Allow callers to arm a sigjmp_buf on a registered mapping so the
SIGBUS handler can siglongjmp instead of remapping and retrying the
faulting instruction.
Needed when the mapping contains objects that are unsafe to resume
on after a replace.
This is preparation work for the next commit where that mechanism is
used.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Assisted-by: AI
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2270>
(cherry picked from commit 7a0b3e2197)
DetermineClientCmd() only used libdispatch for dispatch_once_f(), to
cache kern.argmax. libdispatch doesn't exist before macOS 10.6, so
replace it with a plain lazy init. It's only called from the main
thread (via ReserveClientIds()), so no extra synchronization is needed.
This also drops the hw/xquartz/osxcompat.h include from os/.
Signed-off-by: Sergey Fedorov <vital.had@gmail.com>
Older xquartz used generic code for macOS, so use it now if no dispatch available.
See: 16f52e51a2/os/client.c
Signed-off-by: Sergey Fedorov <vital.had@gmail.com>
The Unix-domain socket transport optionally bound a Linux "abstract"
socket (the @/tmp/.X11-unix/Xn variant with a leading NUL in sun_path)
in addition to the classic filesystem socket. Remove that abstract
variant; on Linux the local transport now behaves exactly like on every
other platform: a single Unix-domain socket under /tmp/.X11-unix.
Reasons:
- It is Linux-only. Abstract sockets are a Linux extension that does
not exist on the BSDs, Solaris, macOS, Cygwin, etc., so the feature
was already carried behind #ifdef __linux__ and only ever benefited
one platform while the code had to be maintained for all.
- It carries a fair amount of extra, special-case code for that single
platform: an abstract flag threaded through set_sun_path(),
CreateListener and ResetListener, the leading-NUL / trailing-'@'
sun_path fixups and their bespoke namelen computation, a dedicated
TRANS_ABSTRACT transport flag, and a second ("unix" vs "local")
transport-table entry whose semantics flipped depending on whether
abstract sockets were available. All of that is now gone.
- The classic filesystem socket has to exist anyway. libX11/libxcb
only *prefer* the abstract socket and fall back to the path socket,
and non-abstract clients (and every non-Linux client) need the path
socket regardless. So the abstract socket was never load-bearing:
it was a second, parallel endpoint duplicating one we must keep.
- It is problematic for containers. Abstract sockets live in the
network namespace rather than the mount namespace, so they cannot be
bind-mounted into a container/sandbox and leak across the netns
boundary, unlike the filesystem socket which can be shared (or
withheld) via a bind mount and constrained by filesystem
permissions. Sandboxes (flatpak, firejail, ...) already suppress the
abstract socket for exactly this reason.
- It does not fit the Unix philosophy. "Everything is a file" is the
whole point of a Unix-domain socket; an abstract socket is a name in
an opaque kernel namespace with no filesystem presence, no path, no
ownership and no permission bits. It exists to paper over userspace
lifecycle issues (stale socket files, cleanup on crash) by pushing
them into the kernel instead of solving them in userspace -- the same
kind of "work around a userspace problem inside the kernel" design
that got kdbus rejected [1]. Those userspace problems are already
handled for the path socket (stat/unlink on reset, mkdir of the
socket dir).
No client-visible behaviour changes on a normal desktop: clients that
tried the abstract socket first simply fall back to the filesystem
socket that the server has always also created.
[1] https://lkml.iu.edu/hypermail/linux/kernel/1504.3/02040.html
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This was accidentially exported. No external driver ever had a chance
to use it yet, so unexport it now.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
At this point, allowing X Font Server connections just introduces us to
possible security issues since the code effectively trusts any font
server and few checks are in place.
Since font servers also haven't been used for ages, let's disable
them by default. Use-cases that require them will have to pass
+fontserverconnections on the commandline and/or set the corresponding
ServerFlags option.
The tests are a bit hacky: Debian builds libXfont2 with --disable-fc so
we need to cater for the case where the X server enables fontserver support
but libXfont then blocks it and we still need to treat this as success.
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2263>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This PR re-adds support for DPI Auto-Detection which was available in X.Org till 21.1, but was removed. This reverts commit 35af1299 and allows to get Auto DPI Detection back only when specified by user as:
$ X -dpi auto
'num * -1' is undefined behavior when num is INT64_MIN, since the
positive value (9223372036854775808) exceeds INT64_MAX.
Fix by casting to uint64_t before negation, which is well-defined
unsigned modular arithmetic and produces the correct absolute value
for all int64_t values including INT64_MIN.
Fixes: https://github.com/X11Libre/xserver/issues/3610
Fixes: 2a41522349
Reported-by: Alex <alexzk1@users.noreply.github.com>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The fallback used an undefined variable and was missing the header
for getrandom(). Also avoid doing pointer arithmetic on void *.
Tested with musl on real MIPS32el, MIPS64eb, PowerPC32 and PowerPC64eb hardware.
Fixes: #3034
Signed-off-by: daemonratte <daemonratte@daemonratte.net>
Update SPDX-License-Identifier from MIT OR X11 (or MIT OR X11 OR AGPLv3+ variants)
to the canonical X11 OR MIT OR AGPL-3.0-or-later on 95 existing source files.
Add the triple-license header to 33 newly-identified files authored by Enrico
Weigelt that were missing SPDX headers entirely.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
XF86-BigFont lets local clients share font-metrics arrays via SysV
shared memory (and compresses them for remote clients) -- a local-only
optimization dating back to ancient XFree86. It hasn't been built by
default for really long time.
Enabling it in our CI immediately exposed that the code has bit-rotted
on 7 non-Linux CI lanes (macOS/BSD: including a nonexistent Linux-only
header; Solaris: an ARRAY_SIZE redefinition pulled in via its system
headers; mingw32: implicit geteuid()/getegid() plus an unused variable).
Concrete evidence that this extension currently has no real users
exercising it, since none of that breakage was ever noticed.
Therefore no practical need for carrying it around any longer.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
There isn't any "vendor" since ancient xfree86 4.x times anymore,
but there're different DDX'es having their own init and fatal error
logic, so "ddx" is the correct prefix.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Windows is the only platform not providing strcasestr, and it's only
user is the xfree86 DDX, which only runs on Unix.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
If fdopen() fails, close the unused pipe fd, free the pid list node,
and restore the smart scheduler signal before returning NULL.
Previously the fd would leak and the node would be added to pidlist
with a NULL fp.
Signed-off-by: dongshengyuan <545258830@qq.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2236>
DetermineClientCmd()'s FreeBSD/DragonFly branch passed calloc()'s
result straight to sysctl() as the output buffer, then unconditionally
strlen()/strdup()'d it, with no NULL check in between. A failed
allocation (OOM) would hand sysctl() a NULL buffer pointer and, should
that not fault on its own, fall through to strlen(NULL)/strdup(NULL).
Add the same NULL check already used for the equivalent macOS
KERN_PROCARGS2 buffer a few lines up in this same function.
Not locally compile-tested (no FreeBSD/DragonFly toolchain available
in this environment) -- mirrors the exact, already-working pattern
from the macOS branch above it; relying on this project's FreeBSD CI
lane to confirm.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
<sys/filio.h>, <sys/sockio.h> and <sys/stropts.h> were included under
the grab-bag SVR4 / __SVR4 OS macro. Whether these headers exist is a
per-header question, so probe them directly:
- conf_data gains HAVE_SYS_FILIO_H / HAVE_SYS_SOCKIO_H /
HAVE_SYS_STROPTS_H via cc.has_header (alongside the other
HAVE_SYS_*_H checks),
- os/Xtranssock.c gates <sys/filio.h> on HAVE_SYS_FILIO_H,
- os/access.c gates <sys/sockio.h> on HAVE_SYS_SOCKIO_H and
<sys/stropts.h> on HAVE_SYS_STROPTS_H (split into independent guards
since they are now independent probes).
<sys/stropts.h> is SVR4/Solaris-only, so its check is exactly
equivalent to the old SVR4 guard. <sys/filio.h> and <sys/sockio.h> also
exist on the BSDs, so they are now correctly included there too (they
provide the FIO*/SIOC* ioctls and are idempotent — the BSD <sys/ioctl.h>
already pulls them in), which is the intended "include it where it
exists" behaviour rather than "only on SVR4".
Verified: Linux -Dwerror=true build gets all three as #undef (none of
the headers exist there, identical to SVR4 being undefined) and links
Xvfb and Xnest cleanly.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Mechanical, brace-only conversion of set_sun_path()'s previously
unbraced single-statement if bodies, per the always-brace-if/while/for
coding-style policy. No logic changes.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The `#if defined(SVR4) || defined(__GNU__)` include of <sys/utsname.h>
is unused: access.c calls neither uname() nor references struct utsname
anywhere. Host-name retrieval was long ago factored out into
xhostname() (os/xhostname.h), which owns the gethostname()/uname()
logic; the include here is a leftover. The explanatory comment above
the xhostname() call (mentioning uname()) is kept — it still documents
why xhostname is preferred over gethostname().
No feature flag needed — there is nothing to gate. Verified: Linux
-Dwerror=true build still links Xvfb and Xnest.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Whether <sys/param.h> is available is a header question, not an
OS-family question. Both os/connection.c and os/access.c included it
under `#ifdef CSRG_BASED` (i.e. "is this a BSD-derived system or
Darwin?") — a grab-bag OS macro standing in for the concrete fact that
actually matters. Replace it with a proper feature check.
Add HAVE_SYS_PARAM_H via cc.has_header('sys/param.h') to conf_data
(alongside the other HAVE_SYS_*_H probes) and switch both includes to
it. This is behaviour-preserving:
- On the BSD/Darwin systems where CSRG_BASED was set, sys/param.h
exists, so the header is still included.
- In os/access.c the inner `#if (BSD >= 199103)` guard is unchanged:
BSD is only defined by sys/param.h itself (on real BSD), so on other
platforms it stays undefined and VARIABLE_IFREQ is not defined —
exactly as before.
- On platforms that always have sys/param.h (e.g. glibc/Linux) the
header is now also included, which is harmless.
Verified: Linux build with -Dwerror=true configures and links Xvfb and
Xnest cleanly (no MIN/MAX or other redefinition from the widened
include).
First step of replacing the tree's grab-bag OS-family #ifdefs
(CSRG_BASED, SVR4, ...) with concrete, meson-detectable feature flags.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
XTHREADS_NEEDS_BYNAMEPARAMS is defined nowhere in the tree — not by the
meson build, not by any header. Its six `#ifdef XTHREADS_NEEDS_BYNAMEPARAMS`
blocks (in access.c, Xtranssock.c, utils.c, xdmcp.c) each only declared a
_Xget{host,serv}bynameparams buffer for the old reentrant _XGethostbyname /
_XGetservbyname wrappers. The declaration was therefore never compiled, and
the buffer is only referenced inside the equally-uncompiled pre-getaddrinfo
gethostbyname fallbacks. Pure dead code; remove it.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
SocketINETCreateListener set sin6_len = sizeof(sockname) (the
sockaddr_storage, 256 bytes) instead of the actual sockaddr_in6 length.
sin6_len is a u_int8_t, so 256 truncates to 0 — on BSD44SOCKETS/SIN6_LEN
platforms (e.g. OpenBSD) the IPv6 listener address carried a zero length.
Use namelen (= sizeof(struct sockaddr_in6)), mirroring the AF_INET branch's
sin_len = namelen. clang flagged this as -Werror=constant-conversion once
the openbsd lane was switched to -Dwerror=true.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
DetermineClientCmd declares path/totsize/fd under
!__APPLE__ && !__DragonFly__ && !__FreeBSD__, but they are used only in the
Linux/Solaris /proc/pid/cmdline branch (#else). OpenBSD has its own
kvm_getprocs branch that doesn't touch them, so on OpenBSD (clang) they are
unused -> -Werror=unused-variable. Exclude __OpenBSD__ from the declaration
guard too, matching the branch that actually consumes them.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Check the snprintf() return value instead of pre-computing the combined
string length against a separate maxlen guard. The two are equivalent,
but GCC's -Wformat-truncation cannot connect the manual length check to
the snprintf() bound and warns anyway -- fatal under -Werror on newer
GCC (e.g. AlmaLinux/RHEL 10, gcc 14).
Evaluating the return value makes the truncation handling explicit and
silences the false positive, with identical behaviour: a path that does
not fit returns -1.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Add a buildtime-selectable meson option 'debug_writetoclient' that logs
every call going through the exported WriteToClient() frontend, to help
track down which (out-of-tree / not-yet-converted) callers still use the
legacy public entry point instead of dixWriteToClient().
- none (default): no logging, the frontend stays a plain tail call
- caller: log client/count plus the immediate caller (return address,
resolved to a symbol name via dladdr() when available)
- backtrace: log client/count plus a full xorg_backtrace() stack
The option maps to CONFIG_DEBUG_WRITETOCLIENT[_BACKTRACE] in dix-config.h.
Internal reply/event paths use dixWriteToClient() directly and are not
affected by this logging.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
PR: https://github.com/X11Libre/xserver/pull/3162
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Move the actual body of WriteToClient() into a new internal worker
dixWriteToClient() and turn WriteToClient() into a thin exported
frontend that just delegates to it.
This separates the two roles the function had: the exported, legacy
entry point kept for ABI compatibility with out-of-tree drivers/modules,
and the worker used by all in-tree reply/event paths. In-tree callers
will be moved over to dixWriteToClient() in the following commits, which
also lets the frontend be instrumented later without affecting internal
paths.
dixWriteToClient() is declared in the private os/io_priv.h but still
exported (_X_EXPORT), since in-tree modules that may be built as separate
shared objects (e.g. GLX) need to link against it.
The xi1/xi2 protocol unit tests intercept the reply path via
-Wl,-wrap,WriteToClient. As the in-tree reply path moves onto
dixWriteToClient(), retarget the linker wrap (and the WRAP_FUNCTION /
wrapped_* references) to dixWriteToClient(); this also covers calls that
still go through the WriteToClient() frontend, since it funnels into the
same worker.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
PR: https://github.com/X11Libre/xserver/pull/3162
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
strlcpy()/strlcat() require non-overlapping source and destination
buffers by contract, so mark the parameters restrict to make that
explicit and enable additional compiler optimizations.
Use the portable _X_RESTRICT_KYWD macro (from <X11/Xfuncproto.h>, pulled
in via os.h) rather than the bare C99 'restrict' keyword, matching the
existing convention in os/xprintf.c and include/Xprintf.h.
Signed-off-by: Victor Lev <levvictor123@gmail.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
register is a no-op hint in all modern C compilers and has been
ignored since at least C99. Remove it for cleaner code.
Signed-off-by: Victor Lev <levvictor123@gmail.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* the `GrabInProgress` field isn't used by any known drivers, thus
no need to export it
* the only in-tree consumer outside of it's source file is Xext/saver.c,
which actually just wants to know whether any *other* client already
grabbed the server - asking the OS layer isn't the right source
(should ask dix/dispatch.c instead)
Therefore adding a simple function for that check into dispatch.c (where
grab/ungrab is actually controlled), so we can easily make this internal
field static again.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Replace public min/max macros by private MIN/MAX and deprecate them.
The few drivers still using them can trivially define them on their own.
Adding a new private header for all kind of math-ish definitions - future
commits will move more stuff there.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Nobody's ever looking at the return value - and in case of error,
there's not much we can do, but emit an error message.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
For safety, add extra parantheses on each used macro argument.
In most cases not strictly necessary, but better have some strict
and automatically enforcable policy here than wasting time on
judging individual cases.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
it's especially needed for xres, which is always enabled anyways.
no need for the extra complexity here.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Refactor the entry pointer header, add documentation and move
it to a more suitable place.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
https://github.com/X11Libre/xserver/issues/2890
musl doesn't indirectly include errno.h as much as other libc's do.
In general it's a good idea to always explicitly include what's needed,
instead of relying on indirect includes.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
In siHostnameCheckAddr(), the digit validation range was 0x30-0x3A, but
0x3A is the colon character (':'). The ASCII range for digits 0-9 is
0x30-0x39.
Colons in hostnames violate RFC 2396 section 3.2.2 and we're not parsing
the host:port notation here.
Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2200>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Since this function is called from signal handlers (e.g. OsSigHandler
processing SIGSEGV/SIGBUS), a NULL %s argument triggers a recursive fault.
Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2200>
----------------------------------------------------------------------------
Modified to fit Xlibre changes.
See: https://github.com/X11Libre/xserver/pull/2794
Signed-off-by: stefan11111 <stefan11111github@gmail.com>
ospoll_create() initializes backend-specific state immediately after
allocating the ospoll structure. Check the allocation result for each
backend before dereferencing it and return NULL on failure.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2217>
the _fptr suffix is used in other parts when they replaced apple blocks
functionality. However in this case a more descriptive name is better
(since this function can technically be reused in other places in the
future)
Signed-off-by: Aggelos Tselios <aggelostselios777@gmail.com>
Replace an apple block in DetermineClientCmd with a regular C function,
in the part responsible for fetching argmax from the kernel on Apple
systems.
Signed-off-by: Aggelos Tselios <aggelostselios777@gmail.com>
