CVE fix for CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597, CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601

.gitignore

@@ -1,3 +1,37 @@
+xorg-server-1.9.1.tar.bz2
+/xorg-server-20101125.tar.xz
+/xorg-server-20101201.tar.xz
+/xorg-server-1.10.0.tar.bz2
+/xorg-server-20110418.tar.xz
+/xorg-server-20110510.tar.xz
+/xorg-server-20110818.tar.xz
+/xorg-server-1.11.0.tar.bz2
+/xorg-server-1.11.1.tar.bz2
+/xorg-server-20111109.tar.xz
+/xorg-server-20120103.tar.xz
+/xorg-server-20120124.tar.xz
+/xorg-server-20120215.tar.xz
+/xorg-server-1.12.0.tar.bz2
+/xorg-server-1.12.1.tar.bz2
+/xorg-server-1.12.2.tar.bz2
+/xorg-server-1.12.3.tar.bz2
+/xorg-server-20120717.tar.xz
+/xorg-server-20120726.tar.xz
+/xorg-server-20120808.tar.xz
+/xorg-server-20120822.tar.xz
+/xorg-server-1.13.0.tar.bz2
+/xorg-server-1.13.1.tar.bz2
+/xorg-server-20130109.tar.xz
+/xorg-server-20130215.tar.xz
+/xorg-server-1.14.0.tar.bz2
+/xorg-server-1.14.1.tar.bz2
+/xorg-server-1.14.1.901.tar.bz2
+/xorg-server-1.14.2.tar.bz2
+/xorg-server-1.14.3.tar.bz2
+/xorg-server-1.14.99.3.tar.bz2
+/xorg-server-1.14.99.901.tar.bz2
+/xorg-server-1.14.99.902.tar.bz2
 *.bz2
 *.xz
-*.gz
+/xorg-x11-server-1.15.0-1.fc21.src.rpm
+/xorg-server-1.20.14.tar.gz

0001-Cursor-Refuse-to-free-the-root-cursor.patch

@@ -0,0 +1,55 @@
+From 42ec29c7fbf8dc797c369d5fe0e4f2e20725332b Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 27 Nov 2024 11:27:05 +0100
+Subject: [PATCH xserver 01/13] Cursor: Refuse to free the root cursor
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If a cursor reference count drops to 0, the cursor is freed.
+
+The root cursor however is referenced with a specific global variable,
+and when the root cursor is freed, the global variable may still point
+to freed memory.
+
+Make sure to prevent the rootCursor from being explicitly freed by a
+client.
+
+CVE-2025-26594, ZDI-CAN-25544
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+v2: Explicitly forbid XFreeCursor() on the root cursor (Peter Hutterer
+<peter.hutterer@who-t.net>)
+v3: Return BadCursor instead of BadValue (Michel Dänzer
+<michel@daenzer.net>)
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Suggested-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit 01642f263f12becf803b19be4db95a4a83f94acc)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ dix/dispatch.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/dix/dispatch.c b/dix/dispatch.c
+index a33bfaa9e..9654c207e 100644
+--- a/dix/dispatch.c
++++ b/dix/dispatch.c
+@@ -3039,6 +3039,10 @@ ProcFreeCursor(ClientPtr client)
+     rc = dixLookupResourceByType((void **) &pCursor, stuff->id, RT_CURSOR,
+                                  client, DixDestroyAccess);
+     if (rc == Success) {
++        if (pCursor == rootCursor) {
++            client->errorValue = stuff->id;
++            return BadCursor;
++        }
+         FreeResource(stuff->id, RT_NONE);
+         return Success;
+     }
+-- 
+2.48.1
+

0001-Disallow-byte-swapped-clients-by-default.patch

@@ -0,0 +1,272 @@
+From 73d6e888c6058b28a0e87ab65aa4172b17d8327d Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 19 Dec 2022 10:34:29 +1000
+Subject: [PATCH xserver] Fix some indentation issues
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ dix/dispatch.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/dix/dispatch.c b/dix/dispatch.c
+index 210df75c63..e38a8fecaa 100644
+--- a/dix/dispatch.c
++++ b/dix/dispatch.c
+@@ -492,10 +492,10 @@ Dispatch(void)
+         if (!WaitForSomething(clients_are_ready()))
+             continue;
+
+-       /*****************
+-	*  Handle events in round robin fashion, doing input between
+-	*  each round
+-	*****************/
++        /*****************
++         *  Handle events in round robin fashion, doing input between
++         *  each round
++         *****************/
+
+         if (!dispatchException && clients_are_ready()) {
+             client = SmartScheduleClient();
+@@ -3657,11 +3657,11 @@ ProcInitialConnection(ClientPtr client)
+     prefix = (xConnClientPrefix *) ((char *)stuff + sz_xReq);
+     order = prefix->byteOrder;
+     if (order != 'l' && order != 'B' && order != 'r' && order != 'R')
+-	return client->noClientException = -1;
++        return client->noClientException = -1;
+     if (((*(char *) &whichbyte) && (order == 'B' || order == 'R')) ||
+-	(!(*(char *) &whichbyte) && (order == 'l' || order == 'r'))) {
+-	client->swapped = TRUE;
+-	SwapConnClientPrefix(prefix);
++        (!(*(char *) &whichbyte) && (order == 'l' || order == 'r'))) {
++        client->swapped = TRUE;
++        SwapConnClientPrefix(prefix);
+     }
+     stuff->reqType = 2;
+     stuff->length += bytes_to_int32(prefix->nbytesAuthProto) +
+@@ -3670,7 +3670,7 @@ ProcInitialConnection(ClientPtr client)
+         swaps(&stuff->length);
+     }
+     if (order == 'r' || order == 'R') {
+-	client->local = FALSE;
++        client->local = FALSE;
+     }
+     ResetCurrentRequest(client);
+     return Success;
+@@ -3781,8 +3781,8 @@ ProcEstablishConnection(ClientPtr client)
+     auth_string = auth_proto + pad_to_int32(prefix->nbytesAuthProto);
+
+     if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix +
+-	pad_to_int32(prefix->nbytesAuthProto) +
+-	pad_to_int32(prefix->nbytesAuthString))
++            pad_to_int32(prefix->nbytesAuthProto) +
++            pad_to_int32(prefix->nbytesAuthString))
+         reason = "Bad length";
+     else if ((prefix->majorVersion != X_PROTOCOL) ||
+         (prefix->minorVersion != X_PROTOCOL_REVISION))
+--
+2.39.0
+
+From f69280ddcdd3115ee4717f22e85e0f43569b60dd Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 20 Dec 2022 11:40:16 +1000
+Subject: [PATCH xserver] dix: localize two variables
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ dix/dispatch.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/dix/dispatch.c b/dix/dispatch.c
+index c651c3d887..92be773e6c 100644
+--- a/dix/dispatch.c
++++ b/dix/dispatch.c
+@@ -3766,14 +3766,11 @@ int
+ ProcEstablishConnection(ClientPtr client)
+ {
+     const char *reason;
+-    char *auth_proto, *auth_string;
+     xConnClientPrefix *prefix;
+
+     REQUEST(xReq);
+
+     prefix = (xConnClientPrefix *) ((char *) stuff + sz_xReq);
+-    auth_proto = (char *) prefix + sz_xConnClientPrefix;
+-    auth_string = auth_proto + pad_to_int32(prefix->nbytesAuthProto);
+
+     if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix +
+             pad_to_int32(prefix->nbytesAuthProto) +
+@@ -3782,12 +3779,15 @@ ProcEstablishConnection(ClientPtr client)
+     else if ((prefix->majorVersion != X_PROTOCOL) ||
+         (prefix->minorVersion != X_PROTOCOL_REVISION))
+         reason = "Protocol version mismatch";
+-    else
++    else {
++        char *auth_proto = (char *) prefix + sz_xConnClientPrefix;
++        char *auth_string = auth_proto + pad_to_int32(prefix->nbytesAuthProto);
+         reason = ClientAuthorized(client,
+                                   (unsigned short) prefix->nbytesAuthProto,
+                                   auth_proto,
+                                   (unsigned short) prefix->nbytesAuthString,
+                                   auth_string);
++    }
+
+     return (SendConnSetup(client, reason));
+ }
+--
+2.39.0
+
+From 412777664a20dd3561b936c02c96571a756fe9b2 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 20 Dec 2022 10:42:03 +1000
+Subject: [PATCH xserver] Disallow byte-swapped clients by default
+
+The X server swapping code is a huge attack surface, much of this code
+is untested and prone to security issues. The use-case of byte-swapped
+clients is very niche, so let's disable this by default and allow it
+only when the respective config option or commandline flag is given.
+
+For Xorg, this adds the ServerFlag "AllowByteSwappedClients" "on".
+For all DDX, this adds the commandline options +byteswappedclients and
+-byteswappedclients to enable or disable, respectively.
+
+Fixes #1201
+
+https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1029
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ dix/dispatch.c                 | 4 +++-
+ hw/xfree86/common/xf86Config.c | 8 ++++++++
+ hw/xfree86/man/xorg.conf.man   | 2 ++
+ hw/xwayland/xwayland.pc.in     | 1 +
+ include/opaque.h               | 2 ++
+ man/Xserver.man                | 6 ++++++
+ os/utils.c                     | 9 +++++++++
+ 7 files changed, 31 insertions(+), 1 deletion(-)
+
+diff --git a/dix/dispatch.c b/dix/dispatch.c
+index 92be773e6c..9c26753a96 100644
+--- a/dix/dispatch.c
++++ b/dix/dispatch.c
+@@ -3772,7 +3772,9 @@ ProcEstablishConnection(ClientPtr client)
+
+     prefix = (xConnClientPrefix *) ((char *) stuff + sz_xReq);
+
+-    if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix +
++    if (client->swapped && !AllowByteSwappedClients) {
++        reason = "Prohibited client endianess, see the Xserver man page ";
++    } else if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix +
+             pad_to_int32(prefix->nbytesAuthProto) +
+             pad_to_int32(prefix->nbytesAuthString))
+         reason = "Bad length";
+diff --git a/hw/xfree86/common/xf86Config.c b/hw/xfree86/common/xf86Config.c
+index 5d814c1485..41acb25aa2 100644
+--- a/hw/xfree86/common/xf86Config.c
++++ b/hw/xfree86/common/xf86Config.c
+@@ -646,6 +646,7 @@ typedef enum {
+     FLAG_MAX_CLIENTS,
+     FLAG_IGLX,
+     FLAG_DEBUG,
++    FLAG_ALLOW_BYTE_SWAPPED_CLIENTS,
+ } FlagValues;
+
+ /**
+@@ -705,6 +706,8 @@ static OptionInfoRec FlagOptions[] = {
+      {0}, FALSE},
+     {FLAG_DEBUG, "Debug", OPTV_STRING,
+      {0}, FALSE},
++    {FLAG_ALLOW_BYTE_SWAPPED_CLIENTS, "AllowByteSwappedClients", OPTV_BOOLEAN,
++     {0}, FALSE},
+     {-1, NULL, OPTV_NONE,
+      {0}, FALSE},
+ };
+@@ -746,6 +749,11 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
+         xf86Msg(X_CONFIG, "Ignoring ABI Version\n");
+     }
+
++    xf86GetOptValBool(FlagOptions, FLAG_ALLOW_BYTE_SWAPPED_CLIENTS, &AllowByteSwappedClients);
++    if (AllowByteSwappedClients) {
++        xf86Msg(X_CONFIG, "Allowing byte-swapped clients\n");
++    }
++
+     if (xf86IsOptionSet(FlagOptions, FLAG_AUTO_ADD_DEVICES)) {
+         xf86GetOptValBool(FlagOptions, FLAG_AUTO_ADD_DEVICES,
+                           &xf86Info.autoAddDevices);
+diff --git a/hw/xfree86/man/xorg.conf.man b/hw/xfree86/man/xorg.conf.man
+index 01b47247ee..d057f26ecd 100644
+--- a/hw/xfree86/man/xorg.conf.man
++++ b/hw/xfree86/man/xorg.conf.man
+@@ -677,6 +677,8 @@ Possible values are
+ or
+ .BR sync .
+ Unset by default.
++.BI "Option \*qAllowByteSwappedClients\*q  \*q" boolean \*q
++Allow clients with a different byte-order than the server. Disabled by default.
+ .SH "MODULE SECTION"
+ The
+ .B Module
+diff --git a/include/opaque.h b/include/opaque.h
+index 256261c2ad..398d4b4e51 100644
+--- a/include/opaque.h
++++ b/include/opaque.h
+@@ -74,4 +74,6 @@ extern _X_EXPORT Bool bgNoneRoot;
+ extern _X_EXPORT Bool CoreDump;
+ extern _X_EXPORT Bool NoListenAll;
+
++extern _X_EXPORT Bool AllowByteSwappedClients;
++
+ #endif                          /* OPAQUE_H */
+diff --git a/man/Xserver.man b/man/Xserver.man
+index 764bd1d907..e7adf9eb35 100644
+--- a/man/Xserver.man
++++ b/man/Xserver.man
+@@ -114,6 +114,12 @@ pattern.   This is the default unless -retro or -wr is specified.
+ .B \-bs
+ disables backing store support on all screens.
+ .TP 8
++.B \+byteswappedclients
++Allow connections from clients with an endianess different to that of the server.
++.TP 8
++.B \-byteswappedclients
++Prohibit connections from clients with an endianess different to that of the server.
++.TP 8
+ .B \-c
+ turns off key-click.
+ .TP 8
+diff --git a/os/utils.c b/os/utils.c
+index fe94912f34..405bf7d8b4 100644
+--- a/os/utils.c
++++ b/os/utils.c
+@@ -189,6 +189,8 @@ Bool CoreDump;
+
+ Bool enableIndirectGLX = FALSE;
+
++Bool AllowByteSwappedClients = FALSE;
++
+ #ifdef PANORAMIX
+ Bool PanoramiXExtensionDisabledHack = FALSE;
+ #endif
+@@ -523,6 +525,8 @@ UseMsg(void)
+     ErrorF("-br                    create root window with black background\n");
+     ErrorF("+bs                    enable any backing store support\n");
+     ErrorF("-bs                    disable any backing store support\n");
++    ErrorF("+byteswappedclients    Allow clients with endianess different to that of the server\n");
++    ErrorF("-byteswappedclients    Prohibit clients with endianess different to that of the server\n");
+     ErrorF("-c                     turns off key-click\n");
+     ErrorF("c #                    key-click volume (0-100)\n");
+     ErrorF("-cc int                default color visual class\n");
+@@ -720,6 +724,11 @@ ProcessCommandLine(int argc, char *argv[])
+             else
+                 UseMsg();
+         }
++        else if (strcmp(argv[i], "-byteswappedclients") == 0) {
++            AllowByteSwappedClients = FALSE;
++        } else if (strcmp(argv[i], "+byteswappedclients") == 0) {
++            AllowByteSwappedClients = TRUE;
++        }
+         else if (strcmp(argv[i], "-br") == 0);  /* default */
+         else if (strcmp(argv[i], "+bs") == 0)
+             enableBackingStore = TRUE;
+--
+2.39.0
+

0001-Don-t-hardcode-fps-for-fake-screen.patch

@@ -0,0 +1,135 @@
+From 6497eeeb1a6552315132340565a3901d4db2144c Mon Sep 17 00:00:00 2001
+From: Boris-Barboris <ismailsiege@gmail.com>
+Date: Tue, 22 Jun 2021 00:51:08 +0300
+Subject: [PATCH] Don't hardcode fps for fake screen
+
+Currently, when main hardware screen is powered-off,
+X server initializes fake screen's timer with
+1 second update interval.
+
+Streaming software like Nomachine or Vnc, as well as
+desktop input automation suffers from it, since it
+will forever be stuck on 1 fps until the display is
+turned back on.
+
+This commit adds command line option -fakescreenfps <int>
+that allows the user to change the default fake screen
+timer.
+
+Signed-off-by: Baranin Alexander <ismailsiege@gmail.com>
+---
+ man/Xserver.man        |  3 +++
+ os/utils.c             | 12 ++++++++++++
+ present/present.h      |  2 ++
+ present/present_fake.c | 28 ++++++++++++++++++----------
+ 4 files changed, 35 insertions(+), 10 deletions(-)
+
+diff --git a/man/Xserver.man b/man/Xserver.man
+index 31ffb8c..b1a3f40 100644
+--- a/man/Xserver.man
++++ b/man/Xserver.man
+@@ -169,6 +169,9 @@ sets default cursor font.
+ .B \-fn \fIfont\fP
+ sets the default font.
+ .TP 8
++.B \-fakescreenfps \fFps\fP
++sets fake presenter screen default fps (allowable range: 1-600).
++.TP 8
+ .B \-fp \fIfontPath\fP
+ sets the search path for fonts.  This path is a comma separated list
+ of directories which the X server searches for font databases.
+diff --git a/os/utils.c b/os/utils.c
+index 2ba1c80..721d4e9 100644
+--- a/os/utils.c
++++ b/os/utils.c
+@@ -110,6 +110,8 @@ __stdcall unsigned long GetTickCount(void);
+ 
+ #include "picture.h"
+ 
++#include "present.h"
++
+ Bool noTestExtensions;
+ 
+ #ifdef COMPOSITE
+@@ -526,6 +528,7 @@ UseMsg(void)
+     ErrorF
+         ("-deferglyphs [none|all|16] defer loading of [no|all|16-bit] glyphs\n");
+     ErrorF("-f #                   bell base (0-100)\n");
++    ErrorF("-fakescreenfps #       fake screen default fps (1-600)\n");
+     ErrorF("-fc string             cursor font\n");
+     ErrorF("-fn string             default font name\n");
+     ErrorF("-fp string             default font path\n");
+@@ -776,6 +779,15 @@ ProcessCommandLine(int argc, char *argv[])
+             else
+                 UseMsg();
+         }
++        else if (strcmp(argv[i], "-fakescreenfps") == 0) {
++            if (++i < argc) {
++                FakeScreenFps = (uint32_t) atoi(argv[i]);
++                if (FakeScreenFps < 1 || FakeScreenFps > 600)
++                    FatalError("fakescreenfps must be an integer in [1;600] range\n");
++            }
++            else
++                UseMsg();
++        }
+         else if (strcmp(argv[i], "-fc") == 0) {
+             if (++i < argc)
+                 defaultCursorFont = argv[i];
+diff --git a/present/present.h b/present/present.h
+index 3d0b972..e7cc50d 100644
+--- a/present/present.h
++++ b/present/present.h
+@@ -190,4 +190,6 @@ present_register_complete_notify(present_complete_notify_proc proc);
+ extern _X_EXPORT Bool
+ present_can_window_flip(WindowPtr window);
+ 
++extern _X_EXPORT uint32_t FakeScreenFps;
++
+ #endif /* _PRESENT_H_ */
+diff --git a/present/present_fake.c b/present/present_fake.c
+index 2350638..d9ac598 100644
+--- a/present/present_fake.c
++++ b/present/present_fake.c
+@@ -117,21 +117,29 @@ present_fake_queue_vblank(ScreenPtr     screen,
+     return Success;
+ }
+ 
++uint32_t FakeScreenFps = 0;
++
+ void
+ present_fake_screen_init(ScreenPtr screen)
+ {
++    uint32_t                fake_fps;
+     present_screen_priv_ptr screen_priv = present_screen_priv(screen);
+ 
+-    /* For screens with hardware vblank support, the fake code
+-     * will be used for off-screen windows and while screens are blanked,
+-     * in which case we want a slow interval here
+-     *
+-     * Otherwise, pretend that the screen runs at 60Hz
+-     */
+-    if (screen_priv->info && screen_priv->info->get_crtc)
+-        screen_priv->fake_interval = 1000000;
+-    else
+-        screen_priv->fake_interval = 16667;
++    if (FakeScreenFps)
++        fake_fps = FakeScreenFps;
++    else {
++        /* For screens with hardware vblank support, the fake code
++        * will be used for off-screen windows and while screens are blanked,
++        * in which case we want a large interval here: 1Hz
++        *
++        * Otherwise, pretend that the screen runs at 60Hz
++        */
++        if (screen_priv->info && screen_priv->info->get_crtc)
++            fake_fps = 1;
++        else
++            fake_fps = 60;
++    }
++    screen_priv->fake_interval = 1000000 / fake_fps;
+ }
+ 
+ void
+-- 
+2.34.1
+

0001-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch

@@ -0,0 +1,45 @@
+From 96798fc1967491c80a4d0c8d9e0a80586cb2152b Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Fri, 22 Mar 2024 18:51:45 -0700
+Subject: [PATCH 1/4] Xi: ProcXIGetSelectedEvents needs to use unswapped length
+ to send reply
+
+CVE-2024-31080
+
+Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762
+Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.")
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
+---
+ Xi/xiselectev.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
+index edcb8a0d3..ac1494987 100644
+--- a/Xi/xiselectev.c
++++ b/Xi/xiselectev.c
+@@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client)
+     InputClientsPtr others = NULL;
+     xXIEventMask *evmask = NULL;
+     DeviceIntPtr dev;
++    uint32_t length;
+ 
+     REQUEST(xXIGetSelectedEventsReq);
+     REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq);
+@@ -418,10 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client)
+         }
+     }
+ 
++    /* save the value before SRepXIGetSelectedEvents swaps it */
++    length = reply.length;
+     WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
+ 
+     if (reply.num_masks)
+-        WriteToClient(client, reply.length * 4, buffer);
++        WriteToClient(client, length * 4, buffer);
+ 
+     free(buffer);
+     return Success;
+-- 
+2.44.0
+

0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch

@@ -0,0 +1,77 @@
+From a7bda3080d2b44eae668cdcec7a93095385b9652 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 28 Nov 2023 15:19:04 +1000
+Subject: [PATCH xserver] Xi: allocate enough XkbActions for our buttons
+
+button->xkb_acts is supposed to be an array sufficiently large for all
+our buttons, not just a single XkbActions struct. Allocating
+insufficient memory here means when we memcpy() later in
+XkbSetDeviceInfo we write into memory that wasn't ours to begin with,
+leading to the usual security ooopsiedaisies.
+
+CVE-2023-6377, ZDI-CAN-22412, ZDI-CAN-22413
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+(cherry picked from commit 0c1a93d319558fe3ab2d94f51d174b4f93810afd)
+---
+ Xi/exevents.c | 12 ++++++------
+ dix/devices.c | 10 ++++++++++
+ 2 files changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/Xi/exevents.c b/Xi/exevents.c
+index dcd4efb3bc..54ea11a938 100644
+--- a/Xi/exevents.c
++++ b/Xi/exevents.c
+@@ -611,13 +611,13 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
+         }
+ 
+         if (from->button->xkb_acts) {
+-            if (!to->button->xkb_acts) {
+-                to->button->xkb_acts = calloc(1, sizeof(XkbAction));
+-                if (!to->button->xkb_acts)
+-                    FatalError("[Xi] not enough memory for xkb_acts.\n");
+-            }
++            size_t maxbuttons = max(to->button->numButtons, from->button->numButtons);
++            to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts,
++                                                   maxbuttons,
++                                                   sizeof(XkbAction));
++            memset(to->button->xkb_acts, 0, maxbuttons * sizeof(XkbAction));
+             memcpy(to->button->xkb_acts, from->button->xkb_acts,
+-                   sizeof(XkbAction));
++                   from->button->numButtons * sizeof(XkbAction));
+         }
+         else {
+             free(to->button->xkb_acts);
+diff --git a/dix/devices.c b/dix/devices.c
+index 5bf956ead4..15e46a9a5f 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -2525,6 +2525,8 @@ RecalculateMasterButtons(DeviceIntPtr slave)
+ 
+     if (master->button && master->button->numButtons != maxbuttons) {
+         int i;
++        int last_num_buttons = master->button->numButtons;
++
+         DeviceChangedEvent event = {
+             .header = ET_Internal,
+             .type = ET_DeviceChanged,
+@@ -2535,6 +2537,14 @@ RecalculateMasterButtons(DeviceIntPtr slave)
+         };
+ 
+         master->button->numButtons = maxbuttons;
++        if (last_num_buttons < maxbuttons) {
++            master->button->xkb_acts = xnfreallocarray(master->button->xkb_acts,
++                                                       maxbuttons,
++                                                       sizeof(XkbAction));
++            memset(&master->button->xkb_acts[last_num_buttons],
++                   0,
++                   (maxbuttons - last_num_buttons) * sizeof(XkbAction));
++        }
+ 
+         memcpy(&event.buttons.names, master->button->labels, maxbuttons *
+                sizeof(Atom));
+-- 
+2.43.0
+

0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch

@@ -0,0 +1,35 @@
+From 7150ba655c0cc08fa6ded309b81265bb672f2869 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 25 Jan 2023 11:41:40 +1000
+Subject: [PATCH xserver] Xi: fix potential use-after-free in
+ DeepCopyPointerClasses
+
+CVE-2023-0494, ZDI-CAN 19596
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ Xi/exevents.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Xi/exevents.c b/Xi/exevents.c
+index 217baa9561..dcd4efb3bc 100644
+--- a/Xi/exevents.c
++++ b/Xi/exevents.c
+@@ -619,8 +619,10 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
+             memcpy(to->button->xkb_acts, from->button->xkb_acts,
+                    sizeof(XkbAction));
+         }
+-        else
++        else {
+             free(to->button->xkb_acts);
++            to->button->xkb_acts = NULL;
++        }
+ 
+         memcpy(to->button->labels, from->button->labels,
+                from->button->numButtons * sizeof(Atom));
+-- 
+2.39.0
+

