MSVSphere Packaging Team
1 year ago
parent
9922287e05
commit
724c5894ac
@ -0,0 +1,42 @@
|
|||||||
|
From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||||
|
Date: Mon, 13 Mar 2023 11:08:47 +0100
|
||||||
|
Subject: [PATCH xserver] composite: Fix use-after-free of the COW
|
||||||
|
|
||||||
|
ZDI-CAN-19866/CVE-2023-1393
|
||||||
|
|
||||||
|
If a client explicitly destroys the compositor overlay window (aka COW),
|
||||||
|
we would leave a dangling pointer to that window in the CompScreen
|
||||||
|
structure, which will trigger a use-after-free later.
|
||||||
|
|
||||||
|
Make sure to clear the CompScreen pointer to the COW when the latter gets
|
||||||
|
destroyed explicitly by the client.
|
||||||
|
|
||||||
|
This vulnerability was discovered by:
|
||||||
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||||
|
|
||||||
|
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||||
|
Reviewed-by: Adam Jackson <ajax@redhat.com>
|
||||||
|
---
|
||||||
|
composite/compwindow.c | 5 +++++
|
||||||
|
1 file changed, 5 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/composite/compwindow.c b/composite/compwindow.c
|
||||||
|
index 4e2494b86..b30da589e 100644
|
||||||
|
--- a/composite/compwindow.c
|
||||||
|
+++ b/composite/compwindow.c
|
||||||
|
@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
|
||||||
|
ret = (*pScreen->DestroyWindow) (pWin);
|
||||||
|
cs->DestroyWindow = pScreen->DestroyWindow;
|
||||||
|
pScreen->DestroyWindow = compDestroyWindow;
|
||||||
|
+
|
||||||
|
+ /* Did we just destroy the overlay window? */
|
||||||
|
+ if (pWin == cs->pOverlayWin)
|
||||||
|
+ cs->pOverlayWin = NULL;
|
||||||
|
+
|
||||||
|
/* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.40.0
|
||||||
|
|
||||||
@ -0,0 +1,105 @@
|
|||||||
|
From b98fc07d3442a289c6bef82df50dd0a2d01de71a Mon Sep 17 00:00:00 2001
|
||||||
|
From: Adam Jackson <ajax@redhat.com>
|
||||||
|
Date: Thu, 2 Feb 2023 12:26:27 -0500
|
||||||
|
Subject: [PATCH xserver] present: Send a PresentConfigureNotify event for
|
||||||
|
destroyed windows
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
This enables fixing a deadlock case on the client side, where the client
|
||||||
|
ends up blocked waiting for a Present event that will never come because
|
||||||
|
the window was destroyed. The new PresentWindowDestroyed flag allows the
|
||||||
|
client to avoid blocking indefinitely.
|
||||||
|
|
||||||
|
Signed-off-by: Adam Jackson <ajax@redhat.com>
|
||||||
|
See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/116
|
||||||
|
See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6685
|
||||||
|
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
|
||||||
|
(cherry picked from commit 462b06033e66a32308d940eb5fc47f5e4c914dc0)
|
||||||
|
---
|
||||||
|
present/present_event.c | 5 +++--
|
||||||
|
present/present_priv.h | 7 ++++++-
|
||||||
|
present/present_screen.c | 11 ++++++++++-
|
||||||
|
3 files changed, 19 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/present/present_event.c b/present/present_event.c
|
||||||
|
index 435b26b70..849732dc8 100644
|
||||||
|
--- a/present/present_event.c
|
||||||
|
+++ b/present/present_event.c
|
||||||
|
@@ -102,7 +102,8 @@ present_event_swap(xGenericEvent *from, xGenericEvent *to)
|
||||||
|
}
|
||||||
|
|
||||||
|
void
|
||||||
|
-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling)
|
||||||
|
+present_send_config_notify(WindowPtr window, int x, int y, int w, int h,
|
||||||
|
+ int bw, WindowPtr sibling, CARD32 flags)
|
||||||
|
{
|
||||||
|
present_window_priv_ptr window_priv = present_window_priv(window);
|
||||||
|
|
||||||
|
@@ -122,7 +123,7 @@ present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw,
|
||||||
|
.off_y = 0,
|
||||||
|
.pixmap_width = w,
|
||||||
|
.pixmap_height = h,
|
||||||
|
- .pixmap_flags = 0
|
||||||
|
+ .pixmap_flags = flags
|
||||||
|
};
|
||||||
|
present_event_ptr event;
|
||||||
|
|
||||||
|
diff --git a/present/present_priv.h b/present/present_priv.h
|
||||||
|
index 6ebd009a2..4ad729864 100644
|
||||||
|
--- a/present/present_priv.h
|
||||||
|
+++ b/present/present_priv.h
|
||||||
|
@@ -43,6 +43,11 @@
|
||||||
|
#define DebugPresent(x)
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+/* XXX this belongs in presentproto */
|
||||||
|
+#ifndef PresentWindowDestroyed
|
||||||
|
+#define PresentWindowDestroyed (1 << 0)
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
extern int present_request;
|
||||||
|
|
||||||
|
extern DevPrivateKeyRec present_screen_private_key;
|
||||||
|
@@ -307,7 +312,7 @@ void
|
||||||
|
present_free_events(WindowPtr window);
|
||||||
|
|
||||||
|
void
|
||||||
|
-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling);
|
||||||
|
+present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling, CARD32 flags);
|
||||||
|
|
||||||
|
void
|
||||||
|
present_send_complete_notify(WindowPtr window, CARD8 kind, CARD8 mode, CARD32 serial, uint64_t ust, uint64_t msc);
|
||||||
|
diff --git a/present/present_screen.c b/present/present_screen.c
|
||||||
|
index 15684eda4..2c29aafd2 100644
|
||||||
|
--- a/present/present_screen.c
|
||||||
|
+++ b/present/present_screen.c
|
||||||
|
@@ -93,6 +93,15 @@ present_destroy_window(WindowPtr window)
|
||||||
|
present_screen_priv_ptr screen_priv = present_screen_priv(screen);
|
||||||
|
present_window_priv_ptr window_priv = present_window_priv(window);
|
||||||
|
|
||||||
|
+ present_send_config_notify(window,
|
||||||
|
+ window->drawable.x,
|
||||||
|
+ window->drawable.y,
|
||||||
|
+ window->drawable.width,
|
||||||
|
+ window->drawable.height,
|
||||||
|
+ window->borderWidth,
|
||||||
|
+ window->nextSib,
|
||||||
|
+ PresentWindowDestroyed);
|
||||||
|
+
|
||||||
|
if (window_priv) {
|
||||||
|
present_clear_window_notifies(window);
|
||||||
|
present_free_events(window);
|
||||||
|
@@ -123,7 +132,7 @@ present_config_notify(WindowPtr window,
|
||||||
|
ScreenPtr screen = window->drawable.pScreen;
|
||||||
|
present_screen_priv_ptr screen_priv = present_screen_priv(screen);
|
||||||
|
|
||||||
|
- present_send_config_notify(window, x, y, w, h, bw, sibling);
|
||||||
|
+ present_send_config_notify(window, x, y, w, h, bw, sibling, 0);
|
||||||
|
|
||||||
|
unwrap(screen_priv, screen, ConfigNotify);
|
||||||
|
if (screen->ConfigNotify)
|
||||||
|
--
|
||||||
|
2.40.0
|
||||||
|
|
||||||
Loading…
Reference in new issue