Bug 89296

Summary: libinput: Xserver crash with suspend/resume
Product: Wayland Reporter: Olivier Fourdan <fourdan>
Component: libinputAssignee: Wayland bug list <wayland-bugs>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: medium CC: fourdan, peter.hutterer
Version: unspecified   
Hardware: Other   
OS: All   
Whiteboard:
i915 platform: i915 features:
Attachments: Reproducer

Description Olivier Fourdan 2015-02-24 08:40:33 UTC
I've noticed that each time I suspend/resume my laptop, I was losing my X session.

Using xorg-x11-server-1.16.3 with libinput-0.11.0 and xf86-input-libinput-0.7.0.

A quick look at the logs reveals that the Xserver crashed because of libinput:

: (II) config/udev: Adding input device Logitech USB-PS/2 Optical Mouse (/dev/input/mouse
: (II) No input driver specified, ignoring this device.
: (II) This device may have been added with another device file.
: (EE)
: (EE) Backtrace:
: (EE) 0: /usr/libexec/Xorg.bin (OsLookupColor+0x119) [0x59c739]
: (EE) 1: /lib64/libc.so.6 (__restore_rt+0x0) [0x7f39c5c2994f]
: (EE) 2: /lib64/libinput.so.7 (libinput_device_config_left_handed_is_available+0x0) [0x7
: (EE) 3: /usr/lib64/xorg/modules/input/libinput_drv.so (_init+0x25c7) [0x7f39be793ca7]
: (EE) 4: /usr/libexec/Xorg.bin (XIChangeDeviceProperty+0x21f) [0x530d4f]
: (EE) 5: /usr/libexec/Xorg.bin (XISetDevicePropertyDeletable+0x278) [0x5315a8]
: (EE) 6: /usr/libexec/Xorg.bin (SendErrorToClient+0x2f7) [0x4391b7]
: (EE) 7: /usr/libexec/Xorg.bin (remove_fs_handlers+0x416) [0x43d316]
: (EE) 8: /lib64/libc.so.6 (__libc_start_main+0xf0) [0x7f39c5c14fe0]
: (EE) 9: /usr/libexec/Xorg.bin (_start+0x29) [0x4276ee]
: (EE) 10: ? (?+0x29) [0x29]
: (EE)
: (EE) Segmentation fault at address 0x68
: (EE)
: Fatal server error:
: (EE) Caught signal 11 (Segmentation fault). Server aborting
: (EE)
: (EE)

This is probably xfce4-settings daemon trying to access a device, as killing the xfsettigsd before suspending the laptop avoids the crash.

Yet, even if one of the client is misbehaving (I am not entirely sure how yet though), the libinput/xf86-input-libinput should not crash and handle the client nicely.
Comment 1 Olivier Fourdan 2015-02-24 08:45:10 UTC
Note that xfce settings daemon uses the left handed property to determine if a device is from libinput, so this is most likely related:

#ifdef HAVE_LIBINPUT
static gboolean
xfce_pointers_is_libinput (Display *xdisplay,
                           XDevice *device)
{
    Atom     prop, type;
    gulong   n_items, bytes_after;
    gint     rc, format;
    guchar  *data;

    prop = XInternAtom (xdisplay, LIBINPUT_PROP_LEFT_HANDED, False);
    gdk_error_trap_push ();
    rc = XGetDeviceProperty (xdisplay, device, prop, 0, 1, False,
                             XA_INTEGER, &type, &format, &n_items,
                             &bytes_after, &data);
    gdk_error_trap_pop ();
    if (rc == Success)
    {
        XFree (data);
        return (n_items > 0);
    }

    return FALSE;
}
#endif /* HAVE_LIBINPUT */
Comment 2 Olivier Fourdan 2015-02-24 13:36:24 UTC
Created attachment 113792 [details]
Reproducer

Simple reproducer, build and run this test program would crash the X server here.
Comment 3 Olivier Fourdan 2015-02-24 13:58:23 UTC
Corresponding backtrace in Xorg:

Program received signal SIGSEGV, Segmentation fault.
libinput_device_config_left_handed_is_available (device=0x0) at libinput.c:1685
1685		if (!device->config.left_handed)
(gdb) p device
$1 = (struct libinput_device *) 0x0
(gdb) bt
#0  libinput_device_config_left_handed_is_available (device=0x0)
    at libinput.c:1685
#1  0x00007f4b2c658e05 in LibinputSetPropertyLeftHanded (
    checkonly=<optimized out>, val=<optimized out>, atom=<optimized out>, 
    dev=<optimized out>) at libinput.c:1473
#2  LibinputSetProperty (dev=<optimized out>, atom=<optimized out>, 
    val=<optimized out>, checkonly=<optimized out>) at libinput.c:1574
#3  0x0000000000530d4f in XIChangeDeviceProperty (dev=0x2211bd0, 
    property=property@entry=275, type=<optimized out>, format=<optimized out>, 
    mode=<optimized out>, len=<optimized out>, value=0x21b46f4, sendevent=1)
    at xiproperty.c:772
#4  0x0000000000531428 in change_property (client=0x2420060, data=0x21b46f4, 
    len=<optimized out>, mode=<optimized out>, format=<optimized out>, 
    type=<optimized out>, property=275, dev=<optimized out>)
    at xiproperty.c:353
#5  ProcXChangeDeviceProperty (client=0x2420060) at xiproperty.c:911
#6  0x0000000000439137 in Dispatch () at dispatch.c:432
#7  0x000000000043d2d6 in dix_main (argc=16, argv=0x7fff251f1bd8, 
    envp=<optimized out>) at main.c:296
#8  0x00007f4b33adcfe0 in __libc_start_main (main=0x4276c0 <main>, argc=16, 
    argv=0x7fff251f1bd8, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fff251f1bc8) at libc-start.c:289
#9  0x00000000004276ee in _start ()
Comment 4 Olivier Fourdan 2015-02-24 14:20:39 UTC
Crash occurs while accessing a specific device "HID 04d9:1400" which is listed as both a keyboard and a pointer device:

15:16 $ xinput
⎡ Virtual core pointer                    	id=2	[master pointer  (3)]
⎜   ↳ Virtual core XTEST pointer              	id=4	[slave  pointer  (2)]
⎜   ↳ Logitech USB-PS/2 Optical Mouse         	id=11	[slave  pointer  (2)]
⎜   ↳ SynPS/2 Synaptics TouchPad              	id=14	[slave  pointer  (2)]
⎜   ↳ TPPS/2 IBM TrackPoint                   	id=15	[slave  pointer  (2)]
⎜   ↳ HID 04d9:1400                           	id=10	[slave  pointer  (2)]
⎣ Virtual core keyboard                   	id=3	[master keyboard (2)]
    ↳ Virtual core XTEST keyboard             	id=5	[slave  keyboard (3)]
    ↳ Power Button                            	id=6	[slave  keyboard (3)]
    ↳ Video Bus                               	id=7	[slave  keyboard (3)]
    ↳ Sleep Button                            	id=8	[slave  keyboard (3)]
    ↳ HID 04d9:1400                           	id=9	[slave  keyboard (3)]
    ↳ Integrated Camera                       	id=12	[slave  keyboard (3)]
    ↳ AT Translated Set 2 keyboard            	id=13	[slave  keyboard (3)]
    ↳ ThinkPad Extra Buttons                  	id=16	[slave  keyboard (3)]

lsusb gives:

Bus 001 Device 025: ID 04d9:1400 Holtek Semiconductor, Inc. PS/2 keyboard + mouse controller
Comment 5 Olivier Fourdan 2015-02-24 14:44:57 UTC
Possible fix http://patchwork.freedesktop.org/patch/43211/ (works for me, but there might be a better fix)
Comment 6 Peter Hutterer 2015-02-25 01:11:44 UTC
Do you have a full Xorg.log? if the libinput device ends up null, you should see an error message.
Comment 7 Peter Hutterer 2015-02-25 05:17:43 UTC
Updated patch: http://patchwork.freedesktop.org/patch/43317/
Comment 8 Peter Hutterer 2015-02-26 07:34:14 UTC
commit 98ae01b9ae8616d3c2047f5510205aa4e3bc52b5
Author: Olivier Fourdan <ofourdan@redhat.com>
Date:   Wed Feb 25 11:49:19 2015 +0100

    Ignore property changes if the device is disabled

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.