0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch

@@ -0,0 +1,80 @@
+From a31ba141824a7649e11f0ef7673718ce559d6337 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 3 Oct 2023 11:53:05 +1000
+Subject: [PATCH xserver 1/4] Xi/randr: fix handling of PropModeAppend/Prepend
+
+The handling of appending/prepending properties was incorrect, with at
+least two bugs: the property length was set to the length of the new
+part only, i.e. appending or prepending N elements to a property with P
+existing elements always resulted in the property having N elements
+instead of N + P.
+
+Second, when pre-pending a value to a property, the offset for the old
+values was incorrect, leaving the new property with potentially
+uninitalized values and/or resulting in OOB memory writes.
+For example, prepending a 3 element value to a 5 element property would
+result in this 8 value array:
+  [N, N, N, ?, ?, P, P, P ] P, P
+                            ^OOB write
+
+The XI2 code is a copy/paste of the RandR code, so the bug exists in
+both.
+
+CVE-2023-5367, ZDI-CAN-22153
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ Xi/xiproperty.c    | 4 ++--
+ randr/rrproperty.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
+index 6ec419e870..563c4f31a5 100644
+--- a/Xi/xiproperty.c
++++ b/Xi/xiproperty.c
+@@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
+                 XIDestroyDeviceProperty(prop);
+             return BadAlloc;
+         }
+-        new_value.size = len;
++        new_value.size = total_len;
+         new_value.type = type;
+         new_value.format = format;
+ 
+@@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
+         case PropModePrepend:
+             new_data = new_value.data;
+             old_data = (void *) (((char *) new_value.data) +
+-                                  (prop_value->size * size_in_bytes));
++                                  (len * size_in_bytes));
+             break;
+         }
+         if (new_data)
+diff --git a/randr/rrproperty.c b/randr/rrproperty.c
+index c2fb9585c6..25469f57b2 100644
+--- a/randr/rrproperty.c
++++ b/randr/rrproperty.c
+@@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
+                 RRDestroyOutputProperty(prop);
+             return BadAlloc;
+         }
+-        new_value.size = len;
++        new_value.size = total_len;
+         new_value.type = type;
+         new_value.format = format;
+ 
+@@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
+         case PropModePrepend:
+             new_data = new_value.data;
+             old_data = (void *) (((char *) new_value.data) +
+-                                  (prop_value->size * size_in_bytes));
++                                  (len * size_in_bytes));
+             break;
+         }
+         if (new_data)
+-- 
+2.41.0
+

0001-Xtest-disallow-GenericEvents-in-XTestSwapFakeInput.patch

@@ -0,0 +1,52 @@
+From 8dba686dc277d6d262ad0c77b4632a5b276697ba Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 29 Nov 2022 12:55:45 +1000
+Subject: [PATCH xserver 1/7] Xtest: disallow GenericEvents in
+ XTestSwapFakeInput
+
+XTestSwapFakeInput assumes all events in this request are
+sizeof(xEvent) and iterates through these in 32-byte increments.
+However, a GenericEvent may be of arbitrary length longer than 32 bytes,
+so any GenericEvent in this list would result in subsequent events to be
+misparsed.
+
+Additional, the swapped event is written into a stack-allocated struct
+xEvent (size 32 bytes). For any GenericEvent longer than 32 bytes,
+swapping the event may thus smash the stack like an avocado on toast.
+
+Catch this case early and return BadValue for any GenericEvent.
+Which is what would happen in unswapped setups anyway since XTest
+doesn't support GenericEvent.
+
+CVE-2022-46340, ZDI-CAN 19265
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+---
+ Xext/xtest.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/Xext/xtest.c b/Xext/xtest.c
+index bf27eb590b..2985a4ce6e 100644
+--- a/Xext/xtest.c
++++ b/Xext/xtest.c
+@@ -502,10 +502,11 @@ XTestSwapFakeInput(ClientPtr client, xReq * req)
+ 
+     nev = ((req->length << 2) - sizeof(xReq)) / sizeof(xEvent);
+     for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) {
++        int evtype = ev->u.u.type & 0x177;
+         /* Swap event */
+-        proc = EventSwapVector[ev->u.u.type & 0177];
++        proc = EventSwapVector[evtype];
+         /* no swapping proc; invalid event type? */
+-        if (!proc || proc == NotImplemented) {
++        if (!proc || proc == NotImplemented || evtype == GenericEvent) {
+             client->errorValue = ev->u.u.type;
+             return BadValue;
+         }
+-- 
+2.38.1
+

0001-add-a-quirk-for-apple-silicon.patch

@@ -0,0 +1,30 @@
+commit 39934a656a44722d16a80bf4db411c53e2d67b38 (HEAD -> master, origin/master, origin/HEAD)
+Author: Eric Curtin <ecurtin@redhat.com>
+Date:   Fri Dec 16 11:10:12 2022 +0000
+
+    config: add a quirk for Apple Silicon appledrm
+    
+    Xorg server does not correctly select the DCP for the display without a
+    quirk on Apple Silicon.
+    
+    Signed-off-by: Eric Curtin <ecurtin@redhat.com>
+    Suggested-by: Hector Martin <marcan@marcan.st>
+
+diff --git a/config/10-quirks.conf b/config/10-quirks.conf
+index 47907d82d..54dd908a7 100644
+--- a/config/10-quirks.conf
++++ b/config/10-quirks.conf
+@@ -36,3 +36,13 @@ Section "InputClass"
+         MatchDriver "evdev"
+         Option "TypeName" "MOUSE"
+ EndSection
++
++# https://bugzilla.redhat.com/show_bug.cgi?id=2152414
++# Xorg server does not correctly select the DCP for the display without
++# a quirk on Apple Silicon
++Section "OutputClass"
++        Identifier "appledrm"
++        MatchDriver "apple"
++        Driver "modesetting"
++        Option "PrimaryGPU" "true"
++EndSection

0001-autobind-GPUs-to-the-screen.patch

@@ -0,0 +1,293 @@
+From 471289fa1dc359555ceed6302f7d9605ab6be3ea Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Mon, 2 Apr 2018 16:49:02 -0400
+Subject: [PATCH] autobind GPUs to the screen
+
+This is a modified version of a patch we've been carry-ing in Fedora and
+RHEL for years now. This patch automatically adds secondary GPUs to the
+master as output sink / offload source making e.g. the use of
+slave-outputs just work, with requiring the user to manually run
+"xrandr --setprovideroutputsource" before he can hookup an external
+monitor to his hybrid graphics laptop.
+
+There is one problem with this patch, which is why it was not upstreamed
+before. What to do when a secondary GPU gets detected really is a policy
+decission (e.g. one may want to autobind PCI GPUs but not USB ones) and
+as such should be under control of the Desktop Environment.
+
+Unconditionally adding autobinding support to the xserver will result
+in races between the DE dealing with the hotplug of a secondary GPU
+and the server itself dealing with it.
+
+However we've waited for years for any Desktop Environments to actually
+start doing some sort of autoconfiguration of secondary GPUs and there
+is still not a single DE dealing with this, so I believe that it is
+time to upstream this now.
+
+To avoid potential future problems if any DEs get support for doing
+secondary GPU configuration themselves, the new autobind functionality
+is made optional. Since no DEs currently support doing this themselves it
+is enabled by default. When DEs grow support for doing this themselves
+they can disable the servers autobinding through the servers cmdline or a
+xorg.conf snippet.
+
+Signed-off-by: Dave Airlie <airlied@gmail.com>
+[hdegoede@redhat.com: Make configurable, fix with nvidia, submit upstream]
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ hw/xfree86/common/xf86Config.c      | 19 +++++++++++++++++++
+ hw/xfree86/common/xf86Globals.c     |  2 ++
+ hw/xfree86/common/xf86Init.c        | 20 ++++++++++++++++++++
+ hw/xfree86/common/xf86Priv.h        |  1 +
+ hw/xfree86/common/xf86Privstr.h     |  1 +
+ hw/xfree86/common/xf86platformBus.c |  4 ++++
+ hw/xfree86/man/Xorg.man             |  7 +++++++
+ hw/xfree86/man/xorg.conf.man        |  6 ++++++
+ randr/randrstr.h                    |  3 +++
+ randr/rrprovider.c                  | 22 ++++++++++++++++++++++
+ 10 files changed, 85 insertions(+)
+
+diff --git a/hw/xfree86/common/xf86Config.c b/hw/xfree86/common/xf86Config.c
+index 2c1d335..d7d7c2e 100644
+--- a/hw/xfree86/common/xf86Config.c
++++ b/hw/xfree86/common/xf86Config.c
+@@ -643,6 +643,7 @@ typedef enum {
+     FLAG_DRI2,
+     FLAG_USE_SIGIO,
+     FLAG_AUTO_ADD_GPU,
++    FLAG_AUTO_BIND_GPU,
+     FLAG_MAX_CLIENTS,
+     FLAG_IGLX,
+     FLAG_DEBUG,
+@@ -699,6 +700,8 @@ static OptionInfoRec FlagOptions[] = {
+      {0}, FALSE},
+     {FLAG_AUTO_ADD_GPU, "AutoAddGPU", OPTV_BOOLEAN,
+      {0}, FALSE},
++    {FLAG_AUTO_BIND_GPU, "AutoBindGPU", OPTV_BOOLEAN,
++     {0}, FALSE},
+     {FLAG_MAX_CLIENTS, "MaxClients", OPTV_INTEGER,
+      {0}, FALSE },
+     {FLAG_IGLX, "IndirectGLX", OPTV_BOOLEAN,
+@@ -779,6 +782,22 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
+     }
+     xf86Msg(from, "%sutomatically adding GPU devices\n",
+             xf86Info.autoAddGPU ? "A" : "Not a");
++
++    if (xf86AutoBindGPUDisabled) {
++        xf86Info.autoBindGPU = FALSE;
++        from = X_CMDLINE;
++    }
++    else if (xf86IsOptionSet(FlagOptions, FLAG_AUTO_BIND_GPU)) {
++        xf86GetOptValBool(FlagOptions, FLAG_AUTO_BIND_GPU,
++                          &xf86Info.autoBindGPU);
++        from = X_CONFIG;
++    }
++    else {
++        from = X_DEFAULT;
++    }
++    xf86Msg(from, "%sutomatically binding GPU devices\n",
++            xf86Info.autoBindGPU ? "A" : "Not a");
++
+     /*
+      * Set things up based on the config file information.  Some of these
+      * settings may be overridden later when the command line options are
+diff --git a/hw/xfree86/common/xf86Globals.c b/hw/xfree86/common/xf86Globals.c
+index e890f05..7b27b4c 100644
+--- a/hw/xfree86/common/xf86Globals.c
++++ b/hw/xfree86/common/xf86Globals.c
+@@ -131,6 +131,7 @@ xf86InfoRec xf86Info = {
+ #else
+     .autoAddGPU = FALSE,
+ #endif
++    .autoBindGPU = TRUE,
+ };
+ 
+ const char *xf86ConfigFile = NULL;
+@@ -191,6 +192,7 @@ Bool xf86FlipPixels = FALSE;
+ Gamma xf86Gamma = { 0.0, 0.0, 0.0 };
+ 
+ Bool xf86AllowMouseOpenFail = FALSE;
++Bool xf86AutoBindGPUDisabled = FALSE;
+ 
+ #ifdef XF86VIDMODE
+ Bool xf86VidModeDisabled = FALSE;
+diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
+index ea42ec9..ec255b6 100644
+--- a/hw/xfree86/common/xf86Init.c
++++ b/hw/xfree86/common/xf86Init.c
+@@ -76,6 +76,7 @@
+ #include "xf86DDC.h"
+ #include "xf86Xinput.h"
+ #include "xf86InPriv.h"
++#include "xf86Crtc.h"
+ #include "picturestr.h"
+ #include "randrstr.h"
+ #include "glxvndabi.h"
+@@ -237,6 +238,19 @@ xf86PrivsElevated(void)
+     return PrivsElevated();
+ }
+ 
++static void
++xf86AutoConfigOutputDevices(void)
++{
++    int i;
++
++    if (!xf86Info.autoBindGPU)
++        return;
++
++    for (i = 0; i < xf86NumGPUScreens; i++)
++        RRProviderAutoConfigGpuScreen(xf86ScrnToScreen(xf86GPUScreens[i]),
++                                      xf86ScrnToScreen(xf86Screens[0]));
++}
++
+ static void
+ TrapSignals(void)
+ {
+@@ -770,6 +784,8 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char **argv)
+     for (i = 0; i < xf86NumGPUScreens; i++)
+         AttachUnboundGPU(xf86Screens[0]->pScreen, xf86GPUScreens[i]->pScreen);
+ 
++    xf86AutoConfigOutputDevices();
++
+     xf86VGAarbiterWrapFunctions();
+     if (sigio_blocked)
+         input_unlock();
+@@ -1278,6 +1294,10 @@ ddxProcessArgument(int argc, char **argv, int i)
+         xf86Info.iglxFrom = X_CMDLINE;
+         return 0;
+     }
++    if (!strcmp(argv[i], "-noautoBindGPU")) {
++        xf86AutoBindGPUDisabled = TRUE;
++        return 1;
++    }
+ 
+     /* OS-specific processing */
+     return xf86ProcessArgument(argc, argv, i);
+diff --git a/hw/xfree86/common/xf86Priv.h b/hw/xfree86/common/xf86Priv.h
+index 4fe2b5f..6566622 100644
+--- a/hw/xfree86/common/xf86Priv.h
++++ b/hw/xfree86/common/xf86Priv.h
+@@ -46,6 +46,7 @@
+ extern _X_EXPORT const char *xf86ConfigFile;
+ extern _X_EXPORT const char *xf86ConfigDir;
+ extern _X_EXPORT Bool xf86AllowMouseOpenFail;
++extern _X_EXPORT Bool xf86AutoBindGPUDisabled;
+ 
+ #ifdef XF86VIDMODE
+ extern _X_EXPORT Bool xf86VidModeDisabled;
+diff --git a/hw/xfree86/common/xf86Privstr.h b/hw/xfree86/common/xf86Privstr.h
+index 21c2e1f..6c71863 100644
+--- a/hw/xfree86/common/xf86Privstr.h
++++ b/hw/xfree86/common/xf86Privstr.h
+@@ -98,6 +98,7 @@ typedef struct {
+ 
+     Bool autoAddGPU;
+     const char *debug;
++    Bool autoBindGPU;
+ } xf86InfoRec, *xf86InfoPtr;
+ 
+ /* ISC's cc can't handle ~ of UL constants, so explicitly type cast them. */
+diff --git a/hw/xfree86/common/xf86platformBus.c b/hw/xfree86/common/xf86platformBus.c
+index cef47da..913a324 100644
+--- a/hw/xfree86/common/xf86platformBus.c
++++ b/hw/xfree86/common/xf86platformBus.c
+@@ -49,6 +49,7 @@
+ #include "Pci.h"
+ #include "xf86platformBus.h"
+ #include "xf86Config.h"
++#include "xf86Crtc.h"
+ 
+ #include "randrstr.h"
+ int platformSlotClaimed;
+@@ -665,6 +666,9 @@ xf86platformAddDevice(int index)
+    }
+    /* attach unbound to 0 protocol screen */
+    AttachUnboundGPU(xf86Screens[0]->pScreen, xf86GPUScreens[i]->pScreen);
++   if (xf86Info.autoBindGPU)
++       RRProviderAutoConfigGpuScreen(xf86ScrnToScreen(xf86GPUScreens[i]),
++                                     xf86ScrnToScreen(xf86Screens[0]));
+ 
+    RRResourcesChanged(xf86Screens[0]->pScreen);
+    RRTellChanged(xf86Screens[0]->pScreen);
+diff --git a/hw/xfree86/man/Xorg.man b/hw/xfree86/man/Xorg.man
+index 13a9dc3..745f986 100644
+--- a/hw/xfree86/man/Xorg.man
++++ b/hw/xfree86/man/Xorg.man
+@@ -283,6 +283,13 @@ is a comma separated list of directories to search for
+ server modules.  This option is only available when the server is run
+ as root (i.e, with real-uid 0).
+ .TP 8
++.B \-noautoBindGPU
++Disable automatically setting secondary GPUs up as output sinks and offload
++sources. This is equivalent to setting the
++.B AutoBindGPU
++xorg.conf(__filemansuffix__) file option. To
++.B false.
++.TP 8
+ .B \-nosilk
+ Disable Silken Mouse support.
+ .TP 8
+diff --git a/hw/xfree86/man/xorg.conf.man b/hw/xfree86/man/xorg.conf.man
+index 9589262..8d51e06 100644
+--- a/hw/xfree86/man/xorg.conf.man
++++ b/hw/xfree86/man/xorg.conf.man
+@@ -672,6 +672,12 @@ Enabled by default.
+ If this option is disabled, then no GPU devices will be added from the udev
+ backend. Enabled by default. (May need to be disabled to setup Xinerama).
+ .TP 7
++.BI "Option \*qAutoBindGPU\*q  \*q" boolean \*q
++If enabled then secondary GPUs will be automatically set up as output-sinks and
++offload-sources. Making e.g. laptop outputs connected only to the secondary
++GPU directly available for use without needing to run
++"xrandr --setprovideroutputsource". Enabled by default.
++.TP 7
+ .BI "Option \*qLog\*q \*q" string \*q
+ This option controls whether the log is flushed and/or synced to disk after
+ each message.
+diff --git a/randr/randrstr.h b/randr/randrstr.h
+index f94174b..092d726 100644
+--- a/randr/randrstr.h
++++ b/randr/randrstr.h
+@@ -1039,6 +1039,9 @@ RRProviderLookup(XID id, RRProviderPtr *provider_p);
+ extern _X_EXPORT void
+ RRDeliverProviderEvent(ClientPtr client, WindowPtr pWin, RRProviderPtr provider);
+ 
++extern _X_EXPORT void
++RRProviderAutoConfigGpuScreen(ScreenPtr pScreen, ScreenPtr masterScreen);
++
+ /* rrproviderproperty.c */
+ 
+ extern _X_EXPORT void
+diff --git a/randr/rrprovider.c b/randr/rrprovider.c
+index e4bc2bf..e04c18f 100644
+--- a/randr/rrprovider.c
++++ b/randr/rrprovider.c
+@@ -485,3 +485,25 @@ RRDeliverProviderEvent(ClientPtr client, WindowPtr pWin, RRProviderPtr provider)
+ 
+     WriteEventsToClient(client, 1, (xEvent *) &pe);
+ }
++
++void
++RRProviderAutoConfigGpuScreen(ScreenPtr pScreen, ScreenPtr masterScreen)
++{
++    rrScrPrivPtr pScrPriv = rrGetScrPriv(pScreen);
++    rrScrPrivPtr masterPriv = rrGetScrPriv(masterScreen);
++    RRProviderPtr provider = pScrPriv->provider;
++    RRProviderPtr master_provider = masterPriv->provider;
++
++    if (!provider || !master_provider)
++        return;
++
++    if ((provider->capabilities & RR_Capability_SinkOutput) &&
++        (master_provider->capabilities & RR_Capability_SourceOutput)) {
++        pScrPriv->rrProviderSetOutputSource(pScreen, provider, master_provider);
++        RRInitPrimeSyncProps(pScreen);
++    }
++
++    if ((provider->capabilities & RR_Capability_SourceOffload) &&
++        (master_provider->capabilities & RR_Capability_SinkOffload))
++        pScrPriv->rrProviderSetOffloadSink(pScreen, provider, master_provider);
++}
+-- 
+2.16.2
+

0001-composite-Fix-use-after-free-of-the-COW.patch

@@ -0,0 +1,42 @@
+From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 13 Mar 2023 11:08:47 +0100
+Subject: [PATCH xserver] composite: Fix use-after-free of the COW
+
+ZDI-CAN-19866/CVE-2023-1393
+
+If a client explicitly destroys the compositor overlay window (aka COW),
+we would leave a dangling pointer to that window in the CompScreen
+structure, which will trigger a use-after-free later.
+
+Make sure to clear the CompScreen pointer to the COW when the latter gets
+destroyed explicitly by the client.
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+---
+ composite/compwindow.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/composite/compwindow.c b/composite/compwindow.c
+index 4e2494b86..b30da589e 100644
+--- a/composite/compwindow.c
++++ b/composite/compwindow.c
+@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
+     ret = (*pScreen->DestroyWindow) (pWin);
+     cs->DestroyWindow = pScreen->DestroyWindow;
+     pScreen->DestroyWindow = compDestroyWindow;
++
++    /* Did we just destroy the overlay window? */
++    if (pWin == cs->pOverlayWin)
++        cs->pOverlayWin = NULL;
++
+ /*    compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
+     return ret;
+ }
+-- 
+2.40.0
+

0001-configure.ac-search-for-the-fontrootdir-ourselves.patch

@@ -0,0 +1,72 @@
+From e67e988730346c63d2f0cdf2531ed36b0c7ad5a6 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 23 Nov 2022 14:50:29 +1000
+Subject: [PATCH xserver] configure.ac: search for the fontrootdir ourselves
+
+This replaces the use of font-utils' .m4 macro set with a copy of the
+only one we actually want: the bit for the fontrootpath.
+
+We don't need configure options for every single subfont directory, so
+let's hardcode those in the default font path. Like meson does upstream
+too.
+
+With this patch we no longer require the font-utils dependency.
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ configure.ac | 28 +++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 0909cc5b4d..2349320888 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -49,9 +49,6 @@ XORG_WITH_XSLTPROC
+ XORG_ENABLE_UNIT_TESTS
+ XORG_LD_WRAP([optional])
+ 
+-m4_ifndef([XORG_FONT_MACROS_VERSION], [m4_fatal([must install font-util 1.1 or later before running autoconf/autogen])])
+-XORG_FONT_MACROS_VERSION(1.1)
+-
+ dnl this gets generated by autoheader, and thus contains all the defines.  we
+ dnl don't ever actually use it, internally.
+ AC_CONFIG_HEADERS(include/do-not-use-config.h)
+@@ -450,18 +447,27 @@ AC_MSG_RESULT([$FALLBACK_INPUT_DRIVER])
+ AC_DEFINE_UNQUOTED(FALLBACK_INPUT_DRIVER, ["$FALLBACK_INPUT_DRIVER"], [ Fallback input driver ])
+ 
+ dnl Determine font path
+-XORG_FONTROOTDIR
+-XORG_FONTSUBDIR(FONTMISCDIR, fontmiscdir, misc)
+-XORG_FONTSUBDIR(FONTOTFDIR, fontotfdir, OTF)
+-XORG_FONTSUBDIR(FONTTTFDIR, fontttfdir, TTF)
+-XORG_FONTSUBDIR(FONTTYPE1DIR, fonttype1dir, Type1)
+-XORG_FONTSUBDIR(FONT75DPIDIR, font75dpidir, 75dpi)
+-XORG_FONTSUBDIR(FONT100DPIDIR, font100dpidir, 100dpi)
++dnl This is a copy of XORG_FONTROOTDIR from font-utils so we can drop the dependency
++AC_MSG_CHECKING([for root directory for font files])
++AC_ARG_WITH(fontrootdir,
++	    AS_HELP_STRING([--with-fontrootdir=DIR],
++		   [Path to root directory for font files]),
++	    [FONTROOTDIR="$withval"])
++# if --with-fontrootdir not specified...
++if test "x${FONTROOTDIR}" = "x"; then
++	FONTROOTDIR=`$PKG_CONFIG --variable=fontrootdir fontutil`
++fi
++# ...and if pkg-config didn't find fontdir in fontutil.pc...
++if test "x${FONTROOTDIR}" = "x"; then
++	FONTROOTDIR="${datadir}/fonts/X11"
++fi
++AC_SUBST(FONTROOTDIR)
++AC_MSG_RESULT([${FONTROOTDIR}])
+ 
+ dnl Uses --with-default-font-path if set, otherwise uses standard
+ dnl subdirectories of FONTROOTDIR. Some distros set the default font path to
+ dnl "catalogue:/etc/X11/fontpath.d,built-ins"
+-DEFAULT_FONT_PATH="${FONTMISCDIR}/,${FONTTTFDIR}/,${FONTOTFDIR}/,${FONTTYPE1DIR}/,${FONT100DPIDIR}/,${FONT75DPIDIR}/"
++DEFAULT_FONT_PATH="${FONTROOTDIR}/misc,${FONTROOTDIR}/OTF,${FONTROOTDIR}/TTF,${FONTROOTDIR}/Type1,${FONTROOTDIR}/75dpi,${FONTROOTDIR}/100dpi"
+ case $host_os in
+     darwin*) DEFAULT_FONT_PATH="${DEFAULT_FONT_PATH},/Library/Fonts,/System/Library/Fonts" ;;
+ esac
+-- 
+2.38.1
+

0001-dix-Fix-use-after-free-in-input-device-shutdown.patch

@@ -0,0 +1,77 @@
+From 1801fe0ac3926882d47d7e1ad6c0518a2cdffd41 Mon Sep 17 00:00:00 2001
+From: Povilas Kanapickas <povilas@radix.lt>
+Date: Sun, 19 Dec 2021 18:11:07 +0200
+Subject: [PATCH] dix: Fix use after free in input device shutdown
+
+This fixes access to freed heap memory via dev->master. E.g. when
+running BarrierNotify.ReceivesNotifyEvents/7 test from
+xorg-integration-tests:
+
+==24736==ERROR: AddressSanitizer: heap-use-after-free on address
+0x619000065020 at pc 0x55c450e2b9cf bp 0x7fffc532fd20 sp 0x7fffc532fd10
+READ of size 4 at 0x619000065020 thread T0
+    #0 0x55c450e2b9ce in GetMaster ../../../dix/devices.c:2722
+    #1 0x55c450e9d035 in IsFloating ../../../dix/events.c:346
+    #2 0x55c4513209c6 in GetDeviceUse ../../../Xi/xiquerydevice.c:525
+../../../Xi/xichangehierarchy.c:95
+    #4 0x55c450e3455c in RemoveDevice ../../../dix/devices.c:1204
+../../../hw/xfree86/common/xf86Xinput.c:1142
+    #6 0x55c450e17b04 in CloseDeviceList ../../../dix/devices.c:1038
+    #7 0x55c450e1de85 in CloseDownDevices ../../../dix/devices.c:1068
+    #8 0x55c450e837ef in dix_main ../../../dix/main.c:302
+    #9 0x55c4517a8d93 in main ../../../dix/stubmain.c:34
+(/lib/x86_64-linux-gnu/libc.so.6+0x28564)
+    #11 0x55c450d0113d in _start (/usr/lib/xorg/Xorg+0x117713d)
+
+0x619000065020 is located 160 bytes inside of 912-byte region
+[0x619000064f80,0x619000065310)
+freed by thread T0 here:
+(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
+    #1 0x55c450e19f1c in CloseDevice ../../../dix/devices.c:1014
+    #2 0x55c450e343a4 in RemoveDevice ../../../dix/devices.c:1186
+../../../hw/xfree86/common/xf86Xinput.c:1142
+    #4 0x55c450e17b04 in CloseDeviceList ../../../dix/devices.c:1038
+    #5 0x55c450e1de85 in CloseDownDevices ../../../dix/devices.c:1068
+    #6 0x55c450e837ef in dix_main ../../../dix/main.c:302
+    #7 0x55c4517a8d93 in main ../../../dix/stubmain.c:34
+(/lib/x86_64-linux-gnu/libc.so.6+0x28564)
+
+previously allocated by thread T0 here:
+(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)
+    #1 0x55c450e1c57b in AddInputDevice ../../../dix/devices.c:259
+    #2 0x55c450e34840 in AllocDevicePair ../../../dix/devices.c:2755
+    #3 0x55c45130318f in add_master ../../../Xi/xichangehierarchy.c:152
+../../../Xi/xichangehierarchy.c:465
+    #5 0x55c4512cb9f5 in ProcIDispatch ../../../Xi/extinit.c:390
+    #6 0x55c450e6a92b in Dispatch ../../../dix/dispatch.c:551
+    #7 0x55c450e834b7 in dix_main ../../../dix/main.c:272
+    #8 0x55c4517a8d93 in main ../../../dix/stubmain.c:34
+(/lib/x86_64-linux-gnu/libc.so.6+0x28564)
+
+The problem is caused by dev->master being not reset when disabling the
+device, which then causes dangling pointer when the master device itself
+is being deleted when exiting whole server.
+
+Note that RecalculateMasterButtons() requires dev->master to be still
+valid, so we can reset it only at the end of function.
+
+Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
+---
+ dix/devices.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/dix/devices.c b/dix/devices.c
+index e62c34c55..5f9ce1678 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -520,6 +520,7 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
+     }
+ 
+     RecalculateMasterButtons(dev);
++    dev->master = NULL;
+ 
+     return TRUE;
+ }
+-- 
+2.43.0
+

0001-dix-allocate-enough-space-for-logical-button-maps.patch

@@ -0,0 +1,51 @@
+From 9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 14 Dec 2023 11:29:49 +1000
+Subject: [PATCH 1/9] dix: allocate enough space for logical button maps
+
+Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for
+each logical button currently down. Since buttons can be arbitrarily mapped
+to anything up to 255 make sure we have enough bits for the maximum mapping.
+
+CVE-2023-6816, ZDI-CAN-22664, ZDI-CAN-22665
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+---
+ Xi/xiquerypointer.c | 3 +--
+ dix/enterleave.c    | 5 +++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c
+index 5b77b1a44..2b05ac5f3 100644
+--- a/Xi/xiquerypointer.c
++++ b/Xi/xiquerypointer.c
+@@ -149,8 +149,7 @@ ProcXIQueryPointer(ClientPtr client)
+     if (pDev->button) {
+         int i;
+ 
+-        rep.buttons_len =
+-            bytes_to_int32(bits_to_bytes(pDev->button->numButtons));
++        rep.buttons_len = bytes_to_int32(bits_to_bytes(256)); /* button map up to 255 */
+         rep.length += rep.buttons_len;
+         buttons = calloc(rep.buttons_len, 4);
+         if (!buttons)
+diff --git a/dix/enterleave.c b/dix/enterleave.c
+index 867ec7436..ded8679d7 100644
+--- a/dix/enterleave.c
++++ b/dix/enterleave.c
+@@ -784,8 +784,9 @@ DeviceFocusEvent(DeviceIntPtr dev, int type, int mode, int detail,
+ 
+     mouse = IsFloating(dev) ? dev : GetMaster(dev, MASTER_POINTER);
+ 
+-    /* XI 2 event */
+-    btlen = (mouse->button) ? bits_to_bytes(mouse->button->numButtons) : 0;
++    /* XI 2 event contains the logical button map - maps are CARD8
++     * so we need 256 bits for the possibly maximum mapping */
++    btlen = (mouse->button) ? bits_to_bytes(256) : 0;
+     btlen = bytes_to_int32(btlen);
+     len = sizeof(xXIFocusInEvent) + btlen * 4;
+ 
+-- 
+2.43.0
+

0001-dix-fix-valuator-copy-paste-error-in-the-DeviceState.patch

@@ -0,0 +1,33 @@
+From 133e0d651c5d12bf01999d6289e84e224ba77adc Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 22 Jan 2024 14:22:12 +1000
+Subject: [PATCH] dix: fix valuator copy/paste error in the DeviceStateNotify
+ event
+
+Fixes 219c54b8a3337456ce5270ded6a67bcde53553d5
+---
+ dix/enterleave.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/dix/enterleave.c b/dix/enterleave.c
+index 7b7ba1098..c1e6ac600 100644
+--- a/dix/enterleave.c
++++ b/dix/enterleave.c
+@@ -619,11 +619,11 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v,
+     ev->first_valuator = first;
+     switch (ev->num_valuators) {
+     case 6:
+-        ev->valuator2 = v->axisVal[first + 5];
++        ev->valuator5 = v->axisVal[first + 5];
+     case 5:
+-        ev->valuator2 = v->axisVal[first + 4];
++        ev->valuator4 = v->axisVal[first + 4];
+     case 4:
+-        ev->valuator2 = v->axisVal[first + 3];
++        ev->valuator3 = v->axisVal[first + 3];
+     case 3:
+         ev->valuator2 = v->axisVal[first + 2];
+     case 2:
+-- 
+2.44.0
+

0001-ephyr-Fix-incompatible-pointer-type-build-error.patch

@@ -0,0 +1,54 @@
+From e89edec497bac581ca9b614fb00c25365580f045 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= <jexposit@redhat.com>
+Date: Fri, 19 Jan 2024 13:05:51 +0100
+Subject: [PATCH] ephyr: Fix incompatible pointer type build error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fix a compilation error on 32 bits architectures with gcc 14:
+
+  ephyr_glamor_xv.c: In function ‘ephyr_glamor_xv_init’:
+  ephyr_glamor_xv.c:154:31: error: assignment to ‘SetPortAttributeFuncPtr’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int,  int,  void *)’} from incompatible pointer type ‘int (*)(KdScreenInfo *, Atom,  INT32,  void *)’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int,  long int,  void *)’} [-Wincompatible-pointer-types]
+    154 |     adaptor->SetPortAttribute = ephyr_glamor_xv_set_port_attribute;
+        |                               ^
+  ephyr_glamor_xv.c:155:31: error: assignment to ‘GetPortAttributeFuncPtr’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int,  int *, void *)’} from incompatible pointer type ‘int (*)(KdScreenInfo *, Atom,  INT32 *, void *)’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int,  long int *, void *)’} [-Wincompatible-pointer-types]
+    155 |     adaptor->GetPortAttribute = ephyr_glamor_xv_get_port_attribute;
+        |                               ^
+
+Build error logs:
+https://koji.fedoraproject.org/koji/taskinfo?taskID=111964273
+
+Signed-off-by: José Expósito <jexposit@redhat.com>
+---
+ hw/kdrive/ephyr/ephyr_glamor_xv.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/hw/kdrive/ephyr/ephyr_glamor_xv.c b/hw/kdrive/ephyr/ephyr_glamor_xv.c
+index 4dd15cf41..b5eae48c8 100644
+--- a/hw/kdrive/ephyr/ephyr_glamor_xv.c
++++ b/hw/kdrive/ephyr/ephyr_glamor_xv.c
+@@ -50,16 +50,16 @@ ephyr_glamor_xv_stop_video(KdScreenInfo *screen, void *data, Bool cleanup)
+ 
+ static int
+ ephyr_glamor_xv_set_port_attribute(KdScreenInfo *screen,
+-                                   Atom attribute, INT32 value, void *data)
++                                   Atom attribute, int value, void *data)
+ {
+-    return glamor_xv_set_port_attribute(data, attribute, value);
++    return glamor_xv_set_port_attribute(data, attribute, (INT32)value);
+ }
+ 
+ static int
+ ephyr_glamor_xv_get_port_attribute(KdScreenInfo *screen,
+-                                   Atom attribute, INT32 *value, void *data)
++                                   Atom attribute, int *value, void *data)
+ {
+-    return glamor_xv_get_port_attribute(data, attribute, value);
++    return glamor_xv_get_port_attribute(data, attribute, (INT32 *)value);
+ }
+ 
+ static void
+-- 
+2.43.0
+

0001-hw-Rename-boolean-config-value-field-from-bool-to-bo.patch

@@ -0,0 +1,154 @@
+From 454b3a826edb5fc6d0fea3a9cfd1a5e8fc568747 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Mon, 22 Jul 2019 13:51:06 -0400
+Subject: [PATCH xserver] hw: Rename boolean config value field from bool to
+ boolean
+
+"bool" conflicts with C++ (meh) and stdbool.h (ngh alright fine). This
+is a driver-visible change and will likely break the build for mach64,
+but it can be fixed by simply using xf86ReturnOptValBool like every
+other driver.
+
+Signed-off-by: Adam Jackson <ajax@redhat.com>
+---
+ hw/xfree86/common/xf86Opt.h    |  2 +-
+ hw/xfree86/common/xf86Option.c | 10 +++++-----
+ hw/xwin/winconfig.c            | 22 +++++++++++-----------
+ hw/xwin/winconfig.h            |  2 +-
+ 4 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/hw/xfree86/common/xf86Opt.h b/hw/xfree86/common/xf86Opt.h
+index 3be2a0fc7..3046fbd41 100644
+--- a/hw/xfree86/common/xf86Opt.h
++++ b/hw/xfree86/common/xf86Opt.h
+@@ -41,7 +41,7 @@ typedef union {
+     unsigned long num;
+     const char *str;
+     double realnum;
+-    Bool bool;
++    Bool boolean;
+     OptFrequency freq;
+ } ValueUnion;
+ 
+diff --git a/hw/xfree86/common/xf86Option.c b/hw/xfree86/common/xf86Option.c
+index 06973bca3..ca538cc57 100644
+--- a/hw/xfree86/common/xf86Option.c
++++ b/hw/xfree86/common/xf86Option.c
+@@ -213,7 +213,7 @@ LookupBoolOption(XF86OptionPtr optlist, const char *name, int deflt,
+     o.name = name;
+     o.type = OPTV_BOOLEAN;
+     if (ParseOptionValue(-1, optlist, &o, markUsed))
+-        deflt = o.value.bool;
++        deflt = o.value.boolean;
+     return deflt;
+ }
+ 
+@@ -474,7 +474,7 @@ xf86ShowUnusedOptions(int scrnIndex, XF86OptionPtr opt)
+ static Bool
+ GetBoolValue(OptionInfoPtr p, const char *s)
+ {
+-    return xf86getBoolValue(&p->value.bool, s);
++    return xf86getBoolValue(&p->value.boolean, s);
+ }
+ 
+ static Bool
+@@ -678,7 +678,7 @@ ParseOptionValue(int scrnIndex, XF86OptionPtr options, OptionInfoPtr p,
+             if (markUsed)
+                 xf86MarkOptionUsedByName(options, newn);
+             if (GetBoolValue(&opt, s)) {
+-                p->value.bool = !opt.value.bool;
++                p->value.boolean = !opt.value.boolean;
+                 p->found = TRUE;
+             }
+             else {
+@@ -869,7 +869,7 @@ xf86GetOptValBool(const OptionInfoRec * table, int token, Bool *value)
+ 
+     p = xf86TokenToOptinfo(table, token);
+     if (p && p->found) {
+-        *value = p->value.bool;
++        *value = p->value.boolean;
+         return TRUE;
+     }
+     else
+@@ -883,7 +883,7 @@ xf86ReturnOptValBool(const OptionInfoRec * table, int token, Bool def)
+ 
+     p = xf86TokenToOptinfo(table, token);
+     if (p && p->found) {
+-        return p->value.bool;
++        return p->value.boolean;
+     }
+     else
+         return def;
+diff --git a/hw/xwin/winconfig.c b/hw/xwin/winconfig.c
+index 31894d2fb..646d69006 100644
+--- a/hw/xwin/winconfig.c
++++ b/hw/xwin/winconfig.c
+@@ -623,7 +623,7 @@ winSetBoolOption(void *optlist, const char *name, int deflt)
+     o.name = name;
+     o.type = OPTV_BOOLEAN;
+     if (ParseOptionValue(-1, optlist, &o))
+-        deflt = o.value.bool;
++        deflt = o.value.boolean;
+     return deflt;
+ }
+ 
+@@ -918,7 +918,7 @@ ParseOptionValue(int scrnIndex, void *options, OptionInfoPtr p)
+         }
+         if ((s = winFindOptionValue(options, newn)) != NULL) {
+             if (GetBoolValue(&opt, s)) {
+-                p->value.bool = !opt.value.bool;
++                p->value.boolean = !opt.value.boolean;
+                 p->found = TRUE;
+             }
+             else {
+@@ -968,25 +968,25 @@ static Bool
+ GetBoolValue(OptionInfoPtr p, const char *s)
+ {
+     if (*s == 0) {
+-        p->value.bool = TRUE;
++        p->value.boolean = TRUE;
+     }
+     else {
+         if (winNameCompare(s, "1") == 0)
+-            p->value.bool = TRUE;
++            p->value.boolean = TRUE;
+         else if (winNameCompare(s, "on") == 0)
+-            p->value.bool = TRUE;
++            p->value.boolean = TRUE;
+         else if (winNameCompare(s, "true") == 0)
+-            p->value.bool = TRUE;
++            p->value.boolean = TRUE;
+         else if (winNameCompare(s, "yes") == 0)
+-            p->value.bool = TRUE;
++            p->value.boolean = TRUE;
+         else if (winNameCompare(s, "0") == 0)
+-            p->value.bool = FALSE;
++            p->value.boolean = FALSE;
+         else if (winNameCompare(s, "off") == 0)
+-            p->value.bool = FALSE;
++            p->value.boolean = FALSE;
+         else if (winNameCompare(s, "false") == 0)
+-            p->value.bool = FALSE;
++            p->value.boolean = FALSE;
+         else if (winNameCompare(s, "no") == 0)
+-            p->value.bool = FALSE;
++            p->value.boolean = FALSE;
+     }
+     return TRUE;
+ }
+diff --git a/hw/xwin/winconfig.h b/hw/xwin/winconfig.h
+index f079368c7..bd1f59650 100644
+--- a/hw/xwin/winconfig.h
++++ b/hw/xwin/winconfig.h
+@@ -199,7 +199,7 @@ typedef union {
+     unsigned long num;
+     char *str;
+     double realnum;
+-    Bool bool;
++    Bool boolean;
+     OptFrequency freq;
+ } ValueUnion;
+ 
+-- 
+2.39.0
+

0001-present-Check-for-NULL-to-prevent-crash.patch

@@ -0,0 +1,43 @@
+From 94b4a3d45451d29e9539ea234ce8b5e9ed58546c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?B=C5=82a=C5=BCej=20Szczygie=C5=82?= <spaz16@wp.pl>
+Date: Thu, 13 Jan 2022 00:47:27 +0100
+Subject: [PATCH xserver] present: Check for NULL to prevent crash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1275
+Signed-off-by: Błażej Szczygieł <spaz16@wp.pl>
+Tested-by: Aaron Plattner <aplattner@nvidia.com>
+(cherry picked from commit 22d5818851967408bb7c903cb345b7ca8766094c)
+---
+ present/present_scmd.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/present/present_scmd.c b/present/present_scmd.c
+index 3c68e690b..11391adbb 100644
+--- a/present/present_scmd.c
++++ b/present/present_scmd.c
+@@ -168,6 +168,9 @@ present_scmd_get_crtc(present_screen_priv_ptr screen_priv, WindowPtr window)
+     if (!screen_priv->info)
+         return NULL;
+ 
++    if (!screen_priv->info->get_crtc)
++        return NULL;
++
+     return (*screen_priv->info->get_crtc)(window);
+ }
+ 
+@@ -206,6 +209,9 @@ present_flush(WindowPtr window)
+     if (!screen_priv->info)
+         return;
+ 
++    if (!screen_priv->info->flush)
++        return;
++
+     (*screen_priv->info->flush) (window);
+ }
+ 
+-- 
+2.34.1
+

0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch

@@ -0,0 +1,105 @@
+From b98fc07d3442a289c6bef82df50dd0a2d01de71a Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Thu, 2 Feb 2023 12:26:27 -0500
+Subject: [PATCH xserver] present: Send a PresentConfigureNotify event for
+ destroyed windows
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This enables fixing a deadlock case on the client side, where the client
+ends up blocked waiting for a Present event that will never come because
+the window was destroyed. The new PresentWindowDestroyed flag allows the
+client to avoid blocking indefinitely.
+
+Signed-off-by: Adam Jackson <ajax@redhat.com>
+See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/116
+See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6685
+Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
+(cherry picked from commit 462b06033e66a32308d940eb5fc47f5e4c914dc0)
+---
+ present/present_event.c  |  5 +++--
+ present/present_priv.h   |  7 ++++++-
+ present/present_screen.c | 11 ++++++++++-
+ 3 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/present/present_event.c b/present/present_event.c
+index 435b26b70..849732dc8 100644
+--- a/present/present_event.c
++++ b/present/present_event.c
+@@ -102,7 +102,8 @@ present_event_swap(xGenericEvent *from, xGenericEvent *to)
+ }
+ 
+ void
+-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling)
++present_send_config_notify(WindowPtr window, int x, int y, int w, int h,
++                           int bw, WindowPtr sibling, CARD32 flags)
+ {
+     present_window_priv_ptr window_priv = present_window_priv(window);
+ 
+@@ -122,7 +123,7 @@ present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw,
+             .off_y = 0,
+             .pixmap_width = w,
+             .pixmap_height = h,
+-            .pixmap_flags = 0
++            .pixmap_flags = flags
+         };
+         present_event_ptr event;
+ 
+diff --git a/present/present_priv.h b/present/present_priv.h
+index 6ebd009a2..4ad729864 100644
+--- a/present/present_priv.h
++++ b/present/present_priv.h
+@@ -43,6 +43,11 @@
+ #define DebugPresent(x)
+ #endif
+ 
++/* XXX this belongs in presentproto */
++#ifndef PresentWindowDestroyed
++#define PresentWindowDestroyed (1 << 0)
++#endif
++
+ extern int present_request;
+ 
+ extern DevPrivateKeyRec present_screen_private_key;
+@@ -307,7 +312,7 @@ void
+ present_free_events(WindowPtr window);
+ 
+ void
+-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling);
++present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling, CARD32 flags);
+ 
+ void
+ present_send_complete_notify(WindowPtr window, CARD8 kind, CARD8 mode, CARD32 serial, uint64_t ust, uint64_t msc);
+diff --git a/present/present_screen.c b/present/present_screen.c
+index 15684eda4..2c29aafd2 100644
+--- a/present/present_screen.c
++++ b/present/present_screen.c
+@@ -93,6 +93,15 @@ present_destroy_window(WindowPtr window)
+     present_screen_priv_ptr screen_priv = present_screen_priv(screen);
+     present_window_priv_ptr window_priv = present_window_priv(window);
+ 
++    present_send_config_notify(window,
++                               window->drawable.x,
++                               window->drawable.y,
++                               window->drawable.width,
++                               window->drawable.height,
++                               window->borderWidth,
++                               window->nextSib,
++                               PresentWindowDestroyed);
++
+     if (window_priv) {
+         present_clear_window_notifies(window);
+         present_free_events(window);
+@@ -123,7 +132,7 @@ present_config_notify(WindowPtr window,
+     ScreenPtr screen = window->drawable.pScreen;
+     present_screen_priv_ptr screen_priv = present_screen_priv(screen);
+ 
+-    present_send_config_notify(window, x, y, w, h, bw, sibling);
++    present_send_config_notify(window, x, y, w, h, bw, sibling, 0);
+ 
+     unwrap(screen_priv, screen, ConfigNotify);
+     if (screen->ConfigNotify)
+-- 
+2.40.0
+

0001-randr-avoid-integer-truncation-in-length-check-of-Pr.patch

@@ -0,0 +1,61 @@
+From 58e83c683950ac9e253ab05dd7a13a8368b70a3c Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 27 Nov 2023 16:27:49 +1000
+Subject: [PATCH xserver] randr: avoid integer truncation in length check of
+ ProcRRChange*Property
+
+Affected are ProcRRChangeProviderProperty and ProcRRChangeOutputProperty.
+See also xserver@8f454b79 where this same bug was fixed for the core
+protocol and XI.
+
+This fixes an OOB read and the resulting information disclosure.
+
+Length calculation for the request was clipped to a 32-bit integer. With
+the correct stuff->nUnits value the expected request size was
+truncated, passing the REQUEST_FIXED_SIZE check.
+
+The server then proceeded with reading at least stuff->num_items bytes
+(depending on stuff->format) from the request and stuffing whatever it
+finds into the property. In the process it would also allocate at least
+stuff->nUnits bytes, i.e. 4GB.
+
+CVE-2023-6478, ZDI-CAN-22561
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+(cherry picked from commit 14f480010a93ff962fef66a16412fafff81ad632)
+---
+ randr/rrproperty.c         | 2 +-
+ randr/rrproviderproperty.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/randr/rrproperty.c b/randr/rrproperty.c
+index 25469f57b2..c4fef8a1f6 100644
+--- a/randr/rrproperty.c
++++ b/randr/rrproperty.c
+@@ -530,7 +530,7 @@ ProcRRChangeOutputProperty(ClientPtr client)
+     char format, mode;
+     unsigned long len;
+     int sizeInBytes;
+-    int totalSize;
++    uint64_t totalSize;
+     int err;
+ 
+     REQUEST_AT_LEAST_SIZE(xRRChangeOutputPropertyReq);
+diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c
+index b79c17f9bf..90c5a9a933 100644
+--- a/randr/rrproviderproperty.c
++++ b/randr/rrproviderproperty.c
+@@ -498,7 +498,7 @@ ProcRRChangeProviderProperty(ClientPtr client)
+     char format, mode;
+     unsigned long len;
+     int sizeInBytes;
+-    int totalSize;
++    uint64_t totalSize;
+     int err;
+ 
+     REQUEST_AT_LEAST_SIZE(xRRChangeProviderPropertyReq);
+-- 
+2.43.0
+

0001-render-Avoid-possible-double-free-in-ProcRenderAddGl.patch

@@ -0,0 +1,72 @@
+From 337d8d48b618d4fc0168a7b978be4c3447650b04 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Fri, 5 Apr 2024 15:24:49 +0200
+Subject: [PATCH] render: Avoid possible double-free in ProcRenderAddGlyphs()
+
+ProcRenderAddGlyphs() adds the glyph to the glyphset using AddGlyph() and
+then frees it using FreeGlyph() to decrease the reference count, after
+AddGlyph() has increased it.
+
+AddGlyph() however may chose to reuse an existing glyph if it's already
+in the glyphSet, and free the glyph that was given, in which case the
+caller function, ProcRenderAddGlyphs() will call FreeGlyph() on an
+already freed glyph, as reported by ASan:
+
+  READ of size 4 thread T0
+    #0 in FreeGlyph xserver/render/glyph.c:252
+    #1 in ProcRenderAddGlyphs xserver/render/render.c:1174
+    #2 in Dispatch xserver/dix/dispatch.c:546
+    #3 in dix_main xserver/dix/main.c:271
+    #4 in main xserver/dix/stubmain.c:34
+    #5 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
+    #6 in __libc_start_main_impl ../csu/libc-start.c:360
+    #7  (/usr/bin/Xwayland+0x44fe4)
+  Address is located 0 bytes inside of 64-byte region
+  freed by thread T0 here:
+    #0 in __interceptor_free libsanitizer/asan/asan_malloc_linux.cpp:52
+    #1 in _dixFreeObjectWithPrivates xserver/dix/privates.c:538
+    #2 in AddGlyph xserver/render/glyph.c:295
+    #3 in ProcRenderAddGlyphs xserver/render/render.c:1173
+    #4 in Dispatch xserver/dix/dispatch.c:546
+    #5 in dix_main xserver/dix/main.c:271
+    #6 in main xserver/dix/stubmain.c:34
+    #7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
+  previously allocated by thread T0 here:
+    #0 in __interceptor_malloc libsanitizer/asan/asan_malloc_linux.cpp:69
+    #1 in AllocateGlyph xserver/render/glyph.c:355
+    #2 in ProcRenderAddGlyphs xserver/render/render.c:1085
+    #3 in Dispatch xserver/dix/dispatch.c:546
+    #4 in dix_main xserver/dix/main.c:271
+    #5 in main xserver/dix/stubmain.c:34
+    #6 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
+  SUMMARY: AddressSanitizer: heap-use-after-free xserver/render/glyph.c:252 in FreeGlyph
+
+To avoid that, make sure not to free the given glyph in AddGlyph().
+
+v2: Simplify the test using the boolean returned from AddGlyph() (Michel)
+v3: Simplify even more by not freeing the glyph in AddGlyph() (Peter)
+
+Fixes: bdca6c3d1 - render: fix refcounting of glyphs during ProcRenderAddGlyphs
+Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1659
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1476>
+---
+ render/glyph.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/render/glyph.c b/render/glyph.c
+index 13991f8a1..5fa7f3b5b 100644
+--- a/render/glyph.c
++++ b/render/glyph.c
+@@ -291,8 +291,6 @@ AddGlyph(GlyphSetPtr glyphSet, GlyphPtr glyph, Glyph id)
+     gr = FindGlyphRef(&globalGlyphs[glyphSet->fdepth], signature,
+                       TRUE, glyph->sha1);
+     if (gr->glyph && gr->glyph != DeletedGlyph && gr->glyph != glyph) {
+-        FreeGlyphPicture(glyph);
+-        dixFreeObjectWithPrivates(glyph, PRIVATE_GLYPH);
+         glyph = gr->glyph;
+     }
+     else if (gr->glyph != glyph) {
+-- 
+2.44.0
+

