Commit graph

19049 commits

Author SHA1 Message Date
Alan Coopersmith
5a1fe4e4f1 xf86bigfont: fix -Wimplicit-function-declaration error
Build breaks with gcc 14 & later when xf86bigfont is enabled:

../Xext/xf86bigfont.c: In function ‘XFree86BigfontExtensionInit’:
../Xext/xf86bigfont.c:709:28: error: implicit declaration of function
 ‘xfont2_allocate_font_private_index’;
 did you mean ‘AllocateFontPrivateIndex’? [-Wimplicit-function-declaration]
  709 |         FontShmdescIndex = xfont2_allocate_font_private_index();
      |                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                            AllocateFontPrivateIndex

Fixes: 05a793f5b ("dix: Switch to the libXfont2 API (v2)")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2053>
(cherry picked from commit 0617f6075b)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
f5e806f2d4 Re-export Ones()
It's used by the nvidia driver

Fixes: 1642adec3 ("dix: unexport Ones()")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2051>
(cherry picked from commit 061690c2e6)
2026-01-25 10:40:02 -08:00
Twaik Yont
59673c0503 os: use close-on-exec for X server socket to prevent fd leaks
In most typical Linux X servers (like Xvfb, Xephyr, or Xwayland),
no child process outlives the server, so this issue rarely arises.
However, in embedded X servers (based on Xvfb or Kdrive) or in
custom Xorg modules, the server might launch a long-running command
with regular fork+exec calls. If the X server crashes or exits while
that command is still running (for example, it spawns a tombstone
generator or any process that hangs or turns to zombie), the file
descriptor associated with the abstract socket can remain open in the
child process. This leads to the kernel refusing to allow another X
server to bind the same socket until the child process terminates
(because there is no explicit way to unlink abstract socket, unlike
Unix socket). By marking the file descriptor as close-on-exec, we
ensure it is automatically closed in child processes, preserving the
ability of a new X server process to bind the socket immediately.

Signed-off-by: Twaik Yont <9674930+twaik@users.noreply.github.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1906>
(cherry picked from commit 5568b0f83f)
2026-01-25 10:40:02 -08:00
liuheng
9e376b9f6a config: Preserve section data when parsing duplicate files
Previously, when parsing multiple configuration files containing the same
section names, only the last occurrence of each section would be retained.
Earlier definitions were silently discarded due to unconditional memory
allocation and overwriting of pointers during parsing.

This resulted in incomplete or incorrect configuration state when users
intended to merge or extend configuration through multiple files.

The section parsing functions in Files.c, Flags.c, and Module.c now
accept existing section pointers. These functions allocate new memory only
if the input pointer is NULL, preserving earlier data when re-parsing.

read.c has been updated to detect and pass existing section pointers when
encountering duplicate sections across files, preventing loss of prior content.

With these changes, the parser properly accumulates and merges configuration
data across multiple files, ensuring that all relevant settings are preserved.

Fixes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/467
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2045>
(cherry picked from commit 9b6f72395a)
2026-01-25 10:40:02 -08:00
Martin von Gagern
fd9ec41679 modesetting: Check for NULL mode_output before printing warning message
Fixes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1816
Signed-off-by: Martin von Gagern <gagern@google.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1938>
(cherry picked from commit 0d39d7a8f3)
2026-01-25 10:40:02 -08:00
Michel Dänzer
1293945d56 xwayland/present: Only flip if the window pixmap dimensions match
If they don't, attaching the new buffer changes the dimensions of the
wl_surface representing the window, which can break stuff as described
in https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2044 .

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2047>
(cherry picked from commit 010c00828a)
2026-01-25 10:40:02 -08:00
Faith Ekstrand
8b9660cd71 glamor: Enable dma-buf on Zink
Zink badly needs dma-buf and modifiers as it can't handle BO import of
tiled buffers without modifiers.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1857>
(cherry picked from commit 376cef6710)
2026-01-25 10:40:02 -08:00
Nathan Kidd
1af7e6c89d glx: Don't blindly write 8 bytes in GLX single replies
Previously we leaked stack when invalid enum parameters were
specified and caused __glGet*_size functions to return a 0 size.

Further, we read out-of-bounds (and leaked) when the input data was less
than 8 bytes (__glXDispSwap_GetFramebufferAttachmentParameteriv and
__glXDisp_GetRenderbufferParameteriv).

Now we only write a single element in the reply padding, and only when there
is a single element. This is what the Mesa client-side libGL expects, and
restores original GLX server behaviour, matching both pre-public (1996) SGI GLX
and XFree86 4.

The main risk of this change is if we have any error in element count or size;
previously it may not have mattered but now it does.

There are no piglit result changes from this modification using either mesa
libGLX or NVIDIA libGLX.

For performance considerations, an extra conditional and variable-length
memcpy has no meaningful impact on the indirect rendering pipeline cost.

There is still the possiblity to leak if our size checks allow an enum that
the GL implemention does not. Guarding against that requires zero-initializing
all temp storage, which wants re-evaluation of the blind 200-byte buffers
used for many calls and thus is a much bigger change.

Signed-off-by: Nathan Kidd <nkidd@rocketsoftware.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1647>
(cherry picked from commit a4df686888)
2026-01-25 10:40:02 -08:00
Nathan Kidd
2081e72904 glx: Fix out-of-bounds reads from negative return
The callers of these functions were casting -1 to unsigned and then
using 4GB indexes. By returning 0 we match all the other size functions.

GLX size functions return -1 to indicate error, but GL size functions return 0.

Signed-off-by: Nathan Kidd <nkidd@rocketsoftware.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1647>
(cherry picked from commit 29cfcf5259)
2026-01-25 10:40:02 -08:00
Icenowy Zheng
fa7396a611 glamor: Fix dual blend on GLES3
The EXT_blend_func_extended extension on ESSL always requires explicit
request to allow two FS out variables because of limitations of the ESSL
language, which is mentioned as the No.6 issue of the extension's
specification.

Fix this by adding the extension request.

The original behavior on GLES3 is slightly against the specification of
GL_EXT_blend_func_extended extension, however Mesa and older version of
PowerVR closed drivers will just ignore this issue. Newest PowerVR
closed driver will bail out on this problem, so it deems a fix now.

Fixes: ee107cd491 ("glamor: support GLES3 shaders")
Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1750>
(cherry picked from commit eba15f1ba7)
2026-01-25 10:40:02 -08:00
Vlad Zahorodnii
0eb1ea5a48 xwayland: Dispatch tablet tool tip events after frame events
Xwayland dispatches tablet tool tip events immediately when they arrive.

With compositors such as mutter and sway, it is not an issue because
their libinput backends synthetize axis events before tip events. In
other words, axis data and the tip status belong to different frames.

On the other hand, kwin sends axis and tip events in a single frame
(its libinput backend generates a single tip event with axis data
attached to it). Since the tip events are dispatched immediately,
they can have wrong information associated with them, for example tool
position or pressure. It results in undesired "streaks" when the user
presses the tablet tool against the tablet.

See also https://bugs.kde.org/show_bug.cgi?id=479856.

Signed-off-by: Vlad Zahorodnii <vlad.zahorodnii@kde.org>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2032>
(cherry picked from commit 60f0bfe852)
2026-01-25 10:40:02 -08:00
Olivier Fourdan
8fec6c7116 randr: Do not leak the provider property
When changing the RandR provider property, if the property does not
already exists, it is created.

In case of error, however, it doesn't get freed, leading to a leak of
the allocated property.

Make sure to free the RandR property in case of error if was to be
added.

Found by OpenScanHub.

Fixes: 3c3a4b767 - randr: Check for overflow in RRChangeProviderProperty()
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2035>
(cherry picked from commit c34f59ee15)
2026-01-25 10:40:02 -08:00
Olivier Fourdan
38aa1b4a91 os: Check for integer overflow on BigRequest length
Check for another possible integer overflow once we get a complete xReq
with BigRequest.

Related to CVE-2025-49176

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Suggested-by: Peter Harris <pharris2@rocketsoftware.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2028>
(cherry picked from commit 4fc4d76b2c)
2026-01-25 10:40:02 -08:00
Olivier Fourdan
2961831f11 xfree86: Check for RandR provider functions
Changing XRandR provider properties if the driver has set no provider
function such as the modesetting driver will cause a NULL pointer
dereference and a crash of the Xorg server.

Related to CVE-2025-49180

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit 0235121c6a)
2026-01-25 10:40:02 -08:00
Olivier Fourdan
07203788d3 randr: Check for overflow in RRChangeProviderProperty()
A client might send a request causing an integer overflow when computing
the total size to allocate in RRChangeProviderProperty().

To avoid the issue, check that total length in bytes won't exceed the
maximum integer value.

CVE-2025-49180

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit 3c3a4b767b)
2026-01-25 10:40:02 -08:00
Olivier Fourdan
d308edc0e5 record: Check for overflow in RecordSanityCheckRegisterClients()
The RecordSanityCheckRegisterClients() checks for the request length,
but does not check for integer overflow.

A client might send a very large value for either the number of clients
or the number of protocol ranges that will cause an integer overflow in
the request length computation, defeating the check for request length.

To avoid the issue, explicitly check the number of clients against the
limit of clients (which is much lower than an maximum integer value) and
the number of protocol ranges (multiplied by the record length) do not
exceed the maximum integer value.

This way, we ensure that the final computation for the request length
will not overflow the maximum integer limit.

CVE-2025-49179

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 2bde9ca49a)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2025>
2026-01-25 10:40:01 -08:00
Olivier Fourdan
5279ee435c os: Account for bytes to ignore when sharing input buffer
When reading requests from the clients, the input buffer might be shared
and used between different clients.

If a given client sends a full request with non-zero bytes to ignore,
the bytes to ignore may still be non-zero even though the request is
full, in which case the buffer could be shared with another client who's
request will not be processed because of those bytes to ignore, leading
to a possible hang of the other client request.

To avoid the issue, make sure we have zero bytes to ignore left in the
input request when sharing the input buffer with another client.

CVE-2025-49178

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit d55c54cecb)
2026-01-25 10:40:01 -08:00
Olivier Fourdan
721d4ff4e5 xfixes: Check request length for SetClientDisconnectMode
The handler of XFixesSetClientDisconnectMode does not check the client
request length.

A client could send a shorter request and read data from a former
request.

Fix the issue by checking the request size matches.

CVE-2025-49177

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Fixes: e167299f6 - xfixes: Add ClientDisconnectMode
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit ab02fb96b1)
2026-01-25 10:40:01 -08:00
Olivier Fourdan
bfbd77a59a os: Do not overflow the integer size with BigRequest
The BigRequest extension allows requests larger than the 16-bit length
limit.

It uses integers for the request length and checks for the size not to
exceed the maxBigRequestSize limit, but does so after translating the
length to integer by multiplying the given size in bytes by 4.

In doing so, it might overflow the integer size limit before actually
checking for the overflow, defeating the purpose of the test.

To avoid the issue, make sure to check that the request size does not
overflow the maxBigRequestSize limit prior to any conversion.

The caller Dispatch() function however expects the return value to be in
bytes, so we cannot just return the converted value in case of error, as
that would also overflow the integer size.

To preserve the existing API, we use a negative value for the X11 error
code BadLength as the function only return positive values, 0 or -1 and
update the caller Dispatch() function to take that case into account to
return the error code to the offending client.

CVE-2025-49176

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit 03731b326a)
2026-01-25 10:40:01 -08:00
Olivier Fourdan
0dca7ea49a render: Avoid 0 or less animated cursors
Animated cursors use a series of cursors that the client can set.

By default, the Xserver assumes at least one cursor is specified
while a client may actually pass no cursor at all.

That causes an out-of-bound read creating the animated cursor and a
crash of the Xserver:

 | Invalid read of size 8
 |    at 0x5323F4: AnimCursorCreate (animcur.c:325)
 |    by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
 |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
 |    by 0x4A1E9D: Dispatch (dispatch.c:560)
 |    by 0x4B0169: dix_main (main.c:284)
 |    by 0x4287F5: main (stubmain.c:34)
 |  Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd
 |    at 0x48468D3: reallocarray (vg_replace_malloc.c:1803)
 |    by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802)
 |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
 |    by 0x4A1E9D: Dispatch (dispatch.c:560)
 |    by 0x4B0169: dix_main (main.c:284)
 |    by 0x4287F5: main (stubmain.c:34)
 |
 | Invalid read of size 2
 |    at 0x5323F7: AnimCursorCreate (animcur.c:325)
 |    by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
 |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
 |    by 0x4A1E9D: Dispatch (dispatch.c:560)
 |    by 0x4B0169: dix_main (main.c:284)
 |    by 0x4287F5: main (stubmain.c:34)
 |  Address 0x8 is not stack'd, malloc'd or (recently) free'd

To avoid the issue, check the number of cursors specified and return a
BadValue error in both the proc handler (early) and the animated cursor
creation (as this is a public function) if there is 0 or less cursor.

CVE-2025-49175

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: José Expósito <jexposit@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit 0885e0b262)
2026-01-25 10:40:01 -08:00
Olivier Fourdan
3c80595c7e xwayland: Do not pretend leaving the X11 surface if buttons are down
Xwayland has its own XYToWindow() handler to account for the case when
the pointer leaves an X11 surface to enter another Wayland native
window.

When that occurs, Xwayland will treat it as if the pointer had entered
the root window so that the X11 clients receive an appropriate leave
event.

When the pointer leaves the X11 surface, Xwayland will call
CheckMotion() to update the sprite coordinates and possibly the cursor.

However, if we left the surface with a button down, it means the wayland
compositor has grabbed the pointer so we will not get button release
events from the compositor.

Once the button is released, Xwayland will get a pointer enter event from
the compositor, and Xwayland will clear up the buttons pressed.

But that might confuse Xwayland in thinking the pointer has crossed the
windows and leave the wrong cursor showing in the X11 surface.

To avoid the issue, if buttons are down, do not pretend the cursor has
left the X11 surface for the root window.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1811
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2008>
(cherry picked from commit 8cb078f8b6)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
6e126016e3 Xephyr.man: Use \- to get ASCII hyphens instead of Unicode dashes
Used in command-line arguments and email addresses

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2009>
(cherry picked from commit 0d2213ec44)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
8fb69863a3 man pages: don't use .BI macro with a single argument
Clears warnings from groff -rCHECKSTYLE=10:

an.tmac: Xephyr.man:53: style: .BI expects at least 2 arguments, got 1
an.tmac: Xephyr.man:55: style: .BI expects at least 2 arguments, got 1
an.tmac: Xwayland.man:151: style: .BI expects at least 2 arguments, got 1
an.tmac: Xwayland.man:166: style: .BI expects at least 2 arguments, got 1

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2009>
(cherry picked from commit ff4f2f718b)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
4837b74123 XWin.man: fix typos in font change escapes
Fixes warnings from `mandoc -T lint`:

mandoc: XWin.man:332:28: WARNING: invalid escape sequence: \fp
mandoc: XWin.man:397:1: WARNING: invalid escape sequence: \fX

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2009>
(cherry picked from commit 286578e83e)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
1176228c0b man pages: remove extraneous PP macros
Clears warnings from `mandoc -T lint` of the forms:
mandoc: Xorg.man:26:2: WARNING: skipping paragraph macro: PP after SH
mandoc: Xorg.man:40:2: WARNING: skipping paragraph macro: PP empty

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2009>
(cherry picked from commit bd08e04fcb)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
fdb85312d1 man pages: strip trailing whitespace
Gets rid of many warnings from `mandoc -T lint` of the form:
mandoc: ./man/Xserver.man:621:7: STYLE: whitespace at end of input line

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2009>
(cherry picked from commit 6dfe3e7db6)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
4a6e8a6efd mi: use common implementation of bit counting function
Reduce a bit of unexplained magic, and use ISA extensions where available

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1984>
(cherry picked from commit 7aa1f121e4)
2026-01-25 10:40:01 -08:00
Enrico Weigelt, metux IT consult
061278dc23 randr: fix unconditional byte-swap in ProcRRGetProviderInfo()
The list of the associated provider's capabilities was always swapped
unconditionally, while it should only be in case of client having
opposite endianess.

Fixes: 4c92eb00f ("randr: add output source setup")
Reported-By: dasha_uwu
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1977>
(cherry picked from commit 73f3c47608)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
b0c8e4ef7e render: miindex.c does not need header guard macros
Clears warning from clang 19.1.7:

render/miindex.c:27:9: warning: macro is not used [-Wunused-macros]
   27 | #define _MIINDEX_H_
      |         ^

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit 37b7ea8f8a)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
f19f6fac9b os: remove unused definition of BUGADDRESS
We stopped including this in error messages back in 2008

Clears warning from clang 19.1.7:

os/utils.c:1338:9: warning: macro is not used [-Wunused-macros]
 1338 | #define BUGADDRESS BUILDERADDR
      |         ^

Fixes: ef77e4c44 ("Remove useless commentary from environment and argument processing.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit f988558348)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
ecf72360c7 test: remove extra return
Clears warning from clang 19.1.7:

test/misc.c:239:12: warning: 'return' will never be executed
 [-Wunreachable-code-return]
  239 |     return 0;

Fixes: 46b579e8d ("test: switch the unit tests to something resembling a test suite")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit d1cc5a599f)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
afceb0d3d1 modesetting: fix typo in XF86ModuleVersionInfo initialization
Found by clang 19.1.7:

hw/xfree86/drivers/modesetting/driver.c:163:21:
 warning: initializer overrides prior initialization of this subobject
 [-Winitializer-overrides]
  163 |     ._modinfo1_   = MODINFOSTRING2,
      |                     ^~~~~~~~~~~~~~
hw/xfree86/drivers/modesetting/driver.c:162:21:
 note: previous initialization is here
  162 |     ._modinfo1_   = MODINFOSTRING1,
      |                     ^~~~~~~~~~~~~~

Fixes: 2a10eff6c ("xfree86: modsetting: use explicit field initializers for XF86ModuleData")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit 062c339519)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
1c0baec459 test: remove stray semi-colons after functions
Clears warnings from clang 19.1.7:

test/list.c:95:2: warning: extra ';' outside of a function [-Wextra-semi]
   95 | };
      |  ^

test/list.c:137:2: warning: extra ';' outside of a function [-Wextra-semi]
  137 | };
      |  ^

Fixes: 92788e677 ("test: add some tests for basic list manipulation.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit 3eaa19d74b)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
e0c28fc85f xfree86: make modeline2c.awk put a newline at the end of xf86DefModeSet.c
Clears warning from clang 19.1.7:
hw/xfree86/common/xf86DefModeSet.c:288:62:
 warning: no newline at end of file [-Wnewline-eof]
  288 | const int xf86NumDefaultModes = ARRAY_SIZE(xf86DefaultModes);
      |                                                              ^

Fixes: 3bf7ff703 ("Size xf86DefaultModes explicitly.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit f9d25189fa)
2026-01-25 10:40:01 -08:00
Peter Harris
b1ebab3550 Update mailmap for Peter Harris
My division was acquired by Rocket Software. The opentext.com email
address is no longer active.

Ref: https://investors.opentext.com/press-releases/press-releases-details/2024/OpenText-Completes-Divestiture-of-Application-Modernization-and-Connectivity-AMC-Business-to-Rocket-Software-for-2.275B/default.aspx
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1914>
(cherry picked from commit dfbc672e85)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
45d9789287 Xserver.man: correct list of available authorization protocols
XDM-AUTHORIZATION-2 (IPv6 capable version of -1) was never merged.
SUN-DES-1 was removed by commit 71b207a2e in 2024
MIT-KERBEROS-5 was removed by commit dfbe32b5b in 2007

Fixes: 71b207a2e ("os: drop SUN-DES-1 authentication")
Fixes: dfbe32b5b ("Remove the old Kerberos 5 authentication code.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1913>
(cherry picked from commit 845c4ae518)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
b05498d3bf Xserver.man: add Xwayland(1) to list of server-specific man pages
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1913>
(cherry picked from commit 80ad8a2c6d)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
b40f3b81e1 Xserver.man: allow line breaks in default font path
Allows nroff to insert a line break between iterm in the font path
instead of displaying it as a single, very overlength line.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1891>
(cherry picked from commit b9c31cc9bc)
2026-01-25 10:40:01 -08:00
Peter Hutterer
84cc4596aa dix: pick the right keyboard for focus FollowKeyboard
This fixes a crash when we try to send focus events and dereference
FollowKeyboardWin (0x3) as WindowPtr.

A device set to XSetDeviceFocus(FollowKeyboard) is supposed to follow
the focus of the corresponding master device. During ActivateKeyboard
a slave device is detached from the master for the duration for the grab
so we don't actually have a master to follow - leaving our oldWin set to
the FollowKeyboardWin constant. This later crashes when we try to
dereference it.

Fix this by getting the current master (if any), or the saved master (if
temporarily detached due to a grab). And if failing that, use the VCK
as fallback device - that is technically wrong but it's such a niche use
case that it shouldn't matter.

Reproducer:
     window = XCreateSimpleWindow(...)
     deviceid = any device that is IsXExtensionKeyboard device
     XSetDeviceFocus(deviceid, FollowKeyboard, ...)
     XGrabDevice(deviceid, window, ...)

Fixes: f01ee198ff ("dix: don't use inputInfo.keyboard to get the focus window in ActivateKbdGrab")

Found-by: Olivier Fourdan <ofourdan@redhat.com>
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
Tested-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1870>
(cherry picked from commit cab9017485)
2026-01-25 10:40:01 -08:00
Enrico Weigelt, metux IT consult
00cd6ed085 xwayland: no need to use WriteReplyToClient()
The WriteReplyToClient() macro is used for cases where byte swapping
is implemented in a separate callback function (set in a global vector
table). Since Xwl extension doesn't have such a callback, but does the
byte swapping directly in it's request handlers, there's no need to
call the WriteReplyToClient() macro - we can use WriteToClient() instead.

Fixes: 2700bc6045 - xwayland: add support for the XWAYLAND extension
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1878>
(cherry picked from commit c445167da6)
2026-01-25 10:40:01 -08:00
Enrico Weigelt, metux IT consult
2b5a37276f kdrive: Xkdrive.man: remove stray whitespace
Tiny editorial correction: drop a stray whitespace in manpage
that sneaked in at recent editorial changes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1876>
(cherry picked from commit 32b3328e49)
2026-01-25 10:40:01 -08:00
Enrico Weigelt, metux IT consult
9a149e1be4 ci: fix missing runner tag on FreeBSD jobs after gitlab migration
All jobs utilizing kvm (eg. FreeBSD) need the "kvm" runner tag set.
It used to work w/o it, since all runners did have kvm, but in the
new CI there are non-kvm runners, so we really need to set the tag.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1872>
(cherry picked from commit 52c2cb7439)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
40bca15705 man pages: use .BR to mark up man page references
The name of a man page is typeset in bold and the section in roman
(see man-pages(7)).

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1875>
(cherry picked from commit 5ac0a19e7f)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
5abf9ba9db Xserver.man: remove X FireWall Proxy (xfwp) info
xfwp has not been maintained in many years, with ssh X11-Forwarding
preferred instead.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1875>
(cherry picked from commit b4b6b19c9a)
2026-01-25 10:40:01 -08:00
Bjarni Ingi Gislason
fefdf88013 inputtestdrv.4: editorial changes for this man page
Use the correct macro for the font change of a single argument or
split the argument into two.

43:.BI Keyboard
46:.BI Pointer
52:.BI PointerAbsolute
58:.BI PointerAbsoluteProximity
62:.BI Touch
103:.BI xf86ITEventWaitForSync

-.-.

Wrong distance between sentences in the input file.

Separate the sentences and subordinate clauses; each begins on a new
line.  See man-pages(7) ("Conventions for source file layout") and
"info groff" ("Input Conventions").

19:server as input events. It supports the full set of the xf86 driver APIs
20:exposed by Xorg. The primary use cases of this input driver are various
29:is created after the driver is initialized. The paths to the socket is passed
37:Sets the path where the driver will create a named socket. Any existing file
47:Initializes a relative-mode pointer device. It will have four valuators -
53:Initializes an absolute-mode pointer device. It will have four valuators -
87:specifies the protocol version supported by it. If this version is lower than
91:to the driver. Each event is an instance of one of the
93:structs. The length field defines the full length of the struct in bytes and
96:The responses from the server follow the same structure. Each response is an
99:structs. The length field defines the full length of the struct in bytes and
104:event. After sending such event, the client must read of a
106:events. The completion of the read operation indicates that Xorg has fully

-.-.

The name of a man page is typeset in bold and the section in roman
(see man-pages(7)).

24:Please refer to xorg.conf(5) for general configuration
112:Xorg(1), xorg.conf(5), Xserver(1), X(7)

-.-

Additionally:

"read of a xf86... event" -> "read an xf86... event"

Originally from: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1095449

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1875>
(cherry picked from commit bcf743f356)
2026-01-25 10:40:01 -08:00
Bjarni Ingi Gislason
2514ca8254 exa.man: editorial changes for this man page
Wrong distance between sentences in the input file.

Separate the sentences and subordinate clauses; each begins on a new
line.  See man-pages(7) ("Conventions for source file layout") and
"info groff" ("Input Conventions").

Mark a final abbreviation point as such by suffixing it with "\&".

25:Disables acceleration of uploading pixmap data to the framebuffer. Default: No.

-.-.

Split a punctuation mark from a single argument for a two-font macro

40:.BR xorg.conf(5).

-.-.

Section headings (.SH and .SS) do not need quoting.

38:.SH "SEE ALSO"

-.-.

Output from "test-groff  -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=10 -ww -z ":

an.tmac:<stdin>:40: misuse, warning: .BR is for at least 2 arguments, got 1
	Use macro '.B' for one argument or split argument.

Originally from: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1095446

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1875>
(cherry picked from commit 49378eb510)
2026-01-25 10:40:01 -08:00
Bjarni Ingi Gislason
6e5e5224be Xserver.man: some remarks and editorial changes for this man page
Output from "mandoc -T lint Xserver.1": (possibly shortened list)

mandoc: Xserver.1:117:4: WARNING: undefined escape, printing literally: \+
mandoc: Xserver.1:118:81: STYLE: input text line longer than 80 bytes: Allow connections fr...
mandoc: Xserver.1:122:84: STYLE: input text line longer than 80 bytes: Prohibit connections...

Add a comma (or \&) after "e.g." and "i.e.", or use English words
(man-pages(7)).

81:sets pointer acceleration (i.e. the ratio of how much is reported to how much
273:sets pointer acceleration threshold in pixels (i.e. after how many pixels
468:contain either an Internet hostname (e.g. expo.lcs.mit.edu)

Split lines longer than 80 characters into two or more lines.
Appropriate break points are the end of a sentence and a subordinate
clause; after punctuation marks.

Xserver.1: line 118 length 81
Allow connections from clients with an endianess different to that of the server.

Xserver.1: line 122 length 84
Prohibit connections from clients with an endianess different to that of the server.

Originally from: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072500

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1875>
(cherry picked from commit 359d12aa0b)
2026-01-25 10:40:01 -08:00
Bjarni Ingi Gislason
34b8a1519f Xserver.man: some editorial fixes for the manual
Wrong distance between sentences.

Separate the sentences and subordinate clauses; each begins on a new
line.  See man-pages(7) ("Conventions for source file layout") and
"info groff" ("Input Conventions").

Split lines longer than 100 characters into two or more lines.
Appropriate break points are the end of a sentence and a subordinate
clause; after punctuation marks.

"[" and "]", showing optional arguments to options, should be typeset in roman.

Output from "test-groff -b -mandoc -dAD=l -rF0 -rHY=0 -t -w w -z -rSTYLECHECK=3":
an.tmac:<stdin>:104: style: .BI expects at least 2 arguments, got 1
troff: backtrace: '/home/bg/git/groff/build/s-tmac/an.tmac':524: macro 'B'
troff: backtrace: file '<stdin>':167
troff:<stdin>:167: warning: cannot select font 'F'

Originally from: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041094

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1875>
(cherry picked from commit 056b447a33)
2026-01-25 10:40:01 -08:00
Bjarni Ingi Gislason
9bb010ca2b Xserver.man: Fix some textual and formatting issues
Protect . if not end of sentence

Protect an aphostrophe (', 0x27), if it can become a control character

Change a HYPHEN-MINUS (code 0x55, 2D) to a minus (\-), if in front of a name
for an option.

Adjust space between sentences or protect the indicator.

Originally from: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869252

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1875>
(cherry picked from commit f544e0df2c)
2026-01-25 10:40:01 -08:00
Bjarni Ingi Gislason
642db82dba Xserver.man: some minor markup changes
Dash for a range is \(en

Change a HYPHEN-MINUS (code 0x55, 2D) to a minus (\-), if in front of a name
for an option.

Add extra word space

Originally from: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=726063

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1875>
(cherry picked from commit d7b7789cac)
2026-01-25 10:40:01 -08:00