So when we VT switch back and attempt to flush the input devices,
we don't succeed because evdev won't return part of an event,
since we were only asking for 4 bytes, we'd only get -EINVAL back.
This could later cause events to be flushed that we shouldn't have
gotten.
This is a fix for CVE-2013-1940.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 6ca03b9161)
e02f864fdf "Suppress cursor display until the first XDefineCursor() request"
disabled cursor display a priori unless -retro is given.
On a plain server, caling XFixesHideCursor() and XFixesShowCursor() would
show the default root cursor, despite no client actually defining a cursor.
Change the logic, disable CursorVisible by default and only enable it from
the window's CWCursor logic. If no window ever defines a cursor, said cursor
stays invisible.
X.Org Bug 58398 <http://bugs.freedesktop.org/show_bug.cgi?id=58398>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Bastien Nocera <hadess@hadess.net>
Reviewed-by: Daniel Martin <consume.noise@gmail.com>
(cherry picked from commit c100211034)
Use bytes_per_line and bits_per_pixel from the created XImage to fix
https://bugzilla.redhat.com/show_bug.cgi?id=518960
Signed-off-by: Daniel Martin <consume.noise@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit bd58ebe4cf)
This is necessary when the input handler deletes itself from the
list. Bug found by Maarten Lankhorst, this patch uses the list macros
instead of open-coding the fix.
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit da92690107)
So in the cold plug server shutdown case, we reap the resources
before we call CloseScreen handlers, so the config->randr_provider
is a dangling pointer when the xf86CrtcCloseScreen handler is called,
however in the hot screen unplug case, we can't rely on automatically
reaped resources, so we need to clean up the provider in the xf86CrtcCloseScreen
case.
This patch provides a cleanup callback from the randr provider removal
into the DDX so it can cleanup properly, this then gets called by the automatic
code for cold plug, or if hot unplug it gets called explicitly.
Fixes a number of random server crashes on shutdown
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=58174
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=891140
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>
When an RandR shared pixmap is created in rrCreateSharedPixmap, it has a refcnt
of 1. Then, PixmapShareToSlave bumps the refcnt to 2. However, there's no
corresponding PixmapUnshareFromSlave where the refcnt can be decreased again,
and there's no convenient common place where the refcnt can be decremented when
the slave pixmap is destroyed.
Fix this by just unreffing the pixmap twice in RRCrtcDetachScanoutPixmap.
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
Set on DeviceEnterLeaveEvent() the xXIEnterEvent->focus field
similarly to how the CoreEnterLeaveEvent() function above does
for core events.
This fixes bug https://bugzilla.gnome.org/show_bug.cgi?id=677329
reported to GTK+, where focus handling on window managers with
sloppy focus or no window manager present was broken due to this
field being always set to FALSE.
Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 509b3c3dc8)
XTest devices are the first ones in the list, being initialised together
with the master devices. If we disable the devices in-order and a device has
a button down when being disabled, the XTest device is checked for a
required button release (xkbAccessX.c's ProcessPointerEvent). This fails if
the device is already NULL.
Instead of putting the check there, disable the devices in the reverse order
they are initialised. Disable physical slaves first, then xtest devices,
then the master devices.
Testcase: shut down server with a button still held down on a physical
device
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 3e4be4033a)
Absolute devices may send relative events depending on the mode (synaptics
by default, wacom per option). The relative events are added to the previous
position, converted into device coordinates and then scaled into desktop
coordinates for pointer movement.
Because the device range must be mapped into the desktop coordinate range,
this results in uneven scaling depending dimensions, e.g. on a setup with
width == 2 * height, a relative movement of 10/10 in device coordinates
results in a cursor movement of 20/10 (+ acceleration)
Other commonly user-visible results:
* the touchpad changing acceleration once an external monitor as added.
* drawing a circle on a wacom tablet in relative mode gives an ellipsis in
the same ratio as the desktop dimensions.
Solution: pre-scale the incoming relative x/y coordinates by width/height
ratio of the total desktop size. Then add them to the previous
coordinates and scale back with the previous mapping, which will undo the
pre-scaling and give us the right movement.
X.Org Bug 31636 <http://bugs.freedesktop.org/show_bug.cgi?id=31636>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 61a99aff9d)
Scaled is already in desktop coordinates, take the total width into account,
not just the current screen's width.
Fixes Xdmx pointer position calculation.
X.Org Bug 51904 <http://bugs.freedesktop.org/show_bug.cgi?id=51904>
Signed-off-by: Sybren van Elderen <sowmestno@msn.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit a191dbfe85)
dmx-config.h is a server header which includes dix-config.h. That again
defines a bunch of server-specifics, including setting the size of XID to
32 bit.
libX11 uses unsigned long (8 bits on x86_64). XGCValues thus ends up being
16 bytes smaller in xdmxconfig than in the library, causing garbage to be
sent to the server.
X.Org Bug 37502 <http://bugs.freedesktop.org/show_bug.cgi?id=37502>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 1058fcf57f)
Due to a typo the major version number was passed as minor version to
version_compare().
Regression-from: ffd4874798
Signed-off-by: Daniel Martin <consume.noise@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 36740d02b9)
Regression introduced by commit 2decff6393
xkb: ProcesssPointerEvent must work on the VCP if it gets the VCP
XTest buttons must be released when a physical button is released. This was
fixed in 1432785839, but
2decff6393 changed a condition that this code
didn't get triggered anymore.
"dev" for pointer events is now always the VCP which doesn't have a xkbi
struct. So move this condition out and always trigger the XTest released for
button events.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Frank Roscher <Frank-Roscher@gmx.net>
(cherry picked from commit c4fee9d2ec)
inputstr, double defines TouchListener typedef, maybe some gcc handles it,
but not all.
fixes tinderbox
Reported-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 605dfc6804)
DDXTouchPointInfoRec.valuators used to store axis values after transform.
This resulted in Coordinate Transformation Matrix
being applied multiple times to the last coordinates,
in the case when only pressure changes in the last touch event.
Changed DDXTouchPointInfoRec.valuators to store values before transform.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=49347
Signed-off-by: Yuly Novikov <ynovikov@chromium.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 3b9f1c7017)
Conflicts:
dix/getevents.c
Introduced in 323869f329
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit f4a58469a2)
The base group is not brought into range and, therefore, using it as an array
index crashed the X server. Also, at this place, we should ignore locked
groups, but not latched groups. Therefore, use sum of base and latched groups,
brought into range.
Reproducible with:
key <FK07> {
type= "ONE_LEVEL",
symbols[Group1]= [ NoSymbol ],
actions[Group1]= [ LatchGroup(group=-1, clearLocks) ]
};
And hitting F7 will exceed the group level and access arbitrary memory.
Signed-off-by: Andreas Wettstein <wettstein509@solnet.ch>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 3578cc3c2e)
The loop above the previous call may end up triggering other
handlers attaching to the same function slot, so unwrapping
the handler after that could leave the just attached handler
in a dangling but not unset state.
This issue was most visible on the XO, where destroying a
window with an animated cursor set and running would trigger
this inconsistent state, never calling the miSpriteBlockHandler
again after the animated cursor is unset.
Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit df746a7341)
Different miPointerSpriteFuncRec implementations do a varying
business at ultimately calling miPointerUpdateSprite(), this
particularly fails when using the plain mi sprite on touch events,
where the sprite is just moved/updated on cursor changes.
So, ensure miPointerUpdateSprite() is called generically for
pointer emulating touch events as with regular motion events.
Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 0fbd779a82)
Should've been removed in bc1f90a615018c05994fae3e678dd2341256cd82a, but got
left here due to a botched rebase.
Fixes stray button events sent to clients after deactivating an async
pointer grab on a pointer-emulating-touch.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 0e1ab433f4)
events.c: In function 'DeactivatePointerGrab':
events.c:1524:51: warning: 'dev' may be used uninitialized in this function
[-Wuninitialized
dev is unset when we get here, the device to check is "mouse".
Introduced in ece8157a59.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 32a6d8a6b5)
Instead of guessing what resource type the listener is and what property to
retrieve, store the resource type in the listener directly.
Breaks XIT test cases:
TouchGrabTestMultipleTaps.PassiveGrabPointerEmulationMultipleTouchesFastSuccession
Fixes https://bugs.freedesktop.org/show_bug.cgi?id=56557
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Chase Douglas <chase.douglas@ubuntu.com>
(cherry picked from commit f59499b5d0)
This places a pointer to the grab related to a TouchListener directly
in the TouchListener structure rather than hoping to find the grab
later on using the resource ID.
Passive grabs have resource ID in the resource DB so they can be
removed when a client exits, and those resource IDs get copied when
activated, but implicit grabs are constructed on-the-fly and have no
resource DB entry.
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 9ad0fdb135)
No reason to have a struct declared inside another struct
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 91ab237358)
DGA only handles master devices but it does intercept slave device events as
well (since the event handlers are per event type, not per device).
The DGA code must thus call into UpdateDeviceState to reset the button/key
state on the slave device before it discards the remainder of the event.
Test case:
- Passive GrabModeSync on VCP
- Press button
- Enable DGA after ButtonPress
- AllowEvents(SyncPointer)
- Release button
The button release is handled by DGAProcessPointerEvent but the device state
is never updated, so the slave ends up with the button permanently down.
And since the master's button state is the union of the slave states, the
master has the button permanently down.
X.Org Bug 59100 <http://bugs.freedesktop.org/show_bug.cgi?id=59100>
Reported-by: Steven Elliott <selliott4@austin.rr.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit ad3bc57134)
Reported-by: Steven Elliott <selliott4@austin.rr.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit c5f2818edb)
If a XI2.1+ client has a grab on a non-root window, it must still receive
raw events on the root window.
Test case: register for XI_ButtonPress on window and XI_RawMotion on root.
No raw events are received once the press activates an implicit grab on the
window.
X.Org Bug 53897 <http://bugs.freedesktop.org/show_bug.cgi?id=53897>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 4e13dd9014)
Once the TouchEnd appears on the device, the touch is done. If the client
still has a pointer grab, accept it to avoid clients with TouchOwnership
selections to wait indefinitely for the actual touch event.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 00def51445)
Conflicts:
Xi/exevents.c
A client with a pointer grab on a touch device must reject the touch when
detactivating the grab while the touch is active. However, such a rejecting
must not trigger a ButtonRelease event to be emulated and sent to the
client.
Set the grabbing listener's state to HAS_END, so we simply skip delivery to
that client.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit ece8157a59)
An active grab ungrabbing is the same as rejecting the grab, since the
client is no longer interested in those events. So reject any touch grab,
but do so before actually deactivating since we're interested in the
TouchEnd for the current grabbing client.
A passive grab otoh is _not_ like rejecting a grab, since it deactivates
automatically when the touch ends.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit bc1f90a615)
TouchListenerAcceptReject may be called during normal event processing, but
ProcessInputEvents is not reentrant and calling it here smashes the event
queue.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 146f48c293)
If a client has a core grab, don't allow re-grabbing with type XI2, etc.
This was the intent of the original commit
xorg-server-1.5.99.1-782-g09f9a86, but ineffective.
X.Org Bug 58255 <http://bugs.freedesktop.org/show_bug.cgi?id=58255>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit dd3242c87a)
GrabMask is a union of core, XI1 and XI2 masks. If a XI2 grab is activated,
the value is a random pointer value, using it as mask has unpredictable
effects.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Jasper St. Pierre <jstpierre@mecheye.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit f793b5fd3e)
RemoveDevice() frees the DeviceIntPtr, we shouldn't use the pointer after
that
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 58bff17e43)
d785368e0e converted the other miinitext functions to use ARRAY_SIZE,
and removed the sentinel, but missed EnableDisableExtensionError so
passing an invalid extension name could cause the server to walk off
the end off the list looking for a sentinel that wasn't there.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Running glxinfo under indirect rendering would randomly fail against the
intel driver, as it would create a context with no attribs, and then the
api value would be passed to the driver uninitialised.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
