Commit Graph

69317 Commits

Author SHA1 Message Date
Christos Gavros
304b1b285b ref-manual/variables.rst: document the IMAGE_ROOTFS_MAXSIZE variable
This variable specifies the maximum allowed size
of the generated image in kilobytes.

CC: Yoann Congal <yoann.congal@smile.fr>
CC: Randy MacLeod <randy.macleod@windriver.com>
CC: Antonin Godard <antonin.godard@bootlin.com>
CC: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: ca56f1002f8d198c0626e87412f33906e13a2761)

Signed-off-by: Christos Gavros <gavrosc@yahoo.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit f3ddc92081363aa7ef7d4fc2c3b918f32f7bda05)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Trevor Woerner
7dfd7de941 sphinx-lint: unbalanced inline literal markup
Fix as many instances of unbalanced-inline-literals-delimiters as reported
by 'make sphinx-lint' as possible. Sphinx and/or its linter seem to get
tripped up randomly when references contain links to heading which contain
literals enclosed in double-back-tics, and not all of them can be "fixed"
to pass both building and linting.

(From yocto-docs rev: 2c1e5b080ad5e62d8283d332cbc473fd2d59c6e6)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Trevor Woerner
d2de20a4b6 sphinx-lint: role missing opening tag colon
Fix all instances missing-space-before-role as reported by 'make sphinx-lint'.

(From yocto-docs rev: 255bfc8c195bbc84a78a4985cf2775c87e525794)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Trevor Woerner
32712b2a6b sphinx-lint: trailing whitespace
Fix all instances of trailing-whitespace as reported by 'make sphinx-lint'.

(From yocto-docs rev: 7776550a190060221a8cc913e470edf5349b6829)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Trevor Woerner
38e33dedee ref-manual/variables.rst: document WIC_CREATE_EXTRA_ARGS
Fixes [YOCTO #15509]

Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: 8e893cc8cabba4b4f21556561d1ca9656ca1ff9f)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit f1cdecb6da91dbfac59359c83038cb4a4c36ad0a)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Trevor Woerner
40232dc020 contributor-guide/submit-changes: encourage patch version changelogs
Add a section after the 'git format-patch' information encouraging developers
to add patch version changelogs to their patch updates.

(From yocto-docs rev: a9f9d53fa4a29e3cf846868567190425ffed8bf0)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 2e3a37c4607b296956993e557d1786c4876e5722)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Adrian Freihofer
7888d6459e ref-manual: kernel-fitimage.bbclass does not use SPL_SIGN_KEYNAME
The kernel-fitimage.bbclass uses the UBOOT_* variables. The SPL_*
variables are handled by uboot-sign.bbclass.

(From yocto-docs rev: 1383a1fac59b9aa02bde2a0c63a6f480807492e1)

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 8ceffee908a039deb1021361faa7637e83ef26f3)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Lee Chee Yang
ac7af3f00b migration-guides: add release notes for 4.0.26
(From yocto-docs rev: 12ef53ea657c3d36c3c59d492c20123e36001628)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 656dc03101705bba718517b7017f71ce00541b72)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Antonin Godard
36432822b1 ref-manual/release-process: update releases.svg
- Add the future "Whinlatter" (5.3) and "Wrynose" (6.0) releases.
- Make the "Walnascar" release a current release.
- Update the month in Current.

(From yocto-docs rev: b60476dd7b056d7b5dd48ac7fce943b4e3542277)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit adb8573b54626e033921a9f4e3db259312b79207)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Antonin Godard
72c9483d9d test-manual/intro: remove Buildbot version used
The version has changed now (3.10.12 as of writing). Avoid having to
maintain this information by removing the version info from the intro.
Also fix a typo ("uses now uses") and give a link to yocto-autobuilder2.

Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: c404868285bfeb64600e70650483c664a8eb9574)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 1ed64dbdf4a60b000305cdc2c67dc24f4bc97ef7)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Antonin Godard
ce1cefc347 dev-manual/sbom.rst: fix wrong build outputs
This document was written with SPDX 3.0 in mind (create-spdx-3.0 class)
on OE-Core's master, but Kirkstone only supports SPDX 2.2 (named simply
create-spdx).

The create-spdx class only generate a tar.zst output, so remove the
other outputs listed here.

Also, ancillary outputs are not only deployed in tmp/deploy/spdx/MACHINE
but tmp/deploy/spdx in general.

(From yocto-docs rev: 25b5ec4c71c97228f8386f5b6c4fbe272c207ed6)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Sundeep KOKKONDA
c6cd61f1a2 gcc: AArch64 - Fix strict-align cpymem/setmem
The cpymemdi/setmemdi implementation doesn't fully support strict alignment.
Block the expansion if the alignment is less than 16 with STRICT_ALIGNMENT.
Clean up the condition when to use MOPS. (PR103100)

The original patch for GCC 12 removed MOPS & SIMD conditionals for setmem and
cpymem expansions in aarch64.md file. However, this version for GCC 11 does not
backport the SIMD & MOPS-related changes and retains the conditions in aarch64.md
file to preserve correctness and compatibility with the GCC 11 backend.

All changes and outputs have been verified by the author.

Upstream-Status: Backport [https://gcc.gnu.org/cgit/gcc/commit/?id=b9d16d8361a9e3a82a2f21e759e760d235d43322]

(From OE-Core rev: a99a65632116955dc69809a14bf536b22582de72)

Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Virendra Thakur
aee1d45a83 util-linux: Add fix to isolate test fstab entries using CUSTOM_FSTAB
During ptest execution, util-linux adds mount entries in /etc/fstab
and runs `mount -a`, which mounts all available entries from
/etc/fstab. This can cause unintended mounts that are unrelated to
the test, leading to incorrect test behavior.

To avoid this, upstream util-linux introduced a mechanism using
CUSTOM_FSTAB,which isolates test-specific fstab entries. Only entries
listed in CUSTOM_FSTAB are mounted during test execution, ensuring
tests do not interfere with or depend on the system's /etc/fstab.

This commit backports below upstream changes to use CUSTOM_FSTAB.
ed3d33faff
b1580bd760
6aa8d17b6b

(From OE-Core rev: 94747fb63518bf907eb7c09fc2e146e39e235a7d)

Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Divya Chellam
32d2b233c6 ruby: fix CVE-2025-27221
In the URI gem before 1.0.3 for Ruby, the URI handling methods
(URI.join, URI#merge, URI#+) have an inadvertent leakage of
authentication credentials because userinfo is retained even
after changing the host.

Reference:
https://security-tracker.debian.org/tracker/CVE-2025-27221

Upstream-patches:
3675494839
2789182478

(From OE-Core rev: c77ff1288719d90ef257dfe28cb33b3768fc124a)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Praveen Kumar
097732e057 glib-2.0: fix CVE-2025-4373
A flaw was found in GLib, which is vulnerable to an integer overflow
in the g_string_insert_unichar() function. When the position at which
to insert the character is large, the position will overflow, leading
to a buffer underwrite.

References:
https://nvd.nist.gov/vuln/detail/CVE-2025-4373
https://security-tracker.debian.org/tracker/CVE-2025-4373

Upstream-patches:
cc647f9e46
4d435bb480

(From OE-Core rev: 7a7319745637d4b681935ae71706dcc467df3040)

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Vijay Anusuri
ef632f4693 libsoup-2.4: Fix CVE-2025-32914
import patch from debian to fix
 CVE-2025-32914

Upstream-Status: Backport [import from debian https://salsa.debian.org/gnome-team/libsoup/-/tree/debian/bullseye/debian/patches?ref_type=heads
Upstream commit 5bfcf81575]

Reference:
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/450
https://security-tracker.debian.org/tracker/CVE-2025-32914

(From OE-Core rev: 8996e178264cf6bf9b69365172f43a5ee8e9f727)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Vijay Anusuri
cbbea14280 libsoup-2.4: Fix CVE-2025-32912
Upstream-Status: Backport from
cd077513f2
& 910ebdcd3d

(From OE-Core rev: e66218f6cda7de046bace6880ea5052900fd6605)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Vijay Anusuri
d8278fd9f9 libsoup-2.4: Fix CVE-2025-32911 & CVE-2025-32913
Upstream-Status: Backport from
7b4ef0e004
& f4a761fb66

(From OE-Core rev: ff1896b14347c7b4a166716338d3822da97be2e4)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Vijay Anusuri
21bb9c063b libsoup-2.4: Fix CVE-2025-32910
import patch from debian to fix
 CVE-2025-32910

Upstream-Status: Backport [import from debian https://salsa.debian.org/gnome-team/libsoup/-/tree/debian/bullseye/debian/patches?ref_type=heads
Upstream commit e40df6d48a
&
405a8a3459
&
ea16eeacb0]

Reference:
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/417
https://security-tracker.debian.org/tracker/CVE-2025-32910

(From OE-Core rev: b65e3d3a4dc2375d9bb81c7a91c84139cc667a47)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Ashish Sharma
0f58759f1b libsoup-2.4: Fix CVE-2025-46420
Upstream-Status: Backport [c9083869ec]

(From OE-Core rev: f0d5d13b0b7b2cf3f60c85b0c135fd948c648256)

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Praveen Kumar
23a8405509 connman :fix CVE-2025-32366
In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length
that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen)
and memcpy(response+offset,*end,*rdlen) without a check for whether
the sum of *end and *rdlen exceeds max. Consequently, *rdlen may be
larger than the amount of remaining packet data in the current state
of parsing. Values of stack memory locations may be sent over the
network in a response.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-32366

Upstream-patch:
https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=8d3be0285f1d4667bfe85dba555c663eb3d704b4

(From OE-Core rev: 1b9156124b4a07e0e3e0ab09e87d654eae6c7b4e)

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Yi Zhao
7f043fb4bb iputils: Security fix for CVE-2025-47268
CVE-2025-47268
ping in iputils through 20240905 allows a denial of service (application
error or incorrect data collection) via a crafted ICMP Echo Reply
packet, because of a signed 64-bit integer overflow in timestamp
multiplication.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-47268

Patch from:
070cfacd73

(From OE-Core rev: a463c8e3950ccf58316d48241c2cd82484f25fda)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Vijay Anusuri
0fa8a4465e openssh: Fix CVE-2025-32728
Upstream-Status: Backport [fc86875e6a]

(From OE-Core rev: 68413e1413eb87254d68f30920574b0e2c766782)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-28 08:46:32 -07:00
Steve Sakoman
ab9a994a8c build-appliance-image: Update to kirkstone head revision
(From OE-Core rev: e8be08a624b2d024715a5c8b0c37f2345a02336b)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
yocto-4.0.27 kirkstone-4.0.27
2025-05-16 09:02:55 -07:00
Steve Sakoman
5dad8173d4 poky.conf: bump version for 4.0.27
(From meta-yocto rev: ff73566d1786b524ec8c809bf641b0b74d85b512)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:59:59 -07:00
Alexander Kanavin
d6a242831e perl: enable _GNU_SOURCE define via d_gnulibc
This is needed to properly support memmem() and friends under musl
as musl guards the declarations with _GNU_SOURCE define, and if the
declarations are not present, gcc will issue warnings and generate
assembly that assumes the functions return int (instead of e.g.
void*), with catastrophic consequences at runtime.

(From OE-Core rev: 79dc3f42958bfefe03a8240e2a57501c38d2bd3c)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6422e62fbc5c65a2165a72c97c880cfa9a80e957)
Signed-off-by: Peter Hurley <peter@meraki.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Alon Bar-Lev
06b97d608e module.bbclass: add KBUILD_EXTRA_SYMBOLS to install
Symbols are used during install as well, adding KBUILD_EXTRA_SYMBOLS enables
successful installation.

    | DEBUG: Executing shell function do_install
    | NOTE: make -j 22 KERNEL_SRC=xxx/kernel-source -C xxx/drivers
    KDIR=xxx/kernel-source DEPMOD=echo
    MODLIB=xxx/image/lib/modules/6.6.75-yocto-standard-00189-g530c419bc9db
    INSTALL_FW_PATH=xxx/image/lib/firmware CC=aarch64-poky-linux-gcc
    -fuse-ld=bfd -fcanon-prefix-map  LD=aarch64-poky-linux-ld.bfd
    OBJCOPY=aarch64-poky-linux-objcopy  STRIP=aarch64-poky-linux-strip
    O=xxx/kernel-build-artifacts modules_install
    | make: Entering directory 'xxx/drivers'
    | make -C xxx/kernel-source M=xxx/drivers modules
    | make[1]: Entering directory 'xxx/kernel-source'
    | make[2]: Entering directory 'xxx/kernel-build-artifacts'
    |   MODPOST xxx/drivers/Module.symvers
    | ERROR: modpost: "xxx" [xxx/xxx.ko] undefined!

(From OE-Core rev: 1403ffa42014ad5c88c28da6c360ea5fd1857147)

Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0ef80eeda967a9e04ff91c3583aabbc35c9868e8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Deepesh Varatharajan
ae5264cac3 glibc: stable 2.35 branch updates
d2febe7c40 math: Improve layout of exp/exp10 data
20b5d5ce26 AArch64: Use prefer_sve_ifuncs for SVE memset
9569a67a58 AArch64: Add SVE memset
59f67e1b82 math: Improve layout of expf data
904c58e47b AArch64: Remove zva_128 from memset
8042d17638 AArch64: Optimize memset
be451d6053 AArch64: Improve generic strlen
8b3d09dc0d assert: Add test for CVE-2025-0395
29d9b1e59e assert: Reformat Makefile.

Testresults:
Before update	|After update	 |Difference
PASS:  4832	|PASS:4833  	 |PASS:  +1
FAIL:  132	|FAIL:132	 |FAIL:  0
XPASS: 6	|XPASS:6 	 |XPASS: 0
XFAIL: 16	|XFAIL:16 	 |XFAIL: 0
UNSUPPORTED: 200|UNSUPPORTED:200 |UNSUPPORTED: 0

(From OE-Core rev: 70e9ae425e34221af6a7bdda6b83f2f8e7848278)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Aleksandar Nikolic
01292aba34 scripts/install-buildtools: Update to 4.0.26
Update to the 4.0.26 release of the 4.0 series for buildtools

(From OE-Core rev: 04ff268291598c1e0588cff43df694a714e48746)

Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Vijay Anusuri
45c3cde26b libsoup: Fix CVE-2025-32914
Upstream-Status: Backport
[5bfcf81575]

(From OE-Core rev: ce7cda16d823012f71d91c820083b0da93762d9d)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Vijay Anusuri
3f1cc96cb9 libsoup: Fix CVE-2025-32912
Upstream-Status: Backport from
cd077513f2
& 910ebdcd3d

(From OE-Core rev: 7c709d985c4e732f6fedd56748b3de3e52869282)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Vijay Anusuri
d8c4c5ea04 libsoup: Fix CVE-2025-32911 & CVE-2025-32913
Upstream-Status: Backport from
7b4ef0e004
& f4a761fb66

(From OE-Core rev: e79585ab2a492a5023bce637cbe519fcd1370e04)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Vijay Anusuri
fe91f67d38 libsoup: Fix CVE-2025-32910
Upstream-Status: Backport from
e40df6d48a
&
405a8a3459
& ea16eeacb0

(From OE-Core rev: aeaa106595f173f5646a17adb413a85e0d01887e)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Vijay Anusuri
cc7f7f1c29 libsoup: Fix CVE-2025-32909
Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/comm
it/ba4c3a6f988beff59e45801ab36067293d24ce92

(From OE-Core rev: 491373828c1c66030fb41687f9a42b9e4deb010b)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Vijay Anusuri
dc621121b1 libsoup: Fix CVE-2025-32906
Upstream-Status: Backport from
1f509f31b6
& af5b9a4a39

(From OE-Core rev: 17fbb56b3cbea445767cba988f3db5b32fb00b71)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Vijay Anusuri
14f293eecf libsoup: update fix CVE-2024-52532
Upstream-Status: Backport from 4c9e75c667

(From OE-Core rev: caf0ac894d029aaac7d746fe87db1aa0e8c3c93f)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Vijay Anusuri
e07ed2059c libsoup-2.4: Fix CVE-2025-32909
Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/comm
it/ba4c3a6f988beff59e45801ab36067293d24ce92

(From OE-Core rev: ad1244ee75b4169eab21c2c8744b86342b32dd07)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Vijay Anusuri
6b27d84c2c libsoup-2.4: Fix CVE-2025-32906
Upstream-Status: Backport from
1f509f31b6
& af5b9a4a39

(From OE-Core rev: 2b938dd6beb1badca59804ffbe395deb679bc1b1)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Vijay Anusuri
02c2876c5e libsoup-2.4: Update fix CVE-2024-52532
Upstream-Status: Backport from 4c9e75c667

(From OE-Core rev: 144d067ed5b98b8ca477a6a0e8c958c0b15e9643)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Peter Marko
b497f2caf7 perl: patch CVE-2024-56406
Pick patch mentioned in NVD links for this CVE.
Tested by runniing ptest and CVE reproducer (before&after).
Ptest fails on test dist/threads/t/join, however the same test also
fails without this patch.

(From OE-Core rev: 8e3c821e9ce8f3a9667847a284bc5a6f4973ea13)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-16 08:58:06 -07:00
Haixiao Yan
8c0982c306 glibc: Add single-threaded fast path to rand()
Backport a patch [1] to improve performance of rand() and __random()[2]
by adding a single-threaded fast path.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=be0cfd848d9ad7378800d6302bc11467cf2b514f
[2] https://sourceware.org/bugzilla/show_bug.cgi?id=32777
(From OE-Core rev: 00f7a2f60dd6de95a1a47fa642978613ce76dc56)

Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 06:38:22 -07:00
Peter Marko
cdca0c82f7 qemu: ignore CVE-2023-1386
Upstream Repository: https://gitlab.com/qemu-project/qemu.git

Bug Details:  https://nvd.nist.gov/vuln/detail/CVE-2023-1386
Type: Security Advisory
CVE: CVE-2023-1386
Score: 3.3

Analysis:
- According to redhat[1] this CVE has closed as not a bug.

Reference:
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2223985

(From OE-Core rev: 6a5d9e3821246c39ec57fa483802e1bb74fca724)

(From OE-Core rev: f7c8877395d4ec0a91cd5cf54e6c2858495746fb)

Signed-off-by: Madhu Marri <madmarri@cisco.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

(Converted to old CVE_CHECK_IGNORE syntax)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 06:38:22 -07:00
Hitendra Prajapati
03a2733983 busybox: fix CVE-2023-39810
Upstream-Status: Backport from https://git.busybox.net/busybox/commit/?id=9a8796436b9b0641e13480811902ea2ac57881d3

(From OE-Core rev: c0b71ec35716a512915b00808a26f77481db0e0a)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 06:38:22 -07:00
Praveen Kumar
9b99800fe7 connman :fix CVE-2025-32743
In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c
can be NULL or an empty string when the TC (Truncated) bit is set in
a DNS response. This allows attackers to cause a denial of service
(application crash) or possibly execute arbitrary code, because those
lookup values lead to incorrect length calculations and incorrect
memcpy operations.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-32743

Upstream-patch:
https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d90b911f6760959bdf1393c39fe8d1118315490f

(From OE-Core rev: ece0fb01bf28fa114f0a6e479491b4b6f565c80c)

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 06:38:21 -07:00
Peter Marko
73c2187fbc ghostscript: ignore CVE-2024-29507
Fix for this CVE is [3] (per [1] and [2]).
It fixes cidfsubstfont handling which is not present in 9.55.0 yet.
It was introduced (as cidsubstpath) in 9.56.0 via [4] and later modified
to cidfsubstfont in [5].
Since this recipe has version 9.55.0, mark it as not affected yet.

[1] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=7745dbe24514710b0cfba925e608e607dee9eb0f
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-29507
[3] https://security-tracker.debian.org/tracker/CVE-2024-29507
[4] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=82efed6cae8b0f2a3d10593b21083be1e7b1ab23
[5] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=4422012f6b40f0627d3527dba92f3a1ba30017d3

(From OE-Core rev: 5c9f3c244971aadee65a98d83668e3d5d63825a0)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 06:38:21 -07:00
Peter Marko
235e74ba09 ghostscript: ignore CVE-2025-27837
This CVE only impacts codepaths relevant for Windows builds.
Se [1] from Debian which marks it as not applicable.

[1] https://security-tracker.debian.org/tracker/CVE-2025-27837

(From OE-Core rev: fb5dc4a476bc4054493d6a7eb64a423e3665afb9)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-14 06:38:21 -07:00
Antonin Godard
e9e862752d Fix dead links that use the DISTRO macro
After introducing the DISTRO_LATEST_TAG and DISTRO_REL_LATEST_TAG
macros, use them in links that currently use DISTRO/DISTRO_REL_TAG. When
building for the tip of a branch, this will replace the current A.B.999
in links to the latest existing tag.

The links were found across the documentation by running 'grep -r
"http.*5\.2\.999"' inside the _build/html output after building the
docs.

[YOCTO #14802]

(From yocto-docs rev: 0d51e553d5f83eea6634e03ddc9c7740bf72fcea)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 29be069ebbf2c55d72fc51d99ed5a558af37c05e)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-02 08:12:41 -07:00
Antonin Godard
dc41858fe3 poky.yaml: introduce DISTRO_LATEST_TAG
Introduce the DISTRO_LATEST_TAG macro, which should always point to the
latest existing tag in the documentation, unlike DISTRO which may point
to A.B.999 to represent the tip of a branch.

This variable is needed to fix dead links in the documentation that
currently use the DISTRO macro.

Also, make DISTRO_REL_TAG use the DISTRO macro directly, to avoid
repetition, and add a DISTRO_REL_LATEST_TAG macro that has the same role
as DISTRO_LATEST_TAG but with "yocto-" prepended to it.

In set_versions.py, run the "git describe --abbrev=0 --tags
--match='yocto-*'" command to get the latest existing tag on the
currently checked out commit. Fallback to ourversion in case we didn't
find any.

(From yocto-docs rev: 9fabb08405601646fd9b00326442e03d43f68804)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit a85b0e500c94921f77fa7b7dbb877e4945f96d1e)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-02 08:12:41 -07:00
Andrew Kreimer
8c784f9287 manuals: remove repeated word
The word "modern" appears twice, remove the extra one.

(From yocto-docs rev: db02bc7eb59feaece5d2a07b3586fd41c7a73a1e)

Signed-off-by: Andrew Kreimer <algonell@gmail.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-02 08:12:41 -07:00
Antonin Godard
c6b1489d98 ref-manual/variables.rst: document autotools class related variables
Document the AUTOTOOLS_SCRIPT_PATH and the CONFIGURE_SCRIPT variables.

(From yocto-docs rev: f7721ff5312b1ebf87dd374db22b254913879ff0)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-02 08:12:41 -07:00