diff options
Diffstat (limited to 'meta-openbmc-mods/meta-common/recipes-core')
8 files changed, 404 insertions, 155 deletions
diff --git a/meta-openbmc-mods/meta-common/recipes-core/at-scale-debug/at-scale-debug_git.bb b/meta-openbmc-mods/meta-common/recipes-core/at-scale-debug/at-scale-debug_git.bb index 77f171095..10df9dd59 100644 --- a/meta-openbmc-mods/meta-common/recipes-core/at-scale-debug/at-scale-debug_git.bb +++ b/meta-openbmc-mods/meta-common/recipes-core/at-scale-debug/at-scale-debug_git.bb @@ -13,6 +13,7 @@ DEPENDS = "sdbusplus openssl libpam libgpiod safec" do_configure[depends] += "virtual/kernel:do_shared_workdir" SRC_URI = "git://github.com/Intel-BMC/asd;protocol=git" +SRC_URI += "file://0001-Fix-build-error-in-kernel-v5.10.patch" SRCREV = "1.4.4" inherit useradd diff --git a/meta-openbmc-mods/meta-common/recipes-core/at-scale-debug/files/0001-Fix-build-error-in-kernel-v5.10.patch b/meta-openbmc-mods/meta-common/recipes-core/at-scale-debug/files/0001-Fix-build-error-in-kernel-v5.10.patch new file mode 100644 index 000000000..7ebedeee3 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-core/at-scale-debug/files/0001-Fix-build-error-in-kernel-v5.10.patch @@ -0,0 +1,62 @@ +From 7ed9ba9738d8f27578ea2d00019f8245ee2a5556 Mon Sep 17 00:00:00 2001 +From: Jae Hyun Yoo <jae.hyun.yoo@intel.com> +Date: Mon, 22 Feb 2021 15:32:13 -0800 +Subject: [PATCH] Fix build error in kernel v5.10 + +Kernel headers should be added as last headers to prevent unexpected +build breaks. + +Change-Id: Ie7d1a054baf2af88b9c46f928d0d84a64d8febd9 +Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com> +--- + i2c_handler.c | 5 +++-- + i2c_msg_builder.c | 5 +++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/i2c_handler.c b/i2c_handler.c +index 21fb931..05470f4 100644 +--- a/i2c_handler.c ++++ b/i2c_handler.c +@@ -29,8 +29,6 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + #include <errno.h> + #include <fcntl.h> +-#include <linux/i2c-dev.h> +-#include <linux/i2c.h> + #include <stdint.h> + #include <stdio.h> + #include <stdlib.h> +@@ -40,6 +38,9 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + #include "logging.h" + ++#include <linux/i2c-dev.h> ++#include <linux/i2c.h> ++ + #define FILE_NAME "/dev/i2c" + #define MAX_I2C_DEV_FILENAME 256 + +diff --git a/i2c_msg_builder.c b/i2c_msg_builder.c +index 6ae06a0..05dc340 100644 +--- a/i2c_msg_builder.c ++++ b/i2c_msg_builder.c +@@ -27,13 +27,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + #include "i2c_msg_builder.h" + +-#include <linux/i2c-dev.h> +-#include <linux/i2c.h> + #include <stdint.h> + #include <stdlib.h> + + #include "logging.h" + ++#include <linux/i2c-dev.h> ++#include <linux/i2c.h> ++ + STATUS copy_i2c_to_asd(asd_i2c_msg* asd, struct i2c_msg* i2c); + STATUS copy_asd_to_i2c(const asd_i2c_msg* asd, struct i2c_msg* i2c); + +-- +2.17.1 + diff --git a/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0031-iconv-Fix-incorrect-UCS4-inner-loop-bounds-BZ-26923.patch b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0031-iconv-Fix-incorrect-UCS4-inner-loop-bounds-BZ-26923.patch deleted file mode 100644 index bb297d50b..000000000 --- a/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0031-iconv-Fix-incorrect-UCS4-inner-loop-bounds-BZ-26923.patch +++ /dev/null @@ -1,151 +0,0 @@ -From 228edd356f03bf62dcf2b1335f25d43c602ee68d Mon Sep 17 00:00:00 2001 -From: Michael Colavita <mcolavita@fb.com> -Date: Thu, 19 Nov 2020 11:44:40 -0500 -Subject: [PATCH] iconv: Fix incorrect UCS4 inner loop bounds (BZ#26923) - -Previously, in UCS4 conversion routines we limit the number of -characters we examine to the minimum of the number of characters in the -input and the number of characters in the output. This is not the -correct behavior when __GCONV_IGNORE_ERRORS is set, as we do not consume -an output character when we skip a code unit. Instead, track the input -and output pointers and terminate the loop when either reaches its -limit. - -This resolves assertion failures when resetting the input buffer in a step of -iconv, which assumes that the input will be fully consumed given sufficient -output space. ---- - iconv/Makefile | 2 +- - iconv/gconv_simple.c | 16 ++++---------- - iconv/tst-iconv8.c | 50 ++++++++++++++++++++++++++++++++++++++++++++ - 3 files changed, 55 insertions(+), 13 deletions(-) - create mode 100644 iconv/tst-iconv8.c - -diff --git a/iconv/Makefile b/iconv/Makefile -index 30bf996d3a..f9b51e23ec 100644 ---- a/iconv/Makefile -+++ b/iconv/Makefile -@@ -44,7 +44,7 @@ CFLAGS-linereader.c += -DNO_TRANSLITERATION - CFLAGS-simple-hash.c += -I../locale - - tests = tst-iconv1 tst-iconv2 tst-iconv3 tst-iconv4 tst-iconv5 tst-iconv6 \ -- tst-iconv7 tst-iconv-mt tst-iconv-opt -+ tst-iconv7 tst-iconv8 tst-iconv-mt - - others = iconv_prog iconvconfig - install-others-programs = $(inst_bindir)/iconv -diff --git a/iconv/gconv_simple.c b/iconv/gconv_simple.c -index d4797fba17..963b29f246 100644 ---- a/iconv/gconv_simple.c -+++ b/iconv/gconv_simple.c -@@ -239,11 +239,9 @@ ucs4_internal_loop (struct __gconv_step *step, - int flags = step_data->__flags; - const unsigned char *inptr = *inptrp; - unsigned char *outptr = *outptrp; -- size_t n_convert = MIN (inend - inptr, outend - outptr) / 4; - int result; -- size_t cnt; - -- for (cnt = 0; cnt < n_convert; ++cnt, inptr += 4) -+ for (; inptr + 4 <= inend && outptr + 4 <= outend; inptr += 4) - { - uint32_t inval; - -@@ -307,11 +305,9 @@ ucs4_internal_loop_unaligned (struct __gconv_step *step, - int flags = step_data->__flags; - const unsigned char *inptr = *inptrp; - unsigned char *outptr = *outptrp; -- size_t n_convert = MIN (inend - inptr, outend - outptr) / 4; - int result; -- size_t cnt; - -- for (cnt = 0; cnt < n_convert; ++cnt, inptr += 4) -+ for (; inptr + 4 <= inend && outptr + 4 <= outend; inptr += 4) - { - if (__glibc_unlikely (inptr[0] > 0x80)) - { -@@ -613,11 +609,9 @@ ucs4le_internal_loop (struct __gconv_step *step, - int flags = step_data->__flags; - const unsigned char *inptr = *inptrp; - unsigned char *outptr = *outptrp; -- size_t n_convert = MIN (inend - inptr, outend - outptr) / 4; - int result; -- size_t