Merge 9.4 stable and 9.5 beta releases

.pcp.metadata

@@ -1,2 +1,2 @@
 65095a4cddfad3ec6e119ea127050ea68ff8676d SOURCES/pcp-6.2.2.src.tar.gz
-17b4396eb6593178f6c29db6f0eb01234eb6dba0 SOURCES/redhat-issues-RHEL-50693-hacluster-metrics-update.patch
+e9a7873944492e28e2f9c5fd0c9bfac12ef7596e SOURCES/redhat-issues-RHEL-50693-hacluster-metrics-update.patch

SOURCES/redhat-issues-RHEL-34586-pmproxy-pmcd-fd-leak.patch

@@ -0,0 +1,113 @@
+diff -Naurp pcp-5.3.7.orig/src/libpcp_web/src/load.h pcp-5.3.7/src/libpcp_web/src/load.h
+--- pcp-5.3.7.orig/src/libpcp_web/src/load.h	2021-02-17 15:27:41.000000000 +1100
++++ pcp-5.3.7/src/libpcp_web/src/load.h	2024-09-09 13:45:56.531933622 +1000
+@@ -42,8 +42,9 @@ typedef struct context {
+     unsigned int	setup	: 1;	/* context established */
+     unsigned int	cached	: 1;	/* context/source in cache */
+     unsigned int	garbage	: 1;	/* context pending removal */
++    unsigned int	inactive: 1;	/* context removal deferred */
+     unsigned int	updated : 1;	/* context labels are updated */
+-    unsigned int	padding : 4;	/* zero-filled struct padding */
++    unsigned int	padding : 3;	/* zero-filled struct padding */
+     unsigned int	refcount : 16;	/* currently-referenced counter */
+     unsigned int	timeout;	/* context timeout in milliseconds */
+     uv_timer_t		timer;
+diff -Naurp pcp-5.3.7.orig/src/libpcp_web/src/webgroup.c pcp-5.3.7/src/libpcp_web/src/webgroup.c
+--- pcp-5.3.7.orig/src/libpcp_web/src/webgroup.c	2024-09-09 13:44:34.166748200 +1000
++++ pcp-5.3.7/src/libpcp_web/src/webgroup.c	2024-09-09 13:45:56.531933622 +1000
+@@ -134,9 +134,18 @@ webgroup_timeout_context(uv_timer_t *arg
+      * is returned to zero by the caller, or background cleanup
+      * finds this context and cleans it.
+      */
+-    if (cp->refcount == 0 && cp->garbage == 0) {
+-	cp->garbage = 1;
+-	uv_timer_stop(&cp->timer);
++    if (cp->refcount == 0) {
++	if (cp->garbage == 0) {
++	    cp->garbage = 1;
++	    uv_timer_stop(&cp->timer);
++	}
++    } else {
++	/*
++	 * Context timed out but still referenced, must wait
++	 * until the caller releases its reference (shortly)
++	 * before beginning garbage collection process.
++	 */
++	cp->inactive = 1;
+     }
+ }
+ 
+@@ -298,20 +307,28 @@ webgroup_garbage_collect(struct webgroup
+     dictIterator        *iterator;
+     dictEntry           *entry;
+     context_t		*cp;
+-    unsigned int	count = 0, drops = 0;
++    unsigned int	count = 0, drops = 0, garbageset = 0, inactiveset = 0;
+ 
+     if (pmDebugOptions.http || pmDebugOptions.libweb)
+-	fprintf(stderr, "%s: started\n", "webgroup_garbage_collect");
++	fprintf(stderr, "%s: started for groups %p\n",
++			"webgroup_garbage_collect", groups);
+ 
+     /* do context GC if we get the lock (else don't block here) */
+     if (uv_mutex_trylock(&groups->mutex) == 0) {
+ 	iterator = dictGetSafeIterator(groups->contexts);
+ 	for (entry = dictNext(iterator); entry;) {
+ 	    cp = (context_t *)dictGetVal(entry);
++	    if (cp->privdata != groups)
++		continue;
+ 	    entry = dictNext(iterator);
+-	    if (cp->garbage && cp->privdata == groups) {
++	    if (cp->garbage)
++		garbageset++;
++	    if (cp->inactive && cp->refcount == 0)
++		inactiveset++;
