Commit Graph

8531 Commits

Author SHA1 Message Date
Joe Slater
2854a664cc file: fix call to localtime_r()
Depending on the version of glibc, localtime_r() must
be preceded by a call to tzset() or it will ignore any
value of TZ in the environment.  This problem will only
be seen when building file-native on outdated hosts.

(From OE-Core rev: c99d7fc46a1070b1c659ed16fbff6a3553aaf209)

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 791145f3064d7807630d3591b9e7c7b2dc37152c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-04 05:21:26 -10:00
Chen Qi
6e379bfb8e gcc-crosssdk: ignore MULTILIB_VARIANTS in signature computation
The gcc_multilib_setup function is a function that is run at the
do_configure step, so it's counted into the signature computation.
The MULTILIB_VARIANTS this function uses is also extracted to be
taken into consideration. After the change of setting MULTILIB_VARIANTS
explictly vardeps on MULTILIBS, the change of MULTILIBS changes the
signature, thus causing rebuilding. However, in case of gcc-crosssdk,
the setting of multilib should have no effect on it, as it's used
to build nativesdk packages, not the target packages. So ignore
MULTILIB_VARIANTS in signature computation. This fixes oe-selftest
case sstatetests.SStateHashSameSigs2.test_sstate_nativesdk_samesigs_multilib.

(From OE-Core rev: 537c71162a711dec32a63a657c4b101269a3e267)

(From OE-Core rev: 6b87f7c9e955abe5833820ee7eda9d525c77d2ea)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-29 04:33:44 -10:00
Narpat Mali
22af10c1b1 python3-git: upgrade 3.1.32 -> 3.1.37
The delta between 3.1.32 & 3.1.37 contains the CVE-2023-40590 and
CVE-2023-41040 fixes and other bugfixes.

Changelog:
==========
- WIP Quick doc by @LeoDaCoda in #1608
- Partial clean up wrt mypy and black by @bodograumann in #1617
- Disable merge_includes in config writers by @bodograumann in #1618
- feat: full typing for "progress" parameter in Repo class by @madebylydia in #1634
- Fix CVE-2023-40590 by @EliahKagan in #1636
- #1566 Creating a lock now uses python built-in "open()" method to work arou… by @HageMaster3108 in #1619
- util: close lockfile after opening successfully by @skshetry in #1639
- Bump actions/checkout from 3 to 4 by @dependabot in #1643
- Fix 'Tree' object has no attribute '_name' when submodule path is normal path by @CosmosAtlas in #1645
- Fix CVE-2023-41040 by @facutuesca in #1644
- Only make config more permissive in tests that need it by @EliahKagan in #1648
- Added test for PR #1645 submodule path by @CosmosAtlas in #1647
- Fix Windows environment variable upcasing bug by @EliahKagan in #1650
- Improve Python version and OS compatibility, fixing deprecations by @EliahKagan in #1654
- Better document env_case test/fixture and cwd by @EliahKagan in #1657
- Remove spurious executable permissions by @EliahKagan in #1658
- Fix up checks in Makefile and make them portable by @EliahKagan in #1661
- Fix URLs that were redirecting to another license by @EliahKagan in #1662
- Assorted small fixes/improvements to root dir docs by @EliahKagan in #1663
- Use venv instead of virtualenv in test_installation by @EliahKagan in #1664
- Omit py_modules in setup by @EliahKagan in #1665
- Don't track code coverage temporary files by @EliahKagan in #1666
- Configure tox by @EliahKagan in #1667
- Format tests with black and auto-exclude untracked paths by @EliahKagan in #1668
- Upgrade and broaden flake8, fixing style problems and bugs by @EliahKagan in #1673
- Fix rollback bug in SymbolicReference.set_reference by @EliahKagan in #1675
- Remove @NoEffect annotations by @EliahKagan in #1677
- Add more checks for the validity of refnames by @facutuesca in #1672

Note that the changes to the license file are just removal of excess whitespace
(the extra blank line at the end, and spaces appearing at the end of lines).

References:
https://github.com/gitpython-developers/GitPython/releases
https://github.com/gitpython-developers/GitPython/blob/main/doc/source/changes.rst
e1af18377f

(From OE-Core rev: 931af3758a2d79aea534ab6d23db392ede7cc1bb)

Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-29 04:33:43 -10:00
Yogita Urade
190a134f8e qemu: fix CVE-2023-3354
A flaw was found in the QEMU built-in VNC server. When a client connects
to the VNC server, QEMU checks whether the current number of connections
crosses a certain threshold and if so, cleans up the previous connection.
If the previous connection happens to be in the handshake phase and fails,
QEMU cleans up the connection again, resulting in a NULL pointer dereference
issue. This could allow a remote unauthenticated client to cause a denial
of service.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-3354

(From OE-Core rev: 8f0b34f7ad5ef842d60c9b93ce2c6142d3249890)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-20 05:23:02 -10:00
Martin Jansa
6ebb52f027 gcc: backport a fix for ICE caused by CVE-2023-4039.patch
* see:
  https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111418
  https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111411

(From OE-Core rev: c49f6b9dc8436322359029fecb90b23d639a2100)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-20 05:23:02 -10:00
Ross Burton
992074032e gcc: Fix -fstack-protector issue on aarch64
This series of patches fixes deficiencies in GCC's -fstack-protector
implementation for AArch64 when using dynamically allocated stack space.
This is CVE-2023-4039.  See:

https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64
https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf

for more details.

(From OE-Core rev: 0cb253565c863aa1f677084a440294fe2a03beb0)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-20 05:23:02 -10:00
Siddharth Doshi
42d270eeed gdb: Fix CVE-2023-39128
Note: The Fix needs to be pushed in gdb rather than bintuils-gdb as we are
disabling gdb in binutils configure.

Upstream-Status: Backport from [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=033bc52bb6190393c8eed80925fa78cc35b40c6d]
CVE: CVE-2023-39128
(From OE-Core rev: 173d7ab67f14fc6d8b5d46e1c1de39d20965d6e9)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-20 05:23:02 -10:00
Sanjana
192ba3d46c binutils: Fix CVE-2023-39128
Avoid buffer overflow in ada_decode.

(From OE-Core rev: a6587352b4d204134443430b2ddc605f25a5ae3f)

Signed-off-by: Sanjana <sanjanasanju1608@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-20 05:23:02 -10:00
Sakib Sajal
1b98e3f744 go: upgrade 1.20.6 -> 1.20.7
Upgrade to latest 1.20.x release [1]:

$ git log --oneline go1.20.6..go1.20.7 origin/release-branch.go1.20
adb775e309 (tag: go1.20.7, origin/release-branch.go1.20) [release-branch.go1.20] go1.20.7
659f2a2207 [release-branch.go1.20] crypto/tls: restrict RSA keys in certificates to <= 8192 bits
10d85fa0f6 [release-branch.go1.20] cmd/asm, cmd/internal/obj: generate proper atomic ops for riscv64
bd3a1f24e7 [release-branch.go1.20] net: tolerate permission errors in interface tests
6211a024b4 [release-branch.go1.20] cmd/compile: on PPC64, fix sign/zero extension when masking

[1] https://github.com/golang/go/compare/go1.20.6...go1.20.7

Upgrade include fix for CVE-2023-29409 CVE-2023-39533

(cherry picked from commit 039324d917ed124228a14ac1effdd66b27d9e82b)

(From OE-Core rev: 8397964d5a8d995a06c5c2a34883047546edc077)

Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-13 06:21:26 -10:00
Chee Yang Lee
6ae9654ab5 python3: update to 3.11.5
upgrade include fix for CVE-2023-40217

Release notes:
https://docs.python.org/3/whatsnew/changelog.html#python-3-11-5-final

(From OE-Core rev: 4a3e3042a0cef3a215d286b0f32be293c3948d1e)

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-13 06:21:25 -10:00
Alexander Kanavin
8b372c7d4e python3: update 3.11.3 -> 3.11.4
upgrade include fix for CVE-2023-24329

(cherry picked from commit f7f163ebe8c53de4314d04595c1fbcc7af2deccc )

(From OE-Core rev: 8687de9f20bde7aba118a50342848031adfb7641)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-13 06:21:25 -10:00
Alexander Kanavin
b2e008f2d4 python3: upgrade 3.11.2 -> 3.11.3
(cherry picked from commit 7d5bb3a4690ef61a1fee21773b4717e829789e32)

(From OE-Core rev: a991fe85dca51ddf36994666e14e69839dd694b2)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-13 06:21:25 -10:00
Martin Jansa
e2c3c0315c tcl: prevent installing another copy of tzdata
It checks build host filesystem and if it doesn't find UTC or GMT
files it installs another copy of tzdata files in:
/usr/lib/tcl8.6/tzdata

Buildhistory shows the difference:
-PKGSIZE = 2227075
+PKGSIZE = 3433088

See the autodetection in configure.in:
  #------------------------------------------------------------------------
  #       Check whether the timezone data is supplied by the OS or has
  #       to be installed by Tcl. The default is autodetection, but can
  #       be overridden on the configure command line either way.
  #------------------------------------------------------------------------

  AC_MSG_CHECKING([for timezone data])
  AC_ARG_WITH(tzdata,
      AC_HELP_STRING([--with-tzdata],
          [install timezone data (default: autodetect)]),
      [tcl_ok=$withval], [tcl_ok=auto])

  #
  # Any directories that get added here must also be added to the
  # search path in ::tcl::clock::Initialize (library/clock.tcl).
  #
  case $tcl_ok in
      no)
          AC_MSG_RESULT([supplied by OS vendor])
      ;;
      yes)
          # nothing to do here
      ;;
      auto*)
          AC_CACHE_VAL([tcl_cv_dir_zoneinfo], [
          for dir in /usr/share/zoneinfo \
                  /usr/share/lib/zoneinfo \
                  /usr/lib/zoneinfo
          do
                  if test -f $dir/UTC -o -f $dir/GMT
                  then
                          tcl_cv_dir_zoneinfo="$dir"
                          break
                  fi
          done])
          if test -n "$tcl_cv_dir_zoneinfo"; then
              tcl_ok=no
              AC_MSG_RESULT([$dir])
          else
              tcl_ok=yes
          fi
      ;;
      *)
          AC_MSG_ERROR([invalid argument: $tcl_ok])
      ;;
  esac
  if test $tcl_ok = yes
  then
      AC_MSG_RESULT([supplied by Tcl])
      INSTALL_TZDATA=install-tzdata
  fi

(From OE-Core rev: d5a038b764720bd3267f258994371909f3f34ad6)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3ace9fbfeb42ebf920812e3dd6d665b8b20a1ca0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-04 04:13:25 -10:00
Narpat Mali
7b65658ede python3-pygments: fix for CVE-2022-40896
A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments
through 2.15.0 via SmithyLexer.

The CVE issue is fixed by these 3 different commits in different version:
1. Improve the Smithy metadata matcher (These changes are already available as part
   of current python3-pygments_2.14.0 version):
dd52102c38 (2.14.0)
2. SQL+Jinja: use a simpler regex in analyse_text:
97eb3d5ec7 (2.15.0)
3. Improve Java properties lexer (#2404):
fdf182a7af (2.15.1)

References:
https://nvd.nist.gov/vuln/detail/CVE-2022-40896
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2/

(From OE-Core rev: 5a02307af5e593be864423a9f3ab309703d61dbf)

Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-04 04:13:24 -10:00
Richard Purdie
89394ac832 pseudo: Fix to work with glibc 2.38
This adds a horrible hack to get pseudo working with glibc 2.38. We can't
drop _GNU_SOURCE to something like _DEFAULT_SOURCE since we need the defines
the gnu options bring in. That leaves using internal glibc defines to disable
the c23 versions of strtol/fscanf and friends. Which would break pseudo
build with 2.38 from running on hosts with older glibc.

We'll probably need to come up with something better but this gets glibc 2.38
and working and avoids autobuilder failures.

(From OE-Core rev: 387b276c2d56d58c2a25d59984fcaaf9c88ac788)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 596fb699d470d7779bfa694e04908929ffeabcf7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-30 04:52:35 -10:00
Wang Mingyu
2b1745c74b file: upgrade 5.44 -> 5.45
Changelog:
==========
-PR/465: psrok1: Avoid muslc asctime_r crash
-add SIMH tape format support
-bump the max size of the elf section notes to be read to 128K
 and make it configurable
-PR/415: Fix decompression with program returning empty
-PR/408: fix -p with seccomp
-PR/412: fix MinGW compilation

(From OE-Core rev: 6f1caa944982e265c394a554bfcfa8a105b1d698)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit facef006da35e22394a4cbb13243769586d10f31)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-30 04:52:35 -10:00
Narpat Mali
4c9e8b0390 python3-git: upgrade 3.1.31 -> 3.1.32
The delta between 3.1.31 & 3.1.32 contains the CVE-2023-40267 fix and other bugfixes.

Changelog:
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.32

- Bump cygwin/cygwin-install-action from 3 to 4 by @dependabot in #1572
- Fix up the commit trailers functionality by @itsluketwist in #1576
- Name top-level exceptions as private variables by @Hawk777 in #1590
- fix pypi long description by @eUgEntOptIc44 in #1603
- Don't rely on del by @r-darwish in #1606
- Block insecure non-multi options in clone/clone_from by @Beuc in #1609

(From OE-Core rev: fd38c8d91f95b44ea7b833772b9a07e1f1d74479)

Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-30 04:52:35 -10:00
Mark Hatle
51904d6c60 tcf-agent: Update to 1.8.0 release
New 1.8 release of tcf-agent.  Implements DWARF 5 support and various
bug fixes.

Changelog since last SRCREV:
   Releng: Upversion TCF to 1.8
   Fixed possible SEGFAULT after error message queue overflow
   Fixed misspelling in a comment
   TCF Agent: update breakpoint error message
   Fixed regression: possible segfault in run_safe_events()
   Bug 581978 - TCF agent wrong handle the call frame debug info generated by LLVM 16 for RISC-V
   DWARF: a bit faster implementation of dio_ReadAddressX()
   Bug 581971 - Failed to handle loclist for DWARF 5
   Fixed handling of situation when a context resumed or exited during breakpoint evaluation
   Bug 581799 - when loads .debug_info section from dwarf 5 file, the content of some part are zero
   Updated examples/daytime/readme.txt

(From OE-Core rev: 1b5b577f1b766ed6f98b6854e6968d4b9b02a45a)

Signed-off-by: Mark Hatle <mark.hatle@amd.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 0c2c7c910fa933bc46f69207f1f7641c1e7b77e0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-18 03:57:05 -10:00
sanjana
f9c58a63f0 binutils: stable 2.40 branch updates
Below commits on binutils-2.40 stable branch are updated.

391fd4d9ee5 PR30697, ppc32 mix of local-dynamic and global-dynamic TLS
7ad52a2357f [GOLD] powerpc DT_RELACOUNT
03f49a0619c PR30536, ppc64el gold linker produces unusable clang-16 binary

(From OE-Core rev: 74e6452a9fbeb928a635869160bc17cfeab867f0)

Signed-off-by: sanjana <sanjanasanju1608@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-18 03:57:05 -10:00
Yogita Urade
ee45db898f qemu: fix CVE-2023-2861
qemu: 9pfs: prevent opening special files

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-2861

(From OE-Core rev: 4dd99f7f48664dbaef7f3a083a9d362552ba44ac)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-18 03:57:05 -10:00
Yogita Urade
911a4b03a5 qemu: fix CVE-2023-3255
QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-3255

(From OE-Core rev: 886536b056230a9d72c900eacc8d1d8b44bd2836)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-18 03:57:05 -10:00
Yogita Urade
f86817b160 qemu: fix CVE-2023-3301
qemu: hotplug/hotunplug mlx vdpa device to the occupied addr port,
then qemu core dump occurs after shutdown guest

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-3301

(From OE-Core rev: 82bf6c4cba88dc9f25caf14d60e79ce0c366919c)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-18 03:57:04 -10:00
Oleksandr Hnatiuk
805b208d23 file: fix the way path is written to environment-setup.d
$OECORE_NATIVE_SYSROOT is not escaped, thus it is expanded to an empty string.
This happens to work because we have ${datadir} which in this context is
relocated to the buildtools sysroot after installation of buildtools.

If the $ before OECORE_NATIVE_SYSROOT is escaped, it will be saved to file.sh
as intended, but MAGIC will point to the wrong location because both
OECORE_NATIVE_SYSROOT and datadir resolve to sysroot which doubles the path
like so:
/path/to/buildtools/sysroots/x86_64-xesdk-linux/path/to/buildtools/sysroots/x86_64-xesdk-linux/usr/share/misc/magic.mgc
which does not exist. So, removing reference to OECORE_NATIVE_SYSROOT.

(From OE-Core rev: 7ae5c9a17d6f8133fa5b4e127dd4e9cc43454ee8)

Signed-off-by: Oleksandr Hnatiuk <ohnatiuk@cisco.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit c6206249683876670602888e78ecaf719753a317)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:49 -10:00
Oleksandr Hnatiuk
5a717511f2 file: return wrapper to fix builds when file is in buildtools-tarball
Wrapper that adds proper path to magic file was removed in
47db876d09d9a4394048579c21d0b394450ce681 in favor of
environment-setup.d/file.sh which now contains `MAGIC` environment variable.
This breaks builds that rely on external buildtools with `file` included in
buildtools-tarball (e.g. via TOOLCHAIN_HOST_TASK) because do_populate_sysroot
task invokes `file` via `subprocess.check_output` (in is_elf function) and
doesn't use variables from files in environment-setup.d. To address this use
case, we need to preserve the wrapper, but also have
environment-setup.d/file.sh for the purposes described in
47db876d09d9a4394048579c21d0b394450ce681.

(From OE-Core rev: 4a9832c55044b894e933179e5c1b6a96634809c0)

Signed-off-by: Oleksandr Hnatiuk <ohnatiuk@cisco.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit e76b059cf4ba9a79150032d68d012b233dd79a65)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:49 -10:00
Julien Stephan
4b5695593a automake: fix buildtest patch
Add check_PROGRAMS as a dependency of buildtest-TESTS target.
This is required because according to the official automake
documentation [1]:
* TESTS: contains all the tests files
* check_PROGRAMS: contains the programs used by the tests
* check_PROGRAMS is not automatically added to TESTS

So, by using only TESTS as a dependency for buildtest-TESTS we may end
up having runtime errors because of missing program required by the
tests.

[1]: https://www.gnu.org/software/automake/manual/html_node/Scripts_002dbased-Testsuites.html

(From OE-Core rev: 8a5630c113bd8509fcb62e8a32fcadfc2dc94181)

Signed-off-by: Julien Stephan <jstephan@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ee3e2af4f8ed95b4fd0f7cec52ae4e169401b719)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:49 -10:00
Wang Mingyu
a8455f68dc opkg-utils: upgrade 0.5.0 -> 0.6.2
(From OE-Core rev: 525459d2f387ec82fabccdae19aa8b977f534929)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit b0fe9b3dfbe78716c96b70ef098d9cfbf430d5b7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:49 -10:00
Wang Mingyu
abbd466097 opkg: upgrade 0.6.1 -> 0.6.2
0001-Define-alignof-using-_Alignof-when-using-C11-or-newe.patch
0002-opkg-key-remove-no-options-flag-from-gpg-calls.patch
removed since they're included in 0.6.2.

Changelog:
===========
### Changed
- the project's developer documentation to be more correct and current.

### Fixed
- a bug in the 'opkg-keys' utility script which caused the script to ignore settings in the '/etc/opkg/gpg/gpg.conf' file.
- a compilation error in 'md5.c' when using clang16+ and '-std >= gnu11'.

(From OE-Core rev: 5bdfde3fd4266d637019b59d55a33438cb36903f)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit d7c8a58297e38f6222035aa9135fedf2ca387742)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:49 -10:00
Narpat Mali
c36a0bd406 python3-certifi: upgrade 2022.12.7 -> 2023.7.22
python3-certifi 2023.7.22 contains the CVE-2023-37920 fix.

No changelog provided. Commits:

8fb96ed (tag: 2023.07.22) 2023.07.22
afe7722 Bump actions/setup-python from 4.6.1 to 4.7.0 (#230)
2038739 Bump dessant/lock-threads from 3.0.0 to 4.0.1 (#229)
44df761 Hash pin Actions and enable dependabot (#228)
8b3d7ba (tag: 2023.05.07) 2023.05.07
53da240 ci: Add Python 3.12-dev to the testing (#224)
c2fc3b1 Create a Security Policy (#222)
c211ef4 Set up permissions to github workflows (#218)
2087de5 Don't let deprecation warning fail CI (#219)
e0b9fc5 remove paragraphs about 1024-bit roots from README
9427a5a fix CI
fed4048 get CI passing again
9e9e840 (tag: 2022.12.07) 2022.12.07

(From OE-Core rev: ec5e5ae6b304dee9b323bd20f3db25152a083398)

Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:48 -10:00
Jose Quaresma
9128886912 go: update 1.20.5 -> 1.20.6
Upgrade to latest 1.20.x release [1]:

