Compare commits
No commits in common. 'c8' and 'c9' have entirely different histories.
@ -1 +1 @@
|
||||
SOURCES/xwayland-21.1.3.tar.xz
|
||||
SOURCES/xwayland-22.1.9.tar.xz
|
||||
|
||||
@ -1 +1 @@
|
||||
ae980a7deeb7cad9f3cd253f3b1ddca5bb26aafa SOURCES/xwayland-21.1.3.tar.xz
|
||||
19ccc8ae5920620db725a08ee65d8b64c521d766 SOURCES/xwayland-22.1.9.tar.xz
|
||||
|
||||
@ -1,77 +0,0 @@
|
||||
From 19e9f199950aaa4b9b7696936d1b067475da999c Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 28 Nov 2023 15:19:04 +1000
|
||||
Subject: [PATCH xserver] Xi: allocate enough XkbActions for our buttons
|
||||
|
||||
button->xkb_acts is supposed to be an array sufficiently large for all
|
||||
our buttons, not just a single XkbActions struct. Allocating
|
||||
insufficient memory here means when we memcpy() later in
|
||||
XkbSetDeviceInfo we write into memory that wasn't ours to begin with,
|
||||
leading to the usual security ooopsiedaisies.
|
||||
|
||||
CVE-2023-6377, ZDI-CAN-22412, ZDI-CAN-22413
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
(cherry picked from commit 0c1a93d319558fe3ab2d94f51d174b4f93810afd)
|
||||
---
|
||||
Xi/exevents.c | 12 ++++++------
|
||||
dix/devices.c | 10 ++++++++++
|
||||
2 files changed, 16 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/Xi/exevents.c b/Xi/exevents.c
|
||||
index dcd4efb3b..54ea11a93 100644
|
||||
--- a/Xi/exevents.c
|
||||
+++ b/Xi/exevents.c
|
||||
@@ -611,13 +611,13 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
|
||||
}
|
||||
|
||||
if (from->button->xkb_acts) {
|
||||
- if (!to->button->xkb_acts) {
|
||||
- to->button->xkb_acts = calloc(1, sizeof(XkbAction));
|
||||
- if (!to->button->xkb_acts)
|
||||
- FatalError("[Xi] not enough memory for xkb_acts.\n");
|
||||
- }
|
||||
+ size_t maxbuttons = max(to->button->numButtons, from->button->numButtons);
|
||||
+ to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts,
|
||||
+ maxbuttons,
|
||||
+ sizeof(XkbAction));
|
||||
+ memset(to->button->xkb_acts, 0, maxbuttons * sizeof(XkbAction));
|
||||
memcpy(to->button->xkb_acts, from->button->xkb_acts,
|
||||
- sizeof(XkbAction));
|
||||
+ from->button->numButtons * sizeof(XkbAction));
|
||||
}
|
||||
else {
|
||||
free(to->button->xkb_acts);
|
||||
diff --git a/dix/devices.c b/dix/devices.c
|
||||
index 7150734a5..20fef1692 100644
|
||||
--- a/dix/devices.c
|
||||
+++ b/dix/devices.c
|
||||
@@ -2530,6 +2530,8 @@ RecalculateMasterButtons(DeviceIntPtr slave)
|
||||
|
||||
if (master->button && master->button->numButtons != maxbuttons) {
|
||||
int i;
|
||||
+ int last_num_buttons = master->button->numButtons;
|
||||
+
|
||||
DeviceChangedEvent event = {
|
||||
.header = ET_Internal,
|
||||
.type = ET_DeviceChanged,
|
||||
@@ -2540,6 +2542,14 @@ RecalculateMasterButtons(DeviceIntPtr slave)
|
||||
};
|
||||
|
||||
master->button->numButtons = maxbuttons;
|
||||
+ if (last_num_buttons < maxbuttons) {
|
||||
+ master->button->xkb_acts = xnfreallocarray(master->button->xkb_acts,
|
||||
+ maxbuttons,
|
||||
+ sizeof(XkbAction));
|
||||
+ memset(&master->button->xkb_acts[last_num_buttons],
|
||||
+ 0,
|
||||
+ (maxbuttons - last_num_buttons) * sizeof(XkbAction));
|
||||
+ }
|
||||
|
||||
memcpy(&event.buttons.names, master->button->labels, maxbuttons *
|
||||
sizeof(Atom));
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -1,36 +0,0 @@
|
||||
From 8660dd164882ce5fc1f274427e2ff3dc020d6273 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Wed, 25 Jan 2023 11:41:40 +1000
|
||||
Subject: [PATCH xserver] Xi: fix potential use-after-free in
|
||||
DeepCopyPointerClasses
|
||||
|
||||
CVE-2023-0494, ZDI-CAN-19596
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
(cherry picked from commit 0ba6d8c37071131a49790243cdac55392ecf71ec)
|
||||
---
|
||||
Xi/exevents.c | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Xi/exevents.c b/Xi/exevents.c
|
||||
index 217baa956..dcd4efb3b 100644
|
||||
--- a/Xi/exevents.c
|
||||
+++ b/Xi/exevents.c
|
||||
@@ -619,8 +619,10 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
|
||||
memcpy(to->button->xkb_acts, from->button->xkb_acts,
|
||||
sizeof(XkbAction));
|
||||
}
|
||||
- else
|
||||
+ else {
|
||||
free(to->button->xkb_acts);
|
||||
+ to->button->xkb_acts = NULL;
|
||||
+ }
|
||||
|
||||
memcpy(to->button->labels, from->button->labels,
|
||||
from->button->numButtons * sizeof(Atom));
|
||||
--
|
||||
2.39.1
|
||||
|
||||
@ -1,81 +0,0 @@
|
||||
From 1e8478455458e998dd366d2cd23d2aeab2bdeee5 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 3 Oct 2023 11:53:05 +1000
|
||||
Subject: [PATCH xserver] Xi/randr: fix handling of PropModeAppend/Prepend
|
||||
|
||||
The handling of appending/prepending properties was incorrect, with at
|
||||
least two bugs: the property length was set to the length of the new
|
||||
part only, i.e. appending or prepending N elements to a property with P
|
||||
existing elements always resulted in the property having N elements
|
||||
instead of N + P.
|
||||
|
||||
Second, when pre-pending a value to a property, the offset for the old
|
||||
values was incorrect, leaving the new property with potentially
|
||||
uninitalized values and/or resulting in OOB memory writes.
|
||||
For example, prepending a 3 element value to a 5 element property would
|
||||
result in this 8 value array:
|
||||
[N, N, N, ?, ?, P, P, P ] P, P
|
||||
^OOB write
|
||||
|
||||
The XI2 code is a copy/paste of the RandR code, so the bug exists in
|
||||
both.
|
||||
|
||||
CVE-2023-5367, ZDI-CAN-22153
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
(cherry picked from commit 541ab2ecd41d4d8689e71855d93e492bc554719a)
|
||||
---
|
||||
Xi/xiproperty.c | 4 ++--
|
||||
randr/rrproperty.c | 4 ++--
|
||||
2 files changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
|
||||
index 066ba21fba..d315f04d0e 100644
|
||||
--- a/Xi/xiproperty.c
|
||||
+++ b/Xi/xiproperty.c
|
||||
@@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
|
||||
XIDestroyDeviceProperty(prop);
|
||||
return BadAlloc;
|
||||
}
|
||||
- new_value.size = len;
|
||||
+ new_value.size = total_len;
|
||||
new_value.type = type;
|
||||
new_value.format = format;
|
||||
|
||||
@@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
|
||||
case PropModePrepend:
|
||||
new_data = new_value.data;
|
||||
old_data = (void *) (((char *) new_value.data) +
|
||||
- (prop_value->size * size_in_bytes));
|
||||
+ (len * size_in_bytes));
|
||||
break;
|
||||
}
|
||||
if (new_data)
|
||||
diff --git a/randr/rrproperty.c b/randr/rrproperty.c
|
||||
index c2fb9585c6..25469f57b2 100644
|
||||
--- a/randr/rrproperty.c
|
||||
+++ b/randr/rrproperty.c
|
||||
@@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
|
||||
RRDestroyOutputProperty(prop);
|
||||
return BadAlloc;
|
||||
}
|
||||
- new_value.size = len;
|
||||
+ new_value.size = total_len;
|
||||
new_value.type = type;
|
||||
new_value.format = format;
|
||||
|
||||
@@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
|
||||
case PropModePrepend:
|
||||
new_data = new_value.data;
|
||||
old_data = (void *) (((char *) new_value.data) +
|
||||
- (prop_value->size * size_in_bytes));
|
||||
+ (len * size_in_bytes));
|
||||
break;
|
||||
}
|
||||
if (new_data)
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -1,51 +0,0 @@
|
||||
From 8dba686dc277d6d262ad0c77b4632a5b276697ba Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 29 Nov 2022 12:55:45 +1000
|
||||
Subject: [PATCH xserver 1/7] Xtest: disallow GenericEvents in
|
||||
XTestSwapFakeInput
|
||||
|
||||
XTestSwapFakeInput assumes all events in this request are
|
||||
sizeof(xEvent) and iterates through these in 32-byte increments.
|
||||
However, a GenericEvent may be of arbitrary length longer than 32 bytes,
|
||||
so any GenericEvent in this list would result in subsequent events to be
|
||||
misparsed.
|
||||
|
||||
Additional, the swapped event is written into a stack-allocated struct
|
||||
xEvent (size 32 bytes). For any GenericEvent longer than 32 bytes,
|
||||
swapping the event may thus smash the stack like an avocado on toast.
|
||||
|
||||
Catch this case early and return BadValue for any GenericEvent.
|
||||
Which is what would happen in unswapped setups anyway since XTest
|
||||
doesn't support GenericEvent.
|
||||
|
||||
CVE-2022-46340, ZDI-CAN 19265
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
---
|
||||
Xext/xtest.c | 5 +++--
|
||||
1 file changed, 3 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/Xext/xtest.c b/Xext/xtest.c
|
||||
index bf27eb590b..2985a4ce6e 100644
|
||||
--- a/Xext/xtest.c
|
||||
+++ b/Xext/xtest.c
|
||||
@@ -502,10 +502,11 @@ XTestSwapFakeInput(ClientPtr client, xReq * req)
|
||||
|
||||
nev = ((req->length << 2) - sizeof(xReq)) / sizeof(xEvent);
|
||||
for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) {
|
||||
+ int evtype = ev->u.u.type & 0x177;
|
||||
/* Swap event */
|
||||
- proc = EventSwapVector[ev->u.u.type & 0177];
|
||||
+ proc = EventSwapVector[evtype];
|
||||
/* no swapping proc; invalid event type? */
|
||||
- if (!proc || proc == NotImplemented) {
|
||||
+ if (!proc || proc == NotImplemented || evtype == GenericEvent) {
|
||||
client->errorValue = ev->u.u.type;
|
||||
return BadValue;
|
||||
}
|
||||
--
|
||||
2.38.1
|
||||
@ -1,42 +0,0 @@
|
||||
From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Mon, 13 Mar 2023 11:08:47 +0100
|
||||
Subject: [PATCH xserver] composite: Fix use-after-free of the COW
|
||||
|
||||
ZDI-CAN-19866/CVE-2023-1393
|
||||
|
||||
If a client explicitly destroys the compositor overlay window (aka COW),
|
||||
we would leave a dangling pointer to that window in the CompScreen
|
||||
structure, which will trigger a use-after-free later.
|
||||
|
||||
Make sure to clear the CompScreen pointer to the COW when the latter gets
|
||||
destroyed explicitly by the client.
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Reviewed-by: Adam Jackson <ajax@redhat.com>
|
||||
---
|
||||
composite/compwindow.c | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/composite/compwindow.c b/composite/compwindow.c
|
||||
index 4e2494b86..b30da589e 100644
|
||||
--- a/composite/compwindow.c
|
||||
+++ b/composite/compwindow.c
|
||||
@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
|
||||
ret = (*pScreen->DestroyWindow) (pWin);
|
||||
cs->DestroyWindow = pScreen->DestroyWindow;
|
||||
pScreen->DestroyWindow = compDestroyWindow;
|
||||
+
|
||||
+ /* Did we just destroy the overlay window? */
|
||||
+ if (pWin == cs->pOverlayWin)
|
||||
+ cs->pOverlayWin = NULL;
|
||||
+
|
||||
/* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
|
||||
return ret;
|
||||
}
|
||||
--
|
||||
2.40.0
|
||||
|
||||
@ -1,54 +0,0 @@
|
||||
From b5cb27032d3e486ba84a491e1420e85171c4c0a3 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Thu, 14 Dec 2023 11:29:49 +1000
|
||||
Subject: [PATCH xserver 1/9] dix: allocate enough space for logical button
|
||||
maps
|
||||
|
||||
Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for
|
||||
each logical button currently down. Since buttons can be arbitrarily mapped
|
||||
to anything up to 255 make sure we have enough bits for the maximum mapping.
|
||||
|
||||
CVE-2023-6816, ZDI-CAN-22664, ZDI-CAN-22665
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
(cherry picked from commit 9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3)
|
||||
---
|
||||
Xi/xiquerypointer.c | 3 +--
|
||||
dix/enterleave.c | 5 +++--
|
||||
2 files changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c
|
||||
index 5b77b1a44..2b05ac5f3 100644
|
||||
--- a/Xi/xiquerypointer.c
|
||||
+++ b/Xi/xiquerypointer.c
|
||||
@@ -149,8 +149,7 @@ ProcXIQueryPointer(ClientPtr client)
|
||||
if (pDev->button) {
|
||||
int i;
|
||||
|
||||
- rep.buttons_len =
|
||||
- bytes_to_int32(bits_to_bytes(pDev->button->numButtons));
|
||||
+ rep.buttons_len = bytes_to_int32(bits_to_bytes(256)); /* button map up to 255 */
|
||||
rep.length += rep.buttons_len;
|
||||
buttons = calloc(rep.buttons_len, 4);
|
||||
if (!buttons)
|
||||
diff --git a/dix/enterleave.c b/dix/enterleave.c
|
||||
index 867ec7436..ded8679d7 100644
|
||||
--- a/dix/enterleave.c
|
||||
+++ b/dix/enterleave.c
|
||||
@@ -784,8 +784,9 @@ DeviceFocusEvent(DeviceIntPtr dev, int type, int mode, int detail,
|
||||
|
||||
mouse = IsFloating(dev) ? dev : GetMaster(dev, MASTER_POINTER);
|
||||
|
||||
- /* XI 2 event */
|
||||
- btlen = (mouse->button) ? bits_to_bytes(mouse->button->numButtons) : 0;
|
||||
+ /* XI 2 event contains the logical button map - maps are CARD8
|
||||
+ * so we need 256 bits for the possibly maximum mapping */
|
||||
+ btlen = (mouse->button) ? bits_to_bytes(256) : 0;
|
||||
btlen = bytes_to_int32(btlen);
|
||||
len = sizeof(xXIFocusInEvent) + btlen * 4;
|
||||
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -1,37 +0,0 @@
|
||||
From 4c8de123f04e80a1c14c64064ebcec5497d2ec4b Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Mon, 22 Jan 2024 14:22:12 +1000
|
||||
Subject: [PATCH xserver 1/4] dix: fix valuator copy/paste error in the
|
||||
DeviceStateNotify event
|
||||
|
||||
Fixes 219c54b8a3337456ce5270ded6a67bcde53553d5
|
||||
|
||||
(cherry picked from commit 133e0d651c5d12bf01999d6289e84e224ba77adc)
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1452>
|
||||
---
|
||||
dix/enterleave.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/dix/enterleave.c b/dix/enterleave.c
|
||||
index 7b7ba1098..c1e6ac600 100644
|
||||
--- a/dix/enterleave.c
|
||||
+++ b/dix/enterleave.c
|
||||
@@ -619,11 +619,11 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v,
|
||||
ev->first_valuator = first;
|
||||
switch (ev->num_valuators) {
|
||||
case 6:
|
||||
- ev->valuator2 = v->axisVal[first + 5];
|
||||
+ ev->valuator5 = v->axisVal[first + 5];
|
||||
case 5:
|
||||
- ev->valuator2 = v->axisVal[first + 4];
|
||||
+ ev->valuator4 = v->axisVal[first + 4];
|
||||
case 4:
|
||||
- ev->valuator2 = v->axisVal[first + 3];
|
||||
+ ev->valuator3 = v->axisVal[first + 3];
|
||||
case 3:
|
||||
ev->valuator2 = v->axisVal[first + 2];
|
||||
case 2:
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -1,105 +0,0 @@
|
||||
From b98fc07d3442a289c6bef82df50dd0a2d01de71a Mon Sep 17 00:00:00 2001
|
||||
From: Adam Jackson <ajax@redhat.com>
|
||||
Date: Thu, 2 Feb 2023 12:26:27 -0500
|
||||
Subject: [PATCH xserver] present: Send a PresentConfigureNotify event for
|
||||
destroyed windows
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
This enables fixing a deadlock case on the client side, where the client
|
||||
ends up blocked waiting for a Present event that will never come because
|
||||
the window was destroyed. The new PresentWindowDestroyed flag allows the
|
||||
client to avoid blocking indefinitely.
