diff --git a/.gitignore b/.gitignore index 29790d0..89c66cc 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,37 @@ +xorg-server-1.9.1.tar.bz2 +/xorg-server-20101125.tar.xz +/xorg-server-20101201.tar.xz +/xorg-server-1.10.0.tar.bz2 +/xorg-server-20110418.tar.xz +/xorg-server-20110510.tar.xz +/xorg-server-20110818.tar.xz +/xorg-server-1.11.0.tar.bz2 +/xorg-server-1.11.1.tar.bz2 +/xorg-server-20111109.tar.xz +/xorg-server-20120103.tar.xz +/xorg-server-20120124.tar.xz +/xorg-server-20120215.tar.xz +/xorg-server-1.12.0.tar.bz2 +/xorg-server-1.12.1.tar.bz2 +/xorg-server-1.12.2.tar.bz2 +/xorg-server-1.12.3.tar.bz2 +/xorg-server-20120717.tar.xz +/xorg-server-20120726.tar.xz +/xorg-server-20120808.tar.xz +/xorg-server-20120822.tar.xz +/xorg-server-1.13.0.tar.bz2 +/xorg-server-1.13.1.tar.bz2 +/xorg-server-20130109.tar.xz +/xorg-server-20130215.tar.xz +/xorg-server-1.14.0.tar.bz2 +/xorg-server-1.14.1.tar.bz2 +/xorg-server-1.14.1.901.tar.bz2 +/xorg-server-1.14.2.tar.bz2 +/xorg-server-1.14.3.tar.bz2 +/xorg-server-1.14.99.3.tar.bz2 +/xorg-server-1.14.99.901.tar.bz2 +/xorg-server-1.14.99.902.tar.bz2 *.bz2 *.xz -*.gz +/xorg-x11-server-1.15.0-1.fc21.src.rpm +/xorg-server-1.20.14.tar.gz diff --git a/0001-Disallow-byte-swapped-clients-by-default.patch b/0001-Disallow-byte-swapped-clients-by-default.patch new file mode 100644 index 0000000..2cbf798 --- /dev/null +++ b/0001-Disallow-byte-swapped-clients-by-default.patch @@ -0,0 +1,272 @@ +From 73d6e888c6058b28a0e87ab65aa4172b17d8327d Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Mon, 19 Dec 2022 10:34:29 +1000 +Subject: [PATCH xserver] Fix some indentation issues + +Signed-off-by: Peter Hutterer +--- + dix/dispatch.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/dix/dispatch.c b/dix/dispatch.c +index 210df75c63..e38a8fecaa 100644 +--- a/dix/dispatch.c ++++ b/dix/dispatch.c +@@ -492,10 +492,10 @@ Dispatch(void) + if (!WaitForSomething(clients_are_ready())) + continue; + +- /***************** +- * Handle events in round robin fashion, doing input between +- * each round +- *****************/ ++ /***************** ++ * Handle events in round robin fashion, doing input between ++ * each round ++ *****************/ + + if (!dispatchException && clients_are_ready()) { + client = SmartScheduleClient(); +@@ -3657,11 +3657,11 @@ ProcInitialConnection(ClientPtr client) + prefix = (xConnClientPrefix *) ((char *)stuff + sz_xReq); + order = prefix->byteOrder; + if (order != 'l' && order != 'B' && order != 'r' && order != 'R') +- return client->noClientException = -1; ++ return client->noClientException = -1; + if (((*(char *) &whichbyte) && (order == 'B' || order == 'R')) || +- (!(*(char *) &whichbyte) && (order == 'l' || order == 'r'))) { +- client->swapped = TRUE; +- SwapConnClientPrefix(prefix); ++ (!(*(char *) &whichbyte) && (order == 'l' || order == 'r'))) { ++ client->swapped = TRUE; ++ SwapConnClientPrefix(prefix); + } + stuff->reqType = 2; + stuff->length += bytes_to_int32(prefix->nbytesAuthProto) + +@@ -3670,7 +3670,7 @@ ProcInitialConnection(ClientPtr client) + swaps(&stuff->length); + } + if (order == 'r' || order == 'R') { +- client->local = FALSE; ++ client->local = FALSE; + } + ResetCurrentRequest(client); + return Success; +@@ -3781,8 +3781,8 @@ ProcEstablishConnection(ClientPtr client) + auth_string = auth_proto + pad_to_int32(prefix->nbytesAuthProto); + + if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix + +- pad_to_int32(prefix->nbytesAuthProto) + +- pad_to_int32(prefix->nbytesAuthString)) ++ pad_to_int32(prefix->nbytesAuthProto) + ++ pad_to_int32(prefix->nbytesAuthString)) + reason = "Bad length"; + else if ((prefix->majorVersion != X_PROTOCOL) || + (prefix->minorVersion != X_PROTOCOL_REVISION)) +-- +2.39.0 + +From f69280ddcdd3115ee4717f22e85e0f43569b60dd Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 20 Dec 2022 11:40:16 +1000 +Subject: [PATCH xserver] dix: localize two variables + +Signed-off-by: Peter Hutterer +--- + dix/dispatch.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/dix/dispatch.c b/dix/dispatch.c +index c651c3d887..92be773e6c 100644 +--- a/dix/dispatch.c ++++ b/dix/dispatch.c +@@ -3766,14 +3766,11 @@ int + ProcEstablishConnection(ClientPtr client) + { + const char *reason; +- char *auth_proto, *auth_string; + xConnClientPrefix *prefix; + + REQUEST(xReq); + + prefix = (xConnClientPrefix *) ((char *) stuff + sz_xReq); +- auth_proto = (char *) prefix + sz_xConnClientPrefix; +- auth_string = auth_proto + pad_to_int32(prefix->nbytesAuthProto); + + if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix + + pad_to_int32(prefix->nbytesAuthProto) + +@@ -3782,12 +3779,15 @@ ProcEstablishConnection(ClientPtr client) + else if ((prefix->majorVersion != X_PROTOCOL) || + (prefix->minorVersion != X_PROTOCOL_REVISION)) + reason = "Protocol version mismatch"; +- else ++ else { ++ char *auth_proto = (char *) prefix + sz_xConnClientPrefix; ++ char *auth_string = auth_proto + pad_to_int32(prefix->nbytesAuthProto); + reason = ClientAuthorized(client, + (unsigned short) prefix->nbytesAuthProto, + auth_proto, + (unsigned short) prefix->nbytesAuthString, + auth_string); ++ } + + return (SendConnSetup(client, reason)); + } +-- +2.39.0 + +From 412777664a20dd3561b936c02c96571a756fe9b2 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 20 Dec 2022 10:42:03 +1000 +Subject: [PATCH xserver] Disallow byte-swapped clients by default + +The X server swapping code is a huge attack surface, much of this code +is untested and prone to security issues. The use-case of byte-swapped +clients is very niche, so let's disable this by default and allow it +only when the respective config option or commandline flag is given. + +For Xorg, this adds the ServerFlag "AllowByteSwappedClients" "on". +For all DDX, this adds the commandline options +byteswappedclients and +-byteswappedclients to enable or disable, respectively. + +Fixes #1201 + +https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1029 + +Signed-off-by: Peter Hutterer +--- + dix/dispatch.c | 4 +++- + hw/xfree86/common/xf86Config.c | 8 ++++++++ + hw/xfree86/man/xorg.conf.man | 2 ++ + hw/xwayland/xwayland.pc.in | 1 + + include/opaque.h | 2 ++ + man/Xserver.man | 6 ++++++ + os/utils.c | 9 +++++++++ + 7 files changed, 31 insertions(+), 1 deletion(-) + +diff --git a/dix/dispatch.c b/dix/dispatch.c +index 92be773e6c..9c26753a96 100644 +--- a/dix/dispatch.c ++++ b/dix/dispatch.c +@@ -3772,7 +3772,9 @@ ProcEstablishConnection(ClientPtr client) + + prefix = (xConnClientPrefix *) ((char *) stuff + sz_xReq); + +- if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix + ++ if (client->swapped && !AllowByteSwappedClients) { ++ reason = "Prohibited client endianess, see the Xserver man page "; ++ } else if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix + + pad_to_int32(prefix->nbytesAuthProto) + + pad_to_int32(prefix->nbytesAuthString)) + reason = "Bad length"; +diff --git a/hw/xfree86/common/xf86Config.c b/hw/xfree86/common/xf86Config.c +index 5d814c1485..41acb25aa2 100644 +--- a/hw/xfree86/common/xf86Config.c ++++ b/hw/xfree86/common/xf86Config.c +@@ -646,6 +646,7 @@ typedef enum { + FLAG_MAX_CLIENTS, + FLAG_IGLX, + FLAG_DEBUG, ++ FLAG_ALLOW_BYTE_SWAPPED_CLIENTS, + } FlagValues; + + /** +@@ -705,6 +706,8 @@ static OptionInfoRec FlagOptions[] = { + {0}, FALSE}, + {FLAG_DEBUG, "Debug", OPTV_STRING, + {0}, FALSE}, ++ {FLAG_ALLOW_BYTE_SWAPPED_CLIENTS, "AllowByteSwappedClients", OPTV_BOOLEAN, ++ {0}, FALSE}, + {-1, NULL, OPTV_NONE, + {0}, FALSE}, + }; +@@ -746,6 +749,11 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts) + xf86Msg(X_CONFIG, "Ignoring ABI Version\n"); + } + ++ xf86GetOptValBool(FlagOptions, FLAG_ALLOW_BYTE_SWAPPED_CLIENTS, &AllowByteSwappedClients); ++ if (AllowByteSwappedClients) { ++ xf86Msg(X_CONFIG, "Allowing byte-swapped clients\n"); ++ } ++ + if (xf86IsOptionSet(FlagOptions, FLAG_AUTO_ADD_DEVICES)) { + xf86GetOptValBool(FlagOptions, FLAG_AUTO_ADD_DEVICES, + &xf86Info.autoAddDevices); +diff --git a/hw/xfree86/man/xorg.conf.man b/hw/xfree86/man/xorg.conf.man +index 01b47247ee..d057f26ecd 100644 +--- a/hw/xfree86/man/xorg.conf.man ++++ b/hw/xfree86/man/xorg.conf.man +@@ -677,6 +677,8 @@ Possible values are + or + .BR sync . + Unset by default. ++.BI "Option \*qAllowByteSwappedClients\*q \*q" boolean \*q ++Allow clients with a different byte-order than the server. Disabled by default. + .SH "MODULE SECTION" + The + .B Module +diff --git a/include/opaque.h b/include/opaque.h +index 256261c2ad..398d4b4e51 100644 +--- a/include/opaque.h ++++ b/include/opaque.h +@@ -74,4 +74,6 @@ extern _X_EXPORT Bool bgNoneRoot; + extern _X_EXPORT Bool CoreDump; + extern _X_EXPORT Bool NoListenAll; + ++extern _X_EXPORT Bool AllowByteSwappedClients; ++ + #endif /* OPAQUE_H */ +diff --git a/man/Xserver.man b/man/Xserver.man +index 764bd1d907..e7adf9eb35 100644 +--- a/man/Xserver.man ++++ b/man/Xserver.man +@@ -114,6 +114,12 @@ pattern. This is the default unless -retro or -wr is specified. + .B \-bs + disables backing store support on all screens. + .TP 8 ++.B \+byteswappedclients ++Allow connections from clients with an endianess different to that of the server. ++.TP 8 ++.B \-byteswappedclients ++Prohibit connections from clients with an endianess different to that of the server. ++.TP 8 + .B \-c + turns off key-click. + .TP 8 +diff --git a/os/utils.c b/os/utils.c +index fe94912f34..405bf7d8b4 100644 +--- a/os/utils.c ++++ b/os/utils.c +@@ -189,6 +189,8 @@ Bool CoreDump; + + Bool enableIndirectGLX = FALSE; + ++Bool AllowByteSwappedClients = FALSE; ++ + #ifdef PANORAMIX + Bool PanoramiXExtensionDisabledHack = FALSE; + #endif +@@ -523,6 +525,8 @@ UseMsg(void) + ErrorF("-br create root window with black background\n"); + ErrorF("+bs enable any backing store support\n"); + ErrorF("-bs disable any backing store support\n"); ++ ErrorF("+byteswappedclients Allow clients with endianess different to that of the server\n"); ++ ErrorF("-byteswappedclients Prohibit clients with endianess different to that of the server\n"); + ErrorF("-c turns off key-click\n"); + ErrorF("c # key-click volume (0-100)\n"); + ErrorF("-cc int default color visual class\n"); +@@ -720,6 +724,11 @@ ProcessCommandLine(int argc, char *argv[]) + else + UseMsg(); + } ++ else if (strcmp(argv[i], "-byteswappedclients") == 0) { ++ AllowByteSwappedClients = FALSE; ++ } else if (strcmp(argv[i], "+byteswappedclients") == 0) { ++ AllowByteSwappedClients = TRUE; ++ } + else if (strcmp(argv[i], "-br") == 0); /* default */ + else if (strcmp(argv[i], "+bs") == 0) + enableBackingStore = TRUE; +-- +2.39.0 + diff --git a/0001-Don-t-hardcode-fps-for-fake-screen.patch b/0001-Don-t-hardcode-fps-for-fake-screen.patch new file mode 100644 index 0000000..465a92b --- /dev/null +++ b/0001-Don-t-hardcode-fps-for-fake-screen.patch @@ -0,0 +1,135 @@ +From 6497eeeb1a6552315132340565a3901d4db2144c Mon Sep 17 00:00:00 2001 +From: Boris-Barboris +Date: Tue, 22 Jun 2021 00:51:08 +0300 +Subject: [PATCH] Don't hardcode fps for fake screen + +Currently, when main hardware screen is powered-off, +X server initializes fake screen's timer with +1 second update interval. + +Streaming software like Nomachine or Vnc, as well as +desktop input automation suffers from it, since it +will forever be stuck on 1 fps until the display is +turned back on. + +This commit adds command line option -fakescreenfps +that allows the user to change the default fake screen +timer. + +Signed-off-by: Baranin Alexander +--- + man/Xserver.man | 3 +++ + os/utils.c | 12 ++++++++++++ + present/present.h | 2 ++ + present/present_fake.c | 28 ++++++++++++++++++---------- + 4 files changed, 35 insertions(+), 10 deletions(-) + +diff --git a/man/Xserver.man b/man/Xserver.man +index 31ffb8c..b1a3f40 100644 +--- a/man/Xserver.man ++++ b/man/Xserver.man +@@ -169,6 +169,9 @@ sets default cursor font. + .B \-fn \fIfont\fP + sets the default font. + .TP 8 ++.B \-fakescreenfps \fFps\fP ++sets fake presenter screen default fps (allowable range: 1-600). ++.TP 8 + .B \-fp \fIfontPath\fP + sets the search path for fonts. This path is a comma separated list + of directories which the X server searches for font databases. +diff --git a/os/utils.c b/os/utils.c +index 2ba1c80..721d4e9 100644 +--- a/os/utils.c ++++ b/os/utils.c +@@ -110,6 +110,8 @@ __stdcall unsigned long GetTickCount(void); + + #include "picture.h" + ++#include "present.h" ++ + Bool noTestExtensions; + + #ifdef COMPOSITE +@@ -526,6 +528,7 @@ UseMsg(void) + ErrorF + ("-deferglyphs [none|all|16] defer loading of [no|all|16-bit] glyphs\n"); + ErrorF("-f # bell base (0-100)\n"); ++ ErrorF("-fakescreenfps # fake screen default fps (1-600)\n"); + ErrorF("-fc string cursor font\n"); + ErrorF("-fn string default font name\n"); + ErrorF("-fp string default font path\n"); +@@ -776,6 +779,15 @@ ProcessCommandLine(int argc, char *argv[]) + else + UseMsg(); + } ++ else if (strcmp(argv[i], "-fakescreenfps") == 0) { ++ if (++i < argc) { ++ FakeScreenFps = (uint32_t) atoi(argv[i]); ++ if (FakeScreenFps < 1 || FakeScreenFps > 600) ++ FatalError("fakescreenfps must be an integer in [1;600] range\n"); ++ } ++ else ++ UseMsg(); ++ } + else if (strcmp(argv[i], "-fc") == 0) { + if (++i < argc) + defaultCursorFont = argv[i]; +diff --git a/present/present.h b/present/present.h +index 3d0b972..e7cc50d 100644 +--- a/present/present.h ++++ b/present/present.h +@@ -190,4 +190,6 @@ present_register_complete_notify(present_complete_notify_proc proc); + extern _X_EXPORT Bool + present_can_window_flip(WindowPtr window); + ++extern _X_EXPORT uint32_t FakeScreenFps; ++ + #endif /* _PRESENT_H_ */ +diff --git a/present/present_fake.c b/present/present_fake.c +index 2350638..d9ac598 100644 +--- a/present/present_fake.c ++++ b/present/present_fake.c +@@ -117,21 +117,29 @@ present_fake_queue_vblank(ScreenPtr screen, + return Success; + } + ++uint32_t FakeScreenFps = 0; ++ + void + present_fake_screen_init(ScreenPtr screen) + { ++ uint32_t fake_fps; + present_screen_priv_ptr screen_priv = present_screen_priv(screen); + +- /* For screens with hardware vblank support, the fake code +- * will be used for off-screen windows and while screens are blanked, +- * in which case we want a slow interval here +- * +- * Otherwise, pretend that the screen runs at 60Hz +- */ +- if (screen_priv->info && screen_priv->info->get_crtc) +- screen_priv->fake_interval = 1000000; +- else +- screen_priv->fake_interval = 16667; ++ if (FakeScreenFps) ++ fake_fps = FakeScreenFps; ++ else { ++ /* For screens with hardware vblank support, the fake code ++ * will be used for off-screen windows and while screens are blanked, ++ * in which case we want a large interval here: 1Hz ++ * ++ * Otherwise, pretend that the screen runs at 60Hz ++ */ ++ if (screen_priv->info && screen_priv->info->get_crtc) ++ fake_fps = 1; ++ else ++ fake_fps = 60; ++ } ++ screen_priv->fake_interval = 1000000 / fake_fps; + } + + void +-- +2.34.1 + diff --git a/0001-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch b/0001-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch new file mode 100644 index 0000000..5a64c75 --- /dev/null +++ b/0001-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch @@ -0,0 +1,45 @@ +From 96798fc1967491c80a4d0c8d9e0a80586cb2152b Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 22 Mar 2024 18:51:45 -0700 +Subject: [PATCH 1/4] Xi: ProcXIGetSelectedEvents needs to use unswapped length + to send reply + +CVE-2024-31080 + +Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762 +Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.") +Signed-off-by: Alan Coopersmith +Part-of: +--- + Xi/xiselectev.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c +index edcb8a0d3..ac1494987 100644 +--- a/Xi/xiselectev.c ++++ b/Xi/xiselectev.c +@@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client) + InputClientsPtr others = NULL; + xXIEventMask *evmask = NULL; + DeviceIntPtr dev; ++ uint32_t length; + + REQUEST(xXIGetSelectedEventsReq); + REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq); +@@ -418,10 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client) + } + } + ++ /* save the value before SRepXIGetSelectedEvents swaps it */ ++ length = reply.length; + WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply); + + if (reply.num_masks) +- WriteToClient(client, reply.length * 4, buffer); ++ WriteToClient(client, length * 4, buffer); + + free(buffer); + return Success; +-- +2.44.0 + diff --git a/0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch b/0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch new file mode 100644 index 0000000..11236a1 --- /dev/null +++ b/0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch @@ -0,0 +1,77 @@ +From a7bda3080d2b44eae668cdcec7a93095385b9652 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 28 Nov 2023 15:19:04 +1000 +Subject: [PATCH xserver] Xi: allocate enough XkbActions for our buttons + +button->xkb_acts is supposed to be an array sufficiently large for all +our buttons, not just a single XkbActions struct. Allocating +insufficient memory here means when we memcpy() later in +XkbSetDeviceInfo we write into memory that wasn't ours to begin with, +leading to the usual security ooopsiedaisies. + +CVE-2023-6377, ZDI-CAN-22412, ZDI-CAN-22413 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +(cherry picked from commit 0c1a93d319558fe3ab2d94f51d174b4f93810afd) +--- + Xi/exevents.c | 12 ++++++------ + dix/devices.c | 10 ++++++++++ + 2 files changed, 16 insertions(+), 6 deletions(-) + +diff --git a/Xi/exevents.c b/Xi/exevents.c +index dcd4efb3bc..54ea11a938 100644 +--- a/Xi/exevents.c ++++ b/Xi/exevents.c +@@ -611,13 +611,13 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) + } + + if (from->button->xkb_acts) { +- if (!to->button->xkb_acts) { +- to->button->xkb_acts = calloc(1, sizeof(XkbAction)); +- if (!to->button->xkb_acts) +- FatalError("[Xi] not enough memory for xkb_acts.\n"); +- } ++ size_t maxbuttons = max(to->button->numButtons, from->button->numButtons); ++ to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts, ++ maxbuttons, ++ sizeof(XkbAction)); ++ memset(to->button->xkb_acts, 0, maxbuttons * sizeof(XkbAction)); + memcpy(to->button->xkb_acts, from->button->xkb_acts, +- sizeof(XkbAction)); ++ from->button->numButtons * sizeof(XkbAction)); + } + else { + free(to->button->xkb_acts); +diff --git a/dix/devices.c b/dix/devices.c +index 5bf956ead4..15e46a9a5f 100644 +--- a/dix/devices.c ++++ b/dix/devices.c +@@ -2525,6 +2525,8 @@ RecalculateMasterButtons(DeviceIntPtr slave) + + if (master->button && master->button->numButtons != maxbuttons) { + int i; ++ int last_num_buttons = master->button->numButtons; ++ + DeviceChangedEvent event = { + .header = ET_Internal, + .type = ET_DeviceChanged, +@@ -2535,6 +2537,14 @@ RecalculateMasterButtons(DeviceIntPtr slave) + }; + + master->button->numButtons = maxbuttons; ++ if (last_num_buttons < maxbuttons) { ++ master->button->xkb_acts = xnfreallocarray(master->button->xkb_acts, ++ maxbuttons, ++ sizeof(XkbAction)); ++ memset(&master->button->xkb_acts[last_num_buttons], ++ 0, ++ (maxbuttons - last_num_buttons) * sizeof(XkbAction)); ++ } + + memcpy(&event.buttons.names, master->button->labels, maxbuttons * + sizeof(Atom)); +-- +2.43.0 + diff --git a/0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch b/0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch new file mode 100644 index 0000000..2389895 --- /dev/null +++ b/0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch @@ -0,0 +1,35 @@ +From 7150ba655c0cc08fa6ded309b81265bb672f2869 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Wed, 25 Jan 2023 11:41:40 +1000 +Subject: [PATCH xserver] Xi: fix potential use-after-free in + DeepCopyPointerClasses + +CVE-2023-0494, ZDI-CAN 19596 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer +--- + Xi/exevents.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Xi/exevents.c b/Xi/exevents.c +index 217baa9561..dcd4efb3bc 100644 +--- a/Xi/exevents.c ++++ b/Xi/exevents.c +@@ -619,8 +619,10 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) + memcpy(to->button->xkb_acts, from->button->xkb_acts, + sizeof(XkbAction)); + } +- else ++ else { + free(to->button->xkb_acts); ++ to->button->xkb_acts = NULL; ++ } + + memcpy(to->button->labels, from->button->labels, + from->button->numButtons * sizeof(Atom)); +-- +2.39.0 + diff --git a/0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch b/0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch new file mode 100644 index 0000000..99625dd --- /dev/null +++ b/0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch @@ -0,0 +1,80 @@ +From a31ba141824a7649e11f0ef7673718ce559d6337 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 3 Oct 2023 11:53:05 +1000 +Subject: [PATCH xserver 1/4] Xi/randr: fix handling of PropModeAppend/Prepend + +The handling of appending/prepending properties was incorrect, with at +least two bugs: the property length was set to the length of the new +part only, i.e. appending or prepending N elements to a property with P +existing elements always resulted in the property having N elements +instead of N + P. + +Second, when pre-pending a value to a property, the offset for the old +values was incorrect, leaving the new property with potentially +uninitalized values and/or resulting in OOB memory writes. +For example, prepending a 3 element value to a 5 element property would +result in this 8 value array: + [N, N, N, ?, ?, P, P, P ] P, P + ^OOB write + +The XI2 code is a copy/paste of the RandR code, so the bug exists in +both. + +CVE-2023-5367, ZDI-CAN-22153 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer +--- + Xi/xiproperty.c | 4 ++-- + randr/rrproperty.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c +index 6ec419e870..563c4f31a5 100644 +--- a/Xi/xiproperty.c ++++ b/Xi/xiproperty.c +@@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type, + XIDestroyDeviceProperty(prop); + return BadAlloc; + } +- new_value.size = len; ++ new_value.size = total_len; + new_value.type = type; + new_value.format = format; + +@@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type, + case PropModePrepend: + new_data = new_value.data; + old_data = (void *) (((char *) new_value.data) + +- (prop_value->size * size_in_bytes)); ++ (len * size_in_bytes)); + break; + } + if (new_data) +diff --git a/randr/rrproperty.c b/randr/rrproperty.c +index c2fb9585c6..25469f57b2 100644 +--- a/randr/rrproperty.c ++++ b/randr/rrproperty.c +@@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type, + RRDestroyOutputProperty(prop); + return BadAlloc; + } +- new_value.size = len; ++ new_value.size = total_len; + new_value.type = type; + new_value.format = format; + +@@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type, + case PropModePrepend: + new_data = new_value.data; + old_data = (void *) (((char *) new_value.data) + +- (prop_value->size * size_in_bytes)); ++ (len * size_in_bytes)); + break; + } + if (new_data) +-- +2.41.0 + diff --git a/0001-Xtest-disallow-GenericEvents-in-XTestSwapFakeInput.patch b/0001-Xtest-disallow-GenericEvents-in-XTestSwapFakeInput.patch new file mode 100644 index 0000000..017f247 --- /dev/null +++ b/0001-Xtest-disallow-GenericEvents-in-XTestSwapFakeInput.patch @@ -0,0 +1,52 @@ +From 8dba686dc277d6d262ad0c77b4632a5b276697ba Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 29 Nov 2022 12:55:45 +1000 +Subject: [PATCH xserver 1/7] Xtest: disallow GenericEvents in + XTestSwapFakeInput + +XTestSwapFakeInput assumes all events in this request are +sizeof(xEvent) and iterates through these in 32-byte increments. +However, a GenericEvent may be of arbitrary length longer than 32 bytes, +so any GenericEvent in this list would result in subsequent events to be +misparsed. + +Additional, the swapped event is written into a stack-allocated struct +xEvent (size 32 bytes). For any GenericEvent longer than 32 bytes, +swapping the event may thus smash the stack like an avocado on toast. + +Catch this case early and return BadValue for any GenericEvent. +Which is what would happen in unswapped setups anyway since XTest +doesn't support GenericEvent. + +CVE-2022-46340, ZDI-CAN 19265 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer +Acked-by: Olivier Fourdan +--- + Xext/xtest.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/Xext/xtest.c b/Xext/xtest.c +index bf27eb590b..2985a4ce6e 100644 +--- a/Xext/xtest.c ++++ b/Xext/xtest.c +@@ -502,10 +502,11 @@ XTestSwapFakeInput(ClientPtr client, xReq * req) + + nev = ((req->length << 2) - sizeof(xReq)) / sizeof(xEvent); + for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) { ++ int evtype = ev->u.u.type & 0x177; + /* Swap event */ +- proc = EventSwapVector[ev->u.u.type & 0177]; ++ proc = EventSwapVector[evtype]; + /* no swapping proc; invalid event type? */ +- if (!proc || proc == NotImplemented) { ++ if (!proc || proc == NotImplemented || evtype == GenericEvent) { + client->errorValue = ev->u.u.type; + return BadValue; + } +-- +2.38.1 + diff --git a/0001-add-a-quirk-for-apple-silicon.patch b/0001-add-a-quirk-for-apple-silicon.patch new file mode 100644 index 0000000..17c40e5 --- /dev/null +++ b/0001-add-a-quirk-for-apple-silicon.patch @@ -0,0 +1,30 @@ +commit 39934a656a44722d16a80bf4db411c53e2d67b38 (HEAD -> master, origin/master, origin/HEAD) +Author: Eric Curtin +Date: Fri Dec 16 11:10:12 2022 +0000 + + config: add a quirk for Apple Silicon appledrm + + Xorg server does not correctly select the DCP for the display without a + quirk on Apple Silicon. + + Signed-off-by: Eric Curtin + Suggested-by: Hector Martin + +diff --git a/config/10-quirks.conf b/config/10-quirks.conf +index 47907d82d..54dd908a7 100644 +--- a/config/10-quirks.conf ++++ b/config/10-quirks.conf +@@ -36,3 +36,13 @@ Section "InputClass" + MatchDriver "evdev" + Option "TypeName" "MOUSE" + EndSection ++ ++# https://bugzilla.redhat.com/show_bug.cgi?id=2152414 ++# Xorg server does not correctly select the DCP for the display without ++# a quirk on Apple Silicon ++Section "OutputClass" ++ Identifier "appledrm" ++ MatchDriver "apple" ++ Driver "modesetting" ++ Option "PrimaryGPU" "true" ++EndSection diff --git a/0001-autobind-GPUs-to-the-screen.patch b/0001-autobind-GPUs-to-the-screen.patch new file mode 100644 index 0000000..86b96a2 --- /dev/null +++ b/0001-autobind-GPUs-to-the-screen.patch @@ -0,0 +1,293 @@ +From 471289fa1dc359555ceed6302f7d9605ab6be3ea Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Mon, 2 Apr 2018 16:49:02 -0400 +Subject: [PATCH] autobind GPUs to the screen + +This is a modified version of a patch we've been carry-ing in Fedora and +RHEL for years now. This patch automatically adds secondary GPUs to the +master as output sink / offload source making e.g. the use of +slave-outputs just work, with requiring the user to manually run +"xrandr --setprovideroutputsource" before he can hookup an external +monitor to his hybrid graphics laptop. + +There is one problem with this patch, which is why it was not upstreamed +before. What to do when a secondary GPU gets detected really is a policy +decission (e.g. one may want to autobind PCI GPUs but not USB ones) and +as such should be under control of the Desktop Environment. + +Unconditionally adding autobinding support to the xserver will result +in races between the DE dealing with the hotplug of a secondary GPU +and the server itself dealing with it. + +However we've waited for years for any Desktop Environments to actually +start doing some sort of autoconfiguration of secondary GPUs and there +is still not a single DE dealing with this, so I believe that it is +time to upstream this now. + +To avoid potential future problems if any DEs get support for doing +secondary GPU configuration themselves, the new autobind functionality +is made optional. Since no DEs currently support doing this themselves it +is enabled by default. When DEs grow support for doing this themselves +they can disable the servers autobinding through the servers cmdline or a +xorg.conf snippet. + +Signed-off-by: Dave Airlie +[hdegoede@redhat.com: Make configurable, fix with nvidia, submit upstream] +Signed-off-by: Hans de Goede +--- + hw/xfree86/common/xf86Config.c | 19 +++++++++++++++++++ + hw/xfree86/common/xf86Globals.c | 2 ++ + hw/xfree86/common/xf86Init.c | 20 ++++++++++++++++++++ + hw/xfree86/common/xf86Priv.h | 1 + + hw/xfree86/common/xf86Privstr.h | 1 + + hw/xfree86/common/xf86platformBus.c | 4 ++++ + hw/xfree86/man/Xorg.man | 7 +++++++ + hw/xfree86/man/xorg.conf.man | 6 ++++++ + randr/randrstr.h | 3 +++ + randr/rrprovider.c | 22 ++++++++++++++++++++++ + 10 files changed, 85 insertions(+) + +diff --git a/hw/xfree86/common/xf86Config.c b/hw/xfree86/common/xf86Config.c +index 2c1d335..d7d7c2e 100644 +--- a/hw/xfree86/common/xf86Config.c ++++ b/hw/xfree86/common/xf86Config.c +@@ -643,6 +643,7 @@ typedef enum { + FLAG_DRI2, + FLAG_USE_SIGIO, + FLAG_AUTO_ADD_GPU, ++ FLAG_AUTO_BIND_GPU, + FLAG_MAX_CLIENTS, + FLAG_IGLX, + FLAG_DEBUG, +@@ -699,6 +700,8 @@ static OptionInfoRec FlagOptions[] = { + {0}, FALSE}, + {FLAG_AUTO_ADD_GPU, "AutoAddGPU", OPTV_BOOLEAN, + {0}, FALSE}, ++ {FLAG_AUTO_BIND_GPU, "AutoBindGPU", OPTV_BOOLEAN, ++ {0}, FALSE}, + {FLAG_MAX_CLIENTS, "MaxClients", OPTV_INTEGER, + {0}, FALSE }, + {FLAG_IGLX, "IndirectGLX", OPTV_BOOLEAN, +@@ -779,6 +782,22 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts) + } + xf86Msg(from, "%sutomatically adding GPU devices\n", + xf86Info.autoAddGPU ? "A" : "Not a"); ++ ++ if (xf86AutoBindGPUDisabled) { ++ xf86Info.autoBindGPU = FALSE; ++ from = X_CMDLINE; ++ } ++ else if (xf86IsOptionSet(FlagOptions, FLAG_AUTO_BIND_GPU)) { ++ xf86GetOptValBool(FlagOptions, FLAG_AUTO_BIND_GPU, ++ &xf86Info.autoBindGPU); ++ from = X_CONFIG; ++ } ++ else { ++ from = X_DEFAULT; ++ } ++ xf86Msg(from, "%sutomatically binding GPU devices\n", ++ xf86Info.autoBindGPU ? "A" : "Not a"); ++ + /* + * Set things up based on the config file information. Some of these + * settings may be overridden later when the command line options are +diff --git a/hw/xfree86/common/xf86Globals.c b/hw/xfree86/common/xf86Globals.c +index e890f05..7b27b4c 100644 +--- a/hw/xfree86/common/xf86Globals.c ++++ b/hw/xfree86/common/xf86Globals.c +@@ -131,6 +131,7 @@ xf86InfoRec xf86Info = { + #else + .autoAddGPU = FALSE, + #endif ++ .autoBindGPU = TRUE, + }; + + const char *xf86ConfigFile = NULL; +@@ -191,6 +192,7 @@ Bool xf86FlipPixels = FALSE; + Gamma xf86Gamma = { 0.0, 0.0, 0.0 }; + + Bool xf86AllowMouseOpenFail = FALSE; ++Bool xf86AutoBindGPUDisabled = FALSE; + + #ifdef XF86VIDMODE + Bool xf86VidModeDisabled = FALSE; +diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c +index ea42ec9..ec255b6 100644 +--- a/hw/xfree86/common/xf86Init.c ++++ b/hw/xfree86/common/xf86Init.c +@@ -76,6 +76,7 @@ + #include "xf86DDC.h" + #include "xf86Xinput.h" + #include "xf86InPriv.h" ++#include "xf86Crtc.h" + #include "picturestr.h" + #include "randrstr.h" + #include "glxvndabi.h" +@@ -237,6 +238,19 @@ xf86PrivsElevated(void) + return PrivsElevated(); + } + ++static void ++xf86AutoConfigOutputDevices(void) ++{ ++ int i; ++ ++ if (!xf86Info.autoBindGPU) ++ return; ++ ++ for (i = 0; i < xf86NumGPUScreens; i++) ++ RRProviderAutoConfigGpuScreen(xf86ScrnToScreen(xf86GPUScreens[i]), ++ xf86ScrnToScreen(xf86Screens[0])); ++} ++ + static void + TrapSignals(void) + { +@@ -770,6 +784,8 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char **argv) + for (i = 0; i < xf86NumGPUScreens; i++) + AttachUnboundGPU(xf86Screens[0]->pScreen, xf86GPUScreens[i]->pScreen); + ++ xf86AutoConfigOutputDevices(); ++ + xf86VGAarbiterWrapFunctions(); + if (sigio_blocked) + input_unlock(); +@@ -1278,6 +1294,10 @@ ddxProcessArgument(int argc, char **argv, int i) + xf86Info.iglxFrom = X_CMDLINE; + return 0; + } ++ if (!strcmp(argv[i], "-noautoBindGPU")) { ++ xf86AutoBindGPUDisabled = TRUE; ++ return 1; ++ } + + /* OS-specific processing */ + return xf86ProcessArgument(argc, argv, i); +diff --git a/hw/xfree86/common/xf86Priv.h b/hw/xfree86/common/xf86Priv.h +index 4fe2b5f..6566622 100644 +--- a/hw/xfree86/common/xf86Priv.h ++++ b/hw/xfree86/common/xf86Priv.h +@@ -46,6 +46,7 @@ + extern _X_EXPORT const char *xf86ConfigFile; + extern _X_EXPORT const char *xf86ConfigDir; + extern _X_EXPORT Bool xf86AllowMouseOpenFail; ++extern _X_EXPORT Bool xf86AutoBindGPUDisabled; + + #ifdef XF86VIDMODE + extern _X_EXPORT Bool xf86VidModeDisabled; +diff --git a/hw/xfree86/common/xf86Privstr.h b/hw/xfree86/common/xf86Privstr.h +index 21c2e1f..6c71863 100644 +--- a/hw/xfree86/common/xf86Privstr.h ++++ b/hw/xfree86/common/xf86Privstr.h +@@ -98,6 +98,7 @@ typedef struct { + + Bool autoAddGPU; + const char *debug; ++ Bool autoBindGPU; + } xf86InfoRec, *xf86InfoPtr; + + /* ISC's cc can't handle ~ of UL constants, so explicitly type cast them. */ +diff --git a/hw/xfree86/common/xf86platformBus.c b/hw/xfree86/common/xf86platformBus.c +index cef47da..913a324 100644 +--- a/hw/xfree86/common/xf86platformBus.c ++++ b/hw/xfree86/common/xf86platformBus.c +@@ -49,6 +49,7 @@ + #include "Pci.h" + #include "xf86platformBus.h" + #include "xf86Config.h" ++#include "xf86Crtc.h" + + #include "randrstr.h" + int platformSlotClaimed; +@@ -665,6 +666,9 @@ xf86platformAddDevice(int index) + } + /* attach unbound to 0 protocol screen */ + AttachUnboundGPU(xf86Screens[0]->pScreen, xf86GPUScreens[i]->pScreen); ++ if (xf86Info.autoBindGPU) ++ RRProviderAutoConfigGpuScreen(xf86ScrnToScreen(xf86GPUScreens[i]), ++ xf86ScrnToScreen(xf86Screens[0])); + + RRResourcesChanged(xf86Screens[0]->pScreen); + RRTellChanged(xf86Screens[0]->pScreen); +diff --git a/hw/xfree86/man/Xorg.man b/hw/xfree86/man/Xorg.man +index 13a9dc3..745f986 100644 +--- a/hw/xfree86/man/Xorg.man ++++ b/hw/xfree86/man/Xorg.man +@@ -283,6 +283,13 @@ is a comma separated list of directories to search for + server modules. This option is only available when the server is run + as root (i.e, with real-uid 0). + .TP 8 ++.B \-noautoBindGPU ++Disable automatically setting secondary GPUs up as output sinks and offload ++sources. This is equivalent to setting the ++.B AutoBindGPU ++xorg.conf(__filemansuffix__) file option. To ++.B false. ++.TP 8 + .B \-nosilk + Disable Silken Mouse support. + .TP 8 +diff --git a/hw/xfree86/man/xorg.conf.man b/hw/xfree86/man/xorg.conf.man +index 9589262..8d51e06 100644 +--- a/hw/xfree86/man/xorg.conf.man ++++ b/hw/xfree86/man/xorg.conf.man +@@ -672,6 +672,12 @@ Enabled by default. + If this option is disabled, then no GPU devices will be added from the udev + backend. Enabled by default. (May need to be disabled to setup Xinerama). + .TP 7 ++.BI "Option \*qAutoBindGPU\*q \*q" boolean \*q ++If enabled then secondary GPUs will be automatically set up as output-sinks and ++offload-sources. Making e.g. laptop outputs connected only to the secondary ++GPU directly available for use without needing to run ++"xrandr --setprovideroutputsource". Enabled by default. ++.TP 7 + .BI "Option \*qLog\*q \*q" string \*q + This option controls whether the log is flushed and/or synced to disk after + each message. +diff --git a/randr/randrstr.h b/randr/randrstr.h +index f94174b..092d726 100644 +--- a/randr/randrstr.h ++++ b/randr/randrstr.h +@@ -1039,6 +1039,9 @@ RRProviderLookup(XID id, RRProviderPtr *provider_p); + extern _X_EXPORT void + RRDeliverProviderEvent(ClientPtr client, WindowPtr pWin, RRProviderPtr provider); + ++extern _X_EXPORT void ++RRProviderAutoConfigGpuScreen(ScreenPtr pScreen, ScreenPtr masterScreen); ++ + /* rrproviderproperty.c */ + + extern _X_EXPORT void +diff --git a/randr/rrprovider.c b/randr/rrprovider.c +index e4bc2bf..e04c18f 100644 +--- a/randr/rrprovider.c ++++ b/randr/rrprovider.c +@@ -485,3 +485,25 @@ RRDeliverProviderEvent(ClientPtr client, WindowPtr pWin, RRProviderPtr provider) + + WriteEventsToClient(client, 1, (xEvent *) &pe); + } ++ ++void ++RRProviderAutoConfigGpuScreen(ScreenPtr pScreen, ScreenPtr masterScreen) ++{ ++ rrScrPrivPtr pScrPriv = rrGetScrPriv(pScreen); ++ rrScrPrivPtr masterPriv = rrGetScrPriv(masterScreen); ++ RRProviderPtr provider = pScrPriv->provider; ++ RRProviderPtr master_provider = masterPriv->provider; ++ ++ if (!provider || !master_provider) ++ return; ++ ++ if ((provider->capabilities & RR_Capability_SinkOutput) && ++ (master_provider->capabilities & RR_Capability_SourceOutput)) { ++ pScrPriv->rrProviderSetOutputSource(pScreen, provider, master_provider); ++ RRInitPrimeSyncProps(pScreen); ++ } ++ ++ if ((provider->capabilities & RR_Capability_SourceOffload) && ++ (master_provider->capabilities & RR_Capability_SinkOffload)) ++ pScrPriv->rrProviderSetOffloadSink(pScreen, provider, master_provider); ++} +-- +2.16.2 + diff --git a/0001-composite-Fix-use-after-free-of-the-COW.patch b/0001-composite-Fix-use-after-free-of-the-COW.patch new file mode 100644 index 0000000..bb21d7e --- /dev/null +++ b/0001-composite-Fix-use-after-free-of-the-COW.patch @@ -0,0 +1,42 @@ +From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Mon, 13 Mar 2023 11:08:47 +0100 +Subject: [PATCH xserver] composite: Fix use-after-free of the COW + +ZDI-CAN-19866/CVE-2023-1393 + +If a client explicitly destroys the compositor overlay window (aka COW), +we would leave a dangling pointer to that window in the CompScreen +structure, which will trigger a use-after-free later. + +Make sure to clear the CompScreen pointer to the COW when the latter gets +destroyed explicitly by the client. + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Olivier Fourdan +Reviewed-by: Adam Jackson +--- + composite/compwindow.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/composite/compwindow.c b/composite/compwindow.c +index 4e2494b86..b30da589e 100644 +--- a/composite/compwindow.c ++++ b/composite/compwindow.c +@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin) + ret = (*pScreen->DestroyWindow) (pWin); + cs->DestroyWindow = pScreen->DestroyWindow; + pScreen->DestroyWindow = compDestroyWindow; ++ ++ /* Did we just destroy the overlay window? */ ++ if (pWin == cs->pOverlayWin) ++ cs->pOverlayWin = NULL; ++ + /* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/ + return ret; + } +-- +2.40.0 + diff --git a/0001-configure.ac-search-for-the-fontrootdir-ourselves.patch b/0001-configure.ac-search-for-the-fontrootdir-ourselves.patch new file mode 100644 index 0000000..3e29358 --- /dev/null +++ b/0001-configure.ac-search-for-the-fontrootdir-ourselves.patch @@ -0,0 +1,72 @@ +From e67e988730346c63d2f0cdf2531ed36b0c7ad5a6 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Wed, 23 Nov 2022 14:50:29 +1000 +Subject: [PATCH xserver] configure.ac: search for the fontrootdir ourselves + +This replaces the use of font-utils' .m4 macro set with a copy of the +only one we actually want: the bit for the fontrootpath. + +We don't need configure options for every single subfont directory, so +let's hardcode those in the default font path. Like meson does upstream +too. + +With this patch we no longer require the font-utils dependency. + +Signed-off-by: Peter Hutterer +--- + configure.ac | 28 +++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 0909cc5b4d..2349320888 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -49,9 +49,6 @@ XORG_WITH_XSLTPROC + XORG_ENABLE_UNIT_TESTS + XORG_LD_WRAP([optional]) + +-m4_ifndef([XORG_FONT_MACROS_VERSION], [m4_fatal([must install font-util 1.1 or later before running autoconf/autogen])]) +-XORG_FONT_MACROS_VERSION(1.1) +- + dnl this gets generated by autoheader, and thus contains all the defines. we + dnl don't ever actually use it, internally. + AC_CONFIG_HEADERS(include/do-not-use-config.h) +@@ -450,18 +447,27 @@ AC_MSG_RESULT([$FALLBACK_INPUT_DRIVER]) + AC_DEFINE_UNQUOTED(FALLBACK_INPUT_DRIVER, ["$FALLBACK_INPUT_DRIVER"], [ Fallback input driver ]) + + dnl Determine font path +-XORG_FONTROOTDIR +-XORG_FONTSUBDIR(FONTMISCDIR, fontmiscdir, misc) +-XORG_FONTSUBDIR(FONTOTFDIR, fontotfdir, OTF) +-XORG_FONTSUBDIR(FONTTTFDIR, fontttfdir, TTF) +-XORG_FONTSUBDIR(FONTTYPE1DIR, fonttype1dir, Type1) +-XORG_FONTSUBDIR(FONT75DPIDIR, font75dpidir, 75dpi) +-XORG_FONTSUBDIR(FONT100DPIDIR, font100dpidir, 100dpi) ++dnl This is a copy of XORG_FONTROOTDIR from font-utils so we can drop the dependency ++AC_MSG_CHECKING([for root directory for font files]) ++AC_ARG_WITH(fontrootdir, ++ AS_HELP_STRING([--with-fontrootdir=DIR], ++ [Path to root directory for font files]), ++ [FONTROOTDIR="$withval"]) ++# if --with-fontrootdir not specified... ++if test "x${FONTROOTDIR}" = "x"; then ++ FONTROOTDIR=`$PKG_CONFIG --variable=fontrootdir fontutil` ++fi ++# ...and if pkg-config didn't find fontdir in fontutil.pc... ++if test "x${FONTROOTDIR}" = "x"; then ++ FONTROOTDIR="${datadir}/fonts/X11" ++fi ++AC_SUBST(FONTROOTDIR) ++AC_MSG_RESULT([${FONTROOTDIR}]) + + dnl Uses --with-default-font-path if set, otherwise uses standard + dnl subdirectories of FONTROOTDIR. Some distros set the default font path to + dnl "catalogue:/etc/X11/fontpath.d,built-ins" +-DEFAULT_FONT_PATH="${FONTMISCDIR}/,${FONTTTFDIR}/,${FONTOTFDIR}/,${FONTTYPE1DIR}/,${FONT100DPIDIR}/,${FONT75DPIDIR}/" ++DEFAULT_FONT_PATH="${FONTROOTDIR}/misc,${FONTROOTDIR}/OTF,${FONTROOTDIR}/TTF,${FONTROOTDIR}/Type1,${FONTROOTDIR}/75dpi,${FONTROOTDIR}/100dpi" + case $host_os in + darwin*) DEFAULT_FONT_PATH="${DEFAULT_FONT_PATH},/Library/Fonts,/System/Library/Fonts" ;; + esac +-- +2.38.1 + diff --git a/0001-dix-Fix-use-after-free-in-input-device-shutdown.patch b/0001-dix-Fix-use-after-free-in-input-device-shutdown.patch new file mode 100644 index 0000000..c2d723f --- /dev/null +++ b/0001-dix-Fix-use-after-free-in-input-device-shutdown.patch @@ -0,0 +1,77 @@ +From 1801fe0ac3926882d47d7e1ad6c0518a2cdffd41 Mon Sep 17 00:00:00 2001 +From: Povilas Kanapickas +Date: Sun, 19 Dec 2021 18:11:07 +0200 +Subject: [PATCH] dix: Fix use after free in input device shutdown + +This fixes access to freed heap memory via dev->master. E.g. when +running BarrierNotify.ReceivesNotifyEvents/7 test from +xorg-integration-tests: + +==24736==ERROR: AddressSanitizer: heap-use-after-free on address +0x619000065020 at pc 0x55c450e2b9cf bp 0x7fffc532fd20 sp 0x7fffc532fd10 +READ of size 4 at 0x619000065020 thread T0 + #0 0x55c450e2b9ce in GetMaster ../../../dix/devices.c:2722 + #1 0x55c450e9d035 in IsFloating ../../../dix/events.c:346 + #2 0x55c4513209c6 in GetDeviceUse ../../../Xi/xiquerydevice.c:525 +../../../Xi/xichangehierarchy.c:95 + #4 0x55c450e3455c in RemoveDevice ../../../dix/devices.c:1204 +../../../hw/xfree86/common/xf86Xinput.c:1142 + #6 0x55c450e17b04 in CloseDeviceList ../../../dix/devices.c:1038 + #7 0x55c450e1de85 in CloseDownDevices ../../../dix/devices.c:1068 + #8 0x55c450e837ef in dix_main ../../../dix/main.c:302 + #9 0x55c4517a8d93 in main ../../../dix/stubmain.c:34 +(/lib/x86_64-linux-gnu/libc.so.6+0x28564) + #11 0x55c450d0113d in _start (/usr/lib/xorg/Xorg+0x117713d) + +0x619000065020 is located 160 bytes inside of 912-byte region +[0x619000064f80,0x619000065310) +freed by thread T0 here: +(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf) + #1 0x55c450e19f1c in CloseDevice ../../../dix/devices.c:1014 + #2 0x55c450e343a4 in RemoveDevice ../../../dix/devices.c:1186 +../../../hw/xfree86/common/xf86Xinput.c:1142 + #4 0x55c450e17b04 in CloseDeviceList ../../../dix/devices.c:1038 + #5 0x55c450e1de85 in CloseDownDevices ../../../dix/devices.c:1068 + #6 0x55c450e837ef in dix_main ../../../dix/main.c:302 + #7 0x55c4517a8d93 in main ../../../dix/stubmain.c:34 +(/lib/x86_64-linux-gnu/libc.so.6+0x28564) + +previously allocated by thread T0 here: +(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6) + #1 0x55c450e1c57b in AddInputDevice ../../../dix/devices.c:259 + #2 0x55c450e34840 in AllocDevicePair ../../../dix/devices.c:2755 + #3 0x55c45130318f in add_master ../../../Xi/xichangehierarchy.c:152 +../../../Xi/xichangehierarchy.c:465 + #5 0x55c4512cb9f5 in ProcIDispatch ../../../Xi/extinit.c:390 + #6 0x55c450e6a92b in Dispatch ../../../dix/dispatch.c:551 + #7 0x55c450e834b7 in dix_main ../../../dix/main.c:272 + #8 0x55c4517a8d93 in main ../../../dix/stubmain.c:34 +(/lib/x86_64-linux-gnu/libc.so.6+0x28564) + +The problem is caused by dev->master being not reset when disabling the +device, which then causes dangling pointer when the master device itself +is being deleted when exiting whole server. + +Note that RecalculateMasterButtons() requires dev->master to be still +valid, so we can reset it only at the end of function. + +Signed-off-by: Povilas Kanapickas +--- + dix/devices.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/dix/devices.c b/dix/devices.c +index e62c34c55..5f9ce1678 100644 +--- a/dix/devices.c ++++ b/dix/devices.c +@@ -520,6 +520,7 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent) + } + + RecalculateMasterButtons(dev); ++ dev->master = NULL; + + return TRUE; + } +-- +2.43.0 + diff --git a/0001-dix-allocate-enough-space-for-logical-button-maps.patch b/0001-dix-allocate-enough-space-for-logical-button-maps.patch new file mode 100644 index 0000000..e11eb0e --- /dev/null +++ b/0001-dix-allocate-enough-space-for-logical-button-maps.patch @@ -0,0 +1,51 @@ +From 9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Thu, 14 Dec 2023 11:29:49 +1000 +Subject: [PATCH 1/9] dix: allocate enough space for logical button maps + +Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for +each logical button currently down. Since buttons can be arbitrarily mapped +to anything up to 255 make sure we have enough bits for the maximum mapping. + +CVE-2023-6816, ZDI-CAN-22664, ZDI-CAN-22665 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative +--- + Xi/xiquerypointer.c | 3 +-- + dix/enterleave.c | 5 +++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c +index 5b77b1a44..2b05ac5f3 100644 +--- a/Xi/xiquerypointer.c ++++ b/Xi/xiquerypointer.c +@@ -149,8 +149,7 @@ ProcXIQueryPointer(ClientPtr client) + if (pDev->button) { + int i; + +- rep.buttons_len = +- bytes_to_int32(bits_to_bytes(pDev->button->numButtons)); ++ rep.buttons_len = bytes_to_int32(bits_to_bytes(256)); /* button map up to 255 */ + rep.length += rep.buttons_len; + buttons = calloc(rep.buttons_len, 4); + if (!buttons) +diff --git a/dix/enterleave.c b/dix/enterleave.c +index 867ec7436..ded8679d7 100644 +--- a/dix/enterleave.c ++++ b/dix/enterleave.c +@@ -784,8 +784,9 @@ DeviceFocusEvent(DeviceIntPtr dev, int type, int mode, int detail, + + mouse = IsFloating(dev) ? dev : GetMaster(dev, MASTER_POINTER); + +- /* XI 2 event */ +- btlen = (mouse->button) ? bits_to_bytes(mouse->button->numButtons) : 0; ++ /* XI 2 event contains the logical button map - maps are CARD8 ++ * so we need 256 bits for the possibly maximum mapping */ ++ btlen = (mouse->button) ? bits_to_bytes(256) : 0; + btlen = bytes_to_int32(btlen); + len = sizeof(xXIFocusInEvent) + btlen * 4; + +-- +2.43.0 + diff --git a/0001-dix-fix-valuator-copy-paste-error-in-the-DeviceState.patch b/0001-dix-fix-valuator-copy-paste-error-in-the-DeviceState.patch new file mode 100644 index 0000000..363af1f --- /dev/null +++ b/0001-dix-fix-valuator-copy-paste-error-in-the-DeviceState.patch @@ -0,0 +1,33 @@ +From 133e0d651c5d12bf01999d6289e84e224ba77adc Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Mon, 22 Jan 2024 14:22:12 +1000 +Subject: [PATCH] dix: fix valuator copy/paste error in the DeviceStateNotify + event + +Fixes 219c54b8a3337456ce5270ded6a67bcde53553d5 +--- + dix/enterleave.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/dix/enterleave.c b/dix/enterleave.c +index 7b7ba1098..c1e6ac600 100644 +--- a/dix/enterleave.c ++++ b/dix/enterleave.c +@@ -619,11 +619,11 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v, + ev->first_valuator = first; + switch (ev->num_valuators) { + case 6: +- ev->valuator2 = v->axisVal[first + 5]; ++ ev->valuator5 = v->axisVal[first + 5]; + case 5: +- ev->valuator2 = v->axisVal[first + 4]; ++ ev->valuator4 = v->axisVal[first + 4]; + case 4: +- ev->valuator2 = v->axisVal[first + 3]; ++ ev->valuator3 = v->axisVal[first + 3]; + case 3: + ev->valuator2 = v->axisVal[first + 2]; + case 2: +-- +2.44.0 + diff --git a/0001-ephyr-Fix-incompatible-pointer-type-build-error.patch b/0001-ephyr-Fix-incompatible-pointer-type-build-error.patch new file mode 100644 index 0000000..345e660 --- /dev/null +++ b/0001-ephyr-Fix-incompatible-pointer-type-build-error.patch @@ -0,0 +1,54 @@ +From e89edec497bac581ca9b614fb00c25365580f045 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= +Date: Fri, 19 Jan 2024 13:05:51 +0100 +Subject: [PATCH] ephyr: Fix incompatible pointer type build error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Fix a compilation error on 32 bits architectures with gcc 14: + + ephyr_glamor_xv.c: In function ‘ephyr_glamor_xv_init’: + ephyr_glamor_xv.c:154:31: error: assignment to ‘SetPortAttributeFuncPtr’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int, int, void *)’} from incompatible pointer type ‘int (*)(KdScreenInfo *, Atom, INT32, void *)’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int, long int, void *)’} [-Wincompatible-pointer-types] + 154 | adaptor->SetPortAttribute = ephyr_glamor_xv_set_port_attribute; + | ^ + ephyr_glamor_xv.c:155:31: error: assignment to ‘GetPortAttributeFuncPtr’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int, int *, void *)’} from incompatible pointer type ‘int (*)(KdScreenInfo *, Atom, INT32 *, void *)’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int, long int *, void *)’} [-Wincompatible-pointer-types] + 155 | adaptor->GetPortAttribute = ephyr_glamor_xv_get_port_attribute; + | ^ + +Build error logs: +https://koji.fedoraproject.org/koji/taskinfo?taskID=111964273 + +Signed-off-by: José Expósito +--- + hw/kdrive/ephyr/ephyr_glamor_xv.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/hw/kdrive/ephyr/ephyr_glamor_xv.c b/hw/kdrive/ephyr/ephyr_glamor_xv.c +index 4dd15cf41..b5eae48c8 100644 +--- a/hw/kdrive/ephyr/ephyr_glamor_xv.c ++++ b/hw/kdrive/ephyr/ephyr_glamor_xv.c +@@ -50,16 +50,16 @@ ephyr_glamor_xv_stop_video(KdScreenInfo *screen, void *data, Bool cleanup) + + static int + ephyr_glamor_xv_set_port_attribute(KdScreenInfo *screen, +- Atom attribute, INT32 value, void *data) ++ Atom attribute, int value, void *data) + { +- return glamor_xv_set_port_attribute(data, attribute, value); ++ return glamor_xv_set_port_attribute(data, attribute, (INT32)value); + } + + static int + ephyr_glamor_xv_get_port_attribute(KdScreenInfo *screen, +- Atom attribute, INT32 *value, void *data) ++ Atom attribute, int *value, void *data) + { +- return glamor_xv_get_port_attribute(data, attribute, value); ++ return glamor_xv_get_port_attribute(data, attribute, (INT32 *)value); + } + + static void +-- +2.43.0 + diff --git a/0001-hw-Rename-boolean-config-value-field-from-bool-to-bo.patch b/0001-hw-Rename-boolean-config-value-field-from-bool-to-bo.patch new file mode 100644 index 0000000..52ea4d0 --- /dev/null +++ b/0001-hw-Rename-boolean-config-value-field-from-bool-to-bo.patch @@ -0,0 +1,154 @@ +From 454b3a826edb5fc6d0fea3a9cfd1a5e8fc568747 Mon Sep 17 00:00:00 2001 +From: Adam Jackson +Date: Mon, 22 Jul 2019 13:51:06 -0400 +Subject: [PATCH xserver] hw: Rename boolean config value field from bool to + boolean + +"bool" conflicts with C++ (meh) and stdbool.h (ngh alright fine). This +is a driver-visible change and will likely break the build for mach64, +but it can be fixed by simply using xf86ReturnOptValBool like every +other driver. + +Signed-off-by: Adam Jackson +--- + hw/xfree86/common/xf86Opt.h | 2 +- + hw/xfree86/common/xf86Option.c | 10 +++++----- + hw/xwin/winconfig.c | 22 +++++++++++----------- + hw/xwin/winconfig.h | 2 +- + 4 files changed, 18 insertions(+), 18 deletions(-) + +diff --git a/hw/xfree86/common/xf86Opt.h b/hw/xfree86/common/xf86Opt.h +index 3be2a0fc7..3046fbd41 100644 +--- a/hw/xfree86/common/xf86Opt.h ++++ b/hw/xfree86/common/xf86Opt.h +@@ -41,7 +41,7 @@ typedef union { + unsigned long num; + const char *str; + double realnum; +- Bool bool; ++ Bool boolean; + OptFrequency freq; + } ValueUnion; + +diff --git a/hw/xfree86/common/xf86Option.c b/hw/xfree86/common/xf86Option.c +index 06973bca3..ca538cc57 100644 +--- a/hw/xfree86/common/xf86Option.c ++++ b/hw/xfree86/common/xf86Option.c +@@ -213,7 +213,7 @@ LookupBoolOption(XF86OptionPtr optlist, const char *name, int deflt, + o.name = name; + o.type = OPTV_BOOLEAN; + if (ParseOptionValue(-1, optlist, &o, markUsed)) +- deflt = o.value.bool; ++ deflt = o.value.boolean; + return deflt; + } + +@@ -474,7 +474,7 @@ xf86ShowUnusedOptions(int scrnIndex, XF86OptionPtr opt) + static Bool + GetBoolValue(OptionInfoPtr p, const char *s) + { +- return xf86getBoolValue(&p->value.bool, s); ++ return xf86getBoolValue(&p->value.boolean, s); + } + + static Bool +@@ -678,7 +678,7 @@ ParseOptionValue(int scrnIndex, XF86OptionPtr options, OptionInfoPtr p, + if (markUsed) + xf86MarkOptionUsedByName(options, newn); + if (GetBoolValue(&opt, s)) { +- p->value.bool = !opt.value.bool; ++ p->value.boolean = !opt.value.boolean; + p->found = TRUE; + } + else { +@@ -869,7 +869,7 @@ xf86GetOptValBool(const OptionInfoRec * table, int token, Bool *value) + + p = xf86TokenToOptinfo(table, token); + if (p && p->found) { +- *value = p->value.bool; ++ *value = p->value.boolean; + return TRUE; + } + else +@@ -883,7 +883,7 @@ xf86ReturnOptValBool(const OptionInfoRec * table, int token, Bool def) + + p = xf86TokenToOptinfo(table, token); + if (p && p->found) { +- return p->value.bool; ++ return p->value.boolean; + } + else + return def; +diff --git a/hw/xwin/winconfig.c b/hw/xwin/winconfig.c +index 31894d2fb..646d69006 100644 +--- a/hw/xwin/winconfig.c ++++ b/hw/xwin/winconfig.c +@@ -623,7 +623,7 @@ winSetBoolOption(void *optlist, const char *name, int deflt) + o.name = name; + o.type = OPTV_BOOLEAN; + if (ParseOptionValue(-1, optlist, &o)) +- deflt = o.value.bool; ++ deflt = o.value.boolean; + return deflt; + } + +@@ -918,7 +918,7 @@ ParseOptionValue(int scrnIndex, void *options, OptionInfoPtr p) + } + if ((s = winFindOptionValue(options, newn)) != NULL) { + if (GetBoolValue(&opt, s)) { +- p->value.bool = !opt.value.bool; ++ p->value.boolean = !opt.value.boolean; + p->found = TRUE; + } + else { +@@ -968,25 +968,25 @@ static Bool + GetBoolValue(OptionInfoPtr p, const char *s) + { + if (*s == 0) { +- p->value.bool = TRUE; ++ p->value.boolean = TRUE; + } + else { + if (winNameCompare(s, "1") == 0) +- p->value.bool = TRUE; ++ p->value.boolean = TRUE; + else if (winNameCompare(s, "on") == 0) +- p->value.bool = TRUE; ++ p->value.boolean = TRUE; + else if (winNameCompare(s, "true") == 0) +- p->value.bool = TRUE; ++ p->value.boolean = TRUE; + else if (winNameCompare(s, "yes") == 0) +- p->value.bool = TRUE; ++ p->value.boolean = TRUE; + else if (winNameCompare(s, "0") == 0) +- p->value.bool = FALSE; ++ p->value.boolean = FALSE; + else if (winNameCompare(s, "off") == 0) +- p->value.bool = FALSE; ++ p->value.boolean = FALSE; + else if (winNameCompare(s, "false") == 0) +- p->value.bool = FALSE; ++ p->value.boolean = FALSE; + else if (winNameCompare(s, "no") == 0) +- p->value.bool = FALSE; ++ p->value.boolean = FALSE; + } + return TRUE; + } +diff --git a/hw/xwin/winconfig.h b/hw/xwin/winconfig.h +index f079368c7..bd1f59650 100644 +--- a/hw/xwin/winconfig.h ++++ b/hw/xwin/winconfig.h +@@ -199,7 +199,7 @@ typedef union { + unsigned long num; + char *str; + double realnum; +- Bool bool; ++ Bool boolean; + OptFrequency freq; + } ValueUnion; + +-- +2.39.0 + diff --git a/0001-present-Check-for-NULL-to-prevent-crash.patch b/0001-present-Check-for-NULL-to-prevent-crash.patch new file mode 100644 index 0000000..894ad0e --- /dev/null +++ b/0001-present-Check-for-NULL-to-prevent-crash.patch @@ -0,0 +1,43 @@ +From 94b4a3d45451d29e9539ea234ce8b5e9ed58546c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?B=C5=82a=C5=BCej=20Szczygie=C5=82?= +Date: Thu, 13 Jan 2022 00:47:27 +0100 +Subject: [PATCH xserver] present: Check for NULL to prevent crash +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1275 +Signed-off-by: Błażej Szczygieł +Tested-by: Aaron Plattner +(cherry picked from commit 22d5818851967408bb7c903cb345b7ca8766094c) +--- + present/present_scmd.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/present/present_scmd.c b/present/present_scmd.c +index 3c68e690b..11391adbb 100644 +--- a/present/present_scmd.c ++++ b/present/present_scmd.c +@@ -168,6 +168,9 @@ present_scmd_get_crtc(present_screen_priv_ptr screen_priv, WindowPtr window) + if (!screen_priv->info) + return NULL; + ++ if (!screen_priv->info->get_crtc) ++ return NULL; ++ + return (*screen_priv->info->get_crtc)(window); + } + +@@ -206,6 +209,9 @@ present_flush(WindowPtr window) + if (!screen_priv->info) + return; + ++ if (!screen_priv->info->flush) ++ return; ++ + (*screen_priv->info->flush) (window); + } + +-- +2.34.1 + diff --git a/0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch b/0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch new file mode 100644 index 0000000..d9eea48 --- /dev/null +++ b/0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch @@ -0,0 +1,105 @@ +From b98fc07d3442a289c6bef82df50dd0a2d01de71a Mon Sep 17 00:00:00 2001 +From: Adam Jackson +Date: Thu, 2 Feb 2023 12:26:27 -0500 +Subject: [PATCH xserver] present: Send a PresentConfigureNotify event for + destroyed windows +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This enables fixing a deadlock case on the client side, where the client +ends up blocked waiting for a Present event that will never come because +the window was destroyed. The new PresentWindowDestroyed flag allows the +client to avoid blocking indefinitely. + +Signed-off-by: Adam Jackson +See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/116 +See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6685 +Reviewed-by: Michel Dänzer +(cherry picked from commit 462b06033e66a32308d940eb5fc47f5e4c914dc0) +--- + present/present_event.c | 5 +++-- + present/present_priv.h | 7 ++++++- + present/present_screen.c | 11 ++++++++++- + 3 files changed, 19 insertions(+), 4 deletions(-) + +diff --git a/present/present_event.c b/present/present_event.c +index 435b26b70..849732dc8 100644 +--- a/present/present_event.c ++++ b/present/present_event.c +@@ -102,7 +102,8 @@ present_event_swap(xGenericEvent *from, xGenericEvent *to) + } + + void +-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling) ++present_send_config_notify(WindowPtr window, int x, int y, int w, int h, ++ int bw, WindowPtr sibling, CARD32 flags) + { + present_window_priv_ptr window_priv = present_window_priv(window); + +@@ -122,7 +123,7 @@ present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, + .off_y = 0, + .pixmap_width = w, + .pixmap_height = h, +- .pixmap_flags = 0 ++ .pixmap_flags = flags + }; + present_event_ptr event; + +diff --git a/present/present_priv.h b/present/present_priv.h +index 6ebd009a2..4ad729864 100644 +--- a/present/present_priv.h ++++ b/present/present_priv.h +@@ -43,6 +43,11 @@ + #define DebugPresent(x) + #endif + ++/* XXX this belongs in presentproto */ ++#ifndef PresentWindowDestroyed ++#define PresentWindowDestroyed (1 << 0) ++#endif ++ + extern int present_request; + + extern DevPrivateKeyRec present_screen_private_key; +@@ -307,7 +312,7 @@ void + present_free_events(WindowPtr window); + + void +-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling); ++present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling, CARD32 flags); + + void + present_send_complete_notify(WindowPtr window, CARD8 kind, CARD8 mode, CARD32 serial, uint64_t ust, uint64_t msc); +diff --git a/present/present_screen.c b/present/present_screen.c +index 15684eda4..2c29aafd2 100644 +--- a/present/present_screen.c ++++ b/present/present_screen.c +@@ -93,6 +93,15 @@ present_destroy_window(WindowPtr window) + present_screen_priv_ptr screen_priv = present_screen_priv(screen); + present_window_priv_ptr window_priv = present_window_priv(window); + ++ present_send_config_notify(window, ++ window->drawable.x, ++ window->drawable.y, ++ window->drawable.width, ++ window->drawable.height, ++ window->borderWidth, ++ window->nextSib, ++ PresentWindowDestroyed); ++ + if (window_priv) { + present_clear_window_notifies(window); + present_free_events(window); +@@ -123,7 +132,7 @@ present_config_notify(WindowPtr window, + ScreenPtr screen = window->drawable.pScreen; + present_screen_priv_ptr screen_priv = present_screen_priv(screen); + +- present_send_config_notify(window, x, y, w, h, bw, sibling); ++ present_send_config_notify(window, x, y, w, h, bw, sibling, 0); + + unwrap(screen_priv, screen, ConfigNotify); + if (screen->ConfigNotify) +-- +2.40.0 + diff --git a/0001-randr-avoid-integer-truncation-in-length-check-of-Pr.patch b/0001-randr-avoid-integer-truncation-in-length-check-of-Pr.patch new file mode 100644 index 0000000..d88a8d5 --- /dev/null +++ b/0001-randr-avoid-integer-truncation-in-length-check-of-Pr.patch @@ -0,0 +1,61 @@ +From 58e83c683950ac9e253ab05dd7a13a8368b70a3c Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Mon, 27 Nov 2023 16:27:49 +1000 +Subject: [PATCH xserver] randr: avoid integer truncation in length check of + ProcRRChange*Property + +Affected are ProcRRChangeProviderProperty and ProcRRChangeOutputProperty. +See also xserver@8f454b79 where this same bug was fixed for the core +protocol and XI. + +This fixes an OOB read and the resulting information disclosure. + +Length calculation for the request was clipped to a 32-bit integer. With +the correct stuff->nUnits value the expected request size was +truncated, passing the REQUEST_FIXED_SIZE check. + +The server then proceeded with reading at least stuff->num_items bytes +(depending on stuff->format) from the request and stuffing whatever it +finds into the property. In the process it would also allocate at least +stuff->nUnits bytes, i.e. 4GB. + +CVE-2023-6478, ZDI-CAN-22561 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +(cherry picked from commit 14f480010a93ff962fef66a16412fafff81ad632) +--- + randr/rrproperty.c | 2 +- + randr/rrproviderproperty.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/randr/rrproperty.c b/randr/rrproperty.c +index 25469f57b2..c4fef8a1f6 100644 +--- a/randr/rrproperty.c ++++ b/randr/rrproperty.c +@@ -530,7 +530,7 @@ ProcRRChangeOutputProperty(ClientPtr client) + char format, mode; + unsigned long len; + int sizeInBytes; +- int totalSize; ++ uint64_t totalSize; + int err; + + REQUEST_AT_LEAST_SIZE(xRRChangeOutputPropertyReq); +diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c +index b79c17f9bf..90c5a9a933 100644 +--- a/randr/rrproviderproperty.c ++++ b/randr/rrproviderproperty.c +@@ -498,7 +498,7 @@ ProcRRChangeProviderProperty(ClientPtr client) + char format, mode; + unsigned long len; + int sizeInBytes; +- int totalSize; ++ uint64_t totalSize; + int err; + + REQUEST_AT_LEAST_SIZE(xRRChangeProviderPropertyReq); +-- +2.43.0 + diff --git a/0001-render-Avoid-possible-double-free-in-ProcRenderAddGl.patch b/0001-render-Avoid-possible-double-free-in-ProcRenderAddGl.patch new file mode 100644 index 0000000..549f90a --- /dev/null +++ b/0001-render-Avoid-possible-double-free-in-ProcRenderAddGl.patch @@ -0,0 +1,72 @@ +From 337d8d48b618d4fc0168a7b978be4c3447650b04 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Fri, 5 Apr 2024 15:24:49 +0200 +Subject: [PATCH] render: Avoid possible double-free in ProcRenderAddGlyphs() + +ProcRenderAddGlyphs() adds the glyph to the glyphset using AddGlyph() and +then frees it using FreeGlyph() to decrease the reference count, after +AddGlyph() has increased it. + +AddGlyph() however may chose to reuse an existing glyph if it's already +in the glyphSet, and free the glyph that was given, in which case the +caller function, ProcRenderAddGlyphs() will call FreeGlyph() on an +already freed glyph, as reported by ASan: + + READ of size 4 thread T0 + #0 in FreeGlyph xserver/render/glyph.c:252 + #1 in ProcRenderAddGlyphs xserver/render/render.c:1174 + #2 in Dispatch xserver/dix/dispatch.c:546 + #3 in dix_main xserver/dix/main.c:271 + #4 in main xserver/dix/stubmain.c:34 + #5 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 + #6 in __libc_start_main_impl ../csu/libc-start.c:360 + #7 (/usr/bin/Xwayland+0x44fe4) + Address is located 0 bytes inside of 64-byte region + freed by thread T0 here: + #0 in __interceptor_free libsanitizer/asan/asan_malloc_linux.cpp:52 + #1 in _dixFreeObjectWithPrivates xserver/dix/privates.c:538 + #2 in AddGlyph xserver/render/glyph.c:295 + #3 in ProcRenderAddGlyphs xserver/render/render.c:1173 + #4 in Dispatch xserver/dix/dispatch.c:546 + #5 in dix_main xserver/dix/main.c:271 + #6 in main xserver/dix/stubmain.c:34 + #7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 + previously allocated by thread T0 here: + #0 in __interceptor_malloc libsanitizer/asan/asan_malloc_linux.cpp:69 + #1 in AllocateGlyph xserver/render/glyph.c:355 + #2 in ProcRenderAddGlyphs xserver/render/render.c:1085 + #3 in Dispatch xserver/dix/dispatch.c:546 + #4 in dix_main xserver/dix/main.c:271 + #5 in main xserver/dix/stubmain.c:34 + #6 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 + SUMMARY: AddressSanitizer: heap-use-after-free xserver/render/glyph.c:252 in FreeGlyph + +To avoid that, make sure not to free the given glyph in AddGlyph(). + +v2: Simplify the test using the boolean returned from AddGlyph() (Michel) +v3: Simplify even more by not freeing the glyph in AddGlyph() (Peter) + +Fixes: bdca6c3d1 - render: fix refcounting of glyphs during ProcRenderAddGlyphs +Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1659 +Signed-off-by: Olivier Fourdan +Part-of: +--- + render/glyph.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/render/glyph.c b/render/glyph.c +index 13991f8a1..5fa7f3b5b 100644 +--- a/render/glyph.c ++++ b/render/glyph.c +@@ -291,8 +291,6 @@ AddGlyph(GlyphSetPtr glyphSet, GlyphPtr glyph, Glyph id) + gr = FindGlyphRef(&globalGlyphs[glyphSet->fdepth], signature, + TRUE, glyph->sha1); + if (gr->glyph && gr->glyph != DeletedGlyph && gr->glyph != glyph) { +- FreeGlyphPicture(glyph); +- dixFreeObjectWithPrivates(glyph, PRIVATE_GLYPH); + glyph = gr->glyph; + } + else if (gr->glyph != glyph) { +-- +2.44.0 + diff --git a/0001-render-Fix-build-with-gcc-12.patch b/0001-render-Fix-build-with-gcc-12.patch new file mode 100644 index 0000000..22f2e5a --- /dev/null +++ b/0001-render-Fix-build-with-gcc-12.patch @@ -0,0 +1,90 @@ +From 53173fdab492f0f638f6616fcf01af0b9ea6338d Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Thu, 20 Jan 2022 10:20:38 +0100 +Subject: [PATCH xserver] render: Fix build with gcc 12 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The xserver fails to compile with the latest gcc 12: + + render/picture.c: In function ‘CreateSolidPicture’: + render/picture.c:874:26: error: array subscript ‘union _SourcePict[0]’ is partly outside array bounds of ‘unsigned char[16]’ [-Werror=array-bounds] + 874 | pPicture->pSourcePict->type = SourcePictTypeSolidFill; + | ^~ + render/picture.c:868:45: note: object of size 16 allocated by ‘malloc’ + 868 | pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictSolidFill)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + render/picture.c: In function ‘CreateLinearGradientPicture’: + render/picture.c:906:26: error: array subscript ‘union _SourcePict[0]’ is partly outside array bounds of ‘unsigned char[32]’ [-Werror=array-bounds] + 906 | pPicture->pSourcePict->linear.type = SourcePictTypeLinear; + | ^~ + render/picture.c:899:45: note: object of size 32 allocated by ‘malloc’ + 899 | pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictLinearGradient)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + render/picture.c: In function ‘CreateConicalGradientPicture’: + render/picture.c:989:26: error: array subscript ‘union _SourcePict[0]’ is partly outside array bounds of ‘unsigned char[32]’ [-Werror=array-bounds] + 989 | pPicture->pSourcePict->conical.type = SourcePictTypeConical; + | ^~ + render/picture.c:982:45: note: object of size 32 allocated by ‘malloc’ + 982 | pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictConicalGradient)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + cc1: some warnings being treated as errors + ninja: build stopped: subcommand failed. + +This is because gcc 12 has become stricter and raises a warning now. + +Fix the warning/error by allocating enough memory to store the union +struct. + +Signed-off-by: Olivier Fourdan +Acked-by: Michel Dänzer +Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1256 +(cherry picked from commit c6b0dcb82d4db07a2f32c09a8c09c85a5f57248e) +--- + render/picture.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/render/picture.c b/render/picture.c +index afa0d258f..2be4b1954 100644 +--- a/render/picture.c ++++ b/render/picture.c +@@ -865,7 +865,7 @@ CreateSolidPicture(Picture pid, xRenderColor * color, int *error) + } + + pPicture->id = pid; +- pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictSolidFill)); ++ pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict)); + if (!pPicture->pSourcePict) { + *error = BadAlloc; + free(pPicture); +@@ -896,7 +896,7 @@ CreateLinearGradientPicture(Picture pid, xPointFixed * p1, xPointFixed * p2, + } + + pPicture->id = pid; +- pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictLinearGradient)); ++ pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict)); + if (!pPicture->pSourcePict) { + *error = BadAlloc; + free(pPicture); +@@ -936,7 +936,7 @@ CreateRadialGradientPicture(Picture pid, xPointFixed * inner, + } + + pPicture->id = pid; +- pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictRadialGradient)); ++ pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict)); + if (!pPicture->pSourcePict) { + *error = BadAlloc; + free(pPicture); +@@ -979,7 +979,7 @@ CreateConicalGradientPicture(Picture pid, xPointFixed * center, xFixed angle, + } + + pPicture->id = pid; +- pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictConicalGradient)); ++ pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict)); + if (!pPicture->pSourcePict) { + *error = BadAlloc; + free(pPicture); +-- +2.34.1 + diff --git a/0001-xf86-Accept-devices-with-the-simpledrm-driver.patch b/0001-xf86-Accept-devices-with-the-simpledrm-driver.patch new file mode 100644 index 0000000..3dc5796 --- /dev/null +++ b/0001-xf86-Accept-devices-with-the-simpledrm-driver.patch @@ -0,0 +1,34 @@ +From b9218fadf3c09d83566549279d68886d8258f79c Mon Sep 17 00:00:00 2001 +From: nerdopolis +Date: Thu, 30 Sep 2021 08:51:18 -0400 +Subject: [PATCH] xf86: Accept devices with the 'simpledrm' driver. + +SimpleDRM 'devices' are a fallback device, and do not have a busid +so they are getting skipped. This will allow simpledrm to work +with the modesetting driver +--- + hw/xfree86/common/xf86platformBus.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/hw/xfree86/common/xf86platformBus.c b/hw/xfree86/common/xf86platformBus.c +index 0e0a995ac..45028f7a6 100644 +--- a/hw/xfree86/common/xf86platformBus.c ++++ b/hw/xfree86/common/xf86platformBus.c +@@ -557,8 +557,13 @@ xf86platformProbeDev(DriverPtr drvp) + } + else { + /* for non-seat0 servers assume first device is the master */ +- if (ServerIsNotSeat0()) ++ if (ServerIsNotSeat0()) { + break; ++ } else { ++ /* Accept the device if the driver is simpledrm */ ++ if (strcmp(xf86_platform_devices[j].attribs->driver, "simpledrm") == 0) ++ break; ++ } + + if (xf86IsPrimaryPlatform(&xf86_platform_devices[j])) + break; +-- +2.35.1 + diff --git a/0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch b/0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch index 2134a44..cce0348 100644 --- a/0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch +++ b/0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch @@ -52,7 +52,7 @@ index 6619e3aa7..1f8ad14bc 100644 /* For non-PCI devices and drmGetDevice fail, just assume that * the 3D driver is named the same as the kernel driver. This is * currently true for vc4 and msm (freedreno). -@@ -1454,12 +1458,14 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) +@@ -1456,12 +1460,14 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) xf86DrvMsg(pScreen->myNum, X_ERROR, "[DRI2] Couldn't drmGetVersion() on non-PCI device, " "no driver name found.\n"); @@ -70,7 +70,7 @@ index 6619e3aa7..1f8ad14bc 100644 } for (i = 0; driver_map[i].driver; i++) { -@@ -1467,13 +1473,15 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) +@@ -1469,13 +1475,15 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) continue; if (driver_map[i].num_chips_ids == -1) { @@ -88,7 +88,7 @@ index 6619e3aa7..1f8ad14bc 100644 goto out; } } -@@ -1485,9 +1493,9 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) +@@ -1487,9 +1495,9 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) dev->deviceinfo.pci->vendor_id, dev->deviceinfo.pci->device_id); out: drmFreeDevice(&dev); @@ -100,21 +100,21 @@ index 6619e3aa7..1f8ad14bc 100644 #endif } -@@ -1604,7 +1612,8 @@ DRI2ScreenInit(ScreenPtr pScreen, DRI2InfoPtr info) +@@ -1610,7 +1618,8 @@ DRI2ScreenInit(ScreenPtr pScreen, DRI2InfoPtr info) + if (info->driverName) { + ds->driverNames[0] = info->driverName; } else { - /* FIXME dri2_probe_driver_name() returns a strdup-ed string, - * currently this gets leaked */ - ds->driverNames[0] = ds->driverNames[1] = dri2_probe_driver_name(pScreen, info); + dri2_probe_driver_name(pScreen, info, + &ds->driverNames[0], &ds->driverNames[1]); if (!ds->driverNames[0]) return FALSE; - + } diff --git a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h index da7ea1c1e..7036d1003 100644 --- a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h +++ b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h -@@ -60,23 +60,24 @@ static const int vmwgfx_chip_ids[] = { +@@ -66,21 +66,22 @@ static const int vmwgfx_chip_ids[] = { static const struct { int vendor_id; const char *driver; @@ -124,10 +124,8 @@ index da7ea1c1e..7036d1003 100644 } driver_map[] = { - { 0x8086, "i915", i915_chip_ids, ARRAY_SIZE(i915_chip_ids) }, - { 0x8086, "i965", i965_chip_ids, ARRAY_SIZE(i965_chip_ids) }, -- { 0x8086, "i965", NULL, -1 }, + { 0x8086, "i915", "i915", i915_chip_ids, ARRAY_SIZE(i915_chip_ids) }, + { 0x8086, "i965", "va_gl", i965_chip_ids, ARRAY_SIZE(i965_chip_ids) }, -+ { 0x8086, "i965", "va_gl", NULL, -1 }, #ifndef DRIVER_MAP_GALLIUM_ONLY - { 0x1002, "radeon", r100_chip_ids, ARRAY_SIZE(r100_chip_ids) }, - { 0x1002, "r200", r200_chip_ids, ARRAY_SIZE(r200_chip_ids) }, @@ -136,18 +134,19 @@ index da7ea1c1e..7036d1003 100644 #endif - { 0x1002, "r300", r300_chip_ids, ARRAY_SIZE(r300_chip_ids) }, - { 0x1002, "r600", r600_chip_ids, ARRAY_SIZE(r600_chip_ids) }, -- { 0x1002, "radeonsi", NULL, -1 }, +- { 0x1002, "radeonsi", radeonsi_chip_ids, ARRAY_SIZE(radeonsi_chip_ids) }, - { 0x10de, "nouveau", NULL, -1 }, - { 0x1af4, "virtio_gpu", virtio_gpu_chip_ids, ARRAY_SIZE(virtio_gpu_chip_ids) }, - { 0x15ad, "vmwgfx", vmwgfx_chip_ids, ARRAY_SIZE(vmwgfx_chip_ids) }, -- { 0x0000, NULL, NULL, 0 }, + { 0x1002, "r300", "r300", r300_chip_ids, ARRAY_SIZE(r300_chip_ids) }, -+ { 0x1002, "r600", "r600", r600_chip_ids, ARRAY_SIZE(r600_chip_ids) }, -+ { 0x1002, "radeonsi", "radeonsi", NULL, -1 }, ++ { 0x1002, "r600","r600", r600_chip_ids, ARRAY_SIZE(r600_chip_ids) }, ++ { 0x1002, "radeonsi", "radeonsi", radeonsi_chip_ids, ARRAY_SIZE(radeonsi_chip_ids) }, + { 0x10de, "nouveau", "nouveau", NULL, -1 }, + { 0x1af4, "virtio_gpu", "virtio_gpu", virtio_gpu_chip_ids, ARRAY_SIZE(virtio_gpu_chip_ids) }, + { 0x15ad, "vmwgfx", "vmwgfx", vmwgfx_chip_ids, ARRAY_SIZE(vmwgfx_chip_ids) }, -+ { 0x0000, NULL, NULL, NULL, 0 }, + { 0x0000, NULL, NULL, 0 }, }; - #endif /* _PCI_ID_DRIVER_MAP_H_ */ +-- +2.19.0 + diff --git a/0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch b/0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch new file mode 100644 index 0000000..2db1508 --- /dev/null +++ b/0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch @@ -0,0 +1,54 @@ +From 56351307017e2501f7cd6e31efcfb55c19aba75a Mon Sep 17 00:00:00 2001 +From: Matthieu Herrb +Date: Thu, 10 Oct 2024 10:37:28 +0200 +Subject: [PATCH] xkb: Fix buffer overflow in _XkbSetCompatMap() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The _XkbSetCompatMap() function attempts to resize the `sym_interpret` +buffer. + +However, It didn't update its size properly. It updated `num_si` only, +without updating `size_si`. + +This may lead to local privilege escalation if the server is run as root +or remote code execution (e.g. x11 over ssh). + +CVE-2024-9632, ZDI-CAN-24756 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Reviewed-by: Peter Hutterer +Tested-by: Peter Hutterer +Reviewed-by: José Expósito +--- + xkb/xkb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/xkb/xkb.c b/xkb/xkb.c +index f203270d5..70e8279aa 100644 +--- a/xkb/xkb.c ++++ b/xkb/xkb.c +@@ -2991,13 +2991,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev, + XkbSymInterpretPtr sym; + unsigned int skipped = 0; + +- if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) { +- compat->num_si = req->firstSI + req->nSI; ++ if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) { ++ compat->num_si = compat->size_si = req->firstSI + req->nSI; + compat->sym_interpret = reallocarray(compat->sym_interpret, +- compat->num_si, ++ compat->size_si, + sizeof(XkbSymInterpretRec)); + if (!compat->sym_interpret) { +- compat->num_si = 0; ++ compat->num_si = compat->size_si = 0; + return BadAlloc; + } + } +-- +2.46.2 + diff --git a/0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch b/0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch new file mode 100644 index 0000000..6e5ebb5 --- /dev/null +++ b/0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch @@ -0,0 +1,59 @@ +From 18f91b950e22c2a342a4fbc55e9ddf7534a707d2 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Wed, 13 Jul 2022 11:23:09 +1000 +Subject: [PATCH xserver] xkb: fix some possible memleaks in XkbGetKbdByName + +GetComponentByName returns an allocated string, so let's free that if we +fail somewhere. + +Signed-off-by: Peter Hutterer +--- + xkb/xkb.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +diff --git a/xkb/xkb.c b/xkb/xkb.c +index 4692895db..b79a269e3 100644 +--- a/xkb/xkb.c ++++ b/xkb/xkb.c +@@ -5935,18 +5935,32 @@ ProcXkbGetKbdByName(ClientPtr client) + xkb = dev->key->xkbInfo->desc; + status = Success; + str = (unsigned char *) &stuff[1]; +- if (GetComponentSpec(&str, TRUE, &status)) /* keymap, unsupported */ +- return BadMatch; ++ { ++ char *keymap = GetComponentSpec(&str, TRUE, &status); /* keymap, unsupported */ ++ if (keymap) { ++ free(keymap); ++ return BadMatch; ++ } ++ } + names.keycodes = GetComponentSpec(&str, TRUE, &status); + names.types = GetComponentSpec(&str, TRUE, &status); + names.compat = GetComponentSpec(&str, TRUE, &status); + names.symbols = GetComponentSpec(&str, TRUE, &status); + names.geometry = GetComponentSpec(&str, TRUE, &status); +- if (status != Success) ++ if (status == Success) { ++ len = str - ((unsigned char *) stuff); ++ if ((XkbPaddedSize(len) / 4) != stuff->length) ++ status = BadLength; ++ } ++ ++ if (status != Success) { ++ free(names.keycodes); ++ free(names.types); ++ free(names.compat); ++ free(names.symbols); ++ free(names.geometry); + return status; +- len = str - ((unsigned char *) stuff); +- if ((XkbPaddedSize(len) / 4) != stuff->length) +- return BadLength; ++ } + + CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask); + CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask); +-- +2.38.1 + diff --git a/0001-xkb-proof-GetCountedString-against-request-length-at.patch b/0001-xkb-proof-GetCountedString-against-request-length-at.patch new file mode 100644 index 0000000..d358a32 --- /dev/null +++ b/0001-xkb-proof-GetCountedString-against-request-length-at.patch @@ -0,0 +1,35 @@ +From 11beef0b7f1ed290348e45618e5fa0d2bffcb72e Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 5 Jul 2022 12:06:20 +1000 +Subject: [PATCH xserver] xkb: proof GetCountedString against request length + attacks + +GetCountedString did a check for the whole string to be within the +request buffer but not for the initial 2 bytes that contain the length +field. A swapped client could send a malformed request to trigger a +swaps() on those bytes, writing into random memory. + +Signed-off-by: Peter Hutterer +--- + xkb/xkb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/xkb/xkb.c b/xkb/xkb.c +index f42f59ef3..1841cff26 100644 +--- a/xkb/xkb.c ++++ b/xkb/xkb.c +@@ -5137,6 +5137,11 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str) + CARD16 len; + + wire = *wire_inout; ++ ++ if (client->req_len < ++ bytes_to_int32(wire + 2 - (char *) client->requestBuffer)) ++ return BadValue; ++ + len = *(CARD16 *) wire; + if (client->swapped) { + swaps(&len); +-- +2.38.1 + diff --git a/0001-xkb-switch-to-array-index-loops-to-moving-pointers.patch b/0001-xkb-switch-to-array-index-loops-to-moving-pointers.patch new file mode 100644 index 0000000..a4efb7a --- /dev/null +++ b/0001-xkb-switch-to-array-index-loops-to-moving-pointers.patch @@ -0,0 +1,76 @@ +From f1070c01d616c5f21f939d5ebc533738779451ac Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 5 Jul 2022 12:40:47 +1000 +Subject: [PATCH xserver 1/3] xkb: switch to array index loops to moving + pointers + +Most similar loops here use a pointer that advances with each loop +iteration, let's do the same here for consistency. + +No functional changes. + +Signed-off-by: Peter Hutterer +Reviewed-by: Olivier Fourdan +--- + xkb/xkb.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/xkb/xkb.c b/xkb/xkb.c +index a29262c24..64e52611e 100644 +--- a/xkb/xkb.c ++++ b/xkb/xkb.c +@@ -5368,16 +5368,16 @@ _CheckSetSections(XkbGeometryPtr geom, + row->left = rWire->left; + row->vertical = rWire->vertical; + kWire = (xkbKeyWireDesc *) &rWire[1]; +- for (k = 0; k < rWire->nKeys; k++) { ++ for (k = 0; k < rWire->nKeys; k++, kWire++) { + XkbKeyPtr key; + + key = XkbAddGeomKey(row); + if (!key) + return BadAlloc; +- memcpy(key->name.name, kWire[k].name, XkbKeyNameLength); +- key->gap = kWire[k].gap; +- key->shape_ndx = kWire[k].shapeNdx; +- key->color_ndx = kWire[k].colorNdx; ++ memcpy(key->name.name, kWire->name, XkbKeyNameLength); ++ key->gap = kWire->gap; ++ key->shape_ndx = kWire->shapeNdx; ++ key->color_ndx = kWire->colorNdx; + if (key->shape_ndx >= geom->num_shapes) { + client->errorValue = _XkbErrCode3(0x10, key->shape_ndx, + geom->num_shapes); +@@ -5389,7 +5389,7 @@ _CheckSetSections(XkbGeometryPtr geom, + return BadMatch; + } + } +- rWire = (xkbRowWireDesc *) &kWire[rWire->nKeys]; ++ rWire = (xkbRowWireDesc *)kWire; + } + wire = (char *) rWire; + if (sWire->nDoodads > 0) { +@@ -5454,16 +5454,16 @@ _CheckSetShapes(XkbGeometryPtr geom, + return BadAlloc; + ol->corner_radius = olWire->cornerRadius; + ptWire = (xkbPointWireDesc *) &olWire[1]; +- for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++) { +- pt->x = ptWire[p].x; +- pt->y = ptWire[p].y; ++ for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++, ptWire++) { ++ pt->x = ptWire->x; ++ pt->y = ptWire->y; + if (client->swapped) { + swaps(&pt->x); + swaps(&pt->y); + } + } + ol->num_points = olWire->nPoints; +- olWire = (xkbOutlineWireDesc *) (&ptWire[olWire->nPoints]); ++ olWire = (xkbOutlineWireDesc *)ptWire; + } + if (shapeWire->primaryNdx != XkbNoShape) + shape->primary = &shape->outlines[shapeWire->primaryNdx]; +-- +2.36.1 + diff --git a/0002-Xi-ProcXIPassiveGrabDevice-needs-to-use-unswapped-le.patch b/0002-Xi-ProcXIPassiveGrabDevice-needs-to-use-unswapped-le.patch new file mode 100644 index 0000000..4e061f7 --- /dev/null +++ b/0002-Xi-ProcXIPassiveGrabDevice-needs-to-use-unswapped-le.patch @@ -0,0 +1,43 @@ +From 3e77295f888c67fc7645db5d0c00926a29ffecee Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 22 Mar 2024 18:56:27 -0700 +Subject: [PATCH 2/4] Xi: ProcXIPassiveGrabDevice needs to use unswapped length + to send reply + +CVE-2024-31081 + +Fixes: d220d6907 ("Xi: add GrabButton and GrabKeysym code.") +Signed-off-by: Alan Coopersmith +Part-of: +--- + Xi/xipassivegrab.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c +index c9ac2f855..896233bec 100644 +--- a/Xi/xipassivegrab.c ++++ b/Xi/xipassivegrab.c +@@ -93,6 +93,7 @@ ProcXIPassiveGrabDevice(ClientPtr client) + GrabParameters param; + void *tmp; + int mask_len; ++ uint32_t length; + + REQUEST(xXIPassiveGrabDeviceReq); + REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq, +@@ -247,9 +248,11 @@ ProcXIPassiveGrabDevice(ClientPtr client) + } + } + ++ /* save the value before SRepXIPassiveGrabDevice swaps it */ ++ length = rep.length; + WriteReplyToClient(client, sizeof(rep), &rep); + if (rep.num_modifiers) +- WriteToClient(client, rep.length * 4, modifiers_failed); ++ WriteToClient(client, length * 4, modifiers_failed); + + out: + free(modifiers_failed); +-- +2.44.0 + diff --git a/0002-Xi-return-an-error-from-XI-property-changes-if-verif.patch b/0002-Xi-return-an-error-from-XI-property-changes-if-verif.patch new file mode 100644 index 0000000..72bcadb --- /dev/null +++ b/0002-Xi-return-an-error-from-XI-property-changes-if-verif.patch @@ -0,0 +1,41 @@ +From c5ff57676698f19ed3a1402aef58a15552e32d27 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 29 Nov 2022 13:24:00 +1000 +Subject: [PATCH xserver 2/7] Xi: return an error from XI property changes if + verification failed + +Both ProcXChangeDeviceProperty and ProcXIChangeProperty checked the +property for validity but didn't actually return the potential error. + +Signed-off-by: Peter Hutterer +Acked-by: Olivier Fourdan +--- + Xi/xiproperty.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c +index a36f7d61df..68c362c628 100644 +--- a/Xi/xiproperty.c ++++ b/Xi/xiproperty.c +@@ -902,6 +902,8 @@ ProcXChangeDeviceProperty(ClientPtr client) + + rc = check_change_property(client, stuff->property, stuff->type, + stuff->format, stuff->mode, stuff->nUnits); ++ if (rc != Success) ++ return rc; + + len = stuff->nUnits; + if (len > (bytes_to_int32(0xffffffff - sizeof(xChangeDevicePropertyReq)))) +@@ -1141,6 +1143,9 @@ ProcXIChangeProperty(ClientPtr client) + + rc = check_change_property(client, stuff->property, stuff->type, + stuff->format, stuff->mode, stuff->num_items); ++ if (rc != Success) ++ return rc; ++ + len = stuff->num_items; + if (len > bytes_to_int32(0xffffffff - sizeof(xXIChangePropertyReq))) + return BadLength; +-- +2.38.1 + diff --git a/0002-dix-Allocate-sufficient-xEvents-for-our-DeviceStateN.patch b/0002-dix-Allocate-sufficient-xEvents-for-our-DeviceStateN.patch new file mode 100644 index 0000000..21c5622 --- /dev/null +++ b/0002-dix-Allocate-sufficient-xEvents-for-our-DeviceStateN.patch @@ -0,0 +1,84 @@ +From ece23be888a93b741aa1209d1dbf64636109d6a5 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Mon, 18 Dec 2023 14:27:50 +1000 +Subject: [PATCH 2/9] dix: Allocate sufficient xEvents for our + DeviceStateNotify + +If a device has both a button class and a key class and numButtons is +zero, we can get an OOB write due to event under-allocation. + +This function seems to assume a device has either keys or buttons, not +both. It has two virtually identical code paths, both of which assume +they're applying to the first event in the sequence. + +A device with both a key and button class triggered a logic bug - only +one xEvent was allocated but the deviceStateNotify pointer was pushed on +once per type. So effectively this logic code: + + int count = 1; + if (button && nbuttons > 32) count++; + if (key && nbuttons > 0) count++; + if (key && nkeys > 32) count++; // this is basically always true + // count is at 2 for our keys + zero button device + + ev = alloc(count * sizeof(xEvent)); + FixDeviceStateNotify(ev); + if (button) + FixDeviceStateNotify(ev++); + if (key) + FixDeviceStateNotify(ev++); // santa drops into the wrong chimney here + +If the device has more than 3 valuators, the OOB is pushed back - we're +off by one so it will happen when the last deviceValuator event is +written instead. + +Fix this by allocating the maximum number of events we may allocate. +Note that the current behavior is not protocol-correct anyway, this +patch fixes only the allocation issue. + +Note that this issue does not trigger if the device has at least one +button. While the server does not prevent a button class with zero +buttons, it is very unlikely. + +CVE-2024-0229, ZDI-CAN-22678 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative +--- + dix/enterleave.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/dix/enterleave.c b/dix/enterleave.c +index ded8679d7..17964b00a 100644 +--- a/dix/enterleave.c ++++ b/dix/enterleave.c +@@ -675,7 +675,8 @@ static void + DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) + { + int evcount = 1; +- deviceStateNotify *ev, *sev; ++ deviceStateNotify sev[6 + (MAX_VALUATORS + 2)/3]; ++ deviceStateNotify *ev; + deviceKeyStateNotify *kev; + deviceButtonStateNotify *bev; + +@@ -714,7 +715,7 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) + } + } + +- sev = ev = xallocarray(evcount, sizeof(xEvent)); ++ ev = sev; + FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first); + + if (b != NULL) { +@@ -770,7 +771,6 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) + + DeliverEventsToWindow(dev, win, (xEvent *) sev, evcount, + DeviceStateNotifyMask, NullGrab); +- free(sev); + } + + void +-- +2.43.0 + diff --git a/0002-mi-reset-the-PointerWindows-reference-on-screen-swit.patch b/0002-mi-reset-the-PointerWindows-reference-on-screen-swit.patch new file mode 100644 index 0000000..cbe9804 --- /dev/null +++ b/0002-mi-reset-the-PointerWindows-reference-on-screen-swit.patch @@ -0,0 +1,99 @@ +From 004f461c440cb6611eefb48fbbb4fa53a6d49f80 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Thu, 5 Oct 2023 12:19:45 +1000 +Subject: [PATCH xserver 2/4] mi: reset the PointerWindows reference on screen + switch + +PointerWindows[] keeps a reference to the last window our sprite +entered - changes are usually handled by CheckMotion(). + +If we switch between screens via XWarpPointer our +dev->spriteInfo->sprite->win is set to the new screen's root window. +If there's another window at the cursor location CheckMotion() will +trigger the right enter/leave events later. If there is not, it skips +that process and we never trigger LeaveWindow() - PointerWindows[] for +the device still refers to the previous window. + +If that window is destroyed we have a dangling reference that will +eventually cause a use-after-free bug when checking the window hierarchy +later. + +To trigger this, we require: +- two protocol screens +- XWarpPointer to the other screen's root window +- XDestroyWindow before entering any other window + +This is a niche bug so we hack around it by making sure we reset the +PointerWindows[] entry so we cannot have a dangling pointer. This +doesn't handle Enter/Leave events correctly but the previous code didn't +either. + +CVE-2023-5380, ZDI-CAN-21608 + +This vulnerability was discovered by: +Sri working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer +Reviewed-by: Adam Jackson +--- + dix/enterleave.h | 2 -- + include/eventstr.h | 3 +++ + mi/mipointer.c | 17 +++++++++++++++-- + 3 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/dix/enterleave.h b/dix/enterleave.h +index 4b833d8a3b..e8af924c68 100644 +--- a/dix/enterleave.h ++++ b/dix/enterleave.h +@@ -58,8 +58,6 @@ extern void DeviceFocusEvent(DeviceIntPtr dev, + + extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode); + +-extern void LeaveWindow(DeviceIntPtr dev); +- + extern void CoreFocusEvent(DeviceIntPtr kbd, + int type, int mode, int detail, WindowPtr pWin); + +diff --git a/include/eventstr.h b/include/eventstr.h +index bf3b95fe4a..2bae3b0767 100644 +--- a/include/eventstr.h ++++ b/include/eventstr.h +@@ -296,4 +296,7 @@ union _InternalEvent { + #endif + }; + ++extern void ++LeaveWindow(DeviceIntPtr dev); ++ + #endif +diff --git a/mi/mipointer.c b/mi/mipointer.c +index 75be1aeeb8..b12ae9be1d 100644 +--- a/mi/mipointer.c ++++ b/mi/mipointer.c +@@ -397,8 +397,21 @@ miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y) + #ifdef PANORAMIX + && noPanoramiXExtension + #endif +- ) +- UpdateSpriteForScreen(pDev, pScreen); ++ ) { ++ DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER); ++ /* Hack for CVE-2023-5380: if we're moving ++ * screens PointerWindows[] keeps referring to the ++ * old window. If that gets destroyed we have a UAF ++ * bug later. Only happens when jumping from a window ++ * to the root window on the other screen. ++ * Enter/Leave events are incorrect for that case but ++ * too niche to fix. ++ */ ++ LeaveWindow(pDev); ++ if (master) ++ LeaveWindow(master); ++ UpdateSpriteForScreen(pDev, pScreen); ++ } + } + + /** +-- +2.41.0 + diff --git a/0002-xkb-swap-XkbSetDeviceInfo-and-XkbSetDeviceInfoCheck.patch b/0002-xkb-swap-XkbSetDeviceInfo-and-XkbSetDeviceInfoCheck.patch new file mode 100644 index 0000000..8973a0e --- /dev/null +++ b/0002-xkb-swap-XkbSetDeviceInfo-and-XkbSetDeviceInfoCheck.patch @@ -0,0 +1,179 @@ +From dd8caf39e9e15d8f302e54045dd08d8ebf1025dc Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 5 Jul 2022 09:50:41 +1000 +Subject: [PATCH xserver 2/3] xkb: swap XkbSetDeviceInfo and + XkbSetDeviceInfoCheck + +XKB often uses a FooCheck and Foo function pair, the former is supposed +to check all values in the request and error out on BadLength, +BadValue, etc. The latter is then called once we're confident the values +are good (they may still fail on an individual device, but that's a +different topic). + +In the case of XkbSetDeviceInfo, those functions were incorrectly +named, with XkbSetDeviceInfo ending up as the checker function and +XkbSetDeviceInfoCheck as the setter function. As a result, the setter +function was called before the checker function, accessing request +data and modifying device state before we ensured that the data is +valid. + +In particular, the setter function relied on values being already +byte-swapped. This in turn could lead to potential OOB memory access. + +Fix this by correctly naming the functions and moving the length checks +over to the checker function. These were added in 87c64fc5b0 to the +wrong function, probably due to the incorrect naming. + +Fixes ZDI-CAN 16070, CVE-2022-2320. + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Introduced in c06e27b2f6fd9f7b9f827623a48876a225264132 + +Signed-off-by: Peter Hutterer +--- + xkb/xkb.c | 46 +++++++++++++++++++++++++--------------------- + 1 file changed, 25 insertions(+), 21 deletions(-) + +diff --git a/xkb/xkb.c b/xkb/xkb.c +index 64e52611e..34b2c290b 100644 +--- a/xkb/xkb.c ++++ b/xkb/xkb.c +@@ -6550,7 +6550,8 @@ ProcXkbGetDeviceInfo(ClientPtr client) + static char * + CheckSetDeviceIndicators(char *wire, + DeviceIntPtr dev, +- int num, int *status_rtrn, ClientPtr client) ++ int num, int *status_rtrn, ClientPtr client, ++ xkbSetDeviceInfoReq * stuff) + { + xkbDeviceLedsWireDesc *ledWire; + int i; +@@ -6558,6 +6559,11 @@ CheckSetDeviceIndicators(char *wire, + + ledWire = (xkbDeviceLedsWireDesc *) wire; + for (i = 0; i < num; i++) { ++ if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) { ++ *status_rtrn = BadLength; ++ return (char *) ledWire; ++ } ++ + if (client->swapped) { + swaps(&ledWire->ledClass); + swaps(&ledWire->ledID); +@@ -6585,6 +6591,11 @@ CheckSetDeviceIndicators(char *wire, + atomWire = (CARD32 *) &ledWire[1]; + if (nNames > 0) { + for (n = 0; n < nNames; n++) { ++ if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) { ++ *status_rtrn = BadLength; ++ return (char *) atomWire; ++ } ++ + if (client->swapped) { + swapl(atomWire); + } +@@ -6596,6 +6607,10 @@ CheckSetDeviceIndicators(char *wire, + mapWire = (xkbIndicatorMapWireDesc *) atomWire; + if (nMaps > 0) { + for (n = 0; n < nMaps; n++) { ++ if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) { ++ *status_rtrn = BadLength; ++ return (char *) mapWire; ++ } + if (client->swapped) { + swaps(&mapWire->virtualMods); + swapl(&mapWire->ctrls); +@@ -6647,11 +6662,6 @@ SetDeviceIndicators(char *wire, + xkbIndicatorMapWireDesc *mapWire; + XkbSrvLedInfoPtr sli; + +- if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) { +- *status_rtrn = BadLength; +- return (char *) ledWire; +- } +- + namec = mapc = statec = 0; + sli = XkbFindSrvLedInfo(dev, ledWire->ledClass, ledWire->ledID, + XkbXI_IndicatorMapsMask); +@@ -6670,10 +6680,6 @@ SetDeviceIndicators(char *wire, + memset((char *) sli->names, 0, XkbNumIndicators * sizeof(Atom)); + for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) { + if (ledWire->namesPresent & bit) { +- if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) { +- *status_rtrn = BadLength; +- return (char *) atomWire; +- } + sli->names[n] = (Atom) *atomWire; + if (sli->names[n] == None) + ledWire->namesPresent &= ~bit; +@@ -6691,10 +6697,6 @@ SetDeviceIndicators(char *wire, + if (ledWire->mapsPresent) { + for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) { + if (ledWire->mapsPresent & bit) { +- if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) { +- *status_rtrn = BadLength; +- return (char *) mapWire; +- } + sli->maps[n].flags = mapWire->flags; + sli->maps[n].which_groups = mapWire->whichGroups; + sli->maps[n].groups = mapWire->groups; +@@ -6730,13 +6732,17 @@ SetDeviceIndicators(char *wire, + } + + static int +-_XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev, ++_XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev, + xkbSetDeviceInfoReq * stuff) + { + char *wire; + + wire = (char *) &stuff[1]; + if (stuff->change & XkbXI_ButtonActionsMask) { ++ int sz = stuff->nBtns * SIZEOF(xkbActionWireDesc); ++ if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz)) ++ return BadLength; ++ + if (!dev->button) { + client->errorValue = _XkbErrCode2(XkbErr_BadClass, ButtonClass); + return XkbKeyboardErrorCode; +@@ -6747,13 +6753,13 @@ _XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev, + dev->button->numButtons); + return BadMatch; + } +- wire += (stuff->nBtns * SIZEOF(xkbActionWireDesc)); ++ wire += sz; + } + if (stuff->change & XkbXI_IndicatorsMask) { + int status = Success; + + wire = CheckSetDeviceIndicators(wire, dev, stuff->nDeviceLedFBs, +- &status, client); ++ &status, client, stuff); + if (status != Success) + return status; + } +@@ -6764,8 +6770,8 @@ _XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev, + } + + static int +-_XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev, +- xkbSetDeviceInfoReq * stuff) ++_XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev, ++ xkbSetDeviceInfoReq * stuff) + { + char *wire; + xkbExtensionDeviceNotify ed; +@@ -6789,8 +6795,6 @@ _XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev, + if (stuff->firstBtn + stuff->nBtns > nBtns) + return BadValue; + sz = stuff->nBtns * SIZEOF(xkbActionWireDesc); +- if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz)) +- return BadLength; + memcpy((char *) &acts[stuff->firstBtn], (char *) wire, sz); + wire += sz; + ed.reason |= XkbXI_ButtonActionsMask; +-- +2.36.1 + diff --git a/0003-Xi-avoid-integer-truncation-in-length-check-of-ProcX.patch b/0003-Xi-avoid-integer-truncation-in-length-check-of-ProcX.patch new file mode 100644 index 0000000..d3c6541 --- /dev/null +++ b/0003-Xi-avoid-integer-truncation-in-length-check-of-ProcX.patch @@ -0,0 +1,71 @@ +From f9c435822c852659e3926502829f1b13ce6efc37 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 29 Nov 2022 13:26:57 +1000 +Subject: [PATCH xserver 3/7] Xi: avoid integer truncation in length check of + ProcXIChangeProperty + +This fixes an OOB read and the resulting information disclosure. + +Length calculation for the request was clipped to a 32-bit integer. With +the correct stuff->num_items value the expected request size was +truncated, passing the REQUEST_FIXED_SIZE check. + +The server then proceeded with reading at least stuff->num_items bytes +(depending on stuff->format) from the request and stuffing whatever it +finds into the property. In the process it would also allocate at least +stuff->num_items bytes, i.e. 4GB. + +The same bug exists in ProcChangeProperty and ProcXChangeDeviceProperty, +so let's fix that too. + +CVE-2022-46344, ZDI-CAN 19405 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer +Acked-by: Olivier Fourdan +--- + Xi/xiproperty.c | 4 ++-- + dix/property.c | 3 ++- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c +index 68c362c628..066ba21fba 100644 +--- a/Xi/xiproperty.c ++++ b/Xi/xiproperty.c +@@ -890,7 +890,7 @@ ProcXChangeDeviceProperty(ClientPtr client) + REQUEST(xChangeDevicePropertyReq); + DeviceIntPtr dev; + unsigned long len; +- int totalSize; ++ uint64_t totalSize; + int rc; + + REQUEST_AT_LEAST_SIZE(xChangeDevicePropertyReq); +@@ -1130,7 +1130,7 @@ ProcXIChangeProperty(ClientPtr client) + { + int rc; + DeviceIntPtr dev; +- int totalSize; ++ uint64_t totalSize; + unsigned long len; + + REQUEST(xXIChangePropertyReq); +diff --git a/dix/property.c b/dix/property.c +index 94ef5a0ec0..acce94b2c6 100644 +--- a/dix/property.c ++++ b/dix/property.c +@@ -205,7 +205,8 @@ ProcChangeProperty(ClientPtr client) + WindowPtr pWin; + char format, mode; + unsigned long len; +- int sizeInBytes, totalSize, err; ++ int sizeInBytes, err; ++ uint64_t totalSize; + + REQUEST(xChangePropertyReq); + +-- +2.38.1 + diff --git a/0003-Xquartz-ProcAppleDRICreatePixmap-needs-to-use-unswap.patch b/0003-Xquartz-ProcAppleDRICreatePixmap-needs-to-use-unswap.patch new file mode 100644 index 0000000..df0a498 --- /dev/null +++ b/0003-Xquartz-ProcAppleDRICreatePixmap-needs-to-use-unswap.patch @@ -0,0 +1,47 @@ +From 6c684d035c06fd41c727f0ef0744517580864cef Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 22 Mar 2024 19:07:34 -0700 +Subject: [PATCH 3/4] Xquartz: ProcAppleDRICreatePixmap needs to use unswapped + length to send reply + +CVE-2024-31082 + +Fixes: 14205ade0 ("XQuartz: appledri: Fix byte swapping in replies") +Signed-off-by: Alan Coopersmith +Part-of: +--- + hw/xquartz/xpr/appledri.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/hw/xquartz/xpr/appledri.c b/hw/xquartz/xpr/appledri.c +index 77574655b..40422b61a 100644 +--- a/hw/xquartz/xpr/appledri.c ++++ b/hw/xquartz/xpr/appledri.c +@@ -272,6 +272,7 @@ ProcAppleDRICreatePixmap(ClientPtr client) + xAppleDRICreatePixmapReply rep; + int width, height, pitch, bpp; + void *ptr; ++ CARD32 stringLength; + + REQUEST_SIZE_MATCH(xAppleDRICreatePixmapReq); + +@@ -307,6 +308,7 @@ ProcAppleDRICreatePixmap(ClientPtr client) + if (sizeof(rep) != sz_xAppleDRICreatePixmapReply) + ErrorF("error sizeof(rep) is %zu\n", sizeof(rep)); + ++ stringLength = rep.stringLength; /* save unswapped value */ + if (client->swapped) { + swaps(&rep.sequenceNumber); + swapl(&rep.length); +@@ -319,7 +321,7 @@ ProcAppleDRICreatePixmap(ClientPtr client) + } + + WriteToClient(client, sizeof(rep), &rep); +- WriteToClient(client, rep.stringLength, path); ++ WriteToClient(client, stringLength, path); + + return Success; + } +-- +2.44.0 + diff --git a/0003-dix-fix-DeviceStateNotify-event-calculation.patch b/0003-dix-fix-DeviceStateNotify-event-calculation.patch new file mode 100644 index 0000000..2fe2f8e --- /dev/null +++ b/0003-dix-fix-DeviceStateNotify-event-calculation.patch @@ -0,0 +1,217 @@ +From 219c54b8a3337456ce5270ded6a67bcde53553d5 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Mon, 18 Dec 2023 12:26:20 +1000 +Subject: [PATCH 3/9] dix: fix DeviceStateNotify event calculation + +The previous code only made sense if one considers buttons and keys to +be mutually exclusive on a device. That is not necessarily true, causing +a number of issues. + +This function allocates and fills in the number of xEvents we need to +send the device state down the wire. This is split across multiple +32-byte devices including one deviceStateNotify event and optional +deviceKeyStateNotify, deviceButtonStateNotify and (possibly multiple) +deviceValuator events. + +The previous behavior would instead compose a sequence +of [state, buttonstate, state, keystate, valuator...]. This is not +protocol correct, and on top of that made the code extremely convoluted. + +Fix this by streamlining: add both button and key into the deviceStateNotify +and then append the key state and button state, followed by the +valuators. Finally, the deviceValuator events contain up to 6 valuators +per event but we only ever sent through 3 at a time. Let's double that +troughput. + +CVE-2024-0229, ZDI-CAN-22678 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative +--- + dix/enterleave.c | 121 ++++++++++++++++++++--------------------------- + 1 file changed, 52 insertions(+), 69 deletions(-) + +diff --git a/dix/enterleave.c b/dix/enterleave.c +index 17964b00a..7b7ba1098 100644 +--- a/dix/enterleave.c ++++ b/dix/enterleave.c +@@ -615,9 +615,15 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v, + + ev->type = DeviceValuator; + ev->deviceid = dev->id; +- ev->num_valuators = nval < 3 ? nval : 3; ++ ev->num_valuators = nval < 6 ? nval : 6; + ev->first_valuator = first; + switch (ev->num_valuators) { ++ case 6: ++ ev->valuator2 = v->axisVal[first + 5]; ++ case 5: ++ ev->valuator2 = v->axisVal[first + 4]; ++ case 4: ++ ev->valuator2 = v->axisVal[first + 3]; + case 3: + ev->valuator2 = v->axisVal[first + 2]; + case 2: +@@ -626,7 +632,6 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v, + ev->valuator0 = v->axisVal[first]; + break; + } +- first += ev->num_valuators; + } + + static void +@@ -646,7 +651,7 @@ FixDeviceStateNotify(DeviceIntPtr dev, deviceStateNotify * ev, KeyClassPtr k, + ev->num_buttons = b->numButtons; + memcpy((char *) ev->buttons, (char *) b->down, 4); + } +- else if (k) { ++ if (k) { + ev->classes_reported |= (1 << KeyClass); + ev->num_keys = k->xkbInfo->desc->max_key_code - + k->xkbInfo->desc->min_key_code; +@@ -670,15 +675,26 @@ FixDeviceStateNotify(DeviceIntPtr dev, deviceStateNotify * ev, KeyClassPtr k, + } + } + +- ++/** ++ * The device state notify event is split across multiple 32-byte events. ++ * The first one contains the first 32 button state bits, the first 32 ++ * key state bits, and the first 3 valuator values. ++ * ++ * If a device has more than that, the server sends out: ++ * - one deviceButtonStateNotify for buttons 32 and above ++ * - one deviceKeyStateNotify for keys 32 and above ++ * - one deviceValuator event per 6 valuators above valuator 4 ++ * ++ * All events but the last one have the deviceid binary ORed with MORE_EVENTS, ++ */ + static void + DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) + { ++ /* deviceStateNotify, deviceKeyStateNotify, deviceButtonStateNotify ++ * and one deviceValuator for each 6 valuators */ ++ deviceStateNotify sev[3 + (MAX_VALUATORS + 6)/6]; + int evcount = 1; +- deviceStateNotify sev[6 + (MAX_VALUATORS + 2)/3]; +- deviceStateNotify *ev; +- deviceKeyStateNotify *kev; +- deviceButtonStateNotify *bev; ++ deviceStateNotify *ev = sev; + + KeyClassPtr k; + ButtonClassPtr b; +@@ -691,82 +707,49 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) + + if ((b = dev->button) != NULL) { + nbuttons = b->numButtons; +- if (nbuttons > 32) ++ if (nbuttons > 32) /* first 32 are encoded in deviceStateNotify */ + evcount++; + } + if ((k = dev->key) != NULL) { + nkeys = k->xkbInfo->desc->max_key_code - k->xkbInfo->desc->min_key_code; +- if (nkeys > 32) ++ if (nkeys > 32) /* first 32 are encoded in deviceStateNotify */ + evcount++; +- if (nbuttons > 0) { +- evcount++; +- } + } + if ((v = dev->valuator) != NULL) { + nval = v->numAxes; +- +- if (nval > 3) +- evcount++; +- if (nval > 6) { +- if (!(k && b)) +- evcount++; +- if (nval > 9) +- evcount += ((nval - 7) / 3); +- } ++ /* first three are encoded in deviceStateNotify, then ++ * it's 6 per deviceValuator event */ ++ evcount += ((nval - 3) + 6)/6; + } + +- ev = sev; +- FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first); +- +- if (b != NULL) { +- FixDeviceStateNotify(dev, ev++, NULL, b, v, first); +- first += 3; +- nval -= 3; +- if (nbuttons > 32) { +- (ev - 1)->deviceid |= MORE_EVENTS; +- bev = (deviceButtonStateNotify *) ev++; +- bev->type = DeviceButtonStateNotify; +- bev->deviceid = dev->id; +- memcpy((char *) &bev->buttons[4], (char *) &b->down[4], +- DOWN_LENGTH - 4); +- } +- if (nval > 0) { +- (ev - 1)->deviceid |= MORE_EVENTS; +- FixDeviceValuator(dev, (deviceValuator *) ev++, v, first); +- first += 3; +- nval -= 3; +- } ++ BUG_RETURN(evcount <= ARRAY_SIZE(sev)); ++ ++ FixDeviceStateNotify(dev, ev, k, b, v, first); ++ ++ if (b != NULL && nbuttons > 32) { ++ deviceButtonStateNotify *bev = (deviceButtonStateNotify *) ++ev; ++ (ev - 1)->deviceid |= MORE_EVENTS; ++ bev->type = DeviceButtonStateNotify; ++ bev->deviceid = dev->id; ++ memcpy((char *) &bev->buttons[4], (char *) &b->down[4], ++ DOWN_LENGTH - 4); + } + +- if (k != NULL) { +- FixDeviceStateNotify(dev, ev++, k, NULL, v, first); +- first += 3; +- nval -= 3; +- if (nkeys > 32) { +- (ev - 1)->deviceid |= MORE_EVENTS; +- kev = (deviceKeyStateNotify *) ev++; +- kev->type = DeviceKeyStateNotify; +- kev->deviceid = dev->id; +- memmove((char *) &kev->keys[0], (char *) &k->down[4], 28); +- } +- if (nval > 0) { +- (ev - 1)->deviceid |= MORE_EVENTS; +- FixDeviceValuator(dev, (deviceValuator *) ev++, v, first); +- first += 3; +- nval -= 3; +- } ++ if (k != NULL && nkeys > 32) { ++ deviceKeyStateNotify *kev = (deviceKeyStateNotify *) ++ev; ++ (ev - 1)->deviceid |= MORE_EVENTS; ++ kev->type = DeviceKeyStateNotify; ++ kev->deviceid = dev->id; ++ memmove((char *) &kev->keys[0], (char *) &k->down[4], 28); + } + ++ first = 3; ++ nval -= 3; + while (nval > 0) { +- FixDeviceStateNotify(dev, ev++, NULL, NULL, v, first); +- first += 3; +- nval -= 3; +- if (nval > 0) { +- (ev - 1)->deviceid |= MORE_EVENTS; +- FixDeviceValuator(dev, (deviceValuator *) ev++, v, first); +- first += 3; +- nval -= 3; +- } ++ ev->deviceid |= MORE_EVENTS; ++ FixDeviceValuator(dev, (deviceValuator *) ++ev, v, first); ++ first += 6; ++ nval -= 6; + } + + DeliverEventsToWindow(dev, win, (xEvent *) sev, evcount, +-- +2.43.0 + diff --git a/0003-xkb-add-request-length-validation-for-XkbSetGeometry.patch b/0003-xkb-add-request-length-validation-for-XkbSetGeometry.patch new file mode 100644 index 0000000..dca4d7c --- /dev/null +++ b/0003-xkb-add-request-length-validation-for-XkbSetGeometry.patch @@ -0,0 +1,182 @@ +From 6907b6ea2b4ce949cb07271f5b678d5966d9df42 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 5 Jul 2022 11:11:06 +1000 +Subject: [PATCH xserver 3/3] xkb: add request length validation for + XkbSetGeometry + +No validation of the various fields on that report were done, so a +malicious client could send a short request that claims it had N +sections, or rows, or keys, and the server would process the request for +N sections, running out of bounds of the actual request data. + +Fix this by adding size checks to ensure our data is valid. + +ZDI-CAN 16062, CVE-2022-2319. + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer +--- + xkb/xkb.c | 43 ++++++++++++++++++++++++++++++++++++++----- + 1 file changed, 38 insertions(+), 5 deletions(-) + +diff --git a/xkb/xkb.c b/xkb/xkb.c +index 34b2c290b..4692895db 100644 +--- a/xkb/xkb.c ++++ b/xkb/xkb.c +@@ -5156,7 +5156,7 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str) + } + + static Status +-_CheckSetDoodad(char **wire_inout, ++_CheckSetDoodad(char **wire_inout, xkbSetGeometryReq *req, + XkbGeometryPtr geom, XkbSectionPtr section, ClientPtr client) + { + char *wire; +@@ -5167,6 +5167,9 @@ _CheckSetDoodad(char **wire_inout, + Status status; + + dWire = (xkbDoodadWireDesc *) (*wire_inout); ++ if (!_XkbCheckRequestBounds(client, req, dWire, dWire + 1)) ++ return BadLength; ++ + any = dWire->any; + wire = (char *) &dWire[1]; + if (client->swapped) { +@@ -5269,7 +5272,7 @@ _CheckSetDoodad(char **wire_inout, + } + + static Status +-_CheckSetOverlay(char **wire_inout, ++_CheckSetOverlay(char **wire_inout, xkbSetGeometryReq *req, + XkbGeometryPtr geom, XkbSectionPtr section, ClientPtr client) + { + register int r; +@@ -5280,6 +5283,9 @@ _CheckSetOverlay(char **wire_inout, + + wire = *wire_inout; + olWire = (xkbOverlayWireDesc *) wire; ++ if (!_XkbCheckRequestBounds(client, req, olWire, olWire + 1)) ++ return BadLength; ++ + if (client->swapped) { + swapl(&olWire->name); + } +@@ -5291,6 +5297,9 @@ _CheckSetOverlay(char **wire_inout, + xkbOverlayKeyWireDesc *kWire; + XkbOverlayRowPtr row; + ++ if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1)) ++ return BadLength; ++ + if (rWire->rowUnder > section->num_rows) { + client->errorValue = _XkbErrCode4(0x20, r, section->num_rows, + rWire->rowUnder); +@@ -5299,6 +5308,9 @@ _CheckSetOverlay(char **wire_inout, + row = XkbAddGeomOverlayRow(ol, rWire->rowUnder, rWire->nKeys); + kWire = (xkbOverlayKeyWireDesc *) &rWire[1]; + for (k = 0; k < rWire->nKeys; k++, kWire++) { ++ if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1)) ++ return BadLength; ++ + if (XkbAddGeomOverlayKey(ol, row, + (char *) kWire->over, + (char *) kWire->under) == NULL) { +@@ -5332,6 +5344,9 @@ _CheckSetSections(XkbGeometryPtr geom, + register int r; + xkbRowWireDesc *rWire; + ++ if (!_XkbCheckRequestBounds(client, req, sWire, sWire + 1)) ++ return BadLength; ++ + if (client->swapped) { + swapl(&sWire->name); + swaps(&sWire->top); +@@ -5357,6 +5372,9 @@ _CheckSetSections(XkbGeometryPtr geom, + XkbRowPtr row; + xkbKeyWireDesc *kWire; + ++ if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1)) ++ return BadLength; ++ + if (client->swapped) { + swaps(&rWire->top); + swaps(&rWire->left); +@@ -5371,6 +5389,9 @@ _CheckSetSections(XkbGeometryPtr geom, + for (k = 0; k < rWire->nKeys; k++, kWire++) { + XkbKeyPtr key; + ++ if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1)) ++ return BadLength; ++ + key = XkbAddGeomKey(row); + if (!key) + return BadAlloc; +@@ -5396,7 +5417,7 @@ _CheckSetSections(XkbGeometryPtr geom, + register int d; + + for (d = 0; d < sWire->nDoodads; d++) { +- status = _CheckSetDoodad(&wire, geom, section, client); ++ status = _CheckSetDoodad(&wire, req, geom, section, client); + if (status != Success) + return status; + } +@@ -5405,7 +5426,7 @@ _CheckSetSections(XkbGeometryPtr geom, + register int o; + + for (o = 0; o < sWire->nOverlays; o++) { +- status = _CheckSetOverlay(&wire, geom, section, client); ++ status = _CheckSetOverlay(&wire, req, geom, section, client); + if (status != Success) + return status; + } +@@ -5439,6 +5460,9 @@ _CheckSetShapes(XkbGeometryPtr geom, + xkbOutlineWireDesc *olWire; + XkbOutlinePtr ol; + ++ if (!_XkbCheckRequestBounds(client, req, shapeWire, shapeWire + 1)) ++ return BadLength; ++ + shape = + XkbAddGeomShape(geom, shapeWire->name, shapeWire->nOutlines); + if (!shape) +@@ -5449,12 +5473,18 @@ _CheckSetShapes(XkbGeometryPtr geom, + XkbPointPtr pt; + xkbPointWireDesc *ptWire; + ++ if (!_XkbCheckRequestBounds(client, req, olWire, olWire + 1)) ++ return BadLength; ++ + ol = XkbAddGeomOutline(shape, olWire->nPoints); + if (!ol) + return BadAlloc; + ol->corner_radius = olWire->cornerRadius; + ptWire = (xkbPointWireDesc *) &olWire[1]; + for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++, ptWire++) { ++ if (!_XkbCheckRequestBounds(client, req, ptWire, ptWire + 1)) ++ return BadLength; ++ + pt->x = ptWire->x; + pt->y = ptWire->y; + if (client->swapped) { +@@ -5560,12 +5590,15 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSetGeometryReq * req, ClientPtr client) + return status; + + for (i = 0; i < req->nDoodads; i++) { +- status = _CheckSetDoodad(&wire, geom, NULL, client); ++ status = _CheckSetDoodad(&wire, req, geom, NULL, client); + if (status != Success) + return status; + } + + for (i = 0; i < req->nKeyAliases; i++) { ++ if (!_XkbCheckRequestBounds(client, req, wire, wire + XkbKeyNameLength)) ++ return BadLength; ++ + if (XkbAddGeomKeyAlias(geom, &wire[XkbKeyNameLength], wire) == NULL) + return BadAlloc; + wire += 2 * XkbKeyNameLength; +-- +2.36.1 + diff --git a/0004-Xi-disallow-passive-grabs-with-a-detail-255.patch b/0004-Xi-disallow-passive-grabs-with-a-detail-255.patch new file mode 100644 index 0000000..5b189ea --- /dev/null +++ b/0004-Xi-disallow-passive-grabs-with-a-detail-255.patch @@ -0,0 +1,82 @@ +From 0dab0b527ac5c4fe0272ea679522bd87238a733b Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 29 Nov 2022 13:55:32 +1000 +Subject: [PATCH xserver 4/7] Xi: disallow passive grabs with a detail > 255 + +The XKB protocol effectively prevents us from ever using keycodes above +255. For buttons it's theoretically possible but realistically too niche +to worry about. For all other passive grabs, the detail must be zero +anyway. + +This fixes an OOB write: + +ProcXIPassiveUngrabDevice() calls DeletePassiveGrabFromList with a +temporary grab struct which contains tempGrab->detail.exact = stuff->detail. +For matching existing grabs, DeleteDetailFromMask is called with the +stuff->detail value. This function creates a new mask with the one bit +representing stuff->detail cleared. + +However, the array size for the new mask is 8 * sizeof(CARD32) bits, +thus any detail above 255 results in an OOB array write. + +CVE-2022-46341, ZDI-CAN 19381 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer +Acked-by: Olivier Fourdan +--- + Xi/xipassivegrab.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c +index 2769fb7c94..c9ac2f8553 100644 +--- a/Xi/xipassivegrab.c ++++ b/Xi/xipassivegrab.c +@@ -137,6 +137,12 @@ ProcXIPassiveGrabDevice(ClientPtr client) + return BadValue; + } + ++ /* XI2 allows 32-bit keycodes but thanks to XKB we can never ++ * implement this. Just return an error for all keycodes that ++ * cannot work anyway, same for buttons > 255. */ ++ if (stuff->detail > 255) ++ return XIAlreadyGrabbed; ++ + if (XICheckInvalidMaskBits(client, (unsigned char *) &stuff[1], + stuff->mask_len * 4) != Success) + return BadValue; +@@ -207,14 +213,8 @@ ProcXIPassiveGrabDevice(ClientPtr client) + ¶m, XI2, &mask); + break; + case XIGrabtypeKeycode: +- /* XI2 allows 32-bit keycodes but thanks to XKB we can never +- * implement this. Just return an error for all keycodes that +- * cannot work anyway */ +- if (stuff->detail > 255) +- status = XIAlreadyGrabbed; +- else +- status = GrabKey(client, dev, mod_dev, stuff->detail, +- ¶m, XI2, &mask); ++ status = GrabKey(client, dev, mod_dev, stuff->detail, ++ ¶m, XI2, &mask); + break; + case XIGrabtypeEnter: + case XIGrabtypeFocusIn: +@@ -334,6 +334,12 @@ ProcXIPassiveUngrabDevice(ClientPtr client) + return BadValue; + } + ++ /* We don't allow passive grabs for details > 255 anyway */ ++ if (stuff->detail > 255) { ++ client->errorValue = stuff->detail; ++ return BadValue; ++ } ++ + rc = dixLookupWindow(&win, stuff->grab_window, client, DixSetAttrAccess); + if (rc != Success) + return rc; +-- +2.38.1 + diff --git a/0004-Xi-when-creating-a-new-ButtonClass-set-the-number-of.patch b/0004-Xi-when-creating-a-new-ButtonClass-set-the-number-of.patch new file mode 100644 index 0000000..dbe90ce --- /dev/null +++ b/0004-Xi-when-creating-a-new-ButtonClass-set-the-number-of.patch @@ -0,0 +1,37 @@ +From df3c65706eb169d5938df0052059f3e0d5981b74 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Thu, 21 Dec 2023 13:48:10 +1000 +Subject: [PATCH 4/9] Xi: when creating a new ButtonClass, set the number of + buttons + +There's a racy sequence where a master device may copy the button class +from the slave, without ever initializing numButtons. This leads to a +device with zero buttons but a button class which is invalid. + +Let's copy the numButtons value from the source - by definition if we +don't have a button class yet we do not have any other slave devices +with more than this number of buttons anyway. + +CVE-2024-0229, ZDI-CAN-22678 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative +--- + Xi/exevents.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Xi/exevents.c b/Xi/exevents.c +index 54ea11a93..e16171468 100644 +--- a/Xi/exevents.c ++++ b/Xi/exevents.c +@@ -605,6 +605,7 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) + to->button = calloc(1, sizeof(ButtonClassRec)); + if (!to->button) + FatalError("[Xi] no memory for class shift.\n"); ++ to->button->numButtons = from->button->numButtons; + } + else + classes->button = NULL; +-- +2.43.0 + diff --git a/0004-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch b/0004-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch new file mode 100644 index 0000000..dcbf337 --- /dev/null +++ b/0004-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch @@ -0,0 +1,112 @@ +From bdca6c3d1f5057eeb31609b1280fc93237b00c77 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 30 Jan 2024 13:13:35 +1000 +Subject: [PATCH 4/4] render: fix refcounting of glyphs during + ProcRenderAddGlyphs + +Previously, AllocateGlyph would return a new glyph with refcount=0 and a +re-used glyph would end up not changing the refcount at all. The +resulting glyph_new array would thus have multiple entries pointing to +the same non-refcounted glyphs. + +AddGlyph may free a glyph, resulting in a UAF when the same glyph +pointer is then later used. + +Fix this by returning a refcount of 1 for a new glyph and always +incrementing the refcount for a re-used glyph, followed by dropping that +refcount back down again when we're done with it. + +CVE-2024-31083, ZDI-CAN-22880 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Part-of: +--- + render/glyph.c | 5 +++-- + render/glyphstr_priv.h | 1 + + render/render.c | 15 +++++++++++---- + 3 files changed, 15 insertions(+), 6 deletions(-) + +diff --git a/render/glyph.c b/render/glyph.c +index 850ea8440..13991f8a1 100644 +--- a/render/glyph.c ++++ b/render/glyph.c +@@ -245,10 +245,11 @@ FreeGlyphPicture(GlyphPtr glyph) + } + } + +-static void ++void + FreeGlyph(GlyphPtr glyph, int format) + { + CheckDuplicates(&globalGlyphs[format], "FreeGlyph"); ++ BUG_RETURN(glyph->refcnt == 0); + if (--glyph->refcnt == 0) { + GlyphRefPtr gr; + int i; +@@ -354,7 +355,7 @@ AllocateGlyph(xGlyphInfo * gi, int fdepth) + glyph = (GlyphPtr) malloc(size); + if (!glyph) + return 0; +- glyph->refcnt = 0; ++ glyph->refcnt = 1; + glyph->size = size + sizeof(xGlyphInfo); + glyph->info = *gi; + dixInitPrivates(glyph, (char *) glyph + head_size, PRIVATE_GLYPH); +diff --git a/render/glyphstr.h b/render/glyphstr.h +index 2f51bd244..3b1d806d1 100644 +--- a/render/glyphstr.h ++++ b/render/glyphstr.h +@@ -108,6 +108,7 @@ extern Bool + extern GlyphPtr FindGlyph(GlyphSetPtr glyphSet, Glyph id); + + extern GlyphPtr AllocateGlyph(xGlyphInfo * gi, int format); ++extern void FreeGlyph(GlyphPtr glyph, int format); + + extern Bool + ResizeGlyphSet(GlyphSetPtr glyphSet, CARD32 change); +diff --git a/render/render.c b/render/render.c +index 29c5055c6..fe5e37dd9 100644 +--- a/render/render.c ++++ b/render/render.c +@@ -1076,6 +1076,7 @@ ProcRenderAddGlyphs(ClientPtr client) + + if (glyph_new->glyph && glyph_new->glyph != DeletedGlyph) { + glyph_new->found = TRUE; ++ ++glyph_new->glyph->refcnt; + } + else { + GlyphPtr glyph; +@@ -1168,8 +1169,10 @@ ProcRenderAddGlyphs(ClientPtr client) + err = BadAlloc; + goto bail; + } +- for (i = 0; i < nglyphs; i++) ++ for (i = 0; i < nglyphs; i++) { + AddGlyph(glyphSet, glyphs[i].glyph, glyphs[i].id); ++ FreeGlyph(glyphs[i].glyph, glyphSet->fdepth); ++ } + + if (glyphsBase != glyphsLocal) + free(glyphsBase); +@@ -1179,9 +1182,13 @@ ProcRenderAddGlyphs(ClientPtr client) + FreePicture((void *) pSrc, 0); + if (pSrcPix) + FreeScratchPixmapHeader(pSrcPix); +- for (i = 0; i < nglyphs; i++) +- if (glyphs[i].glyph && !glyphs[i].found) +- free(glyphs[i].glyph); ++ for (i = 0; i < nglyphs; i++) { ++ if (glyphs[i].glyph) { ++ --glyphs[i].glyph->refcnt; ++ if (!glyphs[i].found) ++ free(glyphs[i].glyph); ++ } ++ } + if (glyphsBase != glyphsLocal) + free(glyphsBase); + return err; +-- +2.44.0 + diff --git a/0005-Xext-free-the-screen-saver-resource-when-replacing-i.patch b/0005-Xext-free-the-screen-saver-resource-when-replacing-i.patch new file mode 100644 index 0000000..dc2a9d9 --- /dev/null +++ b/0005-Xext-free-the-screen-saver-resource-when-replacing-i.patch @@ -0,0 +1,48 @@ +From 94f6fe99d87cf6ba0adadd95c595158c345b7d29 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 29 Nov 2022 14:53:07 +1000 +Subject: [PATCH xserver 5/7] Xext: free the screen saver resource when + replacing it + +This fixes a use-after-free bug: + +When a client first calls ScreenSaverSetAttributes(), a struct +ScreenSaverAttrRec is allocated and added to the client's +resources. + +When the same client calls ScreenSaverSetAttributes() again, a new +struct ScreenSaverAttrRec is allocated, replacing the old struct. The +old struct was freed but not removed from the clients resources. + +Later, when the client is destroyed the resource system invokes +ScreenSaverFreeAttr and attempts to clean up the already freed struct. + +Fix this by letting the resource system free the old attrs instead. + +CVE-2022-46343, ZDI-CAN 19404 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer +Acked-by: Olivier Fourdan +--- + Xext/saver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Xext/saver.c b/Xext/saver.c +index f813ba08d1..fd6153c313 100644 +--- a/Xext/saver.c ++++ b/Xext/saver.c +@@ -1051,7 +1051,7 @@ ScreenSaverSetAttributes(ClientPtr client) + pVlist++; + } + if (pPriv->attr) +- FreeScreenAttr(pPriv->attr); ++ FreeResource(pPriv->attr->resource, AttrType); + pPriv->attr = pAttr; + pAttr->resource = FakeClientID(client->index); + if (!AddResource(pAttr->resource, AttrType, (void *) pAttr)) +-- +2.38.1 + diff --git a/0005-Xi-flush-hierarchy-events-after-adding-removing-mast.patch b/0005-Xi-flush-hierarchy-events-after-adding-removing-mast.patch new file mode 100644 index 0000000..6a21b3c --- /dev/null +++ b/0005-Xi-flush-hierarchy-events-after-adding-removing-mast.patch @@ -0,0 +1,109 @@ +From 4a5e9b1895627d40d26045bd0b7ef3dce503cbd1 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Thu, 4 Jan 2024 10:01:24 +1000 +Subject: [PATCH 5/9] Xi: flush hierarchy events after adding/removing master + devices + +The `XISendDeviceHierarchyEvent()` function allocates space to store up +to `MAXDEVICES` (256) `xXIHierarchyInfo` structures in `info`. + +If a device with a given ID was removed and a new device with the same +ID added both in the same operation, the single device ID will lead to +two info structures being written to `info`. + +Since this case can occur for every device ID at once, a total of two +times `MAXDEVICES` info structures might be written to the allocation. + +To avoid it, once one add/remove master is processed, send out the +device hierarchy event for the current state and continue. That event +thus only ever has exactly one of either added/removed in it (and +optionally slave attached/detached). + +CVE-2024-21885, ZDI-CAN-22744 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative +--- + Xi/xichangehierarchy.c | 27 ++++++++++++++++++++++----- + 1 file changed, 22 insertions(+), 5 deletions(-) + +diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c +index d2d985848..72d00451e 100644 +--- a/Xi/xichangehierarchy.c ++++ b/Xi/xichangehierarchy.c +@@ -416,6 +416,11 @@ ProcXIChangeHierarchy(ClientPtr client) + size_t len; /* length of data remaining in request */ + int rc = Success; + int flags[MAXDEVICES] = { 0 }; ++ enum { ++ NO_CHANGE, ++ FLUSH, ++ CHANGED, ++ } changes = NO_CHANGE; + + REQUEST(xXIChangeHierarchyReq); + REQUEST_AT_LEAST_SIZE(xXIChangeHierarchyReq); +@@ -465,8 +470,9 @@ ProcXIChangeHierarchy(ClientPtr client) + rc = add_master(client, c, flags); + if (rc != Success) + goto unwind; +- } ++ changes = FLUSH; + break; ++ } + case XIRemoveMaster: + { + xXIRemoveMasterInfo *r = (xXIRemoveMasterInfo *) any; +@@ -475,8 +481,9 @@ ProcXIChangeHierarchy(ClientPtr client) + rc = remove_master(client, r, flags); + if (rc != Success) + goto unwind; +- } ++ changes = FLUSH; + break; ++ } + case XIDetachSlave: + { + xXIDetachSlaveInfo *c = (xXIDetachSlaveInfo *) any; +@@ -485,8 +492,9 @@ ProcXIChangeHierarchy(ClientPtr client) + rc = detach_slave(client, c, flags); + if (rc != Success) + goto unwind; +- } ++ changes = CHANGED; + break; ++ } + case XIAttachSlave: + { + xXIAttachSlaveInfo *c = (xXIAttachSlaveInfo *) any; +@@ -495,16 +503,25 @@ ProcXIChangeHierarchy(ClientPtr client) + rc = attach_slave(client, c, flags); + if (rc != Success) + goto unwind; ++ changes = CHANGED; ++ break; + } ++ default: + break; + } + ++ if (changes == FLUSH) { ++ XISendDeviceHierarchyEvent(flags); ++ memset(flags, 0, sizeof(flags)); ++ changes = NO_CHANGE; ++ } ++ + len -= any->length * 4; + any = (xXIAnyHierarchyChangeInfo *) ((char *) any + any->length * 4); + } + + unwind: +- +- XISendDeviceHierarchyEvent(flags); ++ if (changes != NO_CHANGE) ++ XISendDeviceHierarchyEvent(flags); + return rc; + } +-- +2.43.0 + diff --git a/0006-Xext-free-the-XvRTVideoNotify-when-turning-off-from-.patch b/0006-Xext-free-the-XvRTVideoNotify-when-turning-off-from-.patch new file mode 100644 index 0000000..ba8b8fa --- /dev/null +++ b/0006-Xext-free-the-XvRTVideoNotify-when-turning-off-from-.patch @@ -0,0 +1,74 @@ +From a42635ee3c01f71a49052d83a372933504c9db04 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Wed, 30 Nov 2022 11:20:40 +1000 +Subject: [PATCH xserver 6/7] Xext: free the XvRTVideoNotify when turning off + from the same client + +This fixes a use-after-free bug: + +When a client first calls XvdiSelectVideoNotify() on a drawable with a +TRUE onoff argument, a struct XvVideoNotifyRec is allocated. This struct +is added twice to the resources: + - as the drawable's XvRTVideoNotifyList. This happens only once per + drawable, subsequent calls append to this list. + - as the client's XvRTVideoNotify. This happens for every client. + +The struct keeps the ClientPtr around once it has been added for a +client. The idea, presumably, is that if the client disconnects we can remove +all structs from the drawable's list that match the client (by resetting +the ClientPtr to NULL), but if the drawable is destroyed we can remove +and free the whole list. + +However, if the same client then calls XvdiSelectVideoNotify() on the +same drawable with a FALSE onoff argument, only the ClientPtr on the +existing struct was set to NULL. The struct itself remained in the +client's resources. + +If the drawable is now destroyed, the resource system invokes +XvdiDestroyVideoNotifyList which frees the whole list for this drawable +- including our struct. This function however does not free the resource +for the client since our ClientPtr is NULL. + +Later, when the client is destroyed and the resource system invokes +XvdiDestroyVideoNotify, we unconditionally set the ClientPtr to NULL. On +a struct that has been freed previously. This is generally frowned upon. + +Fix this by calling FreeResource() on the second call instead of merely +setting the ClientPtr to NULL. This removes the struct from the client +resources (but not from the list), ensuring that it won't be accessed +again when the client quits. + +Note that the assignment tpn->client = NULL; is superfluous since the +XvdiDestroyVideoNotify function will do this anyway. But it's left for +clarity and to match a similar invocation in XvdiSelectPortNotify. + +CVE-2022-46342, ZDI-CAN 19400 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer +Acked-by: Olivier Fourdan +--- + Xext/xvmain.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Xext/xvmain.c b/Xext/xvmain.c +index f627471938..2a08f8744a 100644 +--- a/Xext/xvmain.c ++++ b/Xext/xvmain.c +@@ -811,8 +811,10 @@ XvdiSelectVideoNotify(ClientPtr client, DrawablePtr pDraw, BOOL onoff) + tpn = pn; + while (tpn) { + if (tpn->client == client) { +- if (!onoff) ++ if (!onoff) { + tpn->client = NULL; ++ FreeResource(tpn->id, XvRTVideoNotify); ++ } + return Success; + } + if (!tpn->client) +-- +2.38.1 + diff --git a/0006-Xi-do-not-keep-linked-list-pointer-during-recursion.patch b/0006-Xi-do-not-keep-linked-list-pointer-during-recursion.patch new file mode 100644 index 0000000..3174635 --- /dev/null +++ b/0006-Xi-do-not-keep-linked-list-pointer-during-recursion.patch @@ -0,0 +1,70 @@ +From bc1fdbe46559dd947674375946bbef54dd0ce36b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= +Date: Fri, 22 Dec 2023 18:28:31 +0100 +Subject: [PATCH 6/9] Xi: do not keep linked list pointer during recursion + +The `DisableDevice()` function is called whenever an enabled device +is disabled and it moves the device from the `inputInfo.devices` linked +list to the `inputInfo.off_devices` linked list. + +However, its link/unlink operation has an issue during the recursive +call to `DisableDevice()` due to the `prev` pointer pointing to a +removed device. + +This issue leads to a length mismatch between the total number of +devices and the number of device in the list, leading to a heap +overflow and, possibly, to local privilege escalation. + +Simplify the code that checked whether the device passed to +`DisableDevice()` was in `inputInfo.devices` or not and find the +previous device after the recursion. + +CVE-2024-21886, ZDI-CAN-22840 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative +--- + dix/devices.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/dix/devices.c b/dix/devices.c +index dca98c8d1..389d28a23 100644 +--- a/dix/devices.c ++++ b/dix/devices.c +@@ -453,14 +453,20 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent) + { + DeviceIntPtr *prev, other; + BOOL enabled; ++ BOOL dev_in_devices_list = FALSE; + int flags[MAXDEVICES] = { 0 }; + + if (!dev->enabled) + return TRUE; + +- for (prev = &inputInfo.devices; +- *prev && (*prev != dev); prev = &(*prev)->next); +- if (*prev != dev) ++ for (other = inputInfo.devices; other; other = other->next) { ++ if (other == dev) { ++ dev_in_devices_list = TRUE; ++ break; ++ } ++ } ++ ++ if (!dev_in_devices_list) + return FALSE; + + TouchEndPhysicallyActiveTouches(dev); +@@ -511,6 +517,9 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent) + LeaveWindow(dev); + SetFocusOut(dev); + ++ for (prev = &inputInfo.devices; ++ *prev && (*prev != dev); prev = &(*prev)->next); ++ + *prev = dev->next; + dev->next = inputInfo.off_devices; + inputInfo.off_devices = dev; +-- +2.43.0 + diff --git a/0007-dix-when-disabling-a-master-float-disabled-slaved-de.patch b/0007-dix-when-disabling-a-master-float-disabled-slaved-de.patch new file mode 100644 index 0000000..32a326a --- /dev/null +++ b/0007-dix-when-disabling-a-master-float-disabled-slaved-de.patch @@ -0,0 +1,53 @@ +From 26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Fri, 5 Jan 2024 09:40:27 +1000 +Subject: [PATCH 7/9] dix: when disabling a master, float disabled slaved + devices too + +Disabling a master device floats all slave devices but we didn't do this +to already-disabled slave devices. As a result those devices kept their +reference to the master device resulting in access to already freed +memory if the master device was removed before the corresponding slave +device. + +And to match this behavior, also forcibly reset that pointer during +CloseDownDevices(). + +Related to CVE-2024-21886, ZDI-CAN-22840 +--- + dix/devices.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/dix/devices.c b/dix/devices.c +index 389d28a23..84a6406d1 100644 +--- a/dix/devices.c ++++ b/dix/devices.c +@@ -483,6 +483,13 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent) + flags[other->id] |= XISlaveDetached; + } + } ++ ++ for (other = inputInfo.off_devices; other; other = other->next) { ++ if (!IsMaster(other) && GetMaster(other, MASTER_ATTACHED) == dev) { ++ AttachDevice(NULL, other, NULL); ++ flags[other->id] |= XISlaveDetached; ++ } ++ } + } + else { + for (other = inputInfo.devices; other; other = other->next) { +@@ -1088,6 +1095,11 @@ CloseDownDevices(void) + dev->master = NULL; + } + ++ for (dev = inputInfo.off_devices; dev; dev = dev->next) { ++ if (!IsMaster(dev) && !IsFloating(dev)) ++ dev->master = NULL; ++ } ++ + CloseDeviceList(&inputInfo.devices); + CloseDeviceList(&inputInfo.off_devices); + +-- +2.43.0 + diff --git a/0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch b/0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch new file mode 100644 index 0000000..c6b2352 --- /dev/null +++ b/0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch @@ -0,0 +1,36 @@ +From 774260dbae1fa505cd2848c786baed9a8db5179d Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Mon, 5 Dec 2022 15:55:54 +1000 +Subject: [PATCH xserver 7/7] xkb: reset the radio_groups pointer to NULL after + freeing it + +Unlike other elements of the keymap, this pointer was freed but not +reset. On a subsequent XkbGetKbdByName request, the server may access +already freed memory. + +CVE-2022-46283, ZDI-CAN-19530 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Peter Hutterer +Acked-by: Olivier Fourdan +--- + xkb/xkbUtils.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c +index dd089c2046..3f5791a183 100644 +--- a/xkb/xkbUtils.c ++++ b/xkb/xkbUtils.c +@@ -1326,6 +1326,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst) + } + else { + free(dst->names->radio_groups); ++ dst->names->radio_groups = NULL; + } + dst->names->num_rg = src->names->num_rg; + +-- +2.38.1 + diff --git a/0008-Xext-fix-invalid-event-type-mask-in-XTestSwapFakeInp.patch b/0008-Xext-fix-invalid-event-type-mask-in-XTestSwapFakeInp.patch new file mode 100644 index 0000000..c84d387 --- /dev/null +++ b/0008-Xext-fix-invalid-event-type-mask-in-XTestSwapFakeInp.patch @@ -0,0 +1,35 @@ +From bb1711b7fba42f2a0c7d1c09beee241a1b2bcc30 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Mon, 19 Dec 2022 10:06:45 +1000 +Subject: [PATCH xserver] Xext: fix invalid event type mask in + XTestSwapFakeInput + +In commit b320ca0 the mask was inadvertently changed from octal 0177 to +hexadecimal 0x177. + +Fixes commit b320ca0ffe4c0c872eeb3a93d9bde21f765c7c63 + Xtest: disallow GenericEvents in XTestSwapFakeInput + +Found by Stuart Cassoff + +Signed-off-by: Peter Hutterer +--- + Xext/xtest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Xext/xtest.c b/Xext/xtest.c +index 2985a4ce6e..dde5c4cf9d 100644 +--- a/Xext/xtest.c ++++ b/Xext/xtest.c +@@ -502,7 +502,7 @@ XTestSwapFakeInput(ClientPtr client, xReq * req) + + nev = ((req->length << 2) - sizeof(xReq)) / sizeof(xEvent); + for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) { +- int evtype = ev->u.u.type & 0x177; ++ int evtype = ev->u.u.type & 0177; + /* Swap event */ + proc = EventSwapVector[evtype]; + /* no swapping proc; invalid event type? */ +-- +2.38.1 + diff --git a/0008-glx-Call-XACE-hooks-on-the-GLX-buffer.patch b/0008-glx-Call-XACE-hooks-on-the-GLX-buffer.patch new file mode 100644 index 0000000..0e9e4a0 --- /dev/null +++ b/0008-glx-Call-XACE-hooks-on-the-GLX-buffer.patch @@ -0,0 +1,60 @@ +From e5e8586a12a3ec915673edffa10dc8fe5e15dac3 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Wed, 6 Dec 2023 12:09:41 +0100 +Subject: [PATCH 8/9] glx: Call XACE hooks on the GLX buffer + +The XSELINUX code will label resources at creation by checking the +access mode. When the access mode is DixCreateAccess, it will call the +function to label the new resource SELinuxLabelResource(). + +However, GLX buffers do not go through the XACE hooks when created, +hence leaving the resource actually unlabeled. + +When, later, the client tries to create another resource using that +drawable (like a GC for example), the XSELINUX code would try to use +the security ID of that object which has never been labeled, get a NULL +pointer and crash when checking whether the requested permissions are +granted for subject security ID. + +To avoid the issue, make sure to call the XACE hooks when creating the +GLX buffers. + +Credit goes to Donn Seeley for providing the patch. + +CVE-2024-0408 + +Signed-off-by: Olivier Fourdan +Acked-by: Peter Hutterer +--- + glx/glxcmds.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/glx/glxcmds.c b/glx/glxcmds.c +index fc26a2e34..1e46d0c72 100644 +--- a/glx/glxcmds.c ++++ b/glx/glxcmds.c +@@ -48,6 +48,7 @@ + #include "indirect_util.h" + #include "protocol-versions.h" + #include "glxvndabi.h" ++#include "xace.h" + + static char GLXServerVendorName[] = "SGI"; + +@@ -1392,6 +1393,13 @@ DoCreatePbuffer(ClientPtr client, int screenNum, XID fbconfigId, + if (!pPixmap) + return BadAlloc; + ++ err = XaceHook(XACE_RESOURCE_ACCESS, client, glxDrawableId, RT_PIXMAP, ++ pPixmap, RT_NONE, NULL, DixCreateAccess); ++ if (err != Success) { ++ (*pGlxScreen->pScreen->DestroyPixmap) (pPixmap); ++ return err; ++ } ++ + /* Assign the pixmap the same id as the pbuffer and add it as a + * resource so it and the DRI2 drawable will be reclaimed when the + * pbuffer is destroyed. */ +-- +2.43.0 + diff --git a/0009-ephyr-xwayland-Use-the-proper-private-key-for-cursor.patch b/0009-ephyr-xwayland-Use-the-proper-private-key-for-cursor.patch new file mode 100644 index 0000000..5fa80fd --- /dev/null +++ b/0009-ephyr-xwayland-Use-the-proper-private-key-for-cursor.patch @@ -0,0 +1,56 @@ +From 2ef0f1116c65d5cb06d7b6d83f8a1aea702c94f7 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Wed, 6 Dec 2023 11:51:56 +0100 +Subject: [PATCH 9/9] ephyr,xwayland: Use the proper private key for cursor + +The cursor in DIX is actually split in two parts, the cursor itself and +the cursor bits, each with their own devPrivates. + +The cursor itself includes the cursor bits, meaning that the cursor bits +devPrivates in within structure of the cursor. + +Both Xephyr and Xwayland were using the private key for the cursor bits +to store the data for the cursor, and when using XSELINUX which comes +with its own special devPrivates, the data stored in that cursor bits' +devPrivates would interfere with the XSELINUX devPrivates data and the +SELINUX security ID would point to some other unrelated data, causing a +crash in the XSELINUX code when trying to (re)use the security ID. + +CVE-2024-0409 + +Signed-off-by: Olivier Fourdan +Reviewed-by: Peter Hutterer +--- + hw/kdrive/ephyr/ephyrcursor.c | 2 +- + hw/xwayland/xwayland-cursor.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/hw/kdrive/ephyr/ephyrcursor.c b/hw/kdrive/ephyr/ephyrcursor.c +index f991899c5..3f192d034 100644 +--- a/hw/kdrive/ephyr/ephyrcursor.c ++++ b/hw/kdrive/ephyr/ephyrcursor.c +@@ -246,7 +246,7 @@ miPointerSpriteFuncRec EphyrPointerSpriteFuncs = { + Bool + ephyrCursorInit(ScreenPtr screen) + { +- if (!dixRegisterPrivateKey(&ephyrCursorPrivateKey, PRIVATE_CURSOR_BITS, ++ if (!dixRegisterPrivateKey(&ephyrCursorPrivateKey, PRIVATE_CURSOR, + sizeof(ephyrCursorRec))) + return FALSE; + +diff --git a/hw/xwayland/xwayland-cursor.c b/hw/xwayland/xwayland-cursor.c +index e3c1aaa50..bd94b0cfb 100644 +--- a/hw/xwayland/xwayland-cursor.c ++++ b/hw/xwayland/xwayland-cursor.c +@@ -431,7 +431,7 @@ static miPointerScreenFuncRec xwl_pointer_screen_funcs = { + Bool + xwl_screen_init_cursor(struct xwl_screen *xwl_screen) + { +- if (!dixRegisterPrivateKey(&xwl_cursor_private_key, PRIVATE_CURSOR_BITS, 0)) ++ if (!dixRegisterPrivateKey(&xwl_cursor_private_key, PRIVATE_CURSOR, 0)) + return FALSE; + + return miPointerInitialize(xwl_screen->screen, +-- +2.43.0 + diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..4041668 --- /dev/null +++ b/Makefile @@ -0,0 +1,30 @@ +# Makefile for source rpm: xorg-x11-server +# $Id$ +NAME := xorg-x11-server +SPECFILE = $(firstword $(wildcard *.spec)) + +define find-makefile-common +for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done +endef + +MAKEFILE_COMMON := $(shell $(find-makefile-common)) + +ifeq ($(MAKEFILE_COMMON),) +# attempt a checkout +define checkout-makefile-common +test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 +endef + +MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) +endif + +include $(MAKEFILE_COMMON) + +ifeq ($(MAKECMDGOALS),me a sandwich) +.PHONY :: me a sandwich +me a: + @: + +sandwich: + @[ `id -u` -ne 0 ] && echo "What? Make it yourself." || echo Okay. +endif diff --git a/commitid b/commitid new file mode 100644 index 0000000..7420e41 --- /dev/null +++ b/commitid @@ -0,0 +1 @@ +d13cb974426f7f1110b0bdb08c4ebb46ff8975f7 diff --git a/gitignore b/gitignore new file mode 100644 index 0000000..524cfc6 --- /dev/null +++ b/gitignore @@ -0,0 +1,306 @@ +Makefile +Makefile.in +.deps +.libs +.msg +*.lo +*.la +*.a +*.o +*~ +.*sw? +*.pbxuser +*.mode1v3 +obj* +build* +local +aclocal.m4 +autom4te.cache +compile +config.guess +config.log +config.status +config.sub +configure +configure.lineno +depcomp +install-sh +libtool +ltmain.sh +missing +TAGS +tags +ylwrap +xorg-server.pc +stamp-h? +do-not-use-config.h +do-not-use-config.h.in +afb/afbbltC.c +afb/afbbltCI.c +afb/afbbltG.c +afb/afbbltO.c +afb/afbbltX.c +afb/afbseg.c +afb/afbtileC.c +afb/afbtileG.c +cfb/cfb8lineCO.c +cfb/cfb8lineCP.c +cfb/cfb8lineG.c +cfb/cfb8lineX.c +cfb/cfb8segC.c +cfb/cfb8segCS.c +cfb/cfb8segX.c +cfb/cfb8setG.c +cfb/cfbbltC.c +cfb/cfbbltG.c +cfb/cfbbltO.c +cfb/cfbbltX.c +cfb/cfbfillarcC.c +cfb/cfbfillarcG.c +cfb/cfbglrop8.c +cfb/cfbply1rctC.c +cfb/cfbply1rctG.c +cfb/cfbseg.c +cfb/cfbsolidC.c +cfb/cfbsolidG.c +cfb/cfbsolidX.c +cfb/cfbtile32C.c +cfb/cfbtile32G.c +cfb/cfbtileoddC.c +cfb/cfbtileoddG.c +cfb/cfbzerarcC.c +cfb/cfbzerarcG.c +cfb/cfbzerarcX.c +cfb32/cfb8lineCO.c +cfb32/cfb8lineCP.c +cfb32/cfb8lineG.c +cfb32/cfb8lineX.c +cfb32/cfb8segC.c +cfb32/cfb8segCS.c +cfb32/cfb8segX.c +cfb32/cfb8setG.c +cfb32/cfbbltC.c +cfb32/cfbbltG.c +cfb32/cfbbltO.c +cfb32/cfbbltX.c +cfb32/cfbfillarcC.c +cfb32/cfbfillarcG.c +cfb32/cfbply1rctC.c +cfb32/cfbply1rctG.c +cfb32/cfbseg.c +cfb32/cfbsolidC.c +cfb32/cfbsolidG.c +cfb32/cfbsolidX.c +cfb32/cfbtile32C.c +cfb32/cfbtile32G.c +cfb32/cfbtileoddC.c +cfb32/cfbtileoddG.c +cfb32/cfbzerarcC.c +cfb32/cfbzerarcG.c +cfb32/cfbzerarcX.c +doc/Xserver.1x +doc/Xserver.man +hw/dmx/Xdmx +hw/dmx/Xdmx.1x +hw/dmx/config/dmxtodmx +hw/dmx/config/dmxtodmx.1x +hw/dmx/config/parser.c +hw/dmx/config/parser.h +hw/dmx/config/scanner.c +hw/dmx/config/vdltodmx +hw/dmx/config/vdltodmx.1x +hw/dmx/config/xdmxconfig +hw/dmx/config/xdmxconfig.1x +hw/dmx/examples/dmxaddinput +hw/dmx/examples/dmxaddscreen +hw/dmx/examples/dmxreconfig +hw/dmx/examples/dmxresize +hw/dmx/examples/dmxrminput +hw/dmx/examples/dmxrmscreen +hw/dmx/examples/dmxwininfo +hw/dmx/examples/ev +hw/dmx/examples/evi +hw/dmx/examples/res +hw/dmx/examples/xbell +hw/dmx/examples/xdmx +hw/dmx/examples/xinput +hw/dmx/examples/xled +hw/dmx/examples/xtest +hw/kdrive/ati/Xati +hw/kdrive/chips/Xchips +hw/kdrive/ephyr/Xephyr +hw/kdrive/epson/Xepson +hw/kdrive/fake/Xfake +hw/kdrive/fbdev/Xfbdev +hw/kdrive/i810/Xi810 +hw/kdrive/mach64/Xmach64 +hw/kdrive/mga/Xmga +hw/kdrive/neomagic/Xneomagic +hw/kdrive/nvidia/Xnvidia +hw/kdrive/pm2/Xpm2 +hw/kdrive/r128/Xr128 +hw/kdrive/sdl/Xsdl +hw/kdrive/sis300/Xsis +hw/kdrive/smi/Xsmi +hw/kdrive/vesa/Xvesa +hw/kdrive/via/Xvia +hw/vfb/Xvfb +hw/vfb/Xvfb.1x +hw/vfb/Xvfb.man +hw/xfree86/Xorg +hw/xfree86/common/xf86Build.h +hw/xfree86/common/xf86DefModeSet.c +hw/xfree86/doc/man/Xorg.1x +hw/xfree86/doc/man/Xorg.man +hw/xfree86/doc/man/xorg.conf.5x +hw/xfree86/doc/man/xorg.conf.man +hw/xfree86/exa/exa.4 +hw/xfree86/exa/exa.4x +hw/xfree86/exa/exa.man +hw/xfree86/fbdevhw/fbdevhw.4x +hw/xfree86/fbdevhw/fbdevhw.man +hw/xfree86/getconfig/cfg.man +hw/xfree86/getconfig/getconfig.1x +hw/xfree86/getconfig/getconfig.5x +hw/xfree86/getconfig/getconfig.man +hw/xfree86/os-support/xorgos.c +hw/xfree86/osandcommon.c +hw/xfree86/ramdac/xf86BitOrder.c +hw/xfree86/scanpci/xf86PciData.c +hw/xfree86/scanpci/xf86PciIds.h +hw/xfree86/utils/cvt/cvt +hw/xfree86/utils/cvt/cvt.man +hw/xfree86/utils/gtf/gtf +hw/xfree86/utils/gtf/gtf.1x +hw/xfree86/utils/gtf/gtf.man +hw/xfree86/utils/ioport/inb +hw/xfree86/utils/ioport/inl +hw/xfree86/utils/ioport/inw +hw/xfree86/utils/ioport/ioport +hw/xfree86/utils/ioport/outb +hw/xfree86/utils/ioport/outl +hw/xfree86/utils/ioport/outw +hw/xfree86/utils/pcitweak/pcitweak +hw/xfree86/utils/pcitweak/pcitweak.1x +hw/xfree86/utils/pcitweak/pcitweak.man +hw/xfree86/utils/scanpci/scanpci +hw/xfree86/utils/scanpci/scanpci.1x +hw/xfree86/utils/scanpci/scanpci.man +hw/xfree86/utils/xorgcfg/XOrgCfg +hw/xfree86/utils/xorgcfg/xorgcfg +hw/xfree86/utils/xorgcfg/xorgcfg.1x +hw/xfree86/utils/xorgcfg/xorgcfg.man +hw/xfree86/utils/xorgconfig/xorgconfig +hw/xfree86/utils/xorgconfig/xorgconfig.1x +hw/xfree86/utils/xorgconfig/xorgconfig.man +hw/xfree86/xaa/l-xaaBitmap.c +hw/xfree86/xaa/l-xaaStipple.c +hw/xfree86/xaa/l-xaaTEGlyph.c +hw/xfree86/xaa/l3-xaaBitmap.c +hw/xfree86/xaa/l3-xaaStipple.c +hw/xfree86/xaa/lf-xaaBitmap.c +hw/xfree86/xaa/lf-xaaStipple.c +hw/xfree86/xaa/lf-xaaTEGlyph.c +hw/xfree86/xaa/lf3-xaaBitmap.c +hw/xfree86/xaa/lf3-xaaStipple.c +hw/xfree86/xaa/m-xaaBitmap.c +hw/xfree86/xaa/m-xaaStipple.c +hw/xfree86/xaa/m-xaaTEGlyph.c +hw/xfree86/xaa/m3-xaaBitmap.c +hw/xfree86/xaa/m3-xaaStipple.c +hw/xfree86/xaa/mf-xaaBitmap.c +hw/xfree86/xaa/mf-xaaStipple.c +hw/xfree86/xaa/mf-xaaTEGlyph.c +hw/xfree86/xaa/mf3-xaaBitmap.c +hw/xfree86/xaa/mf3-xaaStipple.c +hw/xfree86/xaa/s-xaaDashLine.c +hw/xfree86/xaa/s-xaaLine.c +hw/xfree86/xf1bpp/maskbits.c +hw/xfree86/xf1bpp/mfbbitblt.c +hw/xfree86/xf1bpp/mfbbltC.c +hw/xfree86/xf1bpp/mfbbltCI.c +hw/xfree86/xf1bpp/mfbbltG.c +hw/xfree86/xf1bpp/mfbbltO.c +hw/xfree86/xf1bpp/mfbbltX.c +hw/xfree86/xf1bpp/mfbbres.c +hw/xfree86/xf1bpp/mfbbresd.c +hw/xfree86/xf1bpp/mfbclip.c +hw/xfree86/xf1bpp/mfbcmap.c +hw/xfree86/xf1bpp/mfbfillarc.c +hw/xfree86/xf1bpp/mfbfillrct.c +hw/xfree86/xf1bpp/mfbfillsp.c +hw/xfree86/xf1bpp/mfbfont.c +hw/xfree86/xf1bpp/mfbgc.c +hw/xfree86/xf1bpp/mfbgetsp.c +hw/xfree86/xf1bpp/mfbigbblak.c +hw/xfree86/xf1bpp/mfbigbwht.c +hw/xfree86/xf1bpp/mfbhrzvert.c +hw/xfree86/xf1bpp/mfbimage.c +hw/xfree86/xf1bpp/mfbline.c +hw/xfree86/xf1bpp/mfbmisc.c +hw/xfree86/xf1bpp/mfbpablack.c +hw/xfree86/xf1bpp/mfbpainv.c +hw/xfree86/xf1bpp/mfbpawhite.c +hw/xfree86/xf1bpp/mfbpgbblak.c +hw/xfree86/xf1bpp/mfbpgbinv.c +hw/xfree86/xf1bpp/mfbpgbwht.c +hw/xfree86/xf1bpp/mfbpixmap.c +hw/xfree86/xf1bpp/mfbplyblack.c +hw/xfree86/xf1bpp/mfbplyinv.c +hw/xfree86/xf1bpp/mfbplywhite.c +hw/xfree86/xf1bpp/mfbpntwin.c +hw/xfree86/xf1bpp/mfbpolypnt.c +hw/xfree86/xf1bpp/mfbpushpxl.c +hw/xfree86/xf1bpp/mfbscrclse.c +hw/xfree86/xf1bpp/mfbscrinit.c +hw/xfree86/xf1bpp/mfbseg.c +hw/xfree86/xf1bpp/mfbsetsp.c +hw/xfree86/xf1bpp/mfbteblack.c +hw/xfree86/xf1bpp/mfbtewhite.c +hw/xfree86/xf1bpp/mfbtileC.c +hw/xfree86/xf1bpp/mfbtileG.c +hw/xfree86/xf1bpp/mfbwindow.c +hw/xfree86/xf1bpp/mfbzerarc.c +hw/xfree86/xf4bpp/mfbseg.c +hw/xfree86/xf8_32bpp/cfbgc32.c +hw/xfree86/xf8_32bpp/cfbgc8.c +hw/xfree86/xorg.c +hw/xfree86/xorg.conf.example +hw/xfree86/xorg.conf.example.pre +hw/xnest/Xnest +hw/xnest/Xnest.1x +hw/xnest/Xnest.man +hw/xprint/Xprt +hw/xprint/config/C/print/Xprinters.ghostscript +hw/xprint/doc/Xprt.1x +hw/xprint/doc/Xprt.man +hw/xprint/dpmsstubs-wrapper.c +hw/xprint/miinitext-wrapper.c +include/dix-config.h +include/kdrive-config.h +include/xgl-config.h +include/xkb-config.h +include/xorg-config.h +include/xorg-server.h +include/xwin-config.h +mfb/mfbbltC.c +mfb/mfbbltCI.c +mfb/mfbbltG.c +mfb/mfbbltO.c +mfb/mfbbltX.c +mfb/mfbigbblak.c +mfb/mfbigbwht.c +mfb/mfbpablack.c +mfb/mfbpainv.c +mfb/mfbpawhite.c +mfb/mfbpgbblak.c +mfb/mfbpgbinv.c +mfb/mfbpgbwht.c +mfb/mfbplyblack.c +mfb/mfbplyinv.c +mfb/mfbplywhite.c +mfb/mfbseg.c +mfb/mfbteblack.c +mfb/mfbtewhite.c +mfb/mfbtileC.c +mfb/mfbtileG.c diff --git a/import.log b/import.log new file mode 100644 index 0000000..782e371 --- /dev/null +++ b/import.log @@ -0,0 +1,6 @@ +xorg-x11-server-1_5_0-1_fc10:HEAD:xorg-x11-server-1.5.0-1.fc10.src.rpm:1220485219 +xorg-x11-server-1_5_1-1_fc10:HEAD:xorg-x11-server-1.5.1-1.fc10.src.rpm:1222198557 +xorg-x11-server-1_5_2-1_fc10:HEAD:xorg-x11-server-1.5.2-1.fc10.src.rpm:1223667007 +xorg-x11-server-1_5_3-1_fc10:HEAD:xorg-x11-server-1.5.3-1.fc10.src.rpm:1225918317 +xorg-x11-server-1_6_0-1_fc11:HEAD:xorg-x11-server-1.6.0-1.fc11.src.rpm:1235594175 +xorg-x11-server-1_6_1-1_fc11:HEAD:xorg-x11-server-1.6.1-1.fc11.src.rpm:1239742477 diff --git a/make-git-snapshot.sh b/make-git-snapshot.sh new file mode 100755 index 0000000..0d9b2ad --- /dev/null +++ b/make-git-snapshot.sh @@ -0,0 +1,17 @@ +#!/bin/sh + +DIRNAME=xorg-server-$( date +%Y%m%d ) + +rm -rf $DIRNAME +git clone git://git.freedesktop.org/git/xorg/xserver $DIRNAME +cd $DIRNAME +if [ -z "$1" ]; then + git log | head -1 +else + git checkout $1 +fi +git log | head -1 | awk '{ print $2 }' > ../commitid +git repack -a -d +cd .. +tar cf - $DIRNAME | xz -c9 > $DIRNAME.tar.xz +rm -rf $DIRNAME diff --git a/sources b/sources index ae452b9..32cd6fa 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xorg-server-21.1.24.tar.xz) = f51372b04fe21632fc778ff240705161ed2dccc0114dbe3ee25156d8ac85ec945e2ac05d8638bc7d8d54bad4dfc89cb26b6bd2058b7804d54ab7179e1ac2eb13 +SHA512 (xorg-server-1.20.14.tar.xz) = be3dc32cce7d55d7e38c5f6557027f13f39224c76cc83e5800555d5ce89dbdc3731773a2d186a5b97db9fc8731a2b2dd6e9829af2b01ee2559246d4aef7c4963 diff --git a/xorg-x11-server-fb-access-wrapper.patch b/xorg-x11-server-fb-access-wrapper.patch new file mode 100644 index 0000000..7bb0e23 --- /dev/null +++ b/xorg-x11-server-fb-access-wrapper.patch @@ -0,0 +1,31 @@ +fb: Declare wfbFinishScreenInit, wfbScreenInit for !FB_ACCESS_WRAPPER + +xorg-x11-drv-nouveau wfbScreenInit without defining FB_ACCESS_WRAPPER +(which has other unintended side effects). Presently, this compiles +and links because compilers still support implicit function +declarations, but this is going to change fairly soon. This seems to +be the most straightforward change to keep the driver building. + +Submitted upstream: + + + +diff -ur xorg-server-1.20.14.orig/fb/fb.h xorg-server-1.20.14/fb/fb.h +--- xorg-server-1.20.14.orig/fb/fb.h 2021-12-15 20:01:24.000000000 +0100 ++++ xorg-server-1.20.14/fb/fb.h 2023-04-13 13:59:47.325341537 +0200 +@@ -1027,7 +1027,6 @@ + int dpiy, int width, /* pixel width of frame buffer */ + int bpp); /* bits per pixel of frame buffer */ + +-#ifdef FB_ACCESS_WRAPPER + extern _X_EXPORT Bool + wfbFinishScreenInit(ScreenPtr pScreen, + void *pbits, +@@ -1049,7 +1048,6 @@ + int width, + int bpp, + SetupWrapProcPtr setupWrap, FinishWrapProcPtr finishWrap); +-#endif + + extern _X_EXPORT Bool + fbFinishScreenInit(ScreenPtr pScreen, diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index 1702ee0..a6671c9 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -1,230 +1,391 @@ +# This package is an experiment in active integration of upstream SCM with +# Fedora packaging. It works something like this: +# +# The "pristine" source is actually a git repo (with no working checkout). +# The first step of %%prep is to check it out and switch to a "fedora" branch. +# If you need to add a patch to the server, just do it like a normal git +# operation, dump it with git-format-patch to a file in the standard naming +# format, and add a PatchN: line. If you want to push something upstream, +# check out the master branch, pull, cherry-pick, and push. + # X.org requires lazy relocations to work. %undefine _hardened_build %undefine _strict_symbol_defs_build -# Released ABI versions: +#global gitdate 20161026 +%global stable_abi 1 + +%if !0%{?gitdate} || %{stable_abi} +# Released ABI versions. Have to keep these manually in sync with the +# source because rpm is a terrible language. %global ansic_major 0 %global ansic_minor 4 -%global videodrv_major 25 -%global videodrv_minor 2 +%global videodrv_major 24 +%global videodrv_minor 1 %global xinput_major 24 -%global xinput_minor 4 +%global xinput_minor 1 %global extension_major 10 %global extension_minor 0 +%endif + +%if 0%{?gitdate} +# For git snapshots, use date for major and a serial number for minor +%global minor_serial 0 +%global git_ansic_major %{gitdate} +%global git_ansic_minor %{minor_serial} +%global git_videodrv_major %{gitdate} +%global git_videodrv_minor %{minor_serial} +%global git_xinput_major %{gitdate} +%global git_xinput_minor %{minor_serial} +%global git_extension_major %{gitdate} +%global git_extension_minor %{minor_serial} +%endif %global pkgname xorg-server -Summary: X.Org X11 X server -Name: xorg-x11-server -Version: 21.1.24 -Release: 2%{?dist} -URL: http://www.x.org +Summary: X.Org X11 X server +Name: xorg-x11-server +Version: 1.20.14 +Release: 36%{?gitdate:.%{gitdate}}%{?dist} +URL: http://www.x.org # SPDX -License: Adobe-Display-PostScript AND BSD-3-Clause AND DEC-3-Clause AND HPND AND HPND-sell-MIT-disclaimer-xserver AND HPND-sell-variant AND ICU AND ISC AND MIT AND MIT-open-group AND NTP AND SGI-B-2.0 AND SMLNJ AND X11 AND X11-distribute-modifications-variant +License: Adobe-Display-PostScript AND BSD-3-Clause AND DEC-3-Clause AND HPND AND HPND-sell-MIT-disclaimer-xserver AND HPND-sell-variant AND ICU AND ISC AND MIT AND MIT-open-group AND NTP AND SGI-B-2.0 AND SMLNJ AND X11 AND X11-distribute-modifications-variant -Source0: https://www.x.org/pub/individual/xserver/%{pkgname}-%{version}.tar.xz +#VCS: git:git://git.freedesktop.org/git/xorg/xserver +%if 0%{?gitdate} +# git snapshot. to recreate, run: +# ./make-git-snapshot.sh `cat commitid` +Source0: xorg-server-%{gitdate}.tar.xz +#Source0: http://www.x.org/pub/individual/xserver/%{pkgname}-%{version}.tar.bz2 +Source1: make-git-snapshot.sh +Source2: commitid +%else +Source0: https://www.x.org/pub/individual/xserver/%{pkgname}-%{version}.tar.xz +Source1: gitignore +%endif Source10: xserver.pamd + # "useful" xvfb-run script -Source20: http://svn.exactcode.de/t2/trunk/package/xorg/xorg-server/xvfb-run.sh +Source20: http://svn.exactcode.de/t2/trunk/package/xorg/xorg-server/xvfb-run.sh + # for requires generation in drivers -Source30: xserver-sdk-abi-requires +Source30: xserver-sdk-abi-requires.release +Source31: xserver-sdk-abi-requires.git + # maintainer convenience script -Source40: driver-abi-rebuild.sh +Source40: driver-abi-rebuild.sh # From Debian use intel ddx driver only for gen4 and older chipsets -Patch0: 06_use-intel-only-on-pre-gen4.diff +Patch1: 06_use-intel-only-on-pre-gen4.diff # Default to xf86-video-modesetting on GeForce 8 and newer -Patch1: 0001-xfree86-use-modesetting-driver-by-default-on-GeForce.patch +Patch2: 0001-xfree86-use-modesetting-driver-by-default-on-GeForce.patch + # Default to va_gl on intel i965 as we use the modesetting drv there # va_gl should probably just be the default everywhere ? -Patch2: 0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch -# because the display-managers are not ready yet, do not upstream -Patch3: 0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch +Patch3: 0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch -BuildRequires: bison -BuildRequires: flex -BuildRequires: gawk -BuildRequires: gcc -BuildRequires: kernel-headers -BuildRequires: libXi-devel -BuildRequires: libXinerama-devel -BuildRequires: libXres-devel -BuildRequires: libXv-devel -BuildRequires: make -BuildRequires: mesa-libEGL-devel -BuildRequires: mesa-libGL-devel >= 9.2 -BuildRequires: meson -BuildRequires: pkgconfig -BuildRequires: pkgconfig(audit) -BuildRequires: pkgconfig(bigreqsproto) >= 1.1.0 -BuildRequires: pkgconfig(compositeproto) >= 0.4 -BuildRequires: pkgconfig(damageproto) >= 1.1 -BuildRequires: pkgconfig(dbus-1) >= 1.0 -BuildRequires: pkgconfig(dri2proto) >= 2.8 -BuildRequires: pkgconfig(dri3proto) >= 1.2 -BuildRequires: pkgconfig(epoxy) -BuildRequires: pkgconfig(epoxy) >= 1.5.4 -BuildRequires: pkgconfig(fixesproto) >= 6.0 -BuildRequires: pkgconfig(fontsproto) >= 2.1.3 -BuildRequires: pkgconfig(gbm) >= 10.2 -BuildRequires: pkgconfig(inputproto) >= 2.3.99.1 -BuildRequires: pkgconfig(kbproto) >= 1.0.3 -BuildRequires: pkgconfig(libdrm) >= 2.4.89 -BuildRequires: pkgconfig(libselinux) >= 2.0.86 -BuildRequires: pkgconfig(libsystemd) >= 209 -BuildRequires: pkgconfig(libudev) >= 143 -BuildRequires: pkgconfig(libunwind) -BuildRequires: pkgconfig(libxcvt) -BuildRequires: pkgconfig(openssl) -BuildRequires: pkgconfig(pciaccess) >= 0.12.901 -BuildRequires: pkgconfig(pixman-1) -BuildRequires: pkgconfig(randrproto) >= 1.6.0 -BuildRequires: pkgconfig(recordproto) >= 1.13.99.1 -BuildRequires: pkgconfig(renderproto) >= 0.11 -BuildRequires: pkgconfig(resourceproto) >= 1.2.0 -BuildRequires: pkgconfig(scrnsaverproto) >= 1.1 -BuildRequires: pkgconfig(videoproto) -BuildRequires: pkgconfig(x11) -BuildRequires: pkgconfig(x11-xcb) -BuildRequires: pkgconfig(xau) -BuildRequires: pkgconfig(xcb-aux) -BuildRequires: pkgconfig(xcb-icccm) -BuildRequires: pkgconfig(xcb-image) -BuildRequires: pkgconfig(xcb-keysyms) -BuildRequires: pkgconfig(xcb-renderutil) -BuildRequires: pkgconfig(xcmiscproto) >= 1.2.0 -BuildRequires: pkgconfig(xdmcp) -BuildRequires: pkgconfig(xext) >= 1.0.99.4 -BuildRequires: pkgconfig(xextproto) >= 7.2.99.901 -BuildRequires: pkgconfig(xf86bigfontproto) >= 1.2.0 -BuildRequires: pkgconfig(xf86vidmodeproto) >= 2.2.99.1 -BuildRequires: pkgconfig(xfont2) >= 2.0 -BuildRequires: pkgconfig(xineramaproto) -BuildRequires: pkgconfig(xkbfile) -BuildRequires: pkgconfig(xproto) >= 7.0.31 -BuildRequires: pkgconfig(xshmfence) >= 1.1 -BuildRequires: pkgconfig(xtrans) >= 1.3.5 -BuildRequires: pkgconfig(xtrans) >= 1.3.5 -BuildRequires: systemtap-sdt-devel -BuildRequires: xorg-x11-util-macros >= 1.17 -BuildRequires: xorg-x11-xtrans-devel >= 1.3.2 +# Submitted upstream, but not going anywhere +Patch5: 0001-autobind-GPUs-to-the-screen.patch + +# because the display-managers are not ready yet, do not upstream +Patch6: 0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch + +# Not sure anyone else cares about this so let's keep this Fedora-only for now +# Upstream PR for the meson.build equivalent is here, so we can drop this patch +# when we start building with meson. +# https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1001` +Patch7: 0001-configure.ac-search-for-the-fontrootdir-ourselves.patch + +# Backports from current stable "server-1.20-branch": +# + +# Backports from "master" upstream: +Patch100: 0001-present-Check-for-NULL-to-prevent-crash.patch +Patch101: 0001-render-Fix-build-with-gcc-12.patch +Patch102: 0001-xf86-Accept-devices-with-the-simpledrm-driver.patch +Patch103: 0001-Don-t-hardcode-fps-for-fake-screen.patch +Patch104: 0001-hw-Rename-boolean-config-value-field-from-bool-to-bo.patch +Patch105: 0001-add-a-quirk-for-apple-silicon.patch + +# CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070 +Patch110: 0001-xkb-switch-to-array-index-loops-to-moving-pointers.patch +Patch111: 0002-xkb-swap-XkbSetDeviceInfo-and-XkbSetDeviceInfoCheck.patch +Patch112: 0003-xkb-add-request-length-validation-for-XkbSetGeometry.patch + +# CVE-2022-3550 +Patch113: 0001-xkb-proof-GetCountedString-against-request-length-at.patch +# CVE-2022-3551 +Patch114: 0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch + +# CVE-2022-46340 +Patch115: 0001-Xtest-disallow-GenericEvents-in-XTestSwapFakeInput.patch +# related to CVE-2022-46344 +Patch116: 0002-Xi-return-an-error-from-XI-property-changes-if-verif.patch +# CVE-2022-46344 +Patch117: 0003-Xi-avoid-integer-truncation-in-length-check-of-ProcX.patch +# CVE-2022-46341 +Patch118: 0004-Xi-disallow-passive-grabs-with-a-detail-255.patch +# CVE-2022-46343 +Patch119: 0005-Xext-free-the-screen-saver-resource-when-replacing-i.patch +# CVE-2022-46342 +Patch120: 0006-Xext-free-the-XvRTVideoNotify-when-turning-off-from-.patch +# CVE-2022-46283 +Patch121: 0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch +# Fix for buggy patch to CVE-2022-46340 +Patch122: 0008-Xext-fix-invalid-event-type-mask-in-XTestSwapFakeInp.patch +# CVE-2023-0494 +Patch123: 0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch +# CVE-2023-1393 +Patch124: 0001-composite-Fix-use-after-free-of-the-COW.patch +# https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1114 +Patch125: xorg-x11-server-fb-access-wrapper.patch +# https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1057 +Patch126: 0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch + +# CVE-2023-5367 +Patch1010: 0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch +# CVE-2023-5380 +Patch1011: 0002-mi-reset-the-PointerWindows-reference-on-screen-swit.patch +# CVE-2023-6377 +Patch1012: 0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch +# CVE-2023-6478 +Patch1013: 0001-randr-avoid-integer-truncation-in-length-check-of-Pr.patch +# CVE-2023-6816 +Patch1014: 0001-dix-allocate-enough-space-for-logical-button-maps.patch +# CVE-2024-0229 +Patch1015: 0002-dix-Allocate-sufficient-xEvents-for-our-DeviceStateN.patch +Patch1016: 0003-dix-fix-DeviceStateNotify-event-calculation.patch +Patch1017: 0004-Xi-when-creating-a-new-ButtonClass-set-the-number-of.patch +# CVE-2024-21885 +Patch1018: 0005-Xi-flush-hierarchy-events-after-adding-removing-mast.patch +# CVE-2024-21886 +Patch1019: 0006-Xi-do-not-keep-linked-list-pointer-during-recursion.patch +Patch1020: 0007-dix-when-disabling-a-master-float-disabled-slaved-de.patch +# CVE-2024-0408 +Patch1021: 0008-glx-Call-XACE-hooks-on-the-GLX-buffer.patch +# CVE-2024-0409 +Patch1022: 0009-ephyr-xwayland-Use-the-proper-private-key-for-cursor.patch +# Related to CVE-2024-21886 +Patch1023: 0001-dix-Fix-use-after-free-in-input-device-shutdown.patch +# Fix compilation error on i686 +Patch1024: 0001-ephyr-Fix-incompatible-pointer-type-build-error.patch +# Fix copy and paste error in CVE-2024-0229 +Patch1025: 0001-dix-fix-valuator-copy-paste-error-in-the-DeviceState.patch +# CVE-2024-31080 +Patch1026: 0001-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch +# CVE-2024-31081 +Patch1027: 0002-Xi-ProcXIPassiveGrabDevice-needs-to-use-unswapped-le.patch +# CVE-2024-31082 +Patch1028: 0003-Xquartz-ProcAppleDRICreatePixmap-needs-to-use-unswap.patch +# CVE-2024-31083 +Patch1029: 0004-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch +Patch1030: 0001-render-Avoid-possible-double-free-in-ProcRenderAddGl.patch + +# CVE-2024-9632 +Patch1031: 0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch + +## Add new patches above; Fedora-specific patches below + +# Only on F38 and later (patch number starts at 3801, see autopatch below) +# Upstream commits 73d6e88, f69280dd and 4127776, minus the xwayland.pc.in change +Patch3801: 0001-Disallow-byte-swapped-clients-by-default.patch + +BuildRequires: make +BuildRequires: systemtap-sdt-devel +BuildRequires: git-core +BuildRequires: automake autoconf libtool pkgconfig +BuildRequires: xorg-x11-util-macros >= 1.17 + +BuildRequires: xorg-x11-proto-devel >= 7.7-10 + +BuildRequires: dbus-devel libepoxy-devel systemd-devel +BuildRequires: xorg-x11-xtrans-devel >= 1.3.2 +BuildRequires: libXfont2-devel libXau-devel libxkbfile-devel libXres-devel +BuildRequires: libfontenc-devel libXtst-devel libXdmcp-devel +BuildRequires: libX11-devel libXext-devel +BuildRequires: libXinerama-devel libXi-devel + +# DMX config utils buildreqs. +BuildRequires: libXt-devel libdmx-devel libXmu-devel libXrender-devel +BuildRequires: libXi-devel libXpm-devel libXaw-devel libXfixes-devel + +BuildRequires: pkgconfig(epoxy) +BuildRequires: pkgconfig(xshmfence) >= 1.1 +BuildRequires: libXv-devel +BuildRequires: pixman-devel >= 0.30.0 +BuildRequires: libpciaccess-devel >= 0.13.1 openssl-devel bison flex +BuildRequires: mesa-libGL-devel >= 9.2 +BuildRequires: mesa-libEGL-devel +BuildRequires: mesa-libgbm-devel +# XXX silly... +BuildRequires: libdrm-devel >= 2.4.0 kernel-headers + +BuildRequires: audit-libs-devel libselinux-devel >= 2.0.86-1 +BuildRequires: libudev-devel +# libunwind is Exclusive for the following arches +%ifarch aarch64 %{arm} hppa ia64 mips ppc ppc64 %{ix86} x86_64 +%if !0%{?rhel} +BuildRequires: libunwind-devel +%endif +%endif + +BuildRequires: pkgconfig(xcb-aux) pkgconfig(xcb-image) pkgconfig(xcb-icccm) +BuildRequires: pkgconfig(xcb-keysyms) pkgconfig(xcb-renderutil) %description -X.Org X11 X server. +X.Org X11 X server -%package common -Summary: Xorg server common files -Requires: pixman -Requires: xkbcomp -Requires: xkeyboard-config +%package common +Summary: Xorg server common files +Requires: pixman >= 0.30.0 +Requires: xkeyboard-config xkbcomp -%description common +%description common Common files shared among all X servers. -%package Xorg -Summary: Xorg X server -Requires: libEGL -Requires: system-setup-keyboard -Requires: xorg-x11-drv-libinput -Requires: xorg-x11-server-common >= %{version}-%{release} -Provides: Xorg = %{version}-%{release} -Provides: Xserver +%package Xorg +Summary: Xorg X server +Provides: Xorg = %{version}-%{release} +Provides: Xserver # HdG: This should be moved to the wrapper package once the wrapper gets # its own sub-package: -Provides: xorg-x11-server-wrapper = %{version}-%{release} -Provides: xserver-abi(ansic-%{ansic_major}) = %{ansic_minor} -Provides: xserver-abi(videodrv-%{videodrv_major}) = %{videodrv_minor} -Provides: xserver-abi(xinput-%{xinput_major}) = %{xinput_minor} -Provides: xserver-abi(extension-%{extension_major}) = %{extension_minor} -# Dropped from xorg-x11-server-21.1 -# https://gitlab.freedesktop.org/xorg/xserver/-/commit/b3b81c8c2090cd49410960a021baf0d27fdd2ab3 -Obsoletes: xorg-x11-server-Xdmx < 1.20.15 -# Legacy fbdev devices have been replaced with simpledrm: -# https://fedoraproject.org/wiki/Changes/ReplaceFbdevDrivers -Obsoletes: xorg-x11-drv-fbdev < 0.5.0-19 -Obsoletes: xorg-x11-drv-vesa < 2.6.0-3 -Obsoletes: xorg-x11-drv-armsoc < 1.4.1-10 +Provides: xorg-x11-server-wrapper = %{version}-%{release} +%if !0%{?gitdate} || %{stable_abi} +Provides: xserver-abi(ansic-%{ansic_major}) = %{ansic_minor} +Provides: xserver-abi(videodrv-%{videodrv_major}) = %{videodrv_minor} +Provides: xserver-abi(xinput-%{xinput_major}) = %{xinput_minor} +Provides: xserver-abi(extension-%{extension_major}) = %{extension_minor} +%endif +%if 0%{?gitdate} +Provides: xserver-abi(ansic-%{git_ansic_major}) = %{git_ansic_minor} +Provides: xserver-abi(videodrv-%{git_videodrv_major}) = %{git_videodrv_minor} +Provides: xserver-abi(xinput-%{git_xinput_major}) = %{git_xinput_minor} +Provides: xserver-abi(extension-%{git_extension_major}) = %{git_extension_minor} +%endif +Obsoletes: xorg-x11-glamor < %{version}-%{release} +Provides: xorg-x11-glamor = %{version}-%{release} +Obsoletes: xorg-x11-drv-modesetting < %{version}-%{release} +Provides: xorg-x11-drv-modesetting = %{version}-%{release} +# Dropped from F25 +Obsoletes: xorg-x11-drv-vmmouse < 13.1.0-4 -%description Xorg -X.org X11 is an open source implementation of the X Window System. It provides -the basic low level functionality which full fledged graphical user interfaces -(GUIs) such as GNOME and KDE are designed upon. +Requires: xorg-x11-server-common >= %{version}-%{release} +Requires: system-setup-keyboard +Requires: xorg-x11-drv-libinput +Requires: libEGL + +%description Xorg +X.org X11 is an open source implementation of the X Window System. It +provides the basic low level functionality which full fledged +graphical user interfaces (GUIs) such as GNOME and KDE are designed +upon. -%package Xnest -Summary: A nested server -Requires: xorg-x11-server-common >= %{version}-%{release} -Provides: Xnest +%package Xnest +Summary: A nested server +Requires: xorg-x11-server-common >= %{version}-%{release} +Provides: Xnest -%description Xnest -Xnest is an X server which has been implemented as an ordinary X application. It -runs in a window just like other X applications, but it is an X server itself in -which you can run other software. It is a very useful tool for developers who -wish to test their applications without running them on their real X server. +%description Xnest +Xnest is an X server which has been implemented as an ordinary +X application. It runs in a window just like other X applications, +but it is an X server itself in which you can run other software. It +is a very useful tool for developers who wish to test their +applications without running them on their real X server. -%package Xvfb -Summary: A X Windows System virtual framebuffer X server +%package Xdmx +Summary: Distributed Multihead X Server and utilities +Requires: xorg-x11-server-common >= %{version}-%{release} +Provides: Xdmx + +%description Xdmx +Xdmx is proxy X server that provides multi-head support for multiple displays +attached to different machines (each of which is running a typical X server). +When Xinerama is used with Xdmx, the multiple displays on multiple machines +are presented to the user as a single unified screen. A simple application +for Xdmx would be to provide multi-head support using two desktop machines, +each of which has a single display device attached to it. A complex +application for Xdmx would be to unify a 4 by 4 grid of 1280x1024 displays +(each attached to one of 16 computers) into a unified 5120x4096 display. + + +%package Xvfb +Summary: A X Windows System virtual framebuffer X server # xvfb-run is GPLv2, rest is MIT -License: MIT and GPL-2.0-only -Requires: xorg-x11-server-common >= %{version}-%{release} +License: MIT and GPLv2 +Requires: xorg-x11-server-common >= %{version}-%{release} # required for xvfb-run -Requires: xorg-x11-xauth -Provides: Xvfb -Requires: util-linux +Requires: xorg-x11-xauth +Requires: util-linux +Provides: Xvfb -%description Xvfb -Xvfb (X Virtual Frame Buffer) is an X server that is able to run on machines -with no display hardware and no physical input devices. Xvfb simulates a dumb -framebuffer using virtual memory. Xvfb does not open any devices, but behaves -otherwise as an X display. Xvfb is normally used for testing servers. +%description Xvfb +Xvfb (X Virtual Frame Buffer) is an X server that is able to run on +machines with no display hardware and no physical input devices. +Xvfb simulates a dumb framebuffer using virtual memory. Xvfb does +not open any devices, but behaves otherwise as an X display. Xvfb +is normally used for testing servers. -%package Xephyr -Summary: A nested server -Requires: xorg-x11-server-common >= %{version}-%{release} -Provides: Xephyr +%package Xephyr +Summary: A nested server +Requires: xorg-x11-server-common >= %{version}-%{release} +Provides: Xephyr -%description Xephyr -Xephyr is an X server which has been implemented as an ordinary X application. -It runs in a window just like other X applications, but it is an X server itself -in which you can run other software. It is a very useful tool for developers who -wish to test their applications without running them on their real X server. -Unlike Xnest, Xephyr renders to an X image rather than relaying the X protocol, -and therefore supports the newer X extensions like Render and Composite. +%description Xephyr +Xephyr is an X server which has been implemented as an ordinary +X application. It runs in a window just like other X applications, +but it is an X server itself in which you can run other software. It +is a very useful tool for developers who wish to test their +applications without running them on their real X server. Unlike +Xnest, Xephyr renders to an X image rather than relaying the +X protocol, and therefore supports the newer X extensions like +Render and Composite. -%package devel -Summary: SDK for X server driver module development -Requires: libpciaccess-devel -Requires: libXfont2-devel -Requires: xorg-x11-proto-devel -Requires: xorg-x11-util-macros -Requires: pixman-devel -Requires: pkgconfig -Provides: xorg-x11-server-static +%package devel +Summary: SDK for X server driver module development +Requires: xorg-x11-util-macros +Requires: xorg-x11-proto-devel +Requires: libXfont2-devel +Requires: pkgconfig pixman-devel libpciaccess-devel +Provides: xorg-x11-server-static +Obsoletes: xorg-x11-glamor-devel < %{version}-%{release} +Provides: xorg-x11-glamor-devel = %{version}-%{release} %description devel The SDK package provides the developmental files which are necessary for -developing X server driver modules, and for compiling driver modules outside of -the standard X11 source code tree. Developers writing video drivers, input -drivers, or other X modules should install this package. +developing X server driver modules, and for compiling driver modules +outside of the standard X11 source code tree. Developers writing video +drivers, input drivers, or other X modules should install this package. -%package source -Summary: Xserver source code required to build VNC server (Xvnc) -BuildArch: noarch +%package source +Summary: Xserver source code required to build VNC server (Xvnc) +BuildArch: noarch -%description source -Xserver source code needed to build VNC server (Xvnc). +%description source +Xserver source code needed to build VNC server (Xvnc) %prep -%autosetup -p1 -n %{pkgname}-%{version} +%autosetup -N -n %{pkgname}-%{?gitdate:%{gitdate}}%{!?gitdate:%{version}} +rm -rf .git +cp %{SOURCE1} .gitignore +# ick +%global __scm git +%{expand:%__scm_setup_git -q} +%if 0%{?fedora} >= 38 +%autopatch +%else +%autopatch -M 3800 +%endif +%if 0%{?stable_abi} # check the ABI in the source against what we expect. getmajor() { grep -i ^#define.ABI.