Patchwork [v4] xserver-kdrive: Fix X server on PowerPC when built with GCC 4.7.x

login
register
mail settings
Submitter Gary Thomas
Date May 16, 2012, 9:26 p.m.
Message ID <1337203583-27729-1-git-send-email-gary@mlbassoc.com>
Download mbox | patch
Permalink /patch/27859/
State Accepted
Commit 7d1bb144404de650c6e83dfd095d16a796cbcf46
Headers show

Comments

Gary Thomas - May 16, 2012, 9:26 p.m.
Newer versions of GCC uncovered illegal code practice which can cause
runtime failures in the Xext/xace.c code.  This problem has been fixed upstream:
  http://cgit.freedesktop.org/xorg/xserver/patch/Xext/xace.c?id=6dae7f3792611aace1df0cca63bf50c50d93de43
  Subject: xace: Invalid reference to out-of-scope data.

Incorporate this patch into the recipe, with a PR bump.

Signed-off-by: Gary Thomas <gary@mlbassoc.com>
---
 .../fix-bogus-stack-variables.patch                |  231 ++++++++++++++++++++
 .../xorg-xserver/xserver-kdrive_1.7.99.2.bb        |    3 +-
 2 files changed, 233 insertions(+), 1 deletions(-)
 create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch
Martin Jansa - May 16, 2012, 9:33 p.m.
On Wed, May 16, 2012 at 03:26:23PM -0600, Gary Thomas wrote:
> Newer versions of GCC uncovered illegal code practice which can cause
> runtime failures in the Xext/xace.c code.  This problem has been fixed upstream:
>   http://cgit.freedesktop.org/xorg/xserver/patch/Xext/xace.c?id=6dae7f3792611aace1df0cca63bf50c50d93de43
>   Subject: xace: Invalid reference to out-of-scope data.
> 
> Incorporate this patch into the recipe, with a PR bump.
> 
> Signed-off-by: Gary Thomas <gary@mlbassoc.com>
> ---
>  .../fix-bogus-stack-variables.patch                |  231 ++++++++++++++++++++
>  .../xorg-xserver/xserver-kdrive_1.7.99.2.bb        |    3 +-
>  2 files changed, 233 insertions(+), 1 deletions(-)
>  create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch
> 
> diff --git a/meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch b/meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch
> new file mode 100644
> index 0000000..d900fc3
> --- /dev/null
> +++ b/meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch
> @@ -0,0 +1,233 @@
> +From 6dae7f3792611aace1df0cca63bf50c50d93de43 Mon Sep 17 00:00:00 2001
> +From: Chris Wilson <chris@chris-wilson.co.uk>
> +Date: Tue, 10 Aug 2010 18:30:20 +0000
> +Subject: xace: Invalid reference to out-of-scope data.
> +
> +The callback data passed by reference to the hook was allocated on stack
> +within the scope of the case statement. The compiler is free to reuse
> +any of that stack space whilst making the function call so we may end up
> +passing garbage into the callback.
> +
> +References:
> +
> +  Bug 18451 - Xorg server 1.5.2 SEGV during XFixesGetCursorImage()
> +  https://bugs.freedesktop.org/show_bug.cgi?id=18451
> +
> +v2: Drop the unrelated hunk that snuck in when ammending the commit
> +message.
> +
> +Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> +Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
> +Signed-off-by: Keith Packard <keithp@keithp.com>
> +
> +Upstream-Status: accepted

Shouldn't this ^ be "Backport" as in v3?

Probably not worth doing v5, just wondering why did you change that to "accepted".

> +---
> +(limited to 'Xext/xace.c')
> +
> +diff --git a/Xext/xace.c b/Xext/xace.c
> +index e10d837..c757cad 100644
> +--- a/Xext/xace.c
> ++++ b/Xext/xace.c
> +@@ -87,7 +87,18 @@ void XaceHookAuditEnd(ClientPtr ptr, int result)
> +  */
> + int XaceHook(int hook, ...)
> + {
> +-    pointer calldata;	/* data passed to callback */
> ++    union {
> ++	XaceResourceAccessRec res;
> ++	XaceDeviceAccessRec dev;
> ++	XaceSendAccessRec send;
> ++	XaceReceiveAccessRec recv;
> ++	XaceClientAccessRec client;
> ++	XaceExtAccessRec ext;
> ++	XaceServerAccessRec server;
> ++	XaceScreenAccessRec screen;
> ++	XaceAuthAvailRec auth;
> ++	XaceKeyAvailRec key;
> ++    } u;
> +     int *prv = NULL;	/* points to return value from callback */
> +     va_list ap;		/* argument list */
> +     va_start(ap, hook);
> +@@ -99,117 +110,86 @@ int XaceHook(int hook, ...)
> +      */
> +     switch (hook)
> +     {
> +-	case XACE_RESOURCE_ACCESS: {
> +-	    XaceResourceAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.id = va_arg(ap, XID);
> +-	    rec.rtype = va_arg(ap, RESTYPE);
> +-	    rec.res = va_arg(ap, pointer);
> +-	    rec.ptype = va_arg(ap, RESTYPE);
> +-	    rec.parent = va_arg(ap, pointer);
> +-	    rec.access_mode = va_arg(ap, Mask);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata = &rec;
> +-	    prv = &rec.status;
> ++	case XACE_RESOURCE_ACCESS:
> ++	    u.res.client = va_arg(ap, ClientPtr);
> ++	    u.res.id = va_arg(ap, XID);
> ++	    u.res.rtype = va_arg(ap, RESTYPE);
> ++	    u.res.res = va_arg(ap, pointer);
> ++	    u.res.ptype = va_arg(ap, RESTYPE);
> ++	    u.res.parent = va_arg(ap, pointer);
> ++	    u.res.access_mode = va_arg(ap, Mask);
> ++	    u.res.status = Success; /* default allow */
> ++	    prv = &u.res.status;
> + 	    break;
> +-	}
> +-	case XACE_DEVICE_ACCESS: {
> +-	    XaceDeviceAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.dev = va_arg(ap, DeviceIntPtr);
> +-	    rec.access_mode = va_arg(ap, Mask);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata = &rec;
> +-	    prv = &rec.status;
> ++	case XACE_DEVICE_ACCESS:
> ++	    u.dev.client = va_arg(ap, ClientPtr);
> ++	    u.dev.dev = va_arg(ap, DeviceIntPtr);
> ++	    u.dev.access_mode = va_arg(ap, Mask);
> ++	    u.dev.status = Success; /* default allow */
> ++	    prv = &u.dev.status;
> + 	    break;
> +-	}
> +-	case XACE_SEND_ACCESS: {
> +-	    XaceSendAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.dev = va_arg(ap, DeviceIntPtr);
> +-	    rec.pWin = va_arg(ap, WindowPtr);
> +-	    rec.events = va_arg(ap, xEventPtr);
> +-	    rec.count = va_arg(ap, int);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata = &rec;
> +-	    prv = &rec.status;
> ++	case XACE_SEND_ACCESS:
> ++	    u.send.client = va_arg(ap, ClientPtr);
> ++	    u.send.dev = va_arg(ap, DeviceIntPtr);
> ++	    u.send.pWin = va_arg(ap, WindowPtr);
> ++	    u.send.events = va_arg(ap, xEventPtr);
> ++	    u.send.count = va_arg(ap, int);
> ++	    u.send.status = Success; /* default allow */
> ++	    prv = &u.send.status;
> + 	    break;
> +-	}
> +-	case XACE_RECEIVE_ACCESS: {
> +-	    XaceReceiveAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.pWin = va_arg(ap, WindowPtr);
> +-	    rec.events = va_arg(ap, xEventPtr);
> +-	    rec.count = va_arg(ap, int);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata = &rec;
> +-	    prv = &rec.status;
> ++	case XACE_RECEIVE_ACCESS:
> ++	    u.recv.client = va_arg(ap, ClientPtr);
> ++	    u.recv.pWin = va_arg(ap, WindowPtr);
> ++	    u.recv.events = va_arg(ap, xEventPtr);
> ++	    u.recv.count = va_arg(ap, int);
> ++	    u.recv.status = Success; /* default allow */
> ++	    prv = &u.recv.status;
> + 	    break;
> +-	}
> +-	case XACE_CLIENT_ACCESS: {
> +-	    XaceClientAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.target = va_arg(ap, ClientPtr);
> +-	    rec.access_mode = va_arg(ap, Mask);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata = &rec;
> +-	    prv = &rec.status;
> ++	case XACE_CLIENT_ACCESS:
> ++	    u.client.client = va_arg(ap, ClientPtr);
> ++	    u.client.target = va_arg(ap, ClientPtr);
> ++	    u.client.access_mode = va_arg(ap, Mask);
> ++	    u.client.status = Success; /* default allow */
> ++	    prv = &u.client.status;
> + 	    break;
> +-	}
> +-	case XACE_EXT_ACCESS: {
> +-	    XaceExtAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.ext = va_arg(ap, ExtensionEntry*);
> +-	    rec.access_mode = DixGetAttrAccess;
> +-	    rec.status = Success; /* default allow */
> +-	    calldata = &rec;
> +-	    prv = &rec.status;
> ++	case XACE_EXT_ACCESS:
> ++	    u.ext.client = va_arg(ap, ClientPtr);
> ++	    u.ext.ext = va_arg(ap, ExtensionEntry*);
> ++	    u.ext.access_mode = DixGetAttrAccess;
> ++	    u.ext.status = Success; /* default allow */
> ++	    prv = &u.ext.status;
> + 	    break;
> +-	}
> +-	case XACE_SERVER_ACCESS: {
> +-	    XaceServerAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.access_mode = va_arg(ap, Mask);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata = &rec;
> +-	    prv = &rec.status;
> ++	case XACE_SERVER_ACCESS:
> ++	    u.server.client = va_arg(ap, ClientPtr);
> ++	    u.server.access_mode = va_arg(ap, Mask);
> ++	    u.server.status = Success; /* default allow */
> ++	    prv = &u.server.status;
> + 	    break;
> +-	}
> + 	case XACE_SCREEN_ACCESS:
> +-	case XACE_SCREENSAVER_ACCESS: {
> +-	    XaceScreenAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.screen = va_arg(ap, ScreenPtr);
> +-	    rec.access_mode = va_arg(ap, Mask);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata = &rec;
> +-	    prv = &rec.status;
> ++	case XACE_SCREENSAVER_ACCESS:
> ++	    u.screen.client = va_arg(ap, ClientPtr);
> ++	    u.screen.screen = va_arg(ap, ScreenPtr);
> ++	    u.screen.access_mode = va_arg(ap, Mask);
> ++	    u.screen.status = Success; /* default allow */
> ++	    prv = &u.screen.status;
> + 	    break;
> +-	}
> +-	case XACE_AUTH_AVAIL: {
> +-	    XaceAuthAvailRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.authId = va_arg(ap, XID);
> +-	    calldata = &rec;
> ++	case XACE_AUTH_AVAIL:
> ++	    u.auth.client = va_arg(ap, ClientPtr);
> ++	    u.auth.authId = va_arg(ap, XID);
> + 	    break;
> +-	}
> +-	case XACE_KEY_AVAIL: {
> +-	    XaceKeyAvailRec rec;
> +-	    rec.event = va_arg(ap, xEventPtr);
> +-	    rec.keybd = va_arg(ap, DeviceIntPtr);
> +-	    rec.count = va_arg(ap, int);
> +-	    calldata = &rec;
> ++	case XACE_KEY_AVAIL:
> ++	    u.key.event = va_arg(ap, xEventPtr);
> ++	    u.key.keybd = va_arg(ap, DeviceIntPtr);
> ++	    u.key.count = va_arg(ap, int);
> + 	    break;
> +-	}
> +-	default: {
> ++	default:
> + 	    va_end(ap);
> + 	    return 0;	/* unimplemented hook number */
> +-	}
> +     }
> +     va_end(ap);
> +  
> +     /* call callbacks and return result, if any. */
> +-    CallCallbacks(&XaceHooks[hook], calldata);
> ++    CallCallbacks(&XaceHooks[hook], &u);
> +     return prv ? *prv : Success;
> + }
> + 
> +--
> +cgit v0.9.0.2-2-gbebe
> diff --git a/meta/recipes-graphics/xorg-xserver/xserver-kdrive_1.7.99.2.bb b/meta/recipes-graphics/xorg-xserver/xserver-kdrive_1.7.99.2.bb
> index 360a0f3..d90dc25 100644
> --- a/meta/recipes-graphics/xorg-xserver/xserver-kdrive_1.7.99.2.bb
> +++ b/meta/recipes-graphics/xorg-xserver/xserver-kdrive_1.7.99.2.bb
> @@ -7,7 +7,7 @@ RDEPENDS_${PN} += "xkeyboard-config"
>  EXTRA_OECONF += "--disable-glx"
>  
>  PE = "1"
> -PR = "r29"
> +PR = "r30"
>  
>  SRC_URI = "${XORG_MIRROR}/individual/xserver/xorg-server-${PV}.tar.bz2 \
>  	file://extra-kmodes.patch \
> @@ -20,6 +20,7 @@ SRC_URI = "${XORG_MIRROR}/individual/xserver/xorg-server-${PV}.tar.bz2 \
>  	file://fix-newer-xorg-headers.patch \
>  	file://crosscompile.patch \
>  	file://error-address-work-around.patch \
> +        file://fix-bogus-stack-variables.patch \
>  	file://nodolt.patch"
>  #	file://kdrive-evdev.patch
>  #	file://kdrive-use-evdev.patch
> -- 
> 1.7.7.6
> 
> 
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.linuxtogo.org/cgi-bin/mailman/listinfo/openembedded-core
Gary Thomas - May 18, 2012, 2:16 p.m.
On 2012-05-16 15:26, Gary Thomas wrote:
> Newer versions of GCC uncovered illegal code practice which can cause
> runtime failures in the Xext/xace.c code.  This problem has been fixed upstream:
>    http://cgit.freedesktop.org/xorg/xserver/patch/Xext/xace.c?id=6dae7f3792611aace1df0cca63bf50c50d93de43
>    Subject: xace: Invalid reference to out-of-scope data.
>
> Incorporate this patch into the recipe, with a PR bump.
>
> Signed-off-by: Gary Thomas<gary@mlbassoc.com>

Ping?

> ---
>   .../fix-bogus-stack-variables.patch                |  231 ++++++++++++++++++++
>   .../xorg-xserver/xserver-kdrive_1.7.99.2.bb        |    3 +-
>   2 files changed, 233 insertions(+), 1 deletions(-)
>   create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch
>
> diff --git a/meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch b/meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch
> new file mode 100644
> index 0000000..d900fc3
> --- /dev/null
> +++ b/meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch
> @@ -0,0 +1,233 @@
> +From 6dae7f3792611aace1df0cca63bf50c50d93de43 Mon Sep 17 00:00:00 2001
> +From: Chris Wilson<chris@chris-wilson.co.uk>
> +Date: Tue, 10 Aug 2010 18:30:20 +0000
> +Subject: xace: Invalid reference to out-of-scope data.
> +
> +The callback data passed by reference to the hook was allocated on stack
> +within the scope of the case statement. The compiler is free to reuse
> +any of that stack space whilst making the function call so we may end up
> +passing garbage into the callback.
> +
> +References:
> +
> +  Bug 18451 - Xorg server 1.5.2 SEGV during XFixesGetCursorImage()
> +  https://bugs.freedesktop.org/show_bug.cgi?id=18451
> +
> +v2: Drop the unrelated hunk that snuck in when ammending the commit
> +message.
> +
> +Signed-off-by: Chris Wilson<chris@chris-wilson.co.uk>
> +Reviewed-by: Alan Coopersmith<alan.coopersmith@oracle.com>
> +Signed-off-by: Keith Packard<keithp@keithp.com>
> +
> +Upstream-Status: accepted
> +---
> +(limited to 'Xext/xace.c')
> +
> +diff --git a/Xext/xace.c b/Xext/xace.c
> +index e10d837..c757cad 100644
> +--- a/Xext/xace.c
> ++++ b/Xext/xace.c
> +@@ -87,7 +87,18 @@ void XaceHookAuditEnd(ClientPtr ptr, int result)
> +  */
> + int XaceHook(int hook, ...)
> + {
> +-    pointer calldata;	/* data passed to callback */
> ++    union {
> ++	XaceResourceAccessRec res;
> ++	XaceDeviceAccessRec dev;
> ++	XaceSendAccessRec send;
> ++	XaceReceiveAccessRec recv;
> ++	XaceClientAccessRec client;
> ++	XaceExtAccessRec ext;
> ++	XaceServerAccessRec server;
> ++	XaceScreenAccessRec screen;
> ++	XaceAuthAvailRec auth;
> ++	XaceKeyAvailRec key;
> ++    } u;
> +     int *prv = NULL;	/* points to return value from callback */
> +     va_list ap;		/* argument list */
> +     va_start(ap, hook);
> +@@ -99,117 +110,86 @@ int XaceHook(int hook, ...)
> +      */
> +     switch (hook)
> +     {
> +-	case XACE_RESOURCE_ACCESS: {
> +-	    XaceResourceAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.id = va_arg(ap, XID);
> +-	    rec.rtype = va_arg(ap, RESTYPE);
> +-	    rec.res = va_arg(ap, pointer);
> +-	    rec.ptype = va_arg(ap, RESTYPE);
> +-	    rec.parent = va_arg(ap, pointer);
> +-	    rec.access_mode = va_arg(ap, Mask);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata =&rec;
> +-	    prv =&rec.status;
> ++	case XACE_RESOURCE_ACCESS:
> ++	    u.res.client = va_arg(ap, ClientPtr);
> ++	    u.res.id = va_arg(ap, XID);
> ++	    u.res.rtype = va_arg(ap, RESTYPE);
> ++	    u.res.res = va_arg(ap, pointer);
> ++	    u.res.ptype = va_arg(ap, RESTYPE);
> ++	    u.res.parent = va_arg(ap, pointer);
> ++	    u.res.access_mode = va_arg(ap, Mask);
> ++	    u.res.status = Success; /* default allow */
> ++	    prv =&u.res.status;
> + 	    break;
> +-	}
> +-	case XACE_DEVICE_ACCESS: {
> +-	    XaceDeviceAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.dev = va_arg(ap, DeviceIntPtr);
> +-	    rec.access_mode = va_arg(ap, Mask);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata =&rec;
> +-	    prv =&rec.status;
> ++	case XACE_DEVICE_ACCESS:
> ++	    u.dev.client = va_arg(ap, ClientPtr);
> ++	    u.dev.dev = va_arg(ap, DeviceIntPtr);
> ++	    u.dev.access_mode = va_arg(ap, Mask);
> ++	    u.dev.status = Success; /* default allow */
> ++	    prv =&u.dev.status;
> + 	    break;
> +-	}
> +-	case XACE_SEND_ACCESS: {
> +-	    XaceSendAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.dev = va_arg(ap, DeviceIntPtr);
> +-	    rec.pWin = va_arg(ap, WindowPtr);
> +-	    rec.events = va_arg(ap, xEventPtr);
> +-	    rec.count = va_arg(ap, int);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata =&rec;
> +-	    prv =&rec.status;
> ++	case XACE_SEND_ACCESS:
> ++	    u.send.client = va_arg(ap, ClientPtr);
> ++	    u.send.dev = va_arg(ap, DeviceIntPtr);
> ++	    u.send.pWin = va_arg(ap, WindowPtr);
> ++	    u.send.events = va_arg(ap, xEventPtr);
> ++	    u.send.count = va_arg(ap, int);
> ++	    u.send.status = Success; /* default allow */
> ++	    prv =&u.send.status;
> + 	    break;
> +-	}
> +-	case XACE_RECEIVE_ACCESS: {
> +-	    XaceReceiveAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.pWin = va_arg(ap, WindowPtr);
> +-	    rec.events = va_arg(ap, xEventPtr);
> +-	    rec.count = va_arg(ap, int);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata =&rec;
> +-	    prv =&rec.status;
> ++	case XACE_RECEIVE_ACCESS:
> ++	    u.recv.client = va_arg(ap, ClientPtr);
> ++	    u.recv.pWin = va_arg(ap, WindowPtr);
> ++	    u.recv.events = va_arg(ap, xEventPtr);
> ++	    u.recv.count = va_arg(ap, int);
> ++	    u.recv.status = Success; /* default allow */
> ++	    prv =&u.recv.status;
> + 	    break;
> +-	}
> +-	case XACE_CLIENT_ACCESS: {
> +-	    XaceClientAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.target = va_arg(ap, ClientPtr);
> +-	    rec.access_mode = va_arg(ap, Mask);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata =&rec;
> +-	    prv =&rec.status;
> ++	case XACE_CLIENT_ACCESS:
> ++	    u.client.client = va_arg(ap, ClientPtr);
> ++	    u.client.target = va_arg(ap, ClientPtr);
> ++	    u.client.access_mode = va_arg(ap, Mask);
> ++	    u.client.status = Success; /* default allow */
> ++	    prv =&u.client.status;
> + 	    break;
> +-	}
> +-	case XACE_EXT_ACCESS: {
> +-	    XaceExtAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.ext = va_arg(ap, ExtensionEntry*);
> +-	    rec.access_mode = DixGetAttrAccess;
> +-	    rec.status = Success; /* default allow */
> +-	    calldata =&rec;
> +-	    prv =&rec.status;
> ++	case XACE_EXT_ACCESS:
> ++	    u.ext.client = va_arg(ap, ClientPtr);
> ++	    u.ext.ext = va_arg(ap, ExtensionEntry*);
> ++	    u.ext.access_mode = DixGetAttrAccess;
> ++	    u.ext.status = Success; /* default allow */
> ++	    prv =&u.ext.status;
> + 	    break;
> +-	}
> +-	case XACE_SERVER_ACCESS: {
> +-	    XaceServerAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.access_mode = va_arg(ap, Mask);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata =&rec;
> +-	    prv =&rec.status;
> ++	case XACE_SERVER_ACCESS:
> ++	    u.server.client = va_arg(ap, ClientPtr);
> ++	    u.server.access_mode = va_arg(ap, Mask);
> ++	    u.server.status = Success; /* default allow */
> ++	    prv =&u.server.status;
> + 	    break;
> +-	}
> + 	case XACE_SCREEN_ACCESS:
> +-	case XACE_SCREENSAVER_ACCESS: {
> +-	    XaceScreenAccessRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.screen = va_arg(ap, ScreenPtr);
> +-	    rec.access_mode = va_arg(ap, Mask);
> +-	    rec.status = Success; /* default allow */
> +-	    calldata =&rec;
> +-	    prv =&rec.status;
> ++	case XACE_SCREENSAVER_ACCESS:
> ++	    u.screen.client = va_arg(ap, ClientPtr);
> ++	    u.screen.screen = va_arg(ap, ScreenPtr);
> ++	    u.screen.access_mode = va_arg(ap, Mask);
> ++	    u.screen.status = Success; /* default allow */
> ++	    prv =&u.screen.status;
> + 	    break;
> +-	}
> +-	case XACE_AUTH_AVAIL: {
> +-	    XaceAuthAvailRec rec;
> +-	    rec.client = va_arg(ap, ClientPtr);
> +-	    rec.authId = va_arg(ap, XID);
> +-	    calldata =&rec;
> ++	case XACE_AUTH_AVAIL:
> ++	    u.auth.client = va_arg(ap, ClientPtr);
> ++	    u.auth.authId = va_arg(ap, XID);
> + 	    break;
> +-	}
> +-	case XACE_KEY_AVAIL: {
> +-	    XaceKeyAvailRec rec;
> +-	    rec.event = va_arg(ap, xEventPtr);
> +-	    rec.keybd = va_arg(ap, DeviceIntPtr);
> +-	    rec.count = va_arg(ap, int);
> +-	    calldata =&rec;
> ++	case XACE_KEY_AVAIL:
> ++	    u.key.event = va_arg(ap, xEventPtr);
> ++	    u.key.keybd = va_arg(ap, DeviceIntPtr);
> ++	    u.key.count = va_arg(ap, int);
> + 	    break;
> +-	}
> +-	default: {
> ++	default:
> + 	    va_end(ap);
> + 	    return 0;	/* unimplemented hook number */
> +-	}
> +     }
> +     va_end(ap);
> +
> +     /* call callbacks and return result, if any. */
> +-    CallCallbacks(&XaceHooks[hook], calldata);
> ++    CallCallbacks(&XaceHooks[hook],&u);
> +     return prv ? *prv : Success;
> + }
> +
> +--
> +cgit v0.9.0.2-2-gbebe
> diff --git a/meta/recipes-graphics/xorg-xserver/xserver-kdrive_1.7.99.2.bb b/meta/recipes-graphics/xorg-xserver/xserver-kdrive_1.7.99.2.bb
> index 360a0f3..d90dc25 100644
> --- a/meta/recipes-graphics/xorg-xserver/xserver-kdrive_1.7.99.2.bb
> +++ b/meta/recipes-graphics/xorg-xserver/xserver-kdrive_1.7.99.2.bb
> @@ -7,7 +7,7 @@ RDEPENDS_${PN} += "xkeyboard-config"
>   EXTRA_OECONF += "--disable-glx"
>
>   PE = "1"
> -PR = "r29"
> +PR = "r30"
>
>   SRC_URI = "${XORG_MIRROR}/individual/xserver/xorg-server-${PV}.tar.bz2 \
>   	file://extra-kmodes.patch \
> @@ -20,6 +20,7 @@ SRC_URI = "${XORG_MIRROR}/individual/xserver/xorg-server-${PV}.tar.bz2 \
>   	file://fix-newer-xorg-headers.patch \
>   	file://crosscompile.patch \
>   	file://error-address-work-around.patch \
> +        file://fix-bogus-stack-variables.patch \
>   	file://nodolt.patch"
>   #	file://kdrive-evdev.patch
>   #	file://kdrive-use-evdev.patch
Andrei Gherzan - May 18, 2012, 2:24 p.m.
On Fri, May 18, 2012 at 5:16 PM, Gary Thomas <gary@mlbassoc.com> wrote:

