Commit Graph

68459 Commits

Author SHA1 Message Date
Antonin Godard
67fd2ee995 ref-manual: add missing CVE_CHECK manifest variables
Variables that can be used for toggling creation of manifest and
specifying the path to the output in the deploy directory.

(From yocto-docs rev: fb462c47bb15522cc02642fe51f39c8e15044957)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 14131a42a7ea8bbae2165c1b8dbcabd5f28b2b22)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-24 06:31:59 -07:00
Aleksandar Nikolic
ca77e75846 ref-manual: introduce CVE_CHECK_REPORT_PATCHED variable
(From yocto-docs rev: a7929332ade42e8511c2f47d200b3b01cb8a8987)

Signed-off-by: Aleksandar Nikolic <an010@live.com>
Reviewed-by: Michael Opdenacker <michael@opdenacker.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit f585a68a8f35f31814e408dd973ea7345adbbacf)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-24 06:31:59 -07:00
Randolph Sapp
c2dcb5102c kmscube: create_framebuffer: backport modifier fix
Backport the upstream buffer modifier fix for create_framebuffer to
handle the case where no valid modifiers are available.

(From OE-Core rev: 983e3efb51ab22f1fa5f90cbbfba2d701aa425fc)

Signed-off-by: Randolph Sapp <rs@ti.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-24 06:31:58 -07:00
Khem Raj
dfe311ef7a syslinux: Disable error on implicit-function-declaration
syslinux has vendored copy of ext2fs/ext2_fs.h but uses ext2fs/ext2fs.h
from e2fsprogs package, however, ext2fs/ext2fs.h has dependencies on
ext2fs/ext2_fs.h coming from e2fsprogs package as these both headers
come from same package, here syslinux uses ext2fs.h from e2fsprogs but
supplies its own copy of ext2_fs.h which maybe out of sync and that
results in warnings about implicit implicit-function-declarations
e.g.

recipe-sysroot/usr/include/ext2fs/ext2fs.h:727:16: error: implicit declaration of function 'ext2fs_has_feature_gdt_csum' [-Wimplicit-function-declaration]
|   727 |                ext2fs_has_feature_gdt_csum(fs->super);
|       |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~

ext2fs_has_feature_gdt_csum here comes from newer version of
ext2fs/ext2_fs.h but missing from vendored copy, hence the warning.

With gcc-14 this warning is treated as error by default, which breaks
the build, so lets treat it as warning only.

All these functions are never used in syslinux, so functionality-wise we
are fine.

(From OE-Core rev: 14fdee535c37aaa44898dc22149004c97b2456ca)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a2b30108055e68b62fdad7319d7d569bc38a07b4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-24 06:31:58 -07:00
Macpaul Lin
b41fb087da linux-firmware: upgrade 20240220 -> 20240909
License-Update: additional files

(From OE-Core rev: 2f82404cde671d2898d82483cc1fff693d7720e3)

Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-24 06:31:58 -07:00
Ashish Sharma
419b3b4275 libarchive: Fix CVE-2024-48957 & CVE-2024-48958
Backport fix:

* CVE-2024-48957 - Upstream-Status: Backport from 3006bc5d02
* CVE-2024-48958 - Upstream-Status: Backport from a1cb648d52

(From OE-Core rev: 584ce77f3aae332c66e2140497506301200ec9ca)

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-24 06:31:58 -07:00
Peter Marko
87ebb58a64 gcc: ignore CVE-2023-4039
Last version bump removed patch for this CVE because it was integrated
in new release. This has caused the CVE to reappear in reports because
2023-09-12 is "higher" than 11.5...

(From OE-Core rev: d74fd7c4e9353fc00f0b79f05de101efb0148a6f)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-24 06:31:58 -07:00
Steve Sakoman
7e87dc422d build-appliance-image: Update to kirkstone head revision
(From OE-Core rev: f09fca692f96c9c428e89c5ef53fbcb92ac0c9bf)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
yocto-4.0.22 kirkstone-4.0.22
2024-10-12 05:23:21 -07:00
Steve Sakoman
474121d387 poky.conf: bump version for 4.0.22
(From meta-yocto rev: ca60023fd70c4d6ecb9b3f57e4e4e3a3df13862b)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-12 05:19:40 -07:00
Steve Sakoman
b22df9e157 selftest/runtime_test/virgl: Disable for all fedora
We can't support vgem on RHEL derived distros so disable this test for
all fedora hosts rather than specific versions.

(From OE-Core rev: c4760d6a52011515b0f931d08f619c7e49e72158)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-12 05:17:58 -07:00
Steve Sakoman
2589544ca8 valgrind: disable avx_estimate_insn.vgtest
This test fails consistently on the new valkyrie autobuilder cluster

The estimate instructions (rcpss, rcpps, rsqrtps, rsqrtss) are, as the
name suggests, not expected to give a fully accurate result. They may
produce slighly different results on different CPU families because
their results are not defined by the IEEE standard.

(From OE-Core rev: 9269edb63d3c68de62326f5960ffff0c1068e709)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-12 05:17:58 -07:00
Massimiliano Minella
3443d0e575 zstd: fix LICENSE statement
[Backport from OE-Core: 40f85de590c188c9c3985e64a83efaf06b0b4fbc]

zstd is dual-licensed under BSD _OR_ GPLv2 which was updated in the README for v1.5.6.
License wording in the README for v1.5.2 is misleading, but license headers in the code
clearly state that there is a choice between the two licenses.

(From OE-Core rev: 4ef9b4d947b6e8ed7637cdd9e722c3f0c83990dd)

Signed-off-by: Massimiliano Minella <massimiliano.minella@se.com>
Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-12 05:17:58 -07:00
Martin Jansa
3a89e6d7cb cdrtools-native: fix build with gcc-14
Fixes:
http://errors.yoctoproject.org/Errors/Details/770525/
| checking whether the C compiler (gcc  -isystem/OE/build/oe-core/tmp-glibc/work/x86_64-linux/cdrtools-native/3.01/recipe-sysroot-native/usr/include -O2 -pipe ) works... no
| configure: error: installation or configuration problem: C compiler cannot create executables.
| RULES/rules.cnf:70: incs/amd-ryzen-threadripper-3970x-32-core-processor-linux-cc/rules.cnf: No such file or directory
| make: *** [RULES/rules.cnf:59: incs/amd-ryzen-threadripper-3970x-32-core-processor-linux-cc/rules.cnf] Error 1
| make: *** Waiting for unfinished jobs....

where config.log show it's caused by gcc-14:

configure:1189: checking whether the C compiler (gcc  -isystem/OE/build/oe-core/tmp-glibc/work/x86_64-linux/cdrtools-native/3.01/recipe-sysroot-native/usr/include -O2 -pipe ) works
configure:1211: gcc  -o conftest -isystem/OE/build/oe-core/tmp-glibc/work/x86_64-linux/cdrtools-native/3.01/recipe-sysroot-native/usr/include -O2 -pipe  -D_GNU_SOURCE  conftest.c   1>&5
configure:1208:1: error: return type defaults to 'int' [-Wimplicit-int]
configure: failed program was:

main(){return(0);}

(From OE-Core rev: 6fd1bc0620e6d6ce9b940eaeb68474f4d0b9369b)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 094273bd7d1768e14fbdcd2f239bee14c630a625)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-12 05:17:58 -07:00
Martin Jansa
592f0221d1 meta-world-pkgdata: Inherit nopackages
Since this is a recipe with PACKAGES = "", inherit the nopackages
class to skip the various packaging functions which wouldn't do anything anyway.

This fixes errors from buildhistory changes where packages-split would be empty.

(From OE-Core rev: fc8ad580c5d76266ad722c9429f39adf5370c2fb)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-12 05:17:57 -07:00
Peter Marko
ef4d24afa1 rust: ignore CVE-2024-43402
This CVE iwas created because fix for CVE-2024-24576 was incomplete.
Ignore the new CVE in the same way as the old one.

See https://nvd.nist.gov/vuln/detail/CVE-2024-43402

(From OE-Core rev: 62bb1b8f89c97fa32a7b15021e9e3fbbb878ae68)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-12 05:17:57 -07:00
Vijay Anusuri
448b668318 cups: Backport fix for CVE-2024-47175
Upstream-Status: Backport from
9939a70b75
&
04bb2af452
&
e0630cd18f
&
1e6ca5913e
& 2abe1ba8a6

Reference: https://security-tracker.debian.org/tracker/CVE-2024-47175

(From OE-Core rev: 528e2a27564f3093a6a3bb7ac907caae674edab4)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-12 05:17:57 -07:00
Lee Chee Yang
c8f1b3762d migration-guide: add release notes for 4.0.21
(From yocto-docs rev: 2169a52a24ebd1906039c42632bae6c4285a3aca)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-10 12:01:06 -07:00
Joshua Watt
270a77853c bitbake: hashserv: tests: Omit client in slow server start test
On Fedora 39 and Fedora 40 hosts, this version of the hash server
exhibits different behavior on exit when using Unix Domain sockets.
Instead of closing the client connections and exiting immediately, the
server will wait until all clients have disconnected before exiting. It
is unknown why this changed, or why it only affects Unix Domain sockets
and not TCP sockets.

Because of this behavior change, the Slow Server Start test is failing
on these hosts. This test is primarily concerned with ensuring that the
server will actually exit, even if it gets a termination signal before
it enters its main loop, and doesn't really care about clients. As such,
modify the test so that a client is not pre-connected to the server.
This allows the server to actually exit so that the test can verify the
signal behavior.

The latest version of the hash equivalence server (on master) does not
exhibit this behavior. Speculation is that the more standardized usage
of asyncio allows the server to properly exit, even if clients are still
connected. Regardless, this patch is only intended for the older
versions, and should not be applied to master

(Bitbake rev: eb5c1ce6b1b8f33535ff7b9263ec7648044163ea)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-10 12:01:06 -07:00
Rudolf J Streif
8b08aecc80 bitbake: fetch2/wget: Canonicalize DL_DIR paths for wget2 compatibility
Some distributions (namely Fedora Core 40) have started replacing
wget with wget2. There are some changes to wget2 that make it
incompatible with wget:

1. ftp/ftps is not supported anymore
2. progress 'dot' is not yet supported
3. Relative paths in -P and -O are not correctly dealt with

Item 1: Is already dealt with since Scarthgap by only adding the
option --passive-ftp when the URL specifies ftp/sftp. While that
won't help if ftp/sftp is actually required it at least does
not break http/https downloads.

Item 2: While not supported it at least does not break the operation.

Item 3: If there are relative path components in -P or -O then wget2
only deals with them correctly if there is one, and only one, relative
path component at the beginning of the path:

-P ./downloads     works
-P ../downloads    works
-P ../../downloads does not work
-P ./../downloads  does not work
-P /home/user/downloads/../downloads does not work

In cases where there are more than one relative path component at
the beginning of the path and/or one or more reltaive path
component somewhere in the middle or end of the path, wget2 aborts
with the message Internal error: Unexpected relative path: '<path>')

Such can happen if DL_DIR includes relative path components e.g.
DL_DIR = "${TOPDIR}/../../downloads".

This patch canonicalizes DL_DIR before it is passed to wget.

(Bitbake rev: 07081a94997142746f7d345c27bc6805231d025d)

Signed-off-by: Rudolf J Streif <rudolf.streif@ibeeto.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3e4208952b086adc510e78c1c5f9cf4550d79dc9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
(cherry picked from commit 47678142e26bb76d1351886060deff5e75039bc9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-10 12:01:06 -07:00
Richard Purdie
5a511dadc0 bitbake: fetch/wget: Move files into place atomically
(Bitbake rev: aaf9c1b8673f5b181255a08eee4e9a342863e896)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cd7cce4cf4be5c742d29671169354fe84220b47a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-10 12:01:06 -07:00
Richard Purdie
78fc4af777 bitbake: tests/fetch: Tweak to work on Fedora40
On Fedora40, "localhost" sometimes resolves to ::1 and sometimes to 127.0.0.1
and python only binds to one of the addresses, leading to test failures.

Use 127.0.0.1 explicitly to avoid problems of the name resolution, we're trying
to test things other than the host networking.

(Bitbake rev: 3147ebb0edcca8f7f850aabd86ef010ab593496f)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9adc6da42618f41bf0d6b558d62b2f3c13bedd61)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-10 12:01:06 -07:00
Rob Woolley
689b521a38 bitbake: wget: Make wget --passive-ftp option conditional on ftp/ftps
Fedora 40 introduces wget2 as a drop-in replacement for wget.  This
rewrite does not currently have support for FTP.  This causes
the wget fetcher to fail complaining about an unrecognized option.

Making --passive-ftp conditional based on the protocol used in
the SRC_URI limits the scope of the problem.  It also gives us
an opportunity to build the older wget as a host tool.

(Bitbake rev: 477f90f9515cb7cd093920cee5518f662cef2e05)

Signed-off-by: Rob Woolley <rob.woolley@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f10e630fd7561746d835a4378e8777e78f56e44a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-10 12:01:06 -07:00
Martin Jansa
b61f2dc18a populate_sdk_base: inherit nopackages
Since this bbclass sets PACKAGES = "", inherit the nopackages
class to skip the various packaging functions which wouldn't
do anything anyway.

This fixes errors from buildhistory changes where packages-split would be empty.

e.g. meta-toolchain build now fails with:
| DEBUG: Executing shell function buildhistory_list_pkg_files
| find: ".../meta-toolchain/1.0/packages-split/*": No such file or directory
| WARNING: exit code 1 from a shell command.
| DEBUG: Python function buildhistory_emit_pkghistory finished

(From OE-Core rev: 3b646f322b4ffd5ed520f3815ce0726cf225ced2)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.com>
Signed-off-by: Atharva Nandanwar <atharvanandanwar@outlook.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Purushottam Choudhary
f50e096795 kmscube: Add patch to fix -int-conversion build error
On some platforms, `EGLNativeDisplayType` is an int instead of
a pointer, in which case the void pointer will raise
a `-Wint-conversion`.

Add change as a patch instead of updating SRCREV .
if we update SRCREV might will get compatiblity issue
with current gstreamer 1.20.7 version because SRCREV brings changes
which resolves negotiation issues encountered with V4L2 stateless
hardware video decoders when using kmscube video playback option
which has gstreamer dependency requirement to 1.22.0

(From OE-Core rev: 19a899d2ec69572e0eae4576d9fc55a7ba857309)

Signed-off-by: Purushottam Choudhary <purushottam27.kumar@lge.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Aleksandar Nikolic
7805243c19 scripts/install-buildtools: Update to 4.0.21
Update to the 4.0.21 release of the 4.0 series for buildtools.

(From OE-Core rev: e6170a6c9ea419d2fdc4e4ceb04c8a399b4a3b43)

Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Aleksandar Nikolic
af57ddf88e install-buildtools: fix "test installation" step
The "Test installation" step fails with some harmless error messages
(see [1]). This can however make a user think that the buildtools
have not been installed correctly.

Two reasons for the error messages:
- some envvars in the environment-setup-<arch>-pokysdk-linux file
  start and end with double quotes (e.g., PATH) and are as such
  written into python os.environ. This leads that their usage is
  not valid later when testing the installation. This patch removes
  the double quotes before writing, if they are present.
- if installation directory (install_dir), given through the option
  --directory, is given as a relative path, checking if the path to
  a tool (e.g., gcc) in buildtools starts it will always fail. This
  patch converts the install_dir variable to an absolute path.

[1]
ERROR: Something went wrong: tar not found in ./build-tools
ERROR: Something went wrong: installation failed

(From OE-Core rev: 69dfedfa7ee8cf1666e1292ef25028b978131fe0)

Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e4eb0b14ecf9bd2fba13260441c9d86eb348f41e)
Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Aleksandar Nikolic
71ef9f9593 install-buildtools: remove md5 checksum validation
No need to validate with the md5 checksum, as the file is not even
uploaded to the Yocto release webpage (the download never failed due
to a wrong indentation of an else statement). For validation purposes,
use the sha256 checksum only.

(From OE-Core rev: b331769084996ffeb74007fe6ca7e385edd7a577)

Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b740d2f9d40aef1e18c022d1e82b4fb2c5c1fc22)
Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Paul Eggleton
e19ef62254 install-buildtools: support buildtools-make-tarball and update to 4.1
Support installing buildtools-make-tarball that is built in version 4.1
and later for build hosts with a broken make version. Also update the
default version values to 4.1.

(From OE-Core rev: 5348a4999e19bcd002c7d4558067a38870e172d2)

Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5d539268d0c7b8fad1ba9352c7f2d4b81e78b75c)
Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Mingli Yu
e54070cd37 curl: free old conn better on reuse
Backport a patch [1] to free old conn better on reuse to
fix the memory leak issue [2].

[1] https://github.com/curl/curl/commit/06d1210
[2] https://github.com/curl/curl/issues/8841

(From OE-Core rev: fbb820cdfc480e2481d51b9a1057454832f02b23)

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Deepthi Hemraj
d0eef85d33 bintuils: stable 2.38 branch update
Below commit on binutils-2.38 stable branch are updated.
4d71e17a9fd libctf: fix ref leak of names of newly-inserted non-root-visible types

(From OE-Core rev: 98517fbc5bbddbe8608b41a7771eb7d90d7860a7)

Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Deepthi Hemraj
4dd79206e6 glibc: stable 2.35 branch updates
Below commits on glibc-2.35 stable branch are updated.
37214df5f1 libio: Attempt wide backup free only for non-legacy code
09fb06d3d6 nptl: Use <support/check.h> facilities in tst-setuid3
507983797e posix: Use <support/check.h> facilities in tst-truncate and tst-truncate64
bcd0e854ea ungetc: Fix backup buffer leak on program exit [BZ #27821]
e930b89df7 ungetc: Fix uninitialized read when putting into unused streams [BZ #27821]
a3db6ce751 Make tst-ungetc use libsupport
ed9762fdbf stdio-common: Add test for vfscanf with matches longer than INT_MAX [BZ #27650]
cf71d2189c support: Add FAIL test failure helper
5b4e90230b stdio-common: Reformat Makefile.
3c64e961ff Fix name space violation in fortify wrappers (bug 32052)
ba003ee5de resolv: Fix tst-resolv-short-response for older GCC (bug 32042)
5a1d0633be Add mremap tests
0ff91d3961 mremap: Update manual entry
7459b6fe47 linux: Update the mremap C implementation [BZ #31968]
461d0cac38 tests: replace system by xsystem
041ac9dffe resolv: Track single-request fallback via _res._flags (bug 31476)
820a750bed resolv: Do not wait for non-existing second DNS response after error (bug 30081)
4f5aa1d2fb resolv: Allow short error responses to match any query (bug 31890)
a180e82837 Linux: Make __rseq_size useful for feature detection (bug 31965)
f8a52d39c0 elf: Make dl-rseq-symbols Linux only
d36daa4c01 nptl: fix potential merge of __rseq_* relro symbols
602fff4efa Add AT_RSEQ_* from Linux 6.3 to elf.h
c7cd626538 s390x: Fix segfault in wcsncmp [BZ #31934]

(From OE-Core rev: db4cee587fe43f93a9bc9a1356c65a50f92085d9)

Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Deepthi Hemraj
614435f311 gcc: upgrade to v11.5
gcc stable version upgraded from v11.4 to v11.5

Dropped CVE-2023-4039.patch and 0001-aarch64-Update-Neoverse-N2-core-defini.patch
because its been taken to gcc-11.5 with below commits 75c37e0314 and 50d9db203bc

For changes in v11.5 see: https://gcc.gnu.org/gcc-11/changes.html

Below is the bug fix list for v11.5:
https://gcc.gnu.org/bugzilla/buglist.cgi?bug_status=RESOLVED&list_id=444046&resolution=FIXED&target_milestone=11.5

There are a total 164 bugs are fixed in this release, below is the list of bugs fixed excluding the regression fixes.
ID      Product  Comp       Assignee▲       Summary
112672	gcc	target	   ubizjak	[14 Regression] wrong code with __builtin_parityl() at -O and above on x86_64
111736	gcc	sanitize   unassigned	Address sanitizer is not compatible with named address spaces
80899	gcc	ipa	   hubicka	[11/12/13/14 Regression] Devirtualization causes incorrect code generation with placement new in some cases
105301	gcc	c++	   iains	[11 Regression] ICE: tree check: expected tree that contains 'decl minimal' structure, have 'overload' in coro_promise_type_found_p, at cp/coroutines.cc:516
110027	gcc	middle-e   jakub	[11 regression] Stack objects with extended alignments (vectors etc) misaligned on detect_stack_use_after_return
110079	gcc	rtl-opti   jakub	[11 Regression] ICE with -freorder-blocks-and-partition and inline-asm goto
110731	gcc	tree-opt   jakub	[11/12 Regression] Wrong-code because of wide-int division since r5-424
111015	gcc	tree-opt   jakub	[11/12/13/14 Regression] __int128 bitfields optimized incorrectly to the 64 bit operations
112727	gcc	sanitize   jakub	[11/12/13 Regression] UBSAN creates GIMPLE path with uninitialized variable
113674	gcc	c++	   jakub	[11 Regression] [[____attr____]] causes internal compiler error: in decl_attributes, at attribs.cc:776
114310	gcc	target	   jakub	[11 Regression] [aarch64] __sync_val_compare_and_swap fails on __int128_t with newval = 0
114493	gcc	c	   jakub	[11 Regression] internal compiler error: in fld_incomplete_type_of with may_alias
114566	gcc	tree-opt   jakub	[11 Regression] Misaligned vmovaps when compiling with stack-protector-strong for znver4
114634	gcc	c++	   jakub	[11 Regression] Crash Issue Encountered in GCC Compilation of Template Code with Aligned Attribute since r9-1745
114691	gcc	c++	   jakub	[11 Regression] Bogus ignoring loop annotation warning
114825	gcc	fortran	   Jakub	[11 Regression] Compiler error using gfortran and OpenMP since r5-1190
114876	gcc	tree-opt   jakub	[11 Regression] -fprintf-return-value mishandles %lc with a '\0' argument.
114956	gcc	sanitize   jakub	[11 Regression] Segmentation fault with -fsanitize=address -fsanitize=null -O2 when attribute no_sanitize_address is enabled since r9-5742
106890	gcc	c++	   jason	[11 Regression] virtual inheritance triggers compiler error when instatiating derived class with in-class initialization since r8-2709-g12659e10c7820071
111529	gcc	c++	   jason	[11/12/13 Regression] ICE on bool conversion in an unrolled loop condition inside template lambda nested in another template scope
113598	gcc	c++	   jason	[11/12/13 Regression] GCC internal compiler error since r0-124275
114561	gcc	c++	   jason	[11/12 Regression] Comma operator with forwarding reference to pointer raises invalid lvalue required error since r10-7410
114562	gcc	c++	   jason	[11/12 Regression] ICE when trying to bind rvalue reference to lvalue with comma operator and forwarding reference to pointer since r10-7410
115565	gcc	rtl-opti   macro	[11/12/13/14/15 Regression] CSE: Comparison incorrectly evaluated as constant causing optimization to produce wrong code
109876	gcc	c++	  mpolacek	[11/12 Regression] initializer_list not usable in constant expressions in a template
110106	gcc	c++	  mpolacek	[11/12 Regression] ICE on noexcept(noexcept(...)) with optional
89224	gcc	c++	   pinskia	[11/12/13/14/15 Regression] subscript of const vector has the wrong type
110386	gcc	tree-opt   pinskia	[11/12 Regression] ICE with ABSU in backprop
111331	gcc	tree-opt   pinskia	[11/12 Regression] Wrong code at -O1 on x86_64-linux-gnu since
108120	gcc	target	  rearnsha	[11/12 Regression] ICE: in extract_insn, at recog.cc:2791 (on ARM with -mfpu=neon -freciprocal-math -O3)
95048	gcc	libstdc+    redi	[11 Regression] wstring-constructor of std::filesystem::path throws for non-ASCII characters
104606	gcc	libstdc+    redi	[11 Regression] comparison operator resolution with std::optional and -std=c++20
90348	gcc	middle-e   rguenth	[11 Regression] Partition of char arrays is incorrect in some cases
96881	gcc	tree-opt   rguenth	[11 Regression] Clobbers on NULL vs. DCE since r8-1519
97990	gcc	c++	   rguenth	[11 Regression] ICE: ‘verify_type’ failed with vector types and non-PODs since r6-5222-gba6a6a1d44c17f25
103006	gcc	middle-e   rguenth	[12/13/14/15 Regression] wrong code at -O1 or -O2 on x86_64-linux-gnu by r7-7101
110176	gcc	tree-opt   rguenth	[11 Regression] wrong code at -Os and above on x86_64-linux-gnu since r11-2446
110295	gcc	c++	   rguenth	[11 Regression] ICE in dwarf2out_finish with local class with inherited operator delete in a templated function and -g
110298	gcc	tree-opt   rguenth	[11 Regression] ICE at -Os on x86_64-linux-gnu since r10-840
111039	gcc	tree-opt   rguenth	[11 Regression] Unable to coalesce ssa_names
111080	gcc	debug	   rguenth	[11 Regression] restrict qualifier causes extra debug info to happen
111472	gcc	tree-opt   rguenth	[11 Regression] Wrong code at -Os on x86_64-linux-gnu since r11-4563-gd0d8b5d836
111614	gcc	tree-opt   rguenth	[11 Regression] ICE at -O2: verify_gimple failed since r14-2282-gf703d2fd3f0
111764	gcc	tree-opt   rguenth	[11 Regression] Wrong code at -O3 on x86_64-linux-gnu
111818	gcc	middle-e   rguenth	[11 Regression] ICE with __builtin_memcpy with volatile and constants
111917	gcc	tree-opt   rguenth	[11 Regression] ICE in as_a, at is-a.h:255 since GCC-7
112495	gcc	tree-opt   rguenth	[11 Regression] ICE: verify_gimple failed (after vectorizer) with named address space (__seg_gs )
112505	gcc	tree-opt   rguenth	[11 Regression] internal compiler error: in build_vector_from_val, at tree.cc:2104 since r10-4076
112718	gcc	debug	   rguenth	[11 Regression] ICE: in add_dwarf_attr, at dwarf2out.cc:4501 with -g -fdebug-types-section -flto -ffat-lto-objects
112793	gcc	tree-opt   rguenth	[11 regression] ICE when building stellarium (internal compiler error: in vect_schedule_slp_node, at tree-vect-slp.cc:9062)
114027	gcc	tree-opt   rguenth	[11 Regression] miscompile at `-O3 -fno-vect-cost-model -msse4.2`
114734	gcc	target	   rguenth	[11 regression] RISC-V rv64gcv_zvl256b miscompile with -flto -O3 -mrvv-vector-bits=zvl since r8-6047-g65dd1346027bb5
108086	gcc	rtl-opti   rsandifo	[11 Regression] internal compiler error: in set_accesses, at rtl-ssa/internals.inl:449
113281	gcc	tree-opt   rsandifo	[11 Regression] Latent wrong code due to vectorization of shift reduction and missing promotions since r9-1590
113552	gcc	tree-opt   tnfchris	[11/12/13 Regression] vectorizer generates calls to vector math routines with 1 simd lane.
29256	gcc	target	  unassigned	[11/12/13/14 regression] loop performance regression
82446	gcc	tree-opt unassigned	[11/12/13/14 Regression] Missed equalities in dr_group_sort_cmp
93631	gcc	c	 unassigned	[11/12/13/14 Regression] ICE on an invalid strcmp call in gimple_call_arg, at gimple.h:3258
93930	gcc	target	 unassigned	[11/12/13/14 Regression] Unnecessary broadcast instructions for AVX512
94335	gcc	tree-opt unassigned	[11/12/13/14 Regression] False positive -Wstringop-overflow warning with -O2
97140	gcc	target	 unassigned	[11/12/13/14 Regression] ICE in error: unable to generate reloads for since r10-400-gecfdb16c54ad06ac
100623	gcc	target	 unassigned	[11 Regression] wrong code with -Os -fno-dce -fno-defer-pop -fno-forward-propagate -flive-range-shrinkage -fno-rerun-cse-after-loop -mno-push-args since r10-7515-g2c0fa3ecf70d199a
100667	gcc	libstdc+ unassigned	[11/12 Regression] std::tuple<A&&> cannot be constructed from A&&, if A not defined (only forward declared)
103497	gcc	c++	 unassigned	[11/12/13/14 Regression] ICE when decltype(auto)... as parameters
105034	gcc	target	 unassigned	[11/12/13/14 regression]Suboptimal codegen for min/max with -Os
107057	gcc	rtl-opti unassigned	[11/12 Regression] ICE in extract_constrain_insn, at recog.cc:2692
109800	gcc	target	 acoplan	[11 Regression] arm: ICE (segfault) loading double with -mpure-code -mbig-endian
110288	gcc	fortran	  anlauf	[11/12/13/14] Regression: segfault in findloc with allocatable array of allocatable characters
110585	gcc	fortran	  anlauf	ICE in gfc_compare_expr for findloc with complex literal array
110658	gcc	fortran	  anlauf	MINVAL/MAXVAL and deferred-length character arrays
115611	gcc	target	  avieira	mve: vsetq_lane for 64-bits has wrong codegen when setting lane 1
113893	gcc	ada	 ebotcazou	finalization of object allocated by anonymous access type designating local type
111050	gcc	libstdc+  fdumont	[11/12/13/14 Regression] ABI break in _Hash_node_value_base since GCC 11
110624	gcc	target	   iains	Xcode 15 ld warns about -macosx_version_min
114171	gcc	d	 ibuclaw	[13/14 Regression] gdc -O2 -mavx generates misaligned vmovdqa instruction
108789	gcc	middle-e   jakub	__builtin_(add|mul|sub)_overflow methods generate duplicate operations if both operands are const which in turn causes wrong code due to overlapping arguments
110115	gcc	middle-e   jakub	[11 Regression] Wrong code at -O1 on x86_64-linux-gnu
110914	gcc	tree-opt   jakub	[11/12/13/14 Regression] Optimization eliminating necessary assignment before 0-byte memcpy since r10-5451
111422	gcc	middle-e   jakub	Wrong code at -O3 on x86_64-linux-gnu
112816	gcc	target	   jakub	[11/12 Regression] ICE unrecognizable_insn with __builtin_signbit and returning struct with int[4]
113122	gcc	target	   jakub	Assembler messages: Error: operand type mismatch for `movabs' / bad expression / invalid use of register with -fprofile -mcmodel=large -masm=intel
113192	gcc	libgomp	   jakub	[11 Regression] ERROR: couldn't execute "../../../gcc/libgomp/testsuite/flock": no such file or directory
113262	gcc	c	   jakub	[11 Regression] ICE when using [[gnu::copy("")]] attribute
114533	gcc	libquadm   jakub	libquadmath: printf: fix misaligned access on args
114537	gcc	c++	   jakub	bit_cast does not work NSDMI of bitfields
114572	gcc	c++	   jakub	[OpenMP] "internal compiler error: in assign_temp" with assignment operator and lastprivate clause
115172	gcc	sanitize   jakub	Invalid -fsanitize=bool sanitization of variable from named address space
115440	gcc	driver	   jakub	unrecognized command-line option '--c++17'; did you mean '--stdc++17'?
110422	gcc	tree-opt   jamborm	asm goto vs SRA
92145	gcc	c++	   jason	-Wdeprecated-copy false-positive when inheriting base assignment operators
92407	gcc	c++	   jason	Destruction of objects returned from functions skipped by goto
103185	gcc	c++	   jason	[11/12/13 Regression] ind[arr] is rejected when arr is an array prvalue
106310	gcc	c++	   jason	[11 Regression] lookup after this-> seems wrong for dependent lookup since r12-6754-g30f2c22def739211
111357	gcc	c++	   jason	[11/12/13/14 Regression] __integer_pack fails to work with values of dependent type convertible to integers in noexcept context
114130	gcc	target	    kito	[11 Regression] RISC-V: `__atomic_compare_exchange` does not use sign-extended value for RV64
113250	gcc	libstdc+   kmatsui	std::filesystem::equivalent("", "/") should throw
115457	gcc	target	   ktkachov	AArch64 should define __ARM_FEATURE_BF16
115475	gcc	target	   ktkachov	AArch64 should define __ARM_FEATURE_SVE_BF16 when appropriate
88309	gcc	target	   linkw	[11/12/13/14 Regression] ICE: Floating point exception (in is_miss_rate_acceptable), target assigning alignent of 4 bits(!) to vector
104259	gcc	libstdc+   marxin	libstdc++ fails for epiphany-elf
109822	gcc	libstdc+   mkretz	Converting std::experimental::simd masks yields an error
59465	gcc	c++	  mpolacek	[11/12/13 Regression] g++ allows direct-initialization of an array of class type from another array in a mem-initializer
100557	gcc	c++	  mpolacek	[11/12/13/14 Regression] Internal compiler error: Error reporting routines re-entered.
115642	gcc	c	  mpolacek	[11/12/13/14/15 Regression] internal compiler error: tree check: expected class 'type', have 'exceptional' (error_mark) in c_expr_sizeof_expr
95351	gcc	middle-e   pinskia	[11/12 Regression] Comparison with NAN optimizes incorrectly with -ffast-math disabled
111699	gcc	middle-e   pinskia	[11/12/13 Regression] ICE: SIGSEGV: infinite recursion in fold_build3_loc/fold_ternary_loc/generic_simplify_VEC_COND_EXPR
109761	gcc	c++	   ppalka	[11/12 Regression] Nested class destructor's noexcept specification incorrectly considered as too loose compared to the outer class
111485	gcc	c++ 	   ppalka	[11/12 Regression] Constraint mismatch on template template parameter
113175	gcc	testsuit   ppalka	[11/12/13/14 Regression] testsuite/std/ranges/iota/max_size_type.cc 5x times slower
111407	gcc	tree-opt   qinzhao	[11/12/13 Regression] ICE: SSA corruption due to widening_mul opt on conflict across an abnormal edge
99327	gcc	libstdc+    redi	ENOTSUP macro does not exist on djgpp crt
104161	gcc	libstdc+     red	Potential Security Vulnerability: remove_all and symbolic link
105178	gcc	libstdc+    redi	[11 Regression] g++ incorrectly reports invalid use of incomplete type
108178	gcc	libstdc+    redi	Filesystem::copy_file can't copy from /proc on Linux machines
112491	gcc	libstdc+    redi	std::deque<T,Allocator>::size xmethod output is wrong
114147	gcc	libstdc+    redi	[11 Regression] tuple allocator-extended constructor requires non-explicit default constructor
114401	gcc	libstdc+    redi	libstdc++ allocator destructor omitted when reinserting node_handle into tree- and hashtable-based containers
96109	gcc	testsuit    rguenth	[11 Regression] gcc.dg/vect/slp-47.c etc. FAIL
110182	gcc	tree-opt    rguenth	[11 Regression] Vector(2) cast from double to float and back and subtraction seems to produce incorrect results
110200	gcc	middle-e    rguenth	genmatch generating questionable code with convert and !
98237	gcc	ipa	      ro        gcc-dg-lto-modref-3-01.exe etc. FAIL when LTO plugin is not enabled
97696	gcc	sanitize    rsandifo	ICE since ASAN_MARK does not handle poly_int sized varibales
100303	gcc	debug	    rsandifo	[11 Regression] -fcompare-debug failure (length) with -O -fno-dce -ftracer
111340	gcc	target	    ubizjak	gcc.dg/bitint-12.c fails on x86_64-apple-darwin or fails on x86_64-linux-gnu with -fPIE
115297	gcc	rtl-opti    ubizjak	[14/15 regression] alpha: ICE in simplify_subreg, at simplify-rtx.cc:7554 with -O1
115836	gcc	middle-e    ubizjak	ICE when building Firefox with-march=pentium-mmx -mtune=pentium-m
91085	gcc	other	   unassigned	[11 only] fixincludes breaks <bits/statx.h>
103183	gcc	c++	   unassigned	[11/12/13/14 Regression] ind[arr] produces an lvalue when arr is an array xvalue
105417	gcc	libstdc+   unassigned	[11 Regression] powerpc64le-linux abilist changes based on --with-long-double-format=
110309	gcc	target	   unassigned	Wrong code for masked load expansion
111922	gcc	ipa	   unassigned	[11/12/13/14 Regression] ICE in cp with -O2 -fno-tree-fre
112823	gcc	other	   unassigned	[11 only] -Wincompatible-pointer-types errors in libiberty/simple-object-mach-o.c (missing backport for gcc-11)
112891	gcc	target	   unassigned	[11/12/13/14 Regression] Missing vzeroupper insert
114049	gcc	target	   unassigned	gcc.dg/framework-1.c FAILs with Xcode 15.3 beta 3
114098	gcc	target	   unassigned	_tile_loadconfig doesn't work
114521	gcc	target	   unassigned	[11 only] aarch64: wrong code with Neon ld1/st1x4 intrinsics gcc-11 and earlier
115261	gcc	rtl-opti   unassigned	[11/12/13/14/15 regression] FAIL: gcc.target/s390/vector/vec-abi-vararg-1.c
115269	gcc	libstdc+   unassigned	Hardcoded links in 14.1 docs to pages from release 4.3.2
115870	gcc	tree-opt   unassigned	Inlining of different template instances wrongly produces infinite loop
103715	gcc	fortran	   anlauf	[11/12/13/14 Regression] ICE in gfc_find_gsymbol, at fortran/symbol.c:4301 since r9-3803-ga5fbc2f36a291cbe
111837	gcc	fortran	   anlauf	[11/12/13/14 Regression] Out of bounds access with optimization inside io-implied-do-control
114474	gcc	fortran	   anlauf	[11/12/13/14 Regression] DATA statement with derived type, pointer component rejected
113979	gcc	ada	  ebotcazou	[11/12/13/14 regression] bogus error on allocator for array type with Dynamic_Predicate
103506	gcc	fortran	  jvdelisle	[11 Regression] ICE in gfc_free_namespace, at fortran/symbol.c:4039 since r10-2798-ge68a35ae4a65d2b3
107397	gcc	fortran	  jvdelisle	[11/12 Regression] ICE in gfc_arith_plus, at fortran/arith.cc:654
91035	gcc	target	   krebbel	[11/12/13/14 Regression] gotools fails to build on s390x-linux-gnu
84006	gcc	fortran	   pault	[11/12 Regression] ICE in storage_size() with CLASS entity
89462	gcc	fortran	   pault	[11/12/13 Regression] gfortran loops in code generation
93678	gcc	fortran	   pault	[11/12/13 Regression] ICE with TRANSFER and typebound procedures
103312	gcc	fortran	   pault	[11/12 Regression] ICE in gfc_find_component since r9-1098-g3cf89a7b992d483e
103368	gcc	fortran	   pault	[11/12/13 Regression] ICE in gimplify_expr, at gimplify.c:15668 since r12-4464-g017665f63047ce47
103716	gcc	fortran	   pault	[11/12/13 Regression] ICE in gimplify_expr, at gimplify.c:15964 since r9-3803-ga5fbc2f36a291cbe
106999	gcc	fortran	   pault	[11/12/13 Regression] ICE tree check: expected record_type or union_type or qual_union_type, have function_type in gfc_class_data_get, at fortran/trans-expr.cc:233
71703	gcc	fortran	 unassigned	[11 Regression] [OOP] ICE in wide_int_to_tree, at tree.c:1488
89925	gcc	fortran	 unassigned	[11 Regression] Wrong array bounds from ALLOCATE with SOURCE or MOLD
99183	gcc	fortran	 unassigned	[11 Regression] Incompatible Runtime types
99757	gcc	c++	 unassigned	[11/12/13/14 Regression] ICE: in cp_finish_decl, at cp/decl.c:7736
104391	gcc	fortran	 unassigned	[11 Regression] bind(C) and allocatable or pointer attribute don't work
104908	gcc	fortran	 unassigned	[11/12/13/14 Regression] incorrect Fortran out-of-bound runtime error.
113179	gcc	middle-e unassigned	[11/12/13/14/15 Regression] MIPS: INS is used for long long, before SLL
80774	gcc	fortran	   vehre	[11/12/13/14/15 Regression][Coarray] ICE in gfc_conv_descriptor_data_get, at fortran/trans-array.c
82904	gcc	fortran	   vehre	[11/12/13/14/15 Regression][Coarray] ICE in make_ssa_name_fn, at tree-ssanames.c:261
111880	gcc	fortran	   anlauf	[11/12/13/14] False positive warning of obsolescent COMMON block with Fortran submodule
61527	gcc	fortran	 unassigned	[11/12/13/14 Regression] [OOP] class/extends, multiple generic assignment, accept invalid

(From OE-Core rev: 7806e21e7d47fd010872a3967e51bcacdae3a76b)

Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Jinfeng Wang
8c4a3b7c65 procps: patch CVE-2023-4016
Previous patch[1] for CVE-2023-4016 is insufficent.
Backport more from upstream master.

There is one change needed to apply this patch:
* change file location from local/xalloc.h to include/xalloc.h

[1] https://git.openembedded.org/openembedded-core/commit/meta/recipes-extended/procps/procps/CVE-2023-4016.patch?h=kirkstone&id=71d0683d625c09d4db5e0473a0b15a266aa787f4

(From OE-Core rev: 94521a1e49e8fd9193211f486995d2e504f99d3f)

Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Peter Marko
18329f8b1c wpa-supplicant: Patch security advisory 2024-2
Pick patches according to
http://w1.fi/security/2024-2/sae-h2h-and-incomplete-downgrade-protection-for-group-negotiation.txt
SAE H2E and incomplete downgrade protection for group negotiation

(From OE-Core rev: 58b8ad7e33f47f06409be84430a8c2a22b4dd92f)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Peter Marko
27848b47b8 wpa-supplicant: Patch CVE-2024-3596
Picked patches according to
http://w1.fi/security/2024-1/hostapd-and-radius-protocol-forgery-attacks.txt

First patch is style commit picked to have a clean cherry-pick of all
mentioned commits without any conflict.
Patch CVE-2024-3596_07.patch has hostapd code removed as it is not
present in wpa-supplicant download tarball.

(From OE-Core rev: 6f65fd4d98b5a5dcd410b2dcfeb2e6f229c3b973)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Peter Marko
808700d130 wpa-supplicant: Ignore CVE-2024-5290
NVD CVE report [1] links Ubuntu bug [2] which has a very good
description/discussion about this issue.
It applies only to distros patching wpa-supplicant to allow non-root
users (e.g. via netdev group) to load modules.
This is not the case of Yocto.

Quote:
So upstream isn't vulnerable as they only expose the dbus interface to
root. Downstreams like Ubuntu and Chromium added a patch that grants
access to the netdev group. The patch is the problem, not the upstream
code IMHO.

There is also a commit [3] associated with this CVE, however that only
provides build-time configuration to limit paths which can be accessed
but it acts only as a mitigation for distros which allow non-root users
to load crafted modules.

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-5290
[2] https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2067613
[3] https://w1.fi/cgit/hostap/commit/?id=c84388ee4c66bcd310db57489eac4a75fc600747

(From OE-Core rev: 603047ab3c85009c384793cdbdd8e6ae1aebd737)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Peter Marko
3a172a5aa5 gnupg: Document CVE-2022-3219 and mark wontfix
(From OE-Core rev: f10f9c3a8d2c17d5a6c3f0b00749e5b34a66e090)

(From OE-Core rev: fe094c2d50ffe11627efa6c0807a289c1ee6eb74)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Vijay Anusuri
f5c9fab6c4 curl: backport Debian patch for CVE-2024-8096
import patch from ubuntu to fix
 CVE-2024-8096

Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/curl/tree/debian/patches?h=ubuntu/jammy-security
Upstream commit
aeb1a281ca]

Reference:
https://curl.se/docs/CVE-2024-8096.html

(From OE-Core rev: 5383b18d4f8023b49cdadf7c777aaecf55d95dc1)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-07 05:43:22 -07:00
Jörg Sommer
47ffa50db2 doc/features: remove duplicate word in distribution feature ext2
(From yocto-docs rev: fa846606014a85154b63794a17ff1d9aacc1a7bc)

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-27 05:57:35 -07:00
Ross Burton
5088e79244 lib/oeqa: rename assertRaisesRegexp to assertRaisesRegex
TestCase.assertRaisesRegexp was renamed to assertRaisesRegex in Python
3.2, so rename to fix a warning during test execution.

(From OE-Core rev: ff720f337e40761c7d4d544c963cf518ad5403ad)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6df44a4b29487bf8ef51bb5ba6467a4056b749cc)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-27 05:57:35 -07:00
Konrad Weihmann
504f203986 testexport: fallback for empty IMAGE_LINK_NAME
if IMAGE_LINK_NAME is set empty to disable the symlinking
for image artifacts in deploy, testexport fails, as the path assembly
is incorrect.
In that case fallback to IMAGE_NAME

(From OE-Core rev: 0c1d098e6dd08fa3a5aafca656457ac6badcef89)

(From OE-Core rev: a821a5810ae6edba5882a43e3c60c142f2acda9d)

Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-27 05:57:35 -07:00
Konrad Weihmann
38ea1cb055 testimage: fallback for empty IMAGE_LINK_NAME
if IMAGE_LINK_NAME is set empty to disable the symlinking
for image artifacts in deploy, testimage fails, as the path assembly
is incorrect.
In that case fallback to IMAGE_NAME

(From OE-Core rev: c7a4e7e294992acc589c62adcaf6cd32659f2f9b)

(From OE-Core rev: 5b4c7a39f7a99d5c98eab3aaf693f4d3000c7ac1)

Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-27 05:57:35 -07:00
Konrad Weihmann
6ee7342411 runqemu: keep generating tap devices
in case there is no tap device the script tries to
generate a new one.
The new device is then unguarded for a moment, so
the newly generated device could be acquired
by a different instance or user, before it is locked to
the instance with acquire_taplock.
To fix that keep generating new tap devices in case
the lock can't be acquired up to 5 times.
If no tap device can be locked it fails in the existing
error handling

(From OE-Core rev: 23876576d054ebbab9b02c0012782aa56feda123)

(From OE-Core rev: 5215635442949a62f502e839ddf1f12e790e5e37)

Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-27 05:57:35 -07:00
Richard Purdie
065bd86349 buildhistory: Simplify intercept call sites and drop SSTATEPOSTINSTFUNC usage
We planned to drop SSTATEPOSTINSTFUNC some time ago with the introduction of
postfuncs. Finally get around to doing that which should make the buildhistory
code a little more readable.

Unfortunately ordering the buildhistory function calls after the sstate ones is
difficult without coding that into the sstate class. This patch does that to
ensure everything functions as expected until we can find a better way. This is
still likely preferable than the generic sstate postfuncs support since the function
flow is much more readable.

(From OE-Core rev: 78ca086441b21dedd9c471a3d3200c24fd9ec8d2)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c9e2a8fa2f0305ef1247ec405555612326f798f8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-27 05:57:35 -07:00
Pedro Ferreira
958eaccc88 buildhistory: Restoring files from preserve list
This fix will ensure that, when we activate feature
`BUILDHISTORY_RESET`, files marked to keep on feature
`BUILDHISTORY_PRESERVE` will indeed exist is buildhistory
final path since they are moved to buildhistory/old but
not restored at any point.

(From OE-Core rev: 8160fd3c042283a47a2601e1797847c303e1e7e5)

Signed-off-by: Pedro Ferreira <Pedro.Silva.Ferreira@criticaltechworks.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9f68a45aa238ae5fcdfaca71ba0e7015e9cb720e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-27 05:57:35 -07:00
Pedro Ferreira
e4de762adb buildhistory: Fix intermittent package file list creation
The directory that buildhistory_list_pkg_files writes to during do_package
is created by do_packagedata so a clean buildhistory doesn't have
files-in-package written during the first build since packagedata happens
after do_package.

Ensure the output package folder is created to avoid missing
files-in-package.txt files.

Also it ensures that in case of `find` fails we leave with
a hard error instead of hiding the error on the for loop.

(From OE-Core rev: 6817b012763fc32cdcffe30163a304da3ed59ae1)

Signed-off-by: Pedro Silva Ferreira <Pedro.Silva.Ferreira@criticaltechworks.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8de9b8c1e199896b9a7bc5ed64967c6bfbf84bea)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-27 05:57:35 -07:00
Colin McAllister
34538e0dbe udev-extraconf: Add collect flag to mount
Adds extra "--collect" flag to the mount command within
automount_systemd. This is intended to fix an observed deadlock after
rapidly inserting and removing external media. This is because if the
mount command fails, the transient mount will enter a failed state. The
next time the media is inserted, automount_systemd bails because the
first consition finds that the file path for the failed transient mount
still exists. This leaves the external media unmounted and cannot be
mounted until the mount is fixed via systemctl or the device is
rebooted.

Adding "--collect" ensures that the transient mount is cleaned up after
entering a failed state, which ensures that the media can still be
mounted when it's re-inserted.

(From OE-Core rev: f0cda74d73eb8c14cd6f695f514108f1e94984a6)

(From OE-Core rev: 5dbc923acdab11eada37a4f7bba19e6d133ac931)

Signed-off-by: Colin McAllister <colinmca242@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-27 05:57:35 -07:00
Colin McAllister
30d00daf9e busybox: Fix cut with "-s" flag
This fixes and issue that allows blank lines to be incorrectly output
when the "-s" flag is included. This issue propogates into the
populate-volatile.sh script in initscripts. If a volatiles drop file
contains blank lines, a blank line will be included in combined users,
which will incorrectly result in a difference in the number of combined
users versus defined users. If this happens, the volatiles file will not
be executed.

(From OE-Core rev: dfbcf0581ab3dd47037726a7b8aa06f777792473)

(From OE-Core rev: 5576ff6e7676a09649fdbf0042f5f64a1ec1023b)

Signed-off-by: Colin McAllister <colinmca242@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-27 05:57:35 -07:00
Divya Chellam
487e8cdf1d python3: Upgrade 3.10.14 -> 3.10.15
Includes security fixes for CVE-2024-4030, CVE-2024-7592, CVE-2024-4032, CVE-2024-8088
CVE-2024-6232, CVE-2024-6923, CVE-2023-27043 and other bug fixes.

Removed below patches, as the fixes included in 3.10.15 upgrade:
1. CVE-2023-27043.patch
2. CVE-2024-6232.patch
3. CVE-2024-7592.patch
4. CVE-2024-8088.patch

Release Notes:
https://www.python.org/downloads/release/python-31015/

(From OE-Core rev: e64ead97ae3d680f97bf85422f777cd77ae7c434)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-27 05:57:35 -07:00
Michael Halstead
8190d9c754 yocto-uninative: Update to 4.6 for glibc 2.40
(From OE-Core rev: 81b225f27ee22c2533e9698fe27163d7c7fe295f)

Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b29bfd333dffe635ab67475dcd8d22ad8b114c84)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-09-27 05:57:34 -07:00