Commit Graph

54852 Commits

Author SHA1 Message Date
Bruce Ashfield
6a56962e84 linux-yocto/6.6: fix beaglebone ethernet
Integrating the following commit(s) to linux-yocto/6.6:

1/1 [
    Author: Colin Foster
    Email: colin.foster@in-advantage.com
    Subject: ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
    Date: Fri, 31 May 2024 13:38:17 -0500

    Prior to commit df16c1c51d81 ("net: phy: mdio_device: Reset device only
    when necessary") MDIO reset deasserts were performed twice during boot.
    Now that the second deassert is no longer performed, device probe
    failures happen due to the change in timing with the following error
    message:

    SMSC LAN8710/LAN8720: probe of 4a101000.mdio:00 failed with error -5

    Restore the original effective timing, which resolves the probe
    failures.

    Signed-off-by: Colin Foster <colin.foster@in-advantage.com>
    Link: https://lore.kernel.org/r/20240531183817.2698445-1-colin.foster@in-advantage.com
    Signed-off-by: Kevin Hilman <khilman@baylibre.com>
]

(From OE-Core rev: c315a5739b373a33e24e3b84db3fbb4bec9b9353)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-05 08:41:15 -07:00
Bruce Ashfield
dfc1ab0595 linux-yocto/6.6: update to v6.6.85
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

    d57a7c616960 Linux 6.6.85
    fa81cb19f5b7 netfilter: nft_counter: Use u64_stats_t for statistic.
    35afffaddbe8 wifi: iwlwifi: mvm: ensure offloading TID queue exists
    fd82d29c4cfb wifi: iwlwifi: support BIOS override for 5G9 in CA also in LARI version 8
    7f306c651fea bnxt_en: Fix receive ring space parameters when XDP is active
    9dff3e36ea89 btrfs: make sure that WRITTEN is set on all metadata blocks
    690597da35d9 Revert "sched/core: Reduce cost of sched_move_task when config autogroup"
    04cd1dc3df7f arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S
    7d5669629422 KVM: arm64: Eagerly switch ZCR_EL{1,2}
    93074abedecb KVM: arm64: Mark some header functions as inline
    2afe039450a0 KVM: arm64: Refactor exit handlers
    30253b3eb685 KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN
    88adb7a00754 KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN
    73f64c676a6b KVM: arm64: Remove host FPSIMD saving for non-protected KVM
    806d5c1e1d2e KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state
    20c6561c4918 KVM: arm64: Calculate cptr_el2 traps on activating traps
    b44a37824878 mptcp: Fix data stream corruption in the address announcement
    d0f87370622a ksmbd: fix incorrect validation for num_aces field of smb_acl
    5e0f5166e2dc drm/amd/display: Use HW lock mgr for PSR1 when only one eDP
    7803ca385941 drm/amd/display: should support dmub hw lock on Replay
    28780816ca29 drm/amdgpu: Fix JPEG video caps max size for navi1x and raven
    e66a1a616fa6 drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size
    c76bd3c99293 drm/sched: Fix fence reference count leak
    3ce08215cad5 drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
    f2bbfd50e95b soc: qcom: pdr: Fix the potential deadlock
    6e38b4a4b382 batman-adv: Ignore own maximum aggregation size during RX
    b7b4be1fa432 xsk: fix an integer overflow in xp_create_and_assign_umem()
    19f4e715f665 efi/libstub: Avoid physical address 0x0 when doing random allocation
    0baa10cf97b5 ARM: shmobile: smp: Enforce shmobile_smp_* alignment
    d6274b9472d5 ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6
    63b53198aff2 proc: fix UAF in proc_get_inode()
    29124ae980e2 mm/migrate: fix shmem xarray update during migration
    9efb6b502104 mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT
    f42c361843fa mmc: atmel-mci: Add missing clk_disable_unprepare()
    6d2f8c59747a mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops
    db59b24b3858 arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou
    3db71cf02250 arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card
    62b5b2eca3e5 arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card
    4b2a170c2586 accel/qaic: Fix integer overflow in qaic_validate_req()
    998b1aae22dc regulator: check that dummy regulator has been probed before using it
    e26f24ca4fb9 regulator: dummy: force synchronous probing
    f793c0fdaaf1 riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions
    7cd375d46afc drm/v3d: Don't run jobs that have errors flagged in its fence
    c8eebc9d5b9c can: flexcan: disable transceiver during system PM
    6f5481d4ed39 can: flexcan: only change CAN state when link up in system PM
    cc29775a8a72 can: ucan: fix out of bound read in strscpy() source
    e5e6bd8e0de5 can: rcar_canfd: Fix page entries in the AFL list
    b202afc54e94 i2c: omap: fix IRQ storms
    f0372a4cf285 Revert "gre: Fix IPv6 link-local address generation."
    ae2ec5a51fa0 net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
    e4f6de68deba net: lwtunnel: fix recursion loops
    9566f6ee13b1 net: atm: fix use after free in lec_send()
    a235ec29c945 ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
    119dcafe3679 ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
    1e842b459008 ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX
    3d123ec74d81 accel/qaic: Fix possible data corruption in BOs > 2G
    59b683594ff3 Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters
    ecd06ad0823a Bluetooth: Fix error code in chan_alloc_skb_cb()
    9524af58447d RDMA/hns: Fix wrong value of max_sge_rd
    0edfba91b773 RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common()
    5df88c383715 RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db()
    975355faba56 RDMA/hns: Fix soft lockup during bt pages loop
    dba5577d8e33 RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
    1e8d0765da64 ARM: dts: bcm2711: Don't mark timer regs unconfigured
    e68954ecf8b8 ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP
    0e6aa61b54a8 RDMA/mlx5: Handle errors returned from mlx5r_ib_rate()
    6a788e32f64e RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx
    25be7f9bde2d arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1
    61820187b3ef ARM: dts: bcm2711: PL011 UARTs are actually r1p5
    1b7b036685c3 soc: imx8m: Unregister cpufreq and soc dev in cleanup path
    4a58a332eedd soc: imx8m: Use devm_* to simplify probe failure handling
    d1fb2e767e1c soc: imx8m: Remove global soc_uid
    8e1704e5b205 xfrm_output: Force software GSO only in tunnel mode
    bfb9b9404a53 xfrm: fix tunnel mode TX datapath in packet offload mode
    e432cb123d89 arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply
    555f05de6f46 firmware: imx-scu: fix OF node leak in .probe()
    ceb5fadbf450 Revert "v6.6 -stable -rt merge fixup"
    1c2962a164ff v6.6 -stable -rt merge fixup
    18abb2787b53 x86/syscall: Mark exit[_group] syscall handlers __noreturn
    2879d995e569 pnmtologo: sync with 6.6
    43ea1c5e6eb3 lib/build_OID_registry: take -stable reproducibility changes
    35046aea43c8 bpftool: Fix undefined bpf macro for unix socket
    9a558d4b8621 tools/resolve_btfids: Fix comparison of distinct pointer types warning in resolve_btfids
    42b2eec2e503 bpftool: Query only cgroup-related attach types
    f71bb11887ba cpu/amd: inhibit SMP check for qemux86
    c31365597a17 powerpc/uaccess: Fix build errors seen with GCC 13/14
    64ebf485c56b usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock
    7c76aad68f6d kselftest: Add a ksft_perror() helper
    06644f0d7193 drm/tilcdc: Set preferred depth
    ff7ae7b32324 crypto: jitter - add RCT/APT support for different OSRs
    50cd24ddb6f0 arm64: defconfig: remove CONFIG_IPQ_APSS_5018
    58e5c91d6701 x86/alternatives: Disable interrupts and sync when optimizing NOPs in place
    c878fd2d4c79 x86/alternatives: Sync core before enabling interrupts
    c2d64b9f52b6 qemux86: add configuration symbol to select values
    630c33229e6d sched/isolation: really align nohz_full with rcu_nocbs
    0e5e0f68e2e6 clear_warn_once: add a clear_warn_once= boot parameter
    46934791b902 clear_warn_once: bind a timer to written reset value
    cdee9e38ff32 clear_warn_once: expand debugfs to include read support
    82b562b81841 tools: Remove some options from CLANG_CROSS_FLAGS
    36dc380b776b libbpf: Fix build warning on ref_ctr_off
    9e3e1fe20982 perf: perf can not parser the backtrace of app in the 32bit system and 64bit kernel.
    e497a4a5da65 perf: x86-32: explicitly include <errno.h>
    7b57ddd89565 perf: mips64: Convert __u64 to unsigned long long
    1cfc19423dc7 perf: fix bench numa compilation
    98bc2815fade perf: add SLANG_INC for slang.h
    17209a70b9b3 perf: add sgidefs.h to for mips builds
    9cd4258d910a perf: change --root to --prefix for python install
    8110a4f26628 perf: add 'libperl not found' warning
    bc89d5e08f77 perf: force include of <stdbool.h>
    4f6c760cc876 fat: Replace prandom_u32() with get_random_u32()
    bc53117b12b2 fat: don't use obsolete random32 call in namei_vfat
    30b2236ab378 FAT: Added FAT_NO_83NAME
    cef98d22b4ed FAT: Add CONFIG_VFAT_NO_CREATE_WITH_LONGNAMES option
    0bbd7daba9e1 FAT: Add CONFIG_VFAT_FS_NO_DUALNAMES option
    5883fc340084 aufs6: adapt to v6.6 i_op->ctime changes
    c4342d979bf2 aufs6: fix magic.mk include path
    35266bc2dc81 aufs6: adapt to v6.6
    8edede4e98be aufs6: core
    712248233ebe aufs6: standalone
    3b71a8a848d8 aufs6: mmap
    3e2924871f37 aufs6: base
    7f4907a93101 aufs6: kbuild
    d2f7b03e4aa7 yaffs2: update VFS ctime operations to 6.6+
    bcd6cfcd1aa0 yaffs2: v6.5 fixups
    cc615704b5f5 yaffs2: Fix miscalculation of devname buffer length
    8ef2e22dcf91 yaffs2: convert user_namespace to mnt_idmap
    c9c749f9f7d3 yaffs2: replace bdevname call with sprintf
    395b01cdc39d yaffs2: convert read_page -> readfolio
    d98b07e43ba6 yaffs: replace IS_ERR with IS_ERR_OR_NULL to check both ERR and NULL
    613c6d50fdbe yaffs: fix -Wstringop-overread compile warning in yaffs_fix_null_name
    622c4648936f yaffs2: v5.12+ build fixups (not runtime tested)
    7562133d4090 yaffs: include blkdev.h
    dbd44252cd59 yaffs: fix misplaced variable declaration
    c223a10b1ac0 yaffs2: v5.6 build fixups
    90f6007cfbf4 yaffs2: fix memory leak when /proc/yaffs is read
    37ee169c5ea1 yaffs: add strict check when call yaffs_internal_read_super
    b6e007b8abb6 yaffs: repair yaffs_get_mtd_device
    fb98f65a466a yaffs: Fix build failure by handling inode i_version with proper atomic API
    51e0aac75ea2 yaffs2: fix memory leak in mount/umount
    2b74a0cae7b0 yaffs: Avoid setting any ACL releated xattr
    ff4130a9c376 Yaffs:check oob size before auto selecting Yaffs1
    ba95b409c67c fs: yaffs2: replace CURRENT_TIME by other appropriate apis
    8fa35eba9056 yaffs2: adjust to proper location of MS_RDONLY
    1eb5deaad8c4 yaffs2: import git revision b4ce1bb (jan, 2020)
    4dce67c1e8c8 initramfs: allow an optional wrapper script around initramfs generation
    2f603d83fcc4 pnmtologo: use relocatable file name
    664a6a0a484b tools: use basename to identify file in gen-mach-types
    9de64bc0c185 lib/build_OID_registry: fix reproducibility issues
    ae9b80797295 vt/conmakehash: improve reproducibility
    a972323151bd iwlwifi: select MAC80211_LEDS conditionally
    15d2adcc0198 net/dccp: make it depend on CONFIG_BROKEN (CVE-2020-16119)
    5556a6c04b19 arm64/perf: Fix wrong cast that may cause wrong truncation
    5552dc768ffc defconfigs: drop obselete options
    00fe4152df31 arm64/perf: fix backtrace for AAPCS with FP enabled
    3888d0652edf linux-yocto: Handle /bin/awk issues
    3d55d299f23a uvesafb: provide option to specify timeout for task completion
    23c068c080be uvesafb: print error message when task timeout occurs
    edbfc939266e compiler.h: Undef before redefining __attribute_const__
    c99ae7e2a19a vmware: include jiffies.h
    572d84d928c8 Resolve jiffies wrapping about arp
    fdcd47cac843 nfs: Allow default io size to be configured.
    927d48801098 check console device file on fs when booting
    57cc27f821dd mount_root: clarify error messages for when no rootfs found
    1b53d82a8152 mconf: fix output of cflags and libraries
    1811da09f42c menuconfig,mconf-cfg: Allow specification of ncurses location
    83c2e0c6eb1f modpost: mask trivial warnings
    6de673039484 kbuild: exclude meta directory from distclean processing
    6decd32815f5 powerpc: serialize image targets
    f6b683b38318 arm: serialize build targets
    e798b09ebf57 mtd_blkdevs: add mtd_table_mutex lock back to blktrans_{open, release} to avoid race condition
    dc8a1e5a88f8 x86_64_defconfig: Fix warnings
    68491e5f72b6 powerpc/ptrace: Disable array-bounds warning with gcc8
    d71ebfce3004 powerpc: Disable attribute-alias warnings from gcc8
    62f50884b8b1 powerpc: kexec fix for powerpc64
    da6871c62c37 powerpc: Add unwind information for SPE registers of E500 core
    f161c880c11d mips: make current_cpu_data preempt safe
    5e94a8247ce7 mips: vdso: fix 'jalr $t9' crash in vdso code
    19e36714b1c7 mips: Kconfig: add QEMUMIPS64 option
    e2e537db3cbd 4kc cache tlb hazard: tlbp cache coherency
    aee9870611e5 malta uhci quirks: make allowance for slow 4k(e)c
    881948cd1517 drm/fb-helper: move zeroing code to drm_fb_helper_fill_var
    98ec1963fcb7 arm64: defconfig: cleanup config options
    f1727c537ba8 vexpress: Pass LOADADDR to Makefile
    4474c32dc24a arm: ARM EABI socketcall
    75e31a2b70fd ARM: LPAE: Invalidate the TLB for module addresses during translation fault

(From OE-Core rev: 09ebb505598f383d9ec6550a39e77c4ed1dab202)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-05 08:41:15 -07:00
Ashish Sharma
f8d52ece40 screen: patch CVE-2025-46805
Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/screen/patch/?id=aa9f51f996a22470b8461d2b6a32e62c7ec30ed5
Upstream commit https://git.savannah.gnu.org/cgit/screen.git/commit/?id=161f85b98b7e1d5e4893aeed20f4cdb5e3dfaaa4]

(From OE-Core rev: 69dd9b16fbd18a1a960887ee9479a2e731b5a184)

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-05 08:41:15 -07:00
Hitendra Prajapati
d56536a618 libsoup-2.4: Fix CVE-2025-4969
Upstream-Status: Backport from 07b94e27af

(From OE-Core rev: 565ce534e6061913978c7e42dac6b2ff34169b85)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-05 08:41:15 -07:00
Hitendra Prajapati
edc0010d0d libsoup-3.4.4: Fix CVE-2025-4969
Upstream-Status: Backport from 07b94e27af

(From OE-Core rev: 9716cdacb4378e0274246c39c5fb808e4d86b4ce)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-05 08:41:15 -07:00
Steve Sakoman
ac257900c3 build-appliance-image: Update to scarthgap head revision
(From OE-Core rev: d5342ffc570d47a723b18297d75bd2f63c2088db)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 07:22:19 -07:00
Rogerio Guerra Borin
339fe2fe1c u-boot: ensure keys are generated before assembling U-Boot FIT image
Add the task dependency:

do_uboot_assemble_fitimage -> virtual/kernel:do_kernel_generate_rsa_keys

to ensure the kernel FIT image signing keys are available when creating
the U-Boot DTB. This is done only if the signing of the kernel FIT image
is enabled (UBOOT_SIGN_ENABLE="1").

The lack of the dependency causes build errors when executing a build
with no kernel FIT keys initially present in the keys directory. In such
cases one would see an output like this in the Bitbake logs:

Log data follows:
| DEBUG: Executing shell function do_uboot_assemble_fitimage
| Couldn't open RSA private key: '/workdir/build/keys/fit/dev.key': No such file or directory
| Failed to sign 'signature' signature node in 'conf-1' conf node
| FIT description: Kernel Image image with one or more FDT blobs
| ...

This issue was introduced by commit 259bfa86f384 where the dependency
between U-Boot and the kernel was removed (for good reasons). Before
that commit the dependency was set via DEPENDS so that, in terms of
tasks, one had:

u-boot:do_configure -> virtual/kernel:do_populate_sysroot

and the chain leading to the key generation was:

virtual/kernel:do_populate_sysroot -> virtual/kernel:do_install
virtual/kernel:do_install -> virtual/kernel:do_assemble_fitimage
virtual/kernel:do_assemble_fitimage -> virtual/kernel:do_kernel_generate_rsa_keys

With the removal of the first dependency, no more guarantees exist that
the keys would be present when assembling the U-Boot FIT image. That's
the situation we are solving with the present commit.

(From OE-Core rev: 036f20156b3c7d0a8b912e90aa29a9b986106d5a)

Fixes: d7bd9c627661 ("u-boot: kernel-fitimage: Fix dependency loop if UBOOT_SIGN_ENABLE and UBOOT_ENV enabled")
(From OE-Core rev: 56431a98ac661eaa42803e83a9ede6eae0b72b67)

Signed-off-by: Rogerio Guerra Borin <rogerio.borin@toradex.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 07:12:34 -07:00
Virendra Thakur
09edf92b0d util-linux: Add fix to isolate test fstab entries using CUSTOM_FSTAB
During ptest execution, util-linux adds mount entries in /etc/fstab
and runs `mount -a`, which mounts all available entries from
/etc/fstab. This can cause unintended mounts that are unrelated to
the test, leading to incorrect test behavior.

To avoid this, upstream util-linux introduced a mechanism using
CUSTOM_FSTAB,which isolates test-specific fstab entries. Only entries
listed in CUSTOM_FSTAB are mounted during test execution, ensuring
tests do not interfere with or depend on the system's /etc/fstab.

This commit backports below upstream changes to use CUSTOM_FSTAB.
ed3d33faff
b1580bd760
6aa8d17b6b

(From OE-Core rev: e7420db0d77611140149ccfefefc8becfad4f34b)

Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 07:12:34 -07:00
Divyanshu Rathore
51ae2b0ed0 ffmpeg: upgrade 6.1.1 -> 6.1.2
ffmpeg_6.1.2 is the newest available stable release for 6.1.
It introduces quite a few bug and CVE fixes, which should help all.

CVEs that are fixed in the upgrade:
CVE-2024-32230
CVE-2024-35366
CVE-2024-36613
CVE-2024-36616
CVE-2024-36617
CVE-2024-36619
CVE-2024-7055

During upgrade it was noticed that the CVE scan doesn't pick up the CVEs as unpatched
(CVE-2025-0518, CVE-2025-22919, CVE-2025-22921, CVE-2025-25473,
CVE-2024-36618, CVE-2024-35369, CVE-2024-35368, CVE-2024-35367,
CVE-2024-35365, CVE-2024-28661, CVE-2023-50007, CVE-2023-49528,
CVE-2023-49501), due to improper versioning in NVD,
they are affecting 6.1.2 and hence we are leaving the patches in.

check the changelog mention below for information about fixes.
changelog: https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n6.1.2

This upgrade fixes CVE's hence remove those patches.
Refresh vulkan_av1_stable_API.patch as per new codebase.

(From OE-Core rev: 57e25585abf34677451c68d581374245e5b4b418)

Signed-off-by: Divyanshu Rathore <divyanshurathore2022@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 07:12:34 -07:00
Harish Sadineni
4d40c0f355 binutils: set CVE_STATUS for CVE-2025-1180
CVE-2025-1180 is fixed with patch from CVE-2025-1176.
More details about CVE is here: https://nvd.nist.gov/vuln/detail/CVE-2025-1179

(From OE-Core rev: 9c63f1c73426532a94f01fbbe26c9f52a3c4fdf7)

Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 07:12:34 -07:00
Ashish Sharma
474ee8d5de libsoup: patch CVE-2025-4476
Upstream-Status: Backport [e64c221f9c]

(From OE-Core rev: 91231813d04680f93a08cb29540073bb4749e22f)

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 07:12:34 -07:00
Divya Chellam
7ad1d26688 ruby: fix CVE-2025-27221
In the URI gem before 1.0.3 for Ruby, the URI handling methods
(URI.join, URI#merge, URI#+) have an inadvertent leakage of
authentication credentials because userinfo is retained even
after changing the host.

Reference:
https://security-tracker.debian.org/tracker/CVE-2025-27221

Upstream-patches:
3675494839
2789182478

(From OE-Core rev: 421d7011269f4750f5942b815d68f77fa4559d69)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 07:12:34 -07:00
Harish Sadineni
186e2b2b05 binutils: Fix CVE-2025-1179
CVE-2025-1179-pre.patch is dependency patch for CVE-2025-1179.patch

Upstream-Status: Submitted [https://sourceware.org/pipermail/binutils/2025-May/141322.html &&
https://sourceware.org/pipermail/binutils/2025-May/141321.html]
CVE: CVE-2025-1179

cherry picked from upstream commit:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=67e30b15212adc1502b898a1ca224fdf65dc110d
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1d68a49ac5d71b648304f69af978fce0f4413800

(From OE-Core rev: 8f54548f784ef60eaf7fb6b3f539d48b0f7192a3)

Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 07:12:34 -07:00
Vijay Anusuri
53ab80ae8f libsoup-2.4: Fix CVE-2025-32914
import patch from debian to fix
 CVE-2025-32914

Upstream-Status: Backport [import from debian https://salsa.debian.org/gnome-team/libsoup/-/tree/debian/bullseye/debian/patches?ref_type=heads
Upstream commit 5bfcf81575]

Reference:
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/450
https://security-tracker.debian.org/tracker/CVE-2025-32914

(From OE-Core rev: 8eba970123aca651cbce13e52d43ddaddd76a7cc)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 07:12:34 -07:00
Vijay Anusuri
a6c55c0bd7 libsoup-2.4: Fix CVE-2025-32912
Upstream-Status: Backport from
cd077513f2
& 910ebdcd3d

(From OE-Core rev: c45c8ad64aafd1f8a447f4fce6a2e7c0f22ef5f0)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 07:12:34 -07:00
Vijay Anusuri
a0e298a849 libsoup-2.4: Fix CVE-2025-32911 & CVE-2025-32913
Upstream-Status: Backport from
7b4ef0e004
& f4a761fb66

(From OE-Core rev: 7bdeb2217253a86c941edb7c4c28ba57d855c606)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 07:12:34 -07:00
Vijay Anusuri
cca757c461 libsoup-2.4: Fix CVE-2025-32910
import patch from debian to fix
 CVE-2025-32910

Upstream-Status: Backport [import from debian https://salsa.debian.org/gnome-team/libsoup/-/tree/debian/bullseye/debian/patches?ref_type=heads
Upstream commit e40df6d48a
&
405a8a3459
&
ea16eeacb0]

Reference:
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/417
https://security-tracker.debian.org/tracker/CVE-2025-32910

(From OE-Core rev: 0fc936f23e6f70021acf4e711ef49d3a5cc966fe)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 07:12:34 -07:00
Nguyen Dat Tho
e8c615a169 libatomic-ops: Update GITHUB_BASE_URI
libatomic-ops moves to new repo https://github.com/ivmai/libatomic_ops
according to topic: https://github.com/bdwgc/libatomic_ops/issues/66

(From OE-Core rev: 29d920f4c2249df7a69f00100924b4525e03c0d9)

Signed-off-by: Nguyen Dat Tho <tho3.nguyen@lge.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-27 09:38:57 -07:00
Vyacheslav Yurkov
65828b60db systemd: Password agents shouldn't be optional
If extra-utils package is not included in the image, you'll always
see a warning that password agent is missing whenever you start/stop a
service:

Failed to execute /usr/bin/systemd-tty-ask-password-agent: No such file or directory

(From OE-Core rev: 180455ee76a3819933f45ddd6ce9a5610b3ba947)

Signed-off-by: Vyacheslav Yurkov <uvv.mail@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-27 09:38:57 -07:00
Sunil Dora
163530690f binutils: Fix CVE-2025-1153
PR 32603 [https://sourceware.org/bugzilla/show_bug.cgi?id=32603]

Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=0b7f992b78fe0984fc7d84cc748d0794e4a400e3
&& https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=31e9e2e8d1090da0c1da97a70005d8841fff8ddd
&& https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=fe459e33c676883b5f28cc96c00e242973d906a9]

(From OE-Core rev: c8cb463ccee514935fe14544173c85001d66e60b)

Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-27 09:38:57 -07:00
Ashish Sharma
79babbe58a libsoup-2.4: Fix CVE-2025-46420
Upstream-Status: Backport [c9083869ec]

(From OE-Core rev: 7c963f68cb8dfdea3e1664078037303ea3f29e65)

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-27 09:38:57 -07:00
Praveen Kumar
4ff1ba9c72 glib-2.0: fix CVE-2025-4373
A flaw was found in GLib, which is vulnerable to an integer overflow
in the g_string_insert_unichar() function. When the position at which
to insert the character is large, the position will overflow, leading
to a buffer underwrite.

References:
https://nvd.nist.gov/vuln/detail/CVE-2025-4373
https://security-tracker.debian.org/tracker/CVE-2025-4373

Upstream-patches:
cc647f9e46
4d435bb480

(From OE-Core rev: 02e2f5211962394ec3d66882daab240cb465ef85)

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-27 09:38:57 -07:00
Praveen Kumar
f80b122315 connman :fix CVE-2025-32366
In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length
that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen)
and memcpy(response+offset,*end,*rdlen) without a check for whether
the sum of *end and *rdlen exceeds max. Consequently, *rdlen may be
larger than the amount of remaining packet data in the current state
of parsing. Values of stack memory locations may be sent over the
network in a response.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-32366

Upstream-patch:
https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=8d3be0285f1d4667bfe85dba555c663eb3d704b4

(From OE-Core rev: 02e046149b1cc5eca5188eec7b4e1a9970b97faf)

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-27 09:38:57 -07:00
Vijay Anusuri
ac204a6bf9 openssh: Fix for CVE-2025-32728
Upstream-Status: Backport
[fc86875e6a]

(From OE-Core rev: 6565ae2b01d6eb1e3a83ed387a5e3b765f85b8cf)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-27 09:38:57 -07:00
rajmohan r
2a501e4f1b glibc-y2038-tests: remove glibc-y2038-tests_2.39.bb recipe
This recipe takes longer time >20min when bitbake for package
write stage. When cross-verified for longer time duration, found
that do_check() stage taking 20min while other stages completes
before 6min.

This recipe gives only below two test binaries in the packages to
test (ptest: glibc-y2038-tests):
     io/ftwtest
     io/ftwtest-time64

The above test binaries are already included for testing in recipe
glibc-testsuite_2.39.bb.

It is by now well established that glibc itself works as it should,
that all affected 32 bit targets are configured to use 64 bit time_t,
and that any lingering y2038 issues are in components other than the c
library, and usually come from C programming mistakes (e.g. storing
timestamps in long). So this recipe seems to be redundant and
can be removed.

Review comments for fixing above longer time duration ended up in
removing this recipe as a proposal is below
https://lists.openembedded.org/g/openembedded-core/topic/112188476#msg214636

Removed lines having reference to glibc-y2038-tests in the files.

