Compare commits

...

185 Commits

Author SHA1 Message Date
Steve Sakoman
72983ac391 build-appliance-image: Update to scarthgap head revision
(From OE-Core rev: 6988157ad983978ffd6b12bcefedd4deaffdbbd1)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2026-01-02 07:00:05 -08:00
Steve Sakoman
828c9d09b4 poky.conf: bump version for 5.0.15
(From meta-yocto rev: 9bb6e6e8b016a0c9dfe290369a6ed91ef4020535)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2026-01-02 06:56:54 -08:00
Vijay Anusuri
795103a538 go: Fix CVE-2025-61729
Upstream-Status: Backport from 3a842bd5c6

(From OE-Core rev: 2d6d68e46a430a1dbba7bd8b7d37ff56f4f5a0e6)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2026-01-02 06:56:54 -08:00
Vijay Anusuri
d3c87dc830 go: Fix CVE-2025-61727
Upstream-Status: Backport from 04db77a423

(From OE-Core rev: 647e151485bd10a8bbbdbae4825791723c9a5d8e)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2026-01-02 06:56:54 -08:00
Vijay Anusuri
a5cecb013b go: Update CVE-2025-58187
Upstream-Status: Backport from ca6a5545ba

(From OE-Core rev: 2d6b089de3ef5e062d852eb93e3ff16997e796ef)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2026-01-02 06:56:54 -08:00
Changqing Li
a4841fb5a2 libsoup: fix CVE-2025-12105
Refer:
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/481

(From OE-Core rev: 1ac9ad3faf022684ae709f4494a430aee5fb9906)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2026-01-02 06:56:54 -08:00
Jiaying Song
17a65b334d grub: fix CVE-2025-54770 CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664
References:
https://nvd.nist.gov/vuln/detail/CVE-2025-54770
https://nvd.nist.gov/vuln/detail/CVE-2025-61661
https://nvd.nist.gov/vuln/detail/CVE-2025-61662
https://nvd.nist.gov/vuln/detail/CVE-2025-61663
https://nvd.nist.gov/vuln/detail/CVE-2025-61664

(From OE-Core rev: c28fa3e6421257f50d4ae283cca28fadb621f831)

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2026-01-02 06:56:54 -08:00
Martin Jansa
52ba7ab020 cross.bbclass: Propagate dependencies to outhash
Similar to what native and staging is doing since:
https://git.openembedded.org/openembedded-core/commit/meta/classes/native.bbclass?id=d6c7b9f4f0e61fa6546d3644e27abe3e96f597e2
https://git.openembedded.org/openembedded-core/commit/meta/classes/staging.bbclass?id=1cf62882bbac543960e4815d117ffce0e53bda07

Cross task outputs can call native dependencies and even when cross
recipe output doesn't change it might produce different results when
the called native dependency is changed, e.g. clang-cross-${TARGET_ARCH}
contains symlink to clang binary from clang-native, but when clang-native
outhash is changed, clang-cross-${TARGET_ARCH} will still be considered
equivalent and target recipes aren't rebuilt with new clang binary, see
work around in https://github.com/kraj/meta-clang/pull/1140 to make target
recipes to depend directly not only on clang-cross-${TARGET_ARCH} but
clang-native as well.

I have added a small testcase in meta-selftest which demostrates this issue.
Not included in this change, but will send it if useful.

openembedded-core $ ls -1 meta-selftest/recipes-devtools/hashequiv-test/
print-datetime-link-cross.bb
print-datetime-link-native.bb
print-datetime-native.bb
print-datetime-usecross.bb
print-datetime-usenative.bb

print-datetime-native provides script which prints defined PRINT_DATETIME variable.

print-datetime-link-native and print-datetime-link-cross both provide a symlink to
the script from print-datetime-native.

print-datetime-usenative and print-datetime-usecross are target recipes using the
native and cross versions of print-datetime-link-* recipe.

  # clean build all is rebuilt:
  $ bitbake -k print-datetime-usenative print-datetime-usecross
  WARNING: print-datetime-native-1.0-r0 do_install: print-datetime-native current DATETIME in script is 2025-11-13_20_05
  WARNING: print-datetime-link-native-1.0-r0 do_install: print-datetime-link-native current DATETIME in symlink is 2025-11-13_20_05
  WARNING: print-datetime-link-cross-x86_64-1.0-r0 do_install: print-datetime-link-cross-x86_64 current DATETIME in symlink is 2025-11-13_20_05
  WARNING: print-datetime-usenative-1.0-r0 do_install: print-datetime-usenative current DATETIME from print-datetime-link is 2025-11-13_20_05
  WARNING: print-datetime-usecross-1.0-r0 do_install: print-datetime-usecross current DATETIME from print-datetime-link is 2025-11-13_20_05

  # keep sstate-cache and hashserv.db:
  # print-datetime-usenative is correctly rebuilt, because print-datetime-link-native has different hash (because print-datetime-native hash changed)
  # print-datetime-usecross wasn't rebuilt, because print-datetime-link-cross-x86_64 doesn't include the changed hash of print-datetime-native
  $ bitbake -k print-datetime-usenative print-datetime-usecross
  WARNING: print-datetime-native-1.0-r0 do_install: print-datetime-native current DATETIME in script is 2025-11-13_20_07
  WARNING: print-datetime-link-native-1.0-r0 do_install: print-datetime-link-native current DATETIME in symlink is 2025-11-13_20_07
  WARNING: print-datetime-link-cross-x86_64-1.0-r0 do_install: print-datetime-link-cross-x86_64 current DATETIME in symlink is 2025-11-13_20_07
  WARNING: print-datetime-usenative-1.0-r0 do_install: print-datetime-usenative current DATETIME from print-datetime-link is 2025-11-13_20_07

It's because print-datetime-link-cross-x86_64 depsig doesn't include print-datetime-native signature:

$ cat tmp/work/x86_64-linux/print-datetime-link-cross-x86_64/1.0/temp/depsig.do_populate_sysroot
OEOuthashBasic
18
SSTATE_PKGSPEC=sstate:print-datetime-link-cross-x86_64:x86_64-oe-linux:1.0:r0:x86_64:14:
task=populate_sysroot
drwx                                                                                       .
drwx                                                                                       ./recipe-sysroot-native
drwx                                                                                       ./recipe-sysroot-native/sysroot-providers
-rw-                   32 19fbeb373f781c2504453c1ca04dab018a7bc8388c87f4bbc59589df31523d07 ./recipe-sysroot-native/sysroot-providers/print-datetime-link-cross-x86_64
drwx                                                                                       ./recipe-sysroot-native/usr
drwx                                                                                       ./recipe-sysroot-native/usr/bin
drwx                                                                                       ./recipe-sysroot-native/usr/bin/x86_64-oe-linux
lrwx                                                                                       ./recipe-sysroot-native/usr/bin/x86_64-oe-linux/print-datetime-link -> ../print-datetime

While print-datetime-link-native doesn't have this issue, because print-datetime-native signature is there:

$ cat tmp/work/x86_64-linux/print-datetime-link-native/1.0/temp/depsig.do_populate_sysroot
OEOuthashBasic
18
print-datetime-native: 60f2734a63d708489570ca719413b4662f8368abc9f4760a279a0a5481e4a17b
quilt-native: 65d78a7a5b5cbbf0969798efe558ca28e7ef058f4232fcff266912d16f67a8b8
SSTATE_PKGSPEC=sstate:print-datetime-link-native:x86_64-linux:1.0:r0:x86_64:14:
task=populate_sysroot
drwx                                                                                       .
drwx                                                                                       ./recipe-sysroot-native
drwx                                                                                       ./recipe-sysroot-native/sysroot-providers
-rw-                   26 3d5458be834b2d0e4c65466b9b877d6028ae2210a56399284a23144818666f10 ./recipe-sysroot-native/sysroot-providers/print-datetime-link-native
drwx                                                                                       ./recipe-sysroot-native/usr
drwx                                                                                       ./recipe-sysroot-native/usr/bin
lrwx                                                                                       ./recipe-sysroot-native/usr/bin/print-datetime-link -> print-datetime

With the cross.bbclass fix the link-cross recipe has a checksum from native recipe as well:

$ cat tmp/work/x86_64-linux/print-datetime-link-cross-x86_64/1.0/temp/depsig.do_populate_sysroot
OEOuthashBasic
18
print-datetime-native: 9ceb6c27342eae6b8da86c84685af38fb8927ccc19979aae75b8b1e444b11c5c
quilt-native: 65d78a7a5b5cbbf0969798efe558ca28e7ef058f4232fcff266912d16f67a8b8
SSTATE_PKGSPEC=sstate:print-datetime-link-cross-x86_64:x86_64-oe-linux:1.0:r0:x86_64:14:
task=populate_sysroot
drwx                                                                                       .
drwx                                                                                       ./recipe-sysroot-native
drwx                                                                                       ./recipe-sysroot-native/sysroot-providers
-rw-                   32 19fbeb373f781c2504453c1ca04dab018a7bc8388c87f4bbc59589df31523d07 ./recipe-sysroot-native/sysroot-providers/print-datetime-link-cross-x86_64
drwx                                                                                       ./recipe-sysroot-native/usr
drwx                                                                                       ./recipe-sysroot-native/usr/bin
drwx                                                                                       ./recipe-sysroot-native/usr/bin/x86_64-oe-linux
lrwx                                                                                       ./recipe-sysroot-native/usr/bin/x86_64-oe-linux/print-datetime-link -> ../print-datetime

And print-datetime-usecross is correctly rebuilt whenever print-datetime-native output is different.

(From OE-Core rev: dccb7a185fe58a97f33e219b4db283ff4a2071d7)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Moritz Haase
d792f1a83e curl: Use host CA bundle by default for native(sdk) builds
Fixes YOCTO #16077

Commit 0f98fecd (a backport of 4909a46e) broke HTTPS downloads in opkg in the
SDK, they now fail with:

> SSL certificate problem: self-signed certificate in certificate chain

The root cause is a difference in the handling of related env vars between
curl-cli and libcurl. The CLI will honour CURL_CA_BUNDLE and SSL_CERT_DIR|FILE
(see [0]). Those are set in the SDK via env setup scripts like [1], so curl
continued to work. The library however does not handle those env vars. Thus,
unless the program utilizing libcurl has implemented a similar mechanism itself
and configures libcurl accordingly via the API (like for example Git in [2] and
[3]), there will be no default CA bundle configured to verify certificates
against.

Opkg only supports setting the CA bundle path via config options 'ssl_ca_file'
and 'ssl_ca_path'. Upstreaming and then backporting a patch to add env var
support is not a feasible short-time fix for the issue at hand. Instead it's
better to ship libcurl in the SDK with a sensible built-in default - which also
helps any other libcurl users.

This patch is based on a proposal by Peter.Marko@siemens.com in the related
mailing list discussion at [4].

(cherry picked from commit 3f819f57aa1960af36ac0448106d1dce7f38c050)

[0]: 400fffa90f/src/tool_operate.c (L2056-L2084)
[1]: https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl/curl/environment.d-curl.sh?id=3a15ca2a784539098e95a3a06dec7c39f23db985
[2]: 6ab38b7e9c/http.c (L1389)
[3]: 6ab38b7e9c/http.c (L1108-L1109)
[4]: https://lists.openembedded.org/g/openembedded-core/topic/115993530#msg226751

(From OE-Core rev: 0e553b685c0a987a7be1eee16b7b5e3e48a036e2)

Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de>
CC: matthias.schiffer@ew.tq-group.com
CC: Peter.Marko@siemens.com
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Enrico Jörns
1df6f0ae91 cml1.bbclass: use consistent make flags for menuconfig
The class called 'make menuconfig' without any of the make variables and
options set in EXTRA_OEMAKE, resulting in a quite different build
environment than actually intended.

For the kernel.bbclass this was fixed in commit 8c616bc0 ("kernel: Use
consistent make flags for menuconfig") by appending ${EXTRA_OEMAKE} to
KCONFIG_CONFIG_COMMAND.

Instead of fixing this individually for additional recipes, we simply
include ${EXTRA_OEMAKE} in KCONFIG_CONFIG_COMMAND by default.

For most class users, this change is directly visible in the generated
.config file:

* For barebox and u-boot, the CONFIG_GCC_VERSION erroneously reflected
  the host GCC version before where it now correctly reflects the target
  toolchain's GCC.

* For u-boot, also the "Compiler: " line at the beginning of the .config
  now prints the target toolchain instead of the host ones.

* The kernel had this already set.

* busybox did not produce any difference.

Note that these projects might base some compile-time decisions on e.g.
the actual compiler version used. Having the wrong one in the
menuconfig-generated .config affects at least the visibility and
consistency.

Reported-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
(From OE-Core rev: a7dd1c221e42fd8df1d6f1c76c6a5ab7a3e19542)

Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1b6ddd452837e67b500a84455a234f5edc8250a9)
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Kamel Bouhara (Schneider Electric)
12a7475659 oeqa/selftest: oe-selftest: Add SPDX tests for kernel config and PACKAGECONFIG
Add test_kernel_config_spdx and test_packageconfig_spdx to verify
SPDX document generation includes kernel configuration and package
feature metadata when enabled.

(From OE-Core rev: a172a0e8d543796ee78bb66650726168352f1cdf)

Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2f0ab110d7521510c60e0493ef3cb021130758cd)
Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Kamel Bouhara (Schneider Electric)
707dce4f01 spdx30_tasks: Add support for exporting PACKAGECONFIG to SPDX
Introduce the SPDX_INCLUDE_PACKAGECONFIG variable, which when enabled causes
PACKAGECONFIG features to be recorded in the SPDX document as build parameters.

Each feature is recorded as a DictionaryEntry with key PACKAGECONFIG:<feature>
and value enabled or disabled, depending on whether the feature is active in
the current build.

This makes the build-time configuration more transparent in SPDX output and
improves reproducibility tracking.

This makes the build-time configuration more transparent in SPDX output and
improves reproducibility tracking. In particular, it allows consumers of the
SBOM to identify enabled/disabled features that may affect security posture
or feature set.

Reviewed-by: Joshua Watt <JPEWhacker@gmail.com>
(From OE-Core rev: 5cfd0690f819379d9f97c86d2078c3e529efe385)

Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 7ec61ac40345a5c0ef1ce20513a4596989c91ef4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Kamel Bouhara (Schneider Electric)
6d222750d5 kernel.bbclass: Add task to export kernel configuration to SPDX
Introduce a new bitbake task do_create_kernel_config_spdx that extracts
the kernel configuration from ${B}/.config and exports it into the
recipe's SPDX document as a separate build_Build object.

The kernel config parameters are stored as SPDX DictionaryEntry objects
and linked to the main kernel build using an ancestorOf relationship.

This enables the kernel build's configuration to be explicitly captured
in the SPDX document for compliance, auditing, and reproducibility.

The task is gated by SPDX_INCLUDE_KERNEL_CONFIG (default = "0").

Reviewed-by: Joshua Watt <JPEWhacker@gmail.com>
(From OE-Core rev: 1fff29a0428778929ffa530482ebf7db95f1e0ae)

Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 228a968e7c47d811c06143279bdb0f9c5f374bef)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Aleksandar Nikolic
f327b4da74 scripts/install-buildtools: Update to 5.0.14
Update to the 5.0.14 release of the 5.0 series for buildtools

(From OE-Core rev: 4c85440cd95d9cd007ef4346ecc9580806526c96)

Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Mingli Yu
4faff2acb8 ruby: Upgrade 3.3.5 -> 3.3.10
Per ruby maintenance policy [1], the 3.3.x branch should be still in normal
maintenance, so upgrade to the latest version 3.3.10 to fix many security
issues and bugs.

Remove the fix for CVE-2025-27219, CVE-2025-27220 and CVE-2025-27221 as
these fixes have been included in the new version.

[1] https://www.ruby-lang.org/en/downloads/branches/

(From OE-Core rev: bad372ad8ec33334c6a74c077bf975851c1e59d2)

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Mingli Yu
fee180d783 libxslt: Fix CVE-2025-11731
Backport the patch [1] to fix CVE-2025-11731.

[1] fe508f201e

(From OE-Core rev: e70c70e0359418197699f18c9e2cbfd7ebac705d)

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Yash Shinde
d27f4a8879 binutils: fix CVE-2025-11840
CVE-2025-11840

PR 33455
[BUG] A SEGV in vfinfo at ldmisc.c:527
A reloc howto set up with EMPTY_HOWTO has a NULL name.  More than one
place emitting diagnostics assumes a reloc howto won't have a NULL
name.

https://sourceware.org/bugzilla/show_bug.cgi?id=33455

Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=f6b0f53a36820da91eadfa9f466c22f92e4256e0]

(From OE-Core rev: d477a67f623da424c3165bde25d76152636b1f50)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Yash Shinde
a247883e38 binutils: fix CVE-2025-11839
CVE-2025-11839

PR 33448
[BUG] Aborted in tg_tag_type at prdbg.c:2452
Remove call to abort in the DGB debug format printing code, thus allowing
the display of a fuzzed input file to complete without triggering an abort.

https://sourceware.org/bugzilla/show_bug.cgi?id=33448

Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=12ef7d5b7b02d0023db645d86eb9d0797bc747fe]

(From OE-Core rev: d60c144e082d6e6db4f9971bb886751199cd433f)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Deepesh Varatharajan
c65b128458 binutils: Fix CVE-2025-11494
Since x86 .eh_frame section may reference _GLOBAL_OFFSET_TABLE_, keep
_GLOBAL_OFFSET_TABLE_ if there is dynamic section and the output
.eh_frame section is non-empty.

Backport a patch from upstream to fix CVE-2025-11494
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a]

(From OE-Core rev: e087881bece2884f8d1a3c6d0dd7d69b40eb6732)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Daniel Turull
de3a6b0d24 cmake-native: fix CVE-2025-9301
Add fix for native recipe, since previous commit for cmake missed it.
5d8a6fb52c cmake: fix CVE-2025-9301

CC: Saravanan <saravanan.kadambathursubramaniyam@windriver.com>
CC: Steve Sakoman <steve@sakoman.com>
(From OE-Core rev: 24f831be7d99d5ea3fe304b9aa2d82e7e2d4a5fa)

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Jiaying Song
b9843e68be python3-urllib3: fix CVE-2025-66418 CVE-2025-66471
References:
https://nvd.nist.gov/vuln/detail/CVE-2025-66418
https://nvd.nist.gov/vuln/detail/CVE-2025-66471

(From OE-Core rev: d9f52c5f86bcc4716e384fe5c01c03d386d60446)

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Kai Kang
67ac024a29 qemu: fix CVE-2025-12464
Backport patch to fix CVE-2025-12464 for qemu.

Reference: https://gitlab.com/qemu-project/qemu/-/commit/a01344d9d7

(From OE-Core rev: c3108b279bd5c49a3c0ea35880fe7fd4f5b75b96)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Adarsh Jagadish Kamini
997f8de24c rsync: fix CVE-2025-10158
Fix an out-of-bounds read triggered by a malicious rsync client
acting as a receiver. The issue can be exploited with read access
to an rsync module.

CVE: CVE-2025-10158

(From OE-Core rev: 110933506d7a1177d1a074866d08fe0b0da612d7)

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Deepak Rathore
85e5f0fa1e cups 2.4.11: Fix CVE-2025-61915
Upstream Repository: https://github.com/OpenPrinting/cups.git

Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61915
Type: Security Fix
CVE: CVE-2025-61915
Score: 6.7
Patch: https://github.com/OpenPrinting/cups/commit/db8d560262c2

(From OE-Core rev: ca252aac4e50b7ed8864bf7482a86fe7129e737e)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Deepak Rathore
15a18fae40 cups 2.4.11: Fix CVE-2025-58436
Upstream Repository: https://github.com/OpenPrinting/cups.git

Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-58436
Type: Security Fix
CVE: CVE-2025-58436
Score: 5.5
Patch: https://github.com/OpenPrinting/cups/commit/5d414f1f91bd

(From OE-Core rev: 6a721aad5f531ac74996386cbaaa0173c2c5001a)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-31 07:49:31 -08:00
Peter Marko
553530a8ac Revert "lib/oe/go: document map_arch, and raise an error on unknown architecture"
This reverts commit e6de433ccb2784581d6c775cce97f414ef9334b1.

This introduced a breaking change which is not suitable for backport to
stable LTS branches.

(From OE-Core rev: 2b3d2b671a149cbeea2bdc9ba42192da2015c3b7)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-17 08:48:38 -08:00
Vijay Anusuri
719a5fe1e3 libssh2: fix regression in KEX method validation (GH-1553)
Resolves: https://github.com/libssh2/libssh2/issues/1553

Regression caused by
00e2a07e82

Backport fix
4beed72458

(From OE-Core rev: c348296ff0181921e8aa5a16d8d90db75f7b3e7c)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-17 08:48:38 -08:00
Vijay Anusuri
76d0c749da libssh2: upgrade 1.11.0 -> 1.11.1
Changelog: https://github.com/libssh2/libssh2/releases/tag/libssh2-1.11.1

Dropped CVE-2023-48795.patch which is already included in version 1.11.1

Resolves: https://github.com/libssh2/libssh2/issues/1326

License-Update: Copyright symbols were changed from (C) to lowercase (c)

ptest results:

root@qemux86-64:~# ptest-runner libssh2
START: ptest-runner
2025-12-08T12:37
BEGIN: /usr/lib/libssh2/ptest
PASS: mansyntax.sh
PASS: test_simple
PASS: test_sshd.test
DURATION: 6
END: /usr/lib/libssh2/ptest
2025-12-08T12:37
STOP: ptest-runner
TOTAL: 1 FAIL: 0

(From OE-Core rev: 71316433eb018e831d72a873365aa53ed04f14f4)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-17 08:48:38 -08:00
Peter Marko
f0d2110a32 libmicrohttpd: disable experimental code by default
Introduce new packageconfig to explicitly avoid compilation of
experimental code. Note that the code was not compiled by default also
before this patch, this now makes it explicit and makes it possible to
check for the flags in cve-check code.

This is less intrusive change than a patch removing the code which was
rejected in patch review.

This will solve CVE-2025-59777 and CVE-2025-62689 as the vulnerable code
is not compiled by default.
Set appropriate CVE status for these CVEs based on new packageconfig.

(From OE-Core rev: 9e3c0ae261afb7b9ff9528dbc147fb6c89d5a624)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-17 08:48:37 -08:00
Hitendra Prajapati
cc239ca412 libxml2: Security fix for CVE-2025-7425
CVE-2025-7425
libxslt: heap-use-after-free in xmlFreeID caused by `atype` corruption

Origin: https://launchpad.net/ubuntu/+source/libxml2/2.9.14+dfsg-1.3ubuntu3.6
Ref : https://security-tracker.debian.org/tracker/CVE-2025-7425

Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libxslt/-/issues/140

(From OE-Core rev: 315882f25ac3c5e5d210557fd863b3a0fff28850)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-17 08:48:37 -08:00
Peter Marko
0549c04c9f libpng: patch CVE-2025-66293
Pick patches per nvd report [1] and github advisory [2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-66293
[2] https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f

(From OE-Core rev: f5f0af82d8775180d76e6448a14f74cc70edf963)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-17 08:48:37 -08:00
Daniel Turull
8bddd959ff classes/create-spdx-2.2: Define SPDX_VERSION to 2.2
SPDX_VERSION is used in DEPLOY_DIR_SPDX but if is not defined,
will default to SPDX-1.1

Define SPDX_VERSION to have the correct deploy path, to align
with master branch behaviour.

The change in path was introduced in 8996d0899d

CC: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com>
CC: JPEWhacker@gmail.com
(From OE-Core rev: 04cc49593a0ba2c51e4f4d477d4587079735b624)

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-17 08:48:37 -08:00
Moritz Haase
9497778a4d curl: Ensure 'CURL_CA_BUNDLE' from host env is indeed respected
Due to what looks like a copy'n'paste mistake, the environment setup script
might override 'CURL_CA_BUNDLE' from the host env instead of leaving it
untouched. Fix that.

(cherry picked from commit 545e43a7a45be02fda8fc3af69faa20e889f58c4)

CC: changqing.li@windriver.com
CC: raj.khem@gmail.com
CC: Peter.Marko@siemens.com

(From OE-Core rev: ef198b0c6063ede32cb93fe44eb89937c076a073)

Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-05 07:13:42 -08:00
Peter Marko
295e960b85 libpng: patch CVE-2025-65018
Pick commit per NVD report.
Add two patches to apply it cleanly.

(From OE-Core rev: 4e03bed20bceb455cb46dcf9564ad5a8525b207d)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-05 07:13:42 -08:00
Peter Marko
ea30165e8b libpng: patch CVE-2025-64720
Pick commit per NVD report.

(From OE-Core rev: e8fbb7521e0113c467e07ba473a46612709c5311)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-05 07:13:42 -08:00
Peter Marko
eed16ae613 libpng: patch CVE-2025-64506
Pick commit per NVD report.

(From OE-Core rev: f3bdbd782eed2b597927df489a7d38a22fbba5ed)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-05 07:13:42 -08:00
Peter Marko
b0b3210686 libpng: patch CVE-2025-64505
Pick commit per NVD report.
Add two patches to apply it cleanly.

(From OE-Core rev: 285a495b8b0e8fa93a0a0884f466f1adca76a28a)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-05 07:13:42 -08:00
Praveen Kumar
792947d444 python3: fix CVE-2025-6075
If the value passed to os.path.expandvars() is user-controlled a
performance degradation is possible when expanding environment variables.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-6075

Upstream-patch:
9ab89c026a

(From OE-Core rev: 5313fa5236cd3943f90804de2af81358971894bc)

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-05 07:13:42 -08:00
Peter Marko
adc9e377c8 gnutls: patch CVE-2025-9820
This CVE is announced under [1].
Pick commit which mentions this CVE per [2].

[1] https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18
[2] https://security-tracker.debian.org/tracker/CVE-2025-9820

(From OE-Core rev: 37dcb0f617f02f95293455d58927e0da4e768cc4)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-05 07:13:42 -08:00
Peter Marko
e6bfeed8f3 libarchive: patch CVE-2025-60753
Pick patch from [3] marked in [2] mentioned in [1].

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-60753
[2] https://github.com/libarchive/libarchive/issues/2725
[3] https://github.com/libarchive/libarchive/pull/2787

(From OE-Core rev: 1fbd9eddbdf0da062df0510cabff6f6ee33d5752)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-01 07:34:55 -08:00
Peter Marko
842fd60ebb libarchive: patch 3.8.3 security issue 2
Pick patch [2] as listed in [1].

[1] https://github.com/libarchive/libarchive/releases/tag/v3.8.3
[2] https://github.com/libarchive/libarchive/pull/2768

(From OE-Core rev: efe032eef7034009f1202985b2036fc79e06bddf)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-01 07:34:55 -08:00
Peter Marko
03c1257cfd libarchive: patch 3.8.3 security issue 1
Pick patch [2] as listed in [1].
To apply it cleanly, add two additional patches from branch patch/3.8.

[1] https://github.com/libarchive/libarchive/releases/tag/v3.8.3
[2] https://github.com/libarchive/libarchive/pull/2753

(From OE-Core rev: 11f782c1ae9962a2faa98bff3566e49fbf6db017)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-01 07:34:55 -08:00
Benjamin Robin (Schneider Electric)
35a6ffc2db vex: fix rootfs manifest
Rootfs VEX file is created by gathering files from CVE_CHECK_DIR
(deploy directory), however recipes generate the files only in
CVE_CHECK_DIR (log directory).
This make the rootfs VEX be always empty without any message.

The code is copied from cve_check class, which writes to both, so let
keep them aligned and make also vex write both files.

Also add a warning for case that a cve file would be still missing.

(From OE-Core rev: 7493eeed6d53bc704f558a0ccf8a0b5195381873)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ee6541d0940c65685aaafd7d41a59a9406392e7d)
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-01 07:34:55 -08:00
Benjamin Robin (Schneider Electric)
86f11fe94f spdx: extend CVE_STATUS variables
If spdx is generated without inheriting cve/vex classes (which is poky
default), only explicitly set CVE_STATUS fields are handled.
Calculated ones (e.g. from CVE_STATUS_GROUPS) are ignored.

Fix this by expanding the CVE_STATUS in spdx classes.

(From OE-Core rev: 23a4e02542252657fa45fd4a605aec0af9178e0b)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ead9c6a8770463c21210a57cc5320f44f7754dd3)
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-01 07:34:55 -08:00
Benjamin Robin (Schneider Electric)
d1f8b0c6dd cve-check: extract extending CVE_STATUS to library function
The same code for extending CVE_STATUS by CVE_CHECK_IGNORE and
CVE_STATUS_GROUPS is used on multiple places.
Create a library function to have the code on single place and ready for
reuse by additional classes.

Conflicts:
  meta/classes/cve-check.bbclass
  meta/lib/oe/cve_check.py

(From OE-Core rev: ddd295c7d4c313fbbb24f7a5e633d4adfea4054a)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 45e18f4270d084d81c21b1e5a4a601ce975d8a77)
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-01 07:34:55 -08:00
Benjamin Robin (Schneider Electric)
cf3b1a7e6d vex.bbclass: add a new class
The "vex" class generates the minimum information that is necessary
for VEX generation by an external CVE checking tool. It is a drop-in
replacement of "cve-check". It uses the same variables from recipes
to make the migration and backporting easier.

The goal of this class is to allow generation of the CVE list of
an image or distribution on-demand, including the latest information
from vulnerability databases. Vulnerability data changes every day,
so a status generated at build becomes out-of-date very soon.

Research done for this work shows that the current VEX formats (CSAF
and OpenVEX) do not provide enough information to generate such
rolling information. Instead, we extract the needed data from recipe
annotations (package names, CPEs, versions, CVE patches applied...)
and store for later use in the format that is an extension of the
CVE-check JSON output format.

This output can be then used (separately or with SPDX of the same
build) by an external tool to generate the vulnerability annotation
and VEX statements in standard formats.

When back-porting this feature, the do_generate_vex() had to be modified
to use the "old" get_patched_cves() API.

(From OE-Core rev: 123a60bc19987e99d511b1f515e118022949be7e)

Signed-off-by: Marta Rybczynska <marta.rybczynska@syslinbit.com>
Signed-off-by: Samantha Jalabert <samantha.jalabert@syslinbit.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6352ad93a72e67d6dfa82e870222518a97c426fa)
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-01 07:34:55 -08:00
Benjamin Robin (Schneider Electric)
976648aa60 spdx30: provide all CVE_STATUS, not only Patched status
In scarthgap, the `oe.cve_check.get_patched_cves()` method only returns
CVEs with a "Patched" status. We want to retrieve all annotations,
including those with an "Ignored" status. Therefore, to avoid modifying
the current API, we integrate the logic for retrieving all CVE_STATUS
values ​​directly into `spdx30_task`.

(From OE-Core rev: 9a204670b1c0daedf1ed8ff944f8e5443b39c8f7)

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-01 07:34:55 -08:00
Kai Kang
91ba7b5d66 Revert "spdx: Update for bitbake changes"
This reverts part of commit 4859cdf97fd9a260036e148e25f0b78eb393df1e.

Modification of meta/classes/create-spdx-2.2.bbclass is not backported,
so no need to consider it.

In the commit, it updates spdx according to bitbake change. But the
bitbake commit

* 2515fbd10 fetch: Drop multiple branch/revision support for single git urls

doesn't backport for scarthgap.

So revert the other parts of the commit 4859cdf97fd9a260036e148e25f0b.

(From OE-Core rev: f3bfb98d1cf928678d9931308c116e9e6ec64ba5)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-12-01 07:34:54 -08:00
Lee Chee Yang
d71d81814a migration-guides: add release notes for 4.0.31
(From yocto-docs rev: b0f5cc276639916df197435780b3e94accd4af41)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 992d0725e8b4fdcdc2e9a101ce51ebef94a00112)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:36 -08:00
Ross Burton
e54c87a8b5 documentation: link to the Releases page on yoctoproject.org instead of wiki
We have a machine-generated Releases page[1] which is preferable to the
wiki.

[1] https://www.yoctoproject.org/development/releases/

(From yocto-docs rev: 5af5e64e42732c0919cad499e79ff35ca4255a86)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 46a9172fd17aa518028e35b8c874e74889079094)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:36 -08:00
Quentin Schulz
dfa0c8dc8b overview-manual: migrate to SVG + fix typo
The original PNG had a typo (YP-Comptible instead of YP-Compatible).

Instead of patching a PNG, let's migrate to an SVG with the typo already
fixed.

Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
(From yocto-docs rev: fd023b25026b562ff2de972a44bd2c773470208f)

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 9f3c2a9113b329f7efdd22d3b3fbe272a44bc654)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:36 -08:00
Quentin Schulz
00d09f8fd4 dev-manual: debugging: use bitbake-getvar in Viewing Variable Values section
We should recommend using bitbake-getvar command wherever possible as
its output is much less confusing and overwhelming than bitbake -e.

Unfortunately, bitbake-getvar currently doesn't list Python tasks or
functions, unlike bitbake -e, so keep the latter for some corner cases.

[AG: Moroever -> Moreover typo fix]

(From yocto-docs rev: 3f1ca1c3ef60dfabe5b2a2c6e53d14edad64fb06)

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 41e4e05369c4e028c679749b7b62434327927a09)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:36 -08:00
Quentin Schulz
1b8b7802d1 ref-manual: variables: migrate the OVERRIDES note to bitbake-getvar
Wherever possible, we should use bitbake-getvar as it's the recommended
tool so let's do that.

(From yocto-docs rev: b9453c7ce44a6bcae7cdc05f2b2cd47b525726e9)

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 2293a3f2767895e9fb5c3e8f3ec11bb4951a7127)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:36 -08:00
Quentin Schulz
bfa2803f8e kernel-dev: common: migrate bitbake -e to bitbake-getvar
It's recommended to use bitbake-getvar for a few releases now so let's
use that instead of bitbake -e.

While at it, use a cross-reference for "OpenEmbedded Build System".

(From yocto-docs rev: 29836a95c01cdb99c38802f55a92f32377b8c524)

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 54585646d8220f8de1ba2c7246cb3f2fcbc59583)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:36 -08:00
Lee Chee Yang
a6b0e3d404 migration-guides: add release notes for 5.0.13
(From yocto-docs rev: fefa33295b2b96d5bf91dfdec3c6e6913dbf1df2)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 5a6f63e955807d6aab4a9dbcb4560078c2cec77f)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:36 -08:00
Walter Werner SCHNEIDER
6906c4236f kernel-dev: add disable config example
Makes it more clear that the configuration fragment can also be used to
disable a configuration.

(From yocto-docs rev: a586a0ecacb4e40f4f3aeeb01dbefbdfcee8ae35)

Signed-off-by: Walter Werner SCHNEIDER <contact@schnwalter.eu>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit d38ef467081ee73bf23f240ace54b849a3a87612)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:36 -08:00
Robert P. J. Day
938b1ad77a dev-manual/new-recipe.rst: typo, "whith" -> "which"
Fix typo "whith", should be "which".

(From yocto-docs rev: bec165a3505f298b668bcf2a0f03fb8dcfccc510)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit f98b25f7f7522cf223beb001cabef870d6dd8c10)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:36 -08:00
Robert P. J. Day
e1453702a5 dev-manual/new-recipe.rst: replace 'bitbake -e' with 'bitbake-getvar'
Replace the legacy call to 'bitbake -e' to get the value of a recipe's
variable with the newer call to 'bitbake-getvar'.

(From yocto-docs rev: 042c4cb8c6291be857a672144b573a5eb10f1ead)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit ed7c0766ef5f13b90943a69e64f8e8713d05e864)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Robert P. J. Day
d6fd50a616 dev-manual/new-recipe.rst: update "recipetool -h" output
Update the output of "recipetool -h" to include the missing "edit"
subcommand.

(From yocto-docs rev: 09039d05e485a842690f9f54930400e02eef1c2c)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 092d688349b0b6bb10ae6fbbab7d82801964daf5)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Robert P. J. Day
9e6d5e0849 dev-manual/layers.rst: document "bitbake-layers show-machines"
The "show-machines" subcommand is not mentioned in the docs; add it.

(From yocto-docs rev: 98190334b2ad75421e8bf2cc84bd920311398670)

Signed-off-by: Robert P. J. Day <Crpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit b4320cdc4df08c59a24d5247b3895dd602554fa0)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Enrico Jörns
dbf5ddbdb5 dev-manual/sbom.rst: reflect that create-spdx is enabled by default
Since nanbield (b34032ec "defaultsetup: Inherit create-spdx by
default"), the create-spdx class is pulled in by default, not only by
poky.

Adapt the text to reflect this and also change INHERIT to INHERIT_DISTRO
since this is the more concrete variable to modify for disabling
create-spdx.

[AG: fix conflicts]

(From yocto-docs rev: 4c47eb98e096121d71663342dde86b8c9256c9b5)

Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 2b6228943443faf76c9869a0daeccfe7f93688ca)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Peter Marko
fb988ddb65 oeqa/sdk/buildepoxy: skip test in eSDK
Currently meson inside eSDKs only works with fully populated eSDKs,
but our testing uses minimal eSDKS, so skip the test if the eSDK is a
minimal build.  A bug has been filed to resolve this.

This is minimal change extracted from OE-Core commit which has this only
as a minor comment: 575e0bf52db0467d88af4b5fe467b682f10ca62a

(From OE-Core rev: 7cfacaee1b3319e561036512a849e762d0f68a5e)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Peter Marko
2ab61fcf7d oeqa: drop unnecessary dependency from go runtime tests
The tests do not use scp command, so openssh-scp is not needed.

(From OE-Core rev: 4e10e7848cb10307f133f181b41563c995df032a)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Peter Marko
f5c5d1dd6c oeqa: fix package detection in go sdk tests
The test are skipped if architecture contains dash because TARGET_ARCH
contains underscore while package name contains dash. Here the
translation needs to be done.

Note that poky distro default arch has dash:
MACHINE="qemux86-64"
TARGET_ARCH="x86_64"
ERROR: Nothing PROVIDES 'go-cross-canadian-x86_64'. Close matches:
  gcc-cross-canadian-x86-64
  gdb-cross-canadian-x86-64
  go-cross-canadian-x86-64
TRANSLATED_TARGET_ARCH="x86-64"

Quoting meta/classes-recipe/cross-canadian.bbclass:
TRANSLATED_TARGET_ARCH is added into PN

(From OE-Core rev: 82a46b70bfba7c4ce4fd20e2658b182b03e55037)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Osama Abdelkader
72fd157b91 go: remove duplicate arch map in sdk test
ARCH_MAP is duplicating an existing map in meta/lib/oe/go.py
use oe.go map_arch instead.

(From OE-Core rev: c2ba36f41777d347fd5ffcd9b6862638e5f35a1b)

(From OE-Core rev: 21f3a6c661307eab5530b51704c3a338013c9c5c)

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Osama Abdelkader
6ba417e775 go: extend runtime test
extend go runtime test with a simple test file, and simple
go module test to validate go compilation and execution on
target.

(From OE-Core rev: e3b2b9170f76f4bbdc41ea6ba7bccffc17d01968)

(From OE-Core rev: bda3e3711f84394423c15f48fb4e75258fec199a)

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Osama Abdelkader
48b9d014e9 go: add sdk test
- Add meta/lib/oeqa/sdk/cases/go.py with GoCompileTest and GoHostCompileTest classes
- Test validates Go cross-compilation toolchain functionality
- Includes native compilation, cross-compilation, and Go module support
- Uses dynamic architecture detection for portability

(From OE-Core rev: 17015f692a6bf3697a89db51bbc4673a5efa1497)

(From OE-Core rev: 506f4e8c99b164673ba7d1c19e10d240f4df0376)

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Alexander Kanavin
7b9540b6b5 goarch.bbclass: do not leak TUNE_FEATURES into crosssdk task signatures
The default assignments look like this:
TARGET_GO386 = "${@go_map_386(d.getVar('TARGET_ARCH'), d.getVar('TUNE_FEATURES'), d)}"

TUNE_FEATURES is a target-specific variable, and so should be used
only for target builds. The change is similar to what is already done
for native packages.

(From OE-Core rev: cfff8e968257c44880caa3605e158764ed5c6a2a)

(From OE-Core rev: e8d475b9b6d7b1ac3b0cfe367faabc07deb663b0)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Ross Burton
6707dcecb2 lib/oe/go: document map_arch, and raise an error on unknown architecture
Add a comment explaining what this function does and where the values
come from.

If the architecture isn't know, instead of returning an empty string
which could fail mysteriously, raise a KeyError so it fails quickly.

(From OE-Core rev: 025414c16319b068df1cd757ad9a3c987a6b871d)

(From OE-Core rev: e6de433ccb2784581d6c775cce97f414ef9334b1)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Ross Burton
cac0ff2d90 oe/sdk: fix empty SDK manifests
The SDK manifests are generated by listing the sstate was that used, but
it hardcodes that the sstate data filenames end in .tgz.

This has not been the case since sstate switched to Zstd[1] in 2021,
which meant that all of the tests which checked for packages existing
were being skipped as the manifests were empty.  For example, see a
representative core-image-sato eSDK test run[2]:

RESULTS - cmake.CMakeTest.test_assimp: SKIPPED (0.00s)
RESULTS - gtk3.GTK3Test.test_galculator: SKIPPED (0.00s)
RESULTS - kmod.KernelModuleTest.test_cryptodev: SKIPPED (0.00s)
RESULTS - maturin.MaturinDevelopTest.test_maturin_develop: SKIPPED (0.00s)
RESULTS - maturin.MaturinTest.test_maturin_list_python: SKIPPED (0.00s)
RESULTS - meson.MesonTest.test_epoxy: SKIPPED (0.00s)
RESULTS - perl.PerlTest.test_perl: SKIPPED (0.00s)
RESULTS - python.Python3Test.test_python3: SKIPPED (0.00s)

All of those tests should have been ran.

Solve this by generalising the filename check so that it doesn't care
what specfic compression algorithm is used.

[1] oe-core 0710e98f40e ("sstate: Switch to ZStandard compressor support")
[2] https://autobuilder.yoctoproject.org/valkyrie/#/builders/16/builds/1517/steps/15/logs/stdio

(From OE-Core rev: 062a525bd36c672f372dabe8d9f0fbe355c7e58b)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Ross Burton
d4a084d920 testsdk: allow user to specify which tests to run
Following the usage of TEST_SUITES in testimage, add TESTSDK_SUITES to
specify the list of tests to execute. By default the variable is empty,
which means to run all discovered tests.

This makes it easier to work on a single test without having to run all
of the tests.

(From OE-Core rev: 28d437c52c77889b2ede0fc2f2d6777c5b0a553d)

(From OE-Core rev: a93e21419476658f24220193fb0183efeb7a184f)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Gyorgy Sarvari
4af1396e46 glslang: fix compiling with gcc15
Backport a patch that fixes a compilation failure with gcc15:

| .../git/SPIRV/SpvBuilder.h:238:30: error: ‘uint32_t’ has not been declared
|   238 |     Id makeDebugLexicalBlock(uint32_t line);
|       |                              ^~~~~~~~
| .../git/SPIRV/SpvBuilder.h:64:1: note: ‘uint32_t’ is defined in header ‘<cstdint>’; this is probably fixable by adding ‘#include <cstdint>’

(From OE-Core rev: cd0039c22d7aa3d6983ac6fe917b648930355849)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Ovidiu Panait
ee521bb17c rust-target-config: fix nativesdk-libstd-rs build with baremetal
If TCLIBC='baremetal' is set in local.conf, nativesdk-libstd-rs build fails
with:

| error[E0412]: cannot find type `c_char` in the crate root
|   --> /usr/src/debug/libstd-rs/1.75.0/rustc-1.75.0-src/vendor/libc/src/unix/mod.rs:56:29
|    |
| 6  | pub type c_schar = i8;
|    | ---------------------- similarly named type alias `c_schar` defined here
| ...
| 56 |         pub gr_name: *mut ::c_char,
|    |                             ^^^^^^

This happens because rust_gen_target() sets os="none" when TCLIBC is
'baremetal' - even for nativesdk targets. However, nativesdk packages are
built against glibc, so the correct 'os' value should be "linux".

Fix this by setting the os field based on {TARGET,HOST,BUILD}_OS variables,
as it is already done in rust_base_triple(), instead of relying on TCLIBC.

(From OE-Core rev: 4c3f321304f2aa8b75cb58699b59fea80a23690c)

Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(master rev: 3eaf2cd5647585a1e6df03fc20e2753da27bb692) -- backport
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Gyorgy Sarvari
681244152c musl: patch CVE-2025-26519
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-26519

Pick the patches that are attached to the musl advisory:
https://www.openwall.com/lists/musl/2025/02/13/1

(From OE-Core rev: bbdd7d54b070f62f13967df8a13f5f14f2c36120)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Yogita Urade
027ce2d723 xwayland: fix CVE-2025-62231
A flaw was identified in the X.Org X serverâ\x80\x99s X Keyboard
(Xkb) extension where improper bounds checking in the XkbSetCompatMap()
function can cause an unsigned short overflow. If an attacker sends
specially crafted input data, the value calculation may overflow,
leading to memory corruption or a crash.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-62231

Upstream patch:
3baad99f9c

(From OE-Core rev: 97326be553f3fec8fbda63a8b38d18f656425b2c)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Yogita Urade
7f12b64980 xwayland: fix CVE-2025-62230
A flaw was discovered in the X.Org X serverâ\x80\x99s X Keyboard
(Xkb) extension when handling client resource cleanup. The software
frees certain data structures without properly detaching related
resources, leading to a use-after-free condition. This can cause
memory corruption or a crash when affected clients disconnect.

Reference:
3baad99f9c

Upstream patches:
865089ca70
87fe255393

(From OE-Core rev: 5d98bca7ca76964a6bf7efb7cf8331b9f518ad00)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Yogita Urade
33231bec7b xwayland: fix CVE-2025-62229
A flaw was found in the X.Org X server and Xwayland when processing
X11 Present extension notifications. Improper error handling during
notification creation can leave dangling pointers that lead to a
use-after-free condition. This can cause memory corruption or a crash,
potentially allowing an attacker to execute arbitrary code or cause a
denial of service.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-62229

Upstream patch:
5a4286b13f

(From OE-Core rev: 3d606cc94e5ce42b836878578fa271a72bc76015)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Ross Burton
db7f586822 xserver-xorg: fix CVE-2025-62229 CVE-2025-62230 CVE-2025-62231
>From https://lists.x.org/archives/xorg-announce/2025-October/003635.html:

1) CVE-2025-62229: Use-after-free in XPresentNotify structures creation

    Using the X11 Present extension, when processing and adding the
    notifications after presenting a pixmap, if an error occurs, a dangling
    pointer may be left in the error code path of the function causing a
    use-after-free when eventually destroying the notification structures
    later.

    Introduced in: Xorg 1.15
    Fixed in: xorg-server-21.1.19 and xwayland-24.1.9
    Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5a4286b1
    Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.

2) CVE-2025-62230: Use-after-free in Xkb client resource removal

    When removing the Xkb resources for a client, the function
    XkbRemoveResourceClient() will free the XkbInterest data associated
    with the device, but not the resource associated with it.

    As a result, when the client terminates, the resource delete function
    triggers a use-after-free.

    Introduced in: X11R6
    Fixed in: xorg-server-21.1.19 and xwayland-24.1.9
    Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/99790a2c
         https://gitlab.freedesktop.org/xorg/xserver/-/commit/10c94238
    Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.

3) CVE-2025-62231: Value overflow in Xkb extension XkbSetCompatMap()

    The XkbCompatMap structure stores some of its values using an unsigned
    short, but fails to check whether the sum of the input data might
    overflow the maximum unsigned short value.

    Introduced in: X11R6
    Fixed in: xorg-server-21.1.19 and xwayland-24.1.9
    Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/475d9f49
    Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.

(From OE-Core rev: 50b9c34ba932761fab9035a54e58466d72b097bf)

(From OE-Core rev: f5a10c4950ccb5570c72eb0a09618b7b3523bc39)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Ross Burton
a78985ed94 xserver-xorg: remove redundant patch
The underlying issue with -fno-common was resolved upstream in xserver
21.1.0 onwards[1].

[1] xserver 0148a15da ("compiler.h: don't define inb/outb and friends on mips")

(From OE-Core rev: 74b77ee90efd50a703af76769fac66a0f7c394ca)

(From OE-Core rev: f1b064e684cebc3e0c6ca36eb585e26b8da5583b)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Hugo SIMELIERE
49e4da8b0a sqlite3: patch CVE-2025-7709
Pick commit used in debian patch https://git.launchpad.net/ubuntu/+source/sqlite3/commit/?id=9a309a50fa99e3b69623894bfd7d1f84d9fab33c
Upstream-Status: Backport [192d0ff8cc]

(From OE-Core rev: baaf28f6f2eac600f7caf53660a0b75f0329e86a)

Signed-off-by: Bruno VERNAY <bruno.vernay@se.com>
Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Hongxu Jia
e77289e9a4 spdx30: Provide software_packageUrl field in SPDX 3.0 SBOM
Define var-SPDX_PACKAGE_URL to provide software_packageUrl field [1][2]
in SPDX 3.0 SBOM, support to override with package name
SPDX_PACKAGE_URL:<pkgname>

Currently, the format of purl is not defined in Yocto, set empty for now
until we have a comprehensive plan for what Yocto purls look like.
But users could customize their own purl by setting var-SPDX_PACKAGE_URL

[1] https://spdx.github.io/spdx-spec/v3.0.1/model/Software/Properties/packageUrl/
[2] https://spdx.github.io/spdx-spec/v3.0.1/annexes/pkg-url-specification/

(From OE-Core rev: c8e6953a0b6f59ffca994c440069db39e60b12d2)

(From OE-Core rev: 60724efdb3a243bc796b390ad0c478584a0fb7fa)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Peter Marko
c06e4e6e60 spdx30: fix cve status for patch files in VEX
This commit fixes commit 08595b39b46ef2bf3a928d4528292ee31a990c98
which adapts vex creation between function create_spdx where all changes
were backported and funtion get_patched_cves where changes were not
backported.

CVE patches were previously ignored as they cannot be decoded from
CVE_STATUS variables and each caused a warning like:
WARNING: ncurses-native-6.4-r0 do_create_spdx: Skipping CVE-2023-50495 — missing or unknown CVE status

Master branch uses fix-file-included for CVE patches however since
cve-check-map.conf was not part of spdx-3.0 backport, closest one
available (backported-patch) was implemented.

(From OE-Core rev: 8d14b2bb02861612130f02c445392f34090ba5d9)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-26 07:50:35 -08:00
Steve Sakoman
7e8674996b build-appliance-image: Update to scarthgap head revision
(From OE-Core rev: 471adaa5f77fa3b974eab60a2ded48e360042828)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-17 17:02:11 -08:00
Richard Purdie
dd2d3cfc4e oe-build-perf-report: relax metadata matching rules
As the poky repository is no longer used, measurements are indexed using
the oe-core commit. But as bitbake, oe-core and meta-yocto are now
retrieved from separate gits, while measuring performances for a given branch
at some time interval, we can get the same commit for oe-core but
different ones for bitbake or meta-yocto. As a consequence, metadata
associated with the same index (oe-core commit) might differ.

To work around this, relax the equality checks for commit, commit_time
and commit_count since they might no longer match.

Ideally we'd group them into separate results but for now, treat them
as being the same.

[Based on work from Mathieu Dubois-Briand but fixed differently]
(From OE-Core rev: d9c30edf908c129a7540b23e920dd669d2a30657)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e7dc42e30c76bf0fbb4d3cc019bbec675bac55fa)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-17 16:59:28 -08:00
Steve Sakoman
c1bb6b3d12 build-appliance-image: Update to scarthgap head revision
(From OE-Core rev: 5fa3fd112e69cca60577065145f5f8aaa41b5bd6)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:49:29 -08:00
Steve Sakoman
60d407517c poky.conf: bump version for 5.0.14
(From meta-yocto rev: bf6aea52c4009e08f26565c33ce432eec7cfb090)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:30 -08:00
Joshua Watt
d7d531e269 classes/create-spdx-2.2: Handle empty packages
When combining an SPDX document, the package list might be empty (e.g.
a baremetal image). Handle this case instead of erroring out

(From OE-Core rev: 1f7326799c33d2a734c58d360773b87d7b86b0ec)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:30 -08:00
Joshua Watt
6328f52695 oeqa: spdx: Add tar test for SPDX 2.2
The base-files test for SPDX 2.2 did not give good coverage, since
base-files doesn't have any dependencies. Add building tar as another
test which more fully exercises the code

(From OE-Core rev: 2c299c17ef1a97505fd7de8d3ebc9de25fb838fc)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:30 -08:00
Kamel Bouhara (Schneider Electric)
5b74a8f1a5 spdx30_tasks: adapt CVE handling to new cve-check API
Changes to cve-check (see poky commit fb3f440b7d,
"cve-check: annotate CVEs during analysis") modified the
get_patched_cves() API to return a set of CVE IDs instead of a
dictionary of CVE metadata.

The SPDX 3 backport still expected a dictionary and attempted to call
.items(), leading to:

    AttributeError: 'set' object has no attribute 'items'

This patch updates the SPDX3 code to iterate directly over the CVE IDs
and use `oe.cve_check.decode_cve_status()` to retrieve the mapping,
detail, and description for each CVE. This restores compatibility with
the updated CVE API and matches the behavior of SPDX3 handling on
Walnascar.

A warning is logged if a CVE has missing or unknown status.

(From OE-Core rev: 55fdeea44ffbecb705f7900bfa85ab88e1191878)

Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:30 -08:00
Joshua Watt
71aca87ca7 spdx 3.0: Rework how SPDX aliases are linked
The SPDX code needs to be able to look up an Element by its SPDX ID,
locating the file that (should) contain the SPDX ID and opening it for
parsing. Previously, the code would do this be hashing each Element
SPDX ID and Alias, and the creating a symbolic link to the file that
contains the element with a name of the hash.

This worked well as it was possible to look up any arbitrary SPDX ID or
alias by simply hashing it and following the symbolic link to get the
file. However, the down side of this approach is that it creates a lot
of symbolic links, since it will make one or two per Element in the
document. This can be a problem when using SPDX_INCLUDE_SOURCES, for
example.

This change reworks this strategy so that the only Element that gets a
symbolic link based on the hash is the singular SpdxDocument that is
create for each file. All other Elements are assigned an alias with a
special prefix that encodes the hash of SpdxDocument alias. Thus, when
attempting to look up an arbitrary alias, the code sees the special
prefix, extract the hash, opens the file based on the symlink with that
hash name, then finds the matching Element in the file. This drastically
reduces the number of symbolic links by making only one per file.

This also means that the custom link extension can be removed since it
is now superfluous.

(From OE-Core rev: 551433c7a1eddf5090c87a243ea104bf091992b0)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 838d64c09657ac53175737fc4e7fd6f01f3dcf47)
Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:30 -08:00
Joshua Watt
1919d76f68 lib: oeqa: spdx: Add tests for extra options
Adds a test for several of the extra options provided by the SPDX
classes. In particular, these are the options that can produce
non-reproducible results, so are not enabled by default in OE core. This
test takes care to configure the build so that the tests do run in a
reproducible manner so that pre-built test objects can be pulled from
sstate

(From OE-Core rev: 72ee311d4f74499674a29223fb02d4e774097a54)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 14f534f15f7fe6362723d7f064d39783c5bd758f)
Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:30 -08:00
Hongxu Jia
568c1afab4 oeqa/selftest: Add SPDX 3.0 include source case for work-share
Build gcc and check gcc-14.2.0/README in objset is available

$ oe-selftest -r spdx.SPDX30Check.test_gcc_include_source
...
2024-10-26 01:24:57,063 - oe-selftest - INFO - test_gcc_include_source (spdx.SPDX30Check.test_gcc_include_source)
2024-10-26 01:28:24,204 - oe-selftest - INFO - The spdxId of gcc-14.2.0/README in gcc.spdx.json is http://spdx.org/spdxdocs/gcc-f2eaeb0d-b54b-53ba-899a-8c36c21139bf/88d5068ffd41e5ea6b4e0dd390b23bf499bb2b6674a41e09eaf2a887eced16c8/sourcefile/42
2024-10-26 01:28:26,369 - oe-selftest - INFO -  ... ok
2024-10-26 01:28:33,315 - oe-selftest - INFO - ----------------------------------------------------------------------
2024-10-26 01:28:33,316 - oe-selftest - INFO - Ran 1 test in 216.457s
2024-10-26 01:28:33,316 - oe-selftest - INFO - OK
2024-10-26 01:28:45,254 - oe-selftest - INFO - RESULTS:
2024-10-26 01:28:45,254 - oe-selftest - INFO - RESULTS - spdx.SPDX30Check.test_gcc_include_source: PASSED (209.31s)
2024-10-26 01:28:45,260 - oe-selftest - INFO - SUMMARY:
2024-10-26 01:28:45,260 - oe-selftest - INFO - oe-selftest () - Ran 1 test in 216.457s
2024-10-26 01:28:45,260 - oe-selftest - INFO - oe-selftest - OK - All required tests passed (successes=1, skipped=0, failures=0, errors=0)

(From OE-Core rev: 45f3039a4f0fcea208e317ed7134458f7aa7a4cc)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Reviewed-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ccd6dde301dc8c45c8f901ebd4676b488d638b08)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:30 -08:00
Joshua Watt
f5a9af087b selftest: spdx: Add SPDX 3.0 test cases
Adds test cases for SPDX 3.0. Reworks the SPDX 2.2 test setup so it can
also be run even if the default is SPDX 3.0

(From OE-Core rev: e182f76a866d4d750d2baf7b56ffebead5264de2)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b1d2309b3ab0fd8b0d8c4dfa59f50c85074bbd3b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:30 -08:00
Kamel Bouhara (Schneider Electric)
bf3b6c9965 classes/create-spdx-2.2: align DEPLOY_DIR_SPDX with SPDX_VERSION layout
Upstream commit 544d46e4169a ("selftest/spdx: Fix for SPDX_VERSION addition")
updated the selftests to expect SPDX artifacts under:

    ${DEPLOY_DIR}/spdx/${SPDX_VERSION}/

However, in this branch the effective SPDX output was still being
written to:

    ${DEPLOY_DIR}/spdx/${PACKAGE_ARCH}/

without the version subdirectory. This caused SPDX selftests such as
test_spdx_tar to fail with missing file errors, e.g.:

    AssertionError: .../deploy/spdx/SPDX-1.1/core2-64/packages/tar.spdx.json does not exist

Update create-spdx-2.2.bbclass so that DEPLOY_DIR_SPDX includes
${SPDX_VERSION}, matching the expected deploy structure and restoring
successful SPDX selftests.

(From OE-Core rev: 8996d0899df5316742ba5fd73c351e8ca67dc90b)

Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:30 -08:00
Richard Purdie
75922d42b0 selftest/spdx: Fix for SPDX_VERSION addition
Update the test for the addition of SPDX_VERSION to the deploy path.

(From OE-Core rev: d75bfbaf69292f80cacc5b8d6cbff03418a34ebc)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 055e8c21908127722abad9e992d6408d8697a119)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:30 -08:00
Joshua Watt
35b2b34407 classes-recipe/baremetal-image: Add image file manifest
Downstream tasks may want to know what image files were written so write
out a manifest in do_image_complete. The format of the manifest is the
same as the one in image.bbclass

(From OE-Core rev: e15a9934be84c59fc1bf957a60fa395e521abcfc)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Joshua Watt
a905366ee1 classes-recipe/image: Add image file manifest
Downstream tasks may want to know what image files were written by the
do_image family of tasks (e.g. SPDX) so have each task write out a
manifest file that describes the files it produced, then aggregate them
in do_image_complete

(From OE-Core rev: 5da5e2c528e8f4c78d389d60b03725323ff1527c)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5e55ed4c5b9d5af3c96b82805af34af1512fc3d1)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Joshua Watt
b5184d1487 lib: oe: license: Add missing import
The code in this file uses oe.qa, but it was not imported resulting an
an exception when a license error was detected

(From OE-Core rev: f8aa42faa3640d0414745ae32b00a37b2f5d638b)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e44cb7c5b7281d614ed51fdec06dad0a7211528a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Joshua Watt
8f0eab43ed lib/license: Move package license skip to library
Moves the code that skips packages with incompatible licenses to the
library code so that it can be called in other locations

(From OE-Core rev: 4f7a047c4a1e14bbb3bf593764aace1e25bcd4a4)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 86eb409e3c1b30110869ec5a0027ae2d48bbfe7f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Joshua Watt
2cab0b9833 classes-global/staging: Exclude do_create_spdx from automatic sysroot extension
do_create_spdx is a outlier in that it doesn't need the RSS to be
extended just because it depends on do_populate_sysroot. In fact, it
only depends on do_populate_sysroot so it can see the actual recipes
sysroot, and attempting to extend the sysroot can cause problems for
some recipes (e.g. if a recipe does do_populate_sysroot[noexec] = "1")

As such, explicitly exclude do_create_spdx from extending the sysroot
just because it depends on do_populate_sysroot.

(From OE-Core rev: 572bf8fd0ba83c7174f706f17a589abbcdc54df5)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Joshua Watt
ff75417547 classes-global/license: Move functions to library code
Moves several of the functions in license.bbclass to be library code

New function dependencies were manually verified using bitbake-dumpsigs
to ensure that bitbake identified the same dependencies even though they
are now in library code (although the new function names mean that the
task hashes still change)

(From OE-Core rev: 5e220e20833fd800687b05c8f5cef602dfc47202)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0333e04e353991260c5f67a72f80f3ab9dcf526a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Kamel Bouhara (Schneider Electric)
b16bf27386 spdx30_tasks: fix FetchData attribute in add_download_files
The add_download_files() function incorrectly accessed fd.name, which
does not exist on FetchData objects.

Change to use fd.names[0] to correctly retrieve the first filename.

This fixes AttributeError during SPDX document generation.

(From OE-Core rev: 17031d71cf4bc4fc19dd8a41c49b94e1f6a1edee)

Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Kamel Bouhara (Schneider Electric)
11cd8498da backport: SPDX 3.0 fixes and tasks from upstream version Walnascar
Backports the SPDX 3.0 support and fixes from upstream walnascar
commit 49f47169953b807d430461ca33f3a2b076119712 into upstream
scarthgap.

(From OE-Core rev: 9c9b9545049a2f6e5c99edcb079275d29a4d1ac6)

Signed-off-by: Kamel Bouhara (Schneider Electric) <kamel.bouhara@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Alexander Kanavin
d101e1410d xf86-video-intel: correct SRC_URI as freedesktop anongit is down
(From OE-Core rev: 04037a14e1431c4a51f5d51885974732a6108368)

(From OE-Core rev: 64eff9fa267f33d2ca0972a5dc4ae010138cd720)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9649bec517)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Richard Purdie
7ff4ef9855 oeqa/selftest/devtool: Update after upstream repo changes
The upstream changed the branch name, moving to archive/ so we need to
update too. Take the opportunity to match the new location too to avoid
the redirect.

We could use a different branch but upstream would probably eventually
rename that too so this may last longer.

(From OE-Core rev: 1e0a64a1890a62e130595f46d93c8d08af9170f5)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 478a645bad150f04dee1b0085c4542c2eefe7007)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Gyorgy Sarvari
7810db935d ca-certificates: fix on-target postinstall script
When the package is installed directly on the machine (instead of
installing it in the rootfs directly), the postinstall script fails with
the following error:

/usr/sbin/update-ca-certificates: line 75: shift: shift count out of range

The reason is that the "update-ca-certificates" script is executed with
the "--sysroot" argument, and as the sysroot $D is passed. However on the
target system this variable doesn't exist, so the argument is passed without
this mandatory value, and the execution fails.

To avoid this error, check if the $D variable exists, and pass the --sysroot
argument only when it does.

Reported-by: WXbet <Wxbet@proton.me>
(From OE-Core rev: 9a2bd3b6e2e53071a1463d2804d0d4fb17b1814f)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cf39461e97098a1b28693299677888ba7e8bfccf)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Wang Mingyu
d9c3943da3 ca-certificates: upgrade 20241223 -> 20250419
0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch
0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch
refreshed for 20250419

0002-sbin-update-ca-certificates-add-a-sysroot-option.patch
removed since it's included in 20250419

(From OE-Core rev: dd05818a422c8c5be1aef06405d200280b382b91)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e39cc1fb7234bf2b37856296d3c0d10ddf8cae64)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Alexander Kanavin
8951fdb63a ca-certificates: submit sysroot patch upstream, drop default-sysroot.patch
ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch
was using a non-standard environment variable, and was replaced
with a patch that adds a command line option (and then this
was submitted upstream). ca-certificates recipe was tweaked accordingly,
and nothing else in core or meta-oe is using update-ca-certificates.

Drop default-sysroot.patch as the use case is unclear: sysroot
is explicitly specified in all known invocations of update-ca-certificate,
and if there's a place where it isn't, then update-ca-certificates
will error out trying to write to /etc, and should be fixed to
explicitly specify the sysroot.

(From OE-Core rev: a80185fd72a2be183783b0e464c07f1043d7dd37)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 90d9f0ba674d4fe8e9291f0513c13dff3775c545)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Richard Purdie
3ad2146a1b ca-certificates: upgrade 20240203 -> 20241223
(From OE-Core rev: 7e4ce7c927f6328e013db53690a2ef841b1bb9bf)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 48a236c2f78fee5e6db19c6be23b4a18df025607)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Alexander Kanavin
4abd3e001c ca-certificates: get sources from debian tarballs
git repo no longer has tags for recent versions which means
we had missed several of them, and wouldn't be able to get
notifications about any future releases.

(From OE-Core rev: 44c113497c7e3f9f06604e892df1eb717bb3410d)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 81f013fd1312551628701bf36ac62746a2606dbd)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Theodore A. Roth
dab711ba8b ca-certificates: Add comment for provenance of SRCREV
Provide references for how the SRCREV was arrived at for the 20240203
release.

(From OE-Core rev: b1d86653f1485aa56fe8bf050931d5b8657ee499)

Signed-off-by: Theodore A. Roth <troth@openavr.org>
Signed-off-by: Theodore A. Roth <theodore_roth@trimble.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6916cdb0f05f6644edb1e432a9421595abb9f0ca)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Theodore A. Roth
302184ed4c ca-certificates: update 20211016 -> 20240203
The 20240203 version is the same as used in Ubuntu >= 24.04 and Debian
Trixie (testing).

(From OE-Core rev: 63620f034019b3b3585e263bd26b3fadd9a1692e)

Signed-off-by: Theodore A. Roth <troth@openavr.org>
Signed-off-by: Theodore A. Roth <theodore_roth@trimble.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ce19168885a04b0d77e81c1fd1c4262b195a47d4)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Ankur Tyagi
bc0e06b3b1 wireless-regdb: upgrade 2024.10.07 -> 2025.10.07
(From OE-Core rev: e0bdf9b4134b1c1f90687fb6e12e33bf77d4192c)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Ankur Tyagi
9c92d62dac webkitgtk: upgrade 2.44.3 -> 2.44.4
Bug fixes only:
https://www.webkitgtk.org/release/webkitgtk-2.44.4.html

(From OE-Core rev: 59cd37dc19548845804f29d37621f7435e206c43)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Archana Polampalli
c973f0e006 go: fix CVE-2025-61724
The Reader.ReadResponse function constructs a response string through
repeated string concatenation of lines. When the number of lines in a
response is large, this can cause excessive CPU consumption.

(From OE-Core rev: 512c36af3b9d344606b2ebf54bc2f99b88dfea63)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Archana Polampalli
79aeef5d35 go: fix CVE-2025-61723
The processing time for parsing some invalid inputs scales non-linearly with
respect to the size of the input. This affects programs which parse untrusted PEM inputs.

(From OE-Core rev: 228e4aa70743b92eaf1abd5526827b34b33f3419)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Archana Polampalli
18bfeb632b go: fix CVE-2025-47912
The Parse function permits values other than IPv6 addresses to be included
in square brackets within the host component of a URL. RFC 3986 permits
IPv6 addresses to be included within the host component, enclosed within
square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames
must not appear within square brackets. Parse did not enforce this requirement.

(From OE-Core rev: c5fc59eb87d0f92ba8596b7848d16d59773582a0)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Archana Polampalli
b3b8ae2317 go: fix CVE-2025-58189
When Conn.Handshake fails during ALPN negotiation the error contains attacker
controlled information (the ALPN protocols sent by the client) which is not escaped.

(From OE-Core rev: e734cf62f24640d116c901dd97e09ddbb1f0cc4f)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Archana Polampalli
8c87818a10 go: fix CVE-2025-58188
Validating certificate chains which contain DSA public keys can cause
programs to panic, due to a interface cast that assumes they implement
the Equal method. This affects programs which validate arbitrary certificate chains.

(From OE-Core rev: b532fa208d0b102326642a2fba8b17661a14307e)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Archana Polampalli
a6d452646e go: fix CVE-2025-58187
Due to the design of the name constraint checking algorithm, the processing
time of some inputs scals non-linearly with respect to the size of the certificate.
This affects programs which validate arbitrary certificate chains.

(From OE-Core rev: ce1626d1f1e232bc6da81e89088d0c0f5f3c52b4)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Archana Polampalli
0c4e028627 go: fix CVE-2025-58185
Parsing a maliciously crafted DER payload could allocate large amounts of memory,
causing memory exhaustion.

(From OE-Core rev: f27acc863ee34b56e2c49dc96ad2b58fb35e2d46)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Peter Marko
604b1627ed curl: ignore CVE-2025-10966
Per [1] this CVE applies only when wolfssl backed is used.
8.17.0 removed WolfSSL support completely.

[1] https://curl.se/docs/CVE-2025-10966.html

(From OE-Core rev: 3de9b86c295c88005d4df53e5137bb09ea104ed0)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Philippe-Alexandre Mathieu
255271dfff bitbake: fetch2/wget: Keep query parameters in URL during checkstatus
When recreating the uri in wget's checkstatus method, we only use the
scheme, host and path. This completely strips the query parameters from
the final URI and potentially breaks the checking functionality for
URLs that require query parameters (such as the AZ fetcher with SAS
token).

This bug was resolved on master in
`096301250455e2a83bdd818a56317c62436c9981`.
This patch is adapted to the scarthgap branch.

CC: Steve Sakoman <steve@sakoman.com>
(Bitbake rev: 8dcf084522b9c66a6639b5f117f554fde9b6b45a)

Signed-off-by: Philippe-Alexandre Mathieu <pamathieu@poum.ca>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Bin Lan
324f29337b bitbake: bb/fetch2/__init__.py: remove a DeprecationWarning in uri_replace()
There is the following warning when executing to bitbake linux-yocto:
  bitbake/lib/bb/fetch2/__init__.py:464: DeprecationWarning: 'count' is passed as positional argument

This is because the 4th parameter of re.sub(pattern, repl, string, count=0, flags=0)
is a keyword parameter. We use keyword arguments for parameters that are not positional.

(Bitbake rev: c2a54aceab4c75cea6f8be16fe6d0caed12b32c4)

Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Chris Laplante <chris.laplante@agilent.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-14 06:45:29 -08:00
Yannic Moog
b33a8abe77 perf: add arm64 source files for unistd_64.h
kernel commit bfb713ea53c7 ("perf tools: Fix arm64 build by generating unistd_64.h")
introduces a new dependency on source files for arm64, specifically
include/uapi/asm-generic.

Build fails with:
[..]/perf/1.0/perf-1.0/scripts/Makefile.asm-headers:33: [...]/perf/1.0/perf-1.0/include/uapi/asm-generic/Kbuild: No such file or directory
make[4]: *** No rule to make target '[...]/perf/1.0/perf-1.0/include/uapi/asm-generic/Kbuild'.  Stop.

Add the directory to PERF_SRC.
Fix whitespace error while at it.

(From OE-Core rev: 06d4981313ce67a8d53b1c14be9845b4b5a9f4cf)

Signed-off-by: Yannic Moog <y.moog@phytec.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-07 06:54:41 -08:00
Bastian Krause
4f2287dcc4 util-linux: fix pointer usage in hwclock param handling
Passing params as numbers to hwclock is broken in util-linux 2.39.3 due
to wrong pointer handling. So backport the fix from upstream included
since util-linux 2.41.

(From OE-Core rev: 3d8f88906f5560286462eaf55226b872e2805df7)

Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-07 06:54:41 -08:00
Michael Haener
a2b737539e Remove empty file
An error occurred in backport commit
649147913e89cd8f7390cb17cd0be94c9710ffa6. The test file
is empty and has no functionality at all.

(From OE-Core rev: 0539a7869c4a3e28b3e7d0ab93fe07bfb9462d13)

Signed-off-by: Michael Haener <michael.haener@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-07 06:54:41 -08:00
Peter Marko
9e31b2eb18 binutils: patch CVE-2025-11413
Pick commit per NVD CVE report.

Note that there were two patches for this, first [1] and then [2].
The second patch moved the original patch to different location.
Cherry-pick of second patch is successful leaving out the code removing
the code from first location, so the patch attached here is not
identical to the upstream commit but is identical to applying both and
merging them to a single patch.

[1] https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=1108620d7a521f1c85d2f629031ce0fbae14e331
[2] https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=72efdf166aa0ed72ecc69fc2349af6591a7a19c0

(From OE-Core rev: 98df728e6136d04af0f4922b7ffbeffb704de395)

(From OE-Core rev: b220cccdab44bc707d2c934a3ea81d20b67d14b0)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-07 06:54:41 -08:00
Peter Marko
ca2c8b88be binutils: patch CVE-2025-11412
Pick commit per NVD CVE report.

(From OE-Core rev: 6b94ff6c584a31d2b1e06d1e1dc19392d759b4b7)

(From OE-Core rev: fdbcbb0fe92a862a993108609eb4107e34eeeed2)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-07 06:54:41 -08:00
Peter Marko
ef4b31498d binutils: patch CVE-2025-11414
Pick commit per NVD CVE report.

(From OE-Core rev: cd7ce80fa1a99916aa2f93c4d9591c5496c3ef71)

(From OE-Core rev: ddb6453a751efb2c07b0866a1aace9d4adb55089)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-07 06:54:41 -08:00
Peter Marko
97f732ce9b wpa-supplicant: patch CVE-2025-24912
Pick patches as listed in NVD CVE report.

Note that Debian lists one of the patches as introducing the
vulnerability. This is against what the original report [1] says.
Also the commit messages provide hints that the first patch fixes this
issue and second is fixing problem with the first patch.

[1] https://jvn.jp/en/jp/JVN19358384/

(From OE-Core rev: a157719ab349d9393d5a640bb2e45fc2489d5338)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-07 06:54:40 -08:00
Antonin Godard
c4a4df3e72 ref-manual/classes.rst: document the relative_symlinks class
Added by commit e478550c8cd8 ("openssl/fontconfig/bzip2: Use relative
symlinks instead of absolute ones (using a new class)") in OE-Core.

(From yocto-docs rev: a8687e4bb2e822670b6ad110613a12fa02943d3d)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit c0dc554eba7d421023ecc68a70b7a19df38628b0)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Antonin Godard
7e77ef9016 ref-manual/classes.rst: gettext: extend the documentation of the class
Mention the use of USE_NLS, INHIBIT_DEFAULT_DEPS and the cross-canadian
class.

Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: b16f19e8004d571e7a6eadfa34983781ba6a7634)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit d877e54f1c85cefc00dd674d60f2db81446bd95a)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Antonin Godard
448d31c10b ref-manual/variables.rst: document the USE_NLS variable
Part of bitbake.conf, this variable allowing to enable or disable
translation was undocumented. Add a entry to the glossary.

Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: 675b776390c8079deb8f1912dac44b574688a9c7)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 92a55345a56b5038c0344669daaa7a3a99dd0fc0)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Antonin Godard
121ce25859 ref-manual/variables.rst: document the REQUIRED_IMAGE_FEATURES variable
Added by commit 96a9702a24a7 ("distro_features_check: expand with
IMAGE_FEATURES") in OE-Core.

Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: 7c387b11c9844809a0f8debb5b21f5c0a0220d97)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 860ddbd491ee9db291868bd939392538a2c64a4b)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Antonin Godard
2cf19dbd79 ref-manual/variables.rst: document the REQUIRED_COMBINED_FEATURES variable
Added in OE-Core commit: 5f4875b950ce ("distro_features_check: expand
with MACHINE_FEATURES and COMBINED_FEATURES, rename").

Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: b6dfa4af0bd0b7c8c2a642b377f8fbf7b24cc4e8)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit bbc7f26240c2db5cd4179f297ae49c778789514e)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Antonin Godard
f1125c2cf7 ref-manual/variables.rst: document the REQUIRED_MACHINE_FEATURES variable
Added in OE-Core commit: 5f4875b950ce ("distro_features_check: expand
with MACHINE_FEATURES and COMBINED_FEATURES, rename").

Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: 5270b62a0a10169710be11561f1c2623f550f567)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit c0551456cba6016d5014c2be8d6906e58a324cc4)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Antonin Godard
ef8c458f20 ref-manual/classes,variables: document the CCACHE_DISABLE variable
Can be used in recipes that want to explicitly skip Ccache support when
the ccache class is enabled.

Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: e4fb6cd20955046a397b63bfe57f6cb4020b9cbb)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit b1b4adc8d4d9d23ff6fd91bca632bb0f5277e72b)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Robert P. J. Day
b0e19cc72f overview-manual/yp-intro.rst: update on-target packaging info
- drop references to obsolete tar packaging format
  - add references to apt and dpkg utilities for .deb packaging
  - add reference to alternative "dnf" .rpm packaging

(From yocto-docs rev: d1331418317576b569ea2b046adf46ec7af8a15a)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit d4374ac86ebe7980908ed905018ccfb773ac666e)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
João Marcos Costa
ba0fd17fa6 variables.rst: fix LAYERDEPENDS description
This variable does not apply to the scope of a single recipe, but rather
to the scope of the entire layer.

(From yocto-docs rev: a86f2e5d291b86dbf56aefab08f4d3b0e5529801)

Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit eec26e11adb6e3a9c4f53f825b9a1730c9ddee12)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Paul Barker
88bdd0ed92 dev-manual, test-manual: Update autobuilder output links
The current autobuilder cluster is at valkyrie.yocto.io, published files
on autobuilder.yocto.io will be missing or out-of-date.

(From yocto-docs rev: b3b95e590248025d59a7cef311bb0abf207e72fb)

Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 9ed06c070e309b52f1dbf8877867dcede79f4cb6)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Antonin Godard
059f795ebe ref-manual/classes.rst: extend the uninative class documentation
Extend the documentation of the uninative class based on [1].

[1]: https://lore.kernel.org/r/061e6150ce177221f7b6ee8754b03a20347a92c3.camel@linuxfoundation.org

Co-developed-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From yocto-docs rev: 0193bfa7966f301e46253e25eaa0482aeb21d9d4)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 68996f0f3bf882714e8d96a0aa7b2492fe16d0c3)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Antonin Godard
9019056557 ref-manual/variables.rst: document UNINATIVE_URL/CHECKSUM
Document the UNINATIVE_URL and UNINATIVE_CHECKSUM variables.

(From yocto-docs rev: 6b2440465ed6d48b2ec504940dda9517db863796)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 974fe4e1c5db65b462a382e089e016326e7b3f26)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Praveen Kumar
aabe690b3f bind: upgrade 9.18.33 -> 9.18.41
This upgrade fixes
CVE-2025-8677,CVE-2025-40778 and CVE-2025-40780.

Changelog
==========
https://downloads.isc.org/isc/bind9/9.18.41/doc/arm/html/changelog.html

(From OE-Core rev: 4cb834388759540ea5bf7265389b9f1b2e15333a)

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Yogita Urade
2f480a8669 tiff: ignore CVE-2025-8961
This CVE is for the tool which is removed in v4.6.0 via [1] and
re-introduced again in v4.7.0 via [2].

[1] eab89a627f
[2] 9ab54a8580

(From OE-Core rev: 1ff4b39374a5b328069a928e7234c3397769dc6f)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Hongxu Jia
a769ae7a7d u-boot: fix CVE-2024-42040
Backport a patch [1] from upstrem to fix CVE-2024-42040 [2]

[1] 81e5708cc2
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-42040

(From OE-Core rev: 5c086db3f44d44f31e90f95ccb429639a1ff481d)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Yash Shinde
f2b841423f binutils: fix CVE-2025-8225
CVE: CVE-2025-8225

It is possible with fuzzed files to have num_debug_info_entries zero
after allocating space for debug_information, leading to multiple
allocations.

* dwarf.c (process_debug_info): Don't test num_debug_info_entries
to determine whether debug_information has been allocated,
test alloc_num_debug_info_entries.

Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4]

(From OE-Core rev: 7feed679262025b8405488d064e2c546a3ed7a0c)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Yash Shinde
3574b5a9d1 binutils: fix CVE-2025-11081
CVE: CVE-2025-11081

Trying to dump .sframe in a PE file results in a segfault accessing
elf_section_data.

	* objdump (dump_sframe_section, dump_dwarf_section): Don't access
	elf_section_type without first checking the file is ELF.

PR 33406 SEGV in dump_dwarf_section
[https://sourceware.org/bugzilla/show_bug.cgi?id=33406]

Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=f87a66db645caf8cc0e6fc87b0c28c78a38af59b]

(From OE-Core rev: 6ed800208a56d69faf4a1b3458caa8d412f01b89)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
David Nyström
b45fdb365d lz4: fix CVE-2025-62813
Prevent attackers to cause a denial of service (application crash) or
possibly have unspecified other impact when the application processes
untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in
lib/lz4frame.c mishandles NULL checks.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-62813

Upstream patch:
f64efec011

(From OE-Core rev: 0a63e3e120cc6958e2963a3ad510ec7c03f1adae)

Signed-off-by: David Nyström <david.nystrom@est.tech>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Matthias Schiffer
4a784d7f74 curl: only set CA bundle in target build
In native/nativesdk builds, sysconfdir refers to a recipe sysroot
directory, which will disappear once the workdir is cleaned up, breaking
libcurl's HTTPS connections.

By simply not setting --with-ca-bundle at all in non-target builds, curl
defaults to the host system's CA certificates, which is desirable anyways
to allow builds in environments that require local CA certificates.

(From OE-Core rev: 4909a46e93ba774c960c3d3c277e2a669af3fea6)

(From OE-Core rev: 0f98fecda8a0436f760e6fd9f3b7eb510e5258b8)

Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Rasmus Villemoes
bd0c87a3ac iptables: remove /etc/ethertypes
When building an image including iptable built with the libnftnl
PACKAGECONFIG, one hits

Downloading file:.../oe-rootfs-repo/armv8a/libkmod2 * check_data_file_clashes: Package iptables wants to install file .../rootfs/etc/ethertypes
        But that file is already provided by package  * netbase

This used to be handled by
0003-Makefile.am-do-not-install-etc-ethertypes.patch, but that patch
got removed with the 1.8.9->1.8.10 upgrade (commit 4616ada82e70).

I think the rationale for dropping the patch was wrong; the commit log
talks about xtables.conf, which is indeed gone from upstream, but said
patch didn't change anything about xtables.conf, it did

-dist_conf_DATA        = etc/ethertypes etc/xtables.conf
+dist_conf_DATA        = etc/xtables.conf

However, instead of patching iptables to not install ethertypes, and
having to forward-port that patch, it is much simpler to just remove
the file in this do_install:append.

(From OE-Core rev: a970b6c927fb4c04473484f6e4b0a9853c8a5896)

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Daniel Semkowicz
5ea0467919 gstreamer1.0-plugins-bad: fix buffer allocation fail for v4l2codecs
There is a bug in GStreamer 1.22 that prevents video playback when
some of the v4l2codecs are paired with sinks that do not support
GstVideoMeta. This is the case of the Qt 6.9 sink used by some
of the Qt components.

For example, when the v4l2codecs-vp8dec decoder is paired with
QMediaPlayer, video playback fails to start with the following error:

  WARN   videodecoder gstvideodecoder.c:4409:gst_video_decoder_negotiate_pool: Subclass failed to decide allocation
  ERROR  videodecoder gstvideodecoder.c:4635:gst_video_decoder_allocate_output_buffer: Failed to allocate the buffer..
  WARN   videodecoder gstvideodecoder.c:4409:gst_video_decoder_negotiate_pool: Subclass failed to decide allocation
  WARN  matroskademux matroska-demux.c:6131:gst_matroska_demux_loop: error: Internal data stream error.
  WARN  matroskademux matroska-demux.c:6131:gst_matroska_demux_loop: error: streaming stopped, reason not-negotiated (-4)

This problem is already fixed in GStreamer 1.24, so backport the fix.
This fixes the buffer allocation failure for H.264, H.265, and VP8.

CC: Steve Sakoman <steve@sakoman.com>
CC: Anuj Mittal <anuj.mittal@intel.com>
(From OE-Core rev: 1be0de000bb852f1acc9644c1cb702336d7fdd61)

Signed-off-by: Daniel Semkowicz <dse@thaumatec.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:02 -08:00
Martin Jansa
2a7d38f814 flex: fix build with gcc-15 on host
* fixes:
  http://errors.yoctoproject.org/Errors/Details/853017/

../../flex-2.6.4/src/../lib/malloc.c:6:12: warning: conflicting types for built-in function ‘malloc’; expected ‘void *(long unsigned int)’ [-Wbuiltin-declaration-mismatch]
    6 |      void *malloc ();
      |            ^~~~~~
../../flex-2.6.4/src/../lib/malloc.c:5:1: note: ‘malloc’ is declared in header ‘<stdlib.h>’
    4 |      #include <sys/types.h>
  +++ |+#include <stdlib.h>
    5 |
../../flex-2.6.4/src/../lib/malloc.c: In function ‘rpl_malloc’:
../../flex-2.6.4/src/../lib/malloc.c:16:15: error: too many arguments to function ‘malloc’; expected 0, have 1
   16 |        return malloc (n);
      |               ^~~~~~  ~
../../flex-2.6.4/src/../lib/malloc.c:6:12: note: declared here
    6 |      void *malloc ();
      |            ^~~~~~
make[2]: *** [Makefile:1431: ../lib/stage1flex-malloc.o] Error 1

(From OE-Core rev: c13635db898146de4935c8c1c5e61cd732fa694e)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:01 -08:00
Soumya Sambu
4c457412c8 elfutils: Fix CVE-2025-1377
A vulnerability, which was classified as problematic, has been found in GNU elfutils
0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the
component eu-strip. The manipulation leads to denial of service. The attack needs to
be approached locally. The exploit has been disclosed to the public and may be used.
The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is
recommended to apply a patch to fix this issue.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-1377

Upstream patch:
https://sourceware.org/git/?p=elfutils.git;a=fbf1df9ca286de3323ae541973b08449f8d03aba

(From OE-Core rev: ae89d0c2ca49c40429f787577d280b5886f42cc1)

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:01 -08:00
Soumya Sambu
12f14af0bb elfutils: Fix CVE-2025-1376
A vulnerability classified as problematic was found in GNU elfutils 0.192. This
vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c
of the component eu-strip. The manipulation leads to denial of service. It is
possible to launch the attack on the local host. The complexity of an attack is
rather high. The exploitation appears to be difficult. The exploit has been
disclosed to the public and may be used. The name of the patch is
b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to
fix this issue.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-1376

Upstream patch:
https://sourceware.org/git/?p=elfutils.git;a=commit;h=b16f441cca0a4841050e3215a9f120a6d8aea918

(From OE-Core rev: 06e3cd0891f553b0ed036d9247dfa7c5ed814d78)

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:01 -08:00
Peter Marko
2421e79018 expat: patch CVE-2025-59375
Pick patch from PR mentioning this CVE [1]

It's a complex patch so I have checked diff of 2.6.4 and commit before
these patches landed. There were no changes in memory allocations.
Also version in scarthgap is still not that much different from current
upstream master.
Ptests pass.

Also picked one documentation commit  (-00) to resolve patch conflict.

Following conflicts were resolved manually:
* commit "mass-cppcheck.sh: Activate in-code suppression comments" was
  skipped as it only edited github actions not yet available in 2.6.4
* commit "lib: Implement tracking of dynamic memory allocations"
  ale had conflict in github actions not yet available in 2.6.4
* commit "fuzz: Be robust towards NULL return from XML_ExternalEntityParserCreate"
  edited file "expat/fuzz/xml_lpm_fuzzer.cpp" which is not present in
  our version yet. Since we're not using fuzzying, this is not needed.
* the final changelog commit needed lot conflict resolution actions

Finally picked PR fixing regression [2] together with two minor commits
to have a clean cherry-picks.
Also here the Changes commit needed conflict resolution.

[1] https://github.com/libexpat/libexpat/pull/1034
[2] https://github.com/libexpat/libexpat/pull/1048

(From OE-Core rev: 684d3cdbc08ce41dc1f92e1f228eee34bc2bc1fe)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:01 -08:00
Anders Heimer
251d8b676e libpam: mark CVE-2025-6018 as not applicable
CVE-2025-6018 is a local privilege escalation in PAM that requires
`user_readenv=1` to be enabled in the PAM configuration. The default
configuration does not enable reading user environment files (user_readenv
is 0 by default). Hence this vulnerability cannot be exploited using the
default configuration.

(From OE-Core rev: 3f2a9ad03326dc87681cf47ed5f73712ebaa624c)

Signed-off-by: Anders Heimer <anders.heimer@est.tech>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-11-03 07:17:01 -08:00
Peter Marko
ad597f4a54 vulnerabilities: update nvdcve file name
The filename is outdated as its version was already bumped and there are
also different files for different feed choices.
Use glob to match any available file.

(From yocto-docs rev: 6cd7492bf83232744390f34e496367e94b63e701)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Lee Chee Yang
c760866299 migration-guides: add release notes for 4.0.30
(From yocto-docs rev: 3f21dfda982b57a4667824f3c873fddc91ee5f5e)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit e89c95b167c24cfb9c1d5d548a26872393ca2fee)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Michael Haener
06cbccf616 oeqa/runtime/ping: don't bother trying to ping localhost
If SLIRP is being used instead of TAP for networking to the guest then
the target IP will be localhost.  There's no point in pinging localhost
to see if the target is up but whilst you'd think it is harmless, in
some containers ping doesn't actually have enough rights to work:

  ping: socktype: SOCK_RAW
  ping: socket: Operation not permitted
  ping: => missing cap_net_raw+p capability or setuid?

Look at the target address and if it's localhost or 127.0.0.* return
immediately.

(Backport from OE-Core rev: a06ef43d2a50e16c32bd6edbdc7b32c3528687d5)

(From OE-Core rev: 649147913e89cd8f7390cb17cd0be94c9710ffa6)

Signed-off-by: Michael Haener <michael.haener@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Carlos Alberto Lopez Perez
208a66a96b icu: Backport patch to fix build issues with long paths (>512 chars)
There is a bug libicu that causes libicu to be installed incorrectly when
the build system uses long paths (more than 512 chars).

This condition is not very difficult to trigger on a OE build system
due to the long paths an the deep of the directories that are usually
generated by default.
Also the bug is very subtle and won't be detected by the QA post-install
processes because what this bug causes is that a different version of
libicudata.so.X.Y (one without data) is installed instead of the one
containing the data, but there won't be any file missed on the installation
(just that it installed the wrong one).

See: https://unicode-org.atlassian.net/browse/ICU-22813

This patch backports the fix from upstream/main

(From OE-Core rev: 67d1352873957decacde30ff208fb7bb635b0c5d)

(From OE-Core rev: 0860992436092f7651e22e2b894f0d0a365a9bb0)

Signed-off-by: Carlos Alberto Lopez Perez <clopez@igalia.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Benjamin Hahn <B.Hahn@phytec.de>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Peter Marko
2e5bb26c2c python3: upgrade 3.12.11 -> 3.12.12
Drop upstreamed patch and refresh remaining patches.

Release information:
* https://www.python.org/downloads/release/python-31212/
* The release you're looking at is Python 3.12.12, a security bugfix
  release for the legacy 3.12 series.

Handles CVE-2025-59375.

(From OE-Core rev: f1234b8451ba843b5f9ec1d2066c21f54d6bc3b8)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Bruce Ashfield
dba2d4436d linux-yocto/6.6: update to v6.6.111
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

    655054d2c3c1 Linux 6.6.111
    3d3abf3f7e8b KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
    284e67a93b8c net/9p: fix double req put in p9_fd_cancelled
    ab172f4f4262 crypto: rng - Ensure set_ent is always present
    f5f235be7612 riscv: mm: Do not restrict mmap address based on hint
    1602c9b4578a riscv: mm: Use hint address in mmap if available
    e242e52fdfe4 driver core/PM: Set power.no_callbacks along with power.no_pm
    e857421992ce staging: axis-fifo: flush RX FIFO on read errors
    a3c71d6c8332 staging: axis-fifo: fix TX handling on copy_from_user() failure
    6d953e9d3981 staging: axis-fifo: fix maximum TX packet length check
    bfeea103cad9 serial: stm32: allow selecting console when the driver is module
    cb7630e714d6 hid: fix I2C read buffer overflow in raw_event() for mcp2221
    dc4874366cf6 ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
    647410a7da46 ALSA: usb-audio: Kill timer properly at removal
    97e87f367c91 platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list
    bf28f5db40d5 can: rcar_canfd: Fix controller mode setting
    e93af787187e can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled
    03510f5fce33 btrfs: ref-verify: handle damaged extent root tree
    bcccd0220751 ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
    081f14b9a3eb perf subcmd: avoid crash in exclude_cmds when excludes is empty
    6d59f7467f83 platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list
    4b91d0c5781a dm-integrity: limit MAX_TAG_SIZE to 255
    7f7187118bb5 ASoC: amd: acp: Adjust pdm gain value
    8281c2a63bbc wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
    96dc17ae64b1 USB: serial: option: add SIMCom 8230C compositions
    228d06c4cbfc media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
    71ed8b81a490 media: tuner: xc5000: Fix use-after-free in xc5000_release
    f82dc869220d media: tunner: xc5000: Refactor firmware load
    250b6e009ff9 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence

(From OE-Core rev: 2a947cb13d0d46747f14aa6a1aa39a486459ee8a)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Bruce Ashfield
787bcb1b6f linux-yocto/6.6: update to v6.6.110
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

    e617101e5626 Linux 6.6.110
    70e1e5fe9f7e ASoC: qcom: audioreach: fix potential null pointer dereference
    f617d515d66c media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
    71da40648741 media: rc: fix races with imon_disconnect()
    bb10a9ddc8d6 media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
    f03aa5e39da7 scsi: target: target_core_configfs: Add length check to avoid buffer overflow
    e28d05370969 gcc-plugins: Remove TODO_verify_il for GCC >= 16
    5d646a763232 crypto: sha256 - fix crash at kexec

(From OE-Core rev: 42854520a9476ce5ac210097a5f6ce18ecc66c80)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Bruce Ashfield
c4fd9fd38f linux-yocto/6.6: update to v6.6.109
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

    f34f16e5c6323 Linux 6.6.109
    eb53056323f13 drm/i915/backlight: Return immediately when scale() finds invalid parameters
    4529bb0b6be3d minmax.h: remove some #defines that are only expanded once
    1a899044a0f5a minmax.h: simplify the variants of clamp()
    9955044f552b5 minmax.h: move all the clamp() definitions after the min/max() ones
    26c3d697becf3 minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
    511e7d2e4d51f minmax.h: reduce the #define expansion of min(), max() and clamp()
    85d619594313e minmax.h: update some comments
    6012f69bf7495 minmax.h: add whitespace around operators and after commas
    46648b94e6ebb minmax: fix up min3() and max3() too
    f0be4c5dc213d minmax: improve macro expansion and type checking
    7194a302345da minmax: don't use max() in situations that want a C constant expression
    bb63c996c2db0 minmax: simplify min()/max()/clamp() implementation
    6183c6579356a minmax: make generic MIN() and MAX() macros available everywhere
    c0c83f4cd074b i40e: add validation for ring_len param
    6e4251690710d i40e: increase max descriptors for XL710
    7ea47a560a7a3 drm/ast: Use msleep instead of mdelay for edid read
    ed6fa21f68973 gpiolib: Extend software-node support to support secondary software-nodes
    457d2c5e112fd loop: Avoid updating block size under exclusive owner
    78f579cb7d825 mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
    e7a85efb873fa mm: migrate_device: use more folio in migrate_device_finalize()
    684a9a995748c ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB
    53888cd32a3f6 s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b
    09e3bda3a7ba2 fbcon: Fix OOB access in font allocation
    adac90bb1aaf4 fbcon: fix integer overflow in fbcon_do_set_font
    c9c2a51f91aea mm/hugetlb: fix folio is still mapped when deleted
    df1fa034c0fc2 kmsan: fix out-of-bounds access to shadow memory
    cab278cead49a afs: Fix potential null pointer dereference in afs_put_server
    58d304a89178d ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
    3887f3814c0e7 tracing: dynevent: Add a missing lockdown check on dynevent
    8703940bd30b5 crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
    b769490521cf9 i40e: improve VF MAC filters accounting
    b247cdd04750e i40e: add mask to apply valid bits for itr_idx
    edecce7abd715 i40e: add max boundary check for VF filters
    e748f1ee493f8 i40e: fix validation of VF state in get resources
    3883e9702b6a4 i40e: fix input validation logic for action_meta
    2cc26dac0518d i40e: fix idx validation in config queues msg
    50a1e2f50f6c2 i40e: fix idx validation in i40e_validate_queue_map
    3cefd898b7aa1 HID: asus: add support for missing PX series fn keys
    ba7bcfd52c66d smb: client: fix wrong index reference in smb2_compound_op()
    348736955ed6c futex: Prevent use-after-free during requeue-PI
    6ffa6b5bc861a drm/gma500: Fix null dereference in hdmi teardown
    df2c071061ed5 octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
    7b209698e648b net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
    816d30afbad52 net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
    a7a2b29c1ee44 net: dsa: lantiq_gswip: do also enable or disable cpu port
    be0bd592298f8 selftests: fib_nexthops: Fix creation of non-FDB nexthops
    24046d31f6f92 nexthop: Forbid FDB status change while nexthop is in a group
    31ae2fbc9fcb9 net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
    98a76bd96f382 bnxt_en: correct offset handling for IPv6 destination address
    82a1463c968b1 vhost: Take a reference on the task in struct vhost_task.
    bcce99f613163 Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
    6a0070c5c3ad3 Bluetooth: hci_sync: Fix hci_resume_advertising_sync
    c957284701353 ethernet: rvu-af: Remove slash from the driver name
    17edec1830e48 can: peak_usb: fix shift-out-of-bounds issue
    3664ae91b26d1 can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
    2e423e1990f39 can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
    be1b25005fd0f can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
    cbc1de71766f3 can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
    0baf92d0b1590 xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
    f64abeebf763c bpf: Reject bpf_timer for PREEMPT_RT
    865eec09b6e44 can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
    210b91bfe355b wifi: virt_wifi: Fix page fault on connect
    c5be7edd42602 smb: server: don't use delayed_work for post_recv_credits_work
    6017196aabf1d cpufreq: Initialize cpufreq-based invariance before subsys
    35bb271de241d ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
    ebe7a2e46d189 arm64: dts: imx8mp: Correct thermal sensor index
    1744aff07b833 mm: folio_may_be_lru_cached() unless folio_test_large()
    d37ec803b2813 mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
    768c44cc8b638 mm/gup: check ref_count instead of lru before migration
    dc58ab1eb90c9 mm: add folio_expected_ref_count() for reference count calculation
    4ed203f79821c mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
    df2580fbcedea IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
    943754ad81131 ALSA: usb-audio: Add mute TLV for playback volumes on more devices
    0aac2fa4d0c75 ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
    ea6016c9ec61d ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
    b61b90b07416f i2c: designware: Add quirk for Intel Xe
    41ea28a2de255 mmc: sdhci-cadence: add Mobileye eyeQ support
    306697a775fbc usb: core: Add 0x prefix to quirks debug output
    dc77154e83048 ALSA: usb-audio: Fix build with CONFIG_INPUT=n
    a3961b1f7f79e ALSA: usb-audio: Convert comma to semicolon
    d04d301614630 ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
    8fa69bd18148e ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
    9db2614986bd0 ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
    e8c605fece5b9 ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
    bafc648b82c3b ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
    08a96e22bd37f ALSA: usb-audio: Fix block comments in mixer_quirks
    18f9e77de5272 firewire: core: fix overlooked update of subsystem ABI version
    ca3e48e96816c scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE

(From OE-Core rev: 5234d795417f97cfce7bcd891e7bdeabc6f36e9e)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Bruce Ashfield
623cf58e62 linux-yocto/6.6: update to v6.6.108
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

    147338df3487 Linux 6.6.108
    42a6aeb4b238 Revert "loop: Avoid updating block size under exclusive owner"
    06146c26f5cf minmax: add a few more MIN_T/MAX_T users
    af8b531ecfd4 minmax: simplify and clarify min_t()/max_t() implementation
    2d396aa8264d minmax: avoid overly complicated constant expressions in VM code
    532733ff82b9 mptcp: propagate shutdown to subflows when possible
    3ef938f6f0b3 rtc: pcf2127: fix SPI command byte for PCF2131 backport
    075abf0b1a95 iommu/amd/pgtbl: Fix possible race while increase page table level
    564f2312e2ff xhci: dbc: Fix full DbC transfer ring after several reconnects
    3c6dd29a460f xhci: dbc: decouple endpoint allocation from initialization
    27b04564f7a3 phy: ti: omap-usb2: fix device leak at unbind
    34a8d5a198bb phy: Use device_get_match_data()
    0ee0ef483aae selftests: mptcp: userspace pm: validate deny-join-id0 flag
    650150cc9a3e mptcp: pm: nl: announce deny-join-id0 flag
    a6157484bee3 vmxnet3: unregister xdp rxq info in the reset path
    e7b7a9387955 smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
    2374c11189ef crypto: af_alg - Set merge to zero early in af_alg_sendmsg
    6a075f80f303 drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
    15a77e1ab0a9 drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
    e6b0616a360f ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
    7740da20a3a0 ASoC: wm8974: Correct PLL rate rounding
    b4e8741955dc ASoC: wm8940: Correct typo in control name
    b7e4884dd853 ASoC: wm8940: Correct PLL rate rounding
    abc9f859a9ea io_uring: include dying ring in task_work "should cancel" state
    c8e69b783bc4 io_uring: backport io_should_terminate_tw()
    115e7d4d5ee8 ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
    0a3d5a4d4adc selftests: mptcp: avoid spurious errors on TCP disconnect
    9ef1af5d4040 selftests: mptcp: connect: catch IO errors on listen side
    666b49c848f1 rds: ib: Increment i_fastreg_wrs before bailing out
    689aee35ce67 net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
    7e4c3cd7f0a1 KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
    6584e7ecfa7d mmc: mvsdio: Fix dma_unmap_sg() nents value
    ac4e940dc7da ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
    411f7d4f7038 ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed
    468bb23472b7 ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
    fc7bd02dadb8 btrfs: tree-checker: fix the incorrect inode ref size check
    090b61b87420 iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
    561eef41aaa3 LoongArch: Check the return value when creating kobj
    2ff7ef2f71b4 LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
    fb6ee62d3082 LoongArch: Update help info of ARCH_STRICT_ALIGN
    90c0ffa1e0d9 power: supply: bq27xxx: restrict no-battery detection to bq27000
    84ac57c4bbfd power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
    7c4491b5644e crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
    ee74d69af170 nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
    d3cb3f209d35 ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
    eb0378dde086 ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
    d2cfefa14ce8 octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
    8eeb2091e72d cnic: Fix use-after-free bugs in cnic_delete_task
    cd093e8bdcfe net: liquidio: fix overflow in octeon_init_instr_queue()
    13f57d484676 Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
    4cefe5be7388 tls: make sure to abort the stream if headers are bogus
    dfd06131107e tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
    97d797c5fc6f bonding: don't set oif to bond dev when getting NS target destination
    2cb17c88edd3 net/mlx5e: Harden uplink netdev access against device unbind
    fd74bd40f1a4 net/mlx5e: Consider aggregated port speed during rate configuration
    a7f10a466d36 i40e: remove redundant memory barrier when cleaning Tx descs
    0255c5100470 net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
    af114ef225e5 selftests: mptcp: sockopt: fix error messages
    dedaa9bcf79c mptcp: tfo: record 'deny join id0' info
    36d9f72e5d66 mptcp: set remote_deny_join_id0 on SYN recv
    29a5fd482cd5 bonding: set random address only when slaves already exist
    ea53e6a47e14 qed: Don't collect too many protection override GRC elements
    2f4b68e7905e dpaa2-switch: fix buffer pool seeding for control traffic
    4f364023ddcf um: virtio_uml: Fix use-after-free after put_device in probe
    5d2c34ff78b8 btrfs: fix invalid extref key setup when replaying dentry
    4a1e3ec28e80 cgroup: split cgroup_destroy_wq into 3 workqueues
    9ba2b399dee2 pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
    eae22a2573a0 wifi: mac80211: fix incorrect type for ret
    93e063f15e17 wifi: mac80211: increase scan_ies_len for S1G
    0ffb49ba247c ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
    6085291a1a58 wifi: wilc1000: avoid buffer overflow in WID string configuration

(From OE-Core rev: 0b5c6e21160e54b3b571343d932614b23231e273)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Bruce Ashfield
0eb11e9267 linux-yocto/6.6: update to v6.6.107
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

no ids found, dumping:
    af1544b5d072 Linux 6.6.107
    f075a33ef204 x86: disable image size check for test builds
    23f24d0a538e drm/i915/power: fix size for for_each_set_bit() in abox iteration
    0a87bf8bd5d7 drm/amdgpu: fix a memory leak in fence cleanup when unloading
    d70b5910ca31 net: mdiobus: release reset_gpio in mdiobus_unregister_device()
    cce57cd8c5de ksmbd: fix null pointer dereference in alloc_preauth_hash()
    ce807c4c88d2 phy: ti-pipe3: fix device leak at unbind
    7c89ea3ab302 phy: tegra: xusb: fix device and OF node leak at probe
    221f6739369b dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate
    ebf6c7c908e5 dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
    e0727853992a usb: gadget: midi2: Fix MIDI2 IN EP max packet size
    a04b32b0ec1b usb: gadget: midi2: Fix missing UMP group attributes initialization
    bea1946b6919 USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
    26f296e4c497 xhci: fix memory leak regression when freeing xhci vdev devices depth first
    0d861bc0b5c4 RISC-V: Remove unnecessary include from compat.h
    156677ea10ba hrtimers: Unconditionally update target CPU base after offline timer migration
    b1fa39fb3026 hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active()
    6276a6b2c84e hrtimer: Remove unused function
    c504b5aaaaa5 regulator: sy7636a: fix lifecycle of power good gpio
    1baed10553fc dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
    df82c7901513 dmaengine: idxd: Fix double free in idxd_setup_wqs()
    f0e460925679 dmaengine: idxd: Fix refcount underflow on module unload
    0e95ee7f532b dmaengine: idxd: Remove improper idxd_free
    608c14c671a8 hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
    b072e32e0874 hsr: use rtnl lock when iterating over ports
    72dbae1f2f21 net: hsr: Add VLAN CTAG filter support
    64a58ae64da5 net: hsr: Add support for MC filtering at the slave device
    94b050726288 can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
    deedea599e87 can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
    1e1adfffd3fe can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
    23431998a377 i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
    ff00b2ed7c64 igb: fix link test skipping when interface is admin down
    e450b4966f72 docs: networking: can: change bcm_msg_head frames member to support flexible array
    e6867c0ae100 tunnels: reset the GSO metadata before reusing the skb
    5e84e18f6727 net: bridge: Bounce invalid boolopts
    fe78891f296a net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
    092e5703d400 Disable SLUB_TINY for build testing
    8a8f093e621c USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
    e88b7810b43e USB: serial: option: add Telit Cinterion FN990A w/audio compositions
    bb3498089f86 dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
    a0da801d3ea0 serial: sc16is7xx: fix bug in flow control levels init
    1e92afef6061 tty: hvc_console: Call hvc_kick in hvc_write unconditionally
    af253b1a5daa Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups"
    7bd41f9c96dd Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
    27e126072ee0 Input: iqs7222 - avoid enabling unused interrupts
    854baafc00c4 kernfs: Fix UAF in polling when open file is released
    5de7b4141af1 cifs: fix pagecache leak when do writepages
    9f4b38ad41d6 mm/khugepaged: fix the address passed to notifier on testing young
    c95c22402b00 mm/khugepaged: convert hpage_collapse_scan_pmd() to use folios
    394547b9113f btrfs: fix corruption reading compressed range when block size is smaller than page size
    a29f891d4f37 btrfs: use readahead_expand() on compressed extents
    7bb675c9f025 mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters()
    9fe0415156fb mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
    60d7a3d2b985 mm/damon/sysfs: fix use-after-free in state_show()
    23538cfbeed8 libceph: fix invalid accesses to ceph_connection_v1_info
    b97edd195442 mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
    252bc25d7aac mtd: nand: raw: atmel: Fix comment in timings preparation
    cfdde9197ecd drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
    9adb902be26b drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
    b2fbe0f9f80b drm/mediatek: fix potential OF node use-after-free
    6632845292a4 mm/damon/core: set quota->charged_from to jiffies at first charge window
    3d278e89c2ea mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
    8577ded2ee3d fuse: prevent overflow in copy_file_range return value
    01e1eba64860 fuse: check if copy_file_range() returns larger than requested size
    c50336dfcb24 mtd: rawnand: stm32_fmc2: fix ECC overwrite
    06d8ef8f8537 mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
    31dc1603aa43 net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups
    9d55370cc4e2 i2c: i801: Hide Intel Birch Stream SoC TCO WDT
    0709bc11b942 ocfs2: fix recursive semaphore deadlock in fiemap call
    8345a93b9bda mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
    e69f61b8c08e compiler-clang.h: define __SANITIZE_*__ macros only when undefined
    deedce87471e Revert "SUNRPC: Don't allow waiting for exiting tasks"
    6f628d7dd8ac EDAC/altera: Delete an inappropriate dma_free_coherent() call
    2089d8a316f4 KVM: SVM: Set synthesized TSA CPUID flags
    2b8a1969cae5 rcu-tasks: Maintain real-time response in rcu_tasks_postscan()
    d89abc4fbee8 rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks
    4e86206b6967 rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks
    8be3d52101b0 proc: fix type confusion in pde_set_flags()
    66bcb04a441f tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
    449682e76f32 bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
    d660c8d8142e s390/cpum_cf: Deny all sampling events by counter PMU
    1262bda871da tracing: Silence warning when chunk allocation fails in trace_pid_write
    69d99a936f00 NFSv4/flexfiles: Fix layout merge mirror check.
    c288e4c39d21 NFSv4.2: Serialise O_DIRECT i/o and copy range
    9f2fdb18d0bf NFSv4.2: Serialise O_DIRECT i/o and clone range
    4089fd70a508 NFSv4.2: Serialise O_DIRECT i/o and fallocate()
    320a0954e2c8 NFS: Serialise O_DIRECT i/o and truncate()
    275d9fd06d96 fs/nfs/io: make nfs_start_io_*() killable
    06c26a679029 ftrace/samples: Fix function size computation
    f7ec68cc74d8 tracing: Fix tracing_marker may trigger page fault during preempt_disable
    781ec30354e6 NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
    b39234ede545 NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
    a022c9a46455 NFSv4: Don't clear capabilities that won't be reset
    9339b4e75a81 SUNRPC: call xs_sock_process_cmsg for all cmsg
    fd00ae04c5aa flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
    0214b96a6a63 ima: limit the number of ToMToU integrity violations
    905d43b8ad24 net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
    9da2a9d3ccd8 media: i2c: imx214: Fix link frequency validation
    817a962db3f3 NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs()
    913ff520714f nfsd: Fix a regression in nfsd_setattr()
    392260eb8e67 kasan: fix GCC mem-intrinsic prefix with sw tags
    d699575d00ff mm: introduce and use {pgd,p4d}_populate_kernel()
    3f8810b2d22d kunit: kasan_test: disable fortify string checker on kasan_strings() test

(From OE-Core rev: 4964bdf8bf8b4c889928478db3e0d901e748fe55)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Bruce Ashfield
d78bf37c9c linux-yocto/6.6: update to v6.6.106
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

no ids found, dumping:
    60a9e718726f Linux 6.6.106
    3b9e7e5c5298 x86/vmscape: Add old Intel CPUs to affected list
    1e1dc1f9edb9 x86/vmscape: Warn when STIBP is disabled with SMT
    a5d029f1152a x86/bugs: Move cpu_bugs_smt_update() down
    34e566704105 x86/vmscape: Enable the mitigation
    f866eef8d1c6 x86/vmscape: Add conditional IBPB mitigation
    813cb831439c x86/vmscape: Enumerate VMSCAPE bug
    9d1677060428 Documentation/hw-vuln: Add VMSCAPE documentation
    fe9731e10004 Linux 6.6.105
    be4e6a221467 spi: fsl-qspi: Fix double cleanup in probe error path
    054a444b4c17 dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
    b718de5904a6 cpufreq: intel_pstate: Check turbo_is_disabled() in store_no_turbo()
    d0b26a9f5742 cpufreq: intel_pstate: Read global.no_turbo under READ_ONCE()
    a44d0904d673 cpufreq: intel_pstate: Rearrange show_no_turbo() and store_no_turbo()
    524ee2606a30 riscv: use lw when reading int cpu in asm_per_cpu
    522ffe298627 mm: slub: avoid wake up kswapd in set_track_prepare
    ad2df864033e slub: Reflow ___slab_alloc()
    c866c40d07c4 tools: gpio: remove the include directory on make clean
    3c331f7fc5b6 tools: gpio: rm .*.cmd on make clean
    7e4f8e09d577 drm/amd/amdgpu: Fix missing error return on kzalloc failure
    718c248902dd drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c
    c9c4635a6d55 perf bpf-event: Fix use-after-free in synthesis
    85da7f36d9a0 drm/bridge: ti-sn65dsi86: fix REFCLK setting
    1a7d3947a5dd spi: spi-fsl-lpspi: Clear status register after disabling the module
    cd53048e7460 spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
    a339956545a5 spi: spi-fsl-lpspi: Set correct chip-select polarity bit
    a786ef5f693b spi: spi-fsl-lpspi: Fix transmissions when using CONT
    2313baff36d0 hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
    8699358b6ac9 pcmcia: Add error handling for add_interval() in do_validate_mem()
    3ee8f5c8938f pcmcia: omap: Add missing check for platform_get_resource
    8d7ee56bf530 Revert "drm/amdgpu: Avoid extra evict-restore process."
    b9cf42a8f034 ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
    5f46882be912 ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
    7d98166183d6 drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv
    2c6c9d319017 drm/mediatek: Fix using wrong drm private data to bind mediatek-drm
    13d0854e3538 drm/mediatek: Add crtc path enum for all_drm_priv array
    d5875a478b1b vmxnet3: update MTU after device quiesce
    5174ea81d6ca net: dsa: microchip: linearize skb for tail-tagging switches
    3b6a5df36604 net: dsa: microchip: update tag_ksz masks for KSZ9477 family
    16fea5067092 dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
    dd2b7abd0da3 ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
    7df63b5ddd07 ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
    47aba94a924c iio: pressure: mprls0025pa: use aligned_s64 for timestamp
    e791bf216c9e iio: light: opt3001: fix deadlock due to concurrent flag access
    91da53307391 iio: chemical: pms7003: use aligned_s64 for timestamp
    fb6a7c1da207 iio: imu: inv_mpu6050: align buffer for timestamp
    977849e8acd2 btrfs: adjust subpage bit start based on sectorsize
    b088ae4e4184 PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads
    30d201ee3a37 thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold
    50ae352c1848 spi: fsl-qspi: use devm function instead of driver remove
    0ef7058b4dc6 mm/slub: avoid accessing metadata when pointer is invalid in object_err()
    ba0ccc1be52c nouveau: fix disabling the nonstall irq due to storm code
    033f09b647db cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
    83440514ef2a cpufreq: intel_pstate: Do not update global.turbo_disabled after initialization
    86cade7791a2 cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into caller
    e7f4f16ff167 cpufreq: intel_pstate: Revise global turbo disable check
    de6b545bcdba Revert "spi: spi-cadence-quadspi: Fix pm runtime unbalance"
    94f7d9070382 Revert "spi: cadence-quadspi: fix cleanup of rx_chan on failure paths"
    f4f7cde70f59 net: pcs: rzn1-miic: Correct MODCTRL register offset
    50a84d5c8140 e1000e: fix heap overflow in e1000_set_eeprom
    1cfa5dd05847 cifs: prevent NULL pointer dereference in UTF16 conversion
    bb37252c9af1 batman-adv: fix OOB read/write in network-coding decode
    d96cc9a1b577 scsi: lpfc: Fix buffer free/clear order in deferred receive path
    abab31c377cb platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list
    350bfdd2841f drm/amdgpu: drop hw access in non-DC audio fini
    9e4293766e4f wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
    9df29aa5637d wifi: mwifiex: Initialize the chan_stats array to zero
    bc983b834354 soc: qcom: mdt_loader: Deal with zero e_shentsize
    698abcf08818 proc: fix missing pde_set_flags() for net proc files
    e9188f66e949 ocfs2: prevent release journal inode after journal shutdown
    f9b8d4dba8e7 sched: Fix sched_numa_find_nth_cpu() if mask offline
    6797a8b3f71b mm: move page table sync declarations to linux/pgtable.h
    26ff568f390a x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()
    2ee32c4c4f63 pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
    50f2f392eb6e arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module with CONFIG_DYNAMIC_FTRACE
    90e9372ec0b0 ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
    ad17940a6618 ALSA: usb-audio: Add mute TLV for playback volumes on some devices
    a4e366fbec8a phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
    9b035445b7c9 selftest: net: Fix weird setsockopt() in bind_bhash.c.
    85c1c86a67e0 ppp: fix memory leak in pad_compress_skb
    01d2690c09e6 net: atm: fix memory leak in atm_register_sysfs when device_register fail
    7d449b7a6c8e ax25: properly unshare skbs in ax25_kiss_rcv()
    5852cee1d8f6 mctp: return -ENOPROTOOPT for unknown getsockopt options
    7f8869586dd6 net/smc: Remove validation of reserved bits in CLC Decline message
    90ab05ed47c1 ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
    bee1e19cf1fa net: thunder_bgx: decrement cleanup index before use
    4535729550cf net: thunder_bgx: add a missing of_node_put
    e472f59d02c8 wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
    609f6debdff3 wifi: libertas: cap SSID len in lbs_associate()
    ccb839602a82 wifi: cw1200: cap SSID length in cw1200_do_join()
    61b80fbdc072 net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
    5d7b2d45770e wifi: ath11k: fix group data packet drops during rekey
    6bf934426760 wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay()
    38b86b0a37df wifi: ath11k: rename ath11k_start_vdev_delay()
    14ed9f84c7c0 wifi: ath11k: Introduce and use ath11k_sta_to_arsta()
    fb216d980fae i40e: Fix potential invalid access when MAC list is empty
    f18d9b3abf9c net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
    668f4f6382c3 macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
    1cf0b558cbb7 netlink: add variable-length / auto integers
    5430388a8111 net: macb: Fix tx_ptr_lock locking
    8d09b13789ba icmp: fix icmp_ndo_send address translation for reply direction
    1dda64fb3f5e mISDN: Fix memory leak in dsp_hwec_enable()
    9a4abe262df9 xirc2ps_cs: fix register access when enabling FullDuplex
    6077d16b5c0f Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
    bd75eba88e88 Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
    2acc8d3f0a3c netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
    50db11e2bbb6 netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
    f1150153c4e5 wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work
    b7d08929178c wifi: cfg80211: fix use-after-free in cmp_bss()
    4a05520d12a7 arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC
    f7a48ef44576 arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM
    5b94a825945a tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
    0383e172435f arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
    add1ecc8f3ad tee: fix NULL pointer dereference in tee_shm_put
    bf89b1f87c72 fs: writeback: fix use-after-free in __mark_inode_dirty()
    41e168db5942 Bluetooth: hci_sync: Avoid adding default advertising on startup
    703ea9e34f96 cpupower: Fix a bug where the -t option of the set subcommand was not working.
    2b21fd1cf77e drm/amd/display: Don't warn when missing DCE encoder caps
    235a4c0a8aaa cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
    ee58a0a35378 LoongArch: Save LBT before FPU in setup_sigcontext()
    dc4a024b1990 btrfs: avoid load/store tearing races when checking if an inode was logged
    48545620ca8f btrfs: fix race between setting last_dir_index_offset and inode logging
    9f76a2e19baf btrfs: fix race between logging inode and checking if it was logged before
    7acfa07c585e bpf: Fix oob access in cgroup local storage
    dbd8ec2261b8 bpf: Move bpf map owner out of common struct
    8e573ac21fcd bpf: Move cgroup iterator helpers to bpf.h
    3eeefeb9d62d bpf: Add cookie object to bpf maps
    355bd0b51d2f Linux 6.6.104
    d3cc7476b89f xfs: do not propagate ENODATA disk errors into xattr code
    0699faf70413 Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"
    6c9552de7f7e HID: mcp2221: Handle reads greater than 60 bytes
    5a809b34250c HID: mcp2221: Don't set bus speed on every transfer
    1b3ccc394807 net/mlx5: SF, Fix add port error handling
    ea687c003663 net: rose: fix a typo in rose_clear_routes()
    4e86e5ba325e drm/nouveau/disp: Always accept linear modifier
    1424f6132fc8 smb3 client: fix return code mapping of remap_file_range
    3c3321091733 net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
    4191ea1f0bb3 fs/smb: Fix inconsistent refcnt update
    4f43a6d376da dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
    8911ec881cd7 Revert "drm/amdgpu: fix incorrect vm flags to map bo"
    e422370e6ab2 HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
    b9166ea27d0a HID: wacom: Add a new Art Pen 2
    88d3c2790c33 HID: logitech: Add ids for G PRO 2 LIGHTSPEED
    8783b2a0b740 HID: quirks: add support for Legion Go dual dinput modes
    d4e6e2680807 HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
    5f3c0839b173 HID: asus: fix UAF via HID_CLAIMED_INPUT validation
    c84ba4cdf4c6 x86/microcode/AMD: Handle the case of no BIOS microcode
    f49161646e03 KVM: x86: use array_index_nospec with indices that come from guest
    925599eba460 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
    463aa96fca62 sctp: initialize more fields in sctp_v6_from_sk()
    9c547c8eee9d net: rose: include node references in rose_neigh refcount
    f8c29fc437d0 net: rose: convert 'use' field to refcount_t
    4998ab3eb2b8 net: rose: split remove and free operations in rose_remove_neigh()
    b0f8725196ae net: stmmac: Set CIC bit only for TX queues with COE
    dc38d0111c16 net: stmmac: xgmac: Correct supported speed modes
    d02d635fc03d net: stmmac: Rename phylink_get_caps() callback to update_caps()
    ce006b60fc49 net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
    9b0acd3bb291 net/mlx5e: Set local Xoff after FW update
    dec9d873bdf7 net/mlx5e: Update and set Xon/Xoff upon port speed set
    cdd96ed12524 net/mlx5e: Update and set Xon/Xoff upon MTU set
    3e07c623fbc5 net/mlx5: Nack sync reset when SFs are present
    a623e80aaa85 net/mlx5: Convert SF port_indices xarray to function_ids xarray
    a7e9da4d3afb net/mlx5: Use devlink port pointer to get the pointer of container SF struct
    25659835c7af net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc()
    ddac9d0fe249 net/mlx5: Fix lockdep assertion on sync reset unload event
    8da591ae2614 net/mlx5: Add support for sync reset using hot reset
    6292688e07d0 net/mlx5: Add device cap for supporting hot reset in sync reset flow
    09fd27c8621e net/mlx5: Reload auxiliary drivers on fw_activate
    7acefa4c66aa phy: mscc: Fix when PTP clock is register and unregister
    b3c70f6fc258 net: dlink: fix multicast stats being counted incorrectly
    589edd3dc8fb dt-bindings: display/msm: qcom,mdp5: drop lut clock
    dc70ea942fcd ice: fix incorrect counter for buffer allocation failures
    05fc7307e352 ice: stop storing XDP verdict within ice_rx_buf
    29bcd31ace16 ice: gather page_count()'s of each frag right before XDP prog call
    40a9f217cde1 ice: Introduce ice_xdp_buff
    4de399767ddc drm/nouveau: remove unused memory target test
    32a498445641 drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
    3c80c230d6e3 atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
    4bd2866db002 Bluetooth: hci_sync: fix set_local_name race condition
    961abec8184a Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
    f356ed87c78c Bluetooth: hci_event: Mark connection as closed during suspend disconnect
    4c549d87f016 Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
    430786612abe HID: input: report battery status changes immediately
    61d733a568d8 HID: input: rename hidinput_set_battery_charge_status()
    e7d0bd359f4c powerpc/kvm: Fix ifdef to remove build warning
    6de90c2a3b6c drm/msm: Defer fd_install in SUBMIT ioctl
    a208d67cb44b net: ipv4: fix regression in local-broadcast routes
    9b2700151660 vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
    181feb41f0b2 NFS: Fix a race when updating an existing write
    9a1963404cc2 nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests
    b15342e09644 ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
    612527136e0c erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
    8f8e6a781783 ASoC: codecs: tx-macro: correct tx_macro_component_drv name
    24b9ed739c8c smb: client: fix race with concurrent opens in rename(2)
    bc1427a48371 smb: client: fix race with concurrent opens in unlink(2)
    43662b846c7a scsi: core: sysfs: Correct sysfs attributes access rights
    28c8fb7ae2ad ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
    9e0743eb6dcf of: dynamic: Fix use after free in of_changeset_add_prop_helper()
    749137b41e70 of: Add a helper to free property struct
    d3be2b8cff6f mips: lantiq: xway: sysctrl: rename the etop node
    e877b861dab9 mips: dts: lantiq: danube: add missing burst length property
    6e59b8483e6e pinctrl: STMFX: add missing HAS_IOMEM dependency
    43e3118c677a of: dynamic: Fix memleak when of_pci_add_properties() failed

(From OE-Core rev: 212df1778245f7b299b549285ea0994234e163fa)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Bruce Ashfield
7b08b57feb linux-yocto/6.6: update to v6.6.103
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

no ids found, dumping:
    cc1a1c5b404a Linux 6.6.103
    40b36d9a612b alloc_fdtable(): change calling conventions.
    a0a3ace2a578 netfilter: nf_reject: don't leak dst refcount for loopback packets
    c1aa819059b8 s390/hypfs: Enable limited access during lockdown
    972d84075e3b s390/hypfs: Avoid unnecessary ioctl registration in debugfs
    81a0f002e4fd ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
    7d67d591ecb0 net/mlx5e: Preserve shared buffer capacity during headroom updates
    dacf1ca11735 net/mlx5: Base ECVF devlink port attrs from 0
    c71a3e2b02e7 Octeontx2-af: Skip overlap check for SPI field
    2919ca876e15 bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU
    45b70352d186 bonding: Add independent control state machine
    f0c7885ef8d3 bonding: update LACP activity flag after setting lacp_active
    ca88ac44368c net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
    aa12ee1c1bd2 net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
    ee7134481ff7 igc: fix disabling L1.2 PCI-E link substate on I226 on init
    d10f670b6f86 ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
    5189c0b7c251 LoongArch: Optimize module load time by optimizing PLT/GOT counting
    070b4af44c4b net/smc: fix UAF on smcsk after smc_listen_out()
    ba51d73408ed gve: prevent ethtool ops after shutdown
    748da8083122 net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
    3a4eeea79a46 phy: mscc: Fix timestamping for vsc8584
    ca18d751bcc9 ppp: fix race conditions in ppp_fill_forward_path
    06a7acd45a8f net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
    87f78799e358 ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
    2156d9e9f2e4 net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
    857b8387a977 drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
    b79027f7ebb7 ALSA: usb-audio: Fix size validation in convert_chmap_v3()
    f93032e5d68f drm/hisilicon/hibmc: fix the hibmc loaded failed bug
    e50599adc966 mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
    469c45c8a16a Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
    ae1d9779f089 Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
    8f80c633cba1 iommu/amd: Avoid stack buffer overflow from kernel cmdline
    f5ad0819f902 scsi: qla4xxx: Prevent a potential error pointer dereference
    96476b043efb net: bridge: fix soft lockup in br_multicast_query_expired()
    7aee3d519d63 RDMA/bnxt_re: Fix to initialize the PBL array
    5d3f018fc09a RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
    7b044e925aba RDMA/bnxt_re: Fix to do SRQ armena by default
    acf0dea8dc90 RDMA/erdma: Fix ignored return value of init_kernel_qp
    76588276fcf8 iosys-map: Fix undefined behavior in iosys_map_clear()
    34c3bc762bc4 cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key
    72553fe19317 drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
    ad994eda5d95 spi: spi-fsl-lpspi: Clamp too high speed_hz
    7207923d8453 x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
    4986548825fe usb: typec: maxim_contaminant: disable low power mode when reading comparator values
    f56e75b85b54 usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean
    e600de541c37 usb: xhci: Fix slot_id resource race conflict
    8d2b63fbfd4d iio: imu: inv_icm42600: change invalid data error to -EBUSY
    0af5812acfac iio: imu: inv_icm42600: Convert to uXX and sXX integer types
    ec3310a5168b iio: imu: inv_icm42600: use = { } instead of memset()
    f52d8ba43259 iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64
    f13768b9b829 iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
    99b508340d0d iio: light: as73211: Ensure buffer holes are zeroed
    58ff8064cb4c tracing: Limit access to parser->buffer when trace_get_user failed
    648e01a023cb tracing: Remove unneeded goto out logic
    c09dd3773b59 tls: fix handling of zero-length records on the rx_list
    93879b3ba967 powerpc/boot: Fix build with gcc 15
    5c67f7e4330e mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
    03695cdfcb5e compiler: remove __ADDRESSABLE_ASM{_STR,}() again
    fa833df2ba9e drm/amd/display: Don't overclock DCE 6 by 15%
    7660124e6506 usb: dwc3: pci: add support for the Intel Wildcat Lake
    84c95dbf5bec usb: dwc3: Remove WARN_ON for device endpoint command timeouts
    319aba29a486 usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
    dbfaa79103b4 USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
    bf29c9618160 usb: storage: realtek_cr: Use correct byte order for bcs->Residue
    adfdc6ed189b USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
    cd3bace9c9a3 usb: renesas-xhci: Fix External ROM access timeouts
    3b4a57b5cc3b usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test
    d84f6e77ebe3 comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()
    0eb4ed2aa261 comedi: pcl726: Prevent invalid irq number
    842f307a1d11 comedi: Make insn_rw_emulate_bits() do insn->n samples
    decaa5401cb4 usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
    20729b825914 cdx: Fix off-by-one error in cdx_rpmsg_probe()
    4de009fc0a3a most: core: Drop device reference after usage in get_channel()
    bc4e3186a2e2 iio: proximity: isl29501: fix buffered read on big-endian systems
    6a605d307b02 iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
    3b114a3282ab ftrace: Also allocate and copy hash for reading of filter files
    bb912a20fab0 fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
    65e46aeaf84a drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
    d404824f3d25 cpuidle: governors: menu: Avoid selecting states with too much latency
    3a92598c3e55 cpuidle: menu: Remove iowait influence
    f0aa8591ba0c mmc: sdhci-pci-gli: Add a new function to simplify the code
    1eae029f79b6 mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values
    fd269466abe6 selftests: mptcp: pm: check flush doesn't reset limits
    a9cf4362d4d0 mptcp: disable add_addr retransmission when timeout is 0
    ebe3d8cf1ee6 mptcp: remove duplicate sk_reset_timer call
    1982e18bbcc1 use uniform permission checks for all mount propagation changes
    c5aa6ba11273 fs/buffer: fix use-after-free when call bh_read() helper
    212eb86f75b4 smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
    740ccba37a12 arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
    342f7a1dda77 ext4: preserve SB_I_VERSION on remount
    047b4cb30e42 scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
    c065c8d20dd0 scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
    6d53b2a134da scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
    0c3333f7bfee PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features
    d0252e69b932 PCI: imx6: Delay link start until configfs 'start' written
    cee067ef2055 PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
    7b688b365ace PCI: rockchip: Use standard PCIe definitions
    72ff3acf0044 soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
    ef2f64dff281 drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs
    a98aa702c74f drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
    e95f4fd56f6c drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
    5b011264c5da drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
    36a6b43573d1 drm/amd/display: Avoid a NULL pointer dereference
    86c2825791c3 s390/sclp: Fix SCCB present check
    50db1ab0f3ec ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6
    0a1385336970 mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
    63962ff932ef mm/debug_vm_pgtable: clear page table entries at destroy_args()
    8d03bce0dcb2 squashfs: fix memory leak in squashfs_fill_super
    92c9689646c8 mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
    0207d8faa1fb memstick: Fix deadlock by moving removing flag earlier
    28b82be094e2 KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix
    d1446050a29a sched/fair: Fix frequency selection for non-invariant case
    858e035ea448 topology: Set capacity_freq_ref in all cases
    68df021d3cfa arm64/amu: Use capacity_ref_freq() to set AMU ratio
    cf4faefd3a7b cpufreq/cppc: Set the frequency used for computing the capacity
    11da2b1ae4c9 energy_model: Use a fixed reference frequency
    6688eb926932 cpufreq/schedutil: Use a fixed reference frequency
    9771732ab39c cpufreq: Use the fixed and coherent frequency for scaling capacity
    46db6d4797f1 sched/topology: Add a new arch_scale_freq_ref() method
    0ed2068de1f9 kbuild: userprogs: use correct linker when mixing clang and GNU ld
    5b7912d83962 ata: libata-scsi: Return aborted command when missing sense and result TF
    9e9b1fa7ecaa PM: runtime: Take active children into account in pm_runtime_get_if_in_use()
    ac2e62cab097 PM: runtime: Simplify pm_runtime_get_if_active() usage
    c0f179c1547f ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
    dc35f594b0d2 usb: dwc3: imx8mp: fix device leak at unbind
    1636b5e9c354 mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
    365771ee3dc8 wifi: mac80211: check basic rates validity in sta_link_apply_parameters
    b59bea60396c KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
    65b6b10fc005 s390/mm: Remove possible false-positive warning in pte_free_defer()
    0852c97fec9c btrfs: send: make fs_path_len() inline and constify its argument
    8f3aae5fd76d btrfs: send: use fallocate for hole punching with send stream v2
    f942e47453a8 btrfs: send: avoid path allocation for the current inode when issuing commands
    dbda681a0a93 btrfs: send: keep the current inode's path cached
    ffc19fe2a7ad btrfs: send: add and use helper to rename current inode when processing refs
    bfed58ed10f1 btrfs: send: only use boolean variables at process_recorded_refs()
    253557254f8d btrfs: send: factor out common logic when sending xattrs
    b1947464c041 btrfs: populate otime when logging an inode item
    d7badc2ba4da btrfs: constify more pointer parameters
    9dfdea89ceb3 btrfs: fix ssd_spread overallocation
    9c64d6b07cbb btrfs: open code timespec64 in struct btrfs_inode
    8f85af32692d xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
    4734255ef39b btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
    467dcf7e4a61 btrfs: always abort transaction on failure to add block group to free space tree
    8c5bf13905f3 btrfs: move transaction aborts to the error site in add_block_group_free_space()
    b172535ccba1 btrfs: qgroup: fix race between quota disable and quota rescan ioctl
    d6f1a6c2f567 btrfs: don't ignore inode missing when replaying log tree
    a779d1dd7f2d usb: typec: fusb302: cache PD RX state
    827f7b4fe051 PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
    80617b3926b6 block: Make REQ_OP_ZONE_FINISH a write operation
    6c77d4e0f6ad block: reject invalid operation in submit_bio_noacct
    3bbd52a413fc fscrypt: Don't use problematic non-inline crypto engines
    c8a1e1f02921 leds: flash: leds-qcom-flash: Fix registry access after re-bind
    71230248a711 leds: flash: leds-qcom-flash: Limit LED current based on thermal condition
    84a24fb446ee net/sched: ets: use old 'nbands' while purging unused classes
    81505f137b3a net_sched: sch_ets: implement lockless ets_dump()
    00dc616e6cb5 smb: client: fix netns refcount leak after net_passive changes
    2668e038800b net: better track kernel sockets lifetime
    ac90037bf398 net: Add net_passive_inc() and net_passive_dec().
    5dd481868eb1 selftests/memfd: add test for mapping write-sealed memfd read-only
    2e4179698f84 mm: reinstate ability to map write-sealed memfd mappings read-only
    87a75f68eaba mm: update memfd seal write check to include F_SEAL_WRITE
    17c5d49beb6c mm: drop the assumption that VM_SHARED always implies writable
    440d36847a12 mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
    253b7d8bafe6 mptcp: drop skb if MPTCP skb extension allocation fails
    cf0a88124e35 ACPI: pfr_update: Fix the driver update version check
    3ddd55cf19ed ipv6: sr: Fix MAC comparison to be constant-time
    b117c41b0090 net, hsr: reject HSR frame if skb can't hold tag
    3afdeb96dc5f drm/amd/display: Don't overwrite dce60_clk_mgr
    39f187cbf7ed drm/amd/display: Add primary plane to commits for correct VRR handling
    74ee7445c3b6 drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
    627f30a328f2 drm/amdgpu: update mmhub 3.0.1 client id mappings
    a3201e3b7cf1 drm/amdgpu: Avoid extra evict-restore process.
    0e7f5f9aa498 drm/amd: Restore cached power limit during resume
    002860142ceb media: venus: venc: Clamp param smaller than 1fps and bigger than 240
    f866778583b6 media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
    f54be97bc69b media: venus: protect against spurious interrupts during probe
    041015a46597 media: venus: hfi: explicitly release IRQ during teardown
    ba567c2e52fb media: venus: Add a check for packet size after reading from shared memory
    03c0e00ccf59 media: qcom: camss: cleanup media device allocated resource on error path
    3c0e4cc4f55f media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls
    61f267b77dbc media: ov2659: Fix memory leaks in ov2659_probe()
    1c2769dc8025 media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
    3d83d0b5ae50 media: usbtv: Lock resolution while streaming
    ecb7382089bc media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
    b3433cffee8d media: verisilicon: Fix AV1 decoder clock frequency
    6a41dc143e3c media: vivid: fix wrong pixel_array control size
    8ad57bd4a952 media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
    c231d1964878 media: hi556: correct the test pattern configuration
    0148fcdd9140 media: gspca: Add bounds checking to firmware parser
    85bfcb0e40fe parisc: Update comments in make_insert_tlb
    9827b2b0c64e parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault()
    8bccf47adbf6 parisc: Revise gateway LWS calls to probe user read access
    4c981077255a parisc: Revise __get_user() to probe user read access
    d6ac1e11c4a0 parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c
    033605fb20a3 parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers
    69cf90e5aa50 parisc: Drop WARN_ON_ONCE() from flush_cache_vmap
    0199adb6d1f2 parisc: Define and use set_pte_at()
    b334724f6b31 parisc: Check region is readable by user in raw_copy_from_user()
    fe0886c98b63 soc/tegra: pmc: Ensure power-domains are in a known state
    41f40038de62 jbd2: prevent softlockup in jbd2_log_do_checkpoint()
    92ef491b506a f2fs: fix to avoid out-of-boundary access in dnode page
    5d109edb38c9 phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence
    adb482170045 vhost/vsock: Avoid allocating arbitrarily-sized SKBs
    ee438c492b2e vsock/virtio: Validate length in packet header before skb_put()
    6ee4578274d1 PCI: endpoint: Fix configfs group removal on driver teardown
    0758862386f1 PCI: endpoint: Fix configfs group list head handling
    d1f59c792c6f mtd: rawnand: renesas: Add missing check after DMA map
    fcb12d1e4163 mtd: rawnand: fsmc: Add missing check after DMA map
    9de4819feef9 mtd: spinand: propagate spinand_wait() errors from spinand_write_page()
    b9e9afc35a89 mtd: spi-nor: Fix spi_nor_try_unlock_all()
    749ccc175ca5 hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
    747977aeefd4 pwm: mediatek: Fix duty and period setting
    070236488cc9 pwm: mediatek: Handle hardware enable and clock enable separately
    cbf3815d8c11 pwm: imx-tpm: Reset counter if CMOD is 0
    aa48271f7bef wifi: ath11k: fix dest ring-buffer corruption when ring is full
    ee3c10c9738b wifi: ath11k: fix source ring-buffer corruption
    069819aa84d2 wifi: ath11k: fix dest ring-buffer corruption
    daa2b66fa569 wifi: ath12k: fix dest ring-buffer corruption when ring is full
    bfd4918b2b9b wifi: ath12k: fix source ring-buffer corruption
    b5b6201a2b75 wifi: ath12k: fix dest ring-buffer corruption
    97e07460ba85 wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
    296bcff76d41 iio: adc: ad_sigma_delta: change to buffer predisable
    50e823a23816 iio: imu: bno055: fix OOB access of hw_xlate array
    e22e5ac22736 zynq_fpga: use sgtable-based scatterlist wrappers
    981c845f2983 soc: qcom: mdt_loader: Ensure we don't read past the ELF header
    bfa87a2cafb5 ata: libata-scsi: Fix CDL control
    6f5d34088250 scsi: ufs: ufs-pci: Fix default runtime and system PM levels
    03d559670ccd scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers
    8247c4269acb ata: libata-scsi: Fix ata_to_sense_error() status handling
    728abc895294 scsi: mpi3mr: Fix race between config read submit and interrupt completion
    78f1d313442c dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints
    c4adc491a326 dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
    745c9b114eaf arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses
    d1aca165c1f1 arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1
    06c3fda2bda8 arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default
    2fdddc181262 btrfs: zoned: fix write time activation failure for metadata block group
    5fc0345e1af3 ext4: fix hole length calculation overflow in non-extent inodes
    e0bb195aea7a ext4: use kmalloc_array() for array space allocation
    173270d9fe86 ext4: don't try to clear the orphan_present feature block device is r/o
    d387cee49cfe ext4: fix reserved gdt blocks handling in fsmap
    052cd20d8d75 ext4: fix fsmap end of range reporting with bigalloc
    ab1cc862e55e ext4: check fast symlink for ea_inode correctly
    d0570a5b9ccc tracing: fprobe-event: Sanitize wildcard for fprobe event name
    d9e157fcfebc ksmbd: extend the connection limiting mechanism to support IPv6
    a1d2bab4d533 ksmbd: fix refcount leak causing resource not released
    820949bbf33f Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
    5858448a6c65 crypto: qat - flush misc workqueue during device shutdown
    fd2844179567 crypto: qat - lower priority for skcipher and aead algorithms
    ea95d4e8a263 lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
    c82ad93be639 vt: defkeymap: Map keycodes above 127 to K_HOLE
    c0942ce38843 vt: keyboard: Don't process Unicode characters in K_OFF mode
    5e17429679a8 bus: mhi: host: Detect events pointing to unexpected TREs
    38de63c2876e bus: mhi: host: Fix endianness of BHI vector table
    e192ebb7521c usb: dwc3: meson-g12a: fix device leaks at unbind
    d52ad077933f usb: musb: omap2430: fix device leak at unbind
    21c400de1079 usb: gadget: udc: renesas_usb3: fix device leak at unbind
    295425f52052 usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
    e06e9ef1912c m68k: Fix lost column on framebuffer debug console
    b4b21367cb9c platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
    1bf5cc1edb37 cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
    cb7b3633ed74 serial: 8250: fix panic due to PSLVERR
    2328010117d0 rcu: Fix racy re-initialization of irq_work causing hangs
    049874a185aa HID: apple: avoid setting up battery timer for devices without battery
    05a40e70ff5a HID: magicmouse: avoid setting up battery timer when not needed
    5661fdd218c2 RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
    b9669bedc63d tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros
    fdd1c9f78c24 media: uvcvideo: Do not mark valid metadata as invalid
    8f274e2b05fd media: venus: Fix OOB read due to missing payload bound check
    a97e062e4ff3 media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
    1da95d3d4b7b mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
    e21a3ddd5873 mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
    74fb3b1b335b parisc: Makefile: fix a typo in palo.conf
    2a70cbd1aef8 hv_netvsc: Fix panic during namespace deletion with VF
    27b118aebdd8 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
    f83d4c81bda3 btrfs: do not allow relocation of partially dropped subvolumes
    77e07f7226f4 btrfs: zoned: do not select metadata BG as finish target
    6b801da8e146 btrfs: fix log tree replay failure due to file with 0 links and extents
    a002525b2fd7 btrfs: clear dirty status from extent buffer on error at insert_new_root()
    99e36ff41a74 btrfs: zoned: do not remove unwritten non-data block group
    e02bdb223399 btrfs: abort transaction during log replay if walk_log_tree() failed
    ec5bfcfb6e0d btrfs: zoned: use filesystem size not disk size for reclaim decision
    9dfe40cb6c2c cdc-acm: fix race between initial clearing halt and open
    729ac69a3e81 thunderbolt: Fix copy+paste error in match_service_id()
    5c4a2ffcbd05 comedi: fix race between polling and detaching
    e613904fa419 usb: typec: ucsi: Update power_supply on power role change
    ca9fb654f89b misc: rtsx: usb: Ensure mmc child device is active when card is present
    5badd56c711e usb: core: config: Prevent OOB read in SS endpoint companion parsing
    492207cf8372 ext4: fix largest free orders lists corruption on mb_optimize_scan switch
    88d02c333989 ext4: fix zombie groups in average fragment size lists
    d19b817540c0 iommufd: Prevent ALIGN() overflow
    2ccccb0e4178 iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range
    a11b6ee7cab8 iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
    7e0c0664e9aa cifs: reset iface weights when we cannot find a candidate
    1b6310d14b13 drm/amdgpu: fix incorrect vm flags to map bo
    3fbc2e43ab12 ASoC: fsl_sai: replace regmap_write with regmap_update_bits
    8270fbcc1ec4 scsi: lpfc: Remove redundant assignment to avoid memory leak
    063fe9b16be1 rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
    24334f3cf8a2 pNFS: Fix uninited ptr deref in block/scsi layout
    198f26c55779 pNFS: Handle RPC size limit for layoutcommits
    2c5b079bcb31 pNFS: Fix disk addr range check in block/scsi layout
    cf949a960653 pNFS: Fix stripe mapping in block/scsi layout
    3b9d69f0e68a block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
    1df5970cd93d ASoC: Intel: avs: Fix uninitialized pointer error in probe()
    f2e480950d1c net: phy: smsc: add proper reset flags for LAN8710A
    6b93ab1ad84a ipmi: Fix strcpy source and destination the same
    9da4d5c3ea6b kconfig: lxdialog: fix 'space' to (de)select options
    44337363300f kconfig: gconf: fix potential memory leak in renderer_edited()
    e55c6f052032 kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
    933992c60c07 ipmi: Use dev_warn_ratelimited() for incorrect message warnings
    2e07a9fe5117 vfio/mlx5: fix possible overflow in tracking max message size
    48d7bdd8759c scsi: aacraid: Stop using PCI_IRQ_AFFINITY
    0787a522cc9c scsi: target: core: Generate correct identifiers for PR OUT transport IDs
    a40c4af8083d scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
    28d64271510e kconfig: nconf: Ensure null termination where strncpy is used
    106ab3cd026f vfio/type1: conditional rescheduling while pinning
    98b7b47cebe3 kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
    b45134f72642 f2fs: check the generic conditions first
    868f23286c1a exfat: add cluster chain loop check for dir
    6af18148675f i2c: Force DLL0945 touchpad i2c freq to 100khz
    f8c001884bb4 apparmor: use the condition in AA_BUG_FMT even with debug disabled
    dd45d42ab290 dm-table: fix checking for rq stackable devices
    f4133dc2b93d dm-mpath: don't print the "loaded" message if registering fails
    cf4a40ad2116 i3c: master: Initialize ret in i3c_i2c_notifier_call()
    4e24a6a42d91 i3c: don't fail if GETHDRCAP is unsupported
    2e487c0fdeb9 apparmor: shift ouid when mediating hard links in userns
    ef8814a9d64a rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
    6e3733fe88a0 i3c: add missing include to internal header
    6dd90afb3945 module: Prevent silent truncation of module name in delete_module(2)
    d386c8e4e587 md: dm-zoned-target: Initialize return variable r to avoid uninitialized use
    b0cab3d9c70d soundwire: Move handle_nested_irq outside of sdw_dev_lock
    1e3697578567 soundwire: amd: serialize amd manager resume sequence during pm_prepare
    d2974cfd4fa6 crypto: octeontx2 - add timeout for load_fvc completion poll
    ae5a0993f1e4 media: uvcvideo: Fix bandwidth issue for Alcor camera
    6bbaec6a0369 media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
    09906650484a media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
    77ac2addb1dc media: usb: hdpvr: disable zero-length read messages
    1512ced62c87 media: tc358743: Increase FIFO trigger level to 374
    9b023149b97a media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
    5c809ef89e1b media: tc358743: Check I2C succeeded during probe
    815cb5818eef pinctrl: stm32: Manage irq affinity settings
    67bca5b04313 scsi: mpi3mr: Correctly handle ATA device errors
    80726da54c29 scsi: mpt3sas: Correctly handle ATA device errors
    924226822419 power: supply: qcom_battmgr: Add lithium-polymer entry
    7925dd68807c scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
    8c449e588d81 RDMA/core: reduce stack using in nldev_stat_get_doit()
    89fdac333a17 RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
    773612b1edf3 dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs
    01c412e31d98 leds: leds-lp50xx: Handle reg to get correct multi_index
    07cba8891f2c media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control
    f54eacb5b7f8 MIPS: lantiq: falcon: sysctrl: fix request memory check logic
    f22de2027b20 MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
    9021924d8893 crypto: jitter - fix intermediary handling
    173cfd741ad7 jfs: upper bound check of tree index in dbAllocAG
    78989af5bbf5 jfs: Regular file corruption check
    34d8e982bac4 jfs: truncate good inode pages when hard link is 0
    39cfe2c83146 scsi: bfa: Double-free fix
    2b98d2c23317 watchdog: iTCO_wdt: Report error if timeout configuration fails
    7fe9533fb069 MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
    6caa737a77a5 clk: qcom: ipq5018: keep XO clock always on
    16e245176777 hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state
    d202efb10a4b watchdog: dw_wdt: Fix default timeout
    478bd3bc4e7f fs/orangefs: use snprintf() instead of sprintf()
    66a373f50b42 scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
    4db46a83d817 phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
    41368857a354 mfd: axp20x: Set explicit ID for AXP313 regulator
    6c9e12fef997 clk: tegra: periph: Fix error handling and resolve unsigned compare warning
    d960f4b79391 ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
    de6af003239a crypto: hisilicon/hpre - fix dma unmap sequence
    cbe740de32bb fbdev: fix potential buffer overflow in do_register_framebuffer()
    6daa13c20190 cifs: Fix calling CIFSFindFirst() for root path without msearch
    74e7af8334c9 watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition
    3a5236c610e2 drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported
    8708914f05ec drm/amd/display: Only finalize atomic_obj if it was initialized
    110822d339a0 vhost: fail early when __vhost_add_used() fails
    c2bdb45f366a vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
    bc9ef9783c6b net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
    e7a375453cca rcu: Fix rcu_read_unlock() deadloop due to IRQ work
    58ed3ac8538c drm/ttm: Respect the shrinker core free target
    39de3ce65635 drm/amd/display: Avoid trying AUX transactions on disconnected ports
    d02ee5eebbcf selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size
    c03a532fe1d3 bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
    86f3cff54956 uapi: in6: restore visibility of most IPv6 socket options
    3c9ca275100e drm/ttm: Should to return the evict error
    e4b67ceb8634 drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range
    1df5e6eb71e4 net: ncsi: Fix buffer overflow in fetching version id
    859c54bb0120 ionic: clean dbpage in de-init
    ec33caca7662 wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
    c2e719bcaa26 ptp: Use ratelimite for freerun error message
    868b52651f69 bpftool: Fix JSON writer resource leak in version command
    d930e738c0a8 net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
    8609f3c44e27 net: dsa: b53: prevent DIS_LEARNING access on BCM5325
    bc0e01d663f4 net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
    668280aa65fc net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
    7f36d13d5243 gve: Return error for unknown admin queue command
    a1172cbfe51c net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
    8d1f4798c876 net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
    63acb8e26620 drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual
    50dbeff47178 dpaa_eth: don't use fixed_phy_change_carrier
    7c299d0bc983 neighbour: add support for NUD_PERMANENT proxy entries
    a70c31416ddd wifi: iwlegacy: Check rate_idx range after addition
    ad8742e2d1da netmem: fix skb_frag_address_safe with unreadable skbs
    88517afa7401 powerpc: floppy: Add missing checks after DMA map
    eb1e1526b82b wifi: ath12k: Decrement TID on RX peer frag setup error handling
    9874a00ba22b wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
    afb39537d894 wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
    c387d8fcd330 wifi: mac80211: update radar_required in channel context after channel switch
    cf48c230a17a drm/amd/display: Fix 'failed to blank crtc!'
    c43b6b0a8342 wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
    83aba958e33f wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
    5c942d80f3e8 wifi: ath12k: Add memset and update default rate value in wmi tx completion
    9febff30eb52 drm/amd/display: Separate set_gsl from set_gsl_source_select
    f2a4ca5397f5 net: fec: allow disable coalescing
    b3472b9d9d42 net: atlantic: add set_power to fw_ops for atl2 to fix wol
    3d8090bb5342 xfrm: Duplicate SPI Handling
    81667abecebc net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
    99f142ec75dd net: thunderbolt: Enable end-to-end flow control also in transmit
    bdd66b918215 kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace
    b6c39aaa85c4 wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
    51eb6a5f209b wifi: rtw89: Disable deep power saving for USB/SDIO
    ecf449ef73a5 wifi: rtw89: Fix rtw89_mac_power_switch() for USB
    f3d4fa12d6b0 drm/msm: use trylock for debugfs
    e457e0560b55 wifi: mac80211: fix rx link assignment for non-MLO stations
    f7bc50927b4e ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc().
    5a9b21808323 (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
    ffa3a8007d2f wifi: mac80211: don't complete management TX on SAE commit
    c73e54dba107 sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
    3f8bcc32050e s390/stp: Remove udelay from stp_sync_clock()
    11238e68cb68 wifi: iwlwifi: mvm: fix scan request validation
    6cd174be9239 um: Re-evaluate thread flags repeatedly
    dae6099edf91 wifi: iwlwifi: mvm: set gtk id also in older FWs
    8baba93e2e95 perf/cxlpmu: Remove unintended newline from IRQ name format string
    05ee035af6d8 net: phy: micrel: Add ksz9131_resume()
    fd6a21638a1e net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
    c133a9327d2d net: ipv4: fix incorrect MTU in broadcast routes
    606908835bc4 wifi: cfg80211: Fix interface type validation
    a4d2cdb31cf4 net: mctp: Prevent duplicate binds
    b55947b725f1 rcu: Protect ->defer_qs_iw_pending from data race
    e424653498e4 arm64: Mark kernel as tainted on SAE and SError panic
    ac361868f134 net/mlx5e: Properly access RCU protected qdisc_sleeping variable
    d1c8d2426a63 net: ag71xx: Add missing check after DMA map
    b0862e88b887 et131x: Add missing check after DMA map
    72cdcaeaa95b wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
    b16dfa7b4c94 be2net: Use correct byte order and format string for TCP seq and ack_seq
    d46484e9dbb2 s390/time: Use monotonic clock in get_cycles()
    65b7c838736d wifi: cfg80211: reject HTC bit for management frames
    7eb1e485bc84 ktest.pl: Prevent recursion of default variable options
    30cad8797805 wifi: ath12k: Correct tid cleanup when tid setup fails
    5d3559880e9c net: usb: cdc-ncm: check for filtering capability
    8f5015143227 xen/netfront: Fix TX response spurious interrupts
    5ac23fc080be Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
    b84f88749ecf powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
    245d23754f5b ASoC: qcom: use drvdata instead of component to keep id
    c3d3492b12dd ASoC: codecs: rt5640: Retry DEVICE_ID verification
    70b3c831cfea iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
    2925edfa98f7 ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
    2f81d6e98f32 ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
    0de69bc9b366 ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
    7731b7d596c5 platform/chrome: cros_ec_typec: Defer probe on missing EC parent
    8c046583a234 platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
    c2c252d2c180 soc: qcom: mdt_loader: Actually use the e_phoff
    7589729947aa imx8m-blk-ctrl: set ISI panic write hurry level
    ac62b8f82b24 pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
    454a27cbab9b usb: core: usb_submit_urb: downgrade type check
    0455858931ff usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
    41f53afe53a5 ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
    789aa0b98854 ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
    2828f2c4f2e9 ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
    b80d6972859b x86/bugs: Avoid warning when overriding return thunk
    16cdf4f5b959 ALSA: hda: Disable jack polling at shutdown
    240e611b784d ALSA: hda: Handle the jack polling always via a work
    d54d1405f2c6 mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
    24f4ceeaeee7 mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
    a29868db6dcf char: misc: Fix improper and inaccurate error code returned by misc_init()
    f8818e29d268 reset: brcmstb: Enable reset drivers for ARCH_BCM2835
    ff28f5dc3872 pps: clients: gpio: fix interrupt handling order in remove path
    d9d611639bea ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
    d3dd520206bd mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
    f95174d4d5c4 ACPI: processor: fix acpi_object initialization
    e656c2db4922 PM: sleep: console: Fix the black screen issue
    753cd9f3d396 thermal: sysfs: Return ENODATA instead of EAGAIN for reads
    64d78290599a PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
    5aa770f45da7 firmware: tegra: Fix IVC dependency problems
    ab3bf61d9351 ACPI: PRM: Reduce unnecessary printing to avoid user confusion
    783a726d509e selftests: tracing: Use mutex_unlock for testing glob filter
    6ec6282acd89 tools/build: Fix s390(x) cross-compilation with clang
    46b3a7a3a36d ARM: tegra: Use I/O memcpy to write to IRAM
    149b733d5f80 gpio: tps65912: check the return value of regmap_update_bits()
    3c3454b02c62 iio: adc: ad_sigma_delta: don't overallocate scan buffer
    0a4757bf988e tools/nolibc: define time_t in terms of __kernel_old_time_t
    58a39eda7f95 thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required
    cfa9b873a29c ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
    7423fc4da94d EDAC/synopsys: Clear the ECC counters on init
    f53e16dde8ad PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store()
    d7d6d076ee95 ARM: rockchip: fix kernel hang during smp initialization
    6a8b0c7e93df cpufreq: Exit governor when failed to start old governor
    20bbe54f454f gpio: wcd934x: check the return value of regmap_update_bits()
    6b8a8eac58a9 remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
    082735fbcdb6 ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered
    84518ec7f928 soc: qcom: rpmh-rsc: Add RSC version 4 support
    16a5088670e6 usb: xhci: Avoid showing errors during surprise removal
    dabf502ee893 usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
    4a62f49f3d04 usb: xhci: Avoid showing warnings for dying controller
    6cd81d4ffbaa usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
    b2ba2ad06d8a selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
    146262a48be2 cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
    f5611a58f7af platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
    2d32f522c33a usb: xhci: print xhci->xhc_state when queue_command failed
    839312bff2c9 tracefs: Add d_delete to remove negative dentries
    d7e28036b0e9 securityfs: don't pin dentries twice, once is enough...
    270ea0b61725 fix locking in efi_secret_unlink()
    327276cb8a7e ext2: Handle fiemap on empty files to prevent EINVAL
    6c7fadac6cbc fs/ntfs3: correctly create symlink for relative path
    3572737a768d fs/ntfs3: Add sanity check for file name
    934065fd3024 ata: libata-sata: Disallow changing LPM state if not supported
    847a204d3067 better lockdep annotations for simple_recursive_removal()
    cb7b59560400 hfs: fix not erasing deleted b-tree node issue
    9f53b2433ad2 drbd: add missing kref_get in handle_write_conflicts
    5a1e1ab83796 udf: Verify partition map count
    ce8da5d13d8c loop: Avoid updating block size under exclusive owner
    3d2c05cbc6a3 gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
    524ce0f943d7 nvme-pci: try function level reset on init failure
    1e858a7a51c7 smb/server: avoid deadlock when linking with ReplaceIfExists
    61ad294996c0 arm64: Handle KCOV __init vs inline mismatches
    b3359392b753 hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
    291bb5d931c6 hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
    8583d067ae22 hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
    384a66b89f95 hfs: fix slab-out-of-bounds in hfs_bnode_read()
    4f032979b63a hfs: fix general protection fault in hfs_find_init()
    f1fe99919f62 tls: handle data disappearing from under the TLS ULP
    acfb4da42fc4 ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
    7337a6356dff cpuidle: governors: menu: Avoid using invalid recent intervals data
    c11f3802d349 intel_idle: Allow loading ACPI tables for any family
    ea094f38d387 sctp: linearize cloned gso packets in sctp_rcv
    7f94af487c7f net: ti: icss-iep: Fix incorrect type for return value in extts_enable()
    30cf81105855 netfilter: ctnetlink: fix refcount leak on table dump
    19e01bc8c1ac udp: also consider secpath when evaluating ipsec use for checksumming
    e65ad9a14256 KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest
    91fa23d5b9e5 KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
    8867d91ef824 KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
    d1e28ef79b43 KVM: VMX: Extract checking of guest's DEBUGCTL into helper
    48ebed8bd66b KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
    ec70c3f25777 KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
    0d87da9d6065 KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap
    d5aa9bb5e348 KVM: x86: Fully defer to vendor code to decide how to force immediate exit
    62f586df29ca KVM: VMX: Handle KVM-induced preemption timer exits in fastpath for L2
    ca3cc405a3bc KVM: x86: Move handling of is_guest_mode() into fastpath exit handlers
    1c1158aceaf2 KVM: VMX: Handle forced exit due to preemption timer in fastpath
    1fc288e74cf3 KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits
    baf9c96e4e9d KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint
    a1d4091f94c6 KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs
    76025761e8f3 KVM: x86: Snapshot the host's DEBUGCTL in common x86
    cf04778ae1b5 KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
    ebc281bf14aa KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
    abe3d6a559f9 KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow
    d5784ea45663 KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
    edc450030b20 smb: client: don't wait for info->send_pending == 0 on error
    429112e9709b smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
    19849010c9e1 ACPI: processor: perflib: Move problematic pr->performance check
    cb2e6e275d19 ACPI: processor: perflib: Fix initial _PPC limit application
    8c09ad855fbf Documentation: ACPI: Fix parent device references
    2a0c0c974bea eventpoll: Fix semi-unbounded recursion
    237e416eb621 fs: Prevent file descriptor table allocations exceeding INT_MAX
    a5ff67c66208 sunvdc: Balance device refcount in vdc_port_mpgroup_check
    17c010fe45de LoongArch: BPF: Fix jump offset calculation in tailcall
    d89d47abbad2 PCI: Extend isolated function probing to LoongArch
    987c20428f06 NFS: Fix the setting of capabilities when automounting a new filesystem
    f0b89916d2fe NFSD: detect mismatch of file handle and delegation stateid in OPEN op
    d71abd1ae4e0 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
    3b53dc1c641f io_uring/net: commit partial buffers on retry
    ccef5ee4adf5 net: usb: asix_devices: add phy_mask for ax88772 mdio bus
    eb2d79333f79 net: dpaa: fix device leak when querying time stamp info
    fd5c51a187ba net: ti: icss-iep: fix device and OF node leaks at probe
    5daff127b292 net: mtk_eth_soc: fix device leak at probe
    9adaf9a04f9a net: enetc: fix device and OF node leak at probe
    dc395c838610 net: gianfar: fix device leak when querying time stamp info
    8dae82f81e34 net: phy: micrel: fix KSZ8081/KSZ8091 cable test
    346c820ef513 netlink: avoid infinite retry looping in netlink_unicast()
    c66caf21b1d0 Revert "leds: trigger: netdev: Configure LED blink interval for HW offload"
    16a46f2e84d7 gpio: mlxbf3: use platform_get_irq_optional()
    c1aa0743e54b Revert "gpio: mlxbf3: only get IRQ for device instance 0"
    a157478521b3 gpio: mlxbf2: use platform_get_irq_optional()
    50ae9f2d90b2 gpio: virtio: Fix config space reading.
    217e18011663 smb: client: remove redundant lstrp update in negotiate protocol
    a0620e152566 smb3: fix for slab out of bounds on mount to ksmbd
    d63e929bac53 ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
    fb5000cfd7bc ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
    1034719fdefd ALSA: usb-audio: Validate UAC3 cluster segment descriptors
    07c8d78dbb5e ALSA: usb-audio: Validate UAC3 power domain descriptors, too
    17a66aef7ddc io_uring: don't use int for ABI

(From OE-Core rev: f9c140c4856790ae7b752849f4df6533ca5d0027)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Bruce Ashfield
a9224824c3 linux-yocto/6.6: update to v6.6.102
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

no ids found, dumping:
    bb9c90ab9c5a Linux 6.6.102
    aada327a9f80 usb: gadget : fix use-after-free in composite_dev_cleanup()
    e1ee74b9eeb2 mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
    d98b34c40dc7 MIPS: mm: tlb-r4k: Uniquify TLB entries on init
    ab85071a0354 x86/fpu: Delay instruction pointer fixup until after warning
    575b71627529 ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
    48a8a2dfc3f5 ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
    1fb873971e23 x86/sev: Evict cache lines during SNP memory validation
    fdf6959b700b net: usbnet: Fix the wrong netif_carrier_on() call
    3c6236588dc8 net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
    2b98a1539736 Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
    ae591cf2348a sched,freezer: Remove unnecessary warning in __thaw_task
    036bdae8c985 freezer,sched: Clean saved_state when restoring it during thaw
    2e62985121b7 freezer,sched: Do not restore saved_state of a thawed task
    e241ca2f0ec3 freezer,sched: Use saved_state to reduce some spurious wakeups
    8afa818c7733 sched/core: Remove ifdeffery for saved_state
    2c9a096e202c i2c: stm32f7: unmap DMA mapped buffer
    bab0986dc045 i2c: stm32f7: simplify status messages in case of errors
    d786b6592030 i2c: stm32f7: perform most of irq job in threaded handler
    9bfaaa964014 i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq
    de7c7caea59b i2c: stm32f7: Use devm_clk_get_enabled()
    66bf243531ee USB: serial: option: add Foxconn T99W709
    2f4d88f5e5ee smb: server: Fix extension string in ksmbd_extract_shortname()
    fa1c47af4ff6 ksmbd: limit repeated connections from clients with the same IP
    62d136d30621 ksmbd: fix corrupted mtime and ctime in smb2_open
    b69fd87076da ksmbd: fix Preauh_HashValue race condition
    d79c8bebaa62 ksmbd: fix null pointer dereference error in generate_encryptionkey
    44bd006d5c93 vsock: Do not allow binding to VMADDR_PORT_ANY
    88caf46db823 net/packet: fix a race in packet_set_ring() and packet_notifier()
    29d417b1a0d5 selftests/perf_events: Add a mmap() correctness test
    6757a31a8e29 perf/core: Prevent VMA split of buffer mappings
    f41e9eba77bf perf/core: Exit early on perf_mmap() fail
    f07ab7a4b572 perf/core: Don't leak AUX buffer refcount on allocation failure
    b1df39462171 sunrpc: fix handling of server side tls alerts
    d2622f38652c smb: client: return an error if rdma_connect does not return within 5 seconds
    bd7f84df5436 pptp: fix pptp_xmit() error path
    4e5cf39e4064 smb: client: let recv_done() cleanup before notifying the callers.
    83d2a4185f5a smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
    f069f7c14204 smb: client: make use of common smbdirect_socket
    947569b95987 smb: smbdirect: add smbdirect_socket.h
    61f0a6849005 smb: client: Correct typos in multiple comments across various files
    91d7e6cbb3f8 smb: client: Use min() macro
    c29dbc44fbf7 smb: server: let recv_done() avoid touching data_transfer after cleanup/move
    66110b35bebc smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection
    e67aff50476f smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
    28db0cb8a0da smb: server: remove separate empty_recvmsg_queue
    2e4463f44e9b ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
    cd2a7f950038 irqchip: Build IMX_MU_MSI only on ARM
    39491e859fd4 net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
    c377ba2be943 benet: fix BUG when creating VFs
    a55b3d153318 sunrpc: fix client side handling of tls alerts
    a7176675c39a net/sched: taprio: enforce minimum value for picos_per_byte
    0d45954034f8 net: drop UFO packets in udp_rcv_segment()
    ef05007b403d ipv6: reject malicious packets in ipv6_gso_segment()
    194cd28c889a net/mlx5: Correctly set gso_segs when LRO is used
    97ed92a23f0b netlink: specs: ethtool: fix module EEPROM input/output arguments
    5005d2437737 pptp: ensure minimal skb length in pptp_xmit()
    5fde6e016004 net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
    b80353a72958 phy: mscc: Fix parsing of unicast frames
    b0cf318f5cc6 netpoll: prevent hanging NAPI when netcons gets enabled
    227154eb7567 md/md-cluster: handle REMOVE message earlier
    75ed1f6ed8ee NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
    1116e66111f8 NFSv4.2: another fix for listxattr
    12ad3def2e5e NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
    30a739931ed8 NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
    147216030e46 sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
    3bdb29df2f0d pNFS/flexfiles: don't attempt pnfs on fatal DS errors
    6e7b24c71e53 PCI: pnv_php: Fix surprise plug detection and recovery
    a426e8a6ae16 powerpc/eeh: Make EEH driver device hotplug safe
    3f49abdf88b6 powerpc/eeh: Export eeh_unfreeze_pe()
    17dabd7efb28 PCI: pnv_php: Work around switches with broken presence detection
    32173edf3fe2 PCI: pnv_php: Clean up allocated IRQs on unplug
    9184a2bb522c sched/psi: Fix psi_seq initialization
    9ea1cc8b0e95 kconfig: qconf: fix ConfigList::updateListAllforAll()
    05b450da93c6 scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
    450b2a5cf6e4 scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume
    4933567ef9e6 scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
    087a8a7ca354 scsi: mpt3sas: Fix a fw_event memory leak
    349436bf11b8 vfio/pci: Separate SR-IOV VF dev_set
    7dbfae90c5a3 vfio/pds: Fix missing detach_ioas op
    9546b26d391f vfio: Prevent open_count decrement to negative
    a6c5e25861e3 vfio: Fix unbalanced vfio_df_close call in no-iommu mode
    f289690f50a0 f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
    704613681c1c f2fs: fix to calculate dirty data during has_not_enough_free_secs()
    e33c22f2eeba f2fs: fix to update upper_p in __get_secs_required() correctly
    1023836d1b94 f2fs: vm_unmap_ram() may be called from an invalid context
    345fc8d1838f f2fs: fix to avoid out-of-boundary access in devs.path
    880ef748e78a f2fs: fix to avoid panic in f2fs_evict_inode
    3d37cadaac1a f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
    a96f2bf49fbd f2fs: doc: fix wrong quota mount option description
    dabfa3952c8e f2fs: fix KMSAN uninit-value in extent_info usage
    c1c818b636d4 rtc: rv3028: fix incorrect maximum clock rate handling
    f5790cc2ee6f rtc: pcf8563: fix incorrect maximum clock rate handling
    e337c72b17c6 rtc: pcf85063: fix incorrect maximum clock rate handling
    8456b3e28acf rtc: nct3018y: fix incorrect maximum clock rate handling
    17827903802b rtc: hym8563: fix incorrect maximum clock rate handling
    bb94a96374db rtc: ds1307: fix incorrect maximum clock rate handling
    15da236904ec ucount: fix atomic_long_inc_below() argument type
    f9bd692540d8 module: Restore the moduleparam prefix length check
    7500ba6533ab apparmor: fix loop detection used in conflicting attachment resolution
    fad01f7e0d3e apparmor: ensure WB_HISTORY_SIZE value is a power of 2
    4795bcafe9a8 bpf: Check netfilter ctx accesses are aligned
    f56f6054791e bpf: Check flow_dissector ctx accesses are aligned
    d3bf3088f7e9 vhost-scsi: Fix log flooding with target does not exist errors
    ebc6e1d0e97a mtd: rawnand: atmel: set pmecc data setup time
    a01bc4245e43 mtd: rawnand: rockchip: Add missing check after DMA map
    7d0b53a6d199 mtd: rawnand: atmel: Fix dma_mapping_error() address
    505f4111dd98 jfs: fix metapage reference count leak in dbAllocCtl
    4b5d36cc3014 fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
    0aa273dbcf53 crypto: qat - fix seq_file position update in adf_ring_next()
    1c178ccb6caf crypto: qat - fix DMA direction for compression on GEN2 devices
    9ff4de5bd11a perf tools: Remove libtraceevent in .gitignore
    106891c7bdbc sh: Do not use hyphen in exported variable name
    f658f3676538 ASoC: fsl_xcvr: get channel status data when PHY is not exists
    3187ffe08ff0 dmaengine: nbpfaxi: Add missing check after DMA map
    06ddbb28b72b dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
    25d15b0d2b42 fs/orangefs: Allow 2 more characters in do_c_string()
    b93d06499b6f PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
    bdbaa1041816 soundwire: stream: restore params when prepare ports fail
    ac961f6c6dc5 crypto: img-hash - Fix dma_unmap_sg() nents value
    06bc14f9d047 crypto: keembay - Fix dma_unmap_sg() nents value
    5d481d4bea06 hwrng: mtk - handle devm_pm_runtime_enable errors
    9c590ae73c3e watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
    a23fa17e6bec scsi: isci: Fix dma_unmap_sg() nents value
    401fcb7e557d scsi: mvsas: Fix dma_unmap_sg() nents value
    cf9c5b15c4ab scsi: elx: efct: Fix dma_unmap_sg() nents value
    214f94ee5d77 scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
    5b63d6dec556 clk: sunxi-ng: v3s: Fix de clock definition
    c07e017a56d6 perf tests bp_account: Fix leaked file descriptor
    9b2a3e718902 pinmux: fix race causing mux_owner NULL with active mux_usecount
    33c778ea0bd0 proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
    adf2da0bf119 kernel: trace: preemptirq_delay_test: use offstack cpu mask
    5449e60e1cbb RDMA/hns: Fix -Wframe-larger-than issue
    db1114685317 crypto: ccp - Fix crash when rebind ccp device for ccp.ko
    a762bbe11269 crypto: inside-secure - Fix `dma_unmap_sg()` nents value
    b86fd2e61a2c perf sched: Fix memory leaks in 'perf sched latency'
    282d4b34694f perf sched: Fix memory leaks for evsel->priv in timehist
    16ce5ce11145 perf sched: Free thread->priv using priv_destructor
    e5de9ea7796e perf dso: Add missed dso__put to dso__load_kcore
    9fe9f9459951 perf tools: Fix use-after-free in help_unknown_cmd()
    a99cae46ab16 Fix dma_unmap_sg() nents value
    8724a228be43 clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
    45338af03ff3 fanotify: sanitize handle_type values when reporting fid
    e8b4c9e60a7a pinctrl: sunxi: Fix memory leak on krealloc failure
    85a7746a05ea PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails
    3f5186fd43be crypto: arm/aes-neonbs - work around gcc-15 warning
    f693be157c59 power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
    8e9bdb563916 power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
    51990eecf22f clk: xilinx: vcu: unregister pll_post only if registered correctly
    a2b437a88370 media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
    1d92608a2925 clk: davinci: Add NULL check in davinci_lpsc_clk_register()
    530d4db6fb89 mtd: fix possible integer overflow in erase_xfer()
    aff3e6eacef2 crypto: marvell/cesa - Fix engine load inaccuracy
    be1e15938a16 crypto: qat - use unmanaged allocation for dc_data
    25c161a8bed1 crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
    0c93cd98d0c8 PCI: rockchip-host: Fix "Unexpected Completion" log message
    e1c3d14c8252 bpf/preload: Don't select USERMODE_DRIVER
    3bb72c2e9622 ipv6: annotate data-races around rt->fib6_nsiblings
    9cb6de8ee144 ipv6: fix possible infinite loop in fib6_info_uses_dev()
    e1b7932af47f ipv6: prevent infinite loop in rt6_nlmsg_size()
    f237664113fe vrf: Drop existing dst reference in vrf_ip6_input_dst
    dddfc5a996af selftests: rtnetlink.sh: remove esp4_offload after test
    314f568b84b0 net/mlx5e: Remove skb secpath if xfrm state is not found
    4d81205d27c3 net/mlx5e: Clear Read-Only port buffer size in PBMC before update
    58004aa21e79 netfilter: xt_nfacct: don't assume acct name is null-terminated
    9705b8b92d6a can: kvaser_usb: Assign netdev.dev_port based on device channel index
    56a17d28c3dd can: kvaser_pciefd: Store device channel index
    2ac7efc5deef can: peak_usb: fix USB FD devices potential malfunction
    c9be5abdaf2e tools/rv: Do not skip idle in trace
    ee2502485702 bpf: Disable migration in nf_hook_run_bpf().
    9d5aecb57e93 Bluetooth: hci_event: Mask data status from LE ext adv reports
    cdb509f59aaf kcsan: test: Initialize dummy variable
    bf88b7c114d4 wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
    50e98be435df wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
    21e317484d3b wifi: ath12k: fix endianness handling while accessing wmi service bit
    dde152043f6d Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
    9c8e9da118a8 wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
    f74d4525ebad wifi: mac80211: Don't call fq_flow_idx() for management frames
    bc6f35967d9a wifi: mac80211: Do not schedule stopped TXQs
    2874717012d1 wifi: plfxlc: Fix error handling in usb driver probe
    378ae9ccaea3 wifi: mac80211: reject TDLS operations when station is not associated
    df51cc1e965a iommu/amd: Fix geometry.aperture_end for V2 tables
    03df73480547 mwl8k: Add missing check after DMA map
    5cb4349d0c35 wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
    20a1e6536424 tcp: call tcp_measure_rcv_mss() for ooo packets
    9a20c9da5ff1 xen/gntdev: remove struct gntdev_copy_batch from stack
    c9eeae9639ea net_sched: act_ctinfo: use atomic64_t for three counters
    103c4e27ec9f net/sched: Restrict conditions for adding duplicating netems to qdisc tree
    0967ee88ec1e um: rtc: Avoid shadowing err in uml_rtc_start()
    98f1a97d8627 arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
    9ac58afb0cca netfilter: nf_tables: adjust lockdep assertions handling
    b488bee5e92f netfilter: nf_tables: Drop dead code from fill_*_info routines
    f56a863397f5 fbcon: Fix outdated registered_fb reference in comment
    b1c6b13f48a8 sched/psi: Optimize psi_group_change() cpu_clock() usage
    dabe5fc2ee7a drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
    6e2f7903241c m68k: Don't unregister boot console needlessly
    7f0377ca6993 drm/msm/dpu: Fill in min_prefill_lines for SC8180X
    6d029d85aa2b kselftest/arm64: Fix check for setting new VLs in sve-ptrace
    f73c0bc2d1d3 net: dst: annotate data-races around dst->output
    e0b8b6687b7d net: dst: annotate data-races around dst->input
    62d7cf455c88 net/mlx5: Check device memory pointer before usage
    c45a33903e24 tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
    5bf201c55fdf wifi: ath11k: clear initialized flag for deinit-ed srng lists
    ca980f1911a7 iwlwifi: Add missing check for alloc_ordered_workqueue
    d5491ff785f4 wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
    14ca6952691f wifi: rtl818x: Kill URBs before clearing tx status queue
    892b29eab44b wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
    655e3f51de5a caif: reduce stack size, again
    0abd1f48cd25 bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
    0f18414f1d6b drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
    cc7af1b89c55 net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
    3ca8e73c58bb selftests/bpf: fix signedness bug in redir_partial()
    0e853c1464bc bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
    c69d06498ea2 bpf, sockmap: Fix psock incorrectly pointing to sk
    c4a298ae0d36 drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
    8b0285fbbd81 selftests/tracing: Fix false failure of subsystem event test
    faa45887a63c staging: nvec: Fix incorrect null termination of battery manufacturer
    cc03984d7035 interconnect: qcom: sc8180x: specify num_nodes
    37dfd6d6c9e4 interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
    2fffa72282ed soc: qcom: pmic_glink: fix OF node leak
    272cd1f24741 samples: mei: Fix building on musl libc
    f7e5ae0ddd12 cpufreq: Init policy->rwsem before it may be possibly used
    39a0d418b321 cpufreq: Initialize cpufreq-based frequency-invariance later
    1bc35f9a50e1 cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
    81f506193700 PM / devfreq: Check governor before using governor->name
    759b918c8f2e arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
    1661ee5c2a41 arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
    d7b49f4f0da7 ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
    4f886798e1a4 soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
    632c151355ba arm: dts: ti: omap: Fixup pinheader typo
    40ff7460a9a6 usb: early: xhci-dbc: Fix early_ioremap leak
    c6ec27091cf5 powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
    91a177aafc53 Revert "vmci: Prevent the dispatching of uninitialized payloads"
    7ed42b79118d pps: fix poll support
    6696a46f4ebd vmci: Prevent the dispatching of uninitialized payloads
    b31cf6f7716a staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
    6031a54f4eac spi: stm32: Check for cfg availability in stm32_spi_probe
    490877203b40 usb: misc: apple-mfi-fastcharge: Make power supply names unique
    f24e5b445ab9 usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
    448800900925 ARM: dts: vfxxx: Correctly use two tuples for timer address
    964db8725937 arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
    e1b4ca59f633 arm64: dts: qcom: sc7180: Expand IMEM region
    2f4bad6b27c3 arm64: dts: qcom: sdm845: Expand IMEM region
    603df70062fb soc: qcom: QMI encoding/decoding for big endian
    41917d9ce43a selftests: Fix errno checking in syscall_user_dispatch test
    aa771d2928fe ASoC: mediatek: use reserved memory or enable buffer pre-allocation
    4c39fc79ae25 ASoC: ops: dynamically allocate struct snd_ctl_elem_value
    ee1c30d7c6fc ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
    1a91ba12abef gfs2: No more self recovery
    a936be9b5f51 Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
    084933961ecd hfsplus: remove mutex_lock check in hfsplus_free_extents
    0926e13a47fc hfs: make splice write available again
    1de5895fe68d hfsplus: make splice write available again
    d89f71aece34 ublk: use vmalloc for ublk_device's __queues
    b35a50d639ca fs/ntfs3: cancle set bad inode after removing name fails
    8d1bfdd30d17 fs_context: fix parameter name in infofc() macro
    15da73210929 audit,module: restore audit logging in load failure case
    5974c913d6d9 ASoC: amd: yc: add DMI quirk for ASUS M6501RM
    61e5aeff2424 ASoC: Intel: fix SND_SOC_SOF dependencies
    7e98b00615c6 ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
    18196a40af52 ethernet: intel: fix building with large NR_CPUS
    5f577d47bba6 ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx

(From OE-Core rev: 9c0af64f5b688d89349a80cb27bbbc451abfab38)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Bruce Ashfield
d0302e3d94 linux-yocto/6.6: update to v6.6.101
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

no ids found, dumping:
    3a8ababb8b6a Linux 6.6.101
    41d3c751fcb4 Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test"
    1af6d1696ca4 spi: cadence-quadspi: fix cleanup of rx_chan on failure paths
    aed4053c506b drm/sched: Remove optimization that causes hang when killing dependent jobs
    79c8d935147c ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
    3277cf433815 mptcp: reset fallback status gracefully at disconnect() time
    7c96d519ee15 mptcp: plug races between subflow fail and subflow creation
    75a4c9ab8a7a mptcp: make fallback action and fallback decision atomic
    23a5773a5da5 arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1 register
    52f5a52dc17a ksmbd: add free_transport ops in ksmbd connection
    034adb78fc43 wifi: mt76: mt7921: prevent decap offload config before STA initialization
    79e2dd573116 perf/x86/intel: Fix crash in icl_update_topdown_event()
    9ef6abbb2868 mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
    1da8bd9a10ec ksmbd: fix use-after-free in __smb2_lease_break_noti()
    5ea224eaf636 iio: hid-sensor-prox: Restore lost scale assignments
    a56b79a43f83 iio: hid-sensor-prox: Fix incorrect OFFSET calculation
    796c96cf6685 crypto: qat - add shutdown handler to qat_dh895xcc
    4b5e07702b67 crypto: powerpc/poly1305 - add depends on BROKEN for now
    da3e9f0fac60 erofs: address D-cache aliasing
    1d117f79b5c6 mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma
    37c7f0f24b8e drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
    c383033b0ac8 ALSA: hda: Add missing NVIDIA HDA codec IDs
    0a776c273e71 ALSA: hda/tegra: Add Tegra264 support
    4e954080d218 comedi: comedi_test: Fix possible deletion of uninitialized timers
    45fd8421081e jfs: reject on-disk inodes of an unsupported type
    98be604d96a6 x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode()
    f9377bdf86ea usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach
    457d02e71ae9 usb: typec: tcpm: allow switching to mode accessory to mux properly
    8f65f4565cab usb: typec: tcpm: allow to use sink in accessory mode
    145a56bd68f4 drm/amdkfd: Don't call mmput from MMU notifier callback
    cc690930cb24 mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
    325325923a1d selftests: mptcp: connect: also cover checksum
    5cdfb402bae9 selftests: mptcp: connect: also cover alt modes
    a2cd4dcbb725 resource: fix false warning in __request_region()
    bf585ee198bb nilfs2: reject invalid file types when reading inodes
    57104237cd6c kasan: use vmalloc_dump_obj() for vmalloc error reports
    3028f2a4e746 ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
    eaf242ea6fca gve: Fix stuck TX queue for DQ queue format
    c229192417d4 e1000e: ignore uninitialized checksum word on tgp
    1624f9de4432 e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
    04d098fbca47 dpaa2-switch: Fix device reference count leak in MAC endpoint handling
    1c135ff95167 dpaa2-eth: Fix device reference count leak in MAC endpoint handling
    9433a5f437b0 arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
    140ca2cac147 ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
    e5354899f625 sprintf.h requires stdarg.h
    72584a9178af bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint()
    6e7836c83635 i2c: virtio: Avoid hang by using interruptible completion wait
    68ceeb06316e i2c: tegra: Fix reset error handling with ACPI
    0d33913fce67 i2c: qup: jump out of the loop in case of timeout
    60962eed62b9 platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots
    989b2c5322dc net: hns3: default enable tx bounce buffer when smmu enabled
    adbf6f476cd1 net: hns3: fixed vf get max channels bug
    f377792c4186 net: hns3: disable interrupt when ptp init failed
    3cc42004f65b net: hns3: fix concurrent setting vlan filter issue
    faf44487dfc8 s390/ism: fix concurrency management in ism_cmd()
    42e42d64d851 drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe()
    cf81a60a9733 can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
    359492c2024a can: dev: can_restart(): move debug message and stats after successful restart
    71a2dc442e12 can: dev: can_restart(): reverse logic to remove need for goto
    0ede6ce4fcf2 net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
    e4f1564c5b69 net: appletalk: Fix use-after-free in AARP proxy probe
    d989748e9dbb i40e: When removing VF MAC filters, only check PF-set MAC
    0c399fd6ac5a i40e: report VF tx_dropped with tx_errors instead of tx_discards
    a05b3883083b i40e: Add rx_missed_errors for buffer exhaustion
    e4ca597d3116 net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
    c3d8a80d9557 net/mlx5: Fix memory leak in cmd_exec()
    bfebdb85496e xfrm: interface: fix use-after-free after changing collect_md xfrm interface
    2e18442d22c6 staging: vchiq_arm: Make vchiq_shutdown never fail
    6758f73f172d platform/x86: Fix initialization order for firmware_attributes_class
    d72c97b6160d x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
    0915f1856c48 regmap: fix potential memory leak of regmap_bus
    881f3066fd8d iio: adc: ad7949: use spi_is_bpw_supported()
    6a85c96e61c1 interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
    fb93e41ecc75 RDMA/core: Rate limit GID cache warning messages
    233d3c54c962 regulator: core: fix NULL dereference on unbind due to stale coupling data
    0e8c65939ba2 virtio_ring: Fix error reporting in virtqueue_resize
    fa53beab4740 Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT

(From OE-Core rev: 40092b395a04921dd8f0f54f352d958084167227)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Bruce Ashfield
6d4a516d71 linux-yocto/6.6: update to v6.6.100
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

    dbcb8d8e4163 Linux 6.6.100
    3ee59c38ae73 KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls
    48e879184320 nvmem: layouts: u-boot-env: remove crc32 endianness conversion
    35542cbe66c6 i2c: omap: fix deprecated of_property_read_bool() use
    056b65a02edc Revert "selftests/bpf: dummy_st_ops should reject 0 for non-nullable params"
    c148b7282808 Revert "selftests/bpf: adjust dummy_st_ops_success to detect additional error"
    b9e50a5169b0 ASoC: fsl_sai: Force a software reset when starting in consumer mode
    8f2852c1d7aa regulator: pwm-regulator: Manage boot-on with disabled PWM channels
    cad3ec23e398 regulator: pwm-regulator: Calculate the output voltage for disabled PWMs
    7e5ec0059e4d i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
    a7b84035baa8 i2c: omap: Fix an error handling path in omap_i2c_probe()
    caa86f8b6c30 i2c: omap: Add support for setting mux
    6cfbff5f8dc9 usb: dwc3: qcom: Don't leave BCR asserted
    824fa25c85e8 usb: hub: Don't try to recover devices lost during warm reset.
    668c7b47a5ee usb: hub: Fix flushing of delayed work used for post resume purposes
    71f5c98d2931 usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
    15fea75a7886 usb: hub: fix detection of high tier USB3 devices behind suspended hubs
    d5024dc5e644 arm64: Filter out SME hwcaps when FEAT_SME isn't implemented
    dc6a664089f1 clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
    4cb17b11c8af ipv6: make addrconf_wq single threaded
    496efa228f0d sched: Change nr_uninterruptible type to unsigned long
    f371ad6471ee Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
    74bb4de32d92 rxrpc: Fix transmission of an abort in response to an abort
    7692bde89006 rxrpc: Fix recv-recv race of completed call
    7ff2d83ecf26 net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
    7b0d42318393 net: bridge: Do not offload IGMP/MLD messages
    bb515c413064 net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
    1f3a429c21e0 tls: always refresh the queue when reading sock
    007142a263db hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf
    bd3051a81621 Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
    76179961c423 netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
    dcbc346f50a0 ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
    6a213143e0ea net/mlx5: Correctly set gso_size when LRO is used
    ab94e7af363a Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID
    4ceefc9c31e7 Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
    f3323b18e3cc Bluetooth: SMP: If an unallowed command is received consider it a failure
    32e624912eed Bluetooth: hci_sync: fix connectable extended advertising when using static random address
    c4f16f6b071a Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
    5dd6a441748d usb: net: sierra: check for no status endpoint
    27591d926191 ice: add NULL check in eswitch lag check
    eda5e38cc4dd hwmon: (corsair-cpro) Validate the size of the received input buffer
    c18726607c8a selftests: net: increase inter-packet timeout in udpgro.sh
    167006f73005 wifi: cfg80211: remove scan request n_channels counted_by
    a2f02a87fe21 nvme: fix misaccounting of nvme-mpath inflight I/O
    ec158d05eaa9 net: phy: Don't register LEDs for genphy
    5d95fbbfaa8f nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
    2baaf5bbab2a smb: client: fix use-after-free in cifs_oplock_break
    62dcd9d6e61c rpl: Fix use-after-free in rpl_do_srh_inline().
    fbe48f06e641 net/sched: sch_qfq: Fix race condition on qfq_aggregate
    21033b49cf09 block: fix kobject leak in blk_unregister_queue
    c20dd7e8f359 net: emaclite: Fix missing pointer increment in aligned_read()
    bc016b7842f6 cachefiles: Fix the incorrect return value in __cachefiles_write()
    e7be679124ba bpf: Reject %p% format string in bprintf-like helpers
    12e023df10b6 soundwire: amd: fix for clearing command status register
    84830e033bd2 soundwire: amd: fix for handling slave alerts after link is down
    673ee92bd2d3 comedi: Fix initialization of data for instructions that write to subdevice
    10f9024a8c82 comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
    63390b856178 comedi: Fix some signed shift left operations
    c9d3d9667443 comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
    8a3637027cee comedi: das6402: Fix bit shift out of bounds
    adb7df8a8f9d comedi: das16m1: Fix bit shift out of bounds
    955e8835855f comedi: aio_iiro_16: Fix bit shift out of bounds
    7e470d8efd10 comedi: pcl812: Fix bit shift out of bounds
    8d8519aedbf1 iio: adc: stm32-adc: Fix race in installing chained IRQ handler
    6471d4b4ac61 iio: adc: max1363: Reorder mode_list[] entries
    edff26d038d2 iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
    dda42f23a8f5 iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
    329a80adc0e5 soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
    d93b20c88e5e soc: aspeed: lpc-snoop: Cleanup resources in stack-order
    15a0a5de4950 smb: client: fix use-after-free in crypt_message when using async crypto
    0c7b20f7785c s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
    600f55da8d90 pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
    d510116c80b3 net: libwx: properly reset Rx ring descriptor
    027701180a7b net: libwx: fix the using of Rx buffer DMA
    3c91a56762b1 net: libwx: remove duplicate page_pool_put_full_page()
    e30c5fa723dc mmc: sdhci_am654: Workaround for Errata i2312
    7ac120c00c5a mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
    5bfd0078f738 mmc: bcm2835: Fix dma_unmap_sg() nents value
    4206824af6dd memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
    928f3a277f2c isofs: Verify inode mode when loading from disk
    4bb016438335 dmaengine: nbpfaxi: Fix memory corruption in probe()
    2bae35acbb6e af_packet: fix soft lockup issue caused by tpacket_snd()
    67ea5f37b203 af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
    e51cf5d4aa98 arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
    645af2f069d6 arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
    bec18ebcf05c arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
    33eba752d9de net/mlx5: Update the list of the PCI supported devices
    29db3339db0e phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
    d48845afa083 io_uring/poll: fix POLLERR handling
    c855b9aa093a ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
    56f99fdb0b8d drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
    823d79890048 tracing/osnoise: Fix crash in timerlat_dump_stack()
    6bc94f20a4c3 tracing: Add down_write(trace_event_sem) when adding trace event
    6ba89b382be4 tracing/probes: Avoid using params uninitialized in parse_btf_arg()
    0e5017d84d65 HID: core: do not bypass hid_hw_raw_request
    a1c0b87b7682 HID: core: ensure __hid_request reserves the report ID as the first byte
    fcda39a9c5b8 HID: core: ensure the allocated report buffer can contain the reserved report ID
    469a39a33a99 dm-bufio: fix sched in atomic context
    82b29ee8ba90 spi: Add check for 8-bit transfer with 8 IO mode support
    415d4966cb54 pch_uart: Fix dma_sync_sg_for_device() nents value
    db44a558b3af Input: xpad - set correct controller type for Acer NGR200
    0f6f30f5b01a nvmem: imx-ocotp: fix MAC address byte length
    0cd051cb5852 thunderbolt: Fix bit masking in tb_dp_port_set_hops()
    dc52aff53465 thunderbolt: Fix wake on connect at runtime
    e6a2ff56b06e i2c: stm32: fix the device used for the DMA map
    58bdd5160184 usb: gadget: configfs: Fix OOB read on empty string write
    ec35a7125d94 usb: musb: fix gadget state on disconnect
    311c434f5d76 USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
    909d80414869 USB: serial: option: add Foxconn T99W640
    84c320060d53 USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
    ad2437f4abca phy: tegra: xusb: Disable periodic tracking on Tegra234
    491175c139e5 phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
    5367cdeb75cb phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode

(From OE-Core rev: cf70911ca46d3f9980d475369d9f15343b6e52e2)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Bruce Ashfield
a65c2420fd linux-yocto/6.6: update to v6.6.99
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

    d96eb99e2f0e Linux 6.6.99
    eaf112069a90 rseq: Fix segfault on registration when rseq_cs is non-zero
    f02f0218be41 crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
    97c355989928 ksmbd: fix potential use-after-free in oplock/lease break ack
    8377d7744bdc kasan: remove kasan_find_vm_area() to prevent possible deadlock
    d3927e55c959 smb: client: fix potential race in cifs_put_tcon()
    a4bb7ced4e8f selftests/bpf: adapt one more case in test_lru_map to the new target_free
    f35c825a012d Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
    3ce1d87d1f5d HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
    ae915b38e262 HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
    b71a75739af9 bpf: Adjust free target to avoid global starvation of LRU map
    cd5b424d8322 vt: add missing notification when switching back to text mode
    f4428b2d4c68 btrfs: fix assertion when building free space tree
    2cc5ef01ea03 net: mana: Record doorbell physical address in PF mode
    9f460b235ef3 HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
    cd4df14f6180 net: usb: qmi_wwan: add SIMCom 8230C composition
    e07c2feb4916 ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
    ee287cf30ffb ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
    50b1e01aa123 io_uring: make fallocate be hashed work
    825088c90357 um: vector: Reduce stack usage in vector_eth_configure()
    8cafaba2f275 atm: idt77252: Add missing `dma_map_error()`
    0d8a9b6dd321 ublk: sanity check add_dev input for underflow
    5909679a82cd bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
    e644935d40cb bnxt_en: Fix DCB ETS validation
    7d4d1993517b net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
    5aa8b3a1d8ab can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
    10946f834638 net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
    9fa29314eba1 ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
    4a17370da6e4 net: appletalk: Fix device refcount leak in atrtr_create()
    9fbc49429a23 netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
    d46186eb7bbd nbd: fix uaf in nbd_genl_connect() error path
    8fc3d7b23d13 raid10: cleanup memleak at raid10_make_request
    df5894014a92 md/raid1: Fix stack memory use after return in raid1_reshape
    d1240029f97a drm/tegra: nvdec: Fix dma_alloc_coherent error check
    5420de65efbe wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
    739296467a59 cifs: all initializations for tcon should happen in tcon_info_alloc
    03c3cd0c3b67 smb: client: fix DFS interlink failover
    d043b5da37fc smb: client: avoid unnecessary reconnects when refreshing referrals
    609a617a97c0 usb: dwc3: Abort suspend on soft disconnect failure
    e3f79e2c9ad1 usb: cdnsp: Fix issue with CV Bad Descriptor test
    ae5b191184ce usb: cdnsp: Replace snprintf() with the safer scnprintf() variant
    7227a8229f43 usb:cdnsp: remove TRB_FLUSH_ENDPOINT command
    fd79927c8191 btrfs: fix inode lookup error handling during log replay
    6aea26dc23d5 btrfs: return a btrfs_inode from btrfs_iget_logging()
    e6031107f397 btrfs: remove redundant root argument from fixup_inode_link_count()
    28a36e75d196 btrfs: remove redundant root argument from btrfs_update_inode_fallback()
    ddead3c5ca18 btrfs: remove noinline from btrfs_update_inode()
    c31ee1695b6d netlink: make sure we allow at least one dump skb
    ce2ac2e46719 netlink: Fix rmem check in netlink_broadcast_deliver().
    5b1b8f06b179 erofs: fix to add missing tracepoint in erofs_read_folio()
    4c4f931676b6 ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
    d903a0fe324e smb: server: make use of rdma_destroy_qp()
    3c0994a3fd93 x86/mm: Disable hugetlb page table sharing on 32-bit
    ee21fbcb87a0 x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
    ad9d4db5a8ac pwm: mediatek: Ensure to disable clocks in error path
    37e2911d2ec1 mm/vmalloc: leave lazy MMU mode on PTE mapping error
    f64046ae3401 scripts/gdb: fix interrupts.py after maple tree conversion
    ecf16604f3f0 scripts/gdb: de-reference per-CPU MCE interrupts
    e2e200c98e9f scripts/gdb: fix interrupts display after MCP on x86
    56995226431a mm: fix the inaccurate memory statistics issue for users
    167134042418 maple_tree: fix mt_destroy_walk() on root leaf node
    688bf63ee6ba kallsyms: fix build without execinfo
    c23a41086899 Revert "ACPI: battery: negate current when discharging"
    2e2e9b3d7084 drm/framebuffer: Acquire internal references on GEM handles
    dec7774d0ef9 Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
    c6eb4a05af3d usb: gadget: u_serial: Fix race condition in TTY wakeup
    8c290a9d629b drm/gem: Fix race in drm_gem_handle_create_tail()
    db7402d78e7c drm/ttm: fix error handling in ttm_buffer_object_transfer
    c64f5310530b drm/sched: Increment job count before swapping tail spsc queue
    cb4c956a15f8 drm/gem: Acquire references on GEM handles for framebuffers
    ec6392061de6 wifi: prevent A-MSDU attacks in mesh networks
    1d57f7132662 pinctrl: qcom: msm: mark certain pins as invalid for interrupts
    3d82a729530b md/md-bitmap: fix GPF in bitmap_get_stats()
    2ca1db269a8d gre: Fix IPv6 multicast route creation.
    8c8e8d4d7544 KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
    20d1d9e7ce69 KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table.
    a18776abc592 x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
    f536f3b09773 x86/mce: Don't remove sysfs if thresholding sysfs init fails
    cc058adb9beb x86/mce/amd: Fix threshold limit reset
    8e5058a5812e x86/mce/amd: Add default names for MCA banks and blocks
    e2d5c005dfc9 ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
    efc1b2b7c1a3 rxrpc: Fix oops due to non-existence of prealloc backlog struct
    ddc4fe078948 Bluetooth: HCI: Set extended advertising data synchronously
    eb952372bf48 perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation
    e63032e66bca maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
    432c5363cd6f rxrpc: Fix bug due to prealloc collision
    4c691d1b6b6d net/sched: Abort __tc_modify_qdisc if parent class does not exist
    07b585ae3699 atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
    3f61b997fe01 atm: clip: Fix infinite recursive call of clip_push().
    1fb9fb5a4b5c atm: clip: Fix memory leak of struct clip_vcc.
    06935c50cfa3 atm: clip: Fix potential null-ptr-deref in to_atmarpd().
    36cf9bcf09bd net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
    0a0d040f12fe net: phy: smsc: Force predictable MDI-X state on LAN87xx
    72c62b4991a2 net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
    791c8d6b76c5 net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
    d437e8e7dcb9 vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
    9d24bb678028 vsock: Fix transport_* TOCTOU
    401239811fa7 vsock: Fix transport_{g2h,h2g} TOCTOU
    81373cd1d72d tcp: Correct signedness in skb remaining space calculation
    be4b8392da79 tipc: Fix use-after-free in tipc_conn_close().
    42262bc4e8ef vsock: fix `vsock_proto` declaration
    55baecb9eb90 netlink: Fix wraparounds of sk->sk_rmem_alloc.
    f9b3d28f1f62 fix proc_sys_compare() handling of in-lookup dentries
    82c0f15c26be pinctrl: amd: Clear GPIO debounce for suspend
    a219fcea8e8e Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
    51e082108345 Bluetooth: hci_sync: Fix not disabling advertising instance
    c604dd2c5e6b ASoC: cs35l56: probe() should fail if the device ID is not recognized
    183bdb89af1b perf: Revert to requiring CAP_SYS_ADMIN for uprobes
    71eb118baf6e perf/core: Fix the WARN_ON_ONCE is out of lock protected region
    407f1073ea23 ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
    391e5ea5b877 drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
    521e9ff0b67c eventpoll: don't decrement ep refcount while still holding the ep mutex

(From OE-Core rev: 5504778cd1c538b6f3c40d3106a3423abdac3203)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Bruce Ashfield
574cc67a0d linux-yocto/6.6: update to v6.6.98
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:

    9247f4e6573a Linux 6.6.98
    20aa3d519806 x86/CPU/AMD: Properly check the TSA microcode
    59a2de10b81a Linux 6.6.97
    897761d16564 f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault
    8c1944905855 x86/process: Move the buffer clearing before MONITOR
    6fb766d53f61 x86/microcode/AMD: Add TSA microcode SHAs
    276499bb6944 KVM: SVM: Advertise TSA CPUID bits to guests
    90293047df18 x86/bugs: Add a Transient Scheduler Attacks mitigation
    2b6a5fbe9dc1 x86/bugs: Rename MDS machinery to something more generic
    8a7ac2737211 powerpc/kernel: Fix ppc_save_regs inclusion in build
    63cff9f57e86 usb: typec: displayport: Fix potential deadlock
    4b91b77af24c platform/x86: think-lmi: Fix sysfs group cleanup
    98002f1ac947 platform/x86: think-lmi: Fix kobject cleanup
    cb3e3244d88d platform/x86: think-lmi: Create ksets consecutively
    360546362865 powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed
    73d43c215007 iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
    6052862ba31c Logitech C-270 even more broken
    6358cb9c2a31 i2c/designware: Fix an initialization issue
    d8eab407c08d dma-buf: fix timeout handling in dma_resv_wait_timeout v2
    59205a3e93ef smb: client: fix readdir returning wrong type with POSIX extensions
    937f49be49d6 usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume
    afbec8c34428 usb: cdnsp: do not disable slot for disabled slot
    c9a841fd2ec2 Input: iqs7222 - explicitly define number of external channels
    2cd5e7c16942 Input: xpad - support Acer NGR 200 Controller
    c16b75aa6fb6 xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
    881c9274246c xhci: dbc: Flush queued requests before stopping dbc
    897d1170c249 xhci: dbctty: disable ECHO flag by default
    7609899eb6b7 usb: xhci: quirk for data loss in ISOC transfers
    204bdc7a8b7b NFSv4/flexfiles: Fix handling of NFS level errors in I/O
    e3eed0134772 fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
    adb29b437fe5 module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper
    a6069306f4e1 platform/x86: hp-bioscfg: Fix class device unregistration
    8570c219cd59 platform/x86: hp-bioscfg: Directly use firmware_attributes_class
    387da3b6d1a9 drm/v3d: Disable interrupts before resetting the GPU
    817662f9bdf8 rcu: Return early if callback is not specified
    d5c1e3f32902 mtd: spinand: fix memory leak of ECC engine conf
    d547779e72ce ACPICA: Refuse to evaluate a method if arguments are missing
    347827bd0c56 wifi: ath6kl: remove WARN on bad firmware input
    5aebb9aa538a wifi: mac80211: drop invalid source address OCB frames
    270d637100f9 aoe: defer rexmit timer downdev work to workqueue
    55dfffc5e947 scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
    7b9203afeb37 regulator: fan53555: add enable_time support and soft-start times
    a1d10fee0783 ASoC: amd: yc: update quirk data for HP Victus
    871beab5b4f9 powerpc: Fix struct termio related ioctl macros
    ba9117312795 platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list
    785200516552 ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
    69283b3fd463 ata: pata_cs5536: fix build on 32-bit UML
    71f89fab5cc9 ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled
    6766316c1a9f ALSA: sb: Force to disable DMAs once when DMA mode is changed
    c7922052c6f2 ALSA: sb: Don't allow changing the DMA mode during operations
    c40ad1c04d30 drm/msm: Fix another leak in the submit error path
    fe2695b2f63b drm/msm: Fix a fence leak in submit error path
    5df2087c9a1e drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read
    ad09bb7cbd14 drm/simpledrm: Do not upcast in release helpers
    51ba65860457 scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
    847af89aa163 scsi: ufs: core: Add OPP support for scaling clocks and regulators
    95ffe734518d scsi: ufs: core: Fix abnormal scale up after last cmd finish
    9e67044aa9a7 f2fs: fix to zero post-eof page
    d1ccd98eddba f2fs: convert f2fs_vm_page_mkwrite() to use folio
    7ac8a61e5503 f2fs: prevent writing without fallocate() for pinned files
    b43c3050d211 f2fs: add tracepoint for f2fs_vm_page_mkwrite()
    bceae1daf302 x86/traps: Initialize DR6 by writing its architectural reset value
    16254aa985d1 bnxt: properly flush XDP redirect lists
    6310aafd4267 wifi: mac80211: finish link init before RCU publish
    ebca4264c648 wifi: mac80211: Add link iteration macro for link data
    32d0b58079ed wifi: mac80211: chan: chandef is non-NULL for reserved
    bc0819a25e04 Bluetooth: hci_core: Fix use-after-free in vhci_flush()
    64d07a40f853 smb: client: remove \t from TP_printk statements
    3499dcb6c507 btrfs: fix qgroup reservation leak on failure to allocate ordered extent
    ccdd3eaec689 Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
    ca7d5aa7ccf0 smb: client: fix race condition in negotiate timeout by using more precise timing
    70b32cba5cfd amd-xgbe: do not double read link status
    f680a4643c6f net/sched: Always pass notifications when child class becomes empty
    5ea2a10be7d7 nui: Fix dma_mapping_error() check
    7a1841c96093 rose: fix dangling neighbour pointers in rose_rt_device_down()
    744cd8baffe8 enic: fix incorrect MTU comparison in enic_change_mtu()
    a133683c0567 amd-xgbe: align CL37 AN sequence as per databook
    f2ca04cbf01d lib: test_objagg: Set error message in check_expect_hints_stats()
    8f4652848b36 igc: disable L1.2 PCI-E link substate to avoid performance issue
    832058110a1d drm/i915/gsc: mei interrupt top half should be in irq disabled context
    40e09506aea1 drm/i915/gt: Fix timeline left held on VMA alloc error
    968a419c9513 net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
    0cee638d92ac smb: client: fix warning when reconnecting channel
    33713f7cda3d platform/mellanox: mlxreg-lc: Fix logic error in power state check
    421672fb7f13 platform/x86: dell-wmi-sysman: Fix class device unregistration
    dba37f72aae3 platform/x86: dell-sysman: Directly use firmware_attributes_class
    4074f6a15e95 platform/x86: think-lmi: Fix class device unregistration
    093ee65bdafb platform/x86: think-lmi: Directly use firmware_attributes_class
    ee813c62af62 platform/x86: firmware_attributes_class: Simplify API
    e52b896d5fb7 platform/x86: firmware_attributes_class: Move include linux/device/class.h
    9143d22a09b5 platform/x86: make fw_attr_class constant
    3df1e72b7bfe arm64: dts: qcom: sm8550: add UART14 nodes
    0deb3eb78ebf platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks
    55a90f82d4ff drm/i915/selftests: Change mock_request() to return error pointers
    822c05444ffa spi: spi-fsl-dspi: Clear completion counter before initiating transfer
    1fc5dc930137 drm/exynos: fimd: Guard display clock control with runtime PM calls
    7e6423f80bd6 dpaa2-eth: fix xdp_rxq_info leak
    31afd307975f ethernet: atl1: Add missing DMA mapping error checks and count errors
    2a7ac29f10d8 btrfs: use btrfs_record_snapshot_destroy() during rmdir
    d77a16802896 btrfs: propagate last_unlink_trans earlier when doing a rmdir
    65d7f92db8a9 btrfs: rename err to ret in btrfs_rmdir()
    2d11d274e2e1 btrfs: fix iteration of extrefs during log replay
    79b025ebc1c0 btrfs: fix missing error handling when searching for inode refs during log replay
    529281206f11 Bluetooth: Prevent unintended pause by checking if advertising is active
    e373354ecfbf platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message
    d8a1ad180c24 RDMA/mlx5: Fix vport loopback for MPV device
    efb3413f6ba9 RDMA/mlx5: Fix CC counters query for MPV
    301303d14da6 RDMA/mlx5: Fix HW counters query for non-representor devices
    ee9cb28675a5 scsi: ufs: core: Fix spelling of a sysfs attribute name
    39dac98aca12 scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
    c3ec87fbb00d scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
    8ca65fa71024 NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
    d0877c479f44 nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
    23a3b32a274a RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
    edca475158f7 platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
    3962e5a3845d arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename
    b935c1e734d2 mtk-sd: reset host->mrq on prepare_data() error
    61cdd6635646 mtk-sd: Prevent memory corruption from DMA map failure
    b3b00e9b03d3 mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
    45e9444b3b97 usb: typec: altmodes/displayport: do not index invalid pin_assignments
    24418bc77a66 regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
    0506547f6e3d Bluetooth: MGMT: mesh_send: check instances prior disabling advertising
    8af1406949c1 Bluetooth: MGMT: set_mesh: update LE scan interval and window
    7e88ad41b63e Bluetooth: hci_sync: revert some mesh modifications
    3c0c18ef4c79 mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
    c4fad2460c17 Revert "mmc: sdhci: Disable SD card clock before changing parameters"
    3855b7ace3f9 mmc: sdhci: Add a helper function for dump register in dynamic debug mode
    94d0c326cb3e vsock/vmci: Clear the vmci transport packet properly when initializing it
    e7191481d6ae s390/pci: Do not try re-enabling load/store if device is disabled
    80b971be4c37 virtio-net: ensure the received length does not exceed allocated size
    39617dc3fafe rtc: cmos: use spin_lock_irqsave in cmos_interrupt
    5cdd1f73401d rtc: pcf2127: fix SPI command byte for PCF2131
    1cb814dbb03d rtc: pcf2127: add missing semicolon after statement

(From OE-Core rev: b9041a3e6ddc8917eba2af45a8e57f2e48998dc9)

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Deepesh Varatharajan
be43d55edd glibc: stable 2.39 branch updates
git log --oneline b027d5b145f1b2908f370bdb96dfe40180d0fcb6..58cbbd43fe82910cf8ae9008351b0b0665104500

58cbbd43fe (HEAD -> release/2.39/master, origin/release/2.39/master) x86: Detect Intel Nova Lake Processor
835b1e3379 x86: Detect Intel Wildcat Lake Processor
765534258e nss: Group merge does not react to ERANGE during merge (bug 33361)
7ce7b4b2f4 Rename new tst-sem17 test to tst-sem18
a6ac06abeb Avoid uninitialized result in sem_open when file does not exist
ff6ce67220 elf: handle addition overflow in _dl_find_object_update_1 [BZ #32245]
fffc2df8a3 Optimize __libc_tsd_* thread variable access
83340b35cc i386: Add GLIBC_ABI_GNU_TLS version [BZ #33221]
5541edb1bd i386: Also add GLIBC_ABI_GNU2_TLS version [BZ #33129]
1f17635507 debug: Fix tst-longjmp_chk3 build failure on Hurd
3b6c8ea878 debug: Wire up tst-longjmp_chk3
89596f46e3 i386: Update ___tls_get_addr to preserve vector registers
4c2509882f elf: Preserve _rtld_global layout for the release branch
cf0e7d512d elf: Compile _dl_debug_state separately (bug 33224)
5cd1f4b1a1 elf: Restore support for _r_debug interpositions and copy relocations
97017da5ef elf: Introduce _dl_debug_change_state
5601ad79b7 elf: Introduce separate _r_debug_array variable
24c94ea84e elf: Test dlopen (NULL, RTLD_LAZY) from an ELF constructor
79d84b5da5 elf: Fix handling of symbol versions which hash to zero (bug 29190)
5f5c411132 elf: Second ld.so relocation only if libc.so has been loaded
4c9b1877fd elf: Reorder audit events in dlcose to match _dl_fini (bug 32066)
f407a14ff7 elf: Call la_objclose for proxy link maps in _dl_fini (bug 32065)
e27601b385 elf: Signal la_objopen for the proxy link map in dlmopen (bug 31985)
fef226255d elf: Add the endswith function to <endswith.h>
d21a217fa0 elf: Update DSO list, write audit log to elf/tst-audit23.out
4f145bb35d elf: Switch to main malloc after final ld.so self-relocation
65d86471ce elf: Introduce _dl_relocate_object_no_relro
5434cc2c41 elf: Do not define consider_profiling, consider_symbind as macros
b2d8c6cbe7 elf: rtld_multiple_ref is always true
2b89de7c91 Revert "elf: Run constructors on cyclic recursive dlopen (bug 31986)"
46e3ecad27 elf: Fix map_complete Systemtap probe in dl_open_worker
5f225025db elf: Signal RT_CONSISTENT after relocation processing in dlopen (bug 31986)
d6cc325fcf elf: Signal LA_ACT_CONSISTENT to auditors after RT_CONSISTENT switch
6917fde6f9 elf: Run constructors on cyclic recursive dlopen (bug 31986)
9fa7cc6a0b ldconfig: Move endswithn into a new header file
269e89bd8d x86-64: Add GLIBC_ABI_DT_X86_64_PLT [BZ #33212]
62ff85fd09 x86-64: Add GLIBC_ABI_GNU2_TLS version [BZ #33129]
f0e8d04eef libio: Test for fdopen memory leak without SEEK_END support (bug 31840)
42a8cb7560 Remove memory leak in fdopen (bug 31840)
d1c1f78e9e math: Remove no-mathvec flag
20d2d69a2f Use TLS initial-exec model for __libc_tsd_CTYPE_* thread variables [BZ #33234]
c11950503f ctype: Fallback initialization of TLS using relocations (bug 19341, bug 32483)
25c537c3b3 Use proper extern declaration for _nl_C_LC_CTYPE_{class,toupper,tolower}
fbdf9680cc Remove <libc-tsd.h>
fca5937510 ctype: Reformat Makefile.
49f0e73fa3 elf: Handle ld.so with LOAD segment gaps in _dl_find_object (bug 31943)
64488b4b31 elf: Extract rtld_setup_phdr function from dl_main
9833fcf7ce elf: Do not add a copy of _dl_find_object to libc.so
fbade65338 arm: Use _dl_find_object on __gnu_Unwind_Find_exidx (BZ 31405)
392e6cf1e8 AArch64: Improve codegen in SVE log1p
3a78a276a3 AArch64: Optimize inverse trig functions
b6ea8902a7 AArch64: Avoid memset ifunc in cpu-features.c [BZ #33112]

Testing Results:
            Before     After    Diff
PASS         5080      5099      +19
XPASS        4         4          0
FAIL         119       120       +1
XFAIL        16        16         0
UNSUPPORTED  154       154        0

Testcases changes

testcase-name                                                before           after

debug/tst-longjmp_chk3(new)                                    -               PASS
elf/check-dt-x86-64-plt(new)                                   -               PASS
elf/check-gnu2-tls(new)                                        -               PASS
lf/tst-dlmopen4-nonpic(new)                                    -               PASS
elf/tst-dlmopen4-pic(new)                                      -               PASS
elf/tst-dlopen-auditdup(new)                                   -               PASS
elf/tst-dlopen-constructor-null(new)                           -               PASS
elf/tst-link-map-contiguous-ldso(new)                          -               PASS
elf/tst-link-map-contiguous-libc(new)                          -               PASS
elf/tst-nolink-libc-1(new)                                     -               PASS
elf/tst-nolink-libc-2(new)                                     -               PASS
elf/tst-rtld-no-malloc(new)                                    -               PASS
elf/tst-rtld-no-malloc-audit(new)                              -               PASS
elf/tst-rtld-no-malloc-preload(new)                            -               PASS
elf/tst-tls23(new)                                             -               PASS
elf/tst-version-hash-zero(new)                                 -               PASS
libio/tst-fdopen-seek-failure(new)                             -               PASS
libio/tst-fdopen-seek-failure-mem(new)                         -               PASS
nptl/tst-sem18(new)                                            -               PASS
ctype/tst-ctype-tls-dlmopen(new)                               -               FAIL
ctype/tst-ctype-tls-dlopen-static(new)                         -               FAIL
stdio-common/tst-scanf-bz27650                                FAIL             PASS
elf/ifuncmain8                                                PASS              -

(From OE-Core rev: d60dd826d81bc4c85452826427d710b2bb0ddde9)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Rajeshkumar Ramasamy
4456c586d1 glib-networking: fix CVE-2025-60019
glib-networking's OpenSSL backend fails to properly check the return
value of memory allocation routines. An out of memory condition could
potentially result in writing to an invalid memory location.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-60019

Upstream-patch:
70df675dd4

(From OE-Core rev: 8c44478c92a8b3d859c7fcecc734ac6bb399277e)

Signed-off-by: Rajeshkumar Ramasamy <rajeshkumar.ramasamy@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Saravanan
6d7cfb5461 cmake: fix CVE-2025-9301
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-9301
https://gitlab.kitware.com/cmake/cmake/-/issues/27135

Upstream-patch:
37e27f71bc

(From OE-Core rev: 5d8a6fb52ca4a7641236712ba51cb322cb1f9f9d)

Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
David Nyström
2142f17368 openssh: fix CVE-2025-61984
ssh in OpenSSH before 10.1 allows control characters in usernames that
originate from certain possibly untrusted sources, potentially leading
to code execution when a ProxyCommand is used. The untrusted sources
are the command line and %-sequence expansion of a configuration file.

Note:
openssh does not support variable expansion until 10.0, so backport
adapts for this.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-61984

Upstream patch:
35d5917652

(From OE-Core rev: 717d4c7609cdce2cc3a65b7ba69c316fa86a9333)

Signed-off-by: David Nyström <david.nystrom@est.tech>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
David Nyström
a7fdce2a68 openssh: fix CVE-2025-61985
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI,
potentially leading to code execution when a ProxyCommand is used.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-61985

Upstream patch:
43b3bff47b

(From OE-Core rev: 52d925423b826383d12a97b834475ab5699fd492)

Signed-off-by: David Nyström <david.nystrom@est.tech>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:40 -07:00
Rajeshkumar Ramasamy
bf8139e03b glib-networking: fix CVE-2025-60018
glib-networking's OpenSSL backend fails to properly check the return
value of a call to BIO_write(), resulting in an out of bounds read.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-60018

Upstream-patch:
4dd540505d

(From OE-Core rev: e5ef6337416135d3c9d311c870ee72928aa75620)

Signed-off-by: Rajeshkumar Ramasamy <rajeshkumar.ramasamy@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:39 -07:00
Peter Marko
f0bbacca46 gnupg: mark CVE-2025-30258 as patched
Per NVD report [1] this CVE is fixed by [2].
This commit was backported to 2.4.8 via [3].

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-30258
[2] https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158
[3] da0164efc7

(From OE-Core rev: 88fe1eaa4bcd7c838902d8cdc067276c5f32624d)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:39 -07:00
Peter Marko
2f86700da6 binutils: patch CVE-2025-11083
Pick patch per link in NVD report.

(From OE-Core rev: 155a93a0e0ea52316567b0eaea37b8da4c80d7be)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:39 -07:00
Peter Marko
f09c292577 binutils: patch CVE-2025-11082
Pick patch per link in NVD report.

(From OE-Core rev: fe40f3c025d31b262582e0ec9e7b688ae82ee0e6)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:39 -07:00
Saravanan
2ab1bedda9 python3-xmltodict: fix CVE-2025-9375
Reference:
	https://nvd.nist.gov/vuln/detail/CVE-2025-9375
	https://security-tracker.debian.org/tracker/CVE-2025-9375
	https://git.launchpad.net/ubuntu/+source/python-xmltodict/commit/?id=e8110a20e00d80db31d5fc9f8f4577328385d6b6

Upstream-patch:
	ecd456ab88
	f98c90f071

(From OE-Core rev: 30624cce634cade0b030aa71a03be754abbf3da9)

Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:39 -07:00
Peter Marko
a04f9ab3a5 qemu: patch CVE-2024-8354
Pick commit per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2024-8354

(From OE-Core rev: 4bab523ed8ee34e8c09deb631fc82417aa0784b9)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-10-24 06:23:39 -07:00
235 changed files with 24134 additions and 1518 deletions

View File

@@ -460,7 +460,7 @@ def uri_replace(ud, uri_find, uri_replace, replacements, d, mirrortarball=None):
for k in replacements:
uri_replace_decoded[loc] = uri_replace_decoded[loc].replace(k, replacements[k])
#bb.note("%s %s %s" % (regexp, uri_replace_decoded[loc], uri_decoded[loc]))
result_decoded[loc] = re.sub(regexp, uri_replace_decoded[loc], uri_decoded[loc], 1)
result_decoded[loc] = re.sub(regexp, uri_replace_decoded[loc], uri_decoded[loc], count=1)
if loc == 2:
# Handle path manipulations
basename = None

View File

@@ -344,8 +344,11 @@ class Wget(FetchMethod):
opener = urllib.request.build_opener(*handlers)
try:
uri_base = ud.url.split(";")[0]
uri = "{}://{}{}".format(urllib.parse.urlparse(uri_base).scheme, ud.host, ud.path)
parts = urllib.parse.urlparse(ud.url.split(";")[0])
if parts.query:
uri = "{}://{}{}?{}".format(parts.scheme, parts.netloc, parts.path, parts.query)
else:
uri = "{}://{}{}".format(parts.scheme, parts.netloc, parts.path)
r = urllib.request.Request(uri)
r.get_method = lambda: "HEAD"
# Some servers (FusionForge, as used on Alioth) require that the

View File

@@ -697,8 +697,8 @@ backported to a stable branch unless the bug in question does not affect the
master branch or the fix on the master branch is unsuitable for backporting.
The list of stable branches along with the status and maintainer for each
branch can be obtained from the
:yocto_wiki:`Releases wiki page </Releases>`.
branch can be obtained from the :yocto_home:`Releases </development/releases/>`
page.
.. note::

View File

@@ -111,17 +111,17 @@ occurred in your project. Perhaps an attempt to :ref:`modify a variable
<bitbake-user-manual/bitbake-user-manual-metadata:modifying existing
variables>` did not work out as expected.
BitBake's ``-e`` option is used to display variable values after
parsing. The following command displays the variable values after the
configuration files (i.e. ``local.conf``, ``bblayers.conf``,
BitBake's ``bitbake-getvar`` command is used to display variable values after
parsing. The following command displays the variable value for :term:`OVERRIDES`
after the configuration files (i.e. ``local.conf``, ``bblayers.conf``,
``bitbake.conf`` and so forth) have been parsed::
$ bitbake -e
$ bitbake-getvar OVERRIDES
The following command displays variable values after a specific recipe has
been parsed. The variables include those from the configuration as well::
The following command displays the value of :term:`PV` after a specific recipe
has been parsed::
$ bitbake -e recipename
$ bitbake-getvar -r recipename PV
.. note::
@@ -135,19 +135,25 @@ been parsed. The variables include those from the configuration as well::
the recipe datastore, which means that variables set within one task
will not be visible to other tasks.
In the output of ``bitbake -e``, each variable is preceded by a
description of how the variable got its value, including temporary
values that were later overridden. This description also includes
variable flags (varflags) set on the variable. The output can be very
In the output of ``bitbake-getvar``, the line containing the value of the
variable is preceded by a description of how the variable got its value,
including temporary values that were later overridden. This description also
includes variable flags (varflags) set on the variable. The output can be very
helpful during debugging.
Variables that are exported to the environment are preceded by
``export`` in the output of ``bitbake -e``. See the following example::
``export`` in the output of ``bitbake-getvar``. See the following example::
export CC="i586-poky-linux-gcc -m32 -march=i586 --sysroot=/home/ulf/poky/build/tmp/sysroots/qemux86"
In addition to variable values, the output of the ``bitbake -e`` and
``bitbake -e`` recipe commands includes the following information:
Shell functions and tasks can also be inspected with the same mechanism::
$ bitbake-getvar -r recipename do_install
For Python functions and tasks, ``bitbake -e recipename`` can be used instead.
Moreover, the output of the ``bitbake -e`` and ``bitbake -e`` recipe commands
includes the following information:
- The output starts with a tree listing all configuration files and
classes included globally, recursively listing the files they include

View File

@@ -123,10 +123,9 @@ Follow these general steps to create your layer without using tools:
Lists all layers on which this layer depends (if any).
- :term:`LAYERSERIES_COMPAT`:
Lists the :yocto_wiki:`Yocto Project </Releases>`
releases for which the current version is compatible. This
variable is a good way to indicate if your particular layer is
current.
Lists the :yocto_home:`Yocto Project releases </development/releases/>`
for which the current version is compatible. This variable is a good
way to indicate if your particular layer is current.
.. note::
@@ -832,6 +831,8 @@ The following list describes the available commands:
can replicate the directory structure and revisions of the layers in a current build.
For more information, see ":ref:`dev-manual/layers:saving and restoring the layers setup`".
- ``show-machines``: Lists the machines available in the currently configured layers.
Creating a General Layer Using the ``bitbake-layers`` Script
============================================================

View File

@@ -83,19 +83,20 @@ command::
OpenEmbedded recipe tool
options:
-d, --debug Enable debug output
-q, --quiet Print only errors
--color COLOR Colorize output (where COLOR is auto, always, never)
-h, --help show this help message and exit
-d, --debug Enable debug output
-q, --quiet Print only errors
--color COLOR Colorize output (where COLOR is auto, always, never)
-h, --help show this help message and exit
subcommands:
create Create a new recipe
newappend Create a bbappend for the specified target in the specified
layer
setvar Set a variable within a recipe
appendfile Create/update a bbappend to replace a target file
appendsrcfiles Create/update a bbappend to add or replace source files
appendsrcfile Create/update a bbappend to add or replace a source file
newappend Create a bbappend for the specified target in the specified layer
create Create a new recipe
setvar Set a variable within a recipe
appendfile Create/update a bbappend to replace a target file
appendsrcfiles Create/update a bbappend to add or replace source files
appendsrcfile Create/update a bbappend to add or replace a source file
edit Edit the recipe and appends for the specified target. This obeys $VISUAL if set,
otherwise $EDITOR, otherwise vi.
Use recipetool <subcommand> --help to get help on a specific command
Running ``recipetool create -o OUTFILE`` creates the base recipe and
@@ -218,9 +219,9 @@ compilation and packaging files, and so forth.
The path to the per-recipe temporary work directory depends on the
context in which it is being built. The quickest way to find this path
is to have BitBake return it by running the following::
is to use the ``bitbake-getvar`` utility::
$ bitbake -e basename | grep ^WORKDIR=
$ bitbake-getvar -r basename WORKDIR
As an example, assume a Source Directory
top-level folder named ``poky``, a default :term:`Build Directory` at
@@ -438,7 +439,7 @@ Licensing
=========
Your recipe needs to define variables related to the license
under whith the software is distributed. See the
under which the software is distributed. See the
:ref:`contributor-guide/recipe-style-guide:recipe license fields`
section in the Contributor Guide for details.

View File

@@ -24,11 +24,12 @@ users can read in standardized format.
:term:`SBOM` information is also critical to performing vulnerability exposure
assessments, as all the components used in the Software Supply Chain are listed.
The OpenEmbedded build system doesn't generate such information by default.
To make this happen, you must inherit the
:ref:`ref-classes-create-spdx` class from a configuration file::
The OpenEmbedded build system generates such information by default (by
inheriting the :ref:`ref-classes-create-spdx` class in :term:`INHERIT_DISTRO`).
INHERIT += "create-spdx"
If needed, it can be disabled from a :term:`configuration file`::
INHERIT_DISTRO:remove = "create-spdx"
Upon building an image, you will then get the compressed archive
``IMAGE-MACHINE.spdx.tar.zst`` contains the index and the files for the single

View File

@@ -44,10 +44,10 @@ See the
documentation for details regarding the policies and maintenance of stable
branches.
The :yocto_wiki:`Releases page </Releases>` contains a list
of all releases of the Yocto Project. Versions in gray are no longer actively
maintained with security patches, but well-tested patches may still be accepted
for them for significant issues.
The :yocto_home:`Releases </development/releases/>` page contains a list of all
releases of the Yocto Project, grouped into current and previous releases.
Previous releases are no longer actively maintained with security patches, but
well-tested patches may still be accepted for them for significant issues.
Security-related discussions at the Yocto Project
-------------------------------------------------

View File

@@ -651,7 +651,7 @@ described in the ":ref:`dev-manual/start:accessing source archives`" section.
.. note::
For a "map" of Yocto Project releases to version numbers, see the
:yocto_wiki:`Releases </Releases>` wiki page.
:yocto_home:`Releases </development/releases/>` page.
You can use the "RELEASE ARCHIVE" link to reveal a menu of all Yocto
Project releases.

View File

@@ -12,7 +12,7 @@ known security vulnerabilities, as tracked by the public
database.
The Yocto Project maintains a `list of known vulnerabilities
<https://autobuilder.yocto.io/pub/non-release/patchmetrics/>`__
<https://valkyrie.yocto.io/pub/non-release/patchmetrics/>`__
for packages in Poky and OE-Core, tracking the evolution of the number of
unpatched CVEs and the status of patches. Such information is available for
the current development version and for each supported release.
@@ -314,7 +314,7 @@ products defined in :term:`CVE_PRODUCT`. Then, for each found CVE:
The CVE database is stored in :term:`DL_DIR` and can be inspected using
``sqlite3`` command as follows::
sqlite3 downloads/CVE_CHECK/nvdcve_1.1.db .dump | grep CVE-2021-37462
sqlite3 downloads/CVE_CHECK/nvd*.db .dump | grep CVE-2021-37462
When analyzing CVEs, it is recommended to:

View File

@@ -1191,10 +1191,12 @@ appear in the ``.config`` file, which is in the :term:`Build Directory`.
It is simple to create a configuration fragment. One method is to use
shell commands. For example, issuing the following from the shell
creates a configuration fragment file named ``my_smp.cfg`` that enables
multi-processor support within the kernel::
creates a configuration fragment file named ``my_changes.cfg`` that enables
multi-processor support within the kernel and disables the FPGA
Configuration Framework::
$ echo "CONFIG_SMP=y" >> my_smp.cfg
$ echo "CONFIG_SMP=y" >> my_changes.cfg
$ echo "# CONFIG_FPGA is not set" >> my_changes.cfg
.. note::
@@ -1431,15 +1433,13 @@ Expanding Variables
===================
Sometimes it is helpful to determine what a variable expands to during a
build. You can examine the values of variables by examining the
output of the ``bitbake -e`` command. The output is long and is more
easily managed in a text file, which allows for easy searches::
build. You can examine the value of a variable by running the ``bitbake-getvar``
command::
$ bitbake -e virtual/kernel > some_text_file
$ bitbake-getvar -r virtual/kernel VARIABLE
Within the text file, you can see
exactly how each variable is expanded and used by the OpenEmbedded build
system.
The output of the command explains exactly how the variable is expanded and used
by the :term:`OpenEmbedded Build System`.
Working with a "Dirty" Kernel Version String
============================================

View File

@@ -36,3 +36,5 @@ Release 4.0 (kirkstone)
release-notes-4.0.27
release-notes-4.0.28
release-notes-4.0.29
release-notes-4.0.30
release-notes-4.0.31

View File

@@ -19,3 +19,4 @@ Release 5.0 (scarthgap)
release-notes-5.0.10
release-notes-5.0.11
release-notes-5.0.12
release-notes-5.0.13

View File

@@ -0,0 +1,170 @@
Release notes for Yocto-4.0.30 (Kirkstone)
------------------------------------------
Security Fixes in Yocto-4.0.30
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- cups: Fix :cve_nist:`2025-58060` and :cve_nist:`2025-58364`
- dpkg: Fix :cve_nist:`2025-6297`
- ffmpeg: Fix :cve_nist:`2023-6602`, :cve_nist:`2023-6604`, :cve_nist:`2023-6605`,
:cve_nist:`2025-1594` and CVE-2025-7700
- git: Fix :cve_nist:`2025-27613`, :cve_nist:`2025-27614`, :cve_nist:`2025-46334`,
:cve_nist:`2025-46835` and :cve_nist:`2025-48384`
- glib-2.0: Fix :cve_nist:`2025-7039`
- glib-2.0: Ignore :cve_nist:`2025-4056`
- go: Ignore :cve_nist:`2024-24790` and :cve_nist:`2025-0913`
- gstreamer1.0-plugins-base: Fix :cve_nist:`2025-47806`, :cve_nist:`2025-47807` and
:cve_nist:`2025-47808`
- gstreamer1.0-plugins-good: Fix :cve_nist:`2025-47183` and :cve_nist:`2025-47219`
- libarchive: Fix :cve_nist:`2025-5918`
- libxslt: Fix :cve_nist:`2023-40403`
- openssl: Fix :cve_nist:`2023-50781`
- python3: Fix :cve_nist:`2025-8194`
- qemu: Ignore :cve_nist:`2024-7730`
- sqlite3: Revert "sqlite3: patch CVE-2025-7458"
- tiff: Fix :cve_nist:`2024-13978`, :cve_nist:`2025-8176`, :cve_nist:`2025-8177`,
:cve_nist:`2025-8534` and :cve_nist:`2025-8851`
- vim: Fix :cve_nist:`2025-53905` and :cve_nist:`2025-53906`
- wpa-supplicant: Fix :cve_nist:`2022-37660`
- xserver-xorg: Fix :cve_nist:`2025-49175`, :cve_nist:`2025-49176`, :cve_nist:`2025-49177`,
:cve_nist:`2025-49178`, :cve_nist:`2025-49179` and :cve_nist:`2025-49180`
Fixes in Yocto-4.0.30
~~~~~~~~~~~~~~~~~~~~~
- build-appliance-image: Update to kirkstone head revision
- default-distrovars.inc: Fix CONNECTIVITY_CHECK_URIS redirect issue
- dev-manual/security-subjects.rst: update mailing lists
- gnupg: disable tests to avoid running target binaries at build time
- go-helloworld: fix license
- insane: Ensure that `src-uri-bad` fails correctly
- insane: Improve patch warning/error handling
- libubootenv: backport patch to fix unknown type name 'size_t'
- llvm: fix typo in CVE-2024-0151.patch
- migration-guides: add release notes for 4.0.29
- overview-manual/yp-intro.rst: fix broken link to article
- poky.conf: bump version for 4.0.30
- pulseaudio: Add audio group explicitly
- ref-manual/classes.rst: document the testexport class
- ref-manual/system-requirements.rst: update supported distributions
- ref-manual/variables.rst: document :term:`FIT_CONF_PREFIX` :term:`SPL_DTB_BINARY` variable
- ref-manual/variables.rst: expand :term:`IMAGE_OVERHEAD_FACTOR` glossary entry
- sdk: The main in the C example should return an int
- sudo: remove devtool FIXME comment
- systemd: Fix manpage build after :cve_nist:`2025-4598`
- vim: not adjust script pathnames for native scripts either
- vim: upgrade to 9.1.1652
Known Issues in Yocto-4.0.30
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- N/A
Contributors to Yocto-4.0.30
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- Antonin Godard
- Archana Polampalli
- Dan McGregor
- Deepak Rathore
- Divya Chellam
- Erik Lindsten
- Guocai He
- Gyorgy Sarvari
- Hitendra Prajapati
- Jan Vermaete
- Jiaying Song
- Joao Marcos Costa
- Kyungjik Min
- Lee Chee Yang
- Mingli Yu
- Peter Marko
- Philip Lorenz
- Praveen Kumar
- Quentin Schulz
- Richard Purdie
- Steve Sakoman
- Vijay Anusuri
- Yogita Urade
- Youngseok Jeong
Repositories / Downloads for Yocto-4.0.30
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
poky
- Repository Location: :yocto_git:`/poky`
- Branch: :yocto_git:`kirkstone </poky/log/?h=kirkstone>`
- Tag: :yocto_git:`yocto-4.0.30 </poky/log/?h=yocto-4.0.30>`
- Git Revision: :yocto_git:`51dc9c464de0703bfbc6f1ee71ac9bea20933a45 </poky/commit/?id=51dc9c464de0703bfbc6f1ee71ac9bea20933a45>`
- Release Artefact: poky-51dc9c464de0703bfbc6f1ee71ac9bea20933a45
- sha: 2b5db0a07598df7684975c0839e6f31515a8e78d366503feb9917ef1ca56c0b2
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.30/poky-51dc9c464de0703bfbc6f1ee71ac9bea20933a45.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-4.0.30/poky-51dc9c464de0703bfbc6f1ee71ac9bea20933a45.tar.bz2
openembedded-core
- Repository Location: :oe_git:`/openembedded-core`
- Branch: :oe_git:`kirkstone </openembedded-core/log/?h=kirkstone>`
- Tag: :oe_git:`yocto-4.0.30 </openembedded-core/log/?h=yocto-4.0.30>`
- Git Revision: :oe_git:`d381eeb5e70bd0ce9e78032c909e4a23564f4dd7 </openembedded-core/commit/?id=d381eeb5e70bd0ce9e78032c909e4a23564f4dd7>`
- Release Artefact: oecore-d381eeb5e70bd0ce9e78032c909e4a23564f4dd7
- sha: 022ab4ef5ac59ac3f01a9dacd8b1d6310cc117c6bed2e86e195ced88e0689c85
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.30/oecore-d381eeb5e70bd0ce9e78032c909e4a23564f4dd7.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-4.0.30/oecore-d381eeb5e70bd0ce9e78032c909e4a23564f4dd7.tar.bz2
meta-mingw
- Repository Location: :yocto_git:`/meta-mingw`
- Branch: :yocto_git:`kirkstone </meta-mingw/log/?h=kirkstone>`
- Tag: :yocto_git:`yocto-4.0.30 </meta-mingw/log/?h=yocto-4.0.30>`
- Git Revision: :yocto_git:`87c22abb1f11be430caf4372e6b833dc7d77564e </meta-mingw/commit/?id=87c22abb1f11be430caf4372e6b833dc7d77564e>`
- Release Artefact: meta-mingw-87c22abb1f11be430caf4372e6b833dc7d77564e
- sha: f0bc4873e2e0319fb9d6d6ab9b98eb3f89664d4339a167d2db6a787dd12bc1a8
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.30/meta-mingw-87c22abb1f11be430caf4372e6b833dc7d77564e.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-4.0.30/meta-mingw-87c22abb1f11be430caf4372e6b833dc7d77564e.tar.bz2
meta-gplv2
- Repository Location: :yocto_git:`/meta-gplv2`
- Branch: :yocto_git:`kirkstone </meta-gplv2/log/?h=kirkstone>`
- Tag: :yocto_git:`yocto-4.0.30 </meta-gplv2/log/?h=yocto-4.0.30>`
- Git Revision: :yocto_git:`d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a </meta-gplv2/commit/?id=d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a>`
- Release Artefact: meta-gplv2-d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a
- sha: c386f59f8a672747dc3d0be1d4234b6039273d0e57933eb87caa20f56b9cca6d
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.30/meta-gplv2-d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-4.0.30/meta-gplv2-d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a.tar.bz2
bitbake
- Repository Location: :oe_git:`/bitbake`
- Branch: :oe_git:`2.0 </bitbake/log/?h=2.0>`
- Tag: :oe_git:`yocto-4.0.30 </bitbake/log/?h=yocto-4.0.30>`
- Git Revision: :oe_git:`8e2d1f8de055549b2101614d85454fcd1d0f94b2 </bitbake/commit/?id=8e2d1f8de055549b2101614d85454fcd1d0f94b2>`
- Release Artefact: bitbake-8e2d1f8de055549b2101614d85454fcd1d0f94b2
- sha: fad4e7699bae62082118e89785324b031b0af0743064caee87c91ba28549afb0
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.30/bitbake-8e2d1f8de055549b2101614d85454fcd1d0f94b2.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-4.0.30/bitbake-8e2d1f8de055549b2101614d85454fcd1d0f94b2.tar.bz2
meta-yocto
- Repository Location: :yocto_git:`/meta-yocto`
- Branch: :yocto_git:`kirkstone </meta-yocto/log/?h=kirkstone>`
- Tag: :yocto_git:`yocto-4.0.30 </meta-yocto/log/?h=yocto-4.0.30>`
- Git Revision: :yocto_git:`edf7950e4d81dd31f29a58acdd8022dabd2be494 </meta-yocto/commit/?id=edf7950e4d81dd31f29a58acdd8022dabd2be494>`
yocto-docs
- Repository Location: :yocto_git:`/yocto-docs`
- Branch: :yocto_git:`kirkstone </yocto-docs/log/?h=kirkstone>`
- Tag: :yocto_git:`yocto-4.0.30 </yocto-docs/log/?h=yocto-4.0.30>`
- Git Revision: :yocto_git:`71a3933c609ce73ff07e5be48d9e7b03f22ef8d7 </yocto-docs/commit/?id=71a3933c609ce73ff07e5be48d9e7b03f22ef8d7>`

View File

@@ -0,0 +1,210 @@
Release notes for Yocto-4.0.31 (Kirkstone)
------------------------------------------
Security Fixes in Yocto-4.0.31
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- binutils: Fix :cve_nist:`2025-8225`, :cve_nist:`2025-11081`, :cve_nist:`2025-11082` and
:cve_nist:`2025-11083`
- busybox: Fix :cve_nist:`2025-46394`
- cmake: Fix :cve_nist:`2025-9301`
- curl: Fix :cve_nist:`2025-9086`
- ffmpeg: Ignore :cve_nist:`2023-6603`
- ffmpeg: mark :cve_nist:`2023-6601` as Fixed
- ghostscript: Fix :cve_nist:`2025-59798`, :cve_nist:`2025-59799` and :cve_nist:`2025-59800`
- git: Fix :cve_nist:`2025-48386`
- glib-networking: Fix :cve_nist:`2025-60018` and :cve_nist:`2025-60019`
- go: Fix :cve_nist:`2025-47906` and :cve_nist:`2025-47907`
- grub2: Fix :cve_nist:`2024-56738`
- grub: Ignore :cve_nist:`2024-2312`
- gstreamer1.0-plugins-bad: Fix :cve_nist:`2025-3887`
- gstreamer1.0: Ignore :cve_nist:`2025-2759`, :cve_nist:`2025-3887`, :cve_nist:`2025-47183`,
:cve_nist:`2025-47219`, :cve_nist:`2025-47806`, :cve_nist:`2025-47807` and :cve_nist:`2025-47808`
- python3-jinja2: Fix :cve_nist:`2024-56201`, :cve_nist:`2024-56326` and :cve_nist:`2025-27516`
- libxml2: Fix :cve_nist:`2025-9714`
- libxslt: Fix :cve_nist:`2025-7424`
- lz4: Fix :cve_nist:`2025-62813`
- openssl: Fix :cve_nist:`2025-9230` and :cve_nist:`2025-9232`
- pulseaudio: Ignore :cve_nist:`2024-11586`
- python3: Fix :cve_nist:`2024-6345`, :cve_nist:`2025-47273` and :cve_nist:`2025-59375`
- qemu: Fix :cve_nist:`2024-8354`
- tiff: Fix :cve_nist:`2025-8961`, :cve_nist:`2025-9165` and :cve_nist:`2025-9900`
- vim: Fix :cve_nist:`2025-9389`
Fixes in Yocto-4.0.31
~~~~~~~~~~~~~~~~~~~~~
- build-appliance-image: Update to kirkstone head revision
- poky.conf: bump version for 4.0.31
- ref-manual/classes.rst: document the relative_symlinks class
- ref-manual/classes.rst: gettext: extend the documentation of the class
- ref-manual/variables.rst: document the CCACHE_DISABLE, UNINATIVE_CHECKSUM, UNINATIVE_URL, USE_NLS,
REQUIRED_COMBINED_FEATURES, REQUIRED_IMAGE_FEATURES, :term:`REQUIRED_MACHINE_FEATURES` variable
- ref-manual/variables.rst: fix :term:`LAYERDEPENDS` description
- dev-manual, test-manual: Update autobuilder output links
- ref-manual/classes.rst: extend the uninative class documentation
- python3: upgrade to 3.10.19
- linux-yocto/5.15: update to v5.15.194
- glibc: : PTHREAD_COND_INITIALIZER compatibility with pre-2.41 versions (bug 32786)
- glibc: nptl Use all of g1_start and g_signals
- glibc: nptl rename __condvar_quiesce_and_switch_g1
- glibc: nptl Fix indentation
- glibc: nptl Use a single loop in pthread_cond_wait instaed of a nested loop
- glibc: Remove g_refs from condition variables
- glibc: nptl Remove unnecessary quadruple check in pthread_cond_wait
- glibc: nptl Remove unnecessary catch-all-wake in condvar group switch
- glibc: nptl Update comments and indentation for new condvar implementation
- glibc: pthreads NPTL lost wakeup fix 2
- glibc: Remove partial BZ#25847 backport patches
- vulnerabilities: update nvdcve file name
- migration-guides: add release notes for 4.0.30
- oeqa/sdk/cases/buildcpio.py: use gnu mirror instead of main server
- selftest/cases/meta_ide.py: use use gnu mirror instead of main server
- conf/bitbake.conf: use gnu mirror instead of main server
- p11-kit: backport fix for handle :term:`USE_NLS` from master
- systemd: backport fix for handle :term:`USE_NLS` from master
- glibc: stable 2.35 branch updates
- openssl: upgrade to 3.0.18
- scripts/install-buildtools: Update to 4.0.30
- ref-manual/variables.rst: fix the description of :term:`STAGING_DIR`
- ref-manual/structure: document the auto.conf file
- dev-manual/building.rst: add note about externalsrc variables absolute paths
- ref-manual/variables.rst: fix the description of :term:`KBUILD_DEFCONFIG`
- kernel-dev/common.rst: fix the in-tree defconfig description
- test-manual/yocto-project-compatible.rst: fix a typo
- contributor-guide: submit-changes: make "Crediting contributors" part of "Commit your changes"
- contributor-guide: submit-changes: number instruction list in commit your changes
- contributor-guide: submit-changes: reword commit message instructions
- contributor-guide: submit-changes: make the Cc tag follow kernel guidelines
- contributor-guide: submit-changes: align :term:`CC` tag description
- contributor-guide: submit-changes: clarify example with Yocto bug ID
- contributor-guide: submit-changes: fix improper bold string
- libhandy: update git branch name
- python3-jinja2: upgrade to 3.1.6
- vim: upgrade to 9.1.1683
Known Issues in Yocto-4.0.31
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- N/A
Contributors to Yocto-4.0.31
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- Adam Blank
- Aleksandar Nikolic
- Antonin Godard
- Archana Polampalli
- AshishKumar Mishra
- Bruce Ashfield
- Deepesh Varatharajan
- Divya Chellam
- Gyorgy Sarvari
- Hitendra Prajapati
- João Marcos Costa
- Lee Chee Yang
- Paul Barker
- Peter Marko
- Praveen Kumar
- Quentin Schulz
- Rajeshkumar Ramasamy
- Saravanan
- Soumya Sambu
- Steve Sakoman
- Sunil Dora
- Talel BELHAJ SALEM
- Theo GAIGE
- Vijay Anusuri
- Yash Shinde
- Yogita Urade
Repositories / Downloads for Yocto-4.0.31
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
yocto-docs
- Repository Location: :yocto_git:`/yocto-docs`
- Branch: :yocto_git:`kirkstone </yocto-docs/log/?h=kirkstone>`
- Tag: :yocto_git:`yocto-4.0.31 </yocto-docs/log/?h=yocto-4.0.31>`
- Git Revision: :yocto_git:`073f3bca4c374b03398317e7f445d2440a287741 </yocto-docs/commit/?id=073f3bca4c374b03398317e7f445d2440a287741>`
- Release Artefact: yocto-docs-073f3bca4c374b03398317e7f445d2440a287741
- sha: 3bfde9b6ad310dd42817509b67f61cd69552f74b2bc5011bd20788fe96d6823b
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.31/yocto-docs-073f3bca4c374b03398317e7f445d2440a287741.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.31/yocto-docs-073f3bca4c374b03398317e7f445d2440a287741.tar.bz2
poky
- Repository Location: :yocto_git:`/poky`
- Branch: :yocto_git:`kirkstone </poky/log/?h=kirkstone>`
- Tag: :yocto_git:`yocto-4.0.31 </poky/log/?h=yocto-4.0.31>`
- Git Revision: :yocto_git:`04b39e5b7eb19498215d85c88a5fffb460fea1eb </poky/commit/?id=04b39e5b7eb19498215d85c88a5fffb460fea1eb>`
- Release Artefact: poky-04b39e5b7eb19498215d85c88a5fffb460fea1eb
- sha: 0ca18ab1ed25c0d77412ba30dbb03d74811756c7c2fe2401940f848a5e734930
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.31/poky-04b39e5b7eb19498215d85c88a5fffb460fea1eb.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.31/poky-04b39e5b7eb19498215d85c88a5fffb460fea1eb.tar.bz2
openembedded-core
- Repository Location: :oe_git:`/openembedded-core`
- Branch: :oe_git:`kirkstone </openembedded-core/log/?h=kirkstone>`
- Tag: :oe_git:`yocto-4.0.31 </openembedded-core/log/?h=yocto-4.0.31>`
- Git Revision: :oe_git:`99204008786f659ab03538cd2ae2fd23ed4164c5 </openembedded-core/commit/?id=99204008786f659ab03538cd2ae2fd23ed4164c5>`
- Release Artefact: oecore-99204008786f659ab03538cd2ae2fd23ed4164c5
- sha: aa97bf826ad217b3a5278b4ad60bef4d194f0f1ff617677cf2323d3cc4897687
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.31/oecore-99204008786f659ab03538cd2ae2fd23ed4164c5.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.31/oecore-99204008786f659ab03538cd2ae2fd23ed4164c5.tar.bz2
meta-yocto
- Repository Location: :yocto_git:`/meta-yocto`
- Branch: :yocto_git:`kirkstone </meta-yocto/log/?h=kirkstone>`
- Tag: :yocto_git:`yocto-4.0.31 </meta-yocto/log/?h=yocto-4.0.31>`
- Git Revision: :yocto_git:`3b2df00345b46479237fe0218675a818249f891c </meta-yocto/commit/?id=3b2df00345b46479237fe0218675a818249f891c>`
- Release Artefact: meta-yocto-3b2df00345b46479237fe0218675a818249f891c
- sha: 630e99e0f515bab8a316b2e32aff1352b4404f15aa087e8821b84093596a08ce
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.31/meta-yocto-3b2df00345b46479237fe0218675a818249f891c.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.31/meta-yocto-3b2df00345b46479237fe0218675a818249f891c.tar.bz2
meta-mingw
- Repository Location: :yocto_git:`/meta-mingw`
- Branch: :yocto_git:`kirkstone </meta-mingw/log/?h=kirkstone>`
- Tag: :yocto_git:`yocto-4.0.31 </meta-mingw/log/?h=yocto-4.0.31>`
- Git Revision: :yocto_git:`87c22abb1f11be430caf4372e6b833dc7d77564e </meta-mingw/commit/?id=87c22abb1f11be430caf4372e6b833dc7d77564e>`
- Release Artefact: meta-mingw-87c22abb1f11be430caf4372e6b833dc7d77564e
- sha: f0bc4873e2e0319fb9d6d6ab9b98eb3f89664d4339a167d2db6a787dd12bc1a8
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.31/meta-mingw-87c22abb1f11be430caf4372e6b833dc7d77564e.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.31/meta-mingw-87c22abb1f11be430caf4372e6b833dc7d77564e.tar.bz2
meta-gplv2
- Repository Location: :yocto_git:`/meta-gplv2`
- Branch: :yocto_git:`kirkstone </meta-gplv2/log/?h=kirkstone>`
- Tag: :yocto_git:`yocto-4.0.31 </meta-gplv2/log/?h=yocto-4.0.31>`
- Git Revision: :yocto_git:`d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a </meta-gplv2/commit/?id=d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a>`
- Release Artefact: meta-gplv2-d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a
- sha: c386f59f8a672747dc3d0be1d4234b6039273d0e57933eb87caa20f56b9cca6d
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.31/meta-gplv2-d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.31/meta-gplv2-d2f8b5cdb285b72a4ed93450f6703ca27aa42e8a.tar.bz2
bitbake
- Repository Location: :oe_git:`/bitbake`
- Branch: :oe_git:`2.0 </bitbake/log/?h=2.0>`
- Tag: :oe_git:`yocto-4.0.31 </bitbake/log/?h=yocto-4.0.31>`
- Git Revision: :oe_git:`8e2d1f8de055549b2101614d85454fcd1d0f94b2 </bitbake/commit/?id=8e2d1f8de055549b2101614d85454fcd1d0f94b2>`
- Release Artefact: bitbake-8e2d1f8de055549b2101614d85454fcd1d0f94b2
- sha: fad4e7699bae62082118e89785324b031b0af0743064caee87c91ba28549afb0
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-4.0.31/bitbake-8e2d1f8de055549b2101614d85454fcd1d0f94b2.tar.bz2
https://mirrors.edge.kernel.org/yocto/yocto/yocto-4.0.31/bitbake-8e2d1f8de055549b2101614d85454fcd1d0f94b2.tar.bz2

View File

@@ -0,0 +1,241 @@
.. SPDX-License-Identifier: CC-BY-SA-2.0-UK
Release notes for Yocto-5.0.13 (Scarthgap)
------------------------------------------
Security Fixes in Yocto-5.0.13
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- busybox: Fix :cve_nist:`2025-46394`
- cups: Fix :cve_nist:`2025-58060` and :cve_nist:`2025-58364`
- curl: Fix :cve_nist:`2025-9086`
- dpkg: Fix :cve_nist:`2025-6297`
- expat: follow-up Fix :cve_nist:`2024-8176`
- ffmpeg: Fix :cve_nist:`2025-1594`
- ffmpeg: Ignore :cve_nist:`2023-49502`, :cve_nist:`2023-50007`, :cve_nist:`2023-50008`,
:cve_nist:`2023-50009`, :cve_nist:`2023-50010`, :cve_nist:`2024-31578`, :cve_nist:`2024-31582`
and :cve_nist:`2024-31585`
- ghostscript: Fix :cve_nist:`2025-59798`, :cve_nist:`2025-59799` and :cve_nist:`2025-59800`
- glib-2.0: Fix :cve_nist:`2025-6052` and :cve_nist:`2025-7039`
- go-binary-native: Ignore :cve_nist:`2025-0913`
- go: Fix :cve_nist:`2025-4674`, :cve_nist:`2025-47906` and :cve_nist:`2025-47907`
- grub2: Fix :cve_nist:`2024-56738`
- grub2: Ignore :cve_nist:`2024-2312`
- gstreamer1.0-plugins-bad: Fix :cve_nist:`2025-3887`
- gstreamer1.0-plugins-base: Fix :cve_nist:`2025-47807`
- gstreamer1.0-plugins-base: Ignore :cve_nist:`2025-47806` and :cve_nist:`2025-47808`
- gstreamer1.0-plugins-good: Ignore :cve_nist:`2025-47183` and :cve_nist:`2025-47219`
- gstreamer1.0: Ignore :cve_nist:`2025-2759`
- libpam: Fix :cve_nist:`2024-10963`
- libxslt: Fix :cve_nist:`2025-7424`
- openssl: Fix :cve_nist:`2025-9230`, :cve_nist:`2025-9231` and :cve_nist:`2025-9232`
- pulseaudio: Ignore :cve_nist:`2024-11586`
- qemu: Ignore :cve_nist:`2024-7730`
- tiff: Fix :cve_nist:`2025-9900`
- tiff: Ignore :cve_nist:`2024-13978`, :cve_nist:`2025-8176`, :cve_nist:`2025-8177`,
:cve_nist:`2025-8534` and :cve_nist:`2025-8851`
- vim: Fix :cve_nist:`2025-9389`
- wpa-supplicant: Fix :cve_nist:`2022-37660`
Fixes in Yocto-5.0.13
~~~~~~~~~~~~~~~~~~~~~
- binutils: fix build with gcc-15
- bitbake: Use a "fork" multiprocessing context
- bitbake: bitbake: Bump version to 2.8.1
- build-appliance-image: Update to scarthgap head revision
- buildtools-tarball: fix unbound variable issues under 'set -u'
- cmake: fix build with gcc-15 on host
- conf/bitbake.conf: use gnu mirror instead of main server
- contributor-guide: submit-changes: align :term:`CC` tag description
- contributor-guide: submit-changes: clarify example with Yocto bug ID
- contributor-guide: submit-changes: fix improper bold string
- contributor-guide: submit-changes: make "Crediting contributors" part of "Commit your changes"
- contributor-guide: submit-changes: make the Cc tag follow kernel guidelines
- contributor-guide: submit-changes: number instruction list in commit your changes
- contributor-guide: submit-changes: reword commit message instructions
- cpio: Pin to use C17 std
- cups: upgrade to 2.4.11
- curl: update :term:`CVE_STATUS` for :cve_nist:`2025-5025`
- dbus-glib: fix build with gcc-15
- default-distrovars.inc: Fix CONNECTIVITY_CHECK_URIS redirect issue
- dev-manual/building.rst: add note about externalsrc variables absolute paths
- dev-manual/security-subjects.rst: update mailing lists
- elfutils: fix build with gcc-15
- examples: genl: fix wrong attribute size
- expect: Fix build with GCC 15
- expect: Revert "expect-native: fix do_compile failure with gcc-14"
- expect: cleanup do_install
- expect: don't run aclocal in do_configure
- expect: fix native build with GCC 15
- expect: update code for Tcl channel implementation
- ffmpeg: upgrade to 6.1.3
- gdbm: Use C11 standard
- git: fix build with gcc-15 on host
- gmp: Fix build with GCC15/C23
- gmp: Fix build with older gcc versions
- kernel-dev/common.rst: fix the in-tree defconfig description
- lib/oe/utils: use multiprocessing from bb
- libarchive: patch regression of patch for :cve_nist:`2025-5918`
- libgpg-error: fix build with gcc-15
- libtirpc: Fix build with gcc-15/C23
- license.py: avoid deprecated ast.Str
- llvm: fix build with gcc-15
- llvm: update to 18.1.8
- m4: Stick to C17 standard
- migration-guides: add release notes for 4.0.29 5.0.12
- ncurses: Pin to C17 standard
- oeqa/sdk/cases/buildcpio.py: use gnu mirror instead of main server
- openssl: upgrade to 3.2.6
- p11-kit: backport fix for handle :term:`USE_NLS` from master
- pkgconfig: fix build with gcc-15
- poky.conf: bump version for 5.0.13
- pulseaudio: Add audio group explicitly
- ref-manual/structure: document the auto.conf file
- ref-manual/variables.rst: expand :term:`IMAGE_OVERHEAD_FACTOR` glossary entry
- ref-manual/variables.rst: fix the description of :term:`KBUILD_DEFCONFIG` :term:`STAGING_DIR`
- rpm: keep leading "/" from sed operation
- ruby-ptest: some ptest fixes
- runqemu: fix special characters bug
- rust-llvm: fix build with gcc-15
- sanity.conf: Update minimum bitbake version to 2.8.1
- scripts/install-buildtools: Update to 5.0.12
- sdk: The main in the C example should return an int
- selftest/cases/meta_ide.py: use use gnu mirror instead of main server
- shared-mime-info: Handle :term:`USE_NLS`
- sudo: remove devtool FIXME comment
- systemd: backport fix for handle :term:`USE_NLS` from master
- systemtap: Fix task_work_cancel build
- test-manual/yocto-project-compatible.rst: fix a typo
- test-manual: update runtime-testing Exporting Tests section
- unifdef: Don't use C23 constexpr keyword
- unzip: Fix build with GCC-15
- util-linux: use ${B} instead of ${WORKDIR}/build, to fix building under devtool
- vim: upgrade to 9.1.1683
- yocto-uninative: Update to 4.9 for glibc 2.42 GCC 15.1
Known Issues in Yocto-5.0.13
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- N/A
Contributors to Yocto-5.0.13
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Thanks to the following people who contributed to this release:
- Adam Blank
- Adrian Freihofer
- Aleksandar Nikolic
- Antonin Godard
- Archana Polampalli
- AshishKumar Mishra
- Barne Carstensen
- Chris Laplante
- Deepak Rathore
- Divya Chellam
- Gyorgy Sarvari
- Haixiao Yan
- Hitendra Prajapati
- Hongxu Jia
- Jan Vermaete
- Jiaying Song
- Jinfeng Wang
- Joao Marcos Costa
- Joshua Watt
- Khem Raj
- Kyungjik Min
- Lee Chee Yang
- Libo Chen
- Martin Jansa
- Michael Halstead
- Nitin Wankhade
- Peter Marko
- Philip Lorenz
- Praveen Kumar
- Quentin Schulz
- Ross Burton
- Stanislav Vovk
- Steve Sakoman
- Talel BELHAJ SALEM
- Vijay Anusuri
- Vrushti Dabhi
- Yogita Urade
Repositories / Downloads for Yocto-5.0.13
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
yocto-docs
- Repository Location: :yocto_git:`/yocto-docs`
- Branch: :yocto_git:`scarthgap </yocto-docs/log/?h=scarthgap>`
- Tag: :yocto_git:`yocto-5.0.13 </yocto-docs/log/?h=yocto-5.0.13>`
- Git Revision: :yocto_git:`6f086fd3d9dbbb0c80f6c3e89b8df4fed422e79a </yocto-docs/commit/?id=6f086fd3d9dbbb0c80f6c3e89b8df4fed422e79a>`
- Release Artefact: yocto-docs-6f086fd3d9dbbb0c80f6c3e89b8df4fed422e79a
- sha: 454601d8b6034268212f74ca689ed360b08f7a4c7de5df726aa3706586ca4351
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.13/yocto-docs-6f086fd3d9dbbb0c80f6c3e89b8df4fed422e79a.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.13/yocto-docs-6f086fd3d9dbbb0c80f6c3e89b8df4fed422e79a.tar.bz2
poky
- Repository Location: :yocto_git:`/poky`
- Branch: :yocto_git:`scarthgap </poky/log/?h=scarthgap>`
- Tag: :yocto_git:`yocto-5.0.13 </poky/log/?h=yocto-5.0.13>`
- Git Revision: :yocto_git:`f16cffd030d21d12dd57bb95cfc310bda41f8a1f </poky/commit/?id=f16cffd030d21d12dd57bb95cfc310bda41f8a1f>`
- Release Artefact: poky-f16cffd030d21d12dd57bb95cfc310bda41f8a1f
- sha: 1367e43907f5ffa725f3afb019cd7ca07de21f13e5e73a1f5d1808989ae6ed2a
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.13/poky-f16cffd030d21d12dd57bb95cfc310bda41f8a1f.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.13/poky-f16cffd030d21d12dd57bb95cfc310bda41f8a1f.tar.bz2
openembedded-core
- Repository Location: :oe_git:`/openembedded-core`
- Branch: :oe_git:`scarthgap </openembedded-core/log/?h=scarthgap>`
- Tag: :oe_git:`yocto-5.0.13 </openembedded-core/log/?h=yocto-5.0.13>`
- Git Revision: :oe_git:`7af6b75221d5703ba5bf43c7cd9f1e7a2e0ed20b </openembedded-core/commit/?id=7af6b75221d5703ba5bf43c7cd9f1e7a2e0ed20b>`
- Release Artefact: oecore-7af6b75221d5703ba5bf43c7cd9f1e7a2e0ed20b
- sha: 4dcf636ec4a7b38b47a24e9cb3345b385bc126bb19620bf6af773bf292fef6b2
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.13/oecore-7af6b75221d5703ba5bf43c7cd9f1e7a2e0ed20b.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.13/oecore-7af6b75221d5703ba5bf43c7cd9f1e7a2e0ed20b.tar.bz2
meta-yocto
- Repository Location: :yocto_git:`/meta-yocto`
- Branch: :yocto_git:`scarthgap </meta-yocto/log/?h=scarthgap>`
- Tag: :yocto_git:`yocto-5.0.13 </meta-yocto/log/?h=yocto-5.0.13>`
- Git Revision: :yocto_git:`3ff7ca786732390cd56ae92ff4a43aba46a1bf2e </meta-yocto/commit/?id=3ff7ca786732390cd56ae92ff4a43aba46a1bf2e>`
- Release Artefact: meta-yocto-3ff7ca786732390cd56ae92ff4a43aba46a1bf2e
- sha: 8efbaeab49dc3e1c4b67ff8d5801df1b05204c2255d18cff9a6857769ae33b23
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.13/meta-yocto-3ff7ca786732390cd56ae92ff4a43aba46a1bf2e.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.13/meta-yocto-3ff7ca786732390cd56ae92ff4a43aba46a1bf2e.tar.bz2
meta-mingw
- Repository Location: :yocto_git:`/meta-mingw`
- Branch: :yocto_git:`scarthgap </meta-mingw/log/?h=scarthgap>`
- Tag: :yocto_git:`yocto-5.0.13 </meta-mingw/log/?h=yocto-5.0.13>`
- Git Revision: :yocto_git:`bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f </meta-mingw/commit/?id=bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f>`
- Release Artefact: meta-mingw-bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f
- sha: ab073def6487f237ac125d239b3739bf02415270959546b6b287778664f0ae65
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.13/meta-mingw-bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.13/meta-mingw-bd9fef71ec005be3c3a6d7f8b99d8116daf70c4f.tar.bz2
bitbake
- Repository Location: :oe_git:`/bitbake`
- Branch: :oe_git:`2.8 </bitbake/log/?h=2.8>`
- Tag: :oe_git:`yocto-5.0.13 </bitbake/log/?h=yocto-5.0.13>`
- Git Revision: :oe_git:`1c9ec1ffde75809de34c10d3ec2b40d84d258cb4 </bitbake/commit/?id=1c9ec1ffde75809de34c10d3ec2b40d84d258cb4>`
- Release Artefact: bitbake-1c9ec1ffde75809de34c10d3ec2b40d84d258cb4
- sha: 98bf54fa3abe237b73a93b1e33842a429209371fca6e409c258a441987879d16
- Download Locations:
https://downloads.yoctoproject.org/releases/yocto/yocto-5.0.13/bitbake-1c9ec1ffde75809de34c10d3ec2b40d84d258cb4.tar.bz2
https://mirrors.kernel.org/yocto/yocto/yocto-5.0.13/bitbake-1c9ec1ffde75809de34c10d3ec2b40d84d258cb4.tar.bz2

Binary file not shown.

Before

Width:  |  Height:  |  Size: 20 KiB

View File

@@ -0,0 +1,172 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="164.765mm"
height="72.988113mm"
viewBox="0 0 164.765 72.988114"
version="1.1"
id="svg1"
xml:space="preserve"
inkscape:version="1.4.2 (ebf0e940d0, 2025-05-08)"
sodipodi:docname="key-dev-elements.svg"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns="http://www.w3.org/2000/svg"
xmlns:svg="http://www.w3.org/2000/svg"><sodipodi:namedview
id="namedview1"
pagecolor="#ffffff"
bordercolor="#000000"
borderopacity="0.25"
inkscape:showpageshadow="false"
inkscape:pageopacity="0.0"
inkscape:pagecheckerboard="0"
inkscape:deskcolor="#d1d1d1"
inkscape:document-units="mm"
inkscape:zoom="1"
inkscape:cx="341.5"
inkscape:cy="-31.5"
inkscape:window-width="2560"
inkscape:window-height="1440"
inkscape:window-x="0"
inkscape:window-y="0"
inkscape:window-maximized="0"
inkscape:current-layer="layer2"
showborder="false"
borderlayer="false"
inkscape:antialias-rendering="true"
showguides="true" /><defs
id="defs1" /><g
inkscape:groupmode="layer"
id="layer2"
inkscape:label="Layer "
style="display:inline"
transform="translate(-20.664242,-129.6793)"><rect
style="display:inline;fill:#f1e9cc;fill-opacity:1;stroke:#6d8eb4;stroke-width:0.653;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:7.4;stroke-opacity:1;paint-order:fill markers stroke"
id="rect1"
width="164.112"
height="54.273098"
x="20.990742"
y="130.0058"
ry="0"
inkscape:label="yp-rect" /><rect
style="display:inline;fill:#f3d770;fill-opacity:1;stroke:#6d8eb4;stroke-width:0.653;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:7.4;stroke-opacity:1;paint-order:fill markers stroke"
id="rect2"
width="101.45864"
height="41.151588"
x="28.1292"
y="137.10953"
inkscape:label="poky-rect" /><rect
style="display:inline;fill:#c0ebf5;fill-opacity:1;stroke:#6d8eb4;stroke-width:0.653;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:7.4;stroke-opacity:1;paint-order:fill markers stroke"
id="rect3"
width="50.652737"
height="53.04562"
x="35.516178"
y="149.29529"
inkscape:label="oe-rect" /><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:4.23333px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Bold';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;writing-mode:lr-tb;direction:ltr;text-anchor:start;white-space:pre;inline-size:46.7487;display:inline;fill:#000000;fill-opacity:1;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:7.4;stroke-dasharray:none;stroke-opacity:1;paint-order:fill markers stroke"
x="136.38763"
y="137.69727"
id="text3"
inkscape:label="poky-title"
transform="matrix(0.90889596,0,0,0.81399719,-26.072941,39.399474)"><tspan
x="136.38763"
y="137.69727"
id="tspan2">Poky</tspan></text><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:4.23333px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Bold';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;writing-mode:lr-tb;direction:ltr;text-anchor:start;white-space:pre;inline-size:46.7487;display:inline;fill:#000000;fill-opacity:1;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:7.4;stroke-dasharray:none;stroke-opacity:1;paint-order:fill markers stroke"
x="136.38763"
y="137.69727"
id="text3-8"
inkscape:label="oe-title"
transform="matrix(0.90889596,0,0,0.81399719,-78.327995,83.175189)"><tspan
x="136.38763"
y="137.69727"
id="tspan4">OpenEmbedded</tspan></text><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:4.23333px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Bold';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;writing-mode:lr-tb;direction:ltr;text-anchor:start;white-space:pre;inline-size:46.7487;display:inline;fill:#000000;fill-opacity:1;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:7.4;stroke-dasharray:none;stroke-opacity:1;paint-order:fill markers stroke"
x="136.38763"
y="137.69727"
id="text3-0"
inkscape:label="yp-title"
transform="matrix(0.8469291,0,0,0.81399719,21.497595,28.033837)"><tspan
x="136.38763"
y="137.69727"
id="tspan5">YOCTO PROJECT (YP)</tspan></text><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.98347px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;writing-mode:lr-tb;direction:ltr;text-anchor:start;display:inline;fill:#000000;fill-opacity:1;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:7.4;stroke-dasharray:none;stroke-opacity:1;paint-order:fill markers stroke"
x="137.19444"
y="150.50006"
id="text4"
transform="scale(1.0050579,0.9949676)"
inkscape:label="yp-text"><tspan
sodipodi:role="line"
id="tspan3"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.98347px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;stroke-width:0"
x="137.19444"
y="150.50006">Umbrella Open Source Project</tspan><tspan
sodipodi:role="line"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.98347px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;stroke-width:0"
x="137.19444"
y="154.2294"
id="tspan6">that Builds and Maintains</tspan><tspan
sodipodi:role="line"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.98347px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;stroke-width:0"
x="137.19444"
y="157.95874"
id="tspan7">Validated Open Source Tools and</tspan><tspan
sodipodi:role="line"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.98347px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;stroke-width:0"
x="137.19444"
y="161.68808"
id="tspan8">Components Associated with</tspan><tspan
sodipodi:role="line"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.98347px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;stroke-width:0"
x="137.19444"
y="165.4174"
id="tspan9">Embedded Linux</tspan></text><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.97078px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;writing-mode:lr-tb;direction:ltr;text-anchor:start;display:inline;fill:#000000;fill-opacity:1;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:7.4;stroke-dasharray:none;stroke-opacity:1;paint-order:fill markers stroke"
x="90.582634"
y="159.10139"
id="text10"
transform="scale(1.0018079,0.9981954)"
inkscape:label="poky-text"><tspan
sodipodi:role="line"
id="tspan10"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.97078px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;stroke-width:0"
x="90.582634"
y="159.10139">Yocto Project Open</tspan><tspan
sodipodi:role="line"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.97078px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;stroke-width:0"
x="90.582634"
y="162.81487"
id="tspan11">Source Reference</tspan><tspan
sodipodi:role="line"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.97078px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;stroke-width:0"
x="90.582634"
y="166.52835"
id="tspan12">Embedded Distribution</tspan></text><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:3.01677px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;text-align:start;writing-mode:lr-tb;direction:ltr;text-anchor:start;display:inline;fill:#000000;fill-opacity:1;stroke:#000000;stroke-width:0;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:7.4;stroke-dasharray:none;stroke-opacity:1;paint-order:fill markers stroke"
x="40.36692"
y="160.98824"
id="text13"
transform="scale(0.99784993,1.0021547)"
inkscape:label="oe-text"><tspan
sodipodi:role="line"
id="tspan13"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:3.01677px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;stroke-width:0"
x="40.36692"
y="160.98824">Open Source Build Engine</tspan><tspan
sodipodi:role="line"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:3.01677px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;stroke-width:0"
x="40.36692"
y="164.7592"
id="tspan14">and YP-Compatible Metadata</tspan><tspan
sodipodi:role="line"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:3.01677px;font-family:'Liberation Sans';-inkscape-font-specification:'Liberation Sans, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;stroke-width:0"
x="40.36692"
y="168.53017"
id="tspan15">for Embedded Linux</tspan></text></g></svg>

After

Width:  |  Height:  |  Size: 12 KiB

View File

@@ -23,7 +23,7 @@ comes to delivering embedded software stacks. The project allows
software customizations and build interchange for multiple hardware
platforms as well as software stacks that can be maintained and scaled.
.. image:: figures/key-dev-elements.png
.. image:: svg/key-dev-elements.*
:width: 100%
For further introductory information on the Yocto Project, you might be
@@ -172,11 +172,12 @@ Here are challenges you might encounter when developing using the Yocto Project:
changes on the development system within the BitBake environment and
then deploying only the updated packages to the target.
The Yocto Project :term:`OpenEmbedded Build System`
produces packages
in standard formats (i.e. RPM, DEB, IPK, and TAR). You can deploy
these packages into the running system on the target by using
utilities on the target such as ``rpm`` or ``ipk``.
The Yocto Project :term:`OpenEmbedded Build System` produces packages
in standard formats (i.e. RPM, DEB and/or IPK). If you included the
runtime package management feature in your image, you can deploy
these packages into the running system on the target by using the
corresponding utilities on the target such as
``rpm``/``dnf``, ``dpkg``/``apt`` or ``opkg``.
- *Initial Build Times Can be Significant:* Long initial build times
are unfortunately unavoidable due to the large number of packages

View File

@@ -355,8 +355,12 @@ file for details about how to enable this mechanism in your configuration
file, how to disable it for specific recipes, and how to share ``ccache``
files between builds.
However, using the class can lead to unexpected side-effects. Thus, using
this class is not recommended.
Recipes can also explicitly disable `Ccache` support even when the
:ref:`ref-classes-ccache` class is enabled, by setting the
:term:`CCACHE_DISABLE` variable to "1".
Using the :ref:`ref-classes-ccache` class can lead to unexpected side-effects.
Using this class is not recommended.
.. _ref-classes-chrpath:
@@ -909,6 +913,14 @@ software that uses the GNU ``gettext`` internationalization and localization
system. All recipes building software that use ``gettext`` should inherit this
class.
This class will configure recipes to build translations *unless*:
- the :term:`USE_NLS` variable is set to ``no``, or
- the :term:`INHIBIT_DEFAULT_DEPS` variable is set and the recipe inheriting
the :ref:`ref-classes-gettext` class does not also inherit the
:ref:`ref-classes-cross-canadian` class.
.. _ref-classes-github-releases:
``github-releases``
@@ -2692,6 +2704,25 @@ The :ref:`ref-classes-recipe_sanity` class checks for the presence of any host s
recipe prerequisites that might affect the build (e.g. variables that
are set or software that is present).
.. _ref-classes-relative_symlinks:
``relative_symlinks``
=====================
The :ref:`ref-classes-relative_symlinks` class walks the symbolic links in the
:term:`D` directory and replaces links pointing to absolute paths to relative
paths. This is occasionally used in some recipes that create wrong symbolic
links when their :ref:`ref-classes-native` version is built, and/or would cause
breakage in the :ref:`overview-manual/concepts:shared state cache`.
For example, if the following symbolic link is found in :term:`D`::
/usr/bin/foo -> /sbin/bar
It is replaced by::
/usr/bin/foo -> ../../sbin/bar
.. _ref-classes-relocatable:
``relocatable``
@@ -3363,22 +3394,51 @@ imitates.
``uninative``
=============
Attempts to isolate the build system from the host distribution's C
library in order to make re-use of native shared state artifacts across
different host distributions practical. With this class enabled, a
tarball containing a pre-built C library is downloaded at the start of
the build. In the Poky reference distribution this is enabled by default
through ``meta/conf/distro/include/yocto-uninative.inc``. Other
distributions that do not derive from poky can also
"``require conf/distro/include/yocto-uninative.inc``" to use this.
Alternatively if you prefer, you can build the uninative-tarball recipe
yourself, publish the resulting tarball (e.g. via HTTP) and set
``UNINATIVE_URL`` and ``UNINATIVE_CHECKSUM`` appropriately. For an
example, see the ``meta/conf/distro/include/yocto-uninative.inc``.
The :ref:`ref-classes-uninative` class allows binaries to run on systems with
older or newer :wikipedia:`Glibc <Glibc>` versions. This means
:ref:`ref-classes-native` recipe :ref:`overview-manual/concepts:shared state
cache` can be shared among different host distributions of different versions,
i.e. the :ref:`overview-manual/concepts:shared state cache` is "universal".
The :ref:`ref-classes-uninative` class is also used unconditionally by the extensible
SDK. When building the extensible SDK, ``uninative-tarball`` is built
and the resulting tarball is included within the SDK.
To allow this to work, the dynamic loader is changed to our own :manpage:`ld.so
<ld.so.8>` when binaries are compiled using the
``--dynamic-linker`` option. This means when the binary is executed, it finds
our own :manpage:`ld.so <ld.so.8>` and that loader has a modified search path
which finds a newer Glibc version.
The linking of the binaries is not changed at link time since the
headers on the system wouldn't match the newer Glibc and this causes
obtuse failures. Changing the loader is effectively the same as if the
system had a Glibc upgrade after the binary was compiled, so it is a
mechanism supported by upstream.
One caveat to this approach is that the uninative Glibc binary must be
equal to or newer in version to the versions on all the systems using
the common :ref:`overview-manual/concepts:shared state cache`. This is why
:ref:`ref-classes-uninative` is regularly changed on the development and stable
branches.
Another potential issue is static linking: static libraries created on
a system with a new Glibc version may have symbols not present in older
versions, which would then fail during linking on older systems. This
is one reason we don't use static linking for our :ref:`ref-classes-native`
binaries.
With this class enabled, a tarball containing a pre-built C library is
downloaded at the start of the build. In the Poky reference distribution this is
enabled by default through :oe_git:`meta/conf/distro/include/yocto-uninative.inc
</openembedded-core/tree/meta/conf/distro/include/yocto-uninative.inc>`. Other distributions that do
not derive from Poky can also "``require conf/distro/include/yocto-uninative.inc``"
to use this. Alternatively if you prefer, you can build the uninative-tarball
recipe yourself, publish the resulting tarball (e.g. via HTTP) and set
:term:`UNINATIVE_URL` and :term:`UNINATIVE_CHECKSUM` appropriately. For an
example, see :oe_git:`meta/conf/distro/include/yocto-uninative.inc
</openembedded-core/tree/meta/conf/distro/include/yocto-uninative.inc>`.
The :ref:`ref-classes-uninative` class is also used unconditionally by the
:doc:`extensible SDK </sdk-manual/extensible>`. When building the extensible
SDK, ``uninative-tarball`` is built and the resulting tarball is included within
the SDK.
.. _ref-classes-update-alternatives:

View File

@@ -62,7 +62,8 @@ codename are likely to be compatible and thus work together.
Releases are given a nominal release version as well but the codename is
used in repositories for this reason. You can find information on Yocto
Project releases and codenames at :yocto_wiki:`/Releases`.
Project releases and codenames in the :yocto_home:`Releases page
</development/releases/>`.
Our :doc:`/migration-guides/index` detail how to migrate from one release of
the Yocto Project to the next.

View File

@@ -1458,6 +1458,11 @@ system and gives an overview of their function and contents.
:term:`CC`
The minimal command and arguments used to run the C compiler.
:term:`CCACHE_DISABLE`
When inheriting the :ref:`ref-classes-ccache` class, the
:term:`CCACHE_DISABLE` variable can be set to "1" in a recipe to disable
`Ccache` support. This is useful when the recipe is known to not support it.
:term:`CCLD`
The minimal command and arguments used to run the linker when the C
compiler is being used as the linker.
@@ -5224,7 +5229,7 @@ system and gives an overview of their function and contents.
information on how this variable is used.
:term:`LAYERDEPENDS`
Lists the layers, separated by spaces, on which this recipe depends.
Lists the layers, separated by spaces, on which this layer depends.
Optionally, you can specify a specific layer version for a dependency
by adding it to the end of the layer name. Here is an example::
@@ -6167,8 +6172,8 @@ system and gives an overview of their function and contents.
.. note::
An easy way to see what overrides apply is to search for :term:`OVERRIDES`
in the output of the ``bitbake -e`` command. See the
An easy way to see what overrides apply is to run the command
``bitbake-getvar -r myrecipe OVERRIDES``. See the
":ref:`dev-manual/debugging:viewing variable values`" section in the Yocto
Project Development Tasks Manual for more information.
@@ -7438,6 +7443,16 @@ system and gives an overview of their function and contents.
:term:`REPODIR`
See :term:`bitbake:REPODIR` in the BitBake manual.
:term:`REQUIRED_COMBINED_FEATURES`
When inheriting the :ref:`ref-classes-features_check` class, this variable
identifies combined features (the intersection of :term:`MACHINE_FEATURES`
and :term:`DISTRO_FEATURES`) that must exist in the current configuration
in order for the :term:`OpenEmbedded Build System` to build the recipe. In
other words, if the :term:`REQUIRED_COMBINED_FEATURES` variable lists a
feature that does not appear in :term:`COMBINED_FEATURES` within the
current configuration, then the recipe will be skipped, and if the build
system attempts to build the recipe then an error will be triggered.
:term:`REQUIRED_DISTRO_FEATURES`
When inheriting the :ref:`ref-classes-features_check`
class, this variable identifies distribution features that must exist
@@ -7448,6 +7463,32 @@ system and gives an overview of their function and contents.
the recipe will be skipped, and if the build system attempts to build
the recipe then an error will be triggered.
:term:`REQUIRED_IMAGE_FEATURES`
When inheriting the :ref:`ref-classes-features_check` class, this variable
identifies image features that must exist in the current
configuration in order for the :term:`OpenEmbedded Build System` to build
the recipe. In other words, if the :term:`REQUIRED_IMAGE_FEATURES` variable
lists a feature that does not appear in :term:`IMAGE_FEATURES` within the
current configuration, then the recipe will be skipped, and if the build
system attempts to build the recipe then an error will be triggered.
Compared to other ``REQUIRED_*_FEATURES`` variables, the
:term:`REQUIRED_IMAGE_FEATURES` varible only targets image recipes, as the
:term:`IMAGE_FEATURES` variable is handled by the :ref:`ref-classes-core-image`
class). However, the :term:`REQUIRED_IMAGE_FEATURES` varible can also be
set from a :term:`Configuration File`, such as a distro
configuration file, if the list of required image features should apply to
all images using this :term:`DISTRO`.
:term:`REQUIRED_MACHINE_FEATURES`
When inheriting the :ref:`ref-classes-features_check` class, this variable
identifies :term:`MACHINE_FEATURES` that must exist in the current
configuration in order for the :term:`OpenEmbedded Build System` to build
the recipe. In other words, if the :term:`REQUIRED_MACHINE_FEATURES` variable
lists a feature that does not appear in :term:`MACHINE_FEATURES` within the
current configuration, then the recipe will be skipped, and if the build
system attempts to build the recipe then an error will be triggered.
:term:`REQUIRED_VERSION`
If there are multiple versions of a recipe available, this variable
determines which version should be given preference.
@@ -10178,6 +10219,22 @@ system and gives an overview of their function and contents.
passes and uses "all" for the target during the U-Boot building
process.
:term:`UNINATIVE_CHECKSUM`
When inheriting the :ref:`ref-classes-uninative` class, the
:term:`UNINATIVE_CHECKSUM` variable flags contain the checksums of the
uninative tarball as specified by the :term:`UNINATIVE_URL` variable.
There should be one checksum per tarballs published at
:term:`UNINATIVE_URL`, which match architectures. For example::
UNINATIVE_CHECKSUM[aarch64] ?= "812045d826b7fda88944055e8526b95a5a9440bfef608d5b53fd52faab49bf85"
UNINATIVE_CHECKSUM[i686] ?= "5cc28efd0c15a75de4bcb147c6cce65f1c1c9d442173a220f08427f40a3ffa09"
UNINATIVE_CHECKSUM[x86_64] ?= "4c03d1ed2b7b4e823aca4a1a23d8f2e322f1770fc10e859adcede5777aff4f3a"
:term:`UNINATIVE_URL`
When inheriting the :ref:`ref-classes-uninative` class, the
:term:`UNINATIVE_URL` variable contains the URL where the uninative
tarballs are published.
:term:`UNKNOWN_CONFIGURE_OPT_IGNORE`
Specifies a list of options that, if reported by the configure script
as being invalid, should not generate a warning during the
@@ -10268,6 +10325,18 @@ system and gives an overview of their function and contents.
the Yocto Project Development Tasks Manual for information on how to
use this variable.
:term:`USE_NLS`
Determine if language translations should be built for recipes that can
build them. This variable can be equal to:
- ``yes``: translations are enabled.
- ``no``: translation are disabled.
Recipes can use the value of this variable to enable language
translations in their build. Classes such as :ref:`ref-classes-gettext`
use the value of this variable to enable :wikipedia:`Gettext <Gettext>`
support.
:term:`USE_VT`
When using
:ref:`SysVinit <dev-manual/new-recipe:enabling system services>`,

View File

@@ -113,7 +113,7 @@ If ``OEQA_DEBUGGING_SAVED_OUTPUT`` is set, any differing packages will be saved
here. The test is also able to run the ``diffoscope`` command on the output to
generate HTML files showing the differences between the packages, to aid
debugging. On the Autobuilder, these appear under
https://autobuilder.yocto.io/pub/repro-fail/ in the form ``oe-reproducible +
https://valkyrie.yocto.io/pub/repro-fail/ in the form ``oe-reproducible +
<date> + <random ID>``, e.g. ``oe-reproducible-20200202-1lm8o1th``.
The project's current reproducibility status can be seen at

View File

@@ -69,7 +69,7 @@ box to "generate an email to QA" is also checked.
When the build completes, an email is sent out using the ``send-qa-email``
script in the :yocto_git:`yocto-autobuilder-helper </yocto-autobuilder-helper>`
repository to the list of people configured for that release. Release builds
are placed into a directory in https://autobuilder.yocto.io/pub/releases on the
are placed into a directory in https://valkyrie.yocto.io/pub/releases on the
Autobuilder which is included in the email. The process from here is
more manual and control is effectively passed to release engineering.
The next steps include:

View File

@@ -1,6 +1,6 @@
DISTRO = "poky"
DISTRO_NAME = "Poky (Yocto Project Reference Distro)"
DISTRO_VERSION = "5.0.13"
DISTRO_VERSION = "5.0.15"
DISTRO_CODENAME = "scarthgap"
SDK_VENDOR = "-pokysdk"
SDK_VERSION = "${@d.getVar('DISTRO_VERSION').replace('snapshot-${METADATA_REVISION}', 'snapshot')}"

View File

@@ -520,8 +520,8 @@ python () {
bb.fatal('This recipe does not have the LICENSE field set (%s)' % pn)
if bb.data.inherits_class('license', d):
check_license_format(d)
unmatched_license_flags = check_license_flags(d)
oe.license.check_license_format(d)
unmatched_license_flags = oe.license.check_license_flags(d)
if unmatched_license_flags:
for unmatched in unmatched_license_flags:
message = "Has a restricted license '%s' which is not listed in your LICENSE_FLAGS_ACCEPTED." % unmatched
@@ -565,37 +565,10 @@ python () {
bad_licenses = (d.getVar('INCOMPATIBLE_LICENSE') or "").split()
check_license = False if pn.startswith("nativesdk-") else True
for t in ["-native", "-cross-${TARGET_ARCH}", "-cross-initial-${TARGET_ARCH}",
"-crosssdk-${SDK_SYS}", "-crosssdk-initial-${SDK_SYS}",
"-cross-canadian-${TRANSLATED_TARGET_ARCH}"]:
if pn.endswith(d.expand(t)):
check_license = False
if pn.startswith("gcc-source-"):
check_license = False
if check_license and bad_licenses:
bad_licenses = expand_wildcard_licenses(d, bad_licenses)
exceptions = (d.getVar("INCOMPATIBLE_LICENSE_EXCEPTIONS") or "").split()
for lic_exception in exceptions:
if ":" in lic_exception:
lic_exception = lic_exception.split(":")[1]
if lic_exception in oe.license.obsolete_license_list():
bb.fatal("Obsolete license %s used in INCOMPATIBLE_LICENSE_EXCEPTIONS" % lic_exception)
pkgs = d.getVar('PACKAGES').split()
skipped_pkgs = {}
unskipped_pkgs = []
for pkg in pkgs:
remaining_bad_licenses = oe.license.apply_pkg_license_exception(pkg, bad_licenses, exceptions)
incompatible_lic = incompatible_license(d, remaining_bad_licenses, pkg)
if incompatible_lic:
skipped_pkgs[pkg] = incompatible_lic
else:
unskipped_pkgs.append(pkg)
pkgs = d.getVar('PACKAGES').split()
if pkgs:
skipped_pkgs = oe.license.skip_incompatible_package_licenses(d, pkgs)
unskipped_pkgs = [p for p in pkgs if p not in skipped_pkgs]
if unskipped_pkgs:
for pkg in skipped_pkgs:
@@ -604,7 +577,7 @@ python () {
for pkg in unskipped_pkgs:
bb.debug(1, "Including the package %s" % pkg)
else:
incompatible_lic = incompatible_license(d, bad_licenses)
incompatible_lic = oe.license.incompatible_license(d, bad_licenses)
for pkg in skipped_pkgs:
incompatible_lic += skipped_pkgs[pkg]
incompatible_lic = sorted(list(set(incompatible_lic)))

View File

@@ -255,171 +255,6 @@ def find_license_files(d):
return lic_files_paths
def return_spdx(d, license):
"""
This function returns the spdx mapping of a license if it exists.
"""
return d.getVarFlag('SPDXLICENSEMAP', license)
def canonical_license(d, license):
"""
Return the canonical (SPDX) form of the license if available (so GPLv3
becomes GPL-3.0-only) or the passed license if there is no canonical form.
"""
return d.getVarFlag('SPDXLICENSEMAP', license) or license
def expand_wildcard_licenses(d, wildcard_licenses):
"""
There are some common wildcard values users may want to use. Support them
here.
"""
licenses = set(wildcard_licenses)
mapping = {
"AGPL-3.0*" : ["AGPL-3.0-only", "AGPL-3.0-or-later"],
"GPL-3.0*" : ["GPL-3.0-only", "GPL-3.0-or-later"],
"LGPL-3.0*" : ["LGPL-3.0-only", "LGPL-3.0-or-later"],
}
for k in mapping:
if k in wildcard_licenses:
licenses.remove(k)
for item in mapping[k]:
licenses.add(item)
for l in licenses:
if l in oe.license.obsolete_license_list():
bb.fatal("Error, %s is an obsolete license, please use an SPDX reference in INCOMPATIBLE_LICENSE" % l)
if "*" in l:
bb.fatal("Error, %s is an invalid license wildcard entry" % l)
return list(licenses)
def incompatible_license_contains(license, truevalue, falsevalue, d):
license = canonical_license(d, license)
bad_licenses = (d.getVar('INCOMPATIBLE_LICENSE') or "").split()
bad_licenses = expand_wildcard_licenses(d, bad_licenses)
return truevalue if license in bad_licenses else falsevalue
def incompatible_pkg_license(d, dont_want_licenses, license):
# Handles an "or" or two license sets provided by
# flattened_licenses(), pick one that works if possible.
def choose_lic_set(a, b):
return a if all(oe.license.license_ok(canonical_license(d, lic),
dont_want_licenses) for lic in a) else b
try:
licenses = oe.license.flattened_licenses(license, choose_lic_set)
except oe.license.LicenseError as exc:
bb.fatal('%s: %s' % (d.getVar('P'), exc))
incompatible_lic = []
for l in licenses:
license = canonical_license(d, l)
if not oe.license.license_ok(license, dont_want_licenses):
incompatible_lic.append(license)
return sorted(incompatible_lic)
def incompatible_license(d, dont_want_licenses, package=None):
"""
This function checks if a recipe has only incompatible licenses. It also
take into consideration 'or' operand. dont_want_licenses should be passed
as canonical (SPDX) names.
"""
import oe.license
license = d.getVar("LICENSE:%s" % package) if package else None
if not license:
license = d.getVar('LICENSE')
return incompatible_pkg_license(d, dont_want_licenses, license)
def check_license_flags(d):
"""
This function checks if a recipe has any LICENSE_FLAGS that
aren't acceptable.
If it does, it returns the all LICENSE_FLAGS missing from the list
of acceptable license flags, or all of the LICENSE_FLAGS if there
is no list of acceptable flags.
If everything is is acceptable, it returns None.
"""
def license_flag_matches(flag, acceptlist, pn):
"""
Return True if flag matches something in acceptlist, None if not.
Before we test a flag against the acceptlist, we append _${PN}
to it. We then try to match that string against the
acceptlist. This covers the normal case, where we expect
LICENSE_FLAGS to be a simple string like 'commercial', which
the user typically matches exactly in the acceptlist by
explicitly appending the package name e.g 'commercial_foo'.
If we fail the match however, we then split the flag across
'_' and append each fragment and test until we either match or
run out of fragments.
"""
flag_pn = ("%s_%s" % (flag, pn))
for candidate in acceptlist:
if flag_pn == candidate:
return True
flag_cur = ""
flagments = flag_pn.split("_")
flagments.pop() # we've already tested the full string
for flagment in flagments:
if flag_cur:
flag_cur += "_"
flag_cur += flagment
for candidate in acceptlist:
if flag_cur == candidate:
return True
return False
def all_license_flags_match(license_flags, acceptlist):
""" Return all unmatched flags, None if all flags match """
pn = d.getVar('PN')
split_acceptlist = acceptlist.split()
flags = []
for flag in license_flags.split():
if not license_flag_matches(flag, split_acceptlist, pn):
flags.append(flag)
return flags if flags else None
license_flags = d.getVar('LICENSE_FLAGS')
if license_flags:
acceptlist = d.getVar('LICENSE_FLAGS_ACCEPTED')
if not acceptlist:
return license_flags.split()
unmatched_flags = all_license_flags_match(license_flags, acceptlist)
if unmatched_flags:
return unmatched_flags
return None
def check_license_format(d):
"""
This function checks if LICENSE is well defined,
Validate operators in LICENSES.
No spaces are allowed between LICENSES.
"""
pn = d.getVar('PN')
licenses = d.getVar('LICENSE')
from oe.license import license_operator, license_operator_chars, license_pattern
elements = list(filter(lambda x: x.strip(), license_operator.split(licenses)))
for pos, element in enumerate(elements):
if license_pattern.match(element):
if pos > 0 and license_pattern.match(elements[pos - 1]):
oe.qa.handle_error('license-format',
'%s: LICENSE value "%s" has an invalid format - license names ' \
'must be separated by the following characters to indicate ' \
'the license selection: %s' %
(pn, licenses, license_operator_chars), d)
elif not license_operator.match(element):
oe.qa.handle_error('license-format',
'%s: LICENSE value "%s" has an invalid separator "%s" that is not ' \
'in the valid list of separators (%s)' %
(pn, licenses, element, license_operator_chars), d)
SSTATETASKS += "do_populate_lic"
do_populate_lic[sstate-inputdirs] = "${LICSSTATEDIR}"
do_populate_lic[sstate-outputdirs] = "${LICENSE_DIRECTORY}/"

View File

@@ -652,10 +652,17 @@ python do_prepare_recipe_sysroot () {
addtask do_prepare_recipe_sysroot before do_configure after do_fetch
python staging_taskhandler() {
EXCLUDED_TASKS = (
"do_prepare_recipe_sysroot",
"do_create_spdx",
)
bbtasks = e.tasklist
for task in bbtasks:
if task in EXCLUDED_TASKS:
continue
deps = d.getVarFlag(task, "depends")
if task != 'do_prepare_recipe_sysroot' and (task == "do_configure" or (deps and "populate_sysroot" in deps)):
if task == "do_configure" or (deps and "populate_sysroot" in deps):
d.prependVarFlag(task, "prefuncs", "extend_recipe_sysroot ")
}
staging_taskhandler[eventmask] = "bb.event.RecipeTaskPreProcess"

View File

@@ -30,6 +30,9 @@ BAREMETAL_BINNAME ?= "hello_baremetal_${MACHINE}"
IMAGE_LINK_NAME ?= "baremetal-helloworld-image-${MACHINE}"
IMAGE_NAME_SUFFIX ?= ""
IMAGE_OUTPUT_MANIFEST_DIR = "${WORKDIR}/deploy-image-output-manifest"
IMAGE_OUTPUT_MANIFEST = "${IMAGE_OUTPUT_MANIFEST_DIR}/manifest.json"
do_rootfs[dirs] = "${IMGDEPLOYDIR} ${DEPLOY_DIR_IMAGE}"
do_image(){
@@ -37,8 +40,28 @@ do_image(){
install ${D}/${base_libdir}/firmware/${BAREMETAL_BINNAME}.elf ${IMGDEPLOYDIR}/${IMAGE_LINK_NAME}.elf
}
do_image_complete(){
:
python do_image_complete(){
from pathlib import Path
import json
data = {
"taskname": "do_image",
"imagetype": "baremetal-image",
"images": []
}
img_deploy_dir = Path(d.getVar("IMGDEPLOYDIR"))
for child in img_deploy_dir.iterdir():
if not child.is_file() or child.is_symlink():
continue
data["images"].append({
"filename": child.name,
})
with open(d.getVar("IMAGE_OUTPUT_MANIFEST"), "w") as f:
json.dump([data], f)
}
python do_rootfs(){
@@ -62,6 +85,7 @@ python do_rootfs(){
bb.utils.mkdirhier(sysconfdir)
execute_pre_post_process(d, d.getVar('ROOTFS_POSTPROCESS_COMMAND'))
execute_pre_post_process(d, d.getVar("ROOTFS_POSTUNINSTALL_COMMAND"))
}
@@ -72,6 +96,8 @@ SSTATE_SKIP_CREATION:task-image-complete = '1'
do_image_complete[sstate-inputdirs] = "${IMGDEPLOYDIR}"
do_image_complete[sstate-outputdirs] = "${DEPLOY_DIR_IMAGE}"
do_image_complete[stamp-extra-info] = "${MACHINE_ARCH}"
do_image_complete[sstate-plaindirs] += "${IMAGE_OUTPUT_MANIFEST_DIR}"
do_image_complete[dirs] += "${IMAGE_OUTPUT_MANIFEST_DIR}"
addtask do_image_complete after do_image before do_build
python do_image_complete_setscene () {
@@ -140,5 +166,5 @@ python(){
else:
deps += " %s:%s" % (dep, task)
return deps
d.appendVarFlag('do_image', 'depends', extraimage_getdepends('do_populate_sysroot'))
d.appendVarFlag('do_image', 'depends', extraimage_getdepends('do_populate_sysroot'))
}

View File

@@ -31,7 +31,7 @@ CROSS_CURSES_LIB = "-lncurses -ltinfo"
CROSS_CURSES_INC = '-DCURSES_LOC="<curses.h>"'
TERMINFO = "${STAGING_DATADIR_NATIVE}/terminfo"
KCONFIG_CONFIG_COMMAND ??= "menuconfig"
KCONFIG_CONFIG_COMMAND ??= "menuconfig ${EXTRA_OEMAKE}"
KCONFIG_CONFIG_ENABLE_MENUCONFIG ??= "true"
KCONFIG_CONFIG_ROOTDIR ??= "${B}"
python do_menuconfig() {

View File

@@ -0,0 +1,85 @@
#
# Copyright OpenEmbedded Contributors
#
# SPDX-License-Identifier: GPL-2.0-only
#
# SPDX image tasks
SPDX_ROOTFS_PACKAGES = "${SPDXDIR}/rootfs-packages.json"
SPDXIMAGEDEPLOYDIR = "${SPDXDIR}/image-deploy"
SPDXROOTFSDEPLOY = "${SPDXDIR}/rootfs-deploy"
python spdx_collect_rootfs_packages() {
import json
from pathlib import Path
from oe.rootfs import image_list_installed_packages
root_packages_file = Path(d.getVar("SPDX_ROOTFS_PACKAGES"))
packages = image_list_installed_packages(d)
if not packages:
packages = {}
root_packages_file.parent.mkdir(parents=True, exist_ok=True)
with root_packages_file.open("w") as f:
json.dump(packages, f)
}
ROOTFS_POSTUNINSTALL_COMMAND =+ "spdx_collect_rootfs_packages"
python do_create_rootfs_spdx() {
import oe.spdx30_tasks
oe.spdx30_tasks.create_rootfs_spdx(d)
}
addtask do_create_rootfs_spdx after do_rootfs before do_image
SSTATETASKS += "do_create_rootfs_spdx"
do_create_rootfs_spdx[sstate-inputdirs] = "${SPDXROOTFSDEPLOY}"
do_create_rootfs_spdx[sstate-outputdirs] = "${DEPLOY_DIR_SPDX}"
do_create_rootfs_spdx[recrdeptask] += "do_create_spdx do_create_package_spdx"
do_create_rootfs_spdx[cleandirs] += "${SPDXROOTFSDEPLOY}"
do_create_rootfs_spdx[file-checksums] += "${SPDX3_LIB_DEP_FILES}"
python do_create_rootfs_spdx_setscene() {
sstate_setscene(d)
}
addtask do_create_rootfs_spdx_setscene
python do_create_image_spdx() {
import oe.spdx30_tasks
oe.spdx30_tasks.create_image_spdx(d)
}
addtask do_create_image_spdx after do_image_complete do_create_rootfs_spdx before do_build
SSTATETASKS += "do_create_image_spdx"
SSTATE_SKIP_CREATION:task-create-image-spdx = "1"
do_create_image_spdx[sstate-inputdirs] = "${SPDXIMAGEWORK}"
do_create_image_spdx[sstate-outputdirs] = "${DEPLOY_DIR_SPDX}"
do_create_image_spdx[cleandirs] = "${SPDXIMAGEWORK}"
do_create_image_spdx[dirs] = "${SPDXIMAGEWORK}"
do_create_image_spdx[file-checksums] += "${SPDX3_LIB_DEP_FILES}"
do_create_image_spdx[vardeps] += "\
SPDX_IMAGE_PURPOSE \
"
python do_create_image_spdx_setscene() {
sstate_setscene(d)
}
addtask do_create_image_spdx_setscene
python do_create_image_sbom_spdx() {
import oe.spdx30_tasks
oe.spdx30_tasks.create_image_sbom_spdx(d)
}
addtask do_create_image_sbom_spdx after do_create_rootfs_spdx do_create_image_spdx before do_build
SSTATETASKS += "do_create_image_sbom_spdx"
SSTATE_SKIP_CREATION:task-create-image-sbom = "1"
do_create_image_sbom_spdx[sstate-inputdirs] = "${SPDXIMAGEDEPLOYDIR}"
do_create_image_sbom_spdx[sstate-outputdirs] = "${DEPLOY_DIR_IMAGE}"
do_create_image_sbom_spdx[stamp-extra-info] = "${MACHINE_ARCH}"
do_create_image_sbom_spdx[cleandirs] = "${SPDXIMAGEDEPLOYDIR}"
do_create_image_sbom_spdx[recrdeptask] += "do_create_spdx do_create_package_spdx"
do_create_image_sbom_spdx[file-checksums] += "${SPDX3_LIB_DEP_FILES}"
python do_create_image_sbom_spdx_setscene() {
sstate_setscene(d)
}
addtask do_create_image_sbom_spdx_setscene

View File

@@ -0,0 +1,74 @@
#
# Copyright OpenEmbedded Contributors
#
# SPDX-License-Identifier: GPL-2.0-only
#
# SPDX SDK tasks
do_populate_sdk[recrdeptask] += "do_create_spdx do_create_package_spdx"
do_populate_sdk[cleandirs] += "${SPDXSDKWORK}"
do_populate_sdk[postfuncs] += "sdk_create_sbom"
do_populate_sdk[file-checksums] += "${SPDX3_LIB_DEP_FILES}"
POPULATE_SDK_POST_HOST_COMMAND:append:task-populate-sdk = " sdk_host_create_spdx"
POPULATE_SDK_POST_TARGET_COMMAND:append:task-populate-sdk = " sdk_target_create_spdx"
do_populate_sdk_ext[recrdeptask] += "do_create_spdx do_create_package_spdx"
do_populate_sdk_ext[cleandirs] += "${SPDXSDKEXTWORK}"
do_populate_sdk_ext[postfuncs] += "sdk_ext_create_sbom"
do_populate_sdk_ext[file-checksums] += "${SPDX3_LIB_DEP_FILES}"
POPULATE_SDK_POST_HOST_COMMAND:append:task-populate-sdk-ext = " sdk_ext_host_create_spdx"
POPULATE_SDK_POST_TARGET_COMMAND:append:task-populate-sdk-ext = " sdk_ext_target_create_spdx"
python sdk_host_create_spdx() {
from pathlib import Path
import oe.spdx30_tasks
spdx_work_dir = Path(d.getVar('SPDXSDKWORK'))
oe.spdx30_tasks.sdk_create_spdx(d, "host", spdx_work_dir, d.getVar("TOOLCHAIN_OUTPUTNAME"))
}
python sdk_target_create_spdx() {
from pathlib import Path
import oe.spdx30_tasks
spdx_work_dir = Path(d.getVar('SPDXSDKWORK'))
oe.spdx30_tasks.sdk_create_spdx(d, "target", spdx_work_dir, d.getVar("TOOLCHAIN_OUTPUTNAME"))
}
python sdk_ext_host_create_spdx() {
from pathlib import Path
import oe.spdx30_tasks
spdx_work_dir = Path(d.getVar('SPDXSDKEXTWORK'))
# TODO: This doesn't seem to work
oe.spdx30_tasks.sdk_create_spdx(d, "host", spdx_work_dir, d.getVar("TOOLCHAINEXT_OUTPUTNAME"))
}
python sdk_ext_target_create_spdx() {
from pathlib import Path
import oe.spdx30_tasks
spdx_work_dir = Path(d.getVar('SPDXSDKEXTWORK'))
# TODO: This doesn't seem to work
oe.spdx30_tasks.sdk_create_spdx(d, "target", spdx_work_dir, d.getVar("TOOLCHAINEXT_OUTPUTNAME"))
}
python sdk_create_sbom() {
from pathlib import Path
import oe.spdx30_tasks
sdk_deploydir = Path(d.getVar("SDKDEPLOYDIR"))
spdx_work_dir = Path(d.getVar('SPDXSDKWORK'))
oe.spdx30_tasks.create_sdk_sbom(d, sdk_deploydir, spdx_work_dir, d.getVar("TOOLCHAIN_OUTPUTNAME"))
}
python sdk_ext_create_sbom() {
from pathlib import Path
import oe.spdx30_tasks
sdk_deploydir = Path(d.getVar("SDKEXTDEPLOYDIR"))
spdx_work_dir = Path(d.getVar('SPDXSDKEXTWORK'))
oe.spdx30_tasks.create_sdk_sbom(d, sdk_deploydir, spdx_work_dir, d.getVar("TOOLCHAINEXT_OUTPUTNAME"))
}

View File

@@ -101,3 +101,39 @@ addtask addto_recipe_sysroot after do_populate_sysroot
do_addto_recipe_sysroot[deptask] = "do_populate_sysroot"
PATH:prepend = "${COREBASE}/scripts/cross-intercept:"
#
# Cross task outputs can call native dependencies and even when cross
# recipe output doesn't change it might produce different results when
# the called native dependency is changed, e.g. clang-cross-${TARGET_ARCH}
# contains symlink to clang binary from clang-native, but when clang-native
# outhash is changed, clang-cross-${TARGET_ARCH} will still be considered
# equivalent and target recipes aren't rebuilt with new clang binary, see
# work around in https://github.com/kraj/meta-clang/pull/1140 to make target
# recipes to depend directly not only on clang-cross-${TARGET_ARCH} but
# clang-native as well.
#
# This can cause poor interactions with hash equivalence, since this recipes
# output-changing dependency is "hidden" and downstream task only see that this
# recipe has the same outhash and therefore is equivalent. This can result in
# different output in different cases.
#
# To resolve this, unhide the output-changing dependency by adding its unihash
# to this tasks outhash calculation. Unfortunately, don't know specifically
# know which dependencies are output-changing, so we have to add all of them.
#
python cross_add_do_populate_sysroot_deps () {
current_task = "do_" + d.getVar("BB_CURRENTTASK")
if current_task != "do_populate_sysroot":
return
taskdepdata = d.getVar("BB_TASKDEPDATA", False)
pn = d.getVar("PN")
deps = {
dep[0]:dep[6] for dep in taskdepdata.values() if
dep[1] == current_task and dep[0] != pn
}
d.setVar("HASHEQUIV_EXTRA_SIGDATA", "\n".join("%s: %s" % (k, deps[k]) for k in sorted(deps.keys())))
}
SSTATECREATEFUNCS += "cross_add_do_populate_sysroot_deps"

View File

@@ -24,6 +24,9 @@ TARGET_GOMIPS = "${@go_map_mips(d.getVar('TARGET_ARCH'), d.getVar('TUNE_FEATURES
TARGET_GOARM:class-native = "7"
TARGET_GO386:class-native = "sse2"
TARGET_GOMIPS:class-native = "hardfloat"
TARGET_GOARM:class-crosssdk = "7"
TARGET_GO386:class-crosssdk = "sse2"
TARGET_GOMIPS:class-crosssdk = "hardfloat"
TARGET_GOTUPLE = "${TARGET_GOOS}_${TARGET_GOARCH}"
GO_BUILD_BINDIR = "${@['bin/${HOST_GOTUPLE}','bin'][d.getVar('BUILD_GOTUPLE') == d.getVar('HOST_GOTUPLE')]}"

View File

@@ -88,6 +88,11 @@ PACKAGE_INSTALL_ATTEMPTONLY ?= "${FEATURE_INSTALL_OPTIONAL}"
IMGDEPLOYDIR = "${WORKDIR}/deploy-${PN}-image-complete"
IMGMANIFESTDIR = "${WORKDIR}/image-task-manifest"
IMAGE_OUTPUT_MANIFEST_DIR = "${WORKDIR}/deploy-image-output-manifest"
IMAGE_OUTPUT_MANIFEST = "${IMAGE_OUTPUT_MANIFEST_DIR}/manifest.json"
# Images are generally built explicitly, do not need to be part of world.
EXCLUDE_FROM_WORLD = "1"
@@ -277,14 +282,28 @@ fakeroot python do_image () {
execute_pre_post_process(d, pre_process_cmds)
}
do_image[dirs] = "${TOPDIR}"
do_image[cleandirs] += "${IMGMANIFESTDIR}"
addtask do_image after do_rootfs
fakeroot python do_image_complete () {
from oe.utils import execute_pre_post_process
from pathlib import Path
import json
post_process_cmds = d.getVar("IMAGE_POSTPROCESS_COMMAND")
execute_pre_post_process(d, post_process_cmds)
image_manifest_dir = Path(d.getVar('IMGMANIFESTDIR'))
data = []
for manifest_path in image_manifest_dir.glob("*.json"):
with manifest_path.open("r") as f:
data.extend(json.load(f))
with open(d.getVar("IMAGE_OUTPUT_MANIFEST"), "w") as f:
json.dump(data, f)
}
do_image_complete[dirs] = "${TOPDIR}"
SSTATETASKS += "do_image_complete"
@@ -292,6 +311,8 @@ SSTATE_SKIP_CREATION:task-image-complete = '1'
do_image_complete[sstate-inputdirs] = "${IMGDEPLOYDIR}"
do_image_complete[sstate-outputdirs] = "${DEPLOY_DIR_IMAGE}"
do_image_complete[stamp-extra-info] = "${MACHINE_ARCH}"
do_image_complete[sstate-plaindirs] += "${IMAGE_OUTPUT_MANIFEST_DIR}"
do_image_complete[dirs] += "${IMAGE_OUTPUT_MANIFEST_DIR}"
addtask do_image_complete after do_image before do_build
python do_image_complete_setscene () {
sstate_setscene(d)
@@ -501,12 +522,14 @@ python () {
d.setVar(task, '\n'.join(cmds))
d.setVarFlag(task, 'func', '1')
d.setVarFlag(task, 'fakeroot', '1')
d.setVarFlag(task, 'imagetype', t)
d.appendVarFlag(task, 'prefuncs', ' ' + debug + ' set_image_size')
d.prependVarFlag(task, 'postfuncs', 'create_symlinks ')
d.appendVarFlag(task, 'subimages', ' ' + ' '.join(subimages))
d.appendVarFlag(task, 'vardeps', ' ' + ' '.join(vardeps))
d.appendVarFlag(task, 'vardepsexclude', ' DATETIME DATE ' + ' '.join(vardepsexclude))
d.appendVarFlag(task, 'postfuncs', ' write_image_output_manifest')
bb.debug(2, "Adding task %s before %s, after %s" % (task, 'do_image_complete', after))
bb.build.addtask(task, 'do_image_complete', after, d)
@@ -604,6 +627,41 @@ python create_symlinks() {
bb.note("Skipping symlink, source does not exist: %s -> %s" % (dst, src))
}
python write_image_output_manifest() {
import json
from pathlib import Path
taskname = d.getVar("BB_CURRENTTASK")
image_deploy_dir = Path(d.getVar('IMGDEPLOYDIR'))
image_manifest_dir = Path(d.getVar('IMGMANIFESTDIR'))
manifest_path = image_manifest_dir / ("do_" + d.getVar("BB_CURRENTTASK") + ".json")
image_name = d.getVar("IMAGE_NAME")
image_basename = d.getVar("IMAGE_BASENAME")
machine = d.getVar("MACHINE")
subimages = (d.getVarFlag("do_" + taskname, 'subimages', False) or "").split()
imagetype = d.getVarFlag("do_" + taskname, 'imagetype', False)
data = {
"taskname": taskname,
"imagetype": imagetype,
"images": []
}
for type in subimages:
image_filename = image_name + "." + type
image_path = image_deploy_dir / image_filename
if not image_path.exists():
continue
data["images"].append({
"filename": image_filename,
})
with manifest_path.open("w") as f:
json.dump([data], f)
}
MULTILIBRE_ALLOW_REP += "${base_bindir} ${base_sbindir} ${bindir} ${sbindir} ${libexecdir} ${sysconfdir} ${nonarch_base_libdir}/udev /lib/modules/[^/]*/modules.*"
MULTILIB_CHECK_FILE = "${WORKDIR}/multilib_check.py"
MULTILIB_TEMP_ROOTFS = "${WORKDIR}/multilib"

View File

@@ -697,9 +697,6 @@ addtask savedefconfig after do_configure
inherit cml1 pkgconfig
# Need LD, HOSTLDFLAGS and more for config operations
KCONFIG_CONFIG_COMMAND:append = " ${EXTRA_OEMAKE}"
EXPORT_FUNCTIONS do_compile do_transform_kernel do_transform_bundled_initramfs do_install do_configure
# kernel-base becomes kernel-${KERNEL_VERSION}
@@ -873,5 +870,69 @@ addtask deploy after do_populate_sysroot do_packagedata
EXPORT_FUNCTIONS do_deploy
python __anonymous() {
inherits = (d.getVar("INHERIT") or "")
if "create-spdx" in inherits:
bb.build.addtask('do_create_kernel_config_spdx', 'do_populate_lic do_deploy', 'do_create_spdx', d)
}
python do_create_kernel_config_spdx() {
if d.getVar("SPDX_INCLUDE_KERNEL_CONFIG", True) == "1":
import oe.spdx30
import oe.spdx30_tasks
from pathlib import Path
from datetime import datetime, timezone
pkg_arch = d.getVar("SSTATE_PKGARCH")
deploydir = Path(d.getVar("SPDXDEPLOY"))
pn = d.getVar("PN")
config_path = d.expand("${B}/.config")
kernel_params = []
if not os.path.exists(config_path):
bb.warn(f"SPDX: Kernel config file not found at: {config_path}")
return
try:
with open(config_path, 'r') as f:
for line in f:
line = line.strip()
if not line or line.startswith("#"):
continue
if "=" in line:
key, value = line.split("=", 1)
kernel_params.append(oe.spdx30.DictionaryEntry(
key=key,
value=value.strip('"')
))
bb.note(f"Parsed {len(kernel_params)} kernel config entries from {config_path}")
except Exception as e:
bb.error(f"Failed to parse kernel config file: {e}")
build, build_objset = oe.sbom30.find_root_obj_in_jsonld(
d, "recipes", f"recipe-{pn}", oe.spdx30.build_Build
)
kernel_build = build_objset.add_root(
oe.spdx30.build_Build(
_id=build_objset.new_spdxid("kernel-config"),
creationInfo=build_objset.doc.creationInfo,
build_buildType="https://openembedded.org/kernel-configuration",
build_parameter=kernel_params
)
)
oe.spdx30_tasks.set_timestamp_now(d, kernel_build, "build_buildStartTime")
build_objset.new_relationship(
[build],
oe.spdx30.RelationshipType.ancestorOf,
[kernel_build]
)
oe.sbom30.write_jsonld_doc(d, build_objset, deploydir / pkg_arch / "recipes" / f"recipe-{pn}.spdx.json")
}
do_create_kernel_config_spdx[depends] = "virtual/kernel:do_configure"
# Add using Device Tree support
inherit kernel-devicetree

View File

@@ -58,7 +58,7 @@ def write_license_files(d, license_manifest, pkg_dic, rootfs=True):
import stat
bad_licenses = (d.getVar("INCOMPATIBLE_LICENSE") or "").split()
bad_licenses = expand_wildcard_licenses(d, bad_licenses)
bad_licenses = oe.license.expand_wildcard_licenses(d, bad_licenses)
pkgarchs = d.getVar("SSTATE_ARCHS").split()
pkgarchs.reverse()
@@ -66,17 +66,17 @@ def write_license_files(d, license_manifest, pkg_dic, rootfs=True):
with open(license_manifest, "w") as license_file:
for pkg in sorted(pkg_dic):
remaining_bad_licenses = oe.license.apply_pkg_license_exception(pkg, bad_licenses, exceptions)
incompatible_licenses = incompatible_pkg_license(d, remaining_bad_licenses, pkg_dic[pkg]["LICENSE"])
incompatible_licenses = oe.license.incompatible_pkg_license(d, remaining_bad_licenses, pkg_dic[pkg]["LICENSE"])
if incompatible_licenses:
bb.fatal("Package %s cannot be installed into the image because it has incompatible license(s): %s" %(pkg, ' '.join(incompatible_licenses)))
else:
incompatible_licenses = incompatible_pkg_license(d, bad_licenses, pkg_dic[pkg]["LICENSE"])
incompatible_licenses = oe.license.incompatible_pkg_license(d, bad_licenses, pkg_dic[pkg]["LICENSE"])
if incompatible_licenses:
oe.qa.handle_error('license-incompatible', "Including %s with incompatible license(s) %s into the image, because it has been allowed by exception list." %(pkg, ' '.join(incompatible_licenses)), d)
try:
(pkg_dic[pkg]["LICENSE"], pkg_dic[pkg]["LICENSES"]) = \
oe.license.manifest_licenses(pkg_dic[pkg]["LICENSE"],
remaining_bad_licenses, canonical_license, d)
remaining_bad_licenses, oe.license.canonical_license, d)
except oe.license.LicenseError as exc:
bb.fatal('%s: %s' % (d.getVar('P'), exc))
@@ -144,7 +144,7 @@ def write_license_files(d, license_manifest, pkg_dic, rootfs=True):
if not os.path.exists(pkg_license_dir ):
bb.fatal("Couldn't find license information for dependency %s" % pkg)
pkg_manifest_licenses = [canonical_license(d, lic) \
pkg_manifest_licenses = [oe.license.canonical_license(d, lic) \
for lic in pkg_dic[pkg]["LICENSES"]]
licenses = os.listdir(pkg_license_dir)
@@ -153,7 +153,7 @@ def write_license_files(d, license_manifest, pkg_dic, rootfs=True):
pkg_rootfs_license = os.path.join(pkg_rootfs_license_dir, lic)
if re.match(r"^generic_.*$", lic):
generic_lic = canonical_license(d,
generic_lic = oe.license.canonical_license(d,
re.search(r"^generic_(.*)$", lic).group(1))
# Do not copy generic license into package if isn't
@@ -176,7 +176,7 @@ def write_license_files(d, license_manifest, pkg_dic, rootfs=True):
if not os.path.exists(pkg_rootfs_license):
os.symlink(os.path.join('..', generic_lic_file), pkg_rootfs_license)
else:
if (oe.license.license_ok(canonical_license(d,
if (oe.license.license_ok(oe.license.canonical_license(d,
lic), bad_licenses) == False or
os.path.exists(pkg_rootfs_license)):
continue

View File

@@ -0,0 +1,13 @@
#
# Copyright OpenEmbedded Contributors
#
# SPDX-License-Identifier: MIT
#
deltask do_collect_spdx_deps
deltask do_create_spdx
deltask do_create_spdx_runtime
deltask do_create_package_spdx
deltask do_create_rootfs_spdx
deltask do_create_image_spdx
deltask do_create_image_sbom

View File

@@ -329,6 +329,7 @@ def rust_gen_target(d, thing, wd, arch):
sys = d.getVar('{}_SYS'.format(thing))
prefix = d.getVar('{}_PREFIX'.format(thing))
rustsys = d.getVar('RUST_{}_SYS'.format(thing))
os = d.getVar('{}_OS'.format(thing))
abi = None
cpu = "generic"
@@ -368,7 +369,7 @@ def rust_gen_target(d, thing, wd, arch):
tspec['target-c-int-width'] = d.getVarFlag('TARGET_C_INT_WIDTH', arch_abi)
tspec['target-endian'] = d.getVarFlag('TARGET_ENDIAN', arch_abi)
tspec['arch'] = arch_to_rust_target_arch(rust_arch)
if "baremetal" in d.getVar('TCLIBC'):
if "elf" in os:
tspec['os'] = "none"
else:
tspec['os'] = "linux"

View File

@@ -14,6 +14,9 @@
#
# where "<image-name>" is an image like core-image-sato.
# List of test modules to run, or run all that can be found if unset
TESTSDK_SUITES ?= ""
TESTSDK_CLASS_NAME ?= "oeqa.sdk.testsdk.TestSDK"
TESTSDKEXT_CLASS_NAME ?= "oeqa.sdkext.testsdk.TestSDKExt"

View File

@@ -4,7 +4,9 @@
# SPDX-License-Identifier: GPL-2.0-only
#
DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx"
SPDX_VERSION = "2.2"
DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx/${SPDX_VERSION}"
# The product name that the CVE database uses. Defaults to BPN, but may need to
# be overriden per recipe (for example tiff.bb sets CVE_PRODUCT=libtiff).
@@ -1044,52 +1046,53 @@ def combine_spdx(d, rootfs_name, rootfs_deploydir, rootfs_spdxid, packages, spdx
doc.packages.append(image)
for name in sorted(packages.keys()):
if name not in providers:
bb.fatal("Unable to find SPDX provider for '%s'" % name)
if packages:
for name in sorted(packages.keys()):
if name not in providers:
bb.fatal("Unable to find SPDX provider for '%s'" % name)
pkg_name, pkg_hashfn = providers[name]
pkg_name, pkg_hashfn = providers[name]
pkg_spdx_path = oe.sbom.doc_find_by_hashfn(deploy_dir_spdx, package_archs, pkg_name, pkg_hashfn)
if not pkg_spdx_path:
bb.fatal("No SPDX file found for package %s, %s" % (pkg_name, pkg_hashfn))
pkg_spdx_path = oe.sbom.doc_find_by_hashfn(deploy_dir_spdx, package_archs, pkg_name, pkg_hashfn)
if not pkg_spdx_path:
bb.fatal("No SPDX file found for package %s, %s" % (pkg_name, pkg_hashfn))
pkg_doc, pkg_doc_sha1 = oe.sbom.read_doc(pkg_spdx_path)
pkg_doc, pkg_doc_sha1 = oe.sbom.read_doc(pkg_spdx_path)
for p in pkg_doc.packages:
if p.name == name:
pkg_ref = oe.spdx.SPDXExternalDocumentRef()
pkg_ref.externalDocumentId = "DocumentRef-%s" % pkg_doc.name
pkg_ref.spdxDocument = pkg_doc.documentNamespace
pkg_ref.checksum.algorithm = "SHA1"
pkg_ref.checksum.checksumValue = pkg_doc_sha1
for p in pkg_doc.packages:
if p.name == name:
pkg_ref = oe.spdx.SPDXExternalDocumentRef()
pkg_ref.externalDocumentId = "DocumentRef-%s" % pkg_doc.name
pkg_ref.spdxDocument = pkg_doc.documentNamespace
pkg_ref.checksum.algorithm = "SHA1"
pkg_ref.checksum.checksumValue = pkg_doc_sha1
doc.externalDocumentRefs.append(pkg_ref)
doc.add_relationship(image, "CONTAINS", "%s:%s" % (pkg_ref.externalDocumentId, p.SPDXID))
break
else:
bb.fatal("Unable to find package with name '%s' in SPDX file %s" % (name, pkg_spdx_path))
doc.externalDocumentRefs.append(pkg_ref)
doc.add_relationship(image, "CONTAINS", "%s:%s" % (pkg_ref.externalDocumentId, p.SPDXID))
break
else:
bb.fatal("Unable to find package with name '%s' in SPDX file %s" % (name, pkg_spdx_path))
runtime_spdx_path = oe.sbom.doc_find_by_hashfn(deploy_dir_spdx, package_archs, "runtime-" + name, pkg_hashfn)
if not runtime_spdx_path:
bb.fatal("No runtime SPDX document found for %s, %s" % (name, pkg_hashfn))
runtime_spdx_path = oe.sbom.doc_find_by_hashfn(deploy_dir_spdx, package_archs, "runtime-" + name, pkg_hashfn)
if not runtime_spdx_path:
bb.fatal("No runtime SPDX document found for %s, %s" % (name, pkg_hashfn))
runtime_doc, runtime_doc_sha1 = oe.sbom.read_doc(runtime_spdx_path)
runtime_doc, runtime_doc_sha1 = oe.sbom.read_doc(runtime_spdx_path)
runtime_ref = oe.spdx.SPDXExternalDocumentRef()
runtime_ref.externalDocumentId = "DocumentRef-%s" % runtime_doc.name
runtime_ref.spdxDocument = runtime_doc.documentNamespace
runtime_ref.checksum.algorithm = "SHA1"
runtime_ref.checksum.checksumValue = runtime_doc_sha1
runtime_ref = oe.spdx.SPDXExternalDocumentRef()
runtime_ref.externalDocumentId = "DocumentRef-%s" % runtime_doc.name
runtime_ref.spdxDocument = runtime_doc.documentNamespace
runtime_ref.checksum.algorithm = "SHA1"
runtime_ref.checksum.checksumValue = runtime_doc_sha1
# "OTHER" isn't ideal here, but I can't find a relationship that makes sense
doc.externalDocumentRefs.append(runtime_ref)
doc.add_relationship(
image,
"OTHER",
"%s:%s" % (runtime_ref.externalDocumentId, runtime_doc.SPDXID),
comment="Runtime dependencies for %s" % name
)
# "OTHER" isn't ideal here, but I can't find a relationship that makes sense
doc.externalDocumentRefs.append(runtime_ref)
doc.add_relationship(
image,
"OTHER",
"%s:%s" % (runtime_ref.externalDocumentId, runtime_doc.SPDXID),
comment="Runtime dependencies for %s" % name
)
bb.utils.mkdirhier(spdx_workdir)
image_spdx_path = spdx_workdir / (rootfs_name + ".spdx.json")

View File

@@ -0,0 +1,216 @@
#
# Copyright OpenEmbedded Contributors
#
# SPDX-License-Identifier: GPL-2.0-only
#
inherit spdx-common
SPDX_VERSION = "3.0.1"
# The list of SPDX profiles generated documents will conform to
SPDX_PROFILES ?= "core build software simpleLicensing security"
SPDX_INCLUDE_BUILD_VARIABLES ??= "0"
SPDX_INCLUDE_BUILD_VARIABLES[doc] = "If set to '1', the bitbake variables for a \
recipe will be included in the Build object. This will most likely result \
in non-reproducible SPDX output"
SPDX_INCLUDE_BITBAKE_PARENT_BUILD ??= "0"
SPDX_INCLUDE_BITBAKE_PARENT_BUILD[doc] = "Report the parent invocation of bitbake \
for each Build object. This allows you to know who invoked bitbake to perform \
a build, but will result in non-reproducible SPDX output."
SPDX_PACKAGE_ADDITIONAL_PURPOSE ?= ""
SPDX_PACKAGE_ADDITIONAL_PURPOSE[doc] = "The list of additional purposes to assign to \
the generated packages for a recipe. The primary purpose is always `install`. \
Packages overrides are allowed to override the additional purposes for \
individual packages."
SPDX_IMAGE_PURPOSE ?= "filesystemImage"
SPDX_IMAGE_PURPOSE[doc] = "The list of purposes to assign to the generated images. \
The first listed item will be the Primary Purpose and all additional items will \
be added as additional purposes"
SPDX_SDK_PURPOSE ?= "install"
SPDX_SDK_PURPOSE[doc] = "The list of purposes to assign to the generate SDK installer. \
The first listed item will be the Primary Purpose and all additional items will \
be added as additional purposes"
SPDX_INCLUDE_VEX ??= "current"
SPDX_INCLUDE_VEX[doc] = "Controls what VEX information is in the output. Set to \
'none' to disable all VEX data. Set to 'current' to only include VEX data \
for vulnerabilities not already fixed in the upstream source code \
(recommended). Set to 'all' to get all known historical vulnerabilities, \
including those already fixed upstream (warning: This can be large and \
slow)."
SPDX_INCLUDE_TIMESTAMPS ?= "0"
SPDX_INCLUDE_TIMESTAMPS[doc] = "Include time stamps in SPDX output. This is \
useful if you want to know when artifacts were produced and when builds \
occurred, but will result in non-reproducible SPDX output"
SPDX_INCLUDE_KERNEL_CONFIG ??= "0"
SPDX_INCLUDE_KERNEL_CONFIG[doc] = "If set to '1', the .config file for the kernel will be parsed \
and each CONFIG_* value will be included in the Build.build_parameter list as DictionaryEntry \
items. Set to '0' to disable exporting kernel configuration to improve performance or reduce \
SPDX document size."
SPDX_INCLUDE_PACKAGECONFIG ??= "0"
SPDX_INCLUDE_PACKAGECONFIG[doc] = "If set to '1', each PACKAGECONFIG feature is recorded in the \
build_Build object's build_parameter list as a DictionaryEntry with key \
'PACKAGECONFIG:<feature>' and value 'enabled' or 'disabled'"
SPDX_IMPORTS ??= ""
SPDX_IMPORTS[doc] = "SPDX_IMPORTS is the base variable that describes how to \
reference external SPDX ids. Each import is defined as a key in this \
variable with a suffix to describe to as a suffix to look up more \
information about the import. Each key can have the following variables: \
SPDX_IMPORTS_<key>_spdxid: The Fully qualified SPDX ID of the object \
SPDX_IMPORTS_<key>_uri: The URI where the SPDX Document that contains \
the external object can be found. Optional but recommended \
SPDX_IMPORTS_<key>_hash_<hash>: The Checksum of the SPDX Document that \
contains the External ID. <hash> must be one the valid SPDX hashing \
algorithms, as described by the HashAlgorithm vocabulary in the\
SPDX 3 spec. Optional but recommended"
# Agents
# Bitbake variables can be used to describe an SPDX Agent that may be used
# during the build. An Agent is specified using a set of variables which all
# start with some common base name:
#
# <BASE>_name: The name of the Agent (required)
# <BASE>_type: The type of Agent. Must be one of "person", "organization",
# "software", or "agent" (the default if not specified)
# <BASE>_comment: The comment for the Agent (optional)
# <BASE>_id_<ID>: And External Identifier for the Agent. <ID> must be a valid
# ExternalIdentifierType from the SPDX 3 spec. Commonly, an E-mail address
# can be specified with <BASE>_id_email
#
# Alternatively, an Agent can be an external reference by referencing a key
# in SPDX_IMPORTS like so:
#
# <BASE>_import = "<key>"
#
# Finally, the same agent described by another set of agent variables can be
# referenced by specifying the basename of the variable that should be
# referenced:
#
# SPDX_PACKAGE_SUPPLIER_ref = "SPDX_AUTHORS_openembedded"
SPDX_AUTHORS ??= "openembedded"
SPDX_AUTHORS[doc] = "A space separated list of the document authors. Each item \
is used to name a base variable like SPDX_AUTHORS_<AUTHOR> that \
describes the author."
SPDX_AUTHORS_openembedded_name = "OpenEmbedded"
SPDX_AUTHORS_openembedded_type = "organization"
SPDX_BUILD_HOST[doc] = "The base variable name to describe the build host on \
which a build is running. Must be an SPDX_IMPORTS key. Requires \
SPDX_INCLUDE_BITBAKE_PARENT_BUILD. NOTE: Setting this will result in \
non-reproducible SPDX output"
SPDX_INVOKED_BY[doc] = "The base variable name to describe the Agent that \
invoked the build, which builds will link to if specified. Requires \
SPDX_INCLUDE_BITBAKE_PARENT_BUILD. NOTE: Setting this will likely result in \
non-reproducible SPDX output"
SPDX_ON_BEHALF_OF[doc] = "The base variable name to describe the Agent on who's \
behalf the invoking Agent (SPDX_INVOKED_BY) is running the build. Requires \
SPDX_INCLUDE_BITBAKE_PARENT_BUILD. NOTE: Setting this will likely result in \
non-reproducible SPDX output"
SPDX_PACKAGE_SUPPLIER[doc] = "The base variable name to describe the Agent who \
is supplying artifacts produced by the build"
SPDX_PACKAGE_VERSION ??= "${PV}"
SPDX_PACKAGE_VERSION[doc] = "The version of a package, software_packageVersion \
in software_Package"
SPDX_PACKAGE_URL ??= ""
SPDX_PACKAGE_URL[doc] = "Provides a place for the SPDX data creator to record \
the package URL string (in accordance with the Package URL specification) for \
a software Package."
IMAGE_CLASSES:append = " create-spdx-image-3.0"
SDK_CLASSES += "create-spdx-sdk-3.0"
oe.spdx30_tasks.set_timestamp_now[vardepsexclude] = "SPDX_INCLUDE_TIMESTAMPS"
oe.spdx30_tasks.get_package_sources_from_debug[vardepsexclude] += "STAGING_KERNEL_DIR"
oe.spdx30_tasks.collect_dep_objsets[vardepsexclude] = "SPDX_MULTILIB_SSTATE_ARCHS"
# SPDX library code makes heavy use of classes, which bitbake cannot easily
# parse out dependencies. As such, the library code files that make use of
# classes are explicitly added as file checksum dependencies.
SPDX3_LIB_DEP_FILES = "\
${COREBASE}/meta/lib/oe/sbom30.py:True \
${COREBASE}/meta/lib/oe/spdx30.py:True \
"
python do_create_spdx() {
import oe.spdx30_tasks
oe.spdx30_tasks.create_spdx(d)
}
do_create_spdx[vardeps] += "\
SPDX_INCLUDE_BITBAKE_PARENT_BUILD \
SPDX_PACKAGE_ADDITIONAL_PURPOSE \
SPDX_PROFILES \
SPDX_NAMESPACE_PREFIX \
SPDX_UUID_NAMESPACE \
"
addtask do_create_spdx after \
do_collect_spdx_deps \
do_deploy_source_date_epoch \
do_populate_sysroot do_package do_packagedata \
before do_populate_sdk do_populate_sdk_ext do_build do_rm_work
SSTATETASKS += "do_create_spdx"
do_create_spdx[sstate-inputdirs] = "${SPDXDEPLOY}"
do_create_spdx[sstate-outputdirs] = "${DEPLOY_DIR_SPDX}"
do_create_spdx[file-checksums] += "${SPDX3_LIB_DEP_FILES}"
python do_create_spdx_setscene () {
sstate_setscene(d)
}
addtask do_create_spdx_setscene
do_create_spdx[dirs] = "${SPDXWORK}"
do_create_spdx[cleandirs] = "${SPDXDEPLOY} ${SPDXWORK}"
do_create_spdx[depends] += " \
${PATCHDEPENDENCY} \
${@create_spdx_source_deps(d)} \
"
python do_create_package_spdx() {
import oe.spdx30_tasks
oe.spdx30_tasks.create_package_spdx(d)
}
oe.spdx30_tasks.create_package_spdx[vardepsexclude] = "OVERRIDES"
addtask do_create_package_spdx after do_create_spdx before do_build do_rm_work
SSTATETASKS += "do_create_package_spdx"
do_create_package_spdx[sstate-inputdirs] = "${SPDXRUNTIMEDEPLOY}"
do_create_package_spdx[sstate-outputdirs] = "${DEPLOY_DIR_SPDX}"
do_create_package_spdx[file-checksums] += "${SPDX3_LIB_DEP_FILES}"
python do_create_package_spdx_setscene () {
sstate_setscene(d)
}
addtask do_create_package_spdx_setscene
do_create_package_spdx[dirs] = "${SPDXRUNTIMEDEPLOY}"
do_create_package_spdx[cleandirs] = "${SPDXRUNTIMEDEPLOY}"
do_create_package_spdx[rdeptask] = "do_create_spdx"
python spdx30_build_started_handler () {
import oe.spdx30_tasks
d = e.data.createCopy()
oe.spdx30_tasks.write_bitbake_spdx(d)
}
addhandler spdx30_build_started_handler
spdx30_build_started_handler[eventmask] = "bb.event.BuildStarted"

View File

@@ -107,21 +107,8 @@ CVE_CHECK_LAYER_INCLUDELIST ??= ""
CVE_VERSION_SUFFIX ??= ""
python () {
# Fallback all CVEs from CVE_CHECK_IGNORE to CVE_STATUS
cve_check_ignore = d.getVar("CVE_CHECK_IGNORE")
if cve_check_ignore:
bb.warn("CVE_CHECK_IGNORE is deprecated in favor of CVE_STATUS")
for cve in (d.getVar("CVE_CHECK_IGNORE") or "").split():
d.setVarFlag("CVE_STATUS", cve, "ignored")
# Process CVE_STATUS_GROUPS to set multiple statuses and optional detail or description at once
for cve_status_group in (d.getVar("CVE_STATUS_GROUPS") or "").split():
cve_group = d.getVar(cve_status_group)
if cve_group is not None:
for cve in cve_group.split():
d.setVarFlag("CVE_STATUS", cve, d.getVarFlag(cve_status_group, "status"))
else:
bb.warn("CVE_STATUS_GROUPS contains undefined variable %s" % cve_status_group)
from oe.cve_check import extend_cve_status
extend_cve_status(d)
}
def generate_json_report(d, out_path, link_path):

View File

@@ -0,0 +1,104 @@
#
# Copyright OpenEmbedded Contributors
#
# SPDX-License-Identifier: GPL-2.0-only
#
SPDX_VERSION ??= ""
DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx/${SPDX_VERSION}"
# The product name that the CVE database uses. Defaults to BPN, but may need to
# be overriden per recipe (for example tiff.bb sets CVE_PRODUCT=libtiff).
CVE_PRODUCT ??= "${BPN}"
CVE_VERSION ??= "${PV}"
SPDXDIR ??= "${WORKDIR}/spdx/${SPDX_VERSION}"
SPDXDEPLOY = "${SPDXDIR}/deploy"
SPDXWORK = "${SPDXDIR}/work"
SPDXIMAGEWORK = "${SPDXDIR}/image-work"
SPDXSDKWORK = "${SPDXDIR}/sdk-work"
SPDXSDKEXTWORK = "${SPDXDIR}/sdk-ext-work"
SPDXDEPS = "${SPDXDIR}/deps.json"
SPDX_TOOL_NAME ??= "oe-spdx-creator"
SPDX_TOOL_VERSION ??= "1.0"
SPDXRUNTIMEDEPLOY = "${SPDXDIR}/runtime-deploy"
SPDX_INCLUDE_SOURCES ??= "0"
SPDX_UUID_NAMESPACE ??= "sbom.openembedded.org"
SPDX_NAMESPACE_PREFIX ??= "http://spdx.org/spdxdocs"
SPDX_PRETTY ??= "0"
SPDX_LICENSES ??= "${COREBASE}/meta/files/spdx-licenses.json"
SPDX_CUSTOM_ANNOTATION_VARS ??= ""
SPDX_MULTILIB_SSTATE_ARCHS ??= "${SSTATE_ARCHS}"
python () {
from oe.cve_check import extend_cve_status
extend_cve_status(d)
}
def create_spdx_source_deps(d):
import oe.spdx_common
deps = []
if d.getVar("SPDX_INCLUDE_SOURCES") == "1":
pn = d.getVar('PN')
# do_unpack is a hack for now; we only need it to get the
# dependencies do_unpack already has so we can extract the source
# ourselves
if oe.spdx_common.has_task(d, "do_unpack"):
deps.append("%s:do_unpack" % pn)
if oe.spdx_common.is_work_shared_spdx(d) and \
oe.spdx_common.process_sources(d):
# For kernel source code
if oe.spdx_common.has_task(d, "do_shared_workdir"):
deps.append("%s:do_shared_workdir" % pn)
elif d.getVar('S') == d.getVar('STAGING_KERNEL_DIR'):
deps.append("virtual/kernel:do_shared_workdir")
# For gcc-source-${PV} source code
if oe.spdx_common.has_task(d, "do_preconfigure"):
deps.append("%s:do_preconfigure" % pn)
elif oe.spdx_common.has_task(d, "do_patch"):
deps.append("%s:do_patch" % pn)
# For gcc-cross-x86_64 source code
elif oe.spdx_common.has_task(d, "do_configure"):
deps.append("%s:do_configure" % pn)
return " ".join(deps)
python do_collect_spdx_deps() {
# This task calculates the build time dependencies of the recipe, and is
# required because while a task can deptask on itself, those dependencies
# do not show up in BB_TASKDEPDATA. To work around that, this task does the
# deptask on do_create_spdx and writes out the dependencies it finds, then
# do_create_spdx reads in the found dependencies when writing the actual
# SPDX document
import json
import oe.spdx_common
from pathlib import Path
spdx_deps_file = Path(d.getVar("SPDXDEPS"))
deps = oe.spdx_common.collect_direct_deps(d, "do_create_spdx")
with spdx_deps_file.open("w") as f:
json.dump(deps, f)
}
# NOTE: depending on do_unpack is a hack that is necessary to get it's dependencies for archive the source
addtask do_collect_spdx_deps after do_unpack
do_collect_spdx_deps[depends] += "${PATCHDEPENDENCY}"
do_collect_spdx_deps[deptask] = "do_create_spdx"
do_collect_spdx_deps[dirs] = "${SPDXDIR}"
oe.spdx_common.collect_direct_deps[vardepsexclude] += "BB_TASKDEPDATA"
oe.spdx_common.collect_direct_deps[vardeps] += "DEPENDS"
oe.spdx_common.collect_package_providers[vardepsexclude] += "BB_TASKDEPDATA"
oe.spdx_common.get_patched_src[vardepsexclude] += "STAGING_KERNEL_DIR"

319
meta/classes/vex.bbclass Normal file
View File

@@ -0,0 +1,319 @@
#
# Copyright OpenEmbedded Contributors
#
# SPDX-License-Identifier: MIT
#
# This class is used to generate metadata needed by external
# tools to check for vulnerabilities, for example CVEs.
#
# In order to use this class just inherit the class in the
# local.conf file and it will add the generate_vex task for
# every recipe. If an image is build it will generate a report
# in DEPLOY_DIR_IMAGE for all the packages used, it will also
# generate a file for all recipes used in the build.
#
# Variables use CVE_CHECK prefix to keep compatibility with
# the cve-check class
#
# Example:
# bitbake -c generate_vex openssl
# bitbake core-image-sato
# bitbake -k -c generate_vex universe
#
# The product name that the CVE database uses defaults to BPN, but may need to
# be overriden per recipe (for example tiff.bb sets CVE_PRODUCT=libtiff).
CVE_PRODUCT ??= "${BPN}"
CVE_VERSION ??= "${PV}"
CVE_CHECK_SUMMARY_DIR ?= "${LOG_DIR}/cve"
CVE_CHECK_SUMMARY_FILE_NAME_JSON = "cve-summary.json"
CVE_CHECK_SUMMARY_INDEX_PATH = "${CVE_CHECK_SUMMARY_DIR}/cve-summary-index.txt"
CVE_CHECK_DIR ??= "${DEPLOY_DIR}/cve"
CVE_CHECK_RECIPE_FILE_JSON ?= "${CVE_CHECK_DIR}/${PN}_cve.json"
CVE_CHECK_MANIFEST_JSON ?= "${IMGDEPLOYDIR}/${IMAGE_NAME}.json"
# Skip CVE Check for packages (PN)
CVE_CHECK_SKIP_RECIPE ?= ""
# Replace NVD DB check status for a given CVE. Each of CVE has to be mentioned
# separately with optional detail and description for this status.
#
# CVE_STATUS[CVE-1234-0001] = "not-applicable-platform: Issue only applies on Windows"
# CVE_STATUS[CVE-1234-0002] = "fixed-version: Fixed externally"
#
# Settings the same status and reason for multiple CVEs is possible
# via CVE_STATUS_GROUPS variable.
#
# CVE_STATUS_GROUPS = "CVE_STATUS_WIN CVE_STATUS_PATCHED"
#
# CVE_STATUS_WIN = "CVE-1234-0001 CVE-1234-0003"
# CVE_STATUS_WIN[status] = "not-applicable-platform: Issue only applies on Windows"
# CVE_STATUS_PATCHED = "CVE-1234-0002 CVE-1234-0004"
# CVE_STATUS_PATCHED[status] = "fixed-version: Fixed externally"
#
# All possible CVE statuses could be found in cve-check-map.conf
# CVE_CHECK_STATUSMAP[not-applicable-platform] = "Ignored"
# CVE_CHECK_STATUSMAP[fixed-version] = "Patched"
#
# CVE_CHECK_IGNORE is deprecated and CVE_STATUS has to be used instead.
# Keep CVE_CHECK_IGNORE until other layers migrate to new variables
CVE_CHECK_IGNORE ?= ""
# Layers to be excluded
CVE_CHECK_LAYER_EXCLUDELIST ??= ""
# Layers to be included
CVE_CHECK_LAYER_INCLUDELIST ??= ""
# set to "alphabetical" for version using single alphabetical character as increment release
CVE_VERSION_SUFFIX ??= ""
python () {
if bb.data.inherits_class("cve-check", d):
raise bb.parse.SkipRecipe("Skipping recipe: found incompatible combination of cve-check and vex enabled at the same time.")
from oe.cve_check import extend_cve_status
extend_cve_status(d)
}
def generate_json_report(d, out_path, link_path):
if os.path.exists(d.getVar("CVE_CHECK_SUMMARY_INDEX_PATH")):
import json
from oe.cve_check import cve_check_merge_jsons, update_symlinks
bb.note("Generating JSON CVE summary")
index_file = d.getVar("CVE_CHECK_SUMMARY_INDEX_PATH")
summary = {"version":"1", "package": []}
with open(index_file) as f:
filename = f.readline()
while filename:
with open(filename.rstrip()) as j:
data = json.load(j)
cve_check_merge_jsons(summary, data)
filename = f.readline()
summary["package"].sort(key=lambda d: d['name'])
with open(out_path, "w") as f:
json.dump(summary, f, indent=2)
update_symlinks(out_path, link_path)
python vex_save_summary_handler () {
import shutil
import datetime
from oe.cve_check import update_symlinks
cvelogpath = d.getVar("CVE_CHECK_SUMMARY_DIR")
bb.utils.mkdirhier(cvelogpath)
timestamp = datetime.datetime.now().strftime('%Y%m%d%H%M%S')
json_summary_link_name = os.path.join(cvelogpath, d.getVar("CVE_CHECK_SUMMARY_FILE_NAME_JSON"))
json_summary_name = os.path.join(cvelogpath, "cve-summary-%s.json" % (timestamp))
generate_json_report(d, json_summary_name, json_summary_link_name)
bb.plain("Complete CVE JSON report summary created at: %s" % json_summary_link_name)
}
addhandler vex_save_summary_handler
vex_save_summary_handler[eventmask] = "bb.event.BuildCompleted"
python do_generate_vex () {
"""
Generate metadata needed for vulnerability checking for
the current recipe
"""
from oe.cve_check import get_patched_cves, decode_cve_status
cves_status = []
products = d.getVar("CVE_PRODUCT").split()
for product in products:
if ":" in product:
_, product = product.split(":", 1)
cves_status.append([product, False])
patched_cves = get_patched_cves(d)
cve_data = {}
for cve_id in (d.getVarFlags("CVE_STATUS") or {}):
mapping, detail, description = decode_cve_status(d, cve_id)
if not mapping or not detail:
bb.warn(f"Skipping {cve_id} — missing or unknown CVE status")
continue
cve_data[cve_id] = {
"abbrev-status": mapping,
"status": detail,
"justification": description
}
patched_cves.discard(cve_id)
# decode_cve_status is decoding CVE_STATUS, so patch files need to be hardcoded
for cve_id in patched_cves:
# fix-file-included is not available in scarthgap
cve_data[cve_id] = {
"abbrev-status": "Patched",
"status": "backported-patch",
}
cve_write_data_json(d, cve_data, cves_status)
}
addtask generate_vex before do_build
python vex_cleanup () {
"""
Delete the file used to gather all the CVE information.
"""
bb.utils.remove(e.data.getVar("CVE_CHECK_SUMMARY_INDEX_PATH"))
}
addhandler vex_cleanup
vex_cleanup[eventmask] = "bb.event.BuildCompleted"
python vex_write_rootfs_manifest () {
"""
Create VEX/CVE manifest when building an image
"""
import json
from oe.rootfs import image_list_installed_packages
from oe.cve_check import cve_check_merge_jsons, update_symlinks
deploy_file_json = d.getVar("CVE_CHECK_RECIPE_FILE_JSON")
if os.path.exists(deploy_file_json):
bb.utils.remove(deploy_file_json)
# Create a list of relevant recipies
recipies = set()
for pkg in list(image_list_installed_packages(d)):
pkg_info = os.path.join(d.getVar('PKGDATA_DIR'),
'runtime-reverse', pkg)
pkg_data = oe.packagedata.read_pkgdatafile(pkg_info)
recipies.add(pkg_data["PN"])
bb.note("Writing rootfs VEX manifest")
deploy_dir = d.getVar("IMGDEPLOYDIR")
link_name = d.getVar("IMAGE_LINK_NAME")
json_data = {"version":"1", "package": []}
text_data = ""
save_pn = d.getVar("PN")
for pkg in recipies:
# To be able to use the CVE_CHECK_RECIPE_FILE_JSON variable we have to evaluate
# it with the different PN names set each time.
d.setVar("PN", pkg)
pkgfilepath = d.getVar("CVE_CHECK_RECIPE_FILE_JSON")
if os.path.exists(pkgfilepath):
with open(pkgfilepath) as j:
data = json.load(j)
cve_check_merge_jsons(json_data, data)
else:
bb.warn("Missing cve file for %s" % pkg)
d.setVar("PN", save_pn)
link_path = os.path.join(deploy_dir, "%s.json" % link_name)
manifest_name = d.getVar("CVE_CHECK_MANIFEST_JSON")
with open(manifest_name, "w") as f:
json.dump(json_data, f, indent=2)
update_symlinks(manifest_name, link_path)
bb.plain("Image VEX JSON report stored in: %s" % manifest_name)
}
ROOTFS_POSTPROCESS_COMMAND:prepend = "vex_write_rootfs_manifest; "
do_rootfs[recrdeptask] += "do_generate_vex "
do_populate_sdk[recrdeptask] += "do_generate_vex "
def cve_write_data_json(d, cve_data, cve_status):
"""
Prepare CVE data for the JSON format, then write it.
Done for each recipe.
"""
from oe.cve_check import get_cpe_ids
import json
output = {"version":"1", "package": []}
nvd_link = "https://nvd.nist.gov/vuln/detail/"
fdir_name = d.getVar("FILE_DIRNAME")
layer = fdir_name.split("/")[-3]
include_layers = d.getVar("CVE_CHECK_LAYER_INCLUDELIST").split()
exclude_layers = d.getVar("CVE_CHECK_LAYER_EXCLUDELIST").split()
if exclude_layers and layer in exclude_layers:
return
if include_layers and layer not in include_layers:
return
product_data = []
for s in cve_status:
p = {"product": s[0], "cvesInRecord": "Yes"}
if s[1] == False:
p["cvesInRecord"] = "No"
product_data.append(p)
product_data = list({p['product']:p for p in product_data}.values())
package_version = "%s%s" % (d.getVar("EXTENDPE"), d.getVar("PV"))
cpes = get_cpe_ids(d.getVar("CVE_PRODUCT"), d.getVar("CVE_VERSION"))
package_data = {
"name" : d.getVar("PN"),
"layer" : layer,
"version" : package_version,
"products": product_data,
"cpes": cpes
}
cve_list = []
for cve in sorted(cve_data):
issue_link = "%s%s" % (nvd_link, cve)
cve_item = {
"id" : cve,
"status" : cve_data[cve]["abbrev-status"],
"link": issue_link,
}
if 'NVD-summary' in cve_data[cve]:
cve_item["summary"] = cve_data[cve]["NVD-summary"]
cve_item["scorev2"] = cve_data[cve]["NVD-scorev2"]
cve_item["scorev3"] = cve_data[cve]["NVD-scorev3"]
cve_item["vector"] = cve_data[cve]["NVD-vector"]
cve_item["vectorString"] = cve_data[cve]["NVD-vectorString"]
if 'status' in cve_data[cve]:
cve_item["detail"] = cve_data[cve]["status"]
if 'justification' in cve_data[cve]:
cve_item["description"] = cve_data[cve]["justification"]
if 'resource' in cve_data[cve]:
cve_item["patch-file"] = cve_data[cve]["resource"]
cve_list.append(cve_item)
package_data["issue"] = cve_list
output["package"].append(package_data)
deploy_file = d.getVar("CVE_CHECK_RECIPE_FILE_JSON")
write_string = json.dumps(output, indent=2)
cvelogpath = d.getVar("CVE_CHECK_SUMMARY_DIR")
index_path = d.getVar("CVE_CHECK_SUMMARY_INDEX_PATH")
bb.utils.mkdirhier(cvelogpath)
bb.utils.mkdirhier(os.path.dirname(deploy_file))
fragment_file = os.path.basename(deploy_file)
fragment_path = os.path.join(cvelogpath, fragment_file)
with open(fragment_path, "w") as f:
f.write(write_string)
with open(deploy_file, "w") as f:
f.write(write_string)
with open(index_path, "a+") as f:
f.write("%s\n" % fragment_path)

View File

@@ -9,4 +9,4 @@ __path__ = extend_path(__path__, __name__)
BBIMPORTS = ["data", "path", "utils", "types", "package", "packagedata", \
"packagegroup", "sstatesig", "lsb", "cachedpath", "license", \
"qa", "reproducible", "rust", "buildcfg", "go"]
"qa", "reproducible", "rust", "buildcfg", "go", "spdx30_tasks", "spdx_common"]

View File

@@ -243,3 +243,25 @@ def decode_cve_status(d, cve):
status_mapping = "Unpatched"
return (status_mapping, detail, description)
def extend_cve_status(d):
# do this only once in case multiple classes use this
if d.getVar("CVE_STATUS_EXTENDED"):
return
d.setVar("CVE_STATUS_EXTENDED", "1")
# Fallback all CVEs from CVE_CHECK_IGNORE to CVE_STATUS
cve_check_ignore = d.getVar("CVE_CHECK_IGNORE")
if cve_check_ignore:
bb.warn("CVE_CHECK_IGNORE is deprecated in favor of CVE_STATUS")
for cve in (d.getVar("CVE_CHECK_IGNORE") or "").split():
d.setVarFlag("CVE_STATUS", cve, "ignored")
# Process CVE_STATUS_GROUPS to set multiple statuses and optional detail or description at once
for cve_status_group in (d.getVar("CVE_STATUS_GROUPS") or "").split():
cve_group = d.getVar(cve_status_group)
if cve_group is not None:
for cve in cve_group.split():
d.setVarFlag("CVE_STATUS", cve, d.getVarFlag(cve_status_group, "status"))
else:
bb.warn("CVE_STATUS_GROUPS contains undefined variable %s" % cve_status_group)

View File

@@ -7,6 +7,7 @@
import ast
import re
import oe.qa
from fnmatch import fnmatchcase as fnmatch
def license_ok(license, dont_want_licenses):
@@ -259,3 +260,205 @@ def apply_pkg_license_exception(pkg, bad_licenses, exceptions):
"""Return remaining bad licenses after removing any package exceptions"""
return [lic for lic in bad_licenses if pkg + ':' + lic not in exceptions]
def return_spdx(d, license):
"""
This function returns the spdx mapping of a license if it exists.
"""
return d.getVarFlag('SPDXLICENSEMAP', license)
def canonical_license(d, license):
"""
Return the canonical (SPDX) form of the license if available (so GPLv3
becomes GPL-3.0-only) or the passed license if there is no canonical form.
"""
return d.getVarFlag('SPDXLICENSEMAP', license) or license
def expand_wildcard_licenses(d, wildcard_licenses):
"""
There are some common wildcard values users may want to use. Support them
here.
"""
licenses = set(wildcard_licenses)
mapping = {
"AGPL-3.0*" : ["AGPL-3.0-only", "AGPL-3.0-or-later"],
"GPL-3.0*" : ["GPL-3.0-only", "GPL-3.0-or-later"],
"LGPL-3.0*" : ["LGPL-3.0-only", "LGPL-3.0-or-later"],
}
for k in mapping:
if k in wildcard_licenses:
licenses.remove(k)
for item in mapping[k]:
licenses.add(item)
for l in licenses:
if l in obsolete_license_list():
bb.fatal("Error, %s is an obsolete license, please use an SPDX reference in INCOMPATIBLE_LICENSE" % l)
if "*" in l:
bb.fatal("Error, %s is an invalid license wildcard entry" % l)
return list(licenses)
def incompatible_license_contains(license, truevalue, falsevalue, d):
license = canonical_license(d, license)
bad_licenses = (d.getVar('INCOMPATIBLE_LICENSE') or "").split()
bad_licenses = expand_wildcard_licenses(d, bad_licenses)
return truevalue if license in bad_licenses else falsevalue
def incompatible_pkg_license(d, dont_want_licenses, license):
# Handles an "or" or two license sets provided by
# flattened_licenses(), pick one that works if possible.
def choose_lic_set(a, b):
return a if all(license_ok(canonical_license(d, lic),
dont_want_licenses) for lic in a) else b
try:
licenses = flattened_licenses(license, choose_lic_set)
except LicenseError as exc:
bb.fatal('%s: %s' % (d.getVar('P'), exc))
incompatible_lic = []
for l in licenses:
license = canonical_license(d, l)
if not license_ok(license, dont_want_licenses):
incompatible_lic.append(license)
return sorted(incompatible_lic)
def incompatible_license(d, dont_want_licenses, package=None):
"""
This function checks if a recipe has only incompatible licenses. It also
take into consideration 'or' operand. dont_want_licenses should be passed
as canonical (SPDX) names.
"""
license = d.getVar("LICENSE:%s" % package) if package else None
if not license:
license = d.getVar('LICENSE')
return incompatible_pkg_license(d, dont_want_licenses, license)
def check_license_flags(d):
"""
This function checks if a recipe has any LICENSE_FLAGS that
aren't acceptable.
If it does, it returns the all LICENSE_FLAGS missing from the list
of acceptable license flags, or all of the LICENSE_FLAGS if there
is no list of acceptable flags.
If everything is is acceptable, it returns None.
"""
def license_flag_matches(flag, acceptlist, pn):
"""
Return True if flag matches something in acceptlist, None if not.
Before we test a flag against the acceptlist, we append _${PN}
to it. We then try to match that string against the
acceptlist. This covers the normal case, where we expect
LICENSE_FLAGS to be a simple string like 'commercial', which
the user typically matches exactly in the acceptlist by
explicitly appending the package name e.g 'commercial_foo'.
If we fail the match however, we then split the flag across
'_' and append each fragment and test until we either match or
run out of fragments.
"""
flag_pn = ("%s_%s" % (flag, pn))
for candidate in acceptlist:
if flag_pn == candidate:
return True
flag_cur = ""
flagments = flag_pn.split("_")
flagments.pop() # we've already tested the full string
for flagment in flagments:
if flag_cur:
flag_cur += "_"
flag_cur += flagment
for candidate in acceptlist:
if flag_cur == candidate:
return True
return False
def all_license_flags_match(license_flags, acceptlist):
""" Return all unmatched flags, None if all flags match """
pn = d.getVar('PN')
split_acceptlist = acceptlist.split()
flags = []
for flag in license_flags.split():
if not license_flag_matches(flag, split_acceptlist, pn):
flags.append(flag)
return flags if flags else None
license_flags = d.getVar('LICENSE_FLAGS')
if license_flags:
acceptlist = d.getVar('LICENSE_FLAGS_ACCEPTED')
if not acceptlist:
return license_flags.split()
unmatched_flags = all_license_flags_match(license_flags, acceptlist)
if unmatched_flags:
return unmatched_flags
return None
def check_license_format(d):
"""
This function checks if LICENSE is well defined,
Validate operators in LICENSES.
No spaces are allowed between LICENSES.
"""
pn = d.getVar('PN')
licenses = d.getVar('LICENSE')
elements = list(filter(lambda x: x.strip(), license_operator.split(licenses)))
for pos, element in enumerate(elements):
if license_pattern.match(element):
if pos > 0 and license_pattern.match(elements[pos - 1]):
oe.qa.handle_error('license-format',
'%s: LICENSE value "%s" has an invalid format - license names ' \
'must be separated by the following characters to indicate ' \
'the license selection: %s' %
(pn, licenses, license_operator_chars), d)
elif not license_operator.match(element):
oe.qa.handle_error('license-format',
'%s: LICENSE value "%s" has an invalid separator "%s" that is not ' \
'in the valid list of separators (%s)' %
(pn, licenses, element, license_operator_chars), d)
def skip_incompatible_package_licenses(d, pkgs):
if not pkgs:
return {}
pn = d.getVar("PN")
check_license = False if pn.startswith("nativesdk-") else True
for t in ["-native", "-cross-${TARGET_ARCH}", "-cross-initial-${TARGET_ARCH}",
"-crosssdk-${SDK_SYS}", "-crosssdk-initial-${SDK_SYS}",
"-cross-canadian-${TRANSLATED_TARGET_ARCH}"]:
if pn.endswith(d.expand(t)):
check_license = False
if pn.startswith("gcc-source-"):
check_license = False
bad_licenses = (d.getVar('INCOMPATIBLE_LICENSE') or "").split()
if not check_license or not bad_licenses:
return {}
bad_licenses = expand_wildcard_licenses(d, bad_licenses)
exceptions = (d.getVar("INCOMPATIBLE_LICENSE_EXCEPTIONS") or "").split()
for lic_exception in exceptions:
if ":" in lic_exception:
lic_exception = lic_exception.split(":")[1]
if lic_exception in obsolete_license_list():
bb.fatal("Obsolete license %s used in INCOMPATIBLE_LICENSE_EXCEPTIONS" % lic_exception)
skipped_pkgs = {}
for pkg in pkgs:
remaining_bad_licenses = apply_pkg_license_exception(pkg, bad_licenses, exceptions)
incompatible_lic = incompatible_license(d, remaining_bad_licenses, pkg)
if incompatible_lic:
skipped_pkgs[pkg] = incompatible_lic
return skipped_pkgs

1096
meta/lib/oe/sbom30.py Normal file

File diff suppressed because it is too large Load Diff

View File

@@ -148,7 +148,8 @@ def get_extra_sdkinfo(sstate_dir):
extra_info['filesizes'] = {}
for root, _, files in os.walk(sstate_dir):
for fn in files:
if fn.endswith('.tgz'):
# Note that this makes an assumption about the sstate filenames
if '.tar.' in fn and not fn.endswith('.siginfo'):
fsize = int(math.ceil(float(os.path.getsize(os.path.join(root, fn))) / 1024))
task = fn.rsplit(':',1)[1].split('_',1)[1].split(',')[0]
origtotal = extra_info['tasksizes'].get(task, 0)

5593
meta/lib/oe/spdx30.py Normal file

File diff suppressed because it is too large Load Diff

1381
meta/lib/oe/spdx30_tasks.py Normal file

File diff suppressed because it is too large Load Diff

244
meta/lib/oe/spdx_common.py Normal file
View File

@@ -0,0 +1,244 @@
#
# Copyright OpenEmbedded Contributors
#
# SPDX-License-Identifier: GPL-2.0-only
#
import bb
import collections
import json
import oe.packagedata
import re
import shutil
from pathlib import Path
from dataclasses import dataclass
LIC_REGEX = re.compile(
rb"^\W*SPDX-License-Identifier:\s*([ \w\d.()+-]+?)(?:\s+\W*)?$",
re.MULTILINE,
)
def extract_licenses(filename):
"""
Extract SPDX License identifiers from a file
"""
try:
with open(filename, "rb") as f:
size = min(15000, os.stat(filename).st_size)
txt = f.read(size)
licenses = re.findall(LIC_REGEX, txt)
if licenses:
ascii_licenses = [lic.decode("ascii") for lic in licenses]
return ascii_licenses
except Exception as e:
bb.warn(f"Exception reading {filename}: {e}")
return []
def is_work_shared_spdx(d):
return '/work-shared/' in d.getVar('S')
def load_spdx_license_data(d):
with open(d.getVar("SPDX_LICENSES"), "r") as f:
data = json.load(f)
# Transform the license array to a dictionary
data["licenses"] = {l["licenseId"]: l for l in data["licenses"]}
return data
def process_sources(d):
"""
Returns True if the sources for this recipe should be included in the SPDX
or False if not
"""
pn = d.getVar("PN")
assume_provided = (d.getVar("ASSUME_PROVIDED") or "").split()
if pn in assume_provided:
for p in d.getVar("PROVIDES").split():
if p != pn:
pn = p
break
# glibc-locale: do_fetch, do_unpack and do_patch tasks have been deleted,
# so avoid archiving source here.
if pn.startswith("glibc-locale"):
return False
if d.getVar("PN") == "libtool-cross":
return False
if d.getVar("PN") == "libgcc-initial":
return False
if d.getVar("PN") == "shadow-sysroot":
return False
return True
@dataclass(frozen=True)
class Dep(object):
pn: str
hashfn: str
in_taskhash: bool
def collect_direct_deps(d, dep_task):
"""
Find direct dependencies of current task
Returns the list of recipes that have a dep_task that the current task
depends on
"""
current_task = "do_" + d.getVar("BB_CURRENTTASK")
pn = d.getVar("PN")
taskdepdata = d.getVar("BB_TASKDEPDATA", False)
for this_dep in taskdepdata.values():
if this_dep[0] == pn and this_dep[1] == current_task:
break
else:
bb.fatal(f"Unable to find this {pn}:{current_task} in taskdepdata")
deps = set()
for dep_name in this_dep.deps:
dep_data = taskdepdata[dep_name]
if dep_data.taskname == dep_task and dep_data.pn != pn:
deps.add((dep_data.pn, dep_data.hashfn, dep_name in this_dep.taskhash_deps))
return sorted(deps)
def get_spdx_deps(d):
"""
Reads the SPDX dependencies JSON file and returns the data
"""
spdx_deps_file = Path(d.getVar("SPDXDEPS"))
deps = []
with spdx_deps_file.open("r") as f:
for d in json.load(f):
deps.append(Dep(*d))
return deps
def collect_package_providers(d):
"""
Returns a dictionary where each RPROVIDES is mapped to the package that
provides it
"""
deploy_dir_spdx = Path(d.getVar("DEPLOY_DIR_SPDX"))
providers = {}
deps = collect_direct_deps(d, "do_create_spdx")
deps.append((d.getVar("PN"), d.getVar("BB_HASHFILENAME"), True))
for dep_pn, dep_hashfn, _ in deps:
localdata = d
recipe_data = oe.packagedata.read_pkgdata(dep_pn, localdata)
if not recipe_data:
localdata = bb.data.createCopy(d)
localdata.setVar("PKGDATA_DIR", "${PKGDATA_DIR_SDK}")
recipe_data = oe.packagedata.read_pkgdata(dep_pn, localdata)
for pkg in recipe_data.get("PACKAGES", "").split():
pkg_data = oe.packagedata.read_subpkgdata_dict(pkg, localdata)
rprovides = set(
n
for n, _ in bb.utils.explode_dep_versions2(
pkg_data.get("RPROVIDES", "")
).items()
)
rprovides.add(pkg)
if "PKG" in pkg_data:
pkg = pkg_data["PKG"]
rprovides.add(pkg)
for r in rprovides:
providers[r] = (pkg, dep_hashfn)
return providers
def get_patched_src(d):
"""
Save patched source of the recipe in SPDX_WORKDIR.
"""
spdx_workdir = d.getVar("SPDXWORK")
spdx_sysroot_native = d.getVar("STAGING_DIR_NATIVE")
pn = d.getVar("PN")
workdir = d.getVar("WORKDIR")
try:
# The kernel class functions require it to be on work-shared, so we dont change WORKDIR
if not is_work_shared_spdx(d):
# Change the WORKDIR to make do_unpack do_patch run in another dir.
d.setVar("WORKDIR", spdx_workdir)
# Restore the original path to recipe's native sysroot (it's relative to WORKDIR).
d.setVar("STAGING_DIR_NATIVE", spdx_sysroot_native)
# The changed 'WORKDIR' also caused 'B' changed, create dir 'B' for the
# possibly requiring of the following tasks (such as some recipes's
# do_patch required 'B' existed).
bb.utils.mkdirhier(d.getVar("B"))
bb.build.exec_func("do_unpack", d)
if d.getVar("SRC_URI") != "":
if bb.data.inherits_class('dos2unix', d):
bb.build.exec_func('do_convert_crlf_to_lf', d)
bb.build.exec_func("do_patch", d)
# Copy source from work-share to spdx_workdir
if is_work_shared_spdx(d):
share_src = d.getVar('S')
d.setVar("WORKDIR", spdx_workdir)
d.setVar("STAGING_DIR_NATIVE", spdx_sysroot_native)
# Copy source to ${SPDXWORK}, same basename dir of ${S};
src_dir = (
spdx_workdir
+ "/"
+ os.path.basename(share_src)
)
# For kernel souce, rename suffix dir 'kernel-source'
# to ${BP} (${BPN}-${PV})
if bb.data.inherits_class("kernel", d):
src_dir = spdx_workdir + "/" + d.getVar('BP')
bb.note(f"copyhardlinktree {share_src} to {src_dir}")
oe.path.copyhardlinktree(share_src, src_dir)
# Some userland has no source.
if not os.path.exists(spdx_workdir):
bb.utils.mkdirhier(spdx_workdir)
finally:
d.setVar("WORKDIR", workdir)
def has_task(d, task):
return bool(d.getVarFlag(task, "task", False)) and not bool(d.getVarFlag(task, "noexec", False))
def fetch_data_to_uri(fd, name):
"""
Translates a bitbake FetchData to a string URI
"""
uri = fd.type
# Map gitsm to git, since gitsm:// is not a valid URI protocol
if uri == "gitsm":
uri = "git"
proto = getattr(fd, "proto", None)
if proto is not None:
uri = uri + "+" + proto
uri = uri + "://" + fd.host + fd.path
if fd.method.supports_srcrev():
uri = uri + "@" + fd.revisions[name]
return uri

View File

@@ -0,0 +1,7 @@
package main
import "fmt"
func main() {
fmt.Println("Hello from Go!")
}

View File

@@ -4,10 +4,76 @@
# SPDX-License-Identifier: MIT
#
import os
from oeqa.runtime.case import OERuntimeTestCase
from oeqa.core.decorator.depends import OETestDepends
from oeqa.runtime.decorator.package import OEHasPackage
class GoCompileTest(OERuntimeTestCase):
@classmethod
def setUp(cls):
dst = '/tmp/'
src = os.path.join(cls.tc.files_dir, 'test.go')
cls.tc.target.copyTo(src, dst)
@classmethod
def tearDown(cls):
files = '/tmp/test.go /tmp/test'
cls.tc.target.run('rm %s' % files)
dirs = '/tmp/hello-go'
cls.tc.target.run('rm -r %s' % dirs)
@OETestDepends(['ssh.SSHTest.test_ssh'])
@OEHasPackage('go')
@OEHasPackage('go-runtime')
@OEHasPackage('go-runtime-dev')
def test_go_compile(self):
# Check if go is available
status, output = self.target.run('which go')
if status != 0:
self.skipTest('go command not found, output: %s' % output)
# Compile the simple Go program
status, output = self.target.run('go build -o /tmp/test /tmp/test.go')
msg = 'go compile failed, output: %s' % output
self.assertEqual(status, 0, msg=msg)
# Run the compiled program
status, output = self.target.run('/tmp/test')
msg = 'running compiled file failed, output: %s' % output
self.assertEqual(status, 0, msg=msg)
@OETestDepends(['ssh.SSHTest.test_ssh'])
@OEHasPackage('go')
@OEHasPackage('go-runtime')
@OEHasPackage('go-runtime-dev')
def test_go_module(self):
# Check if go is available
status, output = self.target.run('which go')
if status != 0:
self.skipTest('go command not found, output: %s' % output)
# Create a simple Go module
status, output = self.target.run('mkdir -p /tmp/hello-go')
msg = 'mkdir failed, output: %s' % output
self.assertEqual(status, 0, msg=msg)
# Copy the existing test.go file to the module
status, output = self.target.run('cp /tmp/test.go /tmp/hello-go/main.go')
msg = 'copying test.go failed, output: %s' % output
self.assertEqual(status, 0, msg=msg)
# Build the module
status, output = self.target.run('cd /tmp/hello-go && go build -o hello main.go')
msg = 'go build failed, output: %s' % output
self.assertEqual(status, 0, msg=msg)
# Run the module
status, output = self.target.run('cd /tmp/hello-go && ./hello')
msg = 'running go module failed, output: %s' % output
self.assertEqual(status, 0, msg=msg)
class GoHelloworldTest(OERuntimeTestCase):
@OETestDepends(['ssh.SSHTest.test_ssh'])
@OEHasPackage(['go-helloworld'])

View File

@@ -18,6 +18,13 @@ class PingTest(OERuntimeTestCase):
output = ''
count = 0
self.assertNotEqual(len(self.target.ip), 0, msg="No target IP address set")
# If the target IP is localhost (because user-space networking is being used),
# then there's no point in pinging it.
if self.target.ip.startswith("127.0.0.") or self.target.ip in ("localhost", "::1"):
print("runtime/ping: localhost detected, not pinging")
return
try:
while count < 5:
cmd = 'ping -c 1 %s' % self.target.ip

View File

@@ -10,6 +10,7 @@ import tempfile
import unittest
from oeqa.sdk.case import OESDKTestCase
from oeqa.sdkext.context import OESDKExtTestContext
from oeqa.utils.subprocesstweak import errors_have_output
errors_have_output()
@@ -22,6 +23,9 @@ class EpoxyTest(OESDKTestCase):
if libc in [ 'newlib' ]:
raise unittest.SkipTest("MesonTest class: SDK doesn't contain a supported C library")
if isinstance(self.tc, OESDKExtTestContext):
self.skipTest(f"{self.id()} does not support eSDK (https://bugzilla.yoctoproject.org/show_bug.cgi?id=15854)")
if not (self.tc.hasHostPackage("nativesdk-meson") or
self.tc.hasHostPackage("meson-native")):
raise unittest.SkipTest("EpoxyTest class: SDK doesn't contain Meson")

View File

@@ -0,0 +1,107 @@
#
# Copyright OpenEmbedded Contributors
#
# SPDX-License-Identifier: MIT
#
import os
import shutil
import unittest
from oeqa.core.utils.path import remove_safe
from oeqa.sdk.case import OESDKTestCase
from oeqa.utils.subprocesstweak import errors_have_output
from oe.go import map_arch
errors_have_output()
class GoCompileTest(OESDKTestCase):
td_vars = ['MACHINE', 'TARGET_ARCH']
@classmethod
def setUpClass(self):
# Copy test.go file to SDK directory (same as GCC test uses files_dir)
shutil.copyfile(os.path.join(self.tc.files_dir, 'test.go'),
os.path.join(self.tc.sdk_dir, 'test.go'))
def setUp(self):
translated_target_arch = self.td.get("TRANSLATED_TARGET_ARCH")
# Check for go-cross-canadian package (uses target architecture)
if not self.tc.hasHostPackage("go-cross-canadian-%s" % translated_target_arch):
raise unittest.SkipTest("GoCompileTest class: SDK doesn't contain a Go cross-canadian toolchain")
# Additional runtime check for go command availability
try:
self._run('which go')
except Exception as e:
raise unittest.SkipTest("GoCompileTest class: go command not available: %s" % str(e))
def test_go_build(self):
"""Test Go build command (native compilation)"""
self._run('cd %s; go build -o test test.go' % self.tc.sdk_dir)
def test_go_module(self):
"""Test Go module creation and building"""
# Create a simple Go module
self._run('cd %s; go mod init hello-go' % self.tc.sdk_dir)
self._run('cd %s; go build -o hello-go' % self.tc.sdk_dir)
@classmethod
def tearDownClass(self):
files = [os.path.join(self.tc.sdk_dir, f) \
for f in ['test.go', 'test', 'hello-go', 'go.mod', 'go.sum']]
for f in files:
remove_safe(f)
class GoHostCompileTest(OESDKTestCase):
td_vars = ['MACHINE', 'SDK_SYS', 'TARGET_ARCH']
@classmethod
def setUpClass(self):
# Copy test.go file to SDK directory (same as GCC test uses files_dir)
shutil.copyfile(os.path.join(self.tc.files_dir, 'test.go'),
os.path.join(self.tc.sdk_dir, 'test.go'))
def setUp(self):
translated_target_arch = self.td.get("TRANSLATED_TARGET_ARCH")
# Check for go-cross-canadian package (uses target architecture)
if not self.tc.hasHostPackage("go-cross-canadian-%s" % translated_target_arch):
raise unittest.SkipTest("GoHostCompileTest class: SDK doesn't contain a Go cross-canadian toolchain")
# Additional runtime check for go command availability
try:
self._run('which go')
except Exception as e:
raise unittest.SkipTest("GoHostCompileTest class: go command not available: %s" % str(e))
def _get_go_arch(self):
"""Get Go architecture from SDK_SYS"""
sdksys = self.td.get("SDK_SYS")
arch = sdksys.split('-')[0]
# Use mapping for other architectures
return map_arch(arch)
def test_go_cross_compile(self):
"""Test Go cross-compilation for target"""
goarch = self._get_go_arch()
self._run('cd %s; GOOS=linux GOARCH=%s go build -o test-%s test.go' % (self.tc.sdk_dir, goarch, goarch))
def test_go_module_cross_compile(self):
"""Test Go module cross-compilation"""
goarch = self._get_go_arch()
self._run('cd %s; go mod init hello-go' % self.tc.sdk_dir)
self._run('cd %s; GOOS=linux GOARCH=%s go build -o hello-go-%s' % (self.tc.sdk_dir, goarch, goarch))
@classmethod
def tearDownClass(self):
# Clean up files with dynamic architecture names
files = [os.path.join(self.tc.sdk_dir, f) \
for f in ['test.go', 'go.mod', 'go.sum']]
# Add common architecture-specific files that might be created
common_archs = ['arm64', 'arm', 'amd64', '386', 'mips', 'mipsle', 'ppc64', 'ppc64le', 'riscv64']
for arch in common_archs:
files.extend([os.path.join(self.tc.sdk_dir, f) \
for f in ['test-%s' % arch, 'hello-go-%s' % arch]])
for f in files:
remove_safe(f)

View File

@@ -114,7 +114,8 @@ class TestSDK(TestSDKBase):
host_pkg_manifest=host_pkg_manifest, **context_args)
try:
tc.loadTests(self.context_executor_class.default_cases)
modules = (d.getVar("TESTSDK_SUITES") or "").split()
tc.loadTests(self.context_executor_class.default_cases, modules)
except Exception as e:
import traceback
bb.fatal("Loading tests failed:\n%s" % traceback.format_exc())

View File

@@ -82,7 +82,8 @@ class TestSDKExt(TestSDKBase):
host_pkg_manifest=host_pkg_manifest)
try:
tc.loadTests(OESDKExtTestContextExecutor.default_cases)
modules = (d.getVar("TESTSDK_SUITES") or "").split()
tc.loadTests(OESDKExtTestContextExecutor.default_cases, modules)
except Exception as e:
import traceback
bb.fatal("Loading tests failed:\n%s" % traceback.format_exc())

View File

@@ -476,8 +476,8 @@ class DevtoolAddTests(DevtoolBase):
version = 'v3.1.0'
pn = 'mbedtls'
# this will trigger reformat_git_uri with branch parameter in url
git_url = "'git://git@github.com/ARMmbed/mbedtls.git;branch=mbedtls-2.28;protocol=https'"
resulting_src_uri = "git://git@github.com/ARMmbed/mbedtls.git;branch=mbedtls-2.28;protocol=https"
git_url = "'git://git@github.com/Mbed-TLS/mbedtls.git;branch=archive/mbedtls-2.28;protocol=https'"
resulting_src_uri = "git://git@github.com/Mbed-TLS/mbedtls.git;branch=archive/mbedtls-2.28;protocol=https"
self._test_devtool_add_git_url(git_url, version, pn, resulting_src_uri)
def test_devtool_add_git_style2(self):
@@ -485,8 +485,8 @@ class DevtoolAddTests(DevtoolBase):
srcrev = 'v3.1.0'
pn = 'mbedtls'
# this will trigger reformat_git_uri with branch parameter in url
git_url = "'git://git@github.com/ARMmbed/mbedtls.git;protocol=https'"
resulting_src_uri = "git://git@github.com/ARMmbed/mbedtls.git;protocol=https;branch=master"
git_url = "'git://git@github.com/Mbed-TLS/mbedtls.git;protocol=https'"
resulting_src_uri = "git://git@github.com/Mbed-TLS/mbedtls.git;protocol=https;branch=master"
self._test_devtool_add_git_url(git_url, version, pn, resulting_src_uri, srcrev)
def test_devtool_add_library(self):

View File

@@ -6,29 +6,39 @@
import json
import os
import textwrap
import hashlib
from pathlib import Path
from oeqa.selftest.case import OESelftestTestCase
from oeqa.utils.commands import bitbake, get_bb_var, runCmd
from oeqa.utils.commands import bitbake, get_bb_var, get_bb_vars, runCmd
import oe.spdx30
class SPDXCheck(OESelftestTestCase):
class SPDX22Check(OESelftestTestCase):
@classmethod
def setUpClass(cls):
super(SPDXCheck, cls).setUpClass()
super().setUpClass()
bitbake("python3-spdx-tools-native")
bitbake("-c addto_recipe_sysroot python3-spdx-tools-native")
def check_recipe_spdx(self, high_level_dir, spdx_file, target_name):
config = """
INHERIT += "create-spdx"
"""
config = textwrap.dedent(
"""\
INHERIT:remove = "create-spdx"
INHERIT += "create-spdx-2.2"
"""
)
self.write_config(config)
deploy_dir = get_bb_var("DEPLOY_DIR")
machine_var = get_bb_var("MACHINE")
arch_dir = get_bb_var("PACKAGE_ARCH", target_name)
spdx_version = get_bb_var("SPDX_VERSION")
# qemux86-64 creates the directory qemux86_64
machine_dir = machine_var.replace("-", "_")
#arch_dir = arch_var.replace("-", "_")
full_file_path = os.path.join(deploy_dir, "spdx", machine_dir, high_level_dir, spdx_file)
full_file_path = os.path.join(
deploy_dir, "spdx", spdx_version, arch_dir, high_level_dir, spdx_file
)
try:
os.remove(full_file_path)
@@ -43,8 +53,13 @@ INHERIT += "create-spdx"
self.assertNotEqual(report, None)
self.assertNotEqual(report["SPDXID"], None)
python = os.path.join(get_bb_var('STAGING_BINDIR', 'python3-spdx-tools-native'), 'nativepython3')
validator = os.path.join(get_bb_var('STAGING_BINDIR', 'python3-spdx-tools-native'), 'pyspdxtools')
python = os.path.join(
get_bb_var("STAGING_BINDIR", "python3-spdx-tools-native"),
"nativepython3",
)
validator = os.path.join(
get_bb_var("STAGING_BINDIR", "python3-spdx-tools-native"), "pyspdxtools"
)
result = runCmd("{} {} -i {}".format(python, validator, filename))
self.assertExists(full_file_path)
@@ -52,3 +67,279 @@ INHERIT += "create-spdx"
def test_spdx_base_files(self):
self.check_recipe_spdx("packages", "base-files.spdx.json", "base-files")
def test_spdx_tar(self):
self.check_recipe_spdx("packages", "tar.spdx.json", "tar")
class SPDX3CheckBase(object):
"""
Base class for checking SPDX 3 based tests
"""
def check_spdx_file(self, filename):
self.assertExists(filename)
# Read the file
objset = oe.spdx30.SHACLObjectSet()
with open(filename, "r") as f:
d = oe.spdx30.JSONLDDeserializer()
d.read(f, objset)
return objset
def check_recipe_spdx(self, target_name, spdx_path, *, task=None, extraconf=""):
config = (
textwrap.dedent(
f"""\
INHERIT:remove = "create-spdx"
INHERIT += "{self.SPDX_CLASS}"
"""
)
+ textwrap.dedent(extraconf)
)
self.write_config(config)
if task:
bitbake(f"-c {task} {target_name}")
else:
bitbake(target_name)
filename = spdx_path.format(
**get_bb_vars(
[
"DEPLOY_DIR_IMAGE",
"DEPLOY_DIR_SPDX",
"MACHINE",
"MACHINE_ARCH",
"SDKMACHINE",
"SDK_DEPLOY",
"SPDX_VERSION",
"SSTATE_PKGARCH",
"TOOLCHAIN_OUTPUTNAME",
],
target_name,
)
)
return self.check_spdx_file(filename)
def check_objset_missing_ids(self, objset):
for o in objset.foreach_type(oe.spdx30.SpdxDocument):
doc = o
break
else:
self.assertTrue(False, "Unable to find SpdxDocument")
missing_ids = objset.missing_ids - set(i.externalSpdxId for i in doc.import_)
if missing_ids:
self.assertTrue(
False,
"The following SPDXIDs are unresolved:\n " + "\n ".join(missing_ids),
)
class SPDX30Check(SPDX3CheckBase, OESelftestTestCase):
SPDX_CLASS = "create-spdx-3.0"
def test_base_files(self):
self.check_recipe_spdx(
"base-files",
"{DEPLOY_DIR_SPDX}/{MACHINE_ARCH}/packages/package-base-files.spdx.json",
)
def test_gcc_include_source(self):
objset = self.check_recipe_spdx(
"gcc",
"{DEPLOY_DIR_SPDX}/{SSTATE_PKGARCH}/recipes/recipe-gcc.spdx.json",
extraconf="""\
SPDX_INCLUDE_SOURCES = "1"
""",
)
gcc_pv = get_bb_var("PV", "gcc")
filename = f"gcc-{gcc_pv}/README"
found = False
for software_file in objset.foreach_type(oe.spdx30.software_File):
if software_file.name == filename:
found = True
self.logger.info(
f"The spdxId of {filename} in recipe-gcc.spdx.json is {software_file.spdxId}"
)
break
self.assertTrue(
found, f"Not found source file {filename} in recipe-gcc.spdx.json\n"
)
def test_core_image_minimal(self):
objset = self.check_recipe_spdx(
"core-image-minimal",
"{DEPLOY_DIR_IMAGE}/core-image-minimal-{MACHINE}.rootfs.spdx.json",
)
# Document should be fully linked
self.check_objset_missing_ids(objset)
def test_core_image_minimal_sdk(self):
objset = self.check_recipe_spdx(
"core-image-minimal",
"{SDK_DEPLOY}/{TOOLCHAIN_OUTPUTNAME}.spdx.json",
task="populate_sdk",
)
# Document should be fully linked
self.check_objset_missing_ids(objset)
def test_baremetal_helloworld(self):
objset = self.check_recipe_spdx(
"baremetal-helloworld",
"{DEPLOY_DIR_IMAGE}/baremetal-helloworld-image-{MACHINE}.spdx.json",
extraconf="""\
TCLIBC = "baremetal"
""",
)
# Document should be fully linked
self.check_objset_missing_ids(objset)
def test_extra_opts(self):
HOST_SPDXID = "http://foo.bar/spdx/bar2"
EXTRACONF = textwrap.dedent(
f"""\
SPDX_INVOKED_BY_name = "CI Tool"
SPDX_INVOKED_BY_type = "software"
SPDX_ON_BEHALF_OF_name = "John Doe"
SPDX_ON_BEHALF_OF_type = "person"
SPDX_ON_BEHALF_OF_id_email = "John.Doe@noreply.com"
SPDX_PACKAGE_SUPPLIER_name = "ACME Embedded Widgets"
SPDX_PACKAGE_SUPPLIER_type = "organization"
SPDX_AUTHORS += "authorA"
SPDX_AUTHORS_authorA_ref = "SPDX_ON_BEHALF_OF"
SPDX_BUILD_HOST = "host"
SPDX_IMPORTS += "host"
SPDX_IMPORTS_host_spdxid = "{HOST_SPDXID}"
SPDX_INCLUDE_BUILD_VARIABLES = "1"
SPDX_INCLUDE_BITBAKE_PARENT_BUILD = "1"
SPDX_INCLUDE_TIMESTAMPS = "1"
SPDX_PRETTY = "1"
"""
)
extraconf_hash = hashlib.sha1(EXTRACONF.encode("utf-8")).hexdigest()
objset = self.check_recipe_spdx(
"core-image-minimal",
"{DEPLOY_DIR_IMAGE}/core-image-minimal-{MACHINE}.rootfs.spdx.json",
# Many SPDX variables do not trigger a rebuild, since they are
# intended to record information at the time of the build. As such,
# the extra configuration alone may not trigger a rebuild, and even
# if it does, the task hash won't necessarily be unique. In order
# to make sure rebuilds happen, but still allow these test objects
# to be pulled from sstate (e.g. remain reproducible), change the
# namespace prefix to include the hash of the extra configuration
extraconf=textwrap.dedent(
f"""\
SPDX_NAMESPACE_PREFIX = "http://spdx.org/spdxdocs/{extraconf_hash}"
"""
)
+ EXTRACONF,
)
# Document should be fully linked
self.check_objset_missing_ids(objset)
for o in objset.foreach_type(oe.spdx30.SoftwareAgent):
if o.name == "CI Tool":
break
else:
self.assertTrue(False, "Unable to find software tool")
for o in objset.foreach_type(oe.spdx30.Person):
if o.name == "John Doe":
break
else:
self.assertTrue(False, "Unable to find person")
for o in objset.foreach_type(oe.spdx30.Organization):
if o.name == "ACME Embedded Widgets":
break
else:
self.assertTrue(False, "Unable to find organization")
for o in objset.foreach_type(oe.spdx30.SpdxDocument):
doc = o
break
else:
self.assertTrue(False, "Unable to find SpdxDocument")
for i in doc.import_:
if i.externalSpdxId == HOST_SPDXID:
break
else:
self.assertTrue(False, "Unable to find imported Host SpdxID")
def test_kernel_config_spdx(self):
kernel_recipe = get_bb_var("PREFERRED_PROVIDER_virtual/kernel")
spdx_file = f"recipe-{kernel_recipe}.spdx.json"
spdx_path = f"{{DEPLOY_DIR_SPDX}}/{{SSTATE_PKGARCH}}/recipes/{spdx_file}"
# Make sure kernel is configured first
bitbake(f"-c configure {kernel_recipe}")
objset = self.check_recipe_spdx(
kernel_recipe,
spdx_path,
task="do_create_kernel_config_spdx",
extraconf="""\
INHERIT += "create-spdx"
SPDX_INCLUDE_KERNEL_CONFIG = "1"
""",
)
# Check that at least one CONFIG_* entry exists
found_kernel_config = False
for build_obj in objset.foreach_type(oe.spdx30.build_Build):
if getattr(build_obj, "build_buildType", "") == "https://openembedded.org/kernel-configuration":
found_kernel_config = True
self.assertTrue(
len(getattr(build_obj, "build_parameter", [])) > 0,
"Kernel configuration build_Build has no CONFIG_* entries"
)
break
self.assertTrue(found_kernel_config, "Kernel configuration build_Build not found in SPDX output")
def test_packageconfig_spdx(self):
objset = self.check_recipe_spdx(
"tar",
"{DEPLOY_DIR_SPDX}/{SSTATE_PKGARCH}/recipes/recipe-tar.spdx.json",
extraconf="""\
SPDX_INCLUDE_PACKAGECONFIG = "1"
""",
)
found_entries = []
for build_obj in objset.foreach_type(oe.spdx30.build_Build):
for param in getattr(build_obj, "build_parameter", []):
if param.key.startswith("PACKAGECONFIG:"):
found_entries.append((param.key, param.value))
self.assertTrue(
found_entries,
"No PACKAGECONFIG entries found in SPDX output for 'tar'"
)
for key, value in found_entries:
self.assertIn(
value, ["enabled", "disabled"],
f"Unexpected PACKAGECONFIG value '{value}' for {key}"
)

View File

@@ -0,0 +1,41 @@
From 80e0e9b2558c40fb108ae7a869362566eb4c1ead Mon Sep 17 00:00:00 2001
From: Thomas Frauendorfer | Miray Software <tf@miray.de>
Date: Fri, 9 May 2025 14:20:47 +0200
Subject: [PATCH] net/net: Unregister net_set_vlan command on unload
The commit 954c48b9c (net/net: Add net_set_vlan command) added command
net_set_vlan to the net module. Unfortunately the commit only added the
grub_register_command() call on module load but missed the
grub_unregister_command() on unload. Let's fix this.
Fixes: CVE-2025-54770
Fixes: 954c48b9c (net/net: Add net_set_vlan command)
CVE: CVE-2025-54770
Upstream-Status: Backport
[https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=10e58a14db20e17d1b6a39abe38df01fef98e29d]
Reported-by: Thomas Frauendorfer | Miray Software <tf@miray.de>
Signed-off-by: Thomas Frauendorfer | Miray Software <tf@miray.de>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
---
grub-core/net/net.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/grub-core/net/net.c b/grub-core/net/net.c
index 2b45c27d1..05f11be08 100644
--- a/grub-core/net/net.c
+++ b/grub-core/net/net.c
@@ -2080,6 +2080,7 @@ GRUB_MOD_FINI(net)
grub_unregister_command (cmd_deladdr);
grub_unregister_command (cmd_addroute);
grub_unregister_command (cmd_delroute);
+ grub_unregister_command (cmd_setvlan);
grub_unregister_command (cmd_lsroutes);
grub_unregister_command (cmd_lscards);
grub_unregister_command (cmd_lsaddr);
--
2.34.1

View File

@@ -0,0 +1,40 @@
From c24e11d87f8ee8cefd615e0c30eb71ff6149ee50 Mon Sep 17 00:00:00 2001
From: Jamie <volticks@gmail.com>
Date: Mon, 14 Jul 2025 09:52:59 +0100
Subject: [PATCH 2/4] commands/usbtest: Use correct string length field
An incorrect length field is used for buffer allocation. This leads to
grub_utf16_to_utf8() receiving an incorrect/different length and possibly
causing OOB write. This makes sure to use the correct length.
Fixes: CVE-2025-61661
CVE: CVE-2025-61661
Upstream-Status: Backport
[https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=549a9cc372fd0b96a4ccdfad0e12140476cc62a3]
Reported-by: Jamie <volticks@gmail.com>
Signed-off-by: Jamie <volticks@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
---
grub-core/commands/usbtest.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/grub-core/commands/usbtest.c b/grub-core/commands/usbtest.c
index 2c6d93fe6..8ef187a9a 100644
--- a/grub-core/commands/usbtest.c
+++ b/grub-core/commands/usbtest.c
@@ -99,7 +99,7 @@ grub_usb_get_string (grub_usb_device_t dev, grub_uint8_t index, int langid,
return GRUB_USB_ERR_NONE;
}
- *string = grub_malloc (descstr.length * 2 + 1);
+ *string = grub_malloc (descstrp->length * 2 + 1);
if (! *string)
{
grub_free (descstrp);
--
2.34.1

View File

@@ -0,0 +1,72 @@
From 498dc73aa661bb1cae4b06572b5cef154dcb1fb7 Mon Sep 17 00:00:00 2001
From: Alec Brown <alec.r.brown@oracle.com>
Date: Thu, 21 Aug 2025 21:14:06 +0000
Subject: [PATCH 3/4] gettext/gettext: Unregister gettext command on module
unload
When the gettext module is loaded, the gettext command is registered but
isn't unregistered when the module is unloaded. We need to add a call to
grub_unregister_command() when unloading the module.
Fixes: CVE-2025-61662
CVE: CVE-2025-61662
Upstream-Status: Backport
[https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=8ed78fd9f0852ab218cc1f991c38e5a229e43807]
Reported-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
---
grub-core/gettext/gettext.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
index 9ffc73428..edebed998 100644
--- a/grub-core/gettext/gettext.c
+++ b/grub-core/gettext/gettext.c
@@ -502,6 +502,8 @@ grub_cmd_translate (grub_command_t cmd __attribute__ ((unused)),
return 0;
}
+static grub_command_t cmd;
+
GRUB_MOD_INIT (gettext)
{
const char *lang;
@@ -521,13 +523,14 @@ GRUB_MOD_INIT (gettext)
grub_register_variable_hook ("locale_dir", NULL, read_main);
grub_register_variable_hook ("secondary_locale_dir", NULL, read_secondary);
- grub_register_command_p1 ("gettext", grub_cmd_translate,
- N_("STRING"),
- /* TRANSLATORS: It refers to passing the string through gettext.
- So it's "translate" in the same meaning as in what you're
- doing now.
- */
- N_("Translates the string with the current settings."));
+ cmd = grub_register_command_p1 ("gettext", grub_cmd_translate,
+ N_("STRING"),
+ /*
+ * TRANSLATORS: It refers to passing the string through gettext.
+ * So it's "translate" in the same meaning as in what you're
+ * doing now.
+ */
+ N_("Translates the string with the current settings."));
/* Reload .mo file information if lang changes. */
grub_register_variable_hook ("lang", NULL, grub_gettext_env_write_lang);
@@ -544,6 +547,8 @@ GRUB_MOD_FINI (gettext)
grub_register_variable_hook ("secondary_locale_dir", NULL, NULL);
grub_register_variable_hook ("lang", NULL, NULL);
+ grub_unregister_command (cmd);
+
grub_gettext_delete_list (&main_context);
grub_gettext_delete_list (&secondary_context);
--
2.34.1

View File

@@ -0,0 +1,64 @@
From 8368c026562a72a005bea320cfde9fd7d62d3850 Mon Sep 17 00:00:00 2001
From: Alec Brown <alec.r.brown@oracle.com>
Date: Thu, 21 Aug 2025 21:14:07 +0000
Subject: [PATCH 4/4] normal/main: Unregister commands on module unload
When the normal module is loaded, the normal and normal_exit commands
are registered but aren't unregistered when the module is unloaded. We
need to add calls to grub_unregister_command() when unloading the module
for these commands.
Fixes: CVE-2025-61663
Fixes: CVE-2025-61664
CVE: CVE-2025-61663 CVE-2025-61664
Upstream-Status: Backport
[https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=05d3698b8b03eccc49e53491bbd75dba15f40917]
Reported-by: Alec Brown <alec.r.brown@oracle.com>
Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
---
grub-core/normal/main.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
index dad25e7d2..a810858c3 100644
--- a/grub-core/normal/main.c
+++ b/grub-core/normal/main.c
@@ -500,7 +500,7 @@ grub_mini_cmd_clear (struct grub_command *cmd __attribute__ ((unused)),
return 0;
}
-static grub_command_t cmd_clear;
+static grub_command_t cmd_clear, cmd_normal, cmd_normal_exit;
static void (*grub_xputs_saved) (const char *str);
static const char *features[] = {
@@ -542,10 +542,10 @@ GRUB_MOD_INIT(normal)
grub_env_export ("pager");
/* Register a command "normal" for the rescue mode. */
- grub_register_command ("normal", grub_cmd_normal,
- 0, N_("Enter normal mode."));
- grub_register_command ("normal_exit", grub_cmd_normal_exit,
- 0, N_("Exit from normal mode."));
+ cmd_normal = grub_register_command ("normal", grub_cmd_normal,
+ 0, N_("Enter normal mode."));
+ cmd_normal_exit = grub_register_command ("normal_exit", grub_cmd_normal_exit,
+ 0, N_("Exit from normal mode."));
/* Reload terminal colors when these variables are written to. */
grub_register_variable_hook ("color_normal", NULL, grub_env_write_color_normal);
@@ -587,4 +587,6 @@ GRUB_MOD_FINI(normal)
grub_register_variable_hook ("color_highlight", NULL, NULL);
grub_fs_autoload_hook = 0;
grub_unregister_command (cmd_clear);
+ grub_unregister_command (cmd_normal);
+ grub_unregister_command (cmd_normal_exit);
}
--
2.34.1

View File

@@ -38,6 +38,10 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch \
file://CVE-2025-0678_CVE-2025-1125.patch \
file://CVE-2024-56738.patch \
file://CVE-2025-54770.patch \
file://CVE-2025-61661.patch \
file://CVE-2025-61662.patch \
file://CVE-2025-61663_61664.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"

View File

@@ -0,0 +1,56 @@
From 1406fc918977bba4dac0af5e22e63a5553aa6aff Mon Sep 17 00:00:00 2001
From: Paul HENRYS <paul.henrys_ext@softathome.com>
Date: Thu, 9 Oct 2025 17:43:28 +0200
Subject: [PATCH] net: bootp: Prevent buffer overflow to avoid leaking the RAM
content
CVE-2024-42040 describes a possible buffer overflow when calling
bootp_process_vendor() in bootp_handler() since the total length
of the packet is passed to bootp_process_vendor() without being
reduced to len-(offsetof(struct bootp_hdr,bp_vend)+4).
The packet length is also checked against its minimum size to avoid
reading data from struct bootp_hdr outside of the packet length.
Signed-off-by: Paul HENRYS <paul.henrys_ext@softathome.com>
Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
CVE: CVE-2024-42040
Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/81e5708cc2c865df606e49aed5415adb2a662171]
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
net/bootp.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/net/bootp.c b/net/bootp.c
index 68002909634..843180d296c 100644
--- a/net/bootp.c
+++ b/net/bootp.c
@@ -362,6 +362,14 @@ static void bootp_handler(uchar *pkt, unsigned dest, struct in_addr sip,
debug("got BOOTP packet (src=%d, dst=%d, len=%d want_len=%zu)\n",
src, dest, len, sizeof(struct bootp_hdr));
+ /* Check the minimum size of a BOOTP packet is respected.
+ * A BOOTP packet is between 300 bytes and 576 bytes big
+ */
+ if (len < offsetof(struct bootp_hdr, bp_vend) + 64) {
+ printf("Error: got an invalid BOOTP packet (len=%u)\n", len);
+ return;
+ }
+
bp = (struct bootp_hdr *)pkt;
/* Filter out pkts we don't want */
@@ -379,7 +387,8 @@ static void bootp_handler(uchar *pkt, unsigned dest, struct in_addr sip,
/* Retrieve extended information (we must parse the vendor area) */
if (net_read_u32((u32 *)&bp->bp_vend[0]) == htonl(BOOTP_VENDOR_MAGIC))
- bootp_process_vendor((uchar *)&bp->bp_vend[4], len);
+ bootp_process_vendor((uchar *)&bp->bp_vend[4], len -
+ (offsetof(struct bootp_hdr, bp_vend) + 4));
net_set_timeout_handler(0, (thand_f *)0);
bootstage_mark_name(BOOTSTAGE_ID_BOOTP_STOP, "bootp_stop");
--
2.49.0

View File

@@ -23,6 +23,7 @@ SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master \
file://CVE-2024-57258-2.patch \
file://CVE-2024-57258-3.patch \
file://CVE-2024-57259.patch \
file://CVE-2024-42040.patch \
"
S = "${WORKDIR}/git"

View File

@@ -20,7 +20,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \
file://0001-avoid-start-failure-with-bind-user.patch \
"
SRC_URI[sha256sum] = "fb373fac5ebbc41c645160afd5a9fb451918f6c0e69ab1d9474154e2b515de40"
SRC_URI[sha256sum] = "6ddc1d981511c4da0b203b0513af131e5d15e5f1c261145736fe1f35dd1fe79d"
UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
# follow the ESV versions divisible by 2

View File

@@ -0,0 +1,125 @@
From d45e13c956b296bf933901c4da2b61eb2ccd7582 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Thu, 4 Sep 2025 00:29:09 +0000
Subject: [PATCH] upstream: Improve rules for %-expansion of username.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Usernames passed on the commandline will no longer be subject to
% expansion. Some tools invoke ssh with connection information
(i.e. usernames and host names) supplied from untrusted sources.
These may contain % expansion sequences which could yield
unexpected results.
Since openssh-9.6, all usernames have been subject to validity
checking. This change tightens the validity checks by refusing
usernames that include control characters (again, these can cause
surprises when supplied adversarially).
This change also relaxes the validity checks in one small way:
usernames supplied via the configuration file as literals (i.e.
include no % expansion characters) are not subject to these
validity checks. This allows usernames that contain arbitrary
characters to be used, but only via configuration files. This
is done on the basis that ssh's configuration is trusted.
Pointed out by David Leadbeater, ok deraadt@
OpenBSD-Commit-ID: e2f0c871fbe664aba30607321575e7c7fc798362
Slightly modified since variable expansion of user names was
first released in 10.0, commit bd30cf784d6e8"
Upstream-Status: Backport [Upstream commit https://github.com/openssh/openssh-portable/commit/35d5917652106aede47621bb3f64044604164043]
CVE: CVE-2025-61984
Signed-off-by: David Nyström <david.nystrom@est.tech>
---
ssh.c | 26 +++++++++++++++++++++++---
1 file changed, 23 insertions(+), 3 deletions(-)
diff --git a/ssh.c b/ssh.c
index 48d93ddf2..9c49f98a8 100644
--- a/ssh.c
+++ b/ssh.c
@@ -649,6 +649,8 @@ valid_ruser(const char *s)
if (*s == '-')
return 0;
for (i = 0; s[i] != 0; i++) {
+ if (iscntrl((u_char)s[i]))
+ return 0;
if (strchr("'`\";&<>|(){}", s[i]) != NULL)
return 0;
/* Disallow '-' after whitespace */
@@ -671,6 +673,7 @@ main(int ac, char **av)
int i, r, opt, exit_status, use_syslog, direct, timeout_ms;
int was_addr, config_test = 0, opt_terminated = 0, want_final_pass = 0;
char *p, *cp, *line, *argv0, *logfile;
+ int user_on_commandline = 0, user_was_default = 0;
char cname[NI_MAXHOST], thishost[NI_MAXHOST];
struct stat st;
struct passwd *pw;
@@ -1016,8 +1019,10 @@ main(int ac, char **av)
}
break;
case 'l':
- if (options.user == NULL)
+ if (options.user == NULL) {
options.user = optarg;
+ user_on_commandline = 1;
+ }
break;
case 'L':
@@ -1120,6 +1125,7 @@ main(int ac, char **av)
if (options.user == NULL) {
options.user = tuser;
tuser = NULL;
+ user_on_commandline = 1;
}
free(tuser);
if (options.port == -1 && tport != -1)
@@ -1134,6 +1140,7 @@ main(int ac, char **av)
if (options.user == NULL) {
options.user = p;
p = NULL;
+ user_on_commandline = 1;
}
*cp++ = '\0';
host = xstrdup(cp);
@@ -1288,8 +1295,10 @@ main(int ac, char **av)
if (fill_default_options(&options) != 0)
cleanup_exit(255);
- if (options.user == NULL)
+ if (options.user == NULL) {
+ user_was_default = 1;
options.user = xstrdup(pw->pw_name);
+ }
/*
* If ProxyJump option specified, then construct a ProxyCommand now.
@@ -1430,11 +1439,22 @@ main(int ac, char **av)
options.host_key_alias : options.host_arg);
cinfo->host_arg = xstrdup(options.host_arg);
cinfo->remhost = xstrdup(host);
- cinfo->remuser = xstrdup(options.user);
cinfo->homedir = xstrdup(pw->pw_dir);
cinfo->locuser = xstrdup(pw->pw_name);
cinfo->jmphost = xstrdup(options.jump_host == NULL ?
"" : options.jump_host);
+
+ /*
+ * Usernames specified on the commandline must be validated.
+ * Conversely, usernames from getpwnam(3) or specified as literals
+ * via configuration (i.e. not expanded) are not subject to validation.
+ */
+ if (user_on_commandline && !valid_ruser(options.user))
+ fatal("remote username contains invalid characters");
+
+ /* Store it and calculate hash. */
+ cinfo->remuser = xstrdup(options.user);
+
cinfo->conn_hash_hex = ssh_connection_hash(cinfo->thishost,
cinfo->remhost, cinfo->portstr, cinfo->remuser, cinfo->jmphost);

View File

@@ -0,0 +1,47 @@
From 54928cb9eaa7143ff17f463efa7ed3109afdbf30 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Thu, 4 Sep 2025 00:30:06 +0000
Subject: [PATCH] upstream: don't allow \0 characters in url-encoded strings.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Suggested by David Leadbeater, ok deraadt@
OpenBSD-Commit-ID: c92196cef0f970ceabc1e8007a80b01e9b7cd49c
Upstream-Status: Backport [Upstream commit https://github.com/openssh/openssh-portable/commit/43b3bff47bb029f2299bacb6a36057981b39fdb0]
CVE: CVE-2025-61985
Signed-off-by: David Nyström <david.nystrom@est.tech>
---
misc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/misc.c b/misc.c
index 3db2e4d0b..cac246b63 100644
--- a/misc.c
+++ b/misc.c
@@ -955,7 +955,7 @@ urldecode(const char *src)
size_t srclen;
if ((srclen = strlen(src)) >= SIZE_MAX)
- fatal_f("input too large");
+ return NULL;
ret = xmalloc(srclen + 1);
for (dst = ret; *src != '\0'; src++) {
switch (*src) {
@@ -963,9 +963,10 @@ urldecode(const char *src)
*dst++ = ' ';
break;
case '%':
+ /* note: don't allow \0 characters */
if (!isxdigit((unsigned char)src[1]) ||
!isxdigit((unsigned char)src[2]) ||
- (ch = hexchar(src + 1)) == -1) {
+ (ch = hexchar(src + 1)) == -1 || ch == 0) {
free(ret);
return NULL;
}
--
2.44.1

View File

@@ -32,6 +32,8 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2025-26466.patch \
file://CVE-2025-26465.patch \
file://CVE-2025-32728.patch \
file://CVE-2025-61985.patch \
file://CVE-2025-61984.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"

View File

@@ -0,0 +1,79 @@
From 726432d7622cc0088ac353d073b59628b590ea44 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Sat, 25 Jan 2025 11:21:16 +0200
Subject: [PATCH] RADIUS: Drop pending request only when accepting the response
The case of an invalid authenticator in a RADIUS response could imply
that the response is not from the correct RADIUS server and as such,
such a response should be discarded without changing internal state for
the pending request. The case of an unknown response (RADIUS_RX_UNKNOWN)
is somewhat more complex since it could have been indicated before
validating the authenticator. In any case, it seems better to change the
state for the pending request only when we have fully accepted the
response.
Allowing the internal state of pending RADIUS request to change based on
responses that are not fully validation could have allow at least a
theoretical DoS attack if an attacker were to have means for injecting
RADIUS messages to the network using the IP address of the real RADIUS
server and being able to do so more quickly than the real server and
with the matching identifier from the request header (i.e., either by
flooding 256 responses quickly or by having means to capture the RADIUS
request). These should not really be realistic options in a properly
protected deployment, but nevertheless it is good to be more careful in
processing RADIUS responses.
Remove a pending RADIUS request from the internal list only when having
fully accepted a matching RADIUS response, i.e., after one of the
registered handlers has confirmed that the authenticator is valid and
processing of the response has succeeded.
Signed-off-by: Jouni Malinen <j@w1.fi>
CVE: CVE-2025-24912
Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
src/radius/radius_client.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/src/radius/radius_client.c b/src/radius/radius_client.c
index 2a7f36170..7909b29a7 100644
--- a/src/radius/radius_client.c
+++ b/src/radius/radius_client.c
@@ -922,13 +922,6 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
roundtrip / 100, roundtrip % 100);
rconf->round_trip_time = roundtrip;
- /* Remove ACKed RADIUS packet from retransmit list */
- if (prev_req)
- prev_req->next = req->next;
- else
- radius->msgs = req->next;
- radius->num_msgs--;
-
for (i = 0; i < num_handlers; i++) {
RadiusRxResult res;
res = handlers[i].handler(msg, req->msg, req->shared_secret,
@@ -939,6 +932,13 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
radius_msg_free(msg);
/* fall through */
case RADIUS_RX_QUEUED:
+ /* Remove ACKed RADIUS packet from retransmit list */
+ if (prev_req)
+ prev_req->next = req->next;
+ else
+ radius->msgs = req->next;
+ radius->num_msgs--;
+
radius_client_msg_free(req);
return;
case RADIUS_RX_INVALID_AUTHENTICATOR:
@@ -960,7 +960,6 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
msg_type, hdr->code, hdr->identifier,
invalid_authenticator ? " [INVALID AUTHENTICATOR]" :
"");
- radius_client_msg_free(req);
fail:
radius_msg_free(msg);

View File

@@ -0,0 +1,70 @@
From 339a334551ca911187cc870f4f97ef08e11db109 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <quic_jouni@quicinc.com>
Date: Wed, 5 Feb 2025 19:23:39 +0200
Subject: [PATCH] RADIUS: Fix pending request dropping
A recent change to this moved the place where the processed RADIUS
request was removed from the pending list to happen after the message
handler had been called. This did not take into account possibility of
the handler adding a new pending request in the list and the prev_req
pointer not necessarily pointing to the correct entry anymore. As such,
some of the pending requests could have been lost and that would result
in not being able to process responses to those requests and also, to a
memory leak.
Fix this by determining prev_req at the point when the pending request
is being removed, i.e., after the handler function has already added a
new entry.
Fixes: 726432d7622c ("RADIUS: Drop pending request only when accepting the response")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
CVE: CVE-2025-24912
Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
src/radius/radius_client.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/src/radius/radius_client.c b/src/radius/radius_client.c
index 7909b29a7..d4faa7936 100644
--- a/src/radius/radius_client.c
+++ b/src/radius/radius_client.c
@@ -824,7 +824,7 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
struct radius_hdr *hdr;
struct radius_rx_handler *handlers;
size_t num_handlers, i;
- struct radius_msg_list *req, *prev_req;
+ struct radius_msg_list *req, *prev_req, *r;
struct os_reltime now;
struct hostapd_radius_server *rconf;
int invalid_authenticator = 0;
@@ -887,7 +887,6 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
break;
}
- prev_req = NULL;
req = radius->msgs;
while (req) {
/* TODO: also match by src addr:port of the packet when using
@@ -899,7 +898,6 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
hdr->identifier)
break;
- prev_req = req;
req = req->next;
}
@@ -933,6 +931,12 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
/* fall through */
case RADIUS_RX_QUEUED:
/* Remove ACKed RADIUS packet from retransmit list */
+ prev_req = NULL;
+ for (r = radius->msgs; r; r = r->next) {
+ if (r == req)
+ break;
+ prev_req = r;
+ }
if (prev_req)
prev_req->next = req->next;
else

View File

@@ -36,6 +36,8 @@ SRC_URI = "http://w1.fi/releases/wpa_supplicant-${PV}.tar.gz \
file://CVE-2022-37660-0003.patch \
file://CVE-2022-37660-0004.patch \
file://CVE-2022-37660-0005.patch \
file://CVE-2025-24912-01.patch \
file://CVE-2025-24912-02.patch \
"
SRC_URI[sha256sum] = "20df7ae5154b3830355f8ab4269123a87affdea59fe74fe9292a91d0d7e17b2f"

View File

@@ -0,0 +1,52 @@
From 87321ac84a0d6cb42ee64a591adc79c1ec37fb5b Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Tue, 2 Sep 2025 20:52:29 +0200
Subject: [PATCH] xmlwf: Mention supported environment variables in --help
output
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/87321ac84a0d6cb42ee64a591adc79c1ec37fb5b]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
xmlwf/xmlwf.c | 8 ++++++++
xmlwf/xmlwf_helpgen.py | 8 ++++++++
2 files changed, 16 insertions(+)
diff --git a/xmlwf/xmlwf.c b/xmlwf/xmlwf.c
index ec7e51c9..8cfc73ca 100644
--- a/xmlwf/xmlwf.c
+++ b/xmlwf/xmlwf.c
@@ -926,6 +926,14 @@ usage(const XML_Char *prog, int rc) {
T(" -h, --help show this [h]elp message and exit\n")
T(" -v, --version show program's [v]ersion number and exit\n")
T("\n")
+ T("environment variables:\n")
+ T(" EXPAT_ACCOUNTING_DEBUG=(0|1|2|3)\n")
+ T(" Control verbosity of accounting debugging (default: 0)\n")
+ T(" EXPAT_ENTITY_DEBUG=(0|1)\n")
+ T(" Control verbosity of entity debugging (default: 0)\n")
+ T(" EXPAT_ENTROPY_DEBUG=(0|1)\n")
+ T(" Control verbosity of entropy debugging (default: 0)\n")
+ T("\n")
T("exit status:\n")
T(" 0 the input files are well-formed and the output (if requested) was written successfully\n")
T(" 1 could not allocate data structures, signals a serious problem with execution environment\n")
diff --git a/xmlwf/xmlwf_helpgen.py b/xmlwf/xmlwf_helpgen.py
index c3257f0e..39a3dc13 100755
--- a/xmlwf/xmlwf_helpgen.py
+++ b/xmlwf/xmlwf_helpgen.py
@@ -32,6 +32,14 @@
import argparse
epilog = """
+environment variables:
+ EXPAT_ACCOUNTING_DEBUG=(0|1|2|3)
+ Control verbosity of accounting debugging (default: 0)
+ EXPAT_ENTITY_DEBUG=(0|1)
+ Control verbosity of entity debugging (default: 0)
+ EXPAT_ENTROPY_DEBUG=(0|1)
+ Control verbosity of entropy debugging (default: 0)
+
exit status:
0 the input files are well-formed and the output (if requested) was written successfully
1 could not allocate data structures, signals a serious problem with execution environment

View File

@@ -0,0 +1,48 @@
From 0872c189db6e457084fca335662a9cb49e8ec4c7 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Mon, 1 Sep 2025 18:06:59 +0200
Subject: [PATCH] lib: Make function dtdCreate use macro MALLOC
.. and give its body access to the parser for upcoming changes
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/0872c189db6e457084fca335662a9cb49e8ec4c7]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index 25f786ec..b9d6eed1 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -555,7 +555,7 @@ static XML_Bool setContext(XML_Parser parser, const XML_Char *context);
static void FASTCALL normalizePublicId(XML_Char *s);
-static DTD *dtdCreate(const XML_Memory_Handling_Suite *ms);
+static DTD *dtdCreate(XML_Parser parser);
/* do not call if m_parentParser != NULL */
static void dtdReset(DTD *p, const XML_Memory_Handling_Suite *ms);
static void dtdDestroy(DTD *p, XML_Bool isDocEntity,
@@ -1166,7 +1166,7 @@ parserCreate(const XML_Char *encodingName,
if (dtd)
parser->m_dtd = dtd;
else {
- parser->m_dtd = dtdCreate(&parser->m_mem);
+ parser->m_dtd = dtdCreate(parser);
if (parser->m_dtd == NULL) {
FREE(parser, parser->m_dataBuf);
FREE(parser, parser->m_atts);
@@ -7126,8 +7126,9 @@ normalizePublicId(XML_Char *publicId) {
}
static DTD *
-dtdCreate(const XML_Memory_Handling_Suite *ms) {
- DTD *p = ms->malloc_fcn(sizeof(DTD));
+dtdCreate(XML_Parser parser) {
+ const XML_Memory_Handling_Suite *const ms = &parser->m_mem;
+ DTD *p = MALLOC(parser, sizeof(DTD));
if (p == NULL)
return p;
poolInit(&(p->pool), ms);

View File

@@ -0,0 +1,109 @@
From 8768dadae479d9f2e984b747fb2ba79bb78de94f Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Mon, 1 Sep 2025 18:10:26 +0200
Subject: [PATCH] lib: Make string pools use macros MALLOC, FREE, REALLOC
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/8768dadae479d9f2e984b747fb2ba79bb78de94f]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 27 +++++++++++++--------------
1 file changed, 13 insertions(+), 14 deletions(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index b9d6eed1..a56c71ea 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -357,7 +357,7 @@ typedef struct {
const XML_Char *end;
XML_Char *ptr;
XML_Char *start;
- const XML_Memory_Handling_Suite *mem;
+ XML_Parser parser;
} STRING_POOL;
/* The XML_Char before the name is used to determine whether
@@ -574,8 +574,7 @@ static void FASTCALL hashTableIterInit(HASH_TABLE_ITER *iter,
const HASH_TABLE *table);
static NAMED *FASTCALL hashTableIterNext(HASH_TABLE_ITER *iter);
-static void FASTCALL poolInit(STRING_POOL *pool,
- const XML_Memory_Handling_Suite *ms);
+static void FASTCALL poolInit(STRING_POOL *pool, XML_Parser parser);
static void FASTCALL poolClear(STRING_POOL *pool);
static void FASTCALL poolDestroy(STRING_POOL *pool);
static XML_Char *poolAppend(STRING_POOL *pool, const ENCODING *enc,
@@ -1200,8 +1199,8 @@ parserCreate(const XML_Char *encodingName,
parser->m_protocolEncodingName = NULL;
- poolInit(&parser->m_tempPool, &(parser->m_mem));
- poolInit(&parser->m_temp2Pool, &(parser->m_mem));
+ poolInit(&parser->m_tempPool, parser);
+ poolInit(&parser->m_temp2Pool, parser);
parserInit(parser, encodingName);
if (encodingName && ! parser->m_protocolEncodingName) {
@@ -7131,8 +7130,8 @@ dtdCreate(XML_Parser parser) {
DTD *p = MALLOC(parser, sizeof(DTD));
if (p == NULL)
return p;
- poolInit(&(p->pool), ms);
- poolInit(&(p->entityValuePool), ms);
+ poolInit(&(p->pool), parser);
+ poolInit(&(p->entityValuePool), parser);
hashTableInit(&(p->generalEntities), ms);
hashTableInit(&(p->elementTypes), ms);
hashTableInit(&(p->attributeIds), ms);
@@ -7596,13 +7595,13 @@ hashTableIterNext(HASH_TABLE_ITER *iter) {
}
static void FASTCALL
-poolInit(STRING_POOL *pool, const XML_Memory_Handling_Suite *ms) {
+poolInit(STRING_POOL *pool, XML_Parser parser) {
pool->blocks = NULL;
pool->freeBlocks = NULL;
pool->start = NULL;
pool->ptr = NULL;
pool->end = NULL;
- pool->mem = ms;
+ pool->parser = parser;
}
static void FASTCALL
@@ -7629,13 +7628,13 @@ poolDestroy(STRING_POOL *pool) {
BLOCK *p = pool->blocks;
while (p) {
BLOCK *tem = p->next;
- pool->mem->free_fcn(p);
+ FREE(pool->parser, p);
p = tem;
}
p = pool->freeBlocks;
while (p) {
BLOCK *tem = p->next;
- pool->mem->free_fcn(p);
+ FREE(pool->parser, p);
p = tem;
}
}
@@ -7790,8 +7789,8 @@ poolGrow(STRING_POOL *pool) {
if (bytesToAllocate == 0)
return XML_FALSE;
- temp = (BLOCK *)pool->mem->realloc_fcn(pool->blocks,
- (unsigned)bytesToAllocate);
+ temp = (BLOCK *)REALLOC(pool->parser, pool->blocks,
+ (unsigned)bytesToAllocate);
if (temp == NULL)
return XML_FALSE;
pool->blocks = temp;
@@ -7831,7 +7830,7 @@ poolGrow(STRING_POOL *pool) {
if (bytesToAllocate == 0)
return XML_FALSE;
- tem = pool->mem->malloc_fcn(bytesToAllocate);
+ tem = MALLOC(pool->parser, bytesToAllocate);
if (! tem)
return XML_FALSE;
tem->size = blockSize;

View File

@@ -0,0 +1,127 @@
From 4fc6f1ee9f2b282cfe446bf645c992e37f8c3e15 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Mon, 1 Sep 2025 18:14:09 +0200
Subject: [PATCH] lib: Make function hash tables use macros MALLOC and FREE
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/4fc6f1ee9f2b282cfe446bf645c992e37f8c3e15]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 34 ++++++++++++++++------------------
1 file changed, 16 insertions(+), 18 deletions(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index a56c71ea..a65b0265 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -234,7 +234,7 @@ typedef struct {
unsigned char power;
size_t size;
size_t used;
- const XML_Memory_Handling_Suite *mem;
+ XML_Parser parser;
} HASH_TABLE;
static size_t keylen(KEY s);
@@ -566,8 +566,7 @@ static int copyEntityTable(XML_Parser oldParser, HASH_TABLE *newTable,
STRING_POOL *newPool, const HASH_TABLE *oldTable);
static NAMED *lookup(XML_Parser parser, HASH_TABLE *table, KEY name,
size_t createSize);
-static void FASTCALL hashTableInit(HASH_TABLE *table,
- const XML_Memory_Handling_Suite *ms);
+static void FASTCALL hashTableInit(HASH_TABLE *table, XML_Parser parser);
static void FASTCALL hashTableClear(HASH_TABLE *table);
static void FASTCALL hashTableDestroy(HASH_TABLE *table);
static void FASTCALL hashTableIterInit(HASH_TABLE_ITER *iter,
@@ -7126,19 +7125,18 @@ normalizePublicId(XML_Char *publicId) {
static DTD *
dtdCreate(XML_Parser parser) {
- const XML_Memory_Handling_Suite *const ms = &parser->m_mem;
DTD *p = MALLOC(parser, sizeof(DTD));
if (p == NULL)
return p;
poolInit(&(p->pool), parser);
poolInit(&(p->entityValuePool), parser);
- hashTableInit(&(p->generalEntities), ms);
- hashTableInit(&(p->elementTypes), ms);
- hashTableInit(&(p->attributeIds), ms);
- hashTableInit(&(p->prefixes), ms);
+ hashTableInit(&(p->generalEntities), parser);
+ hashTableInit(&(p->elementTypes), parser);
+ hashTableInit(&(p->attributeIds), parser);
+ hashTableInit(&(p->prefixes), parser);
#ifdef XML_DTD
p->paramEntityRead = XML_FALSE;
- hashTableInit(&(p->paramEntities), ms);
+ hashTableInit(&(p->paramEntities), parser);
#endif /* XML_DTD */
p->defaultPrefix.name = NULL;
p->defaultPrefix.binding = NULL;
@@ -7473,7 +7471,7 @@ lookup(XML_Parser parser, HASH_TABLE *table, KEY name, size_t createSize) {
/* table->size is a power of 2 */
table->size = (size_t)1 << INIT_POWER;
tsize = table->size * sizeof(NAMED *);
- table->v = table->mem->malloc_fcn(tsize);
+ table->v = MALLOC(table->parser, tsize);
if (! table->v) {
table->size = 0;
return NULL;
@@ -7513,7 +7511,7 @@ lookup(XML_Parser parser, HASH_TABLE *table, KEY name, size_t createSize) {
}
size_t tsize = newSize * sizeof(NAMED *);
- NAMED **newV = table->mem->malloc_fcn(tsize);
+ NAMED **newV = MALLOC(table->parser, tsize);
if (! newV)
return NULL;
memset(newV, 0, tsize);
@@ -7529,7 +7527,7 @@ lookup(XML_Parser parser, HASH_TABLE *table, KEY name, size_t createSize) {
}
newV[j] = table->v[i];
}
- table->mem->free_fcn(table->v);
+ FREE(table->parser, table->v);
table->v = newV;
table->power = newPower;
table->size = newSize;
@@ -7542,7 +7540,7 @@ lookup(XML_Parser parser, HASH_TABLE *table, KEY name, size_t createSize) {
}
}
}
- table->v[i] = table->mem->malloc_fcn(createSize);
+ table->v[i] = MALLOC(table->parser, createSize);
if (! table->v[i])
return NULL;
memset(table->v[i], 0, createSize);
@@ -7555,7 +7553,7 @@ static void FASTCALL
hashTableClear(HASH_TABLE *table) {
size_t i;
for (i = 0; i < table->size; i++) {
- table->mem->free_fcn(table->v[i]);
+ FREE(table->parser, table->v[i]);
table->v[i] = NULL;
}
table->used = 0;
@@ -7565,17 +7563,17 @@ static void FASTCALL
hashTableDestroy(HASH_TABLE *table) {
size_t i;
for (i = 0; i < table->size; i++)
- table->mem->free_fcn(table->v[i]);
- table->mem->free_fcn(table->v);
+ FREE(table->parser, table->v[i]);
+ FREE(table->parser, table->v);
}
static void FASTCALL
-hashTableInit(HASH_TABLE *p, const XML_Memory_Handling_Suite *ms) {
+hashTableInit(HASH_TABLE *p, XML_Parser parser) {
p->power = 0;
p->size = 0;
p->used = 0;
p->v = NULL;
- p->mem = ms;
+ p->parser = parser;
}
static void FASTCALL

View File

@@ -0,0 +1,62 @@
From 51487ad9d760faa4809b0f8e189d2f666317e41a Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Mon, 1 Sep 2025 17:45:50 +0200
Subject: [PATCH] lib: Make function copyString use macro MALLOC
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/51487ad9d760faa4809b0f8e189d2f666317e41a]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index a65b0265..c0576abd 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -593,8 +593,7 @@ static XML_Content *build_model(XML_Parser parser);
static ELEMENT_TYPE *getElementType(XML_Parser parser, const ENCODING *enc,
const char *ptr, const char *end);
-static XML_Char *copyString(const XML_Char *s,
- const XML_Memory_Handling_Suite *memsuite);
+static XML_Char *copyString(const XML_Char *s, XML_Parser parser);
static unsigned long generate_hash_secret_salt(XML_Parser parser);
static XML_Bool startParsing(XML_Parser parser);
@@ -1231,7 +1230,7 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) {
parser->m_processor = prologInitProcessor;
XmlPrologStateInit(&parser->m_prologState);
if (encodingName != NULL) {
- parser->m_protocolEncodingName = copyString(encodingName, &(parser->m_mem));
+ parser->m_protocolEncodingName = copyString(encodingName, parser);
}
parser->m_curBase = NULL;
XmlInitEncoding(&parser->m_initEncoding, &parser->m_encoding, 0);
@@ -1419,7 +1418,7 @@ XML_SetEncoding(XML_Parser parser, const XML_Char *encodingName) {
parser->m_protocolEncodingName = NULL;
else {
/* Copy the new encoding name into allocated memory */
- parser->m_protocolEncodingName = copyString(encodingName, &(parser->m_mem));
+ parser->m_protocolEncodingName = copyString(encodingName, parser);
if (! parser->m_protocolEncodingName)
return XML_STATUS_ERROR;
}
@@ -8064,7 +8063,7 @@ getElementType(XML_Parser parser, const ENCODING *enc, const char *ptr,
}
static XML_Char *
-copyString(const XML_Char *s, const XML_Memory_Handling_Suite *memsuite) {
+copyString(const XML_Char *s, XML_Parser parser) {
size_t charsRequired = 0;
XML_Char *result;
@@ -8076,7 +8075,7 @@ copyString(const XML_Char *s, const XML_Memory_Handling_Suite *memsuite) {
charsRequired++;
/* Now allocate space for the copy */
- result = memsuite->malloc_fcn(charsRequired * sizeof(XML_Char));
+ result = MALLOC(parser, charsRequired * sizeof(XML_Char));
if (result == NULL)
return NULL;
/* Copy the original into place */

View File

@@ -0,0 +1,64 @@
From b3f0bda5f5e979781469532f7c304f7e223568d5 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Mon, 1 Sep 2025 17:48:02 +0200
Subject: [PATCH] lib: Make function dtdReset use macro FREE
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/b3f0bda5f5e979781469532f7c304f7e223568d5]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index c0576abd..65fcce30 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -557,7 +557,7 @@ static void FASTCALL normalizePublicId(XML_Char *s);
static DTD *dtdCreate(XML_Parser parser);
/* do not call if m_parentParser != NULL */
-static void dtdReset(DTD *p, const XML_Memory_Handling_Suite *ms);
+static void dtdReset(DTD *p, XML_Parser parser);
static void dtdDestroy(DTD *p, XML_Bool isDocEntity,
const XML_Memory_Handling_Suite *ms);
static int dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd,
@@ -1382,7 +1382,7 @@ XML_ParserReset(XML_Parser parser, const XML_Char *encodingName) {
FREE(parser, (void *)parser->m_protocolEncodingName);
parser->m_protocolEncodingName = NULL;
parserInit(parser, encodingName);
- dtdReset(parser->m_dtd, &parser->m_mem);
+ dtdReset(parser->m_dtd, parser);
return XML_TRUE;
}
@@ -7155,7 +7155,7 @@ dtdCreate(XML_Parser parser) {
}
static void
-dtdReset(DTD *p, const XML_Memory_Handling_Suite *ms) {
+dtdReset(DTD *p, XML_Parser parser) {
HASH_TABLE_ITER iter;
hashTableIterInit(&iter, &(p->elementTypes));
for (;;) {
@@ -7163,7 +7163,7 @@ dtdReset(DTD *p, const XML_Memory_Handling_Suite *ms) {
if (! e)
break;
if (e->allocDefaultAtts != 0)
- ms->free_fcn(e->defaultAtts);
+ FREE(parser, e->defaultAtts);
}
hashTableClear(&(p->generalEntities));
#ifdef XML_DTD
@@ -7180,9 +7180,9 @@ dtdReset(DTD *p, const XML_Memory_Handling_Suite *ms) {
p->in_eldecl = XML_FALSE;
- ms->free_fcn(p->scaffIndex);
+ FREE(parser, p->scaffIndex);
p->scaffIndex = NULL;
- ms->free_fcn(p->scaffold);
+ FREE(parser, p->scaffold);
p->scaffold = NULL;
p->scaffLevel = 0;

View File

@@ -0,0 +1,68 @@
From 53a3eda0ae2e0317afd071b72b41976053d82732 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Mon, 1 Sep 2025 17:50:59 +0200
Subject: [PATCH] lib: Make function dtdDestroy use macro FREE
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/53a3eda0ae2e0317afd071b72b41976053d82732]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index 65fcce30..e7df97da 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -558,8 +558,7 @@ static void FASTCALL normalizePublicId(XML_Char *s);
static DTD *dtdCreate(XML_Parser parser);
/* do not call if m_parentParser != NULL */
static void dtdReset(DTD *p, XML_Parser parser);
-static void dtdDestroy(DTD *p, XML_Bool isDocEntity,
- const XML_Memory_Handling_Suite *ms);
+static void dtdDestroy(DTD *p, XML_Bool isDocEntity, XML_Parser parser);
static int dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd,
const XML_Memory_Handling_Suite *ms);
static int copyEntityTable(XML_Parser oldParser, HASH_TABLE *newTable,
@@ -1685,8 +1684,7 @@ XML_ParserFree(XML_Parser parser) {
#else
if (parser->m_dtd)
#endif /* XML_DTD */
- dtdDestroy(parser->m_dtd, (XML_Bool)! parser->m_parentParser,
- &parser->m_mem);
+ dtdDestroy(parser->m_dtd, (XML_Bool)! parser->m_parentParser, parser);
FREE(parser, (void *)parser->m_atts);
#ifdef XML_ATTR_INFO
FREE(parser, (void *)parser->m_attInfo);
@@ -7196,7 +7194,7 @@ dtdReset(DTD *p, XML_Parser parser) {
}
static void
-dtdDestroy(DTD *p, XML_Bool isDocEntity, const XML_Memory_Handling_Suite *ms) {
+dtdDestroy(DTD *p, XML_Bool isDocEntity, XML_Parser parser) {
HASH_TABLE_ITER iter;
hashTableIterInit(&iter, &(p->elementTypes));
for (;;) {
@@ -7204,7 +7202,7 @@ dtdDestroy(DTD *p, XML_Bool isDocEntity, const XML_Memory_Handling_Suite *ms) {
if (! e)
break;
if (e->allocDefaultAtts != 0)
- ms->free_fcn(e->defaultAtts);
+ FREE(parser, e->defaultAtts);
}
hashTableDestroy(&(p->generalEntities));
#ifdef XML_DTD
@@ -7216,10 +7214,10 @@ dtdDestroy(DTD *p, XML_Bool isDocEntity, const XML_Memory_Handling_Suite *ms) {
poolDestroy(&(p->pool));
poolDestroy(&(p->entityValuePool));
if (isDocEntity) {
- ms->free_fcn(p->scaffIndex);
- ms->free_fcn(p->scaffold);
+ FREE(parser, p->scaffIndex);
+ FREE(parser, p->scaffold);
}
- ms->free_fcn(p);
+ FREE(parser, p);
}
/* Do a deep copy of the DTD. Return 0 for out of memory, non-zero otherwise.

View File

@@ -0,0 +1,52 @@
From 4e7a5d03daf672f20c73d40dc8970385c18b30d3 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Mon, 1 Sep 2025 17:52:58 +0200
Subject: [PATCH] lib: Make function dtdCopy use macro MALLOC
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/4e7a5d03daf672f20c73d40dc8970385c18b30d3]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index e7df97da..9f0a8b3e 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -560,7 +560,7 @@ static DTD *dtdCreate(XML_Parser parser);
static void dtdReset(DTD *p, XML_Parser parser);
static void dtdDestroy(DTD *p, XML_Bool isDocEntity, XML_Parser parser);
static int dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd,
- const XML_Memory_Handling_Suite *ms);
+ XML_Parser parser);
static int copyEntityTable(XML_Parser oldParser, HASH_TABLE *newTable,
STRING_POOL *newPool, const HASH_TABLE *oldTable);
static NAMED *lookup(XML_Parser parser, HASH_TABLE *table, KEY name,
@@ -1572,7 +1572,7 @@ XML_ExternalEntityParserCreate(XML_Parser oldParser, const XML_Char *context,
parser->m_prologState.inEntityValue = oldInEntityValue;
if (context) {
#endif /* XML_DTD */
- if (! dtdCopy(oldParser, parser->m_dtd, oldDtd, &parser->m_mem)
+ if (! dtdCopy(oldParser, parser->m_dtd, oldDtd, parser)
|| ! setContext(parser, context)) {
XML_ParserFree(parser);
return NULL;
@@ -7225,7 +7225,7 @@ dtdDestroy(DTD *p, XML_Bool isDocEntity, XML_Parser parser) {
*/
static int
dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd,
- const XML_Memory_Handling_Suite *ms) {
+ XML_Parser parser) {
HASH_TABLE_ITER iter;
/* Copy the prefix table. */
@@ -7306,7 +7306,7 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd,
}
#endif
newE->defaultAtts
- = ms->malloc_fcn(oldE->nDefaultAtts * sizeof(DEFAULT_ATTRIBUTE));
+ = MALLOC(parser, oldE->nDefaultAtts * sizeof(DEFAULT_ATTRIBUTE));
if (! newE->defaultAtts) {
return 0;
}

View File

@@ -0,0 +1,577 @@
From cfce28e171676fe6f70d17b97ed8a59eaeb83f15 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Mon, 1 Sep 2025 17:34:58 +0200
Subject: [PATCH] lib: Implement tracking of dynamic memory allocations
**PLEASE NOTE** that distributors intending to backport (or cherry-pick)
this fix need to copy 99% of the related pull request, not just this
commit, to not end up with a state that literally does both too much and
too little at the same time. Appending ".diff" to the pull request URL
could be of help.
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/cfce28e171676fe6f70d17b97ed8a59eaeb83f15]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/expat.h | 15 +-
lib/internal.h | 5 +
lib/libexpat.def.cmake | 3 +
lib/xmlparse.c | 337 +++++++++++++++++++++++++++++++++++++++--
tests/basic_tests.c | 4 +
tests/nsalloc_tests.c | 5 +
xmlwf/xmlwf.c | 2 +
xmlwf/xmlwf_helpgen.py | 2 +
8 files changed, 361 insertions(+), 12 deletions(-)
diff --git a/lib/expat.h b/lib/expat.h
index 610e1ddc..66a253c1 100644
--- a/lib/expat.h
+++ b/lib/expat.h
@@ -1032,7 +1032,10 @@ enum XML_FeatureEnum {
XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_MAXIMUM_AMPLIFICATION_DEFAULT,
XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT,
/* Added in Expat 2.6.0. */
- XML_FEATURE_GE
+ XML_FEATURE_GE,
+ /* Added in Expat 2.7.2. */
+ XML_FEATURE_ALLOC_TRACKER_MAXIMUM_AMPLIFICATION_DEFAULT,
+ XML_FEATURE_ALLOC_TRACKER_ACTIVATION_THRESHOLD_DEFAULT,
/* Additional features must be added to the end of this enum. */
};
@@ -1057,6 +1060,16 @@ XML_SetBillionLaughsAttackProtectionMaximumAmplification(
XMLPARSEAPI(XML_Bool)
XML_SetBillionLaughsAttackProtectionActivationThreshold(
XML_Parser parser, unsigned long long activationThresholdBytes);
+
+/* Added in Expat 2.7.2. */
+XMLPARSEAPI(XML_Bool)
+XML_SetAllocTrackerMaximumAmplification(XML_Parser parser,
+ float maximumAmplificationFactor);
+
+/* Added in Expat 2.7.2. */
+XMLPARSEAPI(XML_Bool)
+XML_SetAllocTrackerActivationThreshold(
+ XML_Parser parser, unsigned long long activationThresholdBytes);
#endif
/* Added in Expat 2.6.0. */
diff --git a/lib/internal.h b/lib/internal.h
index 6bde6ae6..eb67cf50 100644
--- a/lib/internal.h
+++ b/lib/internal.h
@@ -145,6 +145,11 @@
100.0f
#define EXPAT_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT \
8388608 // 8 MiB, 2^23
+
+#define EXPAT_ALLOC_TRACKER_MAXIMUM_AMPLIFICATION_DEFAULT 100.0f
+#define EXPAT_ALLOC_TRACKER_ACTIVATION_THRESHOLD_DEFAULT \
+ 67108864 // 64 MiB, 2^26
+
/* NOTE END */
#include "expat.h" // so we can use type XML_Parser below
diff --git a/lib/libexpat.def.cmake b/lib/libexpat.def.cmake
index 10ee9cd6..7a3a7ec0 100644
--- a/lib/libexpat.def.cmake
+++ b/lib/libexpat.def.cmake
@@ -79,3 +79,6 @@ EXPORTS
@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetBillionLaughsAttackProtectionMaximumAmplification @70
; added with version 2.6.0
XML_SetReparseDeferralEnabled @71
+; added with version 2.7.2
+@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetAllocTrackerMaximumAmplification @72
+@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetAllocTrackerActivationThreshold @73
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index 9f0a8b3e..fcf1cfdd 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -452,6 +452,14 @@ typedef struct accounting {
unsigned long long activationThresholdBytes;
} ACCOUNTING;
+typedef struct MALLOC_TRACKER {
+ XmlBigCount bytesAllocated;
+ XmlBigCount peakBytesAllocated; // updated live only for debug level >=2
+ unsigned long debugLevel;
+ float maximumAmplificationFactor; // >=1.0
+ XmlBigCount activationThresholdBytes;
+} MALLOC_TRACKER;
+
typedef struct entity_stats {
unsigned int countEverOpened;
unsigned int currentDepth;
@@ -599,7 +607,8 @@ static XML_Bool startParsing(XML_Parser parser);
static XML_Parser parserCreate(const XML_Char *encodingName,
const XML_Memory_Handling_Suite *memsuite,
- const XML_Char *nameSep, DTD *dtd);
+ const XML_Char *nameSep, DTD *dtd,
+ XML_Parser parentParser);
static void parserInit(XML_Parser parser, const XML_Char *encodingName);
@@ -769,14 +778,220 @@ struct XML_ParserStruct {
unsigned long m_hash_secret_salt;
#if XML_GE == 1
ACCOUNTING m_accounting;
+ MALLOC_TRACKER m_alloc_tracker;
ENTITY_STATS m_entity_stats;
#endif
XML_Bool m_reenter;
};
-#define MALLOC(parser, s) (parser->m_mem.malloc_fcn((s)))
-#define REALLOC(parser, p, s) (parser->m_mem.realloc_fcn((p), (s)))
-#define FREE(parser, p) (parser->m_mem.free_fcn((p)))
+#if XML_GE == 1
+# define MALLOC(parser, s) (expat_malloc((parser), (s), __LINE__))
+# define REALLOC(parser, p, s) (expat_realloc((parser), (p), (s), __LINE__))
+# define FREE(parser, p) (expat_free((parser), (p), __LINE__))
+#else
+# define MALLOC(parser, s) (parser->m_mem.malloc_fcn((s)))
+# define REALLOC(parser, p, s) (parser->m_mem.realloc_fcn((p), (s)))
+# define FREE(parser, p) (parser->m_mem.free_fcn((p)))
+#endif
+
+#if XML_GE == 1
+static void
+expat_heap_stat(XML_Parser rootParser, char operator, XmlBigCount absDiff,
+ XmlBigCount newTotal, XmlBigCount peakTotal, int sourceLine) {
+ // NOTE: This can be +infinity or -nan
+ const float amplification
+ = (float)newTotal / (float)rootParser->m_accounting.countBytesDirect;
+ fprintf(
+ stderr,
+ "expat: Allocations(%p): Direct " EXPAT_FMT_ULL("10") ", allocated %c" EXPAT_FMT_ULL(
+ "10") " to " EXPAT_FMT_ULL("10") " (" EXPAT_FMT_ULL("10") " peak), amplification %8.2f (xmlparse.c:%d)\n",
+ (void *)rootParser, rootParser->m_accounting.countBytesDirect, operator,
+ absDiff, newTotal, peakTotal, (double)amplification, sourceLine);
+}
+
+static bool
+expat_heap_increase_tolerable(XML_Parser rootParser, XmlBigCount increase,
+ int sourceLine) {
+ assert(rootParser != NULL);
+ assert(increase > 0);
+
+ XmlBigCount newTotal = 0;
+ bool tolerable = true;
+
+ // Detect integer overflow
+ if ((XmlBigCount)-1 - rootParser->m_alloc_tracker.bytesAllocated < increase) {
+ tolerable = false;
+ } else {
+ newTotal = rootParser->m_alloc_tracker.bytesAllocated + increase;
+
+ if (newTotal >= rootParser->m_alloc_tracker.activationThresholdBytes) {
+ assert(newTotal > 0);
+ // NOTE: This can be +infinity when dividing by zero but not -nan
+ const float amplification
+ = (float)newTotal / (float)rootParser->m_accounting.countBytesDirect;
+ if (amplification
+ > rootParser->m_alloc_tracker.maximumAmplificationFactor) {
+ tolerable = false;
+ }
+ }
+ }
+
+ if (! tolerable && (rootParser->m_alloc_tracker.debugLevel >= 1)) {
+ expat_heap_stat(rootParser, '+', increase, newTotal, newTotal, sourceLine);
+ }
+
+ return tolerable;
+}
+
+static void *
+expat_malloc(XML_Parser parser, size_t size, int sourceLine) {
+ // Detect integer overflow
+ if (SIZE_MAX - size < sizeof(size_t)) {
+ return NULL;
+ }
+
+ const XML_Parser rootParser = getRootParserOf(parser, NULL);
+ assert(rootParser->m_parentParser == NULL);
+
+ const size_t bytesToAllocate = sizeof(size_t) + size;
+
+ if ((XmlBigCount)-1 - rootParser->m_alloc_tracker.bytesAllocated
+ < bytesToAllocate) {
+ return NULL; // i.e. signal integer overflow as out-of-memory
+ }
+
+ if (! expat_heap_increase_tolerable(rootParser, bytesToAllocate,
+ sourceLine)) {
+ return NULL; // i.e. signal violation as out-of-memory
+ }
+
+ // Actually allocate
+ void *const mallocedPtr = parser->m_mem.malloc_fcn(bytesToAllocate);
+
+ if (mallocedPtr == NULL) {
+ return NULL;
+ }
+
+ // Update in-block recorded size
+ *(size_t *)mallocedPtr = size;
+
+ // Update accounting
+ rootParser->m_alloc_tracker.bytesAllocated += bytesToAllocate;
+
+ // Report as needed
+ if (rootParser->m_alloc_tracker.debugLevel >= 2) {
+ if (rootParser->m_alloc_tracker.bytesAllocated
+ > rootParser->m_alloc_tracker.peakBytesAllocated) {
+ rootParser->m_alloc_tracker.peakBytesAllocated
+ = rootParser->m_alloc_tracker.bytesAllocated;
+ }
+ expat_heap_stat(rootParser, '+', bytesToAllocate,
+ rootParser->m_alloc_tracker.bytesAllocated,
+ rootParser->m_alloc_tracker.peakBytesAllocated, sourceLine);
+ }
+
+ return (char *)mallocedPtr + sizeof(size_t);
+}
+
+static void
+expat_free(XML_Parser parser, void *ptr, int sourceLine) {
+ assert(parser != NULL);
+
+ if (ptr == NULL) {
+ return;
+ }
+
+ const XML_Parser rootParser = getRootParserOf(parser, NULL);
+ assert(rootParser->m_parentParser == NULL);
+
+ // Extract size (to the eyes of malloc_fcn/realloc_fcn) and
+ // the original pointer returned by malloc/realloc
+ void *const mallocedPtr = (char *)ptr - sizeof(size_t);
+ const size_t bytesAllocated = sizeof(size_t) + *(size_t *)mallocedPtr;
+
+ // Update accounting
+ assert(rootParser->m_alloc_tracker.bytesAllocated >= bytesAllocated);
+ rootParser->m_alloc_tracker.bytesAllocated -= bytesAllocated;
+
+ // Report as needed
+ if (rootParser->m_alloc_tracker.debugLevel >= 2) {
+ expat_heap_stat(rootParser, '-', bytesAllocated,
+ rootParser->m_alloc_tracker.bytesAllocated,
+ rootParser->m_alloc_tracker.peakBytesAllocated, sourceLine);
+ }
+
+ // NOTE: This may be freeing rootParser, so freeing has to come last
+ parser->m_mem.free_fcn(mallocedPtr);
+}
+
+static void *
+expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine) {
+ assert(parser != NULL);
+
+ if (ptr == NULL) {
+ return expat_malloc(parser, size, sourceLine);
+ }
+
+ if (size == 0) {
+ expat_free(parser, ptr, sourceLine);
+ return NULL;
+ }
+
+ const XML_Parser rootParser = getRootParserOf(parser, NULL);
+ assert(rootParser->m_parentParser == NULL);
+
+ // Extract original size (to the eyes of the caller) and the original
+ // pointer returned by malloc/realloc
+ void *mallocedPtr = (char *)ptr - sizeof(size_t);
+ const size_t prevSize = *(size_t *)mallocedPtr;
+
+ // Classify upcoming change
+ const bool isIncrease = (size > prevSize);
+ const size_t absDiff
+ = (size > prevSize) ? (size - prevSize) : (prevSize - size);
+
+ // Ask for permission from accounting
+ if (isIncrease) {
+ if (! expat_heap_increase_tolerable(rootParser, absDiff, sourceLine)) {
+ return NULL; // i.e. signal violation as out-of-memory
+ }
+ }
+
+ // Actually allocate
+ mallocedPtr = parser->m_mem.realloc_fcn(mallocedPtr, sizeof(size_t) + size);
+
+ if (mallocedPtr == NULL) {
+ return NULL;
+ }
+
+ // Update accounting
+ if (isIncrease) {
+ assert((XmlBigCount)-1 - rootParser->m_alloc_tracker.bytesAllocated
+ >= absDiff);
+ rootParser->m_alloc_tracker.bytesAllocated += absDiff;
+ } else { // i.e. decrease
+ assert(rootParser->m_alloc_tracker.bytesAllocated >= absDiff);
+ rootParser->m_alloc_tracker.bytesAllocated -= absDiff;
+ }
+
+ // Report as needed
+ if (rootParser->m_alloc_tracker.debugLevel >= 2) {
+ if (rootParser->m_alloc_tracker.bytesAllocated
+ > rootParser->m_alloc_tracker.peakBytesAllocated) {
+ rootParser->m_alloc_tracker.peakBytesAllocated
+ = rootParser->m_alloc_tracker.bytesAllocated;
+ }
+ expat_heap_stat(rootParser, isIncrease ? '+' : '-', absDiff,
+ rootParser->m_alloc_tracker.bytesAllocated,
+ rootParser->m_alloc_tracker.peakBytesAllocated, sourceLine);
+ }
+
+ // Update in-block recorded size
+ *(size_t *)mallocedPtr = size;
+
+ return (char *)mallocedPtr + sizeof(size_t);
+}
+#endif // XML_GE == 1
XML_Parser XMLCALL
XML_ParserCreate(const XML_Char *encodingName) {
@@ -1096,19 +1311,40 @@ XML_Parser XMLCALL
XML_ParserCreate_MM(const XML_Char *encodingName,
const XML_Memory_Handling_Suite *memsuite,
const XML_Char *nameSep) {
- return parserCreate(encodingName, memsuite, nameSep, NULL);
+ return parserCreate(encodingName, memsuite, nameSep, NULL, NULL);
}
static XML_Parser
parserCreate(const XML_Char *encodingName,
const XML_Memory_Handling_Suite *memsuite, const XML_Char *nameSep,
- DTD *dtd) {
- XML_Parser parser;
+ DTD *dtd, XML_Parser parentParser) {
+ XML_Parser parser = NULL;
+
+#if XML_GE == 1
+ const size_t increase = sizeof(size_t) + sizeof(struct XML_ParserStruct);
+
+ if (parentParser != NULL) {
+ const XML_Parser rootParser = getRootParserOf(parentParser, NULL);
+ if (! expat_heap_increase_tolerable(rootParser, increase, __LINE__)) {
+ return NULL;
+ }
+ }
+#else
+ UNUSED_P(parentParser);
+#endif
if (memsuite) {
XML_Memory_Handling_Suite *mtemp;
+#if XML_GE == 1
+ void *const sizeAndParser = memsuite->malloc_fcn(
+ sizeof(size_t) + sizeof(struct XML_ParserStruct));
+ if (sizeAndParser != NULL) {
+ *(size_t *)sizeAndParser = sizeof(struct XML_ParserStruct);
+ parser = (XML_Parser)((char *)sizeAndParser + sizeof(size_t));
+#else
parser = memsuite->malloc_fcn(sizeof(struct XML_ParserStruct));
if (parser != NULL) {
+#endif
mtemp = (XML_Memory_Handling_Suite *)&(parser->m_mem);
mtemp->malloc_fcn = memsuite->malloc_fcn;
mtemp->realloc_fcn = memsuite->realloc_fcn;
@@ -1116,18 +1352,67 @@ parserCreate(const XML_Char *encodingName,
}
} else {
XML_Memory_Handling_Suite *mtemp;
+#if XML_GE == 1
+ void *const sizeAndParser
+ = (XML_Parser)malloc(sizeof(size_t) + sizeof(struct XML_ParserStruct));
+ if (sizeAndParser != NULL) {
+ *(size_t *)sizeAndParser = sizeof(struct XML_ParserStruct);
+ parser = (XML_Parser)((char *)sizeAndParser + sizeof(size_t));
+#else
parser = (XML_Parser)malloc(sizeof(struct XML_ParserStruct));
if (parser != NULL) {
+#endif
mtemp = (XML_Memory_Handling_Suite *)&(parser->m_mem);
mtemp->malloc_fcn = malloc;
mtemp->realloc_fcn = realloc;
mtemp->free_fcn = free;
}
- }
+ } // cppcheck-suppress[memleak symbolName=sizeAndParser] // Cppcheck >=2.18.0
if (! parser)
return parser;
+#if XML_GE == 1
+ // Initialize .m_alloc_tracker
+ memset(&parser->m_alloc_tracker, 0, sizeof(MALLOC_TRACKER));
+ if (parentParser == NULL) {
+ parser->m_alloc_tracker.debugLevel
+ = getDebugLevel("EXPAT_MALLOC_DEBUG", 0u);
+ parser->m_alloc_tracker.maximumAmplificationFactor
+ = EXPAT_ALLOC_TRACKER_MAXIMUM_AMPLIFICATION_DEFAULT;
+ parser->m_alloc_tracker.activationThresholdBytes
+ = EXPAT_ALLOC_TRACKER_ACTIVATION_THRESHOLD_DEFAULT;
+
+ // NOTE: This initialization needs to come this early because these fields
+ // are read by allocation tracking code
+ parser->m_parentParser = NULL;
+ parser->m_accounting.countBytesDirect = 0;
+ } else {
+ parser->m_parentParser = parentParser;
+ }
+
+ // Record XML_ParserStruct allocation we did a few lines up before
+ const XML_Parser rootParser = getRootParserOf(parser, NULL);
+ assert(rootParser->m_parentParser == NULL);
+ assert(SIZE_MAX - rootParser->m_alloc_tracker.bytesAllocated >= increase);
+ rootParser->m_alloc_tracker.bytesAllocated += increase;
+
+ // Report on allocation
+ if (rootParser->m_alloc_tracker.debugLevel >= 2) {
+ if (rootParser->m_alloc_tracker.bytesAllocated
+ > rootParser->m_alloc_tracker.peakBytesAllocated) {
+ rootParser->m_alloc_tracker.peakBytesAllocated
+ = rootParser->m_alloc_tracker.bytesAllocated;
+ }
+
+ expat_heap_stat(rootParser, '+', increase,
+ rootParser->m_alloc_tracker.bytesAllocated,
+ rootParser->m_alloc_tracker.peakBytesAllocated, __LINE__);
+ }
+#else
+ parser->m_parentParser = NULL;
+#endif // XML_GE == 1
+
parser->m_buffer = NULL;
parser->m_bufferLim = NULL;
@@ -1291,7 +1576,6 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) {
parser->m_unknownEncodingMem = NULL;
parser->m_unknownEncodingRelease = NULL;
parser->m_unknownEncodingData = NULL;
- parser->m_parentParser = NULL;
parser->m_parsingStatus.parsing = XML_INITIALIZED;
// Reentry can only be triggered inside m_processor calls
parser->m_reenter = XML_FALSE;
@@ -1526,9 +1810,10 @@ XML_ExternalEntityParserCreate(XML_Parser oldParser, const XML_Char *context,
*/
if (parser->m_ns) {
XML_Char tmp[2] = {parser->m_namespaceSeparator, 0};
- parser = parserCreate(encodingName, &parser->m_mem, tmp, newDtd);
+ parser = parserCreate(encodingName, &parser->m_mem, tmp, newDtd, oldParser);
} else {
- parser = parserCreate(encodingName, &parser->m_mem, NULL, newDtd);
+ parser
+ = parserCreate(encodingName, &parser->m_mem, NULL, newDtd, oldParser);
}
if (! parser)
@@ -2708,6 +2993,13 @@ XML_GetFeatureList(void) {
EXPAT_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT},
/* Added in Expat 2.6.0. */
{XML_FEATURE_GE, XML_L("XML_GE"), 0},
+ /* Added in Expat 2.7.2. */
+ {XML_FEATURE_ALLOC_TRACKER_MAXIMUM_AMPLIFICATION_DEFAULT,
+ XML_L("XML_AT_MAX_AMP"),
+ (long int)EXPAT_ALLOC_TRACKER_MAXIMUM_AMPLIFICATION_DEFAULT},
+ {XML_FEATURE_ALLOC_TRACKER_ACTIVATION_THRESHOLD_DEFAULT,
+ XML_L("XML_AT_ACT_THRES"),
+ (long int)EXPAT_ALLOC_TRACKER_ACTIVATION_THRESHOLD_DEFAULT},
#endif
{XML_FEATURE_END, NULL, 0}};
@@ -2736,6 +3028,29 @@ XML_SetBillionLaughsAttackProtectionActivationThreshold(
parser->m_accounting.activationThresholdBytes = activationThresholdBytes;
return XML_TRUE;
}
+
+XML_Bool XMLCALL
+XML_SetAllocTrackerMaximumAmplification(XML_Parser parser,
+ float maximumAmplificationFactor) {
+ if ((parser == NULL) || (parser->m_parentParser != NULL)
+ || isnan(maximumAmplificationFactor)
+ || (maximumAmplificationFactor < 1.0f)) {
+ return XML_FALSE;
+ }
+ parser->m_alloc_tracker.maximumAmplificationFactor
+ = maximumAmplificationFactor;
+ return XML_TRUE;
+}
+
+XML_Bool XMLCALL
+XML_SetAllocTrackerActivationThreshold(
+ XML_Parser parser, unsigned long long activationThresholdBytes) {
