8 files changed, 205 insertions, 1 deletions

diff --git a/meta-oe/recipes-support/libftdi/files/0001-CMake-bump-the-minimal-required-version-to-2.8.12.patch b/meta-oe/recipes-support/libftdi/files/0001-CMake-bump-the-minimal-required-version-to-2.8.12.patch
new file mode 100644
index 0000000000..544ea00c35
--- /dev/null
+++ b/meta-oe/recipes-support/libftdi/files/0001-CMake-bump-the-minimal-required-version-to-2.8.12.patch
@@ -0,0 +1,86 @@
+From 9b1419d46b156c3c61d30e761ee3636431187cc0 Mon Sep 17 00:00:00 2001
+From: Yegor Yefremov <yegorslists@googlemail.com>
+Date: Tue, 1 Aug 2023 11:53:35 +0200
+Subject: [PATCH] CMake: bump the minimal required version to 2.8.12
+
+The older CMake versions are deprecated.
+
+Remove support for CMake code compatible with CMake older than 2.8.8.
+
+Also move cmake_minimum_required() command before the project()
+command invocation.
+
+Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de>
+Upstream-Status: Backport [3861e7dc9e83f2f6ff4e1579cf3bbf63a6827105]
+---
+ CMakeLists.txt | 46 +++++++++++++++++++++-------------------------
+ 1 file changed, 21 insertions(+), 25 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 3b0b87c..41ddf58 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,3 +1,5 @@
++cmake_minimum_required(VERSION 2.8.12 FATAL_ERROR)
++
+ # Project
+ project(libftdi1 C)
+ set(MAJOR_VERSION 1)
+@@ -12,7 +14,6 @@ if("${CMAKE_BUILD_TYPE}" STREQUAL "")
+    set(CMAKE_BUILD_TYPE     RelWithDebInfo)
+ endif("${CMAKE_BUILD_TYPE}" STREQUAL "")
+ set(CMAKE_COLOR_MAKEFILE ON)
+-cmake_minimum_required(VERSION 2.6 FATAL_ERROR)
+ 
+ add_definitions(-Wall)
+ 
+@@ -202,30 +203,25 @@ set ( LIBFTDI_VERSION_MINOR ${MINOR_VERSION} )
+ 
+ set ( LIBFTDI_USE_FILE ${CMAKE_INSTALL_PREFIX}/${LIBFTDI_CMAKE_CONFIG_DIR}/UseLibFTDI1.cmake )
+ 
+-if(CMAKE_VERSION VERSION_LESS 2.8.8) 
+-  configure_file ( cmake/LibFTDI1Config.cmake.in ${CMAKE_CURRENT_BINARY_DIR}/LibFTDI1Config.cmake @ONLY )
+-  configure_file ( cmake/LibFTDI1ConfigVersion.cmake.in ${CMAKE_CURRENT_BINARY_DIR}/LibFTDI1ConfigVersion.cmake @ONLY )
+-else ()
+-  include(CMakePackageConfigHelpers)
+-
+-  configure_package_config_file (
+-    cmake/LibFTDI1Config.cmake.in
+-    ${CMAKE_CURRENT_BINARY_DIR}/LibFTDI1Config.cmake
+-    INSTALL_DESTINATION ${LIBFTDI_CMAKE_CONFIG_DIR}
+-    PATH_VARS
+-      LIBFTDI_USE_FILE
+-      LIBFTDI_ROOT_DIR
+-      LIBFTDI_INCLUDE_DIR
+-      LIBFTDI_INCLUDE_DIRS
+-      LIBFTDI_LIBRARY_DIRS
+-    NO_CHECK_REQUIRED_COMPONENTS_MACRO
+-  )
+-  write_basic_package_version_file (
+-    LibFTDI1ConfigVersion.cmake 
+-    VERSION ${LIBFTDI_VERSION_STRING} 
+-    COMPATIBILITY AnyNewerVersion
+-  )
+-endif ()
++include(CMakePackageConfigHelpers)
++
++configure_package_config_file (
++  cmake/LibFTDI1Config.cmake.in
++  ${CMAKE_CURRENT_BINARY_DIR}/LibFTDI1Config.cmake
++  INSTALL_DESTINATION ${LIBFTDI_CMAKE_CONFIG_DIR}
++  PATH_VARS
++    LIBFTDI_USE_FILE
++    LIBFTDI_ROOT_DIR
++    LIBFTDI_INCLUDE_DIR
++    LIBFTDI_INCLUDE_DIRS
++    LIBFTDI_LIBRARY_DIRS
++  NO_CHECK_REQUIRED_COMPONENTS_MACRO
++)
++write_basic_package_version_file (
++  LibFTDI1ConfigVersion.cmake
++  VERSION ${LIBFTDI_VERSION_STRING}
++  COMPATIBILITY AnyNewerVersion
++)
+ 
+ 
+ install ( FILES 
diff --git a/meta-oe/recipes-support/libftdi/files/0002-CMake-require-2.8.12-for-cmake_example.patch b/meta-oe/recipes-support/libftdi/files/0002-CMake-require-2.8.12-for-cmake_example.patch
new file mode 100644
index 0000000000..a31a67df88
--- /dev/null
+++ b/meta-oe/recipes-support/libftdi/files/0002-CMake-require-2.8.12-for-cmake_example.patch
@@ -0,0 +1,24 @@
+From 579c08ec00d7cfd72071a86c67fb3b3c5fec5a9e Mon Sep 17 00:00:00 2001
+From: Yegor Yefremov <yegorslists@googlemail.com>
+Date: Thu, 31 Aug 2023 09:23:29 +0200
+Subject: [PATCH] CMake: require 2.8.12 for cmake_example
+
+Make CMake minimal version requirement consistent for the entire
+project.
+
+Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de>
+Upstream-Status: Backport [61a6bac98bbac623fb33b6153a063b6436f84721]
+---
+ examples/cmake_example/CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/examples/cmake_example/CMakeLists.txt b/examples/cmake_example/CMakeLists.txt
+index fe203ed..264752d 100644
+--- a/examples/cmake_example/CMakeLists.txt
++++ b/examples/cmake_example/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required ( VERSION 2.8 )
++cmake_minimum_required(VERSION 2.8.12 FATAL_ERROR)
+ 
+ project ( example C )
+ 
diff --git a/meta-oe/recipes-support/libftdi/files/0003-CMake-bump-the-minimal-required-version-to-3.5.patch b/meta-oe/recipes-support/libftdi/files/0003-CMake-bump-the-minimal-required-version-to-3.5.patch
new file mode 100644
index 0000000000..b541cb69f4
--- /dev/null
+++ b/meta-oe/recipes-support/libftdi/files/0003-CMake-bump-the-minimal-required-version-to-3.5.patch
@@ -0,0 +1,34 @@
+From e6d18a015907b22345bf8994110f68f0609949a9 Mon Sep 17 00:00:00 2001
+From: Yegor Yefremov <yegorslists@googlemail.com>
+Date: Tue, 12 Dec 2023 14:20:36 +0100
+Subject: [PATCH] CMake: bump the minimal required version to 3.5
+
+Older CMake versions are treated as deprecated.
+
+Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de>
+Upstream-Status: Backport [de9f01ece34d2fe6e842e0250a38f4b16eda2429]
+---
+ CMakeLists.txt                        | 2 +-
+ examples/cmake_example/CMakeLists.txt | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 41ddf58..c37887b 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 2.8.12 FATAL_ERROR)
++cmake_minimum_required(VERSION 3.5 FATAL_ERROR)
+ 
+ # Project
+ project(libftdi1 C)
+diff --git a/examples/cmake_example/CMakeLists.txt b/examples/cmake_example/CMakeLists.txt
+index 264752d..cbdd2e4 100644
+--- a/examples/cmake_example/CMakeLists.txt
++++ b/examples/cmake_example/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 2.8.12 FATAL_ERROR)
++cmake_minimum_required(VERSION 3.5 FATAL_ERROR)
+ 
+ project ( example C )
+ 
diff --git a/meta-oe/recipes-support/libftdi/libftdi_1.5.bb b/meta-oe/recipes-support/libftdi/libftdi_1.5.bb
index 8c30eca0e7..6faab82ad5 100644
--- a/meta-oe/recipes-support/libftdi/libftdi_1.5.bb
+++ b/meta-oe/recipes-support/libftdi/libftdi_1.5.bb
@@ -14,6 +14,9 @@ DEPENDS = "libusb1 python3 swig-native"
 SRC_URI = "\
     http://www.intra2net.com/en/developer/${BPN}/download/${BPN}1-${PV}.tar.bz2 \
     file://CMakeLists-txt-fix-paths-when-FTDIPP-is-set.patch \
+    file://0001-CMake-bump-the-minimal-required-version-to-2.8.12.patch \
+    file://0002-CMake-require-2.8.12-for-cmake_example.patch \
+    file://0003-CMake-bump-the-minimal-required-version-to-3.5.patch \
 "
 SRC_URI[sha256sum] = "7c7091e9c86196148bd41177b4590dccb1510bfe6cea5bf7407ff194482eb049"
 
diff --git a/meta-oe/recipes-support/libp11/libp11_0.4.13.bb b/meta-oe/recipes-support/libp11/libp11_0.4.13.bb
index 1731d350ae..807d079a05 100644
--- a/meta-oe/recipes-support/libp11/libp11_0.4.13.bb
+++ b/meta-oe/recipes-support/libp11/libp11_0.4.13.bb
@@ -19,6 +19,7 @@ UPSTREAM_CHECK_GITTAGREGEX = "libp11-(?P<pver>\d+(\.\d+)+)"
 inherit autotools pkgconfig
 
 EXTRA_OECONF = "--disable-static"
+EXTRA_OECONF:append:class-native = " --with-enginesdir=${RECIPE_SYSROOT_NATIVE}/usr/lib/engines-3"
 
 do_install:append () {
     rm -rf ${D}${docdir}/${BPN}
diff --git a/meta-oe/recipes-support/libusbgx/libusbgx/gadget-start b/meta-oe/recipes-support/libusbgx/libusbgx/gadget-start
