已开启
Fix shm close order for CVE-2023-5574 #386
liyi15创建于 3月13日
Fix shm close order for CVE-2023-5574 #386
已开启
共 2 个文件变更+101-1
| @@ -0,0 +1,96 @@ | |||
| 1 | +From 0831d57043d9a7914e679ee98ffb441b7f37cd22 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: caixuefeng <caixuefeng@xfusion.com> | ||
| 3 | +Date: Fri, 16 Jan 2026 16:51:57 +0800 | ||
| 4 | +Subject: [PATCH] Xext: fix SHM CloseScreen/DestroyPixmap lifecycle order regression | ||
| 5 | + | ||
| 6 | +TigerVNC depends on xorg-x11-server. After integrating | ||
| 7 | +the CVE‑2023‑5574 patch, a coredump occurs when stopping | ||
| 8 | +the TigerVNC service. This patch fixes a lifecycle issue | ||
| 9 | +in the shutdown order of SHM (shared memory), preventing | ||
| 10 | +a race condition between CloseScreen and DestroyPixmap. | ||
| 11 | + | ||
| 12 | +--- | ||
| 13 | + Xext/shm.c | 42 +++++++++++++++++++++++++++++++++++++----- | ||
| 14 | + 1 file changed, 37 insertions(+), 5 deletions(-) | ||
| 15 | + | ||
| 16 | +diff --git a/Xext/shm.c b/Xext/shm.c | ||
| 17 | +index 24c6b10..557af08 100644 | ||
| 18 | +--- a/Xext/shm.c | ||
| 19 | ++++ b/Xext/shm.c | ||
| 20 | + CheckForShmSyscall(void) | ||
| 21 | + | ||
| 22 | + #endif | ||
| 23 | + | ||
| 24 | ++ | ||
| 25 | + static Bool | ||
| 26 | + ShmCloseScreen(ScreenPtr pScreen) | ||
| 27 | + { | ||
| 28 | + ShmScrPrivateRec *screen_priv = ShmGetScreenPriv(pScreen); | ||
| 29 | ++ Bool ret = TRUE; | ||
| 30 | ++ CloseScreenProcPtr savedClose; | ||
| 31 | ++ DestroyPixmapProcPtr savedDestroy; | ||
| 32 | ++ | ||
| 33 | ++ if (!screen_priv) { | ||
| 34 | ++ /* Nothing registered for this screen; just call current CloseScreen. */ | ||
| 35 | ++ return (*pScreen->CloseScreen) (pScreen); | ||
| 36 | ++ } | ||
| 37 | + | ||
| 38 | +- pScreen->CloseScreen = screen_priv->CloseScreen; | ||
| 39 | ++ /* Save pointers from our private before touching pScreen fields. */ | ||
| 40 | ++ savedClose = screen_priv->CloseScreen; | ||
| 41 | ++ savedDestroy = screen_priv->destroyPixmap; | ||
| 42 | ++ | ||
| 43 | ++ /* Restore the previous CloseScreen and DestroyPixmap so upstream cleanup | ||
| 44 | ++ runs with the expected callbacks. Keep screen_priv intact until after | ||
| 45 | ++ the upstream CloseScreen has run. */ | ||
| 46 | ++ pScreen->CloseScreen = savedClose; | ||
| 47 | ++ if (savedDestroy && (savedDestroy == ShmDestroyPixmap)) | ||
| 48 | ++ pScreen->DestroyPixmap = savedDestroy; | ||
| 49 | ++ | ||
| 50 | ++ /* Call the previous CloseScreen while our private still exists. */ | ||
| 51 | ++ ret = (*savedClose) (pScreen); | ||
| 52 | ++ | ||
| 53 | ++ /* Now safe to remove and free our private. */ | ||
| 54 | + dixSetPrivate(&pScreen->devPrivates, shmScrPrivateKey, NULL); | ||
| 55 | + free(screen_priv); | ||
| 56 | +- return (*pScreen->CloseScreen) (pScreen); | ||
| 57 | ++ | ||
| 58 | ++ return ret; | ||
| 59 | + } | ||
| 60 | + | ||
| 61 | + static ShmScrPrivateRec * | ||
| 62 | + ShmRegisterFuncs(ScreenPtr pScreen, ShmFuncsPtr funcs) | ||
| 63 | + static Bool | ||
| 64 | + ShmDestroyPixmap(PixmapPtr pPixmap) | ||
| 65 | + { | ||
| 66 | +- ScreenPtr pScreen = pPixmap->drawable.pScreen; | ||
| 67 | +- ShmScrPrivateRec *screen_priv = ShmGetScreenPriv(pScreen); | ||
| 68 | ++ ScreenPtr pScreen; | ||
| 69 | ++ ShmScrPrivateRec *screen_priv; | ||
| 70 | + void *shmdesc = NULL; | ||
| 71 | + Bool ret; | ||
| 72 | + | ||
| 73 | ++ pScreen = pPixmap->drawable.pScreen; | ||
| 74 | ++ screen_priv = ShmGetScreenPriv(pScreen); | ||
| 75 | ++ | ||
| 76 | ++ /* If we don't have our per-screen private, fall back safely. */ | ||
| 77 | ++ if (!screen_priv) { | ||
| 78 | ++ return FALSE; | ||
| 79 | ++ } | ||
| 80 | ++ | ||
| 81 | + if (pPixmap->refcnt == 1) | ||
| 82 | + shmdesc = dixLookupPrivate(&pPixmap->devPrivates, shmPixmapPrivateKey); | ||
| 83 | + | ||
| 84 | + ShmDestroyPixmap(PixmapPtr pPixmap) | ||
| 85 | + pScreen->DestroyPixmap = ShmDestroyPixmap; | ||
| 86 | + | ||
| 87 | + if (shmdesc) | ||
| 88 | +- ShmDetachSegment(shmdesc, 0); | ||
| 89 | ++ ShmDetachSegment(shmdesc, 0); | ||
| 90 | + | ||
| 91 | + return ret; | ||
| 92 | + } | ||
| 93 | +-- | ||
| 94 | +2.33.0 | ||
| 95 | + | ||
| 96 | + | ||
| @@ -16,7 +16,7 @@ | |||
| 16 | 16 | ||
| 17 | Name: xorg-x11-server | 17 | Name: xorg-x11-server |
| 18 | Version: 1.20.11 | 18 | Version: 1.20.11 |
| 19 | -Release: 43 | 19 | +Release: 44 |
| 20 | Summary: X.Org X11 X server | 20 | Summary: X.Org X11 X server |
| 21 | License: MIT and GPLv2 | 21 | License: MIT and GPLv2 |
| 22 | URL: https://www.x.org | 22 | URL: https://www.x.org |
| @@ -153,6 +153,7 @@ Patch6066: backport-CVE-2025-62229.patch | |||
| 153 | Patch6067: backport-0001-CVE-2025-62230.patch | 153 | Patch6067: backport-0001-CVE-2025-62230.patch |
| 154 | Patch6068: backport-0002-CVE-2025-62230.patch | 154 | Patch6068: backport-0002-CVE-2025-62230.patch |
| 155 | Patch6069: backport-CVE-2025-62231.patch | 155 | Patch6069: backport-CVE-2025-62231.patch |
| 156 | +Patch6070: fix-shm-close-order-for-cve-2023-5574.patch | ||
| 156 | 157 | ||
| 157 | BuildRequires: audit-libs-devel autoconf automake bison dbus-devel flex git gcc | 158 | BuildRequires: audit-libs-devel autoconf automake bison dbus-devel flex git gcc |
| 158 | BuildRequires: systemtap-sdt-devel libtool pkgconfig | 159 | BuildRequires: systemtap-sdt-devel libtool pkgconfig |
| @@ -494,6 +495,9 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete | |||
| 494 | %{_mandir}/man*/* | 495 | %{_mandir}/man*/* |
| 495 | 496 | ||
| 496 | %changelog | 497 | %changelog |
| 498 | +* Fri Mar 13 2026 caixuefeng<caixuefeng@xfusion.com> - 1.20.11-44 | ||
| 499 | +- Fix shm close order for CVE-2023-5574 | ||
| 500 | + | ||
| 497 | * Mon Mar 09 2026 lingsheng <ultra_planet@qq.com> - 1.20.11-43 | 501 | * Mon Mar 09 2026 lingsheng <ultra_planet@qq.com> - 1.20.11-43 |
| 498 | - Fix possible Xorg crashes for ps23xx when using ast and pe2201 bmc card | 502 | - Fix possible Xorg crashes for ps23xx when using ast and pe2201 bmc card |
| 499 | 503 | ||