From 13469a8847bac2d5452e59d4c93f373f2f57b641 Mon Sep 17 00:00:00 2001
From: Tobias Brox <tobias@redpill-linpro.com>
Date: Thu, 12 Feb 2026 11:46:24 +0100
Subject: [PATCH] fix(keyboard-state): fix segfault on device hotplug

The keyboard-state module crashes with SIGSEGV in libinput_device_ref
when a new input device appears in /dev/input/.

Three bugs fixed:

1. Missing NULL check: tryAddDevice() calls libinput_path_add_device()
   which returns NULL on failure, then immediately passes the result to
   libinput_device_ref() without checking.  On laptops, virtual input
   devices (power buttons, lid switch, etc.) appear and disappear in
   /dev/input/ triggering the hotplug handler; if libinput can't open
   one of these, the NULL return causes the segfault.

2. Missing cleanup on device removal: The IN_DELETE handler erased
   devices from the map without calling libinput_path_remove_device(),
   leaving dangling pointers in the libinput context.

3. Thread safety: libinput_devices_ was accessed from 3 threads
   (main/GTK, libinput_thread_, hotplug_thread_) without any mutex.

Fixes #4851

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 include/modules/keyboard_state.hpp |  2 ++
 src/modules/keyboard_state.cpp     | 29 ++++++++++++++++++++++-------
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/include/modules/keyboard_state.hpp b/include/modules/keyboard_state.hpp
index be90eee4d..db7f2550c 100644
--- a/include/modules/keyboard_state.hpp
+++ b/include/modules/keyboard_state.hpp
@@ -3,6 +3,7 @@
 #include <fmt/chrono.h>
 #include <gtkmm/label.h>
 
+#include <mutex>
 #include <set>
 #include <unordered_map>
 
@@ -41,6 +42,7 @@ class KeyboardState : public AModule {
 
   struct libinput* libinput_;
   std::unordered_map<std::string, struct libinput_device*> libinput_devices_;
+  std::mutex devices_mutex_;  // protects libinput_devices_
   std::set<int> binding_keys;
 
   util::SleeperThread libinput_thread_, hotplug_thread_;
diff --git a/src/modules/keyboard_state.cpp b/src/modules/keyboard_state.cpp
index 18ce0a7c4..a2207fdd6 100644
--- a/src/modules/keyboard_state.cpp
+++ b/src/modules/keyboard_state.cpp
@@ -232,9 +232,12 @@ waybar::modules::KeyboardState::KeyboardState(const std::string& id, const Bar&
           }
           tryAddDevice(dev_path);
         } else if (event->mask & IN_DELETE) {
+          std::lock_guard<std::mutex> lock(devices_mutex_);
           auto it = libinput_devices_.find(dev_path);
           if (it != libinput_devices_.end()) {
             spdlog::info("Keyboard {} has been removed.", dev_path);
+            libinput_path_remove_device(it->second);
+            libinput_device_unref(it->second);
             libinput_devices_.erase(it);
           }
         }
@@ -245,6 +248,7 @@ waybar::modules::KeyboardState::KeyboardState(const std::string& id, const Bar&
 }
 
 waybar::modules::KeyboardState::~KeyboardState() {
+  std::lock_guard<std::mutex> lock(devices_mutex_);
   for (const auto& [_, dev_ptr] : libinput_devices_) {
     libinput_path_remove_device(dev_ptr);
   }
@@ -256,11 +260,17 @@ auto waybar::modules::KeyboardState::update() -> void {
 
   try {
     std::string dev_path;
-    if (config_["device-path"].isString() &&
-        libinput_devices_.find(config_["device-path"].asString()) != libinput_devices_.end()) {
-      dev_path = config_["device-path"].asString();
-    } else {
-      dev_path = libinput_devices_.begin()->first;
+    {
+      std::lock_guard<std::mutex> lock(devices_mutex_);
+      if (libinput_devices_.empty()) {
+        return;
+      }
+      if (config_["device-path"].isString() &&
+          libinput_devices_.find(config_["device-path"].asString()) != libinput_devices_.end()) {
+        dev_path = config_["device-path"].asString();
+      } else {
+        dev_path = libinput_devices_.begin()->first;
+      }
     }
     int fd = openFile(dev_path, O_NONBLOCK | O_CLOEXEC | O_RDONLY);
     auto dev = openDevice(fd);
@@ -308,10 +318,15 @@ auto waybar::modules ::KeyboardState::tryAddDevice(const std::string& dev_path)
     auto dev = openDevice(fd);
     if (supportsLockStates(dev)) {
       spdlog::info("Found device {} at '{}'", libevdev_get_name(dev), dev_path);
+      std::lock_guard<std::mutex> lock(devices_mutex_);
       if (libinput_devices_.find(dev_path) == libinput_devices_.end()) {
         auto device = libinput_path_add_device(libinput_, dev_path.c_str());
-        libinput_device_ref(device);
-        libinput_devices_[dev_path] = device;
+        if (device) {
+          libinput_device_ref(device);
+          libinput_devices_[dev_path] = device;
+        } else {
+          spdlog::warn("keyboard-state: Failed to add device to libinput: {}", dev_path);
+        }
       }
     }
     libevdev_free(dev);