diff --git a/.gitignore b/.gitignore index 74001e1..dd40231 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ xorg-server-20100716.tar.xz xorg-server-1.8.99.906.tar.bz2 +xorg-server-1.9.0.tar.bz2 diff --git a/sources b/sources index 9edbba7..8807af4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -d4ab361cacc35e2ed4587019980b7e57 xorg-server-1.8.99.906.tar.bz2 +ba1173998a5a4216fd7b40eded96697e xorg-server-1.9.0.tar.bz2 diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index af2e324..a0fde8d 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -29,8 +29,8 @@ Summary: X.Org X11 X server Name: xorg-x11-server -Version: 1.8.99.906 -Release: 2%{?gitdate:.%{gitdate}}%{dist} +Version: 1.9.0 +Release: 1%{?gitdate:.%{gitdate}}%{dist} URL: http://www.x.org License: MIT Group: User Interface/X @@ -97,7 +97,6 @@ Patch6053: xserver-1.8-disable-vboxvideo.patch # https://bugs.freedesktop.org/show_bug.cgi?id=28672 Patch7000: xserver-1.8.0-no-xorg.patch -Patch7001: xserver-1.9-reset-root-null.patch %define moduledir %{_libdir}/xorg/modules %define drimoduledir %{_libdir}/dri @@ -547,6 +546,10 @@ rm -rf $RPM_BUILD_ROOT %{xserver_source_dir} %changelog +* Mon Aug 23 2010 Peter Hutterer 1.9.0-1 +- xserver 1.9.0 +- xserver-1.9-reset-root-null.patch: drop, upstream. + * Mon Aug 16 2010 Dave Airlie 1.8.99.906-2 - fix use-after-free for root window - hopefully fix (#596985) diff --git a/xserver-1.9-reset-root-null.patch b/xserver-1.9-reset-root-null.patch deleted file mode 100644 index 67e64a6..0000000 --- a/xserver-1.9-reset-root-null.patch +++ /dev/null @@ -1,59 +0,0 @@ -From d25c74c843b83e7c6acbeb52d4807559c83f98cb Mon Sep 17 00:00:00 2001 -From: Dave Airlie -Date: Mon, 16 Aug 2010 12:16:48 +1000 -Subject: [PATCH] dix: reset pScreen->root to NULL when root window is deleted. - -We were seeing a crash in the FreeAllResources codepath, -running valgrind revealed this, - -==12536== Invalid read of size 4 -==12536== at 0x810BCAB: DeliverPropertyEvent (rrproperty.c:33) -==12536== by 0x80958A4: TraverseTree (window.c:227) -==12536== by 0x809593E: WalkTree (window.c:255) -==12536== by 0x810BC66: RRDeliverPropertyEvent (rrproperty.c:53) -==12536== by 0x810BD5D: RRDeleteProperty.clone.0 (rrproperty.c:76) -==12536== by 0x810BD98: RRDeleteAllOutputProperties (rrproperty.c:88) -==12536== by 0x810A36E: RROutputDestroyResource (rroutput.c:407) -==12536== by 0x808DF4E: FreeClientResources (resource.c:859) -==12536== by 0x808E005: FreeAllResources (resource.c:876) -==12536== by 0x8062300: main (main.c:305) -==12536== Address 0x46ba8ac is 4 bytes inside a block of size 164 free'd -==12536== at 0x40057F6: free (vg_replace_malloc.c:325) -==12536== by 0x8087F1F: _dixFreeObjectWithPrivates (privates.c:357) -==12536== by 0x809832A: DeleteWindow (window.c:926) -==12536== by 0x808DF4E: FreeClientResources (resource.c:859) -==12536== by 0x808E005: FreeAllResources (resource.c:876) -==12536== by 0x8062300: main (main.c:305) - -Its a use after free on the root window, since we have already deleted it -at this point. This patch checks if the window we are destroying is the root -window and resets the pointer to NULL if it is. - -Signed-off-by: Dave Airlie ---- - dix/window.c | 5 +++++ - 1 files changed, 5 insertions(+), 0 deletions(-) - -diff --git a/dix/window.c b/dix/window.c -index 4a47dd5..33ef943 100644 ---- a/dix/window.c -+++ b/dix/window.c -@@ -895,10 +895,15 @@ DeleteWindow(pointer value, XID wid) - WindowPtr pParent; - WindowPtr pWin = (WindowPtr)value; - xEvent event; -+ ScreenPtr pScreen; -+ -+ pScreen = pWin->drawable.pScreen; - - UnmapWindow(pWin, FALSE); - - CrushTree(pWin); -+ if (pWin == pScreen->root) -+ pScreen->root = NULL; - - pParent = pWin->parent; - if (wid && pParent && SubStrSend(pWin, pParent)) --- -1.7.2.1 -