> On 2012-05-16 15:26, Gary Thomas wrote:
>
>> Newer versions of GCC uncovered illegal code practice which can cause
>> runtime failures in the Xext/xace.c code.  This problem has been fixed
>> upstream:
>>   http://cgit.freedesktop.org/**xorg/xserver/patch/Xext/xace.**c?id=**
>> 6dae7f3792611aace1df0cca63bf50**c50d93de43<http://cgit.freedesktop.org/xorg/xserver/patch/Xext/xace.c?id=6dae7f3792611aace1df0cca63bf50c50d93de43>
>>   Subject: xace: Invalid reference to out-of-scope data.
>>
>> Incorporate this patch into the recipe, with a PR bump.
>>
>> Signed-off-by: Gary Thomas<gary@mlbassoc.com>
>>
>
> Ping?
>

Double ping.


>  ---
>>  .../fix-bogus-stack-variables.**patch                |  231
>> ++++++++++++++++++++
>>  .../xorg-xserver/xserver-**kdrive_1.7.99.2.bb<http://xserver-kdrive_1.7.99.2.bb>       |    3 +-
>>  2 files changed, 233 insertions(+), 1 deletions(-)
>>  create mode 100644 meta/recipes-graphics/xorg-**
>> xserver/xserver-kdrive-1.7.99.**2/fix-bogus-stack-variables.**patch
>>
>> diff --git a/meta/recipes-graphics/xorg-**xserver/xserver-kdrive-1.7.99.*
>> *2/fix-bogus-stack-variables.**patch b/meta/recipes-graphics/xorg-**
>> xserver/xserver-kdrive-1.7.99.**2/fix-bogus-stack-variables.**patch
>> new file mode 100644
>> index 0000000..d900fc3
>> --- /dev/null
>> +++ b/meta/recipes-graphics/xorg-**xserver/xserver-kdrive-1.7.99.**
>> 2/fix-bogus-stack-variables.**patch
>> @@ -0,0 +1,233 @@
>> +From 6dae7f3792611aace1df0cca63bf50**c50d93de43 Mon Sep 17 00:00:00 2001
>> +From: Chris Wilson<chris@chris-wilson.co.**uk <chris@chris-wilson.co.uk>
>> >
>> +Date: Tue, 10 Aug 2010 18:30:20 +0000
>> +Subject: xace: Invalid reference to out-of-scope data.
>> +
>> +The callback data passed by reference to the hook was allocated on stack
>> +within the scope of the case statement. The compiler is free to reuse
>> +any of that stack space whilst making the function call so we may end up
>> +passing garbage into the callback.
>> +
>> +References:
>> +
>> +  Bug 18451 - Xorg server 1.5.2 SEGV during XFixesGetCursorImage()
>> +  https://bugs.freedesktop.org/**show_bug.cgi?id=18451<https://bugs.freedesktop.org/show_bug.cgi?id=18451>
>> +
>> +v2: Drop the unrelated hunk that snuck in when ammending the commit
>> +message.
>> +
>> +Signed-off-by: Chris Wilson<chris@chris-wilson.co.**uk<chris@chris-wilson.co.uk>
>> >
>> +Reviewed-by: Alan Coopersmith<alan.coopersmith@**oracle.com<alan.coopersmith@oracle.com>
>> >
>> +Signed-off-by: Keith Packard<keithp@keithp.com>
>> +
>> +Upstream-Status: accepted
>> +---
>> +(limited to 'Xext/xace.c')
>> +
>> +diff --git a/Xext/xace.c b/Xext/xace.c
>> +index e10d837..c757cad 100644
>> +--- a/Xext/xace.c
>> ++++ b/Xext/xace.c
>> +@@ -87,7 +87,18 @@ void XaceHookAuditEnd(ClientPtr ptr, int result)
>> +  */
>> + int XaceHook(int hook, ...)
>> + {
>> +-    pointer calldata; /* data passed to callback */
>> ++    union {
>> ++      XaceResourceAccessRec res;
>> ++      XaceDeviceAccessRec dev;
>> ++      XaceSendAccessRec send;
>> ++      XaceReceiveAccessRec recv;
>> ++      XaceClientAccessRec client;
>> ++      XaceExtAccessRec ext;
>> ++      XaceServerAccessRec server;
>> ++      XaceScreenAccessRec screen;
>> ++      XaceAuthAvailRec auth;
>> ++      XaceKeyAvailRec key;
>> ++    } u;
>> +     int *prv = NULL;  /* points to return value from callback */
>> +     va_list ap;               /* argument list */
>> +     va_start(ap, hook);
>> +@@ -99,117 +110,86 @@ int XaceHook(int hook, ...)
>> +      */
>> +     switch (hook)
>> +     {
>> +-      case XACE_RESOURCE_ACCESS: {
>> +-          XaceResourceAccessRec rec;
>> +-          rec.client = va_arg(ap, ClientPtr);
>> +-          rec.id = va_arg(ap, XID);
>> +-          rec.rtype = va_arg(ap, RESTYPE);
>> +-          rec.res = va_arg(ap, pointer);
>> +-          rec.ptype = va_arg(ap, RESTYPE);
>> +-          rec.parent = va_arg(ap, pointer);
>> +-          rec.access_mode = va_arg(ap, Mask);
>> +-          rec.status = Success; /* default allow */
>> +-          calldata =&rec;
>> +-          prv =&rec.status;
>> ++      case XACE_RESOURCE_ACCESS:
>> ++          u.res.client = va_arg(ap, ClientPtr);
>> ++          u.res.id = va_arg(ap, XID);
>> ++          u.res.rtype = va_arg(ap, RESTYPE);
>> ++          u.res.res = va_arg(ap, pointer);
>> ++          u.res.ptype = va_arg(ap, RESTYPE);
>> ++          u.res.parent = va_arg(ap, pointer);
>> ++          u.res.access_mode = va_arg(ap, Mask);
>> ++          u.res.status = Success; /* default allow */
>> ++          prv =&u.res.status;
>> +           break;
>> +-      }
>> +-      case XACE_DEVICE_ACCESS: {
>> +-          XaceDeviceAccessRec rec;
>> +-          rec.client = va_arg(ap, ClientPtr);
>> +-          rec.dev = va_arg(ap, DeviceIntPtr);
>> +-          rec.access_mode = va_arg(ap, Mask);
>> +-          rec.status = Success; /* default allow */
>> +-          calldata =&rec;
>> +-          prv =&rec.status;
>> ++      case XACE_DEVICE_ACCESS:
>> ++          u.dev.client = va_arg(ap, ClientPtr);
>> ++          u.dev.dev = va_arg(ap, DeviceIntPtr);
>> ++          u.dev.access_mode = va_arg(ap, Mask);
>> ++          u.dev.status = Success; /* default allow */
>> ++          prv =&u.dev.status;
>> +           break;
>> +-      }
>> +-      case XACE_SEND_ACCESS: {
>> +-          XaceSendAccessRec rec;
>> +-          rec.client = va_arg(ap, ClientPtr);
>> +-          rec.dev = va_arg(ap, DeviceIntPtr);
>> +-          rec.pWin = va_arg(ap, WindowPtr);
>> +-          rec.events = va_arg(ap, xEventPtr);
>> +-          rec.count = va_arg(ap, int);
>> +-          rec.status = Success; /* default allow */
>> +-          calldata =&rec;
>> +-          prv =&rec.status;
>> ++      case XACE_SEND_ACCESS:
>> ++          u.send.client = va_arg(ap, ClientPtr);
>> ++          u.send.dev = va_arg(ap, DeviceIntPtr);
>> ++          u.send.pWin = va_arg(ap, WindowPtr);
>> ++          u.send.events = va_arg(ap, xEventPtr);
>> ++          u.send.count = va_arg(ap, int);
>> ++          u.send.status = Success; /* default allow */
>> ++          prv =&u.send.status;
>> +           break;
>> +-      }
>> +-      case XACE_RECEIVE_ACCESS: {
>> +-          XaceReceiveAccessRec rec;
>> +-          rec.client = va_arg(ap, ClientPtr);
>> +-          rec.pWin = va_arg(ap, WindowPtr);
>> +-          rec.events = va_arg(ap, xEventPtr);
>> +-          rec.count = va_arg(ap, int);
>> +-          rec.status = Success; /* default allow */
>> +-          calldata =&rec;
>> +-          prv =&rec.status;
>> ++      case XACE_RECEIVE_ACCESS:
>> ++          u.recv.client = va_arg(ap, ClientPtr);
>> ++          u.recv.pWin = va_arg(ap, WindowPtr);
>> ++          u.recv.events = va_arg(ap, xEventPtr);
>> ++          u.recv.count = va_arg(ap, int);
>> ++          u.recv.status = Success; /* default allow */
>> ++          prv =&u.recv.status;
>> +           break;
>> +-      }
>> +-      case XACE_CLIENT_ACCESS: {
>> +-          XaceClientAccessRec rec;
>> +-          rec.client = va_arg(ap, ClientPtr);
>> +-          rec.target = va_arg(ap, ClientPtr);
>> +-          rec.access_mode = va_arg(ap, Mask);
>> +-          rec.status = Success; /* default allow */
>> +-          calldata =&rec;
>> +-          prv =&rec.status;
>> ++      case XACE_CLIENT_ACCESS:
>> ++          u.client.client = va_arg(ap, ClientPtr);
>> ++          u.client.target = va_arg(ap, ClientPtr);
>> ++          u.client.access_mode = va_arg(ap, Mask);
>> ++          u.client.status = Success; /* default allow */
>> ++          prv =&u.client.status;
>> +           break;
>> +-      }
>> +-      case XACE_EXT_ACCESS: {
>> +-          XaceExtAccessRec rec;
>> +-          rec.client = va_arg(ap, ClientPtr);
>> +-          rec.ext = va_arg(ap, ExtensionEntry*);
>> +-          rec.access_mode = DixGetAttrAccess;
>> +-          rec.status = Success; /* default allow */
>> +-          calldata =&rec;
>> +-          prv =&rec.status;
>> ++      case XACE_EXT_ACCESS:
>> ++          u.ext.client = va_arg(ap, ClientPtr);
>> ++          u.ext.ext = va_arg(ap, ExtensionEntry*);
>> ++          u.ext.access_mode = DixGetAttrAccess;
>> ++          u.ext.status = Success; /* default allow */
>> ++          prv =&u.ext.status;
>> +           break;
>> +-      }
>> +-      case XACE_SERVER_ACCESS: {
>> +-          XaceServerAccessRec rec;
>> +-          rec.client = va_arg(ap, ClientPtr);
>> +-          rec.access_mode = va_arg(ap, Mask);
>> +-          rec.status = Success; /* default allow */
>> +-          calldata =&rec;
>> +-          prv =&rec.status;
>> ++      case XACE_SERVER_ACCESS:
>> ++          u.server.client = va_arg(ap, ClientPtr);
>> ++          u.server.access_mode = va_arg(ap, Mask);
>> ++          u.server.status = Success; /* default allow */
>> ++          prv =&u.server.status;
>> +           break;
>> +-      }
>> +       case XACE_SCREEN_ACCESS:
>> +-      case XACE_SCREENSAVER_ACCESS: {
>> +-          XaceScreenAccessRec rec;
>> +-          rec.client = va_arg(ap, ClientPtr);
>> +-          rec.screen = va_arg(ap, ScreenPtr);
>> +-          rec.access_mode = va_arg(ap, Mask);
>> +-          rec.status = Success; /* default allow */
>> +-          calldata =&rec;
>> +-          prv =&rec.status;
>> ++      case XACE_SCREENSAVER_ACCESS:
>> ++          u.screen.client = va_arg(ap, ClientPtr);
>> ++          u.screen.screen = va_arg(ap, ScreenPtr);
>> ++          u.screen.access_mode = va_arg(ap, Mask);
>> ++          u.screen.status = Success; /* default allow */
>> ++          prv =&u.screen.status;
>> +           break;
>> +-      }
>> +-      case XACE_AUTH_AVAIL: {
>> +-          XaceAuthAvailRec rec;
>> +-          rec.client = va_arg(ap, ClientPtr);
>> +-          rec.authId = va_arg(ap, XID);
>> +-          calldata =&rec;
>> ++      case XACE_AUTH_AVAIL:
>> ++          u.auth.client = va_arg(ap, ClientPtr);
>> ++          u.auth.authId = va_arg(ap, XID);
>> +           break;
>> +-      }
>> +-      case XACE_KEY_AVAIL: {
>> +-          XaceKeyAvailRec rec;
>> +-          rec.event = va_arg(ap, xEventPtr);
>> +-          rec.keybd = va_arg(ap, DeviceIntPtr);
>> +-          rec.count = va_arg(ap, int);
>> +-          calldata =&rec;
>> ++      case XACE_KEY_AVAIL:
>> ++          u.key.event = va_arg(ap, xEventPtr);
>> ++          u.key.keybd = va_arg(ap, DeviceIntPtr);
>> ++          u.key.count = va_arg(ap, int);
>> +           break;
>> +-      }
>> +-      default: {
>> ++      default:
>> +           va_end(ap);
>> +           return 0;   /* unimplemented hook number */
>> +-      }
>> +     }
>> +     va_end(ap);
>> +
>> +     /* call callbacks and return result, if any. */
>> +-    CallCallbacks(&XaceHooks[hook]**, calldata);
>> ++    CallCallbacks(&XaceHooks[hook]**,&u);
>> +     return prv ? *prv : Success;
>> + }
>> +
>> +--
>> +cgit v0.9.0.2-2-gbebe
>> diff --git a/meta/recipes-graphics/xorg-**xserver/xserver-kdrive_1.7.99.*
>> *2.bb <http://xserver-kdrive_1.7.99.2.bb> b/meta/recipes-graphics/xorg-**
>> xserver/xserver-kdrive_1.7.99.**2.bb <http://xserver-kdrive_1.7.99.2.bb>
>> index 360a0f3..d90dc25 100644
>> --- a/meta/recipes-graphics/xorg-**xserver/xserver-kdrive_1.7.99.**2.bb<http://xserver-kdrive_1.7.99.2.bb>
>> +++ b/meta/recipes-graphics/xorg-**xserver/xserver-kdrive_1.7.99.**2.bb<http://xserver-kdrive_1.7.99.2.bb>
>> @@ -7,7 +7,7 @@ RDEPENDS_${PN} += "xkeyboard-config"
>>  EXTRA_OECONF += "--disable-glx"
>>
>>  PE = "1"
>> -PR = "r29"
>> +PR = "r30"
>>
>>  SRC_URI = "${XORG_MIRROR}/individual/**xserver/xorg-server-${PV}.tar.**bz2
>> \
>>        file://extra-kmodes.patch \
>> @@ -20,6 +20,7 @@ SRC_URI = "${XORG_MIRROR}/individual/**
>> xserver/xorg-server-${PV}.tar.**bz2 \
>>        file://fix-newer-xorg-headers.**patch \
>>        file://crosscompile.patch \
>>        file://error-address-work-**around.patch \
>> +        file://fix-bogus-stack-**variables.patch \
>>        file://nodolt.patch"
>>  #     file://kdrive-evdev.patch
>>  #     file://kdrive-use-evdev.patch
>>
>
> --
> ------------------------------**------------------------------
> Gary Thomas                 |  Consulting for the
> MLB Associates              |    Embedded world
> ------------------------------**------------------------------
>
> ______________________________**_________________
> Openembedded-core mailing list
> Openembedded-core@lists.**openembedded.org<Openembedded-core@lists.openembedded.org>
> http://lists.linuxtogo.org/**cgi-bin/mailman/listinfo/**openembedded-core<http://lists.linuxtogo.org/cgi-bin/mailman/listinfo/openembedded-core>
>
Richard Purdie - May 18, 2012, 2:26 p.m.
On Wed, 2012-05-16 at 15:26 -0600, Gary Thomas wrote:
> Newer versions of GCC uncovered illegal code practice which can cause
> runtime failures in the Xext/xace.c code.  This problem has been fixed upstream:
>   http://cgit.freedesktop.org/xorg/xserver/patch/Xext/xace.c?id=6dae7f3792611aace1df0cca63bf50c50d93de43
>   Subject: xace: Invalid reference to out-of-scope data.
> 
> Incorporate this patch into the recipe, with a PR bump.
> 
> Signed-off-by: Gary Thomas <gary@mlbassoc.com>
> ---
>  .../fix-bogus-stack-variables.patch                |  231 ++++++++++++++++++++
>  .../xorg-xserver/xserver-kdrive_1.7.99.2.bb        |    3 +-
>  2 files changed, 233 insertions(+), 1 deletions(-)
>  create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch

Merged to master, thanks.

Richard

Patch

diff --git a/meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch b/meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch
new file mode 100644
index 0000000..d900fc3
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-kdrive-1.7.99.2/fix-bogus-stack-variables.patch
@@ -0,0 +1,233 @@ 
+From 6dae7f3792611aace1df0cca63bf50c50d93de43 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 10 Aug 2010 18:30:20 +0000
+Subject: xace: Invalid reference to out-of-scope data.
+
+The callback data passed by reference to the hook was allocated on stack
+within the scope of the case statement. The compiler is free to reuse
+any of that stack space whilst making the function call so we may end up
+passing garbage into the callback.
+
+References:
+
+  Bug 18451 - Xorg server 1.5.2 SEGV during XFixesGetCursorImage()
+  https://bugs.freedesktop.org/show_bug.cgi?id=18451
+
+v2: Drop the unrelated hunk that snuck in when ammending the commit
+message.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+
+Upstream-Status: accepted
+---
+(limited to 'Xext/xace.c')
+
+diff --git a/Xext/xace.c b/Xext/xace.c
+index e10d837..c757cad 100644
+--- a/Xext/xace.c
++++ b/Xext/xace.c
+@@ -87,7 +87,18 @@ void XaceHookAuditEnd(ClientPtr ptr, int result)
+  */
+ int XaceHook(int hook, ...)
+ {
+-    pointer calldata;	/* data passed to callback */
++    union {
++	XaceResourceAccessRec res;
++	XaceDeviceAccessRec dev;
++	XaceSendAccessRec send;
++	XaceReceiveAccessRec recv;
++	XaceClientAccessRec client;
++	XaceExtAccessRec ext;
++	XaceServerAccessRec server;
++	XaceScreenAccessRec screen;
++	XaceAuthAvailRec auth;
++	XaceKeyAvailRec key;
++    } u;
+     int *prv = NULL;	/* points to return value from callback */
+     va_list ap;		/* argument list */
+     va_start(ap, hook);
+@@ -99,117 +110,86 @@ int XaceHook(int hook, ...)
+      */
+     switch (hook)
+     {
+-	case XACE_RESOURCE_ACCESS: {
+-	    XaceResourceAccessRec rec;
+-	    rec.client = va_arg(ap, ClientPtr);
+-	    rec.id = va_arg(ap, XID);
+-	    rec.rtype = va_arg(ap, RESTYPE);
+-	    rec.res = va_arg(ap, pointer);
+-	    rec.ptype = va_arg(ap, RESTYPE);
+-	    rec.parent = va_arg(ap, pointer);
+-	    rec.access_mode = va_arg(ap, Mask);
+-	    rec.status = Success; /* default allow */
+-	    calldata = &rec;
+-	    prv = &rec.status;
++	case XACE_RESOURCE_ACCESS:
++	    u.res.client = va_arg(ap, ClientPtr);
++	    u.res.id = va_arg(ap, XID);
++	    u.res.rtype = va_arg(ap, RESTYPE);
++	    u.res.res = va_arg(ap, pointer);
++	    u.res.ptype = va_arg(ap, RESTYPE);
++	    u.res.parent = va_arg(ap, pointer);
++	    u.res.access_mode = va_arg(ap, Mask);
++	    u.res.status = Success; /* default allow */
++	    prv = &u.res.status;
+ 	    break;
+-	}
+-	case XACE_DEVICE_ACCESS: {
+-	    XaceDeviceAccessRec rec;
+-	    rec.client = va_arg(ap, ClientPtr);
+-	    rec.dev = va_arg(ap, DeviceIntPtr);
+-	    rec.access_mode = va_arg(ap, Mask);
+-	    rec.status = Success; /* default allow */
+-	    calldata = &rec;
+-	    prv = &rec.status;
++	case XACE_DEVICE_ACCESS:
++	    u.dev.client = va_arg(ap, ClientPtr);
++	    u.dev.dev = va_arg(ap, DeviceIntPtr);
++	    u.dev.access_mode = va_arg(ap, Mask);
++	    u.dev.status = Success; /* default allow */
++	    prv = &u.dev.status;
+ 	    break;
+-	}
+-	case XACE_SEND_ACCESS: {
+-	    XaceSendAccessRec rec;
+-	    rec.client = va_arg(ap, ClientPtr);
+-	    rec.dev = va_arg(ap, DeviceIntPtr);
+-	    rec.pWin = va_arg(ap, WindowPtr);
+-	    rec.events = va_arg(ap, xEventPtr);
+-	    rec.count = va_arg(ap, int);
+-	    rec.status = Success; /* default allow */
+-	    calldata = &rec;
+-	    prv = &rec.status;
++	case XACE_SEND_ACCESS:
++	    u.send.client = va_arg(ap, ClientPtr);
++	    u.send.dev = va_arg(ap, DeviceIntPtr);
++	    u.send.pWin = va_arg(ap, WindowPtr);
++	    u.send.events = va_arg(ap, xEventPtr);
++	    u.send.count = va_arg(ap, int);
++	    u.send.status = Success; /* default allow */
++	    prv = &u.send.status;
+ 	    break;
+-	}
+-	case XACE_RECEIVE_ACCESS: {
+-	    XaceReceiveAccessRec rec;
+-	    rec.client = va_arg(ap, ClientPtr);
+-	    rec.pWin = va_arg(ap, WindowPtr);
+-	    rec.events = va_arg(ap, xEventPtr);
+-	    rec.count = va_arg(ap, int);
+-	    rec.status = Success; /* default allow */
+-	    calldata = &rec;
+-	    prv = &rec.status;
++	case XACE_RECEIVE_ACCESS:
++	    u.recv.client = va_arg(ap, ClientPtr);
++	    u.recv.pWin = va_arg(ap, WindowPtr);
++	    u.recv.events = va_arg(ap, xEventPtr);
++	    u.recv.count = va_arg(ap, int);
++	    u.recv.status = Success; /* default allow */
++	    prv = &u.recv.status;
+ 	    break;
+-	}
+-	case XACE_CLIENT_ACCESS: {
+-	    XaceClientAccessRec rec;
+-	    rec.client = va_arg(ap, ClientPtr);
+-	    rec.target = va_arg(ap, ClientPtr);
+-	    rec.access_mode = va_arg(ap, Mask);
+-	    rec.status = Success; /* default allow */
+-	    calldata = &rec;
+-	    prv = &rec.status;
++	case XACE_CLIENT_ACCESS:
++	    u.client.client = va_arg(ap, ClientPtr);
++	    u.client.target = va_arg(ap, ClientPtr);
++	    u.client.access_mode = va_arg(ap, Mask);
++	    u.client.status = Success; /* default allow */
++	    prv = &u.client.status;
+ 	    break;
+-	}
+-	case XACE_EXT_ACCESS: {
+-	    XaceExtAccessRec rec;
+-	    rec.client = va_arg(ap, ClientPtr);
+-	    rec.ext = va_arg(ap, ExtensionEntry*);
+-	    rec.access_mode = DixGetAttrAccess;
+-	    rec.status = Success; /* default allow */
+-	    calldata = &rec;
+-	    prv = &rec.status;
++	case XACE_EXT_ACCESS:
++	    u.ext.client = va_arg(ap, ClientPtr);
++	    u.ext.ext = va_arg(ap, ExtensionEntry*);
++	    u.ext.access_mode = DixGetAttrAccess;
++	    u.ext.status = Success; /* default allow */
++	    prv = &u.ext.status;
+ 	    break;
+-	}
+-	case XACE_SERVER_ACCESS: {
+-	    XaceServerAccessRec rec;
+-	    rec.client = va_arg(ap, ClientPtr);
+-	    rec.access_mode = va_arg(ap, Mask);
+-	    rec.status = Success; /* default allow */
+-	    calldata = &rec;
+-	    prv = &rec.status;
++	case XACE_SERVER_ACCESS:
++	    u.server.client = va_arg(ap, ClientPtr);
++	    u.server.access_mode = va_arg(ap, Mask);
++	    u.server.status = Success; /* default allow */
++	    prv = &u.server.status;
+ 	    break;
+-	}
+ 	case XACE_SCREEN_ACCESS:
+-	case XACE_SCREENSAVER_ACCESS: {
+-	    XaceScreenAccessRec rec;
+-	    rec.client = va_arg(ap, ClientPtr);
+-	    rec.screen = va_arg(ap, ScreenPtr);
+-	    rec.access_mode = va_arg(ap, Mask);
+-	    rec.status = Success; /* default allow */
+-	    calldata = &rec;
+-	    prv = &rec.status;
++	case XACE_SCREENSAVER_ACCESS:
++	    u.screen.client = va_arg(ap, ClientPtr);
++	    u.screen.screen = va_arg(ap, ScreenPtr);
++	    u.screen.access_mode = va_arg(ap, Mask);
++	    u.screen.status = Success; /* default allow */
++	    prv = &u.screen.status;
+ 	    break;
+-	}
+-	case XACE_AUTH_AVAIL: {
+-	    XaceAuthAvailRec rec;
+-	    rec.client = va_arg(ap, ClientPtr);
+-	    rec.authId = va_arg(ap, XID);
+-	    calldata = &rec;
++	case XACE_AUTH_AVAIL:
++	    u.auth.client = va_arg(ap, ClientPtr);
++	    u.auth.authId = va_arg(ap, XID);
+ 	    break;
+-	}
+-	case XACE_KEY_AVAIL: {
+-	    XaceKeyAvailRec rec;
+-	    rec.event = va_arg(ap, xEventPtr);
+-	    rec.keybd = va_arg(ap, DeviceIntPtr);
+-	    rec.count = va_arg(ap, int);
+-	    calldata = &rec;
++	case XACE_KEY_AVAIL:
++	    u.key.event = va_arg(ap, xEventPtr);
++	    u.key.keybd = va_arg(ap, DeviceIntPtr);
++	    u.key.count = va_arg(ap, int);
+ 	    break;
+-	}
+-	default: {
++	default:
+ 	    va_end(ap);
+ 	    return 0;	/* unimplemented hook number */
+-	}
+     }
+     va_end(ap);
+  
+     /* call callbacks and return result, if any. */
+-    CallCallbacks(&XaceHooks[hook], calldata);
++    CallCallbacks(&XaceHooks[hook], &u);
+     return prv ? *prv : Success;
+ }
+ 
+--
+cgit v0.9.0.2-2-gbebe
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-kdrive_1.7.99.2.bb b/meta/recipes-graphics/xorg-xserver/xserver-kdrive_1.7.99.2.bb
index 360a0f3..d90dc25 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-kdrive_1.7.99.2.bb
+++ b/meta/recipes-graphics/xorg-xserver/xserver-kdrive_1.7.99.2.bb
@@ -7,7 +7,7 @@  RDEPENDS_${PN} += "xkeyboard-config"
 EXTRA_OECONF += "--disable-glx"
 
 PE = "1"
-PR = "r29"
+PR = "r30"
 
 SRC_URI = "${XORG_MIRROR}/individual/xserver/xorg-server-${PV}.tar.bz2 \
 	file://extra-kmodes.patch \
@@ -20,6 +20,7 @@  SRC_URI = "${XORG_MIRROR}/individual/xserver/xorg-server-${PV}.tar.bz2 \
 	file://fix-newer-xorg-headers.patch \
 	file://crosscompile.patch \
 	file://error-address-work-around.patch \
+        file://fix-bogus-stack-variables.patch \
 	file://nodolt.patch"
 #	file://kdrive-evdev.patch
 #	file://kdrive-use-evdev.patch