Bug 1535755 - First stylus event causes libinput crash in tablet_update_artpen_rotation()
Summary: First stylus event causes libinput crash in tablet_update_artpen_rotation()
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: libinput
Version: 26
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Peter Hutterer
QA Contact: Fedora Extras Quality Assurance
URL: https://retrace.fedoraproject.org/faf...
Whiteboard: abrt_hash:079b81718618ad80c57f3608946...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-01-18 02:08 UTC by Martin Kolman
Modified: 2018-02-20 16:38 UTC (History)
13 users (show)

Fixed In Version: libinput-1.9.4-3.fc26
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-02-20 16:38:53 UTC
Type: ---


Attachments (Terms of Use)
File: backtrace (122.63 KB, text/plain)
2018-01-18 02:08 UTC, Martin Kolman
no flags Details
File: cgroup (195 bytes, text/plain)
2018-01-18 02:08 UTC, Martin Kolman
no flags Details
File: core_backtrace (4.16 KB, text/plain)
2018-01-18 02:08 UTC, Martin Kolman
no flags Details
File: cpuinfo (1.18 KB, text/plain)
2018-01-18 02:08 UTC, Martin Kolman
no flags Details
File: dso_list (6.78 KB, text/plain)
2018-01-18 02:08 UTC, Martin Kolman
no flags Details
File: environ (556 bytes, text/plain)
2018-01-18 02:08 UTC, Martin Kolman
no flags Details
File: exploitable (95 bytes, text/plain)
2018-01-18 02:08 UTC, Martin Kolman
no flags Details
File: limits (1.29 KB, text/plain)
2018-01-18 02:08 UTC, Martin Kolman
no flags Details
File: maps (34.77 KB, text/plain)
2018-01-18 02:08 UTC, Martin Kolman
no flags Details
File: open_fds (6.70 KB, text/plain)
2018-01-18 02:09 UTC, Martin Kolman
no flags Details
File: proc_pid_status (1.28 KB, text/plain)
2018-01-18 02:09 UTC, Martin Kolman
no flags Details
File: var_log_messages (28 bytes, text/plain)
2018-01-18 02:09 UTC, Martin Kolman
no flags Details
evemu-record of using the aiptek tablet (81.25 KB, text/plain)
2018-01-18 10:24 UTC, Martin Kolman
no flags Details
evemu-record log started before the pen toched the tablet and ended after it left its sphere of influence (151.90 KB, text/plain)
2018-02-01 12:44 UTC, Martin Kolman
no flags Details
evemu-record log of the pen never leaving the tablet (132.97 KB, text/plain)
2018-02-01 12:46 UTC, Martin Kolman
no flags Details


Links
System ID Private Priority Status Summary Last Updated
FreeDesktop.org 104939 0 None None None 2018-02-05 06:39:03 UTC

Description Martin Kolman 2018-01-18 02:08:35 UTC
Description of problem:
I've recently obtained a Trust TB-4200 Wireless Scroll Tablet (Aiptek based) and 
have been looking into getting it to work with libinput (this is being tracked as
https://bugs.freedesktop.org/show_bug.cgi?id=103476). This more or less boils down
to adding a hwdb entry that matches on the tablet and sets correct size.

But interestingly enough, while my current testing local hwdb entry does make libinput
detect and use the tablet, X crashes imediately once I try to touch the tablet with the stylus (!).


Steps to reproduce the issue
1. add the following into the /etc/udev/hwdb.d/61-evdev-local.hwdb file:

#########################################
# Trust
#########################################

# Trust Wireless Scroll Tablet TB-4200
# (Aiptek based ?)
evdev:input:b0003v08CAp0010*
 EVDEV_ABS_00=::26
 EVDEV_ABS_01=::15

