Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes smallvec rust vulnerability (1.19.x). #7560

Merged
merged 3 commits into from
Jan 12, 2021

Conversation

mkarolin
Copy link
Collaborator

@mkarolin mkarolin commented Jan 11, 2021

Fixes brave/brave-browser#13446
Fixes brave/brave-browser#13101

Uplift from #7551
Uplift from #7412

Submitter Checklist:

  • There is a ticket for my issue.
  • Used Github auto-closing keywords in the commit message.
  • Wrote a good PR/commit description
  • Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
  • Checked the PR locally: npm run test -- brave_browser_tests, npm run test -- brave_unit_tests, npm run lint, npm run gn_check, npm run tslint
  • Ran git rebase master (if needed).
  • Requested a security/privacy review as needed.

Reviewer Checklist:

  • New files have MPL-2.0 license header.
  • Adequate test coverage exists to prevent regressions
  • Major classes, functions and non-trivial code blocks are well-commented
  • Changes in component dependencies are properly reflected in gn
  • Code follows the style guide
  • Test plan is specified in PR before merging

After-merge Checklist:

Test Plan:

@mkarolin mkarolin requested a review from a team January 11, 2021 14:36
@mkarolin mkarolin self-assigned this Jan 11, 2021
@kjozwiak
Copy link
Member

@mkarolin mind taking a look? Looks like CI is failing on every platform due to the following error/failure:

10:02:46  FAILED: brave_rust/out/x64/x86_64-unknown-linux-gnu/release/libbrave_rust.a 
10:02:46  python ../../brave/script/cargo.py --rustup_path=../../brave/build/rustup/ --cargo_path=../../brave/build/rustup/ --manifest_path=../../brave/build/rust/Cargo.toml --build_path=brave_rust/out/x64 --target=x86_64-unknown-linux-gnu --toolchain= --is_debug=false --rust_flags=\ -C\ link-arg=--sysroot=\ \ -C\ link-arg=-Wl,-rpath=\$ORIGIN\ 
10:02:46      Blocking waiting for file lock on package cache
10:02:46      Updating git repository `https://github.com/brave/adblock-rust`
10:02:46      Updating crates.io index
10:02:46  error: failed to select a version for `once_cell`.
10:02:46      ... required by package `adblock v0.3.4 (https://github.com/brave/adblock-rust?rev=c647890b6d065daf98cba540d2232c100698c498#c647890b)`
10:02:46      ... which is depended on by `adblock-ffi v0.1.0 (/home/ubuntu/workspace/pr-brave-browser-pr7551_maxk-fix-smallvec_1.19.x-linux/src/brave/vendor/adblock_rust_ffi)`
10:02:46      ... which is depended on by `brave-rust v0.1.0 (/home/ubuntu/workspace/pr-brave-browser-pr7551_maxk-fix-smallvec_1.19.x-linux/src/brave/build/rust)`
10:02:46  versions that meet the requirements `^1.5` are: 1.5.2, 1.5.1
10:02:46  
10:02:46  all possible versions conflict with previously selected packages.
10:02:46  
10:02:46    previously selected package `once_cell v1.4.0`
10:02:46      ... which is depended on by `adblock v0.2.11`
10:02:46      ... which is depended on by `speedreader v0.1.0 (/home/ubuntu/workspace/pr-brave-browser-pr7551_maxk-fix-smallvec_1.19.x-linux/src/brave/components/speedreader/rust/lib)`
10:02:46      ... which is depended on by `speedreader-ffi v0.1.0 (/home/ubuntu/workspace/pr-brave-browser-pr7551_maxk-fix-smallvec_1.19.x-linux/src/brave/components/speedreader/rust/ffi)`
10:02:46      ... which is depended on by `brave-rust v0.1.0 (/home/ubuntu/workspace/pr-brave-browser-pr7551_maxk-fix-smallvec_1.19.x-linux/src/brave/build/rust)`
10:02:46  
10:02:46  failed to select a version for `once_cell` which could resolve this conflict
10:02:46  None
10:02:46  Traceback (most recent call last):
10:02:46    File "../../brave/script/cargo.py", line 101, in <module>
10:02:46      sys.exit(main())
10:02:46    File "../../brave/script/cargo.py", line 95, in main
10:02:46      build(parse_args())
10:02:46    File "../../brave/script/cargo.py", line 70, in build
10:02:46      raise e
10:02:46  subprocess.CalledProcessError: Command '['cargo', 'build', '--release', '--manifest-path=../../brave/build/rust/Cargo.toml', '--target-dir=brave_rust/out/x64', '--target=x86_64-unknown-linux-gnu']' returned non-zero exit status 101

Copy link
Collaborator

@antonok-edm antonok-edm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe it should be possible to fix this by running cargo update -p once_cell in the build/rust directory.

@mkarolin mkarolin force-pushed the pr7551_maxk-fix-smallvec_1.19.x branch from 398b12c to 445e49f Compare January 11, 2021 19:28
@kjozwiak
Copy link
Member

Restarting macOS as it seems like build failed due to Timeout has been exceeded as per https://ci.brave.com/job/pr-brave-browser-pr7551_maxk-fix-smallvec_1.19.x-macos/4/execution/node/155/log/.

@kjozwiak
Copy link
Member

macOS failed test-browser as per https://ci.brave.com/job/pr-brave-browser-pr7551_maxk-fix-smallvec_1.19.x-macos/5/execution/node/202/log/. Created brave/brave-browser#13510 as this seems like a new intermittent issue that hasn't been logged before. Doesn't block uplift as the failure isn't related to this specific PR.

11:25:08  1 test timed out:
11:25:08      BraveBookmarkModelLoadedObserverBrowserTest.NoClearSyncV1MetaInfo (../../brave/browser/profiles/brave_bookmark_model_loaded_observer_browsertest.cc:114)

Copy link
Member

@kjozwiak kjozwiak left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Uplift into 1.19.x approved after deliberating with @brave/uplift-approvers.

@kjozwiak kjozwiak merged commit 89c51e9 into 1.19.x Jan 12, 2021
@kjozwiak kjozwiak deleted the pr7551_maxk-fix-smallvec_1.19.x branch January 12, 2021 18:12
@kjozwiak kjozwiak added this to the 1.19.x - Beta milestone Jan 12, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants