Commit graph

19158 commits

Author SHA1 Message Date
Konstantin
78c557d974 xv: change FOURCC_RGBA32 to AMD one
Initally we used value of DRM_FORMAT_ARGB8888, but it seems than
xf86-video-ati has established other value for years. So, change it to
well established one.

Because we define a different values, this breaks compilation of xf86-video-ati.
I am unsure, who is right in this situation, but I guess better to use
an established value, to make AMD xorg driver compile.

I do not aware about any of the side effects of this change.

Fixes: 15412e78c8 - glamor: xv: add rgba32 format
Signed-off-by: Konstantin <ria.freelander@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1321>
2026-02-15 01:39:55 +00:00
Dongwon Kim
2114016ea0 modesetting: Empty damage once dispatch is done
This commit is to fix some regression caused by

commit 995e60a919

where DamageEmpty on damage was missing in several
places.

Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1486>
2026-02-15 01:28:48 +00:00
Patrick Lerda
5582e45d94 modesetting: find the first compatible dri device as default
This change replaces the default "/dev/dri/card0" by a loop which
searches for the first compatible device.

This change avoids the error below which happens on some ARM boards:
(EE) No devices detected.
(EE)
Fatal server error:
(EE) no screens found(EE)
(EE)

Signed-off-by: Patrick Lerda <patrick9876@free.fr>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1496>
2026-02-14 17:19:52 -08:00
hongao
1443fd34ea randr: clear primary screen's primaryOutput when the output is deleted
This fix use after free when a pluggable gpu screen (such as displaylink)
was set as primary screen and unpluged.

gdb backtrace:
 #0 OssigHandler (signo=11, sip=0x7fff2e0a50f0, unused=0x7fff2e0a4fc0) at ../../../../os/osinit.c:138
 #1 <signal handler called>
 #2 rrGetscreenResources (client=0x3195160, query=0) at ../../../../randr/rrscreen.c:577
 #3 0x0000000000562bae in ProcRRGetscreenResourcesCurrent (client=0x3195160) at ../../../../randr/rrscreen.c:652
 #4 OxOOOOB0000054de63 in ProcRRDispatch (client=0x3195160) at ../../../../randr/randr.c:717
 #5 0x00000000004322c6 in Dispatch () at ../../../../dix/dispatch.c:485
 #6 0x0900900990443139 in dix_main (argc=12, argv=0x7fff2e0a5f78, envp=0x7fff2e0a5fe0) at ../../../../dix/main.c:276
 #7 0X0000000000421d9a in main (argc=12, argv=0x7fff2e0a5f78, envp=0x7fff2e0a5fe0) at ../../../../dix/stubmain.c:34

Signed-off-by: hongao <hongao@uniontech.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1553>
2026-02-14 17:03:30 -08:00
Sultan Alsawaf
4689e5744e modesetting: Don't recursively force present to unflip
Present calls drmmode_set_mode_major() as part of ms_present_unflip(),
which leads to a crash due to the recursive attempt to force present to
unflip when it already is.

Fix it by simply skipping the forced present unflip when present itself is
unflipping. This also speeds up drmmmode_prepare_modeset() when present
isn't even flipping to begin with.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1791
Fixes: 899c87af1 ("modesetting: unflip before any setcrtc() calls")
Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1793>
2026-02-14 16:04:01 -08:00
matt335672
75b7f87dd9 Add docs for some internal methods
Doxygen headers added for XkbGetCoreMap() and XkbSetRepeatKeys()

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1851>
2026-02-14 23:52:50 +00:00
Povilas Kanapickas
5fa59f2333 Revert "glamor: explicitly draw endpoints of line segments"
This reverts commit 530e80375e.

The commit breaks xts5/Xlib9/XDrawLines/XDrawLines test as per
https://gitlab.freedesktop.org/xorg/xserver/-/issues/1801#note_2812218

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1858>
2026-02-14 23:44:16 +00:00
Thomas Zimmermann
34a53a5746 xf86: Accept devices with the kernel's vesadrm driver
Add a workaround to accept devices of the kernel's vesadrm driver.
Makes Xorg work on pre-configured displays with VESA and the DRM
graphics stack. Review of the vesadrm driver happens at [1].

