import CS xorg-x11-server-1.20.11-17.el8

SOURCES/0001-composite-Fix-use-after-free-of-the-COW.patch

@@ -0,0 +1,42 @@
+From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 13 Mar 2023 11:08:47 +0100
+Subject: [PATCH xserver] composite: Fix use-after-free of the COW
+
+ZDI-CAN-19866/CVE-2023-1393
+
+If a client explicitly destroys the compositor overlay window (aka COW),
+we would leave a dangling pointer to that window in the CompScreen
+structure, which will trigger a use-after-free later.
+
+Make sure to clear the CompScreen pointer to the COW when the latter gets
+destroyed explicitly by the client.
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+---
+ composite/compwindow.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/composite/compwindow.c b/composite/compwindow.c
+index 4e2494b86..b30da589e 100644
+--- a/composite/compwindow.c
++++ b/composite/compwindow.c
+@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
+     ret = (*pScreen->DestroyWindow) (pWin);
+     cs->DestroyWindow = pScreen->DestroyWindow;
+     pScreen->DestroyWindow = compDestroyWindow;
++
++    /* Did we just destroy the overlay window? */
++    if (pWin == cs->pOverlayWin)
++        cs->pOverlayWin = NULL;
++
+ /*    compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
+     return ret;
+ }
+-- 
+2.40.0
+

SOURCES/0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch

@@ -0,0 +1,105 @@
+From b98fc07d3442a289c6bef82df50dd0a2d01de71a Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Thu, 2 Feb 2023 12:26:27 -0500
+Subject: [PATCH xserver] present: Send a PresentConfigureNotify event for
+ destroyed windows
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This enables fixing a deadlock case on the client side, where the client
+ends up blocked waiting for a Present event that will never come because
+the window was destroyed. The new PresentWindowDestroyed flag allows the
+client to avoid blocking indefinitely.
+
+Signed-off-by: Adam Jackson <ajax@redhat.com>
+See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/116
+See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6685
+Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
+(cherry picked from commit 462b06033e66a32308d940eb5fc47f5e4c914dc0)
+---
+ present/present_event.c  |  5 +++--
+ present/present_priv.h   |  7 ++++++-
+ present/present_screen.c | 11 ++++++++++-
+ 3 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/present/present_event.c b/present/present_event.c
+index 435b26b70..849732dc8 100644
+--- a/present/present_event.c
++++ b/present/present_event.c
+@@ -102,7 +102,8 @@ present_event_swap(xGenericEvent *from, xGenericEvent *to)
+ }
+ 
+ void
+-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling)
++present_send_config_notify(WindowPtr window, int x, int y, int w, int h,
++                           int bw, WindowPtr sibling, CARD32 flags)
+ {
+     present_window_priv_ptr window_priv = present_window_priv(window);
+ 
+@@ -122,7 +123,7 @@ present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw,
+             .off_y = 0,
+             .pixmap_width = w,
+             .pixmap_height = h,
+-            .pixmap_flags = 0
++            .pixmap_flags = flags
+         };
+         present_event_ptr event;
+ 
+diff --git a/present/present_priv.h b/present/present_priv.h
+index 6ebd009a2..4ad729864 100644
+--- a/present/present_priv.h
++++ b/present/present_priv.h
+@@ -43,6 +43,11 @@
+ #define DebugPresent(x)
+ #endif
+ 
++/* XXX this belongs in presentproto */
++#ifndef PresentWindowDestroyed
++#define PresentWindowDestroyed (1 << 0)
++#endif
++
+ extern int present_request;
+ 
+ extern DevPrivateKeyRec present_screen_private_key;
+@@ -307,7 +312,7 @@ void
+ present_free_events(WindowPtr window);
+ 
+ void
+-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling);
++present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling, CARD32 flags);
+ 
+ void
+ present_send_complete_notify(WindowPtr window, CARD8 kind, CARD8 mode, CARD32 serial, uint64_t ust, uint64_t msc);
+diff --git a/present/present_screen.c b/present/present_screen.c
+index 15684eda4..2c29aafd2 100644
+--- a/present/present_screen.c
++++ b/present/present_screen.c
+@@ -93,6 +93,15 @@ present_destroy_window(WindowPtr window)
+     present_screen_priv_ptr screen_priv = present_screen_priv(screen);
+     present_window_priv_ptr window_priv = present_window_priv(window);
+ 
++    present_send_config_notify(window,
++                               window->drawable.x,
++                               window->drawable.y,
++                               window->drawable.width,
++                               window->drawable.height,
++                               window->borderWidth,
++                               window->nextSib,
++                               PresentWindowDestroyed);
++
+     if (window_priv) {
+         present_clear_window_notifies(window);
+         present_free_events(window);
+@@ -123,7 +132,7 @@ present_config_notify(WindowPtr window,
+     ScreenPtr screen = window->drawable.pScreen;
+     present_screen_priv_ptr screen_priv = present_screen_priv(screen);
+ 
+-    present_send_config_notify(window, x, y, w, h, bw, sibling);
++    present_send_config_notify(window, x, y, w, h, bw, sibling, 0);
+ 
+     unwrap(screen_priv, screen, ConfigNotify);
+     if (screen->ConfigNotify)
+-- 
+2.40.0
+

SPECS/xorg-x11-server.spec

@@ -46,7 +46,7 @@
 Summary:   X.Org X11 X server
 Name:      xorg-x11-server
 Version:   1.20.11
-Release:   15%{?gitdate:.%{gitdate}}%{?dist}
+Release:   17%{?gitdate:.%{gitdate}}%{?dist}
 URL:       http://www.x.org
 License:   MIT
 Group:     User Interface/X
@@ -110,6 +110,7 @@ Patch202: 0001-modesetting-Reduce-glamor-initialization-failed-mess.patch
 Patch203: 0001-xfree86-Only-switch-to-original-VT-if-it-is-active.patch
 Patch204: 0001-xf86-logind-Fix-drm_drop_master-before-vt_reldisp.patch
 Patch205: 0001-present-Check-for-NULL-to-prevent-crash.patch
+Patch206: 0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch
 
 # CVE-2021-4011
 Patch10009: 0001-record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch
@@ -145,6 +146,8 @@ Patch10024: 0007-xkb-reset-the-radio_groups-pointer-to-NULL-after-fre.patch
 Patch10025: 0008-Xext-fix-invalid-event-type-mask-in-XTestSwapFakeInp.patch
 # CVE-2023-0494
 Patch10026: 0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
+# CVE-2023-1393
+Patch10027: 0001-composite-Fix-use-after-free-of-the-COW.patch
 
 BuildRequires: make
 BuildRequires: systemtap-sdt-devel
@@ -572,6 +575,14 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete
 
 
 %changelog
+* Tue Jun  6 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-17
+- Backport fix for a deadlock with DRI3
+  Resolves: rhbz#2192556
+
+* Fri Mar 31 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-16
+- CVE fix for: CVE-2023-1393
+  Resolves: rhbz#2180296
+
 * Wed Feb 22 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-15
 - Rebuild for the missing debuginfo
   Related: rhbz#2169522