[Git][xorg-team/xserver/xorg-server][debian-unstable] 39 commits: modesetting: Fix dirty updates for sw rotation

Emilio Pozuelo Monfort pushed to branch debian-unstable at X Strike Force / xserver / xorg-server

Commits:

3bda7d11

by Patrik Jakobsson at 2025-02-05T15:02:23+01:00

modesetting: Fix dirty updates for sw rotation

Rotation is broken for all drm drivers not providing hardware rotation
support. Drivers that give direct access to vram and not needing dirty
updates still work but only by accident. The problem is caused by
modesetting not sending the correct fb_id to drmModeDirtyFB() and
passing the damage rects in the rotated state and not as the crtc
expects them. This patch takes care of both problems.

Signed-off-by: Patrik Jakobsson <pjakobsson@suse.de>
(cherry picked from commit db9e9d45e8ba73510f11eb9e534c176102f6623e)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

743f66d6

by Olivier Fourdan at 2025-02-05T15:02:23+01:00

glamor: Fix possible double-free

If glamor_link_glsl_prog() fails, we may jump to the failed code path
which frees the variable vs_prog_string and fs_prog_string.

But those variables were already freed just before, so in that case we
end up freeing the memory twice.

Simply move the free at the end of the success code path so we are sure
to free the values only once, either in the successful of failed code
paths.

Fixes: 2906ee5e4 - glamor: Fix leak in glamor_build_program()
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
(cherry picked from commit 34ea020344ef5f2ea8ffce78c7e1abd6436b21ec)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

de2e2e8d

by Peter Hutterer at 2025-02-05T15:02:23+01:00

dix: don't push the XKB state to a non-existing master keyboard

If our master keyboard is disabled, GetMaster() returns NULL and
we segfault in XkbPushLockedStateToSlaves().

Fixes 45fb3a934dc0db51584aba37c2f9d73deff9191d
Fixes #1611

(cherry picked from commit 9b983fecf999b9f50946973f2379a5ce00491cad)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

f241e4f8

by Peter Hutterer at 2025-02-05T15:02:23+01:00

Xi: when removing a master search for a disabled paired device

If either the master pointer or keyboard was disabled, the respective
GetMaster() call returns NULL, causing a segfault later accessing the
deviceid.

Fix this by looking in the off_devices list for any master
device of the type we're looking for. Master devices lose the pairing
when disabled (on enabling a keyboard we simply pair with the first
available unpaired pointer).

And for readability, split the device we get from the protocol request
into a new "dev" variable instead of re-using ptr.

Fixes #1611

(cherry picked from commit e7c876ab0b0daa546a23d4ef82537fdf8fd88e04)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

ac48573a

by Olivier Fourdan at 2025-02-05T15:02:23+01:00

os: Fix NULL pointer dereference

RemoveHost() can be called from DisableLocalHost() with a NULL client,
but doesn't actually check whether the given client pointer is valid on
error and assigns the error value unconditionally, leading to a possible
NULL pointer dereference and a crash of the Xserver.

To avoid the issue, simply check whether the client pointer is not NULL
prior to assign the errorValue.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1752
See-also: https://bugzilla.redhat.com/2313799
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
(cherry picked from commit 57a446c0f98693bd2e0263e91213344d870f4e03)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

e38c23e5

by Tj at 2025-02-05T15:02:23+01:00

xfree86: fbdevhw: fix pci detection on recent Linux

Linux kernel v6.9 has changed the symlink to point to the parent device. This
breaks fbdev_open() detection logic. Change it to use the subsystem symlink
instead which will remain stable.

Kernel v6.8:

[    14.067] (II) fbdev_open() sysfs_path=/sys/class/graphics/fb0
[    14.067] (II) fbdev_open() buf=../../devices/platform/vesa-framebuffer.0/graphics/fb0

Kernel v6.9:

[    15.609] (II) fbdev_open() sysfs_path=/sys/class/graphics/fb0
[    15.609] (II) fbdev_open() buf=../../devices/pci0000:00/0000:00:01.0/vesa-framebuffer.0/graphics/fb0

Originally found in automated Debian ISO QA testing [0] and confirmed in Linux [1].

Tested on kernels v6.9.7 and v6.8.12

[0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1075713
[1] https://lore.kernel.org/lkml/lLyvPFC_APGHNfyGNHRpQy5izBikkaTPOpHooZIT3fFAoJPquSI31ZMueA99XTdr8ysir3X7O7IMdc6za-0m79vr_claeparHhoRouVgHOI=@proton.me/

Fixes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1714
Signed-off-by: Tj <tj.iam.tj@proton.me>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Enrico Weigelt, metux IT consult <info@metux.net>
(cherry picked from commit 728b54528d37ffa27b07c9b181c5ed8d2d359379)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

cbc2c654

by Alan Coopersmith at 2025-02-05T15:02:23+01:00

os: NextDPMSTimeout: mark intentional fallthroughs in switch

The comment at the top of the function tells humans the fallthroughs
are intentional, but gcc doesn't parse that.

Clears 3 -Wimplicit-fallthrough warnings from gcc 14.1

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit b306df5a6060beea82b5157c3603593527b220b0)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

23b3b719

by Alan Coopersmith at 2025-02-05T15:02:23+01:00

xfree86: avoid memory leak on realloc failure

Found by Oracle Parfait 13.3 static analyzer:
   Memory leak [memory-leak]:
      Memory leak of pointer optname allocated with asprintf(&optname,
      "\"%s\"", p->name)
        at line 326 of hw/xfree86/common/xf86Configure.c in function
	'configureDeviceSection'.
          optname allocated at line 309 with asprintf(&optname, "\"%s\"",
	  p->name)

Fixes: code inherited from XFree86
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit fa711c486a2c2c958c71d7bd8ac0efe552558717)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

cec3e55e

by Alan Coopersmith at 2025-02-05T15:02:23+01:00

Xi: avoid NULL pointer dereference if GetXTestDevice returns NULL

The comments in that function say "This only happens if master is a
slave device. don't do that" but static analysis doesn't respect that.

Found by Oracle Parfait 13.3:
   Null pointer dereference [null-pointer-deref]:
      Read from null pointer XTestptr
        at line 274 of Xi/xichangehierarchy.c in function 'remove_master'.
          Null pointer introduced at line 691 of Xext/xtest.c in function
	   'GetXTestDevice'.
          Function GetXTestDevice may return constant 'NULL' at line 691,
	   called at line 273 of Xi/xichangehierarchy.c in function
	   'remove_master'.
   Null pointer dereference [null-pointer-deref]:
      Read from null pointer XTestkeybd
        at line 279 of Xi/xichangehierarchy.c in function 'remove_master'.
          Null pointer introduced at line 691 of Xext/xtest.c in function
	   'GetXTestDevice'.
          Function GetXTestDevice may return constant 'NULL' at line 691,
	   called at line 278 of Xi/xichangehierarchy.c in function
	   'remove_master'.

Fixes: 0814f511d ("input: store the master device's ID in the devPrivate for XTest devices.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit d10589cc09c68ad09bebd3a4155c44d1b8f2614b)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

5406ddd0

by Alan Coopersmith at 2025-02-05T15:02:23+01:00

render: avoid NULL pointer dereference if PictureFindVisual returns NULL

Found by Oracle Parfait 13.3:
   Null pointer dereference [null-pointer-deref]:
      Read from null pointer pVisual
        at line 257 of dix/colormap.c in function 'CreateColormap'.
          Null pointer introduced at line 412 of render/picture.c in
	   function 'PictureFindVisual'.
          Constant 'NULL' passed into function CreateColormap, argument
	   pVisual, from call at line 431 in function
	   'PictureInitIndexedFormat'.
          Function PictureFindVisual may return constant 'NULL' at
	   line 412, called at line 429.

Fixes: d4a101d4e ("Integration of DAMAGE-XFIXES branch to trunk")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 7af077dd2f939b76e7d6ba84250368b6649fb777)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

abfd0215

by Alan Coopersmith at 2025-02-05T15:02:23+01:00

dix: fix button offset when generating DeviceButtonStateNotify events

Found by Oracle Parfait 13.3 static analyzer:
   Buffer Overflow in STD C function [buffer-overflow-call-stdc]:
      Buffer overflow in call to memcpy. Buffer &bev->buttons[4] of
       size 24 is written at an offset of 28
      Array size is 28 bytes, index is 32
        at line 743 of dix/enterleave.c in function
	 'DeliverStateNotifyEvent'.

Fixes: a85f0d6b9 ("Xi: fix use of button->down - bitflags instead of int arrays.")
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 4b073d65bb5e1f4accb7ed280c8926134582b7ab)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

fbb636bf

by Alan Coopersmith at 2025-02-05T15:02:23+01:00

dix: limit checks to MAX_VALUATORS when generating Xi events

Previously, it was looping through sizeof(ev->valuators.mask) * 8
valuators, where valuators.mask is defined as an array of
(MAX_VALUATORS + 7) / 8 entries.  Since MAX_VALUATORS is defined as 36,
this made it actually loop through 40 entries.  The last 4 bits in this
array should never be set, so we should never access memory outside the
bounds of the arrays defined to be exactly MAX_VALUATORS in length, but
we can make the static analyzer happier and not waste time checking bits
that should never be set.

Found by Oracle Parfait 13.3 static analyzer:

   Read outside array bounds [read-outside-array-bounds]:
      In array dereference of ev->valuators.data[i] with index i
      Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
        at line 741 of dix/eventconvert.c in function 'eventToDeviceEvent'.

   Read outside array bounds [read-outside-array-bounds]:
      In array dereference of ev->valuators.data[i] with index i
      Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
        at line 808 of dix/eventconvert.c in function 'eventToRawEvent'.

   Read outside array bounds [read-outside-array-bounds]:
      In array dereference of ev->valuators.data_raw[i] with index i
      Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
        at line 809 of dix/eventconvert.c in function 'eventToRawEvent'.

Fixes: b2ba77bac ("dix: add EventToXI2 and GetXI2Type.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit b65eea43dd18cdf6d389b7f82ee55ae764c3bf31)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

309ec5a4

by Alan Coopersmith at 2025-02-05T15:02:23+01:00

modesetting: avoid memory leak when ms_present_check_unflip() returns FALSE

Found by Oracle Parfait 13.3 static analyzer:
   Memory leak [memory-leak]:
      Memory leak of pointer event allocated with calloc(1, 16)
        at line 470 of hw/xfree86/drivers/modesetting/present.c in
	function 'ms_present_unflip'.
          event allocated at line 431 with calloc(1, 16)
          event leaks when ms_present_check_unflip(...) == 0 at line 438
              and i >= config->num_crtc at line 445

Fixes: 13c7d53df ("modesetting: Implement page flipping support for Present.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit bf63d9b34ef3a24427f884f66a387119dd5cdb8c)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

6115eb1f

by Olivier Fourdan at 2025-02-05T15:02:24+01:00

xkb: Always use MAP_LENGTH keymap size

Generating the modifier modmap, the helper function generate_modkeymap()
would check the entire range up to the MAP_LENGTH.

However, the given keymap might have less keycodes than MAP_LENGTH, in
which case we would go beyond the size of the modmap, as reported by
ASAN:

==ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1 at 0x5110001c225b thread T0
    #0 0x5e7369393873 in generate_modkeymap ../dix/inpututils.c:309
    #1 0x5e736930dcce in ProcGetModifierMapping ../dix/devices.c:1794
    #2 0x5e7369336489 in Dispatch ../dix/dispatch.c:550
    #3 0x5e736934407d in dix_main ../dix/main.c:275
    #5 0x7e46d47b2ecb in __libc_start_main
    #6 0x5e73691be324 in _start (xserver/build/hw/xwayland/Xwayland)

Address is located 0 bytes after 219-byte region
allocated by thread T0 here:
    #0 0x7e46d4cfc542 in realloc
    #1 0x5e73695aa90e in _XkbCopyClientMap ../xkb/xkbUtils.c:1142
    #2 0x5e73695aa90e in XkbCopyKeymap ../xkb/xkbUtils.c:1966
    #3 0x5e73695b1b2f in XkbDeviceApplyKeymap ../xkb/xkbUtils.c:2023
    #4 0x5e73691c6c18 in keyboard_handle_keymap ../hw/xwayland/xwayland-input.c:1194

As MAP_LENGTH is used in various code paths where the max keycode might
not be easily available, best is to always use MAP_LENGTH to allocate the
keymaps so that the code never run past the buffer size.

If the max key code is smaller than the MAP_LENGTH limit, fill-in the gap
with zeros.

That also simplifies the code slightly as we do not constantly need to
reallocate the keymap to adjust to the max key code size.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1780
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
(cherry picked from commit 92bcebfd7e248f695503c0a6e7bee80be4c96834)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

e183b62e

by Olivier Fourdan at 2025-02-05T15:02:24+01:00

os/connection: Make sure partial is initialized

Following the change in Xtrans 1.5 that allows for partial connections
to succeed, we need to make sure partial is properly initialized at
first, otherwise we rely on an uninitialized variable.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Suggested-by: Twaik Yont <twaikyont@gmail.com>
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1783
(cherry picked from commit 080fb49eff4de7ec3a29214994d1403e4d877f6a)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>

a651eefc

by Daniel Kahn Gillmor at 2025-02-06T17:53:16+00:00

autotools: enable static use of Nettle for SHA1

Debian builds xserver 21 using autotools.

When debian builds xserver-xorg for constrained environments like the
installer, it wants to build against the static library of libnettle
for SHA1, see debian/patches/03_static-nettle.diff in the debian
repository at
https://salsa.debian.org/xorg-team/xserver/xorg-server.git

This modification of configure.ac makes it possible to build static
nettle when needed, while preserving the build to use nettle with a
dynamic library when passing a different configuration option.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1756>

0c6a7750

by Doug Brown at 2025-02-25T10:42:21+01:00

dri2: Protect against dri2ClientPrivate assertion failures

If DRI2ScreenInit hasn't been called yet, DRI2Authenticate and
DRI2CreateDrawable2 cause the X server to crash. This has been observed
to happen on multiple modern Linux distros in various conditions,
including QEMU and VMware VMs. Make these functions more robust in order
to prevent the crash.

This patch was originally provided by Bernhard Übelacker and expanded
upon by Mark Wagner.

Signed-off-by: Doug Brown <doug@schmorgal.com>
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1053
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1534
(cherry picked from commit a0834009cfb10b8982a1f2b47b8ed00de254c2c3)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1824>

32887f6c

by Olivier Fourdan at 2025-02-25T19:35:55+01:00

test: Fix xsync test

The xsync test is relying on the values being changed even in the case
of a BadMatch value.

Typically, it updates the delta but does not update the test type
comparison, so when passing a negative value, it generates a BadMatch.

That's actually not correct, and that will fail with the new fixes that
check the validity of the values prior to apply the changes.

Fix the test by updating the test type as needed.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
(cherry picked from commit 05e54fefafbcec11d847b9f8127bcd4820a20625)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>

9e5ac777