[llvm] Add llvm-project archive issues for Chromium bug tracker (PR #132030)
Peter Smith via llvm-commits
llvm-commits at lists.llvm.org
Thu Mar 20 02:59:24 PDT 2025
https://github.com/smithp35 updated https://github.com/llvm/llvm-project/pull/132030
>From ad6181c4f634bbc1a559597f81e838fc95ad0d2c Mon Sep 17 00:00:00 2001
From: Peter Smith <peter.smith at arm.com>
Date: Wed, 19 Mar 2025 10:04:41 +0000
Subject: [PATCH 1/2] Add llvm-project archive issues for Chromium bug tracker
The Chromium bug tracker is in an archived state. The Security
Response Group has preemptively created llvm-project GitHub
issues with PDF copies of the Chromium issues should the
repository become inaccessible.
* Replace URLs in format:
https://bugs.chromium.org/p/llvm/issues/detail?id=X with
their redirect https://issuetracker.google.com/issues/y
* Add URLs to llvm-project archive issues.
* Add an explanation of archive use.
---
llvm/docs/SecurityTransparencyReports.rst | 78 ++++++++++++++---------
1 file changed, 48 insertions(+), 30 deletions(-)
diff --git a/llvm/docs/SecurityTransparencyReports.rst b/llvm/docs/SecurityTransparencyReports.rst
index bfa15ab4c484d..cc028ae1e1d2a 100644
--- a/llvm/docs/SecurityTransparencyReports.rst
+++ b/llvm/docs/SecurityTransparencyReports.rst
@@ -2,7 +2,15 @@
LLVM Security Group Transparency Reports
========================================
-This page lists the yearly LLVM Security group transparency reports.
+This page lists the yearly LLVM Security Response group transparency reports.
+
+The LLVM Security Response group started out as the LLVM security group, previous
+year's transparency reports keep the original year.
+
+Initially the Chromium issue tracker was used to record issues. This component
+has been archived and is read-only. A llvm-project issue with the SecurityArchive
+label has been created with a further backup PDF copy in a llvm-project
+repository.
2021
----
@@ -29,8 +37,11 @@ In 2021, the security group received 13 issue reports that were made publicly
visible before 31st of December 2021. The security group judged 2 of these
reports to be security issues:
-* https://bugs.chromium.org/p/llvm/issues/detail?id=5
-* https://bugs.chromium.org/p/llvm/issues/detail?id=11
+* https://issuetracker.google.com/issues/42410043 archive:
+ https://github.com/llvm/llvm-project/issues/125709
+
+* https://issuetracker.google.com/issues/42410002 archive:
+ https://github.com/llvm/llvm-project/issues/127644
Both issues were addressed with source changes: #5 in clangd/vscode-clangd, and
#11 in llvm-project. No dedicated LLVM release was made for either.
@@ -54,24 +65,27 @@ the time of writing this transparency report.
5 of these were judged to be security issues:
-* https://bugs.chromium.org/p/llvm/issues/detail?id=17 reports a miscompile in
+* https://issuetracker.google.com/issues/42410008 reports a miscompile in
LLVM that can result in the frame pointer and return address being
- overwritten. This was fixed.
+ overwritten. This was fixed. Archive: https://github.com/llvm/llvm-project/issues/127645
-* https://bugs.chromium.org/p/llvm/issues/detail?id=19 reports a vulnerability
- in `std::filesystem::remove_all` in libc++. This was fixed.
+* https://issuetracker.google.com/issues/42410010 reports a vulnerability
+ in `std::filesystem::remove_all` in libc++. This was fixed. Archive:
+ https://github.com/llvm/llvm-project/issues/127647
-* https://bugs.chromium.org/p/llvm/issues/detail?id=23 reports a new Spectre
+* https://issuetracker.google.com/issues/42410015 reports a new Spectre
gadget variant that Speculative Load Hardening (SLH) does not mitigate. No
extension to SLH was implemented to also mitigate against this variant.
+ Archive: https://github.com/llvm/llvm-project/issues/127648
-* https://bugs.chromium.org/p/llvm/issues/detail?id=30 reports missing memory
+* https://issuetracker.google.com/issues/42410023 reports missing memory
safety protection on the (C++) exception handling path. A number of fixes
- were implemented.
+ were implemented. Archive: https://github.com/llvm/llvm-project/issues/127649
-* https://bugs.chromium.org/p/llvm/issues/detail?id=33 reports the RETBLEED
+* https://issuetracker.google.com/issues/42410026 reports the RETBLEED
vulnerability. The outcome was clang growing a new security hardening feature
`-mfunction-return=thunk-extern`, see https://reviews.llvm.org/D129572.
+ Archive: https://github.com/llvm/llvm-project/issues/127650
No dedicated LLVM releases were made for any of the above issues.
@@ -84,33 +98,37 @@ that were received earlier, but were disclosed in 2023.
