diff --git a/0001-Always-install-vbe-and-int10-sdk-headers.patch b/0001-Always-install-vbe-and-int10-sdk-headers.patch deleted file mode 100644 index c613eb8f9b9a3555d4d2d8cc7d9564481f768e64..0000000000000000000000000000000000000000 --- a/0001-Always-install-vbe-and-int10-sdk-headers.patch +++ /dev/null @@ -1,37 +0,0 @@ -From e96a83d9b1b5a52a41213c7a4840dc96b4f5b06f Mon Sep 17 00:00:00 2001 -From: Adam Jackson -Date: Wed, 15 Aug 2012 12:35:21 -0400 -Subject: [PATCH] Always install vbe and int10 sdk headers - -Signed-off-by: Adam Jackson ---- - hw/xfree86/Makefile.am | 12 ++---------- - 1 file changed, 2 insertions(+), 10 deletions(-) - -diff --git a/hw/xfree86/Makefile.am b/hw/xfree86/Makefile.am -index b876b79..a170b58 100644 ---- a/hw/xfree86/Makefile.am -+++ b/hw/xfree86/Makefile.am -@@ -26,17 +26,9 @@ if VGAHW - VGAHW_SUBDIR = vgahw - endif - --if VBE --VBE_SUBDIR = vbe --endif -- --if INT10MODULE --INT10_SUBDIR = int10 --endif -- --SUBDIRS = common ddc x86emu $(INT10_SUBDIR) os-support parser \ -+SUBDIRS = common ddc x86emu int10 os-support parser \ - ramdac $(VGAHW_SUBDIR) loader modes $(DRI_SUBDIR) \ -- $(DRI2_SUBDIR) . $(VBE_SUBDIR) i2c dixmods xkb \ -+ $(DRI2_SUBDIR) . vbe i2c dixmods xkb \ - fbdevhw shadowfb exa $(XF86UTILS_SUBDIR) doc man \ - $(GLAMOR_EGL_SUBDIR) drivers - --- -2.13.6 - diff --git a/0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch b/0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch deleted file mode 100644 index 9355ad2776117f214210fab8502cfe8ef87d9b04..0000000000000000000000000000000000000000 --- a/0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 38ae53c94a88c7bd5877c72a12582b60865e07ff Mon Sep 17 00:00:00 2001 -From: Hans de Goede -Date: Thu, 17 Apr 2014 15:50:44 +0200 -Subject: [PATCH] Fedora hack: Make the suid-root wrapper start the server with - root rights - -Do NOT upstream. - -Since most display managers are not ready yet to start Xorg in way which will -keep it working without root-rights, see: -https://fedoraproject.org/wiki/Changes/XorgWithoutRootRights - -Just keep starting X as root for now, but do it through the wrapper, by -overriding the needs_root_rights = -1 (auto) default and setting it to 1. - -We set a special environment variable when starting X in a way where root -rights are not needed (from gdm and startx) and keep the upstream -needs_root_rights = -1 (auto) default in that case. - -Signed-off-by: Hans de Goede ---- - hw/xfree86/xorg-wrapper.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/hw/xfree86/xorg-wrapper.c b/hw/xfree86/xorg-wrapper.c -index 4c37cfc..ae5d27f 100644 ---- a/hw/xfree86/xorg-wrapper.c -+++ b/hw/xfree86/xorg-wrapper.c -@@ -198,6 +198,9 @@ int main(int argc, char *argv[]) - int needs_root_rights = -1; - char *const empty_envp[1] = { NULL, }; - -+ if (getenv("XORG_RUN_AS_USER_OK") == NULL) -+ needs_root_rights = 1; -+ - progname = argv[0]; - - parse_config(&allowed, &needs_root_rights); --- -2.4.3 - diff --git a/0001-glx-check-for-indirect-context-in-CreateContextAttri.patch b/0001-glx-check-for-indirect-context-in-CreateContextAttri.patch deleted file mode 100644 index 7c51440eb582b35b66bbf0c35d7f655a3f8aee47..0000000000000000000000000000000000000000 --- a/0001-glx-check-for-indirect-context-in-CreateContextAttri.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 2881ce563661043ef0ee1163c63c120f3622e6d1 Mon Sep 17 00:00:00 2001 -From: Olivier Fourdan -Date: Wed, 5 Sep 2018 15:06:55 +0200 -Subject: [PATCH xserver] glx: check for indirect context in - CreateContextAttribsARB() - -Commit 99f0365b "Add a command line argument for disabling indirect GLX" -added a test to check if indirect context are enabled in -`DoCreateContext()` but `__glXDisp_CreateContextAttribsARB()` doesn't -use `DoCreateContext()` and doesn't check if indirect context is -enabled. - -As a result, clients can still manage to create indirect contexts using -`glXCreateContextAttribsARB()` even if indirect contexts are disabled, -which can possibly crash Xservers such as Xwayland or Xephyr when the -context is destroyed. - -To avoid the issue, check for `enableIndirectGLX` in -`__glXDisp_CreateContextAttribsARB()` as well. - -Fixes: 99f0365b "Add a command line argument for disabling indirect GLX" -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107508 -Signed-off-by: Olivier Fourdan ---- - glx/createcontext.c | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/glx/createcontext.c b/glx/createcontext.c -index 7d09c3a1c..24b02ddfb 100644 ---- a/glx/createcontext.c -+++ b/glx/createcontext.c -@@ -28,6 +28,7 @@ - #include "glxserver.h" - #include "glxext.h" - #include "indirect_dispatch.h" -+#include "opaque.h" - - #define ALL_VALID_FLAGS \ - (GLX_CONTEXT_DEBUG_BIT_ARB | GLX_CONTEXT_FORWARD_COMPATIBLE_BIT_ARB \ -@@ -320,6 +321,17 @@ __glXDisp_CreateContextAttribsARB(__GLXclientState * cl, GLbyte * pc) - err = BadAlloc; - } - else { -+ /* Only allow creating indirect GLX contexts if allowed by -+ * server command line. Indirect GLX is of limited use (since -+ * it's only GL 1.4), it's slower than direct contexts, and -+ * it's a massive attack surface for buffer overflow type -+ * errors. -+ */ -+ if (!enableIndirectGLX) { -+ client->errorValue = req->isDirect; -+ return BadValue; -+ } -+ - ctx = glxScreen->createContext(glxScreen, config, shareCtx, - req->numAttribs, (uint32_t *) attribs, - &err); --- -2.19.0.rc1 - diff --git a/0001-present-fix-freed-pointer-access.patch b/0001-present-fix-freed-pointer-access.patch deleted file mode 100644 index 8c28ee8b1d5ea7a9fecaf1dd770950512105e3e9..0000000000000000000000000000000000000000 --- a/0001-present-fix-freed-pointer-access.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 259f838af4aae2c240d0ea9c05073a86718990d7 Mon Sep 17 00:00:00 2001 -From: Lionel Landwerlin -Date: Mon, 27 Aug 2018 01:04:45 +0100 -Subject: [PATCH xserver] present: fix freed pointer access - -When a vblank has been marked as aborted, it's going to be free in the -flip_notify function when stopped. We can't notify it after it's -stopped because the pointer is invalid. - -Valgrind backtrace: - -==5331== Invalid read of size 8 -==5331== at 0x212B4D: present_vblank_notify (present_vblank.c:34) -==5331== by 0x21439B: present_wnmd_flip_notify (present_wnmd.c:194) -==5331== by 0x21439B: present_wnmd_event_notify (present_wnmd.c:228) -==5331== by 0x156216: xwl_present_sync_callback (xwayland-present.c:282) -==5331== by 0x6570FCD: ffi_call_unix64 (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4) -==5331== by 0x657093E: ffi_call (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4) -==5331== by 0x4DDB183: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x4DD79D8: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x4DD8EA3: wl_display_dispatch_queue_pending (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x14BCCA: xwl_read_events (xwayland.c:814) -==5331== by 0x2AC0D0: ospoll_wait (ospoll.c:651) -==5331== by 0x2A5322: WaitForSomething (WaitFor.c:208) -==5331== by 0x27574B: Dispatch (dispatch.c:421) -==5331== Address 0x1b44dc98 is 40 bytes inside a block of size 184 free'd -==5331== at 0x48369EB: free (vg_replace_malloc.c:530) -==5331== by 0x213B0A: present_wnmd_free_idle_vblanks (present_wnmd.c:118) -==5331== by 0x213B0A: present_wnmd_flips_stop (present_wnmd.c:161) -==5331== by 0x2143EF: present_wnmd_flip_notify (present_wnmd.c:192) -==5331== by 0x2143EF: present_wnmd_event_notify (present_wnmd.c:228) -==5331== by 0x156216: xwl_present_sync_callback (xwayland-present.c:282) -==5331== by 0x6570FCD: ffi_call_unix64 (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4) -==5331== by 0x657093E: ffi_call (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4) -==5331== by 0x4DDB183: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x4DD79D8: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x4DD8EA3: wl_display_dispatch_queue_pending (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x14BCCA: xwl_read_events (xwayland.c:814) -==5331== by 0x2AC0D0: ospoll_wait (ospoll.c:651) -==5331== by 0x2A5322: WaitForSomething (WaitFor.c:208) -==5331== Block was alloc'd at -==5331== at 0x48377D5: calloc (vg_replace_malloc.c:711) -==5331== by 0x212D9F: present_vblank_create (present_vblank.c:69) -==5331== by 0x214014: present_wnmd_pixmap (present_wnmd.c:610) -==5331== by 0x21576C: proc_present_pixmap (present_request.c:150) -==5331== by 0x27599D: Dispatch (dispatch.c:479) -==5331== by 0x279945: dix_main (main.c:276) -==5331== by 0x633AB16: (below main) (libc-start.c:310) - -v2: Still notify aborted flips (Roman) - -Signed-off-by: Lionel Landwerlin -Reviewed-by: Daniel Stone -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107314 -Reviewed-by: Roman Gilg -Tested-by: Roman Gilg ---- - present/present_wnmd.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/present/present_wnmd.c b/present/present_wnmd.c -index 035ae8ffe..8f3836440 100644 ---- a/present/present_wnmd.c -+++ b/present/present_wnmd.c -@@ -188,10 +188,11 @@ present_wnmd_flip_notify(present_vblank_ptr vblank, uint64_t ust, uint64_t crtc_ - window_priv->flip_active = vblank; - window_priv->flip_pending = NULL; - -+ present_vblank_notify(vblank, PresentCompleteKindPixmap, PresentCompleteModeFlip, ust, crtc_msc); -+ - if (vblank->abort_flip) - present_wnmd_flips_stop(window); - -- present_vblank_notify(vblank, PresentCompleteKindPixmap, PresentCompleteModeFlip, ust, crtc_msc); - present_wnmd_flip_try_ready(window); - } - --- -2.19.0.rc1 - diff --git a/0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch b/0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch deleted file mode 100644 index cce03489beb7aec963396f1851d42b93fbda0301..0000000000000000000000000000000000000000 --- a/0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch +++ /dev/null @@ -1,152 +0,0 @@ -From acf5a0100c98a040e5e07a79ecf4a83627da770e Mon Sep 17 00:00:00 2001 -From: Hans de Goede -Date: Thu, 23 Mar 2017 12:54:07 +0100 -Subject: [PATCH xserver] xf86: dri2: Use va_gl as vdpau_driver for Intel i965 - GPUs - -The modesetting driver (which now often is used with Intel GPUs), -relies on dri2_probe_driver_name() to get the dri and vdpau driver -names, before this commit it would always assign the same name to -the 2 names. But the vdpau driver for i965 GPUs should be va_gl -(i915 does not support vdpau at all). - -This commit modifies the used lookup table and dri2_probe_driver_name() -to set the vdpau_driver to va_gl for i965 GPUs, it leaves the 2 -names the same for all other GPUs. - -Note this commit adds a FIXME comment for a memory leak in -dri2_probe_driver_name(), that leak was already present and fixing -it falls outside of the scope of this commit. - -BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1413733 -Cc: kwizart@gmail.com -Signed-off-by: Hans de Goede ---- - hw/xfree86/dri2/dri2.c | 31 +++++++++++++-------- - hw/xfree86/dri2/pci_ids/pci_id_driver_map.h | 21 +++++++------- - 2 files changed, 31 insertions(+), 21 deletions(-) - -diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c -index 6619e3aa7..1f8ad14bc 100644 ---- a/hw/xfree86/dri2/dri2.c -+++ b/hw/xfree86/dri2/dri2.c -@@ -1437,14 +1437,18 @@ get_prime_id(void) - - #include "pci_ids/pci_id_driver_map.h" - --static char * --dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) -+static void -+dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info, -+ const char **dri_driver_ret, -+ const char **vdpau_driver_ret) - { - #ifdef WITH_LIBDRM - int i, j; -- char *driver = NULL; - drmDevicePtr dev; - -+ *dri_driver_ret = NULL; -+ *vdpau_driver_ret = NULL; -+ - /* For non-PCI devices and drmGetDevice fail, just assume that - * the 3D driver is named the same as the kernel driver. This is - * currently true for vc4 and msm (freedreno). -@@ -1456,12 +1460,14 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) - xf86DrvMsg(pScreen->myNum, X_ERROR, - "[DRI2] Couldn't drmGetVersion() on non-PCI device, " - "no driver name found.\n"); -- return NULL; -+ return; - } - -- driver = strndup(version->name, version->name_len); -+ /* FIXME this gets leaked */ -+ *dri_driver_ret = strndup(version->name, version->name_len); -+ *vdpau_driver_ret = *dri_driver_ret; - drmFreeVersion(version); -- return driver; -+ return; - } - - for (i = 0; driver_map[i].driver; i++) { -@@ -1469,13 +1475,15 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) - continue; - - if (driver_map[i].num_chips_ids == -1) { -- driver = strdup(driver_map[i].driver); -+ *dri_driver_ret = driver_map[i].driver; -+ *vdpau_driver_ret = driver_map[i].vdpau_driver; - goto out; - } - - for (j = 0; j < driver_map[i].num_chips_ids; j++) { - if (driver_map[i].chip_ids[j] == dev->deviceinfo.pci->device_id) { -- driver = strdup(driver_map[i].driver); -+ *dri_driver_ret = driver_map[i].driver; -+ *vdpau_driver_ret = driver_map[i].vdpau_driver; - goto out; - } - } -@@ -1487,9 +1495,9 @@ dri2_probe_driver_name(ScreenPtr pScreen, DRI2InfoPtr info) - dev->deviceinfo.pci->vendor_id, dev->deviceinfo.pci->device_id); - out: - drmFreeDevice(&dev); -- return driver; - #else -- return NULL; -+ *dri_driver_ret = NULL; -+ *vdpau_driver_ret = NULL; - #endif - } - -@@ -1610,7 +1618,8 @@ DRI2ScreenInit(ScreenPtr pScreen, DRI2InfoPtr info) - if (info->driverName) { - ds->driverNames[0] = info->driverName; - } else { -- ds->driverNames[0] = ds->driverNames[1] = dri2_probe_driver_name(pScreen, info); -+ dri2_probe_driver_name(pScreen, info, -+ &ds->driverNames[0], &ds->driverNames[1]); - if (!ds->driverNames[0]) - return FALSE; - } -diff --git a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h -index da7ea1c1e..7036d1003 100644 ---- a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h -+++ b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h -@@ -66,21 +66,22 @@ static const int vmwgfx_chip_ids[] = { - static const struct { - int vendor_id; - const char *driver; -+ const char *vdpau_driver; - const int *chip_ids; - int num_chips_ids; - } driver_map[] = { -- { 0x8086, "i915", i915_chip_ids, ARRAY_SIZE(i915_chip_ids) }, -- { 0x8086, "i965", i965_chip_ids, ARRAY_SIZE(i965_chip_ids) }, -+ { 0x8086, "i915", "i915", i915_chip_ids, ARRAY_SIZE(i915_chip_ids) }, -+ { 0x8086, "i965", "va_gl", i965_chip_ids, ARRAY_SIZE(i965_chip_ids) }, - #ifndef DRIVER_MAP_GALLIUM_ONLY -- { 0x1002, "radeon", r100_chip_ids, ARRAY_SIZE(r100_chip_ids) }, -- { 0x1002, "r200", r200_chip_ids, ARRAY_SIZE(r200_chip_ids) }, -+ { 0x1002, "radeon", "radeon", r100_chip_ids, ARRAY_SIZE(r100_chip_ids) }, -+ { 0x1002, "r200", "r200", r200_chip_ids, ARRAY_SIZE(r200_chip_ids) }, - #endif -- { 0x1002, "r300", r300_chip_ids, ARRAY_SIZE(r300_chip_ids) }, -- { 0x1002, "r600", r600_chip_ids, ARRAY_SIZE(r600_chip_ids) }, -- { 0x1002, "radeonsi", radeonsi_chip_ids, ARRAY_SIZE(radeonsi_chip_ids) }, -- { 0x10de, "nouveau", NULL, -1 }, -- { 0x1af4, "virtio_gpu", virtio_gpu_chip_ids, ARRAY_SIZE(virtio_gpu_chip_ids) }, -- { 0x15ad, "vmwgfx", vmwgfx_chip_ids, ARRAY_SIZE(vmwgfx_chip_ids) }, -+ { 0x1002, "r300", "r300", r300_chip_ids, ARRAY_SIZE(r300_chip_ids) }, -+ { 0x1002, "r600","r600", r600_chip_ids, ARRAY_SIZE(r600_chip_ids) }, -+ { 0x1002, "radeonsi", "radeonsi", radeonsi_chip_ids, ARRAY_SIZE(radeonsi_chip_ids) }, -+ { 0x10de, "nouveau", "nouveau", NULL, -1 }, -+ { 0x1af4, "virtio_gpu", "virtio_gpu", virtio_gpu_chip_ids, ARRAY_SIZE(virtio_gpu_chip_ids) }, -+ { 0x15ad, "vmwgfx", "vmwgfx", vmwgfx_chip_ids, ARRAY_SIZE(vmwgfx_chip_ids) }, - { 0x0000, NULL, NULL, 0 }, - }; - --- -2.19.0 - diff --git a/0001-xfree86-use-modesetting-driver-by-default-on-GeForce.patch b/0001-xfree86-use-modesetting-driver-by-default-on-GeForce.patch deleted file mode 100644 index 1b1306e2841aee0240df1675e512698ee200681c..0000000000000000000000000000000000000000 --- a/0001-xfree86-use-modesetting-driver-by-default-on-GeForce.patch +++ /dev/null @@ -1,52 +0,0 @@ -From aa2f34d80ef3118eae0cce73b610c36cdcb978fe Mon Sep 17 00:00:00 2001 -From: Ben Skeggs -Date: Sat, 22 Apr 2017 02:26:28 +1000 -Subject: [PATCH xserver] xfree86: use modesetting driver by default on GeForce - 8 and newer - -Signed-off-by: Ben Skeggs ---- - hw/xfree86/common/xf86pciBus.c | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - -diff --git a/hw/xfree86/common/xf86pciBus.c b/hw/xfree86/common/xf86pciBus.c -index 8158c2b62..78d1c947d 100644 ---- a/hw/xfree86/common/xf86pciBus.c -+++ b/hw/xfree86/common/xf86pciBus.c -@@ -37,6 +37,7 @@ - #include - #include - #include -+#include - #include "os.h" - #include "Pci.h" - #include "xf86.h" -@@ -1190,6 +1191,25 @@ xf86VideoPtrToDriverList(struct pci_device *dev, - int idx = 0; - - #ifdef __linux__ -+ char busid[32]; -+ int fd; -+ -+ snprintf(busid, sizeof(busid), "pci:%04x:%02x:%02x.%d", -+ dev->domain, dev->bus, dev->dev, dev->func); -+ -+ /* 'modesetting' is preferred for GeForce 8 and newer GPUs */ -+ fd = drmOpenWithType("nouveau", busid, DRM_NODE_RENDER); -+ if (fd >= 0) { -+ uint64_t args[] = { 11 /* NOUVEAU_GETPARAM_CHIPSET_ID */, 0 }; -+ int ret = drmCommandWriteRead(fd, 0 /* DRM_NOUVEAU_GETPARAM */, -+ &args, sizeof(args)); -+ drmClose(fd); -+ if (ret == 0) { -+ if (args[1] == 0x050 || args[1] >= 0x80) -+ break; -+ } -+ } -+ - driverList[idx++] = "nouveau"; - #endif - driverList[idx++] = "nv"; --- -2.12.2 - diff --git a/0001-xwayland-Remove-xwl_present_window-from-privates-on-.patch b/0001-xwayland-Remove-xwl_present_window-from-privates-on-.patch deleted file mode 100644 index 1575cb03c341d3b5c92e605a760d9205da549e69..0000000000000000000000000000000000000000 --- a/0001-xwayland-Remove-xwl_present_window-from-privates-on-.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 90ac51f3e44d8d433741dc0f0495e79cc6e5fd51 Mon Sep 17 00:00:00 2001 -From: Olivier Fourdan -Date: Wed, 5 Sep 2018 09:34:12 +0200 -Subject: [PATCH xserver] xwayland: Remove xwl_present_window from privates on - cleanup - -Xwayland's `xwl_destroy_window()` invokes `xwl_present_cleanup()` -before the common `DestroyWindow()`. - -But then `DestroyWindow()` calls `present_destroy_window()` which will -possibly end up in `xwl_present_abort_vblank()` which will try to access -data that was previously freed by `xwl_present_cleanup()`: - - Invalid read of size 8 - at 0x434184: xwl_present_abort_vblank (xwayland-present.c:378) - by 0x53785B: present_wnmd_abort_vblank (present_wnmd.c:651) - by 0x53695A: present_free_window_vblank (present_screen.c:87) - by 0x53695A: present_destroy_window (present_screen.c:152) - by 0x42A90D: xwl_destroy_window (xwayland.c:653) - by 0x584298: compDestroyWindow (compwindow.c:613) - by 0x53CEE3: damageDestroyWindow (damage.c:1570) - by 0x4F1BB8: DbeDestroyWindow (dbe.c:1326) - by 0x46F7F6: FreeWindowResources (window.c:1031) - by 0x472847: DeleteWindow (window.c:1099) - by 0x46B54C: doFreeResource (resource.c:880) - by 0x46C706: FreeClientResources (resource.c:1146) - by 0x446ADE: CloseDownClient (dispatch.c:3473) - Address 0x182abde0 is 80 bytes inside a block of size 112 free'd - at 0x4C2FDAC: free (vg_replace_malloc.c:530) - by 0x42A937: xwl_destroy_window (xwayland.c:647) - by 0x584298: compDestroyWindow (compwindow.c:613) - by 0x53CEE3: damageDestroyWindow (damage.c:1570) - by 0x4F1BB8: DbeDestroyWindow (dbe.c:1326) - by 0x46F7F6: FreeWindowResources (window.c:1031) - by 0x472847: DeleteWindow (window.c:1099) - by 0x46B54C: doFreeResource (resource.c:880) - by 0x46C706: FreeClientResources (resource.c:1146) - by 0x446ADE: CloseDownClient (dispatch.c:3473) - by 0x446DA5: ProcKillClient (dispatch.c:3279) - by 0x4476AF: Dispatch (dispatch.c:479) - Block was alloc'd at - at 0x4C30B06: calloc (vg_replace_malloc.c:711) - by 0x433F46: xwl_present_window_get_priv (xwayland-present.c:54) - by 0x434228: xwl_present_get_crtc (xwayland-present.c:302) - by 0x539728: proc_present_query_capabilities (present_request.c:227) - by 0x4476AF: Dispatch (dispatch.c:479) - by 0x44B5B5: dix_main (main.c:276) - by 0x75F611A: (below main) (libc-start.c:308) - -This is because `xwl_present_cleanup()` frees the memory but does not -remove it from the window's privates, and `xwl_present_abort_vblank()` -will still find it and hence try to access that freed memory... - -Remove `xwl_present_window` from window's privates on cleanup so that no -other function can find and reuse that data once it's freed. - -Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1616269 -Signed-off-by: Olivier Fourdan ---- - hw/xwayland/xwayland-present.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/hw/xwayland/xwayland-present.c b/hw/xwayland/xwayland-present.c -index 81e0eb9ce..316e04443 100644 ---- a/hw/xwayland/xwayland-present.c -+++ b/hw/xwayland/xwayland-present.c -@@ -147,6 +147,11 @@ xwl_present_cleanup(WindowPtr window) - /* Clear timer */ - xwl_present_free_timer(xwl_present_window); - -+ /* Remove from privates so we don't try to access it later */ -+ dixSetPrivate(&window->devPrivates, -+ &xwl_present_window_private_key, -+ NULL); -+ - free(xwl_present_window); - } - --- -2.19.0.rc1 - diff --git a/0001-xwayland-fix-access-to-invalid-pointer.patch b/0001-xwayland-fix-access-to-invalid-pointer.patch deleted file mode 100644 index a6026baccd191ef804a2b4414e3981fb9ecc782c..0000000000000000000000000000000000000000 --- a/0001-xwayland-fix-access-to-invalid-pointer.patch +++ /dev/null @@ -1,78 +0,0 @@ -From b3f6dc6892ca554ecb57f4289182a3e29915a2c6 Mon Sep 17 00:00:00 2001 -From: Lionel Landwerlin -Date: Tue, 28 Aug 2018 21:30:05 +0100 -Subject: [PATCH xserver] xwayland: fix access to invalid pointer - -xwl_output->randr_crtc is used in the update_screen_size() function : - -==5331== Invalid read of size 4 -==5331== at 0x15263D: update_screen_size (xwayland-output.c:190) -==5331== by 0x152C48: xwl_output_remove (xwayland-output.c:413) -==5331== by 0x6570FCD: ffi_call_unix64 (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4) -==5331== by 0x657093E: ffi_call (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4) -==5331== by 0x4DDB183: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x4DD79D8: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x4DD8EA3: wl_display_dispatch_queue_pending (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x14BCCA: xwl_read_events (xwayland.c:814) -==5331== by 0x2AC0D0: ospoll_wait (ospoll.c:651) -==5331== by 0x2A5322: WaitForSomething (WaitFor.c:208) -==5331== by 0x27574B: Dispatch (dispatch.c:421) -==5331== by 0x279945: dix_main (main.c:276) -==5331== Address 0x1aacb5f4 is 36 bytes inside a block of size 154 free'd -==5331== at 0x48369EB: free (vg_replace_malloc.c:530) -==5331== by 0x1F8AE8: RROutputDestroyResource (rroutput.c:421) -==5331== by 0x29A2AC: doFreeResource (resource.c:880) -==5331== by 0x29AE5B: FreeResource (resource.c:910) -==5331== by 0x152BE0: xwl_output_remove (xwayland-output.c:408) -==5331== by 0x6570FCD: ffi_call_unix64 (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4) -==5331== by 0x657093E: ffi_call (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4) -==5331== by 0x4DDB183: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x4DD79D8: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x4DD8EA3: wl_display_dispatch_queue_pending (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x14BCCA: xwl_read_events (xwayland.c:814) -==5331== by 0x2AC0D0: ospoll_wait (ospoll.c:651) -==5331== Block was alloc'd at -==5331== at 0x48357BF: malloc (vg_replace_malloc.c:299) -==5331== by 0x1F93E0: RROutputCreate (rroutput.c:83) -==5331== by 0x152A75: xwl_output_create (xwayland-output.c:361) -==5331== by 0x14BE59: registry_global (xwayland.c:764) -==5331== by 0x6570FCD: ffi_call_unix64 (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4) -==5331== by 0x657093E: ffi_call (in /usr/lib/x86_64-linux-gnu/libffi.so.6.0.4) -==5331== by 0x4DDB183: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x4DD79D8: ??? (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x4DD8EA3: wl_display_dispatch_queue_pending (in /usr/lib/x86_64-linux-gnu/libwayland-client.so.0.3.0) -==5331== by 0x14BCCA: xwl_read_events (xwayland.c:814) -==5331== by 0x2AC0D0: ospoll_wait (ospoll.c:651) -==5331== by 0x2A5322: WaitForSomething (WaitFor.c:208) - -Signed-off-by: Lionel Landwerlin -Reviewed-by: Daniel Stone ---- - hw/xwayland/xwayland-output.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/hw/xwayland/xwayland-output.c b/hw/xwayland/xwayland-output.c -index 0d2ec7890..cc68f0340 100644 ---- a/hw/xwayland/xwayland-output.c -+++ b/hw/xwayland/xwayland-output.c -@@ -404,14 +404,15 @@ xwl_output_remove(struct xwl_output *xwl_output) - int width = 0, height = 0; - Bool need_rotate = (xwl_output->xdg_output == NULL); - -- RRCrtcDestroy(xwl_output->randr_crtc); -- RROutputDestroy(xwl_output->randr_output); - xorg_list_del(&xwl_output->link); - - xorg_list_for_each_entry(it, &xwl_screen->output_list, link) - output_get_new_size(it, need_rotate, &height, &width); - update_screen_size(xwl_output, width, height); - -+ RRCrtcDestroy(xwl_output->randr_crtc); -+ RROutputDestroy(xwl_output->randr_output); -+ - xwl_output_destroy(xwl_output); - } - --- -2.19.0.rc1 - diff --git a/0026-glamor_egl-Don-t-initialize-on-llvmpipe.patch b/0026-glamor_egl-Don-t-initialize-on-llvmpipe.patch deleted file mode 100644 index 0c2bb41d5e8ebb2e250689d05414d023259773eb..0000000000000000000000000000000000000000 --- a/0026-glamor_egl-Don-t-initialize-on-llvmpipe.patch +++ /dev/null @@ -1,92 +0,0 @@ -From 1e3c5d614ee33d9eac1d2cf6366feeb8341fc0f4 Mon Sep 17 00:00:00 2001 -From: Adam Jackson -Date: Fri, 14 Sep 2018 11:33:43 -0400 -Subject: [PATCH 26/29] glamor_egl: Don't initialize on llvmpipe - -Mesa started supporting GL_OES_EGL_image on llvmpipe in 17.3, after this -commit: - - commit bbdeddd5fd0b797e1e281f058338b3da4d98029d - Author: Gurchetan Singh - Date: Tue Aug 1 14:49:33 2017 -0700 - - st/dri: add drisw image extension - -That's pretty cool, but it means glamor now thinks it can initialize on -llvmpipe. This is almost certainly not what anyone wants, as glamor on -llvmpipe is pretty much uniformly slower than fb. - -This fixes both Xorg and Xwayland to refuse glamor in such a setup. -Xephyr is left alone, both because glamor is not the default there and -because Xephyr+glamor+llvmpipe is one of the easier ways to get xts to -exercise glamor. - -The (very small) downside of this change is that you lose DRI3 support. -This wouldn't have helped you very much (since an lp glamor blit is -slower than a pixman blit), but it would eliminate the PutImage overhead -for llvmpipe's glXSwapBuffers. A future change should add DRI3 support -for the fb-only case. - -Reviewed-by: Eric Anholt -Signed-off-by: Adam Jackson -(cherry picked from commit 0a9415cf793babed1f28c61f8047d51de04f1528) ---- - glamor/glamor_egl.c | 11 ++++++++++- - hw/xwayland/xwayland-glamor-gbm.c | 5 +++++ - 2 files changed, 15 insertions(+), 1 deletion(-) - -diff --git a/glamor/glamor_egl.c b/glamor/glamor_egl.c -index 0edfa11..31b1faf 100644 ---- a/glamor/glamor_egl.c -+++ b/glamor/glamor_egl.c -@@ -892,6 +892,7 @@ Bool - glamor_egl_init(ScrnInfoPtr scrn, int fd) - { - struct glamor_egl_screen_private *glamor_egl; -+ const GLubyte *renderer; - - glamor_egl = calloc(sizeof(*glamor_egl), 1); - if (glamor_egl == NULL) -@@ -986,6 +987,14 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd) - "Failed to make EGL context current\n"); - goto error; - } -+ -+ renderer = glGetString(GL_RENDERER); -+ if (strstr((const char *)renderer, "llvmpipe")) { -+ xf86DrvMsg(scrn->scrnIndex, X_INFO, -+ "Refusing to try glamor on llvmpipe\n"); -+ goto error; -+ } -+ - /* - * Force the next glamor_make_current call to set the right context - * (in case of multiple GPUs using glamor) -@@ -999,7 +1008,7 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd) - } - - xf86DrvMsg(scrn->scrnIndex, X_INFO, "glamor X acceleration enabled on %s\n", -- glGetString(GL_RENDERER)); -+ renderer); - - #ifdef GBM_BO_WITH_MODIFIERS - if (epoxy_has_egl_extension(glamor_egl->display, -diff --git a/hw/xwayland/xwayland-glamor-gbm.c b/hw/xwayland/xwayland-glamor-gbm.c -index 06fcf52..25a354b 100644 ---- a/hw/xwayland/xwayland-glamor-gbm.c -+++ b/hw/xwayland/xwayland-glamor-gbm.c -@@ -843,6 +843,11 @@ xwl_glamor_gbm_init_egl(struct xwl_screen *xwl_screen) - goto error; - } - -+ if (strstr((const char *)glGetString(GL_RENDERER), "llvmpipe")) { -+ ErrorF("Refusing to try glamor on llvmpipe\n"); -+ goto error; -+ } -+ - if (!epoxy_has_gl_extension("GL_OES_EGL_image")) { - ErrorF("GL_OES_EGL_image not available\n"); - goto error; --- -2.7.4.huawei.3 - diff --git a/0027-glamor-egl-Avoid-crashing-on-broken-configurations.patch b/0027-glamor-egl-Avoid-crashing-on-broken-configurations.patch deleted file mode 100644 index ca0c21a049ecede6041de2240ad9da054dffc875..0000000000000000000000000000000000000000 --- a/0027-glamor-egl-Avoid-crashing-on-broken-configurations.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 4795c069a503144ea31f01de0c039f32d9880292 Mon Sep 17 00:00:00 2001 -From: Adam Jackson -Date: Fri, 5 Oct 2018 14:50:20 -0400 -Subject: [PATCH 27/29] glamor/egl: Avoid crashing on broken configurations - -0a9415cf apparently can tickle bugs in the GL stack where glGetString -returns NULL, presumably because the eglMakeCurrent() didn't manage to -actually install a dispatch table and you're hitting a stub function. -That's clearly not our bug, but if it happens we should at least not -crash. Notice this case and fail gently. - -Signed-off-by: Adam Jackson -(cherry picked from commit af151895f3cb1755a7a5631f2398a3d3b219cbef) ---- - glamor/glamor_egl.c | 5 +++++ - hw/xwayland/xwayland-glamor-gbm.c | 8 +++++++- - 2 files changed, 12 insertions(+), 1 deletion(-) - -diff --git a/glamor/glamor_egl.c b/glamor/glamor_egl.c -index 31b1faf..d3c678d 100644 ---- a/glamor/glamor_egl.c -+++ b/glamor/glamor_egl.c -@@ -989,6 +989,11 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd) - } - - renderer = glGetString(GL_RENDERER); -+ if (!renderer) { -+ xf86DrvMsg(scrn->scrnIndex, X_ERROR, -+ "glGetString() returned NULL, your GL is broken\n"); -+ goto error; -+ } - if (strstr((const char *)renderer, "llvmpipe")) { - xf86DrvMsg(scrn->scrnIndex, X_INFO, - "Refusing to try glamor on llvmpipe\n"); -diff --git a/hw/xwayland/xwayland-glamor-gbm.c b/hw/xwayland/xwayland-glamor-gbm.c -index 25a354b..6aa1e46 100644 ---- a/hw/xwayland/xwayland-glamor-gbm.c -+++ b/hw/xwayland/xwayland-glamor-gbm.c -@@ -797,6 +797,7 @@ xwl_glamor_gbm_init_egl(struct xwl_screen *xwl_screen) - GLAMOR_GL_CORE_VER_MINOR, - EGL_NONE - }; -+ const GLubyte *renderer; - - if (!xwl_gbm->fd_render_node && !xwl_gbm->drm_authenticated) { - ErrorF("Failed to get wl_drm, disabling Glamor and DRI3\n"); -@@ -843,7 +844,12 @@ xwl_glamor_gbm_init_egl(struct xwl_screen *xwl_screen) - goto error; - } - -- if (strstr((const char *)glGetString(GL_RENDERER), "llvmpipe")) { -+ renderer = glGetString(GL_RENDERER); -+ if (!renderer) { -+ ErrorF("glGetString() returned NULL, your GL is broken\n"); -+ goto error; -+ } -+ if (strstr((const char *)renderer, "llvmpipe")) { - ErrorF("Refusing to try glamor on llvmpipe\n"); - goto error; - } --- -2.7.4.huawei.3 - diff --git a/06_use-intel-only-on-pre-gen4.diff b/06_use-intel-only-on-pre-gen4.diff deleted file mode 100644 index 4994492f6dc98d9120c7f508527a74825859c020..0000000000000000000000000000000000000000 --- a/06_use-intel-only-on-pre-gen4.diff +++ /dev/null @@ -1,30 +0,0 @@ -Description: Use intel ddx only on pre-gen4 hw, newer ones will fall back to modesetting -Author: Timo Aaltonen - ---- a/hw/xfree86/common/xf86pciBus.c -+++ b/hw/xfree86/common/xf86pciBus.c -@@ -1173,7 +1173,23 @@ xf86VideoPtrToDriverList(struct pci_devi - case 0x0bef: - /* Use fbdev/vesa driver on Oaktrail, Medfield, CDV */ - break; -- default: -+ /* Default to intel only on pre-gen4 chips */ -+ case 0x3577: -+ case 0x2562: -+ case 0x3582: -+ case 0x358e: -+ case 0x2572: -+ case 0x2582: -+ case 0x258a: -+ case 0x2592: -+ case 0x2772: -+ case 0x27a2: -+ case 0x27ae: -+ case 0x29b2: -+ case 0x29c2: -+ case 0x29d2: -+ case 0xa001: -+ case 0xa011: - driverList[0] = "intel"; - break; - } diff --git a/xorg-server-1.20.1.tar.bz2 b/xorg-server-1.20.6.tar.bz2 similarity index 44% rename from xorg-server-1.20.1.tar.bz2 rename to xorg-server-1.20.6.tar.bz2 index a6b209e65ee923a3e6685728ca6e38f575fbd8e3..11e51f4343060328e0b92b9d2dc5f5bb03b42e3d 100644 Binary files a/xorg-server-1.20.1.tar.bz2 and b/xorg-server-1.20.6.tar.bz2 differ diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index 99987f00639a7bb466937ad75c10d9b29f7c27d3..0485fd3fa2ec7ee60a5046129b43d4a3cdefc977 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -15,8 +15,8 @@ %global pkgname xorg-server Name: xorg-x11-server -Version: 1.20.1 -Release: 12 +Version: 1.20.6 +Release: 1 Summary: X.Org X11 X server License: MIT and GPLv2 URL: https://www.x.org @@ -32,29 +32,7 @@ Source20: http://svn.exactcode.de/t2/trunk/package/xorg/xorg-server/xvfb-r Source30: xserver-sdk-abi-requires.release Source31: xserver-sdk-abi-requires.git -# From Debian use intel ddx driver only for gen4 and older chipsets -Patch1: 06_use-intel-only-on-pre-gen4.diff -# Default to xf86-video-modesetting on GeForce 8 and newer -Patch2: 0001-xfree86-use-modesetting-driver-by-default-on-GeForce.patch - -# Default to va_gl on intel i965 as we use the modesetting drv there -# va_gl should probably just be the default everywhere ? -Patch3: 0001-xf86-dri2-Use-va_gl-as-vdpau_driver-for-Intel-i965-G.patch - -Patch4: 0001-Always-install-vbe-and-int10-sdk-headers.patch - -# because the display-managers are not ready yet, do not upstream -Patch6: 0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch - -# Submitted upstream -Patch7: 0001-xwayland-Remove-xwl_present_window-from-privates-on-.patch -Patch8: 0001-xwayland-fix-access-to-invalid-pointer.patch -Patch9: 0001-present-fix-freed-pointer-access.patch -Patch10: 0001-glx-check-for-indirect-context-in-CreateContextAttri.patch - -Patch6000: 0026-glamor_egl-Don-t-initialize-on-llvmpipe.patch -Patch6001: 0027-glamor-egl-Avoid-crashing-on-broken-configurations.patch -Patch6003: xorg-s11-server-CVE-2018-20839.patch +Patch6000: xorg-s11-server-CVE-2018-20839.patch BuildRequires: audit-libs-devel autoconf automake bison dbus-devel flex flex-devel git BuildRequires: systemtap-sdt-devel libtool pkgconfig xorg-x11-util-macros xorg-x11-proto-devel @@ -283,12 +261,18 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %files help %defattr(-,root,root) -%doc ChangeLog README +%doc ChangeLog README.md %{_mandir}/man*/* %{_localstatedir}/lib/xkb/README.compiled %{_libdir}/xorg/protocol.txt %changelog +* Sat Jan 11 2020 openEuler Buildteam - 1.20.6-1 +- Type:enhancement +- Id:NA +- SUG:NA +- DESC:update version to 1.20.6 + * Thu Jan 3 2020 openEuler Buildteam - 1.20.1-12 - Type:bugfix - ID:NA