cnt; - -- for (cnt = 0; cnt < n_convert; ++cnt, inptr += 4) -+ for (; inptr + 4 <= inend && outptr + 4 <= outend; inptr += 4) - { - uint32_t inval; - -@@ -684,11 +678,9 @@ ucs4le_internal_loop_unaligned (struct __gconv_step *step, - int flags = step_data->__flags; - const unsigned char *inptr = *inptrp; - unsigned char *outptr = *outptrp; -- size_t n_convert = MIN (inend - inptr, outend - outptr) / 4; - int result; -- size_t cnt; - -- for (cnt = 0; cnt < n_convert; ++cnt, inptr += 4) -+ for (; inptr + 4 <= inend && outptr + 4 <= outend; inptr += 4) - { - if (__glibc_unlikely (inptr[3] > 0x80)) - { -diff --git a/iconv/tst-iconv8.c b/iconv/tst-iconv8.c -new file mode 100644 -index 0000000000..0b92b19f66 ---- /dev/null -+++ b/iconv/tst-iconv8.c -@@ -0,0 +1,50 @@ -+/* Test iconv behavior on UCS4 conversions with //IGNORE. -+ Copyright (C) 2020 Free Software Foundation, Inc. -+ This file is part of the GNU C Library. -+ -+ The GNU C Library is free software; you can redistribute it and/or -+ modify it under the terms of the GNU Lesser General Public -+ License as published by the Free Software Foundation; either -+ version 2.1 of the License, or (at your option) any later version. -+ -+ The GNU C Library is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ Lesser General Public License for more details. -+ -+ You should have received a copy of the GNU Lesser General Public -+ License along with the GNU C Library; if not, see -+ <http://www.gnu.org/licenses/>. */ -+ -+/* Derived from BZ #26923 */ -+#include <errno.h> -+#include <iconv.h> -+#include <stdio.h> -+#include <support/check.h> -+ -+static int -+do_test (void) -+{ -+ iconv_t cd = iconv_open ("UTF-8//IGNORE", "ISO-10646/UCS4/"); -+ TEST_VERIFY_EXIT (cd != (iconv_t) -1); -+ -+ /* -+ * Convert sequence beginning with an irreversible character into buffer that -+ * is too small. -+ */ -+ char input[12] = "\xe1\x80\xa1" "AAAAAAAAA"; -+ char *inptr = input; -+ size_t insize = sizeof (input); -+ char output[6]; -+ char *outptr = output; -+ size_t outsize = sizeof (output); -+ -+ TEST_VERIFY (iconv (cd, &inptr, &insize, &outptr, &outsize) == -1); -+ TEST_VERIFY (errno == E2BIG); -+ -+ TEST_VERIFY_EXIT (iconv_close (cd) != -1); -+ -+ return 0; -+} -+ -+#include <support/test-driver.c> --- -2.27.0 - diff --git a/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0033-Fix-assertion-failure-in-ISO-20220JP-3-module-bug-27256.patch b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0033-Fix-assertion-failure-in-ISO-20220JP-3-module-bug-27256.patch new file mode 100644 index 000000000..68b9fcfdf --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0033-Fix-assertion-failure-in-ISO-20220JP-3-module-bug-27256.patch @@ -0,0 +1,292 @@ +From 7d88c6142c6efc160c0ee5e4f85cde382c072888 Mon Sep 17 00:00:00 2001 +From: Florian Weimer <fweimer@redhat.com> +Date: Wed, 27 Jan 2021 13:36:12 +0100 +Subject: [PATCH] gconv: Fix assertion failure in ISO-2022-JP-3 module (bug + 27256) + +The conversion loop to the internal encoding does not follow +the interface contract that __GCONV_FULL_OUTPUT is only returned +after the internal wchar_t buffer has been filled completely. This +is enforced by the first of the two asserts in iconv/skeleton.c: + + /* We must run out of output buffer space in this + rerun. */ + assert (outbuf == outerr); + assert (nstatus == __GCONV_FULL_OUTPUT); + +This commit solves this issue by queuing a second wide character +which cannot be written immediately in the state variable, like +other converters already do (e.g., BIG5-HKSCS or TSCII). + +Reported-by: Tavis Ormandy <taviso@gmail.com> +--- + iconvdata/Makefile | 4 +- + iconvdata/bug-iconv14.c | 127 ++++++++++++++++++++++++++++++++++++++ + iconvdata/iso-2022-jp-3.c | 67 ++++++++++++++------ + 3 files changed, 178 insertions(+), 20 deletions(-) + create mode 100644 iconvdata/bug-iconv14.c + +diff --git a/iconvdata/Makefile b/iconvdata/Makefile +index c8c532a3e4..55c527a5f7 100644 +--- a/iconvdata/Makefile ++++ b/iconvdata/Makefile +@@ -74,7 +74,7 @@ ifeq (yes,$(build-shared)) + tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \ + tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \ + bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \ +- bug-iconv13 ++ bug-iconv13 bug-iconv14 + ifeq ($(have-thread-library),yes) + tests += bug-iconv3 + endif +@@ -322,6 +322,8 @@ $(objpfx)bug-iconv10.out: $(objpfx)gconv-modules \ + $(addprefix $(objpfx),$(modules.so)) + $(objpfx)bug-iconv12.out: $(objpfx)gconv-modules \ + $(addprefix $(objpfx),$(modules.so)) ++$(objpfx)bug-iconv14.out: $(objpfx)gconv-modules \ ++ $(addprefix $(objpfx),$(modules.so)) + + $(objpfx)iconv-test.out: run-iconv-test.sh $(objpfx)gconv-modules \ + $(addprefix $(objpfx),$(modules.so)) \ +diff --git a/iconvdata/bug-iconv14.c b/iconvdata/bug-iconv14.c +new file mode 100644 +index 0000000000..902f140fa9 +--- /dev/null ++++ b/iconvdata/bug-iconv14.c +@@ -0,0 +1,127 @@ ++/* Assertion in ISO-2022-JP-3 due to two-character sequence (bug 27256). ++ Copyright (C) 2021 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <https://www.gnu.org/licenses/>. */ ++ ++#include <iconv.h> ++#include <string.h> ++#include <errno.h> ++#include <support/check.h> ++ ++/* Use an escape sequence to return to the initial state. */ ++static void ++with_escape_sequence (void) ++{ ++ iconv_t c = iconv_open ("UTF-8", "ISO-2022-JP-3"); ++ TEST_VERIFY_EXIT (c != (iconv_t) -1); ++ ++ char in[] = "\e$(O+D\e(B"; ++ char *inbuf = in; ++ size_t inleft = strlen (in); ++ char out[3]; /* Space for one output character. */ ++ char *outbuf; ++ size_t outleft; ++ ++ outbuf = out; ++ outleft = sizeof (out); ++ TEST_COMPARE (iconv (c, &inbuf, &inleft, &outbuf, &outleft), (size_t) -1); ++ TEST_COMPARE (errno, E2BIG); ++ TEST_COMPARE (inleft, 3); ++ TEST_COMPARE (inbuf - in, strlen (in) - 3); ++ TEST_COMPARE (outleft, sizeof (out) - 2); ++ TEST_COMPARE (outbuf - out, 2); ++ TEST_COMPARE (out[0] & 0xff, 0xc3); ++ TEST_COMPARE (out[1] & 0xff, 0xa6); ++ ++ /* Return to the initial shift state, producing the pending ++ character. */ ++ outbuf = out; ++ outleft = sizeof (out); ++ TEST_COMPARE (iconv (c, &inbuf, &inleft, &outbuf, &outleft), 0); ++ TEST_COMPARE (inleft, 0); ++ TEST_COMPARE (inbuf - in, strlen (in)); ++ TEST_COMPARE (outleft, sizeof (out) - 2); ++ TEST_COMPARE (outbuf - out, 2); ++ TEST_COMPARE (out[0] & 0xff, 0xcc); ++ TEST_COMPARE (out[1] & 0xff, 0x80); ++ ++ /* Nothing should be flushed the second time. */ ++ outbuf = out; ++ outleft = sizeof (out); ++ TEST_COMPARE (iconv (c, NULL, 0, &outbuf, &outleft), 0); ++ TEST_COMPARE (outleft, sizeof (out)); ++ TEST_COMPARE (outbuf - out, 0); ++ TEST_COMPARE (out[0] & 0xff, 0xcc); ++ TEST_COMPARE (out[1] & 0xff, 0x80); ++ ++ TEST_COMPARE (iconv_close (c), 0); ++} ++ ++/* Use an explicit flush to return to the initial state. */ ++static void ++with_flush (void) ++{ ++ iconv_t c = iconv_open ("UTF-8", "ISO-2022-JP-3"); ++ TEST_VERIFY_EXIT (c != (iconv_t) -1); ++ ++ char in[] = "\e$(O+D"; ++ char *inbuf = in; ++ size_t inleft = strlen (in); ++ char out[3]; /* Space for one output character. */ ++ char *outbuf; ++ size_t outleft; ++ ++ outbuf = out; ++ outleft = sizeof (out); ++ TEST_COMPARE (iconv (c, &inbuf, &inleft, &outbuf, &outleft), (size_t) -1); ++ TEST_COMPARE (errno, E2BIG); ++ TEST_COMPARE (inleft, 0); ++ TEST_COMPARE (inbuf - in, strlen (in)); ++ TEST_COMPARE (outleft, sizeof (out) - 2); ++ TEST_COMPARE (outbuf - out, 2); ++ TEST_COMPARE (out[0] & 0xff, 0xc3); ++ TEST_COMPARE (out[1] & 0xff, 0xa6); ++ ++ /* Flush the pending character. */ ++ outbuf = out; ++ outleft = sizeof (out); ++ TEST_COMPARE (iconv (c, NULL, 0, &outbuf, &outleft), 0); ++ TEST_COMPARE (outleft, sizeof (out) - 2); ++ TEST_COMPARE (outbuf - out, 2); ++ TEST_COMPARE (out[0] & 0xff, 0xcc); ++ TEST_COMPARE (out[1] & 0xff, 0x80); ++ ++ /* Nothing should be flushed the second time. */ ++ outbuf = out; ++ outleft = sizeof (out); ++ TEST_COMPARE (iconv (c, NULL, 0, &outbuf, &outleft), 0); ++ TEST_COMPARE (outleft, sizeof (out)); ++ TEST_COMPARE (outbuf - out, 0); ++ TEST_COMPARE (out[0] & 0xff, 0xcc); ++ TEST_COMPARE (out[1] & 0xff, 0x80); ++ ++ TEST_COMPARE (iconv_close (c), 0); ++} ++ ++static int ++do_test (void) ++{ ++ with_escape_sequence (); ++ with_flush (); ++ return 0; ++} ++ ++#include <support/test-driver.c> +diff --git a/iconvdata/iso-2022-jp-3.c b/iconvdata/iso-2022-jp-3.c +index 3eaa847ad9..c8ba88cdc9 100644 +--- a/iconvdata/iso-2022-jp-3.c ++++ b/iconvdata/iso-2022-jp-3.c +@@ -67,23 +67,34 @@ enum + CURRENT_SEL_MASK = 7 << 3 + }; + +-/* During UCS-4 to ISO-2022-JP-3 conversion, the COUNT element of the state +- also contains the last two bytes to be output, shifted by 6 bits, and a +- one-bit indicator whether they must be preceded by the shift sequence, +- in bit 22. */ ++/* During UCS-4 to ISO-2022-JP-3 conversion, the COUNT element of the ++ state also contains the last two bytes to be output, shifted by 6 ++ bits, and a one-bit indicator whether they must be preceded by the ++ shift sequence, in bit 22. During ISO-2022-JP-3 to UCS-4 ++ conversion, COUNT may also contain a non-zero pending wide ++ character, shifted by six bits. This happens for certain inputs in ++ JISX0213_1_2004_set and JISX0213_2_set if the second wide character ++ in a combining sequence cannot be written because the buffer is ++ full. */ + + /* Since this is a stateful encoding we have to provide code which resets + the output state to the initial state. This has to be done during the + flushing. */ + #define EMIT_SHIFT_TO_INIT \ +- if ((data->__statep->__count & ~7) != ASCII_set) \ ++ if (data->__statep->__count != ASCII_set) \ + { \ + if (FROM_DIRECTION) \ + { \ +- /* It's easy, we don't have to emit anything, we just reset the \ +- state for the input. */ \ +- data->__statep->__count &= 7; \ +- data->__statep->__count |= ASCII_set; \ ++ if (__glibc_likely (outbuf + 4 <= outend)) \ ++ { \ ++ /* Write out the last character. */ \ ++ *((uint32_t *) outbuf) = data->__statep->__count >> 6; \ ++ outbuf += sizeof (uint32_t); \ ++ data->__statep->__count = ASCII_set; \ ++ } \ ++ else \ ++ /* We don't have enough room in the output buffer. */ \ ++ status = __GCONV_FULL_OUTPUT; \ + } \ + else \ + { \ +@@ -151,7 +162,21 @@ enum + #define LOOPFCT FROM_LOOP + #define BODY \ + { \ +- uint32_t ch = *inptr; \ ++ uint32_t ch; \ ++ \ ++ /* Output any pending character. */ \ ++ ch = set >> 6; \ ++ if (__glibc_unlikely (ch != 0)) \ ++ { \ ++ put32 (outptr, ch); \ ++ outptr += 4; \ ++ /* Remove the pending character, but preserve state bits. */ \ ++ set &= (1 << 6) - 1; \ ++ continue; \ ++ } \ ++ \ ++ /* Otherwise read the next input byte. */ \ ++ ch = *inptr; \ + \ + /* Recognize escape sequences. */ \ + if (__glibc_unlikely (ch == ESC)) \ +@@ -297,21 +322,25 @@ enum + uint32_t u1 = __jisx0213_to_ucs_combining[ch - 1][0]; \ + uint32_t u2 = __jisx0213_to_ucs_combining[ch - 1][1]; \ + \ ++ inptr += 2; \ ++ \ ++ put32 (outptr, u1); \ ++ outptr += 4; \ ++ \ + /* See whether we have room for two characters. */ \ +- if (outptr + 8 <= outend) \ ++ if (outptr + 4 <= outend) \ + { \ +- inptr += 2; \ +- put32 (outptr, u1); \ +- outptr += 4; \ + put32 (outptr, u2); \ + outptr += 4; \ + continue; \ + } \ +- else \ +- { \ +- result = __GCONV_FULL_OUTPUT; \ +- break; \ +- } \ ++ \ ++ /* Otherwise store only the first character now, and \ ++ put the second one into the queue. */ \ ++ set |= u2 << 6; \ ++ /* Tell the caller why we terminate the loop. */ \ ++ result = __GCONV_FULL_OUTPUT; \ ++ break; \ + } \ + \ + inptr += 2; \ +-- +2.27.0 + diff --git a/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0034-Fix-double-free-in-netgroupcache-BZ-27462.patch b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0034-Fix-double-free-in-netgroupcache-BZ-27462.patch new file mode 100644 index 000000000..28580c7e2 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0034-Fix-double-free-in-netgroupcache-BZ-27462.patch @@ -0,0 +1,44 @@ +From dca565886b5e8bd7966e15f0ca42ee5cff686673 Mon Sep 17 00:00:00 2001 +From: DJ Delorie <dj@redhat.com> +Date: Thu, 25 Feb 2021 16:08:21 -0500 +Subject: [PATCH] nscd: Fix double free in netgroupcache [BZ #27462] + +In commit 745664bd798ec8fd50438605948eea594179fba1 a use-after-free +was fixed, but this led to an occasional double-free. This patch +tracks the "live" allocation better. + +Tested manually by a third party. + +Related: RHBZ 1927877 + +Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> +Reviewed-by: Carlos O'Donell <carlos@redhat.com> +--- + nscd/netgroupcache.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c +index dba6ceec1b..ad2daddafd 100644 +--- a/nscd/netgroupcache.c ++++ b/nscd/netgroupcache.c +@@ -248,7 +248,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req, + : NULL); + ndomain = (ndomain ? newbuf + ndomaindiff + : NULL); +- buffer = newbuf; ++ *tofreep = buffer = newbuf; + } + + nhost = memcpy (buffer + bufused, +@@ -319,7 +319,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req, + else if (status == NSS_STATUS_TRYAGAIN && e == ERANGE) + { + buflen *= 2; +- buffer = xrealloc (buffer, buflen); ++ *tofreep = buffer = xrealloc (buffer, buflen); + } + else if (status == NSS_STATUS_RETURN + || status == NSS_STATUS_NOTFOUND +-- +2.27.0 + diff --git a/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc_%.bbappend index d458a6d94..e0f4c3080 100644 --- a/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc_%.bbappend +++ b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc_%.bbappend @@ -1,5 +1,6 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" -SRC_URI += "file://0031-iconv-Fix-incorrect-UCS4-inner-loop-bounds-BZ-26923.patch \ - file://0032-Fix-buffer-overrun-in-EUC-KR-conversion-module-BZ-24973.patch \ +SRC_URI += "file://0032-Fix-buffer-overrun-in-EUC-KR-conversion-module-BZ-24973.patch \ + file://0033-Fix-assertion-failure-in-ISO-20220JP-3-module-bug-27256.patch \ + file://0034-Fix-double-free-in-netgroupcache-BZ-27462.patch \ " diff --git a/meta-openbmc-mods/meta-common/recipes-core/ipmi/intel-ipmi-oem_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/ipmi/intel-ipmi-oem_%.bbappend index 995146b35..6c25b3e0e 100644 --- a/meta-openbmc-mods/meta-common/recipes-core/ipmi/intel-ipmi-oem_%.bbappend +++ b/meta-openbmc-mods/meta-common/recipes-core/ipmi/intel-ipmi-oem_%.bbappend @@ -2,4 +2,4 @@ EXTRA_OECMAKE += "${@bb.utils.contains('IMAGE_FSTYPES', 'intel-pfr', '-DINTEL_PF EXTRA_OECMAKE += "${@bb.utils.contains('EXTRA_IMAGE_FEATURES', 'validation-unsecure', '-DBMC_VALIDATION_UNSECURE_FEATURE=ON', '', d)}" EXTRA_OECMAKE += "-DUSING_ENTITY_MANAGER_DECORATORS=OFF" SRC_URI = "git://github.com/openbmc/intel-ipmi-oem.git" -SRCREV = "b910987a7d832e38e9342f0946aeb555a48f9cb0" +SRCREV = "84efff0c639ed24e3b47394e8c38d3aba75b1a41" diff --git a/meta-openbmc-mods/meta-common/recipes-core/libpeci/libpeci_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/libpeci/libpeci_%.bbappend index 55cfcc00c..b99d3948b 100644 --- a/meta-openbmc-mods/meta-common/recipes-core/libpeci/libpeci_%.bbappend +++ b/meta-openbmc-mods/meta-common/recipes-core/libpeci/libpeci_%.bbappend @@ -1,3 +1,3 @@ # Enable downstream autobump SRC_URI = "git://github.com/openbmc/libpeci" -SRCREV = "bc641112abc99b4a972665aa984023a6713a21ac" +SRCREV = "adf056af63af67dff75065be810ba286bcea6e3a" |