From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id D22EB1582EF for ; Mon, 10 Mar 2025 00:15:27 +0000 (UTC) Received: from lists.gentoo.org (bobolink.gentoo.org [140.211.166.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) (Authenticated sender: relay-lists.gentoo.org@gentoo.org) by smtp.gentoo.org (Postfix) with ESMTPSA id BB4D3342FAF for ; Mon, 10 Mar 2025 00:15:27 +0000 (UTC) Received: from bobolink.gentoo.org (localhost [127.0.0.1]) by bobolink.gentoo.org (Postfix) with ESMTP id B84AF110370; Mon, 10 Mar 2025 00:15:26 +0000 (UTC) Received: from smtp.gentoo.org (mail.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by bobolink.gentoo.org (Postfix) with ESMTPS id B12A3110370 for ; Mon, 10 Mar 2025 00:15:26 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 6304B342FAF for ; Mon, 10 Mar 2025 00:15:26 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id C3D162853 for ; Mon, 10 Mar 2025 00:15:24 +0000 (UTC) From: "Sam James" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sam James" Message-ID: <1741565655.1b1023ec6bee0475caa7ec6d74a2983bfb8a0238.sam@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: sys-libs/libseccomp/, sys-libs/libseccomp/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: sys-libs/libseccomp/files/libseccomp-2.6.0-aliasing.patch sys-libs/libseccomp/libseccomp-2.6.0-r1.ebuild X-VCS-Directories: sys-libs/libseccomp/ sys-libs/libseccomp/files/ X-VCS-Committer: sam X-VCS-Committer-Name: Sam James X-VCS-Revision: 1b1023ec6bee0475caa7ec6d74a2983bfb8a0238 X-VCS-Branch: master Date: Mon, 10 Mar 2025 00:15:24 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 7f79c7e0-1712-4e58-ac4c-2283d75a8864 X-Archives-Hash: 41ae3705bacc2a838a279481755b41a2 commit: 1b1023ec6bee0475caa7ec6d74a2983bfb8a0238 Author: Sam James gentoo org> AuthorDate: Mon Mar 10 00:14:15 2025 +0000 Commit: Sam James gentoo org> CommitDate: Mon Mar 10 00:14:15 2025 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1b1023ec sys-libs/libseccomp: fix aliasing violation The patch isn't perfect so may revbump with a tweaked version later. Signed-off-by: Sam James gentoo.org> .../files/libseccomp-2.6.0-aliasing.patch | 69 +++++++++++++ sys-libs/libseccomp/libseccomp-2.6.0-r1.ebuild | 108 +++++++++++++++++++++ 2 files changed, 177 insertions(+) diff --git a/sys-libs/libseccomp/files/libseccomp-2.6.0-aliasing.patch b/sys-libs/libseccomp/files/libseccomp-2.6.0-aliasing.patch new file mode 100644 index 000000000000..f946dc468822 --- /dev/null +++ b/sys-libs/libseccomp/files/libseccomp-2.6.0-aliasing.patch @@ -0,0 +1,69 @@ +https://github.com/seccomp/libseccomp/pull/459 + +From e6904da422e68031b0237c1e005fc5e98c12e2cf Mon Sep 17 00:00:00 2001 +From: Romain Geissler +Date: Tue, 18 Feb 2025 22:29:05 +0000 +Subject: [PATCH] Fix strict aliasing UB in MurMur hash implementation. + +This was spotted when trying to upgrade the libseccomp fedora package to +version 2.6.0 in fedora rawhide. It comes with gcc 15 and LTO enabled by +default. When running the test 61-sim-transactions we get plenty of such +errors in valgrind: + +==265507== Use of uninitialised value of size 8 +==265507== at 0x4096AD: _hsh_add (gen_bpf.c:599) +==265507== by 0x40A557: UnknownInlinedFun (gen_bpf.c:2016) +==265507== by 0x40A557: gen_bpf_generate (gen_bpf.c:2341) +==265507== by 0x400CDE: UnknownInlinedFun (db.c:2685) +==265507== by 0x400CDE: UnknownInlinedFun (db.c:2682) +==265507== by 0x400CDE: UnknownInlinedFun (api.c:756) +==265507== by 0x400CDE: UnknownInlinedFun (util.c:162) +==265507== by 0x400CDE: UnknownInlinedFun (util.c:153) +==265507== by 0x400CDE: main (61-sim-transactions.c:128) +==265507== Uninitialised value was created by a stack allocation +==265507== at 0x409590: _hsh_add (gen_bpf.c:573) + +Investigating this a bit, it seems that because of LTO the MurMur hash +implementation is being inlined in _hsh_add. The way we call getblock32 +with the explicit cast to const uint32_t* is a strict aliasing +violation. + +This is reproducible on a "fedora:rawhide" container (gcc 15) and using: +export CFLAGS='-O2 -flto=auto -ffat-lto-objects -g' + +Signed-off-by: Romain Geissler +--- + src/hash.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/src/hash.c b/src/hash.c +index 4435900f..301abfc9 100644 +--- a/src/hash.c ++++ b/src/hash.c +@@ -12,15 +12,11 @@ + */ + + #include ++#include + #include + + #include "hash.h" + +-static inline uint32_t getblock32(const uint32_t *p, int i) +-{ +- return p[i]; +-} +- + static inline uint32_t rotl32(uint32_t x, int8_t r) + { + return (x << r) | (x >> (32 - r)); +@@ -56,7 +52,7 @@ uint32_t hash(const void *key, size_t length) + /* body */ + blocks = (const uint32_t *)(data + nblocks * 4); + for(i = -nblocks; i; i++) { +- k1 = getblock32(blocks, i); ++ memcpy(&k1, &blocks[i], sizeof(uint32_t)); + + k1 *= c1; + k1 = rotl32(k1, 15); + diff --git a/sys-libs/libseccomp/libseccomp-2.6.0-r1.ebuild b/sys-libs/libseccomp/libseccomp-2.6.0-r1.ebuild new file mode 100644 index 000000000000..cbdd8dc79a61 --- /dev/null +++ b/sys-libs/libseccomp/libseccomp-2.6.0-r1.ebuild @@ -0,0 +1,108 @@ +# Copyright 1999-2025 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +DISTUTILS_EXT=1 +DISTUTILS_OPTIONAL=1 +DISTUTILS_USE_PEP517=setuptools +PYTHON_COMPAT=( python3_{10..13} ) + +inherit distutils-r1 multilib-minimal + +DESCRIPTION="High level interface to Linux seccomp filter" +HOMEPAGE="https://github.com/seccomp/libseccomp" + +if [[ ${PV} == *9999 ]] ; then + EGIT_REPO_URI="https://github.com/seccomp/libseccomp.git" + PRERELEASE="2.6.0" + inherit autotools git-r3 +else + SRC_URI="https://github.com/seccomp/libseccomp/releases/download/v${PV}/${P}.tar.gz" + KEYWORDS="-* ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux" +fi + +LICENSE="LGPL-2.1" +SLOT="0" +IUSE="python static-libs test" +RESTRICT="!test? ( test )" +REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )" + +# We need newer kernel headers; we don't keep strict control of the exact +# version here, just be safe and pull in the latest stable ones. bug #551248 +DEPEND=" + >=sys-kernel/linux-headers-5.15 + python? ( ${PYTHON_DEPS} ) +" +RDEPEND="${DEPEND}" +BDEPEND=" + ${DEPEND} + dev-util/gperf + python? ( + ${DISTUTILS_DEPS} + dev-python/cython[${PYTHON_USEDEP}] + ) +" + +PATCHES=( + "${FILESDIR}"/libseccomp-2.6.0-python-shared.patch + "${FILESDIR}"/libseccomp-2.5.3-skip-valgrind.patch + "${FILESDIR}"/${P}-drop-bogus-test.patch + "${FILESDIR}"/${PN}-2.6.0-aliasing.patch +) + +src_prepare() { + default + + if [[ ${PV} == *9999 ]] ; then + sed -i -e "s/0.0.0/${PRERELEASE}/" configure.ac || die + + eautoreconf + fi +} + +multilib_src_configure() { + local myeconfargs=( + $(use_enable static-libs static) + --disable-python + ) + + ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" +} + +multilib_src_compile() { + emake + + if multilib_is_native_abi && use python ; then + # setup.py expects libseccomp.so to live in "../.libs" + # Copy the python files to the right place for this. + rm -r "${BUILD_DIR}"/src/python || die + cp -r "${S}"/src/python "${BUILD_DIR}"/src/python || die + local -x CPPFLAGS="-I\"${BUILD_DIR}/include\" -I\"${S}/include\" ${CPPFLAGS}" + + # setup.py reads VERSION_RELEASE from the environment + local -x VERSION_RELEASE=${PRERELEASE-${PV}} + + pushd "${BUILD_DIR}/src/python" >/dev/null || die + distutils-r1_src_compile + popd >/dev/null || die + fi +} + +multilib_src_test() { + emake -Onone check +} + +multilib_src_install() { + emake DESTDIR="${D}" install + + if multilib_is_native_abi && use python ; then + distutils-r1_src_install + fi +} + +multilib_src_install_all() { + find "${ED}" -type f -name "${PN}.la" -delete || die + + einstalldocs +}