linux/poky.git/meta/recipes-devtools/binutils, branch 5.3_M1

toolchain: Provide abstraction for recipe specific toolchain selection

2025-06-16T21:26:38+00:00

This change implements a toolchain selection mechanism. Selection is made using a set of variables, primarily PREFERRED_TOOLCHAIN_TARGET which defaults to gcc. It uses the familiar name for toolchain e.g. "gcc" which selects GNU compiler + binutils as default C/C++ toolchain or "clang" which will use LLVM/Clang Compiler. Layers an add their own toolchain definitions too. There are also PREFERRED_TOOLCHAIN_NATIVE and PREFERRED_TOOLCHAIN_SDK which will ulitmately allow selection of the toolchain used for the native/cross and nativesdk/crosssdk compilers. This currently isn't functional but is essential to the patch to ensure things are set to the existing gcc support in those cases. Users would most commonly want to set: PREFERRED_TOOLCHAIN_TARGET ?= "clang" in local.conf or other distro specific global configuration metadata. It is also selectable at recipe scope, since not all packages are buildable with either clang or gcc, a recipe can explicitly require a given toolchain using the TOOLCAHIN variable, e.g. glibc can not be built with clang therefore glibc recipe sets: TOOLCHAIN = "gcc" The TOOLCHAIN variable is distinct from the user preference so recipes with specific requirements can be identified. This also allows different polcies to be be specified for native/SDK cases in the future. (From OE-Core rev: 45bdedd213aff8df3214b95ef2a8551c0abd93a0) Signed-off-by: Richard Purdie

binutils: Fix for CVE-2025-3198

2025-06-12T10:03:43+00:00

Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=ba6ad3a18cb26b79e0e3b84c39f707535bbc344d] CVE: CVE-2025-3198 (From OE-Core rev: 602d1cab0f8e11925244a27310086b195de70464) Signed-off-by: Harish Sadineni Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

binutils: Fix CVE-2025-5244

2025-06-12T10:03:43+00:00

PR32858 ld segfault on fuzzed object We missed one place where it is necessary to check for empty groups. Backport a patch from upstream to fix CVE-2025-5244 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=d1458933830456e54223d9fc61f0d9b3a19256f5] (From OE-Core rev: 082c56061e910176dd464702a19858dc0d57431a) Signed-off-by: Deepesh Varatharajan Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

binutils: Fix CVE-2025-5245

2025-06-09T16:43:41+00:00

PR32829, SEGV on objdump function debug_type_samep u.kenum is always non-NULL, see debug_make_enum_type. Backport a patch from upstream to fix CVE-2025-5245 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=6c3458a8b7ee7d39f070c7b2350851cb2110c65a] (From OE-Core rev: f5fd6f691d62052ffddb13461cf221321ff127c3) Signed-off-by: Deepesh Varatharajan Signed-off-by: Richard Purdie

binutils: Fix CVE-2025-1181

2025-06-02T21:17:24+00:00

PR 32641 [https://sourceware.org/bugzilla/show_bug.cgi?id=32641] PR 32643 [https://sourceware.org/bugzilla/show_bug.cgi?id=32643] Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=18cc11a2771d9e40180485da9a4fb660c03efac3 && https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=931494c9a89558acb36a03a340c01726545eef24] (From OE-Core rev: f7ffc2ab17d0ae55f7193c6fe39ac081bd00f340) Signed-off-by: Deepesh Varatharajan Signed-off-by: Richard Purdie

binutils: Fix CVE-2025-1182

2025-05-29T14:14:37+00:00

Upstream-Status: Submitted [https://sourceware.org/pipermail/binutils/2025-May/141415.html] CVE: CVE-2025-1182 (From OE-Core rev: 1e6575a4eb6168322a6560af787399267f5fa304) Signed-off-by: Harish Sadineni Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

binutils: Fix CVE-2025-1180

2025-05-27T08:01:17+00:00

Upstream-Status: Submitted [https://sourceware.org/pipermail/binutils/2025-May/141351.html] CVE: CVE-2025-1180 cherry picked from upstream commit: https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=f9978defb6fab0bd8583942d97c112b0932ac814 (From OE-Core rev: f2681cfb09f1079543dd58cf788f67d65d26e21d) Signed-off-by: Harish Sadineni Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

binutils: Fix CVE-2025-1178

2025-05-22T13:36:49+00:00

Prevent an abort in the bfd linker when attempting to generate dynamic relocs for a corrupt input file. PR 32638 Backport a patch from upstream to fix CVE-2025-1178 Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0] (From OE-Core rev: f58f174daa7e30baa18abe4db9eda9c1b1c425cc) Signed-off-by: Deepesh Varatharajan Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

binutils: mark CVE-2025-1153 as fixed

2025-05-05T16:22:11+00:00

We had this CVE patched but the patch was removed with last 2.44 branch updates as it is now included. Since there is no new version which could be set in NVD DB, this needs to be explicitly handled. (From OE-Core rev: 32f18145dee54f61203506daef339cd132908287) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

binutils: drop obsolete CVE_STATUS

2025-05-05T16:22:11+00:00

NVD has CVE-2023-25584 listed as < 2.40, so we don't need to ignore it for version 2.44 anymore. (From OE-Core rev: eaf80096f96e5bebed53076c1dfe7e35e539f383) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie