linux/poky.git/meta, branch dunfell-23.0.20

build-appliance-image: Update to dunfell head revision

2022-10-09T18:34:46+00:00

(From OE-Core rev: dbad46a0079843b380cf3dda6008b12ab9526688) Signed-off-by: Richard Purdie

licenses: Handle newer SPDX license names

2022-10-05T07:39:19+00:00

License names were updated in commit 2456f523cfbb (after the dunfell release) to match the current SPDX license list. We don't want to do any wholesale renaming on the dunfell stable branch but we should add mappings for the newer '*-only' names to allow for layers which support both dunfell and newer releases. (From OE-Core rev: 2a646cbdaca914e6f2c76ccb75065a811a9f94de) Signed-off-by: Paul Barker Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bind: Fix CVEs 2022-2795, 2022-38177, 2022-38178

2022-10-05T07:39:19+00:00

(From OE-Core rev: 9632481dc14868c0f92572472834a2a0c4f46e2e) Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

go: Add fix for CVE-2022-32190

2022-09-30T15:34:52+00:00

Link: https://github.com/golang/go/commit/28335508913a46e05ef0c04a18e8a1a6beb775ec (From OE-Core rev: 3362bbb1a1ce599418dc8377043f7549f9327315) Signed-off-by: Shubham Kulkarni Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

golang: CVE-2022-27664 net/http: handle server errors after sending GOAWAY

2022-09-30T15:34:52+00:00

Source: https://github.com/golang/go MR: 121912 Type: Security Fix Disposition: Backport from https://github.com/golang/go/commit/5bc9106458fc07851ac324a4157132a91b1f3479 ChangeID: 0b76a92a774279d7bffc9d6fa05564dfd8371e8c Description: CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY. (From OE-Core rev: 4e2f723a4288ad4839fac2769e487612252b1d40) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

vim: Upgrade 9.0.0541 -> 9.0.0598

2022-09-30T15:34:52+00:00

Includes a fix for CVE-2022-3278. (From OE-Core rev: bc13c16bec7a898ae3246e2a9ab586e8241af28e) Signed-off-by: Richard Purdie Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 98c40271692147873a622e168e8b2e90a9fcc54c) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bluez: CVE-2022-39176 BlueZ allows physically proximate attackers

2022-09-30T15:34:52+00:00

Source: https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/1977968 MR: 122140 Type: Security Fix Disposition: Backport from https://launchpad.net/ubuntu/+source/bluez/5.53-0ubuntu3.6 ChangeID: b989c7670a9b2bd1d11221e981eab0d162f3271c Description: CVE-2022-39176 bluez: BlueZ allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len. Affects "bluez < 5.59" (From OE-Core rev: 3750b576035d87633c69c0a5fc6de4854179f9b0) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

linux-firmware: package new Qualcomm firmware

2022-09-30T15:34:52+00:00

Add packages for the new Qualcomm firmware released for Lenovo X13s laptop. The INSANE_SKIP:${PN} has to be provided to silent following warnings: WARNING: File '/lib/firmware/qcom/sc8280xp/LENOVO/21BX/qcadsp8280.mbn' from linux-firmware was already stripped, this will prevent future debugging! WARNING: File '/lib/firmware/qcom/sc8280xp/LENOVO/21BX/qcdxkmsuc8280.mbn' from linux-firmware was already stripped, this will prevent future debugging! WARNING: File '/lib/firmware/qcom/sc8280xp/LENOVO/21BX/qccdsp8280.mbn' from linux-firmware was already stripped, this will prevent future debugging! WARNING: File '/lib/firmware/qcom/sc8280xp/LENOVO/21BX/qcslpi8280.mbn' from linux-firmware was already stripped, this will prevent future debugging! (From OE-Core rev: 6227efbf03d2e7ca773ab29177705203f2550722) Signed-off-by: Dmitry Baryshkov Signed-off-by: Richard Purdie (cherry picked from commit af9924a3da0569e90c2d3abe030584456e66229b) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

linux-firmware: package new Qualcomm firmware

2022-09-30T15:34:52+00:00

Create separate packages with firmware files for APQ8096 SoC and for Adreno 2xx/4xx. Include A330 firmware into the 3xx package. (From OE-Core rev: 705de0a585b9e6343075eb6af41b8f8972ee327d) Signed-off-by: Dmitry Baryshkov Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 1a0cb8f9131d1f238dc150e583a7ff816645765f) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

linux-firmware: upgrade 20220708 -> 20220913

2022-09-30T15:34:52+00:00

License-Update: additional files (From OE-Core rev: a8efbea09f851e9ef72a1ec387077d9eda5335c6) Signed-off-by: Dmitry Baryshkov Signed-off-by: Richard Purdie (cherry picked from commit 68ce822b765a7b67f8cc8590688860cc2530cf04) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie