forked from pool/xorg-x11-server
Accepting request 853603 from home:tobijk:X11:XOrg
- Update to version 1.20.10: * Check SetMap request length carefully. * Fix XkbSetDeviceInfo() and SetDeviceIndicators() heap overflows * present/wnmd: Translate update region to screen space * modesetting: keep going if a modeset fails on EnterVT * modesetting: check the kms state on EnterVT * configure: Build hashtable for Xres and glvnd * xwayland: Create an xwl_window for toplevel only * xwayland: non-rootless requires the wl_shell protocol * glamor: Update pixmap's devKind when making it exportable * os: Fix instruction pointer written in xorg_backtrace * present/wnmd: Execute copies at target_msc-1 already * present/wnmd: Move up present_wnmd_queue_vblank * present: Add present_vblank::exec_msc field * present: Move flip target_msc adjustment out of present_vblank_create * xwayland: Remove pending stream reference when freeing * xwayland: use drmGetNodeTypeFromFd for checking if a node is a render one * xwayland: Do not discard frame callbacks on allow commits * present/wnmd: Remove dead check from present_wnmd_check_flip * xwayland: Check window pixmap in xwl_present_check_flip2 * present/wnmd: Can't use page flipping for windows clipped by children * xfree86: Take second reference for SavedCursor in xf86CursorSetCursor * glamor: Fix glamor_poly_fill_rect_gl xRectangle::width/height handling * include: Increase the number of max. input devices to 256. * Revert "linux: Make platform device probe less fragile" * Revert "linux: Fix platform device PCI detection for complex bus topologies" * Revert "linux: Fix platform device probe for DT-based PCI" - Remove included pachtes * U_xfree86_take_second_ref_for_xcursor.patch * U_Revert-linux-Fix-platform-device-probe-for-DT-based-.patch OBS-URL: https://build.opensuse.org/request/show/853603 OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/xorg-x11-server?expand=0&rev=785
This commit is contained in:
parent
8364917173
commit
a9f2918c0e
@ -1,127 +0,0 @@
|
||||
From 446ff2d3177087b8173fa779fa5b77a2a128988b Mon Sep 17 00:00:00 2001
|
||||
From: Matthieu Herrb <matthieu@herrb.eu>
|
||||
Date: Thu, 12 Nov 2020 19:15:07 +0100
|
||||
Subject: [PATCH] Check SetMap request length carefully.
|
||||
|
||||
Avoid out of bounds memory accesses on too short request.
|
||||
|
||||
ZDI-CAN 11572 / CVE-2020-14360
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
|
||||
---
|
||||
xkb/xkb.c | 92 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
1 file changed, 92 insertions(+)
|
||||
|
||||
Index: xserver-1.20.9/xkb/xkb.c
|
||||
===================================================================
|
||||
--- xserver-1.20.9.orig/xkb/xkb.c
|
||||
+++ xserver-1.20.9/xkb/xkb.c
|
||||
@@ -2382,6 +2382,93 @@ SetVirtualModMap(XkbSrvInfoPtr xkbi,
|
||||
return (char *) wire;
|
||||
}
|
||||
|
||||
+#define _add_check_len(new) \
|
||||
+ if (len > UINT32_MAX - (new) || len > req_len - (new)) goto bad; \
|
||||
+ else len += new
|
||||
+
|
||||
+/**
|
||||
+ * Check the length of the SetMap request
|
||||
+ */
|
||||
+static int
|
||||
+_XkbSetMapCheckLength(xkbSetMapReq *req)
|
||||
+{
|
||||
+ size_t len = sz_xkbSetMapReq, req_len = req->length << 2;
|
||||
+ xkbKeyTypeWireDesc *keytype;
|
||||
+ xkbSymMapWireDesc *symmap;
|
||||
+ BOOL preserve;
|
||||
+ int i, map_count, nSyms;
|
||||
+
|
||||
+ if (req_len < len)
|
||||
+ goto bad;
|
||||
+ /* types */
|
||||
+ if (req->present & XkbKeyTypesMask) {
|
||||
+ keytype = (xkbKeyTypeWireDesc *)(req + 1);
|
||||
+ for (i = 0; i < req->nTypes; i++) {
|
||||
+ _add_check_len(XkbPaddedSize(sz_xkbKeyTypeWireDesc));
|
||||
+ if (req->flags & XkbSetMapResizeTypes) {
|
||||
+ _add_check_len(keytype->nMapEntries
|
||||
+ * sz_xkbKTSetMapEntryWireDesc);
|
||||
+ preserve = keytype->preserve;
|
||||
+ map_count = keytype->nMapEntries;
|
||||
+ if (preserve) {
|
||||
+ _add_check_len(map_count * sz_xkbModsWireDesc);
|
||||
+ }
|
||||
+ keytype += 1;
|
||||
+ keytype = (xkbKeyTypeWireDesc *)
|
||||
+ ((xkbKTSetMapEntryWireDesc *)keytype + map_count);
|
||||
+ if (preserve)
|
||||
+ keytype = (xkbKeyTypeWireDesc *)
|
||||
+ ((xkbModsWireDesc *)keytype + map_count);
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
+ /* syms */
|
||||
+ if (req->present & XkbKeySymsMask) {
|
||||
+ symmap = (xkbSymMapWireDesc *)((char *)req + len);
|
||||
+ for (i = 0; i < req->nKeySyms; i++) {
|
||||
+ _add_check_len(sz_xkbSymMapWireDesc);
|
||||
+ nSyms = symmap->nSyms;
|
||||
+ _add_check_len(nSyms*sizeof(CARD32));
|
||||
+ symmap += 1;
|
||||
+ symmap = (xkbSymMapWireDesc *)((CARD32 *)symmap + nSyms);
|
||||
+ }
|
||||
+ }
|
||||
+ /* actions */
|
||||
+ if (req->present & XkbKeyActionsMask) {
|
||||
+ _add_check_len(req->totalActs * sz_xkbActionWireDesc
|
||||
+ + XkbPaddedSize(req->nKeyActs));
|
||||
+ }
|
||||
+ /* behaviours */
|
||||
+ if (req->present & XkbKeyBehaviorsMask) {
|
||||
+ _add_check_len(req->totalKeyBehaviors * sz_xkbBehaviorWireDesc);
|
||||
+ }
|
||||
+ /* vmods */
|
||||
+ if (req->present & XkbVirtualModsMask) {
|
||||
+ _add_check_len(XkbPaddedSize(Ones(req->virtualMods)));
|
||||
+ }
|
||||
+ /* explicit */
|
||||
+ if (req->present & XkbExplicitComponentsMask) {
|
||||
+ /* two bytes per non-zero explicit componen */
|
||||
+ _add_check_len(XkbPaddedSize(req->totalKeyExplicit * sizeof(CARD16)));
|
||||
+ }
|
||||
+ /* modmap */
|
||||
+ if (req->present & XkbModifierMapMask) {
|
||||
+ /* two bytes per non-zero modmap component */
|
||||
+ _add_check_len(XkbPaddedSize(req->totalModMapKeys * sizeof(CARD16)));
|
||||
+ }
|
||||
+ /* vmodmap */
|
||||
+ if (req->present & XkbVirtualModMapMask) {
|
||||
+ _add_check_len(req->totalVModMapKeys * sz_xkbVModMapWireDesc);
|
||||
+ }
|
||||
+ if (len == req_len)
|
||||
+ return Success;
|
||||
+bad:
|
||||
+ ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %ld got %ld\n",
|
||||
+ len, req_len);
|
||||
+ return BadLength;
|
||||
+}
|
||||
+
|
||||
+
|
||||
/**
|
||||
* Check if the given request can be applied to the given device but don't
|
||||
* actually do anything..
