summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core
Commit message (Collapse)AuthorAgeFilesLines
...
* systemd-systemctl: fix instance template WantedBy symlink constructionMartin Siegumfeldt2023-06-271-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix issue of the below instance template systemd service dependency [Install] WantedBy=svc-wants@%i.service creating the symlink (instance "a" example) /etc/systemd/system/svc-wants@%i.service.wants/svc-wanted-by@a.service which should be /etc/systemd/system/svc-wants@a.service.wants/svc-wanted-by@a.service as implemented by this change. The functionality appears regressed just after "thud" baseline when the logic was refactored from shell script into python (commit 925e30cb104ece7bfa48b78144e758a46dc9ec3f) (From OE-Core rev: 308397f0bb3d6f3d4e9ec2c6a10823184049c9b5) (From OE-Core rev: 2751472807edc6d2ccc93b6339e6dc57d4abb2da) Signed-off-by: Martin Siegumfeldt <mns@gomspace.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 372b29c8ad270d4d430c26a4e614976c7029afaf) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: added the missing http importJan Vermaete2023-06-271-0/+1
| | | | | | | | | (From OE-Core rev: 787acb1cbc22c0f3bd0cc163c527cc7a98007f26) Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 39d2cde7eb922cb0a2cf9402cd8b3ae3b4cc2f62) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: new CVE database fetcherMarta Rybczynska2023-06-271-0/+333
| | | | | | | | | | | | | | | | | | | | Add new fetcher for the NVD database using the 2.0 API [1]. The implementation changes as little as possible, keeping the current database format (but using a different database file for the transition period), with a notable exception of not using the META table. Minor changes that could be visible: - the database starts in 1999 instead of 2002 - the complete fetch is longer (30 minutes typically) [1] https://nvd.nist.gov/developers/vulnerabilities (From OE-Core rev: 191e2c6d7009999f049a0cf8460259f8f91a829d) Signed-off-by: Marta Rybczynska <marta.rybczynska@syslinbit.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit fb62c4c3dbca4e58f7ce6cf29d4b630a06411a97) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.26dunfell-23.0.26Steve Sakoman2023-06-171-1/+1
| | | | | | (From OE-Core rev: 77f6fbfa18b4ad77c3756cfdc45d441a20210781) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: patch CVE-2023-28484 and CVE-2023-29469Peter Marko2023-05-163-0/+123
| | | | | | | | | | | Backports from: * https://gitlab.gnome.org/GNOME/libxml2/-/commit/e4f85f1bd2eb34d9b49da9154a4cc3a1bc284f68 * https://gitlab.gnome.org/GNOME/libxml2/-/commit/547edbf1cbdccd46b2e8ff322a456eaa5931c5df (From OE-Core rev: c0cfcd3945257efd40745e0ebb84495441acb590) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.25dunfell-23.0.25Steve Sakoman2023-05-031-1/+1
| | | | | | (From OE-Core rev: fd4cc8d7b5156c43d162a1a5a809fae507457ef4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: Fix CVE-2023-26604rajmohan r2023-04-265-0/+597
| | | | | | | | | | | | | | | | | | | | | | | | Below patch files to fix CVE-2023-26604 CVE-2023-26604-1.patch, CVE-2023-26604-2.patch and CVE-2023-26604-3.patch and CVE-2023-26604-4.patch make pager secure when under euid is changed or explicitly requested Reference: CVE-2023-26604-1.patch: https://github.com/systemd/systemd/pull/17270/commits/612ebf6c913dd0e4197c44909cb3157f5c51a2f0 CVE-2023-26604-2.patch: https://github.com/systemd/systemd/pull/17270/commits/1b5b507cd2d1d7a2b053151abb548475ad9c5c3b CVE-2023-26604-3.patch: https://github.com/systemd/systemd/pull/17270/commits/0a42426d797406b4b01a0d9c13bb759c2629d108 CVE-2023-26604-4.patch: https://github.com/systemd/systemd/pull/17359/commits/b8f736b30e20a2b44e7c34bb4e43b0d97ae77e3c (From OE-Core rev: 7880eb801dcee44a9e8920d249057492d1de6b12) Signed-off-by: rajmohan r <rajmohan.r@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: fix wrong nobody-group assignmentPiotr Łobacz2023-04-011-1/+1
| | | | | | | | | | | | | | | | | | The generated /etc/group file had a wrong group name for nobody-group which was nobody with same id as nogroup groupd. This was leading to duplcate groups, with same ids and different names. More can be read on this link: https://bugzilla.yoctoproject.org/show_bug.cgi?id=11766 (From OE-Core rev: 0928857e4aaa524f36e028d4fe0cc48cc4d40148) Signed-off-by: Piotr Łobacz <p.lobacz@welotec.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d69fccf2e5d108dd7c6059310924588d36a45865) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* base-files: Drop localhost.localdomain from hosts fileRichard Purdie2023-03-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This was likely something we took inspiration from elsewhere with. It was added in: https://git.openembedded.org/openembedded/commit/packages/netbase/netbase/hosts?id=c8e5702127e507e82e6f68a4b8c546803accea9d in 2005. Debian added this entry around 2004 and discussed and dropped it in 2005: https://lists.debian.org/debian-devel/2005/10/msg00559.html resulting in: https://salsa.debian.org/installer-team/netcfg/-/commit/3c15ee521b2b8f47b34ccc7f610523cd284f2221 We should drop this for some of the reasons in those threads, it doesn't seem to be doing anything too helpful and isn't what most applications expect. (From OE-Core rev: a04b207c4ffa900313a0b5e3079ad2eec7d31f27) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e730d005fa8aec07f9ae25c58d4566eaa92a6997) Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-tarball: Handle spaces within user $PATHKenfe-Mickael Laventure2023-03-251-1/+1
| | | | | | | | | | | | | | | The environment-setup script generated by the recipe was not quoting the user existing PATH when updating it causing the export command to fail. Add necessary double quotes around $PATH. (From OE-Core rev: 9ececa2c36eff7c954d92e9d13a2fe8c1fae9bd2) Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 2d4c032bf3187aaa953a0c33a999074e695f54bb) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: Add missing binutils dependencyRichard Purdie2023-03-251-1/+3
| | | | | | | | | | | | | | | | | | glibc has it's dependencies handled more manually due to it's place in the toolchain bootstrap. It depends upon the compiler and indirectly through that to binutils. This did mean that if binutils changes and the compiler does not, sstate and hash equivalence could mean that glibc wouldn't rebuild. Add a direct dependency on binutils that if it changes, it forces glibc to rebuild, as it should. (From OE-Core rev: ea6d768d0910e2076a971bdba57605dd9d68763a) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c4a7b3decff636292f5e76e95406a22b6fe4a994) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Fix systemd when used with busybox lessAlban Bedel2023-03-252-0/+12
| | | | | | | | | | | | | | | | | | | Per default systemd use a pager for the output of most of its tools and it expect this pager to be color capable. But that is not the case when the busybox `less` is used, which lead to output garbled by color escape sequences. To fix this issue add a profile frament that disable the systemd pager when busybox `less` is detected. (From OE-Core rev: 06271fd8d26bc34448524157077c23eb1ea29c52) Signed-off-by: Alban Bedel <alban.bedel@aerq.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit de7e36a7858ebca4615975967fcad1c399eacdb0) Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.24dunfell-23.0.24Richard Purdie2023-03-151-1/+1
| | | | | | (From OE-Core rev: efb1a73a13907bed3acac8e06053aef3e2ef57f5) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: Security fix for CVE-2023-0687Shubham Kulkarni2023-03-142-0/+83
| | | | | | | | | | Backport from https://sourceware.org/git/?p=glibc.git;a=patch;h=801af9fafd4689337ebf27260aa115335a0cb2bc (From OE-Core rev: d7c7e9acd5b5699e4a0c2c7f2664cce7a5a08641) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: rm temporary files if do_compile was interruptedAntonin Godard2023-02-241-0/+3
| | | | | | | | | | | To avoid working with undeterministic config files, remove all the temporary files to start from scratch. (From OE-Core rev: a3f31997c633e8476bad68c81fac0dcd0750c7d4) Signed-off-by: Antonin Godard <antoningodard@pm.me> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: always start do_compile with orig config filesAntonin Godard2023-02-241-8/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When compiling busybox a second time (e.g. with `compile -f`), busybox can use an altered autoconf.h file for compiling, which can ultimately produces different and unwanted binaries. This can produce errors like this one: ERROR: busybox-1.35.0-r0 do_package: Error executing a python function in exec_func_python() autogenerated: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_func_python() autogenerated', lineno: 2, function: <module> 0001: *** 0002:ptest_update_alternatives(d) 0003: File: '…/poky/meta/classes/ptest.bbclass', lineno: 100, function: ptest_update_alternatives 0096: for alt_name, alt_link, alt_target, _ in alternatives: 0097: # Some alternatives are for man pages, 0098: # check if the alternative is in PATH 0099: if os.path.dirname(alt_link) in bin_paths: *** 0100: os.symlink(alt_target, os.path.join(ptest_bindir, alt_name)) 0101:} 0102: 0103:do_configure_ptest_base[dirs] = "${B}" 0104:do_compile_ptest_base[dirs] = "${B}" Exception: FileExistsError: [Errno 17] File exists: '/bin/busybox.suid' -> '…/busybox/1.35.0-r0/package/usr/lib/busybox/ptest/bin/login' This happens because ALTERNATIVE:busybox contains `/bin/login` twice, initially that's because `/bin/login` is present in both busybox.links.suid and busybox.links.nosuid. The reason for that is because of the altered autoconf.h. Steps to reproduce above error: <add ptest to distro configs> bitbake busybox -c clean bitbake busybox -c package -f bitbake busybox -c compile -f bitbake busybox -c package -f This patch guards against potential bugs by: - making a backup of .config and autoconf.h that have matching timestamps. - make sure do_compile always starts with these files. - restore .config and autoconf.h at the end of do_compile. (From OE-Core rev: 7ef76eaf5b68d52afdc4292bbe20309e29bb464a) Signed-off-by: Antonin Godard <antoningodard@pm.me> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.23dunfell-23.0.23Richard Purdie2023-02-131-1/+1
| | | | | | (From OE-Core rev: daaee6fcb0d201f041678af433d8e1cd6f924d09) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Consider PACKAGECONFIG in RRECOMMENDSNiko Mauno2023-02-131-2/+2
| | | | | | | | | | | | | | | | | Since RRECOMMENDS declaration implictly induces building the recipes that provide the runtime recommended packages, conditionalize adding such values according to associated PACKAGECONFIG settings in order to avoid redundant building. (From OE-Core rev: a1989add927f7805378fe4d5afbde780b747ba77) (From OE-Core rev: a35444fa035d551b6a4dcb9609ab8de960258618) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: show IP on failureRoss Burton2023-02-131-1/+4
| | | | | | | | | | | | | | | | | We get random SSL failures when fetching the CVE database, and it's notable that the NVD server is behind a DNS round-robin or geographically diverse servers. On a hunch that there is one misconfigured server, dump the IP that we connected to. (From OE-Core rev: 48c0e427675f4c99c395cc0a75743ac70eb64802) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 91f46d431dc8f40e8c6475c800bb61cb08b82b0a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: avoid incomplete updatesMarta Rybczynska2023-02-131-22/+61
| | | | | | | | | | | | | | | | | | | | | The database update has been done on the original file. In case of network connection issues, temporary outage of the NVD server or a similar situation, the function could exit with incomplete data in the database. This patch solves the issue by performing the update on a copy of the database. It replaces the main one only if the whole update was successful. See https://bugzilla.yoctoproject.org/show_bug.cgi?id=14929 Reported-by: Alberto Pianon <alberto@pianon.eu> (From OE-Core rev: 6a219c50ee12b7fb584e2db3e4dde171903acfb7) Signed-off-by: Marta Rybczynska <marta.rybczynska@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8efe99214d8b005f0ecac690ce5ba17b31758f92) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: add more logging when fetchingRoss Burton2023-02-131-1/+4
| | | | | | | | | | | | Add some debug logging when fetching the CVE data. (From OE-Core rev: 60fa8135437ab1e2bc7cead5f838ac787c8dab26) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9b230584664873af2ab453b8153b1ad276d3b0af) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: Allow to overrule the URL in a bbappend.jan2023-02-131-2/+2
| | | | | | | | | | | | | With this small patch, it's possible to overrule the public URL with a local mirror for those without Internet access. (From OE-Core rev: 7290b3217c31cec7dd9985cbf5a003a9c368fa54) Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2d903126e8bbece3a5171c3488c3deae1f0aa3ee) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.22dunfell-23.0.22Richard Purdie2023-01-131-1/+1
| | | | | | (From OE-Core rev: db81e3c7e7f1d4d9eba52ac35ac97627d0240b63) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ovmf: fix gcc12 warning for device path handlingSteve Sakoman2023-01-132-0/+42
| | | | | | | | | | | | | | | | | | | | | | | Backport [https://github.com/tianocore/edk2/commit/22130dcd98b4d4b76ac8d922adb4a2dbc86fa52c] Fixes: In function ?SetDevicePathEndNode?, inlined from ?FileDevicePath? at DevicePathUtilities.c:857:5: DevicePathUtilities.c:321:3: error: writing 4 bytes into a region of size 1 [-Werror=stringop-overflow=] 321 | memcpy (Node, &mUefiDevicePathLibEndDevicePath, sizeof (mUefiDevicePathLibEndDevicePath)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from UefiDevicePathLib.h:22, from DevicePathUtilities.c:16: ../Include/Protocol/DevicePath.h: In function ?FileDevicePath?: ../Include/Protocol/DevicePath.h:51:9: note: destination object ?Type? of size 1 51 | UINT8 Type; ///< 0x01 Hardware Device Path. | ^~~~ (From OE-Core rev: a33abd759e2e9f41e056f87024de3b333e9b948b) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ovmf: fix gcc12 warning in LzmaEncSteve Sakoman2023-01-132-0/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Backport [https://github.com/tianocore/edk2/commit/85021f8cf22d1bd4114803c6c610dea5ef0059f1] Fixes: Sdk/C/LzmaEnc.c: In function ?LzmaEnc_CodeOneMemBlock?: Sdk/C/LzmaEnc.c:2828:19: error: storing the address of local variable ?outStream? in ?*p.rc.outStream? [-Werror=dangling-pointer=] 2828 | p->rc.outStream = &outStream.vt; | ~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~ Sdk/C/LzmaEnc.c:2811:28: note: ?outStream? declared here 2811 | CLzmaEnc_SeqOutStreamBuf outStream; | ^~~~~~~~~ Sdk/C/LzmaEnc.c:2811:28: note: ?pp? declared here Sdk/C/LzmaEnc.c:2828:19: error: storing the address of local variable ?outStream? in ?*(CLzmaEnc *)pp.rc.outStream? [-Werror=dangling-pointer=] 2828 | p->rc.outStream = &outStream.vt; | ~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~ Sdk/C/LzmaEnc.c:2811:28: note: ?outStream? declared here 2811 | CLzmaEnc_SeqOutStreamBuf outStream; | ^~~~~~~~~ Sdk/C/LzmaEnc.c:2811:28: note: ?pp? declared here cc1: all warnings being treated as errors (From OE-Core rev: 25cc13c1016c2565694d0e0959a69c8b91054309) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ovmf: fix gcc12 warning in GenFfsSteve Sakoman2023-01-132-0/+50
| | | | | | | | | | | | | | | | | | Backport [https://github.com/tianocore/edk2/commit/7b005f344e533cd913c3ca05b266f9872df886d1] Fixes: GenFfs.c:545:5: error: pointer ?InFileHandle? used after ?fclose? [-Werror=use-after-free] 545 | Error(NULL, 0, 4001, "Resource", "memory cannot be allocated of %s", InFileHandle); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ GenFfs.c:544:5: note: call to ?fclose? here 544 | fclose (InFileHandle); | ^~~~~~~~~~~~~~~~~~~~~ (From OE-Core rev: 19da9603f4e7e64d4ffcb6d1e927965dcd161079) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* psplash: consider the situation of psplash not exist for systemdChen Qi2022-12-232-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | In current psplash framework, the psplash might not exist at all. For example, in case DSITRO is set to nodistro, the psplash does not exist. In our psplash recipe, we have: SPLASH_IMAGES = "file://psplash-poky-img.h;outsuffix=default" This variable is parsed to if psplash-poky-img.h exists, a package named psplash-default is created and is added to RDEPENDS:${PN}. We can see that the psplash-poky-img.h resides in meta-poky, and in psplash_git.bbappend file in meta-poky, we have: FILESEXTRAPATHS:prepend:poky := "${THISDIR}/files:" So this file is only available in case poky distro is used. To fix this issue, add condition check in the corresponding systemd services. (From OE-Core rev: bf9cb1a3d68da6463195f79caf8baf94cd01a30a) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7a62ff9ed39c179d2b9b0c40f4f8423ced413063) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dropbear: fix CVE-2021-36369Lee Chee Yang2022-12-232-0/+146
| | | | | | | | (From OE-Core rev: c0e44595555a81d1a1cd206c2235cbc419d02bd1) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Fix CVE-2022-40304Bhabu Bindu2022-12-072-0/+105
| | | | | | | | | | | | | | Fix dict corruption caused by entity reference cycles Link: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b Upstream-Status: Pending (From OE-Core rev: 8e195f0a01b4cc1017bf9df67ffc3c6d6c15d24a) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Fix CVE-2022-40303Bhabu Bindu2022-12-072-0/+624
| | | | | | | | | | | | | | Fix integer overflows with XML_PARSE_HUGE Link: https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0 Upstream-Status: Pending (From OE-Core rev: d16d5660a32386158632ee5599ad92a9f2dc08dd) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Fix CVE-2022-3821 issueRanjitsinh Rathod2022-12-072-0/+48
| | | | | | | | | | | | | | | An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service. Add a patch to solve above CVE issue Link: https://github.com/systemd/systemd/commit/9102c625a673a3246d7e73d8737f3494446bad4e (From OE-Core rev: e2db40ca49b8ed217f14c7f861087837e8b3f389) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.21dunfell-23.0.21Richard Purdie2022-11-221-1/+1
| | | | | | (From OE-Core rev: 1ee082e979baaba871bbe1d91181bb04951faf3b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionRichard Purdie2022-11-221-1/+1
| | | | | | (From OE-Core rev: a5d90bf22c037044c471daefe326ae14702b173e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc : stable 2.31 branch updates.Sundeep KOKKONDA2022-11-202-16/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Below commits on glibc-2.31 stable branch are updated. d4b7559457 x86-64: Require BMI2 for avx2 functions [BZ #29611] b8bb48a18d x86-64: Require BMI2 for strchr-avx2.S [BZ #29611] c8f2a3e803 Add test for bug 29530 e6ae5b25cd Fix memmove call in vfprintf-internal.c:group_number 1dbe841a67 Remove most vfprintf width/precision-dependent allocations (bug 14231, bug 26211). 5a802723db stdio: Add tests for printf multibyte convertion leak [BZ#25691] ae7748e67f stdio: Remove memory leak from multibyte convertion [BZ#25691] 174d0b61c7 Linux: Require properly configured /dev/pts for PTYs 0a167374fd Linux: Detect user namespace support in io/tst-getcwd-smallbuff 4ad1659d8c getcwd: Set errno to ERANGE for size == 1 (CVE-2021-3999) 3319cea99e support: Add helpers to create paths longer than PATH_MAX f733e291bb support: Fix xclone build failures on ia64 and hppa 43757c70ee support: Add xclone 29d3aeb0e8 Add xchdir to libsupport. 2d7720f316 support: Add create_temp_file_in_dir 183709983d NEWS: Add a bug fix entry for BZ #28896 d385079bd5 x86: Fix TEST_NAME to make it a string in tst-strncmp-rtm.c 7df3ad6560 x86: Test wcscmp RTM in the wcsncmp overflow case [BZ #28896] fc133fcf49 x86: Fallback {str|wcs}cmp RTM in the ncmp overflow case [BZ #28896] 775c05b28c string: Add a testcase for wcsncmp with SIZE_MAX [BZ #28755] c6b346ec55 x86-64: Test strlen and wcslen with 0 in the RSI register [BZ #28064] 0675185923 x86: Remove wcsnlen-sse4_1 from wcslen ifunc-impl-list [BZ #28064] 5db3239baf x86: Black list more Intel CPUs for TSX [BZ #27398] 5b99f172b8 x86: Check RTM_ALWAYS_ABORT for RTM [BZ #28033] 70d293a158 NEWS: Add a bug fix entry for BZ #27974 a2be2c0f5d String: Add overflow tests for strnlen, memchr, and strncat [BZ #27974] 489006c3c5 x86: Optimize strlen-evex.S 937f2c783a x86: Fix overflow bug in wcsnlen-sse4_1 and wcsnlen-avx2 [BZ #27974] 0058c73d11 x86-64: Add wcslen optimize for sse4.1 665d0252f1 x86-64: Move strlen.S to multiarch/strlen-vec.S 82ff13e2cc x86-64: Fix an unknown vector operation in memchr-evex.S 539b593a1d x86: Optimize memchr-evex.S 7b37ae60c6 x86: Optimize strlen-avx2.S 0381c1c10d x86: Fix overflow bug with wmemchr-sse2 and wmemchr-avx2 [BZ #27974] 10368cb76b x86: Optimize memchr-avx2.S 66ca40582e test-strnlen.c: Check that strnlen won't go beyond the maximum length 927bcaf892 test-strnlen.c: Initialize wchar_t string with wmemset [BZ #27655] 0d4159c36c x86-64: Require BMI2 for __strlen_evex and __strnlen_evex c0cbb9345e NEWS: Add a bug fix entry for BZ #27457 e81b975fcc x86-64: Fix ifdef indentation in strlen-evex.S aa4e48e73c x86-64: Use ZMM16-ZMM31 in AVX512 memmove family functions ac911d3b57 x86-64: Use ZMM16-ZMM31 in AVX512 memset family functions 20d37de533 x86: Add string/memory function tests in RTM region fbaa99ed41 x86-64: Add AVX optimized string/memory functions for RTM 096e14f632 x86-64: Add memcmp family functions with 256-bit EVEX f00fad4e4c x86-64: Add memset family functions with 256-bit EVEX cf239ddd2e x86-64: Add memmove family functions with 256-bit EVEX 7257ba7bf2 x86-64: Add strcpy family functions with 256-bit EVEX db9071c0f6 x86-64: Add ifunc-avx2.h functions with 256-bit EVEX 2d612b2c5f x86: Set Prefer_No_VZEROUPPER and add Prefer_AVX2_STRCMP 5b13651085 NEWS: Add a bug fix entry for BZ #28755 5ee8a436ab x86: Fix __wcsncmp_avx2 in strcmp-avx2.S [BZ# 28755] (From OE-Core rev: 1d047a1f19ea57f919180273589cdf7fb4dacaa3) Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* coreutils: add openssl PACKAGECONFIGDaniel McGregor2022-11-091-0/+1
| | | | | | | | | | | | | | | | | coreutils-native will pick up openssl on the host if it's GPL compatible (version >= 3), which causes uninative failures with hosts that don't have openssl3. Add a PACKAGECONFIG entry for openssl so it can be enabled, but isn't by default. (From OE-Core rev: 590d8f2bdbb7ea558b9e99e58a1dae2b5eb58153) Signed-off-by: Daniel McGregor <daniel.mcgregor@vecima.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9859a8124a0c09ac38d476445e7df7097f41d153) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: add timeout to urlopen() callsFrank de Brabander2022-11-091-2/+7
| | | | | | | | | | | | | | | | | | The urlopen() call can block indefinitely under some circumstances. This can result in the bitbake process to run endlessly because of the 'do_fetch' task of cve-update-bb-native to remain active. This adds a default timeout of 60 seconds to avoid this hang, while being large enough to minimize the risk of unwanted timeouts. (From OE-Core rev: f51a6742bcae3a151a326d17cd44935815eb78c7) Signed-off-by: Frank de Brabander <debrabander@gmail.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e5f6652854f544106b40d860de2946954de642f3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* expat: Fix CVE-2022-43680 for expatRanjitsinh Rathod2022-11-092-0/+34
| | | | | | | | | | | | | Add a patch to fix CVE-2022-43680 issue where use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations Link: https://nvd.nist.gov/vuln/detail/CVE-2022-43680 (From OE-Core rev: ac4476e6594417b14bfb05a110009ef245f419b0) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dbus: upgrade 1.12.22 -> 1.12.24Omkar2022-10-273-1/+1
| | | | | | | | | | | | | | | Upgrade dbus from 1.12.22 to 1.12.24 Fix Below CVE's: 2022-42010 2022-42011 2022-42012 (From OE-Core rev: f00cb90cb4169ecbc003c61b50ae9e0dd4b75254) Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dbus: upgrade 1.12.20 -> 1.12.22wangmy2022-10-273-2/+1
| | | | | | | | | | | | | (From OE-Core rev: 1fb8ea03cf6c4df4d8c2cc9329dfe80c83a37e2d) (From OE-Core rev: f2632f0e5f814aac9f0c8f7294fb1d8439167c36) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dc98fba73aeac4d1e661475dfb4acfca94d6c8f8) Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.20dunfell-23.0.20Richard Purdie2022-10-091-1/+1
| | | | | | (From OE-Core rev: dbad46a0079843b380cf3dda6008b12ab9526688) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* expat: Fix CVE-2022-40674Virendra Thakur2022-09-232-0/+54
| | | | | | | | | | | | Add patch file to fix CVE-2022-40674 Link: https://github.com/libexpat/libexpat/pull/629/commits/4a32da87e931ba54393d465bb77c40b5c33d343b (From OE-Core rev: 4efa4490becea956a62d45e1476f7b602be53eee) Signed-off-by: Virendra Thakur <virendrak@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Add 'no-dns-fallback' PACKAGECONFIG optionniko.mauno@vaisala.com2022-09-161-0/+1
| | | | | | | | | | | | | | | | | | | | | systemd defines a default set of fallback DNS servers in https://github.com/systemd/systemd/blob/v251/meson_options.txt#L328-L330 By adding a PACKAGECONFIG knob providing a convenient way to opt out, and then adding that value to systemd's PACKAGECONFIG, the output from runtime 'resolvectl status' command no longer contains the following line: Fallback DNS Servers: 1.1.1.1#cloudflare-dns.com 8.8.8.8#dns.google 1.0.0.1#cloudflare-dns.com 8.8.4.4#dns.google 2606:4700:4700::1111#cloudflare-dns.com 2001:4860:4860::8888#dns.google 2606:4700:4700::1001#cloudflare-dns.com 2001:4860:4860::8844#dns.google (From OE-Core rev: 2b300d6b9ec6288a99d9dacb24a86949caf99e55) (From OE-Core rev: 834ccad676b3d8d58d1a66bbe813a331599435b4) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Fix unwritable /var/lock when no sysvinit handlingniko.mauno@vaisala.com2022-09-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 8089cefed8e83c0348037768c292058f1bcbbbe5 ("systemd: Add PACKAGECONFIG for sysvinit") decoupled enabling of systemd's sysvinit handling behavior behind a distinct PACKAGECONFIG feature. This new option affects among other things the installing of tmpfiles.d/legacy.conf, which is responsible for creating /run/lock directory, which is pointed to by /var/lock symlink provided by base-files package. In case the option is not enabled, then base-files provided /var/lock is a dangling symlink on resulting rootfs, causing problems with certain Linux userspace components that rely on existence of writable /var/lock directory. As an example: # fw_printenv Error opening lock file /var/lock/fw_printenv.lock Since Filesystem Hierarchy Standard Version 3.0 states in https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch05s09.html that Lock files should be stored within the /var/lock directory structure. Ensure the /run/lock directory is always created, so that lock files can be stored under /var/lock also when 'sysvinit' handling is disabled. (From OE-Core rev: 85e5ee2c35cf5778c3aefda45f526e8f6a511131) (From OE-Core rev: b8aa4d53b636bec55ad0ff4de764222662647859) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: close cursors as soon as possibleRoss Burton2022-09-121-23/+28
| | | | | | | | | | | | | | | | We can have multiple processes reading the database at the same time, and cursors only release their locks when they're garbage collected. This might be the cause of random sqlite errors on the autobuilder, so explicitly close the cursors when we're done with them. (From OE-Core rev: 48742ddf4d0acd419c8ffb8f22124ed525efc2d9) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 5d2e90e4a58217a943ec21140bc2ecdd4357a98a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Add fix for CVE-2016-3709Pawan Badganchi2022-09-032-0/+90
| | | | | | | | | | | | | Add below patch to fix CVE-2016-3709 CVE-2016-3709.patch Link: https://github.com/GNOME/libxml2/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f (From OE-Core rev: b9312041e4c8d565ad1e1102f8634bcc913adfa7) Signed-off-by: Pawan Badganchi<pawan.badganchi@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.19dunfell-23.0.19Richard Purdie2022-08-221-1/+1
| | | | | | (From OE-Core rev: a3cba15142e98177119ef36c09f553d09acf35ef) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* initscripts: run umountnfs as a KILL scriptShruthi Ravichandran2022-08-221-1/+1
| | | | | | | | | | | | | | | | | | | | `rc` runs all the KILL scripts in a runlevel before the START scripts. The umountnfs script is currently configured as a START script, and runs after the networking KILL script. During shutdown, this causes a ~3 minute timeout after networking is shutdown when the system tries to connect to and unmount any mounted network shares. Fix this by changing the script configuration to "stop" so that it can run before networking is stopped and unmount any network shares safely. (From OE-Core rev: e59c72d570102d72786e44c8ace69fd4d0e8e5ef) Signed-off-by: Shruthi Ravichandran <shruthi.ravichandran@ni.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c419bd4537756e9f6c2fe6da3a9b798526e27eca) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* zlib: CVE-2022-37434 a heap-based buffer over-readHitendra Prajapati2022-08-222-0/+45
| | | | | | | | | | | | | | | | Source: https://github.com/madler/zlib MR: 120531 Type: Security Fix Disposition: Backport from https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1 & https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d ChangeID: 364c17d74213c64fe40b9b37ee78aa172ff93acf Description: CVE-2022-37434 zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. (From OE-Core rev: 10ed7cf347d9e73b29e4a3f6ef77e0a4b08e350b) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Port gentest.py to Python-3Martin Jansa2022-08-182-0/+824
| | | | | | | | | | | | | | | * but it still won't work well on hosts without libxml2, make sure to use pre-generated testapi.c in do_compile_ptest * this is reproducible with SOURCE_DATE_EPOCH set to 0 which e.g. meta-updater still sets by default for DISTROs which use it :(, see https://github.com/uptane/meta-updater/pull/35 (From OE-Core rev: 2f78dbcb300e7deae6cf39263e874ee8776d7a7b) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.18dunfell-23.0.18Richard Purdie2022-07-251-1/+1
| | | | | | (From OE-Core rev: 3f40d5f095ceb099b604750db96058df00fcd49e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-14 01:48:50 +0000