* [zeus][PATCH 2/9] openssl: fix CVE-2019-1551
2019-12-18 3:20 [zeus][PATCH 0/9] zeus -next review Anuj Mittal
2019-12-18 3:20 ` [zeus][PATCH 1/9] git: upgrade 2.23.0 -> 2.23.1 Anuj Mittal
@ 2019-12-18 3:20 ` Anuj Mittal
2019-12-18 3:20 ` [zeus][PATCH 3/9] sysstat: fix CVE-2019-19725 Anuj Mittal
` (9 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: Anuj Mittal @ 2019-12-18 3:20 UTC (permalink / raw)
To: openembedded-core
(From OE-Core rev: 7a8165e0d833bc64c824fa2aee2ddad21d866675)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
.../openssl/openssl/CVE-2019-1551.patch | 758 ++++++++++++++++++
.../openssl/openssl_1.1.1d.bb | 1 +
2 files changed, 759 insertions(+)
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2019-1551.patch
diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2019-1551.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2019-1551.patch
new file mode 100644
index 0000000000..0cc19cb5f4
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/CVE-2019-1551.patch
@@ -0,0 +1,758 @@
+From 419102400a2811582a7a3d4a4e317d72e5ce0a8f Mon Sep 17 00:00:00 2001
+From: Andy Polyakov <appro@openssl.org>
+Date: Wed, 4 Dec 2019 12:48:21 +0100
+Subject: [PATCH] Fix an overflow bug in rsaz_512_sqr
+
+There is an overflow bug in the x64_64 Montgomery squaring procedure used in
+exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis
+suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a
+result of this defect would be very difficult to perform and are not believed
+likely. Attacks against DH512 are considered just feasible. However, for an
+attack the target would have to re-use the DH512 private key, which is not
+recommended anyway. Also applications directly using the low level API
+BN_mod_exp may be affected if they use BN_FLG_CONSTTIME.
+
+CVE-2019-1551
+
+Reviewed-by: Paul Dale <paul.dale@oracle.com>
+Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
+(Merged from https://github.com/openssl/openssl/pull/10575)
+
+CVE: CVE-2019-1551
+Upstream-Status: Backport
+Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
+---
+ crypto/bn/asm/rsaz-x86_64.pl | 381 ++++++++++++++++++-----------------
+ 1 file changed, 197 insertions(+), 184 deletions(-)
+
+diff --git a/crypto/bn/asm/rsaz-x86_64.pl b/crypto/bn/asm/rsaz-x86_64.pl
+index b1797b649f0..7534d5cd03e 100755
+--- a/crypto/bn/asm/rsaz-x86_64.pl
++++ b/crypto/bn/asm/rsaz-x86_64.pl
+@@ -116,7 +116,7 @@
+ subq \$128+24, %rsp
+ .cfi_adjust_cfa_offset 128+24
+ .Lsqr_body:
+- movq $mod, %rbp # common argument
++ movq $mod, %xmm1 # common off-load
+ movq ($inp), %rdx
+ movq 8($inp), %rax
+ movq $n0, 128(%rsp)
+@@ -134,7 +134,8 @@
+ .Loop_sqr:
+ movl $times,128+8(%rsp)
+ #first iteration
+- movq %rdx, %rbx
++ movq %rdx, %rbx # 0($inp)
++ mov %rax, %rbp # 8($inp)
+ mulq %rdx
+ movq %rax, %r8
+ movq 16($inp), %rax
+@@ -173,31 +174,29 @@
+ mulq %rbx
+ addq %rax, %r14
+ movq %rbx, %rax
+- movq %rdx, %r15
+- adcq \$0, %r15
++ adcq \$0, %rdx
+
+- addq %r8, %r8 #shlq \$1, %r8
+- movq %r9, %rcx
+- adcq %r9, %r9 #shld \$1, %r8, %r9
++ xorq %rcx,%rcx # rcx:r8 = r8 << 1
++ addq %r8, %r8
++ movq %rdx, %r15
++ adcq \$0, %rcx
+
+ mulq %rax
+- movq %rax, (%rsp)
+- addq %rdx, %r8
+- adcq \$0, %r9
++ addq %r8, %rdx
++ adcq \$0, %rcx
+
+- movq %r8, 8(%rsp)
+- shrq \$63, %rcx
++ movq %rax, (%rsp)
++ movq %rdx, 8(%rsp)
+
+ #second iteration
+- movq 8($inp), %r8
+ movq 16($inp), %rax
+- mulq %r8
++ mulq %rbp
+ addq %rax, %r10
+ movq 24($inp), %rax
+ movq %rdx, %rbx
+ adcq \$0, %rbx
+
+- mulq %r8
++ mulq %rbp
+ addq %rax, %r11
+ movq 32($inp), %rax
+ adcq \$0, %rdx
+@@ -205,7 +204,7 @@
+ movq %rdx, %rbx
+ adcq \$0, %rbx
+
+- mulq %r8
++ mulq %rbp
+ addq %rax, %r12
+ movq 40($inp), %rax
+ adcq \$0, %rdx
+@@ -213,7 +212,7 @@
+ movq %rdx, %rbx
+ adcq \$0, %rbx
+
+- mulq %r8
++ mulq %rbp
+ addq %rax, %r13
+ movq 48($inp), %rax
+ adcq \$0, %rdx
+@@ -221,7 +220,7 @@
+ movq %rdx, %rbx
+ adcq \$0, %rbx
+
+- mulq %r8
++ mulq %rbp
+ addq %rax, %r14
+ movq 56($inp), %rax
+ adcq \$0, %rdx
+@@ -229,39 +228,39 @@
+ movq %rdx, %rbx
+ adcq \$0, %rbx
+
+- mulq %r8
++ mulq %rbp
+ addq %rax, %r15
+- movq %r8, %rax
++ movq %rbp, %rax
+ adcq \$0, %rdx
+ addq %rbx, %r15
+- movq %rdx, %r8
+- movq %r10, %rdx
+- adcq \$0, %r8
++ adcq \$0, %rdx
+
+- add %rdx, %rdx
+- lea (%rcx,%r10,2), %r10 #shld \$1, %rcx, %r10
+- movq %r11, %rbx
+- adcq %r11, %r11 #shld \$1, %r10, %r11
++ xorq %rbx, %rbx # rbx:r10:r9 = r10:r9 << 1
++ addq %r9, %r9
++ movq %rdx, %r8
++ adcq %r10, %r10
++ adcq \$0, %rbx
+
+ mulq %rax
++ addq %rcx, %rax
++ movq 16($inp), %rbp
++ adcq \$0, %rdx
+ addq %rax, %r9
++ movq 24($inp), %rax
+ adcq %rdx, %r10
+- adcq \$0, %r11
++ adcq \$0, %rbx
+
+ movq %r9, 16(%rsp)
+ movq %r10, 24(%rsp)
+- shrq \$63, %rbx
+
+ #third iteration
+- movq 16($inp), %r9
+- movq 24($inp), %rax
+- mulq %r9
++ mulq %rbp
+ addq %rax, %r12
+ movq 32($inp), %rax
+ movq %rdx, %rcx
+ adcq \$0, %rcx
+
+- mulq %r9
++ mulq %rbp
+ addq %rax, %r13
+ movq 40($inp), %rax
+ adcq \$0, %rdx
+@@ -269,7 +268,7 @@
+ movq %rdx, %rcx
+ adcq \$0, %rcx
+
+- mulq %r9
++ mulq %rbp
+ addq %rax, %r14
+ movq 48($inp), %rax
+ adcq \$0, %rdx
+@@ -277,9 +276,7 @@
+ movq %rdx, %rcx
+ adcq \$0, %rcx
+
+- mulq %r9
+- movq %r12, %r10
+- lea (%rbx,%r12,2), %r12 #shld \$1, %rbx, %r12
++ mulq %rbp
+ addq %rax, %r15
+ movq 56($inp), %rax
+ adcq \$0, %rdx
+@@ -287,36 +284,40 @@
+ movq %rdx, %rcx
+ adcq \$0, %rcx
+
+- mulq %r9
+- shrq \$63, %r10
++ mulq %rbp
+ addq %rax, %r8
+- movq %r9, %rax
++ movq %rbp, %rax
+ adcq \$0, %rdx
+ addq %rcx, %r8
+- movq %rdx, %r9
+- adcq \$0, %r9
++ adcq \$0, %rdx
+
+- movq %r13, %rcx
+- leaq (%r10,%r13,2), %r13 #shld \$1, %r12, %r13
++ xorq %rcx, %rcx # rcx:r12:r11 = r12:r11 << 1
++ addq %r11, %r11
++ movq %rdx, %r9
++ adcq %r12, %r12
++ adcq \$0, %rcx
+
+ mulq %rax
++ addq %rbx, %rax
++ movq 24($inp), %r10
++ adcq \$0, %rdx
+ addq %rax, %r11
++ movq 32($inp), %rax
+ adcq %rdx, %r12
+- adcq \$0, %r13
++ adcq \$0, %rcx
+
+ movq %r11, 32(%rsp)
+ movq %r12, 40(%rsp)
+- shrq \$63, %rcx
+
+ #fourth iteration
+- movq 24($inp), %r10
+- movq 32($inp), %rax
++ mov %rax, %r11 # 32($inp)
+ mulq %r10
+ addq %rax, %r14
+ movq 40($inp), %rax
+ movq %rdx, %rbx
+ adcq \$0, %rbx
+
++ mov %rax, %r12 # 40($inp)
+ mulq %r10
+ addq %rax, %r15
+ movq 48($inp), %rax
+@@ -325,9 +326,8 @@
+ movq %rdx, %rbx
+ adcq \$0, %rbx
+
++ mov %rax, %rbp # 48($inp)
+ mulq %r10
+- movq %r14, %r12
+- leaq (%rcx,%r14,2), %r14 #shld \$1, %rcx, %r14
+ addq %rax, %r8
+ movq 56($inp), %rax
+ adcq \$0, %rdx
+@@ -336,32 +336,33 @@
+ adcq \$0, %rbx
+
+ mulq %r10
+- shrq \$63, %r12
+ addq %rax, %r9
+ movq %r10, %rax
+ adcq \$0, %rdx
+ addq %rbx, %r9
+- movq %rdx, %r10
+- adcq \$0, %r10
++ adcq \$0, %rdx
+
+- movq %r15, %rbx
+- leaq (%r12,%r15,2),%r15 #shld \$1, %r14, %r15
++ xorq %rbx, %rbx # rbx:r13:r14 = r13:r14 << 1
++ addq %r13, %r13
++ movq %rdx, %r10
++ adcq %r14, %r14
++ adcq \$0, %rbx
+
+ mulq %rax
++ addq %rcx, %rax
++ adcq \$0, %rdx
+ addq %rax, %r13
++ movq %r12, %rax # 40($inp)
+ adcq %rdx, %r14
+- adcq \$0, %r15
++ adcq \$0, %rbx
+
+ movq %r13, 48(%rsp)
+ movq %r14, 56(%rsp)
+- shrq \$63, %rbx
+
+ #fifth iteration
+- movq 32($inp), %r11
+- movq 40($inp), %rax
+ mulq %r11
+ addq %rax, %r8
+- movq 48($inp), %rax
++ movq %rbp, %rax # 48($inp)
+ movq %rdx, %rcx
+ adcq \$0, %rcx
+
+@@ -369,97 +370,99 @@
+ addq %rax, %r9
+ movq 56($inp), %rax
+ adcq \$0, %rdx
+- movq %r8, %r12
+- leaq (%rbx,%r8,2), %r8 #shld \$1, %rbx, %r8
+ addq %rcx, %r9
+ movq %rdx, %rcx
+ adcq \$0, %rcx
+
++ mov %rax, %r14 # 56($inp)
+ mulq %r11
+- shrq \$63, %r12
+ addq %rax, %r10
+ movq %r11, %rax
+ adcq \$0, %rdx
+ addq %rcx, %r10
+- movq %rdx, %r11
+- adcq \$0, %r11
++ adcq \$0, %rdx
+
+- movq %r9, %rcx
+- leaq (%r12,%r9,2), %r9 #shld \$1, %r8, %r9
++ xorq %rcx, %rcx # rcx:r8:r15 = r8:r15 << 1
++ addq %r15, %r15
++ movq %rdx, %r11
++ adcq %r8, %r8
++ adcq \$0, %rcx
+
+ mulq %rax
++ addq %rbx, %rax
++ adcq \$0, %rdx
+ addq %rax, %r15
++ movq %rbp, %rax # 48($inp)
+ adcq %rdx, %r8
+- adcq \$0, %r9
++ adcq \$0, %rcx
+
+ movq %r15, 64(%rsp)
+ movq %r8, 72(%rsp)
+- shrq \$63, %rcx
+
+ #sixth iteration
+- movq 40($inp), %r12
+- movq 48($inp), %rax
+ mulq %r12
+ addq %rax, %r10
+- movq 56($inp), %rax
++ movq %r14, %rax # 56($inp)
+ movq %rdx, %rbx
+ adcq \$0, %rbx
+
+ mulq %r12
+ addq %rax, %r11
+ movq %r12, %rax
+- movq %r10, %r15
+- leaq (%rcx,%r10,2), %r10 #shld \$1, %rcx, %r10
+ adcq \$0, %rdx
+- shrq \$63, %r15
+ addq %rbx, %r11
+- movq %rdx, %r12
+- adcq \$0, %r12
++ adcq \$0, %rdx
+
+- movq %r11, %rbx
+- leaq (%r15,%r11,2), %r11 #shld \$1, %r10, %r11
++ xorq %rbx, %rbx # rbx:r10:r9 = r10:r9 << 1
++ addq %r9, %r9
++ movq %rdx, %r12
++ adcq %r10, %r10
++ adcq \$0, %rbx
+
+ mulq %rax
++ addq %rcx, %rax
++ adcq \$0, %rdx
+ addq %rax, %r9
++ movq %r14, %rax # 56($inp)
+ adcq %rdx, %r10
+- adcq \$0, %r11
++ adcq \$0, %rbx
+
+ movq %r9, 80(%rsp)
+ movq %r10, 88(%rsp)
+
+ #seventh iteration
+- movq 48($inp), %r13
+- movq 56($inp), %rax
+- mulq %r13
++ mulq %rbp
+ addq %rax, %r12
+- movq %r13, %rax
+- movq %rdx, %r13
+- adcq \$0, %r13
++ movq %rbp, %rax
++ adcq \$0, %rdx
+
+- xorq %r14, %r14
+- shlq \$1, %rbx
+- adcq %r12, %r12 #shld \$1, %rbx, %r12
+- adcq %r13, %r13 #shld \$1, %r12, %r13
+- adcq %r14, %r14 #shld \$1, %r13, %r14
++ xorq %rcx, %rcx # rcx:r12:r11 = r12:r11 << 1
++ addq %r11, %r11
++ movq %rdx, %r13
++ adcq %r12, %r12
++ adcq \$0, %rcx
+
+ mulq %rax
++ addq %rbx, %rax
++ adcq \$0, %rdx
+ addq %rax, %r11
++ movq %r14, %rax # 56($inp)
+ adcq %rdx, %r12
+- adcq \$0, %r13
++ adcq \$0, %rcx
+
+ movq %r11, 96(%rsp)
+ movq %r12, 104(%rsp)
+
+ #eighth iteration
+- movq 56($inp), %rax
++ xorq %rbx, %rbx # rbx:r13 = r13 << 1
++ addq %r13, %r13
++ adcq \$0, %rbx
++
+ mulq %rax
+- addq %rax, %r13
++ addq %rcx, %rax
+ adcq \$0, %rdx
+-
+- addq %rdx, %r14
+-
+- movq %r13, 112(%rsp)
+- movq %r14, 120(%rsp)
++ addq %r13, %rax
++ adcq %rbx, %rdx
+
+ movq (%rsp), %r8
+ movq 8(%rsp), %r9
+@@ -469,6 +472,10 @@
+ movq 40(%rsp), %r13
+ movq 48(%rsp), %r14
+ movq 56(%rsp), %r15
++ movq %xmm1, %rbp
++
++ movq %rax, 112(%rsp)
++ movq %rdx, 120(%rsp)
+
+ call __rsaz_512_reduce
+
+@@ -500,9 +507,9 @@
+ .Loop_sqrx:
+ movl $times,128+8(%rsp)
+ movq $out, %xmm0 # off-load
+- movq %rbp, %xmm1 # off-load
+ #first iteration
+ mulx %rax, %r8, %r9
++ mov %rax, %rbx
+
+ mulx 16($inp), %rcx, %r10
+ xor %rbp, %rbp # cf=0, of=0
+@@ -510,40 +517,39 @@
+ mulx 24($inp), %rax, %r11
+ adcx %rcx, %r9
+
+- mulx 32($inp), %rcx, %r12
++ .byte 0xc4,0x62,0xf3,0xf6,0xa6,0x20,0x00,0x00,0x00 # mulx 32($inp), %rcx, %r12
+ adcx %rax, %r10
+
+- mulx 40($inp), %rax, %r13
++ .byte 0xc4,0x62,0xfb,0xf6,0xae,0x28,0x00,0x00,0x00 # mulx 40($inp), %rax, %r13
+ adcx %rcx, %r11
+
+- .byte 0xc4,0x62,0xf3,0xf6,0xb6,0x30,0x00,0x00,0x00 # mulx 48($inp), %rcx, %r14
++ mulx 48($inp), %rcx, %r14
+ adcx %rax, %r12
+ adcx %rcx, %r13
+
+- .byte 0xc4,0x62,0xfb,0xf6,0xbe,0x38,0x00,0x00,0x00 # mulx 56($inp), %rax, %r15
++ mulx 56($inp), %rax, %r15
+ adcx %rax, %r14
+ adcx %rbp, %r15 # %rbp is 0
+
+- mov %r9, %rcx
+- shld \$1, %r8, %r9
+- shl \$1, %r8
+-
+- xor %ebp, %ebp
+- mulx %rdx, %rax, %rdx
+- adcx %rdx, %r8
+- mov 8($inp), %rdx
+- adcx %rbp, %r9
++ mulx %rdx, %rax, $out
++ mov %rbx, %rdx # 8($inp)
++ xor %rcx, %rcx
++ adox %r8, %r8
++ adcx $out, %r8
++ adox %rbp, %rcx
++ adcx %rbp, %rcx
+
+ mov %rax, (%rsp)
+ mov %r8, 8(%rsp)
+
+ #second iteration
+- mulx 16($inp), %rax, %rbx
++ .byte 0xc4,0xe2,0xfb,0xf6,0x9e,0x10,0x00,0x00,0x00 # mulx 16($inp), %rax, %rbx
+ adox %rax, %r10
+ adcx %rbx, %r11
+
+- .byte 0xc4,0x62,0xc3,0xf6,0x86,0x18,0x00,0x00,0x00 # mulx 24($inp), $out, %r8
++ mulx 24($inp), $out, %r8
+ adox $out, %r11
++ .byte 0x66
+ adcx %r8, %r12
+
+ mulx 32($inp), %rax, %rbx
+@@ -561,24 +567,25 @@
+ .byte 0xc4,0x62,0xc3,0xf6,0x86,0x38,0x00,0x00,0x00 # mulx 56($inp), $out, %r8
+ adox $out, %r15
+ adcx %rbp, %r8
++ mulx %rdx, %rax, $out
+ adox %rbp, %r8
++ .byte 0x48,0x8b,0x96,0x10,0x00,0x00,0x00 # mov 16($inp), %rdx
+
+- mov %r11, %rbx
+- shld \$1, %r10, %r11
+- shld \$1, %rcx, %r10
+-
+- xor %ebp,%ebp
+- mulx %rdx, %rax, %rcx
+- mov 16($inp), %rdx
++ xor %rbx, %rbx
++ adcx %rcx, %rax
++ adox %r9, %r9
++ adcx %rbp, $out
++ adox %r10, %r10
+ adcx %rax, %r9
+- adcx %rcx, %r10
+- adcx %rbp, %r11
++ adox %rbp, %rbx
++ adcx $out, %r10
++ adcx %rbp, %rbx
+
+ mov %r9, 16(%rsp)
+ .byte 0x4c,0x89,0x94,0x24,0x18,0x00,0x00,0x00 # mov %r10, 24(%rsp)
+
+ #third iteration
+- .byte 0xc4,0x62,0xc3,0xf6,0x8e,0x18,0x00,0x00,0x00 # mulx 24($inp), $out, %r9
++ mulx 24($inp), $out, %r9
+ adox $out, %r12
+ adcx %r9, %r13
+
+@@ -586,7 +593,7 @@
+ adox %rax, %r13
+ adcx %rcx, %r14
+
+- mulx 40($inp), $out, %r9
++ .byte 0xc4,0x62,0xc3,0xf6,0x8e,0x28,0x00,0x00,0x00 # mulx 40($inp), $out, %r9
+ adox $out, %r14
+ adcx %r9, %r15
+
+@@ -594,27 +601,28 @@
+ adox %rax, %r15
+ adcx %rcx, %r8
+
+- .byte 0xc4,0x62,0xc3,0xf6,0x8e,0x38,0x00,0x00,0x00 # mulx 56($inp), $out, %r9
++ mulx 56($inp), $out, %r9
+ adox $out, %r8
+ adcx %rbp, %r9
++ mulx %rdx, %rax, $out
+ adox %rbp, %r9
++ mov 24($inp), %rdx
+
+- mov %r13, %rcx
+- shld \$1, %r12, %r13
+- shld \$1, %rbx, %r12
+-
+- xor %ebp, %ebp
+- mulx %rdx, %rax, %rdx
++ xor %rcx, %rcx
++ adcx %rbx, %rax
++ adox %r11, %r11
++ adcx %rbp, $out
++ adox %r12, %r12
+ adcx %rax, %r11
+- adcx %rdx, %r12
+- mov 24($inp), %rdx
+- adcx %rbp, %r13
++ adox %rbp, %rcx
++ adcx $out, %r12
++ adcx %rbp, %rcx
+
+ mov %r11, 32(%rsp)
+- .byte 0x4c,0x89,0xa4,0x24,0x28,0x00,0x00,0x00 # mov %r12, 40(%rsp)
++ mov %r12, 40(%rsp)
+
+ #fourth iteration
+- .byte 0xc4,0xe2,0xfb,0xf6,0x9e,0x20,0x00,0x00,0x00 # mulx 32($inp), %rax, %rbx
++ mulx 32($inp), %rax, %rbx
+ adox %rax, %r14
+ adcx %rbx, %r15
+
+@@ -629,25 +637,25 @@
+ mulx 56($inp), $out, %r10
+ adox $out, %r9
+ adcx %rbp, %r10
++ mulx %rdx, %rax, $out
+ adox %rbp, %r10
++ mov 32($inp), %rdx
+
+- .byte 0x66
+- mov %r15, %rbx
+- shld \$1, %r14, %r15
+- shld \$1, %rcx, %r14
+-
+- xor %ebp, %ebp
+- mulx %rdx, %rax, %rdx
++ xor %rbx, %rbx
++ adcx %rcx, %rax
++ adox %r13, %r13
++ adcx %rbp, $out
++ adox %r14, %r14
+ adcx %rax, %r13
+- adcx %rdx, %r14
+- mov 32($inp), %rdx
+- adcx %rbp, %r15
++ adox %rbp, %rbx
++ adcx $out, %r14
++ adcx %rbp, %rbx
+
+ mov %r13, 48(%rsp)
+ mov %r14, 56(%rsp)
+
+ #fifth iteration
+- .byte 0xc4,0x62,0xc3,0xf6,0x9e,0x28,0x00,0x00,0x00 # mulx 40($inp), $out, %r11
++ mulx 40($inp), $out, %r11
+ adox $out, %r8
+ adcx %r11, %r9
+
+@@ -658,18 +666,19 @@
+ mulx 56($inp), $out, %r11
+ adox $out, %r10
+ adcx %rbp, %r11
++ mulx %rdx, %rax, $out
++ mov 40($inp), %rdx
+ adox %rbp, %r11
+
+- mov %r9, %rcx
+- shld \$1, %r8, %r9
+- shld \$1, %rbx, %r8
+-
+- xor %ebp, %ebp
+- mulx %rdx, %rax, %rdx
++ xor %rcx, %rcx
++ adcx %rbx, %rax
++ adox %r15, %r15
++ adcx %rbp, $out
++ adox %r8, %r8
+ adcx %rax, %r15
+- adcx %rdx, %r8
+- mov 40($inp), %rdx
+- adcx %rbp, %r9
++ adox %rbp, %rcx
++ adcx $out, %r8
++ adcx %rbp, %rcx
+
+ mov %r15, 64(%rsp)
+ mov %r8, 72(%rsp)
+@@ -682,18 +691,19 @@
+ .byte 0xc4,0x62,0xc3,0xf6,0xa6,0x38,0x00,0x00,0x00 # mulx 56($inp), $out, %r12
+ adox $out, %r11
+ adcx %rbp, %r12
++ mulx %rdx, %rax, $out
+ adox %rbp, %r12
++ mov 48($inp), %rdx
+
+- mov %r11, %rbx
+- shld \$1, %r10, %r11
+- shld \$1, %rcx, %r10
+-
+- xor %ebp, %ebp
+- mulx %rdx, %rax, %rdx
++ xor %rbx, %rbx
++ adcx %rcx, %rax
++ adox %r9, %r9
++ adcx %rbp, $out
++ adox %r10, %r10
+ adcx %rax, %r9
+- adcx %rdx, %r10
+- mov 48($inp), %rdx
+- adcx %rbp, %r11
++ adcx $out, %r10
++ adox %rbp, %rbx
++ adcx %rbp, %rbx
+
+ mov %r9, 80(%rsp)
+ mov %r10, 88(%rsp)
+@@ -703,31 +713,31 @@
+ adox %rax, %r12
+ adox %rbp, %r13
+
+- xor %r14, %r14
+- shld \$1, %r13, %r14
+- shld \$1, %r12, %r13
+- shld \$1, %rbx, %r12
+-
+- xor %ebp, %ebp
+- mulx %rdx, %rax, %rdx
+- adcx %rax, %r11
+- adcx %rdx, %r12
++ mulx %rdx, %rax, $out
++ xor %rcx, %rcx
+ mov 56($inp), %rdx
+- adcx %rbp, %r13
++ adcx %rbx, %rax
++ adox %r11, %r11
++ adcx %rbp, $out
