Bug 105761

In a multiseat enviroment with two Xorg servers running with latest redhat xorg-x11-server-Xorg-1.19.3-11.el7_4.2.x86_64.rpm the Xorg crashes with a segmentation fault.

Change Log:
2018-02-21 Adam Jackson <ajax@redhat.com> - 1.19.3-11.2
    - Fix fetching animated cursor images with the XFIXES extension

We have no segmentation fault with older redhat xorg-x11-server-Xorg releases.

/usr/bin/X +iglx -ac -br -audit 0 -isolateDevice PCI:1:0:0 :0 -layout seat0 -seat seat0 -auth /var/run/lightdm/root/:0 -listen tcp vt1 -novtswitch
/usr/bin/X +iglx -ac -br -audit 0 -isolateDevice PCI:3:0:0 -sharevts :1 -layout seat1 -seat seat1 -auth /var/run/lightdm/root/:1 -listen tcp

# xinput
⎡ Virtual core pointer                          id=2    [master pointer  (3)]
⎜   ↳ Virtual core XTEST pointer                id=4    [slave  pointer  (2)]
⎜   ↳ Mouse5                                    id=6    [slave  pointer  (2)]
⎜   ↳ Keyboard2                                 id=7    [slave  pointer  (2)]
⎜   ↳ EloTouchSystems,Inc Elo TouchSystems 2216 AccuTouch® USB Touchmonitor Interface   id=8    [slave  pointer  (2)]
⎜   ↳ EloTouchSystems,Inc Elo TouchSystems 2216 AccuTouch® USB Touchmonitor Interface   id=9    [slave  pointer  (2)]
⎜   ↳ EloTouchSystems,Inc Elo TouchSystems 2216 AccuTouch® USB Touchmonitor Interface   id=10   [slave  pointer  (2)]
⎣ Virtual core keyboard                         id=3    [master keyboard (2)]
    ↳ Virtual core XTEST keyboard               id=5    [slave  keyboard (3)]


# echo '3-4' | tee /sys/bus/usb/drivers/usb/unbind

# xinput
⎡ Virtual core pointer                          id=2    [master pointer  (3)]
⎜   ↳ Virtual core XTEST pointer                id=4    [slave  pointer  (2)]
⎜   ↳ Mouse5                                    id=6    [slave  pointer  (2)]
⎜   ↳ Keyboard2                                 id=7    [slave  pointer  (2)]
⎣ Virtual core keyboard                         id=3    [master keyboard (2)]
    ↳ Virtual core XTEST keyboard               id=5    [slave  keyboard (3)]

# echo '3-4' | tee /sys/bus/usb/drivers/usb/bind


Program received signal SIGSEGV, Segmentation fault.
0x000055cc1cb47b24 in AnimCurCancelTimer (pDev=<optimized out>)
    at animcur.c:159
159         CursorPtr cur = pDev->spriteInfo->sprite->current;
#0  0x000055cc1cb47b24 in AnimCurCancelTimer (pDev=<optimized out>)
    at animcur.c:159
        cur = <optimized out>
#1  0x000055cc1cb480fd in AnimCurDisplayCursor (pDev=0x55cc1f177ce0,
    pScreen=0x55cc1e971380, pCursor=0x0) at animcur.c:196
        ret = 1
#2  0x000055cc1ca652cb in RemoveDevice (dev=dev@entry=0x55cc1f177ce0,
    sendevent=sendevent@entry=1 '\001') at devices.c:1159
        prev = <optimized out>
        tmp = <optimized out>
        next = <optimized out>
        ret = 8
        screen = 0x55cc1e971380
        deviceid = 11
        initialized = 1
        flags = {0 <repeats 40 times>}
#3  0x000055cc1cabb3b2 in DeleteInputDeviceRequest (pDev=0x55cc1f177ce0)
    at xf86Xinput.c:1111
        pInfo = 0x0
        drv = 0x0
        isMaster = 484936056
#4  0x000055cc1ca604ac in CloseDeviceList (
    listHead=listHead@entry=0x55cc1ce6f830 <inputInfo+16>) at devices.c:1041
        freedIds = {0 <repeats 11 times>, 1, 0 <repeats 28 times>}
        dev = <optimized out>
#5  0x000055cc1ca6102a in CloseDownDevices () at devices.c:1071
        dev = 0x0
#6  0x000055cc1ca7030c in dix_main (argc=16, argv=0x7fff4ac55678,
    envp=<optimized out>) at main.c:317
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#7  0x00007fa065c22c05 in __libc_start_main () from /lib64/libc.so.6
No symbol table info available.
#8  0x000055cc1ca5a39e in _start ()
No symbol table info available.
(EE)
(EE) Backtrace:
(EE) 0: /usr/bin/Xorg (xorg_backtrace+0x55) [0x55cc1cbc6485]
(EE) 1: /usr/bin/Xorg (0x55cc1ca18000+0x1b2199) [0x55cc1cbca199]
(EE) 2: /lib64/libpthread.so.0 (0x7fa065fc4000+0xf5e0) [0x7fa065fd35e0]
(EE) 3: /usr/bin/Xorg (0x55cc1ca18000+0x12fb24) [0x55cc1cb47b24]
(EE) 4: /usr/bin/Xorg (0x55cc1ca18000+0x1300fd) [0x55cc1cb480fd]
(EE) 5: /usr/bin/Xorg (RemoveDevice+0x25b) [0x55cc1ca652cb]
(EE) 6: /usr/bin/Xorg (DeleteInputDeviceRequest+0x92) [0x55cc1cabb3b2]
(EE) 7: /usr/bin/Xorg (0x55cc1ca18000+0x484ac) [0x55cc1ca604ac]
(EE) 8: /usr/bin/Xorg (0x55cc1ca18000+0x4902a) [0x55cc1ca6102a]
(EE) 9: /usr/bin/Xorg (0x55cc1ca18000+0x5830c) [0x55cc1ca7030c]
(EE) 10: /lib64/libc.so.6 (__libc_start_main+0xf5) [0x7fa065c22c05]
(EE) 11: /usr/bin/Xorg (0x55cc1ca18000+0x4239e) [0x55cc1ca5a39e]
(EE)
(EE) Segmentation fault at address 0x0
(EE)
Fatal server error:
(EE) Caught signal 11 (Segmentation fault). Server aborting
(EE)
(EE)
Please consult the The X.Org Foundation support
         at http://wiki.x.org
 for help.
(EE) Please also check the log file at "/var/log/Xorg.1.log" for additional information.
(EE)
(EE) Server terminated with error (1). Closing log file.