For master branch requested for integration and below is the link
https://lists.openembedded.org/g/openembedded-core/message/215655

(From OE-Core rev: b214cc84a922f7a3fb7ebbc501189ce25e8bd2bd)

Signed-off-by: rajmohan r <semc.2042@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:32:49 -07:00
Niko Mauno
848da2f632 cve-check.bbclass: Fix symlink handling also for text files
While backporting commit 7543e4e24a ("cve-check.bbclass: Mitigate
symlink related error") I failed to address the fact that in Scarthgap
this bbclass still generates also the text CVE file, in addition to the
JSON file.

In order to avoid the error that occurred with JSON files from
occurring now with CVE files:

  ERROR: core-image-base-1.0-r0 do_image_complete: Recipe core-image-base is trying to install files into a shared area when those files already exist. The files and the manifests listing them are:
    /home/poky/build/tmp/deploy/images/qemux86-64/.cve
      (matched in manifest-qemux86_64-core-image-minimal.image_complete)
  Please adjust the recipes so only one recipe provides a given file.

update the symlink handling for the text file variant too.

(From OE-Core rev: 81e702c85c62782dbedd5ca2a5e6569e6339dd60)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:32:49 -07:00
Alon Bar-Lev
8940ebb70a module.bbclass: add KBUILD_EXTRA_SYMBOLS to install
Symbols are used during install as well, adding KBUILD_EXTRA_SYMBOLS enables
successful installation.

    | DEBUG: Executing shell function do_install
    | NOTE: make -j 22 KERNEL_SRC=xxx/kernel-source -C xxx/drivers
    KDIR=xxx/kernel-source DEPMOD=echo
    MODLIB=xxx/image/lib/modules/6.6.75-yocto-standard-00189-g530c419bc9db
    INSTALL_FW_PATH=xxx/image/lib/firmware CC=aarch64-poky-linux-gcc
    -fuse-ld=bfd -fcanon-prefix-map  LD=aarch64-poky-linux-ld.bfd
    OBJCOPY=aarch64-poky-linux-objcopy  STRIP=aarch64-poky-linux-strip
    O=xxx/kernel-build-artifacts modules_install
    | make: Entering directory 'xxx/drivers'
    | make -C xxx/kernel-source M=xxx/drivers modules
    | make[1]: Entering directory 'xxx/kernel-source'
    | make[2]: Entering directory 'xxx/kernel-build-artifacts'
    |   MODPOST xxx/drivers/Module.symvers
    | ERROR: modpost: "xxx" [xxx/xxx.ko] undefined!

(From OE-Core rev: e8b90907f9c12808ac7137779f16edb62763e1c3)

Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0ef80eeda967a9e04ff91c3583aabbc35c9868e8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:32:49 -07:00
Yi Zhao
57560c118d iputils: Security fix for CVE-2025-47268
CVE-2025-47268
ping in iputils through 20240905 allows a denial of service (application
error or incorrect data collection) via a crafted ICMP Echo Reply
packet, because of a signed 64-bit integer overflow in timestamp
multiplication.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-47268

Patch from:
070cfacd73

(From OE-Core rev: 6b0dd564249754ab8ec20ce69b137466e051501e)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:32:48 -07:00
Haixiao Yan
fa7bc4c1a8 glibc: Add single-threaded fast path to rand()
Backport a patch [1] to improve performance of rand() and __random()[2]
by adding a single-threaded fast path.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=be0cfd848d9ad7378800d6302bc11467cf2b514f
[2] https://sourceware.org/bugzilla/show_bug.cgi?id=32777
(From OE-Core rev: 68ee8d16fa5419acba9111d3aca285be92bd93d3)

Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 09:08:58 -07:00
Vijay Anusuri
c418c7ec51 libsoup: Fix CVE-2025-32914
Upstream-Status: Backport
[5bfcf81575]

(From OE-Core rev: 6dd125b619974c8102b3050900781c22c2db4b10)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 09:08:58 -07:00
Praveen Kumar
86ea2699ac connman :fix CVE-2025-32743
In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c
can be NULL or an empty string when the TC (Truncated) bit is set in
a DNS response. This allows attackers to cause a denial of service
(application crash) or possibly execute arbitrary code, because those
lookup values lead to incorrect length calculations and incorrect
memcpy operations.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-32743

Upstream-patch:
https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d90b911f6760959bdf1393c39fe8d1118315490f

(From OE-Core rev: 9558ec2091964556b47b0909c5d243aee5bafb6f)

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 09:08:57 -07:00
Vijay Anusuri
e4df627b22 libsoup-2.4: Fix CVE-2025-32909
Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/comm
it/ba4c3a6f988beff59e45801ab36067293d24ce92

(From OE-Core rev: 90359036300731b6c26b646afbf3d66127b72fa2)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 09:08:57 -07:00
Vijay Anusuri
adc945c074 libsoup-2.4: Fix CVE-2025-32906
Upstream-Status: Backport from
1f509f31b6
& af5b9a4a39

(From OE-Core rev: 6e373ec360151b212ae6eedc4c663fb9e760ae75)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 09:08:57 -07:00
Vijay Anusuri
929989c6c3 libsoup-2.4: Fix CVE-2024-52532
Upstream-Status: Backport from 6adc0e3eb7
&
29b96fab25
& 4c9e75c667

(From OE-Core rev: dfde13ecffad3426846bd4b366d1e0cdb77b1be0)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 09:08:57 -07:00
Vijay Anusuri
e2e65311f8 libsoup-2.4: Fix CVE-2024-52531
import patch from ubuntu to fix
 CVE-2024-52531

Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsoup2.4/tree/debian/patches?h=ubuntu/jammy-security
Upstream commit
a35222dd0b
&
825fda3425]

Reference:
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/
https://ubuntu.com/security/CVE-2024-52531

(From OE-Core rev: c7ab8b45b1f533ca1b27b07c30f44b7b64a3cfde)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 09:08:57 -07:00
Vijay Anusuri
ecdb5e1785 libsoup-2.4: Fix CVE-2024-52530
Upstream-Status: Backport from
04df03bc09

(From OE-Core rev: ef1bff79d6b84eacccff2a3f8a5c3b8ed92fe0c4)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 09:08:57 -07:00
Jeroen Hofstee
488cf4238a bluez5: backport a patch to fix btmgmt -i
Without this patch btmgmt will always use hci0 in
non interactive mode.

(From OE-Core rev: 45c50169fa7e34349acf3e24fc19e573cbab4e65)

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-08 13:37:30 -07:00
Jeroen Hofstee
b19f30b8a0 bluez5: make media control a PACKAGECONFIG option
When not building with the default PACKAGECONFIG options, the build can fail
with:

undefined reference to `media_player_controller_create'
undefined reference to `media_player_set_status'

Otherwise. So disable it when not set and enable it by default.

The packageconfig option is the same as in Styhead.
ebbdb7cf5c (diff-9d9284f6f27a81c75dffffd6d601b40c8266ae12e678d0a49c46bdb8356a0e91R52)

(From OE-Core rev: 82448a6c8b720cefc200513daa41115961b43e8f)

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-08 13:37:30 -07:00
Deepesh Varatharajan
679db8c1a3 binutils: stable 2.42 branch updates
Below commit on binutils-2.42 stable branch is updated.

6558f9f5f0c s390: Add support for z17 as CPU name

Testing was done and there were no regressions found

(From OE-Core rev: 08d6ca500e6dd571f5882f82f6ad804bd2eec8c8)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-08 13:37:30 -07:00
Deepesh Varatharajan
5ede912795 glibc: stable 2.39 branch updates
3463100f2d x86: Detect Intel Diamond Rapids
e09436c2cb x86: Handle unknown Intel processor with default tuning
7620d98186 x86: Add ARL/PTL/CWF model detection support
765ff3d0d4 x86: Optimize xstate size calculation
65ae73be01 x86: Use `Avoid_Non_Temporal_Memset` to control non-temporal path
2be36448c4 x86: Tunables may incorrectly set Prefer_PMINUB_for_stringop (bug 32047)
bde201e92c x86: Disable non-temporal memset on Skylake Server
38a7632f2d x86: Fix value for `x86_memset_non_temporal_threshold` when it is undesirable
cc59fa5dbc x86: Enable non-temporal memset tunable for AMD
0da58e8be0 x86: Add seperate non-temporal tunable for memset
837a36c371 x86: Link tst-gnu2-tls2-x86-noxsave{,c,xsavec} with libpthread
87ab0c7f7f x86: Use separate variable for TLSDESC XSAVE/XSAVEC state size (bug 32810)
60cd7123a6 x86: Skip XSAVE state size reset if ISA level requires XSAVE
4cf3f9df54 x86_64: Add atanh with FMA
01ed435e2e x86_64: Add sinh with FMA
0edcc77fe7 x86_64: Add tanh with FMA
7ecf0d3bde x86-64: Exclude FMA4 IFUNC functions for -mapxf
e1fe22368e nptl: clear the whole rseq area before registration
dd8c0c3bbd math: Improve layout of exp/exp10 data
a1b09e59e2 AArch64: Use prefer_sve_ifuncs for SVE memset
d0e2133470 AArch64: Add SVE memset
0cc12d9c47 math: Improve layout of expf data
0cd10047bf AArch64: Remove zva_128 from memset
dd1e63ab58 AArch64: Optimize memset
65a96a6f2b AArch64: Improve generic strlen
4073e4ee2c AArch64: Improve codegen for SVE logs
78abd3ef6e AArch64: Improve codegen in SVE tans
a10183b633 AArch64: Improve codegen of AdvSIMD atan(2)(f)
dcd1229e5b AArch64: Improve codegen of AdvSIMD logf function family
72156cb90b AArch64: Improve codegen in AdvSIMD logs
5e354bf4e2 AArch64: Simplify rounding-multiply pattern in several AdvSIMD routines
80df456112 aarch64: Avoid redundant MOVs in AdvSIMD F32 logs
d591876303 aarch64: Fix AdvSIMD libmvec routines for big-endian
f6d48470ae assert: Add test for CVE-2025-0395

Testresults:
Before update	|After update	 |Difference
PASS: 5068	|PASS: 5072	 |PASS: +4
FAIL: 120	|FAIL: 120	 |FAIL: 0
XPASS: 4	|XPASS: 4	 |XPASS: 0
XFAIL: 16	|XFAIL: 16	 |XFAIL: 0
UNSUPPORTED: 157|UNSUPPORTED: 157|UNSUPPORTED: 0

(From OE-Core rev: f14c2e6a6ba72673a0e30cde48ec1d5573be3e01)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-08 13:37:30 -07:00
Peter Marko
5d362ec2d7 sqlite3: mark CVE-2025-29087 as patched
Description of CVE-2025-29087 and CVE-2025-3277 are very similar.
There is no lonk from NVD, but [1] and [2] from Debian mark these two
CVEs as duplicates with the same link for patch.

[1] https://security-tracker.debian.org/tracker/CVE-2025-29087
[2] https://security-tracker.debian.org/tracker/CVE-2025-3277

(From OE-Core rev: 3f951941c758b6982a3cd30d085460756b7fefd9)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-08 13:37:29 -07:00
Soumya Sambu
38a5779745 elfutils: Fix CVE-2025-1371
A vulnerability has been found in GNU elfutils 0.192 and classified as problematic.
This vulnerability affects the function handle_dynamic_symtab of the file readelf.c
of the component eu-read. The manipulation leads to null pointer dereference.
Attacking locally is a requirement. The exploit has been disclosed to the public and
may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It
is recommended to apply a patch to fix this issue.

