>From https://lists.x.org/archives/xorg-announce/2025-October/003635.html:
1) CVE-2025-62229: Use-after-free in XPresentNotify structures creation
Using the X11 Present extension, when processing and adding the
notifications after presenting a pixmap, if an error occurs, a dangling
pointer may be left in the error code path of the function causing a
use-after-free when eventually destroying the notification structures
later.
Introduced in: Xorg 1.15
Fixed in: xorg-server-21.1.19 and xwayland-24.1.9
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5a4286b1
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.
2) CVE-2025-62230: Use-after-free in Xkb client resource removal
When removing the Xkb resources for a client, the function
XkbRemoveResourceClient() will free the XkbInterest data associated
with the device, but not the resource associated with it.
As a result, when the client terminates, the resource delete function
triggers a use-after-free.
Introduced in: X11R6
Fixed in: xorg-server-21.1.19 and xwayland-24.1.9
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/99790a2chttps://gitlab.freedesktop.org/xorg/xserver/-/commit/10c94238
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.
3) CVE-2025-62231: Value overflow in Xkb extension XkbSetCompatMap()
The XkbCompatMap structure stores some of its values using an unsigned
short, but fails to check whether the sum of the input data might
overflow the maximum unsigned short value.
Introduced in: X11R6
Fixed in: xorg-server-21.1.19 and xwayland-24.1.9
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/475d9f49
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.
(From OE-Core rev: 50b9c34ba932761fab9035a54e58466d72b097bf)
(From OE-Core rev: f5a10c4950ccb5570c72eb0a09618b7b3523bc39)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Changes:
render: Avoid possible double-free in ProcRenderAddGlyphs()
mi: fix rounding issues around zero in miPointerSetPosition
(From OE-Core rev: 9c00034001c27a17658ae8ae6a75d0c115a1a16b)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 78dc14599a65075a40c26df4bf9d2bb33a237ca9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
These patches are not yet merged (so they're not backports) because they
have outstanding (undescribed) issues[1]. As this issue only affects
Xvfb and is a use-after-free with only a hypothetical attack, revert the
patches until the compromise is understood.
This reverts commit a193c0224a.
[1] https://lists.x.org/archives/xorg-announce/2023-October/003430.html
(From OE-Core rev: 1ed1c4f48203a8366519b40a094c7d9719c3ae32)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libxcvt is a new dependency (thanks Oleksandr!).
Include ${libdir}/xorg/modules/input/*.so into the main
package (if for someone separate packaging matters, please
investigate what they do).
Remove options no longer present upstream.
Remove patches available upstream; drop a chunk as well.
(From OE-Core rev: fe501ae1f6bea73882707c944c4fab5c5657a551)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fix segfault on probing a non-PCI platform device on a system with PCI.
...
at ../../xorg-server-1.20.9/os/log.c:1017
at ../../xorg-server-1.20.9/os/osinit.c:156
at ../../xorg-server-1.20.9/os/osinit.c:110
at ../../../../xorg-server-1.20.9/hw/xfree86/common/xf86platformBus.c:292
argv=argv@entry=0xffffca43c7c8) at ../../../../xorg-server-1.20.9/hw/xfree86/common/xf86Init.c:388
at ../../xorg-server-1.20.9/dix/main.c:193
init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=<optimized out>)
at ../csu/libc-start.c:314
...
Backported from upstream rev e50c85f4e.
(From OE-Core rev: 3b37cbd53219d9c10640b462aa91991d8cbc2a23)
Signed-off-by: Aníbal Limón <anibal.limon@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Build fails on architectures which use IOPortBase
(From OE-Core rev: 36dc499eea1d0e5c342b94ce30b56ba8bbf04922)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The patch has iterated, so update to the latest revision.
(From OE-Core rev: 042e8e8a7181bb3ca830185c38f9287f62c68fe6)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The generated source file sdksyms.c has a comment with the absolute build path,
which means xserver-xorg-src contains this build path. This is both potential
build information leakage and a source of unreproducibility, so remove the
comment.
(From OE-Core rev: 2086e0f08d920de15ab4065fb43c2281b1dcc57a)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
latest glibc dropped support for sys/io.h on arm, which is fixed in
upstream xserver, as a bonus we can drop musl specific patch which was
doing something similar up until now.
Fixes
|In file included from ../../../../xorg-server-1.20.4/hw/xfree86/int10/generic.c:15:
| ../../../../xorg-server-1.20.4/hw/xfree86/common/compiler.h:767:10: fatal error: 'sys/io.h' file not found
| #include <sys/io.h>
| ^~~~~~~~~~
| 1 error generated.
(From OE-Core rev: 1c72953b6c890b8411fec997b5c28a17eed82897)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Incorrect command-line parameter validation in the Xorg X server can lead to
privilege elevation and/or arbitrary files overwrite, when the X server is
running with elevated privileges (ie when Xorg is installed with the setuid bit
set and started by a non-root user). The -modulepath argument can be used to
specify an insecure path to modules that are going to be loaded in the X server,
allowing to execute unprivileged code in the privileged process. The -logfile
argument can be used to overwrite arbitrary files in the file system, due to
incorrect checks in the parsing of the option.
(From OE-Core rev: 14b5854d50c38e94fc0d1ce6af36698fc69f52b4)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of having a patch that upstream won't accept, rewrite it in a
upstreamable way and <gasp> submit it upstream.
The fundamental problem is that pkg-config --variable=sdkdir will return the
value of sdkdir literally, whereas --cflags will return -I${sdkdir} *but* will
do sysroot relocation magic on the path so it is usable.
(From OE-Core rev: 4af34cb1193fe86b862566becfb560b3d19155f4)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch is forcing input to use SIGIO, despite the fact that since 2015
xserver has used an input thread.
(From OE-Core rev: cde11398e6d74ad8f27334199b4bd99cdf1f0ff7)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upstream doesn't assume a monotonic clock isn't available anymore, so we can
remove this patch.
(From OE-Core rev: 25e034b4c3854a7a9190c4deee7fbca6ba4a8c47)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Debian and Fedora both carry this patch, and the xf86-video-modesetting
driver seems better on recent hardware.
As an example, on a NUC6CAYS, the x11perf -aa10text and -rgb10text tests
see around a 20x increase.
[YOCTO #12019]
[YOCTO #12390]
(From OE-Core rev: 2e4934d5d4b2745ffcd76020b307b9021f8d8853)
Signed-off-by: California Sullivan <california.l.sullivan@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The patch tool will apply patches by default with "fuzz", which is where if the
hunk context isn't present but what is there is close enough, it will force the
patch in.
Whilst this is useful when there's just whitespace changes, when applied to
source it is possible for a patch applied with fuzz to produce broken code which
still compiles (see #10450). This is obviously bad.
We'd like to eventually have do_patch() rejecting any fuzz on these grounds. For
that to be realistic the existing patches with fuzz need to be rebased and
reviewed.
(From OE-Core rev: 77fb72c76c8a5b2229a32f36a913a3293e9d2b56)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The installation path and wayland-scanner location problems in Wayland were
resolved in "wayland: Fix installation patch issue" (oe-core 14c0d99) which made
the WAYLAND_PROTOCOLS_SYSROOT_DIR workaround redundant.
(From OE-Core rev: 2dffd043c7f9bb71356a0d0b86b5b0a19fdf7343)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport 3 patches to fix CVE-2017-10971:
In the X.Org X server before 2017-06-19, a user authenticated to an X
Session could crash or execute code in the context of the X Server by
exploiting a stack overflow in the endianness conversion of X Events.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2017-10971
(From OE-Core rev: 20428f660f2c046c63bbf63c4e4af95dac9f2b3d)
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Commit 6a5a4e60373c1386b311b2a8bb666c32d68a9d99 removes the configure of
useSIGIO option:
xfree86 SIGIO support is reworked to use internal versions of
OsBlockSIGIO and OsReleaseSIGIO
The check for useSIGIO is no longer needed.
(From OE-Core rev: 5ed1bc5b4dadc74f1db52179238fbbd145a59043)
Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xserver depends on xfont2 now.
* xwayland support requires wayland-scanner: Add patch to find
wayland-scanner and protocol files while cross-compiling.
* patch MONOTONIC_CLOCK check so it works when cross-compiling
(otherwise we always end with no monotonic clock and xwayland
compile fails)
* Add vardepsexclude for MACHINE to ensure consistent hashes (RB)
(From OE-Core rev: f9c2b4284fafaa8998bbd2a6f443b0b7b98dafaa)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* drm-version patch was applied mainline
* libsystemd was solved similar to patch upstream
* glamor was enhanced twice by Eric Anholt and makes vc4 work on Raspberry Pi
* glamor does not link against libegl but won't work without libegl
(From OE-Core rev: 7fc6e5e816434fb6e35c137d5440b92a1cc4d9c2)
Signed-off-by: Andreas Müller <schnitzeltony@googlemail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
inb/outb are implemented for ARM on glibc but not on linux in general
therefore the conditional has to reflect that
(From OE-Core rev: 8920e520b58118c72c68e739c780efd71c1650d3)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Remove glibc-guard patch: xserver no longer uses termio.h on linux
in any case.
* Remove "--enable-glx-tls": this hasn't done anything since glapi
was separated from glx
* Note that xserver no longer installs evdev configuration
(evdev and/or libinput should do it instead)
* Add patch to check for libsystemd correctly
* Add PACKAGECONFIG for libsystemd
(From OE-Core rev: 9057678e75ec09af081b27d5935907ec955c3664)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixes CVE-2015-3164 in Xwayland.
Remove unnecessary patches:
* fix_open_max_preprocessor_error.patch is no longer needed:
OPEN_MAX is defined in every case now
* xorg-CVE-2013-6424.patch was handled in pixman several releases ago
* other removed patches are included in 1.17.2
(From OE-Core rev: 1d35231d666baee9ac4aaeb482371f3c71998c76)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When falling back to the VESA server, X fails to start due to an error
reading the int10 vec.
We cherry-pick the following commit to fix the error:
commit 0a78b599b34cc8b5fe6fe82f90e90234e8ab7a56
Author: Jürg Billeter <j@bitron.ch>
Date: Sat Feb 7 18:13:21 2015 +0100
int10: Fix error check for pci_device_map_legacy
pci_device_map_legacy returns 0 on success.
Signed-off-by: Jürg Billeter <j@bitron.ch>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(From OE-Core rev: e1570e12f92bf359ef34d0e2998b09981bcece18)
Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Increase OELAYOUT_ABI: this is required because the
xf86-video-modesetting package moves from its own recipe to
xserver-xorg and sanity check cannot handle that currently.
The upgrade will delete old xf86-video-modesetting files from
sysroots.
* Remove upstreamed xserver-xorg patches
* Remove xf86-video-modesetting recipe: the driver is now included in
xserver-xorg recipe, which now produces the xf86-video-modesetting
package. The package version changes from 0.9 to 1.17.1
* Update xserver-xorg license checksum: modesetting license
info (another MIT one) has been added to the file
(From OE-Core rev: 950846d019ffac21909a96d90af8cf7e5bdd5738)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upstream has already fixed the GCC 5 problem, so use the patch from upstream.
(From OE-Core rev: 15b39bfbb1a0263ac194a9833175b72ab7345ebd)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