|
||||
|
||||
Signed-off-by: Adam Jackson <ajax@redhat.com>
|
||||
See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/116
|
||||
See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6685
|
||||
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
|
||||
(cherry picked from commit 462b06033e66a32308d940eb5fc47f5e4c914dc0)
|
||||
---
|
||||
present/present_event.c | 5 +++--
|
||||
present/present_priv.h | 7 ++++++-
|
||||
present/present_screen.c | 11 ++++++++++-
|
||||
3 files changed, 19 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/present/present_event.c b/present/present_event.c
|
||||
index 435b26b70..849732dc8 100644
|
||||
--- a/present/present_event.c
|
||||
+++ b/present/present_event.c
|
||||
@@ -102,7 +102,8 @@ present_event_swap(xGenericEvent *from, xGenericEvent *to)
|
||||
}
|
||||
|
||||
void
|
||||
-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling)
|
||||
+present_send_config_notify(WindowPtr window, int x, int y, int w, int h,
|
||||
+ int bw, WindowPtr sibling, CARD32 flags)
|
||||
{
|
||||
present_window_priv_ptr window_priv = present_window_priv(window);
|
||||
|
||||
@@ -122,7 +123,7 @@ present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw,
|
||||
.off_y = 0,
|
||||
.pixmap_width = w,
|
||||
.pixmap_height = h,
|
||||
- .pixmap_flags = 0
|
||||
+ .pixmap_flags = flags
|
||||
};
|
||||
present_event_ptr event;
|
||||
|
||||
diff --git a/present/present_priv.h b/present/present_priv.h
|
||||
index 6ebd009a2..4ad729864 100644
|
||||
--- a/present/present_priv.h
|
||||
+++ b/present/present_priv.h
|
||||
@@ -43,6 +43,11 @@
|
||||
#define DebugPresent(x)
|
||||
#endif
|
||||
|
||||
+/* XXX this belongs in presentproto */
|
||||
+#ifndef PresentWindowDestroyed
|
||||
+#define PresentWindowDestroyed (1 << 0)
|
||||
+#endif
|
||||
+
|
||||
extern int present_request;
|
||||
|
||||
extern DevPrivateKeyRec present_screen_private_key;
|
||||
@@ -307,7 +312,7 @@ void
|
||||
present_free_events(WindowPtr window);
|
||||
|
||||
void
|
||||
-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling);
|
||||
+present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling, CARD32 flags);
|
||||
|
||||
void
|
||||
present_send_complete_notify(WindowPtr window, CARD8 kind, CARD8 mode, CARD32 serial, uint64_t ust, uint64_t msc);
|
||||
diff --git a/present/present_screen.c b/present/present_screen.c
|
||||
index 15684eda4..2c29aafd2 100644
|
||||
--- a/present/present_screen.c
|
||||
+++ b/present/present_screen.c
|
||||
@@ -93,6 +93,15 @@ present_destroy_window(WindowPtr window)
|
||||
present_screen_priv_ptr screen_priv = present_screen_priv(screen);
|
||||
present_window_priv_ptr window_priv = present_window_priv(window);
|
||||
|
||||
+ present_send_config_notify(window,
|
||||
+ window->drawable.x,
|
||||
+ window->drawable.y,
|
||||
+ window->drawable.width,
|
||||
+ window->drawable.height,
|
||||
+ window->borderWidth,
|
||||
+ window->nextSib,
|
||||
+ PresentWindowDestroyed);
|
||||
+
|
||||
if (window_priv) {
|
||||
present_clear_window_notifies(window);
|
||||
present_free_events(window);
|
||||
@@ -123,7 +132,7 @@ present_config_notify(WindowPtr window,
|
||||
ScreenPtr screen = window->drawable.pScreen;
|
||||
present_screen_priv_ptr screen_priv = present_screen_priv(screen);
|
||||
|
||||
- present_send_config_notify(window, x, y, w, h, bw, sibling);
|
||||
+ present_send_config_notify(window, x, y, w, h, bw, sibling, 0);
|
||||
|
||||
unwrap(screen_priv, screen, ConfigNotify);
|
||||
if (screen->ConfigNotify)
|
||||
--
|
||||
2.40.0
|
||||
|
||||
@ -1,61 +0,0 @@
|
||||
From aaf854fb25541380cc38a221c15f0e8372f48872 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Mon, 27 Nov 2023 16:27:49 +1000
|
||||
Subject: [PATCH xserver] randr: avoid integer truncation in length check of
|
||||
ProcRRChange*Property
|
||||
|
||||
Affected are ProcRRChangeProviderProperty and ProcRRChangeOutputProperty.
|
||||
See also xserver@8f454b79 where this same bug was fixed for the core
|
||||
protocol and XI.
|
||||
|
||||
This fixes an OOB read and the resulting information disclosure.
|
||||
|
||||
Length calculation for the request was clipped to a 32-bit integer. With
|
||||
the correct stuff->nUnits value the expected request size was
|
||||
truncated, passing the REQUEST_FIXED_SIZE check.
|
||||
|
||||
The server then proceeded with reading at least stuff->num_items bytes
|
||||
(depending on stuff->format) from the request and stuffing whatever it
|
||||
finds into the property. In the process it would also allocate at least
|
||||
stuff->nUnits bytes, i.e. 4GB.
|
||||
|
||||
CVE-2023-6478, ZDI-CAN-22561
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
(cherry picked from commit 14f480010a93ff962fef66a16412fafff81ad632)
|
||||
---
|
||||
randr/rrproperty.c | 2 +-
|
||||
randr/rrproviderproperty.c | 2 +-
|
||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/randr/rrproperty.c b/randr/rrproperty.c
|
||||
index 25469f57b..c4fef8a1f 100644
|
||||
--- a/randr/rrproperty.c
|
||||
+++ b/randr/rrproperty.c
|
||||
@@ -530,7 +530,7 @@ ProcRRChangeOutputProperty(ClientPtr client)
|
||||
char format, mode;
|
||||
unsigned long len;
|
||||
int sizeInBytes;
|
||||
- int totalSize;
|
||||
+ uint64_t totalSize;
|
||||
int err;
|
||||
|
||||
REQUEST_AT_LEAST_SIZE(xRRChangeOutputPropertyReq);
|
||||
diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c
|
||||
index b79c17f9b..90c5a9a93 100644
|
||||
--- a/randr/rrproviderproperty.c
|
||||
+++ b/randr/rrproviderproperty.c
|
||||
@@ -498,7 +498,7 @@ ProcRRChangeProviderProperty(ClientPtr client)
|
||||
char format, mode;
|
||||
unsigned long len;
|
||||
int sizeInBytes;
|
||||
- int totalSize;
|
||||
+ uint64_t totalSize;
|
||||
int err;
|
||||
|
||||
REQUEST_AT_LEAST_SIZE(xRRChangeProviderPropertyReq);
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -1,35 +0,0 @@
|
||||
From a8644465d98beb08759546711b77bb617861c67f Mon Sep 17 00:00:00 2001
|
||||
From: Povilas Kanapickas <povilas@radix.lt>
|
||||
Date: Tue, 14 Dec 2021 15:00:00 +0200
|
||||
Subject: [PATCH xserver 1/4] record: Fix out of bounds access in
|
||||
SwapCreateRegister()
|
||||
|
||||
ZDI-CAN-14952, CVE-2021-4011
|
||||
|
||||
This vulnerability was discovered and the fix was suggested by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
|
||||
(cherry picked from commit e56f61c79fc3cee26d83cda0f84ae56d5979f768)
|
||||
---
|
||||
record/record.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/record/record.c b/record/record.c
|
||||
index be154525d..e123867a7 100644
|
||||
--- a/record/record.c
|
||||
+++ b/record/record.c
|
||||
@@ -2516,8 +2516,8 @@ SwapCreateRegister(ClientPtr client, xRecordRegisterClientsReq * stuff)
|
||||
swapl(pClientID);
|
||||
}
|
||||
if (stuff->nRanges >
|
||||
- client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
|
||||
- - stuff->nClients)
|
||||
+ (client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
|
||||
+ - stuff->nClients) / bytes_to_int32(sz_xRecordRange))
|
||||
return BadLength;
|
||||
RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges);
|
||||
return Success;
|
||||
--
|
||||
2.33.1
|
||||
|
||||
@ -1,75 +0,0 @@
|
||||
From c3c2218ab797516e4d63a93a078d77c6ce872d03 Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Fri, 5 Apr 2024 15:24:49 +0200
|
||||
Subject: [PATCH xserver] render: Avoid possible double-free in
|
||||
ProcRenderAddGlyphs()
|
||||
|
||||
ProcRenderAddGlyphs() adds the glyph to the glyphset using AddGlyph() and
|
||||
then frees it using FreeGlyph() to decrease the reference count, after
|
||||
AddGlyph() has increased it.
|
||||
|
||||
AddGlyph() however may chose to reuse an existing glyph if it's already
|
||||
in the glyphSet, and free the glyph that was given, in which case the
|
||||
caller function, ProcRenderAddGlyphs() will call FreeGlyph() on an
|
||||
already freed glyph, as reported by ASan:
|
||||
|
||||
READ of size 4 thread T0
|
||||
#0 in FreeGlyph xserver/render/glyph.c:252
|
||||
#1 in ProcRenderAddGlyphs xserver/render/render.c:1174
|
||||
#2 in Dispatch xserver/dix/dispatch.c:546
|
||||
#3 in dix_main xserver/dix/main.c:271
|
||||
#4 in main xserver/dix/stubmain.c:34
|
||||
#5 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
||||
#6 in __libc_start_main_impl ../csu/libc-start.c:360
|
||||
#7 (/usr/bin/Xwayland+0x44fe4)
|
||||
Address is located 0 bytes inside of 64-byte region
|
||||
freed by thread T0 here:
|
||||
#0 in __interceptor_free libsanitizer/asan/asan_malloc_linux.cpp:52
|
||||
#1 in _dixFreeObjectWithPrivates xserver/dix/privates.c:538
|
||||
#2 in AddGlyph xserver/render/glyph.c:295
|
||||
#3 in ProcRenderAddGlyphs xserver/render/render.c:1173
|
||||
#4 in Dispatch xserver/dix/dispatch.c:546
|
||||
#5 in dix_main xserver/dix/main.c:271
|
||||
#6 in main xserver/dix/stubmain.c:34
|
||||
#7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
||||
previously allocated by thread T0 here:
|
||||
#0 in __interceptor_malloc libsanitizer/asan/asan_malloc_linux.cpp:69
|
||||
#1 in AllocateGlyph xserver/render/glyph.c:355
|
||||
#2 in ProcRenderAddGlyphs xserver/render/render.c:1085
|
||||
#3 in Dispatch xserver/dix/dispatch.c:546
|
||||
#4 in dix_main xserver/dix/main.c:271
|
||||
#5 in main xserver/dix/stubmain.c:34
|
||||
#6 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
||||
SUMMARY: AddressSanitizer: heap-use-after-free xserver/render/glyph.c:252 in FreeGlyph
|
||||
|
||||
To avoid that, make sure not to free the given glyph in AddGlyph().
|
||||
|
||||
v2: Simplify the test using the boolean returned from AddGlyph() (Michel)
|
||||
v3: Simplify even more by not freeing the glyph in AddGlyph() (Peter)
|
||||
|
||||
Fixes: bdca6c3d1 - render: fix refcounting of glyphs during ProcRenderAddGlyphs
|
||||
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1659
|
||||
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
(cherry picked from commit 337d8d48b618d4fc0168a7b978be4c3447650b04)
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1478>
|
||||
---
|
||||
render/glyph.c | 2 --
|
||||
1 file changed, 2 deletions(-)
|
||||
|
||||
diff --git a/render/glyph.c b/render/glyph.c
|
||||
index d5fc5f3c9..f5069d42f 100644
|
||||
--- a/render/glyph.c
|
||||
+++ b/render/glyph.c
|
||||
@@ -291,8 +291,6 @@ AddGlyph(GlyphSetPtr glyphSet, GlyphPtr glyph, Glyph id)
|
||||
gr = FindGlyphRef(&globalGlyphs[glyphSet->fdepth], signature,
|
||||
TRUE, glyph->sha1);
|
||||
if (gr->glyph && gr->glyph != DeletedGlyph && gr->glyph != glyph) {
|
||||
- FreeGlyphPicture(glyph);
|
||||
- dixFreeObjectWithPrivates(glyph, PRIVATE_GLYPH);
|
||||
glyph = gr->glyph;
|
||||
}
|
||||
else if (gr->glyph != glyph) {
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -1,57 +0,0 @@
|
||||
From 26120df7aae6b5bf8086fb4d871d3b1a07ddacdb Mon Sep 17 00:00:00 2001
|
||||
From: Matthieu Herrb <matthieu@herrb.eu>
|
||||
Date: Thu, 10 Oct 2024 10:37:28 +0200
|
||||
Subject: [PATCH xserver] xkb: Fix buffer overflow in _XkbSetCompatMap()
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
|
||||
buffer.
|
||||
|
||||
However, It didn't update its size properly. It updated `num_si` only,
|
||||
without updating `size_si`.
|
||||
|
||||
This may lead to local privilege escalation if the server is run as root
|
||||
or remote code execution (e.g. x11 over ssh).
|
||||
|
||||
CVE-2024-9632, ZDI-CAN-24756
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Reviewed-by: José Expósito <jexposit@redhat.com>
|
||||
(cherry picked from commit 85b776571487f52e756f68a069c768757369bfe3)
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1735>
|
||||
---
|
||||
xkb/xkb.c | 8 ++++----
|
||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/xkb/xkb.c b/xkb/xkb.c
|
||||
index 8d52e25df..8b63e34b5 100644
|
||||
--- a/xkb/xkb.c
|
||||
+++ b/xkb/xkb.c
|
||||
@@ -2990,13 +2990,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
|
||||
XkbSymInterpretPtr sym;
|
||||
unsigned int skipped = 0;
|
||||
|
||||
- if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) {
|
||||
- compat->num_si = req->firstSI + req->nSI;
|
||||
+ if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
|
||||
+ compat->num_si = compat->size_si = req->firstSI + req->nSI;
|
||||
compat->sym_interpret = reallocarray(compat->sym_interpret,
|
||||
- compat->num_si,
|
||||
+ compat->size_si,
|
||||
sizeof(XkbSymInterpretRec));
|
||||
if (!compat->sym_interpret) {
|
||||
- compat->num_si = 0;
|
||||
+ compat->num_si = compat->size_si = 0;
|
||||
return BadAlloc;
|
||||
}
|
||||
}
|
||||
--
|
||||
2.47.0
|
||||
|
||||
@ -1,59 +0,0 @@
|
||||
From 18f91b950e22c2a342a4fbc55e9ddf7534a707d2 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Wed, 13 Jul 2022 11:23:09 +1000
|
||||
Subject: [PATCH xserver] xkb: fix some possible memleaks in XkbGetKbdByName
|
||||
|
||||
GetComponentByName returns an allocated string, so let's free that if we
|
||||
fail somewhere.
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
---
|
||||
xkb/xkb.c | 26 ++++++++++++++++++++------
|
||||
1 file changed, 20 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/xkb/xkb.c b/xkb/xkb.c
|
||||
index 4692895db..b79a269e3 100644
|
||||
--- a/xkb/xkb.c
|
||||
+++ b/xkb/xkb.c
|
||||
@@ -5935,18 +5935,32 @@ ProcXkbGetKbdByName(ClientPtr client)
|
||||
xkb = dev->key->xkbInfo->desc;
|
||||
status = Success;
|
||||
str = (unsigned char *) &stuff[1];
|
||||
- if (GetComponentSpec(&str, TRUE, &status)) /* keymap, unsupported */
|
||||
- return BadMatch;
|
||||
+ {
|
||||
+ char *keymap = GetComponentSpec(&str, TRUE, &status); /* keymap, unsupported */
|
||||
+ if (keymap) {
|
||||
+ free(keymap);
|
||||
+ return BadMatch;
|
||||
+ }
|
||||
+ }
|
||||
names.keycodes = GetComponentSpec(&str, TRUE, &status);
|
||||
names.types = GetComponentSpec(&str, TRUE, &status);
|
||||
names.compat = GetComponentSpec(&str, TRUE, &status);
|
||||
names.symbols = GetComponentSpec(&str, TRUE, &status);
|
||||
names.geometry = GetComponentSpec(&str, TRUE, &status);
|
||||
- if (status != Success)
|
||||
+ if (status == Success) {
|
||||
+ len = str - ((unsigned char *) stuff);
|
||||
+ if ((XkbPaddedSize(len) / 4) != stuff->length)
|
||||
+ status = BadLength;
|
||||
+ }
|
||||
+
|
||||
+ if (status != Success) {
|
||||
+ free(names.keycodes);
|
||||
+ free(names.types);
|
||||
+ free(names.compat);
|
||||
+ free(names.symbols);
|
||||
+ free(names.geometry);
|
||||
return status;
|
||||
- len = str - ((unsigned char *) stuff);
|
||||
- if ((XkbPaddedSize(len) / 4) != stuff->length)
|
||||
- return BadLength;
|
||||
+ }
|
||||
|
||||
CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask);
|
||||
CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask);
|
||||
--
|
||||
2.38.1
|
||||
|
||||
@ -1,35 +0,0 @@
|
||||
From 11beef0b7f1ed290348e45618e5fa0d2bffcb72e Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 5 Jul 2022 12:06:20 +1000
|
||||
Subject: [PATCH xserver] xkb: proof GetCountedString against request length
|
||||
attacks
|
||||
|
||||
GetCountedString did a check for the whole string to be within the
|
||||
request buffer but not for the initial 2 bytes that contain the length
|
||||
field. A swapped client could send a malformed request to trigger a
|
||||
swaps() on those bytes, writing into random memory.
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
---
|
||||
xkb/xkb.c | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/xkb/xkb.c b/xkb/xkb.c
|
||||
index f42f59ef3..1841cff26 100644
|
||||
--- a/xkb/xkb.c
|
||||
+++ b/xkb/xkb.c
|
||||
@@ -5137,6 +5137,11 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str)
|
||||
CARD16 len;
|
||||
|
||||
wire = *wire_inout;
|
||||
+
|
||||
+ if (client->req_len <
|
||||
+ bytes_to_int32(wire + 2 - (char *) client->requestBuffer))
|
||||
+ return BadValue;
|
||||
+
|
||||
len = *(CARD16 *) wire;
|
||||
if (client->swapped) {
|
||||
swaps(&len);
|
||||
--
|
||||
2.38.1
|
||||
|
||||
@ -1,77 +0,0 @@
|
||||
From c9b379ec5a1a34692af06056925bd0fc5f809713 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 5 Jul 2022 12:40:47 +1000
|
||||
Subject: [PATCH xserver 1/3] xkb: switch to array index loops to moving
|
||||
pointers
|
||||
|
||||
Most similar loops here use a pointer that advances with each loop
|
||||
iteration, let's do the same here for consistency.
|
||||
|
||||
No functional changes.
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
(cherry picked from commit f1070c01d616c5f21f939d5ebc533738779451ac)
|
||||
---
|
||||
xkb/xkb.c | 20 ++++++++++----------
|
||||
1 file changed, 10 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/xkb/xkb.c b/xkb/xkb.c
|
||||
index d056c698c..684394d77 100644
|
||||
--- a/xkb/xkb.c
|
||||
+++ b/xkb/xkb.c
|
||||
@@ -5372,16 +5372,16 @@ _CheckSetSections(XkbGeometryPtr geom,
|
||||
row->left = rWire->left;
|
||||
row->vertical = rWire->vertical;
|
||||
kWire = (xkbKeyWireDesc *) &rWire[1];
|
||||
- for (k = 0; k < rWire->nKeys; k++) {
|
||||
+ for (k = 0; k < rWire->nKeys; k++, kWire++) {
|
||||
XkbKeyPtr key;
|
||||
|
||||
key = XkbAddGeomKey(row);
|
||||
if (!key)
|
||||
return BadAlloc;
|
||||
- memcpy(key->name.name, kWire[k].name, XkbKeyNameLength);
|
||||
- key->gap = kWire[k].gap;
|
||||
- key->shape_ndx = kWire[k].shapeNdx;
|
||||
- key->color_ndx = kWire[k].colorNdx;
|
||||
+ memcpy(key->name.name, kWire->name, XkbKeyNameLength);
|
||||
+ key->gap = kWire->gap;
|
||||
+ key->shape_ndx = kWire->shapeNdx;
|
||||
+ key->color_ndx = kWire->colorNdx;
|
||||
if (key->shape_ndx >= geom->num_shapes) {
|
||||
client->errorValue = _XkbErrCode3(0x10, key->shape_ndx,
|
||||
geom->num_shapes);
|
||||
@@ -5393,7 +5393,7 @@ _CheckSetSections(XkbGeometryPtr geom,
|
||||
return BadMatch;
|
||||
}
|
||||
}
|
||||
- rWire = (xkbRowWireDesc *) &kWire[rWire->nKeys];
|
||||
+ rWire = (xkbRowWireDesc *)kWire;
|
||||
}
|
||||
wire = (char *) rWire;
|
||||
if (sWire->nDoodads > 0) {
|
||||
@@ -5458,16 +5458,16 @@ _CheckSetShapes(XkbGeometryPtr geom,
|
||||
return BadAlloc;
|
||||
ol->corner_radius = olWire->cornerRadius;
|
||||
ptWire = (xkbPointWireDesc *) &olWire[1];
|
||||
- for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++) {
|
||||
- pt->x = ptWire[p].x;
|
||||
- pt->y = ptWire[p].y;
|
||||
+ for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++, ptWire++) {
|
||||
+ pt->x = ptWire->x;
|
||||
+ pt->y = ptWire->y;
|
||||
if (client->swapped) {
|
||||
swaps(&pt->x);
|
||||
swaps(&pt->y);
|
||||
}
|
||||
}
|
||||
ol->num_points = olWire->nPoints;
|
||||
- olWire = (xkbOutlineWireDesc *) (&ptWire[olWire->nPoints]);
|
||||
+ olWire = (xkbOutlineWireDesc *)ptWire;
|
||||
}
|
||||
if (shapeWire->primaryNdx != XkbNoShape)
|
||||
shape->primary = &shape->outlines[shapeWire->primaryNdx];
|
||||
--
|
||||
2.36.1
|
||||
|
||||
@ -1,43 +0,0 @@
|
||||
From 0a7ed9ff7ea20f7b958a2ad9f9bd045080a3ad9a Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Mon, 15 Nov 2021 16:02:34 +0100
|
||||
Subject: [PATCH xserver 1/4] xwayland/eglstream: Demote EGLstream device
|
||||
warning
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
If no EGLstream capable device is found at startup, Xwayland's EGLstream
|
||||
backend will log an error message "glamor: No eglstream capable devices
|
||||
found".
|
||||
|
||||
However, considering that the vast majority of drivers do not implement
|
||||
EGLstream, the lack of EGLstream capable device is more of the norm than
|
||||
the exception.
|
||||
|
||||
Change the error message to a log verbose message.
|
||||
|
||||
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Reviewed-by: Simon Ser <contact@emersion.fr>
|
||||
Reviewed-by: Jonas Ådahl <jadahl@gmail.com>
|
||||
(cherry picked from commit 96c82befa2c3f3dc3534743c67cc003c2106e9b0)
|
||||
---
|
||||
hw/xwayland/xwayland-glamor-eglstream.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/hw/xwayland/xwayland-glamor-eglstream.c b/hw/xwayland/xwayland-glamor-eglstream.c
|
||||
index 8d18caaf5..93d192d58 100644
|
||||
--- a/hw/xwayland/xwayland-glamor-eglstream.c
|
||||
+++ b/hw/xwayland/xwayland-glamor-eglstream.c
|
||||
@@ -1144,7 +1144,7 @@ xwl_eglstream_get_device(struct xwl_screen *xwl_screen)
|
||||
free(devices);
|
||||
out:
|
||||
if (!device)
|
||||
- ErrorF("glamor: No eglstream capable devices found\n");
|
||||
+ LogMessageVerb(X_INFO, 3, "glamor: No eglstream capable devices found\n");
|
||||
return device;
|
||||
}
|
||||
|
||||
--
|
||||
2.33.1
|
||||
|
||||
@ -1,47 +0,0 @@
|
||||
From bd16cc8368afc6959bebfb2b15cfdb93bcac6fee Mon Sep 17 00:00:00 2001
|
||||
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||||
Date: Fri, 22 Mar 2024 18:51:45 -0700
|
||||
Subject: [PATCH xserver 2/4] Xi: ProcXIGetSelectedEvents needs to use
|
||||
unswapped length to send reply
|
||||
|
||||
CVE-2024-31080
|
||||
|
||||
Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762
|
||||
Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.")
|
||||
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||||
(cherry picked from commit 96798fc1967491c80a4d0c8d9e0a80586cb2152b)
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1464>
|
||||
---
|
||||
Xi/xiselectev.c | 5 ++++-
|
||||
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
|
||||
index edcb8a0d3..ac1494987 100644
|
||||
--- a/Xi/xiselectev.c
|
||||
+++ b/Xi/xiselectev.c
|
||||
@@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client)
|
||||
InputClientsPtr others = NULL;
|
||||
xXIEventMask *evmask = NULL;
|
||||
DeviceIntPtr dev;
|
||||
+ uint32_t length;
|
||||
|
||||
REQUEST(xXIGetSelectedEventsReq);
|
||||
REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq);
|
||||
@@ -418,10 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client)
|
||||
}
|
||||
}
|
||||
|
||||
+ /* save the value before SRepXIGetSelectedEvents swaps it */
|
||||
+ length = reply.length;
|
||||
WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
|
||||
|
||||
if (reply.num_masks)
|
||||
- WriteToClient(client, reply.length * 4, buffer);
|
||||
+ WriteToClient(client, length * 4, buffer);
|
||||
|
||||
free(buffer);
|
||||
return Success;
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -1,40 +0,0 @@
|
||||
From c5ff57676698f19ed3a1402aef58a15552e32d27 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 29 Nov 2022 13:24:00 +1000
|
||||
Subject: [PATCH xserver 2/7] Xi: return an error from XI property changes if
|
||||
verification failed
|
||||
|
||||
Both ProcXChangeDeviceProperty and ProcXIChangeProperty checked the
|
||||
property for validity but didn't actually return the potential error.
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
---
|
||||
Xi/xiproperty.c | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
|
||||
index a36f7d61df..68c362c628 100644
|
||||
--- a/Xi/xiproperty.c
|
||||
+++ b/Xi/xiproperty.c
|
||||
@@ -902,6 +902,8 @@ ProcXChangeDeviceProperty(ClientPtr client)
|
||||
|
||||
rc = check_change_property(client, stuff->property, stuff->type,
|
||||
stuff->format, stuff->mode, stuff->nUnits);
|
||||
+ if (rc != Success)
|
||||
+ return rc;
|
||||
|
||||
len = stuff->nUnits;
|
||||
if (len > (bytes_to_int32(0xffffffff - sizeof(xChangeDevicePropertyReq))))
|
||||
@@ -1141,6 +1143,9 @@ ProcXIChangeProperty(ClientPtr client)
|
||||
|
||||
rc = check_change_property(client, stuff->property, stuff->type,
|
||||
stuff->format, stuff->mode, stuff->num_items);
|
||||
+ if (rc != Success)
|
||||
+ return rc;
|
||||
+
|
||||
len = stuff->num_items;
|
||||
if (len > bytes_to_int32(0xffffffff - sizeof(xXIChangePropertyReq)))
|
||||
return BadLength;
|
||||
--
|
||||
2.38.1
|
||||
@ -1,86 +0,0 @@
|
||||
From 9105be1c51d6973dc8d7806108349bc152029ec5 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Mon, 18 Dec 2023 14:27:50 +1000
|
||||
Subject: [PATCH xserver 2/9] dix: Allocate sufficient xEvents for our
|
||||
DeviceStateNotify
|
||||
|
||||
If a device has both a button class and a key class and numButtons is
|
||||
zero, we can get an OOB write due to event under-allocation.
|
||||
|
||||
This function seems to assume a device has either keys or buttons, not
|
||||
both. It has two virtually identical code paths, both of which assume
|
||||
they're applying to the first event in the sequence.
|
||||
|
||||
A device with both a key and button class triggered a logic bug - only
|
||||
one xEvent was allocated but the deviceStateNotify pointer was pushed on
|
||||
once per type. So effectively this logic code:
|
||||
|
||||
int count = 1;
|
||||
if (button && nbuttons > 32) count++;
|
||||
if (key && nbuttons > 0) count++;
|
||||
if (key && nkeys > 32) count++; // this is basically always true
|
||||
// count is at 2 for our keys + zero button device
|
||||
|
||||
ev = alloc(count * sizeof(xEvent));
|
||||
FixDeviceStateNotify(ev);
|
||||
if (button)
|
||||
FixDeviceStateNotify(ev++);
|
||||
if (key)
|
||||
FixDeviceStateNotify(ev++); // santa drops into the wrong chimney here
|
||||
|
||||
If the device has more than 3 valuators, the OOB is pushed back - we're
|
||||
off by one so it will happen when the last deviceValuator event is
|
||||
written instead.
|
||||
|
||||
Fix this by allocating the maximum number of events we may allocate.
|
||||
Note that the current behavior is not protocol-correct anyway, this
|
||||
patch fixes only the allocation issue.
|
||||
|
||||
Note that this issue does not trigger if the device has at least one
|
||||
button. While the server does not prevent a button class with zero
|
||||
buttons, it is very unlikely.
