Xext/panoramiXprocs.c | 70 +++++++++-- Xext/shm.c | 1 Xi/xibarriers.c | 9 - Xi/xiwarppointer.c | 4 configure.ac | 9 - debian/changelog | 5 debian/upstream/signing-key.asc | 77 ++++++------ dix/dispatch.c | 4 glamor/glamor.c | 3 glamor/glamor_copy.c | 21 +-- glamor/glamor_dash.c | 2 glamor/glamor_fbo.c | 4 glamor/glamor_glyphblt.c | 26 ++-- glamor/glamor_largepixmap.c | 11 - glamor/glamor_lines.c | 13 +- glamor/glamor_points.c | 14 +- glamor/glamor_rects.c | 13 +- glamor/glamor_render.c | 5 glamor/glamor_segs.c | 14 +- glamor/glamor_spans.c | 13 +- glamor/glamor_transform.c | 11 + glamor/glamor_transform.h | 2 glamor/glamor_utils.h | 4 glamor/glamor_xv.c | 9 - hw/dmx/dmxinit.c | 63 ---------- hw/dmx/dmxsync.c | 2 hw/dmx/input/usb-keyboard.c | 3 hw/kdrive/ephyr/ephyr.c | 6 hw/kdrive/ephyr/ephyrvideo.c | 5 hw/kdrive/ephyr/hostx.c | 6 hw/xfree86/Makefile.am | 10 - hw/xfree86/common/xf86Init.c | 1 hw/xfree86/common/xf86Xinput.c | 3 hw/xfree86/common/xf86pciBus.c | 2 hw/xfree86/dixmods/Makefile.am | 4 hw/xfree86/dixmods/xkbKillSrv.c | 54 -------- hw/xfree86/dixmods/xkbPrivate.c | 53 -------- hw/xfree86/dixmods/xkbVT.c | 64 ---------- hw/xfree86/dri2/pci_ids/i965_pci_ids.h | 63 +++++++--- hw/xfree86/drivers/modesetting/dri2.c | 74 +++--------- hw/xfree86/drivers/modesetting/driver.c | 5 hw/xfree86/drivers/modesetting/driver.h | 17 ++ hw/xfree86/drivers/modesetting/drmmode_display.c | 66 +++++++++- hw/xfree86/drivers/modesetting/present.c | 25 ---- hw/xfree86/drivers/modesetting/vblank.c | 69 +++++++++-- hw/xfree86/modes/xf86RandR12.c | 139 +++++++++++++++-------- hw/xfree86/os-support/linux/lnx_init.c | 3 hw/xfree86/os-support/shared/posix_tty.c | 3 hw/xfree86/parser/scan.c | 2 hw/xfree86/xkb/Makefile.am | 6 hw/xfree86/xkb/meson.build | 12 + hw/xfree86/xkb/xkbKillSrv.c | 54 ++++++++ hw/xfree86/xkb/xkbPrivate.c | 53 ++++++++ hw/xfree86/xkb/xkbVT.c | 64 ++++++++++ hw/xfree86/xorg-wrapper.c | 3 hw/xquartz/quartz.c | 1 hw/xwayland/drm.xml | 35 +++-- hw/xwayland/xwayland-input.c | 32 +++++ hw/xwayland/xwayland-output.c | 3 hw/xwayland/xwayland.c | 38 +++++- include/xorg-config.h.in | 3 os/io.c | 38 ++++-- os/osinit.c | 1 os/utils.c | 8 + present/present.c | 4 randr/rrcrtc.c | 5 record/record.c | 3 test/Makefile.am | 2 test/signal-logging.c | 2 xkb/xkbtext.c | 42 +++--- 70 files changed, 897 insertions(+), 598 deletions(-)
New commits: commit c4dec70aa8ca949a125e3e8150f667304922d293 Author: Timo Aaltonen <tjaal...@debian.org> Date: Thu Oct 5 10:36:23 2017 +0300 close some bugs diff --git a/debian/changelog b/debian/changelog index eb5770a..0afe3d4 100644 --- a/debian/changelog +++ b/debian/changelog @@ -5,7 +5,7 @@ xorg-server (2:1.19.4-1) UNRELEASED; urgency=medium (Closes: #868876, LP: #1059947). [ Timo Aaltonen ] - * New upstream release. + * New upstream release. (Closes: #855206, #857983, #860886) - CVE-2017-13721, CVE-2017-13723 * rules: Drop dh_strip override, dbgsym transition is done (Closes: #876690). commit 72d2aeda88d5f883c7ad89e6ba5e60a4caa0f655 Author: Timo Aaltonen <tjaal...@debian.org> Date: Thu Oct 5 10:23:27 2017 +0300 fixes two CVE's diff --git a/debian/changelog b/debian/changelog index 4dd3760..eb5770a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -6,6 +6,7 @@ xorg-server (2:1.19.4-1) UNRELEASED; urgency=medium [ Timo Aaltonen ] * New upstream release. + - CVE-2017-13721, CVE-2017-13723 * rules: Drop dh_strip override, dbgsym transition is done (Closes: #876690). * signing-key.asc: Update Adam Jackson's key. commit 2f7fb09988d093bd77e99e61597106908985ac21 Author: Timo Aaltonen <tjaal...@debian.org> Date: Thu Oct 5 10:14:29 2017 +0300 signing-key.asc: Update Adam Jackson's key. diff --git a/debian/changelog b/debian/changelog index 23163d9..4dd3760 100644 --- a/debian/changelog +++ b/debian/changelog @@ -8,6 +8,7 @@ xorg-server (2:1.19.4-1) UNRELEASED; urgency=medium * New upstream release. * rules: Drop dh_strip override, dbgsym transition is done (Closes: #876690). + * signing-key.asc: Update Adam Jackson's key. [ Julien Cristau ] * Restore definition of DEB_HOST_ARCH_OS in debian/rules, lost in dh diff --git a/debian/upstream/signing-key.asc b/debian/upstream/signing-key.asc index 2395a38..0880e35 100644 --- a/debian/upstream/signing-key.asc +++ b/debian/upstream/signing-key.asc @@ -280,43 +280,44 @@ DNOWZJQhmuWMtbOUL2WMkKRPDwJrcbwpt3bc6aZCeAH1SSRLEe9Y+2uLeneTMA== =+xMJ -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP PUBLIC KEY BLOCK----- -Version: GnuPG v1 +Version: GnuPG v2 -mQGiBEDLnMIRBACNlsJkPRfH7RMOn7nirvYN5StKVvwdJa2MFUM3sjoaA11nW+Zw -Yxion4GkbIOtz25R29TcwuAaK1UWhy1Rz6aIOOMOzBeUNGGCvRXF76rKHBHOdSJw -AXEvNa/9rKOIaPL7PBN7Lb4CmrjEbA9gKYtZQD9qQSKcAwyyxszkW1e7TwCg7MbV -Bq5MWlATjOAzXLoSpgyENwMD/jPz53KmwUobbqri2pFhozacl5N93cy7b3pwpTZY -fM50cXVSSshYpqdCr5AoWG/DXNGRixv1DnBKOI2Cv6YAQLntcATHxR8ssemOZHRv -7D0hvWwC3o6GSKdg0rSOtRHfDhEL4IFVmPLZaXIRDZ0/ancrCuQPdZ9mzCi/LQmV -noTeA/kB73zJMYH7Z0TSKv490AMWQHbKVvos8+tXxATlq0Otib+s55LXQocSPjgp -GR5qKzqTn9elg2dyo4GYeAYvGBmhQtBdeYo1rVq2pC6HCzMG79zozL9O25SnDLpj -WoqJB6qHBAd9tlTHzkRxv1Fqr4jfIupNborXbhR25tiYOm72irQcQWRhbSBKYWNr -c29uIDxhamF4QG53bmsubmV0PohhBBMRAgAhAhsDBgsJCAcDAgMVAgMDFgIBAh4B -AheABQJEZNYGAhkBAAoJEFuKLVCg7NDTlj8AoL9RgTs++HaD5w5lYARcE+OB+0Jg -AKDZBhJhVgOsEjeg7atMglFR7s36mrQeQWRhbSBKYWNrc29uIDxhamF4QHJlZGhh -dC5jb20+iGAEExECACAFAkfENSICGwMGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgAAK -CRBbii1QoOzQ0x6CAJ0fevUkaaBcTzKa0lTgfNFQ0E+JwgCfaWy44eNKttn4WWEZ -CTGF+e+zraS0IEFkYW0gSmFja3NvbiA8YWpheEBlbmdyLnNnaS5jb20+iF4EExEC -AB4FAkHB1gECGwMGCwkIBwMCAxUCAwMWAgECHgECF4AACgkQW4otUKDs0NNTOgCg -lu1MOCbysvn68WReXz+v02+y2VkAoL12gktA0TFZnPBk3cweEAwCkUlXtCZBZGFt -IEphY2tzb24gPGFqYXhAd2lsZG9wZW5zb3VyY2UuY29tPoheBBMRAgAeBQJBriSn -AhsDBgsJCAcDAgMVAgMDFgIBAh4BAheAAAoJEFuKLVCg7NDTOe4AnRUJ6FqQLaoY -XWCToQdl/Gry4UNZAJ97YYHMt1FIo1TLCWWozSiG+VtTq7QnQWRhbSBKYWNrc29u -IDxhamF4QGJlbnplZHJpbmUubnduay5uZXQ+iF4EExECAB4FAkRk1eACGwMGCwkI -BwMCAxUCAwMWAgECHgECF4AACgkQW4otUKDs0NN+fwCg2cPLDbAb07gMWBETKTRm -sj34FsAAn0SQ4kuqs9Ms0ZRKDqNQ1YTMwyEHuQINBEDLnNAQCACrbu13VZsigsM6 -8MzfdGQ4x/acO4Vd+Dg/aFj3EhPfXZHRauuJ7gQtWc9Mk2ghTjbqEXj0JILbif95 -IyShdC/fxEYiFybRODR6FHlXj6BFCxZFfqi4mOuaGQ4BeB57g/gW+FSoIPzYU4IY -85KD62qeS37zQEBAAK+mCEboUGfPT0wHrkFtkTObjOg7UTjpBp5/HknUREYo8mLo -WBv7CDlApicmXoqnKfAcFaNY2YLMjklwFHh2i2+6dPbkdWSEpuZhkxIQ/8JlYS6A -2g5DMKcNdmqr4Z6xjk8Fj1SO7ILc9EtR+ACqkqkmlU3m4AUHjdR/4kk7tEJ5DytP -c95JcuJnAAMFB/9KWUqJbdeHs47LJBksZ6tnHArcSG653e9uejtNt5xquJIz2wxb -exMV9Bkzwu9v/A8Vo7px7Bkhh++sBrgpGD4z5Jr+PaWOsw5qrO9OVVgzXkUf2QoD -gw4Hh8m9jpx1s6tNasPsy12OGMJ4a5a1GCGg8F7sPlWLBd491viavDyOWYkKozLH -hXwKlGOec0sCRGeHTiqPinxs29PXaTE7Dl/f2dYgiNzTSWetSx7Sv1H9EX4qxPgc -smdRuGV7k7dIw/J02rcI/Ol4OUORRMY2cgJnb5mNxIxTgTGJysm+MjfPrZnOeDVK -TroAYtas/uirqiNzk7fdIdUdgbOhsAl9n3QZiEYEGBECAAYFAkDLnNAACgkQW4ot -UKDs0NP3CACfS1DKwgN/rB7Ib+RJiuK0F/BQoEYAoOhr0VXCT5dP0Yr1kIad7njC -GBF1 -=bYOv +mQGNBFnVVFMBDACz5+V0s2/JjDuvutBbI4hAO3Zgb8mlny5nM/YgkCCVe79MsOAe +5Kn4Gj+lc8LiwJ4fyYPAWx1FIliryYE4RgpnKhipQhZB/UcvImTHQA4tqIavReyo +H4o5+CbPgRY7XNE2wRWOogWd3WuSeuq/37mu1gORmq3KogzuarjJvffLNL4saA+w +J37BXWhQ3P+eRiyF0qHaozf+bMenqtWEy0n0IQEg5wUS/zGXVlOX3fNhJeskq93a +US0bu3axZL4sxOMKxnhRK0XDziFaiMu/DTj4Y0SWDXgK0owkcc7Ow2eAX52Z+zvw +m9O3nBaQvQV7cUxNwYBmc2WkVts9XBrGT7tZ3HmFAkzB6YyPfdXYT4TpyFLofLVs +JDvpa8iXkOmy22JUuqJlW36Idpmv/2jNkEfiIbby3wwZtONJOD9xNxCmOiVGA59+ +q+Lgs0aCWzomNx07zMOEeVvLOj9ficZhTqfvhZrkPD4iEOKKIpRRjCyDyMa0HTb7 +XAkDYk/NcZe4kQsAEQEAAbQcQWRhbSBKYWNrc29uIDxhamF4QG53bmsubmV0PokB +zgQTAQgAOBYhBJle1cimE46wlh8YR0wJ3YPKqlCyBQJZ1VRTAhsDBQsJCAcCBhUI +CQoLAgQWAgMBAh4BAheAAAoJEEwJ3YPKqlCy6A4L/Ru8dHFdsNKvKtBH9szNgd5d +qcjEVWzw6YZKRTVpqw30O9uTcfuHzjV5ATIVTPEdXLklQficyCb4mGQLwxL2q5kT +YMrGteTwBt4pYExo/DYIEZom3f9+75+OgN1PleXQ9pTYo+Ndw18GsnD/sW04HX2I +IGKY3qUX3qhlxG6zdXsHTTIoCCBXrWepaD/IdA9Nw37tiyaTq2NH/ChcxFN7SuYr +SWpBkPRhcsxKDju7j+s4KzO9f1QYFB2Vi3TbbYLEJ3BJg6AxVoiVe4B9xfl6KfCa +EUjFWMqUprWiOjxNAdRUnfBN3UF2O/BxAtgZMk3RwVGG7fAEkfACkws8G5lcraTu +kHQJBfzdlbbwrQG4020kRRdNihblPHZAWI5PJG5jpdGcqftyD+lRvv4gljHpAg/I +eMK4rHjGANX3uQvcCelNwKf8TPVIDTB5vYvWmnHtRmEQkIeHhrMRzjhZej+uzNDF +FpKPZayGn2uyPLv77aZCQmEs1O1EafWz1+IfBWDUmLkBjQRZ1VRTAQwA5E5W/FDK +wfm+owkPenG0VYoXRfLlrBDvHcewLt04evdygHZZxNdV9Ycpsve9INdEg4nTJHj4 +mf302faUGECtiMKek78mfymzbAXS0kEXc2NoaXtEgFlPhavM4e8PpJ5aAKEsSHnQ +1HMS2KJ4bPbDNSLpWkT4HBDAzsJHOFNDu0Z6TsyG/bA1VLoj0iMC9jL8xWz1lOBN +iAhukMkjHOvmeq4BA2ktH5CUh8qwn8iEyw4sps5RcFKanIeru3sg8SVed4w0oCId +Tw54mSNE3vzGiK9tDk0yhDRq2oFT7ER4r0Cr3ctyAsDPJCwhgVJ2YWAGdHewdfg6 +l1hfsvmO1omjR1SQBSEbw6Ftl6GySd91rsvT9i5+3LiNIpYgYb2L6wNn7cSXc9NF +RXDWtw07P1mRJiRrBHwX1Brro7h9tvFT751F5yWSDdah5dUaqbl0C3cmXMoM+FLv +E0dECfuM/mwOvtvlYzL1htdTSLZRb25dddZ6nTlH3sLkVpd9oZRSd7kdABEBAAGJ +AbYEGAEIACAWIQSZXtXIphOOsJYfGEdMCd2DyqpQsgUCWdVUUwIbDAAKCRBMCd2D +yqpQsjd+C/sHZFFz3zSLBo1sUIHCGl6P2DYHatEoQTP7R8g1kAHd145pAGrvXzR4 +F6T5SgM8t4a04Ia2SJLaptNXpf1pJXKlEpEaCb/oDhB/eCt8sOilcqSojkEmpe7z +1xZY/ePNSzbsXDWTOagTM70UdaxgDand1dxMs2q8+Q3y3xZltXcYDmM48a/mRwe7 +rtPK68v3A54ZbcXojNcIMS1JBk+XcuBbmeI0yfGkcqbO2hiP8W81n1mb96jfZ/wj +QhNzLqI3zxRnFHPiBMLy9tF0odNCRccQ2mbKdV2cfOIF5WKC4lrcyqz3eit2RYdS +W3PPUqS3x2696I40zI2KoFjRn7YcWJ6T+skZPWW5bHCVcUN57v7270IG2MCA6D6a +Rto7m6yUbLNgGadDyIjTQladTN1aKYK/QAsxS4y+EhkAPeaQRvZxBhZEocjIAE0B +D2qzco+dq7IuQHIhXTnGRGEsS0bQdEnpQAoTQMVRo7loR2/XqzCIjkG40JH7Cr/r +gPSRdLLYOLo= +=+H4u -----END PGP PUBLIC KEY BLOCK----- commit 891a2d0343c5ce3b12469d509c800e5d61c8856e Author: Timo Aaltonen <tjaal...@debian.org> Date: Thu Oct 5 10:03:56 2017 +0300 bump the version diff --git a/debian/changelog b/debian/changelog index f17f20e..23163d9 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,10 +1,11 @@ -xorg-server (2:1.19.3-3) UNRELEASED; urgency=medium +xorg-server (2:1.19.4-1) UNRELEASED; urgency=medium [ Sven Joachim ] * xvfb-run: Do not redirect stderr to stdout when running the program (Closes: #868876, LP: #1059947). [ Timo Aaltonen ] + * New upstream release. * rules: Drop dh_strip override, dbgsym transition is done (Closes: #876690). commit ec37e559614cf4eaba67d3ca0693f09fd95a5d57 Author: Adam Jackson <a...@redhat.com> Date: Wed Oct 4 15:29:18 2017 -0400 xserver 1.19.4 Signed-off-by: Adam Jackson <a...@redhat.com> diff --git a/configure.ac b/configure.ac index e078f12..682c655 100644 --- a/configure.ac +++ b/configure.ac @@ -26,9 +26,9 @@ dnl dnl Process this file with autoconf to create configure. AC_PREREQ(2.60) -AC_INIT([xorg-server], 1.19.3, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server) -RELEASE_DATE="2017-03-15" -RELEASE_NAME="Lobster Bisque" +AC_INIT([xorg-server], 1.19.4, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server) +RELEASE_DATE="2017-10-04" +RELEASE_NAME="French Onion Soup" AC_CONFIG_SRCDIR([Makefile.am]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE([foreign dist-bzip2]) commit 12fe3d3e9f494ef84832efe94ba00db92be499b1 Author: Louis-Francis Ratté-Boulianne <l...@collabora.com> Date: Wed Sep 27 01:19:58 2017 -0400 present: Check the whole exec queue on event Later events are sometimes added in front of the queue (e.g. if page flipping fails) so we need to check the whole queue on event. Signed-off-by: Louis-Francis Ratté-Boulianne <l...@collabora.com> Reviewed-by: Michel Dänzer <michel.daen...@amd.com> (cherry picked from commit c2f2b25ab55c67f9f3ad07c02fa746eae7c61196) diff --git a/present/present.c b/present/present.c index c9c68dc..7d428fc 100644 --- a/present/present.c +++ b/present/present.c @@ -543,8 +543,6 @@ present_event_notify(uint64_t event_id, uint64_t ust, uint64_t msc) present_execute(vblank, ust, msc); return; } - if (match < 0) - break; } xorg_list_for_each_entry(vblank, &present_flip_queue, event_queue) { if (vblank->event_id == event_id) { @@ -1007,8 +1005,6 @@ present_abort_vblank(ScreenPtr screen, RRCrtcPtr crtc, uint64_t event_id, uint64 vblank->queued = FALSE; return; } - if (match < 0) - break; } xorg_list_for_each_entry(vblank, &present_flip_queue, event_queue) { if (vblank->event_id == event_id) { commit 388dc1aeac9acf2d51ad5103570beffd81d78b96 Author: Keith Packard <kei...@keithp.com> Date: Fri Sep 29 08:48:33 2017 -0700 xf86-video-modesetting: Add ms_queue_vblank helper [v3] This provides an API wrapper around the kernel interface for queueing a vblank event, simplifying all of the callers. v2: Fix missing '|' in computing vbl.request.type v3: Remove spurious bit of next patch (thanks, Michel Dänzer) Signed-off-by: Keith Packard <kei...@keithp.com> Reviewed-by: Adam Jackson <a...@redhat.com> (cherry picked from commit 677c32bcda98a96585bb1f66b57e0755a157b772) diff --git a/hw/xfree86/drivers/modesetting/dri2.c b/hw/xfree86/drivers/modesetting/dri2.c index 8944ef1..8f44899 100644 --- a/hw/xfree86/drivers/modesetting/dri2.c +++ b/hw/xfree86/drivers/modesetting/dri2.c @@ -695,19 +695,16 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc, { ScreenPtr screen = draw->pScreen; ScrnInfoPtr scrn = xf86ScreenToScrn(screen); - modesettingPtr ms = modesettingPTR(scrn); ms_dri2_frame_event_ptr wait_info; - drmVBlank vbl; int ret; xf86CrtcPtr crtc = ms_dri2_crtc_covering_drawable(draw); - drmmode_crtc_private_ptr drmmode_crtc; CARD64 current_msc, current_ust, request_msc; uint32_t seq; + uint64_t queued_msc; /* Drawable not visible, return immediately */ if (!crtc) goto out_complete; - drmmode_crtc = crtc->driver_private; wait_info = calloc(1, sizeof(*wait_info)); if (!wait_info) @@ -747,13 +744,8 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc, if (current_msc >= target_msc) target_msc = current_msc; - vbl.request.type = (DRM_VBLANK_ABSOLUTE | - DRM_VBLANK_EVENT | - drmmode_crtc->vblank_pipe); - vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, target_msc); - vbl.request.signal = (unsigned long)seq; - ret = drmWaitVBlank(ms->fd, &vbl); + ret = ms_queue_vblank(crtc, MS_QUEUE_ABSOLUTE, target_msc, &queued_msc, seq); if (ret) { static int limit = 5; if (limit) { @@ -766,7 +758,7 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc, goto out_free; } - wait_info->frame = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence); + wait_info->frame = queued_msc; DRI2BlockClient(client, draw); return TRUE; } @@ -775,9 +767,6 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc, * If we get here, target_msc has already passed or we don't have one, * so we queue an event that will satisfy the divisor/remainder equation. */ - vbl.request.type = - DRM_VBLANK_ABSOLUTE | DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe; - request_msc = current_msc - (current_msc % divisor) + remainder; /* @@ -795,11 +784,7 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc, if (!seq) goto out_free; - vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, request_msc); - vbl.request.signal = (unsigned long)seq; - - ret = drmWaitVBlank(ms->fd, &vbl); - if (ret) { + if (!ms_queue_vblank(crtc, MS_QUEUE_ABSOLUTE, request_msc, &queued_msc, seq)) { static int limit = 5; if (limit) { xf86DrvMsg(scrn->scrnIndex, X_WARNING, @@ -811,7 +796,8 @@ ms_dri2_schedule_wait_msc(ClientPtr client, DrawablePtr draw, CARD64 target_msc, goto out_free; } - wait_info->frame = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence); + wait_info->frame = queued_msc; + DRI2BlockClient(client, draw); return TRUE; @@ -839,20 +825,18 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw, { ScreenPtr screen = draw->pScreen; ScrnInfoPtr scrn = xf86ScreenToScrn(screen); - modesettingPtr ms = modesettingPTR(scrn); - drmVBlank vbl; int ret, flip = 0; xf86CrtcPtr crtc = ms_dri2_crtc_covering_drawable(draw); - drmmode_crtc_private_ptr drmmode_crtc; ms_dri2_frame_event_ptr frame_info = NULL; uint64_t current_msc, current_ust; uint64_t request_msc; uint32_t seq; + ms_queue_flag ms_flag = MS_QUEUE_ABSOLUTE; + uint64_t queued_msc; /* Drawable not displayed... just complete the swap */ if (!crtc) goto blit_fallback; - drmmode_crtc = crtc->driver_private; frame_info = calloc(1, sizeof(*frame_info)); if (!frame_info) @@ -878,6 +862,8 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw, ms_dri2_reference_buffer(back); ret = ms_get_crtc_ust_msc(crtc, ¤t_ust, ¤t_msc); + if (ret != Success) + goto blit_fallback; /* Flips need to be submitted one frame before */ if (can_flip(scrn, draw, front, back)) { @@ -892,22 +878,19 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw, if (*target_msc > 0) *target_msc -= flip; + /* If non-pageflipping, but blitting/exchanging, we need to use + * DRM_VBLANK_NEXTONMISS to avoid unreliable timestamping later + * on. + */ + if (flip == 0) + ms_flag |= MS_QUEUE_NEXT_ON_MISS; + /* * If divisor is zero, or current_msc is smaller than target_msc * we just need to make sure target_msc passes before initiating * the swap. */ if (divisor == 0 || current_msc < *target_msc) { - vbl.request.type = (DRM_VBLANK_ABSOLUTE | - DRM_VBLANK_EVENT | - drmmode_crtc->vblank_pipe); - - /* If non-pageflipping, but blitting/exchanging, we need to use - * DRM_VBLANK_NEXTONMISS to avoid unreliable timestamping later - * on. - */ - if (flip == 0) - vbl.request.type |= DRM_VBLANK_NEXTONMISS; /* If target_msc already reached or passed, set it to * current_msc to ensure we return a reasonable value back @@ -922,19 +905,14 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw, if (!seq) goto blit_fallback; - vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, *target_msc); - vbl.request.signal = (unsigned long)seq; - - ret = drmWaitVBlank(ms->fd, &vbl); - if (ret) { + if (!ms_queue_vblank(crtc, ms_flag, *target_msc, &queued_msc, seq)) { xf86DrvMsg(scrn->scrnIndex, X_WARNING, "divisor 0 get vblank counter failed: %s\n", strerror(errno)); goto blit_fallback; } - *target_msc = ms_kernel_msc_to_crtc_msc(crtc, - vbl.reply.sequence + flip); + *target_msc = queued_msc + flip; frame_info->frame = *target_msc; return TRUE; @@ -945,11 +923,6 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw, * and we need to queue an event that will satisfy the divisor/remainder * equation. */ - vbl.request.type = (DRM_VBLANK_ABSOLUTE | - DRM_VBLANK_EVENT | - drmmode_crtc->vblank_pipe); - if (flip == 0) - vbl.request.type |= DRM_VBLANK_NEXTONMISS; request_msc = current_msc - (current_msc % divisor) + remainder; @@ -966,7 +939,6 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw, if (request_msc <= current_msc) request_msc += divisor; - seq = ms_drm_queue_alloc(crtc, frame_info, ms_dri2_frame_event_handler, ms_dri2_frame_event_abort); @@ -974,11 +946,7 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw, goto blit_fallback; /* Account for 1 frame extra pageflip delay if flip > 0 */ - vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, request_msc) - flip; - vbl.request.signal = (unsigned long)seq; - - ret = drmWaitVBlank(ms->fd, &vbl); - if (ret) { + if (!ms_queue_vblank(crtc, ms_flag, request_msc - flip, &queued_msc, seq)) { xf86DrvMsg(scrn->scrnIndex, X_WARNING, "final get vblank counter failed: %s\n", strerror(errno)); @@ -986,7 +954,7 @@ ms_dri2_schedule_swap(ClientPtr client, DrawablePtr draw, } /* Adjust returned value for 1 fame pageflip offset of flip > 0 */ - *target_msc = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence + flip); + *target_msc = queued_msc + flip; frame_info->frame = *target_msc; return TRUE; diff --git a/hw/xfree86/drivers/modesetting/driver.h b/hw/xfree86/drivers/modesetting/driver.h index eee96e5..66034ba 100644 --- a/hw/xfree86/drivers/modesetting/driver.h +++ b/hw/xfree86/drivers/modesetting/driver.h @@ -119,6 +119,10 @@ typedef struct _modesettingRec { Bool dirty_enabled; uint32_t cursor_width, cursor_height; + + Bool has_queue_sequence; + Bool tried_queue_sequence; + } modesettingRec, *modesettingPtr; #define modesettingPTR(p) ((modesettingPtr)((p)->driverPrivate)) @@ -129,6 +133,15 @@ uint32_t ms_drm_queue_alloc(xf86CrtcPtr crtc, ms_drm_handler_proc handler, ms_drm_abort_proc abort); +typedef enum ms_queue_flag { + MS_QUEUE_ABSOLUTE = 0, + MS_QUEUE_RELATIVE = 1, + MS_QUEUE_NEXT_ON_MISS = 2 +} ms_queue_flag; + +Bool ms_queue_vblank(xf86CrtcPtr crtc, ms_queue_flag flags, + uint64_t msc, uint64_t *msc_queued, uint32_t seq); + void ms_drm_abort(ScrnInfoPtr scrn, Bool (*match)(void *data, void *match_data), void *match_data); @@ -140,8 +153,8 @@ xf86CrtcPtr ms_dri2_crtc_covering_drawable(DrawablePtr pDraw); int ms_get_crtc_ust_msc(xf86CrtcPtr crtc, CARD64 *ust, CARD64 *msc); -uint32_t ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect); -uint64_t ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint32_t sequence); +uint64_t ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect); +uint64_t ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint64_t sequence); Bool ms_dri2_screen_init(ScreenPtr screen); diff --git a/hw/xfree86/drivers/modesetting/drmmode_display.c b/hw/xfree86/drivers/modesetting/drmmode_display.c index 53e1cf5..025725a 100644 --- a/hw/xfree86/drivers/modesetting/drmmode_display.c +++ b/hw/xfree86/drivers/modesetting/drmmode_display.c @@ -279,8 +279,6 @@ drmmode_SharedPixmapPresentOnVBlank(PixmapPtr ppix, xf86CrtcPtr crtc, { drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private; msPixmapPrivPtr ppriv = msGetPixmapPriv(drmmode, ppix); - - drmVBlank vbl; struct vblank_event_args *event_args; if (ppix == drmmode_crtc->prime_pixmap) @@ -303,12 +301,7 @@ drmmode_SharedPixmapPresentOnVBlank(PixmapPtr ppix, xf86CrtcPtr crtc, drmmode_SharedPixmapVBlankEventHandler, drmmode_SharedPixmapVBlankEventAbort); - vbl.request.type = - DRM_VBLANK_RELATIVE | DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe; - vbl.request.sequence = 1; - vbl.request.signal = (unsigned long) ppriv->flip_seq; - - return drmWaitVBlank(drmmode->fd, &vbl) >= 0; + return ms_queue_vblank(crtc, MS_QUEUE_RELATIVE, 1, NULL, ppriv->flip_seq); } Bool diff --git a/hw/xfree86/drivers/modesetting/present.c b/hw/xfree86/drivers/modesetting/present.c index 55b622c..67982d7 100644 --- a/hw/xfree86/drivers/modesetting/present.c +++ b/hw/xfree86/drivers/modesetting/present.c @@ -109,13 +109,7 @@ ms_present_queue_vblank(RRCrtcPtr crtc, uint64_t msc) { xf86CrtcPtr xf86_crtc = crtc->devPrivate; - ScreenPtr screen = crtc->pScreen; - ScrnInfoPtr scrn = xf86ScreenToScrn(screen); - modesettingPtr ms = modesettingPTR(scrn); - drmmode_crtc_private_ptr drmmode_crtc = xf86_crtc->driver_private; struct ms_present_vblank_event *event; - drmVBlank vbl; - int ret; uint32_t seq; event = calloc(sizeof(struct ms_present_vblank_event), 1); @@ -130,22 +124,9 @@ ms_present_queue_vblank(RRCrtcPtr crtc, return BadAlloc; } - vbl.request.type = - DRM_VBLANK_ABSOLUTE | DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe; - vbl.request.sequence = ms_crtc_msc_to_kernel_msc(xf86_crtc, msc); - vbl.request.signal = seq; - for (;;) { - ret = drmWaitVBlank(ms->fd, &vbl); - if (!ret) - break; - /* If we hit EBUSY, then try to flush events. If we can't, then - * this is an error. - */ - if (errno != EBUSY || ms_flush_drm_events(screen) < 0) { - ms_drm_abort_seq(scrn, seq); - return BadAlloc; - } - } + if (!ms_queue_vblank(xf86_crtc, MS_QUEUE_ABSOLUTE, msc, NULL, seq)) + return BadAlloc; + DebugPresent(("\t\tmq %lld seq %u msc %llu (hw msc %u)\n", (long long) event_id, seq, (long long) msc, vbl.request.sequence)); diff --git a/hw/xfree86/drivers/modesetting/vblank.c b/hw/xfree86/drivers/modesetting/vblank.c index 8682f4d..31cf0bd 100644 --- a/hw/xfree86/drivers/modesetting/vblank.c +++ b/hw/xfree86/drivers/modesetting/vblank.c @@ -173,7 +173,7 @@ ms_dri2_crtc_covering_drawable(DrawablePtr pDraw) static Bool ms_get_kernel_ust_msc(xf86CrtcPtr crtc, - uint32_t *msc, uint64_t *ust) + uint64_t *msc, uint64_t *ust) { ScreenPtr screen = crtc->randr_crtc->pScreen; ScrnInfoPtr scrn = xf86ScreenToScrn(screen); @@ -198,13 +198,50 @@ ms_get_kernel_ust_msc(xf86CrtcPtr crtc, } } +Bool +ms_queue_vblank(xf86CrtcPtr crtc, ms_queue_flag flags, + uint64_t msc, uint64_t *msc_queued, uint32_t seq) +{ + ScreenPtr screen = crtc->randr_crtc->pScreen; + ScrnInfoPtr scrn = xf86ScreenToScrn(screen); + modesettingPtr ms = modesettingPTR(scrn); + drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private; + drmVBlank vbl; + int ret; + + for (;;) { + /* Queue an event at the specified sequence */ + vbl.request.type = DRM_VBLANK_EVENT | drmmode_crtc->vblank_pipe; + if (flags & MS_QUEUE_RELATIVE) + vbl.request.type |= DRM_VBLANK_RELATIVE; + else + vbl.request.type |= DRM_VBLANK_ABSOLUTE; + if (flags & MS_QUEUE_NEXT_ON_MISS) + vbl.request.type |= DRM_VBLANK_NEXTONMISS; + + vbl.request.sequence = ms_crtc_msc_to_kernel_msc(crtc, msc); + vbl.request.signal = seq; + ret = drmWaitVBlank(ms->fd, &vbl); + if (ret == 0) { + if (msc_queued) + *msc_queued = ms_kernel_msc_to_crtc_msc(crtc, vbl.reply.sequence); + return TRUE; + } + if (errno != EBUSY) { + ms_drm_abort_seq(scrn, msc); + return FALSE; + } + ms_flush_drm_events(screen); + } +} + /** * Convert a 32-bit kernel MSC sequence number to a 64-bit local sequence * number, adding in the vblank_offset and high 32 bits, and dealing * with 64-bit wrapping */ uint64_t -ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint32_t sequence) +ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint64_t sequence) { drmmode_crtc_private_rec *drmmode_crtc = crtc->driver_private; sequence += drmmode_crtc->vblank_offset; @@ -218,7 +255,7 @@ ms_kernel_msc_to_crtc_msc(xf86CrtcPtr crtc, uint32_t sequence) int ms_get_crtc_ust_msc(xf86CrtcPtr crtc, CARD64 *ust, CARD64 *msc) { - uint32_t kernel_msc; + uint64_t kernel_msc; if (!ms_get_kernel_ust_msc(crtc, &kernel_msc, ust)) return BadMatch; @@ -230,13 +267,13 @@ ms_get_crtc_ust_msc(xf86CrtcPtr crtc, CARD64 *ust, CARD64 *msc) #define MAX_VBLANK_OFFSET 1000 /** - * Convert a 64-bit adjusted MSC value into a 32-bit kernel sequence number, - * removing the high 32 bits and subtracting out the vblank_offset term. + * Convert a 64-bit adjusted MSC value into a 64-bit kernel sequence number, + * by subtracting out the vblank_offset term. * * This also updates the vblank_offset when it notices that the value should * change. */ -uint32_t +uint64_t ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect) { drmmode_crtc_private_rec *drmmode_crtc = crtc->driver_private; @@ -257,7 +294,7 @@ ms_crtc_msc_to_kernel_msc(xf86CrtcPtr crtc, uint64_t expect) drmmode_crtc->vblank_offset = 0; } } - return (uint32_t) (expect - drmmode_crtc->vblank_offset); + return (expect - drmmode_crtc->vblank_offset); } /** @@ -375,25 +412,31 @@ ms_drm_abort(ScrnInfoPtr scrn, Bool (*match)(void *data, void *match_data), * drm event queue and calls the handler for it. */ static void -ms_drm_handler(int fd, uint32_t frame, uint32_t sec, uint32_t usec, - void *user_ptr) +ms_drm_sequence_handler(int fd, uint64_t frame, uint64_t ns, uint64_t user_data) { struct ms_drm_queue *q, *tmp; - uint32_t user_data = (uint32_t) (intptr_t) user_ptr; + uint32_t seq = (uint32_t) user_data; xorg_list_for_each_entry_safe(q, tmp, &ms_drm_queue, list) { - if (q->seq == user_data) { + if (q->seq == seq) { uint64_t msc; msc = ms_kernel_msc_to_crtc_msc(q->crtc, frame); xorg_list_del(&q->list); - q->handler(msc, (uint64_t) sec * 1000000 + usec, q->data); + q->handler(msc, ns / 1000, q->data); free(q); break; } } } +static void +ms_drm_handler(int fd, uint32_t frame, uint32_t sec, uint32_t usec, + void *user_ptr) +{ + ms_drm_sequence_handler(fd, frame, ((uint64_t) sec * 1000000 + usec) * 1000, (uint32_t) (uintptr_t) user_ptr); +} + Bool ms_vblank_screen_init(ScreenPtr screen) { commit 8bd33a2db7337b2801fc630a57e36b6aeea219d9 Author: Keith Packard <kei...@keithp.com> Date: Thu Jul 27 10:08:32 2017 -0700 xkb: Handle xkb formated string output safely (CVE-2017-13723) Generating strings for XKB data used a single shared static buffer, which offered several opportunities for errors. Use a ring of resizable buffers instead, to avoid problems when strings end up longer than anticipated. Reviewed-by: Michal Srb <m...@suse.com> Signed-off-by: Keith Packard <kei...@keithp.com> Signed-off-by: Julien Cristau <jcris...@debian.org> (cherry picked from commit 94f11ca5cf011ef123bd222cabeaef6f424d76ac) diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c index ead2b1a..d2a2567 100644 --- a/xkb/xkbtext.c +++ b/xkb/xkbtext.c @@ -47,23 +47,27 @@ /***====================================================================***/ -#define BUFFER_SIZE 512 - -static char textBuffer[BUFFER_SIZE]; -static int tbNext = 0; +#define NUM_BUFFER 8 +static struct textBuffer { + int size; + char *buffer; +} textBuffer[NUM_BUFFER]; +static int textBufferIndex; static char * tbGetBuffer(unsigned size) { - char *rtrn; + struct textBuffer *tb; - if (size >= BUFFER_SIZE) - return NULL; - if ((BUFFER_SIZE - tbNext) <= size) - tbNext = 0; - rtrn = &textBuffer[tbNext]; - tbNext += size; - return rtrn; + tb = &textBuffer[textBufferIndex]; + textBufferIndex = (textBufferIndex + 1) % NUM_BUFFER; + + if (size > tb->size) { + free(tb->buffer); + tb->buffer = xnfalloc(size); + tb->size = size; + } + return tb->buffer; } /***====================================================================***/ @@ -79,8 +83,6 @@ XkbAtomText(Atom atm, unsigned format) int len; len = strlen(atmstr) + 1; - if (len > BUFFER_SIZE) - len = BUFFER_SIZE - 2; rtrn = tbGetBuffer(len); strlcpy(rtrn, atmstr, len); } @@ -128,8 +130,6 @@ XkbVModIndexText(XkbDescPtr