summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* ghostscript: fix CVE-2023-38559Archana Polampalli2023-08-192-0/+33
| | | | | | | | | | | | | | | | | A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-38559 Upstream patch: https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d81b82c70bc1fb9991bb95f1201abb5dea55f57f (From OE-Core rev: e77c0b35969ae690b390ffae682fd6552ff8aff8) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-3354 VNC: improper I/O watch removal in TLS handshake can ↵Vivek Kumbhar2023-08-192-0/+88
| | | | | | | | | lead to remote unauthenticated denial of service (From OE-Core rev: 42859fe600e5dddba3c51fa8d1e680721b73e5dc) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2020-14394Yogita Urade2023-08-192-0/+80
| | | | | | | | | | | | QEMU: infinite loop in xhci_ring_chain_length() in hw/usb/hcd-xhci.c Reference: https://gitlab.com/qemu-project/qemu/-/issues/646 (From OE-Core rev: 057f4f77ac2e83f99c916dceb4cbbcc8de448ad4) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-certifi: fix CVE-2023-37920Narpat Mali2023-08-192-1/+304
| | | | | | | | | | | | | | | | | | | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. References: https://nvd.nist.gov/vuln/detail/CVE-2023-37920 https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7 (From OE-Core rev: 98abbe3394638c6ce795b34247a9e49120e4ffba) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.12kirkstone-4.0.12Steve Sakoman2023-08-071-1/+1
| | | | | | (From OE-Core rev: e1a604db8d2cf8782038b4016cc2e2052467333b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 4.0.12Steve Sakoman2023-08-071-1/+1
| | | | | | (From meta-yocto rev: 464204a5e52a3f3ae5d7ec9e36c143ca06fed3eb) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: fix runpath errors in cc1 binarySteve Sakoman2023-08-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The runpath in the cc1 binary is: Library runpath: [$ORIGIN/../../../recipe-sysroot-native/usr/lib:$ORIGIN/../../../recipe-sysroot-native/lib] This does not match the actual location of the libraries, which would require: Library runpath: [$ORIGIN/../../recipe-sysroot-native/usr/lib:$ORIGIN/../../recipe-sysroot-native/lib] Prior to gcc 9.1 the recipe set B explicity with: B = "${WORKDIR}/gcc-${PV}/build.${HOST_SYS}.${TARGET_SYS}" and this build directory structure matches the runpath in cc1, so there is no issue. This line was commented out in versions 9.1 through 11.3. The upgrade to 12.1 once again uncommented this line. As a result the runpath is incorrect in version 9.1 through 11.3 and cc1 defaults to using host libraries. This patch restores setting B as done in master and versions prior to 9.1 (From OE-Core rev: b6f4b3d43a399c2b446754de56ebea35657e13de) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Upgrade 3.0.9 -> 3.0.10Peter Marko2023-08-071-1/+1
| | | | | | | | | | | | | https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-309-and-openssl-3010-1-aug-2023 Major changes between OpenSSL 3.0.9 and OpenSSL 3.0.10 [1 Aug 2023] * Fix excessive time spent checking DH q parameter value (CVE-2023-3817) * Fix DH_check() excessive time with over sized modulus (CVE-2023-3446) * Do not ignore empty associated data entries with AES-SIV (CVE-2023-2975) (From OE-Core rev: 94ce10791ce10aa30d3a3bdef53f9b2f3c1b331a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc : upgrade to v11.4Sundeep KOKKONDA2023-08-0716-97/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | gcc stable version upgraded from v11.3 to v11.4 For changes in v11.4 see - https://gcc.gnu.org/gcc-11/changes.html Below is the bug fix list for v11.4 https://gcc.gnu.org/bugzilla/buglist.cgi?bug_status=RESOLVED&order=short_desc%2Cbug_status%2Cpriority%2Cassigned_to%2Cbug_id&query_format=advanced&resolution=FIXED&target_milestone=11.4 There are a total 115 bugs are fixed in this release, below is the list of bugs fixed excluding the regression fixes. ID Product Comp Resolution Summary▲ 108199 gcc tree-opt FIXE