Commit Graph

817 Commits

Author SHA1 Message Date
Alan Coopersmith
32a95fb7c7 Xv: unvalidated lengths in XVideo extension swapped procs [CVE-2014-8099]
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-12-08 18:09:48 -08:00
Alan Coopersmith
7553082b9b xcmisc: unvalidated length in SProcXCMiscGetXIDList() [CVE-2014-8096]
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-12-08 18:09:48 -08:00
Keith Packard
ec0ac8970b Merge remote-tracking branch 'whot/for-keith' 2014-11-24 15:39:51 -08:00
Peter Hutterer
732fd7e571 Drop trailing whitespaces
sed -i "s/[ ]\+$//g" **/*.(c|h)

happy reviewing...
git diff -w is an empty diff.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-11-12 10:25:00 +10:00
Peter Hutterer
25315ee555 Xext: fix clang compiler warning
shm.c:1150:24: warning: equality comparison with extraneous parentheses
[-Wparentheses-equality]
    if ((shmdesc->addr == ((char *) -1))) {

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-11-12 10:25:00 +10:00
Thierry Reding
63bb5c5ef1 xv: Add missing gcstruct.h include
Commit ea3f3b0786 (xv: Move xf86 XV color key helper to core.) added
code that uses internals of struct _GC. This structure is defined in the
include/gcstruct.h header which wasn't included by the source file, only
gc.h was. That caused the following build failure:

	  CC       xvmain.lo
	Xext/xvmain.c: In function 'XvFillColorKey':
	Xext/xvmain.c:1114:13: error: dereferencing pointer to incomplete type
	         (*gc->ops->PolyFillRect) (pDraw, gc, nbox, rects);
	             ^

Fix this by including the correct header file.

Signed-off-by: Thierry Reding <treding@nvidia.com>
Tested-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-10-31 07:00:01 -07:00
Chris Wilson
9b29fa957a Xext/shm: Detach SHM segment after Pixmap is released
The GPU may still have a reference to the SHM segment which would only
be finally released when the Pixmap is destroy. So we can only detach
the SHM segment (and thereby making the memory unaccessible) after the
backend has had a chance to flush any remaining references.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=85058
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reported-and-tested-by: gedgon@gmail.com
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-10-27 15:33:48 -07:00
Adam Jackson
3f4edd2e3f xinerama: Fix access mode in GetImage's drawable lookup
Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-10-23 14:29:49 -07:00
Adam Jackson
1e56b2dfc6 mi: Move pScreen->SendGraphicsExpose up to dix
No DDX is overriding this and it's fairly absurd to expose it as a
screen operation anyway.

Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-10-09 11:14:53 +02:00
Daniel Martin
2aeb9d8f8b security: Remove XpExtension from SecurityTrustedExtensions
There's no XPrint extension (anymore).

Signed-off-by: Daniel Martin <consume.noise@gmail.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-10-02 10:16:45 -07:00
Eric Anholt
ef258fa4fd xv: Drop the ClientPtr from the interface to the DDX.
Nobody was using it.

v2: Merge the hunk that was accidentally in the previous commit into
    this one.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-07 12:39:53 -07:00
Eric Anholt
850b268e2b xv: Remove the no-op AllocatePort/FreePort interfaces.
v2: Fix accidentally squashed-in change for dropping client from the
    arguments, which should have been in the next commit.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Keith Packard <keithp@keithp.com> (v2)
2014-08-07 12:39:48 -07:00
Eric Anholt
7eac142fb6 xv: Fix malloc-failure cases in the fill color key helper.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
2014-08-06 20:12:20 -07:00
Eric Anholt
ea3f3b0786 xv: Move xf86 XV color key helper to core.
Color key overlay implementations want to reuse this code, and XF86's
had bugs (to be fixed in the next commit).

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06 20:12:20 -07:00
Eric Anholt
b01cfe5f23 xv: Move CloseScreen setup from a DIX hook to normal wrapping.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06 20:12:20 -07:00
Eric Anholt
6a71ee79aa xv: Drop unused XvdiVideoStopped().
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06 20:12:20 -07:00
Eric Anholt
4a095902a3 xv: Drop unused XvdiPreemptVideo().
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06 20:12:20 -07:00
Eric Anholt
e7dde86f23 xv: Move the DDX XV screen private allocation into the DDXes.
XV was going against convention by having the core infrastructure
allocate the private on behalf of the DDX.  I was interested in this
because I was trying to make multiple pieces of DDX be able to
allocate adaptors, and that wasn't going to work if DDX-specific code
was hung off of a single global screen private.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06 20:12:20 -07:00
Eric Anholt
a146c6d421 xv: Drop the ddQueryAdaptors() interface.
The core was passing pointers to pxvs's nAdaptors and pAdaptors, and
the two hardware implementations were copying pxvs's nAdaptors and
pAdaptors into those pointers.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06 20:12:20 -07:00
Eric Anholt
cb42805c66 xv: Move common code for adaptor cleanup to xvmain.c
Since any DDX XV screen cleanup would need this same code for freeing
the tree of pointers for xv adaptors, move it to the dix.

v2: Unconditionalize the pPorts freeing, to match the block above it.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Keith Packard <keithp@keithp.com> (v1)
2014-08-06 20:12:20 -07:00
Adam Jackson
2db71b232c saver: Don't open-code IsMapInstalled
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-07-29 09:52:22 -04:00
Ray Strode
a26578dbb9 selinux: don't checkout for AVCs on select() EINTR
wakeup handlers are called even when select() returns EINTR,
and when they're called the passed fd set is undefined.

This commit fixes the selinux wakeup handler to avoid checking
for AVCs over the netlink socket spuriously.

Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Ray Strode <rstrode@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-04-30 08:56:35 -07:00
Adam Jackson
f466fb2432 xres: Fix size estimation for <8bpp pixmaps (#69057)
Just use floats, it's not like this is a performance path.

Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-04-21 21:39:43 -07:00
Jon TURNEY
45b223e1c2 Build dpmsstubs.c once as a convenience library, rather than once for each DDX which wants to use it
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Gaetan Nadon <memsize@videotron.ca>
2014-03-27 14:09:33 +00:00
Mark Kettenis
ddeca92749 sync: Avoid ridiculously long timeouts
On OpenBSD, passing a timeout longer than 100000000 seconds to select(2) will
make it fail with EINVAL.  As this is original 4.4BSD behaviour it is not
inconceivable that other systems suffer from the same problem.  And Linux,
though not suffering from any 4.4BSD heritage, briefly did something similar:

<https://lkml.org/lkml/2012/8/31/263>

So avoid calling AdjustWaitForDelay() instead of setting the timeout to
(effectively) ULONG_MAX milliseconds.

Signed-off-by: Mark Kettenis <kettenis@openbsd.org>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
2014-02-09 10:41:18 +01:00
Keith Packard
2d2d49dab5 Clean up a few function prototypes to not place formals in /**/
This just removes the comment markers from around the formals in
several function prototypes near where pointer -> void * changes were
made. There are plenty more of these to fix.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-01-12 10:24:12 -08:00
Keith Packard
60014a4a98 Replace 'pointer' type with 'void *'
This lets us stop using the 'pointer' typedef in Xdefs.h as 'pointer'
is used throughout the X server for other things, and having duplicate
names generates compiler warnings.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
2014-01-12 10:24:11 -08:00
Keith Packard
af04cf6968 Xext: Clean up warnings in hashtable code
Make keys const void *

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-01-12 10:14:49 -08:00
Keith Packard
a1cb69dc28 Xext: Clean up warnings
GC funcs and ops are const.
Remove unused variables.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-01-12 10:14:49 -08:00
Keith Packard
d89b42bda4 Clean up warnings in DIX
As usual, mostly const char changes. However, filter_device_events had
a potentially uninitialized value, 'raw', which I added a bunch of
checks for. I suspect most of those are 'can't happen', but it's hard
to see that inside the function.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-01-12 10:14:49 -08:00
Keith Packard
1ce15ed5ba Xext: _X_EXPORT DPMSSet and DPMSSupported
These are needed by drivers, and it's better to export them from here
rather than redefining them in hw/xfree86 and exporting them from there.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-01-12 10:14:49 -08:00
Adam Jackson
f10f36d91d damageext: Xineramify (v7)
v7: Don't bother making resources for the backing listeners. [keithp]

This is now slightly unlike how other resources are xineramified.  We
create N+1 internal damage listeners, one that's a real resource and
reflects the protocol view, and then one per backend screen where the
report function piles onto the protocol view.  The internal listeners
are not stored in the resource database directly, they just hang off the
xinerama resource. We don't wrap Subtract at the dispatch level, but we
do extend it for the Xinerama case to clip to the root window geometry.

As a result of the N+1 design here, the damage reports we generate are
not quite minimal.  However they are indistinguishable from sequential
rendering events happening before the client hears damage, and we don't
need to add a post-dispatch callback just for this one extension.

Add is probably (still) somewhat broken since it will only hit screen 0,
but Add really only exists for DRI1's sake, and DRI1 disables itself
with Xinerama enabled anyway.  In the absence of a use case, I'm leaving
it unwrapped under Xinerama; if someone wants to define how it ought to
work, be my guest.

Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2013-12-09 13:20:37 -05:00
Adam Jackson
8dbe456aba xinerama: Export the screen region
damageext wants this so it can intersect subtract requests against the
root window geometry.

Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2013-12-09 13:20:36 -05:00
Keith Packard
cc63204926 Xext: Use SHMDIR and O_TMPFILE when creating mapping files
ShmCreateSegment asks for a file descriptor for a memory mapped file
created by the X server. This patch uses O_TMPFILE where available,
and also uses the SHMDIR directory to store the files, both for the
O_TMPFILE and mkstemp cases.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
2013-12-02 12:57:05 -08:00
Keith Packard
037566c57c Xext: Recover from miSyncInitFenceFromFD failure without crashing
miSyncDestroyFence must not be called unless miSyncInitFence has been
invoked, so if miSyncInitFenceFromFD fails, we must free the fence
manually.

Signed-off-by: Keith Packard <keithp@keithp.com>
Tested-by: Fredrik Höglund <fredrik@kde.org>
2013-11-23 22:06:19 -08:00
Keith Packard
9309d2a009 xext: Fix shmint.h to not use headers outside of sdk_HEADERS
shmint.h is part of sdk_HEADERS, and so can't use anything not
included in sdk_HEADERS.

busfault.h includes dix-config.h which is not. Leave the use of
struct busfault in shmint.h and move the include of busfault.h to
shm.c.

protocol-versions.h is not part of sdk_HEADERS, so instead of using
that, just use XTRANS_SEND_FDS to choose whether to expose the fd
passing requests directly.

Reported-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
Tested-by: Knut Petersen <Knut_Petersen@t-online.de>
Reviewed-by: Julien Cristau <jcristau@debian.org>

v2: also avoid using protocol-versions.h
2013-11-14 10:22:15 +09:00
Keith Packard
41da295eb5 Trap SIGBUS to handle truncated shared memory segments
If a client passes a section of memory via file descriptor and then
subsequently truncates that file, the underlying pages will be freed
and the addresses invalidated. Subsequent accesses to the page will
fail with a SIGBUS error.

Trap that SIGBUS, figure out which segment was causing the error and
then allocate new pages to fill in for that region. Mark the offending
shared segment as invalid and free the resource ID so that the client
will be able to tell when subsequently attempting to use the segment.

Signed-off-by: Keith Packard <keithp@keithp.com>

v2: Use MAP_FIXED to simplify the recovery logic (Mark Kettenis)
v3: Also catch errors in ShmCreateSegment

Conflicts:
	include/dix-config.h.in
	include/xorg-config.h.in
2013-11-11 15:16:07 -08:00
Keith Packard
bee2ec5404 Xext: Enable MIT-SHM FD-passing request definitions only when possible
Check to see if xtrans FD passing is available and use that to
advertise the appropriate version of the SHM extension

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-11-11 15:12:50 -08:00
Keith Packard
aaf0e29619 Disable DRI3 and sync fence FD functions if xshmfence isn't available
Make sure the server can build when the xshmfence library isn't present

Signed-off-by: Keith Packard <keithp@keithp.com>
2013-11-04 18:53:36 -08:00
Keith Packard
977e2644b1 Merge remote-tracking branch 'whot/for-keith' 2013-11-01 00:34:18 -07:00
Peter Hutterer
f36f5a65f6 sync: fix corner-case in triggering idle alarms
ProcessInputEvent() resets the device idle times. If idle time was higher than
the lower bracket, this should trigger an event in the idle time wakeup
handler.

If processing is slow, the idle time may advance past the lower bracket
between the reset and the time the BlockHandler is called. In that case, we'd
never schedule a wakeup to handle the event, causing us to randomly miss
events.

Ran tests with a neg transition trigger on 5ms with 200 repeats of the test
and it succeeded. Anything below that gets a bit tricky to make sure the
server sees the same idle time as the client usleeps for.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
2013-11-01 17:08:22 +10:00
Keith Packard
5631382988 dri3: Add DRI3 extension
Adds DRM compatible fences using futexes.
Uses FD passing to get pixmaps from DRM applications.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2013-10-31 16:58:30 -07:00
Keith Packard
fdec793cdc Add support for MIT-SHM AttachFd request
This passes a file descriptor from the client to the server, which is
then mmap'd

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2013-10-31 16:58:28 -07:00
Keith Packard
7710f2b927 Xext: Move MIT-SHM 'ShmDesc' to shmint.h
This data structure is required to use shared memory objects in any
extension. That includes the Xv extension, which (before this patch)
duplicated the definition of this structure in its own code.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2013-10-31 16:57:57 -07:00
Peter Hutterer
2523a445a0 sync: split updating and triggering a counter up
Now that the brackets are always the nearest change points (regardless of
transition) we need to update the counters whenever we check for any updates.

Otherwise we end up with a situation where counter->value is out of date and
an alarm doesn't trigger because we're still using the value from last time
something actually triggered.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18 16:48:25 +10:00
Peter Hutterer
e57ec99b03 sync: always set the brackets (#59644)
The current code sets bracket_greater to the first trigger after the current
value, and bracket_less to the last trigger before the current value.

For example, the idle timer with three negative and three positive transitions
would set this:

         nt1       nt2                 nt3
|--------|------|--|------- idle --|---|--|-----> t
               pt1                pt2    pt3
bracket_less == nt2
bracket_greater == pt2

This is an optimization so we can skip code paths in the block/wakeup handlers
if the current value doesn't meet any of the trigger requirements. Those
handlers largely do a
   if (bracket_less is less than current value &&
       bracket_greater is greater than current value)
        return, nothing to do

However, unless the bracket values are updated at the correct time, the
following may happen:

                                      nt
|--------------|---------- idle ------|--------> t
               pt

In this case, neither bracket is set, we're past the pos transition and not
yet at the neg transition. idle may now go past nt, but the brackets are not
updated. If idle is then reset to 0, no alarm is triggered for nt. Likewise,
idle may now go past pt and no alarm is triggered.

Changing an alarm or triggering an alarm will re-calculate the brackets, so
this bug is somewhat random. If any other client triggers an alarm when the
brackets are wrongly NULL, the recalculation will set them this bug may not
appear.

This patch changes the behavior, so that the brackets are always the nearest
positive or negative transitions to the current counter value. In the example
above, nt will trigger a wakeup and a re-calculation of the brackets, so that
going past it in the negative direction will then cause the proper alarm
triggers.

Or, in Keith's words:

  Timer currently past a positive trigger
      No bracket values, because no trigger in range

  Timer moves backwards before the positive trigger
      Brackets not reset, even though there is now a trigger in range

  Timer moves forward past the positive trigger
      Trigger doesn't fire because brackets not set

Setting the LT bracket in this case will cause everything to get
re-evaluated when the sync value moves backwards before the trigger
value.

X.Org Bug 59644 <http://bugs.freedesktop.org/show_bug.cgi?id=59644>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18 16:46:33 +10:00
Peter Hutterer
06b87aa528 sync: if the idle time was reset, force alarms to trigger (#70476)
The time between the idle reset and the IdleTimeWakeupHandler to be called is
indeterminate. Clients with an PositiveTransition or NegativeTransition alarm
on a low threshold may miss an alarm.

Work around this by keeping a reset flag for each device. When the
WakeupHandler triggers and the reset flag is set, we force a re-calculation of
everything and pretend the current idle time is zero. Immediately after is the
next calculation with the real idle time.

Relatively reproducible test case: Set up a XSyncNegativeTransition alarm for
a threshold of 1 ms. May trigger, may not.

X.Org Bug 70476 <http://bugs.freedesktop.org/show_bug.cgi?id=70476>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18 16:44:32 +10:00
Peter Hutterer
efc1035ca9 dix: provide accessor methods for the last device event time
And now that we have the accessors, localize it. No functional changes, just
preparing for a future change.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18 16:44:32 +10:00
Peter Hutterer
b7c9bd9cf2 sync: supply the counter from IdleTimeBlockHandler
The main idletime counter has an initialized deviceid, might as well be
supplying it properly. Without this, we'd only ever check the XIAllDevices
counter, so the wait would never be adjusted for the device-specific triggers.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18 16:43:00 +10:00
Peter Hutterer
2efe49c102 sync: always call BracketValues when recalculating upper/lower brackets
Both ServertimeBracketValues and IdleTimeBracketValues copy the value into
there SysCounter privates. Call it for a NULL set as well, so we don't end up
with stale pointers and we can remove the block/wakeup handlers.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18 13:42:20 +10:00