linux/poky.git/meta/recipes-devtools, branch dunfell

valgrind: skip intermittently failing ptest

2024-04-16T02:13:22+00:00

Intermittent failures on autobuilder: AssertionError: Failed ptests: {'valgrind': ['memcheck/tests/linux/timerfd-syscall']} (From OE-Core rev: 189628c2e3aa973ab9127924c1cf017013c7c113) Signed-off-by: Steve Sakoman

go: Backport fix for CVE-2024-24784

2024-04-13T11:51:47+00:00

Upstream-Status: Backport [https://github.com/golang/go/commit/5330cd225ba54c7dc78c1b46dcdf61a4671a632c] (From OE-Core rev: b58dae3401bcf6747a36e87106285d4bc944d25d) Signed-off-by: Ashish Sharma Signed-off-by: Steve Sakoman

go: Fix for CVE-2023-45289 CVE-2023-45290 & CVE-2024-24785

2024-04-05T13:34:42+00:00

Upstream-Status: Backport [https://github.com/golang/go/commit/20586c0dbe03d144f914155f879fa5ee287591a1 & https://github.com/golang/go/commit/bf80213b121074f4ad9b449410a4d13bae5e9be0 & https://github.com/golang/go/commit/3643147a29352ca2894fd5d0d2069bc4b4335a7e] (From OE-Core rev: 2bc50dccff15b9c4ad815092ef20caa3ef06864c) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

gcc-shared-source: whitelist CVE-2023-4039

2024-02-27T15:42:54+00:00

Concept of gcc-source prevents cve-check to detect existing CVE patch file. So whitelist this CVE in all recipes using gcc-source via this include file. (From OE-Core rev: 04511734c6dc8c7dda3a943b385cd273d012d8c7) (From OE-Core rev: 037f640b9272ba055ee41eeb1e6e9b002faefe36) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman (cherry picked from commit d803ca653139aa2d6acb4f99469c76a9d232b307) Signed-off-by: Dnyandev Padalkar Signed-off-by: Steve Sakoman

cmake: Unset CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES

2024-02-16T13:35:51+00:00

As discussion in [YOCTO #14717] cmake contains a OEToolchainConfig.cmake file to configure the toolchain correctly in cross-compile build for recipes using cmake. The variable CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES value updates incorrectly during do_compile the code. Due to this getting sporadic error like below, fatal error: stdlib.h: No such file or directory | 75 | #include_next | | ^~~~~~~~~~ | compilation terminated. | ninja: build stopped: subcommand failed. | WARNING: exit code 1 from a shell command. As cmake already correctly initializes the variable from environment, So we have to unset it in the toolchain file to avoid overwriting the variable definition again. (From OE-Core rev: 7ab6087536bc67c63094f08f863dcd3d5e35b8e7) Signed-off-by: aszh07 Signed-off-by: Zahir Hussain Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 5aeada5793af53e8c93940952d4f314474dca4c2) Signed-off-by: Steve Sakoman

rsync: Fix rsync hanging when used with --relative

2024-02-16T13:35:51+00:00

Fixes [YOCTO #15383] This bug was introduced into upstream when fixing CVE-2022-29154. It was later discovered and fixed upstream but this fix didn't make it into poky yet. The added patch is taken from upstreams git repository: https://github.com/WayneD/rsync/commit/fabef23bea6e9963c06e218586fda1a823e3c6bf (From OE-Core rev: fb448f87c0b3906b91d453451083dc003ac94ebe) Signed-off-by: Matthias Schmitz Signed-off-by: Steve Sakoman

go: add a complementary fix for CVE-2023-29406

2024-02-16T13:35:51+00:00

The original CVE-2023-29406.patch is not complete, causing docker failures at runtime, backport a complementary fix from golang upstream. (From OE-Core rev: bff621d5399e5ff2930d21f403bb2f274febd2e4) Signed-off-by: Ming Liu Signed-off-by: Steve Sakoman

perl: Whitelist CVE-2023-47039

2024-02-16T13:35:51+00:00

This CVE is related to Windows. Link: https://nvd.nist.gov/vuln/detail/CVE-2023-47039 (From OE-Core rev: 970a0a64ce147970c7743411584c9bd1dc1ce414) Signed-off-by: virendra thakur Signed-off-by: Steve Sakoman

opkg: Fix bad memory access error observe in file_read_line_alloc

2024-01-31T13:51:10+00:00

In the case of a zero length string being returned by fgets(), the condition checking for a trailing new line would perform a bad memory access outside of `buf`. This might happen when line with a leading null byte is read. Avoid this case by checking that the string has a length of at least one byte. Link: https://github.com/ndmsystems/opkg/commit/8b45a3c4cab95382beea1ecdddeb2e4a9ed14aba (From OE-Core rev: 32e3618891295cec1ee5d4195998aa97f93b2207) Signed-off-by: virendra thakur Signed-off-by: Steve Sakoman

qemu: Backport fix for CVE-2023-2861

2024-01-21T18:33:19+00:00

Updated 0012-fix-libcap-header-issue-on-some-distro.patch to resolve patch fuzz caused by the CVE-2023-2861 patch Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/a5804fcf7b22fc7d1f9ec794dd284c7d504bd16b & https://gitlab.com/qemu-project/qemu/-/commit/f6b0de53fb87ddefed348a39284c8e2f28dc4eda] (From OE-Core rev: cede843cdd1d1a83b2d616086aa69a2b584f9442) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman