From 294a810705e0ed12a1f6ad2fc2a9e5c9bee585a8 Mon Sep 17 00:00:00 2001 From: liuzekun Date: Fri, 27 Nov 2020 17:16:20 +0800 Subject: [PATCH] docker: sync patches from internal Signed-off-by: liuzekun --- docker.spec | 15 +++- docker.yaml | 2 +- git-commit | 2 +- ...-messages-for-ops-when-device-not-fo.patch | 27 +++++++ .../0168-docker-do-not-add-w-to-LDFLAGS.patch | 79 +++++++++++++++++++ ...69-docker-add-files-in-proc-for-mask.patch | 42 ++++++++++ ...70-docker-fix-docker-load-files-leak.patch | 27 +++++++ ...-do-not-sync-if-BYPAAS_SYNC-is-false.patch | 28 +++++++ ...ix-panic-on-single-character-volumes.patch | 27 +++++++ patch/0173-docker-mask-proc-pin_memory.patch | 25 ++++++ series.conf | 8 ++ 11 files changed, 279 insertions(+), 3 deletions(-) create mode 100644 patch/0167-docker-add-more-messages-for-ops-when-device-not-fo.patch create mode 100644 patch/0168-docker-do-not-add-w-to-LDFLAGS.patch create mode 100644 patch/0169-docker-add-files-in-proc-for-mask.patch create mode 100644 patch/0170-docker-fix-docker-load-files-leak.patch create mode 100644 patch/0171-docker-do-not-sync-if-BYPAAS_SYNC-is-false.patch create mode 100644 patch/0172-docker-fix-panic-on-single-character-volumes.patch create mode 100644 patch/0173-docker-mask-proc-pin_memory.patch diff --git a/docker.spec b/docker.spec index ddcfbc9..5e4ee8e 100644 --- a/docker.spec +++ b/docker.spec @@ -1,6 +1,6 @@ Name: docker-engine Version: 18.09.0 -Release: 108 +Release: 109 Summary: The open-source application container engine Group: Tools/Docker @@ -210,3 +210,16 @@ fi %endif %changelog +* Fri Dec 27 2020 liuzekun - 18.09.109 +- Type:bugfix +- ID:NA +- CVE:NA +- SUG:restart +- DESC: +1.add more messages for ops when device not found +2.do not add "-w" to LDFLAG +3.add files in proc for mask +4.fix docker load files leak +5.do not sync if BYPAAS_SYNC is false +6.fix panic on single-character volumes +7.mask /proc/pin_memory diff --git a/docker.yaml b/docker.yaml index 6291420..30d6a74 100644 --- a/docker.yaml +++ b/docker.yaml @@ -1,4 +1,4 @@ version_control: github -src_repo: docker +src_repo: docker/docker-ce tag_prefix: ^v seperator: . diff --git a/git-commit b/git-commit index 5732905..4ac9680 100644 --- a/git-commit +++ b/git-commit @@ -1 +1 @@ -9798d7077fc83c2be9182cbad441e371cae31303 +026550e43812d1fc2fcea9cc172e35a4b7f1a848 diff --git a/patch/0167-docker-add-more-messages-for-ops-when-device-not-fo.patch b/patch/0167-docker-add-more-messages-for-ops-when-device-not-fo.patch new file mode 100644 index 0000000..4863e76 --- /dev/null +++ b/patch/0167-docker-add-more-messages-for-ops-when-device-not-fo.patch @@ -0,0 +1,27 @@ +From 19ce3a9a435ddb67a4e7a081cd23bb5cc19abc92 Mon Sep 17 00:00:00 2001 +From: liuzekun +Date: Thu, 30 Jul 2020 05:09:42 -0400 +Subject: [PATCH] dockerd: add more messages for ops when device not found in + the host + +Signed-off-by: liuzekun +--- + components/engine/daemon/daemon_unix.go | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/components/engine/daemon/daemon_unix.go b/components/engine/daemon/daemon_unix.go +index 5a59b324..af50fa37 100644 +--- a/components/engine/daemon/daemon_unix.go ++++ b/components/engine/daemon/daemon_unix.go +@@ -262,7 +262,7 @@ func getBlkioThrottleDevices(devs []*blkiodev.ThrottleDevice) ([]specs.LinuxThro + + for _, d := range devs { + if err := unix.Stat(d.Path, &stat); err != nil { +- return nil, err ++ return nil, errors.Wrapf(err, "Failed to stat device %q", d.Path) + } + d := specs.LinuxThrottleDevice{Rate: d.Rate} + d.Major = int64(stat.Rdev / 256) +-- +2.19.1 + diff --git a/patch/0168-docker-do-not-add-w-to-LDFLAGS.patch b/patch/0168-docker-do-not-add-w-to-LDFLAGS.patch new file mode 100644 index 0000000..5486839 --- /dev/null +++ b/patch/0168-docker-do-not-add-w-to-LDFLAGS.patch @@ -0,0 +1,79 @@ +From b23e7a179e68f194516b542bea375c44122e1037 Mon Sep 17 00:00:00 2001 +From: xiadanni1 +Date: Tue, 11 Aug 2020 08:00:12 +0800 +Subject: [PATCH] docker: do not add "-w" to LDFLAG + +reason: for gdb debug, do not add "-w" to LDFLAGS + +Signed-off-by: xiadanni1 +--- + components/cli/scripts/build/.variables | 1 - + components/cli/scripts/build/dynbinary | 5 ++++- + components/engine/hack/make.sh | 5 ----- + components/engine/hack/make/.binary | 5 ++++- + 4 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/components/cli/scripts/build/.variables b/components/cli/scripts/build/.variables +index a23e379..7b78e62 100755 +--- a/components/cli/scripts/build/.variables ++++ b/components/cli/scripts/build/.variables +@@ -13,7 +13,6 @@ if test -n "${PLATFORM}"; then + fi + + export LDFLAGS="\ +- -w \ + ${PLATFORM_LDFLAGS} \ + -X \"github.com/docker/cli/cli.GitCommit=${GITCOMMIT}\" \ + -X \"github.com/docker/cli/cli.BuildTime=${BUILDTIME}\" \ +diff --git a/components/cli/scripts/build/dynbinary b/components/cli/scripts/build/dynbinary +index 2442166..40941bb 100755 +--- a/components/cli/scripts/build/dynbinary ++++ b/components/cli/scripts/build/dynbinary +@@ -13,7 +13,10 @@ export CGO_ENABLED=1 + BEP_DIR=/tmp/docker-build-bep + BEP_FLAGS="-tmpdir=$BEP_DIR" + mkdir -p $BEP_DIR ++GC_FLAGS="-gcflags=-trimpath=$GOPATH" ++ASM_FLAGS="-asmflags=-trimpath=$GOPATH" + +-go build -o "${TARGET}" -tags pkcs11 --ldflags " -buildid=IdByIsula -extldflags=-zrelro -extldflags=-znow $BEP_FLAGS ${LDFLAGS}" -buildmode=pie "${SOURCE}" ++set -x ++go build $GC_FLAGS $ASM_FLAGS -o "${TARGET}" -tags pkcs11 --ldflags " -buildid=IdByIsula -extldflags=-zrelro -extldflags=-znow $BEP_FLAGS ${LDFLAGS}" -buildmode=pie "${SOURCE}" + + ln -sf "$(basename "${TARGET}")" build/docker +diff --git a/components/engine/hack/make.sh b/components/engine/hack/make.sh +index f4a51e7..d24a7b7 100755 +--- a/components/engine/hack/make.sh ++++ b/components/engine/hack/make.sh +@@ -137,12 +137,7 @@ if \ + fi + + # Use these flags when compiling the tests and final binary +- + IAMSTATIC='true' +-if [ -z "$DOCKER_DEBUG" ]; then +- LDFLAGS='-w' +-fi +- + LDFLAGS_STATIC='' + EXTLDFLAGS_STATIC='-static' + # ORIG_BUILDFLAGS is necessary for the cross target which cannot always build +diff --git a/components/engine/hack/make/.binary b/components/engine/hack/make/.binary +index f76b6f7..35bb836 100755 +--- a/components/engine/hack/make/.binary ++++ b/components/engine/hack/make/.binary +@@ -63,7 +63,10 @@ echo "Building: $DEST/$BINARY_FULLNAME" + BEP_DIR=/tmp/dockerd-build-bep + BEP_FLAGS="-tmpdir=$BEP_DIR" + mkdir -p $BEP_DIR +-go build \ ++GC_FLAGS="-gcflags=-trimpath=$GOPATH" ++ASM_FLAGS="-asmflags=-trimpath=$GOPATH" ++set -x ++go build $GC_FLAGS $ASM_FLAGS \ + -o "$DEST/$BINARY_FULLNAME" \ + "${BUILDFLAGS[@]}" \ + -ldflags " +-- +1.8.3.1 + diff --git a/patch/0169-docker-add-files-in-proc-for-mask.patch b/patch/0169-docker-add-files-in-proc-for-mask.patch new file mode 100644 index 0000000..18d6522 --- /dev/null +++ b/patch/0169-docker-add-files-in-proc-for-mask.patch @@ -0,0 +1,42 @@ +From c9db33aaad779afff04db8beb5b6d7e7e512a66d Mon Sep 17 00:00:00 2001 +From: liuzekun +Date: Mon, 24 Aug 2020 09:42:21 -0400 +Subject: [PATCH] docker: add files in proc for mask + +Signed-off-by: liuzekun +--- + components/engine/oci/defaults.go | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/components/engine/oci/defaults.go b/components/engine/oci/defaults.go +index cd4985f5..ec748a6d 100644 +--- a/components/engine/oci/defaults.go ++++ b/components/engine/oci/defaults.go +@@ -65,7 +65,7 @@ func DefaultLinuxSpec() specs.Spec { + Effective: defaultCapabilities(), + }, + }, +- Root: &specs.Root{}, ++ Root: &specs.Root{}, + Hooks: &specs.Hooks{}, + } + s.Mounts = []specs.Mount{ +@@ -128,9 +128,15 @@ func DefaultLinuxSpec() specs.Spec { + "/proc/keys", + "/proc/latency_stats", + "/proc/livepatch", ++ "/proc/lru_info", ++ "/proc/lru_info_file", + "/proc/memstat", + "/proc/net_namespace", + "/proc/oom_extend", ++ "/proc/pagealloc_statistics", ++ "/proc/pagealloc_bt", ++ "/proc/slaballoc_bt", ++ "/proc/slaballoc_module", + "/proc/sched_debug", + "/proc/scsi", + "/proc/sig_catch", +-- +2.19.1 + diff --git a/patch/0170-docker-fix-docker-load-files-leak.patch b/patch/0170-docker-fix-docker-load-files-leak.patch new file mode 100644 index 0000000..75bfa1b --- /dev/null +++ b/patch/0170-docker-fix-docker-load-files-leak.patch @@ -0,0 +1,27 @@ +From e7dd426dc3d962eae0e934dcb8fe4d805f8ea4ca Mon Sep 17 00:00:00 2001 +From: liuzekun +Date: Wed, 16 Sep 2020 22:40:49 -0400 +Subject: [PATCH] fix docker load files leak + +Signed-off-by: liuzekun +--- + components/engine/daemon/graphdriver/devmapper/deviceset.go | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/components/engine/daemon/graphdriver/devmapper/deviceset.go b/components/engine/daemon/graphdriver/devmapper/deviceset.go +index f5c0b04..ff90c44 100644 +--- a/components/engine/daemon/graphdriver/devmapper/deviceset.go ++++ b/components/engine/daemon/graphdriver/devmapper/deviceset.go +@@ -2285,6 +2285,9 @@ func (devices *DeviceSet) unmountAndDeactivateAll(dir string) { + // and the device will be released when that container dies. + if err := unix.Unmount(fullname, unix.MNT_DETACH); err != nil && err != unix.EINVAL { + logger.Warnf("Shutdown unmounting %s, error: %s", fullname, err) ++ } else if err == nil { ++ logger.Debugf("Remove %s", fullname) ++ os.RemoveAll(fullname) + } + + if devInfo, err := devices.lookupDevice(name); err != nil { +-- +2.19.1 + diff --git a/patch/0171-docker-do-not-sync-if-BYPAAS_SYNC-is-false.patch b/patch/0171-docker-do-not-sync-if-BYPAAS_SYNC-is-false.patch new file mode 100644 index 0000000..63334a2 --- /dev/null +++ b/patch/0171-docker-do-not-sync-if-BYPAAS_SYNC-is-false.patch @@ -0,0 +1,28 @@ +From bbc6fce3870ff7f43c87efe13247bb185817aa67 Mon Sep 17 00:00:00 2001 +From: liuzekun +Date: Wed, 14 Oct 2020 04:36:56 -0400 +Subject: [PATCH] do not sync if BYPAAS_SYNC is false + +Signed-off-by: liuzekun +--- + components/engine/pkg/devicemapper/devmapper.go | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/components/engine/pkg/devicemapper/devmapper.go b/components/engine/pkg/devicemapper/devmapper.go +index 06ddc3e9..a5c30cb3 100644 +--- a/components/engine/pkg/devicemapper/devmapper.go ++++ b/components/engine/pkg/devicemapper/devmapper.go +@@ -477,7 +477,9 @@ func BlockDeviceDiscard(path string) error { + + // Without this sometimes the remove of the device that happens after + // discard fails with EBUSY. +- unix.Sync() ++ if os.Getenv("DOCKER_BYPASS_SYNC_SYSCALL") != "false" { ++ unix.Sync() ++ } + + return nil + } +-- +2.19.1 + diff --git a/patch/0172-docker-fix-panic-on-single-character-volumes.patch b/patch/0172-docker-fix-panic-on-single-character-volumes.patch new file mode 100644 index 0000000..f0bdb97 --- /dev/null +++ b/patch/0172-docker-fix-panic-on-single-character-volumes.patch @@ -0,0 +1,27 @@ +From 0a2c746c0d560d18502f84078d233166934e9eb9 Mon Sep 17 00:00:00 2001 +From: liuzekun +Date: Wed, 11 Nov 2020 23:47:30 -0500 +Subject: [PATCH] fix panic on single-character volumes + +Signed-off-by: liuzekun +--- + components/cli/cli/compose/loader/volume.go | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/components/cli/cli/compose/loader/volume.go b/components/cli/cli/compose/loader/volume.go +index 9c2792e0..f043f4aa 100644 +--- a/components/cli/cli/compose/loader/volume.go ++++ b/components/cli/cli/compose/loader/volume.go +@@ -111,6 +111,9 @@ func isFilePath(source string) bool { + case '.', '/', '~': + return true + } ++ if len([]rune(source)) == 1 { ++ return false ++ } + + // windows named pipes + if strings.HasPrefix(source, `\\`) { +-- +2.19.1 + diff --git a/patch/0173-docker-mask-proc-pin_memory.patch b/patch/0173-docker-mask-proc-pin_memory.patch new file mode 100644 index 0000000..4b0502d --- /dev/null +++ b/patch/0173-docker-mask-proc-pin_memory.patch @@ -0,0 +1,25 @@ +From 017c3377f0bd5230c0fa1699bd193baa527f0b8f Mon Sep 17 00:00:00 2001 +From: xiadanni1 +Date: Fri, 20 Nov 2020 18:34:45 +0800 +Subject: [PATCH] docker:mask /proc/pin_memory + +Signed-off-by: xiadanni1 +--- + components/engine/oci/defaults.go | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/components/engine/oci/defaults.go b/components/engine/oci/defaults.go +index ec748a6..e763cb7 100644 +--- a/components/engine/oci/defaults.go ++++ b/components/engine/oci/defaults.go +@@ -135,6 +135,7 @@ func DefaultLinuxSpec() specs.Spec { + "/proc/oom_extend", + "/proc/pagealloc_statistics", + "/proc/pagealloc_bt", ++ "/proc/pin_memory", + "/proc/slaballoc_bt", + "/proc/slaballoc_module", + "/proc/sched_debug", +-- +1.8.3.1 + diff --git a/series.conf b/series.conf index d3de6fd..3ea83f6 100644 --- a/series.conf +++ b/series.conf @@ -161,3 +161,11 @@ patch/0162-docker-delete-event-is-not-need-to-process.patch patch/0163-docker-stat-process-exit-file-when-kill-process-dire.patch patch/0164-docker-use-git-commit-to-store-commit-ID.patch patch/0165-docker-sync-cli-vendor.patch +patch/0167-docker-add-more-messages-for-ops-when-device-not-fo.patch +patch/0168-docker-do-not-add-w-to-LDFLAGS.patch +patch/0169-docker-add-files-in-proc-for-mask.patch +patch/0170-docker-fix-docker-load-files-leak.patch +patch/0171-docker-do-not-sync-if-BYPAAS_SYNC-is-false.patch +patch/0172-docker-fix-panic-on-single-character-volumes.patch +patch/0173-docker-mask-proc-pin_memory.patch +#end -- Gitee