summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* pixman: backport fix for CVE-2022-44638Ross Burton2022-12-072-0/+35
| | | | | | | | | | | | | | | | (From OE-Core rev: 1d2e131d9ba55626354264d454b2808e84751600) (From OE-Core rev: fe5a5009939f056ff4d9d3426832d0b67a668ed6) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 23df4760ebc153c484d467e51b414910c570a6f8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 37595eeddfb01110d8cdc628be76a8bf6bde483a) Signed-off-by: Bhabu Bindu <bindu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sstate: Account for reserved characters when shortening sstate filenamesManuel Leonhardt2022-12-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Previously, when shortening sstate filenames, the reserved characters for .siginfo were not considered, when siginfo=False, resulting in differently shortend filenames for the sstate and siginfo files. With this change, the filenames of the truncated sstate and siginfo files have the same basename, just as is already the case for untruncated filenames. Making sure that the .siginfo files always have the filename of the corresponding sstate file plus its .siginfo suffix, also when being truncated, makes it easier to manage the sstate cache and an sstate mirror outside of Bitbake/Yocto. (From OE-Core rev: 408bf1b4bb4f4ed126c17fb3676f9fa0513065ba) Signed-off-by: Manuel Leonhardt <mleonhardt@arri.de> Cc: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c2e0e43b7123cf5149833e0072c8edaea3629112) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.0614 -> 9.0.0820Tim Orling2022-12-071-2/+2
| | | | | | | | | | | | | | | | | Includes fixes for CVE-2022-3705 https://nvd.nist.gov/vuln/detail/CVE-2022-3705 For a short list of important changes, see: https://www.arp242.net/vimlog/ (From OE-Core rev: 3251dc441a31b2d4d7acb690bd6db13f0f99a1d0) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f6d917bd0f8810b5ed8d403ad25d59cda2fc9574) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* maintainers: update gcc version to 9.5Steve Sakoman2022-12-071-1/+1
| | | | | SIgned-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc: upgrade to v9.5Sundeep KOKKONDA2022-12-0755-1636/+4
| | | | | | | | | | | | | gcc stable version upgraded from v9.3 to v9.5 Below is the bug fix list for v9.5 https://gcc.gnu.org/bugzilla/buglist.cgi?bug_status=RESOLVED&resolution=FIXED&target_milestone=9.5 (From OE-Core rev: 698c3323fd95592e815345acd9070e5089a1bd00) Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2022-30630Ralph Siemsen2022-12-071-0/+3
| | | | | | | | | | | | | | The CVE is in the io/fs package, which first appeared in go1.16. Since dunfell is using go1.14, this issue does not apply. CVE was fixed in fa2d41d0ca736f3ad6b200b2a4e134364e9acc59 Original code in b64202bc29b9c1cf0118878d1c0acc9cdb2308f6 (From OE-Core rev: 1e258940e9a6fabda6e7e60841082c113fdf9500) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2022-30580Ralph Siemsen2022-12-071-0/+1
| | | | | | | | | | | | | | | | Only affects Windows platform, as per the release announcement [1]: "If, on Windows, Cmd.Run, cmd.Start, cmd.Output, or cmd.CombinedOutput are executed when Cmd.Path is unset and, in the working directory, there are binaries named either "..com" or "..exe", they will be executed." [1] https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ (From OE-Core rev: 54c40730bc54aa2b2c12b37decbcc99bbcafd07a) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2021-41772Ralph Siemsen2022-12-071-0/+3
| | | | | | | | | | | | | | | | | Dunfell uses golang 1.14 which does not contain the affected code (it was introduced in golang 1.16). From the golang announcement [1] "Reader.Open (the API implementing io/fs.FS introduced in Go 1.16) can be made to panic by an attacker providing either a crafted ZIP archive containing completely invalid names or an empty filename argument. [1] https://groups.google.com/g/golang-announce/c/0fM21h43arc (From OE-Core rev: 2329902f994b631d6b77e8bd501d5599db6d5306) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2021-33194Ralph Siemsen2022-12-071-0/+3
| | | | | | | | | | | | | This is a bug in golang.org/x/net/html/parse.go. The golang compiler includes a partial copy of this under src/vendor/golang.org/x/net/ however the "html" subdirectory is not included. So this bug does not apply to the compiler itself. (From OE-Core rev: b8a851faef9990ccb41ded875fc79cf28abd4a4e) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2022-29804Ralph Siemsen2022-12-071-0/+1
| | | | | | | | | | | | | | | The issue only affects Windows per the golang announcement [1]: On Windows, the filepath.Clean function could convert an invalid path to a valid, absolute path. For example, Clean(`.\c:`) returned `c:`. [1] https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg (From OE-Core rev: bca720eca95929752436b56aa01e7fddfa1c834f) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2022-28327Ralph Siemsen2022-12-072-0/+37
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/7139e8b024604ab168b51b99c6e8168257a5bf58] CVE: CVE-2022-28327 (From OE-Core rev: aab2a343be4b0b21dcaf22a7fbf77007d48c08d6) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2022-28131Ralph Siemsen2022-12-072-0/+105
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/58facfbe7db2fbb9afed794b281a70bdb12a60ae] CVE: CVE-2022-28131 (From OE-Core rev: 09a820fe21d7884c6733d569f6560ef1ded5435d) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2022-24291Ralph Siemsen2022-12-072-0/+199
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/2b65cde5868d8245ef8a0b8eba1e361440252d3b] CVE: CVE-2022-24921 (From OE-Core rev: a2d3d80a7df5b8f57105ef2b680e9e01a9da6486) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2021-44716Ralph Siemsen2022-12-072-0/+94
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/d0aebe3e74fe14799f97ddd3f01129697c6a290a] CVE: CVE-2021-44716 (From OE-Core rev: c5ec3e8701a1b81d8e5b17d2521530345892a09b) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2021-33198Ralph Siemsen2022-12-072-0/+114
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/df9ce19db6df32d94eae8760927bdfbc595433c3] CVE: CVE-2021-33198 (From OE-Core rev: 078260dd63e205d3a433b03357f2332f44daa397) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2021-33195Ralph Siemsen2022-12-072-0/+374
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/31d60cda1f58b7558fc5725d2b9e4531655d980e] CVE: CVE-2021-33195 (From OE-Core rev: f1051e11fd0eb5b0e9924a0acdcb078ddc8f9772) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Fix CVE-2022-40304Bhabu Bindu2022-12-072-0/+105
| | | | | | | | | | | | | | Fix dict corruption caused by entity reference cycles Link: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b Upstream-Status: Pending (From OE-Core rev: 8e195f0a01b4cc1017bf9df67ffc3c6d6c15d24a) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Fix CVE-2022-40303Bhabu Bindu2022-12-072-0/+624
| | | | | | | | | | | | | | Fix integer overflows with XML_PARSE_HUGE Link: https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0 Upstream-Status: Pending (From OE-Core rev: d16d5660a32386158632ee5599ad92a9f2dc08dd) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtasn1: fix CVE-2021-46848 off-by-one in asn1_encode_simple_derVivek Kumbhar2022-12-072-0/+46
| | | | | | | | | | Upstream-Status: Backport [https://gitlab.com/gnutls/libtasn1/-/commit/44a700d2051a666235748970c2df047ff207aeb5] (From OE-Core rev: 305f1c56121436da7be39c5980fc11f779188ab7) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Fix CVE-2022-45061Omkar2022-12-072-0/+101
| | | | | | | | | | | | | Fix CVE-2022-45061, referenced as https://github.com/python/cpython/issues/98433 patch taken from https://github.com/python/cpython/pull/99231/commits/064ec20bf7a181ba5fa961aaa12973812aa6ca5d (From OE-Core rev: 4498ca9a299bd5d9a7173ec67daf17cb66b6d286) Signed-off-by: Omkar <omkarpatil10.93@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Fix CVE-2022-3821 issueRanjitsinh Rathod2022-12-072-0/+48
| | | | | | | | | | | | | | | An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service. Add a patch to solve above CVE issue Link: https://github.com/systemd/systemd/commit/9102c625a673a3246d7e73d8737f3494446bad4e (From OE-Core rev: e2db40ca49b8ed217f14c7f861087837e8b3f389) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sudo: CVE-2022-43995 heap-based overflow with very small passwordsHitendra Prajapati2022-12-072-0/+60
| | | | | | | | | | Upstream-Status: Backport from https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050 (From OE-Core rev: d1bdb663e6a69993d3f42547a27296b606965d47) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.21dunfell-23.0.21Richard Purdie2022-11-221-1/+1
| | | | | | (From OE-Core rev: 1ee082e979baaba871bbe1d91181bb04951faf3b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: utils: Fix lockfile path length issuesRichard Purdie2022-11-221-3/+6
| | | | | | | | | | | | | | | | If the path to bitbake.lock is in a deep directory, bitbake will hang. The reason was that the max file length limiting code (to 255 chars) was including the directory name and it should only act on the filename within the directory. Fix it to just use the base filename. [YOCTO #14766] (Bitbake rev: e3db9c2e9eded3c5cb6040714a6054b44f6b3880) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 89d70e7b71eecfe06592202f326e566c579ba01d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: utils: Handle lockfile filenames that are too long for filesystemsRichard Purdie2022-11-221-1/+5
| | | | | | | | | | | | | | | | The fetcher mirror code can go crazy creating lock filenames which exceed the filesystem limits. When this happens, the code will loop/hang. Handle the filename too long exception correctly but also truncate lockfile lengths to under 256 since the worst case situation is lockfile overlap and lack of parallelism. (Bitbake rev: 30d42ef030d03e11322b6b05ea7bbb64ab3d6f21) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 63baf3440b16e41ac6601de21ced94a94bdf1509) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionRichard Purdie2022-11-221-1/+1
| | | | | | (From OE-Core rev: a5d90bf22c037044c471daefe326ae14702b173e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* poky.conf: bump version for 3.1.21Steve Sakoman2022-11-221-1/+1
| | | | | | | (From meta-yocto rev: 9b713fe0cc7c5f5cb51bcf760d1a1c6540b485f1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* documentation: update for 3.1.21Steve Sakoman2022-11-221-5/+5
| | | | | | | | (From yocto-docs rev: 01d31151d5c4a87a466cb49b97eabf75cf47ed98) Signed-off-by: Steve Sakoman <steve@sakoman.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wic: swap partitions are not added to fstabciarancourtney2022-11-201-1/+1
| | | | | | | | | | | | - Regression in 7aa678ce804c21dc1dc51b9be442671bc33c4041 (From OE-Core rev: ce99d451a54b8ce46b7f9030deaba86355009b1a) Signed-off-by: Ciaran Courtney <ciaran.courtney@activeenergy.ie> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit f1243572ad6b6303fe562e4eb7a9826fd51ea3c3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sanity: check for GNU tar specificallyRoss Burton2022-11-201-0/+8
| | | | | | | | | | | | | | | We need the system tar to be GNU tar, as we reply on --xattrs. Some distributions may be using libarchive's tar binary, which is definitely not as featureful, so check for this and abort early with a clear message instead of later with mysterious errors. (From OE-Core rev: 8f852648fe730615c99bcdaace8a4748ef4e96a5) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7dd2b1cd1bb10e67485dab8600c0787df6c2eee7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* externalsrc.bbclass: Remove a trailing slash from ${B}Peter Kjellerstedt2022-11-201-1/+1
