Author	SHA1	Message	Date
Peter Hutterer	5d3b8520ec	present: unlink notifies from window list in present_clear_window_notifies ... When a window is destroyed, present_clear_window_notifies() does not remove the notify list node from the window. The notify may then be freed as part of the window_priv, leaving dangling pointers in place. When the vblank owning the notify is later torn down, present_free_window_notify() calls xorg_list_del() which writes through these dangling pointers (use-after-free write). This happens when Present cross-window notifies are used: a PresentPixmap on window A can reference window B as a notify target. An untriggered wait_fence keeps the vblank alive so that B can be destroyed first, creating the dangling-pointer window. Fix this by calling the free function we have (and moving the window reset into that function too). present_clear_window_notifies is only called from one place anyway. This vulnerability was discovered by: Anonymous working with TrendAI Zero Day Initiative ZDI-CAN-31830 CVE-2026-93515 Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Assisted-by: Claude:claude-opus-4-6 Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341> (cherry picked from commit 1b6955c310)	2026-10-20 19:49:20 +02:00
itz-me-zappex	5f6b5e0138	present: Get rid of blank "present_execute()" declaration. ... Signed-off-by: itz-me-zappex <85901674+itz-me-zappex@users.noreply.github.com>	2026-10-13 14:16:11 +02:00
stefan11111	80c69cbadd	Xext/present: Copy the present info struct instead of just the pointer ... When using multiple screens with different present capabilities, we need to store the present screen info for each screen. Instead of forcing callers to store copies of the screen info struct for each screen, just copy it in `present_screen_init` Signed-off-by: stefan11111 <stefan11111github@gmail.com>	2026-08-19 10:43:54 +02:00
Enrico Weigelt, metux IT consult	07569eb9e1	xext: present: use stdbool's 'bool' instead of 'Bool' for local variables ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-08-07 14:24:45 +02:00
Enrico Weigelt, metux IT consult	dd2ad2cd93	xext: panoramiX: helpers for checking wether it's enabled/disabled ... These helpers are always defined, even when compiling w/o PanoramiX at all (symbol XINERAMA not defined), so we need fewer ifdef's. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-07-24 17:27:51 +02:00
Enrico Weigelt, metux IT consult	9221735fc5	xext: present: present_screen: declare variables where needed ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-07-24 16:12:58 +02:00
Enrico Weigelt, metux IT consult	2c0ccb7504	present: rename wrap()/unwrap() macros and move them into their only consumer. ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-25 15:04:38 +02:00
Enrico Weigelt, metux IT consult	41c714b1cb	present: parentheses around macro argument symbols ... For safety, add extra parantheses on each used macro argument. In most cases not strictly necessary, but better have some strict and automatically enforcable policy here than wasting time on judging individual cases. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-25 07:37:23 +02:00
Peter Hutterer	bd03a8d408	present: Fix missing byte swaps in sproc_present_pixmap() ... sproc_present_pixmap() was missing byte swaps the variable-length xPresentNotify array after the fixed header was not byte-swapped at all (each entry has window and serial CARD32 fields). Fixes: a5ac3c8712 ("present: add missing byte swapping for various fields") Assisted-by: Claude:claude-claude-opus-4-6 Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2202> Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 19:06:03 +02:00
Enrico Weigelt, metux IT consult	16d7c79445	present: byte-swap notify list in sproc_present_pixmap_synced ... sproc_present_pixmap_synced() swapped the fixed request header but, unlike sproc_present_pixmap(), never byte-swapped the trailing LISTofPRESENTNOTIFY. present_create_notifies() then read each notify window/serial in the wrong byte order for swapped clients, so PresentPixmapSynced with notifies resolved the wrong (or no) window. Bounds are enforced by req_len and dixLookupWindow() so there was no memory-safety impact, only incorrect behaviour. Add the missing SwapRestL(stuff). Fixes: ac0bc0b3b6 ("Present: add PresentCapabilitySyncobj and PresentPixmapSynced") Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-23 17:27:46 +02:00
Enrico Weigelt, metux IT consult	876c782094	treewide: clean up includes of misc.h ... adding include/ prefix to it. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-19 19:24:57 +02:00
Enrico Weigelt, metux IT consult	fdc9819e6c	Xext: sync: move it into it's own subdir ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-18 15:32:45 +02:00
Enrico Weigelt, metux IT consult	3535961183	Xext: geext: move it into its own subdir ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-18 14:07:18 +02:00
Enrico Weigelt, metux IT consult	b64e58ff07	xfixes: move it under the Xext/ directory ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-17 15:33:32 +02:00
Enrico Weigelt, metux IT consult	7560b5c85e	randr: move it under Xext/ ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-17 10:59:48 +02:00
Enrico Weigelt, metux IT consult	f7d7861371	present: move it under Xext/ ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-16 19:18:39 +02:00