-
Notifications
You must be signed in to change notification settings - Fork 587
[MEDIUM] Patch gcc for CVE-2021-32256 #13503
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
3b43161
to
3f8713b
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please investigate build failures
bace534
to
19eaba8
Compare
01ff9d3
to
a266df7
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
- Buddy Build
- patch applied during the build (check
rpm.log
) - patch include an upstream reference
- PR has security tag
SPECS/gcc/gcc.spec
Outdated
@@ -474,7 +476,7 @@ $tests_ok | |||
%files -n libgcc-devel | |||
%defattr(-,root,root) | |||
%{_lib64dir}/libgcc_s.so | |||
%{_libdir}/libcc1.* |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Kindly provide the reason for the removal?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@kgodara912 need your review |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please wait before merging.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Full build is failing for this change complaining that the the shared libraries which are removed in this patch were generated in that location itself
error: Installed (but unpackaged) file(s) found:
/usr/lib/libcc1.la
/usr/lib/libcc1.so
/usr/lib/libcc1.so.0
/usr/lib/libcc1.so.0.0.0
Though our local run only produces these files in %{_lib64dir}/libcc1.*
but full pipeline is producing these files in %{_libdir}/
as well. There is slight difference between local build and full build in compilation environment,
Full build (-L/lib/../lib
):
libtool: link: x86_64-pc-linux-gnu-g++ -fPIC -DPIC -shared -nostdlib /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../../../lib/crti.o /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/crtbeginS.o .libs/findcomp.o .libs/libcc1.o .libs/libcp1.o .libs/names.o .libs/callbacks.o .libs/connection.o .libs/marshall.o -Wl,-rpath -Wl,/usr/lib/../lib -Wl,-rpath -Wl,/usr/lib/../lib -L/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0 -L/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../../../lib -L/lib/../lib -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../.. /usr/lib/../lib/libstdc++.so -lm -lc -lgcc_s /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/crtendS.o /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../../../lib/crtn.o -m64 -mtune=generic -static-libstdc++ -static-libgcc -Wl,-z -Wl,relro -Wl,--as-needed -Wl,-z -Wl,now -Wl,-dT -Wl,/usr/src/mariner/BUILD/module_info.ld ../libiberty/pic/libiberty.a -Wl,-soname -Wl,libcc1.so.0 -Wl,-retain-symbols-file -Wl,../../libcc1/libcc1.sym -o .libs/libcc1.so.0.0.0
While local build gives (-L/lib/../lib64
/)
libtool: link: x86_64-pc-linux-gnu-g++ -fPIC -DPIC -shared -nostdlib /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../../../lib64/crti.o /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/crtbeginS.o .libs/findcomp.o .libs/libcc1.o .libs/libcp1.o .libs/names.o .libs/callbacks.o .libs/connection.o .libs/marshall.o -L/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0 -L/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../../../lib64 -L/lib/../lib64 -L/usr/lib/../lib64 -L/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../.. -lstdc++ -lm -lc -lgcc_s /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/crtendS.o /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../../../lib64/crtn.o -m64 -mtune=generic -static-libstdc++ -static-libgcc -Wl,-z -Wl,relro -Wl,--as-needed -Wl,-z -Wl,now -Wl,-dT -Wl,/usr/src/mariner/BUILD/module_info.ld ../libiberty/pic/libiberty.a -Wl,-soname -Wl,libcc1.so.0 -Wl,-retain-symbols-file -Wl,../../libcc1/libcc1.sym -o .libs/libcc1.so.0.0.0
Will understand a bit more to work it on both the environments, may be by putting conditionals or why the env difference is there with both are using Azure Linux 30. Will update with proper solution.
Based on the host machine, the compilation system may not generate libcc1 files on some systems, this commit will copy those files wherever they are missing.
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-static
subpackages, etc.) have had theirRelease
tag incremented../cgmanifest.json
,./toolkit/scripts/toolchain/cgmanifest.json
,.github/workflows/cgmanifest.json
)./LICENSES-AND-NOTICES/SPECS/data/licenses.json
,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md
,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON
)*.signatures.json
filessudo make go-tidy-all
andsudo make go-test-coverage
passSummary
What does the PR accomplish, why was it needed?
Patch gcc for CVE-2021-32256
Patch application confirmation
Change Log
Does this affect the toolchain?
NO
Associated issues
Links to CVEs
Test Methodology