diff --git a/.gitignore b/.gitignore index 89c66cc..29790d0 100644 --- a/.gitignore +++ b/.gitignore @@ -1,37 +1,3 @@ -xorg-server-1.9.1.tar.bz2 -/xorg-server-20101125.tar.xz -/xorg-server-20101201.tar.xz -/xorg-server-1.10.0.tar.bz2 -/xorg-server-20110418.tar.xz -/xorg-server-20110510.tar.xz -/xorg-server-20110818.tar.xz -/xorg-server-1.11.0.tar.bz2 -/xorg-server-1.11.1.tar.bz2 -/xorg-server-20111109.tar.xz -/xorg-server-20120103.tar.xz -/xorg-server-20120124.tar.xz -/xorg-server-20120215.tar.xz -/xorg-server-1.12.0.tar.bz2 -/xorg-server-1.12.1.tar.bz2 -/xorg-server-1.12.2.tar.bz2 -/xorg-server-1.12.3.tar.bz2 -/xorg-server-20120717.tar.xz -/xorg-server-20120726.tar.xz -/xorg-server-20120808.tar.xz -/xorg-server-20120822.tar.xz -/xorg-server-1.13.0.tar.bz2 -/xorg-server-1.13.1.tar.bz2 -/xorg-server-20130109.tar.xz -/xorg-server-20130215.tar.xz -/xorg-server-1.14.0.tar.bz2 -/xorg-server-1.14.1.tar.bz2 -/xorg-server-1.14.1.901.tar.bz2 -/xorg-server-1.14.2.tar.bz2 -/xorg-server-1.14.3.tar.bz2 -/xorg-server-1.14.99.3.tar.bz2 -/xorg-server-1.14.99.901.tar.bz2 -/xorg-server-1.14.99.902.tar.bz2 *.bz2 *.xz -/xorg-x11-server-1.15.0-1.fc21.src.rpm -/xorg-server-1.20.14.tar.gz +*.gz diff --git a/0001-Disallow-byte-swapped-clients-by-default.patch b/0001-Disallow-byte-swapped-clients-by-default.patch deleted file mode 100644 index 2cbf798..0000000 --- a/0001-Disallow-byte-swapped-clients-by-default.patch +++ /dev/null @@ -1,272 +0,0 @@ -From 73d6e888c6058b28a0e87ab65aa4172b17d8327d Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Mon, 19 Dec 2022 10:34:29 +1000 -Subject: [PATCH xserver] Fix some indentation issues - -Signed-off-by: Peter Hutterer ---- - dix/dispatch.c | 22 +++++++++++----------- - 1 file changed, 11 insertions(+), 11 deletions(-) - -diff --git a/dix/dispatch.c b/dix/dispatch.c -index 210df75c63..e38a8fecaa 100644 ---- a/dix/dispatch.c -+++ b/dix/dispatch.c -@@ -492,10 +492,10 @@ Dispatch(void) - if (!WaitForSomething(clients_are_ready())) - continue; - -- /***************** -- * Handle events in round robin fashion, doing input between -- * each round -- *****************/ -+ /***************** -+ * Handle events in round robin fashion, doing input between -+ * each round -+ *****************/ - - if (!dispatchException && clients_are_ready()) { - client = SmartScheduleClient(); -@@ -3657,11 +3657,11 @@ ProcInitialConnection(ClientPtr client) - prefix = (xConnClientPrefix *) ((char *)stuff + sz_xReq); - order = prefix->byteOrder; - if (order != 'l' && order != 'B' && order != 'r' && order != 'R') -- return client->noClientException = -1; -+ return client->noClientException = -1; - if (((*(char *) &whichbyte) && (order == 'B' || order == 'R')) || -- (!(*(char *) &whichbyte) && (order == 'l' || order == 'r'))) { -- client->swapped = TRUE; -- SwapConnClientPrefix(prefix); -+ (!(*(char *) &whichbyte) && (order == 'l' || order == 'r'))) { -+ client->swapped = TRUE; -+ SwapConnClientPrefix(prefix); - } - stuff->reqType = 2; - stuff->length += bytes_to_int32(prefix->nbytesAuthProto) + -@@ -3670,7 +3670,7 @@ ProcInitialConnection(ClientPtr client) - swaps(&stuff->length); - } - if (order == 'r' || order == 'R') { -- client->local = FALSE; -+ client->local = FALSE; - } - ResetCurrentRequest(client); - return Success; -@@ -3781,8 +3781,8 @@ ProcEstablishConnection(ClientPtr client) - auth_string = auth_proto + pad_to_int32(prefix->nbytesAuthProto); - - if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix + -- pad_to_int32(prefix->nbytesAuthProto) + -- pad_to_int32(prefix->nbytesAuthString)) -+ pad_to_int32(prefix->nbytesAuthProto) + -+ pad_to_int32(prefix->nbytesAuthString)) - reason = "Bad length"; - else if ((prefix->majorVersion != X_PROTOCOL) || - (prefix->minorVersion != X_PROTOCOL_REVISION)) --- -2.39.0 - -From f69280ddcdd3115ee4717f22e85e0f43569b60dd Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 20 Dec 2022 11:40:16 +1000 -Subject: [PATCH xserver] dix: localize two variables - -Signed-off-by: Peter Hutterer ---- - dix/dispatch.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/dix/dispatch.c b/dix/dispatch.c -index c651c3d887..92be773e6c 100644 ---- a/dix/dispatch.c -+++ b/dix/dispatch.c -@@ -3766,14 +3766,11 @@ int - ProcEstablishConnection(ClientPtr client) - { - const char *reason; -- char *auth_proto, *auth_string; - xConnClientPrefix *prefix; - - REQUEST(xReq); - - prefix = (xConnClientPrefix *) ((char *) stuff + sz_xReq); -- auth_proto = (char *) prefix + sz_xConnClientPrefix; -- auth_string = auth_proto + pad_to_int32(prefix->nbytesAuthProto); - - if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix + - pad_to_int32(prefix->nbytesAuthProto) + -@@ -3782,12 +3779,15 @@ ProcEstablishConnection(ClientPtr client) - else if ((prefix->majorVersion != X_PROTOCOL) || - (prefix->minorVersion != X_PROTOCOL_REVISION)) - reason = "Protocol version mismatch"; -- else -+ else { -+ char *auth_proto = (char *) prefix + sz_xConnClientPrefix; -+ char *auth_string = auth_proto + pad_to_int32(prefix->nbytesAuthProto); - reason = ClientAuthorized(client, - (unsigned short) prefix->nbytesAuthProto, - auth_proto, - (unsigned short) prefix->nbytesAuthString, - auth_string); -+ } - - return (SendConnSetup(client, reason)); - } --- -2.39.0 - -From 412777664a20dd3561b936c02c96571a756fe9b2 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 20 Dec 2022 10:42:03 +1000 -Subject: [PATCH xserver] Disallow byte-swapped clients by default - -The X server swapping code is a huge attack surface, much of this code -is untested and prone to security issues. The use-case of byte-swapped -clients is very niche, so let's disable this by default and allow it -only when the respective config option or commandline flag is given. - -For Xorg, this adds the ServerFlag "AllowByteSwappedClients" "on". -For all DDX, this adds the commandline options +byteswappedclients and --byteswappedclients to enable or disable, respectively. - -Fixes #1201 - -https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1029 - -Signed-off-by: Peter Hutterer ---- - dix/dispatch.c | 4 +++- - hw/xfree86/common/xf86Config.c | 8 ++++++++ - hw/xfree86/man/xorg.conf.man | 2 ++ - hw/xwayland/xwayland.pc.in | 1 + - include/opaque.h | 2 ++ - man/Xserver.man | 6 ++++++ - os/utils.c | 9 +++++++++ - 7 files changed, 31 insertions(+), 1 deletion(-) - -diff --git a/dix/dispatch.c b/dix/dispatch.c -index 92be773e6c..9c26753a96 100644 ---- a/dix/dispatch.c -+++ b/dix/dispatch.c -@@ -3772,7 +3772,9 @@ ProcEstablishConnection(ClientPtr client) - - prefix = (xConnClientPrefix *) ((char *) stuff + sz_xReq); - -- if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix + -+ if (client->swapped && !AllowByteSwappedClients) { -+ reason = "Prohibited client endianess, see the Xserver man page "; -+ } else if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix + - pad_to_int32(prefix->nbytesAuthProto) + - pad_to_int32(prefix->nbytesAuthString)) - reason = "Bad length"; -diff --git a/hw/xfree86/common/xf86Config.c b/hw/xfree86/common/xf86Config.c -index 5d814c1485..41acb25aa2 100644 ---- a/hw/xfree86/common/xf86Config.c -+++ b/hw/xfree86/common/xf86Config.c -@@ -646,6 +646,7 @@ typedef enum { - FLAG_MAX_CLIENTS, - FLAG_IGLX, - FLAG_DEBUG, -+ FLAG_ALLOW_BYTE_SWAPPED_CLIENTS, - } FlagValues; - - /** -@@ -705,6 +706,8 @@ static OptionInfoRec FlagOptions[] = { - {0}, FALSE}, - {FLAG_DEBUG, "Debug", OPTV_STRING, - {0}, FALSE}, -+ {FLAG_ALLOW_BYTE_SWAPPED_CLIENTS, "AllowByteSwappedClients", OPTV_BOOLEAN, -+ {0}, FALSE}, - {-1, NULL, OPTV_NONE, - {0}, FALSE}, - }; -@@ -746,6 +749,11 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts) - xf86Msg(X_CONFIG, "Ignoring ABI Version\n"); - } - -+ xf86GetOptValBool(FlagOptions, FLAG_ALLOW_BYTE_SWAPPED_CLIENTS, &AllowByteSwappedClients); -+ if (AllowByteSwappedClients) { -+ xf86Msg(X_CONFIG, "Allowing byte-swapped clients\n"); -+ } -+ - if (xf86IsOptionSet(FlagOptions, FLAG_AUTO_ADD_DEVICES)) { - xf86GetOptValBool(FlagOptions, FLAG_AUTO_ADD_DEVICES, - &xf86Info.autoAddDevices); -diff --git a/hw/xfree86/man/xorg.conf.man b/hw/xfree86/man/xorg.conf.man -index 01b47247ee..d057f26ecd 100644 ---- a/hw/xfree86/man/xorg.conf.man -+++ b/hw/xfree86/man/xorg.conf.man -@@ -677,6 +677,8 @@ Possible values are - or - .BR sync . - Unset by default. -+.BI "Option \*qAllowByteSwappedClients\*q \*q" boolean \*q -+Allow clients with a different byte-order than the server. Disabled by default. - .SH "MODULE SECTION" - The - .B Module -diff --git a/include/opaque.h b/include/opaque.h -index 256261c2ad..398d4b4e51 100644 ---- a/include/opaque.h -+++ b/include/opaque.h -@@ -74,4 +74,6 @@ extern _X_EXPORT Bool bgNoneRoot; - extern _X_EXPORT Bool CoreDump; - extern _X_EXPORT Bool NoListenAll; - -+extern _X_EXPORT Bool AllowByteSwappedClients; -+ - #endif /* OPAQUE_H */ -diff --git a/man/Xserver.man b/man/Xserver.man -index 764bd1d907..e7adf9eb35 100644 ---- a/man/Xserver.man -+++ b/man/Xserver.man -@@ -114,6 +114,12 @@ pattern. This is the default unless -retro or -wr is specified. - .B \-bs - disables backing store support on all screens. - .TP 8 -+.B \+byteswappedclients -+Allow connections from clients with an endianess different to that of the server. -+.TP 8 -+.B \-byteswappedclients -+Prohibit connections from clients with an endianess different to that of the server. -+.TP 8 - .B \-c - turns off key-click. - .TP 8 -diff --git a/os/utils.c b/os/utils.c -index fe94912f34..405bf7d8b4 100644 ---- a/os/utils.c -+++ b/os/utils.c -@@ -189,6 +189,8 @@ Bool CoreDump; - - Bool enableIndirectGLX = FALSE; - -+Bool AllowByteSwappedClients = FALSE; -+ - #ifdef PANORAMIX - Bool PanoramiXExtensionDisabledHack = FALSE; - #endif -@@ -523,6 +525,8 @@ UseMsg(void) - ErrorF("-br create root window with black background\n"); - ErrorF("+bs enable any backing store support\n"); - ErrorF("-bs disable any backing store support\n"); -+ ErrorF("+byteswappedclients Allow clients with endianess different to that of the server\n"); -+ ErrorF("-byteswappedclients Prohibit clients with endianess different to that of the server\n"); - ErrorF("-c turns off key-click\n"); - ErrorF("c # key-click volume (0-100)\n"); - ErrorF("-cc int default color visual class\n"); -@@ -720,6 +724,11 @@ ProcessCommandLine(int argc, char *argv[]) - else - UseMsg(); - } -+ else if (strcmp(argv[i], "-byteswappedclients") == 0) { -+ AllowByteSwappedClients = FALSE; -+ } else if (strcmp(argv[i], "+byteswappedclients") == 0) { -+ AllowByteSwappedClients = TRUE; -+ } - else if (strcmp(argv[i], "-br") == 0); /* default */ - else if (strcmp(argv[i], "+bs") == 0) - enableBackingStore = TRUE; --- -2.39.0 - diff --git a/0001-Don-t-hardcode-fps-for-fake-screen.patch b/0001-Don-t-hardcode-fps-for-fake-screen.patch deleted file mode 100644 index 465a92b..0000000 --- a/0001-Don-t-hardcode-fps-for-fake-screen.patch +++ /dev/null @@ -1,135 +0,0 @@ -From 6497eeeb1a6552315132340565a3901d4db2144c Mon Sep 17 00:00:00 2001 -From: Boris-Barboris -Date: Tue, 22 Jun 2021 00:51:08 +0300 -Subject: [PATCH] Don't hardcode fps for fake screen - -Currently, when main hardware screen is powered-off, -X server initializes fake screen's timer with -1 second update interval. - -Streaming software like Nomachine or Vnc, as well as -desktop input automation suffers from it, since it -will forever be stuck on 1 fps until the display is -turned back on. - -This commit adds command line option -fakescreenfps -that allows the user to change the default fake screen -timer. - -Signed-off-by: Baranin Alexander ---- - man/Xserver.man | 3 +++ - os/utils.c | 12 ++++++++++++ - present/present.h | 2 ++ - present/present_fake.c | 28 ++++++++++++++++++---------- - 4 files changed, 35 insertions(+), 10 deletions(-) - -diff --git a/man/Xserver.man b/man/Xserver.man -index 31ffb8c..b1a3f40 100644 ---- a/man/Xserver.man -+++ b/man/Xserver.man -@@ -169,6 +169,9 @@ sets default cursor font. - .B \-fn \fIfont\fP - sets the default font. - .TP 8 -+.B \-fakescreenfps \fFps\fP -+sets fake presenter screen default fps (allowable range: 1-600). -+.TP 8 - .B \-fp \fIfontPath\fP - sets the search path for fonts. This path is a comma separated list - of directories which the X server searches for font databases. -diff --git a/os/utils.c b/os/utils.c -index 2ba1c80..721d4e9 100644 ---- a/os/utils.c -+++ b/os/utils.c -@@ -110,6 +110,8 @@ __stdcall unsigned long GetTickCount(void); - - #include "picture.h" - -+#include "present.h" -+ - Bool noTestExtensions; - - #ifdef COMPOSITE -@@ -526,6 +528,7 @@ UseMsg(void) - ErrorF - ("-deferglyphs [none|all|16] defer loading of [no|all|16-bit] glyphs\n"); - ErrorF("-f # bell base (0-100)\n"); -+ ErrorF("-fakescreenfps # fake screen default fps (1-600)\n"); - ErrorF("-fc string cursor font\n"); - ErrorF("-fn string default font name\n"); - ErrorF("-fp string default font path\n"); -@@ -776,6 +779,15 @@ ProcessCommandLine(int argc, char *argv[]) - else - UseMsg(); - } -+ else if (strcmp(argv[i], "-fakescreenfps") == 0) { -+ if (++i < argc) { -+ FakeScreenFps = (uint32_t) atoi(argv[i]); -+ if (FakeScreenFps < 1 || FakeScreenFps > 600) -+ FatalError("fakescreenfps must be an integer in [1;600] range\n"); -+ } -+ else -+ UseMsg(); -+ } - else if (strcmp(argv[i], "-fc") == 0) { - if (++i < argc) - defaultCursorFont = argv[i]; -diff --git a/present/present.h b/present/present.h -index 3d0b972..e7cc50d 100644 ---- a/present/present.h -+++ b/present/present.h -@@ -190,4 +190,6 @@ present_register_complete_notify(present_complete_notify_proc proc); - extern _X_EXPORT Bool - present_can_window_flip(WindowPtr window); - -+extern _X_EXPORT uint32_t FakeScreenFps; -+ - #endif /* _PRESENT_H_ */ -diff --git a/present/present_fake.c b/present/present_fake.c -index 2350638..d9ac598 100644 ---- a/present/present_fake.c -+++ b/present/present_fake.c -@@ -117,21 +117,29 @@ present_fake_queue_vblank(ScreenPtr screen, - return Success; - } - -+uint32_t FakeScreenFps = 0; -+ - void - present_fake_screen_init(ScreenPtr screen) - { -+ uint32_t fake_fps; - present_screen_priv_ptr screen_priv = present_screen_priv(screen); - -- /* For screens with hardware vblank support, the fake code -- * will be used for off-screen windows and while screens are blanked, -- * in which case we want a slow interval here -- * -- * Otherwise, pretend that the screen runs at 60Hz -- */ -- if (screen_priv->info && screen_priv->info->get_crtc) -- screen_priv->fake_interval = 1000000; -- else -- screen_priv->fake_interval = 16667; -+ if (FakeScreenFps) -+ fake_fps = FakeScreenFps; -+ else { -+ /* For screens with hardware vblank support, the fake code -+ * will be used for off-screen windows and while screens are blanked, -+ * in which case we want a large interval here: 1Hz -+ * -+ * Otherwise, pretend that the screen runs at 60Hz -+ */ -+ if (screen_priv->info && screen_priv->info->get_crtc) -+ fake_fps = 1; -+ else -+ fake_fps = 60; -+ } -+ screen_priv->fake_interval = 1000000 / fake_fps; - } - - void --- -2.34.1 - diff --git a/0001-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch b/0001-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch deleted file mode 100644 index 5a64c75..0000000 --- a/0001-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 96798fc1967491c80a4d0c8d9e0a80586cb2152b Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith -Date: Fri, 22 Mar 2024 18:51:45 -0700 -Subject: [PATCH 1/4] Xi: ProcXIGetSelectedEvents needs to use unswapped length - to send reply - -CVE-2024-31080 - -Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762 -Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.") -Signed-off-by: Alan Coopersmith -Part-of: ---- - Xi/xiselectev.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c -index edcb8a0d3..ac1494987 100644 ---- a/Xi/xiselectev.c -+++ b/Xi/xiselectev.c -@@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client) - InputClientsPtr others = NULL; - xXIEventMask *evmask = NULL; - DeviceIntPtr dev; -+ uint32_t length; - - REQUEST(xXIGetSelectedEventsReq); - REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq); -@@ -418,10 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client) - } - } - -+ /* save the value before SRepXIGetSelectedEvents swaps it */ -+ length = reply.length; - WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply); - - if (reply.num_masks) -- WriteToClient(client, reply.length * 4, buffer); -+ WriteToClient(client, length * 4, buffer); - - free(buffer); - return Success; --- -2.44.0 - diff --git a/0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch b/0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch deleted file mode 100644 index 11236a1..0000000 --- a/0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch +++ /dev/null @@ -1,77 +0,0 @@ -From a7bda3080d2b44eae668cdcec7a93095385b9652 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 28 Nov 2023 15:19:04 +1000 -Subject: [PATCH xserver] Xi: allocate enough XkbActions for our buttons - -button->xkb_acts is supposed to be an array sufficiently large for all -our buttons, not just a single XkbActions struct. Allocating -insufficient memory here means when we memcpy() later in -XkbSetDeviceInfo we write into memory that wasn't ours to begin with, -leading to the usual security ooopsiedaisies. - -CVE-2023-6377, ZDI-CAN-22412, ZDI-CAN-22413 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -(cherry picked from commit 0c1a93d319558fe3ab2d94f51d174b4f93810afd) ---- - Xi/exevents.c | 12 ++++++------ - dix/devices.c | 10 ++++++++++ - 2 files changed, 16 insertions(+), 6 deletions(-) - -diff --git a/Xi/exevents.c b/Xi/exevents.c -index dcd4efb3bc..54ea11a938 100644 ---- a/Xi/exevents.c -+++ b/Xi/exevents.c -@@ -611,13 +611,13 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) - } - - if (from->button->xkb_acts) { -- if (!to->button->xkb_acts) { -- to->button->xkb_acts = calloc(1, sizeof(XkbAction)); -- if (!to->button->xkb_acts) -- FatalError("[Xi] not enough memory for xkb_acts.\n"); -- } -+ size_t maxbuttons = max(to->button->numButtons, from->button->numButtons); -+ to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts, -+ maxbuttons, -+ sizeof(XkbAction)); -+ memset(to->button->xkb_acts, 0, maxbuttons * sizeof(XkbAction)); - memcpy(to->button->xkb_acts, from->button->xkb_acts, -- sizeof(XkbAction)); -+ from->button->numButtons * sizeof(XkbAction)); - } - else { - free(to->button->xkb_acts); -diff --git a/dix/devices.c b/dix/devices.c -index 5bf956ead4..15e46a9a5f 100644 ---- a/dix/devices.c -+++ b/dix/devices.c -@@ -2525,6 +2525,8 @@ RecalculateMasterButtons(DeviceIntPtr slave) - - if (master->button && master->button->numButtons != maxbuttons) { - int i; -+ int last_num_buttons = master->button->numButtons; -+ - DeviceChangedEvent event = { - .header = ET_Internal, - .type = ET_DeviceChanged, -@@ -2535,6 +2537,14 @@ RecalculateMasterButtons(DeviceIntPtr slave) - }; - - master->button->numButtons = maxbuttons; -+ if (last_num_buttons < maxbuttons) { -+ master->button->xkb_acts = xnfreallocarray(master->button->xkb_acts, -+ maxbuttons, -+ sizeof(XkbAction)); -+ memset(&master->button->xkb_acts[last_num_buttons], -+ 0, -+ (maxbuttons - last_num_buttons) * sizeof(XkbAction)); -+ } - - memcpy(&event.buttons.names, master->button->labels, maxbuttons * - sizeof(Atom)); --- -2.43.0 - diff --git a/0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch b/0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch deleted file mode 100644 index 2389895..0000000 --- a/0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 7150ba655c0cc08fa6ded309b81265bb672f2869 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Wed, 25 Jan 2023 11:41:40 +1000 -Subject: [PATCH xserver] Xi: fix potential use-after-free in - DeepCopyPointerClasses - -CVE-2023-0494, ZDI-CAN 19596 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Signed-off-by: Peter Hutterer ---- - Xi/exevents.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/Xi/exevents.c b/Xi/exevents.c -index 217baa9561..dcd4efb3bc 100644 ---- a/Xi/exevents.c -+++ b/Xi/exevents.c -@@ -619,8 +619,10 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) - memcpy(to->button->xkb_acts, from->button->xkb_acts, - sizeof(XkbAction)); - } -- else -+ else { - free(to->button->xkb_acts); -+ to->button->xkb_acts = NULL; -+ } - - memcpy(to->button->labels, from->button->labels, - from->button->numButtons * sizeof(Atom)); --- -2.39.0 - diff --git a/0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch b/0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch deleted file mode 100644 index 99625dd..0000000 --- a/0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch +++ /dev/null @@ -1,80 +0,0 @@ -From a31ba141824a7649e11f0ef7673718ce559d6337 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 3 Oct 2023 11:53:05 +1000 -Subject: [PATCH xserver 1/4] Xi/randr: fix handling of PropModeAppend/Prepend - -The handling of appending/prepending properties was incorrect, with at -least two bugs: the property length was set to the length of the new -part only, i.e. appending or prepending N elements to a property with P -existing elements always resulted in the property having N elements -instead of N + P. - -Second, when pre-pending a value to a property, the offset for the old -values was incorrect, leaving the new property with potentially -uninitalized values and/or resulting in OOB memory writes. -For example, prepending a 3 element value to a 5 element property would -result in this 8 value array: - [N, N, N, ?, ?, P, P, P ] P, P - ^OOB write - -The XI2 code is a copy/paste of the RandR code, so the bug exists in -both. - -CVE-2023-5367, ZDI-CAN-22153 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Signed-off-by: Peter Hutterer ---- - Xi/xiproperty.c | 4 ++-- - randr/rrproperty.c | 4 ++-- - 2 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c -index 6ec419e870..563c4f31a5 100644 ---- a/Xi/xiproperty.c -+++ b/Xi/xiproperty.c -@@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type, - XIDestroyDeviceProperty(prop); - return BadAlloc; - } -- new_value.size = len; -+ new_value.size = total_len; - new_value.type = type; - new_value.format = format; - -@@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type, - case PropModePrepend: - new_data = new_value.data; - old_data = (void *) (((char *) new_value.data) + -- (prop_value->size * size_in_bytes)); -+ (len * size_in_bytes)); - break; - } - if (new_data) -diff --git a/randr/rrproperty.c b/randr/rrproperty.c -index c2fb9585c6..25469f57b2 100644 ---- a/randr/rrproperty.c -+++ b/randr/rrproperty.c -@@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type, - RRDestroyOutputProperty(prop); - return BadAlloc; - } -- new_value.size = len; -+ new_value.size = total_len; - new_value.type = type; - new_value.format = format; - -@@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type, - case PropModePrepend: - new_data = new_value.data; - old_data = (void *) (((char *) new_value.data) + -- (prop_value->size * size_in_bytes)); -+ (len * size_in_bytes)); - break; - } - if (new_data) --- -2.41.0 - diff --git a/0001-Xtest-disallow-GenericEvents-in-XTestSwapFakeInput.patch b/0001-Xtest-disallow-GenericEvents-in-XTestSwapFakeInput.patch deleted file mode 100644 index 017f247..0000000 --- a/0001-Xtest-disallow-GenericEvents-in-XTestSwapFakeInput.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 8dba686dc277d6d262ad0c77b4632a5b276697ba Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 29 Nov 2022 12:55:45 +1000 -Subject: [PATCH xserver 1/7] Xtest: disallow GenericEvents in - XTestSwapFakeInput - -XTestSwapFakeInput assumes all events in this request are -sizeof(xEvent) and iterates through these in 32-byte increments. -However, a GenericEvent may be of arbitrary length longer than 32 bytes, -so any GenericEvent in this list would result in subsequent events to be -misparsed. - -Additional, the swapped event is written into a stack-allocated struct -xEvent (size 32 bytes). For any GenericEvent longer than 32 bytes, -swapping the event may thus smash the stack like an avocado on toast. - -Catch this case early and return BadValue for any GenericEvent. -Which is what would happen in unswapped setups anyway since XTest -doesn't support GenericEvent. - -CVE-2022-46340, ZDI-CAN 19265 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Signed-off-by: Peter Hutterer -Acked-by: Olivier Fourdan ---- - Xext/xtest.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/Xext/xtest.c b/Xext/xtest.c -index bf27eb590b..2985a4ce6e 100644 ---- a/Xext/xtest.c -+++ b/Xext/xtest.c -@@ -502,10 +502,11 @@ XTestSwapFakeInput(ClientPtr client, xReq * req) - - nev = ((req->length << 2) - sizeof(xReq)) / sizeof(xEvent); - for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) { -+ int evtype = ev->u.u.type & 0x177; - /* Swap event */ -- proc = EventSwapVector[ev->u.u.type & 0177]; -+ proc = EventSwapVector[evtype]; - /* no swapping proc; invalid event type? */ -- if (!proc || proc == NotImplemented) { -+ if (!proc || proc == NotImplemented || evtype == GenericEvent) { - client->errorValue = ev->u.u.type; - return BadValue; - } --- -2.38.1 - diff --git a/0001-add-a-quirk-for-apple-silicon.patch b/0001-add-a-quirk-for-apple-silicon.patch deleted file mode 100644 index 17c40e5..0000000 --- a/0001-add-a-quirk-for-apple-silicon.patch +++ /dev/null @@ -1,30 +0,0 @@ -commit 39934a656a44722d16a80bf4db411c53e2d67b38 (HEAD -> master, origin/master, origin/HEAD) -Author: Eric Curtin -Date: Fri Dec 16 11:10:12 2022 +0000 - - config: add a quirk for Apple Silicon appledrm - - Xorg server does not correctly select the DCP for the display without a - quirk on Apple Silicon. - - Signed-off-by: Eric Curtin - Suggested-by: Hector Martin - -diff --git a/config/10-quirks.conf b/config/10-quirks.conf -index 47907d82d..54dd908a7 100644 ---- a/config/10-quirks.conf -+++ b/config/10-quirks.conf -@@ -36,3 +36,13 @@ Section "InputClass" - MatchDriver "evdev" - Option "TypeName" "MOUSE" - EndSection -+ -+# https://bugzilla.redhat.com/show_bug.cgi?id=2152414 -+# Xorg server does not correctly select the DCP for the display without -+# a quirk on Apple Silicon -+Section "OutputClass" -+ Identifier "appledrm" -+ MatchDriver "apple" -+ Driver "modesetting" -+ Option "PrimaryGPU" "true" -+EndSection diff --git a/0001-autobind-GPUs-to-the-screen.patch b/0001-autobind-GPUs-to-the-screen.patch deleted file mode 100644 index 86b96a2..0000000 --- a/0001-autobind-GPUs-to-the-screen.patch +++ /dev/null @@ -1,293 +0,0 @@ -From 471289fa1dc359555ceed6302f7d9605ab6be3ea Mon Sep 17 00:00:00 2001 -From: Dave Airlie -Date: Mon, 2 Apr 2018 16:49:02 -0400 -Subject: [PATCH] autobind GPUs to the screen - -This is a modified version of a patch we've been carry-ing in Fedora and -RHEL for years now. This patch automatically adds secondary GPUs to the -master as output sink / offload source making e.g. the use of -slave-outputs just work, with requiring the user to manually run -"xrandr --setprovideroutputsource" before he can hookup an external -monitor to his hybrid graphics laptop. - -There is one problem with this patch, which is why it was not upstreamed -before. What to do when a secondary GPU gets detected really is a policy -decission (e.g. one may want to autobind PCI GPUs but not USB ones) and -as such should be under control of the Desktop Environment. - -Unconditionally adding autobinding support to the xserver will result -in races between the DE dealing with the hotplug of a secondary GPU -and the server itself dealing with it. - -However we've waited for years for any Desktop Environments to actually -start doing some sort of autoconfiguration of secondary GPUs and there -is still not a single DE dealing with this, so I believe that it is -time to upstream this now. - -To avoid potential future problems if any DEs get support for doing -secondary GPU configuration themselves, the new autobind functionality -is made optional. Since no DEs currently support doing this themselves it -is enabled by default. When DEs grow support for doing this themselves -they can disable the servers autobinding through the servers cmdline or a -xorg.conf snippet. - -Signed-off-by: Dave Airlie -[hdegoede@redhat.com: Make configurable, fix with nvidia, submit upstream] -Signed-off-by: Hans de Goede ---- - hw/xfree86/common/xf86Config.c | 19 +++++++++++++++++++ - hw/xfree86/common/xf86Globals.c | 2 ++ - hw/xfree86/common/xf86Init.c | 20 ++++++++++++++++++++ - hw/xfree86/common/xf86Priv.h | 1 + - hw/xfree86/common/xf86Privstr.h | 1 + - hw/xfree86/common/xf86platformBus.c | 4 ++++ - hw/xfree86/man/Xorg.man | 7 +++++++ - hw/xfree86/man/xorg.conf.man | 6 ++++++ - randr/randrstr.h | 3 +++ - randr/rrprovider.c | 22 ++++++++++++++++++++++ - 10 files changed, 85 insertions(+) - -diff --git a/hw/xfree86/common/xf86Config.c b/hw/xfree86/common/xf86Config.c -index 2c1d335..d7d7c2e 100644 ---- a/hw/xfree86/common/xf86Config.c -+++ b/hw/xfree86/common/xf86Config.c -@@ -643,6 +643,7 @@ typedef enum { - FLAG_DRI2, - FLAG_USE_SIGIO, - FLAG_AUTO_ADD_GPU, -+ FLAG_AUTO_BIND_GPU, - FLAG_MAX_CLIENTS, - FLAG_IGLX, - FLAG_DEBUG, -@@ -699,6 +700,8 @@ static OptionInfoRec FlagOptions[] = { - {0}, FALSE}, - {FLAG_AUTO_ADD_GPU, "AutoAddGPU", OPTV_BOOLEAN, - {0}, FALSE}, -+ {FLAG_AUTO_BIND_GPU, "AutoBindGPU", OPTV_BOOLEAN, -+ {0}, FALSE}, - {FLAG_MAX_CLIENTS, "MaxClients", OPTV_INTEGER, - {0}, FALSE }, - {FLAG_IGLX, "IndirectGLX", OPTV_BOOLEAN, -@@ -779,6 +782,22 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts) - } - xf86Msg(from, "%sutomatically adding GPU devices\n", - xf86Info.autoAddGPU ? "A" : "Not a"); -+ -+ if (xf86AutoBindGPUDisabled) { -+ xf86Info.autoBindGPU = FALSE; -+ from = X_CMDLINE; -+ } -+ else if (xf86IsOptionSet(FlagOptions, FLAG_AUTO_BIND_GPU)) { -+ xf86GetOptValBool(FlagOptions, FLAG_AUTO_BIND_GPU, -+ &xf86Info.autoBindGPU); -+ from = X_CONFIG; -+ } -+ else { -+ from = X_DEFAULT; -+ } -+ xf86Msg(from, "%sutomatically binding GPU devices\n", -+ xf86Info.autoBindGPU ? "A" : "Not a"); -+ - /* - * Set things up based on the config file information. Some of these - * settings may be overridden later when the command line options are -diff --git a/hw/xfree86/common/xf86Globals.c b/hw/xfree86/common/xf86Globals.c -index e890f05..7b27b4c 100644 ---- a/hw/xfree86/common/xf86Globals.c -+++ b/hw/xfree86/common/xf86Globals.c -@@ -131,6 +131,7 @@ xf86InfoRec xf86Info = { - #else - .autoAddGPU = FALSE, - #endif -+ .autoBindGPU = TRUE, - }; - - const char *xf86ConfigFile = NULL; -@@ -191,6 +192,7 @@ Bool xf86FlipPixels = FALSE; - Gamma xf86Gamma = { 0.0, 0.0, 0.0 }; - - Bool xf86AllowMouseOpenFail = FALSE; -+Bool xf86AutoBindGPUDisabled = FALSE; - - #ifdef XF86VIDMODE - Bool xf86VidModeDisabled = FALSE; -diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c -index ea42ec9..ec255b6 100644 ---- a/hw/xfree86/common/xf86Init.c -+++ b/hw/xfree86/common/xf86Init.c -@@ -76,6 +76,7 @@ - #include "xf86DDC.h" - #include "xf86Xinput.h" - #include "xf86InPriv.h" -+#include "xf86Crtc.h" - #include "picturestr.h" - #include "randrstr.h" - #include "glxvndabi.h" -@@ -237,6 +238,19 @@ xf86PrivsElevated(void) - return PrivsElevated(); - } - -+static void -+xf86AutoConfigOutputDevices(void) -+{ -+ int i; -+ -+ if (!xf86Info.autoBindGPU) -+ return; -+ -+ for (i = 0; i < xf86NumGPUScreens; i++) -+ RRProviderAutoConfigGpuScreen(xf86ScrnToScreen(xf86GPUScreens[i]), -+ xf86ScrnToScreen(xf86Screens[0])); -+} -+ - static void - TrapSignals(void) - { -@@ -770,6 +784,8 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char **argv) - for (i = 0; i < xf86NumGPUScreens; i++) - AttachUnboundGPU(xf86Screens[0]->pScreen, xf86GPUScreens[i]->pScreen); - -+ xf86AutoConfigOutputDevices(); -+ - xf86VGAarbiterWrapFunctions(); - if (sigio_blocked) - input_unlock(); -@@ -1278,6 +1294,10 @@ ddxProcessArgument(int argc, char **argv, int i) - xf86Info.iglxFrom = X_CMDLINE; - return 0; - } -+ if (!strcmp(argv[i], "-noautoBindGPU")) { -+ xf86AutoBindGPUDisabled = TRUE; -+ return 1; -+ } - - /* OS-specific processing */ - return xf86ProcessArgument(argc, argv, i); -diff --git a/hw/xfree86/common/xf86Priv.h b/hw/xfree86/common/xf86Priv.h -index 4fe2b5f..6566622 100644 ---- a/hw/xfree86/common/xf86Priv.h -+++ b/hw/xfree86/common/xf86Priv.h -@@ -46,6 +46,7 @@ - extern _X_EXPORT const char *xf86ConfigFile; - extern _X_EXPORT const char *xf86ConfigDir; - extern _X_EXPORT Bool xf86AllowMouseOpenFail; -+extern _X_EXPORT Bool xf86AutoBindGPUDisabled; - - #ifdef XF86VIDMODE - extern _X_EXPORT Bool xf86VidModeDisabled; -diff --git a/hw/xfree86/common/xf86Privstr.h b/hw/xfree86/common/xf86Privstr.h -index 21c2e1f..6c71863 100644 ---- a/hw/xfree86/common/xf86Privstr.h -+++ b/hw/xfree86/common/xf86Privstr.h -@@ -98,6 +98,7 @@ typedef struct { - - Bool autoAddGPU; - const char *debug; -+ Bool autoBindGPU; - } xf86InfoRec, *xf86InfoPtr; - - /* ISC's cc can't handle ~ of UL constants, so explicitly type cast them. */ -diff --git a/hw/xfree86/common/xf86platformBus.c b/hw/xfree86/common/xf86platformBus.c -index cef47da..913a324 100644 ---- a/hw/xfree86/common/xf86platformBus.c -+++ b/hw/xfree86/common/xf86platformBus.c -@@ -49,6 +49,7 @@ - #include "Pci.h" - #include "xf86platformBus.h" - #include "xf86Config.h" -+#include "xf86Crtc.h" - - #include "randrstr.h" - int platformSlotClaimed; -@@ -665,6 +666,9 @@ xf86platformAddDevice(int index) - } - /* attach unbound to 0 protocol screen */ - AttachUnboundGPU(xf86Screens[0]->pScreen, xf86GPUScreens[i]->pScreen); -+ if (xf86Info.autoBindGPU) -+ RRProviderAutoConfigGpuScreen(xf86ScrnToScreen(xf86GPUScreens[i]), -+ xf86ScrnToScreen(xf86Screens[0])); - - RRResourcesChanged(xf86Screens[0]->pScreen); - RRTellChanged(xf86Screens[0]->pScreen); -diff --git a/hw/xfree86/man/Xorg.man b/hw/xfree86/man/Xorg.man -index 13a9dc3..745f986 100644 ---- a/hw/xfree86/man/Xorg.man -+++ b/hw/xfree86/man/Xorg.man -@@ -283,6 +283,13 @@ is a comma separated list of directories to search for - server modules. This option is only available when the server is run - as root (i.e, with real-uid 0). - .TP 8 -+.B \-noautoBindGPU -+Disable automatically setting secondary GPUs up as output sinks and offload -+sources. This is equivalent to setting the -+.B AutoBindGPU -+xorg.conf(__filemansuffix__) file option. To -+.B false. -+.TP 8 - .B \-nosilk - Disable Silken Mouse support. - .TP 8 -diff --git a/hw/xfree86/man/xorg.conf.man b/hw/xfree86/man/xorg.conf.man -index 9589262..8d51e06 100644 ---- a/hw/xfree86/man/xorg.conf.man -+++ b/hw/xfree86/man/xorg.conf.man -@@ -672,6 +672,12 @@ Enabled by default. - If this option is disabled, then no GPU devices will be added from the udev - backend. Enabled by default. (May need to be disabled to setup Xinerama). - .TP 7 -+.BI "Option \*qAutoBindGPU\*q \*q" boolean \*q -+If enabled then secondary GPUs will be automatically set up as output-sinks and -+offload-sources. Making e.g. laptop outputs connected only to the secondary -+GPU directly available for use without needing to run -+"xrandr --setprovideroutputsource". Enabled by default. -+.TP 7 - .BI "Option \*qLog\*q \*q" string \*q - This option controls whether the log is flushed and/or synced to disk after - each message. -diff --git a/randr/randrstr.h b/randr/randrstr.h -index f94174b..092d726 100644 ---- a/randr/randrstr.h -+++ b/randr/randrstr.h -@@ -1039,6 +1039,9 @@ RRProviderLookup(XID id, RRProviderPtr *provider_p); - extern _X_EXPORT void - RRDeliverProviderEvent(ClientPtr client, WindowPtr pWin, RRProviderPtr provider); - -+extern _X_EXPORT void -+RRProviderAutoConfigGpuScreen(ScreenPtr pScreen, ScreenPtr masterScreen); -+ - /* rrproviderproperty.c */ - - extern _X_EXPORT void -diff --git a/randr/rrprovider.c b/randr/rrprovider.c -index e4bc2bf..e04c18f 100644 ---- a/randr/rrprovider.c -+++ b/randr/rrprovider.c -@@ -485,3 +485,25 @@ RRDeliverProviderEvent(ClientPtr client, WindowPtr pWin, RRProviderPtr provider) - - WriteEventsToClient(client, 1, (xEvent *) &pe); - } -+ -+void -+RRProviderAutoConfigGpuScreen(ScreenPtr pScreen, ScreenPtr masterScreen) -+{ -+ rrScrPrivPtr pScrPriv = rrGetScrPriv(pScreen); -+ rrScrPrivPtr masterPriv = rrGetScrPriv(masterScreen); -+ RRProviderPtr provider = pScrPriv->provider; -+ RRProviderPtr master_provider = masterPriv->provider; -+ -+ if (!provider || !master_provider) -+ return; -+ -+ if ((provider->capabilities & RR_Capability_SinkOutput) && -+ (master_provider->capabilities & RR_Capability_SourceOutput)) { -+ pScrPriv->rrProviderSetOutputSource(pScreen, provider, master_provider); -+ RRInitPrimeSyncProps(pScreen); -+ } -+ -+ if ((provider->capabilities & RR_Capability_SourceOffload) && -+ (master_provider->capabilities & RR_Capability_SinkOffload)) -+ pScrPriv->rrProviderSetOffloadSink(pScreen, provider, master_provider); -+} --- -2.16.2 - diff --git a/0001-composite-Fix-use-after-free-of-the-COW.patch b/0001-composite-Fix-use-after-free-of-the-COW.patch deleted file mode 100644 index bb21d7e..0000000 --- a/0001-composite-Fix-use-after-free-of-the-COW.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001 -From: Olivier Fourdan -Date: Mon, 13 Mar 2023 11:08:47 +0100 -Subject: [PATCH xserver] composite: Fix use-after-free of the COW - -ZDI-CAN-19866/CVE-2023-1393 - -If a client explicitly destroys the compositor overlay window (aka COW), -we would leave a dangling pointer to that window in the CompScreen -structure, which will trigger a use-after-free later. - -Make sure to clear the CompScreen pointer to the COW when the latter gets -destroyed explicitly by the client. - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Signed-off-by: Olivier Fourdan -Reviewed-by: Adam Jackson ---- - composite/compwindow.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/composite/compwindow.c b/composite/compwindow.c -index 4e2494b86..b30da589e 100644 ---- a/composite/compwindow.c -+++ b/composite/compwindow.c -@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin) - ret = (*pScreen->DestroyWindow) (pWin); - cs->DestroyWindow = pScreen->DestroyWindow; - pScreen->DestroyWindow = compDestroyWindow; -+ -+ /* Did we just destroy the overlay window? */ -+ if (pWin == cs->pOverlayWin) -+ cs->pOverlayWin = NULL; -+ - /* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/ - return ret; - } --- -2.40.0 - diff --git a/0001-configure.ac-search-for-the-fontrootdir-ourselves.patch b/0001-configure.ac-search-for-the-fontrootdir-ourselves.patch deleted file mode 100644 index 3e29358..0000000 --- a/0001-configure.ac-search-for-the-fontrootdir-ourselves.patch +++ /dev/null @@ -1,72 +0,0 @@ -From e67e988730346c63d2f0cdf2531ed36b0c7ad5a6 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Wed, 23 Nov 2022 14:50:29 +1000 -Subject: [PATCH xserver] configure.ac: search for the fontrootdir ourselves - -This replaces the use of font-utils' .m4 macro set with a copy of the -only one we actually want: the bit for the fontrootpath. - -We don't need configure options for every single subfont directory, so -let's hardcode those in the default font path. Like meson does upstream -too. - -With this patch we no longer require the font-utils dependency. - -Signed-off-by: Peter Hutterer ---- - configure.ac | 28 +++++++++++++++++----------- - 1 file changed, 17 insertions(+), 11 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 0909cc5b4d..2349320888 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -49,9 +49,6 @@ XORG_WITH_XSLTPROC - XORG_ENABLE_UNIT_TESTS - XORG_LD_WRAP([optional]) - --m4_ifndef([XORG_FONT_MACROS_VERSION], [m4_fatal([must install font-util 1.1 or later before running autoconf/autogen])]) --XORG_FONT_MACROS_VERSION(1.1) -- - dnl this gets generated by autoheader, and thus contains all the defines. we - dnl don't ever actually use it, internally. - AC_CONFIG_HEADERS(include/do-not-use-config.h) -@@ -450,18 +447,27 @@ AC_MSG_RESULT([$FALLBACK_INPUT_DRIVER]) - AC_DEFINE_UNQUOTED(FALLBACK_INPUT_DRIVER, ["$FALLBACK_INPUT_DRIVER"], [ Fallback input driver ]) - - dnl Determine font path --XORG_FONTROOTDIR --XORG_FONTSUBDIR(FONTMISCDIR, fontmiscdir, misc) --XORG_FONTSUBDIR(FONTOTFDIR, fontotfdir, OTF) --XORG_FONTSUBDIR(FONTTTFDIR, fontttfdir, TTF) --XORG_FONTSUBDIR(FONTTYPE1DIR, fonttype1dir, Type1) --XORG_FONTSUBDIR(FONT75DPIDIR, font75dpidir, 75dpi) --XORG_FONTSUBDIR(FONT100DPIDIR, font100dpidir, 100dpi) -+dnl This is a copy of XORG_FONTROOTDIR from font-utils so we can drop the dependency -+AC_MSG_CHECKING([for root directory for font files]) -+AC_ARG_WITH(fontrootdir, -+ AS_HELP_STRING([--with-fontrootdir=DIR], -+ [Path to root directory for font files]), -+ [FONTROOTDIR="$withval"]) -+# if --with-fontrootdir not specified... -+if test "x${FONTROOTDIR}" = "x"; then -+ FONTROOTDIR=`$PKG_CONFIG --variable=fontrootdir fontutil` -+fi -+# ...and if pkg-config didn't find fontdir in fontutil.pc... -+if test "x${FONTROOTDIR}" = "x"; then -+ FONTROOTDIR="${datadir}/fonts/X11" -+fi -+AC_SUBST(FONTROOTDIR) -+AC_MSG_RESULT([${FONTROOTDIR}]) - - dnl Uses --with-default-font-path if set, otherwise uses standard - dnl subdirectories of FONTROOTDIR. Some distros set the default font path to - dnl "catalogue:/etc/X11/fontpath.d,built-ins" --DEFAULT_FONT_PATH="${FONTMISCDIR}/,${FONTTTFDIR}/,${FONTOTFDIR}/,${FONTTYPE1DIR}/,${FONT100DPIDIR}/,${FONT75DPIDIR}/" -+DEFAULT_FONT_PATH="${FONTROOTDIR}/misc,${FONTROOTDIR}/OTF,${FONTROOTDIR}/TTF,${FONTROOTDIR}/Type1,${FONTROOTDIR}/75dpi,${FONTROOTDIR}/100dpi" - case $host_os in - darwin*) DEFAULT_FONT_PATH="${DEFAULT_FONT_PATH},/Library/Fonts,/System/Library/Fonts" ;; - esac --- -2.38.1 - diff --git a/0001-dix-Fix-use-after-free-in-input-device-shutdown.patch b/0001-dix-Fix-use-after-free-in-input-device-shutdown.patch deleted file mode 100644 index c2d723f..0000000 --- a/0001-dix-Fix-use-after-free-in-input-device-shutdown.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 1801fe0ac3926882d47d7e1ad6c0518a2cdffd41 Mon Sep 17 00:00:00 2001 -From: Povilas Kanapickas -Date: Sun, 19 Dec 2021 18:11:07 +0200 -Subject: [PATCH] dix: Fix use after free in input device shutdown - -This fixes access to freed heap memory via dev->master. E.g. when -running BarrierNotify.ReceivesNotifyEvents/7 test from -xorg-integration-tests: - -==24736==ERROR: AddressSanitizer: heap-use-after-free on address -0x619000065020 at pc 0x55c450e2b9cf bp 0x7fffc532fd20 sp 0x7fffc532fd10 -READ of size 4 at 0x619000065020 thread T0 - #0 0x55c450e2b9ce in GetMaster ../../../dix/devices.c:2722 - #1 0x55c450e9d035 in IsFloating ../../../dix/events.c:346 - #2 0x55c4513209c6 in GetDeviceUse ../../../Xi/xiquerydevice.c:525 -../../../Xi/xichangehierarchy.c:95 - #4 0x55c450e3455c in RemoveDevice ../../../dix/devices.c:1204 -../../../hw/xfree86/common/xf86Xinput.c:1142 - #6 0x55c450e17b04 in CloseDeviceList ../../../dix/devices.c:1038 - #7 0x55c450e1de85 in CloseDownDevices ../../../dix/devices.c:1068 - #8 0x55c450e837ef in dix_main ../../../dix/main.c:302 - #9 0x55c4517a8d93 in main ../../../dix/stubmain.c:34 -(/lib/x86_64-linux-gnu/libc.so.6+0x28564) - #11 0x55c450d0113d in _start (/usr/lib/xorg/Xorg+0x117713d) - -0x619000065020 is located 160 bytes inside of 912-byte region -[0x619000064f80,0x619000065310) -freed by thread T0 here: -(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf) - #1 0x55c450e19f1c in CloseDevice ../../../dix/devices.c:1014 - #2 0x55c450e343a4 in RemoveDevice ../../../dix/devices.c:1186 -../../../hw/xfree86/common/xf86Xinput.c:1142 - #4 0x55c450e17b04 in CloseDeviceList ../../../dix/devices.c:1038 - #5 0x55c450e1de85 in CloseDownDevices ../../../dix/devices.c:1068 - #6 0x55c450e837ef in dix_main ../../../dix/main.c:302 - #7 0x55c4517a8d93 in main ../../../dix/stubmain.c:34 -(/lib/x86_64-linux-gnu/libc.so.6+0x28564) - -previously allocated by thread T0 here: -(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6) - #1 0x55c450e1c57b in AddInputDevice ../../../dix/devices.c:259 - #2 0x55c450e34840 in AllocDevicePair ../../../dix/devices.c:2755 - #3 0x55c45130318f in add_master ../../../Xi/xichangehierarchy.c:152 -../../../Xi/xichangehierarchy.c:465 - #5 0x55c4512cb9f5 in ProcIDispatch ../../../Xi/extinit.c:390 - #6 0x55c450e6a92b in Dispatch ../../../dix/dispatch.c:551 - #7 0x55c450e834b7 in dix_main ../../../dix/main.c:272 - #8 0x55c4517a8d93 in main ../../../dix/stubmain.c:34 -(/lib/x86_64-linux-gnu/libc.so.6+0x28564) - -The problem is caused by dev->master being not reset when disabling the -device, which then causes dangling pointer when the master device itself -is being deleted when exiting whole server. - -Note that RecalculateMasterButtons() requires dev->master to be still -valid, so we can reset it only at the end of function. - -Signed-off-by: Povilas Kanapickas ---- - dix/devices.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/dix/devices.c b/dix/devices.c -index e62c34c55..5f9ce1678 100644 ---- a/dix/devices.c -+++ b/dix/devices.c -@@ -520,6 +520,7 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent) - } - - RecalculateMasterButtons(dev); -+ dev->master = NULL; - - return TRUE; - } --- -2.43.0 - diff --git a/0001-dix-allocate-enough-space-for-logical-button-maps.patch b/0001-dix-allocate-enough-space-for-logical-button-maps.patch deleted file mode 100644 index e11eb0e..0000000 --- a/0001-dix-allocate-enough-space-for-logical-button-maps.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Thu, 14 Dec 2023 11:29:49 +1000 -Subject: [PATCH 1/9] dix: allocate enough space for logical button maps - -Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for -each logical button currently down. Since buttons can be arbitrarily mapped -to anything up to 255 make sure we have enough bits for the maximum mapping. - -CVE-2023-6816, ZDI-CAN-22664, ZDI-CAN-22665 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative ---- - Xi/xiquerypointer.c | 3 +-- - dix/enterleave.c | 5 +++-- - 2 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c -index 5b77b1a44..2b05ac5f3 100644 ---- a/Xi/xiquerypointer.c -+++ b/Xi/xiquerypointer.c -@@ -149,8 +149,7 @@ ProcXIQueryPointer(ClientPtr client) - if (pDev->button) { - int i; - -- rep.buttons_len = -- bytes_to_int32(bits_to_bytes(pDev->button->numButtons)); -+ rep.buttons_len = bytes_to_int32(bits_to_bytes(256)); /* button map up to 255 */ - rep.length += rep.buttons_len; - buttons = calloc(rep.buttons_len, 4); - if (!buttons) -diff --git a/dix/enterleave.c b/dix/enterleave.c -index 867ec7436..ded8679d7 100644 ---- a/dix/enterleave.c -+++ b/dix/enterleave.c -@@ -784,8 +784,9 @@ DeviceFocusEvent(DeviceIntPtr dev, int type, int mode, int detail, - - mouse = IsFloating(dev) ? dev : GetMaster(dev, MASTER_POINTER); - -- /* XI 2 event */ -- btlen = (mouse->button) ? bits_to_bytes(mouse->button->numButtons) : 0; -+ /* XI 2 event contains the logical button map - maps are CARD8 -+ * so we need 256 bits for the possibly maximum mapping */ -+ btlen = (mouse->button) ? bits_to_bytes(256) : 0; - btlen = bytes_to_int32(btlen); - len = sizeof(xXIFocusInEvent) + btlen * 4; - --- -2.43.0 - diff --git a/0001-dix-fix-valuator-copy-paste-error-in-the-DeviceState.patch b/0001-dix-fix-valuator-copy-paste-error-in-the-DeviceState.patch deleted file mode 100644 index 363af1f..0000000 --- a/0001-dix-fix-valuator-copy-paste-error-in-the-DeviceState.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 133e0d651c5d12bf01999d6289e84e224ba77adc Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Mon, 22 Jan 2024 14:22:12 +1000 -Subject: [PATCH] dix: fix valuator copy/paste error in the DeviceStateNotify - event - -Fixes 219c54b8a3337456ce5270ded6a67bcde53553d5 ---- - dix/enterleave.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/dix/enterleave.c b/dix/enterleave.c -index 7b7ba1098..c1e6ac600 100644 ---- a/dix/enterleave.c -+++ b/dix/enterleave.c -@@ -619,11 +619,11 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v, - ev->first_valuator = first; - switch (ev->num_valuators) { - case 6: -- ev->valuator2 = v->axisVal[first + 5]; -+ ev->valuator5 = v->axisVal[first + 5]; - case 5: -- ev->valuator2 = v->axisVal[first + 4]; -+ ev->valuator4 = v->axisVal[first + 4]; - case 4: -- ev->valuator2 = v->axisVal[first + 3]; -+ ev->valuator3 = v->axisVal[first + 3]; - case 3: - ev->valuator2 = v->axisVal[first + 2]; - case 2: --- -2.44.0 - diff --git a/0001-ephyr-Fix-incompatible-pointer-type-build-error.patch b/0001-ephyr-Fix-incompatible-pointer-type-build-error.patch deleted file mode 100644 index 345e660..0000000 --- a/0001-ephyr-Fix-incompatible-pointer-type-build-error.patch +++ /dev/null @@ -1,54 +0,0 @@ -From e89edec497bac581ca9b614fb00c25365580f045 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= -Date: Fri, 19 Jan 2024 13:05:51 +0100 -Subject: [PATCH] ephyr: Fix incompatible pointer type build error -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Fix a compilation error on 32 bits architectures with gcc 14: - - ephyr_glamor_xv.c: In function ‘ephyr_glamor_xv_init’: - ephyr_glamor_xv.c:154:31: error: assignment to ‘SetPortAttributeFuncPtr’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int, int, void *)’} from incompatible pointer type ‘int (*)(KdScreenInfo *, Atom, INT32, void *)’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int, long int, void *)’} [-Wincompatible-pointer-types] - 154 | adaptor->SetPortAttribute = ephyr_glamor_xv_set_port_attribute; - | ^ - ephyr_glamor_xv.c:155:31: error: assignment to ‘GetPortAttributeFuncPtr’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int, int *, void *)’} from incompatible pointer type ‘int (*)(KdScreenInfo *, Atom, INT32 *, void *)’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int, long int *, void *)’} [-Wincompatible-pointer-types] - 155 | adaptor->GetPortAttribute = ephyr_glamor_xv_get_port_attribute; - | ^ - -Build error logs: -https://koji.fedoraproject.org/koji/taskinfo?taskID=111964273 - -Signed-off-by: José Expósito ---- - hw/kdrive/ephyr/ephyr_glamor_xv.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/hw/kdrive/ephyr/ephyr_glamor_xv.c b/hw/kdrive/ephyr/ephyr_glamor_xv.c -index 4dd15cf41..b5eae48c8 100644 ---- a/hw/kdrive/ephyr/ephyr_glamor_xv.c -+++ b/hw/kdrive/ephyr/ephyr_glamor_xv.c -@@ -50,16 +50,16 @@ ephyr_glamor_xv_stop_video(KdScreenInfo *screen, void *data, Bool cleanup) - - static int - ephyr_glamor_xv_set_port_attribute(KdScreenInfo *screen, -- Atom attribute, INT32 value, void *data) -+ Atom attribute, int value, void *data) - { -- return glamor_xv_set_port_attribute(data, attribute, value); -+ return glamor_xv_set_port_attribute(data, attribute, (INT32)value); - } - - static int - ephyr_glamor_xv_get_port_attribute(KdScreenInfo *screen, -- Atom attribute, INT32 *value, void *data) -+ Atom attribute, int *value, void *data) - { -- return glamor_xv_get_port_attribute(data, attribute, value); -+ return glamor_xv_get_port_attribute(data, attribute, (INT32 *)value); - } - - static void --- -2.43.0 - diff --git a/0001-hw-Rename-boolean-config-value-field-from-bool-to-bo.patch b/0001-hw-Rename-boolean-config-value-field-from-bool-to-bo.patch deleted file mode 100644 index 52ea4d0..0000000 --- a/0001-hw-Rename-boolean-config-value-field-from-bool-to-bo.patch +++ /dev/null @@ -1,154 +0,0 @@ -From 454b3a826edb5fc6d0fea3a9cfd1a5e8fc568747 Mon Sep 17 00:00:00 2001 -From: Adam Jackson -Date: Mon, 22 Jul 2019 13:51:06 -0400 -Subject: [PATCH xserver] hw: Rename boolean config value field from bool to - boolean - -"bool" conflicts with C++ (meh) and stdbool.h (ngh alright fine). This -is a driver-visible change and will likely break the build for mach64, -but it can be fixed by simply using xf86ReturnOptValBool like every -other driver. - -Signed-off-by: Adam Jackson ---- - hw/xfree86/common/xf86Opt.h | 2 +- - hw/xfree86/common/xf86Option.c | 10 +++++----- - hw/xwin/winconfig.c | 22 +++++++++++----------- - hw/xwin/winconfig.h | 2 +- - 4 files changed, 18 insertions(+), 18 deletions(-) - -diff --git a/hw/xfree86/common/xf86Opt.h b/hw/xfree86/common/xf86Opt.h -index 3be2a0fc7..3046fbd41 100644 ---- a/hw/xfree86/common/xf86Opt.h -+++ b/hw/xfree86/common/xf86Opt.h -@@ -41,7 +41,7 @@ typedef union { - unsigned long num; - const char *str; - double realnum; -- Bool bool; -+ Bool boolean; - OptFrequency freq; - } ValueUnion; - -diff --git a/hw/xfree86/common/xf86Option.c b/hw/xfree86/common/xf86Option.c -index 06973bca3..ca538cc57 100644 ---- a/hw/xfree86/common/xf86Option.c -+++ b/hw/xfree86/common/xf86Option.c -@@ -213,7 +213,7 @@ LookupBoolOption(XF86OptionPtr optlist, const char *name, int deflt, - o.name = name; - o.type = OPTV_BOOLEAN; - if (ParseOptionValue(-1, optlist, &o, markUsed)) -- deflt = o.value.bool; -+ deflt = o.value.boolean; - return deflt; - } - -@@ -474,7 +474,7 @@ xf86ShowUnusedOptions(int scrnIndex, XF86OptionPtr opt) - static Bool - GetBoolValue(OptionInfoPtr p, const char *s) - { -- return xf86getBoolValue(&p->value.bool, s); -+ return xf86getBoolValue(&p->value.boolean, s); - } - - static Bool -@@ -678,7 +678,7 @@ ParseOptionValue(int scrnIndex, XF86OptionPtr options, OptionInfoPtr p, - if (markUsed) - xf86MarkOptionUsedByName(options, newn); - if (GetBoolValue(&opt, s)) { -- p->value.bool = !opt.value.bool; -+ p->value.boolean = !opt.value.boolean; - p->found = TRUE; - } - else { -@@ -869,7 +869,7 @@ xf86GetOptValBool(const OptionInfoRec * table, int token, Bool *value) - - p = xf86TokenToOptinfo(table, token); - if (p && p->found) { -- *value = p->value.bool; -+ *value = p->value.boolean; - return TRUE; - } - else -@@ -883,7 +883,7 @@ xf86ReturnOptValBool(const OptionInfoRec * table, int token, Bool def) - - p = xf86TokenToOptinfo(table, token); - if (p && p->found) { -- return p->value.bool; -+ return p->value.boolean; - } - else - return def; -diff --git a/hw/xwin/winconfig.c b/hw/xwin/winconfig.c -index 31894d2fb..646d69006 100644 ---- a/hw/xwin/winconfig.c -+++ b/hw/xwin/winconfig.c -@@ -623,7 +623,7 @@ winSetBoolOption(void *optlist, const char *name, int deflt) - o.name = name; - o.type = OPTV_BOOLEAN; - if (ParseOptionValue(-1, optlist, &o)) -- deflt = o.value.bool; -+ deflt = o.value.boolean; - return deflt; - } - -@@ -918,7 +918,7 @@ ParseOptionValue(int scrnIndex, void *options, OptionInfoPtr p) - } - if ((s = winFindOptionValue(options, newn)) != NULL) { - if (GetBoolValue(&opt, s)) { -- p->value.bool = !opt.value.bool; -+ p->value.boolean = !opt.value.boolean; - p->found = TRUE; - } - else { -@@ -968,25 +968,25 @@ static Bool - GetBoolValue(OptionInfoPtr p, const char *s) - { - if (*s == 0) { -- p->value.bool = TRUE; -+ p->value.boolean = TRUE; - } - else { - if (winNameCompare(s, "1") == 0) -- p->value.bool = TRUE; -+ p->value.boolean = TRUE; - else if (winNameCompare(s, "on") == 0) -- p->value.bool = TRUE; -+ p->value.boolean = TRUE; - else if (winNameCompare(s, "true") == 0) -- p->value.bool = TRUE; -+ p->value.boolean = TRUE; - else if (winNameCompare(s, "yes") == 0) -- p->value.bool = TRUE; -+ p->value.boolean = TRUE; - else if (winNameCompare(s, "0") == 0) -- p->value.bool = FALSE; -+ p->value.boolean = FALSE; - else if (winNameCompare(s, "off") == 0) -- p->value.bool = FALSE; -+ p->value.boolean = FALSE; - else if (winNameCompare(s, "false") == 0) -- p->value.bool = FALSE; -+ p->value.boolean = FALSE; - else if (winNameCompare(s, "no") == 0) -- p->value.bool = FALSE; -+ p->value.boolean = FALSE; - } - return TRUE; - } -diff --git a/hw/xwin/winconfig.h b/hw/xwin/winconfig.h -index f079368c7..bd1f59650 100644 ---- a/hw/xwin/winconfig.h -+++ b/hw/xwin/winconfig.h -@@ -199,7 +199,7 @@ typedef union { - unsigned long num; - char *str; - double realnum; -- Bool bool; -+ Bool boolean; - OptFrequency freq; - } ValueUnion; - --- -2.39.0 - diff --git a/0001-present-Check-for-NULL-to-prevent-crash.patch b/0001-present-Check-for-NULL-to-prevent-crash.patch deleted file mode 100644 index 894ad0e..0000000 --- a/0001-present-Check-for-NULL-to-prevent-crash.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 94b4a3d45451d29e9539ea234ce8b5e9ed58546c Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?B=C5=82a=C5=BCej=20Szczygie=C5=82?= -Date: Thu, 13 Jan 2022 00:47:27 +0100 -Subject: [PATCH xserver] present: Check for NULL to prevent crash -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1275 -Signed-off-by: Błażej Szczygieł -Tested-by: Aaron Plattner -(cherry picked from commit 22d5818851967408bb7c903cb345b7ca8766094c) ---- - present/present_scmd.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/present/present_scmd.c b/present/present_scmd.c -index 3c68e690b..11391adbb 100644 ---- a/present/present_scmd.c -+++ b/present/present_scmd.c -@@ -168,6 +168,9 @@ present_scmd_get_crtc(present_screen_priv_ptr screen_priv, WindowPtr window) - if (!screen_priv->info) - return NULL; - -+ if (!screen_priv->info->get_crtc) -+ return NULL; -+ - return (*screen_priv->info->get_crtc)(window); - } - -@@ -206,6 +209,9 @@ present_flush(WindowPtr window) - if (!screen_priv->info) - return; - -+ if (!screen_priv->info->flush) -+ return; -+ - (*screen_priv->info->flush) (window); - } - --- -2.34.1 - diff --git a/0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch b/0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch deleted file mode 100644 index d9eea48..0000000 --- a/0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch +++ /dev/null @@ -1,105 +0,0 @@ -From b98fc07d3442a289c6bef82df50dd0a2d01de71a Mon Sep 17 00:00:00 2001 -From: Adam Jackson -Date: Thu, 2 Feb 2023 12:26:27 -0500 -Subject: [PATCH xserver] present: Send a PresentConfigureNotify event for - destroyed windows -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This enables fixing a deadlock case on the client side, where the client -ends up blocked waiting for a Present event that will never come because -the window was destroyed. The new PresentWindowDestroyed flag allows the -client to avoid blocking indefinitely. - -Signed-off-by: Adam Jackson -See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/116 -See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6685 -Reviewed-by: Michel Dänzer -(cherry picked from commit 462b06033e66a32308d940eb5fc47f5e4c914dc0) ---- - present/present_event.c | 5 +++-- - present/present_priv.h | 7 ++++++- - present/present_screen.c | 11 ++++++++++- - 3 files changed, 19 insertions(+), 4 deletions(-) - -diff --git a/present/present_event.c b/present/present_event.c -index 435b26b70..849732dc8 100644 ---- a/present/present_event.c -+++ b/present/present_event.c -@@ -102,7 +102,8 @@ present_event_swap(xGenericEvent *from, xGenericEvent *to) - } - - void --present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling) -+present_send_config_notify(WindowPtr window, int x, int y, int w, int h, -+ int bw, WindowPtr sibling, CARD32 flags) - { - present_window_priv_ptr window_priv = present_window_priv(window); - -@@ -122,7 +123,7 @@ present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, - .off_y = 0, - .pixmap_width = w, - .pixmap_height = h, -- .pixmap_flags = 0 -+ .pixmap_flags = flags - }; - present_event_ptr event; - -diff --git a/present/present_priv.h b/present/present_priv.h -index 6ebd009a2..4ad729864 100644 ---- a/present/present_priv.h -+++ b/present/present_priv.h -@@ -43,6 +43,11 @@ - #define DebugPresent(x) - #endif - -+/* XXX this belongs in presentproto */ -+#ifndef PresentWindowDestroyed -+#define PresentWindowDestroyed (1 << 0) -+#endif -+ - extern int present_request; - - extern DevPrivateKeyRec present_screen_private_key; -@@ -307,7 +312,7 @@ void - present_free_events(WindowPtr window); - - void --present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling); -+present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling, CARD32 flags); - - void - present_send_complete_notify(WindowPtr window, CARD8 kind, CARD8 mode, CARD32 serial, uint64_t ust, uint64_t msc); -diff --git a/present/present_screen.c b/present/present_screen.c -index 15684eda4..2c29aafd2 100644 ---- a/present/present_screen.c -+++ b/present/present_screen.c -@@ -93,6 +93,15 @@ present_destroy_window(WindowPtr window) - present_screen_priv_ptr screen_priv = present_screen_priv(screen); - present_window_priv_ptr window_priv = present_window_priv(window); - -+ present_send_config_notify(window, -+ window->drawable.x, -+ window->drawable.y, -+ window->drawable.width, -+ window->drawable.height, -+ window->borderWidth, -+ window->nextSib, -+ PresentWindowDestroyed); -+ - if (window_priv) { - present_clear_window_notifies(window); - present_free_events(window); -@@ -123,7 +132,7 @@ present_config_notify(WindowPtr window, - ScreenPtr screen = window->drawable.pScreen; - present_screen_priv_ptr screen_priv = present_screen_priv(screen); - -- present_send_config_notify(window, x, y, w, h, bw, sibling); -+ present_send_config_notify(window, x, y, w, h, bw, sibling, 0); - - unwrap(screen_priv, screen, ConfigNotify); - if (screen->ConfigNotify) --- -2.40.0 - diff --git a/0001-randr-avoid-integer-truncation-in-length-check-of-Pr.patch b/0001-randr-avoid-integer-truncation-in-length-check-of-Pr.patch deleted file mode 100644 index d88a8d5..0000000 --- a/0001-randr-avoid-integer-truncation-in-length-check-of-Pr.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 58e83c683950ac9e253ab05dd7a13a8368b70a3c Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Mon, 27 Nov 2023 16:27:49 +1000 -Subject: [PATCH xserver] randr: avoid integer truncation in length check of - ProcRRChange*Property - -Affected are ProcRRChangeProviderProperty and ProcRRChangeOutputProperty. -See also xserver@8f454b79 where this same bug was fixed for the core -protocol and XI. - -This fixes an OOB read and the resulting information disclosure. - -Length calculation for the request was clipped to a 32-bit integer. With -the correct stuff->nUnits value the expected request size was -truncated, passing the REQUEST_FIXED_SIZE check. - -The server then proceeded with reading at least stuff->num_items bytes -(depending on stuff->format) from the request and stuffing whatever it -finds into the property. In the process it would also allocate at least -stuff->nUnits bytes, i.e. 4GB. - -CVE-2023-6478, ZDI-CAN-22561 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -(cherry picked from commit 14f480010a93ff962fef66a16412fafff81ad632) ---- - randr/rrproperty.c | 2 +- - randr/rrproviderproperty.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/randr/rrproperty.c b/randr/rrproperty.c -index 25469f57b2..c4fef8a1f6 100644 ---- a/randr/rrproperty.c -+++ b/randr/rrproperty.c -@@ -530,7 +530,7 @@ ProcRRChangeOutputProperty(ClientPtr client) - char format, mode; - unsigned long len; - int sizeInBytes; -- int totalSize; -+ uint64_t totalSize; - int err; - - REQUEST_AT_LEAST_SIZE(xRRChangeOutputPropertyReq); -diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c -index b79c17f9bf..90c5a9a933 100644 ---- a/randr/rrproviderproperty.c -+++ b/randr/rrproviderproperty.c -@@ -498,7 +498,7 @@ ProcRRChangeProviderProperty(ClientPtr client) - char format, mode; - unsigned long len; - int sizeInBytes; -- int totalSize; -+ uint64_t totalSize; - int err; - - REQUEST_AT_LEAST_SIZE(xRRChangeProviderPropertyReq); --- -2.43.0 - diff --git a/0001-render-Avoid-possible-double-free-in-ProcRenderAddGl.patch b/0001-render-Avoid-possible-double-free-in-ProcRenderAddGl.patch deleted file mode 100644 index 549f90a..0000000 --- a/0001-render-Avoid-possible-double-free-in-ProcRenderAddGl.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 337d8d48b618d4fc0168a7b978be4c3447650b04 Mon Sep 17 00:00:00 2001 -From: Olivier Fourdan -Date: Fri, 5 Apr 2024 15:24:49 +0200 -Subject: [PATCH] render: Avoid possible double-free in ProcRenderAddGlyphs() - -ProcRenderAddGlyphs() adds the glyph to the glyphset using AddGlyph() and -then frees it using FreeGlyph() to decrease the reference count, after -AddGlyph() has increased it. - -AddGlyph() however may chose to reuse an existing glyph if it's already -in the glyphSet, and free the glyph that was given, in which case the -caller function, ProcRenderAddGlyphs() will call FreeGlyph() on an -already freed glyph, as reported by ASan: - - READ of size 4 thread T0 - #0 in FreeGlyph xserver/render/glyph.c:252 - #1 in ProcRenderAddGlyphs xserver/render/render.c:1174 - #2 in Dispatch xserver/dix/dispatch.c:546 - #3 in dix_main xserver/dix/main.c:271 - #4 in main xserver/dix/stubmain.c:34 - #5 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 - #6 in __libc_start_main_impl ../csu/libc-start.c:360 - #7 (/usr/bin/Xwayland+0x44fe4) - Address is located 0 bytes inside of 64-byte region - freed by thread T0 here: - #0 in __interceptor_free libsanitizer/asan/asan_malloc_linux.cpp:52 - #1 in _dixFreeObjectWithPrivates xserver/dix/privates.c:538 - #2 in AddGlyph xserver/render/glyph.c:295 - #3 in ProcRenderAddGlyphs xserver/render/render.c:1173 - #4 in Dispatch xserver/dix/dispatch.c:546 - #5 in dix_main xserver/dix/main.c:271 - #6 in main xserver/dix/stubmain.c:34 - #7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 - previously allocated by thread T0 here: - #0 in __interceptor_malloc libsanitizer/asan/asan_malloc_linux.cpp:69 - #1 in AllocateGlyph xserver/render/glyph.c:355 - #2 in ProcRenderAddGlyphs xserver/render/render.c:1085 - #3 in Dispatch xserver/dix/dispatch.c:546 - #4 in dix_main xserver/dix/main.c:271 - #5 in main xserver/dix/stubmain.c:34 - #6 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 - SUMMARY: AddressSanitizer: heap-use-after-free xserver/render/glyph.c:252 in FreeGlyph - -To avoid that, make sure not to free the given glyph in AddGlyph(). - -v2: Simplify the test using the boolean returned from AddGlyph() (Michel) -v3: Simplify even more by not freeing the glyph in AddGlyph() (Peter) - -Fixes: bdca6c3d1 - render: fix refcounting of glyphs during ProcRenderAddGlyphs -Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1659 -Signed-off-by: Olivier Fourdan -Part-of: ---- - render/glyph.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/render/glyph.c b/render/glyph.c -index 13991f8a1..5fa7f3b5b 100644 ---- a/render/glyph.c -+++ b/render/glyph.c -@@ -291,8 +291,6 @@ AddGlyph(GlyphSetPtr glyphSet, GlyphPtr glyph, Glyph id) - gr = FindGlyphRef(&globalGlyphs[glyphSet->fdepth], signature, - TRUE, glyph->sha1); - if (gr->glyph && gr->glyph != DeletedGlyph && gr->glyph != glyph) { -- FreeGlyphPicture(glyph); -- dixFreeObjectWithPrivates(glyph, PRIVATE_GLYPH); - glyph = gr->glyph; - } - else if (gr->glyph != glyph) { --- -2.44.0 - diff --git a/0001-render-Fix-build-with-gcc-12.patch b/0001-render-Fix-build-with-gcc-12.patch deleted file mode 100644 index 22f2e5a..0000000 --- a/0001-render-Fix-build-with-gcc-12.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 53173fdab492f0f638f6616fcf01af0b9ea6338d Mon Sep 17 00:00:00 2001 -From: Olivier Fourdan -Date: Thu, 20 Jan 2022 10:20:38 +0100 -Subject: [PATCH xserver] render: Fix build with gcc 12 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The xserver fails to compile with the latest gcc 12: - - render/picture.c: In function ‘CreateSolidPicture’: - render/picture.c:874:26: error: array subscript ‘union _SourcePict[0]’ is partly outside array bounds of ‘unsigned char[16]’ [-Werror=array-bounds] - 874 | pPicture->pSourcePict->type = SourcePictTypeSolidFill; - | ^~ - render/picture.c:868:45: note: object of size 16 allocated by ‘malloc’ - 868 | pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictSolidFill)); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - render/picture.c: In function ‘CreateLinearGradientPicture’: - render/picture.c:906:26: error: array subscript ‘union _SourcePict[0]’ is partly outside array bounds of ‘unsigned char[32]’ [-Werror=array-bounds] - 906 | pPicture->pSourcePict->linear.type = SourcePictTypeLinear; - | ^~ - render/picture.c:899:45: note: object of size 32 allocated by ‘malloc’ - 899 | pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictLinearGradient)); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - render/picture.c: In function ‘CreateConicalGradientPicture’: - render/picture.c:989:26: error: array subscript ‘union _SourcePict[0]’ is partly outside array bounds of ‘unsigned char[32]’ [-Werror=array-bounds] - 989 | pPicture->pSourcePict->conical.type = SourcePictTypeConical; - | ^~ - render/picture.c:982:45: note: object of size 32 allocated by ‘malloc’ - 982 | pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictConicalGradient)); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - cc1: some warnings being treated as errors - ninja: build stopped: subcommand failed. - -This is because gcc 12 has become stricter and raises a warning now. - -Fix the warning/error by allocating enough memory to store the union -struct. - -Signed-off-by: Olivier Fourdan -Acked-by: Michel Dänzer -Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1256 -(cherry picked from commit c6b0dcb82d4db07a2f32c09a8c09c85a5f57248e) ---- - render/picture.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/render/picture.c b/render/picture.c -index afa0d258f..2be4b1954 100644 ---- a/render/picture.c -+++ b/render/picture.c -@@ -865,7 +865,7 @@ CreateSolidPicture(Picture pid, xRenderColor * color, int *error) - } - - pPicture->id = pid; -- pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictSolidFill)); -+ pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict)); - if (!pPicture->pSourcePict) { - *error = BadAlloc; - free(pPicture); -@@ -896,7 +896,7 @@ CreateLinearGradientPicture(Picture pid, xPointFixed * p1, xPointFixed * p2, - } - - pPicture->id = pid; -- pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictLinearGradient)); -+ pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict)); - if (!pPicture->pSourcePict) { - *error = BadAlloc; - free(pPicture); -@@ -936,7 +936,7 @@ CreateRadialGradientPicture(Picture pid, xPointFixed * inner, - } - - pPicture->id = pid; -- pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictRadialGradient)); -+ pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict)); - if (!pPicture->pSourcePict) { - *error = BadAlloc; - free(pPicture); -@@ -979,7 +979,7 @@ CreateConicalGradientPicture(Picture pid, xPointFixed * center, xFixed angle, - } - - pPicture->id = pid; -- pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictConicalGradient)); -+ pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict)); - if (!pPicture->pSourcePict) { - *error = BadAlloc; - free(pPicture); --- -2.34.1 - diff --git a/0001-xf86-Accept-devices-with-the-simpledrm-driver.patch b/0001-xf86-Accept-devices-with-the-simpledrm-driver.patch deleted file mode 100644 index 3dc5796..0000000 --- a/0001-xf86-Accept-devices-with-the-simpledrm-driver.patch +++ /dev/null @@ -1,34 +0,0 @@ -From b9218fadf3c09d83566549279d68886d8258f79c Mon Sep 17 00:00:00 2001 -From: nerdopolis -Date: Thu, 30 Sep 2021 08:51:18 -0400 -Subject: [PATCH] xf86: Accept devices with the 'simpledrm' driver. - -SimpleDRM 'devices' are a fallback device, and do not have a busid -so they are getting skipped. This will allow simpledrm to work -with the modesetting driver ---- - hw/xfree86/common/xf86platformBus.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/hw/xfree86/common/xf86platformBus.c b/hw/xfree86/common/xf86platformBus.c -index 0e0a995ac..45028f7a6 100644 ---- a/hw/xfree86/common/xf86platformBus.c -+++ b/hw/xfree86/common/xf86platformBus.c -@@ -557,8 +557,13 @@ xf86platformProbeDev(DriverPtr drvp) - } - else { - /* for non-seat0 servers assume first device is the master */ -- if (ServerIsNotSeat0()) -+ if (ServerIsNotSeat0()) { - break; -+ } else { -+ /* Accept the device if the driver is simpledrm */ -+ if (strcmp(xf86_platform_devices[j].attribs->driver, "simpledrm") == 0) -+ break; -+ } - - if (xf86IsPrimaryPlatform(&xf86_platform_devices[j])) - break; --- -2.35.1 - diff --git a/0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch b/0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch index cce0348..2134a44 100644 --- a/0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch +++ b/0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch @@ -52,7 +52,7 @@ index 6619e3aa7..1f8ad14bc 100644 /* For non-PCI devices and drmGetDevice fail, just assume that * the 3D driver is named the same as the kernel driver. This is * currently true for vc4 and msm (freedreno). -@@ -1456,12 +1460,14 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) +@@ -1454,12 +1458,14 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) xf86DrvMsg(pScreen->myNum, X_ERROR, "[DRI2] Couldn't drmGetVersion() on non-PCI device, " "no driver name found.\n"); @@ -70,7 +70,7 @@ index 6619e3aa7..1f8ad14bc 100644 } for (i = 0; driver_map[i].driver; i++) { -@@ -1469,13 +1475,15 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) +@@ -1467,13 +1473,15 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) continue; if (driver_map[i].num_chips_ids == -1) { @@ -88,7 +88,7 @@ index 6619e3aa7..1f8ad14bc 100644 goto out; } } -@@ -1487,9 +1495,9 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) +@@ -1485,9 +1493,9 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) dev->deviceinfo.pci->vendor_id, dev->deviceinfo.pci->device_id); out: drmFreeDevice(&dev); @@ -100,21 +100,21 @@ index 6619e3aa7..1f8ad14bc 100644 #endif } -@@ -1610,7 +1618,8 @@ DRI2ScreenInit(ScreenPtr pScreen, DRI2InfoPtr info) - if (info->driverName) { - ds->driverNames[0] = info->driverName; +@@ -1604,7 +1612,8 @@ DRI2ScreenInit(ScreenPtr pScreen, DRI2InfoPtr info) } else { + /* FIXME dri2_probe_driver_name() returns a strdup-ed string, + * currently this gets leaked */ - ds->driverNames[0] = ds->driverNames[1] = dri2_probe_driver_name(pScreen, info); + dri2_probe_driver_name(pScreen, info, + &ds->driverNames[0], &ds->driverNames[1]); if (!ds->driverNames[0]) return FALSE; - } + diff --git a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h index da7ea1c1e..7036d1003 100644 --- a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h +++ b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h -@@ -66,21 +66,22 @@ static const int vmwgfx_chip_ids[] = { +@@ -60,23 +60,24 @@ static const int vmwgfx_chip_ids[] = { static const struct { int vendor_id; const char *driver; @@ -124,8 +124,10 @@ index da7ea1c1e..7036d1003 100644 } driver_map[] = { - { 0x8086, "i915", i915_chip_ids, ARRAY_SIZE(i915_chip_ids) }, - { 0x8086, "i965", i965_chip_ids, ARRAY_SIZE(i965_chip_ids) }, +- { 0x8086, "i965", NULL, -1 }, + { 0x8086, "i915", "i915", i915_chip_ids, ARRAY_SIZE(i915_chip_ids) }, + { 0x8086, "i965", "va_gl", i965_chip_ids, ARRAY_SIZE(i965_chip_ids) }, ++ { 0x8086, "i965", "va_gl", NULL, -1 }, #ifndef DRIVER_MAP_GALLIUM_ONLY - { 0x1002, "radeon", r100_chip_ids, ARRAY_SIZE(r100_chip_ids) }, - { 0x1002, "r200", r200_chip_ids, ARRAY_SIZE(r200_chip_ids) }, @@ -134,19 +136,18 @@ index da7ea1c1e..7036d1003 100644 #endif - { 0x1002, "r300", r300_chip_ids, ARRAY_SIZE(r300_chip_ids) }, - { 0x1002, "r600", r600_chip_ids, ARRAY_SIZE(r600_chip_ids) }, -- { 0x1002, "radeonsi", radeonsi_chip_ids, ARRAY_SIZE(radeonsi_chip_ids) }, +- { 0x1002, "radeonsi", NULL, -1 }, - { 0x10de, "nouveau", NULL, -1 }, - { 0x1af4, "virtio_gpu", virtio_gpu_chip_ids, ARRAY_SIZE(virtio_gpu_chip_ids) }, - { 0x15ad, "vmwgfx", vmwgfx_chip_ids, ARRAY_SIZE(vmwgfx_chip_ids) }, +- { 0x0000, NULL, NULL, 0 }, + { 0x1002, "r300", "r300", r300_chip_ids, ARRAY_SIZE(r300_chip_ids) }, -+ { 0x1002, "r600","r600", r600_chip_ids, ARRAY_SIZE(r600_chip_ids) }, -+ { 0x1002, "radeonsi", "radeonsi", radeonsi_chip_ids, ARRAY_SIZE(radeonsi_chip_ids) }, ++ { 0x1002, "r600", "r600", r600_chip_ids, ARRAY_SIZE(r600_chip_ids) }, ++ { 0x1002, "radeonsi", "radeonsi", NULL, -1 }, + { 0x10de, "nouveau", "nouveau", NULL, -1 }, + { 0x1af4, "virtio_gpu", "virtio_gpu", virtio_gpu_chip_ids, ARRAY_SIZE(virtio_gpu_chip_ids) }, + { 0x15ad, "vmwgfx", "vmwgfx", vmwgfx_chip_ids, ARRAY_SIZE(vmwgfx_chip_ids) }, - { 0x0000, NULL, NULL, 0 }, ++ { 0x0000, NULL, NULL, NULL, 0 }, }; --- -2.19.0 - + #endif /* _PCI_ID_DRIVER_MAP_H_ */ diff --git a/0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch b/0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch deleted file mode 100644 index 6e5ebb5..0000000 --- a/0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 18f91b950e22c2a342a4fbc55e9ddf7534a707d2 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Wed, 13 Jul 2022 11:23:09 +1000 -Subject: [PATCH xserver] xkb: fix some possible memleaks in XkbGetKbdByName - -GetComponentByName returns an allocated string, so let's free that if we -fail somewhere. - -Signed-off-by: Peter Hutterer ---- - xkb/xkb.c | 26 ++++++++++++++++++++------ - 1 file changed, 20 insertions(+), 6 deletions(-) - -diff --git a/xkb/xkb.c b/xkb/xkb.c -index 4692895db..b79a269e3 100644 ---- a/xkb/xkb.c -+++ b/xkb/xkb.c -@@ -5935,18 +5935,32 @@ ProcXkbGetKbdByName(ClientPtr client) - xkb = dev->key->xkbInfo->desc; - status = Success; - str = (unsigned char *) &stuff[1]; -- if (GetComponentSpec(&str, TRUE, &status)) /* keymap, unsupported */ -- return BadMatch; -+ { -+ char *keymap = GetComponentSpec(&str, TRUE, &status); /* keymap, unsupported */ -+ if (keymap) { -+ free(keymap); -+ return BadMatch; -+ } -+ } - names.keycodes = GetComponentSpec(&str, TRUE, &status); - names.types = GetComponentSpec(&str, TRUE, &status); - names.compat = GetComponentSpec(&str, TRUE, &status); - names.symbols = GetComponentSpec(&str, TRUE, &status); - names.geometry = GetComponentSpec(&str, TRUE, &status); -- if (status != Success) -+ if (status == Success) { -+ len = str - ((unsigned char *) stuff); -+ if ((XkbPaddedSize(len) / 4) != stuff->length) -+ status = BadLength; -+ } -+ -+ if (status != Success) { -+ free(names.keycodes); -+ free(names.types); -+ free(names.compat); -+ free(names.symbols); -+ free(names.geometry); - return status; -- len = str - ((unsigned char *) stuff); -- if ((XkbPaddedSize(len) / 4) != stuff->length) -- return BadLength; -+ } - - CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask); - CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask); --- -2.38.1 - diff --git a/0001-xkb-proof-GetCountedString-against-request-length-at.patch b/0001-xkb-proof-GetCountedString-against-request-length-at.patch deleted file mode 100644 index d358a32..0000000 --- a/0001-xkb-proof-GetCountedString-against-request-length-at.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 11beef0b7f1ed290348e45618e5fa0d2bffcb72e Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 5 Jul 2022 12:06:20 +1000 -Subject: [PATCH xserver] xkb: proof GetCountedString against request length - attacks - -GetCountedString did a check for the whole string to be within the -request buffer but not for the initial 2 bytes that contain the length -field. A swapped client could send a malformed request to trigger a -swaps() on those bytes, writing into random memory. - -Signed-off-by: Peter Hutterer ---- - xkb/xkb.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/xkb/xkb.c b/xkb/xkb.c -index f42f59ef3..1841cff26 100644 ---- a/xkb/xkb.c -+++ b/xkb/xkb.c -@@ -5137,6 +5137,11 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str) - CARD16 len; - - wire = *wire_inout; -+ -+ if (client->req_len < -+ bytes_to_int32(wire + 2 - (char *) client->requestBuffer)) -+ return BadValue; -+ - len = *(CARD16 *) wire; - if (client->swapped) { - swaps(&len); --- -2.38.1 - diff --git a/0001-xkb-switch-to-array-index-loops-to-moving-pointers.patch b/0001-xkb-switch-to-array-index-loops-to-moving-pointers.patch deleted file mode 100644 index a4efb7a..0000000 --- a/0001-xkb-switch-to-array-index-loops-to-moving-pointers.patch +++ /dev/null @@ -1,76 +0,0 @@ -From f1070c01d616c5f21f939d5ebc533738779451ac Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 5 Jul 2022 12:40:47 +1000 -Subject: [PATCH xserver 1/3] xkb: switch to array index loops to moving - pointers - -Most similar loops here use a pointer that advances with each loop -iteration, let's do the same here for consistency. - -No functional changes. - -Signed-off-by: Peter Hutterer -Reviewed-by: Olivier Fourdan ---- - xkb/xkb.c | 20 ++++++++++---------- - 1 file changed, 10 insertions(+), 10 deletions(-) - -diff --git a/xkb/xkb.c b/xkb/xkb.c -index a29262c24..64e52611e 100644 ---- a/xkb/xkb.c -+++ b/xkb/xkb.c -@@ -5368,16 +5368,16 @@ _CheckSetSections(XkbGeometryPtr geom, - row->left = rWire->left; - row->vertical = rWire->vertical; - kWire = (xkbKeyWireDesc *) &rWire[1]; -- for (k = 0; k < rWire->nKeys; k++) { -+ for (k = 0; k < rWire->nKeys; k++, kWire++) { - XkbKeyPtr key; - - key = XkbAddGeomKey(row); - if (!key) - return BadAlloc; -- memcpy(key->name.name, kWire[k].name, XkbKeyNameLength); -- key->gap = kWire[k].gap; -- key->shape_ndx = kWire[k].shapeNdx; -- key->color_ndx = kWire[k].colorNdx; -+ memcpy(key->name.name, kWire->name, XkbKeyNameLength); -+ key->gap = kWire->gap; -+ key->shape_ndx = kWire->shapeNdx; -+ key->color_ndx = kWire->colorNdx; - if (key->shape_ndx >= geom->num_shapes) { - client->errorValue = _XkbErrCode3(0x10, key->shape_ndx, - geom->num_shapes); -@@ -5389,7 +5389,7 @@ _CheckSetSections(XkbGeometryPtr geom, - return BadMatch; - } - } -- rWire = (xkbRowWireDesc *) &kWire[rWire->nKeys]; -+ rWire = (xkbRowWireDesc *)kWire; - } - wire = (char *) rWire; - if (sWire->nDoodads > 0) { -@@ -5454,16 +5454,16 @@ _CheckSetShapes(XkbGeometryPtr geom, - return BadAlloc; - ol->corner_radius = olWire->cornerRadius; - ptWire = (xkbPointWireDesc *) &olWire[1]; -- for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++) { -- pt->x = ptWire[p].x; -- pt->y = ptWire[p].y; -+ for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++, ptWire++) { -+ pt->x = ptWire->x; -+ pt->y = ptWire->y; - if (client->swapped) { - swaps(&pt->x); - swaps(&pt->y); - } - } - ol->num_points = olWire->nPoints; -- olWire = (xkbOutlineWireDesc *) (&ptWire[olWire->nPoints]); -+ olWire = (xkbOutlineWireDesc *)ptWire; - } - if (shapeWire->primaryNdx != XkbNoShape) - shape->primary = &shape->outlines[shapeWire->primaryNdx]; --- -2.36.1 - diff --git a/0002-Xi-ProcXIPassiveGrabDevice-needs-to-use-unswapped-le.patch b/0002-Xi-ProcXIPassiveGrabDevice-needs-to-use-unswapped-le.patch deleted file mode 100644 index 4e061f7..0000000 --- a/0002-Xi-ProcXIPassiveGrabDevice-needs-to-use-unswapped-le.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 3e77295f888c67fc7645db5d0c00926a29ffecee Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith -Date: Fri, 22 Mar 2024 18:56:27 -0700 -Subject: [PATCH 2/4] Xi: ProcXIPassiveGrabDevice needs to use unswapped length - to send reply - -CVE-2024-31081 - -Fixes: d220d6907 ("Xi: add GrabButton and GrabKeysym code.") -Signed-off-by: Alan Coopersmith -Part-of: ---- - Xi/xipassivegrab.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c -index c9ac2f855..896233bec 100644 ---- a/Xi/xipassivegrab.c -+++ b/Xi/xipassivegrab.c -@@ -93,6 +93,7 @@ ProcXIPassiveGrabDevice(ClientPtr client) - GrabParameters param; - void *tmp; - int mask_len; -+ uint32_t length; - - REQUEST(xXIPassiveGrabDeviceReq); - REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq, -@@ -247,9 +248,11 @@ ProcXIPassiveGrabDevice(ClientPtr client) - } - } - -+ /* save the value before SRepXIPassiveGrabDevice swaps it */ -+ length = rep.length; - WriteReplyToClient(client, sizeof(rep), &rep); - if (rep.num_modifiers) -- WriteToClient(client, rep.length * 4, modifiers_failed); -+ WriteToClient(client, length * 4, modifiers_failed); - - out: - free(modifiers_failed); --- -2.44.0 - diff --git a/0002-Xi-return-an-error-from-XI-property-changes-if-verif.patch b/0002-Xi-return-an-error-from-XI-property-changes-if-verif.patch deleted file mode 100644 index 72bcadb..0000000 --- a/0002-Xi-return-an-error-from-XI-property-changes-if-verif.patch +++ /dev/null @@ -1,41 +0,0 @@ -From c5ff57676698f19ed3a1402aef58a15552e32d27 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 29 Nov 2022 13:24:00 +1000 -Subject: [PATCH xserver 2/7] Xi: return an error from XI property changes if - verification failed - -Both ProcXChangeDeviceProperty and ProcXIChangeProperty checked the -property for validity but didn't actually return the potential error. - -Signed-off-by: Peter Hutterer -Acked-by: Olivier Fourdan ---- - Xi/xiproperty.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c -index a36f7d61df..68c362c628 100644 ---- a/Xi/xiproperty.c -+++ b/Xi/xiproperty.c -@@ -902,6 +902,8 @@ ProcXChangeDeviceProperty(ClientPtr client) - - rc = check_change_property(client, stuff->property, stuff->type, - stuff->format, stuff->mode, stuff->nUnits); -+ if (rc != Success) -+ return rc; - - len = stuff->nUnits; - if (len > (bytes_to_int32(0xffffffff - sizeof(xChangeDevicePropertyReq)))) -@@ -1141,6 +1143,9 @@ ProcXIChangeProperty(ClientPtr client) - - rc = check_change_property(client, stuff->property, stuff->type, - stuff->format, stuff->mode, stuff->num_items); -+ if (rc != Success) -+ return rc; -+ - len = stuff->num_items; - if (len > bytes_to_int32(0xffffffff - sizeof(xXIChangePropertyReq))) - return BadLength; --- -2.38.1 - diff --git a/0002-dix-Allocate-sufficient-xEvents-for-our-DeviceStateN.patch b/0002-dix-Allocate-sufficient-xEvents-for-our-DeviceStateN.patch deleted file mode 100644 index 21c5622..0000000 --- a/0002-dix-Allocate-sufficient-xEvents-for-our-DeviceStateN.patch +++ /dev/null @@ -1,84 +0,0 @@ -From ece23be888a93b741aa1209d1dbf64636109d6a5 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Mon, 18 Dec 2023 14:27:50 +1000 -Subject: [PATCH 2/9] dix: Allocate sufficient xEvents for our - DeviceStateNotify - -If a device has both a button class and a key class and numButtons is -zero, we can get an OOB write due to event under-allocation. - -This function seems to assume a device has either keys or buttons, not -both. It has two virtually identical code paths, both of which assume -they're applying to the first event in the sequence. - -A device with both a key and button class triggered a logic bug - only -one xEvent was allocated but the deviceStateNotify pointer was pushed on -once per type. So effectively this logic code: - - int count = 1; - if (button && nbuttons > 32) count++; - if (key && nbuttons > 0) count++; - if (key && nkeys > 32) count++; // this is basically always true - // count is at 2 for our keys + zero button device - - ev = alloc(count * sizeof(xEvent)); - FixDeviceStateNotify(ev); - if (button) - FixDeviceStateNotify(ev++); - if (key) - FixDeviceStateNotify(ev++); // santa drops into the wrong chimney here - -If the device has more than 3 valuators, the OOB is pushed back - we're -off by one so it will happen when the last deviceValuator event is -written instead. - -Fix this by allocating the maximum number of events we may allocate. -Note that the current behavior is not protocol-correct anyway, this -patch fixes only the allocation issue. - -Note that this issue does not trigger if the device has at least one -button. While the server does not prevent a button class with zero -buttons, it is very unlikely. - -CVE-2024-0229, ZDI-CAN-22678 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative ---- - dix/enterleave.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/dix/enterleave.c b/dix/enterleave.c -index ded8679d7..17964b00a 100644 ---- a/dix/enterleave.c -+++ b/dix/enterleave.c -@@ -675,7 +675,8 @@ static void - DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) - { - int evcount = 1; -- deviceStateNotify *ev, *sev; -+ deviceStateNotify sev[6 + (MAX_VALUATORS + 2)/3]; -+ deviceStateNotify *ev; - deviceKeyStateNotify *kev; - deviceButtonStateNotify *bev; - -@@ -714,7 +715,7 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) - } - } - -- sev = ev = xallocarray(evcount, sizeof(xEvent)); -+ ev = sev; - FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first); - - if (b != NULL) { -@@ -770,7 +771,6 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) - - DeliverEventsToWindow(dev, win, (xEvent *) sev, evcount, - DeviceStateNotifyMask, NullGrab); -- free(sev); - } - - void --- -2.43.0 - diff --git a/0002-mi-reset-the-PointerWindows-reference-on-screen-swit.patch b/0002-mi-reset-the-PointerWindows-reference-on-screen-swit.patch deleted file mode 100644 index cbe9804..0000000 --- a/0002-mi-reset-the-PointerWindows-reference-on-screen-swit.patch +++ /dev/null @@ -1,99 +0,0 @@ -From 004f461c440cb6611eefb48fbbb4fa53a6d49f80 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Thu, 5 Oct 2023 12:19:45 +1000 -Subject: [PATCH xserver 2/4] mi: reset the PointerWindows reference on screen - switch - -PointerWindows[] keeps a reference to the last window our sprite -entered - changes are usually handled by CheckMotion(). - -If we switch between screens via XWarpPointer our -dev->spriteInfo->sprite->win is set to the new screen's root window. -If there's another window at the cursor location CheckMotion() will -trigger the right enter/leave events later. If there is not, it skips -that process and we never trigger LeaveWindow() - PointerWindows[] for -the device still refers to the previous window. - -If that window is destroyed we have a dangling reference that will -eventually cause a use-after-free bug when checking the window hierarchy -later. - -To trigger this, we require: -- two protocol screens -- XWarpPointer to the other screen's root window -- XDestroyWindow before entering any other window - -This is a niche bug so we hack around it by making sure we reset the -PointerWindows[] entry so we cannot have a dangling pointer. This -doesn't handle Enter/Leave events correctly but the previous code didn't -either. - -CVE-2023-5380, ZDI-CAN-21608 - -This vulnerability was discovered by: -Sri working with Trend Micro Zero Day Initiative - -Signed-off-by: Peter Hutterer -Reviewed-by: Adam Jackson ---- - dix/enterleave.h | 2 -- - include/eventstr.h | 3 +++ - mi/mipointer.c | 17 +++++++++++++++-- - 3 files changed, 18 insertions(+), 4 deletions(-) - -diff --git a/dix/enterleave.h b/dix/enterleave.h -index 4b833d8a3b..e8af924c68 100644 ---- a/dix/enterleave.h -+++ b/dix/enterleave.h -@@ -58,8 +58,6 @@ extern void DeviceFocusEvent(DeviceIntPtr dev, - - extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode); - --extern void LeaveWindow(DeviceIntPtr dev); -- - extern void CoreFocusEvent(DeviceIntPtr kbd, - int type, int mode, int detail, WindowPtr pWin); - -diff --git a/include/eventstr.h b/include/eventstr.h -index bf3b95fe4a..2bae3b0767 100644 ---- a/include/eventstr.h -+++ b/include/eventstr.h -@@ -296,4 +296,7 @@ union _InternalEvent { - #endif - }; - -+extern void -+LeaveWindow(DeviceIntPtr dev); -+ - #endif -diff --git a/mi/mipointer.c b/mi/mipointer.c -index 75be1aeeb8..b12ae9be1d 100644 ---- a/mi/mipointer.c -+++ b/mi/mipointer.c -@@ -397,8 +397,21 @@ miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y) - #ifdef PANORAMIX - && noPanoramiXExtension - #endif -- ) -- UpdateSpriteForScreen(pDev, pScreen); -+ ) { -+ DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER); -+ /* Hack for CVE-2023-5380: if we're moving -+ * screens PointerWindows[] keeps referring to the -+ * old window. If that gets destroyed we have a UAF -+ * bug later. Only happens when jumping from a window -+ * to the root window on the other screen. -+ * Enter/Leave events are incorrect for that case but -+ * too niche to fix. -+ */ -+ LeaveWindow(pDev); -+ if (master) -+ LeaveWindow(master); -+ UpdateSpriteForScreen(pDev, pScreen); -+ } - } - - /** --- -2.41.0 - diff --git a/0002-xkb-swap-XkbSetDeviceInfo-and-XkbSetDeviceInfoCheck.patch b/0002-xkb-swap-XkbSetDeviceInfo-and-XkbSetDeviceInfoCheck.patch deleted file mode 100644 index 8973a0e..0000000 --- a/0002-xkb-swap-XkbSetDeviceInfo-and-XkbSetDeviceInfoCheck.patch +++ /dev/null @@ -1,179 +0,0 @@ -From dd8caf39e9e15d8f302e54045dd08d8ebf1025dc Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 5 Jul 2022 09:50:41 +1000 -Subject: [PATCH xserver 2/3] xkb: swap XkbSetDeviceInfo and - XkbSetDeviceInfoCheck - -XKB often uses a FooCheck and Foo function pair, the former is supposed -to check all values in the request and error out on BadLength, -BadValue, etc. The latter is then called once we're confident the values -are good (they may still fail on an individual device, but that's a -different topic). - -In the case of XkbSetDeviceInfo, those functions were incorrectly -named, with XkbSetDeviceInfo ending up as the checker function and -XkbSetDeviceInfoCheck as the setter function. As a result, the setter -function was called before the checker function, accessing request -data and modifying device state before we ensured that the data is -valid. - -In particular, the setter function relied on values being already -byte-swapped. This in turn could lead to potential OOB memory access. - -Fix this by correctly naming the functions and moving the length checks -over to the checker function. These were added in 87c64fc5b0 to the -wrong function, probably due to the incorrect naming. - -Fixes ZDI-CAN 16070, CVE-2022-2320. - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Introduced in c06e27b2f6fd9f7b9f827623a48876a225264132 - -Signed-off-by: Peter Hutterer ---- - xkb/xkb.c | 46 +++++++++++++++++++++++++--------------------- - 1 file changed, 25 insertions(+), 21 deletions(-) - -diff --git a/xkb/xkb.c b/xkb/xkb.c -index 64e52611e..34b2c290b 100644 ---- a/xkb/xkb.c -+++ b/xkb/xkb.c -@@ -6550,7 +6550,8 @@ ProcXkbGetDeviceInfo(ClientPtr client) - static char * - CheckSetDeviceIndicators(char *wire, - DeviceIntPtr dev, -- int num, int *status_rtrn, ClientPtr client) -+ int num, int *status_rtrn, ClientPtr client, -+ xkbSetDeviceInfoReq * stuff) - { - xkbDeviceLedsWireDesc *ledWire; - int i; -@@ -6558,6 +6559,11 @@ CheckSetDeviceIndicators(char *wire, - - ledWire = (xkbDeviceLedsWireDesc *) wire; - for (i = 0; i < num; i++) { -+ if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) { -+ *status_rtrn = BadLength; -+ return (char *) ledWire; -+ } -+ - if (client->swapped) { - swaps(&ledWire->ledClass); - swaps(&ledWire->ledID); -@@ -6585,6 +6591,11 @@ CheckSetDeviceIndicators(char *wire, - atomWire = (CARD32 *) &ledWire[1]; - if (nNames > 0) { - for (n = 0; n < nNames; n++) { -+ if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) { -+ *status_rtrn = BadLength; -+ return (char *) atomWire; -+ } -+ - if (client->swapped) { - swapl(atomWire); - } -@@ -6596,6 +6607,10 @@ CheckSetDeviceIndicators(char *wire, - mapWire = (xkbIndicatorMapWireDesc *) atomWire; - if (nMaps > 0) { - for (n = 0; n < nMaps; n++) { -+ if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) { -+ *status_rtrn = BadLength; -+ return (char *) mapWire; -+ } - if (client->swapped) { - swaps(&mapWire->virtualMods); - swapl(&mapWire->ctrls); -@@ -6647,11 +6662,6 @@ SetDeviceIndicators(char *wire, - xkbIndicatorMapWireDesc *mapWire; - XkbSrvLedInfoPtr sli; - -- if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) { -- *status_rtrn = BadLength; -- return (char *) ledWire; -- } -- - namec = mapc = statec = 0; - sli = XkbFindSrvLedInfo(dev, ledWire->ledClass, ledWire->ledID, - XkbXI_IndicatorMapsMask); -@@ -6670,10 +6680,6 @@ SetDeviceIndicators(char *wire, - memset((char *) sli->names, 0, XkbNumIndicators * sizeof(Atom)); - for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) { - if (ledWire->namesPresent & bit) { -- if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) { -- *status_rtrn = BadLength; -- return (char *) atomWire; -- } - sli->names[n] = (Atom) *atomWire; - if (sli->names[n] == None) - ledWire->namesPresent &= ~bit; -@@ -6691,10 +6697,6 @@ SetDeviceIndicators(char *wire, - if (ledWire->mapsPresent) { - for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) { - if (ledWire->mapsPresent & bit) { -- if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) { -- *status_rtrn = BadLength; -- return (char *) mapWire; -- } - sli->maps[n].flags = mapWire->flags; - sli->maps[n].which_groups = mapWire->whichGroups; - sli->maps[n].groups = mapWire->groups; -@@ -6730,13 +6732,17 @@ SetDeviceIndicators(char *wire, - } - - static int --_XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev, -+_XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev, - xkbSetDeviceInfoReq * stuff) - { - char *wire; - - wire = (char *) &stuff[1]; - if (stuff->change & XkbXI_ButtonActionsMask) { -+ int sz = stuff->nBtns * SIZEOF(xkbActionWireDesc); -+ if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz)) -+ return BadLength; -+ - if (!dev->button) { - client->errorValue = _XkbErrCode2(XkbErr_BadClass, ButtonClass); - return XkbKeyboardErrorCode; -@@ -6747,13 +6753,13 @@ _XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev, - dev->button->numButtons); - return BadMatch; - } -- wire += (stuff->nBtns * SIZEOF(xkbActionWireDesc)); -+ wire += sz; - } - if (stuff->change & XkbXI_IndicatorsMask) { - int status = Success; - - wire = CheckSetDeviceIndicators(wire, dev, stuff->nDeviceLedFBs, -- &status, client); -+ &status, client, stuff); - if (status != Success) - return status; - } -@@ -6764,8 +6770,8 @@ _XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev, - } - - static int --_XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev, -- xkbSetDeviceInfoReq * stuff) -+_XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev, -+ xkbSetDeviceInfoReq * stuff) - { - char *wire; - xkbExtensionDeviceNotify ed; -@@ -6789,8 +6795,6 @@ _XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev, - if (stuff->firstBtn + stuff->nBtns > nBtns) - return BadValue; - sz = stuff->nBtns * SIZEOF(xkbActionWireDesc); -- if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz)) -- return BadLength; - memcpy((char *) &acts[stuff->firstBtn], (char *) wire, sz); - wire += sz; - ed.reason |= XkbXI_ButtonActionsMask; --- -2.36.1 - diff --git a/0003-Xi-avoid-integer-truncation-in-length-check-of-ProcX.patch b/0003-Xi-avoid-integer-truncation-in-length-check-of-ProcX.patch deleted file mode 100644 index d3c6541..0000000 --- a/0003-Xi-avoid-integer-truncation-in-length-check-of-ProcX.patch +++ /dev/null @@ -1,71 +0,0 @@ -From f9c435822c852659e3926502829f1b13ce6efc37 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 29 Nov 2022 13:26:57 +1000 -Subject: [PATCH xserver 3/7] Xi: avoid integer truncation in length check of - ProcXIChangeProperty - -This fixes an OOB read and the resulting information disclosure. - -Length calculation for the request was clipped to a 32-bit integer. With -the correct stuff->num_items value the expected request size was -truncated, passing the REQUEST_FIXED_SIZE check. - -The server then proceeded with reading at least stuff->num_items bytes -(depending on stuff->format) from the request and stuffing whatever it -finds into the property. In the process it would also allocate at least -stuff->num_items bytes, i.e. 4GB. - -The same bug exists in ProcChangeProperty and ProcXChangeDeviceProperty, -so let's fix that too. - -CVE-2022-46344, ZDI-CAN 19405 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Signed-off-by: Peter Hutterer -Acked-by: Olivier Fourdan ---- - Xi/xiproperty.c | 4 ++-- - dix/property.c | 3 ++- - 2 files changed, 4 insertions(+), 3 deletions(-) - -diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c -index 68c362c628..066ba21fba 100644 ---- a/Xi/xiproperty.c -+++ b/Xi/xiproperty.c -@@ -890,7 +890,7 @@ ProcXChangeDeviceProperty(ClientPtr client) - REQUEST(xChangeDevicePropertyReq); - DeviceIntPtr dev; - unsigned long len; -- int totalSize; -+ uint64_t totalSize; - int rc; - - REQUEST_AT_LEAST_SIZE(xChangeDevicePropertyReq); -@@ -1130,7 +1130,7 @@ ProcXIChangeProperty(ClientPtr client) - { - int rc; - DeviceIntPtr dev; -- int totalSize; -+ uint64_t totalSize; - unsigned long len; - - REQUEST(xXIChangePropertyReq); -diff --git a/dix/property.c b/dix/property.c -index 94ef5a0ec0..acce94b2c6 100644 ---- a/dix/property.c -+++ b/dix/property.c -@@ -205,7 +205,8 @@ ProcChangeProperty(ClientPtr client) - WindowPtr pWin; - char format, mode; - unsigned long len; -- int sizeInBytes, totalSize, err; -+ int sizeInBytes, err; -+ uint64_t totalSize; - - REQUEST(xChangePropertyReq); - --- -2.38.1 - diff --git a/0003-Xquartz-ProcAppleDRICreatePixmap-needs-to-use-unswap.patch b/0003-Xquartz-ProcAppleDRICreatePixmap-needs-to-use-unswap.patch deleted file mode 100644 index df0a498..0000000 --- a/0003-Xquartz-ProcAppleDRICreatePixmap-needs-to-use-unswap.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 6c684d035c06fd41c727f0ef0744517580864cef Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith -Date: Fri, 22 Mar 2024 19:07:34 -0700 -Subject: [PATCH 3/4] Xquartz: ProcAppleDRICreatePixmap needs to use unswapped - length to send reply - -CVE-2024-31082 - -Fixes: 14205ade0 ("XQuartz: appledri: Fix byte swapping in replies") -Signed-off-by: Alan Coopersmith -Part-of: ---- - hw/xquartz/xpr/appledri.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/hw/xquartz/xpr/appledri.c b/hw/xquartz/xpr/appledri.c -index 77574655b..40422b61a 100644 ---- a/hw/xquartz/xpr/appledri.c -+++ b/hw/xquartz/xpr/appledri.c -@@ -272,6 +272,7 @@ ProcAppleDRICreatePixmap(ClientPtr client) - xAppleDRICreatePixmapReply rep; - int width, height, pitch, bpp; - void *ptr; -+ CARD32 stringLength; - - REQUEST_SIZE_MATCH(xAppleDRICreatePixmapReq); - -@@ -307,6 +308,7 @@ ProcAppleDRICreatePixmap(ClientPtr client) - if (sizeof(rep) != sz_xAppleDRICreatePixmapReply) - ErrorF("error sizeof(rep) is %zu\n", sizeof(rep)); - -+ stringLength = rep.stringLength; /* save unswapped value */ - if (client->swapped) { - swaps(&rep.sequenceNumber); - swapl(&rep.length); -@@ -319,7 +321,7 @@ ProcAppleDRICreatePixmap(ClientPtr client) - } - - WriteToClient(client, sizeof(rep), &rep); -- WriteToClient(client, rep.stringLength, path); -+ WriteToClient(client, stringLength, path); - - return Success; - } --- -2.44.0 - diff --git a/0003-dix-fix-DeviceStateNotify-event-calculation.patch b/0003-dix-fix-DeviceStateNotify-event-calculation.patch deleted file mode 100644 index 2fe2f8e..0000000 --- a/0003-dix-fix-DeviceStateNotify-event-calculation.patch +++ /dev/null @@ -1,217 +0,0 @@ -From 219c54b8a3337456ce5270ded6a67bcde53553d5 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Mon, 18 Dec 2023 12:26:20 +1000 -Subject: [PATCH 3/9] dix: fix DeviceStateNotify event calculation - -The previous code only made sense if one considers buttons and keys to -be mutually exclusive on a device. That is not necessarily true, causing -a number of issues. - -This function allocates and fills in the number of xEvents we need to -send the device state down the wire. This is split across multiple -32-byte devices including one deviceStateNotify event and optional -deviceKeyStateNotify, deviceButtonStateNotify and (possibly multiple) -deviceValuator events. - -The previous behavior would instead compose a sequence -of [state, buttonstate, state, keystate, valuator...]. This is not -protocol correct, and on top of that made the code extremely convoluted. - -Fix this by streamlining: add both button and key into the deviceStateNotify -and then append the key state and button state, followed by the -valuators. Finally, the deviceValuator events contain up to 6 valuators -per event but we only ever sent through 3 at a time. Let's double that -troughput. - -CVE-2024-0229, ZDI-CAN-22678 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative ---- - dix/enterleave.c | 121 ++++++++++++++++++++--------------------------- - 1 file changed, 52 insertions(+), 69 deletions(-) - -diff --git a/dix/enterleave.c b/dix/enterleave.c -index 17964b00a..7b7ba1098 100644 ---- a/dix/enterleave.c -+++ b/dix/enterleave.c -@@ -615,9 +615,15 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v, - - ev->type = DeviceValuator; - ev->deviceid = dev->id; -- ev->num_valuators = nval < 3 ? nval : 3; -+ ev->num_valuators = nval < 6 ? nval : 6; - ev->first_valuator = first; - switch (ev->num_valuators) { -+ case 6: -+ ev->valuator2 = v->axisVal[first + 5]; -+ case 5: -+ ev->valuator2 = v->axisVal[first + 4]; -+ case 4: -+ ev->valuator2 = v->axisVal[first + 3]; - case 3: - ev->valuator2 = v->axisVal[first + 2]; - case 2: -@@ -626,7 +632,6 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v, - ev->valuator0 = v->axisVal[first]; - break; - } -- first += ev->num_valuators; - } - - static void -@@ -646,7 +651,7 @@ FixDeviceStateNotify(DeviceIntPtr dev, deviceStateNotify * ev, KeyClassPtr k, - ev->num_buttons = b->numButtons; - memcpy((char *) ev->buttons, (char *) b->down, 4); - } -- else if (k) { -+ if (k) { - ev->classes_reported |= (1 << KeyClass); - ev->num_keys = k->xkbInfo->desc->max_key_code - - k->xkbInfo->desc->min_key_code; -@@ -670,15 +675,26 @@ FixDeviceStateNotify(DeviceIntPtr dev, deviceStateNotify * ev, KeyClassPtr k, - } - } - -- -+/** -+ * The device state notify event is split across multiple 32-byte events. -+ * The first one contains the first 32 button state bits, the first 32 -+ * key state bits, and the first 3 valuator values. -+ * -+ * If a device has more than that, the server sends out: -+ * - one deviceButtonStateNotify for buttons 32 and above -+ * - one deviceKeyStateNotify for keys 32 and above -+ * - one deviceValuator event per 6 valuators above valuator 4 -+ * -+ * All events but the last one have the deviceid binary ORed with MORE_EVENTS, -+ */ - static void - DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) - { -+ /* deviceStateNotify, deviceKeyStateNotify, deviceButtonStateNotify -+ * and one deviceValuator for each 6 valuators */ -+ deviceStateNotify sev[3 + (MAX_VALUATORS + 6)/6]; - int evcount = 1; -- deviceStateNotify sev[6 + (MAX_VALUATORS + 2)/3]; -- deviceStateNotify *ev; -- deviceKeyStateNotify *kev; -- deviceButtonStateNotify *bev; -+ deviceStateNotify *ev = sev; - - KeyClassPtr k; - ButtonClassPtr b; -@@ -691,82 +707,49 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win) - - if ((b = dev->button) != NULL) { - nbuttons = b->numButtons; -- if (nbuttons > 32) -+ if (nbuttons > 32) /* first 32 are encoded in deviceStateNotify */ - evcount++; - } - if ((k = dev->key) != NULL) { - nkeys = k->xkbInfo->desc->max_key_code - k->xkbInfo->desc->min_key_code; -- if (nkeys > 32) -+ if (nkeys > 32) /* first 32 are encoded in deviceStateNotify */ - evcount++; -- if (nbuttons > 0) { -- evcount++; -- } - } - if ((v = dev->valuator) != NULL) { - nval = v->numAxes; -- -- if (nval > 3) -- evcount++; -- if (nval > 6) { -- if (!(k && b)) -- evcount++; -- if (nval > 9) -- evcount += ((nval - 7) / 3); -- } -+ /* first three are encoded in deviceStateNotify, then -+ * it's 6 per deviceValuator event */ -+ evcount += ((nval - 3) + 6)/6; - } - -- ev = sev; -- FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first); -- -- if (b != NULL) { -- FixDeviceStateNotify(dev, ev++, NULL, b, v, first); -- first += 3; -- nval -= 3; -- if (nbuttons > 32) { -- (ev - 1)->deviceid |= MORE_EVENTS; -- bev = (deviceButtonStateNotify *) ev++; -- bev->type = DeviceButtonStateNotify; -- bev->deviceid = dev->id; -- memcpy((char *) &bev->buttons[4], (char *) &b->down[4], -- DOWN_LENGTH - 4); -- } -- if (nval > 0) { -- (ev - 1)->deviceid |= MORE_EVENTS; -- FixDeviceValuator(dev, (deviceValuator *) ev++, v, first); -- first += 3; -- nval -= 3; -- } -+ BUG_RETURN(evcount <= ARRAY_SIZE(sev)); -+ -+ FixDeviceStateNotify(dev, ev, k, b, v, first); -+ -+ if (b != NULL && nbuttons > 32) { -+ deviceButtonStateNotify *bev = (deviceButtonStateNotify *) ++ev; -+ (ev - 1)->deviceid |= MORE_EVENTS; -+ bev->type = DeviceButtonStateNotify; -+ bev->deviceid = dev->id; -+ memcpy((char *) &bev->buttons[4], (char *) &b->down[4], -+ DOWN_LENGTH - 4); - } - -- if (k != NULL) { -- FixDeviceStateNotify(dev, ev++, k, NULL, v, first); -- first += 3; -- nval -= 3; -- if (nkeys > 32) { -- (ev - 1)->deviceid |= MORE_EVENTS; -- kev = (deviceKeyStateNotify *) ev++; -- kev->type = DeviceKeyStateNotify; -- kev->deviceid = dev->id; -- memmove((char *) &kev->keys[0], (char *) &k->down[4], 28); -- } -- if (nval > 0) { -- (ev - 1)->deviceid |= MORE_EVENTS; -- FixDeviceValuator(dev, (deviceValuator *) ev++, v, first); -- first += 3; -- nval -= 3; -- } -+ if (k != NULL && nkeys > 32) { -+ deviceKeyStateNotify *kev = (deviceKeyStateNotify *) ++ev; -+ (ev - 1)->deviceid |= MORE_EVENTS; -+ kev->type = DeviceKeyStateNotify; -+ kev->deviceid = dev->id; -+ memmove((char *) &kev->keys[0], (char *) &k->down[4], 28); - } - -+ first = 3; -+ nval -= 3; - while (nval > 0) { -- FixDeviceStateNotify(dev, ev++, NULL, NULL, v, first); -- first += 3; -- nval -= 3; -- if (nval > 0) { -- (ev - 1)->deviceid |= MORE_EVENTS; -- FixDeviceValuator(dev, (deviceValuator *) ev++, v, first); -- first += 3; -- nval -= 3; -- } -+ ev->deviceid |= MORE_EVENTS; -+ FixDeviceValuator(dev, (deviceValuator *) ++ev, v, first); -+ first += 6; -+ nval -= 6; - } - - DeliverEventsToWindow(dev, win, (xEvent *) sev, evcount, --- -2.43.0 - diff --git a/0003-xkb-add-request-length-validation-for-XkbSetGeometry.patch b/0003-xkb-add-request-length-validation-for-XkbSetGeometry.patch deleted file mode 100644 index dca4d7c..0000000 --- a/0003-xkb-add-request-length-validation-for-XkbSetGeometry.patch +++ /dev/null @@ -1,182 +0,0 @@ -From 6907b6ea2b4ce949cb07271f5b678d5966d9df42 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 5 Jul 2022 11:11:06 +1000 -Subject: [PATCH xserver 3/3] xkb: add request length validation for - XkbSetGeometry - -No validation of the various fields on that report were done, so a -malicious client could send a short request that claims it had N -sections, or rows, or keys, and the server would process the request for -N sections, running out of bounds of the actual request data. - -Fix this by adding size checks to ensure our data is valid. - -ZDI-CAN 16062, CVE-2022-2319. - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Signed-off-by: Peter Hutterer ---- - xkb/xkb.c | 43 ++++++++++++++++++++++++++++++++++++++----- - 1 file changed, 38 insertions(+), 5 deletions(-) - -diff --git a/xkb/xkb.c b/xkb/xkb.c -index 34b2c290b..4692895db 100644 ---- a/xkb/xkb.c -+++ b/xkb/xkb.c -@@ -5156,7 +5156,7 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str) - } - - static Status --_CheckSetDoodad(char **wire_inout, -+_CheckSetDoodad(char **wire_inout, xkbSetGeometryReq *req, - XkbGeometryPtr geom, XkbSectionPtr section, ClientPtr client) - { - char *wire; -@@ -5167,6 +5167,9 @@ _CheckSetDoodad(char **wire_inout, - Status status; - - dWire = (xkbDoodadWireDesc *) (*wire_inout); -+ if (!_XkbCheckRequestBounds(client, req, dWire, dWire + 1)) -+ return BadLength; -+ - any = dWire->any; - wire = (char *) &dWire[1]; - if (client->swapped) { -@@ -5269,7 +5272,7 @@ _CheckSetDoodad(char **wire_inout, - } - - static Status --_CheckSetOverlay(char **wire_inout, -+_CheckSetOverlay(char **wire_inout, xkbSetGeometryReq *req, - XkbGeometryPtr geom, XkbSectionPtr section, ClientPtr client) - { - register int r; -@@ -5280,6 +5283,9 @@ _CheckSetOverlay(char **wire_inout, - - wire = *wire_inout; - olWire = (xkbOverlayWireDesc *) wire; -+ if (!_XkbCheckRequestBounds(client, req, olWire, olWire + 1)) -+ return BadLength; -+ - if (client->swapped) { - swapl(&olWire->name); - } -@@ -5291,6 +5297,9 @@ _CheckSetOverlay(char **wire_inout, - xkbOverlayKeyWireDesc *kWire; - XkbOverlayRowPtr row; - -+ if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1)) -+ return BadLength; -+ - if (rWire->rowUnder > section->num_rows) { - client->errorValue = _XkbErrCode4(0x20, r, section->num_rows, - rWire->rowUnder); -@@ -5299,6 +5308,9 @@ _CheckSetOverlay(char **wire_inout, - row = XkbAddGeomOverlayRow(ol, rWire->rowUnder, rWire->nKeys); - kWire = (xkbOverlayKeyWireDesc *) &rWire[1]; - for (k = 0; k < rWire->nKeys; k++, kWire++) { -+ if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1)) -+ return BadLength; -+ - if (XkbAddGeomOverlayKey(ol, row, - (char *) kWire->over, - (char *) kWire->under) == NULL) { -@@ -5332,6 +5344,9 @@ _CheckSetSections(XkbGeometryPtr geom, - register int r; - xkbRowWireDesc *rWire; - -+ if (!_XkbCheckRequestBounds(client, req, sWire, sWire + 1)) -+ return BadLength; -+ - if (client->swapped) { - swapl(&sWire->name); - swaps(&sWire->top); -@@ -5357,6 +5372,9 @@ _CheckSetSections(XkbGeometryPtr geom, - XkbRowPtr row; - xkbKeyWireDesc *kWire; - -+ if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1)) -+ return BadLength; -+ - if (client->swapped) { - swaps(&rWire->top); - swaps(&rWire->left); -@@ -5371,6 +5389,9 @@ _CheckSetSections(XkbGeometryPtr geom, - for (k = 0; k < rWire->nKeys; k++, kWire++) { - XkbKeyPtr key; - -+ if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1)) -+ return BadLength; -+ - key = XkbAddGeomKey(row); - if (!key) - return BadAlloc; -@@ -5396,7 +5417,7 @@ _CheckSetSections(XkbGeometryPtr geom, - register int d; - - for (d = 0; d < sWire->nDoodads; d++) { -- status = _CheckSetDoodad(&wire, geom, section, client); -+ status = _CheckSetDoodad(&wire, req, geom, section, client); - if (status != Success) - return status; - } -@@ -5405,7 +5426,7 @@ _CheckSetSections(XkbGeometryPtr geom, - register int o; - - for (o = 0; o < sWire->nOverlays; o++) { -- status = _CheckSetOverlay(&wire, geom, section, client); -+ status = _CheckSetOverlay(&wire, req, geom, section, client); - if (status != Success) - return status; - } -@@ -5439,6 +5460,9 @@ _CheckSetShapes(XkbGeometryPtr geom, - xkbOutlineWireDesc *olWire; - XkbOutlinePtr ol; - -+ if (!_XkbCheckRequestBounds(client, req, shapeWire, shapeWire + 1)) -+ return BadLength; -+ - shape = - XkbAddGeomShape(geom, shapeWire->name, shapeWire->nOutlines); - if (!shape) -@@ -5449,12 +5473,18 @@ _CheckSetShapes(XkbGeometryPtr geom, - XkbPointPtr pt; - xkbPointWireDesc *ptWire; - -+ if (!_XkbCheckRequestBounds(client, req, olWire, olWire + 1)) -+ return BadLength; -+ - ol = XkbAddGeomOutline(shape, olWire->nPoints); - if (!ol) - return BadAlloc; - ol->corner_radius = olWire->cornerRadius; - ptWire = (xkbPointWireDesc *) &olWire[1]; - for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++, ptWire++) { -+ if (!_XkbCheckRequestBounds(client, req, ptWire, ptWire + 1)) -+ return BadLength; -+ - pt->x = ptWire->x; - pt->y = ptWire->y; - if (client->swapped) { -@@ -5560,12 +5590,15 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSetGeometryReq * req, ClientPtr client) - return status; - - for (i = 0; i < req->nDoodads; i++) { -- status = _CheckSetDoodad(&wire, geom, NULL, client); -+ status = _CheckSetDoodad(&wire, req, geom, NULL, client); - if (status != Success) - return status; - } - - for (i = 0; i < req->nKeyAliases; i++) { -+ if (!_XkbCheckRequestBounds(client, req, wire, wire + XkbKeyNameLength)) -+ return BadLength; -+ - if (XkbAddGeomKeyAlias(geom, &wire[XkbKeyNameLength], wire) == NULL) - return BadAlloc; - wire += 2 * XkbKeyNameLength; --- -2.36.1 - diff --git a/0004-Xi-disallow-passive-grabs-with-a-detail-255.patch b/0004-Xi-disallow-passive-grabs-with-a-detail-255.patch deleted file mode 100644 index 5b189ea..0000000 --- a/0004-Xi-disallow-passive-grabs-with-a-detail-255.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 0dab0b527ac5c4fe0272ea679522bd87238a733b Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 29 Nov 2022 13:55:32 +1000 -Subject: [PATCH xserver 4/7] Xi: disallow passive grabs with a detail > 255 - -The XKB protocol effectively prevents us from ever using keycodes above -255. For buttons it's theoretically possible but realistically too niche -to worry about. For all other passive grabs, the detail must be zero -anyway. - -This fixes an OOB write: - -ProcXIPassiveUngrabDevice() calls DeletePassiveGrabFromList with a -temporary grab struct which contains tempGrab->detail.exact = stuff->detail. -For matching existing grabs, DeleteDetailFromMask is called with the -stuff->detail value. This function creates a new mask with the one bit -representing stuff->detail cleared. - -However, the array size for the new mask is 8 * sizeof(CARD32) bits, -thus any detail above 255 results in an OOB array write. - -CVE-2022-46341, ZDI-CAN 19381 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Signed-off-by: Peter Hutterer -Acked-by: Olivier Fourdan ---- - Xi/xipassivegrab.c | 22 ++++++++++++++-------- - 1 file changed, 14 insertions(+), 8 deletions(-) - -diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c -index 2769fb7c94..c9ac2f8553 100644 ---- a/Xi/xipassivegrab.c -+++ b/Xi/xipassivegrab.c -@@ -137,6 +137,12 @@ ProcXIPassiveGrabDevice(ClientPtr client) - return BadValue; - } - -+ /* XI2 allows 32-bit keycodes but thanks to XKB we can never -+ * implement this. Just return an error for all keycodes that -+ * cannot work anyway, same for buttons > 255. */ -+ if (stuff->detail > 255) -+ return XIAlreadyGrabbed; -+ - if (XICheckInvalidMaskBits(client, (unsigned char *) &stuff[1], - stuff->mask_len * 4) != Success) - return BadValue; -@@ -207,14 +213,8 @@ ProcXIPassiveGrabDevice(ClientPtr client) - ¶m, XI2, &mask); - break; - case XIGrabtypeKeycode: -- /* XI2 allows 32-bit keycodes but thanks to XKB we can never -- * implement this. Just return an error for all keycodes that -- * cannot work anyway */ -- if (stuff->detail > 255) -- status = XIAlreadyGrabbed; -- else -- status = GrabKey(client, dev, mod_dev, stuff->detail, -- ¶m, XI2, &mask); -+ status = GrabKey(client, dev, mod_dev, stuff->detail, -+ ¶m, XI2, &mask); - break; - case XIGrabtypeEnter: - case XIGrabtypeFocusIn: -@@ -334,6 +334,12 @@ ProcXIPassiveUngrabDevice(ClientPtr client) - return BadValue; - } - -+ /* We don't allow passive grabs for details > 255 anyway */ -+ if (stuff->detail > 255) { -+ client->errorValue = stuff->detail; -+ return BadValue; -+ } -+ - rc = dixLookupWindow(&win, stuff->grab_window, client, DixSetAttrAccess); - if (rc != Success) - return rc; --- -2.38.1 - diff --git a/0004-Xi-when-creating-a-new-ButtonClass-set-the-number-of.patch b/0004-Xi-when-creating-a-new-ButtonClass-set-the-number-of.patch deleted file mode 100644 index dbe90ce..0000000 --- a/0004-Xi-when-creating-a-new-ButtonClass-set-the-number-of.patch +++ /dev/null @@ -1,37 +0,0 @@ -From df3c65706eb169d5938df0052059f3e0d5981b74 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Thu, 21 Dec 2023 13:48:10 +1000 -Subject: [PATCH 4/9] Xi: when creating a new ButtonClass, set the number of - buttons - -There's a racy sequence where a master device may copy the button class -from the slave, without ever initializing numButtons. This leads to a -device with zero buttons but a button class which is invalid. - -Let's copy the numButtons value from the source - by definition if we -don't have a button class yet we do not have any other slave devices -with more than this number of buttons anyway. - -CVE-2024-0229, ZDI-CAN-22678 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative ---- - Xi/exevents.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/Xi/exevents.c b/Xi/exevents.c -index 54ea11a93..e16171468 100644 ---- a/Xi/exevents.c -+++ b/Xi/exevents.c -@@ -605,6 +605,7 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) - to->button = calloc(1, sizeof(ButtonClassRec)); - if (!to->button) - FatalError("[Xi] no memory for class shift.\n"); -+ to->button->numButtons = from->button->numButtons; - } - else - classes->button = NULL; --- -2.43.0 - diff --git a/0004-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch b/0004-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch deleted file mode 100644 index dcbf337..0000000 --- a/0004-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch +++ /dev/null @@ -1,112 +0,0 @@ -From bdca6c3d1f5057eeb31609b1280fc93237b00c77 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 30 Jan 2024 13:13:35 +1000 -Subject: [PATCH 4/4] render: fix refcounting of glyphs during - ProcRenderAddGlyphs - -Previously, AllocateGlyph would return a new glyph with refcount=0 and a -re-used glyph would end up not changing the refcount at all. The -resulting glyph_new array would thus have multiple entries pointing to -the same non-refcounted glyphs. - -AddGlyph may free a glyph, resulting in a UAF when the same glyph -pointer is then later used. - -Fix this by returning a refcount of 1 for a new glyph and always -incrementing the refcount for a re-used glyph, followed by dropping that -refcount back down again when we're done with it. - -CVE-2024-31083, ZDI-CAN-22880 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Part-of: ---- - render/glyph.c | 5 +++-- - render/glyphstr_priv.h | 1 + - render/render.c | 15 +++++++++++---- - 3 files changed, 15 insertions(+), 6 deletions(-) - -diff --git a/render/glyph.c b/render/glyph.c -index 850ea8440..13991f8a1 100644 ---- a/render/glyph.c -+++ b/render/glyph.c -@@ -245,10 +245,11 @@ FreeGlyphPicture(GlyphPtr glyph) - } - } - --static void -+void - FreeGlyph(GlyphPtr glyph, int format) - { - CheckDuplicates(&globalGlyphs[format], "FreeGlyph"); -+ BUG_RETURN(glyph->refcnt == 0); - if (--glyph->refcnt == 0) { - GlyphRefPtr gr; - int i; -@@ -354,7 +355,7 @@ AllocateGlyph(xGlyphInfo * gi, int fdepth) - glyph = (GlyphPtr) malloc(size); - if (!glyph) - return 0; -- glyph->refcnt = 0; -+ glyph->refcnt = 1; - glyph->size = size + sizeof(xGlyphInfo); - glyph->info = *gi; - dixInitPrivates(glyph, (char *) glyph + head_size, PRIVATE_GLYPH); -diff --git a/render/glyphstr.h b/render/glyphstr.h -index 2f51bd244..3b1d806d1 100644 ---- a/render/glyphstr.h -+++ b/render/glyphstr.h -@@ -108,6 +108,7 @@ extern Bool - extern GlyphPtr FindGlyph(GlyphSetPtr glyphSet, Glyph id); - - extern GlyphPtr AllocateGlyph(xGlyphInfo * gi, int format); -+extern void FreeGlyph(GlyphPtr glyph, int format); - - extern Bool - ResizeGlyphSet(GlyphSetPtr glyphSet, CARD32 change); -diff --git a/render/render.c b/render/render.c -index 29c5055c6..fe5e37dd9 100644 ---- a/render/render.c -+++ b/render/render.c -@@ -1076,6 +1076,7 @@ ProcRenderAddGlyphs(ClientPtr client) - - if (glyph_new->glyph && glyph_new->glyph != DeletedGlyph) { - glyph_new->found = TRUE; -+ ++glyph_new->glyph->refcnt; - } - else { - GlyphPtr glyph; -@@ -1168,8 +1169,10 @@ ProcRenderAddGlyphs(ClientPtr client) - err = BadAlloc; - goto bail; - } -- for (i = 0; i < nglyphs; i++) -+ for (i = 0; i < nglyphs; i++) { - AddGlyph(glyphSet, glyphs[i].glyph, glyphs[i].id); -+ FreeGlyph(glyphs[i].glyph, glyphSet->fdepth); -+ } - - if (glyphsBase != glyphsLocal) - free(glyphsBase); -@@ -1179,9 +1182,13 @@ ProcRenderAddGlyphs(ClientPtr client) - FreePicture((void *) pSrc, 0); - if (pSrcPix) - FreeScratchPixmapHeader(pSrcPix); -- for (i = 0; i < nglyphs; i++) -- if (glyphs[i].glyph && !glyphs[i].found) -- free(glyphs[i].glyph); -+ for (i = 0; i < nglyphs; i++) { -+ if (glyphs[i].glyph) { -+ --glyphs[i].glyph->refcnt; -+ if (!glyphs[i].found) -+ free(glyphs[i].glyph); -+ } -+ } - if (glyphsBase != glyphsLocal) - free(glyphsBase); - return err; --- -2.44.0 - diff --git a/0005-Xext-free-the-screen-saver-resource-when-replacing-i.patch b/0005-Xext-free-the-screen-saver-resource-when-replacing-i.patch deleted file mode 100644 index dc2a9d9..0000000 --- a/0005-Xext-free-the-screen-saver-resource-when-replacing-i.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 94f6fe99d87cf6ba0adadd95c595158c345b7d29 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 29 Nov 2022 14:53:07 +1000 -Subject: [PATCH xserver 5/7] Xext: free the screen saver resource when - replacing it - -This fixes a use-after-free bug: - -When a client first calls ScreenSaverSetAttributes(), a struct -ScreenSaverAttrRec is allocated and added to the client's -resources. - -When the same client calls ScreenSaverSetAttributes() again, a new -struct ScreenSaverAttrRec is allocated, replacing the old struct. The -old struct was freed but not removed from the clients resources. - -Later, when the client is destroyed the resource system invokes -ScreenSaverFreeAttr and attempts to clean up the already freed struct. - -Fix this by letting the resource system free the old attrs instead. - -CVE-2022-46343, ZDI-CAN 19404 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Signed-off-by: Peter Hutterer -Acked-by: Olivier Fourdan ---- - Xext/saver.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Xext/saver.c b/Xext/saver.c -index f813ba08d1..fd6153c313 100644 ---- a/Xext/saver.c -+++ b/Xext/saver.c -@@ -1051,7 +1051,7 @@ ScreenSaverSetAttributes(ClientPtr client) - pVlist++; - } - if (pPriv->attr) -- FreeScreenAttr(pPriv->attr); -+ FreeResource(pPriv->attr->resource, AttrType); - pPriv->attr = pAttr; - pAttr->resource = FakeClientID(client->index); - if (!AddResource(pAttr->resource, AttrType, (void *) pAttr)) --- -2.38.1 - diff --git a/0005-Xi-flush-hierarchy-events-after-adding-removing-mast.patch b/0005-Xi-flush-hierarchy-events-after-adding-removing-mast.patch deleted file mode 100644 index 6a21b3c..0000000 --- a/0005-Xi-flush-hierarchy-events-after-adding-removing-mast.patch +++ /dev/null @@ -1,109 +0,0 @@ -From 4a5e9b1895627d40d26045bd0b7ef3dce503cbd1 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Thu, 4 Jan 2024 10:01:24 +1000 -Subject: [PATCH 5/9] Xi: flush hierarchy events after adding/removing master - devices - -The `XISendDeviceHierarchyEvent()` function allocates space to store up -to `MAXDEVICES` (256) `xXIHierarchyInfo` structures in `info`. - -If a device with a given ID was removed and a new device with the same -ID added both in the same operation, the single device ID will lead to -two info structures being written to `info`. - -Since this case can occur for every device ID at once, a total of two -times `MAXDEVICES` info structures might be written to the allocation. - -To avoid it, once one add/remove master is processed, send out the -device hierarchy event for the current state and continue. That event -thus only ever has exactly one of either added/removed in it (and -optionally slave attached/detached). - -CVE-2024-21885, ZDI-CAN-22744 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative ---- - Xi/xichangehierarchy.c | 27 ++++++++++++++++++++++----- - 1 file changed, 22 insertions(+), 5 deletions(-) - -diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c -index d2d985848..72d00451e 100644 ---- a/Xi/xichangehierarchy.c -+++ b/Xi/xichangehierarchy.c -@@ -416,6 +416,11 @@ ProcXIChangeHierarchy(ClientPtr client) - size_t len; /* length of data remaining in request */ - int rc = Success; - int flags[MAXDEVICES] = { 0 }; -+ enum { -+ NO_CHANGE, -+ FLUSH, -+ CHANGED, -+ } changes = NO_CHANGE; - - REQUEST(xXIChangeHierarchyReq); - REQUEST_AT_LEAST_SIZE(xXIChangeHierarchyReq); -@@ -465,8 +470,9 @@ ProcXIChangeHierarchy(ClientPtr client) - rc = add_master(client, c, flags); - if (rc != Success) - goto unwind; -- } -+ changes = FLUSH; - break; -+ } - case XIRemoveMaster: - { - xXIRemoveMasterInfo *r = (xXIRemoveMasterInfo *) any; -@@ -475,8 +481,9 @@ ProcXIChangeHierarchy(ClientPtr client) - rc = remove_master(client, r, flags); - if (rc != Success) - goto unwind; -- } -+ changes = FLUSH; - break; -+ } - case XIDetachSlave: - { - xXIDetachSlaveInfo *c = (xXIDetachSlaveInfo *) any; -@@ -485,8 +492,9 @@ ProcXIChangeHierarchy(ClientPtr client) - rc = detach_slave(client, c, flags); - if (rc != Success) - goto unwind; -- } -+ changes = CHANGED; - break; -+ } - case XIAttachSlave: - { - xXIAttachSlaveInfo *c = (xXIAttachSlaveInfo *) any; -@@ -495,16 +503,25 @@ ProcXIChangeHierarchy(ClientPtr client) - rc = attach_slave(client, c, flags); - if (rc != Success) - goto unwind; -+ changes = CHANGED; -+ break; - } -+ default: - break; - } - -+ if (changes == FLUSH) { -+ XISendDeviceHierarchyEvent(flags); -+ memset(flags, 0, sizeof(flags)); -+ changes = NO_CHANGE; -+ } -+ - len -= any->length * 4; - any = (xXIAnyHierarchyChangeInfo *) ((char *) any + any->length * 4); - } - - unwind: -- -- XISendDeviceHierarchyEvent(flags); -+ if (changes != NO_CHANGE) -+ XISendDeviceHierarchyEvent(flags); - return rc; - } --- -2.43.0 - diff --git a/0006-Xext-free-the-XvRTVideoNotify-when-turning-off-from-.patch b/0006-Xext-free-the-XvRTVideoNotify-when-turning-off-from-.patch deleted file mode 100644 index ba8b8fa..0000000 --- a/0006-Xext-free-the-XvRTVideoNotify-when-turning-off-from-.patch +++ /dev/null @@ -1,74 +0,0 @@ -From a42635ee3c01f71a49052d83a372933504c9db04 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Wed, 30 Nov 2022 11:20:40 +1000 -Subject: [PATCH xserver 6/7] Xext: free the XvRTVideoNotify when turning off - from the same client - -This fixes a use-after-free bug: - -When a client first calls XvdiSelectVideoNotify() on a drawable with a -TRUE onoff argument, a struct XvVideoNotifyRec is allocated. This struct -is added twice to the resources: - - as the drawable's XvRTVideoNotifyList. This happens only once per - drawable, subsequent calls append to this list. - - as the client's XvRTVideoNotify. This happens for every client. - -The struct keeps the ClientPtr around once it has been added for a -client. The idea, presumably, is that if the client disconnects we can remove -all structs from the drawable's list that match the client (by resetting -the ClientPtr to NULL), but if the drawable is destroyed we can remove -and free the whole list. - -However, if the same client then calls XvdiSelectVideoNotify() on the -same drawable with a FALSE onoff argument, only the ClientPtr on the -existing struct was set to NULL. The struct itself remained in the -client's resources. - -If the drawable is now destroyed, the resource system invokes -XvdiDestroyVideoNotifyList which frees the whole list for this drawable -- including our struct. This function however does not free the resource -for the client since our ClientPtr is NULL. - -Later, when the client is destroyed and the resource system invokes -XvdiDestroyVideoNotify, we unconditionally set the ClientPtr to NULL. On -a struct that has been freed previously. This is generally frowned upon. - -Fix this by calling FreeResource() on the second call instead of merely -setting the ClientPtr to NULL. This removes the struct from the client -resources (but not from the list), ensuring that it won't be accessed -again when the client quits. - -Note that the assignment tpn->client = NULL; is superfluous since the -XvdiDestroyVideoNotify function will do this anyway. But it's left for -clarity and to match a similar invocation in XvdiSelectPortNotify. - -CVE-2022-46342, ZDI-CAN 19400 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Signed-off-by: Peter Hutterer -Acked-by: Olivier Fourdan ---- - Xext/xvmain.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/Xext/xvmain.c b/Xext/xvmain.c -index f627471938..2a08f8744a 100644 ---- a/Xext/xvmain.c -+++ b/Xext/xvmain.c -@@ -811,8 +811,10 @@ XvdiSelectVideoNotify(ClientPtr client, DrawablePtr pDraw, BOOL onoff) - tpn = pn; - while (tpn) { - if (tpn->client == client) { -- if (!onoff) -+ if (!onoff) { - tpn->client = NULL; -+ FreeResource(tpn->id, XvRTVideoNotify); -+ } - return Success; - } - if (!tpn->client) --- -2.38.1 - diff --git a/0006-Xi-do-not-keep-linked-list-pointer-during-recursion.patch b/0006-Xi-do-not-keep-linked-list-pointer-during-recursion.patch deleted file mode 100644 index 3174635..0000000 --- a/0006-Xi-do-not-keep-linked-list-pointer-during-recursion.patch +++ /dev/null @@ -1,70 +0,0 @@ -From bc1fdbe46559dd947674375946bbef54dd0ce36b Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= -Date: Fri, 22 Dec 2023 18:28:31 +0100 -Subject: [PATCH 6/9] Xi: do not keep linked list pointer during recursion - -The `DisableDevice()` function is called whenever an enabled device -is disabled and it moves the device from the `inputInfo.devices` linked -list to the `inputInfo.off_devices` linked list. - -However, its link/unlink operation has an issue during the recursive -call to `DisableDevice()` due to the `prev` pointer pointing to a -removed device. - -This issue leads to a length mismatch between the total number of -devices and the number of device in the list, leading to a heap -overflow and, possibly, to local privilege escalation. - -Simplify the code that checked whether the device passed to -`DisableDevice()` was in `inputInfo.devices` or not and find the -previous device after the recursion. - -CVE-2024-21886, ZDI-CAN-22840 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative ---- - dix/devices.c | 15 ++++++++++++--- - 1 file changed, 12 insertions(+), 3 deletions(-) - -diff --git a/dix/devices.c b/dix/devices.c -index dca98c8d1..389d28a23 100644 ---- a/dix/devices.c -+++ b/dix/devices.c -@@ -453,14 +453,20 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent) - { - DeviceIntPtr *prev, other; - BOOL enabled; -+ BOOL dev_in_devices_list = FALSE; - int flags[MAXDEVICES] = { 0 }; - - if (!dev->enabled) - return TRUE; - -- for (prev = &inputInfo.devices; -- *prev && (*prev != dev); prev = &(*prev)->next); -- if (*prev != dev) -+ for (other = inputInfo.devices; other; other = other->next) { -+ if (other == dev) { -+ dev_in_devices_list = TRUE; -+ break; -+ } -+ } -+ -+ if (!dev_in_devices_list) - return FALSE; - - TouchEndPhysicallyActiveTouches(dev); -@@ -511,6 +517,9 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent) - LeaveWindow(dev); - SetFocusOut(dev); - -+ for (prev = &inputInfo.devices; -+ *prev && (*prev != dev); prev = &(*prev)->next); -+ - *prev = dev->next; - dev->next = inputInfo.off_devices; - inputInfo.off_devices = dev; --- -2.43.0 - diff --git a/0007-dix-when-disabling-a-master-float-disabled-slaved-de.patch b/0007-dix-when-disabling-a-master-float-disabled-slaved-de.patch deleted file mode 100644 index 32a326a..0000000 --- a/0007-dix-when-disabling-a-master-float-disabled-slaved-de.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Fri, 5 Jan 2024 09:40:27 +1000 -Subject: [PATCH 7/9] dix: when disabling a master, float disabled slaved - devices too - -Disabling a master device floats all slave devices but we didn't do this -to already-disabled slave devices. As a result those devices kept their -reference to the master device resulting in access to already freed -memory if the master device was removed before the corresponding slave -device. - -And to match this behavior, also forcibly reset that pointer during -CloseDownDevices(). - -Related to CVE-2024-21886, ZDI-CAN-22840 ---- - dix/devices.c | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/dix/devices.c b/dix/devices.c -index 389d28a23..84a6406d1 100644 ---- a/dix/devices.c -+++ b/dix/devices.c -@@ -483,6 +483,13 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent) - flags[other->id] |= XISlaveDetached; - } - } -+ -+ for (other = inputInfo.off_devices; other; other = other->next) { -+ if (!IsMaster(other) && GetMaster(other, MASTER_ATTACHED) == dev) { -+ AttachDevice(NULL, other, NULL); -+ flags[other->id] |= XISlaveDetached; -+ } -+ } - } - else { - for (other = inputInfo.devices; other; other = other->next) { -@@ -1088,6 +1095,11 @@ CloseDownDevices(void) - dev->master = NULL; - } - -+ for (dev = inputInfo.off_devices; dev; dev = dev->next) { -+ if (!IsMaster(dev) && !IsFloating(dev)) -+ dev->master = NULL; -+ } -+ - CloseDeviceList(&inputInfo.devices); - CloseDeviceList(&inputInfo.off_devices); - --- -2.43.0 - diff --git a/0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch b/0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch deleted file mode 100644 index c6b2352..0000000 --- a/0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 774260dbae1fa505cd2848c786baed9a8db5179d Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Mon, 5 Dec 2022 15:55:54 +1000 -Subject: [PATCH xserver 7/7] xkb: reset the radio_groups pointer to NULL after - freeing it - -Unlike other elements of the keymap, this pointer was freed but not -reset. On a subsequent XkbGetKbdByName request, the server may access -already freed memory. - -CVE-2022-46283, ZDI-CAN-19530 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Signed-off-by: Peter Hutterer -Acked-by: Olivier Fourdan ---- - xkb/xkbUtils.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c -index dd089c2046..3f5791a183 100644 ---- a/xkb/xkbUtils.c -+++ b/xkb/xkbUtils.c -@@ -1326,6 +1326,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst) - } - else { - free(dst->names->radio_groups); -+ dst->names->radio_groups = NULL; - } - dst->names->num_rg = src->names->num_rg; - --- -2.38.1 - diff --git a/0008-Xext-fix-invalid-event-type-mask-in-XTestSwapFakeInp.patch b/0008-Xext-fix-invalid-event-type-mask-in-XTestSwapFakeInp.patch deleted file mode 100644 index c84d387..0000000 --- a/0008-Xext-fix-invalid-event-type-mask-in-XTestSwapFakeInp.patch +++ /dev/null @@ -1,35 +0,0 @@ -From bb1711b7fba42f2a0c7d1c09beee241a1b2bcc30 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Mon, 19 Dec 2022 10:06:45 +1000 -Subject: [PATCH xserver] Xext: fix invalid event type mask in - XTestSwapFakeInput - -In commit b320ca0 the mask was inadvertently changed from octal 0177 to -hexadecimal 0x177. - -Fixes commit b320ca0ffe4c0c872eeb3a93d9bde21f765c7c63 - Xtest: disallow GenericEvents in XTestSwapFakeInput - -Found by Stuart Cassoff - -Signed-off-by: Peter Hutterer ---- - Xext/xtest.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Xext/xtest.c b/Xext/xtest.c -index 2985a4ce6e..dde5c4cf9d 100644 ---- a/Xext/xtest.c -+++ b/Xext/xtest.c -@@ -502,7 +502,7 @@ XTestSwapFakeInput(ClientPtr client, xReq * req) - - nev = ((req->length << 2) - sizeof(xReq)) / sizeof(xEvent); - for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) { -- int evtype = ev->u.u.type & 0x177; -+ int evtype = ev->u.u.type & 0177; - /* Swap event */ - proc = EventSwapVector[evtype]; - /* no swapping proc; invalid event type? */ --- -2.38.1 - diff --git a/0008-glx-Call-XACE-hooks-on-the-GLX-buffer.patch b/0008-glx-Call-XACE-hooks-on-the-GLX-buffer.patch deleted file mode 100644 index 0e9e4a0..0000000 --- a/0008-glx-Call-XACE-hooks-on-the-GLX-buffer.patch +++ /dev/null @@ -1,60 +0,0 @@ -From e5e8586a12a3ec915673edffa10dc8fe5e15dac3 Mon Sep 17 00:00:00 2001 -From: Olivier Fourdan -Date: Wed, 6 Dec 2023 12:09:41 +0100 -Subject: [PATCH 8/9] glx: Call XACE hooks on the GLX buffer - -The XSELINUX code will label resources at creation by checking the -access mode. When the access mode is DixCreateAccess, it will call the -function to label the new resource SELinuxLabelResource(). - -However, GLX buffers do not go through the XACE hooks when created, -hence leaving the resource actually unlabeled. - -When, later, the client tries to create another resource using that -drawable (like a GC for example), the XSELINUX code would try to use -the security ID of that object which has never been labeled, get a NULL -pointer and crash when checking whether the requested permissions are -granted for subject security ID. - -To avoid the issue, make sure to call the XACE hooks when creating the -GLX buffers. - -Credit goes to Donn Seeley for providing the patch. - -CVE-2024-0408 - -Signed-off-by: Olivier Fourdan -Acked-by: Peter Hutterer ---- - glx/glxcmds.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/glx/glxcmds.c b/glx/glxcmds.c -index fc26a2e34..1e46d0c72 100644 ---- a/glx/glxcmds.c -+++ b/glx/glxcmds.c -@@ -48,6 +48,7 @@ - #include "indirect_util.h" - #include "protocol-versions.h" - #include "glxvndabi.h" -+#include "xace.h" - - static char GLXServerVendorName[] = "SGI"; - -@@ -1392,6 +1393,13 @@ DoCreatePbuffer(ClientPtr client, int screenNum, XID fbconfigId, - if (!pPixmap) - return BadAlloc; - -+ err = XaceHook(XACE_RESOURCE_ACCESS, client, glxDrawableId, RT_PIXMAP, -+ pPixmap, RT_NONE, NULL, DixCreateAccess); -+ if (err != Success) { -+ (*pGlxScreen->pScreen->DestroyPixmap) (pPixmap); -+ return err; -+ } -+ - /* Assign the pixmap the same id as the pbuffer and add it as a - * resource so it and the DRI2 drawable will be reclaimed when the - * pbuffer is destroyed. */ --- -2.43.0 - diff --git a/0009-ephyr-xwayland-Use-the-proper-private-key-for-cursor.patch b/0009-ephyr-xwayland-Use-the-proper-private-key-for-cursor.patch deleted file mode 100644 index 5fa80fd..0000000 --- a/0009-ephyr-xwayland-Use-the-proper-private-key-for-cursor.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 2ef0f1116c65d5cb06d7b6d83f8a1aea702c94f7 Mon Sep 17 00:00:00 2001 -From: Olivier Fourdan -Date: Wed, 6 Dec 2023 11:51:56 +0100 -Subject: [PATCH 9/9] ephyr,xwayland: Use the proper private key for cursor - -The cursor in DIX is actually split in two parts, the cursor itself and -the cursor bits, each with their own devPrivates. - -The cursor itself includes the cursor bits, meaning that the cursor bits -devPrivates in within structure of the cursor. - -Both Xephyr and Xwayland were using the private key for the cursor bits -to store the data for the cursor, and when using XSELINUX which comes -with its own special devPrivates, the data stored in that cursor bits' -devPrivates would interfere with the XSELINUX devPrivates data and the -SELINUX security ID would point to some other unrelated data, causing a -crash in the XSELINUX code when trying to (re)use the security ID. - -CVE-2024-0409 - -Signed-off-by: Olivier Fourdan -Reviewed-by: Peter Hutterer ---- - hw/kdrive/ephyr/ephyrcursor.c | 2 +- - hw/xwayland/xwayland-cursor.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/hw/kdrive/ephyr/ephyrcursor.c b/hw/kdrive/ephyr/ephyrcursor.c -index f991899c5..3f192d034 100644 ---- a/hw/kdrive/ephyr/ephyrcursor.c -+++ b/hw/kdrive/ephyr/ephyrcursor.c -@@ -246,7 +246,7 @@ miPointerSpriteFuncRec EphyrPointerSpriteFuncs = { - Bool - ephyrCursorInit(ScreenPtr screen) - { -- if (!dixRegisterPrivateKey(&ephyrCursorPrivateKey, PRIVATE_CURSOR_BITS, -+ if (!dixRegisterPrivateKey(&ephyrCursorPrivateKey, PRIVATE_CURSOR, - sizeof(ephyrCursorRec))) - return FALSE; - -diff --git a/hw/xwayland/xwayland-cursor.c b/hw/xwayland/xwayland-cursor.c -index e3c1aaa50..bd94b0cfb 100644 ---- a/hw/xwayland/xwayland-cursor.c -+++ b/hw/xwayland/xwayland-cursor.c -@@ -431,7 +431,7 @@ static miPointerScreenFuncRec xwl_pointer_screen_funcs = { - Bool - xwl_screen_init_cursor(struct xwl_screen *xwl_screen) - { -- if (!dixRegisterPrivateKey(&xwl_cursor_private_key, PRIVATE_CURSOR_BITS, 0)) -+ if (!dixRegisterPrivateKey(&xwl_cursor_private_key, PRIVATE_CURSOR, 0)) - return FALSE; - - return miPointerInitialize(xwl_screen->screen, --- -2.43.0 - diff --git a/Makefile b/Makefile deleted file mode 100644 index 4041668..0000000 --- a/Makefile +++ /dev/null @@ -1,30 +0,0 @@ -# Makefile for source rpm: xorg-x11-server -# $Id$ -NAME := xorg-x11-server -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attempt a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) - -ifeq ($(MAKECMDGOALS),me a sandwich) -.PHONY :: me a sandwich -me a: - @: - -sandwich: - @[ `id -u` -ne 0 ] && echo "What? Make it yourself." || echo Okay. -endif diff --git a/commitid b/commitid deleted file mode 100644 index 7420e41..0000000 --- a/commitid +++ /dev/null @@ -1 +0,0 @@ -d13cb974426f7f1110b0bdb08c4ebb46ff8975f7 diff --git a/gitignore b/gitignore deleted file mode 100644 index 524cfc6..0000000 --- a/gitignore +++ /dev/null @@ -1,306 +0,0 @@ -Makefile -Makefile.in -.deps -.libs -.msg -*.lo -*.la -*.a -*.o -*~ -.*sw? -*.pbxuser -*.mode1v3 -obj* -build* -local -aclocal.m4 -autom4te.cache -compile -config.guess -config.log -config.status -config.sub -configure -configure.lineno -depcomp -install-sh -libtool -ltmain.sh -missing -TAGS -tags -ylwrap -xorg-server.pc -stamp-h? -do-not-use-config.h -do-not-use-config.h.in -afb/afbbltC.c -afb/afbbltCI.c -afb/afbbltG.c -afb/afbbltO.c -afb/afbbltX.c -afb/afbseg.c -afb/afbtileC.c -afb/afbtileG.c -cfb/cfb8lineCO.c -cfb/cfb8lineCP.c -cfb/cfb8lineG.c -cfb/cfb8lineX.c -cfb/cfb8segC.c -cfb/cfb8segCS.c -cfb/cfb8segX.c -cfb/cfb8setG.c -cfb/cfbbltC.c -cfb/cfbbltG.c -cfb/cfbbltO.c -cfb/cfbbltX.c -cfb/cfbfillarcC.c -cfb/cfbfillarcG.c -cfb/cfbglrop8.c -cfb/cfbply1rctC.c -cfb/cfbply1rctG.c -cfb/cfbseg.c -cfb/cfbsolidC.c -cfb/cfbsolidG.c -cfb/cfbsolidX.c -cfb/cfbtile32C.c -cfb/cfbtile32G.c -cfb/cfbtileoddC.c -cfb/cfbtileoddG.c -cfb/cfbzerarcC.c -cfb/cfbzerarcG.c -cfb/cfbzerarcX.c -cfb32/cfb8lineCO.c -cfb32/cfb8lineCP.c -cfb32/cfb8lineG.c -cfb32/cfb8lineX.c -cfb32/cfb8segC.c -cfb32/cfb8segCS.c -cfb32/cfb8segX.c -cfb32/cfb8setG.c -cfb32/cfbbltC.c -cfb32/cfbbltG.c -cfb32/cfbbltO.c -cfb32/cfbbltX.c -cfb32/cfbfillarcC.c -cfb32/cfbfillarcG.c -cfb32/cfbply1rctC.c -cfb32/cfbply1rctG.c -cfb32/cfbseg.c -cfb32/cfbsolidC.c -cfb32/cfbsolidG.c -cfb32/cfbsolidX.c -cfb32/cfbtile32C.c -cfb32/cfbtile32G.c -cfb32/cfbtileoddC.c -cfb32/cfbtileoddG.c -cfb32/cfbzerarcC.c -cfb32/cfbzerarcG.c -cfb32/cfbzerarcX.c -doc/Xserver.1x -doc/Xserver.man -hw/dmx/Xdmx -hw/dmx/Xdmx.1x -hw/dmx/config/dmxtodmx -hw/dmx/config/dmxtodmx.1x -hw/dmx/config/parser.c -hw/dmx/config/parser.h -hw/dmx/config/scanner.c -hw/dmx/config/vdltodmx -hw/dmx/config/vdltodmx.1x -hw/dmx/config/xdmxconfig -hw/dmx/config/xdmxconfig.1x -hw/dmx/examples/dmxaddinput -hw/dmx/examples/dmxaddscreen -hw/dmx/examples/dmxreconfig -hw/dmx/examples/dmxresize -hw/dmx/examples/dmxrminput -hw/dmx/examples/dmxrmscreen -hw/dmx/examples/dmxwininfo -hw/dmx/examples/ev -hw/dmx/examples/evi -hw/dmx/examples/res -hw/dmx/examples/xbell -hw/dmx/examples/xdmx -hw/dmx/examples/xinput -hw/dmx/examples/xled -hw/dmx/examples/xtest -hw/kdrive/ati/Xati -hw/kdrive/chips/Xchips -hw/kdrive/ephyr/Xephyr -hw/kdrive/epson/Xepson -hw/kdrive/fake/Xfake -hw/kdrive/fbdev/Xfbdev -hw/kdrive/i810/Xi810 -hw/kdrive/mach64/Xmach64 -hw/kdrive/mga/Xmga -hw/kdrive/neomagic/Xneomagic -hw/kdrive/nvidia/Xnvidia -hw/kdrive/pm2/Xpm2 -hw/kdrive/r128/Xr128 -hw/kdrive/sdl/Xsdl -hw/kdrive/sis300/Xsis -hw/kdrive/smi/Xsmi -hw/kdrive/vesa/Xvesa -hw/kdrive/via/Xvia -hw/vfb/Xvfb -hw/vfb/Xvfb.1x -hw/vfb/Xvfb.man -hw/xfree86/Xorg -hw/xfree86/common/xf86Build.h -hw/xfree86/common/xf86DefModeSet.c -hw/xfree86/doc/man/Xorg.1x -hw/xfree86/doc/man/Xorg.man -hw/xfree86/doc/man/xorg.conf.5x -hw/xfree86/doc/man/xorg.conf.man -hw/xfree86/exa/exa.4 -hw/xfree86/exa/exa.4x -hw/xfree86/exa/exa.man -hw/xfree86/fbdevhw/fbdevhw.4x -hw/xfree86/fbdevhw/fbdevhw.man -hw/xfree86/getconfig/cfg.man -hw/xfree86/getconfig/getconfig.1x -hw/xfree86/getconfig/getconfig.5x -hw/xfree86/getconfig/getconfig.man -hw/xfree86/os-support/xorgos.c -hw/xfree86/osandcommon.c -hw/xfree86/ramdac/xf86BitOrder.c -hw/xfree86/scanpci/xf86PciData.c -hw/xfree86/scanpci/xf86PciIds.h -hw/xfree86/utils/cvt/cvt -hw/xfree86/utils/cvt/cvt.man -hw/xfree86/utils/gtf/gtf -hw/xfree86/utils/gtf/gtf.1x -hw/xfree86/utils/gtf/gtf.man -hw/xfree86/utils/ioport/inb -hw/xfree86/utils/ioport/inl -hw/xfree86/utils/ioport/inw -hw/xfree86/utils/ioport/ioport -hw/xfree86/utils/ioport/outb -hw/xfree86/utils/ioport/outl -hw/xfree86/utils/ioport/outw -hw/xfree86/utils/pcitweak/pcitweak -hw/xfree86/utils/pcitweak/pcitweak.1x -hw/xfree86/utils/pcitweak/pcitweak.man -hw/xfree86/utils/scanpci/scanpci -hw/xfree86/utils/scanpci/scanpci.1x -hw/xfree86/utils/scanpci/scanpci.man -hw/xfree86/utils/xorgcfg/XOrgCfg -hw/xfree86/utils/xorgcfg/xorgcfg -hw/xfree86/utils/xorgcfg/xorgcfg.1x -hw/xfree86/utils/xorgcfg/xorgcfg.man -hw/xfree86/utils/xorgconfig/xorgconfig -hw/xfree86/utils/xorgconfig/xorgconfig.1x -hw/xfree86/utils/xorgconfig/xorgconfig.man -hw/xfree86/xaa/l-xaaBitmap.c -hw/xfree86/xaa/l-xaaStipple.c -hw/xfree86/xaa/l-xaaTEGlyph.c -hw/xfree86/xaa/l3-xaaBitmap.c -hw/xfree86/xaa/l3-xaaStipple.c -hw/xfree86/xaa/lf-xaaBitmap.c -hw/xfree86/xaa/lf-xaaStipple.c -hw/xfree86/xaa/lf-xaaTEGlyph.c -hw/xfree86/xaa/lf3-xaaBitmap.c -hw/xfree86/xaa/lf3-xaaStipple.c -hw/xfree86/xaa/m-xaaBitmap.c -hw/xfree86/xaa/m-xaaStipple.c -hw/xfree86/xaa/m-xaaTEGlyph.c -hw/xfree86/xaa/m3-xaaBitmap.c -hw/xfree86/xaa/m3-xaaStipple.c -hw/xfree86/xaa/mf-xaaBitmap.c -hw/xfree86/xaa/mf-xaaStipple.c -hw/xfree86/xaa/mf-xaaTEGlyph.c -hw/xfree86/xaa/mf3-xaaBitmap.c -hw/xfree86/xaa/mf3-xaaStipple.c -hw/xfree86/xaa/s-xaaDashLine.c -hw/xfree86/xaa/s-xaaLine.c -hw/xfree86/xf1bpp/maskbits.c -hw/xfree86/xf1bpp/mfbbitblt.c -hw/xfree86/xf1bpp/mfbbltC.c -hw/xfree86/xf1bpp/mfbbltCI.c -hw/xfree86/xf1bpp/mfbbltG.c -hw/xfree86/xf1bpp/mfbbltO.c -hw/xfree86/xf1bpp/mfbbltX.c -hw/xfree86/xf1bpp/mfbbres.c -hw/xfree86/xf1bpp/mfbbresd.c -hw/xfree86/xf1bpp/mfbclip.c -hw/xfree86/xf1bpp/mfbcmap.c -hw/xfree86/xf1bpp/mfbfillarc.c -hw/xfree86/xf1bpp/mfbfillrct.c -hw/xfree86/xf1bpp/mfbfillsp.c -hw/xfree86/xf1bpp/mfbfont.c -hw/xfree86/xf1bpp/mfbgc.c -hw/xfree86/xf1bpp/mfbgetsp.c -hw/xfree86/xf1bpp/mfbigbblak.c -hw/xfree86/xf1bpp/mfbigbwht.c -hw/xfree86/xf1bpp/mfbhrzvert.c -hw/xfree86/xf1bpp/mfbimage.c -hw/xfree86/xf1bpp/mfbline.c -hw/xfree86/xf1bpp/mfbmisc.c -hw/xfree86/xf1bpp/mfbpablack.c -hw/xfree86/xf1bpp/mfbpainv.c -hw/xfree86/xf1bpp/mfbpawhite.c -hw/xfree86/xf1bpp/mfbpgbblak.c -hw/xfree86/xf1bpp/mfbpgbinv.c -hw/xfree86/xf1bpp/mfbpgbwht.c -hw/xfree86/xf1bpp/mfbpixmap.c -hw/xfree86/xf1bpp/mfbplyblack.c -hw/xfree86/xf1bpp/mfbplyinv.c -hw/xfree86/xf1bpp/mfbplywhite.c -hw/xfree86/xf1bpp/mfbpntwin.c -hw/xfree86/xf1bpp/mfbpolypnt.c -hw/xfree86/xf1bpp/mfbpushpxl.c -hw/xfree86/xf1bpp/mfbscrclse.c -hw/xfree86/xf1bpp/mfbscrinit.c -hw/xfree86/xf1bpp/mfbseg.c -hw/xfree86/xf1bpp/mfbsetsp.c -hw/xfree86/xf1bpp/mfbteblack.c -hw/xfree86/xf1bpp/mfbtewhite.c -hw/xfree86/xf1bpp/mfbtileC.c -hw/xfree86/xf1bpp/mfbtileG.c -hw/xfree86/xf1bpp/mfbwindow.c -hw/xfree86/xf1bpp/mfbzerarc.c -hw/xfree86/xf4bpp/mfbseg.c -hw/xfree86/xf8_32bpp/cfbgc32.c -hw/xfree86/xf8_32bpp/cfbgc8.c -hw/xfree86/xorg.c -hw/xfree86/xorg.conf.example -hw/xfree86/xorg.conf.example.pre -hw/xnest/Xnest -hw/xnest/Xnest.1x -hw/xnest/Xnest.man -hw/xprint/Xprt -hw/xprint/config/C/print/Xprinters.ghostscript -hw/xprint/doc/Xprt.1x -hw/xprint/doc/Xprt.man -hw/xprint/dpmsstubs-wrapper.c -hw/xprint/miinitext-wrapper.c -include/dix-config.h -include/kdrive-config.h -include/xgl-config.h -include/xkb-config.h -include/xorg-config.h -include/xorg-server.h -include/xwin-config.h -mfb/mfbbltC.c -mfb/mfbbltCI.c -mfb/mfbbltG.c -mfb/mfbbltO.c -mfb/mfbbltX.c -mfb/mfbigbblak.c -mfb/mfbigbwht.c -mfb/mfbpablack.c -mfb/mfbpainv.c -mfb/mfbpawhite.c -mfb/mfbpgbblak.c -mfb/mfbpgbinv.c -mfb/mfbpgbwht.c -mfb/mfbplyblack.c -mfb/mfbplyinv.c -mfb/mfbplywhite.c -mfb/mfbseg.c -mfb/mfbteblack.c -mfb/mfbtewhite.c -mfb/mfbtileC.c -mfb/mfbtileG.c diff --git a/import.log b/import.log deleted file mode 100644 index 782e371..0000000 --- a/import.log +++ /dev/null @@ -1,6 +0,0 @@ -xorg-x11-server-1_5_0-1_fc10:HEAD:xorg-x11-server-1.5.0-1.fc10.src.rpm:1220485219 -xorg-x11-server-1_5_1-1_fc10:HEAD:xorg-x11-server-1.5.1-1.fc10.src.rpm:1222198557 -xorg-x11-server-1_5_2-1_fc10:HEAD:xorg-x11-server-1.5.2-1.fc10.src.rpm:1223667007 -xorg-x11-server-1_5_3-1_fc10:HEAD:xorg-x11-server-1.5.3-1.fc10.src.rpm:1225918317 -xorg-x11-server-1_6_0-1_fc11:HEAD:xorg-x11-server-1.6.0-1.fc11.src.rpm:1235594175 -xorg-x11-server-1_6_1-1_fc11:HEAD:xorg-x11-server-1.6.1-1.fc11.src.rpm:1239742477 diff --git a/make-git-snapshot.sh b/make-git-snapshot.sh deleted file mode 100755 index 0d9b2ad..0000000 --- a/make-git-snapshot.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/bin/sh - -DIRNAME=xorg-server-$( date +%Y%m%d ) - -rm -rf $DIRNAME -git clone git://git.freedesktop.org/git/xorg/xserver $DIRNAME -cd $DIRNAME -if [ -z "$1" ]; then - git log | head -1 -else - git checkout $1 -fi -git log | head -1 | awk '{ print $2 }' > ../commitid -git repack -a -d -cd .. -tar cf - $DIRNAME | xz -c9 > $DIRNAME.tar.xz -rm -rf $DIRNAME diff --git a/sources b/sources index 32cd6fa..888c6f9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (xorg-server-1.20.14.tar.xz) = be3dc32cce7d55d7e38c5f6557027f13f39224c76cc83e5800555d5ce89dbdc3731773a2d186a5b97db9fc8731a2b2dd6e9829af2b01ee2559246d4aef7c4963 +SHA512 (xorg-server-21.1.21.tar.xz) = bb2eb4e6756eb9e38b61bd47c017da44bcf5f45f2b7a906b4bb3a56b3d791cec64abb9bf37b224efe1e4fab9cc296f3672c9b2f8e00e1cdfc54337bef63cd16c diff --git a/xorg-x11-server-fb-access-wrapper.patch b/xorg-x11-server-fb-access-wrapper.patch deleted file mode 100644 index 7bb0e23..0000000 --- a/xorg-x11-server-fb-access-wrapper.patch +++ /dev/null @@ -1,31 +0,0 @@ -fb: Declare wfbFinishScreenInit, wfbScreenInit for !FB_ACCESS_WRAPPER - -xorg-x11-drv-nouveau wfbScreenInit without defining FB_ACCESS_WRAPPER -(which has other unintended side effects). Presently, this compiles -and links because compilers still support implicit function -declarations, but this is going to change fairly soon. This seems to -be the most straightforward change to keep the driver building. - -Submitted upstream: - - - -diff -ur xorg-server-1.20.14.orig/fb/fb.h xorg-server-1.20.14/fb/fb.h ---- xorg-server-1.20.14.orig/fb/fb.h 2021-12-15 20:01:24.000000000 +0100 -+++ xorg-server-1.20.14/fb/fb.h 2023-04-13 13:59:47.325341537 +0200 -@@ -1027,7 +1027,6 @@ - int dpiy, int width, /* pixel width of frame buffer */ - int bpp); /* bits per pixel of frame buffer */ - --#ifdef FB_ACCESS_WRAPPER - extern _X_EXPORT Bool - wfbFinishScreenInit(ScreenPtr pScreen, - void *pbits, -@@ -1049,7 +1048,6 @@ - int width, - int bpp, - SetupWrapProcPtr setupWrap, FinishWrapProcPtr finishWrap); --#endif - - extern _X_EXPORT Bool - fbFinishScreenInit(ScreenPtr pScreen, diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index d5cfe46..788acf9 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -1,388 +1,230 @@ -# This package is an experiment in active integration of upstream SCM with -# Fedora packaging. It works something like this: -# -# The "pristine" source is actually a git repo (with no working checkout). -# The first step of %%prep is to check it out and switch to a "fedora" branch. -# If you need to add a patch to the server, just do it like a normal git -# operation, dump it with git-format-patch to a file in the standard naming -# format, and add a PatchN: line. If you want to push something upstream, -# check out the master branch, pull, cherry-pick, and push. - # X.org requires lazy relocations to work. %undefine _hardened_build %undefine _strict_symbol_defs_build -#global gitdate 20161026 -%global stable_abi 1 - -%if !0%{?gitdate} || %{stable_abi} -# Released ABI versions. Have to keep these manually in sync with the -# source because rpm is a terrible language. +# Released ABI versions: %global ansic_major 0 %global ansic_minor 4 -%global videodrv_major 24 -%global videodrv_minor 1 +%global videodrv_major 25 +%global videodrv_minor 2 %global xinput_major 24 -%global xinput_minor 1 +%global xinput_minor 4 %global extension_major 10 %global extension_minor 0 -%endif - -%if 0%{?gitdate} -# For git snapshots, use date for major and a serial number for minor -%global minor_serial 0 -%global git_ansic_major %{gitdate} -%global git_ansic_minor %{minor_serial} -%global git_videodrv_major %{gitdate} -%global git_videodrv_minor %{minor_serial} -%global git_xinput_major %{gitdate} -%global git_xinput_minor %{minor_serial} -%global git_extension_major %{gitdate} -%global git_extension_minor %{minor_serial} -%endif %global pkgname xorg-server -Summary: X.Org X11 X server -Name: xorg-x11-server -Version: 1.20.14 -Release: 35%{?gitdate:.%{gitdate}}%{?dist} -URL: http://www.x.org +Summary: X.Org X11 X server +Name: xorg-x11-server +Version: 21.1.21 +Release: 1%{?dist} +URL: http://www.x.org # SPDX -License: Adobe-Display-PostScript AND BSD-3-Clause AND DEC-3-Clause AND HPND AND HPND-sell-MIT-disclaimer-xserver AND HPND-sell-variant AND ICU AND ISC AND MIT AND MIT-open-group AND NTP AND SGI-B-2.0 AND SMLNJ AND X11 AND X11-distribute-modifications-variant +License: Adobe-Display-PostScript AND BSD-3-Clause AND DEC-3-Clause AND HPND AND HPND-sell-MIT-disclaimer-xserver AND HPND-sell-variant AND ICU AND ISC AND MIT AND MIT-open-group AND NTP AND SGI-B-2.0 AND SMLNJ AND X11 AND X11-distribute-modifications-variant -#VCS: git:git://git.freedesktop.org/git/xorg/xserver -%if 0%{?gitdate} -# git snapshot. to recreate, run: -# ./make-git-snapshot.sh `cat commitid` -Source0: xorg-server-%{gitdate}.tar.xz -#Source0: http://www.x.org/pub/individual/xserver/%{pkgname}-%{version}.tar.bz2 -Source1: make-git-snapshot.sh -Source2: commitid -%else -Source0: https://www.x.org/pub/individual/xserver/%{pkgname}-%{version}.tar.xz -Source1: gitignore -%endif +Source0: https://www.x.org/pub/individual/xserver/%{pkgname}-%{version}.tar.xz Source10: xserver.pamd - # "useful" xvfb-run script -Source20: http://svn.exactcode.de/t2/trunk/package/xorg/xorg-server/xvfb-run.sh - +Source20: http://svn.exactcode.de/t2/trunk/package/xorg/xorg-server/xvfb-run.sh # for requires generation in drivers -Source30: xserver-sdk-abi-requires.release -Source31: xserver-sdk-abi-requires.git - +Source30: xserver-sdk-abi-requires # maintainer convenience script -Source40: driver-abi-rebuild.sh +Source40: driver-abi-rebuild.sh # From Debian use intel ddx driver only for gen4 and older chipsets -Patch1: 06_use-intel-only-on-pre-gen4.diff +Patch0: 06_use-intel-only-on-pre-gen4.diff # Default to xf86-video-modesetting on GeForce 8 and newer -Patch2: 0001-xfree86-use-modesetting-driver-by-default-on-GeForce.patch - +Patch1: 0001-xfree86-use-modesetting-driver-by-default-on-GeForce.patch # Default to va_gl on intel i965 as we use the modesetting drv there # va_gl should probably just be the default everywhere ? -Patch3: 0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch - -# Submitted upstream, but not going anywhere -Patch5: 0001-autobind-GPUs-to-the-screen.patch - +Patch2: 0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch # because the display-managers are not ready yet, do not upstream -Patch6: 0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch +Patch3: 0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch -# Not sure anyone else cares about this so let's keep this Fedora-only for now -# Upstream PR for the meson.build equivalent is here, so we can drop this patch -# when we start building with meson. -# https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1001` -Patch7: 0001-configure.ac-search-for-the-fontrootdir-ourselves.patch - -# Backports from current stable "server-1.20-branch": -# - -# Backports from "master" upstream: -Patch100: 0001-present-Check-for-NULL-to-prevent-crash.patch -Patch101: 0001-render-Fix-build-with-gcc-12.patch -Patch102: 0001-xf86-Accept-devices-with-the-simpledrm-driver.patch -Patch103: 0001-Don-t-hardcode-fps-for-fake-screen.patch -Patch104: 0001-hw-Rename-boolean-config-value-field-from-bool-to-bo.patch -Patch105: 0001-add-a-quirk-for-apple-silicon.patch - -# CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070 -Patch110: 0001-xkb-switch-to-array-index-loops-to-moving-pointers.patch -Patch111: 0002-xkb-swap-XkbSetDeviceInfo-and-XkbSetDeviceInfoCheck.patch -Patch112: 0003-xkb-add-request-length-validation-for-XkbSetGeometry.patch - -# CVE-2022-3550 -Patch113: 0001-xkb-proof-GetCountedString-against-request-length-at.patch -# CVE-2022-3551 -Patch114: 0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch - -# CVE-2022-46340 -Patch115: 0001-Xtest-disallow-GenericEvents-in-XTestSwapFakeInput.patch -# related to CVE-2022-46344 -Patch116: 0002-Xi-return-an-error-from-XI-property-changes-if-verif.patch -# CVE-2022-46344 -Patch117: 0003-Xi-avoid-integer-truncation-in-length-check-of-ProcX.patch -# CVE-2022-46341 -Patch118: 0004-Xi-disallow-passive-grabs-with-a-detail-255.patch -# CVE-2022-46343 -Patch119: 0005-Xext-free-the-screen-saver-resource-when-replacing-i.patch -# CVE-2022-46342 -Patch120: 0006-Xext-free-the-XvRTVideoNotify-when-turning-off-from-.patch -# CVE-2022-46283 -Patch121: 0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch -# Fix for buggy patch to CVE-2022-46340 -Patch122: 0008-Xext-fix-invalid-event-type-mask-in-XTestSwapFakeInp.patch -# CVE-2023-0494 -Patch123: 0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch -# CVE-2023-1393 -Patch124: 0001-composite-Fix-use-after-free-of-the-COW.patch -# https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1114 -Patch125: xorg-x11-server-fb-access-wrapper.patch -# https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1057 -Patch126: 0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch - -# CVE-2023-5367 -Patch1010: 0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch -# CVE-2023-5380 -Patch1011: 0002-mi-reset-the-PointerWindows-reference-on-screen-swit.patch -# CVE-2023-6377 -Patch1012: 0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch -# CVE-2023-6478 -Patch1013: 0001-randr-avoid-integer-truncation-in-length-check-of-Pr.patch -# CVE-2023-6816 -Patch1014: 0001-dix-allocate-enough-space-for-logical-button-maps.patch -# CVE-2024-0229 -Patch1015: 0002-dix-Allocate-sufficient-xEvents-for-our-DeviceStateN.patch -Patch1016: 0003-dix-fix-DeviceStateNotify-event-calculation.patch -Patch1017: 0004-Xi-when-creating-a-new-ButtonClass-set-the-number-of.patch -# CVE-2024-21885 -Patch1018: 0005-Xi-flush-hierarchy-events-after-adding-removing-mast.patch -# CVE-2024-21886 -Patch1019: 0006-Xi-do-not-keep-linked-list-pointer-during-recursion.patch -Patch1020: 0007-dix-when-disabling-a-master-float-disabled-slaved-de.patch -# CVE-2024-0408 -Patch1021: 0008-glx-Call-XACE-hooks-on-the-GLX-buffer.patch -# CVE-2024-0409 -Patch1022: 0009-ephyr-xwayland-Use-the-proper-private-key-for-cursor.patch -# Related to CVE-2024-21886 -Patch1023: 0001-dix-Fix-use-after-free-in-input-device-shutdown.patch -# Fix compilation error on i686 -Patch1024: 0001-ephyr-Fix-incompatible-pointer-type-build-error.patch -# Fix copy and paste error in CVE-2024-0229 -Patch1025: 0001-dix-fix-valuator-copy-paste-error-in-the-DeviceState.patch -# CVE-2024-31080 -Patch1026: 0001-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch -# CVE-2024-31081 -Patch1027: 0002-Xi-ProcXIPassiveGrabDevice-needs-to-use-unswapped-le.patch -# CVE-2024-31082 -Patch1028: 0003-Xquartz-ProcAppleDRICreatePixmap-needs-to-use-unswap.patch -# CVE-2024-31083 -Patch1029: 0004-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch -Patch1030: 0001-render-Avoid-possible-double-free-in-ProcRenderAddGl.patch - -## Add new patches above; Fedora-specific patches below - -# Only on F38 and later (patch number starts at 3801, see autopatch below) -# Upstream commits 73d6e88, f69280dd and 4127776, minus the xwayland.pc.in change -Patch3801: 0001-Disallow-byte-swapped-clients-by-default.patch - -BuildRequires: make -BuildRequires: systemtap-sdt-devel -BuildRequires: git-core -BuildRequires: automake autoconf libtool pkgconfig -BuildRequires: xorg-x11-util-macros >= 1.17 - -BuildRequires: xorg-x11-proto-devel >= 7.7-10 - -BuildRequires: dbus-devel libepoxy-devel systemd-devel -BuildRequires: xorg-x11-xtrans-devel >= 1.3.2 -BuildRequires: libXfont2-devel libXau-devel libxkbfile-devel libXres-devel -BuildRequires: libfontenc-devel libXtst-devel libXdmcp-devel -BuildRequires: libX11-devel libXext-devel -BuildRequires: libXinerama-devel libXi-devel - -# DMX config utils buildreqs. -BuildRequires: libXt-devel libdmx-devel libXmu-devel libXrender-devel -BuildRequires: libXi-devel libXpm-devel libXaw-devel libXfixes-devel - -BuildRequires: pkgconfig(epoxy) -BuildRequires: pkgconfig(xshmfence) >= 1.1 -BuildRequires: libXv-devel -BuildRequires: pixman-devel >= 0.30.0 -BuildRequires: libpciaccess-devel >= 0.13.1 openssl-devel bison flex -BuildRequires: mesa-libGL-devel >= 9.2 -BuildRequires: mesa-libEGL-devel -BuildRequires: mesa-libgbm-devel -# XXX silly... -BuildRequires: libdrm-devel >= 2.4.0 kernel-headers - -BuildRequires: audit-libs-devel libselinux-devel >= 2.0.86-1 -BuildRequires: libudev-devel -# libunwind is Exclusive for the following arches -%ifarch aarch64 %{arm} hppa ia64 mips ppc ppc64 %{ix86} x86_64 -%if !0%{?rhel} -BuildRequires: libunwind-devel -%endif -%endif - -BuildRequires: pkgconfig(xcb-aux) pkgconfig(xcb-image) pkgconfig(xcb-icccm) -BuildRequires: pkgconfig(xcb-keysyms) pkgconfig(xcb-renderutil) +BuildRequires: bison +BuildRequires: flex +BuildRequires: gawk +BuildRequires: gcc +BuildRequires: kernel-headers +BuildRequires: libXi-devel +BuildRequires: libXinerama-devel +BuildRequires: libXres-devel +BuildRequires: libXv-devel +BuildRequires: make +BuildRequires: mesa-libEGL-devel +BuildRequires: mesa-libGL-devel >= 9.2 +BuildRequires: meson +BuildRequires: pkgconfig +BuildRequires: pkgconfig(audit) +BuildRequires: pkgconfig(bigreqsproto) >= 1.1.0 +BuildRequires: pkgconfig(compositeproto) >= 0.4 +BuildRequires: pkgconfig(damageproto) >= 1.1 +BuildRequires: pkgconfig(dbus-1) >= 1.0 +BuildRequires: pkgconfig(dri2proto) >= 2.8 +BuildRequires: pkgconfig(dri3proto) >= 1.2 +BuildRequires: pkgconfig(epoxy) +BuildRequires: pkgconfig(epoxy) >= 1.5.4 +BuildRequires: pkgconfig(fixesproto) >= 6.0 +BuildRequires: pkgconfig(fontsproto) >= 2.1.3 +BuildRequires: pkgconfig(gbm) >= 10.2 +BuildRequires: pkgconfig(inputproto) >= 2.3.99.1 +BuildRequires: pkgconfig(kbproto) >= 1.0.3 +BuildRequires: pkgconfig(libdrm) >= 2.4.89 +BuildRequires: pkgconfig(libselinux) >= 2.0.86 +BuildRequires: pkgconfig(libsystemd) >= 209 +BuildRequires: pkgconfig(libudev) >= 143 +BuildRequires: pkgconfig(libunwind) +BuildRequires: pkgconfig(libxcvt) +BuildRequires: pkgconfig(openssl) +BuildRequires: pkgconfig(pciaccess) >= 0.12.901 +BuildRequires: pkgconfig(pixman-1) +BuildRequires: pkgconfig(randrproto) >= 1.6.0 +BuildRequires: pkgconfig(recordproto) >= 1.13.99.1 +BuildRequires: pkgconfig(renderproto) >= 0.11 +BuildRequires: pkgconfig(resourceproto) >= 1.2.0 +BuildRequires: pkgconfig(scrnsaverproto) >= 1.1 +BuildRequires: pkgconfig(videoproto) +BuildRequires: pkgconfig(x11) +BuildRequires: pkgconfig(x11-xcb) +BuildRequires: pkgconfig(xau) +BuildRequires: pkgconfig(xcb-aux) +BuildRequires: pkgconfig(xcb-icccm) +BuildRequires: pkgconfig(xcb-image) +BuildRequires: pkgconfig(xcb-keysyms) +BuildRequires: pkgconfig(xcb-renderutil) +BuildRequires: pkgconfig(xcmiscproto) >= 1.2.0 +BuildRequires: pkgconfig(xdmcp) +BuildRequires: pkgconfig(xext) >= 1.0.99.4 +BuildRequires: pkgconfig(xextproto) >= 7.2.99.901 +BuildRequires: pkgconfig(xf86bigfontproto) >= 1.2.0 +BuildRequires: pkgconfig(xf86vidmodeproto) >= 2.2.99.1 +BuildRequires: pkgconfig(xfont2) >= 2.0 +BuildRequires: pkgconfig(xineramaproto) +BuildRequires: pkgconfig(xkbfile) +BuildRequires: pkgconfig(xproto) >= 7.0.31 +BuildRequires: pkgconfig(xshmfence) >= 1.1 +BuildRequires: pkgconfig(xtrans) >= 1.3.5 +BuildRequires: pkgconfig(xtrans) >= 1.3.5 +BuildRequires: systemtap-sdt-devel +BuildRequires: xorg-x11-util-macros >= 1.17 +BuildRequires: xorg-x11-xtrans-devel >= 1.3.2 %description -X.Org X11 X server +X.Org X11 X server. -%package common -Summary: Xorg server common files -Requires: pixman >= 0.30.0 -Requires: xkeyboard-config xkbcomp +%package common +Summary: Xorg server common files +Requires: pixman +Requires: xkbcomp +Requires: xkeyboard-config -%description common +%description common Common files shared among all X servers. -%package Xorg -Summary: Xorg X server -Provides: Xorg = %{version}-%{release} -Provides: Xserver +%package Xorg +Summary: Xorg X server +Requires: libEGL +Requires: system-setup-keyboard +Requires: xorg-x11-drv-libinput +Requires: xorg-x11-server-common >= %{version}-%{release} +Provides: Xorg = %{version}-%{release} +Provides: Xserver # HdG: This should be moved to the wrapper package once the wrapper gets # its own sub-package: -Provides: xorg-x11-server-wrapper = %{version}-%{release} -%if !0%{?gitdate} || %{stable_abi} -Provides: xserver-abi(ansic-%{ansic_major}) = %{ansic_minor} -Provides: xserver-abi(videodrv-%{videodrv_major}) = %{videodrv_minor} -Provides: xserver-abi(xinput-%{xinput_major}) = %{xinput_minor} -Provides: xserver-abi(extension-%{extension_major}) = %{extension_minor} -%endif -%if 0%{?gitdate} -Provides: xserver-abi(ansic-%{git_ansic_major}) = %{git_ansic_minor} -Provides: xserver-abi(videodrv-%{git_videodrv_major}) = %{git_videodrv_minor} -Provides: xserver-abi(xinput-%{git_xinput_major}) = %{git_xinput_minor} -Provides: xserver-abi(extension-%{git_extension_major}) = %{git_extension_minor} -%endif -Obsoletes: xorg-x11-glamor < %{version}-%{release} -Provides: xorg-x11-glamor = %{version}-%{release} -Obsoletes: xorg-x11-drv-modesetting < %{version}-%{release} -Provides: xorg-x11-drv-modesetting = %{version}-%{release} -# Dropped from F25 -Obsoletes: xorg-x11-drv-vmmouse < 13.1.0-4 +Provides: xorg-x11-server-wrapper = %{version}-%{release} +Provides: xserver-abi(ansic-%{ansic_major}) = %{ansic_minor} +Provides: xserver-abi(videodrv-%{videodrv_major}) = %{videodrv_minor} +Provides: xserver-abi(xinput-%{xinput_major}) = %{xinput_minor} +Provides: xserver-abi(extension-%{extension_major}) = %{extension_minor} +# Dropped from xorg-x11-server-21.1 +# https://gitlab.freedesktop.org/xorg/xserver/-/commit/b3b81c8c2090cd49410960a021baf0d27fdd2ab3 +Obsoletes: xorg-x11-server-Xdmx < 1.20.15 +# Legacy fbdev devices have been replaced with simpledrm: +# https://fedoraproject.org/wiki/Changes/ReplaceFbdevDrivers +Obsoletes: xorg-x11-drv-fbdev < 0.5.0-19 +Obsoletes: xorg-x11-drv-vesa < 2.6.0-3 +Obsoletes: xorg-x11-drv-armsoc < 1.4.1-10 -Requires: xorg-x11-server-common >= %{version}-%{release} -Requires: system-setup-keyboard -Requires: xorg-x11-drv-libinput -Requires: libEGL - -%description Xorg -X.org X11 is an open source implementation of the X Window System. It -provides the basic low level functionality which full fledged -graphical user interfaces (GUIs) such as GNOME and KDE are designed -upon. +%description Xorg +X.org X11 is an open source implementation of the X Window System. It provides +the basic low level functionality which full fledged graphical user interfaces +(GUIs) such as GNOME and KDE are designed upon. -%package Xnest -Summary: A nested server -Requires: xorg-x11-server-common >= %{version}-%{release} -Provides: Xnest +%package Xnest +Summary: A nested server +Requires: xorg-x11-server-common >= %{version}-%{release} +Provides: Xnest -%description Xnest -Xnest is an X server which has been implemented as an ordinary -X application. It runs in a window just like other X applications, -but it is an X server itself in which you can run other software. It -is a very useful tool for developers who wish to test their -applications without running them on their real X server. +%description Xnest +Xnest is an X server which has been implemented as an ordinary X application. It +runs in a window just like other X applications, but it is an X server itself in +which you can run other software. It is a very useful tool for developers who +wish to test their applications without running them on their real X server. -%package Xdmx -Summary: Distributed Multihead X Server and utilities -Requires: xorg-x11-server-common >= %{version}-%{release} -Provides: Xdmx - -%description Xdmx -Xdmx is proxy X server that provides multi-head support for multiple displays -attached to different machines (each of which is running a typical X server). -When Xinerama is used with Xdmx, the multiple displays on multiple machines -are presented to the user as a single unified screen. A simple application -for Xdmx would be to provide multi-head support using two desktop machines, -each of which has a single display device attached to it. A complex -application for Xdmx would be to unify a 4 by 4 grid of 1280x1024 displays -(each attached to one of 16 computers) into a unified 5120x4096 display. - - -%package Xvfb -Summary: A X Windows System virtual framebuffer X server +%package Xvfb +Summary: A X Windows System virtual framebuffer X server # xvfb-run is GPLv2, rest is MIT -License: MIT and GPLv2 -Requires: xorg-x11-server-common >= %{version}-%{release} +License: MIT and GPL-2.0-only +Requires: xorg-x11-server-common >= %{version}-%{release} # required for xvfb-run -Requires: xorg-x11-xauth -Requires: util-linux -Provides: Xvfb +Requires: xorg-x11-xauth +Provides: Xvfb +Requires: util-linux -%description Xvfb -Xvfb (X Virtual Frame Buffer) is an X server that is able to run on -machines with no display hardware and no physical input devices. -Xvfb simulates a dumb framebuffer using virtual memory. Xvfb does -not open any devices, but behaves otherwise as an X display. Xvfb -is normally used for testing servers. +%description Xvfb +Xvfb (X Virtual Frame Buffer) is an X server that is able to run on machines +with no display hardware and no physical input devices. Xvfb simulates a dumb +framebuffer using virtual memory. Xvfb does not open any devices, but behaves +otherwise as an X display. Xvfb is normally used for testing servers. -%package Xephyr -Summary: A nested server -Requires: xorg-x11-server-common >= %{version}-%{release} -Provides: Xephyr +%package Xephyr +Summary: A nested server +Requires: xorg-x11-server-common >= %{version}-%{release} +Provides: Xephyr -%description Xephyr -Xephyr is an X server which has been implemented as an ordinary -X application. It runs in a window just like other X applications, -but it is an X server itself in which you can run other software. It -is a very useful tool for developers who wish to test their -applications without running them on their real X server. Unlike -Xnest, Xephyr renders to an X image rather than relaying the -X protocol, and therefore supports the newer X extensions like -Render and Composite. +%description Xephyr +Xephyr is an X server which has been implemented as an ordinary X application. +It runs in a window just like other X applications, but it is an X server itself +in which you can run other software. It is a very useful tool for developers who +wish to test their applications without running them on their real X server. +Unlike Xnest, Xephyr renders to an X image rather than relaying the X protocol, +and therefore supports the newer X extensions like Render and Composite. -%package devel -Summary: SDK for X server driver module development -Requires: xorg-x11-util-macros -Requires: xorg-x11-proto-devel -Requires: libXfont2-devel -Requires: pkgconfig pixman-devel libpciaccess-devel -Provides: xorg-x11-server-static -Obsoletes: xorg-x11-glamor-devel < %{version}-%{release} -Provides: xorg-x11-glamor-devel = %{version}-%{release} +%package devel +Summary: SDK for X server driver module development +Requires: libpciaccess-devel +Requires: libXfont2-devel +Requires: xorg-x11-proto-devel +Requires: xorg-x11-util-macros +Requires: pixman-devel +Requires: pkgconfig +Provides: xorg-x11-server-static %description devel The SDK package provides the developmental files which are necessary for -developing X server driver modules, and for compiling driver modules -outside of the standard X11 source code tree. Developers writing video -drivers, input drivers, or other X modules should install this package. +developing X server driver modules, and for compiling driver modules outside of +the standard X11 source code tree. Developers writing video drivers, input +drivers, or other X modules should install this package. -%package source -Summary: Xserver source code required to build VNC server (Xvnc) -BuildArch: noarch +%package source +Summary: Xserver source code required to build VNC server (Xvnc) +BuildArch: noarch -%description source -Xserver source code needed to build VNC server (Xvnc) +%description source +Xserver source code needed to build VNC server (Xvnc). %prep -%autosetup -N -n %{pkgname}-%{?gitdate:%{gitdate}}%{!?gitdate:%{version}} -rm -rf .git -cp %{SOURCE1} .gitignore -# ick -%global __scm git -%{expand:%__scm_setup_git -q} -%if 0%{?fedora} >= 38 -%autopatch -%else -%autopatch -M 3800 -%endif +%autosetup -p1 -n %{pkgname}-%{version} -%if 0%{?stable_abi} # check the ABI in the source against what we expect. getmajor() { grep -i ^#define.ABI.$1_VERSION hw/xfree86/common/xf86Module.h | @@ -403,76 +245,80 @@ test `getminor xinput` == %{xinput_minor} test `getmajor extension` == %{extension_major} test `getminor extension` == %{extension_minor} -%endif - %build +%meson \ + -D agp=auto \ + -D builder_string="Build ID: %{name} %{version}-%{release}" \ + -D default_font_path="catalogue:/etc/X11/fontpath.d,built-ins" \ + -D devel-docs=false \ + -D dga=true \ + -D docs-pdf=false \ + -D docs=false \ + -D dpms=true \ + -D dri1=false \ + -D dri2=true \ + -D dri3=true \ + -D drm=true \ + -D dtrace=false \ + -D fallback_input_driver=libinput \ + -D glamor=true \ + -D glx=true \ + -D hal=false \ + -D input_thread=true \ + -D int10=false \ + -D ipv6=true \ + -D libunwind=true \ + -D linux_acpi=false \ + -D linux_apm=false \ + -D listen_local=true \ + -D listen_tcp=false \ + -D listen_unix=true \ + -D log_dir="%{_localstatedir}/log" \ + -D mitshm=auto \ + -D module_dir="%{_libdir}/xorg/modules" \ + -D pciaccess=true \ + -D screensaver=true \ + -D secure-rpc=false \ + -D sha1=libcrypto \ + -D suid_wrapper=true \ + -D systemd_logind=true \ + -D udev_kms=true \ + -D udev=true \ + -D vgahw=true \ + -D xace=true \ + -D xcsecurity=true \ + -D xdm-auth-1=true \ + -D xdmcp=true \ + -D xephyr=true \ + -D xf86bigfont=false \ + -D xf86-input-inputtest=true \ + -D xinerama=true \ + -D xkb_output_dir="%{_localstatedir}/lib/xkb" \ + -D xnest=true \ + -D xorg=true \ + -D xpbproxy=false \ + -D xquartz=false \ + -D xres=true \ + -D xselinux=true \ + -D xvfb=true \ + -D xvmc=true \ + -D xv=true \ + -D xwin=false -export CFLAGS="$RPM_OPT_FLAGS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1" -export CXXFLAGS="$RPM_OPT_FLAGS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1" -export LDFLAGS="$RPM_LD_FLAGS -specs=/usr/lib/rpm/redhat/redhat-hardened-ld" - -%if !0%{?rhel} -%ifarch %{ix86} x86_64 -%global int10_arch 1 -%endif -%endif - -%if %{undefined int10_arch} -%global no_int10 --disable-vbe --disable-int10-module -%endif - -%global kdrive --enable-kdrive --enable-xephyr --disable-xfake --disable-xfbdev -%global xservers --enable-xvfb --enable-xnest %{kdrive} --enable-xorg -%global default_font_path "catalogue:/etc/X11/fontpath.d,built-ins" -%global dri_flags --disable-dri --enable-dri2 %{?!rhel:--enable-dri3} --enable-suid-wrapper --enable-glamor - -autoreconf -f -v --install || exit 1 - -%configure %{xservers} \ - --enable-dependency-tracking \ - --disable-static \ - --with-pic \ - %{?no_int10} \ - --with-default-font-path=%{default_font_path} \ - --with-module-dir=%{_libdir}/xorg/modules \ - --with-builderstring="Build ID: %{name} %{version}-%{release}" \ - --with-os-name="$(hostname -s) $(uname -r)" \ - --with-xkb-output=%{_localstatedir}/lib/xkb \ - --without-dtrace \ - --disable-linux-acpi --disable-linux-apm \ - --enable-xselinux --enable-record --enable-present \ - --enable-xcsecurity \ - --enable-config-udev \ - --disable-unit-tests \ - --enable-dmx \ - --disable-xwayland \ - %{dri_flags} \ - ${CONFIGURE} - -make V=1 %{?_smp_mflags} - +%meson_build %install -%make_install +%meson_install -mkdir -p $RPM_BUILD_ROOT%{_libdir}/xorg/modules/{drivers,input} - -mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d -install -m 644 %{SOURCE10} $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/xserver +install -D -m 0644 -p xkb/README.compiled %{buildroot}%{_localstatedir}/lib/xkb/README.compiled +install -D -m 0644 %{SOURCE10} %{buildroot}%{_sysconfdir}/pam.d/xserver # make sure the (empty) /etc/X11/xorg.conf.d is there, system-setup-keyboard # relies on it more or less. -mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/X11/xorg.conf.d +mkdir -p %{buildroot}%{_sysconfdir}/X11/xorg.conf.d -%if %{stable_abi} -install -m 755 %{SOURCE30} $RPM_BUILD_ROOT%{_bindir}/xserver-sdk-abi-requires -%else -sed -e s/@MAJOR@/%{gitdate}/g -e s/@MINOR@/%{minor_serial}/g %{SOURCE31} > \ - $RPM_BUILD_ROOT%{_bindir}/xserver-sdk-abi-requires -chmod 755 $RPM_BUILD_ROOT%{_bindir}/xserver-sdk-abi-requires -%endif - -install -m 0755 %{SOURCE20} $RPM_BUILD_ROOT%{_bindir}/xvfb-run +install -D -m 0755 %{SOURCE30} %{buildroot}%{_bindir}/xserver-sdk-abi-requires +install -D -m 0755 %{SOURCE20} %{buildroot}%{_bindir}/xvfb-run # Make the source package %global xserver_source_dir %{_datadir}/xorg-x11-server-source @@ -483,24 +329,18 @@ mkdir -p %{inst_srcdir}/{hw/dmx/doc,man,doc,hw/dmx/doxygen} cp {,%{inst_srcdir}/}hw/xquartz/bundle/cpprules.in cp {,%{inst_srcdir}/}man/Xserver.man cp {,%{inst_srcdir}/}doc/smartsched -cp {,%{inst_srcdir}/}hw/dmx/doxygen/doxygen.conf.in +#cp {,%{inst_srcdir}/}hw/dmx/doxygen/doxygen.conf.in cp {,%{inst_srcdir}/}xserver.ent.in cp {,%{inst_srcdir}/}hw/xfree86/Xorg.sh.in cp xkb/README.compiled %{inst_srcdir}/xkb cp hw/xfree86/xorgconf.cpp %{inst_srcdir}/hw/xfree86 -find . -type f | egrep '.*\.(c|h|am|ac|inc|m4|h.in|pc.in|man.pre|pl|txt)$' | +find . -type f -not -path "./%{_vpath_builddir}/*" | egrep '.*\.(c|h|am|ac|inc|m4|h.in|pc.in|man.pre|pl|txt)$' | xargs tar cf - | (cd %{inst_srcdir} && tar xf -) find %{inst_srcdir}/hw/xfree86 -name \*.c -delete # Remove unwanted files/dirs -{ - find $RPM_BUILD_ROOT -type f -name '*.la' | xargs rm -f -- || : -# wtf -%ifnarch %{ix86} x86_64 - rm -f $RPM_BUILD_ROOT%{_libdir}/xorg/modules/lib{int10,vbe}.so -%endif -} +find %{buildroot} -type f -name '*.la' -delete %files common @@ -510,21 +350,15 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %dir %{_localstatedir}/lib/xkb %{_localstatedir}/lib/xkb/README.compiled -%if 1 -%global Xorgperms %attr(4755, root, root) -%else -# disable until module loading is audited -%global Xorgperms %attr(0711,root,root) %caps(cap_sys_admin,cap_sys_rawio,cap_dac_override=pe) -%endif - %files Xorg %config %attr(0644,root,root) %{_sysconfdir}/pam.d/xserver +%{_bindir}/gtf %{_bindir}/X %{_bindir}/Xorg %{_libexecdir}/Xorg -%{Xorgperms} %{_libexecdir}/Xorg.wrap -%{_bindir}/cvt -%{_bindir}/gtf +# Disable until module loading is audited +# %attr(0711,root,root) %caps(cap_sys_admin,cap_sys_rawio,cap_dac_override=pe) +%attr(4755, root, root) %{_libexecdir}/Xorg.wrap %dir %{_libdir}/xorg %dir %{_libdir}/xorg/modules %dir %{_libdir}/xorg/modules/drivers @@ -532,28 +366,25 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %dir %{_libdir}/xorg/modules/extensions %{_libdir}/xorg/modules/extensions/libglx.so %dir %{_libdir}/xorg/modules/input -%{_libdir}/xorg/modules/libfbdevhw.so +%{_libdir}/xorg/modules/input/inputtest_drv.so %{_libdir}/xorg/modules/libexa.so -%{_libdir}/xorg/modules/libfb.so +%{_libdir}/xorg/modules/libfbdevhw.so +#%%{_libdir}/xorg/modules/libfb.so %{_libdir}/xorg/modules/libglamoregl.so %{_libdir}/xorg/modules/libshadow.so %{_libdir}/xorg/modules/libshadowfb.so %{_libdir}/xorg/modules/libvgahw.so %{_libdir}/xorg/modules/libwfb.so -%if %{defined int10_arch} -%{_libdir}/xorg/modules/libint10.so -%{_libdir}/xorg/modules/libvbe.so -%endif %{_mandir}/man1/gtf.1* %{_mandir}/man1/Xorg.1* %{_mandir}/man1/Xorg.wrap.1* -%{_mandir}/man1/cvt.1* -%{_mandir}/man4/fbdevhw.4* %{_mandir}/man4/exa.4* +%{_mandir}/man4/fbdevhw.4* +%{_mandir}/man4/inputtestdrv.4* %{_mandir}/man4/modesetting.4* -%{_mandir}/man5/Xwrapper.config.5* %{_mandir}/man5/xorg.conf.5* %{_mandir}/man5/xorg.conf.d.5* +%{_mandir}/man5/Xwrapper.config.5* %dir %{_sysconfdir}/X11/xorg.conf.d %dir %{_datadir}/X11/xorg.conf.d %{_datadir}/X11/xorg.conf.d/10-quirks.conf @@ -562,24 +393,6 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %{_bindir}/Xnest %{_mandir}/man1/Xnest.1* -%files Xdmx -%{_bindir}/Xdmx -%{_bindir}/dmxaddinput -%{_bindir}/dmxaddscreen -%{_bindir}/dmxreconfig -%{_bindir}/dmxresize -%{_bindir}/dmxrminput -%{_bindir}/dmxrmscreen -%{_bindir}/dmxtodmx -%{_bindir}/dmxwininfo -%{_bindir}/vdltodmx -%{_bindir}/dmxinfo -%{_bindir}/xdmxconfig -%{_mandir}/man1/Xdmx.1* -%{_mandir}/man1/dmxtodmx.1* -%{_mandir}/man1/vdltodmx.1* -%{_mandir}/man1/xdmxconfig.1* - %files Xvfb %{_bindir}/Xvfb %{_bindir}/xvfb-run @@ -591,7 +404,6 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %files devel %doc COPYING -#{_docdir}/xorg-server %{_bindir}/xserver-sdk-abi-requires %{_libdir}/pkgconfig/xorg-server.pc %dir %{_includedir}/xorg @@ -603,6 +415,90 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %changelog +* Tue Nov 25 2025 Olivier Fourdan - 21.1.21-1 +- Update to xserver 21.1.21 (#2417000) + +* Tue Oct 28 2025 Olivier Fourdan - 21.1.20-1 +- Update to xserver 21.1.20 (#2406803) +- CVE fix for: CVE-2025-62229, CVE-2025-62230, CVE-2025-62231 + +* Fri Jul 25 2025 Fedora Release Engineering - 21.1.18-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Wed Jul 09 2025 Peter Hutterer +- Update Xvfb SPDX license identifier + +* Wed Jun 18 2025 Olivier Fourdan - 21.1.18-1 +- Update to xserver 21.1.18 +- Contains an additional fix for CVE-2025-49176 + +* Tue Jun 17 2025 Olivier Fourdan - 21.1.17-1 +- Update to xserver 21.1.17 +- CVE fix for: CVE-2025-49175, CVE-2025-49176, CVE-2025-49177 + CVE-2025-49178, CVE-2025-49179, CVE-2025-49180 + +* Wed Feb 26 2025 Olivier Fourdan - 21.1.16-1 +- Update to xserver 21.1.16 (#2347558) +- CVE fix for: CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597, + CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601 + +* Tue Feb 25 2025 Olivier Fourdan - 21.1.15-3 +- Fix DRI2 failure (#2347345) + +* Sun Jan 19 2025 Fedora Release Engineering - 21.1.15-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Fri Dec 20 2024 José Expósito - 21.1.15-1 +- Update to v21.1.15 + +* Fri Nov 29 2024 Sérgio Basto - 21.1.14-3 +- Revert commit "Fix error copying Xorg.wrap", debugedit-5.1-2 have the real fix + +* Mon Nov 18 2024 José Expósito - 21.1.14-2 +- Fix build issues caused by Xorg.wrap +- Restore quirks for Apple silicon + Fixes: 422064e45a42 ("Update X11-server to 21.1.13 and ABI numbers of videodrv and xinput") + Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2326701 + +* Tue Oct 29 2024 José Expósito - 21.1.14-1 +- Update to v21.1.14 + +* Wed Oct 16 2024 Peter Robinson +- Obsolete xorg-x11-drv-armsoc + +* Mon Sep 30 2024 Simone Caronni - 21.1.13-5 +- After removal of int10/vbe, obsolete vesa and fbdev X drivers: + https://fedoraproject.org/wiki/Changes/ReplaceFbdevDrivers + +* Sat Sep 28 2024 Simone Caronni - 21.1.13-4 +- Remove all conditionals. Drop int10 everywhere and enable libunwind/dri3 on + ELN. + +* Fri Sep 27 2024 Simone Caronni - 21.1.13-3 +- Switch to meson, drop no longer required patch. +- Drop Obsoletes/Provides that have been removed in ~2014. +- Add build depdendencies as they are searched by meson. +- Format SPEC file. + +* Thu Sep 26 2024 Simone Caronni - 21.1.13-2 +- Drop support for building snapshots. If they need to be built, there are + anyway more simpler ways. +- Trim changelog. +- Drop custom compileri/linker flags that are part of the standard already. + +* Mon Sep 02 2024 Sérgio Basto - 21.1.13-1 +- Update X11-server to 21.1.13 and ABI numbers of videodrv and xinput +- DMX DDX was dropped +- 0001-Disallow-byte-swapped-clients-by-default.patch is upstreamed +- 0001-autobind-GPUs-to-the-screen.patch is upstreamed +- 0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch updated + +* Sat Jul 20 2024 Fedora Release Engineering - 1.20.14-37 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Wed Apr 10 2024 José Expósito - 1.20.14-35 +- Backport fix for invalid Unicode sequence + * Wed Apr 10 2024 José Expósito - 1.20.14-35 - Fix regression caused by the fix for CVE-2024-31083 @@ -714,286 +610,3 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete * Sat Jan 22 2022 Fedora Release Engineering - 1.20.14-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Fri Dec 17 2021 Olivier - 1.20.14-1 -- xserver 1.20.14 - CVE-2021-4008/ZDI-CAN-14192 (#2026059, #2032941) - CVE-2021-4009/ZDI-CAN-14950 (#2026072, #2032943) - CVE-2021-4010/ZDI-CAN-14951 (#2026073, #2032944) - CVE-2021-4011/ZDI-CAN-14952 (#2026074, #2032945) - -* Tue Sep 14 2021 Sahana Prasad - 1.20.11-3 -- Rebuilt with OpenSSL 3.0.0 - -* Fri Jul 23 2021 Fedora Release Engineering - 1.20.11-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Wed Apr 14 2021 Olivier Fourdan - 1.20.11-1 -- xserver 1.20.11 (CVE-2021-3472 / ZDI-CAN-1259) - -* Wed Feb 03 2021 Peter Hutterer 1.20.10-5 -- Drop BuildRequires for flex-devel (#1871101) - -* Mon Feb 1 2021 Olivier Fourdan - 1.20.10-4 -- Remove Xwayland from the xserver builds - -* Thu Jan 28 2021 Fedora Release Engineering - 1.20.10-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Tue Jan 19 2021 Adam Jackson - 1.20.10-2 -- Disable int10 and vbe on RHEL -- Disable DRI1 -- Stop overriding the vendor name - -* Wed Dec 2 2020 Olivier Fourdan - 1.20.10-1 -- xserver 1.20.10 (CVE-2020-14360, CVE-2020-25712) - -* Thu Nov 5 10:35:09 AEST 2020 Peter Hutterer - 1.20.9-3 -- Add BuildRequires for make - -* Wed Nov 04 2020 Peter Hutterer 1.20.9-2 -- Drop BuildRequires to git-core only - -* Thu Oct 8 2020 Olivier Fourdan - 1.20.9-1 -- xserver 1.20.9 + all current fixes from upstream - -* Wed Aug 12 2020 Adam Jackson - 1.20.8-4 -- Enable XC-SECURITY - -* Fri Jul 31 2020 Adam Jackson - 1.20.8-3 -- Fix information disclosure bug in pixmap allocation (CVE-2020-14347) - -* Wed Jul 29 2020 Fedora Release Engineering - 1.20.8-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Mon Mar 30 2020 Olivier Fourdan - 1.20.8-1 -- xserver 1.20.8 -- Backport latest Xwayland randr resolution change emulation support - patches. - -* Wed Mar 18 2020 Olivier Fourdan - 1.20.7-2 -- Fix a crash on closing a window using Present found upstream: - https://gitlab.freedesktop.org/xorg/xserver/issues/1000 - -* Fri Mar 13 2020 Olivier Fourdan - 1.20.7-1 -- xserver 1.20.7 -- backport from stable "xserver-1.20-branch" up to commit ad7364d8d - (for mutter fullscreen unredirect on Wayland) -- Update videodrv minor ABI as 1.20.7 changed the minor ABI version - (backward compatible, API addition in glamor) -- Rebase Xwayland randr resolution change emulation support patches - -* Fri Jan 31 2020 Fedora Release Engineering - 1.20.6-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Mon Nov 25 2019 Olivier Fourdan - 1.20.6-1 -- xserver 1.20.6 - -* Mon Nov 4 2019 Hans de Goede - 1.20.5-9 -- Fix building with new libglvnd-1.2.0 (E)GL headers and pkgconfig files - -* Mon Nov 4 2019 Hans de Goede - 1.20.5-8 -- Backport Xwayland randr resolution change emulation support - -* Thu Aug 29 2019 Olivier Fourdan 1.20.5-7 -- Pick latest fixes from xserver stable branch upstream (rhbz#1729925) - -* Sat Jul 27 2019 Fedora Release Engineering - 1.20.5-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Mon Jul 8 2019 Olivier Fourdan 1.20.5-5 -- Do not include on ARM with glibc to avoid compilation failure. -- Do not force vbe and int10 sdk headers as this enables int10 which does - not build on ARM without - -* Mon Jul 8 2019 Olivier Fourdan 1.20.5-4 -- Fix regression causing screen tearing with upstream xserver 1.20.5 - (rhbz#1726419) - -* Fri Jun 28 2019 Olivier Fourdan 1.20.5-3 -- Remove atomic downstream patches causing regressions (#1714981, #1723715) -- Xwayland crashes (#1708119, #1691745) -- Cursor issue with tablet on Xwayland -- Xorg/modesetting issue with flipping pixmaps with Present (#1645553) - -* Thu Jun 06 2019 Peter Hutterer 1.20.5-2 -- Return AlreadyGrabbed for keycodes > 255 (#1697804) - -* Thu May 30 2019 Adam Jackson - 1.20.5-1 -- xserver 1.20.5 - -* Tue Apr 23 2019 Adam Jackson - 1.20.4-4 -- Fix some non-atomic modesetting calls to be atomic - -* Wed Mar 27 2019 Peter Hutterer 1.20.4-3 -- Fix a Qt scrolling bug, don't reset the valuator on slave switch - -* Thu Mar 21 2019 Adam Jackson - 1.20.4-2 -- Backport an Xwayland crash fix in the Present code - -* Tue Feb 26 2019 Adam Jackson - 1.20.4-1 -- xserver 1.20.4 - -* Sun Feb 03 2019 Fedora Release Engineering - 1.20.3-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Fri Jan 11 2019 Olivier Fourdan - 1.20.3-3 -- More Xwayland/Present fixes from upstream (rhbz#1609181, rhbz#1661748) - -* Thu Dec 06 2018 Olivier Fourdan - 1.20.3-2 -- Xwayland/Present fixes from master upstream - -* Thu Nov 01 2018 Adam Jackson - 1.20.3-1 -- xserver 1.20.3 - -* Mon Oct 15 2018 Adam Jackson - 1.20.2-1 -- xserver 1.20.2 - -* Thu Oct 4 2018 Hans de Goede - 1.20.1-4 -- Rebase patch to use va_gl as vdpau driver on i965 GPUs, re-fix rhbz#1413733 - -* Thu Sep 13 2018 Dave Airlie - 1.20.1-3 -- Build with PIE enabled (this doesn't enable bind now) - -* Mon Sep 10 2018 Olivier Fourdan - 1.20.1-2 -- Include patches from upstream to fix Xwayland crashes - -* Thu Aug 09 2018 Adam Jackson - 1.20.1-1 -- xserver 1.20.1 - -* Sat Jul 14 2018 Fedora Release Engineering - 1.20.0-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Tue Jun 12 2018 Adam Jackson - 1.20.0-4 -- Xorg and Xwayland Requires: libEGL - -* Fri Jun 01 2018 Adam Williamson - 1.20.0-3 -- Backport fixes for RHBZ#1579067 - -* Wed May 16 2018 Adam Jackson - 1.20.0-2 -- Xorg Requires: xorg-x11-drv-libinput - -* Thu May 10 2018 Adam Jackson - 1.20.0-1 -- xserver 1.20 - -* Wed Apr 25 2018 Adam Jackson - 1.19.99.905-2 -- Fix xvfb-run's default depth to be 24 - -* Tue Apr 24 2018 Adam Jackson - 1.19.99.905-1 -- xserver 1.20 RC5 - -* Thu Apr 12 2018 Olivier Fourdan - 1.19.99.904-2 -- Re-fix "use type instead of which in xvfb-run (rhbz#1443357)" which - was overridden inadvertently - -* Tue Apr 10 2018 Adam Jackson - 1.19.99.904-1 -- xserver 1.20 RC4 - -* Mon Apr 02 2018 Adam Jackson - 1.19.99.903-1 -- xserver 1.20 RC3 - -* Tue Feb 13 2018 Olivier Fourdan 1.19.6-5 -- xwayland: avoid race condition on new keymap -- xwayland: Keep separate variables for pointer and tablet foci (rhbz#1519961) -- xvfb-run now support command line option “--auto-display” - -* Fri Feb 09 2018 Fedora Release Engineering - 1.19.6-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Tue Jan 30 2018 Olivier Fourdan 1.19.6-3 -- Avoid generating a core file when the Wayland compositor is gone. - -* Thu Jan 11 2018 Peter Hutterer 1.19.6-2 -- Fix handling of devices with ID_INPUT=null - -* Wed Dec 20 2017 Adam Jackson - 1.19.6-1 -- xserver 1.19.6 - -* Thu Oct 12 2017 Adam Jackson - 1.19.5-1 -- xserver 1.19.5 - -* Thu Oct 05 2017 Olivier Fourdan - 1.19.4-1 -- xserver-1.19.4 -- Backport tablet support for Xwayland - -* Fri Sep 08 2017 Troy Dawson - 1.19.3-9 -- Cleanup spec file conditionals - -* Thu Aug 03 2017 Fedora Release Engineering - 1.19.3-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Thu Jul 27 2017 Fedora Release Engineering - 1.19.3-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Sun Jul 2 2017 Ville Skyttä - 1.19.3-6 -- Use type instead of which in xvfb-run (rhbz#1443357) - -* Thu May 04 2017 Orion Poplawski - 1.19.3-5 -- Enable full build for s390/x - -* Mon Apr 24 2017 Ben Skeggs - 1.19.3-4 -- Default to xf86-video-modesetting on GeForce 8 and newer - -* Fri Apr 07 2017 Adam Jackson - 1.19.3-3 -- Inoculate against a versioning bug with libdrm 2.4.78 - -* Thu Mar 23 2017 Hans de Goede - 1.19.3-2 -- Use va_gl as vdpau driver on i965 GPUs (rhbz#1413733) - -* Wed Mar 15 2017 Adam Jackson - 1.19.3-1 -- xserver 1.19.3 - -* Thu Mar 02 2017 Adam Jackson - 1.19.2-1 -- xserver 1.19.2 - -* Sat Feb 11 2017 Fedora Release Engineering - 1.19.1-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Wed Feb 01 2017 Peter Hutterer 1.19.1-3 -- Fix a few input thread lock issues causing intel crashes (#1384486) - -* Mon Jan 16 2017 Adam Jackson - 1.19.1-2 -- Limit the intel driver only on F26 and up - -* Wed Jan 11 2017 Adam Jackson - 1.19.1-1 -- xserver 1.19.1 - -* Tue Jan 10 2017 Hans de Goede - 1.19.0-4 -- Follow Debian and only default to the intel ddx on gen4 or older intel GPUs - -* Tue Dec 20 2016 Hans de Goede - 1.19.0-3 -- Add one more patch for better integration with the nvidia binary driver - -* Thu Dec 15 2016 Hans de Goede - 1.19.0-2 -- Add some patches for better integration with the nvidia binary driver -- Add a patch from upstream fixing a crash (rhbz#1389886) - -* Wed Nov 23 2016 Olivier Fourdan 1.19.0-1 -- xserver 1.19.0 -- Fix use after free of cursors in Xwayland (rhbz#1385258) -- Fix an issue where some monitors would show only black, or - partially black when secondary GPU outputs are used - -* Tue Nov 15 2016 Peter Hutterer 1.19.0-0.8.rc2 -- Update device barriers for new master devices (#1384432) - -* Thu Nov 3 2016 Hans de Goede - 1.19.0-0.7.rc2 -- Update to 1.19.0-rc2 -- Fix (hopefully) various crashes in FlushAllOutput() (rhbz#1382444) -- Fix Xwayland crashing in glamor on non glamor capable hw (rhbz#1390018) - -* Tue Nov 1 2016 Ben Crocker - 1.19.0-0.6.20161028 -- Fix Config record allocation during startup: if xorg.conf.d directory -- was absent, a segfault resulted. - -* Mon Oct 31 2016 Adam Jackson - 1.19.0-0.5.20161026 -- Use %%autopatch instead of doing our own custom git-am trick - -* Fri Oct 28 2016 Hans de Goede - 1.19.0-0.4.20161026 -- Add missing Requires: libXfont2-devel to -devel sub-package (rhbz#1389711) - -* Wed Oct 26 2016 Hans de Goede - 1.19.0-0.3.20161026 -- Sync with upstream git, bringing in a bunch if bug-fixes -- Add some extra fixes which are pending upstream -- This also adds PointerWarping emulation to Xwayland, which should improve - compatiblity with many games diff --git a/xserver-sdk-abi-requires.git b/xserver-sdk-abi-requires.git deleted file mode 100755 index c033061..0000000 --- a/xserver-sdk-abi-requires.git +++ /dev/null @@ -1,14 +0,0 @@ -#!/bin/sh -# -# The X server provides capabilities of the form: -# -# Provides: xserver-abi(ansic-0) = 4 -# -# for an ABI version of 0.4. The major number is encoded into the name so -# that major number changes force upgrades. If we didn't, then -# -# Requires: xserver-abi(ansic) >= 0.4 -# -# would also match 1.0, which is wrong since major numbers mean an ABI break. - -echo "xserver-abi($1-@MAJOR@) >= @MINOR@" diff --git a/xserver-sdk-abi-requires.release b/xserver-sdk-abi-requires.release deleted file mode 100755 index 30d77bf..0000000 --- a/xserver-sdk-abi-requires.release +++ /dev/null @@ -1,19 +0,0 @@ -#!/bin/sh -# -# The X server provides capabilities of the form: -# -# Provides: xserver-abi(ansic-0) = 4 -# -# for an ABI version of 0.4. The major number is encoded into the name so -# that major number changes force upgrades. If we didn't, then -# -# Requires: xserver-abi(ansic) >= 0.4 -# -# would also match 1.0, which is wrong since major numbers mean an ABI break. - -ver=$(pkg-config --variable abi_$1 xorg-server) - -major=$(echo $ver | cut -f 1 -d .) -minor=$(echo $ver | cut -f 2 -d .) - -echo "xserver-abi($1-$major) >= $minor"