Commit Graph

74617 Commits

Author SHA1 Message Date
Anuj Mittal
c8b8639251 sqlite3: upgrade 3.45.1 -> 3.45.3
(From OE-Core rev: a5c24e05e8397e2e353d2d27d9da98375f6ec036)

(From OE-Core rev: 3d42e2e7328bfc0066cf3a7a90ae447f3961c5f4)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-30 08:30:00 -07:00
Rohini Sangam
5536f35186 vim: Upgrade 9.1.0698 -> 9.1.0764
This includes CVE-fix for CVE-2024-45306 and CVE-2024-47814

Changes between 9.1.0698 -> 9.1.0764
====================================
https://github.com/vim/vim/compare/v9.1.0698...v9.1.0764

(From OE-Core rev: 7dc4956d4eeb1ffe7fe5df1ed55197c0b5a1bc79)

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2f0e5e63399e544063c79b0b1f9555c820b0604c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-30 08:30:00 -07:00
Shunsuke Tokumoto
8dae11e0b5 python3-setuptools: Add "python:setuptools" to CVE_PRODUCT
Since there are vulnerabilities that cannot be detected by the existing
CVE_PRODUCT, add "python:setuptools" to CVE_PRODUCT.

https://nvd.nist.gov/vuln/detail/CVE-2013-1633
https://nvd.nist.gov/vuln/detail/CVE-2022-40897

(From OE-Core rev: 85b61bf9cefc024faefa083c37ce88ba9c7355e1)

Signed-off-by: Shunsuke Tokumoto <s-tokumoto@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit aa1c8d97efc6640a1cffa2459d9b20ad1f7309b0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-30 08:30:00 -07:00
aszh07
a44d507151 ffmpeg: Add "libswresample libavcodec" to CVE_PRODUCT
Currently, CVE_PRODUCT only detects vulnerabilities where the product is "ffmpeg".

However, there are also vulnerabilities where the product is "libswresample",
and "libavcodec" as shown below.
https://app.opencve.io/vendors/?vendor=ffmpeg

Therefore, add "libswresample libavcodec" to CVE_PRODUCT to detect vulnerabilities
where the product is "libswresample libavcodec" as well.

(From OE-Core rev: cebbbf76c029c5bf5563aca515b1c025c3644bf8)

Signed-off-by: aszh07 <mail2szahir@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-30 08:30:00 -07:00
Peter Marko
c146cf43c7 openssl: patch CVE-2024-9143
Pick patch from branch openssl-3.2.

(From OE-Core rev: df9cd27e23f051fb02391ca62d29f152f36f76fe)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-30 08:30:00 -07:00
Joshua Watt
a34743f178 bitbake: asyncrpc: Use client timeout for websocket open timeout
The default connection timeout for websockets is 10 seconds, so use the
provided client timeout instead (which defaults to 30 seconds).

(Bitbake rev: 270c0c8bdc802c04fd3021c082d58cf8e8d68d82)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 23681775e5941e54ebead469addf708fca1e6beb)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-30 08:30:00 -07:00
Peter Kjellerstedt
200d12b6a5 image.bbclass: Drop support for ImageQAFailed exceptions in image_qa
After commit 905e224849fbbed1719e0add231b00e2d570b3b4 (image_qa: fix
error handling), any unexpected exceptions in do_image_qa() would result
in a variable being set, but never used, effectively hiding the error.

Since image_qa now calls oe.qa.exit_if_errors(), remove the support for
oe.utils.ImageQAFailed and instead rely on the called functions to call
oe.qa.handle_error() themselves. This matches what do_package_qa() does.

Also update the description of do_image_qa() to explain that the called
functions are expected to call oe.qa.handle_error() themselves.

[ YOCTO #15601 ]

(From OE-Core rev: a1b28a88bc7697371ab166b18587b615d6d39c8e)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0c3e111c965af2bc56533633c376b70b7fa5e1de)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:41 -07:00
Paul Barker
8156bb675c meta-ide-support: Mark recipe as MACHINE-specific
meta-ide-support:do_write_test_data dumps the bitbake data dictionary to
a file using export2json(). As this obviously includes the value of
MACHINE, and other MACHINE-specific variables, the recipe needs to be
marked as MACHINE-specific.

RP: Note that this patch does change the name of the environment script
since it is no longer package arch specific but machine arch specific.

