New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 603189 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Jan 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Feature



Sign in to add a comment

Update glibc to 2.23

Project Member Reported by adityakali@google.com, Apr 13 2016

Issue description

Can we update glibc to newer version? v2.23 is latest.
We are interested in some of the fixes that went in release 2.20 and later. We can backport them, but unless there is a problem would prefer if we can just update to the newer version.

 
Cc: llozano@chromium.org
Owner: yunlian@chromium.org
In general, we want to use the same version of glibc that crosstool uses.

I can do some testing for glibc 2.23 though. 

Comment 2 by vapier@chromium.org, Apr 13 2016

i've moved glibc-2.23-r1 into ~arch in Gentoo now.  was waiting for 2.22-r4 to go stable.
Labels: Build-Toolchain
@adityakali
can you please provide more details about what fixes do you need?
There is another request to upgrade glibc but we were not planning to do the upgrade this quarter. 
We like to see crostool do some testing before us.
Last time we did the upgrade we had an issue that was quite nasty and took several days to fix. 

We need fix for https://sourceware.org/bugzilla/show_bug.cgi?id=15946 at the minimum (which I think can be backported as well). But there are several bug fixes that went in since 2.19, and it would be better to simply upgrade to newer version.
If not 2.23 (latest), is it possible to upgrade to 2.22?
Thanks.
Project Member

Comment 5 by bugdroid1@chromium.org, Apr 18 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/portage-stable/+/0aaca2bd48b66e85b750ccb25d5aad5208a48b93

commit 0aaca2bd48b66e85b750ccb25d5aad5208a48b93
Author: Yunlian Jiang <yunlian@google.com>
Date: Thu Apr 14 21:22:18 2016

gentoo-functions: pull it from upstream.

gentoo-functions is needed to build glibc 2.23

BUG= chromium:603189 
TEST=glibc2.23 builds locally with it.

Change-Id: Ieab643a25c280a02aed89086590fbe0fd55ae86b
Reviewed-on: https://chromium-review.googlesource.com/338965
Commit-Ready: Yunlian Jiang <yunlian@chromium.org>
Tested-by: Yunlian Jiang <yunlian@chromium.org>
Reviewed-by: Yunlian Jiang <yunlian@chromium.org>

[add] https://crrev.com/0aaca2bd48b66e85b750ccb25d5aad5208a48b93/sys-apps/gentoo-functions/gentoo-functions-0.10.ebuild
[add] https://crrev.com/0aaca2bd48b66e85b750ccb25d5aad5208a48b93/sys-apps/gentoo-functions/Manifest
[add] https://crrev.com/0aaca2bd48b66e85b750ccb25d5aad5208a48b93/sys-apps/gentoo-functions/metadata.xml

Comment 6 by vapier@chromium.org, Apr 18 2016

if you look at the list of bugfixes in the glibc-2.20+ NEWS files, there will be a number of security related changes that we don't have in CrOS.  the question then becomes how many of those are important/critical to us ... i suspect the answer is non-zero.
Project Member

Comment 7 by bugdroid1@chromium.org, Apr 19 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/5fe5622adf1b348a6483d098a46f63c1a4aa2f81

commit 5fe5622adf1b348a6483d098a46f63c1a4aa2f81
Author: Yunlian Jiang <yunlian@google.com>
Date: Fri Apr 15 21:33:59 2016

toolchain-funcs: get upstream version.

when building cros glibc, it needs tc-ld-disable-gold(),
so we need to update toolchain-funcs.

BUG= chromium:603189 
TEST=cbuildbot chromiumos_sdk falco-release
     build cros-glibc 2.23 locally.

Change-Id: Id64a8e88ea3bcefecbd53438b6f152900b30b217
Reviewed-on: https://chromium-review.googlesource.com/339284
Commit-Ready: Yunlian Jiang <yunlian@chromium.org>
Tested-by: Yunlian Jiang <yunlian@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/5fe5622adf1b348a6483d098a46f63c1a4aa2f81/eclass/toolchain-funcs.eclass

Cc: chromeos-security@google.com
I would prefer we dont do any glibc upgrades this quarter.
I am loosing one engineer and another is on parental leave. 
We have plenty of work for this quarter and, in my experience, a glibc roll will take at least 2 weeks of work (assuming there will be some problems introduced by it, which usually happens). 
So, I will prefer to backport the change required by GCI and do the roll later in the year (and let 2.23 mature a little bit).
About security, I have not heard any request from the security team for gblic updagrades or backports (except for the recent CVE-2015-7547 which we backported to 2.19).
I am adding security team in case there is any hard request.
And as Yunlian said, we prefer to trail Google3 on glibc rolls.

Labels: Restrict-View-Google
I will send a patch to backport fix for CVE-2013-7423 (https://sourceware.org/bugzilla/show_bug.cgi?id=15946)
Labels: Merge-Request-51
https://chrome-internal-review.googlesource.com/#/c/256334/ submitted.

Is it possible to cherry-pick it in R51?

Comment 12 by tin...@google.com, Apr 22 2016

Labels: -Merge-Request-51 Merge-Approved-51 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M51 (branch: 2704)
this changes

https://chrome-internal-review.googlesource.com/#/c/256334/

does not seem to be related to glibc... 

what am I missing?
Sorry, bad copy-paste :(
This is the actual patch: https://chromium-review.googlesource.com/#/c/340262/
Cherry-pick to R51: https://chromium-review.googlesource.com/#/c/340257/

Project Member

Comment 15 by sheriffbot@chromium.org, Apr 29 2016

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: -Restrict-View-Google -Hotlist-Merge-Approved -Merge-Approved-51
any idea on timeframe for this ?  on a completely unrelated topic, i found a bug in glibc-2.19 with C++/PIEs/finalizers that looks fixed in glibc-2.23.  i'd like to be lazy and not track down the upstream fix :).
we can try this next quarter. 
FYI, there is also b/28693689.
Project Member

Comment 20 by sheriffbot@chromium.org, Jun 3 2016

Labels: Hotlist-Google
Hello,
A friendly ping. Any chance this may happen this quarter?
Thanks!
Project Member

Comment 22 by bugdroid1@chromium.org, Dec 19 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/88ad3013d1add4b162d277fbacf9b491fc00ad4e

commit 88ad3013d1add4b162d277fbacf9b491fc00ad4e
Author: Yunlian Jiang <yunlian@google.com>
Date: Mon Dec 05 19:27:17 2016

glibc: roll to 2.23

This rolls glibc to 2.23.

Differences from upstream:
five local patches.
appended-cflags "-ggdb" and export SYSROOT="" in setup_target_flags()
use abort() directly instead of INLINE_SYSCALL(kill, 2, pid, SIGABRT);
configure whith --with-bugurl=http://crbug.com/new

BUG= chromium:603189 
TEST=cbuildbot daisy-release falco-release x86-alex-release oak-release

Change-Id: Ic2062b0a6df14f68f802177e5d8ab090d13490cf
Reviewed-on: https://chromium-review.googlesource.com/339261
Commit-Ready: Yunlian Jiang <yunlian@chromium.org>
Tested-by: Yunlian Jiang <yunlian@chromium.org>
Reviewed-by: Yunlian Jiang <yunlian@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/eblits/common.eblit
[modify] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/eblits/src_unpack.eblit
[add] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/2.19/glibc-2.19-ia64-gcc-4.8-reloc-hack.patch
[delete] https://crrev.com/38612267a7c5ba06fb09c5079cca676b2ef01c81/sys-libs/glibc/files/2.17/glibc-2.17-hardened-pie.patch
[modify] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/eblits/pkg_postinst.eblit
[delete] https://crrev.com/38612267a7c5ba06fb09c5079cca676b2ef01c81/sys-libs/glibc/files/local/glibc-2.19-CVE-2015-7547.patch
[add] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/glibc-2.23-r3.ebuild
[add] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/eblits/pkg_pretend.eblit
[modify] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/eblits/pkg_setup.eblit
[modify] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/eblits/src_compile.eblit
[modify] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/Manifest
[modify] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/metadata.xml
[add] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/nscd.service
[delete] https://crrev.com/38612267a7c5ba06fb09c5079cca676b2ef01c81/sys-libs/glibc/files/local/glibc-2.19-ldso-pie.patch
[delete] https://crrev.com/38612267a7c5ba06fb09c5079cca676b2ef01c81/sys-libs/glibc/files/2.18/glibc-2.18-hardened-inittls-nosysenter.patch
[delete] https://crrev.com/38612267a7c5ba06fb09c5079cca676b2ef01c81/sys-libs/glibc/files/local/glibc-2.19-CVE-2014-7817.patch
[add] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/eblits/src_prepare.eblit
[modify] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/eblits/pkg_preinst.eblit
[add] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/nscd.tmpfilesd
[modify] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/eblits/src_test.eblit
[delete] https://crrev.com/38612267a7c5ba06fb09c5079cca676b2ef01c81/sys-libs/glibc/files/2.19/glibc-2.19-hardened-configure-picdefault.patch
[add] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/nscd
[delete] https://crrev.com/38612267a7c5ba06fb09c5079cca676b2ef01c81/sys-libs/glibc/files/local/glibc-2.19-CVE-2013-7423.patch
[delete] https://crrev.com/38612267a7c5ba06fb09c5079cca676b2ef01c81/sys-libs/glibc/files/local/glibc-2.19-CVE-2015-1472.patch
[add] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/local/glibc-2.23-file-mangle.patch
[rename] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/local/glibc-2.23-clang-fortify.patch
[delete] https://crrev.com/38612267a7c5ba06fb09c5079cca676b2ef01c81/sys-libs/glibc/files/local/glibc-2.21-resize-dtv.patch
[delete] https://crrev.com/38612267a7c5ba06fb09c5079cca676b2ef01c81/sys-libs/glibc/files/local/glibc-2.19-file-mangle.patch
[add] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/local/glibc-2.23-fortify-warning.patch
[add] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/local/glibc-2.23-set-ld.patch
[modify] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/eblits/src_install.eblit
[modify] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/2.20/glibc-2.20-gentoo-chk_fail.c
[add] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/eblits/src_configure.eblit
[delete] https://crrev.com/38612267a7c5ba06fb09c5079cca676b2ef01c81/sys-libs/glibc/glibc-2.19-r13.ebuild
[add] https://crrev.com/88ad3013d1add4b162d277fbacf9b491fc00ad4e/sys-libs/glibc/files/nsswitch.conf

Project Member

Comment 23 by bugdroid1@chromium.org, Jan 4 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/1e966b908056b4588ed0948880e90332fa9d5fdc

commit 1e966b908056b4588ed0948880e90332fa9d5fdc
Author: Yunlian Jiang <yunlian@google.com>
Date: Tue Dec 27 23:17:21 2016

glibc: roll to 2.23

This rolls glibc to 2.23.

Differences from upstream:

four local patches:
glibc-2.19-arm-memcpy.patch
glibc-2.23-clang-fortify.patch
glibc-2.23-file-mangle.patch
glibc-2.23-set-ld.patch

Reverted two upstream patch:
glibc-2.23-fortify-warning.patch
glibc-2.23-long_jmp.patch

appended-cflags "-ggdb" and export SYSROOT="" in setup_target_flags()
use abort() directly instead of INLINE_SYSCALL(kill, 2, pid, SIGABRT);
configure whith --with-bugurl=http://crbug.com/new

