summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* linux-yocto/5.4: update to v5.4.118Bruce Ashfield2021-06-033-18/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updating linux-yocto/5.4 to the latest korg -stable release that comprises the following commits: 16022114de98 Linux 5.4.118 a992a283c0b7 dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails 569bae00ebbe dm integrity: fix missing goto in bitmap_flush_interval error handling ff8fd1e3b58a dm space map common: fix division bug in sm_ll_find_free_block() 6fcaa44105aa dm persistent data: packed struct should have an aligned() attribute too c64da3294a7d tracing: Restructure trace_clock_global() to never block 0834094c9a08 tracing: Map all PIDs to command lines 8768085ba271 rsi: Use resume_noirq for SDIO 55aa314a1a6c tty: fix memory leak in vc_deallocate 943131fda33b usb: dwc2: Fix session request interrupt handler 5bd06fc6b02c usb: dwc3: gadget: Fix START_TRANSFER link state check 0790fdbf37ee usb: gadget/function/f_fs string table fix for multiple languages 3b8b63be230f usb: gadget: Fix double free of device descriptor pointers efa99087ea69 usb: gadget: dummy_hcd: fix gpf in gadget_setup ffe824c0e35a media: staging/intel-ipu3: Fix race condition during set_fmt a03fb1e8a110 media: staging/intel-ipu3: Fix set_fmt error handling ff792ae52005 media: staging/intel-ipu3: Fix memory leak in imu_fmt ae37aee56cad media: dvb-usb: Fix memory leak at error in dvb_usb_device_init() e5c27c2ae2f2 media: dvb-usb: Fix use-after-free access 9185b3b1c143 media: dvbdev: Fix memory leak in dvb_media_device_free() 92eb134265fa ext4: fix error code in ext4_commit_super c599462ab9c3 ext4: do not set SB_ACTIVE in ext4_orphan_cleanup() 9c61387630a5 ext4: fix check to prevent false positive report of incorrect used inodes 79c95130a52a kbuild: update config_data.gz only when the content of .config is changed 19c8c34a8b80 x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported 8d2be04dbb17 Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op") 2b040d13b411 jffs2: check the validity of dstlen in jffs2_zlib_compress() 564b1868f229 Fix misc new gcc warnings 8aa728568202 security: commoncap: fix -Wstringop-overread warning be8db260f482 fuse: fix write deadlock dc21b424861a dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload sequences 6920cef604fa md/raid1: properly indicate failure when ending a failed write request 5f2d256875a5 crypto: rng - fix crypto_rng_reset() refcounting when !CRYPTO_STATS 63a25b715633 tpm: vtpm_proxy: Avoid reading host log when using a virtual device 2f12258b5224 tpm: efi: Use local variable for calculating final log size 2af501de8f43 intel_th: pci: Add Alder Lake-M support ab5d5c9dfd02 powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h abf3573ef4e7 powerpc/eeh: Fix EEH handling for hugepages in ioremap space. 077f526fe3cc jffs2: Fix kasan slab-out-of-bounds problem ad3f360ef20f Input: ili210x - add missing negation for touch indication on ili210x 6be0e4b59314 NFSv4: Don't discard segments marked for return in _pnfs_return_layout() 12ccd59941e3 NFS: Don't discard pNFS layout segments that are marked for return 504632a3577a ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure 490ad0a23904 openvswitch: fix stack OOB read while fragmenting IPv4 packets 9508634b2b18 mlxsw: spectrum_mr: Update egress RIF list before route's action 27a130638406 f2fs: fix to avoid out-of-bounds memory access 6c9b98a66d0a ubifs: Only check replay with inode type to judge if inode linked 310efc95c72c virtiofs: fix memory leak in virtio_fs_probe() 2b28e26bd776 Makefile: Move -Wno-unused-but-set-variable out of GCC only block 13a474c01353 arm64/vdso: Discard .note.gnu.property sections in vDSO f40bf82bf693 btrfs: fix race when picking most recent mod log operation for an old root 2bc0131d5be0 ALSA: hda/realtek: Add quirk for Intel Clevo PCx0Dx 45392da1bd91 ALSA: hda/realtek: fix static noise on ALC285 Lenovo laptops ee47a6414950 ALSA: hda/realtek: fix mic boost on Intel NUC 8 d143cd1f8f6b ALSA: hda/realtek: GA503 use same quirks as GA401 f2b75e357816 ALSA: usb-audio: Add dB range mapping for Sennheiser Communications Headset PC 8 2136ecfcf3d9 ALSA: usb-audio: More constifications adba683c573d ALSA: usb-audio: Explicitly set up the clock selector 93588ea2fbd4 ALSA: sb: Fix two use after free in snd_sb_qsound_build 1666f1ac383f ALSA: hda/conexant: Re-order CX5066 quirk table entries b53b72ef83ff ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer a65181cfd953 s390/archrandom: add parameter check for s390_arch_random_generate ef00a39e2c78 scsi: libfc: Fix a format specifier 02c13900477c mfd: arizona: Fix rumtime PM imbalance on error 0d0e6dbd5fca scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic 0756818b4d3b scsi: lpfc: Fix error handling for mailboxes completed in MBX_POLL mode f67fc8095bbe scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response 82bc134b93b5 drm/amdgpu: fix NULL pointer dereference 4b65414ea416 amdgpu: avoid incorrect %hu format string 443fdd7b4bc3 drm/amdkfd: Fix cat debugfs hang_hws file causes system crash bug c49981759450 drm/msm/mdp5: Do not multiply vclk line count by 100 336e7e758640 drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal b56ad4febe67 sched/fair: Ignore percpu threads for imbalance pulls 53995be39f93 media: gscpa/stv06xx: fix memory leak 3a855efb5426 media: dvb-usb: fix memory leak in dvb_usb_adapter_init 4ca05c0e04d5 media: platform: sti: Fix runtime PM imbalance in regs_show 47be6867d2d0 media: i2c: adv7842: fix possible use-after-free in adv7842_remove() f6b97476053d media: i2c: tda1997: Fix possible use-after-free in tda1997x_remove() cc265fb8e549 media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() 48304f37ce81 media: adv7604: fix possible use-after-free in adv76xx_remove() b76249a0a64e media: tc358743: fix possible use-after-free in tc358743_remove() b25324cf16f5 power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() ac22a96c7388 power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() e0be54070ba1 clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return 330753d38f26 media: vivid: update EDID 71b75e6e2410 media: em28xx: fix memory leak cfb42c1bcce8 scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg() 1a22a9fde806 scsi: smartpqi: Add new PCI IDs 7973764b5454 scsi: smartpqi: Correct request leakage during reset operations 7d77ac088fd7 ata: ahci: Disable SXS for Hisilicon Kunpeng920 1f3daf672a13 mmc: sdhci-pci: Add PCI IDs for Intel LKF 40fdaa2d149b scsi: qla2xxx: Fix use after free in bsg 2cb8ce1d79d3 drm/vkms: fix misuse of WARN_ON 3f67d5b6f943 scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats() 48425948d2b6 drm/amd/display: fix dml prefetch validation cd148571eab0 drm/amd/display: Fix UBSAN warning for not a valid value for type '_Bool' e81f4da43b1d drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f 0c0356ef2498 drm/amdkfd: Fix UBSAN shift-out-of-bounds warning 888b482dbe26 drm/amdgpu: mask the xgmi number of hops reported from psp to kfd 8d802ad28f9c power: supply: Use IRQF_ONESHOT bc73cb52997d media: gspca/sq905.c: fix uninitialized variable bec3831f5108 media: media/saa7164: fix saa7164_encoder_register() memory leak bugs 20065ae0056a extcon: arizona: Fix various races on driver unbind 32990455bd12 extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged 22ee443ac784 power: supply: bq27xxx: fix power_avg for newer ICs 5bc128a16333 media: imx: capture: Return -EPIPE from __capture_legacy_try_fmt() e18cee768a6e media: drivers: media: pci: sta2x11: fix Kconfig dependency on GPIOLIB a2e71d2d797d media: ite-cir: check for receive overflow 78829d2ec594 scsi: target: pscsi: Fix warning in pscsi_complete_cmd() a27784943a96 scsi: lpfc: Fix pt2pt connection does not recover after LOGO 52d2b4370a9d scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe 2b847dc1f662 drm/amd/display: Don't optimize bandwidth before disabling planes 84b03026cccc drm/amd/display: Check for DSC support instead of ASIC revision bbf11337ded8 drm/qxl: release shadow on shutdown a7d964da5d17 drm: Added orientation quirk for OneGX1 Pro 567c83104471 btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s 3260434687cc platform/x86: intel_pmc_core: Don't use global pmcdev in quirks 229d2c12f1eb crypto: omap-aes - Fix PM reference leak on omap-aes.c 5c411b92439d crypto: stm32/cryp - Fix PM reference leak on stm32-cryp.c e6d5c66737a9 crypto: stm32/hash - Fix PM reference leak on stm32-hash.c e7138a6d6a4d phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() 349f95248bce intel_th: Consistency and off-by-one fix 86f4ac7ca448 tty: n_gsm: check error while registering tty devices 665dbcf35508 usb: core: hub: Fix PM reference leak in usb_port_resume() b8035ac2ad08 usb: musb: fix PM reference leak in musb_irq_work() 972639ed7b90 spi: qup: fix PM reference leak in spi_qup_remove() 0adc0e0c87ff spi: omap-100k: Fix reference leak to master d6aa2fcd8566 spi: dln2: Fix reference leak to master 99569ac2e97c xhci: fix potential array out of bounds with several interrupters 99c82db050ae xhci: check control context is valid before dereferencing it. 6f34d2ab34ed usb: xhci-mtk: support quirk to disable usb2 lpm d95748f23084 perf/arm_pmu_platform: Fix error handling fe53f8fd64d7 tee: optee: do not check memref size on return from Secure World dda2bc82891c x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS) ee68dd4e502f PCI: PM: Do not read power state in pci_enable_device_flags() 52b4b9d250d4 usb: xhci: Fix port minor revision c13c8354fd58 usb: dwc3: gadget: Ignore EP queue requests during bus reset 9f3c7e0074b7 usb: gadget: f_uac1: validate input parameters a10fb8a1c70a usb: gadget: f_uac2: validate input parameters a629f6bc034a genirq/matrix: Prevent allocation counter corruption 1b2207a19664 usb: webcam: Invalid size of Processing Unit Descriptor 4cc65c749d58 usb: gadget: uvc: add bInterval checking for HS mode 28da0edb56ae crypto: qat - fix unmap invalid dma address 69f1a9702d3f crypto: api - check for ERR pointers in crypto_destroy_tfm() 8ac79bdcc0c4 spi: ath79: remove spi-master setup and cleanup assignment 4d6a20917fda spi: ath79: always call chipselect function e24b9cded4bc staging: wimax/i2400m: fix byte-order issue ce64f57a0fe0 bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first 4928d3b02083 fbdev: zero-fill colormap in fbcmap.c 1c5cb86cdd7f posix-timers: Preserve return value in clock_adjtime32() e07d0fd8d64f intel_th: pci: Add Rocket Lake CPU support b6635915a3c3 btrfs: fix metadata extent leak after failure to create subvolume 93f3339b22ba cifs: Return correct error code from smb2_get_enc_key e7ea8e46e3b7 irqchip/gic-v3: Do not enable irqs when handling spurious interrups 13b0a28e6fef modules: inherit TAINT_PROPRIETARY_MODULE cd5a738e28ac modules: return licensing information from find_symbol c4698910a9af modules: rename the licence field in struct symsearch to license 7500d4999431 modules: unexport __module_address ad6d414703d7 modules: unexport __module_text_address 86de29b833e6 modules: mark each_symbol_section static 79100b191e71 modules: mark find_symbol static 6e38daf2e5db modules: mark ref_module static 909a01b95120 mmc: core: Fix hanging on I/O during system suspend for removable cards c80524b9e418 mmc: core: Set read only for SD cards with permanent write protect bit 42998c98ce9f mmc: core: Do a power cycle when the CMD11 fails 1b45fcf11d28 mmc: block: Issue a cache flush only when it's enabled 2fb68f705c56 mmc: block: Update ext_csd.cache_ctrl if it was written 4e438ff2d967 mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based controllers 698df555cc5f mmc: sdhci: Check for reset prior to DMA address unmap 0d8941b9b2d3 mmc: uniphier-sd: Fix a resource leak in the remove function 06e48bb631d3 mmc: uniphier-sd: Fix an error handling path in uniphier_sd_probe() 21171ede4337 scsi: mpt3sas: Block PCI config access from userspace during reset 77509a238547 scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() e45acaddd64b spi: spi-ti-qspi: Free DMA resources c57af0be7722 erofs: add unsupported inode i_format check 49fc21a47e93 mtd: rawnand: atmel: Update ecc_stats.corrected counter 3ef6813bb3a4 mtd: spinand: core: add missing MODULE_DEVICE_TABLE() fd1772305002 ecryptfs: fix kernel panic with null dev_name e057164f8731 arm64: dts: mt8173: fix property typo of 'phys' in dsi node 527edae13d24 arm64: dts: marvell: armada-37xx: add syscon compatible to NB clk node 34ae75d699fd ARM: 9056/1: decompressor: fix BSS size calculation for LLVM ld.lld 0b641b25870f ftrace: Handle commands when closing set_ftrace_filter file 6a4f786f8eb5 ACPI: custom_method: fix a possible memory leak 72814a94c38a ACPI: custom_method: fix potential use-after-free issue b691331218d0 s390/disassembler: increase ebpf disasm buffer size (From OE-Core rev: 1eae221b25018bc1007748bf0465ff21cc7af7a5) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4d4609d4bb709db887b5302077f89a14c05b1edc) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-yocto/5.4: update to v5.4.117Bruce Ashfield2021-06-033-18/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updating linux-yocto/5.4 to the latest korg -stable release that comprises the following commits: b5dbcd05792a Linux 5.4.117 0ee3bfc2c31e vfio: Depend on MMU b246759284d6 perf/core: Fix unconditional security_locked_down() call a1e6a0d1e6cf ovl: allow upperdir inside lowerdir 8198962021fd scsi: ufs: Unlock on a couple error paths 91aa2644a3ab platform/x86: thinkpad_acpi: Correct thermal sensor allocation 164f74391822 USB: Add reset-resume quirk for WD19's Realtek Hub 5922dfc42ac8 USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet 314192f055d9 ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX 6cede11149bf perf ftrace: Fix access to pid in array when setting a pid filter ad4659935e11 perf data: Fix error return code in perf_data__create_dir() cbc6b467610c iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd() c7166a529e2b avoid __memcat_p link failure 8ba25a9ef9b9 bpf: Fix leakage of uninitialized bpf stack under speculation 53e0db429b37 bpf: Fix masking negation logic upon negative dst register b0c8fe7ef797 iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd() 43b515c52942 igb: Enable RSS for Intel I211 Ethernet Controller 354520d3ea81 net: usb: ax88179_178a: initialize local variables before use 55714a57f369 ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade() b3041510f0fc ACPI: tables: x86: Reserve memory occupied by ACPI tables 91b08c5319a5 mips: Do not include hi and lo in clobber list for R6 (From OE-Core rev: 494b2200aea140b5241a181a5a16529df1f17177) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0bb2a057ed02b94e6f12b0508b5d7f4a535b1ca0) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-yocto: provide debug / summary information for metadataBruce Ashfield2021-06-031-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It was mentioned that when developing a BSP, the information about what definition was used, or what fragments have been applied is not obvious and requires looking at the code. With this change, we can trigger a full summary of the meta data gathering phase when KCONF_AUDIT_LEVEL > 0. Sample output follows: NOTE: do_kernel_metadata: for summary/debug, set KCONF_AUDIT_LEVEL > 0 NOTE: kernel meta data summary for qemux86-64 (standard): NOTE: ====================================================================== NOTE: BSP entry point / definition: /build/tmp/work/qemux86_64-poky-linux/linux-yocto/5.10.34+gitAUTOINC+bca3bfbc74_85c17ad073-r0/kernel-meta/bsp/common-pc-64/common-pc-64-standard.scc NOTE: Fragments from SRC_URI: /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/xt-checksum.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/ebtables.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/vswitch.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/lxc.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/docker.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/cgroup-hugetlb.