pool/Mesa
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 749087 from X11:XOrg

Browse Source 
- u_call-shmget-with-permission-0600-instead-of-0777.patch
  * CVE-2019-5068 (bsc#1156015)

- Update to version 19.2.4
  * This is an emergency release, to fix a critical bug found in
    the 19.2.3 release which causes incomplete rendering on all
    mesa drivers. This release contains a single patch to fix
    that bug. 

- Update _contraints, Mesa-drivers needs 7GB of disk to build
  safely.

OBS-URL: https://build.opensuse.org/request/show/749087
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/Mesa?expand=0&rev=361
This commit is contained in:
Dominique Leuenberger 2019-11-18 19:02:56 +00:00 committed by Git OBS Bridge
commit bbca81114b
10 changed files with 115 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
Mesa-drivers.changes
View File

@ -1,3 +1,24 @@
-------------------------------------------------------------------
Thu Nov 14 14:36:08 UTC 2019 - Stefan Dirsch <sndirsch@suse.com>
- u_call-shmget-with-permission-0600-instead-of-0777.patch
* CVE-2019-5068 (bsc#1156015)
-------------------------------------------------------------------
Thu Nov 14 10:15:13 UTC 2019 - Stefan Dirsch <sndirsch@suse.com>
- Update to version 19.2.4
* This is an emergency release, to fix a critical bug found in
the 19.2.3 release which causes incomplete rendering on all
mesa drivers. This release contains a single patch to fix
that bug.
-------------------------------------------------------------------
Wed Nov 13 14:01:29 UTC 2019 - Frederic Crozat <fcrozat@suse.com>
- Update _contraints, Mesa-drivers needs 7GB of disk to build
safely.
-------------------------------------------------------------------
Thu Nov 7 11:20:41 UTC 2019 - Stefan Dirsch <sndirsch@suse.com>

6
Mesa-drivers.spec
View File

@ -42,7 +42,7 @@
%define glamor 1
%define _name_archive mesa
%define _version 19.2.3
%define _version 19.2.4
%define with_opencl 0
%define with_vulkan 0
%define with_llvm 0
@ -110,7 +110,7 @@
%endif
Name: Mesa-drivers
Version: 19.2.3
Version: 19.2.4
Release: 0
Summary: System for rendering 3-D graphics
License: MIT
@ -126,6 +126,7 @@ Source6: %{name}-rpmlintrc
Source7: Mesa.keyring
Patch1: n_opencl_dep_libclang.patch
Patch2: n_add-Mesa-headers-again.patch
Patch3: u_call-shmget-with-permission-0600-instead-of-0777.patch
# never to be upstreamed
Patch54: n_drirc-disable-rgb10-for-chromium-on-amd.patch
Patch58: u_dep_xcb.patch
@ -733,6 +734,7 @@ rm -rf docs/README.{VMS,WIN32,OS2}
%endif
%endif
%patch2 -p1
%patch3 -p1
%patch54 -p1
%patch58 -p1

21
Mesa.changes
View File

@ -1,3 +1,24 @@
-------------------------------------------------------------------
Thu Nov 14 14:36:08 UTC 2019 - Stefan Dirsch <sndirsch@suse.com>
- u_call-shmget-with-permission-0600-instead-of-0777.patch
* CVE-2019-5068 (bsc#1156015)
-------------------------------------------------------------------
Thu Nov 14 10:15:13 UTC 2019 - Stefan Dirsch <sndirsch@suse.com>
- Update to version 19.2.4
* This is an emergency release, to fix a critical bug found in
the 19.2.3 release which causes incomplete rendering on all
mesa drivers. This release contains a single patch to fix
that bug.
-------------------------------------------------------------------
Wed Nov 13 14:01:29 UTC 2019 - Frederic Crozat <fcrozat@suse.com>
- Update _contraints, Mesa-drivers needs 7GB of disk to build
safely.
-------------------------------------------------------------------
Thu Nov 7 11:20:41 UTC 2019 - Stefan Dirsch <sndirsch@suse.com>

6
Mesa.spec
View File

@ -41,7 +41,7 @@
%define glamor 1
%define _name_archive mesa
%define _version 19.2.3
%define _version 19.2.4
%define with_opencl 0
%define with_vulkan 0
%define with_llvm 0
@ -109,7 +109,7 @@
%endif
Name: Mesa
Version: 19.2.3
Version: 19.2.4
Release: 0
Summary: System for rendering 3-D graphics
License: MIT
@ -125,6 +125,7 @@ Source6: %{name}-rpmlintrc
Source7: Mesa.keyring
Patch1: n_opencl_dep_libclang.patch
Patch2: n_add-Mesa-headers-again.patch
Patch3: u_call-shmget-with-permission-0600-instead-of-0777.patch
# never to be upstreamed
Patch54: n_drirc-disable-rgb10-for-chromium-on-amd.patch
Patch58: u_dep_xcb.patch
@ -732,6 +733,7 @@ rm -rf docs/README.{VMS,WIN32,OS2}
%endif
%endif
%patch2 -p1
%patch3 -p1
%patch54 -p1
%patch58 -p1

2
_constraints
View File

@ -7,7 +7,7 @@
</conditions>
<hardware>
<disk>
<size unit="G">6</size>
<size unit="G">7</size>
</disk>
</hardware>
</overwrite>

3
mesa-19.2.3.tar.xz
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:5ee6e42504fe41dcc9a6eba26982656a675b2550a640946f463927ed7f1c5047
size 11457544

BIN
mesa-19.2.3.tar.xz.sig
View File

Binary file not shown.

3
mesa-19.2.4.tar.xz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:09000a0f7dbbd82e193b81a8f1bf0c118eab7ca975c0329181968596e548e30f
size 11458340

BIN
mesa-19.2.4.tar.xz.sig Normal file
View File

Binary file not shown.

61
u_call-shmget-with-permission-0600-instead-of-0777.patch Normal file
View File

@ -0,0 +1,61 @@
A security advisory (TALOS-2019-0857/CVE-2019-5068) found that
creating shared memory regions with permission mode 0777 could allow
any user to access that memory. Several Mesa drivers use shared-
memory XImages to implement back buffers for improved performance.
This path changes the shmget() calls to use 0600 (user r/w).
Tested with legacy Xlib driver and llvmpipe.
Cc: <a href="https://lists.freedesktop.org/mailman/listinfo/mesa-dev">mesa-stable at lists.freedesktop.org</a>
---
src/gallium/winsys/sw/dri/dri_sw_winsys.c | 3 ++-
src/gallium/winsys/sw/xlib/xlib_sw_winsys.c | 3 ++-
src/mesa/drivers/x11/xm_buffer.c | 3 ++-
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/src/gallium/winsys/sw/dri/dri_sw_winsys.c b/src/gallium/winsys/sw/dri/dri_sw_winsys.c
index 761f5d1..2e5970b 100644
--- a/src/gallium/winsys/sw/dri/dri_sw_winsys.c
+++ b/src/gallium/winsys/sw/dri/dri_sw_winsys.c
@@ -92,7 +92,8 @@ alloc_shm(struct dri_sw_displaytarget *dri_sw_dt, unsigned size)
{
char *addr;
- dri_sw_dt->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777);
+ /* 0600 = user read+write */
+ dri_sw_dt->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0600);
if (dri_sw_dt->shmid < 0)
return NULL;
diff --git a/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c b/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
index c14c9de..edebb48 100644
--- a/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
+++ b/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
@@ -126,7 +126,8 @@ alloc_shm(struct xlib_displaytarget *buf, unsigned size)
shminfo->shmid = -1;
shminfo->shmaddr = (char *) -1;
- shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777);
+ /* 0600 = user read+write */
+ shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0600);
if (shminfo->shmid < 0) {
return NULL;
}
diff --git a/src/mesa/drivers/x11/xm_buffer.c b/src/mesa/drivers/x11/xm_buffer.c
index d945d8a..0da08a6 100644
--- a/src/mesa/drivers/x11/xm_buffer.c
+++ b/src/mesa/drivers/x11/xm_buffer.c
@@ -89,8 +89,9 @@ alloc_back_shm_ximage(XMesaBuffer b, GLuint width, GLuint height)
return GL_FALSE;
}
+ /* 0600 = user read+write */
b->shminfo.shmid = shmget(IPC_PRIVATE, b->backxrb->ximage->bytes_per_line
- * b->backxrb->ximage->height, IPC_CREAT|0777);
+ * b->backxrb->ximage->height, IPC_CREAT|0600);
if (b->shminfo.shmid < 0) {
_mesa_warning(NULL, "shmget failed while allocating back buffer.\n");
XDestroyImage(b->backxrb->ximage);
--
1.8.5.6