Commit Graph

67656 Commits

Author SHA1 Message Date
Vivek Kumbhar
ab548842ef qemu: fix CVE-2023-3354 VNC: improper I/O watch removal in TLS handshake can lead to remote unauthenticated denial of service
(From OE-Core rev: 42859fe600e5dddba3c51fa8d1e680721b73e5dc)

Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-19 05:56:58 -10:00
Yogita Urade
4869a1f60e qemu: fix CVE-2020-14394
QEMU: infinite loop in xhci_ring_chain_length() in hw/usb/hcd-xhci.c

Reference:
https://gitlab.com/qemu-project/qemu/-/issues/646

(From OE-Core rev: 057f4f77ac2e83f99c916dceb4cbbcc8de448ad4)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-19 05:56:58 -10:00
Narpat Mali
fbe56e677b python3-certifi: fix CVE-2023-37920
Certifi is a curated collection of Root Certificates for validating
the trustworthiness of SSL certificates while verifying the identity
of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra"
root certificates. e-Tugra's root certificates were subject to an
investigation prompted by reporting of security issues in their systems.
Certifi 2023.07.22 removes root certificates from "e-Tugra" from the
root store.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-37920
https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7

(From OE-Core rev: 98abbe3394638c6ce795b34247a9e49120e4ffba)

Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-19 05:56:58 -10:00
Steve Sakoman
d6b8790370 build-appliance-image: Update to kirkstone head revision
(From OE-Core rev: e1a604db8d2cf8782038b4016cc2e2052467333b)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
yocto-4.0.12 kirkstone-4.0.12
2023-08-07 04:44:16 -10:00
Steve Sakoman
326921a89e poky.conf: bump version for 4.0.12
(From meta-yocto rev: 464204a5e52a3f3ae5d7ec9e36c143ca06fed3eb)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07 04:40:44 -10:00
Steve Sakoman
ab9b43f60b gcc: fix runpath errors in cc1 binary
The runpath in the cc1 binary is:

Library runpath: [$ORIGIN/../../../recipe-sysroot-native/usr/lib:$ORIGIN/../../../recipe-sysroot-native/lib]

This does not match the actual location of the libraries, which would require:

Library runpath: [$ORIGIN/../../recipe-sysroot-native/usr/lib:$ORIGIN/../../recipe-sysroot-native/lib]

Prior to gcc 9.1 the recipe set B explicity with:

B = "${WORKDIR}/gcc-${PV}/build.${HOST_SYS}.${TARGET_SYS}"

and this build directory structure matches the runpath in cc1, so there is no issue.

This line was commented out in versions 9.1 through 11.3.  The upgrade to 12.1 once
again uncommented this line.

As a result the runpath is incorrect in version 9.1 through 11.3 and cc1 defaults
to using host libraries.

This patch restores setting B as done in master and versions prior to 9.1

(From OE-Core rev: b6f4b3d43a399c2b446754de56ebea35657e13de)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07 04:40:44 -10:00
Peter Marko
7e2d3b8346 openssl: Upgrade 3.0.9 -> 3.0.10
https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-309-and-openssl-3010-1-aug-2023
Major changes between OpenSSL 3.0.9 and OpenSSL 3.0.10 [1 Aug 2023]
* Fix excessive time spent checking DH q parameter value (CVE-2023-3817)
* Fix DH_check() excessive time with over sized modulus (CVE-2023-3446)
* Do not ignore empty associated data entries with AES-SIV (CVE-2023-2975)

(From OE-Core rev: 94ce10791ce10aa30d3a3bdef53f9b2f3c1b331a)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07 04:40:44 -10:00
Sundeep KOKKONDA
e8c1d3e07e gcc : upgrade to v11.4
gcc stable version upgraded from v11.3 to v11.4

For changes in v11.4 see - https://gcc.gnu.org/gcc-11/changes.html

Below is the bug fix list for v11.4
https://gcc.gnu.org/bugzilla/buglist.cgi?bug_status=RESOLVED&order=short_desc%2Cbug_status%2Cpriority%2Cassigned_to%2Cbug_id&query_format=advanced&resolution=FIXED&target_milestone=11.4

There are a total 115 bugs are fixed in this release, below is the list of bugs fixed excluding the regression fixes.

ID	Product	Comp	    Resolution	Summary▲
108199	gcc	tree-opt	FIXE	Bitfields, unions and SRA and storage_order_attribute
107801	gcc	libstdc+	FIXE	Building cross compiler for H8 family fails in libstdc++ (c++17/memory_resource.cc)
108265	gcc	libstdc+	FIXE	chrono::hh_mm_ss can't be constructed from unsigned durations
104443	gcc	libstdc+	FIXE	common_iterator<I, S>::operator-> is not correctly implemented
98056	gcc	c++		FIXE	coroutines: ICE tree check: expected record_type or union_type or qual_union_type, have array_type since r11-2183-g0f66b8486cea8668
107061	gcc	target		FIXE	ENCODEKEY128 clobbers xmm4-xmm6
105433	gcc	testsuit	FIXE	FAIL: gcc.target/i386/iamcu/test_3_element_struct_and_unions.c
105095	gcc	testsuit	FIXE	gcc.dg/vect/complex/fast-math-complex-* tests are not executed
100474	gcc	c++		FIXE	ICE: in diagnose_trait_expr, at cp/constraint.cc:3706
105854	gcc	target		FIXE	ICE: in extract_constrain_insn, at recog.cc:2692 (insn does not satisfy its constraints: sse2_lshrv1ti3)
104462	gcc	target		FIXE	ICE: in extract_constrain_insn_cached, at recog.cc:2682 with -mavx512fp16 -mno-xsave
106045	gcc	libgomp		FIXE	Incorrect testcase in libgomp.c/target-31.c at -O0
56189	gcc	c++		FIXE	Infinite recursion with noexcept when instantiating function template
100295	gcc	c++		FIXE	Internal compiler error from generic lambda capturing parameter pack and expanding it in if constexpr
100613	gcc	jit		FIXE	libgccjit should produce dylib on macOS
104875	gcc	libstdc+	FIXE	libstdc++-v3/src/c++11/codecvt.cc:312:24: warning: left shift count >= width of type
107471	gcc	libstdc+	FIXE	mismatching constraints in common_iterator
105284	gcc	libstdc+	FIXE	missing syncstream and spanstream forward decl. in <iosfwd>
98821	gcc	c++		FIXE	modules : c++tools configures with CC but code fragments assume CXX.
109846	gcc	fortran		FIXE	Pointer-valued function reference rejected as actual argument
101324	gcc	target		FIXE	powerpc64le: hashst appears before mflr at -O1 or higher
102479	gcc	c++		FIXE	segfault when deducing class template arguments for tuple with libc++-14
105128	gcc	libstdc+	FIXE	source_location compile error for latest clang 15
106183	gcc	libstdc+	FIXE	std::atomic::wait might fail to be unblocked by notify_one/all on platforms without platform_wait()
102994	gcc	libstdc+	FIXE	std::atomic<ptr>::wait is not marked const
105324	gcc	libstdc+	FIXE	std::from_chars() assertion at floating_from_chars.cc:78 when parsing 1.11111111....
105375	gcc	libstdc+	FIXE	std::packaged_task has no deduction guide.
104602	gcc	libstdc+	FIXE	std::source_location::current uses cast from void*
106808	gcc	libstdc+	FIXE	std::string_view range concept requirement causes compile error with Boost.Filesystem
105725	gcc	c++		FIXE	[ICE] segfault with `-Wmismatched-tags`
105920	gcc	target		FIXE	__builtin_cpu_supports ("f16c") should check AVX

(From OE-Core rev: 4fd7e5951c42336729f12cde71450ec298f2078b)

Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07 04:40:44 -10:00
Yuta Hayama
cd1d34d510 cve-update-nvd2-native: always pass str for json.loads()
Currently json.loads() accepts one of the types str, bytes, or bytearray
as an argument, but bytes and bytearrays have only been allowed since
python 3.6. The version of Python3 provided by default on Ubuntu 16.04
and Debian 9.x is 3.5, so make raw_data type str to work correctly on
these build hosts.

(From OE-Core rev: e67d659847afe648de1b1eca2d19c4f6375dd12c)

Signed-off-by: Yuta Hayama <hayama@lineo.co.jp>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07 04:40:44 -10:00
Sakib Sajal
1aae734721 go: fix CVE-2023-24531
Backport required patches from go1.21 to fix CVE-2023-24531.

(From OE-Core rev: 6d892c52bd5806507a05e8b6f749c54bbd9e9da6)

Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07 04:40:44 -10:00
Sakib Sajal
1ba43f2c88 go: fix CVE-2023-24536
Backport required patches to fix CVE-2023-24536.

(From OE-Core rev: a774c895f4a425979cef8e05e8dd17c2dcb67654)

Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07 04:40:44 -10:00
Archana Polampalli
ae7992e3b7 qemu: fix CVE-2023-2861
9pfs: prevent opening special files

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-2861

Upstream patches:
10fad73a2b

(From OE-Core rev: 9bd4ddeb4b5efc65b0514d50d6991211271924c1)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07 04:40:43 -10:00
Archana Polampalli
76f6267368 qemu: fix CVE-2023-3255
VNC: infinite loop in inflate_buffer() leads to denial of service

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-3255

Upstream patches:
d921fea338

(From OE-Core rev: 52711b1392ed0c5cbe4ddf70a94b21be2f4e6e58)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07 04:40:43 -10:00
Archana Polampalli
2587c36e87 qemu: fix CVE-2023-3301
qemu: hotplug/hotunplug mlx vdpa device to the occupied addr port,
then qemu core dump occurs after shutdown guest

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-3301

Upstream patches:
a0d7215e33

(From OE-Core rev: f549ff6db018f66a80fc65987675e8bb6afcd002)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07 04:40:43 -10:00
Peter Marko
cd329fc984 libarchive: ignore CVE-2023-30571
This issue was reported and discusses under [1] which is linked in NVD CVE report.
It was already documented that some parts or libarchive are thread safe and some not.
[2] was now merged to document that also reported function is not thread safe.
So this CVE *now* reports thread race condition for non-thread-safe function.
And as such the CVE report is now invalid.

The issue is still not closed for 2 reasons:
* better document what is and what is not thread safe
* request to public if someone could make these functions thread safe
This should however not invalidate above statment about ignoring this CVE.

[1] https://github.com/libarchive/libarchive/issues/1876
[2] https://github.com/libarchive/libarchive/pull/1875

(From OE-Core rev: d5e7971e12cdc8748be91b4e6408b42fa86b2f15)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07 04:40:43 -10:00
Peter Marko
9ceede321a libpcre2: patch CVE-2022-41409
Backport commit mentioned in NVD DB links.
94e1c00176

(From OE-Core rev: 410cdbc70cfba709ec5bef508e772f52514ba28a)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-07 04:40:43 -10:00
Alexander Kanavin
7fdfb828fd bitbake: bitbake-layers: initialize tinfoil before registering command line arguments
Plugins may want to use it (e.g. the layers-setup plugin that would
want to discover writer sub-plugins with it), and so it makes sense
to make tinfoil available a bit eariler.

(Bitbake rev: 41b6684489d0261753344956042be2cc4adb0159)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2f6c7523a622f59ddf84a1a196927492bc5fa7a2)
Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-04 04:43:41 -10:00
Michael Opdenacker
fa7dd8ac75 ref-manual: document image-specific variant of INCOMPATIBLE_LICENSE
This has been around without being properly documented since 2019 (!!!),
and is nowadays the preferred method for enforcing license restrictions,
especially since meta-gplv2 is officially obsolete.

(From yocto-docs rev: 4dfef81ac6164764c6541e39a9fef81d49227096)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Benjamin Bouvier
96404a7c4c util-linux: add alternative links for ipcs,ipcrm
When enabling ipcs and ipcrm configuration into busybox, both tools are
built and then deployed during do_rootfs. These operation lead to below
issue (similar behavior happens for ipcs):

do_rootfs: Postinstall scriptlets of ['busybox'] have failed. If the intention is to defer them to first boot,
then please place them into pkg_postinst_ontarget:${PN} ().

update-alternatives: Error: not linking .../build/tmp/work/board-poky-linux/board-image/1.0-r0/rootfs/usr/bin/ipcrm
to /bin/busybox since .../build/tmp/work/board-poky-linux/board-image/1.0-r0/rootfs/usr/bin/ipcrm exists and is not a link

Binaries enter in conflict with same named util-linux utilities during
do_rootfs step.
Adding ALTERNATIVE_LINK_NAME for both tools fix the issue.

(From OE-Core rev: dc2e760591c5ed3c999222f235484829426c71a7)

Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e4d60408b869c9cc2ccff794d4e271d993ec8a97)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Jose Quaresma
f285505e20 openssl: use a glob on the PERLEXTERNAL to track updates on the path
The Text-Template was updated from 1.46 to 1.56

| ERROR: openssl-native-3.1.1-r0 do_configure: PERLEXTERNAL '/build/tmp/work/x86_64-linux/openssl-native/3.1.1-r0/openssl-3.1.1/external/perl/Text-Template-1.46/lib' not found!

(From OE-Core rev: b39e394771e4fa4c9250e11fafe5ef2157089422)

Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b9a7739b01e31d0cc8358d99255e3e1b02a0a1a8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Jose Quaresma
03ae07181a openssl: add PERLEXTERNAL path to test its existence
When upstream change is better to fail or removing the PERL5LIB
if they are not need anymore.

(From OE-Core rev: 14905c6bfdaba3e2e31eaee6c02e20bf7b6669a7)

Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 337ac1159644678508990927923ef8af30f34cd7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Yoann Congal
d97c5782be oeqa/selftest/devtool: add unit test for "devtool add -b"
Fix [Yocto #15085]

Co-authored-by: Fawzi KHABER <fawzi.khaber@smile.fr>
(From OE-Core rev: ea1592b49c6b45495fe9243339fc4dc9cea9ef12)

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d5eedf8ca689ccb433c2f5d0b324378f966dd627)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Ross Burton
a22efd0373 oeqa/runtime/cases/rpm: fix wait_for_no_process_for_user failure case
str.format() doesn't use % notation, update the formatting to work.

assertTrue() is a member of self not a global, and assertTrue(True) will
always pass. Change this to just self.fail() as this is the failure case.

(From OE-Core rev: 05c8af81438d43fd83495cb165c75f43778fea41)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 017f3a0b1265c1a3b69c20bdb56bbf446111977e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Khem Raj
56f316630a meson.bbclass: Point to llvm-config from native sysroot
Default search in meson would grok /usr/bin for llvm-config and if found
will use it, which might add wrong paths into cflags/ldflags, since we
depend on llvm-native when building gallium support ( thats when
llvm-config is effective), its better to point llvm-config into native
sysroot so it can add correct paths into compiler/linker cmdline

(From OE-Core rev: 8e6b616066ba0f7f452f929dc7c412e620da9101)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cc73360b9728812ed6123e30559b77d8e89cc21c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Ross Burton
4b5f2ecf67 python3: fix missing comma in get_module_deps3.py
Wes Tarro <wes.tarro@azuresummit.com> noticed a missing comma in a
preplace() call, add it.

That said, calling replace() with one argument results in a TypeError,
so this is obviously dead code.

(From OE-Core rev: 3a79a210665efae1af6d68e9e923a739c82d800e)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9b2e2c8d809e7ca34451ec9702b029a00dfb410b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Ovidiu Panait
c094bb4a46 mdadm: skip running known broken ptests
Upstream marked some testcases as "KNOWN BROKEN" and introduced the
"--skip-broken" flag to ignore them when running the testsuite (commits [1]
and [2]). Backport these two commits to get rid of the last remaining ptest
failures.

Also, add the "--skip-broken" option to the run-ptest script.

[1] https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=28520bf114b3
[2] https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/commit/?id=daa86d663476

(From OE-Core rev: 62daa4ca064da1c014b9c21798bc55ff3e7656e6)

Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 62148b978b26b5fcd1a2fa3a0ff82ef814f4e7ec)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Ovidiu Panait
e715193ee6 mdadm: fix segfaults when running ptests
Currently, some segfaults are reported when running ptest:
mdadm[12333]: segfault at 0 ip 00007fe855924060 sp 00007ffc4d6caf88 error 4 in libc.so.6[7f)
Code: d2 0f 84 b7 0f 00 00 48 83 fa 01 0f 84 b9 0f 00 00 49 89 d3 89 f1 89 f8 48 83 e1 3f 4f

Backport the following upstream commits to fix them:
679bd9508a30 ("DDF: Cleanup validate_geometry_ddf_container()")
2b93288a5650 ("DDF: Fix NULL pointer dereference in validate_geometry_ddf()")
548e9b916f86 ("mdadm/Grow: Fix use after close bug by closing after fork")
9ae62977b51d ("monitor: Avoid segfault when calling NULL get_bad_blocks")

The fixes are part of the "Bug fixes and testing improvments" patchset [1].

[1] https://www.spinics.net/lists/raid/msg70621.html

(From OE-Core rev: 4ea6acbf25ad1b3e910f01d136b53c6353daf0c5)

Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9585009e3e505b361cd32b14e0e85e77e7822878)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Ovidiu Panait
1d0454b413 mdadm: fix 07revert-inplace ptest
Testcase 07revert-inplace fails if strace is not installed:
...
strace -o /tmp/str ./mdadm -A /dev/md0 --update=revert-reshape /dev/<...>
tests/07revert-inplace: line 40: strace: command not found

Add strace to mdadm-ptest RDEPENDS to make sure the testcase passes even with
a core-image-minimal build.

(From OE-Core rev: 1df8d9d45bb4ff01e30d9ec9ffd0fb822d5f91e9)

Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 7d9386663ac52ab69812867a0823c6055aedbc18)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Ovidiu Panait
06416b34a0 mdadm: fix util-linux ptest dependency
Trying to run mdadm-ptest in a core-image-minimal build will result in:
root@qemux86-64:~# ptest-runner mdadm
START: ptest-runner
BEGIN: /usr/lib/mdadm/ptest
which: no lsblk in (/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin)
lsblk command not found!
DURATION: 0
END: /usr/lib/mdadm/ptest
2023-06-28T10:14
STOP: ptest-runner
TOTAL: 1 FAIL: 0

Remove util-linux from RRECOMMENDS and only add util-linux-lsblk and
util-linux-losetup to RDEPENDS.

(From OE-Core rev: 898b9add68d9c30c7c90285e659b128289313668)

Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3004f7589974c135cc82630d980ea281b97ecd83)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Quentin Schulz
b1e2d14d88 uboot-extlinux-config.bbclass: fix old override syntax in comment
The comment specifies how to use the variables but uses the older and
now unsupported override syntax. Let's update to match the newer syntax.

Cc: Quentin Schulz <foss+yocto@0leil.net>
(From OE-Core rev: 0a381eea4d50ff1c6e7c7d0d4df62eb581454b48)

(From OE-Core rev: 0e9a70ee3c8f78db746d3cb627c6b212e1b4e4e4)

Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bb64f3fed29b9532e6ddc9a2ba0283d373622d87)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Yuta Hayama
162ca7a55c systemd-systemctl: fix errors in instance name expansion
If the instance name indicated by %i begins with a number, the meaning of the
replacement string "\\1{}".format(instance) is ambiguous.

To indicate group number 1 regardless of the instance name, use "\g<1>".

(From OE-Core rev: 392f60b0aa775ce95c3494ae87551e7954c9925b)

Signed-off-by: Yuta Hayama <hayama@lineo.co.jp>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d18b939fb08b37380ce95934da38e6522392621c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Yoann Congal
23af44f254 recipetool: Fix inherit in created -native* recipes
native and nativesdk classes are special and must be inherited last :
put them at the end of the gathered classes to inherit.

(From OE-Core rev: 2c92780236b25205af0dcf75de2d2ede14132152)

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a6614fd800cbe791264aeb102d379ba79bd145c2)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Andrej Valek
0391bb6f9e kernel: add missing path to search for debug files
Since explicit debug package creation via ${KERNEL_PACKAGE_NAME}-dbg has
been added to kernel, it has to cover all PACKAGE_DEBUG_SPLIT_STYLE
options. For ex. when the variable "debug-file-directory" package search
path has to be set explicitly, otherwise it will not find any files.

(From OE-Core rev: 9adbda8450c57f49edf85e3b3433304e8ac8267e)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9c39da147683dcaaa244b3ddc4531c4408ad5c9e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Martin Jansa
2e4bdbc5c4 libxcrypt: fix build with perl-5.38 and use master branch
* fixes do_configure failure:
  checking whether all ucontext.h functions are available... yes
  when is deprecated at libxcrypt/4.4.30-r0/git/build-aux/scripts/BuildCommon.pm line 522.
  Compilation failed in require at ../git/build-aux/scripts/expand-selected-hashes line 28.
  BEGIN failed--compilation aborted at ../git/build-aux/scripts/expand-selected-hashes line 28.
  configure: error: bad value 'all' for --enable-hashes
  NOTE: The following config.log files may provide further information.

* with this patch backported it works OK:
  libxcrypt/4.4.30-r0/git $ perl build-aux/scripts/expand-selected-hashes
  usage: expand-selected-hashes hashes.conf names,of,selected,hashes

* similarly do_compile failure:
  ../git/build-aux/scripts/move-if-change crypt-hashes.h.T crypt-hashes.h
  ../git/build-aux/scripts/move-if-change crypt-symbol-vers.h.T crypt-symbol-vers.h
  given is deprecated at ../git/build-aux/scripts/gen-crypt-h line 41.
  Makefile:3818: Makefile.deps: No such file or directory
  make: *** [Makefile:3715: crypt.h.stamp] Error 255

* also use master branch instead of develop, the SRCREV exists in both
  but stable metadata branches should track stable component branches

  libxcrypt/4.4.30-r0/git $ git branch -a --contains d7fe1ac04c326dba7e0440868889d1dccb41a175 | tee
  * develop
    remotes/origin/HEAD -> origin/develop
    remotes/origin/develop
    remotes/origin/master

  and oe-core master also uses master SRCBRANCH since:
  https://git.openembedded.org/openembedded-core/commit/?id=d18e89bd2b46c6e266cc39dbe9fdb6c032f5f1fe

(From OE-Core rev: 54996f24243a10252d3aa70effc9c13db1d507f8)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Wang Mingyu
f2394b13c1 lttng-ust: upgrade 2.13.5 -> 2.13.6
Changelog:
===========
* Fix: segmentation fault on filter interpretation in "switch" mode
* Fix: `ip` context is expressed as a base-10 field
* Fix: c99: use __asm__ __volatile__
* Fix: c99: static assert: clang build fails due to multiple typedef
* Fix: Reevaluate LTTNG_UST_TRACEPOINT_DEFINE each time tracepoint.h is included
* Fix: trace events in C++ constructors/destructors
* Fix: trace events in C constructors/destructors
* Fix: use unaligned pointer accesses for lttng_inline_memcpy

(From OE-Core rev: 1361c8f4be21e41db74623dcacc92d8f02e6a2ee)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 656470b4b0db579308d218d1ece77bdacd168d14)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Wang Mingyu
f51ce76cd8 libksba: upgrade 1.6.3 -> 1.6.4
Changelog:
Correctly detect CMS write errors.

