Module Name: xsrc
Committed By: maya
Date: Sun Dec 1 20:21:21 UTC 2019
Modified Files:
xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/dri:
dri_sw_winsys.c
xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/xlib:
xlib_sw_winsys.c
xsrc/external/mit/MesaLib/dist/src/mesa/drivers/x11: xm_buffer.c
Log Message:
>From 02c3dad0f3b4d26e0faa5cc51d06bc50d693dcdc Mon Sep 17 00:00:00 2001
From: Brian Paul <[email protected]>
Date: Wed, 9 Oct 2019 12:05:16 -0600
Subject: [PATCH] Call shmget() with permission 0600 instead of 0777
A security advisory (TALOS-2019-0857/CVE-2019-5068) found that
creating shared memory regions with permission mode 0777 could allow
any user to access that memory. Several Mesa drivers use shared-
memory XImages to implement back buffers for improved performance.
This path changes the shmget() calls to use 0600 (user r/w).
Tested with legacy Xlib driver and llvmpipe.
Cc: [email protected]
Reviewed-by: Kristian H. Kristensen <[email protected]>
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.4 -r1.2 \
xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/dri/dri_sw_winsys.c
cvs rdiff -u -r1.1.1.3 -r1.2 \
xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
cvs rdiff -u -r1.1.1.7 -r1.2 \
xsrc/external/mit/MesaLib/dist/src/mesa/drivers/x11/xm_buffer.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/dri/dri_sw_winsys.c
diff -u xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/dri/dri_sw_winsys.c:1.1.1.4 xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/dri/dri_sw_winsys.c:1.2
--- xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/dri/dri_sw_winsys.c:1.1.1.4 Tue Sep 24 17:31:59 2019
+++ xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/dri/dri_sw_winsys.c Sun Dec 1 20:21:21 2019
@@ -94,7 +94,8 @@ alloc_shm(struct dri_sw_displaytarget *d
{
char *addr;
- dri_sw_dt->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777);
+ /* 0600 = user read+write */
+ dri_sw_dt->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT | 0600);
if (dri_sw_dt->shmid < 0)
return NULL;
Index: xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
diff -u xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c:1.1.1.3 xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c:1.2
--- xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c:1.1.1.3 Sun Mar 10 03:42:41 2019
+++ xsrc/external/mit/MesaLib/dist/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c Sun Dec 1 20:21:21 2019
@@ -126,7 +126,8 @@ alloc_shm(struct xlib_displaytarget *buf
shminfo->shmid = -1;
shminfo->shmaddr = (char *) -1;
- shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777);
+ /* 0600 = user read+write */
+ shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT | 0600);
if (shminfo->shmid < 0) {
return NULL;
}
Index: xsrc/external/mit/MesaLib/dist/src/mesa/drivers/x11/xm_buffer.c
diff -u xsrc/external/mit/MesaLib/dist/src/mesa/drivers/x11/xm_buffer.c:1.1.1.7 xsrc/external/mit/MesaLib/dist/src/mesa/drivers/x11/xm_buffer.c:1.2
--- xsrc/external/mit/MesaLib/dist/src/mesa/drivers/x11/xm_buffer.c:1.1.1.7 Sun Mar 10 03:42:37 2019
+++ xsrc/external/mit/MesaLib/dist/src/mesa/drivers/x11/xm_buffer.c Sun Dec 1 20:21:21 2019
@@ -89,8 +89,9 @@ alloc_back_shm_ximage(XMesaBuffer b, GLu
return GL_FALSE;
}
+ /* 0600 = user read+write */
b->shminfo.shmid = shmget(IPC_PRIVATE, b->backxrb->ximage->bytes_per_line
- * b->backxrb->ximage->height, IPC_CREAT|0777);
+ * b->backxrb->ximage->height, IPC_CREAT | 0600);
if (b->shminfo.shmid < 0) {
_mesa_warning(NULL, "shmget failed while allocating back buffer.\n");
XDestroyImage(b->backxrb->ximage);
