Compare commits

..

10 Commits

Author SHA1 Message Date
openeuler-ci-bot
fe46e1beda
!76 add Conflicts with redis and redis5
From: @jxy_git 
Reviewed-by: @yangzhao_kl 
Signed-off-by: @yangzhao_kl
2024-04-10 07:57:45 +00:00
jxy_git
34d173e4d4 add Conflicts with redis and redis5 2024-04-10 15:20:28 +08:00
openeuler-ci-bot
b83ea8d205
!56 Update config.guess and config.sub for loongarch.
From: @huajingyun 
Reviewed-by: @wuzeyi1 
Signed-off-by: @wuzeyi1
2022-12-06 03:15:08 +00:00
Jingyun Hua
d2d1301723 Add loongarch64 support
Update config.guess and config.sub

Signed-off-by: Jingyun Hua <huajingyun@loongson.cn>
2022-11-15 12:26:40 +00:00
openeuler-ci-bot
15efbc3e34
!44 upgrade to 6.2.7 for fix CVE-2022-24735 CVE-2022-24736 CVE-2021-29477 CVE-2021-32672
From: @yuluosha 
Reviewed-by: @wuzeyi1 
Signed-off-by: @wuzeyi1
2022-08-05 06:40:16 +00:00
yangweidong
7161b71265 upgrade to 6.2.7 for fix CVE-2022-24735 CVE-2022-24736 CVE-2021-29477 CVE-2021-32672 2022-06-15 10:23:12 +08:00
openeuler-ci-bot
d08e582164 !26 [sync] PR-25: fix help info
From: @openeuler-sync-bot
Reviewed-by: @yangzhao_kl
Signed-off-by: @yangzhao_kl
2021-12-06 11:52:05 +00:00
caodongxia
7306203546 fix help info
(cherry picked from commit cd517b9eede8b15c6748e9984130cf386c08a387)
2021-12-06 19:31:32 +08:00
openeuler-ci-bot
04b466b6ff !19 fix CVE-2021-32628 CVE-2021-32627 CVE-2021-32687 CVE-2021-41099 CVE-2021-32675 CVE-2021-32762
From: @programmer12
Reviewed-by: 
Signed-off-by:
2021-11-30 11:22:38 +00:00
programmer12
daa03c38b6 redis6 2021-11-30 14:15:30 +08:00
8 changed files with 5496 additions and 163 deletions

View File

@ -0,0 +1,26 @@
From a1f23456adfaec27df27bba511bcf7fae59708f0 Mon Sep 17 00:00:00 2001
From: WangQiang <wangqiang1@kylinos.cn>
Date: Tue, 28 Jun 2022 10:10:21 +0800
Subject: [PATCH] Add LoongArch64 Support
---
.../include/jemalloc/internal/jemalloc_internal_types.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/deps/jemalloc/include/jemalloc/internal/jemalloc_internal_types.h b/deps/jemalloc/include/jemalloc/internal/jemalloc_internal_types.h
index 1b750b1..780627d 100644
--- a/deps/jemalloc/include/jemalloc/internal/jemalloc_internal_types.h
+++ b/deps/jemalloc/include/jemalloc/internal/jemalloc_internal_types.h
@@ -107,6 +107,9 @@ typedef int malloc_cpuid_t;
# ifdef __tile__
# define LG_QUANTUM 4
# endif
+# ifdef __loongarch__
+# define LG_QUANTUM 4
+# endif
# ifdef __le32__
# define LG_QUANTUM 4
# endif
--
2.27.0

View File

@ -1,140 +0,0 @@
From 666ed7facf4524bf6d19b11b20faa2cf93fdf591 Mon Sep 17 00:00:00 2001
From: "meir@redislabs.com" <meir@redislabs.com>
Date: Sun, 13 Jun 2021 14:27:18 +0300
Subject: [PATCH] Fix invalid memory write on lua stack overflow
{CVE-2021-32626}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When LUA call our C code, by default, the LUA stack has room for 20
elements. In most cases, this is more than enough but sometimes it's not
and the caller must verify the LUA stack size before he pushes elements.
On 3 places in the code, there was no verification of the LUA stack size.
On specific inputs this missing verification could have lead to invalid
memory write:
1. On 'luaReplyToRedisReply', one might return a nested reply that will
explode the LUA stack.
2. On 'redisProtocolToLuaType', the Redis reply might be deep enough
   to explode the LUA stack (notice that currently there is no such
   command in Redis that returns such a nested reply, but modules might
   do it)
3. On 'ldbRedis', one might give a command with enough arguments to
   explode the LUA stack (all the arguments will be pushed to the LUA
   stack)
This commit is solving all those 3 issues by calling 'lua_checkstack' and
verify that there is enough room in the LUA stack to push elements. In
case 'lua_checkstack' returns an error (there is not enough room in the
LUA stack and it's not possible to increase the stack), we will do the
following:
1. On 'luaReplyToRedisReply', we will return an error to the user.
2. On 'redisProtocolToLuaType' we will exit with panic (we assume this
scenario is rare because it can only happen with a module).
3. On 'ldbRedis', we return an error.
---
src/scripting.c | 41 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 41 insertions(+)
diff --git a/src/scripting.c b/src/scripting.c
index dea5f516561e..afa6adb0c47e 100644
--- a/src/scripting.c
+++ b/src/scripting.c
@@ -128,6 +128,16 @@ void sha1hex(char *digest, char *script, size_t len) {
*/
char *redisProtocolToLuaType(lua_State *lua, char* reply) {
+
+ if (!lua_checkstack(lua, 5)) {
+ /*
+ * Increase the Lua stack if needed, to make sure there is enough room
+ * to push 5 elements to the stack. On failure, exit with panic.
+         * Notice that we need, in the worst case, 5 elements because redisProtocolToLuaType_Aggregate
+         * might push 5 elements to the Lua stack.*/
+ serverPanic("lua stack limit reach when parsing redis.call reply");
+ }
+
char *p = reply;
switch(*p) {
@@ -220,6 +230,11 @@ char *redisProtocolToLuaType_Aggregate(lua_State *lua, char *reply, int atype) {
if (atype == '%') {
p = redisProtocolToLuaType(lua,p);
} else {
+ if (!lua_checkstack(lua, 1)) {
+ /* Notice that here we need to check the stack again because the recursive
+ * call to redisProtocolToLuaType might have use the room allocated in the stack */
+ serverPanic("lua stack limit reach when parsing redis.call reply");
+ }
lua_pushboolean(lua,1);
}
lua_settable(lua,-3);
@@ -339,6 +354,17 @@ void luaSortArray(lua_State *lua) {
/* Reply to client 'c' converting the top element in the Lua stack to a
* Redis reply. As a side effect the element is consumed from the stack. */
void luaReplyToRedisReply(client *c, lua_State *lua) {
+
+ if (!lua_checkstack(lua, 4)) {
+ /* Increase the Lua stack if needed to make sure there is enough room
+ * to push 4 elements to the stack. On failure, return error.
+         * Notice that we need, in the worst case, 4 elements because returning a map might
+ * require push 4 elements to the Lua stack.*/
+ addReplyErrorFormat(c, "reached lua stack limit");
+ lua_pop(lua,1); // pop the element from the stack
+ return;
+ }
+
int t = lua_type(lua,-1);
switch(t) {
@@ -362,6 +388,7 @@ void luaReplyToRedisReply(client *c, lua_State *lua) {
* field. */
/* Handle error reply. */
+ // we took care of the stack size on function start
lua_pushstring(lua,"err");
lua_gettable(lua,-2);
t = lua_type(lua,-1);
@@ -407,6 +434,7 @@ void luaReplyToRedisReply(client *c, lua_State *lua) {
if (t == LUA_TTABLE) {
int maplen = 0;
void *replylen = addReplyDeferredLen(c);
+ /* we took care of the stack size on function start */
lua_pushnil(lua); /* Use nil to start iteration. */
while (lua_next(lua,-2)) {
/* Stack now: table, key, value */
@@ -429,6 +457,7 @@ void luaReplyToRedisReply(client *c, lua_State *lua) {
if (t == LUA_TTABLE) {
int setlen = 0;
void *replylen = addReplyDeferredLen(c);
+ /* we took care of the stack size on function start */
lua_pushnil(lua); /* Use nil to start iteration. */
while (lua_next(lua,-2)) {
/* Stack now: table, key, true */
@@ -448,6 +477,7 @@ void luaReplyToRedisReply(client *c, lua_State *lua) {
void *replylen = addReplyDeferredLen(c);
int j = 1, mbulklen = 0;
while(1) {
+ /* we took care of the stack size on function start */
lua_pushnumber(lua,j++);
lua_gettable(lua,-2);
t = lua_type(lua,-1);
@@ -2506,6 +2536,17 @@ void ldbEval(lua_State *lua, sds *argv, int argc) {
void ldbRedis(lua_State *lua, sds *argv, int argc) {
int j, saved_rc = server.lua_replicate_commands;
+ if (!lua_checkstack(lua, argc + 1)) {
+ /* Increase the Lua stack if needed to make sure there is enough room
+ * to push 'argc + 1' elements to the stack. On failure, return error.
+         * Notice that we need, in worst case, 'argc + 1' elements because we push all the arguments
+         * given by the user (without the first argument) and we also push the 'redis' global table and
+         * 'redis.call' function so:
+         * (1 (redis table)) + (1 (redis.call function)) + (argc - 1 (all arguments without the first)) = argc + 1*/
+ ldbLogRedisReply("max lua stack reached");
+ return;
+ }
+
lua_getglobal(lua,"redis");
lua_pushstring(lua,"call");
lua_gettable(lua,-2); /* Stack: redis, redis.call */

View File

@ -1,25 +1,12 @@
From 8c4c3730d69ea1e3352d35e18999d42dca4c07e5 Mon Sep 17 00:00:00 2001
From: lingsheng <lingsheng@huawei.com>
Date: Mon, 29 Mar 2021 17:37:06 +0800
Subject: [PATCH] Modify aarch64 architecture jemalloc page size from 4k to 64k
---
deps/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/deps/Makefile b/deps/Makefile
index eb35c1e..2ba6ae3 100644
--- a/deps/Makefile
+++ b/deps/Makefile
@@ -81,7 +81,7 @@ JEMALLOC_LDFLAGS= $(LDFLAGS)
diff -Naru redis-6.2.7/deps/Makefile redis-6.2.7-new/deps/Makefile
--- redis-6.2.7/deps/Makefile 2022-04-27 21:31:52.000000000 +0800
+++ redis-6.2.7-new/deps/Makefile 2022-06-14 15:21:56.254108000 +0800
@@ -88,7 +88,7 @@
jemalloc: .make-prerequisites
@printf '%b %b\n' $(MAKECOLOR)MAKE$(ENDCOLOR) $(BINCOLOR)$@$(ENDCOLOR)
- cd jemalloc && ./configure --with-version=5.1.0-0-g0 --with-lg-quantum=3 --with-jemalloc-prefix=je_ --enable-cc-silence CFLAGS="$(JEMALLOC_CFLAGS)" LDFLAGS="$(JEMALLOC_LDFLAGS)"
+ cd jemalloc && ./configure --with-version=5.1.0-0-g0 --with-lg-quantum=3 --with-jemalloc-prefix=je_ --enable-cc-silence CFLAGS="$(JEMALLOC_CFLAGS)" LDFLAGS="$(JEMALLOC_LDFLAGS)" --with-lg-page=16
- cd jemalloc && ./configure --with-version=5.1.0-0-g0 --with-lg-quantum=3 --with-jemalloc-prefix=je_ CFLAGS="$(JEMALLOC_CFLAGS)" LDFLAGS="$(JEMALLOC_LDFLAGS)"
+ cd jemalloc && ./configure --with-version=5.1.0-0-g0 --with-lg-quantum=3 --with-jemalloc-prefix=je_ CFLAGS="$(JEMALLOC_CFLAGS)" LDFLAGS="$(JEMALLOC_LDFLAGS)" --with-lg-page=16
cd jemalloc && $(MAKE) CFLAGS="$(JEMALLOC_CFLAGS)" LDFLAGS="$(JEMALLOC_LDFLAGS)" lib/libjemalloc.a
.PHONY: jemalloc
--
2.23.0

File diff suppressed because it is too large Load Diff

12
fix-help-info.patch Normal file
View File

@ -0,0 +1,12 @@
diff -Naru redis-6.2.7/src/server.c redis-6.2.7-new/src/server.c
--- redis-6.2.7/src/server.c 2022-04-27 21:31:52.000000000 +0800
+++ redis-6.2.7-new/src/server.c 2022-06-14 15:16:01.860899000 +0800
@@ -5656,7 +5656,7 @@
fprintf(stderr," ./redis-server /etc/myredis.conf --loglevel verbose -\n");
fprintf(stderr," ./redis-server /etc/myredis.conf --loglevel verbose\n\n");
fprintf(stderr,"Sentinel mode:\n");
- fprintf(stderr," ./redis-server /etc/sentinel.conf --sentinel\n");
+ fprintf(stderr," ./redis-server /etc/redis/sentinel.conf --sentinel\n");
exit(1);
}

Binary file not shown.

BIN
redis-6.2.7.tar.gz Normal file

Binary file not shown.

View File

@ -5,8 +5,8 @@
%global make_flags DEBUG="" V="echo" LDFLAGS="%{?__global_ldflags}" CFLAGS+="%{optflags} -fPIC" INSTALL="install -p" PREFIX=%{buildroot}%{_prefix} BUILD_WITH_SYSTEMD=yes BUILD_TLS=yes
%global Pname redis
Name: redis6
Version: 6.0.11
Release: 4
Version: 6.2.7
Release: 3
Summary: A persistent key-value database
License: BSD and MIT
URL: https://redis.io
@ -21,7 +21,10 @@ Source10: https://github.com/%{Pname}/%{Pname}-doc/archive/%{doc_comm
Patch0001: Modify-aarch64-architecture-jemalloc-page-size-from-from-4k-to-64k.patch
Patch0002: CVE-2021-32626.patch
Patch0003: Add-loongarch64-support.patch
Patch0004: Update-config.guess-and-config.sub.patch
Patch0002: fix-help-info.patch
BuildRequires: make gcc
%if %{with tests}
BuildRequires: procps-ng tcl
@ -39,6 +42,7 @@ Requires(post): systemd
Requires(preun): systemd
Requires(postun): systemd
Provides: redis(modules_abi)%{?_isa} = 1
Conflicts: redis redis5
%description
Redis is an advanced key-value store. It is often referred to as a data
structure server since keys can contain strings, hashes, lists, sets and
@ -62,6 +66,7 @@ You can use Redis from most programming languages also.
%package devel
Summary: Development header for Redis module development
Provides: %{Pname}-static = %{version}-%{release}
Conflicts: redis redis5
%description devel
Header file required for building loadable Redis modules. Detailed
API documentation is available in the redis-doc package.
@ -70,7 +75,7 @@ API documentation is available in the redis-doc package.
Summary: Documentation for Redis
License: CC-BY-SA
BuildArch: noarch
Conflicts: redis < 4.0
Conflicts: redis redis5
%description doc
Detailed documentation for many aspects of Redis use,
administration and development.
@ -82,6 +87,10 @@ tar -xvf %{SOURCE10}
%patch0001 -p1
%patch0002 -p1
%endif
%ifarch loongarch64
%patch0003 -p1
%patch0004 -p1
%endif
mv ../%{Pname}-doc-%{doc_commit} doc
mv deps/lua/COPYRIGHT COPYRIGHT-lua
mv deps/jemalloc/COPYING COPYING-jemalloc
@ -210,6 +219,22 @@ fi
%{_docdir}/%{Pname}
%changelog
* Wed Apr 10 2024 jiangxinyu <jiangxinyu@kylinos.cn> - 6.2.7-3
- add Conflicts with redis and redis5
* Tue Nov 15 2022 huajingyun <huajingyun@loongson.cn> - 6.2.7-2
- Update config.guess and config.sub for loongarch
* Tue Jun 14 2022 yangweidong <yangweidong9@huawei.com> - 6.2.7-1
- Fix CVE-2022-24735 CVE-2022-24736 CVE-2021-29477 CVE-2021-32672
* Mon Dec 06 2021 caodongxia <caodongxia@huawei.com> - 6.0.11-6
- Fix help info
* Mon Nov 29 2021 liwu <liwu13@huawei.com> - 6.0.11-5
- Fix CVE-2021-32687 CVE-2021-32628 CVE-2021-32627
CVE-2021-41099 CVE-2021-32675 CVE-2021-32762
* Thu Nov 04 2021 liwu <liwu13@huawei.com> - 6.0.11-4
- Fix CVE-2021-32626