0001-render-Fix-build-with-gcc-12.patch

@@ -0,0 +1,90 @@
+From 53173fdab492f0f638f6616fcf01af0b9ea6338d Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Thu, 20 Jan 2022 10:20:38 +0100
+Subject: [PATCH xserver] render: Fix build with gcc 12
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The xserver fails to compile with the latest gcc 12:
+
+ render/picture.c: In function ‘CreateSolidPicture’:
+ render/picture.c:874:26: error: array subscript ‘union _SourcePict[0]’ is partly outside array bounds of ‘unsigned char[16]’ [-Werror=array-bounds]
+  874 |     pPicture->pSourcePict->type = SourcePictTypeSolidFill;
+      |                          ^~
+ render/picture.c:868:45: note: object of size 16 allocated by ‘malloc’
+  868 |     pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictSolidFill));
+      |                                             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ render/picture.c: In function ‘CreateLinearGradientPicture’:
+ render/picture.c:906:26: error: array subscript ‘union _SourcePict[0]’ is partly outside array bounds of ‘unsigned char[32]’ [-Werror=array-bounds]
+  906 |     pPicture->pSourcePict->linear.type = SourcePictTypeLinear;
+      |                          ^~
+ render/picture.c:899:45: note: object of size 32 allocated by ‘malloc’
+  899 |     pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictLinearGradient));
+      |                                             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ render/picture.c: In function ‘CreateConicalGradientPicture’:
+ render/picture.c:989:26: error: array subscript ‘union _SourcePict[0]’ is partly outside array bounds of ‘unsigned char[32]’ [-Werror=array-bounds]
+  989 |     pPicture->pSourcePict->conical.type = SourcePictTypeConical;
+      |                          ^~
+ render/picture.c:982:45: note: object of size 32 allocated by ‘malloc’
+  982 |     pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictConicalGradient));
+      |                                             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ cc1: some warnings being treated as errors
+ ninja: build stopped: subcommand failed.
+
+This is because gcc 12 has become stricter and raises a warning now.
+
+Fix the warning/error by allocating enough memory to store the union
+struct.
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Acked-by: Michel Dänzer <mdaenzer@redhat.com>
+Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1256
+(cherry picked from commit c6b0dcb82d4db07a2f32c09a8c09c85a5f57248e)
+---
+ render/picture.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/render/picture.c b/render/picture.c
+index afa0d258f..2be4b1954 100644
+--- a/render/picture.c
++++ b/render/picture.c
+@@ -865,7 +865,7 @@ CreateSolidPicture(Picture pid, xRenderColor * color, int *error)
+     }
+ 
+     pPicture->id = pid;
+-    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictSolidFill));
++    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict));
+     if (!pPicture->pSourcePict) {
+         *error = BadAlloc;
+         free(pPicture);
+@@ -896,7 +896,7 @@ CreateLinearGradientPicture(Picture pid, xPointFixed * p1, xPointFixed * p2,
+     }
+ 
+     pPicture->id = pid;
+-    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictLinearGradient));
++    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict));
+     if (!pPicture->pSourcePict) {
+         *error = BadAlloc;
+         free(pPicture);
+@@ -936,7 +936,7 @@ CreateRadialGradientPicture(Picture pid, xPointFixed * inner,
+     }
+ 
+     pPicture->id = pid;
+-    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictRadialGradient));
++    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict));
+     if (!pPicture->pSourcePict) {
+         *error = BadAlloc;
+         free(pPicture);
+@@ -979,7 +979,7 @@ CreateConicalGradientPicture(Picture pid, xPointFixed * center, xFixed angle,
+     }
+ 
+     pPicture->id = pid;
+-    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictConicalGradient));
++    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict));
+     if (!pPicture->pSourcePict) {
+         *error = BadAlloc;
+         free(pPicture);
+-- 
+2.34.1
+

0001-xf86-Accept-devices-with-the-simpledrm-driver.patch

@@ -0,0 +1,34 @@
+From b9218fadf3c09d83566549279d68886d8258f79c Mon Sep 17 00:00:00 2001
+From: nerdopolis <rbos@rbos>
+Date: Thu, 30 Sep 2021 08:51:18 -0400
+Subject: [PATCH] xf86: Accept devices with the 'simpledrm' driver.
+
+SimpleDRM 'devices' are a fallback device, and do not have a busid
+so they are getting skipped. This will allow simpledrm to work
+with the modesetting driver
+---
+ hw/xfree86/common/xf86platformBus.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/hw/xfree86/common/xf86platformBus.c b/hw/xfree86/common/xf86platformBus.c
+index 0e0a995ac..45028f7a6 100644
+--- a/hw/xfree86/common/xf86platformBus.c
++++ b/hw/xfree86/common/xf86platformBus.c
+@@ -557,8 +557,13 @@ xf86platformProbeDev(DriverPtr drvp)
+             }
+             else {
+                 /* for non-seat0 servers assume first device is the master */
+-                if (ServerIsNotSeat0())
++                if (ServerIsNotSeat0()) {
+                     break;
++                } else {
++                    /* Accept the device if the driver is simpledrm */
++                    if (strcmp(xf86_platform_devices[j].attribs->driver, "simpledrm") == 0)
++                        break;
++                }
+ 
+                 if (xf86IsPrimaryPlatform(&xf86_platform_devices[j]))
+                     break;
+-- 
+2.35.1
+

0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch

@@ -52,7 +52,7 @@ index 6619e3aa7..1f8ad14bc 100644
      /* For non-PCI devices and drmGetDevice fail, just assume that
       * the 3D driver is named the same as the kernel driver. This is
       * currently true for vc4 and msm (freedreno).
-@@ -1454,12 +1458,14 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info)
+@@ -1456,12 +1460,14 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info)
              xf86DrvMsg(pScreen->myNum, X_ERROR,
                         "[DRI2] Couldn't drmGetVersion() on non-PCI device, "
                         "no driver name found.\n");
@@ -70,7 +70,7 @@ index 6619e3aa7..1f8ad14bc 100644
      }
  
      for (i = 0; driver_map[i].driver; i++) {
-@@ -1467,13 +1473,15 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info)
+@@ -1469,13 +1475,15 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info)
              continue;
  
          if (driver_map[i].num_chips_ids == -1) {
@@ -88,7 +88,7 @@ index 6619e3aa7..1f8ad14bc 100644
                  goto out;
              }
          }
-@@ -1485,9 +1493,9 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info)
+@@ -1487,9 +1495,9 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info)
                 dev->deviceinfo.pci->vendor_id, dev->deviceinfo.pci->device_id);
  out:
      drmFreeDevice(&dev);
@@ -100,21 +100,21 @@ index 6619e3aa7..1f8ad14bc 100644
  #endif
  }
  
-@@ -1604,7 +1612,8 @@ DRI2ScreenInit(ScreenPtr pScreen, DRI2InfoPtr info)
+@@ -1610,7 +1618,8 @@ DRI2ScreenInit(ScreenPtr pScreen, DRI2InfoPtr info)
+         if (info->driverName) {
+             ds->driverNames[0] = info->driverName;
          } else {
-             /* FIXME dri2_probe_driver_name() returns a strdup-ed string,
-              * currently this gets leaked */
 -            ds->driverNames[0] = ds->driverNames[1] = dri2_probe_driver_name(pScreen, info);
 +            dri2_probe_driver_name(pScreen, info,
 +                                   &ds->driverNames[0], &ds->driverNames[1]);
              if (!ds->driverNames[0])
                  return FALSE;
- 
+         }
 diff --git a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
 index da7ea1c1e..7036d1003 100644
 --- a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
 +++ b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-@@ -60,23 +60,24 @@ static const int vmwgfx_chip_ids[] = {
+@@ -66,21 +66,22 @@ static const int vmwgfx_chip_ids[] = {
  static const struct {
     int vendor_id;
     const char *driver;
@@ -124,10 +124,8 @@ index da7ea1c1e..7036d1003 100644
  } driver_map[] = {
 -   { 0x8086, "i915", i915_chip_ids, ARRAY_SIZE(i915_chip_ids) },
 -   { 0x8086, "i965", i965_chip_ids, ARRAY_SIZE(i965_chip_ids) },
--   { 0x8086, "i965", NULL, -1 },
 +   { 0x8086, "i915", "i915", i915_chip_ids, ARRAY_SIZE(i915_chip_ids) },
 +   { 0x8086, "i965", "va_gl", i965_chip_ids, ARRAY_SIZE(i965_chip_ids) },
-+   { 0x8086, "i965", "va_gl", NULL, -1 },
  #ifndef DRIVER_MAP_GALLIUM_ONLY
 -   { 0x1002, "radeon", r100_chip_ids, ARRAY_SIZE(r100_chip_ids) },
 -   { 0x1002, "r200", r200_chip_ids, ARRAY_SIZE(r200_chip_ids) },
@@ -136,18 +134,19 @@ index da7ea1c1e..7036d1003 100644
  #endif
 -   { 0x1002, "r300", r300_chip_ids, ARRAY_SIZE(r300_chip_ids) },
 -   { 0x1002, "r600", r600_chip_ids, ARRAY_SIZE(r600_chip_ids) },
--   { 0x1002, "radeonsi", NULL, -1 },
+-   { 0x1002, "radeonsi", radeonsi_chip_ids, ARRAY_SIZE(radeonsi_chip_ids) },
 -   { 0x10de, "nouveau", NULL, -1 },
 -   { 0x1af4, "virtio_gpu", virtio_gpu_chip_ids, ARRAY_SIZE(virtio_gpu_chip_ids) },
 -   { 0x15ad, "vmwgfx", vmwgfx_chip_ids, ARRAY_SIZE(vmwgfx_chip_ids) },
--   { 0x0000, NULL, NULL, 0 },
 +   { 0x1002, "r300", "r300", r300_chip_ids, ARRAY_SIZE(r300_chip_ids) },
-+   { 0x1002, "r600", "r600", r600_chip_ids, ARRAY_SIZE(r600_chip_ids) },
-+   { 0x1002, "radeonsi", "radeonsi", NULL, -1 },
++   { 0x1002, "r600","r600",  r600_chip_ids, ARRAY_SIZE(r600_chip_ids) },
++   { 0x1002, "radeonsi", "radeonsi", radeonsi_chip_ids, ARRAY_SIZE(radeonsi_chip_ids) },
 +   { 0x10de, "nouveau", "nouveau", NULL, -1 },
 +   { 0x1af4, "virtio_gpu", "virtio_gpu", virtio_gpu_chip_ids, ARRAY_SIZE(virtio_gpu_chip_ids) },
 +   { 0x15ad, "vmwgfx", "vmwgfx", vmwgfx_chip_ids, ARRAY_SIZE(vmwgfx_chip_ids) },
-+   { 0x0000, NULL, NULL, NULL, 0 },
+    { 0x0000, NULL, NULL, 0 },
  };
  
- #endif /* _PCI_ID_DRIVER_MAP_H_ */
+-- 
+2.19.0
+

0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch

@@ -0,0 +1,54 @@
+From 56351307017e2501f7cd6e31efcfb55c19aba75a Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Thu, 10 Oct 2024 10:37:28 +0200
+Subject: [PATCH] xkb: Fix buffer overflow in _XkbSetCompatMap()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
+buffer.
+
+However, It didn't update its size properly. It updated `num_si` only,
+without updating `size_si`.
+
+This may lead to local privilege escalation if the server is run as root
+or remote code execution (e.g. x11 over ssh).
+
+CVE-2024-9632, ZDI-CAN-24756
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: José Expósito <jexposit@redhat.com>
+---
+ xkb/xkb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index f203270d5..70e8279aa 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -2991,13 +2991,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
+         XkbSymInterpretPtr sym;
+         unsigned int skipped = 0;
+ 
+-        if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) {
+-            compat->num_si = req->firstSI + req->nSI;
++        if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
++            compat->num_si = compat->size_si = req->firstSI + req->nSI;
+             compat->sym_interpret = reallocarray(compat->sym_interpret,
+-                                                 compat->num_si,
++                                                 compat->size_si,
+                                                  sizeof(XkbSymInterpretRec));
+             if (!compat->sym_interpret) {
+-                compat->num_si = 0;
++                compat->num_si = compat->size_si = 0;
+                 return BadAlloc;
+             }
+         }
+-- 
+2.46.2
+

0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch

@@ -0,0 +1,59 @@
+From 18f91b950e22c2a342a4fbc55e9ddf7534a707d2 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 13 Jul 2022 11:23:09 +1000
+Subject: [PATCH xserver] xkb: fix some possible memleaks in XkbGetKbdByName
+
+GetComponentByName returns an allocated string, so let's free that if we
+fail somewhere.
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ xkb/xkb.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index 4692895db..b79a269e3 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -5935,18 +5935,32 @@ ProcXkbGetKbdByName(ClientPtr client)
+     xkb = dev->key->xkbInfo->desc;
+     status = Success;
+     str = (unsigned char *) &stuff[1];
+-    if (GetComponentSpec(&str, TRUE, &status))  /* keymap, unsupported */
+-        return BadMatch;
++    {
++        char *keymap = GetComponentSpec(&str, TRUE, &status);  /* keymap, unsupported */
++        if (keymap) {
++            free(keymap);
++            return BadMatch;
++        }
++    }
+     names.keycodes = GetComponentSpec(&str, TRUE, &status);
+     names.types = GetComponentSpec(&str, TRUE, &status);
+     names.compat = GetComponentSpec(&str, TRUE, &status);
+     names.symbols = GetComponentSpec(&str, TRUE, &status);
+     names.geometry = GetComponentSpec(&str, TRUE, &status);
+-    if (status != Success)
++    if (status == Success) {
++        len = str - ((unsigned char *) stuff);
++        if ((XkbPaddedSize(len) / 4) != stuff->length)
++            status = BadLength;
++    }
++
++    if (status != Success) {
++        free(names.keycodes);
++        free(names.types);
++        free(names.compat);
++        free(names.symbols);
++        free(names.geometry);
+         return status;
+-    len = str - ((unsigned char *) stuff);
+-    if ((XkbPaddedSize(len) / 4) != stuff->length)
+-        return BadLength;
++    }
+ 
+     CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask);
+     CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask);
+-- 
+2.38.1
+

0001-xkb-proof-GetCountedString-against-request-length-at.patch

@@ -0,0 +1,35 @@
+From 11beef0b7f1ed290348e45618e5fa0d2bffcb72e Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 5 Jul 2022 12:06:20 +1000
+Subject: [PATCH xserver] xkb: proof GetCountedString against request length
+ attacks
+
+GetCountedString did a check for the whole string to be within the
+request buffer but not for the initial 2 bytes that contain the length
+field. A swapped client could send a malformed request to trigger a
+swaps() on those bytes, writing into random memory.
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ xkb/xkb.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index f42f59ef3..1841cff26 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -5137,6 +5137,11 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str)
+     CARD16 len;
+ 
+     wire = *wire_inout;
++
++    if (client->req_len <
++        bytes_to_int32(wire + 2 - (char *) client->requestBuffer))
++        return BadValue;
++
+     len = *(CARD16 *) wire;
+     if (client->swapped) {
+         swaps(&len);
+-- 
+2.38.1
+

0001-xkb-switch-to-array-index-loops-to-moving-pointers.patch

@@ -0,0 +1,76 @@
+From f1070c01d616c5f21f939d5ebc533738779451ac Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 5 Jul 2022 12:40:47 +1000
+Subject: [PATCH xserver 1/3] xkb: switch to array index loops to moving
+ pointers
+
+Most similar loops here use a pointer that advances with each loop
+iteration, let's do the same here for consistency.
+
+No functional changes.
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
+---
+ xkb/xkb.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index a29262c24..64e52611e 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -5368,16 +5368,16 @@ _CheckSetSections(XkbGeometryPtr geom,
+             row->left = rWire->left;
+             row->vertical = rWire->vertical;
+             kWire = (xkbKeyWireDesc *) &rWire[1];
+-            for (k = 0; k < rWire->nKeys; k++) {
++            for (k = 0; k < rWire->nKeys; k++, kWire++) {
+                 XkbKeyPtr key;
+ 
+                 key = XkbAddGeomKey(row);
+                 if (!key)
+                     return BadAlloc;
+-                memcpy(key->name.name, kWire[k].name, XkbKeyNameLength);
+-                key->gap = kWire[k].gap;
+-                key->shape_ndx = kWire[k].shapeNdx;
+-                key->color_ndx = kWire[k].colorNdx;
++                memcpy(key->name.name, kWire->name, XkbKeyNameLength);
++                key->gap = kWire->gap;
++                key->shape_ndx = kWire->shapeNdx;
++                key->color_ndx = kWire->colorNdx;
+                 if (key->shape_ndx >= geom->num_shapes) {
+                     client->errorValue = _XkbErrCode3(0x10, key->shape_ndx,
+                                                       geom->num_shapes);
+@@ -5389,7 +5389,7 @@ _CheckSetSections(XkbGeometryPtr geom,
+                     return BadMatch;
+                 }
+             }
+-            rWire = (xkbRowWireDesc *) &kWire[rWire->nKeys];
++            rWire = (xkbRowWireDesc *)kWire;
+         }
+         wire = (char *) rWire;
+         if (sWire->nDoodads > 0) {
+@@ -5454,16 +5454,16 @@ _CheckSetShapes(XkbGeometryPtr geom,
+                     return BadAlloc;
+                 ol->corner_radius = olWire->cornerRadius;
+                 ptWire = (xkbPointWireDesc *) &olWire[1];
+-                for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++) {
+-                    pt->x = ptWire[p].x;
+-                    pt->y = ptWire[p].y;
++                for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++, ptWire++) {
++                    pt->x = ptWire->x;
++                    pt->y = ptWire->y;
+                     if (client->swapped) {
+                         swaps(&pt->x);
+                         swaps(&pt->y);
+                     }
+                 }
+                 ol->num_points = olWire->nPoints;
+-                olWire = (xkbOutlineWireDesc *) (&ptWire[olWire->nPoints]);
++                olWire = (xkbOutlineWireDesc *)ptWire;
+             }
+             if (shapeWire->primaryNdx != XkbNoShape)
+                 shape->primary = &shape->outlines[shapeWire->primaryNdx];
+-- 
+2.36.1
+

0002-Xi-ProcXIPassiveGrabDevice-needs-to-use-unswapped-le.patch

@@ -0,0 +1,43 @@
+From 3e77295f888c67fc7645db5d0c00926a29ffecee Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Fri, 22 Mar 2024 18:56:27 -0700
+Subject: [PATCH 2/4] Xi: ProcXIPassiveGrabDevice needs to use unswapped length
+ to send reply
+
+CVE-2024-31081
+
+Fixes: d220d6907 ("Xi: add GrabButton and GrabKeysym code.")
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
+---
+ Xi/xipassivegrab.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
+index c9ac2f855..896233bec 100644
+--- a/Xi/xipassivegrab.c
++++ b/Xi/xipassivegrab.c
+@@ -93,6 +93,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
+     GrabParameters param;
+     void *tmp;
+     int mask_len;
++    uint32_t length;
+ 
+     REQUEST(xXIPassiveGrabDeviceReq);
+     REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,
+@@ -247,9 +248,11 @@ ProcXIPassiveGrabDevice(ClientPtr client)
+         }
+     }
+ 
++    /* save the value before SRepXIPassiveGrabDevice swaps it */
++    length = rep.length;
+     WriteReplyToClient(client, sizeof(rep), &rep);
+     if (rep.num_modifiers)
+-        WriteToClient(client, rep.length * 4, modifiers_failed);
++        WriteToClient(client, length * 4, modifiers_failed);
+ 
+  out:
+     free(modifiers_failed);
+-- 
+2.44.0
+

0002-Xi-return-an-error-from-XI-property-changes-if-verif.patch

@@ -0,0 +1,41 @@
+From c5ff57676698f19ed3a1402aef58a15552e32d27 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 29 Nov 2022 13:24:00 +1000
+Subject: [PATCH xserver 2/7] Xi: return an error from XI property changes if
+ verification failed
+
+Both ProcXChangeDeviceProperty and ProcXIChangeProperty checked the
+property for validity but didn't actually return the potential error.
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+---
+ Xi/xiproperty.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
+index a36f7d61df..68c362c628 100644
+--- a/Xi/xiproperty.c
++++ b/Xi/xiproperty.c
+@@ -902,6 +902,8 @@ ProcXChangeDeviceProperty(ClientPtr client)
+ 
+     rc = check_change_property(client, stuff->property, stuff->type,
+                                stuff->format, stuff->mode, stuff->nUnits);
++    if (rc != Success)
++        return rc;
+ 
+     len = stuff->nUnits;
+     if (len > (bytes_to_int32(0xffffffff - sizeof(xChangeDevicePropertyReq))))
+@@ -1141,6 +1143,9 @@ ProcXIChangeProperty(ClientPtr client)
+ 
+     rc = check_change_property(client, stuff->property, stuff->type,
+                                stuff->format, stuff->mode, stuff->num_items);
++    if (rc != Success)
++        return rc;
++
+     len = stuff->num_items;
+     if (len > bytes_to_int32(0xffffffff - sizeof(xXIChangePropertyReq)))
+         return BadLength;
+-- 
+2.38.1
+

0002-dix-Allocate-sufficient-xEvents-for-our-DeviceStateN.patch

@@ -0,0 +1,84 @@
+From ece23be888a93b741aa1209d1dbf64636109d6a5 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 18 Dec 2023 14:27:50 +1000
+Subject: [PATCH 2/9] dix: Allocate sufficient xEvents for our
+ DeviceStateNotify
+
+If a device has both a button class and a key class and numButtons is
+zero, we can get an OOB write due to event under-allocation.
+
+This function seems to assume a device has either keys or buttons, not
+both. It has two virtually identical code paths, both of which assume
+they're applying to the first event in the sequence.
+
+A device with both a key and button class triggered a logic bug - only
+one xEvent was allocated but the deviceStateNotify pointer was pushed on
+once per type. So effectively this logic code:
+
+   int count = 1;
+   if (button && nbuttons > 32) count++;
+   if (key && nbuttons > 0) count++;
+   if (key && nkeys > 32) count++; // this is basically always true
+   // count is at 2 for our keys + zero button device
+
+   ev = alloc(count * sizeof(xEvent));
+   FixDeviceStateNotify(ev);
+   if (button)
+     FixDeviceStateNotify(ev++);
+   if (key)
+     FixDeviceStateNotify(ev++);   // santa drops into the wrong chimney here
+
+If the device has more than 3 valuators, the OOB is pushed back - we're
+off by one so it will happen when the last deviceValuator event is
+written instead.
+
+Fix this by allocating the maximum number of events we may allocate.
+Note that the current behavior is not protocol-correct anyway, this
+patch fixes only the allocation issue.
+
+Note that this issue does not trigger if the device has at least one
+button. While the server does not prevent a button class with zero
+buttons, it is very unlikely.
+
+CVE-2024-0229, ZDI-CAN-22678
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+---
+ dix/enterleave.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/dix/enterleave.c b/dix/enterleave.c
+index ded8679d7..17964b00a 100644
+--- a/dix/enterleave.c
++++ b/dix/enterleave.c
+@@ -675,7 +675,8 @@ static void
+ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
+ {
+     int evcount = 1;
+-    deviceStateNotify *ev, *sev;
++    deviceStateNotify sev[6 + (MAX_VALUATORS + 2)/3];
++    deviceStateNotify *ev;
+     deviceKeyStateNotify *kev;
+     deviceButtonStateNotify *bev;
+ 
+@@ -714,7 +715,7 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
+         }
+     }
+ 
+-    sev = ev = xallocarray(evcount, sizeof(xEvent));
++    ev = sev;
+     FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first);
+ 
+     if (b != NULL) {
+@@ -770,7 +771,6 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
+ 
+     DeliverEventsToWindow(dev, win, (xEvent *) sev, evcount,
+                           DeviceStateNotifyMask, NullGrab);
+-    free(sev);
+ }
+ 
+ void
+-- 
+2.43.0
+

0002-dix-keep-a-ref-to-the-rootCursor.patch

@@ -0,0 +1,49 @@
+From 9dc8beff846a127cc8754212fb654e5f66dacff4 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 4 Dec 2024 15:49:43 +1000
+Subject: [PATCH xserver 02/13] dix: keep a ref to the rootCursor
+
+CreateCursor returns a cursor with refcount 1 - that refcount is used by
+the resource system, any caller needs to call RefCursor to get their own
+reference. That happens correctly for normal cursors but for our
+rootCursor we keep a variable to the cursor despite not having a ref for
+ourselves.
+
+Fix this by reffing/unreffing the rootCursor to ensure our pointer is
+valid.
+
+Related to CVE-2025-26594, ZDI-CAN-25544
+
+Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
+(cherry picked from commit b0a09ba6020147961acc62d9c73d807b4cccd9f7)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ dix/main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/dix/main.c b/dix/main.c
+index b228d9c28..f2606d3d6 100644
+--- a/dix/main.c
++++ b/dix/main.c
+@@ -235,6 +235,8 @@ dix_main(int argc, char *argv[], char *envp[])
+                        defaultCursorFont);
+         }
+ 
++        rootCursor = RefCursor(rootCursor);
++
+ #ifdef PANORAMIX
+         /*
+          * Consolidate window and colourmap information for each screen
+@@ -275,6 +277,8 @@ dix_main(int argc, char *argv[], char *envp[])
+ 
+         Dispatch();
+ 
++        UnrefCursor(rootCursor);
++
+         UndisplayDevices();
+         DisableAllDevices();
+ 
+-- 
+2.48.1
+

0002-mi-reset-the-PointerWindows-reference-on-screen-swit.patch

@@ -0,0 +1,99 @@
+From 004f461c440cb6611eefb48fbbb4fa53a6d49f80 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 5 Oct 2023 12:19:45 +1000
+Subject: [PATCH xserver 2/4] mi: reset the PointerWindows reference on screen
+ switch
+
+PointerWindows[] keeps a reference to the last window our sprite
+entered - changes are usually handled by CheckMotion().
+
+If we switch between screens via XWarpPointer our
+dev->spriteInfo->sprite->win is set to the new screen's root window.
+If there's another window at the cursor location CheckMotion() will
+trigger the right enter/leave events later. If there is not, it skips
+that process and we never trigger LeaveWindow() - PointerWindows[] for
+the device still refers to the previous window.
+
+If that window is destroyed we have a dangling reference that will
+eventually cause a use-after-free bug when checking the window hierarchy
+later.
+
+To trigger this, we require:
+- two protocol screens
+- XWarpPointer to the other screen's root window
+- XDestroyWindow before entering any other window
+
+This is a niche bug so we hack around it by making sure we reset the
+PointerWindows[] entry so we cannot have a dangling pointer. This
+doesn't handle Enter/Leave events correctly but the previous code didn't
+either.
+
+CVE-2023-5380, ZDI-CAN-21608
+
+This vulnerability was discovered by:
+Sri working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+---
+ dix/enterleave.h   |  2 --
+ include/eventstr.h |  3 +++
+ mi/mipointer.c     | 17 +++++++++++++++--
+ 3 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/dix/enterleave.h b/dix/enterleave.h
+index 4b833d8a3b..e8af924c68 100644
+--- a/dix/enterleave.h
++++ b/dix/enterleave.h
+@@ -58,8 +58,6 @@ extern void DeviceFocusEvent(DeviceIntPtr dev,
+ 
+ extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode);
+ 
+-extern void LeaveWindow(DeviceIntPtr dev);
+-
+ extern void CoreFocusEvent(DeviceIntPtr kbd,
+                            int type, int mode, int detail, WindowPtr pWin);
+ 
+diff --git a/include/eventstr.h b/include/eventstr.h
+index bf3b95fe4a..2bae3b0767 100644
+--- a/include/eventstr.h
++++ b/include/eventstr.h
+@@ -296,4 +296,7 @@ union _InternalEvent {
+ #endif
+ };
+ 
++extern void
++LeaveWindow(DeviceIntPtr dev);
++
+ #endif
+diff --git a/mi/mipointer.c b/mi/mipointer.c
+index 75be1aeeb8..b12ae9be1d 100644
+--- a/mi/mipointer.c
++++ b/mi/mipointer.c
+@@ -397,8 +397,21 @@ miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y)
+ #ifdef PANORAMIX
+         && noPanoramiXExtension
+ #endif
+-        )
+-        UpdateSpriteForScreen(pDev, pScreen);
++        ) {
++            DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER);
++            /* Hack for CVE-2023-5380: if we're moving
++             * screens PointerWindows[] keeps referring to the
++             * old window. If that gets destroyed we have a UAF
++             * bug later. Only happens when jumping from a window
++             * to the root window on the other screen.
++             * Enter/Leave events are incorrect for that case but
++             * too niche to fix.
++             */
++            LeaveWindow(pDev);
++            if (master)
++                LeaveWindow(master);
++            UpdateSpriteForScreen(pDev, pScreen);
++    }
+ }
+ 
+ /**
+-- 
+2.41.0
+

