mirror of
https://git.yoctoproject.org/poky
synced 2026-01-29 21:08:42 +01:00
xserver-xorg: Fix for CVE-2023-5574
Upstream-Status: Backport [1953f460b9&b6fe3f924a&ab2c58ba47] (From OE-Core rev: 9291d7e7aca8ff93d036770e4fb42901c3ea1d60) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Vijay Anusuri
committed by
Richard Purdie
Richard Purdie
parent
1c135f1d7a
commit
a193c0224a
@@ -0,0 +1,113 @@
|
||||
From 1953f460b9ad1a9cdf0fcce70f6ad3310b713d5f Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Thu, 12 Oct 2023 12:44:13 +1000
|
||||
Subject: [PATCH] fb: properly wrap/unwrap CloseScreen
|
||||
|
||||
fbCloseScreen assumes that it overrides miCloseScreen (which just
|
||||
calls FreePixmap(screen->devPrivates)) and emulates that instead of
|
||||
wrapping it.
|
||||
|
||||
This is a wrong assumption, we may have ShmCloseScreen in the mix too,
|
||||
resulting in leaks (see below). Fix this by properly setting up the
|
||||
CloseScreen wrapper.
|
||||
|
||||
This means we no longer need the manual DestroyPixmap call in
|
||||
vfbCloseScreen, reverting d348ab06aae21c153ecbc3511aeafc8ab66d8303
|
||||
|
||||
CVE-2023-5574, ZDI-CAN-21213
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Sri working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Reviewed-by: Adam Jackson <ajax@redhat.com>
|
||||
|
||||
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/1953f460b9ad1a9cdf0fcce70f6ad3310b713d5f]
|
||||
CVE: CVE-2023-5574
|
||||
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
||||
---
|
||||
fb/fb.h | 1 +
|
||||
fb/fbscreen.c | 14 ++++++++++----
|
||||
hw/vfb/InitOutput.c | 7 -------
|
||||
3 files changed, 11 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/fb/fb.h b/fb/fb.h
|
||||
index d157b6956d..cd7bd05d21 100644
|
||||
--- a/fb/fb.h
|
||||
+++ b/fb/fb.h
|
||||
@@ -410,6 +410,7 @@ typedef struct {
|
||||
#endif
|
||||
DevPrivateKeyRec gcPrivateKeyRec;
|
||||
DevPrivateKeyRec winPrivateKeyRec;
|
||||
+ CloseScreenProcPtr CloseScreen;
|
||||
} FbScreenPrivRec, *FbScreenPrivPtr;
|
||||
|
||||
#define fbGetScreenPrivate(pScreen) ((FbScreenPrivPtr) \
|
||||
diff --git a/fb/fbscreen.c b/fb/fbscreen.c
|
||||
index 4ab807ab50..c481033f98 100644
|
||||
--- a/fb/fbscreen.c
|
||||
+++ b/fb/fbscreen.c
|
||||
@@ -29,6 +29,7 @@
|
||||
Bool
|
||||
fbCloseScreen(ScreenPtr pScreen)
|
||||
{
|
||||
+ FbScreenPrivPtr screen_priv = fbGetScreenPrivate(pScreen);
|
||||
int d;
|
||||
DepthPtr depths = pScreen->allowedDepths;
|
||||
|
||||
@@ -37,9 +38,10 @@ fbCloseScreen(ScreenPtr pScreen)
|
||||
free(depths[d].vids);
|
||||
free(depths);
|
||||
free(pScreen->visuals);
|
||||
- if (pScreen->devPrivate)
|
||||
- FreePixmap((PixmapPtr)pScreen->devPrivate);
|
||||
- return TRUE;
|
||||
+
|
||||
+ pScreen->CloseScreen = screen_priv->CloseScreen;
|
||||
+
|
||||
+ return pScreen->CloseScreen(pScreen);
|
||||
}
|
||||
|
||||
Bool
|
||||
@@ -144,6 +146,7 @@ fbFinishScreenInit(ScreenPtr pScreen, void *pbits, int xsize, int ysize,
|
||||
int dpix, int dpiy, int width, int bpp)
|
||||
#endif
|
||||
{
|
||||
+ FbScreenPrivPtr screen_priv;
|
||||
VisualPtr visuals;
|
||||
DepthPtr depths;
|
||||
int nvisuals;
|
||||
@@ -177,8 +180,11 @@ fbFinishScreenInit(ScreenPtr pScreen, void *pbits, int xsize, int ysize,
|
||||
rootdepth, ndepths, depths,
|
||||
defaultVisual, nvisuals, visuals))
|
||||
return FALSE;
|
||||
- /* overwrite miCloseScreen with our own */
|
||||
+
|
||||
+ screen_priv = fbGetScreenPrivate(pScreen);
|
||||
+ screen_priv->CloseScreen = pScreen->CloseScreen;
|
||||
pScreen->CloseScreen = fbCloseScreen;
|
||||
+
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
diff --git a/hw/vfb/InitOutput.c b/hw/vfb/InitOutput.c
|
||||
index 48efb61b2f..076fb7defa 100644
|
||||
--- a/hw/vfb/InitOutput.c
|
||||
+++ b/hw/vfb/InitOutput.c
|
||||
@@ -720,13 +720,6 @@ vfbCloseScreen(ScreenPtr pScreen)
|
||||
|
||||
pScreen->CloseScreen = pvfb->closeScreen;
|
||||
|
||||
- /*
|
||||
- * fb overwrites miCloseScreen, so do this here
|
||||
- */
|
||||
- if (pScreen->devPrivate)
|
||||
- (*pScreen->DestroyPixmap) (pScreen->devPrivate);
|
||||
- pScreen->devPrivate = NULL;
|
||||
-
|
||||
return pScreen->CloseScreen(pScreen);
|
||||
}
|
||||
|
||||
--
|
||||
GitLab
|
||||
|
||||
@@ -0,0 +1,42 @@
|
||||
From b6fe3f924aecac6d6e311673511ce61aa2f7a81f Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Thu, 12 Oct 2023 12:42:06 +1000
|
||||
Subject: [PATCH] mi: fix CloseScreen initialization order
|
||||
|
||||
If SHM is enabled it will set the CloseScreen pointer, only to be
|
||||
overridden by the hardcoded miCloseScreen pointer. Do this the other way
|
||||
round, miCloseScreen is the bottom of our stack.
|
||||
|
||||
Direct leak of 48 byte(s) in 2 object(s) allocated from:
|
||||
#0 0x7f5ea3ad8cc7 in calloc (/lib64/libasan.so.8+0xd8cc7) (BuildId: d8f3addefe29e892d775c30eb364afd3c2484ca5))
|
||||
#1 0x70adfb in ShmInitScreenPriv ../Xext/shm.c:213
|
||||
|
||||
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Reviewed-by: Adam Jackson <ajax@redhat.com>
|
||||
|
||||
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/b6fe3f924aecac6d6e311673511ce61aa2f7a81f]
|
||||
CVE: CVE-2023-5574
|
||||
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
||||
---
|
||||
mi/miscrinit.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/mi/miscrinit.c b/mi/miscrinit.c
|
||||
index 3bb52b1bc6..b88938c9ae 100644
|
||||
--- a/mi/miscrinit.c
|
||||
+++ b/mi/miscrinit.c
|
||||
@@ -249,10 +249,10 @@ miScreenInit(ScreenPtr pScreen, void *pbits, /* pointer to screen bits */
|
||||
pScreen->numVisuals = numVisuals;
|
||||
pScreen->visuals = visuals;
|
||||
if (width) {
|
||||
+ pScreen->CloseScreen = miCloseScreen;
|
||||
#ifdef MITSHM
|
||||
ShmRegisterFbFuncs(pScreen);
|
||||
#endif
|
||||
- pScreen->CloseScreen = miCloseScreen;
|
||||
}
|
||||
/* else CloseScreen */
|
||||
/* QueryBestSize */
|
||||
--
|
||||
GitLab
|
||||
|
||||
@@ -0,0 +1,54 @@
|
||||
From ab2c58ba4719fc31c19c7829b06bdba8a88bd586 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 24 Oct 2023 12:09:36 +1000
|
||||
Subject: [PATCH] dix: always initialize pScreen->CloseScreen
|
||||
|
||||
CloseScreen is wrapped by the various modules, many of which do not
|
||||
check if they're the last ones unwrapping. This is fine if the order of
|
||||
those modules never changes but when it does we might get a NULL-pointer
|
||||
dereference by some naive code doing a
|
||||
|
||||
pScreen->CloseScreen = priv->CloseScreen;
|
||||
free(priv);
|
||||
return (*pScreen->CloseScreen)(pScreen);
|
||||
|
||||
To avoid this set it to a default function that just returns TRUE that's
|
||||
guaranteed to be the last one.
|
||||
|
||||
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/ab2c58ba4719fc31c19c7829b06bdba8a88bd586]
|
||||
CVE: CVE-2023-5574
|
||||
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
||||
---
|
||||
dix/dispatch.c | 9 +++++++++
|
||||
1 file changed, 9 insertions(+)
|
||||
|
||||
diff --git a/dix/dispatch.c b/dix/dispatch.c
|
||||
index eaac39b7c9..cd092fd409 100644
|
||||
--- a/dix/dispatch.c
|
||||
+++ b/dix/dispatch.c
|
||||
@@ -3890,6 +3890,12 @@ static int indexForScanlinePad[65] = {
|
||||
3 /* 64 bits per scanline pad unit */
|
||||
};
|
||||
|
||||
+static Bool
|
||||
+DefaultCloseScreen(ScreenPtr screen)
|
||||
+{
|
||||
+ return TRUE;
|
||||
+}
|
||||
+
|
||||
/*
|
||||
grow the array of screenRecs if necessary.
|
||||
call the device-supplied initialization procedure
|
||||
@@ -3949,6 +3955,9 @@ static int init_screen(ScreenPtr pScreen, int i, Bool gpu)
|
||||
PixmapWidthPaddingInfo[depth].notPower2 = 0;
|
||||
}
|
||||
}
|
||||
+
|
||||
+ pScreen->CloseScreen = DefaultCloseScreen;
|
||||
+
|
||||
return 0;
|
||||
}
|
||||
|
||||
--
|
||||
GitLab
|
||||
|
||||
@@ -2,6 +2,9 @@ require xserver-xorg.inc
|
||||
|
||||
SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch \
|
||||
file://0001-Avoid-duplicate-definitions-of-IOPortBase.patch \
|
||||
file://CVE-2023-5574-1.patch \
|
||||
file://CVE-2023-5574-2.patch \
|
||||
file://CVE-2023-5574-3.patch \
|
||||
"
|
||||
SRC_URI[sha256sum] = "ff697be2011b4c4966b7806929e51b7a08e9d33800d505305d26d9ccde4b533a"
|
||||
|
||||
|
||||
Reference in New Issue
Block a user