From 5d3013f04f92546951897e87f995f418e6d96ffd Mon Sep 17 00:00:00 2001 From: P Dheeraj Srujan Kumar Date: Sun, 11 Dec 2022 17:22:53 +0530 Subject: [PATCH 1/2] Update to internal 1-0.92-41 Signed-off-by: P Dheeraj Srujan Kumar --- .../recipes-core/dropbear/dropbear_%.bbappend | 1 + .../dropbear/files/CVE-2021-36369.patch | 235 ++++++++++++ ...configure-Pass-LDFLAGS-to-link-tests.patch | 80 ++++ .../zlib/zlib/CVE-2018-25032.patch | 343 ------------------ .../zlib/zlib/CVE-2022-37434_1.patch | 32 -- .../zlib/zlib/CVE-2022-37434_2.patch | 29 -- .../recipes-core/zlib/zlib/run-ptest | 7 + .../recipes-core/zlib/zlib_%.bbappend | 7 - .../recipes-core/zlib/zlib_1.2.13.bb | 47 +++ ...-prototypes-to-function-declarations.patch | 173 +++++++++ ...antic-errors-at-the-end-of-configure.patch | 68 ++++ .../rsync/files/determism.patch | 34 ++ .../rsync/files/makefile-no-rebuild.patch | 80 ++++ .../recipes-devtools/rsync/files/rsyncd.conf | 15 + .../recipes-devtools/rsync/rsync_3.2.5.bb | 72 ++++ .../linux/linux-aspeed/CVE-2022-20158-1.patch | 55 +++ .../linux/linux-aspeed/CVE-2022-2663-1.patch | 76 ++++ .../linux/linux-aspeed/CVE-2022-2663-2.patch | 35 ++ .../linux/linux-aspeed_%.bbappend | 3 + 19 files changed, 981 insertions(+), 411 deletions(-) create mode 100644 meta-openbmc-mods/meta-common/recipes-core/dropbear/files/CVE-2021-36369.patch create mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/0001-configure-Pass-LDFLAGS-to-link-tests.patch delete mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2018-25032.patch delete mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_1.patch delete mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_2.patch create mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/run-ptest delete mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_%.bbappend create mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_1.2.13.bb create mode 100644 meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch create mode 100644 meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch create mode 100644 meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/determism.patch create mode 100644 meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/makefile-no-rebuild.patch create mode 100644 meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/rsyncd.conf create mode 100644 meta-openbmc-mods/meta-common/recipes-devtools/rsync/rsync_3.2.5.bb create mode 100644 meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20158-1.patch create mode 100644 meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-1.patch create mode 100644 meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-2.patch diff --git a/meta-openbmc-mods/meta-common/recipes-core/dropbear/dropbear_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/dropbear/dropbear_%.bbappend index 029defb671..ed8f0718cc 100644 --- a/meta-openbmc-mods/meta-common/recipes-core/dropbear/dropbear_%.bbappend +++ b/meta-openbmc-mods/meta-common/recipes-core/dropbear/dropbear_%.bbappend @@ -2,6 +2,7 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/files:" SRC_URI += "file://enable-ssh.sh \ file://0001-Enable-UART-mux-setting-before-SOL-activation-via-SS.patch \ + file://CVE-2021-36369.patch \ " do_install:append() { diff --git a/meta-openbmc-mods/meta-common/recipes-core/dropbear/files/CVE-2021-36369.patch b/meta-openbmc-mods/meta-common/recipes-core/dropbear/files/CVE-2021-36369.patch new file mode 100644 index 0000000000..f641374f0a --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-core/dropbear/files/CVE-2021-36369.patch @@ -0,0 +1,235 @@ +From 7c2e8fcd0d162d2ba9fac116f96a5e82ac77f11c Mon Sep 17 00:00:00 2001 +From: Manfred Kaiser +Date: Thu, 17 Jun 2021 11:11:03 +0200 +Subject: [PATCH 1/3] added option to disable trivial auth methods + +--- + cli-auth.c | 3 +++ + cli-authinteract.c | 1 + + cli-authpasswd.c | 2 +- + cli-authpubkey.c | 1 + + cli-runopts.c | 7 +++++++ + cli-session.c | 1 + + runopts.h | 1 + + session.h | 1 + + 8 files changed, 16 insertions(+), 1 deletion(-) + +diff --git a/cli-auth.c b/cli-auth.c +index 5fcacc3a7..20cb34857 100644 +--- a/cli-auth.c ++++ b/cli-auth.c +@@ -261,6 +261,9 @@ void recv_msg_userauth_success() { + if DROPBEAR_CLI_IMMEDIATE_AUTH is set */ + + TRACE(("received msg_userauth_success")) ++ if (cli_opts.exit_on_trivial_auth && cli_ses.is_trivial_auth) { ++ dropbear_exit("trivial authentication not allowed"); ++ } + /* Note: in delayed-zlib mode, setting authdone here + * will enable compression in the transport layer */ + ses.authstate.authdone = 1; +diff --git a/cli-authinteract.c b/cli-authinteract.c +index e1cc9a161..f7128ee59 100644 +--- a/cli-authinteract.c ++++ b/cli-authinteract.c +@@ -114,6 +114,7 @@ void recv_msg_userauth_info_request() { + m_free(instruction); + + for (i = 0; i < num_prompts; i++) { ++ cli_ses.is_trivial_auth = 0; + unsigned int response_len = 0; + prompt = buf_getstring(ses.payload, NULL); + cleantext(prompt); +diff --git a/cli-authpasswd.c b/cli-authpasswd.c +index 00fdd8bc4..a24d43efa 100644 +--- a/cli-authpasswd.c ++++ b/cli-authpasswd.c +@@ -155,7 +155,7 @@ void cli_auth_password() { + + encrypt_packet(); + m_burn(password, strlen(password)); +- ++ cli_ses.is_trivial_auth = 0; + TRACE(("leave cli_auth_password")) + } + #endif /* DROPBEAR_CLI_PASSWORD_AUTH */ +diff --git a/cli-authpubkey.c b/cli-authpubkey.c +index 28c54fa9b..bdb855880 100644 +--- a/cli-authpubkey.c ++++ b/cli-authpubkey.c +@@ -266,6 +266,7 @@ int cli_auth_pubkey() { + /* Send a trial request */ + send_msg_userauth_pubkey(key, sigtype, 0); + cli_ses.lastprivkey = key; ++ cli_ses.is_trivial_auth = 0; + TRACE(("leave cli_auth_pubkey-success")) + return 1; + } else { +diff --git a/cli-runopts.c b/cli-runopts.c +index 3654b9a32..da3ad3d3e 100644 +--- a/cli-runopts.c ++++ b/cli-runopts.c +@@ -152,6 +152,7 @@ void cli_getopts(int argc, char ** argv) { + #if DROPBEAR_CLI_ANYTCPFWD + cli_opts.exit_on_fwd_failure = 0; + #endif ++ cli_opts.exit_on_trivial_auth = 0; + #if DROPBEAR_CLI_LOCALTCPFWD + cli_opts.localfwds = list_new(); + opts.listen_fwd_all = 0; +@@ -889,6 +890,7 @@ static void add_extendedopt(const char* origstr) { + #if DROPBEAR_CLI_ANYTCPFWD + "\tExitOnForwardFailure\n" + #endif ++ "\tExitOnTrivialAuth\n" + #ifndef DISABLE_SYSLOG + "\tUseSyslog\n" + #endif +@@ -916,5 +918,10 @@ static void add_extendedopt(const char* origstr) { + return; + } + ++ if (match_extendedopt(&optstr, "ExitOnTrivialAuth") == DROPBEAR_SUCCESS) { ++ cli_opts.exit_on_trivial_auth = parse_flag_value(optstr); ++ return; ++ } ++ + dropbear_log(LOG_WARNING, "Ignoring unknown configuration option '%s'", origstr); + } +diff --git a/cli-session.c b/cli-session.c +index 699286db1..eee760e74 100644 +--- a/cli-session.c ++++ b/cli-session.c +@@ -165,6 +165,7 @@ static void cli_session_init(pid_t proxy_cmd_pid) { + /* Auth */ + cli_ses.lastprivkey = NULL; + cli_ses.lastauthtype = 0; ++ cli_ses.is_trivial_auth = 1; + + /* For printing "remote host closed" for the user */ + ses.remoteclosed = cli_remoteclosed; +diff --git a/runopts.h b/runopts.h +index 6a4a94ccd..c626b0e7a 100644 +--- a/runopts.h ++++ b/runopts.h +@@ -159,6 +159,7 @@ typedef struct cli_runopts { + #if DROPBEAR_CLI_ANYTCPFWD + int exit_on_fwd_failure; + #endif ++ int exit_on_trivial_auth; + #if DROPBEAR_CLI_REMOTETCPFWD + m_list * remotefwds; + #endif +diff --git a/session.h b/session.h +index fb5b8cbb6..6706592a8 100644 +--- a/session.h ++++ b/session.h +@@ -316,6 +316,7 @@ struct clientsession { + + int lastauthtype; /* either AUTH_TYPE_PUBKEY or AUTH_TYPE_PASSWORD, + for the last type of auth we tried */ ++ int is_trivial_auth; + int ignore_next_auth_response; + #if DROPBEAR_CLI_INTERACT_AUTH + int auth_interact_failed; /* flag whether interactive auth can still + +From adbdb213eb0fe3e982cc57d7ae882c1915bef818 Mon Sep 17 00:00:00 2001 +From: Manfred Kaiser +Date: Fri, 18 Jun 2021 07:48:47 +0200 +Subject: [PATCH 2/3] rename argument to match with other ssh clients + +--- + cli-auth.c | 2 +- + cli-runopts.c | 8 ++++---- + runopts.h | 2 +- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/cli-auth.c b/cli-auth.c +index 20cb34857..517923052 100644 +--- a/cli-auth.c ++++ b/cli-auth.c +@@ -261,7 +261,7 @@ void recv_msg_userauth_success() { + if DROPBEAR_CLI_IMMEDIATE_AUTH is set */ + + TRACE(("received msg_userauth_success")) +- if (cli_opts.exit_on_trivial_auth && cli_ses.is_trivial_auth) { ++ if (cli_opts.disable_trivial_auth && cli_ses.is_trivial_auth) { + dropbear_exit("trivial authentication not allowed"); + } + /* Note: in delayed-zlib mode, setting authdone here +diff --git a/cli-runopts.c b/cli-runopts.c +index da3ad3d3e..255b47e8a 100644 +--- a/cli-runopts.c ++++ b/cli-runopts.c +@@ -152,7 +152,7 @@ void cli_getopts(int argc, char ** argv) { + #if DROPBEAR_CLI_ANYTCPFWD + cli_opts.exit_on_fwd_failure = 0; + #endif +- cli_opts.exit_on_trivial_auth = 0; ++ cli_opts.disable_trivial_auth = 0; + #if DROPBEAR_CLI_LOCALTCPFWD + cli_opts.localfwds = list_new(); + opts.listen_fwd_all = 0; +@@ -890,7 +890,7 @@ static void add_extendedopt(const char* origstr) { + #if DROPBEAR_CLI_ANYTCPFWD + "\tExitOnForwardFailure\n" + #endif +- "\tExitOnTrivialAuth\n" ++ "\tDisableTrivialAuth\n" + #ifndef DISABLE_SYSLOG + "\tUseSyslog\n" + #endif +@@ -918,8 +918,8 @@ static void add_extendedopt(const char* origstr) { + return; + } + +- if (match_extendedopt(&optstr, "ExitOnTrivialAuth") == DROPBEAR_SUCCESS) { +- cli_opts.exit_on_trivial_auth = parse_flag_value(optstr); ++ if (match_extendedopt(&optstr, "DisableTrivialAuth") == DROPBEAR_SUCCESS) { ++ cli_opts.disable_trivial_auth = parse_flag_value(optstr); + return; + } + +diff --git a/runopts.h b/runopts.h +index c626b0e7a..01201d2dc 100644 +--- a/runopts.h ++++ b/runopts.h +@@ -159,7 +159,7 @@ typedef struct cli_runopts { + #if DROPBEAR_CLI_ANYTCPFWD + int exit_on_fwd_failure; + #endif +- int exit_on_trivial_auth; ++ int disable_trivial_auth; + #if DROPBEAR_CLI_REMOTETCPFWD + m_list * remotefwds; + #endif + +From 318109125e747f0bc256a6d94d5756030ea2f5a0 Mon Sep 17 00:00:00 2001 +From: Manfred Kaiser +Date: Thu, 1 Jul 2021 18:50:18 +0200 +Subject: [PATCH 3/3] fixed trivial auth detection for pubkeys + +--- + cli-authpubkey.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/cli-authpubkey.c b/cli-authpubkey.c +index bdb855880..c0da77f1e 100644 +--- a/cli-authpubkey.c ++++ b/cli-authpubkey.c +@@ -176,6 +176,7 @@ static void send_msg_userauth_pubkey(sign_key *key, enum signature_type sigtype, + buf_putbytes(sigbuf, ses.writepayload->data, ses.writepayload->len); + cli_buf_put_sign(ses.writepayload, key, sigtype, sigbuf); + buf_free(sigbuf); /* Nothing confidential in the buffer */ ++ cli_ses.is_trivial_auth = 0; + } + + encrypt_packet(); +@@ -266,7 +267,6 @@ int cli_auth_pubkey() { + /* Send a trial request */ + send_msg_userauth_pubkey(key, sigtype, 0); + cli_ses.lastprivkey = key; +- cli_ses.is_trivial_auth = 0; + TRACE(("leave cli_auth_pubkey-success")) + return 1; + } else { diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/0001-configure-Pass-LDFLAGS-to-link-tests.patch b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/0001-configure-Pass-LDFLAGS-to-link-tests.patch new file mode 100644 index 0000000000..e6cc915ba5 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/0001-configure-Pass-LDFLAGS-to-link-tests.patch @@ -0,0 +1,80 @@ +Upstream-Status: Submitted [https://github.com/madler/zlib/pull/599] +Signed-off-by: Ross Burton + +From f15584918a7fbbe3cc794ad59100e5e8153ea9f6 Mon Sep 17 00:00:00 2001 +From: Khem Raj +Date: Tue, 8 Mar 2022 22:38:47 -0800 +Subject: [PATCH] configure: Pass LDFLAGS to link tests + +LDFLAGS can contain critical flags without which linking wont succeed +therefore ensure that all configure tests involving link time checks are +using LDFLAGS on compiler commandline along with CFLAGS to ensure the +tests perform correctly. Without this some tests may fail resulting in +wrong confgure result, ending in miscompiling the package + +Signed-off-by: Khem Raj +--- + configure | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/configure b/configure +index 52ff4a0..d04ee59 100755 +--- a/configure ++++ b/configure +@@ -427,7 +427,7 @@ if test $shared -eq 1; then + echo Checking for shared library support... | tee -a configure.log + # we must test in two steps (cc then ld), required at least on SunOS 4.x + if try $CC -w -c $SFLAGS $test.c && +- try $LDSHARED $SFLAGS -o $test$shared_ext $test.o; then ++ try $LDSHARED $SFLAGS $LDFLAGS -o $test$shared_ext $test.o; then + echo Building shared library $SHAREDLIBV with $CC. | tee -a configure.log + elif test -z "$old_cc" -a -z "$old_cflags"; then + echo No shared library support. | tee -a configure.log +@@ -503,7 +503,7 @@ int main(void) { + } + EOF + fi +- if try $CC $CFLAGS -o $test $test.c; then ++ if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then + sizet=`./$test` + echo "Checking for a pointer-size integer type..." $sizet"." | tee -a configure.log + CFLAGS="${CFLAGS} -DNO_SIZE_T=${sizet}" +@@ -537,7 +537,7 @@ int main(void) { + return 0; + } + EOF +- if try $CC $CFLAGS -o $test $test.c; then ++ if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then + echo "Checking for fseeko... Yes." | tee -a configure.log + else + CFLAGS="${CFLAGS} -DNO_FSEEKO" +@@ -554,7 +554,7 @@ cat > $test.c < + int main() { return strlen(strerror(errno)); } + EOF +-if try $CC $CFLAGS -o $test $test.c; then ++if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then + echo "Checking for strerror... Yes." | tee -a configure.log + else + CFLAGS="${CFLAGS} -DNO_STRERROR" +@@ -661,7 +661,7 @@ int main() + return (mytest("Hello%d\n", 1)); + } + EOF +- if try $CC $CFLAGS -o $test $test.c; then ++ if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then + echo "Checking for vsnprintf() in stdio.h... Yes." | tee -a configure.log + + echo >> configure.log +@@ -751,7 +751,7 @@ int main() + } + EOF + +- if try $CC $CFLAGS -o $test $test.c; then ++ if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then + echo "Checking for snprintf() in stdio.h... Yes." | tee -a configure.log + + echo >> configure.log +-- +2.25.1 + diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2018-25032.patch b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2018-25032.patch deleted file mode 100644 index 9f37ba5c58..0000000000 --- a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2018-25032.patch +++ /dev/null @@ -1,343 +0,0 @@ -From 5c44459c3b28a9bd3283aaceab7c615f8020c531 Mon Sep 17 00:00:00 2001 -From: Mark Adler -Date: Tue, 17 Apr 2018 22:09:22 -0700 -Subject: [PATCH] Fix a bug that can crash deflate on some input when using - Z_FIXED. - -This bug was reported by Danilo Ramos of Eideticom, Inc. It has -lain in wait 13 years before being found! The bug was introduced -in zlib 1.2.2.2, with the addition of the Z_FIXED option. That -option forces the use of fixed Huffman codes. For rare inputs with -a large number of distant matches, the pending buffer into which -the compressed data is written can overwrite the distance symbol -table which it overlays. That results in corrupted output due to -invalid distances, and can result in out-of-bound accesses, -crashing the application. - -The fix here combines the distance buffer and literal/length -buffers into a single symbol buffer. Now three bytes of pending -buffer space are opened up for each literal or length/distance -pair consumed, instead of the previous two bytes. This assures -that the pending buffer cannot overwrite the symbol table, since -the maximum fixed code compressed length/distance is 31 bits, and -since there are four bytes of pending space for every three bytes -of symbol space. ---- - deflate.c | 74 ++++++++++++++++++++++++++++++++++++++++--------------- - deflate.h | 25 +++++++++---------- - trees.c | 50 +++++++++++-------------------------- - 3 files changed, 79 insertions(+), 70 deletions(-) - -diff --git a/deflate.c b/deflate.c -index 425babc00..19cba873a 100644 ---- a/deflate.c -+++ b/deflate.c -@@ -255,11 +255,6 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, - int wrap = 1; - static const char my_version[] = ZLIB_VERSION; - -- ushf *overlay; -- /* We overlay pending_buf and d_buf+l_buf. This works since the average -- * output size for (length,distance) codes is <= 24 bits. -- */ -- - if (version == Z_NULL || version[0] != my_version[0] || - stream_size != sizeof(z_stream)) { - return Z_VERSION_ERROR; -@@ -329,9 +324,47 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, - - s->lit_bufsize = 1 << (memLevel + 6); /* 16K elements by default */ - -- overlay = (ushf *) ZALLOC(strm, s->lit_bufsize, sizeof(ush)+2); -- s->pending_buf = (uchf *) overlay; -- s->pending_buf_size = (ulg)s->lit_bufsize * (sizeof(ush)+2L); -+ /* We overlay pending_buf and sym_buf. This works since the average size -+ * for length/distance pairs over any compressed block is assured to be 31 -+ * bits or less. -+ * -+ * Analysis: The longest fixed codes are a length code of 8 bits plus 5 -+ * extra bits, for lengths 131 to 257. The longest fixed distance codes are -+ * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest -+ * possible fixed-codes length/distance pair is then 31 bits total. -+ * -+ * sym_buf starts one-fourth of the way into pending_buf. So there are -+ * three bytes in sym_buf for every four bytes in pending_buf. Each symbol -+ * in sym_buf is three bytes -- two for the distance and one for the -+ * literal/length. As each symbol is consumed, the pointer to the next -+ * sym_buf value to read moves forward three bytes. From that symbol, up to -+ * 31 bits are written to pending_buf. The closest the written pending_buf -+ * bits gets to the next sym_buf symbol to read is just before the last -+ * code is written. At that time, 31*(n-2) bits have been written, just -+ * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at -+ * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1 -+ * symbols are written.) The closest the writing gets to what is unread is -+ * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and -+ * can range from 128 to 32768. -+ * -+ * Therefore, at a minimum, there are 142 bits of space between what is -+ * written and what is read in the overlain buffers, so the symbols cannot -+ * be overwritten by the compressed data. That space is actually 139 bits, -+ * due to the three-bit fixed-code block header. -+ * -+ * That covers the case where either Z_FIXED is specified, forcing fixed -+ * codes, or when the use of fixed codes is chosen, because that choice -+ * results in a smaller compressed block than dynamic codes. That latter -+ * condition then assures that the above analysis also covers all dynamic -+ * blocks. A dynamic-code block will only be chosen to be emitted if it has -+ * fewer bits than a fixed-code block would for the same set of symbols. -+ * Therefore its average symbol length is assured to be less than 31. So -+ * the compressed data for a dynamic block also cannot overwrite the -+ * symbols from which it is being constructed. -+ */ -+ -+ s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4); -+ s->pending_buf_size = (ulg)s->lit_bufsize * 4; - - if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL || - s->pending_buf == Z_NULL) { -@@ -340,8 +373,12 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, - deflateEnd (strm); - return Z_MEM_ERROR; - } -- s->d_buf = overlay + s->lit_bufsize/sizeof(ush); -- s->l_buf = s->pending_buf + (1+sizeof(ush))*s->lit_bufsize; -+ s->sym_buf = s->pending_buf + s->lit_bufsize; -+ s->sym_end = (s->lit_bufsize - 1) * 3; -+ /* We avoid equality with lit_bufsize*3 because of wraparound at 64K -+ * on 16 bit machines and because stored blocks are restricted to -+ * 64K-1 bytes. -+ */ - - s->level = level; - s->strategy = strategy; -@@ -552,7 +589,7 @@ int ZEXPORT deflatePrime (strm, bits, value) - - if (deflateStateCheck(strm)) return Z_STREAM_ERROR; - s = strm->state; -- if ((Bytef *)(s->d_buf) < s->pending_out + ((Buf_size + 7) >> 3)) -+ if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3)) - return Z_BUF_ERROR; - do { - put = Buf_size - s->bi_valid; -@@ -1113,7 +1150,6 @@ int ZEXPORT deflateCopy (dest, source) - #else - deflate_state *ds; - deflate_state *ss; -- ushf *overlay; - - - if (deflateStateCheck(source) || dest == Z_NULL) { -@@ -1133,8 +1169,7 @@ int ZEXPORT deflateCopy (dest, source) - ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte)); - ds->prev = (Posf *) ZALLOC(dest, ds->w_size, sizeof(Pos)); - ds->head = (Posf *) ZALLOC(dest, ds->hash_size, sizeof(Pos)); -- overlay = (ushf *) ZALLOC(dest, ds->lit_bufsize, sizeof(ush)+2); -- ds->pending_buf = (uchf *) overlay; -+ ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4); - - if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL || - ds->pending_buf == Z_NULL) { -@@ -1148,8 +1183,7 @@ int ZEXPORT deflateCopy (dest, source) - zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size); - - ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf); -- ds->d_buf = overlay + ds->lit_bufsize/sizeof(ush); -- ds->l_buf = ds->pending_buf + (1+sizeof(ush))*ds->lit_bufsize; -+ ds->sym_buf = ds->pending_buf + ds->lit_bufsize; - - ds->l_desc.dyn_tree = ds->dyn_ltree; - ds->d_desc.dyn_tree = ds->dyn_dtree; -@@ -1925,7 +1959,7 @@ local block_state deflate_fast(s, flush) - FLUSH_BLOCK(s, 1); - return finish_done; - } -- if (s->last_lit) -+ if (s->sym_next) - FLUSH_BLOCK(s, 0); - return block_done; - } -@@ -2056,7 +2090,7 @@ local block_state deflate_slow(s, flush) - FLUSH_BLOCK(s, 1); - return finish_done; - } -- if (s->last_lit) -+ if (s->sym_next) - FLUSH_BLOCK(s, 0); - return block_done; - } -@@ -2131,7 +2165,7 @@ local block_state deflate_rle(s, flush) - FLUSH_BLOCK(s, 1); - return finish_done; - } -- if (s->last_lit) -+ if (s->sym_next) - FLUSH_BLOCK(s, 0); - return block_done; - } -@@ -2170,7 +2204,7 @@ local block_state deflate_huff(s, flush) - FLUSH_BLOCK(s, 1); - return finish_done; - } -- if (s->last_lit) -+ if (s->sym_next) - FLUSH_BLOCK(s, 0); - return block_done; - } -diff --git a/deflate.h b/deflate.h -index 23ecdd312..d4cf1a98b 100644 ---- a/deflate.h -+++ b/deflate.h -@@ -217,7 +217,7 @@ typedef struct internal_state { - /* Depth of each subtree used as tie breaker for trees of equal frequency - */ - -- uchf *l_buf; /* buffer for literals or lengths */ -+ uchf *sym_buf; /* buffer for distances and literals/lengths */ - - uInt lit_bufsize; - /* Size of match buffer for literals/lengths. There are 4 reasons for -@@ -239,13 +239,8 @@ typedef struct internal_state { - * - I can't count above 4 - */ - -- uInt last_lit; /* running index in l_buf */ -- -- ushf *d_buf; -- /* Buffer for distances. To simplify the code, d_buf and l_buf have -- * the same number of elements. To use different lengths, an extra flag -- * array would be necessary. -- */ -+ uInt sym_next; /* running index in sym_buf */ -+ uInt sym_end; /* symbol table full when sym_next reaches this */ - - ulg opt_len; /* bit length of current block with optimal trees */ - ulg static_len; /* bit length of current block with static trees */ -@@ -325,20 +320,22 @@ void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf, - - # define _tr_tally_lit(s, c, flush) \ - { uch cc = (c); \ -- s->d_buf[s->last_lit] = 0; \ -- s->l_buf[s->last_lit++] = cc; \ -+ s->sym_buf[s->sym_next++] = 0; \ -+ s->sym_buf[s->sym_next++] = 0; \ -+ s->sym_buf[s->sym_next++] = cc; \ - s->dyn_ltree[cc].Freq++; \ -- flush = (s->last_lit == s->lit_bufsize-1); \ -+ flush = (s->sym_next == s->sym_end); \ - } - # define _tr_tally_dist(s, distance, length, flush) \ - { uch len = (uch)(length); \ - ush dist = (ush)(distance); \ -- s->d_buf[s->last_lit] = dist; \ -- s->l_buf[s->last_lit++] = len; \ -+ s->sym_buf[s->sym_next++] = dist; \ -+ s->sym_buf[s->sym_next++] = dist >> 8; \ -+ s->sym_buf[s->sym_next++] = len; \ - dist--; \ - s->dyn_ltree[_length_code[len]+LITERALS+1].Freq++; \ - s->dyn_dtree[d_code(dist)].Freq++; \ -- flush = (s->last_lit == s->lit_bufsize-1); \ -+ flush = (s->sym_next == s->sym_end); \ - } - #else - # define _tr_tally_lit(s, c, flush) flush = _tr_tally(s, 0, c) -diff --git a/trees.c b/trees.c -index 4f4a65011..decaeb7c3 100644 ---- a/trees.c -+++ b/trees.c -@@ -416,7 +416,7 @@ local void init_block(s) - - s->dyn_ltree[END_BLOCK].Freq = 1; - s->opt_len = s->static_len = 0L; -- s->last_lit = s->matches = 0; -+ s->sym_next = s->matches = 0; - } - - #define SMALLEST 1 -@@ -948,7 +948,7 @@ void ZLIB_INTERNAL _tr_flush_block(s, buf, stored_len, last) - - Tracev((stderr, "\nopt %lu(%lu) stat %lu(%lu) stored %lu lit %u ", - opt_lenb, s->opt_len, static_lenb, s->static_len, stored_len, -- s->last_lit)); -+ s->sym_next / 3)); - - if (static_lenb <= opt_lenb) opt_lenb = static_lenb; - -@@ -1017,8 +1017,9 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc) - unsigned dist; /* distance of matched string */ - unsigned lc; /* match length-MIN_MATCH or unmatched char (if dist==0) */ - { -- s->d_buf[s->last_lit] = (ush)dist; -- s->l_buf[s->last_lit++] = (uch)lc; -+ s->sym_buf[s->sym_next++] = dist; -+ s->sym_buf[s->sym_next++] = dist >> 8; -+ s->sym_buf[s->sym_next++] = lc; - if (dist == 0) { - /* lc is the unmatched char */ - s->dyn_ltree[lc].Freq++; -@@ -1033,30 +1034,7 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc) - s->dyn_ltree[_length_code[lc]+LITERALS+1].Freq++; - s->dyn_dtree[d_code(dist)].Freq++; - } -- --#ifdef TRUNCATE_BLOCK -- /* Try to guess if it is profitable to stop the current block here */ -- if ((s->last_lit & 0x1fff) == 0 && s->level > 2) { -- /* Compute an upper bound for the compressed length */ -- ulg out_length = (ulg)s->last_lit*8L; -- ulg in_length = (ulg)((long)s->strstart - s->block_start); -- int dcode; -- for (dcode = 0; dcode < D_CODES; dcode++) { -- out_length += (ulg)s->dyn_dtree[dcode].Freq * -- (5L+extra_dbits[dcode]); -- } -- out_length >>= 3; -- Tracev((stderr,"\nlast_lit %u, in %ld, out ~%ld(%ld%%) ", -- s->last_lit, in_length, out_length, -- 100L - out_length*100L/in_length)); -- if (s->matches < s->last_lit/2 && out_length < in_length/2) return 1; -- } --#endif -- return (s->last_lit == s->lit_bufsize-1); -- /* We avoid equality with lit_bufsize because of wraparound at 64K -- * on 16 bit machines and because stored blocks are restricted to -- * 64K-1 bytes. -- */ -+ return (s->sym_next == s->sym_end); - } - - /* =========================================================================== -@@ -1069,13 +1047,14 @@ local void compress_block(s, ltree, dtree) - { - unsigned dist; /* distance of matched string */ - int lc; /* match length or unmatched char (if dist == 0) */ -- unsigned lx = 0; /* running index in l_buf */ -+ unsigned sx = 0; /* running index in sym_buf */ - unsigned code; /* the code to send */ - int extra; /* number of extra bits to send */ - -- if (s->last_lit != 0) do { -- dist = s->d_buf[lx]; -- lc = s->l_buf[lx++]; -+ if (s->sym_next != 0) do { -+ dist = s->sym_buf[sx++] & 0xff; -+ dist += (unsigned)(s->sym_buf[sx++] & 0xff) << 8; -+ lc = s->sym_buf[sx++]; - if (dist == 0) { - send_code(s, lc, ltree); /* send a literal byte */ - Tracecv(isgraph(lc), (stderr," '%c' ", lc)); -@@ -1100,11 +1079,10 @@ local void compress_block(s, ltree, dtree) - } - } /* literal or match pair ? */ - -- /* Check that the overlay between pending_buf and d_buf+l_buf is ok: */ -- Assert((uInt)(s->pending) < s->lit_bufsize + 2*lx, -- "pendingBuf overflow"); -+ /* Check that the overlay between pending_buf and sym_buf is ok: */ -+ Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow"); - -- } while (lx < s->last_lit); -+ } while (sx < s->sym_next); - - send_code(s, END_BLOCK, ltree); - } diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_1.patch b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_1.patch deleted file mode 100644 index dc84d3a1d3..0000000000 --- a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_1.patch +++ /dev/null @@ -1,32 +0,0 @@ -From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001 -From: Mark Adler -Date: Sat, 30 Jul 2022 15:51:11 -0700 -Subject: [PATCH] Fix a bug when getting a gzip header extra field with - inflate(). - -If the extra field was larger than the space the user provided with -inflateGetHeader(), and if multiple calls of inflate() delivered -the extra header data, then there could be a buffer overflow of the -provided space. This commit assures that provided space is not -exceeded. ---- - inflate.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/inflate.c b/inflate.c -index 7be8c6366..7a7289749 100644 ---- a/inflate.c -+++ b/inflate.c -@@ -763,9 +763,10 @@ int flush; - copy = state->length; - if (copy > have) copy = have; - if (copy) { -+ len = state->head->extra_len - state->length; - if (state->head != Z_NULL && -- state->head->extra != Z_NULL) { -- len = state->head->extra_len - state->length; -+ state->head->extra != Z_NULL && -+ len < state->head->extra_max) { - zmemcpy(state->head->extra + len, next, - len + copy > state->head->extra_max ? - state->head->extra_max - len : copy); diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_2.patch b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_2.patch deleted file mode 100644 index c5c95a92b2..0000000000 --- a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_2.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d Mon Sep 17 00:00:00 2001 -From: Mark Adler -Date: Mon, 8 Aug 2022 10:50:09 -0700 -Subject: [PATCH] Fix extra field processing bug that dereferences NULL - state->head. - -The recent commit to fix a gzip header extra field processing bug -introduced the new bug fixed here. ---- - inflate.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/inflate.c b/inflate.c -index 7a7289749..2a3c4fe98 100644 ---- a/inflate.c -+++ b/inflate.c -@@ -763,10 +763,10 @@ int flush; - copy = state->length; - if (copy > have) copy = have; - if (copy) { -- len = state->head->extra_len - state->length; - if (state->head != Z_NULL && - state->head->extra != Z_NULL && -- len < state->head->extra_max) { -+ (len = state->head->extra_len - state->length) < -+ state->head->extra_max) { - zmemcpy(state->head->extra + len, next, - len + copy > state->head->extra_max ? - state->head->extra_max - len : copy); diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/run-ptest b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/run-ptest new file mode 100644 index 0000000000..065863ef75 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/run-ptest @@ -0,0 +1,7 @@ +#!/bin/sh + +if ./examplesh ; then + echo "PASS: zlib" +else + echo "FAIL: zlib" +fi diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_%.bbappend deleted file mode 100644 index 482197c4f3..0000000000 --- a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_%.bbappend +++ /dev/null @@ -1,7 +0,0 @@ -FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:" - -SRC_URI += " \ - file://CVE-2018-25032.patch \ - file://CVE-2022-37434_1.patch \ - file://CVE-2022-37434_2.patch \ - " diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_1.2.13.bb b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_1.2.13.bb new file mode 100644 index 0000000000..ec977a3035 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_1.2.13.bb @@ -0,0 +1,47 @@ +SUMMARY = "Zlib Compression Library" +DESCRIPTION = "Zlib is a general-purpose, patent-free, lossless data compression \ +library which is used by many different programs." +HOMEPAGE = "http://zlib.net/" +SECTION = "libs" +LICENSE = "Zlib" +LIC_FILES_CHKSUM = "file://zlib.h;beginline=6;endline=23;md5=5377232268e952e9ef63bc555f7aa6c0" + +# The source tarball needs to be .gz as only the .gz ends up in fossils/ +SRC_URI = "https://zlib.net/${BP}.tar.gz \ + file://0001-configure-Pass-LDFLAGS-to-link-tests.patch \ + file://run-ptest \ + " +UPSTREAM_CHECK_URI = "http://zlib.net/" + +SRC_URI[sha256sum] = "b3a24de97a8fdbc835b9833169501030b8977031bcb54b3b3ac13740f846ab30" + +# When a new release is made the previous release is moved to fossils/, so add this +# to PREMIRRORS so it is also searched automatically. +PREMIRRORS:append = " https://zlib.net/ https://zlib.net/fossils/" + +CFLAGS += "-D_REENTRANT" + +RDEPENDS:${PN}-ptest += "make" + +inherit ptest + +B = "${WORKDIR}/build" + +do_configure() { + LDCONFIG=true ${S}/configure --prefix=${prefix} --shared --libdir=${libdir} --uname=GNU +} +do_configure[cleandirs] += "${B}" + +do_compile() { + oe_runmake shared +} + +do_install() { + oe_runmake DESTDIR=${D} install +} + +do_install_ptest() { + install ${B}/examplesh ${D}${PTEST_PATH} +} + +BBCLASSEXTEND = "native nativesdk" diff --git a/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch new file mode 100644 index 0000000000..474d82db22 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch @@ -0,0 +1,173 @@ +From 785c0072c80c2f6e0839478453cf65fdeac15da0 Mon Sep 17 00:00:00 2001 +From: Khem Raj +Date: Mon, 29 Aug 2022 19:53:28 -0700 +Subject: [PATCH] Add missing prototypes to function declarations + +With Clang 15+ compiler -Wstrict-prototypes is triggering warnings which +are turned into errors with -Werror, this fixes the problem by adding +missing prototypes + +Fixes errors like +| log.c:134:24: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes] +| static void syslog_init() +| ^ +| void + +Upstream-Status: Submitted [https://lists.samba.org/archive/rsync/2022-August/032858.html] +Signed-off-by: Khem Raj +--- + checksum.c | 2 +- + exclude.c | 2 +- + hlink.c | 3 +-- + lib/pool_alloc.c | 2 +- + log.c | 2 +- + main.c | 2 +- + syscall.c | 4 ++-- + zlib/crc32.c | 2 +- + zlib/trees.c | 2 +- + zlib/zutil.c | 4 ++-- + 10 files changed, 12 insertions(+), 13 deletions(-) + +diff --git a/checksum.c b/checksum.c +index fb8c0a0..174c28c 100644 +--- a/checksum.c ++++ b/checksum.c +@@ -629,7 +629,7 @@ int sum_end(char *sum) + return csum_len_for_type(cursum_type, 0); + } + +-void init_checksum_choices() ++void init_checksum_choices(void) + { + #ifdef SUPPORT_XXH3 + char buf[32816]; +diff --git a/exclude.c b/exclude.c +index adc82e2..79f5a82 100644 +--- a/exclude.c ++++ b/exclude.c +@@ -358,7 +358,7 @@ void implied_include_partial_string(const char *s_start, const char *s_end) + memcpy(partial_string_buf, s_start, partial_string_len); + } + +-void free_implied_include_partial_string() ++void free_implied_include_partial_string(void) + { + if (partial_string_buf) { + free(partial_string_buf); +diff --git a/hlink.c b/hlink.c +index 66810a3..6511dfb 100644 +--- a/hlink.c ++++ b/hlink.c +@@ -117,8 +117,7 @@ static void match_gnums(int32 *ndx_list, int ndx_count) + struct ht_int32_node *node = NULL; + int32 gnum, gnum_next; + +- qsort(ndx_list, ndx_count, sizeof ndx_list[0], (int (*)()) hlink_compare_gnum); +- ++ qsort(ndx_list, ndx_count, sizeof ndx_list[0], (int (*)(const void *, const void *)) hlink_compare_gnum); + for (from = 0; from < ndx_count; from++) { + file = hlink_flist->sorted[ndx_list[from]]; + gnum = F_HL_GNUM(file); +diff --git a/lib/pool_alloc.c b/lib/pool_alloc.c +index a1a7245..4eae062 100644 +--- a/lib/pool_alloc.c ++++ b/lib/pool_alloc.c +@@ -9,7 +9,7 @@ struct alloc_pool + size_t size; /* extent size */ + size_t quantum; /* allocation quantum */ + struct pool_extent *extents; /* top extent is "live" */ +- void (*bomb)(); /* called if malloc fails */ ++ void (*bomb)(const char *, const char *, int); /* called if malloc fails */ + int flags; + + /* statistical data */ +diff --git a/log.c b/log.c +index 44344e2..991e359 100644 +--- a/log.c ++++ b/log.c +@@ -131,7 +131,7 @@ static void logit(int priority, const char *buf) + } + } + +-static void syslog_init() ++static void syslog_init(void) + { + int options = LOG_PID; + +diff --git a/main.c b/main.c +index 9ebfbea..affa244 100644 +--- a/main.c ++++ b/main.c +@@ -244,7 +244,7 @@ void read_del_stats(int f) + stats.deleted_files += stats.deleted_specials = read_varint(f); + } + +-static void become_copy_as_user() ++static void become_copy_as_user(void) + { + char *gname; + uid_t uid; +diff --git a/syscall.c b/syscall.c +index d92074a..92ca86d 100644 +--- a/syscall.c ++++ b/syscall.c +@@ -389,9 +389,9 @@ OFF_T do_lseek(int fd, OFF_T offset, int whence) + { + #ifdef HAVE_LSEEK64 + #if !SIZEOF_OFF64_T +- OFF_T lseek64(); ++ OFF_T lseek64(int fd, OFF_T offset, int whence); + #else +- off64_t lseek64(); ++ off64_t lseek64(int fd, off64_t offset, int whence); + #endif + return lseek64(fd, offset, whence); + #else +diff --git a/zlib/crc32.c b/zlib/crc32.c +index 05733f4..50c6c02 100644 +--- a/zlib/crc32.c ++++ b/zlib/crc32.c +@@ -187,7 +187,7 @@ local void write_table(out, table) + /* ========================================================================= + * This function can be used by asm versions of crc32() + */ +-const z_crc_t FAR * ZEXPORT get_crc_table() ++const z_crc_t FAR * ZEXPORT get_crc_table(void) + { + #ifdef DYNAMIC_CRC_TABLE + if (crc_table_empty) +diff --git a/zlib/trees.c b/zlib/trees.c +index 9c66770..0d9047e 100644 +--- a/zlib/trees.c ++++ b/zlib/trees.c +@@ -231,7 +231,7 @@ local void send_bits(s, value, length) + /* =========================================================================== + * Initialize the various 'constant' tables. + */ +-local void tr_static_init() ++local void tr_static_init(void) + { + #if defined(GEN_TREES_H) || !defined(STDC) + static int static_init_done = 0; +diff --git a/zlib/zutil.c b/zlib/zutil.c +index bbba7b2..61f8dc9 100644 +--- a/zlib/zutil.c ++++ b/zlib/zutil.c +@@ -27,12 +27,12 @@ z_const char * const z_errmsg[10] = { + ""}; + + +-const char * ZEXPORT zlibVersion() ++const char * ZEXPORT zlibVersion(void) + { + return ZLIB_VERSION; + } + +-uLong ZEXPORT zlibCompileFlags() ++uLong ZEXPORT zlibCompileFlags(void) + { + uLong flags; + +-- +2.37.2 + diff --git a/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch new file mode 100644 index 0000000000..1d9c4bfe48 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch @@ -0,0 +1,68 @@ +From e64a58387db46239902b610871a0eb81626e99ff Mon Sep 17 00:00:00 2001 +From: Paul Eggert +Date: Thu, 18 Aug 2022 07:46:28 -0700 +Subject: [PATCH] Turn on -pedantic-errors at the end of 'configure' + +Problem reported by Khem Raj in: +https://lists.gnu.org/r/autoconf-patches/2022-08/msg00009.html +Upstream-Status: Submitted [https://lists.samba.org/archive/rsync/2022-August/032862.html] +--- + configure.ac | 35 ++++++++++++++++++++--------------- + 1 file changed, 20 insertions(+), 15 deletions(-) + +diff --git a/configure.ac b/configure.ac +index d185b2d3..7e9514f7 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -1071,21 +1071,6 @@ elif test x"$ac_cv_header_popt_h" != x"yes"; then + with_included_popt=yes + fi + +-if test x"$GCC" = x"yes"; then +- if test x"$with_included_popt" != x"yes"; then +- # Turn pedantic warnings into errors to ensure an array-init overflow is an error. +- CFLAGS="$CFLAGS -pedantic-errors" +- else +- # Our internal popt code cannot be compiled with pedantic warnings as errors, so try to +- # turn off pedantic warnings (which will not lose the error for array-init overflow). +- # Older gcc versions don't understand -Wno-pedantic, so check if --help=warnings lists +- # -Wpedantic and use that as a flag. +- case `$CC --help=warnings 2>/dev/null | grep Wpedantic` in +- *-Wpedantic*) CFLAGS="$CFLAGS -pedantic-errors -Wno-pedantic" ;; +- esac +- fi +-fi +- + AC_MSG_CHECKING([whether to use included libpopt]) + if test x"$with_included_popt" = x"yes"; then + AC_MSG_RESULT($srcdir/popt) +@@ -1444,6 +1429,26 @@ case "$CC" in + ;; + esac + ++# Enable -pedantic-errors last, so that it doesn't mess up other ++# 'configure' tests. For example, Autoconf uses empty function ++# prototypes like 'int main () {}' which Clang 15's -pedantic-errors ++# would reject. Generally it's not a good idea to try to run ++# 'configure' itself with strict compiler checking. ++if test x"$GCC" = x"yes"; then ++ if test x"$with_included_popt" != x"yes"; then ++ # Turn pedantic warnings into errors to ensure an array-init overflow is an error. ++ CFLAGS="$CFLAGS -pedantic-errors" ++ else ++ # Our internal popt code cannot be compiled with pedantic warnings as errors, so try to ++ # turn off pedantic warnings (which will not lose the error for array-init overflow). ++ # Older gcc versions don't understand -Wno-pedantic, so check if --help=warnings lists ++ # -Wpedantic and use that as a flag. ++ case `$CC --help=warnings 2>/dev/null | grep Wpedantic` in ++ *-Wpedantic*) CFLAGS="$CFLAGS -pedantic-errors -Wno-pedantic" ;; ++ esac ++ fi ++fi ++ + AC_CONFIG_FILES([Makefile lib/dummy zlib/dummy popt/dummy shconfig]) + AC_OUTPUT + +-- +2.37.1 + diff --git a/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/determism.patch b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/determism.patch new file mode 100644 index 0000000000..e3494fdded --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/determism.patch @@ -0,0 +1,34 @@ +The Makefile calls awk on a "*.c" glob. The results of this glob are sorted +but the order depends on the locale settings, particularly whether +"util.c" and "util2.c" sort before or after each other. In en_US.UTF-8 +they sort one way, in C, they sort the other. The sorting order changes +the output binaries. The behaviour also changes dependning on whether +SHELL (/bin/sh) is dash or bash. + +Specify a C locale setting to be deterministic. + +Signed-off-by: Richard Purdie +Submitted: https://github.com/WayneD/rsync/pull/155 + +Upstream-Status: Backport [ish, see below] + +After discussion upstream renamed util.c to util1.c which avoids the problem +in a different way. This patch can be dropped when we upgrade to include: +https://github.com/WayneD/rsync/commit/d3085f7add38a5cf833a0b31cb0637ff46c80f8d + +Index: rsync-3.2.3/Makefile.in +=================================================================== +--- rsync-3.2.3.orig/Makefile.in ++++ rsync-3.2.3/Makefile.in +@@ -26,6 +26,11 @@ MKDIR_P=@MKDIR_P@ + VPATH=$(srcdir) + SHELL=/bin/sh + ++# We use globbing in commands, need to be deterministic ++unexport LC_ALL ++LC_COLLATE=C ++export LC_COLLATE ++ + .SUFFIXES: + .SUFFIXES: .c .o + diff --git a/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/makefile-no-rebuild.patch b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/makefile-no-rebuild.patch new file mode 100644 index 0000000000..92ed1f4419 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/makefile-no-rebuild.patch @@ -0,0 +1,80 @@ +From 81700d1a0e51391028c761cc8ef1cd660084d114 Mon Sep 17 00:00:00 2001 +From: Ross Burton +Date: Tue, 12 Apr 2016 15:51:54 +0100 +Subject: [PATCH] rsync: remove upstream's rebuild logic + +Remove the Makefile rules to reinvoke autoconf, they're not out-of-tree safe and +generally overcomplicated, and we ensure that autoreconf is invoked if required. + +Upstream-Status: Inappropriate +Signed-off-by: Ross Burton + +--- + Makefile.in | 54 ----------------------------------------------------- + 1 file changed, 54 deletions(-) + +diff --git a/Makefile.in b/Makefile.in +index 3cde955..d963a70 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -190,60 +190,6 @@ gensend: gen + fi + rsync -aic $(GENFILES) git-version.h $${SAMBA_HOST-samba.org}:/home/ftp/pub/rsync/generated-files/ || true + +-aclocal.m4: $(srcdir)/m4/*.m4 +- aclocal -I $(srcdir)/m4 +- +-configure.sh config.h.in: configure.ac aclocal.m4 +- @if test -f configure.sh; then cp -p configure.sh configure.sh.old; else touch configure.sh.old; fi +- @if test -f config.h.in; then cp -p config.h.in config.h.in.old; else touch config.h.in.old; fi +- autoconf -o configure.sh +- autoheader && touch config.h.in +- @if diff configure.sh configure.sh.old >/dev/null 2>&1; then \ +- echo "configure.sh is unchanged."; \ +- rm configure.sh.old; \ +- else \ +- echo "configure.sh has CHANGED."; \ +- fi +- @if diff config.h.in config.h.in.old >/dev/null 2>&1; then \ +- echo "config.h.in is unchanged."; \ +- rm config.h.in.old; \ +- else \ +- echo "config.h.in has CHANGED."; \ +- fi +- @if test -f configure.sh.old || test -f config.h.in.old; then \ +- if test "$(MAKECMDGOALS)" = reconfigure; then \ +- echo 'Continuing with "make reconfigure".'; \ +- else \ +- echo 'You may need to run:'; \ +- echo ' make reconfigure'; \ +- exit 1; \ +- fi \ +- fi +- +-.PHONY: reconfigure +-reconfigure: configure.sh +- ./config.status --recheck +- ./config.status +- +-.PHONY: restatus +-restatus: +- ./config.status +- +-Makefile: Makefile.in config.status configure.sh config.h.in +- @if test -f Makefile; then cp -p Makefile Makefile.old; else touch Makefile.old; fi +- @./config.status +- @if diff Makefile Makefile.old >/dev/null 2>&1; then \ +- echo "Makefile is unchanged."; \ +- rm Makefile.old; \ +- else \ +- if test "$(MAKECMDGOALS)" = reconfigure; then \ +- echo 'Continuing with "make reconfigure".'; \ +- else \ +- echo "Makefile updated -- rerun your make command."; \ +- exit 1; \ +- fi \ +- fi +- + stunnel-rsyncd.conf: $(srcdir)/stunnel-rsyncd.conf.in Makefile + sed 's;\@bindir\@;$(bindir);g' <$(srcdir)/stunnel-rsyncd.conf.in >stunnel-rsyncd.conf + diff --git a/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/rsyncd.conf b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/rsyncd.conf new file mode 100644 index 0000000000..845f5b33f5 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/rsyncd.conf @@ -0,0 +1,15 @@ +# /etc/rsyncd.conf + +# Minimal configuration file for rsync daemon +# See rsync(1) and rsyncd.conf(5) man pages for help + +# This file is required by rsync --daemon +pid file = /var/run/rsyncd.pid +use chroot = yes +read only = yes + +# Simple example for enabling your own local rsync server +#[everything] +# path = / +# comment = Everything except /etc exposed +# exclude = /etc diff --git a/meta-openbmc-mods/meta-common/recipes-devtools/rsync/rsync_3.2.5.bb b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/rsync_3.2.5.bb new file mode 100644 index 0000000000..983bdd5ab0 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/rsync_3.2.5.bb @@ -0,0 +1,72 @@ +SUMMARY = "File synchronization tool" +HOMEPAGE = "http://rsync.samba.org/" +DESCRIPTION = "rsync is an open source utility that provides fast incremental file transfer." +BUGTRACKER = "http://rsync.samba.org/bugzilla.html" +SECTION = "console/network" +# GPL-2.0-or-later (<< 3.0.0), GPL-3.0-or-later (>= 3.0.0) +# Includes opennsh and xxhash dynamic link exception +LICENSE = "GPL-3.0-or-later" +LIC_FILES_CHKSUM = "file://COPYING;md5=24423708fe159c9d12be1ea29fcb18c7" + +DEPENDS = "popt" + +SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \ + file://rsyncd.conf \ + file://makefile-no-rebuild.patch \ + file://determism.patch \ + file://0001-Add-missing-prototypes-to-function-declarations.patch \ + file://0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch \ + " + +SRC_URI[sha256sum] = "2ac4d21635cdf791867bc377c35ca6dda7f50d919a58be45057fd51600c69aba" + +# -16548 required for v3.1.3pre1. Already in v3.1.3. +CVE_CHECK_IGNORE += " CVE-2017-16548 " + +inherit autotools-brokensep + +PACKAGECONFIG ??= "acl attr \ + ${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)} \ +" + +PACKAGECONFIG[acl] = "--enable-acl-support,--disable-acl-support,acl," +PACKAGECONFIG[attr] = "--enable-xattr-support,--disable-xattr-support,attr," +PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6," +PACKAGECONFIG[lz4] = "--enable-lz4,--disable-lz4,lz4" +PACKAGECONFIG[openssl] = "--enable-openssl,--disable-openssl,openssl" +PACKAGECONFIG[xxhash] = "--enable-xxhash,--disable-xxhash,xxhash" +PACKAGECONFIG[zstd] = "--enable-zstd,--disable-zstd,zstd" + +# By default, if crosscompiling, rsync disables a number of +# capabilities, hardlinking symlinks and special files (i.e. devices) +CACHED_CONFIGUREVARS += "rsync_cv_can_hardlink_special=yes rsync_cv_can_hardlink_symlink=yes" + +EXTRA_OEMAKE = 'STRIP=""' +EXTRA_OECONF = "--disable-md2man --with-nobody-group=nogroup" + +#| ./simd-checksum-x86_64.cpp: In function 'uint32_t get_checksum1_cpp(char*, int32_t)': +#| ./simd-checksum-x86_64.cpp:89:52: error: multiversioning needs 'ifunc' which is not supported on this target +#| 89 | __attribute__ ((target("default"))) MVSTATIC int32 get_checksum1_avx2_64(schar* buf, int32 len, int32 i, uint32* ps1, uint32* ps2) { return i; } +#| | ^~~~~~~~~~~~~~~~~~~~~ +#| ./simd-checksum-x86_64.cpp:480:1: error: use of multiversioned function without a default +#| 480 | } +#| | ^ +#| If you can't fix the issue, re-run ./configure with --disable-roll-simd. +EXTRA_OECONF:append:libc-musl = " --disable-roll-simd" + +# rsync 3.0 uses configure.sh instead of configure, and +# makefile checks the existence of configure.sh +do_configure:prepend () { + rm -f ${S}/configure ${S}/configure.sh +} + +do_configure:append () { + cp -f ${S}/configure ${S}/configure.sh +} + +do_install:append() { + install -d ${D}${sysconfdir} + install -m 0644 ${WORKDIR}/rsyncd.conf ${D}${sysconfdir} +} + +BBCLASSEXTEND = "native nativesdk" diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20158-1.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20158-1.patch new file mode 100644 index 0000000000..ace5ed4abc --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20158-1.patch @@ -0,0 +1,55 @@ +From 0b3ea0926afb8dde70cfab00316ae0a70b93a7cc Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Fri, 5 Nov 2021 13:36:58 -0700 +Subject: [PATCH] fs: explicitly unregister per-superblock BDIs + +Add a new SB_I_ flag to mark superblocks that have an ephemeral bdi +associated with them, and unregister it when the superblock is shut +down. + +Link: https://lkml.kernel.org/r/20211021124441.668816-4-hch@lst.de +Signed-off-by: Christoph Hellwig +Reviewed-by: Jan Kara +Cc: Miquel Raynal +Cc: Richard Weinberger +Cc: Vignesh Raghavendra +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +--- + fs/super.c | 3 +++ + include/linux/fs.h | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/fs/super.c b/fs/super.c +index bcef3a6f4c4b5..3bfc0f8fbd5bc 100644 +--- a/fs/super.c ++++ b/fs/super.c +@@ -476,6 +476,8 @@ void generic_shutdown_super(struct super_block *sb) + spin_unlock(&sb_lock); + up_write(&sb->s_umount); + if (sb->s_bdi != &noop_backing_dev_info) { ++ if (sb->s_iflags & SB_I_PERSB_BDI) ++ bdi_unregister(sb->s_bdi); + bdi_put(sb->s_bdi); + sb->s_bdi = &noop_backing_dev_info; + } +@@ -1562,6 +1564,7 @@ int super_setup_bdi_name(struct super_block *sb, char *fmt, ...) + } + WARN_ON(sb->s_bdi != &noop_backing_dev_info); + sb->s_bdi = bdi; ++ sb->s_iflags |= SB_I_PERSB_BDI; + + return 0; + } +diff --git a/include/linux/fs.h b/include/linux/fs.h +index e7a633353fd20..226de651f52e6 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -1443,6 +1443,7 @@ extern int send_sigurg(struct fown_struct *fown); + #define SB_I_UNTRUSTED_MOUNTER 0x00000040 + + #define SB_I_SKIP_SYNC 0x00000100 /* Skip superblock at global sync */ ++#define SB_I_PERSB_BDI 0x00000200 /* has a per-sb bdi */ + + /* Possible states of 'frozen' field */ + enum { diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-1.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-1.patch new file mode 100644 index 0000000000..bc459492c5 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-1.patch @@ -0,0 +1,76 @@ +From e8d5dfd1d8747b56077d02664a8838c71ced948e Mon Sep 17 00:00:00 2001 +From: David Leadbeater +Date: Fri, 26 Aug 2022 14:56:57 +1000 +Subject: [PATCH] netfilter: nf_conntrack_irc: Tighten matching on DCC message + +CTCP messages should only be at the start of an IRC message, not +anywhere within it. + +While the helper only decodes packes in the ORIGINAL direction, its +possible to make a client send a CTCP message back by empedding one into +a PING request. As-is, thats enough to make the helper believe that it +saw a CTCP message. + +Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port") +Signed-off-by: David Leadbeater +Signed-off-by: Florian Westphal +--- + net/netfilter/nf_conntrack_irc.c | 34 ++++++++++++++++++++++++++------ + 1 file changed, 28 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c +index 992decbcaa5c1e..5703846bea3b69 100644 +--- a/net/netfilter/nf_conntrack_irc.c ++++ b/net/netfilter/nf_conntrack_irc.c +@@ -157,15 +157,37 @@ static int help(struct sk_buff *skb, unsigned int protoff, + data = ib_ptr; + data_limit = ib_ptr + datalen; + +- /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24 +- * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */ +- while (data < data_limit - (19 + MINMATCHLEN)) { +- if (memcmp(data, "\1DCC ", 5)) { ++ /* Skip any whitespace */ ++ while (data < data_limit - 10) { ++ if (*data == ' ' || *data == '\r' || *data == '\n') ++ data++; ++ else ++ break; ++ } ++ ++ /* strlen("PRIVMSG x ")=10 */ ++ if (data < data_limit - 10) { ++ if (strncasecmp("PRIVMSG ", data, 8)) ++ goto out; ++ data += 8; ++ } ++ ++ /* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26 ++ * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26 ++ */ ++ while (data < data_limit - (21 + MINMATCHLEN)) { ++ /* Find first " :", the start of message */ ++ if (memcmp(data, " :", 2)) { + data++; + continue; + } ++ data += 2; ++ ++ /* then check that place only for the DCC command */ ++ if (memcmp(data, "\1DCC ", 5)) ++ goto out; + data += 5; +- /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */ ++ /* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */ + + iph = ip_hdr(skb); + pr_debug("DCC found in master %pI4:%u %pI4:%u\n", +@@ -181,7 +203,7 @@ static int help(struct sk_buff *skb, unsigned int protoff, + pr_debug("DCC %s detected\n", dccprotos[i]); + + /* we have at least +- * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid ++ * (21+MINMATCHLEN)-7-dccprotos[i].matchlen bytes valid + * data left (== 14/13 bytes) */ + if (parse_dcc(data, data_limit, &dcc_ip, + &dcc_port, &addr_beg_p, &addr_end_p)) { diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-2.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-2.patch new file mode 100644 index 0000000000..849183f7d4 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-2.patch @@ -0,0 +1,35 @@ +From 0efe125cfb99e6773a7434f3463f7c2fa28f3a43 Mon Sep 17 00:00:00 2001 +From: David Leadbeater +Date: Fri, 26 Aug 2022 14:56:58 +1000 +Subject: [PATCH] netfilter: nf_conntrack_irc: Fix forged IP logic + +Ensure the match happens in the right direction, previously the +destination used was the server, not the NAT host, as the comment +shows the code intended. + +Additionally nf_nat_irc uses port 0 as a signal and there's no valid way +it can appear in a DCC message, so consider port 0 also forged. + +Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port") +Signed-off-by: David Leadbeater +Signed-off-by: Pablo Neira Ayuso +--- + net/netfilter/nf_conntrack_irc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c +index 1796c456ac98be..992decbcaa5c1e 100644 +--- a/net/netfilter/nf_conntrack_irc.c ++++ b/net/netfilter/nf_conntrack_irc.c +@@ -194,8 +194,9 @@ static int help(struct sk_buff *skb, unsigned int protoff, + + /* dcc_ip can be the internal OR external (NAT'ed) IP */ + tuple = &ct->tuplehash[dir].tuple; +- if (tuple->src.u3.ip != dcc_ip && +- tuple->dst.u3.ip != dcc_ip) { ++ if ((tuple->src.u3.ip != dcc_ip && ++ ct->tuplehash[!dir].tuple.dst.u3.ip != dcc_ip) || ++ dcc_port == 0) { + net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n", + &tuple->src.u3.ip, + &dcc_ip, dcc_port); diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend index a8d09586ba..92620086df 100644 --- a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend @@ -49,6 +49,9 @@ SRC_URI += " \ file://CVE-2022-20368.patch\ file://CVE-2022-0168.patch\ file://CVE-2022-40476.patch\ + file://CVE-2022-2663-1.patch\ + file://CVE-2022-2663-2.patch\ + file://CVE-2022-20158-1.patch\ " SRC_URI += "${@bb.utils.contains('IMAGE_FSTYPES', 'intel-pfr', 'file://1000-128MB-flashmap-for-PFR.patch', '', d)}" From 2856c9ab56260bdd398de617bf610e4f7334cafd Mon Sep 17 00:00:00 2001 From: jmbills Date: Mon, 12 Dec 2022 09:41:04 -0700 Subject: [PATCH 2/2] Install lz4 Yocto is complaining about lz4c missing, so try to install it. --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 7c36ade7a2..8265447c05 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -12,7 +12,7 @@ jobs: - name: Run a multi-line script run: | sudo apt update - sudo apt-get install gawk wget git-core diffstat unzip texinfo gcc-multilib build-essential chrpath socat + sudo apt-get install gawk wget git-core diffstat unzip texinfo gcc-multilib build-essential chrpath socat lz4 sudo apt autoremove rm -rf build export TEMPLATECONF=meta-openbmc-mods/meta-wht/conf