diff options
author | Jason M. Bills <jason.m.bills@intel.com> | 2022-01-27 02:10:44 +0300 |
---|---|---|
committer | Jason M. Bills <jason.m.bills@intel.com> | 2022-01-27 19:43:30 +0300 |
commit | 2af2c470828b4b3bbcd44215d6a68c8d01cd74db (patch) | |
tree | 0f51257a1ef79405a4be114acbb914ed7131a4a1 | |
parent | d9a15a908f3fc807f0c5cd3473d28b6a16435127 (diff) | |
download | openbmc-2af2c470828b4b3bbcd44215d6a68c8d01cd74db.tar.xz |
Update to internal 1.01-61
Signed-off-by: Jason M. Bills <jason.m.bills@intel.com>
25 files changed, 758 insertions, 406 deletions
diff --git a/meta-openbmc-mods/meta-common/recipes-connectivity/avahi/avahi/0001-Fix-NULL-pointer-crashes-CVE-2021-36217.patch b/meta-openbmc-mods/meta-common/recipes-connectivity/avahi/avahi/0001-Fix-NULL-pointer-crashes-CVE-2021-36217.patch new file mode 100644 index 000000000..7b0449a2e --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-connectivity/avahi/avahi/0001-Fix-NULL-pointer-crashes-CVE-2021-36217.patch @@ -0,0 +1,148 @@ +From 9d31939e55280a733d930b15ac9e4dda4497680c Mon Sep 17 00:00:00 2001 +From: Tommi Rantala <tommi.t.rantala@nokia.com> +Date: Mon, 8 Feb 2021 11:04:43 +0200 +Subject: [PATCH] Fix NULL pointer crashes from #175 + +avahi-daemon is crashing when running "ping .local". +The crash is due to failing assertion from NULL pointer. +Add missing NULL pointer checks to fix it. + +Introduced in #175 - merge commit 8f75a045709a780c8cf92a6a21e9d35b593bdecd +--- + avahi-core/browse-dns-server.c | 5 ++++- + avahi-core/browse-domain.c | 5 ++++- + avahi-core/browse-service-type.c | 3 +++ + avahi-core/browse-service.c | 3 +++ + avahi-core/browse.c | 3 +++ + avahi-core/resolve-address.c | 5 ++++- + avahi-core/resolve-host-name.c | 5 ++++- + avahi-core/resolve-service.c | 5 ++++- + 8 files changed, 29 insertions(+), 5 deletions(-) + +diff --git a/avahi-core/browse-dns-server.c b/avahi-core/browse-dns-server.c +index 049752e9..c2d914fa 100644 +--- a/avahi-core/browse-dns-server.c ++++ b/avahi-core/browse-dns-server.c +@@ -343,7 +343,10 @@ AvahiSDNSServerBrowser *avahi_s_dns_server_browser_new( + AvahiSDNSServerBrowser* b; + + b = avahi_s_dns_server_browser_prepare(server, interface, protocol, domain, type, aprotocol, flags, callback, userdata); ++ if (!b) ++ return NULL; ++ + avahi_s_dns_server_browser_start(b); + + return b; +-} +\ No newline at end of file ++} +diff --git a/avahi-core/browse-domain.c b/avahi-core/browse-domain.c +index f145d56a..06fa70c0 100644 +--- a/avahi-core/browse-domain.c ++++ b/avahi-core/browse-domain.c +@@ -253,7 +253,10 @@ AvahiSDomainBrowser *avahi_s_domain_browser_new( + AvahiSDomainBrowser *b; + + b = avahi_s_domain_browser_prepare(server, interface, protocol, domain, type, flags, callback, userdata); ++ if (!b) ++ return NULL; ++ + avahi_s_domain_browser_start(b); + + return b; +-} +\ No newline at end of file ++} +diff --git a/avahi-core/browse-service-type.c b/avahi-core/browse-service-type.c +index fdd22dcd..b1fc7af8 100644 +--- a/avahi-core/browse-service-type.c ++++ b/avahi-core/browse-service-type.c +@@ -171,6 +171,9 @@ AvahiSServiceTypeBrowser *avahi_s_service_type_browser_new( + AvahiSServiceTypeBrowser *b; + + b = avahi_s_service_type_browser_prepare(server, interface, protocol, domain, flags, callback, userdata); ++ if (!b) ++ return NULL; ++ + avahi_s_service_type_browser_start(b); + + return b; +diff --git a/avahi-core/browse-service.c b/avahi-core/browse-service.c +index 5531360c..63e0275a 100644 +--- a/avahi-core/browse-service.c ++++ b/avahi-core/browse-service.c +@@ -184,6 +184,9 @@ AvahiSServiceBrowser *avahi_s_service_browser_new( + AvahiSServiceBrowser *b; + + b = avahi_s_service_browser_prepare(server, interface, protocol, service_type, domain, flags, callback, userdata); ++ if (!b) ++ return NULL; ++ + avahi_s_service_browser_start(b); + + return b; +diff --git a/avahi-core/browse.c b/avahi-core/browse.c +index 2941e579..e8a915e9 100644 +--- a/avahi-core/browse.c ++++ b/avahi-core/browse.c +@@ -634,6 +634,9 @@ AvahiSRecordBrowser *avahi_s_record_browser_new( + AvahiSRecordBrowser *b; + + b = avahi_s_record_browser_prepare(server, interface, protocol, key, flags, callback, userdata); ++ if (!b) ++ return NULL; ++ + avahi_s_record_browser_start_query(b); + + return b; +diff --git a/avahi-core/resolve-address.c b/avahi-core/resolve-address.c +index ac0b29b1..e61dd242 100644 +--- a/avahi-core/resolve-address.c ++++ b/avahi-core/resolve-address.c +@@ -286,7 +286,10 @@ AvahiSAddressResolver *avahi_s_address_resolver_new( + AvahiSAddressResolver *b; + + b = avahi_s_address_resolver_prepare(server, interface, protocol, address, flags, callback, userdata); ++ if (!b) ++ return NULL; ++ + avahi_s_address_resolver_start(b); + + return b; +-} +\ No newline at end of file ++} +diff --git a/avahi-core/resolve-host-name.c b/avahi-core/resolve-host-name.c +index 808b0e72..4e8e5973 100644 +--- a/avahi-core/resolve-host-name.c ++++ b/avahi-core/resolve-host-name.c +@@ -318,7 +318,10 @@ AvahiSHostNameResolver *avahi_s_host_name_resolver_new( + AvahiSHostNameResolver *b; + + b = avahi_s_host_name_resolver_prepare(server, interface, protocol, host_name, aprotocol, flags, callback, userdata); ++ if (!b) ++ return NULL; ++ + avahi_s_host_name_resolver_start(b); + + return b; +-} +\ No newline at end of file ++} +diff --git a/avahi-core/resolve-service.c b/avahi-core/resolve-service.c +index 66bf3cae..43771763 100644 +--- a/avahi-core/resolve-service.c ++++ b/avahi-core/resolve-service.c +@@ -519,7 +519,10 @@ AvahiSServiceResolver *avahi_s_service_resolver_new( + AvahiSServiceResolver *b; + + b = avahi_s_service_resolver_prepare(server, interface, protocol, name, type, domain, aprotocol, flags, callback, userdata); ++ if (!b) ++ return NULL; ++ + avahi_s_service_resolver_start(b); + + return b; +-} +\ No newline at end of file ++} diff --git a/meta-openbmc-mods/meta-common/recipes-connectivity/avahi/avahi/0002-handle-hup-CVE-2021-3468.patch b/meta-openbmc-mods/meta-common/recipes-connectivity/avahi/avahi/0002-handle-hup-CVE-2021-3468.patch new file mode 100644 index 000000000..26632e544 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-connectivity/avahi/avahi/0002-handle-hup-CVE-2021-3468.patch @@ -0,0 +1,41 @@ +CVE: CVE-2021-3468 +Upstream-Status: Submitted [https://github.com/lathiat/avahi/pull/330] +Signed-off-by: Ross Burton <ross.burton@arm.com> + +From 447affe29991ee99c6b9732fc5f2c1048a611d3b Mon Sep 17 00:00:00 2001 +From: Riccardo Schirone <sirmy15@gmail.com> +Date: Fri, 26 Mar 2021 11:50:24 +0100 +Subject: [PATCH] Avoid infinite-loop in avahi-daemon by handling HUP event in + client_work + +If a client fills the input buffer, client_work() disables the +AVAHI_WATCH_IN event, thus preventing the function from executing the +`read` syscall the next times it is called. However, if the client then +terminates the connection, the socket file descriptor receives a HUP +event, which is not handled, thus the kernel keeps marking the HUP event +as occurring. While iterating over the file descriptors that triggered +an event, the client file descriptor will keep having the HUP event and +the client_work() function is always called with AVAHI_WATCH_HUP but +without nothing being done, thus entering an infinite loop. + +See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=984938 +--- + avahi-daemon/simple-protocol.