9 of these were judged to be security issues:
-https://bugs.chromium.org/p/llvm/issues/detail?id=36 reports the presence of
-.git folder in https://llvm.org/.git.
+ * https://issuetracker.google.com/issues/42410029 reports the presence of
+ .git folder in https://llvm.org/.git. Archive: https://github.com/llvm/llvm-project/issues/131841
-https://bugs.chromium.org/p/llvm/issues/detail?id=66 reports the presence of
-a GitHub Personal Access token in a DockerHub imaage.
+ * https://issuetracker.google.com/issues/42410060 reports the presence of
+ a GitHub Personal Access token in a DockerHub imaage. Archive: https://github.com/llvm/llvm-project/issues/131846
-https://bugs.chromium.org/p/llvm/issues/detail?id=42 reports a potential gap
-in the Armv8.1-m BTI protection, involving a combination of large switch statements
-and __builtin_unreachable() in the default case.
+ * https://issuetracker.google.com/issues/42410035 reports a potential gap
+ in the Armv8.1-m BTI protection, involving a combination of large switch statements
+ and __builtin_unreachable() in the default case. Archive: https://github.com/llvm/llvm-project/issues/131848
-https://bugs.chromium.org/p/llvm/issues/detail?id=43 reports a dependency
-on an old version of xml2js with a CVE filed against it.
+ * https://issuetracker.google.com/issues/42410036 reports a dependency on
+ an old version of xml2js with a CVE filed against it.
+ Archive: https://github.com/llvm/llvm-project/issues/131849
-https://bugs.chromium.org/p/llvm/issues/detail?id=45 reports a number of
-dependencies that have had vulnerabilities reported against them.
+ * https://issuetracker.google.com/issues/42410038 reports a number of
+ dependencies that have had vulnerabilities reported against them.
+ Archive: https://github.com/llvm/llvm-project/issues/131851
-https://bugs.chromium.org/p/llvm/issues/detail?id=46 is related to issue 43.
+ * https://issuetracker.google.com/issues/42410039 is related to issue 42410038.
+ Archive: https://github.com/llvm/llvm-project/issues/131852
-https://bugs.chromium.org/p/llvm/issues/detail?id=48 reports a buffer overflow
-in std::format from -fexperimental-library.
+ * https://issuetracker.google.com/issues/42410041 reports a buffer overflow
+ in std::format from -fexperimental-library. Archive: https://github.com/llvm/llvm-project/issues/131856
-https://bugs.chromium.org/p/llvm/issues/detail?id=54 reports a memory leak in
-basic_string move assignment when built with libc++ versions <=6.0 and run against
-newer libc++ shared/dylibs.
+ * https://issuetracker.google.com/issues/42410047 reports a memory leak in
+ basic_string move assignment when built with libc++ versions <=6.0 and run against
+ newer libc++ shared/dylibs. Archive: https://github.com/llvm/llvm-project/issues/131857
-https://bugs.chromium.org/p/llvm/issues/detail?id=56 reports an out of bounds buffer
-store introduced by LLVM backends, that regressed due to a procedural oversight.
+ * https://issuetracker.google.com/issues/42410049 reports an out of bounds buffer
+ store introduced by LLVM backends, that regressed due to a procedural oversight.
+ Archive: https://github.com/llvm/llvm-project/issues/131858
No dedicated LLVM releases were made for any of the above issues.
>From e5d6ac7d9b54b5d39532bb791c62a6ca51b1db82 Mon Sep 17 00:00:00 2001
From: Peter Smith <peter.smith at arm.com>
Date: Wed, 19 Mar 2025 14:15:05 +0000
Subject: [PATCH 2/2] Kristof's Review comments
* year should have been name.
* reworded part about archives.
I've kept the URLs the same for now.
---
llvm/docs/SecurityTransparencyReports.rst | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/llvm/docs/SecurityTransparencyReports.rst b/llvm/docs/SecurityTransparencyReports.rst
index cc028ae1e1d2a..9fca66a48cec3 100644
--- a/llvm/docs/SecurityTransparencyReports.rst
+++ b/llvm/docs/SecurityTransparencyReports.rst
@@ -5,12 +5,14 @@ LLVM Security Group Transparency Reports
This page lists the yearly LLVM Security Response group transparency reports.
The LLVM Security Response group started out as the LLVM security group, previous
-year's transparency reports keep the original year.
-
-Initially the Chromium issue tracker was used to record issues. This component
-has been archived and is read-only. A llvm-project issue with the SecurityArchive
-label has been created with a further backup PDF copy in a llvm-project
-repository.
+year's transparency reports keep the original name.
+
+Initially the Chromium issue tracker was used to record issues. This
+component has been archived and is read-only. A GitHub
+llvm/llvm-project issue has been created for each issue in the
+Chromium issue tracker. All of these issues contain an attached PDF
+with the content of the Chromium issue, and have the SecurityArchive
+label.
2021
----
More information about the llvm-commits
mailing list