RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1798702 - shm busted in mesa again
Summary: shm busted in mesa again
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: mesa
Version: 8.2
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.0
Assignee: Dave Airlie
QA Contact: Desktop QE
URL:
Whiteboard:
: 1779994 1800486 (view as bug list)
Depends On:
Blocks: 1739559
TreeView+ depends on / blocked
 
Reported: 2020-02-05 19:58 UTC by Ray Strode [halfline]
Modified: 2023-09-07 21:44 UTC (History)
4 users (show)

Fixed In Version: mesa-19.3.4-2.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-04-28 15:41:41 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:1633 0 None None None 2020-04-28 15:41:59 UTC

Description Ray Strode [halfline] 2020-02-05 19:58:45 UTC 
If I do something like

Xephyr -query localhost :123

when XDMCP is enabled, all windows show up black with clear titlebars.

This is the same symptom we've had in the past when the SHM detection in mesa was broken iirc.

Indeed,

Xephyr -extension mit-shm -query localhost :123

works around the problem.

Maybe dropped patch in a rebase?
Comment 1 Michal Odehnal 2020-02-07 09:47:28 UTC 
*** Bug 1800486 has been marked as a duplicate of this bug. ***
Comment 2 Dave Airlie 2020-02-13 05:09:02 UTC 
reproduced this locally.
Comment 3 Dave Airlie 2020-02-13 05:28:05 UTC 
small analysis

upstream did a CVE fix to make shm segment permissions 600 instead of 777 to stop random users accessing them

running Xephyr as user 1000, but then having a user session inside it running as user 1001 stops the shm from being accessed.

commit addf63dbd796fc08e06ac1323071a8f8f48ac7b9
Author: Brian Paul <brianp>
Date:   Wed Oct 9 12:05:16 2019 -0600

    Call shmget() with permission 0600 instead of 0777
    
    A security advisory (TALOS-2019-0857/CVE-2019-5068) found that
    creating shared memory regions with permission mode 0777 could allow
    any user to access that memory.  Several Mesa drivers use shared-
    memory XImages to implement back buffers for improved performance.
    
    This path changes the shmget() calls to use 0600 (user r/w).
    
    Tested with legacy Xlib driver and llvmpipe.
    
    Cc: mesa-stable.org
    Reviewed-by: Kristian H. Kristensen <hoegsberg>
    (cherry picked from commit 02c3dad0f3b4d26e0faa5cc51d06bc50d693dcdc)
Comment 4 Dave Airlie 2020-02-14 05:15:47 UTC 
https://gitlab.freedesktop.org/mesa/mesa/merge_requests/3823

Upstream proposed fixes.
Comment 5 Dave Airlie 2020-02-14 21:30:13 UTC 
mesa-19.3.4-1.el8 built in brew
Comment 8 Ray Strode [halfline] 2020-02-17 16:03:43 UTC 
*** Bug 1779994 has been marked as a duplicate of this bug. ***
Comment 9 Michal Odehnal 2020-02-18 08:21:05 UTC 
I can still reproduce to some extent. Windows are no longer black, but gnome-shell panels are still broken.
Comment 10 Dave Airlie 2020-02-18 23:35:29 UTC 
Hey Michal,

I'm not reproducing that at all here in a VM with qxl, can you drop drop a screenshot here or what panels are broken?

or maybe just test RHEL 8.1 baseline with just the mesa package updated (if you are not), as I'm seeing not great stability with RHEL8.2 nightly.
Comment 11 Michal Odehnal 2020-02-19 09:41:23 UTC 
Hi, I am seeing exact issues with panels that shows in video attachment in duplicate bug here https://bugzilla.redhat.com/show_bug.cgi?id=1800486. I used the Rey's reproducer here, using Xephyr, logging in and playing with panels. I also tried with base RHEL8.1 with updated only mesa, same issue.
Comment 12 Michal Odehnal 2020-02-19 09:46:43 UTC 
Now I noticed I had vga model set, switched to qxl but the issue still remains.
Comment 13 Dave Airlie 2020-02-19 19:46:24 UTC 
okay thanks for that, I was missing what you are seeing, looks like another bug in the fallback paths, will dig a bit more today.
Comment 14 Tomas Pelka 2020-02-20 07:23:55 UTC 
Michale please check the new build in brew.
Comment 15 Michal Odehnal 2020-02-20 07:46:52 UTC 
All works as expected now.
Comment 17 errata-xmlrpc 2020-04-28 15:41:41 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:1633
Note You need to log in before you can comment on or make changes to this bug.