Commit Graph

8009 Commits

Author SHA1 Message Date
Praveen Kumar
212172aa13 go: Fix CVE-2024-45336
The HTTP client drops sensitive headers after following a cross-domain redirect.
For example, a request to a.com/ containing an Authorization header which is redirected to
b.com/ will not send that header to b.com. In the event that the client received a subsequent
same-domain redirect, however, the sensitive headers would be restored. For example, a chain
of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the
Authorization header to b.com/2.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-45336

Upstream-patch:
b72d56f98d

(From OE-Core rev: 63e84b64f055ad7c91de67194e6739c96fb95496)

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-02-15 06:04:43 -08:00
Yash Shinde
57be589ed2 gdb: Fix CVE-2024-53589
CVE: CVE-2024-53589

(From OE-Core rev: 4ddd1e5aea1c4b84a6c4e1db5ded4938c4a35393)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-02-05 06:54:35 -08:00
Yash Shinde
7e19a67813 binutils: internal gdb: Fix CVE-2024-53589
CVE: CVE-2024-53589

(From OE-Core rev: 2d6df18f4a694d6499b337bbbab10ba8bb6e3fe4)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-02-05 06:54:35 -08:00
Ross Burton
966aead7e8 classes/qemu: use tune to select QEMU_EXTRAOPTIONS, not package architecture
Using the package architecture to select the right qemu options to pass
to qemu-user is incorrect, and fails for recipes that set PACKAGE_ARCH
to MACHINE_ARCH (as the qemuppc workarounds suggest) because there are
not typically any options set for the machine name.

Solve this by using TUNE_PKGARCH instead: for the majority of recipes
this is the same value, but for machine-specific recipes it remains the
same instead of changing to the machine name.

This means we can remove the qemuppc workarounds, as they're obsolete.

Also update the gcc-testsuite recipe which uses the same pattern to use
TUNE_PKGARCH, and generalise the else codepath to avoid needing to
update the list of architectures.

[ YOCTO #15647 ]

(From OE-Core rev: 077aab43f2c928eb8da71934405c62327010f552)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-24 07:49:28 -08:00
Archana Polampalli
b4825be806 rsync: fix CVE-2024-12747
A flaw was found in rsync. This vulnerability arises from a race condition during
rsync's handling of symbolic links. Rsync's default behavior when encountering
symbolic links is to skip them. If an attacker replaced a regular file with a
symbolic link at the right time, it was possible to bypass the default behavior
and traverse symbolic links. Depending on the privileges of the rsync process,
an attacker could leak sensitive information, potentially leading to privilege escalation.

(From OE-Core rev: c0905ffb2f1aa3bc4c6187ff4860dcc8d3dbfb01)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-24 07:49:28 -08:00
Archana Polampalli
f70841d2a2 rsync: fix CVE-2024-12088
A flaw was found in rsync. When using the `--safe-links` option, rsync fails to
properly verify if a symbolic link destination contains another symbolic link within it.
This results in a path traversal vulnerability, which may lead to arbitrary file write
outside the desired directory

(From OE-Core rev: 741200c41a19ef5b4876d9a80667dfde2e5f4a9d)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-24 07:49:28 -08:00
Archana Polampalli
2aebe10959 rsync: fix CVE-2024-12087
A path traversal vulnerability exists in rsync. It stems from behavior enabled
by the `--inc-recursive` option, a default-enabled option for many client options
and can be enabled by the server even if not explicitly enabled by the client.
When using the `--inc-recursive` option, a lack of proper symlink verification
coupled with deduplication checks occurring on a per-file-list basis could allow
a server to write files outside of the client's intended destination directory.
A malicious server could write malicious files to arbitrary locations named after
valid directories/paths on the client.

(From OE-Core rev: 12328df8dfcdc73ef70af299e9ebdc1d8ae73f37)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-24 07:49:28 -08:00
Archana Polampalli
1e04a4df0a rsync: fix CVE-2024-12086
A flaw was found in rsync. It could allow a server to enumerate the contents of an
arbitrary file from the client's machine. This issue occurs when files are being
copied from a client to a server. During this process, the rsync server will send
checksums of local data to the client to compare with in order to determine what
data needs to be sent to the server. By sending specially constructed checksum values
for arbitrary files, an attacker may be able to reconstruct the data of those files
byte-by-byte based on the responses from the client.

(From OE-Core rev: b49c8f58c20d7deb354a86a34488cb798c49eba3)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-24 07:49:28 -08:00
Archana Polampalli
5d60b24103 rsync: fix CVE-2024-12085
A flaw was found in the rsync daemon which could be triggered when rsync compares
file checksums. This flaw allows an attacker to manipulate the checksum length
(s2length) to cause a comparison between a checksum and uninitialized memory and
leak one byte of uninitialized stack data at a time.

(From OE-Core rev: 3fd8bea3e72573cca03cd3f6f4fc077cd2fd45a3)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-24 07:49:28 -08:00
Archana Polampalli
a1fab4c1a9 rsync: fix CVE-2024-12084
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due
to improper handling of attacker-controlled checksum lengths (s2length) in the code.
When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write
out of bounds in the sum2 buffer.

(From OE-Core rev: 17fac276e27af19b00b6263f22156a55bae6a5c9)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-24 07:49:28 -08:00
Khem Raj
b7070c567a rsync: Delete pedantic errors re-ordering patch
It has been fixed by removing the check upstream see
9a3449a398

(From OE-Core rev: c6228b8371ea5c3c452db7b536948ae96d83844b)

(From OE-Core rev: 3746c60f38a6cf99f293131b8b1bfed7c73a1944)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-24 07:49:28 -08:00
Alexander Kanavin
956e98851d rsync: update 3.2.5 -> 3.2.7
Rebase patches.

(From OE-Core rev: 827c787893caa973c509acf7cac9e17fec5692a4)

(From OE-Core rev: 798009f46f2044aaa0bac753430cca1964677741)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-24 07:49:28 -08:00
Divya Chellam
61c55b9e30 ruby: fix CVE-2024-49761
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS
vulnerability when it parses an XML that has many digits between &# and x...;
in a hex numeric character reference (&#x.... This does not happen with
Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby.
The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

CVE-2024-49761-0009.patch is the CVE fix and rest are dependent commits.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-49761

Upstream-patch:
810d228523
83ca5c4b0f
51217dbcc6
7e4049f6a6
fc6cad570b
7712855547
370666e314
a579730f25
ce59f2eb1a

(From OE-Core rev: 5b453400e9dd878b81b1447d14b3f518809de17e)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-18 06:21:02 -08:00
Archana Polampalli
4f959ce14c go: Fix CVE-2024-34158
Calling Parse on a "// +build" build tag line with deeply nested
expressions can cause a panic due to stack exhaustion.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-34158

Upstream-patch:
d4c53812e6

(From OE-Core rev: eb14e9722d023b4d1668c55ce4bc6ef02f8ce6c2)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-18 06:21:02 -08:00
Archana Polampalli
0c88d20540 go: Fix CVE-2024-34156
Calling Decoder.Decode on a message which contains deeply nested structures can
cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-34156

Upstream-patch:
2092294f2b

(From OE-Core rev: 3aeeee86a53cee14bb1a6a485f8781459b6f2ffc)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-18 06:21:02 -08:00
Archana Polampalli
f700dcdc1d go: Fix CVE-2024-34155
Calling any of the Parse functions on Go source code which contains
deeply nested literals can cause a panic due to stack exhaustion.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-34155

Upstream-patch:
b232596139

(From OE-Core rev: 9d21d527e2448e202030ae7ad38c88e25943a2f3)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-18 06:21:02 -08:00
Peter Marko
2d08595a93 python3: upgrade 3.10.15 -> 3.10.16
Handles CVE-2024-50602, CVE-2024-11168 and CVE-2024-9287.

(From OE-Core rev: 5a611fbbdb3e373d379f922ffc5606ff70279831)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-09 08:41:04 -08:00
Jiaying Song
dffb6c2442 subversion: fix CVE-2024-46901
Insufficient validation of filenames against control characters in
Apache Subversion repositories served via mod_dav_svn allows
authenticated users with commit access to commit a corrupted revision,
leading to disruption for users of the repository. All versions of
Subversion up to and including Subversion 1.14.4 are affected if serving
repositories via mod_dav_svn. Users are recommended to upgrade to
version 1.14.5, which fixes this issue. Repositories served via other
access methods are not affected.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-46901

Upstream patches:
https://subversion.apache.org/security/CVE-2024-46901-advisory.txt

(From OE-Core rev: 2082038de00090e4b10a151068876f83c83f94c7)

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-20 06:01:45 -08:00
Jiaying Song
e402b2417a python3-requests: fix CVE-2024-35195
Requests is a HTTP library. Prior to 2.32.0, when making requests
through a Requests `Session`, if the first request is made with
`verify=False` to disable cert verification, all subsequent requests to
the same host will continue to ignore cert verification regardless of
changes to the value of `verify`. This behavior will continue for the
lifecycle of the connection in the connection pool. This vulnerability
is fixed in 2.32.0.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-35195

Upstream patches:
a58d7f2ffb

(From OE-Core rev: 8bc8d316a6e8ac08b4eb2b9e2ec30b1f2309c31c)

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-16 05:58:03 -08:00
Yogita Urade
450857b441 qemu: fix CVE-2024-3447
A heap-based buffer overflow was found in the SDHCI device
emulation of QEMU. The bug is triggered when both
`s->data_count` and the size of `s->fifo_buffer` are set to
0x200, leading to an out-of-bound access. A malicious guest
could use this flaw to crash the QEMU process on the host,
resulting in a denial of service condition.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-3447

Upstream patch:
2429cb7a9f

(From OE-Core rev: 01d7ac9244364b7f89cd2f99fff11c2417bcad03)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-09 07:54:03 -08:00
Divya Chellam
e0736e9b27 qemu: fix CVE-2024-3446
A double free vulnerability was found in QEMU virtio devices
(virtio-gpu, virtio-serial-bus, virtio-crypto), where the
mem_reentrancy_guard flag insufficiently protects against DMA
reentrancy issues. This issue could allow a malicious privileged
guest to crash the QEMU process on the host, resulting in a d
enial of service or allow arbitrary code execution within the
context of the QEMU process on the host.

CVE-2024-3446-0004, CVE-2024-3446-0005, CVE-2024-3446-0006
are CVE fix and CVE-2024-3446-0001, CVE-2024-3446-0002,
CVE-2024-3446-0003 are dependent commits to fix the CVE.

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-3446

Upstream patches:
9c86c97f12
f63192b054
ec0504b989
ba28e0ff4d
b4295bff25
f4729ec39a

(From OE-Core rev: db7e3a56656db0bc61ec2e35ccc149e9b90a389b)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-09 07:54:03 -08:00
Peter Marko
47b90adf88 qemu: patch CVE-2024-6505
Backport patch [3] as linked from [1] via [2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-6505
[2] https://bugzilla.redhat.com/show_bug.cgi?id=2295760
[3] https://gitlab.com/qemu-project/qemu/-/commit/f1595ceb

(From OE-Core rev: 7e725e126689cc44055e27a05efafb7b52e89192)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-09 07:54:03 -08:00
Peter Marko
7aa27fe43b qemu: ignore CVE-2022-36648
The CVE has disputed flag in NVD DB.

(From OE-Core rev: bd01091c33c1de6ae7e1605301e3f73350ee7e7e)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-09 07:54:03 -08:00
Hongxu Jia
af06cbf82b python3-zipp: fix CVE-2024-5569
According to [1] which provided the fix link [2], but upstream author
reworked it later [3][4][5]

Backport and rebase all the patches for tracing

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-5569
[2] fd604bd34f
[3] 3cb5609002
[4] f89b93f037
[5] cc61e6140f

(From OE-Core rev: 13bd99e17f0aca108839e81e9aa0b14351116fdf)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-09 07:54:03 -08:00
Markus Volk
e95fcf9f57 ninja: fix build with python 3.13
python 3.13 removed the pipes module. Thus build fails for host machines that run python 3.13

