Commits:
-
b98fc07d
by Adam Jackson at 2023-04-24T10:13:27+02:00
present: Send a PresentConfigureNotify event for destroyed windows
This enables fixing a deadlock case on the client side, where the client
ends up blocked waiting for a Present event that will never come because
the window was destroyed. The new PresentWindowDestroyed flag allows the
client to avoid blocking indefinitely.
Signed-off-by: Adam Jackson <ajax@redhat.com>
See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/116
See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6685
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
(cherry picked from commit 462b06033e66a32308d940eb5fc47f5e4c914dc0)
-
2c33ee9f
by Sam James at 2023-10-23T23:30:14-04:00
Switch to libbsd-overlay
This is more portable than libbsd as everything Just Works, even on BSD systems,
and is the recommended method of consuming libbsd nowadays.
It also helpfully lets things work with glibc-provided functions for new
enough glibc.
[For the 21.1.x backport, take inspiration from @alanc's commit to libxdmcp
at https://gitlab.freedesktop.org/xorg/lib/libxdmcp/-/commit/c01da8ebd0969efd15388ce999e121127cc46f67.]
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/973
Co-authored-by: Guillem Jover <guillem@hadrons.org>
(cherry picked from commit 94945a52746ee2612c6cd394692f49e2ed5fc56b)
Signed-off-by: Sam James <sam@gentoo.org>
-
f2922f6f
by Peter Hutterer at 2023-10-25T10:51:17+10:00
Xi/randr: fix handling of PropModeAppend/Prepend
The handling of appending/prepending properties was incorrect, with at
least two bugs: the property length was set to the length of the new
part only, i.e. appending or prepending N elements to a property with P
existing elements always resulted in the property having N elements
instead of N + P.
Second, when pre-pending a value to a property, the offset for the old
values was incorrect, leaving the new property with potentially
uninitalized values and/or resulting in OOB memory writes.
For example, prepending a 3 element value to a 5 element property would
result in this 8 value array:
[N, N, N, ?, ?, P, P, P ] P, P
^OOB write
The XI2 code is a copy/paste of the RandR code, so the bug exists in
both.
CVE-2023-5367, ZDI-CAN-22153
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 541ab2ecd41d4d8689e71855d93e492bc554719a)
-
3e290b3c
by Peter Hutterer at 2023-10-25T10:51:18+10:00
mi: reset the PointerWindows reference on screen switch
PointerWindows[] keeps a reference to the last window our sprite
entered - changes are usually handled by CheckMotion().
If we switch between screens via XWarpPointer our
dev->spriteInfo->sprite->win is set to the new screen's root window.
If there's another window at the cursor location CheckMotion() will
trigger the right enter/leave events later. If there is not, it skips
that process and we never trigger LeaveWindow() - PointerWindows[] for
the device still refers to the previous window.
If that window is destroyed we have a dangling reference that will
eventually cause a use-after-free bug when checking the window hierarchy
later.
To trigger this, we require:
- two protocol screens
- XWarpPointer to the other screen's root window
- XDestroyWindow before entering any other window
This is a niche bug so we hack around it by making sure we reset the
PointerWindows[] entry so we cannot have a dangling pointer. This
doesn't handle Enter/Leave events correctly but the previous code didn't
either.
CVE-2023-5380, ZDI-CAN-21608
This vulnerability was discovered by:
Sri working with Trend Micro Zero Day Initiative
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 564ccf2ce9616620456102727acb8b0256b7bbd7)
-
6197bea0
by Peter Hutterer at 2023-10-25T11:05:28+10:00
xserver 21.1.9
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
-
944cd44c
by Timo Aaltonen at 2023-10-25T10:38:20+03:00
Merge branch 'upstream-unstable' into debian-unstable
-
2fa4d26b
by Timo Aaltonen at 2023-10-25T10:39:32+03:00
version bump
-
dd2d222c
by Timo Aaltonen at 2023-10-25T10:43:07+03:00
release to sid
13 changed files:
Changes:
Xi/xiproperty.c
| ... |
... |
@@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type, |
|
730
|
730
|
XIDestroyDeviceProperty(prop);
|
|
731
|
731
|
return BadAlloc;
|
|
732
|
732
|
}
|
|
733
|
|
- new_value.size = len;
|
|
|
733
|
+ new_value.size = total_len;
|
|
734
|
734
|
new_value.type = type;
|
|
735
|
735
|
new_value.format = format;
|
|
736
|
736
|
|
| ... |
... |
@@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type, |
|
747
|
747
|
case PropModePrepend:
|
|
748
|
748
|
new_data = new_value.data;
|
|
749
|
749
|
old_data = (void *) (((char *) new_value.data) +
|
|
750
|
|
- (prop_value->size * size_in_bytes));
|
|
|
750
|
+ (len * size_in_bytes));
|
|
751
|
751
|
break;
|
|
752
|
752
|
}
|
|
753
|
753
|
if (new_data)
|
configure.ac
| ... |
... |
@@ -26,8 +26,8 @@ dnl |
|
26
|
26
|
dnl Process this file with autoconf to create configure.
|
|
27
|
27
|
|
|
28
|
28
|
AC_PREREQ(2.60)
|
|
29
|
|
-AC_INIT([xorg-server], 21.1.8, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server)
|
|
30
|
|
-RELEASE_DATE="2023-03-29"
|
|
|
29
|
+AC_INIT([xorg-server], 21.1.9, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server)
|
|
|
30
|
+RELEASE_DATE="2023-10-25"
|
|
31
|
31
|
RELEASE_NAME="Caramel Ice Cream"
|
|
32
|
32
|
AC_CONFIG_SRCDIR([Makefile.am])
|
|
33
|
33
|
AC_CONFIG_MACRO_DIR([m4])
|
| ... |
... |
@@ -164,8 +164,16 @@ AC_REPLACE_FUNCS([reallocarray strcasecmp strcasestr strlcat strlcpy strndup\ |
|
164
|
164
|
timingsafe_memcmp])
|
|
165
|
165
|
AM_CONDITIONAL(POLL, [test "x$ac_cv_func_poll" = "xyes"])
|
|
166
|
166
|
|
|
167
|
|
-AC_CHECK_LIB([bsd], [arc4random_buf])
|
|
168
|
|
-AC_CHECK_FUNCS([arc4random_buf])
|
|
|
167
|
+# Checks for non-standard functions and fallback to libbsd if we can
|
|
|
168
|
+# We only check for arc4random_buf, because if we have that, we don't
|
|
|
169
|
+# need/use getentropy.
|
|
|
170
|
+AC_LINK_IFELSE([AC_LANG_CALL([], [arc4random_buf])],
|
|
|
171
|
+ [TRY_LIBBSD="no"], [TRY_LIBBSD="yes"])
|
|
|
172
|
+AS_IF([test "x$TRY_LIBBSD" = "xyes"],
|
|
|
173
|
+ [PKG_CHECK_MODULES([LIBBSD], [libbsd-overlay], [
|
|
|
174
|
+ CFLAGS="$CFLAGS $LIBBSD_CFLAGS"
|
|
|
175
|
+ LIBS="$LIBS $LIBBSD_LIBS"
|
|
|
176
|
+], [:])])
|
|
169
|
177
|
|
|
170
|
178
|
AC_CHECK_DECLS([program_invocation_short_name], [], [], [[#include <errno.h>]])
|
|
171
|
179
|
|
debian/changelog
|
|
1
|
+xorg-server (2:21.1.9-1) unstable; urgency=medium
|
|
|
2
|
+
|
|
|
3
|
+ * New upstream release.
|
|
|
4
|
+ - CVE-2023-5367
|
|
|
5
|
+ - CVE-2023-5380
|
|
|
6
|
+ - CVE-2023-5574
|
|
|
7
|
+
|
|
|
8
|
+ -- Timo Aaltonen <tjaalton@debian.org> Wed, 25 Oct 2023 10:43:00 +0300
|
|
|
9
|
+
|
|
1
|
10
|
xorg-server (2:21.1.8-1) unstable; urgency=medium
|
|
2
|
11
|
|
|
3
|
12
|
* patches: Drop an obsolete patch. (Closes: #1034413)
|
dix/enterleave.h
| ... |
... |
@@ -58,8 +58,6 @@ extern void DeviceFocusEvent(DeviceIntPtr dev, |
|
58
|
58
|
|
|
59
|
59
|
extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode);
|
|
60
|
60
|
|
|
61
|
|
-extern void LeaveWindow(DeviceIntPtr dev);
|
|
62
|
|
-
|
|
63
|
61
|
extern void CoreFocusEvent(DeviceIntPtr kbd,
|
|
64
|
62
|
int type, int mode, int detail, WindowPtr pWin);
|
|
65
|
63
|
|
include/eventstr.h
| ... |
... |
@@ -335,4 +335,7 @@ union _InternalEvent { |
|
335
|
335
|
GestureEvent gesture_event;
|
|
336
|
336
|
};
|
|
337
|
337
|
|
|
|
338
|
+extern void
|
|
|
339
|
+LeaveWindow(DeviceIntPtr dev);
|
|
|
340
|
+
|
|
338
|
341
|
#endif |
include/os.h
| ... |
... |
@@ -50,16 +50,13 @@ SOFTWARE. |
|
50
|
50
|
#include "misc.h"
|
|
51
|
51
|
#include <stdarg.h>
|
|
52
|
52
|
#include <stdint.h>
|
|
|
53
|
+#if defined(HAVE_REALLOCARRAY)
|
|
|
54
|
+#include <stdlib.h> /* for reallocarray */
|
|
|
55
|
+#endif
|
|
53
|
56
|
#include <string.h>
|
|
54
|
57
|
#ifdef MONOTONIC_CLOCK
|
|
55
|
58
|
#include <time.h>
|
|
56
|
59
|
#endif
|
|
57
|
|
-#if defined(HAVE_LIBBSD) && defined(HAVE_REALLOCARRAY)
|
|
58
|
|
-#include <bsd/stdlib.h> /* for reallocarray */
|
|
59
|
|
-#endif
|
|
60
|
|
-#if defined(HAVE_LIBBSD) && defined(HAVE_STRLCPY)
|
|
61
|
|
-#include <bsd/string.h> /* for strlcpy, strlcat */
|
|
62
|
|
-#endif
|
|
63
|
60
|
|
|
64
|
61
|
#define SCREEN_SAVER_ON 0
|
|
65
|
62
|
#define SCREEN_SAVER_OFF 1
|
meson.build
| ... |
... |
@@ -3,10 +3,10 @@ project('xserver', 'c', |
|
3
|
3
|
'buildtype=debugoptimized',
|
|
4
|
4
|
'c_std=gnu99',
|
|
5
|
5
|
],
|
|
6
|
|
- version: '21.1.8',
|
|
|
6
|
+ version: '21.1.9',
|
|
7
|
7
|
meson_version: '>= 0.47.0',
|
|
8
|
8
|
)
|
|
9
|
|
-release_date = '2023-03-29'
|
|
|
9
|
+release_date = '2023-10-25'
|
|
10
|
10
|
|
|
11
|
11
|
add_project_arguments('-DHAVE_DIX_CONFIG_H', language: ['c', 'objc'])
|
|
12
|
12
|
cc = meson.get_compiler('c')
|
| ... |
... |
@@ -96,7 +96,7 @@ applewmproto_dep = dependency('applewmproto', version: '>= 1.4', fallback: ['xor |
|
96
|
96
|
xshmfence_dep = dependency('xshmfence', version: '>= 1.1', required: false)
|
|
97
|
97
|
|
|
98
|
98
|
pixman_dep = dependency('pixman-1')
|
|
99
|
|
-libbsd_dep = dependency('libbsd', required: false)
|
|
|
99
|
+libbsd_dep = dependency('libbsd-overlay', required: false)
