hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-15 05:23:40 +00:00
Code Issues Projects Releases Wiki Activity
xserver/Xext
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer f3f026b3cd sync: fix deletion of counters and fences 
Both FreeCounter() and miSyncDestroyFence() iterate over the trigger list
and invoke the CounterDestroyed callback on each trigger.

The CounterDestroyed callback (e.g. SyncAwaitTriggerFired) may call
FreeResource/FreeAwait, which frees the SyncAwaitUnion containing all
SyncAwait structs in the same Await group.

When multiple conditions in a single Await reference the same sync
object (counter or fence), the first callback frees all SyncAwait
structs while subsequent trigger list nodes still reference them. On the
next iteration, reading ptl->next or ptl->pTrigger dereferences freed
memory, leading to a use-after-free.

We need separate fixes for separate issues here to fix this in one go
- use our null-terminated list macro to make sure our next pointer stays
  valid (the code accessed ptl->next after freeing it)
- update the list head before deleting the trigger, eventually this ends
  up being NULL anyway but meanwhile the list head is a valid list
  during CounterDestroyed
- check if we actually do have a trigger before dereferencing the
  callback
- Set all triggers to NULL if they are shared so we don't dereference
  potentially freed memory

This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-30159 (miSyncDestroyFence), ZDI-CAN-30163 (FreeCounter)

Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2228>
2026-06-03 15:42:12 +02:00
..
namespace xext: namespace: fix printf format string 2025-12-11 15:04:42 +01:00
bigreq.c miext: move over extinit_priv.h from include 2025-06-12 17:21:46 +02:00
dpms.c dix: add dixAllocServerXID() 2025-06-12 17:21:48 +02:00
dpmsproc.h Xext: drop checking for HAVE_DIX_CONFIG_H 2025-06-12 16:50:20 +02:00
geext.c miext: move over extinit_priv.h from include 2025-06-12 17:21:46 +02:00
geext_priv.h xext: add/fix include guards where missing/broken 2025-06-27 13:58:05 +02:00
hashtable.c xext: replace xallocarray() by calloc() 2025-06-12 17:21:43 +02:00
hashtable.h Xext: hashtable.h: unexport functions not used by drivers 2025-06-12 16:51:36 +02:00
meson.build treewide: remove "lib" prefix in static_library names (meson) 2025-07-03 12:01:52 +02:00
panoramiX.c panoramiX: fail if we can't allocate our visual arrays 2026-05-01 18:51:19 +02:00
panoramiX.h composite: clean up including panoramix headers 2025-06-12 17:21:43 +02:00
panoramiXh.h xext: add/fix include guards where missing/broken 2025-06-27 13:58:05 +02:00
panoramiXprocs.c panoramix: protect against allocaton failure 2025-06-12 17:21:44 +02:00
panoramiXsrv.h panoramix: export PanoramiXTranslateVisualID for nvidia 2025-06-16 10:32:48 +02:00
panoramiXSwap.c Xext: clean up including panoramix headers 2025-06-12 17:21:43 +02:00
saver.c saver: re-fetch screen private after CheckScreenPrivate in CreateSaverWindow 2026-06-03 15:33:26 +02:00
security.c miext: move over extinit_priv.h from include 2025-06-12 17:21:46 +02:00
securitysrv.h Xext: security: drop not needed include 2025-06-12 16:30:13 +02:00
shape.c Xext: shape: fix non-ximerama build 2025-08-12 11:07:24 +02:00
shm.c Xext/shm: add missing reply byte-swap in ProcShmCreateSegment 2026-04-27 15:20:43 +02:00
shmint.h xext: Fix shmint.h to not use headers outside of sdk_HEADERS 2013-11-14 10:22:15 +09:00
sleepuntil.c Xext: use calloc() instead of malloc() 2025-06-12 16:48:11 +02:00
sleepuntil.h Xext: drop checking for HAVE_DIX_CONFIG_H 2025-06-12 16:50:20 +02:00
sync.c sync: fix deletion of counters and fences 2026-06-03 15:42:12 +02:00
syncsdk.h xsync: Add resource inside of SyncCreate, export SyncCreate 2019-04-17 14:01:17 -07:00
syncsrv.h sync: Convert from "CARD64" to int64_t. 2017-09-20 13:19:27 -04:00
vidmode.c Xext/vidmode: fix SProcVidModeSwitchToMode swapping only screen field 2026-04-27 15:17:23 +02:00
xace.c xace: export XaceRegisterCallback() and XaceDeleteCallback() 2025-06-12 17:21:45 +02:00
xace.h Xext: Fix typo in xace.h 2025-06-27 17:10:33 +02:00
xacestr.h dix: move over private defintions from selection.h to private header 2025-06-12 17:21:46 +02:00
xcmisc.c miext: move over extinit_priv.h from include 2025-06-12 17:21:46 +02:00
xf86bigfont.c xf86bigfont: fix compiler warning on unused variable 2025-07-01 17:01:07 +02:00
xf86bigfontsrv.h Move extension initialisation prototypes into extinit.h 2012-07-09 23:06:41 -07:00
xres.c Xext/xres: add missing byte-swap of spec entries in SProcXResQueryClientIds 2026-04-27 17:22:20 +02:00
xselinux.h include: unpexport SELINUX_* consts from include/global.h 2024-03-25 19:40:04 +00:00
xselinux_ext.c dix: move over private defintions from selection.h to private header 2025-06-12 17:21:46 +02:00
xselinux_hooks.c selinux: remap security classes on policyload 2026-04-21 10:45:12 +02:00
xselinux_label.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
xselinuxint.h include: drop obsolete registry.h 2024-03-03 23:20:06 +00:00
xtest.c miext: move over extinit_priv.h from include 2025-06-12 17:21:46 +02:00
xvdisp.c Zero out structs to avoid leaking information via padding 2026-04-27 15:16:13 +02:00
xvdisp.h xext: add/fix include guards where missing/broken 2025-06-27 13:58:05 +02:00
xvdix.h treewide: preemptively revert !1714 where it affects ABI compatibility 2025-06-16 10:32:48 +02:00
xvdix_priv.h Xext: xv: fix redefinition of typedef 'XvPortNotifyPtr' 2025-08-05 18:59:43 +02:00
xvmain.c miext: move over extinit_priv.h from include 2025-06-12 17:21:46 +02:00
xvmc.c xres/xkb/xvmc/modesetting: Fix incorrect pointer data size usage 2025-06-13 13:01:24 +02:00
xvmcext.h xvmc: unexport XvMCFindXvImage() 2024-10-10 19:59:48 +00:00