From dd7180414ec58d5c315b141a6c04e2e29ec2ecdb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi> Date: Mon, 15 Feb 2021 15:09:03 +0200 Subject: [PATCH] community/openjdk8: security upgrade to 3.17.1 (8.275.01) --- community/openjdk8/APKBUILD | 57 +++-- .../openjdk8/icedtea-hotspot-musl-ppc.patch | 194 ++++++++++++------ 2 files changed, 169 insertions(+), 82 deletions(-) diff --git a/community/openjdk8/APKBUILD b/community/openjdk8/APKBUILD index 8ad162a50272..83c57dc83587 100644 --- a/community/openjdk8/APKBUILD +++ b/community/openjdk8/APKBUILD @@ -2,10 +2,10 @@ # Contributor: Jakub Jirutka <jakub@jirutka.cz> # Maintainer: Timo Teras <timo.teras@iki.fi> pkgname=openjdk8 -_icedteaver=3.16.0 +_icedteaver=3.17.1 # pkgver is <JDK version>.<JDK update>.<JDK build> # Check https://icedtea.classpath.org/wiki/Main_Page when updating! -pkgver=8.252.09 +pkgver=8.275.01 pkgrel=0 pkgdesc="OpenJDK 8 provided by IcedTea" url="https://icedtea.classpath.org/" @@ -49,6 +49,7 @@ makedepends=" pcsc-lite-dev sed util-linux + xz zip zlib-dev " @@ -60,6 +61,12 @@ case $CARCH in *) _jarch="$CARCH";; esac +case $CARCH in +x86|x86_64|aarch64) + _configure_jfr="--enable-jfr";; +*) _configure_jfr="--disable-jfr";; +esac + _bootstrap_java_home="/usr/lib/jvm/java-1.7-openjdk" _java_home="/usr/lib/jvm/java-1.8-openjdk" _jrelib="$_java_home/jre/lib/$_jarch" @@ -98,6 +105,23 @@ source="https://icedtea.classpath.org/download/source/icedtea-$_icedteaver.tar.x builddir="$srcdir/icedtea-$_icedteaver" # secfixes: +# 8.272.10-r0: +# - CVE-2020-14556 +# - CVE-2020-14577 +# - CVE-2020-14578 +# - CVE-2020-14579 +# - CVE-2020-14581 +# - CVE-2020-14583 +# - CVE-2020-14593 +# - CVE-2020-14621 +# - CVE-2020-14779 +# - CVE-2020-14781 +# - CVE-2020-14782 +# - CVE-2020-14792 +# - CVE-2020-14796 +# - CVE-2020-14797 +# - CVE-2020-14798 +# - CVE-2020-14803 # 8.252.09-r0: # - CVE-2020-2754 # - CVE-2020-2755 @@ -176,7 +200,7 @@ unpack() { fi mkdir -p "$srcdir" msg "Unpacking sources..." - tar -C "$srcdir" -Jxf icedtea-$_icedteaver.tar.xz + unxz -c icedtea-$_icedteaver.tar.xz | tar -C "$srcdir" -x } prepare() { @@ -233,6 +257,7 @@ build() { --disable-dependency-tracking \ --disable-downloading \ --disable-precompiled-headers \ + --disable-docs \ --with-parallel-jobs=${JOBS:-2} \ --with-hotspot-build=default \ --with-openjdk-src-zip="$srcdir/openjdk-$_dropsver.tar.xz" \ @@ -245,9 +270,9 @@ build() { --with-nashorn-src-zip="$srcdir/nashorn-$_dropsver.tar.xz" \ --with-jdk-home="$_bootstrap_java_home" \ --with-pkgversion="Alpine $pkgver-r$pkgrel" \ + --with-curves="nist+" \ --enable-nss \ - --enable-sunec \ - --enable-non-nss-curves + $_configure_jfr make } @@ -297,6 +322,7 @@ jrelib() { jre() { pkgdesc="OpenJDK 8 Java Runtime" + depends="ttf-dejavu" local file dir mkdir -p "$subpkgdir" @@ -321,6 +347,7 @@ jrebase() { mkdir -p "$subpkgdir"/$_java_home/bin \ "$subpkgdir"/$_java_home/lib/$_jarch + ln -s java-1.8-openjdk "$subpkgdir"/usr/lib/jvm/java-8-openjdk mv "$pkgdir"/$_java_home/lib/$_jarch/jli \ "$subpkgdir"/$_java_home/lib/$_jarch/ @@ -350,17 +377,17 @@ demos() { "$subpkgdir"/$_java_home/ } -sha512sums="67964f283b5a220ded7c86141ac359fc51f41077686d3e68568a9f303d2e5e6d62472bef2d6f5f9d53897a55589c84d3212983194607b9a6704192752f8ad2ac icedtea-3.16.0.tar.xz -76b32457958c2cdbb0006629bb41652286a1a9bfbda862665eddf822d4653d4858f9f2565e849b0e49f031b7667be73be8fe8c71abc65e1795eb570a96d1fd1e openjdk-3.16.0.tar.xz -bf90c95f401d4628e32b9a7ea78b7d43944f82882818a81d2ff368f09e49148091bf823d78ed56c343c175fe6d25492d9b78e25b725f218592ea94c4ae285e56 corba-3.16.0.tar.xz -86e8c18741c1f4baca27d784b068765e404a5c2ee6ecb172c826fc1d6192b5776133f103b749839c39154fcaec87a0df95e8fd5bcb56b1e9b811711b296a4836 jaxp-3.16.0.tar.xz -824ef15aa70ec629406fd9b98a69e5699fe8f6a8ab06be00ac546bcda1daf485b20de6ea0310064e000efbaf35b1cebee25bf69033634fdce8434efb3bb16f1d jaxws-3.16.0.tar.xz -9202f88b360637ad474920d8a6f85740e6a425679617ef713efd67778b4c7ca0b3eba7e4fc9d33de0bbd5dacda4862c8a9b63a13880204388b01af29d5fb6a55 jdk-3.16.0.tar.xz -1858bb3b7dd37edd817a52c67a878b48bc9b790623e77d9a6107f54b141638cb101ae3b8df560e3352c9ca2925aa5d493b4924e36a238be5a9628c714cc23642 langtools-3.16.0.tar.xz -19490ccc377fde5dc3d4396425e945f32e121ad0cc4be394b07f8698a7e3805b16fc41e427bab5fa290cb84efc7edb62acf8ca98072176343f5584d692592d2d hotspot-3.16.0.tar.xz -4bf87e7441ac747f133612e1fba5c06946c6731bae76132ffc614b41fcb689fda9d9ceb1e1fee3765765c6109894c85cf0f6e6fa9eb301f9a2d640ea6cd1c16c nashorn-3.16.0.tar.xz +sha512sums="eaf66df177f08cf335fe795f816e4f6b70a25a402ff8db4c1a2c545dd129350e1135c45e131eab8820620de2a75fda1d56141583ec1a651218d0a02680eb1df7 icedtea-3.17.1.tar.xz +82f2688b018b893cbf583ccc1cd328f6909ebeb4d30655ddb554691f1f0ee38debe57dc91bc8200d6676ad531047ffbf149ce7c1e49b65e67db3254c7d6205ed openjdk-3.17.1.tar.xz +c33886bfa517087e3cf37064fd9dcf1c0b8a9c9ccc4147beac3eb9c07e66c2f8aa3053feb8ab6cbdd42054b073854ed5aaf4a2cfb2888e0a09b7efe3809447c8 corba-3.17.1.tar.xz +e690a6c498e2418feaa22713517aefd051524aedd349fbab5c70fbdee3ca0f17a297089e02f1de2a27e318413e5ca6fe7dfd825b49c37e749ff48e9c8981307a jaxp-3.17.1.tar.xz +99c32483c6f5469c256026be9ee5c2a5654768ceff9d10fa9aa10888640af60d618668ae47880062d1253668e546949fd6ffe94c27d6436088e0a8367e2602fd jaxws-3.17.1.tar.xz +7f5321944cc6c7510db5d6ea6ef189bd15fdf7c904c8ec009576c33ce1e0288e18e51a5dc906e5c7c3beb4daebb161be0c08d1fe8f2ebde81b72a992da919142 jdk-3.17.1.tar.xz +68ff7857d180b90a77858505523416bee6102e30af7a394d08ab1581ba65d28b78c30f48c1b5555c30bf8b43adc5497d5530372101dc2e4adbc99e5d9c988def langtools-3.17.1.tar.xz +e377a2ad481727a1d5218f1bf629690ea5f1b7976307f593505efc07252cc5cd408f7eb0873032ec74ed44a31e5f2cd90747be3e6f709eba5ac9fd90857887ab hotspot-3.17.1.tar.xz +088948d01fc6ea627610bbdcf6691a7bcdd34c5715be103297292db54d0e9080f82f395c3b4bb432058615bc04e05c2d4292fc8f31735e3005d4cf16ff1f9af1 nashorn-3.17.1.tar.xz 28709285390a997adbd56ebda42ef718fbc08daf572b8568f484436d255514f9d25f033e3333dff8aa352fc9846057ac5bb42fa955d3e5e44eddc96dc273c07c icedtea-hotspot-musl.patch -e5cf4d70f96fc1e72ae8b97a887adb96092ff36584711cbb8de9d9fa9e859cb8731d638838de0d9591239fc44ffe5c74422d1842bd9f10a0c00dff1627bdeeef icedtea-hotspot-musl-ppc.patch +54ef36ea5a749b733cadaf4fb47a2766db204fe7c9d4dbc1c2d49dd1cec14a552d18da5c49da9ebe8718329c59bdee2c34f94f7882a23837cee2f18af6ffe95f icedtea-hotspot-musl-ppc.patch 19459dbb922f5a71cd15b53199481498626a783c24f91d2544d55b7dddd2cdb34a64bbf0226b99548612dd1743af01b3f9ff32c30abbbc90ce727ca2dbbbd1f9 icedtea-hotspot-noagent-musl.patch f6365cfafafa008bd6c1bf0ccec01a63f8a39bd1a8bc87baa492a27234d47793ba02d455e5667a873ef50148df3baaf6a8421e2da0b15faac675867da714dd5f icedtea-jdk-execinfo.patch 48533f87fc2cf29d26b259be0df51087d2fe5b252e72d00c6ea2f4add7b0fb113141718c116279c5905e03f64a1118082e719393786811367cf4d472b5d36774 icedtea-jdk-fix-ipv6-init.patch diff --git a/community/openjdk8/icedtea-hotspot-musl-ppc.patch b/community/openjdk8/icedtea-hotspot-musl-ppc.patch index eca684884c80..dfb3150f6b6e 100644 --- a/community/openjdk8/icedtea-hotspot-musl-ppc.patch +++ b/community/openjdk8/icedtea-hotspot-musl-ppc.patch @@ -1,13 +1,94 @@ +Subject: Fix compilation with different ucontext_t on musl +Upstream: No +Author: Simon Frankenberger <simon-alpine@fraho.eu> + +The machine state registers have to be accessed differently when +running on musl libc. This patch fix this by replacing +"uc_mcontext.regs->grp" with "uc_mcontext.gp_regs" +and accessing the named fields (like "->nip") by the array index constants. + +--- openjdk.orig/hotspot/src/cpu/ppc/vm/macroAssembler_ppc.cpp ++++ openjdk/hotspot/src/cpu/ppc/vm/macroAssembler_ppc.cpp +@@ -1243,7 +1243,11 @@ + // the safepoing polling page. + ucontext_t* uc = (ucontext_t*) ucontext; + // Set polling address. ++#if defined(__GLIBC__) || defined(__UCLIBC__) + address addr = (address)uc->uc_mcontext.regs->gpr[ra] + (ssize_t)ds; ++#else // Musl ++ address addr = (address)uc->uc_mcontext.gp_regs[ra] + (ssize_t)ds; ++#endif + if (polling_address_ptr != NULL) { + *polling_address_ptr = addr; + } +@@ -1264,15 +1268,24 @@ + int rb = inv_rb_field(instruction); + + // look up content of ra and rb in ucontext ++#if defined(__GLIBC__) || defined(__UCLIBC__) + address ra_val=(address)uc->uc_mcontext.regs->gpr[ra]; + long rb_val=(long)uc->uc_mcontext.regs->gpr[rb]; ++#else // Musl ++ address ra_val=(address)uc->uc_mcontext.gp_regs[ra]; ++ long rb_val=(long)uc->uc_mcontext.gp_regs[rb]; ++#endif + return os::is_memory_serialize_page(thread, ra_val+rb_val); + } else if (is_stw(instruction) || is_stwu(instruction)) { + int ra = inv_ra_field(instruction); + int d1 = inv_d1_field(instruction); + + // look up content of ra in ucontext ++#if defined(__GLIBC__) || defined(__UCLIBC__) + address ra_val=(address)uc->uc_mcontext.regs->gpr[ra]; ++#else // Musl ++ address ra_val=(address)uc->uc_mcontext.gp_regs[ra]; ++#endif + return os::is_memory_serialize_page(thread, ra_val+d1); + } else { + return false; +@@ -1335,11 +1348,20 @@ + || (is_stdu(instruction) && rs == 1)) { + int ds = inv_ds_field(instruction); + // return banged address ++#if defined(__GLIBC__) || defined(__UCLIBC__) + return ds+(address)uc->uc_mcontext.regs->gpr[ra]; ++#else // Musl ++ return ds+(address)uc->uc_mcontext.gp_regs[ra]; ++#endif + } else if (is_stdux(instruction) && rs == 1) { + int rb = inv_rb_field(instruction); ++#if defined(__GLIBC__) || defined(__UCLIBC__) + address sp = (address)uc->uc_mcontext.regs->gpr[1]; + long rb_val = (long)uc->uc_mcontext.regs->gpr[rb]; ++#else // Musl ++ address sp = (address)uc->uc_mcontext.gp_regs[1]; ++ long rb_val = (long)uc->uc_mcontext.gp_regs[rb]; ++#endif + return ra != 1 || rb_val >= 0 ? NULL // not a stack bang + : sp + rb_val; // banged address + } --- openjdk.orig/hotspot/src/os_cpu/linux_ppc/vm/os_linux_ppc.cpp +++ openjdk/hotspot/src/os_cpu/linux_ppc/vm/os_linux_ppc.cpp -@@ -110,11 +110,19 @@ +@@ -75,7 +75,11 @@ + # include <poll.h> + # include <ucontext.h> + ++#if ! (defined(__GLIBC__) || defined(__UCLIBC__)) ++# include <asm/ptrace.h> ++#endif + ++ + address os::current_stack_pointer() { + intptr_t* csp; + +@@ -110,11 +114,19 @@ // it because the volatile registers are not needed to make setcontext() work. // Hopefully it was zero'd out beforehand. guarantee(uc->uc_mcontext.regs != NULL, "only use ucontext_get_pc in sigaction context"); +#if defined(__GLIBC__) || defined(__UCLIBC__) return (address)uc->uc_mcontext.regs->nip; +#else // Musl -+ return (address)uc->uc_mcontext.gp_regs[32]; ++ return (address)uc->uc_mcontext.gp_regs[PT_NIP]; +#endif } @@ -20,55 +101,55 @@ } intptr_t* os::Linux::ucontext_get_fp(ucontext_t * uc) { -@@ -213,7 +221,11 @@ +@@ -213,7 +225,11 @@ if (uc) { address const pc = os::Linux::ucontext_get_pc(uc); if (pc && StubRoutines::is_safefetch_fault(pc)) { +#if defined(__GLIBC__) || defined(__UCLIBC__) uc->uc_mcontext.regs->nip = (unsigned long)StubRoutines::continuation_for_safefetch_fault(pc); +#else // Musl -+ uc->uc_mcontext.gp_regs[32] = (unsigned long)StubRoutines::continuation_for_safefetch_fault(pc); ++ uc->uc_mcontext.gp_regs[PT_NIP] = (unsigned long)StubRoutines::continuation_for_safefetch_fault(pc); +#endif return true; } } -@@ -364,7 +376,11 @@ +@@ -364,7 +380,11 @@ // continue at the next instruction after the faulting read. Returning // garbage from this read is ok. thread->set_pending_unsafe_access_error(); +#if defined(__GLIBC__) || defined(__UCLIBC__) uc->uc_mcontext.regs->nip = ((unsigned long)pc) + 4; +#else // Musl -+ uc->uc_mcontext.gp_regs[32] = ((unsigned long)pc) + 4; ++ uc->uc_mcontext.gp_regs[PT_NIP] = ((unsigned long)pc) + 4; +#endif return true; } } -@@ -383,7 +399,11 @@ +@@ -383,7 +403,11 @@ // continue at the next instruction after the faulting read. Returning // garbage from this read is ok. thread->set_pending_unsafe_access_error(); +#if defined(__GLIBC__) || defined(__UCLIBC__) uc->uc_mcontext.regs->nip = ((unsigned long)pc) + 4; +#else // Musl -+ uc->uc_mcontext.gp_regs[32] = ((unsigned long)pc) + 4; ++ uc->uc_mcontext.gp_regs[PT_NIP] = ((unsigned long)pc) + 4; +#endif return true; } } -@@ -406,7 +426,11 @@ +@@ -406,7 +430,11 @@ if (stub != NULL) { // Save all thread context in case we need to restore it. if (thread != NULL) thread->set_saved_exception_pc(pc); +#if defined(__GLIBC__) || defined(__UCLIBC__) uc->uc_mcontext.regs->nip = (unsigned long)stub; +#else -+ uc->uc_mcontext.gp_regs[32] = (unsigned long)stub; ++ uc->uc_mcontext.gp_regs[PT_NIP] = (unsigned long)stub; +#endif return true; } -@@ -564,6 +588,7 @@ +@@ -564,6 +592,7 @@ ucontext_t* uc = (ucontext_t*)context; st->print_cr("Registers:"); @@ -76,14 +157,14 @@ st->print("pc =" INTPTR_FORMAT " ", uc->uc_mcontext.regs->nip); st->print("lr =" INTPTR_FORMAT " ", uc->uc_mcontext.regs->link); st->print("ctr=" INTPTR_FORMAT " ", uc->uc_mcontext.regs->ctr); -@@ -572,8 +597,18 @@ +@@ -572,8 +601,18 @@ st->print("r%-2d=" INTPTR_FORMAT " ", i, uc->uc_mcontext.regs->gpr[i]); if (i % 3 == 2) st->cr(); } +#else // Musl -+ st->print("pc =" INTPTR_FORMAT " ", uc->uc_mcontext.gp_regs[32]); -+ st->print("lr =" INTPTR_FORMAT " ", uc->uc_mcontext.gp_regs[36]); -+ st->print("ctr=" INTPTR_FORMAT " ", uc->uc_mcontext.gp_regs[35]); ++ st->print("pc =" INTPTR_FORMAT " ", uc->uc_mcontext.gp_regs[PT_NIP]); ++ st->print("lr =" INTPTR_FORMAT " ", uc->uc_mcontext.gp_regs[PT_LNK]); ++ st->print("ctr=" INTPTR_FORMAT " ", uc->uc_mcontext.gp_regs[PT_CTR]); st->cr(); + for (int i = 0; i < 32; i++) { + st->print("r%-2d=" INTPTR_FORMAT " ", i, uc->uc_mcontext.gp_regs[i]); @@ -95,7 +176,7 @@ intptr_t *sp = (intptr_t *)os::Linux::ucontext_get_sp(uc); st->print_cr("Top of Stack: (sp=" PTR_FORMAT ")", p2i(sp)); -@@ -600,7 +635,11 @@ +@@ -600,7 +639,11 @@ // this is only for the "general purpose" registers for (int i = 0; i < 32; i++) { st->print("r%-2d=", i); @@ -107,63 +188,42 @@ } st->cr(); } ---- openjdk.orig/hotspot.orig/src/cpu/ppc/vm/macroAssembler_ppc.cpp -+++ openjdk/hotspot/src/cpu/ppc/vm/macroAssembler_ppc.cpp -@@ -1242,7 +1242,11 @@ - // the safepoing polling page. - ucontext_t* uc = (ucontext_t*) ucontext; - // Set polling address. -+#if defined(__GLIBC__) || defined(__UCLIBC__) - address addr = (address)uc->uc_mcontext.regs->gpr[ra] + (ssize_t)ds; -+#else // Musl -+ address addr = (address)uc->uc_mcontext.gp_regs[ra] + (ssize_t)ds; -+#endif - if (polling_address_ptr != NULL) { - *polling_address_ptr = addr; - } -@@ -1263,15 +1267,24 @@ - int rb = inv_rb_field(instruction); +--- openjdk.orig/hotspot/src/os_cpu/linux_ppc/vm/thread_linux_ppc.cpp ++++ openjdk/hotspot/src/os_cpu/linux_ppc/vm/thread_linux_ppc.cpp +@@ -27,6 +27,10 @@ + #include "runtime/frame.inline.hpp" + #include "runtime/thread.hpp" - // look up content of ra and rb in ucontext -+#if defined(__GLIBC__) || defined(__UCLIBC__) - address ra_val=(address)uc->uc_mcontext.regs->gpr[ra]; - long rb_val=(long)uc->uc_mcontext.regs->gpr[rb]; -+#else // Musl -+ address ra_val=(address)uc->uc_mcontext.gp_regs[ra]; -+ long rb_val=(long)uc->uc_mcontext.gp_regs[rb]; ++#if ! (defined(__GLIBC__) || defined(__UCLIBC__)) ++#include <asm/ptrace.h> +#endif - return os::is_memory_serialize_page(thread, ra_val+rb_val); - } else if (is_stw(instruction) || is_stwu(instruction)) { - int ra = inv_ra_field(instruction); - int d1 = inv_d1_field(instruction); ++ + bool JavaThread::pd_get_top_frame_for_profiling(frame* fr_addr, void* ucontext, bool isInJava) { + assert(this->is_Java_thread(), "must be JavaThread"); - // look up content of ra in ucontext +@@ -42,8 +46,13 @@ + // if we were running Java code when SIGPROF came in. + if (isInJava) { + ucontext_t* uc = (ucontext_t*) ucontext; +#if defined(__GLIBC__) || defined(__UCLIBC__) - address ra_val=(address)uc->uc_mcontext.regs->gpr[ra]; + frame ret_frame((intptr_t*)uc->uc_mcontext.regs->gpr[1/*REG_SP*/], + (address)uc->uc_mcontext.regs->nip); +#else // Musl -+ address ra_val=(address)uc->uc_mcontext.gp_regs[ra]; ++ frame ret_frame((intptr_t*)uc->uc_mcontext.gp_regs[1/*REG_SP*/], ++ (address)uc->uc_mcontext.gp_regs[PT_NIP]); +#endif - return os::is_memory_serialize_page(thread, ra_val+d1); - } else { - return false; -@@ -1334,11 +1347,20 @@ - || (is_stdu(instruction) && rs == 1)) { - int ds = inv_ds_field(instruction); - // return banged address -+#if defined(__GLIBC__) || defined(__UCLIBC__) - return ds+(address)uc->uc_mcontext.regs->gpr[ra]; -+#else // Musl -+ return ds+(address)uc->uc_mcontext.gp_regs[ra]; -+#endif - } else if (is_stdux(instruction) && rs == 1) { - int rb = inv_rb_field(instruction); + + if (ret_frame.pc() == NULL) { + // ucontext wasn't useful +@@ -55,7 +64,11 @@ + if (!((Method*)(istate->method))->is_metaspace_object()) { + return false; + } +#if defined(__GLIBC__) || defined(__UCLIBC__) - address sp = (address)uc->uc_mcontext.regs->gpr[1]; - long rb_val = (long)uc->uc_mcontext.regs->gpr[rb]; + uint64_t reg_bcp = uc->uc_mcontext.regs->gpr[14/*R14_bcp*/]; +#else // Musl -+ address sp = (address)uc->uc_mcontext.gp_regs[1]; -+ long rb_val = (long)uc->uc_mcontext.gp_regs[rb]; ++ uint64_t reg_bcp = uc->uc_mcontext.gp_regs[14/*R14_bcp*/]; +#endif - return ra != 1 || rb_val >= 0 ? NULL // not a stack bang - : sp + rb_val; // banged address - } + uint64_t istate_bcp = istate->bcp; + uint64_t code_start = (uint64_t)(((Method*)(istate->method))->code_base()); + uint64_t code_end = (uint64_t)(((Method*)istate->method)->code_base() + ((Method*)istate->method)->code_size()); -- GitLab