|
|
100
|
100
|
xkbcomp_dep = dependency('xkbcomp', required: false)
|
|
101
|
101
|
xkbfile_dep = dependency('xkbfile')
|
|
102
|
102
|
xfont2_dep = dependency('xfont2', version: '>= 2.0')
|
mi/mipointer.c
| ... |
... |
@@ -397,8 +397,21 @@ miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y) |
|
397
|
397
|
#ifdef PANORAMIX
|
|
398
|
398
|
&& noPanoramiXExtension
|
|
399
|
399
|
#endif
|
|
400
|
|
- )
|
|
401
|
|
- UpdateSpriteForScreen(pDev, pScreen);
|
|
|
400
|
+ ) {
|
|
|
401
|
+ DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER);
|
|
|
402
|
+ /* Hack for CVE-2023-5380: if we're moving
|
|
|
403
|
+ * screens PointerWindows[] keeps referring to the
|
|
|
404
|
+ * old window. If that gets destroyed we have a UAF
|
|
|
405
|
+ * bug later. Only happens when jumping from a window
|
|
|
406
|
+ * to the root window on the other screen.
|
|
|
407
|
+ * Enter/Leave events are incorrect for that case but
|
|
|
408
|
+ * too niche to fix.
|
|
|
409
|
+ */
|
|
|
410
|
+ LeaveWindow(pDev);
|
|
|
411
|
+ if (master)
|
|
|
412
|
+ LeaveWindow(master);
|
|
|
413
|
+ UpdateSpriteForScreen(pDev, pScreen);
|
|
|
414
|
+ }
|
|
402
|
415
|
}
|
|
403
|
416
|
|
|
404
|
417
|
/**
|
os/auth.c
| ... |
... |
@@ -46,9 +46,7 @@ from The Open Group. |
|
46
|
46
|
#ifdef WIN32
|
|
47
|
47
|
#include <X11/Xw32defs.h>
|
|
48
|
48
|
#endif
|
|
49
|
|
-#ifdef HAVE_LIBBSD
|
|
50
|
|
-#include <bsd/stdlib.h> /* for arc4random_buf() */
|
|
51
|
|
-#endif
|
|
|
49
|
+#include <stdlib.h> /* for arc4random_buf() */
|
|
52
|
50
|
|
|
53
|
51
|
struct protocol {
|
|
54
|
52
|
unsigned short name_length;
|
present/present_event.c
| ... |
... |
@@ -102,7 +102,8 @@ present_event_swap(xGenericEvent *from, xGenericEvent *to) |
|
102
|
102
|
}
|
|
103
|
103
|
|
|
104
|
104
|
void
|
|
105
|
|
-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling)
|
|
|
105
|
+present_send_config_notify(WindowPtr window, int x, int y, int w, int h,
|
|
|
106
|
+ int bw, WindowPtr sibling, CARD32 flags)
|
|
106
|
107
|
{
|
|
107
|
108
|
present_window_priv_ptr window_priv = present_window_priv(window);
|
|
108
|
109
|
|
| ... |
... |
@@ -122,7 +123,7 @@ present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, |
|
122
|
123
|
.off_y = 0,
|
|
123
|
124
|
.pixmap_width = w,
|
|
124
|
125
|
.pixmap_height = h,
|
|
125
|
|
- .pixmap_flags = 0
|
|
|
126
|
+ .pixmap_flags = flags
|
|
126
|
127
|
};
|
|
127
|
128
|
present_event_ptr event;
|
|
128
|
129
|
|
present/present_priv.h
| ... |
... |
@@ -43,6 +43,11 @@ |
|
43
|
43
|
#define DebugPresent(x)
|
|
44
|
44
|
#endif
|
|
45
|
45
|
|
|
|
46
|
+/* XXX this belongs in presentproto */
|
|
|
47
|