(From OE-Core rev: 4bc2f5c3a46b76d152fda326f7c8227fe938b97e)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0296cf63007542c1cb209a4288be1c82aa2ba843)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Wang Mingyu
f01294ea24 libassuan: upgrade 2.5.5 -> 2.5.6
Changelog:
===========
 * Fix logging of confidential data.  [rA0fc31770fa]
 * Fix memory wiping.  [T5977]
 * Fix macOS build problem.  [T5440,T5610]
 * Upgrade autoconf stuff.

(From OE-Core rev: a905094c4e7ff3475de657adcf7a0afcc132191a)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 90126be6dc32170c08eb90223b6a6cc06c2133ce)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Alexander Kanavin
9cc2735749 diffutils: update 3.9 -> 3.10
* Noteworthy changes in release 3.10 (2023-05-21) [stable]

** Bug fixes

  cmp/diff can again work with file dates past Y2K38
  [bug introduced in 3.9]

  diff -D no longer fails to output #ifndef lines.
  [bug#61193 introduced in 3.9]

Remove the comment addition from the patch body, as it
increases likelyhood of rebase conflicts, and repeats what
the commit says.

(From OE-Core rev: ab9ae300ce3895cdf64d207b5dc281b65c984211)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 925155acc6922f7e9df2afa45e79ad1b2c57ba24)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
(cherry picked from commit 21e40166870fadee986fb36be80019d3bcdb69e5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Tim Orling
7658d8f2c9 python3: upgrade 3.10.9 -> 3.10.12
Security and bugfix updates.

* Drop cve-2023-24329.patch as it is merged in 3.10.12

CVE: CVE-2023-24329

Includes openssl 1.1.1u which addresses:
CVE: CVE-2023-0286
CVE: CVE-2022-4304
CVE: CVE-2022-4203

https://docs.python.org/release/3.10.12/whatsnew/changelog.html#python-3-10-12-final
https://docs.python.org/release/3.10.12/whatsnew/changelog.html#python-3-10-11-final
https://docs.python.org/release/3.10.12/whatsnew/changelog.html#python-3-10-10-final

License-Update: Update Copyright years to include 2023

(From OE-Core rev: 4df594dbc1b391afbe703f663fb2d5c9e9d35078)

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Yogita Urade
f4c5d9a3a6 dmidecode: fix CVE-2023-30630
Dmidecode before 3.5 allows -dump-bin to overwrite a local file.
This has security relevance because, for example, execution of
Dmidecode via Sudo is plausible.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-30630
https://lists.nongnu.org/archive/html/dmidecode-devel/2023-04/msg00016.html
https://lists.nongnu.org/archive/html/dmidecode-devel/2023-04/msg00017.html

Backport: fixes fuzz in the CVE-2023-30630_2.patch in kirkstone

(From OE-Core rev: 4f83427a0a01e8285c9eb42d2a635d1ff7b23779)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
(cherry picked from commit f92e59a0894145a828dc9ac74bf8c7a9355e0587)
Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Archana Polampalli
e01d123ba1 openssh: fix CVE-2023-38408
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an
insufficiently trustworthy search path, leading to remote code
execution if an agent is forwarded to an attacker-controlled system.
(Code in /usr/lib is not necessarily safe for loading into ssh-agent.)
NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-38408

Upstream patches:
892506b136
1f2731f5d7
29ef8a0486
099cdf59ce

(From OE-Core rev: 3c01159ab6a843fc922cf779b022c965d4ecd453)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Hitendra Prajapati
d198c0d738 libtiff: fix CVE-2023-26965 heap-based use after free
Upstream-Status: Backport from ec8ef90c1f

(From OE-Core rev: 9b9f88d8828ee822635ed645cc192829fecec39e)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Hitendra Prajapati
3c2e546a1a tiff: fix multiple CVEs
Backport fixes for:
* CVE-2023-25433 - Upstream-Status: Backport from 9c22495e5e && 688012dca2
* CVE-2023-25434 & CVE-2023-25435 - Upstream-Status: Backport from 69818e2f2d

(From OE-Core rev: 01b9f7f7bb3eaecd6aa757fa090fcc4424788ce1)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:13 -10:00
Vivek Kumbhar
4596433a54 go: fix CVE-2023-29406 net/http insufficient sanitization of Host header
(From OE-Core rev: 5dc74138649ab7a2c0158a43225dc7a8fd732355)

Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:12 -10:00
Hitendra Prajapati
51f8011956 tiff: fix multiple CVEs
Bug-Debian: https://bugs.debian.org/1031632
Origin: afaabc3e50

import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u7.debian.tar.xz

fix multiple CVEs:

CVE-2023-0795
CVE-2023-0796
CVE-2023-0797
CVE-2023-0798
CVE-2023-0799

(From OE-Core rev: 1a4e54d5b7b4d26b9fcdc2be1b115600ca71c9ea)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:12 -10:00
Peter Marko
ffce38bad0 python3: ignore CVE-2023-36632
This CVE shouldn't have been filed as the "exploit" is described in the
documentation as how the library behaves.

(From OE-Core rev: 9665121fd9daf1174ec4045071b900de9195b11e)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c652f094d86c4efb7ff99accba63b8169493ab18)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:12 -10:00
Peter Marko
f24230b04b libjpeg-turbo: patch CVE-2023-2804
Relevant links:
* linked fronm NVD:
  * https://github.com/libjpeg-turbo/libjpeg-turbo/issues/668#issuecomment-1492586118
* follow-up analysis:
  * https://github.com/libjpeg-turbo/libjpeg-turbo/issues/668#issuecomment-1496473989
  * picked commits fix all issues mentioned in this analysis

(From OE-Core rev: ca8ede6d29c04159e85c2bdd2b635c58ec6a1484)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-02 04:47:12 -10:00
Xiangyu Chen
6539812e23 package.bbclass: moving field data process before variable process in process_pkgconfig
Currently, the latest version abseil-cpp contains a new library named "absl_log_internal_format", it's
basic package config(.pc file) as below:

prefix=/usr
exec_prefix=${prefix}

......

Requires: absl_config = 20230125, absl_core_headers = 20230125, absl_log_internal_append_truncated = 20230125,
absl_log_internal_config = 20230125, absl_log_internal_globals = 20230125, absl_log_severity = 20230125,
absl_strings = 20230125, absl_str_format = 20230125, absl_time = 20230125, absl_span = 20230125
......

Normally, the process_pkgconfig() would process variable data before field data in a .pc file, but in the
absl_log_internal_format, the field data in "Requires" section contains "xxxx = xxxx" format, the
process_pkgconfig() treats them as normal variable and using the setVar() in bitbake's data_smart.py
try to process. The absl_log_internal_format field data contains "_append_", this hit the setVar() checking
and finally bitbake stop building and reporting an error as below:

"Variable xxx contains an operation using the old override syntax. Please convert this layer/metadata before attempting to use with a newer bitbake."

This patch move the field data process before variable process to avoid the process_pkgconfig() treat the field
data as variable.

(From OE-Core rev: e7d3e02a624f7ce23d012bb11ad1df2049066b37)

Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
(cherry picked from commit a73e269d3e591a10bb397b94b82e3fb960112d33)
Signed-off-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26 05:20:36 -10:00
Richard Purdie
55e4c90abf gcc-testsuite: Fix ppc cpu specification
After this change in qemu:

c7e89de132

there is no 'max' cpu model on ppc. Drop it to clean up ppc gcc testsuite failures.

In order for this to work we do need to pull in the alternative cpu option from
QEMU_EXTRAOPTIONS on powerpc.

(From OE-Core rev: 3a1b9f300a796e1216d0094043dba7b0f39ec869)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c447f2b21b20fb2b1829d540af2cc0bf8242700c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26 05:20:36 -10:00
Ross Burton
a2bf83842a machine/arch-arm64: add -mbranch-protection=standard
Enable branch protection (PAC/BTI) for all aarch64 builds.  This was
previously enabled at a global level in the GCC build, but that breaks
the gcc test suite.

(From OE-Core rev: a1119750e9b3b9fae4fa9698d2ea3710a5a73768)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8905639d1cdc5ce809cc5ecd9672f5e86bf8a579)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26 05:20:36 -10:00