From 0ed62638c2e7f79e34ee2434bdc40d260f1d73f1 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Wed, 26 Aug 2026 17:16:59 +1000
Subject: [PATCH] [PR #3997] dix: remove passive grabs referencing a device on
 removal

Passive grabs (GrabRec) store raw DeviceIntPtr values for both the
grabbed device and the modifier device without any lifetime management.
When a device is removed via XIRemoveMaster, CloseDevice() frees the
device struct, but leaves dangling pointers in grab->modifierDevice
for any grab that used this device.

Subsequent pointer events trigger CheckPassiveGrab() which dereferences
the dangling modifierDevice pointer for XI grabs (the CORE and XI2 paths
reassign it, but the XI path does not).

This vulnerability was discovered by:
  Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-31832

CVE-2026-93516

Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit be572634158850fff4e9829cee88db08d30c9743)
PR: https://github.com/X11Libre/xserver/pull/3997
---
 dix/devices.c | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/dix/devices.c b/dix/devices.c
index 60fa16f43..c0b4ea8cc 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -1202,6 +1202,40 @@ CloseOneDevice(const DeviceIntPtr dev, DeviceIntPtr *listHead)
     return BadMatch;
 }
 
+static Bool
+GrabReferencesDevice(void *value, XID id, void *cdata)
+{
+    GrabPtr grab = value;
+    DeviceIntPtr dev = cdata;
+
+    return grab->device == dev || grab->modifierDevice == dev;
+}
+
+/**
+ * Remove all passive grabs that reference the given device, either as
+ * the grabbed device or as the modifier device. This must be called
+ * before the device is freed to avoid dangling pointers in GrabRec.
+ */
+static void
+RemovePassiveGrabsForDevice(DeviceIntPtr dev)
+{
+    int i;
+
+    for (i = 0; i < currentMaxClients; i++) {
+        GrabPtr grab;
+
+        if (!clients[i])
+            continue;
+
+        while ((grab = LookupClientResourceComplex(clients[i],
+                                                   X11_RESTYPE_PASSIVEGRAB,
+                                                   GrabReferencesDevice,
+                                                   dev))) {
+            FreeResource(grab->resource, X11_RESTYPE_NONE);
+        }
+    }
+}
+
 /**
  * Remove a device from the device list, closes it and thus frees all
  * resources.
@@ -1241,6 +1275,8 @@ RemoveDevice(DeviceIntPtr dev, BOOL sendevent)
         flags[dev->id] = XIDeviceDisabled;
     }
 
+    RemovePassiveGrabsForDevice(dev);
+
     flag = InputDevIsMaster(dev) ? XIMasterRemoved : XISlaveRemoved;
 
     input_lock();