Xorg crash when removing an input device

Peter Hutterer mailinglists at who-t.net
Thu Oct 18 18:13:32 PDT 2007

Fabrice Ménard wrote:
> Hi,
> Using input hotplug, I noticed that the server crashes when I remove a device 
> with the following command
> dbus-send --system --type=method_call --print-reply \
>        --dest=org.x.config.display0 /org/x/config/0 org.x.config.input.remove\
>         uint32:X
> (where X is the device number given by listDevices)
> The bug comes from a double freed memory.  When a device is removed 
> DeleteInputDeviceRequest (in xf86Xinput.c) calls RemoveDevice(pDev) then 
> xf86DeleteInput (in xf86Helper.c) and this latter frees something 
> (xfree(pInp)) that has been previously freed by RemoveDevice.
> This proposed patch is ok for me but I don't know if xf86DeleteInput is called 
> outside DeleteInputDeviceRequest (therefore without calling RemoveDevice)

what driver are you using?

More information about the xorg mailing list