$1_VERSION hw/xfree86/common/xf86Module.h | @@ -245,80 +406,76 @@ test `getminor xinput` == %{xinput_minor} test `getmajor extension` == %{extension_major} test `getminor extension` == %{extension_minor} +%endif + %build -%meson \ - -D agp=auto \ - -D builder_string="Build ID: %{name} %{version}-%{release}" \ - -D default_font_path="catalogue:/etc/X11/fontpath.d,built-ins" \ - -D devel-docs=false \ - -D dga=true \ - -D docs-pdf=false \ - -D docs=false \ - -D dpms=true \ - -D dri1=false \ - -D dri2=true \ - -D dri3=true \ - -D drm=true \ - -D dtrace=false \ - -D fallback_input_driver=libinput \ - -D glamor=true \ - -D glx=true \ - -D hal=false \ - -D input_thread=true \ - -D int10=false \ - -D ipv6=true \ - -D libunwind=true \ - -D linux_acpi=false \ - -D linux_apm=false \ - -D listen_local=true \ - -D listen_tcp=false \ - -D listen_unix=true \ - -D log_dir="%{_localstatedir}/log" \ - -D mitshm=auto \ - -D module_dir="%{_libdir}/xorg/modules" \ - -D pciaccess=true \ - -D screensaver=true \ - -D secure-rpc=false \ - -D sha1=libcrypto \ - -D suid_wrapper=true \ - -D systemd_logind=true \ - -D udev_kms=true \ - -D udev=true \ - -D vgahw=true \ - -D xace=true \ - -D xcsecurity=true \ - -D xdm-auth-1=true \ - -D xdmcp=true \ - -D xephyr=true \ - -D xf86bigfont=false \ - -D xf86-input-inputtest=true \ - -D xinerama=true \ - -D xkb_output_dir="%{_localstatedir}/lib/xkb" \ - -D xnest=true \ - -D xorg=true \ - -D xpbproxy=false \ - -D xquartz=false \ - -D xres=true \ - -D xselinux=true \ - -D xvfb=true \ - -D xvmc=true \ - -D xv=true \ - -D xwin=false + +export CFLAGS="$RPM_OPT_FLAGS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1" +export CXXFLAGS="$RPM_OPT_FLAGS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1" +export LDFLAGS="$RPM_LD_FLAGS -specs=/usr/lib/rpm/redhat/redhat-hardened-ld" + +%if !0%{?rhel} +%ifarch %{ix86} x86_64 +%global int10_arch 1 +%endif +%endif + +%if %{undefined int10_arch} +%global no_int10 --disable-vbe --disable-int10-module +%endif + +%global kdrive --enable-kdrive --enable-xephyr --disable-xfake --disable-xfbdev +%global xservers --enable-xvfb --enable-xnest %{kdrive} --enable-xorg +%global default_font_path "catalogue:/etc/X11/fontpath.d,built-ins" +%global dri_flags --disable-dri --enable-dri2 %{?!rhel:--enable-dri3} --enable-suid-wrapper --enable-glamor + +autoreconf -f -v --install || exit 1 + +%configure %{xservers} \ + --enable-dependency-tracking \ + --disable-static \ + --with-pic \ + %{?no_int10} \ + --with-default-font-path=%{default_font_path} \ + --with-module-dir=%{_libdir}/xorg/modules \ + --with-builderstring="Build ID: %{name} %{version}-%{release}" \ + --with-os-name="$(hostname -s) $(uname -r)" \ + --with-xkb-output=%{_localstatedir}/lib/xkb \ + --without-dtrace \ + --disable-linux-acpi --disable-linux-apm \ + --enable-xselinux --enable-record --enable-present \ + --enable-xcsecurity \ + --enable-config-udev \ + --disable-unit-tests \ + --enable-dmx \ + --disable-xwayland \ + %{dri_flags} \ + ${CONFIGURE} + +make V=1 %{?_smp_mflags} -%meson_build %install -%meson_install +%make_install -install -D -m 0644 -p xkb/README.compiled %{buildroot}%{_localstatedir}/lib/xkb/README.compiled -install -D -m 0644 %{SOURCE10} %{buildroot}%{_sysconfdir}/pam.d/xserver +mkdir -p $RPM_BUILD_ROOT%{_libdir}/xorg/modules/{drivers,input} + +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d +install -m 644 %{SOURCE10} $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/xserver # make sure the (empty) /etc/X11/xorg.conf.d is there, system-setup-keyboard # relies on it more or less. -mkdir -p %{buildroot}%{_sysconfdir}/X11/xorg.conf.d +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/X11/xorg.conf.d -install -D -m 0755 %{SOURCE30} %{buildroot}%{_bindir}/xserver-sdk-abi-requires -install -D -m 0755 %{SOURCE20} %{buildroot}%{_bindir}/xvfb-run +%if %{stable_abi} +install -m 755 %{SOURCE30} $RPM_BUILD_ROOT%{_bindir}/xserver-sdk-abi-requires +%else +sed -e s/@MAJOR@/%{gitdate}/g -e s/@MINOR@/%{minor_serial}/g %{SOURCE31} > \ + $RPM_BUILD_ROOT%{_bindir}/xserver-sdk-abi-requires +chmod 755 $RPM_BUILD_ROOT%{_bindir}/xserver-sdk-abi-requires +%endif + +install -m 0755 %{SOURCE20} $RPM_BUILD_ROOT%{_bindir}/xvfb-run # Make the source package %global xserver_source_dir %{_datadir}/xorg-x11-server-source @@ -329,18 +486,24 @@ mkdir -p %{inst_srcdir}/{hw/dmx/doc,man,doc,hw/dmx/doxygen} cp {,%{inst_srcdir}/}hw/xquartz/bundle/cpprules.in cp {,%{inst_srcdir}/}man/Xserver.man cp {,%{inst_srcdir}/}doc/smartsched -#cp {,%{inst_srcdir}/}hw/dmx/doxygen/doxygen.conf.in +cp {,%{inst_srcdir}/}hw/dmx/doxygen/doxygen.conf.in cp {,%{inst_srcdir}/}xserver.ent.in cp {,%{inst_srcdir}/}hw/xfree86/Xorg.sh.in cp xkb/README.compiled %{inst_srcdir}/xkb cp hw/xfree86/xorgconf.cpp %{inst_srcdir}/hw/xfree86 -find . -type f -not -path "./%{_vpath_builddir}/*" | egrep '.*\.(c|h|am|ac|inc|m4|h.in|pc.in|man.pre|pl|txt)$' | +find . -type f | egrep '.*\.(c|h|am|ac|inc|m4|h.in|pc.in|man.pre|pl|txt)$' | xargs tar cf - | (cd %{inst_srcdir} && tar xf -) find %{inst_srcdir}/hw/xfree86 -name \*.c -delete # Remove unwanted files/dirs -find %{buildroot} -type f -name '*.la' -delete +{ + find $RPM_BUILD_ROOT -type f -name '*.la' | xargs rm -f -- || : +# wtf +%ifnarch %{ix86} x86_64 + rm -f $RPM_BUILD_ROOT%{_libdir}/xorg/modules/lib{int10,vbe}.so +%endif +} %files common @@ -350,15 +513,21 @@ find %{buildroot} -type f -name '*.la' -delete %dir %{_localstatedir}/lib/xkb %{_localstatedir}/lib/xkb/README.compiled +%if 1 +%global Xorgperms %attr(4755, root, root) +%else +# disable until module loading is audited +%global Xorgperms %attr(0711,root,root) %caps(cap_sys_admin,cap_sys_rawio,cap_dac_override=pe) +%endif + %files Xorg %config %attr(0644,root,root) %{_sysconfdir}/pam.d/xserver -%{_bindir}/gtf %{_bindir}/X %{_bindir}/Xorg %{_libexecdir}/Xorg -# Disable until module loading is audited -# %attr(0711,root,root) %caps(cap_sys_admin,cap_sys_rawio,cap_dac_override=pe) -%attr(4755, root, root) %{_libexecdir}/Xorg.wrap +%{Xorgperms} %{_libexecdir}/Xorg.wrap +%{_bindir}/cvt +%{_bindir}/gtf %dir %{_libdir}/xorg %dir %{_libdir}/xorg/modules %dir %{_libdir}/xorg/modules/drivers @@ -366,25 +535,28 @@ find %{buildroot} -type f -name '*.la' -delete %dir %{_libdir}/xorg/modules/extensions %{_libdir}/xorg/modules/extensions/libglx.so %dir %{_libdir}/xorg/modules/input -%{_libdir}/xorg/modules/input/inputtest_drv.so -%{_libdir}/xorg/modules/libexa.so %{_libdir}/xorg/modules/libfbdevhw.so -#%%{_libdir}/xorg/modules/libfb.so +%{_libdir}/xorg/modules/libexa.so +%{_libdir}/xorg/modules/libfb.so %{_libdir}/xorg/modules/libglamoregl.so %{_libdir}/xorg/modules/libshadow.so %{_libdir}/xorg/modules/libshadowfb.so %{_libdir}/xorg/modules/libvgahw.so %{_libdir}/xorg/modules/libwfb.so +%if %{defined int10_arch} +%{_libdir}/xorg/modules/libint10.so +%{_libdir}/xorg/modules/libvbe.so +%endif %{_mandir}/man1/gtf.1* %{_mandir}/man1/Xorg.1* %{_mandir}/man1/Xorg.wrap.1* -%{_mandir}/man4/exa.4* +%{_mandir}/man1/cvt.1* %{_mandir}/man4/fbdevhw.4* -%{_mandir}/man4/inputtestdrv.4* +%{_mandir}/man4/exa.4* %{_mandir}/man4/modesetting.4* +%{_mandir}/man5/Xwrapper.config.5* %{_mandir}/man5/xorg.conf.5* %{_mandir}/man5/xorg.conf.d.5* -%{_mandir}/man5/Xwrapper.config.5* %dir %{_sysconfdir}/X11/xorg.conf.d %dir %{_datadir}/X11/xorg.conf.d %{_datadir}/X11/xorg.conf.d/10-quirks.conf @@ -393,6 +565,24 @@ find %{buildroot} -type f -name '*.la' -delete %{_bindir}/Xnest %{_mandir}/man1/Xnest.1* +%files Xdmx +%{_bindir}/Xdmx +%{_bindir}/dmxaddinput +%{_bindir}/dmxaddscreen +%{_bindir}/dmxreconfig +%{_bindir}/dmxresize +%{_bindir}/dmxrminput +%{_bindir}/dmxrmscreen +%{_bindir}/dmxtodmx +%{_bindir}/dmxwininfo +%{_bindir}/vdltodmx +%{_bindir}/dmxinfo +%{_bindir}/xdmxconfig +%{_mandir}/man1/Xdmx.1* +%{_mandir}/man1/dmxtodmx.1* +%{_mandir}/man1/vdltodmx.1* +%{_mandir}/man1/xdmxconfig.1* + %files Xvfb %{_bindir}/Xvfb %{_bindir}/xvfb-run @@ -404,6 +594,7 @@ find %{buildroot} -type f -name '*.la' -delete %files devel %doc COPYING +#{_docdir}/xorg-server %{_bindir}/xserver-sdk-abi-requires %{_libdir}/pkgconfig/xorg-server.pc %dir %{_includedir}/xorg @@ -415,113 +606,8 @@ find %{buildroot} -type f -name '*.la' -delete %changelog -* Fri Jul 17 2026 Fedora Release Engineering - 21.1.24-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild - -* Wed Jul 08 2026 Peter Hutterer - 21.1.24-1 -- Update to xserver 21.1.24 - Security fixes for: CVE-2026-55999, CVE-2025-56000 - -* Sat Jun 13 2026 Yaakov Selkowitz - 21.1.23-2 -- Rebuilt for openssl 4.0 - -* Tue Jun 02 2026 Peter Hutterer - 21.1.23-1 -- Update to xserver 21.1.23 - Security fixes for: ZDI-CAN-30136, ZDI-CAN-30159, ZDI-CAN-30160, - ZDI-CAN-30161, ZDI-CAN-30163, ZDI-CAN-30164, - ZDI-CAN-30165, ZDI-CAN-30168 - -* Tue Apr 14 2026 Olivier Fourdan - 21.1.22-1 -- Update to xserver 21.1.22 -- CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, - CVE-2026-34002, CVE-2026-34003 - -* Sat Jan 17 2026 Fedora Release Engineering - 21.1.21-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - -* Tue Nov 25 2025 Olivier Fourdan - 21.1.21-1 -- Update to xserver 21.1.21 (#2417000) - -* Tue Oct 28 2025 Olivier Fourdan - 21.1.20-1 -- Update to xserver 21.1.20 (#2406803) -- CVE fix for: CVE-2025-62229, CVE-2025-62230, CVE-2025-62231 - -* Fri Jul 25 2025 Fedora Release Engineering - 21.1.18-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Wed Jul 09 2025 Peter Hutterer -- Update Xvfb SPDX license identifier - -* Wed Jun 18 2025 Olivier Fourdan - 21.1.18-1 -- Update to xserver 21.1.18 -- Contains an additional fix for CVE-2025-49176 - -* Tue Jun 17 2025 Olivier Fourdan - 21.1.17-1 -- Update to xserver 21.1.17 -- CVE fix for: CVE-2025-49175, CVE-2025-49176, CVE-2025-49177 - CVE-2025-49178, CVE-2025-49179, CVE-2025-49180 - -* Wed Feb 26 2025 Olivier Fourdan - 21.1.16-1 -- Update to xserver 21.1.16 (#2347558) -- CVE fix for: CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597, - CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601 - -* Tue Feb 25 2025 Olivier Fourdan - 21.1.15-3 -- Fix DRI2 failure (#2347345) - -* Sun Jan 19 2025 Fedora Release Engineering - 21.1.15-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Fri Dec 20 2024 José Expósito - 21.1.15-1 -- Update to v21.1.15 - -* Fri Nov 29 2024 Sérgio Basto - 21.1.14-3 -- Revert commit "Fix error copying Xorg.wrap", debugedit-5.1-2 have the real fix - -* Mon Nov 18 2024 José Expósito - 21.1.14-2 -- Fix build issues caused by Xorg.wrap -- Restore quirks for Apple silicon - Fixes: 422064e45a42 ("Update X11-server to 21.1.13 and ABI numbers of videodrv and xinput") - Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2326701 - -* Tue Oct 29 2024 José Expósito - 21.1.14-1 -- Update to v21.1.14 - -* Wed Oct 16 2024 Peter Robinson -- Obsolete xorg-x11-drv-armsoc - -* Mon Sep 30 2024 Simone Caronni - 21.1.13-5 -- After removal of int10/vbe, obsolete vesa and fbdev X drivers: - https://fedoraproject.org/wiki/Changes/ReplaceFbdevDrivers - -* Sat Sep 28 2024 Simone Caronni - 21.1.13-4 -- Remove all conditionals. Drop int10 everywhere and enable libunwind/dri3 on - ELN. - -* Fri Sep 27 2024 Simone Caronni - 21.1.13-3 -- Switch to meson, drop no longer required patch. -- Drop Obsoletes/Provides that have been removed in ~2014. -- Add build depdendencies as they are searched by meson. -- Format SPEC file. - -* Thu Sep 26 2024 Simone Caronni - 21.1.13-2 -- Drop support for building snapshots. If they need to be built, there are - anyway more simpler ways. -- Trim changelog. -- Drop custom compileri/linker flags that are part of the standard already. - -* Mon Sep 02 2024 Sérgio Basto - 21.1.13-1 -- Update X11-server to 21.1.13 and ABI numbers of videodrv and xinput -- DMX DDX was dropped -- 0001-Disallow-byte-swapped-clients-by-default.patch is upstreamed -- 0001-autobind-GPUs-to-the-screen.patch is upstreamed -- 0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch updated - -* Sat Jul 20 2024 Fedora Release Engineering - 1.20.14-37 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Wed Apr 10 2024 José Expósito - 1.20.14-35 -- Backport fix for invalid Unicode sequence +* Tue Oct 29 2024 José Expósito - 1.20.14-36 +- CVE fix for CVE-2024-9632 * Wed Apr 10 2024 José Expósito - 1.20.14-35 - Fix regression caused by the fix for CVE-2024-31083 @@ -634,3 +720,286 @@ find %{buildroot} -type f -name '*.la' -delete * Sat Jan 22 2022 Fedora Release Engineering - 1.20.14-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Fri Dec 17 2021 Olivier - 1.20.14-1 +- xserver 1.20.14 + CVE-2021-4008/ZDI-CAN-14192 (#2026059, #2032941) + CVE-2021-4009/ZDI-CAN-14950 (#2026072, #2032943) + CVE-2021-4010/ZDI-CAN-14951 (#2026073, #2032944) + CVE-2021-4011/ZDI-CAN-14952 (#2026074, #2032945) + +* Tue Sep 14 2021 Sahana Prasad - 1.20.11-3 +- Rebuilt with OpenSSL 3.0.0 + +* Fri Jul 23 2021 Fedora Release Engineering - 1.20.11-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Wed Apr 14 2021 Olivier Fourdan - 1.20.11-1 +- xserver 1.20.11 (CVE-2021-3472 / ZDI-CAN-1259) + +* Wed Feb 03 2021 Peter Hutterer 1.20.10-5 +- Drop BuildRequires for flex-devel (#1871101) + +* Mon Feb 1 2021 Olivier Fourdan - 1.20.10-4 +- Remove Xwayland from the xserver builds + +* Thu Jan 28 2021 Fedora Release Engineering - 1.20.10-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Tue Jan 19 2021 Adam Jackson - 1.20.10-2 +- Disable int10 and vbe on RHEL +- Disable DRI1 +- Stop overriding the vendor name + +* Wed Dec 2 2020 Olivier Fourdan - 1.20.10-1 +- xserver 1.20.10 (CVE-2020-14360, CVE-2020-25712) + +* Thu Nov 5 10:35:09 AEST 2020 Peter Hutterer - 1.20.9-3 +- Add BuildRequires for make + +* Wed Nov 04 2020 Peter Hutterer 1.20.9-2 +- Drop BuildRequires to git-core only + +* Thu Oct 8 2020 Olivier Fourdan - 1.20.9-1 +- xserver 1.20.9 + all current fixes from upstream + +* Wed Aug 12 2020 Adam Jackson - 1.20.8-4 +- Enable XC-SECURITY + +* Fri Jul 31 2020 Adam Jackson - 1.20.8-3 +- Fix information disclosure bug in pixmap allocation (CVE-2020-14347) + +* Wed Jul 29 2020 Fedora Release Engineering - 1.20.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Mar 30 2020 Olivier Fourdan - 1.20.8-1 +- xserver 1.20.8 +- Backport latest Xwayland randr resolution change emulation support + patches. + +* Wed Mar 18 2020 Olivier Fourdan - 1.20.7-2 +- Fix a crash on closing a window using Present found upstream: + https://gitlab.freedesktop.org/xorg/xserver/issues/1000 + +* Fri Mar 13 2020 Olivier Fourdan - 1.20.7-1 +- xserver 1.20.7 +- backport from stable "xserver-1.20-branch" up to commit ad7364d8d + (for mutter fullscreen unredirect on Wayland) +- Update videodrv minor ABI as 1.20.7 changed the minor ABI version + (backward compatible, API addition in glamor) +- Rebase Xwayland randr resolution change emulation support patches + +* Fri Jan 31 2020 Fedora Release Engineering - 1.20.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Mon Nov 25 2019 Olivier Fourdan - 1.20.6-1 +- xserver 1.20.6 + +* Mon Nov 4 2019 Hans de Goede - 1.20.5-9 +- Fix building with new libglvnd-1.2.0 (E)GL headers and pkgconfig files + +* Mon Nov 4 2019 Hans de Goede - 1.20.5-8 +- Backport Xwayland randr resolution change emulation support + +* Thu Aug 29 2019 Olivier Fourdan 1.20.5-7 +- Pick latest fixes from xserver stable branch upstream (rhbz#1729925) + +* Sat Jul 27 2019 Fedora Release Engineering - 1.20.5-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Mon Jul 8 2019 Olivier Fourdan 1.20.5-5 +- Do not include on ARM with glibc to avoid compilation failure. +- Do not force vbe and int10 sdk headers as this enables int10 which does + not build on ARM without + +* Mon Jul 8 2019 Olivier Fourdan 1.20.5-4 +- Fix regression causing screen tearing with upstream xserver 1.20.5 + (rhbz#1726419) + +* Fri Jun 28 2019 Olivier Fourdan 1.20.5-3 +- Remove atomic downstream patches causing regressions (#1714981, #1723715) +- Xwayland crashes (#1708119, #1691745) +- Cursor issue with tablet on Xwayland +- Xorg/modesetting issue with flipping pixmaps with Present (#1645553) + +* Thu Jun 06 2019 Peter Hutterer 1.20.5-2 +- Return AlreadyGrabbed for keycodes > 255 (#1697804) + +* Thu May 30 2019 Adam Jackson - 1.20.5-1 +- xserver 1.20.5 + +* Tue Apr 23 2019 Adam Jackson - 1.20.4-4 +- Fix some non-atomic modesetting calls to be atomic + +* Wed Mar 27 2019 Peter Hutterer 1.20.4-3 +- Fix a Qt scrolling bug, don't reset the valuator on slave switch + +* Thu Mar 21 2019 Adam Jackson - 1.20.4-2 +- Backport an Xwayland crash fix in the Present code + +* Tue Feb 26 2019 Adam Jackson - 1.20.4-1 +- xserver 1.20.4 + +* Sun Feb 03 2019 Fedora Release Engineering - 1.20.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Fri Jan 11 2019 Olivier Fourdan - 1.20.3-3 +- More Xwayland/Present fixes from upstream (rhbz#1609181, rhbz#1661748) + +* Thu Dec 06 2018 Olivier Fourdan - 1.20.3-2 +- Xwayland/Present fixes from master upstream + +* Thu Nov 01 2018 Adam Jackson - 1.20.3-1 +- xserver 1.20.3 + +* Mon Oct 15 2018 Adam Jackson - 1.20.2-1 +- xserver 1.20.2 + +* Thu Oct 4 2018 Hans de Goede - 1.20.1-4 +- Rebase patch to use va_gl as vdpau driver on i965 GPUs, re-fix rhbz#1413733 + +* Thu Sep 13 2018 Dave Airlie - 1.20.1-3 +- Build with PIE enabled (this doesn't enable bind now) + +* Mon Sep 10 2018 Olivier Fourdan - 1.20.1-2 +- Include patches from upstream to fix Xwayland crashes + +* Thu Aug 09 2018 Adam Jackson - 1.20.1-1 +- xserver 1.20.1 + +* Sat Jul 14 2018 Fedora Release Engineering - 1.20.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Tue Jun 12 2018 Adam Jackson - 1.20.0-4 +- Xorg and Xwayland Requires: libEGL + +* Fri Jun 01 2018 Adam Williamson - 1.20.0-3 +- Backport fixes for RHBZ#1579067 + +* Wed May 16 2018 Adam Jackson - 1.20.0-2 +- Xorg Requires: xorg-x11-drv-libinput + +* Thu May 10 2018 Adam Jackson - 1.20.0-1 +- xserver 1.20 + +* Wed Apr 25 2018 Adam Jackson - 1.19.99.905-2 +- Fix xvfb-run's default depth to be 24 + +* Tue Apr 24 2018 Adam Jackson - 1.19.99.905-1 +- xserver 1.20 RC5 + +* Thu Apr 12 2018 Olivier Fourdan - 1.19.99.904-2 +- Re-fix "use type instead of which in xvfb-run (rhbz#1443357)" which + was overridden inadvertently + +* Tue Apr 10 2018 Adam Jackson - 1.19.99.904-1 +- xserver 1.20 RC4 + +* Mon Apr 02 2018 Adam Jackson - 1.19.99.903-1 +- xserver 1.20 RC3 + +* Tue Feb 13 2018 Olivier Fourdan 1.19.6-5 +- xwayland: avoid race condition on new keymap +- xwayland: Keep separate variables for pointer and tablet foci (rhbz#1519961) +- xvfb-run now support command line option “--auto-display” + +* Fri Feb 09 2018 Fedora Release Engineering - 1.19.6-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Tue Jan 30 2018 Olivier Fourdan 1.19.6-3 +- Avoid generating a core file when the Wayland compositor is gone. + +* Thu Jan 11 2018 Peter Hutterer 1.19.6-2 +- Fix handling of devices with ID_INPUT=null + +* Wed Dec 20 2017 Adam Jackson - 1.19.6-1 +- xserver 1.19.6 + +* Thu Oct 12 2017 Adam Jackson - 1.19.5-1 +- xserver 1.19.5 + +* Thu Oct 05 2017 Olivier Fourdan - 1.19.4-1 +- xserver-1.19.4 +- Backport tablet support for Xwayland + +* Fri Sep 08 2017 Troy Dawson - 1.19.3-9 +- Cleanup spec file conditionals + +* Thu Aug 03 2017 Fedora Release Engineering - 1.19.3-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Thu Jul 27 2017 Fedora Release Engineering - 1.19.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Sun Jul 2 2017 Ville Skyttä - 1.19.3-6 +- Use type instead of which in xvfb-run (rhbz#1443357) + +* Thu May 04 2017 Orion Poplawski - 1.19.3-5 +- Enable full build for s390/x + +* Mon Apr 24 2017 Ben Skeggs - 1.19.3-4 +- Default to xf86-video-modesetting on GeForce 8 and newer + +* Fri Apr 07 2017 Adam Jackson - 1.19.3-3 +- Inoculate against a versioning bug with libdrm 2.4.78 + +* Thu Mar 23 2017 Hans de Goede - 1.19.3-2 +- Use va_gl as vdpau driver on i965 GPUs (rhbz#1413733) + +* Wed Mar 15 2017 Adam Jackson - 1.19.3-1 +- xserver 1.19.3 + +* Thu Mar 02 2017 Adam Jackson - 1.19.2-1 +- xserver 1.19.2 + +* Sat Feb 11 2017 Fedora Release Engineering - 1.19.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Wed Feb 01 2017 Peter Hutterer 1.19.1-3 +- Fix a few input thread lock issues causing intel crashes (#1384486) + +* Mon Jan 16 2017 Adam Jackson - 1.19.1-2 +- Limit the intel driver only on F26 and up + +* Wed Jan 11 2017 Adam Jackson - 1.19.1-1 +- xserver 1.19.1 + +* Tue Jan 10 2017 Hans de Goede - 1.19.0-4 +- Follow Debian and only default to the intel ddx on gen4 or older intel GPUs + +* Tue Dec 20 2016 Hans de Goede - 1.19.0-3 +- Add one more patch for better integration with the nvidia binary driver + +* Thu Dec 15 2016 Hans de Goede - 1.19.0-2 +- Add some patches for better integration with the nvidia binary driver +- Add a patch from upstream fixing a crash (rhbz#1389886) + +* Wed Nov 23 2016 Olivier Fourdan 1.19.0-1 +- xserver 1.19.0 +- Fix use after free of cursors in Xwayland (rhbz#1385258) +- Fix an issue where some monitors would show only black, or + partially black when secondary GPU outputs are used + +* Tue Nov 15 2016 Peter Hutterer 1.19.0-0.8.rc2 +- Update device barriers for new master devices (#1384432) + +* Thu Nov 3 2016 Hans de Goede - 1.19.0-0.7.rc2 +- Update to 1.19.0-rc2 +- Fix (hopefully) various crashes in FlushAllOutput() (rhbz#1382444) +- Fix Xwayland crashing in glamor on non glamor capable hw (rhbz#1390018) + +* Tue Nov 1 2016 Ben Crocker - 1.19.0-0.6.20161028 +- Fix Config record allocation during startup: if xorg.conf.d directory +- was absent, a segfault resulted. + +* Mon Oct 31 2016 Adam Jackson - 1.19.0-0.5.20161026 +- Use %%autopatch instead of doing our own custom git-am trick + +* Fri Oct 28 2016 Hans de Goede - 1.19.0-0.4.20161026 +- Add missing Requires: libXfont2-devel to -devel sub-package (rhbz#1389711) + +* Wed Oct 26 2016 Hans de Goede - 1.19.0-0.3.20161026 +- Sync with upstream git, bringing in a bunch if bug-fixes +- Add some extra fixes which are pending upstream +- This also adds PointerWarping emulation to Xwayland, which should improve + compatiblity with many games diff --git a/xserver-sdk-abi-requires.git b/xserver-sdk-abi-requires.git new file mode 100755 index 0000000..c033061 --- /dev/null +++ b/xserver-sdk-abi-requires.git @@ -0,0 +1,14 @@ +#!/bin/sh +# +# The X server provides capabilities of the form: +# +# Provides: xserver-abi(ansic-0) = 4 +# +# for an ABI version of 0.4. The major number is encoded into the name so +# that major number changes force upgrades. If we didn't, then +# +# Requires: xserver-abi(ansic) >= 0.4 +# +# would also match 1.0, which is wrong since major numbers mean an ABI break. + +echo "xserver-abi($1-@MAJOR@) >= @MINOR@" diff --git a/xserver-sdk-abi-requires.release b/xserver-sdk-abi-requires.release new file mode 100755 index 0000000..30d77bf --- /dev/null +++ b/xserver-sdk-abi-requires.release @@ -0,0 +1,19 @@ +#!/bin/sh +# +# The X server provides capabilities of the form: +# +# Provides: xserver-abi(ansic-0) = 4 +# +# for an ABI version of 0.4. The major number is encoded into the name so +# that major number changes force upgrades. If we didn't, then +# +# Requires: xserver-abi(ansic) >= 0.4 +# +# would also match 1.0, which is wrong since major numbers mean an ABI break. + +ver=$(pkg-config --variable abi_$1 xorg-server) + +major=$(echo $ver | cut -f 1 -d .) +minor=$(echo $ver | cut -f 2 -d .) + +echo "xserver-abi($1-$major) >= $minor" diff --git a/xvfb-run.sh b/xvfb-run.sh index 7f3bac0..dec7dfc 100644 --- a/xvfb-run.sh +++ b/xvfb-run.sh @@ -183,7 +183,7 @@ RETVAL=$? set -e # Kill Xvfb now that the command has exited. -kill "$XVFBPID" 2>/dev/null || ! kill -0 "$XVFBPID" 2>/dev/null +kill $XVFBPID # Clean up. XAUTHORITY=$AUTHFILE xauth remove ":$SERVERNUM" >"$ERRORFILE" 2>&1