diff --git a/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch b/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch deleted file mode 100644 index 75d874b93d09..000000000000 --- a/pkgs/development/libraries/glibc/2.30-cve-2020-1752.patch +++ /dev/null @@ -1,62 +0,0 @@ -From: Andreas Schwab -Date: Wed, 19 Feb 2020 16:21:46 +0000 (+0100) -Subject: Fix use-after-free in glob when expanding ~user (bug 25414) -X-Git-Url: https://sourceware.org/git/?p=glibc.git;a=commitdiff_plain;h=da97c6b88eb03fb834e92964b0895c2ac8d61f63;hp=dd34bce38c822b67fcc42e73969bf6699d6874b6 - -Fix use-after-free in glob when expanding ~user (bug 25414) - -The value of `end_name' points into the value of `dirname', thus don't -deallocate the latter before the last use of the former. - -(cherry picked from commit ddc650e9b3dc916eab417ce9f79e67337b05035c) ---- - -diff --git a/posix/glob.c b/posix/glob.c -index e73e35c510..c6cbd0eb43 100644 ---- a/posix/glob.c -+++ b/posix/glob.c -@@ -827,31 +827,32 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int), - { - size_t home_len = strlen (p->pw_dir); - size_t rest_len = end_name == NULL ? 0 : strlen (end_name); -- char *d; -+ char *d, *newp; -+ bool use_alloca = glob_use_alloca (alloca_used, -+ home_len + rest_len + 1); - -- if (__glibc_unlikely (malloc_dirname)) -- free (dirname); -- malloc_dirname = 0; -- -- if (glob_use_alloca (alloca_used, home_len + rest_len + 1)) -- dirname = alloca_account (home_len + rest_len + 1, -- alloca_used); -+ if (use_alloca) -+ newp = alloca_account (home_len + rest_len + 1, alloca_used); - else - { -- dirname = malloc (home_len + rest_len + 1); -- if (dirname == NULL) -+ newp = malloc (home_len + rest_len + 1); -+ if (newp == NULL) - { - scratch_buffer_free (&pwtmpbuf); - retval = GLOB_NOSPACE; - goto out; - } -- malloc_dirname = 1; - } -- d = mempcpy (dirname, p->pw_dir, home_len); -+ d = mempcpy (newp, p->pw_dir, home_len); - if (end_name != NULL) - d = mempcpy (d, end_name, rest_len); - *d = '\0'; - -+ if (__glibc_unlikely (malloc_dirname)) -+ free (dirname); -+ dirname = newp; -+ malloc_dirname = !use_alloca; -+ - dirlen = home_len + rest_len; - dirname_modified = 1; - } diff --git a/pkgs/development/libraries/glibc/2.31-cve-2020-10029.patch b/pkgs/development/libraries/glibc/2.31-cve-2020-10029.patch deleted file mode 100644 index 8334398e8912..000000000000 --- a/pkgs/development/libraries/glibc/2.31-cve-2020-10029.patch +++ /dev/null @@ -1,79 +0,0 @@ -diff --git a/sysdeps/ieee754/ldbl-96/Makefile b/sysdeps/ieee754/ldbl-96/Makefile -index 995e90d6da..318628aed6 100644 ---- a/sysdeps/ieee754/ldbl-96/Makefile -+++ b/sysdeps/ieee754/ldbl-96/Makefile -@@ -17,5 +17,6 @@ - # . - - ifeq ($(subdir),math) --tests += test-canonical-ldbl-96 test-totalorderl-ldbl-96 -+tests += test-canonical-ldbl-96 test-totalorderl-ldbl-96 test-sinl-pseudo -+CFLAGS-test-sinl-pseudo.c += -fstack-protector-all - endif -diff --git a/sysdeps/ieee754/ldbl-96/e_rem_pio2l.c b/sysdeps/ieee754/ldbl-96/e_rem_pio2l.c -index 5f742321ae..bcdf20179f 100644 ---- a/sysdeps/ieee754/ldbl-96/e_rem_pio2l.c -+++ b/sysdeps/ieee754/ldbl-96/e_rem_pio2l.c -@@ -210,6 +210,18 @@ __ieee754_rem_pio2l (long double x, long double *y) - return 0; - } - -+ if ((i0 & 0x80000000) == 0) -+ { -+ /* Pseudo-zero and unnormal representations are not valid -+ representations of long double. We need to avoid stack -+ corruption in __kernel_rem_pio2, which expects input in a -+ particular normal form, but those representations do not need -+ to be consistently handled like any particular floating-point -+ value. */ -+ y[1] = y[0] = __builtin_nanl (""); -+ return 0; -+ } -+ - /* Split the 64 bits of the mantissa into three 24-bit integers - stored in a double array. */ - exp = j0 - 23; ---- /dev/null -+++ b/sysdeps/ieee754/ldbl-96/test-sinl-pseudo.c -@@ -0,0 +1,41 @@ -+/* Test sinl for pseudo-zeros and unnormals for ldbl-96 (bug 25487). -+ Copyright (C) 2020 Free Software Foundation, Inc. -+ This file is part of the GNU C Library. -+ -+ The GNU C Library is free software; you can redistribute it and/or -+ modify it under the terms of the GNU Lesser General Public -+ License as published by the Free Software Foundation; either -+ version 2.1 of the License, or (at your option) any later version. -+ -+ The GNU C Library is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ Lesser General Public License for more details. -+ -+ You should have received a copy of the GNU Lesser General Public -+ License along with the GNU C Library; if not, see -+ . */ -+ -+#include -+#include -+#include -+ -+static int -+do_test (void) -+{ -+ for (int i = 0; i < 64; i++) -+ { -+ uint64_t sig = i == 63 ? 0 : 1ULL << i; -+ long double ld; -+ SET_LDOUBLE_WORDS (ld, 0x4141, -+ sig >> 32, sig & 0xffffffffULL); -+ /* The requirement is that no stack overflow occurs when the -+ pseudo-zero or unnormal goes through range reduction. */ -+ volatile long double ldr; -+ ldr = sinl (ld); -+ (void) ldr; -+ } -+ return 0; -+} -+ -+#include diff --git a/pkgs/development/libraries/glibc/2.31-cve-2020-6096.0.patch b/pkgs/development/libraries/glibc/2.31-cve-2020-6096.0.patch deleted file mode 100644 index bd7ac311e3df..000000000000 --- a/pkgs/development/libraries/glibc/2.31-cve-2020-6096.0.patch +++ /dev/null @@ -1,189 +0,0 @@ -From 79a4fa341b8a89cb03f84564fd72abaa1a2db394 Mon Sep 17 00:00:00 2001 -From: Evgeny Eremin -Date: Wed, 8 Jul 2020 14:18:19 +0200 -Subject: [PATCH] arm: CVE-2020-6096: fix memcpy and memmove for negative - length [BZ #25620] - -Unsigned