Merge 9.4 stable and 9.5 beta releases
This commit is contained in:
parent
1064e55c38
commit
c7566870f2
@ -1,2 +1,2 @@
|
|||||||
65095a4cddfad3ec6e119ea127050ea68ff8676d SOURCES/pcp-6.2.2.src.tar.gz
|
65095a4cddfad3ec6e119ea127050ea68ff8676d SOURCES/pcp-6.2.2.src.tar.gz
|
||||||
17b4396eb6593178f6c29db6f0eb01234eb6dba0 SOURCES/redhat-issues-RHEL-50693-hacluster-metrics-update.patch
|
e9a7873944492e28e2f9c5fd0c9bfac12ef7596e SOURCES/redhat-issues-RHEL-50693-hacluster-metrics-update.patch
|
||||||
|
|||||||
113
SOURCES/redhat-issues-RHEL-34586-pmproxy-pmcd-fd-leak.patch
Normal file
113
SOURCES/redhat-issues-RHEL-34586-pmproxy-pmcd-fd-leak.patch
Normal file
@ -0,0 +1,113 @@
|
|||||||
|
diff -Naurp pcp-5.3.7.orig/src/libpcp_web/src/load.h pcp-5.3.7/src/libpcp_web/src/load.h
|
||||||
|
--- pcp-5.3.7.orig/src/libpcp_web/src/load.h 2021-02-17 15:27:41.000000000 +1100
|
||||||
|
+++ pcp-5.3.7/src/libpcp_web/src/load.h 2024-09-09 13:45:56.531933622 +1000
|
||||||
|
@@ -42,8 +42,9 @@ typedef struct context {
|
||||||
|
unsigned int setup : 1; /* context established */
|
||||||
|
unsigned int cached : 1; /* context/source in cache */
|
||||||
|
unsigned int garbage : 1; /* context pending removal */
|
||||||
|
+ unsigned int inactive: 1; /* context removal deferred */
|
||||||
|
unsigned int updated : 1; /* context labels are updated */
|
||||||
|
- unsigned int padding : 4; /* zero-filled struct padding */
|
||||||
|
+ unsigned int padding : 3; /* zero-filled struct padding */
|
||||||
|
unsigned int refcount : 16; /* currently-referenced counter */
|
||||||
|
unsigned int timeout; /* context timeout in milliseconds */
|
||||||
|
uv_timer_t timer;
|
||||||
|
diff -Naurp pcp-5.3.7.orig/src/libpcp_web/src/webgroup.c pcp-5.3.7/src/libpcp_web/src/webgroup.c
|
||||||
|
--- pcp-5.3.7.orig/src/libpcp_web/src/webgroup.c 2024-09-09 13:44:34.166748200 +1000
|
||||||
|
+++ pcp-5.3.7/src/libpcp_web/src/webgroup.c 2024-09-09 13:45:56.531933622 +1000
|
||||||
|
@@ -134,9 +134,18 @@ webgroup_timeout_context(uv_timer_t *arg
|
||||||
|
* is returned to zero by the caller, or background cleanup
|
||||||
|
* finds this context and cleans it.
|
||||||
|
*/
|
||||||
|
- if (cp->refcount == 0 && cp->garbage == 0) {
|
||||||
|
- cp->garbage = 1;
|
||||||
|
- uv_timer_stop(&cp->timer);
|
||||||
|
+ if (cp->refcount == 0) {
|
||||||
|
+ if (cp->garbage == 0) {
|
||||||
|
+ cp->garbage = 1;
|
||||||
|
+ uv_timer_stop(&cp->timer);
|
||||||
|
+ }
|
||||||
|
+ } else {
|
||||||
|
+ /*
|
||||||
|
+ * Context timed out but still referenced, must wait
|
||||||
|
+ * until the caller releases its reference (shortly)
|
||||||
|
+ * before beginning garbage collection process.
|
||||||
|
+ */
|
||||||
|
+ cp->inactive = 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -298,20 +307,28 @@ webgroup_garbage_collect(struct webgroup
|
||||||
|
dictIterator *iterator;
|
||||||
|
dictEntry *entry;
|
||||||
|
context_t *cp;
|
||||||
|
- unsigned int count = 0, drops = 0;
|
||||||
|
+ unsigned int count = 0, drops = 0, garbageset = 0, inactiveset = 0;
|
||||||
|
|
||||||
|
if (pmDebugOptions.http || pmDebugOptions.libweb)
|
||||||
|
- fprintf(stderr, "%s: started\n", "webgroup_garbage_collect");
|
||||||
|
+ fprintf(stderr, "%s: started for groups %p\n",
|
||||||
|
+ "webgroup_garbage_collect", groups);
|
||||||
|
|
||||||
|
/* do context GC if we get the lock (else don't block here) */
|
||||||
|
if (uv_mutex_trylock(&groups->mutex) == 0) {
|
||||||
|
iterator = dictGetSafeIterator(groups->contexts);
|
||||||
|
for (entry = dictNext(iterator); entry;) {
|
||||||
|
cp = (context_t *)dictGetVal(entry);
|
||||||
|
+ if (cp->privdata != groups)
|
||||||
|
+ continue;
|
||||||
|
entry = dictNext(iterator);
|
||||||
|
- if (cp->garbage && cp->privdata == groups) {
|
||||||
|
+ if (cp->garbage)
|
||||||
|
+ garbageset++;
|
||||||
|
+ if (cp->inactive && cp->refcount == 0)
|
||||||
|
+ inactiveset++;
|
||||||
|
+ if (cp->garbage || (cp->inactive && cp->refcount == 0)) {
|
||||||
|
if (pmDebugOptions.http || pmDebugOptions.libweb)
|
||||||
|
- fprintf(stderr, "GC context %u (%p)\n", cp->randomid, cp);
