[Git][xorg-team/wayland/xwayland][upstream-unstable] 10 commits: glamor: fixes GL_INVALID

Timo Aaltonen pushed to branch upstream-unstable at X Strike Force / wayland / xwayland

Commits:

2bd43be9

by Konstantin at 2023-10-12T09:38:17+02:00

glamor: fixes GL_INVALID_ENUM errors on ES if there is no quads

If there is no quads to draw, then we have a possibility to call
glDrawElements with type as zero, which will generate
GL_INVALID_ENUM error. While this error is harmless, it is annoying.

Signed-off-by: Konstantin <ria.freelander@gmail.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit baaddf47d593b51d215d836a796b95a3cb14a220)

c9a842e6

by Michel Dänzer at 2023-10-12T09:38:52+02:00

xwayland/present: Handle NULL window_priv in xwl_present_cleanup

This can happen if the window has never completed a Present operation.

Fixes: 42301760802e ("xwayland/present: Embed present_vblank_rec in xwl_present_event")
(cherry picked from commit 32c5b2c044604c5b1039035fd1f320c33988a2e3)

4f8e209d

by José Expósito at 2023-10-12T09:39:31+02:00

xwayland/glamor/gbm: Set GBM_BO_USE_LINEAR if only LINEAR modifier is supported

Some drivers might not support explicit format modifiers. On these
drivers `gbm_bo_create_with_modifiers()` will fail and the
`gbm_bo_create()` code path will be used instead.

In this case, if the LINEAR modifier is advertised (and the INVALID
modifier is not) add the `GBM_BO_USE_LINEAR` flag.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1438
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
Signed-off-by: José Expósito's avatarJosé Expósito <jexposit@redhat.com>
(cherry picked from commit 287638db59d0938ceb263fcef1bf0c28eefb2033)

10353a01

by Olivier Fourdan at 2023-10-12T09:39:37+02:00

xwayland: Add an option to enable EI portal support

With EI support wired to XTEST, and oeffis being enabled unconditionally
means that Xwayland will always go through the XDG portal for XTEST when
supported.

While this the intended behavior for the general use case of Xwayland
running rootless on a desktop compositor, that breaks when Xwayland is
running on a nested compositor, because the portal is for the entire
session and not limited to the nested Wayland compositor.

Xwayland itself, as a regular Wayland client, has no way to tell that it
is running on a nested compositor.

So to keep backward compatibility with existing (and also common) use
cases such as nested compositors, best is to disable support for the XDG
portal by default, and add a new command line option "-enable-ei-portal"
for the Wayland compositors (who spawn Xwayland rootless) to explicitly
enable support for the input emulation XDG portal in Xwayland.

A Wayland compositor running nested should not use that command line
option with Xwayland.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Joshua Ashton <joshua@froggi.es>
Fixes: a1333342 - xwayland: Add XTEST support using EIS
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1586
See-also: https://gitlab.gnome.org/GNOME/mutter/-/issues/3047
(cherry picked from commit cfcbb075c23fc668e84a381c9c2c165a95798cf4)

07c18c90

by Olivier Fourdan at 2023-10-12T09:39:41+02:00

xwayland: Give up on EI on setup failure

If we fail to setup EI, give up on using EI for XTEST and restore the
default XTEST handlers.

This happens when neither the portal nor the socket backends are usable.

This does not affect the portal operation though, if the user choose not
to allow a particular client, Xwayland would continue to use EI.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Joshua Ashton <joshua@froggi.es>
(cherry picked from commit 6b56ae68e5476bdda00a6c5f4e2311a13b3d12cc)

cc79b2a8

by Jeffy Chen at 2023-10-12T09:39:54+02:00

glamor: xv: Fix invalid accessing of plane attributes for NV12

NV12 only has 2 planes.

Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
(cherry picked from commit 0076671e24670f1ddb151946e490497f171589f0)

4f8a851b

by Olivier Fourdan at 2023-10-12T09:40:04+02:00

xwayland: Cancel the EI disconnect timer when freed

Xwayland maintains a connection to EI up for 10 minutes after an X11
client has vanished, to avoid going through the connection phase every
time a short lived X11 client comes and goes.

