import CS libseccomp-2.5.6-1.el9
This commit is contained in:
AlmaLinux RelEng Bot
parent
a1ca5f9dc1
commit
ccfa8950e1
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
||||
SOURCES/libseccomp-2.5.2.tar.gz
|
||||
SOURCES/libseccomp-2.5.6.tar.gz
|
||||
|
||||
@ -1 +1 @@
|
||||
81e6fc7b63baae9ba2b607d920588eb4d5072d6b SOURCES/libseccomp-2.5.2.tar.gz
|
||||
dd8ebb7196a67004eecc6fb0ec1eb7ae99a7a19d SOURCES/libseccomp-2.5.6.tar.gz
|
||||
|
||||
@ -1,92 +0,0 @@
|
||||
diff --color -ru a/tests/11-basic-basic_errors.c b/tests/11-basic-basic_errors.c
|
||||
--- a/tests/11-basic-basic_errors.c 2021-09-01 18:57:34.018676687 +0200
|
||||
+++ b/tests/11-basic-basic_errors.c 2021-11-05 15:04:34.647739284 +0100
|
||||
@@ -29,9 +29,13 @@
|
||||
int rc;
|
||||
scmp_filter_ctx ctx;
|
||||
uint32_t attr;
|
||||
+ unsigned int api;
|
||||
struct seccomp_notif *req = NULL;
|
||||
struct seccomp_notif_resp *resp = NULL;
|
||||
|
||||
+ /* get the api level */
|
||||
+ api = seccomp_api_get();
|
||||
+
|
||||
/* seccomp_init errors */
|
||||
ctx = seccomp_init(SCMP_ACT_ALLOW + 1);
|
||||
if (ctx != NULL)
|
||||
@@ -199,39 +203,41 @@
|
||||
ctx = NULL;
|
||||
|
||||
/* seccomp notify errors */
|
||||
- ctx = seccomp_init(SCMP_ACT_ALLOW);
|
||||
- if (ctx == NULL)
|
||||
- return -1;
|
||||
- rc = seccomp_notify_alloc(NULL, NULL);
|
||||
- if (rc != 0)
|
||||
- return -1;
|
||||
- rc = seccomp_notify_alloc(&req, NULL);
|
||||
- if (rc != 0)
|
||||
- return -1;
|
||||
- rc = seccomp_notify_alloc(NULL, &resp);
|
||||
- if (rc != 0)
|
||||
- return -1;
|
||||
- seccomp_notify_free(NULL, NULL);
|
||||
- seccomp_notify_free(req, resp);
|
||||
- req = NULL;
|
||||
- resp = NULL;
|
||||
- rc = seccomp_notify_receive(-1, NULL);
|
||||
- if (rc == 0)
|
||||
- return -1;
|
||||
- rc = seccomp_notify_respond(-1, NULL);
|
||||
- if (rc == 0)
|
||||
- return -1;
|
||||
- rc = seccomp_notify_id_valid(-1, 0);
|
||||
- if (rc == 0)
|
||||
- return -1;
|
||||
- rc = seccomp_notify_fd(NULL);
|
||||
- if (rc == 0)
|
||||
- return -1;
|
||||
- rc = seccomp_notify_fd(ctx);
|
||||
- if (rc == 0)
|
||||
- return -1;
|
||||
- seccomp_release(ctx);
|
||||
- ctx = NULL;
|
||||
+ if (api >= 5) {
|
||||
+ ctx = seccomp_init(SCMP_ACT_ALLOW);
|
||||
+ if (ctx == NULL)
|
||||
+ return -1;
|
||||
+ rc = seccomp_notify_alloc(NULL, NULL);
|
||||
+ if (rc != 0)
|
||||
+ return -1;
|
||||
+ rc = seccomp_notify_alloc(&req, NULL);
|
||||
+ if (rc != 0)
|
||||
+ return -1;
|
||||
+ rc = seccomp_notify_alloc(NULL, &resp);
|
||||
+ if (rc != 0)
|
||||
+ return -1;
|
||||
+ seccomp_notify_free(NULL, NULL);
|
||||
+ seccomp_notify_free(req, resp);
|
||||
+ req = NULL;
|
||||
+ resp = NULL;
|
||||
+ rc = seccomp_notify_receive(-1, NULL);
|
||||
+ if (rc == 0)
|
||||
+ return -1;
|
||||
+ rc = seccomp_notify_respond(-1, NULL);
|
||||
+ if (rc == 0)
|
||||
+ return -1;
|
||||
+ rc = seccomp_notify_id_valid(-1, 0);
|
||||
+ if (rc == 0)
|
||||
+ return -1;
|
||||
+ rc = seccomp_notify_fd(NULL);
|
||||
+ if (rc == 0)
|
||||
+ return -1;
|
||||
+ rc = seccomp_notify_fd(ctx);
|
||||
+ if (rc == 0)
|
||||
+ return -1;
|
||||
+ seccomp_release(ctx);
|
||||
+ ctx = NULL;
|
||||
+ }
|
||||
|
||||
return 0;
|
||||
}
|
||||
86
SOURCES/fix-murmur-hash-strict-aliasing-violation.patch
Normal file
86
SOURCES/fix-murmur-hash-strict-aliasing-violation.patch
Normal file
@ -0,0 +1,86 @@
|
||||
From b7d0f04e63c460638eeca970ba3bb784733e2e2e Mon Sep 17 00:00:00 2001
|
||||
From: Romain Geissler <romain.geissler@amadeus.com>
|
||||
Date: Tue, 18 Feb 2025 22:29:05 +0000
|
||||
Subject: [PATCH] Fix strict aliasing UB in MurMur hash implementation.
|
||||
|
||||
This was spotted when trying to upgrade the libseccomp fedora package to
|
||||
version 2.6.0 in fedora rawhide. It comes with gcc 15 and LTO enabled by
|
||||
default. When running the test 61-sim-transactions we get plenty of such
|
||||
errors in valgrind:
|
||||
|
||||
==265507== Use of uninitialised value of size 8
|
||||
==265507== at 0x4096AD: _hsh_add (gen_bpf.c:599)
|
||||
==265507== by 0x40A557: UnknownInlinedFun (gen_bpf.c:2016)
|
||||
==265507== by 0x40A557: gen_bpf_generate (gen_bpf.c:2341)
|
||||
==265507== by 0x400CDE: UnknownInlinedFun (db.c:2685)
|
||||
==265507== by 0x400CDE: UnknownInlinedFun (db.c:2682)
|
||||
==265507== by 0x400CDE: UnknownInlinedFun (api.c:756)
|
||||
==265507== by 0x400CDE: UnknownInlinedFun (util.c:162)
|
||||
==265507== by 0x400CDE: UnknownInlinedFun (util.c:153)
|
||||
==265507== by 0x400CDE: main (61-sim-transactions.c:128)
|
||||
==265507== Uninitialised value was created by a stack allocation
|
||||
==265507== at 0x409590: _hsh_add (gen_bpf.c:573)
|
||||
|
||||
Investigating this a bit, it seems that because of LTO the MurMur hash
|
||||
implementation is being inlined in _hsh_add. The two buffers data and
|
||||
blocks to point at the same underlying data, but via incompatible type,
|
||||
which is a strict aliasing violation. Instead, remove the getblock32
|
||||
function and inline the copy with memcpy.
|
||||
|
||||
This is reproducible on a "fedora:rawhide" container (gcc 15) and using:
|
||||
export CFLAGS='-O2 -flto=auto -ffat-lto-objects -g'
|
||||
|
||||
Signed-off-by: Romain Geissler <romain.geissler@amadeus.com>
|
||||
---
|
||||
src/hash.c | 12 +++---------
|
||||
1 file changed, 3 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/src/hash.c b/src/hash.c
|
||||
index 4435900f..01ff9399 100644
|
||||
--- a/src/hash.c
|
||||
+++ b/src/hash.c
|
||||
@@ -12,15 +12,11 @@
|
||||
*/
|
||||
|
||||
#include <stdlib.h>
|
||||
+#include <string.h>
|
||||
#include <inttypes.h>
|
||||
|
||||
#include "hash.h"
|
||||
|
||||
-static inline uint32_t getblock32(const uint32_t *p, int i)
|
||||
-{
|
||||
- return p[i];
|
||||
-}
|
||||
-
|
||||
static inline uint32_t rotl32(uint32_t x, int8_t r)
|
||||
{
|
||||
return (x << r) | (x >> (32 - r));
|
||||
@@ -41,7 +37,6 @@ static inline uint32_t fmix32(uint32_t h)
|
||||
uint32_t hash(const void *key, size_t length)
|
||||
{
|
||||
const uint8_t *data = (const uint8_t *)key;
|
||||
- const uint32_t *blocks;
|
||||
const uint8_t *tail;
|
||||
const int nblocks = length / 4;
|
||||
const uint32_t c1 = 0xcc9e2d51;
|
||||
@@ -54,9 +49,8 @@ uint32_t hash(const void *key, size_t length)
|
||||
uint32_t h1 = 0;
|
||||
|
||||
/* body */
|
||||
- blocks = (const uint32_t *)(data + nblocks * 4);
|
||||
for(i = -nblocks; i; i++) {
|
||||
- k1 = getblock32(blocks, i);
|
||||
+ memcpy(&k1, data + (nblocks + i) * sizeof(uint32_t), sizeof(uint32_t));
|
||||
|
||||
k1 *= c1;
|
||||
k1 = rotl32(k1, 15);
|
||||
@@ -68,7 +62,7 @@ uint32_t hash(const void *key, size_t length)
|
||||
}
|
||||
|
||||
/* tail */
|
||||
- tail = (const uint8_t *)(data + nblocks * 4);
|
||||
+ tail = data + nblocks * sizeof(uint32_t);
|
||||
switch(length & 3) {
|
||||
case 3:
|
||||
k2 ^= tail[2] << 16;
|
||||
@ -1,6 +1,6 @@
|
||||
Name: libseccomp
|
||||
Version: 2.5.2
|
||||
Release: 2%{?dist}
|
||||
Version: 2.5.6
|
||||
Release: 1%{?dist}
|
||||
Summary: Enhanced seccomp library
|
||||
License: LGPLv2
|
||||
URL: https://github.com/seccomp/libseccomp
|
||||
@ -8,8 +8,8 @@ Source0: %{url}/releases/download/v%{version}/%{name}-%{version}.tar.gz
|
||||
|
||||
# Backports from upstream
|
||||
|
||||
## From: https://github.com/seccomp/libseccomp/commit/5532444587fa5f33a43179ca5cc710f1bb05f51f
|
||||
Patch0101: 0101-fix-11-basic-basic_errors-on-old-kernels.patch
|
||||
# From https://github.com/seccomp/libseccomp/pull/459
|
||||
Patch0101: fix-murmur-hash-strict-aliasing-violation.patch
|
||||
|
||||
BuildRequires: gcc
|
||||
BuildRequires: gperf
|
||||
@ -67,11 +67,6 @@ mkdir -p %{buildroot}/%{_mandir}
|
||||
rm -f %{buildroot}/%{_libdir}/libseccomp.la
|
||||
|
||||
%check
|
||||
# Tests 36 and 37 fail on the build systems for the arches below and I'm not
|
||||
# able to reproduce the failure so just skip the tests for now
|
||||
%ifarch i686 ppc64le s390x
|
||||
rm -f tests/36-sim-ipc_syscalls.tests tests/37-sim-ipc_syscalls_be.tests
|
||||
%endif
|
||||
%make_build check
|
||||
|
||||
|
||||
@ -93,6 +88,10 @@ rm -f tests/36-sim-ipc_syscalls.tests tests/37-sim-ipc_syscalls_be.tests
|
||||
%{_libdir}/libseccomp.a
|
||||
|
||||
%changelog
|
||||
* Tue Feb 18 2025 Romain Geissler <romain.geissler@amadeus.com> - 2.5.6-1
|
||||
- Upgrade to version 2.5.6.
|
||||
Resolves: RHEL-178770
|
||||
|
||||
* Fri Nov 05 2021 Zoltan Fridrich <zfridric@redhat.com> - 2.5.2-2
|
||||
- fix devel-usability test
|
||||
- rebase to 2.5.2
|
||||
|
||||
Loading…
Reference in New Issue
Block a user