Merge branch 'master' of ssh://git.ipfire.org/pub/git/ipfire-2.x

[people/mfischer/ipfire-2.x.git] / src / patches / glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch

diff --git a/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch b/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch
deleted file mode 100644 (file)
index d2083e6..0000000
--- a/src/patches/glibc-2.33-librt-fix-null-pointer-dereference-bug-28213.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 27a78fd712c06748737dfa9638fab96ea362fca9 Mon Sep 17 00:00:00 2001
-From: Nikita Popov <npv1310@gmail.com>
-Date: Mon, 9 Aug 2021 20:17:34 +0530
-Subject: [PATCH] librt: fix NULL pointer dereference (bug 28213)
-
-Helper thread frees copied attribute on NOTIFY_REMOVED message
-received from the OS kernel.  Unfortunately, it fails to check whether
-copied attribute actually exists (data.attr != NULL).  This worked
-earlier because free() checks passed pointer before actually
-attempting to release corresponding memory.  But
-__pthread_attr_destroy assumes pointer is not NULL.
-
-So passing NULL pointer to __pthread_attr_destroy will result in
-segmentation fault.  This scenario is possible if
-notification->sigev_notify_attributes == NULL (which means default
-thread attributes should be used).
-
-Signed-off-by: Nikita Popov <npv1310@gmail.com>
-Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
-(cherry picked from commit b805aebd42364fe696e417808a700fdb9800c9e8)
----
- sysdeps/unix/sysv/linux/mq_notify.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/sysdeps/unix/sysv/linux/mq_notify.c b/sysdeps/unix/sysv/linux/mq_notify.c
-index 6f46d29d1d..1714e1cc5f 100644
---- a/sysdeps/unix/sysv/linux/mq_notify.c
-+++ b/sysdeps/unix/sysv/linux/mq_notify.c
-@@ -132,7 +132,7 @@ helper_thread (void *arg)
-              to wait until it is done with it.  */
-           (void) __pthread_barrier_wait (&notify_barrier);
-       }
--      else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED)
-+      else if (data.raw[NOTIFY_COOKIE_LEN - 1] == NOTIFY_REMOVED && data.attr != NULL)
-       {
-         /* The only state we keep is the copy of the thread attributes.  */
-         pthread_attr_destroy (data.attr);
--- 
-2.20.1
-