Bug 13991 - x11-drivers/xf86-input-evdev-1.2.0 crashes when pressing non-left mouse button
Summary: x11-drivers/xf86-input-evdev-1.2.0 crashes when pressing non-left mouse button
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Input/evdev (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: Zephaniah E. Hull
QA Contact: Xorg Project Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-01-09 08:14 UTC by Aaron
Modified: 2008-01-28 19:54 UTC (History)
5 users (show)

See Also:
i915 platform:
i915 features:


Attachments
b_map_data member was set to size ABS_MAX, instead of BTN_MAX (407 bytes, patch)
2008-01-22 19:00 UTC, Jon Wagoner
no flags Details | Splinter Review

Description Aaron 2008-01-09 08:14:36 UTC
When I press a mouse button other than the left one,
x11-drivers/xf86-input-evdev-1.2.0 crashes. Sadly there is no usable backtrace
or error message in Xorg.0.log.

I don't know if this extra bit of information is of any use, but the
mouse/keyboard combination I'm using is a Logitech Cordless Desktop MX3100.
That uses a common USB reciever for both the mouse and the keyboard.

And this is what Xorg.0.log tells me when detecting the mouse/keyboard:
(Note those 96 mouse buttons? I might find about a dozen... but 96?)

(II) LoadModule: "evdev"
(II) Loading /usr/lib64/xorg/modules/input//evdev_drv.so
(II) Module evdev: vendor="X.Org Foundation"
        compiled for 1.4.0.90, module version = 1.2.0
        Module class: X.Org XInput Driver
        ABI class: X.Org XInput driver, version 2.0
(**) Logitech USB Receiver: always reports core events
(II) Logitech USB Receiver: Found 4 relative axes.
(II) Logitech USB Receiver: Configuring as pointer.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Unable to parse 'null' as a map specifier string.
(EE) Logitech USB Receiver: Button(null)MapTo: Button 96 already claimed.
(EE) Logitech USB Receiver: Unable to parse 'Button 96' as a map specifier.
(II) Logitech USB Receiver: Found 96 mouse buttons
(II) Logitech USB Receiver: Configured 96 mouse buttons.
(**) Option "xkb_model" "evdev"
(**) Option "xkb_layout" "us"
(II) XINPUT: Adding extended input device "Logitech USB Receiver" (type:
KEYBOARD)
(**) Logitech USB Receiver: 2 valuators.
(**) Logitech USB Receiver: Configuring in Absolute mode.
(**) Logitech USB Receiver: Registering 96 buttons.
evdev: leds are 0x0 for device 4
(II) Logitech USB Receiver: Init
(II) Logitech USB Receiver: On
(**) Logitech USB Receiver: always reports core events
(**) Option "xkb_model" "evdev"
(**) Option "xkb_layout" "us"
(II) XINPUT: Adding extended input device "Logitech USB Receiver" (type:
KEYBOARD)
evdev: leds are 0x0 for device 5
(II) Logitech USB Receiver: Init
(II) Logitech USB Receiver: On

If any additional information is needed just ask!
Comment 1 Aaron 2008-01-09 08:32:29 UTC
/proc/bus/input/devices contains those infos about the mouse/keyboard:

I: Bus=0003 Vendor=046d Product=c512 Version=0110
N: Name="Logitech USB Receiver"
P: Phys=usb-0000:00:02.0-4/input0
S: Sysfs=/class/input/input1
U: Uniq=
H: Handlers=kbd event1
B: EV=120003
B: KEY=1000000000007 ff800000000007ff febeffdfffefffff fffffffffffffffe
B: LED=ff1f

I: Bus=0003 Vendor=046d Product=c512 Version=0110
N: Name="Logitech USB Receiver"
P: Phys=usb-0000:00:02.0-4/input1
S: Sysfs=/class/input/input2
U: Uniq=
H: Handlers=kbd mouse0 event2
B: EV=20007
B: KEY=1fffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff 3300007 ff80d8fafd01d000 1f000000000000 0
B: REL=143
B: LED=ff00
Comment 2 Dennis Schridde 2008-01-10 05:55:16 UTC
I am using a similar Mouse/Keyboard combo with single reciever from Logitech,
the LX700 (iirc).
My Xorg.0.log looks exactly the same, except that I have "xkb_layout=de" and
not "us".
Comment 3 Zephaniah E. Hull 2008-01-10 11:08:35 UTC
Daniel:  I'm adding you to the CC list.

Remind me who I need to send what to in order to get Xorg to buy me one of these bloody Logitech units?  I keep having bugs, because they lie through their teeth.
Comment 4 Daniel Stone 2008-01-10 19:27:08 UTC
(In reply to comment #3)
> Daniel:  I'm adding you to the CC list.
> 
> Remind me who I need to send what to in order to get Xorg to buy me one of
> these bloody Logitech units?  I keep having bugs, because they lie through
> their teeth.

Email xf_board@x.org and we'll sort you out.

Comment 5 Bernhard Seibold 2008-01-14 02:26:47 UTC
Same problem here, same Xorg.0.log, just slightly different Logitech device:

I: Bus=0003 Vendor=046d Product=c504 Version=0110
N: Name="Logitech USB Receiver"
P: Phys=usb-0000:00:1a.0-1/input0
S: Sysfs=/class/input/input2
U: Uniq=
H: Handlers=kbd event2 
B: EV=120003
B: KEY=10000 7 ff800000 7ff febeffdf ffefffff ffffffff fffffffe
B: LED=ff1f

I: Bus=0003 Vendor=046d Product=c504 Version=0110
N: Name="Logitech USB Receiver"
P: Phys=usb-0000:00:1a.0-1/input1
S: Sysfs=/class/input/input3
U: Uniq=
H: Handlers=kbd mouse0 event3 
B: EV=20007
B: KEY=1fffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff 0 2000000 1878 d800d000 1e0000 0 0 0
B: REL=30f
B: LED=ff00

Comment 6 Jon Wagoner 2008-01-21 23:09:59 UTC
I am also getting the crashes on middle/right clicks.  I have a Logitech Cordless Elite keyboard, and a Logitech Cordless Optical Trackman, with a single receiver.

I don't know enough to try to fix the problem, but I tried to trace the code to see what was happening.  

It is crashing in EvdevBtnProcess when trying to call the function stored in b_map.

It looks like all three buttons were getting their pEvdev->state->btn->b_map function set to EvdevMapButton in EvdevParseMapToButton, but when EvdevBtnProcess is called, the b_map is set to 81 and 82 for the right and middle clicks, instead of the pointer to EvdevMapButton (the left click still shows the address of EvdevMapButton for the b_map pointer when EvdevBtnProcess is called).
Comment 7 Jon Wagoner 2008-01-21 23:20:40 UTC
Hard-coding EvdevBtnProcess to call EvdevMapButton when it sees those bogus function pointers has all of my buttons working correctly for now.  Is there any other info I can get you to help track this down?
Comment 8 Jon Wagoner 2008-01-22 19:00:38 UTC
Created attachment 13871 [details] [review]
b_map_data member was set to size ABS_MAX, instead of BTN_MAX

b_map_data was sized as ABS_MAX instead of BTN_MAX.  When evdev was iterating through the higher buttons on the mouse, it was writing past the end of b_map_data, and overwriting some of the b_map pointers.
Comment 9 Dennis Schridde 2008-01-23 12:54:59 UTC
Confirming: Patch works. Thanks a lot!
Comment 10 Peter Hutterer 2008-01-28 19:54:05 UTC
pushed as 5adbc6b98ca1da9a426528ce0df64a992feff3bd. Thanks.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.