diff options
author | Steve Sakoman <steve@sakoman.com> | 2022-03-29 06:20:27 -1000 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-04-01 23:22:43 +0100 |
commit | e2ecbb13db5a2f7a45f2618e842c0ff3bd3acbb9 (patch) | |
tree | 2e16510a9c451e9b20823b6e8d78a76393d82d44 /meta/recipes-graphics | |
parent | 14127d25e79924fdbcb6c6ad1790c293538a5743 (diff) | |
download | poky-e2ecbb13db5a2f7a45f2618e842c0ff3bd3acbb9.tar.gz |
xserver-xorg: update to 1.20.10
Remove CVE patches contained in this release.
Stable branch update:
bc111a2e6 (tag: xorg-server-1.20.10) xserver 1.20.10
06d1a032e Check SetMap request length carefully.
7ccb3b0ea Fix XkbSetDeviceInfo() and SetDeviceIndicators() heap overflows
440ed5948 present/wnmd: Translate update region to screen space
54f9af1c6 modesetting: keep going if a modeset fails on EnterVT
bd0f53725 modesetting: check the kms state on EnterVT
5c400cae1 configure: Build hashtable for Xres and glvnd
253569a3d xwayland: Create an xwl_window for toplevel only
0811a9ff7 xwayland: non-rootless requires the wl_shell protocol
b3ae038c3 glamor: Update pixmap's devKind when making it exportable
d6c389cb8 os: Fix instruction pointer written in xorg_backtrace
c3e4c1a0f present/wnmd: Execute copies at target_msc-1 already
96ef31e0f present/wnmd: Move up present_wnmd_queue_vblank
669e40390 present: Add present_vblank::exec_msc field
dae234efd present: Move flip target_msc adjustment out of present_vblank_create
1930ed233 xwayland: Remove pending stream reference when freeing
1ac389dda xwayland: use drmGetNodeTypeFromFd for checking if a node is a render one
d108c2c82 xwayland: Do not discard frame callbacks on allow commits
174cb91d8 present/wnmd: Remove dead check from present_wnmd_check_flip
51ee6e5ce xwayland: Check window pixmap in xwl_present_check_flip2
f4006d795 present/wnmd: Can't use page flipping for windows clipped by children
1e84fda20 xfree86: Take second reference for SavedCursor in xf86CursorSetCursor
8c3c8bda2 glamor: Fix glamor_poly_fill_rect_gl xRectangle::width/height handling
b28c88288 include: Increase the number of max. input devices to 256.
af4c84ce8 Revert "linux: Make platform device probe less fragile"
39cb95e95 Revert "linux: Fix platform device PCI detection for complex bus topologies"
4b6fce597 Revert "linux: Fix platform device probe for DT-based PCI"
(From OE-Core rev: ac86083917380ca8398307f0e59b7bb73c727b4f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-graphics')
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14360.patch | 132 | ||||
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-25712.patch | 102 | ||||
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.10.bb (renamed from meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.9.bb) | 6 |
3 files changed, 2 insertions, 238 deletions
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14360.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14360.patch deleted file mode 100644 index e9ab42742e..0000000000 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14360.patch +++ /dev/null | |||
@@ -1,132 +0,0 @@ | |||
1 | From 446ff2d3177087b8173fa779fa5b77a2a128988b Mon Sep 17 00:00:00 2001 | ||
2 | From: Matthieu Herrb <matthieu@herrb.eu> | ||
3 | Date: Thu, 12 Nov 2020 19:15:07 +0100 | ||
4 | Subject: [PATCH] Check SetMap request length carefully. | ||
5 | |||
6 | Avoid out of bounds memory accesses on too short request. | ||
7 | |||
8 | ZDI-CAN 11572 / CVE-2020-14360 | ||
9 | |||
10 | This vulnerability was discovered by: | ||
11 | Jan-Niklas Sohn working with Trend Micro Zero Day Initiative | ||
12 | |||
13 | Signed-off-by: Matthieu Herrb <matthieu@herrb.eu> | ||
14 | |||
15 | Upstream-Status: Backport | ||
16 | https://gitlab.freedesktop.org/xorg/xserver/-/commit/446ff2d3177087b8173fa779fa5b77a2a128988b | ||
17 | CVE: CVE-2020-14360 | ||
18 | Signed-off-by: Armin Kuster <akuster@mvista.com> | ||
19 | --- | ||
20 | xkb/xkb.c | 92 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ | ||
21 | 1 file changed, 92 insertions(+) | ||
22 | |||
23 | Index: xorg-server-1.20.8/xkb/xkb.c | ||
24 | =================================================================== | ||
25 | --- xorg-server-1.20.8.orig/xkb/xkb.c | ||
26 | +++ xorg-server-1.20.8/xkb/xkb.c | ||
27 | @@ -2382,6 +2382,93 @@ SetVirtualModMap(XkbSrvInfoPtr xkbi, | ||
28 | return (char *) wire; | ||
29 | } | ||
30 | |||
31 | +#define _add_check_len(new) \ | ||
32 | + if (len > UINT32_MAX - (new) || len > req_len - (new)) goto bad; \ | ||
33 | + else len += new | ||
34 | + | ||
35 | +/** | ||
36 | + * Check the length of the SetMap request | ||
37 | + */ | ||
38 | +static int | ||
39 | +_XkbSetMapCheckLength(xkbSetMapReq *req) | ||
40 | +{ | ||
41 | + size_t len = sz_xkbSetMapReq, req_len = req->length << 2; | ||
42 | + xkbKeyTypeWireDesc *keytype; | ||
43 | + xkbSymMapWireDesc *symmap; | ||
44 | + BOOL preserve; | ||
45 | + int i, map_count, nSyms; | ||
46 | + | ||
47 | + if (req_len < len) | ||
48 | + goto bad; | ||
49 | + /* types */ | ||
50 | + if (req->present & XkbKeyTypesMask) { | ||
51 | + keytype = (xkbKeyTypeWireDesc *)(req + 1); | ||
52 | + for (i = 0; i < req->nTypes; i++) { | ||
53 | + _add_check_len(XkbPaddedSize(sz_xkbKeyTypeWireDesc)); | ||
54 | + if (req->flags & XkbSetMapResizeTypes) { | ||
55 | + _add_check_len(keytype->nMapEntries | ||
56 | + * sz_xkbKTSetMapEntryWireDesc); | ||
57 | + preserve = keytype->preserve; | ||
58 | + map_count = keytype->nMapEntries; | ||
59 | + if (preserve) { | ||
60 | + _add_check_len(map_count * sz_xkbModsWireDesc); | ||
61 | + } | ||
62 | + keytype += 1; | ||
63 | + keytype = (xkbKeyTypeWireDesc *) | ||
64 | + ((xkbKTSetMapEntryWireDesc *)keytype + map_count); | ||
65 | + if (preserve) | ||
66 | + keytype = (xkbKeyTypeWireDesc *) | ||
67 | + ((xkbModsWireDesc *)keytype + map_count); | ||
68 | + } | ||
69 | + } | ||
70 | + } | ||
71 | + /* syms */ | ||
72 | + if (req->present & XkbKeySymsMask) { | ||
73 | + symmap = (xkbSymMapWireDesc *)((char *)req + len); | ||
74 | + for (i = 0; i < req->nKeySyms; i++) { | ||
75 | + _add_check_len(sz_xkbSymMapWireDesc); | ||
76 | + nSyms = symmap->nSyms; | ||
77 | + _add_check_len(nSyms*sizeof(CARD32)); | ||
78 | + symmap += 1; | ||
79 | + symmap = (xkbSymMapWireDesc *)((CARD32 *)symmap + nSyms); | ||
80 | + } | ||
81 | + } | ||
82 | + /* actions */ | ||
83 | + if (req->present & XkbKeyActionsMask) { | ||
84 | + _add_check_len(req->totalActs * sz_xkbActionWireDesc | ||
85 | + + XkbPaddedSize(req->nKeyActs)); | ||
86 | + } | ||
87 | + /* behaviours */ | ||
88 | + if (req->present & XkbKeyBehaviorsMask) { | ||
89 | + _add_check_len(req->totalKeyBehaviors * sz_xkbBehaviorWireDesc); | ||
90 | + } | ||
91 | + /* vmods */ | ||
92 | + if (req->present & XkbVirtualModsMask) { | ||
93 | + _add_check_len(XkbPaddedSize(Ones(req->virtualMods))); | ||
94 | + } | ||
95 | + /* explicit */ | ||
96 | + if (req->present & XkbExplicitComponentsMask) { | ||
97 | + /* two bytes per non-zero explicit componen */ | ||
98 | + _add_check_len(XkbPaddedSize(req->totalKeyExplicit * sizeof(CARD16))); | ||
99 | + } | ||
100 | + /* modmap */ | ||
101 | + if (req->present & XkbModifierMapMask) { | ||
102 | + /* two bytes per non-zero modmap component */ | ||
103 | + _add_check_len(XkbPaddedSize(req->totalModMapKeys * sizeof(CARD16))); | ||
104 | + } | ||
105 | + /* vmodmap */ | ||
106 | + if (req->present & XkbVirtualModMapMask) { | ||
107 | + _add_check_len(req->totalVModMapKeys * sz_xkbVModMapWireDesc); | ||
108 | + } | ||
109 | + if (len == req_len) | ||
110 | + return Success; | ||
111 | +bad: | ||
112 | + ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %ld got %ld\n", | ||
113 | + len, req_len); | ||
114 | + return BadLength; | ||
115 | +} | ||
116 | + | ||
117 | + | ||
118 | /** | ||
119 | * Check if the given request can be applied to the given device but don't | ||
120 | * actually do anything.. | ||
121 | @@ -2639,6 +2726,11 @@ ProcXkbSetMap(ClientPtr client) | ||
122 | CHK_KBD_DEVICE(dev, stuff->deviceSpec, client, DixManageAccess); | ||
123 | CHK_MASK_LEGAL(0x01, stuff->present, XkbAllMapComponentsMask); | ||
124 | |||
125 | + /* first verify the request length carefully */ | ||
126 | + rc = _XkbSetMapCheckLength(stuff); | ||
127 | + if (rc != Success) | ||
128 | + return rc; | ||
129 | + | ||
130 | tmp = (char *) &stuff[1]; | ||
131 | |||
132 | /* Check if we can to the SetMap on the requested device. If this | ||
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-25712.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-25712.patch deleted file mode 100644 index f39f6b32b1..0000000000 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-25712.patch +++ /dev/null | |||
@@ -1,102 +0,0 @@ | |||
1 | From 87c64fc5b0db9f62f4e361444f4b60501ebf67b9 Mon Sep 17 00:00:00 2001 | ||
2 | From: Matthieu Herrb <matthieu@herrb.eu> | ||
3 | Date: Sun, 11 Oct 2020 17:05:09 +0200 | ||
4 | Subject: [PATCH] Fix XkbSetDeviceInfo() and SetDeviceIndicators() heap | ||
5 | overflows | ||
6 | |||
7 | ZDI-CAN 11389 / CVE-2020-25712 | ||
8 | |||
9 | This vulnerability was discovered by: | ||
10 | Jan-Niklas Sohn working with Trend Micro Zero Day Initiative | ||
11 | |||
12 | Signed-off-by: Matthieu Herrb <matthieu@herrb.eu> | ||
13 | |||
14 | Upstream-Status: Backport | ||
15 | https://gitlab.freedesktop.org/xorg/xserver/-/commit/87c64fc5b0db9f62f4e361444f4b60501ebf67b9 | ||
16 | CVE: CVE-2020-25712 | ||
17 | Signed-off-by: Armin Kuster <akuster@mvista.com> | ||
18 | |||
19 | --- | ||
20 | xkb/xkb.c | 26 +++++++++++++++++++++++--- | ||
21 | 1 file changed, 23 insertions(+), 3 deletions(-) | ||
22 | |||
23 | Index: xorg-server-1.20.8/xkb/xkb.c | ||
24 | =================================================================== | ||
25 | --- xorg-server-1.20.8.orig/xkb/xkb.c | ||
26 | +++ xorg-server-1.20.8/xkb/xkb.c | ||
27 | @@ -6625,7 +6625,9 @@ SetDeviceIndicators(char *wire, | ||
28 | unsigned changed, | ||
29 | int num, | ||
30 | int *status_rtrn, | ||
31 | - ClientPtr client, xkbExtensionDeviceNotify * ev) | ||
32 | + ClientPtr client, | ||
33 | + xkbExtensionDeviceNotify * ev, | ||
34 | + xkbSetDeviceInfoReq * stuff) | ||
35 | { | ||
36 | xkbDeviceLedsWireDesc *ledWire; | ||
37 | int i; | ||
38 | @@ -6646,6 +6648,11 @@ SetDeviceIndicators(char *wire, | ||
39 | xkbIndicatorMapWireDesc *mapWire; | ||
40 | XkbSrvLedInfoPtr sli; | ||
41 | |||
42 | + if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) { | ||
43 | + *status_rtrn = BadLength; | ||
44 | + return (char *) ledWire; | ||
45 | + } | ||
46 | + | ||
47 | namec = mapc = statec = 0; | ||
48 | sli = XkbFindSrvLedInfo(dev, ledWire->ledClass, ledWire->ledID, | ||
49 | XkbXI_IndicatorMapsMask); | ||
50 | @@ -6664,6 +6671,10 @@ SetDeviceIndicators(char *wire, | ||
51 | memset((char *) sli->names, 0, XkbNumIndicators * sizeof(Atom)); | ||
52 | for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) { | ||
53 | if (ledWire->namesPresent & bit) { | ||
54 | + if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) { | ||
55 | + *status_rtrn = BadLength; | ||
56 | + return (char *) atomWire; | ||
57 | + } | ||
58 | sli->names[n] = (Atom) *atomWire; | ||
59 | if (sli->names[n] == None) | ||
60 | ledWire->namesPresent &= ~bit; | ||
61 | @@ -6681,6 +6692,10 @@ SetDeviceIndicators(char *wire, | ||
62 | if (ledWire->mapsPresent) { | ||
63 | for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) { | ||
64 | if (ledWire->mapsPresent & bit) { | ||
65 | + if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) { | ||
66 | + *status_rtrn = BadLength; | ||
67 | + return (char *) mapWire; | ||
68 | + } | ||
69 | sli->maps[n].flags = mapWire->flags; | ||
70 | sli->maps[n].which_groups = mapWire->whichGroups; | ||
71 | sli->maps[n].groups = mapWire->groups; | ||
72 | @@ -6760,7 +6775,7 @@ _XkbSetDeviceInfoCheck(ClientPtr client, | ||
73 | ed.deviceID = dev->id; | ||
74 | wire = (char *) &stuff[1]; | ||
75 | if (stuff->change & XkbXI_ButtonActionsMask) { | ||
76 | - int nBtns, sz, i; | ||
77 | + int nBtns, sz, i; | ||
78 | XkbAction *acts; | ||
79 | DeviceIntPtr kbd; | ||
80 | |||
81 | @@ -6772,7 +6787,11 @@ _XkbSetDeviceInfoCheck(ClientPtr client, | ||
82 | return BadAlloc; | ||
83 | dev->button->xkb_acts = acts; | ||
84 | } | ||
85 | + if (stuff->firstBtn + stuff->nBtns > nBtns) | ||
86 | + return BadValue; | ||
87 | sz = stuff->nBtns * SIZEOF(xkbActionWireDesc); | ||
88 | + if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz)) | ||
89 | + return BadLength; | ||
90 | memcpy((char *) &acts[stuff->firstBtn], (char *) wire, sz); | ||
91 | wire += sz; | ||
92 | ed.reason |= XkbXI_ButtonActionsMask; | ||
93 | @@ -6793,7 +6812,8 @@ _XkbSetDeviceInfoCheck(ClientPtr client, | ||
94 | int status = Success; | ||
95 | |||
96 | wire = SetDeviceIndicators(wire, dev, stuff->change, | ||
97 | - stuff->nDeviceLedFBs, &status, client, &ed); | ||
98 | + stuff->nDeviceLedFBs, &status, client, &ed, | ||
99 | + stuff); | ||
100 | if (status != Success) | ||
101 | return status; | ||
102 | } | ||
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.9.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.10.bb index 4f001c2d3d..4d368a8b5a 100644 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.9.bb +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.10.bb | |||
@@ -5,11 +5,9 @@ SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.pat | |||
5 | file://0001-test-xtest-Initialize-array-with-braces.patch \ | 5 | file://0001-test-xtest-Initialize-array-with-braces.patch \ |
6 | file://sdksyms-no-build-path.patch \ | 6 | file://sdksyms-no-build-path.patch \ |
7 | file://0001-drmmode_display.c-add-missing-mi.h-include.patch \ | 7 | file://0001-drmmode_display.c-add-missing-mi.h-include.patch \ |
8 | file://CVE-2020-14360.patch \ | ||
9 | file://CVE-2020-25712.patch \ | ||
10 | " | 8 | " |
11 | SRC_URI[md5sum] = "afcae2f46d47c33863cab7fd9db7279a" | 9 | SRC_URI[md5sum] = "8cf8bd1f33e3736bc8dd279b20a32399" |
12 | SRC_URI[sha256sum] = "e219f2e0dfe455467939149d7cd2ee53b79b512cc1d2094ae4f5c9ed9ccd3571" | 10 | SRC_URI[sha256sum] = "977420c082450dc808de301ef56af4856d653eea71519a973c3490a780cb7c99" |
13 | 11 | ||
14 | CFLAGS += "-fcommon" | 12 | CFLAGS += "-fcommon" |
15 | 13 | ||