upgpkg: xorg-server 21.1.3-6

6 files changed, 227 insertions, 5 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 666d272351e7..1987dcac50a9 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,6 +1,6 @@
 pkgbase = xorg-server-bug865
 	pkgver = 21.1.3
-	pkgrel = 2
+	pkgrel = 6
 	url = https://xorg.freedesktop.org
 	arch = x86_64
 	groups = xorg
@@ -41,13 +41,19 @@ pkgbase = xorg-server-bug865
 	source = xvfb-run
 	source = xvfb-run.1
 	source = 0001-xkb-fix-XkbSetMap-when-changing-a-keysym-without-cha.patch
+	source = 0002-xephyr_Dont_check_for_SeatId_anymore.patch
+	source = 0003-dix_Correctly_save_replayed_event_into_GrabInfoRec.patch
+	source = 0004-present_Check_for_NULL_to_prevent_crash.patch
 	source = freedesktop-bug-865.patch
 	validpgpkeys = FD0004A26EADFE43A4C3F249C6F7AE200374452D
 	sha512sums = cf5fed023eadda62ae732f8c4d427c272ebe005188341290f3d03147042c103b00cbb94d86a0256da815fb9b9a3da315c21a05ee0c926c1a2ff0c54ab0c0638b
 	sha512sums = SKIP
-	sha512sums = 4154dd55702b98083b26077bf70c60aa957b4795dbf831bcc4c78b3cb44efe214f0cf8e3c140729c829b5f24e7466a24615ab8dbcce0ac6ebee3229531091514
+	sha512sums = 87c79b4a928e74463f96f58d277558783eac9b8ea6ba00d6bbbb67ad84c4d65b3792d960ea2a70089ae18162e82ae572a49ad36df169c974cc99dbaa51f63eb2
 	sha512sums = de5e2cb3c6825e6cf1f07ca0d52423e17f34d70ec7935e9dd24be5fb9883bf1e03b50ff584931bd3b41095c510ab2aa44d2573fd5feaebdcb59363b65607ff22
 	sha512sums = bc3b955072f320ae72a771bebecbcf56637cd0448c3afa28149fcd9e0de3700e9fba1fec21fe283be77e1236e317e385f6970eb59df54d3181324c229c8309d7
+	sha512sums = 34de52147054535256f35143d321e4d5e189baae502afca2bd3291094946dbead0829b1f196ae2a4d23bd6d0e1e04b65a387dee43f12dee55d247e37aec419d7
+	sha512sums = 01acc49ee9d0681b1ec3f9f22cd4e0dbaee2f5395ebe796e158e30c7d61890337a01fe7ace267d90d62e29f3d74b981391feb7cc5840c187d62f9433ce8e1fff
+	sha512sums = a61128b27b76b7089a4b43f9b679d9ecd607b5d8645fa5ef635902e4a51a7609e3bff0190d877117ce324d49a2711375850df2046f4cad99ea8a8c6cc8cf11fa
 	sha512sums = c3b541c7ac95c94f682577cacedc06e79427003a870cde844056a7662087873b59dc06933552bb867b16fc0387f8a061672df780454769f26aa3e53b13a94edf
 
 pkgname = xorg-server-bug865
diff --git a/0002-xephyr_Dont_check_for_SeatId_anymore.patch b/0002-xephyr_Dont_check_for_SeatId_anymore.patch
new file mode 100644
index 000000000000..f0158bfe1ad3
--- /dev/null
+++ b/0002-xephyr_Dont_check_for_SeatId_anymore.patch
@@ -0,0 +1,63 @@
+From 4c03b67d334b05b814239420776f2fdd4c4a98ac Mon Sep 17 00:00:00 2001
+From: nerdopolis <bluescreen_avenger@verizon.net>
+Date: Tue, 11 Jan 2022 18:41:42 -0500
+Subject: [PATCH] xephyr: Don't check for SeatId anymore
+
+After a change for the xserver to automatically determine the seat
+based on the XDG_SEAT variable, xephyr stopped working. This was
+because of an old feature where xephyr used to handle evdev
+directly. This was dropped some time ago, and now this check is
+not needed
+---
+ hw/kdrive/ephyr/ephyrinit.c | 34 ++++++++++++++++------------------
+ 1 file changed, 16 insertions(+), 18 deletions(-)
+
+diff --git a/hw/kdrive/ephyr/ephyrinit.c b/hw/kdrive/ephyr/ephyrinit.c
+index 020461db2..09cd28cb3 100644
+--- a/hw/kdrive/ephyr/ephyrinit.c
++++ b/hw/kdrive/ephyr/ephyrinit.c
+@@ -70,25 +70,23 @@ InitInput(int argc, char **argv)
+     KdKeyboardInfo *ki;
+     KdPointerInfo *pi;
+ 
+-    if (!SeatId) {
+-        KdAddKeyboardDriver(&EphyrKeyboardDriver);
+-        KdAddPointerDriver(&EphyrMouseDriver);
+-
+-        if (!kdHasKbd) {
+-            ki = KdNewKeyboard();
+-            if (!ki)
+-                FatalError("Couldn't create Xephyr keyboard\n");
+-            ki->driver = &EphyrKeyboardDriver;
+-            KdAddKeyboard(ki);
+-        }
++    KdAddKeyboardDriver(&EphyrKeyboardDriver);
++    KdAddPointerDriver(&EphyrMouseDriver);
++
++    if (!kdHasKbd) {
++        ki = KdNewKeyboard();
++        if (!ki)
++            FatalError("Couldn't create Xephyr keyboard\n");
++        ki->driver = &EphyrKeyboardDriver;
++        KdAddKeyboard(ki);
++    }
+ 
+-        if (!kdHasPointer) {
+-            pi = KdNewPointer();
+-            if (!pi)
+-                FatalError("Couldn't create Xephyr pointer\n");
+-            pi->driver = &EphyrMouseDriver;
+-            KdAddPointer(pi);
+-        }
++    if (!kdHasPointer) {
++        pi = KdNewPointer();
++        if (!pi)
++            FatalError("Couldn't create Xephyr pointer\n");
++        pi->driver = &EphyrMouseDriver;
++        KdAddPointer(pi);
+     }
+ 
+     KdInitInput();
+-- 
+GitLab
+
diff --git a/0003-dix_Correctly_save_replayed_event_into_GrabInfoRec.patch b/0003-dix_Correctly_save_replayed_event_into_GrabInfoRec.patch
new file mode 100644
index 000000000000..9ccbd58ebbc4
--- /dev/null
+++ b/0003-dix_Correctly_save_replayed_event_into_GrabInfoRec.patch
@@ -0,0 +1,98 @@
+From 6ef5c05728f8b18170fbc8415d7502495a08670b Mon Sep 17 00:00:00 2001
+From: Povilas Kanapickas <povilas@radix.lt>
+Date: Sun, 23 Jan 2022 22:18:52 +0200
+Subject: [PATCH] dix: Correctly save replayed event into GrabInfoRec
+
+When processing events we operate on InternalEvent pointers. They may
+actually refer to a an instance of DeviceEvent, GestureEvent or any
+other event that comprises the InternalEvent union. This works well in
+practice because we always look into event type before doing anything,
+except in the case of copying the event.
+
+*dst_event = *src_event would copy whole InternalEvent event and would
+cause out of bounds read in case the pointed to event was not
+InternalEvent but e.g. DeviceEvent.
+
+This regression has been introduced in
+23a8b62d34344575f9df9d057fb74bfefa94a77b.
+
+Fixes https://gitlab.freedesktop.org/xorg/xserver/-/issues/1261
+
+Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
+---
+ Xi/exevents.c   |  2 +-
+ dix/events.c    | 18 ++++++++++++++++--
+ include/input.h |  1 +
+ 3 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/Xi/exevents.c b/Xi/exevents.c
+index 94b9983bd..217baa956 100644
+--- a/Xi/exevents.c
++++ b/Xi/exevents.c
+@@ -1524,7 +1524,7 @@ DeliverTouchEmulatedEvent(DeviceIntPtr dev, TouchPointInfoPtr ti,
+             g = AllocGrab(devgrab);
+             BUG_WARN(!g);
+ 
+-            *dev->deviceGrab.sync.event = *ev;
++            CopyPartialInternalEvent(dev->deviceGrab.sync.event, ev);
+ 
+             /* The listener array has a sequence of grabs and then one event
+              * selection. Implicit grab activation occurs through delivering an
+diff --git a/dix/events.c b/dix/events.c
+index 341c746d4..28d7d177c 100644
+--- a/dix/events.c
++++ b/dix/events.c
+@@ -467,6 +467,20 @@ WindowXI2MaskIsset(DeviceIntPtr dev, WindowPtr win, xEvent *ev)
+     return xi2mask_isset(inputMasks->xi2mask, dev, evtype);
+ }
+ 
++/**
++ * When processing events we operate on InternalEvent pointers. They may actually refer to a
++ * an instance of DeviceEvent, GestureEvent or any other event that comprises the InternalEvent
++ * union. This works well in practice because we always look into event type before doing anything,
++ * except in the case of copying the event. Any copying of InternalEvent should use this function
++ * instead of doing *dst_event = *src_event whenever it's not clear whether source event actually
++ * points to full InternalEvent instance.
++ */
++void
++CopyPartialInternalEvent(InternalEvent* dst_event, const InternalEvent* src_event)
++{
++    memcpy(dst_event, src_event, src_event->any.length);
++}
++
+ Mask
+ GetEventMask(DeviceIntPtr dev, xEvent *event, InputClients * other)
+ {
+@@ -3873,7 +3887,7 @@ void ActivateGrabNoDelivery(DeviceIntPtr dev, GrabPtr grab,
+ 
+     if (grabinfo->sync.state == FROZEN_NO_EVENT)
+         grabinfo->sync.state = FROZEN_WITH_EVENT;
+-    *grabinfo->sync.event = *real_event;
++    CopyPartialInternalEvent(grabinfo->sync.event, real_event);
+ }
+ 
+ static BOOL
+@@ -4455,7 +4469,7 @@ FreezeThisEventIfNeededForSyncGrab(DeviceIntPtr thisDev, InternalEvent *event)
+     case FREEZE_NEXT_EVENT:
+         grabinfo->sync.state = FROZEN_WITH_EVENT;
+         FreezeThaw(thisDev, TRUE);
+-        *grabinfo->sync.event = *event;
++        CopyPartialInternalEvent(grabinfo->sync.event, event);
+         break;
+     }
+ }
+diff --git a/include/input.h b/include/input.h
+index b1aef3663..cdb5d5a90 100644
+--- a/include/input.h
++++ b/include/input.h
+@@ -676,6 +676,7 @@ extern void GestureEmitGestureEndToOwner(DeviceIntPtr dev, GestureInfoPtr gi);
+ extern void ProcessGestureEvent(InternalEvent *ev, DeviceIntPtr dev);
+ 
+ /* misc event helpers */
++extern void CopyPartialInternalEvent(InternalEvent* dst_event, const InternalEvent* src_event);
+ extern Mask GetEventMask(DeviceIntPtr dev, xEvent *ev, InputClientsPtr clients);
+ extern Mask GetEventFilter(DeviceIntPtr dev, xEvent *event);
+ extern Bool WindowXI2MaskIsset(DeviceIntPtr dev, WindowPtr win, xEvent *ev);
+-- 
+GitLab
+
diff --git a/0004-present_Check_for_NULL_to_prevent_crash.patch b/0004-present_Check_for_NULL_to_prevent_crash.patch
new file mode 100644
index 000000000000..edc147bae8d3
--- /dev/null
+++ b/0004-present_Check_for_NULL_to_prevent_crash.patch
@@ -0,0 +1,43 @@
+From 69774044716039fa70655b3bc6dd6a4ff4535cfd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?B=C5=82a=C5=BCej=20Szczygie=C5=82?= <spaz16@wp.pl>
+Date: Thu, 13 Jan 2022 00:47:27 +0100
+Subject: [PATCH] present: Check for NULL to prevent crash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1275
+Signed-off-by: Błażej Szczygieł <spaz16@wp.pl>
+Tested-by: Aaron Plattner <aplattner@nvidia.com>
+(cherry picked from commit 22d5818851967408bb7c903cb345b7ca8766094c)
+---
+ present/present_scmd.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/present/present_scmd.c b/present/present_scmd.c
+index da836ea6b..239055bc1 100644
+--- a/present/present_scmd.c
++++ b/present/present_scmd.c
+@@ -158,6 +158,9 @@ present_scmd_get_crtc(present_screen_priv_ptr screen_priv, WindowPtr window)
+     if (!screen_priv->info)
+         return NULL;
+ 
++    if (!screen_priv->info->get_crtc)
++        return NULL;
++
+     return (*screen_priv->info->get_crtc)(window);
+ }
+ 
+@@ -196,6 +199,9 @@ present_flush(WindowPtr window)
+     if (!screen_priv->info)
+         return;
+ 
++    if (!screen_priv->info->flush)
++        return;
++
+     (*screen_priv->info->flush) (window);
+ }
+ 
+-- 
+GitLab
+
diff --git a/PKGBUILD b/PKGBUILD
index bf52432eea14..23ad8e6db0f1 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -5,7 +5,7 @@ pkgbase=xorg-server-bug865
 pkgname=xorg-server-bug865
 
 pkgver=21.1.3
-pkgrel=2
+pkgrel=6
 arch=('x86_64')
 license=('custom')
 groups=('xorg')
@@ -21,13 +21,19 @@ source=(https://xorg.freedesktop.org/releases/individual/xserver/xorg-server-${p
         xvfb-run # with updates from FC master
         xvfb-run.1
         0001-xkb-fix-XkbSetMap-when-changing-a-keysym-without-cha.patch
+        0002-xephyr_Dont_check_for_SeatId_anymore.patch
+        0003-dix_Correctly_save_replayed_event_into_GrabInfoRec.patch
+        0004-present_Check_for_NULL_to_prevent_crash.patch
         freedesktop-bug-865.patch)
 validpgpkeys=('FD0004A26EADFE43A4C3F249C6F7AE200374452D') # Povilas Kanapickas <povilas@radix.lt>
 sha512sums=('cf5fed023eadda62ae732f8c4d427c272ebe005188341290f3d03147042c103b00cbb94d86a0256da815fb9b9a3da315c21a05ee0c926c1a2ff0c54ab0c0638b'
             'SKIP'
-            '4154dd55702b98083b26077bf70c60aa957b4795dbf831bcc4c78b3cb44efe214f0cf8e3c140729c829b5f24e7466a24615ab8dbcce0ac6ebee3229531091514'
+            '87c79b4a928e74463f96f58d277558783eac9b8ea6ba00d6bbbb67ad84c4d65b3792d960ea2a70089ae18162e82ae572a49ad36df169c974cc99dbaa51f63eb2'
             'de5e2cb3c6825e6cf1f07ca0d52423e17f34d70ec7935e9dd24be5fb9883bf1e03b50ff584931bd3b41095c510ab2aa44d2573fd5feaebdcb59363b65607ff22'
             'bc3b955072f320ae72a771bebecbcf56637cd0448c3afa28149fcd9e0de3700e9fba1fec21fe283be77e1236e317e385f6970eb59df54d3181324c229c8309d7'
+            '34de52147054535256f35143d321e4d5e189baae502afca2bd3291094946dbead0829b1f196ae2a4d23bd6d0e1e04b65a387dee43f12dee55d247e37aec419d7'
+            '01acc49ee9d0681b1ec3f9f22cd4e0dbaee2f5395ebe796e158e30c7d61890337a01fe7ace267d90d62e29f3d74b981391feb7cc5840c187d62f9433ce8e1fff'
+            'a61128b27b76b7089a4b43f9b679d9ecd607b5d8645fa5ef635902e4a51a7609e3bff0190d877117ce324d49a2711375850df2046f4cad99ea8a8c6cc8cf11fa'
             'c3b541c7ac95c94f682577cacedc06e79427003a870cde844056a7662087873b59dc06933552bb867b16fc0387f8a061672df780454769f26aa3e53b13a94edf')
 
 prepare() {
@@ -35,6 +41,12 @@ prepare() {
 
   # merged in main
   patch -Np1 -i ../0001-xkb-fix-XkbSetMap-when-changing-a-keysym-without-cha.patch
+  # FS#73274
+  patch -Np1 -i ../0002-xephyr_Dont_check_for_SeatId_anymore.patch
+  # FS#73875
+  patch -Np1 -i ../0003-dix_Correctly_save_replayed_event_into_GrabInfoRec.patch
+  # FS#73895
+  patch -Np1 -i ../0004-present_Check_for_NULL_to_prevent_crash.patch
 
   # The patch for freedesktop bug 865
   patch -Np1 -i "${srcdir}/freedesktop-bug-865.patch"
diff --git a/xvfb-run b/xvfb-run
index 8e046f2aabf3..6bc62d094993 100644
--- a/xvfb-run
+++ b/xvfb-run
@@ -101,7 +101,7 @@ find_free_servernum() {
 
 # Parse the command line.
 ARGS=$(getopt --options +ade:f:hn:lp:s:w: \
-       --long auto-servernum,auto-display,error-file:auth-file:,help,server-num:,listen-tcp,xauth-protocol:,server-args:,wait: \
+       --long auto-servernum,auto-display,error-file:,auth-file:,help,server-num:,listen-tcp,xauth-protocol:,server-args:,wait: \
        --name "$PROGNAME" -- "$@")
 GETOPT_STATUS=$?