Commit Graph

19400 Commits

Author SHA1 Message Date
Povilas Kanapickas f7d2e810ba ci: Adjust prefix instead of setting DESTDIR for meson-dist job
This ensures that the pkg-config files installed to
xserver-tarball/install will have correct paths. This is needed so that
xf86-driver-build-test will be able to reuse this installation of
xserver. It will be passed to that job via artifacts (subsequent
commits)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1806>
2025-03-03 14:10:17 +00:00
Povilas Kanapickas 8d1fa6acde ci: Point to last commit of xf86-video-qxl instead of master branch
This ensures that the tests don't start failing silently after new
commits are added to the QXL driver.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1806>
2025-03-03 14:10:17 +00:00
Enrico Weigelt, metux IT consult af86c5cbc2 Xnest: use authorative declarations from X11/XKBlib.h
Better use the headers from the library we're linking against,
instead of having our own private declarations.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1842>
2025-02-28 17:27:05 +00:00
Enrico Weigelt, metux IT consult cab3856903 xfree86: os-support: fix FTBS when no recent enough libdrm found
On Linux, the only supported platform bus backend (*1) is via DRM/DRI.
Trying to build it w/o (recent enough) libdrm fails as it tries to
compile the drm-based implementation, w/o having drm.h available. (*2)

In order to fix this, we need to compile noop-implementation instead.

*1) platform specific code for detecting video devices
*2) https://gitlab.freedesktop.org/xorg/xserver/-/issues/1771

Issue: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1771
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1848>
2025-02-28 16:15:32 +00:00
Enrico Weigelt, metux IT consult e2ac461629 xfree86: platform_noop: add missing functions
In order to be able to build on Linux w/ platform_noop
(when no recent enough libdrm found), a few more dummy functions
are needed here.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1848>
2025-02-28 16:15:32 +00:00
Enrico Weigelt, metux IT consult fe9c911e22 xfree86: xf86helper: fix NULL dereference
xf86MatchDevice() can segfault if screensecptr->device is NULL.

Issue: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1767
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1847>
2025-02-28 16:41:09 +01:00
Enrico Weigelt, metux IT consult 628e94b164 os: let vpnprintf() accept %X
Several pieces of the code, as well as drivers are using %X, which
we don't support, so leading to error messages like this:

[2025-02-27 14:28:44] BUG: 'if (f[f_idx])'
[2025-02-27 14:28:44] BUG: ../xserver/os/log.c:538 in vpnprintf()
[2025-02-27 14:28:44] Unsupported printf directive 'X'
[2025-02-27 14:28:44]
[2025-02-27 14:28:44] Backtrace:
[2025-02-27 14:28:44] unw_get_proc_name failed: no unwind info found [-10]
[2025-02-27 14:28:44] 0: /usr/lib/Xorg (?+0x0) [0x5f4d1261bc47]
[2025-02-27 14:28:44] 1: /usr/lib/Xorg (LogVHdrMessageVerb+0x10f) [0x5f4d1261ca3f]
[2025-02-27 14:28:44] 2: /usr/lib/Xorg (LogHdrMessageVerb+0x85) [0x5f4d1261cae5]
[2025-02-27 14:28:44] 3: /usr/lib/Xorg (xf86VDrvMsgVerb+0x54) [0x5f4d12636604]
[2025-02-27 14:28:44] 4: /usr/lib/Xorg (xf86DrvMsg+0x97) [0x5f4d126367d7]
[2025-02-27 14:28:44] 5: /usr/lib/Xorg (xf86PrintEDID+0x545) [0x5f4d12654315]
[2025-02-27 14:28:44] 6: /usr/lib/Xorg (xf86OutputSetEDID+0x1bd) [0x5f4d12657e0d]

In the longer run, we'll have to decide whether we actually want to
implement the upper-case directive or change all callers to lower-case.

But for now it's better to just accept %X and interpret it as lower-case,
in order to fix those error messages. Whether it's printed as upper or
lower case is more or less an aesthetic matter.

Reported-By: guido iodice <guido.iodice@gmail.com>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1846>
2025-02-28 12:51:44 +01:00
Enrico Weigelt, metux IT consult 53876f1ef1 randr: fix RRGetCrtcTransform reply length, part 2
Mixed up reply vs request. Obviously, the size substracted from reply
struct's one has to be the one of the generic reply, not generic requst :o

Background: the meaning of the length field isn't entirely intuitive.

a) the size is in 4-byte units, instead of bytes (therefore passing through
   bytes_to_int32() call)
b) it's not the total packet size, but only the *extra* payload size, ergo:
   how much is the packet longer than a xGenericReply = 8 units = 32 bytes.
   (min. packet size is 32 bytes -> length = 0)

In order to prevent those kind of coding errors ever happening again, it might
be a good idea putting that into a generic macro.

