* Mon Feb 08 2010 Peter Hutterer <peter.hutterer@redhat.com> 1.7.99.3-2.20100120

- xserver-1.7.4-reset-sli-pointers.patch: reset the server LED indicator
  pointers after device class copying (#540584)

xorg-x11-server.spec

@@ -19,7 +19,7 @@
 Summary:   X.Org X11 X server
 Name:      xorg-x11-server
 Version:   1.7.99.3
-Release:   1.%{gitdate}%{dist}
+Release:   2.%{gitdate}%{dist}
 URL:       http://www.x.org
 License:   MIT
 Group:     User Interface/X
@@ -76,6 +76,7 @@ Patch6045: xserver-1.7.0-randr-gamma-restore.patch
 
 Patch6049: xserver-1.7.1-multilib.patch
 Patch6051: xserver-1.7.1-gamma-kdm-fix.patch
+Patch6052: xserver-1.7.4-reset-sli-pointers.patch
 
 %define moduledir	%{_libdir}/xorg/modules
 %define drimoduledir	%{_libdir}/dri
@@ -504,6 +505,10 @@ rm -rf $RPM_BUILD_ROOT
 %{xserver_source_dir}
 
 %changelog
+* Mon Feb 08 2010 Peter Hutterer <peter.hutterer@redhat.com> 1.7.99.3-2.20100120
+- xserver-1.7.4-reset-sli-pointers.patch: reset the server LED indicator
+  pointers after device class copying (#540584) 
+
 * Wed Jan 20 2010 Peter Hutterer <peter.hutterer@redhat.com> 1.7.99.3-1.20100120
 - Update to today's git master.
 - Disable prelease warning patch - this is a prerelease

xserver-1.7.4-reset-sli-pointers.patch

@@ -0,0 +1,59 @@
+From 11eea736f44a236dde884b52ad51cb5d1271b7a5 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 13 Jan 2010 15:03:45 +1000
+Subject: [PATCH] Xi: reset the sli pointers after copying device classes. (#25640)
+
+If the indicator flags have the XkbSLI_IsDefault bit set, the indicator map
+and names aren't their own bit of memory but rather point into the
+device->key->xkbInfo->desc structure. XkbCopySrvLedInfo knows about this and
+leaves the pointers alone.
+
+When copying the classes from the slave to the master, these pointers are
+copied and still point to the dev->key class of the slave device. If the
+slave device is removed, the memory becomes invalid and a call to modify
+this data (e.g. XkbSetIndicators) may cause a deadlock.
+
+The copying of dev->key relies on dev->kbdfeed to be already set up. Hence
+the pointers need to be reset once _both_ kbdfeed and key have been copied
+into the master device.
+
+X.Org Bug 25640 <http://bugs.freedesktop.org/show_bug.cgi?id=25640>
+Fedora Bug 540584 <https://bugzilla.redhat.com/show_bug.cgi?id=540584>
+---
+ Xi/exevents.c |   20 ++++++++++++++++++++
+ 1 files changed, 20 insertions(+), 0 deletions(-)
+
+diff --git a/Xi/exevents.c b/Xi/exevents.c
+index cb2452b..ee32ba8 100644
+--- a/Xi/exevents.c
++++ b/Xi/exevents.c
+@@ -444,6 +444,26 @@ DeepCopyKeyboardClasses(DeviceIntPtr from, DeviceIntPtr to)
+         to->key      = NULL;
+     }
+ 
++    /* If a SrvLedInfoPtr's flags are XkbSLI_IsDefault, the names and maps
++     * pointer point into the xkbInfo->desc struct.  XkbCopySrvLedInfo
++     * didn't update the pointers so we need to do it manually here.
++     */
++    if (to->kbdfeed)
++    {
++        KbdFeedbackPtr k;
++
++        for (k = to->kbdfeed; k; k = k->next)
++        {
++            if (!k->xkb_sli)
++                continue;
++            if (k->xkb_sli->flags & XkbSLI_IsDefault)
++            {
++                k->xkb_sli->names = to->key->xkbInfo->desc->names->indicators;
++                k->xkb_sli->maps = to->key->xkbInfo->desc->indicators->maps;
++            }
++        }
++    }
++
+     /* We can't just copy over the focus class. When an app sets the focus,
+      * it'll do so on the master device. Copying the SDs focus means losing
+      * the focus.
+-- 
+1.6.6
+