Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Peter Hutterer 5d3b8520ec present: unlink notifies from window list in present_clear_window_notifies ... When a window is destroyed, present_clear_window_notifies() does not remove the notify list node from the window. The notify may then be freed as part of the window_priv, leaving dangling pointers in place. When the vblank owning the notify is later torn down, present_free_window_notify() calls xorg_list_del() which writes through these dangling pointers (use-after-free write). This happens when Present cross-window notifies are used: a PresentPixmap on window A can reference window B as a notify target. An untriggered wait_fence keeps the vblank alive so that B can be destroyed first, creating the dangling-pointer window. Fix this by calling the free function we have (and moving the window reset into that function too). present_clear_window_notifies is only called from one place anyway. This vulnerability was discovered by: Anonymous working with TrendAI Zero Day Initiative ZDI-CAN-31830 CVE-2026-93515 Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Assisted-by: Claude:claude-opus-4-6 Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341> (cherry picked from commit 1b6955c310)		2026-10-20 19:49:20 +02:00
..
meson.build
present.c
present_event.c
present_execute.c
present_fake.c
present_fence.c
present_notify.c	present: unlink notifies from window list in present_clear_window_notifies	2026-10-20 19:49:20 +02:00
present_priv.h
present_request.c
present_scmd.c
present_screen.c
present_vblank.c