+#ifndef PresentWindowDestroyed
|
|
|
48
|
+#define PresentWindowDestroyed (1 << 0)
|
|
|
49
|
+#endif
|
|
|
50
|
+
|
|
46
|
51
|
extern int present_request;
|
|
47
|
52
|
|
|
48
|
53
|
extern DevPrivateKeyRec present_screen_private_key;
|
| ... |
... |
@@ -307,7 +312,7 @@ void |
|
307
|
312
|
present_free_events(WindowPtr window);
|
|
308
|
313
|
|
|
309
|
314
|
void
|
|
310
|
|
-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling);
|
|
|
315
|
+present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling, CARD32 flags);
|
|
311
|
316
|
|
|
312
|
317
|
void
|
|
313
|
318
|
present_send_complete_notify(WindowPtr window, CARD8 kind, CARD8 mode, CARD32 serial, uint64_t ust, uint64_t msc);
|
present/present_screen.c
| ... |
... |
@@ -93,6 +93,15 @@ present_destroy_window(WindowPtr window) |
|
93
|
93
|
present_screen_priv_ptr screen_priv = present_screen_priv(screen);
|
|
94
|
94
|
present_window_priv_ptr window_priv = present_window_priv(window);
|
|
95
|
95
|
|
|
|
96
|
+ present_send_config_notify(window,
|
|
|
97
|
+ window->drawable.x,
|
|
|
98
|
+ window->drawable.y,
|
|
|
99
|
+ window->drawable.width,
|
|
|
100
|
+ window->drawable.height,
|
|
|
101
|
+ window->borderWidth,
|
|
|
102
|
+ window->nextSib,
|
|
|
103
|
+ PresentWindowDestroyed);
|
|
|
104
|
+
|
|
96
|
105
|
if (window_priv) {
|
|
97
|
106
|
present_clear_window_notifies(window);
|
|
98
|
107
|
present_free_events(window);
|
| ... |
... |
@@ -123,7 +132,7 @@ present_config_notify(WindowPtr window, |
|
123
|
132
|
ScreenPtr screen = window->drawable.pScreen;
|
|
124
|
133
|
present_screen_priv_ptr screen_priv = present_screen_priv(screen);
|
|
125
|
134
|
|
|
126
|
|
- present_send_config_notify(window, x, y, w, h, bw, sibling);
|
|
|
135
|
+ present_send_config_notify(window, x, y, w, h, bw, sibling, 0);
|
|
127
|
136
|
|
|
128
|
137
|
unwrap(screen_priv, screen, ConfigNotify);
|
|
129
|
138
|
if (screen->ConfigNotify)
|
randr/rrproperty.c
| ... |
... |
@@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type, |
|
209
|
209
|
RRDestroyOutputProperty(prop);
|
|
210
|
210
|
return BadAlloc;
|
|
211
|
211
|
}
|
|
212
|
|
- new_value.size = len;
|
|
|
212
|
+ new_value.size = total_len;
|
|
213
|
213
|
new_value.type = type;
|
|
214
|
214
|
new_value.format = format;
|
|
215
|
215
|
|
| ... |
... |
@@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type, |
|
226
|
226
|
case PropModePrepend:
|
|
227
|
227
|
new_data = new_value.data;
|
|
228
|
228
|
old_data = (void *) (((char *) new_value.data) +
|
|
229
|
|
- (prop_value->size * size_in_bytes));
|
|
|
229
|
+ (len * size_in_bytes));
|
|
230
|
230
|
break;
|
|
231
|
231
|
}
|
|
232
|
232
|
if (new_data)
|
|