port xorg-server change 26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8

there are two chunks in this change, and while they apply fine to the old
xorg-server 1.10 tree (unlike _most_), they do not build due to using new
identifiers.

the first chunk uses a new MASTER_ATTACHED argument to GetMaster(), which
avoids finding paired devices. the only answer it can give with the setup
of already testing !IsMaster(other) is "other->u.master", so just use that
directly instead if calling GetMaster().

the second chunk uses a new single-line IsFloating() function, and if you
expand it's use here to the full expression, it ends up just being:

if (!IsMaster(dev) && dev->u.master)

(which just happens to match the same line a few above, for the loop of
not-off "devices".)


testing this code path is a little tricky.


Subject: [PATCH] dix: when disabling a master, float disabled slaved devices
too

Disabling a master device floats all slave devices but we didn't do this
to already-disabled slave devices. As a result those devices kept their
reference to the master device resulting in access to already freed
memory if the master device was removed before the corresponding slave
device.

And to match this behavior, also forcibly reset that pointer during
CloseDownDevices().

Related to CVE-2024-21886, ZDI-CAN-22840

apply upstream change 3e77295f888c67fc7645db5d0c00926a29ffecee

Subject: [PATCH] Xi: ProcXIPassiveGrabDevice needs to use unswapped length to
send reply

CVE-2024-31081

apply upstream change 96798fc1967491c80a4d0c8d9e0a80586cb2152b


Subject: [PATCH] Xi: ProcXIGetSelectedEvents needs to use unswapped length to
send reply

CVE-2024-31080

merge upstream change bc1fdbe46559dd947674375946bbef54dd0ce36b


Subject: [PATCH] Xi: do not keep linked list pointer during recursion

The `DisableDevice()` function is called whenever an enabled device
is disabled and it moves the device from the `inputInfo.devices` linked
list to the `inputInfo.off_devices` linked list.

However, its link/unlink operation has an issue during the recursive
call to `DisableDevice()` due to the `prev` pointer pointing to a
removed device.

This issue leads to a length mismatch between the total number of
devices and the number of device in the list, leading to a heap
overflow and, possibly, to local privilege escalation.

Simplify the code that checked whether the device passed to
`DisableDevice()` was in `inputInfo.devices` or not and find the
previous device after the recursion.

CVE-2024-21886, ZDI-CAN-22840

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

merge upstream change 4a5e9b1895627d40d26045bd0b7ef3dce503cbd1


Subject: [PATCH] Xi: flush hierarchy events after adding/removing master
devices

The `XISendDeviceHierarchyEvent()` function allocates space to store up
to `MAXDEVICES` (256) `xXIHierarchyInfo` structures in `info`.

If a device with a given ID was removed and a new device with the same
ID added both in the same operation, the single device ID will lead to
two info structures being written to `info`.

Since this case can occur for every device ID at once, a total of two
times `MAXDEVICES` info structures might be written to the allocation.

To avoid it, once one add/remove master is processed, send out the
device hierarchy event for the current state and continue. That event
thus only ever has exactly one of either added/removed in it (and
optionally slave attached/detached).

CVE-2024-21885, ZDI-CAN-22744

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

merge upstream change e5e8586a12a3ec915673edffa10dc8fe5e15dac3


Subject: [PATCH] glx: Call XACE hooks on the GLX buffer

The XSELINUX code will label resources at creation by checking the
access mode. When the access mode is DixCreateAccess, it will call the
function to label the new resource SELinuxLabelResource().

However, GLX buffers do not go through the XACE hooks when created,
hence leaving the resource actually unlabeled.

When, later, the client tries to create another resource using that
drawable (like a GC for example), the XSELINUX code would try to use
the security ID of that object which has never been labeled, get a NULL
pointer and crash when checking whether the requested permissions are
granted for subject security ID.

To avoid the issue, make sure to call the XACE hooks when creating the
GLX buffers.

Credit goes to Donn Seeley <donn@xmission.com> for providing the patch.

CVE-2024-0408

merge upstream change ece23be888a93b741aa1209d1dbf64636109d6a5 but into
Xi/exevents.c instead of dix/enterleave.c.


Subject: [PATCH] dix: Allocate sufficient xEvents for our DeviceStateNotify

If a device has both a button class and a key class and numButtons is
zero, we can get an OOB write due to event under-allocation.

This function seems to assume a device has either keys or buttons, not
both. It has two virtually identical code paths, both of which assume
they're applying to the first event in the sequence.

A device with both a key and button class triggered a logic bug - only
one xEvent was allocated but the deviceStateNotify pointer was pushed on
once per type. So effectively this logic code:

int count = 1;
if (button && nbuttons > 32) count++;
if (key && nbuttons > 0) count++;
if (key && nkeys > 32) count++; // this is basically always true
// count is at 2 for our keys + zero button device

ev = alloc(count * sizeof(xEvent));
FixDeviceStateNotify(ev);
if (button)
FixDeviceStateNotify(ev++);
if (key)
FixDeviceStateNotify(ev++); // santa drops into the wrong chimney here

If the device has more than 3 valuators, the OOB is pushed back - we're
off by one so it will happen when the last deviceValuator event is
written instead.

Fix this by allocating the maximum number of events we may allocate.
Note that the current behavior is not protocol-correct anyway, this
patch fixes only the allocation issue.

Note that this issue does not trigger if the device has at least one
button. While the server does not prevent a button class with zero
buttons, it is very unlikely.

CVE-2024-0229, ZDI-CAN-22678

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

merge upstream change 9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 though the
enterleave.c portion msut be applied to Xi/exevents.c:DeviceFocusEvent().


Subject: [PATCH] dix: allocate enough space for logical button maps

Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for
each logical button currently down. Since buttons can be arbitrarily mapped
to anything up to 255 make sure we have enough bits for the maximum mapping.

CVE-2023-6816, ZDI-CAN-22664, ZDI-CAN-22665

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

merge upstream change 14f480010a93ff962fef66a16412fafff81ad632:

Subject: [PATCH] randr: avoid integer truncation in length check of
ProcRRChange*Property

Affected are ProcRRChangeProviderProperty and ProcRRChangeOutputProperty.
See also xserver@8f454b79 where this same bug was fixed for the core
protocol and XI.

This fixes an OOB read and the resulting information disclosure.

Length calculation for the request was clipped to a 32-bit integer. With
the correct stuff->nUnits value the expected request size was
truncated, passing the REQUEST_FIXED_SIZE check.

The server then proceeded with reading at least stuff->num_items bytes
(depending on stuff->format) from the request and stuffing whatever it
finds into the property. In the process it would also allocate at least
stuff->nUnits bytes, i.e. 4GB.

CVE-2023-6478, ZDI-CAN-22561

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

merge upstream change 8f454b793e1f13c99872c15f0eed1d7f3b823fe8:

Subject: [PATCH] Xi: avoid integer truncation in length check of
ProcXIChangeProperty

This fixes an OOB read and the resulting information disclosure.

Length calculation for the request was clipped to a 32-bit integer. With
the correct stuff->num_items value the expected request size was
truncated, passing the REQUEST_FIXED_SIZE check.

The server then proceeded with reading at least stuff->num_items bytes
(depending on stuff->format) from the request and stuffing whatever it
finds into the property. In the process it would also allocate at least
stuff->num_items bytes, i.e. 4GB.

The same bug exists in ProcChangeProperty and ProcXChangeDeviceProperty,
so let's fix that too.

CVE-2022-46344, ZDI-CAN 19405

merge security fixes from xorg-server 21.1.9 into xorg-server 10.

Fixes CVE-2023-5367 and CVE-2023-5380.

pull across fixes for ZDI-CAN-19866 / CVE-2023-1393: use after free

pullover fix from xorg-server 21.1.7:

https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ec

Xi: fix potential use-after-free in DeepCopyPointerClasses

CVE-2023-0494, ZDI-CAN-19596

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Peter Hutterer's avatarPeter Hutterer <peter.hutterer@who-t.net>

Declare IOPortBase for mips, as done for xorg-server.

Fix build for sgimips, which still uses xorg-server.old.

Avoid multiple definitions of the same variable.

pull across the fixes for CVE-2021-3472.

merge security fixes for xkb, as found in these xserver gitlab
commits:

270e439739e023463e7e0719a4eede69d45f7a3f - xkb: only swap once in XkbSetMap
446ff2d3177087b8173fa779fa5b77a2a128988b - Check SetMap request length carefully
87c64fc5b0db9f62f4e361444f4b60501ebf67b9 - Fix XkbSetDeviceInfo() and SetDeviceIndicators() heap overflows
de940e06f8733d87bbb857aef85d830053442cfe - xkb: fix key type index check in _XkbSetMapChecks
f7cd1276bbd4fe3a9700096dec33b52b8440788d - Correct bounds checking in XkbSetNames()

i haven't tested these run OK, and it was a 33 out of 34 hunks
did not apply cleanly, but they merge was still largely the
same (patch failed due to whitespace changes mostly), and i am
able to build-test successfully.

Sync with xorg-server:

Report which settings are chosen per a config file in the log file.

Sync with xorg-server: Fix typo in comment.

Cherry-pick Xorg version independent changes from xorg-server.

Normalize #include paths.
Call LogInit() for logging to /var/log/X68k.%s.log as Xorg and Xsun servers.
Fix a suspicious chunk disabled on xfree 4.x migration as sunKbd.c does.
Restore video mode properly on exit even on CRT Mode 19 (640x480 31kHz VGA).
Add ModeDef for 640x480x4bit PseudoColor.
Avoid a use of __UNVOLATILE(3).
Remove unnecessary pointer casts from malloc(3).
Use exact-width interger types properly for register accesses etc.

More cherry-picks to sync with xorg-server:

Remove more redundant command option arg checks.
Avoid dumb DevicePtr casts.

Cherry-pick to sync with xorg-server:

Inform detected keyboard type and layout via LogMessage().
Remove a leftover variable for non-XKB autorepeat.
Remove redundant command option arg checks.
Put probed framebuffer info to a log file by default.

Sync with xorg-server:

> Call LogInit() for logging to /var/log/Xsun.%s.log as Xorg server.

TAB/space cleanup.

Cherry-pick non-Xorg-1.20-specific fixes from xorg-server dir.

Use proper ANSI offsetof(3) to specify framebuffer offset in struct.
Add prototype declarations for CG2 functions.
Implement functions to restore palette settings on exiting Xserver.
Explicitly initialize origColormapValid for readability.
Fix LED defintions to match xkb/xkbInit.c.
Remove unused functions required to handle non-XKB autorepeat.
Initialize ModMap dynamically using keymap data per each keyboard.
Remove now unused ModMap data for each keyboard.
Use "empty" for rmlvo model and layout to avoid lingering default settings.
Trailing whitespace.

Note it looks there is some serious performance regression
between Xorg 1.10 and 1.20 on rendering root_weave to root window
on 3/60 bwtwo mono server.

Backport the only patch from xorg-server 1.20.9 as I can't find a tarball.

From aac28e162e5108510065ad4c323affd6deffd816 Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@herrb.eu>
Date: Sat, 25 Jul 2020 19:33:50 +0200
Subject: [PATCH] fix for ZDI-11426

Avoid leaking un-initalized memory to clients by zeroing the
whole pixmap on initial allocation.

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>

Import WIP Xorg-Server-1.10'fied ancient monolithic Xsun servers.

There are still several issue especially around XKB stuff,
but both Xsun and XsunMono servers are confirmed working with
bwtwo on 3/60 and tme, and also cgtwo on tme.
See my port-sun3@ posts for more details:
https://mail-index.netbsd.org/port-sun3/2020/07/17/msg000157.html

Note a newer Xorg Server 1.20 based version is also ready
so these 1.10 sources are imported as referenece for people
who will try to port other X11R6 servers.

Remove #ifdef XKB conditional.

It has been mandatory on Xorg:
https://cgit.freedesktop.org/xorg/xserver/commit/?id=40877c6680863bd6a8475f2bb0c54df55bcf0b0e

Fix 1bpp Xservers on "whitePixel=0, blackPixel=1" VRAMs.

- Don't override pScreen->blackPixel and pScreen->whitePixel
(set in MD server Init functions per -filpPixels option)
on 1bpp servers in merged fbSetupScreen() (merged one
from cfbSetupScrenn and mfbSetupScreen() in old xsrc/xfree)
- Pull mfbCreateColormap() function from old xsrc/xfree tree
and use it on 1bpp servers

Required by forthcoming X11R7'fied ancient Xsun and XsunMono servers:
https://mail-index.netbsd.org/port-sun3/2020/07/17/msg000157.html

Without these fixes, mouse pointers and twm window titlebar etc. are
rendered inverted.

Use AllocDevicePair() to initialize input devices in InitInput().

This should have been done on the initial X11R7'fied imoprt as
upstream xnest did:
https://cgit.freedesktop.org/xorg/xserver/commit?id=32ce5c83a504d2cafd2b19ed628b40032ef347b3

Tested and no visible regression on XM6i.

Remove clause 3 and 4 from X68k server files written by Yasushi Yamasaki.

I've finally contacted with Yamasaki-san and he kindly answered
"no objection to change them to 2 clause license" in private mail.
Diffs to be committed have also been confirmed by him.
We appreciate all his contribution to early NetBSD/x68k.

use asprintf() to avoid strncpy warning (as the newer version does)

ad provde the cursor function...

Add compatibility to xorg-server-120
- Convert display modes arguments to const.
- Provive bswap* in misc.h
- Provide missing cursor function

apply fixes for CVEs 2017-12176 to 2017-12187 to xorg-server 1.10.
several of the changes were in new code, and the DGA code had moved.