+ if ((parser == NULL) || (parser->m_parentParser != NULL)) {
+ return XML_FALSE;
+ }
+ parser->m_alloc_tracker.activationThresholdBytes = activationThresholdBytes;
+ return XML_TRUE;
+}
#endif /* XML_GE == 1 */
XML_Bool XMLCALL
diff --git a/tests/basic_tests.c b/tests/basic_tests.c
index 129db1d8..0231e094 100644
--- a/tests/basic_tests.c
+++ b/tests/basic_tests.c
@@ -3089,6 +3089,10 @@ START_TEST(test_buffer_can_grow_to_max) {
for (int i = 0; i < num_prefixes; ++i) {
set_subtest("\"%s\"", prefixes[i]);
XML_Parser parser = XML_ParserCreate(NULL);
+#if XML_GE == 1
+ assert_true(XML_SetAllocTrackerActivationThreshold(parser, (size_t)-1)
+ == XML_TRUE); // i.e. deactivate
+#endif
const int prefix_len = (int)strlen(prefixes[i]);
const enum XML_Status s
= _XML_Parse_SINGLE_BYTES(parser, prefixes[i], prefix_len, XML_FALSE);
diff --git a/tests/nsalloc_tests.c b/tests/nsalloc_tests.c
index 48520f42..0a594e14 100644
--- a/tests/nsalloc_tests.c
+++ b/tests/nsalloc_tests.c
@@ -454,10 +454,15 @@ START_TEST(test_nsalloc_realloc_attributes) {
nsalloc_teardown();
nsalloc_setup();
}
+#if XML_GE == 1
+ assert_true(
+ i == 0); // because expat_realloc relies on expat_malloc to some extent
+#else
if (i == 0)
fail("Parsing worked despite failing reallocations");
else if (i == max_realloc_count)
fail("Parsing failed at max reallocation count");
+#endif
}
END_TEST
diff --git a/xmlwf/xmlwf.c b/xmlwf/xmlwf.c
index 8cfc73ca..b9d0a7fc 100644
--- a/xmlwf/xmlwf.c
+++ b/xmlwf/xmlwf.c
@@ -933,6 +933,8 @@ usage(const XML_Char *prog, int rc) {
T(" Control verbosity of entity debugging (default: 0)\n")
T(" EXPAT_ENTROPY_DEBUG=(0|1)\n")
T(" Control verbosity of entropy debugging (default: 0)\n")
+ T(" EXPAT_MALLOC_DEBUG=(0|1|2)\n")
+ T(" Control verbosity of allocation tracker (default: 0)\n")
T("\n")
T("exit status:\n")
T(" 0 the input files are well-formed and the output (if requested) was written successfully\n")
diff --git a/xmlwf/xmlwf_helpgen.py b/xmlwf/xmlwf_helpgen.py
index 39a3dc13..2360820d 100755
--- a/xmlwf/xmlwf_helpgen.py
+++ b/xmlwf/xmlwf_helpgen.py
@@ -39,6 +39,8 @@ environment variables:
Control verbosity of entity debugging (default: 0)
EXPAT_ENTROPY_DEBUG=(0|1)
Control verbosity of entropy debugging (default: 0)
+ EXPAT_MALLOC_DEBUG=(0|1|2)
+ Control verbosity of allocation tracker (default: 0)
exit status:
0 the input files are well-formed and the output (if requested) was written successfully

View File

@@ -0,0 +1,43 @@
From 1270e5bc0836d296ac4970fc9e1cf53d83972083 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Sun, 7 Sep 2025 12:18:08 +0200
Subject: [PATCH] lib: Make XML_MemFree and XML_FreeContentModel match their
siblings
.. XML_MemMalloc and XML_MemRealloc in structure, prior to upcoming changes
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/1270e5bc0836d296ac4970fc9e1cf53d83972083]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index fcf1cfdd..5d27cd45 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -2772,8 +2772,9 @@ XML_GetCurrentColumnNumber(XML_Parser parser) {
void XMLCALL
XML_FreeContentModel(XML_Parser parser, XML_Content *model) {
- if (parser != NULL)
- FREE(parser, model);
+ if (parser == NULL)
+ return;
+ FREE(parser, model);
}
void *XMLCALL
@@ -2792,8 +2793,9 @@ XML_MemRealloc(XML_Parser parser, void *ptr, size_t size) {
void XMLCALL
XML_MemFree(XML_Parser parser, void *ptr) {
- if (parser != NULL)
- FREE(parser, ptr);
+ if (parser == NULL)
+ return;
+ FREE(parser, ptr);
}
void XMLCALL

View File

@@ -0,0 +1,54 @@
From 96c7467281c72028aada525c1d3822512758b266 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Sun, 7 Sep 2025 12:06:43 +0200
Subject: [PATCH] lib: Exclude XML_Mem* functions from allocation tracking
.. so that allocations by the user application
are not being limited.
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/96c7467281c72028aada525c1d3822512758b266]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index 5d27cd45..8145a049 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -2781,21 +2781,31 @@ void *XMLCALL
XML_MemMalloc(XML_Parser parser, size_t size) {
if (parser == NULL)
return NULL;
- return MALLOC(parser, size);
+
+ // NOTE: We are avoiding MALLOC(..) here to not include
+ // user allocations with allocation tracking and limiting.
+ return parser->m_mem.malloc_fcn(size);
}
void *XMLCALL
XML_MemRealloc(XML_Parser parser, void *ptr, size_t size) {
if (parser == NULL)
return NULL;
- return REALLOC(parser, ptr, size);
+
+ // NOTE: We are avoiding REALLOC(..) here to not include
+ // user allocations with allocation tracking and limiting.
+ return parser->m_mem.realloc_fcn(ptr, size);
}
void XMLCALL
XML_MemFree(XML_Parser parser, void *ptr) {
if (parser == NULL)
return;
- FREE(parser, ptr);
+
+ // NOTE: We are avoiding FREE(..) here because XML_MemMalloc and
+ // XML_MemRealloc are not using MALLOC(..) and REALLOC(..)
+ // but plain .malloc_fcn(..) and .realloc_fcn(..), internally.
+ parser->m_mem.free_fcn(ptr);
}
void XMLCALL

View File

@@ -0,0 +1,66 @@
From ae4086198d710a62a0a1560007b81307dba72909 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Tue, 9 Sep 2025 21:34:28 +0200
Subject: [PATCH] lib: Exclude the main input buffer from allocation tracking
.. so that control of the input buffer size remains with the
application using Expat
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/ae4086198d710a62a0a1560007b81307dba72909]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index 8145a049..00139b94 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -1975,7 +1975,10 @@ XML_ParserFree(XML_Parser parser) {
FREE(parser, (void *)parser->m_attInfo);
#endif
FREE(parser, parser->m_groupConnector);
- FREE(parser, parser->m_buffer);
+ // NOTE: We are avoiding FREE(..) here because parser->m_buffer
+ // is not being allocated with MALLOC(..) but with plain
+ // .malloc_fcn(..).
+ parser->m_mem.free_fcn(parser->m_buffer);
FREE(parser, parser->m_dataBuf);
FREE(parser, parser->m_nsAtts);
FREE(parser, parser->m_unknownEncodingMem);
@@ -2567,7 +2570,9 @@ XML_GetBuffer(XML_Parser parser, int len) {
parser->m_errorCode = XML_ERROR_NO_MEMORY;
return NULL;
}
- newBuf = (char *)MALLOC(parser, bufferSize);
+ // NOTE: We are avoiding MALLOC(..) here to leave limiting
+ // the input size to the application using Expat.
+ newBuf = (char *)parser->m_mem.malloc_fcn(bufferSize);
if (newBuf == 0) {
parser->m_errorCode = XML_ERROR_NO_MEMORY;
return NULL;
@@ -2578,7 +2583,10 @@ XML_GetBuffer(XML_Parser parser, int len) {
memcpy(newBuf, &parser->m_bufferPtr[-keep],
EXPAT_SAFE_PTR_DIFF(parser->m_bufferEnd, parser->m_bufferPtr)
+ keep);
- FREE(parser, parser->m_buffer);
+ // NOTE: We are avoiding FREE(..) here because parser->m_buffer
+ // is not being allocated with MALLOC(..) but with plain
+ // .malloc_fcn(..).
+ parser->m_mem.free_fcn(parser->m_buffer);
parser->m_buffer = newBuf;
parser->m_bufferEnd
= parser->m_buffer
@@ -2594,7 +2602,10 @@ XML_GetBuffer(XML_Parser parser, int len) {
if (parser->m_bufferPtr) {
memcpy(newBuf, parser->m_bufferPtr,
EXPAT_SAFE_PTR_DIFF(parser->m_bufferEnd, parser->m_bufferPtr));
- FREE(parser, parser->m_buffer);
+ // NOTE: We are avoiding FREE(..) here because parser->m_buffer
+ // is not being allocated with MALLOC(..) but with plain
+ // .malloc_fcn(..).
+ parser->m_mem.free_fcn(parser->m_buffer);
parser->m_bufferEnd
= newBuf
+ EXPAT_SAFE_PTR_DIFF(parser->m_bufferEnd, parser->m_bufferPtr);

View File

@@ -0,0 +1,58 @@
From 7e35240dc97e9fd4f609e31f27c27b659535e436 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Thu, 11 Sep 2025 00:27:05 +0200
Subject: [PATCH] lib: Exclude the content model from allocation tracking
.. so that applications that are not using XML_FreeContentModel
but plain free(..) or .free_fcn() to free the content model's
memory are safe
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/7e35240dc97e9fd4f609e31f27c27b659535e436]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index 00139b94..d0b6e0cd 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -2785,7 +2785,10 @@ void XMLCALL
XML_FreeContentModel(XML_Parser parser, XML_Content *model) {
if (parser == NULL)
return;
- FREE(parser, model);
+
+ // NOTE: We are avoiding FREE(..) here because the content model
+ // has been created using plain .malloc_fcn(..) rather than MALLOC(..).
+ parser->m_mem.free_fcn(model);
}
void *XMLCALL
@@ -6063,8 +6066,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
case XML_ROLE_CONTENT_EMPTY:
if (dtd->in_eldecl) {
if (parser->m_elementDeclHandler) {
+ // NOTE: We are avoiding MALLOC(..) here to so that
+ // applications that are not using XML_FreeContentModel but
+ // plain free(..) or .free_fcn() to free the content model's
+ // memory are safe.
XML_Content *content
- = (XML_Content *)MALLOC(parser, sizeof(XML_Content));
+ = (XML_Content *)parser->m_mem.malloc_fcn(sizeof(XML_Content));
if (! content)
return XML_ERROR_NO_MEMORY;
content->quant = XML_CQUANT_NONE;
@@ -8278,7 +8285,10 @@ build_model(XML_Parser parser) {
const size_t allocsize = (dtd->scaffCount * sizeof(XML_Content)
+ (dtd->contentStringLen * sizeof(XML_Char)));
- ret = (XML_Content *)MALLOC(parser, allocsize);
+ // NOTE: We are avoiding MALLOC(..) here to so that
+ // applications that are not using XML_FreeContentModel but plain
+ // free(..) or .free_fcn() to free the content model's memory are safe.
+ ret = (XML_Content *)parser->m_mem.malloc_fcn(allocsize);
if (! ret)
return NULL;

View File

@@ -0,0 +1,309 @@
From 31f9053c3c46741f4daf2ea2bdea75f40f720d42 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Tue, 2 Sep 2025 22:36:49 +0200
Subject: [PATCH] tests: Cover allocation tracking and limiting with tests
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/31f9053c3c46741f4daf2ea2bdea75f40f720d42]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/internal.h | 3 +
lib/xmlparse.c | 12 +++
tests/alloc_tests.c | 214 ++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 229 insertions(+)
diff --git a/lib/internal.h b/lib/internal.h
index eb67cf50..6e087858 100644
--- a/lib/internal.h
+++ b/lib/internal.h
@@ -173,6 +173,9 @@ extern
#endif
XML_Bool g_reparseDeferralEnabledDefault; // written ONLY in runtests.c
#if defined(XML_TESTING)
+void *expat_malloc(XML_Parser parser, size_t size, int sourceLine);
+void expat_free(XML_Parser parser, void *ptr, int sourceLine);
+void *expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine);
extern unsigned int g_bytesScanned; // used for testing only
#endif
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index d0b6e0cd..6e9c6fb2 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -843,7 +843,11 @@ expat_heap_increase_tolerable(XML_Parser rootParser, XmlBigCount increase,
return tolerable;
}
+# if defined(XML_TESTING)
+void *
+# else
static void *
+# endif
expat_malloc(XML_Parser parser, size_t size, int sourceLine) {
// Detect integer overflow
if (SIZE_MAX - size < sizeof(size_t)) {
@@ -893,7 +897,11 @@ expat_malloc(XML_Parser parser, size_t size, int sourceLine) {
return (char *)mallocedPtr + sizeof(size_t);
}
+# if defined(XML_TESTING)
+void
+# else
static void
+# endif
expat_free(XML_Parser parser, void *ptr, int sourceLine) {
assert(parser != NULL);
@@ -924,7 +932,11 @@ expat_free(XML_Parser parser, void *ptr, int sourceLine) {
parser->m_mem.free_fcn(mallocedPtr);
}
+# if defined(XML_TESTING)
+void *
+# else
static void *
+# endif
expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine) {
assert(parser != NULL);
diff --git a/tests/alloc_tests.c b/tests/alloc_tests.c
index 4c3e2af4..275f92d5 100644
--- a/tests/alloc_tests.c
+++ b/tests/alloc_tests.c
@@ -46,10 +46,16 @@
# undef NDEBUG /* because test suite relies on assert(...) at the moment */
#endif
+#include <math.h> /* NAN, INFINITY */
+#include <stdbool.h>
+#include <stdint.h> /* for SIZE_MAX */
#include <string.h>
#include <assert.h>
+#include "expat_config.h"
+
#include "expat.h"
+#include "internal.h"
#include "common.h"
#include "minicheck.h"
#include "dummy.h"
@@ -2085,6 +2091,203 @@ START_TEST(test_alloc_reset_after_external_entity_parser_create_fail) {
}
END_TEST
+START_TEST(test_alloc_tracker_size_recorded) {
+ XML_Memory_Handling_Suite memsuite = {malloc, realloc, free};
+
+ bool values[] = {true, false};
+ for (size_t i = 0; i < sizeof(values) / sizeof(values[0]); i++) {
+ const bool useMemSuite = values[i];
+ set_subtest("useMemSuite=%d", (int)useMemSuite);
+ XML_Parser parser = useMemSuite
+ ? XML_ParserCreate_MM(NULL, &memsuite, XCS("|"))
+ : XML_ParserCreate(NULL);
+
+#if XML_GE == 1
+ void *ptr = expat_malloc(parser, 10, -1);
+
+ assert_true(ptr != NULL);
+ assert_true(*((size_t *)ptr - 1) == 10);
+
+ assert_true(expat_realloc(parser, ptr, SIZE_MAX / 2, -1) == NULL);
+
+ assert_true(*((size_t *)ptr - 1) == 10); // i.e. unchanged
+
+ ptr = expat_realloc(parser, ptr, 20, -1);
+
+ assert_true(ptr != NULL);
+ assert_true(*((size_t *)ptr - 1) == 20);
+
+ expat_free(parser, ptr, -1);
+#endif
+
+ XML_ParserFree(parser);
+ }
+}
+END_TEST
+
+START_TEST(test_alloc_tracker_maximum_amplification) {
+ if (g_reparseDeferralEnabledDefault == XML_TRUE) {
+ return;
+ }
+
+ XML_Parser parser = XML_ParserCreate(NULL);
+
+ // Get .m_accounting.countBytesDirect from 0 to 3
+ const char *const chunk = "<e>";
+ assert_true(_XML_Parse_SINGLE_BYTES(parser, chunk, (int)strlen(chunk),
+ /*isFinal=*/XML_FALSE)
+ == XML_STATUS_OK);
+
+#if XML_GE == 1
+ // Stop activation threshold from interfering
+ assert_true(XML_SetAllocTrackerActivationThreshold(parser, 0) == XML_TRUE);
+
+ // Exceed maximum amplification: should be rejected.
+ assert_true(expat_malloc(parser, 1000, -1) == NULL);
+
+ // Increase maximum amplification, and try the same amount once more: should
+ // work.
+ assert_true(XML_SetAllocTrackerMaximumAmplification(parser, 3000.0f)
+ == XML_TRUE);
+
+ void *const ptr = expat_malloc(parser, 1000, -1);
+ assert_true(ptr != NULL);
+ expat_free(parser, ptr, -1);
+#endif
+
+ XML_ParserFree(parser);
+}
+END_TEST
+
+START_TEST(test_alloc_tracker_threshold) {
+ XML_Parser parser = XML_ParserCreate(NULL);
+
+#if XML_GE == 1
+ // Exceed maximum amplification *before* (default) threshold: should work.
+ void *const ptr = expat_malloc(parser, 1000, -1);
+ assert_true(ptr != NULL);
+ expat_free(parser, ptr, -1);
+
+ // Exceed maximum amplification *after* threshold: should be rejected.
+ assert_true(XML_SetAllocTrackerActivationThreshold(parser, 999) == XML_TRUE);
+ assert_true(expat_malloc(parser, 1000, -1) == NULL);
+#endif
+
+ XML_ParserFree(parser);
+}
+END_TEST
+
+START_TEST(test_alloc_tracker_getbuffer_unlimited) {
+ XML_Parser parser = XML_ParserCreate(NULL);
+
+#if XML_GE == 1
+ // Artificially lower threshold
+ assert_true(XML_SetAllocTrackerActivationThreshold(parser, 0) == XML_TRUE);
+
+ // Self-test: Prove that threshold is as rejecting as expected
+ assert_true(expat_malloc(parser, 1000, -1) == NULL);
+#endif
+ // XML_GetBuffer should be allowed to pass, though
+ assert_true(XML_GetBuffer(parser, 1000) != NULL);
+
+ XML_ParserFree(parser);
+}
+END_TEST
+
+START_TEST(test_alloc_tracker_api) {
+ XML_Parser parserWithoutParent = XML_ParserCreate(NULL);
+ XML_Parser parserWithParent = XML_ExternalEntityParserCreate(
+ parserWithoutParent, XCS("entity123"), NULL);
+ if (parserWithoutParent == NULL)
+ fail("parserWithoutParent is NULL");
+ if (parserWithParent == NULL)
+ fail("parserWithParent is NULL");
+
+#if XML_GE == 1
+ // XML_SetAllocTrackerMaximumAmplification, error cases
+ if (XML_SetAllocTrackerMaximumAmplification(NULL, 123.0f) == XML_TRUE)
+ fail("Call with NULL parser is NOT supposed to succeed");
+ if (XML_SetAllocTrackerMaximumAmplification(parserWithParent, 123.0f)
+ == XML_TRUE)
+ fail("Call with non-root parser is NOT supposed to succeed");
+ if (XML_SetAllocTrackerMaximumAmplification(parserWithoutParent, NAN)
+ == XML_TRUE)
+ fail("Call with NaN limit is NOT supposed to succeed");
+ if (XML_SetAllocTrackerMaximumAmplification(parserWithoutParent, -1.0f)
+ == XML_TRUE)
+ fail("Call with negative limit is NOT supposed to succeed");
+ if (XML_SetAllocTrackerMaximumAmplification(parserWithoutParent, 0.9f)
+ == XML_TRUE)
+ fail("Call with positive limit <1.0 is NOT supposed to succeed");
+
+ // XML_SetAllocTrackerMaximumAmplification, success cases
+ if (XML_SetAllocTrackerMaximumAmplification(parserWithoutParent, 1.0f)
+ == XML_FALSE)
+ fail("Call with positive limit >=1.0 is supposed to succeed");
+ if (XML_SetAllocTrackerMaximumAmplification(parserWithoutParent, 123456.789f)
+ == XML_FALSE)
+ fail("Call with positive limit >=1.0 is supposed to succeed");
+ if (XML_SetAllocTrackerMaximumAmplification(parserWithoutParent, INFINITY)
+ == XML_FALSE)
+ fail("Call with positive limit >=1.0 is supposed to succeed");
+
+ // XML_SetAllocTrackerActivationThreshold, error cases
+ if (XML_SetAllocTrackerActivationThreshold(NULL, 123) == XML_TRUE)
+ fail("Call with NULL parser is NOT supposed to succeed");
+ if (XML_SetAllocTrackerActivationThreshold(parserWithParent, 123) == XML_TRUE)
+ fail("Call with non-root parser is NOT supposed to succeed");
+
+ // XML_SetAllocTrackerActivationThreshold, success cases
+ if (XML_SetAllocTrackerActivationThreshold(parserWithoutParent, 123)
+ == XML_FALSE)
+ fail("Call with non-NULL parentless parser is supposed to succeed");
+#endif // XML_GE == 1
+
+ XML_ParserFree(parserWithParent);
+ XML_ParserFree(parserWithoutParent);
+}
+END_TEST
+
+START_TEST(test_mem_api_cycle) {
+ XML_Parser parser = XML_ParserCreate(NULL);
+
+ void *ptr = XML_MemMalloc(parser, 10);
+
+ assert_true(ptr != NULL);
+ memset(ptr, 'x', 10); // assert writability, with ASan in mind
+
+ ptr = XML_MemRealloc(parser, ptr, 20);
+
+ assert_true(ptr != NULL);
+ memset(ptr, 'y', 20); // assert writability, with ASan in mind
+
+ XML_MemFree(parser, ptr);
+
+ XML_ParserFree(parser);
+}
+END_TEST
+
+START_TEST(test_mem_api_unlimited) {
+ XML_Parser parser = XML_ParserCreate(NULL);
+
+#if XML_GE == 1
+ assert_true(XML_SetAllocTrackerActivationThreshold(parser, 0) == XML_TRUE);
+#endif
+
+ void *ptr = XML_MemMalloc(parser, 1000);
+
+ assert_true(ptr != NULL);
+
+ ptr = XML_MemRealloc(parser, ptr, 2000);
+
+ assert_true(ptr != NULL);
+
+ XML_MemFree(parser, ptr);
+
+ XML_ParserFree(parser);
+}
+END_TEST
+
void
make_alloc_test_case(Suite *s) {
TCase *tc_alloc = tcase_create("allocation tests");
@@ -2151,4 +2354,15 @@ make_alloc_test_case(Suite *s) {
tcase_add_test__ifdef_xml_dtd(
tc_alloc, test_alloc_reset_after_external_entity_parser_create_fail);
+
+ tcase_add_test__ifdef_xml_dtd(tc_alloc, test_alloc_tracker_size_recorded);
+ tcase_add_test__ifdef_xml_dtd(tc_alloc,
+ test_alloc_tracker_maximum_amplification);
+ tcase_add_test__ifdef_xml_dtd(tc_alloc, test_alloc_tracker_threshold);
+ tcase_add_test__ifdef_xml_dtd(tc_alloc,
+ test_alloc_tracker_getbuffer_unlimited);
+ tcase_add_test__ifdef_xml_dtd(tc_alloc, test_alloc_tracker_api);
+
+ tcase_add_test(tc_alloc, test_mem_api_cycle);
+ tcase_add_test__ifdef_xml_dtd(tc_alloc, test_mem_api_unlimited);
}

View File

@@ -0,0 +1,122 @@
From 78366891a586f293aeff60a14a55e4afe1169586 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Tue, 2 Sep 2025 16:44:00 +0200
Subject: [PATCH] xmlwf: Wire allocation tracker config to existing arguments
-a and -b
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/78366891a586f293aeff60a14a55e4afe1169586]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
doc/xmlwf.xml | 26 ++++++++++++++++++++------
xmlwf/xmlwf.c | 7 +++++--
xmlwf/xmlwf_helpgen.py | 4 ++--
3 files changed, 27 insertions(+), 10 deletions(-)
diff --git a/doc/xmlwf.xml b/doc/xmlwf.xml
index 17e9cf51..65d8ae9b 100644
--- a/doc/xmlwf.xml
+++ b/doc/xmlwf.xml
@@ -158,19 +158,31 @@ supports both.
<listitem>
<para>
Sets the maximum tolerated amplification factor
- for protection against billion laughs attacks (default: 100.0).
+ for protection against amplification attacks
+ like the billion laughs attack
+ (default: 100.0
+ for the sum of direct and indirect output and also
+ for allocations of dynamic memory).
The amplification factor is calculated as ..
</para>
<literallayout>
amplification := (direct + indirect) / direct
</literallayout>
<para>
- .. while parsing, whereas
+ .. with regard to use of entities and ..
+ </para>
+ <literallayout>
+ amplification := allocated / direct
+ </literallayout>
+ <para>
+ .. with regard to dynamic memory while parsing.
&lt;direct&gt; is the number of bytes read
- from the primary document in parsing and
+ from the primary document in parsing,
&lt;indirect&gt; is the number of bytes
added by expanding entities and reading of external DTD files,
- combined.
+ combined, and
+ &lt;allocated&gt; is the total number of bytes of dynamic memory
+ allocated (and not freed) per hierarchy of parsers.
</para>
<para>
<emphasis>NOTE</emphasis>:
@@ -185,8 +197,10 @@ supports both.
<listitem>
<para>
Sets the number of output bytes (including amplification)
- needed to activate protection against billion laughs attacks
- (default: 8 MiB).
+ needed to activate protection against amplification attacks
+ like billion laughs
+ (default: 8 MiB for the sum of direct and indirect output,
+ and 64 MiB for allocations of dynamic memory).
This can be thought of as an &quot;activation threshold&quot;.
</para>
<para>
diff --git a/xmlwf/xmlwf.c b/xmlwf/xmlwf.c
index b9d0a7fc..14206d9e 100644
--- a/xmlwf/xmlwf.c
+++ b/xmlwf/xmlwf.c
@@ -913,11 +913,11 @@ usage(const XML_Char *prog, int rc) {
T(" -t write no XML output for [t]iming of plain parsing\n")
T(" -N enable adding doctype and [n]otation declarations\n")
T("\n")
- T("billion laughs attack protection:\n")
+ T("amplification attack protection (e.g. billion laughs):\n")
T(" NOTE: If you ever need to increase these values for non-attack payload, please file a bug report.\n")
T("\n")
T(" -a FACTOR set maximum tolerated [a]mplification factor (default: 100.0)\n")
- T(" -b BYTES set number of output [b]ytes needed to activate (default: 8 MiB)\n")
+ T(" -b BYTES set number of output [b]ytes needed to activate (default: 8 MiB/64 MiB)\n")
T("\n")
T("reparse deferral:\n")
T(" -q disable reparse deferral, and allow [q]uadratic parse runtime with large tokens\n")
@@ -1181,12 +1181,15 @@ tmain(int argc, XML_Char **argv) {
#if XML_GE == 1
XML_SetBillionLaughsAttackProtectionMaximumAmplification(
parser, attackMaximumAmplification);
+ XML_SetAllocTrackerMaximumAmplification(parser,
+ attackMaximumAmplification);
#endif
}
if (attackThresholdGiven) {
#if XML_GE == 1
XML_SetBillionLaughsAttackProtectionActivationThreshold(
parser, attackThresholdBytes);
+ XML_SetAllocTrackerActivationThreshold(parser, attackThresholdBytes);
#else
(void)attackThresholdBytes; // silence -Wunused-but-set-variable
#endif
diff --git a/xmlwf/xmlwf_helpgen.py b/xmlwf/xmlwf_helpgen.py
index 2360820d..e91c285c 100755
--- a/xmlwf/xmlwf_helpgen.py
+++ b/xmlwf/xmlwf_helpgen.py
@@ -84,13 +84,13 @@ output_mode.add_argument('-m', action='store_true', help='write [m]eta XML, not
output_mode.add_argument('-t', action='store_true', help='write no XML output for [t]iming of plain parsing')
output_related.add_argument('-N', action='store_true', help='enable adding doctype and [n]otation declarations')
-billion_laughs = parser.add_argument_group('billion laughs attack protection',
+billion_laughs = parser.add_argument_group('amplification attack protection (e.g. billion laughs)',
description='NOTE: '
'If you ever need to increase these values '
'for non-attack payload, please file a bug report.')
billion_laughs.add_argument('-a', metavar='FACTOR',
help='set maximum tolerated [a]mplification factor (default: 100.0)')
-billion_laughs.add_argument('-b', metavar='BYTES', help='set number of output [b]ytes needed to activate (default: 8 MiB)')
+billion_laughs.add_argument('-b', metavar='BYTES', help='set number of output [b]ytes needed to activate (default: 8 MiB/64 MiB)')
reparse_deferral = parser.add_argument_group('reparse deferral')
reparse_deferral.add_argument('-q', metavar='FACTOR',

View File

@@ -0,0 +1,70 @@
From 5ae51be57ed0ca1e87582881d07ea9c29c4f7c05 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Wed, 3 Sep 2025 17:06:41 +0200
Subject: [PATCH] fuzz: Be robust towards NULL return from
XML_ExternalEntityParserCreate
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/5ae51be57ed0ca1e87582881d07ea9c29c4f7c05]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
fuzz/xml_parse_fuzzer.c | 14 ++++++++------
fuzz/xml_parsebuffer_fuzzer.c | 14 ++++++++------
2 files changed, 16 insertions(+), 12 deletions(-)
diff --git a/fuzz/xml_parse_fuzzer.c b/fuzz/xml_parse_fuzzer.c
index 90c38549..29ab33ff 100644
--- a/fuzz/xml_parse_fuzzer.c
+++ b/fuzz/xml_parse_fuzzer.c
@@ -89,15 +89,17 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
XML_Parser externalEntityParser
= XML_ExternalEntityParserCreate(parentParser, "e1", NULL);
- assert(externalEntityParser);
- ParseOneInput(externalEntityParser, data, size);
- XML_ParserFree(externalEntityParser);
+ if (externalEntityParser != NULL) {
+ ParseOneInput(externalEntityParser, data, size);
+ XML_ParserFree(externalEntityParser);
+ }
XML_Parser externalDtdParser
= XML_ExternalEntityParserCreate(parentParser, NULL, NULL);
- assert(externalDtdParser);
- ParseOneInput(externalDtdParser, data, size);
- XML_ParserFree(externalDtdParser);
+ if (externalDtdParser != NULL) {
+ ParseOneInput(externalDtdParser, data, size);
+ XML_ParserFree(externalDtdParser);
+ }
// finally frees this parser which served as parent
XML_ParserFree(parentParser);
diff --git a/fuzz/xml_parsebuffer_fuzzer.c b/fuzz/xml_parsebuffer_fuzzer.c
index 0db67dce..38b9981b 100644
--- a/fuzz/xml_parsebuffer_fuzzer.c
+++ b/fuzz/xml_parsebuffer_fuzzer.c
@@ -101,15 +101,17 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
XML_Parser externalEntityParser
= XML_ExternalEntityParserCreate(parentParser, "e1", NULL);
- assert(externalEntityParser);
- ParseOneInput(externalEntityParser, data, size);
- XML_ParserFree(externalEntityParser);
+ if (externalEntityParser != NULL) {
+ ParseOneInput(externalEntityParser, data, size);
+ XML_ParserFree(externalEntityParser);
+ }
XML_Parser externalDtdParser
= XML_ExternalEntityParserCreate(parentParser, NULL, NULL);
- assert(externalDtdParser);
- ParseOneInput(externalDtdParser, data, size);
- XML_ParserFree(externalDtdParser);
+ if (externalDtdParser != NULL) {
+ ParseOneInput(externalDtdParser, data, size);
+ XML_ParserFree(externalDtdParser);
+ }
// finally frees this parser which served as parent
XML_ParserFree(parentParser);

View File

@@ -0,0 +1,146 @@
From d6246c31a1238d065b4d9690d3bac740326f6485 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Wed, 3 Sep 2025 01:28:03 +0200
Subject: [PATCH] docs: Document the two allocation tracking API functions
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/d6246c31a1238d065b4d9690d3bac740326f6485]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
doc/reference.html | 116 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 116 insertions(+)
diff --git a/doc/reference.html b/doc/reference.html
index 89476710..81da4e6c 100644
--- a/doc/reference.html
+++ b/doc/reference.html
@@ -157,6 +157,8 @@ interface.</p>
<ul>
<li><a href="#XML_SetBillionLaughsAttackProtectionMaximumAmplification">XML_SetBillionLaughsAttackProtectionMaximumAmplification</a></li>
<li><a href="#XML_SetBillionLaughsAttackProtectionActivationThreshold">XML_SetBillionLaughsAttackProtectionActivationThreshold</a></li>
+ <li><a href="#XML_SetAllocTrackerMaximumAmplification">XML_SetAllocTrackerMaximumAmplification</a></li>
+ <li><a href="#XML_SetAllocTrackerActivationThreshold">XML_SetAllocTrackerActivationThreshold</a></li>
<li><a href="#XML_SetReparseDeferralEnabled">XML_SetReparseDeferralEnabled</a></li>
</ul>
</li>
@@ -2262,6 +2264,120 @@ XML_SetBillionLaughsAttackProtectionActivationThreshold(XML_Parser p,
</p>
</div>
+<h4 id="XML_SetAllocTrackerMaximumAmplification">XML_SetAllocTrackerMaximumAmplification</h4>
+<pre class="fcndec">
+/* Added in Expat 2.7.2. */
+XML_Bool
+XML_SetAllocTrackerMaximumAmplification(XML_Parser p,
+ float maximumAmplificationFactor);
+</pre>
+<div class="fcndef">
+ <p>
+ Sets the maximum tolerated amplification factor
+ between direct input and bytes of dynamic memory allocated
+ (default: <code>100.0</code>)
+ of parser <code>p</code> to <code>maximumAmplificationFactor</code>, and
+ returns <code>XML_TRUE</code> upon success and <code>XML_FALSE</code> upon error.
+ </p>
+
+ <p>
+ <strong>Note:</strong>
+ There are three types of allocations that intentionally bypass tracking and limiting:
+ </p>
+ <ul>
+ <li>
+ application calls to functions
+ <code><a href="#XML_MemMalloc">XML_MemMalloc</a></code>
+ and
+ <code><a href="#XML_MemRealloc">XML_MemRealloc</a></code>
+ &mdash;
+ <em>healthy</em> use of these two functions continues to be a responsibility
+ of the application using Expat
+ &mdash;,
+ </li>
+ <li>
+ the main character buffer used by functions
+ <code><a href="#XML_GetBuffer">XML_GetBuffer</a></code>
+ and
+ <code><a href="#XML_ParseBuffer">XML_ParseBuffer</a></code>
+ (and thus also by plain
+ <code><a href="#XML_Parse">XML_Parse</a></code>), and
+ </li>
+ <li>
+ the <a href="#XML_SetElementDeclHandler">content model memory</a>
+ (that is passed to the
+ <a href="#XML_SetElementDeclHandler">element declaration handler</a>
+ and freed by a call to
+ <code><a href="#XML_FreeContentModel">XML_FreeContentModel</a></code>).
+ </li>
+ </ul>
+
+ <p>The amplification factor is calculated as ..</p>
+ <pre>amplification := allocated / direct</pre>
+ <p>
+ .. while parsing, whereas
+ <code>direct</code> is the number of bytes read from the primary document in parsing and
+ <code>allocated</code> is the number of bytes of dynamic memory allocated in the parser hierarchy.
+ </p>
+
+ <p>For a call to <code>XML_SetAllocTrackerMaximumAmplification</code> to succeed:</p>
+ <ul>
+ <li>parser <code>p</code> must be a non-<code>NULL</code> root parser (without any parent parsers) and</li>
+ <li><code>maximumAmplificationFactor</code> must be non-<code>NaN</code> and greater than or equal to <code>1.0</code>.</li>
+ </ul>
+
+ <p>
+ <strong>Note:</strong>
+ If you ever need to increase this value for non-attack payload,
+ please <a href="https://github.com/libexpat/libexpat/issues">file a bug report</a>.
+ </p>
+
+ <p>
+ <strong>Note:</strong>
+ Amplifications factors greater than 100 can been observed near the start of parsing
+ even with benign files in practice.
+
+ So if you do reduce the maximum allowed amplification,
+ please make sure that the activation threshold is still big enough
+ to not end up with undesired false positives (i.e. benign files being rejected).
+ </p>
+</div>
+
+<h4 id="XML_SetAllocTrackerActivationThreshold">XML_SetAllocTrackerActivationThreshold</h4>
+<pre class="fcndec">
+/* Added in Expat 2.7.2. */
+XML_Bool
+XML_SetAllocTrackerActivationThreshold(XML_Parser p,
+ unsigned long long activationThresholdBytes);
+</pre>
+<div class="fcndef">
+ <p>
+ Sets number of allocated bytes of dynamic memory
+ needed to activate protection against disproportionate use of RAM
+ (default: <code>64 MiB</code>)
+ of parser <code>p</code> to <code>activationThresholdBytes</code>, and
+ returns <code>XML_TRUE</code> upon success and <code>XML_FALSE</code> upon error.
+ </p>
+
+ <p>
+ <strong>Note:</strong>
+ For types of allocations that intentionally bypass tracking and limiting, please see
+ <code><a href="#XML_SetAllocTrackerMaximumAmplification">XML_SetAllocTrackerMaximumAmplification</a></code>
+ above.
+ </p>
+
+ <p>For a call to <code>XML_SetAllocTrackerActivationThreshold</code> to succeed:</p>
+ <ul>
+ <li>parser <code>p</code> must be a non-<code>NULL</code> root parser (without any parent parsers).</li>
+ </ul>
+
+ <p>
+ <strong>Note:</strong>
+ If you ever need to increase this value for non-attack payload,
+ please <a href="https://github.com/libexpat/libexpat/issues">file a bug report</a>.
+ </p>
+</div>
+
<h4 id="XML_SetReparseDeferralEnabled">XML_SetReparseDeferralEnabled</h4>
<pre class="fcndec">
/* Added in Expat 2.6.0. */

View File

@@ -0,0 +1,28 @@
From a6a2a49367f03f5d8a73c9027b45b59953ca27d8 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Wed, 10 Sep 2025 19:52:39 +0200
Subject: [PATCH] docs: Promote the contract to call XML_FreeContentModel
.. when registering a custom element declaration handler
(via a call to function XML_SetElementDeclHandler)
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/a6a2a49367f03f5d8a73c9027b45b59953ca27d8]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
doc/reference.html | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/doc/reference.html b/doc/reference.html
index 81da4e6c..564fc1b2 100644
--- a/doc/reference.html
+++ b/doc/reference.html
@@ -1902,7 +1902,7 @@ struct XML_cp {
<p>Sets a handler for element declarations in a DTD. The handler gets
called with the name of the element in the declaration and a pointer
to a structure that contains the element model. It's the user code's
-responsibility to free model when finished with it. See <code>
+responsibility to free model when finished with via a call to <code>
<a href="#XML_FreeContentModel">XML_FreeContentModel</a></code>.
There is no need to free the model from the handler, it can be kept
around and freed at a later stage.</p>

View File

@@ -0,0 +1,74 @@
From a21a3a8299e1ee0b0ae5ae2886a0746d088cf135 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Sun, 7 Sep 2025 16:00:35 +0200
Subject: [PATCH] Changes: Document allocation tracking
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/a21a3a8299e1ee0b0ae5ae2886a0746d088cf135]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
Changes | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/Changes b/Changes
index cb752151..ceb5c5dc 100644
--- a/Changes
+++ b/Changes
@@ -30,6 +30,36 @@
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Patches:
+ Security fixes:
+ #1018 #1034 CVE-2025-59375 -- Disallow use of disproportional amounts of
+ dynamic memory from within an Expat parser (e.g. previously
+ a ~250 KiB sized document was able to cause allocation of
+ ~800 MiB from the heap, i.e. an "amplification" of factor
+ ~3,300); once a threshold (that defaults to 64 MiB) is
+ reached, a maximum amplification factor (that defaults to
+ 100.0) is enforced, and violating documents are rejected
+ with an out-of-memory error.
+ There are two new API functions to fine-tune this new
+ behavior:
+ - XML_SetAllocTrackerActivationThreshold
+ - XML_SetAllocTrackerMaximumAmplification .
+ If you ever need to increase these defaults for non-attack
+ XML payload, please file a bug report with libexpat.
+ There is also a new environment variable
+ EXPAT_MALLOC_DEBUG=(0|1|2) to control the verbosity
+ of allocations debugging at runtime, disabled by default.
+ Known impact is (reliable and easy) denial of service:
+ CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
+ (Base Score: 7.5, Temporal Score: 7.2)
+ Please note that a layer of compression around XML can
+ significantly reduce the minimum attack payload size.
+ Distributors intending to backport (or cherry-pick) the
+ fix need to copy 99% of the related pull request, not just
+ the "lib: Implement tracking of dynamic memory allocations"
+ commit, to not end up with a state that literally does both
+ too much and too little at the same time. Appending ".diff"
+ to the pull request URL could be of help.
+
Bug fixes:
#980 #989 Restore event pointer behavior from Expat 2.6.4
(that the fix to CVE-2024-8176 changed in 2.7.0);
@@ -39,6 +69,10 @@ Patches:
- XML_GetCurrentColumnNumber
- XML_GetCurrentLineNumber
- XML_GetInputContext
+ #1034 docs: Promote the contract to call function
+ XML_FreeContentModel when registering a custom
+ element declaration handler (via a call to function
+ XML_SetElementDeclHandler)
Special thanks to:
Berkay Eren Ürün
@@ -71,6 +105,9 @@ Patches:
Linutronix
Red Hat
Siemens
+ and
+ OSS-Fuzz / ClusterFuzz
+ Perl XML::Parser
Release 2.6.4 Wed November 6 2024
Security fixes:

View File

@@ -0,0 +1,103 @@
From f4b5bb033dc4430bbd31dcae8a55f988360bcec5 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Wed, 17 Sep 2025 23:14:02 +0200
Subject: [PATCH] lib: Document and regression-proof absence of integer
overflow from expat_realloc
Matthew Fernandez (@Smattr) and I teamed up on whether function expat_realloc
could be vulnerable to integer overflow in line:
mallocedPtr = parser->m_mem.realloc_fcn(mallocedPtr, sizeof(size_t) + size);
^
We ended up with a mathematical proof that, fortunately, the current code
already is safe from overflow.
The proof uses technique "proof by contradiction". Let's assume, there *was* a
risk of integer overflow. For a risk of overflow, these four conditions would
all need to be met, together:
(1) `SIZE_MAX < sizeof(size_t) + size`
or we would not hit an overflow on `size_t`.
(2) `size > prevSize`
or `expat_malloc` would have already not allocated earlier
as `expat_realloc` relies on `expat_malloc` for the initial allocation.
(3) `rootParser->m_alloc_tracker.bytesAllocated >= sizeof(size_t) + prevSize`
or the previous allocation would be gone already or have bypassed accounting.
The code is not thread-safe in general, race conditions are off the table.
(4) `rootParser->m_alloc_tracker.bytesAllocated + (size - prevSize) <= SIZE_MAX`
or `expat_heap_increase_tolerable` would have returned `false` and
the overflow line would not be reached.
We encoded this for the Z3 Theorem Prover (https://github.com/Z3Prover/z3)
and ended up with this document:
$ cat proof_v2.smt2
; Copyright (c) 2025 Matthew Fernandez <matthew.fernandez@gmail.com>
; Copyright (c) 2025 Sebastian Pipping <sebastian@pipping.org>
; Licensed under the MIT license
; (1), (2), (3), (4) form a contradiction
; define `SIZE_MAX`
(declare-fun SIZE_MAX () (_ BitVec 64))
(assert (= SIZE_MAX #xffffffffffffffff))
; define `sizeof(size_t)`
(declare-fun sizeof_size_t () (_ BitVec 64))
(assert (= sizeof_size_t #x0000000000000008))
; claim we have inputs `size`, `prevSize`, and `bytesAllocated`
(declare-fun size () (_ BitVec 64))
(declare-fun prevSize () (_ BitVec 64))
(declare-fun bytesAllocated () (_ BitVec 64))
; assume `SIZE_MAX - sizeof(size_t) < size` (1)
(assert (bvult (bvsub SIZE_MAX sizeof_size_t) size))
; assume `bytesAllocated >= sizeof(size_t) + prevSize` (3)
(assert (bvuge bytesAllocated (bvadd sizeof_size_t prevSize)))
; assume `bytesAllocated - prevSize <= SIZE_MAX - size` (4)
(assert (bvule (bvsub bytesAllocated prevSize) (bvsub SIZE_MAX size)))
; assume `SIZE_MAX - sizeof(size_t) >= prevSize` (anti-overflow for 3)
(assert (bvuge (bvsub SIZE_MAX sizeof_size_t) prevSize))
; prove we have a contradiction
(check-sat)
Note that we operate on fixed-size bit vectors here, and hence had
to transform the assertions to not allow integer overflow by themselves.
Z3 confirms the contradiction, and thus the absence of integer overflow:
$ z3 -smt2 -model proof_v2.smt2
unsat
Co-authored-by: Matthew Fernandez <matthew.fernandez@gmail.com>
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/f4b5bb033dc4430bbd31dcae8a55f988360bcec5]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index de159493..24fd7b97 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -969,6 +969,10 @@ expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine) {
}
}
+ // NOTE: Integer overflow detection has already been done for us
+ // by expat_heap_increase_tolerable(..) above
+ assert(SIZE_MAX - sizeof(size_t) >= size);
+
// Actually allocate
mallocedPtr = parser->m_mem.realloc_fcn(mallocedPtr, sizeof(size_t) + size);

View File

@@ -0,0 +1,285 @@
From faf36f806c9065bfd9f0567b01924d5e27c4911c Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Mon, 15 Sep 2025 18:05:23 +0200
Subject: [PATCH] lib: Drop casts around malloc/realloc returns that C99 does
not need
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/faf36f806c9065bfd9f0567b01924d5e27c4911c]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/xmlparse.c | 80 ++++++++++++++++++++++----------------------------
1 file changed, 35 insertions(+), 45 deletions(-)
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index 6e9c6fb2..fb8ad2e7 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -1370,12 +1370,12 @@ parserCreate(const XML_Char *encodingName,
XML_Memory_Handling_Suite *mtemp;
#if XML_GE == 1
void *const sizeAndParser
- = (XML_Parser)malloc(sizeof(size_t) + sizeof(struct XML_ParserStruct));
+ = malloc(sizeof(size_t) + sizeof(struct XML_ParserStruct));
if (sizeAndParser != NULL) {
*(size_t *)sizeAndParser = sizeof(struct XML_ParserStruct);
parser = (XML_Parser)((char *)sizeAndParser + sizeof(size_t));
#else
- parser = (XML_Parser)malloc(sizeof(struct XML_ParserStruct));
+ parser = malloc(sizeof(struct XML_ParserStruct));
if (parser != NULL) {
#endif
mtemp = (XML_Memory_Handling_Suite *)&(parser->m_mem);
@@ -1433,23 +1433,20 @@ parserCreate(const XML_Char *encodingName,
parser->m_bufferLim = NULL;
parser->m_attsSize = INIT_ATTS_SIZE;
- parser->m_atts
- = (ATTRIBUTE *)MALLOC(parser, parser->m_attsSize * sizeof(ATTRIBUTE));
+ parser->m_atts = MALLOC(parser, parser->m_attsSize * sizeof(ATTRIBUTE));
if (parser->m_atts == NULL) {
FREE(parser, parser);
return NULL;
}
#ifdef XML_ATTR_INFO
- parser->m_attInfo = (XML_AttrInfo *)MALLOC(
- parser, parser->m_attsSize * sizeof(XML_AttrInfo));
+ parser->m_attInfo = MALLOC(parser, parser->m_attsSize * sizeof(XML_AttrInfo));
if (parser->m_attInfo == NULL) {
FREE(parser, parser->m_atts);
FREE(parser, parser);
return NULL;
}
#endif
- parser->m_dataBuf
- = (XML_Char *)MALLOC(parser, INIT_DATA_BUF_SIZE * sizeof(XML_Char));
+ parser->m_dataBuf = MALLOC(parser, INIT_DATA_BUF_SIZE * sizeof(XML_Char));
if (parser->m_dataBuf == NULL) {
FREE(parser, parser->m_atts);
#ifdef XML_ATTR_INFO
@@ -2588,7 +2585,7 @@ XML_GetBuffer(XML_Parser parser, int len) {
}
// NOTE: We are avoiding MALLOC(..) here to leave limiting
// the input size to the application using Expat.
- newBuf = (char *)parser->m_mem.malloc_fcn(bufferSize);
+ newBuf = parser->m_mem.malloc_fcn(bufferSize);
if (newBuf == 0) {
parser->m_errorCode = XML_ERROR_NO_MEMORY;
return NULL;
@@ -3133,7 +3130,7 @@ storeRawNames(XML_Parser parser) {
return XML_FALSE;
bufSize = nameLen + (int)rawNameLen;
if (bufSize > tag->bufEnd - tag->buf) {
- char *temp = (char *)REALLOC(parser, tag->buf, bufSize);
+ char *temp = REALLOC(parser, tag->buf, bufSize);
if (temp == NULL)
return XML_FALSE;
/* if tag->name.str points to tag->buf (only when namespace
@@ -3459,10 +3456,10 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
tag = parser->m_freeTagList;
parser->m_freeTagList = parser->m_freeTagList->parent;
} else {
- tag = (TAG *)MALLOC(parser, sizeof(TAG));
+ tag = MALLOC(parser, sizeof(TAG));
if (! tag)
return XML_ERROR_NO_MEMORY;
- tag->buf = (char *)MALLOC(parser, INIT_TAG_BUF_SIZE);
+ tag->buf = MALLOC(parser, INIT_TAG_BUF_SIZE);
if (! tag->buf) {
FREE(parser, tag);
return XML_ERROR_NO_MEMORY;
@@ -3495,7 +3492,7 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
}
bufSize = (int)(tag->bufEnd - tag->buf) << 1;
{
- char *temp = (char *)REALLOC(parser, tag->buf, bufSize);
+ char *temp = REALLOC(parser, tag->buf, bufSize);
if (temp == NULL)
return XML_ERROR_NO_MEMORY;
tag->buf = temp;
@@ -3874,8 +3871,8 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
}
#endif
- temp = (ATTRIBUTE *)REALLOC(parser, (void *)parser->m_atts,
- parser->m_attsSize * sizeof(ATTRIBUTE));
+ temp = REALLOC(parser, (void *)parser->m_atts,
+ parser->m_attsSize * sizeof(ATTRIBUTE));
if (temp == NULL) {
parser->m_attsSize = oldAttsSize;
return XML_ERROR_NO_MEMORY;
@@ -3893,8 +3890,8 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
}
# endif
- temp2 = (XML_AttrInfo *)REALLOC(parser, (void *)parser->m_attInfo,
- parser->m_attsSize * sizeof(XML_AttrInfo));
+ temp2 = REALLOC(parser, (void *)parser->m_attInfo,
+ parser->m_attsSize * sizeof(XML_AttrInfo));
if (temp2 == NULL) {
parser->m_attsSize = oldAttsSize;
return XML_ERROR_NO_MEMORY;
@@ -4070,8 +4067,7 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
}
#endif
- temp = (NS_ATT *)REALLOC(parser, parser->m_nsAtts,
- nsAttsSize * sizeof(NS_ATT));
+ temp = REALLOC(parser, parser->m_nsAtts, nsAttsSize * sizeof(NS_ATT));
if (! temp) {
/* Restore actual size of memory in m_nsAtts */
parser->m_nsAttsPower = oldNsAttsPower;
@@ -4252,7 +4248,7 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
}
#endif
- uri = (XML_Char *)MALLOC(parser, (n + EXPAND_SPARE) * sizeof(XML_Char));
+ uri = MALLOC(parser, (n + EXPAND_SPARE) * sizeof(XML_Char));
if (! uri)
return XML_ERROR_NO_MEMORY;
binding->uriAlloc = n + EXPAND_SPARE;
@@ -4498,8 +4494,8 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
}
#endif
- XML_Char *temp = (XML_Char *)REALLOC(
- parser, b->uri, sizeof(XML_Char) * (len + EXPAND_SPARE));
+ XML_Char *temp
+ = REALLOC(parser, b->uri, sizeof(XML_Char) * (len + EXPAND_SPARE));
if (temp == NULL)
return XML_ERROR_NO_MEMORY;
b->uri = temp;
@@ -4507,7 +4503,7 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
}
parser->m_freeBindingList = b->nextTagBinding;
} else {
- b = (BINDING *)MALLOC(parser, sizeof(BINDING));
+ b = MALLOC(parser, sizeof(BINDING));
if (! b)
return XML_ERROR_NO_MEMORY;
@@ -4525,8 +4521,7 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
}
#endif
- b->uri
- = (XML_Char *)MALLOC(parser, sizeof(XML_Char) * (len + EXPAND_SPARE));
+ b->uri = MALLOC(parser, sizeof(XML_Char) * (len + EXPAND_SPARE));
if (! b->uri) {
FREE(parser, b);
return XML_ERROR_NO_MEMORY;
@@ -5897,7 +5892,7 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
return XML_ERROR_NO_MEMORY;
}
- char *const new_connector = (char *)REALLOC(
+ char *const new_connector = REALLOC(
parser, parser->m_groupConnector, parser->m_groupSize *= 2);
if (new_connector == NULL) {
parser->m_groupSize /= 2;
@@ -5917,15 +5912,14 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
}
#endif
- int *const new_scaff_index = (int *)REALLOC(
+ int *const new_scaff_index = REALLOC(
parser, dtd->scaffIndex, parser->m_groupSize * sizeof(int));
if (new_scaff_index == NULL)
return XML_ERROR_NO_MEMORY;
dtd->scaffIndex = new_scaff_index;
}
} else {
- parser->m_groupConnector
- = (char *)MALLOC(parser, parser->m_groupSize = 32);
+ parser->m_groupConnector = MALLOC(parser, parser->m_groupSize = 32);
if (! parser->m_groupConnector) {
parser->m_groupSize = 0;
return XML_ERROR_NO_MEMORY;
@@ -6086,8 +6080,7 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
// applications that are not using XML_FreeContentModel but
// plain free(..) or .free_fcn() to free the content model's
// memory are safe.
- XML_Content *content
- = (XML_Content *)parser->m_mem.malloc_fcn(sizeof(XML_Content));
+ XML_Content *content = parser->m_mem.malloc_fcn(sizeof(XML_Content));
if (! content)
return XML_ERROR_NO_MEMORY;
content->quant = XML_CQUANT_NONE;
@@ -6364,8 +6357,7 @@ processEntity(XML_Parser parser, ENTITY *entity, XML_Bool betweenDecl,
openEntity = *freeEntityList;
*freeEntityList = openEntity->next;
} else {
- openEntity
- = (OPEN_INTERNAL_ENTITY *)MALLOC(parser, sizeof(OPEN_INTERNAL_ENTITY));
+ openEntity = MALLOC(parser, sizeof(OPEN_INTERNAL_ENTITY));
if (! openEntity)
return XML_ERROR_NO_MEMORY;
}
@@ -7164,8 +7156,8 @@ defineAttribute(ELEMENT_TYPE *type, ATTRIBUTE_ID *attId, XML_Bool isCdata,
if (type->nDefaultAtts == type->allocDefaultAtts) {
if (type->allocDefaultAtts == 0) {
type->allocDefaultAtts = 8;
- type->defaultAtts = (DEFAULT_ATTRIBUTE *)MALLOC(
- parser, type->allocDefaultAtts * sizeof(DEFAULT_ATTRIBUTE));
+ type->defaultAtts
+ = MALLOC(parser, type->allocDefaultAtts * sizeof(DEFAULT_ATTRIBUTE));
if (! type->defaultAtts) {
type->allocDefaultAtts = 0;
return 0;
@@ -7190,8 +7182,8 @@ defineAttribute(ELEMENT_TYPE *type, ATTRIBUTE_ID *attId, XML_Bool isCdata,
}
#endif
- temp = (DEFAULT_ATTRIBUTE *)REALLOC(parser, type->defaultAtts,
- (count * sizeof(DEFAULT_ATTRIBUTE)));
+ temp = REALLOC(parser, type->defaultAtts,
+ (count * sizeof(DEFAULT_ATTRIBUTE)));
if (temp == NULL)
return 0;
type->allocDefaultAtts = count;
@@ -8145,8 +8137,7 @@ poolGrow(STRING_POOL *pool) {
if (bytesToAllocate == 0)
return XML_FALSE;
- temp = (BLOCK *)REALLOC(pool->parser, pool->blocks,
- (unsigned)bytesToAllocate);
+ temp = REALLOC(pool->parser, pool->blocks, (unsigned)bytesToAllocate);
if (temp == NULL)
return XML_FALSE;
pool->blocks = temp;
@@ -8217,7 +8208,7 @@ nextScaffoldPart(XML_Parser parser) {
return -1;
}
#endif
- dtd->scaffIndex = (int *)MALLOC(parser, parser->m_groupSize * sizeof(int));
+ dtd->scaffIndex = MALLOC(parser, parser->m_groupSize * sizeof(int));
if (! dtd->scaffIndex)
return -1;
dtd->scaffIndex[0] = 0;
@@ -8240,14 +8231,13 @@ nextScaffoldPart(XML_Parser parser) {
}
#endif
- temp = (CONTENT_SCAFFOLD *)REALLOC(
- parser, dtd->scaffold, dtd->scaffSize * 2 * sizeof(CONTENT_SCAFFOLD));
+ temp = REALLOC(parser, dtd->scaffold,
+ dtd->scaffSize * 2 * sizeof(CONTENT_SCAFFOLD));
if (temp == NULL)
return -1;
dtd->scaffSize *= 2;
} else {
- temp = (CONTENT_SCAFFOLD *)MALLOC(parser, INIT_SCAFFOLD_ELEMENTS
- * sizeof(CONTENT_SCAFFOLD));
+ temp = MALLOC(parser, INIT_SCAFFOLD_ELEMENTS * sizeof(CONTENT_SCAFFOLD));
if (temp == NULL)
return -1;
dtd->scaffSize = INIT_SCAFFOLD_ELEMENTS;
@@ -8304,7 +8294,7 @@ build_model(XML_Parser parser) {
// NOTE: We are avoiding MALLOC(..) here to so that
// applications that are not using XML_FreeContentModel but plain
// free(..) or .free_fcn() to free the content model's memory are safe.
- ret = (XML_Content *)parser->m_mem.malloc_fcn(allocsize);
+ ret = parser->m_mem.malloc_fcn(allocsize);
if (! ret)
return NULL;

View File

@@ -0,0 +1,196 @@
From 4b43b8dacc96fd538254e17a69abc9745c3a2ed4 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Fri, 19 Sep 2025 23:32:46 +0200
Subject: [PATCH] lib: Fix alignment of internal allocations for some non-amd64
architectures
sparc32 is known to be affected.
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/4b43b8dacc96fd538254e17a69abc9745c3a2ed4]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
lib/internal.h | 6 ++++++
lib/xmlparse.c | 38 ++++++++++++++++++++++----------------
tests/alloc_tests.c | 13 ++++++++++---
3 files changed, 38 insertions(+), 19 deletions(-)
diff --git a/lib/internal.h b/lib/internal.h
index 6e087858..8f5edf48 100644
--- a/lib/internal.h
+++ b/lib/internal.h
@@ -108,6 +108,7 @@
#endif
#include <limits.h> // ULONG_MAX
+#include <stddef.h> // size_t
#if defined(_WIN32) \
&& (! defined(__USE_MINGW_ANSI_STDIO) \
@@ -150,6 +151,11 @@
#define EXPAT_ALLOC_TRACKER_ACTIVATION_THRESHOLD_DEFAULT \
67108864 // 64 MiB, 2^26
+// NOTE: If function expat_alloc was user facing, EXPAT_MALLOC_ALIGNMENT would
+// have to take sizeof(long double) into account
+#define EXPAT_MALLOC_ALIGNMENT sizeof(long long) // largest parser (sub)member
+#define EXPAT_MALLOC_PADDING ((EXPAT_MALLOC_ALIGNMENT) - sizeof(size_t))
+
/* NOTE END */
#include "expat.h" // so we can use type XML_Parser below
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index 24fd7b97..ce29ab6f 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -850,14 +850,14 @@ static void *
# endif
expat_malloc(XML_Parser parser, size_t size, int sourceLine) {
// Detect integer overflow
- if (SIZE_MAX - size < sizeof(size_t)) {
+ if (SIZE_MAX - size < sizeof(size_t) + EXPAT_MALLOC_PADDING) {
return NULL;
}
const XML_Parser rootParser = getRootParserOf(parser, NULL);
assert(rootParser->m_parentParser == NULL);
- const size_t bytesToAllocate = sizeof(size_t) + size;
+ const size_t bytesToAllocate = sizeof(size_t) + EXPAT_MALLOC_PADDING + size;
if ((XmlBigCount)-1 - rootParser->m_alloc_tracker.bytesAllocated
< bytesToAllocate) {
@@ -894,7 +894,7 @@ expat_malloc(XML_Parser parser, size_t size, int sourceLine) {
rootParser->m_alloc_tracker.peakBytesAllocated, sourceLine);
}
- return (char *)mallocedPtr + sizeof(size_t);
+ return (char *)mallocedPtr + sizeof(size_t) + EXPAT_MALLOC_PADDING;
}
# if defined(XML_TESTING)
@@ -914,8 +914,9 @@ expat_free(XML_Parser parser, void *ptr, int sourceLine) {
// Extract size (to the eyes of malloc_fcn/realloc_fcn) and
// the original pointer returned by malloc/realloc
- void *const mallocedPtr = (char *)ptr - sizeof(size_t);
- const size_t bytesAllocated = sizeof(size_t) + *(size_t *)mallocedPtr;
+ void *const mallocedPtr = (char *)ptr - EXPAT_MALLOC_PADDING - sizeof(size_t);
+ const size_t bytesAllocated
+ = sizeof(size_t) + EXPAT_MALLOC_PADDING + *(size_t *)mallocedPtr;
// Update accounting
assert(rootParser->m_alloc_tracker.bytesAllocated >= bytesAllocated);
@@ -954,7 +955,7 @@ expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine) {
// Extract original size (to the eyes of the caller) and the original
// pointer returned by malloc/realloc
- void *mallocedPtr = (char *)ptr - sizeof(size_t);
+ void *mallocedPtr = (char *)ptr - EXPAT_MALLOC_PADDING - sizeof(size_t);
const size_t prevSize = *(size_t *)mallocedPtr;
// Classify upcoming change
@@ -971,10 +972,11 @@ expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine) {
// NOTE: Integer overflow detection has already been done for us
// by expat_heap_increase_tolerable(..) above
- assert(SIZE_MAX - sizeof(size_t) >= size);
+ assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size);
// Actually allocate
- mallocedPtr = parser->m_mem.realloc_fcn(mallocedPtr, sizeof(size_t) + size);
+ mallocedPtr = parser->m_mem.realloc_fcn(
+ mallocedPtr, sizeof(size_t) + EXPAT_MALLOC_PADDING + size);
if (mallocedPtr == NULL) {
return NULL;
@@ -1005,7 +1007,7 @@ expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine) {
// Update in-block recorded size
*(size_t *)mallocedPtr = size;
- return (char *)mallocedPtr + sizeof(size_t);
+ return (char *)mallocedPtr + sizeof(size_t) + EXPAT_MALLOC_PADDING;
}
#endif // XML_GE == 1
@@ -1337,7 +1339,8 @@ parserCreate(const XML_Char *encodingName,
XML_Parser parser = NULL;
#if XML_GE == 1
- const size_t increase = sizeof(size_t) + sizeof(struct XML_ParserStruct);
+ const size_t increase
+ = sizeof(size_t) + EXPAT_MALLOC_PADDING + sizeof(struct XML_ParserStruct);
if (parentParser != NULL) {
const XML_Parser rootParser = getRootParserOf(parentParser, NULL);
@@ -1352,11 +1355,13 @@ parserCreate(const XML_Char *encodingName,
if (memsuite) {
XML_Memory_Handling_Suite *mtemp;
#if XML_GE == 1
- void *const sizeAndParser = memsuite->malloc_fcn(
- sizeof(size_t) + sizeof(struct XML_ParserStruct));
+ void *const sizeAndParser
+ = memsuite->malloc_fcn(sizeof(size_t) + EXPAT_MALLOC_PADDING
+ + sizeof(struct XML_ParserStruct));
if (sizeAndParser != NULL) {
*(size_t *)sizeAndParser = sizeof(struct XML_ParserStruct);
- parser = (XML_Parser)((char *)sizeAndParser + sizeof(size_t));
+ parser = (XML_Parser)((char *)sizeAndParser + sizeof(size_t)
+ + EXPAT_MALLOC_PADDING);
#else
parser = memsuite->malloc_fcn(sizeof(struct XML_ParserStruct));
if (parser != NULL) {
@@ -1369,11 +1374,12 @@ parserCreate(const XML_Char *encodingName,
} else {
XML_Memory_Handling_Suite *mtemp;
#if XML_GE == 1
- void *const sizeAndParser
- = malloc(sizeof(size_t) + sizeof(struct XML_ParserStruct));
+ void *const sizeAndParser = malloc(sizeof(size_t) + EXPAT_MALLOC_PADDING
+ + sizeof(struct XML_ParserStruct));
if (sizeAndParser != NULL) {
*(size_t *)sizeAndParser = sizeof(struct XML_ParserStruct);
- parser = (XML_Parser)((char *)sizeAndParser + sizeof(size_t));
+ parser = (XML_Parser)((char *)sizeAndParser + sizeof(size_t)
+ + EXPAT_MALLOC_PADDING);
#else
parser = malloc(sizeof(struct XML_ParserStruct));
if (parser != NULL) {
diff --git a/tests/alloc_tests.c b/tests/alloc_tests.c
index 644a4952..dabdf0da 100644
--- a/tests/alloc_tests.c
+++ b/tests/alloc_tests.c
@@ -2091,6 +2091,13 @@ START_TEST(test_alloc_reset_after_external_entity_parser_create_fail) {
}
END_TEST
+#if XML_GE == 1
+static size_t
+sizeRecordedFor(void *ptr) {
+ return *(size_t *)((char *)ptr - EXPAT_MALLOC_PADDING - sizeof(size_t));
+}
+#endif // XML_GE == 1
+
START_TEST(test_alloc_tracker_size_recorded) {
XML_Memory_Handling_Suite memsuite = {malloc, realloc, free};
@@ -2106,16 +2113,16 @@ START_TEST(test_alloc_tracker_size_recorded) {
void *ptr = expat_malloc(parser, 10, -1);
assert_true(ptr != NULL);
- assert_true(*((size_t *)ptr - 1) == 10);
+ assert_true(sizeRecordedFor(ptr) == 10);
assert_true(expat_realloc(parser, ptr, SIZE_MAX / 2, -1) == NULL);
- assert_true(*((size_t *)ptr - 1) == 10); // i.e. unchanged
+ assert_true(sizeRecordedFor(ptr) == 10); // i.e. unchanged
ptr = expat_realloc(parser, ptr, 20, -1);
assert_true(ptr != NULL);
- assert_true(*((size_t *)ptr - 1) == 20);
+ assert_true(sizeRecordedFor(ptr) == 20);
expat_free(parser, ptr, -1);
#endif

View File

@@ -0,0 +1,37 @@
From 5cc0010ad93868ec03248e4ac814272bc7d607bc Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Fri, 19 Sep 2025 22:50:54 +0200
Subject: [PATCH] tests: Fix test guard for test related to allocation tracking
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/5cc0010ad93868ec03248e4ac814272bc7d607bc]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
tests/alloc_tests.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/tests/alloc_tests.c b/tests/alloc_tests.c
index dabdf0da..045447b0 100644
--- a/tests/alloc_tests.c
+++ b/tests/alloc_tests.c
@@ -2362,14 +2362,12 @@ make_alloc_test_case(Suite *s) {
tcase_add_test__ifdef_xml_dtd(
tc_alloc, test_alloc_reset_after_external_entity_parser_create_fail);
- tcase_add_test__ifdef_xml_dtd(tc_alloc, test_alloc_tracker_size_recorded);
- tcase_add_test__ifdef_xml_dtd(tc_alloc,
- test_alloc_tracker_maximum_amplification);
- tcase_add_test__ifdef_xml_dtd(tc_alloc, test_alloc_tracker_threshold);
- tcase_add_test__ifdef_xml_dtd(tc_alloc,
- test_alloc_tracker_getbuffer_unlimited);
- tcase_add_test__ifdef_xml_dtd(tc_alloc, test_alloc_tracker_api);
+ tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_size_recorded);
+ tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_maximum_amplification);
+ tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_threshold);
+ tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_getbuffer_unlimited);
+ tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_api);
tcase_add_test(tc_alloc, test_mem_api_cycle);
- tcase_add_test__ifdef_xml_dtd(tc_alloc, test_mem_api_unlimited);
+ tcase_add_test__if_xml_ge(tc_alloc, test_mem_api_unlimited);
}

View File

@@ -0,0 +1,47 @@
From 343594dc344e543acb7478d1283b50b299a1c110 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Fri, 19 Sep 2025 22:46:01 +0200
Subject: [PATCH] tests: Add new test test_alloc_tracker_pointer_alignment
CVE: CVE-2025-59375
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/343594dc344e543acb7478d1283b50b299a1c110]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
tests/alloc_tests.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/tests/alloc_tests.c b/tests/alloc_tests.c
index 045447b0..5ae6c6a7 100644
--- a/tests/alloc_tests.c
+++ b/tests/alloc_tests.c
@@ -2132,6 +2132,22 @@ START_TEST(test_alloc_tracker_size_recorded) {
}
END_TEST
+START_TEST(test_alloc_tracker_pointer_alignment) {
+ XML_Parser parser = XML_ParserCreate(NULL);
+#if XML_GE == 1
+ assert_true(sizeof(long long) >= sizeof(size_t)); // self-test
+ long long *const ptr
+ = (long long *)expat_malloc(parser, 4 * sizeof(long long), -1);
+ ptr[0] = 0LL;
+ ptr[1] = 1LL;
+ ptr[2] = 2LL;
+ ptr[3] = 3LL;
+ expat_free(parser, ptr, -1);
+#endif
+ XML_ParserFree(parser);
+}
+END_TEST
+
START_TEST(test_alloc_tracker_maximum_amplification) {
if (g_reparseDeferralEnabledDefault == XML_TRUE) {
return;
@@ -2363,6 +2379,7 @@ make_alloc_test_case(Suite *s) {
tc_alloc, test_alloc_reset_after_external_entity_parser_create_fail);
tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_size_recorded);
+ tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_pointer_alignment);
tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_maximum_amplification);
tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_threshold);
tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_getbuffer_unlimited);

Some files were not shown because too many files have changed in this diff Show More