This commit adds a backport patch to use subprocess module instead

(From OE-Core rev: 1a02cf1997216cb943d8965fe74f971a8cb2f70f)

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-02 06:23:20 -08:00
Jiaying Song
53801adf75 python3-pip: fix CVE-2023-5752
When installing a package from a Mercurial VCS URL (ie "pip install
hg+...") with pip prior to v23.3, the specified Mercurial revision could
be used to inject arbitrary configuration options to the "hg clone" call
(ie "--config"). Controlling the Mercurial configuration can modify how
and which repository is installed. This vulnerability does not affect
users who aren't installing from Mercurial.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-5752

Upstream patches:
389cb799d0

(From OE-Core rev: 862c0338fba06077a26c775b49f993eac63762c9)

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-12-02 06:23:20 -08:00
Steve Sakoman
2208ff6ccb llvm: reduce size of -dbg package
Unless DEBUG_BUILD is enabled, pass -g1 to massively reduce the size of
the debug symbols

  Level 1 produces minimal information, enough for making backtraces in
  parts of the program that you don't plan to debug. This includes
  descriptions of functions and external variables, and line number
  tables, but no information about local variables.

This makes the sstate objects a lot more manageable, and packaging
faster.

(From OE-Core rev: 13a2f43920c53f9f1bc5ec52eba9eb48da265ef6)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-27 06:27:26 -08:00
Richard Purdie
7090df8cc3 pseudo: Fix envp bug and add posix_spawn wrapper
Fix pseudo with python 3.13 by adding a wrapper for posix_spawn and
fixing a NULL pointer dereference in envp handling it uncovered. This
fixes issues on Fedora 41.

(From OE-Core rev: 89b64526ac2bf0609a18c4d44b4835028f686978)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Richard Purdie
0781183d75 pseudo: Update to include open symlink handling bugfix
Update to a new revision which includes "Bugfix for Linux open(O_CREAT|O_EXCL)"

(From OE-Core rev: cc87b332c5d09d4d7aaa2569fa046a16012597d2)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Richard Purdie
282be2fc6e pseudo: Fix to work with glibc 2.40
glibc 2.40 renames some internal header variables. Update our hack to
work with the new version. These kinds of problems illustrate we need to
address the issue properly.

(From OE-Core rev: 63d7c11b46119f0c97d08f2fa837c02e633ab75f)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Richard Purdie
bb34759979 pseudo: Update to pull in python 3.12+ fix
Pull in a fix which avoids syntax warnings with python 3.12.

(From OE-Core rev: 82526703823e252070dbf689e6f82a12ceb3b035)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Richard Purdie
67f0d86422 pseudo: Update to pull in fchmodat fix
This is needed to work with coreutils 9.5.

Also contains some README tweaks.

(From OE-Core rev: c2549844031c30d2c1a6965ee66f163878d46fab)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Richard Purdie
044c07e9fb pseudo: Update to pull in gcc14 fix and missing statvfs64 intercept
rpm 4.19 now builds with LFS64 support enabled by default,
so it calls statvfs64() to get the space available on the
filesystem it is installing packages into.  This is not
getting caught by pseudo, so rpm is checking the host's
root filesystem, rather than the filesystem where the
build is happening.

Merge in that fix and a gcc14 fix.

(From OE-Core rev: 1b181d1fcef45f969ef9147912995d80dbe87d87)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Richard Purdie
707e3073b4 pseudo: Update to pull in syncfs probe fix
Pulls in the changes:

Eilís 'pidge' Ní Fhlannagáin (1):
      subports: Add _GNU_SOURCE for syncfs probe

Richard Purdie (1):
      SECURITY.md: Add file

Wu Zhenyu (1):
      pseudo.1: Fix a typo

(From OE-Core rev: 40a013f7134aec1d0e953ad4906944072cfb2ca1)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Alexandre Belloni
fb7c005c8d pseudo: Update to pull in fd leak fix
Pull in:
    pseudo_util.c: Open file with O_CLOEXEC to avoid fd leak

    Use close-on-exec (O_CLOEXEC) flag when open log file to
    make sure its file descriptor is not leaked to parent
    process on fork/exec.

    Fixes [YOCTO #13311]

(From OE-Core rev: b8445072f4009b3e912792931bd71a4201d541e9)

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Richard Purdie
676ce4044d pseudo: Update to include logic fix
The logic in the previous commit was reversed, update to fix it.

(From OE-Core rev: 9b06d2741191333c7b11c66e9ab5848f95cb4e42)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Richard Purdie
a507374b08 pseudo: Switch back to the master branch
OE is the main user of pseudo and we've had the changes in the oe-core branch
around long enough that we're going to run with them. Swicth back to directly
using the master branch.

(From OE-Core rev: 198ff9141f94c551d2a29f3a036c209e3e554a37)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[Luca: re-add 'branch' parameter to fix "does not set any branch parameter" warning]
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Khem Raj
6dd57602e1 pseudo: Disable LFS on 32bit arches
pseudo overrides certain libc functions which are aliases when LFS64 is
enabled. In anycase pseudo may not be of much use on 32bit systems

(From OE-Core rev: 215367b62ac1f48ba224e56e7b8862c0a7bdbcd0)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Richard Purdie
2f7e023180 pseudo: Update to pull in linux-libc-headers race fix
Update to pull in:

    pseudo.c: Avoid patch mismatch errors for NAMELESS file entries

    In rare cases we see failures, often in linux-libc-headers for things like:

    |   INSTALL /XXX/linux-libc-headers/6.1-r0/image/usr/include
    | abort()ing pseudo client by server request. See https://wiki.yoctoproject.org/wiki/Pseudo_Abort for more details on this.

    Pseudo log:
    path mismatch [2 links]: ino 46662476 db 'NAMELESS FILE' req '/XXX/linux-libc-headers/6.1-r0/image/usr'.
    Setup complete, sending SIGUSR1 to pid 3630890.

    Whilst this doesn't easily reproduce, the issue is that multiple different processes are
    likely working on the directory and the creation in pseudo might not match accesses
    made by other processes.

    Ultimately, the "NAMELESS FILE" is harmless and pseudo will reconcile things
    so rather than error out, we should ignore this case.

(From OE-Core rev: 77d018ce3b3a9390a5cc020bce9f9ea9017820dd)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4f30a1a74828e105cbe69677b3fbe5623f371543)
Signed-off-by: Fabio Berton <fabio.berton@criticaltechworks.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Philip Lorenz
872786c742 cmake: Fix sporadic issues when determining compiler internals
When `-pipe` is enabled, GCC passes data between its different
executables using pipes instead of temporary files. This leads to issues
when cmake attempts to infer compiler internals via the `-v` parameter
as each executable will print to `stderr` in parallel.

In turn this may lead to compilation issues down the line as for example
the system include directories could not be determined properly which
may then propagate to issues such as:

    recipe-sysroot/usr/include/c++/11.3.0/cstdlib:75:15: fatal error:
        stdlib.h: No such file or directory
    |    75 | #include_next <stdlib.h>
    |       |               ^~~~~~~~~~
    | compilation terminated.
    | ninja: build stopped: subcommand failed.
    | WARNING: exit code 1 from a shell command.

Fix this stripping `-pipe` from the command line used to determine
compiler internals.

(From OE-Core rev: 8e2233fd0509b9f20c19d5006dd7ef0c2260bdba)

Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-15 06:05:32 -08:00
Martin Jansa
4a9e116da8 xmlto: backport a patch to fix build with gcc-14 on host
* need to add dependency on flex-native because now when the
  .l file is modified by the .patch file it will try to regenerate
  the c code and fail:

| make[1]: Entering directory 'work/x86_64-linux/xmlto-native/0.0.28-r0/build'
| /bin/bash ../xmlto-0.0.28/ylwrap ../xmlto-0.0.28/xmlif/xmlif.l .c xmlif/xmlif.c -- /bin/bash 'work/x86_64-linux/xmlto-native/0.0.28-r0/xmlto-0.0.28/missing' flex
| work/x86_64-linux/xmlto-native/0.0.28-r0/xmlto-0.0.28/missing: line 81: flex: command not found
| WARNING: 'flex' is missing on your system.
|          You should only need it if you modified a '.l' file.
|          You may want to install the Fast Lexical Analyzer package:
|          <https://github.com/westes/flex>