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/avahi-daemon/simple-protocol.c b/avahi-daemon/simple-protocol.c +index 3e0ebb11..6c0274d6 100644 +--- a/avahi-daemon/simple-protocol.c ++++ b/avahi-daemon/simple-protocol.c +@@ -424,6 +424,11 @@ static void client_work(AvahiWatch *watch, AVAHI_GCC_UNUSED int fd, AvahiWatchEv + } + } + ++ if (events & AVAHI_WATCH_HUP) { ++ client_free(c); ++ return; ++ } ++ + c->server->poll_api->watch_update( + watch, + (c->outbuf_length > 0 ? AVAHI_WATCH_OUT : 0) | diff --git a/meta-openbmc-mods/meta-common/recipes-connectivity/avahi/avahi_%.bbappend b/meta-openbmc-mods/meta-common/recipes-connectivity/avahi/avahi_%.bbappend new file mode 100644 index 000000000..ba6b7b554 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-connectivity/avahi/avahi_%.bbappend @@ -0,0 +1,6 @@ +FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" + +SRC_URI += " \ + file://0001-Fix-NULL-pointer-crashes-CVE-2021-36217.patch \ + file://0002-handle-hup-CVE-2021-3468.patch \ + " diff --git a/meta-openbmc-mods/meta-common/recipes-connectivity/openssl/openssl_1.1.1k.bb b/meta-openbmc-mods/meta-common/recipes-connectivity/openssl/openssl_1.1.1l.bb index 034cc610d..87325162b 100644 --- a/meta-openbmc-mods/meta-common/recipes-connectivity/openssl/openssl_1.1.1k.bb +++ b/meta-openbmc-mods/meta-common/recipes-connectivity/openssl/openssl_1.1.1l.bb @@ -23,7 +23,7 @@ SRC_URI_append_class-nativesdk = " \ file://environment.d-openssl.sh \ " -SRC_URI[sha256sum] = "892a0875b9872acd04a9fde79b1f943075d5ea162415de3047c327df33fbaee5" +SRC_URI[sha256sum] = "0b7a3e5e59c34827fe0c3a74b7ec8baef302b98fa80088d7f9153aa16fa76bd1" inherit lib_package multilib_header multilib_script ptest MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash" diff --git a/meta-openbmc-mods/meta-common/recipes-core/crashdump/crashdump_git.bb b/meta-openbmc-mods/meta-common/recipes-core/crashdump/crashdump_git.bb index adcdc6011..bb6d54807 100644 --- a/meta-openbmc-mods/meta-common/recipes-core/crashdump/crashdump_git.bb +++ b/meta-openbmc-mods/meta-common/recipes-core/crashdump/crashdump_git.bb @@ -13,7 +13,7 @@ LICENSE = "Proprietary" LIC_FILES_CHKSUM = "file://LICENSE;md5=43c09494f6b77f344027eea0a1c22830" SRC_URI = "git://github.com/Intel-BMC/crashdump;protocol=git" -SRCREV = "wht-1.0.6" +SRCREV = "wht-1.0.7" S = "${WORKDIR}/git" diff --git a/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0038-CVE-2021-38604-fix-NULL-pointer-dereference-bug-28213.patch b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0038-CVE-2021-38604-fix-NULL-pointer-dereference-bug-28213.patch new file mode 100644 index 000000000..3dca8cc6c --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0038-CVE-2021-38604-fix-NULL-pointer-dereference-bug-28213.patch @@ -0,0 +1,39 @@ +From b805aebd42364fe696e417808a700fdb9800c9e8 Mon Sep 17 00:00:00 2001 +From: Nikita Popov <npv1310@gmail.com> +Date: Mon, 9 Aug 2021 20:17:34 +0530 +Subject: [PATCH] librt: fix NULL pointer dereference (bug 28213) + +Helper thread frees copied attribute on NOTIFY_REMOVED message +received from the OS kernel. Unfortunately, it fails to check whether +copied attribute actually exists (data.attr != NULL). This worked +earlier because free() checks passed pointer before actually +attempting to release corresponding memory. But +__pthread_attr_destroy assumes pointer is not NULL. + +So passing NULL pointer to __pthread_attr_destroy will result in +segmentation fault. This scenario is possible if +notification->sigev_notify_attributes == NULL (which means default +thread attributes should be used). + +Signed-off-by: Nikita Popov <npv1310@gmail.com> +Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> +--- + sysdeps/unix/sysv/linux/mq_notify.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c +index 9799dcdaa4..eccae2e4c6 100644 +--- a/sysdeps/unix/sysv/linux/mq_notify.c ++++ b/sysdeps/unix/sysv/linux/mq_notify.c +@@ -131,7 +131,7 @@ helper_thread (void *arg) + to wait until it is done with it. */ + (void) __pthread_barrier_wait (¬ify_barrier); + } +- else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED) ++ else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED && data.attr != NULL) + { + /* The only state we keep is the copy of the thread attributes. */ + __pthread_attr_destroy (data.attr); +-- +2.27.0 + diff --git a/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0039-CVE-2021-35942-handle-overflow-in-positional-parameter-number-bug-28011.patch b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0039-CVE-2021-35942-handle-overflow-in-positional-parameter-number-bug-28011.patch new file mode 100644 index 000000000..4ad5da6da --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc/0039-CVE-2021-35942-handle-overflow-in-positional-parameter-number-bug-28011.patch @@ -0,0 +1,40 @@ +From 5adda61f62b77384718b4c0d8336ade8f2b4b35c Mon Sep 17 00:00:00 2001 +From: Andreas Schwab <schwab@linux-m68k.org> +Date: Fri, 25 Jun 2021 15:02:47 +0200 +Subject: [PATCH] wordexp: handle overflow in positional parameter number (bug + 28011) + +Use strtoul instead of atoi so that overflow can be detected. +--- + posix/wordexp-test.c | 1 + + posix/wordexp.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c +index f93a546d7e..9df02dbbb3 100644 +--- a/posix/wordexp-test.c ++++ b/posix/wordexp-test.c +@@ -183,6 +183,7 @@ struct test_case_struct + { 0, NULL, "$var", 0, 0, { NULL, }, IFS }, + { 0, NULL, "\"\\n\"", 0, 1, { "\\n", }, IFS }, + { 0, NULL, "", 0, 0, { NULL, }, IFS }, ++ { 0, NULL, "${1234567890123456789012}", 0, 0, { NULL, }, IFS }, + + /* Flags not already covered (testit() has special handling for these) */ + { 0, NULL, "one two", WRDE_DOOFFS, 2, { "one", "two", }, IFS }, +diff --git a/posix/wordexp.c b/posix/wordexp.c +index bcbe96e48d..1f3b09f721 100644 +--- a/posix/wordexp.c ++++ b/posix/wordexp.c +@@ -1399,7 +1399,7 @@ envsubst: + /* Is it a numeric parameter? */ + else if (isdigit (env[0])) + { +- int n = atoi (env); ++ unsigned long n = strtoul (env, NULL, 10); + + if (n >= __libc_argc) + /* Substitute NULL. */ +-- +2.27.0 + diff --git a/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc_2.33.bb b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc_2.33.bb index 5c4d944b0..b46782499 100644 --- a/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc_2.33.bb +++ b/meta-openbmc-mods/meta-common/recipes-core/glibc/glibc_2.33.bb @@ -51,6 +51,8 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0035-Fix-build-error.patch \ file://0036-Use-__pthread_attr_copy-in-mq_notify-bug-27896.patch \ file://0037-Fix-use-of-__pthread_attr_copy-in-mq_notify-bug-27896.patch \ + file://0038-CVE-2021-38604-fix-NULL-pointer-dereference-bug-28213.patch \ + file://0039-CVE-2021-35942-handle-overflow-in-positional-parameter-number-bug-28011.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" diff --git a/meta-openbmc-mods/meta-common/recipes-core/ipmi/intel-ipmi-oem/0006-Update-Product-ID-for-EEPROM-FRU-platforms.patch b/meta-openbmc-mods/meta-common/recipes-core/ipmi/intel-ipmi-oem/0006-Update-Product-ID-for-EEPROM-FRU-platforms.patch index 93dcc1c33..28b8f8a4e 100644 --- a/meta-openbmc-mods/meta-common/recipes-core/ipmi/intel-ipmi-oem/0006-Update-Product-ID-for-EEPROM-FRU-platforms.patch +++ b/meta-openbmc-mods/meta-common/recipes-core/ipmi/intel-ipmi-oem/0006-Update-Product-ID-for-EEPROM-FRU-platforms.patch @@ -1,4 +1,4 @@ -From a9899d878d49c5d37810f2d97a68ae9d1de1a390 Mon Sep 17 00:00:00 2001 +From e3324be962eae4f42d6262998b413e4b6e51991d Mon Sep 17 00:00:00 2001 From: Anoop S <anoopx.s@intel.com> Date: Fri, 2 Oct 2020 13:32:05 +0000 Subject: [PATCH] Update Product ID for EEPROM FRU platforms. @@ -32,12 +32,14 @@ Tested-by: Signed-off-by: Anoop S <anoopx.s@intel.com> Signed-off-by: Saravanan Palanisamy <saravanan.palanisamy@linux.intel.com> + +%% original patch: 0006-Update-Product-ID-for-EEPROM-FRU-platforms.patch --- - src/appcommands.cpp | 137 ++++++++++++++++++++++++++++++++++++++++++-- - 1 file changed, 131 insertions(+), 6 deletions(-) + src/appcommands.cpp | 142 ++++++++++++++++++++++++++++++++++++++++++-- + 1 file changed, 136 insertions(+), 6 deletions(-) diff --git a/src/appcommands.cpp b/src/appcommands.cpp -index 10e3d13..d5b5c50 100644 +index 10e3d13..6e3df64 100644 --- a/src/appcommands.cpp +++ b/src/appcommands.cpp @@ -16,6 +16,7 @@ @@ -60,47 +62,8 @@ index 10e3d13..d5b5c50 100644 int initBMCDeviceState(ipmi::Context::ptr ctx) { -@@ -286,7 +292,6 @@ RspType<uint8_t, // Device ID - static bool devIdInitialized = false; - static bool bmcStateInitialized = false; - const char* filename = "/usr/share/ipmi-providers/dev_id.json"; -- const char* prodIdFilename = "/var/cache/private/prodID"; - if (!fwVerInitialized) - { - std::string versionString; -@@ -351,13 +356,13 @@ RspType<uint8_t, // Device ID - // boot time. Avoid using DBus to get the Product ID. The Product ID is - // stored in a non-volatile file now. The /usr/bin/checkFru.sh script, - // run during bootup, will populate the productIdFile. -- std::fstream prodIdFile(prodIdFilename); -+ std::fstream prodIdFile(prodIdFilename, std::ios::in); - if (prodIdFile.is_open()) - { -- std::string id = "0x00"; -- char* end; -- prodIdFile.getline(&id[0], id.size() + 1); -- devId.prodId = std::strtol(&id[0], &end, 0); -+ uint16_t id = 0x00; -+ // id will become 0xFFFF (Reserved) if prodIdFile has invalid data. -+ prodIdFile >> std::hex >> id; -+ devId.prodId = id; - devIdInitialized = true; - } - else -@@ -377,17 +382,137 @@ RspType<uint8_t, // Device ID - } - } - -+ // Update the productId, if required. -+ if (!devId.prodId && productId) -+ { -+ devId.prodId = productId; -+ baseBoardUpdatedSignal.reset(); -+ } - return ipmi::responseSuccess(devId.id, devId.revision, devId.fwMajor, - bmcDeviceBusy, devId.fwMinor, devId.ipmiVer, - devId.addnDevSupport, devId.manufId, - devId.prodId, devId.aux); +@@ -256,6 +262,118 @@ std::optional<MetaRevision> convertIntelVersion(std::string& s) + return std::nullopt; } +static void getProductId(const std::string& baseboardObjPath) @@ -215,8 +178,55 @@ index 10e3d13..d5b5c50 100644 + return; +} + - static void registerAPPFunctions(void) - { + RspType<uint8_t, // Device ID + uint8_t, // Device Revision + uint7_t, // Firmware Revision Major +@@ -286,7 +404,6 @@ RspType<uint8_t, // Device ID + static bool devIdInitialized = false; + static bool bmcStateInitialized = false; + const char* filename = "/usr/share/ipmi-providers/dev_id.json"; +- const char* prodIdFilename = "/var/cache/private/prodID"; + if (!fwVerInitialized) + { + std::string versionString; +@@ -351,13 +468,13 @@ RspType<uint8_t, // Device ID + // boot time. Avoid using DBus to get the Product ID. The Product ID is + // stored in a non-volatile file now. The /usr/bin/checkFru.sh script, + // run during bootup, will populate the productIdFile. +- std::fstream prodIdFile(prodIdFilename); ++ std::fstream prodIdFile(prodIdFilename, std::ios::in); + if (prodIdFile.is_open()) + { +- std::string id = "0x00"; +- char* end; +- prodIdFile.getline(&id[0], id.size() + 1); +- devId.prodId = std::strtol(&id[0], &end, 0); ++ uint16_t id = 0x00; ++ // id will become 0xFFFF (Reserved) if prodIdFile has invalid data. ++ prodIdFile >> std::hex >> id; ++ devId.prodId = id; + devIdInitialized = true; + } + else +@@ -377,6 +494,17 @@ RspType<uint8_t, // Device ID + } + } + ++ if (!devId.prodId) ++ { ++ baseBoardUpdatedSignal.reset(); ++ getProductIdFromBoard(); ++ } ++ // Update the productId, if required. ++ if (!devId.prodId && productId) ++ { ++ devId.prodId = productId; ++ baseBoardUpdatedSignal.reset(); ++ } + return ipmi::responseSuccess(devId.id, devId.revision, devId.fwMajor, + bmcDeviceBusy, devId.fwMinor, devId.ipmiVer, + devId.addnDevSupport, devId.manufId, +@@ -388,6 +516,8 @@ static void registerAPPFunctions(void) // <Get Device ID> registerHandler(prioOemBase, netFnApp, app::cmdGetDeviceId, Privilege::User, ipmiAppGetDeviceId); diff --git a/meta-openbmc-mods/meta-common/recipes-core/nv-sync/nv-sync/nv-syncd b/meta-openbmc-mods/meta-common/recipes-core/nv-sync/nv-sync/nv-syncd index e2bb4bb0c..538c96875 100644 --- a/meta-openbmc-mods/meta-common/recipes-core/nv-sync/nv-sync/nv-syncd +++ b/meta-openbmc-mods/meta-common/recipes-core/nv-sync/nv-sync/nv-syncd @@ -3,8 +3,12 @@ NVMP=/tmp/.rwfs SOMP=/var/sofs +clean_var_volatile_tmp() { + rm -rf $NVMP/.overlay/var/volatile/tmp/* || : +} + do_sync() { - rsync -a --delete /tmp/.overlay/ $NVMP/.overlay + rsync -a --delete --exclude='**/var/volatile/tmp/**' /tmp/.overlay/ $NVMP/.overlay sync $NVMP/.overlay } @@ -25,6 +29,8 @@ trap stop_nv EXIT mount -o remount,rw $NVMP mount -o remount,rw $SOMP +clean_var_volatile_tmp + # Run rsync periodically to sync the overlay to NV storage while true; do do_sync diff --git a/meta-openbmc-mods/meta-common/recipes-core/systemd/systemd/0003-CVE-2021-33910-basic-unit-name-do-not-use-strdupa-on-a-path.patch b/meta-openbmc-mods/meta-common/recipes-core/systemd/systemd/0003-CVE-2021-33910-basic-unit-name-do-not-use-strdupa-on-a-path.patch new file mode 100644 index 000000000..a240d63d4 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-core/systemd/systemd/0003-CVE-2021-33910-basic-unit-name-do-not-use-strdupa-on-a-path.patch @@ -0,0 +1,64 @@ +From 4a1c5f34bd3e1daed4490e9d97918e504d19733b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl> +Date: Wed, 23 Jun 2021 11:46:41 +0200 +Subject: [PATCH] basic/unit-name: do not use strdupa() on a path + +The path may have unbounded length, for example through a fuse mount. + +CVE-2021-33910: attacked controlled alloca() leads to crash in systemd and +ultimately a kernel panic. Systemd parses the content of /proc/self/mountinfo +and each mountpoint is passed to mount_setup_unit(), which calls +unit_name_path_escape() underneath. A local attacker who is able to mount a +filesystem with a very long path can crash systemd and the whole system. + +https://bugzilla.redhat.com/show_bug.cgi?id=1970887 + +The resulting string length is bounded by UNIT_NAME_MAX, which is 256. But we +can't easily check the length after simplification before doing the +simplification, which in turns uses a copy of the string we can write to. +So we can't reject paths that are too long before doing the duplication. +Hence the most obvious solution is to switch back to strdup(), as before +7410616cd9dbbec97cf98d75324da5cda2b2f7a2. + +(cherry picked from commit 441e0115646d54f080e5c3bb0ba477c892861ab9) +(cherry picked from commit 764b74113e36ac5219a4b82a05f311b5a92136ce) +--- + src/basic/unit-name.