[PATCH libinput] Do not abort on invalid speed.

[Olivier Fourdan]

Hey Peter,

On 05/02/15 02:30, Peter Hutterer wrote:
> On Wed, Feb 04, 2015 at 04:45:37PM -0500, Olivier Fourdan wrote:
>> Hi Peter,
>>
>> Just to clarify, evdev_accel_config_set_speed() calls filter_set_speed()
>> which calls accelerator_set_speed() which reaches the assert().
>>
>> My patch basically removes the assert() and replaces it by a return false
>> so that it fails gracefully.
>
> yeah, I understand that bit but I don't know is how you get here. the
> xorg libinput driver calls libinput_device_config_accel_set_speed() which
> has the range check. This should be the only entry point for
> evdev_accel_config_set_speed() so really, this assert should never trigger.
>
> I tried triggering this through xinput set-prop and it seems to work as
> expected with the random values I tried. Can you attach gdb to see the
> callstack of how you get there?

Sure, took me a while to reproduce because I had the re-introduce the 
bug in my code, but it goes like that:

#0 raise ()
#1 abort ()
#2 __assert_fail_base ()
#3 __assert_fail ()
#4 accelerator_set_speed () at filter.c:263
#5 evdev_accel_config_set_speed () at evdev.c:1197
#6 LibinputApplyConfig () at libinput.c:238
#7 LibinputSetProperty () at libinput.c:1582
#8 XIChangeDeviceProperty () at xiproperty.c:772
#9 change_property () at xiproperty.c:353
#10 ProcXChangeDeviceProperty () at xiproperty.c:911
#11 Dispatch () at dispatch.c:432
#12 dix_main () at main.c:296

(Full backtrace attached).

Note, it does not go through libinput_device_config_accel_set_speed() 
but via evdev_accel_config_set_speed() which does not check for the 
range before reaching the assert().

Cheers,
Olivier
-------------- next part --------------
Program received signal SIGABRT, Aborted.
0x00007f9d315318c7 in raise () from /lib64/libc.so.6
(gdb) bt
#0  0x00007f9d315318c7 in raise () from /lib64/libc.so.6
#1  0x00007f9d3153352a in abort () from /lib64/libc.so.6
#2  0x00007f9d3152a46d in __assert_fail_base () from /lib64/libc.so.6
#3  0x00007f9d3152a522 in __assert_fail () from /lib64/libc.so.6
#4  0x00007f9d29e8da80 in accelerator_set_speed (filter=<optimized out>, speed=<optimized out>) at filter.c:263
#5  0x00007f9d29e856d0 in evdev_accel_config_set_speed (device=<optimized out>, speed=<optimized out>) at evdev.c:1197
#6  0x00007f9d2a09ab21 in LibinputApplyConfig (dev=<optimized out>) at libinput.c:238
#7  LibinputSetProperty (dev=<optimized out>, atom=<optimized out>, val=<optimized out>, checkonly=<optimized out>) at libinput.c:1582
#8  0x0000000000530d4f in XIChangeDeviceProperty (dev=0x2eb6e20, property=property at entry=273, type=<optimized out>, format=<optimized out>, 
    mode=<optimized out>, len=<optimized out>, value=0x328da34, sendevent=1) at xiproperty.c:772
#9  0x0000000000531428 in change_property (client=0x3280bf0, data=0x328da34, len=<optimized out>, mode=<optimized out>, format=<optimized out>, 
    type=<optimized out>, property=273, dev=<optimized out>) at xiproperty.c:353
#10 ProcXChangeDeviceProperty (client=0x3280bf0) at xiproperty.c:911
#11 0x0000000000439137 in Dispatch () at dispatch.c:432
#12 0x000000000043d2d6 in dix_main (argc=16, argv=0x7fff6cc644e8, envp=<optimized out>) at main.c:296
#13 0x00007f9d3151cfe0 in __libc_start_main () from /lib64/libc.so.6
#14 0x00000000004276ee in _start ()
(gdb) bt full
#0  0x00007f9d315318c7 in raise () from /lib64/libc.so.6
No symbol table info available.
#1  0x00007f9d3153352a in abort () from /lib64/libc.so.6
No symbol table info available.
#2  0x00007f9d3152a46d in __assert_fail_base () from /lib64/libc.so.6
No symbol table info available.
#3  0x00007f9d3152a522 in __assert_fail () from /lib64/libc.so.6
No symbol table info available.
#4  0x00007f9d29e8da80 in accelerator_set_speed (filter=<optimized out>, speed=<optimized out>) at filter.c:263
        filter = <optimized out>
        speed = <optimized out>
        accel_filter = <optimized out>
#5  0x00007f9d29e856d0 in evdev_accel_config_set_speed (device=<optimized out>, speed=<optimized out>) at evdev.c:1197
        dev = <optimized out>
#6  0x00007f9d2a09ab21 in LibinputApplyConfig (dev=<optimized out>) at libinput.c:238
        pInfo = 0x2eb2850
        driver_data = 0x2eb2bd0
        device = 0x2ebac50
        scroll_button = <optimized out>
#7  LibinputSetProperty (dev=<optimized out>, atom=<optimized out>, val=<optimized out>, checkonly=<optimized out>) at libinput.c:1582
        rc = 0
#8  0x0000000000530d4f in XIChangeDeviceProperty (dev=0x2eb6e20, property=property at entry=273, type=<optimized out>, format=<optimized out>, 
    mode=<optimized out>, len=<optimized out>, value=0x328da34, sendevent=1) at xiproperty.c:772
        handler = 0x2eb98a0
        checkonly = <optimized out>
        new_data = <optimized out>
        old_data = <optimized out>
        prop = 0x2eb9580
        size_in_bytes = <optimized out>
        total_size = <optimized out>
        total_len = <optimized out>
        prop_value = <optimized out>
        new_value = {type = 140, format = 32, size = 1, data = 0x2eb96f0}
        add = <optimized out>
        rc = <optimized out>
#9  0x0000000000531428 in change_property (client=0x3280bf0, data=0x328da34, len=<optimized out>, mode=<optimized out>, format=<optimized out>, 
    type=<optimized out>, property=273, dev=<optimized out>) at xiproperty.c:353
        rc = 0
#10 ProcXChangeDeviceProperty (client=0x3280bf0) at xiproperty.c:911
        stuff = 0x328da20
---Type <return> to continue, or q <return> to quit---
        dev = 0x2eb6e20
        len = <optimized out>
        totalSize = <optimized out>
        rc = <optimized out>
#11 0x0000000000439137 in Dispatch () at dispatch.c:432
        clientReady = 0x2e6b8e0
        result = <optimized out>
        client = 0x3280bf0
        nready = 0
        icheck = 0x832e10 <checkForInput>
        start_tick = 395
#12 0x000000000043d2d6 in dix_main (argc=16, argv=0x7fff6cc644e8, envp=<optimized out>) at main.c:296
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#13 0x00007f9d3151cfe0 in __libc_start_main () from /lib64/libc.so.6
No symbol table info available.
#14 0x00000000004276ee in _start ()
No symbol table info available.
(gdb)