index e80cb2c340..4ef679888e 100755
--- a/meta-oe/recipes-support/libusbgx/libusbgx/gadget-start
+++ b/meta-oe/recipes-support/libusbgx/libusbgx/gadget-start
@@ -15,6 +15,10 @@ for i in $ENABLED_SCHEMAS; do
     if [ -n "${configured_udc}" ] && [ -e "/sys/class/udc/${configured_udc}" ]; then
         echo ${configured_udc} > /sys/kernel/config/usb_gadget/"$i"/UDC
     else
-        ls /sys/class/udc/ > /sys/kernel/config/usb_gadget/"$i"/UDC
+        detected_udc=$(ls /sys/class/udc/)
+        if [ -z "${detected_udc}" ]; then
+            exit 1
+        fi
+        echo "${detected_udc}" > /sys/kernel/config/usb_gadget/"$i"/UDC
     fi
 done
diff --git a/meta-oe/recipes-support/udisks/udisks2/CVE-2025-6019.patch b/meta-oe/recipes-support/udisks/udisks2/CVE-2025-6019.patch
new file mode 100644
index 0000000000..2e94c8497f
--- /dev/null
+++ b/meta-oe/recipes-support/udisks/udisks2/CVE-2025-6019.patch
@@ -0,0 +1,51 @@
+From d0d04a381036b79df91616552706d515639bb762 Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Wed, 4 Jun 2025 15:26:46 +0200
+Subject: [PATCH] udiskslinuxfilesystemhelpers: Mount private mounts with
+ 'nodev,nosuid'
+
+The private mount done in take_filesystem_ownership() should always
+default to 'nodev,nosuid' for security and 'errors=remount-ro' for
+selected filesystem types to handle an corrupted filesystem. This is
+consistent with mount options calculation for regular mounts.
+
+CVE: CVE-2025-6019
+Upstream-Status: Backport [ https://github.com/storaged-project/udisks/commit/5e7277debea926370e587408517560afe87d28c9 ]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ src/udiskslinuxfilesystemhelpers.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/udiskslinuxfilesystemhelpers.c b/src/udiskslinuxfilesystemhelpers.c
+index 7c5fc037..9eb7742c 100644
+--- a/src/udiskslinuxfilesystemhelpers.c
++++ b/src/udiskslinuxfilesystemhelpers.c
+@@ -123,6 +123,7 @@ take_filesystem_ownership (const gchar  *device,
+ 
+ {
+   gchar *mountpoint = NULL;
++  const gchar *mount_opts;
+   GError *local_error = NULL;
+   gboolean unmount = FALSE;
+   gboolean success = TRUE;
+@@ -151,8 +152,15 @@ take_filesystem_ownership (const gchar  *device,
+               goto out;
+             }
+ 
++          mount_opts = "nodev,nosuid";
++          if (g_strcmp0 (fstype, "ext2") == 0 ||
++              g_strcmp0 (fstype, "ext3") == 0 ||
++              g_strcmp0 (fstype, "ext4") == 0 ||
++              g_strcmp0 (fstype, "jfs") == 0)
++            mount_opts = "nodev,nosuid,errors=remount-ro";
++
+           /* TODO: mount to a private mount namespace */
+-          if (!bd_fs_mount (device, mountpoint, fstype, NULL, NULL, &local_error))
++          if (!bd_fs_mount (device, mountpoint, fstype, mount_opts, NULL, &local_error))
+             {
+               g_set_error (error, UDISKS_ERROR, UDISKS_ERROR_FAILED,
+                            "Cannot mount %s at %s: %s",
+-- 
+2.34.1
+
diff --git a/meta-oe/recipes-support/udisks/udisks2_2.10.1.bb b/meta-oe/recipes-support/udisks/udisks2_2.10.1.bb
index 85859cd968..cc0c19ec8e 100644
--- a/meta-oe/recipes-support/udisks/udisks2_2.10.1.bb
+++ b/meta-oe/recipes-support/udisks/udisks2_2.10.1.bb
@@ -20,6 +20,7 @@ RDEPENDS:${PN} = "acl"
 SRC_URI = " \
         git://github.com/storaged-project/udisks.git;branch=2.10.x-branch;protocol=https \
         file://0001-Makefile.am-Dont-include-buildpath.patch \
+    file://CVE-2025-6019.patch \
 "
 SRCREV = "18c9faf089e306ad6f3f51f5cb887a6b9aa08350"