probably dup bug 531884 (can't reopen) I use an usb-switch device to switch keyboard+mouse between machines. This has worked fine for 4+ years (even works with fine Windows, except twice as slow). But in Fedora 12 on a new machine I have a problem: *** glibc detected *** /usr/bin/Xorg: free(): invalid pointer: 0x00000000026bc390 *** ======= Backtrace: ========= /lib64/libc.so.6[0x3384674576] /usr/bin/Xorg(XIDeleteAllDeviceProperties+0x33)[0x4e2673] /usr/bin/Xorg[0x425714] /usr/bin/Xorg(RemoveDevice+0x165)[0x426935] /usr/bin/Xorg(DeleteInputDeviceRequest+0x54)[0x479144] /usr/bin/Xorg[0x455c50] /usr/bin/Xorg[0x455cef] /usr/lib64/libhal.so.1[0x339220bb68] /lib64/libdbus-1.so.3(dbus_connection_dispatch+0x336)[0x3389e109d6] /lib64/libdbus-1.so.3[0x3389e10bff] /usr/bin/Xorg[0x4558fb] /usr/bin/Xorg(WakeupHandler+0x4b)[0x43196b] /usr/bin/Xorg(WaitForSomething+0x1d7)[0x45bd97] /usr/bin/Xorg[0x42c3b2] /usr/bin/Xorg[0x421cfa] /lib64/libc.so.6(__libc_start_main+0xfd)[0x338461eb1d] /usr/bin/Xorg[0x4218a9] --- The configuration to reproduce is this computer - switch - hub - keyboard + 2 mice I can reproduce it reliably (<10 switches) with just one mouse without valgrind, but with valgrind I could only reproduce it after adding another mouse. Installation: Fedora 12, x86-64, AMD motherboard+cpu
Created attachment 380607 [details] Xorg log file
Created attachment 380608 [details] valgrind output valgrind seems to crash in this
Created attachment 385448 [details] more valgrind output (better stack traces) Attaching another valgrind output log. This one has more debug info that was previously missing, but I couldn't crash the server again under valgrind (crash easily without). The most relevant log seems to be: ==3808== Invalid write of size 1 ==3808== at 0x4EB6CC: _XkbSetIndicatorMap (xkb.c:3093) ==3808== by 0x4EB933: ProcXkbSetIndicatorMap (xkb.c:3160) ==3808== by 0x42C69B: Dispatch (dispatch.c:445) ==3808== by 0x421CF9: main (main.c:285) ==3808== Address 0x88a8568 is 8 bytes inside a block of size 392 free'd ==3808== at 0x4A04D72: free (vg_replace_malloc.c:325) ==3808== by 0x50AC4E: SrvXkbFreeKeyboard (XKBAlloc.c:289) ==3808== by 0x4FE30D: XkbFreeInfo (xkbInit.c:679) ==3808== by 0x4254C3: FreeDeviceClass (devices.c:671) ==3808== by 0x425656: FreeAllDeviceClasses (devices.c:801) ==3808== by 0x425775: CloseDevice (devices.c:849) ==3808== by 0x426934: RemoveDevice (devices.c:993) ==3808== by 0x479143: DeleteInputDeviceRequest (xf86Xinput.c:671) ==3808== by 0x455C4F: remove_device (hal.c:72) ==3808== by 0x455CEE: device_removed (hal.c:90) ==3808== by 0x339220BB67: filter_func (libhal.c:1067) ==3808== by 0x3389E109D5: dbus_connection_dispatch (dbus-connection.c:4444)
*** This bug has been marked as a duplicate of bug 540584 ***