|
||||
@@ -2639,6 +2726,11 @@ ProcXkbSetMap(ClientPtr client)
|
||||
CHK_KBD_DEVICE(dev, stuff->deviceSpec, client, DixManageAccess);
|
||||
CHK_MASK_LEGAL(0x01, stuff->present, XkbAllMapComponentsMask);
|
||||
|
||||
+ /* first verify the request length carefully */
|
||||
+ rc = _XkbSetMapCheckLength(stuff);
|
||||
+ if (rc != Success)
|
||||
+ return rc;
|
||||
+
|
||||
tmp = (char *) &stuff[1];
|
||||
|
||||
/* Check if we can to the SetMap on the requested device. If this
|
@ -1,96 +0,0 @@
|
||||
From 87c64fc5b0db9f62f4e361444f4b60501ebf67b9 Mon Sep 17 00:00:00 2001
|
||||
From: Matthieu Herrb <matthieu@herrb.eu>
|
||||
Date: Sun, 11 Oct 2020 17:05:09 +0200
|
||||
Subject: [PATCH] Fix XkbSetDeviceInfo() and SetDeviceIndicators() heap
|
||||
overflows
|
||||
|
||||
ZDI-CAN 11389 / CVE-2020-25712
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
|
||||
---
|
||||
xkb/xkb.c | 26 +++++++++++++++++++++++---
|
||||
1 file changed, 23 insertions(+), 3 deletions(-)
|
||||
|
||||
Index: xserver-1.20.9/xkb/xkb.c
|
||||
===================================================================
|
||||
--- xserver-1.20.9.orig/xkb/xkb.c
|
||||
+++ xserver-1.20.9/xkb/xkb.c
|
||||
@@ -6533,7 +6533,9 @@ SetDeviceIndicators(char *wire,
|
||||
unsigned changed,
|
||||
int num,
|
||||
int *status_rtrn,
|
||||
- ClientPtr client, xkbExtensionDeviceNotify * ev)
|
||||
+ ClientPtr client,
|
||||
+ xkbExtensionDeviceNotify * ev,
|
||||
+ xkbSetDeviceInfoReq * stuff)
|
||||
{
|
||||
xkbDeviceLedsWireDesc *ledWire;
|
||||
int i;
|
||||
@@ -6554,6 +6556,11 @@ SetDeviceIndicators(char *wire,
|
||||
xkbIndicatorMapWireDesc *mapWire;
|
||||
XkbSrvLedInfoPtr sli;
|
||||
|
||||
+ if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) {
|
||||
+ *status_rtrn = BadLength;
|
||||
+ return (char *) ledWire;
|
||||
+ }
|
||||
+
|
||||
namec = mapc = statec = 0;
|
||||
sli = XkbFindSrvLedInfo(dev, ledWire->ledClass, ledWire->ledID,
|
||||
XkbXI_IndicatorMapsMask);
|
||||
@@ -6572,6 +6579,10 @@ SetDeviceIndicators(char *wire,
|
||||
memset((char *) sli->names, 0, XkbNumIndicators * sizeof(Atom));
|
||||
for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) {
|
||||
if (ledWire->namesPresent & bit) {
|
||||
+ if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) {
|
||||
+ *status_rtrn = BadLength;
|
||||
+ return (char *) atomWire;
|
||||
+ }
|
||||
sli->names[n] = (Atom) *atomWire;
|
||||
if (sli->names[n] == None)
|
||||
ledWire->namesPresent &= ~bit;
|
||||
@@ -6589,6 +6600,10 @@ SetDeviceIndicators(char *wire,
|
||||
if (ledWire->mapsPresent) {
|
||||
for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) {
|
||||
if (ledWire->mapsPresent & bit) {
|
||||
+ if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) {
|
||||
+ *status_rtrn = BadLength;
|
||||
+ return (char *) mapWire;
|
||||
+ }
|
||||
sli->maps[n].flags = mapWire->flags;
|
||||
sli->maps[n].which_groups = mapWire->whichGroups;
|
||||
sli->maps[n].groups = mapWire->groups;
|
||||
@@ -6668,7 +6683,7 @@ _XkbSetDeviceInfoCheck(ClientPtr client,
|
||||
ed.deviceID = dev->id;
|
||||
wire = (char *) &stuff[1];
|
||||
if (stuff->change & XkbXI_ButtonActionsMask) {
|
||||
- int nBtns, sz, i;
|
||||
+ int nBtns, sz, i;
|
||||
XkbAction *acts;
|
||||
DeviceIntPtr kbd;
|
||||
|
||||
@@ -6680,7 +6695,11 @@ _XkbSetDeviceInfoCheck(ClientPtr client,
|
||||
return BadAlloc;
|
||||
dev->button->xkb_acts = acts;
|
||||
}
|
||||
+ if (stuff->firstBtn + stuff->nBtns > nBtns)
|
||||
+ return BadValue;
|
||||
sz = stuff->nBtns * SIZEOF(xkbActionWireDesc);
|
||||
+ if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz))
|
||||
+ return BadLength;
|
||||
memcpy((char *) &acts[stuff->firstBtn], (char *) wire, sz);
|
||||
wire += sz;
|
||||
ed.reason |= XkbXI_ButtonActionsMask;
|
||||
@@ -6701,7 +6720,8 @@ _XkbSetDeviceInfoCheck(ClientPtr client,
|
||||
int status = Success;
|
||||
|
||||
wire = SetDeviceIndicators(wire, dev, stuff->change,
|
||||
- stuff->nDeviceLedFBs, &status, client, &ed);
|
||||
+ stuff->nDeviceLedFBs, &status, client, &ed,
|
||||
+ stuff);
|
||||
if (status != Success)
|
||||
return status;
|
||||
}
|
@ -1,40 +0,0 @@
|
||||
From 39cb95e959fab97a7e255dda1a1599b096fb0f7e Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Tue, 8 Sep 2020 10:03:11 +0200
|
||||
Subject: [PATCH] Revert "linux: Fix platform device PCI detection for complex
|
||||
bus topologies"
|
||||
|
||||
This reverts commit 5c96eb5f44e62a4cfe835023cde304eb5795b8fd.
|
||||
|
||||
https://gitlab.freedesktop.org/xorg/xserver/-/issues/1068
|
||||
---
|
||||
config/udev.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/config/udev.c b/config/udev.c
|
||||
index 14409549b..8c6c4b666 100644
|
||||
--- a/config/udev.c
|
||||
+++ b/config/udev.c
|
||||
@@ -470,7 +470,7 @@ config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path
|
||||
config_odev_probe_proc_ptr probe_callback)
|
||||
{
|
||||
struct OdevAttributes *attribs = config_odev_allocate_attributes();
|
||||
- const char *value, *str;
|
||||
+ const char *value;
|
||||
|
||||
attribs->path = XNFstrdup(path);
|
||||
attribs->syspath = XNFstrdup(syspath);
|
||||
@@ -478,8 +478,8 @@ config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path
|
||||
attribs->minor = minor;
|
||||
|
||||
value = udev_device_get_property_value(udev_device, "ID_PATH");
|
||||
- if (value && (str = strstr(value, "pci-"))) {
|
||||
- attribs->busid = XNFstrdup(str);
|
||||
+ if (value && !strncmp(value, "pci-", 4)) {
|
||||
+ attribs->busid = XNFstrdup(value);
|
||||
attribs->busid[3] = ':';
|
||||
}
|
||||
|
||||
--
|
||||
2.16.4
|
||||
|
@ -1,60 +0,0 @@
|
||||
From 4b6fce5975c2f931a0478cf4deeec97529b05eb6 Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Tue, 8 Sep 2020 10:01:55 +0200
|
||||
Subject: [PATCH] Revert "linux: Fix platform device probe for DT-based PCI"
|
||||
|
||||
This reverts commit 249a12c54a9316b089bd22683c011519348496df.
|
||||
|
||||
https://gitlab.freedesktop.org/xorg/xserver/-/issues/1068
|
||||
---
|
||||
config/udev.c | 27 +--------------------------
|
||||
1 file changed, 1 insertion(+), 26 deletions(-)
|
||||
|
||||
diff --git a/config/udev.c b/config/udev.c
|
||||
index b00d90237..14409549b 100644
|
||||
--- a/config/udev.c
|
||||
+++ b/config/udev.c
|
||||
@@ -464,31 +464,6 @@ config_udev_fini(void)
|
||||
|
||||
#ifdef CONFIG_UDEV_KMS
|
||||
|
||||
-/* Find the last occurrence of the needle in haystack */
|
||||
-static char *strrstr(const char *haystack, const char *needle)
|
||||
-{
|
||||
- char *prev, *last, *tmp;
|
||||
-
|
||||
- prev = strstr(haystack, needle);
|
||||
- if (!prev)
|
||||
- return NULL;
|
||||
-
|
||||
- last = prev;
|
||||
- tmp = prev + 1;
|
||||
-
|
||||
- while (tmp) {
|
||||
- last = strstr(tmp, needle);
|
||||
- if (!last)
|
||||
- return prev;
|
||||
- else {
|
||||
- prev = last;
|
||||
- tmp = prev + 1;
|
||||
- }
|
||||
- }
|
||||
-
|
||||
- return last;
|
||||
-}
|
||||
-
|
||||
static void
|
||||
config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path, const char *syspath,
|
||||
int major, int minor,
|
||||
@@ -503,7 +478,7 @@ config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path
|
||||
attribs->minor = minor;
|
||||
|
||||
value = udev_device_get_property_value(udev_device, "ID_PATH");
|
||||
- if (value && (str = strrstr(value, "pci-"))) {
|
||||
+ if (value && (str = strstr(value, "pci-"))) {
|
||||
attribs->busid = XNFstrdup(str);
|
||||
attribs->busid[3] = ':';
|
||||
}
|
||||
--
|
||||
2.16.4
|
||||
|
@ -1,132 +0,0 @@
|
||||
From af4c84ce8855e84c0ad89b929bc972e884f0b8e3 Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Tue, 8 Sep 2020 10:03:33 +0200
|
||||
Subject: [PATCH] Revert "linux: Make platform device probe less fragile"
|
||||
|
||||
This reverts commit 74b7427c41b4e4104af7abf70a996c086d3d7628.
|
||||
|
||||
https://gitlab.freedesktop.org/xorg/xserver/-/issues/1068
|
||||
---
|
||||
config/udev.c | 17 +++++------------
|
||||
hw/xfree86/os-support/linux/lnx_platform.c | 20 ++++++++++++++++++--
|
||||
2 files changed, 23 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/config/udev.c b/config/udev.c
|
||||
index 8c6c4b666..3a73189e2 100644
|
||||
--- a/config/udev.c
|
||||
+++ b/config/udev.c
|
||||
@@ -56,7 +56,7 @@ static struct udev_monitor *udev_monitor;
|
||||
|
||||
#ifdef CONFIG_UDEV_KMS
|
||||
static void
|
||||
-config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path, const char *syspath,
|
||||
+config_udev_odev_setup_attribs(const char *path, const char *syspath,
|
||||
int major, int minor,
|
||||
config_odev_probe_proc_ptr probe_callback);
|
||||
#endif
|
||||
@@ -128,7 +128,7 @@ device_added(struct udev_device *udev_device)
|
||||
|
||||
LogMessage(X_INFO, "config/udev: Adding drm device (%s)\n", path);
|
||||
|
||||
- config_udev_odev_setup_attribs(udev_device, path, syspath, major(devnum),
|
||||
+ config_udev_odev_setup_attribs(path, syspath, major(devnum),
|
||||
minor(devnum), NewGPUDeviceRequest);
|
||||
return;
|
||||
}
|
||||
@@ -322,7 +322,7 @@ device_removed(struct udev_device *device)
|
||||
|
||||
LogMessage(X_INFO, "config/udev: removing GPU device %s %s\n",
|
||||
syspath, path);
|
||||
- config_udev_odev_setup_attribs(device, path, syspath, major(devnum),
|
||||
+ config_udev_odev_setup_attribs(path, syspath, major(devnum),
|
||||
minor(devnum), DeleteGPUDeviceRequest);
|
||||
/* Retry vtenter after a drm node removal */
|
||||
systemd_logind_vtenter();
|
||||
@@ -465,24 +465,17 @@ config_udev_fini(void)
|
||||
#ifdef CONFIG_UDEV_KMS
|
||||
|
||||
static void
|
||||
-config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path, const char *syspath,
|
||||
+config_udev_odev_setup_attribs(const char *path, const char *syspath,
|
||||
int major, int minor,
|
||||
config_odev_probe_proc_ptr probe_callback)
|
||||
{
|
||||
struct OdevAttributes *attribs = config_odev_allocate_attributes();
|
||||
- const char *value;
|
||||
|
||||
attribs->path = XNFstrdup(path);
|
||||
attribs->syspath = XNFstrdup(syspath);
|
||||
attribs->major = major;
|
||||
attribs->minor = minor;
|
||||
|
||||
- value = udev_device_get_property_value(udev_device, "ID_PATH");
|
||||
- if (value && !strncmp(value, "pci-", 4)) {
|
||||
- attribs->busid = XNFstrdup(value);
|
||||
- attribs->busid[3] = ':';
|
||||
- }
|
||||
-
|
||||
/* ownership of attribs is passed to probe layer */
|
||||
probe_callback(attribs);
|
||||
}
|
||||
@@ -523,7 +516,7 @@ config_udev_odev_probe(config_odev_probe_proc_ptr probe_callback)
|
||||
else if (!check_seat(udev_device))
|
||||
goto no_probe;
|
||||
|
||||
- config_udev_odev_setup_attribs(udev_device, path, syspath, major(devnum),
|
||||
+ config_udev_odev_setup_attribs(path, syspath, major(devnum),
|
||||
minor(devnum), probe_callback);
|
||||
no_probe:
|
||||
udev_device_unref(udev_device);
|
||||
diff --git a/hw/xfree86/os-support/linux/lnx_platform.c b/hw/xfree86/os-support/linux/lnx_platform.c
|
||||
index e62306219..70374ace8 100644
|
||||
--- a/hw/xfree86/os-support/linux/lnx_platform.c
|
||||
+++ b/hw/xfree86/os-support/linux/lnx_platform.c
|
||||
@@ -23,13 +23,13 @@
|
||||
static Bool
|
||||
get_drm_info(struct OdevAttributes *attribs, char *path, int delayed_index)
|
||||
{
|
||||
+ drmSetVersion sv;
|
||||
drmVersionPtr v;
|
||||
+ char *buf;
|
||||
int fd;
|
||||
int err = 0;
|
||||
Bool paused, server_fd = FALSE;
|
||||
|
||||
- LogMessage(X_INFO, "Platform probe for %s\n", attribs->syspath);
|
||||
-
|
||||
fd = systemd_logind_take_fd(attribs->major, attribs->minor, path, &paused);
|
||||
if (fd != -1) {
|
||||
if (paused) {
|
||||
@@ -48,6 +48,18 @@ get_drm_info(struct OdevAttributes *attribs, char *path, int delayed_index)
|
||||
if (fd == -1)
|
||||
return FALSE;
|
||||
|
||||
+ sv.drm_di_major = 1;
|
||||
+ sv.drm_di_minor = 4;
|
||||
+ sv.drm_dd_major = -1; /* Don't care */
|
||||
+ sv.drm_dd_minor = -1; /* Don't care */
|
||||
+
|
||||
+ err = drmSetInterfaceVersion(fd, &sv);
|
||||
+ if (err) {
|
||||
+ xf86Msg(X_ERROR, "%s: failed to set DRM interface version 1.4: %s\n",
|
||||
+ path, strerror(-err));
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
/* for a delayed probe we've already added the device */
|
||||
if (delayed_index == -1) {
|
||||
xf86_add_platform_device(attribs, FALSE);
|
||||
@@ -57,6 +69,10 @@ get_drm_info(struct OdevAttributes *attribs, char *path, int delayed_index)
|
||||
if (server_fd)
|
||||
xf86_platform_devices[delayed_index].flags |= XF86_PDEV_SERVER_FD;
|
||||
|
||||
+ buf = drmGetBusid(fd);
|
||||
+ xf86_platform_odev_attributes(delayed_index)->busid = XNFstrdup(buf);
|
||||
+ drmFreeBusid(buf);
|
||||
+
|
||||
v = drmGetVersion(fd);
|
||||
if (!v) {
|
||||
xf86Msg(X_ERROR, "%s: failed to query DRM version\n", path);
|
||||
--
|
||||
2.16.4
|
||||
|
@ -1,33 +0,0 @@
|
||||
From 919f1f46fc67dae93b2b3f278fcbfc77af34ec58 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <mdaenzer@redhat.com>
|
||||
Date: Mon, 31 Aug 2020 12:10:43 +0200
|
||||
Subject: [PATCH] xfree86: Take second reference for SavedCursor in
|
||||
xf86CursorSetCursor
|
||||
|
||||
The same pointer is kept in CurrentCursor as well, therefore two
|
||||
RefCursor calls are needed.
|
||||
|
||||
Fixes use-after-free after switching VTs.
|
||||
|
||||
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1067
|
||||
---
|
||||
hw/xfree86/ramdac/xf86CursorRD.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/hw/xfree86/ramdac/xf86CursorRD.c b/hw/xfree86/ramdac/xf86CursorRD.c
|
||||
index 9aa3de97b..c8362d169 100644
|
||||
--- a/hw/xfree86/ramdac/xf86CursorRD.c
|
||||
+++ b/hw/xfree86/ramdac/xf86CursorRD.c
|
||||
@@ -334,6 +334,9 @@ xf86CursorSetCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCurs,
|
||||
ScreenPriv->HotY = cursor->bits->yhot;
|
||||
|
||||
if (!infoPtr->pScrn->vtSema) {
|
||||
+ cursor = RefCursor(cursor);
|
||||
+ if (ScreenPriv->SavedCursor)
|
||||
+ FreeCursor(ScreenPriv->SavedCursor, None);
|
||||
ScreenPriv->SavedCursor = cursor;
|
||||
return;
|
||||
}
|
||||
--
|
||||
2.28.0
|
||||
|
2
_service
2
_service
@ -2,7 +2,7 @@
|
||||
<service name="tar_scm" mode="disabled">
|
||||
<param name="url">https://gitlab.freedesktop.org/xorg/xserver.git</param>
|
||||
<param name="scm">git</param>
|
||||
<param name="revision">afb77415</param>
|
||||
<param name="revision">bc111a2e</param>
|
||||
<param name="versionformat">@PARENT_TAG@</param>
|
||||
<param name="versionrewrite-pattern">xorgserver(.*)</param>
|
||||
<param name="changesgenerate">enable</param>
|
||||
|
@ -1,4 +1,4 @@
|
||||
<servicedata>
|
||||
<service name="tar_scm">
|
||||
<param name="url">https://gitlab.freedesktop.org/xorg/xserver.git</param>
|
||||
<param name="changesrevision">afb77415e1fb862c322754230f63bb70fd596943</param></service></servicedata>
|
||||
<param name="changesrevision">bc111a2e67e16d4e6d4f3196ab86c22c1e278c45</param></service></servicedata>
|
@ -1,3 +1,41 @@
|
||||
-------------------------------------------------------------------
|
||||
Mon Dec 07 13:48:26 UTC 2020 - tobias.klausmann@freenet.de
|
||||
|
||||
- Update to version 1.20.10:
|
||||
* Check SetMap request length carefully.
|
||||
* Fix XkbSetDeviceInfo() and SetDeviceIndicators() heap overflows
|
||||
* present/wnmd: Translate update region to screen space
|
||||
* modesetting: keep going if a modeset fails on EnterVT
|
||||
* modesetting: check the kms state on EnterVT
|
||||
* configure: Build hashtable for Xres and glvnd
|
||||
* xwayland: Create an xwl_window for toplevel only
|
||||
* xwayland: non-rootless requires the wl_shell protocol
|
||||
* glamor: Update pixmap's devKind when making it exportable
|
||||
* os: Fix instruction pointer written in xorg_backtrace
|
||||
* present/wnmd: Execute copies at target_msc-1 already
|
||||
* present/wnmd: Move up present_wnmd_queue_vblank
|
||||
* present: Add present_vblank::exec_msc field
|
||||
* present: Move flip target_msc adjustment out of present_vblank_create
|
||||
* xwayland: Remove pending stream reference when freeing
|
||||
* xwayland: use drmGetNodeTypeFromFd for checking if a node is a render one
|
||||
* xwayland: Do not discard frame callbacks on allow commits
|
||||
* present/wnmd: Remove dead check from present_wnmd_check_flip
|
||||
* xwayland: Check window pixmap in xwl_present_check_flip2
|
||||
* present/wnmd: Can't use page flipping for windows clipped by children
|
||||
* xfree86: Take second reference for SavedCursor in xf86CursorSetCursor
|
||||
* glamor: Fix glamor_poly_fill_rect_gl xRectangle::width/height handling
|
||||
* include: Increase the number of max. input devices to 256.
|
||||
* Revert "linux: Make platform device probe less fragile"
|
||||
* Revert "linux: Fix platform device PCI detection for complex bus topologies"
|
||||
* Revert "linux: Fix platform device probe for DT-based PCI"
|
||||
- Remove included pachtes
|
||||
* U_xfree86_take_second_ref_for_xcursor.patch
|
||||
* U_Revert-linux-Fix-platform-device-probe-for-DT-based-.patch
|
||||
* U_Revert-linux-Fix-platform-device-PCI-detection-for-c.patch
|
||||
* U_Revert-linux-Make-platform-device-probe-less-fragile.patch
|
||||
* U_Fix-XkbSetDeviceInfo-and-SetDeviceIndicators-heap-ov.patch
|
||||
* U_Check-SetMap-request-length-carefully.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Dec 7 11:36:04 UTC 2020 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
|
@ -41,7 +41,7 @@
|
||||
%endif
|
||||
|
||||
Name: xorg-x11-server
|
||||
Version: 1.20.9
|
||||
Version: 1.20.10
|
||||
Release: 0
|
||||
URL: http://xorg.freedesktop.org/
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||
@ -251,15 +251,8 @@ Patch1503: u_xfree86-Do-not-claim-pci-slots-if-fb-slot-is-already.patch
|
||||
Patch1505: U_xwayland-Allow-passing-a-fd.patch
|
||||
|
||||
Patch1600: U_glamor_egl-Reject-OpenGL-2.1-early-on.patch
|
||||
Patch1700: U_xfree86_take_second_ref_for_xcursor.patch
|
||||
|
||||
Patch1801: U_Fix-segfault-on-probing-a-non-PCI-platform-device-on.patch
|
||||
Patch1802: U_Revert-linux-Fix-platform-device-probe-for-DT-based-.patch
|
||||
Patch1803: U_Revert-linux-Fix-platform-device-PCI-detection-for-c.patch
|
||||
Patch1804: U_Revert-linux-Make-platform-device-probe-less-fragile.patch
|
||||
|
||||
Patch1901: U_Fix-XkbSetDeviceInfo-and-SetDeviceIndicators-heap-ov.patch
|
||||
Patch1902: U_Check-SetMap-request-length-carefully.patch
|
||||
|
||||
%description
|
||||
This package contains the X.Org Server.
|
||||
@ -410,13 +403,7 @@ sh %{SOURCE92} --verify . %{SOURCE91}
|
||||
%patch1503 -p1
|
||||
%patch1505 -p1
|
||||
%patch1600 -p1
|
||||
%patch1700 -p1
|
||||
%patch1801 -p1
|
||||
%patch1802 -p1
|
||||
%patch1803 -p1
|
||||
%patch1804 -p1
|
||||
%patch1901 -p1
|
||||
%patch1902 -p1
|
||||
|
||||
%build
|
||||
%define _lto_cflags %{nil}
|
||||
|
3
xserver-1.20.10.tar.xz
Normal file
3
xserver-1.20.10.tar.xz
Normal file
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:a6006d1ece16284ff782ac7a13907c304b1760319cf4678c85a02a9dca6bac85
|
||||
size 3112104
|
@ -1,3 +0,0 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:1a5cabab6e8affa957bf12bb1704334a12bd00cff9f76d66a7f0998959de55a7
|
||||
size 3130696
|
Loading…
Reference in New Issue
Block a user