Bitfields, unions and SRA and storage_order_attribute 107801 gcc libstdc+ FIXE Building cross compiler for H8 family fails in libstdc++ (c++17/memory_resource.cc) 108265 gcc libstdc+ FIXE chrono::hh_mm_ss can't be constructed from unsigned durations 104443 gcc libstdc+ FIXE common_iterator<I, S>::operator-> is not correctly implemented 98056 gcc c++ FIXE coroutines: ICE tree check: expected record_type or union_type or qual_union_type, have array_type since r11-2183-g0f66b8486cea8668 107061 gcc target FIXE ENCODEKEY128 clobbers xmm4-xmm6 105433 gcc testsuit FIXE FAIL: gcc.target/i386/iamcu/test_3_element_struct_and_unions.c 105095 gcc testsuit FIXE gcc.dg/vect/complex/fast-math-complex-* tests are not executed 100474 gcc c++ FIXE ICE: in diagnose_trait_expr, at cp/constraint.cc:3706 105854 gcc target FIXE ICE: in extract_constrain_insn, at recog.cc:2692 (insn does not satisfy its constraints: sse2_lshrv1ti3) 104462 gcc target FIXE ICE: in extract_constrain_insn_cached, at recog.cc:2682 with -mavx512fp16 -mno-xsave 106045 gcc libgomp FIXE Incorrect testcase in libgomp.c/target-31.c at -O0 56189 gcc c++ FIXE Infinite recursion with noexcept when instantiating function template 100295 gcc c++ FIXE Internal compiler error from generic lambda capturing parameter pack and expanding it in if constexpr 100613 gcc jit FIXE libgccjit should produce dylib on macOS 104875 gcc libstdc+ FIXE libstdc++-v3/src/c++11/codecvt.cc:312:24: warning: left shift count >= width of type 107471 gcc libstdc+ FIXE mismatching constraints in common_iterator 105284 gcc libstdc+ FIXE missing syncstream and spanstream forward decl. in <iosfwd> 98821 gcc c++ FIXE modules : c++tools configures with CC but code fragments assume CXX. 109846 gcc fortran FIXE Pointer-valued function reference rejected as actual argument 101324 gcc target FIXE powerpc64le: hashst appears before mflr at -O1 or higher 102479 gcc c++ FIXE segfault when deducing class template arguments for tuple with libc++-14 105128 gcc libstdc+ FIXE source_location compile error for latest clang 15 106183 gcc libstdc+ FIXE std::atomic::wait might fail to be unblocked by notify_one/all on platforms without platform_wait() 102994 gcc libstdc+ FIXE std::atomic<ptr>::wait is not marked const 105324 gcc libstdc+ FIXE std::from_chars() assertion at floating_from_chars.cc:78 when parsing 1.11111111.... 105375 gcc libstdc+ FIXE std::packaged_task has no deduction guide. 104602 gcc libstdc+ FIXE std::source_location::current uses cast from void* 106808 gcc libstdc+ FIXE std::string_view range concept requirement causes compile error with Boost.Filesystem 105725 gcc c++ FIXE [ICE] segfault with `-Wmismatched-tags` 105920 gcc target FIXE __builtin_cpu_supports ("f16c") should check AVX (From OE-Core rev: 4fd7e5951c42336729f12cde71450ec298f2078b) Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: always pass str for json.loads()Yuta Hayama2023-08-071-1/+1
| | | | | | | | | | | | | Currently json.loads() accepts one of the types str, bytes, or bytearray as an argument, but bytes and bytearrays have only been allowed since python 3.6. The version of Python3 provided by default on Ubuntu 16.04 and Debian 9.x is 3.5, so make raw_data type str to work correctly on these build hosts. (From OE-Core rev: e67d659847afe648de1b1eca2d19c4f6375dd12c) Signed-off-by: Yuta Hayama <hayama@lineo.co.jp> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24531Sakib Sajal2023-08-073-1/+302
| | | | | | | | | Backport required patches from go1.21 to fix CVE-2023-24531. (From OE-Core rev: 6d892c52bd5806507a05e8b6f749c54bbd9e9da6) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24536Sakib Sajal2023-08-074-0/+676
| | | | | | | | | Backport required patches to fix CVE-2023-24536. (From OE-Core rev: a774c895f4a425979cef8e05e8dd17c2dcb67654) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-2861Archana Polampalli2023-08-072-0/+173
