xserver: Branch 'master' - 2 commits

[GitLab Mirror]

 hw/xwayland/xwayland-shm.c |   50 +++++++++++++++++++++++++++++++--------------
 1 file changed, 35 insertions(+), 15 deletions(-)

New commits:
commit ddb86e94c07a269dfc9cd80543f9f6a2c3e934a2
Author: Emmanuel Gil Peyrot <linkmauve at linkmauve.fr>
Date:   Sat Jul 11 19:47:40 2020 +0200

    xwayland: Remove harmless duplicated #include

diff --git a/hw/xwayland/xwayland-shm.c b/hw/xwayland/xwayland-shm.c
index 612fe8263..cf7e97ca3 100644
--- a/hw/xwayland/xwayland-shm.c
+++ b/hw/xwayland/xwayland-shm.c
@@ -37,7 +37,6 @@
 #include <stdlib.h>
 
 #include "fb.h"
-#include "os.h"
 #include "pixmapstr.h"
 
 #include "xwayland-pixmap.h"
commit a137dd5f79d272a57c6704143dc9c25a9b59c927
Author: Emmanuel Gil Peyrot <linkmauve at linkmauve.fr>
Date:   Sat Jul 11 19:34:59 2020 +0200

    xwayland: Use memfd_create() when available
    
    This (so-far) Linux-only API lets users create file descriptors purely
    in memory, without any backing file on the filesystem and the race
    condition which could ensue when unlink()ing it.
    
    It also allows seals to be placed on the file, ensuring to every other
    process that we won’t be allowed to shrink the contents, potentially
    causing a SIGBUS when they try reading it.
    
    This patch is best viewed with the -w option of git log -p.
    
    This is a port of this commit from Weston:
    https://gitlab.freedesktop.org/wayland/weston/-/commit/deae98ef45e060b8412a5edd195fb0c7c14f0321
    
    Fixes #848.
    
    Signed-off-by: Emmanuel Gil Peyrot <linkmauve at linkmauve.fr>

diff --git a/hw/xwayland/xwayland-shm.c b/hw/xwayland/xwayland-shm.c
index 00f2600a7..612fe8263 100644
--- a/hw/xwayland/xwayland-shm.c
+++ b/hw/xwayland/xwayland-shm.c
@@ -114,6 +114,13 @@ create_tmpfile_cloexec(char *tmpname)
  * given size. If disk space is insufficient, errno is set to ENOSPC.
  * If posix_fallocate() is not supported, program may receive
  * SIGBUS on accessing mmap()'ed file contents instead.
+ *
+ * If the C library implements memfd_create(), it is used to create the
+ * file purely in memory, without any backing file name on the file
+ * system, and then sealing off the possibility of shrinking it.  This
+ * can then be checked before accessing mmap()'ed file contents, to
+ * make sure SIGBUS can't happen.  It also avoids requiring
+ * XDG_RUNTIME_DIR.
  */
 static int
 os_create_anonymous_file(off_t size)
@@ -124,25 +131,39 @@ os_create_anonymous_file(off_t size)
     int fd;
     int ret;
 
-    path = getenv("XDG_RUNTIME_DIR");
-    if (!path) {
-        errno = ENOENT;
-        return -1;
-    }
+#ifdef HAVE_MEMFD_CREATE
+    fd = memfd_create("xwayland-shared", MFD_CLOEXEC | MFD_ALLOW_SEALING);
+    if (fd >= 0) {
+        /* We can add this seal before calling posix_fallocate(), as
+         * the file is currently zero-sized anyway.
+         *
+         * There is also no need to check for the return value, we
+         * couldn't do anything with it anyway.
+         */
+        fcntl(fd, F_ADD_SEALS, F_SEAL_SHRINK);
+    } else
+#endif
+    {
+        path = getenv("XDG_RUNTIME_DIR");
+        if (!path) {
+            errno = ENOENT;
+            return -1;
+        }
 
-    name = malloc(strlen(path) + sizeof(template));
-    if (!name)
-        return -1;
+        name = malloc(strlen(path) + sizeof(template));
+        if (!name)
+            return -1;
 
-    strcpy(name, path);
-    strcat(name, template);
+        strcpy(name, path);
+        strcat(name, template);
 
-    fd = create_tmpfile_cloexec(name);
+        fd = create_tmpfile_cloexec(name);
 
-    free(name);
+        free(name);
 
-    if (fd < 0)
-        return -1;
+        if (fd < 0)
+            return -1;
+    }
 
 #ifdef HAVE_POSIX_FALLOCATE
     /*