Commit 2f1aedcaed8fd99b823d451bf1fb02330c078f67 added several bug checks. Some of them are not correct.
Checks in Init(Ptr|String|Bell|Led|Integer)FeedbackClassDeviceStruct verify that no feedback struct was set yet, but that is not required. If any feedback structs are already present, the function will chain them behind the new one. Signed-off-by: Michal Srb <[email protected]> --- Presence of this check caused crashes in Xen. The virtual pointer there has both relative and absolute axis. InitPtrFeedbackClassDeviceStruct got called twice, first from EvdevAddRelValuatorClass then from EvdevAddAbsValuatorClass. The second call fails because of this bug check which makes EvdevAddAbsValuatorClass revert some EvdevPtr members to zero. That leads to crashes later when absolute events came for processing. diff --git a/dix/devices.c b/dix/devices.c index ab923d5..73f60f4 100644 --- a/dix/devices.c +++ b/dix/devices.c @@ -1475,7 +1475,6 @@ InitPtrFeedbackClassDeviceStruct(DeviceIntPtr dev, PtrCtrlProcPtr controlProc) PtrFeedbackPtr feedc; BUG_RETURN_VAL(dev == NULL, FALSE); - BUG_RETURN_VAL(dev->ptrfeed != NULL, FALSE); feedc = malloc(sizeof(PtrFeedbackClassRec)); if (!feedc) @@ -1519,7 +1518,6 @@ InitStringFeedbackClassDeviceStruct(DeviceIntPtr dev, StringFeedbackPtr feedc; BUG_RETURN_VAL(dev == NULL, FALSE); - BUG_RETURN_VAL(dev->stringfeed != NULL, FALSE); feedc = malloc(sizeof(StringFeedbackClassRec)); if (!feedc) @@ -1556,7 +1554,6 @@ InitBellFeedbackClassDeviceStruct(DeviceIntPtr dev, BellProcPtr bellProc, BellFeedbackPtr feedc; BUG_RETURN_VAL(dev == NULL, FALSE); - BUG_RETURN_VAL(dev->bell != NULL, FALSE); feedc = malloc(sizeof(BellFeedbackClassRec)); if (!feedc) @@ -1578,7 +1575,6 @@ InitLedFeedbackClassDeviceStruct(DeviceIntPtr dev, LedCtrlProcPtr controlProc) LedFeedbackPtr feedc; BUG_RETURN_VAL(dev == NULL, FALSE); - BUG_RETURN_VAL(dev->leds != NULL, FALSE); feedc = malloc(sizeof(LedFeedbackClassRec)); if (!feedc) @@ -1601,7 +1597,6 @@ InitIntegerFeedbackClassDeviceStruct(DeviceIntPtr dev, IntegerFeedbackPtr feedc; BUG_RETURN_VAL(dev == NULL, FALSE); - BUG_RETURN_VAL(dev->intfeed != NULL, FALSE); feedc = malloc(sizeof(IntegerFeedbackClassRec)); if (!feedc) _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
