rpcbind: Fix memory corruption in PMAP_CALLIT code

Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in
rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of
service (daemon crash) via crafted packets, involving a PMAP_CALLIT
code.

The patch comes from
<http://www.openwall.com/lists/oss-security/2015/09/18/7>, and it hasn't
been in rpcbind upstream yet.

(From OE-Core master rev: cc4f62f3627f3804907e8ff9c68d9321979df32b)

Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>

The 0001-uclibc-nss.patch has been applied upstream
in a bit different way but solves the issue at hand

Change-Id: I7312d109d01c08338d4673383e2eaccee219b7bd
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>

* Updated 0001-Avoid-use-of-glibc-sys-cdefs.h-header.patch
* Removed 0002-uclibc-rpcsvc-defines.patch since it is already in the
  source.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

most patches are just removing glibc'ism e.g. using sys/queue.h
of cdefs.h the one patch which is specific to musl
is housed with overrides

Change-Id: Ia15bf6c9c4b562c9392a704ef92e9090aa5f6381
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

* rpcbind.service requires rpcbind.socket and systemctl tries to add it twice
* see log.do_rootfs:
  Started /OE/build/shr-core/tmp-glibc/sysroots/x86_64-linux/usr/bin/systemctl --root=/OE/build/shr-core/tmp-glibc/work/nokia900-oe-linux-gnueabi/shr-image/2.0-r20/rootfs enable rpcbind.service rpcbind.socket
  Try to find location of rpcbind.service...
  Found rpcbind.service in /lib/systemd/system/rpcbind.service
  Also=rpcbind.socket found in rpcbind.service
  Started /OE/build/shr-core/tmp-glibc/sysroots/x86_64-linux/usr/bin/systemctl --root=/OE/build/shr-core/tmp-glibc/work/nokia900-oe-linux-gnueabi/shr-image/2.0-r20/rootfs enable rpcbind.socket
  Try to find location of rpcbind.socket...
  Found rpcbind.socket in /lib/systemd/system/rpcbind.socket
  WantedBy=sockets.target found in rpcbind.socket
  Enabled rpcbind.socket for sockets.target.
  Try to find location of rpcbind.socket...
  Found rpcbind.socket in /lib/systemd/system/rpcbind.socket
  WantedBy=sockets.target found in rpcbind.socket
  ln: failed to create symbolic link '/OE/build/shr-core/tmp-glibc/work/nokia900-oe-linux-gnueabi/shr-image/2.0-r20/rootfs/etc/systemd/system/sockets.target.wants/rpcbind.socket': File exists
  Enabled rpcbind.socket for sockets.target.

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>

Drop 0001-rpcbind-rpcuser-not-being-set-in-Makefile.am.patch
which has been merged to 0.2.2

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>

Instead of setting 'Restart=always' in the service file, we should
make the service socket activated, just like what Fedora does.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>

Exiting with '2' is actually expected with rpcbind, because it catches
SIGTERM and exits with '2' explicitly.

The related code is as follows.

(void) signal(SIGTERM, terminate);

/*
 * Catch the signal and die
 */
static void
terminate(int dummy /*__unused*/)
{
        close(rpcbindlockfd);
        unlink(_PATH_RPCBINDSOCK);
        unlink(RPCBINDDLOCK);
        syslog(LOG_ERR,
                "rpcbind terminating on signal. Restart with \"rpcbind -w\"");
        write_warmstart(); /* Dump yourself */
        exit(2);
}

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>