Fixes: c6f1b8a735
Fixes: 0ca5aaba50
Issue: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1797
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1845>
2025-02-27 12:18:20 +00:00
Enrico Weigelt, metux IT consult fe156104cf Revert "mi: drop obsolete miInitOverlay()"
This reverts commit 12ab2e314b.

Requested by Nvidia - their proprietary driver still needs it.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1843>
2025-02-27 11:53:54 +00:00
Enrico Weigelt, metux IT consult 41a75f01cc Revert "mi: drop obsolete miOverlayGetPrivateClips()"
This reverts commit 2c21824ee9.

Requested by Nvidia - their proprietary driver still needs it.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1843>
2025-02-27 11:53:54 +00:00
Enrico Weigelt, metux IT consult ab95b569e1 Revert "mi: drop obsolete miOverlayCollectUnderlayRegions()"
This reverts commit a860ce2c9f.

Requested by Nvidia - their proprietary driver still needs it.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1843>
2025-02-27 11:53:54 +00:00
Enrico Weigelt, metux IT consult 4cdc184c13 Revert "mi: drop obsolete miOverlayComputeCompositeClip()"
This reverts commit bfb69b7316.

Requested by Nvidia - their proprietary driver still needs it.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1843>
2025-02-27 11:53:54 +00:00
Enrico Weigelt, metux IT consult 9d88cc5f11 Revert "mi: drop obsolete miOverlayCopyUnderlay()"
This reverts commit be6985948d.

Requested by Nvidia - their proprietary driver still needs it.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1843>
2025-02-27 11:53:54 +00:00
Enrico Weigelt, metux IT consult d4f92a5688 Revert "mi: drop obsolete miOverlaySetRootClip()"
This reverts commit 00796cbf8c.

Requested by Nvidia - their proprietary driver still needs it.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1843>
2025-02-27 11:53:54 +00:00
Enrico Weigelt, metux IT consult 0463d7aaaa Revert "mi: drop now obsolete mioverlay.c"
This reverts commit 65b738ed60.

Requested by Nvidia - their proprietary driver still needs it.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1843>
2025-02-27 11:53:54 +00:00
Enrico Weigelt, metux IT consult f1d87a38ae Revert "mi: drop now obsolete mioverlay.h"
This reverts commit 6825f89cd2.

Requested by Nvidia - their proprietary driver still needs it.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1843>
2025-02-27 11:53:54 +00:00
Enrico Weigelt, metux IT consult 0ca5aaba50 randr: fix RRGetCrtcTransform reply length
Reply length field missed to add the payload's size.

Fixes: c6f1b8a735
Issue: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1797
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1844>
2025-02-26 19:05:41 +01:00
Enrico Weigelt, metux IT consult a0c1eeea98 xkb: simplify loops in XkbRF_Free()
Make the code a bit easier to read by simplifying the loops.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult abfbc76824 xkb: drop obsolete parameter from XkbRF_Free()
The freeRules parameter is always set to TRUE, meaning always free the
XkbRF_RulesRec struct. Therefore also no need to clear out fields that
aren't going to be reused again, ever.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult a88b17565b xkb: maprules: use static struct init instead of memset()
Allow the compiler to figure out the most efficient way to do the
struct initialization, and a little improvement on code readability.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult ffd7ca8af2 xkb: maprules: put some loop counters into local scope
Prevent from being accidentially removed and making the code a
little bit easier to understand.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult 60d37d0158 xkb: make XkbRF_Create() static inline
The function is nothing more than a calloc() call, so we can spare
an actual function call here by making it static inline.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult a82fa00835 xkb: unexport XkbRF_RuleRec struct
Not used outside xkb, so no need to keep it in public API header.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult 83c8a90a61 xkb: unexport XkbRF_GroupRec struct
Not used outside xkb, so no need to keep it in public API header.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult 043dc8041c xkb: unexport XkbRF_RulesRec struct
Not used by any drivers, so no need to keep it in public header.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult 34372cb3da xkb: unexport XkbRF_Free()
Only used inside xkb/* - not used by any modules, so no need
to keep maintaining it in public headers.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult 89475cbed4 xkb: unexport XkbRF_Create()
Only used inside xkb/* - not used by any modules, so no need
to keep maintaining it in public headers.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult c376cd2c3d xkb: unexport XkbRF_LoadRules()
Only used inside xkb/* - not used by any modules, so no need
to keep maintaining it in public headers.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult d3b328ba4a xkb: unexport XkbRF_GetComponents()
Only used inside xkb/* - not used by any modules, so no need
to keep maintaining it in public headers.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult b535fd7a4c xkb: move XkbRF_* defines into xkb/maprules.c
Only used there so no need to keep them in public API header.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult 1a9592ea4b xkb: move _XKB_RF_NAMES_PROP_ATOM define into xkbInit.c
It's only used there, nowhere else, so no need to keep it in
a public API header.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult 5030f23f94 xkb: drop unused XkbRF_Invalid define from xkbrules.h
Not used anywhere, so no need to keep it in public interface.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult 975aed300e xkb: drop unused _XKB_RF_NAMES_PROP_MAXLEN define
Not used anywhere, so no need to keep it in public header.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult e38eeb4718 xkb: drop unused XkbRF_LoadRulesByName()
Not used anywhere, so no need to keep it around any longer.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1840>
2025-02-26 13:43:52 +00:00
Enrico Weigelt, metux IT consult 00843efafb Xext: drop disable flag for GE extension
There's really no practical use for disabling GEEext, would just
cause the Xserver misbehaviour (eg. missing byte swapping)

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1812>
2025-02-26 13:34:19 +00:00
Enrico Weigelt, metux IT consult a7401945c4 dix: add prefix to grab state value defines
make it a bit easier to diffenciate from other symbols by
adding a prefix to their names.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1837>
2025-02-26 13:24:41 +00:00
Enrico Weigelt, metux IT consult 5f6cb45ac3 dix: unexport defines for device grab states
These aren't used anywhere in modules or outside DIX & XI, so
no need to keep them in public API any longer.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1837>
2025-02-26 13:24:41 +00:00
Alan Coopersmith 42a1f25faf xkb: Add tbGetBufferString helper function
Handles common case of allocating & copying string to temporary buffer

(cherry picked from xorg/lib/libxkbfile@8a91517ca6ea77633476595b0eb5b213357c60e5)

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1821>
2025-02-26 13:15:34 +00:00
Martin Burggraf 7a23010232 xkb: correcting mathematical nonsense in XkbGeomFPText
Fixes formatting of negative numbers, so they don't show minus sign
after the decimal point.

(cherry picked from xorg/lib/libxkbfile@d2ec504fec2550f4fd046e801b34317ef4a4bab9)

Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1821>
2025-02-26 13:15:34 +00:00
Alan Coopersmith 60419d8e4a xkb: Convert more sprintf calls to snprintf in xkbtext.c
Based on xorg/lib/libxkbfile@390acfe5bb88cdab509b5eaae4041f265e969d2b

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1821>
2025-02-26 13:15:34 +00:00
José Expósito 6d33834186 xkb: Check that needed is > 0 in XkbResizeKeyActions
Passing a negative value in `needed` to the `XkbResizeKeyActions()`
function can create a `newActs` array of an unespected size.
Check the value and return if it is invalid.

This error has been found by a static analysis tool. This is the report:

    Error: OVERRUN (CWE-119):
    libX11-1.8.7/src/xkb/XKBMAlloc.c:811: cond_const:
      Checking "xkb->server->size_acts == 0" implies that
      "xkb->server->size_acts" is 0 on the true branch.
    libX11-1.8.7/src/xkb/XKBMAlloc.c:811: buffer_alloc:
      "calloc" allocates 8 bytes dictated by parameters
      "(size_t)((xkb->server->size_acts == 0) ? 1 : xkb->server->size_acts)"
      and "8UL".
    libX11-1.8.7/src/xkb/XKBMAlloc.c:811: var_assign:
      Assigning: "newActs" = "calloc((size_t)((xkb->server->size_acts == 0) ? 1 : xkb->server->size_acts), 8UL)".
    libX11-1.8.7/src/xkb/XKBMAlloc.c:815: assignment:
      Assigning: "nActs" = "1".
    libX11-1.8.7/src/xkb/XKBMAlloc.c:829: cond_at_least:
      Checking "nCopy > 0" implies that "nCopy" is at least 1 on the
      true branch.
    libX11-1.8.7/src/xkb/XKBMAlloc.c:830: overrun-buffer-arg:
      Overrunning buffer pointed to by "&newActs[nActs]" of 8 bytes by
      passing it to a function which accesses it at byte offset 15
      using argument "nCopy * 8UL" (which evaluates to 8).
    #  828|
    #  829|           if (nCopy > 0)
    #  830|->             memcpy(&newActs[nActs], XkbKeyActionsPtr(xkb, i),
    #  831|                      nCopy * sizeof(XkbAction));
    #  832|           if (nCopy < nKeyActs)

(cherry picked from xorg/lib/libx11@af1312d2873d2ce49b18708a5029895aed477392)

Signed-off-by: José Expósito <jexposit@redhat.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1821>
2025-02-26 13:15:34 +00:00
Alan Coopersmith 09c6f09eb7 xkb: ensure XkbAllocNames sets num_rg to 0 on allocation failure
If there was a previous radio_groups array which we failed to realloc
and freed instead, clear the array size in the XkbNamesRec.

Taken from xorg/lib/libx11@258a8ced681dc1bc50396be7439fce23f9807e2a

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1821>
2025-02-26 13:15:34 +00:00
Michel Dänzer f73f8ccb60 ci: Install XCB dependencies for meson tests
The lack of these prevented some of the tests from running in CI.
2025-02-26 09:57:07 +01:00
Peter Hutterer 68c17477d2 mi: guard miPointer functions against NULL dereferences
Already in place for some functions, let's add it to most others.
The only function missing is miPointerSetPosition() which needs to
return the ScreenPtr and that one is unclear if we don't have a screen -
returning NULL will crash the caller(s) so let's wait for something to
trigger this bug before we try to fix it wrongly.

Related to #1782

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1771>
2025-02-26 04:17:03 +00:00
Peter Hutterer acbdd0ecdd mi: don't crash on miPointerGetPosition for disabled devices
If a device is disabled, its master device is forcibly reset to NULL but
unlike a floating device it doesn't have a sprite allocated. Calling
miPointerGetPosition for a disabled device thus crashes.

Avoid this by returning 0/0 for any device without a miPointer.
This is a quick fix only, a proper fix for this issue is rather more
involved.

Closes #1782

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1771>
2025-02-26 04:17:02 +00:00
Olivier Fourdan 05e54fefaf test: Fix xsync test
The xsync test is relying on the values being changed even in the case
of a BadMatch value.

Typically, it updates the delta but does not update the test type
comparison, so when passing a negative value, it generates a BadMatch.

That's actually not correct, and that will fail with the new fixes that
check the validity of the values prior to apply the changes.

Fix the test by updating the test type as needed.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1835>
2025-02-25 19:25:40 +01:00
Olivier Fourdan c285798984 sync: Apply changes last in SyncChangeAlarmAttributes()
SyncChangeAlarmAttributes() would apply the various changes while
checking for errors.

If one of the changes triggers an error, the changes for the trigger,
counter or delta value would remain, possibly leading to inconsistent
changes.

Postpone the actual changes until we're sure nothing else can go wrong.

Related to CVE-2025-26601, ZDI-CAN-25870

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
2025-02-25 16:11:58 +01:00
Olivier Fourdan 8cbc90c881 sync: Do not fail SyncAddTriggerToSyncObject()
We do not want to return a failure at the very last step in
SyncInitTrigger() after having all changes applied.

SyncAddTriggerToSyncObject() must not fail on memory allocation, if the
allocation of the SyncTriggerList fails, trigger a FatalError() instead.

Related to CVE-2025-26601, ZDI-CAN-25870

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
2025-02-25 11:43:01 +01:00
Olivier Fourdan f52cea2f93 sync: Check values before applying changes
In SyncInitTrigger(), we would set the CheckTrigger function before
validating the counter value.

As a result, if the counter value overflowed, we would leave the
function SyncInitTrigger() with the CheckTrigger applied but without
updating the trigger object.

To avoid that issue, move the portion of code checking for the trigger
check value before updating the CheckTrigger function.

Related to CVE-2025-26601, ZDI-CAN-25870

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
2025-02-25 11:43:01 +01:00
Olivier Fourdan 16a1242d0f sync: Do not let sync objects uninitialized
When changing an alarm, the change mask values are evaluated one after
the other, changing the trigger values as requested and eventually,
SyncInitTrigger() is called.

SyncInitTrigger() will evaluate the XSyncCACounter first and may free
the existing sync object.

Other changes are then evaluated and may trigger an error and an early
return, not adding the new sync object.

This can be used to cause a use after free when the alarm eventually
triggers.

To avoid the issue, delete the existing sync object as late as possible
only once we are sure that no further error will cause an early exit.

CVE-2025-26601, ZDI-CAN-25870

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
2025-02-25 11:43:01 +01:00