Olivier Fourdan 6e0f332ba4 dix: Dequeue pending events on frozen device on removal ...

When a device is removed while still frozen, the events queued for that
device remain while the device itself is freed.

As a result, replaying the events will cause a use after free.

To avoid the issue, make sure to dequeue and free any pending events on
a frozen device when removed.

CVE-2025-26600, ZDI-CAN-25871

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>

2025-02-25 11:43:01 +01:00

..

.gitignore

Fix spelling/wording issues

2020-07-05 13:07:33 -07:00

atom.c

dix: unexport MakePredeclaredAtoms()

2025-02-17 18:13:33 +00:00

BuiltInAtoms

…

callback_priv.h

dix: fix duplicate typedef of CallbackListPtr

2024-09-01 22:32:49 +00:00

closestr.h

dix: move closestr.h into dix directory

2024-04-16 01:42:39 +00:00

color.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

colormap_priv.h

dix: move colormap flags into colormap_priv.h and rename them

2024-09-01 22:06:50 +00:00

colormap.c

rename old symbol PANORAMIX to XINERAMA

2025-02-06 15:51:27 +00:00

cursor_priv.h

dix: unexport GetSpritePosition()

2024-09-02 16:43:29 +00:00

cursor.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

devices.c

dix: Dequeue pending events on frozen device on removal

2025-02-25 11:43:01 +01:00

dispatch.c

Cursor: Refuse to free the root cursor

2025-02-25 11:43:01 +01:00

dispatch.h

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

display.c

dix: add getter for display name

2025-02-11 19:13:01 +01:00

dix_priv.h

drop not needed includes of geext.h

2025-02-24 20:19:55 +00:00

dixfonts.c

os: log: replace VErrorF() by LogVMessageVerb()

2025-02-06 23:35:27 +00:00

dixgrabs_priv.h

dix: unexport non-public functions from dixgrabs.h and document prototypes

2024-10-10 13:50:57 +00:00

dixstruct_priv.h

include: move private defs to dixstruct_priv.h

2024-04-30 00:47:38 +00:00

dixutils.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

enterleave.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

enterleave.h

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

eventconvert.c

dix: limit checks to MAX_VALUATORS when generating Xi events

2024-10-28 05:38:25 +00:00

eventconvert.h

dix: unexport eventconvert.h functions

2024-03-11 12:26:44 +01:00

events.c

drop not needed includes of geext.h

2025-02-24 20:19:55 +00:00

exevents_priv.h

include: move private definitions out of exevents.h

2024-04-30 00:47:38 +00:00

extension.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

gc_priv.h

dix: unexport SetClipRects()

2024-04-15 23:10:31 +00:00

gc.c

dix: use dixDestroyPixmap() instead of direct driver call

2025-02-12 17:48:30 +01:00

generate-atoms

dix: unexport MakePredeclaredAtoms()

2025-02-17 18:13:33 +00:00

gestures.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

getevents.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

globals.c

dix: add getter for display name

2025-02-11 19:13:01 +01:00

glyphcurs.c

dix: use dixDestroyPixmap() instead of direct driver call

2025-02-12 17:48:30 +01:00

grabs.c

dix: unexport non-public functions from dixgrabs.h and document prototypes

2024-10-10 13:50:57 +00:00

input_priv.h

include: move private definitions out of input.h

2024-09-01 17:59:23 +00:00

inpututils.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

main.c

dix: keep a ref to the rootCursor

2025-02-25 11:43:01 +01:00

meson.build

dix: add getter for display name

2025-02-11 19:13:01 +01:00

pixmap.c

dix: use dixDestroyPixmap() instead of direct driver call

2025-02-12 17:48:30 +01:00

privates.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

property_priv.h

dix: unexport DeleteAllWindowProperties()

2024-09-02 17:50:47 +00:00

property.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

protocol.txt

drop remains of DMX

2024-03-05 16:57:52 +01:00

ptrveloc_priv.h

dix: fix duplicate typedef of MotionTracker and *MotionTrackerPtr

2024-09-01 22:32:49 +00:00

ptrveloc.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

region.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

registry_priv.h

dix: unexport XREGISTRY_UNKNOWN define

2024-03-03 23:20:06 +00:00

registry.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

resource.c

rename old symbol PANORAMIX to XINERAMA

2025-02-06 15:51:27 +00:00

screenint_priv.h

dix: fix duplicate typedef of *ScreenPtr

2024-09-01 22:32:49 +00:00

selection.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

stubmain.c

Allow DDX to provide a main()

2013-07-23 23:56:58 +01:00

swaprep.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

swapreq.c

misc.h: drop LengthRestB() macro

2025-02-17 19:25:14 +00:00

tables.c

dix: drop swapping request length fields

2025-02-06 22:28:51 +00:00

touch.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

window.c

dix: use dixDestroyPixmap() instead of direct driver call

2025-02-12 17:48:30 +01:00