References:
https://nvd.nist.gov/vuln/detail/CVE-2025-1371
https://ubuntu.com/security/CVE-2025-1371

Upstream patch:
https://sourceware.org/cgit/elfutils/commit/?id=b38e562a4c907e08171c76b8b2def8464d5a104a

(From OE-Core rev: 11c44bde4f3d9e63506ece2f9b27114914aacc4b)

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-08 13:37:29 -07:00
Ashish Sharma
2e1dd3c3d6 libsoup: patch CVE-2025-46420
Upstream-Status: Backport [c9083869ec]

(From OE-Core rev: 0e4a77c928e2eb0e8b012f2bba13b2ef3929cb34)

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-08 13:37:29 -07:00
Peter Marko
9c63e0c964 Revert "cve-update-nvd2-native: Tweak to work better with NFS DL_DIR"
This reverts commit 7adaec468d.

It does not seem to fix the issue it was supposed to fix.
Additionally it breaks code which decides in full/partial update,
because it manipulates timestamp that code is relying on.

(From OE-Core rev: 00dd4901e364d16d96cfab864823a9cfdd336eeb)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ebc65fdddd7ce51f0f1008baa30d0ae7918ae0bb)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-02 08:20:12 -07:00
Changqing Li
18206fc2db buildtools-tarball: Make buildtools respects host CA certificates
To adapt user network enviroment, buildtools should first try to use
the user configured envs like SSL_CERT_FILE/CURL_CA_BUNDLE/..., if these
envs is not set, then use the auto-detected ca file and ca path, and
finally use the CA certificates in buildtools.

nativesdk-openssl set OPENSSLDIR as "/not/builtin", need set SSL_CERT_FILE/SSL_CERT_DIR to work

nativesdk-curl don't set default ca file, need
SSL_CERT_FILE/SSL_CERT_DIR or CURL_CA_BUNDLE/CURL_CA_PATH to work

nativesdk-git actually use libcurl, and GIT_SSL_CAPATH/GIT_SSL_CAINFO
also works

nativesdk-python3-requests will use cacert.pem under python module certifi by
default, need to set REQUESTS_CA_BUNDLE

(From OE-Core rev: 0653b96bac6d0800dc5154557706a323418808be)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-02 08:20:12 -07:00
Changqing Li
397d432a62 buildtools-tarball: add envvars into BB_ENV_PASSTHROUGH_ADDITIONS
Here is one testcase:
For recipe tensorflow-lite-host-tools_2.18.0.bb, refer [1],
do_configure[network] = "1"
and it will git clone some repos in CMakeLists.txt

When buildtools is used and nativesdk-git is installed into sdk,
do_configure failed with error:
[1/9] Performing download step (git clone) for 'protobuf-populate'
Cloning into 'protobuf'...
fatal: unable to access 'https://github.com/protocolbuffers/protobuf/': error setting certificate file: /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-wrlinuxsdk-linux/etc/ssl/certs/ca-certificates.crt

Fix by adding GIT_SSL_CAINFO in BB_ENV_PASSTHROUGH_ADDITIONS, so that
user can export GIT_SSL_CAINFO=${GIT_SSL_CAINFO} in their
do_configure:prepend() to fix above do_configure failure

CURL_CA_BUNDLE and REQUESTS_CA_BUNDLE is similar envvars, so all add
into BB_ENV_PASSTHROUGH_ADDITIONS

[1] https://github.com/nxp-imx/meta-imx/blob/styhead-6.12.3-1.0.0/meta-imx-ml/recipes-libraries/tensorflow-lite/tensorflow-lite-host-tools_2.18.0.bb

(From OE-Core rev: 27f018d8e8ace97d0b1cdfb8782a2a7a0a319816)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-02 08:20:12 -07:00
Changqing Li
2e0b9e9a86 buildtools-tarball: move setting of envvars to respective envfile
* make git,curl,python3-requests align with openssl, move the setting of
  envvars into respective envfile
* for environment.d-openssl.sh, also check if ca-certificates.crt exist
  before export envvars

(From OE-Core rev: 5f4fd544d3df7365224599c9efdce4e545f51d5e)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-02 08:20:12 -07:00
Changqing Li
f587cfcb8a initscripts: add function log_success_msg/log_failure_msg/log_warning_msg
* add function log_success_msg/log_failure_msg/log_warning_msg, some
packages still use these functions, like mariadb, refer [1], without
these function, with sysV init manager, mariadb will report error:

root@qemux86-64:~# /etc/init.d/mysqld status
/etc/init.d/mysqld: line 383: log_success_msg: command not found

* remove RCONFLICTS with lsbinitscripts, LSB support already remove in
  [2]

[1] https://github.com/MariaDB/server/blob/main/support-files/mysql.server.sh#L104
[2] https://git.openembedded.org/openembedded-core/commit/?id=fb064356af615d67d85b65942103bf943d84d290
[3] https://refspecs.linuxbase.org/LSB_4.0.0/LSB-Core-generic/LSB-Core-generic/iniscrptfunc.html

(From OE-Core rev: 90cf409ba74c4bb398199667ea2819759a720373)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-02 08:20:12 -07:00
Priyal Doshi
1feef3d75d tzdata/tzcode-native: upgrade 2025a -> 2025b
(From OE-Core rev: 0d93972dc2d67853b7ddb0d9e55522930fb51df2)

Signed-off-by: Priyal Doshi <pdoshi@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b1ff8b45da27b533477cf6d9ace7a47f7f3a28b1)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-02 08:20:12 -07:00
Archana Polampalli
c8b84eb224 perl: upgrade 5.38.2 -> 5.38.4
update include fix for CVE-2024-56406

https://perldoc.perl.org/5.38.4/perl5384delta

(From OE-Core rev: a9edffbd3c129966d4028505940ae6286273f399)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-02 08:20:12 -07:00