branch instructions could be used for r2 to fix the wrong -behavior when a negative length is passed to memcpy and memmove. -This commit fixes the generic arm implementation of memcpy amd memmove. ---- - sysdeps/arm/memcpy.S | 24 ++++++++++-------------- - sysdeps/arm/memmove.S | 24 ++++++++++-------------- - 2 files changed, 20 insertions(+), 28 deletions(-) - -diff --git a/sysdeps/arm/memcpy.S b/sysdeps/arm/memcpy.S -index 510e8adaf2..bcfbc51d99 100644 ---- a/sysdeps/arm/memcpy.S -+++ b/sysdeps/arm/memcpy.S -@@ -68,7 +68,7 @@ ENTRY(memcpy) - cfi_remember_state - - subs r2, r2, #4 -- blt 8f -+ blo 8f - ands ip, r0, #3 - PLD( pld [r1, #0] ) - bne 9f -@@ -82,7 +82,7 @@ ENTRY(memcpy) - cfi_rel_offset (r6, 4) - cfi_rel_offset (r7, 8) - cfi_rel_offset (r8, 12) -- blt 5f -+ blo 5f - - CALGN( ands ip, r1, #31 ) - CALGN( rsb r3, ip, #32 ) -@@ -98,9 +98,9 @@ ENTRY(memcpy) - #endif - - PLD( pld [r1, #0] ) --2: PLD( subs r2, r2, #96 ) -+2: PLD( cmp r2, #96 ) - PLD( pld [r1, #28] ) -- PLD( blt 4f ) -+ PLD( blo 4f ) - PLD( pld [r1, #60] ) - PLD( pld [r1, #92] ) - -@@ -108,9 +108,7 @@ ENTRY(memcpy) - 4: ldmia r1!, {r3, r4, r5, r6, r7, r8, ip, lr} - subs r2, r2, #32 - stmia r0!, {r3, r4, r5, r6, r7, r8, ip, lr} -- bge 3b -- PLD( cmn r2, #96 ) -- PLD( bge 4b ) -+ bhs 3b - - 5: ands ip, r2, #28 - rsb ip, ip, #32 -@@ -222,7 +220,7 @@ ENTRY(memcpy) - strbge r4, [r0], #1 - subs r2, r2, ip - strb lr, [r0], #1 -- blt 8b -+ blo 8b - ands ip, r1, #3 - beq 1b - -@@ -236,7 +234,7 @@ ENTRY(memcpy) - .macro forward_copy_shift pull push - - subs r2, r2, #28 -- blt 14f -+ blo 14f - - CALGN( ands ip, r1, #31 ) - CALGN( rsb ip, ip, #32 ) -@@ -253,9 +251,9 @@ ENTRY(memcpy) - cfi_rel_offset (r10, 16) - - PLD( pld [r1, #0] ) -- PLD( subs r2, r2, #96 ) -+ PLD( cmp r2, #96 ) - PLD( pld [r1, #28] ) -- PLD( blt 13f ) -+ PLD( blo 13f ) - PLD( pld [r1, #60] ) - PLD( pld [r1, #92] ) - -@@ -280,9 +278,7 @@ ENTRY(memcpy) - mov ip, ip, PULL #\pull - orr ip, ip, lr, PUSH #\push - stmia r0!, {r3, r4, r5, r6, r7, r8, r10, ip} -- bge 12b -- PLD( cmn r2, #96 ) -- PLD( bge 13b ) -+ bhs 12b - - pop {r5 - r8, r10} - cfi_adjust_cfa_offset (-20) -diff --git a/sysdeps/arm/memmove.S b/sysdeps/arm/memmove.S -index 954037ef3a..0d07b76ee6 100644 ---- a/sysdeps/arm/memmove.S -+++ b/sysdeps/arm/memmove.S -@@ -85,7 +85,7 @@ ENTRY(memmove) - add r1, r1, r2 - add r0, r0, r2 - subs r2, r2, #4 -- blt 8f -+ blo 8f - ands ip, r0, #3 - PLD( pld [r1, #-4] ) - bne 9f -@@ -99,7 +99,7 @@ ENTRY(memmove) - cfi_rel_offset (r6, 4) - cfi_rel_offset (r7, 8) - cfi_rel_offset (r8, 12) -- blt 5f -+ blo 5f - - CALGN( ands ip, r1, #31 ) - CALGN( sbcsne r4, ip, r2 ) @ C is always set here -@@ -114,9 +114,9 @@ ENTRY(memmove) - #endif - - PLD( pld [r1, #-4] ) --2: PLD( subs r2, r2, #96 ) -+2: PLD( cmp