Upgrade urgency: SECURITY, contains fixes to security issues.
Security Fixes:
(CVE-2021-41099) Integer to heap buffer overflow handling certain string
commands and network payloads, when proto-max-bulk-len is manually configured
to a non-default, very large value [reported by yiyuaner].
(CVE-2021-32762) Integer to heap buffer overflow issue in redis-cli and
redis-sentinel parsing large multi-bulk replies on some older and less common
platforms [reported by Microsoft Vulnerability Research].
(CVE-2021-32687) Integer to heap buffer overflow with intsets, when
set-max-intset-entries is manually configured to a non-default, very large
value [reported by Pawel Wieczorkiewicz, AWS].
(CVE-2021-32675) Denial Of Service when processing RESP request payloads with
a large number of elements on many connections.
(CVE-2021-32672) Random heap reading issue with Lua Debugger [reported by
Meir Shpilraien].
(CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded
data types, when configuring a large, non-default value for
hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries
or zset-max-ziplist-value [reported by sundb].
(CVE-2021-32627) Integer to heap buffer overflow issue with streams, when
configuring a non-default, large value for proto-max-bulk-len and
client-query-buffer-limit [reported by sundb].
(CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer
overflow [reported by Meir Shpilraien].
Bug fixes that involve behavior changes:
GEO* STORE with empty source key deletes the destination key and return 0 (#9271)
Previously it would have returned an empty array like the non-STORE variant.
PUBSUB NUMPAT replies with number of patterns rather than number of subscriptions (#9209)
This actually changed in 6.2.0 but was overlooked and omitted from the release notes.
Bug fixes that are only applicable to previous releases of Redis 6.2:
Fix CLIENT PAUSE, used an old timeout from previous PAUSE (#9477)
Fix CLIENT PAUSE in a replica would mess the replication offset (#9448)
Add some missing error statistics in INFO errorstats (#9328)
Other bug fixes:
Fix incorrect reply of COMMAND command key positions for MIGRATE command (#9455)
Fix appendfsync to always guarantee fsync before reply, on MacOS and FreeBSD (kqueue) (#9416)
Fix the wrong mis-detection of sync_file_range system call, affecting performance (#9371)
CLI tools:
When redis-cli received ASK response, it didn't handle it (#8930)
Improvements:
Add latency monitor sample when key is deleted via lazy expire (#9317)
Sanitize corrupt payload improvements (#9321, #9399)
Delete empty keys when loading RDB file or handling a RESTORE command (#9297, #9349)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This is the result of automated script (0.9.1) conversion:
oe-core/scripts/contrib/convert-overrides.py .
converting the metadata to use ":" as the override character instead of "_".
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Upstream changelog:
Upgrade urgency: SECURITY, Contains fixes to security issues that affect
authenticated client connections. MODERATE otherwise.
Fix integer overflow in STRALGO LCS (CVE-2021-32625)
An integer overflow bug in Redis version 6.0 or newer can be exploited using the
STRALGO LCS command to corrupt the heap and potentially result with remote code
execution. This is a result of an incomplete fix by CVE-2021-29477.
Bug fixes that are only applicable to previous releases of Redis 6.2:
Fix crash after a diskless replication fork child is terminated (#8991)
Fix redis-benchmark crash on unsupported configs (#8916)
Other bug fixes:
Fix crash in UNLINK on a stream key with deleted consumer groups (#8932)
SINTERSTORE: Add missing keyspace del event when none of the sources exist (#8949)
Sentinel: Fix CONFIG SET of empty string sentinel-user/sentinel-pass configs (#8958)
Enforce client output buffer soft limit when no traffic (#8833)
Improvements:
Hide AUTH passwords in MIGRATE command from slowlog (#8859)
Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
clang defines __ILP32__ for rv32 but gcc does not as a result
backtracing gets enabled when using clang but not when using gcc so
clang build exposes a porting error. Therefore add code to return
correct mcontext on rv32
Signed-off-by: Khem Raj <raj.khem@gmail.com>
-Refresh the following patch:
0001-src-Do-not-reset-FINAL_LIBS.patch
-0005-Mark-extern-definition-of-SDS_NOINIT-in-sds.h.patch
Removed since this is included in 5.0.8
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Remove an upstreamed patch
Add patches to build with new glibc/gcc
Drop atomic removal patch and link with libatomic when needed
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Need to link with libatomics for 64bit atomics support
Fixes
i686-yoe-linux/i686-yoe-linux-ld: networking.o: in function `createClient':
| /usr/src/debug/redis/4.0.14-r0/redis-4.0.14/src/networking.c:103: undefined reference to `__atomic_fetch_add_8'
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Sometimes with high parallel build we see compile errors e.g.
clang-8: error: linker command failed with exit code 1 (use -v to see invocation)
make[3]: *** [Makefile:52: lua] Error 1
Therefore try to build dependencies before main build
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Apply the same patch used for mips.
Fix
|ld: networking.o: in function `createClient':
| /usr/src/debug/redis/4.0.8-r0/redis-4.0.8/src/networking.c:93:
undefined reference to `__atomic_fetch_add_8'
Signed-off-by: Andrea Adami <andrea.adami@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Update redis to the latest 4.0.8 release. This also involves updating
the redis.conf while maintaining some OE specific config options.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Now that the processes no longer runs as root, we need to increase
the limit for it.
This only affects systemd based systems.
Signed-off-by: Frank Meerkoetter <frank@meerkoetter.org>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Running a network facing daemon written in C as root is not
a good idea. Introduce a redis system user/group for that.
A drawback is that now redis can no longer increase the
number of open fds to 10000 (MaxClients). If this is needed
the ulimit needs to be tweaked in the init script or systemd
unit file.
This only affects systemd based systems.
Signed-off-by: Frank Meerkoetter <frank@meerkoetter.org>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Creating /var/log/redis.log requires root permissions to
create the file. Use syslog instead so redis does not
require root.
This affects both sysv and systemd based systems.
Signed-off-by: Frank Meerkoetter <frank@meerkoetter.org>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Binding it to localhost is a safe default.
This affects both sysv and systemd based systems.
Signed-off-by: Frank Meerkoetter <frank@meerkoetter.org>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
The redis.conf is changed on the fly to not daemonize redis.
The reason for that is that with this appraoch we don't need
special permissions to write to /var/run/.
Signed-off-by: Frank Meerkoetter <frank@meerkoetter.org>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
This patch resets the default OPT flags to -O2 and adds the missing
ranlib command to index the static library.
Signed-off-by: Stephen Arnold <sarnold@vctlabs.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* remove trailing whitespaces
* run through oe-stylize
Signed-off-by: Andrea Galbusera <gizero@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
use 0644 instead of 0755 to install configuration file
Signed-off-by: Andrea Galbusera <gizero@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
This includes CVE-2015-4335.
LICENSE checksum changed do to copyright update.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* This change is only aesthetic (unlike indentation in Python
tasks).
* Some recipes were using tabs.
* Some were using 8 spaces.
* Some were using mix or different number of spaces.
* Make them consistently use 4 spaces everywhere.
* Yocto styleguide advises to use tabs (but the only reason to keep
tabs is the need to update a lot of recipes). Lately this advice
was also merged into the styleguide on the OE wiki.
* Using 4 spaces in both types of tasks is better because it's less
error prone when someone is not sure if e.g.
do_generate_toolchain_file() is Python or shell task and also allows
to highlight every tab used in .bb, .inc, .bbappend, .bbclass as
potentially bad (shouldn't be used for indenting of multiline
variable assignments and cannot be used for Python tasks).
* Don't indent closing quote on multiline variables
we're quite inconsistent wheater it's first character on line
under opening quote or under first non-whitespace character in
previous line.
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Acked-by: Koen Kooi <koen@dominion.thruhere.net>
A recipe for Redis 2.6.9, an advanced key-value store.
Needed some patching of Makefiles and deps to get it to work with OE.
OE Specific configuration: This is built to override MALLOC and use
libc's malloc instead of the provided jemalloc or tcmalloc that
weren't building correctly.
Also the default savepoint setting was updated in the default
redis.conf to tune for a small embedded system.
Known Bug: redis-cli eats all the input on a serial port - watch out
when using the serial console with redis-cli.
see https://github.com/antirez/linenoise/issues/38
Tested with Yocto "Danny" / armv7a.
Signed-off-by: Kevin Baker <kevinb@ventureresearch.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
