| Summary: | glibc recipe accidentally disables stack protector (instead of using --enable-stack-protector=strong) | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] OE-Core | Reporter: | Ivan Nestlerode <ivan.nestlerode> |
| Component: | core | Assignee: | Sundeep Kokkonda <sundeep.kokkonda> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | Medium+ | CC: | mathieu.dubois-briand, meta.mr.watcher, meta.watcher, paul, randy.macleod, sundeep.kokkonda |
| Version: | 5.0.17 | ||
| Target Milestone: | 6.1 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | Don't know | |
| Attachments: | |||
Created attachment 5211 [details]
patch to fix scarthgap branch of poky repository
Created attachment 5212 [details]
configure and compile log file evidence
Hi Ivan, Thanks for reporting this nasty bug and attaching the patches. Are you interested in and able to submit the patches to the oe-core email list: openembedded-core@lists.openembedded.org https://docs.yoctoproject.org/contributor-guide/index.html If not, Sundeep please have someone consider the patch and if you agree that the patches are good, send them to the list. Thanks, ../Randy "a happy owner of many Sonos speakers. :-) " MacLeod Created attachment 5213 [details]
"git send-email" style patch for openembedded-core master
I unfortunately do not have a working "git send-email" setup. I have added one more attachment in that formatting style though (it is what I would have sent this way).
Hi Ivan, you should be able to submit a patch using `b4 send` (https://b4.docs.kernel.org/en/latest/contributor/send.html) without needing an SMTP server setup for git-send-email. The kernel.org endpoint (https://lkml.kernel.org/_b4_submit) should be usable as our mailing lists are available on lore.kernel.org. I will try to get this sent out using b4 send, but it may not happen until early next week. I just used b4 and sent this patch to openembedded-core@lists.openembedded.org. Hopefully I did it correctly. |
Created attachment 5210 [details] patch to fix openembedded-core master branch There is a bug in the glibc recipe in the poky repository and in the openembedded-core repository (in multiple branches). The bug is that the recipe purports to configure glibc with --enable-stack-protector=strong, but in fact stack protector is completely disabled due to these 3 CACHED_CONFIGVARS values that are set in glibc.inc: - libc_cv_ssp_strong=no - libc_cv_ssp_all=no - libc_cv_ssp=no The fix is to stop passing these 3 in CACHED_CONFIGVARS. The evidence described below was gathered on the scarthgap branch of poky, but I believe that this bug is also present in other branches (since they also contain these 3 tokens in CACHED_CONFIGUREVARS in glibc.inc): - the kirkstone branch of poky - the master branch of openembedded-core - probably all branches between kirkstone and openembedded-core master Evidence is shown here in log.do_configure and in the extracted compilation log of strlcpy.c (extracted from log.do_compile and normalized) in a file called one_cc. before/ has the logs from the existing buggy recipe. after/ has the logs from the patched recipe. The relevant diffs: --- before/log.do_configure 2026-04-18 13:44:55.415875935 -0400 +++ after/log.do_configure 2026-04-18 13:47:33.794420623 -0400 @@ -62,9 +62,9 @@ *** some features or tests will be disabled. *** Check the INSTALL file for required versions. checking for use of fpu sysdeps directories... yes -checking for -fstack-protector... (cached) no -checking for -fstack-protector-strong... (cached) no -checking for -fstack-protector-all... (cached) no +checking for -fstack-protector... yes +checking for -fstack-protector-strong... yes +checking for -fstack-protector-all... yes checking for assembler and linker STT_GNU_IFUNC support... yes checking for gcc attribute ifunc support... yes checking whether the linker supports textrels along with ifunc... yes --- before/one_cc 2026-04-18 13:50:46.423816366 -0400 +++ after/one_cc 2026-04-18 13:51:27.049793631 -0400 @@ -27,7 +27,7 @@ -Wundef -fmerge-all-constants -frounding-math --fno-stack-protector +-fstack-protector-strong -fno-common -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=2 -Wstrict-prototypes Two versions of the patch to fix this are included here in scarthgap.patch and master.patch respectively (removal of the 3 ssp tokens from CACHED_CONFIGVARS in glibc.inc).