xkb, unsigned ndx, unsigned format) len = strlen(tmp) + 1; if (format == XkbCFile) len += 4; - if (len >= BUFFER_SIZE) - len = BUFFER_SIZE - 1; rtrn = tbGetBuffer(len); if (format == XkbCFile) { strcpy(rtrn, "vmod_"); @@ -140,6 +140,8 @@ XkbVModIndexText(XkbDescPtr xkb, unsigned ndx, unsigned format) return rtrn; } +#define VMOD_BUFFER_SIZE 512 + char * XkbVModMaskText(XkbDescPtr xkb, unsigned modMask, unsigned mask, unsigned format) @@ -147,7 +149,7 @@ XkbVModMaskText(XkbDescPtr xkb, register int i, bit; int len; char *mm, *rtrn; - char *str, buf[BUFFER_SIZE]; + char *str, buf[VMOD_BUFFER_SIZE]; if ((modMask == 0) && (mask == 0)) { rtrn = tbGetBuffer(5); @@ -173,7 +175,7 @@ XkbVModMaskText(XkbDescPtr xkb, len = strlen(tmp) + 1 + (str == buf ? 0 : 1); if (format == XkbCFile) len += 4; - if ((str - (buf + len)) <= BUFFER_SIZE) { + if ((str - (buf + len)) <= VMOD_BUFFER_SIZE) { if (str != buf) { if (format == XkbCFile) *str++ = '|'; @@ -199,8 +201,6 @@ XkbVModMaskText(XkbDescPtr xkb, len = 0; if (str) len += strlen(str) + (mm == NULL ? 0 : 1); - if (len >= BUFFER_SIZE) - len = BUFFER_SIZE - 1; rtrn = tbGetBuffer(len + 1); rtrn[0] = '\0'; commit 3094c4c6d879215923f2183ecd048b4f5429b182 Author: Michal Srb <m...@suse.com> Date: Thu Jul 27 11:54:26 2017 +0200 xkb: Escape non-printable characters correctly. XkbStringText escapes non-printable characters using octal numbers. Such escape sequence would be at most 5 characters long ("\0123"), so it reserves 5 bytes in the buffer. Due to char->unsigned int conversion, it would print much longer string for negative numbers. Reviewed-by: Keith Packard <kei...@keithp.com> Signed-off-by: Julien Cristau <jcris...@debian.org> (cherry picked from commit eaf1f72ed8994b708d94ec2de7b1a99f5c4a39b8) diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c index ffbc546..ead2b1a 100644 --- a/xkb/xkbtext.c +++ b/xkb/xkbtext.c @@ -603,7 +603,7 @@ XkbStringText(char *str, unsigned format) } else { *out++ = '0'; - sprintf(out, "%o", *in); + sprintf(out, "%o", (unsigned char) *in); while (*out != '\0') out++; } commit a510fb811100bc27f0bfafe5d073998551161819 Author: Michal Srb <m...@suse.com> Date: Fri Jul 28 16:27:10 2017 +0200 Xext/shm: Validate shmseg resource id (CVE-2017-13721) Otherwise it can belong to a non-existing client and abort X server with FatalError "client not in use", or overwrite existing segment of another existing client. Signed-off-by: Julien Cristau <jcris...@debian.org> (cherry picked from commit b95f25af141d33a65f6f821ea9c003f66a01e1f1) diff --git a/Xext/shm.c b/Xext/shm.c index 1b622e3..c98d4a0 100644 --- a/Xext/shm.c +++ b/Xext/shm.c @@ -1238,6 +1238,7 @@ ProcShmCreateSegment(ClientPtr client) }; REQUEST_SIZE_MATCH(xShmCreateSegmentReq); + LEGAL_NEW_RESOURCE(stuff->shmseg, client); if ((stuff->readOnly != xTrue) && (stuff->readOnly != xFalse)) { client->errorValue = stuff->readOnly; return BadValue; commit 3cea13cc40e2421ebefcf2ee0eb949a7bc4e63fd Author: Adam Jackson <a...@redhat.com> Date: Fri Jun 16 15:44:47 2017 -0400 dmx: Remove some not-very-interesting debug prints gcc/glibc think the snprintf in dmxExecOS() might truncate. Yes, it might, and we also don't care. Just delete all this. Signed-off-by: Adam Jackson <a...@redhat.com> Acked-by: Keith Packard <kei...@keithp.com> (cherry picked from commit d6db66811643d3762716f6b144a7358572216a4f) diff --git a/hw/dmx/dmxinit.c b/hw/dmx/dmxinit.c index 3d394c5..24bb875 100644 --- a/hw/dmx/dmxinit.c +++ b/hw/dmx/dmxinit.c @@ -532,63 +532,6 @@ dmxDisplayInit(DMXScreenInfo * dmxScreen) dmxGetPixmapFormats(dmxScreen); } -/* If this doesn't compile, just add || defined(yoursystem) to the line - * below. This information is to help with bug reports and is not - * critical. */ -#if !defined(_POSIX_SOURCE) -static const char * -dmxExecOS(void) -{ - return ""; -} -#else -#include <sys/utsname.h> -static const char * -dmxExecOS(void) -{ - static char buffer[128]; - static int initialized = 0; - struct utsname u; - - if (!initialized++) { - memset(buffer, 0, sizeof(buffer)); - uname(&u); - snprintf(buffer, sizeof(buffer) - 1, "%s %s %s", - u.sysname, u.release, u.version); - } - return buffer; -} -#endif -