| | | | | | | | | | | | | | | The trailing slash in ${B} caused -fdebug-prefix-map=${B}=... to not match as intended, resulting in ${TMPDIR} ending up in files in ${PN}-dbg when externalsrc was in use, which in turn triggered buildpath QA warnings. (From OE-Core rev: fa89e048e223ae2e96d0f55979f93f29904b5229) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 9b5031ed5a0d102905fa75acc418246c23df6eef) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* externalsrc.bbclass: fix git repo detectionMartin Jansa2022-11-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fix issue introduced in: https://git.openembedded.org/openembedded-core/commit/?id=95fbac8dcad6c93f4c9737e9fe13e92ab6befa09 * it added check for s_dir + git-dir (typically '.git') isn't the same as ${TOPDIR} + git-dir, but due to copy-paste issue it was just comparing it with s_dir + git-dir again, resulting in most external repos (where git-dir is '.git') to be processed as regular directory (not taking advantage of git write-tree). * normally this wouldn't be an issue, but for big repo with a lot of files this added a lot of checksums in: d.setVarFlag('do_compile', 'file-checksums', '${@srctree_hash_files(d)}') and I mean *a lot, e.g. in chromium build it was 380227 paths which still wouldn't that bad, but the checksum processing in siggen.py isn't trivial and just looping through all these checksums takes very long time (over 1000sec on fast NVME drive with warm cache) and then https://git.openembedded.org/bitbake/commit/?id=b4975d2ecf615ac4c240808fbc5a3f879a93846b made the processing a bit more complicated and the loop in get_taskhash() function took 6448sec and to make things worse there was no output from bitbake during that time, so even with -DDD it looks like this: DEBUG: virtual/libgles2 resolved to: mesa (langdale/oe-core/meta/recipes-graphics/mesa/mesa_22.2.0.bb) Bitbake still alive (no events for 600s). Active tasks: Bitbake still alive (no events for 1200s). Active tasks: Bitbake still alive (no events for 1800s). Active tasks: Bitbake still alive (no events for 2400s). Active tasks: Bitbake still alive (no events for 3000s). Active tasks: Bitbake still alive (no events for 3600s). Active tasks: Bitbake still alive (no events for 4200s). Active tasks: Bitbake still alive (no events for 4800s). Active tasks: Bitbake still alive (no events for 5400s). Active tasks: Bitbake still alive (no events for 6000s). Active tasks: DEBUG: Starting bitbake-worker without -DDD it will get stuck for almost 2 hours in: "Initialising tasks..." before it finally writes sstate summary like: "Sstate summary: Wanted 3102 Local 0 Mirrors 0 Missed 3102 Current 1483 (0% match, 32% complete)" * fix the copy&paste typo to use git work-tree in most cases, but be aware that this issue still exists for huge local source trees not in git [YOCTO #14942] (From OE-Core rev: 1f0e4de8d92edd7438d462c779d917ac0ccd5499) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 9102e5a94b8146cb1da27afbe41d3db999a914ff) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: upgrade 1.1.1q to 1.1.1sAlex Kiernan2022-11-201-1/+1
| | | | | | | | | | | | | | | | Major changes between OpenSSL 1.1.1r and OpenSSL 1.1.1s [1 Nov 2022] * Fixed a regression introduced in OpenSSL 1.1.1r not refreshing the certificate data to be signed before signing the certificate. Major changes between OpenSSL 1.1.1q and OpenSSL 1.1.1r [11 Oct 2022] * Added a missing header for memcmp that caused compilation failure on some platforms (From OE-Core rev: a39a32efd41c92a3ada49d667979c79101a4a2da) Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc : stable 2.31 branch updates.Sundeep KOKKONDA2022-11-202-16/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Below commits on glibc-2.31 stable branch are updated. d4b7559457 x86-64: Require BMI2 for avx2 functions [BZ #29611] b8bb48a18d x86-64: Require BMI2 for strchr-avx2.S [BZ #29611] c8f2a3e803 Add test for bug 29530 e6ae5b25cd Fix memmove call in vfprintf-internal.c:group_number 1dbe841a67 Remove most vfprintf width/precision-dependent allocations (bug 14231, bug 26211). 5a802723db stdio: Add tests for printf multibyte convertion leak [BZ#25691] ae7748e67f stdio: Remove memory leak from multibyte convertion [BZ#25691] 174d0b61c7 Linux: Require properly configured /dev/pts for PTYs 0a167374fd Linux: Detect user namespace support in io/tst-getcwd-smallbuff 4ad1659d8c getcwd: Set errno to ERANGE for size == 1 (CVE-2021-3999) 3319cea99e support: Add helpers to create paths longer than PATH_MAX f733e291bb support: Fix xclone build failures on ia64 and hppa 43757c70ee support: Add xclone 29d3aeb0e8 Add xchdir to libsupport. 2d7720f316 support: Add create_temp_file_in_dir 183709983d NEWS: Add a bug fix entry for BZ #28896 d385079bd5 x86: Fix TEST_NAME to make it a string in tst-strncmp-rtm.c 7df3ad6560 x86: Test wcscmp RTM in the wcsncmp overflow case [BZ #28896] fc133fcf49 x86: Fallback {str|wcs}cmp RTM in the ncmp overflow case [BZ #28896] 775c05b28c string: Add a testcase for wcsncmp with SIZE_MAX [BZ #28755] c6b346ec55 x86-64: Test strlen and wcslen with 0 in the RSI register [BZ #28064] 0675185923 x86: Remove wcsnlen-sse4_1 from wcslen ifunc-impl-list [BZ #28064] 5db3239baf x86: Black list more Intel CPUs for TSX [BZ #27398] 5b99f172b8 x86: Check RTM_ALWAYS_ABORT for RTM [BZ #28033] 70d293a158 NEWS: Add a bug fix entry for BZ #27974 a2be2c0f5d String: Add overflow tests for strnlen, memchr, and strncat [BZ #27974] 489006c3c5 x86: Optimize strlen-evex.S 937f2c783a x86: Fix overflow bug in wcsnlen-sse4_1 and wcsnlen-avx2 [BZ #27974] 0058c73d11 x86-64: Add wcslen optimize for sse4.1 665d0252f1 x86-64: Move strlen.S to multiarch/strlen-vec.S 82ff13e2cc x86-64: Fix an unknown vector operation in memchr-evex.S 539b593a1d x86: Optimize memchr-evex.S 7b37ae60c6 x86: Optimize strlen-avx2.S 0381c1c10d x86: Fix overflow bug with wmemchr-sse2 and wmemchr-avx2 [BZ #27974] 10368cb76b x86: Optimize memchr-avx2.S 66ca40582e test-strnlen.c: Check that strnlen won't go beyond the maximum length 927bcaf892 test-strnlen.c: Initialize wchar_t string with wmemset [BZ #27655] 0d4159c36c x86-64: Require BMI2 for __strlen_evex and __strnlen_evex c0cbb9345e NEWS: Add a bug fix entry for BZ #27457 e81b975fcc x86-64: Fix ifdef indentation in strlen-evex.S aa4e48e73c x86-64: Use ZMM16-ZMM31 in AVX512 memmove family functions ac911d3b57 x86-64: Use ZMM16-ZMM31 in AVX512 memset family functions 20d37de533 x86: Add string/memory function tests in RTM region fbaa99ed41 x86-64: Add AVX optimized string/memory functions for RTM 096e14f632 x86-64: Add memcmp family functions with 256-bit EVEX f00fad4e4c x86-64: Add memset family functions with 256-bit EVEX cf239ddd2e x86-64: Add memmove family functions with 256-bit EVEX 7257ba7bf2 x86-64: Add strcpy family functions with 256-bit EVEX db9071c0f6 x86-64: Add ifunc-avx2.h functions with 256-bit EVEX 2d612b2c5f x86: Set Prefer_No_VZEROUPPER and add Prefer_AVX2_STRCMP 5b13651085 NEWS: Add a bug fix entry for BZ #28755 5ee8a436ab x86: Fix __wcsncmp_avx2 in strcmp-avx2.S [BZ# 28755] (From OE-Core rev: 1d047a1f19ea57f919180273589cdf7fb4dacaa3) Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils: stable 2.34 branch updatesSundeep KOKKONDA2022-11-203-45/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Below commits on binutils-2.34 stable branch are updated. c4e78c0868a PR27755, powerpc-ld infinite loop 33973d228c9 gas, arm: PR26858 Fix availability of single precision vmul/vmla in arm mode 0c8652fe288 x86: Update GNU property tests 5c1bd3f52c6 x86: Properly merge -z ibt and -z shstk 93b9bf1651a PowerPC TPREL_HA/LO optimisation 58950a3bfd4 Date update e3b314d3a61 aarch64: set sh_entsize of .plt to 0 26b6ab7a0e4 S/390: z13: Accept vector alignment hints 7324292cd94 gas: Fix checking for backwards .org with negative offset 463ec189fe9 Prevent a potential use-after-fee memory corruption bug in the linker (for PE format files). ef2826c0fdb Fix the ARM assembler to generate a Realtime profile for armv8-r. 8524bb5bd28 Re: Fix tight loop on recursively-defined symbols 5768460022b Fix tight loop on recursively-defined symbols a72427b1ae0 gas: PR 25863: Fix scalar vmul inside it block when assembling for MVE 9f57ab49b32 BFD: Exclude sections with no content from compress check. aaf3f0599a2 Arm: Fix LSB of GOT for Thumb2 only PLT. 97f92b3e90a Arm: Fix thumb2 PLT branch offsets. 