Toshaan Bharvani
4 months ago
2 changed files with 147 additions and 0 deletions
@ -0,0 +1,42 @@
@@ -0,0 +1,42 @@
|
||||
From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001 |
||||
From: Olivier Fourdan <ofourdan@redhat.com> |
||||
Date: Mon, 13 Mar 2023 11:08:47 +0100 |
||||
Subject: [PATCH xserver] composite: Fix use-after-free of the COW |
||||
|
||||
ZDI-CAN-19866/CVE-2023-1393 |
||||
|
||||
If a client explicitly destroys the compositor overlay window (aka COW), |
||||
we would leave a dangling pointer to that window in the CompScreen |
||||
structure, which will trigger a use-after-free later. |
||||
|
||||
Make sure to clear the CompScreen pointer to the COW when the latter gets |
||||
destroyed explicitly by the client. |
||||
|
||||
This vulnerability was discovered by: |
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative |
||||
|
||||
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> |
||||
Reviewed-by: Adam Jackson <ajax@redhat.com> |
||||
--- |
||||
composite/compwindow.c | 5 +++++ |
||||
1 file changed, 5 insertions(+) |
||||
|
||||
diff --git a/composite/compwindow.c b/composite/compwindow.c |
||||
index 4e2494b86..b30da589e 100644 |
||||
--- a/composite/compwindow.c |
||||
+++ b/composite/compwindow.c |
||||
@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin) |
||||
ret = (*pScreen->DestroyWindow) (pWin); |
||||
cs->DestroyWindow = pScreen->DestroyWindow; |
||||
pScreen->DestroyWindow = compDestroyWindow; |
||||
+ |
||||
+ /* Did we just destroy the overlay window? */ |
||||
+ if (pWin == cs->pOverlayWin) |
||||
+ cs->pOverlayWin = NULL; |
||||
+ |
||||
/* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/ |
||||
return ret; |
||||
} |
||||
-- |
||||
2.40.0 |
||||
|
@ -0,0 +1,105 @@
@@ -0,0 +1,105 @@
|
||||
From b98fc07d3442a289c6bef82df50dd0a2d01de71a Mon Sep 17 00:00:00 2001 |
||||
From: Adam Jackson <ajax@redhat.com> |
||||
Date: Thu, 2 Feb 2023 12:26:27 -0500 |
||||
Subject: [PATCH xserver] present: Send a PresentConfigureNotify event for |
||||
destroyed windows |
||||
MIME-Version: 1.0 |
||||
Content-Type: text/plain; charset=UTF-8 |
||||
Content-Transfer-Encoding: 8bit |
||||
|
||||
This enables fixing a deadlock case on the client side, where the client |
||||
ends up blocked waiting for a Present event that will never come because |
||||
the window was destroyed. The new PresentWindowDestroyed flag allows the |
||||
client to avoid blocking indefinitely. |
||||
|
||||
Signed-off-by: Adam Jackson <ajax@redhat.com> |
||||
See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/116 |
||||
See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6685 |
||||
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com> |
||||
(cherry picked from commit 462b06033e66a32308d940eb5fc47f5e4c914dc0) |
||||
--- |
||||
present/present_event.c | 5 +++-- |
||||
present/present_priv.h | 7 ++++++- |
||||
present/present_screen.c | 11 ++++++++++- |
||||
3 files changed, 19 insertions(+), 4 deletions(-) |
||||
|
||||
diff --git a/present/present_event.c b/present/present_event.c |
||||
index 435b26b70..849732dc8 100644 |
||||
--- a/present/present_event.c |
||||
+++ b/present/present_event.c |
||||
@@ -102,7 +102,8 @@ present_event_swap(xGenericEvent *from, xGenericEvent *to) |
||||
} |
||||
|
||||
void |
||||
-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling) |
||||
+present_send_config_notify(WindowPtr window, int x, int y, int w, int h, |
||||
+ int bw, WindowPtr sibling, CARD32 flags) |
||||
{ |
||||
present_window_priv_ptr window_priv = present_window_priv(window); |
||||
|
||||
@@ -122,7 +123,7 @@ present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, |
||||
.off_y = 0, |
||||
.pixmap_width = w, |
||||
.pixmap_height = h, |
||||
- .pixmap_flags = 0 |
||||
+ .pixmap_flags = flags |
||||
}; |
||||
present_event_ptr event; |
||||
|
||||
diff --git a/present/present_priv.h b/present/present_priv.h |
||||
index 6ebd009a2..4ad729864 100644 |
||||
--- a/present/present_priv.h |
||||
+++ b/present/present_priv.h |
||||
@@ -43,6 +43,11 @@ |
||||
#define DebugPresent(x) |
||||
#endif |
||||
|
||||
+/* XXX this belongs in presentproto */ |
||||
+#ifndef PresentWindowDestroyed |
||||
+#define PresentWindowDestroyed (1 << 0) |
||||
+#endif |
||||
+ |
||||
extern int present_request; |
||||
|
||||
extern DevPrivateKeyRec present_screen_private_key; |
||||
@@ -307,7 +312,7 @@ void |
||||
present_free_events(WindowPtr window); |
||||
|
||||
void |
||||
-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling); |
||||
+present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling, CARD32 flags); |
||||
|
||||
void |
||||
present_send_complete_notify(WindowPtr window, CARD8 kind, CARD8 mode, CARD32 serial, uint64_t ust, uint64_t msc); |
||||
diff --git a/present/present_screen.c b/present/present_screen.c |
||||
index 15684eda4..2c29aafd2 100644 |
||||
--- a/present/present_screen.c |
||||
+++ b/present/present_screen.c |
||||
@@ -93,6 +93,15 @@ present_destroy_window(WindowPtr window) |
||||
present_screen_priv_ptr screen_priv = present_screen_priv(screen); |
||||
present_window_priv_ptr window_priv = present_window_priv(window); |
||||
|
||||
+ present_send_config_notify(window, |
||||
+ window->drawable.x, |
||||
+ window->drawable.y, |
||||
+ window->drawable.width, |
||||
+ window->drawable.height, |
||||
+ window->borderWidth, |
||||
+ window->nextSib, |
||||
+ PresentWindowDestroyed); |
||||
+ |
||||
if (window_priv) { |
||||
present_clear_window_notifies(window); |
||||
present_free_events(window); |
||||
@@ -123,7 +132,7 @@ present_config_notify(WindowPtr window, |
||||
ScreenPtr screen = window->drawable.pScreen; |
||||
present_screen_priv_ptr screen_priv = present_screen_priv(screen); |
||||
|
||||
- present_send_config_notify(window, x, y, w, h, bw, sibling); |
||||
+ present_send_config_notify(window, x, y, w, h, bw, sibling, 0); |
||||
|
||||
unwrap(screen_priv, screen, ConfigNotify); |
||||
if (screen->ConfigNotify) |
||||
-- |
||||
2.40.0 |
||||
|
Loading…
Reference in new issue