summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* libmicrohttpd: upgrade 0.9.75 -> 0.9.76Narpat Mali2023-03-201-1/+1
| | | | | | | | | | | | | | | Changelog: ============ Fix potential DoS vector in MHD_PostProcessor.(CVE-2023-27371) Releasing GNU libmicrohttpd 0.9.76 hotfix. https://github.com/Karlson2k/libmicrohttpd/blob/v0.9.76/ChangeLog (From OE-Core rev: 017346be6c97d20b1b16d495ee9484f10973857c) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* shadow: ignore CVE-2016-15024Ross Burton2023-03-201-0/+3
| | | | | | | | | | | | | This recently got an updated CPE which matches this recipe, but the issue is related to an entirely different shadow project so ignore it. (From OE-Core rev: d0b1f61eb1fadf44b2e4fba13b6a94140cf029db) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 2331e98abb09cbcd56625d65c4e5d258dc29dd04) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tiff: fix multiple CVEsChee Yang Lee2023-03-203-0/+156
| | | | | | | | | | | | | | | | | | | | | | import patch from debian to fix CVE-2022-48281 http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.2.0-1+deb11u4.debian.tar.xz import patch from fedora to fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804 https://src.fedoraproject.org/rpms/libtiff/c/91856895aadf3cce6353f40c2feef9bf0b486440 (From OE-Core rev: f2782b4cac461909cf432db13516e443fee8c3de) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit d9ce9b37236f5c16ffba4572ad720aeb50edeee9) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* harfbuzz: Security fix for CVE-2023-25193Siddharth Doshi2023-03-203-1/+323
| | | | | | | | | Upstream-Status: Backport from [https://github.com/harfbuzz/harfbuzz/commit/8708b9e081192786c027bb7f5f23d76dbe5c19e8] (From OE-Core rev: 58e212a6109a639ca0675e73967da74d6c4c5aa3) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnutls: fix CVE-2023-0361 timing side-channel in the TLS RSA key exchange codeVivek Kumbhar2023-03-202-0/+86
| | | | | | | | | | | | | Remove branching that depends on secret data. since the `ok` variable isn't used any more, we can remove all code used to calculate it (From OE-Core rev: 05b1222815bec400d573f7b06c0ad6b7b2d78a80) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: Security fix for CVE-2023-0687Shubham Kulkarni2023-03-202-0/+83
| | | | | | | | | | Backport from https://sourceware.org/git/?p=glibc.git;a=patch;h=801af9fafd4689337ebf27260aa115335a0cb2bc (From OE-Core rev: eadf28a0640c9b714bfa8081626641a7d3d30537) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* epiphany: Security fix for CVE-2023-26081Siddharth Doshi2023-03-202-0/+91
| | | | | | | | | Upstream-Status: Backport from [https://gitlab.gnome.org/GNOME/epiphany/-/commit/53363c3c8178bf9193dad9fa3516f4e10cff0ffd] (From OE-Core rev: d5390008c3747073e4dfcc120b335d14dd0a08c9) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* migration-guides: add 4.0.8 release notesMichael Opdenacker2023-03-202-0/+220
| | | | | | | (From yocto-docs rev: 86d0b38a97941ad52b1af220c7b801a399d50e93) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: cookerdata: Drop dubious exception handling codeRichard Purdie2023-03-141-5/+0
| | | | | | | | | | | | | This code appears to be dangerous, it swallows exceptions, turning them into "handled" versions which then show no errors to the user. This is a pretty poor user experience and I can't see why this code should be swallowing such things. Drop the worst bits of code. (Bitbake rev: a29ffcc12df24737e702e198aeb8f6892884932b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: cookerdata: Improve early exception handlingRichard Purdie2023-03-141-9/+1
| | | | | | | | | | | | | | | | | | Martin Jansa reported that if you put a syntax error into an imported module such as qa.py in OE, no error is shown. Part of the issue appears to be that the catch_parse_error() decorator only catches certain exceptions and SyntaxError isn't one of them. As far as I can tell we should remove all the special cases and use the more advanced code in all cases, not just expansion errors. I confirmed this now prints a proper error message for a qa.py syntax error. (Bitbake rev: e66012bfda60ffe1658473e25879aa67909ae65f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: cookerdata: Remove incorrect SystemExit usageRichard Purdie2023-03-141-1/+1
| | | | | | | | | | | | | Calling SystemExit doesn't work well with server/client usage since the string isn't printed to the right place. Use bb.fatal() instead which prints the right log output and raises and handled exception which then shows correctly on the UI. (Bitbake rev: b9ae7164d9e744e8eb9aaff79218f57233a449b7) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: utils: Allow to_boolean to support int valuesRichard Purdie2023-03-141-0/+3
| | | | | | | | | | | | | | | | | | Some variables may be set as: X = 1 as well the more usual X = "1" so add support to to_boolean to handle this case. (Bitbake rev: e7df13a61911b7431802af2b4d7472b2aaf346fa) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nghttp2: never build python bindingsJoe Slater2023-03-091-0/+4
| | | | | | | | | | This has already been done for oe-core/master. (From OE-Core rev: 9e8cbf46fe6e4e257b76b228de56d4a891199896) Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* runqemu: kill qemu if it hangsMikko Rapeli2023-03-091-9/+15
| | | | | | | | | | | | | | qemu doesn't always behave well and can hang too. kill it with force if it was still alive. Move clean up commands into cleanup() function. (From OE-Core rev: 929e7679c1d9b21ac5130a9cbc83c415fb9f63f5) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 079c2935d2f585ce49e1c7daab2155fcf0094c48) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa ssh.py: fix hangs in run()Mikko Rapeli2023-03-091-9/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When qemu machine hangs, the ssh commands done by tests are not timing out. do_testimage() task has last logs like this: DEBUG: time: 1673531086.3155053, endtime: 1673531686.315502 The test process is stuck for hours, or for ever if the executing command or test case did not set a timeout correctly. The default 300 second timeout is not working when target hangs. Note that timeout is really a "inactive timeout" since data returned by the process will reset the timeout. Make the process stdout non-blocking so read() will always return right away using os.set_blocking() available in python 3.5 and later. Then change from python codec reader to plain read() and make the ssh subprocess stdout non-blocking. Even with select() making sure the file had input to be read, the codec reader was trying to find more stuff and blocking for ever when process hangs. While at it, add a small timeout to read data in larger chunks if possible. This avoids reading data one or few characters at a time and makes the debug logs more readable. close() the stdout file in all cases after read loop is complete. Then make sure to wait or kill the ssh subprocess in all cases. Just reading the output stream and receiving EOF there does not mean that the process exited, and wait() needs a timeout if the process is hanging. In the end kill the process and return the return value and captured output utf-8 encoded, just like before these changes. This fixes ssh run() related deadlocks when a qemu target hangs completely. (From OE-Core rev: 04f080802b4a28709a105e4f0ead56a7a2da42b4) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 9c63970fce3a3d6029745252a6ec2bf9b9da862d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libseccomp: fix for the ptest result formatNarpat Mali2023-03-091-0/+3
| | | | | | | | | | | | | | | | | | The output of libseccomp ptest should follow a unified format as per this https://wiki.yoctoproject.org/wiki/Ptest Replaced the test results SUCCESS, FAILURE & SKIPPPED with PASS, FAIL & SKIP and printing the ptest result with the below format result: testname (From OE-Core rev: 20f15c72ad7e52fb68669bce8be57bbe5a366ca3) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 30d025a8641cfcce5412b5f021478777620b55f1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel-yocto: fix kernel-meta data detectionUlrich Ölmann2023-03-091-1/+1
| | | | | | | | | | | | Fixes: 7ef7af5c03ba ("kernel-yocto: restore kernel-meta data detection for SRC_URI elements") (From OE-Core rev: c92593af46ef2ccbaaff89bb75eac46b3ac8b856) Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c77754f23e3fb49a62602a6c6a04d5525d1cf457) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lib/buildstats: handle tasks that never finishedRoss Burton2023-03-091-6/+27
| | | | | | | | | | | | | If a task is aborted the buildstats file isn't complete, so calculate when the build finished and use that as a end time. (From OE-Core rev: ffce2744f5833d1c30db7f50443503b3c1a1d119) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 23ebaec476dc46aebe5997f025661137f3e341bd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/selftest/resulttooltests: fix minor typoAlexis Lothoré2023-03-091-1/+1
| | | | | | | | | | (From OE-Core rev: 2da6b6f231519b32fde61a64559aa105f2a9342f) Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 80cfa56d133bd3abbb1f37272607d8e15ce70861) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libssh2: Clean up ptest patch/coverageRichard Purdie2023-03-094-48/+25
| | | | | | | | | | | | | | | | | | Martin Jansa spotted patchreview.py reports Malformed Upstream-Status in a patch in this recipe. The patch is not being applied since there is no ptest override. The test in question was also disabled due to an issue with new versions of openssh. Add a workaround for the broken test, enable it, drop the broken patch. (From OE-Core rev: 2c05ee17d58774fc628b8a5b55a14551590fadaa) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e9f2cc084638ce9cb5339df611e473c30f0e40b1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lttng-modules: fix for kernel 6.2+Bruce Ashfield2023-03-092-0/+46
| | | | | | | | | | | | | Backporting a patching from the 2.13.x stable branch of lttng to fix the build against kernel 6.2+. (From OE-Core rev: d04dcd155fb8ce420c66b53ae61360680513ccf8) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3aed7dfe5ff6f52497dcffa58bc2f06cf709ea18) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dhcpcd: fix dhcpcd start failure on qemuppc64Xiangyu Chen2023-03-092-0/+35
| | | | | | | | | | | | | Backport patch to fix dhcpcd start failed on qemuppc64. (From OE-Core rev: 4b4f071fd178b4c8208fccf2e218d3945ed224e3) Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a31d658198566de12cdd1aad18776b8da8065787) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sstatesig: Improve output hash calculationMateusz Marciniec2023-03-091-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Symbolic links to the files are included during the output hash calculation but symlinks to the directories are missed. So if the new symlink to a directory was the only change made, then the output hash won't change, and the Hash Equivalence server may change unihash. In the next run bitbake may use an older package from sstate-cache. To fix this followlinks=True flag could be set for os.walk but it can lead to infinite recursion if link points to a parent directory of itself. Also, all files from a directory to which symlink points would be included in depsig file. Therefore another solution was applied, I added code that will loop through directories and process those that are symlinks. (From OE-Core rev: 477a4e816494e256b309fd7e84b2c3796708e6e8) Signed-off-by: Mateusz Marciniec <mateuszmar2@gmail.com> Signed-off-by: Tomasz Dziendzielski <tomasz.dziendzielski@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ee729163f31f26b1462a47e1e53f7a0f9de9b464) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: Fix depmod patchSaul Wold2023-03-091-1/+1
| | | | | | | | | | | | | | | | | The original patch was actually allowing .debug modules though which was in-correct. This change blocks the parsing of .debug modules (which is correct). As noted in [YOCTO #15022] this should address the empty modules.dep when using the BusyBox depmod. (From OE-Core rev: 49bddef864768bbf339513414b42a820f861bdb7) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 339c3c3abe8d405cfe7b3f34db9b3547bcaaf878) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wic: Fix usage of fstype=none in wicPavel Zhukov2023-03-091-0/+5
| | | | | | | | | | | | | | | | | | | | | | | This allows to specify partition with fstype=none in the wks file to have partition created but without following mkfs. The none fstype is in the list already but the usage is not documented. Example; part /data --ondisk mmcblk0 --fstype=none --align 4096 --fixed-size 512 will create a partition, filesystem may be created manualy on the host or target and data will be preserved if the device is reflashed using same wks. Works with bmaptool and probably does not work with dd. Use case is persistent filesystem/data between reflashing of the image. (From OE-Core rev: 9af61442c8bc2e0b447706734cb90b3f4bcb2d6b) Signed-off-by: Pavel Zhukov <pavel@zhukoff.net> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 351cb64da37aa43113e5192605d04436652aa3b8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix dependencies when building with ldap/ldapsFederico Pellegrin2023-03-091-2/+2
| | | | | | | | | | | | | | | | | | openldap is added as a dependency so the build will not fail, as otherwise ldap headers are not found during configure phase Note: due to upstream bug (now fixed) building LDAP/LDAPS support with minimal configurations can sometimes not work, see details at: https://github.com/curl/curl/pull/10445 (From OE-Core rev: e6a001c22ec1b0d5487027148dda099847474272) Signed-off-by: Federico Pellegrin <fede@evolware.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a999f62f5692687a5557f7a50c7c768c50f3d7d3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wireless-regdb: upgrade 2022.08.12 -> 2023.02.13Alexander Kanavin2023-03-091-1/+1
| | | | | | | | | | (From OE-Core rev: 2f5dfa6dac8f7e366c58e2d24a535b8a1e7e43f6) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit a8e8ea1b4b100b6f0ba5ca9441a8f3f1ac31fbfd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-firmware: upgrade 20230117 -> 20230210Alexander Kanavin2023-03-091-2/+2
| | | | | | | | | | | | License-Update: additional firmwares (From OE-Core rev: 2658aa90d07cbee2e1d94158bbab2e758b5ffd9f) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 8e6134d39b840d96e1c37d3df21a522afea8bc76) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-firmware: add yamato fw files to qcom-adreno-a2xx packageDmitry Baryshkov2023-03-091-4/+10
| | | | | | | | | | | | | | | | Newest linux-firmware release got firmware for Adreno A200. Add these two files to the ${PN}-qcom-adreno-a2xx package. As these files are licensed under a separate BSD-3-Clause license, add separate license package too. (From OE-Core rev: 97e0687455c91acbe57dbaf3cbfaed5d962e4ee6) Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 56e1b2b06ef7f22d4ac5899046f650ae8ec0d547) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-firmware: properly set license for all Qualcomm firmwareDmitry Baryshkov2023-03-091-0/+25
| | | | | | | | | | | | | | | It is not enough to depend on the ${PN}-qcom-license package. Set LICENSE variable for all the qcom packages to point to the proper license. (From OE-Core rev: bc41970a9a1f1e9227b24679aae935326cd4bf94) Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9dc41e18dc138a7cce920f8e4c85eb3130c0d553) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Upgrade 3.0.7 -> 3.0.8Siddharth Doshi2023-03-092-45/+1
| | | | | | | | | | | | | | | | | | | | | | | | | OpenSSL 3.0.8 fixes 1 HIGH level security vulnerability and 7 MODERATE level security vulnerability [1]. Upgrade the recipe to point to 3.0.8. CVE-2022-3996 is reported fixed in 3.0.8, so drop the patch for that as well. [1] https://www.openssl.org/news/vulnerabilities.html CVEs Fixed: https://www.openssl.org/news/secadv/20230207.txt (From OE-Core rev: e356e203a72fc2062b63b0f744b15313e41e2880) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8461466f63200a0b1c9c247b70fdf5819651544c) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit f5dce7274bfd65c05df932f36a5e43cfc884fd41) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dbus: upgrade 1.14.4 -> 1.14.6Alexander Kanavin2023-03-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Denial of service fixes: • Fix an incorrect assertion that could be used to crash dbus-daemon or other users of DBusServer prior to authentication, if libdbus was compiled with assertions enabled. We recommend that production builds of dbus, for example in OS distributions, should be compiled with checks but without assertions. (dbus#421, Ralf Habacker; thanks to Evgeny Vereshchagin) Other fixes: • When connected to a dbus-broker, stop dbus-monitor from incorrectly replying to Peer method calls that were sent to the dbus-broker with a NULL destination (dbus#301, Kai A. Hiller) • Fix out-of-bounds varargs read in the dbus-daemon's config-parser. This is not attacker-triggerable and appears to be harmless in practice, but is technically undefined behaviour and is detected as such by AddressSanitizer. (dbus!357, Evgeny Vereshchagin) • Avoid a data race in multi-threaded use of DBusCounter (dbus#426, Ralf Habacker) • Fix a crash with some glibc versions when non-auditable SELinux events are logged (dbus!386, Jeremi Piotrowski) • If dbus_message_demarshal() runs out of memory while validating a message, report it as NoMemory rather than InvalidArgs (dbus#420, Simon McVittie) • Use C11 _Alignof if available, for better standards-compliance (dbus!389, Khem Raj) • Stop including an outdated copy of pkg.m4 in the git tree (dbus!365, Simon McVittie) • Documentation: · Consistently use Gitlab bug reporting URL (dbus!372, Marco Trevisan) • Tests fixes: · Fix the test-apparmor-activation test after dbus#416 (dbus!380, Dave Jones) Internal changes: • Fix CI builds with recent git versions (dbus#447, Simon McVittie) (From OE-Core rev: be5d5919242d6d26bdb1e70b83aab88949ffe0eb) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 31245df3061c1a913bffe5e11ad6ac7fa9c83915) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 83e9bd1507fd5f79c680dde30b0f66df84cde6b0) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xwayland: upgrade 22.1.7 -> 22.1.8Wang Mingyu2023-03-091-1/+1
| | | | | | | | | | | | | | | xwayland 22.1.8 - Security fix for CVE-2023-0494 (From OE-Core rev: c4f35a99a0f840ccd50fd3514a63ea5bb90784a8) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e0ca374267cce807d12d706564989900fe61bd97) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 964ca02debe1e85cb91789dee1d08344f4fcf33a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libjpeg-turbo: upgrade 2.1.5 -> 2.1.5.1Wang Mingyu2023-03-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== 1. The SIMD dispatchers in libjpeg-turbo 2.1.4 and prior stored the list of supported SIMD instruction sets in a global variable, which caused an innocuous race condition whereby the variable could have been initialized multiple times if 'jpeg_start_*compress()' was called simultaneously in multiple threads. libjpeg-turbo 2.1.5 included an undocumented attempt to fix this race condition by making the SIMD support variable thread-local. However, that caused another issue whereby, if 'jpeg_start_*compress()' was called in one thread and 'jpeg_read_*()' or 'jpeg_write_*()' was called in a second thread, the SIMD support variable was never initialized in the second thread. On x86 systems, this led the second thread to incorrectly assume that AVX2 instructions were always available, and when it attempted to use those instructions on older x86 CPUs that do not support them, an illegal instruction error occurred. The SIMD dispatchers now ensure that the SIMD support variable is initialized before dispatching based on its value. (From OE-Core rev: 195aae4fcb14c818629b04fc371910125a4b3277) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 009a1b0390d791d614b8d4a1407e7479c261f60d) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit d57de2a7169de369105ed9bce19a43dad68f350a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: update 9.0.1211 -> 9.0.1293 to resolve open CVEsAlexander Kanavin2023-03-091-2/+2
| | | | | | | | | | | (From OE-Core rev: 5eb050c439d891188ded3e79bf1e5b5695f24872) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6d77dbe499ee362b6e28902f1efcf52b961037a5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xserver-xorg: 21.1.6 -> 21.1.7Kai Kang2023-03-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | According to the ANNOUNCE of xorg-server 21.1.7[1]: This release contains the fix for CVE-2023-0494 in today's security advisory: https://lists.x.org/archives/xorg-announce/2023-February/003320.html It also fixes a second possible OOB access during EnqueueEvent and a crasher caused by ResourceClientBits not correctly honouring the MaxClients value in the configuration file. Finally, a bunch of Xquartz updates including the ability to correctly detect ssh-tunneled clients as remote. [1]: https://lists.x.org/archives/xorg-announce/2023-February/003321.html (From OE-Core rev: b69011d194a39ea7812fdd8fc59ba12b6e0416a9) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 60737bee6466e206d8f3c751910dfce00b60d703) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* package.bbclase: Add check for /build in copydebugsources()Saul Wold2023-03-091-0/+7
| | | | | | | | | | | | | | | | This is needed when the SDK or eSDK is installed in a /build top level directory as it conflicts with the build directory within the existing /usr/src/debug/build (which is really a link). Rename it and then do the copy, this is not an issue with master currently due to some other changes that occurred in master. Fixes: [YOCTO #15026] (From OE-Core rev: 80839835ec9fcb63069289225a3c1af257ffdef7) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* less: backport the fix for CVE-2022-46663Hitendra Prajapati2023-03-092-0/+32
| | | | | | | | | | Upstream-Status: Backport from https://github.com/gwsw/less/commit/a78e1351113cef564d790a730d657a321624d79c (From OE-Core rev: 6cec065d795a562460c422947ac70c4a6f3f3175) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsdl2: fix CVE-2022-4743Changqing Li2023-03-092-0/+41
| | | | | | | | (From OE-Core rev: 41e13e88dd1f9d251d1e86ee1de543165789a579) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils : Fix CVE-2023-22608Yash Shinde2023-03-094-0/+751
| | | | | | | | | | Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=8af23b30edbaedf009bc9b243cd4dfa10ae1ac09] (From OE-Core rev: 3dd27bbe8c19aa358916de940453de81d3831510) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.8kirkstone-4.0.8Richard Purdie2023-02-271-1/+1
| | | | | | (From OE-Core rev: b20e2134daec33fbb8ce358d984751d887752bd5) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* poky.conf: bump version for 4.0.8Steve Sakoman2023-02-271-1/+1
