The xvfb / xehypr / xehypr-glamor display-info tests each start their own X
server (Xvfb, or Xephyr nested inside Xvfb) via simple-xinit -displayfd. When
several of them start at the same instant, the servers race on the same display
numbers and the losing client ends up with a display it cannot open, failing the
lane intermittently:
_XSERVTransSocketUNIXCreateListener: /tmp/.X11-unix/X0 already in use
_XSERVTransMakeAllCOTSServerListeners: server already running
xdpyinfo: unable to open display ":1".
This reproduces on master (run 38774811861) as well as on PRs, hitting a
different display-info subtest each time, so it is a harness race and not a
regression in the code under test. Mark these tests is_parallel:false so the
display allocation cannot collide. The tests are short, so the lost parallelism
is negligible.
Test-harness only, no production code change.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
(cherry picked from commit 7289b9936c)
XIQueryDevice already reports the current cumulative axisVal for relative scroll valuators. Seed nonzero vertical and horizontal values and verify their FP3232 representation for native and swapped clients.
Signed-off-by: Lukáš Lipinský <18076-Mr-Tao@users.noreply.gitlab.freedesktop.org>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2292>
(cherry picked from commit 18dbde8971)
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
input_constrain_cursor() writes barrier hit and leave events into the
InputEventList buffer without checking how many slots remain.
The buffer is allocated by the DDX at GetMaximumEventsNum() (100) entries
and may contain one raw event already. A client can create more than 100
pointer barriers, pre-arm them as released via XIBarrierReleasePointer,
and then trigger a single pointer motion that crosses all barriers
simultaneously. The leave event loop iterates every hit barrier and
writes one event per barrier, overflowing the 100-slot buffer.
In an ideal world we'd change the InternalEvent* pointer to a struct
that contains allocated size, number of events and the pointer itself
but we're crossing public APIs here and that requires an ABI bump.
So we make do with cutting off the number of barrier events at 64 which
should be low enough to not trigger the issue. However, for the 100+
barrier case this means we only send BarierHit events, not BarrierRelease.
Potentially leaving a client stuck.
We mitigate that problem by simply refusing to create more than 32
barriers per screen (which on its own would also fix the issue, but hey,
'doppelt gemoppelt' as they say).
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-31938
CVE-2026-93519
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Gesture sprite traces which have the same 'fixed sprite trace
for the duration of the gesture' logic as touch sprite traces.
Both copy WindowPtrs into the trace without refcounting them.
If a device supports gestures but does not have a TouchClass,
the cleanup skipped over the gesture sprite cleanup, leaving
dangling pointers in place if a sprite trace is destroyed
during an active gesture (i.e. window is removed).
DeliverOneGestureEvent() then dereferences the stale pointer via
DeepestSpriteWin(&gi->sprite)->drawable.id, causing a use-after-free.
This vulnerability was discovered by:
4nibhal working with TrendAI Zero Day Initiative
ZDI-CAN-32753
CVE-2026-93536
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit efcfd8acc7)
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Set locale to C before checking log message format to ensure consistent
behavior across all locales. The test was checking for 'en\n' at the end
of log messages, which only works in English locale.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
SDeviceChangedEvent left ValuatorClass.value and every ScrollClass-specific multi-byte field in server byte order. Swapped clients therefore received corrupt current values and scroll metadata.
Swap those fields and extend the protocol event conversion coverage to nonzero relative valuator values and both scroll directions and flags.
Signed-off-by: Lukáš Lipinský <18076-Mr-Tao@users.noreply.gitlab.freedesktop.org>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2291>
Simple confirmation of known values, not exhaustive testing.
Tested with SHA-1 implementations from:
- libcrypto (OpenSSL 3)
- libgcrypt
- libnettle
- Solaris libmd
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2066>
> ../test/misc.c:172:5: warning: result of comparison of constant 4611686018427387903 with expression of type 'CARD32' (aka 'unsigned int') is always true [-Wtautological-constant-out-of-range-compare]
> 172 | REQUEST_FIXED_SIZE(req, SIZE_MAX);
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ../include/dix.h:88:25: note: expanded from macro 'REQUEST_FIXED_SIZE'
> 88 | (((n) >> 2) >= client->req_len) || \
> | ~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~
We don't really need SIZE_MAX (platform specific) for this job, just a big
enough number.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Drop the -reset flag, so Xserver now either simply continues (w/o going
through internal reset) when last client disconnected or terminates
when -terminate is given.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This warning doesn't matter in this case:
> ../test/simple-xinit.c: In function ‘handle_sigchld’:
> ../test/simple-xinit.c:69:5: warning: ignoring return value of ‘write’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
> 69 | write(server_displayfd, server_dead, strlen(server_dead));
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In order to allow building w/ -Werror, it should be suppressed.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Instead of directly accessing the global screenInfo.screens[] array,
let everybody go through a little inline helper. This one also checks
for array bounds - if the screen doesn't exist, return NULL.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
No need to have a hole bunch of extra functions, if we can just easily
inline the few relevant lines.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Follow-up on renaming dixGetFirstScreenPtr() to dixGetMasterScreen():
also rename the target variables for correct technical terminology.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
In Xinerama/Panoramix configuration there's one screen that's having special
meaning - it's used for simulating as the frontend for all client operations:
the clients (should) only talk to that screen, while panoramix subsystem is
proxying those operations to all the other screens (with certain changed
applied, eg. coordinate transformations).
Historically, this screen happens to be the first one in the system (some of
it's proc's are hooked up in order to achieve desired behaviour). That's why it
used to be accessed via screenInfo.screens[0] - that already had been encapsulated
into a tiny helper `dixGetFirstScreen()`.
a) the correct terminus technicus for a situation where one device (or SW entity)
entirely controlling others is a master-slave-relationship: the controlling
device/entity is `master`, the controlled ones are `slave` (to that specific
master).
b) the term "first screen" is inacurate and misleading here: what the caller's are
actually interest in isn't the first entry in the screen array, but the screen
that's controlling the others. With upcoming refactoring of the Xinerama/Panoramix
subsystem, this might well be a different array index than 0.
c) the term `default` also wouldn't match: `default` implies there's a real practical
choice, and such value applies when no explicit choice has been made. But in this
case, it practically doesn't make sense (except perhaps for debugging purpose)
for a client to use any different screen.
Therefore fixing the function name to the correct technical terminology.
(for sake of patch readability, renaming corresponding variables is left to
subsequent patches).
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Instead of having huge number of micro-headers, consolidate all the
request handler prototypes in one file.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Instead of everybody directly accessing the (internal) screenInfo struct,
let those consumers only interested in first screen use a little helper.
Also caching the value if it's needed several times.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
* a bit more type-safe and cleaner to read
* cache the screen pointer on cache
* preparation for upcoming refactoring of screen array access
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The GLES tests need an actual GPU (/dev/dri/* device), which is not available
within github CI runners, so we need to skip those when running there.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Run various common checking commands like xdpyinfo, xvinfo, etc
on both Xvfb directly, as well as Xephyr inside Xvfb.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The triangles test of rendercheck is known to be (partially broken on Xephyr,
since it doesn't fully support transparency (eg. a8 surfaces).
Therefore make it optional, so we're not spammed too much by false alarms
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
It always had it's own lifecycle (not been part of Xorg releases),
doesn't make sense to maintain a competing implementation that we
won't use anyways.
Once that's gone, we can also drop few things in core/dix that had
been added just for xwayland only.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
No need for extra call to some demuxer function for nothing but setting a
simple int variable. Setting verbosity level really is nothing more than just
writing some value into a variable, so it's trivial to just to do that, instead
of having an unncessarily complex "universal setter" for that.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Lots of logging functions, especially init and teardown aren't called
by any drivers/modules, so no need to keep them exported.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Since most of the extension init logic (and on/off switches for them)
is driven from miext, this seems the appropriate place for the header.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Several sources including it without need. For consistency, those who still
need someting from there should include exitinit_priv.h (which also pulls
in extinit.h)
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Not used by any external drivers/modules, so no need to keep it public.
Since modesetting is using it, still needs _X_EXPORT, as long as it's
a module.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Some test cases are recycling the ClientRec between swapped/unwapped runs.
Make sure the Client's swapped flag is always reset in those cases.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Reduce the analyzer spam a bit by adding some extra asserts.
Since it's test code, we can't have enough of them anyways ;-)
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Clears warning from clang 19.1.7:
test/misc.c:239:12: warning: 'return' will never be executed
[-Wunreachable-code-return]
239 | return 0;
Fixes: 46b579e8d ("test: switch the unit tests to something resembling a test suite")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