++ adox %r12, %r12
++ adcx %rax, %r11
++ adox %rbp, %rcx
++ adcx $out, %r12
++ adcx %rbp, %rcx
+
+ .byte 0x4c,0x89,0x9c,0x24,0x60,0x00,0x00,0x00 # mov %r11, 96(%rsp)
+ .byte 0x4c,0x89,0xa4,0x24,0x68,0x00,0x00,0x00 # mov %r12, 104(%rsp)
+
+ #eighth iteration
+ mulx %rdx, %rax, %rdx
+- adox %rax, %r13
+- adox %rbp, %rdx
++ xor %rbx, %rbx
++ adcx %rcx, %rax
++ adox %r13, %r13
++ adcx %rbp, %rdx
++ adox %rbp, %rbx
++ adcx %r13, %rax
++ adcx %rdx, %rbx
+
+- .byte 0x66
+- add %rdx, %r14
+-
+- movq %r13, 112(%rsp)
+- movq %r14, 120(%rsp)
+ movq %xmm0, $out
+ movq %xmm1, %rbp
+
+@@ -741,6 +751,9 @@
+ movq 48(%rsp), %r14
+ movq 56(%rsp), %r15
+
++ movq %rax, 112(%rsp)
++ movq %rbx, 120(%rsp)
++
+ call __rsaz_512_reducex
+
+ addq 64(%rsp), %r8
diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1d.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1d.bb
index 8819e19ec4..9fe80e5fd2 100644
--- a/meta/recipes-connectivity/openssl/openssl_1.1.1d.bb
+++ b/meta/recipes-connectivity/openssl/openssl_1.1.1d.bb
@@ -16,6 +16,7 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \
file://0001-skip-test_symbol_presence.patch \
file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \
file://afalg.patch \
+ file://CVE-2019-1551.patch \
"
SRC_URI_append_class-nativesdk = " \
--
2.21.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [zeus][PATCH 9/9] lttng-modules: fix NULL pointer deference error when testing rpc_task_running
2019-12-18 3:20 [zeus][PATCH 0/9] zeus -next review Anuj Mittal
` (7 preceding siblings ...)
2019-12-18 3:20 ` [zeus][PATCH 8/9] systemd-systemctl: Fix handling of aliased targets Anuj Mittal
@ 2019-12-18 3:20 ` Anuj Mittal
2019-12-18 3:32 ` ✗ patchtest: failure for zeus -next review (rev3) Patchwork
` (2 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: Anuj Mittal @ 2019-12-18 3:20 UTC (permalink / raw)
To: openembedded-core
From: Quanyang Wang <quanyang.wang@windriver.com>
This is a backport from upstream https://github.com/lttng/lttng-modules.git stable-2.10
to fix NULL pointer deference error when running kts testcase lttng_syscall_events.
(From OE-Core rev: a522ccff838ba1577255c90e64d98dd75470fb0a)
Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
...ops-when-trace-sunrpc_task-events-in.patch | 94 +++++++++++++
...rpc_clnt-dereference-in-rpc_task_que.patch | 44 ++++++
...rpc-use-signed-integer-for-client-id.patch | 105 ++++++++++++++
...nrpc-introduce-lttng_get_clid-helper.patch | 130 ++++++++++++++++++
.../lttng/lttng-modules_2.10.11.bb | 4 +
5 files changed, 377 insertions(+)
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0001-Fix-SUNRPC-Fix-oops-when-trace-sunrpc_task-events-in.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0002-Fix-sunrpc-null-rpc_clnt-dereference-in-rpc_task_que.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0003-Fix-sunrpc-use-signed-integer-for-client-id.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0004-sunrpc-introduce-lttng_get_clid-helper.patch
diff --git a/meta/recipes-kernel/lttng/lttng-modules/0001-Fix-SUNRPC-Fix-oops-when-trace-sunrpc_task-events-in.patch b/meta/recipes-kernel/lttng/lttng-modules/0001-Fix-SUNRPC-Fix-oops-when-trace-sunrpc_task-events-in.patch
new file mode 100644
index 0000000000..bdbc4f811e
--- /dev/null
+++ b/meta/recipes-kernel/lttng/lttng-modules/0001-Fix-SUNRPC-Fix-oops-when-trace-sunrpc_task-events-in.patch
@@ -0,0 +1,94 @@
+From 1ff7013bcf7f068cf4371d12d758f9c0fd16a619 Mon Sep 17 00:00:00 2001
+From: Quanyang Wang <quanyang.wang@windriver.com>
+Date: Thu, 5 Dec 2019 15:35:32 +0800
+Subject: [PATCH 1/4] Fix: SUNRPC: Fix oops when trace sunrpc_task events in
+ nfs client
+
+See upstream commit :
+
+ commit 2ca310fc4160ed0420da65534a21ae77b24326a8
+ Author: Ditang Chen <chendt.fnst@cn.fujitsu.com>
+ Date: Fri, 7 Mar 2014 13:27:57 +0800
+ Subject: SUNRPC: Fix oops when trace sunrpc_task events in nfs client
+
+ When tracking sunrpc_task events in nfs client, the clnt pointer may be NULL.
+
+ [ 139.269266] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
+ [ 139.269915] IP: [<ffffffffa026f216>] ftrace_raw_event_rpc_task_running+0x86/0xf0 [sunrpc]
+ [ 139.269915] PGD 1d293067 PUD 1d294067 PMD 0
+ [ 139.269915] Oops: 0000 [#1] SMP
+ [ 139.269915] Modules linked in: nfsv4 dns_resolver nfs lockd sunrpc fscache sg ppdev e1000
+ serio_raw pcspkr parport_pc parport i2c_piix4 i2c_core microcode xfs libcrc32c sd_mod sr_mod
+ cdrom ata_generic crc_t10dif crct10dif_common pata_acpi ahci libahci ata_piix libata dm_mirror
+ dm_region_hash dm_log dm_mod
+ [ 139.269915] CPU: 0 PID: 59 Comm: kworker/0:2 Not tainted 3.10.0-84.el7.x86_64 #1
+ [ 139.269915] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+ [ 139.269915] Workqueue: rpciod rpc_async_schedule [sunrpc]
+ [ 139.269915] task: ffff88001b598000 ti: ffff88001b632000 task.ti: ffff88001b632000
+ [ 139.269915] RIP: 0010:[<ffffffffa026f216>] [<ffffffffa026f216>] ftrace_raw_event_rpc_task_running+0x86/0xf0 [sunrpc]
+ [ 139.269915] RSP: 0018:ffff88001b633d70 EFLAGS: 00010206
+ [ 139.269915] RAX: ffff88001dfc5338 RBX: ffff88001cc37a00 RCX: ffff88001dfc5334
+ [ 139.269915] RDX: ffff88001dfc5338 RSI: 0000000000000000 RDI: ffff88001dfc533c
+ [ 139.269915] RBP: ffff88001b633db0 R08: 000000000000002c R09: 000000000000000a
+ [ 139.269915] R10: 0000000000062180 R11: 00000020759fb9dc R12: ffffffffa0292c20
+ [ 139.269915] R13: ffff88001dfc5334 R14: 0000000000000000 R15: 0000000000000000
+ [ 139.269915] FS: 0000000000000000(0000) GS:ffff88001fc00000(0000) knlGS:0000000000000000
+ [ 139.269915] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+ [ 139.269915] CR2: 0000000000000004 CR3: 000000001d290000 CR4: 00000000000006f0
+ [ 139.269915] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ [ 139.269915] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+ [ 139.269915] Stack:
+ [ 139.269915] 000000001b633d98 0000000000000246 ffff88001df1dc00 ffff88001cc37a00
+ [ 139.269915] ffff88001bc35e60 0000000000000000 ffff88001ffa0a48 ffff88001bc35ee0
+ [ 139.269915] ffff88001b633e08 ffffffffa02704b5 0000000000010000 ffff88001cc37a70
+ [ 139.269915] Call Trace:
+ [ 139.269915] [<ffffffffa02704b5>] __rpc_execute+0x1d5/0x400 [sunrpc]
+ [ 139.269915] [<ffffffffa0270706>] rpc_async_schedule+0x26/0x30 [sunrpc]
+ [ 139.269915] [<ffffffff8107867b>] process_one_work+0x17b/0x460
+ [ 139.269915] [<ffffffff8107942b>] worker_thread+0x11b/0x400
+ [ 139.269915] [<ffffffff81079310>] ? rescuer_thread+0x3e0/0x3e0
+ [ 139.269915] [<ffffffff8107fc80>] kthread+0xc0/0xd0
+ [ 139.269915] [<ffffffff8107fbc0>] ? kthread_create_on_node+0x110/0x110
+ [ 139.269915] [<ffffffff815d122c>] ret_from_fork+0x7c/0xb0
+ [ 139.269915] [<ffffffff8107fbc0>] ? kthread_create_on_node+0x110/0x110
+ [ 139.269915] Code: 4c 8b 45 c8 48 8d 7d d0 89 4d c4 41 89 c9 b9 28 00 00 00 e8 9d b4 e9
+ e0 48 85 c0 49 89 c5 74 a2 48 89 c7 e8 9d 3f e9 e0 48 89 c2 <41> 8b 46 04 48 8b 7d d0 4c
+ 89 e9 4c 89 e6 89 42 0c 0f b7 83 d4
+ [ 139.269915] RIP [<ffffffffa026f216>] ftrace_raw_event_rpc_task_running+0x86/0xf0 [sunrpc]
+ [ 139.269915] RSP <ffff88001b633d70>
+ [ 139.269915] CR2: 0000000000000004
+ [ 140.946406] ---[ end trace ba486328b98d7622 ]---
+
+Upstream-Status: Backport [https://github.com/lttng/lttng-modules/commit/2b228b503cad10bf0c5a99b42a908ca906eab5b9]
+
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+---
+ instrumentation/events/lttng-module/rpc.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/instrumentation/events/lttng-module/rpc.h b/instrumentation/events/lttng-module/rpc.h
+index 3798e8e..fb13106 100644
+--- a/instrumentation/events/lttng-module/rpc.h
++++ b/instrumentation/events/lttng-module/rpc.h
+@@ -139,7 +139,7 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_running,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(unsigned int, client_id, task->tk_client->cl_clid)
++ ctf_integer(unsigned int, client_id, task->tk_client ? task->tk_client->cl_clid : -1)
+ ctf_integer_hex(const void *, action, action)
+ ctf_integer(unsigned long, runstate, task->tk_runstate)
+ ctf_integer(int, status, task->tk_status)
+@@ -208,7 +208,7 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_running,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(unsigned int, client_id, task->tk_client->cl_clid)
++ ctf_integer(unsigned int, client_id, task->tk_client ? task->tk_client->cl_clid : -1)
+ ctf_integer_hex(const void *, action, action)
+ ctf_integer(unsigned long, runstate, task->tk_runstate)
+ ctf_integer(int, status, task->tk_status)
+--
+2.17.1
+
diff --git a/meta/recipes-kernel/lttng/lttng-modules/0002-Fix-sunrpc-null-rpc_clnt-dereference-in-rpc_task_que.patch b/meta/recipes-kernel/lttng/lttng-modules/0002-Fix-sunrpc-null-rpc_clnt-dereference-in-rpc_task_que.patch
new file mode 100644
index 0000000000..03264bac68
--- /dev/null
+++ b/meta/recipes-kernel/lttng/lttng-modules/0002-Fix-sunrpc-null-rpc_clnt-dereference-in-rpc_task_que.patch
@@ -0,0 +1,44 @@
+From 032a74d83b263c4faead8e4c25d497fb8ea07b6e Mon Sep 17 00:00:00 2001
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Date: Thu, 12 Dec 2019 10:29:02 -0500
+Subject: [PATCH 2/4] Fix: sunrpc: null rpc_clnt dereference in rpc_task_queued
+ tracepoint
+
+Based on upstream Linux commit:
+
+commit 0be283f676a1e7b208db0c992283197ef8b52158
+Author: Benjamin Coddington <bcodding@redhat.com>
+Date: Tue Jan 23 09:32:35 2018 -0500
+
+ SUNRPC: Fix null rpc_clnt dereference in rpc_task_queued tracepoint
+
+ Backchannel tasks will not have a reference to the rpc_clnt. Return -1 for
+ cl_clid in that case.