--
From 1b1d4c04695dced2463404174b50b3581dbd857b Mon Sep 17 00:00:00 2001
From: Nathan Kidd <nkidd@opentext.com>
Date: Sun, 21 Dec 2014 01:10:03 -0500
Subject: hw/xfree86: unvalidated lengths

This addresses:
CVE-2017-12180 in XFree86-VidModeExtension
CVE-2017-12181 in XFree86-DGA
CVE-2017-12182 in XFree86-DRI
--
From 211e05ac85a294ef361b9f80d689047fa52b9076 Mon Sep 17 00:00:00 2001
From: Michal Srb <msrb@suse.com>
Date: Fri, 7 Jul 2017 17:21:46 +0200
Subject: Xi: Test exact size of XIBarrierReleasePointer

Otherwise a client can send any value of num_barriers and cause reading or swapping of values on heap behind the receive buffer.
--
From 4ca68b878e851e2136c234f40a25008297d8d831 Mon Sep 17 00:00:00 2001
From: Nathan Kidd <nkidd@opentext.com>
Date: Fri, 9 Jan 2015 10:09:14 -0500
Subject: dbe: Unvalidated variable-length request in ProcDbeGetVisualInfo
(CVE-2017-12177)

v2: Protect against integer overflow (Alan Coopersmith)
--
From 55caa8b08c84af2b50fbc936cf334a5a93dd7db5 Mon Sep 17 00:00:00 2001
From: Nathan Kidd <nkidd@opentext.com>
Date: Fri, 9 Jan 2015 11:43:05 -0500
Subject: xfixes: unvalidated lengths (CVE-2017-12183)

v2: Use before swap (Jeremy Huddleston Sequoia)

v3: Fix wrong XFixesCopyRegion checks (Alan Coopersmith)
--
From 859b08d523307eebde7724fd1a0789c44813e821 Mon Sep 17 00:00:00 2001
From: Nathan Kidd <nkidd@opentext.com>
Date: Wed, 24 Dec 2014 16:22:18 -0500
Subject: Xi: fix wrong extra length check in ProcXIChangeHierarchy
(CVE-2017-12178)
--
From 9c23685009aa96f4b861dcc5d2e01dbee00c4dd9 Mon Sep 17 00:00:00 2001
From: Michal Srb <msrb@suse.com>
Date: Fri, 7 Jul 2017 17:04:03 +0200
Subject: os: Make sure big requests have sufficient length.

A client can send a big request where the 32B "length" field has value
0. When the big request header is removed and the length corrected,
the value will underflow to 0xFFFFFFFF. Functions processing the
request later will think that the client sent much more data and may
touch memory beyond the receive buffer.
--
From b747da5e25be944337a9cd1415506fc06b70aa81 Mon Sep 17 00:00:00 2001
From: Nathan Kidd <nkidd@opentext.com>
Date: Fri, 9 Jan 2015 10:15:46 -0500
Subject: Unvalidated extra length in ProcEstablishConnection (CVE-2017-12176)

add missing } from the previous. apparently i mis-tested and it didn't compile.

CVE-2017-10971 and CVE-2017-10972: apply fixes to the event loop from

https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455
https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992edcfd282cbeeec35d9d
https://cgit.freedesktop.org/xorg/xserver/commit/?id=215f894965df5fb0bb45b107d84524e700d2073c
https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc1a00eca3ffc5489ced

XXX: pullup-[678] (6/7 also need xfree port.)

port to xorg-server 1.10:

apply
https://cgit.freedesktop.org/xorg/xserver/commit/?id=957e8db38f27932d353e86e9aa69cf16778b18f1

--
Use arc4random_buf(3) if available to generate cookies.

Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
--

port to xorg-server 1.10:

--
Log Message:
apply

https://cgit.freedesktop.org/xorg/xserver/commit/?id=d7ac755f0b618eb1259d93c8a16ec6e39a18627c

Use timingsafe_memcmp() to compare MIT-MAGIC-COOKIES CVE-2017-2624
Provide the function definition for systems that don't have it.

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>

and
https://cgit.freedesktop.org/xorg/xserver/commit/?id=5c44169caed811e59a65ba346de1cadb46d266ec

os: Squash missing declaration warning for timingsafe_memcmp
timingsafe_memcmp.c:21:1: warning: no previous prototype for `timingsafe_memcmp' [-Wmissing-prototypes]
timingsafe_memcmp(const void *b1, const void *b2, size_t len)

Signed-off-by: Adam Jackson <ajax@redhat.com>
--

port to xorg-server 1.10:
--
Log Message:
apply
https://cgit.freedesktop.org/xorg/xserver/commit/?id=2855f759b1e7bf7f5e57cac36c1f0d0e5ac1a683

auth: remove AuthToIDFunc and associated functions. Not used anymore.
And the current code for MitToId has a use-after-free() issue.

[Also remove the actual implementations - ajax]

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
--

Fix -O0 build; <machine/bwx.h> should be included after ".arch ev56" pseudo-op.

prune xrefs to xorgconfig

Avoid legacy VGA I/O port access on MIPS. Xorg converts the I/O port
address to a pointer and dereferences it, and then seg faults.

This fixes Xorg on my Lemote YeeLoong netbook.

initial import of existing netbsd xorg-server 1.10 sources in the
xorg-server.old subdir.