However, if the EI client gets freed (through some other event, e.g. the
user decides to terminate the EI session), Xwayland would still keep the
callback alive and end up trying to free an already freed EI client:

 Invalid read of size 4
    at 0x4C5E6F9: object_unref (util-object.h:89)
    by 0x4C5E6F9: ei_unref (libei.c:77)
    by 0x429525: free_ei (xwayland-xtest.c:224)
    by 0x429A6E: disconnect_timer_cb (xwayland-xtest.c:404)
    by 0x5E63FF: DoTimer (WaitFor.c:276)
    by 0x5E6463: DoTimers (WaitFor.c:290)
    by 0x5E6164: check_timers (WaitFor.c:133)
    by 0x5E61E9: WaitForSomething (WaitFor.c:195)
    by 0x4AD50E: Dispatch (dispatch.c:487)
    by 0x4BBA0B: dix_main (main.c:272)
    by 0x43615D: main (stubmain.c:34)
  Address 0x15cc6ee8 is 8 bytes inside a block of size 240 free'd
    at 0x48452AC: free (vg_replace_malloc.c:974)
    by 0x4C5E729: object_destroy (util-object.h:73)
    by 0x4C5E729: object_unref (util-object.h:91)
    by 0x4C5E729: ei_unref (libei.c:77)
    by 0x429525: free_ei (xwayland-xtest.c:224)
    by 0x42A946: xwl_handle_ei_event (xwayland-xtest.c:804)
    by 0x5EA977: HandleNotifyFd (connection.c:809)
    by 0x5EE8E3: ospoll_wait (ospoll.c:657)
    by 0x5E624D: WaitForSomething (WaitFor.c:208)
    by 0x4AD50E: Dispatch (dispatch.c:487)
    by 0x4BBA0B: dix_main (main.c:272)
    by 0x43615D: main (stubmain.c:34)
  Block was alloc'd at
    at 0x484782C: calloc (vg_replace_malloc.c:1554)
    by 0x4C5E777: ei_create (libei.c:73)
    by 0x4C5E777: ei_create_context (libei.c:97)
    by 0x42994B: setup_ei (xwayland-xtest.c:366)
    by 0x42A383: xwayland_xtest_send_events (xwayland-xtest.c:658)
    by 0x54ED4C: ProcXTestFakeInput (xtest.c:441)
    by 0x54EE56: ProcXTestDispatch (xtest.c:475)
    by 0x4AD6E6: Dispatch (dispatch.c:546)
    by 0x4BBA0B: dix_main (main.c:272)
    by 0x43615D: main (stubmain.c:34)

To avoid that issue, make sure to cancel the timer as soon as a EI
client is freed.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
See-also: https://bugzilla.redhat.com/2243076
(cherry picked from commit 9617de733becb04f547191570978dcbc449bb11e)

829a9911

by Sam James at 2023-10-23T23:45:09-04:00

Switch to libbsd-overlay

This is more portable than libbsd as everything Just Works, even on BSD systems,
and is the recommended method of consuming libbsd nowadays.

It also helpfully lets things work with glibc-provided functions for new
enough glibc.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/973
Co-authored-by: Guillem Jover <guillem@hadrons.org>
Signed-off-by: Sam James <sam@gentoo.org>
(cherry picked from commit 94945a52746ee2612c6cd394692f49e2ed5fc56b)

1e847845

by Peter Hutterer at 2023-10-25T11:49:11+10:00

Xi/randr: fix handling of PropModeAppend/Prepend

The handling of appending/prepending properties was incorrect, with at
least two bugs: the property length was set to the length of the new
part only, i.e. appending or prepending N elements to a property with P
existing elements always resulted in the property having N elements
instead of N + P.

Second, when pre-pending a value to a property, the offset for the old
values was incorrect, leaving the new property with potentially
uninitalized values and/or resulting in OOB memory writes.
For example, prepending a 3 element value to a 5 element property would
result in this 8 value array:
  [N, N, N, ?, ?, P, P, P ] P, P
                            ^OOB write

The XI2 code is a copy/paste of the RandR code, so the bug exists in
both.