BUG= chromium:603189 
TEST=cbuildbot daisy-release falco-release x86-alex-release oak-release
     chromiumos-sdk
Change-Id: Iebcc7a0621bcf2cc5acb45d0dbd18414cffee882
Reviewed-on: https://chromium-review.googlesource.com/424122
Commit-Ready: Yunlian Jiang <yunlian@chromium.org>
Tested-by: Yunlian Jiang <yunlian@chromium.org>
Reviewed-by: Yunlian Jiang <yunlian@chromium.org>

[modify] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/eblits/common.eblit
[modify] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/eblits/src_unpack.eblit
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/2.19/glibc-2.19-ia64-gcc-4.8-reloc-hack.patch
[delete] https://crrev.com/4caa052f632cce2a9019b4b9f0a726a57e01b0ec/sys-libs/glibc/files/2.17/glibc-2.17-hardened-pie.patch
[modify] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/eblits/pkg_postinst.eblit
[delete] https://crrev.com/4caa052f632cce2a9019b4b9f0a726a57e01b0ec/sys-libs/glibc/files/local/glibc-2.19-CVE-2015-7547.patch
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/glibc-2.23-r3.ebuild
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/eblits/pkg_pretend.eblit
[modify] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/eblits/pkg_setup.eblit
[modify] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/eblits/src_compile.eblit
[modify] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/Manifest
[modify] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/metadata.xml
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/nscd.service
[delete] https://crrev.com/4caa052f632cce2a9019b4b9f0a726a57e01b0ec/sys-libs/glibc/files/local/glibc-2.19-ldso-pie.patch
[delete] https://crrev.com/4caa052f632cce2a9019b4b9f0a726a57e01b0ec/sys-libs/glibc/files/2.18/glibc-2.18-hardened-inittls-nosysenter.patch
[delete] https://crrev.com/4caa052f632cce2a9019b4b9f0a726a57e01b0ec/sys-libs/glibc/files/local/glibc-2.19-CVE-2014-7817.patch
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/eblits/src_prepare.eblit
[modify] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/eblits/pkg_preinst.eblit
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/nscd.tmpfilesd
[modify] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/eblits/src_test.eblit
[delete] https://crrev.com/4caa052f632cce2a9019b4b9f0a726a57e01b0ec/sys-libs/glibc/files/2.19/glibc-2.19-hardened-configure-picdefault.patch
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/nscd
[delete] https://crrev.com/4caa052f632cce2a9019b4b9f0a726a57e01b0ec/sys-libs/glibc/files/local/glibc-2.19-CVE-2013-7423.patch
[delete] https://crrev.com/4caa052f632cce2a9019b4b9f0a726a57e01b0ec/sys-libs/glibc/files/local/glibc-2.19-CVE-2015-1472.patch
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/local/glibc-2.23-file-mangle.patch
[rename] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/local/glibc-2.23-clang-fortify.patch
[delete] https://crrev.com/4caa052f632cce2a9019b4b9f0a726a57e01b0ec/sys-libs/glibc/files/local/glibc-2.21-resize-dtv.patch
[delete] https://crrev.com/4caa052f632cce2a9019b4b9f0a726a57e01b0ec/sys-libs/glibc/files/local/glibc-2.19-file-mangle.patch
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/local/glibc-2.23-fortify-warning.patch
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/local/glibc-2.23-set-ld.patch
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/local/glibc-2.23-long_jmp.patch
[modify] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/eblits/src_install.eblit
[modify] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/2.20/glibc-2.20-gentoo-chk_fail.c
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/eblits/src_configure.eblit
[delete] https://crrev.com/4caa052f632cce2a9019b4b9f0a726a57e01b0ec/sys-libs/glibc/glibc-2.19-r14.ebuild
[add] https://crrev.com/1e966b908056b4588ed0948880e90332fa9d5fdc/sys-libs/glibc/files/nsswitch.conf

Status: Fixed (was: Untriaged)

Comment 25 by dchan@google.com, Mar 4 2017

Labels: VerifyIn-58
Status: Verified (was: Fixed)

Sign in to add a comment