rpm/xorg-x11-server
SHA256
1
0
Fork 0
forked from pool/xorg-x11-server
Code Pull Requests Activity

OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/xorg-x11-server?expand=0&rev=107

Browse Source
This commit is contained in:
OBS User unknown 2008-11-23 08:38:55 +00:00 committed by Git OBS Bridge
parent 6d8464fa76
commit 440466a937
3 changed files with 75 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
commit-a9e2030.diff Normal file
View File

@ -0,0 +1,49 @@
commit a9e20306fbe3262602f21b876a52a1ef38cdf20a
Author: Egbert Eich <eich@ovid.suse.de>
Date: Fri Nov 21 18:50:01 2008 +0100
int10: Do an mprotect(..,PROT_EXEC) on shmat()ed memory ranges.
When the linux kernel sets the NX bit vm86 segfaults when it tries to execute
code in memory that is not marked EXEC. Such code gets called whenever
we return from a VBIOS call to signal the calling program that the call
is actually finished and that we are not trapping for other reasons (like
IO accesses).
Use mprotect(2) to set these memory ranges PROT_EXEC.
diff --git a/hw/xfree86/os-support/linux/int10/linux.c b/hw/xfree86/os-support/linux/int10/linux.c
index 67eb161..b15f7fd 100644
--- a/hw/xfree86/os-support/linux/int10/linux.c
+++ b/hw/xfree86/os-support/linux/int10/linux.c
@@ -1,6 +1,6 @@
/*
* linux specific part of the int10 module
- * Copyright 1999, 2000, 2001, 2002, 2003, 2004 Egbert Eich
+ * Copyright 1999, 2000, 2001, 2002, 2003, 2004, 2008 Egbert Eich
*/
#ifdef HAVE_XORG_CONFIG_H
#include <xorg-config.h>
@@ -357,7 +357,10 @@ MapCurrentInt10(xf86Int10InfoPtr pInt)
"shmat(low_mem) error: %s\n",strerror(errno));
return FALSE;
}
-
+ if (mprotect((void*)0, V_RAM, PROT_READ|PROT_WRITE|PROT_EXEC) != 0)
+ xf86DrvMsg(pInt->scrnIndex, X_ERROR,
+ "Cannot set EXEC bit on low memory: %s\n", strerror(errno));
+
if (((linuxInt10Priv*)pInt->private)->highMem >= 0) {
addr = shmat(((linuxInt10Priv*)pInt->private)->highMem,
(char*)HIGH_MEM, 0);
@@ -368,6 +371,11 @@ MapCurrentInt10(xf86Int10InfoPtr pInt)
"shmget error: %s\n",strerror(errno));
return FALSE;
}
+ if (mprotect((void*)HIGH_MEM, HIGH_MEM_SIZE,
+ PROT_READ|PROT_WRITE|PROT_EXEC) != 0)
+ xf86DrvMsg(pInt->scrnIndex, X_ERROR,
+ "Cannot set EXEC bit on high memory: %s\n",
+ strerror(errno));
} else {
if ((fd = open(DEV_MEM, O_RDWR, 0)) >= 0) {
if (mmap((void *)(V_BIOS), SYS_BIOS - V_BIOS,

13
xorg-x11-server.changes
View File

@ -1,3 +1,16 @@
-------------------------------------------------------------------
Fri Nov 21 20:16:00 CET 2008 - sndirsch@suse.de
- commit-a9e2030.diff
* int10: Do an mprotect(..,PROT_EXEC) on shmat()ed memory
ranges. When the linux kernel sets the NX bit vm86 segfaults
when it tries to execute code in memory that is not marked
EXEC. Such code gets called whenever we return from a VBIOS
call to signal the calling program that the call is actually
finished and that we are not trapping for other reasons
(like IO accesses). Use mprotect(2) to set these memory
ranges PROT_EXEC. (bnc #443440)
-------------------------------------------------------------------
Thu Nov 13 17:55:01 CET 2008 - sndirsch@suse.de

14
xorg-x11-server.spec
View File

@ -29,7 +29,7 @@ BuildRequires: libjpeg-devel
Url: http://xorg.freedesktop.org/
%define EXPERIMENTAL 0
Version: 7.4
Release: 15
Release: 16
License: X11/MIT
BuildRoot: %{_tmppath}/%{name}-%{version}-build
Group: System/X11/Servers/XF86_4
@ -103,6 +103,7 @@ Patch122: unplugged_monitor_crashfix.diff
Patch123: vidmode-sig11.diff
Patch124: commit-59f9fb4b8.diff
Patch125: 0001-Xinput-Catch-missing-configlayout-when-deleting-dev.patch
Patch126: commit-a9e2030.diff
%description
This package contains the X.Org Server.
@ -221,6 +222,7 @@ popd
%patch123 -p0
%patch124 -p1
%patch125 -p1
%patch126 -p1
%build
pushd xorg-docs-*
@ -537,6 +539,16 @@ exit 0
%endif
%changelog
* Fri Nov 21 2008 sndirsch@suse.de
- commit-a9e2030.diff
* int10: Do an mprotect(..,PROT_EXEC) on shmat()ed memory
ranges. When the linux kernel sets the NX bit vm86 segfaults
when it tries to execute code in memory that is not marked
EXEC. Such code gets called whenever we return from a VBIOS
call to signal the calling program that the call is actually
finished and that we are not trapping for other reasons
(like IO accesses). Use mprotect(2) to set these memory
ranges PROT_EXEC. (bnc #443440)
* Thu Nov 13 2008 sndirsch@suse.de
- 0001-Xinput-Catch-missing-configlayout-when-deleting-dev.patch
* In DeleteInputDeviceRequest (xf86Xinput.c), we access idev