diff --git a/chromium-121-el8-support-64kpage.patch b/chromium-121-el8-support-64kpage.patch new file mode 100644 index 00000000..556fc656 --- /dev/null +++ b/chromium-121-el8-support-64kpage.patch @@ -0,0 +1,126 @@ +diff -up chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_bucket.h.el8-support-64kpage.patch chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_bucket.h +--- chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_bucket.h.el8-support-64kpage.patch 2024-01-30 21:24:10.000000000 +0100 ++++ chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_bucket.h 2024-02-01 17:20:37.178877448 +0100 +@@ -146,7 +146,13 @@ struct PartitionBucket { + // Returns a slot number starting from the beginning of the slot span. + PA_ALWAYS_INLINE size_t GetSlotNumber(size_t offset_in_slot_span) const { + // See the static assertion for `kReciprocalShift` above. +- PA_DCHECK(offset_in_slot_span <= kMaxBucketed); ++ // TODO(casey.smalley@arm.com): triggers on Aarch64/Linux ++ // systems with 64k system pages. Constants need to be ++ // adjusted to prevent different parts of the allocator ++ // from overlapping. For now this will allow 64k pages ++ // to function on Aarch64/Linux systems, albeit not ++ // very efficiently. ++ // PA_DCHECK(offset_in_slot_span <= kMaxBucketed); + PA_DCHECK(slot_size <= kMaxBucketed); + + const size_t offset_in_slot = +diff -up chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_page_constants.h.el8-support-64kpage.patch chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_page_constants.h +--- chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_page_constants.h.el8-support-64kpage.patch 2024-02-01 17:20:37.178877448 +0100 ++++ chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_page_constants.h 2024-02-01 17:31:08.500268457 +0100 +@@ -17,10 +17,8 @@ namespace partition_alloc::internal { + // PartitionPageSize() is 4 times the OS page size. + static constexpr size_t kMaxSlotsPerSlotSpan = 4 * (1 << 14) / kSmallestBucket; + #elif BUILDFLAG(IS_LINUX) && defined(ARCH_CPU_ARM64) +-// System page size can be 4, 16, or 64 kiB on Linux on arm64. 64 kiB is +-// currently (kMaxSlotsPerSlotSpanBits == 13) not supported by the code, +-// so we use the 16 kiB maximum (64 kiB will crash). +-static constexpr size_t kMaxSlotsPerSlotSpan = 4 * (1 << 14) / kSmallestBucket; ++// System page size can be 4, 16, or 64 kiB on Linux on AArch64. ++static constexpr size_t kMaxSlotsPerSlotSpan = 4 * (1 << 16) / kSmallestBucket; + #else + // A slot span can "span" multiple PartitionPages, but then its slot size is + // larger, so it doesn't have as many slots. +diff -up chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_page.h.el8-support-64kpage.patch chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_page.h +--- chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_page.h.el8-support-64kpage.patch 2024-01-30 21:24:10.000000000 +0100 ++++ chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_page.h 2024-02-01 17:20:37.178877448 +0100 +@@ -95,26 +95,25 @@ struct SlotSpanMetadata { + + // CHECK()ed in AllocNewSlotSpan(). + // The maximum number of bits needed to cover all currently supported OSes. +- static constexpr size_t kMaxSlotsPerSlotSpanBits = 13; ++ static constexpr size_t kMaxSlotsPerSlotSpanBits = 15; + static_assert(kMaxSlotsPerSlotSpan < (1 << kMaxSlotsPerSlotSpanBits), ""); + +- // |marked_full| isn't equivalent to being full. Slot span is marked as full +- // iff it isn't on the active slot span list (or any other list). +- uint32_t marked_full : 1; + // |num_allocated_slots| is 0 for empty or decommitted slot spans, which can + // be further differentiated by checking existence of the freelist. +- uint32_t num_allocated_slots : kMaxSlotsPerSlotSpanBits; +- uint32_t num_unprovisioned_slots : kMaxSlotsPerSlotSpanBits; ++ uint16_t num_allocated_slots : kMaxSlotsPerSlotSpanBits; ++ uint16_t num_unprovisioned_slots : kMaxSlotsPerSlotSpanBits; ++ ++ // |marked_full| isn't equivalent to being full. Slot span is marked as full ++ // iff it isn't on the active slot span list (or any other list). ++ bool marked_full : 1; + + private: +- const uint32_t can_store_raw_size_ : 1; +- uint32_t freelist_is_sorted_ : 1; +- uint32_t unused1_ : (32 - 1 - 2 * kMaxSlotsPerSlotSpanBits - 1 - 1); ++ const uint8_t can_store_raw_size_ : 1; ++ uint8_t freelist_is_sorted_ : 1; + // If |in_empty_cache_|==1, |empty_cache_index| is undefined and mustn't be + // used. +- uint16_t in_empty_cache_ : 1; +- uint16_t empty_cache_index_ : kEmptyCacheIndexBits; // < kMaxFreeableSpans. +- uint16_t unused2_ : (16 - 1 - kEmptyCacheIndexBits); ++ bool in_empty_cache_ : 1; ++ uint8_t empty_cache_index_ : kEmptyCacheIndexBits; // < kMaxFreeableSpans. + // Can use only 48 bits (6B) in this bitfield, as this structure is embedded + // in PartitionPage which has 2B worth of fields and must fit in 32B. + +@@ -279,18 +278,13 @@ static_assert(sizeof(SlotSpanMetadata) < + "SlotSpanMetadata must fit into a Page Metadata slot."); + + inline constexpr SlotSpanMetadata::SlotSpanMetadata() noexcept +- : marked_full(0), +- num_allocated_slots(0), ++ : num_allocated_slots(0), + num_unprovisioned_slots(0), ++ marked_full(0), + can_store_raw_size_(false), + freelist_is_sorted_(true), +- unused1_(0), + in_empty_cache_(0), +- empty_cache_index_(0), +- unused2_(0) { +- (void)unused1_; +- (void)unused2_; +-} ++ empty_cache_index_(0) {} + + inline SlotSpanMetadata::SlotSpanMetadata(const SlotSpanMetadata&) = default; + +@@ -883,7 +877,7 @@ PA_ALWAYS_INLINE void SlotSpanMetadata:: + + size_t num_slots_per_span = bucket->get_slots_per_span(); + PA_DCHECK(num_slots_per_span <= kMaxSlotsPerSlotSpan); +- num_unprovisioned_slots = static_cast(num_slots_per_span); ++ num_unprovisioned_slots = static_cast(num_slots_per_span); + PA_DCHECK(num_unprovisioned_slots); + + ToSuperPageExtent()->IncrementNumberOfNonemptySlotSpans(); +diff -up chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_root.cc.el8-support-64kpage.patch chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_root.cc +--- chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_root.cc.el8-support-64kpage.patch 2024-01-30 21:24:10.000000000 +0100 ++++ chromium-121.0.6167.139/base/allocator/partition_allocator/src/partition_alloc/partition_root.cc 2024-02-01 17:20:37.178877448 +0100 +@@ -950,12 +950,11 @@ void PartitionRoot::Init(PartitionOption + (internal::SystemPageSize() == (size_t{1} << 14))); + #elif BUILDFLAG(IS_LINUX) && defined(ARCH_CPU_ARM64) + // Check runtime pagesize. Though the code is currently the same, it is +- // not merged with the IS_APPLE case above as a 1 << 16 case needs to be +- // added here in the future, to allow 64 kiB pagesize. That is only +- // supported on Linux on arm64, not on IS_APPLE, but not yet present here +- // as the rest of the partition allocator does not currently support it. ++ // not merged with the IS_APPLE case above as a 1 << 16 case is only ++ // supported on Linux on AArch64. + PA_CHECK((internal::SystemPageSize() == (size_t{1} << 12)) || +- (internal::SystemPageSize() == (size_t{1} << 14))); ++ (internal::SystemPageSize() == (size_t{1} << 14)) || ++ (internal::SystemPageSize() == (size_t{1} << 16))); + #endif + + ::partition_alloc::internal::ScopedGuard guard{lock_}; diff --git a/chromium.spec b/chromium.spec index 8416e7f7..a8c52e32 100644 --- a/chromium.spec +++ b/chromium.spec @@ -286,7 +286,7 @@ Name: chromium%{chromium_channel} Version: 121.0.6167.139 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A WebKit (Blink) powered web browser that Google doesn't want you to use Url: http://www.chromium.org/Home License: BSD-3-Clause AND LGPL-2.1-or-later AND Apache-2.0 AND IJG AND MIT AND GPL-2.0-or-later AND ISC AND OpenSSL AND (MPL-1.1 OR GPL-2.0-only OR LGPL-2.0-only) @@ -463,6 +463,7 @@ Patch358: chromium-121-rust-clang_lib.patch Patch359: chromium-121-python3-invalid-escape-sequence.patch # upstream patches +Patch400: chromium-121-el8-support-64kpage.patch # Use chromium-latest.py to generate clean tarball from released build tarballs, found here: # http://build.chromium.org/buildbot/official/ @@ -1082,6 +1083,12 @@ udev. %patch -P358 -p1 -b .rust-clang_lib %patch -P359 -p1 -b .python3-invalid-escape-sequence +%%ifarch aarch64 +%if 0%{?rhel} == 8 +%patch -P400 -p1 -b .el8-support-64kpage.patch +%endif +%endif + # Change shebang in all relevant files in this directory and all subdirectories # See `man find` for how the `-exec command {} +` syntax works find -type f \( -iname "*.py" \) -exec sed -i '1s=^#! */usr/bin/\(python\|env python\)[23]\?=#!%{__python3}=' {} + @@ -1796,6 +1803,9 @@ getent group chrome-remote-desktop >/dev/null || groupadd -r chrome-remote-deskt %{chromium_path}/chromedriver %changelog +* Thu Feb 01 2024 Than Ngo - 121.0.6167.139-2 +- Support for 64K pages on Linux/AArch64 + * Wed Jan 31 2024 Than Ngo - 121.0.6167.139-1 - update to 121.0.6167.139 * High CVE-2024-1060: Use after free in Canvas