[RP: Fix selftest to reference new environment file]
(From OE-Core rev: bec6b535c9a817a5ed51453bcb9ecae0b81a8590)

Signed-off-by: Paul Barker <paul.barker.ct@bp.renesas.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3be2bc8a9b0c9d6a178329c8b451a6bedf255d6c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:41 -07:00
Louis Rannou
2c09c72cf1 image_qa: fix error handling
Make ImageQAFailed inherit BBHandledException so exceptions raised in tests are
catched when the actual test function is executed by bb.utils.better_exec.

Change the do_image_qa tasks so errors are handled with oe.qa.handle_error. Add
some comment to explain this requires to list the test in ERROR_QA or WARN_QA.

[YOCTO #14807]
https://bugzilla.yoctoproject.org/show_bug.cgi?id=14807

(From OE-Core rev: 8fe7aef17eefa70e3f7c07077b8c695e5c00ed5e)

Signed-off-by: Louis Rannou <louis.rannou@non.se.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 905e224849fbbed1719e0add231b00e2d570b3b4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:41 -07:00
Richard Purdie
cbd445e044 libsdl2: Fix non-deterministic configure option for libsamplerate
The libsamplerate option was floating and being enabled on some systems
and not others. Fix this to be deterministic.

(From OE-Core rev: 7ee654579ccf818708989251a97662ea11218d14)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 61455a839e568a3ae7e059ea95c02a1c88d39e1a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:41 -07:00
Teresa Remmet
f9fd48d759 recipes-bsp: usbutils: Fix usb-devices command using busybox
Unknown find parameter -printf makes usb-devices script unusable with
busybox. Replace the parameter to fix this issue.

(From OE-Core rev: bb7dad01066d22c3cc4465bdf39ec4e310821d15)

Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c7c9f827e914b7c27856d995da553a2e41372321)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:41 -07:00
Paul Gerber
e6acba1518 uboot-sign: fix counters in do_uboot_assemble_fitimage
Without unsetting `j` and `k` for each `UBOOT_MACHINE`, `j` and `k`
are incremented in the same frequency as `i` and therefore `$j -eq $i`
and `$k -eq $i` is always true for the first `type` from `UBOOT_CONFIG`
and the first `binary` from `UBOOT_BINARIES`.

(From OE-Core rev: 7f81c38e91563d6d77621a3bfcb155cd226c9b74)

Signed-off-by: Paul Gerber <paul.gerber@ew.tq-group.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3aef55c7ceb654b0012f20618bfd6ead1ef578b6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:41 -07:00
Jörg Sommer
f43ef3aa92 runqemu: Fix detection of -serial parameter
The pattern `-serial` matches also `-device usb-serial` and `virtio-serial`
which are not the desired parameter. This causes the serial console ttyS1 is
missing and Systemd's getty@ttyS1 fails constantly.

(From OE-Core rev: 44c1f003d617ac20527926b4b321ffd1fe4462bb)

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b6d035894120b45b42f146ab5b3110522c58d178)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:41 -07:00
Jaeyoon Jung
008e269c6b makedevs: Fix matching uid/gid
Correct the length to compare in convert2guid() to fix an issue where it
ends up with returning a wrong id that matches partially. Also fix the
length of usr_buf and grp_buf in interpret_table_entry() which are used
as arguments of convert2guid().

(From OE-Core rev: 865b7149da5dd6301c1d9805a1e7bac8dcac82a9)

Signed-off-by: Jaeyoon Jung <jaeyoon.jung@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ca9d193a21e6b8669c4da1a68cd5e0791bb80a4b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:41 -07:00
Claus Stovgaard
9d9325d07b lib/oe/package-manager: skip processing installed-pkgs with empty globs
We can skip processing the installed-pkgs file if globs is empty.
This is the case if self.d.getVar for IMAGE_INSTALL_COMPLEMENTARY
returns an empty string. If globs is an empty string the result from
processing with empty glob in oe-pkgdata-util will always be 0 packages
to install.

Instead of return early on this we just skip and still generate the
locale archive if needed.

