Pick patch from [1] & [2] also mentioned at Debian report in [3] & [4]
[1] https://github.com/golang/go/commit/7d2dd3488cdfbddda14c18c455d3263df75a46fc [2] https://github.com/golang/go/commit/72cc33629a3b26e68f6e6e5564618a1d763896f3 [3] https://security-tracker.debian.org/tracker/CVE-2026-27143 [4] https://security-tracker.debian.org/tracker/CVE-2026-27144 Signed-off-by: Hitendra Prajapati <[email protected]> --- meta/recipes-devtools/go/go-1.22.12.inc | 2 + .../go/go/CVE-2026-27143.patch | 165 ++++++++++++++++++ .../go/go/CVE-2026-27144.patch | 125 +++++++++++++ 3 files changed, 292 insertions(+) create mode 100644 meta/recipes-devtools/go/go/CVE-2026-27143.patch create mode 100644 meta/recipes-devtools/go/go/CVE-2026-27144.patch diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc index 7ece9095ff..03437f0358 100644 --- a/meta/recipes-devtools/go/go-1.22.12.inc +++ b/meta/recipes-devtools/go/go-1.22.12.inc @@ -42,6 +42,8 @@ SRC_URI += "\ file://CVE-2025-68121_p2.patch \ file://CVE-2025-68121_p3.patch \ file://CVE-2026-27140.patch \ + file://CVE-2026-27143.patch \ + file://CVE-2026-27144.patch \ " SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71" diff --git a/meta/recipes-devtools/go/go/CVE-2026-27143.patch b/meta/recipes-devtools/go/go/CVE-2026-27143.patch new file mode 100644 index 0000000000..99e7f7639e --- /dev/null +++ b/meta/recipes-devtools/go/go/CVE-2026-27143.patch @@ -0,0 +1,165 @@ +From 7d2dd3488cdfbddda14c18c455d3263df75a46fc Mon Sep 17 00:00:00 2001 +From: Junyang Shao <[email protected]> +Date: Fri, 6 Mar 2026 00:03:45 +0000 +Subject: [PATCH] [release-branch.go1.25] cmd/compile: fix loopbce overflow + check logic + +addWillOverflow and subWillOverflow has an implicit assumption that y is +positive, using it outside of addU and subU is really incorrect. This CL +fixes those incorrect usage to use the correct logic in place. + +Thanks to Jakub Ciolek for reporting this issue. + +Fixes #78333 +Fixes CVE-2026-27143 + +Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3700 +Reviewed-by: Damien Neil <[email protected]> +Reviewed-by: Neal Patel <[email protected]> +Change-Id: I263e8e7ac227e2a68109eb7bbd45f66569ed22ec +Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3987 +Commit-Queue: Damien Neil <[email protected]> +Reviewed-on: https://go-review.googlesource.com/c/go/+/763553 +Reviewed-by: David Chase <[email protected]> +Auto-Submit: Gopher Robot <[email protected]> +TryBot-Bypass: Gopher Robot <[email protected]> +Reviewed-by: Junyang Shao <[email protected]> + +CVE: CVE-2026-27143 +Upstream-Status: Backport [https://github.com/golang/go/commit/7d2dd3488cdfbddda14c18c455d3263df75a46fc] +Signed-off-by: Hitendra Prajapati <[email protected]> +--- + src/cmd/compile/internal/ssa/loopbce.go | 36 +++++++++++++++++-------- + test/loopbce.go | 28 +++++++++++++++++++ + 2 files changed, 53 insertions(+), 11 deletions(-) + +diff --git a/src/cmd/compile/internal/ssa/loopbce.go b/src/cmd/compile/internal/ssa/loopbce.go +index dd1f39d..1b3e567 100644 +--- a/src/cmd/compile/internal/ssa/loopbce.go ++++ b/src/cmd/compile/internal/ssa/loopbce.go +@@ -204,9 +204,11 @@ func findIndVar(f *Func) []indVar { + if init.AuxInt > v { + return false + } ++ // TODO(1.27): investigate passing a smaller-magnitude overflow limit to addU ++ // for addWillOverflow. + v = addU(init.AuxInt, diff(v, init.AuxInt)/uint64(step)*uint64(step)) + } +- if addWillOverflow(v, step) { ++ if addWillOverflow(v, step, maxSignedValue(ind.Type)) { + return false + } + if inclusive && v != limit.AuxInt || !inclusive && v+1 != limit.AuxInt { +@@ -235,7 +237,7 @@ func findIndVar(f *Func) []indVar { + // ind < knn - k cannot overflow if step is at most k+1 + return step <= k+1 && k != maxSignedValue(limit.Type) + } else { // step < 0 +- if limit.Op == OpConst64 { ++ if limit.isGenericIntConst() { + // Figure out the actual smallest value. + v := limit.AuxInt + if !inclusive { +@@ -249,9 +251,11 @@ func findIndVar(f *Func) []indVar { + if init.AuxInt < v { + return false + } ++ // TODO(1.27): investigate passing a smaller-magnitude underflow limit to subU ++ // for subWillUnderflow. + v = subU(init.AuxInt, diff(init.AuxInt, v)/uint64(-step)*uint64(-step)) + } +- if subWillUnderflow(v, -step) { ++ if subWillUnderflow(v, -step, minSignedValue(ind.Type)) { + return false + } + if inclusive && v != limit.AuxInt || !inclusive && v-1 != limit.AuxInt { +@@ -313,14 +317,22 @@ func findIndVar(f *Func) []indVar { + return iv + } + +-// addWillOverflow reports whether x+y would result in a value more than maxint. +-func addWillOverflow(x, y int64) bool { +- return x+y < x ++// subWillUnderflow checks if x - y underflows the min value. ++// y must be positive. ++func subWillUnderflow(x, y int64, min int64) bool { ++ if y < 0 { ++ base.Fatalf("expecting positive value") ++ } ++ return x < min+y + } + +-// subWillUnderflow reports whether x-y would result in a value less than minint. +-func subWillUnderflow(x, y int64) bool { +- return x-y > x ++// addWillOverflow checks if x + y overflows the max value. ++// y must be positive. ++func addWillOverflow(x, y int64, max int64) bool { ++ if y < 0 { ++ base.Fatalf("expecting positive value") ++ } ++ return x > max-y + } + + // diff returns x-y as a uint64. Requires x>=y. +@@ -341,7 +353,8 @@ func addU(x int64, y uint64) int64 { + x += 1 + y -= 1 << 63 + } +- if addWillOverflow(x, int64(y)) { ++ // TODO(1.27): investigate passing a smaller-magnitude overflow limit in here. ++ if addWillOverflow(x, int64(y), maxSignedValue(types.Types[types.TINT64])) { + base.Fatalf("addU overflowed %d + %d", x, y) + } + return x + int64(y) +@@ -357,7 +370,8 @@ func subU(x int64, y uint64) int64 { + x -= 1 + y -= 1 << 63 + } +- if subWillUnderflow(x, int64(y)) { ++ // TODO(1.27): investigate passing a smaller-magnitude underflow limit in here. ++ if subWillUnderflow(x, int64(y), minSignedValue(types.Types[types.TINT64])) { + base.Fatalf("subU underflowed %d - %d", x, y) + } + return x - int64(y) +diff --git a/test/loopbce.go b/test/loopbce.go +index 04c186b..a4b101b 100644 +--- a/test/loopbce.go ++++ b/test/loopbce.go +@@ -466,6 +466,34 @@ func stride2(x *[7]int) int { + return s + } + ++// This loop should not be proved anything. ++func smallIntUp(arr *[128]int) { ++ for i := int8(0); i <= int8(120); i += int8(10) { ++ arr[i] = int(i) ++ } ++} ++ ++// This loop should not be proved anything. ++func smallIntDown(arr *[128]int) { ++ for i := int8(0); i >= int8(-120); i -= int8(10) { ++ arr[127+i] = int(i) ++ } ++} ++ ++// This loop should not be proved anything. ++func smallUintUp(arr *[128]int) { ++ for i := uint8(0); i <= uint8(250); i += uint8(10) { ++ arr[i] = int(i) ++ } ++} ++ ++// This loop should not be proved anything. ++func smallUintDown(arr *[128]int) { ++ for i := uint8(255); i >= uint8(0); i -= uint8(10) { ++ arr[127+i] = int(i) ++ } ++} ++ + //go:noinline + func useString(a string) { + } +-- +2.50.1 + diff --git a/meta/recipes-devtools/go/go/CVE-2026-27144.patch b/meta/recipes-devtools/go/go/CVE-2026-27144.patch new file mode 100644 index 0000000000..3f791ea491 --- /dev/null +++ b/meta/recipes-devtools/go/go/CVE-2026-27144.patch @@ -0,0 +1,125 @@ +From 72cc33629a3b26e68f6e6e5564618a1d763896f3 Mon Sep 17 00:00:00 2001 +From: Junyang Shao <[email protected]> +Date: Thu, 12 Mar 2026 21:36:33 +0000 +Subject: [PATCH] [release-branch.go1.25] cmd/compile: fix mem access overlap + detection + +When a no-op interface conversion is wrapped around the rhs of an +assignment, the memory overlap detection logic in the compiler failed to +peel down conversion to see the actual pointer, causing an incorrect +no-overlapping determination. + +Thanks to Jakub Ciolek for reporting this issue. + + +Fixes #78371 +Fixes CVE-2026-27144 + +Change-Id: I55ff0806b099e1447bdbfba7fde6c6597db5d65c +Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3780 +Reviewed-by: Damien Neil <[email protected]> +Reviewed-by: Neal Patel <[email protected]> +Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/4002 +Reviewed-on: https://go-review.googlesource.com/c/go/+/763552 +Auto-Submit: Gopher Robot <[email protected]> +TryBot-Bypass: Gopher Robot <[email protected]> +Reviewed-by: Junyang Shao <[email protected]> +Reviewed-by: David Chase <[email protected]> + +CVE: CVE-2026-27144 +Upstream-Status: Backport [https://github.com/golang/go/commit/72cc33629a3b26e68f6e6e5564618a1d763896f3] +Signed-off-by: Hitendra Prajapati <[email protected]> +--- + src/cmd/compile/internal/ssagen/ssa.go | 20 ++++++--- + .../compile/internal/test/memoverlap_test.go | 41 +++++++++++++++++++ + 2 files changed, 55 insertions(+), 6 deletions(-) + create mode 100644 src/cmd/compile/internal/test/memoverlap_test.go + +diff --git a/src/cmd/compile/internal/ssagen/ssa.go b/src/cmd/compile/internal/ssagen/ssa.go +index c794d6f..0214621 100644 +--- a/src/cmd/compile/internal/ssagen/ssa.go ++++ b/src/cmd/compile/internal/ssagen/ssa.go +@@ -1427,6 +1427,16 @@ func (s *state) stmtList(l ir.Nodes) { + } + } + ++func peelConvNop(n ir.Node) ir.Node { ++ if n == nil { ++ return n ++ } ++ for n.Op() == ir.OCONVNOP { ++ n = n.(*ir.ConvExpr).X ++ } ++ return n ++} ++ + // stmt converts the statement n to SSA and adds it to s. + func (s *state) stmt(n ir.Node) { + s.pushLine(n.Pos()) +@@ -1598,12 +1608,10 @@ func (s *state) stmt(n ir.Node) { + // arrays referenced are strictly smaller parts of the same base array. + // If one side of the assignment is a full array, then partial overlap + // can't happen. (The arrays are either disjoint or identical.) +- mayOverlap := n.X.Op() == ir.ODEREF && (n.Y != nil && n.Y.Op() == ir.ODEREF) +- if n.Y != nil && n.Y.Op() == ir.ODEREF { +- p := n.Y.(*ir.StarExpr).X +- for p.Op() == ir.OCONVNOP { +- p = p.(*ir.ConvExpr).X +- } ++ ny := peelConvNop(n.Y) ++ mayOverlap := n.X.Op() == ir.ODEREF && (n.Y != nil && ny.Op() == ir.ODEREF) ++ if ny != nil && ny.Op() == ir.ODEREF { ++ p := peelConvNop(ny.(*ir.StarExpr).X) + if p.Op() == ir.OSPTR && p.(*ir.UnaryExpr).X.Type().IsString() { + // Pointer fields of strings point to unmodifiable memory. + // That memory can't overlap with the memory being written. +diff --git a/src/cmd/compile/internal/test/memoverlap_test.go b/src/cmd/compile/internal/test/memoverlap_test.go +new file mode 100644 +index 0000000..c53288e +--- /dev/null ++++ b/src/cmd/compile/internal/test/memoverlap_test.go +@@ -0,0 +1,41 @@ ++// Copyright 2026 The Go Authors. All rights reserved. ++// Use of this source code is governed by a BSD-style ++// license that can be found in the LICENSE file. ++ ++package test ++ ++import "testing" ++ ++const arrFooSize = 96 ++ ++type arrFoo [arrFooSize]int ++ ++//go:noinline ++func badCopy(dst, src []int) { ++ p := (*[arrFooSize]int)(dst[:arrFooSize]) ++ q := (*[arrFooSize]int)(src[:arrFooSize]) ++ *p = arrFoo(*q) ++} ++ ++//go:noinline ++func goodCopy(dst, src []int) { ++ p := (*[arrFooSize]int)(dst[:arrFooSize]) ++ q := (*[arrFooSize]int)(src[:arrFooSize]) ++ *p = *q ++} ++ ++func TestOverlapedMoveWithNoopIConv(t *testing.T) { ++ h1 := make([]int, arrFooSize+1) ++ h2 := make([]int, arrFooSize+1) ++ for i := range arrFooSize + 1 { ++ h1[i] = i ++ h2[i] = i ++ } ++ badCopy(h1[1:], h1[:arrFooSize]) ++ goodCopy(h2[1:], h2[:arrFooSize]) ++ for i := range arrFooSize + 1 { ++ if h1[i] != h2[i] { ++ t.Errorf("h1 and h2 differ at index %d, expect them to be the same", i) ++ } ++ } ++} +-- +2.50.1 + -- 2.50.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#236853): https://lists.openembedded.org/g/openembedded-core/message/236853 Mute This Topic: https://lists.openembedded.org/mt/119271035/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