* backport
  https://pagure.io/xmlto/c/32376c053733c6c0ebaca3c25c0725509342fdf3?branch=master
  as well, so that patched xmlif/xmlif.c is newer than xmlif/xmlif.l and the build
  won't try to regenerate it with flex as that leads to random build failures reported
  in:
  https://lists.openembedded.org/g/openembedded-core/message/206412
  https://errors.yoctoproject.org/Errors/Details/810853/
  https://lists.openembedded.org/g/openembedded-core/message/206496
  https://valkyrie.yoctoproject.org/#/builders/29/builds/355

(From OE-Core rev: 2e8819c0b9ada2b600aecc40c974a18eb7c0a666)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-11 06:19:18 -08:00
Ruiqiang Hao
959405cc37 gcc: restore a patch for Neoverse N2 core
Commit 7806e21e7d47 ("gcc: upgrade to v11.5") removed one patch named
0001-aarch64-Update-Neoverse-N2-core-defini.patch by mistake, this will
cause the Neoverse N2 core to be identified as the armv8.5 architecture,
restore this patch to avoid related compilation issues.

(From OE-Core rev: 4c75edda8ec28fb8dee19ca90a1ea7f33ba80999)

Signed-off-by: Ruiqiang Hao <Ruiqiang.Hao@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-11 06:19:18 -08:00
Martin Jansa
b8984370a5 vala: add -Wno-error=incompatible-pointer-types work around
* to allow building vala-native on hosts with gcc-14
* we could backport:
  23ec71b1a5
  which is already included in scarthgap, but that's big patch doing almost the same

(From OE-Core rev: 0f850f213071d4bc3a7065334debabd32c7bd9a1)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-02 06:32:36 -07:00
Wang Mingyu
d3e106ba1e orc: upgrade 0.4.39 -> 0.4.40
Changelog:
===========
- Security: Minor follow-up fixes for CVE-2024-40897
- powerpc: fix div255w which still used the inexact substitution
- x86: work around old GCC versions (pre 9.0) having broken xgetbv
  implementations
- x86: consider MSYS2/Cygwin as Windows for ABI purposes only
- x86: handle unnatural and misaligned array pointers
- orccodemem: Assorted memory mapping fixes
- Fix include header use from C++
- Some compatibility fixes for Musl
- ppc: Disable VSX and ISA 2.07 for Apple targets
- ppc: Allow detection of ppc64 in Mac OS
- x86: Fix non-C11 typedefs
- meson: Fix detecting XSAVE on older AppleClang
- x86: try fixing AVX detection again by adding check for XSAVE
- Check return values of malloc() and realloc()

(From OE-Core rev: ec300eadd0ab51583502b833798a6b46956f0f47)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ed7e4eb12491968c5f962b7e89d557c2c6d86a33)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-02 06:32:36 -07:00
Peter Marko
6cac0cf4fe python3: ignore fixed CVEs
These CVEs were fixed in 3.10.15

Commit 487e8cdf1d removed patches in favor
of version upgrade, which caused the CVEs to re-appear in reports.

(From OE-Core rev: 2cf10084c56c83da3deff4e65e619afab80e08e1)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-02 06:32:36 -07:00
Yogita Urade
e50d61d7df qemu: fix CVE-2023-3019
A DMA reentrancy issue leading to a use-after-free error
was found in the e1000e NIC emulation code in QEMU. This
issue could allow a privileged guest user to crash the
QEMU process on the host, resulting in a denial of service.

CVE-2023-3019-0002 is the CVE fix and CVE-2023-3019-0001
is dependent CVE fix.

fix indent issue in qemu.inc file.

CVE-2023-3019 patch required Mem ReenttranceyGuard structure
definition, it's defined in commit:
a2e1753b80
but the patch is causing errors:
Failed: qemux86 does not shutdown within timeout(120)
so backported only required structure definition.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-3019

Upstream patches:
7d0fefdf81
3c0463a650

(From OE-Core rev: 3782e1b21882ffc5e4cc466418e066179470241e)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-11-02 06:32:36 -07:00
Khem Raj
dfe311ef7a syslinux: Disable error on implicit-function-declaration
syslinux has vendored copy of ext2fs/ext2_fs.h but uses ext2fs/ext2fs.h
from e2fsprogs package, however, ext2fs/ext2fs.h has dependencies on
ext2fs/ext2_fs.h coming from e2fsprogs package as these both headers
come from same package, here syslinux uses ext2fs.h from e2fsprogs but
supplies its own copy of ext2_fs.h which maybe out of sync and that
results in warnings about implicit implicit-function-declarations
e.g.

recipe-sysroot/usr/include/ext2fs/ext2fs.h:727:16: error: implicit declaration of function 'ext2fs_has_feature_gdt_csum' [-Wimplicit-function-declaration]
|   727 |                ext2fs_has_feature_gdt_csum(fs->super);
|       |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~

ext2fs_has_feature_gdt_csum here comes from newer version of
ext2fs/ext2_fs.h but missing from vendored copy, hence the warning.

With gcc-14 this warning is treated as error by default, which breaks
the build, so lets treat it as warning only.

All these functions are never used in syslinux, so functionality-wise we
are fine.

(From OE-Core rev: 14fdee535c37aaa44898dc22149004c97b2456ca)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a2b30108055e68b62fdad7319d7d569bc38a07b4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-24 06:31:58 -07:00
Peter Marko
87ebb58a64 gcc: ignore CVE-2023-4039
Last version bump removed patch for this CVE because it was integrated
in new release. This has caused the CVE to reappear in reports because
2023-09-12 is "higher" than 11.5...

(From OE-Core rev: d74fd7c4e9353fc00f0b79f05de101efb0148a6f)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-24 06:31:58 -07:00
Steve Sakoman
2589544ca8 valgrind: disable avx_estimate_insn.vgtest
This test fails consistently on the new valkyrie autobuilder cluster

The estimate instructions (rcpss, rcpps, rsqrtps, rsqrtss) are, as the
name suggests, not expected to give a fully accurate result. They may
produce slighly different results on different CPU families because
their results are not defined by the IEEE standard.

(From OE-Core rev: 9269edb63d3c68de62326f5960ffff0c1068e709)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-12 05:17:58 -07:00
Martin Jansa
3a89e6d7cb cdrtools-native: fix build with gcc-14
Fixes:
http://errors.yoctoproject.org/Errors/Details/770525/
| checking whether the C compiler (gcc  -isystem/OE/build/oe-core/tmp-glibc/work/x86_64-linux/cdrtools-native/3.01/recipe-sysroot-native/usr/include -O2 -pipe ) works... no
| configure: error: installation or configuration problem: C compiler cannot create executables.
| RULES/rules.cnf:70: incs/amd-ryzen-threadripper-3970x-32-core-processor-linux-cc/rules.cnf: No such file or directory
| make: *** [RULES/rules.cnf:59: incs/amd-ryzen-threadripper-3970x-32-core-processor-linux-cc/rules.cnf] Error 1
| make: *** Waiting for unfinished jobs....

where config.log show it's caused by gcc-14:

configure:1189: checking whether the C compiler (gcc  -isystem/OE/build/oe-core/tmp-glibc/work/x86_64-linux/cdrtools-native/3.01/recipe-sysroot-native/usr/include -O2 -pipe ) works
configure:1211: gcc  -o conftest -isystem/OE/build/oe-core/tmp-glibc/work/x86_64-linux/cdrtools-native/3.01/recipe-sysroot-native/usr/include -O2 -pipe  -D_GNU_SOURCE  conftest.c   1>&5
configure:1208:1: error: return type defaults to 'int' [-Wimplicit-int]
configure: failed program was:

main(){return(0);}

(From OE-Core rev: 6fd1bc0620e6d6ce9b940eaeb68474f4d0b9369b)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 094273bd7d1768e14fbdcd2f239bee14c630a625)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-10-12 05:17:58 -07:00