dgit.raspbian.org Git - ceph.git/log

Merge ceph (16.2.11+ds-1) import into refs/heads/workingbranch

CVE-2022-3854: rgw: Guard against malformed bucket URLs

Fixes: https://tracker.ceph.com/issues/55765
Fixes: https://tracker.ceph.com/issues/56586
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
Origin: upstream, https://github.com/ceph/ceph/pull/47194/commits/9746e8011ff1de6de7dba9c0041e28a16c8f6828.patch
Bug-Debian: https://bugs.debian.org/1027151
Last-Update: 2022-01-09

Misplaced colons can result in radosgw thinking is has a bucket URL
but with no bucket name, leading to a crash later on.

Gbp-Pq: Name CVE-2022-3854_1_rgw_Guard_against_malformed_bucket_URLs.patch

CVE-2022-3650: ceph-crash: fix stderr handling

Bug: a77b47eeeb5770eeefcf4619ab2105ee7a6a003e
Signed-off-by: Tim Serong <tserong@suse.com>
Bug-Debian: https://bugs.debian.org/1024932
Origin: upstream, https://github.com/ceph/ceph/commit/45915540559126a652f8d9d105723584cfc63439
Last-Update: 2022-11-28

Popen.communicate() returns a tuple (stdout, stderr), and stderr
will be of type bytes, hence the need to decode it before checking
if it's an empty string or not.

Gbp-Pq: Name CVE-2022-3650_2_ceph-crash_fix_stderr_handling.patch

CVE-2022-3650: ceph-crash: drop privleges to run as "ceph" user, rather than root

Bug: https://tracker.ceph.com/issues/57967
Signed-off-by: Tim Serong <tserong@suse.com>
Origin: upstream, https://github.com/ceph/ceph/commit/130c9626598bc3a75942161e6cce7c664c447382
Bug-Debian: https://bugs.debian.org/1024932
Last-Update: 2022-11-28

If privileges cannot be dropped, log an error and exit. This commit
also catches and logs exceptions when scraping the crash path, without
which ceph-crash would just exit if it encountered an error.

Gbp-Pq: Name CVE-2022-3650_1_ceph-crash_drop_privleges_to_run_as_ceph_user_rather_than_root.patch

Fix CheckCxxAtomic to detect more accurately

Last-Update: 2022-08-30

Some platforms like riscv64 does not have full support for atomic primitives,
yet passes the test. Adding operator++ fixes this issue.

Gbp-Pq: Name fix-CheckCxxAtomic-riscv64.patch

Fix build with fmt 8/9

+ changes in segment_manager.cc and segment_manager.h are backported from
  part of the large changes in https://github.com/ceph/ceph/commit/d5b0cd13
+ change in node_extent_accessor.h is not forwarded to upstream since it's
  a workaround. However it doesn't harm since it's just a error message
  which shouldn't happen anyway.
+ changes in seastar is backported from
  https://github.com/scylladb/seastar/commit/dfb62861
+ changes in crimson/osd/main.cc is backported from
  https://github.com/ceph/ceph/commit/58cb9bac

Gbp-Pq: Name Fix-build-with-fmt-8-9.patch

Only yield under ARMv7 and above (#1176)

Origin: upstream, https://github.com/facebook/folly/commit/62d8e6e0b91ebd6f878f3066cd9b6e5f3c18a97b.patch
Last-Update: 2021-11-24

Gbp-Pq: Name only-yied-under-armv7-and-above.patch

cmake: test for 16-byte atomic support on mips also

Origin: upstream, https://github.com/ceph/ceph/commit/709a77f22010f03aee4a4c0ab930588944cb4a58
Last-Update: 2021-11-24

it's reported that a mips64el build host is able to pass the test of
CheckCxxAtomic without linking against libatomic, while librbd.so
fails to link due to failures like

/usr/bin/ld: ../../../lib/librbd.so.1.16.0: undefined reference to `__atomic_store_16'
/usr/bin/ld: ../../../lib/librbd.so.1.16.0: undefined reference to `__atomic_load_16'
/usr/bin/ld: ../../../lib/librbd.so.1.16.0: undefined reference to `__atomic_compare_exchange_16'

so we have to check the existence of __atomic_load_16 instruction on
mips architecture.

Gbp-Pq: Name cmake-test-for-16-bytes-atomic-support-on-mips-also.patch

[PATCH] src/isa-l/erasure_code: Fix text relocation on aarch64

Here is the bug report on ceph. https://tracker.ceph.com/issues/48681

Signed-off-by: luo rixin <luorixin@huawei.com>
Gbp-Pq: Name bug1917414.patch

[PATCH] rgw/radosgw-admin clarify error when email address already in use

The error message if you try and create an S3 user with an email
address that is already associated with another S3 account is very
confusing; this patch makes it much clearer

To reproduce:

radosgw-admin user create --uid=foo --display-name="Foo test" --email=bar@domain.invalid
radosgw-admin user create --uid=test --display-name="AN test" --email=bar@domain.invalid
could not create user: unable to parse parameters, user id mismatch, operation id: foo does not match: test

With this patch:

radosgw-admin user create --uid=test --display-name="AN test" --email=bar@domain.invalid
could not create user: unable to create user test because user id foo already exists with email bar@domain.invalid

Fixes: https://tracker.ceph.com/issues/49137
Fixes: https://tracker.ceph.com/issues/19411
Signed-off-by: Matthew Vernon <mv3@sanger.ac.uk>
(cherry picked from commit 05318d6f71e45a42a46518a0ef17047dfab83990)

Gbp-Pq: Name bug1914584.patch

[PATCH] arch,cmake: compile ppc.c on all powerpc machines

* cmake/modules/SIMDExt.cmake: define HAVE_PPC for 32-bit PowerPC.
* src/arch/CMakeLists.txt: compile ppc.c for all PowerPC architectures,
including powerpc (32-bit PowerPC), ppc64el (64-bit Little Endian
PowerPC) and ppc64 (64-bit Big Endian PowerPC).

before this change, ppc.c is only compiled if HAVE_POWER8 is defined.
but Power8 is a 64-bit PowerPC architecture. while in src/arch/probe.cc,
we check for `defined(__powerpc__) || defined(__ppc__)`, if this is
true, ceph_arch_ppc_probe() is used to check for the support of
Altivec. but on non-power8 PowerPC machines, the linker fails to find the
symbols like ceph_arch_ppc_probe(), as ppc.c is not compiled on them.

in this change, ppc.c is compiled on all PowerPC architectures, so that
ceph_arch_ppc_probe() is also available on non-power8 machines. this
change does not impact the behavior of non-power8 machines. because
on them, the runtime check would fail to detect the existence of
PPC_FEATURE2_VEC_CRYPTO instructions.

Reported-by: Mattias Ellert <mattias.ellert@physics.uu.se>
Signed-off-by: Kefu Chai <tchaikov@gmail.com>
Gbp-Pq: Name compile-ppc.c-on-all-powerpc-machines.patch

Fix systemd ceph-osd.target

Forwarded: no
Last-Update: 2021-01-28

This helps when rebooting.

Gbp-Pq: Name fix-ceph-osd-systemd-target.patch

Link with -pthread instead of -lpthread to fix FTBFS on riscv64

Forwarded: no
Last-Update: 2020-03-01

Gbp-Pq: Name riscv64-link-pthread.patch

add-option-to-disable-ceph-dencoder

===================================================================

Gbp-Pq: Name add-option-to-disable-ceph-dencoder.patch

Misc fixes for 32 bit architecture builds.

Forwarded: no

Gbp-Pq: Name 32bit-fixes.patch

fix-bash-completion-location

Gbp-Pq: Name fix-bash-completion-location

debian-armel-armhf-buildflags

Gbp-Pq: Name debian-armel-armhf-buildflags.patch

Adds max_connections to test display.

