From cd2673fdadb59e6696248e33d7fc6653e7c27c15 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Tue, 26 Jan 2021 11:04:23 +0100 Subject: [PATCH 1/9] Rebase to go1.15.7 Security fix for CVE-2021-3114 and CVE-2021-3115 Resolves: BZ#1918751, BZ#1918763 --- .gitignore | 1 + golang.spec | 9 +++++++-- sources | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 4127c4e..601dabd 100644 --- a/.gitignore +++ b/.gitignore @@ -96,3 +96,4 @@ /go1.15.4.src.tar.gz /go1.15.5.src.tar.gz /go1.15.6.src.tar.gz +/go1.15.7.src.tar.gz diff --git a/golang.spec b/golang.spec index 4f1c9df..5291f7a 100644 --- a/golang.spec +++ b/golang.spec @@ -106,10 +106,10 @@ %endif %global go_api 1.15 -%global go_version 1.15.6 +%global go_version 1.15.7 Name: golang -Version: 1.15.6 +Version: 1.15.7 Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -608,6 +608,11 @@ fi %endif %changelog +* Wed Jan 20 2021 Jakub Čajka - 1.15.7-1 +- Rebase to go1.15.7 +- Security fix for CVE-2021-3114 and CVE-2021-3115 +- Resolves: BZ#1918751, BZ#1918763 + * Fri Dec 04 2020 Jakub Čajka - 1.15.6-1 - Rebase to go1.15.6 - Resolves: BZ#1904238 diff --git a/sources b/sources index d81e4cd..e1f5a6e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.15.6.src.tar.gz) = f20e495204f32170d6554e8f4b64763dae8302a7859005020f650d1d53a5b15de3afbaff28e0b6418287396166c67bdc4c6bee7a0fd7ba8a87bb79b6c1d38326 +SHA512 (go1.15.7.src.tar.gz) = 7b3e8bcd2fc95baad41f8b5f0456c009e01896d160e65c2670d51c23d8cfcf7a6801e831e6f9a8877fe58c8f54ac8f75bf6e7935b38ba7aaa51dc8e46cf76ddb From 643bf673f215fe4d7432ce374032ba9f115a96c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Fri, 5 Feb 2021 13:24:23 +0100 Subject: [PATCH 2/9] Update to go1.15.8 --- .gitignore | 1 + golang.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 601dabd..5a07953 100644 --- a/.gitignore +++ b/.gitignore @@ -97,3 +97,4 @@ /go1.15.5.src.tar.gz /go1.15.6.src.tar.gz /go1.15.7.src.tar.gz +/go1.15.8.src.tar.gz diff --git a/golang.spec b/golang.spec index 5291f7a..206d001 100644 --- a/golang.spec +++ b/golang.spec @@ -106,10 +106,10 @@ %endif %global go_api 1.15 -%global go_version 1.15.7 +%global go_version 1.15.8 Name: golang -Version: 1.15.7 +Version: 1.15.8 Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -608,6 +608,9 @@ fi %endif %changelog +* Fri Feb 05 2021 Jakub Čajka - 1.15.8-1 +- Update to go1.15.8 + * Wed Jan 20 2021 Jakub Čajka - 1.15.7-1 - Rebase to go1.15.7 - Security fix for CVE-2021-3114 and CVE-2021-3115 diff --git a/sources b/sources index e1f5a6e..1082d54 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.15.7.src.tar.gz) = 7b3e8bcd2fc95baad41f8b5f0456c009e01896d160e65c2670d51c23d8cfcf7a6801e831e6f9a8877fe58c8f54ac8f75bf6e7935b38ba7aaa51dc8e46cf76ddb +SHA512 (go1.15.8.src.tar.gz) = 4b805425550aff5c38f1f66fa7f7b3282b20850b1c0735898ee62820080514a2a6ab573f1d6984656c5bb955ec2b10cef90fbb7ab6a6c8f1e75ebc0964a04a80 From 65d082e844518f00ba1477e259c55ab86f42facc Mon Sep 17 00:00:00 2001 From: Edjunior Machado Date: Mon, 18 Jan 2021 00:32:44 +0100 Subject: [PATCH 3/9] Introduce CI gating --- .fmf/version | 1 + gating.yaml | 19 ++++++++ plans/ci.fmf | 6 +++ tests/Sanity/basic-smoke/Makefile | 64 +++++++++++++++++++++++++++ tests/Sanity/basic-smoke/PURPOSE | 3 ++ tests/Sanity/basic-smoke/main.fmf | 13 ++++++ tests/Sanity/basic-smoke/runtest.sh | 68 +++++++++++++++++++++++++++++ 7 files changed, 174 insertions(+) create mode 100644 .fmf/version create mode 100644 gating.yaml create mode 100644 plans/ci.fmf create mode 100644 tests/Sanity/basic-smoke/Makefile create mode 100644 tests/Sanity/basic-smoke/PURPOSE create mode 100644 tests/Sanity/basic-smoke/main.fmf create mode 100755 tests/Sanity/basic-smoke/runtest.sh diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..ce3cdc1 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,19 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} +--- !Policy +product_versions: + - rhel-8 +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} +--- !Policy +product_versions: + - rhel-9 +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} diff --git a/plans/ci.fmf b/plans/ci.fmf new file mode 100644 index 0000000..1ad2c12 --- /dev/null +++ b/plans/ci.fmf @@ -0,0 +1,6 @@ +summary: CI Gating Plan +discover: + how: fmf + directory: tests +execute: + how: beakerlib diff --git a/tests/Sanity/basic-smoke/Makefile b/tests/Sanity/basic-smoke/Makefile new file mode 100644 index 0000000..801fdb1 --- /dev/null +++ b/tests/Sanity/basic-smoke/Makefile @@ -0,0 +1,64 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /tools/golang/Sanity/basic-smoke +# Description: basic smoke test for go +# Author: Edjunior Machado +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2019 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/tools/golang/Sanity/basic-smoke +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Edjunior Machado " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: basic smoke test for go" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: golang" >> $(METADATA) + @echo "Requires: golang" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL6 -RHELClient5 -RHELServer5" >> $(METADATA) + @echo "Architectures: s390x x86_64 ppc64le aarch64" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/tests/Sanity/basic-smoke/PURPOSE b/tests/Sanity/basic-smoke/PURPOSE new file mode 100644 index 0000000..263fb91 --- /dev/null +++ b/tests/Sanity/basic-smoke/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /tools/golang/Sanity/basic-smoke +Description: basic smoke test for go +Author: Edjunior Machado diff --git a/tests/Sanity/basic-smoke/main.fmf b/tests/Sanity/basic-smoke/main.fmf new file mode 100644 index 0000000..3c6d036 --- /dev/null +++ b/tests/Sanity/basic-smoke/main.fmf @@ -0,0 +1,13 @@ +summary: basic smoke test for go +description: '' +contact: +- Edjunior Machado +component: +- golang +test: ./runtest.sh +framework: beakerlib +recommend: +- golang +duration: 5m +extra-summary: /tools/golang/Sanity/basic-smoke +extra-task: /tools/golang/Sanity/basic-smoke diff --git a/tests/Sanity/basic-smoke/runtest.sh b/tests/Sanity/basic-smoke/runtest.sh new file mode 100755 index 0000000..e14b324 --- /dev/null +++ b/tests/Sanity/basic-smoke/runtest.sh @@ -0,0 +1,68 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /tools/golang/Sanity/basic-smoke +# Description: basic smoke test for go +# Author: Edjunior Machado +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2019 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="$(rpm -qf $(which go))" + +# Conserve the non-zero return value through the pipe +set -o pipefail + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlPhaseEnd + + rlPhaseStartTest + cat << EOF > $TmpDir/hello.go +package main +import "fmt" +func main() { + fmt.Println("hello world") +} +EOF + rlAssertExists "$TmpDir/hello.go" + + rlRun "go run $TmpDir/hello.go |& tee $TmpDir/go-run-hello.out" 0 "Testing 'go run'" + rlAssertNotDiffer <(echo 'hello world') go-run-hello.out + + rlRun "go build -o $TmpDir/hello $TmpDir/hello.go" 0 "Testing 'go build'" + rlAssertExists "hello" + + rlRun "$TmpDir/hello |& tee $TmpDir/hello.out" 0 "Running binary" + rlAssertNotDiffer <(echo 'hello world') hello.out + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From e15aaec1b1ce310a089e4ee5d28750760ee40c3e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= Date: Sun, 18 Apr 2021 09:15:39 +0200 Subject: [PATCH 4/9] Update to go1.15.11 --- .gitignore | 1 + golang.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 5a07953..509a126 100644 --- a/.gitignore +++ b/.gitignore @@ -98,3 +98,4 @@ /go1.15.6.src.tar.gz /go1.15.7.src.tar.gz /go1.15.8.src.tar.gz +/go1.15.11.src.tar.gz diff --git a/golang.spec b/golang.spec index 206d001..327ac30 100644 --- a/golang.spec +++ b/golang.spec @@ -106,10 +106,10 @@ %endif %global go_api 1.15 -%global go_version 1.15.8 +%global go_version 1.15.11 Name: golang -Version: 1.15.8 +Version: 1.15.11 Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -608,6 +608,9 @@ fi %endif %changelog +* Sun Apr 18 2021 Alejandro Sáez - 1.15.11-1 +- Update to go1.15.11 + * Fri Feb 05 2021 Jakub Čajka - 1.15.8-1 - Update to go1.15.8 diff --git a/sources b/sources index 1082d54..02f542c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.15.8.src.tar.gz) = 4b805425550aff5c38f1f66fa7f7b3282b20850b1c0735898ee62820080514a2a6ab573f1d6984656c5bb955ec2b10cef90fbb7ab6a6c8f1e75ebc0964a04a80 +SHA512 (go1.15.11.src.tar.gz) = 52a107220f02197f07c0d3afef403c3762428c1f69107fa7123bc6cdf6b47dd4e65f2ab3979ad7d12a265b0c9bd0b66e6e50eb91f7fa994ba22882f117afe289 From b2a8f76814f5c9246873fd78cd2c6c32fa110605 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= Date: Mon, 10 May 2021 10:50:21 +0200 Subject: [PATCH 5/9] Update to go1.15.12 --- .gitignore | 1 + golang.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 509a126..aca1881 100644 --- a/.gitignore +++ b/.gitignore @@ -99,3 +99,4 @@ /go1.15.7.src.tar.gz /go1.15.8.src.tar.gz /go1.15.11.src.tar.gz +/go1.15.12.src.tar.gz diff --git a/golang.spec b/golang.spec index 327ac30..076041a 100644 --- a/golang.spec +++ b/golang.spec @@ -106,10 +106,10 @@ %endif %global go_api 1.15 -%global go_version 1.15.11 +%global go_version 1.15.12 Name: golang -Version: 1.15.11 +Version: 1.15.12 Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -608,6 +608,9 @@ fi %endif %changelog +* Mon May 10 2021 Alejandro Sáez - 1.15.12-1 +- Update to go1.15.12 + * Sun Apr 18 2021 Alejandro Sáez - 1.15.11-1 - Update to go1.15.11 diff --git a/sources b/sources index 02f542c..ffc90cd 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.15.11.src.tar.gz) = 52a107220f02197f07c0d3afef403c3762428c1f69107fa7123bc6cdf6b47dd4e65f2ab3979ad7d12a265b0c9bd0b66e6e50eb91f7fa994ba22882f117afe289 +SHA512 (go1.15.12.src.tar.gz) = 9fdb0e74c0b4e8e5d8d45cbdb6f1d4be4d40549ef10629350856c3e045a82567a0418e949dfc229df7eea091ababec6b3e4e12b1bd424e14d7b10ef989e5c232 From 010e6cc156e12831363b23b8e16d83f0a3465796 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= Date: Wed, 23 Jun 2021 19:31:59 +0200 Subject: [PATCH 6/9] Update to go1.15.13 --- .gitignore | 1 + golang.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index aca1881..a8ea9c1 100644 --- a/.gitignore +++ b/.gitignore @@ -100,3 +100,4 @@ /go1.15.8.src.tar.gz /go1.15.11.src.tar.gz /go1.15.12.src.tar.gz +/go1.15.13.src.tar.gz diff --git a/golang.spec b/golang.spec index 076041a..08c8bc0 100644 --- a/golang.spec +++ b/golang.spec @@ -106,10 +106,10 @@ %endif %global go_api 1.15 -%global go_version 1.15.12 +%global go_version 1.15.13 Name: golang -Version: 1.15.12 +Version: %{go_version} Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -608,6 +608,9 @@ fi %endif %changelog +* Wed Jun 23 2021 Alejandro Sáez - 1.15.13-1 +- Update to go1.15.13 + * Mon May 10 2021 Alejandro Sáez - 1.15.12-1 - Update to go1.15.12 diff --git a/sources b/sources index ffc90cd..3284387 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.15.12.src.tar.gz) = 9fdb0e74c0b4e8e5d8d45cbdb6f1d4be4d40549ef10629350856c3e045a82567a0418e949dfc229df7eea091ababec6b3e4e12b1bd424e14d7b10ef989e5c232 +SHA512 (go1.15.13.src.tar.gz) = 3f77716c9721afacb27daa175e236bb25cfc93602f1531df18938fad94bf4f59e81b81f53fa977c2ebc9a912942275a1106043133fec166965e72766b1638ba1 From 60bb8c5a1e706c37c7f2386e7cc306486762518a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Mon, 19 Jul 2021 18:09:04 +0200 Subject: [PATCH 7/9] Update to go1.15.14 Security fix for CVE-2021-34558 --- .gitignore | 1 + golang.spec | 7 ++++++- sources | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index a8ea9c1..c3e919f 100644 --- a/.gitignore +++ b/.gitignore @@ -101,3 +101,4 @@ /go1.15.11.src.tar.gz /go1.15.12.src.tar.gz /go1.15.13.src.tar.gz +/go1.15.14.src.tar.gz diff --git a/golang.spec b/golang.spec index 08c8bc0..8f1258d 100644 --- a/golang.spec +++ b/golang.spec @@ -106,7 +106,7 @@ %endif %global go_api 1.15 -%global go_version 1.15.13 +%global go_version 1.15.14 Name: golang Version: %{go_version} @@ -608,6 +608,11 @@ fi %endif %changelog +* Mon Jul 19 2021 Jakub Čajka - 1.15.14-1 +- Update to go1.15.14 +- Security fix for CVE-2021-34558 +- Resolves: BZ#1983597 + * Wed Jun 23 2021 Alejandro Sáez - 1.15.13-1 - Update to go1.15.13 diff --git a/sources b/sources index 3284387..bce4e13 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.15.13.src.tar.gz) = 3f77716c9721afacb27daa175e236bb25cfc93602f1531df18938fad94bf4f59e81b81f53fa977c2ebc9a912942275a1106043133fec166965e72766b1638ba1 +SHA512 (go1.15.14.src.tar.gz) = 2bf18efcb3a5f9e54de0a0e7ee27a689c2dc895d9403bc6f66e500358e70d1d664d7f17102126c98bd26fa2a3346ead358684e45b1a354cde8764c715064dd92 From a782d8140fa1baa61f627773b86f43d581a2afb3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Fri, 30 Jul 2021 14:17:35 +0200 Subject: [PATCH 8/9] - Fix crash in VDSO calls on ppc64le --- golang.spec | 7 +- ppc64le-vdso-fix.patch | 227 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 233 insertions(+), 1 deletion(-) create mode 100644 ppc64le-vdso-fix.patch diff --git a/golang.spec b/golang.spec index 8f1258d..83143f1 100644 --- a/golang.spec +++ b/golang.spec @@ -110,7 +110,7 @@ Name: golang Version: %{go_version} -Release: 1%{?dist} +Release: 2%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain License: BSD and Public Domain @@ -237,6 +237,8 @@ Requires: go-srpm-macros Patch1: 0001-Don-t-use-the-bundled-tzdata-at-runtime-except-for-t.patch Patch2: 0002-syscall-expose-IfInfomsg.X__ifi_pad-on-s390x.patch Patch3: 0003-cmd-go-disable-Google-s-proxy-and-sumdb.patch +# https://go-review.googlesource.com/c/go/+/334411 +Patch4: ppc64le-vdso-fix.patch # Having documentation separate was broken Obsoletes: %{name}-docs < 1.1-4 @@ -608,6 +610,9 @@ fi %endif %changelog +* Fri Jul 30 2021 Jakub Čajka - 1.15.14-2 +- Fix crash in VDSO calls on ppc64le + * Mon Jul 19 2021 Jakub Čajka - 1.15.14-1 - Update to go1.15.14 - Security fix for CVE-2021-34558 diff --git a/ppc64le-vdso-fix.patch b/ppc64le-vdso-fix.patch new file mode 100644 index 0000000..000d4c1 --- /dev/null +++ b/ppc64le-vdso-fix.patch @@ -0,0 +1,227 @@ +From 781560d5d38247f0b55dacdeace8a930cf922fa1 Mon Sep 17 00:00:00 2001 +From: Derek Parker +Date: Thu, 17 Jun 2021 20:22:40 +0000 +Subject: [PATCH] [release-branch.go1.15] runtime: fix crash during VDSO calls on PowerPC + +This patch reinstates a fix for PowerPC with regard to making VDSO calls +while receiving a signal, and subsequently crashing. The crash happens +because certain VDSO calls can modify the r30 register, which is where g +is stored. This change was reverted for PowerPC because r30 is supposed +to be a non-volatile register. This is true, but that only makes a +guarantee across function calls, but not "within" a function call. This +patch was seemingly fine before because the Linux kernel still had hand +rolled assembly VDSO function calls, however with a recent change to C +function calls it seems the compiler used can generate instructions +which temporarily clobber r30. This means that when we receive a signal +during one of these calls the value of r30 will not be the g as the +runtime expects, causing a segfault. + +You can see from this assembly dump how the register is clobbered during +the call: + +(the following is from a 5.13rc2 kernel) + +``` +Dump of assembler code for function __cvdso_clock_gettime_data: + 0x00007ffff7ff0700 <+0>: cmplwi r4,15 + 0x00007ffff7ff0704 <+4>: bgt 0x7ffff7ff07f0 <__cvdso_clock_gettime_data+240> + 0x00007ffff7ff0708 <+8>: li r9,1 + 0x00007ffff7ff070c <+12>: slw r9,r9,r4 + 0x00007ffff7ff0710 <+16>: andi. r10,r9,2179 + 0x00007ffff7ff0714 <+20>: beq 0x7ffff7ff0810 <__cvdso_clock_gettime_data+272> + 0x00007ffff7ff0718 <+24>: rldicr r10,r4,4,59 + 0x00007ffff7ff071c <+28>: lis r9,32767 + 0x00007ffff7ff0720 <+32>: std r30,-16(r1) + 0x00007ffff7ff0724 <+36>: std r31,-8(r1) + 0x00007ffff7ff0728 <+40>: add r6,r3,r10 + 0x00007ffff7ff072c <+44>: ori r4,r9,65535 + 0x00007ffff7ff0730 <+48>: lwz r8,0(r3) + 0x00007ffff7ff0734 <+52>: andi. r9,r8,1 + 0x00007ffff7ff0738 <+56>: bne 0x7ffff7ff07d0 <__cvdso_clock_gettime_data+208> + 0x00007ffff7ff073c <+60>: lwsync + 0x00007ffff7ff0740 <+64>: mftb r30 <---- RIGHT HERE +=> 0x00007ffff7ff0744 <+68>: ld r12,40(r6) +``` + +What I believe is happening is that the kernel changed the PowerPC VDSO +calls to use standard C calls instead of using hand rolled assembly. The +hand rolled assembly calls never touched r30, so this change was safe to +roll back. That does not seem to be the case anymore as on the 5.13rc2 +kernel the compiler *is* generating assembly which modifies r30, making +this change again unsafe and causing a crash when the program receives a +signal during these calls (which will happen often due to async +preempt). This change happened here: +https://lwn.net/ml/linux-kernel/235e5571959cfa89ced081d7e838ed5ff38447d2.1601365870.git.christophe.leroy@csgroup.eu/. + +I realize this was reverted due to unexplained hangs in PowerPC +builders, but I think we should reinstate this change and investigate +those issues separately: +https://github.com/golang/go/commit/f4ca3c1e0a2066ca4f7bd6203866d282ed34acf2 + +Fixes #46857 + +Change-Id: Ib18d7bbfc80a1a9cb558f0098878d41081324b52 +GitHub-Last-Rev: c3002bcfca3ef58b27485e31328e6297b7a9dfe7 +GitHub-Pull-Request: golang/go#46767 +Reviewed-on: https://go-review.googlesource.com/c/go/+/328110 +Run-TryBot: Lynn Boger +TryBot-Result: Go Bot +Reviewed-by: Cherry Mui +Trust: Lynn Boger +(cherry picked from commit 16e82be454cbf41299e6a055d54d489ca4612ee0) +--- + +diff --git a/src/runtime/signal_unix.go b/src/runtime/signal_unix.go +index 003c7b0..8e1eb9e 100644 +--- a/src/runtime/signal_unix.go ++++ b/src/runtime/signal_unix.go +@@ -393,7 +393,7 @@ + //go:nosplit + func sigFetchG(c *sigctxt) *g { + switch GOARCH { +- case "arm", "arm64": ++ case "arm", "arm64", "ppc64", "ppc64le": + if !iscgo && inVDSOPage(c.sigpc()) { + // When using cgo, we save the g on TLS and load it from there + // in sigtramp. Just use that. +diff --git a/src/runtime/sys_linux_ppc64x.s b/src/runtime/sys_linux_ppc64x.s +index fd69ee7..7be8c4c 100644 +--- a/src/runtime/sys_linux_ppc64x.s ++++ b/src/runtime/sys_linux_ppc64x.s +@@ -215,15 +215,45 @@ + MOVD (g_sched+gobuf_sp)(R7), R1 // Set SP to g0 stack + + noswitch: +- SUB $16, R1 // Space for results +- RLDICR $0, R1, $59, R1 // Align for C code ++ SUB $16, R1 // Space for results ++ RLDICR $0, R1, $59, R1 // Align for C code + MOVD R12, CTR + MOVD R1, R4 +- BL (CTR) // Call from VDSO +- MOVD $0, R0 // Restore R0 +- MOVD 0(R1), R3 // sec +- MOVD 8(R1), R5 // nsec +- MOVD R15, R1 // Restore SP ++ ++ // Store g on gsignal's stack, so if we receive a signal ++ // during VDSO code we can find the g. ++ // If we don't have a signal stack, we won't receive signal, ++ // so don't bother saving g. ++ // When using cgo, we already saved g on TLS, also don't save ++ // g here. ++ // Also don't save g if we are already on the signal stack. ++ // We won't get a nested signal. ++ MOVBZ runtime·iscgo(SB), R22 ++ CMP R22, $0 ++ BNE nosaveg ++ MOVD m_gsignal(R21), R22 // g.m.gsignal ++ CMP R22, $0 ++ BEQ nosaveg ++ ++ CMP g, R22 ++ BEQ nosaveg ++ MOVD (g_stack+stack_lo)(R22), R22 // g.m.gsignal.stack.lo ++ MOVD g, (R22) ++ ++ BL (CTR) // Call from VDSO ++ ++ MOVD $0, (R22) // clear g slot, R22 is unchanged by C code ++ ++ JMP finish ++ ++nosaveg: ++ BL (CTR) // Call from VDSO ++ ++finish: ++ MOVD $0, R0 // Restore R0 ++ MOVD 0(R1), R3 // sec ++ MOVD 8(R1), R5 // nsec ++ MOVD R15, R1 // Restore SP + + // Restore vdsoPC, vdsoSP + // We don't worry about being signaled between the two stores. +@@ -235,7 +265,7 @@ + MOVD 32(R1), R6 + MOVD R6, m_vdsoPC(R21) + +-finish: ++return: + MOVD R3, sec+0(FP) + MOVW R5, nsec+8(FP) + RET +@@ -246,7 +276,7 @@ + SYSCALL $SYS_clock_gettime + MOVD 32(R1), R3 + MOVD 40(R1), R5 +- JMP finish ++ JMP return + + TEXT runtime·nanotime1(SB),NOSPLIT,$16-8 + MOVD $1, R3 // CLOCK_MONOTONIC +@@ -282,7 +312,37 @@ + RLDICR $0, R1, $59, R1 // Align for C code + MOVD R12, CTR + MOVD R1, R4 +- BL (CTR) // Call from VDSO ++ ++ // Store g on gsignal's stack, so if we receive a signal ++ // during VDSO code we can find the g. ++ // If we don't have a signal stack, we won't receive signal, ++ // so don't bother saving g. ++ // When using cgo, we already saved g on TLS, also don't save ++ // g here. ++ // Also don't save g if we are already on the signal stack. ++ // We won't get a nested signal. ++ MOVBZ runtime·iscgo(SB), R22 ++ CMP R22, $0 ++ BNE nosaveg ++ MOVD m_gsignal(R21), R22 // g.m.gsignal ++ CMP R22, $0 ++ BEQ nosaveg ++ ++ CMP g, R22 ++ BEQ nosaveg ++ MOVD (g_stack+stack_lo)(R22), R22 // g.m.gsignal.stack.lo ++ MOVD g, (R22) ++ ++ BL (CTR) // Call from VDSO ++ ++ MOVD $0, (R22) // clear g slot, R22 is unchanged by C code ++ ++ JMP finish ++ ++nosaveg: ++ BL (CTR) // Call from VDSO ++ ++finish: + MOVD $0, R0 // Restore R0 + MOVD 0(R1), R3 // sec + MOVD 8(R1), R5 // nsec +@@ -298,7 +358,7 @@ + MOVD 32(R1), R6 + MOVD R6, m_vdsoPC(R21) + +-finish: ++return: + // sec is in R3, nsec in R5 + // return nsec in R3 + MOVD $1000000000, R4 +@@ -313,7 +373,7 @@ + SYSCALL $SYS_clock_gettime + MOVD 32(R1), R3 + MOVD 40(R1), R5 +- JMP finish ++ JMP return + + TEXT runtime·rtsigprocmask(SB),NOSPLIT|NOFRAME,$0-28 + MOVW how+0(FP), R3 +@@ -366,7 +426,7 @@ + // this might be called in external code context, + // where g is not set. + MOVBZ runtime·iscgo(SB), R6 +- CMP R6, $0 ++ CMP R6, $0 + BEQ 2(PC) + BL runtime·load_g(SB) + From 061da13b96ba7dcd582a0577fe8106d38f14c8f0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Tue, 7 Sep 2021 09:55:39 +0200 Subject: [PATCH 9/9] Update to go1.15.15 Security fix for CVE-2021-36221 --- .gitignore | 1 + golang.spec | 11 +- ppc64le-vdso-fix.patch | 227 ----------------------------------------- sources | 2 +- 4 files changed, 9 insertions(+), 232 deletions(-) delete mode 100644 ppc64le-vdso-fix.patch diff --git a/.gitignore b/.gitignore index c3e919f..e9ef196 100644 --- a/.gitignore +++ b/.gitignore @@ -102,3 +102,4 @@ /go1.15.12.src.tar.gz /go1.15.13.src.tar.gz /go1.15.14.src.tar.gz +/go1.15.15.src.tar.gz diff --git a/golang.spec b/golang.spec index 83143f1..f4553a8 100644 --- a/golang.spec +++ b/golang.spec @@ -106,11 +106,11 @@ %endif %global go_api 1.15 -%global go_version 1.15.14 +%global go_version 1.15.15 Name: golang Version: %{go_version} -Release: 2%{?dist} +Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain License: BSD and Public Domain @@ -237,8 +237,6 @@ Requires: go-srpm-macros Patch1: 0001-Don-t-use-the-bundled-tzdata-at-runtime-except-for-t.patch Patch2: 0002-syscall-expose-IfInfomsg.X__ifi_pad-on-s390x.patch Patch3: 0003-cmd-go-disable-Google-s-proxy-and-sumdb.patch -# https://go-review.googlesource.com/c/go/+/334411 -Patch4: ppc64le-vdso-fix.patch # Having documentation separate was broken Obsoletes: %{name}-docs < 1.1-4 @@ -610,6 +608,11 @@ fi %endif %changelog +* Mon Aug 30 2021 Jakub Čajka - 1.15.15-1 +- Update to go1.15.15 +- Security fix for CVE-2021-36221 +- Resolves: BZ#1999415 + * Fri Jul 30 2021 Jakub Čajka - 1.15.14-2 - Fix crash in VDSO calls on ppc64le diff --git a/ppc64le-vdso-fix.patch b/ppc64le-vdso-fix.patch deleted file mode 100644 index 000d4c1..0000000 --- a/ppc64le-vdso-fix.patch +++ /dev/null @@ -1,227 +0,0 @@ -From 781560d5d38247f0b55dacdeace8a930cf922fa1 Mon Sep 17 00:00:00 2001 -From: Derek Parker -Date: Thu, 17 Jun 2021 20:22:40 +0000 -Subject: [PATCH] [release-branch.go1.15] runtime: fix crash during VDSO calls on PowerPC - -This patch reinstates a fix for PowerPC with regard to making VDSO calls -while receiving a signal, and subsequently crashing. The crash happens -because certain VDSO calls can modify the r30 register, which is where g -is stored. This change was reverted for PowerPC because r30 is supposed -to be a non-volatile register. This is true, but that only makes a -guarantee across function calls, but not "within" a function call. This -patch was seemingly fine before because the Linux kernel still had hand -rolled assembly VDSO function calls, however with a recent change to C -function calls it seems the compiler used can generate instructions -which temporarily clobber r30. This means that when we receive a signal -during one of these calls the value of r30 will not be the g as the -runtime expects, causing a segfault. - -You can see from this assembly dump how the register is clobbered during -the call: - -(the following is from a 5.13rc2 kernel) - -``` -Dump of assembler code for function __cvdso_clock_gettime_data: - 0x00007ffff7ff0700 <+0>: cmplwi r4,15 - 0x00007ffff7ff0704 <+4>: bgt 0x7ffff7ff07f0 <__cvdso_clock_gettime_data+240> - 0x00007ffff7ff0708 <+8>: li r9,1 - 0x00007ffff7ff070c <+12>: slw r9,r9,r4 - 0x00007ffff7ff0710 <+16>: andi. r10,r9,2179 - 0x00007ffff7ff0714 <+20>: beq 0x7ffff7ff0810 <__cvdso_clock_gettime_data+272> - 0x00007ffff7ff0718 <+24>: rldicr r10,r4,4,59 - 0x00007ffff7ff071c <+28>: lis r9,32767 - 0x00007ffff7ff0720 <+32>: std r30,-16(r1) - 0x00007ffff7ff0724 <+36>: std r31,-8(r1) - 0x00007ffff7ff0728 <+40>: add r6,r3,r10 - 0x00007ffff7ff072c <+44>: ori r4,r9,65535 - 0x00007ffff7ff0730 <+48>: lwz r8,0(r3) - 0x00007ffff7ff0734 <+52>: andi. r9,r8,1 - 0x00007ffff7ff0738 <+56>: bne 0x7ffff7ff07d0 <__cvdso_clock_gettime_data+208> - 0x00007ffff7ff073c <+60>: lwsync - 0x00007ffff7ff0740 <+64>: mftb r30 <---- RIGHT HERE -=> 0x00007ffff7ff0744 <+68>: ld r12,40(r6) -``` - -What I believe is happening is that the kernel changed the PowerPC VDSO -calls to use standard C calls instead of using hand rolled assembly. The -hand rolled assembly calls never touched r30, so this change was safe to -roll back. That does not seem to be the case anymore as on the 5.13rc2 -kernel the compiler *is* generating assembly which modifies r30, making -this change again unsafe and causing a crash when the program receives a -signal during these calls (which will happen often due to async -preempt). This change happened here: -https://lwn.net/ml/linux-kernel/235e5571959cfa89ced081d7e838ed5ff38447d2.1601365870.git.christophe.leroy@csgroup.eu/. - -I realize this was reverted due to unexplained hangs in PowerPC -builders, but I think we should reinstate this change and investigate -those issues separately: -https://github.com/golang/go/commit/f4ca3c1e0a2066ca4f7bd6203866d282ed34acf2 - -Fixes #46857 - -Change-Id: Ib18d7bbfc80a1a9cb558f0098878d41081324b52 -GitHub-Last-Rev: c3002bcfca3ef58b27485e31328e6297b7a9dfe7 -GitHub-Pull-Request: golang/go#46767 -Reviewed-on: https://go-review.googlesource.com/c/go/+/328110 -Run-TryBot: Lynn Boger -TryBot-Result: Go Bot -Reviewed-by: Cherry Mui -Trust: Lynn Boger -(cherry picked from commit 16e82be454cbf41299e6a055d54d489ca4612ee0) ---- - -diff --git a/src/runtime/signal_unix.go b/src/runtime/signal_unix.go -index 003c7b0..8e1eb9e 100644 ---- a/src/runtime/signal_unix.go -+++ b/src/runtime/signal_unix.go -@@ -393,7 +393,7 @@ - //go:nosplit - func sigFetchG(c *sigctxt) *g { - switch GOARCH { -- case "arm", "arm64": -+ case "arm", "arm64", "ppc64", "ppc64le": - if !iscgo && inVDSOPage(c.sigpc()) { - // When using cgo, we save the g on TLS and load it from there - // in sigtramp. Just use that. -diff --git