++	    if (cp->garbage || (cp->inactive && cp->refcount == 0)) {
+ 		if (pmDebugOptions.http || pmDebugOptions.libweb)
+-		    fprintf(stderr, "GC context %u (%p)\n", cp->randomid, cp);
++		    fprintf(stderr, "GC dropping context %u (%p)\n",
++				    cp->randomid, cp);
+ 		uv_mutex_unlock(&groups->mutex);
+ 		webgroup_drop_context(cp, groups);
+ 		uv_mutex_lock(&groups->mutex);
+@@ -324,7 +341,8 @@ webgroup_garbage_collect(struct webgroup
+ 	/* if dropping the last remaining context, do cleanup */
+ 	if (groups->active && drops == count) {
+ 	    if (pmDebugOptions.http || pmDebugOptions.libweb)
+-		fprintf(stderr, "%s: freezing\n", "webgroup_garbage_collect");
++		fprintf(stderr, "%s: freezing groups %p\n",
++				"webgroup_garbage_collect", groups);
+ 	    webgroup_timers_stop(groups);
+ 	}
+ 	uv_mutex_unlock(&groups->mutex);
+@@ -334,8 +352,10 @@ webgroup_garbage_collect(struct webgroup
+     mmv_set(groups->map, groups->metrics[WEBGROUP_GC_COUNT], &count);
+ 
+     if (pmDebugOptions.http || pmDebugOptions.libweb)
+-	fprintf(stderr, "%s: finished [%u drops from %u entries]\n",
+-			"webgroup_garbage_collect", drops, count);
++	fprintf(stderr, "%s: finished [%u drops from %u entries,"
++			" %u garbageset, %u inactiveset]\n",
++			"webgroup_garbage_collect", drops, count,
++			garbageset, inactiveset);
+ }
+ 
+ static void
+@@ -354,7 +374,7 @@ webgroup_use_context(struct context *cp,
+     int			sts;
+     struct webgroups    *gp = (struct webgroups *)cp->privdata;
+ 
+-    if (cp->garbage == 0) {
++    if (cp->garbage == 0 && cp->inactive == 0) {
+ 	if (cp->setup == 0) {
+ 	    if ((sts = pmReconnectContext(cp->context)) < 0) {
+ 		infofmt(*message, "cannot reconnect context: %s",
+@@ -424,7 +444,7 @@ webgroup_lookup_context(pmWebGroupSettin
+ 	    *status = -ENOTCONN;
+ 	    return NULL;
+ 	}
+-	if (cp->garbage == 0) {
++	if (cp->garbage == 0 && cp->inactive == 0) {
+ 	    access.username = cp->username;
+ 	    access.password = cp->password;
+ 	    access.realm = cp->realm;

SOURCES/redhat-issues-RHEL-57796-pmcd-pmstore-corruption.patch

@@ -0,0 +1,419 @@
+diff -Naurp pcp-6.2.0.orig/qa/1518 pcp-6.2.0/qa/1518
+--- pcp-6.2.0.orig/qa/1518	1970-01-01 10:00:00.000000000 +1000
++++ pcp-6.2.0/qa/1518	2024-09-17 10:11:45.805874610 +1000
+@@ -0,0 +1,75 @@
++#!/bin/sh
++# PCP QA Test No. 1518
++# SUSE Issue A)
++#	__pmDecodeValueSet() Miscalculates Available Buffer Space
++#	Leading to a Possible Heap Corruption
++#
++# Copyright (c) 2024 Ken McDonell.  All Rights Reserved.
++# Copyright (c) 2024 Matthias Gerstner.  All Rights Reserved.
++#
++
++if [ $# -eq 0 ]
++then
++    seq=`basename $0`
++    echo "QA output created by $seq"
++else
++    # use $seq from caller, unless not set
++    [ -n "$seq" ] || seq=`basename $0`
++    echo "QA output created by `basename $0` $*"
++fi
++
++# get standard environment, filters and checks
++. ./common.product
++. ./common.filter
++. ./common.check
++
++$sudo rm -rf $tmp $tmp.* $seq.full
++
++which nc >/dev/null 2>&1 || _notrun "no nc executable installed"
++_check_valgrind
++
++_cleanup()
++{
++    cat pmcd.log >>$here/$seq.full
++    cd $here
++    $sudo rm -rf $tmp $tmp.*
++}
++
++status=0	# success is the default!
++trap "_cleanup; exit \$status" 0 1 2 3 15
++
++_filter()
++{
++    sed \
++	-e '/^Command: /d' \
++    # end
++}
++
++mkdir $tmp || exit 1
++cd $tmp
++grep sampledso $PCP_PMCDCONF_PATH >pmcd.conf
++cat pmcd.conf >>$here/$seq.full
++port=`_find_free_port`
++echo "port=$port" >>$here/$seq.full
++
++# real QA test starts here
++valgrind $PCP_BINADM_DIR/pmcd -f -Dpdu -c ./pmcd.conf -s ./pmcd.socket -p $port  >out 2>err &
++valgrind_pid=$!
++sleep 2
++pmcd_pid=`$PCP_PS_PROG $PCP_PS_ALL_FLAGS | grep '[p]mcd -f -Dpdu' | $PCP_AWK_PROG '{ print $2 }'`
++echo "pmcd_pid=$pmcd_pid" >>$here/$seq.full
++nc -N -U ./pmcd.socket <$here/binary/decode-value-set-out-of-bound-write 2>&1 \
++| od -c >>$here/$seq.full
++sleep 2
++kill -TERM $pmcd_pid
++wait
++
++echo "expect error to be logged ..."
++grep __pmDecodeValueSet pmcd.log
++
++echo
++echo "and no valgrind badness ..."
++cat out err | _filter_valgrind | _filter
++
++# success, all done
++exit
+diff -Naurp pcp-6.2.0.orig/qa/1518.out pcp-6.2.0/qa/1518.out
+--- pcp-6.2.0.orig/qa/1518.out	1970-01-01 10:00:00.000000000 +1000
++++ pcp-6.2.0/qa/1518.out	2024-09-17 10:11:45.806874611 +1000
+@@ -0,0 +1,11 @@
++QA output created by 1518
++expect error to be logged ...
++__pmDecodeValueSet: PM_ERR_IPC: pmid[0] value[0] vindex=1020 (max=255)
++
++and no valgrind badness ...
++Memcheck, a memory error detector
++LEAK SUMMARY:
++definitely lost: 0 bytes in 0 blocks
++indirectly lost: 0 bytes in 0 blocks
++Rerun with --leak-check=full to see details of leaked memory
++ERROR SUMMARY: 0 errors from 0 contexts ...
+diff -Naurp pcp-6.2.0.orig/qa/group pcp-6.2.0/qa/group
+--- pcp-6.2.0.orig/qa/group	2024-02-11 23:48:09.000000000 +1100
++++ pcp-6.2.0/qa/group	2024-09-17 10:11:45.815874621 +1000
+@@ -1984,7 +1984,7 @@ x11
+ 1515 pmda.denki local valgrind
+ 1516:reserved kenj
+ 1517:reserved kenj
+-1518:reserved kenj
++1518 pmcd libpcp local
+ 1519:reserved kenj
+ 1530 pmda.zfs local valgrind
+ 1531 pmda.zfs local valgrind
+diff -Naurp pcp-6.2.0.orig/src/libpcp/src/endian.c pcp-6.2.0/src/libpcp/src/endian.c
+--- pcp-6.2.0.orig/src/libpcp/src/endian.c	2023-11-16 17:51:39.000000000 +1100
++++ pcp-6.2.0/src/libpcp/src/endian.c	2024-09-17 10:11:45.820874627 +1000
+@@ -275,13 +275,17 @@ ntohEventArray(pmValueBlock * const vb,
+ }
+ 
+ void
+-__ntohpmValueBlock(pmValueBlock * const vb)
++__ntohpmValueBlock_hdr(pmValueBlock * const vb)
+ {
+     unsigned int	*ip = (unsigned int *)vb;
+ 
+     /* Swab the first word, which contain vtype and vlen */
+     *ip = ntohl(*ip);
++}
+ 
++void
++__ntohpmValueBlock_buf(pmValueBlock * const vb)
++{
+     switch (vb->vtype) {
+     case PM_TYPE_U64:
+     case PM_TYPE_64:
+@@ -305,6 +309,13 @@ __ntohpmValueBlock(pmValueBlock * const
+ 	break;
+     }
+ }
++
++void
++__ntohpmValueBlock(pmValueBlock * const vb)
++{
++    __ntohpmValueBlock_hdr(vb);
++    __ntohpmValueBlock_buf(vb);
++}
+ #endif
+ 
+ #ifndef __htonpmPDUInfo
+diff -Naurp pcp-6.2.0.orig/src/libpcp/src/internal.h pcp-6.2.0/src/libpcp/src/internal.h
+--- pcp-6.2.0.orig/src/libpcp/src/internal.h	2023-11-16 17:51:39.000000000 +1100
++++ pcp-6.2.0/src/libpcp/src/internal.h	2024-09-17 10:11:45.823874630 +1000
+@@ -60,6 +60,8 @@ extern int __pmGetDate(struct timespec *
+ #define __ntohpmLabel(a)	/* noop */
+ #define __htonpmValueBlock(a)	/* noop */
+ #define __ntohpmValueBlock(a)	/* noop */
++#define __ntohpmValueBlock_hdr(a)	/* noop */
++#define __ntohpmValueBlock_buf(a)	/* noop */
+ #define __htonf(a)		/* noop */
+ #define __ntohf(a)		/* noop */
+ #define __htond(a)		/* noop */
+@@ -90,6 +92,8 @@ extern void __htonpmLabel(pmLabel * cons
+ extern void __ntohpmLabel(pmLabel * const) _PCP_HIDDEN;
+ extern void __htonpmValueBlock(pmValueBlock * const) _PCP_HIDDEN;
+ extern void __ntohpmValueBlock(pmValueBlock * const) _PCP_HIDDEN;
++extern void __ntohpmValueBlock_hdr(pmValueBlock * const) _PCP_HIDDEN;
++extern void __ntohpmValueBlock_buf(pmValueBlock * const) _PCP_HIDDEN;
+ extern void __htonf(char *) _PCP_HIDDEN;	/* float */
+ #define __ntohf(v) __htonf(v)
+ #define __htond(v) __htonll(v)			/* double */
+diff -Naurp pcp-6.2.0.orig/src/libpcp/src/p_result.c pcp-6.2.0/src/libpcp/src/p_result.c
+--- pcp-6.2.0.orig/src/libpcp/src/p_result.c	2023-11-16 17:51:39.000000000 +1100
++++ pcp-6.2.0/src/libpcp/src/p_result.c	2024-09-17 10:18:17.264314112 +1000
+@@ -323,6 +323,135 @@ __pmSendHighResResult(int fd, int from,
+     return __pmSendHighResResult_ctx(NULL, fd, from, result);
+ }
+ 
++/* Check that a network encoded event array is within a given buffer size */
++int
++__pmEventArrayCheck(pmValueBlock * const vb, int highres, int pmid, int value, size_t check)
++{
++    char		*base;
++    int			r;	/* records */
++    int			p;	/* parameters in a record ... */
++    int			nrecords;
++    int			nparams;
++
++    if (highres) {
++	pmHighResEventArray *hreap = (pmHighResEventArray *)vb;
++	base = (char *)&hreap->ea_record[0];
++	if (base > (char *)vb + check) {
++	    if (pmDebugOptions.pdu)
++		fprintf(stderr, "__pmEventArrayCheck #1: PM_ERR_IPC: pmid[%d] value[%d] highres event records past end of PDU buffer\n",
++			pmid, value);
++	    return PM_ERR_IPC;
++	}
++	nrecords = ntohl(hreap->ea_nrecords);
++    }
++    else {
++	pmEventArray *eap = (pmEventArray *)vb;
++	base = (char *)&eap->ea_record[0];
++	if (base > (char *)vb + check) {
++	    if (pmDebugOptions.pdu)
++		fprintf(stderr, "__pmEventArrayCheck #2: PM_ERR_IPC: pmid[%d] value[%d] event records past end of PDU buffer\n",
++			pmid, value);
++	    return PM_ERR_IPC;
++	}
++	nrecords = ntohl(eap->ea_nrecords);
++    }
++
++    /* walk packed event record array */
++    for (r = 0; r < nrecords; r++) {
++	unsigned int flags, type;
++	size_t size, remaining;
++
++	remaining = check - (base - (char *)vb);
++	if (highres) {
++	    pmHighResEventRecord *hrerp = (pmHighResEventRecord *)base;
++	    size = sizeof(hrerp->er_timestamp) + sizeof(hrerp->er_flags) +
++		    sizeof(hrerp->er_nparams);
++	    if (size > remaining) {
++		if (pmDebugOptions.pdu)