0002-xkb-swap-XkbSetDeviceInfo-and-XkbSetDeviceInfoCheck.patch

@@ -0,0 +1,179 @@
+From dd8caf39e9e15d8f302e54045dd08d8ebf1025dc Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 5 Jul 2022 09:50:41 +1000
+Subject: [PATCH xserver 2/3] xkb: swap XkbSetDeviceInfo and
+ XkbSetDeviceInfoCheck
+
+XKB often uses a FooCheck and Foo function pair, the former is supposed
+to check all values in the request and error out on BadLength,
+BadValue, etc. The latter is then called once we're confident the values
+are good (they may still fail on an individual device, but that's a
+different topic).
+
+In the case of XkbSetDeviceInfo, those functions were incorrectly
+named, with XkbSetDeviceInfo ending up as the checker function and
+XkbSetDeviceInfoCheck as the setter function. As a result, the setter
+function was called before the checker function, accessing request
+data and modifying device state before we ensured that the data is
+valid.
+
+In particular, the setter function relied on values being already
+byte-swapped. This in turn could lead to potential OOB memory access.
+
+Fix this by correctly naming the functions and moving the length checks
+over to the checker function. These were added in 87c64fc5b0 to the
+wrong function, probably due to the incorrect naming.
+
+Fixes ZDI-CAN 16070, CVE-2022-2320.
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Introduced in c06e27b2f6fd9f7b9f827623a48876a225264132
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ xkb/xkb.c | 46 +++++++++++++++++++++++++---------------------
+ 1 file changed, 25 insertions(+), 21 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index 64e52611e..34b2c290b 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -6550,7 +6550,8 @@ ProcXkbGetDeviceInfo(ClientPtr client)
+ static char *
+ CheckSetDeviceIndicators(char *wire,
+                          DeviceIntPtr dev,
+-                         int num, int *status_rtrn, ClientPtr client)
++                         int num, int *status_rtrn, ClientPtr client,
++                         xkbSetDeviceInfoReq * stuff)
+ {
+     xkbDeviceLedsWireDesc *ledWire;
+     int i;
+@@ -6558,6 +6559,11 @@ CheckSetDeviceIndicators(char *wire,
+ 
+     ledWire = (xkbDeviceLedsWireDesc *) wire;
+     for (i = 0; i < num; i++) {
++        if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) {
++            *status_rtrn = BadLength;
++            return (char *) ledWire;
++        }
++
+         if (client->swapped) {
+             swaps(&ledWire->ledClass);
+             swaps(&ledWire->ledID);
+@@ -6585,6 +6591,11 @@ CheckSetDeviceIndicators(char *wire,
+             atomWire = (CARD32 *) &ledWire[1];
+             if (nNames > 0) {
+                 for (n = 0; n < nNames; n++) {
++                    if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) {
++                        *status_rtrn = BadLength;
++                        return (char *) atomWire;
++                    }
++
+                     if (client->swapped) {
+                         swapl(atomWire);
+                     }
+@@ -6596,6 +6607,10 @@ CheckSetDeviceIndicators(char *wire,
+             mapWire = (xkbIndicatorMapWireDesc *) atomWire;
+             if (nMaps > 0) {
+                 for (n = 0; n < nMaps; n++) {
++                    if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) {
++                        *status_rtrn = BadLength;
++                        return (char *) mapWire;
++                    }
+                     if (client->swapped) {
+                         swaps(&mapWire->virtualMods);
+                         swapl(&mapWire->ctrls);
+@@ -6647,11 +6662,6 @@ SetDeviceIndicators(char *wire,
+         xkbIndicatorMapWireDesc *mapWire;
+         XkbSrvLedInfoPtr sli;
+ 
+-        if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) {
+-            *status_rtrn = BadLength;
+-            return (char *) ledWire;
+-        }
+-
+         namec = mapc = statec = 0;
+         sli = XkbFindSrvLedInfo(dev, ledWire->ledClass, ledWire->ledID,
+                                 XkbXI_IndicatorMapsMask);
+@@ -6670,10 +6680,6 @@ SetDeviceIndicators(char *wire,
+             memset((char *) sli->names, 0, XkbNumIndicators * sizeof(Atom));
+             for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) {
+                 if (ledWire->namesPresent & bit) {
+-                    if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) {
+-                        *status_rtrn = BadLength;
+-                        return (char *) atomWire;
+-                    }
+                     sli->names[n] = (Atom) *atomWire;
+                     if (sli->names[n] == None)
+                         ledWire->namesPresent &= ~bit;
+@@ -6691,10 +6697,6 @@ SetDeviceIndicators(char *wire,
+         if (ledWire->mapsPresent) {
+             for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) {
+                 if (ledWire->mapsPresent & bit) {
+-                    if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) {
+-                        *status_rtrn = BadLength;
+-                        return (char *) mapWire;
+-                    }
+                     sli->maps[n].flags = mapWire->flags;
+                     sli->maps[n].which_groups = mapWire->whichGroups;
+                     sli->maps[n].groups = mapWire->groups;
+@@ -6730,13 +6732,17 @@ SetDeviceIndicators(char *wire,
+ }
+ 
+ static int
+-_XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
++_XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev,
+                   xkbSetDeviceInfoReq * stuff)
+ {
+     char *wire;
+ 
+     wire = (char *) &stuff[1];
+     if (stuff->change & XkbXI_ButtonActionsMask) {
++        int sz = stuff->nBtns * SIZEOF(xkbActionWireDesc);
++        if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz))
++            return BadLength;
++
+         if (!dev->button) {
+             client->errorValue = _XkbErrCode2(XkbErr_BadClass, ButtonClass);
+             return XkbKeyboardErrorCode;
+@@ -6747,13 +6753,13 @@ _XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
+                              dev->button->numButtons);
+             return BadMatch;
+         }
+-        wire += (stuff->nBtns * SIZEOF(xkbActionWireDesc));
++        wire += sz;
+     }
+     if (stuff->change & XkbXI_IndicatorsMask) {
+         int status = Success;
+ 
+         wire = CheckSetDeviceIndicators(wire, dev, stuff->nDeviceLedFBs,
+-                                        &status, client);
++                                        &status, client, stuff);
+         if (status != Success)
+             return status;
+     }
+@@ -6764,8 +6770,8 @@ _XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
+ }
+ 
+ static int
+-_XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev,
+-                       xkbSetDeviceInfoReq * stuff)
++_XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
++                  xkbSetDeviceInfoReq * stuff)
+ {
+     char *wire;
+     xkbExtensionDeviceNotify ed;
+@@ -6789,8 +6795,6 @@ _XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev,
+         if (stuff->firstBtn + stuff->nBtns > nBtns)
+             return BadValue;
+         sz = stuff->nBtns * SIZEOF(xkbActionWireDesc);
+-        if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz))
+-            return BadLength;
+         memcpy((char *) &acts[stuff->firstBtn], (char *) wire, sz);
+         wire += sz;
+         ed.reason |= XkbXI_ButtonActionsMask;
+-- 
+2.36.1
+

0003-Xi-avoid-integer-truncation-in-length-check-of-ProcX.patch

@@ -0,0 +1,71 @@
+From f9c435822c852659e3926502829f1b13ce6efc37 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 29 Nov 2022 13:26:57 +1000
+Subject: [PATCH xserver 3/7] Xi: avoid integer truncation in length check of
+ ProcXIChangeProperty
+
+This fixes an OOB read and the resulting information disclosure.
+
+Length calculation for the request was clipped to a 32-bit integer. With
+the correct stuff->num_items value the expected request size was
+truncated, passing the REQUEST_FIXED_SIZE check.
+
+The server then proceeded with reading at least stuff->num_items bytes
+(depending on stuff->format) from the request and stuffing whatever it
+finds into the property. In the process it would also allocate at least
+stuff->num_items bytes, i.e. 4GB.
+
+The same bug exists in ProcChangeProperty and ProcXChangeDeviceProperty,
+so let's fix that too.
+
+CVE-2022-46344, ZDI-CAN 19405
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+---
+ Xi/xiproperty.c | 4 ++--
+ dix/property.c  | 3 ++-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
+index 68c362c628..066ba21fba 100644
+--- a/Xi/xiproperty.c
++++ b/Xi/xiproperty.c
+@@ -890,7 +890,7 @@ ProcXChangeDeviceProperty(ClientPtr client)
+     REQUEST(xChangeDevicePropertyReq);
+     DeviceIntPtr dev;
+     unsigned long len;
+-    int totalSize;
++    uint64_t totalSize;
+     int rc;
+ 
+     REQUEST_AT_LEAST_SIZE(xChangeDevicePropertyReq);
+@@ -1130,7 +1130,7 @@ ProcXIChangeProperty(ClientPtr client)
+ {
+     int rc;
+     DeviceIntPtr dev;
+-    int totalSize;
++    uint64_t totalSize;
+     unsigned long len;
+ 
+     REQUEST(xXIChangePropertyReq);
+diff --git a/dix/property.c b/dix/property.c
+index 94ef5a0ec0..acce94b2c6 100644
+--- a/dix/property.c
++++ b/dix/property.c
+@@ -205,7 +205,8 @@ ProcChangeProperty(ClientPtr client)
+     WindowPtr pWin;
+     char format, mode;
+     unsigned long len;
+-    int sizeInBytes, totalSize, err;
++    int sizeInBytes, err;
++    uint64_t totalSize;
+ 
+     REQUEST(xChangePropertyReq);
+ 
+-- 
+2.38.1
+

0003-Xquartz-ProcAppleDRICreatePixmap-needs-to-use-unswap.patch

@@ -0,0 +1,47 @@
+From 6c684d035c06fd41c727f0ef0744517580864cef Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Fri, 22 Mar 2024 19:07:34 -0700
+Subject: [PATCH 3/4] Xquartz: ProcAppleDRICreatePixmap needs to use unswapped
+ length to send reply
+
+CVE-2024-31082
+
+Fixes: 14205ade0 ("XQuartz: appledri: Fix byte swapping in replies")
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
+---
+ hw/xquartz/xpr/appledri.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/xquartz/xpr/appledri.c b/hw/xquartz/xpr/appledri.c
+index 77574655b..40422b61a 100644
+--- a/hw/xquartz/xpr/appledri.c
++++ b/hw/xquartz/xpr/appledri.c
+@@ -272,6 +272,7 @@ ProcAppleDRICreatePixmap(ClientPtr client)
+     xAppleDRICreatePixmapReply rep;
+     int width, height, pitch, bpp;
+     void *ptr;
++    CARD32 stringLength;
+ 
+     REQUEST_SIZE_MATCH(xAppleDRICreatePixmapReq);
+ 
+@@ -307,6 +308,7 @@ ProcAppleDRICreatePixmap(ClientPtr client)
+     if (sizeof(rep) != sz_xAppleDRICreatePixmapReply)
+         ErrorF("error sizeof(rep) is %zu\n", sizeof(rep));
+ 
++    stringLength = rep.stringLength;  /* save unswapped value */
+     if (client->swapped) {
+         swaps(&rep.sequenceNumber);
+         swapl(&rep.length);
+@@ -319,7 +321,7 @@ ProcAppleDRICreatePixmap(ClientPtr client)
+     }
+ 
+     WriteToClient(client, sizeof(rep), &rep);
+-    WriteToClient(client, rep.stringLength, path);
++    WriteToClient(client, stringLength, path);
+ 
+     return Success;
+ }
+-- 
+2.44.0
+

0003-dix-fix-DeviceStateNotify-event-calculation.patch

@@ -0,0 +1,217 @@
+From 219c54b8a3337456ce5270ded6a67bcde53553d5 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 18 Dec 2023 12:26:20 +1000
+Subject: [PATCH 3/9] dix: fix DeviceStateNotify event calculation
+
+The previous code only made sense if one considers buttons and keys to
+be mutually exclusive on a device. That is not necessarily true, causing
+a number of issues.
+
+This function allocates and fills in the number of xEvents we need to
+send the device state down the wire.  This is split across multiple
+32-byte devices including one deviceStateNotify event and optional
+deviceKeyStateNotify, deviceButtonStateNotify and (possibly multiple)
+deviceValuator events.
+
+The previous behavior would instead compose a sequence
+of [state, buttonstate, state, keystate, valuator...]. This is not
+protocol correct, and on top of that made the code extremely convoluted.
+
+Fix this by streamlining: add both button and key into the deviceStateNotify
+and then append the key state and button state, followed by the
+valuators. Finally, the deviceValuator events contain up to 6 valuators
+per event but we only ever sent through 3 at a time. Let's double that
+troughput.
+
+CVE-2024-0229, ZDI-CAN-22678
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+---
+ dix/enterleave.c | 121 ++++++++++++++++++++---------------------------
+ 1 file changed, 52 insertions(+), 69 deletions(-)
+
+diff --git a/dix/enterleave.c b/dix/enterleave.c
+index 17964b00a..7b7ba1098 100644
+--- a/dix/enterleave.c
++++ b/dix/enterleave.c
+@@ -615,9 +615,15 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v,
+ 
+     ev->type = DeviceValuator;
+     ev->deviceid = dev->id;
+-    ev->num_valuators = nval < 3 ? nval : 3;
++    ev->num_valuators = nval < 6 ? nval : 6;
+     ev->first_valuator = first;
+     switch (ev->num_valuators) {
++    case 6:
++        ev->valuator2 = v->axisVal[first + 5];
++    case 5:
++        ev->valuator2 = v->axisVal[first + 4];
++    case 4:
++        ev->valuator2 = v->axisVal[first + 3];
+     case 3:
+         ev->valuator2 = v->axisVal[first + 2];
+     case 2:
+@@ -626,7 +632,6 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v,
+         ev->valuator0 = v->axisVal[first];
+         break;
+     }
+-    first += ev->num_valuators;
+ }
+ 
+ static void
+@@ -646,7 +651,7 @@ FixDeviceStateNotify(DeviceIntPtr dev, deviceStateNotify * ev, KeyClassPtr k,
+         ev->num_buttons = b->numButtons;
+         memcpy((char *) ev->buttons, (char *) b->down, 4);
+     }
+-    else if (k) {
++    if (k) {
+         ev->classes_reported |= (1 << KeyClass);
+         ev->num_keys = k->xkbInfo->desc->max_key_code -
+             k->xkbInfo->desc->min_key_code;
+@@ -670,15 +675,26 @@ FixDeviceStateNotify(DeviceIntPtr dev, deviceStateNotify * ev, KeyClassPtr k,
+     }
+ }
+ 
+-
++/**
++ * The device state notify event is split across multiple 32-byte events.
++ * The first one contains the first 32 button state bits, the first 32
++ * key state bits, and the first 3 valuator values.
++ *
++ * If a device has more than that, the server sends out:
++ * - one deviceButtonStateNotify for buttons 32 and above
++ * - one deviceKeyStateNotify for keys 32 and above
++ * - one deviceValuator event per 6 valuators above valuator 4
++ *
++ * All events but the last one have the deviceid binary ORed with MORE_EVENTS,
++ */
+ static void
+ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
+ {
++    /* deviceStateNotify, deviceKeyStateNotify, deviceButtonStateNotify
++     * and one deviceValuator for each 6 valuators */
++    deviceStateNotify sev[3 + (MAX_VALUATORS + 6)/6];
+     int evcount = 1;
+-    deviceStateNotify sev[6 + (MAX_VALUATORS + 2)/3];
+-    deviceStateNotify *ev;
+-    deviceKeyStateNotify *kev;
+-    deviceButtonStateNotify *bev;
++    deviceStateNotify *ev = sev;
+ 
+     KeyClassPtr k;
+     ButtonClassPtr b;
+@@ -691,82 +707,49 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
+ 
+     if ((b = dev->button) != NULL) {
+         nbuttons = b->numButtons;
+-        if (nbuttons > 32)
++        if (nbuttons > 32) /* first 32 are encoded in deviceStateNotify */
+             evcount++;
+     }
+     if ((k = dev->key) != NULL) {
+         nkeys = k->xkbInfo->desc->max_key_code - k->xkbInfo->desc->min_key_code;
+-        if (nkeys > 32)
++        if (nkeys > 32) /* first 32 are encoded in deviceStateNotify */
+             evcount++;
+-        if (nbuttons > 0) {
+-            evcount++;
+-        }
+     }
+     if ((v = dev->valuator) != NULL) {
+         nval = v->numAxes;
+-
+-        if (nval > 3)
+-            evcount++;
+-        if (nval > 6) {
+-            if (!(k && b))
+-                evcount++;
+-            if (nval > 9)
+-                evcount += ((nval - 7) / 3);
+-        }
++        /* first three are encoded in deviceStateNotify, then
++         * it's 6 per deviceValuator event */
++        evcount += ((nval - 3) + 6)/6;
+     }
+ 
+-    ev = sev;
+-    FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first);
+-
+-    if (b != NULL) {
+-        FixDeviceStateNotify(dev, ev++, NULL, b, v, first);
+-        first += 3;
+-        nval -= 3;
+-        if (nbuttons > 32) {
+-            (ev - 1)->deviceid |= MORE_EVENTS;
+-            bev = (deviceButtonStateNotify *) ev++;
+-            bev->type = DeviceButtonStateNotify;
+-            bev->deviceid = dev->id;
+-            memcpy((char *) &bev->buttons[4], (char *) &b->down[4],
+-                   DOWN_LENGTH - 4);
+-        }
+-        if (nval > 0) {
+-            (ev - 1)->deviceid |= MORE_EVENTS;
+-            FixDeviceValuator(dev, (deviceValuator *) ev++, v, first);
+-            first += 3;
+-            nval -= 3;
+-        }
++    BUG_RETURN(evcount <= ARRAY_SIZE(sev));
++
++    FixDeviceStateNotify(dev, ev, k, b, v, first);
++
++    if (b != NULL && nbuttons > 32) {
++        deviceButtonStateNotify *bev = (deviceButtonStateNotify *) ++ev;
++        (ev - 1)->deviceid |= MORE_EVENTS;
++        bev->type = DeviceButtonStateNotify;
++        bev->deviceid = dev->id;
++        memcpy((char *) &bev->buttons[4], (char *) &b->down[4],
++               DOWN_LENGTH - 4);
+     }
+ 
+-    if (k != NULL) {
+-        FixDeviceStateNotify(dev, ev++, k, NULL, v, first);
+-        first += 3;
+-        nval -= 3;
+-        if (nkeys > 32) {
+-            (ev - 1)->deviceid |= MORE_EVENTS;
+-            kev = (deviceKeyStateNotify *) ev++;
+-            kev->type = DeviceKeyStateNotify;
+-            kev->deviceid = dev->id;
+-            memmove((char *) &kev->keys[0], (char *) &k->down[4], 28);
+-        }
+-        if (nval > 0) {
+-            (ev - 1)->deviceid |= MORE_EVENTS;
+-            FixDeviceValuator(dev, (deviceValuator *) ev++, v, first);
+-            first += 3;
+-            nval -= 3;
+-        }
++    if (k != NULL && nkeys > 32) {
++        deviceKeyStateNotify *kev = (deviceKeyStateNotify *) ++ev;
++        (ev - 1)->deviceid |= MORE_EVENTS;
++        kev->type = DeviceKeyStateNotify;
++        kev->deviceid = dev->id;
++        memmove((char *) &kev->keys[0], (char *) &k->down[4], 28);
+     }
+ 
++    first = 3;
++    nval -= 3;
+     while (nval > 0) {
+-        FixDeviceStateNotify(dev, ev++, NULL, NULL, v, first);
+-        first += 3;
+-        nval -= 3;
+-        if (nval > 0) {
+-            (ev - 1)->deviceid |= MORE_EVENTS;
+-            FixDeviceValuator(dev, (deviceValuator *) ev++, v, first);
+-            first += 3;
+-            nval -= 3;
+-        }
++        ev->deviceid |= MORE_EVENTS;
++        FixDeviceValuator(dev, (deviceValuator *) ++ev, v, first);
++        first += 6;
++        nval -= 6;
+     }
+ 
+     DeliverEventsToWindow(dev, win, (xEvent *) sev, evcount,
+-- 
+2.43.0
+

0003-xkb-Fix-buffer-overflow-in-XkbVModMaskText.patch

@@ -0,0 +1,63 @@
+From c0e295af1adca6a0258bb405c535fe04969cc178 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 27 Nov 2024 14:41:45 +0100
+Subject: [PATCH xserver 03/13] xkb: Fix buffer overflow in XkbVModMaskText()
+
+The code in XkbVModMaskText() allocates a fixed sized buffer on the
+stack and copies the virtual mod name.
+
+There's actually two issues in the code that can lead to a buffer
+overflow.
+
+First, the bound check mixes pointers and integers using misplaced
+parenthesis, defeating the bound check.
+
+But even though, if the check fails, the data is still copied, so the
+stack overflow will occur regardless.
+
+Change the logic to skip the copy entirely if the bound check fails.
+
+CVE-2025-26595, ZDI-CAN-25545
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit 11fcda8753e994e15eb915d28cf487660ec8e722)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ xkb/xkbtext.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c
+index d2a2567fc..002626450 100644
+--- a/xkb/xkbtext.c
++++ b/xkb/xkbtext.c
+@@ -175,14 +175,14 @@ XkbVModMaskText(XkbDescPtr xkb,
+                 len = strlen(tmp) + 1 + (str == buf ? 0 : 1);
+                 if (format == XkbCFile)
+                     len += 4;
+-                if ((str - (buf + len)) <= VMOD_BUFFER_SIZE) {
+-                    if (str != buf) {
+-                        if (format == XkbCFile)
+-                            *str++ = '|';
+-                        else
+-                            *str++ = '+';
+-                        len--;
+-                    }
++                if ((str - buf) + len > VMOD_BUFFER_SIZE)
++                    continue; /* Skip */
++                if (str != buf) {
++                    if (format == XkbCFile)
++                        *str++ = '|';
++                    else
++                        *str++ = '+';
++                    len--;
+                 }
+                 if (format == XkbCFile)
+                     sprintf(str, "%sMask", tmp);
+-- 
+2.48.1
+

0003-xkb-add-request-length-validation-for-XkbSetGeometry.patch

@@ -0,0 +1,182 @@
+From 6907b6ea2b4ce949cb07271f5b678d5966d9df42 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 5 Jul 2022 11:11:06 +1000
+Subject: [PATCH xserver 3/3] xkb: add request length validation for
+ XkbSetGeometry
+
+No validation of the various fields on that report were done, so a
+malicious client could send a short request that claims it had N
+sections, or rows, or keys, and the server would process the request for
+N sections, running out of bounds of the actual request data.
+
+Fix this by adding size checks to ensure our data is valid.
+
+ZDI-CAN 16062, CVE-2022-2319.
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ xkb/xkb.c | 43 ++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 38 insertions(+), 5 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index 34b2c290b..4692895db 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -5156,7 +5156,7 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str)
+ }
+ 
+ static Status
+-_CheckSetDoodad(char **wire_inout,
++_CheckSetDoodad(char **wire_inout, xkbSetGeometryReq *req,
+                 XkbGeometryPtr geom, XkbSectionPtr section, ClientPtr client)
+ {
+     char *wire;
+@@ -5167,6 +5167,9 @@ _CheckSetDoodad(char **wire_inout,
+     Status status;
+ 
+     dWire = (xkbDoodadWireDesc *) (*wire_inout);
++    if (!_XkbCheckRequestBounds(client, req, dWire, dWire + 1))
++        return BadLength;
++
+     any = dWire->any;
+     wire = (char *) &dWire[1];
+     if (client->swapped) {
+@@ -5269,7 +5272,7 @@ _CheckSetDoodad(char **wire_inout,
+ }
+ 
+ static Status
+-_CheckSetOverlay(char **wire_inout,
++_CheckSetOverlay(char **wire_inout, xkbSetGeometryReq *req,
+                  XkbGeometryPtr geom, XkbSectionPtr section, ClientPtr client)
+ {
+     register int r;
+@@ -5280,6 +5283,9 @@ _CheckSetOverlay(char **wire_inout,
+ 
+     wire = *wire_inout;
+     olWire = (xkbOverlayWireDesc *) wire;
++    if (!_XkbCheckRequestBounds(client, req, olWire, olWire + 1))
++        return BadLength;
++
+     if (client->swapped) {
+         swapl(&olWire->name);
+     }
+@@ -5291,6 +5297,9 @@ _CheckSetOverlay(char **wire_inout,
+         xkbOverlayKeyWireDesc *kWire;
+         XkbOverlayRowPtr row;
+ 
++        if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1))
++            return BadLength;
++
+         if (rWire->rowUnder > section->num_rows) {
+             client->errorValue = _XkbErrCode4(0x20, r, section->num_rows,
+                                               rWire->rowUnder);
+@@ -5299,6 +5308,9 @@ _CheckSetOverlay(char **wire_inout,
+         row = XkbAddGeomOverlayRow(ol, rWire->rowUnder, rWire->nKeys);
+         kWire = (xkbOverlayKeyWireDesc *) &rWire[1];
+         for (k = 0; k < rWire->nKeys; k++, kWire++) {
++            if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1))
++                return BadLength;
++
+             if (XkbAddGeomOverlayKey(ol, row,
+                                      (char *) kWire->over,
+                                      (char *) kWire->under) == NULL) {
+@@ -5332,6 +5344,9 @@ _CheckSetSections(XkbGeometryPtr geom,
+         register int r;
+         xkbRowWireDesc *rWire;
+ 
++        if (!_XkbCheckRequestBounds(client, req, sWire, sWire + 1))
++            return BadLength;
++
+         if (client->swapped) {
+             swapl(&sWire->name);
+             swaps(&sWire->top);
+@@ -5357,6 +5372,9 @@ _CheckSetSections(XkbGeometryPtr geom,
+             XkbRowPtr row;
+             xkbKeyWireDesc *kWire;
+ 
++            if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1))
++                return BadLength;
++
+             if (client->swapped) {
+                 swaps(&rWire->top);
+                 swaps(&rWire->left);
+@@ -5371,6 +5389,9 @@ _CheckSetSections(XkbGeometryPtr geom,
+             for (k = 0; k < rWire->nKeys; k++, kWire++) {
+                 XkbKeyPtr key;
+ 
++                if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1))
++                    return BadLength;
++
+                 key = XkbAddGeomKey(row);
+                 if (!key)
+                     return BadAlloc;
+@@ -5396,7 +5417,7 @@ _CheckSetSections(XkbGeometryPtr geom,
+             register int d;
+ 
+             for (d = 0; d < sWire->nDoodads; d++) {
+-                status = _CheckSetDoodad(&wire, geom, section, client);
++                status = _CheckSetDoodad(&wire, req, geom, section, client);
+                 if (status != Success)
+                     return status;
+             }
+@@ -5405,7 +5426,7 @@ _CheckSetSections(XkbGeometryPtr geom,
+             register int o;
+ 
+             for (o = 0; o < sWire->nOverlays; o++) {
+-                status = _CheckSetOverlay(&wire, geom, section, client);
++                status = _CheckSetOverlay(&wire, req, geom, section, client);
+                 if (status != Success)
+                     return status;
+             }
+@@ -5439,6 +5460,9 @@ _CheckSetShapes(XkbGeometryPtr geom,
+             xkbOutlineWireDesc *olWire;
+             XkbOutlinePtr ol;
+ 
++            if (!_XkbCheckRequestBounds(client, req, shapeWire, shapeWire + 1))
++                return BadLength;
++
+             shape =
+                 XkbAddGeomShape(geom, shapeWire->name, shapeWire->nOutlines);
+             if (!shape)
+@@ -5449,12 +5473,18 @@ _CheckSetShapes(XkbGeometryPtr geom,
+                 XkbPointPtr pt;
+                 xkbPointWireDesc *ptWire;
+ 
++                if (!_XkbCheckRequestBounds(client, req, olWire, olWire + 1))
++                    return BadLength;
++
+                 ol = XkbAddGeomOutline(shape, olWire->nPoints);
+                 if (!ol)
+                     return BadAlloc;
+                 ol->corner_radius = olWire->cornerRadius;
+                 ptWire = (xkbPointWireDesc *) &olWire[1];
+                 for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++, ptWire++) {
++                    if (!_XkbCheckRequestBounds(client, req, ptWire, ptWire + 1))
++                        return BadLength;
++
+                     pt->x = ptWire->x;
+                     pt->y = ptWire->y;
+                     if (client->swapped) {
+@@ -5560,12 +5590,15 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSetGeometryReq * req, ClientPtr client)
+         return status;
+ 
+     for (i = 0; i < req->nDoodads; i++) {
+-        status = _CheckSetDoodad(&wire, geom, NULL, client);
++        status = _CheckSetDoodad(&wire, req, geom, NULL, client);
+         if (status != Success)
+             return status;
+     }
+ 
+     for (i = 0; i < req->nKeyAliases; i++) {
++        if (!_XkbCheckRequestBounds(client, req, wire, wire + XkbKeyNameLength))
++                return BadLength;
++
+         if (XkbAddGeomKeyAlias(geom, &wire[XkbKeyNameLength], wire) == NULL)
+             return BadAlloc;
+         wire += 2 * XkbKeyNameLength;
+-- 
+2.36.1
+

0004-Xi-disallow-passive-grabs-with-a-detail-255.patch

@@ -0,0 +1,82 @@
+From 0dab0b527ac5c4fe0272ea679522bd87238a733b Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 29 Nov 2022 13:55:32 +1000
+Subject: [PATCH xserver 4/7] Xi: disallow passive grabs with a detail > 255
+
+The XKB protocol effectively prevents us from ever using keycodes above
+255. For buttons it's theoretically possible but realistically too niche
+to worry about. For all other passive grabs, the detail must be zero
+anyway.
+
+This fixes an OOB write:
+
+ProcXIPassiveUngrabDevice() calls DeletePassiveGrabFromList with a
+temporary grab struct which contains tempGrab->detail.exact = stuff->detail.
+For matching existing grabs, DeleteDetailFromMask is called with the
+stuff->detail value. This function creates a new mask with the one bit
+representing stuff->detail cleared.
+
+However, the array size for the new mask is 8 * sizeof(CARD32) bits,
+thus any detail above 255 results in an OOB array write.
+
+CVE-2022-46341, ZDI-CAN 19381
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+---
+ Xi/xipassivegrab.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
+index 2769fb7c94..c9ac2f8553 100644
+--- a/Xi/xipassivegrab.c
++++ b/Xi/xipassivegrab.c
+@@ -137,6 +137,12 @@ ProcXIPassiveGrabDevice(ClientPtr client)
+         return BadValue;
+     }
+ 
++    /* XI2 allows 32-bit keycodes but thanks to XKB we can never
++     * implement this. Just return an error for all keycodes that
++     * cannot work anyway, same for buttons > 255. */
++    if (stuff->detail > 255)
++        return XIAlreadyGrabbed;
++
+     if (XICheckInvalidMaskBits(client, (unsigned char *) &stuff[1],
+                                stuff->mask_len * 4) != Success)
+         return BadValue;
+@@ -207,14 +213,8 @@ ProcXIPassiveGrabDevice(ClientPtr client)
+                                 &param, XI2, &mask);
+             break;
+         case XIGrabtypeKeycode:
+-            /* XI2 allows 32-bit keycodes but thanks to XKB we can never
+-             * implement this. Just return an error for all keycodes that
+-             * cannot work anyway */
+-            if (stuff->detail > 255)
+-                status = XIAlreadyGrabbed;
+-            else
+-                status = GrabKey(client, dev, mod_dev, stuff->detail,
+-                                 &param, XI2, &mask);
++            status = GrabKey(client, dev, mod_dev, stuff->detail,
++                             &param, XI2, &mask);
+             break;
+         case XIGrabtypeEnter:
+         case XIGrabtypeFocusIn:
+@@ -334,6 +334,12 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
+         return BadValue;
+     }
+ 
++    /* We don't allow passive grabs for details > 255 anyway */
++    if (stuff->detail > 255) {
++        client->errorValue = stuff->detail;
++        return BadValue;
++    }
++
+     rc = dixLookupWindow(&win, stuff->grab_window, client, DixSetAttrAccess);
+     if (rc != Success)
+         return rc;
+-- 
+2.38.1
+

0004-Xi-when-creating-a-new-ButtonClass-set-the-number-of.patch

@@ -0,0 +1,37 @@
+From df3c65706eb169d5938df0052059f3e0d5981b74 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 21 Dec 2023 13:48:10 +1000
+Subject: [PATCH 4/9] Xi: when creating a new ButtonClass, set the number of
+ buttons
+
+There's a racy sequence where a master device may copy the button class
+from the slave, without ever initializing numButtons. This leads to a
+device with zero buttons but a button class which is invalid.
+
+Let's copy the numButtons value from the source - by definition if we
+don't have a button class yet we do not have any other slave devices
+with more than this number of buttons anyway.
+
+CVE-2024-0229, ZDI-CAN-22678
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+---
+ Xi/exevents.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Xi/exevents.c b/Xi/exevents.c
+index 54ea11a93..e16171468 100644
+--- a/Xi/exevents.c
++++ b/Xi/exevents.c
+@@ -605,6 +605,7 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
+                 to->button = calloc(1, sizeof(ButtonClassRec));
+                 if (!to->button)
+                     FatalError("[Xi] no memory for class shift.\n");
++                to->button->numButtons = from->button->numButtons;
+             }
+             else
+                 classes->button = NULL;
+-- 
+2.43.0
+

0004-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch

@@ -0,0 +1,112 @@
+From bdca6c3d1f5057eeb31609b1280fc93237b00c77 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 30 Jan 2024 13:13:35 +1000
+Subject: [PATCH 4/4] render: fix refcounting of glyphs during
+ ProcRenderAddGlyphs
+
+Previously, AllocateGlyph would return a new glyph with refcount=0 and a
+re-used glyph would end up not changing the refcount at all. The
+resulting glyph_new array would thus have multiple entries pointing to
+the same non-refcounted glyphs.
+
+AddGlyph may free a glyph, resulting in a UAF when the same glyph
+pointer is then later used.
+
+Fix this by returning a refcount of 1 for a new glyph and always
+incrementing the refcount for a re-used glyph, followed by dropping that
+refcount back down again when we're done with it.
+
+CVE-2024-31083, ZDI-CAN-22880
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
+---
+ render/glyph.c         |  5 +++--
+ render/glyphstr_priv.h |  1 +
+ render/render.c        | 15 +++++++++++----
+ 3 files changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/render/glyph.c b/render/glyph.c
+index 850ea8440..13991f8a1 100644
+--- a/render/glyph.c
++++ b/render/glyph.c
+@@ -245,10 +245,11 @@ FreeGlyphPicture(GlyphPtr glyph)
+     }
+ }
+ 
+-static void
++void
+ FreeGlyph(GlyphPtr glyph, int format)
+ {
+     CheckDuplicates(&globalGlyphs[format], "FreeGlyph");
++    BUG_RETURN(glyph->refcnt == 0);
+     if (--glyph->refcnt == 0) {
+         GlyphRefPtr gr;
+         int i;
+@@ -354,7 +355,7 @@ AllocateGlyph(xGlyphInfo * gi, int fdepth)
+     glyph = (GlyphPtr) malloc(size);
+     if (!glyph)
+         return 0;
+-    glyph->refcnt = 0;
++    glyph->refcnt = 1;
+     glyph->size = size + sizeof(xGlyphInfo);
+     glyph->info = *gi;
+     dixInitPrivates(glyph, (char *) glyph + head_size, PRIVATE_GLYPH);
+diff --git a/render/glyphstr.h b/render/glyphstr.h
+index 2f51bd244..3b1d806d1 100644
+--- a/render/glyphstr.h
++++ b/render/glyphstr.h
+@@ -108,6 +108,7 @@ extern Bool
+ extern GlyphPtr FindGlyph(GlyphSetPtr glyphSet, Glyph id);
+ 
+ extern GlyphPtr AllocateGlyph(xGlyphInfo * gi, int format);
++extern void FreeGlyph(GlyphPtr glyph, int format);
+ 
+ extern Bool
+  ResizeGlyphSet(GlyphSetPtr glyphSet, CARD32 change);
+diff --git a/render/render.c b/render/render.c
+index 29c5055c6..fe5e37dd9 100644
+--- a/render/render.c
++++ b/render/render.c
+@@ -1076,6 +1076,7 @@ ProcRenderAddGlyphs(ClientPtr client)
+ 
+         if (glyph_new->glyph && glyph_new->glyph != DeletedGlyph) {
+             glyph_new->found = TRUE;
++            ++glyph_new->glyph->refcnt;
+         }
+         else {
+             GlyphPtr glyph;
+@@ -1168,8 +1169,10 @@ ProcRenderAddGlyphs(ClientPtr client)
+         err = BadAlloc;
+         goto bail;
+     }
+-    for (i = 0; i < nglyphs; i++)
++    for (i = 0; i < nglyphs; i++) {
+         AddGlyph(glyphSet, glyphs[i].glyph, glyphs[i].id);
++        FreeGlyph(glyphs[i].glyph, glyphSet->fdepth);
++    }
+ 
+     if (glyphsBase != glyphsLocal)
+         free(glyphsBase);
+@@ -1179,9 +1182,13 @@ ProcRenderAddGlyphs(ClientPtr client)
+         FreePicture((void *) pSrc, 0);
+     if (pSrcPix)
+         FreeScratchPixmapHeader(pSrcPix);
+-    for (i = 0; i < nglyphs; i++)
+-        if (glyphs[i].glyph && !glyphs[i].found)
+-            free(glyphs[i].glyph);
++    for (i = 0; i < nglyphs; i++) {
++        if (glyphs[i].glyph) {
++            --glyphs[i].glyph->refcnt;
++            if (!glyphs[i].found)
++                free(glyphs[i].glyph);
++        }
++    }
+     if (glyphsBase != glyphsLocal)
+         free(glyphsBase);
+     return err;
+-- 
+2.44.0
+

0004-xkb-Fix-computation-of-XkbSizeKeySyms.patch

@@ -0,0 +1,47 @@
+From ddf9500846982402250114803b28180036a54cac Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Thu, 28 Nov 2024 11:49:34 +0100
+Subject: [PATCH xserver 04/13] xkb: Fix computation of XkbSizeKeySyms
+
+The computation of the length in XkbSizeKeySyms() differs from what is
+actually written in XkbWriteKeySyms(), leading to a heap overflow.
+
+Fix the calculation in XkbSizeKeySyms() to match what kbWriteKeySyms()
+does.
+
+CVE-2025-26596, ZDI-CAN-25543
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit 80d69f01423fc065c950e1ff4e8ddf9f675df773)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ xkb/xkb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index 68c59df02..175a81bf7 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -1093,10 +1093,10 @@ XkbSizeKeySyms(XkbDescPtr xkb, xkbGetMapReply * rep)
+     len = rep->nKeySyms * SIZEOF(xkbSymMapWireDesc);
+     symMap = &xkb->map->key_sym_map[rep->firstKeySym];
+     for (i = nSyms = 0; i < rep->nKeySyms; i++, symMap++) {
+-        if (symMap->offset != 0) {
+-            nSymsThisKey = XkbNumGroups(symMap->group_info) * symMap->width;
+-            nSyms += nSymsThisKey;
+-        }
++        nSymsThisKey = XkbNumGroups(symMap->group_info) * symMap->width;
++        if (nSymsThisKey == 0)
++            continue;
++        nSyms += nSymsThisKey;
+     }
+     len += nSyms * 4;
+     rep->totalSyms = nSyms;
+-- 
+2.48.1
+

0005-Xext-free-the-screen-saver-resource-when-replacing-i.patch

@@ -0,0 +1,48 @@
+From 94f6fe99d87cf6ba0adadd95c595158c345b7d29 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 29 Nov 2022 14:53:07 +1000
+Subject: [PATCH xserver 5/7] Xext: free the screen saver resource when
+ replacing it
+
+This fixes a use-after-free bug:
+
+When a client first calls ScreenSaverSetAttributes(), a struct
+ScreenSaverAttrRec is allocated and added to the client's
+resources.
+
+When the same client calls ScreenSaverSetAttributes() again, a new
+struct ScreenSaverAttrRec is allocated, replacing the old struct. The
+old struct was freed but not removed from the clients resources.
+
+Later, when the client is destroyed the resource system invokes
+ScreenSaverFreeAttr and attempts to clean up the already freed struct.
+
+Fix this by letting the resource system free the old attrs instead.
+
+CVE-2022-46343, ZDI-CAN 19404
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+---
+ Xext/saver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Xext/saver.c b/Xext/saver.c
+index f813ba08d1..fd6153c313 100644
+--- a/Xext/saver.c
++++ b/Xext/saver.c
+@@ -1051,7 +1051,7 @@ ScreenSaverSetAttributes(ClientPtr client)
+         pVlist++;
+     }
+     if (pPriv->attr)
+-        FreeScreenAttr(pPriv->attr);
++        FreeResource(pPriv->attr->resource, AttrType);
+     pPriv->attr = pAttr;
+     pAttr->resource = FakeClientID(client->index);
+     if (!AddResource(pAttr->resource, AttrType, (void *) pAttr))
+-- 
+2.38.1
+

0005-Xi-flush-hierarchy-events-after-adding-removing-mast.patch

@@ -0,0 +1,109 @@
+From 4a5e9b1895627d40d26045bd0b7ef3dce503cbd1 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 4 Jan 2024 10:01:24 +1000
+Subject: [PATCH 5/9] Xi: flush hierarchy events after adding/removing master
+ devices
+
+The `XISendDeviceHierarchyEvent()` function allocates space to store up
+to `MAXDEVICES` (256) `xXIHierarchyInfo` structures in `info`.
+
+If a device with a given ID was removed and a new device with the same
+ID added both in the same operation, the single device ID will lead to
+two info structures being written to `info`.
+
+Since this case can occur for every device ID at once, a total of two
+times `MAXDEVICES` info structures might be written to the allocation.
+
+To avoid it, once one add/remove master is processed, send out the
+device hierarchy event for the current state and continue. That event
+thus only ever has exactly one of either added/removed in it (and
+optionally slave attached/detached).
+
+CVE-2024-21885, ZDI-CAN-22744
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+---
+ Xi/xichangehierarchy.c | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c
+index d2d985848..72d00451e 100644
+--- a/Xi/xichangehierarchy.c
++++ b/Xi/xichangehierarchy.c
+@@ -416,6 +416,11 @@ ProcXIChangeHierarchy(ClientPtr client)
+     size_t len;			/* length of data remaining in request */
+     int rc = Success;
+     int flags[MAXDEVICES] = { 0 };
++    enum {
++        NO_CHANGE,
++        FLUSH,
++        CHANGED,
++    } changes = NO_CHANGE;
+ 
+     REQUEST(xXIChangeHierarchyReq);
+     REQUEST_AT_LEAST_SIZE(xXIChangeHierarchyReq);
+@@ -465,8 +470,9 @@ ProcXIChangeHierarchy(ClientPtr client)
+             rc = add_master(client, c, flags);
+             if (rc != Success)
+                 goto unwind;
+-        }
++            changes = FLUSH;
+             break;
++        }
+         case XIRemoveMaster:
+         {
+             xXIRemoveMasterInfo *r = (xXIRemoveMasterInfo *) any;
+@@ -475,8 +481,9 @@ ProcXIChangeHierarchy(ClientPtr client)
+             rc = remove_master(client, r, flags);
+             if (rc != Success)
+                 goto unwind;
+-        }
++            changes = FLUSH;
+             break;
++        }
+         case XIDetachSlave:
+         {
+             xXIDetachSlaveInfo *c = (xXIDetachSlaveInfo *) any;
+@@ -485,8 +492,9 @@ ProcXIChangeHierarchy(ClientPtr client)
+             rc = detach_slave(client, c, flags);
+             if (rc != Success)
+                 goto unwind;
+-        }
++            changes = CHANGED;
+             break;
++        }
+         case XIAttachSlave:
+         {
+             xXIAttachSlaveInfo *c = (xXIAttachSlaveInfo *) any;
+@@ -495,16 +503,25 @@ ProcXIChangeHierarchy(ClientPtr client)
+             rc = attach_slave(client, c, flags);
+             if (rc != Success)
+                 goto unwind;
++            changes = CHANGED;
++            break;
+         }
++        default:
+             break;
+         }
+ 
++        if (changes == FLUSH) {
++            XISendDeviceHierarchyEvent(flags);
++            memset(flags, 0, sizeof(flags));
++            changes = NO_CHANGE;
++        }
++
+         len -= any->length * 4;
+         any = (xXIAnyHierarchyChangeInfo *) ((char *) any + any->length * 4);
+     }
+ 
+  unwind:
+-
+-    XISendDeviceHierarchyEvent(flags);
++    if (changes != NO_CHANGE)
++        XISendDeviceHierarchyEvent(flags);
+     return rc;
+ }
+-- 
+2.43.0
+

0005-xkb-Fix-buffer-overflow-in-XkbChangeTypesOfKey.patch

@@ -0,0 +1,45 @@
+From 33dfc78a0f67f4db5558c2374f5a73d262e43671 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Thu, 28 Nov 2024 14:09:04 +0100
+Subject: [PATCH xserver 05/13] xkb: Fix buffer overflow in
+ XkbChangeTypesOfKey()
+
+If XkbChangeTypesOfKey() is called with nGroups == 0, it will resize the
+key syms to 0 but leave the key actions unchanged.
+
+If later, the same function is called with a non-zero value for nGroups,
+this will cause a buffer overflow because the key actions are of the wrong
+size.
+
+To avoid the issue, make sure to resize both the key syms and key actions
+when nGroups is 0.
+
+CVE-2025-26597, ZDI-CAN-25683
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit 0e4ed94952b255c04fe910f6a1d9c852878dcd64)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ xkb/XKBMisc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/xkb/XKBMisc.c b/xkb/XKBMisc.c
+index f17194528..c45471686 100644
+--- a/xkb/XKBMisc.c
++++ b/xkb/XKBMisc.c
+@@ -553,6 +553,7 @@ XkbChangeTypesOfKey(XkbDescPtr xkb,
+         i = XkbSetNumGroups(i, 0);
+         xkb->map->key_sym_map[key].group_info = i;
+         XkbResizeKeySyms(xkb, key, 0);
++        XkbResizeKeyActions(xkb, key, 0);
+         return Success;
+     }
+ 
+-- 
+2.48.1
+

0006-Xext-free-the-XvRTVideoNotify-when-turning-off-from-.patch

@@ -0,0 +1,74 @@
+From a42635ee3c01f71a49052d83a372933504c9db04 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 30 Nov 2022 11:20:40 +1000
+Subject: [PATCH xserver 6/7] Xext: free the XvRTVideoNotify when turning off
+ from the same client
+
+This fixes a use-after-free bug:
+
+When a client first calls XvdiSelectVideoNotify() on a drawable with a
+TRUE onoff argument, a struct XvVideoNotifyRec is allocated. This struct
+is added twice to the resources:
+  - as the drawable's XvRTVideoNotifyList. This happens only once per
+    drawable, subsequent calls append to this list.
+  - as the client's XvRTVideoNotify. This happens for every client.
+
+The struct keeps the ClientPtr around once it has been added for a
+client. The idea, presumably, is that if the client disconnects we can remove
+all structs from the drawable's list that match the client (by resetting
+the ClientPtr to NULL), but if the drawable is destroyed we can remove
+and free the whole list.
+
+However, if the same client then calls XvdiSelectVideoNotify() on the
+same drawable with a FALSE onoff argument, only the ClientPtr on the
+existing struct was set to NULL. The struct itself remained in the
+client's resources.
+
+If the drawable is now destroyed, the resource system invokes
+XvdiDestroyVideoNotifyList which frees the whole list for this drawable
+- including our struct. This function however does not free the resource
+for the client since our ClientPtr is NULL.
+
+Later, when the client is destroyed and the resource system invokes
+XvdiDestroyVideoNotify, we unconditionally set the ClientPtr to NULL. On
+a struct that has been freed previously. This is generally frowned upon.
+
+Fix this by calling FreeResource() on the second call instead of merely
+setting the ClientPtr to NULL. This removes the struct from the client
+resources (but not from the list), ensuring that it won't be accessed
+again when the client quits.
+
+Note that the assignment tpn->client = NULL; is superfluous since the
+XvdiDestroyVideoNotify function will do this anyway. But it's left for
+clarity and to match a similar invocation in XvdiSelectPortNotify.
+
+CVE-2022-46342, ZDI-CAN 19400
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+---
+ Xext/xvmain.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Xext/xvmain.c b/Xext/xvmain.c
+index f627471938..2a08f8744a 100644
+--- a/Xext/xvmain.c
++++ b/Xext/xvmain.c
+@@ -811,8 +811,10 @@ XvdiSelectVideoNotify(ClientPtr client, DrawablePtr pDraw, BOOL onoff)
+         tpn = pn;
+         while (tpn) {
+             if (tpn->client == client) {
+-                if (!onoff)
++                if (!onoff) {
+                     tpn->client = NULL;
++                    FreeResource(tpn->id, XvRTVideoNotify);
++                }
+                 return Success;
+             }
+             if (!tpn->client)
+-- 
+2.38.1
+

0006-Xi-Fix-barrier-device-search.patch

@@ -0,0 +1,118 @@
+From 475a856c919c8648aaefac9388a7788eed5725fa Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 16 Dec 2024 11:25:11 +0100
+Subject: [PATCH xserver 06/13] Xi: Fix barrier device search
+
+The function GetBarrierDevice() would search for the pointer device
+based on its device id and return the matching value, or supposedly NULL
+if no match was found.
+
+Unfortunately, as written, it would return the last element of the list
+if no matching device id was found which can lead to out of bounds
+memory access.
+
+Fix the search function to return NULL if not matching device is found,
+and adjust the callers to handle the case where the device cannot be
+found.
+
+CVE-2025-26598, ZDI-CAN-25740
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit bba9df1a9d57234c76c0b93f88dacb143d01bca2)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ Xi/xibarriers.c | 27 +++++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/Xi/xibarriers.c b/Xi/xibarriers.c
+index 1926762ad..cb336f22b 100644
+--- a/Xi/xibarriers.c
++++ b/Xi/xibarriers.c
+@@ -129,14 +129,15 @@ static void FreePointerBarrierClient(struct PointerBarrierClient *c)
+ 
+ static struct PointerBarrierDevice *GetBarrierDevice(struct PointerBarrierClient *c, int deviceid)
+ {
+-    struct PointerBarrierDevice *pbd = NULL;
++    struct PointerBarrierDevice *p, *pbd = NULL;
+ 
+-    xorg_list_for_each_entry(pbd, &c->per_device, entry) {
+-        if (pbd->deviceid == deviceid)
++    xorg_list_for_each_entry(p, &c->per_device, entry) {
++        if (p->deviceid == deviceid) {
++            pbd = p;
+             break;
++        }
+     }
+ 
+-    BUG_WARN(!pbd);
+     return pbd;
+ }
+ 
+@@ -337,6 +338,9 @@ barrier_find_nearest(BarrierScreenPtr cs, DeviceIntPtr dev,
+         double distance;
+ 
+         pbd = GetBarrierDevice(c, dev->id);
++        if (!pbd)
++            continue;
++
+         if (pbd->seen)
+             continue;
+ 
+@@ -445,6 +449,9 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr screen,
+         nearest = &c->barrier;
+ 
+         pbd = GetBarrierDevice(c, master->id);
++        if (!pbd)
++            continue;
++
+         new_sequence = !pbd->hit;
+ 
+         pbd->seen = TRUE;
+@@ -485,6 +492,9 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr screen,
+         int flags = 0;
+ 
+         pbd = GetBarrierDevice(c, master->id);
++        if (!pbd)
++            continue;
++
+         pbd->seen = FALSE;
+         if (!pbd->hit)
+             continue;
+@@ -679,6 +689,9 @@ BarrierFreeBarrier(void *data, XID id)
+             continue;
+ 
+         pbd = GetBarrierDevice(c, dev->id);
++        if (!pbd)
++            continue;
++
+         if (!pbd->hit)
+             continue;
+ 
+@@ -738,6 +751,8 @@ static void remove_master_func(void *res, XID id, void *devid)
+     barrier = container_of(b, struct PointerBarrierClient, barrier);
+ 
+     pbd = GetBarrierDevice(barrier, *deviceid);
++    if (!pbd)
++        return;
+ 
+     if (pbd->hit) {
+         BarrierEvent ev = {
+@@ -903,6 +918,10 @@ ProcXIBarrierReleasePointer(ClientPtr client)
+         barrier = container_of(b, struct PointerBarrierClient, barrier);
+ 
+         pbd = GetBarrierDevice(barrier, dev->id);
++        if (!pbd) {
++            client->errorValue = dev->id;
++            return BadDevice;
++        }
+ 
+         if (pbd->barrier_event_id == event_id)
+             pbd->release_event_id = event_id;
+-- 
+2.48.1
+