+
+ Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+ Signed-off-by: Trond Myklebust <trondmy@gmail.com>
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Upstream-Status: Backport [https://github.com/lttng/lttng-modules/commit/8f83a9103dcdf4f6b73783427fc5ded4869309d5]
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+---
+ instrumentation/events/lttng-module/rpc.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/instrumentation/events/lttng-module/rpc.h b/instrumentation/events/lttng-module/rpc.h
+index fb13106..68c622c 100644
+--- a/instrumentation/events/lttng-module/rpc.h
++++ b/instrumentation/events/lttng-module/rpc.h
+@@ -176,7 +176,8 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_queued,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(unsigned int, client_id, task->tk_client->cl_clid)
++ ctf_integer(unsigned int, client_id, task->tk_client ?
++ task->tk_client->cl_clid : -1)
+ ctf_integer(unsigned long, timeout, task->tk_timeout)
+ ctf_integer(unsigned long, runstate, task->tk_runstate)
+ ctf_integer(int, status, task->tk_status)
+--
+2.17.1
+
diff --git a/meta/recipes-kernel/lttng/lttng-modules/0003-Fix-sunrpc-use-signed-integer-for-client-id.patch b/meta/recipes-kernel/lttng/lttng-modules/0003-Fix-sunrpc-use-signed-integer-for-client-id.patch
new file mode 100644
index 0000000000..c7529f16dd
--- /dev/null
+++ b/meta/recipes-kernel/lttng/lttng-modules/0003-Fix-sunrpc-use-signed-integer-for-client-id.patch
@@ -0,0 +1,105 @@
+From 70389e422dd3146161089d454f525367c9046ecd Mon Sep 17 00:00:00 2001
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Date: Thu, 12 Dec 2019 10:29:37 -0500
+Subject: [PATCH 3/4] Fix: sunrpc: use signed integer for client id
+
+Within include/linux/sunrpc/clnt.h:struct rpc_cltn, the cl_clid field
+is an unsigned integer, which is the type expected by the tracepoint
+signature.
+
+However, looking into net/sunrpc/clnt.c:rpc_alloc_clid(), its allocation
+considers negative signed integer as errors.
+
+Therefore, in order to properly show "-1" in the trace output (rather
+than MAX_INT) when called with a NULL task->tk_client, move to a
+signed integer as backing type for the client_id field.
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Upstream-Status: Backport [https://github.com/lttng/lttng-modules/commit/cc7bb0aa52cae22255581d67841449bb8ea36fda]
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+---
+ instrumentation/events/lttng-module/rpc.h | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/instrumentation/events/lttng-module/rpc.h b/instrumentation/events/lttng-module/rpc.h
+index 68c622c..2d06e55 100644
+--- a/instrumentation/events/lttng-module/rpc.h
++++ b/instrumentation/events/lttng-module/rpc.h
+@@ -18,7 +18,7 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_status,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(unsigned int, client_id, task->tk_client->cl_clid)
++ ctf_integer(int, client_id, task->tk_client->cl_clid)
+ ctf_integer(int, status, task->tk_status)
+ )
+ )
+@@ -43,7 +43,7 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_status,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(unsigned int, client_id, task->tk_client->cl_clid)
++ ctf_integer(int, client_id, task->tk_client->cl_clid)
+ ctf_integer(int, status, task->tk_status)
+ )
+ )
+@@ -100,7 +100,7 @@ LTTNG_TRACEPOINT_EVENT(rpc_connect_status,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(unsigned int, client_id, task->tk_client->cl_clid)
++ ctf_integer(int, client_id, task->tk_client->cl_clid)
+ ctf_integer(int, status, task->tk_status)
+ )
+ )
+@@ -112,7 +112,7 @@ LTTNG_TRACEPOINT_EVENT(rpc_connect_status,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(unsigned int, client_id, task->tk_client->cl_clid)
++ ctf_integer(int, client_id, task->tk_client->cl_clid)
+ ctf_integer(int, status, status)
+ )
+ )
+@@ -139,7 +139,8 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_running,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(unsigned int, client_id, task->tk_client ? task->tk_client->cl_clid : -1)
++ ctf_integer(int, client_id, task->tk_client ?
++ task->tk_client->cl_clid : -1)
+ ctf_integer_hex(const void *, action, action)
+ ctf_integer(unsigned long, runstate, task->tk_runstate)
+ ctf_integer(int, status, task->tk_status)
+@@ -176,7 +177,7 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_queued,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(unsigned int, client_id, task->tk_client ?
++ ctf_integer(int, client_id, task->tk_client ?
+ task->tk_client->cl_clid : -1)
+ ctf_integer(unsigned long, timeout, task->tk_timeout)
+ ctf_integer(unsigned long, runstate, task->tk_runstate)
+@@ -209,7 +210,8 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_running,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(unsigned int, client_id, task->tk_client ? task->tk_client->cl_clid : -1)
++ ctf_integer(int, client_id, task->tk_client ?
++ task->tk_client->cl_clid : -1)
+ ctf_integer_hex(const void *, action, action)
+ ctf_integer(unsigned long, runstate, task->tk_runstate)
+ ctf_integer(int, status, task->tk_status)
+@@ -246,7 +248,8 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_queued,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(unsigned int, client_id, task->tk_client->cl_clid)
++ ctf_integer(int, client_id, task->tk_client ?
++ task->tk_client->cl_clid : -1)
+ ctf_integer(unsigned long, timeout, task->tk_timeout)
+ ctf_integer(unsigned long, runstate, task->tk_runstate)
+ ctf_integer(int, status, task->tk_status)
+--
+2.17.1
+
diff --git a/meta/recipes-kernel/lttng/lttng-modules/0004-sunrpc-introduce-lttng_get_clid-helper.patch b/meta/recipes-kernel/lttng/lttng-modules/0004-sunrpc-introduce-lttng_get_clid-helper.patch
new file mode 100644
index 0000000000..4dd726cf2c
--- /dev/null
+++ b/meta/recipes-kernel/lttng/lttng-modules/0004-sunrpc-introduce-lttng_get_clid-helper.patch
@@ -0,0 +1,130 @@
+From b6903d57e4c3234ec5b1c7f72e232023cdee0fab Mon Sep 17 00:00:00 2001
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Date: Thu, 12 Dec 2019 10:39:38 -0500
+Subject: [PATCH 4/4] sunrpc: introduce lttng_get_clid helper
+
+Introduce the lttng_get_clid helper to always check for NULL pointer
+when getting the client id. While not always strictly needed depending
+on the tracepoint callsite, prefer robustness of instrumentation and
+always check for NULL rather than play whack-a-mole.
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Upstream-Status: Backport [https://github.com/lttng/lttng-modules/commit/1330a091a687a406513c3a326c2fc2a0dbe75536]
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+---
+ instrumentation/events/lttng-module/rpc.h | 43 ++++++++++++++++-------
+ 1 file changed, 31 insertions(+), 12 deletions(-)
+
+diff --git a/instrumentation/events/lttng-module/rpc.h b/instrumentation/events/lttng-module/rpc.h
+index 2d06e55..ceaf9db 100644
+--- a/instrumentation/events/lttng-module/rpc.h
++++ b/instrumentation/events/lttng-module/rpc.h
+@@ -9,6 +9,29 @@
+ #include <linux/sunrpc/sched.h>
+ #include <linux/sunrpc/clnt.h>
+
++#ifndef ONCE_LTTNG_RPC_H
++#define ONCE_LTTNG_RPC_H
++
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,12,0))
++static inline
++int lttng_get_clid(const struct rpc_task *task)
++{
++ struct rpc_clnt *tk_client;
++
++ tk_client = task->tk_client;
++ if (!tk_client)
++ return -1;
++ /*
++ * The cl_clid field is always initialized to positive signed
++ * integers. Negative signed integer values are treated as
++ * errors.
++ */
++ return (int) tk_client->cl_clid;
++}
++#endif /* #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,12,0)) */
++
++#endif /* ONCE_LTTNG_RPC_H */
++
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(5,0,0))
+ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_status,
+
+@@ -18,7 +41,7 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_status,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(int, client_id, task->tk_client->cl_clid)
++ ctf_integer(int, client_id, lttng_get_clid(task))
+ ctf_integer(int, status, task->tk_status)
+ )
+ )
+@@ -43,7 +66,7 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_status,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(int, client_id, task->tk_client->cl_clid)
++ ctf_integer(int, client_id, lttng_get_clid(task))
+ ctf_integer(int, status, task->tk_status)
+ )
+ )
+@@ -100,7 +123,7 @@ LTTNG_TRACEPOINT_EVENT(rpc_connect_status,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(int, client_id, task->tk_client->cl_clid)
++ ctf_integer(int, client_id, lttng_get_clid(task))
+ ctf_integer(int, status, task->tk_status)
+ )
+ )
+@@ -112,7 +135,7 @@ LTTNG_TRACEPOINT_EVENT(rpc_connect_status,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(int, client_id, task->tk_client->cl_clid)
++ ctf_integer(int, client_id, lttng_get_clid(task))
+ ctf_integer(int, status, status)
+ )
+ )
+@@ -139,8 +162,7 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_running,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(int, client_id, task->tk_client ?
+- task->tk_client->cl_clid : -1)
++ ctf_integer(int, client_id, lttng_get_clid(task))
+ ctf_integer_hex(const void *, action, action)
+ ctf_integer(unsigned long, runstate, task->tk_runstate)
+ ctf_integer(int, status, task->tk_status)
+@@ -177,8 +199,7 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_queued,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(int, client_id, task->tk_client ?
+- task->tk_client->cl_clid : -1)
++ ctf_integer(int, client_id, lttng_get_clid(task))
+ ctf_integer(unsigned long, timeout, task->tk_timeout)
+ ctf_integer(unsigned long, runstate, task->tk_runstate)
+ ctf_integer(int, status, task->tk_status)
+@@ -210,8 +231,7 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_running,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(int, client_id, task->tk_client ?
+- task->tk_client->cl_clid : -1)
++ ctf_integer(int, client_id, lttng_get_clid(task))
+ ctf_integer_hex(const void *, action, action)
+ ctf_integer(unsigned long, runstate, task->tk_runstate)
+ ctf_integer(int, status, task->tk_status)
+@@ -248,8 +268,7 @@ LTTNG_TRACEPOINT_EVENT_CLASS(rpc_task_queued,
+
+ TP_FIELDS(
+ ctf_integer(unsigned int, task_id, task->tk_pid)
+- ctf_integer(int, client_id, task->tk_client ?
+- task->tk_client->cl_clid : -1)
++ ctf_integer(int, client_id, lttng_get_clid(task))
+ ctf_integer(unsigned long, timeout, task->tk_timeout)
+ ctf_integer(unsigned long, runstate, task->tk_runstate)
+ ctf_integer(int, status, task->tk_status)
+--
+2.17.1
+
diff --git a/meta/recipes-kernel/lttng/lttng-modules_2.10.11.bb b/meta/recipes-kernel/lttng/lttng-modules_2.10.11.bb
index 789a3be850..cc4f44519a 100644
--- a/meta/recipes-kernel/lttng/lttng-modules_2.10.11.bb
+++ b/meta/recipes-kernel/lttng/lttng-modules_2.10.11.bb
@@ -14,6 +14,10 @@ COMPATIBLE_HOST = '(x86_64|i.86|powerpc|aarch64|mips|nios2|arm|riscv).*-linux'
SRC_URI = "https://lttng.org/files/${BPN}/${BPN}-${PV}.tar.bz2 \
file://Makefile-Do-not-fail-if-CONFIG_TRACEPOINTS-is-not-en.patch \
file://BUILD_RUNTIME_BUG_ON-vs-gcc7.patch \
+ file://0001-Fix-SUNRPC-Fix-oops-when-trace-sunrpc_task-events-in.patch \
+ file://0002-Fix-sunrpc-null-rpc_clnt-dereference-in-rpc_task_que.patch \
+ file://0003-Fix-sunrpc-use-signed-integer-for-client-id.patch \
+ file://0004-sunrpc-introduce-lttng_get_clid-helper.patch \
"
SRC_URI[md5sum] = "c618fb646514dfc1bf910cfd7cda4256"
--
2.21.0
^ permalink raw reply related [flat|nested] 14+ messages in thread