r2, #96 ) - PLD( pld [r1, #-32] ) -- PLD( blt 4f ) -+ PLD( blo 4f ) - PLD( pld [r1, #-64] ) - PLD( pld [r1, #-96] ) - -@@ -124,9 +124,7 @@ ENTRY(memmove) - 4: ldmdb r1!, {r3, r4, r5, r6, r7, r8, ip, lr} - subs r2, r2, #32 - stmdb r0!, {r3, r4, r5, r6, r7, r8, ip, lr} -- bge 3b -- PLD( cmn r2, #96 ) -- PLD( bge 4b ) -+ bhs 3b - - 5: ands ip, r2, #28 - rsb ip, ip, #32 -@@ -237,7 +235,7 @@ ENTRY(memmove) - strbge r4, [r0, #-1]! - subs r2, r2, ip - strb lr, [r0, #-1]! -- blt 8b -+ blo 8b - ands ip, r1, #3 - beq 1b - -@@ -251,7 +249,7 @@ ENTRY(memmove) - .macro backward_copy_shift push pull - - subs r2, r2, #28 -- blt 14f -+ blo 14f - - CALGN( ands ip, r1, #31 ) - CALGN( rsb ip, ip, #32 ) -@@ -268,9 +266,9 @@ ENTRY(memmove) - cfi_rel_offset (r10, 16) - - PLD( pld [r1, #-4] ) -- PLD( subs r2, r2, #96 ) -+ PLD( cmp r2, #96 ) - PLD( pld [r1, #-32] ) -- PLD( blt 13f ) -+ PLD( blo 13f ) - PLD( pld [r1, #-64] ) - PLD( pld [r1, #-96] ) - -@@ -295,9 +293,7 @@ ENTRY(memmove) - mov r4, r4, PUSH #\push - orr r4, r4, r3, PULL #\pull - stmdb r0!, {r4 - r8, r10, ip, lr} -- bge 12b -- PLD( cmn r2, #96 ) -- PLD( bge 13b ) -+ bhs 12b - - pop {r5 - r8, r10} - cfi_adjust_cfa_offset (-20) --- -2.18.4 - diff --git a/pkgs/development/libraries/glibc/2.31-cve-2020-6096.1.patch b/pkgs/development/libraries/glibc/2.31-cve-2020-6096.1.patch deleted file mode 100644 index 130936a9b8c2..000000000000 --- a/pkgs/development/libraries/glibc/2.31-cve-2020-6096.1.patch +++ /dev/null @@ -1,107 +0,0 @@ -From beea361050728138b82c57dda0c4810402d342b9 Mon Sep 17 00:00:00 2001 -From: Alexander Anisimov -Date: Wed, 8 Jul 2020 14:18:31 +0200 -Subject: [PATCH] arm: CVE-2020-6096: Fix multiarch memcpy for negative length - [BZ #25620] - -Unsigned branch instructions could be used for r2 to fix the wrong -behavior when a negative length is passed to memcpy. -This commit fixes the armv7 version. ---- - sysdeps/arm/armv7/multiarch/memcpy_impl.S | 22 +++++++++++----------- - 1 file changed, 11 insertions(+), 11 deletions(-) - -diff --git a/sysdeps/arm/armv7/multiarch/memcpy_impl.S b/sysdeps/arm/armv7/multiarch/memcpy_impl.S -index bf4ac7077f..379bb56fc9 100644 ---- a/sysdeps/arm/armv7/multiarch/memcpy_impl.S -+++ b/sysdeps/arm/armv7/multiarch/memcpy_impl.S -@@ -268,7 +268,7 @@ ENTRY(memcpy) - - mov dst, dstin /* Preserve dstin, we need to return it. */ - cmp count, #64 -- bge .Lcpy_not_short -+ bhs .Lcpy_not_short - /* Deal with small copies quickly by dropping straight into the - exit block. */ - -@@ -351,10 +351,10 @@ ENTRY(memcpy) - - 1: - subs tmp2, count, #64 /* Use tmp2 for count. */ -- blt .Ltail63aligned -+ blo .Ltail63aligned - - cmp tmp2, #512 -- bge .Lcpy_body_long -+ bhs .Lcpy_body_long - - .Lcpy_body_medium: /* Count in tmp2. */ - #ifdef USE_VFP -@@ -378,7 +378,7 @@ ENTRY(memcpy) - add src, src, #64 - vstr d1, [dst, #56] - add dst, dst, #64 -- bge 1b -+ bhs 1b - tst tmp2, #0x3f - beq .Ldone - -@@ -412,7 +412,7 @@ ENTRY(memcpy) - ldrd A_l, A_h, [src, #64]! - strd A_l, A_h, [dst, #64]! - subs tmp2, tmp2, #64 -- bge 1b -+ bhs 1b - tst tmp2, #0x3f - bne 1f - ldr tmp2,[sp], #FRAME_SIZE -@@ -482,7 +482,7 @@ ENTRY(memcpy) - add src, src, #32 - - subs tmp2, tmp2, #prefetch_lines * 64 * 2 -- blt 2f -+ blo 2f - 1: - cpy_line_vfp d3, 0 - cpy_line_vfp d4, 64 -@@ -494,7 +494,7 @@ ENTRY(memcpy) - add dst, dst, #2 * 64 - add src, src, #2 * 64 - subs tmp2, tmp2, #prefetch_lines * 64 -- bge 1b -+ bhs 1b - - 2: - cpy_tail_vfp d3, 0 -@@ -615,8 +615,8 @@ ENTRY(memcpy) - 1: - pld [src, #(3 * 64)] - subs count, count, #64 -- ldrmi tmp2, [sp], #FRAME_SIZE -- bmi .Ltail63unaligned -+ ldrlo tmp2, [sp], #FRAME_SIZE -+ blo .Ltail63unaligned - pld [src, #(4 * 64)] - - #ifdef USE_NEON -@@ -633,7 +633,7 @@ ENTRY(memcpy) - neon_load_multi d0-d3, src - neon_load_multi d4-d7, src - subs count, count, #64 -- bmi 2f -+ blo 2f - 1: - pld [src, #(4 * 64)] - neon_store_multi d0-d3, dst -@@ -641,7 +641,7 @@ ENTRY(memcpy) - neon_store_multi d4-d7, dst - neon_load_multi d4-d7, src - subs count, count, #64 -- bpl 1b -+ bhs 1b - 2: - neon_store_multi d0-d3, dst - neon_store_multi d4-d7, dst --- -2.18.4 - diff --git a/pkgs/development/libraries/glibc/2.31-master.patch.gz b/pkgs/development/libraries/glibc/2.31-master.patch.gz new file mode 100644 index 000000000000..d58757924610 Binary files /dev/null and b/pkgs/development/libraries/glibc/2.31-master.patch.gz differ diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix index bf9db5357efa..b1cbe5d0bba5 100644 --- a/pkgs/development/libraries/glibc/common.nix +++ b/pkgs/development/libraries/glibc/common.nix @@ -42,7 +42,7 @@ let version = "2.31"; - patchSuffix = ""; + patchSuffix = "-74"; sha256 = "05zxkyz9bv3j9h0xyid1rhvh3klhsmrpkf3bcs6frvlgyr2gwilj"; in @@ -59,6 +59,15 @@ stdenv.mkDerivation ({ patches = [ + /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git + and using git or something would complicate bootstrapping. + Fortunately it's not too big. + $ git checkout origin/release/2.31/master; git describe + glibc-2.31-74-gd0c84d22b6 + $ git show --reverse glibc-2.31.. | gzip -n -9 --rsyncable - > 2.31-master.patch.gz + */ + ./2.31-master.patch.gz + /* Have rpcgen(1) look for cpp(1) in $PATH. */ ./rpcgen-path.patch @@ -113,10 +122,6 @@ stdenv.mkDerivation ({ }) ./fix-x64-abi.patch - ./2.30-cve-2020-1752.patch - ./2.31-cve-2020-10029.patch - ./2.31-cve-2020-6096.0.patch - ./2.31-cve-2020-6096.1.patch ] ++ lib.optional stdenv.hostPlatform.isMusl ./fix-rpc-types-musl-conflicts.patch ++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch;