[PR #3997] dix: remove passive grabs referencing a device on removal

Passive grabs (GrabRec) store raw DeviceIntPtr values for both the
grabbed device and the modifier device without any lifetime management.
When a device is removed via XIRemoveMaster, CloseDevice() frees the
device struct, but leaves dangling pointers in grab->modifierDevice
for any grab that used this device.

Subsequent pointer events trigger CheckPassiveGrab() which dereferences
the dangling modifierDevice pointer for XI grabs (the CORE and XI2 paths
reassign it, but the XI path does not).

This vulnerability was discovered by:
  Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-31832

CVE-2026-93516

Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit be57263415)
PR: https://github.com/X11Libre/xserver/pull/3997

dix/devices.c

@@ -1202,6 +1202,40 @@ CloseOneDevice(const DeviceIntPtr dev, DeviceIntPtr *listHead)
     return BadMatch;
 }
 
+static Bool
+GrabReferencesDevice(void *value, XID id, void *cdata)
+{
+    GrabPtr grab = value;
+    DeviceIntPtr dev = cdata;
+
+    return grab->device == dev || grab->modifierDevice == dev;
+}
+
+/**
+ * Remove all passive grabs that reference the given device, either as
+ * the grabbed device or as the modifier device. This must be called
+ * before the device is freed to avoid dangling pointers in GrabRec.
+ */
+static void
+RemovePassiveGrabsForDevice(DeviceIntPtr dev)
+{
+    int i;
+
+    for (i = 0; i < currentMaxClients; i++) {
+        GrabPtr grab;
+
+        if (!clients[i])
+            continue;
+
+        while ((grab = LookupClientResourceComplex(clients[i],
+                                                   X11_RESTYPE_PASSIVEGRAB,
+                                                   GrabReferencesDevice,
+                                                   dev))) {
+            FreeResource(grab->resource, X11_RESTYPE_NONE);
+        }
+    }
+}
+
 /**
  * Remove a device from the device list, closes it and thus frees all
  * resources.
@@ -1241,6 +1275,8 @@ RemoveDevice(DeviceIntPtr dev, BOOL sendevent)
         flags[dev->id] = XIDeviceDisabled;
     }
 
+    RemovePassiveGrabsForDevice(dev);
+
     flag = InputDevIsMaster(dev) ? XIMasterRemoved : XISlaveRemoved;
 
     input_lock();