(From OE-Core rev: f944a1be484378c733d7fd835dc17e210f1c2705)

Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 160c45c83d5addf01e4834cf896af871bd6fca7f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:40 -07:00
Purushottam Choudhary
3d6bbf83ea virglrenderer: Add patch to fix -int-conversion build issue
Fix int conversion related error during compilation
as some of the platforms where EGLNativeDisplayType
is an int instead of a pointer with GCC-14.

(From OE-Core rev: 17049482f0a112781026376245437c4c8343d28a)

Signed-off-by: Purushottam Choudhary <purushottam27.kumar@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f71f4936a273262343e34f278e6cfcc1e419aea3)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:40 -07:00
Richard Purdie
75ac1f529a license: Fix directory layout issues
There are several issues:

a) pointless empty directories were being created as a path wasn't
   fixed in a previous commit
b) SSTATE_PKGARCH wasn't being captured into the task signature
   since it is in the ignore list by default. We want to capture
   the absolute value, not the dependencies
c) with those issues fixed, cross/native issues became apparent so
   those need to be fixed too.

(From OE-Core rev: a31b46627a85ea871deb760f3d0008de72ceb439)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

Backport from oe-core master: f68aed302a0e4b86fb8c16a6ef4e7295bed48b86

Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:40 -07:00
Khem Raj
302fd9c095 libpcre2: Update base uri PhilipHazel -> PCRE2Project
(From OE-Core rev: 31861ad29c18ee76185970335fe86441ffba0442)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bd6d18228835773163a085070651e13ed961d66d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:40 -07:00
Alexander Kanavin
597c051923 sysvinit: take release tarballs from github
Upstream no longer publishes them on savannah, e.g.
release announcement for 3.10:
https://lists.gnu.org/archive/html/sysvinit-devel/2024-07/msg00016.html

There's been several new versions since:
https://github.com/slicer69/sysvinit/releases

(From OE-Core rev: e39cad8d845ee17517e69c2935567a9316ab8d22)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6cb71eaf3d225de14e62cfc1b76dc8094f8f4aed)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:40 -07:00
Jörg Sommer
d6951e3ce3 ptest-runner: Update 2.4.4 -> 2.4.5
Changelog:

aea9f42 ptest_list_remove: Fix pointer adjustment of prev and next

(From OE-Core rev: edb7968fe272e6afd89b01471f7949ccf730f295)

Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f70ec9bcd379b5fc4c85d7479d42789c2e22f4a9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:40 -07:00
Yogita Urade
0402f54b66 ruby: upgrade 3.2.2 -> 3.3.5
Includes fix for CVE-2024-41123 & CVE-2024-41946

Release notes:
https://github.com/ruby/ruby/releases/tag/v3_3_5

Rebase:
0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch
0006-Make-gemspecs-reproducible.patch

Drop:
0001-fiddle-Use-C11-_Alignof-to-define-ALIGN_OF-when-poss.patch
0002-Obey-LDFLAGS-for-the-link-of-libruby.patch
CVE-2023-36617_1.patch
CVE-2023-36617_2.patch
CVE-2024-27281.patch
CVE-2024-27282.patch
(merged upstream)

0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch
0002-template-Makefile.in-filter-out-f-prefix-map.patch
remove_has_include_macros.patch
(code rewritten upstream)

License-Update: Updated LEGAL section

(From OE-Core rev: 69ffe5bc09260918fb32bfcb29586dcaa1958a5c)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:40 -07:00
Macpaul Lin
711c934229 linux-firmware: upgrade 20240312 -> 20240909
License-Update: additional files

(From OE-Core rev: 14b1560b2fb303eb63fc1c6853ca4e3e8ef9355b)

Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:40 -07:00
Hitendra Prajapati
f88e92a7b3 libarchive: fix CVE-2024-48957 & CVE-2024-48958
Backport fixes for:

* CVE-2024-48957 - Upstream-Status: Backport from 3006bc5d02
* CVE-2024-48958 - Upstream-Status: Backport from a1cb648d52

(From OE-Core rev: 8b520c3cea136591128f6601718c23334afd7a55)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:40 -07:00
Hitendra Prajapati
afbf467405 cups: Backport fix for CVE-2024-47175
Upstream-Status: Backport from
9939a70b75
&
04bb2af452
&
e0630cd18f
&
1e6ca5913e
&
2abe1ba8a6

Reference: https://security-tracker.debian.org/tracker/CVE-2024-47175

(From OE-Core rev: f00847d91eb9440c9f1bc2f34cd0edd2af490f78)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:40 -07:00
Peter Marko
fc449a98b6 rust: ignore CVE-2024-43402
This CVE was created because fix for CVE-2024-24576 was incomplete.
Ignore the new CVE in the same way as the old one.

See https://nvd.nist.gov/vuln/detail/CVE-2024-43402

(From OE-Core rev: 6ed9968bf3e35aca316227ee23294c683f77055d)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-18 06:04:40 -07:00
Lee Chee Yang
cd44e6bd40 migration-guide: add release notes for 4.0.21
(From yocto-docs rev: a854b398db797394677ac8e15b5459373c1c3cd3)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-11 05:47:38 -07:00
Martin Jansa
890f63b6bf meta-world-pkgdata: Inherit nopackages
Since this is a recipe with PACKAGES = "", inherit the nopackages
class to skip the various packaging functions which wouldn't do anything anyway.

This fixes errors from buildhistory changes where packages-split would be empty.

(From OE-Core rev: 5ea3ba00532265165e0d30f6d2eed568f5b5867f)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-11 05:47:38 -07:00
Martin Jansa
a3987f60df populate_sdk_base: inherit nopackages
Since this bbclass sets PACKAGES = "", inherit the nopackages
class to skip the various packaging functions which wouldn't
do anything anyway.

This fixes errors from buildhistory changes where packages-split would be empty.

e.g. meta-toolchain build now fails with:
| DEBUG: Executing shell function buildhistory_list_pkg_files
| find: ".../meta-toolchain/1.0/packages-split/*": No such file or directory
| WARNING: exit code 1 from a shell command.
| DEBUG: Python function buildhistory_emit_pkghistory finished

(From OE-Core rev: 2462cceaeec362d85a469ec0668ed92a092e725c)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Atharva Nandanwar <atharvanandanwar@outlook.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-11 05:47:38 -07:00
Wang Mingyu
92d7f055c4 cryptodev: upgrade 1.13 -> 1.14
0001-Disable-installing-header-file-provided-by-another-p.patch
0001-tests-Makefile-do-not-use-Werror.patch
removed since they're included in 1.14

Changelog:
===========
* Fix compilation issues after API changes in several Linux kernels
* Split install targets to help package maintainers

(From OE-Core rev: 749f297f5d94fc97a5ade8f7cb0321d7286b2521)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Acked-by: Chirag Shilwant <c-shilwant@ti.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-11 05:47:38 -07:00
Hitendra Prajapati
4639bc9503 webkitgtk: upgrade 2.44.1 -> 2.44.3
Remove below patches which already fix in this upgraded version.

0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch
0002-More-dynamicDowncast-adoption-in-platform-code.patch

(From OE-Core rev: 9a05f72805fa4c8ac408024bc8cd51892ad4a37c)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-11 05:47:38 -07:00
Deepesh Varatharajan
2186202022 glibc: stable 2.39 branch updates.
Below commits on glibc-2.39 stable branch are updated.
84f6bfce2c libio: Attempt wide backup free only for non-legacy code
4e382ce01c debug: Fix read error handling in pcprofiledump
7f5027995f elf: Fix tst-dlopen-tlsreinit1.out test dependency
27a0c6b490 elf: Avoid re-initializing already allocated TLS in dlopen (bug 31717)
e3d5d2d350 elf: Clarify and invert second argument of _dl_allocate_tls_init
28c4f32f71 elf: Support recursive use of dynamic TLS in interposed malloc
5ff30b2f75 nptl: Use <support/check.h> facilities in tst-setuid3
cae418638e posix: Use <support/check.h> facilities in tst-truncate and tst-truncate64
a500b48bd2 ungetc: Fix backup buffer leak on program exit [BZ #27821]
70939528c6 ungetc: Fix uninitialized read when putting into unused streams [BZ #27821]
f0c308ab23 Make tst-ungetc use libsupport
3c5f493d87 stdio-common: Add test for vfscanf with matches longer than INT_MAX [BZ #27650]
98de2f2bae support: Add FAIL test failure helper
e73fd06b7f string: strerror, strsignal cannot use buffer after dlmopen (bug 32026)
37c2aa4eaa Define __libc_initial for the static libc
49953727d1 x86: Fix bug in strchrnul-evex512 [BZ #32078]
81631a0dd1 Adjust check-local-headers test for libaudit 4.0
9fbbe86f7c x32/cet: Support shadow stack during startup for Linux 6.10
eeff407b19 x86-64: Remove sysdeps/x86_64/x32/dl-machine.h
1ab7faf86d support: Add options list terminator to the test driver
6eebc92cb2 manual/stdio: Further clarify putc, putwc, getc, and getwc
afc15c2044 Fix name space violation in fortify wrappers (bug 32052)
5a5eb72d8e resolv: Fix tst-resolv-short-response for older GCC (bug 32042)
7f5ccdd8af Add mremap tests
a8c230c881 mremap: Update manual entry
9f349d02c6 linux: Update the mremap C implementation [BZ #31968]
127ef30c46 Enhanced test coverage for strncmp, wcsncmp
3b25c7fa87 Enhance test coverage for strnlen, wcsnlen
4bdcc1963b manual: make setrlimit() description less ambiguous
b71a51189d manual/stdio: Clarify putc and putwc
946006d37c malloc: add multi-threaded tests for aligned_alloc/calloc/malloc
f11b7178a1 malloc: avoid global locks in tst-aligned_alloc-lib.c
51db012c94 resolv: Track single-request fallback via _res._flags (bug 31476)
8c9fbc6651 resolv: Do not wait for non-existing second DNS response after error (bug 30081)
fc1dc39984 resolv: Allow short error responses to match any query (bug 31890)
cb19cef087 elf: Fix localplt.awk for DT_RELR-enabled builds (BZ 31978)
f6a75fddf4 Fix usage of _STACK_GROWS_DOWN and _STACK_GROWS_UP defines [BZ 31989]

Results before updates as below:

No. of passes                     4581
No. of expected passes            2
No. of expected failures          16
No. of unexpected failures        214
No. of unsupported tests          45

Results after updates as below:

No. of passes                     4605
No. of expected passes            2
No. of expected failures          16
No. of unexpected failures        212
No. of unsupported tests          46

(From OE-Core rev: d652964e2bd860473b2d39f57b92e51d646672bf)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-11 05:47:38 -07:00
Peter Marko
c6844e50df wpa-supplicant: Patch security advisory 2024-2
Pick patches according to
http://w1.fi/security/2024-2/sae-h2h-and-incomplete-downgrade-protection-for-group-negotiation.txt
SAE H2E and incomplete downgrade protection for group negotiation

(From OE-Core rev: 44f1d5f08c6dfbd03d2997fc6fa8f257339589fa)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-11 05:47:38 -07:00
Peter Marko
eca9779e43 wpa-supplicant: Patch CVE-2024-3596
Picked patches according to
http://w1.fi/security/2024-1/hostapd-and-radius-protocol-forgery-attacks.txt

First patch is style commit picked to have a clean cherry-pick of all
mentioned commits without any conflict.
Patch CVE-2024-3596_07.patch has hostapd code removed as it is not
present in wpa-supplicant download tarball.

(From OE-Core rev: 2352c8a1282b7b11a542eb7a821625580c8395fa)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-11 05:47:38 -07:00
Peter Marko
e828e0364a wpa-supplicant: Ignore CVE-2024-5290
NVD CVE report [1] links Ubuntu bug [2] which has a very good
description/discussion about this issue.
It applies only to distros patching wpa-supplicant to allow non-root
users (e.g. via netdev group) to load modules.
This is not the case of Yocto.

Quote:
So upstream isn't vulnerable as they only expose the dbus interface to
root. Downstreams like Ubuntu and Chromium added a patch that grants
access to the netdev group. The patch is the problem, not the upstream
code IMHO.

There is also a commit [3] associated with this CVE, however that only
provides build-time configuration to limit paths which can be accessed
but it acts only as a mitigation for distros which allow non-root users
to load crafted modules.

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-5290
[2] https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2067613
[3] https://w1.fi/cgit/hostap/commit/?id=c84388ee4c66bcd310db57489eac4a75fc600747

(From OE-Core rev: 33548479f66164f486efdb6aeba2de7da2b5b0c9)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-11 05:47:38 -07:00
Khem Raj
ff5c6bd86f openssh: Mark CVE-2023-51767 as wont-fix
(From OE-Core rev: 1b4bada6c003ef743df09283e45953e6d9ea4c5a)

(From OE-Core rev: 9376c14f367477a8d02df1331908e3df3bd009b6)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-11 05:47:38 -07:00
Khem Raj
ff0f3fca81 gnupg: Document CVE-2022-3219 and mark wontfix
(From OE-Core rev: f10f9c3a8d2c17d5a6c3f0b00749e5b34a66e090)

(From OE-Core rev: 1bce8a63edd93070bdd8e8a518a6d359e3fbf0ba)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-11 05:47:37 -07:00
Jaeyoon Jung
c799f73a47 makedevs: Fix issue when rootdir of / is given
Treating rootdir "/" as "" leads an error in parse_devtable(). Preserve
it as it is given and use a separate variable for path name prepending.
Another minor fix is to add a return statement at the end of
convert2guid() to avoid an error with -Werror=return-type.

(From OE-Core rev: 3d894863f442188bad446095bd7fdd82665bb54b)

Signed-off-by: Jaeyoon Jung <jaeyoon.jung@lge.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4d52e6276c687a8950bde21850072ddf14893fb2)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Richard Purdie
6f48df063e bitbake.conf: Add truncate to HOSTTOOLS
Some wic images need this command. Since it is part of coreutils, it doesn't really
cost anything to have in HOSTTOOLS and it avoids signifiant build dependencies on
coreutils-native.

[YOCTO #15571]

(From OE-Core rev: 85451cdaee4718233211da1e43db01f5cd2b1aff)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 522000ce5c4f0201cbe42d7826b6a8489ed10117)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Yi Zhao
9bbf3a7362 rpm: fix expansion of %_libdir in macros
There is a patch in oe-core[1] to avoid hardcoded paths in macros. It
tries to use libdir to expand %_libdir in macros.in. However, in
upstream commit[2], libdir for macros in CMakeLists.txt is set to
${prefix}/=LIB=, which causes %_libdir to expand to ${prefix}/=LIB=
instead of the correct path in the final macros.

On target:
$ rpm --showrc | grep _libdir
[snip]
-13: _libdir    ${prefix}/=LIB=
[snip]

This also causes %__pkgconfig_path in fileattrs/pkgconfig.attr to become
an invalid regular expression when building rpm packages. This results a
warning in log.do_package_write_rpm in all packages:

Warning: Ignoring invalid regular expression ^((${prefix}/=LIB=|usr/share)/pkgconfig/.*.pc|usr/bin/pkg-config)$

Set libdir to ${CMAKE_INSTALL_FULL_LIBDIR} instead of ${prefix}/=LIB= to
make sure it is expanded to the correct path in macros.

After the patch:
On target:
$ rpm --showrc | grep _libdir
[snip]
-13: _libdir    /usr/lib
[snip]

[1] https://git.openembedded.org/openembedded-core/tree/meta/recipes-devtools/rpm/files/0001-Do-not-hardcode-lib-rpm-as-the-installation-path-for.patch
[2] d2abb7a487

(From OE-Core rev: 7c7f95668d270a825c7d3d235ec2b8d4e7eb0b9f)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit ae0e217145f45d065124aeb0a7d72a0c25f621ef)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Alexander Kanavin
c5e470dbbf pulseaudio, desktop-file-utils: correct freedesktop.org -> www.freedesktop.org SRC_URI
Server's https certificate isn't valid for freedesktop.org without www prefix.

(From OE-Core rev: 60f411d19a9ea5297911eed64902e1cb65358e35)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d7ce9da33498869384b26a6fda05c37e7b2c3565)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Adrian Freihofer
1f79d3af0e kernel-fitimage: fix external dtb check
If EXTERNAL_KERNEL_DEVICETREE and dtb_image_sect are empty variables
dtb_path ends up as "/" which is available on most Unix systems but
probably not the dtb_path which is needed here. Checking for a file
makes more sense and also solves the issue with the "/".

(From OE-Core rev: 74054f3614922e331620a4dcb37975c5f679ab4e)

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c8f629b6991449cc6726f48a607d9e1bd50807ee)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Adrian Freihofer
bf9a4b750d kernel-fitimage: fix intentation
white space changes only.
- python part should be 4 spaces, not 8.
- use tabs for shell

(From OE-Core rev: 667aab25e83c84c0daccd43eda574ae34c75c8a7)

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 000079a973e8c97d496ca721259437880a7ea70d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Richard Purdie
8f0499abe6 scripts/install-buildtools: Update to 5.0.3
Update to the 5.0.3 release of the 5.0 series for buildtools.

(From OE-Core rev: 9028036392df4c49895c3c980596d26e0461febb)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c922ca720a0c3b7b4d3d3187539e7cf77d93d457)
Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Aleksandar Nikolic
c0a82370fd install-buildtools: update base-url, release and installer version
Update the following default values:
- DEFAULT_BASE_URL (https instead of http)
- DEFAULT_RELEASE (5.0.1)
- DEFAULT_INSTALLER_VERSION (5.0.1)

(From OE-Core rev: 2c4b9af5e3f385b296e2ce0e1d8a0c43937a7334)

Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b2ebb965a5aa128b05ed7ddc9216171463777732)
Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Aleksandar Nikolic
60e2f32a43 install-buildtools: fix "test installation" step
The "Test installation" step fails with some harmless error messages
(see [1]). This can however make a user think that the buildtools
have not been installed correctly.

Two reasons for the error messages:
- some envvars in the environment-setup-<arch>-pokysdk-linux file
  start and end with double quotes (e.g., PATH) and are as such
  written into python os.environ. This leads that their usage is
  not valid later when testing the installation. This patch removes
  the double quotes before writing, if they are present.
- if installation directory (install_dir), given through the option
  --directory, is given as a relative path, checking if the path to
  a tool (e.g., gcc) in buildtools starts it will always fail. This
  patch converts the install_dir variable to an absolute path.

[1]
ERROR: Something went wrong: tar not found in ./build-tools
ERROR: Something went wrong: installation failed

(From OE-Core rev: 915c48232b0e66915720bff9c745825fa169fa65)

Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e4eb0b14ecf9bd2fba13260441c9d86eb348f41e)
Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Aleksandar Nikolic
4ad1e92c10 install-buildtools: remove md5 checksum validation
No need to validate with the md5 checksum, as the file is not even
uploaded to the Yocto release webpage (the download never failed due
to a wrong indentation of an else statement). For validation purposes,
use the sha256 checksum only.

(From OE-Core rev: 081ac6c177860c1bd7e2d4f4b873f3a760864d21)

Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b740d2f9d40aef1e18c022d1e82b4fb2c5c1fc22)
Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Victor Kamensky
e7e5720dd4 systemtap: fix systemtap-native build error on Fedora 40
Backport of couple patches from upstream.

(From OE-Core rev: bca8aa07ce0cea82f6f17381efaeba897edab265)

Signed-off-by: Victor Kamensky <victor.kamensky7@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cc486f26db46c562e35f770c16edf3f4035e536e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Konrad Weihmann
2b073f0eaa testexport: fallback for empty IMAGE_LINK_NAME
if IMAGE_LINK_NAME is set empty to disable the symlinking
for image artifacts in deploy, testexport fails, as the path assembly
is incorrect.
In that case fallback to IMAGE_NAME

(From OE-Core rev: bd723b611e937b8532ebcd485db61a3eae46091d)

Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0c1d098e6dd08fa3a5aafca656457ac6badcef89)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Konrad Weihmann
89b7eef375 testimage: fallback for empty IMAGE_LINK_NAME
if IMAGE_LINK_NAME is set empty to disable the symlinking
for image artifacts in deploy, testimage fails, as the path assembly
is incorrect.
In that case fallback to IMAGE_NAME

(From OE-Core rev: 1b026479e6d86d43d68ba26bed4b31dac91fc327)

Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c7a4e7e294992acc589c62adcaf6cd32659f2f9b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00
Konrad Weihmann
a335a496d2 runqemu: keep generating tap devices
in case there is no tap device the script tries to
generate a new one.
The new device is then unguarded for a moment, so
the newly generated device could be acquired
by a different instance or user, before it is locked to
the instance with acquire_taplock.
To fix that keep generating new tap devices in case
the lock can't be acquired up to 5 times.
If no tap device can be locked it fails in the existing
error handling

(From OE-Core rev: ae4e4fb703f63402cacbef772e70082e5760f78a)

Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 23876576d054ebbab9b02c0012782aa56feda123)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-02 06:15:15 -07:00