a/src/runtime/sys_linux_ppc64x.s b/src/runtime/sys_linux_ppc64x.s -index fd69ee7..7be8c4c 100644 ---- a/src/runtime/sys_linux_ppc64x.s -+++ b/src/runtime/sys_linux_ppc64x.s -@@ -215,15 +215,45 @@ - MOVD (g_sched+gobuf_sp)(R7), R1 // Set SP to g0 stack - - noswitch: -- SUB $16, R1 // Space for results -- RLDICR $0, R1, $59, R1 // Align for C code -+ SUB $16, R1 // Space for results -+ RLDICR $0, R1, $59, R1 // Align for C code - MOVD R12, CTR - MOVD R1, R4 -- BL (CTR) // Call from VDSO -- MOVD $0, R0 // Restore R0 -- MOVD 0(R1), R3 // sec -- MOVD 8(R1), R5 // nsec -- MOVD R15, R1 // Restore SP -+ -+ // Store g on gsignal's stack, so if we receive a signal -+ // during VDSO code we can find the g. -+ // If we don't have a signal stack, we won't receive signal, -+ // so don't bother saving g. -+ // When using cgo, we already saved g on TLS, also don't save -+ // g here. -+ // Also don't save g if we are already on the signal stack. -+ // We won't get a nested signal. -+ MOVBZ runtime·iscgo(SB), R22 -+ CMP R22, $0 -+ BNE nosaveg -+ MOVD m_gsignal(R21), R22 // g.m.gsignal -+ CMP R22, $0 -+ BEQ nosaveg -+ -+ CMP g, R22 -+ BEQ nosaveg -+ MOVD (g_stack+stack_lo)(R22), R22 // g.m.gsignal.stack.lo -+ MOVD g, (R22) -+ -+ BL (CTR) // Call from VDSO -+ -+ MOVD $0, (R22) // clear g slot, R22 is unchanged by C code -+ -+ JMP finish -+ -+nosaveg: -+ BL (CTR) // Call from VDSO -+ -+finish: -+ MOVD $0, R0 // Restore R0 -+ MOVD 0(R1), R3 // sec -+ MOVD 8(R1), R5 // nsec -+ MOVD R15, R1 // Restore SP - - // Restore vdsoPC, vdsoSP - // We don't worry about being signaled between the two stores. -@@ -235,7 +265,7 @@ - MOVD 32(R1), R6 - MOVD R6, m_vdsoPC(R21) - --finish: -+return: - MOVD R3, sec+0(FP) - MOVW R5, nsec+8(FP) - RET -@@ -246,7 +276,7 @@ - SYSCALL $SYS_clock_gettime - MOVD 32(R1), R3 - MOVD 40(R1), R5 -- JMP finish -+ JMP return - - TEXT runtime·nanotime1(SB),NOSPLIT,$16-8 - MOVD $1, R3 // CLOCK_MONOTONIC -@@ -282,7 +312,37 @@ - RLDICR $0, R1, $59, R1 // Align for C code - MOVD R12, CTR - MOVD R1, R4 -- BL (CTR) // Call from VDSO -+ -+ // Store g on gsignal's stack, so if we receive a signal -+ // during VDSO code we can find the g. -+ // If we don't have a signal stack, we won't receive signal, -+ // so don't bother saving g. -+ // When using cgo, we already saved g on TLS, also don't save -+ // g here. -+ // Also don't save g if we are already on the signal stack. -+ // We won't get a nested signal. -+ MOVBZ runtime·iscgo(SB), R22 -+ CMP R22, $0 -+ BNE nosaveg -+ MOVD m_gsignal(R21), R22 // g.m.gsignal -+ CMP R22, $0 -+ BEQ nosaveg -+ -+ CMP g, R22 -+ BEQ nosaveg -+ MOVD (g_stack+stack_lo)(R22), R22 // g.m.gsignal.stack.lo -+ MOVD g, (R22) -+ -+ BL (CTR) // Call from VDSO -+ -+ MOVD $0, (R22) // clear g slot, R22 is unchanged by C code -+ -+ JMP finish -+ -+nosaveg: -+ BL (CTR) // Call from VDSO -+ -+finish: - MOVD $0, R0 // Restore R0 - MOVD 0(R1), R3 // sec - MOVD 8(R1), R5 // nsec -@@ -298,7 +358,7 @@ - MOVD 32(R1), R6 - MOVD R6, m_vdsoPC(R21) - --finish: -+return: - // sec is in R3, nsec in R5 - // return nsec in R3 - MOVD $1000000000, R4 -@@ -313,7 +373,7 @@ - SYSCALL $SYS_clock_gettime - MOVD 32(R1), R3 - MOVD 40(R1), R5 -- JMP finish -+ JMP return - - TEXT runtime·rtsigprocmask(SB),NOSPLIT|NOFRAME,$0-28 - MOVW how+0(FP), R3 -@@ -366,7 +426,7 @@ - // this might be called in external code context, - // where g is not set. - MOVBZ runtime·iscgo(SB), R6 -- CMP R6, $0 -+ CMP R6, $0 - BEQ 2(PC) - BL runtime·load_g(SB) - diff --git a/sources b/sources index bce4e13..8ce0d51 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.15.14.src.tar.gz) = 2bf18efcb3a5f9e54de0a0e7ee27a689c2dc895d9403bc6f66e500358e70d1d664d7f17102126c98bd26fa2a3346ead358684e45b1a354cde8764c715064dd92 +SHA512 (go1.15.15.src.tar.gz) = bf8a6f669d024ce77271fbc8dc1d7a727c4da85c70cad00d0baaef157e7c5d7879ea9ae71cdb04e55f9c07f5ae76655264ca8a159c971eab1cf8a8861b74e69b