Origin: upstream, https://github.com/civetweb/civetweb/pull/776/commits/3b8eb36676f70d06f8918ccf62029207c49cdda0
Bug: https://github.com/civetweb/civetweb/issues/775
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1838109

Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1838109
Gbp-Pq: Name civetweb-755-1.8-somaxconn-configurable_test.patch

Makes SOMAXCONN user-configurable.

Origin: upstream, https://github.com/civetweb/civetweb/pull/776/commits/febab7dc38c9671577603425c54c20f841e27f97
Bug: https://github.com/civetweb/civetweb/issues/775
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1838109

Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1838109
Gbp-Pq: Name civetweb-755-1.8-somaxconn-configurable.patch

Adds max_connections to reference configuration.

Origin: upstream, https://github.com/civetweb/civetweb/pull/776/commits/3b8eb36676f70d06f8918ccf62029207c49cdda0
Bug: https://github.com/civetweb/civetweb/issues/775
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1838109

Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1838109
Gbp-Pq: Name civetweb-755-1.8-somaxconn-configurable_conf.patch

disable-crypto

===================================================================

Gbp-Pq: Name disable-crypto.patch

use --release 7 instead of -source/-target

Bug-Ubuntu: https://launchpad.net/bugs/1756854
Bug-Ubuntu: https://launchpad.net/bugs/1766998
Forwarded: no
Last-Update: 2018-04-24

Instead of -source/-target ceph should be build with --release for OpenJDK 9
or later so that the bootclasspath is also set, as per JEP-247, otherwise it
risks incurring into binary incompatibility when run with an earlier OpenJDK.
OpenJDK 11 minimum compatibility release has been updated to 7.
Last-Update: 2018-04-24
Gbp-Pq: Name update-java-source-target-flags.patch

This defines HAVE_REENTRANT_STRSIGNAL as sys_siglist no longer

Forwarded: no
Last-Update: 2020-09-21

exists with glibc 2.32 and all programs should use strsignal instead.

Gbp-Pq: Name enable-strsignal.patch

ceph (16.2.11+ds-1) unstable; urgency=medium

  * New upstream release.
  * Removed patches applied upstream:
    - CVE-2022-3854_2_rgw_Fix_rgw_sal_Bucket_empty_static_method_signatures.patch
    - fix-FTBFS-include-memory.h.patch
    - mgr-Define-PY_SSIZE_T_CLEAN-ahead-of-every-Python.h.patch
  * Refreshed patches:
    - 32bit-fixes.patch
    - CVE-2022-3854_1_rgw_Guard_against_malformed_bucket_URLs.patch
    - enable-strsignal.patch
  * Fix cephfs-shell.install.

[dgit import unpatched ceph 16.2.11+ds-1]

Import ceph_16.2.11+ds.orig.tar.xz

[dgit import orig ceph_16.2.11+ds.orig.tar.xz]

Import ceph_16.2.11+ds-1.debian.tar.xz

[dgit import tarball ceph 16.2.11+ds-1 ceph_16.2.11+ds-1.debian.tar.xz]

Merge ceph (16.2.10+ds-5) import into refs/heads/workingbranch

CVE-2022-3854: rgw: Fix `rgw::sal::Bucket::empty` static method signatures

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
Fixes: https://tracker.ceph.com/issues/56586
Origin: upstream, https://github.com/ceph/ceph/pull/47194/commits/9746e8011ff1de6de7dba9c0041e28a16c8f6828.patch
Bug-Debian: https://bugs.debian.org/1027151
Last-Update: 2022-01-09

`unique_ptr` overload should take by reference.

Both should be const.

Gbp-Pq: Name CVE-2022-3854_2_rgw_Fix_rgw_sal_Bucket_empty_static_method_signatures.patch

CVE-2022-3854: rgw: Guard against malformed bucket URLs

Fixes: https://tracker.ceph.com/issues/55765
Fixes: https://tracker.ceph.com/issues/56586
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
Origin: upstream, https://github.com/ceph/ceph/pull/47194/commits/9746e8011ff1de6de7dba9c0041e28a16c8f6828.patch
Bug-Debian: https://bugs.debian.org/1027151
Last-Update: 2022-01-09

Misplaced colons can result in radosgw thinking is has a bucket URL
but with no bucket name, leading to a crash later on.

Gbp-Pq: Name CVE-2022-3854_1_rgw_Guard_against_malformed_bucket_URLs.patch

CVE-2022-3650: ceph-crash: fix stderr handling

Bug: a77b47eeeb5770eeefcf4619ab2105ee7a6a003e
Signed-off-by: Tim Serong <tserong@suse.com>
Bug-Debian: https://bugs.debian.org/1024932
Origin: upstream, https://github.com/ceph/ceph/commit/45915540559126a652f8d9d105723584cfc63439
Last-Update: 2022-11-28

Popen.communicate() returns a tuple (stdout, stderr), and stderr
will be of type bytes, hence the need to decode it before checking
if it's an empty string or not.

Gbp-Pq: Name CVE-2022-3650_2_ceph-crash_fix_stderr_handling.patch

CVE-2022-3650: ceph-crash: drop privleges to run as "ceph" user, rather than root

Bug: https://tracker.ceph.com/issues/57967
Signed-off-by: Tim Serong <tserong@suse.com>
Origin: upstream, https://github.com/ceph/ceph/commit/130c9626598bc3a75942161e6cce7c664c447382
Bug-Debian: https://bugs.debian.org/1024932
Last-Update: 2022-11-28

If privileges cannot be dropped, log an error and exit. This commit
also catches and logs exceptions when scraping the crash path, without
which ceph-crash would just exit if it encountered an error.

Gbp-Pq: Name CVE-2022-3650_1_ceph-crash_drop_privleges_to_run_as_ceph_user_rather_than_root.patch

Fix CheckCxxAtomic to detect more accurately

Last-Update: 2022-08-30

Some platforms like riscv64 does not have full support for atomic primitives,
yet passes the test. Adding operator++ fixes this issue.

Gbp-Pq: Name fix-CheckCxxAtomic-riscv64.patch

mgr: Define PY_SSIZE_T_CLEAN ahead of every Python.h

Origin: upstream, https://github.com/ceph/ceph/commit/389054888f2aa782f73564125ec7a1ef0212d536.patch
Last-Update: 2022-09-22

Gbp-Pq: Name mgr-Define-PY_SSIZE_T_CLEAN-ahead-of-every-Python.h.patch

include/buffer: include <memory>

Signed-off-by: Kefu Chai <tchaikov@gmail.com>
Origin: upstream, https://github.com/ceph/ceph/commit/7c381ba985bd1398ef7d145cc00fae9d0db510e3
Last-Update: 2022-07-27

to address following FTBFS (under GCC 12):

/usr/bin/ccache /usr/bin/clang++-13 -DBOOST_ALL_NO_LIB -DBOOST_ASIO_DISABLE_CONCEPTS -DBOOST_ASIO_DISABLE_THREAD_KEYWORD_EXTENSION -DBOOST_ASIO_USE_TS_EXECUTOR_AS_DEFAULT -DBOOST_PROGRAM_OPTIONS_DYN_LINK -DBOOST_T$
In file included from /var/ssd/ceph/src/crimson/os/seastore/seastore_types.cc:4:
In file included from /var/ssd/ceph/src/crimson/os/seastore/seastore_types.h:14:
In file included from /var/ssd/ceph/src/include/denc.h:47:
/var/ssd/ceph/src/include/buffer.h:98:37: error: no template named 'unique_ptr' in namespace 'std'; did you mean 'boost::movelib::unique_ptr'?
struct unique_leakable_ptr : public std::unique_ptr<T, ceph::nop_delete<T>> {
                                    ^~~~~~~~~~~~~~~
                                    boost::movelib::unique_ptr
/opt/ceph/include/boost/move/unique_ptr.hpp:354:7: note: 'boost::movelib::unique_ptr' declared here
class unique_ptr
      ^

Gbp-Pq: Name fix-FTBFS-include-memory.h.patch