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/src/basic/unit-name.c b/src/basic/unit-name.c +index 85dcba6cb7..46b24f2d9e 100644 +--- a/src/basic/unit-name.c ++++ b/src/basic/unit-name.c +@@ -378,12 +378,13 @@ int unit_name_unescape(const char *f, char **ret) { + } + + int unit_name_path_escape(const char *f, char **ret) { +- char *p, *s; ++ _cleanup_free_ char *p = NULL; ++ char *s; + + assert(f); + assert(ret); + +- p = strdupa(f); ++ p = strdup(f); + if (!p) + return -ENOMEM; + +@@ -395,13 +396,9 @@ int unit_name_path_escape(const char *f, char **ret) { + if (!path_is_normalized(p)) + return -EINVAL; + +- /* Truncate trailing slashes */ ++ /* Truncate trailing slashes and skip leading slashes */ + delete_trailing_chars(p, "/"); +- +- /* Truncate leading slashes */ +- p = skip_leading_chars(p, "/"); +- +- s = unit_name_escape(p); ++ s = unit_name_escape(skip_leading_chars(p, "/")); + } + if (!s) + return -ENOMEM; diff --git a/meta-openbmc-mods/meta-common/recipes-core/systemd/systemd_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/systemd/systemd_%.bbappend index e6df605aa..ecb27d416 100644 --- a/meta-openbmc-mods/meta-common/recipes-core/systemd/systemd_%.bbappend +++ b/meta-openbmc-mods/meta-common/recipes-core/systemd/systemd_%.bbappend @@ -7,6 +7,7 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" SRC_URI += "file://0001-Modfiy-system.conf-DefaultTimeoutStopSec.patch \ file://0002-Disable-LLMNR-port-5355.patch \ file://systemd-time-wait-sync.service \ + file://0003-CVE-2021-33910-basic-unit-name-do-not-use-strdupa-on-a-path.patch \ " USERADD_PACKAGES_remove = "${PN}-journal-gateway ${PN}-journal-upload ${PN}-journal-remote" diff --git a/meta-openbmc-mods/meta-common/recipes-core/util-linux/util-linux/CVE-2021-37600/0001-sys-utils-ipcutils-be-careful-when-call-calloc-for-u.patch b/meta-openbmc-mods/meta-common/recipes-core/util-linux/util-linux/CVE-2021-37600/0001-sys-utils-ipcutils-be-careful-when-call-calloc-for-u.patch new file mode 100644 index 000000000..bdb58d032 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-core/util-linux/util-linux/CVE-2021-37600/0001-sys-utils-ipcutils-be-careful-when-call-calloc-for-u.patch @@ -0,0 +1,28 @@ +From 1c9143d0c1f979c3daf10e1c37b5b1e916c22a1c Mon Sep 17 00:00:00 2001 +From: Karel Zak <kzak@redhat.com> +Date: Tue, 27 Jul 2021 11:58:31 +0200 +Subject: [PATCH] sys-utils/ipcutils: be careful when call calloc() for uint64 + nmembs + +Fix: https://github.com/karelzak/util-linux/issues/1395 +Signed-off-by: Karel Zak <kzak@redhat.com> +--- + sys-utils/ipcutils.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sys-utils/ipcutils.c b/sys-utils/ipcutils.c +index e784c4dcb9c0..18868cfd3885 100644 +--- a/sys-utils/ipcutils.c ++++ b/sys-utils/ipcutils.c +@@ -218,7 +218,7 @@ static void get_sem_elements(struct sem_data *p) + { + size_t i; + +- if (!p || !p->sem_nsems || p->sem_perm.id < 0) ++ if (!p || !p->sem_nsems || p->sem_nsems > SIZE_MAX || p->sem_perm.id < 0) + return; + + p->elements = xcalloc(p->sem_nsems, sizeof(struct sem_elem)); +-- +2.17.1 + diff --git a/meta-openbmc-mods/meta-common/recipes-core/util-linux/util-linux_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/util-linux/util-linux_%.bbappend new file mode 100644 index 000000000..5178ce553 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-core/util-linux/util-linux_%.bbappend @@ -0,0 +1,6 @@ +FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" + +FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}/CVE-2021-37600:" +SRC_URI += " \ + file://0001-sys-utils-ipcutils-be-careful-when-call-calloc-for-u.patch \ + " diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2020-21781/0001-ARM-ensure-the-signal-page-contains-defined-contents.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2020-21781/0001-ARM-ensure-the-signal-page-contains-defined-contents.patch new file mode 100644 index 000000000..98597243e --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2020-21781/0001-ARM-ensure-the-signal-page-contains-defined-contents.patch @@ -0,0 +1,52 @@ +From f49bff85b6dbb60a410c7f7dc53b52ee1dc22470 Mon Sep 17 00:00:00 2001 +From: Russell King <rmk+kernel@armlinux.org.uk> +Date: Fri, 29 Jan 2021 10:19:07 +0000 +Subject: [PATCH] ARM: ensure the signal page contains defined contents + +[ Upstream commit 9c698bff66ab4914bb3d71da7dc6112519bde23e ] + +Ensure that the signal page contains our poison instruction to increase +the protection against ROP attacks and also contains well defined +contents. + +Acked-by: Will Deacon <will@kernel.org> +Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm/kernel/signal.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c +index ab2568996ddb..c01f76cd0242 100644 +--- a/arch/arm/kernel/signal.c ++++ b/arch/arm/kernel/signal.c +@@ -694,18 +694,20 @@ struct page *get_signal_page(void) + + addr = page_address(page); + ++ /* Poison the entire page */ ++ memset32(addr, __opcode_to_mem_arm(0xe7fddef1), ++ PAGE_SIZE / sizeof(u32)); ++ + /* Give the signal return code some randomness */ + offset = 0x200 + (get_random_int() & 0x7fc); + signal_return_offset = offset; + +- /* +- * Copy signal return handlers into the vector page, and +- * set sigreturn to be a pointer to these. +- */ ++ /* Copy signal return handlers into the page */ + memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes)); + +- ptr = (unsigned long)addr + offset; +- flush_icache_range(ptr, ptr + sizeof(sigreturn_codes)); ++ /* Flush out all instructions in this page */ ++ ptr = (unsigned long)addr; ++ flush_icache_range(ptr, ptr + PAGE_SIZE); + + return page; + } +-- +2.17.1 + diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2021-22555/0001-netfilter-x_tables-fix-compat-match-target-pad-out-o.