|
||||
|
||||
CVE-2024-0229, ZDI-CAN-22678
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
(cherry picked from commit ece23be888a93b741aa1209d1dbf64636109d6a5)
|
||||
---
|
||||
dix/enterleave.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/dix/enterleave.c b/dix/enterleave.c
|
||||
index ded8679d7..17964b00a 100644
|
||||
--- a/dix/enterleave.c
|
||||
+++ b/dix/enterleave.c
|
||||
@@ -675,7 +675,8 @@ static void
|
||||
DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
|
||||
{
|
||||
int evcount = 1;
|
||||
- deviceStateNotify *ev, *sev;
|
||||
+ deviceStateNotify sev[6 + (MAX_VALUATORS + 2)/3];
|
||||
+ deviceStateNotify *ev;
|
||||
deviceKeyStateNotify *kev;
|
||||
deviceButtonStateNotify *bev;
|
||||
|
||||
@@ -714,7 +715,7 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
|
||||
}
|
||||
}
|
||||
|
||||
- sev = ev = xallocarray(evcount, sizeof(xEvent));
|
||||
+ ev = sev;
|
||||
FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first);
|
||||
|
||||
if (b != NULL) {
|
||||
@@ -770,7 +771,6 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
|
||||
|
||||
DeliverEventsToWindow(dev, win, (xEvent *) sev, evcount,
|
||||
DeviceStateNotifyMask, NullGrab);
|
||||
- free(sev);
|
||||
}
|
||||
|
||||
void
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -1,44 +0,0 @@
|
||||
From 3eb5445f6f7fa9f86de87adc768105d42bdbcf74 Mon Sep 17 00:00:00 2001
|
||||
From: Povilas Kanapickas <povilas@radix.lt>
|
||||
Date: Tue, 14 Dec 2021 15:00:01 +0200
|
||||
Subject: [PATCH xserver 2/4] xfixes: Fix out of bounds access in
|
||||
*ProcXFixesCreatePointerBarrier()
|
||||
|
||||
ZDI-CAN-14950, CVE-2021-4009
|
||||
|
||||
This vulnerability was discovered and the fix was suggested by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
|
||||
(cherry picked from commit b5196750099ae6ae582e1f46bd0a6dad29550e02)
|
||||
---
|
||||
xfixes/cursor.c | 6 ++++--
|
||||
1 file changed, 4 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/xfixes/cursor.c b/xfixes/cursor.c
|
||||
index 60580b88f..c5d4554b2 100644
|
||||
--- a/xfixes/cursor.c
|
||||
+++ b/xfixes/cursor.c
|
||||
@@ -1010,7 +1010,8 @@ ProcXFixesCreatePointerBarrier(ClientPtr client)
|
||||
{
|
||||
REQUEST(xXFixesCreatePointerBarrierReq);
|
||||
|
||||
- REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
|
||||
+ REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
|
||||
+ pad_to_int32(stuff->num_devices * sizeof(CARD16)));
|
||||
LEGAL_NEW_RESOURCE(stuff->barrier, client);
|
||||
|
||||
return XICreatePointerBarrier(client, stuff);
|
||||
@@ -1027,7 +1028,8 @@ SProcXFixesCreatePointerBarrier(ClientPtr client)
|
||||
|
||||
swaps(&stuff->length);
|
||||
swaps(&stuff->num_devices);
|
||||
- REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
|
||||
+ REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
|
||||
+ pad_to_int32(stuff->num_devices * sizeof(CARD16)));
|
||||
|
||||
swapl(&stuff->barrier);
|
||||
swapl(&stuff->window);
|
||||
--
|
||||
2.33.1
|
||||
|
||||
@ -1,180 +0,0 @@
|
||||
From 45a0af83129eb7dc244c5118360afc1972a686c7 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 5 Jul 2022 09:50:41 +1000
|
||||
Subject: [PATCH xserver 2/3] xkb: swap XkbSetDeviceInfo and
|
||||
XkbSetDeviceInfoCheck
|
||||
|
||||
XKB often uses a FooCheck and Foo function pair, the former is supposed
|
||||
to check all values in the request and error out on BadLength,
|
||||
BadValue, etc. The latter is then called once we're confident the values
|
||||
are good (they may still fail on an individual device, but that's a
|
||||
different topic).
|
||||
|
||||
In the case of XkbSetDeviceInfo, those functions were incorrectly
|
||||
named, with XkbSetDeviceInfo ending up as the checker function and
|
||||
XkbSetDeviceInfoCheck as the setter function. As a result, the setter
|
||||
function was called before the checker function, accessing request
|
||||
data and modifying device state before we ensured that the data is
|
||||
valid.
|
||||
|
||||
In particular, the setter function relied on values being already
|
||||
byte-swapped. This in turn could lead to potential OOB memory access.
|
||||
|
||||
Fix this by correctly naming the functions and moving the length checks
|
||||
over to the checker function. These were added in 87c64fc5b0 to the
|
||||
wrong function, probably due to the incorrect naming.
|
||||
|
||||
Fixes ZDI-CAN 16070, CVE-2022-2320.
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Introduced in c06e27b2f6fd9f7b9f827623a48876a225264132
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
(cherry picked from commit dd8caf39e9e15d8f302e54045dd08d8ebf1025dc)
|
||||
---
|
||||
xkb/xkb.c | 46 +++++++++++++++++++++++++---------------------
|
||||
1 file changed, 25 insertions(+), 21 deletions(-)
|
||||
|
||||
diff --git a/xkb/xkb.c b/xkb/xkb.c
|
||||
index 684394d77..36464a770 100644
|
||||
--- a/xkb/xkb.c
|
||||
+++ b/xkb/xkb.c
|
||||
@@ -6554,7 +6554,8 @@ ProcXkbGetDeviceInfo(ClientPtr client)
|
||||
static char *
|
||||
CheckSetDeviceIndicators(char *wire,
|
||||
DeviceIntPtr dev,
|
||||
- int num, int *status_rtrn, ClientPtr client)
|
||||
+ int num, int *status_rtrn, ClientPtr client,
|
||||
+ xkbSetDeviceInfoReq * stuff)
|
||||
{
|
||||
xkbDeviceLedsWireDesc *ledWire;
|
||||
int i;
|
||||
@@ -6562,6 +6563,11 @@ CheckSetDeviceIndicators(char *wire,
|
||||
|
||||
ledWire = (xkbDeviceLedsWireDesc *) wire;
|
||||
for (i = 0; i < num; i++) {
|
||||
+ if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) {
|
||||
+ *status_rtrn = BadLength;
|
||||
+ return (char *) ledWire;
|
||||
+ }
|
||||
+
|
||||
if (client->swapped) {
|
||||
swaps(&ledWire->ledClass);
|
||||
swaps(&ledWire->ledID);
|
||||
@@ -6589,6 +6595,11 @@ CheckSetDeviceIndicators(char *wire,
|
||||
atomWire = (CARD32 *) &ledWire[1];
|
||||
if (nNames > 0) {
|
||||
for (n = 0; n < nNames; n++) {
|
||||
+ if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) {
|
||||
+ *status_rtrn = BadLength;
|
||||
+ return (char *) atomWire;
|
||||
+ }
|
||||
+
|
||||
if (client->swapped) {
|
||||
swapl(atomWire);
|
||||
}
|
||||
@@ -6600,6 +6611,10 @@ CheckSetDeviceIndicators(char *wire,
|
||||
mapWire = (xkbIndicatorMapWireDesc *) atomWire;
|
||||
if (nMaps > 0) {
|
||||
for (n = 0; n < nMaps; n++) {
|
||||
+ if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) {
|
||||
+ *status_rtrn = BadLength;
|
||||
+ return (char *) mapWire;
|
||||
+ }
|
||||
if (client->swapped) {
|
||||
swaps(&mapWire->virtualMods);
|
||||
swapl(&mapWire->ctrls);
|
||||
@@ -6651,11 +6666,6 @@ SetDeviceIndicators(char *wire,
|
||||
xkbIndicatorMapWireDesc *mapWire;
|
||||
XkbSrvLedInfoPtr sli;
|
||||
|
||||
- if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) {
|
||||
- *status_rtrn = BadLength;
|
||||
- return (char *) ledWire;
|
||||
- }
|
||||
-
|
||||
namec = mapc = statec = 0;
|
||||
sli = XkbFindSrvLedInfo(dev, ledWire->ledClass, ledWire->ledID,
|
||||
XkbXI_IndicatorMapsMask);
|
||||
@@ -6674,10 +6684,6 @@ SetDeviceIndicators(char *wire,
|
||||
memset((char *) sli->names, 0, XkbNumIndicators * sizeof(Atom));
|
||||
for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) {
|
||||
if (ledWire->namesPresent & bit) {
|
||||
- if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) {
|
||||
- *status_rtrn = BadLength;
|
||||
- return (char *) atomWire;
|
||||
- }
|
||||
sli->names[n] = (Atom) *atomWire;
|
||||
if (sli->names[n] == None)
|
||||
ledWire->namesPresent &= ~bit;
|
||||
@@ -6695,10 +6701,6 @@ SetDeviceIndicators(char *wire,
|
||||
if (ledWire->mapsPresent) {
|
||||
for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) {
|
||||
if (ledWire->mapsPresent & bit) {
|
||||
- if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) {
|
||||
- *status_rtrn = BadLength;
|
||||
- return (char *) mapWire;
|
||||
- }
|
||||
sli->maps[n].flags = mapWire->flags;
|
||||
sli->maps[n].which_groups = mapWire->whichGroups;
|
||||
sli->maps[n].groups = mapWire->groups;
|
||||
@@ -6734,13 +6736,17 @@ SetDeviceIndicators(char *wire,
|
||||
}
|
||||
|
||||
static int
|
||||
-_XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
|
||||
+_XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev,
|
||||
xkbSetDeviceInfoReq * stuff)
|
||||
{
|
||||
char *wire;
|
||||
|
||||
wire = (char *) &stuff[1];
|
||||
if (stuff->change & XkbXI_ButtonActionsMask) {
|
||||
+ int sz = stuff->nBtns * SIZEOF(xkbActionWireDesc);
|
||||
+ if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz))
|
||||
+ return BadLength;
|
||||
+
|
||||
if (!dev->button) {
|
||||
client->errorValue = _XkbErrCode2(XkbErr_BadClass, ButtonClass);
|
||||
return XkbKeyboardErrorCode;
|
||||
@@ -6751,13 +6757,13 @@ _XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
|
||||
dev->button->numButtons);
|
||||
return BadMatch;
|
||||
}
|
||||
- wire += (stuff->nBtns * SIZEOF(xkbActionWireDesc));
|
||||
+ wire += sz;
|
||||
}
|
||||
if (stuff->change & XkbXI_IndicatorsMask) {
|
||||
int status = Success;
|
||||
|
||||
wire = CheckSetDeviceIndicators(wire, dev, stuff->nDeviceLedFBs,
|
||||
- &status, client);
|
||||
+ &status, client, stuff);
|
||||
if (status != Success)
|
||||
return status;
|
||||
}
|
||||
@@ -6768,8 +6774,8 @@ _XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
|
||||
}
|
||||
|
||||
static int
|
||||
-_XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev,
|
||||
- xkbSetDeviceInfoReq * stuff)
|
||||
+_XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
|
||||
+ xkbSetDeviceInfoReq * stuff)
|
||||
{
|
||||
char *wire;
|
||||
xkbExtensionDeviceNotify ed;
|
||||
@@ -6793,8 +6799,6 @@ _XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev,
|
||||
if (stuff->firstBtn + stuff->nBtns > nBtns)
|
||||
return BadValue;
|
||||
sz = stuff->nBtns * SIZEOF(xkbActionWireDesc);
|
||||
- if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz))
|
||||
- return BadLength;
|
||||
memcpy((char *) &acts[stuff->firstBtn], (char *) wire, sz);
|
||||
wire += sz;
|
||||
ed.reason |= XkbXI_ButtonActionsMask;
|
||||
--
|
||||
2.36.1
|
||||
|
||||
@ -1,88 +0,0 @@
|
||||
From a515f4f4336efb8a2adf9a3ac141129708297d80 Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Mon, 29 Nov 2021 11:45:35 +0100
|
||||
Subject: [PATCH xserver 2/4] xwayland/glamor: Change errors to verbose
|
||||
messages
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
On a normal startup sequence, the Xwayland glamor backend would log
|
||||
an error whenever a required Wayland protocol is missing.
|
||||
|
||||
Those are not really errors though, more informational messages along
|
||||
the glamor backend selection process.
|
||||
|
||||
Demote those errors to verbose messages to reduce the verbosity of
|
||||
Xwayland at startup by default.
|
||||
|
||||
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Reviewed-by: Jonas Ådahl <jadahl@gmail.com>
|
||||
(cherry picked from commit 30d0d4a19be61dd7b61f5ced992cb299e6a38068)
|
||||
---
|
||||
hw/xwayland/xwayland-glamor-eglstream.c | 6 ++++--
|
||||
hw/xwayland/xwayland-glamor-gbm.c | 2 +-
|
||||
hw/xwayland/xwayland-glamor.c | 6 ++++--
|
||||
3 files changed, 9 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/hw/xwayland/xwayland-glamor-eglstream.c b/hw/xwayland/xwayland-glamor-eglstream.c
|
||||
index 93d192d58..5a20b452f 100644
|
||||
--- a/hw/xwayland/xwayland-glamor-eglstream.c
|
||||
+++ b/hw/xwayland/xwayland-glamor-eglstream.c
|
||||
@@ -753,12 +753,14 @@ xwl_glamor_eglstream_has_wl_interfaces(struct xwl_screen *xwl_screen)
|
||||
xwl_eglstream_get(xwl_screen);
|
||||
|
||||
if (xwl_eglstream->display == NULL) {
|
||||
- ErrorF("glamor: 'wl_eglstream_display' not supported\n");
|
||||
+ LogMessageVerb(X_INFO, 3,
|
||||
+ "glamor: 'wl_eglstream_display' not supported\n");
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
if (xwl_eglstream->controller == NULL) {
|
||||
- ErrorF("glamor: 'wl_eglstream_controller' not supported\n");
|
||||
+ LogMessageVerb(X_INFO, 3,
|
||||
+ "glamor: 'wl_eglstream_controller' not supported\n");
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
diff --git a/hw/xwayland/xwayland-glamor-gbm.c b/hw/xwayland/xwayland-glamor-gbm.c
|
||||
index 466a1b052..e06b6f54b 100644
|
||||
--- a/hw/xwayland/xwayland-glamor-gbm.c
|
||||
+++ b/hw/xwayland/xwayland-glamor-gbm.c
|
||||
@@ -835,7 +835,7 @@ xwl_glamor_gbm_has_wl_interfaces(struct xwl_screen *xwl_screen)
|
||||
struct xwl_gbm_private *xwl_gbm = xwl_gbm_get(xwl_screen);
|
||||
|
||||
if (xwl_gbm->drm == NULL) {
|
||||
- ErrorF("glamor: 'wl_drm' not supported\n");
|
||||
+ LogMessageVerb(X_INFO, 3, "glamor: 'wl_drm' not supported\n");
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
diff --git a/hw/xwayland/xwayland-glamor.c b/hw/xwayland/xwayland-glamor.c
|
||||
index deb398f91..541d5e923 100644
|
||||
--- a/hw/xwayland/xwayland-glamor.c
|
||||
+++ b/hw/xwayland/xwayland-glamor.c
|
||||
@@ -412,7 +412,8 @@ xwl_glamor_select_gbm_backend(struct xwl_screen *xwl_screen)
|
||||
return TRUE;
|
||||
}
|
||||
else
|
||||
- ErrorF("Missing Wayland requirements for glamor GBM backend\n");
|
||||
+ LogMessageVerb(X_INFO, 3,
|
||||
+ "Missing Wayland requirements for glamor GBM backend\n");
|
||||
#endif
|
||||
|
||||
return FALSE;
|
||||
@@ -428,7 +429,8 @@ xwl_glamor_select_eglstream_backend(struct xwl_screen *xwl_screen)
|
||||
return TRUE;
|
||||
}
|
||||
else
|
||||
- ErrorF("Missing Wayland requirements for glamor EGLStream backend\n");
|
||||
+ LogMessageVerb(X_INFO, 3,
|
||||
+ "Missing Wayland requirements for glamor EGLStream backend\n");
|
||||
#endif
|
||||
|
||||
return FALSE;
|
||||
--
|
||||
2.33.1
|
||||
|
||||
@ -1,34 +0,0 @@
|
||||
From fe0c050276c09f43cc1ae80b4553db42398ca84c Mon Sep 17 00:00:00 2001
|
||||
From: Povilas Kanapickas <povilas@radix.lt>
|
||||
Date: Tue, 14 Dec 2021 15:00:02 +0200
|
||||
Subject: [PATCH xserver 3/4] Xext: Fix out of bounds access in
|
||||
SProcScreenSaverSuspend()
|
||||
|
||||
ZDI-CAN-14951, CVE-2021-4010
|
||||
|
||||
This vulnerability was discovered and the fix was suggested by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
|
||||
(cherry picked from commit 6c4c53010772e3cb4cb8acd54950c8eec9c00d21)
|
||||
---
|
||||
Xext/saver.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Xext/saver.c b/Xext/saver.c
|
||||
index 1d7e3cadf..f813ba08d 100644
|
||||
--- a/Xext/saver.c
|
||||
+++ b/Xext/saver.c
|
||||
@@ -1351,8 +1351,8 @@ SProcScreenSaverSuspend(ClientPtr client)
|
||||
REQUEST(xScreenSaverSuspendReq);
|
||||
|
||||
swaps(&stuff->length);
|
||||
- swapl(&stuff->suspend);
|
||||
REQUEST_SIZE_MATCH(xScreenSaverSuspendReq);
|
||||
+ swapl(&stuff->suspend);
|
||||
return ProcScreenSaverSuspend(client);
|
||||
}
|
||||
|
||||
--
|
||||
2.33.1
|
||||
|
||||
@ -1,45 +0,0 @@
|
||||
From 672b26d1f8e1cbe67d289786e3ce887988052b64 Mon Sep 17 00:00:00 2001
|
||||
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||||
Date: Fri, 22 Mar 2024 18:56:27 -0700
|
||||
Subject: [PATCH xserver 3/4] Xi: ProcXIPassiveGrabDevice needs to use
|
||||
unswapped length to send reply
|
||||
|
||||
CVE-2024-31081
|
||||
|
||||
Fixes: d220d6907 ("Xi: add GrabButton and GrabKeysym code.")
