Peter Hutterer
8304192c3c
dix: remove passive grabs referencing a device on removal ...
Passive grabs (GrabRec) store raw DeviceIntPtr values for both the
grabbed device and the modifier device without any lifetime management.
When a device is removed via XIRemoveMaster, CloseDevice() frees the
device struct, but leaves dangling pointers in grab->modifierDevice
for any grab that used this device.
Subsequent pointer events trigger CheckPassiveGrab() which dereferences
the dangling modifierDevice pointer for XI grabs (the CORE and XI2 paths
reassign it, but the XI path does not).
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-31832
CVE-2026-93516
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341 >
(cherry picked from commit be57263415
2026-10-20 19:53:06 +02:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
glx: revert cb85ceae2d
2025-11-11 10:46:29 +01:00
dix: add callback before ClientRec is being destroyed
2025-09-22 12:15:31 +02:00
dix: replace XACE_CLIENT_ACCESS by direct callback
2025-09-29 11:24:13 +02:00
dix: remove dixLookupBuiltinColor() unused screen argument
2025-11-28 18:43:40 +01:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
cursor: fix AllocARGBCursor leak/double-free for psrcbits/pmaskbits/argb
2026-05-21 16:50:29 +02:00
include: unexport CURSOR_BITS_SIZE() and CURSOR_REC_SIZE() macros
2025-11-08 10:45:43 +01:00
dix: remove passive grabs referencing a device on removal
2026-10-20 19:53:06 +02:00
dix: replace XACE_CLIENT_ACCESS by direct callback
2025-10-07 10:52:54 +02:00
dix: dispatch: return DestroySubwindows() errors from ProcDestroySubwindows
2026-10-13 09:49:34 +02:00
dix: move include guards up to wrap the whole file
2025-11-21 15:20:11 +01:00
os: rename __size_assert() into __SIZE_ASSERT()
2026-06-18 12:01:35 +02:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
include: don't install client.h anymore
2025-12-05 19:44:59 +01:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
Xi: move it under Xext/xinput
2026-06-17 16:25:12 +02:00
dix: move include guards up to wrap the whole file
2025-11-21 15:20:11 +01:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
dix, Xi: remove spurious dereference when checking function pointers
2026-10-15 11:42:34 +02:00
dix: unexport XIUnregisterPropertyHandler() and XIDeleteAllDeviceProperties()
2025-11-20 19:21:37 +01:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
dix: replace XACE_EXT_ACCESS and XACE_EXT_DISPATCH by direct callback
2025-09-23 11:37:50 +02:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
dix: move GCAllBits define into private header
2025-11-27 20:05:59 +01:00
dix: don't include dix-config.h from randrstr.h
2025-07-23 15:46:51 +02:00
Xi: move it under Xext/xinput
2026-06-17 16:25:12 +02:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
Add Support for DPI Auto-Detection
2026-10-07 14:50:24 +02:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
dix: make InputDevIsFloating() and InputDevIsMaster() static inline
2026-10-06 17:20:37 +02:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
treewide: drop including <dix-config.h> from private includes
2025-12-04 19:50:44 +01:00
dix: use NULL instead of NullClient
2025-07-18 22:24:55 +02:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
Xext: move sleepuntil.c to dix
2026-06-19 09:37:22 +02:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
dix: fix missing includes of <assert.h>
2026-06-18 17:36:59 +02:00
Xext: move remaining panoramix headers into panoramix subdir.
2026-06-17 19:01:48 +02:00
dix: unexport DeleteProperty()
2025-11-20 19:22:35 +01:00
Treewide: Fix typos
2026-03-16 13:11:07 +01:00
RegionValidate: Fix double free of badreg->data on the error path
2026-10-02 13:57:31 +02:00
dix: inline SProcGrabButton()
2026-01-31 16:20:28 +01:00
include: dix.h: add macros for reply swapping in request handlers
2026-04-28 13:26:09 +02:00
glx: fix DrawableGone use-after-free without rejecting duplicate drawables
2026-08-24 12:24:29 +02:00
glx: fix DrawableGone use-after-free without rejecting duplicate drawables
2026-08-24 12:24:29 +02:00
dix: unexport SwapLongs()
2025-11-25 18:26:02 +01:00
dix: rpcbuf: write empty counted string for NULL str
2026-10-08 13:01:01 +02:00
dix: dixFreeScreen call hookPostCreateResources too
2025-10-29 11:41:26 +01:00
dix: encapsulate ScreenRec::UnrealizeWindow() call in helper function
2026-01-08 17:44:11 +01:00
glxmor/glamor_egl: Move glamor_egl_close_screen to the post screen close hook
2026-04-02 10:13:02 +02:00
treewide: use helper dixGetScreenPtr() for retrieving ScreenPtr's
2025-10-30 09:44:24 +01:00
dix: unexport screenIsSaved and HasSaverWindow()
2025-11-20 17:52:23 +01:00
dix: ProcSetSelectionOwner(): use X_REQUEST_* macros
2026-05-08 14:05:35 +02:00
dix: reexport ConnectionInfo for NVidia 390
2025-11-27 17:06:36 +01:00
os: unexport SeatId and move it to dix settings
2026-02-03 11:34:14 +01:00
os: unexport SeatId and move it to dix settings
2026-02-03 11:34:14 +01:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
Xext: move sleepuntil.c to dix
2026-06-19 09:37:22 +02:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
dix: swaprep.h: fix missing include of Xdefs.h
2026-04-23 10:29:14 +02:00
treewide: clean up includes of misc.h
2026-06-19 19:24:57 +02:00
dix: inline SProcQueryColor()
2026-01-31 16:16:19 +01:00
dix: inline SProcGrabButton()
2026-01-31 16:20:28 +01:00
Xi: move it under Xext/xinput
2026-06-17 16:25:12 +02:00
dix/window: fix UnmapNotify and DestroyNotify order in DestroySubwindows
2026-10-14 12:30:36 +02:00
include: windowstr.h: unexport w*() macros
2025-11-27 19:54:42 +01:00
8304192c3c