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/series/146477/ # 1
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1879>
2026-02-14 23:39:34 +00:00
Thomas Zimmermann
b6b7218aed xf86: Accept devices with the kernel's efidrm driver
Add a workaround to accept devices of the kernel's efidrm driver.
Makes Xorg work on pre-configured displays with UEFI and the DRM
graphics stack. Review of the efidrm driver happens at [1].

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/series/146477/ # 1
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1879>
2026-02-14 23:39:34 +00:00
Timo Aaltonen
e45516afa6 xf86pciBus.c: use Intel ddx only for pre-gen3 hardware
Use intel ddx only on pre-gen4 hw, newer ones will fall back to modesetting.

Instead of defaulting to the Intel driver for all Intel hardware, only
default it for older hardware for which it has shown to be better for.

Note that Debian/Fedora and their derivatives, as well as the yocto project
have been carrying this patch for many years:
192254841a
ee515e44b0

so this simply aligns xserver upstream with Linux distributions.

Signed-off-by: California Sullivan <california.l.sullivan@intel.com>
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Co-authored-by: Balló György <ballogyor@gmail.com>
Reviewed-by: Emma Anholt <emma@anholt.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1887>
2026-02-14 23:33:49 +00:00
Icenowy Zheng
4165516ac4 randr: do full transform when checking SetScreenSize size
When validating the size passed to SetScreenSize, the CRTC mode size
needs to be applied the full CRTC transform, otherwise the check may
bogusly fail.

Do a full transform on the CRTC mode size when checking the
SetScreenSize request size instead of the current code that only
manually handles rotation.

Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1971>
2026-02-14 15:20:23 -08:00
Icenowy Zheng
febc30a75b modesetting: properly use fb_id of front_bo for reverse PRIME CRTC
When doing reverse PRIME, the buffer being scaned out is still the front
BO.

Properly reuse its fb_id, to prevent adding a FB for the front_bo each
time the fb_id is requested.

Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2064>
2026-02-14 14:28:20 -08:00
Pierre Le Marre
c49cbc176a xkb: Fix serialization of key type without level names
Before this commit the count of key type level names was wrongly set
in `XkbGetNames`: for key type without names, it was set to the level
count, while it should be 0:
- `XkbComputeGetNamesReplySize()` does not account key type without
  level names;
- `XkbSendNames()` does not write any level entry for key types without
  level names.

This causes a mismatch offset while parsing the response and its
processing would ultimately fail.

Fixed by setting the correct level name count: 0 if there is no level
name, else the number of levels.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2082>
2026-02-14 13:06:31 -08:00
Pierre Le Marre
12605989af xkb: Fix key type without level names in XkbCopyKeymap
A key type that has no level names is legit. Before this commit,
`XkbCopyKeymap` would make such level inconsistent by setting its
number of levels to 0 while keeping its map entries. It suffices
to clear the names array.

Fixed by copying the level count from the source type.

WARNING: this will trigger an error in `XkbGetNames`, which worked
before this commit only by chance. This is fixed in the next commit.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2082>
2026-02-14 13:06:31 -08:00
Qiang Yu
0b0b59d711 glamor: enable dmabuf_capable by default for radeonsi
This is needed by radeonsi to support multi plane modifier when
using modesetting DDX.

xserver reject any multi plane buffer (in DRI3PixmapFromBuffers)
without the dmabuf_capable debug option. It's OK for single plane
buffer as xserver will fallback to DRI3BufferFromPixmap path.
amdgpu DDX does not expose DRI3PixmapFromBuffers, mesa just use
the single plane path anyway, so amdgpu DDX does not have this
problem.

Reviewed-by: Sultan Alsawaf <sultan@kerneltoast.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2091>
2026-02-14 20:48:29 +00:00
Qiang Yu
3d5c955337 modesetting: fix PRESENT_FLIP_REASON_BUFFER_FORMAT gets overwritten
When dmabuf_capable is enabled, ms_present_check_unflip may return
with reason PRESENT_FLIP_REASON_BUFFER_FORMAT to be reported back
to client by PresentCompleteModeSuboptimalCopy. We should not
overwrite it by page flip reasons anyway when exit.

This fix also avoid changing vblank->exec_msc in present_scmd_pixmap()
which caused by page flip reasons to prevent a present to be executed
immediatly. So that we can cancel pending vblanks when new vblanks with
same msc arrive. This happens when application just starts.

This problem can be observed at least using radeonsi OGL driver, start
xserver with dmabuf_capable enabled, no window manager, glxgears will
stuck for the first several seconds. If using a composite window manager
like Mutter, we can't observe the glxgears stuck, but the prensent
complete event still shows unexpected Copy mode instead of
PresentCompleteModeSuboptimalCopy or Skip mode.

glxgears window msc is 0 at the beginning, it will send present request
with target msc = 1, 2, 3, ... N before server send back the complete
event for target msc = 1. But server side window msc is way bigger than N,
so it will think all these present requests are outdated and just show the
Nth request at the next vblank. [1 .. N-1] requests should be skipped.
But without this fix, all [1 .. N] presents will be executed with Copy
mode which causes stuck.

Fixes: a94dd9536 ("modesetting: add support for TearFree page flips")
Reviewed-by: Sultan Alsawaf <sultan@kerneltoast.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2091>
2026-02-14 20:48:29 +00:00
Michel Dänzer
39897b3b71 composite: Skip copying parent pixmap contents when possible
If the parent window has a different depth (which means pWin can't have
valid contents yet) and pWin has effective background other than None.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2092>
2026-02-14 12:37:18 -08:00
Michel Dänzer
d4be568863 Revert "composite: Only copy bits from the parent pixmap when absolutely necessary"
This reverts commit 7e6c55cc9f.

In the pParent->drawable.depth == pWin->drawable.depth case, pWin may
already have valid contents, which need to be copied to the new pixmap.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2092>
2026-02-14 12:37:18 -08:00
quantenzitrone
fff0023339 COPYING: add author to HPND-sell-MIT-disclaimer-xserver
the license notice comes from these files:
- dix/registry.c
- Xext/xselinuxint.h
- Xext/xselinux_label.c
- Xext/xselinux_hooks.c
- Xext/xselinux_ext.c
- Xext/xselinux.h
- Xext/xacestr.h
- Xext/xace.h
- Xext/xace.c

while this is not like the standard `Copyright (C)` lines I think it
still belongs to the license, even if just to make it more clearly
separate from the MIT license above

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2098>
2026-02-14 20:27:44 +00:00
quantenzitrone
6105e5b133 COPYING: add missing paragraph to SGI-B-2.0
all files that this license applies to include the last paragraph:
- glx/xfont.c
- glx/unpack.h
- glx/singlesize.h
- glx/singlesize.c
- glx/singlepixswap.c
- glx/singlepix.c
- glx/single2swap.c
- glx/single2.c
- glx/rensize.c
- glx/renderpixswap.c
- glx/renderpix.c
- glx/render2swap.c
- glx/render2.c
- glx/glxutil.h
- glx/glxdrawable.h
- glx/glxserver.h
- glx/glxcontext.h
- glx/glxscreens.h
- glx/glxscreens.c
- glx/glxcmdsswap.c
- glx/glxext.h
- glx/glxcmds.c
- glx/glxext.c

the paragraph was likely accidentally missed when the license changed
from SGI-B-1.0 to SGI-B-2.0 in ed9aecf851

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2097>
2026-02-14 12:19:08 -08:00
Mikhail Dmitrichenko
0237462d32 dix: avoid null ptr deref at doListFontsAndAliases
In the `doListFontsAndAliases` function in dixfonts.c, when a font alias
is encountered (`err == FontNameAlias`) as a result of
`list_next_font_or_alias` call, the code allocates memory for
`resolved` variable (`resolvedlen + 1` bytes) for storing target font
name. In this case, if the `malloc(resolvedlen + 1)` call fails,
`resolved` remains NULL.

Later, when check (`else if (err == FontNameAlias)`) is TRUE, the code
uses `memcpy` to copy nullable `resolved` into `tmp_pattern` without
checking if `resolved` is NULL, so there is a potential null ptr
dereference.

This commit replaces `malloc` with `XNFalloc` for allocating memory for
`resolved`. `XNFalloc` will internally check result of `malloc` and stop
program execution if allocation was failed, preventing potential NULL
dereferencing.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2114>
2026-02-14 18:55:55 +00:00
Mikhail Dmitrichenko
809402414e render: fix multiple mem leaks on err paths
Free nested allocations when initialization fails.
Several code paths returned early on error without releasing
memory owned by embedded structures, leading to leaks.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2125>
2026-02-14 18:50:30 +00:00
Alan Coopersmith
3eaaa35849 xfree86: remove leftover ev56.c source files
Commit 166ac294a replaced the function calls in these files with inline
functions in compiler.h and updated the configure scripts & meson builds
to stop compiling them, but missed actually removing the now unused sources.

Fixes: 166ac294a ("xfree86: Inline xf86{Read,Write}Mmio{8,16,32} on alpha")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2122>
2026-02-14 10:00:51 -08:00
Yixue Wang
6a37e21ca4 xwayland: wrong expecting_event
According to

https://wayland.app/protocols/wayland#wl_seat:event:capabilities

Compositor might send capabilities when its capabilities change.
Decrease expecting_event here without any check might cause a
negative expecting_count.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2123>
(cherry picked from commit 6bf6a9bff2)
2026-02-08 11:44:42 -08:00
Alexander Melnyk
a9ee6b7326 xkb: Fix locked/latched indicator desync across multiple keyboards
When a group indicator (or a latched indicator of any kind) is defined,
e.g.:
  indicator "Scroll Lock" { groups = Group2; }
the logical and physical indicator state may desync across multiple
connected keyboards.

This is caused by XkbPushLockedStateToSlaves only pushing locked_mods to
the slave devices. Pushing locked_group (as well as latched groups/mods)
along with locked_mods resolves the issue.

The issue is not observed with API calls because a different code path
is taken (avoiding XkbPushLockedStateToSlaves altogether).

Signed-off-by: Alexander Melnyk <inboxnumberzero@zoho.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2120>
(cherry picked from commit 36a7fdd315)
2026-02-01 17:53:18 -08:00
Liu Heng
6bef11002f xwayland: prevent X11 get enter event when pointer is over Wayland client
In Wayland, mouse coordinates are not updated after all x11 clients have left,
causing the mouse information to remain at the position left by the last x11
client. However, if CheckMotion is called at this point for other reasons
(such as window mapped, reactive, etc.), xwayland might continue to send enter
events to x11 clients, even if the mouse is actually on a Wayland client.

This MR introduces and checks pointer_enter_count to determine if the mouse
has left an x11 client and is now on a Wayland client. When it's confirmed
that the mouse is no longer on an x11 client but on a Wayland client,
returning TRUE in sprite_check_lost_focus causes XYToWindow to return to the
root window, preventing further enter events from being sent to x11 clients.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2112>
(cherry picked from commit e673a4bda0)
2026-02-01 17:53:16 -08:00
Olivier Fourdan
e1cd42dcaa xwayland/ci: Enforce various code style checks
Make sure the code change does not contain tab characters nor stray
newlines.

This is contributed by Peter Hutterer, adapted from the libinput similar
CI check.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2121>
(cherry picked from commit 9c31b4ad8f)
2026-01-25 11:47:31 -08:00
Olivier Fourdan
22dcaf44d4 xwayland: Clean-up stray newlines
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2121>
(cherry picked from commit 5a78e5f1e9)
2026-01-25 11:47:31 -08:00
Olivier Fourdan
3df29994ec xwayland: Expand tab characters
Over time, some sneaky tab characters have found their way in the
Xwayland code, even though they were not allowed:

  https://www.x.org/wiki/CodingStyle/

Simply expand the tabs to get rid of these...

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2121>
(cherry picked from commit 904cdb0d11)
2026-01-25 11:47:31 -08:00
Olivier Fourdan
f5d8e11288 xwayland: Avoid premature surface commit running rootfull
When running rootful, i.e. as a regular Wayland client, Xwayland needs
to wait for the initial configure event before posting its initial
buffer and commit the surface.

Not doing so may cause mutter to log a warning when Xwayland is started
rootful:

 | Buggy client (org.freedesktop.Xwayland) committed initial non-empty
 | content without acknowledging configuration, working around.

Or running rootful with libdecor:

 | Client provided invalid window geometry for xdg_surface#nn
 | (org.freedesktop.Xwayland - Wnn (Xwayland on :nn)). Working around.
 |
 | Buggy client (org.freedesktop.Xwayland) committed initial non-empty
 | content without acknowledging configuration, working around.

This is actually mutter being nice, as this should be treated as a
protocol error and Xwayland would be terminated.

To avoid the issue, we need to hold on attaching a buffer and committing
the surface until we actually get the first configure event from the
compositor.

That, however, only applies to rootful mode, so we can leave the default
code path for rootless untouched.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1853
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>

v2: commit the surface after attaching the first buffer on configure
event only for the initial configure (Michel Dänzer).
v3: return early in present flip if we didn't get the initial configure
event (Michel Dänzer).

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2110>
(cherry picked from commit 37f59e1a4d)
2026-01-25 11:47:31 -08:00
Michel Dänzer
cdb2cb6cbc xwayland: Adjust RandR emulation for rotation
Need to use the extents of the output in screen cordinates, instead of
the canonical mode size.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2095>
(cherry picked from commit 44dea3a8bd)
2026-01-25 11:47:26 -08:00
Michel Dänzer
297e29f8c1 xwayland: Add emulated modes larger than the logical mode
Up to the native mode, as reported by the wl_output protocol.

This ensures that fullscreen apps can always use the native mode.

Also ensure the root window is large enough for the output at its
current position with the native mode.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2095>
(cherry picked from commit d339284006)
2026-01-25 11:46:10 -08:00
Michel Dänzer
c859dce96d xwayland: Clear ConstrainCursorHarder in xwl_screen_init_output
In the rootless case, Xwayland receives pointer motion events only while
the pointer is over one of its Wayland surfaces, so there's no need for
constraining them to RandR boundaries.

This also avoids them getting spuriously constrained when using RandR
emulation for modes larger than the default one.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2095>
(cherry picked from commit dcfba8a9bd)
2026-01-25 11:46:10 -08:00
Michel Dänzer
ff641acc65 xwayland: Add RandR mode for the native resolution if it fits in logical
Always add it as the first mode, which makes it considered the preferred
mode per the RandR protocol.

Mark the logical mode as currently set.

v2:
* Drop change in xwl_window_should_enable_viewport which seems
  unnecessary and coult result in a crash. (Olivier Fourdan)
* Use 'native' instead of 'actual'.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2095>
(cherry picked from commit 288dcb3128)
2026-01-25 11:46:10 -08:00
Michel Dänzer
0268f28aea xwayland: Do not assume the first RandR mode is the logical mode
It currently always is, it won't be with the next commit though.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2095>
(cherry picked from commit 4ea088f9e2)
2026-01-25 11:46:10 -08:00
Michel Dänzer
53fadc0503 xwayland: Set output mode size as reported by the wl_output protocol
This means xwl_output->mode_width/height can be non-0 also with
rootless, so need to check for rootful explicitly in
xwl_output_find_mode.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2095>
(cherry picked from commit e4da0673f7)
2026-01-25 11:46:10 -08:00
Michel Dänzer
9b6adb97ed xwayland: Refactor output_get_logical_mode/extents helpers
Preparation for later changes.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2095>
(cherry picked from commit a1be2542e0)
2026-01-25 11:46:10 -08:00
Michel Dänzer
9303c0dc50 xwayland: Use logical_ prefix for logical coordinate system values
Inspired by
https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/878 .

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2095>
(cherry picked from commit ce67045211)

v2: fix builds with debug enabled (Olivier)
2026-01-25 11:45:22 -08:00
Michel Dänzer
1f88fec938 xwayland: Sort xwl_output_fake_modes entries
Makes the list of modes tidier e.g. in xrandr output.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2095>
(cherry picked from commit 1a3c5e7827)
2026-01-25 10:40:03 -08:00
Michel Dänzer
04476430cd xwayland: Use separate comment for each xwl_output_fake_modes line
Preparation for next commit.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2095>
(cherry picked from commit bf6cbf244f)
2026-01-25 10:40:03 -08:00
Matthieu Herrb
5eccd05b61 Fix drmModeCreatePropertyBlob() length parameter after f894801fa2
Fixes: f894801fa ("xfree86: modesetting: don't use VLA")
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2011>
(cherry picked from commit 772cb30448)
2026-01-25 10:40:03 -08:00
Alan Coopersmith
3eac9393d7 os: make FormatInt64() handle LONG_MIN correctly
When compiling with gcc 15.2.0 using -O3 -m64 on Solaris SPARC & x64,
we'd get a test failure of:

Assertion failed: strcmp(logmsg, expected) == 0,
 file ../test/signal-logging.c, line 339, function logging_format

because 'num *= 1' produced a value that was out of the range of the
int64_t it was being stored in.  (Compiling with -O2 worked fine with
the same compiler/configuration/platform though.)

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2117>
(cherry picked from commit 7f68b58865)
2026-01-25 10:40:03 -08:00
Peter Hutterer
3f939536d7 CI: drop the ci-fairy check-mr job
The only thing this checked was the checkbox for allowing maintainers to
edit the MR. Changed permissions checks now fail this job but luckily
the setting it checked has been the default for years anyway so we can
drop it.

https://gitlab.freedesktop.org/freedesktop/ci-templates/-/issues/81

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2116>
(cherry picked from commit cd5666a4e0)
2026-01-25 10:40:03 -08:00
Mikhail Dmitrichenko
dd2255c309 os: avoid closing null fd at Fopen
In `Fopen` function variable `iop` may store NULL as a result of `fopen`
call. In this case, if later privileges couldn't be restored (`seteuid`
call fails), further `fclose(iop)` call will cause runtime error.

This commit adds check `iop` for NULL before calling `fclose` to prevent
potential NULL pointer dereference.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2115>
(cherry picked from commit f83807647e)
2026-01-25 10:40:03 -08:00
Liu Heng
b4c5796e4b xwayland: Fix incorrect pointer coordinates in enter events
Xwayland was sending incorrect pointer coordinates to X clients on
pointer enter events.

This was caused by calling CheckMotion() with a NULL event, which
prevented the pointer sprite hot coordinates from being updated
properly.

Fix this by constructing a proper DeviceEvent of type ET_Enter in
pointer_handle_enter, initializing it with the current timestamp
and EVENT_SOURCE_FOCUS, and passing it to CheckMotion() instead
of NULL.

This ensures the pointer sprite coordinates are correctly updated
when the pointer enters a window.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2113>
(cherry picked from commit 7fb5e00ad8)
2026-01-25 10:40:03 -08:00
Alan Coopersmith
7f1050de78 dix: set errorValue correctly when XID lookup fails in ChangeGCXIDs()
dixLookupResourceByType always overwrites the pointer passed in as the
first arg, so we shouldn't use the union it's in after that to get the
requested XID value to put in the errorValue.

Closes: #1857
Fixes: 2d7eb4a19 ("Pre-validate ChangeGC XIDs.")
Reported-by: Mouse <mouse@Rodents-Montreal.ORG>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2111>
(cherry picked from commit ac42c39145)
2026-01-25 10:40:03 -08:00
stefan11111
ddadb162f2 glamor: fix Option "GlxVendorLibrary"
The old code tried to use a screen pointer that was uninitialized and set to NULL.
This caused it to segfault when this option was set.

When this option was used with the modesetting driver, `glamor_egl_init`
is called indirectly in the driver PreInit proc.

`xf86ScrnToScreen(scrn)` then returns NULL.

This patch moves setting the gl vendor later in the initialization process,
when we already have a non-null pScreen.

Minimal reproducer:
```
$ cat /etc/X11/xorg.conf.d/99-screen.conf
Section "Screen"
	Identifier "Default"
	Option "GlxVendorLibrary" "Name"
EndSection
```

Backtrace:
```
| #0  in abort ()
| #1  in OsAbort () at os/utils.c:1361
| #2  in AbortServer () at os/log.c:879
| #3  FatalError () at os/log.c:1017
| #4  in OsSigHandler () at os/osinit.c:156
| #5  OsSigHandler () at os/osinit.c:110
| #6  <signal handler called>
| #7  in __pthread_kill_implementation () from /lib64/libc.so.6
| #8  in raise () from /lib64/libc.so.6
| #9  in abort () from /lib64/libc.so.6
| #10 in __assert_fail_base.cold () from /lib64/libc.so.6
| #11 in xf86ScrnToScreen () at hw/xfree86/common/xf86Helper.c:1734
| #12 in glamor_egl_init () at glamor/glamor_egl.c:1108
| #13 in try_enable_glamor () at hw/xfree86/drivers/modesetting/driver.c:984
| #14 PreInit () at hw/xfree86/drivers/modesetting/driver.c:1211
| #15 in InitOutput () at hw/xfree86/common/xf86Init.c:478
| #16 in dix_main () at dix/main.c:190
| #17 main () at dix/stubmain.c:34
```

Fixes: a449bb4c5 - glamor_egl: add support of GlxVendorLibrary option

Signed-off-by: stefan11111 <stefan11111@shitposting.expert>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2096>
(cherry picked from commit eccee47185)
2026-01-25 10:40:03 -08:00
Alan Coopersmith
1fe162ab99 Create a SECURITY.md file
Provide information on where to report or learn of security bugs,
and what we do or do not consider to be a security bug.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2103>
(cherry picked from commit a5047d4a65)
2026-01-25 10:40:03 -08:00
Alan Coopersmith
46ad162815 glamor: avoid double free in glamor_make_pixmap_exportable()
Reported by gcc 15.1:

../glamor/glamor_egl.c:320:9:
 warning: double-‘free’ of ‘modifiers’ [CWE-415] [-Wanalyzer-double-free]
[...]
           │  732 |│        free(*modifiers);
           │      |│        ~~~~~~~~~~~~~~~~
           │      |│        |
           │      |└───────>(25) ...to here
           │      |         (26) first ‘free’ here
[...]
    │  320 |         free(modifiers);
    │      |         ~~~~~~~~~~~~~~~
    │      |         |
    │      |         (28) ⚠️  second ‘free’ here; first ‘free’ was at (26)

Fixes: cef12efc1 ("glamor: Implement GetSupportedModifiers")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2094>
(cherry picked from commit 3e9baa20f3)
2026-01-25 10:40:03 -08:00
Alan Coopersmith
2df83c5566 glamor: avoid null dereference in glamor_composite_clipped_region()
Reported in #1817:

xwayland-24.1.6/redhat-linux-build/../glamor/glamor_render.c:1577:21:
 warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2094>
(cherry picked from commit 6a4ec30af4)
2026-01-25 10:40:03 -08:00