| | | | | | | (From meta-yocto rev: 2903a4ac643f390bc0ca0899187b89ecd346d294) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/selftest/bbtests: Update message lookup for test_git_unpack_nonetwork_failAlexandre Belloni2023-02-241-1/+1
| | | | | | | | | | | | bitbake's output changed, update the test (From OE-Core rev: 6b50713cd51002584915f46eb366b8667db210ea) Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7e64b63f96dd1d71e263e7bbbe6591e51e98395a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa qemurunner.py: try to avoid reading one character at a timeMikko Rapeli2023-02-241-0/+2
| | | | | | | | | | | | | | Read from serial console with a small delay to bundle data to e.g. full lines. Reading one character at a time is not needed and causes busy looping. (From OE-Core rev: e91a09702680b713293bcfcc851b27a73e884a8b) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 0049f6757f6f956fb4cc77b3df6a672c20b53cf4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa qemurunner.py: add timeout to QMP callsMikko Rapeli2023-02-241-0/+3
| | | | | | | | | | | | | | | | | | When a qemu machine hangs, the QMP calls can hang for ever too, and when this happens any failing test commands from ssh runner may be followed by dump_monitor() calls which then also hang. Hangs followed by hangs. Use runqemutime at setup and run_monitor() specific timeout for later calls. (From OE-Core rev: 3b99d0ce6445084038f89dfa98605a7aec49107b) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 3a07bdf77dc6ecbf4c620b051dd032abaaf1e4ff) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa qemurunner: read more data at a time from serialMikko Rapeli2023-02-241-1/+3
| | | | | | | | | | | | | | Use a short sleep to bundle serial console reads so that we are not reading one character at a time which reduces busy looping. (From OE-Core rev: 3699e5bf2f9259266c49aaf69127183988b9d052) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit cafe65d8cf7544edbd387f7f5f6d77c64c6b18fa) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa dump.py: add error counter and stop after 5 failuresMikko Rapeli2023-02-241-2/+21
| | | | | | | | | | | | | | | | | | | | | | If test target qemu machine hangs completely, dump_target() calls over serial console are taking a long time to time out, possibly for every failing ssh command execution and a lot of test cases, and same with dump_monitor(). Instead of trying for ever, count errors and after 5 stop trying to dump_target() and dump_monitor() completely. These help to end testing earlier when a test target is completely deadlocked and all ssh, serial and QMP communication with it are failing. (From OE-Core rev: 91bc1e03bc990c527d8aadbdcd7bf97217db124e) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit d9ad0a055abba983c6cee1dca4d2f0a8a3c48782) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa ssh.py: add connection keep alive options to ssh clientMikko Rapeli2023-02-241-0/+2
| | | | | | | | | | | | | | | | | | | | Configure ssh client to test that connection with server is up. If the server does not respond within a minute then the connection, target machine or sshd daemon are stuck and it's better to exit the command execution with errors. Some tests can execute a long time without returning stdout/stderror data and it's difficult to adjust timers for those cases if connection to target machine or the target machine itself hangs and output is not expected in minutes or even hours. (From OE-Core rev: 94021c8571242dd491ee3c7c40144c5a12ca8e42) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit ba68ff04c5786eca7cd8dd44056705867dea8ac4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa ssh.py: move output prints to new lineMikko Rapeli2023-02-241-3/+3
| | | | | | | | | | | | | The output from is garbled otherwise and it's not easy to remove debug output form real command output on target. (From OE-Core rev: 36b572fbc5c88b9aaf4e146ecdb00c8d4ea6ff70) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 917a70cbc43ac1c70c477b220c4115735457ef04) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* devshell: Do not add scripts/git-intercept to PATHPeter Kjellerstedt2023-02-241-2/+0
| | | | | | | | | | | | | | | The use of scripts/git-intercept was introduced in commit 3266c327df (install/devshell: Introduce git intercept script due to fakeroot issues) and later reverted in commit af27c81eaf (scripts: Make git intercept global). (From OE-Core rev: 70ee5f9d50bec6e708cd2006c11ef3d0bd7cab42) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit f6c260c8e2a33e282a35afc99de4ef8cc1791b08) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-16 23:10:00 +0000