|
||||||
|
+ fprintf(stderr, "GC dropping context %u (%p)\n",
|
||||||
|
+ cp->randomid, cp);
|
||||||
|
uv_mutex_unlock(&groups->mutex);
|
||||||
|
webgroup_drop_context(cp, groups);
|
||||||
|
uv_mutex_lock(&groups->mutex);
|
||||||
|
@@ -324,7 +341,8 @@ webgroup_garbage_collect(struct webgroup
|
||||||
|
/* if dropping the last remaining context, do cleanup */
|
||||||
|
if (groups->active && drops == count) {
|
||||||
|
if (pmDebugOptions.http || pmDebugOptions.libweb)
|
||||||
|
- fprintf(stderr, "%s: freezing\n", "webgroup_garbage_collect");
|
||||||
|
+ fprintf(stderr, "%s: freezing groups %p\n",
|
||||||
|
+ "webgroup_garbage_collect", groups);
|
||||||
|
webgroup_timers_stop(groups);
|
||||||
|
}
|
||||||
|
uv_mutex_unlock(&groups->mutex);
|
||||||
|
@@ -334,8 +352,10 @@ webgroup_garbage_collect(struct webgroup
|
||||||
|
mmv_set(groups->map, groups->metrics[WEBGROUP_GC_COUNT], &count);
|
||||||
|
|
||||||
|
if (pmDebugOptions.http || pmDebugOptions.libweb)
|
||||||
|
- fprintf(stderr, "%s: finished [%u drops from %u entries]\n",
|
||||||
|
- "webgroup_garbage_collect", drops, count);
|
||||||
|
+ fprintf(stderr, "%s: finished [%u drops from %u entries,"
|
||||||
|
+ " %u garbageset, %u inactiveset]\n",
|
||||||
|
+ "webgroup_garbage_collect", drops, count,
|
||||||
|
+ garbageset, inactiveset);
|
||||||
|
}
|
||||||
|
|
||||||
|
static void
|
||||||
|
@@ -354,7 +374,7 @@ webgroup_use_context(struct context *cp,
|
||||||
|
int sts;
|
||||||
|
struct webgroups *gp = (struct webgroups *)cp->privdata;
|
||||||
|
|
||||||
|
- if (cp->garbage == 0) {
|
||||||
|
+ if (cp->garbage == 0 && cp->inactive == 0) {
|
||||||
|
if (cp->setup == 0) {
|
||||||
|
if ((sts = pmReconnectContext(cp->context)) < 0) {
|
||||||
|
infofmt(*message, "cannot reconnect context: %s",
|
||||||
|
@@ -424,7 +444,7 @@ webgroup_lookup_context(pmWebGroupSettin
|
||||||
|
*status = -ENOTCONN;
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
- if (cp->garbage == 0) {
|
||||||
|
+ if (cp->garbage == 0 && cp->inactive == 0) {
|
||||||
|
access.username = cp->username;
|
||||||
|
access.password = cp->password;
|
||||||
|
access.realm = cp->realm;
|
||||||
1349
SOURCES/redhat-issues-RHEL-57788-pmdahacluster-update.patch
Normal file
1349
SOURCES/redhat-issues-RHEL-57788-pmdahacluster-update.patch
Normal file
File diff suppressed because it is too large
Load Diff
419
SOURCES/redhat-issues-RHEL-57796-pmcd-pmstore-corruption.patch
Normal file
419
SOURCES/redhat-issues-RHEL-57796-pmcd-pmstore-corruption.patch
Normal file
@ -0,0 +1,419 @@
|
|||||||
|
diff -Naurp pcp-6.2.0.orig/qa/1518 pcp-6.2.0/qa/1518
|
||||||
|
--- pcp-6.2.0.orig/qa/1518 1970-01-01 10:00:00.000000000 +1000
|
||||||
|
+++ pcp-6.2.0/qa/1518 2024-09-17 10:11:45.805874610 +1000
|
||||||
|
@@ -0,0 +1,75 @@
|
||||||
|
+#!/bin/sh
|
||||||
|
+# PCP QA Test No. 1518
|
||||||
|
+# SUSE Issue A)
|
||||||
|
+# __pmDecodeValueSet() Miscalculates Available Buffer Space
|
||||||
|
+# Leading to a Possible Heap Corruption
|
||||||
|
+#
|
||||||
|
+# Copyright (c) 2024 Ken McDonell. All Rights Reserved.
|
||||||
|
+# Copyright (c) 2024 Matthias Gerstner. All Rights Reserved.
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+if [ $# -eq 0 ]
|
||||||
|
+then
|
||||||
|
+ seq=`basename $0`
|
||||||
|
+ echo "QA output created by $seq"
|
||||||
|
+else
|
||||||
|
+ # use $seq from caller, unless not set
|
||||||
|
+ [ -n "$seq" ] || seq=`basename $0`
|
||||||
|
+ echo "QA output created by `basename $0` $*"
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
+# get standard environment, filters and checks
|
||||||
|
+. ./common.product
|
||||||
|
+. ./common.filter
|
||||||
|
+. ./common.check
|
||||||
|
+
|
||||||
|
+$sudo rm -rf $tmp $tmp.* $seq.full
|
||||||
|
+
|
||||||
|
+which nc >/dev/null 2>&1 || _notrun "no nc executable installed"
|
||||||
|
+_check_valgrind
|
||||||
|
+
|
||||||
|
+_cleanup()
|
||||||
|
+{
|
||||||
|
+ cat pmcd.log >>$here/$seq.full
|
||||||
|
+ cd $here
|
||||||
|
+ $sudo rm -rf $tmp $tmp.*
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+status=0 # success is the default!
|
||||||
|
+trap "_cleanup; exit \$status" 0 1 2 3 15
|
||||||
|
+
|
||||||
|
+_filter()
|
||||||
|
+{
|
||||||
|
+ sed \
|
||||||
|
+ -e '/^Command: /d' \
|
||||||
|
+ # end
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+mkdir $tmp || exit 1
|
||||||
|
+cd $tmp
|
||||||
|
+grep sampledso $PCP_PMCDCONF_PATH >pmcd.conf
|
||||||
|
+cat pmcd.conf >>$here/$seq.full
|
||||||
|
+port=`_find_free_port`
|
||||||
|
+echo "port=$port" >>$here/$seq.full
|
||||||
|
+
|
||||||
|
+# real QA test starts here
|
||||||
|
+valgrind $PCP_BINADM_DIR/pmcd -f -Dpdu -c ./pmcd.conf -s ./pmcd.socket -p $port >out 2>err &
|
||||||
|
+valgrind_pid=$!
|
||||||
|
+sleep 2
|
||||||
|
+pmcd_pid=`$PCP_PS_PROG $PCP_PS_ALL_FLAGS | grep '[p]mcd -f -Dpdu' | $PCP_AWK_PROG '{ print $2 }'`
|
||||||
|
+echo "pmcd_pid=$pmcd_pid" >>$here/$seq.full
|
||||||
|
+nc -N -U ./pmcd.socket <$here/binary/decode-value-set-out-of-bound-write 2>&1 \
|
||||||
|
+| od -c >>$here/$seq.full
|
||||||
|
+sleep 2
|
||||||
|
+kill -TERM $pmcd_pid
|
||||||
|
+wait
|
||||||
|
+
|
||||||
|
+echo "expect error to be logged ..."
|
||||||
|
+grep __pmDecodeValueSet pmcd.log
|
||||||
|
+
|
||||||
|
+echo
|
||||||
|
+echo "and no valgrind badness ..."
|
||||||
|
+cat out err | _filter_valgrind | _filter
|
||||||
|
+
|
||||||
|
+# success, all done
|
||||||
|
+exit
|
||||||
|
diff -Naurp pcp-6.2.0.orig/qa/1518.out pcp-6.2.0/qa/1518.out
|
||||||
|
--- pcp-6.2.0.orig/qa/1518.out 1970-01-01 10:00:00.000000000 +1000
|
||||||
|
+++ pcp-6.2.0/qa/1518.out 2024-09-17 10:11:45.806874611 +1000
|
||||||
|
@@ -0,0 +1,11 @@
|
||||||
|
+QA output created by 1518
|
||||||
|
+expect error to be logged ...
|
||||||
|
+__pmDecodeValueSet: PM_ERR_IPC: pmid[0] value[0] vindex=1020 (max=255)
|
||||||
|
+
|
||||||
|
+and no valgrind badness ...
|
||||||
|
+Memcheck, a memory error detector
|
||||||
|
+LEAK SUMMARY:
|
||||||
|
+definitely lost: 0 bytes in 0 blocks
|
||||||
|
+indirectly lost: 0 bytes in 0 blocks
|
||||||
|
+Rerun with --leak-check=full to see details of leaked memory
|
||||||
|
+ERROR SUMMARY: 0 errors from 0 contexts ...
|
||||||
|
diff -Naurp pcp-6.2.0.orig/qa/group pcp-6.2.0/qa/group
|
||||||
|
--- pcp-6.2.0.orig/qa/group 2024-02-11 23:48:09.000000000 +1100
|
||||||
|
+++ pcp-6.2.0/qa/group 2024-09-17 10:11:45.815874621 +1000
|
||||||
|
@@ -1984,7 +1984,7 @@ x11
|
||||||
|
1515 pmda.denki local valgrind
|
||||||
|
1516:reserved kenj
|
||||||
|
1517:reserved kenj
|
||||||
|
-1518:reserved kenj
|
||||||
|
+1518 pmcd libpcp local
|
||||||
|
1519:reserved kenj
|
||||||
|
1530 pmda.zfs local valgrind
|
||||||
|
1531 pmda.zfs local valgrind
|
||||||
|
diff -Naurp pcp-6.2.0.orig/src/libpcp/src/endian.c pcp-6.2.0/src/libpcp/src/endian.c
|
||||||
|
--- pcp-6.2.0.orig/src/libpcp/src/endian.c 2023-11-16 17:51:39.000000000 +1100
|
||||||
|
+++ pcp-6.2.0/src/libpcp/src/endian.c 2024-09-17 10:11:45.820874627 +1000
|
||||||
|
@@ -275,13 +275,17 @@ ntohEventArray(pmValueBlock * const vb,
|
||||||
|
}
|
||||||
|
|
||||||
|
void
|
||||||
|
-__ntohpmValueBlock(pmValueBlock * const vb)
|
||||||
|
+__ntohpmValueBlock_hdr(pmValueBlock * const vb)
|
||||||
|
{
|
||||||
|
unsigned int *ip = (unsigned int *)vb;
|
||||||
|
|
||||||
|
/* Swab the first word, which contain vtype and vlen */
|
||||||
|
*ip = ntohl(*ip);
|
||||||
|
+}
|
||||||
|
|
||||||
|
+void
|
||||||
|
+__ntohpmValueBlock_buf(pmValueBlock * const vb)
|
||||||
|
+{
|
||||||
|
switch (vb->vtype) {
|
||||||
|
case PM_TYPE_U64:
|
||||||
|
case PM_TYPE_64:
|
||||||
|
@@ -305,6 +309,13 @@ __ntohpmValueBlock(pmValueBlock * const
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+void
|
||||||
|
+__ntohpmValueBlock(pmValueBlock * const vb)
|
||||||
|
+{
|
||||||
|
+ __ntohpmValueBlock_hdr(vb);
|
||||||
|
+ __ntohpmValueBlock_buf(vb);
|
||||||
|
+}
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#ifndef __htonpmPDUInfo
|
||||||
|
diff -Naurp pcp-6.2.0.orig/src/libpcp/src/internal.h pcp-6.2.0/src/libpcp/src/internal.h
|
||||||
|
--- pcp-6.2.0.orig/src/libpcp/src/internal.h 2023-11-16 17:51:39.000000000 +1100
|
||||||
|
+++ pcp-6.2.0/src/libpcp/src/internal.h 2024-09-17 10:11:45.823874630 +1000
|
||||||
|
@@ -60,6 +60,8 @@ extern int __pmGetDate(struct timespec *
|
||||||
|
#define __ntohpmLabel(a) /* noop */
|
||||||
|
#define __htonpmValueBlock(a) /* noop */
|
||||||
|
#define __ntohpmValueBlock(a) /* noop */
|
||||||
|
+#define __ntohpmValueBlock_hdr(a) /* noop */
|
||||||
|
+#define __ntohpmValueBlock_buf(a) /* noop */
|
||||||
|
#define __htonf(a) /* noop */
|
||||||
|
#define __ntohf(a) /* noop */
|
||||||
|
#define __htond(a) /* noop */
|
||||||
|
@@ -90,6 +92,8 @@ extern void __htonpmLabel(pmLabel * cons
|
||||||
|
extern void __ntohpmLabel(pmLabel * const) _PCP_HIDDEN;
|
||||||
|
extern void __htonpmValueBlock(pmValueBlock * const) _PCP_HIDDEN;
|
||||||
|
extern void __ntohpmValueBlock(pmValueBlock * const) _PCP_HIDDEN;
|
||||||
|
+extern void __ntohpmValueBlock_hdr(pmValueBlock * const) _PCP_HIDDEN;
|
||||||
|
+extern void __ntohpmValueBlock_buf(pmValueBlock * const) _PCP_HIDDEN;
|
||||||
|
extern void __htonf(char *) _PCP_HIDDEN; /* float */
|
||||||
|
#define __ntohf(v) __htonf(v)
|
||||||
|
#define __htond(v) __htonll(v) /* double */
|
||||||
|
diff -Naurp pcp-6.2.0.orig/src/libpcp/src/p_result.c pcp-6.2.0/src/libpcp/src/p_result.c
|
||||||
|
--- pcp-6.2.0.orig/src/libpcp/src/p_result.c 2023-11-16 17:51:39.000000000 +1100
|
||||||
|
+++ pcp-6.2.0/src/libpcp/src/p_result.c 2024-09-17 10:18:17.264314112 +1000
|
||||||
|
@@ -323,6 +323,135 @@ __pmSendHighResResult(int fd, int from,
|
||||||
|
return __pmSendHighResResult_ctx(NULL, fd, from, result);
|
||||||
|
}
|
||||||
|
|
||||||
|
+/* Check that a network encoded event array is within a given buffer size */
|
||||||
|
+int
|
||||||
|
+__pmEventArrayCheck(pmValueBlock * const vb, int highres, int pmid, int value, size_t check)
|
||||||
|
+{
|
||||||
|
+ char *base;
|
||||||
|
+ int r; /* records */
|
||||||
|
+ int p; /* parameters in a record ... */
|
||||||
|
+ int nrecords;
|
||||||
|
+ int nparams;
|
||||||
|
+
|
||||||
|
+ if (highres) {
|
||||||
|
+ pmHighResEventArray *hreap = (pmHighResEventArray *)vb;
|
||||||
|
+ base = (char *)&hreap->ea_record[0];
|
||||||
|
+ if (base > (char *)vb + check) {
|
||||||
|
+ if (pmDebugOptions.pdu)
|
||||||
|
+ fprintf(stderr, "__pmEventArrayCheck #1: PM_ERR_IPC: pmid[%d] value[%d] highres event records past end of PDU buffer\n",
|
||||||
|
+ pmid, value);
|
||||||
|
+ return PM_ERR_IPC;
|
||||||
|
+ }
|
||||||
|
+ nrecords = ntohl(hreap->ea_nrecords);
|
||||||
|
+ }
|
||||||
|
+ else {
|
||||||
|
+ pmEventArray *eap = (pmEventArray *)vb;
|
||||||
|
+ base = (char *)&eap->ea_record[0];
|
||||||
|
+ if (base > (char *)vb + check) {
|
||||||
|
+ if (pmDebugOptions.pdu)
|
||||||
|
+ fprintf(stderr, "__pmEventArrayCheck #2: PM_ERR_IPC: pmid[%d] value[%d] event records past end of PDU buffer\n",
|
||||||
|
+ pmid, value);
|
||||||
|
+ return PM_ERR_IPC;
|
||||||
|
+ }
|
||||||
|
+ nrecords = ntohl(eap->ea_nrecords);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /* walk packed event record array */
|
||||||
|
+ for (r = 0; r < nrecords; r++) {
|
||||||
|
+ unsigned int flags, type;
|
||||||
|
+ size_t size, remaining;
|
||||||
|
+
|
||||||
|
+ remaining = check - (base - (char *)vb);
|
||||||
|
+ if (highres) {
|
||||||
|
+ pmHighResEventRecord *hrerp = (pmHighResEventRecord *)base;
|
||||||
|
+ size = sizeof(hrerp->er_timestamp) + sizeof(hrerp->er_flags) +
|
||||||
|
+ sizeof(hrerp->er_nparams);
|
||||||
|
+ if (size > remaining) {
|
||||||
|
+ if (pmDebugOptions.pdu)
|
||||||
|
+ fprintf(stderr, "__pmEventArrayCheck #3: PM_ERR_IPC: pmid[%d] value[%d] record[%d] highres event record past end of PDU buffer\n",
|
||||||
|
+ pmid, value, r);
|
||||||
|
+ return PM_ERR_IPC;
|
||||||
|
+ }
|
||||||
|
+ nparams = ntohl(hrerp->er_nparams);
|
||||||
|
+ flags = ntohl(hrerp->er_flags);
|
||||||
|
+ }
|
||||||
|
+ else {
|
||||||
|
+ pmEventRecord *erp = (pmEventRecord *)base;
|
||||||
|
+ size = sizeof(erp->er_timestamp) + sizeof(erp->er_flags) +
|
||||||
|
+ sizeof(erp->er_nparams);
|
||||||
|
+ if (size > remaining) {
|
||||||
|
+ if (pmDebugOptions.pdu)
|
||||||
|
+ fprintf(stderr, "__pmEventArrayCheck #4: PM_ERR_IPC: pmid[%d] value[%d] record[%d] event record past end of PDU buffer\n",
|
||||||
|
+ pmid, value, r);
|
||||||
|
+ return PM_ERR_IPC;
|
||||||
|
+ }
|
||||||
|
+ nparams = ntohl(erp->er_nparams);
|
||||||
|
+ flags = ntohl(erp->er_flags);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (flags & PM_EVENT_FLAG_MISSED)
|
||||||
|
+ nparams = 0;
|
||||||
|
+
|
||||||
|
+ base += size;
|
||||||
|
+ remaining = check - (base - (char *)vb);
|
||||||
|
+
|
||||||
|
+ for (p = 0; p < nparams; p++) {
|
||||||
|
+ __uint32_t *tp; /* points to int holding vtype/vlen */
|
||||||
|
+ pmEventParameter *epp = (pmEventParameter *)base;
|
||||||
|
+
|
||||||
|
+ if (sizeof(pmEventParameter) > remaining) {
|
||||||
|
+ if (pmDebugOptions.pdu)
|
||||||
|
+ fprintf(stderr, "__pmEventArrayCheck #5: PM_ERR_IPC: pmid[%d] value[%d] record[%d] param[%d] event record past end of PDU buffer\n",
|
||||||
|
+ pmid, value, r, p);
|
||||||
|
+ return PM_ERR_IPC;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ tp = (__uint32_t *)&epp->ep_pmid;
|
||||||
|
+ tp++; /* now points to ep_type/ep_len */
|
||||||
|
+ *tp = ntohl(*tp);
|
||||||
|
+ type = epp->ep_type;
|
||||||
|
+ size = epp->ep_len;
|
||||||
|
+ *tp = htonl(*tp); /* leave the buffer how we found it */
|
||||||
|
+
|
||||||
|
+ if (sizeof(pmID) + size > remaining) {
|
||||||
|
+ if (pmDebugOptions.pdu)
|
||||||
|
+ fprintf(stderr, "__pmEventArrayCheck #6: PM_ERR_IPC: pmid[%d] value[%d] record[%d] param[%d] event record past end of PDU buffer\n",
|
||||||
|
+ pmid, value, r, p);
|
||||||
|
+ return PM_ERR_IPC;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ base += sizeof(pmID) + PM_PDU_SIZE_BYTES(size);
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * final check for the types below, ep_len should be 4 or
|
||||||
|
+ * 8, but a malformed PDU could have smaller ep_len values
|
||||||
|
+ * and then unpacking these types risk going past the end
|
||||||
|
+ * of the PDU buffer
|
||||||
|
+ */
|
||||||
|
+ size = 0;
|
||||||
|
+ switch (type) {
|
||||||
|
+ case PM_TYPE_32:
|
||||||
|
+ case PM_TYPE_U32:
|
||||||
|
+ case PM_TYPE_FLOAT:
|
||||||
|
+ size = 4; /* 32-bit types */
|
||||||
|
+ break;
|
||||||
|
+ case PM_TYPE_64:
|
||||||
|
+ case PM_TYPE_U64:
|
||||||
|
+ case PM_TYPE_DOUBLE:
|
||||||
|
+ size = 8; /* 64-bit types */
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+ if (size > 0 && sizeof(pmID) + size > remaining) {
|
||||||
|
+ if (pmDebugOptions.pdu)
|
||||||
|
+ fprintf(stderr, "__pmEventArrayCheck #7: PM_ERR_IPC: pmid[%d] value[%d] record[%d] param[%d] event record past end of PDU buffer\n",
|
||||||
|
+ pmid, value, r, p);
|
||||||
|
+ return PM_ERR_IPC;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
#if defined(HAVE_64BIT_PTR)
|
||||||
|
int
|
||||||
|
__pmDecodeValueSet(__pmPDU *pdubuf, int pdulen, __pmPDU *data, char *pduend,
|
||||||
|
@@ -336,7 +465,7 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
|
||||||
|
int i, j;
|
||||||
|
/*
|
||||||
|
* Note: all sizes are in units of bytes ... beware that 'data' is in
|
||||||
|
- * units of __pmPDU
|
||||||
|
+ * units of __pmPDU (four bytes)
|
||||||
|
*/
|
||||||
|
int vsize; /* size of vlist_t's in PDU buffer */
|
||||||
|
int nvsize; /* size of pmValue's after decode */
|
||||||
|
@@ -414,11 +543,10 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
|
||||||
|
return PM_ERR_IPC;
|
||||||
|
}
|
||||||
|
vindex = ntohl(pduvp->value.lval);
|
||||||
|
- if (vindex < 0 || vindex > pdulen) {
|
||||||
|
+ if (vindex < 0 || (char *)&pdubuf[vindex] >= pduend) {
|
||||||
|
if (pmDebugOptions.pdu && pmDebugOptions.desperate)
|
||||||
|
- fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
|
||||||
|
- "vindex=%d\n",
|
||||||
|
- "__pmDecodeValueSet", i, j, vindex);
|
||||||
|
+ fprintf(stderr, "__pmDecodeValueSet: PM_ERR_IPC: pmid[%d] value[%d] vindex=%d (max=%ld)\n",
|
||||||
|
+ i, j, vindex, (long)((pduend-(char *)pdubuf) / sizeof(pdubuf[0])-1));
|
||||||
|
return PM_ERR_IPC;
|
||||||
|
}
|
||||||
|
pduvbp = (pmValueBlock *)&pdubuf[vindex];
|
||||||
|
@@ -427,29 +555,31 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
|
||||||
|
check = (size_t)(pduend - (char *)pduvbp);
|
||||||
|
if (sizeof(unsigned int) > check) {
|
||||||
|
if (pmDebugOptions.pdu && pmDebugOptions.desperate)
|
||||||
|
- fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
|
||||||
|
- "second pduvp past end of "
|
||||||
|
- "PDU buffer\n",
|
||||||
|
- "__pmDecodeValueSet", i, j);
|
||||||
|
+ fprintf(stderr, "__pmDecodeValueSet: PM_ERR_IPC: pmid[%d] value[%d] second pduvp past end of PDU buffer\n",
|
||||||
|
+ i, j);
|
||||||
|
return PM_ERR_IPC;
|
||||||
|
}
|
||||||
|
-
|
||||||
|
- __ntohpmValueBlock(pduvbp);
|
||||||
|
+ __ntohpmValueBlock_hdr(pduvbp);
|
||||||
|
if (pduvbp->vlen < PM_VAL_HDR_SIZE ||
|
||||||
|
pduvbp->vlen > pdulen) {
|
||||||
|
- if (pmDebugOptions.pdu && pmDebugOptions.desperate)
|
||||||
|
- fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
|
||||||
|
- "vlen=%d\n", "__pmDecodeValueSet",
|
||||||
|
- i, j, pduvbp->vlen);
|
||||||
|
+ if (pmDebugOptions.pdu)
|
||||||
|
+ fprintf(stderr, "__pmDecodeValueSet: PM_ERR_IPC: pmid[%d] value[%d] vlen=%d\n",
|
||||||
|
+ i, j, pduvbp->vlen);
|
||||||
|
return PM_ERR_IPC;
|
||||||
|
}
|
||||||
|
- if (pduvbp->vlen > (size_t)(pduend - (char *)pduvbp)) {
|
||||||
|
- if (pmDebugOptions.pdu && pmDebugOptions.desperate)
|
||||||
|
- fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
|
||||||
|
- "pduvp past end of PDU buffer\n",
|
||||||
|
- "__pmDecodeValueSet", i, j);
|
||||||
|
+ if (pduvbp->vlen > check) {
|
||||||
|
+ if (pmDebugOptions.pdu)
|
||||||
|
+ fprintf(stderr, "__pmDecodeValueSet: PM_ERR_IPC: pmid[%d] value[%d] pduvp past end of PDU buffer\n",
|
||||||
|
+ i, j);
|
||||||
|
return PM_ERR_IPC;
|
||||||
|
}
|
||||||
|
+ if (pduvbp->vtype == PM_TYPE_HIGHRES_EVENT ||
|
||||||
|
+ pduvbp->vtype == PM_TYPE_EVENT) {
|
||||||
|
+ vindex = (pduvbp->vtype == PM_TYPE_HIGHRES_EVENT);
|
||||||
|
+ if (__pmEventArrayCheck(pduvbp, vindex, i, j, check) < 0)
|
||||||
|
+ return PM_ERR_IPC;
|
||||||
|
+ }
|
||||||
|
+ __ntohpmValueBlock_buf(pduvbp);
|
||||||
|
vbsize += PM_PDU_SIZE_BYTES(pduvbp->vlen);
|
||||||
|
if (pmDebugOptions.pdu && pmDebugOptions.desperate) {
|
||||||
|
fprintf(stderr, " len: %d type: %d",
|
||||||
|
@@ -682,11 +812,10 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
|
||||||
|
} else {
|
||||||
|
/* salvage pmValueBlocks from end of PDU */
|
||||||
|
vindex = ntohl(pduvp->value.lval);
|
||||||
|
- if (vindex < 0 || vindex > pdulen) {
|
||||||
|
+ if (vindex < 0 || (char *)&pdubuf[vindex] >= pduend) {
|
||||||
|
if (pmDebugOptions.pdu && pmDebugOptions.desperate)
|
||||||
|
- fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
|
||||||
|
- "vindex=%d\n",
|
||||||
|
- "__pmDecodeValueSet", i, j, vindex);
|
||||||
|
+ fprintf(stderr, "__pmDecodeValueSet: PM_ERR_IPC: pmid[%d] value[%d] vindex=%d (max=%ld)\n",
|
||||||
|
+ i, j, vindex, (long)((pduend-(char *)pdubuf) / sizeof(pdubuf[0])-1));
|
||||||
|
return PM_ERR_IPC;
|
||||||
|
}
|
||||||
|
pduvbp = (pmValueBlock *)&pdubuf[vindex];
|
||||||
|
@@ -701,7 +830,7 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
|
||||||
|
"__pmDecodeValueSet", i, j);
|
||||||
|
return PM_ERR_IPC;
|
||||||
|
}
|
||||||
|
- __ntohpmValueBlock(pduvbp);
|
||||||
|
+ __ntohpmValueBlock_hdr(pduvbp);
|
||||||
|
if (pduvbp->vlen < PM_VAL_HDR_SIZE ||
|
||||||
|
pduvbp->vlen > pdulen) {
|
||||||
|
if (pmDebugOptions.pdu && pmDebugOptions.desperate)
|
||||||
|
@@ -710,13 +839,20 @@ __pmDecodeValueSet(__pmPDU *pdubuf, int
|
||||||
|
i, j, pduvbp->vlen);
|
||||||
|
return PM_ERR_IPC;
|
||||||
|
}
|
||||||
|
- if (pduvbp->vlen > (size_t)(pduend - (char *)pduvbp)) {
|
||||||
|
+ if (pduvbp->vlen > check) {
|
||||||
|
if (pmDebugOptions.pdu && pmDebugOptions.desperate)
|
||||||
|
fprintf(stderr, "%s: Bad: pmid[%d] value[%d] "
|
||||||
|
"pduvp past end of PDU buffer\n",
|
||||||
|
"__pmDecodeValueSet", i, j);
|
||||||
|
return PM_ERR_IPC;
|
||||||
|
}
|
||||||
|
+ if (pduvbp->vtype == PM_TYPE_HIGHRES_EVENT ||
|
||||||
|
+ pduvbp->vtype == PM_TYPE_EVENT) {
|
||||||
|
+ vindex = (pduvbp->vtype == PM_TYPE_HIGHRES_EVENT);
|
||||||
|
+ if (__pmEventArrayCheck(pduvbp, vindex, i, j, check) < 0)
|
||||||
|
+ return PM_ERR_IPC;
|
||||||
|
+ }
|
||||||
|
+ __ntohpmValueBlock_buf(pduvbp);
|
||||||
|
pduvp->value.pval = pduvbp;
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,99 @@
|
|||||||
|
diff -Naurp pcp-5.3.7.orig/qa/640 pcp-5.3.7/qa/640
|
||||||
|
--- pcp-5.3.7.orig/qa/640 2017-08-17 10:54:57.000000000 +1000
|
||||||
|
+++ pcp-5.3.7/qa/640 2024-09-09 13:41:12.440235947 +1000
|
||||||
|
@@ -6,6 +6,10 @@
|
||||||
|
# years; so we now simply check the right permissions are in place
|
||||||
|
# and move right along...
|
||||||
|
#
|
||||||
|
+# Aug 2024 update
|
||||||
|
+# SuSE Issue G identifies another possible exploit, so try that
|
||||||
|
+# as well.
|
||||||
|
+#
|
||||||
|
# Copyright (c) 1995-2002 Silicon Graphics, Inc. All Rights Reserved.
|
||||||
|
#
|
||||||
|
|
||||||
|
@@ -17,13 +21,54 @@ echo "QA output created by $seq"
|
||||||
|
. ./common.filter
|
||||||
|
. ./common.check
|
||||||
|
|
||||||
|
-status=0 # success is the default!
|
||||||
|
-trap "$sudo rm -f $tmp.*; exit \$status" 0 1 2 3 15
|
||||||
|
+rm -f $seq.full
|
||||||
|
+ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
|
||||||
|
+
|
||||||
|
+_cleanup()
|
||||||
|
+{
|
||||||
|
+ if [ -f $PCP_LOG_DIR/NOTICES.$seq ]
|
||||||
|
+ then
|
||||||
|
+ $sudo rm -f $PCP_LOG_DIR/NOTICES
|
||||||
|
+ $sudo mv $PCP_LOG_DIR/NOTICES.$seq $PCP_LOG_DIR/NOTICES
|
||||||
|
+ fi
|
||||||
|
+ ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
|
||||||
|
+ $sudo rm -rf $tmp $tmp.*
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+status=1 # failure is the default!
|
||||||
|
+trap "_cleanup; exit \$status" 0 1 2 3 15
|
||||||
|
+
|
||||||
|
+_filter()
|
||||||
|
+{
|
||||||
|
+ sed \
|
||||||
|
+ -e "s@$PCP_LOG_DIR@PCP_LOG_DIR@g" \
|
||||||
|
+ -e '/^pmpost:/s/\[.*]/[DATE]/' \
|
||||||
|
+ # end
|
||||||
|
+}
|
||||||
|
|
||||||
|
# real QA test starts here
|
||||||
|
pmpost=$PCP_BINADM_DIR/pmpost
|
||||||
|
-echo "Using pmpost binary: $pmpost" > $seq.full
|
||||||
|
+echo "Using pmpost binary: $pmpost" >>$seq.full
|
||||||
|
test -u "$pmpost" && echo "FAIL: pmpost has setuid bit set"
|
||||||
|
test -g "$pmpost" && echo "FAIL: pmpost has setgid bit set"
|
||||||
|
+
|
||||||
|
+$sudo mkdir $tmp || exit
|
||||||
|
+$sudo chmod 700 $tmp || exit
|
||||||
|
+$sudo -u $PCP_USER mv $PCP_LOG_DIR/NOTICES $PCP_LOG_DIR/NOTICES.$seq
|
||||||
|
+
|
||||||
|
+$sudo -u $PCP_USER ln -s $tmp/badness $PCP_LOG_DIR/NOTICES >>$seq.full
|
||||||
|
+$pmpost ordinary user 2>&1 | _filter
|
||||||
|
+$sudo ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
|
||||||
|
+$sudo -u pcp $pmpost pcp user 2>&1 | _filter
|
||||||
|
+$sudo ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
|
||||||
|
+$sudo $pmpost root user 2>&1 | _filter
|
||||||
|
+$sudo ls -li $PCP_LOG_DIR/NOTICES $tmp/badness >>$seq.full 2>&1
|
||||||
|
+if $sudo test -f $tmp/badness
|
||||||
|
+then
|
||||||
|
+ $sudo cat $tmp/badness
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
echo "Test complete"
|
||||||
|
+
|
||||||
|
+status=0
|
||||||
|
exit
|
||||||
|
diff -Naurp pcp-5.3.7.orig/qa/640.out pcp-5.3.7/qa/640.out
|
||||||
|
--- pcp-5.3.7.orig/qa/640.out 2017-08-17 10:54:57.000000000 +1000
|
||||||
|
+++ pcp-5.3.7/qa/640.out 2024-09-09 13:41:12.440235947 +1000
|
||||||
|
@@ -1,2 +1,5 @@
|
||||||
|
QA output created by 640
|
||||||
|
+pmpost: unposted message: [DATE] ordinary user
|
||||||
|
+pmpost: unposted message: [DATE] pcp user
|
||||||
|
+pmpost: unposted message: [DATE] root user
|
||||||
|
Test complete
|
||||||
|
diff -Naurp pcp-5.3.7.orig/src/pmpost/pmpost.c pcp-5.3.7/src/pmpost/pmpost.c
|
||||||
|
--- pcp-5.3.7.orig/src/pmpost/pmpost.c 2021-02-17 15:27:41.000000000 +1100
|
||||||
|
+++ pcp-5.3.7/src/pmpost/pmpost.c 2024-09-09 13:41:12.440235947 +1000
|
||||||
|
@@ -144,8 +144,12 @@ main(int argc, char **argv)
|
||||||
|
goto oops;
|
||||||
|
}
|
||||||
|
|
||||||
|
- if ((fd = open(notices, O_WRONLY|O_APPEND, 0)) < 0) {
|
||||||
|
- if ((fd = open(notices, O_WRONLY|O_CREAT|O_APPEND, 0664)) < 0) {
|
||||||
|
+ if ((fd = open(notices, O_WRONLY|O_APPEND|O_NOFOLLOW, 0)) < 0) {
|
||||||
|
+ if (oserror() == ELOOP) {
|
||||||
|
+ /* last component is symlink => attack? ... bail! */
|
||||||
|
+ goto oops;
|
||||||
|
+ }
|
||||||
|
+ if ((fd = open(notices, O_WRONLY|O_CREAT|O_APPEND|O_NOFOLLOW, 0664)) < 0) {
|
||||||
|
fprintf(stderr, "pmpost: cannot open or create file \"%s\": %s\n",
|
||||||
|
notices, osstrerror());
|
||||||
|
goto oops;
|
||||||
@ -1,6 +1,6 @@
|
|||||||
Name: pcp
|
Name: pcp
|
||||||
Version: 6.2.2
|
Version: 6.2.2
|
||||||
Release: 6%{?dist}
|
Release: 7%{?dist}.alma.1
|
||||||
Summary: System-level performance monitoring and performance management
|
Summary: System-level performance monitoring and performance management
|
||||||
License: GPL-2.0-or-later AND LGPL-2.1-or-later AND CC-BY-3.0
|
License: GPL-2.0-or-later AND LGPL-2.1-or-later AND CC-BY-3.0
|
||||||
URL: https://pcp.io
|
URL: https://pcp.io
|
||||||
@ -15,6 +15,11 @@ Patch4: redhat-issues-39159-39132-32983-39293.patch
|
|||||||
Patch5: redhat-issues-RHEL-40718-java-bytecode-update.patch
|
Patch5: redhat-issues-RHEL-40718-java-bytecode-update.patch
|
||||||
Patch6: redhat-issues-RHEL-50693-hacluster-metrics-update.patch
|
Patch6: redhat-issues-RHEL-50693-hacluster-metrics-update.patch
|
||||||
|
|
||||||
|
# Patches were taken from AlmaLinux 9.4
|
||||||
|
Patch7: redhat-issues-RHEL-57796-pmcd-pmstore-corruption.patch
|
||||||
|
Patch8: redhat-issues-RHEL-57799-pmpost-symlink-handling.patch
|
||||||
|
Patch9: redhat-issues-RHEL-34586-pmproxy-pmcd-fd-leak.patch
|
||||||
|
Patch10: redhat-issues-RHEL-57788-pmdahacluster-update.patch
|
||||||
%if 0%{?fedora} >= 40 || 0%{?rhel} >= 10
|
%if 0%{?fedora} >= 40 || 0%{?rhel} >= 10
|
||||||
ExcludeArch: %{ix86}
|
ExcludeArch: %{ix86}
|
||||||
%endif
|
%endif
|
||||||
@ -3544,6 +3549,12 @@ fi
|
|||||||
%files zeroconf -f pcp-zeroconf-files.rpm
|
%files zeroconf -f pcp-zeroconf-files.rpm
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Tue Nov 12 2024 Eduard Abdullin <eabdullin@almalinux.org> - 6.2.0-7.alma.1
|
||||||
|
- Fix buffer sizing checks in pmstore PDU handling
|
||||||
|
- Guard against symlink attacks in pmpost program
|
||||||
|
- Fix libpcp_web webgroup slow request refcounting
|
||||||
|
- Updated pmdahacluster for newer crm_mon versions
|
||||||
|
|
||||||
* Wed Aug 7 2024 Nathan Scott <nathans@redhat.com> - 6.2.2-6
|
* Wed Aug 7 2024 Nathan Scott <nathans@redhat.com> - 6.2.2-6
|
||||||
- Update hacluster PMDA for pacemaker 2.1.6 crm_mon (RHEL-50693)
|
- Update hacluster PMDA for pacemaker 2.1.6 crm_mon (RHEL-50693)
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user