Toshaan Bharvani
5 months ago
2 changed files with 147 additions and 0 deletions
@ -0,0 +1,42 @@ |
|||||||
|
From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001 |
||||||
|
From: Olivier Fourdan <ofourdan@redhat.com> |
||||||
|
Date: Mon, 13 Mar 2023 11:08:47 +0100 |
||||||
|
Subject: [PATCH xserver] composite: Fix use-after-free of the COW |
||||||
|
|
||||||
|
ZDI-CAN-19866/CVE-2023-1393 |
||||||
|
|
||||||
|
If a client explicitly destroys the compositor overlay window (aka COW), |
||||||
|
we would leave a dangling pointer to that window in the CompScreen |
||||||
|
structure, which will trigger a use-after-free later. |
||||||
|
|
||||||
|
Make sure to clear the CompScreen pointer to the COW when the latter gets |
||||||
|
destroyed explicitly by the client. |
||||||
|
|
||||||
|
This vulnerability was discovered by: |
||||||
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative |
||||||
|
|
||||||
|
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> |
||||||
|
Reviewed-by: Adam Jackson <ajax@redhat.com> |
||||||
|
--- |
||||||
|
composite/compwindow.c | 5 +++++ |
||||||
|
1 file changed, 5 insertions(+) |
||||||
|
|
||||||
|
diff --git a/composite/compwindow.c b/composite/compwindow.c |
||||||
|
index 4e2494b86..b30da589e 100644 |
||||||
|
--- a/composite/compwindow.c |
||||||
|
+++ b/composite/compwindow.c |
||||||
|
@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin) |
||||||
|
ret = (*pScreen->DestroyWindow) (pWin); |
||||||
|
cs->DestroyWindow = pScreen->DestroyWindow; |
||||||
|
pScreen->DestroyWindow = compDestroyWindow; |
||||||
|
+ |
||||||
|
+ /* Did we just destroy the overlay window? */ |
||||||
|
+ if (pWin == cs->pOverlayWin) |
||||||
|
+ cs->pOverlayWin = NULL; |
||||||
|
+ |
||||||
|
/* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/ |
||||||
|
return ret; |
||||||
|
} |
||||||
|
-- |
||||||
|
2.40.0 |
||||||
|
|
@ -0,0 +1,105 @@ |
|||||||
|
From b98fc07d3442a289c6bef82df50dd0a2d01de71a Mon Sep 17 00:00:00 2001 |
||||||
|
From: Adam Jackson <ajax@redhat.com> |
||||||
|
Date: Thu, 2 Feb 2023 12:26:27 -0500 |
||||||
|
Subject: [PATCH xserver] present: Send a PresentConfigureNotify event for |
||||||
|
destroyed windows |
||||||
|
MIME-Version: 1.0 |
||||||
|
Content-Type: text/plain; charset=UTF-8 |
||||||
|
Content-Transfer-Encoding: 8bit |
||||||
|
|
||||||
|
This enables fixing a deadlock case on the client side, where the client |
||||||
|
ends up blocked waiting for a Present event that will never come because |
||||||
|
the window was destroyed. The new PresentWindowDestroyed flag allows the |
||||||
|
client to avoid blocking indefinitely. |
||||||
|
|
||||||
|
Signed-off-by: Adam Jackson <ajax@redhat.com> |
||||||
|
See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/116 |
||||||
|
See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6685 |
||||||
|
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com> |
||||||
|
(cherry picked from commit 462b06033e66a32308d940eb5fc47f5e4c914dc0) |
||||||
|
--- |
||||||
|
present/present_event.c | 5 +++-- |
||||||
|
present/present_priv.h | 7 ++++++- |
||||||
|
present/present_screen.c | 11 ++++++++++- |
||||||
|
3 files changed, 19 insertions(+), 4 deletions(-) |
||||||
|
|
||||||
|
diff --git a/present/present_event.c b/present/present_event.c |
||||||
|
index 435b26b70..849732dc8 100644 |
||||||
|
--- a/present/present_event.c |
||||||
|
+++ b/present/present_event.c |
||||||
|
@@ -102,7 +102,8 @@ present_event_swap(xGenericEvent *from, xGenericEvent *to) |
||||||
|
} |
||||||
|
|
||||||
|
void |
||||||
|
-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling) |
||||||
|
+present_send_config_notify(WindowPtr window, int x, int y, int w, int h, |
||||||
|
+ int bw, WindowPtr sibling, CARD32 flags) |
||||||
|
{ |
||||||
|
present_window_priv_ptr window_priv = present_window_priv(window); |
||||||
|
|
||||||
|
@@ -122,7 +123,7 @@ present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, |
||||||
|
.off_y = 0, |
||||||
|
.pixmap_width = w, |
||||||
|
.pixmap_height = h, |
||||||
|
- .pixmap_flags = 0 |
||||||
|
+ .pixmap_flags = flags |
||||||
|
}; |
||||||
|
present_event_ptr event; |
||||||
|
|
||||||
|
diff --git a/present/present_priv.h b/present/present_priv.h |
||||||
|
index 6ebd009a2..4ad729864 100644 |
||||||
|
--- a/present/present_priv.h |
||||||
|
+++ b/present/present_priv.h |
||||||
|
@@ -43,6 +43,11 @@ |
||||||
|
#define DebugPresent(x) |
||||||
|
#endif |
||||||
|
|
||||||
|
+/* XXX this belongs in presentproto */ |
||||||
|
+#ifndef PresentWindowDestroyed |
||||||
|
+#define PresentWindowDestroyed (1 << 0) |
||||||
|
+#endif |
||||||
|
+ |
||||||
|
extern int present_request; |
||||||
|
|
||||||
|
extern DevPrivateKeyRec present_screen_private_key; |
||||||
|
@@ -307,7 +312,7 @@ void |
||||||
|
present_free_events(WindowPtr window); |
||||||
|
|
||||||
|
void |
||||||
|
-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling); |
||||||
|
+present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling, CARD32 flags); |
||||||
|
|
||||||
|
void |
||||||
|
present_send_complete_notify(WindowPtr window, CARD8 kind, CARD8 mode, CARD32 serial, uint64_t ust, uint64_t msc); |
||||||
|
diff --git a/present/present_screen.c b/present/present_screen.c |
||||||
|
index 15684eda4..2c29aafd2 100644 |
||||||
|
--- a/present/present_screen.c |
||||||
|
+++ b/present/present_screen.c |
||||||
|
@@ -93,6 +93,15 @@ present_destroy_window(WindowPtr window) |
||||||
|
present_screen_priv_ptr screen_priv = present_screen_priv(screen); |
||||||
|
present_window_priv_ptr window_priv = present_window_priv(window); |
||||||
|
|
||||||
|
+ present_send_config_notify(window, |
||||||
|
+ window->drawable.x, |
||||||
|
+ window->drawable.y, |
||||||
|
+ window->drawable.width, |
||||||
|
+ window->drawable.height, |
||||||
|
+ window->borderWidth, |
||||||
|
+ window->nextSib, |
||||||
|
+ PresentWindowDestroyed); |
||||||
|
+ |
||||||
|
if (window_priv) { |
||||||
|
present_clear_window_notifies(window); |
||||||
|
present_free_events(window); |
||||||
|
@@ -123,7 +132,7 @@ present_config_notify(WindowPtr window, |
||||||
|
ScreenPtr screen = window->drawable.pScreen; |
||||||
|
present_screen_priv_ptr screen_priv = present_screen_priv(screen); |
||||||
|
|
||||||
|
- present_send_config_notify(window, x, y, w, h, bw, sibling); |
||||||
|
+ present_send_config_notify(window, x, y, w, h, bw, sibling, 0); |
||||||
|
|
||||||
|
unwrap(screen_priv, screen, ConfigNotify); |
||||||
|
if (screen->ConfigNotify) |
||||||
|
-- |
||||||
|
2.40.0 |
||||||
|
|
Loading…
Reference in new issue