[xsrc/netbsd-9]: xsrc/external/mit/MesaLib/dist/src Pull up following revisio...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/xsrc/rev/1f9fe59a8a09
branches:  netbsd-9
changeset: 10412:1f9fe59a8a09
user:      martin <martin%NetBSD.org@localhost>
date:      Sun Dec 08 15:00:33 2019 +0000

description:
Pull up following revision(s) (requested by maya in ticket #518):

        external/mit/MesaLib/dist/src/gallium/winsys/sw/dri/dri_sw_winsys.c: revision 1.2
        external/mit/MesaLib/dist/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c: revision 1.2
        external/mit/MesaLib/dist/src/mesa/drivers/x11/xm_buffer.c: revision 1.2

>From 02c3dad0f3b4d26e0faa5cc51d06bc50d693dcdc Mon Sep 17 00:00:00 2001

From: Brian Paul <brianp%vmware.com@localhost>
Date: Wed, 9 Oct 2019 12:05:16 -0600
Subject: [PATCH] Call shmget() with permission 0600 instead of 0777

A security advisory (TALOS-2019-0857/CVE-2019-5068) found that
creating shared memory regions with permission mode 0777 could allow
any user to access that memory.  Several Mesa drivers use shared-
memory XImages to implement back buffers for improved performance.

This path changes the shmget() calls to use 0600 (user r/w).
Tested with legacy Xlib driver and llvmpipe.

Cc: mesa-stable%lists.freedesktop.org@localhost
Reviewed-by: Kristian H. Kristensen <hoegsberg%google.com@localhost>

diffstat:

 external/mit/MesaLib/dist/src/gallium/winsys/sw/dri/dri_sw_winsys.c   |  3 ++-
 external/mit/MesaLib/dist/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c |  3 ++-
 external/mit/MesaLib/dist/src/mesa/drivers/x11/xm_buffer.c            |  3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diffs (40 lines):

diff -r 867f3e0cdc27 -r 1f9fe59a8a09 external/mit/MesaLib/dist/src/gallium/winsys/sw/dri/dri_sw_winsys.c
--- a/external/mit/MesaLib/dist/src/gallium/winsys/sw/dri/dri_sw_winsys.c       Sun Sep 01 14:18:00 2019 +0000
+++ b/external/mit/MesaLib/dist/src/gallium/winsys/sw/dri/dri_sw_winsys.c       Sun Dec 08 15:00:33 2019 +0000
@@ -93,7 +93,8 @@
 {
    char *addr;
 
-   dri_sw_dt->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777);
+   /* 0600 = user read+write */
+   dri_sw_dt->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT | 0600);
    if (dri_sw_dt->shmid < 0)
       return NULL;
 
diff -r 867f3e0cdc27 -r 1f9fe59a8a09 external/mit/MesaLib/dist/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
--- a/external/mit/MesaLib/dist/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c     Sun Sep 01 14:18:00 2019 +0000
+++ b/external/mit/MesaLib/dist/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c     Sun Dec 08 15:00:33 2019 +0000
@@ -126,7 +126,8 @@
    shminfo->shmid = -1;
    shminfo->shmaddr = (char *) -1;
 
-   shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777);
+   /* 0600 = user read+write */
+   shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT | 0600);
    if (shminfo->shmid < 0) {
       return NULL;
    }
diff -r 867f3e0cdc27 -r 1f9fe59a8a09 external/mit/MesaLib/dist/src/mesa/drivers/x11/xm_buffer.c
--- a/external/mit/MesaLib/dist/src/mesa/drivers/x11/xm_buffer.c        Sun Sep 01 14:18:00 2019 +0000
+++ b/external/mit/MesaLib/dist/src/mesa/drivers/x11/xm_buffer.c        Sun Dec 08 15:00:33 2019 +0000
@@ -89,8 +89,9 @@
       return GL_FALSE;
    }
 
+   /* 0600 = user read+write */
    b->shminfo.shmid = shmget(IPC_PRIVATE, b->backxrb->ximage->bytes_per_line
-                            * b->backxrb->ximage->height, IPC_CREAT|0777);
+                             * b->backxrb->ximage->height, IPC_CREAT | 0600);
    if (b->shminfo.shmid < 0) {
       _mesa_warning(NULL, "shmget failed while allocating back buffer.\n");
       XDestroyImage(b->backxrb->ximage);