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/xen.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/kubernetes.scc NOTE: KERNEL_FEATURES: features/nfsd/nfsd-enable.scc features/debug/printk.scc features/kernel-sample/kernel-sample.scc features/netfilter/netfilter.scc cfg/virtio.scc features/drm-bochs/drm-bochs.scc cfg/sound.scc cfg/paravirt_kvm.scc features/scsi/scsi-debug.scc features/gpio/mockup.scc features/aufs/aufs-enable.scc cfg/fs/flash_fs.scc cfg/virtio.scc NOTE: Final scc/cfg list: /build/tmp/work/qemux86_64-poky-linux/linux-yocto/5.10.34+gitAUTOINC+bca3bfbc74_85c17ad073-r0/kernel-meta/bsp/common-pc-64/common-pc-64-standard.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/xt-checksum.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/ebtables.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/vswitch.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/lxc.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/docker.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/cgroup-hugetlb.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/xen.scc /poky/meta-virtualization/recipes-kernel/linux/linux-yocto/kubernetes.scc features/nfsd/nfsd-enable.scc features/debug/printk.scc features/kernel-sample/kernel-sample.scc features/netfilter/netfilter.scc cfg/virtio.scc features/drm-bochs/drm-bochs.scc cfg/sound.scc cfg/paravirt_kvm.scc features/scsi/scsi-debug.scc features/gpio/mockup.scc features/aufs/aufs-enable.scc cfg/fs/flash_fs.scc cfg/virtio.scc (From OE-Core rev: 8c299837622795408f4e4a9e8c2b3b3d6f409acd) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b95b11e130e91cb7c5e65f0f9a1c655bcbcbc919) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: make busybox's syslog.cfg depend on VIRTUAL-RUNTIME_base-utils-syslogVolker Vogelhuber2021-06-031-1/+1
| | | | | | | | | | | | | | syslog.cfg is added to the list of sources for busybox independent of the VIRTUAL-RUNTIME_base-utils-syslog variable. So even if VIRTUAL-RUNTIME_base-utils-syslog being set e.g. to empty, syslogd will be enabled. So only include syslog.cfg in SRC_URI if VIRTUAL-RUNTIME_base-utils-syslog is set to busybox-syslog. (From OE-Core rev: e990a9ec5d6eaf2c328d61c4de73ea6c270cfa15) Signed-off-by: Volker Vogelhuber <v.vogelhuber@digitalendoscopy.de> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-extra-exclusions.inc: Clean up merged CPE updatesRichard Purdie2021-06-031-15/+0
| | | | | | | | | (From OE-Core rev: be30d2754a23ce195e9685872e0e476e1ca42052) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d2ba6d58e77430cceeca9db61fdb06882a92e1e7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-extra-exclusions: Fix typosRichard Purdie2021-06-031-4/+4
| | | | | | | | | (From OE-Core rev: 43d8d7001402aebc78979f3c86493f0aa15140a4) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d4d4644e7c127e8b88b180635124e8afc905c69e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-extra-exclusions.inc: add exclusion list for intractable CVE'sRichard Purdie2021-06-031-0/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The preferred methods for CVE resolution are: 1. Version upgrades where possible 2. Patches where not possible 3. Database updates where version info is incorrect 4. Exclusion from checking where it is determined that the CVE does not apply to our environment In some cases none of these methods are possible. For example the CVE may be decades old with no apparent resolution, and with broken links that make further research impractical. Some CVEs are vauge with no specific action the project can take too. This patch creates a mechanism for users to remove this type of CVE from the cve-check results via an optional include file. Based on an initial patch from Steve Sakoman <steve@sakoman.com> but extended heavily by RP. (From OE-Core rev: c93d541a84ce4f9ed52b7aee0a59857957ea0380) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit cf282ae03db3f09df42dcd110d7086c2d854642c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* expat: set CVE_PRODUCTSteve Sakoman2021-06-031-0/+2
| | | | | | | | | | | | Upstream database uses both "expat" and "libexpat" to report CVEs (From OE-Core rev: f89b497800fb3a3ecd77b7a868a02800b6c86d92) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 706bdcaec5fd7c59d7877bbefa5ed4ce5b4f3da1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Add fixes for CVEs reported for opensshSana Kazi2021-06-032-1/+109
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Applied patch for CVE-2020-14145 Link: https://anongit.mindrot.org/openssh.git/patch/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d Also, whitelisted below CVEs: 1.CVE-2020-15778: As per upstream, because of the way scp is based on a historical protocol called rcp which relies on that style of argument passing and therefore encounters expansion problems. Making changes to how the scp command line works breaks the pattern used by scp consumers. Upstream therefore recommends the use of rsync in the place of scp for better security. https://bugzilla.redhat.com/show_bug.cgi?id=1860487 2.CVE-2008-3844: It was reported in OpenSSH on Red Hat Enterprise Linux and certain packages may have been compromised. This CVE is not applicable as our source is OpenBSD. Links: https://securitytracker.com/id?1020730 https://www.securityfocus.com/bid/30794 Also, for CVE-2007-2768 no fix is available yet as it's unavoidable drawback of using one time passwords as per https://bugzilla.suse.com/show_bug.cgi?id=CVE-2007-2768 Also it is marked as unimportant on debian https://security-tracker.debian.org/tracker/CVE-2007-2768 Mailed to CPE to update database for CVE-2020-15778, CVE-2008-3844 and CVE-2007-2768. We can upstream CVE-2020-14145 till we recieve response from CPE. (From OE-Core rev: 302a6828b380ba20bb244f11f22a5bc273f0e5e7) Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Nisha Parrakat <nishaparrakat@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tiff: Add fix for CVE-2020-35521 and CVE-2020-35522akash hadke2021-06-034-0/+297
| | | | | | | | | | | | | | | | | | | Added fix for CVE-2020-35521 and CVE-2020-35522 Link: https://gitlab.com/libtiff/libtiff/-/commit/b5a935d96b21cda0f434230cdf8ca958cd8b4eef.patch Added below support patches for CVE-2020-35521 and CVE-2020-35522 1. 001_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch Link: https://gitlab.com/libtiff/libtiff/-/commit/02875964eba5c4a2ea98c41562835428214adfe7.patch 2. 002_support_patch_for_CVE-2020-35521_and_CVE-2020-35522.patch Link: https://gitlab.com/libtiff/libtiff/-/commit/ca70b5e702b9f503333344b2d46691de9feae84e.patch (From OE-Core rev: 03a65159093e0b2df4bc867c873b5c43721b9a9c) Signed-off-by: akash hadke <akash.hadke@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cups: whitelist CVE-2021-25317Ross Burton2021-06-031-0/+4
| | | | | | | | | | | | This CVE relates to bad ownership of /var/log/cups, which we don't have. (From OE-Core rev: 68ee8fd1ec0f09c6477578de40e1adfc7ba35027) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0792312f3637ec160d2ef90781a8cb1f75b84940) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.8dunfell-23.0.8Richard Purdie2021-05-241-1/+1
| | | | | | (From OE-Core rev: ecd636154e7cfc1349a7cfd8026a85eafa219535) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* poky.conf: Bump version for 3.1.8 releaseSteve Sakoman2021-05-241-1/+1
| | | | | | | (From meta-yocto rev: 134c1e9902148f907d4f9e78435fa3a827c6df03) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* poky.conf: Add fedora33 as a supported distroSteve Sakoman2021-05-241-0/+1
| | | | | | | (From meta-yocto rev: 199fa05ab723fa6df28fe228cc303409f0e37bf4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* documentation: prepare for 3.1.8 releaseSteve Sakoman2021-05-224-6/+7
| | | | | | | (From yocto-docs rev: 09b64a4d246bdcca62dddee152deef7b0dea69d7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-system-requirements.rst: Add Fedora 33 to list of supported distrosSteve Sakoman2021-05-221-0/+2
| | | | | | | (From yocto-docs rev: 07669400a5affa6bc19a5bfdea9ebc05db0b07e3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sstate: Handle manifest 'corruption' issueRichard Purdie2021-05-221-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Under certain build patterns, warnings about missing manifests can appear. These are real issues where the manifest was removed and shouldn't have been. Martin Jansa was able to find a reproducer of: MACHINE=qemux86 bitbake zlib-native echo 'PR = "r1"' >> meta/recipes-core/zlib/zlib_1.2.11.bb MACHINE=qemux86-64 bitbake zlib-native MACHINE=qemux86 bitbake zlib-native <the zlib-native manifest is now removed along with the sysroot-components contents> The code maintains a per machine list of stamps but a per PACAGE_ARCH list of stamp/manifest/workdir mappings. The latter is only appended to for speed with the assumption that once stamps are gone, the code wouldn't trigger. The code only ever appends to the mapping list (for speed/efficency under lock) meaning that multiple entries can result where the stamp/workdir differs due to version changes but the manifest remains the same. By switching MACHINE part way through the build, the older stamp is referenced and the manifest is incorrectly removed as it matches an now obsolete entry in the mapping file. There are two possible fixes, one is to rewrite the mapping file every time which means adding regexs, iterating and generally complicating that code. The second option is to only use the last mapping entry in the file for a given manifest and ignore any earlier ones. This patch implments the latter. Also drop the stale entries if we are rewriting it. (From OE-Core rev: 9039dd25e5d419dd1c60e1b27ff5f9d96c5b0fb5) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 63da9a4f889c5b0e41bc8ec08abe0acea1546479) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* boost: fix do_fetch failureStefan Ghinea2021-05-221-1/+1
| | | | | | | | | | | | | | | Bintray service has been discontinued causing boost do_fetch to fail: WARNING: boost-1.72.0-r0 do_fetch: Failed to fetch URL https://dl.bintray.com/boostorg/release/1.76.0/source/boost_1_72_0.tar.bz2, attempting MIRRORS if available (From OE-Core rev: ea7c3d5dce5e89ed746480b53789546222c961b5) Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6a76da15ece9d27fca20ace12db4978092e042b7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "cml1.bbclass: Return sorted list of cfg files"Richard Purdie2021-05-221-1/+1
| | | | | | | | | | | | | | This reverts commit dee41e92f0efac7e453597bed4b4c02f867e3aa9. This patch breaks cases where some config files make changes to earlier ones, ordering is important. The reproducibility issue in busybox was elsewhere. (From OE-Core rev: 37d71a7a290a24ee9f57a76725e27769588de0ca) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ab0a296607b58775e91948ba40956c666dbb1244) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: providers: selected version not available should be a warningRoss Burton2021-05-221-2/+2
| | | | | | | | | | | | | If the selected version if not available, bitbake will happily attempt to build something else. This should be a loud warning not a small note. (Bitbake rev: 078f3164dcb1de7a141bec3a8fd52631d0362631) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 78cd63285713fde59506eb2e71a7b7ee59a594ff) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta/lib/oe/rootfs.py: Fix typo "Restoreing" -> "Restoring"Robert P. J. Day2021-05-201-1/+1
| | | | | | | | | | (From OE-Core rev: cc49591d84d241d90e3dccb3e174ddfd737de311) Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2621dbbc1181808f18ca4ae79408d0d5b557670f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* image.bbclass: fix comment "pacackages" -> "packages"Robert P. J. Day2021-05-201-1/+1
| | | | | | | | | | (From OE-Core rev: f0a53e39130d73eba774e97249e0fd472ca5b66d) Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5c5f0d21799c2bff6875ef9fdc22d11035ea3320) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dejagnu: needs expect at runtimeRomain Naour2021-05-201-0/+1
| | | | | | | | | | | | | runtest return an error due to missing expect on the target. Add expect as runtime dependency. (From OE-Core rev: 381a5f3e409504b2a31710d971eef58346339ae4) Signed-off-by: Romain Naour <romain.naour@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d9a3a08edc1efcbe7b02e80be98370792d3c6cc2) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-yocto/5.4: qemuppc32: reduce serial shutdown issuesBruce Ashfield2021-05-203-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Integrating the following commit(s) to linux-yocto/5.4: qemuppc32: reduce serial issues seen on shutdown Richard reported: We've been seeing a lot of the qemuppc shutdown issue and I decided to look into it. The really worrying thing looking at the logs locally is the serial ports are showing irq issues and becoming disabled as nobody would handle them. Errors like: [ 9.194886] irq 36: nobody cared (try booting with the "irqpoll" option) [ 9.198712] CPU: 0 PID: 127 Comm: bootlogd Not tainted [ 9.202283] Call Trace: [ 9.205611] [d1005f00] [c00a0da8] __report_bad_irq+0x50/0x138 (unreliable) [ 9.209347] [d1005f30] [c00a0cc0] note_interrupt+0x324/0x378 [ 9.212855] [d1005f70] [c009d138] handle_irq_event+0xe8/0x104 [ 9.216353] [d1005fa0] [c00a1d9c] handle_fasteoi_irq+0xc0/0x29c [ 9.219960] [d1005fc0] [c009b798] generic_handle_irq+0x40/0x5c [ 9.223496] [d1005fd0] [c00075d0] __do_irq+0x58/0x188 [ 9.226948] [d1005ff0] [c0010040] call_do_irq+0x20/0x38 [ 9.230391] [d29eda60] [c0007788] do_IRQ+0x88/0xfc [ 9.233860] [d29eda90] [c0016454] ret_from_except+0x0/0x14 [ 9.237288] --- interrupt: 501 at __setup_irq+0x3c4/0x838 [ 9.237288] LR = __setup_irq+0x790/0x838 [ 9.244155] [d29edb88] [c009f0a4] request_threaded_irq+0x114/0x1c8 [ 9.247672] [d29edbb8] [c07a5a18] pmz_startup+0x17c/0x32c [ 9.251203] [d29edbd8] [c07a1140] uart_port_startup+0x184/0x2f8 [ 9.254651] [d29edc08] [c07a1974] uart_port_activate+0x78/0xf4 [ 9.258141] [d29edc28] [c07839f8] tty_port_open+0xd4/0x170 [ 9.261579] [d29edc58] [c079db74] uart_open+0x2c/0x48 [ 9.265116] [d29edc68] [c077a288] tty_open+0x168/0x640 [ 9.268574] [d29edcd8] [c0280be8] chrdev_open+0x138/0x2a4 [ 9.272123] [d29edd18] [c027421c] do_dentry_open+0x228/0x410 [ 9.275643] [d29edd48] [c028e9f4] path_openat+0xb04/0xf28 [ 9.279184] [d29eddd8] [c02917e4] do_filp_open+0x120/0x164 [ 9.282535] [d29ede98] [c0276238] do_sys_openat2+0xd8/0x19c [ 9.285790] [d29edee8] [c0276574] sys_openat+0x88/0xdc [ 9.289096] [d29edf38] [c00160d8] ret_from_syscall+0x0/0x34 [ 9.292620] --- interrupt: c01 at 0xfec3738 [ 9.292620] LR = 0xfec36e0 [ 9.299035] handlers: [ 9.302312] [<7f7f7da8>] pmz_interrupt [ 9.305541] Disabling IRQ #36 (and the irqpoll option does not help) This is problematic as the shutdown test uses the serial interface to shut down the system. If the serial interface fails to login or run the command, game over for the test. CONFIG_SERIAL_PMACZILOG_CONSOLE complicates that handling, but doesn't provide any output or capabilities that we need. So we disable it here, and reduce the chances of issues during shutdown. (From OE-Core rev: 9ee0f43414a121487fc3310f4d5635b09aa3e117) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 42355cb73049ee7a4af0f539a2a5b7d4ee1abc65) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-firmware: include all relevant files in -bcm4356Yann Dirson2021-05-201-2/+2
| | | | | | | | | | | | | This currently catches the .clb_blob and .vamrs,rock960.txt, and other .txt files may come in future upstream releases. (From OE-Core rev: 501cd3063af388dabd3329d2e69ac218ffd62a9e) Signed-off-by: Yann Dirson <yann@blade-group.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e332738a8aae0914c58b40faae8b9d7a82fd6a95) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-firmware: upgrade 20210208 -> 20210315Alexander Kanavin2021-05-201-2/+2
| | | | | | | | | | | | License-Update: additional firmware files, version changes (From OE-Core rev: c3d35ca5ca70af56956425cf0879ed3fa2970179) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2f10b9dbb4fb8ccb9a427883370fbbeb6f394551) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* db: update CVE_PRODUCTChen Qi2021-05-201-1/+1
| | | | | | | | | | | | | Update CVE_PRODUCT to also include 'berkeley_db'. For example, CVE-2020-2981 uses 'berkeley_db'. (From OE-Core rev: 753e6510df01fb4d71f46639bef06e1361f87170) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ad799b109716ccd2f44dcf7a6a4cfcbd622ea661) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lsb-release: fix reproducibility failureAnuj Mittal2021-05-202-0/+28
| | | | | | | | | | | | | | | | Make sure help2man output is reproducible. Fixes: | .\"·DO·NOT·MODIFY·THIS·FILE!··It·was·generated·by·help2man·1.022. .\"·DO·NOT·MODIFY·THIS·FILE!··It·was·generated·by·help2man·1.022. | .TH·FSG·"1"·"April·2021"·"FSG·lsb_release·v1.4"·FSG .TH·FSG·"1"·"May·2021"·"FSG·lsb_release·v1.4"·FSG | .SH·NAME 3 .SH·NAME (From OE-Core rev: a5f34c7a95d227610ed9b6047ed53f43f84cbba9) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 49371207a7f1fe3d3feb7b8b9aabb62b43ae34d1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/qemurunner: Improve handling of run_serial for shutdown commandsRichard Purdie2021-05-201-1/+6
| | | | | | | | | | | | | | When running a shutdown command, the serial port can close without the command returning. This is seen as the socket being readable but having no data. Change the way this case is handled in the code to avoid tracebacks. (From OE-Core rev: 9c0b242856de519c58be179f82441a35fc635ad9) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 396a3ba884820d040c91f7592daf20ac28c49b5d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/qemurunner: Fix binary vs str issueRichard Purdie2021-05-201-2/+2
| | | | | | | | | | | | | | | | | The recent logging changes for qemurunner showed up as errors on the autobuilder where decode couldn't be called on the returned string. Since the code returns binary data, return b'' instead of '' to match to avoid tracebacks. One of these cases was newly added, copied from the other which has been there for a long time, always broken. (From OE-Core rev: 8f24a7b35861b6aec39bc8d589e090ea9816732c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b8995b27db265b0a0b2d2ca595915f70f9f96e07) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/qemurunner: Improve logging thread exit handling for qemu shutdown testRichard Purdie2021-05-202-6/+15
| | | | | | | | | | | | | | | | | | Rather than totally disabling the logging, inform it we're about to exit so we can log messages over the exit cleanly too. This aids debugging. It also avoids a race where the logging handler could still error whilst shutting down. Also remove a race window by notificing the handler of the shutdown first, before triggering it. This removes a race window I watched in local testing. (From OE-Core rev: 57249316b6c66c5e17804e1b04f2d5cf0db92683) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0e19f31a1005f94105e1cef252abfffcef2aafad) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* avahi: Exclude CVE-2021-26720 from cve-checkRichard Purdie2021-05-201-0/+3
| | | | | | | | | | | Issue only affects Debian and SUSE. (From OE-Core rev: 760cc905fda18ee73ff3698a117f8841d3823b65) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 72522fa1a5f3b9b2855043fe6b421886d641385f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* librsvg: Exclude CVE-2018-1000041 from cve-checkRichard Purdie2021-05-201-0/+3
| | | | | | | | | | | Issue only affects windows. (From OE-Core rev: 9b214d503f3237fa7cd96c20686e610b09994823) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a90d3b056992346003d96765fc8639f5235cca55) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* coreutils: Exclude CVE-2016-2781 from cve-checkRichard Purdie2021-05-201-0/+4
| | | | | | | | | | | | | | http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=v8.27-101-gf5d7c0842 "Given runcon is not really a sandbox command, the advice is to use `runcon ... setsid ...` to avoid this particular issue. (From OE-Core rev: 1c18220fc8559f6423f9afd95a402753c2143e6b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2d273b5aed4a5bd509ec9c68a6f451c17ec17d0c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tiff: Exclude CVE-2015-7313 from cve-checkRichard Purdie2021-05-201-0/+4
| | | | | | | | | | | | Some fix upstream addresses the issue, it isn't clear which change this was. Our current version doesn't have issues with the test image though so we can exclude. (From OE-Core rev: 256f6be93eed82c7db8a76b1038e105331c0009f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3874da694ae1d9de06dd003bd80705205e2b033b) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez: Exclude CVE-2020-12352 CVE-2020-24490 from cve-checkRichard Purdie2021-05-201-0/+3
| | | | | | | | | | | These CVEs are fixed with kernel changes and don't affect the bluez recipe. (From OE-Core rev: d7779a9d58b088ce078956af4fdc0325d8c03c35) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 658902477840ea34d414083c4c79616bf5e999a2) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ghostscript: Exclude CVE-2013-6629 from cve-checkRichard Purdie2021-05-201-0/+4
| | | | | | | | | | | | The CVE is in the jpeg sources included with ghostscript. We use our own external jpeg library so this doesn't affect us. (From OE-Core rev: 829296767ecfbd443d738367b7146a91506e25f2) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8556d6a6722f21af5e6f97589bec3cbd31da206c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cpio: Exclude CVE-2010-4226 from cve-checkRichard Purdie2021-05-201-0/+3
| | | | | | | | | | | Issue applies to use of cpio in SUSE/OBS, doesn't apply to us. (From OE-Core rev: 0f759992b7713e9664a4276a068a65f5e638fe33) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 915b38c54a7932744a9f56713d1c6bd00a789331) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* unzip: Exclude CVE-2008-0888 from cve-checkRichard Purdie2021-05-201-0/+3
| | | | | | | | | | | | The patch mentioned as the fix for the CVE is applied to the 6.0 source code. Zip versioning makes CPE entry changes hard. (From OE-Core rev: 4ff9d2c57d9cade1faa3916f171e5ad96ee32487) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8917e5ae2bb44d017fc0155f16632c5decadb0bd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Exclude CVE-2008-3844 from cve-checkRichard Purdie2021-05-201-0/+3
| | | | | | | | | | | CVE only applies to some distributed RHEL binaries so irrelavent to us. (From OE-Core rev: 44d477b1cadc3e48c0a902123736fdf3bf2b412c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5d8b3ddf91050f6745a99a8abb1c3b03c35247af) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Exclude CVE-2007-2768 from cve-checkRichard Purdie2021-05-201-0/+3
| | | | | | | | | | | We don't build/use the OPIE PAM module, exclude the CVE from this recipe. (From OE-Core rev: d55474025a4518c674d9781c4c3b1ce5d6389466) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3670be602f2ace24dc49e196407efec577164050) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* logrotate: Exclude CVE-2011-1548,1549,1550 from cve-checkRichard Purdie2021-05-201-0/+3
| | | | | | | | | | | | These CVEs apply to the way logrotate was installed on Gentoo, Debian and SUSE, exclude from cve-check as they don't apply to OE. (From OE-Core rev: 99cb9534902717e637f1460c1d1c10d290bbebf2) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 23643016f3b8794db772e333ff0b8f598571b628) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* jquery: Exclude CVE-2007-2379 from cve-checkRichard Purdie2021-05-201-0/+5
| | | | | | | | | | | | | The CVE is non-specific and depends on the users of jquery, doesn't make sense to have this flagged against jquery as there is nothing we can do about it. (From OE-Core rev: d18ba3735ff3438ebd60b680e6bae5227c85bccb) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1f82843584f6d2843c5bbd2fe5dcbc654a0fbcfb) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Exclude CVE-2018-18438 from cve-checkRichard Purdie2021-05-201-0/+4
| | | | | | | | | | | | The issues were investigated and found not to be an issue therefore exclude from checks. (From OE-Core rev: 05f39301ab19a968916163b2d8f65beda7c09852) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ee6ee9bd489c126b99d15c1011560df2f840a6e9) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Exclude CVE-2007-0998 from cve-checkRichard Purdie2021-05-201-0/+4
| | | | | | | | | | | The CVE applies to the built-in VNC server but we don't enable this by default. (From OE-Core rev: f0e0787265d9d8bd01629f2b56a0eb57d950c037) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d62b9974a5f3a0f462434ce2763c28a4b4bbcfc6) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Exclude CVE-2017-5957 from cve-checkRichard Purdie2021-05-201-0/+3
| | | | | | | | | | | The CVE applies to virglrender before 0.6.0 which we don't have. (From OE-Core rev: 559ed3e62e542b7a4456a9a4eef8742ce8521dfb) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9b5355375d028577de0b98e05992de6a088cb972) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* builder: whitelist CVE-2008-4178 (a different builder)Ross Burton2021-05-201-0/+2
| | | | | | | | | | (From OE-Core rev: 095535506951172e6f1812506a14fc3400f8b96e) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 107987b342a834badfad286474b03543b4764d23) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libnotify: whitelist CVE-2013-7381 (specific to the NodeJS bindings)Ross Burton2021-05-201-0/+3
| | | | | | | | | | (From OE-Core rev: a6beac63da5294d02605100e6a47768c517280d9) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit be04484f99a5b29cc9066e350b526fc4420ad6d4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cairo: backport patch for CVE-2020-35492Ross Burton2021-05-202-0/+61
| | | | | | | | | (From OE-Core rev: 907e0edecbef830e1b057c58f5d398b57529f085) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0c4e6f99332ae253855708845a41fdfeb72d4c30) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: Document and whitelist CVE-2019-1010022-25Richard Purdie2021-05-201-0/+13
| | | | | | | | | | | | | | These CVEs are disputed by upstream and there is no plan to fix/address them. No other distros are carrying patches for them. There is a patch for 1010025 however it isn't merged upstream and probably carries more risk of other bugs than not having it. (From OE-Core rev: 2afbfc1eb6bc7613da4a7f06ac267ea561b5470e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b238db678083cc15313b98d2e33f83cccab03fc6) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-19 17:52:10 +0000