diff options
author | Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> | 2025-07-24 00:56:27 -0700 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2025-07-30 07:47:48 -0700 |
commit | fe4b8e0b69865abca563e90d7f3e0d39b1746a5f (patch) | |
tree | f3659fc559bf02626fc1be043d12fc7bb8d339a8 | |
parent | 7103a733a185d9a23aceda183fd8b50421631ac7 (diff) | |
download | poky-fe4b8e0b69865abca563e90d7f3e0d39b1746a5f.tar.gz |
glibc: stable 2.35 branch updates
Below commits on glibc-2.35 stable branch are updated.
git log --oneline d2febe7c407665c18cfea1930c65f41899ab3aa3..80401002011f470d9c6eb604bf734715e9b3a8c2
8040100201 Fix error reporting (false negatives) in SGID tests
c6ec750be5 support: Pick group in support_capture_subprogram_self_sgid if UID == 0
c9e44b6467 support: Don't fail on fchown when spawning sgid processes
621c65ccf1 elf: Ignore LD_LIBRARY_PATH and debug env var for setuid for static
c7ff2bc297 Revert "elf: Ignore LD_LIBRARY_PATH and debug env var for setuid for static"
8624f6431b elf: Fix subprocess status handling for tst-dlopen-sgid (bug 32987)
ed10034f00 elf: Test case for bug 32976 (CVE-2025-4802)
08aea7712d support: Add support_record_failure_barrier
901e24b128 support: Use const char * argument in support_capture_subprogram_self_sgid
bff3b0f16c elf: Ignore LD_LIBRARY_PATH and debug env var for setuid for static
Dropped :
0025-CVE-2025-4802.patch
ed10034f00 elf: Test case for bug 32976 (CVE-2025-4802)
Test results:
Before after diff
PASS 4833 4839 +6
XPASS 6 6 0
FAIL 133 130 -3
XFAIL 16 16 0
UNSUPPORTED 200 197 -3
Following commits improved test results:
8040100201 Fix error reporting (false negatives) in SGID tests
Improved SGID test handling by unifying error reporting and using secure temporary directories.
Replaced non-standard exit codes and fixed premature exits to avoid masking failures.
These changes reduced false negatives, increasing overall test pass rates.
8624f6431b elf: Fix subprocess status handling for tst-dlopen-sgid (bug 32987)
Fixed tst-dlopen-sgid false positives by correctly handling subprocess exit status (bug 32987).
Ensured test fails on abnormal or non-zero child exits.
This commit restores reliability in SGID testing and is the first step toward centralized SGID test error handling.
UNSUPPORTED tests changes
-UNSUPPORTED: elf/tst-env-setuid
-UNSUPPORTED: elf/tst-env-setuid-tunables
-UNSUPPORTED: stdlib/tst-secure-getenv
FAILed tests changes
-FAIL: elf/tst-dlopen-sgid
-FAIL: misc/tst-error1
-FAIL: resolv/tst-resolv-aliases
PASSed tests changes
+PASS: elf/tst-env-setuid
+PASS: elf/tst-env-setuid-tunables
+PASS: stdlib/tst-secure-getenv
+PASS: elf/tst-dlopen-sgid
+PASS: misc/tst-error1
+PASS: resolv/tst-resolv-aliases
(From OE-Core rev: 2ea1d2d9bc6d173a8a586542d47a7f8a443d24c1)
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
-rw-r--r-- | meta/recipes-core/glibc/glibc-version.inc | 2 | ||||
-rw-r--r-- | meta/recipes-core/glibc/glibc/0025-CVE-2025-4802.patch | 3 | ||||
-rw-r--r-- | meta/recipes-core/glibc/glibc_2.35.bb | 2 |
3 files changed, 4 insertions, 3 deletions
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc index 34b199c02b..b269518af4 100644 --- a/meta/recipes-core/glibc/glibc-version.inc +++ b/meta/recipes-core/glibc/glibc-version.inc | |||
@@ -1,6 +1,6 @@ | |||
1 | SRCBRANCH ?= "release/2.35/master" | 1 | SRCBRANCH ?= "release/2.35/master" |
2 | PV = "2.35" | 2 | PV = "2.35" |
3 | SRCREV_glibc ?= "d2febe7c407665c18cfea1930c65f41899ab3aa3" | 3 | SRCREV_glibc ?= "80401002011f470d9c6eb604bf734715e9b3a8c2" |
4 | SRCREV_localedef ?= "794da69788cbf9bf57b59a852f9f11307663fa87" | 4 | SRCREV_localedef ?= "794da69788cbf9bf57b59a852f9f11307663fa87" |
5 | 5 | ||
6 | GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git" | 6 | GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git" |
diff --git a/meta/recipes-core/glibc/glibc/0025-CVE-2025-4802.patch b/meta/recipes-core/glibc/glibc/0025-CVE-2025-4802.patch index 0298f5a865..a1197c0318 100644 --- a/meta/recipes-core/glibc/glibc/0025-CVE-2025-4802.patch +++ b/meta/recipes-core/glibc/glibc/0025-CVE-2025-4802.patch | |||
@@ -81,7 +81,7 @@ index 09079c12..c2baed69 100644 | |||
81 | - NULL, NULL); | 81 | - NULL, NULL); |
82 | - | 82 | - |
83 | - /* Remember the last search directory added at startup. */ | 83 | - /* Remember the last search directory added at startup. */ |
84 | - _dl_init_all_dirs = GL(dl_all_dirs); | 84 | _dl_verbose = *(getenv ("LD_WARN") ?: "") == '\0' ? 0 : 1;- _dl_init_all_dirs = GL(dl_all_dirs); |
85 | - | 85 | - |
86 | - _dl_lazy = *(getenv ("LD_BIND_NOW") ?: "") == '\0'; | 86 | - _dl_lazy = *(getenv ("LD_BIND_NOW") ?: "") == '\0'; |
87 | - | 87 | - |
@@ -97,6 +97,7 @@ index 09079c12..c2baed69 100644 | |||
97 | if (__libc_enable_secure) | 97 | if (__libc_enable_secure) |
98 | { | 98 | { |
99 | static const char unsecure_envvars[] = | 99 | static const char unsecure_envvars[] = |
100 | setup_vdso_pointers (); | ||
100 | @@ -324,6 +301,29 @@ _dl_non_dynamic_init (void) | 101 | @@ -324,6 +301,29 @@ _dl_non_dynamic_init (void) |
101 | #endif | 102 | #endif |
102 | } | 103 | } |
diff --git a/meta/recipes-core/glibc/glibc_2.35.bb b/meta/recipes-core/glibc/glibc_2.35.bb index 3023e9c1ed..df5f14984a 100644 --- a/meta/recipes-core/glibc/glibc_2.35.bb +++ b/meta/recipes-core/glibc/glibc_2.35.bb | |||
@@ -27,6 +27,7 @@ CVE_CHECK_IGNORE += "CVE-2023-4527" | |||
27 | CVE_CHECK_IGNORE += " \ | 27 | CVE_CHECK_IGNORE += " \ |
28 | CVE-2023-0687 CVE-2023-4813 CVE-2023-4806 CVE-2023-4911 CVE-2023-5156 \ | 28 | CVE-2023-0687 CVE-2023-4813 CVE-2023-4806 CVE-2023-4911 CVE-2023-5156 \ |
29 | CVE-2024-2961 CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602 \ | 29 | CVE-2024-2961 CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602 \ |
30 | CVE-2025-4802 \ | ||
30 | " | 31 | " |
31 | 32 | ||
32 | DEPENDS += "gperf-native bison-native" | 33 | DEPENDS += "gperf-native bison-native" |
@@ -61,7 +62,6 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ | |||
61 | file://0022-sysdeps-gnu-configure.ac-Set-libc_cv_rootsbindir-onl.patch \ | 62 | file://0022-sysdeps-gnu-configure.ac-Set-libc_cv_rootsbindir-onl.patch \ |
62 | file://0023-timezone-Make-shell-interpreter-overridable-in-tzsel.patch \ | 63 | file://0023-timezone-Make-shell-interpreter-overridable-in-tzsel.patch \ |
63 | file://0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch \ | 64 | file://0024-fix-create-thread-failed-in-unprivileged-process-BZ-.patch \ |
64 | file://0025-CVE-2025-4802.patch \ | ||
65 | file://0026-PR25847-1.patch \ | 65 | file://0026-PR25847-1.patch \ |
66 | file://0026-PR25847-2.patch \ | 66 | file://0026-PR25847-2.patch \ |
67 | file://0026-PR25847-3.patch \ | 67 | file://0026-PR25847-3.patch \ |