Peter Hutterer 4b9638714e sync: fix deletion of counters and fences ... Both FreeCounter() and miSyncDestroyFence() iterate over the trigger list and invoke the CounterDestroyed callback on each trigger. The CounterDestroyed callback (e.g. SyncAwaitTriggerFired) may call FreeResource/FreeAwait, which frees the SyncAwaitUnion containing all SyncAwait structs in the same Await group. When multiple conditions in a single Await reference the same sync object (counter or fence), the first callback frees all SyncAwait structs while subsequent trigger list nodes still reference them. On the next iteration, reading ptl->next or ptl->pTrigger dereferences freed memory, leading to a use-after-free. We need separate fixes for separate issues here to fix this in one go - use our null-terminated list macro to make sure our next pointer stays valid (the code accessed ptl->next after freeing it) - update the list head before deleting the trigger, eventually this ends up being NULL anyway but meanwhile the list head is a valid list during CounterDestroyed - check if we actually do have a trigger before dereferencing the callback - Set all triggers to NULL if they are shared so we don't dereference potentially freed memory This vulnerability was discovered by: Anonymous working with TrendAI Zero Day Initiative ZDI-CAN-30159 (miSyncDestroyFence), ZDI-CAN-30163 (FreeCounter) Assisted-by: Claude:claude-opus-4-6 (cherry picked from commit f5abfb6199) Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2230>		2026-06-02 09:53:34 +10:00
..
damage	Drop Xorg DDX	2024-04-12 10:40:05 +02:00
sync	sync: fix deletion of counters and fences	2026-06-02 09:53:34 +10:00