Revert "xserver-xorg: Fix for CVE-2023-5574"

These patches are not yet merged (so they're not backports) because they
have outstanding (undescribed) issues[1]. As this issue only affects
Xvfb and is a use-after-free with only a hypothetical attack, revert the
patches until the compromise is understood.

This reverts commit a193c0224a.

[1] https://lists.x.org/archives/xorg-announce/2023-October/003430.html

(From OE-Core rev: 1ed1c4f48203a8366519b40a094c7d9719c3ae32)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5574-1.patch

@@ -1,113 +0,0 @@
-From 1953f460b9ad1a9cdf0fcce70f6ad3310b713d5f Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Thu, 12 Oct 2023 12:44:13 +1000
-Subject: [PATCH] fb: properly wrap/unwrap CloseScreen
-
-fbCloseScreen assumes that it overrides miCloseScreen (which just
-calls FreePixmap(screen->devPrivates)) and emulates that instead of
-wrapping it.
-
-This is a wrong assumption, we may have ShmCloseScreen in the mix too,
-resulting in leaks (see below). Fix this by properly setting up the
-CloseScreen wrapper.
-
-This means we no longer need the manual DestroyPixmap call in
-vfbCloseScreen, reverting d348ab06aae21c153ecbc3511aeafc8ab66d8303
-
-CVE-2023-5574, ZDI-CAN-21213
-
-This vulnerability was discovered by:
-Sri working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
-Reviewed-by: Adam Jackson <ajax@redhat.com>
-
-Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/1953f460b9ad1a9cdf0fcce70f6ad3310b713d5f]
-CVE: CVE-2023-5574
-Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
----
- fb/fb.h             |  1 +
- fb/fbscreen.c       | 14 ++++++++++----
- hw/vfb/InitOutput.c |  7 -------
- 3 files changed, 11 insertions(+), 11 deletions(-)
-
-diff --git a/fb/fb.h b/fb/fb.h
-index d157b6956d..cd7bd05d21 100644
---- a/fb/fb.h
-+++ b/fb/fb.h
-@@ -410,6 +410,7 @@ typedef struct {
- #endif
-     DevPrivateKeyRec    gcPrivateKeyRec;
-     DevPrivateKeyRec    winPrivateKeyRec;
-+    CloseScreenProcPtr  CloseScreen;
- } FbScreenPrivRec, *FbScreenPrivPtr;
- 
- #define fbGetScreenPrivate(pScreen) ((FbScreenPrivPtr) \
-diff --git a/fb/fbscreen.c b/fb/fbscreen.c
-index 4ab807ab50..c481033f98 100644
---- a/fb/fbscreen.c
-+++ b/fb/fbscreen.c
-@@ -29,6 +29,7 @@
- Bool
- fbCloseScreen(ScreenPtr pScreen)
- {
-+    FbScreenPrivPtr screen_priv = fbGetScreenPrivate(pScreen);
-     int d;
-     DepthPtr depths = pScreen->allowedDepths;
- 
-@@ -37,9 +38,10 @@ fbCloseScreen(ScreenPtr pScreen)
-         free(depths[d].vids);
-     free(depths);
-     free(pScreen->visuals);
--    if (pScreen->devPrivate)
--        FreePixmap((PixmapPtr)pScreen->devPrivate);
--    return TRUE;
-+
-+    pScreen->CloseScreen = screen_priv->CloseScreen;
-+
-+    return pScreen->CloseScreen(pScreen);
- }
- 
- Bool
-@@ -144,6 +146,7 @@ fbFinishScreenInit(ScreenPtr pScreen, void *pbits, int xsize, int ysize,
-                    int dpix, int dpiy, int width, int bpp)
- #endif
- {
-+    FbScreenPrivPtr screen_priv;
-     VisualPtr visuals;
-     DepthPtr depths;
-     int nvisuals;
-@@ -177,8 +180,11 @@ fbFinishScreenInit(ScreenPtr pScreen, void *pbits, int xsize, int ysize,
-                       rootdepth, ndepths, depths,
-                       defaultVisual, nvisuals, visuals))
-         return FALSE;
--    /* overwrite miCloseScreen with our own */
-+
-+    screen_priv = fbGetScreenPrivate(pScreen);
-+    screen_priv->CloseScreen = pScreen->CloseScreen;
-     pScreen->CloseScreen = fbCloseScreen;
-+
-     return TRUE;
- }
- 
-diff --git a/hw/vfb/InitOutput.c b/hw/vfb/InitOutput.c
-index 48efb61b2f..076fb7defa 100644
---- a/hw/vfb/InitOutput.c
-+++ b/hw/vfb/InitOutput.c
-@@ -720,13 +720,6 @@ vfbCloseScreen(ScreenPtr pScreen)
- 
-     pScreen->CloseScreen = pvfb->closeScreen;
- 
--    /*
--     * fb overwrites miCloseScreen, so do this here
--     */
--    if (pScreen->devPrivate)
--        (*pScreen->DestroyPixmap) (pScreen->devPrivate);
--    pScreen->devPrivate = NULL;
--
-     return pScreen->CloseScreen(pScreen);
- }
- 
--- 
-GitLab
-

meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5574-2.patch

@@ -1,42 +0,0 @@
-From b6fe3f924aecac6d6e311673511ce61aa2f7a81f Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Thu, 12 Oct 2023 12:42:06 +1000
-Subject: [PATCH] mi: fix CloseScreen initialization order
-
-If SHM is enabled it will set the CloseScreen pointer, only to be
-overridden by the hardcoded miCloseScreen pointer. Do this the other way
-round, miCloseScreen is the bottom of our stack.
-
-Direct leak of 48 byte(s) in 2 object(s) allocated from:
-  #0 0x7f5ea3ad8cc7 in calloc (/lib64/libasan.so.8+0xd8cc7) (BuildId: d8f3addefe29e892d775c30eb364afd3c2484ca5))
-  #1 0x70adfb in ShmInitScreenPriv ../Xext/shm.c:213
-
-Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
-Reviewed-by: Adam Jackson <ajax@redhat.com>
-
-Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/b6fe3f924aecac6d6e311673511ce61aa2f7a81f]
-CVE: CVE-2023-5574
-Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
----
- mi/miscrinit.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mi/miscrinit.c b/mi/miscrinit.c
-index 3bb52b1bc6..b88938c9ae 100644
---- a/mi/miscrinit.c
-+++ b/mi/miscrinit.c
-@@ -249,10 +249,10 @@ miScreenInit(ScreenPtr pScreen, void *pbits,  /* pointer to screen bits */
-     pScreen->numVisuals = numVisuals;
-     pScreen->visuals = visuals;
-     if (width) {
-+        pScreen->CloseScreen = miCloseScreen;
- #ifdef MITSHM
-         ShmRegisterFbFuncs(pScreen);
- #endif
--        pScreen->CloseScreen = miCloseScreen;
-     }
-     /* else CloseScreen */
-     /* QueryBestSize */
--- 
-GitLab
-

meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5574-3.patch

@@ -1,54 +0,0 @@
-From ab2c58ba4719fc31c19c7829b06bdba8a88bd586 Mon Sep 17 00:00:00 2001
-From: Peter Hutterer <peter.hutterer@who-t.net>
-Date: Tue, 24 Oct 2023 12:09:36 +1000
-Subject: [PATCH] dix: always initialize pScreen->CloseScreen
-
-CloseScreen is wrapped by the various modules, many of which do not
-check if they're the last ones unwrapping. This is fine if the order of
-those modules never changes but when it does we might get a NULL-pointer
-dereference by some naive code doing a
-
-   pScreen->CloseScreen = priv->CloseScreen;
-   free(priv);
-   return (*pScreen->CloseScreen)(pScreen);
-
-To avoid this set it to a default function that just returns TRUE that's
-guaranteed to be the last one.
-
-Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/ab2c58ba4719fc31c19c7829b06bdba8a88bd586]
-CVE: CVE-2023-5574
-Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
----
- dix/dispatch.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/dix/dispatch.c b/dix/dispatch.c
-index eaac39b7c9..cd092fd409 100644
---- a/dix/dispatch.c
-+++ b/dix/dispatch.c
-@@ -3890,6 +3890,12 @@ static int indexForScanlinePad[65] = {
-     3                           /* 64 bits per scanline pad unit */
- };
- 
-+static Bool
-+DefaultCloseScreen(ScreenPtr screen)
-+{
-+    return TRUE;
-+}
-+
- /*
- 	grow the array of screenRecs if necessary.
- 	call the device-supplied initialization procedure
-@@ -3949,6 +3955,9 @@ static int init_screen(ScreenPtr pScreen, int i, Bool gpu)
-             PixmapWidthPaddingInfo[depth].notPower2 = 0;
-         }
-     }
-+
-+    pScreen->CloseScreen = DefaultCloseScreen;
-+
-     return 0;
- }
- 
--- 
-GitLab
-

meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.9.bb

@@ -2,9 +2,6 @@ require xserver-xorg.inc
 
 SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch \
            file://0001-Avoid-duplicate-definitions-of-IOPortBase.patch \
-           file://CVE-2023-5574-1.patch \
-           file://CVE-2023-5574-2.patch \
-           file://CVE-2023-5574-3.patch \
            "
 SRC_URI[sha256sum] = "ff697be2011b4c4966b7806929e51b7a08e9d33800d505305d26d9ccde4b533a"