File bsc1218585-0002-dix-when-disabling-a-master-flo... of Package xwayland.32148

Overview Repositories Revisions Requests Users Attributes Meta

File bsc1218585-0002-dix-when-disabling-a-master-float-disabled-slaved-de.patch of Package xwayland.32148

From 1a5e3c3e68d4f965077ea6a40ba57cc0d5a4e8cb Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Fri, 5 Jan 2024 09:40:27 +1000
Subject: [PATCH xserver] dix: when disabling a master, float disabled slaved
 devices too

Disabling a master device floats all slave devices but we didn't do this
to already-disabled slave devices. As a result those devices kept their
reference to the master device resulting in access to already freed
memory if the master device was removed before the corresponding slave
device.

And to match this behavior, also forcibly reset that pointer during
CloseDownDevices().

Related to CVE-2024-21886, ZDI-CAN-22840
---
 dix/devices.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

Index: xwayland-22.1.5/dix/devices.c
===================================================================
--- xwayland-22.1.5.orig/dix/devices.c
+++ xwayland-22.1.5/dix/devices.c
@@ -477,6 +477,13 @@ DisableDevice(DeviceIntPtr dev, BOOL sen
                 flags[other->id] |= XISlaveDetached;
             }
         }
+
+        for (other = inputInfo.off_devices; other; other = other->next) {
+            if (!IsMaster(other) && GetMaster(other, MASTER_ATTACHED) == dev) {
+                AttachDevice(NULL, other, NULL);
+                flags[other->id] |= XISlaveDetached;
+            }
+        }
     }
     else {
         for (other = inputInfo.devices; other; other = other->next) {
@@ -1072,6 +1079,11 @@ CloseDownDevices(void)
         if (!IsMaster(dev) && !IsFloating(dev))
             dev->master = NULL;
     }
+
+    for (dev = inputInfo.off_devices; dev; dev = dev->next) {
+        if (!IsMaster(dev) && !IsFloating(dev))
+            dev->master = NULL;
+    }
 
     CloseDeviceList(&inputInfo.devices);
     CloseDeviceList(&inputInfo.off_devices);

Places

File bsc1218585-0002-dix-when-disabling-a-master-float-disabled-slaved-de.patch of Package xwayland.32148

Places