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2021-22555/0001-netfilter-x_tables-fix-compat-match-target-pad-out-o.patch new file mode 100644 index 000000000..7c5363462 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2021-22555/0001-netfilter-x_tables-fix-compat-match-target-pad-out-o.patch @@ -0,0 +1,107 @@ +From b29c457a6511435960115c0f548c4360d5f4801d Mon Sep 17 00:00:00 2001 +From: Florian Westphal <fw@strlen.de> +Date: Wed, 7 Apr 2021 21:38:57 +0200 +Subject: [PATCH] netfilter: x_tables: fix compat match/target pad out-of-bound + write + +xt_compat_match/target_from_user doesn't check that zeroing the area +to start of next rule won't write past end of allocated ruleset blob. + +Remove this code and zero the entire blob beforehand. + +Reported-by: syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com +Reported-by: Andy Nguyen <theflow@google.com> +Fixes: 9fa492cdc160c ("[NETFILTER]: x_tables: simplify compat API") +Signed-off-by: Florian Westphal <fw@strlen.de> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + net/ipv4/netfilter/arp_tables.c | 2 ++ + net/ipv4/netfilter/ip_tables.c | 2 ++ + net/ipv6/netfilter/ip6_tables.c | 2 ++ + net/netfilter/x_tables.c | 10 ++-------- + 4 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index 6c26533480dd..d6d45d820d79 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -1193,6 +1193,8 @@ static int translate_compat_table(struct net *net, + if (!newinfo) + goto out_unlock; + ++ memset(newinfo->entries, 0, size); ++ + newinfo->number = compatr->num_entries; + for (i = 0; i < NF_ARP_NUMHOOKS; i++) { + newinfo->hook_entry[i] = compatr->hook_entry[i]; +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index f15bc21d7301..f77ea0dbe656 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -1428,6 +1428,8 @@ translate_compat_table(struct net *net, + if (!newinfo) + goto out_unlock; + ++ memset(newinfo->entries, 0, size); ++ + newinfo->number = compatr->num_entries; + for (i = 0; i < NF_INET_NUMHOOKS; i++) { + newinfo->hook_entry[i] = compatr->hook_entry[i]; +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 2e2119bfcf13..eb2b5404806c 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -1443,6 +1443,8 @@ translate_compat_table(struct net *net, + if (!newinfo) + goto out_unlock; + ++ memset(newinfo->entries, 0, size); ++ + newinfo->number = compatr->num_entries; + for (i = 0; i < NF_INET_NUMHOOKS; i++) { + newinfo->hook_entry[i] = compatr->hook_entry[i]; +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 6bd31a7a27fc..92e9d4ebc5e8 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -733,7 +733,7 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr, + { + const struct xt_match *match = m->u.kernel.match; + struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m; +- int pad, off = xt_compat_match_offset(match); ++ int off = xt_compat_match_offset(match); + u_int16_t msize = cm->u.user.match_size; + char name[sizeof(m->u.user.name)]; + +@@ -743,9 +743,6 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr, + match->compat_from_user(m->data, cm->data); + else + memcpy(m->data, cm->data, msize - sizeof(*cm)); +- pad = XT_ALIGN(match->matchsize) - match->matchsize; +- if (pad > 0) +- memset(m->data + match->matchsize, 0, pad); + + msize += off; + m->u.user.match_size = msize; +@@ -1116,7 +1113,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr, + { + const struct xt_target *target = t->u.kernel.target; + struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t; +- int pad, off = xt_compat_target_offset(target); ++ int off = xt_compat_target_offset(target); + u_int16_t tsize = ct->u.user.target_size; + char name[sizeof(t->u.user.name)]; + +@@ -1126,9 +1123,6 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr, + target->compat_from_user(t->data, ct->data); + else + memcpy(t->data, ct->data, tsize - sizeof(*ct)); +- pad = XT_ALIGN(target->targetsize) - target->targetsize; +- if (pad > 0) +- memset(t->data + target->targetsize, 0, pad); + + tsize += off; + t->u.user.target_size = tsize; +-- +2.17.1 + diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2021-3679/0001-tracing-Fix-bug-in-rb_per_cpu_empty-that-might-cause.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2021-3679/0001-tracing-Fix-bug-in-rb_per_cpu_empty-that-might-cause.patch new file mode 100644 index 000000000..4ed034ac2 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2021-3679/0001-tracing-Fix-bug-in-rb_per_cpu_empty-that-might-cause.patch @@ -0,0 +1,106 @@ +From f899f24d34d964593b16122a774c192a78e2ca56 Mon Sep 17 00:00:00 2001 +From: Haoran Luo <www@aegistudio.net> +Date: Wed, 21 Jul 2021 14:12:07 +0000 +Subject: [PATCH] tracing: Fix bug in rb_per_cpu_empty() that might cause + deadloop. + +commit 67f0d6d9883c13174669f88adac4f0ee656cc16a upstream. + +The "rb_per_cpu_empty()" misinterpret the condition (as not-empty) when +"head_page" and "commit_page" of "struct ring_buffer_per_cpu" points to +the same buffer page, whose "buffer_data_page" is empty and "read" field +is non-zero. + +An error scenario could be constructed as followed (kernel perspective): + +1. All pages in the buffer has been accessed by reader(s) so that all of +them will have non-zero "read" field. + +2. Read and clear all buffer pages so that "rb_num_of_entries()" will +return 0 rendering there's no more data to read. It is also required +that the "read_page", "commit_page" and "tail_page" points to the same +page, while "head_page" is the next page of them. + +3. Invoke "ring_buffer_lock_reserve()" with large enough "length" +so that it shot pass the end of current tail buffer page. Now the +"head_page", "commit_page" and "tail_page" points to the same page. + +4. Discard current event with "ring_buffer_discard_commit()", so that +"head_page", "commit_page" and "tail_page" points to a page whose buffer +data page is now empty. + +When the error scenario has been constructed, "tracing_read_pipe" will +be trapped inside a deadloop: "trace_empty()" returns 0 since +"rb_per_cpu_empty()" returns 0 when it hits the CPU containing such +constructed ring buffer. Then "trace_find_next_entry_inc()" always +return NULL since "rb_num_of_entries()" reports there's no more entry +to read. Finally "trace_seq_to_user()" returns "-EBUSY" spanking +"tracing_read_pipe" back to the start of the "waitagain" loop. + +I've also written a proof-of-concept script to construct the scenario +and trigger the bug automatically, you can use it to trace and validate +my reasoning above: + + https://github.com/aegistudio/RingBufferDetonator.git + +Tests has been carried out on linux kernel 5.14-rc2 +(2734d6c1b1a089fb593ef6a23d4b70903526fe0c), my fixed version +of kernel (for testing whether my update fixes the bug) and +some older kernels (for range of affected kernels). Test result is +also attached to the proof-of-concept repository. + +Link: https://lore.kernel.org/linux-trace-devel/YPaNxsIlb2yjSi5Y@aegistudio/ +Link: https://lore.kernel.org/linux-trace-devel/YPgrN85WL9VyrZ55@aegistudio + +Cc: stable@vger.kernel.org +Fixes: bf41a158cacba ("ring-buffer: make reentrant") +Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org> +Signed-off-by: Haoran Luo <www@aegistudio.net> +Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + kernel/trace/ring_buffer.c | 28 ++++++++++++++++++++++++---- + 1 file changed, 24 insertions(+), 4 deletions(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 728374166653..5e1b9f6e77f3 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -3221,10 +3221,30 @@ static bool rb_per_cpu_empty(struct ring_buffer_per_cpu *cpu_buffer) + if (unlikely(!head)) + return true; + +- return reader->read == rb_page_commit(reader) && +- (commit == reader || +- (commit == head && +- head->read == rb_page_commit(commit))); ++ /* Reader should exhaust content in reader page */ ++ if (reader->read != rb_page_commit(reader)) ++ return false; ++ ++ /* ++ * If writers are committing on the reader page, knowing all ++ * committed content has been read, the ring buffer is empty. ++ */ ++ if (commit == reader) ++ return true; ++ ++ /* ++ * If writers are committing on a page other than reader page ++ * and head page, there should always be content to read. ++ */ ++ if (commit != head) ++ return false; ++ ++ /* ++ * Writers are committing on the head page, we just need ++ * to care about there're committed data, and the reader will ++ * swap reader page with head page when it is to read data. ++ */ ++ return rb_page_commit(commit) == 0; + } + + /** +-- +2.17.1 + diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/intel.cfg b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/intel.cfg index 9c08d590f..ef07b6b13 100644 --- a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/intel.cfg +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/intel.cfg @@ -90,4 +90,6 @@ CONFIG_USB_EHCI_HCD_PLATFORM=n CONFIG_IPMB_DEVICE_INTERFACE=y CONFIG_BPF_SYSCALL=n CONFIG_IO_URING=n - +CONFIG_EXT2_FS=n +CONFIG_EXT3_FS=n +CONFIG_EXT4_FS=n diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend index 467578d85..e9916f101 100644 --- a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend @@ -264,5 +264,23 @@ SRC_URI += " \ file://0001-dm-ioctl-fix-out-of-bounds-array-access-when-no-devi.patch \ " +# CVE-2021-22555 vulnerability fix +FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}/CVE-2021-22555:" +SRC_URI += " \ + file://0001-netfilter-x_tables-fix-compat-match-target-pad-out-o.patch \ + " + +# CVE-2021-3679 vulnerability fix +FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}/CVE-2021-3679:" +SRC_URI += " \ + file://0001-tracing-Fix-bug-in-rb_per_cpu_empty-that-might-cause.patch \ + " + +# CVE-2020-21781 vulnerability fix +FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}/CVE-2020-21781:" +SRC_URI += " \ + file://0001-ARM-ensure-the-signal-page-contains-defined-contents.patch \ + " + SRC_URI += "${@bb.utils.contains('IMAGE_FSTYPES', 'intel-pfr', 'file://0005-128MB-flashmap-for-PFR.patch', '', d)}" SRC_URI += "${@bb.utils.contains('EXTRA_IMAGE_FEATURES', 'debug-tweaks', 'file://debug.cfg', '', d)}" diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net/0009-Add-dbus-interface-for-sol-commands.patch b/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net/0009-Add-dbus-interface-for-sol-commands.patch deleted file mode 100644 index 5f749af45..000000000 --- a/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net/0009-Add-dbus-interface-for-sol-commands.patch +++ /dev/null @@ -1,317 +0,0 @@ -From e5ab844259f569656e95f5324f7428229dd811a7 Mon Sep 17 00:00:00 2001 -From: Cheng C Yang <cheng.c.yang@intel.com> -Date: Wed, 3 Jul 2019 07:39:47 +0800 -Subject: [PATCH] Add dbus interface for sol commands - -Add dbus interface for sol config parameters so that after move set/get -sol config parameter command from net-ipmid to host-ipmid, the command -can send config parameters to net-ipmid sol service through the dbus -interface. - -Tested by: -busctl introspect xyz.openbmc_project.Settings /xyz/openbmc_project -/network/host0/sol can show correct dbus properties of sol parameters. -ipmitool -I lanplus -H x -U x -P x raw 0x0c 0x21 0x0e 0x00 0x01 -ipmitool -I lanplus -H x -U x -P x raw 0x0c 0x21 0x0e 0x01 0x00 -ipmitool -I lanplus -H x -U x -P x raw 0x0c 0x21 0x0e 0x02 0x83 -ipmitool -I lanplus -H x -U x -P x raw 0x0c 0x21 0x0e 0x03 0x5 0x03 -ipmitool -I lanplus -H x -U x -P x raw 0x0c 0x21 0x0e 0x04 0x5 0x03 -all these commands can change the dbus properties as the value in -above commands. -Before and after run these commands, ipmitool -I lanplus -H x -U x --P x sol activate can start sol session correctly. -After reboot BMC, "Progress" property in dbus interface change back -to 0 and other properties will not reset to default value. - -Signed-off-by: Cheng C Yang <cheng.c.yang@intel.com> ---- - command/payload_cmds.cpp | 3 + - command/sol_cmds.cpp | 84 -------------------------- - sol/sol_manager.cpp | 124 +++++++++++++++++++++++++++++++++++++++ - sol/sol_manager.hpp | 1 + - sol_module.cpp | 6 -- - 5 files changed, 128 insertions(+), 90 deletions(-) - -diff --git a/command/payload_cmds.cpp b/command/payload_cmds.cpp -index c8e682e..bc987c5 100644 ---- a/command/payload_cmds.cpp -+++ b/command/payload_cmds.cpp -@@ -41,6 +41,9 @@ std::vector<uint8_t> activatePayload(const std::vector<uint8_t>& inPayload, - return outPayload; - } - -+ std::get<sol::Manager&>(singletonPool) -+ .updateSOLParameter(ipmi::convertCurrentChannelNum( -+ ipmi::currentChNum, getInterfaceIndex())); - if (!std::get<sol::Manager&>(singletonPool).enable) - { - response->completionCode = IPMI_CC_PAYLOAD_TYPE_DISABLED; -diff --git a/command/sol_cmds.cpp b/command/sol_cmds.cpp -index fda3e91..a1e820f 100644 ---- a/command/sol_cmds.cpp -+++ b/command/sol_cmds.cpp -@@ -71,90 +71,6 @@ void activating(uint8_t payloadInstance, uint32_t sessionID) - outPayload); - } - --std::vector<uint8_t> setConfParams(const std::vector<uint8_t>& inPayload, -- const message::Handler& handler) --{ -- std::vector<uint8_t> outPayload(sizeof(SetConfParamsResponse)); -- auto request = -- reinterpret_cast<const SetConfParamsRequest*>(inPayload.data()); -- auto response = reinterpret_cast<SetConfParamsResponse*>(outPayload.data()); -- response->completionCode = IPMI_CC_OK; -- -- switch (static_cast<Parameter>(request->paramSelector)) -- { -- case Parameter::PROGRESS: -- { -- uint8_t progress = request->value & progressMask; -- std::get<sol::Manager&>(singletonPool).progress = progress; -- break; -- } -- case Parameter::ENABLE: -- { -- bool enable = request->value & enableMask; -- std::get<sol::Manager&>(singletonPool).enable = enable; -- break; -- } -- case Parameter::AUTHENTICATION: -- { -- if (!request->auth.auth || !request->auth.encrypt) -- { -- response->completionCode = ipmiCCWriteReadParameter; -- } -- else if (request->auth.privilege < -- static_cast<uint8_t>(session::Privilege::USER) || -- request->auth.privilege > -- static_cast<uint8_t>(session::Privilege::OEM)) -- { -- response->completionCode = IPMI_CC_INVALID_FIELD_REQUEST; -- } -- else -- { -- std::get<sol::Manager&>(singletonPool).solMinPrivilege = -- static_cast<session::Privilege>(request->auth.privilege); -- } -- break; -- } -- case Parameter::ACCUMULATE: -- { -- using namespace std::chrono_literals; -- -- if (request->acc.threshold == 0) -- { -- response->completionCode = IPMI_CC_INVALID_FIELD_REQUEST; -- break; -- } -- -- std::get<sol::Manager&>(singletonPool).accumulateInterval = -- request->acc.interval * sol::accIntervalFactor * 1ms; -- std::get<sol::Manager&>(singletonPool).sendThreshold = -- request->acc.threshold; -- break; -- } -- case Parameter::RETRY: -- { -- using namespace std::chrono_literals; -- -- std::get<sol::Manager&>(singletonPool).retryCount = -- request->retry.count; -- std::get<sol::Manager&>(singletonPool).retryInterval = -- request->retry.interval * sol::retryIntervalFactor * 1ms; -- break; -- } -- case Parameter::PORT: -- { -- response->completionCode = ipmiCCWriteReadParameter; -- break; -- } -- case Parameter::NVBITRATE: -- case Parameter::VBITRATE: -- case Parameter::CHANNEL: -- default: -- response->completionCode = ipmiCCParamNotSupported; -- } -- -- return outPayload; --} -- - std::vector<uint8_t> getConfParams(const std::vector<uint8_t>& inPayload, - const message::Handler& handler) - { -diff --git a/sol/sol_manager.cpp b/sol/sol_manager.cpp -index a118457..55d269a 100644 ---- a/sol/sol_manager.cpp -+++ b/sol/sol_manager.cpp -@@ -14,6 +14,11 @@ - #include <cmath> - #include <ipmid/utils.hpp> - #include <phosphor-logging/log.hpp> -+#include <sdbusplus/message/types.hpp> -+ -+constexpr const char* solInterface = "xyz.openbmc_project.Ipmi.SOL"; -+constexpr const char* solPath = "/xyz/openbmc_project/ipmi/sol/"; -+constexpr const char* PROP_INTF = "org.freedesktop.DBus.Properties"; - - namespace sol - { -@@ -103,6 +108,125 @@ void Manager::stopHostConsole() - } - } - -+std::string getService(sdbusplus::bus::bus& bus, const std::string& intf, -+ const std::string& path) -+{ -+ auto mapperCall = -+ bus.new_method_call("xyz.openbmc_project.ObjectMapper", -+ "/xyz/openbmc_project/object_mapper", -+ "xyz.openbmc_project.ObjectMapper", "GetObject"); -+ -+ mapperCall.append(path); -+ mapperCall.append(std::vector<std::string>({intf})); -+ -+ std::map<std::string, std::vector<std::string>> mapperResponse; -+ -+ try -+ { -+ auto mapperResponseMsg = bus.call(mapperCall); -+ mapperResponseMsg.read(mapperResponse); -+ } -+ catch (sdbusplus::exception_t&) -+ { -+ throw std::runtime_error("ERROR in mapper call"); -+ } -+ -+ if (mapperResponse.begin() == mapperResponse.end()) -+ { -+ throw std::runtime_error("ERROR in reading the mapper response"); -+ } -+ -+ return mapperResponse.begin()->first; -+} -+ -+ipmi::PropertyMap getAllDbusProperties(sdbusplus::bus::bus& bus, -+ const std::string& service, -+ const std::string& objPath, -+ const std::string& interface) -+{ -+ ipmi::PropertyMap properties; -+ -+ sdbusplus::message::message method = bus.new_method_call( -+ service.c_str(), objPath.c_str(), PROP_INTF, "GetAll"); -+ -+ method.append(interface); -+ -+ try -+ { -+ sdbusplus::message::message reply = bus.call(method); -+ reply.read(properties); -+ } -+ catch (sdbusplus::exception_t&) -+ { -+ phosphor::logging::log<phosphor::logging::level::ERR>( -+ "Failed to get all properties", -+ phosphor::logging::entry("PATH=%s", objPath.c_str()), -+ phosphor::logging::entry("INTERFACE=%s", interface.c_str())); -+ throw std::runtime_error("ERROR in reading proerties"); -+ } -+ -+ return properties; -+} -+ -+void Manager::updateSOLParameter(uint8_t channelNum) -+{ -+ std::variant<uint8_t, bool> value; -+ sdbusplus::bus::bus dbus(ipmid_get_sd_bus_connection()); -+ static std::string solService{}; -+ ipmi::PropertyMap properties; -+ std::string ethdevice = ipmi::getChannelName(channelNum); -+ std::string solPathWitheEthName = solPath + ethdevice; -+ if (solService.empty()) -+ { -+ try -+ { -+ solService = getService(dbus, solInterface, solPathWitheEthName); -+ } -+ catch (const std::runtime_error& e) -+ { -+ solService.clear(); -+ phosphor::logging::log<phosphor::logging::level::ERR>( -+ "Error: get SOL service failed"); -+ return; -+ } -+ } -+ try -+ { -+ properties = getAllDbusProperties(dbus, solService, solPathWitheEthName, -+ solInterface); -+ } -+ catch (const std::runtime_error&) -+ { -+ phosphor::logging::log<phosphor::logging::level::ERR>( -+ "Error setting sol parameter"); -+ return; -+ } -+ -+ progress = std::get<uint8_t>(properties["Progress"]); -+ -+ enable = std::get<bool>(properties["Enable"]); -+ -+ forceEncrypt = std::get<bool>(properties["ForceEncryption"]); -+ -+ forceAuth = std::get<bool>(properties["ForceAuthentication"]); -+ -+ solMinPrivilege = static_cast<session::Privilege>( -+ std::get<uint8_t>(properties["Privilege"])); -+ -+ accumulateInterval = -+ std::get<uint8_t>((properties["AccumulateIntervalMS"])) * -+ sol::accIntervalFactor * 1ms; -+ -+ sendThreshold = std::get<uint8_t>(properties["Threshold"]); -+ -+ retryCount = std::get<uint8_t>(properties["RetryCount"]); -+ -+ retryInterval = std::get<uint8_t>(properties["RetryIntervalMS"]) * -+ sol::retryIntervalFactor * 1ms; -+ -+ return; -+} -+ - void Manager::startPayloadInstance(uint8_t payloadInstance, - session::SessionID sessionID) - { -diff --git a/sol/sol_manager.hpp b/sol/sol_manager.hpp -index 5b48add..4e797d4 100644 ---- a/sol/sol_manager.hpp -+++ b/sol/sol_manager.hpp -@@ -252,6 +252,7 @@ class Manager - * @return 0 on success and errno on failure. - */ - int writeConsoleSocket(const std::vector<uint8_t>& input) const; -+ void updateSOLParameter(uint8_t channelNum); - - private: - SOLPayloadMap payloadMap; -diff --git a/sol_module.cpp b/sol_module.cpp -index 8200e74..2b1fb46 100644 ---- a/sol_module.cpp -+++ b/sol_module.cpp -@@ -42,12 +42,6 @@ void registerCommands() - &getPayloadInfo, - session::Privilege::USER, - false}, -- // Set SOL Configuration Parameters -- {{(static_cast<uint32_t>(message::PayloadType::IPMI) << 16) | -- static_cast<uint16_t>(::command::NetFns::TRANSPORT) | 0x21}, -- &setConfParams, -- session::Privilege::ADMIN, -- false}, - // Get SOL Configuration Parameters - {{(static_cast<uint32_t>(message::PayloadType::IPMI) << 16) | - static_cast<uint16_t>(::command::NetFns::TRANSPORT) | 0x22}, --- -2.17.1 - diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net/0011-Remove-Get-SOL-Config-Command-from-Netipmid.patch b/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net/0011-Remove-Get-SOL-Config-Command-from-Netipmid.patch index da173704b..7b690998f 100644 --- a/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net/0011-Remove-Get-SOL-Config-Command-from-Netipmid.patch +++ b/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net/0011-Remove-Get-SOL-Config-Command-from-Netipmid.patch @@ -1,4 +1,4 @@ -From a36f181163974b2da0a954fc97a89fb2cdbd7287 Mon Sep 17 00:00:00 2001 +From adabdfa46aa0db56f40030c7077f991ba1987b04 Mon Sep 17 00:00:00 2001 From: Cheng C Yang <cheng.c.yang@intel.com> Date: Tue, 30 Apr 2019 05:35:31 +0800 Subject: [PATCH] Remove Get SOL Config Command from Netipmid @@ -28,21 +28,21 @@ Payload Port : 623 Signed-off-by: Cheng C Yang <cheng.c.yang@intel.com> --- - command/sol_cmds.cpp | 91 ---------------------------- - command/sol_cmds.hpp | 168 --------------------------------------------------- + command/sol_cmds.cpp | 86 ---------------------- + command/sol_cmds.hpp | 168 ------------------------------------------- sol_module.cpp | 6 -- - 3 files changed, 265 deletions(-) + 3 files changed, 260 deletions(-) diff --git a/command/sol_cmds.cpp b/command/sol_cmds.cpp -index 804b5ea..8b2d041 100644 +index 81dfc993236c..be2cc81fc9cc 100644 --- a/command/sol_cmds.cpp +++ b/command/sol_cmds.cpp -@@ -65,97 +65,6 @@ void activating(uint8_t payloadInstance, uint32_t sessionID) +@@ -69,92 +69,6 @@ void activating(uint8_t payloadInstance, uint32_t sessionID) outPayload); } -std::vector<uint8_t> getConfParams(const std::vector<uint8_t>& inPayload, -- const message::Handler& handler) +- std::shared_ptr<message::Handler>& handler) -{ - std::vector<uint8_t> outPayload(sizeof(GetConfParamsResponse)); - auto request = @@ -60,23 +60,22 @@ index 804b5ea..8b2d041 100644 - { - case Parameter::PROGRESS: - { -- outPayload.push_back( -- std::get<sol::Manager&>(singletonPool).progress); +- outPayload.push_back(sol::Manager::get().progress); - break; - } - case Parameter::ENABLE: - { -- outPayload.push_back(std::get<sol::Manager&>(singletonPool).enable); +- outPayload.push_back(sol::Manager::get().enable); - break; - } - case Parameter::AUTHENTICATION: - { - Auth value{0}; - -- value.encrypt = std::get<sol::Manager&>(singletonPool).forceEncrypt; -- value.auth = std::get<sol::Manager&>(singletonPool).forceAuth; -- value.privilege = static_cast<uint8_t>( -- std::get<sol::Manager&>(singletonPool).solMinPrivilege); +- value.encrypt = sol::Manager::get().forceEncrypt; +- value.auth = sol::Manager::get().forceAuth; +- value.privilege = +- static_cast<uint8_t>(sol::Manager::get().solMinPrivilege); - auto buffer = reinterpret_cast<const uint8_t*>(&value); - - std::copy_n(buffer, sizeof(value), std::back_inserter(outPayload)); @@ -86,11 +85,9 @@ index 804b5ea..8b2d041 100644 - { - Accumulate value{0}; - -- value.interval = std::get<sol::Manager&>(singletonPool) -- .accumulateInterval.count() / +- value.interval = sol::Manager::get().accumulateInterval.count() / - sol::accIntervalFactor; -- value.threshold = -- std::get<sol::Manager&>(singletonPool).sendThreshold; +- value.threshold = sol::Manager::get().sendThreshold; - auto buffer = reinterpret_cast<const uint8_t*>(&value); - - std::copy_n(buffer, sizeof(value), std::back_inserter(outPayload)); @@ -100,10 +97,9 @@ index 804b5ea..8b2d041 100644 - { - Retry value{0}; - -- value.count = std::get<sol::Manager&>(singletonPool).retryCount; -- value.interval = -- std::get<sol::Manager&>(singletonPool).retryInterval.count() / -- sol::retryIntervalFactor; +- value.count = sol::Manager::get().retryCount; +- value.interval = sol::Manager::get().retryInterval.count() / +- sol::retryIntervalFactor; - auto buffer = reinterpret_cast<const uint8_t*>(&value); - - std::copy_n(buffer, sizeof(value), std::back_inserter(outPayload)); @@ -119,8 +115,7 @@ index 804b5ea..8b2d041 100644 - } - case Parameter::CHANNEL: - { -- outPayload.push_back( -- std::get<sol::Manager&>(singletonPool).channel); +- outPayload.push_back(sol::Manager::get().channel); - break; - } - case Parameter::NVBITRATE: @@ -136,7 +131,7 @@ index 804b5ea..8b2d041 100644 } // namespace sol diff --git a/command/sol_cmds.hpp b/command/sol_cmds.hpp -index 182b73e..10cbf25 100644 +index 3e05e0fc035f..9aedfddf0d39 100644 --- a/command/sol_cmds.hpp +++ b/command/sol_cmds.hpp @@ -62,174 +62,6 @@ struct ActivatingRequest @@ -266,7 +261,7 @@ index 182b73e..10cbf25 100644 - * @return Response data for the command. - */ -std::vector<uint8_t> setConfParams(const std::vector<uint8_t>& inPayload, -- const message::Handler& handler); +- std::shared_ptr<message::Handler>& handler); - -/** @struct GetConfParamsRequest - * @@ -309,16 +304,16 @@ index 182b73e..10cbf25 100644 - * @return Response data for the command. - */ -std::vector<uint8_t> getConfParams(const std::vector<uint8_t>& inPayload, -- const message::Handler& handler); +- std::shared_ptr<message::Handler>& handler); - } // namespace command } // namespace sol diff --git a/sol_module.cpp b/sol_module.cpp -index 2b1fb46..6da82c0 100644 +index d9a9a7c9551f..21196d8a2cbf 100644 --- a/sol_module.cpp +++ b/sol_module.cpp -@@ -42,12 +42,6 @@ void registerCommands() +@@ -41,12 +41,6 @@ void registerCommands() &getPayloadInfo, session::Privilege::USER, false}, @@ -332,5 +327,5 @@ index 2b1fb46..6da82c0 100644 for (const auto& iter : commands) -- -2.7.4 +2.17.1 diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend b/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend index f10bb6ef4..86b8873f1 100644 --- a/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend +++ b/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend @@ -3,7 +3,7 @@ inherit useradd # TODO: This should be removed, once up-stream bump up # issue is resolved SRC_URI += "git://github.com/openbmc/phosphor-net-ipmid" -SRCREV = "2b1edef0b1e395591dcf751d7ccf45a85bb58d4c" +SRCREV = "60d6e4ed2b74c88621f43081951d86956557baa0" USERADD_PACKAGES = "${PN}" # add a group called ipmi @@ -21,7 +21,6 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" SRC_URI += " file://10-nice-rules.conf \ file://0006-Modify-dbus-namespace-of-chassis-control-for-guid.patch \ - file://0009-Add-dbus-interface-for-sol-commands.patch \ file://0011-Remove-Get-SOL-Config-Command-from-Netipmid.patch \ file://0012-crypt_algo-Null-check-on-Cipher-context.patch \ " diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/webui/phosphor-webui_%.bbappend b/meta-openbmc-mods/meta-common/recipes-phosphor/webui/phosphor-webui_%.bbappend index 36b155fe9..6b6793914 100644 --- a/meta-openbmc-mods/meta-common/recipes-phosphor/webui/phosphor-webui_%.bbappend +++ b/meta-openbmc-mods/meta-common/recipes-phosphor/webui/phosphor-webui_%.bbappend @@ -1,4 +1,4 @@ SRC_URI = "git://github.com/Intel-BMC/phosphor-webui;protocol=ssh;branch=intel2" FILESEXTRAPATHS_prepend_intel := "${THISDIR}/${PN}:" -SRCREV = "2397c142c0d75c7705757a52848945b00928232d" +SRCREV = "3e7346c1ea86c08ff2fafeee8f05c0937ffef731" diff --git a/meta-openbmc-mods/meta-common/recipes-support/curl/curl_7.77.0.bb b/meta-openbmc-mods/meta-common/recipes-support/curl/curl_7.78.0.bb index 9a5a40ec7..ce2f1e8be 100644 --- a/meta-openbmc-mods/meta-common/recipes-support/curl/curl_7.77.0.bb +++ b/meta-openbmc-mods/meta-common/recipes-support/curl/curl_7.78.0.bb @@ -9,8 +9,8 @@ SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \ file://0001-replace-krb5-config-with-pkg-config.patch \ " -SRC_URI[md5sum] = "045d28029679dabb6b20a814934671ad" -SRC_URI[sha256sum] = "6c0c28868cb82593859fc43b9c8fdb769314c855c05cf1b56b023acf855df8ea" +SRC_URI[md5sum] = "9a57717210a0bb0b6becda1497f0f2b5" +SRC_URI[sha256sum] = "98530b317dc95ccb324bbe4f834f07bb642fbc393b794ddf3434f246a71ea44a" CVE_PRODUCT = "curl libcurl" inherit autotools pkgconfig binconfig multilib_header @@ -55,7 +55,6 @@ EXTRA_OECONF = " \ --disable-ntlm-wb \ --enable-crypto-auth \ --with-ca-bundle=${sysconfdir}/ssl/certs/ca-certificates.crt \ - --without-libmetalink \ --without-libpsl \ " diff --git a/meta-openbmc-mods/meta-common/recipes-support/nettle/nettle_3.7.2.bb b/meta-openbmc-mods/meta-common/recipes-support/nettle/nettle_3.7.3.bb index 320a9048b..fd50ead17 100644 --- a/meta-openbmc-mods/meta-common/recipes-support/nettle/nettle_3.7.2.bb +++ b/meta-openbmc-mods/meta-common/recipes-support/nettle/nettle_3.7.3.bb @@ -23,8 +23,8 @@ SRC_URI_append_class-target = "\ file://dlopen-test.patch \ " -SRC_URI[md5sum] = "22849db27ed563ebbc829273f0c97e35" -SRC_URI[sha256sum] = "8d2a604ef1cde4cd5fb77e422531ea25ad064679ff0adf956e78b3352e0ef162" +SRC_URI[md5sum] = "a60273d0fab9c808646fcf5e9edc2e8f" +SRC_URI[sha256sum] = "661f5eb03f048a3b924c3a8ad2515d4068e40f67e774e8a26827658007e3bcf0" UPSTREAM_CHECK_REGEX = "nettle-(?P<pver>\d+(\.\d+)+)\.tar" |