CVE-2023-5367, ZDI-CAN-22153

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 541ab2ecd41d4d8689e71855d93e492bc554719a)

e4487cae

by Peter Hutterer at 2023-10-25T11:52:55+10:00

Bump version to 23.2.2

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

Changes:

Xi/xiproperty.c

@@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
                  XIDestroyDeviceProperty(prop);
              return BadAlloc;
+         }
 -        new_value.size = len;
 +        new_value.size = total_len;
          new_value.type = type;
          new_value.format = format;
@@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
          case PropModePrepend:
              new_data = new_value.data;
              old_data = (void *) (((char *) new_value.data) +
 -                                  (prop_value->size * size_in_bytes));
 +                                  (len * size_in_bytes));
              break;
+         }
          if (new_data)

glamor/glamor.c

@@ -307,6 +307,10 @@ glamor_gldrawarrays_quads_using_indices(glamor_screen_private *glamor_priv,
+ {
      unsigned i;
 +    /* If there is no quads to draw, just exit */
 +    if (count == 0)
 +        return;
++
      /* For a single quad, don't bother with an index buffer. */
      if (count ==  1)
          goto fallback;

glamor/glamor_xv.c

@@ -291,10 +291,10 @@ glamor_xv_query_image_attributes(int id,
              pitches[0] = size;
          size *= *h;
          if (offsets)
 -            offsets[1] = offsets[2] = size;
 +            offsets[1] = size;
          tmp = ALIGN(*w, 4);
          if (pitches)
 -            pitches[1] = pitches[2] = tmp;
 +            pitches[1] = tmp;
          tmp *= (*h >> 1);
          size += tmp;
          break;

hw/xwayland/man/Xwayland.man

@@ -61,6 +61,15 @@ backend first, then fallback to the GBM backend if EGLStream is not supported
  by the Wayland server. Without this option, \fIXwayland\fP tries the GBM
  backend first, and fallback to EGLStream if GBM is not usable.
  .TP 8
 +.B \-enable-ei-portal
 +Enable support for the XDG portal for input emulation.
++
 +A Wayland compositor running nested should not use that command line
 +option with Xwayland.
++
 +This option has no effect if the compositor doesn't support the relevant
 +XDG portal or if Xwayland was not compiled with EI and OEFFIS support.
 +.TP 8
  .B \-fullscreen
  Set the Xwayland window fullscreen when running rootful.

hw/xwayland/meson.build

@@ -186,6 +186,7 @@ xwayland_vars = [
      'have_fullscreen=true',
      'have_host_grab=true',
      'have_decorate=' + have_libdecor.to_string(),
 +    'have_enable_ei_portal=' + build_ei_portal.to_string(),
      'have_byteswappedclients=true',
+ ]

hw/xwayland/xwayland-glamor-gbm.c

@@ -284,6 +284,8 @@ xwl_glamor_gbm_create_pixmap_internal(struct xwl_screen *xwl_screen,
      struct xwl_gbm_private *xwl_gbm = xwl_gbm_get(xwl_screen);
      struct gbm_bo *bo = NULL;
      PixmapPtr pixmap = NULL;
 +    uint32_t num_modifiers = 0;
 +    uint64_t *modifiers = NULL;
      if (width > 0 && height > 0 && depth >= 15 &&
          (hint == CREATE_PIXMAP_USAGE_BACKING_PIXMAP ||
@@ -294,8 +296,6 @@ xwl_glamor_gbm_create_pixmap_internal(struct xwl_screen *xwl_screen,
  #ifdef GBM_BO_WITH_MODIFIERS
          if (xwl_gbm->dmabuf_capable) {
 -            uint32_t num_modifiers = 0;
 -            uint64_t *modifiers = NULL;
              Bool supports_scanout = FALSE;
              if (drawable) {
@@ -324,7 +324,6 @@ xwl_glamor_gbm_create_pixmap_internal(struct xwl_screen *xwl_screen,
                                                    format, modifiers, num_modifiers);
  #endif
+             }
 -            free(modifiers);
+         }
  #endif
          if (bo == NULL) {
@@ -332,6 +331,22 @@ xwl_glamor_gbm_create_pixmap_internal(struct xwl_screen *xwl_screen,
              implicit = TRUE;
              if (implicit_scanout)
                  usage |= GBM_BO_USE_SCANOUT;
++
 +            if (num_modifiers > 0) {
 +                Bool has_mod_invalid = FALSE, has_mod_linear = FALSE;
 +                int i;
++
 +                for (i = 0; i < num_modifiers; i++) {
 +                    if (modifiers[i] == DRM_FORMAT_MOD_INVALID)
 +                        has_mod_invalid = TRUE;
 +                    else if (modifiers[i] == DRM_FORMAT_MOD_LINEAR)
 +                        has_mod_linear = TRUE;
 +                }
++
 +                if (!has_mod_invalid && has_mod_linear)
 +                    usage |= GBM_BO_USE_LINEAR;
 +            }
++
              bo = gbm_bo_create(xwl_gbm->gbm, width, height, format, usage);
+         }
@@ -350,6 +365,7 @@ xwl_glamor_gbm_create_pixmap_internal(struct xwl_screen *xwl_screen,
      if (!pixmap)
          pixmap = glamor_create_pixmap(xwl_screen->screen, width, height, depth, hint);
 +    free(modifiers);
      return pixmap;
+ }

hw/xwayland/xwayland-present.c

@@ -414,9 +414,11 @@ xwl_present_cleanup(WindowPtr window)
          xwl_present_window->sync_callback = NULL;
+     }
 -    /* Clear remaining events */
 -    xorg_list_for_each_entry_safe(event, tmp, &window_priv->vblank, vblank.window_list)
 -        xwl_present_free_event(event);
 +    if (window_priv) {
 +        /* Clear remaining events */
 +        xorg_list_for_each_entry_safe(event, tmp, &window_priv->vblank, vblank.window_list)
 +            xwl_present_free_event(event);
 +    }
      /* Clear timer */
      xwl_present_free_timer(xwl_present_window);

hw/xwayland/xwayland-screen.c

@@ -812,6 +812,13 @@ xwl_screen_init(ScreenPtr pScreen, int argc, char **argv)
              use_fixed_size = 1;
  #else
              ErrorF("This build does not have libdecor support\n");
 +#endif
 +        }
 +        else if (strcmp(argv[i], "-enable-ei-portal") == 0) {
 +#ifdef XWL_HAS_EI_PORTAL
 +            xwl_screen->enable_ei_portal = 1;
 +#else
 +            ErrorF("This build does not have XDG portal support\n");
  #endif
+         }
+     }

hw/xwayland/xwayland-screen.h

@@ -67,6 +67,7 @@ struct xwl_screen {
      int host_grab;
      int has_grab;
      int decorate;
 +    int enable_ei_portal;
      CreateScreenResourcesProcPtr CreateScreenResources;
      CloseScreenProcPtr CloseScreen;

hw/xwayland/xwayland-xtest.c

@@ -200,6 +200,7 @@ free_ei(struct xwl_ei_client *xwl_ei_client)
      struct xwl_abs_device *abs, *tmp;
      ClientPtr client = xwl_ei_client->client;
 +    TimerCancel(xwl_ei_client->disconnect_timer);
      xorg_list_del(&xwl_ei_client->link);
      debug_ei("Removing EI fd=%d\n", xwl_ei_client->ei_fd);
@@ -334,12 +335,14 @@ setup_ei_from_socket(struct xwl_ei_client *xwl_ei_client)
  static struct xwl_ei_client *
  setup_ei(ClientPtr client)
+ {
 +    ScreenPtr pScreen = screenInfo.screens[0];
      struct xwl_ei_client *xwl_ei_client = NULL;
 +    struct xwl_screen *xwl_screen = xwl_screen_get(pScreen);
      struct ei *ei = NULL;
      char buffer[PATH_MAX];
      const char *cmdname;
      char *client_name = NULL;
 -    bool status;
 +    bool status = false;
      cmdname = GetClientCmdName(client);
      if (cmdname) {
@@ -375,7 +378,8 @@ setup_ei(ClientPtr client)
      xorg_list_init(&xwl_ei_client->pending_emulated_events);
      xorg_list_init(&xwl_ei_client->abs_devices);
 -    status = setup_oeffis(xwl_ei_client);
 +    if (xwl_screen->enable_ei_portal)
 +        status = setup_oeffis(xwl_ei_client);
      if (!status)
          status = setup_ei_from_socket(xwl_ei_client);
@@ -384,6 +388,8 @@ setup_ei(ClientPtr client)
          xwl_ei_client = NULL;
          ei_unref(ei);
          error_ei("EI setup failed\n");
 +        /* We failed to setup EI using either backends, give up on EI. */
 +        xwayland_restore_xtest();
+     }
   out:

hw/xwayland/xwayland.c

@@ -109,6 +109,9 @@ ddxUseMsg(void)
  #ifdef XWL_HAS_LIBDECOR
      ErrorF("-decorate              add decorations to Xwayland when rootful\n");
  #endif
 +#ifdef XWL_HAS_EI_PORTAL
 +    ErrorF("-enable-ei-portal      use the XDG portal for input emulation\n");
 +#endif
+ }
  static int init_fd = -1;
@@ -246,6 +249,9 @@ ddxProcessArgument(int argc, char *argv[], int i)
      else if (strcmp(argv[i], "-decorate") == 0) {
          return 1;
+     }
 +    else if (strcmp(argv[i], "-enable-ei-portal") == 0) {
 +        return 1;
 +    }
      return 0;
+ }

include/os.h

@@ -50,16 +50,13 @@ SOFTWARE.
  #include "misc.h"
  #include <stdarg.h>
  #include <stdint.h>
 +#if defined(HAVE_REALLOCARRAY)
 +#include <stdlib.h>       /* for reallocarray */
 +#endif
  #include <string.h>
  #ifdef MONOTONIC_CLOCK
  #include <time.h>
  #endif
 -#if defined(HAVE_LIBBSD) && defined(HAVE_REALLOCARRAY)
 -#include <bsd/stdlib.h>       /* for reallocarray */
 -#endif
 -#if defined(HAVE_LIBBSD) && defined(HAVE_STRLCPY)
 -#include <bsd/string.h>       /* for strlcpy, strlcat */
 -#endif
  #define SCREEN_SAVER_ON   0
  #define SCREEN_SAVER_OFF  1

meson.build

@@ -3,10 +3,10 @@ project('xwayland', 'c',
              'buildtype=debugoptimized',
              'c_std=gnu99',
          ],
 -        version: '23.2.1',
 +        version: '23.2.2',
          meson_version: '>= 0.52.0',
+ )
 -release_date = '2023-09-20'
 +release_date = '2023-10-25'
  add_project_arguments('-DHAVE_DIX_CONFIG_H', language: ['c', 'objc'])
  cc = meson.get_compiler('c')
@@ -94,7 +94,7 @@ xshmfence_dep = dependency('xshmfence', version: '>= 1.1', required: false)
  xwaylandproto_dep = dependency('xwaylandproto', version: '>= 1.0', fallback: ['xorgproto', 'ext_xorgproto'], required: false)
  pixman_dep = dependency('pixman-1')
 -libbsd_dep = dependency('libbsd', required: false)
 +libbsd_dep = dependency('libbsd-overlay', required: false)
  xkbcomp_dep = dependency('xkbcomp', required: false)
  xkbfile_dep = dependency('xkbfile')
  xfont2_dep = dependency('xfont2', version: '>= 2.0')

os/auth.c

@@ -46,9 +46,7 @@ from The Open Group.
  #ifdef WIN32
  #include    <X11/Xw32defs.h>
  #endif
 -#ifdef HAVE_LIBBSD
 -#include   <bsd/stdlib.h>       /* for arc4random_buf() */
 -#endif
 +#include   <stdlib.h>       /* for arc4random_buf() */
  struct protocol {
      unsigned short name_length;

randr/rrproperty.c

@@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
                  RRDestroyOutputProperty(prop);
              return BadAlloc;
+         }
 -        new_value.size = len;
 +        new_value.size = total_len;
          new_value.type = type;
          new_value.format = format;
@@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
          case PropModePrepend:
              new_data = new_value.data;
              old_data = (void *) (((char *) new_value.data) +
 -                                  (prop_value->size * size_in_bytes));
 +                                  (len * size_in_bytes));
              break;
+         }
          if (new_data)

[Git][xorg-team/wayland/xwayland][upstream-unstable] 10 commits: glamor: fixes GL_INVALID_ENUM errors on ES if there is no quads

Timo Aaltonen pushed to branch upstream-unstable at X Strike Force / wayland / xwayland

Commits:

15 changed files:

Changes: