From 6e0f332ba4c8b8c9a9945dc9d7989bfe06f80e14 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Mon, 16 Dec 2024 16:18:04 +0100 Subject: [PATCH] dix: Dequeue pending events on frozen device on removal When a device is removed while still frozen, the events queued for that device remain while the device itself is freed. As a result, replaying the events will cause a use after free. To avoid the issue, make sure to dequeue and free any pending events on a frozen device when removed. CVE-2025-26600, ZDI-CAN-25871 This vulnerability was discovered by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative Signed-off-by: Olivier Fourdan Reviewed-by: Peter Hutterer Part-of: --- dix/devices.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/dix/devices.c b/dix/devices.c index 3074662a66..3103647308 100644 --- a/dix/devices.c +++ b/dix/devices.c @@ -981,6 +981,23 @@ FreeAllDeviceClasses(ClassesPtr classes) } +static void +FreePendingFrozenDeviceEvents(DeviceIntPtr dev) +{ + QdEventPtr qe, tmp; + + if (!dev->deviceGrab.sync.frozen) + return; + + /* Dequeue any frozen pending events */ + xorg_list_for_each_entry_safe(qe, tmp, &syncEvents.pending, next) { + if (qe->device == dev) { + xorg_list_del(&qe->next); + free(qe); + } + } +} + /** * Close down a device and free all resources. * Once closed down, the driver will probably not expect you that you'll ever @@ -1044,6 +1061,7 @@ CloseDevice(DeviceIntPtr dev) valuator_mask_free(&dev->last.touches[j].valuators); free(dev->last.touches); dev->config_info = NULL; + FreePendingFrozenDeviceEvents(dev); dixFreePrivates(dev->devPrivates, PRIVATE_DEVICE); free(dev); } -- GitLab