XvMC is only helpful for old MPEG2 decoding (and here only some specific
part, the motion compensation). It's only supported by few cards, and needs
special client-side drivers, which need to have direct and pretty low-level
(non-DRI) GPU access (usually involving root access).
Since it's local-only anyways, modern clients can use generic GPU shaders
for various video formats (via standard DRI/mesa) and send whole frames.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
XQuartz was the last consumer of this 2007 workaround, which made getDrawableDamageRef() route a non-viewable window's
damage to the screen damage list instead of the window pixmap's. Because the answer then changed as a window's
viewability changed, it was a source of exactly the register/unregister list mismatch the previous commit addresses --
CrushTree() clears ->viewable before unrealizing, so a window's damage was inserted on one list and looked for on
another during teardown.
It was disabled for XWin in 20701522be for breaking Composite and removed entirely in
c89f0521044083a11d538ebfeaabee6fc7fb9a03, but that removal was reverted in de32d4dcf5
after a regression report, pending a proper fix in the damage layer. That fix is now in place, so drop the workaround.
Fixes: https://github.com/XQuartz/XQuartz/issues/406
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2277>
(cherry picked from commit cfbc5224a6)
(cherry picked from commit 029735e8a254ed2dd5c565878eb946f1ef684fa1)
(cherry picked from commit 0939e0d745c0ee86e603b23b09cac7ea5e632801)
Port notes
----------
This brings our tree in line with xorg/main, where ROOTLESS_WORKAROUND no longer
occurs at all. Jeremy Huddleston removed it there; this is that change, not a new
proposal.
Scope: the define is set only under `if build_rootless`, and build_rootless is set
only for build_xquartz (meson.build). In a normal -Dwerror=true build of this tree the
generated dix-config.h contains no ROOTLESS_WORKAROUND, so the #ifdef block in
miext/damage/damage.c does not compile there. The affected configuration is macOS
XQuartz.
History: the removal was reverted in de32d4dcf5 after a
regression report, pending a proper fix in the damage layer. That fix has since landed
as #3793 ("use drawable pointer instead of list head pointer"), which is what the
original commit message above refers to. Nothing re-established the workaround's
necessity afterwards: it returned in 2019 only because ecf62b7ba6 added the meson build
and carried the define over from configure.ac, without referring to the 2011 report.
Not verified here: that XQuartz on macOS runs without the workaround. applewm is not
available on this Linux host and no CI lane exercises it.
Not a backport candidate: this removes a workaround rather than fixing a defect.
It corrects no crash, no memory error and no security issue, so it must not be
carried to release/25.2, 25.1 or 25.0. Per the backport policy a release branch takes
bugfixes, not cleanups. If a release branch ever needs this, it has to be a deliberate
maintainer decision with its own justification - not a consequence of this port.
The original fix (*1) introduced a use-after-free vulnerability by caching a pointer
into a realloc()able privates array (pListHead). This fix replaces the pListHead pointer with
pListDrawable, storing the drawable pointer at insertion time and re-deriving the list head
at removal time via getDrawableDamageRef(), avoiding the realloc() UAF.
The fix:
1. Changes pListHead (DamagePtr *) to pListDrawable (DrawablePtr) in damagestr.h
2. Updates damageInsertDamage to store pDamage->pDrawable instead of the list head pointer
3. Updates damageRemoveDamage to take a DrawablePtr and re-derive the list head via getDrawableDamageRef()
4. Updates all call sites to pass the drawable pointer instead of the list head pointer
5. Fixes damagePixmapDestroy to pass the pixmap as the drawable
*1) da72833185
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
DamageRegister() chooses which list a damage is linked onto via getDrawableDamageRef(), but DamageUnregister() and
damageSetWindowPixmap() re-derived that list at removal time. For a window the answer depends on the window pixmap,
which changes while the damage is registered (Composite redirection, rootless drawing and Present flips all swap it), so
the removal could consult a different list than the one the damage was inserted onto. It then silently found nothing --
DAMAGE_VALIDATE_ENABLE is off, so the diagnostic is compiled out -- and left an unregistered, often freed, damage linked
where damageRegionAppend() would later dereference its NULL pDrawable and crash.
Record the list head when linking a damage and always unlink from that, which also drops a use-after-free read of the
old window pixmap in damageSetWindowPixmap(): rootless frees its scratch pixmap before restoring the pre-drawing window
pixmaps, so the pixmap consulted there had already been destroyed.
Fixes: https://github.com/XQuartz/XQuartz/issues/406
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2277>
(cherry picked from commit da72833185)
(cherry picked from commit 07df8459788fa1f73ff173cb4dbd8233a69fddf4)
(cherry picked from commit 3df8dc189e3982038a8672639ab6bffbf6e32ad4)
RootlessEnsureFrame returns without releasing a shaped window's region when the implementation refuses to create the
frame, and RootlessMiValidateTree never releases the exposed region it hands to RootlessComputeClips -- upstream
miValidateTree does.
Both are longstanding.
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
The xorg backport 924020906e added a few broken
lines that must not be there and cause FTBS as well as a double-free bug.
Fixes: 924020906e
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
RootlessUpdateScreenPixmap freed the old backing store before attempting the replacement allocation and returned early
on failure, leaving the screen pixmap's devPrivate.ptr pointing at freed memory.
The published geometry was also only refreshed when the buffer grew, so a screen that shrinks kept advertising its
previous, larger size.
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Return NULL from DamageRegion() and DamagePendingRegion() (and check in
DamageEmpty()) when passed a NULL DamagePtr
In exaDoPutImage(), explicitly set migration pReg to NULL since
pExaPixmap->pDamage is guaranteed to be NULL there
852128f18 made the screen private preallocated, so it exists on every
screen as soon as the single global key is registered. sync_fd_screen_priv()
therefore never returns NULL again, which breaks the "already initialized"
check in miSyncFdScreenInit() and the guards in miSyncInitFenceFromFD() /
miSyncFDFromFence(), which then call through a zeroed funcs pointer.
Multi-GPU setups crash on this: with glamor on one screen and a non-glamor
driver (NVIDIA blob under PRIME) on the other, XSyncCreateFenceFromFD on
the latter kills the server.
Use a filled-in funcs as the sentinel instead of the private's presence.
Assisted-by: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Kiyoshi Spreclerg <kiyoshi_pip@protonmail.com>
On a calloc() failure while growing the rootless screen pixmap buffer, the
old buffer was already freed and pixmap_data_size already bumped to the new
(larger) size before the failure check -- leaving s->pixmap_data (and the
screen pixmap pPix, still pointing at the freed block via its prior
ModifyPixmapHeader() call) dangling. Worse, because pixmap_data_size was
already bumped, a later same-or-smaller-size call sees pixmap_data_size <
rowbytes as false and skips reallocating forever, permanently pinning the
dangling state instead of retrying.
Trigger: real host memory pressure during a rootless (Xquartz-style DDX)
geometry change.
Fix: allocate the replacement into a temporary first; only free the old
buffer and update pixmap_data_size/pixmap_data together once the new
allocation has succeeded.
Found via a fleet-directed alloc-fail/UAF sweep of Xext/, mi/, and miext/,
not from a live crash report. Verification note: miext/rootless/ only
compiles into hw/xquartz, which this Linux build has disabled -- checked
with a standalone `gcc -fsyntax-only` pass instead of the normal
ninja+meson-test build/test cycle used for the other fixes in this sweep.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Update SPDX-License-Identifier from MIT OR X11 (or MIT OR X11 OR AGPLv3+ variants)
to the canonical X11 OR MIT OR AGPL-3.0-or-later on 95 existing source files.
Add the triple-license header to 33 newly-identified files authored by Enrico
Weigelt that were missing SPDX headers entirely.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
XF86-BigFont lets local clients share font-metrics arrays via SysV
shared memory (and compresses them for remote clients) -- a local-only
optimization dating back to ancient XFree86. It hasn't been built by
default for really long time.
Enabling it in our CI immediately exposed that the code has bit-rotted
on 7 non-Linux CI lanes (macOS/BSD: including a nonexistent Linux-only
header; Solaris: an ARRAY_SIZE redefinition pulled in via its system
headers; mingw32: implicit geteuid()/getegid() plus an unused variable).
Concrete evidence that this extension currently has no real users
exercising it, since none of that breakage was ever noticed.
Therefore no practical need for carrying it around any longer.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Replace public min/max macros by private MIN/MAX and deprecate them.
The few drivers still using them can trivially define them on their own.
Adding a new private header for all kind of math-ish definitions - future
commits will move more stuff there.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
For safety, add extra parantheses on each used macro argument.
In most cases not strictly necessary, but better have some strict
and automatically enforcable policy here than wasting time on
judging individual cases.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The Render extension operates on PictFormats rather than GC, so it
bypasses the rootless layer's GC-based alpha protection
(ROOTLESS_PROTECT_ALPHA). Depth-24 windows use PICT_x8r8g8b8 where
the 'x' tells pixman the high byte is padding it may freely zero.
The macOS compositor needs this byte to be 0xFF (opaque).
Before each Render operation that targets a rootless window,
temporarily upgrade the destination Picture's format from
PICT_x8r8g8b8 to PICT_a8r8g8b8. This tells pixman that the alpha
channel is significant and must not be optimized away. The format
is restored after the operation completes.
This parallels how ROOTLESS_PROTECT_ALPHA handles GC operations (by
masking alpha out of the planemask) and how ROOTLESS_SAFEALPHA
handles PaintWindow (by forcing alpha in solid fills). The
save/restore approach is analogous to rootlessGC.c's GC_SAVE /
GC_RESTORE pattern.
Fixes [2/2]: https://github.com/XQuartz/XQuartz/issues/31
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Both FreeCounter() and miSyncDestroyFence() iterate over the trigger list
and invoke the CounterDestroyed callback on each trigger.
The CounterDestroyed callback (e.g. SyncAwaitTriggerFired) may call
FreeResource/FreeAwait, which frees the SyncAwaitUnion containing all
SyncAwait structs in the same Await group.
When multiple conditions in a single Await reference the same sync
object (counter or fence), the first callback frees all SyncAwait
structs while subsequent trigger list nodes still reference them. On the
next iteration, reading ptl->next or ptl->pTrigger dereferences freed
memory, leading to a use-after-free.
We need separate fixes for separate issues here to fix this in one go
- use our null-terminated list macro to make sure our next pointer stays
valid (the code accessed ptl->next after freeing it)
- update the list head before deleting the trigger, eventually this ends
up being NULL anyway but meanwhile the list head is a valid list
during CounterDestroyed
- check if we actually do have a trigger before dereferencing the
callback
- Set all triggers to NULL if they are shared so we don't dereference
potentially freed memory
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-30159 (miSyncDestroyFence), ZDI-CAN-30163 (FreeCounter)
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2228>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The Render extension's Trapezoids and Triangles operations
(fbTrapezoids, fbTriangles) render directly via pixman through
fbShapes without going through ps->Composite, so RootlessComposite
never fires for these operations. This means RootlessStartDrawing
is not called and the macOS compositor is not notified of changed
pixels.
Add RootlessTrapezoids and RootlessTriangles wrappers following the
same pattern as RootlessComposite: call RootlessStartDrawing before
the operation, then compute the bounding box via miTrapezoidBounds or
miTriangleBounds and call RootlessDamageBox after. The default
miTriStrip and miTriFan implementations decompose their input into
triangles and dispatch through ps->Triangles, so the RootlessTriangles
wrapper covers TriStrip and TriFan as well.
Also add a RootlessCompositeRects wrapper as defense-in-depth. The
current miCompositeRects implementation already has partial rootless
coverage: PictOpSrc/PictOpClear go through the GC layer, and other
ops route through CompositePicture -> RootlessComposite. Wrapping at
the PictureScreen level ensures robustness regardless of the underlying
implementation.
Fixes [1/2]: https://github.com/XQuartz/XQuartz/issues/31
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Protect against SEGFAULT in cases where per-screen damage private
hasn't been initialized yet or already destroyed, or function pointers
not implemented.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
RootlessGlyphs used max() for box.x1 and box.y1 when accumulating the
bounding box across glyphs in a list. Computing the union of bounding
boxes requires min() for the lower coordinate corner and max for the
higher coordinate corner.
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
As reported by valgrind:
== Invalid read of size 8
== at 0x568C14: miSyncTriggerFence (misync.c:140)
== by 0x540688: ProcSyncTriggerFence (sync.c:1957)
== by 0x540CCC: ProcSyncDispatch (sync.c:2152)
== by 0x4A28C5: Dispatch (dispatch.c:553)
== by 0x4B0B24: dix_main (main.c:274)
== by 0x42915E: main (stubmain.c:34)
== Address 0x17e35488 is 8 bytes inside a block of size 16 free'd
== at 0x4843E43: free (vg_replace_malloc.c:990)
== by 0x53D683: SyncDeleteTriggerFromSyncObject (sync.c:169)
== by 0x53F14D: FreeAwait (sync.c:1208)
== by 0x4DFB06: doFreeResource (resource.c:888)
== by 0x4DFC59: FreeResource (resource.c:918)
== by 0x53E349: SyncAwaitTriggerFired (sync.c:701)
== by 0x568C52: miSyncTriggerFence (misync.c:142)
== by 0x540688: ProcSyncTriggerFence (sync.c:1957)
== by 0x540CCC: ProcSyncDispatch (sync.c:2152)
== by 0x4A28C5: Dispatch (dispatch.c:553)
== by 0x4B0B24: dix_main (main.c:274)
== by 0x42915E: main (stubmain.c:34)
== Block was alloc'd at
== at 0x4840B26: malloc (vg_replace_malloc.c:447)
== by 0x5E50E1: XNFalloc (utils.c:1129)
== by 0x53D772: SyncAddTriggerToSyncObject (sync.c:206)
== by 0x53DCA8: SyncInitTrigger (sync.c:414)
== by 0x5409C7: ProcSyncAwaitFence (sync.c:2089)
== by 0x540D04: ProcSyncDispatch (sync.c:2160)
== by 0x4A28C5: Dispatch (dispatch.c:553)
== by 0x4B0B24: dix_main (main.c:274)
== by 0x42915E: main (stubmain.c:34)
When walking the list of fences to trigger, miSyncTriggerFence() may
call TriggerFence() for the current trigger, which end up calling the
function SyncAwaitTriggerFired().
SyncAwaitTriggerFired() frees the entire await resource, which removes
all triggers from that await - including pNext which may be another
trigger from the same await attached to the same fence.
On the next iteration, ptl = pNext points to freed memory...
To avoid the issue, we need to restart the iteration from the beginning
of the list each time a trigger fires, since the callback can modify the
list.
CVE-2026-34001, ZDI-CAN-28706
This vulnerability was discovered by:
Jan-Niklas Sohn working with TrendAI Zero Day Initiative
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2176>
Signed-off-by: Diego Viola <diego.viola@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2134>
----------------------------------------------------------------------------
This commit is the result of `git apply commit.diff --reject`
applied on e8f452231267c82078fe does not
apply to Xlibre
Signed-off-by: stefan11111 <stefan11111@shitposting.expert>
This header needs to be included at the top of source files,
should not be done from other headers.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This is needed to get proton working in Xfbdev, but is probably useful in other places too.
Xephyr has some unrelated issues regaring Xinput, so steam doesn't work there.
Signed-off-by: stefan11111 <stefan11111@shitposting.expert>
Not used by any driver (not even by xf86 at all), so no need to
keep it exported. Also disposing the now empty nonsdk_extinit.h,
which also isn't used by any drivers.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This variable is only used in os layer and PanoramiX, nowhere else,
and shouldn't be visible to drivers at all.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
iterating over screen list via lambda-esque macros calls like this
DIX_FOR_EACH_SCREEN({
do_something
});
withing the body, the iterator variables `walkScreenIdx` and `walkScreen`
are defined and can be directly used (read-only). the code inside the body
is running in a separate scope.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
According to @felipe19930 in https://github.com/X11Libre/xserver/issues/310 ,
this symbol is required by the 470 nvidia DDX driver.
Signed-off-by: stefan11111 <stefan11111@shitposting.expert>
When iterating screen lists, consistently use the same variable name
`walkScreen` for holding current screen pointer everywhere.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The global (exported) serverGeneration field is `unsigned long`, while
many other places copy it and compare it two other integer types, eg.
plain `int` (which is signed). Even if it's unlikely ever reaching such
high number of generations that it will ever make trouble, it's still
a good idea to clean this up and use the same type everywhere.
For clearity, introducing a typedef `x_server_generation_t` which is
used everywhere, instead of raw `unsigned long`.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
For now that case doensn't practically happen yet - all fields are at
least assigned to some default/dummy function. But in the future, we
might wanna get rid of dummies.
From now on, video drivers are allowed to assign them to NULL, if they
don't wanna have the default implementations and nothing happening
at all instead (no more need for having their own empty dummies)
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
It is a patch that fixes xserver build if libdrm is too old.
Now misyncshm.c compilation depends on dri3, which is incorrect. If libdrm
is not recent enough, then dri3 is not built, the file misyncshm.c
is not compiled, and the function miSyncShmScreenInit() is unavailable.
It is called in glamor_sync.c if xshmfence is present, which causes
a compilation error. This patch makes misyncshm.c compile if xshmfence
is found.
Signed-off-by: Oleh Nykyforchyn <olen.nyk@gmail.com>
This struct (and associated functions) needs to be part of public driver ABI,
so video drivers can get notifications on damage certain operations, but
there hasn't been any documentation on it.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
