ChangeLog | 8599 ++++++++++++- Xext/dpms.c | 10 Xext/dpmsstubs.c | 10 Xext/panoramiX.c | 2 Xext/panoramiX.h | 2 Xext/panoramiXprocs.c | 4 Xext/security.c | 4 Xext/shm.c | 6 Xext/sync.c | 2 Xext/syncsrv.h | 8 Xext/xcmisc.c | 1 Xext/xres.c | 12 Xext/xvdisp.c | 28 Xext/xvdix.h | 14 Xext/xvmain.c | 18 Xi/chgdctl.c | 8 Xi/chgfctl.c | 2 Xi/sendexev.c | 3 Xi/xiallowev.c | 2 Xi/xichangecursor.c | 2 Xi/xichangehierarchy.c | 35 Xi/xigetclientpointer.c | 1 Xi/xigrabdev.c | 9 Xi/xipassivegrab.c | 12 Xi/xiproperty.c | 14 Xi/xiquerydevice.c | 1 Xi/xiquerypointer.c | 2 Xi/xiselectev.c | 8 Xi/xisetclientpointer.c | 3 Xi/xisetdevfocus.c | 4 Xi/xiwarppointer.c | 2 composite/compalloc.c | 8 composite/compext.c | 4 composite/compinit.c | 2 composite/compint.h | 2 composite/compoverlay.c | 4 config/udev.c | 7 configure.ac | 1 dbe/dbe.c | 33 dbe/dbestruct.h | 12 dbe/midbe.c | 14 dbe/midbe.h | 8 debian/changelog | 61 debian/control | 8 debian/patches/disable-rotation-transform-gpuscreens.patch | 35 debian/serverminver | 2 dix/atom.c | 8 dix/colormap.c | 34 dix/cursor.c | 8 dix/devices.c | 2 dix/dispatch.c | 19 dix/dispatch.h | 2 dix/dixfonts.c | 6 dix/dixutils.c | 12 dix/extension.c | 8 dix/gc.c | 22 dix/globals.c | 8 dix/glyphcurs.c | 8 dix/grabs.c | 16 dix/inpututils.c | 2 dix/main.c | 8 dix/property.c | 8 dix/region.c | 42 dix/resource.c | 16 dix/selection.c | 10 dix/swaprep.c | 8 dix/swapreq.c | 8 dix/tables.c | 8 dix/window.c | 38 dri3/dri3_request.c | 6 exa/exa.c | 2 exa/exa.h | 8 exa/exa_glyphs.c | 8 exa/exa_render.c | 4 fb/fb24_32.c | 2 fb/fb24_32.h | 2 fb/fbbltone.c | 6 fb/fbfillrect.c | 2 fb/fbgc.c | 2 fb/fbglyph.c | 2 fb/fboverlay.c | 2 fb/fboverlay.h | 2 fb/fbpict.c | 6 fb/fbpixmap.c | 6 fb/fbrop.h | 2 glamor/glamor.c | 19 glamor/glamor.h | 2 glamor/glamor_egl.c | 77 glamor/glamor_egl_stubs.c | 2 glamor/glamor_fbo.c | 3 glamor/glamor_picture.c | 2 glamor/glamor_priv.h | 3 glx/clientinfo.c | 20 glx/glxbyteorder.h | 8 glx/glxcmds.c | 112 glx/glxcmdsswap.c | 4 glx/glxdri2.c | 2 glx/glxext.c | 8 glx/glxext.h | 1 glx/glxscreens.c | 2 glx/glxscreens.h | 2 glx/glxserver.h | 43 glx/indirect_dispatch.c | 6 glx/indirect_dispatch.h | 6 glx/indirect_dispatch_swap.c | 6 glx/indirect_program.c | 8 glx/indirect_reqsize.c | 148 glx/indirect_reqsize.h | 187 glx/indirect_size.h | 6 glx/indirect_size_get.c | 6 glx/indirect_size_get.h | 6 glx/indirect_table.c | 6 glx/indirect_table.h | 6 glx/indirect_texture_compression.c | 10 glx/indirect_util.c | 17 glx/indirect_util.h | 6 glx/rensize.c | 118 glx/single2.c | 23 glx/single2swap.c | 19 glx/singlepix.c | 60 glx/singlepixswap.c | 50 glx/swap_interval.c | 2 glx/unpack.h | 3 hw/dmx/config/Canvas.c | 2 hw/dmx/config/dmxprint.c | 2 hw/dmx/dmxpict.h | 2 hw/dmx/glxProxy/glxcmds.c | 16 hw/dmx/glxProxy/glxsingle.c | 4 hw/dmx/glxProxy/glxvendor.c | 4 hw/dmx/input/ChkNotMaskEv.c | 2 hw/dmx/input/lnx-keyboard.c | 20 hw/dmx/input/lnx-ms.c | 2 hw/kdrive/ephyr/ephyr.c | 14 hw/kdrive/ephyr/ephyr.h | 4 hw/kdrive/ephyr/ephyrdri.c | 4 hw/kdrive/ephyr/ephyrdri.h | 4 hw/kdrive/ephyr/ephyrdriext.c | 4 hw/kdrive/ephyr/ephyrdriext.h | 4 hw/kdrive/ephyr/ephyrglxext.c | 4 hw/kdrive/ephyr/ephyrglxext.h | 4 hw/kdrive/ephyr/ephyrhostglx.c | 4 hw/kdrive/ephyr/ephyrhostglx.h | 4 hw/kdrive/ephyr/ephyrinit.c | 4 hw/kdrive/ephyr/ephyrlog.h | 4 hw/kdrive/ephyr/ephyrvideo.c | 4 hw/kdrive/ephyr/hostx.c | 12 hw/kdrive/ephyr/hostx.h | 4 hw/kdrive/ephyr/os.c | 4 hw/xfree86/common/Makefile.am | 4 hw/xfree86/common/compiler.h | 4 hw/xfree86/common/xf86AutoConfig.c | 8 hw/xfree86/common/xf86Bus.c | 2 hw/xfree86/common/xf86Config.c | 4 hw/xfree86/common/xf86Configure.c | 4 hw/xfree86/common/xf86Mode.c | 8 hw/xfree86/common/xf86PciInfo.h | 2 hw/xfree86/common/xf86Xinput.c | 16 hw/xfree86/common/xf86Xinput.h | 6 hw/xfree86/common/xf86cmap.c | 4 hw/xfree86/common/xf86fbman.c | 6 hw/xfree86/common/xf86platformBus.c | 2 hw/xfree86/common/xf86str.h | 2 hw/xfree86/common/xf86vmode.c | 8 hw/xfree86/common/xf86xvmc.h | 10 hw/xfree86/ddc/ddc.c | 10 hw/xfree86/ddc/edid.h | 8 hw/xfree86/ddc/print_edid.c | 2 hw/xfree86/ddc/xf86DDC.h | 6 hw/xfree86/dixmods/xkbKillSrv.c | 16 hw/xfree86/dixmods/xkbVT.c | 16 hw/xfree86/dri/dri.c | 4 hw/xfree86/dri/sarea.h | 10 hw/xfree86/dri2/dri2ext.c | 3 hw/xfree86/drivers/modesetting/driver.c | 16 hw/xfree86/drivers/modesetting/driver.h | 1 hw/xfree86/drivers/modesetting/drmmode_display.c | 32 hw/xfree86/drivers/modesetting/drmmode_display.h | 5 hw/xfree86/fbdevhw/fbdevhw.c | 2 hw/xfree86/i2c/xf86i2c.c | 40 hw/xfree86/i2c/xf86i2c.h | 2 hw/xfree86/loader/loadmod.c | 4 hw/xfree86/modes/xf86Crtc.c | 4 hw/xfree86/modes/xf86Crtc.h | 10 hw/xfree86/modes/xf86RandR12.c | 4 hw/xfree86/modes/xf86cvt.c | 4 hw/xfree86/modes/xf86gtf.c | 10 hw/xfree86/os-support/bsd/alpha_video.c | 20 hw/xfree86/os-support/bsd/arm_video.c | 28 hw/xfree86/os-support/bsd/bsd_apm.c | 2 hw/xfree86/os-support/bsd/bsd_bell.c | 20 hw/xfree86/os-support/bsd/bsd_init.c | 24 hw/xfree86/os-support/bsd/bsd_kqueue_apm.c | 16 hw/xfree86/os-support/bsd/i386_video.c | 22 hw/xfree86/os-support/bsd/ppc_video.c | 20 hw/xfree86/os-support/bsd/sparc64_video.c | 20 hw/xfree86/os-support/hurd/hurd_video.c | 4 hw/xfree86/os-support/linux/lnx_agp.c | 4 hw/xfree86/os-support/linux/lnx_kmod.c | 2 hw/xfree86/os-support/linux/systemd-logind.c | 2 hw/xfree86/os-support/misc/SlowBcopy.c | 8 hw/xfree86/os-support/shared/ioperm_noop.c | 2 hw/xfree86/os-support/shared/sigio.c | 6 hw/xfree86/os-support/solaris/sun_apm.c | 2 hw/xfree86/os-support/xf86_OSlib.h | 30 hw/xfree86/os-support/xf86_OSproc.h | 28 hw/xfree86/parser/Configint.h | 18 hw/xfree86/parser/DRI.c | 8 hw/xfree86/parser/Device.c | 16 hw/xfree86/parser/Files.c | 14 hw/xfree86/parser/Flags.c | 16 hw/xfree86/parser/Input.c | 16 hw/xfree86/parser/Layout.c | 16 hw/xfree86/parser/Module.c | 16 hw/xfree86/parser/Monitor.c | 18 hw/xfree86/parser/Pointer.c | 16 hw/xfree86/parser/Screen.c | 16 hw/xfree86/parser/Vendor.c | 16 hw/xfree86/parser/Video.c | 16 hw/xfree86/parser/read.c | 22 hw/xfree86/parser/scan.c | 36 hw/xfree86/parser/write.c | 14 hw/xfree86/parser/xf86Optrec.h | 18 hw/xfree86/parser/xf86Parser.h | 18 hw/xfree86/parser/xf86tokens.h | 18 hw/xfree86/ramdac/IBM.c | 4 hw/xfree86/ramdac/TI.c | 2 hw/xfree86/ramdac/xf86Cursor.c | 2 hw/xfree86/ramdac/xf86HWCurs.c | 2 hw/xfree86/ramdac/xf86RamDac.h | 4 hw/xfree86/shadowfb/shadowfb.h | 2 hw/xfree86/utils/gtf/gtf.c | 26 hw/xfree86/vbe/vbe.c | 4 hw/xfree86/vbe/vbe.h | 4 hw/xfree86/vgahw/vgaHW.c | 8 hw/xfree86/vgahw/vgaHW.h | 2 hw/xfree86/x86emu/debug.c | 4 hw/xfree86/x86emu/ops.c | 22 hw/xfree86/x86emu/prim_ops.c | 70 hw/xfree86/x86emu/sys.c | 6 hw/xfree86/x86emu/x86emu/regs.h | 10 hw/xnest/Color.c | 2 hw/xnest/Xnest.h | 2 hw/xquartz/darwin.c | 8 hw/xquartz/darwinEvents.c | 4 hw/xwayland/xwayland-glamor.c | 3 hw/xwayland/xwayland.c | 1 hw/xwin/InitInput.c | 2 hw/xwin/InitOutput.c | 12 hw/xwin/XWin.rc | 1 hw/xwin/ddraw.h | 6 hw/xwin/man/XWin.man | 6 hw/xwin/win.h | 2 hw/xwin/winclipboard/internal.h | 14 hw/xwin/winclipboard/thread.c | 56 hw/xwin/winclipboard/winclipboard.h | 2 hw/xwin/winclipboard/wndproc.c | 227 hw/xwin/winclipboard/xevents.c | 175 hw/xwin/winclipboard/xwinclip.c | 7 hw/xwin/winclipboard/xwinclip.man | 3 hw/xwin/winclipboardwrappers.c | 6 hw/xwin/wincmap.c | 2 hw/xwin/winconfig.c | 10 hw/xwin/wincreatewnd.c | 4 hw/xwin/wincursor.c | 10 hw/xwin/windialogs.c | 8 hw/xwin/winlayouts.h | 2 hw/xwin/winmultiwindowwindow.c | 6 hw/xwin/winmultiwindowwm.c | 2 hw/xwin/winmultiwindowwndproc.c | 4 hw/xwin/winprocarg.c | 27 hw/xwin/winresource.h | 1 hw/xwin/winscrinit.c | 4 hw/xwin/winshaddd.c | 8 hw/xwin/winshadddnl.c | 6 hw/xwin/winshadgdi.c | 10 hw/xwin/wintrayicon.c | 19 hw/xwin/winwin32rootlesswndproc.c | 2 hw/xwin/winwindowswm.c | 2 hw/xwin/winwndproc.c | 12 include/closure.h | 8 include/colormap.h | 8 include/colormapst.h | 8 include/cursor.h | 8 include/cursorstr.h | 10 include/dbus-core.h | 2 include/dix.h | 15 include/extension.h | 8 include/extnsionst.h | 10 include/gc.h | 8 include/gcstruct.h | 8 include/input.h | 8 include/inputstr.h | 14 include/list.h | 2 include/misc.h | 18 include/miscstruct.h | 8 include/os.h | 8 include/pixmap.h | 8 include/pixmapstr.h | 10 include/property.h | 8 include/propertyst.h | 10 include/region.h | 8 include/regionstr.h | 12 include/resource.h | 10 include/rgb.h | 8 include/screenint.h | 8 include/scrnintstr.h | 8 include/selection.h | 10 include/servermd.h | 10 include/site.h | 14 include/window.h | 8 include/windowstr.h | 8 include/xkbfile.h | 18 include/xkbsrv.h | 16 include/xkbstr.h | 24 include/xsha1.h | 2 man/Xserver.man | 10 mi/mi.h | 8 mi/miarc.c | 39 mi/mibitblt.c | 30 mi/midash.c | 8 mi/midispcur.c | 4 mi/miexpose.c | 16 mi/mifillrct.c | 8 mi/mifpoly.h | 8 mi/miglblt.c | 8 mi/miinitext.c | 8 mi/mipointer.c | 5 mi/mipoly.c | 8 mi/mipoly.h | 2 mi/mipolypnt.c | 8 mi/mipolyrect.c | 8 mi/mipolyseg.c | 10 mi/mipolytext.c | 8 mi/mipushpxl.c | 8 mi/miscrinit.c | 2 mi/mistruct.h | 8 mi/mivaltree.c | 20 mi/miwindow.c | 8 mi/mizerclip.c | 8 mi/mizerline.c | 12 miext/damage/damage.c | 2 miext/rootless/rootless.h | 2 miext/rootless/rootlessGC.c | 2 miext/rootless/rootlessValTree.c | 32 miext/rootless/rootlessWindow.c | 6 miext/shadow/shrotate.c | 2 miext/sync/misyncfd.c | 4 os/WaitFor.c | 18 os/access.c | 48 os/busfault.c | 2 os/connection.c | 16 os/io.c | 17 os/log.c | 9 os/oscolor.c | 8 os/osdep.h | 8 os/osinit.c | 14 os/rpcauth.c | 4 os/xdmcp.c | 2 present/present.c | 17 present/present_request.c | 6 randr/randrstr.h | 20 randr/rrprovider.c | 2 randr/rrsdispatch.c | 4 randr/rrtransform.c | 2 randr/rrtransform.h | 2 randr/rrxinerama.c | 2 record/record.c | 20 render/animcur.c | 2 render/glyph.c | 2 render/glyphstr.h | 2 render/mipict.h | 2 render/picture.c | 47 render/picture.h | 8 render/render.c | 24 test/Makefile.am | 2 test/misc.c | 37 test/xi1/Makefile.am | 34 test/xi1/protocol-xchangedevicecontrol.c | 122 test/xi2/protocol-xigetclientpointer.c | 5 test/xi2/protocol-xipassivegrabdevice.c | 8 test/xi2/protocol-xiquerypointer.c | 4 test/xi2/protocol-xiwarppointer.c | 3 xfixes/cursor.c | 22 xfixes/select.c | 1 xkb/XKBAlloc.c | 16 xkb/XKBGAlloc.c | 16 xkb/XKBMAlloc.c | 18 xkb/XKBMisc.c | 16 xkb/ddxBeep.c | 16 xkb/ddxCtrls.c | 16 xkb/ddxKillSrv.c | 16 xkb/ddxLEDs.c | 16 xkb/ddxLoad.c | 16 xkb/ddxVT.c | 16 xkb/maprules.c | 18 xkb/xkb.c | 16 xkb/xkbAccessX.c | 18 xkb/xkbActions.c | 16 xkb/xkbEvents.c | 16 xkb/xkbInit.c | 22 xkb/xkbLEDs.c | 44 xkb/xkbPrKeyEv.c | 16 xkb/xkbSwap.c | 16 xkb/xkbUtils.c | 16 xkb/xkbfmisc.c | 18 xkb/xkbgeom.h | 16 xkb/xkbout.c | 18 xkb/xkbtext.c | 18 xkb/xkmread.c | 18 409 files changed, 11597 insertions(+), 2334 deletions(-)
New commits: commit 495f55531e5ef4bd93a46436b55a0845f11364b2 Author: Maarten Lankhorst <maarten.lankho...@ubuntu.com> Date: Thu Dec 11 16:17:27 2014 +0100 release to vivid diff --git a/debian/changelog b/debian/changelog index 1340401..5287cff 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,8 +1,8 @@ -xorg-server (2:1.16.2.901-1ubuntu1) UNRELEASED; urgency=medium +xorg-server (2:1.16.2.901-1ubuntu1) vivid; urgency=medium * Merge from released debian-unstable. - -- Maarten Lankhorst <maarten.lankho...@ubuntu.com> Thu, 11 Dec 2014 16:15:36 +0100 + -- Maarten Lankhorst <maarten.lankho...@ubuntu.com> Thu, 11 Dec 2014 16:17:07 +0100 xorg-server (2:1.16.2.901-1) unstable; urgency=medium commit 188080cb3e175e798afd9d70055e0f70cf29360f Author: Maarten Lankhorst <maarten.lankho...@ubuntu.com> Date: Thu Dec 11 16:17:05 2014 +0100 Merge from released debian-unstable. diff --git a/debian/changelog b/debian/changelog index d7e4d3b..1340401 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +xorg-server (2:1.16.2.901-1ubuntu1) UNRELEASED; urgency=medium + + * Merge from released debian-unstable. + + -- Maarten Lankhorst <maarten.lankho...@ubuntu.com> Thu, 11 Dec 2014 16:15:36 +0100 + xorg-server (2:1.16.2.901-1) unstable; urgency=medium * New upstream release commit 8a656bb010778ffdf1ee57a68db5a98da7df4879 Author: Maarten Lankhorst <maarten.lankho...@ubuntu.com> Date: Thu Dec 11 16:04:10 2014 +0100 More fixes to make the server build. diff --git a/debian/changelog b/debian/changelog index 63a9f99..34198a4 100644 --- a/debian/changelog +++ b/debian/changelog @@ -2,6 +2,11 @@ xorg-server (2:1.16.99.901-1) UNRELEASED; urgency=medium * New upstream release candidate 17~rc1. * Enable the modesetting driver from xorg-server. + * Drop upstreamed patches: + - 09_Xserver-man-iglx.diff + * Disable 08_xfree86_fix_ia64_inx_outx.diff, no longer applies. + - Is this patch still needed because it seems to be handled now? + * Bump video abi to 19. -- Maarten Lankhorst <maarten.lankho...@ubuntu.com> Thu, 11 Dec 2014 15:49:13 +0100 diff --git a/debian/control b/debian/control index 7aa502b..5ec4a5c 100644 --- a/debian/control +++ b/debian/control @@ -35,7 +35,7 @@ Build-Depends: x11proto-xf86vidmode-dev (>= 2.2.99.1), x11proto-present-dev, x11proto-dri3-dev, - xtrans-dev (>= 1.3.3), + xtrans-dev (>= 1.3.5), libxau-dev (>= 1:1.0.5-2), x11proto-input-dev (>= 2.3), x11proto-dri2-dev (>= 2.8), @@ -84,6 +84,7 @@ Build-Depends: libxcb-keysyms1-dev, libxcb-xv0-dev, libxcb-glx0-dev, + libxcb-render-util0-dev, libxcb-xf86dri0-dev (>= 1.6), # unit tests xkb-data, @@ -137,6 +138,9 @@ Breaks: xserver-xorg-video-vga (<= 1:4.1.0-8), libgl1-mesa-dri (<< 7.10.2-4), libgl1-mesa-dri-experimental (<< 7.10.2-4), + xserver-xorg-video-modesetting, +Replaces: + xserver-xorg-video-modesetting, Conflicts: xserver-xorg-input-evtouch, Provides: diff --git a/debian/patches/09_Xserver-man-iglx.diff b/debian/patches/09_Xserver-man-iglx.diff deleted file mode 100644 index 95d38a5..0000000 --- a/debian/patches/09_Xserver-man-iglx.diff +++ /dev/null @@ -1,16 +0,0 @@ -Index: xorg-server/man/Xserver.man -=================================================================== ---- xorg-server.orig/man/Xserver.man -+++ xorg-server/man/Xserver.man -@@ -186,10 +186,10 @@ Prohibit creating indirect GLX contexts. - since it lacks support for many modern OpenGL features and extensions; - it's slower than direct contexts; and it opens a large attack surface for - protocol parsing errors. -+This is the default unless +iglx is specified. - .TP 8 - .B +iglx - Allow creating indirect GLX contexts. --This is the default unless \-iglx is specified. - .TP 8 - .B \-maxbigreqsize \fIsize\fP - sets the maximum big request to diff --git a/debian/patches/series b/debian/patches/series index 54342e9..2c8af94 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -4,5 +4,4 @@ 02_kbsd-input-devd.diff 03_static-nettle.diff 05_Revert-Unload-submodules.diff -08_xfree86_fix_ia64_inx_outx.diff -09_Xserver-man-iglx.diff +#08_xfree86_fix_ia64_inx_outx.diff diff --git a/debian/serverminver b/debian/serverminver index 13cf097..f8cfe44 100644 --- a/debian/serverminver +++ b/debian/serverminver @@ -1,3 +1,3 @@ -2:1.15.99.903 -ABI_VIDEODRV_VERSION:18.0 +2:1.16.99.901 +ABI_VIDEODRV_VERSION:19.0 ABI_XINPUT_VERSION:21.0 commit 05c5b69d88c262e29575aec6018c5a094f64dc9d Author: Maarten Lankhorst <maarten.lankho...@ubuntu.com> Date: Thu Dec 11 15:52:08 2014 +0100 bump changelogs diff --git a/ChangeLog b/ChangeLog index 04c9c9c..e613918 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,41 @@ +commit 27017380f96d7cec79ce8d618ea0ec389fa716a9 +Merge: 91651e7 9b037af +Author: Maarten Lankhorst <maarten.lankho...@ubuntu.com> +Date: Thu Dec 11 15:47:29 2014 +0100 + + Merge branch 'upstream-unstable' into upstream-experimental + +commit 91651e7c15892aa846fc406fbb13b37f094dd3f0 +Author: Michel Dänzer <michel.daen...@amd.com> +Date: Wed Dec 10 16:21:44 2014 +0900 + + glamor: Reinstate glamor_(egl_)destroy_textured_pixmap + + They are part of the ABI. + + Signed-off-by: Michel Dänzer <michel.daen...@amd.com> + Reviewed-by: Keith Packard <kei...@keithp.com> + Signed-off-by: Keith Packard <kei...@keithp.com> + +commit c1455f76c6b1aa4ecaacb2221a687244285aa44b +Author: Neil Roberts <n...@linux.intel.com> +Date: Mon Dec 1 16:06:17 2014 -0500 + + glx: Add implementation of __GLXContext->loseCurrent for direct ctxts + + This adds a dummy implementation for the loseCurrent function in + __GLXContext for direct contexts which just returns GL_TRUE. Without + this then the X server can crash if receives a MakeCurrent message for + a direct context because it will attempt to call loseCurrent when + cleaning up the client in the callback for ClientStateGone. + + [ajax: added assumed s-o-b line] + + Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=86531 + Reviewed-by: Adam Jackson <a...@redhat.com> + Signed-off-by: Neil Roberts <n...@linux.intel.com> + Signed-off-by: Keith Packard <kei...@keithp.com> + commit 9b037af0410bb1f63d370d8b8be06135de7af600 Author: Julien Cristau <jcris...@debian.org> Date: Tue Dec 9 20:55:02 2014 +0100 @@ -75,6 +113,74 @@ Date: Tue Dec 9 09:30:57 2014 -0800 (cherry picked from commit b20912c3d45cbbde3c443e6c3d9e189092fe65e1) Signed-off-by: Julien Cristau <jcris...@debian.org> +commit 6704bb0ed7a10dabe8ef3bb3adf8b8a7f29a78f0 +Merge: 8aa23f2 1559a94 +Author: Keith Packard <kei...@keithp.com> +Date: Tue Dec 9 11:47:11 2014 -0800 + + Merge remote-tracking branch 'alanc/master' + +commit 1559a94395258fd73e369f1a2c98a44bfe21a486 +Author: Keith Packard <kei...@keithp.com> +Date: Tue Dec 9 09:31:00 2014 -0800 + + dix: GetHosts bounds check using wrong pointer value [CVE-2014-8092 pt. 6] + + GetHosts saves the pointer to allocated memory in *data, and then + wants to bounds-check writes to that region, but was mistakenly using + a bare 'data' instead of '*data'. Also, data is declared as void **, + so we need a cast to turn it into a byte pointer so we can actually do + pointer comparisons. + + Signed-off-by: Keith Packard <kei...@keithp.com> + Reviewed-by: Alan Coopersmith <alan.coopersm...@oracle.com> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> + +commit 9802a0162f738de03585ca3f3b8a8266494f7d45 +Author: Keith Packard <kei...@keithp.com> +Date: Tue Dec 9 09:30:59 2014 -0800 + + Missing parens in REQUEST_FIXED_SIZE macro [CVE-2014-8092 pt. 5] + + The 'n' parameter must be surrounded by parens in both places to + prevent precedence from mis-computing things. + + Signed-off-by: Keith Packard <kei...@keithp.com> + Reviewed-by: Alan Coopersmith <alan.coopersm...@oracle.com> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> + +commit 61b17c0f10307e25e51e30e6fb1d3e3127f82d86 +Author: Keith Packard <kei...@keithp.com> +Date: Tue Dec 9 09:30:58 2014 -0800 + + glx: Can't mix declarations and code in X.org sources [CVE-2014-8098 pt. 9] + + We're using compiler compatibility settings which generate warnings + when a variable is declared after the first statement. + + Signed-off-by: Keith Packard <kei...@keithp.com> + Reviewed-by: Alan Coopersmith <alan.coopersm...@oracle.com> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> + +commit b20912c3d45cbbde3c443e6c3d9e189092fe65e1 +Author: Keith Packard <kei...@keithp.com> +Date: Tue Dec 9 09:30:57 2014 -0800 + + dbe: Call to DDX SwapBuffers requires address of int, not unsigned int [CVE-2014-8097 pt. 2] + + When the local types used to walk the DBE request were changed, this + changed the type of the parameter passed to the DDX SwapBuffers API, + but there wasn't a matching change in the API definition. + + At this point, with the API frozen, I just stuck a new variable in + with the correct type. Because we've already bounds-checked nStuff to + be smaller than UINT32_MAX / sizeof(DbeSwapInfoRec), we know it will + fit in a signed int without overflow. + + Signed-off-by: Keith Packard <kei...@keithp.com + Reviewed-by: Alan Coopersmith <alan.coopersm...@oracle.com> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> + commit 73b1880eb37bd8ffbc3e36739e94f9b56b8323b9 Author: Robert Morell <rmor...@nvidia.com> Date: Wed Nov 12 18:51:43 2014 -0800 @@ -629,6 +735,31 @@ Date: Fri Jan 17 18:54:03 2014 -0800 (cherry picked from commit 90cc925c5991fcb203f72d00b04419cd754a9b2c) Signed-off-by: Julien Cristau <jcris...@debian.org> +commit 8aa23f27c7e29c62d23867440b0bb00fc288b5ba +Author: Keith Packard <kei...@keithp.com> +Date: Mon Dec 8 12:59:31 2014 -0800 + + glamor: Free existing EGL image when assigning new one + + When reallocating the framebuffer on screen resize, the old EGL image + was getting leaked. Check for an existing EGL image and free it in + this case. + + Signed-off-by: Keith Packard <kei...@keithp.com> + Revewied-by: Zhigang Gong <zhigang.g...@linux.intel.com> + +commit c22433d55ea16e4879b092ee28d284fc895c9956 +Author: Keith Packard <kei...@keithp.com> +Date: Fri Dec 5 11:02:11 2014 -0800 + + glamor: Remove redundant reference to screen pixmap EGL image + + There's no reason to store this in the egl screen private as the + screen pixmap will always hold a reference to it anyways. + + Signed-off-by: Keith Packard <kei...@keithp.com> + Revewied-by: Zhigang Gong <zhigang.g...@linux.intel.com> + commit 07b01bb5bd3587cd14d9dd2c8f4b145cf1757fe5 Author: Keith Packard <kei...@keithp.com> Date: Thu Oct 9 15:17:17 2014 +0200 @@ -642,6 +773,29 @@ Date: Thu Oct 9 15:17:17 2014 +0200 (cherry picked from commit 61a292adf45405641de1c522a04c148e0a152acd) Signed-off-by: Julien Cristau <jcris...@debian.org> +commit 5064ffab631dcbc4265079fb32a02d3e2f1c4cd8 +Author: Keith Packard <kei...@keithp.com> +Date: Fri Dec 5 10:58:28 2014 -0800 + + glamor: Always destroy EGL image associated with destroyed pixmap + + There were three paths that called eglDestroyImageKHR: + + * The front buffer + * The intel driver's flip buffer + * pixmaps under DRI3 + + This patch unifies the second two by having glamor_destroy_pixmap + always destroy any associaged EGL image. This allows us to stop + storing the back_pixmap pointer in glamor as that was only used to + make sure that buffer was freed at server reset time. + + v2: check for valid pixmap_priv before using it in + glamor_egl_destroy_pixmap_image + + Signed-off-by: Keith Packard <kei...@keithp.com> + Reviewed-by: Zhigang Gong <zhigang.g...@linux.intel.com> + commit d1bd02fb6746a4393e2538bf605b610e1764a413 Author: Mario Kleiner <mario.kleiner...@gmail.com> Date: Sat Dec 6 05:40:08 2014 +0100 @@ -731,301 +885,5741 @@ Date: Wed Sep 10 14:02:13 2014 -0700 (cherry picked from commit 2051514652481a83bd7cf22e57cb0fcd40333f33) Signed-off-by: Julien Cristau <jcris...@debian.org> -commit 386329ec7238edfd1b680c4a7acd39947a161ab5 -Author: Alan Coopersmith <alan.coopersm...@oracle.com> -Date: Mon Dec 1 14:26:11 2014 -0800 +commit 7e7630bbb775573eea2a2335adb9d190c3e1e971 +Author: Robert Morell <rmor...@nvidia.com> +Date: Wed Nov 12 18:51:43 2014 -0800 - Add -iglx & +iglx to Xserver.man + glx: Fix mask truncation in __glXGetAnswerBuffer [CVE-2014-8093 6/6] - Covers the current state after commits 99f0365b1fbdfd9238b9f, - d0da0e9c3bb8fe0cd4879, & e3aa13b8d63ea2fba6eb4 were all applied. + On a system where sizeof(unsigned) != sizeof(intptr_t), the unary + bitwise not operation will result in a mask that clears all high bits + from temp_buf in the expression: + temp_buf = (temp_buf + mask) & ~mask; + Signed-off-by: Robert Morell <rmor...@nvidia.com> + Reviewed-by: Alan Coopersmith <alan.coopersm...@oracle.com> Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> - Reviewed-by: James Jones <jajo...@nvidia.com> - Reviewed-by: Robert Morell <rmor...@nvidia.com> - Signed-off-by: Keith Packard <kei...@keithp.com> - (cherry picked from commit b09d59342804db7dbb8056dca43dd39f54e290aa) - - [alanc: Modified for server-1.16-branch to show +iglx as default instead of - -iglx, to match code in os/utils.c in server-1.16-branch.] - Signed-off-by: Julien Cristau <jcris...@debian.org> -commit a471a15c779377073fd5d6bb8cff40dff917eca9 -Author: Alex Orange <crazyca...@gmail.com> -Date: Fri Oct 3 15:41:38 2014 -0600 +commit e883c170c15493ab3637c0a01890f5a7ca4e16a5 +Author: Adam Jackson <a...@redhat.com> +Date: Mon Nov 10 12:13:48 2014 -0500 - fb: Fix Bresenham algorithms for commonly used small segments. - - Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=54168 + glx: Pass remaining request length into ->varsize (v2) [CVE-2014-8098 8/8] - Fix errors introducted in 863d528a9f76d0e8f122aebf19f8564a4c67a938. Said - patch does indeed remove the problematic writes to bad memory, however - it also introduces errors in the algoritm. This patch has the effect of - reverting said patch and adding an if in the proper location to catch - the out of bounds memory write without causing problems to the overall - algorithm. + v2: Handle more multiplies in indirect_reqsize.c (Julien Cristau) - Signed-off-by: Alex Orange <crazyca...@gmail.com> - Reviewed-by: Peter Harris <phar...@opentext.com> - Tested-by: Peter Harris <phar...@opentext.com> - Signed-off-by: Keith Packard <kei...@keithp.com> - (cherry picked from commit 1b94fd77792310c80b0a2bcf4bf6d4e4c4c23bca) + Reviewed-by: Julien Cristau <jcris...@debian.org> + Reviewed-by: Michal Srb <m...@suse.com> + Reviewed-by: Andy Ritger <arit...@nvidia.com> + Signed-off-by: Adam Jackson <a...@redhat.com> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> -commit 4393c7f1ba6140a02232f04fbb434a80d663a99d -Author: Julien Cristau <jcris...@debian.org> -Date: Mon Nov 10 16:38:52 2014 +0100 +commit 984583a497c813df5827ae22483133e704fee79c +Author: Adam Jackson <a...@redhat.com> +Date: Mon Nov 10 12:13:47 2014 -0500 - Bump to 1.16.2 + glx: Length checking for non-generated single requests (v2) [CVE-2014-8098 7/8] - Signed-off-by: Julien Cristau <jcris...@debian.org> - -commit 151ec89574c0d1b4566137d0f2d965ef48f04ec5 -Author: Julien Cristau <jcris...@debian.org> -Date: Sun Nov 2 11:21:33 2014 +0100 - - Bump to 1.16.1.901 - -commit a4d9637504ea4c97ca22d86c9f2e275f5253470d -Author: Chris Wilson <ch...@chris-wilson.co.uk> -Date: Thu Oct 16 14:09:08 2014 +0100 - - Xext/shm: Detach SHM segment after Pixmap is released + v2: + Fix single versus vendor-private length checking for ARB_imaging subset + extensions. (Julien Cristau) - The GPU may still have a reference to the SHM segment which would only - be finally released when the Pixmap is destroy. So we can only detach - the SHM segment (and thereby making the memory unaccessible) after the - backend has had a chance to flush any remaining references. + v3: + Fix single versus vendor-private length checking for ARB_imaging subset + extensions. (Julien Cristau) - Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=85058 - Signed-off-by: Chris Wilson <ch...@chris-wilson.co.uk> - Reported-and-tested-by: ged...@gmail.com - Reviewed-by: Adam Jackson <a...@redhat.com> - Signed-off-by: Keith Packard <kei...@keithp.com> - (cherry picked from commit 9b29fa957a397664463c7c78fbcc2f34d1993271) + Reviewed-by: Michal Srb <m...@suse.com> + Reviewed-by: Andy Ritger <arit...@nvidia.com> + Signed-off-by: Adam Jackson <a...@redhat.com> Signed-off-by: Julien Cristau <jcris...@debian.org> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> -commit a7c207cc8e713092c51401baddbb3a30de398a34 -Author: Axel Davy <axel.d...@ens.fr> -Date: Wed Oct 29 13:31:42 2014 +0100 +commit 44ba149f28ece93c2fbfc9cc980588de5322dd4b +Author: Adam Jackson <a...@redhat.com> +Date: Mon Nov 10 12:13:46 2014 -0500 - Fix present_notify to return right away when querying current or past msc. - - When the target msc is past or is the current one, we want to get immediate - feedback. This patch fixes this behaviour. + glx: Length-checking for non-generated vendor private requests [CVE-2014-8098 6/8] - Signed-off-by: Axel Davy <axel.d...@ens.fr> Reviewed-by: Keith Packard <kei...@keithp.com> - Signed-off-by: Keith Packard <kei...@keithp.com> - (cherry picked from commit 882f2d10d99a04a96afc0ce0c8937e16bec3afb5) - Signed-off-by: Julien Cristau <jcris...@debian.org> + Reviewed-by: Michal Srb <m...@suse.com> + Reviewed-by: Andy Ritger <arit...@nvidia.com> + Signed-off-by: Adam Jackson <a...@redhat.com> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> -commit 27600a6b2056b8cf6af8b6b0f078164ef36c0767 -Author: Axel Davy <axel.d...@ens.fr> -Date: Sat Sep 27 23:17:13 2014 +0200 +commit afe177020d1fb776c6163f21eddc82cb185b95ca +Author: Adam Jackson <a...@redhat.com> +Date: Mon Nov 10 12:13:45 2014 -0500 - Fix present_pixmap when using present_notify_msc + glx: Request length checks for SetClientInfoARB [CVE-2014-8098 5/8] - Calling present_notify_msc could cancel a pending pixmap presentation. + Reviewed-by: Keith Packard <kei...@keithp.com> + Reviewed-by: Julien Cristau <jcris...@debian.org> + Reviewed-by: Michal Srb <m...@suse.com> + Reviewed-by: Andy Ritger <arit...@nvidia.com> + Signed-off-by: Adam Jackson <a...@redhat.com> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> + +commit c91e4abc3b892f42802efa20fef7ada442c2d3f5 +Author: Adam Jackson <a...@redhat.com> +Date: Mon Nov 10 12:13:44 2014 -0500 + + glx: Top-level length checking for swapped VendorPrivate requests [CVE-2014-8098 4/8] - Signed-off-by: Axel Davy <axel.d...@ens.fr> Reviewed-by: Keith Packard <kei...@keithp.com> - Signed-off-by: Keith Packard <kei...@keithp.com> - (cherry picked from commit 9bc01dfc7070a40f5948588895b3a11dd1636d0e) - Signed-off-by: Julien Cristau <jcris...@debian.org> + Reviewed-by: Julien Cristau <jcris...@debian.org> + Reviewed-by: Michal Srb <m...@suse.com> + Reviewed-by: Andy Ritger <arit...@nvidia.com> + Signed-off-by: Adam Jackson <a...@redhat.com> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> -commit 0e62f275aa02c5694fd714f3bbd5271836142755 -Author: Peter Hutterer <peter.hutte...@who-t.net> -Date: Mon Aug 4 10:47:03 2014 +1000 +commit a33a939e6abb255b14d8dbc85fcbd2c55b958bae +Author: Adam Jackson <a...@redhat.com> +Date: Mon Nov 10 12:13:43 2014 -0500 - xkb: ignore floating slave devices when updating from master (#81885) + glx: Length checking for RenderLarge requests (v2) [CVE-2014-8098 3/8] - Introduced in 45fb3a934dc0db51584aba37c2f9d73deff9191d. When a device is - enabled, the master's locked state is pushed to the slave. If the device is - floating, no master exists and we triggered a NULL-pointer dereference - in XkbPushLockedStateToSlaves. + This is a half-measure until we start passing request length into the + varsize function, but it's better than the nothing we had before. - X.Org Bug 81885 <http://bugs.freedesktop.org/show_bug.cgi?id=81885> + v2: Verify that there's at least a large render header's worth of + dataBytes (Julien Cristau) - Signed-off-by: Peter Hutterer <peter.hutte...@who-t.net> - Reviewed-by: Daniel Stone <dan...@fooishbar.org> - Signed-off-by: Keith Packard <kei...@keithp.com> - (cherry picked from commit 1e30fc1b99bda040038e4fd56d1b27c686b44c75) - Signed-off-by: Julien Cristau <jcris...@debian.org> + Reviewed-by: Michal Srb <m...@suse.com> + Reviewed-by: Andy Ritger <arit...@nvidia.com> + Signed-off-by: Adam Jackson <a...@redhat.com> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> -commit f7ca20cacfd4e0304d01f29491ae8363fd482279 -Author: Takashi Iwai <ti...@suse.de> -Date: Tue Aug 19 15:57:22 2014 -0500 +commit 698888e6671d54c7ae41e9d456f7f5483a3459d2 +Author: Adam Jackson <a...@redhat.com> +Date: Mon Nov 10 12:13:42 2014 -0500 - fb: Fix invalid bpp for 24bit depth window - - We have a hack in fb layer for a 24bpp screen to use 32bpp images, and - fbCreateWindow() replaces its drawable.bitsPerPixel field - appropriately. But, the problem is that it always replaces when 32bpp - is passed. If the depth is 32, this results in bpp < depth, which is - actually invalid. + glx: Integer overflow protection for non-generated render requests (v3) [CVE-2014-8093 5/6] - Meanwhile, fbCreatePixmap() has a more check and it creates with 24bpp - only when the passed depth <= 24 for avoiding such a problem. + v2: + Fix constants in __glXMap2fReqSize (Michal Srb) + Validate w/h/d for proxy targets too (Keith Packard) - This oneliner patch just adds the similar check in fbCreateWindow(). - This (hopefully) fixes the long-standing broken graphics mess of - cirrus KMS with 24bpp. + v3: + Fix Map[12]Size to correctly reject order == 0 (Julien Cristau) - Signed-off-by: Takashi Iwai <ti...@suse.de> Reviewed-by: Keith Packard <kei...@keithp.com> - (cherry picked from commit fe5018e0564118a7a8198fa286186fdb9ed818c7) - Signed-off-by: Julien Cristau <jcris...@debian.org> + Reviewed-by: Michal Srb <m...@suse.com> + Reviewed-by: Andy Ritger <arit...@nvidia.com> + Signed-off-by: Adam Jackson <a...@redhat.com> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> -commit 0e0951ce3eb33242934df9b683f8f5ca4fd501af +commit be09e0c988ffdb0371293af49fb4ea8f49ed324a Author: Julien Cristau <jcris...@debian.org> -Date: Sun Sep 21 10:56:53 2014 +0200 +Date: Mon Nov 10 12:13:41 2014 -0500 - Bump to 1.16.1 + glx: Length checking for GLXRender requests (v2) [CVE-2014-8098 2/8] + + v2: + Remove can't-happen comparison for cmdlen < 0 (Michal Srb) + Reviewed-by: Adam Jackson <a...@redhat.com> + Reviewed-by: Michal Srb <m...@suse.com> + Reviewed-by: Andy Ritger <arit...@nvidia.com> Signed-off-by: Julien Cristau <jcris...@debian.org> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> -commit b501462e5da776e28a8e16d8573a6d17d7ebe15e -Author: Julien Cristau <jcris...@debian.org> -Date: Wed Sep 17 07:41:27 2014 +0200 +commit 2a5cbc17fc72185bf0fa06fef26d1f782de72595 -- To UNSUBSCRIBE, email to debian-x-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: https://lists.debian.org/e1y0sgb-00040b...@moszumanska.debian.org