[gentoo-commits] repo/gentoo:master commit in: dev-db/redis/files/, dev-db/redis/

["Joonas Niilola" <juippis@gentoo.org>]

commit:     85442e23f002bbdbfe137a7fc15314eb6b048982
Author:     Petr Vaněk <arkamar <AT> atlas <DOT> cz>
AuthorDate: Sat Oct 22 09:52:31 2022 +0000
Commit:     Joonas Niilola <juippis <AT> gentoo <DOT> org>
CommitDate: Fri Nov 11 15:10:06 2022 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=85442e23

dev-db/redis: backport recommended patch for CVE-2022-3647 to 6.2.7

The original patch does not apply cleanly, it was necessary to backport it.

Upstream-commit: https://github.com/redis/redis/commit/0bf90d944313919eb8e63d3588bf63a367f020a3
Bug: https://bugs.gentoo.org/877863
Signed-off-by: Petr Vaněk <arkamar <AT> atlas.cz>
Closes: https://github.com/gentoo/gentoo/pull/27893
Signed-off-by: Joonas Niilola <juippis <AT> gentoo.org>

 dev-db/redis/files/redis-6.2.7-cve-2022-3647.patch | 173 ++++++++++++++++++
 dev-db/redis/redis-6.2.7-r2.ebuild                 | 198 +++++++++++++++++++++
 2 files changed, 371 insertions(+)

diff --git a/dev-db/redis/files/redis-6.2.7-cve-2022-3647.patch b/dev-db/redis/files/redis-6.2.7-cve-2022-3647.patch
new file mode 100644
index 000000000000..8c3a2358c8eb
--- /dev/null
+++ b/dev-db/redis/files/redis-6.2.7-cve-2022-3647.patch
@@ -0,0 +1,173 @@
+This is backported patch from upstream commit for version 6.2.7 which fixes CVE-2022-3647.
+
+Upstream-commit: https://github.com/redis/redis/commit/0bf90d944313919eb8e63d3588bf63a367f020a3
+Bug: https://bugs.gentoo.org/877863
+
+diff --git a/src/debug.c b/src/debug.c
+index 71ef51f8b..40fffec52 100644
+--- a/src/debug.c
++++ b/src/debug.c
+@@ -1019,61 +1019,88 @@ void bugReportStart(void) {
+ }
+ 
+ #ifdef HAVE_BACKTRACE
+-static void *getMcontextEip(ucontext_t *uc) {
++
++/* Returns the current eip and set it to the given new value (if its not NULL) */
++static void* getAndSetMcontextEip(ucontext_t *uc, void *eip) {
++#define NOT_SUPPORTED() do {\
++    UNUSED(uc);\
++    UNUSED(eip);\
++    return NULL;\
++} while(0)
++#define GET_SET_RETURN(target_var, new_val) do {\
++    void *old_val = (void*)target_var; \
++    if (new_val) { \
++        void **temp = (void**)&target_var; \
++        *temp = new_val; \
++    } \
++    return old_val; \
++} while(0)
+ #if defined(__APPLE__) && !defined(MAC_OS_X_VERSION_10_6)
+     /* OSX < 10.6 */
+     #if defined(__x86_64__)
+-    return (void*) uc->uc_mcontext->__ss.__rip;
++    GET_SET_RETURN(uc->uc_mcontext->__ss.__rip, eip);
+     #elif defined(__i386__)
+-    return (void*) uc->uc_mcontext->__ss.__eip;
++    GET_SET_RETURN(uc->uc_mcontext->__ss.__eip, eip);
+     #else
+-    return (void*) uc->uc_mcontext->__ss.__srr0;
++    GET_SET_RETURN(uc->uc_mcontext->__ss.__srr0, eip);
+     #endif
+ #elif defined(__APPLE__) && defined(MAC_OS_X_VERSION_10_6)
+     /* OSX >= 10.6 */
+     #if defined(_STRUCT_X86_THREAD_STATE64) && !defined(__i386__)
+-    return (void*) uc->uc_mcontext->__ss.__rip;
++    GET_SET_RETURN(uc->uc_mcontext->__ss.__rip, eip);
+     #elif defined(__i386__)
+-    return (void*) uc->uc_mcontext->__ss.__eip;
++    GET_SET_RETURN(uc->uc_mcontext->__ss.__eip, eip);
+     #else
+     /* OSX ARM64 */
+-    return (void*) arm_thread_state64_get_pc(uc->uc_mcontext->__ss);
++    void *old_val = (void*)arm_thread_state64_get_pc(uc->uc_mcontext->__ss);
++    if (eip) {
++        arm_thread_state64_set_pc_fptr(uc->uc_mcontext->__ss, eip);
++    }
++    return old_val;
+     #endif
+ #elif defined(__linux__)
+     /* Linux */
+     #if defined(__i386__) || ((defined(__X86_64__) || defined(__x86_64__)) && defined(__ILP32__))
+-    return (void*) uc->uc_mcontext.gregs[14]; /* Linux 32 */
++    GET_SET_RETURN(uc->uc_mcontext.gregs[14], eip);
+     #elif defined(__X86_64__) || defined(__x86_64__)
+-    return (void*) uc->uc_mcontext.gregs[16]; /* Linux 64 */
++    GET_SET_RETURN(uc->uc_mcontext.gregs[16], eip);
+     #elif defined(__ia64__) /* Linux IA64 */
+-    return (void*) uc->uc_mcontext.sc_ip;
++    GET_SET_RETURN(uc->uc_mcontext.sc_ip, eip);
+     #elif defined(__arm__) /* Linux ARM */
+-    return (void*) uc->uc_mcontext.arm_pc;
++    GET_SET_RETURN(uc->uc_mcontext.arm_pc, eip);
+     #elif defined(__aarch64__) /* Linux AArch64 */
