Xorg crashed with SIGSEGV in _start()

#0 XISendDeviceHierarchyEvent (flags=0xbfa27e1c) at ../../Xi/xichangehierarchy.c:73
        ev = 0x0
        info = <value optimized out>
        dummyDev = {public = {devicePrivate = 0x0, processInputProc = 0, realInputProc = 0,
            enqueueInputProc = 0, on = 0}, next = 0x0, startup = 0, deviceProc = 0, inited = 0,
          enabled = 0, coreEvents = 0, deviceGrab = {grabTime = {months = 0, milliseconds = 0},
            fromPassiveGrab = 0, implicitGrab = 0, activeGrab = {next = 0x0, resource = 0,
              device = 0x0, window = 0x0, ownerEvents = 0, keyboardMode = 0, pointerMode = 0,
              grabtype = GRABTYPE_CORE, type = 0 '\000', modifiersDetail = {exact = 0, pMask = 0x0},
              modifierDevice = 0x0, detail = {exact = 0, pMask = 0x0}, confineTo = 0x0, cursor = 0x0,
              eventMask = 0, deviceMask = 0, xi2mask = {"\000\000" <repeats 42 times>}}, grab = 0x0,
            activatingKey = 0 '\000', ActivateGrab = 0, DeactivateGrab = 0, sync = {frozen = 0,
              state = 0, other = 0x0, event = 0x0}}, type = 0, xinput_type = 0, name = 0x0, id = 0,
          key = 0x0, valuator = 0x0, button = 0x0, focus = 0x0, proximity = 0x0, absolute = 0x0,
          kbdfeed = 0x0, ptrfeed = 0x0, intfeed = 0x0, stringfeed = 0x0, bell = 0x0, leds = 0x0,
          xkb_interest = 0x0, config_info = 0x0, unused_classes = 0x0, saved_master_id = 0,
          devPrivates = 0x0, unwrapProc = 0, spriteInfo = 0x0, u = {master = 0x0, lastSlave = 0x0},
          last = {valuators = {0 <repeats 36 times>}, remainder = {0 <repeats 36 times>},
            numValuators = 0, slave = 0x0}, properties = {properties = 0x0, handlers = 0x0},
          transform = {m = {{0, 0, 0}, {0, 0, 0}, {0, 6.239361907117234e-287,
                2.1792897639592041e-311}}}, xtest_master_id = 164071608}
        dev = <value optimized out>
        i = <value optimized out>
#1 0x08066f94 in DisableDevice (dev=0x9d371b0, sendevent=1 '\001') at ../../dix/devices.c:507
        prev = <value optimized out>
        other = <value optimized out>
        enabled = 0 '\000'
        flags = {0, 0, 0, 0, 128, 0 <repeats 35 times>}
---Type <return> to continue, or q <return> to quit--- q
Quit
(gdb) bt full
#0 XISendDeviceHierarchyEvent (flags=0xbfa27e1c) at ../../Xi/xichangehierarchy.c:73
        ev = 0x0
        info = <value optimized out>
        dummyDev = {public = {devicePrivate = 0x0, processInputProc = 0, realInputProc = 0,
            enqueueInputProc = 0, on = 0}, next = 0x0, startup = 0, deviceProc = 0, inited = 0,
          enabled = 0, coreEvents = 0, deviceGrab = {grabTime = {months = 0, milliseconds = 0},
            fromPassiveGrab = 0, implicitGrab = 0, activeGrab = {next = 0x0, resource = 0,
              device = 0x0, window = 0x0, ownerEvents = 0, keyboardMode = 0, pointerMode = 0,
              grabtype = GRABTYPE_CORE, type = 0 '\000', modifiersDetail = {exact = 0, pMask = 0x0},
              modifierDevice = 0x0, detail = {exact = 0, pMask = 0x0}, confineTo = 0x0, cursor = 0x0,
              eventMask = 0, deviceMask = 0, xi2mask = {"\000\000" <repeats 42 times>}}, grab = 0x0,
            activatingKey = 0 '\000'...

StacktraceTop:
 XISendDeviceHierarchyEvent (flags=0xbfa27e1c)
 DisableDevice (dev=0x9d371b0, sendevent=1 '\001')
 ?? ()

Sorry, that was a horrible paste.

The crash is an out-of-memory situation. In the first call, XISendDeviceHierarchyEvent() dereferences calloc'd memory without checking the pointer:

void XISendDeviceHierarchyEvent(int flags[MAXDEVICES])
{
...
    ev = calloc(1, sizeof(xXIHierarchyEvent) +
                 MAXDEVICES * sizeof(xXIHierarchyInfo));
    ev->type = GenericEvent;

But as per the backtrace, ev is null at this point:

#0 XISendDeviceHierarchyEvent (flags=0xbfa27e1c) at ../../Xi/xichangehierarchy.c:73
        ev = 0x0

We can patch in a check for this which will fix the X crash, but it doesn't answer the question as to why it is running out of memory to begin with.

This bug was fixed in the package xorg-server - 2:1.9.99.901+git20110131.be3be758-0ubuntu5

---------------
xorg-server (2:1.9.99.901+git20110131.be3be758-0ubuntu5) natty; urgency=low

  * Add 213_xichangehierarchy-check-oom.patch: Another NULL pointer check
    for out-of-memory conditions, this time leading to a segfault in an
    unchecked calloc in XISendDeviceHierarchyEvent().
    (LP: #720445)
 -- Bryce Harrington <email address hidden> Wed, 16 Feb 2011 16:46:35 -0800

I'll leave this closed as fixed, but let me reiterate, this patch does not fix the underlying issue, just a side effect.

Basically, a train has gone off its rails and crashed through a town, and we're just bandaging up a bystander hit by flying debris.

The underlying out of memory issue still needs investigated, and will likely exhibit itself in a crash or freeze somewhere else in the system.