++		    fprintf(stderr, "__pmEventArrayCheck #3: PM_ERR_IPC: pmid[%d] value[%d] record[%d] highres event record past end of PDU buffer\n",
++			    pmid, value, r);
++		return PM_ERR_IPC;
++	    }
++	    nparams = ntohl(hrerp->er_nparams);
++	    flags = ntohl(hrerp->er_flags);
++	}
++	else {
++	    pmEventRecord *erp = (pmEventRecord *)base;
++	    size = sizeof(erp->er_timestamp) + sizeof(erp->er_flags) +
++		    sizeof(erp->er_nparams);
++	    if (size > remaining) {
++		if (pmDebugOptions.pdu)
++		    fprintf(stderr, "__pmEventArrayCheck #4: PM_ERR_IPC: pmid[%d] value[%d] record[%d] event record past end of PDU buffer\n",
++			    pmid, value, r);
++		return PM_ERR_IPC;
++	    }
++	    nparams = ntohl(erp->er_nparams);
++	    flags = ntohl(erp->er_flags);
++	}
++
++	if (flags & PM_EVENT_FLAG_MISSED)
++	    nparams = 0;
++
++	base += size;
++	remaining = check - (base - (char *)vb);
++
++	for (p = 0; p < nparams; p++) {
++	    __uint32_t		*tp;	/* points to int holding vtype/vlen */
++	    pmEventParameter	*epp = (pmEventParameter *)base;
++
++	    if (sizeof(pmEventParameter) > remaining) {
++		if (pmDebugOptions.pdu)
++		    fprintf(stderr, "__pmEventArrayCheck #5: PM_ERR_IPC: pmid[%d] value[%d] record[%d] param[%d] event record past end of PDU buffer\n",
++			    pmid, value, r, p);
++		return PM_ERR_IPC;
++	    }
++
++	    tp = (__uint32_t *)&epp->ep_pmid;
++	    tp++;		/* now points to ep_type/ep_len */
++	    *tp = ntohl(*tp);
++	    type = epp->ep_type;
++	    size = epp->ep_len;
++	    *tp = htonl(*tp);	/* leave the buffer how we found it */
++
++	    if (sizeof(pmID) + size > remaining) {
++		if (pmDebugOptions.pdu)
++		    fprintf(stderr, "__pmEventArrayCheck #6: PM_ERR_IPC: pmid[%d] value[%d] record[%d] param[%d] event record past end of PDU buffer\n",
++			    pmid, value, r, p);
++		return PM_ERR_IPC;
++	    }
++
++	    base += sizeof(pmID) + PM_PDU_SIZE_BYTES(size);
++
++	    /*
++	     * final check for the types below, ep_len should be 4 or
++	     * 8, but a malformed PDU could have smaller ep_len values
++	     * and then unpacking these types risk going past the end
++	     * of the  PDU buffer
++	     */
++	    size = 0;
++	    switch (type) {
++		case PM_TYPE_32:
++		case PM_TYPE_U32:
++		case PM_TYPE_FLOAT:
++		    size = 4;	/* 32-bit types */
++		    break;
++		case PM_TYPE_64:
++		case PM_TYPE_U64:
++		case PM_TYPE_DOUBLE:
++		    size = 8;	/* 64-bit types */
++		    break;
++	    }
++	    if (size > 0 && sizeof(pmID) + size > remaining) {
++		if (pmDebugOptions.pdu)
++		    fprintf(stderr, "__pmEventArrayCheck #7: PM_ERR_IPC: pmid[%d] value[%d] record[%d] param[%d] event record past end of PDU buffer\n",
++			    pmid, value, r, p);
++		return PM_ERR_IPC;
++	    }
++	}
++    }
++    return 0;
++}
++
+ #if defined(HAVE_64BIT_PTR)
+ int
+ __pmDecodeValueSet(__pmPDU *pdubuf, int pdulen, __pmPDU *data, char *pduend,
+@@ -336,7 +465,7 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+     int		i, j;
+ /*
+  * Note: all sizes are in units of bytes ... beware that 'data' is in
+- *	 units of __pmPDU
++ *	 units of __pmPDU (four bytes)
+  */
+     int		vsize;		/* size of vlist_t's in PDU buffer */
+     int		nvsize;		/* size of pmValue's after decode */
+@@ -414,11 +543,10 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+ 			return PM_ERR_IPC;
+ 		    }
+ 		    vindex = ntohl(pduvp->value.lval);
+-		    if (vindex < 0 || vindex > pdulen) {
++		    if (vindex < 0 || (char *)&pdubuf[vindex] >= pduend) {
+ 			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+-			    fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
+-					    "vindex=%d\n",
+-					    "__pmDecodeValueSet", i, j, vindex);
++			    fprintf(stderr, "__pmDecodeValueSet: PM_ERR_IPC: pmid[%d] value[%d] vindex=%d (max=%ld)\n",
++				i, j, vindex, (long)((pduend-(char *)pdubuf) / sizeof(pdubuf[0])-1));
+ 			return PM_ERR_IPC;
+ 		    }
+ 		    pduvbp = (pmValueBlock *)&pdubuf[vindex];
+@@ -427,29 +555,31 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+ 		    check = (size_t)(pduend - (char *)pduvbp);
+ 		    if (sizeof(unsigned int) > check) {
+ 			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+-			    fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
+-					    "second pduvp past end of "
+-					    "PDU buffer\n",
+-					    "__pmDecodeValueSet", i, j);
++			    fprintf(stderr, "__pmDecodeValueSet: PM_ERR_IPC: pmid[%d] value[%d] second pduvp past end of PDU buffer\n",
++				i, j);
+ 			return PM_ERR_IPC;
+ 		    }
+-
+-		    __ntohpmValueBlock(pduvbp);
++		    __ntohpmValueBlock_hdr(pduvbp);
+ 		    if (pduvbp->vlen < PM_VAL_HDR_SIZE ||
+ 			pduvbp->vlen > pdulen) {
+-			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+-			    fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
+-					    "vlen=%d\n", "__pmDecodeValueSet",
+-					    i, j, pduvbp->vlen);
++			if (pmDebugOptions.pdu)
++			    fprintf(stderr, "__pmDecodeValueSet: PM_ERR_IPC: pmid[%d] value[%d] vlen=%d\n",
++				i, j, pduvbp->vlen);
+ 			return PM_ERR_IPC;
+ 		    }
+-		    if (pduvbp->vlen > (size_t)(pduend - (char *)pduvbp)) {
+-			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+-			    fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
+-					    "pduvp past end of PDU buffer\n",
+-					    "__pmDecodeValueSet", i, j);
++		    if (pduvbp->vlen > check) {
++			if (pmDebugOptions.pdu)
++			    fprintf(stderr, "__pmDecodeValueSet: PM_ERR_IPC: pmid[%d] value[%d] pduvp past end of PDU buffer\n",
++				i, j);
+ 			return PM_ERR_IPC;
+ 		    }
++		    if (pduvbp->vtype == PM_TYPE_HIGHRES_EVENT ||
++			pduvbp->vtype == PM_TYPE_EVENT) {
++			vindex = (pduvbp->vtype == PM_TYPE_HIGHRES_EVENT);
++			if (__pmEventArrayCheck(pduvbp, vindex, i, j, check) < 0)
++			    return PM_ERR_IPC;
++		    }
++		    __ntohpmValueBlock_buf(pduvbp);
+ 		    vbsize += PM_PDU_SIZE_BYTES(pduvbp->vlen);
+ 		    if (pmDebugOptions.pdu && pmDebugOptions.desperate) {
+ 			fprintf(stderr, " len: %d type: %d",
+@@ -682,11 +812,10 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+ 		} else {
+ 		    /* salvage pmValueBlocks from end of PDU */
+ 		    vindex = ntohl(pduvp->value.lval);
+-		    if (vindex < 0 || vindex > pdulen) {
++		    if (vindex < 0 || (char *)&pdubuf[vindex] >= pduend) {
+ 			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+-			    fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
+-					    "vindex=%d\n",
+-					    "__pmDecodeValueSet", i, j, vindex);
++			    fprintf(stderr, "__pmDecodeValueSet: PM_ERR_IPC: pmid[%d] value[%d] vindex=%d (max=%ld)\n",
++				i, j, vindex, (long)((pduend-(char *)pdubuf) / sizeof(pdubuf[0])-1));
+ 			return PM_ERR_IPC;
+ 		    }
+ 		    pduvbp = (pmValueBlock *)&pdubuf[vindex];
+@@ -701,7 +830,7 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+ 					    "__pmDecodeValueSet", i, j);
+ 			return PM_ERR_IPC;
+ 		    }
+-		    __ntohpmValueBlock(pduvbp);
++		    __ntohpmValueBlock_hdr(pduvbp);
+ 		    if (pduvbp->vlen < PM_VAL_HDR_SIZE ||
+ 			pduvbp->vlen > pdulen) {
+ 			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+@@ -710,13 +839,20 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
+ 					    i, j, pduvbp->vlen);
+ 			return PM_ERR_IPC;
+ 		    }
+-		    if (pduvbp->vlen > (size_t)(pduend - (char *)pduvbp)) {
++		    if (pduvbp->vlen > check) {
+ 			if (pmDebugOptions.pdu && pmDebugOptions.desperate)
+ 			    fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
+ 					    "pduvp past end of PDU buffer\n",
+ 					    "__pmDecodeValueSet", i, j);
+ 			return PM_ERR_IPC;
+ 		    }
++		    if (pduvbp->vtype == PM_TYPE_HIGHRES_EVENT ||
++		        pduvbp->vtype == PM_TYPE_EVENT) {
++			vindex = (pduvbp->vtype == PM_TYPE_HIGHRES_EVENT);
++			if (__pmEventArrayCheck(pduvbp, vindex, i, j, check) < 0)
++			    return PM_ERR_IPC;
++		    }
++		    __ntohpmValueBlock_buf(pduvbp);
+ 		    pduvp->value.pval = pduvbp;
+ 		}
+ 	    }

SOURCES/redhat-issues-RHEL-57799-pmpost-symlink-handling.patch

@@ -0,0 +1,99 @@
+diff -Naurp pcp-5.3.7.orig/qa/640 pcp-5.3.7/qa/640
+--- pcp-5.3.7.orig/qa/640	2017-08-17 10:54:57.000000000 +1000
++++ pcp-5.3.7/qa/640	2024-09-09 13:41:12.440235947 +1000
+@@ -6,6 +6,10 @@
+ # years; so we now simply check the right permissions are in place
+ # and move right along...
+ #
++# Aug 2024 update
++# SuSE Issue G identifies another possible exploit, so try that
++# as well.
++#
+ # Copyright (c) 1995-2002 Silicon Graphics, Inc.  All Rights Reserved.
+ #
+ 
+@@ -17,13 +21,54 @@ echo "QA output created by $seq"
+ . ./common.filter
+ . ./common.check
+ 
+-status=0	# success is the default!
+-trap "$sudo rm -f $tmp.*; exit \$status" 0 1 2 3 15
++rm -f $seq.full
++ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
++
++_cleanup()
++{
++    if [ -f $PCP_LOG_DIR/NOTICES.$seq ]
++    then
++	$sudo rm -f $PCP_LOG_DIR/NOTICES
++	$sudo mv $PCP_LOG_DIR/NOTICES.$seq $PCP_LOG_DIR/NOTICES
++    fi
++    ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
++    $sudo rm -rf $tmp $tmp.*
++}
++
++status=1	# failure is the default!
++trap "_cleanup; exit \$status" 0 1 2 3 15
++
++_filter()
++{
++    sed \
++	-e "s@$PCP_LOG_DIR@PCP_LOG_DIR@g" \
++	-e '/^pmpost:/s/\[.*]/[DATE]/' \
++    # end
++}
+ 
+ # real QA test starts here
+ pmpost=$PCP_BINADM_DIR/pmpost
+-echo "Using pmpost binary: $pmpost" > $seq.full
++echo "Using pmpost binary: $pmpost" >>$seq.full
+ test -u "$pmpost" && echo "FAIL: pmpost has setuid bit set"
+ test -g "$pmpost" && echo "FAIL: pmpost has setgid bit set"
++
++$sudo mkdir $tmp || exit
++$sudo chmod 700 $tmp || exit
++$sudo -u $PCP_USER mv $PCP_LOG_DIR/NOTICES $PCP_LOG_DIR/NOTICES.$seq
++
++$sudo -u $PCP_USER ln -s $tmp/badness $PCP_LOG_DIR/NOTICES >>$seq.full
++$pmpost ordinary user 2>&1 | _filter
++$sudo ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
++$sudo -u pcp $pmpost pcp user 2>&1 | _filter
++$sudo ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
++$sudo $pmpost root user 2>&1 | _filter
++$sudo ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
++if $sudo test -f $tmp/badness
++then
++    $sudo cat $tmp/badness
++fi
++
+ echo "Test complete"
++
++status=0
+ exit
+diff -Naurp pcp-5.3.7.orig/qa/640.out pcp-5.3.7/qa/640.out
+--- pcp-5.3.7.orig/qa/640.out	2017-08-17 10:54:57.000000000 +1000
++++ pcp-5.3.7/qa/640.out	2024-09-09 13:41:12.440235947 +1000
+@@ -1,2 +1,5 @@
+ QA output created by 640
++pmpost: unposted message: [DATE] ordinary user
++pmpost: unposted message: [DATE] pcp user
++pmpost: unposted message: [DATE] root user
+ Test complete
+diff -Naurp pcp-5.3.7.orig/src/pmpost/pmpost.c pcp-5.3.7/src/pmpost/pmpost.c
+--- pcp-5.3.7.orig/src/pmpost/pmpost.c	2021-02-17 15:27:41.000000000 +1100
++++ pcp-5.3.7/src/pmpost/pmpost.c	2024-09-09 13:41:12.440235947 +1000
+@@ -144,8 +144,12 @@ main(int argc, char **argv)
+ 	goto oops;
+     }
+ 
+-    if ((fd = open(notices, O_WRONLY|O_APPEND, 0)) < 0) {
+-	if ((fd = open(notices, O_WRONLY|O_CREAT|O_APPEND, 0664)) < 0) {
++    if ((fd = open(notices, O_WRONLY|O_APPEND|O_NOFOLLOW, 0)) < 0) {
++	if (oserror() == ELOOP) {
++	    /* last component is symlink => attack? ... bail! */
++	    goto oops;
++	}
++	if ((fd = open(notices, O_WRONLY|O_CREAT|O_APPEND|O_NOFOLLOW, 0664)) < 0) {
+ 	    fprintf(stderr, "pmpost: cannot open or create file \"%s\": %s\n",
+ 		notices, osstrerror());
+ 	    goto oops;

SPECS/pcp.spec

@@ -1,6 +1,6 @@
 Name:    pcp
 Version: 6.2.2
-Release: 6%{?dist}
+Release: 7%{?dist}.alma.1
 Summary: System-level performance monitoring and performance management
 License: GPL-2.0-or-later AND LGPL-2.1-or-later AND CC-BY-3.0
 URL:     https://pcp.io
@@ -15,6 +15,11 @@ Patch4: redhat-issues-39159-39132-32983-39293.patch
 Patch5: redhat-issues-RHEL-40718-java-bytecode-update.patch 
 Patch6: redhat-issues-RHEL-50693-hacluster-metrics-update.patch
 
+# Patches were taken from AlmaLinux 9.4
+Patch7: redhat-issues-RHEL-57796-pmcd-pmstore-corruption.patch	
+Patch8: redhat-issues-RHEL-57799-pmpost-symlink-handling.patch	
+Patch9: redhat-issues-RHEL-34586-pmproxy-pmcd-fd-leak.patch	
+Patch10: redhat-issues-RHEL-57788-pmdahacluster-update.patch
 %if 0%{?fedora} >= 40 || 0%{?rhel} >= 10
 ExcludeArch: %{ix86}
 %endif
@@ -3544,6 +3549,12 @@ fi
 %files zeroconf -f pcp-zeroconf-files.rpm
 
 %changelog
+* Tue Nov 12 2024 Eduard Abdullin <eabdullin@almalinux.org> - 6.2.0-7.alma.1
+- Fix buffer sizing checks in pmstore PDU handling
+- Guard against symlink attacks in pmpost program
+- Fix libpcp_web webgroup slow request refcounting
+- Updated pmdahacluster for newer crm_mon versions
+
 * Wed Aug 7 2024 Nathan Scott <nathans@redhat.com> - 6.2.2-6
 - Update hacluster PMDA for pacemaker 2.1.6 crm_mon (RHEL-50693)