.gitignore

@@ -1 +0,0 @@
-SOURCES/xorg-server-1.20.11.tar.bz2

.xorg-x11-server.metadata

@@ -1 +0,0 @@
-86ae4add5719e6026a569f5559d51e8707171d5d SOURCES/xorg-server-1.20.11.tar.bz2

0001-render-Fix-build-with-gcc-12.patch

@@ -0,0 +1,90 @@
+From 53173fdab492f0f638f6616fcf01af0b9ea6338d Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Thu, 20 Jan 2022 10:20:38 +0100
+Subject: [PATCH xserver] render: Fix build with gcc 12
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The xserver fails to compile with the latest gcc 12:
+
+ render/picture.c: In function ‘CreateSolidPicture’:
+ render/picture.c:874:26: error: array subscript ‘union _SourcePict[0]’ is partly outside array bounds of ‘unsigned char[16]’ [-Werror=array-bounds]
+  874 |     pPicture->pSourcePict->type = SourcePictTypeSolidFill;
+      |                          ^~
+ render/picture.c:868:45: note: object of size 16 allocated by ‘malloc’
+  868 |     pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictSolidFill));
+      |                                             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ render/picture.c: In function ‘CreateLinearGradientPicture’:
+ render/picture.c:906:26: error: array subscript ‘union _SourcePict[0]’ is partly outside array bounds of ‘unsigned char[32]’ [-Werror=array-bounds]
+  906 |     pPicture->pSourcePict->linear.type = SourcePictTypeLinear;
+      |                          ^~
+ render/picture.c:899:45: note: object of size 32 allocated by ‘malloc’
+  899 |     pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictLinearGradient));
+      |                                             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ render/picture.c: In function ‘CreateConicalGradientPicture’:
+ render/picture.c:989:26: error: array subscript ‘union _SourcePict[0]’ is partly outside array bounds of ‘unsigned char[32]’ [-Werror=array-bounds]
+  989 |     pPicture->pSourcePict->conical.type = SourcePictTypeConical;
+      |                          ^~
+ render/picture.c:982:45: note: object of size 32 allocated by ‘malloc’
+  982 |     pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictConicalGradient));
+      |                                             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ cc1: some warnings being treated as errors
+ ninja: build stopped: subcommand failed.
+
+This is because gcc 12 has become stricter and raises a warning now.
+
+Fix the warning/error by allocating enough memory to store the union
+struct.
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Acked-by: Michel Dänzer <mdaenzer@redhat.com>
+Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1256
+(cherry picked from commit c6b0dcb82d4db07a2f32c09a8c09c85a5f57248e)
+---
+ render/picture.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/render/picture.c b/render/picture.c
+index afa0d258f..2be4b1954 100644
+--- a/render/picture.c
++++ b/render/picture.c
+@@ -865,7 +865,7 @@ CreateSolidPicture(Picture pid, xRenderColor * color, int *error)
+     }
+ 
+     pPicture->id = pid;
+-    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictSolidFill));
++    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict));
+     if (!pPicture->pSourcePict) {
+         *error = BadAlloc;
+         free(pPicture);
+@@ -896,7 +896,7 @@ CreateLinearGradientPicture(Picture pid, xPointFixed * p1, xPointFixed * p2,
+     }
+ 
+     pPicture->id = pid;
+-    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictLinearGradient));
++    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict));
+     if (!pPicture->pSourcePict) {
+         *error = BadAlloc;
+         free(pPicture);
+@@ -936,7 +936,7 @@ CreateRadialGradientPicture(Picture pid, xPointFixed * inner,
+     }
+ 
+     pPicture->id = pid;
+-    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictRadialGradient));
++    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict));
+     if (!pPicture->pSourcePict) {
+         *error = BadAlloc;
+         free(pPicture);
+@@ -979,7 +979,7 @@ CreateConicalGradientPicture(Picture pid, xPointFixed * center, xFixed angle,
+     }
+ 
+     pPicture->id = pid;
+-    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(PictConicalGradient));
++    pPicture->pSourcePict = (SourcePictPtr) malloc(sizeof(SourcePict));
+     if (!pPicture->pSourcePict) {
+         *error = BadAlloc;
+         free(pPicture);
+-- 
+2.34.1
+

0001-xf86-Accept-devices-with-the-simpledrm-driver.patch

@@ -0,0 +1,34 @@
+From b9218fadf3c09d83566549279d68886d8258f79c Mon Sep 17 00:00:00 2001
+From: nerdopolis <rbos@rbos>
+Date: Thu, 30 Sep 2021 08:51:18 -0400
+Subject: [PATCH] xf86: Accept devices with the 'simpledrm' driver.
+
+SimpleDRM 'devices' are a fallback device, and do not have a busid
+so they are getting skipped. This will allow simpledrm to work
+with the modesetting driver
+---
+ hw/xfree86/common/xf86platformBus.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/hw/xfree86/common/xf86platformBus.c b/hw/xfree86/common/xf86platformBus.c
+index 0e0a995ac..45028f7a6 100644
+--- a/hw/xfree86/common/xf86platformBus.c
++++ b/hw/xfree86/common/xf86platformBus.c
+@@ -557,8 +557,13 @@ xf86platformProbeDev(DriverPtr drvp)
+             }
+             else {
+                 /* for non-seat0 servers assume first device is the master */
+-                if (ServerIsNotSeat0())
++                if (ServerIsNotSeat0()) {
+                     break;
++                } else {
++                    /* Accept the device if the driver is simpledrm */
++                    if (strcmp(xf86_platform_devices[j].attribs->driver, "simpledrm") == 0)
++                        break;
++                }
+ 
+                 if (xf86IsPrimaryPlatform(&xf86_platform_devices[j]))
+                     break;
+-- 
+2.35.1
+

0001-xkb-switch-to-array-index-loops-to-moving-pointers.patch

@@ -1,4 +1,4 @@
-From c9b379ec5a1a34692af06056925bd0fc5f809713 Mon Sep 17 00:00:00 2001
+From f1070c01d616c5f21f939d5ebc533738779451ac Mon Sep 17 00:00:00 2001
 From: Peter Hutterer <peter.hutterer@who-t.net>
 Date: Tue, 5 Jul 2022 12:40:47 +1000
 Subject: [PATCH xserver 1/3] xkb: switch to array index loops to moving
@@ -11,16 +11,15 @@ No functional changes.
 
 Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
 Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
-(cherry picked from commit f1070c01d616c5f21f939d5ebc533738779451ac)
 ---
  xkb/xkb.c | 20 ++++++++++----------
  1 file changed, 10 insertions(+), 10 deletions(-)
 
 diff --git a/xkb/xkb.c b/xkb/xkb.c
-index d056c698c..684394d77 100644
+index a29262c24..64e52611e 100644
 --- a/xkb/xkb.c
 +++ b/xkb/xkb.c
-@@ -5372,16 +5372,16 @@ _CheckSetSections(XkbGeometryPtr geom,
+@@ -5368,16 +5368,16 @@ _CheckSetSections(XkbGeometryPtr geom,
              row->left = rWire->left;
              row->vertical = rWire->vertical;
              kWire = (xkbKeyWireDesc *) &rWire[1];
@@ -42,7 +41,7 @@ index d056c698c..684394d77 100644
                  if (key->shape_ndx >= geom->num_shapes) {
                      client->errorValue = _XkbErrCode3(0x10, key->shape_ndx,
                                                        geom->num_shapes);
-@@ -5393,7 +5393,7 @@ _CheckSetSections(XkbGeometryPtr geom,
+@@ -5389,7 +5389,7 @@ _CheckSetSections(XkbGeometryPtr geom,
                      return BadMatch;
                  }
              }
@@ -51,7 +50,7 @@ index d056c698c..684394d77 100644
          }
          wire = (char *) rWire;
          if (sWire->nDoodads > 0) {
-@@ -5458,16 +5458,16 @@ _CheckSetShapes(XkbGeometryPtr geom,
+@@ -5454,16 +5454,16 @@ _CheckSetShapes(XkbGeometryPtr geom,
                      return BadAlloc;
                  ol->corner_radius = olWire->cornerRadius;
                  ptWire = (xkbPointWireDesc *) &olWire[1];

0002-xkb-swap-XkbSetDeviceInfo-and-XkbSetDeviceInfoCheck.patch

@@ -1,4 +1,4 @@
-From 45a0af83129eb7dc244c5118360afc1972a686c7 Mon Sep 17 00:00:00 2001
+From dd8caf39e9e15d8f302e54045dd08d8ebf1025dc Mon Sep 17 00:00:00 2001
 From: Peter Hutterer <peter.hutterer@who-t.net>
 Date: Tue, 5 Jul 2022 09:50:41 +1000
 Subject: [PATCH xserver 2/3] xkb: swap XkbSetDeviceInfo and
@@ -32,16 +32,15 @@ Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
 Introduced in c06e27b2f6fd9f7b9f827623a48876a225264132
 
 Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
-(cherry picked from commit dd8caf39e9e15d8f302e54045dd08d8ebf1025dc)
 ---
  xkb/xkb.c | 46 +++++++++++++++++++++++++---------------------
  1 file changed, 25 insertions(+), 21 deletions(-)
 
 diff --git a/xkb/xkb.c b/xkb/xkb.c
-index 684394d77..36464a770 100644
+index 64e52611e..34b2c290b 100644
 --- a/xkb/xkb.c
 +++ b/xkb/xkb.c
-@@ -6554,7 +6554,8 @@ ProcXkbGetDeviceInfo(ClientPtr client)
+@@ -6550,7 +6550,8 @@ ProcXkbGetDeviceInfo(ClientPtr client)
  static char *
  CheckSetDeviceIndicators(char *wire,
                           DeviceIntPtr dev,
@@ -51,7 +50,7 @@ index 684394d77..36464a770 100644
  {
      xkbDeviceLedsWireDesc *ledWire;
      int i;
-@@ -6562,6 +6563,11 @@ CheckSetDeviceIndicators(char *wire,
+@@ -6558,6 +6559,11 @@ CheckSetDeviceIndicators(char *wire,
  
      ledWire = (xkbDeviceLedsWireDesc *) wire;
      for (i = 0; i < num; i++) {
@@ -63,7 +62,7 @@ index 684394d77..36464a770 100644
          if (client->swapped) {
              swaps(&ledWire->ledClass);
              swaps(&ledWire->ledID);
-@@ -6589,6 +6595,11 @@ CheckSetDeviceIndicators(char *wire,
+@@ -6585,6 +6591,11 @@ CheckSetDeviceIndicators(char *wire,
              atomWire = (CARD32 *) &ledWire[1];
              if (nNames > 0) {
                  for (n = 0; n < nNames; n++) {
@@ -75,7 +74,7 @@ index 684394d77..36464a770 100644
                      if (client->swapped) {
                          swapl(atomWire);
                      }
-@@ -6600,6 +6611,10 @@ CheckSetDeviceIndicators(char *wire,
+@@ -6596,6 +6607,10 @@ CheckSetDeviceIndicators(char *wire,
              mapWire = (xkbIndicatorMapWireDesc *) atomWire;
              if (nMaps > 0) {
                  for (n = 0; n < nMaps; n++) {
@@ -86,7 +85,7 @@ index 684394d77..36464a770 100644
                      if (client->swapped) {
                          swaps(&mapWire->virtualMods);
                          swapl(&mapWire->ctrls);
-@@ -6651,11 +6666,6 @@ SetDeviceIndicators(char *wire,
+@@ -6647,11 +6662,6 @@ SetDeviceIndicators(char *wire,
          xkbIndicatorMapWireDesc *mapWire;
          XkbSrvLedInfoPtr sli;
  
@@ -98,7 +97,7 @@ index 684394d77..36464a770 100644
          namec = mapc = statec = 0;
          sli = XkbFindSrvLedInfo(dev, ledWire->ledClass, ledWire->ledID,
                                  XkbXI_IndicatorMapsMask);
-@@ -6674,10 +6684,6 @@ SetDeviceIndicators(char *wire,
+@@ -6670,10 +6680,6 @@ SetDeviceIndicators(char *wire,
              memset((char *) sli->names, 0, XkbNumIndicators * sizeof(Atom));
              for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) {
                  if (ledWire->namesPresent & bit) {
@@ -109,7 +108,7 @@ index 684394d77..36464a770 100644
                      sli->names[n] = (Atom) *atomWire;
                      if (sli->names[n] == None)
                          ledWire->namesPresent &= ~bit;
-@@ -6695,10 +6701,6 @@ SetDeviceIndicators(char *wire,
+@@ -6691,10 +6697,6 @@ SetDeviceIndicators(char *wire,
          if (ledWire->mapsPresent) {
              for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) {
                  if (ledWire->mapsPresent & bit) {
@@ -120,7 +119,7 @@ index 684394d77..36464a770 100644
                      sli->maps[n].flags = mapWire->flags;
                      sli->maps[n].which_groups = mapWire->whichGroups;
                      sli->maps[n].groups = mapWire->groups;
-@@ -6734,13 +6736,17 @@ SetDeviceIndicators(char *wire,
+@@ -6730,13 +6732,17 @@ SetDeviceIndicators(char *wire,
  }
  
  static int
@@ -139,7 +138,7 @@ index 684394d77..36464a770 100644
          if (!dev->button) {
              client->errorValue = _XkbErrCode2(XkbErr_BadClass, ButtonClass);
              return XkbKeyboardErrorCode;
-@@ -6751,13 +6757,13 @@ _XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
+@@ -6747,13 +6753,13 @@ _XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
                               dev->button->numButtons);
              return BadMatch;
          }
@@ -155,7 +154,7 @@ index 684394d77..36464a770 100644
          if (status != Success)
              return status;
      }
-@@ -6768,8 +6774,8 @@ _XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
+@@ -6764,8 +6770,8 @@ _XkbSetDeviceInfo(ClientPtr client, DeviceIntPtr dev,
  }
  
  static int
@@ -166,7 +165,7 @@ index 684394d77..36464a770 100644
  {
      char *wire;
      xkbExtensionDeviceNotify ed;
-@@ -6793,8 +6799,6 @@ _XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev,
+@@ -6789,8 +6795,6 @@ _XkbSetDeviceInfoCheck(ClientPtr client, DeviceIntPtr dev,
          if (stuff->firstBtn + stuff->nBtns > nBtns)
              return BadValue;
          sz = stuff->nBtns * SIZEOF(xkbActionWireDesc);

0003-xkb-add-request-length-validation-for-XkbSetGeometry.patch

@@ -1,4 +1,4 @@
-From bd134231e282d9eb126b6fdaa40bb383180fa72b Mon Sep 17 00:00:00 2001
+From 6907b6ea2b4ce949cb07271f5b678d5966d9df42 Mon Sep 17 00:00:00 2001
 From: Peter Hutterer <peter.hutterer@who-t.net>
 Date: Tue, 5 Jul 2022 11:11:06 +1000
 Subject: [PATCH xserver 3/3] xkb: add request length validation for
@@ -17,16 +17,15 @@ This vulnerability was discovered by:
 Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
 
 Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
-(cherry picked from commit 6907b6ea2b4ce949cb07271f5b678d5966d9df42)
 ---
  xkb/xkb.c | 43 ++++++++++++++++++++++++++++++++++++++-----
  1 file changed, 38 insertions(+), 5 deletions(-)
 
 diff --git a/xkb/xkb.c b/xkb/xkb.c
-index 36464a770..27d19793e 100644
+index 34b2c290b..4692895db 100644
 --- a/xkb/xkb.c
 +++ b/xkb/xkb.c
-@@ -5160,7 +5160,7 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str)
+@@ -5156,7 +5156,7 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str)
  }
  
  static Status
@@ -35,7 +34,7 @@ index 36464a770..27d19793e 100644
                  XkbGeometryPtr geom, XkbSectionPtr section, ClientPtr client)
  {
      char *wire;
-@@ -5171,6 +5171,9 @@ _CheckSetDoodad(char **wire_inout,
+@@ -5167,6 +5167,9 @@ _CheckSetDoodad(char **wire_inout,
      Status status;
  
      dWire = (xkbDoodadWireDesc *) (*wire_inout);
@@ -45,7 +44,7 @@ index 36464a770..27d19793e 100644
      any = dWire->any;
      wire = (char *) &dWire[1];
      if (client->swapped) {
-@@ -5273,7 +5276,7 @@ _CheckSetDoodad(char **wire_inout,
+@@ -5269,7 +5272,7 @@ _CheckSetDoodad(char **wire_inout,
  }
  
  static Status
@@ -54,7 +53,7 @@ index 36464a770..27d19793e 100644
                   XkbGeometryPtr geom, XkbSectionPtr section, ClientPtr client)
  {
      register int r;
-@@ -5284,6 +5287,9 @@ _CheckSetOverlay(char **wire_inout,
+@@ -5280,6 +5283,9 @@ _CheckSetOverlay(char **wire_inout,
  
      wire = *wire_inout;
      olWire = (xkbOverlayWireDesc *) wire;
@@ -64,7 +63,7 @@ index 36464a770..27d19793e 100644
      if (client->swapped) {
          swapl(&olWire->name);
      }
-@@ -5295,6 +5301,9 @@ _CheckSetOverlay(char **wire_inout,
+@@ -5291,6 +5297,9 @@ _CheckSetOverlay(char **wire_inout,
          xkbOverlayKeyWireDesc *kWire;
          XkbOverlayRowPtr row;
  
@@ -74,7 +73,7 @@ index 36464a770..27d19793e 100644
          if (rWire->rowUnder > section->num_rows) {
              client->errorValue = _XkbErrCode4(0x20, r, section->num_rows,
                                                rWire->rowUnder);
-@@ -5303,6 +5312,9 @@ _CheckSetOverlay(char **wire_inout,
+@@ -5299,6 +5308,9 @@ _CheckSetOverlay(char **wire_inout,
          row = XkbAddGeomOverlayRow(ol, rWire->rowUnder, rWire->nKeys);
          kWire = (xkbOverlayKeyWireDesc *) &rWire[1];
          for (k = 0; k < rWire->nKeys; k++, kWire++) {
@@ -84,7 +83,7 @@ index 36464a770..27d19793e 100644
              if (XkbAddGeomOverlayKey(ol, row,
                                       (char *) kWire->over,
                                       (char *) kWire->under) == NULL) {
-@@ -5336,6 +5348,9 @@ _CheckSetSections(XkbGeometryPtr geom,
+@@ -5332,6 +5344,9 @@ _CheckSetSections(XkbGeometryPtr geom,
          register int r;
          xkbRowWireDesc *rWire;
  
@@ -94,7 +93,7 @@ index 36464a770..27d19793e 100644
          if (client->swapped) {
              swapl(&sWire->name);
              swaps(&sWire->top);
-@@ -5361,6 +5376,9 @@ _CheckSetSections(XkbGeometryPtr geom,
+@@ -5357,6 +5372,9 @@ _CheckSetSections(XkbGeometryPtr geom,
              XkbRowPtr row;
              xkbKeyWireDesc *kWire;
  
@@ -104,7 +103,7 @@ index 36464a770..27d19793e 100644
              if (client->swapped) {
                  swaps(&rWire->top);
                  swaps(&rWire->left);
-@@ -5375,6 +5393,9 @@ _CheckSetSections(XkbGeometryPtr geom,
+@@ -5371,6 +5389,9 @@ _CheckSetSections(XkbGeometryPtr geom,
              for (k = 0; k < rWire->nKeys; k++, kWire++) {
                  XkbKeyPtr key;
  
@@ -114,7 +113,7 @@ index 36464a770..27d19793e 100644
                  key = XkbAddGeomKey(row);
                  if (!key)
                      return BadAlloc;
-@@ -5400,7 +5421,7 @@ _CheckSetSections(XkbGeometryPtr geom,
+@@ -5396,7 +5417,7 @@ _CheckSetSections(XkbGeometryPtr geom,
              register int d;
  
              for (d = 0; d < sWire->nDoodads; d++) {
@@ -123,7 +122,7 @@ index 36464a770..27d19793e 100644
                  if (status != Success)
                      return status;
              }
-@@ -5409,7 +5430,7 @@ _CheckSetSections(XkbGeometryPtr geom,
+@@ -5405,7 +5426,7 @@ _CheckSetSections(XkbGeometryPtr geom,
              register int o;
  
              for (o = 0; o < sWire->nOverlays; o++) {
@@ -132,7 +131,7 @@ index 36464a770..27d19793e 100644
                  if (status != Success)
                      return status;
              }
-@@ -5443,6 +5464,9 @@ _CheckSetShapes(XkbGeometryPtr geom,
+@@ -5439,6 +5460,9 @@ _CheckSetShapes(XkbGeometryPtr geom,
              xkbOutlineWireDesc *olWire;
              XkbOutlinePtr ol;
  
@@ -142,7 +141,7 @@ index 36464a770..27d19793e 100644
              shape =
                  XkbAddGeomShape(geom, shapeWire->name, shapeWire->nOutlines);
              if (!shape)
-@@ -5453,12 +5477,18 @@ _CheckSetShapes(XkbGeometryPtr geom,
+@@ -5449,12 +5473,18 @@ _CheckSetShapes(XkbGeometryPtr geom,
                  XkbPointPtr pt;
                  xkbPointWireDesc *ptWire;
  
@@ -161,7 +160,7 @@ index 36464a770..27d19793e 100644
                      pt->x = ptWire->x;
                      pt->y = ptWire->y;
                      if (client->swapped) {
-@@ -5564,12 +5594,15 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSetGeometryReq * req, ClientPtr client)
+@@ -5560,12 +5590,15 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSetGeometryReq * req, ClientPtr client)
          return status;
  
      for (i = 0; i < req->nDoodads; i++) {

0004-Xi-disallow-passive-grabs-with-a-detail-255.patch

@@ -27,14 +27,14 @@ Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
 Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
 Acked-by: Olivier Fourdan <ofourdan@redhat.com>
 ---
- Xi/xipassivegrab.c | 12 ++++++++++++
+ Xi/xipassivegrab.c | 22 ++++++++++++++--------
- 1 file changed, 12 insertions(+)
+ 1 file changed, 14 insertions(+), 8 deletions(-)
 
 diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
-index 65d5870f6f..89a591098a 100644
+index 2769fb7c94..c9ac2f8553 100644
 --- a/Xi/xipassivegrab.c
 +++ b/Xi/xipassivegrab.c
-@@ -133,6 +133,12 @@ ProcXIPassiveGrabDevice(ClientPtr client)
+@@ -137,6 +137,12 @@ ProcXIPassiveGrabDevice(ClientPtr client)
          return BadValue;
      }
  
@@ -47,7 +47,24 @@ index 65d5870f6f..89a591098a 100644
      if (XICheckInvalidMaskBits(client, (unsigned char *) &stuff[1],
                                 stuff->mask_len * 4) != Success)
          return BadValue;
-@@ -313,6 +319,12 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
+@@ -207,14 +213,8 @@ ProcXIPassiveGrabDevice(ClientPtr client)
+                                 &param, XI2, &mask);
+             break;
+         case XIGrabtypeKeycode:
+-            /* XI2 allows 32-bit keycodes but thanks to XKB we can never
+-             * implement this. Just return an error for all keycodes that
+-             * cannot work anyway */
+-            if (stuff->detail > 255)
+-                status = XIAlreadyGrabbed;
+-            else
+-                status = GrabKey(client, dev, mod_dev, stuff->detail,
+-                                 &param, XI2, &mask);
++            status = GrabKey(client, dev, mod_dev, stuff->detail,
++                             &param, XI2, &mask);
+             break;
+         case XIGrabtypeEnter:
+         case XIGrabtypeFocusIn:
+@@ -334,6 +334,12 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
          return BadValue;
      }
  

Makefile

@@ -0,0 +1,30 @@
+# Makefile for source rpm: xorg-x11-server
+# $Id$
+NAME := xorg-x11-server
+SPECFILE = $(firstword $(wildcard *.spec))
+
+define find-makefile-common
+for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
+endef
+
+MAKEFILE_COMMON := $(shell $(find-makefile-common))
+
+ifeq ($(MAKEFILE_COMMON),)
+# attempt a checkout
+define checkout-makefile-common
+test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
+endef
+
+MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
+endif
+
+include $(MAKEFILE_COMMON)
+
+ifeq ($(MAKECMDGOALS),me a sandwich)
+.PHONY :: me a sandwich
+me a:
+	@:
+
+sandwich:
+	@[ `id -u` -ne 0 ] && echo "What? Make it yourself." || echo Okay.
+endif

SOURCES/0001-Always-install-vbe-and-int10-sdk-headers.patch

@@ -1,37 +0,0 @@
-From e96a83d9b1b5a52a41213c7a4840dc96b4f5b06f Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Wed, 15 Aug 2012 12:35:21 -0400
-Subject: [PATCH] Always install vbe and int10 sdk headers
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
----
- hw/xfree86/Makefile.am | 12 ++----------
- 1 file changed, 2 insertions(+), 10 deletions(-)
-
-diff --git a/hw/xfree86/Makefile.am b/hw/xfree86/Makefile.am
-index b876b79..a170b58 100644
---- a/hw/xfree86/Makefile.am
-+++ b/hw/xfree86/Makefile.am
-@@ -26,17 +26,9 @@ if VGAHW
- VGAHW_SUBDIR = vgahw
- endif
- 
--if VBE
--VBE_SUBDIR = vbe
--endif
--
--if INT10MODULE
--INT10_SUBDIR = int10
--endif
--
--SUBDIRS = common ddc x86emu $(INT10_SUBDIR) os-support parser \
-+SUBDIRS = common ddc x86emu int10 os-support parser \
- 	  ramdac $(VGAHW_SUBDIR) loader modes $(DRI_SUBDIR) \
--	  $(DRI2_SUBDIR) . $(VBE_SUBDIR) i2c dixmods xkb \
-+	  $(DRI2_SUBDIR) . vbe i2c dixmods xkb \
- 	  fbdevhw shadowfb exa $(XF86UTILS_SUBDIR) doc man \
- 	  $(GLAMOR_EGL_SUBDIR) drivers
- 
--- 
-2.13.6
-

SOURCES/0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch

@@ -1,41 +0,0 @@
-From 38ae53c94a88c7bd5877c72a12582b60865e07ff Mon Sep 17 00:00:00 2001
-From: Hans de Goede <hdegoede@redhat.com>
-Date: Thu, 17 Apr 2014 15:50:44 +0200
-Subject: [PATCH] Fedora hack: Make the suid-root wrapper start the server with
- root rights
-
-Do NOT upstream.
-
-Since most display managers are not ready yet to start Xorg in way which will
-keep it working without root-rights, see:
-https://fedoraproject.org/wiki/Changes/XorgWithoutRootRights
-
-Just keep starting X as root for now, but do it through the wrapper, by
-overriding the needs_root_rights = -1 (auto) default and setting it to 1.
-
-We set a special environment variable when starting X in a way where root
-rights are not needed (from gdm and startx) and keep the upstream
-needs_root_rights = -1 (auto) default in that case.
-
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
----
- hw/xfree86/xorg-wrapper.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/hw/xfree86/xorg-wrapper.c b/hw/xfree86/xorg-wrapper.c
-index 4c37cfc..ae5d27f 100644
---- a/hw/xfree86/xorg-wrapper.c
-+++ b/hw/xfree86/xorg-wrapper.c
-@@ -198,6 +198,9 @@ int main(int argc, char *argv[])
-     int needs_root_rights = -1;
-     char *const empty_envp[1] = { NULL, };
- 
-+    if (getenv("XORG_RUN_AS_USER_OK") == NULL)
-+        needs_root_rights = 1;
-+
-     progname = argv[0];
- 
-     parse_config(&allowed, &needs_root_rights);
--- 
-2.4.3
-

SOURCES/0001-Fix-segfault-on-probing-a-non-PCI-platform-device-on.patch

@@ -1,31 +0,0 @@
-From e50c85f4ebf559a3bac4817b41074c43d4691779 Mon Sep 17 00:00:00 2001
-From: Eric Anholt <eric@anholt.net>
-Date: Fri, 26 Oct 2018 17:47:30 -0700
-Subject: [PATCH xserver] Fix segfault on probing a non-PCI platform device on
- a system with PCI.
-
-Some Broadcom set-top-box boards have PCI busses, but the GPU is still
-probed through DT.  We would dereference a null busid here in that
-case.
-
-Signed-off-by: Eric Anholt <eric@anholt.net>
----
- hw/xfree86/common/xf86platformBus.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/xfree86/common/xf86platformBus.c b/hw/xfree86/common/xf86platformBus.c
-index cef47da03..dadbac6c8 100644
---- a/hw/xfree86/common/xf86platformBus.c
-+++ b/hw/xfree86/common/xf86platformBus.c
-@@ -289,7 +289,7 @@ xf86platformProbe(void)
-     for (i = 0; i < xf86_num_platform_devices; i++) {
-         char *busid = xf86_platform_odev_attributes(i)->busid;
- 
--        if (pci && (strncmp(busid, "pci:", 4) == 0)) {
-+        if (pci && busid && (strncmp(busid, "pci:", 4) == 0)) {
-             platform_find_pci_info(&xf86_platform_devices[i], busid);
-         }
- 
--- 
-2.14.4
-

SOURCES/0001-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch

@@ -1,45 +0,0 @@
-From 96798fc1967491c80a4d0c8d9e0a80586cb2152b Mon Sep 17 00:00:00 2001
-From: Alan Coopersmith <alan.coopersmith@oracle.com>
-Date: Fri, 22 Mar 2024 18:51:45 -0700
-Subject: [PATCH 1/4] Xi: ProcXIGetSelectedEvents needs to use unswapped length
- to send reply
-
-CVE-2024-31080
-
-Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762
-Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.")
-Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
----
- Xi/xiselectev.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
-index edcb8a0d3..ac1494987 100644
---- a/Xi/xiselectev.c
-+++ b/Xi/xiselectev.c
-@@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client)
-     InputClientsPtr others = NULL;
-     xXIEventMask *evmask = NULL;
-     DeviceIntPtr dev;
-+    uint32_t length;
- 
-     REQUEST(xXIGetSelectedEventsReq);
-     REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq);
-@@ -418,10 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client)
-         }
-     }
- 
-+    /* save the value before SRepXIGetSelectedEvents swaps it */
-+    length = reply.length;
-     WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
- 
-     if (reply.num_masks)
--        WriteToClient(client, reply.length * 4, buffer);
-+        WriteToClient(client, length * 4, buffer);
- 
-     free(buffer);
-     return Success;
--- 
-2.44.0
-

SOURCES/0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch

@@ -1,77 +0,0 @@
-From a7bda3080d2b44eae668cdcec7a93095385b9652 Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Tue, 28 Nov 2023 15:19:04 +1000
-Subject: [PATCH xserver] Xi: allocate enough XkbActions for our buttons
-
-button->xkb_acts is supposed to be an array sufficiently large for all
-our buttons, not just a single XkbActions struct. Allocating
-insufficient memory here means when we memcpy() later in
-XkbSetDeviceInfo we write into memory that wasn't ours to begin with,
-leading to the usual security ooopsiedaisies.
-
-CVE-2023-6377, ZDI-CAN-22412, ZDI-CAN-22413
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-(cherry picked from commit 0c1a93d319558fe3ab2d94f51d174b4f93810afd)
----
- Xi/exevents.c | 12 ++++++------
- dix/devices.c | 10 ++++++++++
- 2 files changed, 16 insertions(+), 6 deletions(-)
-
-diff --git a/Xi/exevents.c b/Xi/exevents.c
-index dcd4efb3bc..54ea11a938 100644
---- a/Xi/exevents.c
-+++ b/Xi/exevents.c
-@@ -611,13 +611,13 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
-         }
- 
-         if (from->button->xkb_acts) {
--            if (!to->button->xkb_acts) {
--                to->button->xkb_acts = calloc(1, sizeof(XkbAction));
--                if (!to->button->xkb_acts)
--                    FatalError("[Xi] not enough memory for xkb_acts.\n");
--            }
-+            size_t maxbuttons = max(to->button->numButtons, from->button->numButtons);
-+            to->button->xkb_acts = xnfreallocarray(to->button->xkb_acts,
-+                                                   maxbuttons,
-+                                                   sizeof(XkbAction));
-+            memset(to->button->xkb_acts, 0, maxbuttons * sizeof(XkbAction));
-             memcpy(to->button->xkb_acts, from->button->xkb_acts,
--                   sizeof(XkbAction));
-+                   from->button->numButtons * sizeof(XkbAction));
-         }
-         else {
-             free(to->button->xkb_acts);
-diff --git a/dix/devices.c b/dix/devices.c
-index 5bf956ead4..15e46a9a5f 100644
---- a/dix/devices.c
-+++ b/dix/devices.c
-@@ -2525,6 +2525,8 @@ RecalculateMasterButtons(DeviceIntPtr slave)
- 
-     if (master->button && master->button->numButtons != maxbuttons) {
-         int i;
-+        int last_num_buttons = master->button->numButtons;
-+
-         DeviceChangedEvent event = {
-             .header = ET_Internal,
-             .type = ET_DeviceChanged,
-@@ -2535,6 +2537,14 @@ RecalculateMasterButtons(DeviceIntPtr slave)
-         };
- 
-         master->button->numButtons = maxbuttons;
-+        if (last_num_buttons < maxbuttons) {
-+            master->button->xkb_acts = xnfreallocarray(master->button->xkb_acts,
-+                                                       maxbuttons,
-+                                                       sizeof(XkbAction));
-+            memset(&master->button->xkb_acts[last_num_buttons],
-+                   0,
-+                   (maxbuttons - last_num_buttons) * sizeof(XkbAction));
-+        }
- 
-         memcpy(&event.buttons.names, master->button->labels, maxbuttons *
-                sizeof(Atom));
--- 
-2.43.0
-

SOURCES/0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch

@@ -1,35 +0,0 @@
-From 7150ba655c0cc08fa6ded309b81265bb672f2869 Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Wed, 25 Jan 2023 11:41:40 +1000
-Subject: [PATCH xserver] Xi: fix potential use-after-free in
- DeepCopyPointerClasses
-
-CVE-2023-0494, ZDI-CAN 19596
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
----
- Xi/exevents.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/Xi/exevents.c b/Xi/exevents.c
-index 217baa9561..dcd4efb3bc 100644
---- a/Xi/exevents.c
-+++ b/Xi/exevents.c
-@@ -619,8 +619,10 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to)
-             memcpy(to->button->xkb_acts, from->button->xkb_acts,
-                    sizeof(XkbAction));
-         }
--        else
-+        else {
-             free(to->button->xkb_acts);
-+            to->button->xkb_acts = NULL;
-+        }
- 
-         memcpy(to->button->labels, from->button->labels,
-                from->button->numButtons * sizeof(Atom));
--- 
-2.39.0
-

SOURCES/0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch

@@ -1,80 +0,0 @@
-From a31ba141824a7649e11f0ef7673718ce559d6337 Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Tue, 3 Oct 2023 11:53:05 +1000
-Subject: [PATCH xserver 1/4] Xi/randr: fix handling of PropModeAppend/Prepend
-
-The handling of appending/prepending properties was incorrect, with at
-least two bugs: the property length was set to the length of the new
-part only, i.e. appending or prepending N elements to a property with P
-existing elements always resulted in the property having N elements
-instead of N + P.
-
-Second, when pre-pending a value to a property, the offset for the old
-values was incorrect, leaving the new property with potentially
-uninitalized values and/or resulting in OOB memory writes.
-For example, prepending a 3 element value to a 5 element property would
-result in this 8 value array:
-  [N, N, N, ?, ?, P, P, P ] P, P
-                            ^OOB write
-
-The XI2 code is a copy/paste of the RandR code, so the bug exists in
-both.
-
-CVE-2023-5367, ZDI-CAN-22153
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
----
- Xi/xiproperty.c    | 4 ++--
- randr/rrproperty.c | 4 ++--
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
-index 6ec419e870..563c4f31a5 100644
---- a/Xi/xiproperty.c
-+++ b/Xi/xiproperty.c
-@@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
-                 XIDestroyDeviceProperty(prop);
-             return BadAlloc;
-         }
--        new_value.size = len;
-+        new_value.size = total_len;
-         new_value.type = type;
-         new_value.format = format;
- 
-@@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
-         case PropModePrepend:
-             new_data = new_value.data;
-             old_data = (void *) (((char *) new_value.data) +
--                                  (prop_value->size * size_in_bytes));
-+                                  (len * size_in_bytes));
-             break;
-         }
-         if (new_data)
-diff --git a/randr/rrproperty.c b/randr/rrproperty.c
-index c2fb9585c6..25469f57b2 100644
---- a/randr/rrproperty.c
-+++ b/randr/rrproperty.c
-@@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
-                 RRDestroyOutputProperty(prop);
-             return BadAlloc;
-         }
--        new_value.size = len;
-+        new_value.size = total_len;
-         new_value.type = type;
-         new_value.format = format;
- 
-@@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
-         case PropModePrepend:
-             new_data = new_value.data;
-             old_data = (void *) (((char *) new_value.data) +
--                                  (prop_value->size * size_in_bytes));
-+                                  (len * size_in_bytes));
-             break;
-         }
-         if (new_data)
--- 
-2.41.0
-

SOURCES/0001-Xtest-disallow-GenericEvents-in-XTestSwapFakeInput.patch

@@ -1,52 +0,0 @@
-From 8dba686dc277d6d262ad0c77b4632a5b276697ba Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Tue, 29 Nov 2022 12:55:45 +1000
-Subject: [PATCH xserver 1/7] Xtest: disallow GenericEvents in
- XTestSwapFakeInput
-
-XTestSwapFakeInput assumes all events in this request are
-sizeof(xEvent) and iterates through these in 32-byte increments.
-However, a GenericEvent may be of arbitrary length longer than 32 bytes,
-so any GenericEvent in this list would result in subsequent events to be
-misparsed.
-
-Additional, the swapped event is written into a stack-allocated struct
-xEvent (size 32 bytes). For any GenericEvent longer than 32 bytes,
-swapping the event may thus smash the stack like an avocado on toast.
-
-Catch this case early and return BadValue for any GenericEvent.
-Which is what would happen in unswapped setups anyway since XTest
-doesn't support GenericEvent.
-
-CVE-2022-46340, ZDI-CAN 19265
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
-Acked-by: Olivier Fourdan <ofourdan@redhat.com>
----
- Xext/xtest.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/Xext/xtest.c b/Xext/xtest.c
-index bf27eb590b..2985a4ce6e 100644
---- a/Xext/xtest.c
-+++ b/Xext/xtest.c
-@@ -502,10 +502,11 @@ XTestSwapFakeInput(ClientPtr client, xReq * req)
- 
-     nev = ((req->length << 2) - sizeof(xReq)) / sizeof(xEvent);
-     for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) {
-+        int evtype = ev->u.u.type & 0x177;
-         /* Swap event */
--        proc = EventSwapVector[ev->u.u.type & 0177];
-+        proc = EventSwapVector[evtype];
-         /* no swapping proc; invalid event type? */
--        if (!proc || proc == NotImplemented) {
-+        if (!proc || proc == NotImplemented || evtype == GenericEvent) {
-             client->errorValue = ev->u.u.type;
-             return BadValue;
-         }
--- 
-2.38.1
-

SOURCES/0001-autobind-GPUs-to-the-screen.patch

@@ -1,293 +0,0 @@
-From 471289fa1dc359555ceed6302f7d9605ab6be3ea Mon Sep 17 00:00:00 2001
-From: Dave Airlie <airlied@redhat.com>
-Date: Mon, 2 Apr 2018 16:49:02 -0400
-Subject: [PATCH] autobind GPUs to the screen
-
-This is a modified version of a patch we've been carry-ing in Fedora and
-RHEL for years now. This patch automatically adds secondary GPUs to the
-master as output sink / offload source making e.g. the use of
-slave-outputs just work, with requiring the user to manually run
-"xrandr --setprovideroutputsource" before he can hookup an external
-monitor to his hybrid graphics laptop.
-
-There is one problem with this patch, which is why it was not upstreamed
-before. What to do when a secondary GPU gets detected really is a policy
-decission (e.g. one may want to autobind PCI GPUs but not USB ones) and
-as such should be under control of the Desktop Environment.
-
-Unconditionally adding autobinding support to the xserver will result
-in races between the DE dealing with the hotplug of a secondary GPU
-and the server itself dealing with it.
-
-However we've waited for years for any Desktop Environments to actually
-start doing some sort of autoconfiguration of secondary GPUs and there
-is still not a single DE dealing with this, so I believe that it is
-time to upstream this now.
-
-To avoid potential future problems if any DEs get support for doing
-secondary GPU configuration themselves, the new autobind functionality
-is made optional. Since no DEs currently support doing this themselves it
-is enabled by default. When DEs grow support for doing this themselves
-they can disable the servers autobinding through the servers cmdline or a
-xorg.conf snippet.
-
-Signed-off-by: Dave Airlie <airlied@gmail.com>
-[hdegoede@redhat.com: Make configurable, fix with nvidia, submit upstream]
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
----
- hw/xfree86/common/xf86Config.c      | 19 +++++++++++++++++++
- hw/xfree86/common/xf86Globals.c     |  2 ++
- hw/xfree86/common/xf86Init.c        | 20 ++++++++++++++++++++
- hw/xfree86/common/xf86Priv.h        |  1 +
- hw/xfree86/common/xf86Privstr.h     |  1 +
- hw/xfree86/common/xf86platformBus.c |  4 ++++
- hw/xfree86/man/Xorg.man             |  7 +++++++
- hw/xfree86/man/xorg.conf.man        |  6 ++++++
- randr/randrstr.h                    |  3 +++
- randr/rrprovider.c                  | 22 ++++++++++++++++++++++
- 10 files changed, 85 insertions(+)
-
-diff --git a/hw/xfree86/common/xf86Config.c b/hw/xfree86/common/xf86Config.c
-index 2c1d335..d7d7c2e 100644
---- a/hw/xfree86/common/xf86Config.c
-+++ b/hw/xfree86/common/xf86Config.c
-@@ -643,6 +643,7 @@ typedef enum {
-     FLAG_DRI2,
-     FLAG_USE_SIGIO,
-     FLAG_AUTO_ADD_GPU,
-+    FLAG_AUTO_BIND_GPU,
-     FLAG_MAX_CLIENTS,
-     FLAG_IGLX,
-     FLAG_DEBUG,
-@@ -699,6 +700,8 @@ static OptionInfoRec FlagOptions[] = {
-      {0}, FALSE},
-     {FLAG_AUTO_ADD_GPU, "AutoAddGPU", OPTV_BOOLEAN,
-      {0}, FALSE},
-+    {FLAG_AUTO_BIND_GPU, "AutoBindGPU", OPTV_BOOLEAN,
-+     {0}, FALSE},
-     {FLAG_MAX_CLIENTS, "MaxClients", OPTV_INTEGER,
-      {0}, FALSE },
-     {FLAG_IGLX, "IndirectGLX", OPTV_BOOLEAN,
-@@ -779,6 +782,22 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
-     }
-     xf86Msg(from, "%sutomatically adding GPU devices\n",
-             xf86Info.autoAddGPU ? "A" : "Not a");
-+
-+    if (xf86AutoBindGPUDisabled) {
-+        xf86Info.autoBindGPU = FALSE;
-+        from = X_CMDLINE;
-+    }
-+    else if (xf86IsOptionSet(FlagOptions, FLAG_AUTO_BIND_GPU)) {
-+        xf86GetOptValBool(FlagOptions, FLAG_AUTO_BIND_GPU,
-+                          &xf86Info.autoBindGPU);
-+        from = X_CONFIG;
-+    }
-+    else {
-+        from = X_DEFAULT;
-+    }
-+    xf86Msg(from, "%sutomatically binding GPU devices\n",
-+            xf86Info.autoBindGPU ? "A" : "Not a");
-+
-     /*
-      * Set things up based on the config file information.  Some of these
-      * settings may be overridden later when the command line options are
-diff --git a/hw/xfree86/common/xf86Globals.c b/hw/xfree86/common/xf86Globals.c
-index e890f05..7b27b4c 100644
---- a/hw/xfree86/common/xf86Globals.c
-+++ b/hw/xfree86/common/xf86Globals.c
-@@ -131,6 +131,7 @@ xf86InfoRec xf86Info = {
- #else
-     .autoAddGPU = FALSE,
- #endif
-+    .autoBindGPU = TRUE,
- };
- 
- const char *xf86ConfigFile = NULL;
-@@ -191,6 +192,7 @@ Bool xf86FlipPixels = FALSE;
- Gamma xf86Gamma = { 0.0, 0.0, 0.0 };
- 
- Bool xf86AllowMouseOpenFail = FALSE;
-+Bool xf86AutoBindGPUDisabled = FALSE;
- 
- #ifdef XF86VIDMODE
- Bool xf86VidModeDisabled = FALSE;
-diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
-index ea42ec9..ec255b6 100644
---- a/hw/xfree86/common/xf86Init.c
-+++ b/hw/xfree86/common/xf86Init.c
-@@ -76,6 +76,7 @@
- #include "xf86DDC.h"
- #include "xf86Xinput.h"
- #include "xf86InPriv.h"
-+#include "xf86Crtc.h"
- #include "picturestr.h"
- #include "randrstr.h"
- #include "glxvndabi.h"
-@@ -237,6 +238,19 @@ xf86PrivsElevated(void)
-     return PrivsElevated();
- }
- 
-+static void
-+xf86AutoConfigOutputDevices(void)
-+{
-+    int i;
-+
-+    if (!xf86Info.autoBindGPU)
-+        return;
-+
-+    for (i = 0; i < xf86NumGPUScreens; i++)
-+        RRProviderAutoConfigGpuScreen(xf86ScrnToScreen(xf86GPUScreens[i]),
-+                                      xf86ScrnToScreen(xf86Screens[0]));
-+}
-+
- static void
- TrapSignals(void)
- {
-@@ -770,6 +784,8 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char **argv)
-     for (i = 0; i < xf86NumGPUScreens; i++)
-         AttachUnboundGPU(xf86Screens[0]->pScreen, xf86GPUScreens[i]->pScreen);
- 
-+    xf86AutoConfigOutputDevices();
-+
-     xf86VGAarbiterWrapFunctions();
-     if (sigio_blocked)
-         input_unlock();
-@@ -1278,6 +1294,10 @@ ddxProcessArgument(int argc, char **argv, int i)
-         xf86Info.iglxFrom = X_CMDLINE;
-         return 0;
-     }
-+    if (!strcmp(argv[i], "-noautoBindGPU")) {
-+        xf86AutoBindGPUDisabled = TRUE;
-+        return 1;
-+    }
- 
-     /* OS-specific processing */
-     return xf86ProcessArgument(argc, argv, i);
-diff --git a/hw/xfree86/common/xf86Priv.h b/hw/xfree86/common/xf86Priv.h
-index 4fe2b5f..6566622 100644
---- a/hw/xfree86/common/xf86Priv.h
-+++ b/hw/xfree86/common/xf86Priv.h
-@@ -46,6 +46,7 @@
- extern _X_EXPORT const char *xf86ConfigFile;
- extern _X_EXPORT const char *xf86ConfigDir;
- extern _X_EXPORT Bool xf86AllowMouseOpenFail;
-+extern _X_EXPORT Bool xf86AutoBindGPUDisabled;
- 
- #ifdef XF86VIDMODE
- extern _X_EXPORT Bool xf86VidModeDisabled;
-diff --git a/hw/xfree86/common/xf86Privstr.h b/hw/xfree86/common/xf86Privstr.h
-index 21c2e1f..6c71863 100644
---- a/hw/xfree86/common/xf86Privstr.h
-+++ b/hw/xfree86/common/xf86Privstr.h
-@@ -98,6 +98,7 @@ typedef struct {
- 
-     Bool autoAddGPU;
-     const char *debug;
-+    Bool autoBindGPU;
- } xf86InfoRec, *xf86InfoPtr;
- 
- /* ISC's cc can't handle ~ of UL constants, so explicitly type cast them. */
-diff --git a/hw/xfree86/common/xf86platformBus.c b/hw/xfree86/common/xf86platformBus.c
-index cef47da..913a324 100644
---- a/hw/xfree86/common/xf86platformBus.c
-+++ b/hw/xfree86/common/xf86platformBus.c
-@@ -49,6 +49,7 @@
- #include "Pci.h"
- #include "xf86platformBus.h"
- #include "xf86Config.h"
-+#include "xf86Crtc.h"
- 
- #include "randrstr.h"
- int platformSlotClaimed;
-@@ -665,6 +666,9 @@ xf86platformAddDevice(int index)
-    }
-    /* attach unbound to 0 protocol screen */
-    AttachUnboundGPU(xf86Screens[0]->pScreen, xf86GPUScreens[i]->pScreen);
-+   if (xf86Info.autoBindGPU)
-+       RRProviderAutoConfigGpuScreen(xf86ScrnToScreen(xf86GPUScreens[i]),
-+                                     xf86ScrnToScreen(xf86Screens[0]));
- 
-    RRResourcesChanged(xf86Screens[0]->pScreen);
-    RRTellChanged(xf86Screens[0]->pScreen);
-diff --git a/hw/xfree86/man/Xorg.man b/hw/xfree86/man/Xorg.man
-index 13a9dc3..745f986 100644
---- a/hw/xfree86/man/Xorg.man
-+++ b/hw/xfree86/man/Xorg.man
-@@ -283,6 +283,13 @@ is a comma separated list of directories to search for
- server modules.  This option is only available when the server is run
- as root (i.e, with real-uid 0).
- .TP 8
-+.B \-noautoBindGPU
-+Disable automatically setting secondary GPUs up as output sinks and offload
-+sources. This is equivalent to setting the
-+.B AutoBindGPU
-+xorg.conf(__filemansuffix__) file option. To
-+.B false.
-+.TP 8
- .B \-nosilk
- Disable Silken Mouse support.
- .TP 8
-diff --git a/hw/xfree86/man/xorg.conf.man b/hw/xfree86/man/xorg.conf.man
-index 9589262..8d51e06 100644
---- a/hw/xfree86/man/xorg.conf.man
-+++ b/hw/xfree86/man/xorg.conf.man
-@@ -672,6 +672,12 @@ Enabled by default.
- If this option is disabled, then no GPU devices will be added from the udev
- backend. Enabled by default. (May need to be disabled to setup Xinerama).
- .TP 7
-+.BI "Option \*qAutoBindGPU\*q  \*q" boolean \*q
-+If enabled then secondary GPUs will be automatically set up as output-sinks and
-+offload-sources. Making e.g. laptop outputs connected only to the secondary
-+GPU directly available for use without needing to run
-+"xrandr --setprovideroutputsource". Enabled by default.
-+.TP 7
- .BI "Option \*qLog\*q \*q" string \*q
- This option controls whether the log is flushed and/or synced to disk after
- each message.
-diff --git a/randr/randrstr.h b/randr/randrstr.h
-index f94174b..092d726 100644
---- a/randr/randrstr.h
-+++ b/randr/randrstr.h
-@@ -1039,6 +1039,9 @@ RRProviderLookup(XID id, RRProviderPtr *provider_p);
- extern _X_EXPORT void
- RRDeliverProviderEvent(ClientPtr client, WindowPtr pWin, RRProviderPtr provider);
- 
-+extern _X_EXPORT void
-+RRProviderAutoConfigGpuScreen(ScreenPtr pScreen, ScreenPtr masterScreen);
-+
- /* rrproviderproperty.c */
- 
- extern _X_EXPORT void
-diff --git a/randr/rrprovider.c b/randr/rrprovider.c
-index e4bc2bf..e04c18f 100644
---- a/randr/rrprovider.c
-+++ b/randr/rrprovider.c
-@@ -485,3 +485,25 @@ RRDeliverProviderEvent(ClientPtr client, WindowPtr pWin, RRProviderPtr provider)
- 
-     WriteEventsToClient(client, 1, (xEvent *) &pe);
- }
-+
-+void
-+RRProviderAutoConfigGpuScreen(ScreenPtr pScreen, ScreenPtr masterScreen)
-+{
-+    rrScrPrivPtr pScrPriv = rrGetScrPriv(pScreen);
-+    rrScrPrivPtr masterPriv = rrGetScrPriv(masterScreen);
-+    RRProviderPtr provider = pScrPriv->provider;
-+    RRProviderPtr master_provider = masterPriv->provider;
-+
-+    if (!provider || !master_provider)
-+        return;
-+
-+    if ((provider->capabilities & RR_Capability_SinkOutput) &&
-+        (master_provider->capabilities & RR_Capability_SourceOutput)) {
-+        pScrPriv->rrProviderSetOutputSource(pScreen, provider, master_provider);
-+        RRInitPrimeSyncProps(pScreen);
-+    }
-+
-+    if ((provider->capabilities & RR_Capability_SourceOffload) &&
-+        (master_provider->capabilities & RR_Capability_SinkOffload))
-+        pScrPriv->rrProviderSetOffloadSink(pScreen, provider, master_provider);
-+}
--- 
-2.16.2
-

SOURCES/0001-composite-Fix-use-after-free-of-the-COW.patch

@@ -1,42 +0,0 @@
-From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Mon, 13 Mar 2023 11:08:47 +0100
-Subject: [PATCH xserver] composite: Fix use-after-free of the COW
-
-ZDI-CAN-19866/CVE-2023-1393
-
-If a client explicitly destroys the compositor overlay window (aka COW),
-we would leave a dangling pointer to that window in the CompScreen
-structure, which will trigger a use-after-free later.
-
-Make sure to clear the CompScreen pointer to the COW when the latter gets
-destroyed explicitly by the client.
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Reviewed-by: Adam Jackson <ajax@redhat.com>
----
- composite/compwindow.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/composite/compwindow.c b/composite/compwindow.c
-index 4e2494b86..b30da589e 100644
---- a/composite/compwindow.c
-+++ b/composite/compwindow.c
-@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
-     ret = (*pScreen->DestroyWindow) (pWin);
-     cs->DestroyWindow = pScreen->DestroyWindow;
-     pScreen->DestroyWindow = compDestroyWindow;
-+
-+    /* Did we just destroy the overlay window? */
-+    if (pWin == cs->pOverlayWin)
-+        cs->pOverlayWin = NULL;
-+
- /*    compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
-     return ret;
- }
--- 
-2.40.0
-

SOURCES/0001-dix-Fix-use-after-free-in-input-device-shutdown.patch

@@ -1,77 +0,0 @@
-From 1801fe0ac3926882d47d7e1ad6c0518a2cdffd41 Mon Sep 17 00:00:00 2001
-From: Povilas Kanapickas <povilas@radix.lt>
-Date: Sun, 19 Dec 2021 18:11:07 +0200
-Subject: [PATCH] dix: Fix use after free in input device shutdown
-
-This fixes access to freed heap memory via dev->master. E.g. when
-running BarrierNotify.ReceivesNotifyEvents/7 test from
-xorg-integration-tests:
-
-==24736==ERROR: AddressSanitizer: heap-use-after-free on address
-0x619000065020 at pc 0x55c450e2b9cf bp 0x7fffc532fd20 sp 0x7fffc532fd10
-READ of size 4 at 0x619000065020 thread T0
-    #0 0x55c450e2b9ce in GetMaster ../../../dix/devices.c:2722
-    #1 0x55c450e9d035 in IsFloating ../../../dix/events.c:346
-    #2 0x55c4513209c6 in GetDeviceUse ../../../Xi/xiquerydevice.c:525
-../../../Xi/xichangehierarchy.c:95
-    #4 0x55c450e3455c in RemoveDevice ../../../dix/devices.c:1204
-../../../hw/xfree86/common/xf86Xinput.c:1142
-    #6 0x55c450e17b04 in CloseDeviceList ../../../dix/devices.c:1038
-    #7 0x55c450e1de85 in CloseDownDevices ../../../dix/devices.c:1068
-    #8 0x55c450e837ef in dix_main ../../../dix/main.c:302
-    #9 0x55c4517a8d93 in main ../../../dix/stubmain.c:34
-(/lib/x86_64-linux-gnu/libc.so.6+0x28564)
-    #11 0x55c450d0113d in _start (/usr/lib/xorg/Xorg+0x117713d)
-
-0x619000065020 is located 160 bytes inside of 912-byte region
-[0x619000064f80,0x619000065310)
-freed by thread T0 here:
-(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
-    #1 0x55c450e19f1c in CloseDevice ../../../dix/devices.c:1014
-    #2 0x55c450e343a4 in RemoveDevice ../../../dix/devices.c:1186
-../../../hw/xfree86/common/xf86Xinput.c:1142
-    #4 0x55c450e17b04 in CloseDeviceList ../../../dix/devices.c:1038
-    #5 0x55c450e1de85 in CloseDownDevices ../../../dix/devices.c:1068
-    #6 0x55c450e837ef in dix_main ../../../dix/main.c:302
-    #7 0x55c4517a8d93 in main ../../../dix/stubmain.c:34
-(/lib/x86_64-linux-gnu/libc.so.6+0x28564)
-
-previously allocated by thread T0 here:
-(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)
-    #1 0x55c450e1c57b in AddInputDevice ../../../dix/devices.c:259
-    #2 0x55c450e34840 in AllocDevicePair ../../../dix/devices.c:2755
-    #3 0x55c45130318f in add_master ../../../Xi/xichangehierarchy.c:152
-../../../Xi/xichangehierarchy.c:465
-    #5 0x55c4512cb9f5 in ProcIDispatch ../../../Xi/extinit.c:390
-    #6 0x55c450e6a92b in Dispatch ../../../dix/dispatch.c:551
-    #7 0x55c450e834b7 in dix_main ../../../dix/main.c:272
-    #8 0x55c4517a8d93 in main ../../../dix/stubmain.c:34
-(/lib/x86_64-linux-gnu/libc.so.6+0x28564)
-
-The problem is caused by dev->master being not reset when disabling the
-device, which then causes dangling pointer when the master device itself
-is being deleted when exiting whole server.
-
-Note that RecalculateMasterButtons() requires dev->master to be still
-valid, so we can reset it only at the end of function.
-
-Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
----
- dix/devices.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/dix/devices.c b/dix/devices.c
-index e62c34c55..5f9ce1678 100644
---- a/dix/devices.c
-+++ b/dix/devices.c
-@@ -520,6 +520,7 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
-     }
- 
-     RecalculateMasterButtons(dev);
-+    dev->master = NULL;
- 
-     return TRUE;
- }
--- 
-2.43.0
-

SOURCES/0001-dix-Silence-a-compiler-warning-in-doListFontsAndAlia.patch

@@ -1,45 +0,0 @@
-From e710e570b1709d100072a8ab7d05c2aefaf41a1b Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Mon, 15 Jun 2026 14:00:19 +0200
-Subject: [PATCH xserver] dix: Silence a compiler warning in
- doListFontsAndAliases()
-
-Compiler complains that "resolvedlen" might be uninitialized:
-
-| dix/dixfonts.c:559:5: var_decl: Declaring variable "resolvedlen" without initializer.
-| dix/dixfonts.c:674:17: uninit_use: Using uninitialized value "resolvedlen".
-|    672|                    * is complete.
-|    673|                    */
-|    674|->                 if (resolvedlen > XLFDMAXFONTNAMELEN) {
-|    675|                       err = BadFontName;
-|    676|                       goto ContBadFontName;
-
-Most likely a false positive, while immediately after the (newly added)
-test, there was a memcpy() using "resolvedlen" and the compiler did not
-choke on that before.
-
-Either way, initializing "resolvedlen" to 0 is a small price to pay to
-silence the compiler warning and keep us on the safe side.
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2237>
----
- dix/dixfonts.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/dix/dixfonts.c b/dix/dixfonts.c
-index 3c6c9d594..cf2b45d4f 100644
---- a/dix/dixfonts.c
-+++ b/dix/dixfonts.c
-@@ -556,7 +556,7 @@ doListFontsAndAliases(ClientPtr client, LFclosurePtr c)
-     int err = Successful;
-     FontNamesPtr names = NULL;
-     char *name, *resolved = NULL;
--    int namelen, resolvedlen;
-+    int namelen, resolvedlen = 0;
-     int nnames;
-     int stringLens;
-     int i;
--- 
-2.54.0
-

SOURCES/0001-dix-allocate-enough-space-for-logical-button-maps.patch

@@ -1,51 +0,0 @@
-From 9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Thu, 14 Dec 2023 11:29:49 +1000
-Subject: [PATCH 1/9] dix: allocate enough space for logical button maps
-
-Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for
-each logical button currently down. Since buttons can be arbitrarily mapped
-to anything up to 255 make sure we have enough bits for the maximum mapping.
-
-CVE-2023-6816, ZDI-CAN-22664, ZDI-CAN-22665
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
----
- Xi/xiquerypointer.c | 3 +--
- dix/enterleave.c    | 5 +++--
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c
-index 5b77b1a44..2b05ac5f3 100644
---- a/Xi/xiquerypointer.c
-+++ b/Xi/xiquerypointer.c
-@@ -149,8 +149,7 @@ ProcXIQueryPointer(ClientPtr client)
-     if (pDev->button) {
-         int i;
- 
--        rep.buttons_len =
--            bytes_to_int32(bits_to_bytes(pDev->button->numButtons));
-+        rep.buttons_len = bytes_to_int32(bits_to_bytes(256)); /* button map up to 255 */
-         rep.length += rep.buttons_len;
-         buttons = calloc(rep.buttons_len, 4);
-         if (!buttons)
-diff --git a/dix/enterleave.c b/dix/enterleave.c
-index 867ec7436..ded8679d7 100644
---- a/dix/enterleave.c
-+++ b/dix/enterleave.c
-@@ -784,8 +784,9 @@ DeviceFocusEvent(DeviceIntPtr dev, int type, int mode, int detail,
- 
-     mouse = IsFloating(dev) ? dev : GetMaster(dev, MASTER_POINTER);
- 
--    /* XI 2 event */
--    btlen = (mouse->button) ? bits_to_bytes(mouse->button->numButtons) : 0;
-+    /* XI 2 event contains the logical button map - maps are CARD8
-+     * so we need 256 bits for the possibly maximum mapping */
-+    btlen = (mouse->button) ? bits_to_bytes(256) : 0;
-     btlen = bytes_to_int32(btlen);
-     len = sizeof(xXIFocusInEvent) + btlen * 4;
- 
--- 
-2.43.0
-

SOURCES/0001-dix-fix-valuator-copy-paste-error-in-the-DeviceState.patch

@@ -1,33 +0,0 @@
-From 133e0d651c5d12bf01999d6289e84e224ba77adc Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Mon, 22 Jan 2024 14:22:12 +1000
-Subject: [PATCH] dix: fix valuator copy/paste error in the DeviceStateNotify
- event
-
-Fixes 219c54b8a3337456ce5270ded6a67bcde53553d5
----
- dix/enterleave.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/dix/enterleave.c b/dix/enterleave.c
-index 7b7ba1098..c1e6ac600 100644
---- a/dix/enterleave.c
-+++ b/dix/enterleave.c
-@@ -619,11 +619,11 @@ FixDeviceValuator(DeviceIntPtr dev, deviceValuator * ev, ValuatorClassPtr v,
-     ev->first_valuator = first;
-     switch (ev->num_valuators) {
-     case 6:
--        ev->valuator2 = v->axisVal[first + 5];
-+        ev->valuator5 = v->axisVal[first + 5];
-     case 5:
--        ev->valuator2 = v->axisVal[first + 4];
-+        ev->valuator4 = v->axisVal[first + 4];
-     case 4:
--        ev->valuator2 = v->axisVal[first + 3];
-+        ev->valuator3 = v->axisVal[first + 3];
-     case 3:
-         ev->valuator2 = v->axisVal[first + 2];
-     case 2:
--- 
-2.44.0
-

SOURCES/0001-ephyr-Fix-incompatible-pointer-type-build-error.patch

@@ -1,54 +0,0 @@
-From e89edec497bac581ca9b614fb00c25365580f045 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= <jexposit@redhat.com>
-Date: Fri, 19 Jan 2024 13:05:51 +0100
-Subject: [PATCH] ephyr: Fix incompatible pointer type build error
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Fix a compilation error on 32 bits architectures with gcc 14:
-
-  ephyr_glamor_xv.c: In function ‘ephyr_glamor_xv_init’:
-  ephyr_glamor_xv.c:154:31: error: assignment to ‘SetPortAttributeFuncPtr’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int,  int,  void *)’} from incompatible pointer type ‘int (*)(KdScreenInfo *, Atom,  INT32,  void *)’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int,  long int,  void *)’} [-Wincompatible-pointer-types]
-    154 |     adaptor->SetPortAttribute = ephyr_glamor_xv_set_port_attribute;
-        |                               ^
-  ephyr_glamor_xv.c:155:31: error: assignment to ‘GetPortAttributeFuncPtr’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int,  int *, void *)’} from incompatible pointer type ‘int (*)(KdScreenInfo *, Atom,  INT32 *, void *)’ {aka ‘int (*)(struct _KdScreenInfo *, long unsigned int,  long int *, void *)’} [-Wincompatible-pointer-types]
-    155 |     adaptor->GetPortAttribute = ephyr_glamor_xv_get_port_attribute;
-        |                               ^
-
-Build error logs:
-https://koji.fedoraproject.org/koji/taskinfo?taskID=111964273
-
-Signed-off-by: José Expósito <jexposit@redhat.com>
----
- hw/kdrive/ephyr/ephyr_glamor_xv.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/hw/kdrive/ephyr/ephyr_glamor_xv.c b/hw/kdrive/ephyr/ephyr_glamor_xv.c
-index 4dd15cf41..b5eae48c8 100644
---- a/hw/kdrive/ephyr/ephyr_glamor_xv.c
-+++ b/hw/kdrive/ephyr/ephyr_glamor_xv.c
-@@ -50,16 +50,16 @@ ephyr_glamor_xv_stop_video(KdScreenInfo *screen, void *data, Bool cleanup)
- 
- static int
- ephyr_glamor_xv_set_port_attribute(KdScreenInfo *screen,
--                                   Atom attribute, INT32 value, void *data)
-+                                   Atom attribute, int value, void *data)
- {
--    return glamor_xv_set_port_attribute(data, attribute, value);
-+    return glamor_xv_set_port_attribute(data, attribute, (INT32)value);
- }
- 
- static int
- ephyr_glamor_xv_get_port_attribute(KdScreenInfo *screen,
--                                   Atom attribute, INT32 *value, void *data)
-+                                   Atom attribute, int *value, void *data)
- {
--    return glamor_xv_get_port_attribute(data, attribute, value);
-+    return glamor_xv_get_port_attribute(data, attribute, (INT32 *)value);
- }
- 
- static void
--- 
-2.43.0
-

SOURCES/0001-hw-Rename-boolean-config-value-field-from-bool-to-bo.patch

@@ -1,153 +0,0 @@
-From 454b3a826edb5fc6d0fea3a9cfd1a5e8fc568747 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Mon, 22 Jul 2019 13:51:06 -0400
-Subject: [PATCH] hw: Rename boolean config value field from bool to boolean
-
-"bool" conflicts with C++ (meh) and stdbool.h (ngh alright fine). This
-is a driver-visible change and will likely break the build for mach64,
-but it can be fixed by simply using xf86ReturnOptValBool like every
-other driver.
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
----
- hw/xfree86/common/xf86Opt.h    |  2 +-
- hw/xfree86/common/xf86Option.c | 10 +++++-----
- hw/xwin/winconfig.c            | 22 +++++++++++-----------
- hw/xwin/winconfig.h            |  2 +-
- 4 files changed, 18 insertions(+), 18 deletions(-)
-
-diff --git a/hw/xfree86/common/xf86Opt.h b/hw/xfree86/common/xf86Opt.h
-index 3be2a0fc7..3046fbd41 100644
---- a/hw/xfree86/common/xf86Opt.h
-+++ b/hw/xfree86/common/xf86Opt.h
-@@ -41,7 +41,7 @@ typedef union {
-     unsigned long num;
-     const char *str;
-     double realnum;
--    Bool bool;
-+    Bool boolean;
-     OptFrequency freq;
- } ValueUnion;
- 
-diff --git a/hw/xfree86/common/xf86Option.c b/hw/xfree86/common/xf86Option.c
-index 06973bca3..ca538cc57 100644
---- a/hw/xfree86/common/xf86Option.c
-+++ b/hw/xfree86/common/xf86Option.c
-@@ -213,7 +213,7 @@ LookupBoolOption(XF86OptionPtr optlist, const char *name, int deflt,
-     o.name = name;
-     o.type = OPTV_BOOLEAN;
-     if (ParseOptionValue(-1, optlist, &o, markUsed))
--        deflt = o.value.bool;
-+        deflt = o.value.boolean;
-     return deflt;
- }
- 
-@@ -474,7 +474,7 @@ xf86ShowUnusedOptions(int scrnIndex, XF86OptionPtr opt)
- static Bool
- GetBoolValue(OptionInfoPtr p, const char *s)
- {
--    return xf86getBoolValue(&p->value.bool, s);
-+    return xf86getBoolValue(&p->value.boolean, s);
- }
- 
- static Bool
-@@ -678,7 +678,7 @@ ParseOptionValue(int scrnIndex, XF86OptionPtr options, OptionInfoPtr p,
-             if (markUsed)
-                 xf86MarkOptionUsedByName(options, newn);
-             if (GetBoolValue(&opt, s)) {
--                p->value.bool = !opt.value.bool;
-+                p->value.boolean = !opt.value.boolean;
-                 p->found = TRUE;
-             }
-             else {
-@@ -869,7 +869,7 @@ xf86GetOptValBool(const OptionInfoRec * table, int token, Bool *value)
- 
-     p = xf86TokenToOptinfo(table, token);
-     if (p && p->found) {
--        *value = p->value.bool;
-+        *value = p->value.boolean;
-         return TRUE;
-     }
-     else
-@@ -883,7 +883,7 @@ xf86ReturnOptValBool(const OptionInfoRec * table, int token, Bool def)
- 
-     p = xf86TokenToOptinfo(table, token);
-     if (p && p->found) {
--        return p->value.bool;
-+        return p->value.boolean;
-     }
-     else
-         return def;
-diff --git a/hw/xwin/winconfig.c b/hw/xwin/winconfig.c
-index 31894d2fb..646d69006 100644
---- a/hw/xwin/winconfig.c
-+++ b/hw/xwin/winconfig.c
-@@ -623,7 +623,7 @@ winSetBoolOption(void *optlist, const char *name, int deflt)
-     o.name = name;
-     o.type = OPTV_BOOLEAN;
-     if (ParseOptionValue(-1, optlist, &o))
--        deflt = o.value.bool;
-+        deflt = o.value.boolean;
-     return deflt;
- }
- 
-@@ -918,7 +918,7 @@ ParseOptionValue(int scrnIndex, void *options, OptionInfoPtr p)
-         }
-         if ((s = winFindOptionValue(options, newn)) != NULL) {
-             if (GetBoolValue(&opt, s)) {
--                p->value.bool = !opt.value.bool;
-+                p->value.boolean = !opt.value.boolean;
-                 p->found = TRUE;
-             }
-             else {
-@@ -968,25 +968,25 @@ static Bool
- GetBoolValue(OptionInfoPtr p, const char *s)
- {
-     if (*s == 0) {
--        p->value.bool = TRUE;
-+        p->value.boolean = TRUE;
-     }
-     else {
-         if (winNameCompare(s, "1") == 0)
--            p->value.bool = TRUE;
-+            p->value.boolean = TRUE;
-         else if (winNameCompare(s, "on") == 0)
--            p->value.bool = TRUE;
-+            p->value.boolean = TRUE;
-         else if (winNameCompare(s, "true") == 0)
--            p->value.bool = TRUE;
-+            p->value.boolean = TRUE;
-         else if (winNameCompare(s, "yes") == 0)
--            p->value.bool = TRUE;
-+            p->value.boolean = TRUE;
-         else if (winNameCompare(s, "0") == 0)
--            p->value.bool = FALSE;
-+            p->value.boolean = FALSE;
-         else if (winNameCompare(s, "off") == 0)
--            p->value.bool = FALSE;
-+            p->value.boolean = FALSE;
-         else if (winNameCompare(s, "false") == 0)
--            p->value.bool = FALSE;
-+            p->value.boolean = FALSE;
-         else if (winNameCompare(s, "no") == 0)
--            p->value.bool = FALSE;
-+            p->value.boolean = FALSE;
-     }
-     return TRUE;
- }
-diff --git a/hw/xwin/winconfig.h b/hw/xwin/winconfig.h
-index f079368c7..bd1f59650 100644
---- a/hw/xwin/winconfig.h
-+++ b/hw/xwin/winconfig.h
-@@ -199,7 +199,7 @@ typedef union {
-     unsigned long num;
-     char *str;
-     double realnum;
--    Bool bool;
-+    Bool boolean;
-     OptFrequency freq;
- } ValueUnion;
- 
--- 
-2.43.0
-

SOURCES/0001-link-with-z-now.patch

@@ -1,214 +0,0 @@
-From e84d6f25015d36202fd524b8b8d85d2324348ddb Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Mon, 19 Nov 2018 11:27:09 -0500
-Subject: [PATCH] link with -z now
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
----
- hw/dmx/Makefile.am               | 2 +-
- hw/kdrive/ephyr/Makefile.am      | 2 +-
- hw/vfb/Makefile.am               | 2 +-
- hw/xfree86/Makefile.am           | 3 ++-
- hw/xfree86/dixmods/Makefile.am   | 6 +++---
- hw/xfree86/exa/Makefile.am       | 2 +-
- hw/xfree86/fbdevhw/Makefile.am   | 2 +-
- hw/xfree86/int10/Makefile.am     | 2 +-
- hw/xfree86/shadowfb/Makefile.am  | 2 +-
- hw/xfree86/utils/cvt/Makefile.am | 1 +
- hw/xfree86/utils/gtf/Makefile.am | 1 +
- hw/xfree86/vgahw/Makefile.am     | 2 +-
- hw/xnest/Makefile.am             | 2 +-
- hw/xwayland/Makefile.am          | 2 +-
- 14 files changed, 17 insertions(+), 14 deletions(-)
-
-diff --git a/hw/dmx/Makefile.am b/hw/dmx/Makefile.am
-index eef84cb..9ab20cc 100644
---- a/hw/dmx/Makefile.am
-+++ b/hw/dmx/Makefile.am
-@@ -78,7 +78,7 @@ XDMX_LIBS = \
-         input/libdmxinput.a \
-         config/libdmxconfig.a
- 
--Xdmx_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
-+Xdmx_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -Wl,-z,now -pie
- Xdmx_DEPENDENCIES= $(XDMX_LIBS)
- Xdmx_LDADD = $(XDMX_LIBS) $(XDMX_SYS_LIBS) $(XSERVER_SYS_LIBS)
- 
-diff --git a/hw/kdrive/ephyr/Makefile.am b/hw/kdrive/ephyr/Makefile.am
-index d12559b..cc37add 100644
---- a/hw/kdrive/ephyr/Makefile.am
-+++ b/hw/kdrive/ephyr/Makefile.am
-@@ -78,7 +78,7 @@ Xephyr_LDADD = 						\
- 
- Xephyr_DEPENDENCIES = @KDRIVE_LOCAL_LIBS@ $(XEPHYR_GLAMOR_LIB)
- 
--Xephyr_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
-+Xephyr_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -W,-z,now -pie
- 
- relink:
- 	$(AM_V_at)rm -f $(bin_PROGRAMS) && $(MAKE) $(bin_PROGRAMS)
-diff --git a/hw/vfb/Makefile.am b/hw/vfb/Makefile.am
-index 7033397..c09a9c9 100644
---- a/hw/vfb/Makefile.am
-+++ b/hw/vfb/Makefile.am
-@@ -20,7 +20,7 @@ XVFB_LIBS = \
- 
- Xvfb_LDADD = $(XVFB_LIBS) $(XVFB_SYS_LIBS) $(XSERVER_SYS_LIBS)
- Xvfb_DEPENDENCIES = $(XVFB_LIBS)
--Xvfb_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
-+Xvfb_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -Wl,-z,now -pie
- 
- relink:
- 	$(AM_V_at)rm -f Xvfb$(EXEEXT) && $(MAKE) Xvfb$(EXEEXT)
-diff --git a/hw/xfree86/Makefile.am b/hw/xfree86/Makefile.am
-index 32f98b5..5955148 100644
---- a/hw/xfree86/Makefile.am
-+++ b/hw/xfree86/Makefile.am
-@@ -78,12 +78,13 @@ Xorg_LDADD = \
-             $(XSERVER_SYS_LIBS)
- Xorg_DEPENDENCIES = $(LOCAL_LIBS)
- 
--Xorg_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
-+Xorg_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -Wl,-z,now -pie
- 
- if SUID_WRAPPER
- wrapexecdir = $(SUID_WRAPPER_DIR)
- wrapexec_PROGRAMS = Xorg.wrap
- Xorg_wrap_SOURCES = xorg-wrapper.c
-+Xorg_wrap_LDFLAGS = -Wl,-z,now -pie
- endif
- 
- BUILT_SOURCES = xorg.conf.example
-diff --git a/hw/xfree86/dixmods/Makefile.am b/hw/xfree86/dixmods/Makefile.am
-index 856659f..6ab101b 100644
---- a/hw/xfree86/dixmods/Makefile.am
-+++ b/hw/xfree86/dixmods/Makefile.am
-@@ -17,17 +17,17 @@ AM_CPPFLAGS = @XORG_INCS@ \
-            -I$(top_srcdir)/miext/shadow \
-            -I$(top_srcdir)/glx
- 
--libfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
-+libfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG) -Wl,-z,now
- libfb_la_LIBADD = $(top_builddir)/fb/libfb.la
- libfb_la_SOURCES = fbmodule.c
- libfb_la_CFLAGS = $(AM_CFLAGS)
- 
--libwfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
-+libwfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG) -Wl,-z,now
- libwfb_la_LIBADD = $(top_builddir)/fb/libwfb.la
- libwfb_la_SOURCES = fbmodule.c
- libwfb_la_CFLAGS = $(AM_CFLAGS) -DFB_ACCESS_WRAPPER
- 
--libglx_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
-+libglx_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG) -Wl,-z,now
- libglx_la_LIBADD = $(top_builddir)/glx/libglx.la $(GLX_SYS_LIBS)
- if DRI2
- libglx_la_LIBADD += $(top_builddir)/glx/libglxdri.la
-diff --git a/hw/xfree86/exa/Makefile.am b/hw/xfree86/exa/Makefile.am
-index ccbb305..7bf7137 100644
---- a/hw/xfree86/exa/Makefile.am
-+++ b/hw/xfree86/exa/Makefile.am
-@@ -2,7 +2,7 @@ SUBDIRS = man
- 
- module_LTLIBRARIES = libexa.la
- 
--libexa_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
-+libexa_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG) -Wl,-z,now
- 
- AM_CPPFLAGS = \
- 	$(XORG_INCS) \
-diff --git a/hw/xfree86/fbdevhw/Makefile.am b/hw/xfree86/fbdevhw/Makefile.am
-index 37cd88c..895cfab 100644
---- a/hw/xfree86/fbdevhw/Makefile.am
-+++ b/hw/xfree86/fbdevhw/Makefile.am
-@@ -2,7 +2,7 @@ SUBDIRS = man
- 
- module_LTLIBRARIES = libfbdevhw.la
- 
--libfbdevhw_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
-+libfbdevhw_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG) -Wl,-z,now
- 
- if FBDEVHW
- libfbdevhw_la_SOURCES = fbdevhw.c
-diff --git a/hw/xfree86/int10/Makefile.am b/hw/xfree86/int10/Makefile.am
-index 66cb14d..aad47a1 100644
---- a/hw/xfree86/int10/Makefile.am
-+++ b/hw/xfree86/int10/Makefile.am
-@@ -4,7 +4,7 @@ sdk_HEADERS = xf86int10.h
- 
- EXTRA_CFLAGS =
- 
--libint10_la_LDFLAGS = -avoid-version
-+libint10_la_LDFLAGS = -avoid-version -Wl,-z,now
- libint10_la_LIBADD = $(PCIACCESS_LIBS)
- 
- COMMON_SOURCES = \
-diff --git a/hw/xfree86/shadowfb/Makefile.am b/hw/xfree86/shadowfb/Makefile.am
-index 67fb2e4..a8c2d59 100644
---- a/hw/xfree86/shadowfb/Makefile.am
-+++ b/hw/xfree86/shadowfb/Makefile.am
-@@ -1,5 +1,5 @@
- module_LTLIBRARIES = libshadowfb.la
--libshadowfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG)
-+libshadowfb_la_LDFLAGS = -module -avoid-version $(LD_NO_UNDEFINED_FLAG) -Wl,-z,now
- libshadowfb_la_SOURCES = sfbmodule.c shadowfb.c
- libshadowfb_la_LIBADD = $(PIXMAN_LIBS)
- 
-diff --git a/hw/xfree86/utils/cvt/Makefile.am b/hw/xfree86/utils/cvt/Makefile.am
-index 26abeb4..19b0eba 100644
---- a/hw/xfree86/utils/cvt/Makefile.am
-+++ b/hw/xfree86/utils/cvt/Makefile.am
-@@ -33,3 +33,4 @@ cvt_SOURCES = cvt.c \
- 	$(top_srcdir)/os/xprintf.c
- 
- cvt_CFLAGS = $(DIX_CFLAGS) $(XORG_CFLAGS)
-+cvt_LDFLAGS = -Wl,-z,now -pie
-diff --git a/hw/xfree86/utils/gtf/Makefile.am b/hw/xfree86/utils/gtf/Makefile.am
-index f77bf60..f520fb9 100644
---- a/hw/xfree86/utils/gtf/Makefile.am
-+++ b/hw/xfree86/utils/gtf/Makefile.am
-@@ -25,3 +25,4 @@ bin_PROGRAMS = gtf
- gtf_SOURCES = gtf.c
- gtf_CFLAGS = $(XORG_CFLAGS)
- gtf_LDADD = -lm
-+gtf_LDFLAGS = -Wl,-z,now -pie
-diff --git a/hw/xfree86/vgahw/Makefile.am b/hw/xfree86/vgahw/Makefile.am
-index b8196a6..37ac499 100644
---- a/hw/xfree86/vgahw/Makefile.am
-+++ b/hw/xfree86/vgahw/Makefile.am
-@@ -1,5 +1,5 @@
- module_LTLIBRARIES = libvgahw.la
--libvgahw_la_LDFLAGS = -avoid-version
-+libvgahw_la_LDFLAGS = -avoid-version -Wl,-z,now
- libvgahw_la_LIBADD = $(PCIACCESS_LIBS)
- libvgahw_la_SOURCES = vgaHW.c vgaHWmodule.c
- AM_CPPFLAGS = $(XORG_INCS) -I$(srcdir)/../ddc -I$(srcdir)/../i2c
-diff --git a/hw/xnest/Makefile.am b/hw/xnest/Makefile.am
-index c77da64..185803c 100644
---- a/hw/xnest/Makefile.am
-+++ b/hw/xnest/Makefile.am
-@@ -51,7 +51,7 @@ Xnest_SOURCES = $(SRCS)
- 
- Xnest_DEPENDENCIES = $(XNEST_LIBS)
- Xnest_LDADD = $(XNEST_LIBS) $(XNEST_SYS_LIBS) $(XSERVER_SYS_LIBS)
--Xnest_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
-+Xnest_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -Wl,-z,now -pie
- 
- EXTRA_DIST = icon \
-              screensaver
-diff --git a/hw/xwayland/Makefile.am b/hw/xwayland/Makefile.am
-index bc1cb85..2f70cd1 100644
---- a/hw/xwayland/Makefile.am
-+++ b/hw/xwayland/Makefile.am
-@@ -28,7 +28,7 @@ Xwayland_LDADD =				\
- 	$(XWAYLAND_SYS_LIBS)			\
- 	$(top_builddir)/Xext/libXvidmode.la	\
- 	$(XSERVER_SYS_LIBS)
--Xwayland_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
-+Xwayland_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG) -Wl,-z,now -pie
- 
- Xwayland_built_sources =
- 
--- 
-2.19.1
-

SOURCES/0001-linux-Fix-platform-device-PCI-detection-for-complex-.patch

@@ -1,45 +0,0 @@
-From b6e18eb57f3dd104704d0a5ec3d2f051645b9068 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Wed, 19 Jun 2019 14:23:56 -0400
-Subject: [PATCH xserver] linux: Fix platform device PCI detection for complex
- bus topologies
-
-Suppose you're in a Hyper-V guest and are trying to use PCI passthrough.
-The ID_PATH that udev will construct for that looks something like
-"acpi-VMBUS:00-pci-b8c8:00:00.0", and obviously looking for "pci-" in
-the first four characters of that is going to not work.
-
-Instead, strstr. I suppose it's possible you could have _multiple_ PCI
-buses in the path, in which case you'd want strrstr, if that were a
-thing.
----
- config/udev.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/config/udev.c b/config/udev.c
-index 314acba6ce..6e11aa3b88 100644
---- a/config/udev.c
-+++ b/config/udev.c
-@@ -474,7 +474,7 @@ config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path
-                                config_odev_probe_proc_ptr probe_callback)
- {
-     struct OdevAttributes *attribs = config_odev_allocate_attributes();
--    const char *value;
-+    const char *value, *str;
- 
-     attribs->path = XNFstrdup(path);
-     attribs->syspath = XNFstrdup(syspath);
-@@ -482,8 +482,8 @@ config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path
-     attribs->minor = minor;
- 
-     value = udev_device_get_property_value(udev_device, "ID_PATH");
--    if (value && !strncmp(value, "pci-", 4)) {
--        attribs->busid = XNFstrdup(value);
-+    if (value && (str = strstr(value, "pci-"))) {
-+        attribs->busid = XNFstrdup(str);
-         attribs->busid[3] = ':';
-     }
- 
--- 
-2.21.0
-

SOURCES/0001-linux-Make-platform-device-probe-less-fragile.patch

@@ -1,129 +0,0 @@
-From 28320833d61af76dc3b77b985c69706f3e021836 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Tue, 18 Sep 2018 14:37:51 -0400
-Subject: [PATCH xserver] linux: Make platform device probe less fragile
-
-At the point where xf86BusProbe runs we haven't yet taken our own VT,
-which means we can't perform drm "master" operations on the device. This
-is tragic, because we need master to fish the bus id string out of the
-kernel, which we can only do after drmSetInterfaceVersion, which for
-some reason stores that string on the device not the file handle and
-thus needs master access.
-
-Fortunately we know the format of the busid string, and it happens to
-almost be the same as the ID_PATH variable from udev. Use that instead
-and stop calling drmSetInterfaceVersion.
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
----
- config/udev.c                              | 17 ++++++++++++-----
- hw/xfree86/os-support/linux/lnx_platform.c | 13 ++-----------
- 2 files changed, 14 insertions(+), 16 deletions(-)
-
-diff --git a/config/udev.c b/config/udev.c
-index 3a73189e25..8c6c4b6665 100644
---- a/config/udev.c
-+++ b/config/udev.c
-@@ -56,7 +56,7 @@ static struct udev_monitor *udev_monitor;
- 
- #ifdef CONFIG_UDEV_KMS
- static void
--config_udev_odev_setup_attribs(const char *path, const char *syspath,
-+config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path, const char *syspath,
-                                int major, int minor,
-                                config_odev_probe_proc_ptr probe_callback);
- #endif
-@@ -128,7 +128,7 @@ device_added(struct udev_device *udev_device)
- 
-         LogMessage(X_INFO, "config/udev: Adding drm device (%s)\n", path);
- 
--        config_udev_odev_setup_attribs(path, syspath, major(devnum),
-+        config_udev_odev_setup_attribs(udev_device, path, syspath, major(devnum),
-                                        minor(devnum), NewGPUDeviceRequest);
-         return;
-     }
-@@ -322,7 +322,7 @@ device_removed(struct udev_device *device)
- 
-         LogMessage(X_INFO, "config/udev: removing GPU device %s %s\n",
-                    syspath, path);
--        config_udev_odev_setup_attribs(path, syspath, major(devnum),
-+        config_udev_odev_setup_attribs(device, path, syspath, major(devnum),
-                                        minor(devnum), DeleteGPUDeviceRequest);
-         /* Retry vtenter after a drm node removal */
-         systemd_logind_vtenter();
-@@ -465,17 +465,24 @@ config_udev_fini(void)
- #ifdef CONFIG_UDEV_KMS
- 
- static void
--config_udev_odev_setup_attribs(const char *path, const char *syspath,
-+config_udev_odev_setup_attribs(struct udev_device *udev_device, const char *path, const char *syspath,
-                                int major, int minor,
-                                config_odev_probe_proc_ptr probe_callback)
- {
-     struct OdevAttributes *attribs = config_odev_allocate_attributes();
-+    const char *value;
- 
-     attribs->path = XNFstrdup(path);
-     attribs->syspath = XNFstrdup(syspath);
-     attribs->major = major;
-     attribs->minor = minor;
- 
-+    value = udev_device_get_property_value(udev_device, "ID_PATH");
-+    if (value && !strncmp(value, "pci-", 4)) {
-+        attribs->busid = XNFstrdup(value);
-+        attribs->busid[3] = ':';
-+    }
-+
-     /* ownership of attribs is passed to probe layer */
-     probe_callback(attribs);
- }
-@@ -516,7 +523,7 @@ config_udev_odev_probe(config_odev_probe_proc_ptr probe_callback)
-         else if (!check_seat(udev_device))
-             goto no_probe;
- 
--        config_udev_odev_setup_attribs(path, syspath, major(devnum),
-+        config_udev_odev_setup_attribs(udev_device, path, syspath, major(devnum),
-                                        minor(devnum), probe_callback);
-     no_probe:
-         udev_device_unref(udev_device);
-diff --git a/hw/xfree86/os-support/linux/lnx_platform.c b/hw/xfree86/os-support/linux/lnx_platform.c
-index 70374ace88..0eb6d22875 100644
---- a/hw/xfree86/os-support/linux/lnx_platform.c
-+++ b/hw/xfree86/os-support/linux/lnx_platform.c
-@@ -30,6 +30,8 @@ get_drm_info(struct OdevAttributes *attribs, char *path, int delayed_index)
-     int err = 0;
-     Bool paused, server_fd = FALSE;
- 
-+    LogMessage(X_INFO, "Platform probe for %s\n", attribs->syspath);
-+
-     fd = systemd_logind_take_fd(attribs->major, attribs->minor, path, &paused);
-     if (fd != -1) {
-         if (paused) {
-@@ -53,13 +55,6 @@ get_drm_info(struct OdevAttributes *attribs, char *path, int delayed_index)
-     sv.drm_dd_major = -1;       /* Don't care */
-     sv.drm_dd_minor = -1;       /* Don't care */
- 
--    err = drmSetInterfaceVersion(fd, &sv);
--    if (err) {
--        xf86Msg(X_ERROR, "%s: failed to set DRM interface version 1.4: %s\n",
--                path, strerror(-err));
--        goto out;
--    }
--
-     /* for a delayed probe we've already added the device */
-     if (delayed_index == -1) {
-             xf86_add_platform_device(attribs, FALSE);
-@@ -69,10 +64,6 @@ get_drm_info(struct OdevAttributes *attribs, char *path, int delayed_index)
-     if (server_fd)
-         xf86_platform_devices[delayed_index].flags |= XF86_PDEV_SERVER_FD;
- 
--    buf = drmGetBusid(fd);
--    xf86_platform_odev_attributes(delayed_index)->busid = XNFstrdup(buf);
--    drmFreeBusid(buf);
--
-     v = drmGetVersion(fd);
-     if (!v) {
-         xf86Msg(X_ERROR, "%s: failed to query DRM version\n", path);
--- 
-2.19.0
-

SOURCES/0001-modesetting-Reduce-glamor-initialization-failed-mess.patch

@@ -1,37 +0,0 @@
-From 41e265988a0b6ec456ddd562253e0f82a7c2ede2 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Fri, 27 Sep 2019 11:43:52 -0400
-Subject: [PATCH xserver] modesetting: Reduce "glamor initialization failed"
- message to X_INFO
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This might be an error or not, for example refusing to work on llvmpipe
-is normal and expected. glamor_egl_init() will print X_ERROR messages if
-appropriate, so we don't need to here.
-
-Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
-
-(cherry picked from commit cbdde938cbaf604741cd057fac743859ada342ec)
-Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
----
- hw/xfree86/drivers/modesetting/driver.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
-index 2aaea5f7d..783d53eaa 100644
---- a/hw/xfree86/drivers/modesetting/driver.c
-+++ b/hw/xfree86/drivers/modesetting/driver.c
-@@ -772,7 +772,7 @@ try_enable_glamor(ScrnInfoPtr pScrn)
-             xf86DrvMsg(pScrn->scrnIndex, X_INFO, "glamor initialized\n");
-             ms->drmmode.glamor = TRUE;
-         } else {
--            xf86DrvMsg(pScrn->scrnIndex, X_ERROR,
-+            xf86DrvMsg(pScrn->scrnIndex, X_INFO,
-                        "glamor initialization failed\n");
-         }
-     } else {
--- 
-2.26.2
-

SOURCES/0001-mustard-Add-DRI2-fallback-driver-mappings-for-i965-a.patch

@@ -1,28 +0,0 @@
-From efb4bc5b3da511d128144840d7eb3cf3c7cfa0ae Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Tue, 3 Sep 2019 12:10:37 -0400
-Subject: [PATCH] mustard: Add DRI2 fallback driver mappings for i965 and
- radeonsi
-
----
- hw/xfree86/dri2/pci_ids/pci_id_driver_map.h | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-index 689a570..3825f52 100644
---- a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-+++ b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-@@ -45,8 +45,10 @@ static const struct {
-    int num_chips_ids;
- } driver_map[] = {
-    { 0x8086, "i965", "va_gl", i965_chip_ids, ARRAY_SIZE(i965_chip_ids) },
-+   { 0x8086, "i965", "va_gl", NULL, -1 },
-    { 0x1002, "r600","r600",  r600_chip_ids, ARRAY_SIZE(r600_chip_ids) },
-    { 0x1002, "radeonsi", "radeonsi", radeonsi_chip_ids, ARRAY_SIZE(radeonsi_chip_ids) },
-+   { 0x1002, "radeonsi", "radeonsi", NULL, -1 },
-    { 0x10de, "nouveau", "nouveau", NULL, -1 },
-    { 0x1af4, "virtio_gpu", "virtio_gpu", virtio_gpu_chip_ids, ARRAY_SIZE(virtio_gpu_chip_ids) },
-    { 0x15ad, "vmwgfx", "vmwgfx", vmwgfx_chip_ids, ARRAY_SIZE(vmwgfx_chip_ids) },
--- 
-2.23.0
-

SOURCES/0001-mustard-Don-t-probe-for-drivers-not-shipped-in-RHEL8.patch

@@ -1,278 +0,0 @@
-From b6e50ece375b6b1fbe053b30b52fc40dde5c682b Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Tue, 13 Nov 2018 10:11:36 -0500
-Subject: [PATCH] mustard: Don't probe for drivers not shipped in RHEL8
-
-As with RHEL7, this is mostly to keep spurious probe messages out of the
-X log and prevent questions like "why isn't it loading mga on my
-G200SE" or "why isn't it loading radeon_dri.so on my RN50".
----
- hw/xfree86/common/xf86pciBus.c              | 162 --------------------
- hw/xfree86/dri2/pci_ids/pci_id_driver_map.h |  32 ----
- 2 files changed, 194 deletions(-)
-
-diff --git a/hw/xfree86/common/xf86pciBus.c b/hw/xfree86/common/xf86pciBus.c
-index b7f9999..398ed45 100644
---- a/hw/xfree86/common/xf86pciBus.c
-+++ b/hw/xfree86/common/xf86pciBus.c
-@@ -1074,107 +1074,12 @@ xf86VideoPtrToDriverList(struct pci_device *dev, XF86MatchedDrivers *md)
-     const char *driverList[5] = { NULL, NULL, NULL, NULL, NULL };
- 
-     switch (dev->vendor_id) {
--        /* AMD Geode LX */
--    case 0x1022:
--        if (dev->device_id == 0x2081)
--            driverList[0] = "geode";
--        break;
--        /* older Geode products acquired by AMD still carry an NSC vendor_id */
--    case 0x100b:
--        if (dev->device_id == 0x0030) {
--            /* NSC Geode GX2 specifically */
--            driverList[0] = "geode";
--            /* GX2 support started its life in the NSC tree and was later
--               forked by AMD for GEODE so we keep it as a backup */
--            driverList[1] = "nsc";
--        }
--        else
--            /* other NSC variant e.g. 0x0104 (SC1400), 0x0504 (SCx200) */
--            driverList[0] = "nsc";
--        break;
--        /* Cyrix Geode GX1 */
--    case 0x1078:
--        if (dev->device_id == 0x0104)
--            driverList[0] = "cyrix";
--        break;
--    case 0x1142:
--        driverList[0] = "apm";
--        break;
--    case 0xedd8:
--        driverList[0] = "ark";
--        break;
--    case 0x1a03:
--        driverList[0] = "ast";
--        break;
-     case 0x1002:
-         driverList[0] = "ati";
-         break;
--    case 0x102c:
--        driverList[0] = "chips";
--        break;
--    case 0x1013:
--        driverList[0] = "cirrus";
--        break;
--    case 0x3d3d:
--        driverList[0] = "glint";
--        break;
--    case 0x105d:
--        driverList[0] = "i128";
--        break;
-     case 0x8086:
- 	switch (dev->device_id)
- 	{
--		/* Intel i740 */
--		case 0x00d1:
--		case 0x7800:
--			driverList[0] = "i740";
--			break;
--		/* GMA500/Poulsbo */
--		case 0x8108:
--		case 0x8109:
--			/* Try psb driver on Poulsbo - if available */
--			driverList[0] = "psb";
--			driverList[1] = "psb_drv";
--			break;
--		/* GMA600/Oaktrail */
--		case 0x4100:
--		case 0x4101:
--		case 0x4102:
--		case 0x4103:
--		case 0x4104:
--		case 0x4105:
--		case 0x4106:
--		case 0x4107:
--		/* Atom E620/Oaktrail */
--		case 0x4108:
--		/* Medfield */
--		case 0x0130:
--		case 0x0131:
--		case 0x0132:
--		case 0x0133:
--		case 0x0134:
--		case 0x0135:
--		case 0x0136:
--		case 0x0137:
--		/* GMA 3600/CDV */
--		case 0x0be0:
--		case 0x0be1:
--		case 0x0be2:
--		case 0x0be3:
--		case 0x0be4:
--		case 0x0be5:
--		case 0x0be6:
--		case 0x0be7:
--		case 0x0be8:
--		case 0x0be9:
--		case 0x0bea:
--		case 0x0beb:
--		case 0x0bec:
--		case 0x0bed:
--		case 0x0bee:
--		case 0x0bef:
--			/* Use fbdev/vesa driver on Oaktrail, Medfield, CDV */
--			break;
- 		/* Default to intel only on pre-gen4 chips */
- 		case 0x3577:
- 		case 0x2562:
-@@ -1196,14 +1101,7 @@ xf86VideoPtrToDriverList(struct pci_device *dev, XF86MatchedDrivers *md)
- 			break;
-         }
-         break;
--    case 0x102b:
--        driverList[0] = "mga";
--        break;
--    case 0x10c8:
--        driverList[0] = "neomagic";
--        break;
-     case 0x10de:
--    case 0x12d2:
-     {
-         int idx = 0;
- 
-@@ -1229,77 +1127,17 @@ xf86VideoPtrToDriverList(struct pci_device *dev, XF86MatchedDrivers *md)
- 
-         driverList[idx++] = "nouveau";
- #endif
--        driverList[idx++] = "nv";
-         break;
-     }
--    case 0x1106:
--        driverList[0] = "openchrome";
--        break;
-     case 0x1b36:
-         driverList[0] = "qxl";
-         break;
--    case 0x1163:
--        driverList[0] = "rendition";
--        break;
--    case 0x5333:
--        switch (dev->device_id) {
--        case 0x88d0:
--        case 0x88d1:
--        case 0x88f0:
--        case 0x8811:
--        case 0x8812:
--        case 0x8814:
--        case 0x8901:
--            driverList[0] = "s3";
--            break;
--        case 0x5631:
--        case 0x883d:
--        case 0x8a01:
--        case 0x8a10:
--        case 0x8c01:
--        case 0x8c03:
--        case 0x8904:
--        case 0x8a13:
--            driverList[0] = "s3virge";
--            break;
--        default:
--            driverList[0] = "savage";
--            break;
--        }
--        break;
--    case 0x1039:
--        driverList[0] = "sis";
--        break;
--    case 0x126f:
--        driverList[0] = "siliconmotion";
--        break;
--    case 0x121a:
--        if (dev->device_id < 0x0003)
--            driverList[0] = "voodoo";
--        else
--            driverList[0] = "tdfx";
--        break;
--    case 0x1011:
--        driverList[0] = "tga";
--        break;
--    case 0x1023:
--        driverList[0] = "trident";
--        break;
--    case 0x100c:
--        driverList[0] = "tseng";
--        break;
-     case 0x80ee:
-         driverList[0] = "vboxvideo";
-         break;
-     case 0x15ad:
-         driverList[0] = "vmware";
-         break;
--    case 0x18ca:
--        if (dev->device_id == 0x47)
--            driverList[0] = "xgixp";
--        else
--            driverList[0] = "xgi";
--        break;
-     default:
-         break;
-     }
-diff --git a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-index 7036d10..689a570 100644
---- a/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-+++ b/hw/xfree86/dri2/pci_ids/pci_id_driver_map.h
-@@ -7,38 +7,12 @@
- #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
- #endif
- 
--static const int i915_chip_ids[] = {
--#define CHIPSET(chip, desc, name) chip,
--#include "pci_ids/i915_pci_ids.h"
--#undef CHIPSET
--};
--
- static const int i965_chip_ids[] = {
- #define CHIPSET(chip, family, name) chip,
- #include "pci_ids/i965_pci_ids.h"
- #undef CHIPSET
- };
- 
--#ifndef DRIVER_MAP_GALLIUM_ONLY
--static const int r100_chip_ids[] = {
--#define CHIPSET(chip, name, family) chip,
--#include "pci_ids/radeon_pci_ids.h"
--#undef CHIPSET
--};
--
--static const int r200_chip_ids[] = {
--#define CHIPSET(chip, name, family) chip,
--#include "pci_ids/r200_pci_ids.h"
--#undef CHIPSET
--};
--#endif
--
--static const int r300_chip_ids[] = {
--#define CHIPSET(chip, name, family) chip,
--#include "pci_ids/r300_pci_ids.h"
--#undef CHIPSET
--};
--
- static const int r600_chip_ids[] = {
- #define CHIPSET(chip, name, family) chip,
- #include "pci_ids/r600_pci_ids.h"
-@@ -70,13 +44,7 @@ static const struct {
-    const int *chip_ids;
-    int num_chips_ids;
- } driver_map[] = {
--   { 0x8086, "i915", "i915", i915_chip_ids, ARRAY_SIZE(i915_chip_ids) },
-    { 0x8086, "i965", "va_gl", i965_chip_ids, ARRAY_SIZE(i965_chip_ids) },
--#ifndef DRIVER_MAP_GALLIUM_ONLY
--   { 0x1002, "radeon", "radeon", r100_chip_ids, ARRAY_SIZE(r100_chip_ids) },
--   { 0x1002, "r200", "r200", r200_chip_ids, ARRAY_SIZE(r200_chip_ids) },
--#endif
--   { 0x1002, "r300", "r300", r300_chip_ids, ARRAY_SIZE(r300_chip_ids) },
-    { 0x1002, "r600","r600",  r600_chip_ids, ARRAY_SIZE(r600_chip_ids) },
-    { 0x1002, "radeonsi", "radeonsi", radeonsi_chip_ids, ARRAY_SIZE(radeonsi_chip_ids) },
-    { 0x10de, "nouveau", "nouveau", NULL, -1 },
--- 
-2.19.1
-

SOURCES/0001-mustard-Work-around-broken-fbdev-headers.patch

@@ -1,34 +0,0 @@
-From a4fc2f3a55776018eda20e09c11b3710f8f0e542 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Fri, 26 Oct 2018 14:16:17 -0400
-Subject: [PATCH xserver] mustard: Work around broken fbdev headers
-
-This configure check is somewhat pointless as we have our own copy of
-the fbdev ioctl declarations. There's also a bug in the version of the
-kernel headers I happen to want to build against, where an IS_ENABLED()
-escaped into uapi like it oughtn't.
-
-Nerf the test so we build the right fbdevhw code.
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
----
- configure.ac | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 57a2331024..2b8477ed61 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -197,8 +197,7 @@ AC_CHECK_HEADERS([linux/agpgart.h sys/agpio.h sys/agpgart.h], AGP=yes)
- AM_CONDITIONAL(AGP, [test "x$AGP" = xyes])
- 
- dnl fbdev header
--AC_CHECK_HEADERS([linux/fb.h], FBDEV=yes)
--AM_CONDITIONAL(FBDEVHW, [test "x$FBDEV" = xyes])
-+AM_CONDITIONAL(FBDEVHW, true)
- 
- dnl FreeBSD kldload support (sys/linker.h)
- AC_CHECK_HEADERS([sys/linker.h],
--- 
-2.19.1
-

SOURCES/0001-os-avoid-potential-out-of-bounds-access-at-logVHdrMe.patch

@@ -1,40 +0,0 @@
-From 5a3926455d74fe167af612ee11399c0f8cd896b5 Mon Sep 17 00:00:00 2001
-From: Mikhail Dmitrichenko <mdmitrichenko@astralinux.ru>
-Date: Wed, 17 Sep 2025 17:29:49 +0300
-Subject: [PATCH xserver 01/51] os: avoid potential out-of-bounds access at
- logVHdrMessageVerb
-
-The LogVHdrMessageVerb function may access an array out of bounds in a
-specific edge case. Specifically, the line:
-
-newline = (buf[len - 1] == '\n');
-
-can result in accessing buf[-1] if len == 0, which is undefined behavior.
-
-Commit adds check to avoid access out of bounds at pointed line.
-
-Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1841
-Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
-(cherry picked from commit 8d25a8914346824f820490ba7090175dea9428cd)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
----
- os/log.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/os/log.c b/os/log.c
-index cc8219129..71210aee8 100644
---- a/os/log.c
-+++ b/os/log.c
-@@ -827,7 +827,7 @@ LogVHdrMessageVerb(MessageType type, int verb, const char *msg_format,
-     if (size - len == 1)
-         buf[len - 1] = '\n';
- 
--    newline = (buf[len - 1] == '\n');
-+    newline = (len > 0 && buf[len - 1] == '\n');
-     LogSWrite(verb, buf, len, newline);
- }
- 
--- 
-2.54.0
-

SOURCES/0001-present-Check-for-NULL-to-prevent-crash.patch

@@ -1,43 +0,0 @@
-From 94b4a3d45451d29e9539ea234ce8b5e9ed58546c Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?B=C5=82a=C5=BCej=20Szczygie=C5=82?= <spaz16@wp.pl>
-Date: Thu, 13 Jan 2022 00:47:27 +0100
-Subject: [PATCH xserver] present: Check for NULL to prevent crash
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1275
-Signed-off-by: Błażej Szczygieł <spaz16@wp.pl>
-Tested-by: Aaron Plattner <aplattner@nvidia.com>
-(cherry picked from commit 22d5818851967408bb7c903cb345b7ca8766094c)
----
- present/present_scmd.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/present/present_scmd.c b/present/present_scmd.c
-index 3c68e690b..11391adbb 100644
---- a/present/present_scmd.c
-+++ b/present/present_scmd.c
-@@ -168,6 +168,9 @@ present_scmd_get_crtc(present_screen_priv_ptr screen_priv, WindowPtr window)
-     if (!screen_priv->info)
-         return NULL;
- 
-+    if (!screen_priv->info->get_crtc)
-+        return NULL;
-+
-     return (*screen_priv->info->get_crtc)(window);
- }
- 
-@@ -206,6 +209,9 @@ present_flush(WindowPtr window)
-     if (!screen_priv->info)
-         return;
- 
-+    if (!screen_priv->info->flush)
-+        return;
-+
-     (*screen_priv->info->flush) (window);
- }
- 
--- 
-2.34.1
-

SOURCES/0001-present-Fix-use-after-free-in-present_create_notifie.patch

@@ -1,88 +0,0 @@
-From 4d07b16328bc9c9d4f6c4c1a9a522d64bf09deda Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Wed, 2 Jul 2025 09:46:22 +0200
-Subject: [PATCH xserver 1/4] present: Fix use-after-free in
- present_create_notifies()
-
-Using the Present extension, if an error occurs while processing and
-adding the notifications after presenting a pixmap, the function
-present_create_notifies() will clean up and remove the notifications
-it added.
-
-However, there are two different code paths that can lead to an error
-creating the notify, one being before the notify is being added to the
-list, and another one after the notify is added.
-
-When the error occurs before it's been added, it removes the elements up
-to the last added element, instead of the actual number of elements
-which were added.
-
-As a result, in case of error, as with an invalid window for example, it
-leaves a dangling pointer to the last element, leading to a use after
-free case later:
-
- |  Invalid write of size 8
- |     at 0x5361D5: present_clear_window_notifies (present_notify.c:42)
- |     by 0x534A56: present_destroy_window (present_screen.c:107)
- |     by 0x41E441: xwl_destroy_window (xwayland-window.c:1959)
- |     by 0x4F9EC9: compDestroyWindow (compwindow.c:622)
- |     by 0x51EAC4: damageDestroyWindow (damage.c:1592)
- |     by 0x4FDC29: DbeDestroyWindow (dbe.c:1291)
- |     by 0x4EAC55: FreeWindowResources (window.c:1023)
- |     by 0x4EAF59: DeleteWindow (window.c:1091)
- |     by 0x4DE59A: doFreeResource (resource.c:890)
- |     by 0x4DEFB2: FreeClientResources (resource.c:1156)
- |     by 0x4A9AFB: CloseDownClient (dispatch.c:3567)
- |     by 0x5DCC78: ClientReady (connection.c:603)
- |   Address 0x16126200 is 16 bytes inside a block of size 2,048 free'd
- |     at 0x4841E43: free (vg_replace_malloc.c:989)
- |     by 0x5363DD: present_destroy_notifies (present_notify.c:111)
- |     by 0x53638D: present_create_notifies (present_notify.c:100)
- |     by 0x5368E9: proc_present_pixmap_common (present_request.c:164)
- |     by 0x536A7D: proc_present_pixmap (present_request.c:189)
- |     by 0x536FA9: proc_present_dispatch (present_request.c:337)
- |     by 0x4A1E4E: Dispatch (dispatch.c:561)
- |     by 0x4B00F1: dix_main (main.c:284)
- |     by 0x42879D: main (stubmain.c:34)
- |   Block was alloc'd at
- |     at 0x48463F3: calloc (vg_replace_malloc.c:1675)
- |     by 0x5362A1: present_create_notifies (present_notify.c:81)
- |     by 0x5368E9: proc_present_pixmap_common (present_request.c:164)
- |     by 0x536A7D: proc_present_pixmap (present_request.c:189)
- |     by 0x536FA9: proc_present_dispatch (present_request.c:337)
- |     by 0x4A1E4E: Dispatch (dispatch.c:561)
- |     by 0x4B00F1: dix_main (main.c:284)
- |     by 0x42879D: main (stubmain.c:34)
-
-To fix the issue, count and remove the actual number of notify elements
-added in case of error.
-
-CVE-2025-62229, ZDI-CAN-27238
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-(cherry picked from commit 5a4286b13f631b66c20f5bc8db7b68211dcbd1d0)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2088>
----
- present/present_notify.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/present/present_notify.c b/present/present_notify.c
-index 445954998..00b3b68bd 100644
---- a/present/present_notify.c
-+++ b/present/present_notify.c
-@@ -90,7 +90,7 @@ present_create_notifies(ClientPtr client, int num_notifies, xPresentNotify *x_no
-         if (status != Success)
-             goto bail;
- 
--        added = i;
-+        added++;
-     }
-     return Success;
- 
--- 
-2.51.1
-

SOURCES/0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch

@@ -1,105 +0,0 @@
-From b98fc07d3442a289c6bef82df50dd0a2d01de71a Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Thu, 2 Feb 2023 12:26:27 -0500
-Subject: [PATCH xserver] present: Send a PresentConfigureNotify event for
- destroyed windows
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This enables fixing a deadlock case on the client side, where the client
-ends up blocked waiting for a Present event that will never come because
-the window was destroyed. The new PresentWindowDestroyed flag allows the
-client to avoid blocking indefinitely.
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
-See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/116
-See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6685
-Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
-(cherry picked from commit 462b06033e66a32308d940eb5fc47f5e4c914dc0)
----
- present/present_event.c  |  5 +++--
- present/present_priv.h   |  7 ++++++-
- present/present_screen.c | 11 ++++++++++-
- 3 files changed, 19 insertions(+), 4 deletions(-)
-
-diff --git a/present/present_event.c b/present/present_event.c
-index 435b26b70..849732dc8 100644
---- a/present/present_event.c
-+++ b/present/present_event.c
-@@ -102,7 +102,8 @@ present_event_swap(xGenericEvent *from, xGenericEvent *to)
- }
- 
- void
--present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling)
-+present_send_config_notify(WindowPtr window, int x, int y, int w, int h,
-+                           int bw, WindowPtr sibling, CARD32 flags)
- {
-     present_window_priv_ptr window_priv = present_window_priv(window);
- 
-@@ -122,7 +123,7 @@ present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw,
-             .off_y = 0,
-             .pixmap_width = w,
-             .pixmap_height = h,
--            .pixmap_flags = 0
-+            .pixmap_flags = flags
-         };
-         present_event_ptr event;
- 
-diff --git a/present/present_priv.h b/present/present_priv.h
-index 6ebd009a2..4ad729864 100644
---- a/present/present_priv.h
-+++ b/present/present_priv.h
-@@ -43,6 +43,11 @@
- #define DebugPresent(x)
- #endif
- 
-+/* XXX this belongs in presentproto */
-+#ifndef PresentWindowDestroyed
-+#define PresentWindowDestroyed (1 << 0)
-+#endif
-+
- extern int present_request;
- 
- extern DevPrivateKeyRec present_screen_private_key;
-@@ -307,7 +312,7 @@ void
- present_free_events(WindowPtr window);
- 
- void
--present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling);
-+present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling, CARD32 flags);
- 
- void
- present_send_complete_notify(WindowPtr window, CARD8 kind, CARD8 mode, CARD32 serial, uint64_t ust, uint64_t msc);
-diff --git a/present/present_screen.c b/present/present_screen.c
-index 15684eda4..2c29aafd2 100644
---- a/present/present_screen.c
-+++ b/present/present_screen.c
-@@ -93,6 +93,15 @@ present_destroy_window(WindowPtr window)
-     present_screen_priv_ptr screen_priv = present_screen_priv(screen);
-     present_window_priv_ptr window_priv = present_window_priv(window);
- 
-+    present_send_config_notify(window,
-+                               window->drawable.x,
-+                               window->drawable.y,
-+                               window->drawable.width,
-+                               window->drawable.height,
-+                               window->borderWidth,
-+                               window->nextSib,
-+                               PresentWindowDestroyed);
-+
-     if (window_priv) {
-         present_clear_window_notifies(window);
-         present_free_events(window);
-@@ -123,7 +132,7 @@ present_config_notify(WindowPtr window,
-     ScreenPtr screen = window->drawable.pScreen;
-     present_screen_priv_ptr screen_priv = present_screen_priv(screen);
- 
--    present_send_config_notify(window, x, y, w, h, bw, sibling);
-+    present_send_config_notify(window, x, y, w, h, bw, sibling, 0);
- 
-     unwrap(screen_priv, screen, ConfigNotify);
-     if (screen->ConfigNotify)
--- 
-2.40.0
-

SOURCES/0001-record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch

@@ -1,35 +0,0 @@
-From acc50e6097d51fec0c6c34d84c35018a50c52d5a Mon Sep 17 00:00:00 2001
-From: Povilas Kanapickas <povilas@radix.lt>
-Date: Tue, 14 Dec 2021 15:00:00 +0200
-Subject: [PATCH xserver 1/4] record: Fix out of bounds access in
- SwapCreateRegister()
-
-ZDI-CAN-14952, CVE-2021-4011
-
-This vulnerability was discovered and the fix was suggested by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
-(cherry picked from commit e56f61c79fc3cee26d83cda0f84ae56d5979f768)
----
- record/record.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/record/record.c b/record/record.c
-index 05d751ac2..a8aec23bd 100644
---- a/record/record.c
-+++ b/record/record.c
-@@ -2515,8 +2515,8 @@ SwapCreateRegister(ClientPtr client, xRecordRegisterClientsReq * stuff)
-         swapl(pClientID);
-     }
-     if (stuff->nRanges >
--        client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
--        - stuff->nClients)
-+        (client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
-+        - stuff->nClients) / bytes_to_int32(sz_xRecordRange))
-         return BadLength;
-     RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges);
-     return Success;
--- 
-2.33.1
-

SOURCES/0001-render-Avoid-0-or-less-animated-cursors.patch

@@ -1,89 +0,0 @@
-From 4c8e10312a721aa2f36048388284a2fd4ad97043 Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Fri, 28 Mar 2025 09:43:52 +0100
-Subject: [PATCH xserver 1/7] render: Avoid 0 or less animated cursors
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Animated cursors use a series of cursors that the client can set.
-
-By default, the Xserver assumes at least one cursor is specified
-while a client may actually pass no cursor at all.
-
-That causes an out-of-bound read creating the animated cursor and a
-crash of the Xserver:
-
- | Invalid read of size 8
- |    at 0x5323F4: AnimCursorCreate (animcur.c:325)
- |    by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
- |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
- |    by 0x4A1E9D: Dispatch (dispatch.c:560)
- |    by 0x4B0169: dix_main (main.c:284)
- |    by 0x4287F5: main (stubmain.c:34)
- |  Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd
- |    at 0x48468D3: reallocarray (vg_replace_malloc.c:1803)
- |    by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802)
- |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
- |    by 0x4A1E9D: Dispatch (dispatch.c:560)
- |    by 0x4B0169: dix_main (main.c:284)
- |    by 0x4287F5: main (stubmain.c:34)
- |
- | Invalid read of size 2
- |    at 0x5323F7: AnimCursorCreate (animcur.c:325)
- |    by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
- |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
- |    by 0x4A1E9D: Dispatch (dispatch.c:560)
- |    by 0x4B0169: dix_main (main.c:284)
- |    by 0x4287F5: main (stubmain.c:34)
- |  Address 0x8 is not stack'd, malloc'd or (recently) free'd
-
-To avoid the issue, check the number of cursors specified and return a
-BadValue error in both the proc handler (early) and the animated cursor
-creation (as this is a public function) if there is 0 or less cursor.
-
-CVE-2025-49175
-
-This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
-reported by Julian Suleder via ERNW Vulnerability Disclosure.
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Reviewed-by: José Expósito <jexposit@redhat.com>
-(cherry picked from commit 0885e0b26225c90534642fe911632ec0779eebee)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2025>
----
- render/animcur.c | 3 +++
- render/render.c  | 2 ++
- 2 files changed, 5 insertions(+)
-
-diff --git a/render/animcur.c b/render/animcur.c
-index ef27bda27..77942d846 100644
---- a/render/animcur.c
-+++ b/render/animcur.c
-@@ -304,6 +304,9 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor,
-     int rc = BadAlloc, i;
-     AnimCurPtr ac;
- 
-+    if (ncursor <= 0)
-+        return BadValue;
-+
-     for (i = 0; i < screenInfo.numScreens; i++)
-         if (!GetAnimCurScreen(screenInfo.screens[i]))
-             return BadImplementation;
-diff --git a/render/render.c b/render/render.c
-index 456f156d4..e9bbac62d 100644
---- a/render/render.c
-+++ b/render/render.c
-@@ -1788,6 +1788,8 @@ ProcRenderCreateAnimCursor(ClientPtr client)
-     ncursor =
-         (client->req_len -
-          (bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1;
-+    if (ncursor <= 0)
-+        return BadValue;
-     cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32));
-     if (!cursors)
-         return BadAlloc;
--- 
-2.49.0
-

SOURCES/0001-sync-fix-deletion-of-counters-and-fences.patch

@@ -1,122 +0,0 @@
-From 2b60d9c28c98f6d2c924c69c0dcbb2aa64b861eb Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Mon, 20 Apr 2026 11:16:13 +1000
-Subject: [PATCH xserver 1/9] sync: fix deletion of counters and fences
-
-Both FreeCounter() and miSyncDestroyFence() iterate over the trigger list
-and invoke the CounterDestroyed callback on each trigger.
-
-The CounterDestroyed callback (e.g. SyncAwaitTriggerFired) may call
-FreeResource/FreeAwait, which frees the SyncAwaitUnion containing all
-SyncAwait structs in the same Await group.
-
-When multiple conditions in a single Await reference the same sync
-object (counter or fence), the first callback frees all SyncAwait
-structs while subsequent trigger list nodes still reference them. On the
-next iteration, reading ptl->next or ptl->pTrigger dereferences freed
-memory, leading to a use-after-free.
-
-We need separate fixes for separate issues here to fix this in one go
-- use our null-terminated list macro to make sure our next pointer stays
-  valid (the code accessed ptl->next after freeing it)
-- update the list head before deleting the trigger, eventually this ends
-  up being NULL anyway but meanwhile the list head is a valid list
-  during CounterDestroyed
-- check if we actually do have a trigger before dereferencing the
-  callback
-- Set all triggers to NULL if they are shared so we don't dereference
-  potentially freed memory
-
-This vulnerability was discovered by:
-Anonymous working with TrendAI Zero Day Initiative
-
-ZDI-CAN-30159 (miSyncDestroyFence), ZDI-CAN-30163 (FreeCounter)
-
-Assisted-by: Claude:claude-opus-4-6
-(cherry picked from commit f5abfb61994471023d8c6470428c8e30c411cc0b)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
----
- Xext/sync.c         | 32 +++++++++++++++++++++++++-------
- miext/sync/misync.c | 12 ++++++++----
- 2 files changed, 33 insertions(+), 11 deletions(-)
-
-diff --git a/Xext/sync.c b/Xext/sync.c
-index fd2ceb042..0079e85ed 100644
---- a/Xext/sync.c
-+++ b/Xext/sync.c
-@@ -1148,9 +1148,12 @@ FreeCounter(void *env, XID id)
-         SyncTriggerList *ptl, *pnext;
- 
-         /* tell all the counter's triggers that counter has been destroyed */
--        for (ptl = pCounter->sync.pTriglist; ptl; ptl = pnext) {
--            (*ptl->pTrigger->CounterDestroyed) (ptl->pTrigger);
--            pnext = ptl->next;
-+        nt_list_for_each_entry_safe(ptl, pnext, pCounter->sync.pTriglist, next) {
-+            /* Remove it from the list first so CounterDestroyed
-+             * callbacks have a valid list to iterate */
-+            pCounter->sync.pTriglist = pnext;
-+            if (ptl->pTrigger)
-+                (*ptl->pTrigger->CounterDestroyed) (ptl->pTrigger);
-             free(ptl); /* destroy the trigger list as we go */
-         }
-         if (IsSystemCounter(pCounter)) {
-@@ -1182,13 +1185,28 @@ FreeAwait(void *addr, XID id)
- 
-     for (numwaits = pAwaitUnion->header.num_waitconditions; numwaits;
-          numwaits--, pAwait++) {
--        /* If the counter is being destroyed, FreeCounter will delete
--         * the trigger list itself, so don't do it here.
-+        /* If the counter is being destroyed, FreeCounter/miSyncDestroyFence
-+         * will delete the trigger list itself, so don't do it here.
-+         * However, we must NULL out the pTrigger pointer in the trigger list
-+         * node so the destroy loop knows not to dereference it - the backing
-+         * SyncAwait memory is about to be freed below.
-          */
-         SyncObject *pSync = pAwait->trigger.pSync;
- 
--        if (pSync && !pSync->beingDestroyed)
--            SyncDeleteTriggerFromSyncObject(&pAwait->trigger);
-+        if (pSync) {
-+            if (!pSync->beingDestroyed) {
-+                SyncDeleteTriggerFromSyncObject(&pAwait->trigger);
-+            } else {
-+                SyncTriggerList *ptl;
-+
-+                nt_list_for_each_entry(ptl, pSync->pTriglist, next) {
-+                    if (ptl->pTrigger == &pAwait->trigger) {
-+                        ptl->pTrigger = NULL;
-+                        break;
-+                    }
-+                }
-+            }
-+        }
-     }
-     free(pAwaitUnion);
-     return Success;
-diff --git a/miext/sync/misync.c b/miext/sync/misync.c
-index 0931803f6..6a47d1cdd 100644
---- a/miext/sync/misync.c
-+++ b/miext/sync/misync.c
-@@ -115,10 +115,14 @@ miSyncDestroyFence(SyncFence * pFence)
-         SyncScreenPrivPtr pScreenPriv = SYNC_SCREEN_PRIV(pScreen);
-         SyncTriggerList *ptl, *pNext;
- 
--        /* tell all the fence's triggers that the counter has been destroyed */
--        for (ptl = pFence->sync.pTriglist; ptl; ptl = pNext) {
--            (*ptl->pTrigger->CounterDestroyed) (ptl->pTrigger);
--            pNext = ptl->next;
-+        /* tell all the fence's triggers that the fence has been destroyed.
-+         * Update pTriglist before each callback and free so that FreeAwait
-+         * sees a valid list head when scanning for triggers to NULL out.
-+         */
-+        nt_list_for_each_entry_safe(ptl, pNext, pFence->sync.pTriglist, next) {
-+            pFence->sync.pTriglist = pNext;
-+            if (ptl->pTrigger)
-+                (*ptl->pTrigger->CounterDestroyed) (ptl->pTrigger);
-             free(ptl); /* destroy the trigger list as we go */
-         }
- 
--- 
-2.54.0
-

SOURCES/0001-xf86-logind-Fix-drm_drop_master-before-vt_reldisp.patch

@@ -1,167 +0,0 @@
-From dafe5f6358edd557d89bb63265d6df2e1249f106 Mon Sep 17 00:00:00 2001
-From: Jocelyn Falempe <jfalempe@redhat.com>
-Date: Thu, 18 Nov 2021 14:45:42 +0100
-Subject: [PATCH] xf86/logind: fix call systemd_logind_vtenter after receiving
- drm device resume
-
-logind send the resume event for input devices and drm device,
-in any order. if we call vt_enter before logind resume the drm device,
-it leads to a driver error, because logind has not done the
-DRM_IOCTL_SET_MASTER on it.
-
-Keep the old workaround to make sure we call systemd_logind_vtenter at
-least once if there are no platform device
-
-Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-
-xf86/logind: Fix drm_drop_master before vt_reldisp
-
-When switching to VT, the ioctl DRM_DROP_MASTER must be done before
-the ioctl VT_RELDISP. Otherwise the kernel can't change the modesetting
-reliably, and this leads to the console not showing up in some cases, like
-after unplugging a docking station with a DP or HDMI monitor.
-
-Before doing the VT_RELDISP, send a dbus message to logind, to
-pause the drm device, so logind will do the ioctl DRM_DROP_MASTER.
-
-With this patch, it changes the order logind will send the resume
-event, and drm will be sent last instead of first.
-so there is a also fix to call systemd_logind_vtenter() at the right time.
-
-Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-
-xf86/logind: Fix compilation error when built without logind/platform bus
-
-This was introduced by commit 8eb1396d
-
-Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1269
-Fixes: da9d012a9 - xf86/logind: Fix drm_drop_master before vt_reldisp
-
-Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-
-xf86/logind: fix missing call to vtenter if the platform device is not paused
-
-If there is one platform device, which is not paused nor resumed,
-systemd_logind_vtenter() will never get called.
-This break suspend/resume, and switching to VT on system with Nvidia
-proprietary driver.
-This is a regression introduced by f5bd039633fa83
-
-So now call systemd_logind_vtenter() if there are no paused
-platform devices.
-
-Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1271
-Fixes: f5bd0396 - xf86/logind: fix call systemd_logind_vtenter after receiving drm device resume
-
-Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
-Tested-by: Olivier Fourdan <ofourdan@redhat.com>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
----
- hw/xfree86/common/xf86Events.c               |  4 ++
- hw/xfree86/os-support/linux/systemd-logind.c | 41 +++++++++++++++++---
- include/systemd-logind.h                     |  2 +
- 3 files changed, 42 insertions(+), 5 deletions(-)
-
-diff --git a/hw/xfree86/common/xf86Events.c b/hw/xfree86/common/xf86Events.c
-index 8a800bd8f..b683d233b 100644
---- a/hw/xfree86/common/xf86Events.c
-+++ b/hw/xfree86/common/xf86Events.c
-@@ -393,6 +393,10 @@ xf86VTLeave(void)
-     for (i = 0; i < xf86NumGPUScreens; i++)
-         xf86GPUScreens[i]->LeaveVT(xf86GPUScreens[i]);
- 
-+    if (systemd_logind_controls_session()) {
-+        systemd_logind_drop_master();
-+    }
-+
-     if (!xf86VTSwitchAway())
-         goto switch_failed;
- 
-diff --git a/hw/xfree86/os-support/linux/systemd-logind.c b/hw/xfree86/os-support/linux/systemd-logind.c
-index 13784d15c..bd7a341f0 100644
---- a/hw/xfree86/os-support/linux/systemd-logind.c
-+++ b/hw/xfree86/os-support/linux/systemd-logind.c
-@@ -302,6 +302,37 @@ cleanup:
-     dbus_error_free(&error);
- }
- 
-+/*
-+ * Send a message to logind, to pause the drm device
-+ * and ensure the drm_drop_master is done before
-+ * VT_RELDISP when switching VT
-+ */
-+void systemd_logind_drop_master(void)
-+{
-+    int i;
-+    for (i = 0; i < xf86_num_platform_devices; i++) {
-+        if (xf86_platform_devices[i].flags & XF86_PDEV_SERVER_FD) {
-+            dbus_int32_t major, minor;
-+            struct systemd_logind_info *info = &logind_info;
-+
-+            xf86_platform_devices[i].flags |= XF86_PDEV_PAUSED;
-+            major = xf86_platform_odev_attributes(i)->major;
-+            minor = xf86_platform_odev_attributes(i)->minor;
-+            systemd_logind_ack_pause(info, minor, major);
-+        }
-+    }
-+}
-+
-+static Bool are_platform_devices_resumed(void) {
-+    int i;
-+    for (i = 0; i < xf86_num_platform_devices; i++) {
-+        if (xf86_platform_devices[i].flags & XF86_PDEV_PAUSED) {
-+            return FALSE;
-+        }
-+    }
-+    return TRUE;
-+}
-+
- static DBusHandlerResult
- message_filter(DBusConnection * connection, DBusMessage * message, void *data)
- {
-@@ -417,14 +448,14 @@ message_filter(DBusConnection * connection, DBusMessage * message, void *data)
-         /* info->vt_active gets set by systemd_logind_vtenter() */
-         info->active = TRUE;
- 
--        if (pdev)
-+        if (pdev) {
-             pdev->flags &= ~XF86_PDEV_PAUSED;
--        else
-+        } else
-             systemd_logind_set_input_fd_for_all_devs(major, minor, fd,
-                                                      info->vt_active);
--
--        /* Always call vtenter(), in case there are only legacy video devs */
--        systemd_logind_vtenter();
-+        /* Call vtenter if all platform devices are resumed, or if there are no platform device */
-+        if (are_platform_devices_resumed())
-+            systemd_logind_vtenter();
-     }
-     return DBUS_HANDLER_RESULT_HANDLED;
- }
-diff --git a/include/systemd-logind.h b/include/systemd-logind.h
-index a4067d097..5c04d0130 100644
---- a/include/systemd-logind.h
-+++ b/include/systemd-logind.h
-@@ -33,6 +33,7 @@ int systemd_logind_take_fd(int major, int minor, const char *path, Bool *paus);
- void systemd_logind_release_fd(int major, int minor, int fd);
- int systemd_logind_controls_session(void);
- void systemd_logind_vtenter(void);
-+void systemd_logind_drop_master(void);
- #else
- #define systemd_logind_init()
- #define systemd_logind_fini()
-@@ -40,6 +41,7 @@ void systemd_logind_vtenter(void);
- #define systemd_logind_release_fd(major, minor, fd) close(fd)
- #define systemd_logind_controls_session() 0
- #define systemd_logind_vtenter()
-+#define systemd_logind_drop_master()
- #endif
- 
- #endif
--- 
-2.33.1
-

SOURCES/0001-xfree86-Don-t-autoconfigure-vesa-or-fbdev.patch

@@ -1,27 +0,0 @@
-From e4dce2bfaf4a61dd8a8ac099638489d4fdff9024 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Tue, 29 May 2018 15:05:10 -0400
-Subject: [PATCH] xfree86: Don't autoconfigure vesa or fbdev
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
----
- hw/xfree86/loader/loadmod.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/hw/xfree86/loader/loadmod.c b/hw/xfree86/loader/loadmod.c
-index a6356bd..1c1c2b1 100644
---- a/hw/xfree86/loader/loadmod.c
-+++ b/hw/xfree86/loader/loadmod.c
-@@ -383,6 +383,9 @@ LoaderListDir(const char *subdir, const char **patternlist)
-                 strcpy(fp, dp->d_name);
-                 if (!(stat(buf, &stat_buf) == 0 && S_ISREG(stat_buf.st_mode)))
-                     continue;
-+                if (!strcmp(subdir, "drivers") &&
-+                            (strstr(dp->d_name, "vesa") || strstr(dp->d_name, "fbdev")))
-+                    continue;
-                 for (p = patterns; p->pattern; p++) {
-                     if (regexec(&p->rex, dp->d_name, 2, match, 0) == 0 &&
-                         match[1].rm_so != -1) {
--- 
-2.17.0
-

SOURCES/0001-xfree86-LeaveVT-from-xf86CrtcCloseScreen.patch

@@ -1,27 +0,0 @@
-From 1070ffa0953e9200688fc8fae11e3ab0680b86f2 Mon Sep 17 00:00:00 2001
-From: Adam Jackson <ajax@redhat.com>
-Date: Tue, 9 Oct 2018 12:28:48 -0400
-Subject: [PATCH xserver] xfree86: LeaveVT from xf86CrtcCloseScreen
-
-Signed-off-by: Adam Jackson <ajax@redhat.com>
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
----
- hw/xfree86/modes/xf86Crtc.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/hw/xfree86/modes/xf86Crtc.c b/hw/xfree86/modes/xf86Crtc.c
-index 37a45bb3af..45d325f4d2 100644
---- a/hw/xfree86/modes/xf86Crtc.c
-+++ b/hw/xfree86/modes/xf86Crtc.c
-@@ -776,6 +776,8 @@ xf86CrtcCloseScreen(ScreenPtr screen)
-         crtc->randr_crtc = NULL;
-     }
- 
-+    scrn->LeaveVT(scrn);
-+
-     screen->CloseScreen = config->CloseScreen;
- 
-     xf86RotateCloseScreen(screen);
--- 
-2.19.0
-

SOURCES/0001-xfree86-Only-switch-to-original-VT-if-it-is-active.patch

@@ -1,136 +0,0 @@
-From ff91c696ff8f5f56da40e107cb5c321539758a81 Mon Sep 17 00:00:00 2001
-From: Michal Srb <msrb@suse.com>
-Date: Tue, 16 Oct 2018 09:32:13 +0200
-Subject: [PATCH xserver] xfree86: Only switch to original VT if it is active.
-
-If the X server is terminated while its VT is not active, it should
-not change the current VT.
-
-v2: Query current state in xf86CloseConsole using VT_GETSTATE instead of
-    keeping track in xf86VTEnter/xf86VTLeave/etc.
----
- hw/xfree86/os-support/linux/lnx_init.c | 16 +++++++++++++---
- 1 file changed, 13 insertions(+), 3 deletions(-)
-
-diff --git a/hw/xfree86/os-support/linux/lnx_init.c b/hw/xfree86/os-support/linux/lnx_init.c
-index 039dc4a4d..358d89f0f 100644
---- a/hw/xfree86/os-support/linux/lnx_init.c
-+++ b/hw/xfree86/os-support/linux/lnx_init.c
-@@ -272,101 +272,111 @@ xf86OpenConsole(void)
-                 xf86SetConsoleHandler(drain_console, NULL);
-             }
- 
-             nTty = tty_attr;
-             nTty.c_iflag = (IGNPAR | IGNBRK) & (~PARMRK) & (~ISTRIP);
-             nTty.c_oflag = 0;
-             nTty.c_cflag = CREAD | CS8;
-             nTty.c_lflag = 0;
-             nTty.c_cc[VTIME] = 0;
-             nTty.c_cc[VMIN] = 1;
-             cfsetispeed(&nTty, 9600);
-             cfsetospeed(&nTty, 9600);
-             tcsetattr(xf86Info.consoleFd, TCSANOW, &nTty);
-         }
-     }
-     else {                      /* serverGeneration != 1 */
-         if (!xf86Info.ShareVTs && xf86Info.autoVTSwitch) {
-             /* now get the VT */
-             if (!switch_to(xf86Info.vtno, "xf86OpenConsole"))
-                 FatalError("xf86OpenConsole: Switching VT failed\n");
-         }
-     }
- }
- 
- #pragma GCC diagnostic pop
- 
- void
- xf86CloseConsole(void)
- {
-     struct vt_mode VT;
-+    struct vt_stat vts;
-     int ret;
- 
-     if (xf86Info.ShareVTs) {
-         close(xf86Info.consoleFd);
-         return;
-     }
- 
-     /*
-      * unregister the drain_console handler
-      * - what to do if someone else changed it in the meantime?
-      */
-     xf86SetConsoleHandler(NULL, NULL);
- 
-     /* Back to text mode ... */
-     SYSCALL(ret = ioctl(xf86Info.consoleFd, KDSETMODE, KD_TEXT));
-     if (ret < 0)
-         xf86Msg(X_WARNING, "xf86CloseConsole: KDSETMODE failed: %s\n",
-                 strerror(errno));
- 
-     SYSCALL(ioctl(xf86Info.consoleFd, KDSKBMODE, tty_mode));
-     tcsetattr(xf86Info.consoleFd, TCSANOW, &tty_attr);
- 
-     SYSCALL(ret = ioctl(xf86Info.consoleFd, VT_GETMODE, &VT));
-     if (ret < 0)
-         xf86Msg(X_WARNING, "xf86CloseConsole: VT_GETMODE failed: %s\n",
-                 strerror(errno));
-     else {
-         /* set dflt vt handling */
-         VT.mode = VT_AUTO;
-         SYSCALL(ret = ioctl(xf86Info.consoleFd, VT_SETMODE, &VT));
-         if (ret < 0)
-             xf86Msg(X_WARNING, "xf86CloseConsole: VT_SETMODE failed: %s\n",
-                     strerror(errno));
-     }
- 
-     if (xf86Info.autoVTSwitch) {
-         /*
--         * Perform a switch back to the active VT when we were started
--         */
-+        * Perform a switch back to the active VT when we were started if our
-+        * vt is active now.
-+        */
-         if (activeVT >= 0) {
--            switch_to(activeVT, "xf86CloseConsole");
-+            SYSCALL(ret = ioctl(xf86Info.consoleFd, VT_GETSTATE, &vts));
-+            if (ret < 0) {
-+                xf86Msg(X_WARNING, "xf86OpenConsole: VT_GETSTATE failed: %s\n",
-+                        strerror(errno));
-+            } else {
-+                if (vts.v_active == xf86Info.vtno) {
-+                    switch_to(activeVT, "xf86CloseConsole");
-+                }
-+            }
-             activeVT = -1;
-         }
-     }
-     close(xf86Info.consoleFd);  /* make the vt-manager happy */
- }
- 
- #define CHECK_FOR_REQUIRED_ARGUMENT() \
-     if (((i + 1) >= argc) || (!argv[i + 1])) { 				\
-       ErrorF("Required argument to %s not specified\n", argv[i]); 	\
-       UseMsg(); 							\
-       FatalError("Required argument to %s not specified\n", argv[i]);	\
-     }
- 
- int
- xf86ProcessArgument(int argc, char *argv[], int i)
- {
-     /*
-      * Keep server from detaching from controlling tty.  This is useful
-      * when debugging (so the server can receive keyboard signals.
-      */
-     if (!strcmp(argv[i], "-keeptty")) {
-         KeepTty = TRUE;
-         return 1;
-     }
- 
-     if ((argv[i][0] == 'v') && (argv[i][1] == 't')) {
-         if (sscanf(argv[i], "vt%2d", &xf86Info.vtno) == 0) {
-             UseMsg();
-             xf86Info.vtno = -1;
-             return 0;
--- 
-2.18.4
-

SOURCES/0001-xfree86-ensure-the-readlink-buffer-is-null-terminate.patch

@@ -1,34 +0,0 @@
-From 71703e4e8bd00719eefad53c2ed6c604079f87ea Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Wed, 17 Oct 2018 09:00:59 +1000
-Subject: [PATCH xserver] xfree86: ensure the readlink buffer is
- null-terminated
-
-Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
-Reviewed-by: Dave Airlie <airlied@redhat.com>
----
- hw/xfree86/fbdevhw/fbdevhw.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/hw/xfree86/fbdevhw/fbdevhw.c b/hw/xfree86/fbdevhw/fbdevhw.c
-index 95089515c..f146ff4a4 100644
---- a/hw/xfree86/fbdevhw/fbdevhw.c
-+++ b/hw/xfree86/fbdevhw/fbdevhw.c
-@@ -331,12 +331,12 @@ fbdev_open(int scrnIndex, const char *dev, char **namep)
- 
-     /* only touch non-PCI devices on this path */
-     {
--        char buf[PATH_MAX];
-+        char buf[PATH_MAX] = {0};
-         char *sysfs_path = NULL;
-         char *node = strrchr(dev, '/') + 1;
- 
-         if (asprintf(&sysfs_path, "/sys/class/graphics/%s", node) < 0 ||
--            readlink(sysfs_path, buf, sizeof(buf)) < 0 ||
-+            readlink(sysfs_path, buf, sizeof(buf) - 1) < 0 ||
-             strstr(buf, "devices/pci")) {
-             free(sysfs_path);
-             close(fd);
--- 
-2.19.1
-

SOURCES/0001-xfree86-try-harder-to-span-on-multihead.patch

@@ -1,190 +0,0 @@
-From 326f992a90dae7a747da45626e588fa3c1dfa5dc Mon Sep 17 00:00:00 2001
-From: Ray Strode <rstrode@redhat.com>
-Date: Fri, 21 Sep 2018 14:38:31 -0400
-Subject: [PATCH xserver] xfree86: try harder to span on multihead
-
-right now if one of the monitors can't give
-it's native resolution because of bandwidth limitations,
-X decides to avoid spanning and instead clone.
-
-That's suboptimal, spanning is normally the right
-thing to do (with the exception of some projector
-use cases and other edge cases)
-
-This commit tries harder to make spanning work.
----
- hw/xfree86/modes/xf86Crtc.c | 33 +++++++++++++++++++++++++++++----
- 1 file changed, 29 insertions(+), 4 deletions(-)
-
-diff --git a/hw/xfree86/modes/xf86Crtc.c b/hw/xfree86/modes/xf86Crtc.c
-index 37a45bb3a..686cb51b8 100644
---- a/hw/xfree86/modes/xf86Crtc.c
-+++ b/hw/xfree86/modes/xf86Crtc.c
-@@ -2132,135 +2132,160 @@ bestModeForAspect(xf86CrtcConfigPtr config, Bool *enabled, float aspect)
-             if (test->HDisplay != mode->HDisplay ||
-                 test->VDisplay != mode->VDisplay) {
-                 test = NULL;
-                 break;
-             }
-         }
- 
-         /* if we didn't match it on all outputs, try the next one */
-         if (!test)
-             continue;
- 
-         /* if it's bigger than the last one, save it */
-         if (!match || (test->HDisplay > match->HDisplay))
-             match = test;
-     }
- 
-     /* return the biggest one found */
-     return match;
- }
- 
- static int
- numEnabledOutputs(xf86CrtcConfigPtr config, Bool *enabled)
- {
-     int i = 0, p;
- 
-     for (i = 0, p = -1; nextEnabledOutput(config, enabled, &p); i++) ;
- 
-     return i;
- }
- 
-+static DisplayModePtr
-+findReasonableMode(xf86CrtcConfigPtr config, xf86OutputPtr output, Bool *enabled, int width, int height)
-+{
-+    DisplayModePtr mode =
-+        xf86OutputHasPreferredMode(output, width, height);
-+
-+    /* if there's no preferred mode, just try to find a reasonable one */
-+    if (!mode) {
-+        float aspect = 0.0;
-+        DisplayModePtr a = NULL, b = NULL;
-+
-+        if (output->mm_height)
-+            aspect = (float) output->mm_width /
-+                (float) output->mm_height;
-+
-+        a = bestModeForAspect(config, enabled, 4.0/3.0);
-+        if (aspect)
-+            b = bestModeForAspect(config, enabled, aspect);
-+
-+        mode = biggestMode(a, b);
-+    }
-+
-+    return mode;
-+}
-+
- static Bool
- xf86TargetRightOf(ScrnInfoPtr scrn, xf86CrtcConfigPtr config,
-                   DisplayModePtr *modes, Bool *enabled,
-                   int width, int height)
- {
-     int o;
-     int w = 0;
-     Bool has_tile = FALSE;
-     uint32_t configured_outputs;
- 
-     xf86GetOptValBool(config->options, OPTION_PREFER_CLONEMODE,
-                       &scrn->preferClone);
-     if (scrn->preferClone)
-         return FALSE;
- 
-     if (numEnabledOutputs(config, enabled) < 2)
-         return FALSE;
- 
-     for (o = -1; nextEnabledOutput(config, enabled, &o); ) {
-         DisplayModePtr mode =
--            xf86OutputHasPreferredMode(config->output[o], width, height);
-+            findReasonableMode(config, config->output[o], enabled, width, height);
- 
-         if (!mode)
-             return FALSE;
- 
-         w += mode->HDisplay;
-     }
- 
-     if (w > width)
-         return FALSE;
- 
-     w = 0;
-     configured_outputs = 0;
- 
-     for (o = -1; nextEnabledOutput(config, enabled, &o); ) {
-         DisplayModePtr mode =
--            xf86OutputHasPreferredMode(config->output[o], width, height);
-+            findReasonableMode(config, config->output[o], enabled, width, height);
- 
-         if (configured_outputs & (1 << o))
-             continue;
- 
-         if (config->output[o]->tile_info.group_id) {
-             has_tile = TRUE;
-             continue;
-         }
- 
-         config->output[o]->initial_x = w;
-         w += mode->HDisplay;
- 
-         configured_outputs |= (1 << o);
-         modes[o] = mode;
-     }
- 
-     if (has_tile) {
-         for (o = -1; nextEnabledOutput(config, enabled, &o); ) {
-             int ht, vt, ot;
-             int add_x, cur_x = w;
-             struct xf86CrtcTileInfo *tile_info = &config->output[o]->tile_info, *this_tile;
-             if (configured_outputs & (1 << o))
-                 continue;
-             if (!tile_info->group_id)
-                 continue;
- 
-             if (tile_info->tile_h_loc != 0 && tile_info->tile_v_loc != 0)
-                 continue;
- 
-             for (ht = 0; ht < tile_info->num_h_tile; ht++) {
-                 int cur_y = 0;
-                 add_x = 0;
-                 for (vt = 0; vt < tile_info->num_v_tile; vt++) {
- 
-                     for (ot = -1; nextEnabledOutput(config, enabled, &ot); ) {
--
-                         DisplayModePtr mode =
--                            xf86OutputHasPreferredMode(config->output[ot], width, height);
-+                            findReasonableMode(config, config->output[ot], enabled, width, height);
-+
-                         if (!config->output[ot]->tile_info.group_id)
-                             continue;
- 
-                         this_tile = &config->output[ot]->tile_info;
-                         if (this_tile->group_id != tile_info->group_id)
-                             continue;
- 
-                         if (this_tile->tile_h_loc != ht ||
-                             this_tile->tile_v_loc != vt)
-                             continue;
- 
-                         config->output[ot]->initial_x = cur_x;
-                         config->output[ot]->initial_y = cur_y;
- 
-                         if (vt == 0)
-                             add_x = this_tile->tile_h_size;
-                         cur_y += this_tile->tile_v_size;
-                         configured_outputs |= (1 << ot);
-                         modes[ot] = mode;
-                     }
-                 }
-                 cur_x += add_x;
-             }
-             w = cur_x;
-         }
-     }
-     return TRUE;
- }
- 
- static Bool
--- 
-2.17.1
-

SOURCES/0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch

@@ -1,54 +0,0 @@
-From 56351307017e2501f7cd6e31efcfb55c19aba75a Mon Sep 17 00:00:00 2001
-From: Matthieu Herrb <matthieu@herrb.eu>
-Date: Thu, 10 Oct 2024 10:37:28 +0200
-Subject: [PATCH] xkb: Fix buffer overflow in _XkbSetCompatMap()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
-buffer.
-
-However, It didn't update its size properly. It updated `num_si` only,
-without updating `size_si`.
-
-This may lead to local privilege escalation if the server is run as root
-or remote code execution (e.g. x11 over ssh).
-
-CVE-2024-9632, ZDI-CAN-24756
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
-Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
-Reviewed-by: José Expósito <jexposit@redhat.com>
----
- xkb/xkb.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/xkb/xkb.c b/xkb/xkb.c
-index f203270d5..70e8279aa 100644
---- a/xkb/xkb.c
-+++ b/xkb/xkb.c
-@@ -2991,13 +2991,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
-         XkbSymInterpretPtr sym;
-         unsigned int skipped = 0;
- 
--        if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) {
--            compat->num_si = req->firstSI + req->nSI;
-+        if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
-+            compat->num_si = compat->size_si = req->firstSI + req->nSI;
-             compat->sym_interpret = reallocarray(compat->sym_interpret,
--                                                 compat->num_si,
-+                                                 compat->size_si,
-                                                  sizeof(XkbSymInterpretRec));
-             if (!compat->sym_interpret) {
--                compat->num_si = 0;
-+                compat->num_si = compat->size_si = 0;
-                 return BadAlloc;
-             }
-         }
--- 
-2.46.2
-

SOURCES/0001-xkb-fix-buffer-re-use-in-_XkbSetCompatMap.patch

@@ -1,47 +0,0 @@
-From 750205e2a8ba90ce532b19a953e8dba221e62648 Mon Sep 17 00:00:00 2001
-From: Peter Harris <pharris2@rocketsoftware.com>
-Date: Thu, 15 Jan 2026 15:54:09 -0500
-Subject: [PATCH xserver 1/6] xkb: fix buffer re-use in _XkbSetCompatMap
-
-If the "compat" buffer has previously been truncated, there will be
-unused space in the buffer. The code uses this space, but does not
-update the number of valid entries in the buffer.
-
-In the best case, this leads to the new compat entries being ignored. In the
-worst case, if there are any "skipped" compat entries, the number of
-valid entries will be corrupted, potentially leading to a buffer read
-overrun when processing a future request.
-
-Set the number of used "compat" entries when re-using previously
-allocated space in the buffer.
-
-CVE-2026-33999, ZDI-CAN-28593
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with TrendAI Zero Day Initiative
-
-Signed-off-by: Peter Harris <pharris2@rocketsoftware.com>
-Acked-by: Olivier Fourdan <ofourdan@redhat.com>
-(cherry picked from commit b024ae1749ee58c6fbf863b9a1f5dc440fee2e1b)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2178>
----
- xkb/xkb.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/xkb/xkb.c b/xkb/xkb.c
-index d5f790338..b002da5bc 100644
---- a/xkb/xkb.c
-+++ b/xkb/xkb.c
-@@ -3003,7 +3003,7 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
-                 return BadAlloc;
-             }
-         }
--        else if (req->truncateSI) {
-+        else if (req->truncateSI || req->firstSI + req->nSI > compat->num_si) {
-             compat->num_si = req->firstSI + req->nSI;
-         }
-         sym = &compat->sym_interpret[req->firstSI];
--- 
-2.53.0
-

SOURCES/0001-xkb-fix-int-size-mismatch.patch

@@ -1,56 +0,0 @@
-From de8df5f72f7f1673fc1bb7a9c84ba0e7f1d5e562 Mon Sep 17 00:00:00 2001
-From: "Enrico Weigelt, metux IT consult" <info@metux.net>
-Date: Wed, 24 Jan 2024 17:18:16 +0100
-Subject: [PATCH xserver] xkb: fix int size mismatch
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-GCC reports:
-
-../xkb/xkb.c: In function ‘_XkbSetMapCheckLength’:
-../xkb/xkb.c:2464:54: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 2 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=]
- 2464 |     ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %ld got %ld\n",
-      |                                                    ~~^
-      |                                                      |
-      |                                                      long int
-      |                                                    %d
- 2465 |            len, req_len);
-      |            ~~~
-      |            |
-      |            size_t {aka unsigned int}
-../xkb/xkb.c:2464:62: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 3 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=]
- 2464 |     ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %ld got %ld\n",
-      |                                                            ~~^
-      |                                                              |
-      |                                                              long int
-      |                                                            %d
- 2465 |            len, req_len);
-      |                 ~~~~~~~
-      |                 |
-      |                 size_t {aka unsigned int}
-
-Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1257>
-(cherry picked from commit bc90c44e60c309564a7feec5d288ecafcbb2a62b)
----
- xkb/xkb.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/xkb/xkb.c b/xkb/xkb.c
-index b240b6f6c..8d52e25df 100644
---- a/xkb/xkb.c
-+++ b/xkb/xkb.c
-@@ -2460,8 +2460,7 @@ _XkbSetMapCheckLength(xkbSetMapReq *req)
-     if (len == req_len)
-         return Success;
- bad:
--    ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %ld got %ld\n",
--           len, req_len);
-+    ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %zd got %zd\n", len, req_len);
-     return BadLength;
- }
- 
--- 
-2.54.0
-

SOURCES/0002-dix-avoid-null-ptr-deref-at-doListFontsWithInfo.patch

@@ -1,47 +0,0 @@
-From 27d924f41a04f37ee8a16ba2419a703174c5026c Mon Sep 17 00:00:00 2001
-From: Mikhail Dmitrichenko <mdmitrichenko@astralinux.ru>
-Date: Wed, 17 Sep 2025 17:25:40 +0300
-Subject: [PATCH xserver 02/51] dix: avoid null ptr deref at
- doListFontsWithInfo
-
-In the doListFontsWithInfo function in dixfonts.c, when a font alias is
-encountered (err == FontNameAlias), the code saves the current state
-and allocates memory for c->savedName.
-
-If the malloc(namelen + 1) call fails, c->savedName remains NULL,
-but c->haveSaved is still set to TRUE. Later, when a font is
-successfully resolved (err == Successful), the code uses c->savedName
-without checking if it is NULL, so there is potential null ptr
-dereference. XNFalloc will check result of malloc and stop
-program execution if allocation was failed.
-
-Found by Linux Verification Center (linuxtesting.org) with SVACE.
-
-Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1842
-Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
-(cherry picked from commit dd5c2595a42d3ff0c4f18d9b53d1f6c3fd934fd4)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
----
- dix/dixfonts.c | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/dix/dixfonts.c b/dix/dixfonts.c
-index 386c38686..b079dcf67 100644
---- a/dix/dixfonts.c
-+++ b/dix/dixfonts.c
-@@ -933,9 +933,8 @@ doListFontsWithInfo(ClientPtr client, LFWIclosurePtr c)
-                 c->haveSaved = TRUE;
-                 c->savedNumFonts = numFonts;
-                 free(c->savedName);
--                c->savedName = malloc(namelen + 1);
--                if (c->savedName)
--                    memmove(c->savedName, name, namelen + 1);
-+                c->savedName = XNFalloc(namelen + 1);
-+                memcpy(c->savedName, name, namelen + 1);
-                 aliascount = 20;
-             }
-             if (namelen > XLFDMAXFONTNAMELEN) {
--- 
-2.54.0
-

SOURCES/0002-os-Do-not-overflow-the-integer-size-with-BigRequest.patch

@@ -1,91 +0,0 @@
-From a99c927aec4563101f574d0a65cd451dcdd7e012 Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Mon, 7 Apr 2025 16:13:34 +0200
-Subject: [PATCH xserver 2/7] os: Do not overflow the integer size with
- BigRequest
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The BigRequest extension allows requests larger than the 16-bit length
-limit.
-
-It uses integers for the request length and checks for the size not to
-exceed the maxBigRequestSize limit, but does so after translating the
-length to integer by multiplying the given size in bytes by 4.
-
-In doing so, it might overflow the integer size limit before actually
-checking for the overflow, defeating the purpose of the test.
-
-To avoid the issue, make sure to check that the request size does not
-overflow the maxBigRequestSize limit prior to any conversion.
-
-The caller Dispatch() function however expects the return value to be in
-bytes, so we cannot just return the converted value in case of error, as
-that would also overflow the integer size.
-
-To preserve the existing API, we use a negative value for the X11 error
-code BadLength as the function only return positive values, 0 or -1 and
-update the caller Dispatch() function to take that case into account to
-return the error code to the offending client.
-
-CVE-2025-49176
-
-This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
-reported by Julian Suleder via ERNW Vulnerability Disclosure.
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
-(cherry picked from commit 03731b326a80b582e48d939fe62cb1e2b10400d9)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2025>
----
- dix/dispatch.c | 9 +++++----
- os/io.c        | 4 ++++
- 2 files changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/dix/dispatch.c b/dix/dispatch.c
-index a33bfaa9e..14ccdc57a 100644
---- a/dix/dispatch.c
-+++ b/dix/dispatch.c
-@@ -447,9 +447,10 @@ Dispatch(void)
- 
-                 /* now, finally, deal with client requests */
-                 result = ReadRequestFromClient(client);
--                if (result <= 0) {
--                    if (result < 0)
--                        CloseDownClient(client);
-+                if (result == 0)
-+                    break;
-+                else if (result == -1) {
-+                    CloseDownClient(client);
-                     break;
-                 }
- 
-@@ -470,7 +471,7 @@ Dispatch(void)
-                                           client->index,
-                                           client->requestBuffer);
- #endif
--                if (result > (maxBigRequestSize << 2))
-+                if (result < 0 || result > (maxBigRequestSize << 2))
-                     result = BadLength;
-                 else {
-                     result = XaceHookDispatch(client, client->majorOp);
-diff --git a/os/io.c b/os/io.c
-index 939f51743..a05300869 100644
---- a/os/io.c
-+++ b/os/io.c
-@@ -296,6 +296,10 @@ ReadRequestFromClient(ClientPtr client)
-                 needed = get_big_req_len(request, client);
-         }
-         client->req_len = needed;
-+        if (needed > MAXINT >> 2) {
-+            /* Check for potential integer overflow */
-+            return -(BadLength);
-+        }
-         needed <<= 2;           /* needed is in bytes now */
-     }
-     if (gotnow < needed) {
--- 
-2.49.0
-

SOURCES/0002-sync-restart-trigger-list-iteration-in-SyncChangeCou.patch

@@ -1,71 +0,0 @@
-From 513d92540e8edba52a08f53c461e4e366bb8b385 Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Mon, 20 Apr 2026 11:17:08 +1000
-Subject: [PATCH xserver 2/9] sync: restart trigger list iteration in
- SyncChangeCounter after TriggerFired
-
-This is the equivalent check to miSyncTriggerFence() from
-commit f19ab94ba9c8 ("miext/sync: Fix use-after-free in miSyncTriggerFence()")
-
-When a trigger fires via SyncAwaitTriggerFired, the resulting
-FreeResource/FreeAwait call invokes SyncDeleteTriggerFromSyncObject for
-every trigger in the same Await group. This unlinks and frees the
-corresponding trigger list nodes - potentially including the node pnext
-points to.
-
-Fix by restarting iteration from the list head after a trigger fires, since
-TriggerFired may have arbitrarily mutated the list. Triggers that have fired
-are removed from the list by FreeAwait, so restarting cannot cause infinite
-loops.
-
-This vulnerability was discovered by:
-Anonymous working with TrendAI Zero Day Initiative
-
-ZDI-CAN-30164
-
-Assisted-by: Claude:claude-opus-4-6
-(cherry picked from commit bdd7bf57af208b1ddf57d4683d67104443b44812)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
----
- Xext/sync.c | 23 ++++++++++++++++++++++-
- 1 file changed, 22 insertions(+), 1 deletion(-)
-
-diff --git a/Xext/sync.c b/Xext/sync.c
-index 0079e85ed..69a28ec14 100644
---- a/Xext/sync.c
-+++ b/Xext/sync.c
-@@ -718,8 +718,29 @@ SyncChangeCounter(SyncCounter * pCounter, int64_t newval)
-     /* run through triggers to see if any become true */
-     for (ptl = pCounter->sync.pTriglist; ptl; ptl = pnext) {
-         pnext = ptl->next;
--        if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, oldval))
-+        if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, oldval)) {
-             (*ptl->pTrigger->TriggerFired) (ptl->pTrigger);
-+            /* TriggerFired may have called SyncDeleteTriggerFromSyncObject
-+             * for sibling triggers in the same Await group, freeing their
-+             * trigger list nodes - potentially including pnext. Verify
-+             * pnext is still on the counter's trigger list; if not,
-+             * restart from the list head.
-+             *
-+             * Unlike miSyncTriggerFence() we cannot use a do/while
-+             * restart loop here: counter trigger lists may contain alarm
-+             * triggers which are not removed after firing and would cause
-+             * an infinite loop when delta is 0.
-+             */
-+            if (pnext) {
-+                SyncTriggerList *tmp;
-+                for (tmp = pCounter->sync.pTriglist; tmp; tmp = tmp->next) {
-+                    if (tmp == pnext)
-+                        break;
-+                }
-+                if (!tmp)
-+                    pnext = pCounter->sync.pTriglist;
-+            }
-+        }
-     }
- 
-     if (IsSystemCounter(pCounter)) {
--- 
-2.54.0
-

SOURCES/0002-xfixes-Fix-out-of-bounds-access-in-ProcXFixesCreateP.patch

@@ -1,44 +0,0 @@
-From 6bb8aeb30a2686facc48733016caade97ece10ad Mon Sep 17 00:00:00 2001
-From: Povilas Kanapickas <povilas@radix.lt>
-Date: Tue, 14 Dec 2021 15:00:01 +0200
-Subject: [PATCH xserver 2/4] xfixes: Fix out of bounds access in
- *ProcXFixesCreatePointerBarrier()
-
-ZDI-CAN-14950, CVE-2021-4009
-
-This vulnerability was discovered and the fix was suggested by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
-(cherry picked from commit b5196750099ae6ae582e1f46bd0a6dad29550e02)
----
- xfixes/cursor.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/xfixes/cursor.c b/xfixes/cursor.c
-index d4b68f3af..5f531a89a 100644
---- a/xfixes/cursor.c
-+++ b/xfixes/cursor.c
-@@ -1010,7 +1010,8 @@ ProcXFixesCreatePointerBarrier(ClientPtr client)
- {
-     REQUEST(xXFixesCreatePointerBarrierReq);
- 
--    REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
-+    REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
-+                       pad_to_int32(stuff->num_devices * sizeof(CARD16)));
-     LEGAL_NEW_RESOURCE(stuff->barrier, client);
- 
-     return XICreatePointerBarrier(client, stuff);
-@@ -1027,7 +1028,8 @@ SProcXFixesCreatePointerBarrier(ClientPtr client)
- 
-     swaps(&stuff->length);
-     swaps(&stuff->num_devices);
--    REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
-+    REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
-+                       pad_to_int32(stuff->num_devices * sizeof(CARD16)));
- 
-     swapl(&stuff->barrier);
-     swapl(&stuff->window);
--- 
-2.33.1
-

SOURCES/0002-xkb-Fix-bounds-check-in-_CheckSetGeom.patch

@@ -1,70 +0,0 @@
-From 229b7ab7ee48cf9640d635d7db7e32ce00fcb8be Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Wed, 18 Feb 2026 16:03:11 +0100
-Subject: [PATCH xserver 2/6] xkb: Fix bounds check in _CheckSetGeom()
-
-As reported by valgrind:
-
-  == Conditional jump or move depends on uninitialised value(s)
-  ==    at 0x5CBE66: SrvXkbAddGeomKeyAlias (XKBGAlloc.c:585)
-  ==    by 0x5AC7D5: _CheckSetGeom (xkb.c:5607)
-  ==    by 0x5AC952: _XkbSetGeometry (xkb.c:5643)
-  ==    by 0x5ACB58: ProcXkbSetGeometry (xkb.c:5684)
-  ==    by 0x5B0DAC: ProcXkbDispatch (xkb.c:7070)
-  ==    by 0x4A28C5: Dispatch (dispatch.c:553)
-  ==    by 0x4B0B24: dix_main (main.c:274)
-  ==    by 0x42915E: main (stubmain.c:34)
-  ==  Uninitialised value was created by a heap allocation
-  ==    at 0x4840B26: malloc (vg_replace_malloc.c:447)
-  ==    by 0x5E13B0: AllocateInputBuffer (io.c:981)
-  ==    by 0x5E05CD: InsertFakeRequest (io.c:516)
-  ==    by 0x4AA860: NextAvailableClient (dispatch.c:3629)
-  ==    by 0x5DE0D7: AllocNewConnection (connection.c:628)
-  ==    by 0x5DE2C6: EstablishNewConnections (connection.c:692)
-  ==    by 0x5DE600: HandleNotifyFd (connection.c:809)
-  ==    by 0x5E2598: ospoll_wait (ospoll.c:660)
-  ==    by 0x5DA00C: WaitForSomething (WaitFor.c:208)
-  ==    by 0x4A26E5: Dispatch (dispatch.c:493)
-  ==    by 0x4B0B24: dix_main (main.c:274)
-  ==    by 0x42915E: main (stubmain.c:34)
-
-Each key alias entry contains two key names (the alias and the real key
-name), each of size XkbKeyNameLength.
-
-The current bounds check only validates the first name, allowing
-XkbAddGeomKeyAlias to potentially read uninitialized memory when
-accessing the second name at &wire[XkbKeyNameLength].
-
-To fix this, change the value to check to use 2 * XkbKeyNameLength to
-validate the bounds.
-
-CVE-2026-34000, ZDI-CAN-28679
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with TrendAI Zero Day Initiative
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
-(cherry picked from commit 81b6a34f90b28c32ad499a78a4f391b7c06daea2)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2178>
----
- xkb/xkb.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/xkb/xkb.c b/xkb/xkb.c
-index b002da5bc..9cd2afdb8 100644
---- a/xkb/xkb.c
-+++ b/xkb/xkb.c
-@@ -5602,7 +5602,7 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSetGeometryReq * req, ClientPtr client)
-     }
- 
-     for (i = 0; i < req->nKeyAliases; i++) {
--        if (!_XkbCheckRequestBounds(client, req, wire, wire + XkbKeyNameLength))
-+        if (!_XkbCheckRequestBounds(client, req, wire, wire + 2 * XkbKeyNameLength))
-                 return BadLength;
- 
-         if (XkbAddGeomKeyAlias(geom, &wire[XkbKeyNameLength], wire) == NULL)
--- 
-2.53.0
-

SOURCES/0002-xkb-Make-the-RT_XKBCLIENT-resource-private.patch

@@ -1,59 +0,0 @@
-From a1d4f04bbd46957af854bea3b23d0dcb31b38afd Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Wed, 10 Sep 2025 15:55:06 +0200
-Subject: [PATCH xserver 2/4] xkb: Make the RT_XKBCLIENT resource private
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Currently, the resource in only available to the xkb.c source file.
-
-In preparation for the next commit, to be able to free the resources
-from XkbRemoveResourceClient(), make that variable private instead.
-
-This is related to:
-
-CVE-2025-62230, ZDI-CAN-27545
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
-(cherry picked from commit 99790a2c9205a52fbbec01f21a92c9b7f4ed1d8f)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2088>
----
- include/xkbsrv.h | 2 ++
- xkb/xkb.c        | 2 +-
- 2 files changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/include/xkbsrv.h b/include/xkbsrv.h
-index bd747856b..d801cd4b8 100644
---- a/include/xkbsrv.h
-+++ b/include/xkbsrv.h
-@@ -58,6 +58,8 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
- #include "inputstr.h"
- #include "events.h"
- 
-+extern RESTYPE RT_XKBCLIENT;
-+
- typedef struct _XkbInterest {
-     DeviceIntPtr dev;
-     ClientPtr client;
-diff --git a/xkb/xkb.c b/xkb/xkb.c
-index ac154e200..6c102af0a 100644
---- a/xkb/xkb.c
-+++ b/xkb/xkb.c
-@@ -50,7 +50,7 @@ int XkbKeyboardErrorCode;
- CARD32 xkbDebugFlags = 0;
- static CARD32 xkbDebugCtrls = 0;
- 
--static RESTYPE RT_XKBCLIENT;
-+RESTYPE RT_XKBCLIENT = 0;
- 
- /***====================================================================***/
- 
--- 
-2.51.1
-

SOURCES/0003-Xext-Fix-out-of-bounds-access-in-SProcScreenSaverSus.patch

@@ -1,34 +0,0 @@
-From 67425fcab50ef24a5617e109897f38876dd81277 Mon Sep 17 00:00:00 2001
-From: Povilas Kanapickas <povilas@radix.lt>
-Date: Tue, 14 Dec 2021 15:00:02 +0200
-Subject: [PATCH xserver 3/4] Xext: Fix out of bounds access in
- SProcScreenSaverSuspend()
-
-ZDI-CAN-14951, CVE-2021-4010
-
-This vulnerability was discovered and the fix was suggested by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
-(cherry picked from commit 6c4c53010772e3cb4cb8acd54950c8eec9c00d21)
----
- Xext/saver.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Xext/saver.c b/Xext/saver.c
-index c27a66c80..c23907dbb 100644
---- a/Xext/saver.c
-+++ b/Xext/saver.c
-@@ -1351,8 +1351,8 @@ SProcScreenSaverSuspend(ClientPtr client)
-     REQUEST(xScreenSaverSuspendReq);
- 
-     swaps(&stuff->length);
--    swapl(&stuff->suspend);
-     REQUEST_SIZE_MATCH(xScreenSaverSuspendReq);
-+    swapl(&stuff->suspend);
-     return ProcScreenSaverSuspend(client);
- }
- 
--- 
-2.33.1
-

SOURCES/0003-miext-sync-Fix-use-after-free-in-miSyncTriggerFence.patch

@@ -1,103 +0,0 @@
-From f6638d751790ee3f5ca672a9db303bbf5b66d020 Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Wed, 18 Feb 2026 16:23:23 +0100
-Subject: [PATCH xserver 3/6] miext/sync: Fix use-after-free in
- miSyncTriggerFence()
-
-As reported by valgrind:
-
-  == Invalid read of size 8
-  ==    at 0x568C14: miSyncTriggerFence (misync.c:140)
-  ==    by 0x540688: ProcSyncTriggerFence (sync.c:1957)
-  ==    by 0x540CCC: ProcSyncDispatch (sync.c:2152)
-  ==    by 0x4A28C5: Dispatch (dispatch.c:553)
-  ==    by 0x4B0B24: dix_main (main.c:274)
-  ==    by 0x42915E: main (stubmain.c:34)
-  ==  Address 0x17e35488 is 8 bytes inside a block of size 16 free'd
-  ==    at 0x4843E43: free (vg_replace_malloc.c:990)
-  ==    by 0x53D683: SyncDeleteTriggerFromSyncObject (sync.c:169)
-  ==    by 0x53F14D: FreeAwait (sync.c:1208)
-  ==    by 0x4DFB06: doFreeResource (resource.c:888)
-  ==    by 0x4DFC59: FreeResource (resource.c:918)
-  ==    by 0x53E349: SyncAwaitTriggerFired (sync.c:701)
-  ==    by 0x568C52: miSyncTriggerFence (misync.c:142)
-  ==    by 0x540688: ProcSyncTriggerFence (sync.c:1957)
-  ==    by 0x540CCC: ProcSyncDispatch (sync.c:2152)
-  ==    by 0x4A28C5: Dispatch (dispatch.c:553)
-  ==    by 0x4B0B24: dix_main (main.c:274)
-  ==    by 0x42915E: main (stubmain.c:34)
-  ==  Block was alloc'd at
-  ==    at 0x4840B26: malloc (vg_replace_malloc.c:447)
-  ==    by 0x5E50E1: XNFalloc (utils.c:1129)
-  ==    by 0x53D772: SyncAddTriggerToSyncObject (sync.c:206)
-  ==    by 0x53DCA8: SyncInitTrigger (sync.c:414)
-  ==    by 0x5409C7: ProcSyncAwaitFence (sync.c:2089)
-  ==    by 0x540D04: ProcSyncDispatch (sync.c:2160)
-  ==    by 0x4A28C5: Dispatch (dispatch.c:553)
-  ==    by 0x4B0B24: dix_main (main.c:274)
-  ==    by 0x42915E: main (stubmain.c:34)
-
-When walking the list of fences to trigger, miSyncTriggerFence() may
-call TriggerFence() for the current trigger, which end up calling the
-function SyncAwaitTriggerFired().
-
-SyncAwaitTriggerFired() frees the entire await resource, which removes
-all triggers from that await - including pNext which may be another
-trigger from the same await attached to the same fence.
-
-On the next iteration, ptl = pNext points to freed memory...
-
-To avoid the issue, we need to restart the iteration from the beginning
-of the list each time a trigger fires, since the callback can modify the
-list.
-
-CVE-2026-34001, ZDI-CAN-28706
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with TrendAI Zero Day Initiative
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
-(cherry picked from commit f19ab94ba9c891d801231654267556dc7f32b5e0)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2178>
----
- miext/sync/misync.c | 18 ++++++++++++------
- 1 file changed, 12 insertions(+), 6 deletions(-)
-
-diff --git a/miext/sync/misync.c b/miext/sync/misync.c
-index 0931803f6..9a6fbbd4a 100644
---- a/miext/sync/misync.c
-+++ b/miext/sync/misync.c
-@@ -131,16 +131,22 @@ miSyncDestroyFence(SyncFence * pFence)
- void
- miSyncTriggerFence(SyncFence * pFence)
- {
--    SyncTriggerList *ptl, *pNext;
-+    SyncTriggerList *ptl;
-+    Bool triggered;
- 
-     pFence->funcs.SetTriggered(pFence);
- 
-     /* run through triggers to see if any fired */
--    for (ptl = pFence->sync.pTriglist; ptl; ptl = pNext) {
--        pNext = ptl->next;
--        if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, 0))
--            (*ptl->pTrigger->TriggerFired) (ptl->pTrigger);
--    }
-+    do {
-+        triggered = FALSE;
-+        for (ptl = pFence->sync.pTriglist; ptl; ptl = ptl->next) {
-+            if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, 0)) {
-+                (*ptl->pTrigger->TriggerFired) (ptl->pTrigger);
-+                triggered = TRUE;
-+                break;
-+            }
-+        }
-+    } while (triggered);
- }
- 
- SyncScreenFuncsPtr
--- 
-2.53.0
-

SOURCES/0003-os-Check-for-integer-overflow-on-BigRequest-length.patch

@@ -1,35 +0,0 @@
-From d5b66f2b1f3d9a322261d150e0da4e707a337334 Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Wed, 18 Jun 2025 08:39:02 +0200
-Subject: [PATCH xserver 3/7] os: Check for integer overflow on BigRequest
- length
-
-Check for another possible integer overflow once we get a complete xReq
-with BigRequest.
-
-Related to CVE-2025-49176
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Suggested-by: Peter Harris <pharris2@rocketsoftware.com>
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2028>
-(cherry picked from commit 4fc4d76b2c7aaed61ed2653f997783a3714c4fe1)
----
- os/io.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/os/io.c b/os/io.c
-index a05300869..de5b3c921 100644
---- a/os/io.c
-+++ b/os/io.c
-@@ -395,6 +395,8 @@ ReadRequestFromClient(ClientPtr client)
-                     needed = get_big_req_len(request, client);
-             }
-             client->req_len = needed;
-+            if (needed > MAXINT >> 2)
-+                return -(BadLength);
-             needed <<= 2;
-         }
-         if (gotnow < needed) {
--- 
-2.49.0
-

SOURCES/0003-panoramix-avoid-null-dereference-in-PanoramiXMaybeAd.patch

@@ -1,49 +0,0 @@
-From 5e657943933a79166d2020ee978abd8afa5fccfe Mon Sep 17 00:00:00 2001
-From: Alan Coopersmith <alan.coopersmith@oracle.com>
-Date: Sat, 20 Sep 2025 16:35:46 -0700
-Subject: [PATCH xserver 03/51] panoramix: avoid null dereference in
- PanoramiXMaybeAddDepth()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Reported in #1817:
-
-Error: GCC_ANALYZER_WARNING (CWE-476): [#def4]
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:748:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘PanoramiXDepths’
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:802:1: enter_function: entry to ‘PanoramiXConsolidate’
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:813:17: branch_true: following ‘true’ branch...
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:814:9: branch_true: ...to here
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:814:9: call_function: calling ‘PanoramiXMaybeAddDepth’ from ‘PanoramiXConsolidate’
-746|       PanoramiXDepths = reallocarray(PanoramiXDepths,
-747|                                      PanoramiXNumDepths, sizeof(DepthRec));
-748|->     PanoramiXDepths[j].depth = pDepth->depth;
-749|       PanoramiXDepths[j].numVids = 0;
-750|       PanoramiXDepths[j].vids = NULL;
-
-Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
-(cherry picked from commit 537b56cccaf1759f9beef9396463b1f412614003)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
----
- Xext/panoramiX.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Xext/panoramiX.c b/Xext/panoramiX.c
-index bd9c45b03..00585e3f6 100644
---- a/Xext/panoramiX.c
-+++ b/Xext/panoramiX.c
-@@ -747,8 +747,8 @@ PanoramiXMaybeAddDepth(DepthPtr pDepth)
- 
-     j = PanoramiXNumDepths;
-     PanoramiXNumDepths++;
--    PanoramiXDepths = reallocarray(PanoramiXDepths,
--                                   PanoramiXNumDepths, sizeof(DepthRec));
-+    PanoramiXDepths = XNFreallocarray(PanoramiXDepths,
-+                                      PanoramiXNumDepths, sizeof(DepthRec));
-     PanoramiXDepths[j].depth = pDepth->depth;
-     PanoramiXDepths[j].numVids = 0;
-     PanoramiXDepths[j].vids = NULL;
--- 
-2.54.0
-

SOURCES/0003-xkb-Free-the-XKB-resource-when-freeing-XkbInterest.patch

@@ -1,89 +0,0 @@
-From 1abca0b9b5b019cda32aa92466a760660ebd952d Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Wed, 10 Sep 2025 15:58:57 +0200
-Subject: [PATCH xserver 3/4] xkb: Free the XKB resource when freeing
- XkbInterest
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-XkbRemoveResourceClient() would free the XkbInterest data associated
-with the device, but not the resource associated with it.
-
-As a result, when the client terminates, the resource delete function
-gets called and accesses already freed memory:
-
- | Invalid read of size 8
- |   at 0x5BC0C0: XkbRemoveResourceClient (xkbEvents.c:1047)
- |   by 0x5B3391: XkbClientGone (xkb.c:7094)
- |   by 0x4DF138: doFreeResource (resource.c:890)
- |   by 0x4DFB50: FreeClientResources (resource.c:1156)
- |   by 0x4A9A59: CloseDownClient (dispatch.c:3550)
- |   by 0x5E0A53: ClientReady (connection.c:601)
- |   by 0x5E4FEF: ospoll_wait (ospoll.c:657)
- |   by 0x5DC834: WaitForSomething (WaitFor.c:206)
- |   by 0x4A1BA5: Dispatch (dispatch.c:491)
- |   by 0x4B0070: dix_main (main.c:277)
- |   by 0x4285E7: main (stubmain.c:34)
- | Address 0x1893e278 is 184 bytes inside a block of size 928 free'd
- |   at 0x4842E43: free (vg_replace_malloc.c:989)
- |   by 0x49C1A6: CloseDevice (devices.c:1067)
- |   by 0x49C522: CloseOneDevice (devices.c:1193)
- |   by 0x49C6E4: RemoveDevice (devices.c:1244)
- |   by 0x5873D4: remove_master (xichangehierarchy.c:348)
- |   by 0x587921: ProcXIChangeHierarchy (xichangehierarchy.c:504)
- |   by 0x579BF1: ProcIDispatch (extinit.c:390)
- |   by 0x4A1D85: Dispatch (dispatch.c:551)
- |   by 0x4B0070: dix_main (main.c:277)
- |   by 0x4285E7: main (stubmain.c:34)
- | Block was alloc'd at
- |   at 0x48473F3: calloc (vg_replace_malloc.c:1675)
- |   by 0x49A118: AddInputDevice (devices.c:262)
- |   by 0x4A0E58: AllocDevicePair (devices.c:2846)
- |   by 0x5866EE: add_master (xichangehierarchy.c:153)
- |   by 0x5878C2: ProcXIChangeHierarchy (xichangehierarchy.c:493)
- |   by 0x579BF1: ProcIDispatch (extinit.c:390)
- |   by 0x4A1D85: Dispatch (dispatch.c:551)
- |   by 0x4B0070: dix_main (main.c:277)
- |   by 0x4285E7: main (stubmain.c:34)
-
-To avoid that issue, make sure to free the resources when freeing the
-device XkbInterest data.
-
-CVE-2025-62230, ZDI-CAN-27545
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
-(cherry picked from commit 10c94238bdad17c11707e0bdaaa3a9cd54c504be)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2088>
----
- xkb/xkbEvents.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/xkb/xkbEvents.c b/xkb/xkbEvents.c
-index f8f65d4a7..7c669c93e 100644
---- a/xkb/xkbEvents.c
-+++ b/xkb/xkbEvents.c
-@@ -1055,6 +1055,7 @@ XkbRemoveResourceClient(DevicePtr inDev, XID id)
-             autoCtrls = interest->autoCtrls;
-             autoValues = interest->autoCtrlValues;
-             client = interest->client;
-+            FreeResource(interest->resource, RT_XKBCLIENT);
-             free(interest);
-             found = TRUE;
-         }
-@@ -1066,6 +1067,7 @@ XkbRemoveResourceClient(DevicePtr inDev, XID id)
-                 autoCtrls = victim->autoCtrls;
-                 autoValues = victim->autoCtrlValues;
-                 client = victim->client;
-+                FreeResource(victim->resource, RT_XKBCLIENT);
-                 free(victim);
-                 found = TRUE;
-             }
--- 
-2.51.1
-

SOURCES/0003-xkb-reject-key-types-with-num_levels-exceeding-XkbMa.patch

@@ -1,50 +0,0 @@
-From 7841780e7b1d0e0f5f9bb98691eaffece19d06e1 Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Mon, 20 Apr 2026 11:17:41 +1000
-Subject: [PATCH xserver 3/9] xkb: reject key types with num_levels exceeding
- XkbMaxShiftLevel
-
-CheckKeyTypes validates incoming key type definitions from XkbSetMap
-requests but does not enforce an upper bound on numLevels. A client can set
-numLevels up to 255 on a non-canonical key type, which is stored in the
-server's type table.
-
-When ChangeKeyboardMapping later triggers XkbUpdateKeyTypesFromCore, the
-function XkbKeyTypesForCoreSymbols computes groupsWidth from num_levels and
-uses the XKB_OFFSET(g, l) = (g * groupsWidth) + l macro to index into
-tsyms[], a stack-allocated buffer of XkbMaxSymsPerKey (252) entries. With
-num_levels=255, groupsWidth=255, and indices reach up to 3*255+254 = 1019,
-overflowing the 252-element stack buffer by 767 KeySym-sized entries.
-
-Fix by rejecting numLevels values greater than XkbMaxShiftLevel (63) in
-CheckKeyTypes, alongside the existing lower-bound check for numLevels < 1.
-
-This vulnerability was discovered by:
-Anonymous working with TrendAI Zero Day Initiative
-
-ZDI-CAN-30160
-
-Assisted-by: Claude:claude-opus-4-6
-(cherry picked from commit 543e108516428fc8c3bea91d6563ad266f9a801e)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
----
- xkb/xkb.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/xkb/xkb.c b/xkb/xkb.c
-index 2139da7ee..f190be5eb 100644
---- a/xkb/xkb.c
-+++ b/xkb/xkb.c
-@@ -1644,7 +1644,7 @@ CheckKeyTypes(ClientPtr client,
-         }
-         n = i + req->firstType;
-         width = wire->numLevels;
--        if (width < 1) {
-+        if (width < 1 || width > XkbMaxShiftLevel) {
-             *nMapsRtrn = _XkbErrCode3(0x04, n, width);
-             return 0;
-         }
--- 
-2.54.0
-

SOURCES/0004-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch

@@ -1,48 +0,0 @@
-From b4f63879f2a5cf0578101591f26471238f944e9c Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Mon, 28 Apr 2025 10:46:03 +0200
-Subject: [PATCH xserver 4/7] os: Account for bytes to ignore when sharing
- input buffer
-
-When reading requests from the clients, the input buffer might be shared
-and used between different clients.
-
-If a given client sends a full request with non-zero bytes to ignore,
-the bytes to ignore may still be non-zero even though the request is
-full, in which case the buffer could be shared with another client who's
-request will not be processed because of those bytes to ignore, leading
-to a possible hang of the other client request.
-
-To avoid the issue, make sure we have zero bytes to ignore left in the
-input request when sharing the input buffer with another client.
-
-CVE-2025-49178
-
-This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
-reported by Julian Suleder via ERNW Vulnerability Disclosure.
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
-(cherry picked from commit d55c54cecb5e83eaa2d56bed5cc4461f9ba318c2)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2025>
----
- os/io.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/os/io.c b/os/io.c
-index de5b3c921..b7f2750b5 100644
---- a/os/io.c
-+++ b/os/io.c
-@@ -444,7 +444,7 @@ ReadRequestFromClient(ClientPtr client)
-      */
- 
-     gotnow -= needed;
--    if (!gotnow)
-+    if (!gotnow && !oci->ignoreBytes)
-         AvailableInput = oc;
-     if (move_header) {
-         if (client->req_len < bytes_to_int32(sizeof(xBigReq) - sizeof(xReq))) {
--- 
-2.49.0
-

SOURCES/0004-panoramix-avoid-null-dereference-in-PanoramiXConsoli.patch

@@ -1,71 +0,0 @@
-From bd7f4a48a5187dd32d3a0791a407432933af0c1d Mon Sep 17 00:00:00 2001
-From: Alan Coopersmith <alan.coopersmith@oracle.com>
-Date: Sat, 20 Sep 2025 16:45:59 -0700
-Subject: [PATCH xserver 04/51] panoramix: avoid null dereference in
- PanoramiXConsolidate()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Reported in #1817:
-
-Error: GCC_ANALYZER_WARNING (CWE-476): [#def5]
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:820:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘root’
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:819:12: acquire_memory: this call could return NULL
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:820:5: danger: ‘root’ could be NULL: unchecked value from (1)
-818|
-819|       root = malloc(sizeof(PanoramiXRes));
-820|->     root->type = XRT_WINDOW;
-821|       defmap = malloc(sizeof(PanoramiXRes));
-822|       defmap->type = XRT_COLORMAP;
-Error: GCC_ANALYZER_WARNING (CWE-476): [#def6]
-
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:822:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘defmap’
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:821:14: acquire_memory: this call could return NULL
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:822:5: danger: ‘defmap’ could be NULL: unchecked value from (1)
-820|       root->type = XRT_WINDOW;
-821|       defmap = malloc(sizeof(PanoramiXRes));
-822|->     defmap->type = XRT_COLORMAP;
-823|       saver = malloc(sizeof(PanoramiXRes));
-824|       saver->type = XRT_WINDOW;
-
-Error: GCC_ANALYZER_WARNING (CWE-476): [#def7]
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:824:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘saver’
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:823:13: acquire_memory: this call could return NULL
-xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:824:5: danger: ‘saver’ could be NULL: unchecked value from (1)
-822|       defmap->type = XRT_COLORMAP;
-823|       saver = malloc(sizeof(PanoramiXRes));
-824|->     saver->type = XRT_WINDOW;
-825|
-826|       FOR_NSCREENS(i) {
-
-Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
-(cherry picked from commit 23c103d41f35cc030b0c0e973f7f3bcb8d9902a0)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
----
- Xext/panoramiX.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/Xext/panoramiX.c b/Xext/panoramiX.c
-index 00585e3f6..2029b353d 100644
---- a/Xext/panoramiX.c
-+++ b/Xext/panoramiX.c
-@@ -820,11 +820,11 @@ PanoramiXConsolidate(void)
-     for (i = 0; i < pScreen->numVisuals; i++)
-         PanoramiXMaybeAddVisual(pVisual++);
- 
--    root = malloc(sizeof(PanoramiXRes));
-+    root = XNFcallocarray(1, sizeof(PanoramiXRes));
-     root->type = XRT_WINDOW;
--    defmap = malloc(sizeof(PanoramiXRes));
-+    defmap = XNFcallocarray(1, sizeof(PanoramiXRes));
-     defmap->type = XRT_COLORMAP;
--    saver = malloc(sizeof(PanoramiXRes));
-+    saver = XNFcallocarray(1, sizeof(PanoramiXRes));
-     saver->type = XRT_WINDOW;
- 
-     FOR_NSCREENS(i) {
--- 
-2.54.0
-

SOURCES/0004-render-Fix-out-of-bounds-access-in-SProcRenderCompos.patch

@@ -1,53 +0,0 @@
-From 35b4681c79480d980bd8dcba390146aad7817c47 Mon Sep 17 00:00:00 2001
-From: Povilas Kanapickas <povilas@radix.lt>
-Date: Tue, 14 Dec 2021 15:00:03 +0200
-Subject: [PATCH xserver 4/4] render: Fix out of bounds access in
- SProcRenderCompositeGlyphs()
-
-ZDI-CAN-14192, CVE-2021-4008
-
-This vulnerability was discovered and the fix was suggested by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
-(cherry picked from commit ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60)
----
- render/render.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/render/render.c b/render/render.c
-index c376090ca..456f156d4 100644
---- a/render/render.c
-+++ b/render/render.c
-@@ -2309,6 +2309,9 @@ SProcRenderCompositeGlyphs(ClientPtr client)
- 
-         i = elt->len;
-         if (i == 0xff) {
-+            if (buffer + 4 > end) {
-+                return BadLength;
-+            }
-             swapl((int *) buffer);
-             buffer += 4;
-         }
-@@ -2319,12 +2322,18 @@ SProcRenderCompositeGlyphs(ClientPtr client)
-                 buffer += i;
-                 break;
-             case 2:
-+                if (buffer + i * 2 > end) {
-+                    return BadLength;
-+                }
-                 while (i--) {
-                     swaps((short *) buffer);
-                     buffer += 2;
-                 }
-                 break;
-             case 4:
-+                if (buffer + i * 4 > end) {
-+                    return BadLength;
-+                }
-                 while (i--) {
-                     swapl((int *) buffer);
-                     buffer += 4;
--- 
-2.33.1
-

SOURCES/0004-xkb-Fix-out-of-bounds-read-in-CheckModifierMap.patch

@@ -1,91 +0,0 @@
-From 5842fd1fcce48ec98bdcce75b804210584ea35e2 Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Wed, 18 Feb 2026 17:02:09 +0100
-Subject: [PATCH xserver 4/6] xkb: Fix out-of-bounds read in CheckModifierMap()
-
-As reported by valgrind:
-
-  == Conditional jump or move depends on uninitialised value(s)
-  ==    at 0x547E5B: CheckModifierMap (xkb.c:1972)
-  ==    by 0x54A086: _XkbSetMapChecks (xkb.c:2574)
-  ==    by 0x54A845: ProcXkbSetMap (xkb.c:2741)
-  ==    by 0x556EF4: ProcXkbDispatch (xkb.c:7048)
-  ==    by 0x454A8C: Dispatch (dispatch.c:553)
-  ==    by 0x462CEB: dix_main (main.c:274)
-  ==    by 0x405EA7: main (stubmain.c:34)
-  ==  Uninitialised value was created by a heap allocation
-  ==    at 0x4840B26: malloc (vg_replace_malloc.c:447)
-  ==    by 0x592D5A: AllocateInputBuffer (io.c:981)
-  ==    by 0x591F77: InsertFakeRequest (io.c:516)
-  ==    by 0x45CA27: NextAvailableClient (dispatch.c:3629)
-  ==    by 0x58FA81: AllocNewConnection (connection.c:628)
-  ==    by 0x58FC70: EstablishNewConnections (connection.c:692)
-  ==    by 0x58FFAA: HandleNotifyFd (connection.c:809)
-  ==    by 0x593F42: ospoll_wait (ospoll.c:660)
-  ==    by 0x58B9B6: WaitForSomething (WaitFor.c:208)
-  ==    by 0x4548AC: Dispatch (dispatch.c:493)
-  ==    by 0x462CEB: dix_main (main.c:274)
-  ==    by 0x405EA7: main (stubmain.c:34)
-
-The issue is that the loop in CheckModifierMap() reads from wire without
-verifying that the data is within the request bounds.
-
-The req->totalModMapKeys value could exceed the actual data provided,
-causing reads of uninitialized memory.
-
-To fix that issue, we add a bounds check using _XkbCheckRequestBounds,
-but for that, we need to also pass a ClientPtr parameter, which is not
-a problem since CheckModifierMap() is a private, static function.
-
-CVE-2026-34002, ZDI-CAN-28737
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
-(cherry picked from commit f056ce1cc96ed9261052c31524162c78e458f98c)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2178>
----
- xkb/xkb.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/xkb/xkb.c b/xkb/xkb.c
-index 9cd2afdb8..f47ffbc5d 100644
---- a/xkb/xkb.c
-+++ b/xkb/xkb.c
-@@ -1940,8 +1940,8 @@ CheckKeyExplicit(XkbDescPtr xkb,
- }
- 
- static int
--CheckModifierMap(XkbDescPtr xkb, xkbSetMapReq * req, CARD8 **wireRtrn,
--                 int *errRtrn)
-+CheckModifierMap(ClientPtr client, XkbDescPtr xkb, xkbSetMapReq * req,
-+                 CARD8 **wireRtrn, int *errRtrn)
- {
-     register CARD8 *wire = *wireRtrn;
-     CARD8 *start;
-@@ -1965,6 +1965,10 @@ CheckModifierMap(XkbDescPtr xkb, xkbSetMapReq * req, CARD8 **wireRtrn,
-     }
-     start = wire;
-     for (i = 0; i < req->totalModMapKeys; i++, wire += 2) {
-+        if (!_XkbCheckRequestBounds(client, req, wire, wire + 2)) {
-+            *errRtrn = _XkbErrCode3(0x64, req->totalModMapKeys, i);
-+            return 0;
-+        }
-         if ((wire[0] < first) || (wire[0] > last)) {
-             *errRtrn = _XkbErrCode4(0x63, first, last, wire[0]);
-             return 0;
-@@ -2567,7 +2571,7 @@ _XkbSetMapChecks(ClientPtr client, DeviceIntPtr dev, xkbSetMapReq * req,
-         return BadValue;
-     }
-     if ((req->present & XkbModifierMapMask) &&
--        (!CheckModifierMap(xkb, req, (CARD8 **) &values, &error))) {
-+        (!CheckModifierMap(client, xkb, req, (CARD8 **) &values, &error))) {
-         client->errorValue = error;
-         return BadValue;
-     }
--- 
-2.53.0
-

SOURCES/0004-xkb-Prevent-overflow-in-XkbSetCompatMap.patch

@@ -1,49 +0,0 @@
-From c7beaec76c556870e5566b84dce7099bf28f9502 Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Wed, 10 Sep 2025 16:30:29 +0200
-Subject: [PATCH xserver 4/4] xkb: Prevent overflow in XkbSetCompatMap()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The XkbCompatMap structure stores its "num_si" and "size_si" fields
-using an unsigned short.
-
-However, the function _XkbSetCompatMap() will store the sum of the
-input data "firstSI" and "nSI" in both XkbCompatMap's "num_si" and
-"size_si" without first checking if the sum overflows the maximum
-unsigned short value, leading to a possible overflow.
-
-To avoid the issue, check whether the sum does not exceed the maximum
-unsigned short value, or return a "BadValue" error otherwise.
-
-CVE-2025-62231, ZDI-CAN-27560
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
-(cherry picked from commit 475d9f49acd0e55bc0b089ed77f732ad18585470)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2088>
----
- xkb/xkb.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/xkb/xkb.c b/xkb/xkb.c
-index 6c102af0a..a77fe7ff0 100644
---- a/xkb/xkb.c
-+++ b/xkb/xkb.c
-@@ -2990,6 +2990,8 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
-         XkbSymInterpretPtr sym;
-         unsigned int skipped = 0;
- 
-+        if ((unsigned) (req->firstSI + req->nSI) > USHRT_MAX)
-+            return BadValue;
-         if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
-             compat->num_si = compat->size_si = req->firstSI + req->nSI;
-             compat->sym_interpret = reallocarray(compat->sym_interpret,
--- 
-2.51.1
-

SOURCES/0004-xkb-clamp-nMaps-to-mapWidths-buffer-size-in-CheckKey.patch

@@ -1,53 +0,0 @@
-From 50b6eeda460f0badea82f689442461fea7f7af2a Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Mon, 20 Apr 2026 11:18:13 +1000
-Subject: [PATCH xserver 4/9] xkb: clamp nMaps to mapWidths buffer size in
- CheckKeyTypes
-
-CheckKeyTypes computes nMaps = firstType + nTypes from client-controlled
-request fields when XkbSetMapResizeTypes is set. This value is used to
-index mapWidths[], a stack-allocated CARD8 array of XkbMaxLegalKeyCode + 1
-(256) elements. No upper bound is enforced on nMaps.
-
-An attacker can first send SetMap(firstType=0, nTypes=255, ResizeTypes) to
-set the server's num_types to 255, then send SetMap(firstType=255,
-nTypes=10, ResizeTypes). The firstType > num_types check passes because
-255 > 255 is false (the check uses > rather than >=). nMaps is then
-computed as 265, and the loop writes mapWidths[255..264], overflowing 9
-bytes past the stack buffer into adjacent stack variables (symsPerKey[]).
-
-Fix by rejecting requests where firstType + nTypes would exceed the
-mapWidths buffer size (XkbMaxLegalKeyCode + 1).
-
-This vulnerability was discovered by:
-Anonymous working with TrendAI Zero Day Initiative
-
-ZDI-CAN-30161
-
-Assisted-by: Claude:claude-opus-4-6
-(cherry picked from commit 867b59b33bee669cb412f1314e47c52eacf6e00b)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
----
- xkb/xkb.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/xkb/xkb.c b/xkb/xkb.c
-index f190be5eb..f92ba9c3d 100644
---- a/xkb/xkb.c
-+++ b/xkb/xkb.c
-@@ -1617,6 +1617,11 @@ CheckKeyTypes(ClientPtr client,
-             *nMapsRtrn = _XkbErrCode4(0x02, req->firstType, req->nTypes, 4);
-             return 0;
-         }
-+        if (nMaps > XkbMaxLegalKeyCode + 1) {
-+            *nMapsRtrn = _XkbErrCode4(0x02, req->firstType, req->nTypes,
-+                                      XkbMaxLegalKeyCode + 1);
-+            return 0;
-+        }
-     }
-     else if (req->present & XkbKeyTypesMask) {
-         nMaps = xkb->map->num_types;
--- 
-2.54.0
-

SOURCES/0005-Xext-shm-avoid-null-dereference-in-ShmInitScreenPriv.patch

@@ -1,43 +0,0 @@
-From 70c8842c14764e0cfb343cbe4c29acfedb4b0bc3 Mon Sep 17 00:00:00 2001
-From: Alan Coopersmith <alan.coopersmith@oracle.com>
-Date: Sat, 4 Oct 2025 12:18:49 -0700
-Subject: [PATCH xserver 05/51] Xext/shm: avoid null dereference in
- ShmInitScreenPriv()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Reported in #1817:
-
-xwayland-24.1.6/redhat-linux-build/../Xext/shm.c:213:23: acquire_memory: this call could return NULL
-xwayland-24.1.6/redhat-linux-build/../Xext/shm.c:214:9: danger: ‘screen_priv’ could be NULL: unchecked value from [(19)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/18)
-#  212|       if (!screen_priv) {
-#  213|           screen_priv = calloc(1, sizeof(ShmScrPrivateRec));
-#  214|->         screen_priv->CloseScreen = pScreen->CloseScreen;
-#  215|           dixSetPrivate(&pScreen->devPrivates, shmScrPrivateKey, screen_priv);
-#  216|           pScreen->CloseScreen = ShmCloseScreen;
-
-Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
-(cherry picked from commit 87e53afd9c7f52a8fa3d1fed22db5380742cc7b7)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
----
- Xext/shm.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Xext/shm.c b/Xext/shm.c
-index 24c6b1087..2b23a15fe 100644
---- a/Xext/shm.c
-+++ b/Xext/shm.c
-@@ -210,7 +210,7 @@ ShmInitScreenPriv(ScreenPtr pScreen)
-     ShmScrPrivateRec *screen_priv = ShmGetScreenPriv(pScreen);
- 
-     if (!screen_priv) {
--        screen_priv = calloc(1, sizeof(ShmScrPrivateRec));
-+        screen_priv = XNFcallocarray(1, sizeof(ShmScrPrivateRec));
-         screen_priv->CloseScreen = pScreen->CloseScreen;
-         dixSetPrivate(&pScreen->devPrivates, shmScrPrivateKey, screen_priv);
-         pScreen->CloseScreen = ShmCloseScreen;
--- 
-2.54.0
-

SOURCES/0005-glx-fix-reversed-length-check-in-ChangeDrawableAttri.patch

@@ -1,154 +0,0 @@
-From f7f8b663c7d19cfbd29c8ea16ca6475d6a5f0af0 Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Mon, 20 Apr 2026 11:18:48 +1000
-Subject: [PATCH xserver 5/9] glx: fix reversed length check in
- ChangeDrawableAttributes
-
-The request length validation in __glXDisp_ChangeDrawableAttributes and
-__glXDispSwap_ChangeDrawableAttributes uses the wrong comparison direction.
-The check tests whether the computed request size is LESS THAN
-client->req_len, but should test whether it is GREATER THAN. With the
-reversed operator, an undersized request (where numAttribs claims more
-attribute pairs than the request actually contains) passes validation.
-
-DoChangeDrawableAttributes then iterates numAttribs attribute pairs starting
-from the end of the request header, reading past the actual request data
-into adjacent memory. This is an out-of-bounds read that can also cause
-an out-of-bounds write when a GLX_EVENT_MASK attribute key is found in the
-overread data and its corresponding value is written to pGlxDraw->eventMask.
-
-This patch effectively reverts commit 402b329c3aa8 ("glx: Work around
-wrong request lengths sent by mesa"). This was fixed in mesa commit
-4324d6fdfbba1 in 2011 (mesa 7.11).
-
-Fixes: 402b329c3aa8 ("glx: Work around wrong request lengths sent by mesa")
-
-This vulnerability was discovered by:
-Anonymous working with TrendAI Zero Day Initiative
-
-ZDI-CAN-30165
-
-Assisted-by: Claude:claude-opus-4-6
-(cherry picked from commit 6d459e4daf715bea8abdafa8fb130be2f8a1d145)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
----
- glx/glxcmds.c     | 21 +++++----------------
- glx/glxcmdsswap.c | 12 +++++-------
- 2 files changed, 10 insertions(+), 23 deletions(-)
-
-diff --git a/glx/glxcmds.c b/glx/glxcmds.c
-index 75e42823c..758308432 100644
---- a/glx/glxcmds.c
-+++ b/glx/glxcmds.c
-@@ -1122,8 +1122,7 @@ __glXDisp_GetFBConfigsSGIX(__GLXclientState * cl, GLbyte * pc)
-     ClientPtr client = cl->client;
-     xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc;
- 
--    /* work around mesa bug, don't use REQUEST_SIZE_MATCH */
--    REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq);
-+    REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq);
-     return DoGetFBConfigs(cl, req->screen);
- }
- 
-@@ -1344,9 +1343,7 @@ __glXDisp_DestroyPixmap(__GLXclientState * cl, GLbyte * pc)
-     ClientPtr client = cl->client;
-     xGLXDestroyPixmapReq *req = (xGLXDestroyPixmapReq *) pc;
- 
--    /* should be REQUEST_SIZE_MATCH, but mesa's glXDestroyPixmap used to set
--     * length to 3 instead of 2 */
--    REQUEST_AT_LEAST_SIZE(xGLXDestroyPixmapReq);
-+    REQUEST_SIZE_MATCH(xGLXDestroyPixmapReq);
- 
-     return DoDestroyDrawable(cl, req->glxpixmap, GLX_DRAWABLE_PIXMAP);
- }
-@@ -1495,14 +1492,8 @@ __glXDisp_ChangeDrawableAttributes(__GLXclientState * cl, GLbyte * pc)
-         client->errorValue = req->numAttribs;
-         return BadValue;
-     }
--#if 0
--    /* mesa sends an additional 8 bytes */
-+
-     REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3);
--#else
--    if (((sizeof(xGLXChangeDrawableAttributesReq) +
--          (req->numAttribs << 3)) >> 2) < client->req_len)
--        return BadLength;
--#endif
- 
-     return DoChangeDrawableAttributes(cl->client, req->drawable,
-                                       req->numAttribs, (CARD32 *) (req + 1));
-@@ -1569,8 +1560,7 @@ __glXDisp_DestroyWindow(__GLXclientState * cl, GLbyte * pc)
-     ClientPtr client = cl->client;
-     xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc;
- 
--    /* mesa's glXDestroyWindow used to set length to 3 instead of 2 */
--    REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq);
-+    REQUEST_SIZE_MATCH(xGLXDestroyWindowReq);
- 
-     return DoDestroyDrawable(cl, req->glxwindow, GLX_DRAWABLE_WINDOW);
- }
-@@ -1923,8 +1913,7 @@ __glXDisp_GetDrawableAttributes(__GLXclientState * cl, GLbyte * pc)
-     ClientPtr client = cl->client;
-     xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *) pc;
- 
--    /* this should be REQUEST_SIZE_MATCH, but mesa sends an additional 4 bytes */
--    REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq);
-+    REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq);
- 
-     return DoGetDrawableAttributes(cl, req->drawable);
- }
-diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c
-index 7d6674470..96382672a 100644
---- a/glx/glxcmdsswap.c
-+++ b/glx/glxcmdsswap.c
-@@ -235,7 +235,7 @@ __glXDispSwap_GetFBConfigsSGIX(__GLXclientState * cl, GLbyte * pc)
- 
-     __GLX_DECLARE_SWAP_VARIABLES;
- 
--    REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq);
-+    REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq);
- 
-     __GLX_SWAP_INT(&req->screen);
-     return __glXDisp_GetFBConfigsSGIX(cl, pc);
-@@ -327,7 +327,7 @@ __glXDispSwap_DestroyPixmap(__GLXclientState * cl, GLbyte * pc)
- 
-     __GLX_DECLARE_SWAP_VARIABLES;
- 
--    REQUEST_AT_LEAST_SIZE(xGLXDestroyGLXPixmapReq);
-+    REQUEST_SIZE_MATCH(xGLXDestroyGLXPixmapReq);
- 
-     __GLX_SWAP_SHORT(&req->length);
-     __GLX_SWAP_INT(&req->glxpixmap);
-@@ -440,9 +440,7 @@ __glXDispSwap_ChangeDrawableAttributes(__GLXclientState * cl, GLbyte * pc)
-         client->errorValue = req->numAttribs;
-         return BadValue;
-     }
--    if (((sizeof(xGLXChangeDrawableAttributesReq) +
--          (req->numAttribs << 3)) >> 2) < client->req_len)
--        return BadLength;
-+    REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3);
- 
-     attribs = (CARD32 *) (req + 1);
-     __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
-@@ -514,7 +512,7 @@ __glXDispSwap_DestroyWindow(__GLXclientState * cl, GLbyte * pc)
- 
-     __GLX_DECLARE_SWAP_VARIABLES;
- 
--    REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq);
-+    REQUEST_SIZE_MATCH(xGLXDestroyWindowReq);
- 
-     __GLX_SWAP_INT(&req->glxwindow);
- 
-@@ -723,7 +721,7 @@ __glXDispSwap_GetDrawableAttributes(__GLXclientState * cl, GLbyte * pc)
- 
-     __GLX_DECLARE_SWAP_VARIABLES;
- 
--    REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq);
-+    REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq);
- 
-     __GLX_SWAP_SHORT(&req->length);
-     __GLX_SWAP_INT(&req->drawable);
--- 
-2.54.0
-

SOURCES/0005-record-Check-for-overflow-in-RecordSanityCheckRegist.patch

@@ -1,64 +0,0 @@
-From d943eaa6b8584e7ceebd73ee59bd84e99b09be5d Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Mon, 28 Apr 2025 11:47:15 +0200
-Subject: [PATCH xserver 5/7] record: Check for overflow in
- RecordSanityCheckRegisterClients()
-
-The RecordSanityCheckRegisterClients() checks for the request length,
-but does not check for integer overflow.
-
-A client might send a very large value for either the number of clients
-or the number of protocol ranges that will cause an integer overflow in
-the request length computation, defeating the check for request length.
-
-To avoid the issue, explicitly check the number of clients against the
-limit of clients (which is much lower than an maximum integer value) and
-the number of protocol ranges (multiplied by the record length) do not
-exceed the maximum integer value.
-
-This way, we ensure that the final computation for the request length
-will not overflow the maximum integer limit.
-
-CVE-2025-49179
-
-This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
-reported by Julian Suleder via ERNW Vulnerability Disclosure.
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
-(cherry picked from commit 2bde9ca49a8fd9a1e6697d5e7ef837870d66f5d4)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2025>
----
- record/record.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/record/record.c b/record/record.c
-index a8aec23bd..afaceb55c 100644
---- a/record/record.c
-+++ b/record/record.c
-@@ -45,6 +45,7 @@ and Jim Haggerty of Metheus.
- #include "inputstr.h"
- #include "eventconvert.h"
- #include "scrnintstr.h"
-+#include "opaque.h"
- 
- #include <stdio.h>
- #include <assert.h>
-@@ -1298,6 +1299,13 @@ RecordSanityCheckRegisterClients(RecordContextPtr pContext, ClientPtr client,
-     int i;
-     XID recordingClient;
- 
-+    /* LimitClients is 2048 at max, way less that MAXINT */
-+    if (stuff->nClients > LimitClients)
-+        return BadValue;
-+
-+    if (stuff->nRanges > (MAXINT - 4 * stuff->nClients) / SIZEOF(xRecordRange))
-+        return BadValue;
-+
-     if (((client->req_len << 2) - SIZEOF(xRecordRegisterClientsReq)) !=
-         4 * stuff->nClients + SIZEOF(xRecordRange) * stuff->nRanges)
-         return BadLength;
--- 
-2.49.0
-

SOURCES/0005-xkb-Add-additional-bound-checking-in-CheckKeyTypes.patch

@@ -1,112 +0,0 @@
-From 5d6f378904ec5c7ae22e9ba4afd15e889a0a1df5 Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Mon, 23 Feb 2026 15:52:49 +0100
-Subject: [PATCH xserver 5/6] xkb: Add additional bound checking in
- CheckKeyTypes()
-
-The function CheckKeyTypes() will loop over the client's request but
-won't perform any additional bound checking to ensure that the data
-read remains within the request bounds.
-
-As a result, a specifically crafted request may cause CheckKeyTypes() to
-read past the request data, as reported by valgrind:
-
-  == Invalid read of size 2
-  ==    at 0x5A3D1D: CheckKeyTypes (xkb.c:1694)
-  ==    by 0x5A6A9C: _XkbSetMapChecks (xkb.c:2515)
-  ==    by 0x5A759E: ProcXkbSetMap (xkb.c:2736)
-  ==    by 0x5BF832: SProcXkbSetMap (xkbSwap.c:245)
-  ==    by 0x5C05ED: SProcXkbDispatch (xkbSwap.c:501)
-  ==    by 0x4A20DF: Dispatch (dispatch.c:551)
-  ==    by 0x4B03B4: dix_main (main.c:277)
-  ==    by 0x428941: main (stubmain.c:34)
-  ==  Address is 30 bytes after a block of size 28,672 in arena "client"
-  ==
-  == Invalid read of size 2
-  ==    at 0x5A3AB6: CheckKeyTypes (xkb.c:1669)
-  ==    by 0x5A6A9C: _XkbSetMapChecks (xkb.c:2515)
-  ==    by 0x5A759E: ProcXkbSetMap (xkb.c:2736)
-  ==    by 0x5BF832: SProcXkbSetMap (xkbSwap.c:245)
-  ==    by 0x5C05ED: SProcXkbDispatch (xkbSwap.c:501)
-  ==    by 0x4A20DF: Dispatch (dispatch.c:551)
-  ==    by 0x4B03B4: dix_main (main.c:277)
-  ==    by 0x428941: main (stubmain.c:34)
-  ==  Address is 2 bytes after a block of size 28,672 alloc'd
-  ==    at 0x4848897: realloc (vg_replace_malloc.c:1804)
-  ==    by 0x5E357A: ReadRequestFromClient (io.c:336)
-  ==    by 0x4A1FAB: Dispatch (dispatch.c:519)
-  ==    by 0x4B03B4: dix_main (main.c:277)
-  ==    by 0x428941: main (stubmain.c:34)
-  ==
-  == Invalid write of size 2
-  ==    at 0x5A3AD7: CheckKeyTypes (xkb.c:1669)
-  ==    by 0x5A6A9C: _XkbSetMapChecks (xkb.c:2515)
-  ==    by 0x5A759E: ProcXkbSetMap (xkb.c:2736)
-  ==    by 0x5BF832: SProcXkbSetMap (xkbSwap.c:245)
-  ==    by 0x5C05ED: SProcXkbDispatch (xkbSwap.c:501)
-  ==    by 0x4A20DF: Dispatch (dispatch.c:551)
-  ==    by 0x4B03B4: dix_main (main.c:277)
-  ==    by 0x428941: main (stubmain.c:34)
-  ==  Address is 2 bytes after a block of size 28,672 alloc'd
-  ==    at 0x4848897: realloc (vg_replace_malloc.c:1804)
-  ==    by 0x5E357A: ReadRequestFromClient (io.c:336)
-  ==    by 0x4A1FAB: Dispatch (dispatch.c:519)
-  ==    by 0x4B03B4: dix_main (main.c:277)
-  ==    by 0x428941: main (stubmain.c:34)
-  ==
-
-To avoid that issue, add additional bounds checking within the loops by
-calling _XkbCheckRequestBounds() and report an error if we are to read
-past the client's request.
-
-CVE-2026-34003, ZDI-CAN-28736
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with TrendAI Zero Day Initiative
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
-(cherry picked from commit b85b00dd7b9eee05e3c12e7ad1fce4fc6671507b)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2178>
----
- xkb/xkb.c | 15 +++++++++++++++
- 1 file changed, 15 insertions(+)
-
-diff --git a/xkb/xkb.c b/xkb/xkb.c
-index f47ffbc5d..1ee9cfb6f 100644
---- a/xkb/xkb.c
-+++ b/xkb/xkb.c
-@@ -1639,6 +1639,10 @@ CheckKeyTypes(ClientPtr client,
-     for (i = 0; i < req->nTypes; i++) {
-         unsigned width;
- 
-+        if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) {
-+            *nMapsRtrn = _XkbErrCode3(0x0b, req->nTypes, i);
-+            return 0;
-+        }
-         if (client->swapped) {
-             swaps(&wire->virtualMods);
-         }
-@@ -1664,7 +1668,18 @@ CheckKeyTypes(ClientPtr client,
-             xkbModsWireDesc *preWire;
- 
-             mapWire = (xkbKTSetMapEntryWireDesc *) &wire[1];
-+            if (!_XkbCheckRequestBounds(client, req, mapWire,
-+                                        &mapWire[wire->nMapEntries])) {
-+                *nMapsRtrn = _XkbErrCode3(0x0c, i, wire->nMapEntries);
-+                return 0;
-+            }
-             preWire = (xkbModsWireDesc *) &mapWire[wire->nMapEntries];
-+            if (wire->preserve &&
-+                !_XkbCheckRequestBounds(client, req, preWire,
-+                                        &preWire[wire->nMapEntries])) {
-+                *nMapsRtrn = _XkbErrCode3(0x0d, i, wire->nMapEntries);
-+                return 0;
-+            }
-             for (n = 0; n < wire->nMapEntries; n++) {
-                 if (client->swapped) {
-                     swaps(&mapWire[n].virtualMods);
--- 
-2.53.0
-

SOURCES/0006-Xext-sync-avoid-null-dereference-if-SysCounterGetPri.patch

@@ -1,90 +0,0 @@
-From 03aeaee358fc6a34a851f875d37df405240879c1 Mon Sep 17 00:00:00 2001
-From: Alan Coopersmith <alan.coopersmith@oracle.com>
-Date: Sat, 4 Oct 2025 15:26:19 -0700
-Subject: [PATCH xserver 06/51] Xext/sync: avoid null dereference if
- SysCounterGetPrivate() returns NULL
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Reported in #1817:
-
-xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2664:9: danger: dereference of NULL ‘SysCounterGetPrivate(pCounter)’
-# 2662|           SyncCounter *counter = pCounter;
-# 2663|           IdleCounterPriv *priv = SysCounterGetPrivate(counter);
-# 2664|->         deviceid = priv->deviceid;
-# 2665|       }
-# 2666|       else
-
-xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2677:14: danger: dereference of NULL ‘SysCounterGetPrivate(pCounter)’
-# 2675|       SyncCounter *counter = pCounter;
-# 2676|       IdleCounterPriv *priv = SysCounterGetPrivate(counter);
-# 2677|->     int64_t *less = priv->value_less;
-# 2678|       int64_t *greater = priv->value_greater;
-# 2679|       int64_t idle, old_idle;
-
-xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2767:14: danger: dereference of NULL ‘SysCounterGetPrivate(pCounter)’
-# 2765|       SyncCounter *counter = pCounter;
-# 2766|       IdleCounterPriv *priv = SysCounterGetPrivate(counter);
-# 2767|->     int64_t *less = priv->value_less;
-# 2768|       int64_t *greater = priv->value_greater;
-# 2769|       int64_t idle;
-
-xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2800:14: danger: dereference of NULL ‘SysCounterGetPrivate(pCounter)’
-# 2798|       SyncCounter *counter = pCounter;
-# 2799|       IdleCounterPriv *priv = SysCounterGetPrivate(counter);
-# 2800|->     int64_t *less = priv->value_less;
-# 2801|       int64_t *greater = priv->value_greater;
-# 2802|       Bool registered = (less || greater);
-
-Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
-(cherry picked from commit 0211de37b340eccfc0bad6a3ea13b27810b11a30)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
----
- Xext/sync.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/Xext/sync.c b/Xext/sync.c
-index c3d160327..09a14ac3c 100644
---- a/Xext/sync.c
-+++ b/Xext/sync.c
-@@ -2695,9 +2695,11 @@ IdleTimeQueryValue(void *pCounter, int64_t *pValue_return)
-     int deviceid;
-     CARD32 idle;
- 
-+    *pValue_return = 0;
-     if (pCounter) {
-         SyncCounter *counter = pCounter;
-         IdleCounterPriv *priv = SysCounterGetPrivate(counter);
-+        BUG_RETURN(priv == NULL);
-         deviceid = priv->deviceid;
-     }
-     else
-@@ -2711,6 +2713,7 @@ IdleTimeBlockHandler(void *pCounter, void *wt)
- {
-     SyncCounter *counter = pCounter;
-     IdleCounterPriv *priv = SysCounterGetPrivate(counter);
-+    BUG_RETURN(priv == NULL);
-     int64_t *less = priv->value_less;
-     int64_t *greater = priv->value_greater;
-     int64_t idle, old_idle;
-@@ -2801,6 +2804,7 @@ IdleTimeWakeupHandler(void *pCounter, int rc)
- {
-     SyncCounter *counter = pCounter;
-     IdleCounterPriv *priv = SysCounterGetPrivate(counter);
-+    BUG_RETURN(priv == NULL);
-     int64_t *less = priv->value_less;
-     int64_t *greater = priv->value_greater;
-     int64_t idle;
-@@ -2834,6 +2838,7 @@ IdleTimeBracketValues(void *pCounter, int64_t *pbracket_less,
- {
-     SyncCounter *counter = pCounter;
-     IdleCounterPriv *priv = SysCounterGetPrivate(counter);
-+    BUG_RETURN(priv == NULL);
-     int64_t *less = priv->value_less;
-     int64_t *greater = priv->value_greater;
-     Bool registered = (less || greater);
--- 
-2.54.0
-

SOURCES/0006-randr-Check-for-overflow-in-RRChangeProviderProperty.patch

@@ -1,43 +0,0 @@
-From 3d44c08d94e850769d7d16fce0596536370253b1 Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Tue, 20 May 2025 15:18:19 +0200
-Subject: [PATCH xserver 6/7] randr: Check for overflow in
- RRChangeProviderProperty()
-
-A client might send a request causing an integer overflow when computing
-the total size to allocate in RRChangeProviderProperty().
-
-To avoid the issue, check that total length in bytes won't exceed the
-maximum integer value.
-
-CVE-2025-49180
-
-This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
-reported by Julian Suleder via ERNW Vulnerability Disclosure.
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
-(cherry picked from commit 3c3a4b767b16174d3213055947ea7f4f88e10ec6)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2025>
----
- randr/rrproviderproperty.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c
-index b79c17f9b..7088570ee 100644
---- a/randr/rrproviderproperty.c
-+++ b/randr/rrproviderproperty.c
-@@ -179,7 +179,8 @@ RRChangeProviderProperty(RRProviderPtr provider, Atom property, Atom type,
- 
-     if (mode == PropModeReplace || len > 0) {
-         void *new_data = NULL, *old_data = NULL;
--
-+        if (total_len > MAXINT / size_in_bytes)
-+            return BadValue;
-         total_size = total_len * size_in_bytes;
-         new_value.data = (void *) malloc(total_size);
-         if (!new_value.data && total_size) {
--- 
-2.49.0
-

SOURCES/0006-saver-re-fetch-screen-private-after-CheckScreenPriva.patch

@@ -1,74 +0,0 @@
-From 637343690922ccd44bedf4e524357b0593067fa2 Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Mon, 20 Apr 2026 11:19:20 +1000
-Subject: [PATCH xserver 6/9] saver: re-fetch screen private after
- CheckScreenPrivate in CreateSaverWindow
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-CreateSaverWindow stores pPriv (the ScreenSaverScreenPrivatePtr) in a local
-variable via the SetupScreen macro at function entry. When an existing saver
-window is being replaced, the function sets pPriv->hasWindow = FALSE and
-calls CheckScreenPrivate(). If at this point pPriv->attr is NULL (cleared
-by a prior UnsetAttributes call), pPriv->events is NULL, and
-pPriv->installedMap is None, then CheckScreenPrivate determines the screen
-private is unused, frees it, and sets the screen private pointer to NULL.
-
-The function then continues to dereference the now-freed pPriv on the very
-next line (pPriv->attr), resulting in a use-after-free. On glibc 2.34+,
-the tcache key at offset 8 within the freed block makes pPriv->attr appear
-non-NULL, causing the function to continue operating on garbage data and
-eventually crash.
-
-The attack sequence is:
-  1. SetAttributes (creates pPriv with pPriv->attr set)
-  2. ForceScreenSaver(Active) (creates saver window, pPriv->hasWindow=TRUE)
-  3. UnsetAttributes (sets pPriv->attr = NULL)
-  4. ForceScreenSaver(Active) (re-enters CreateSaverWindow → UAF)
-
-Fix by re-fetching pPriv from the screen private after CheckScreenPrivate
-returns, so the subsequent NULL check correctly detects the freed state.
-
-ScreenSaverFreeAttr has the same pattern, force pPriv to NULL there too
-even though it has no real effect.
-
-This vulnerability was discovered by:
-Anonymous working with TrendAI Zero Day Initiative
-
-ZDI-CAN-30168
-
-Assisted-by: Claude:claude-opus-4-6
-(cherry picked from commit ecc634f1b2f7aa473d3a267eada98c4918bf9e05)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
----
- Xext/saver.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/Xext/saver.c b/Xext/saver.c
-index c27a66c80..f750ef4cd 100644
---- a/Xext/saver.c
-+++ b/Xext/saver.c
-@@ -348,6 +348,9 @@ ScreenSaverFreeAttr(void *value, XID id)
-         dixSaveScreens(serverClient, SCREEN_SAVER_FORCER, ScreenSaverActive);
-     }
-     CheckScreenPrivate(pScreen);
-+    /* CheckScreenPrivate may have freed pPriv (same pattern as
-+     * CreateSaverWindow fix for ZDI-CAN-30168). */
-+    pPriv = NULL;
-     return TRUE;
- }
- 
-@@ -479,6 +482,8 @@ CreateSaverWindow(ScreenPtr pScreen)
-             UninstallSaverColormap(pScreen);
-             pPriv->hasWindow = FALSE;
-             CheckScreenPrivate(pScreen);
-+            /* Re-fetch pPriv since CheckScreenPrivate may have freed it */
-+            pPriv = GetScreenPrivate(pScreen);
-         }
-     }
- 
--- 
-2.54.0
-

SOURCES/0006-xkb-Add-more-_XkbCheckRequestBounds.patch

@@ -1,221 +0,0 @@
-From 7c03d504c2b6ca498e0ff3761b000d77788f0c23 Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Mon, 2 Mar 2026 14:09:57 +0100
-Subject: [PATCH xserver 6/6] xkb: Add more _XkbCheckRequestBounds()
-
-Similar to the recent fixes, add more _XkbCheckRequestBounds() to the
-functions that loop over the request data, i.e.:
-
- * CheckKeySyms()
- * CheckKeyActions()
- * CheckKeyBehaviors()
- * CheckVirtualMods()
- * CheckKeyExplicit()
- * CheckVirtualModMap()
- * _XkbSetMapChecks()
-
-All these are static functions so we can add the client to the parameters
-without breaking any API.
-
-See also:
-CVE-2026-34003, ZDI-CAN-28736, CVE-2026-34002, ZDI-CAN-28737
-
-v2: Check for "nSyms != 0" in CheckKeySyms() to avoid false positives.
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
-(cherry picked from commit d38c563fab5c4a554e0939da39e4d1dadef7cbae)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2178>
----
- xkb/xkb.c | 69 ++++++++++++++++++++++++++++++++++++++++++++-----------
- 1 file changed, 55 insertions(+), 14 deletions(-)
-
-diff --git a/xkb/xkb.c b/xkb/xkb.c
-index 1ee9cfb6f..f81d20655 100644
---- a/xkb/xkb.c
-+++ b/xkb/xkb.c
-@@ -1752,6 +1752,11 @@ CheckKeySyms(ClientPtr client,
-         KeySym *pSyms;
-         register unsigned nG;
- 
-+        /* Check we received enough data to read the next xkbSymMapWireDesc */
-+        if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) {
-+            *errorRtrn = _XkbErrCode3(0x18, i + req->firstKeySym, i);
-+            return 0;
-+        }
-         if (client->swapped) {
-             swaps(&wire->nSyms);
-         }
-@@ -1790,6 +1795,12 @@ CheckKeySyms(ClientPtr client,
-             return 0;
-         }
-         pSyms = (KeySym *) &wire[1];
-+        if (wire->nSyms != 0) {
-+            if (!_XkbCheckRequestBounds(client, req, pSyms, &pSyms[wire->nSyms])) {
-+                *errorRtrn = _XkbErrCode3(0x19, i + req->firstKeySym, wire->nSyms);
-+                return 0;
-+            }
-+        }
-         wire = (xkbSymMapWireDesc *) &pSyms[wire->nSyms];
-     }
- 
-@@ -1813,11 +1824,12 @@ CheckKeySyms(ClientPtr client,
- }
- 
- static int
--CheckKeyActions(XkbDescPtr xkb,
--                xkbSetMapReq * req,
--                int nTypes,
--                CARD8 *mapWidths,
--                CARD16 *symsPerKey, CARD8 **wireRtrn, int *nActsRtrn)
-+CheckKeyActions(ClientPtr client,
-+               XkbDescPtr xkb,
-+               xkbSetMapReq * req,
-+               int nTypes,
-+               CARD8 *mapWidths,
-+               CARD16 *symsPerKey, CARD8 **wireRtrn, int *nActsRtrn)
- {
-     int nActs;
-     CARD8 *wire = *wireRtrn;
-@@ -1828,6 +1840,11 @@ CheckKeyActions(XkbDescPtr xkb,
-     CHK_REQ_KEY_RANGE2(0x21, req->firstKeyAct, req->nKeyActs, req, (*nActsRtrn),
-                        0);
-     for (nActs = i = 0; i < req->nKeyActs; i++) {
-+        /* Check we received enough data to read the next byte on the wire */
-+        if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) {
-+            *nActsRtrn = _XkbErrCode3(0x24, i + req->firstKeyAct, i);
-+            return 0;
-+        }
-         if (wire[0] != 0) {
-             if (wire[0] == symsPerKey[i + req->firstKeyAct])
-                 nActs += wire[0];
-@@ -1846,7 +1863,8 @@ CheckKeyActions(XkbDescPtr xkb,
- }
- 
- static int
--CheckKeyBehaviors(XkbDescPtr xkb,
-+CheckKeyBehaviors(ClientPtr client,
-+                  XkbDescPtr xkb,
-                   xkbSetMapReq * req,
-                   xkbBehaviorWireDesc ** wireRtrn, int *errorRtrn)
- {
-@@ -1872,6 +1890,11 @@ CheckKeyBehaviors(XkbDescPtr xkb,
-     }
- 
-     for (i = 0; i < req->totalKeyBehaviors; i++, wire++) {
-+        /* Check we received enough data to read the next behavior */
-+        if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) {
-+            *errorRtrn = _XkbErrCode3(0x36, first, i);
-+            return 0;
-+        }
-         if ((wire->key < first) || (wire->key > last)) {
-             *errorRtrn = _XkbErrCode4(0x33, first, last, wire->key);
-             return 0;
-@@ -1897,7 +1920,8 @@ CheckKeyBehaviors(XkbDescPtr xkb,
- }
- 
- static int
--CheckVirtualMods(XkbDescRec * xkb,
-+CheckVirtualMods(ClientPtr client,
-+                 XkbDescRec * xkb,
-                  xkbSetMapReq * req, CARD8 **wireRtrn, int *errorRtrn)
- {
-     register CARD8 *wire = *wireRtrn;
-@@ -1909,12 +1933,18 @@ CheckVirtualMods(XkbDescRec * xkb,
-         if (req->virtualMods & bit)
-             nMods++;
-     }
-+    /* Check we received enough data for the number of virtual mods expected */
-+    if (!_XkbCheckRequestBounds(client, req, wire, wire + XkbPaddedSize(nMods))) {
-+        *errorRtrn = _XkbErrCode3(0x37, nMods, i);
-+        return 0;
-+    }
-     *wireRtrn = (wire + XkbPaddedSize(nMods));
-     return 1;
- }
- 
- static int
--CheckKeyExplicit(XkbDescPtr xkb,
-+CheckKeyExplicit(ClientPtr client,
-+                 XkbDescPtr xkb,
-                  xkbSetMapReq * req, CARD8 **wireRtrn, int *errorRtrn)
- {
-     register CARD8 *wire = *wireRtrn;
-@@ -1940,6 +1970,11 @@ CheckKeyExplicit(XkbDescPtr xkb,
-     }
-     start = wire;
-     for (i = 0; i < req->totalKeyExplicit; i++, wire += 2) {
-+        /* Check we received enough data to read the next two bytes */
-+        if (!_XkbCheckRequestBounds(client, req, wire, wire + 2)) {
-+            *errorRtrn = _XkbErrCode4(0x54, first, last, i);
-+            return 0;
-+        }
-         if ((wire[0] < first) || (wire[0] > last)) {
-             *errorRtrn = _XkbErrCode4(0x53, first, last, wire[0]);
-             return 0;
-@@ -1995,7 +2030,8 @@ CheckModifierMap(ClientPtr client, XkbDescPtr xkb, xkbSetMapReq * req,
- }
- 
- static int
--CheckVirtualModMap(XkbDescPtr xkb,
-+CheckVirtualModMap(ClientPtr client,
-+                   XkbDescPtr xkb,
-                    xkbSetMapReq * req,
-                    xkbVModMapWireDesc ** wireRtrn, int *errRtrn)
- {
-@@ -2019,6 +2055,11 @@ CheckVirtualModMap(XkbDescPtr xkb,
-         return 0;
-     }
-     for (i = 0; i < req->totalVModMapKeys; i++, wire++) {
-+        /* Check we received enough data to read the next virtual mod map key */
-+        if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) {
-+            *errRtrn = _XkbErrCode3(0x74, first, i);
-+            return 0;
-+        }
-         if ((wire->key < first) || (wire->key > last)) {
-             *errRtrn = _XkbErrCode4(0x73, first, last, wire->key);
-             return 0;
-@@ -2562,7 +2603,7 @@ _XkbSetMapChecks(ClientPtr client, DeviceIntPtr dev, xkbSetMapReq * req,
-     }
- 
-     if ((req->present & XkbKeyActionsMask) &&
--        (!CheckKeyActions(xkb, req, nTypes, mapWidths, symsPerKey,
-+        (!CheckKeyActions(client, xkb, req, nTypes, mapWidths, symsPerKey,
-                           (CARD8 **) &values, &nActions))) {
-         client->errorValue = nActions;
-         return BadValue;
-@@ -2570,18 +2611,18 @@ _XkbSetMapChecks(ClientPtr client, DeviceIntPtr dev, xkbSetMapReq * req,
- 
-     if ((req->present & XkbKeyBehaviorsMask) &&
-         (!CheckKeyBehaviors
--         (xkb, req, (xkbBehaviorWireDesc **) &values, &error))) {
-+         (client, xkb, req, (xkbBehaviorWireDesc **) &values, &error))) {
-         client->errorValue = error;
-         return BadValue;
-     }
- 
-     if ((req->present & XkbVirtualModsMask) &&
--        (!CheckVirtualMods(xkb, req, (CARD8 **) &values, &error))) {
-+        (!CheckVirtualMods(client, xkb, req, (CARD8 **) &values, &error))) {
-         client->errorValue = error;
-         return BadValue;
-     }
-     if ((req->present & XkbExplicitComponentsMask) &&
--        (!CheckKeyExplicit(xkb, req, (CARD8 **) &values, &error))) {
-+        (!CheckKeyExplicit(client, xkb, req, (CARD8 **) &values, &error))) {
-         client->errorValue = error;
-         return BadValue;
-     }
-@@ -2592,7 +2633,7 @@ _XkbSetMapChecks(ClientPtr client, DeviceIntPtr dev, xkbSetMapReq * req,
-     }
-     if ((req->present & XkbVirtualModMapMask) &&
-         (!CheckVirtualModMap
--         (xkb, req, (xkbVModMapWireDesc **) &values, &error))) {
-+         (client, xkb, req, (xkbVModMapWireDesc **) &values, &error))) {
-         client->errorValue = error;
-         return BadValue;
-     }
--- 
-2.53.0
-

SOURCES/0007-Xext-sync-avoid-null-dereference-in-init_system_idle.patch

@@ -1,47 +0,0 @@
-From 2d2fcd6c83bbc174d1ae178388e7ae0d8297da56 Mon Sep 17 00:00:00 2001
-From: Alan Coopersmith <alan.coopersmith@oracle.com>
-Date: Sat, 4 Oct 2025 15:40:22 -0700
-Subject: [PATCH xserver 07/51] Xext/sync: avoid null dereference in
- init_system_idle_counter()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Reported in #1817:
-
-xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2835:33: acquire_memory: this call could return NULL
-xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2837:28: danger: ‘priv’ could be NULL: unchecked value from [(30)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/29)
-# 2835|           IdleCounterPriv *priv = malloc(sizeof(IdleCounterPriv));
-# 2836|
-# 2837|->         priv->value_less = priv->value_greater = NULL;
-# 2838|           priv->deviceid = deviceid;
-# 2839|
-
-Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
-(cherry picked from commit 304d21854d349b21dd8deb8a8f319637f17bd4a8)
-
-Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
----
- Xext/sync.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/Xext/sync.c b/Xext/sync.c
-index 09a14ac3c..8fd7e947e 100644
---- a/Xext/sync.c
-+++ b/Xext/sync.c
-@@ -2876,8 +2876,10 @@ init_system_idle_counter(const char *name, int deviceid)
-     if (idle_time_counter != NULL) {
-         IdleCounterPriv *priv = malloc(sizeof(IdleCounterPriv));
- 
--        priv->value_less = priv->value_greater = NULL;
--        priv->deviceid = deviceid;
-+        if (priv) {
-+            priv->value_less = priv->value_greater = NULL;
-+            priv->deviceid = deviceid;
-+        }
- 
-         idle_time_counter->pSysCounterInfo->private = priv;
-     }
--- 
-2.54.0
-