3053d7a163c include: Sync plugin-api.h with GCC f7aec2b8e09 PR25745, powerpc64-ld overflows string buffer in --stats mode 1b2bf0f65c1 include: Sync plugin-api.h with GCC 5e8619b9597 include: Sync lto-symtab.h and plugin-api.h with GCC 23820109ced plugin: Don't invoke LTO-wrapper 64f5c0afcc4 plugin: Use LDPT_ADD_SYMBOLS_V2 to get symbol type aaa1e160040 Silence warnings due to plugin API change e7c0ee5110c Include: Sync lto-symtab.h and plugin-api.h with GCC b6520be37fd Fix dwarf.c build with GCC 10 a560c29ca5a bfd: Change num_group to unsigned int 3ca4cd1ebde gas, arm: Fix bad backport b3174859c4b gas, arm: PR25660L Fix vadd/vsub with lt and le condition codes for MVE de9c1b7cfe6 powerpc64-ld infinite loop 0318fc4e18e Adjust PR25355 testcase 40bfb976274 Re: PR24511, nm should not mark symbols in .init_array as "t" 42b2380cdce Don't call lto-wrapper for ar and ranlib acc4a8b8ac8 PR25585, PHDR segment not covered by LOAD segment (From OE-Core rev: ad15d44b6c56ccbbe8e4c12717e7dfe3492a659a) Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2021-3638 ati-vga: inconsistent check in ati_2d_blt() may lead ↵Vivek Kumbhar2022-11-202-0/+81
| | | | | | | | | | | | to out-of-bounds write Upstream-Status: Backport from https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg01682.html (From OE-Core rev: 8b5d38abdbfd3bdeb175c793b4d33f9054e89f77) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix CVE-2022-32221 POST following PUTVivek Kumbhar2022-11-202-0/+30
| | | | | | | | | | Upstream-Status: Backport from https://github.com/curl/curl/commit/a64e3e59938abd7d6 (From OE-Core rev: 9af175e122acb93a412ad7a099f0eaa793a1c097) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: Security Fix for CVE-2022-2879Sunil Kumar2022-11-202-0/+112
| | | | | | | | | | | | | | | | archive/tar: limit size of headers Set a 1MiB limit on special file blocks (PAX headers, GNU long names, GNU link names), to avoid reading arbitrarily large amounts of data into memory. Link: https://github.com/golang/go/commit/0a723816cd2 (From OE-Core rev: a8e2f91edfe2df5204a482c4e53fbdd08f80e878) Signed-off-by: Sunil Kumar <sukumar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez: CVE-2022-3637 A DoS exists in monitor/jlink.cHitendra Prajapati2022-11-202-0/+40
| | | | | | | | | | Upstream-Status: Backport from https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/monitor/jlink.c?id=1d6cfb8e625a944010956714c1802bc1e1fc6c4f (From OE-Core rev: c008c56e9b03f0ce3eccf4c01799ae8e987e5cd5) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez5: add dbus to RDEPENDSBartosz Golaszewski2022-11-091-0/+1
| | | | | | | | | | | | | | | Unless we're using systemd, dbus is not pulled into the system automatically. Bluez5 will not work without dbus so add it to RDEPENDS explicitly. (From OE-Core rev: babcb7cd3bbefe9c0ea28e960e4fd6cefbc03cae) Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 377ef7009a8638efe688b6b61f67ae399eb1f23d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* coreutils: add openssl PACKAGECONFIGDaniel McGregor2022-11-091-0/+1
| | | | | | | | | | | | | | | | | coreutils-native will pick up openssl on the host if it's GPL compatible (version >= 3), which causes uninative failures with hosts that don't have openssl3. Add a PACKAGECONFIG entry for openssl so it can be enabled, but isn't by default. (From OE-Core rev: 590d8f2bdbb7ea558b9e99e58a1dae2b5eb58153) Signed-off-by: Daniel McGregor <daniel.mcgregor@vecima.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9859a8124a0c09ac38d476445e7df7097f41d153) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tzdata: update to 2022dAlexander Kanavin2022-11-091-3/+3
| | | | | | | | | | (From OE-Core rev: d325f5389a09ba03b4ded7c57c29dad773dbc0af) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ceac0492e75baa63a46365d8b63275437ad5671f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0598 -> 9.0.0614Teoh Jay Shen2022-11-091-2/+2
| | | | | | | | | | | | Include fixes for CVE-2022-3352. (From OE-Core rev: 30ade05280760253bb1de4f5d757363e1b7e4fc0) Signed-off-by: Teoh Jay Shen <jay.shen.teoh@intel.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 8aa707f80ae1cfe89d5e20ec1f1632a65149aed4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: add timeout to urlopen() callsFrank de Brabander2022-11-091-2/+7
| | | | | | | | | | | | | | | | | | The urlopen() call can block indefinitely under some circumstances. This can result in the bitbake process to run endlessly because of the 'do_fetch' task of cve-update-bb-native to remain active. This adds a default timeout of 60 seconds to avoid this hang, while being large enough to minimize the risk of unwanted timeouts. (From OE-Core rev: f51a6742bcae3a151a326d17cd44935815eb78c7) Signed-off-by: Frank de Brabander <debrabander@gmail.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e5f6652854f544106b40d860de2946954de642f3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* expat: Fix CVE-2022-43680 for expatRanjitsinh Rathod2022-11-092-0/+34
| | | | | | | | | | | | | Add a patch to fix CVE-2022-43680 issue where use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations Link: https://nvd.nist.gov/vuln/detail/CVE-2022-43680 (From OE-Core rev: ac4476e6594417b14bfb05a110009ef245f419b0) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libX11: CVE-2022-3554 Fix memory leakHitendra Prajapati2022-11-092-0/+59
| | | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/1d11822601fd24a396b354fa616b04ed3df8b4ef (From OE-Core rev: 1d36df9c9ec0ea13c4e0c3794b0d97305e2c6ac1) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: CVE-2022-2880 ReverseProxy should not forward unparseable query ↵Hitendra Prajapati2022-11-092-0/+165
| | | | | | | | | | | | parameters Upstream-Status: Backport from https://github.com/golang/go/commit/9d2c73a9fd69e45876509bb3bdb2af99bf77da1e (From OE-Core rev: f977d712455411c091aeee04ea7096d9e8c5b563) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* selftest: skip virgl test on all Alma LinuxSteve Sakoman2022-10-271-2/+2
| | | | | | | | | This test will fail any time the host has libdrm > 2.4.107 (From OE-Core rev: 54bbfe94ae4514386c572564bf221edfdbb2ce38) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* devtool: add HostKeyAlgorithms option to ssh and scp commandsSteve Sakoman2022-10-272-5/+5
| | | | | | | | | | | | | | | With the newer version of ssh in Ubuntu 22.04 we are getting errors of this type: Unable to negotiate with 192.168.7.2 port 22: no matching host key type found. Their offer: ssh-rsa Add -o HostKeyAlgorithms=+ssh-rsa to command invocation as suggested at: http://www.openssh.com/legacy.html (From OE-Core rev: 9275d23c782071382c201bca2d647f6426a64e2f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/kernel-fitimage: add ability to add additional signing optionsPaul Eggleton2022-10-271-1/+5
| | | | | | | | | | | | | | | Add a UBOOT_MKIMAGE_SIGN_ARGS variable to enable passing additional options to uboot-mkimage when it is run the second time to perform signing. (From OE-Core rev: fd39b936b03a6416e7a66408c47578daa2a08cf1) Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8fd7ee7414b45a1feeef7982af3583475902a677) Signed-off-by: Massimiliano Minella <massimiliano.minella@se.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-10 07:06:47 +0000