2. run as root:

systemd-hwdb update
udevadm trigger /dev/input/event*

3. connect the tablet and note its detected and setup by libinput (it's logged in Journal):

led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) config/udev: Adding input device Aiptek (/dev/input/mouse4)
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (**) Aiptek: Applying InputClass "system-keyboard"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) No input driver specified, ignoring this device.
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) This device may have been added with another device file.
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (II) config/udev: Adding input device Aiptek (/dev/input/mouse4)
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (**) Aiptek: Applying InputClass "system-keyboard"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (II) No input driver specified, ignoring this device.
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (II) This device may have been added with another device file.
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) config/udev: Adding input device Aiptek (/dev/input/event18)
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (**) Aiptek: Applying InputClass "evdev pointer catchall"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (**) Aiptek: Applying InputClass "evdev keyboard catchall"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (**) Aiptek: Applying InputClass "evdev tablet catchall"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (**) Aiptek: Applying InputClass "libinput pointer catchall"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (**) Aiptek: Applying InputClass "libinput keyboard catchall"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (**) Aiptek: Applying InputClass "libinput tablet catchall"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (**) Aiptek: Applying InputClass "system-keyboard"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) Using input driver 'libinput' for 'Aiptek'
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) systemd-logind: got fd for /dev/input/event18 13:82 fd 66 paused 0
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (**) Aiptek: always reports core events
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (**) Option "Device" "/dev/input/event18"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (**) Option "_source" "server/udev"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) event18 - (II) Aiptek: (II) is tagged by udev as: Keyboard Mouse Tablet
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (II) config/udev: Adding input device Aiptek (/dev/input/event18)
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (**) Aiptek: Applying InputClass "evdev pointer catchall"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (**) Aiptek: Applying InputClass "evdev keyboard catchall"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (**) Aiptek: Applying InputClass "evdev tablet catchall"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (**) Aiptek: Applying InputClass "libinput pointer catchall"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (**) Aiptek: Applying InputClass "libinput keyboard catchall"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (**) Aiptek: Applying InputClass "libinput tablet catchall"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (**) Aiptek: Applying InputClass "system-keyboard"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (II) Using input driver 'libinput' for 'Aiptek'
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (II) systemd-logind: got fd for /dev/input/event18 13:82 fd 24 paused 1
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[1384]: (II) systemd-logind: releasing fd for 13:82
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) event18 - (II) Aiptek: (II) tablet 'Aiptek' unknown to libwacom
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) event18 - (II) Aiptek: (II) device is a tablet
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) event18 - (II) Aiptek: (II) device removed
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (**) Option "config_info" "udev:/sys/devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.1/1-1.1:1.0/input/input24/event18"
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) XINPUT: Adding extended input device "Aiptek" (type: TABLET, id 19)
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) event18 - (II) Aiptek: (II) is tagged by udev as: Keyboard Mouse Tablet
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) event18 - (II) Aiptek: (II) tablet 'Aiptek' unknown to libwacom
led 18 02:44:59 localhost.localdomain /usr/libexec/gdm-x-session[2234]: (II) event18 - (II) Aiptek: (II) device is a tablet

4. try to touch the tablet with the stylus - trying to draw a short line is enough

5. X crashes

As for reproducibility - I've just had this happen two times in a row. Each time I got dumped to GDM and was able to reproduce it just by logging back in and touching the tablet with the stylus.

Version-Release number of selected component:
xorg-x11-server-Xorg-1.19.3-4.fc26

Additional info:
reporter:       libreport-2.9.1
backtrace_rating: 4
cmdline:        /usr/libexec/Xorg vt2 -displayfd 3 -auth /run/user/1000/gdm/Xauthority -nolisten tcp -background none -noreset -keeptty -verbose 3
crash_function: tablet_update_artpen_rotation
executable:     /usr/libexec/Xorg
journald_cursor: s=24a4982d27604ec2b64aad53527975d2;i=2a7f;b=f0c88338f0474d0c841603e4215f5432;m=17d94f0ee;t=5630322f8f10b;x=1bc45e51050262cd
kernel:         4.13.5-200.fc26.x86_64
rootdir:        /
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 tablet_update_artpen_rotation at ../src/evdev-tablet.c:533
 #1 tablet_update_rotation at ../src/evdev-tablet.c:570
 #2 tablet_check_notify_axes at ../src/evdev-tablet.c:645
 #3 tablet_send_events at ../src/evdev-tablet.c:1534
 #4 tablet_flush at ../src/evdev-tablet.c:1595
 #5 tablet_process at ../src/evdev-tablet.c:1767
 #6 evdev_device_dispatch at ../src/evdev.c:830
 #7 libinput_dispatch at ../src/libinput.c:1988
 #8 xf86libinput_read_input at xf86libinput.c:2187
 #9 InputReady at inputthread.c:180

Comment 1 Martin Kolman 2018-01-18 02:08:44 UTC
Created attachment 1382699 [details]
File: backtrace

Comment 2 Martin Kolman 2018-01-18 02:08:46 UTC
Created attachment 1382700 [details]
File: cgroup

Comment 3 Martin Kolman 2018-01-18 02:08:47 UTC
Created attachment 1382701 [details]
File: core_backtrace

Comment 4 Martin Kolman 2018-01-18 02:08:49 UTC
Created attachment 1382702 [details]
File: cpuinfo

Comment 5 Martin Kolman 2018-01-18 02:08:51 UTC
Created attachment 1382703 [details]
File: dso_list

Comment 6 Martin Kolman 2018-01-18 02:08:52 UTC
Created attachment 1382704 [details]
File: environ

Comment 7 Martin Kolman 2018-01-18 02:08:54 UTC
Created attachment 1382705 [details]
File: exploitable

Comment 8 Martin Kolman 2018-01-18 02:08:56 UTC
Created attachment 1382706 [details]
File: limits

Comment 9 Martin Kolman 2018-01-18 02:08:58 UTC
Created attachment 1382707 [details]
File: maps

Comment 10 Martin Kolman 2018-01-18 02:09:00 UTC
Created attachment 1382708 [details]
File: open_fds

Comment 11 Martin Kolman 2018-01-18 02:09:01 UTC
Created attachment 1382709 [details]
File: proc_pid_status

Comment 12 Martin Kolman 2018-01-18 02:09:03 UTC
Created attachment 1382710 [details]
File: var_log_messages

Comment 13 Peter Hutterer 2018-01-18 02:52:55 UTC
This looks like a libinput bug, can you verify this happens when you run sudo libinput debug-events from the tty?

Best way for me to reproduce this is to have an evemu-record of the interaction that crashed it.

Comment 14 Martin Kolman 2018-01-18 10:24:22 UTC
Created attachment 1382848 [details]
evemu-record of using the aiptek tablet

Comment 15 Martin Kolman 2018-01-18 10:25:29 UTC
(In reply to Peter Hutterer from comment #13)
> This looks like a libinput bug, can you verify this happens when you run
> sudo libinput debug-events from the tty?
Yep - when I run it on a tty and touch the tablet with the stylus, it immediately segfaults (Segmentation fault).
> 
> Best way for me to reproduce this is to have an evemu-record of the
> interaction that crashed it.
Attached a short interaction log (drawing on the tablet with the stylus) as comment 14.

Comment 16 Peter Hutterer 2018-01-19 06:36:34 UTC
Was this recording from a neutral position? When I replay it here it doesn't crash but judging by the event sequence this was started when the pen was already in proximity of the tablet? If that's the case, please re-record, starting evemu before the pen is in proximity and stopping it after the pen left proximity again.

Comment 17 Peter Hutterer 2018-01-28 22:07:18 UTC
ping?

Comment 18 Martin Kolman 2018-01-29 12:20:00 UTC
(In reply to Peter Hutterer from comment #17)
> ping?

Sorry, I was rather busy due to DevConf & related events. But I should be be able to do the recording in the next few days.