| | | | | | | | | | | | | | | 9pfs: prevent opening special files References: https://nvd.nist.gov/vuln/detail/CVE-2023-2861 Upstream patches: https://github.com/qemu/qemu/commit/10fad73a2bf1c76c8aa9d6322755e5f877d83ce5 (From OE-Core rev: 9bd4ddeb4b5efc65b0514d50d6991211271924c1) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-3255Archana Polampalli2023-08-072-0/+65
| | | | | | | | | | | | | | | VNC: infinite loop in inflate_buffer() leads to denial of service References: https://nvd.nist.gov/vuln/detail/CVE-2023-3255 Upstream patches: https://gitlab.com/qemu-project/qemu/-/commit/d921fea338c1059a27ce7b75309d7a2e485f710b (From OE-Core rev: 52711b1392ed0c5cbe4ddf70a94b21be2f4e6e58) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-3301Archana Polampalli2023-08-072-0/+61
| | | | | | | | | | | | | | | | qemu: hotplug/hotunplug mlx vdpa device to the occupied addr port, then qemu core dump occurs after shutdown guest References: https://nvd.nist.gov/vuln/detail/CVE-2023-3301 Upstream patches: https://gitlab.com/qemu-project/qemu/-/commit/a0d7215e339b61c7d7a7b3fcf754954d80d93eb8 (From OE-Core rev: f549ff6db018f66a80fc65987675e8bb6afcd002) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: ignore CVE-2023-30571Peter Marko2023-08-071-0/+3
| | | | | | | | | | | | | | | | | | | | | This issue was reported and discusses under [1] which is linked in NVD CVE report. It was already documented that some parts or libarchive are thread safe and some not. [2] was now merged to document that also reported function is not thread safe. So this CVE *now* reports thread race condition for non-thread-safe function. And as such the CVE report is now invalid. The issue is still not closed for 2 reasons: * better document what is and what is not thread safe * request to public if someone could make these functions thread safe This should however not invalidate above statment about ignoring this CVE. [1] https://github.com/libarchive/libarchive/issues/1876 [2] https://github.com/libarchive/libarchive/pull/1875 (From OE-Core rev: d5e7971e12cdc8748be91b4e6408b42fa86b2f15) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpcre2: patch CVE-2022-41409Peter Marko2023-08-072-0/+76
| | | | | | | | | | Backport commit mentioned in NVD DB links. https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35 (From OE-Core rev: 410cdbc70cfba709ec5bef508e772f52514ba28a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: bitbake-layers: initialize tinfoil before registering command line ↵Alexander Kanavin2023-08-041-2/+2
| | | | | | | | | | | | | | | | | arguments Plugins may want to use it (e.g. the layers-setup plugin that would want to discover writer sub-plugins with it), and so it makes sense to make tinfoil available a bit eariler. (Bitbake rev: 41b6684489d0261753344956042be2cc4adb0159) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2f6c7523a622f59ddf84a1a196927492bc5fa7a2) Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: document image-specific variant of INCOMPATIBLE_LICENSEMichael Opdenacker2023-08-022-8/+19
| | | | | | | | | | | | This has been around without being properly documented since 2019 (!!!), and is nowadays the preferred method for enforcing license restrictions, especially since meta-gplv2 is officially obsolete. (From yocto-docs rev: 4dfef81ac6164764c6541e39a9fef81d49227096) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* util-linux: add alternative links for ipcs,ipcrmBenjamin Bouvier2023-08-021-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | When enabling ipcs and ipcrm configuration into busybox, both tools are built and then deployed during do_rootfs. These operation lead to below issue (similar behavior happens for ipcs): do_rootfs: Postinstall scriptlets of ['busybox'] have failed. If the intention is to defer them to first boot, then please place them into pkg_postinst_ontarget:${PN} (). update-alternatives: Error: not linking .../build/tmp/work/board-poky-linux/board-image/1.0-r0/rootfs/usr/bin/ipcrm to /bin/busybox since .../build/tmp/work/board-poky-linux/board-image/1.0-r0/rootfs/usr/bin/ipcrm exists and is not a link Binaries enter in conflict with same named util-linux utilities during do_rootfs step. Adding ALTERNATIVE_LINK_NAME for both tools fix the issue. (From OE-Core rev: dc2e760591c5ed3c999222f235484829426c71a7) Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e4d60408b869c9cc2ccff794d4e271d993ec8a97) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: use a glob on the PERLEXTERNAL to track updates on the pathJose Quaresma2023-08-021-1/+1
| | | | | | | | | | | | | | The Text-Template was updated from 1.46 to 1.56 | ERROR: openssl-native-3.1.1-r0 do_configure: PERLEXTERNAL '/build/tmp/work/x86_64-linux/openssl-native/3.1.1-r0/openssl-3.1.1/external/perl/Text-Template-1.46/lib' not found! (From OE-Core rev: b39e394771e4fa4c9250e11fafe5ef2157089422) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b9a7739b01e31d0cc8358d99255e3e1b02a0a1a8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: add PERLEXTERNAL path to test its existenceJose Quaresma2023-08-021-1/+3
| | | | | | | | | | | | | When upstream change is better to fail or removing the PERL5LIB if they are not need anymore. (From OE-Core rev: 14905c6bfdaba3e2e31eaee6c02e20bf7b6669a7) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 337ac1159644678508990927923ef8af30f34cd7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/selftest/devtool: add unit test for "devtool add -b"Yoann Congal2023-08-021-0/+32
| | | | | | | | | | | | Fix [Yocto #15085] Co-authored-by: Fawzi KHABER <fawzi.khaber@smile.fr> (From OE-Core rev: ea1592b49c6b45495fe9243339fc4dc9cea9ef12) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d5eedf8ca689ccb433c2f5d0b324378f966dd627) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/runtime/cases/rpm: fix wait_for_no_process_for_user failure caseRoss Burton2023-08-021-2/+2
| | | | | | | | | | | | | | str.format() doesn't use % notation, update the formatting to work. assertTrue() is a member of self not a global, and assertTrue(True) will always pass. Change this to just self.fail() as this is the failure case. (From OE-Core rev: 05c8af81438d43fd83495cb165c75f43778fea41) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 017f3a0b1265c1a3b69c20bdb56bbf446111977e) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* meson.bbclass: Point to llvm-config from native sysrootKhem Raj2023-08-021-0/+1
| | | | | | | | | | | | | | | Default search in meson would grok /usr/bin for llvm-config and if found will use it, which might add wrong paths into cflags/ldflags, since we depend on llvm-native when building gallium support ( thats when llvm-config is effective), its better to point llvm-config into native sysroot so it can add correct paths into compiler/linker cmdline (From OE-Core rev: 8e6b616066ba0f7f452f929dc7c412e620da9101) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit cc73360b9728812ed6123e30559b77d8e89cc21c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: fix missing comma in get_module_deps3.pyRoss Burton2023-08-021-1/+1
| | | | | | | | | | | | | | | Wes Tarro <wes.tarro@azuresummit.com> noticed a missing comma in a preplace() call, add it. That said, calling replace() with one argument results in a TypeError, so this is obviously dead code. (From OE-Core rev: 3a79a210665efae1af6d68e9e923a739c82d800e) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9b2e2c8d809e7ca34451ec9702b029a00dfb410b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mdadm: skip running known broken ptestsOvidiu Panait2023-08-024-1/+585
| | | | | | | | | | | | | | | | | | | Upstream marked some testcases as "KNOWN BROKEN" and introduced the "--skip-broken" flag to ignore them when running the testsuite (commits [1] and [2]). Backport these two commits to get rid of the last remaining ptest failures. Also, add the "--skip-broken" option to the run-ptest script. [1] https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=28520bf114b3 [2] https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=daa86d663476 (From OE-Core rev: 62daa4ca064da1c014b9c21798bc55ff3e7656e6) Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 62148b978b26b5fcd1a2fa3a0ff82ef814f4e7ec) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mdadm: fix segfaults when running ptestsOvidiu Panait2023-08-025-0/+341
| | | | | | | | | | | | | | | | | | | | | | | Currently, some segfaults are reported when running ptest: mdadm[12333]: segfault at 0 ip 00007fe855924060 sp 00007ffc4d6caf88 error 4 in libc.so.6[7f) Code: d2 0f 84 b7 0f 00 00 48 83 fa 01 0f 84 b9 0f 00 00 49 89 d3 89 f1 89 f8 48 83 e1 3f 4f Backport the following upstream commits to fix them: 679bd9508a30 ("DDF: Cleanup validate_geometry_ddf_container()") 2b93288a5650 ("DDF: Fix NULL pointer dereference in validate_geometry_ddf()") 548e9b916f86 ("mdadm/Grow: Fix use after close bug by closing after fork") 9ae62977b51d ("monitor: Avoid segfault when calling NULL get_bad_blocks") The fixes are part of the "Bug fixes and testing improvments" patchset [1]. [1] https://www.spinics.net/lists/raid/msg70621.html (From OE-Core rev: 4ea6acbf25ad1b3e910f01d136b53c6353daf0c5) Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9585009e3e505b361cd32b14e0e85e77e7822878) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mdadm: fix 07revert-inplace ptestOvidiu Panait2023-08-021-1/+1
| | | | | | | | | | | | | | | | | Testcase 07revert-inplace fails if strace is not installed: ... strace -o /tmp/str ./mdadm -A /dev/md0 --update=revert-reshape /dev/<...> tests/07revert-inplace: line 40: strace: command not found Add strace to mdadm-ptest RDEPENDS to make sure the testcase passes even with a core-image-minimal build. (From OE-Core rev: 1df8d9d45bb4ff01e30d9ec9ffd0fb822d5f91e9) Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7d9386663ac52ab69812867a0823c6055aedbc18) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mdadm: fix util-linux ptest dependencyOvidiu Panait2023-08-021-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | Trying to run mdadm-ptest in a core-image-minimal build will result in: root@qemux86-64:~# ptest-runner mdadm START: ptest-runner BEGIN: /usr/lib/mdadm/ptest which: no lsblk in (/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin) lsblk command not found! DURATION: 0 END: /usr/lib/mdadm/ptest 2023-06-28T10:14 STOP: ptest-runner TOTAL: 1 FAIL: 0 Remove util-linux from RRECOMMENDS and only add util-linux-lsblk and util-linux-losetup to RDEPENDS. (From OE-Core rev: 898b9add68d9c30c7c90285e659b128289313668) Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3004f7589974c135cc82630d980ea281b97ecd83) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* uboot-extlinux-config.bbclass: fix old override syntax in commentQuentin Schulz2023-08-021-4/+4
| | | | | | | | | | | | | | | | | The comment specifies how to use the variables but uses the older and now unsupported override syntax. Let's update to match the newer syntax. Cc: Quentin Schulz <foss+yocto@0leil.net> (From OE-Core rev: 0a381eea4d50ff1c6e7c7d0d4df62eb581454b48) (From OE-Core rev: 0e9a70ee3c8f78db746d3cb627c6b212e1b4e4e4) Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bb64f3fed29b9532e6ddc9a2ba0283d373622d87) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd-systemctl: fix errors in instance name expansionYuta Hayama2023-08-021-1/+1
| | | | | | | | | | | | | | If the instance name indicated by %i begins with a number, the meaning of the replacement string "\\1{}".format(instance) is ambiguous. To indicate group number 1 regardless of the instance name, use "\g<1>". (From OE-Core rev: 392f60b0aa775ce95c3494ae87551e7954c9925b) Signed-off-by: Yuta Hayama <hayama@lineo.co.jp> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d18b939fb08b37380ce95934da38e6522392621c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* recipetool: Fix inherit in created -native* recipesYoann Congal2023-08-021-0/+4
| | | | | | | | | | | | native and nativesdk classes are special and must be inherited last : put them at the end of the gathered classes to inherit. (From OE-Core rev: 2c92780236b25205af0dcf75de2d2ede14132152) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a6614fd800cbe791264aeb102d379ba79bd145c2) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* kernel: add missing path to search for debug filesAndrej Valek2023-08-021-0/+1
| | | | | | | | | | | | | | Since explicit debug package creation via ${KERNEL_PACKAGE_NAME}-dbg has been added to kernel, it has to cover all PACKAGE_DEBUG_SPLIT_STYLE options. For ex. when the variable "debug-file-directory" package search path has to be set explicitly, otherwise it will not find any files. (From OE-Core rev: 9adbda8450c57f49edf85e3b3433304e8ac8267e) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9c39da147683dcaaa244b3ddc4531c4408ad5c9e) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxcrypt: fix build with perl-5.38 and use master branchMartin Jansa2023-08-023-2/+117
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fixes do_configure failure: checking whether all ucontext.h functions are available... yes when is deprecated at libxcrypt/4.4.30-r0/git/build-aux/scripts/BuildCommon.pm line 522. Compilation failed in require at ../git/build-aux/scripts/expand-selected-hashes line 28. BEGIN failed--compilation aborted at ../git/build-aux/scripts/expand-selected-hashes line 28. configure: error: bad value 'all' for --enable-hashes NOTE: The following config.log files may provide further information. * with this patch backported it works OK: libxcrypt/4.4.30-r0/git $ perl build-aux/scripts/expand-selected-hashes usage: expand-selected-hashes hashes.conf names,of,selected,hashes * similarly do_compile failure: ../git/build-aux/scripts/move-if-change crypt-hashes.h.T crypt-hashes.h ../git/build-aux/scripts/move-if-change crypt-symbol-vers.h.T crypt-symbol-vers.h given is deprecated at ../git/build-aux/scripts/gen-crypt-h line 41. Makefile:3818: Makefile.deps: No such file or directory make: *** [Makefile:3715: crypt.h.stamp] Error 255 * also use master branch instead of develop, the SRCREV exists in both but stable metadata branches should track stable component branches libxcrypt/4.4.30-r0/git $ git branch -a --contains d7fe1ac04c326dba7e0440868889d1dccb41a175 | tee * develop remotes/origin/HEAD -> origin/develop remotes/origin/develop remotes/origin/master and oe-core master also uses master SRCBRANCH since: https://git.openembedded.org/openembedded-core/commit/?id=d18e89bd2b46c6e266cc39dbe9fdb6c032f5f1fe (From OE-Core rev: 54996f24243a10252d3aa70effc9c13db1d507f8) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* lttng-ust: upgrade 2.13.5 -> 2.13.6Wang Mingyu2023-08-021-1/+1
| | | | | | | | | | | | | | | | | | | | Changelog: =========== * Fix: segmentation fault on filter interpretation in "switch" mode * Fix: `ip` context is expressed as a base-10 field * Fix: c99: use __asm__ __volatile__ * Fix: c99: static assert: clang build fails due to multiple typedef * Fix: Reevaluate LTTNG_UST_TRACEPOINT_DEFINE each time tracepoint.h is included * Fix: trace events in C++ constructors/destructors * Fix: trace events in C constructors/destructors * Fix: use unaligned pointer accesses for lttng_inline_memcpy (From OE-Core rev: 1361c8f4be21e41db74623dcacc92d8f02e6a2ee) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 656470b4b0db579308d218d1ece77bdacd168d14) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libksba: upgrade 1.6.3 -> 1.6.4Wang Mingyu2023-08-021-1/+1
| | | | | | | | | | | | Changelog: Correctly detect CMS write errors. (From OE-Core rev: 4bc2f5c3a46b76d152fda326f7c8227fe938b97e) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0296cf63007542c1cb209a4288be1c82aa2ba843) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libassuan: upgrade 2.5.5 -> 2.5.6Wang Mingyu2023-08-021-1/+1
| | | | | | | | | | | | | | | | Changelog: =========== * Fix logging of confidential data. [rA0fc31770fa] * Fix memory wiping. [T5977] * Fix macOS build problem. [T5440,T5610] * Upgrade autoconf stuff. (From OE-Core rev: a905094c4e7ff3475de657adcf7a0afcc132191a) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 90126be6dc32170c08eb90223b6a6cc06c2133ce) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* diffutils: update 3.9 -> 3.10Alexander Kanavin2023-08-022-13/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | * Noteworthy changes in release 3.10 (2023-05-21) [stable] ** Bug fixes cmp/diff can again work with file dates past Y2K38 [bug introduced in 3.9] diff -D no longer fails to output #ifndef lines. [bug#61193 introduced in 3.9] Remove the comment addition from the patch body, as it increases likelyhood of rebase conflicts, and repeats what the commit says. (From OE-Core rev: ab9ae300ce3895cdf64d207b5dc281b65c984211) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 925155acc6922f7e9df2afa45e79ad1b2c57ba24) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 21e40166870fadee986fb36be80019d3bcdb69e5) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: upgrade 3.10.9 -> 3.10.12Tim Orling2023-08-022-53/+2
| | | | | | | | | | | | | | | | | | | | | | | | Security and bugfix updates. * Drop cve-2023-24329.patch as it is merged in 3.10.12 CVE: CVE-2023-24329 Includes openssl 1.1.1u which addresses: CVE: CVE-2023-0286 CVE: CVE-2022-4304 CVE: CVE-2022-4203 https://docs.python.org/release/3.10.12/whatsnew/changelog.html#python-3-10-12-final https://docs.python.org/release/3.10.12/whatsnew/changelog.html#python-3-10-11-final https://docs.python.org/release/3.10.12/whatsnew/changelog.html#python-3-10-10-final License-Update: Update Copyright years to include 2023 (From OE-Core rev: 4df594dbc1b391afbe703f663fb2d5c9e9d35078) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dmidecode: fix CVE-2023-30630Yogita Urade2023-08-025-0/+527
| | | | | | | | | | | | | | | | | | | | | Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. References: https://nvd.nist.gov/vuln/detail/CVE-2023-30630 https://lists.nongnu.org/archive/html/dmidecode-devel/2023-04/msg00016.html https://lists.nongnu.org/archive/html/dmidecode-devel/2023-04/msg00017.html Backport: fixes fuzz in the CVE-2023-30630_2.patch in kirkstone (From OE-Core rev: 4f83427a0a01e8285c9eb42d2a635d1ff7b23779) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit f92e59a0894145a828dc9ac74bf8c7a9355e0587) Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssh: fix CVE-2023-38408Archana Polampalli2023-08-025-0/+912
| | | | | | | | | | | | | | | | | | | | | | The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. References: https://nvd.nist.gov/vuln/detail/CVE-2023-38408 Upstream patches: https://github.com/openssh/openssh-portable/commit/892506b13654301f69f9545f48213fc210e5c5cc https://github.com/openssh/openssh-portable/commit/1f2731f5d7a8f8a8385c6031667ed29072c0d92a https://github.com/openssh/openssh-portable/commit/29ef8a04866ca14688d5b7fed7b8b9deab851f77 https://github.com/openssh/openssh-portable/commit/099cdf59ce1e72f55d421c8445bf6321b3004755 (From OE-Core rev: 3c01159ab6a843fc922cf779b022c965d4ecd453) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libtiff: fix CVE-2023-26965 heap-based use after freeHitendra Prajapati2023-08-022-0/+98
| | | | | | | | | Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/ec8ef90c1f573c9eb1f17d6a056aa0015f184acf (From OE-Core rev: 9b9f88d8828ee822635ed645cc192829fecec39e) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: fix multiple CVEsHitendra Prajapati2023-08-023-0/+291
| | | | | | | | | | | Backport fixes for: * CVE-2023-25433 - Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/9c22495e5eeeae9e00a1596720c969656bb8d678 && https://gitlab.com/libtiff/libtiff/-/commit/688012dca2c39033aa2dc7bcea9796787cfd1b44 * CVE-2023-25434 & CVE-2023-25435 - Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/69818e2f2d246e6631ac2a2da692c3706b849c38 (From OE-Core rev: 01b9f7f7bb3eaecd6aa757fa090fcc4424788ce1) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29406 net/http insufficient sanitization of Host headerVivek Kumbhar2023-08-022-0/+211
| | | | | | | (From OE-Core rev: 5dc74138649ab7a2c0158a43225dc7a8fd732355) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: fix multiple CVEsHitendra Prajapati2023-08-022-0/+163
| | | | | | | | | | | | | | | | | | | | Bug-Debian: https://bugs.debian.org/1031632 Origin: https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68 import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u7.debian.tar.xz fix multiple CVEs: CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799 (From OE-Core rev: 1a4e54d5b7b4d26b9fcdc2be1b115600ca71c9ea) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: ignore CVE-2023-36632Peter Marko2023-08-021-0/+2
| | | | | | | | | | | | | | This CVE shouldn't have been filed as the "exploit" is described in the documentation as how the library behaves. (From OE-Core rev: 9665121fd9daf1174ec4045071b900de9195b11e) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c652f094d86c4efb7ff99accba63b8169493ab18) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libjpeg-turbo: patch CVE-2023-2804Peter Marko2023-08-023-0/+180
| | | | | | | | | | | | | | Relevant links: * linked fronm NVD: * https://github.com/libjpeg-turbo/libjpeg-turbo/issues/668#issuecomment-1492586118 * follow-up analysis: * https://github.com/libjpeg-turbo/libjpeg-turbo/issues/668#issuecomment-1496473989 * picked commits fix all issues mentioned in this analysis (From OE-Core rev: ca8ede6d29c04159e85c2bdd2b635c58ec6a1484) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* package.bbclass: moving field data process before variable process in ↵Xiangyu Chen2023-07-261-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | process_pkgconfig Currently, the latest version abseil-cpp contains a new library named "absl_log_internal_format", it's basic package config(.pc file) as below: prefix=/usr exec_prefix=${prefix} ...... Requires: absl_config = 20230125, absl_core_headers = 20230125, absl_log_internal_append_truncated = 20230125, absl_log_internal_config = 20230125, absl_log_internal_globals = 20230125, absl_log_severity = 20230125, absl_strings = 20230125, absl_str_format = 20230125, absl_time = 20230125, absl_span = 20230125 ...... Normally, the process_pkgconfig() would process variable data before field data in a .pc file, but in the absl_log_internal_format, the field data in "Requires" section contains "xxxx = xxxx" format, the process_pkgconfig() treats them as normal variable and using the setVar() in bitbake's data_smart.py try to process. The absl_log_internal_format field data contains "_append_", this hit the setVar() checking and finally bitbake stop building and reporting an error as below: "Variable xxx contains an operation using the old override syntax. Please convert this layer/metadata before attempting to use with a newer bitbake." This patch move the field data process before variable process to avoid the process_pkgconfig() treat the field data as variable. (From OE-Core rev: e7d3e02a624f7ce23d012bb11ad1df2049066b37) Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> (cherry picked from commit a73e269d3e591a10bb397b94b82e3fb960112d33) Signed-off-by: Clément Péron <peron.clem@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc-testsuite: Fix ppc cpu specificationRichard Purdie2023-07-261-2/+3
| | | | | | | | | | | | | | | | | After this change in qemu: https://gitlab.com/qemu-project/qemu/-/commit/c7e89de13224c1e6409152602ac760ac91f606b4 there is no 'max' cpu model on ppc. Drop it to clean up ppc gcc testsuite failures. In order for this to work we do need to pull in the alternative cpu option from QEMU_EXTRAOPTIONS on powerpc. (From OE-Core rev: 3a1b9f300a796e1216d0094043dba7b0f39ec869) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c447f2b21b20fb2b1829d540af2cc0bf8242700c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-09 02:57:50 +0000