frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dix: Dequeue pending events on frozen device on removal 

When a device is removed while still frozen, the events queued for that
device remain while the device itself is freed.

As a result, replaying the events will cause a use after free.

To avoid the issue, make sure to dequeue and free any pending events on
a frozen device when removed.

CVE-2025-26600, ZDI-CAN-25871

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
This commit is contained in:
Olivier Fourdan 2024-12-16 16:18:04 +01:00
parent b07192a8be
commit 6e0f332ba4
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
dix/devices.c
View File

@ -981,6 +981,23 @@ FreeAllDeviceClasses(ClassesPtr classes)
} }
static void
FreePendingFrozenDeviceEvents(DeviceIntPtr dev)
{
QdEventPtr qe, tmp;
if (!dev->deviceGrab.sync.frozen)
return;
/* Dequeue any frozen pending events */
xorg_list_for_each_entry_safe(qe, tmp, &syncEvents.pending, next) {
if (qe->device == dev) {
xorg_list_del(&qe->next);
free(qe);
}
}
}
/** /**
* Close down a device and free all resources. * Close down a device and free all resources.
* Once closed down, the driver will probably not expect you that you'll ever * Once closed down, the driver will probably not expect you that you'll ever
@ -1044,6 +1061,7 @@ CloseDevice(DeviceIntPtr dev)
valuator_mask_free(&dev->last.touches[j].valuators); valuator_mask_free(&dev->last.touches[j].valuators);
free(dev->last.touches); free(dev->last.touches);
dev->config_info = NULL; dev->config_info = NULL;
FreePendingFrozenDeviceEvents(dev);
dixFreePrivates(dev->devPrivates, PRIVATE_DEVICE); dixFreePrivates(dev->devPrivates, PRIVATE_DEVICE);
free(dev); free(dev);
} }