Comment 19 Martin Kolman 2018-02-01 12:44:15 UTC
Created attachment 1389477 [details]
evemu-record log started before the pen toched the tablet and ended after it left its sphere of influence

I recorded the log like this:

1) switched to a tty
2) connected the tablet
3) started recording while the pen was far from the tablet
4) moved the pen on tablet and startet to draw on it
5) moved the pen away from the tablet
6) stopped recording

Comment 20 Martin Kolman 2018-02-01 12:46:32 UTC
Created attachment 1389478 [details]
evemu-record log of the pen never leaving the tablet

For comparison with the previous log I've recorded a log, where the pen never leaves the tablet:

1) switched to tty
2) connected the tablet
3) touched the tablet with the pen
4) started recording
5) drawn something on the tablet
6) stopped recording while the pen was still touching the tablet

Comment 21 Peter Hutterer 2018-02-02 02:02:02 UTC
I tested libinput 1.9.1, 1.9.4 and git master, none of them reproduce the crash. And none of them send events but that's because BTN_TOOL_PEN is never sent. What version of libinput are you using here? What other configuration do you have in place?

I found the place where it crashes even though I can't figure out the event sequence that actually causes it to crash. To paper over this, please test this scratch build: https://koji.fedoraproject.org/koji/taskinfo?taskID=24634583

The result of that will be that you don't get any events from the tablet, though that's already the case here anyway. Lemme know if that fixes the crash though, thanks.

Comment 22 Peter Hutterer 2018-02-02 06:01:43 UTC
Ok, I think I found the issue while working on something else, but it's friday evening so consider this a brain dump only :)

There's a mixup between BTN_TOOL_MOUSE and BTN_TOOL_AIRBRUSH in that we set the rotation axis inside libinput (because we have BTN_TOOL_MOUSE and ABS_TILT_X/Y). But then when checking for the axis, the tool type isn't set to MOUSE or LENS so we fall back on the regular tablet_update_artpen_rotation() check. That requires ABS_Z which doesn't exist on the device and boom, here's your NULL-pointer dereference. 

This happens on the first event because that's when we have to update all axes with the current value so the caller has the right information. Definitely a bug in libinput.

Comment 23 Peter Hutterer 2018-02-05 06:39:03 UTC
Upstream bug is now: https://bugs.freedesktop.org/show_bug.cgi?id=104939

Comment 24 Fedora Update System 2018-02-06 01:23:05 UTC
libinput-1.9.4-2.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2018-162d48a296

Comment 25 Fedora Update System 2018-02-06 12:05:16 UTC
libinput-1.9.4-2.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-162d48a296

Comment 26 Peter Hutterer 2018-02-07 00:09:56 UTC
fwiw, I'm holiding back the libinput 1.10 release for this patch, please let me know if it fixes the issue. It'll only fix the crash, the tablet won't work because of other bugs. But hey, that's an improvement already ;)

Comment 27 Martin Kolman 2018-02-08 14:30:04 UTC
(In reply to Peter Hutterer from comment #26)
> fwiw, I'm holiding back the libinput 1.10 release for this patch, please let
> me know if it fixes the issue. It'll only fix the crash, the tablet won't
> work because of other bugs. But hey, that's an improvement already ;)

Sure, I'll try it out later today (later due to the crashes-your-session issue and I need my session till then :) ).

Comment 28 Martin Kolman 2018-02-09 01:05:51 UTC
So I figured out I can basically test this on a TTY without the danger of crashing my session.

So I've tried it on a TTY with:

libinput debug-events

Then connecting the Aiptek tablet and drawing on it with the pen. That always crashed libinput before with libinput-1.9.0-1.fc26.x86_64 (segmentation fault), but it no longer happens and I get a stream of events instead when the pan is drawing on the tablet.

So the update seems to work and fixes the crash (and I gave it positive karma). :)

Comment 29 Peter Hutterer 2018-02-09 02:29:50 UTC
Thanks! Will merge this into the 1.10 release

Comment 30 Fedora Update System 2018-02-13 04:45:38 UTC
libinput-1.9.4-3.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2018-bdea546d95

Comment 31 Fedora Update System 2018-02-13 16:22:07 UTC
libinput-1.9.4-3.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-bdea546d95

Comment 32 Fedora Update System 2018-02-20 16:38:53 UTC
libinput-1.9.4-3.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.