|
||||
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||||
(cherry picked from commit 3e77295f888c67fc7645db5d0c00926a29ffecee)
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1464>
|
||||
---
|
||||
Xi/xipassivegrab.c | 5 ++++-
|
||||
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
|
||||
index c9ac2f855..896233bec 100644
|
||||
--- a/Xi/xipassivegrab.c
|
||||
+++ b/Xi/xipassivegrab.c
|
||||
@@ -93,6 +93,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
|
||||
GrabParameters param;
|
||||
void *tmp;
|
||||
int mask_len;
|
||||
+ uint32_t length;
|
||||
|
||||
REQUEST(xXIPassiveGrabDeviceReq);
|
||||
REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,
|
||||
@@ -247,9 +248,11 @@ ProcXIPassiveGrabDevice(ClientPtr client)
|
||||
}
|
||||
}
|
||||
|
||||
+ /* save the value before SRepXIPassiveGrabDevice swaps it */
|
||||
+ length = rep.length;
|
||||
WriteReplyToClient(client, sizeof(rep), &rep);
|
||||
if (rep.num_modifiers)
|
||||
- WriteToClient(client, rep.length * 4, modifiers_failed);
|
||||
+ WriteToClient(client, length * 4, modifiers_failed);
|
||||
|
||||
out:
|
||||
free(modifiers_failed);
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -1,70 +0,0 @@
|
||||
From f9c435822c852659e3926502829f1b13ce6efc37 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 29 Nov 2022 13:26:57 +1000
|
||||
Subject: [PATCH xserver 3/7] Xi: avoid integer truncation in length check of
|
||||
ProcXIChangeProperty
|
||||
|
||||
This fixes an OOB read and the resulting information disclosure.
|
||||
|
||||
Length calculation for the request was clipped to a 32-bit integer. With
|
||||
the correct stuff->num_items value the expected request size was
|
||||
truncated, passing the REQUEST_FIXED_SIZE check.
|
||||
|
||||
The server then proceeded with reading at least stuff->num_items bytes
|
||||
(depending on stuff->format) from the request and stuffing whatever it
|
||||
finds into the property. In the process it would also allocate at least
|
||||
stuff->num_items bytes, i.e. 4GB.
|
||||
|
||||
The same bug exists in ProcChangeProperty and ProcXChangeDeviceProperty,
|
||||
so let's fix that too.
|
||||
|
||||
CVE-2022-46344, ZDI-CAN 19405
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
---
|
||||
Xi/xiproperty.c | 4 ++--
|
||||
dix/property.c | 3 ++-
|
||||
2 files changed, 4 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
|
||||
index 68c362c628..066ba21fba 100644
|
||||
--- a/Xi/xiproperty.c
|
||||
+++ b/Xi/xiproperty.c
|
||||
@@ -890,7 +890,7 @@ ProcXChangeDeviceProperty(ClientPtr client)
|
||||
REQUEST(xChangeDevicePropertyReq);
|
||||
DeviceIntPtr dev;
|
||||
unsigned long len;
|
||||
- int totalSize;
|
||||
+ uint64_t totalSize;
|
||||
int rc;
|
||||
|
||||
REQUEST_AT_LEAST_SIZE(xChangeDevicePropertyReq);
|
||||
@@ -1130,7 +1130,7 @@ ProcXIChangeProperty(ClientPtr client)
|
||||
{
|
||||
int rc;
|
||||
DeviceIntPtr dev;
|
||||
- int totalSize;
|
||||
+ uint64_t totalSize;
|
||||
unsigned long len;
|
||||
|
||||
REQUEST(xXIChangePropertyReq);
|
||||
diff --git a/dix/property.c b/dix/property.c
|
||||
index 94ef5a0ec0..acce94b2c6 100644
|
||||
--- a/dix/property.c
|
||||
+++ b/dix/property.c
|
||||
@@ -205,7 +205,8 @@ ProcChangeProperty(ClientPtr client)
|
||||
WindowPtr pWin;
|
||||
char format, mode;
|
||||
unsigned long len;
|
||||
- int sizeInBytes, totalSize, err;
|
||||
+ int sizeInBytes, err;
|
||||
+ uint64_t totalSize;
|
||||
|
||||
REQUEST(xChangePropertyReq);
|
||||
|
||||
--
|
||||
2.38.1
|
||||
@ -1,219 +0,0 @@
|
||||
From ee5377d94ea587f584adbc9ab8372b3842cfa149 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Mon, 18 Dec 2023 12:26:20 +1000
|
||||
Subject: [PATCH xserver 3/9] dix: fix DeviceStateNotify event calculation
|
||||
|
||||
The previous code only made sense if one considers buttons and keys to
|
||||
be mutually exclusive on a device. That is not necessarily true, causing
|
||||
a number of issues.
|
||||
|
||||
This function allocates and fills in the number of xEvents we need to
|
||||
send the device state down the wire. This is split across multiple
|
||||
32-byte devices including one deviceStateNotify event and optional
|
||||
deviceKeyStateNotify, deviceButtonStateNotify and (possibly multiple)
|
||||
deviceValuator events.
|
||||
|
||||
The previous behavior would instead compose a sequence
|
||||
of [state, buttonstate, state, keystate, valuator...]. This is not
|
||||
protocol correct, and on top of that made the code extremely convoluted.
|
||||
|
||||
Fix this by streamlining: add both button and key into the deviceStateNotify
|
||||
and then append the key state and button state, followed by the
|
||||
valuators. Finally, the deviceValuator events contain up to 6 valuators
|
||||
per event but we only ever sent through 3 at a time. Let's double that
|
||||
troughput.
|
||||
|
||||
CVE-2024-0229, ZDI-CAN-22678
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
(cherry picked from commit 219c54b8a3337456ce5270ded6a67bcde53553d5)
|
||||
---
|
||||
dix/enterleave.c | 121 ++++++++++++++++++++---------------------------
|
||||
1 file changed, 52 insertions(+), 69 deletions(-)
|
||||
|
||||
diff --git a/dix/enterleave.c b/dix/enterleave.c
|
||||
index 17964b00a..7b7ba1098 100644
|
||||
--- a/dix/enterleave.c
|
||||
+++ b/dix/enterleave.c
|
||||
@@ -615,9 +615,15 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v,
|
||||
|
||||
ev->type = DeviceValuator;
|
||||
ev->deviceid = dev->id;
|
||||
- ev->num_valuators = nval < 3 ? nval : 3;
|
||||
+ ev->num_valuators = nval < 6 ? nval : 6;
|
||||
ev->first_valuator = first;
|
||||
switch (ev->num_valuators) {
|
||||
+ case 6:
|
||||
+ ev->valuator2 = v->axisVal[first + 5];
|
||||
+ case 5:
|
||||
+ ev->valuator2 = v->axisVal[first + 4];
|
||||
+ case 4:
|
||||
+ ev->valuator2 = v->axisVal[first + 3];
|
||||
case 3:
|
||||
ev->valuator2 = v->axisVal[first + 2];
|
||||
case 2:
|
||||
@@ -626,7 +632,6 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v,
|
||||
ev->valuator0 = v->axisVal[first];
|
||||
break;
|
||||
}
|
||||
- first += ev->num_valuators;
|
||||
}
|
||||
|
||||
static void
|
||||
@@ -646,7 +651,7 @@ FixDeviceStateNotify(DeviceIntPtr dev, deviceStateNotify * ev, KeyClassPtr k,
|
||||
ev->num_buttons = b->numButtons;
|
||||
memcpy((char *) ev->buttons, (char *) b->down, 4);
|
||||
}
|
||||
- else if (k) {
|
||||
+ if (k) {
|
||||
ev->classes_reported |= (1 << KeyClass);
|
||||
ev->num_keys = k->xkbInfo->desc->max_key_code -
|
||||
k->xkbInfo->desc->min_key_code;
|
||||
@@ -670,15 +675,26 @@ FixDeviceStateNotify(DeviceIntPtr dev, deviceStateNotify * ev, KeyClassPtr k,
|
||||
}
|
||||
}
|
||||
|
||||
-
|
||||
+/**
|
||||
+ * The device state notify event is split across multiple 32-byte events.
|
||||
+ * The first one contains the first 32 button state bits, the first 32
|
||||
+ * key state bits, and the first 3 valuator values.
|
||||
+ *
|
||||
+ * If a device has more than that, the server sends out:
|
||||
+ * - one deviceButtonStateNotify for buttons 32 and above
|
||||
+ * - one deviceKeyStateNotify for keys 32 and above
|
||||
+ * - one deviceValuator event per 6 valuators above valuator 4
|
||||
+ *
|
||||
+ * All events but the last one have the deviceid binary ORed with MORE_EVENTS,
|
||||
+ */
|
||||
static void
|
||||
DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
|
||||
{
|
||||
+ /* deviceStateNotify, deviceKeyStateNotify, deviceButtonStateNotify
|
||||
+ * and one deviceValuator for each 6 valuators */
|
||||
+ deviceStateNotify sev[3 + (MAX_VALUATORS + 6)/6];
|
||||
int evcount = 1;
|
||||
- deviceStateNotify sev[6 + (MAX_VALUATORS + 2)/3];
|
||||
- deviceStateNotify *ev;
|
||||
- deviceKeyStateNotify *kev;
|
||||
- deviceButtonStateNotify *bev;
|
||||
+ deviceStateNotify *ev = sev;
|
||||
|
||||
KeyClassPtr k;
|
||||
ButtonClassPtr b;
|
||||
@@ -691,82 +707,49 @@ DeliverStateNotifyEvent(DeviceIntPtr dev, WindowPtr win)
|
||||
|
||||
if ((b = dev->button) != NULL) {
|
||||
nbuttons = b->numButtons;
|
||||
- if (nbuttons > 32)
|
||||
+ if (nbuttons > 32) /* first 32 are encoded in deviceStateNotify */
|
||||
evcount++;
|
||||
}
|
||||
if ((k = dev->key) != NULL) {
|
||||
nkeys = k->xkbInfo->desc->max_key_code - k->xkbInfo->desc->min_key_code;
|
||||
- if (nkeys > 32)
|
||||
+ if (nkeys > 32) /* first 32 are encoded in deviceStateNotify */
|
||||
evcount++;
|
||||
- if (nbuttons > 0) {
|
||||
- evcount++;
|
||||
- }
|
||||
}
|
||||
if ((v = dev->valuator) != NULL) {
|
||||
nval = v->numAxes;
|
||||
-
|
||||
- if (nval > 3)
|
||||
- evcount++;
|
||||
- if (nval > 6) {
|
||||
- if (!(k && b))
|
||||
- evcount++;
|
||||
- if (nval > 9)
|
||||
- evcount += ((nval - 7) / 3);
|
||||
- }
|
||||
+ /* first three are encoded in deviceStateNotify, then
|
||||
+ * it's 6 per deviceValuator event */
|
||||
+ evcount += ((nval - 3) + 6)/6;
|
||||
}
|
||||
|
||||
- ev = sev;
|
||||
- FixDeviceStateNotify(dev, ev, NULL, NULL, NULL, first);
|
||||
-
|
||||
- if (b != NULL) {
|
||||
- FixDeviceStateNotify(dev, ev++, NULL, b, v, first);
|
||||
- first += 3;
|
||||
- nval -= 3;
|
||||
- if (nbuttons > 32) {
|
||||
- (ev - 1)->deviceid |= MORE_EVENTS;
|
||||
- bev = (deviceButtonStateNotify *) ev++;
|
||||
- bev->type = DeviceButtonStateNotify;
|
||||
- bev->deviceid = dev->id;
|
||||
- memcpy((char *) &bev->buttons[4], (char *) &b->down[4],
|
||||
- DOWN_LENGTH - 4);
|
||||
- }
|
||||
- if (nval > 0) {
|
||||
- (ev - 1)->deviceid |= MORE_EVENTS;
|
||||
- FixDeviceValuator(dev, (deviceValuator *) ev++, v, first);
|
||||
- first += 3;
|
||||
- nval -= 3;
|
||||
- }
|
||||
+ BUG_RETURN(evcount <= ARRAY_SIZE(sev));
|
||||
+
|
||||
+ FixDeviceStateNotify(dev, ev, k, b, v, first);
|
||||
+
|
||||
+ if (b != NULL && nbuttons > 32) {
|
||||
+ deviceButtonStateNotify *bev = (deviceButtonStateNotify *) ++ev;
|
||||
+ (ev - 1)->deviceid |= MORE_EVENTS;
|
||||
+ bev->type = DeviceButtonStateNotify;
|
||||
+ bev->deviceid = dev->id;
|
||||
+ memcpy((char *) &bev->buttons[4], (char *) &b->down[4],
|
||||
+ DOWN_LENGTH - 4);
|
||||
}
|
||||
|
||||
- if (k != NULL) {
|
||||
- FixDeviceStateNotify(dev, ev++, k, NULL, v, first);
|
||||
- first += 3;
|
||||
- nval -= 3;
|
||||
- if (nkeys > 32) {
|
||||
- (ev - 1)->deviceid |= MORE_EVENTS;
|
||||
- kev = (deviceKeyStateNotify *) ev++;
|
||||
- kev->type = DeviceKeyStateNotify;
|
||||
- kev->deviceid = dev->id;
|
||||
- memmove((char *) &kev->keys[0], (char *) &k->down[4], 28);
|
||||
- }
|
||||
- if (nval > 0) {
|
||||
- (ev - 1)->deviceid |= MORE_EVENTS;
|
||||
- FixDeviceValuator(dev, (deviceValuator *) ev++, v, first);
|
||||
- first += 3;
|
||||
- nval -= 3;
|
||||
- }
|
||||
+ if (k != NULL && nkeys > 32) {
|
||||
+ deviceKeyStateNotify *kev = (deviceKeyStateNotify *) ++ev;
|
||||
+ (ev - 1)->deviceid |= MORE_EVENTS;
|
||||
+ kev->type = DeviceKeyStateNotify;
|
||||
+ kev->deviceid = dev->id;
|
||||
+ memmove((char *) &kev->keys[0], (char *) &k->down[4], 28);
|
||||
}
|
||||
|
||||
+ first = 3;
|
||||
+ nval -= 3;
|
||||
while (nval > 0) {
|
||||
- FixDeviceStateNotify(dev, ev++, NULL, NULL, v, first);
|
||||
- first += 3;
|
||||
- nval -= 3;
|
||||
- if (nval > 0) {
|
||||
- (ev - 1)->deviceid |= MORE_EVENTS;
|
||||
- FixDeviceValuator(dev, (deviceValuator *) ev++, v, first);
|
||||
- first += 3;
|
||||
- nval -= 3;
|
||||
- }
|
||||
+ ev->deviceid |= MORE_EVENTS;
|
||||
+ FixDeviceValuator(dev, (deviceValuator *) ++ev, v, first);
|
||||
+ first += 6;
|
||||
+ nval -= 6;
|
||||
}
|
||||
|
||||
DeliverEventsToWindow(dev, win, (xEvent *) sev, evcount,
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -1,183 +0,0 @@
|
||||
From bd134231e282d9eb126b6fdaa40bb383180fa72b Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 5 Jul 2022 11:11:06 +1000
|
||||
Subject: [PATCH xserver 3/3] xkb: add request length validation for
|
||||
XkbSetGeometry
|
||||
|
||||
No validation of the various fields on that report were done, so a
|
||||
malicious client could send a short request that claims it had N
|
||||
sections, or rows, or keys, and the server would process the request for
|
||||
N sections, running out of bounds of the actual request data.
|
||||
|
||||
Fix this by adding size checks to ensure our data is valid.
|
||||
|
||||
ZDI-CAN 16062, CVE-2022-2319.
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
(cherry picked from commit 6907b6ea2b4ce949cb07271f5b678d5966d9df42)
|
||||
---
|
||||
xkb/xkb.c | 43 ++++++++++++++++++++++++++++++++++++++-----
|
||||
1 file changed, 38 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/xkb/xkb.c b/xkb/xkb.c
|
||||
index 36464a770..27d19793e 100644
|
||||
--- a/xkb/xkb.c
|
||||
+++ b/xkb/xkb.c
|
||||
@@ -5160,7 +5160,7 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str)
|
||||
}
|
||||
|
||||
static Status
|
||||
-_CheckSetDoodad(char **wire_inout,
|
||||
+_CheckSetDoodad(char **wire_inout, xkbSetGeometryReq *req,
|
||||
XkbGeometryPtr geom, XkbSectionPtr section, ClientPtr client)
|
||||
{
|
||||
char *wire;
|
||||
@@ -5171,6 +5171,9 @@ _CheckSetDoodad(char **wire_inout,
|
||||
Status status;
|
||||
|
||||
dWire = (xkbDoodadWireDesc *) (*wire_inout);
|
||||
+ if (!_XkbCheckRequestBounds(client, req, dWire, dWire + 1))
|
||||
+ return BadLength;
|
||||
+
|
||||
any = dWire->any;
|
||||
wire = (char *) &dWire[1];
|
||||
if (client->swapped) {
|
||||
@@ -5273,7 +5276,7 @@ _CheckSetDoodad(char **wire_inout,
|
||||
}
|
||||
|
||||
static Status
|
||||
-_CheckSetOverlay(char **wire_inout,
|
||||
+_CheckSetOverlay(char **wire_inout, xkbSetGeometryReq *req,
|
||||
XkbGeometryPtr geom, XkbSectionPtr section, ClientPtr client)
|
||||
{
|
||||
register int r;
|
||||
@@ -5284,6 +5287,9 @@ _CheckSetOverlay(char **wire_inout,
|
||||
|
||||
wire = *wire_inout;
|
||||
olWire = (xkbOverlayWireDesc *) wire;
|
||||
+ if (!_XkbCheckRequestBounds(client, req, olWire, olWire + 1))
|
||||
+ return BadLength;
|
||||
+
|
||||
if (client->swapped) {
|
||||
swapl(&olWire->name);
|
||||
}
|
||||
@@ -5295,6 +5301,9 @@ _CheckSetOverlay(char **wire_inout,
|
||||
xkbOverlayKeyWireDesc *kWire;
|
||||
XkbOverlayRowPtr row;
|
||||
|
||||
+ if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1))
|
||||
+ return BadLength;
|
||||
+
|
||||
if (rWire->rowUnder > section->num_rows) {
|
||||
client->errorValue = _XkbErrCode4(0x20, r, section->num_rows,
|
||||
rWire->rowUnder);
|
||||
@@ -5303,6 +5312,9 @@ _CheckSetOverlay(char **wire_inout,
|
||||
row = XkbAddGeomOverlayRow(ol, rWire->rowUnder, rWire->nKeys);
|
||||
kWire = (xkbOverlayKeyWireDesc *) &rWire[1];
|
||||
for (k = 0; k < rWire->nKeys; k++, kWire++) {
|
||||
+ if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1))
|
||||
+ return BadLength;
|
||||
+
|
||||
if (XkbAddGeomOverlayKey(ol, row,
|
||||
(char *) kWire->over,
|
||||
(char *) kWire->under) == NULL) {
|
||||
@@ -5336,6 +5348,9 @@ _CheckSetSections(XkbGeometryPtr geom,
|
||||
register int r;
|
||||
xkbRowWireDesc *rWire;
|
||||
|
||||
+ if (!_XkbCheckRequestBounds(client, req, sWire, sWire + 1))
|
||||
+ return BadLength;
|
||||
+
|
||||
if (client->swapped) {
|
||||
swapl(&sWire->name);
|
||||
swaps(&sWire->top);
|
||||
@@ -5361,6 +5376,9 @@ _CheckSetSections(XkbGeometryPtr geom,
|
||||
XkbRowPtr row;
|
||||
xkbKeyWireDesc *kWire;
|
||||
|
||||
+ if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1))
|
||||
+ return BadLength;
|
||||
+
|
||||
if (client->swapped) {
|
||||
swaps(&rWire->top);
|
||||
swaps(&rWire->left);
|
||||
@@ -5375,6 +5393,9 @@ _CheckSetSections(XkbGeometryPtr geom,
|
||||
for (k = 0; k < rWire->nKeys; k++, kWire++) {
|
||||
XkbKeyPtr key;
|
||||
|
||||
+ if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1))
|
||||
+ return BadLength;
|
||||
+
|
||||
key = XkbAddGeomKey(row);
|
||||
if (!key)
|
||||
return BadAlloc;
|
||||
@@ -5400,7 +5421,7 @@ _CheckSetSections(XkbGeometryPtr geom,
|
||||
register int d;
|
||||
|
||||
for (d = 0; d < sWire->nDoodads; d++) {
|
||||
- status = _CheckSetDoodad(&wire, geom, section, client);
|
||||
+ status = _CheckSetDoodad(&wire, req, geom, section, client);
|
||||
if (status != Success)
|
||||
return status;
|
||||
}
|
||||
@@ -5409,7 +5430,7 @@ _CheckSetSections(XkbGeometryPtr geom,
|
||||
register int o;
|
||||
|
||||
for (o = 0; o < sWire->nOverlays; o++) {
|
||||
- status = _CheckSetOverlay(&wire, geom, section, client);
|
||||
+ status = _CheckSetOverlay(&wire, req, geom, section, client);
|
||||
if (status != Success)
|
||||
return status;
|
||||
}
|
||||
@@ -5443,6 +5464,9 @@ _CheckSetShapes(XkbGeometryPtr geom,
|
||||
xkbOutlineWireDesc *olWire;
|
||||
XkbOutlinePtr ol;
|
||||
|
||||
+ if (!_XkbCheckRequestBounds(client, req, shapeWire, shapeWire + 1))
|
||||
+ return BadLength;
|
||||
+
|
||||
shape =
|
||||
XkbAddGeomShape(geom, shapeWire->name, shapeWire->nOutlines);
|
||||
if (!shape)
|
||||
@@ -5453,12 +5477,18 @@ _CheckSetShapes(XkbGeometryPtr geom,
|
||||
XkbPointPtr pt;
|
||||
xkbPointWireDesc *ptWire;
|
||||
|
||||
+ if (!_XkbCheckRequestBounds(client, req, olWire, olWire + 1))
|
||||
+ return BadLength;
|
||||
+
|
||||
ol = XkbAddGeomOutline(shape, olWire->nPoints);
|
||||
if (!ol)
|
||||
return BadAlloc;
|
||||
ol->corner_radius = olWire->cornerRadius;
|
||||
ptWire = (xkbPointWireDesc *) &olWire[1];
|
||||
for (p = 0, pt = ol->points; p < olWire->nPoints; p++, pt++, ptWire++) {
|
||||
+ if (!_XkbCheckRequestBounds(client, req, ptWire, ptWire + 1))
|
||||
+ return BadLength;
|
||||
+
|
||||
pt->x = ptWire->x;
|
||||
pt->y = ptWire->y;
|
||||
if (client->swapped) {
|
||||
@@ -5564,12 +5594,15 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSetGeometryReq * req, ClientPtr client)
|
||||
return status;
|
||||
|
||||
for (i = 0; i < req->nDoodads; i++) {
|
||||
- status = _CheckSetDoodad(&wire, geom, NULL, client);
|
||||
+ status = _CheckSetDoodad(&wire, req, geom, NULL, client);
|
||||
if (status != Success)
|
||||
return status;
|
||||
}
|
||||
|
||||
for (i = 0; i < req->nKeyAliases; i++) {
|
||||
+ if (!_XkbCheckRequestBounds(client, req, wire, wire + XkbKeyNameLength))
|
||||
+ return BadLength;
|
||||
+
|
||||
if (XkbAddGeomKeyAlias(geom, &wire[XkbKeyNameLength], wire) == NULL)
|
||||
return BadAlloc;
|
||||
wire += 2 * XkbKeyNameLength;
|
||||
--
|
||||
2.36.1
|
||||
|
||||
@ -1,42 +0,0 @@
|
||||
From 3206e133cb768709d32f260ac4b1bb17a46141a7 Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Wed, 17 Nov 2021 13:09:58 +0100
|
||||
Subject: [PATCH xserver 3/4] xwayland/glamor: Log backend selected for debug
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Add (verbose) statements to trace the actual backend used with glamor.
|
||||
|
||||
That can be useful for debugging.
|
||||
|
||||
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
|
||||
(cherry picked from commit c5d1fed9fa32244739677ec5c58ea87b261e023b)
|
||||
---
|
||||
hw/xwayland/xwayland-glamor.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/hw/xwayland/xwayland-glamor.c b/hw/xwayland/xwayland-glamor.c
|
||||
index 541d5e923..b34eafabb 100644
|
||||
--- a/hw/xwayland/xwayland-glamor.c
|
||||
+++ b/hw/xwayland/xwayland-glamor.c
|
||||
@@ -409,6 +409,7 @@ xwl_glamor_select_gbm_backend(struct xwl_screen *xwl_screen)
|
||||
if (xwl_screen->gbm_backend.is_available &&
|
||||
xwl_glamor_has_wl_interfaces(xwl_screen, &xwl_screen->gbm_backend)) {
|
||||
xwl_screen->egl_backend = &xwl_screen->gbm_backend;
|
||||
+ LogMessageVerb(X_INFO, 3, "glamor: Using GBM backend\n");
|
||||
return TRUE;
|
||||
}
|
||||
else
|
||||
@@ -426,6 +427,7 @@ xwl_glamor_select_eglstream_backend(struct xwl_screen *xwl_screen)
|
||||
if (xwl_screen->eglstream_backend.is_available &&
|
||||
xwl_glamor_has_wl_interfaces(xwl_screen, &xwl_screen->eglstream_backend)) {
|
||||
xwl_screen->egl_backend = &xwl_screen->eglstream_backend;
|
||||
+ LogMessageVerb(X_INFO, 3, "glamor: Using EGLStream backend\n");
|
||||
return TRUE;
|
||||
}
|
||||
else
|
||||
--
|
||||
2.33.1
|
||||
|
||||
@ -1,64 +0,0 @@
|
||||
From 0dab0b527ac5c4fe0272ea679522bd87238a733b Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 29 Nov 2022 13:55:32 +1000
|
||||
Subject: [PATCH xserver 4/7] Xi: disallow passive grabs with a detail > 255
|
||||
|
||||
The XKB protocol effectively prevents us from ever using keycodes above
|
||||
255. For buttons it's theoretically possible but realistically too niche
|
||||
to worry about. For all other passive grabs, the detail must be zero
|
||||
anyway.
|
||||
|
||||
This fixes an OOB write:
|
||||
|
||||
ProcXIPassiveUngrabDevice() calls DeletePassiveGrabFromList with a
|
||||
temporary grab struct which contains tempGrab->detail.exact = stuff->detail.
|
||||
For matching existing grabs, DeleteDetailFromMask is called with the
|
||||
stuff->detail value. This function creates a new mask with the one bit
|
||||
representing stuff->detail cleared.
|
||||
|
||||
However, the array size for the new mask is 8 * sizeof(CARD32) bits,
|
||||
thus any detail above 255 results in an OOB array write.
|
||||
|
||||
CVE-2022-46341, ZDI-CAN 19381
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
---
|
||||
Xi/xipassivegrab.c | 12 ++++++++++++
|
||||
1 file changed, 12 insertions(+)
|
||||
|
||||
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
|
||||
index 65d5870f6f..89a591098a 100644
|
||||
--- a/Xi/xipassivegrab.c
|
||||
+++ b/Xi/xipassivegrab.c
|
||||
@@ -133,6 +133,12 @@ ProcXIPassiveGrabDevice(ClientPtr client)
|
||||
return BadValue;
|
||||
}
|
||||
|
||||
+ /* XI2 allows 32-bit keycodes but thanks to XKB we can never
|
||||
+ * implement this. Just return an error for all keycodes that
|
||||
+ * cannot work anyway, same for buttons > 255. */
|
||||
+ if (stuff->detail > 255)
|
||||
+ return XIAlreadyGrabbed;
|
||||
+
|
||||
if (XICheckInvalidMaskBits(client, (unsigned char *) &stuff[1],
|
||||
stuff->mask_len * 4) != Success)
|
||||
return BadValue;
|
||||
@@ -313,6 +319,12 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
|
||||
return BadValue;
|
||||
}
|
||||
|
||||
+ /* We don't allow passive grabs for details > 255 anyway */
|
||||
+ if (stuff->detail > 255) {
|
||||
+ client->errorValue = stuff->detail;
|
||||
+ return BadValue;
|
||||
+ }
|
||||
+
|
||||
rc = dixLookupWindow(&win, stuff->grab_window, client, DixSetAttrAccess);
|
||||
if (rc != Success)
|
||||
return rc;
|
||||
--
|
||||
2.38.1
|
||||
@ -1,39 +0,0 @@
|
||||
From 1c22e4a35e71d98a082ad2f8f7bc778a8859e18d Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Thu, 21 Dec 2023 13:48:10 +1000
|
||||
Subject: [PATCH xserver 4/9] Xi: when creating a new ButtonClass, set the
|
||||
number of buttons
|
||||
|
||||
There's a racy sequence where a master device may copy the button class
|
||||
from the slave, without ever initializing numButtons. This leads to a
|
||||
device with zero buttons but a button class which is invalid.
|
||||
|
||||
Let's copy the numButtons value from the source - by definition if we
|
||||
don't have a button class yet we do not have any other slave devices
|
||||
with more than this number of buttons anyway.
|
||||
|
||||
CVE-2024-0229, ZDI-CAN-22678
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
(cherry picked from commit df3c65706eb169d5938df0052059f3e0d5981b74)
|
||||
---
|
||||
Xi/exevents.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/Xi/exevents.c b/Xi/exevents.c
|
||||
index 54ea11a93..e16171468 100644
|
||||
--- a/Xi/exevents.c
|
||||
+++ b/Xi/exevents.c
|
||||
@@ -605,6 +605,7 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
|
||||
to->button = calloc(1, sizeof(ButtonClassRec));
|
||||
if (!to->button)
|
||||
FatalError("[Xi] no memory for class shift.\n");
|
||||
+ to->button->numButtons = from->button->numButtons;
|
||||
}
|
||||
else
|
||||
classes->button = NULL;
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -1,53 +0,0 @@
|
||||
From 59c977bff66de77bd93ce8853e33e1b4ca661a49 Mon Sep 17 00:00:00 2001
|
||||
From: Povilas Kanapickas <povilas@radix.lt>
|
||||
Date: Tue, 14 Dec 2021 15:00:03 +0200
|
||||
Subject: [PATCH xserver 4/4] render: Fix out of bounds access in
|
||||
SProcRenderCompositeGlyphs()
|
||||
|
||||
ZDI-CAN-14192, CVE-2021-4008
|
||||
|
||||
This vulnerability was discovered and the fix was suggested by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
|
||||
(cherry picked from commit ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60)
|
||||
---
|
||||
render/render.c | 9 +++++++++
|
||||
1 file changed, 9 insertions(+)
|
||||
|
||||
diff --git a/render/render.c b/render/render.c
|
||||
index c376090ca..456f156d4 100644
|
||||
--- a/render/render.c
|
||||
+++ b/render/render.c
|
||||
@@ -2309,6 +2309,9 @@ SProcRenderCompositeGlyphs(ClientPtr client)
|
||||
|
||||
i = elt->len;
|
||||
if (i == 0xff) {
|
||||
+ if (buffer + 4 > end) {
|
||||
+ return BadLength;
|
||||
+ }
|
||||
swapl((int *) buffer);
|
||||
buffer += 4;
|
||||
}
|
||||
@@ -2319,12 +2322,18 @@ SProcRenderCompositeGlyphs(ClientPtr client)
|
||||
buffer += i;
|
||||
break;
|
||||
case 2:
|
||||
+ if (buffer + i * 2 > end) {
|
||||
+ return BadLength;
|
||||
+ }
|
||||
while (i--) {
|
||||
swaps((short *) buffer);
|
||||
buffer += 2;
|
||||
}
|
||||
break;
|
||||
case 4:
|
||||
+ if (buffer + i * 4 > end) {
|
||||
+ return BadLength;
|
||||
+ }
|
||||
while (i--) {
|
||||
swapl((int *) buffer);
|
||||
buffer += 4;
|
||||
--
|
||||
2.33.1
|
||||
|
||||
@ -1,116 +0,0 @@
|
||||
From 01941a831811c9fd47ffed5ea96375abeb20c9fc Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 30 Jan 2024 13:13:35 +1000
|
||||
Subject: [PATCH xserver 4/4] render: fix refcounting of glyphs during
|
||||
ProcRenderAddGlyphs
|
||||
|
||||
Previously, AllocateGlyph would return a new glyph with refcount=0 and a
|
||||
re-used glyph would end up not changing the refcount at all. The
|
||||
resulting glyph_new array would thus have multiple entries pointing to
|
||||
the same non-refcounted glyphs.
|
||||
|
||||
AddGlyph may free a glyph, resulting in a UAF when the same glyph
|
||||
pointer is then later used.
|
||||
|
||||
Fix this by returning a refcount of 1 for a new glyph and always
|
||||
incrementing the refcount for a re-used glyph, followed by dropping that
|
||||
refcount back down again when we're done with it.
|
||||
|
||||
CVE-2024-31083, ZDI-CAN-22880
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
(backported from commit bdca6c3d1f5057eeb31609b1280fc93237b00c77)
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1464>
|
||||
---
|
||||
render/glyph.c | 5 +++--
|
||||
render/glyphstr.h | 3 +++
|
||||
render/render.c | 15 +++++++++++----
|
||||
3 files changed, 17 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/render/glyph.c b/render/glyph.c
|
||||
index f3ed9cf4c..d5fc5f3c9 100644
|
||||
--- a/render/glyph.c
|
||||
+++ b/render/glyph.c
|
||||
@@ -245,10 +245,11 @@ FreeGlyphPicture(GlyphPtr glyph)
|
||||
}
|
||||
}
|
||||
|
||||
-static void
|
||||
+void
|
||||
FreeGlyph(GlyphPtr glyph, int format)
|
||||
{
|
||||
CheckDuplicates(&globalGlyphs[format], "FreeGlyph");
|
||||
+ BUG_RETURN(glyph->refcnt == 0);
|
||||
if (--glyph->refcnt == 0) {
|
||||
GlyphRefPtr gr;
|
||||
int i;
|
||||
@@ -354,7 +355,7 @@ AllocateGlyph(xGlyphInfo * gi, int fdepth)
|
||||
glyph = (GlyphPtr) malloc(size);
|
||||
if (!glyph)
|
||||
return 0;
|
||||
- glyph->refcnt = 0;
|
||||
+ glyph->refcnt = 1;
|
||||
glyph->size = size + sizeof(xGlyphInfo);
|
||||
glyph->info = *gi;
|
||||
dixInitPrivates(glyph, (char *) glyph + head_size, PRIVATE_GLYPH);
|
||||
diff --git a/render/glyphstr.h b/render/glyphstr.h
|
||||
index 2f51bd244..fb6589d3e 100644
|
||||
--- a/render/glyphstr.h
|
||||
+++ b/render/glyphstr.h
|
||||
@@ -102,6 +102,9 @@ HashGlyph(xGlyphInfo * gi,
|
||||
extern void
|
||||
AddGlyph(GlyphSetPtr glyphSet, GlyphPtr glyph, Glyph id);
|
||||
|
||||
+extern void
|
||||
+FreeGlyph(GlyphPtr glyph, int format);
|
||||
+
|
||||
extern Bool
|
||||
DeleteGlyph(GlyphSetPtr glyphSet, Glyph id);
|
||||
|
||||
diff --git a/render/render.c b/render/render.c
|
||||
index 456f156d4..5bc2a204b 100644
|
||||
--- a/render/render.c
|
||||
+++ b/render/render.c
|
||||
@@ -1076,6 +1076,7 @@ ProcRenderAddGlyphs(ClientPtr client)
|
||||
|
||||
if (glyph_new->glyph && glyph_new->glyph != DeletedGlyph) {
|
||||
glyph_new->found = TRUE;
|
||||
+ ++glyph_new->glyph->refcnt;
|
||||
}
|
||||
else {
|
||||
GlyphPtr glyph;
|
||||
@@ -1168,8 +1169,10 @@ ProcRenderAddGlyphs(ClientPtr client)
|
||||
err = BadAlloc;
|
||||
goto bail;
|
||||
}
|
||||
- for (i = 0; i < nglyphs; i++)
|
||||
+ for (i = 0; i < nglyphs; i++) {
|
||||
AddGlyph(glyphSet, glyphs[i].glyph, glyphs[i].id);
|
||||
+ FreeGlyph(glyphs[i].glyph, glyphSet->fdepth);
|
||||
+ }
|
||||
|
||||
if (glyphsBase != glyphsLocal)
|
||||
free(glyphsBase);
|
||||
@@ -1179,9 +1182,13 @@ ProcRenderAddGlyphs(ClientPtr client)
|
||||
FreePicture((void *) pSrc, 0);
|
||||
if (pSrcPix)
|
||||
FreeScratchPixmapHeader(pSrcPix);
|
||||
- for (i = 0; i < nglyphs; i++)
|
||||
- if (glyphs[i].glyph && !glyphs[i].found)
|
||||
- free(glyphs[i].glyph);
|
||||
+ for (i = 0; i < nglyphs; i++) {
|
||||
+ if (glyphs[i].glyph) {
|
||||
+ --glyphs[i].glyph->refcnt;
|
||||
+ if (!glyphs[i].found)
|
||||
+ free(glyphs[i].glyph);
|
||||
+ }
|
||||
+ }
|
||||
if (glyphsBase != glyphsLocal)
|
||||
free(glyphsBase);
|
||||
return err;
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -1,64 +0,0 @@
|
||||
From bdc00ba749ac6cde35c025f5f6b1a5b49c1f4960 Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Wed, 17 Nov 2021 09:56:52 +0100
|
||||
Subject: [PATCH xserver 4/4] xwayland/eglstream: Prefer EGLstream if available
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Currently, when given the choice, Xwayland will pick the GBM backend
|
||||
over the EGLstream backend if both are available, unless the command
|
||||
line option “-eglstream” is specified.
|
||||
|
||||
The NVIDIA proprietary driver had no support for GBM until driver series
|
||||
495, but starting with the driver series 495, both can be used.
|
||||
|
||||
But there are other requirements with the rest of the stack, typically
|
||||
Mesa, egl-wayland, libglvnd as documented in the NVIDIA driver.
|
||||
|
||||
So if the NVIDIA driver series 495 gets installed, Xwayland will pick
|
||||
the GBM backend even if EGLstream is available and may fail to render
|
||||
properly.
|
||||
|
||||
To avoid that issue, prefer EGLstream if EGLstream and all the Wayland
|
||||
interfaces are available, and fallback to GBM automatically unless
|
||||
“-eglstream” was specified.
|
||||
|
||||
With this, the compositor, given the choice, can decide which actual
|
||||
backend Xwayland would use by advertising (or not) the Wayland
|
||||
"wl_eglstream_controller" interface.
|
||||
|
||||
This change has no impact on compositors which do not have support for
|
||||
EGLstream in the first place.
|
||||
|
||||
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Acked-by: Michel Dänzer <mdaenzer@redhat.com>
|
||||
(cherry picked from commit 6dd9709bd85cf5de4067887818c864220b951355)
|
||||
---
|
||||
hw/xwayland/xwayland-glamor.c | 8 ++------
|
||||
1 file changed, 2 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/hw/xwayland/xwayland-glamor.c b/hw/xwayland/xwayland-glamor.c
|
||||
index b34eafabb..f46b677f5 100644
|
||||
--- a/hw/xwayland/xwayland-glamor.c
|
||||
+++ b/hw/xwayland/xwayland-glamor.c
|
||||
@@ -441,14 +441,10 @@ xwl_glamor_select_eglstream_backend(struct xwl_screen *xwl_screen)
|
||||
void
|
||||
xwl_glamor_select_backend(struct xwl_screen *xwl_screen, Bool use_eglstream)
|
||||
{
|
||||
- if (use_eglstream) {
|
||||
- if (!xwl_glamor_select_eglstream_backend(xwl_screen))
|
||||
+ if (!xwl_glamor_select_eglstream_backend(xwl_screen)) {
|
||||
+ if (!use_eglstream)
|
||||
xwl_glamor_select_gbm_backend(xwl_screen);
|
||||
}
|
||||
- else {
|
||||
- if (!xwl_glamor_select_gbm_backend(xwl_screen))
|
||||
- xwl_glamor_select_eglstream_backend(xwl_screen);
|
||||
- }
|
||||
}
|
||||
|
||||
Bool
|
||||
--
|
||||
2.33.1
|
||||
|
||||
@ -1,47 +0,0 @@
|
||||
From 94f6fe99d87cf6ba0adadd95c595158c345b7d29 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 29 Nov 2022 14:53:07 +1000
|
||||
Subject: [PATCH xserver 5/7] Xext: free the screen saver resource when
|
||||
replacing it
|
||||
|
||||
This fixes a use-after-free bug:
|
||||
|
||||
When a client first calls ScreenSaverSetAttributes(), a struct
|
||||
ScreenSaverAttrRec is allocated and added to the client's
|
||||
resources.
|
||||
|
||||
When the same client calls ScreenSaverSetAttributes() again, a new
|
||||
struct ScreenSaverAttrRec is allocated, replacing the old struct. The
|
||||
old struct was freed but not removed from the clients resources.
|
||||
|
||||
Later, when the client is destroyed the resource system invokes
|
||||
ScreenSaverFreeAttr and attempts to clean up the already freed struct.
|
||||
|
||||
Fix this by letting the resource system free the old attrs instead.
|
||||
|
||||
CVE-2022-46343, ZDI-CAN 19404
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
---
|
||||
Xext/saver.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Xext/saver.c b/Xext/saver.c
|
||||
index f813ba08d1..fd6153c313 100644
|
||||
--- a/Xext/saver.c
|
||||
+++ b/Xext/saver.c
|
||||
@@ -1051,7 +1051,7 @@ ScreenSaverSetAttributes(ClientPtr client)
|
||||
pVlist++;
|
||||
}
|
||||
if (pPriv->attr)
|
||||
- FreeScreenAttr(pPriv->attr);
|
||||
+ FreeResource(pPriv->attr->resource, AttrType);
|
||||
pPriv->attr = pAttr;
|
||||
pAttr->resource = FakeClientID(client->index);
|
||||
if (!AddResource(pAttr->resource, AttrType, (void *) pAttr))
|
||||
--
|
||||
2.38.1
|
||||
@ -1,111 +0,0 @@
|
||||
From 7efd09cdb13ae1a4100f68a11947afe581fa1ee8 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Thu, 4 Jan 2024 10:01:24 +1000
|
||||
Subject: [PATCH xserver 5/9] Xi: flush hierarchy events after adding/removing
|
||||
master devices
|
||||
|
||||
The `XISendDeviceHierarchyEvent()` function allocates space to store up
|
||||
to `MAXDEVICES` (256) `xXIHierarchyInfo` structures in `info`.
|
||||
|
||||
If a device with a given ID was removed and a new device with the same
|
||||
ID added both in the same operation, the single device ID will lead to
|
||||
two info structures being written to `info`.
|
||||
|
||||
Since this case can occur for every device ID at once, a total of two
|
||||
times `MAXDEVICES` info structures might be written to the allocation.
|
||||
|
||||
To avoid it, once one add/remove master is processed, send out the
|
||||
device hierarchy event for the current state and continue. That event
|
||||
thus only ever has exactly one of either added/removed in it (and
|
||||
optionally slave attached/detached).
|
||||
|
||||
CVE-2024-21885, ZDI-CAN-22744
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
(cherry picked from commit 4a5e9b1895627d40d26045bd0b7ef3dce503cbd1)
|
||||
---
|
||||
Xi/xichangehierarchy.c | 27 ++++++++++++++++++++++-----
|
||||
1 file changed, 22 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c
|
||||
index d2d985848..72d00451e 100644
|
||||
--- a/Xi/xichangehierarchy.c
|
||||
+++ b/Xi/xichangehierarchy.c
|
||||
@@ -416,6 +416,11 @@ ProcXIChangeHierarchy(ClientPtr client)
|
||||
size_t len; /* length of data remaining in request */
|
||||
int rc = Success;
|
||||
int flags[MAXDEVICES] = { 0 };
|
||||
+ enum {
|
||||
+ NO_CHANGE,
|
||||
+ FLUSH,
|
||||
+ CHANGED,
|
||||
+ } changes = NO_CHANGE;
|
||||
|
||||
REQUEST(xXIChangeHierarchyReq);
|
||||
REQUEST_AT_LEAST_SIZE(xXIChangeHierarchyReq);
|
||||
@@ -465,8 +470,9 @@ ProcXIChangeHierarchy(ClientPtr client)
|
||||
rc = add_master(client, c, flags);
|
||||
if (rc != Success)
|
||||
goto unwind;
|
||||
- }
|
||||
+ changes = FLUSH;
|
||||
break;
|
||||
+ }
|
||||
case XIRemoveMaster:
|
||||
{
|
||||
xXIRemoveMasterInfo *r = (xXIRemoveMasterInfo *) any;
|
||||
@@ -475,8 +481,9 @@ ProcXIChangeHierarchy(ClientPtr client)
|
||||
rc = remove_master(client, r, flags);
|
||||
if (rc != Success)
|
||||
goto unwind;
|
||||
- }
|
||||
+ changes = FLUSH;
|
||||
break;
|
||||
+ }
|
||||
case XIDetachSlave:
|
||||
{
|
||||
xXIDetachSlaveInfo *c = (xXIDetachSlaveInfo *) any;
|
||||
@@ -485,8 +492,9 @@ ProcXIChangeHierarchy(ClientPtr client)
|
||||
rc = detach_slave(client, c, flags);
|
||||
if (rc != Success)
|
||||
goto unwind;
|
||||
- }
|
||||
+ changes = CHANGED;
|
||||
break;
|
||||
+ }
|
||||
case XIAttachSlave:
|
||||
{
|
||||
xXIAttachSlaveInfo *c = (xXIAttachSlaveInfo *) any;
|
||||
@@ -495,16 +503,25 @@ ProcXIChangeHierarchy(ClientPtr client)
|
||||
rc = attach_slave(client, c, flags);
|
||||
if (rc != Success)
|
||||
goto unwind;
|
||||
+ changes = CHANGED;
|
||||
+ break;
|
||||
}
|
||||
+ default:
|
||||
break;
|
||||
}
|
||||
|
||||
+ if (changes == FLUSH) {
|
||||
+ XISendDeviceHierarchyEvent(flags);
|
||||
+ memset(flags, 0, sizeof(flags));
|
||||
+ changes = NO_CHANGE;
|
||||
+ }
|
||||
+
|
||||
len -= any->length * 4;
|
||||
any = (xXIAnyHierarchyChangeInfo *) ((char *) any + any->length * 4);
|
||||
}
|
||||
|
||||
unwind:
|
||||
-
|
||||
- XISendDeviceHierarchyEvent(flags);
|
||||
+ if (changes != NO_CHANGE)
|
||||
+ XISendDeviceHierarchyEvent(flags);
|
||||
return rc;
|
||||
}
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -1,73 +0,0 @@
|
||||
From a42635ee3c01f71a49052d83a372933504c9db04 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Wed, 30 Nov 2022 11:20:40 +1000
|
||||
Subject: [PATCH xserver 6/7] Xext: free the XvRTVideoNotify when turning off
|
||||
from the same client
|
||||
|
||||
This fixes a use-after-free bug:
|
||||
|
||||
When a client first calls XvdiSelectVideoNotify() on a drawable with a
|
||||
TRUE onoff argument, a struct XvVideoNotifyRec is allocated. This struct
|
||||
is added twice to the resources:
|
||||
- as the drawable's XvRTVideoNotifyList. This happens only once per
|
||||
drawable, subsequent calls append to this list.
|
||||
- as the client's XvRTVideoNotify. This happens for every client.
|
||||
|
||||
The struct keeps the ClientPtr around once it has been added for a
|
||||
client. The idea, presumably, is that if the client disconnects we can remove
|
||||
all structs from the drawable's list that match the client (by resetting
|
||||
the ClientPtr to NULL), but if the drawable is destroyed we can remove
|
||||
and free the whole list.
|
||||
|
||||
However, if the same client then calls XvdiSelectVideoNotify() on the
|
||||
same drawable with a FALSE onoff argument, only the ClientPtr on the
|
||||
existing struct was set to NULL. The struct itself remained in the
|
||||
client's resources.
|
||||
|
||||
If the drawable is now destroyed, the resource system invokes
|
||||
XvdiDestroyVideoNotifyList which frees the whole list for this drawable
|
||||
- including our struct. This function however does not free the resource
|
||||
for the client since our ClientPtr is NULL.
|
||||
|
||||
Later, when the client is destroyed and the resource system invokes
|
||||
XvdiDestroyVideoNotify, we unconditionally set the ClientPtr to NULL. On
|
||||
a struct that has been freed previously. This is generally frowned upon.
|
||||
|
||||
Fix this by calling FreeResource() on the second call instead of merely
|
||||
setting the ClientPtr to NULL. This removes the struct from the client
|
||||
resources (but not from the list), ensuring that it won't be accessed
|
||||
again when the client quits.
|
||||
|
||||
Note that the assignment tpn->client = NULL; is superfluous since the
|
||||
XvdiDestroyVideoNotify function will do this anyway. But it's left for
|
||||
clarity and to match a similar invocation in XvdiSelectPortNotify.
|
||||
|
||||
CVE-2022-46342, ZDI-CAN 19400
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
---
|
||||
Xext/xvmain.c | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Xext/xvmain.c b/Xext/xvmain.c
|
||||
index f627471938..2a08f8744a 100644
|
||||
--- a/Xext/xvmain.c
|
||||
+++ b/Xext/xvmain.c
|
||||
@@ -811,8 +811,10 @@ XvdiSelectVideoNotify(ClientPtr client, DrawablePtr pDraw, BOOL onoff)
|
||||
tpn = pn;
|
||||
while (tpn) {
|
||||
if (tpn->client == client) {
|
||||
- if (!onoff)
|
||||
+ if (!onoff) {
|
||||
tpn->client = NULL;
|
||||
+ FreeResource(tpn->id, XvRTVideoNotify);
|
||||
+ }
|
||||
return Success;
|
||||
}
|
||||
if (!tpn->client)
|
||||
--
|
||||
2.38.1
|
||||
@ -1,73 +0,0 @@
|
||||
From 01cd3a72858ccc1afb0b42ace92263f2912619a3 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= <jexposit@redhat.com>
|
||||
Date: Fri, 22 Dec 2023 18:28:31 +0100
|
||||
Subject: [PATCH xserver 6/9] Xi: do not keep linked list pointer during
|
||||
recursion
|
||||
|
||||
The `DisableDevice()` function is called whenever an enabled device
|
||||
is disabled and it moves the device from the `inputInfo.devices` linked
|
||||
list to the `inputInfo.off_devices` linked list.
|
||||
|
||||
However, its link/unlink operation has an issue during the recursive
|
||||
call to `DisableDevice()` due to the `prev` pointer pointing to a
|
||||
removed device.
|
||||
|
||||
This issue leads to a length mismatch between the total number of
|
||||
devices and the number of device in the list, leading to a heap
|
||||
overflow and, possibly, to local privilege escalation.
|
||||
|
||||
Simplify the code that checked whether the device passed to
|
||||
`DisableDevice()` was in `inputInfo.devices` or not and find the
|
||||
previous device after the recursion.
|
||||
|
||||
CVE-2024-21886, ZDI-CAN-22840
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
(cherry picked from commit bc1fdbe46559dd947674375946bbef54dd0ce36b)
|
||||
---
|
||||
dix/devices.c | 15 ++++++++++++---
|
||||
1 file changed, 12 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/dix/devices.c b/dix/devices.c
|
||||
index 8fe4a341c..f3db37203 100644
|
||||
--- a/dix/devices.c
|
||||
+++ b/dix/devices.c
|
||||
@@ -453,14 +453,20 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
|
||||
{
|
||||
DeviceIntPtr *prev, other;
|
||||
BOOL enabled;
|
||||
+ BOOL dev_in_devices_list = FALSE;
|
||||
int flags[MAXDEVICES] = { 0 };
|
||||
|
||||
if (!dev->enabled)
|
||||
return TRUE;
|
||||
|
||||
- for (prev = &inputInfo.devices;
|
||||
- *prev && (*prev != dev); prev = &(*prev)->next);
|
||||
- if (*prev != dev)
|
||||
+ for (other = inputInfo.devices; other; other = other->next) {
|
||||
+ if (other == dev) {
|
||||
+ dev_in_devices_list = TRUE;
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ if (!dev_in_devices_list)
|
||||
return FALSE;
|
||||
|
||||
TouchEndPhysicallyActiveTouches(dev);
|
||||
@@ -511,6 +517,9 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
|
||||
LeaveWindow(dev);
|
||||
SetFocusOut(dev);
|
||||
|
||||
+ for (prev = &inputInfo.devices;
|
||||
+ *prev && (*prev != dev); prev = &(*prev)->next);
|
||||
+
|
||||
*prev = dev->next;
|
||||
dev->next = inputInfo.off_devices;
|
||||
inputInfo.off_devices = dev;
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -1,55 +0,0 @@
|
||||
From 42f8d1828b4fc1e0b8165a767a0b74edcdbf3806 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Fri, 5 Jan 2024 09:40:27 +1000
|
||||
Subject: [PATCH xserver 7/9] dix: when disabling a master, float disabled
|
||||
slaved devices too
|
||||
|
||||
Disabling a master device floats all slave devices but we didn't do this
|
||||
to already-disabled slave devices. As a result those devices kept their
|
||||
reference to the master device resulting in access to already freed
|
||||
memory if the master device was removed before the corresponding slave
|
||||
device.
|
||||
|
||||
And to match this behavior, also forcibly reset that pointer during
|
||||
CloseDownDevices().
|
||||
|
||||
Related to CVE-2024-21886, ZDI-CAN-22840
|
||||
|
||||
(cherry picked from commit 26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8)
|
||||
---
|
||||
dix/devices.c | 12 ++++++++++++
|
||||
1 file changed, 12 insertions(+)
|
||||
|
||||
diff --git a/dix/devices.c b/dix/devices.c
|
||||
index f3db37203..95190b5b7 100644
|
||||
--- a/dix/devices.c
|
||||
+++ b/dix/devices.c
|
||||
@@ -483,6 +483,13 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
|
||||
flags[other->id] |= XISlaveDetached;
|
||||
}
|
||||
}
|
||||
+
|
||||
+ for (other = inputInfo.off_devices; other; other = other->next) {
|
||||
+ if (!IsMaster(other) && GetMaster(other, MASTER_ATTACHED) == dev) {
|
||||
+ AttachDevice(NULL, other, NULL);
|
||||
+ flags[other->id] |= XISlaveDetached;
|
||||
+ }
|
||||
+ }
|
||||
}
|
||||
else {
|
||||
for (other = inputInfo.devices; other; other = other->next) {
|
||||
@@ -1080,6 +1087,11 @@ CloseDownDevices(void)
|
||||
dev->master = NULL;
|
||||
}
|
||||
|
||||
+ for (dev = inputInfo.off_devices; dev; dev = dev->next) {
|
||||
+ if (!IsMaster(dev) && !IsFloating(dev))
|
||||
+ dev->master = NULL;
|
||||
+ }
|
||||
+
|
||||
CloseDeviceList(&inputInfo.devices);
|
||||
CloseDeviceList(&inputInfo.off_devices);
|
||||
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -1,35 +0,0 @@
|
||||
From 774260dbae1fa505cd2848c786baed9a8db5179d Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Mon, 5 Dec 2022 15:55:54 +1000
|
||||
Subject: [PATCH xserver 7/7] xkb: reset the radio_groups pointer to NULL after
|
||||
freeing it
|
||||
|
||||
Unlike other elements of the keymap, this pointer was freed but not
|
||||
reset. On a subsequent XkbGetKbdByName request, the server may access
|
||||
already freed memory.
|
||||
|
||||
CVE-2022-46283, ZDI-CAN-19530
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
---
|
||||
xkb/xkbUtils.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c
|
||||
index dd089c2046..3f5791a183 100644
|
||||
--- a/xkb/xkbUtils.c
|
||||
+++ b/xkb/xkbUtils.c
|
||||
@@ -1326,6 +1326,7 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr dst)
|
||||
}
|
||||
else {
|
||||
free(dst->names->radio_groups);
|
||||
+ dst->names->radio_groups = NULL;
|
||||
}
|
||||
dst->names->num_rg = src->names->num_rg;
|
||||
|
||||
--
|
||||
2.38.1
|
||||
@ -1,35 +0,0 @@
|
||||
From bb1711b7fba42f2a0c7d1c09beee241a1b2bcc30 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Mon, 19 Dec 2022 10:06:45 +1000
|
||||
Subject: [PATCH xserver] Xext: fix invalid event type mask in
|
||||
XTestSwapFakeInput
|
||||
|
||||
In commit b320ca0 the mask was inadvertently changed from octal 0177 to
|
||||
hexadecimal 0x177.
|
||||
|
||||
Fixes commit b320ca0ffe4c0c872eeb3a93d9bde21f765c7c63
|
||||
Xtest: disallow GenericEvents in XTestSwapFakeInput
|
||||
|
||||
Found by Stuart Cassoff
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
---
|
||||
Xext/xtest.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Xext/xtest.c b/Xext/xtest.c
|
||||
index 2985a4ce6e..dde5c4cf9d 100644
|
||||
--- a/Xext/xtest.c
|
||||
+++ b/Xext/xtest.c
|
||||
@@ -502,7 +502,7 @@ XTestSwapFakeInput(ClientPtr client, xReq * req)
|
||||
|
||||
nev = ((req->length << 2) - sizeof(xReq)) / sizeof(xEvent);
|
||||
for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) {
|
||||
- int evtype = ev->u.u.type & 0x177;
|
||||
+ int evtype = ev->u.u.type & 0177;
|
||||
/* Swap event */
|
||||
proc = EventSwapVector[evtype];
|
||||
/* no swapping proc; invalid event type? */
|
||||
--
|
||||
2.38.1
|
||||
|
||||
@ -1,61 +0,0 @@
|
||||
From 4093057b98bc5a178f130c9ba6b0b28385e24ae5 Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Wed, 6 Dec 2023 12:09:41 +0100
|
||||
Subject: [PATCH xserver 8/9] glx: Call XACE hooks on the GLX buffer
|
||||
|
||||
The XSELINUX code will label resources at creation by checking the
|
||||
access mode. When the access mode is DixCreateAccess, it will call the
|
||||
function to label the new resource SELinuxLabelResource().
|
||||
|
||||
However, GLX buffers do not go through the XACE hooks when created,
|
||||
hence leaving the resource actually unlabeled.
|
||||
|
||||
When, later, the client tries to create another resource using that
|
||||
drawable (like a GC for example), the XSELINUX code would try to use
|
||||
the security ID of that object which has never been labeled, get a NULL
|
||||
pointer and crash when checking whether the requested permissions are
|
||||
granted for subject security ID.
|
||||
|
||||
To avoid the issue, make sure to call the XACE hooks when creating the
|
||||
GLX buffers.
|
||||
|
||||
Credit goes to Donn Seeley <donn@xmission.com> for providing the patch.
|
||||
|
||||
CVE-2024-0408
|
||||
|
||||
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
(cherry picked from commit e5e8586a12a3ec915673edffa10dc8fe5e15dac3)
|
||||
---
|
||||
glx/glxcmds.c | 8 ++++++++
|
||||
1 file changed, 8 insertions(+)
|
||||
|
||||
diff --git a/glx/glxcmds.c b/glx/glxcmds.c
|
||||
index fc26a2e34..1e46d0c72 100644
|
||||
--- a/glx/glxcmds.c
|
||||
+++ b/glx/glxcmds.c
|
||||
@@ -48,6 +48,7 @@
|
||||
#include "indirect_util.h"
|
||||
#include "protocol-versions.h"
|
||||
#include "glxvndabi.h"
|
||||
+#include "xace.h"
|
||||
|
||||
static char GLXServerVendorName[] = "SGI";
|
||||
|
||||
@@ -1392,6 +1393,13 @@ DoCreatePbuffer(ClientPtr client, int screenNum, XID fbconfigId,
|
||||
if (!pPixmap)
|
||||
return BadAlloc;
|
||||
|
||||
+ err = XaceHook(XACE_RESOURCE_ACCESS, client, glxDrawableId, RT_PIXMAP,
|
||||
+ pPixmap, RT_NONE, NULL, DixCreateAccess);
|
||||
+ if (err != Success) {
|
||||
+ (*pGlxScreen->pScreen->DestroyPixmap) (pPixmap);
|
||||
+ return err;
|
||||
+ }
|
||||
+
|
||||
/* Assign the pixmap the same id as the pbuffer and add it as a
|
||||
* resource so it and the DRI2 drawable will be reclaimed when the
|
||||
* pbuffer is destroyed. */
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -1,44 +0,0 @@
|
||||
From 51be9e767a02cdc6a524dc895dcc81abb689d50b Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Wed, 6 Dec 2023 11:51:56 +0100
|
||||
Subject: [PATCH xserver 9/9] ephyr,xwayland: Use the proper private key for
|
||||
cursor
|
||||
|
||||
The cursor in DIX is actually split in two parts, the cursor itself and
|
||||
the cursor bits, each with their own devPrivates.
|
||||
|
||||
The cursor itself includes the cursor bits, meaning that the cursor bits
|
||||
devPrivates in within structure of the cursor.
|
||||
|
||||
Both Xephyr and Xwayland were using the private key for the cursor bits
|
||||
to store the data for the cursor, and when using XSELINUX which comes
|
||||
with its own special devPrivates, the data stored in that cursor bits'
|
||||
devPrivates would interfere with the XSELINUX devPrivates data and the
|
||||
SELINUX security ID would point to some other unrelated data, causing a
|
||||
crash in the XSELINUX code when trying to (re)use the security ID.
|
||||
|
||||
CVE-2024-0409
|
||||
|
||||
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
(cherry picked from commit 2ef0f1116c65d5cb06d7b6d83f8a1aea702c94f7)
|
||||
---
|
||||
hw/xwayland/xwayland-cursor.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/hw/xwayland/xwayland-cursor.c b/hw/xwayland/xwayland-cursor.c
|
||||
index e3c1aaa50..bd94b0cfb 100644
|
||||
--- a/hw/xwayland/xwayland-cursor.c
|
||||
+++ b/hw/xwayland/xwayland-cursor.c
|
||||
@@ -431,7 +431,7 @@ static miPointerScreenFuncRec xwl_pointer_screen_funcs = {
|
||||
Bool
|
||||
xwl_screen_init_cursor(struct xwl_screen *xwl_screen)
|
||||
{
|
||||
- if (!dixRegisterPrivateKey(&xwl_cursor_private_key, PRIVATE_CURSOR_BITS, 0))
|
||||
+ if (!dixRegisterPrivateKey(&xwl_cursor_private_key, PRIVATE_CURSOR, 0))
|
||||
return FALSE;
|
||||
|
||||
return miPointerInitialize(xwl_screen->screen,
|
||||
--
|
||||
2.43.0
|
||||
|
||||
Loading…
Reference in new issue