From 1a5e3c3e68d4f965077ea6a40ba57cc0d5a4e8cb Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Fri, 5 Jan 2024 09:40:27 +1000 Subject: [PATCH xserver] dix: when disabling a master, float disabled slaved devices too Disabling a master device floats all slave devices but we didn't do this to already-disabled slave devices. As a result those devices kept their reference to the master device resulting in access to already freed memory if the master device was removed before the corresponding slave device. And to match this behavior, also forcibly reset that pointer during CloseDownDevices(). Related to CVE-2024-21886, ZDI-CAN-22840 --- dix/devices.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/dix/devices.c b/dix/devices.c index c7fa8fad69..87f4d4a213 100644 --- a/dix/devices.c +++ b/dix/devices.c @@ -482,6 +482,13 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent) flags[other->id] |= XISlaveDetached; } } + + for (other = inputInfo.off_devices; other; other = other->next) { + if (!IsMaster(other) && GetMaster(other, MASTER_ATTACHED) == dev) { + AttachDevice(NULL, other, NULL); + flags[other->id] |= XISlaveDetached; + } + } } else { for (other = inputInfo.devices; other; other = other->next) { @@ -1088,6 +1095,11 @@ CloseDownDevices(void) dev->master = NULL; } + for (dev = inputInfo.off_devices; dev; dev = dev->next) { + if (!IsMaster(dev) && !IsFloating(dev)) + dev->master = NULL; + } + CloseDeviceList(&inputInfo.devices); CloseDeviceList(&inputInfo.off_devices); -- 2.43.0