$ git log --oneline go1.20.5..go1.20.6 origin/release-branch.go1.20
2c358ffe97 (tag: go1.20.6, origin/release-branch.go1.20) [release-branch.go1.20] go1.20.6
312920c00a [release-branch.go1.20] net/http: validate Host header before sending
4db13d762b [release-branch.go1.20] runtime: set raceignore to zero when starting a new goroutine
08a58dd8b6 [release-branch.go1.20] runtime: allow for 5 more threads in TestWindowsStackMemory*
65092835c5 [release-branch.go1.20] cmd/go: skip TestScript/gccgo_link_ldflags on aix/ppc64
bca817594c [release-branch.go1.20] crypto/x509: tolerate multiple matching chains in testVerify
b8e67d1ddd [release-branch.go1.20] cmd/go/internal/test: don't wait for previous test actions when interrupted
3db4f8146c [release-branch.go1.20] runtime: resolve checkdead panic by refining `startm` lock handling in caller context
6b45fb7b73 [release-branch.go1.20] runtime: fallback to TEB arbitrary pointer when TLS slots are full
be30960e58 [release-branch.go1.20] runtime: use 1-byte load for address checking in racecallatomic
b59efe6c34 [release-branch.go1.20] net/mail: permit more characters in mail headers
c32f1afb41 [release-branch.go1.20] all: make safe for new vet analyzer
c7b145655b [release-branch.go1.20] cmd/go: fix tests for new builder environment
03063101a2 [release-branch.go1.20] text/template: set variables correctly in range assignment
d51e322a3f [release-branch.go1.20] go/printer: error out of Fprint when it would write a '//line' directive with a multiline file path
49594244d3 [release-branch.go1.20] cmd/cover: error out if a requested source file contains a newline
4719048211 [release-branch.go1.20] cmd/cgo: error out if the source path used in line directives would contain a newline
6c606fc191 [release-branch.go1.20] cmd/go: fix TestScript/build_cwd_newline with CGO_ENABLED=0
63ad2b5811 [release-branch.go1.20] cmd/compile: do not report division by error during typecheck
95f377daad [release-branch.go1.20] cmd/go: retain extra roots to disambiguate imports in 'go mod tidy'
a7a48fad7e [release-branch.go1.20] crypto/ecdsa: properly truncate P-521 hashes
f5172dcd38 [release-branch.go1.20] go/build: check for invalid import paths again
8b3acefcbe [release-branch.go1.20] cmd/go: omit checksums for go.mod files needed for go version lines more often in pre-1.21 modules
1008486a9f [release-branch.go1.20] cmd/cgo: correct _cgo_flags output

[1] https://github.com/golang/go/compare/go1.20.5...go1.20.6

(From OE-Core rev: 944b186eeb6821654ce6ef56df7ac0f2829696f5)

Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8d8216d8c4d37cc0d9508eb644653f94fff8989c)
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:48 -10:00
Ross Burton
1dccb216a0 python3: fix missing comma in get_module_deps3.py
Wes Tarro <wes.tarro@azuresummit.com> noticed a missing comma in a
preplace() call, add it.

That said, calling replace() with one argument results in a TypeError,
so this is obviously dead code.

(From OE-Core rev: f24236b7b52dd753d7170bac9c38dff1133db76e)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9b2e2c8d809e7ca34451ec9702b029a00dfb410b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-01 06:17:28 -10:00
Ross Burton
9b6c564afc pkgconf: update SRC_URI
dereferenced.org is now longer controlled by the pkgconf maintainers[1],
so use the the new hosting location.

[1] 437c2a3218

(From OE-Core rev: 7b50737b787311216670aa4b83b0a363d9a12aa3)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c3df4594513410c7a6352e62aa928c42982eac13)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-01 06:17:28 -10:00
Mingli Yu
452cc7b484 ruby: Fix CVE-2023-36617
Backport two patches [1] [2] to fix CVE-2023-36617 [3].

[1] 9010ee2536
[2] 9d7bcef1e6
[3] https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/

(From OE-Core rev: 403a24f02600e2462e8ccfbb42651e15e002bd2e)

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-01 06:17:27 -10:00
Peter Marko
38c70c430f python3: ignore CVE-2023-36632
This CVE shouldn't have been filed as the "exploit" is described in the
documentation as how the library behaves.

(From OE-Core rev: 3e7f736fa07a132d4fe42a59baaabe565238da21)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c652f094d86c4efb7ff99accba63b8169493ab18)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-01 06:17:27 -10:00
Richard Purdie
7995f780f9 gcc-testsuite: Fix ppc cpu specification
After this change in qemu:

c7e89de132

there is no 'max' cpu model on ppc. Drop it to clean up ppc gcc testsuite failures.

In order for this to work we do need to pull in the alternative cpu option from
QEMU_EXTRAOPTIONS on powerpc.

(From OE-Core rev: ea3143b243bb979f9b89f01fc2e7826cac0a7d75)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c447f2b21b20fb2b1829d540af2cc0bf8242700c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26 05:12:21 -10:00
Ross Burton
151fd33bbe gcc: don't pass --enable-standard-branch-protection
By changing the default code generation of GCC we're inadvertently
breaking the GCC test suite, which has ~120K+ more failures when run for
aarch64 compared to x86-64.

This was because the generated code fragments included the BTI
instructions, which the test case wasn't expecting.  We can't tell the
tests globally to run without branch protection, as that will break the
tests which also turn it on.

Remove the enabling of branch protection by standard in GCC, we'll
enable it in the tune files instead.

(From OE-Core rev: 81351d984bc6238e9b901ae83c0de6e3d3463c77)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bb4b9017db6a893ed054a2d2ad4cc671dec09c42)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26 05:12:21 -10:00
Sakib Sajal
3bd29f3620 go: fix CVE-2023-24531
Backport required commits to fix CVE-2023-24531.

(From OE-Core rev: 5d80e920c7ceaf091ccace8a3b6781b720abafbf)

Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26 05:12:21 -10:00
Archana Polampalli
2e660a5be9 qemu: fix CVE-2023-0330
A vulnerability in the lsi53c895a device affects the latest version
of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption
bugs like stack overflow or use-after-free.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-0330

Upstream patches:
b987718bbb

(From OE-Core rev: 3be283237a9e473112430bcb614b25b7ff7e64b2)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26 05:12:21 -10:00
Alexander Kanavin
1f2b28e9c6 rust-common.bbclass: move musl-specific linking fix from rust-source.inc
This needs to be done for any item that is linked under rustc,
and not just rust itself. Latest python-cryptography exposes the issue.

(From OE-Core rev: 967d847a9815df43d0c92ca61cc544e1fe5dcc03)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d3811228747590ea06e8d68be4785d45ec9c478f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-20 12:10:40 -10:00
Changqing Li
ffe2b61053 erofs-utils: fix CVE-2023-33551/CVE-2023-33552
* CVE-2023-33551.patch is for fix CVE-2023-33551.
* CVE-2023-33552-3.patch is upstream patch for fix CVE-2023-33552, since
  the patch context is changed, CVE-2023-33552-1.patch and
  CVE-2023-33552-2.patch is backported.

(From OE-Core rev: 77b5c2f68ea0eef45e77936ce3e7caafa7bd3f54)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-20 12:10:40 -10:00
Yogita Urade
4c0213759a dmidecode: fix CVE-2023-30630
Dmidecode before 3.5 allows -dump-bin to overwrite a local file.
This has security relevance because, for example, execution of
Dmidecode via Sudo is plausible.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-30630
https://lists.nongnu.org/archive/html/dmidecode-devel/2023-04/msg00016.html
https://lists.nongnu.org/archive/html/dmidecode-devel/2023-04/msg00017.html

(From OE-Core rev: f92e59a0894145a828dc9ac74bf8c7a9355e0587)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-20 12:10:40 -10:00
Chee Yang Lee
02f1740351 python3-requests: fix CVE-2023-32681
(From OE-Core rev: 11b6e64c07df043441824511c931fb0bc9673adc)

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-20 12:10:40 -10:00
Changqing Li
e7242a885b dnf: only write the log lock to root for native dnf
From commit 742a1b7124, log_lock.pid is writen to root, but following
file is not changed, which will make it never deleted, and an unexpected
file exist in root dir after boot target.

$ tail  -n 1 etc/tmpfiles.d/dnf.conf
r /var/log/log_lock.pid

Besides, root dir may be read-only, so it is better still
keep the log_lock.pid under /var/log, only write the log lock to root
for native dnf for fixing issue mentioned in 742a1b7124

(From OE-Core rev: 207cc7acef40f92b5de306aa6f035258c0eec828)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:26 -10:00
Khem Raj
725d9c170d python3-bcrypt: Use BFD linker when building tests
Some of the tests use symbols from libpython3 e.g. PyBytes_FromStringAndSize
but does not add it to linker cmdline, its perhaps cargo which
should be fixed for that, this however is not something we can
fix in OE. So switch to using bfd linker explicitly when
building with ptests

(From OE-Core rev: 353b9c765218ed631fc14a406fcdfe1c36a8237b)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b4392ebb512fa48168a48fbff3e9140a8e1b7ec4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:26 -10:00
Chen Qi
2ed4fd70e4 rpm: write macros under libdir
If we create a macros file under etc/, the populate_sdk task would
fail if 'package-management' is in SDKIMAGE_FEATURES and nativesdk-rpm-build
is installed.. The error message is like below:

  unable to place /.../sdk/image/etc/rpm in final SDK location

This is because it's trying to move the etc/rpm dictory into the
host sysroot but the <host_sysroot>/etc/rpm has already exists.

To solve this problem, avoid creating /etc/rpm/macros for nativesdk-rpm-build,
use ${libdir}/macros instead. In this way, the macros file is hold
in nativesdk-rpm. As nativesdk-rpm-build depends on nativesdk-rpm,
the 'rpmbuild' command inside SDK can still correctly find find-debuginfo
binary.

(From OE-Core rev: 2a13a671910cad68ab962ce369b9ed60a9bf7eea)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5fde0eadf16d34d88a599009013913fe55d89283)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:26 -10:00
Richard Purdie
e1e65f69c8 strace: Update patches/tests with upstream fixes
Replace the sockopt disable patch with a fix from upstream

(From OE-Core rev: c1beb73526e3ade75bd6dae5f9310107c50f1226)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ac921989991c319ecad01bec37c4ccaa15a7b58f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:25 -10:00
Richard Purdie
242dff550e strace: Merge two similar patches
Both patches change the same paths to gawk, merge them together
as we only need one patch for this.

(From OE-Core rev: 6080138fd0c27db7029b5a76e69b8dc241ad8dc3)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 79c0b18e29cad337640860f57683f0a170f6daab)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:25 -10:00
Alexander Kanavin
b1493fb1a8 gdb: upgrade 13.1 -> 13.2
Fixes:

 * PR testsuite/30158 (rustc testsuite fails with 13.1, apparently worked before with trunk 20230114 on i686-linux-gnu and powerpc64le-linux-gnu)

 * PR gdb/30214 (GDB 13.1 does not compile on FreeBSD 13.1)

 * PR gdb/30240 ((linux/aarch) thread.c:86: internal-error: inferior_thread: Assertion `current_thread_ != nullptr' failed)

 * PR gdb/30249 ([13 regression] hookpost-extended-remote will not work)

 * PR exp/30271 (Addresses of static thread_local fields are badly calculated sometimes)

 * PR symtab/30357 (Segmentation fault for the 'start' command)

 * PR symtab/30369 ([gdb/symtab] False match issue in skip_prologue_using_linetable)

 * PR gdb/30423 (Build failures with clang 16)

 * PR build/30450 (Build failure (linux-low.cc:5393:45: error: expected ':' before ')' token) with musl-1.2.4)

(From OE-Core rev: 900379776878c363ff7c802f6b740ee89661ea9c)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d10764916624f61d39cb9ea368359837156ad960)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:25 -10:00
Soumya
68b407ff94 perl: Fix CVE-2023-31484 & CVE-2023-31486
CPAN.pm before 2.35 does not verify TLS certificates when downloading
distributions over HTTPS.

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and
available standalone on CPAN, has an insecure default TLS
configuration where users must opt in to verify certificates.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-31484
https://nvd.nist.gov/vuln/detail/CVE-2023-31486

Upstream patches:
9c98370287
77f557ef84
a22785783b

(From OE-Core rev: f4fe9861d6aebd971a3120a0eb43f752c73ce2fb)

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:25 -10:00
Alexander Kanavin
4036c7097a qemu: a pending patch was submitted and accepted upstream
(From OE-Core rev: 13c9eba31a848450b1502c1677536ce42576ed08)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f59df55d63a8841c834bbc488589209e7f23f803)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-04 05:32:29 -10:00
Mingli Yu
3ee2522d8a python3-numpy: remove NPY_INLINE, use inline instead
The build fails when DEBUG_BUILD is enabled with GCC-13 as [1] and [2].

Fixes:
   | numpy/core/src/umath/simd.inc.src:977:20: note: called from here
   | 977 |     @vtype@ zeros = _mm512_setzero_@vsuffix@();
      |                    ^~~~~~~~~~~~~~~~~~~
   | numpy/core/src/umath/simd.inc.src:596:1: error: inlining failed in call to ‘always_inline’ ‘avx512_get_full_load_mask_ps’: target specific option mismatch
  596 | avx512_get_full_load_mask_ps(void)
      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
   | numpy/core/src/umath/simd.inc.src:976:27: note: called from here
  976 |     @mask@ load_mask = avx512_get_full_load_mask_@vsuffix@();
      |                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   | /usr/lib/gcc/x86_64-redhat-linux/13/include/avx512fintrin.h:6499:1: error: inlining failed in call to ‘always_inline’ ‘_mm512_loadu_si512’: target specific option mismatch

Reference: 3947b1a023

[1] https://git.openembedded.org/openembedded-core/commit/?id=8596678667797971559aed962b1c204266032186
[2] http://errors.yoctoproject.org/Errors/Details/689841/

(From OE-Core rev: 77a64a8686b6c9ef3bc6adbce6cdc442096decfd)

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-04 05:32:29 -10:00