From 2e7ad6fe9d4032ebfb60deee38060f7df053c643 Mon Sep 17 00:00:00 2001 From: "Gary T. Giesen" Date: Fri, 26 Jun 2026 14:56:18 -0400 Subject: [PATCH] config/udev: guard against NULL subsystem in fallback bus id config_udev_get_fallback_bus_id() passes the result of udev_device_get_subsystem() straight into strcmp(). That accessor can return NULL when the device has no subsystem, so strcmp(NULL, "pci") dereferences a NULL pointer and the server crashes with a SIGSEGV. The path is reached for any DRM device with no udev ID_PATH property, where config_udev_odev_setup_attribs() falls back to this function. DisplayLink/evdi virtual cards have no ID_PATH; a udev remove of such a card during teardown can present a parent whose subsystem is already gone (reported NULL), and the unchecked strcmp faults. The same NULL-subsystem-into-strcmp class was fixed for the four sibling callers in this file by commit 429ee86a; config_udev_get_fallback_bus_id() was added later (commit 2f53d1cf) without the guard. The preceding parent==NULL case is already guarded here; extend the same defensiveness to the subsystem lookup. Related to: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1905 Signed-off-by: Gary T. Giesen Part-of: (cherry picked from commit 9babe7e7f687b0342c8ab726d01a658d590d7c54) --- config/udev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/config/udev.c b/config/udev.c index 3c89d178c..45da00f5c 100644 --- a/config/udev.c +++ b/config/udev.c @@ -512,13 +512,15 @@ static char* config_udev_get_fallback_bus_id(struct udev_device *udev_device) { const char *sysname; + const char *subsys; char *busid; udev_device = udev_device_get_parent(udev_device); if (udev_device == NULL) return NULL; - if (strcmp(udev_device_get_subsystem(udev_device), "pci") != 0) + subsys = udev_device_get_subsystem(udev_device); + if (!subsys || strcmp(subsys, "pci") != 0) return NULL; sysname = udev_device_get_sysname(udev_device);