+-    return (void*) uc->uc_mcontext.pc;
++    GET_SET_RETURN(uc->uc_mcontext.pc, eip);
++    #else
++    NOT_SUPPORTED();
+     #endif
+ #elif defined(__FreeBSD__)
+     /* FreeBSD */
+     #if defined(__i386__)
+-    return (void*) uc->uc_mcontext.mc_eip;
++    GET_SET_RETURN(uc->uc_mcontext.mc_eip, eip);
+     #elif defined(__x86_64__)
+-    return (void*) uc->uc_mcontext.mc_rip;
++    GET_SET_RETURN(uc->uc_mcontext.mc_rip, eip);
++    #else
++    NOT_SUPPORTED();
+     #endif
+ #elif defined(__OpenBSD__)
+     /* OpenBSD */
+     #if defined(__i386__)
+-    return (void*) uc->sc_eip;
++    GET_SET_RETURN(uc->sc_eip, eip);
+     #elif defined(__x86_64__)
+-    return (void*) uc->sc_rip;
++    GET_SET_RETURN(uc->sc_rip, eip);
++    #else
++    NOT_SUPPORTED();
+     #endif
+ #elif defined(__NetBSD__)
+     #if defined(__i386__)
+-    return (void*) uc->uc_mcontext.__gregs[_REG_EIP];
++    GET_SET_RETURN(uc->uc_mcontext.__gregs[_REG_EIP], eip);
+     #elif defined(__x86_64__)
+-    return (void*) uc->uc_mcontext.__gregs[_REG_RIP];
++    GET_SET_RETURN(uc->uc_mcontext.__gregs[_REG_RIP], eip);
++    #else
++    NOT_SUPPORTED();
+     #endif
+ #elif defined(__DragonFly__)
+-    return (void*) uc->uc_mcontext.mc_rip;
++    GET_SET_RETURN(uc->uc_mcontext.mc_rip, eip);
+ #else
+     return NULL;
+ #endif
+@@ -1800,6 +1827,10 @@ void dumpCodeAroundEIP(void *eip) {
+     }
+ }
+ 
++void invalidFunctionWasCalled() {}
++
++typedef void (*invalidFunctionWasCalledType)();
++
+ void sigsegvHandler(int sig, siginfo_t *info, void *secret) {
+     UNUSED(secret);
+     UNUSED(info);
+@@ -1817,13 +1848,30 @@ void sigsegvHandler(int sig, siginfo_t *info, void *secret) {
+ 
+ #ifdef HAVE_BACKTRACE
+     ucontext_t *uc = (ucontext_t*) secret;
+-    void *eip = getMcontextEip(uc);
++    void *eip = getAndSetMcontextEip(uc, NULL);
+     if (eip != NULL) {
+         serverLog(LL_WARNING,
+         "Crashed running the instruction at: %p", eip);
+     }
+ 
+-    logStackTrace(getMcontextEip(uc), 1);
++    if (eip == info->si_addr) {
++        /* When eip matches the bad address, it's an indication that we crashed when calling a non-mapped
++         * function pointer. In that case the call to backtrace will crash trying to access that address and we
++         * won't get a crash report logged. Set it to a valid point to avoid that crash. */
++
++        /* This trick allow to avoid compiler warning */
++        void *ptr;
++        invalidFunctionWasCalledType *ptr_ptr = (invalidFunctionWasCalledType*)&ptr;
++        *ptr_ptr = invalidFunctionWasCalled;
++        getAndSetMcontextEip(uc, ptr);
++    }
++
++    logStackTrace(eip, 1);
++
++    if (eip == info->si_addr) {
++        /* Restore old eip */
++        getAndSetMcontextEip(uc, eip);
++    }
+ 
+     logRegisters(uc);
+ #endif
+@@ -1918,7 +1966,7 @@ void watchdogSignalHandler(int sig, siginfo_t *info, void *secret) {
+ 
+     serverLogFromHandler(LL_WARNING,"\n--- WATCHDOG TIMER EXPIRED ---");
+ #ifdef HAVE_BACKTRACE
+-    logStackTrace(getMcontextEip(uc), 1);
++    logStackTrace(getAndSetMcontextEip(uc, NULL), 1);
+ #else
+     serverLogFromHandler(LL_WARNING,"Sorry: no support for backtrace().");
+ #endif
+-- 
+2.37.4
+

diff --git a/dev-db/redis/redis-6.2.7-r2.ebuild b/dev-db/redis/redis-6.2.7-r2.ebuild
new file mode 100644
index 000000000000..012ad4d40847
--- /dev/null
+++ b/dev-db/redis/redis-6.2.7-r2.ebuild
@@ -0,0 +1,198 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Redis does NOT build with Lua 5.2 or newer at this time:
+#  - 5.3 and 5.4 give:
+# lua_bit.c:83:2: error: #error "Unknown number type, check LUA_NUMBER_* in luaconf.h"
+#  - 5.2 fails with:
+# scripting.c:(.text+0x1f9b): undefined reference to `lua_open'
+#    because lua_open became lua_newstate in 5.2
+LUA_COMPAT=( lua5-1 luajit )
+
+# Upstream have deviated too far from vanilla Lua, adding their own APIs
+# like lua_enablereadonlytable, but we still need the eclass and such
+# for bug #841422.
+inherit autotools edo flag-o-matic lua-single multiprocessing systemd tmpfiles toolchain-funcs
+
+DESCRIPTION="A persistent caching system, key-value, and data structures database"
+HOMEPAGE="https://redis.io"
+SRC_URI="https://download.redis.io/releases/${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x86-solaris"
+IUSE="+jemalloc selinux ssl systemd tcmalloc test"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	${LUA_DEPS}
+	jemalloc? ( >=dev-libs/jemalloc-5.1:= )
+	ssl? ( dev-libs/openssl:0= )
+	systemd? ( sys-apps/systemd:= )
+	tcmalloc? ( dev-util/google-perftools )
+"
+
+RDEPEND="
+	${COMMON_DEPEND}
+	acct-group/redis
+	acct-user/redis
+	selinux? ( sec-policy/selinux-redis )
+"
+
+BDEPEND="
+	${COMMON_DEPEND}
+	virtual/pkgconfig
+"
+
+# Tcl is only needed in the CHOST test env
+DEPEND="
+	${COMMON_DEPEND}
+	test? (
+		dev-lang/tcl:0=
+		ssl? ( dev-tcltk/tls )
+	)"
+
+REQUIRED_USE="?? ( jemalloc tcmalloc )
+	${LUA_REQUIRED_USE}"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-6.2.1-config.patch
+	"${FILESDIR}"/${PN}-5.0-shared.patch
+	"${FILESDIR}"/${PN}-6.2.3-ppc-atomic.patch
+	"${FILESDIR}"/${PN}-sentinel-5.0-config.patch
+
+	# see bug 877863
+	"${FILESDIR}/${PN}-6.2.7-cve-2022-3647.patch"
+)
+
+src_prepare() {
+	default
+
+	# Copy lua modules into build dir
+	#cp "${S}"/deps/lua/src/{fpconv,lua_bit,lua_cjson,lua_cmsgpack,lua_struct,strbuf}.c "${S}"/src || die
+	#cp "${S}"/deps/lua/src/{fpconv,strbuf}.h "${S}"/src || die
+	# Append cflag for lua_cjson
+	# https://github.com/antirez/redis/commit/4fdcd213#diff-3ba529ae517f6b57803af0502f52a40bL61
+	append-cflags "-DENABLE_CJSON_GLOBAL"
+
+	# now we will rewrite present Makefiles
+	local makefiles="" MKF
+	for MKF in $(find -name 'Makefile' | cut -b 3-); do
+		mv "${MKF}" "${MKF}.in"
+		sed -i	-e 's:$(CC):@CC@:g' \
+			-e 's:$(CFLAGS):@AM_CFLAGS@:g' \
+			-e 's: $(DEBUG)::g' \
+			-e 's:$(OBJARCH)::g' \
+			-e 's:ARCH:TARCH:g' \
+			-e '/^CCOPT=/s:$: $(LDFLAGS):g' \
+			"${MKF}.in" \
+		|| die "Sed failed for ${MKF}"
+		makefiles+=" ${MKF}"
+	done
+	# autodetection of compiler and settings; generates the modified Makefiles
+	cp "${FILESDIR}"/configure.ac-3.2 configure.ac || die
+
+	# Use the correct pkgconfig name for Lua.
+	# The upstream configure script handles luajit specially, and is not
+	# affected by these changes.
+	sed -i	\
+		-e "/^AC_INIT/s|, [0-9].+, |, $PV, |" \
+		-e "s:AC_CONFIG_FILES(\[Makefile\]):AC_CONFIG_FILES([${makefiles}]):g" \
+		-e "/PKG_CHECK_MODULES.*\<LUA\>/s,lua5.1,${ELUA},g" \
+		configure.ac || die "Sed failed for configure.ac"
+	eautoreconf
+}
+
+src_configure() {
+	econf #$(use_with lua_single_target_luajit luajit)
+
+	# Linenoise can't be built with -std=c99, see https://bugs.gentoo.org/451164
+	# also, don't define ANSI/c99 for lua twice
+	sed -i -e "s:-std=c99::g" deps/linenoise/Makefile deps/Makefile || die
+}
+
+src_compile() {
+	local myconf=""
+
+	if use jemalloc; then
+		myconf+="MALLOC=jemalloc"
+	elif use tcmalloc; then
+		myconf+="MALLOC=tcmalloc"
+	else
+		myconf+="MALLOC=libc"
+	fi
+
+	if use ssl; then
+		myconf+=" BUILD_TLS=yes"
+	fi
+
+	export USE_SYSTEMD=$(usex systemd)
+
+	tc-export AR CC RANLIB
+	emake V=1 ${myconf} AR="${AR}" CC="${CC}" RANLIB="${RANLIB}"
+}
+
+src_test() {
+	local runtestargs=(
+		--clients "$(makeopts_jobs)" # see bug #649868
+	)
+
+	if has usersandbox ${FEATURES} || ! has userpriv ${FEATURES}; then
+		ewarn "unit/oom-score-adj test will be skipped." \
+			"It is known to fail with FEATURES usersandbox or -userpriv. See bug #756382."
+
+		# unit/oom-score-adj was introduced in version 6.2.0
+		runtestargs+=( --skipunit unit/oom-score-adj ) # see bug #756382
+	fi
+
+	if use ssl; then
+		edo ./utils/gen-test-certs.sh
+		runtestargs+=( --tls )
+	fi
+
+	edo ./runtest "${runtestargs[@]}"
+}
+
+src_install() {
+	insinto /etc/redis
+	doins redis.conf sentinel.conf
+	use prefix || fowners -R redis:redis /etc/redis /etc/redis/{redis,sentinel}.conf
+	fperms 0750 /etc/redis
+	fperms 0644 /etc/redis/{redis,sentinel}.conf
+
+	newconfd "${FILESDIR}/redis.confd-r2" redis
+	newinitd "${FILESDIR}/redis.initd-6" redis
+
+	systemd_newunit "${FILESDIR}/redis.service-4" redis.service
+	newtmpfiles "${FILESDIR}/redis.tmpfiles-2" redis.conf
+
+	newconfd "${FILESDIR}/redis-sentinel.confd-r1" redis-sentinel
+	newinitd "${FILESDIR}/redis-sentinel.initd-r1" redis-sentinel
+
+	insinto /etc/logrotate.d/
+	newins "${FILESDIR}/${PN}.logrotate" ${PN}
+
+	dodoc 00-RELEASENOTES BUGS CONTRIBUTING MANIFESTO README.md
+
+	dobin src/redis-cli
+	dosbin src/redis-benchmark src/redis-server src/redis-check-aof src/redis-check-rdb
+	fperms 0750 /usr/sbin/redis-benchmark
+	dosym redis-server /usr/sbin/redis-sentinel
+
+	if use prefix; then
+		diropts -m0750
+	else
+		diropts -m0750 -o redis -g redis
+	fi
+	keepdir /var/{log,lib}/redis
+}
+
+pkg_postinst() {
+	tmpfiles_process redis.conf
+
+	ewarn "The default redis configuration file location changed to:"
+	ewarn "  /etc/redis/{redis,sentinel}.conf"
+	ewarn "Please apply your changes to the new configuration files."
+}