summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* rpm: Fix rpm CVE CVE-2021-3521Riyaz Khan2022-12-235-0/+483
| | | | | | | | | | | | | | | | | | | Links: Dependent Patches: CVE-2021-3521-01 https://github.com/rpm-software-management/rpm/commit/b5e8bc74b2b05aa557f663fe227b94d2bc64fbd8 CVE-2021-3521-02 https://github.com/rpm-software-management/rpm/commit/9f03f42e2614a68f589f9db8fe76287146522c0c CVE-2021-3521-03 https://github.com/rpm-software-management/rpm/commit/5ff86764b17f31535cb247543a90dd739076ec38 CVE-2021-3521 https://github.com/rpm-software-management/rpm/commit/bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8 (From OE-Core rev: ddb4f775a86855e4ddc6c0d0d1f24a55e0ecbfe0) Signed-off-by: Riyaz Khan <Riyaz.Khan@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xserver-xorg: backport fixes for CVE-2022-3550, CVE-2022-3551 and CVE-2022-3553Minjae Kim2022-12-234-0/+156
| | | | | | | | | | | | | | | | | | | | | <CVE-2022-3550> xkb: proof GetCountedString against request length attacks Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=11beef0b7f1ed290348e45618e5fa0d2bffcb72e] <CVE-2022-3551> xkb: fix some possible memleaks in XkbGetKbdByName Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=18f91b950e22c2a342a4fbc55e9ddf7534a707d2] <CVE-2022-3553> xquartz: Fix a possible crash when editing the Application menu due to mutaing immutable arrays Upstream-Status: Backport[https://cgit.freedesktop.org/xorg/xserver/commit/?id=dfd057996b26420309c324ec844a5ba6dd07eda3] (From OE-Core rev: 081ac12677096886b25023a03df06b99585ef18c) Signed-off-by:Minjae Kim <flowergom@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-yocto/5.4: update genericx86* machines to v5.4.219Ravula Adhitya Siddartha2022-12-191-4/+4
| | | | | | | | (From meta-yocto rev: 1a19e6d4eae26106378d28153db1fd44804770f1) Signed-off-by: Ravula Adhitya Siddartha <adhityax.siddartha.ravula@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dev-manual: update session about multiconfigMichael Opdenacker2022-12-081-37/+31
| | | | | | | | | | | Aligning with contents from the "master" branch. [YOCTO #14980] (From yocto-docs rev: 4961ddc9848f6569307107c10ff132532944ccaa) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Reported-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel.bbclass: make KERNEL_DEBUG_TIMESTAMPS work at rebuildChen Qi2022-12-071-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, the KERNEL_DEBUG_TIMESTAMPS is not working as expected at rebuild. That is, even if we set it to "1", the kernel build time is not changed. The problem could be reproduced by the following steps. 1. bitbake core-image-minimal; start image and check `uname -a` output. 2. set in local.conf: KERNEL_DEBUG_TIMESTAMPS = "1" 3. bitbake core-image-minimal; start image and check `uname -a` output. It's expected that after enabling KERNEL_DEBUG_TIMESTAMPS, the kernel build time will be set to current date. But it's not. This is because the compile.h was not re-generated when do_compile task was re-executed. In mkcompile_h, we have: """ # Only replace the real compile.h if the new one is different, # in order to preserve the timestamp and avoid unnecessary # recompilations. # We don't consider the file changed if only the date/time changed, # unless KBUILD_BUILD_TIMESTAMP was explicitly set (e.g. for # reproducible builds with that value referring to a commit timestamp). # A kernel config change will increase the generation number, thus # causing compile.h to be updated (including date/time) due to the # changed comment in the # first line. """ It has made it very clear that it will not be re-generated unless we have KBUILD_BUILD_TIMESTAMP set explicitly. So we set this variable explicitly in do_compile to fix this issue. (From OE-Core rev: e44f0cda8176186d42a752631810c1cb5f1971eb) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 1b68c2d2d385013a1c535ef81172494302a36d74) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel: improve transformation from KERNEL_IMAGETYPE_FOR_MAKEMike Crowe2022-12-071-3/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In 526bdd88ccd758204452579333ba188e29270bde the imageType loop in kernel_do_deploy was changed to use KERNEL_IMAGETYPE_FOR_MAKE rather than KERNEL_IMAGETYPES. This broke the special handling for fitImage immediately below because KERNEL_IMAGETYPE_FOR_MAKE never contains fitImage. It has always been my understanding that KERNEL_IMAGETYPE_FOR_MAKE controlled what was passed to make, but KERNEL_IMAGETYPE controlled what was installed/deployed. When the two are different then it's the responsibility of whoever set KERNEL_IMAGETYPE_FOR_MAKE to ensure that whatever comes out of the kernel build system has been transformed in to the requested form by the time of installation. This is what happens for kernel.bbclass's own support for vmlinux.gz. I think this means that for KERNEL_IMAGETYPE vmlinux.gz, kernel.bbclass is responsible for generating vmlinux.gz.initramfs[1] so that kernel_do_deploy can deploy it. This means that the change in 526bdd88ccd758204452579333ba188e29270bde can be reverted, fixing KERNEL_IMAGETYPE = "fitImage". In addition, it ought to be possible for recipes and other classes that use kernel.bbclass to hook into this mechanism by setting KERNEL_IMAGETYPE_FOR_MAKE and performing their own transformations. do_bundle_initramfs calls kernel_do_compile and we don't want it to transform vmlinux to vmlinux.gz at that point, since it will fight against the careful renaming and preserving that do_bundle_initramfs does. Let's separate the transformation out of kernel_do_compile to a new do_transform_kernel task that can be run at the right time. This means that it's also logical to perform the equivalent translation for the kernel with the initramfs in a separate do_transform_bundled_initramfs task too. This leaves two clear customisation points for recipes and other classes to hook into the process and perform their transformations: do_transform_kernel and do_transform_bundled_initramfs. (I care about this because our recipes that use kernel.bbclass also set KERNEL_IMAGETYPE_FOR_MAKE and transform vmlinux into a form suitable for our bootloader after do_compile and do_bundle_initramfs into the format matching KERNEL_IMAGETYPE. I'm unable to successfully bundle an initramfs after 526bdd88ccd758204452579333ba188e29270bde, but I didn't want to just revert that change to reintroduce the bug that it was fixing.) I can't say that I'm entirely happy with this change, but I'm unsure what to do to improve it. I find the way that both the bare kernel and the one with the initramfs both get deployed to be confusing, and a waste of build time. I would like to not actually generate a publishable kernel image at all during do_compile when an initramfs is in use, but I suspect that this would affect valid use cases that I'm not aware of. (From OE-Core rev: d9e9653616638f2b187d5e04540071ac34d99f56) Signed-off-by: Mike Crowe <mac@mcrowe.com> [1] It could be argued that this should be vmlinux.initramfs.gz, but that would require another special case in kernel_do_deploy and the filename is only visible within this class and the recipes that use it anyway. Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 10a4a132e87e835726bf5da81a60f6f509b90765) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mobile-broadband-provider-info: upgrade 20220725 -> 20221107Wang Mingyu2022-12-071-2/+2
| | | | | | | | | | (From OE-Core rev: 5d1add59695baf597ff52ae97844572215fa325b) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7e12fa1e6250fc358ba159a6b626458d871f7ccf) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-firmware: upgrade 20221012 -> 20221109Dmitry Baryshkov2022-12-071-2/+2
| | | | | | | | | | | License-Update: additional files (From OE-Core rev: bb804245dea980796e8f861fabef46cf3572e462) Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 6940f297243a66bd58d6adee7d690bcee9b9ccb2) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-firmware: upgrade 20220913 -> 20221012Alexander Kanavin2022-12-071-3/+3
| | | | | | | | | | | | License-Update: copyright years, additional firmwares (From OE-Core rev: 2e31e08b5792828d7969f9642190b24e56319ab7) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 9f658c724b6635e5745f30b25601bcc51a004be4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2021-20196 block fdc null pointer dereference may lead to ↵Vivek Kumbhar2022-12-072-0/+63
| | | | | | | | | | | | guest crash Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/1ab95af033a419e7a64e2d58e67dd96b20af5233] (From OE-Core rev: 1523fcbb6fef60d30c07377673fca265c5c9781c) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pixman: backport fix for CVE-2022-44638Ross Burton2022-12-072-0/+35
| | | | | | | | | | | | | | | | (From OE-Core rev: 1d2e131d9ba55626354264d454b2808e84751600) (From OE-Core rev: fe5a5009939f056ff4d9d3426832d0b67a668ed6) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 23df4760ebc153c484d467e51b414910c570a6f8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 37595eeddfb01110d8cdc628be76a8bf6bde483a) Signed-off-by: Bhabu Bindu <bindu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sstate: Account for reserved characters when shortening sstate filenamesManuel Leonhardt2022-12-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Previously, when shortening sstate filenames, the reserved characters for .siginfo were not considered, when siginfo=False, resulting in differently shortend filenames for the sstate and siginfo files. With this change, the filenames of the truncated sstate and siginfo files have the same basename, just as is already the case for untruncated filenames. Making sure that the .siginfo files always have the filename of the corresponding sstate file plus its .siginfo suffix, also when being truncated, makes it easier to manage the sstate cache and an sstate mirror outside of Bitbake/Yocto. (From OE-Core rev: 408bf1b4bb4f4ed126c17fb3676f9fa0513065ba) Signed-off-by: Manuel Leonhardt <mleonhardt@arri.de> Cc: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c2e0e43b7123cf5149833e0072c8edaea3629112) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.0614 -> 9.0.0820Tim Orling2022-12-071-2/+2
| | | | | | | | | | | | | | | | | Includes fixes for CVE-2022-3705 https://nvd.nist.gov/vuln/detail/CVE-2022-3705 For a short list of important changes, see: https://www.arp242.net/vimlog/ (From OE-Core rev: 3251dc441a31b2d4d7acb690bd6db13f0f99a1d0) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f6d917bd0f8810b5ed8d403ad25d59cda2fc9574) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* maintainers: update gcc version to 9.5Steve Sakoman2022-12-071-1/+1
| | | | | SIgned-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc: upgrade to v9.5Sundeep KOKKONDA2022-12-0755-1636/+4
| | | | | | | | | | | | | gcc stable version upgraded from v9.3 to v9.5 Below is the bug fix list for v9.5 https://gcc.gnu.org/bugzilla/buglist.cgi?bug_status=RESOLVED&resolution=FIXED&target_milestone=9.5 (From OE-Core rev: 698c3323fd95592e815345acd9070e5089a1bd00) Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2022-30630Ralph Siemsen2022-12-071-0/+3
| | | | | | | | | | | | | | The CVE is in the io/fs package, which first appeared in go1.16. Since dunfell is using go1.14, this issue does not apply. CVE was fixed in fa2d41d0ca736f3ad6b200b2a4e134364e9acc59 Original code in b64202bc29b9c1cf0118878d1c0acc9cdb2308f6 (From OE-Core rev: 1e258940e9a6fabda6e7e60841082c113fdf9500) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2022-30580Ralph Siemsen2022-12-071-0/+1
| | | | | | | | | | | | | | | | Only affects Windows platform, as per the release announcement [1]: "If, on Windows, Cmd.Run, cmd.Start, cmd.Output, or cmd.CombinedOutput are executed when Cmd.Path is unset and, in the working directory, there are binaries named either "..com" or "..exe", they will be executed." [1] https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ (From OE-Core rev: 54c40730bc54aa2b2c12b37decbcc99bbcafd07a) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2021-41772Ralph Siemsen2022-12-071-0/+3
| | | | | | | | | | | | | | | | | Dunfell uses golang 1.14 which does not contain the affected code (it was introduced in golang 1.16). From the golang announcement [1] "Reader.Open (the API implementing io/fs.FS introduced in Go 1.16) can be made to panic by an attacker providing either a crafted ZIP archive containing completely invalid names or an empty filename argument. [1] https://groups.google.com/g/golang-announce/c/0fM21h43arc (From OE-Core rev: 2329902f994b631d6b77e8bd501d5599db6d5306) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2021-33194Ralph Siemsen2022-12-071-0/+3
| | | | | | | | | | | | | This is a bug in golang.org/x/net/html/parse.go. The golang compiler includes a partial copy of this under src/vendor/golang.org/x/net/ however the "html" subdirectory is not included. So this bug does not apply to the compiler itself. (From OE-Core rev: b8a851faef9990ccb41ded875fc79cf28abd4a4e) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2022-29804Ralph Siemsen2022-12-071-0/+1
| | | | | | | | | | | | | | | The issue only affects Windows per the golang announcement [1]: On Windows, the filepath.Clean function could convert an invalid path to a valid, absolute path. For example, Clean(`.\c:`) returned `c:`. [1] https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg (From OE-Core rev: bca720eca95929752436b56aa01e7fddfa1c834f) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2022-28327Ralph Siemsen2022-12-072-0/+37
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/7139e8b024604ab168b51b99c6e8168257a5bf58] CVE: CVE-2022-28327 (From OE-Core rev: aab2a343be4b0b21dcaf22a7fbf77007d48c08d6) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2022-28131Ralph Siemsen2022-12-072-0/+105
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/58facfbe7db2fbb9afed794b281a70bdb12a60ae] CVE: CVE-2022-28131 (From OE-Core rev: 09a820fe21d7884c6733d569f6560ef1ded5435d) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2022-24291Ralph Siemsen2022-12-072-0/+199
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/2b65cde5868d8245ef8a0b8eba1e361440252d3b] CVE: CVE-2022-24921 (From OE-Core rev: a2d3d80a7df5b8f57105ef2b680e9e01a9da6486) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2021-44716Ralph Siemsen2022-12-072-0/+94
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/d0aebe3e74fe14799f97ddd3f01129697c6a290a] CVE: CVE-2021-44716 (From OE-Core rev: c5ec3e8701a1b81d8e5b17d2521530345892a09b) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2021-33198Ralph Siemsen2022-12-072-0/+114
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/df9ce19db6df32d94eae8760927bdfbc595433c3] CVE: CVE-2021-33198 (From OE-Core rev: 078260dd63e205d3a433b03357f2332f44daa397) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2021-33195Ralph Siemsen2022-12-072-0/+374
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/31d60cda1f58b7558fc5725d2b9e4531655d980e] CVE: CVE-2021-33195 (From OE-Core rev: f1051e11fd0eb5b0e9924a0acdcb078ddc8f9772) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Fix CVE-2022-40304Bhabu Bindu2022-12-072-0/+105
| | | | | | | | | | | | | | Fix dict corruption caused by entity reference cycles Link: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b Upstream-Status: Pending (From OE-Core rev: 8e195f0a01b4cc1017bf9df67ffc3c6d6c15d24a) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Fix CVE-2022-40303Bhabu Bindu2022-12-072-0/+624
| | | | | | | | | | | | | | Fix integer overflows with XML_PARSE_HUGE Link: https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0 Upstream-Status: Pending (From OE-Core rev: d16d5660a32386158632ee5599ad92a9f2dc08dd) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtasn1: fix CVE-2021-46848 off-by-one in asn1_encode_simple_derVivek Kumbhar2022-12-072-0/+46
| | | | | | | | | | Upstream-Status: Backport [https://gitlab.com/gnutls/libtasn1/-/commit/44a700d2051a666235748970c2df047ff207aeb5] (From OE-Core rev: 305f1c56121436da7be39c5980fc11f779188ab7) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Fix CVE-2022-45061Omkar2022-12-072-0/+101
| | | | | | | | | | | | | Fix CVE-2022-45061, referenced as https://github.com/python/cpython/issues/98433 patch taken from https://github.com/python/cpython/pull/99231/commits/064ec20bf7a181ba5fa961aaa12973812aa6ca5d (From OE-Core rev: 4498ca9a299bd5d9a7173ec67daf17cb66b6d286) Signed-off-by: Omkar <omkarpatil10.93@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Fix CVE-2022-3821 issueRanjitsinh Rathod2022-12-072-0/+48
| | | | | | | | | | | | | | | An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service. Add a patch to solve above CVE issue Link: https://github.com/systemd/systemd/commit/9102c625a673a3246d7e73d8737f3494446bad4e (From OE-Core rev: e2db40ca49b8ed217f14c7f861087837e8b3f389) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sudo: CVE-2022-43995 heap-based overflow with very small passwordsHitendra Prajapati2022-12-072-0/+60
| | | | | | | | | | Upstream-Status: Backport from https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050 (From OE-Core rev: d1bdb663e6a69993d3f42547a27296b606965d47) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.21dunfell-23.0.21Richard Purdie2022-11-221-1/+1
| | | | | | (From OE-Core rev: 1ee082e979baaba871bbe1d91181bb04951faf3b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: utils: Fix lockfile path length issuesRichard Purdie2022-11-221-3/+6
| | | | | | | | | | | | | | | | If the path to bitbake.lock is in a deep directory, bitbake will hang. The reason was that the max file length limiting code (to 255 chars) was including the directory name and it should only act on the filename within the directory. Fix it to just use the base filename. [YOCTO #14766] (Bitbake rev: e3db9c2e9eded3c5cb6040714a6054b44f6b3880) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 89d70e7b71eecfe06592202f326e566c579ba01d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: utils: Handle lockfile filenames that are too long for filesystemsRichard Purdie2022-11-221-1/+5
| | | | | | | | | | | | | | | | The fetcher mirror code can go crazy creating lock filenames which exceed the filesystem limits. When this happens, the code will loop/hang. Handle the filename too long exception correctly but also truncate lockfile lengths to under 256 since the worst case situation is lockfile overlap and lack of parallelism. (Bitbake rev: 30d42ef030d03e11322b6b05ea7bbb64ab3d6f21) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 63baf3440b16e41ac6601de21ced94a94bdf1509) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionRichard Purdie2022-11-221-1/+1
| | | | | | (From OE-Core rev: a5d90bf22c037044c471daefe326ae14702b173e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* poky.conf: bump version for 3.1.21Steve Sakoman2022-11-221-1/+1
| | | | | | | (From meta-yocto rev: 9b713fe0cc7c5f5cb51bcf760d1a1c6540b485f1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* documentation: update for 3.1.21Steve Sakoman2022-11-221-5/+5
| | | | | | | | (From yocto-docs rev: 01d31151d5c4a87a466cb49b97eabf75cf47ed98) Signed-off-by: Steve Sakoman <steve@sakoman.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wic: swap partitions are not added to fstabciarancourtney2022-11-201-1/+1
| | | | | | | | | | | | - Regression in 7aa678ce804c21dc1dc51b9be442671bc33c4041 (From OE-Core rev: ce99d451a54b8ce46b7f9030deaba86355009b1a) Signed-off-by: Ciaran Courtney <ciaran.courtney@activeenergy.ie> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit f1243572ad6b6303fe562e4eb7a9826fd51ea3c3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sanity: check for GNU tar specificallyRoss Burton2022-11-201-0/+8
| | | | | | | | | | | | | | | We need the system tar to be GNU tar, as we reply on --xattrs. Some distributions may be using libarchive's tar binary, which is definitely not as featureful, so check for this and abort early with a clear message instead of later with mysterious errors. (From OE-Core rev: 8f852648fe730615c99bcdaace8a4748ef4e96a5) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7dd2b1cd1bb10e67485dab8600c0787df6c2eee7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* externalsrc.bbclass: Remove a trailing slash from ${B}Peter Kjellerstedt2022-11-201-1/+1
| | | | | | | | | | | | | | | The trailing slash in ${B} caused -fdebug-prefix-map=${B}=... to not match as intended, resulting in ${TMPDIR} ending up in files in ${PN}-dbg when externalsrc was in use, which in turn triggered buildpath QA warnings. (From OE-Core rev: fa89e048e223ae2e96d0f55979f93f29904b5229) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 9b5031ed5a0d102905fa75acc418246c23df6eef) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* externalsrc.bbclass: fix git repo detectionMartin Jansa2022-11-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fix issue introduced in: https://git.openembedded.org/openembedded-core/commit/?id=95fbac8dcad6c93f4c9737e9fe13e92ab6befa09 * it added check for s_dir + git-dir (typically '.git') isn't the same as ${TOPDIR} + git-dir, but due to copy-paste issue it was just comparing it with s_dir + git-dir again, resulting in most external repos (where git-dir is '.git') to be processed as regular directory (not taking advantage of git write-tree). * normally this wouldn't be an issue, but for big repo with a lot of files this added a lot of checksums in: d.setVarFlag('do_compile', 'file-checksums', '${@srctree_hash_files(d)}') and I mean *a lot, e.g. in chromium build it was 380227 paths which still wouldn't that bad, but the checksum processing in siggen.py isn't trivial and just looping through all these checksums takes very long time (over 1000sec on fast NVME drive with warm cache) and then https://git.openembedded.org/bitbake/commit/?id=b4975d2ecf615ac4c240808fbc5a3f879a93846b made the processing a bit more complicated and the loop in get_taskhash() function took 6448sec and to make things worse there was no output from bitbake during that time, so even with -DDD it looks like this: DEBUG: virtual/libgles2 resolved to: mesa (langdale/oe-core/meta/recipes-graphics/mesa/mesa_22.2.0.bb) Bitbake still alive (no events for 600s). Active tasks: Bitbake still alive (no events for 1200s). Active tasks: Bitbake still alive (no events for 1800s). Active tasks: Bitbake still alive (no events for 2400s). Active tasks: Bitbake still alive (no events for 3000s). Active tasks: Bitbake still alive (no events for 3600s). Active tasks: Bitbake still alive (no events for 4200s). Active tasks: Bitbake still alive (no events for 4800s). Active tasks: Bitbake still alive (no events for 5400s). Active tasks: Bitbake still alive (no events for 6000s). Active tasks: DEBUG: Starting bitbake-worker without -DDD it will get stuck for almost 2 hours in: "Initialising tasks..." before it finally writes sstate summary like: "Sstate summary: Wanted 3102 Local 0 Mirrors 0 Missed 3102 Current 1483 (0% match, 32% complete)" * fix the copy&paste typo to use git work-tree in most cases, but be aware that this issue still exists for huge local source trees not in git [YOCTO #14942] (From OE-Core rev: 1f0e4de8d92edd7438d462c779d917ac0ccd5499) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 9102e5a94b8146cb1da27afbe41d3db999a914ff) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: upgrade 1.1.1q to 1.1.1sAlex Kiernan2022-11-201-1/+1
| | | | | | | | | | | | | | | | Major changes between OpenSSL 1.1.1r and OpenSSL 1.1.1s [1 Nov 2022] * Fixed a regression introduced in OpenSSL 1.1.1r not refreshing the certificate data to be signed before signing the certificate. Major changes between OpenSSL 1.1.1q and OpenSSL 1.1.1r [11 Oct 2022] * Added a missing header for memcmp that caused compilation failure on some platforms (From OE-Core rev: a39a32efd41c92a3ada49d667979c79101a4a2da) Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc : stable 2.31 branch updates.Sundeep KOKKONDA2022-11-202-16/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Below commits on glibc-2.31 stable branch are updated. d4b7559457 x86-64: Require BMI2 for avx2 functions [BZ #29611] b8bb48a18d x86-64: Require BMI2 for strchr-avx2.S [BZ #29611] c8f2a3e803 Add test for bug 29530 e6ae5b25cd Fix memmove call in vfprintf-internal.c:group_number 1dbe841a67 Remove most vfprintf width/precision-dependent allocations (bug 14231, bug 26211). 5a802723db stdio: Add tests for printf multibyte convertion leak [BZ#25691] ae7748e67f stdio: Remove memory leak from multibyte convertion [BZ#25691] 174d0b61c7 Linux: Require properly configured /dev/pts for PTYs 0a167374fd Linux: Detect user namespace support in io/tst-getcwd-smallbuff 4ad1659d8c getcwd: Set errno to ERANGE for size == 1 (CVE-2021-3999) 3319cea99e support: Add helpers to create paths longer than PATH_MAX f733e291bb support: Fix xclone build failures on ia64 and hppa 43757c70ee support: Add xclone 29d3aeb0e8 Add xchdir to libsupport. 2d7720f316 support: Add create_temp_file_in_dir 183709983d NEWS: Add a bug fix entry for BZ #28896 d385079bd5 x86: Fix TEST_NAME to make it a string in tst-strncmp-rtm.c 7df3ad6560 x86: Test wcscmp RTM in the wcsncmp overflow case [BZ #28896] fc133fcf49 x86: Fallback {str|wcs}cmp RTM in the ncmp overflow case [BZ #28896] 775c05b28c string: Add a testcase for wcsncmp with SIZE_MAX [BZ #28755] c6b346ec55 x86-64: Test strlen and wcslen with 0 in the RSI register [BZ #28064] 0675185923 x86: Remove wcsnlen-sse4_1 from wcslen ifunc-impl-list [BZ #28064] 5db3239baf x86: Black list more Intel CPUs for TSX [BZ #27398] 5b99f172b8 x86: Check RTM_ALWAYS_ABORT for RTM [BZ #28033] 70d293a158 NEWS: Add a bug fix entry for BZ #27974 a2be2c0f5d String: Add overflow tests for strnlen, memchr, and strncat [BZ #27974] 489006c3c5 x86: Optimize strlen-evex.S 937f2c783a x86: Fix overflow bug in wcsnlen-sse4_1 and wcsnlen-avx2 [BZ #27974] 0058c73d11 x86-64: Add wcslen optimize for sse4.1 665d0252f1 x86-64: Move strlen.S to multiarch/strlen-vec.S 82ff13e2cc x86-64: Fix an unknown vector operation in memchr-evex.S 539b593a1d x86: Optimize memchr-evex.S 7b37ae60c6 x86: Optimize strlen-avx2.S 0381c1c10d x86: Fix overflow bug with wmemchr-sse2 and wmemchr-avx2 [BZ #27974] 10368cb76b x86: Optimize memchr-avx2.S 66ca40582e test-strnlen.c: Check that strnlen won't go beyond the maximum length 927bcaf892 test-strnlen.c: Initialize wchar_t string with wmemset [BZ #27655] 0d4159c36c x86-64: Require BMI2 for __strlen_evex and __strnlen_evex c0cbb9345e NEWS: Add a bug fix entry for BZ #27457 e81b975fcc x86-64: Fix ifdef indentation in strlen-evex.S aa4e48e73c x86-64: Use ZMM16-ZMM31 in AVX512 memmove family functions ac911d3b57 x86-64: Use ZMM16-ZMM31 in AVX512 memset family functions 20d37de533 x86: Add string/memory function tests in RTM region fbaa99ed41 x86-64: Add AVX optimized string/memory functions for RTM 096e14f632 x86-64: Add memcmp family functions with 256-bit EVEX f00fad4e4c x86-64: Add memset family functions with 256-bit EVEX cf239ddd2e x86-64: Add memmove family functions with 256-bit EVEX 7257ba7bf2 x86-64: Add strcpy family functions with 256-bit EVEX db9071c0f6 x86-64: Add ifunc-avx2.h functions with 256-bit EVEX 2d612b2c5f x86: Set Prefer_No_VZEROUPPER and add Prefer_AVX2_STRCMP 5b13651085 NEWS: Add a bug fix entry for BZ #28755 5ee8a436ab x86: Fix __wcsncmp_avx2 in strcmp-avx2.S [BZ# 28755] (From OE-Core rev: 1d047a1f19ea57f919180273589cdf7fb4dacaa3) Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils: stable 2.34 branch updatesSundeep KOKKONDA2022-11-203-45/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Below commits on binutils-2.34 stable branch are updated. c4e78c0868a PR27755, powerpc-ld infinite loop 33973d228c9 gas, arm: PR26858 Fix availability of single precision vmul/vmla in arm mode 0c8652fe288 x86: Update GNU property tests 5c1bd3f52c6 x86: Properly merge -z ibt and -z shstk 93b9bf1651a PowerPC TPREL_HA/LO optimisation 58950a3bfd4 Date update e3b314d3a61 aarch64: set sh_entsize of .plt to 0 26b6ab7a0e4 S/390: z13: Accept vector alignment hints 7324292cd94 gas: Fix checking for backwards .org with negative offset 463ec189fe9 Prevent a potential use-after-fee memory corruption bug in the linker (for PE format files). ef2826c0fdb Fix the ARM assembler to generate a Realtime profile for armv8-r. 8524bb5bd28 Re: Fix tight loop on recursively-defined symbols 5768460022b Fix tight loop on recursively-defined symbols a72427b1ae0 gas: PR 25863: Fix scalar vmul inside it block when assembling for MVE 9f57ab49b32 BFD: Exclude sections with no content from compress check. aaf3f0599a2 Arm: Fix LSB of GOT for Thumb2 only PLT. 97f92b3e90a Arm: Fix thumb2 PLT branch offsets. 3053d7a163c include: Sync plugin-api.h with GCC f7aec2b8e09 PR25745, powerpc64-ld overflows string buffer in --stats mode 1b2bf0f65c1 include: Sync plugin-api.h with GCC 5e8619b9597 include: Sync lto-symtab.h and plugin-api.h with GCC 23820109ced plugin: Don't invoke LTO-wrapper 64f5c0afcc4 plugin: Use LDPT_ADD_SYMBOLS_V2 to get symbol type aaa1e160040 Silence warnings due to plugin API change e7c0ee5110c Include: Sync lto-symtab.h and plugin-api.h with GCC b6520be37fd Fix dwarf.c build with GCC 10 a560c29ca5a bfd: Change num_group to unsigned int 3ca4cd1ebde gas, arm: Fix bad backport b3174859c4b gas, arm: PR25660L Fix vadd/vsub with lt and le condition codes for MVE de9c1b7cfe6 powerpc64-ld infinite loop 0318fc4e18e Adjust PR25355 testcase 40bfb976274 Re: PR24511, nm should not mark symbols in .init_array as "t" 42b2380cdce Don't call lto-wrapper for ar and ranlib acc4a8b8ac8 PR25585, PHDR segment not covered by LOAD segment (From OE-Core rev: ad15d44b6c56ccbbe8e4c12717e7dfe3492a659a) Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2021-3638 ati-vga: inconsistent check in ati_2d_blt() may lead ↵Vivek Kumbhar2022-11-202-0/+81
| | | | | | | | | | | | to out-of-bounds write Upstream-Status: Backport from https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg01682.html (From OE-Core rev: 8b5d38abdbfd3bdeb175c793b4d33f9054e89f77) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix CVE-2022-32221 POST following PUTVivek Kumbhar2022-11-202-0/+30
| | | | | | | | | | Upstream-Status: Backport from https://github.com/curl/curl/commit/a64e3e59938abd7d6 (From OE-Core rev: 9af175e122acb93a412ad7a099f0eaa793a1c097) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: Security Fix for CVE-2022-2879Sunil Kumar2022-11-202-0/+112
| | | | | | | | | | | | | | | | archive/tar: limit size of headers Set a 1MiB limit on special file blocks (PAX headers, GNU long names, GNU link names), to avoid reading arbitrarily large amounts of data into memory. Link: https://github.com/golang/go/commit/0a723816cd2 (From OE-Core rev: a8e2f91edfe2df5204a482c4e53fbdd08f80e878) Signed-off-by: Sunil Kumar <sukumar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez: CVE-2022-3637 A DoS exists in monitor/jlink.cHitendra Prajapati2022-11-202-0/+40
| | | | | | | | | | Upstream-Status: Backport from https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/monitor/jlink.c?id=1d6cfb8e625a944010956714c1802bc1e1fc6c4f (From OE-Core rev: c008c56e9b03f0ce3eccf4c01799ae8e987e5cd5) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez5: add dbus to RDEPENDSBartosz Golaszewski2022-11-091-0/+1
| | | | | | | | | | | | | | | Unless we're using systemd, dbus is not pulled into the system automatically. Bluez5 will not work without dbus so add it to RDEPENDS explicitly. (From OE-Core rev: babcb7cd3bbefe9c0ea28e960e4fd6cefbc03cae) Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 377ef7009a8638efe688b6b61f67ae399eb1f23d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-09 08:52:53 +0000