summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* gst-plugins-good: fix several CVEChee Yang Lee2022-09-166-0/+413
| | | | | | | | | | | | | | | | | | | backport fix for: CVE-2022-1920 CVE-2022-1921 CVE-2022-1922 CVE-2022-1923 CVE-2022-1924 CVE-2022-1925 CVE-2022-2122 also set ignore at gstreamer1.0_1.16.3.bb (From OE-Core rev: c852d3e6742fe82b9f4ec84b077d6e1b0bfd021e) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils : CVE-2022-38533Florin Diaconescu2022-09-162-0/+38
| | | | | | | | | | | Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ef186fe54aa6d281a3ff8a9528417e5cc614c797] (From OE-Core rev: 2cf26e2e5a83d2b2efd01de34c11da07eeb9c8f9) Signed-off-by: Florin Diaconescu <florin.diaconescu009@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Add 'no-dns-fallback' PACKAGECONFIG optionniko.mauno@vaisala.com2022-09-161-0/+1
| | | | | | | | | | | | | | | | | | | | | systemd defines a default set of fallback DNS servers in https://github.com/systemd/systemd/blob/v251/meson_options.txt#L328-L330 By adding a PACKAGECONFIG knob providing a convenient way to opt out, and then adding that value to systemd's PACKAGECONFIG, the output from runtime 'resolvectl status' command no longer contains the following line: Fallback DNS Servers: 1.1.1.1#cloudflare-dns.com 8.8.8.8#dns.google 1.0.0.1#cloudflare-dns.com 8.8.4.4#dns.google 2606:4700:4700::1111#cloudflare-dns.com 2001:4860:4860::8888#dns.google 2606:4700:4700::1001#cloudflare-dns.com 2001:4860:4860::8844#dns.google (From OE-Core rev: 2b300d6b9ec6288a99d9dacb24a86949caf99e55) (From OE-Core rev: 834ccad676b3d8d58d1a66bbe813a331599435b4) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Fix unwritable /var/lock when no sysvinit handlingniko.mauno@vaisala.com2022-09-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 8089cefed8e83c0348037768c292058f1bcbbbe5 ("systemd: Add PACKAGECONFIG for sysvinit") decoupled enabling of systemd's sysvinit handling behavior behind a distinct PACKAGECONFIG feature. This new option affects among other things the installing of tmpfiles.d/legacy.conf, which is responsible for creating /run/lock directory, which is pointed to by /var/lock symlink provided by base-files package. In case the option is not enabled, then base-files provided /var/lock is a dangling symlink on resulting rootfs, causing problems with certain Linux userspace components that rely on existence of writable /var/lock directory. As an example: # fw_printenv Error opening lock file /var/lock/fw_printenv.lock Since Filesystem Hierarchy Standard Version 3.0 states in https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch05s09.html that Lock files should be stored within the /var/lock directory structure. Ensure the /run/lock directory is always created, so that lock files can be stored under /var/lock also when 'sysvinit' handling is disabled. (From OE-Core rev: 85e5ee2c35cf5778c3aefda45f526e8f6a511131) (From OE-Core rev: b8aa4d53b636bec55ad0ff4de764222662647859) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* virglrenderer: fix CVE-2022-0135Chee Yang Lee2022-09-162-0/+101
| | | | | | | | (From OE-Core rev: 5eea0b24c6fcd90aab0737c7a3f7431535a02890) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnutls: fix CVE-2021-4209Chee Yang Lee2022-09-162-0/+38
| | | | | | | | (From OE-Core rev: d08031bffafbd2df7e938d5599af9e818bddba04) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* connman: fix CVE-2022-32292Chee Yang Lee2022-09-162-0/+38
| | | | | | | | (From OE-Core rev: 380b6fb2583f875aad0cb28c91b1531e63eb2eeb) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tiff: Security fixes CVE-2022-1354 and CVE-2022-1355Yi Zhao2022-09-163-0/+276
| | | | | | | | | | | | | | | | | | | | | | | | | | | | References: https://nvd.nist.gov/vuln/detail/CVE-2022-1354 https://security-tracker.debian.org/tracker/CVE-2022-1354 https://nvd.nist.gov/vuln/detail/CVE-2022-1355 https://security-tracker.debian.org/tracker/CVE-2022-1355 Patches from: CVE-2022-1354: https://gitlab.com/libtiff/libtiff/-/commit/87f580f39011109b3bb5f6eca13fac543a542798 CVE-2022-1355: https://gitlab.com/libtiff/libtiff/-/commit/c1ae29f9ebacd29b7c3e0c7db671af7db3584bc2 (From OE-Core rev: 6c373c041f1dd45458866408d1ca16d47cacbd86) (From OE-Core rev: 8414d39f3f89cc1176bd55c9455ad942db8ea4b1) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tiff: Fix for CVE-2022-2867/8/9Virendra Thakur2022-09-162-0/+160
| | | | | | | | | | | Add Patch to fix CVE-2022-2867, CVE-2022-2868 CVE-2022-2869 (From OE-Core rev: 67df7488bf66183ffdb9f497f00ad291b79210d3) Signed-off-by: Virendra Thakur <virendrak@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Fix CVE-2021-28861 for python3Khan@kpit.com2022-09-162-0/+136
| | | | | | | | | | | | | Add patch to fix CVE-2021-28861 CVE-2021-28861.patch Link: https://github.com/python/cpython/commit/4dc2cae3abd75f386374d0635d00443b897d0672 (From OE-Core rev: cbf57b25c78ea9d56863d9546b51fc2c88adb8cf) Signed-off-by: Riyaz Khan <rak3033@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0242 -> 9.0.0341Richard Purdie2022-09-121-2/+2
| | | | | | | | | | | | Addresses CVE-2022-2980, CVE-2022-2946 and CVE-2022-2982. (From OE-Core rev: c9a9d5a1f7fbe88422ccee542a89afbc4c5336e4) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 01c08d47ecfcc7aefacc8280e0055c75b13795b2) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: close cursors as soon as possibleRoss Burton2022-09-122-27/+37
| | | | | | | | | | | | | | | | We can have multiple processes reading the database at the same time, and cursors only release their locks when they're garbage collected. This might be the cause of random sqlite errors on the autobuilder, so explicitly close the cursors when we're done with them. (From OE-Core rev: 48742ddf4d0acd419c8ffb8f22124ed525efc2d9) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 5d2e90e4a58217a943ec21140bc2ecdd4357a98a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes: cve-check: Get shared database lockJoshua Watt2022-09-121-11/+12
| | | | | | | | | | | | | | | | The CVE check database needs to have a shared lock acquired on it before it is accessed. This to prevent cve-update-db-native from deleting the database file out from underneath it. [YOCTO #14899] (From OE-Core rev: 374dd13db2c4fa92793f12c93d68d09304f77c17) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 20a9911b73df62a0d0d1884e57085f13ac5016dd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libarchive: Fix CVE-2021-31566 issueRanjitsinh Rathod2022-09-123-0/+197
| | | | | | | | | | | Add patch to fix CVE-2021-31566 issue for libarchive Link: http://deb.debian.org/debian/pool/main/liba/libarchive/libarchive_3.4.3-2+deb11u1.debian.tar.xz (From OE-Core rev: 7028803d7d10c0b041a7bda16f9d9261f220459f) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libarchive: Fix CVE-2021-23177 issueRanjitsinh Rathod2022-09-122-0/+184
| | | | | | | | | | | Add patch to fix CVE-2021-23177 issue for libarchive Link: http://deb.debian.org/debian/pool/main/liba/libarchive/libarchive_3.4.3-2+deb11u1.debian.tar.xz (From OE-Core rev: 01d7e2c7a0da55a7c00aebed107c1338f5f032b1) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Backport patch for CVE-2022-35252Robert Joslyn2022-09-122-0/+73
| | | | | | | | | | https://curl.se/docs/CVE-2022-35252.html (From OE-Core rev: 59344420eb62060c79265a2557d2364c8174e46c) Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sqlite: CVE-2022-35737 assertion failureHitendra Prajapati2022-09-122-0/+30
| | | | | | | | | | | | | | | | Source: https://www.sqlite.org/ MR: 120541 Type: Security Fix Disposition: Backport from https://www.sqlite.org/src/info/aab790a16e1bdff7 ChangeID: cf6d0962be0d1f7d4a5019843da6349eb7f9acda Description: CVE-2022-35737 sqlite: assertion failure via query when compiled with -DSQLITE_ENABLE_STAT4. (From OE-Core rev: 226f9458075061cb99d71bee737bafbe73469c22) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* relocate_sdk.py: ensure interpreter size error causes relocation to failPaul Eggleton2022-09-031-2/+8
| | | | | | | | | | | | | | | | | If there is insufficent space to change the interpreter, we were printing an error here but the overall script did not return an error code, and thus the SDK installation appeared to succeed - but some of the binaries will not be in a working state. Allow the relocation to proceed (so we still get a full list of the failures) but error out at the end so that the installation is halted. (From OE-Core rev: 345193f36d08cfe4899c65e8edf3f79db09c50d2) Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c5a9a448e462d3e5457e8403c5a1a54148ecd224) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cryptodev-module: fix build with 5.11+ kernelsAnuj Mittal2022-09-032-0/+33
| | | | | | | | | | | | | | | | Backport patch to fix: | cryptodev-module/1.10-r0/git/ioctl.c:875:4: error: implicit declaration of function 'ksys_close'; did you mean 'ksys_chown'? [-Werror=implicit-function-declaration] | 875 | ksys_close(fd); | | ^~~~~~~~~~ | | ksys_chown | cc1: some warnings being treated as errors (From OE-Core rev: 653b03aa6fc8effd3b2215a7a0ba005979e78e9f) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-yocto/5.4: update to v5.4.210Bruce Ashfield2022-09-033-18/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Updating to the latest korg -stable release that comprises the following commits: de0cd3ea700d Linux 5.4.210 b58882c69f66 x86/speculation: Add LFENCE to RSB fill sequence f2f41ef0352d x86/speculation: Add RSB VM Exit protections 3a0ef79c6abe macintosh/adb: fix oob read in do_adb_query() function 54e1abbe8560 media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls 17c2356e467f selftests: KVM: Handle compiler optimizations in ucall 170465715a60 KVM: Don't null dereference ops->destroy 6098562ed9df selftests/bpf: Fix "dubious pointer arithmetic" test 6a9b3f0f3bad selftests/bpf: Fix test_align verifier log patterns 9d6f67365d9c bpf: Test_verifier, #70 error message updates for 32-bit right shift 751f05bc6f95 selftests/bpf: Extend verifier and bpf_sock tests for dst_port loads 7c1134c7da99 bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() a8ba72bbeda5 ACPI: APEI: Better fix to avoid spamming the console with old error logs fa829bd4af43 ACPI: video: Shortening quirk list by identifying Clevo by board_name only 8ed6e5c5e23c ACPI: video: Force backlight native for some TongFang devices 828f4c31684d thermal: Fix NULL pointer dereferences in of_thermal_ functions (From OE-Core rev: 2663435831c0ef953fb7fe6c883f42cf0c86ae43) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wireless-regdb: upgrade 2022.06.06 -> 2022.08.12Alexander Kanavin2022-09-031-1/+1
| | | | | | | | | | | (From OE-Core rev: 8b69eafa5c624dfc169ee11ced685847332437fa) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 75386480abd1660a50c79d5987b77ccc43295511) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tzdata: upgrade 2022a -> 2022bAlexander Kanavin2022-09-031-3/+3
| | | | | | | | | | | (From OE-Core rev: b0a0abbcc5e631e693b9e896bd0fc9b9432dd297) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b301d5203a4da0a0985670848126c5db762ddc86) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mobile-broadband-provider-info: upgrade 20220511 -> 20220725Alexander Kanavin2022-09-031-2/+2
| | | | | | | | | | | (From OE-Core rev: 5dd5130f9b13212a4f5e8b075ae1ecda868c5f28) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 96185dac787e14fa9eb77d009653a2fd4d926e3f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0115 -> 9.0.0242Richard Purdie2022-09-031-2/+2
| | | | | | | | | | | | | | | | | | | | Includes fixes for: CVE-2022-2816 CVE-2022-2817 CVE-2022-2819 CVE-2022-2845 CVE-2022-2849 CVE-2022-2862 CVE-2022-2874 CVE-2022-2889 (From OE-Core rev: 169537045e614aa08052fd0130ea3199523bc8f3) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3ec2d27d09444213ec1c9b91c6f8c4363f297294) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: Don't use f-stringsErnst Sjöstrand2022-09-031-1/+1
| | | | | | | | | | | | | | Since we're keeping cve-check aligned between the active branches, and dunfell is supported on Python 3.5, we can't use f-strings. (From OE-Core rev: 4cc681fd66031c8355f69e53443536b31377eba9) Signed-off-by: Ernst Sjöstrand <ernstp@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1821cf7464cbba521b55a9c128fe8812c0cc5eca) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Add fix for CVE-2016-3709Pawan Badganchi2022-09-032-0/+90
| | | | | | | | | | | | | Add below patch to fix CVE-2016-3709 CVE-2016-3709.patch Link: https://github.com/GNOME/libxml2/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f (From OE-Core rev: b9312041e4c8d565ad1e1102f8634bcc913adfa7) Signed-off-by: Pawan Badganchi<pawan.badganchi@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: CVE-2022-32189 a denial of serviceHitendra Prajapati2022-09-032-0/+114
| | | | | | | | | | | | | | | | Source: https://github.com/golang/go MR: 120634 Type: Security Fix Disposition: Backport from https://github.com/golang/go/commit/703c8ab7e5ba75c95553d4e249309297abad7102 ChangeID: 3ade323dd52a6b654358f6738a0b3411ccc6d3f8 Description: CVE-2022-32189 golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service. (From OE-Core rev: 9b3420c9a91059eb55754078bb1e733972e94489) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2022-30635 and CVE-2022-32148Hitendra Prajapati2022-09-033-0/+171
| | | | | | | | | | | | | | | | | | Source: https://github.com/golang/go MR: 120628, 120631 Type: Security Fix Disposition: Backport from https://github.com/golang/go/commit/ed2f33e1a7e0d18f61bd56f7ee067331d612c27e && https://github.com/golang/go/commit/ed2f33e1a7e0d18f61bd56f7ee067331d612c27e ChangeID: fbd8d61bdc2e9cb0cdbe9879e02aed218ee93dbe Description: Fixed CVE: 1. CVE-2022-30635 2. CVE-2022-32148 (From OE-Core rev: 2c4fb77f417464d9cd40f0ebd8cc52e6e6ca689e) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2022-30632 and CVE-2022-30633Hitendra Prajapati2022-09-033-0/+204
| | | | | | | | | | | | | | | | | | Source: https://github.com/golang/go MR: 120622, 120625 Type: Security Fix Disposition: Backport from https://github.com/golang/go/commit/76f8b7304d1f7c25834e2a0cc9e88c55276c47df && https://github.com/golang/go/commit/2678d0c957193dceef336c969a9da74dd716a827 ChangeID: aabb29a6dd6a89842f451c95af228aaf66e58bb5 Description: Fixed CVE: 1. CVE-2022-30632 2. CVE-2022-30633 (From OE-Core rev: 9ffaae887743d77839fb758657b1dec71a9b8880) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2022-30629 and CVE-2022-30631Hitendra Prajapati2022-09-033-0/+165
| | | | | | | | | | | | | | | | | | Source: https://github.com/golang/go MR: 120613, 120613 Type: Security Fix Disposition: Backport from https://github.com/golang/go/commit/c15a8e2dbb5ac376a6ed890735341b812d6b965c && https://github.com/golang/go/commit/0117dee7dccbbd7803d88f65a2ce8bd686219ad3 ChangeID: 366db775dec045d7b312b8da0436af36ab322046 Description: Fixed CVE: 1. CVE-2022-30629 2. CVE-2022-30631 (From OE-Core rev: 6813a265c7c21e24636d07a6a8df16ef0cf7da50) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtiff: CVE-2022-34526 A stack overflow was discoveredHitendra Prajapati2022-09-032-0/+30
| | | | | | | | | | | | | | | | Source: https://gitlab.com/libtiff/libtiff MR: 120545 Type: Security Fix Disposition: Backport from https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990 ChangeID: 4c781586f7aba27420a7adc0adc597cc68495387 Description: CVE-2022-34526 libtiff: A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit. (From OE-Core rev: 462d4a55a460c60a7b8c36fe3899e66f13835761) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: utils: Pass lock argument in fileslockedJoshua Watt2022-09-021-2/+4
| | | | | | | | | | | | Pass additional arguments in the fileslocked() context manager to the underlying lockfile() function. This allows the context manager to be used for any types of locks (non-blocking, shared, etc.) that the lockfile() function supports. (Bitbake rev: 048d682b031644fb9f0d41a489bacb873aa27bd7) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual: add numa to machine featuresJon Mason2022-08-311-0/+2
| | | | | | | | | | | numa is an existing machine feature, add it to the list so that users are aware of it. (From yocto-docs rev: d9931a04bccd115f854275cd46c8195c3fa1d391) Signed-off-by: Jon Mason <jdmason@kudzu.us> Reviewed-by: Quentin Schulz <foss+yocto@0leil.net> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: runqueue: Change pressure file warning to a noteRichard Purdie2022-08-241-1/+1
| | | | | | | | | The user does need to be told about this but it isn't really a warning, just something they may need to be aware of. Drop the level accordingly. (Bitbake rev: 3b719e8e115b7fde869f62ddc180e045c1b51cdf) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: bitbake: runqueue: add memory pressure regulationAryaman Gupta2022-08-231-5/+22
| | | | | | | | | | | | | | | | | | | | | Prevent new tasks from being scheduled if the memory pressure is above a certain threshold, specified through the "BB_MAX_PRESSURE_MEMORY" variable in the conf/local.conf file. This is an extension to the following commit and hence regulates pressure in the same way: 48a6d84de1 bitbake: runqueue: add cpu/io pressure regulation Memory pressure is experienced when time is spent swapping, refaulting pages from the page cache or performing direct reclaim. This is why memory pressure is rarely seen but might be useful as a last resort to prevent OOM errors. (Bitbake rev: 44c395434c7be8dab968630a610c8807f512920c) (Bitbake rev: 82b683f8c7a559f4fcab68f6a0fa7dc3dc20fa05) Signed-off-by: Aryaman Gupta <aryaman.gupta@windriver.com> Signed-off-by: Randy Macleod <Randy.Macleod@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: bitbake: runqueue: add cpu/io pressure regulationAryaman Gupta2022-08-231-0/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prevent the scheduler from starting new tasks if the current cpu or io pressure is above a certain threshold and there is at least one active task. This threshold can be specified through the "BB_PRESSURE_MAX_{CPU|IO}" variables in conf/local.conf. The threshold represents the difference in "total" pressure from the previous second. The pressure data is discussed in this oe-core commit: 061931520b buildstats.py: enable collection of /proc/pressure data where one can see that the average and "total" values are available. >From tests, it was seen that while using the averaged data was somewhat useful, the latency in regulating builds was too high. By taking the difference between the current pressure and the pressure seen in the previous second, better regulation occurs. Using a shorter time period is appealing but due to fluctations in pressure, comparing the current pressure to 1 second ago achieves a reasonable compromise. One can look at the buildstats logs, that usually sample once per second, to decide a sensible threshold. If the thresholds aren't specified, pressure is not monitored and hence there is no impact on build times. Arbitary lower limit of 1.0 results in a fatal error to avoid extremely long builds. If the limits are higher than 1,000,000, then warnings are issued to inform users that the specified limit is very high and unlikely to result in any regulation. The current bitbake scheduling algorithm requires that at least one task be active. This means that if high pressure is seen, then new tasks will not be started and pressure will be checked only for as long as at least one task is active. When there are no active tasks, an additional task will be started and pressure checking resumed. This behaviour means that if an external source is causing the pressure to exceed the threshold, bitbake will continue to make some progress towards the requested target. This violates the intent of limiting pressure but, given the current scheduling algorithm as described above, there seems to be no other option. In the case where only one bitbake build is running, the implications of the scheduler requirement will likely result in pressure being higher than the threshold. More work would be required to ensure that the pressure threshold is never exceeded, for example by adding pressure monitoring to make and ninja. (Bitbake rev: 502e05cbe67fb7a0e804dcc2cc0764a2e05c014f) (Bitbake rev: 66741d216e9d4343e82a94f00cd39751632a5b96) Signed-off-by: Aryaman Gupta <aryaman.gupta@windriver.com> Signed-off-by: Randy Macleod <randy.macleod@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.19dunfell-23.0.19Richard Purdie2022-08-221-1/+1
| | | | | | (From OE-Core rev: a3cba15142e98177119ef36c09f553d09acf35ef) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* poky.conf: bump version for 3.1.19 releaseSteve Sakoman2022-08-221-1/+1
| | | | | | | (From meta-yocto rev: 2de758bc8a4ead8e89619766d5096604b554f2c1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* documentation: update for 3.1.19 releaseSteve Sakoman2022-08-221-5/+5
| | | | | | | (From yocto-docs rev: 95e030ec74f69eccabcc97737c8a93fd7629f9d9) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: fetch2/wget: Update user-agentChristophe Priouzeau2022-08-221-3/+8
| | | | | | | | | | | | | | | With the usage of enterprise proxy, the user-agent defined are too old and refused by proxy configuration. Updating to something more modern is desirable. (Bitbake rev: 17be38290d1e971cd89785e6bf44caef0a6416f8) Signed-off-by: Christophe Priouzeau <christophe.priouzeau@st.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7001fdd7c4dca372cbebd8fd2c0b03c5d43f9400) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* initscripts: run umountnfs as a KILL scriptShruthi Ravichandran2022-08-221-1/+1
| | | | | | | | | | | | | | | | | | | | `rc` runs all the KILL scripts in a runlevel before the START scripts. The umountnfs script is currently configured as a START script, and runs after the networking KILL script. During shutdown, this causes a ~3 minute timeout after networking is shutdown when the system tries to connect to and unmount any mounted network shares. Fix this by changing the script configuration to "stop" so that it can run before networking is stopped and unmount any network shares safely. (From OE-Core rev: e59c72d570102d72786e44c8ace69fd4d0e8e5ef) Signed-off-by: Shruthi Ravichandran <shruthi.ravichandran@ni.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c419bd4537756e9f6c2fe6da3a9b798526e27eca) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rootfs-postcommands.bbclass: move host-user-contaminated.txt to ${S}Ming Liu2022-08-221-1/+1
| | | | | | | | | | | | | | | This is to ensure host-user-contaminated.txt would be removed before do_rootfs runs, since ${S} is in cleandirs of do_rootfs, otherwise, a host-user-contaminated.txt file that generated from previous builds could be used which is wrong. (From OE-Core rev: 06cfa8be54c9aee23bd8570a370a974b463a0a1a) Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 54a3fd63e684d070fad962be97e549f3af7ac111) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bin_package: install into base_prefixPascal Bach2022-08-221-1/+2
| | | | | | | | | | | | This makes the bin_package.bbclass work properly with the native class. (From OE-Core rev: 0bf78a8e0e1cf7e74b55aca4db0e62dd9dfa55ce) Signed-off-by: Pascal Bach <pascal.bach@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ad330b6d4b6e2ba051b5c6c437e07a183831f757) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-arch: Fix buildpaths leaking into external module compilesRichard Purdie2022-08-221-1/+1
| | | | | | | | | | | | | | | Building external kernel modules like lttng-modules was showing build paths inside the debug symbols for the modules and breaking build reproducibility. Fix this by adding in the mapping needed to map the kernel build directory to something more approriate on target. (From OE-Core rev: c4d8834ed3d200f25f12fec8acfa2b954f3240e0) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b56dc9009ba93174de6bf4c01e17808ef249dc5c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-firwmare: restore WHENCE_CHKSUM variableDmitry Baryshkov2022-08-221-1/+4
| | | | | | | | | | | | | | | | | | | | | | Restore WHENCE_CHKSUM variable which is used to hold the WHENCE file checksum. It is necessary to allow easily overriding it from local.conf if the devupstream version is selected: PREFERRED_VERSION_linux-firmware = "1:20220708+git%" SRCREV:class-devupstream = "${AUTOREV}" WHENCE_CHKSUM:class-devupstream:pn-linux-firmware = "abf1077491eeb261ecdcb680a34fc059" Without the WHENCE_CHECKSUM one would need to manually patch the LIC_FILES_CHKSUM variable to change the checksum of WHENC (e.g. using the anonymous python function or remove expression). (From OE-Core rev: ba997f02b2cb86aeaa308873727a9280d1f88b5b) Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 554be2af1e0a03a2d23032d48afbbe0913a45409) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-firmware: update 20220610 -> 20220708Alexander Kanavin2022-08-221-11/+2
| | | | | | | | | | | | | | License-Update: a few obsolete firmware were dropped (particularly i2400m and tda7706), file list updates. (From OE-Core rev: a151460d9234d6cd0bd1920c48aff8c78454931a) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e89fb37e13fcb832ee7d35e7d92d45eaca20689e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: update from 9.0.0063 to 9.0.0115Randy MacLeod2022-08-223-92/+2
| | | | | | | | | | | | | | | | | | | | Drop crosscompile.patch which was merged as part of: 509695c1c (tag: v9.0.0065) patch 9.0.0065: \ cross-compiling doesn't work because of timer_create check Also drop: racefix.patch which may have been fixed upstream and is being tracked by: https://github.com/vim/vim/pull/10776 where upstream is asking if the different approach resolves the race condition. Let's see what's out there! (From OE-Core rev: 083d6de4139859a5eb66f78c2a62a1d59c8aee35) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 6996472cd33d2d4b91821f2dfe24a27a697e4afe) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0021 -> 9.0.0063Richard Purdie2022-08-223-6/+67
| | | | | | | | | | | | | | | | | | Pulls in several CVE fixes. Added a patch to avoid timer_create cross compile issue (and submitted upstream). Also submit the race fix upstream. We disable timer_create in the native case since some systems have it and some don't so this makes us consistent. Change from master commit: we also disable timer_create in the target case since the function isn't available in our glibc. (From OE-Core rev: f99677f79449032a3b0ea79d704fdccbd5be68b7) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d0c1de084c7ce030d47a428e4bbfbc4ce2996057) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* zlib: CVE-2022-37434 a heap-based buffer over-readHitendra Prajapati2022-08-222-0/+45
| | | | | | | | | | | | | | | | Source: https://github.com/madler/zlib MR: 120531 Type: Security Fix Disposition: Backport from https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1 & https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d ChangeID: 364c17d74213c64fe40b9b37ee78aa172ff93acf Description: CVE-2022-37434 zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. (From OE-Core rev: 10ed7cf347d9e73b29e4a3f6ef77e0a4b08e350b) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnutls: CVE-2022-2509 Double free during gnutls_pkcs7_verifyHitendra Prajapati2022-08-222-0/+283
| | | | | | | | | | | | | | | | Source: https://gitlab.com/gnutls/gnutls MR: 120421 Type: Security Fix Disposition: Backport from https://gitlab.com/gnutls/gnutls/-/commit/ce37f9eb265dbe9b6d597f5767449e8ee95848e2 ChangeID: f0c84c6aa8178582ac9838c453dacdf2c7cae0e5 Description: CVE-2022-2509 gnutls: Double free during gnutls_pkcs7_verify. (From OE-Core rev: 4cac37913d08f433668778e788f01e009dbb94bd) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-09 14:36:14 +0000