0006-Xi-do-not-keep-linked-list-pointer-during-recursion.patch

@@ -0,0 +1,70 @@
+From bc1fdbe46559dd947674375946bbef54dd0ce36b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= <jexposit@redhat.com>
+Date: Fri, 22 Dec 2023 18:28:31 +0100
+Subject: [PATCH 6/9] Xi: do not keep linked list pointer during recursion
+
+The `DisableDevice()` function is called whenever an enabled device
+is disabled and it moves the device from the `inputInfo.devices` linked
+list to the `inputInfo.off_devices` linked list.
+
+However, its link/unlink operation has an issue during the recursive
+call to `DisableDevice()` due to the `prev` pointer pointing to a
+removed device.
+
+This issue leads to a length mismatch between the total number of
+devices and the number of device in the list, leading to a heap
+overflow and, possibly, to local privilege escalation.
+
+Simplify the code that checked whether the device passed to
+`DisableDevice()` was in `inputInfo.devices` or not and find the
+previous device after the recursion.
+
+CVE-2024-21886, ZDI-CAN-22840
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+---
+ dix/devices.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/dix/devices.c b/dix/devices.c
+index dca98c8d1..389d28a23 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -453,14 +453,20 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
+ {
+     DeviceIntPtr *prev, other;
+     BOOL enabled;
++    BOOL dev_in_devices_list = FALSE;
+     int flags[MAXDEVICES] = { 0 };
+ 
+     if (!dev->enabled)
+         return TRUE;
+ 
+-    for (prev = &inputInfo.devices;
+-         *prev && (*prev != dev); prev = &(*prev)->next);
+-    if (*prev != dev)
++    for (other = inputInfo.devices; other; other = other->next) {
++        if (other == dev) {
++            dev_in_devices_list = TRUE;
++            break;
++        }
++    }
++
++    if (!dev_in_devices_list)
+         return FALSE;
+ 
+     TouchEndPhysicallyActiveTouches(dev);
+@@ -511,6 +517,9 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
+     LeaveWindow(dev);
+     SetFocusOut(dev);
+ 
++    for (prev = &inputInfo.devices;
++         *prev && (*prev != dev); prev = &(*prev)->next);
++
+     *prev = dev->next;
+     dev->next = inputInfo.off_devices;
+     inputInfo.off_devices = dev;
+-- 
+2.43.0
+

0007-composite-Handle-failure-to-redirect-in-compRedirect.patch

@@ -0,0 +1,65 @@
+From 04d8041534d40e975d11a8a58ea7e8b1f09b519d Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Tue, 17 Dec 2024 15:19:45 +0100
+Subject: [PATCH xserver 07/13] composite: Handle failure to redirect in
+ compRedirectWindow()
+
+The function compCheckRedirect() may fail if it cannot allocate the
+backing pixmap.
+
+In that case, compRedirectWindow() will return a BadAlloc error.
+
+However that failure code path will shortcut the validation of the
+window tree marked just before, which leaves the validate data partly
+initialized.
+
+That causes a use of uninitialized pointer later.
+
+The fix is to not shortcut the call to compHandleMarkedWindows() even in
+the case of compCheckRedirect() returning an error.
+
+CVE-2025-26599, ZDI-CAN-25851
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit c1ff84bef2569b4ba4be59323cf575d1798ba9be)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ composite/compalloc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/composite/compalloc.c b/composite/compalloc.c
+index 3e2f14fb0..55a1b725a 100644
+--- a/composite/compalloc.c
++++ b/composite/compalloc.c
+@@ -138,6 +138,7 @@ compRedirectWindow(ClientPtr pClient, WindowPtr pWin, int update)
+     CompScreenPtr cs = GetCompScreen(pWin->drawable.pScreen);
+     WindowPtr pLayerWin;
+     Bool anyMarked = FALSE;
++    int status = Success;
+ 
+     if (pWin == cs->pOverlayWin) {
+         return Success;
+@@ -216,13 +217,13 @@ compRedirectWindow(ClientPtr pClient, WindowPtr pWin, int update)
+ 
+     if (!compCheckRedirect(pWin)) {
+         FreeResource(ccw->id, RT_NONE);
+-        return BadAlloc;
++        status = BadAlloc;
+     }
+ 
+     if (anyMarked)
+         compHandleMarkedWindows(pWin, pLayerWin);
+ 
+-    return Success;
++    return status;
+ }
+ 
+ void
+-- 
+2.48.1
+

0007-dix-when-disabling-a-master-float-disabled-slaved-de.patch

@@ -0,0 +1,53 @@
+From 26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Fri, 5 Jan 2024 09:40:27 +1000
+Subject: [PATCH 7/9] dix: when disabling a master, float disabled slaved
+ devices too
+
+Disabling a master device floats all slave devices but we didn't do this
+to already-disabled slave devices. As a result those devices kept their
+reference to the master device resulting in access to already freed
+memory if the master device was removed before the corresponding slave
+device.
+
+And to match this behavior, also forcibly reset that pointer during
+CloseDownDevices().
+
+Related to CVE-2024-21886, ZDI-CAN-22840
+---
+ dix/devices.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/dix/devices.c b/dix/devices.c
+index 389d28a23..84a6406d1 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -483,6 +483,13 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
+                 flags[other->id] |= XISlaveDetached;
+             }
+         }
++
++        for (other = inputInfo.off_devices; other; other = other->next) {
++            if (!IsMaster(other) && GetMaster(other, MASTER_ATTACHED) == dev) {
++                AttachDevice(NULL, other, NULL);
++                flags[other->id] |= XISlaveDetached;
++            }
++        }
+     }
+     else {
+         for (other = inputInfo.devices; other; other = other->next) {
+@@ -1088,6 +1095,11 @@ CloseDownDevices(void)
+             dev->master = NULL;
+     }
+ 
++    for (dev = inputInfo.off_devices; dev; dev = dev->next) {
++        if (!IsMaster(dev) && !IsFloating(dev))
++            dev->master = NULL;
++    }
++
+     CloseDeviceList(&inputInfo.devices);
+     CloseDeviceList(&inputInfo.off_devices);
+ 
+-- 
+2.43.0
+

0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch

@@ -0,0 +1,36 @@
+From 774260dbae1fa505cd2848c786baed9a8db5179d Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 5 Dec 2022 15:55:54 +1000
+Subject: [PATCH xserver 7/7] xkb: reset the radio_groups pointer to NULL after
+ freeing it
+
+Unlike other elements of the keymap, this pointer was freed but not
+reset. On a subsequent XkbGetKbdByName request, the server may access
+already freed memory.
+
+CVE-2022-46283, ZDI-CAN-19530
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Acked-by: Olivier Fourdan <ofourdan@redhat.com>
+---
+ xkb/xkbUtils.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c
+index dd089c2046..3f5791a183 100644
+--- a/xkb/xkbUtils.c
++++ b/xkb/xkbUtils.c
+@@ -1326,6 +1326,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst)
+         }
+         else {
+             free(dst->names->radio_groups);
++            dst->names->radio_groups = NULL;
+         }
+         dst->names->num_rg = src->names->num_rg;
+ 
+-- 
+2.38.1
+

0008-Xext-fix-invalid-event-type-mask-in-XTestSwapFakeInp.patch

@@ -0,0 +1,35 @@
+From bb1711b7fba42f2a0c7d1c09beee241a1b2bcc30 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Mon, 19 Dec 2022 10:06:45 +1000
+Subject: [PATCH xserver] Xext: fix invalid event type mask in
+ XTestSwapFakeInput
+
+In commit b320ca0 the mask was inadvertently changed from octal 0177 to
+hexadecimal 0x177.
+
+Fixes commit b320ca0ffe4c0c872eeb3a93d9bde21f765c7c63
+  Xtest: disallow GenericEvents in XTestSwapFakeInput
+
+Found by Stuart Cassoff
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ Xext/xtest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Xext/xtest.c b/Xext/xtest.c
+index 2985a4ce6e..dde5c4cf9d 100644
+--- a/Xext/xtest.c
++++ b/Xext/xtest.c
+@@ -502,7 +502,7 @@ XTestSwapFakeInput(ClientPtr client, xReq * req)
+ 
+     nev = ((req->length << 2) - sizeof(xReq)) / sizeof(xEvent);
+     for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) {
+-        int evtype = ev->u.u.type & 0x177;
++        int evtype = ev->u.u.type & 0177;
+         /* Swap event */
+         proc = EventSwapVector[evtype];
+         /* no swapping proc; invalid event type? */
+-- 
+2.38.1
+

0008-composite-initialize-border-clip-even-when-pixmap-al.patch

@@ -0,0 +1,127 @@
+From 9a5a5b2972539ba5ef16dbc802c4eb87c9226d4e Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 13 Jan 2025 16:09:43 +0100
+Subject: [PATCH xserver 08/13] composite: initialize border clip even when
+ pixmap alloc fails
+
+If it fails to allocate the pixmap, the function compAllocPixmap() would
+return early and leave the borderClip region uninitialized, which may
+lead to the use of uninitialized value as reported by valgrind:
+
+ Conditional jump or move depends on uninitialised value(s)
+    at 0x4F9B33: compClipNotify (compwindow.c:317)
+    by 0x484FC9: miComputeClips (mivaltree.c:476)
+    by 0x48559A: miValidateTree (mivaltree.c:679)
+    by 0x4F0685: MapWindow (window.c:2693)
+    by 0x4A344A: ProcMapWindow (dispatch.c:922)
+    by 0x4A25B5: Dispatch (dispatch.c:560)
+    by 0x4B082A: dix_main (main.c:282)
+    by 0x429233: main (stubmain.c:34)
+  Uninitialised value was created by a heap allocation
+    at 0x4841866: malloc (vg_replace_malloc.c:446)
+    by 0x4F47BC: compRedirectWindow (compalloc.c:171)
+    by 0x4FA8AD: compCreateWindow (compwindow.c:592)
+    by 0x4EBB89: CreateWindow (window.c:925)
+    by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
+    by 0x4A25B5: Dispatch (dispatch.c:560)
+    by 0x4B082A: dix_main (main.c:282)
+    by 0x429233: main (stubmain.c:34)
+
+ Conditional jump or move depends on uninitialised value(s)
+    at 0x48EEDBC: pixman_region_translate (pixman-region.c:2233)
+    by 0x4F9255: RegionTranslate (regionstr.h:312)
+    by 0x4F9B7E: compClipNotify (compwindow.c:319)
+    by 0x484FC9: miComputeClips (mivaltree.c:476)
+    by 0x48559A: miValidateTree (mivaltree.c:679)
+    by 0x4F0685: MapWindow (window.c:2693)
+    by 0x4A344A: ProcMapWindow (dispatch.c:922)
+    by 0x4A25B5: Dispatch (dispatch.c:560)
+    by 0x4B082A: dix_main (main.c:282)
+    by 0x429233: main (stubmain.c:34)
+  Uninitialised value was created by a heap allocation
+    at 0x4841866: malloc (vg_replace_malloc.c:446)
+    by 0x4F47BC: compRedirectWindow (compalloc.c:171)
+    by 0x4FA8AD: compCreateWindow (compwindow.c:592)
+    by 0x4EBB89: CreateWindow (window.c:925)
+    by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
+    by 0x4A25B5: Dispatch (dispatch.c:560)
+    by 0x4B082A: dix_main (main.c:282)
+    by 0x429233: main (stubmain.c:34)
+
+ Conditional jump or move depends on uninitialised value(s)
+    at 0x48EEE33: UnknownInlinedFun (pixman-region.c:2241)
+    by 0x48EEE33: pixman_region_translate (pixman-region.c:2225)
+    by 0x4F9255: RegionTranslate (regionstr.h:312)
+    by 0x4F9B7E: compClipNotify (compwindow.c:319)
+    by 0x484FC9: miComputeClips (mivaltree.c:476)
+    by 0x48559A: miValidateTree (mivaltree.c:679)
+    by 0x4F0685: MapWindow (window.c:2693)
+    by 0x4A344A: ProcMapWindow (dispatch.c:922)
+    by 0x4A25B5: Dispatch (dispatch.c:560)
+    by 0x4B082A: dix_main (main.c:282)
+    by 0x429233: main (stubmain.c:34)
+  Uninitialised value was created by a heap allocation
+    at 0x4841866: malloc (vg_replace_malloc.c:446)
+    by 0x4F47BC: compRedirectWindow (compalloc.c:171)
+    by 0x4FA8AD: compCreateWindow (compwindow.c:592)
+    by 0x4EBB89: CreateWindow (window.c:925)
+    by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
+    by 0x4A25B5: Dispatch (dispatch.c:560)
+    by 0x4B082A: dix_main (main.c:282)
+    by 0x429233: main (stubmain.c:34)
+
+Fix compAllocPixmap() to initialize the border clip even if the creation
+of the backing pixmap has failed, to avoid depending later on
+uninitialized border clip values.
+
+Related to CVE-2025-26599, ZDI-CAN-25851
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit b07192a8bedb90b039dc0f70ae69daf047ff9598)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ composite/compalloc.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/composite/compalloc.c b/composite/compalloc.c
+index 55a1b725a..d1c205ca0 100644
+--- a/composite/compalloc.c
++++ b/composite/compalloc.c
+@@ -604,9 +604,12 @@ compAllocPixmap(WindowPtr pWin)
+     int h = pWin->drawable.height + (bw << 1);
+     PixmapPtr pPixmap = compNewPixmap(pWin, x, y, w, h);
+     CompWindowPtr cw = GetCompWindow(pWin);
++    Bool status;
+ 
+-    if (!pPixmap)
+-        return FALSE;
++    if (!pPixmap) {
++        status = FALSE;
++        goto out;
++    }
+     if (cw->update == CompositeRedirectAutomatic)
+         pWin->redirectDraw = RedirectDrawAutomatic;
+     else
+@@ -620,14 +623,16 @@ compAllocPixmap(WindowPtr pWin)
+         DamageRegister(&pWin->drawable, cw->damage);
+         cw->damageRegistered = TRUE;
+     }
++    status = TRUE;
+ 
++out:
+     /* Make sure our borderClip is up to date */
+     RegionUninit(&cw->borderClip);
+     RegionCopy(&cw->borderClip, &pWin->borderClip);
+     cw->borderClipX = pWin->drawable.x;
+     cw->borderClipY = pWin->drawable.y;
+ 
+-    return TRUE;
++    return status;
+ }
+ 
+ void
+-- 
+2.48.1
+

0008-glx-Call-XACE-hooks-on-the-GLX-buffer.patch

@@ -0,0 +1,60 @@
+From e5e8586a12a3ec915673edffa10dc8fe5e15dac3 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 6 Dec 2023 12:09:41 +0100
+Subject: [PATCH 8/9] glx: Call XACE hooks on the GLX buffer
+
+The XSELINUX code will label resources at creation by checking the
+access mode. When the access mode is DixCreateAccess, it will call the
+function to label the new resource SELinuxLabelResource().
+
+However, GLX buffers do not go through the XACE hooks when created,
+hence leaving the resource actually unlabeled.
+
+When, later, the client tries to create another resource using that
+drawable (like a GC for example), the XSELINUX code would try to use
+the security ID of that object which has never been labeled, get a NULL
+pointer and crash when checking whether the requested permissions are
+granted for subject security ID.
+
+To avoid the issue, make sure to call the XACE hooks when creating the
+GLX buffers.
+
+Credit goes to Donn Seeley <donn@xmission.com> for providing the patch.
+
+CVE-2024-0408
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ glx/glxcmds.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/glx/glxcmds.c b/glx/glxcmds.c
+index fc26a2e34..1e46d0c72 100644
+--- a/glx/glxcmds.c
++++ b/glx/glxcmds.c
+@@ -48,6 +48,7 @@
+ #include "indirect_util.h"
+ #include "protocol-versions.h"
+ #include "glxvndabi.h"
++#include "xace.h"
+ 
+ static char GLXServerVendorName[] = "SGI";
+ 
+@@ -1392,6 +1393,13 @@ DoCreatePbuffer(ClientPtr client, int screenNum, XID fbconfigId,
+     if (!pPixmap)
+         return BadAlloc;
+ 
++    err = XaceHook(XACE_RESOURCE_ACCESS, client, glxDrawableId, RT_PIXMAP,
++                   pPixmap, RT_NONE, NULL, DixCreateAccess);
++    if (err != Success) {
++        (*pGlxScreen->pScreen->DestroyPixmap) (pPixmap);
++        return err;
++    }
++
+     /* Assign the pixmap the same id as the pbuffer and add it as a
+      * resource so it and the DRI2 drawable will be reclaimed when the
+      * pbuffer is destroyed. */
+-- 
+2.43.0
+

0009-dix-Dequeue-pending-events-on-frozen-device-on-remov.patch

@@ -0,0 +1,67 @@
+From 470c77ae761a36c71494285009bc37b2abbefe97 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 16 Dec 2024 16:18:04 +0100
+Subject: [PATCH xserver 09/13] dix: Dequeue pending events on frozen device on
+ removal
+
+When a device is removed while still frozen, the events queued for that
+device remain while the device itself is freed.
+
+As a result, replaying the events will cause a use after free.
+
+To avoid the issue, make sure to dequeue and free any pending events on
+a frozen device when removed.
+
+CVE-2025-26600, ZDI-CAN-25871
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit 6e0f332ba4c8b8c9a9945dc9d7989bfe06f80e14)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ dix/devices.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/dix/devices.c b/dix/devices.c
+index e7c74d7b7..11120b70b 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -949,6 +949,23 @@ FreeAllDeviceClasses(ClassesPtr classes)
+ 
+ }
+ 
++static void
++FreePendingFrozenDeviceEvents(DeviceIntPtr dev)
++{
++    QdEventPtr qe, tmp;
++
++    if (!dev->deviceGrab.sync.frozen)
++        return;
++
++    /* Dequeue any frozen pending events */
++    xorg_list_for_each_entry_safe(qe, tmp, &syncEvents.pending, next) {
++        if (qe->device == dev) {
++            xorg_list_del(&qe->next);
++            free(qe);
++        }
++    }
++}
++
+ /**
+  * Close down a device and free all resources.
+  * Once closed down, the driver will probably not expect you that you'll ever
+@@ -1013,6 +1030,7 @@ CloseDevice(DeviceIntPtr dev)
+         free(dev->last.touches[j].valuators);
+     free(dev->last.touches);
+     dev->config_info = NULL;
++    FreePendingFrozenDeviceEvents(dev);
+     dixFreePrivates(dev->devPrivates, PRIVATE_DEVICE);
+     free(dev);
+ }
+-- 
+2.48.1
+

0009-ephyr-xwayland-Use-the-proper-private-key-for-cursor.patch

@@ -0,0 +1,56 @@
+From 2ef0f1116c65d5cb06d7b6d83f8a1aea702c94f7 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 6 Dec 2023 11:51:56 +0100
+Subject: [PATCH 9/9] ephyr,xwayland: Use the proper private key for cursor
+
+The cursor in DIX is actually split in two parts, the cursor itself and
+the cursor bits, each with their own devPrivates.
+
+The cursor itself includes the cursor bits, meaning that the cursor bits
+devPrivates in within structure of the cursor.
+
+Both Xephyr and Xwayland were using the private key for the cursor bits
+to store the data for the cursor, and when using XSELINUX which comes
+with its own special devPrivates, the data stored in that cursor bits'
+devPrivates would interfere with the XSELINUX devPrivates data and the
+SELINUX security ID would point to some other unrelated data, causing a
+crash in the XSELINUX code when trying to (re)use the security ID.
+
+CVE-2024-0409
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ hw/kdrive/ephyr/ephyrcursor.c | 2 +-
+ hw/xwayland/xwayland-cursor.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/kdrive/ephyr/ephyrcursor.c b/hw/kdrive/ephyr/ephyrcursor.c
+index f991899c5..3f192d034 100644
+--- a/hw/kdrive/ephyr/ephyrcursor.c
++++ b/hw/kdrive/ephyr/ephyrcursor.c
+@@ -246,7 +246,7 @@ miPointerSpriteFuncRec EphyrPointerSpriteFuncs = {
+ Bool
+ ephyrCursorInit(ScreenPtr screen)
+ {
+-    if (!dixRegisterPrivateKey(&ephyrCursorPrivateKey, PRIVATE_CURSOR_BITS,
++    if (!dixRegisterPrivateKey(&ephyrCursorPrivateKey, PRIVATE_CURSOR,
+                                sizeof(ephyrCursorRec)))
+         return FALSE;
+ 
+diff --git a/hw/xwayland/xwayland-cursor.c b/hw/xwayland/xwayland-cursor.c
+index e3c1aaa50..bd94b0cfb 100644
+--- a/hw/xwayland/xwayland-cursor.c
++++ b/hw/xwayland/xwayland-cursor.c
+@@ -431,7 +431,7 @@ static miPointerScreenFuncRec xwl_pointer_screen_funcs = {
+ Bool
+ xwl_screen_init_cursor(struct xwl_screen *xwl_screen)
+ {
+-    if (!dixRegisterPrivateKey(&xwl_cursor_private_key, PRIVATE_CURSOR_BITS, 0))
++    if (!dixRegisterPrivateKey(&xwl_cursor_private_key, PRIVATE_CURSOR, 0))
+         return FALSE;
+ 
+     return miPointerInitialize(xwl_screen->screen,
+-- 
+2.43.0
+

0010-sync-Do-not-let-sync-objects-uninitialized.patch

@@ -0,0 +1,69 @@
+From 7f7f51e8907b14c6654944e0e321f15e256b34e7 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 20 Jan 2025 16:52:01 +0100
+Subject: [PATCH xserver 10/13] sync: Do not let sync objects uninitialized
+
+When changing an alarm, the change mask values are evaluated one after
+the other, changing the trigger values as requested and eventually,
+SyncInitTrigger() is called.
+
+SyncInitTrigger() will evaluate the XSyncCACounter first and may free
+the existing sync object.
+
+Other changes are then evaluated and may trigger an error and an early
+return, not adding the new sync object.
+
+This can be used to cause a use after free when the alarm eventually
+triggers.
+
+To avoid the issue, delete the existing sync object as late as possible
+only once we are sure that no further error will cause an early exit.
+
+CVE-2025-26601, ZDI-CAN-25870
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit 16a1242d0ffc7f45ed3c595ee7564b5c04287e0b)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ Xext/sync.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index fd2ceb042..e55295904 100644
+--- a/Xext/sync.c
++++ b/Xext/sync.c
+@@ -329,11 +329,6 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+             client->errorValue = syncObject;
+             return rc;
+         }
+-        if (pSync != pTrigger->pSync) { /* new counter for trigger */
+-            SyncDeleteTriggerFromSyncObject(pTrigger);
+-            pTrigger->pSync = pSync;
+-            newSyncObject = TRUE;
+-        }
+     }
+ 
+     /* if system counter, ask it what the current value is */
+@@ -401,6 +396,14 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+         }
+     }
+ 
++    if (changes & XSyncCACounter) {
++        if (pSync != pTrigger->pSync) { /* new counter for trigger */
++            SyncDeleteTriggerFromSyncObject(pTrigger);
++            pTrigger->pSync = pSync;
++            newSyncObject = TRUE;
++        }
++    }
++
+     /*  we wait until we're sure there are no errors before registering
+      *  a new counter on a trigger
+      */
+-- 
+2.48.1
+

0011-sync-Check-values-before-applying-changes.patch

@@ -0,0 +1,83 @@
+From a4c19259fca5af558fb27d8fa98f2ad4a3689d56 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 20 Jan 2025 16:54:30 +0100
+Subject: [PATCH xserver 11/13] sync: Check values before applying changes
+
+In SyncInitTrigger(), we would set the CheckTrigger function before
+validating the counter value.
+
+As a result, if the counter value overflowed, we would leave the
+function SyncInitTrigger() with the CheckTrigger applied but without
+updating the trigger object.
+
+To avoid that issue, move the portion of code checking for the trigger
+check value before updating the CheckTrigger function.
+
+Related to CVE-2025-26601, ZDI-CAN-25870
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit f52cea2f93a0c891494eb3334894442a92368030)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ Xext/sync.c | 36 ++++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index e55295904..66a52283d 100644
+--- a/Xext/sync.c
++++ b/Xext/sync.c
+@@ -350,6 +350,24 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+         }
+     }
+ 
++    if (changes & (XSyncCAValueType | XSyncCAValue)) {
++        if (pTrigger->value_type == XSyncAbsolute)
++            pTrigger->test_value = pTrigger->wait_value;
++        else {                  /* relative */
++            Bool overflow;
++
++            if (pCounter == NULL)
++                return BadMatch;
++
++            overflow = checked_int64_add(&pTrigger->test_value,
++                                         pCounter->value, pTrigger->wait_value);
++            if (overflow) {
++                client->errorValue = pTrigger->wait_value >> 32;
++                return BadValue;
++            }
++        }
++    }
++
+     if (changes & XSyncCATestType) {
+ 
+         if (pSync && SYNC_FENCE == pSync->type) {
+@@ -378,24 +396,6 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+         }
+     }
+ 
+-    if (changes & (XSyncCAValueType | XSyncCAValue)) {
+-        if (pTrigger->value_type == XSyncAbsolute)
+-            pTrigger->test_value = pTrigger->wait_value;
+-        else {                  /* relative */
+-            Bool overflow;
+-
+-            if (pCounter == NULL)
+-                return BadMatch;
+-
+-            overflow = checked_int64_add(&pTrigger->test_value,
+-                                         pCounter->value, pTrigger->wait_value);
+-            if (overflow) {
+-                client->errorValue = pTrigger->wait_value >> 32;
+-                return BadValue;
+-            }
+-        }
+-    }
+-
+     if (changes & XSyncCACounter) {
+         if (pSync != pTrigger->pSync) { /* new counter for trigger */
+             SyncDeleteTriggerFromSyncObject(pTrigger);
+-- 
+2.48.1
+

0012-sync-Do-not-fail-SyncAddTriggerToSyncObject.patch

@@ -0,0 +1,50 @@
+From 7537745b5fe63d7e43d692bfa86f93259d522c80 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 20 Jan 2025 17:06:07 +0100
+Subject: [PATCH xserver 12/13] sync: Do not fail SyncAddTriggerToSyncObject()
+
+We do not want to return a failure at the very last step in
+SyncInitTrigger() after having all changes applied.
+
+SyncAddTriggerToSyncObject() must not fail on memory allocation, if the
+allocation of the SyncTriggerList fails, trigger a FatalError() instead.
+
+Related to CVE-2025-26601, ZDI-CAN-25870
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit 8cbc90c8817306af75a60f494ec9dbb1061e50db)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ Xext/sync.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index 66a52283d..8def4adbf 100644
+--- a/Xext/sync.c
++++ b/Xext/sync.c
+@@ -199,8 +199,8 @@ SyncAddTriggerToSyncObject(SyncTrigger * pTrigger)
+             return Success;
+     }
+ 
+-    if (!(pCur = malloc(sizeof(SyncTriggerList))))
+-        return BadAlloc;
++    /* Failure is not an option, it's succeed or burst! */
++    pCur = XNFalloc(sizeof(SyncTriggerList));
+ 
+     pCur->pTrigger = pTrigger;
+     pCur->next = pTrigger->pSync->pTriglist;
+@@ -408,8 +408,7 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+      *  a new counter on a trigger
+      */
+     if (newSyncObject) {
+-        if ((rc = SyncAddTriggerToSyncObject(pTrigger)) != Success)
+-            return rc;
++        SyncAddTriggerToSyncObject(pTrigger);
+     }
+     else if (pCounter && IsSystemCounter(pCounter)) {
+         SyncComputeBracketValues(pCounter);
+-- 
+2.48.1
+

0013-sync-Apply-changes-last-in-SyncChangeAlarmAttributes.patch

@@ -0,0 +1,131 @@
+From e7bca6a0933b6f0c1568cbe770740c48626f30be Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 20 Jan 2025 17:10:31 +0100
+Subject: [PATCH xserver 13/13] sync: Apply changes last in
+ SyncChangeAlarmAttributes()
+
+SyncChangeAlarmAttributes() would apply the various changes while
+checking for errors.
+
+If one of the changes triggers an error, the changes for the trigger,
+counter or delta value would remain, possibly leading to inconsistent
+changes.
+
+Postpone the actual changes until we're sure nothing else can go wrong.
+
+Related to CVE-2025-26601, ZDI-CAN-25870
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+(cherry picked from commit c285798984c6bb99e454a33772cde23d394d3dcd)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>
+---
+ Xext/sync.c | 42 +++++++++++++++++++++++++++---------------
+ 1 file changed, 27 insertions(+), 15 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index 8def4adbf..e2f2c2774 100644
+--- a/Xext/sync.c
++++ b/Xext/sync.c
+@@ -799,8 +799,14 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
+     int status;
+     XSyncCounter counter;
+     Mask origmask = mask;
++    SyncTrigger trigger;
++    Bool select_events_changed = FALSE;
++    Bool select_events_value = FALSE;
++    int64_t delta;
+ 
+-    counter = pAlarm->trigger.pSync ? pAlarm->trigger.pSync->id : None;
++    trigger = pAlarm->trigger;
++    delta = pAlarm->delta;
++    counter = trigger.pSync ? trigger.pSync->id : None;
+ 
+     while (mask) {
+         int index2 = lowbit(mask);
+@@ -816,24 +822,24 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
+         case XSyncCAValueType:
+             mask &= ~XSyncCAValueType;
+             /* sanity check in SyncInitTrigger */
+-            pAlarm->trigger.value_type = *values++;
++            trigger.value_type = *values++;
+             break;
+ 
+         case XSyncCAValue:
+             mask &= ~XSyncCAValue;
+-            pAlarm->trigger.wait_value = ((int64_t)values[0] << 32) | values[1];
++            trigger.wait_value = ((int64_t)values[0] << 32) | values[1];
+             values += 2;
+             break;
+ 
+         case XSyncCATestType:
+             mask &= ~XSyncCATestType;
+             /* sanity check in SyncInitTrigger */
+-            pAlarm->trigger.test_type = *values++;
++            trigger.test_type = *values++;
+             break;
+ 
+         case XSyncCADelta:
+             mask &= ~XSyncCADelta;
+-            pAlarm->delta = ((int64_t)values[0] << 32) | values[1];
++            delta = ((int64_t)values[0] << 32) | values[1];
+             values += 2;
+             break;
+ 
+@@ -843,10 +849,8 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
+                 client->errorValue = *values;
+                 return BadValue;
+             }
+-            status = SyncEventSelectForAlarm(pAlarm, client,
+-                                             (Bool) (*values++));
+-            if (status != Success)
+-                return status;
++            select_events_value = (Bool) (*values++);
++            select_events_changed = TRUE;
+             break;
+ 
+         default:
+@@ -855,25 +859,33 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
+         }
+     }
+ 
++    if (select_events_changed) {
++        status = SyncEventSelectForAlarm(pAlarm, client, select_events_value);
++        if (status != Success)
++            return status;
++    }
++
+     /* "If the test-type is PositiveComparison or PositiveTransition
+      *  and delta is less than zero, or if the test-type is
+      *  NegativeComparison or NegativeTransition and delta is
+      *  greater than zero, a Match error is generated."
+      */
+     if (origmask & (XSyncCADelta | XSyncCATestType)) {
+-        if ((((pAlarm->trigger.test_type == XSyncPositiveComparison) ||
+-              (pAlarm->trigger.test_type == XSyncPositiveTransition))
+-             && pAlarm->delta < 0)
++        if ((((trigger.test_type == XSyncPositiveComparison) ||
++              (trigger.test_type == XSyncPositiveTransition))
++             && delta < 0)
+             ||
+-            (((pAlarm->trigger.test_type == XSyncNegativeComparison) ||
+-              (pAlarm->trigger.test_type == XSyncNegativeTransition))
+-             && pAlarm->delta > 0)
++            (((trigger.test_type == XSyncNegativeComparison) ||
++              (trigger.test_type == XSyncNegativeTransition))
++             && delta > 0)
+             ) {
+             return BadMatch;
+         }
+     }
+ 
+     /* postpone this until now, when we're sure nothing else can go wrong */
++    pAlarm->delta = delta;
++    pAlarm->trigger = trigger;
+     if ((status = SyncInitTrigger(client, &pAlarm->trigger, counter, RTCounter,
+                                   origmask & XSyncCAAllTrigger)) != Success)
+         return status;
+-- 
+2.48.1
+

Makefile

@@ -0,0 +1,30 @@
+# Makefile for source rpm: xorg-x11-server
+# $Id$
+NAME := xorg-x11-server
+SPECFILE = $(firstword $(wildcard *.spec))
+
+define find-makefile-common
+for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
+endef
+
+MAKEFILE_COMMON := $(shell $(find-makefile-common))
+
+ifeq ($(MAKEFILE_COMMON),)
+# attempt a checkout
+define checkout-makefile-common
+test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
+endef
+
+MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
+endif
+
+include $(MAKEFILE_COMMON)
+
+ifeq ($(MAKECMDGOALS),me a sandwich)
+.PHONY :: me a sandwich
+me a:
+	@:
+
+sandwich:
+	@[ `id -u` -ne 0 ] && echo "What? Make it yourself." || echo Okay.
+endif

commitid

@@ -0,0 +1 @@
+d13cb974426f7f1110b0bdb08c4ebb46ff8975f7

gitignore

@@ -0,0 +1,306 @@
+Makefile
+Makefile.in
+.deps
+.libs
+.msg
+*.lo
+*.la
+*.a
+*.o
+*~
+.*sw?
+*.pbxuser
+*.mode1v3
+obj*
+build*
+local
+aclocal.m4
+autom4te.cache
+compile
+config.guess
+config.log
+config.status
+config.sub
+configure
+configure.lineno
+depcomp
+install-sh
+libtool
+ltmain.sh
+missing
+TAGS
+tags
+ylwrap
+xorg-server.pc
+stamp-h?
+do-not-use-config.h
+do-not-use-config.h.in
+afb/afbbltC.c
+afb/afbbltCI.c
+afb/afbbltG.c
+afb/afbbltO.c
+afb/afbbltX.c
+afb/afbseg.c
+afb/afbtileC.c
+afb/afbtileG.c
+cfb/cfb8lineCO.c
+cfb/cfb8lineCP.c
+cfb/cfb8lineG.c
+cfb/cfb8lineX.c
+cfb/cfb8segC.c
+cfb/cfb8segCS.c
+cfb/cfb8segX.c
+cfb/cfb8setG.c
+cfb/cfbbltC.c
+cfb/cfbbltG.c
+cfb/cfbbltO.c
+cfb/cfbbltX.c
+cfb/cfbfillarcC.c
+cfb/cfbfillarcG.c
+cfb/cfbglrop8.c
+cfb/cfbply1rctC.c
+cfb/cfbply1rctG.c
+cfb/cfbseg.c
+cfb/cfbsolidC.c
+cfb/cfbsolidG.c
+cfb/cfbsolidX.c
+cfb/cfbtile32C.c
+cfb/cfbtile32G.c
+cfb/cfbtileoddC.c
+cfb/cfbtileoddG.c
+cfb/cfbzerarcC.c
+cfb/cfbzerarcG.c
+cfb/cfbzerarcX.c
+cfb32/cfb8lineCO.c
+cfb32/cfb8lineCP.c
+cfb32/cfb8lineG.c
+cfb32/cfb8lineX.c
+cfb32/cfb8segC.c
+cfb32/cfb8segCS.c
+cfb32/cfb8segX.c
+cfb32/cfb8setG.c
+cfb32/cfbbltC.c
+cfb32/cfbbltG.c
+cfb32/cfbbltO.c
+cfb32/cfbbltX.c
+cfb32/cfbfillarcC.c
+cfb32/cfbfillarcG.c
+cfb32/cfbply1rctC.c
+cfb32/cfbply1rctG.c
+cfb32/cfbseg.c
+cfb32/cfbsolidC.c
+cfb32/cfbsolidG.c
+cfb32/cfbsolidX.c
+cfb32/cfbtile32C.c
+cfb32/cfbtile32G.c
+cfb32/cfbtileoddC.c
+cfb32/cfbtileoddG.c
+cfb32/cfbzerarcC.c
+cfb32/cfbzerarcG.c
+cfb32/cfbzerarcX.c
+doc/Xserver.1x
+doc/Xserver.man
+hw/dmx/Xdmx
+hw/dmx/Xdmx.1x
+hw/dmx/config/dmxtodmx
+hw/dmx/config/dmxtodmx.1x
+hw/dmx/config/parser.c
+hw/dmx/config/parser.h
+hw/dmx/config/scanner.c
+hw/dmx/config/vdltodmx
+hw/dmx/config/vdltodmx.1x
+hw/dmx/config/xdmxconfig
+hw/dmx/config/xdmxconfig.1x
+hw/dmx/examples/dmxaddinput
+hw/dmx/examples/dmxaddscreen
+hw/dmx/examples/dmxreconfig
+hw/dmx/examples/dmxresize
+hw/dmx/examples/dmxrminput
+hw/dmx/examples/dmxrmscreen
+hw/dmx/examples/dmxwininfo
+hw/dmx/examples/ev
+hw/dmx/examples/evi
+hw/dmx/examples/res
+hw/dmx/examples/xbell
+hw/dmx/examples/xdmx
+hw/dmx/examples/xinput
+hw/dmx/examples/xled
+hw/dmx/examples/xtest
+hw/kdrive/ati/Xati
+hw/kdrive/chips/Xchips
+hw/kdrive/ephyr/Xephyr
+hw/kdrive/epson/Xepson
+hw/kdrive/fake/Xfake
+hw/kdrive/fbdev/Xfbdev
+hw/kdrive/i810/Xi810
+hw/kdrive/mach64/Xmach64
+hw/kdrive/mga/Xmga
+hw/kdrive/neomagic/Xneomagic
+hw/kdrive/nvidia/Xnvidia
+hw/kdrive/pm2/Xpm2
+hw/kdrive/r128/Xr128
+hw/kdrive/sdl/Xsdl
+hw/kdrive/sis300/Xsis
+hw/kdrive/smi/Xsmi
+hw/kdrive/vesa/Xvesa
+hw/kdrive/via/Xvia
+hw/vfb/Xvfb
+hw/vfb/Xvfb.1x
+hw/vfb/Xvfb.man
+hw/xfree86/Xorg
+hw/xfree86/common/xf86Build.h
+hw/xfree86/common/xf86DefModeSet.c
+hw/xfree86/doc/man/Xorg.1x
+hw/xfree86/doc/man/Xorg.man
+hw/xfree86/doc/man/xorg.conf.5x
+hw/xfree86/doc/man/xorg.conf.man
+hw/xfree86/exa/exa.4
+hw/xfree86/exa/exa.4x
+hw/xfree86/exa/exa.man
+hw/xfree86/fbdevhw/fbdevhw.4x
+hw/xfree86/fbdevhw/fbdevhw.man
+hw/xfree86/getconfig/cfg.man
+hw/xfree86/getconfig/getconfig.1x
+hw/xfree86/getconfig/getconfig.5x
+hw/xfree86/getconfig/getconfig.man
+hw/xfree86/os-support/xorgos.c
+hw/xfree86/osandcommon.c
+hw/xfree86/ramdac/xf86BitOrder.c
+hw/xfree86/scanpci/xf86PciData.c
+hw/xfree86/scanpci/xf86PciIds.h
+hw/xfree86/utils/cvt/cvt
+hw/xfree86/utils/cvt/cvt.man
+hw/xfree86/utils/gtf/gtf
+hw/xfree86/utils/gtf/gtf.1x
+hw/xfree86/utils/gtf/gtf.man
+hw/xfree86/utils/ioport/inb
+hw/xfree86/utils/ioport/inl
+hw/xfree86/utils/ioport/inw
+hw/xfree86/utils/ioport/ioport
+hw/xfree86/utils/ioport/outb
+hw/xfree86/utils/ioport/outl
+hw/xfree86/utils/ioport/outw
+hw/xfree86/utils/pcitweak/pcitweak
+hw/xfree86/utils/pcitweak/pcitweak.1x
+hw/xfree86/utils/pcitweak/pcitweak.man
+hw/xfree86/utils/scanpci/scanpci
+hw/xfree86/utils/scanpci/scanpci.1x
+hw/xfree86/utils/scanpci/scanpci.man
+hw/xfree86/utils/xorgcfg/XOrgCfg
+hw/xfree86/utils/xorgcfg/xorgcfg
+hw/xfree86/utils/xorgcfg/xorgcfg.1x
+hw/xfree86/utils/xorgcfg/xorgcfg.man
+hw/xfree86/utils/xorgconfig/xorgconfig
+hw/xfree86/utils/xorgconfig/xorgconfig.1x
+hw/xfree86/utils/xorgconfig/xorgconfig.man
+hw/xfree86/xaa/l-xaaBitmap.c
+hw/xfree86/xaa/l-xaaStipple.c
+hw/xfree86/xaa/l-xaaTEGlyph.c
+hw/xfree86/xaa/l3-xaaBitmap.c
+hw/xfree86/xaa/l3-xaaStipple.c
+hw/xfree86/xaa/lf-xaaBitmap.c
+hw/xfree86/xaa/lf-xaaStipple.c
+hw/xfree86/xaa/lf-xaaTEGlyph.c
+hw/xfree86/xaa/lf3-xaaBitmap.c
+hw/xfree86/xaa/lf3-xaaStipple.c
+hw/xfree86/xaa/m-xaaBitmap.c
+hw/xfree86/xaa/m-xaaStipple.c
+hw/xfree86/xaa/m-xaaTEGlyph.c
+hw/xfree86/xaa/m3-xaaBitmap.c
+hw/xfree86/xaa/m3-xaaStipple.c
+hw/xfree86/xaa/mf-xaaBitmap.c
+hw/xfree86/xaa/mf-xaaStipple.c
+hw/xfree86/xaa/mf-xaaTEGlyph.c
+hw/xfree86/xaa/mf3-xaaBitmap.c
+hw/xfree86/xaa/mf3-xaaStipple.c
+hw/xfree86/xaa/s-xaaDashLine.c
+hw/xfree86/xaa/s-xaaLine.c
+hw/xfree86/xf1bpp/maskbits.c
+hw/xfree86/xf1bpp/mfbbitblt.c
+hw/xfree86/xf1bpp/mfbbltC.c
+hw/xfree86/xf1bpp/mfbbltCI.c
+hw/xfree86/xf1bpp/mfbbltG.c
+hw/xfree86/xf1bpp/mfbbltO.c
+hw/xfree86/xf1bpp/mfbbltX.c
+hw/xfree86/xf1bpp/mfbbres.c
+hw/xfree86/xf1bpp/mfbbresd.c
+hw/xfree86/xf1bpp/mfbclip.c
+hw/xfree86/xf1bpp/mfbcmap.c
+hw/xfree86/xf1bpp/mfbfillarc.c
+hw/xfree86/xf1bpp/mfbfillrct.c
+hw/xfree86/xf1bpp/mfbfillsp.c
+hw/xfree86/xf1bpp/mfbfont.c
+hw/xfree86/xf1bpp/mfbgc.c
+hw/xfree86/xf1bpp/mfbgetsp.c
+hw/xfree86/xf1bpp/mfbigbblak.c
+hw/xfree86/xf1bpp/mfbigbwht.c
+hw/xfree86/xf1bpp/mfbhrzvert.c
+hw/xfree86/xf1bpp/mfbimage.c
+hw/xfree86/xf1bpp/mfbline.c
+hw/xfree86/xf1bpp/mfbmisc.c
+hw/xfree86/xf1bpp/mfbpablack.c
+hw/xfree86/xf1bpp/mfbpainv.c
+hw/xfree86/xf1bpp/mfbpawhite.c
+hw/xfree86/xf1bpp/mfbpgbblak.c
+hw/xfree86/xf1bpp/mfbpgbinv.c
+hw/xfree86/xf1bpp/mfbpgbwht.c
+hw/xfree86/xf1bpp/mfbpixmap.c
+hw/xfree86/xf1bpp/mfbplyblack.c
+hw/xfree86/xf1bpp/mfbplyinv.c
+hw/xfree86/xf1bpp/mfbplywhite.c
+hw/xfree86/xf1bpp/mfbpntwin.c
+hw/xfree86/xf1bpp/mfbpolypnt.c
+hw/xfree86/xf1bpp/mfbpushpxl.c
+hw/xfree86/xf1bpp/mfbscrclse.c
+hw/xfree86/xf1bpp/mfbscrinit.c
+hw/xfree86/xf1bpp/mfbseg.c
+hw/xfree86/xf1bpp/mfbsetsp.c
+hw/xfree86/xf1bpp/mfbteblack.c
+hw/xfree86/xf1bpp/mfbtewhite.c
+hw/xfree86/xf1bpp/mfbtileC.c
+hw/xfree86/xf1bpp/mfbtileG.c
+hw/xfree86/xf1bpp/mfbwindow.c
+hw/xfree86/xf1bpp/mfbzerarc.c
+hw/xfree86/xf4bpp/mfbseg.c
+hw/xfree86/xf8_32bpp/cfbgc32.c
+hw/xfree86/xf8_32bpp/cfbgc8.c
+hw/xfree86/xorg.c
+hw/xfree86/xorg.conf.example
+hw/xfree86/xorg.conf.example.pre
+hw/xnest/Xnest
+hw/xnest/Xnest.1x
+hw/xnest/Xnest.man
+hw/xprint/Xprt
+hw/xprint/config/C/print/Xprinters.ghostscript
+hw/xprint/doc/Xprt.1x
+hw/xprint/doc/Xprt.man
+hw/xprint/dpmsstubs-wrapper.c
+hw/xprint/miinitext-wrapper.c
+include/dix-config.h
+include/kdrive-config.h
+include/xgl-config.h
+include/xkb-config.h
+include/xorg-config.h
+include/xorg-server.h
+include/xwin-config.h
+mfb/mfbbltC.c
+mfb/mfbbltCI.c
+mfb/mfbbltG.c
+mfb/mfbbltO.c
+mfb/mfbbltX.c
+mfb/mfbigbblak.c
+mfb/mfbigbwht.c
+mfb/mfbpablack.c
+mfb/mfbpainv.c
+mfb/mfbpawhite.c
+mfb/mfbpgbblak.c
+mfb/mfbpgbinv.c
+mfb/mfbpgbwht.c
+mfb/mfbplyblack.c
+mfb/mfbplyinv.c
+mfb/mfbplywhite.c
+mfb/mfbseg.c
+mfb/mfbteblack.c
+mfb/mfbtewhite.c
+mfb/mfbtileC.c
+mfb/mfbtileG.c

import.log

@@ -0,0 +1,6 @@
+xorg-x11-server-1_5_0-1_fc10:HEAD:xorg-x11-server-1.5.0-1.fc10.src.rpm:1220485219
+xorg-x11-server-1_5_1-1_fc10:HEAD:xorg-x11-server-1.5.1-1.fc10.src.rpm:1222198557
+xorg-x11-server-1_5_2-1_fc10:HEAD:xorg-x11-server-1.5.2-1.fc10.src.rpm:1223667007
+xorg-x11-server-1_5_3-1_fc10:HEAD:xorg-x11-server-1.5.3-1.fc10.src.rpm:1225918317
+xorg-x11-server-1_6_0-1_fc11:HEAD:xorg-x11-server-1.6.0-1.fc11.src.rpm:1235594175
+xorg-x11-server-1_6_1-1_fc11:HEAD:xorg-x11-server-1.6.1-1.fc11.src.rpm:1239742477

make-git-snapshot.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+DIRNAME=xorg-server-$( date +%Y%m%d )
+
+rm -rf $DIRNAME
+git clone git://git.freedesktop.org/git/xorg/xserver $DIRNAME
+cd $DIRNAME
+if [ -z "$1" ]; then
+    git log | head -1
+else
+    git checkout $1
+fi
+git log | head -1 | awk '{ print $2 }' > ../commitid
+git repack -a -d
+cd ..
+tar cf - $DIRNAME | xz -c9 > $DIRNAME.tar.xz
+rm -rf $DIRNAME

sources

@@ -1 +1 @@
-SHA512 (xorg-server-21.1.21.tar.xz) = bb2eb4e6756eb9e38b61bd47c017da44bcf5f45f2b7a906b4bb3a56b3d791cec64abb9bf37b224efe1e4fab9cc296f3672c9b2f8e00e1cdfc54337bef63cd16c
+SHA512 (xorg-server-1.20.14.tar.xz) = be3dc32cce7d55d7e38c5f6557027f13f39224c76cc83e5800555d5ce89dbdc3731773a2d186a5b97db9fc8731a2b2dd6e9829af2b01ee2559246d4aef7c4963

xorg-x11-server-fb-access-wrapper.patch

@@ -0,0 +1,31 @@
+fb: Declare wfbFinishScreenInit, wfbScreenInit for !FB_ACCESS_WRAPPER
+
+xorg-x11-drv-nouveau wfbScreenInit without defining FB_ACCESS_WRAPPER
+(which has other unintended side effects).  Presently, this compiles
+and links because compilers still support implicit function
+declarations, but this is going to change fairly soon.  This seems to
+be the most straightforward change to keep the driver building.
+
+Submitted upstream:
+
+  <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1114>
+
+diff -ur xorg-server-1.20.14.orig/fb/fb.h xorg-server-1.20.14/fb/fb.h
+--- xorg-server-1.20.14.orig/fb/fb.h	2021-12-15 20:01:24.000000000 +0100
++++ xorg-server-1.20.14/fb/fb.h	2023-04-13 13:59:47.325341537 +0200
+@@ -1027,7 +1027,6 @@
+                int dpiy, int width,     /* pixel width of frame buffer */
+                int bpp);        /* bits per pixel of frame buffer */
+ 
+-#ifdef FB_ACCESS_WRAPPER
+ extern _X_EXPORT Bool
+ wfbFinishScreenInit(ScreenPtr pScreen,
+                     void *pbits,
+@@ -1049,7 +1048,6 @@
+               int width,
+               int bpp,
+               SetupWrapProcPtr setupWrap, FinishWrapProcPtr finishWrap);
+-#endif
+ 
+ extern _X_EXPORT Bool
+ fbFinishScreenInit(ScreenPtr pScreen,

xserver-sdk-abi-requires.git

@@ -0,0 +1,14 @@
+#!/bin/sh
+#
+# The X server provides capabilities of the form:
+#
+# Provides: xserver-abi(ansic-0) = 4
+#
+# for an ABI version of 0.4.  The major number is encoded into the name so
+# that major number changes force upgrades.  If we didn't, then
+#
+# Requires: xserver-abi(ansic) >= 0.4
+#
+# would also match 1.0, which is wrong since major numbers mean an ABI break.
+
+echo "xserver-abi($1-@MAJOR@) >= @MINOR@"

xserver-sdk-abi-requires.release

@@ -0,0 +1,19 @@
+#!/bin/sh
+#
+# The X server provides capabilities of the form:
+#
+# Provides: xserver-abi(ansic-0) = 4
+#
+# for an ABI version of 0.4.  The major number is encoded into the name so
+# that major number changes force upgrades.  If we didn't, then
+#
+# Requires: xserver-abi(ansic) >= 0.4
+#
+# would also match 1.0, which is wrong since major numbers mean an ABI break.
+
+ver=$(pkg-config --variable abi_$1 xorg-server)
+
+major=$(echo $ver | cut -f 1 -d .)
+minor=$(echo $ver | cut -f 2 -d .)
+
+echo "xserver-abi($1-$major) >= $minor"