* [OE-core][scarthgap 00/10] Patch review
@ 2024-10-07 1:54 Steve Sakoman
2024-10-07 1:54 ` [OE-core][scarthgap 01/10] gnupg: Document CVE-2022-3219 and mark wontfix Steve Sakoman
` (10 more replies)
0 siblings, 11 replies; 19+ messages in thread
From: Steve Sakoman @ 2024-10-07 1:54 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Tuesday, October 8
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7374
The following changes since commit 3d894863f442188bad446095bd7fdd82665bb54b:
makedevs: Fix issue when rootdir of / is given (2024-09-28 05:21:51 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Deepesh Varatharajan (1):
glibc: stable 2.39 branch updates.
Hitendra Prajapati (1):
webkitgtk: upgrade 2.44.1 -> 2.44.3
Khem Raj (2):
gnupg: Document CVE-2022-3219 and mark wontfix
openssh: Mark CVE-2023-51767 as wont-fix
Martin Jansa (2):
populate_sdk_base: inherit nopackages
meta-world-pkgdata: Inherit nopackages
Peter Marko (3):
wpa-supplicant: Ignore CVE-2024-5290
wpa-supplicant: Patch CVE-2024-3596
wpa-supplicant: Patch security advisory 2024-2
Wang Mingyu (1):
cryptodev: upgrade 1.13 -> 1.14
meta/classes-recipe/populate_sdk_base.bbclass | 2 +-
.../openssh/openssh_9.6p1.bb | 1 +
...valid-Rejected-Groups-element-length.patch | 52 ++++++
...valid-Rejected-Groups-element-length.patch | 50 ++++++
...id-Rejected-Groups-element-in-the-pa.patch | 38 ++++
.../wpa-supplicant/CVE-2024-3596_00.patch | 82 +++++++++
.../wpa-supplicant/CVE-2024-3596_01.patch | 165 ++++++++++++++++++
.../wpa-supplicant/CVE-2024-3596_02.patch | 62 +++++++
.../wpa-supplicant/CVE-2024-3596_03.patch | 37 ++++
.../wpa-supplicant/CVE-2024-3596_04.patch | 52 ++++++
.../wpa-supplicant/CVE-2024-3596_05.patch | 51 ++++++
.../wpa-supplicant/CVE-2024-3596_06.patch | 46 +++++
.../wpa-supplicant/CVE-2024-3596_07.patch | 67 +++++++
.../wpa-supplicant/CVE-2024-3596_08.patch | 47 +++++
.../wpa-supplicant/wpa-supplicant_2.10.bb | 14 ++
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/meta/meta-world-pkgdata.bb | 1 +
...-linux_1.13.bb => cryptodev-linux_1.14.bb} | 0
...odule_1.13.bb => cryptodev-module_1.14.bb} | 3 -
...-tests_1.13.bb => cryptodev-tests_1.14.bb} | 4 -
meta/recipes-kernel/cryptodev/cryptodev.inc | 4 +-
...ng-header-file-provided-by-another-p.patch | 25 ---
...001-tests-Makefile-do-not-use-Werror.patch | 25 ---
...able-to-control-macro-__PAS_ALWAYS_I.patch | 6 +-
...spection.cmake-prefix-variables-obta.patch | 2 +-
...fic-declarations-in-FELighting.h-unn.patch | 44 -----
...icDowncast-adoption-in-platform-code.patch | 65 -------
...d5e22213fdaca2a29ec3400c927d710a37a8.patch | 2 +-
.../webkit/webkitgtk/no-musttail-arm.patch | 6 +-
.../webkit/webkitgtk/reproducibility.patch | 2 +-
.../webkit/webkitgtk/t6-not-declared.patch | 12 +-
...ebkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} | 6 +-
meta/recipes-support/gnupg/gnupg_2.4.4.bb | 1 +
33 files changed, 786 insertions(+), 190 deletions(-)
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch
rename meta/recipes-kernel/cryptodev/{cryptodev-linux_1.13.bb => cryptodev-linux_1.14.bb} (100%)
rename meta/recipes-kernel/cryptodev/{cryptodev-module_1.13.bb => cryptodev-module_1.14.bb} (74%)
rename meta/recipes-kernel/cryptodev/{cryptodev-tests_1.13.bb => cryptodev-tests_1.14.bb} (74%)
delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-Disable-installing-header-file-provided-by-another-p.patch
delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-tests-Makefile-do-not-use-Werror.patch
delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch
delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0002-More-dynamicDowncast-adoption-in-platform-code.patch
rename meta/recipes-sato/webkit/{webkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} (96%)
--
2.34.1
^ permalink raw reply [flat|nested] 19+ messages in thread* [OE-core][scarthgap 01/10] gnupg: Document CVE-2022-3219 and mark wontfix 2024-10-07 1:54 [OE-core][scarthgap 00/10] Patch review Steve Sakoman @ 2024-10-07 1:54 ` Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 02/10] openssh: Mark CVE-2023-51767 as wont-fix Steve Sakoman ` (9 subsequent siblings) 10 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2024-10-07 1:54 UTC (permalink / raw) To: openembedded-core From: Khem Raj <raj.khem@gmail.com> (From OE-Core rev: f10f9c3a8d2c17d5a6c3f0b00749e5b34a66e090) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/recipes-support/gnupg/gnupg_2.4.4.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-support/gnupg/gnupg_2.4.4.bb b/meta/recipes-support/gnupg/gnupg_2.4.4.bb index fff7d8c6da..ec75960235 100644 --- a/meta/recipes-support/gnupg/gnupg_2.4.4.bb +++ b/meta/recipes-support/gnupg/gnupg_2.4.4.bb @@ -88,3 +88,4 @@ BBCLASSEXTEND = "native nativesdk" lcl_maybe_fortify:mipsarch = "" +CVE_STATUS[CVE-2022-3219] = "upstream-wontfix: Upstream doesn't seem to be keen on merging the proposed commit - https://dev.gnupg.org/T5993" -- 2.34.1 ^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 02/10] openssh: Mark CVE-2023-51767 as wont-fix 2024-10-07 1:54 [OE-core][scarthgap 00/10] Patch review Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 01/10] gnupg: Document CVE-2022-3219 and mark wontfix Steve Sakoman @ 2024-10-07 1:54 ` Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 03/10] wpa-supplicant: Ignore CVE-2024-5290 Steve Sakoman ` (8 subsequent siblings) 10 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2024-10-07 1:54 UTC (permalink / raw) To: openembedded-core From: Khem Raj <raj.khem@gmail.com> (From OE-Core rev: 1b4bada6c003ef743df09283e45953e6d9ea4c5a) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/recipes-connectivity/openssh/openssh_9.6p1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index 3c507cf911..a8ba67e360 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -40,6 +40,7 @@ CVE_STATUS[CVE-2014-9278] = "not-applicable-platform: This CVE is specific to Op Red Hat Enterprise Linux 7 and when running in a Kerberos environment" CVE_STATUS[CVE-2008-3844] = "not-applicable-platform: Only applies to some distributed RHEL binaries." +CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1." PAM_SRC_URI = "file://sshd" -- 2.34.1 ^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 03/10] wpa-supplicant: Ignore CVE-2024-5290 2024-10-07 1:54 [OE-core][scarthgap 00/10] Patch review Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 01/10] gnupg: Document CVE-2022-3219 and mark wontfix Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 02/10] openssh: Mark CVE-2023-51767 as wont-fix Steve Sakoman @ 2024-10-07 1:54 ` Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 04/10] wpa-supplicant: Patch CVE-2024-3596 Steve Sakoman ` (7 subsequent siblings) 10 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2024-10-07 1:54 UTC (permalink / raw) To: openembedded-core From: Peter Marko <peter.marko@siemens.com> NVD CVE report [1] links Ubuntu bug [2] which has a very good description/discussion about this issue. It applies only to distros patching wpa-supplicant to allow non-root users (e.g. via netdev group) to load modules. This is not the case of Yocto. Quote: So upstream isn't vulnerable as they only expose the dbus interface to root. Downstreams like Ubuntu and Chromium added a patch that grants access to the netdev group. The patch is the problem, not the upstream code IMHO. There is also a commit [3] associated with this CVE, however that only provides build-time configuration to limit paths which can be accessed but it acts only as a mitigation for distros which allow non-root users to load crafted modules. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-5290 [2] https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2067613 [3] https://w1.fi/cgit/hostap/commit/?id=c84388ee4c66bcd310db57489eac4a75fc600747 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb index 22028ce957..01dc72b385 100644 --- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb @@ -32,6 +32,8 @@ PACKAGECONFIG[openssl] = ",,openssl" CVE_PRODUCT = "wpa_supplicant" +CVE_STATUS[CVE-2024-5290] = "not-applicable-platform: this only affects Ubuntu and other platforms patching wpa-supplicant" + EXTRA_OEMAKE = "'LIBDIR=${libdir}' 'INCDIR=${includedir}' 'BINDIR=${sbindir}'" do_configure () { -- 2.34.1 ^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 04/10] wpa-supplicant: Patch CVE-2024-3596 2024-10-07 1:54 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (2 preceding siblings ...) 2024-10-07 1:54 ` [OE-core][scarthgap 03/10] wpa-supplicant: Ignore CVE-2024-5290 Steve Sakoman @ 2024-10-07 1:54 ` Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 05/10] wpa-supplicant: Patch security advisory 2024-2 Steve Sakoman ` (6 subsequent siblings) 10 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2024-10-07 1:54 UTC (permalink / raw) To: openembedded-core From: Peter Marko <peter.marko@siemens.com> Picked patches according to http://w1.fi/security/2024-1/hostapd-and-radius-protocol-forgery-attacks.txt First patch is style commit picked to have a clean cherry-pick of all mentioned commits without any conflict. Patch CVE-2024-3596_07.patch has hostapd code removed as it is not present in wpa-supplicant download tarball. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- .../wpa-supplicant/CVE-2024-3596_00.patch | 82 +++++++++ .../wpa-supplicant/CVE-2024-3596_01.patch | 165 ++++++++++++++++++ .../wpa-supplicant/CVE-2024-3596_02.patch | 62 +++++++ .../wpa-supplicant/CVE-2024-3596_03.patch | 37 ++++ .../wpa-supplicant/CVE-2024-3596_04.patch | 52 ++++++ .../wpa-supplicant/CVE-2024-3596_05.patch | 51 ++++++ .../wpa-supplicant/CVE-2024-3596_06.patch | 46 +++++ .../wpa-supplicant/CVE-2024-3596_07.patch | 67 +++++++ .../wpa-supplicant/CVE-2024-3596_08.patch | 47 +++++ .../wpa-supplicant/wpa-supplicant_2.10.bb | 9 + 10 files changed, 618 insertions(+) create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch new file mode 100644 index 0000000000..7a8197d2b4 --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch @@ -0,0 +1,82 @@ +From 945acf3ef06a6c312927da4fa055693dbac432d1 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Sat, 2 Apr 2022 16:28:12 +0300 +Subject: [PATCH 1/9] ieee802_11_auth: Coding style cleanup - no string + constant splitting + +Signed-off-by: Jouni Malinen <j@w1.fi> + +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=945acf3ef06a6c312927da4fa055693dbac432d1] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + src/ap/ieee802_11_auth.c | 27 +++++++++++++++------------ + 1 file changed, 15 insertions(+), 12 deletions(-) + +diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c +index 783ee6dea..47cc625be 100644 +--- a/src/ap/ieee802_11_auth.c ++++ b/src/ap/ieee802_11_auth.c +@@ -267,16 +267,16 @@ int hostapd_allowed_address(struct hostapd_data *hapd, const u8 *addr, + os_get_reltime(&query->timestamp); + os_memcpy(query->addr, addr, ETH_ALEN); + if (hostapd_radius_acl_query(hapd, addr, query)) { +- wpa_printf(MSG_DEBUG, "Failed to send Access-Request " +- "for ACL query."); ++ wpa_printf(MSG_DEBUG, ++ "Failed to send Access-Request for ACL query."); + hostapd_acl_query_free(query); + return HOSTAPD_ACL_REJECT; + } + + query->auth_msg = os_memdup(msg, len); + if (query->auth_msg == NULL) { +- wpa_printf(MSG_ERROR, "Failed to allocate memory for " +- "auth frame."); ++ wpa_printf(MSG_ERROR, ++ "Failed to allocate memory for auth frame."); + hostapd_acl_query_free(query); + return HOSTAPD_ACL_REJECT; + } +@@ -467,19 +467,21 @@ hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req, + if (query == NULL) + return RADIUS_RX_UNKNOWN; + +- wpa_printf(MSG_DEBUG, "Found matching Access-Request for RADIUS " +- "message (id=%d)", query->radius_id); ++ wpa_printf(MSG_DEBUG, ++ "Found matching Access-Request for RADIUS message (id=%d)", ++ query->radius_id); + + if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) { +- wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have " +- "correct authenticator - dropped\n"); ++ wpa_printf(MSG_INFO, ++ "Incoming RADIUS packet did not have correct authenticator - dropped"); + return RADIUS_RX_INVALID_AUTHENTICATOR; + } + + if (hdr->code != RADIUS_CODE_ACCESS_ACCEPT && + hdr->code != RADIUS_CODE_ACCESS_REJECT) { +- wpa_printf(MSG_DEBUG, "Unknown RADIUS message code %d to ACL " +- "query", hdr->code); ++ wpa_printf(MSG_DEBUG, ++ "Unknown RADIUS message code %d to ACL query", ++ hdr->code); + return RADIUS_RX_UNKNOWN; + } + +@@ -506,8 +508,9 @@ hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req, + msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL, + &info->acct_interim_interval) == 0 && + info->acct_interim_interval < 60) { +- wpa_printf(MSG_DEBUG, "Ignored too small " +- "Acct-Interim-Interval %d for STA " MACSTR, ++ wpa_printf(MSG_DEBUG, ++ "Ignored too small Acct-Interim-Interval %d for STA " ++ MACSTR, + info->acct_interim_interval, + MAC2STR(query->addr)); + info->acct_interim_interval = 0; +-- +2.30.2 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch new file mode 100644 index 0000000000..dab2eedd6a --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch @@ -0,0 +1,165 @@ +From adac846bd0e258a0aa50750bbd2b411fa0085c46 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Sat, 16 Mar 2024 11:11:44 +0200 +Subject: [PATCH 2/9] RADIUS: Allow Message-Authenticator attribute as the + first attribute + +If a Message-Authenticator attribute was already added to a RADIUS +message, use that attribute instead of adding a new one when finishing +message building. This allows the Message-Authenticator attribute to be +placed as the first attribute in the message. + +Signed-off-by: Jouni Malinen <j@w1.fi> + +CVE: CVE-2024-3596 +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=adac846bd0e258a0aa50750bbd2b411fa0085c46] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + src/radius/radius.c | 85 ++++++++++++++++++++++++++++----------------- + src/radius/radius.h | 1 + + 2 files changed, 54 insertions(+), 32 deletions(-) + +diff --git a/src/radius/radius.c b/src/radius/radius.c +index be16e27b9..2d2e00b5c 100644 +--- a/src/radius/radius.c ++++ b/src/radius/radius.c +@@ -364,25 +364,54 @@ void radius_msg_dump(struct radius_msg *msg) + } + + ++u8 * radius_msg_add_msg_auth(struct radius_msg *msg) ++{ ++ u8 auth[MD5_MAC_LEN]; ++ struct radius_attr_hdr *attr; ++ ++ os_memset(auth, 0, MD5_MAC_LEN); ++ attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, ++ auth, MD5_MAC_LEN); ++ if (!attr) { ++ wpa_printf(MSG_ERROR, ++ "WARNING: Could not add Message-Authenticator"); ++ return NULL; ++ } ++ ++ return (u8 *) (attr + 1); ++} ++ ++ ++static u8 * radius_msg_auth_pos(struct radius_msg *msg) ++{ ++ u8 *pos; ++ size_t alen; ++ ++ if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, ++ &pos, &alen, NULL) == 0 && ++ alen == MD5_MAC_LEN) { ++ /* Use already added Message-Authenticator attribute */ ++ return pos; ++ } ++ ++ /* Add a Message-Authenticator attribute */ ++ return radius_msg_add_msg_auth(msg); ++} ++ ++ + int radius_msg_finish(struct radius_msg *msg, const u8 *secret, + size_t secret_len) + { + if (secret) { +- u8 auth[MD5_MAC_LEN]; +- struct radius_attr_hdr *attr; ++ u8 *pos; + +- os_memset(auth, 0, MD5_MAC_LEN); +- attr = radius_msg_add_attr(msg, +- RADIUS_ATTR_MESSAGE_AUTHENTICATOR, +- auth, MD5_MAC_LEN); +- if (attr == NULL) { +- wpa_printf(MSG_WARNING, "RADIUS: Could not add " +- "Message-Authenticator"); ++ pos = radius_msg_auth_pos(msg); ++ if (!pos) + return -1; +- } + msg->hdr->length = host_to_be16(wpabuf_len(msg->buf)); +- hmac_md5(secret, secret_len, wpabuf_head(msg->buf), +- wpabuf_len(msg->buf), (u8 *) (attr + 1)); ++ if (hmac_md5(secret, secret_len, wpabuf_head(msg->buf), ++ wpabuf_len(msg->buf), pos) < 0) ++ return -1; + } else + msg->hdr->length = host_to_be16(wpabuf_len(msg->buf)); + +@@ -398,23 +427,19 @@ int radius_msg_finish(struct radius_msg *msg, const u8 *secret, + int radius_msg_finish_srv(struct radius_msg *msg, const u8 *secret, + size_t secret_len, const u8 *req_authenticator) + { +- u8 auth[MD5_MAC_LEN]; +- struct radius_attr_hdr *attr; + const u8 *addr[4]; + size_t len[4]; ++ u8 *pos; + +- os_memset(auth, 0, MD5_MAC_LEN); +- attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, +- auth, MD5_MAC_LEN); +- if (attr == NULL) { +- wpa_printf(MSG_ERROR, "WARNING: Could not add Message-Authenticator"); ++ pos = radius_msg_auth_pos(msg); ++ if (!pos) + return -1; +- } + msg->hdr->length = host_to_be16(wpabuf_len(msg->buf)); + os_memcpy(msg->hdr->authenticator, req_authenticator, + sizeof(msg->hdr->authenticator)); +- hmac_md5(secret, secret_len, wpabuf_head(msg->buf), +- wpabuf_len(msg->buf), (u8 *) (attr + 1)); ++ if (hmac_md5(secret, secret_len, wpabuf_head(msg->buf), ++ wpabuf_len(msg->buf), pos) < 0) ++ return -1; + + /* ResponseAuth = MD5(Code+ID+Length+RequestAuth+Attributes+Secret) */ + addr[0] = (u8 *) msg->hdr; +@@ -442,21 +467,17 @@ int radius_msg_finish_das_resp(struct radius_msg *msg, const u8 *secret, + { + const u8 *addr[2]; + size_t len[2]; +- u8 auth[MD5_MAC_LEN]; +- struct radius_attr_hdr *attr; ++ u8 *pos; + +- os_memset(auth, 0, MD5_MAC_LEN); +- attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, +- auth, MD5_MAC_LEN); +- if (attr == NULL) { +- wpa_printf(MSG_WARNING, "Could not add Message-Authenticator"); ++ pos = radius_msg_auth_pos(msg); ++ if (!pos) + return -1; +- } + + msg->hdr->length = host_to_be16(wpabuf_len(msg->buf)); + os_memcpy(msg->hdr->authenticator, req_hdr->authenticator, 16); +- hmac_md5(secret, secret_len, wpabuf_head(msg->buf), +- wpabuf_len(msg->buf), (u8 *) (attr + 1)); ++ if (hmac_md5(secret, secret_len, wpabuf_head(msg->buf), ++ wpabuf_len(msg->buf), pos) < 0) ++ return -1; + + /* ResponseAuth = MD5(Code+ID+Length+RequestAuth+Attributes+Secret) */ + addr[0] = wpabuf_head_u8(msg->buf); +diff --git a/src/radius/radius.h b/src/radius/radius.h +index fb8148180..6b9dfbca2 100644 +--- a/src/radius/radius.h ++++ b/src/radius/radius.h +@@ -240,6 +240,7 @@ struct wpabuf * radius_msg_get_buf(struct radius_msg *msg); + struct radius_msg * radius_msg_new(u8 code, u8 identifier); + void radius_msg_free(struct radius_msg *msg); + void radius_msg_dump(struct radius_msg *msg); ++u8 * radius_msg_add_msg_auth(struct radius_msg *msg); + int radius_msg_finish(struct radius_msg *msg, const u8 *secret, + size_t secret_len); + int radius_msg_finish_srv(struct radius_msg *msg, const u8 *secret, +-- +2.30.2 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch new file mode 100644 index 0000000000..02e35bd6de --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch @@ -0,0 +1,62 @@ +From 54abb0d3cf35894e7d86e3f7555e95b106306803 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Sat, 16 Mar 2024 11:13:32 +0200 +Subject: [PATCH 3/9] RADIUS server: Place Message-Authenticator attribute as + the first one + +Move the Message-Authenticator attribute to be the first attribute in +the RADIUS messages. This mitigates certain MD5 attacks against +RADIUS/UDP. + +Signed-off-by: Jouni Malinen <j@w1.fi> + +CVE: CVE-2024-3596 +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=54abb0d3cf35894e7d86e3f7555e95b106306803] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + src/radius/radius_server.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/src/radius/radius_server.c b/src/radius/radius_server.c +index e02c21540..fa3691548 100644 +--- a/src/radius/radius_server.c ++++ b/src/radius/radius_server.c +@@ -920,6 +920,11 @@ radius_server_encapsulate_eap(struct radius_server_data *data, + return NULL; + } + ++ if (!radius_msg_add_msg_auth(msg)) { ++ radius_msg_free(msg); ++ return NULL; ++ } ++ + sess_id = htonl(sess->sess_id); + if (code == RADIUS_CODE_ACCESS_CHALLENGE && + !radius_msg_add_attr(msg, RADIUS_ATTR_STATE, +@@ -1204,6 +1209,11 @@ radius_server_macacl(struct radius_server_data *data, + return NULL; + } + ++ if (!radius_msg_add_msg_auth(msg)) { ++ radius_msg_free(msg); ++ return NULL; ++ } ++ + if (radius_msg_copy_attr(msg, request, RADIUS_ATTR_PROXY_STATE) < 0) { + RADIUS_DEBUG("Failed to copy Proxy-State attribute(s)"); + radius_msg_free(msg); +@@ -1253,6 +1263,11 @@ static int radius_server_reject(struct radius_server_data *data, + return -1; + } + ++ if (!radius_msg_add_msg_auth(msg)) { ++ radius_msg_free(msg); ++ return -1; ++ } ++ + os_memset(&eapfail, 0, sizeof(eapfail)); + eapfail.code = EAP_CODE_FAILURE; + eapfail.identifier = 0; +-- +2.30.2 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch new file mode 100644 index 0000000000..c4aa40c811 --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch @@ -0,0 +1,37 @@ +From 689a248260c9708e6c92cd8635382725a29e34ca Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Sat, 16 Mar 2024 11:16:12 +0200 +Subject: [PATCH 4/9] eapol_test: Move Message-Authenticator attribute to be + the first one + +Even if this is not strictly speaking necessary for mitigating certain +RADIUS protocol attacks, be consistent with the RADIUS server behavior +and move the Message-Authenticator attribute to be the first attribute +in the message from RADIUS client. + +Signed-off-by: Jouni Malinen <j@w1.fi> + +CVE: CVE-2024-3596 +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=689a248260c9708e6c92cd8635382725a29e34ca] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + wpa_supplicant/eapol_test.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/wpa_supplicant/eapol_test.c b/wpa_supplicant/eapol_test.c +index e256ac50e..57082e4b8 100644 +--- a/wpa_supplicant/eapol_test.c ++++ b/wpa_supplicant/eapol_test.c +@@ -194,6 +194,9 @@ static void ieee802_1x_encapsulate_radius(struct eapol_test_data *e, + return; + } + ++ if (!radius_msg_add_msg_auth(msg)) ++ goto fail; ++ + radius_msg_make_authenticator(msg); + + hdr = (const struct eap_hdr *) eap; +-- +2.30.2 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch new file mode 100644 index 0000000000..ce499ce8b6 --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch @@ -0,0 +1,52 @@ +From 37fe8e48ab44d44fe3cf5dd8f52cb0a10be0cd17 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Sat, 16 Mar 2024 11:22:43 +0200 +Subject: [PATCH 5/9] hostapd: Move Message-Authenticator attribute to be the + first one in req + +Even if this is not strictly speaking necessary for mitigating certain +RADIUS protocol attacks, be consistent with the RADIUS server behavior +and move the Message-Authenticator attribute to be the first attribute +in the message from RADIUS client in hostapd. + +Signed-off-by: Jouni Malinen <j@w1.fi> + +CVE: CVE-2024-3596 +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=37fe8e48ab44d44fe3cf5dd8f52cb0a10be0cd17] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + src/ap/ieee802_11_auth.c | 3 +++ + src/ap/ieee802_1x.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c +index 47cc625be..2a950cf7f 100644 +--- a/src/ap/ieee802_11_auth.c ++++ b/src/ap/ieee802_11_auth.c +@@ -119,6 +119,9 @@ static int hostapd_radius_acl_query(struct hostapd_data *hapd, const u8 *addr, + goto fail; + } + ++ if (!radius_msg_add_msg_auth(msg)) ++ goto fail; ++ + os_snprintf(buf, sizeof(buf), RADIUS_ADDR_FORMAT, MAC2STR(addr)); + if (!radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, (u8 *) buf, + os_strlen(buf))) { +diff --git a/src/ap/ieee802_1x.c b/src/ap/ieee802_1x.c +index 753c88335..89e3dd30e 100644 +--- a/src/ap/ieee802_1x.c ++++ b/src/ap/ieee802_1x.c +@@ -702,6 +702,9 @@ void ieee802_1x_encapsulate_radius(struct hostapd_data *hapd, + goto fail; + } + ++ if (!radius_msg_add_msg_auth(msg)) ++ goto fail; ++ + if (sm->identity && + !radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, + sm->identity, sm->identity_len)) { +-- +2.30.2 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch new file mode 100644 index 0000000000..44113afd4a --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch @@ -0,0 +1,51 @@ +From f54157077f799d84ce26bed6ad6b01c4a16e31cf Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Sat, 16 Mar 2024 11:26:58 +0200 +Subject: [PATCH 6/9] RADIUS DAS: Move Message-Authenticator attribute to be + the first one + +Even if this might not be strictly speaking necessary for mitigating +certain RADIUS protocol attacks, be consistent with the RADIUS server +behavior and move the Message-Authenticator attribute to be the first +attribute in the RADIUS DAS responses from hostapd. + +Signed-off-by: Jouni Malinen <j@w1.fi> + +CVE: CVE-2024-3596 +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=f54157077f799d84ce26bed6ad6b01c4a16e31cf] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + src/radius/radius_das.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/src/radius/radius_das.c b/src/radius/radius_das.c +index aaa3fc267..8d7c9b4c4 100644 +--- a/src/radius/radius_das.c ++++ b/src/radius/radius_das.c +@@ -177,6 +177,11 @@ fail: + if (reply == NULL) + return NULL; + ++ if (!radius_msg_add_msg_auth(reply)) { ++ radius_msg_free(reply); ++ return NULL; ++ } ++ + if (error) { + if (!radius_msg_add_attr_int32(reply, RADIUS_ATTR_ERROR_CAUSE, + error)) { +@@ -368,6 +373,11 @@ fail: + if (!reply) + return NULL; + ++ if (!radius_msg_add_msg_auth(reply)) { ++ radius_msg_free(reply); ++ return NULL; ++ } ++ + if (error && + !radius_msg_add_attr_int32(reply, RADIUS_ATTR_ERROR_CAUSE, error)) { + radius_msg_free(reply); +-- +2.30.2 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch new file mode 100644 index 0000000000..9a284b5261 --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch @@ -0,0 +1,46 @@ +From 934b0c3a45ce0726560ccefbd992a9d385c36385 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Sat, 16 Mar 2024 11:31:37 +0200 +Subject: [PATCH 7/9] Require Message-Authenticator in Access-Reject even + without EAP-Message + +Do not allow the exception for missing Message-Authenticator in +Access-Reject without EAP-Message. While such exception is allowed in +RADIUS definition, there is no strong reason to maintain this since +Access-Reject is supposed to include EAP-Message and even if it doesn't, +discarding Access-Reject will result in the connection not completing. + +Signed-off-by: Jouni Malinen <j@w1.fi> + +CVE: CVE-2024-3596 +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=934b0c3a45ce0726560ccefbd992a9d385c36385] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + src/ap/ieee802_1x.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +diff --git a/src/ap/ieee802_1x.c b/src/ap/ieee802_1x.c +index 89e3dd30e..6e7b75128 100644 +--- a/src/ap/ieee802_1x.c ++++ b/src/ap/ieee802_1x.c +@@ -1939,16 +1939,7 @@ ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req, + } + sta = sm->sta; + +- /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be +- * present when packet contains an EAP-Message attribute */ +- if (hdr->code == RADIUS_CODE_ACCESS_REJECT && +- radius_msg_get_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, NULL, +- 0) < 0 && +- radius_msg_get_attr(msg, RADIUS_ATTR_EAP_MESSAGE, NULL, 0) < 0) { +- wpa_printf(MSG_DEBUG, +- "Allowing RADIUS Access-Reject without Message-Authenticator since it does not include EAP-Message"); +- } else if (radius_msg_verify(msg, shared_secret, shared_secret_len, +- req, 1)) { ++ if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 1)) { + wpa_printf(MSG_INFO, + "Incoming RADIUS packet did not have correct Message-Authenticator - dropped"); + return RADIUS_RX_INVALID_AUTHENTICATOR; +-- +2.30.2 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch new file mode 100644 index 0000000000..177c6f81e6 --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch @@ -0,0 +1,67 @@ +From 58097123ec5ea6f8276b38cb9b07669ec368a6c1 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Sun, 17 Mar 2024 10:42:56 +0200 +Subject: [PATCH 8/9] RADIUS: Require Message-Authenticator attribute in MAC + ACL cases + +hostapd required Message-Authenticator attribute to be included in EAP +authentication cases, but that requirement was not in place for MAC ACL +cases. Start requiring Message-Authenticator attribute for MAC ACL by +default. Unlike the EAP case, this can still be disabled with +radius_require_message_authenticator=1 to maintain compatibility with +some RADIUS servers when used in a network where the connection to such +a server is secure. + +Signed-off-by: Jouni Malinen <j@w1.fi> + +CVE: CVE-2024-3596 +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=58097123ec5ea6f8276b38cb9b07669ec368a6c1] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + src/ap/ap_config.c | 1 + + src/ap/ap_config.h | 1 + + src/ap/ieee802_11_auth.c | 4 +++- + 5 files changed, 19 insertions(+), 1 deletion(-) + +diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c +index 86b6e097c..cf497a180 100644 +--- a/src/ap/ap_config.c ++++ b/src/ap/ap_config.c +@@ -120,6 +120,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss) + #endif /* CONFIG_IEEE80211R_AP */ + + bss->radius_das_time_window = 300; ++ bss->radius_require_message_authenticator = 1; + + bss->anti_clogging_threshold = 5; + bss->sae_sync = 5; +diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h +index 49cd3168a..22ad617f4 100644 +--- a/src/ap/ap_config.h ++++ b/src/ap/ap_config.h +@@ -302,6 +302,7 @@ struct hostapd_bss_config { + struct hostapd_ip_addr own_ip_addr; + char *nas_identifier; + struct hostapd_radius_servers *radius; ++ int radius_require_message_authenticator; + int acct_interim_interval; + int radius_request_cui; + struct hostapd_radius_attr *radius_auth_req_attr; +diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c +index 2a950cf7f..dab9bcde3 100644 +--- a/src/ap/ieee802_11_auth.c ++++ b/src/ap/ieee802_11_auth.c +@@ -474,7 +474,9 @@ hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req, + "Found matching Access-Request for RADIUS message (id=%d)", + query->radius_id); + +- if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) { ++ if (radius_msg_verify( ++ msg, shared_secret, shared_secret_len, req, ++ hapd->conf->radius_require_message_authenticator)) { + wpa_printf(MSG_INFO, + "Incoming RADIUS packet did not have correct authenticator - dropped"); + return RADIUS_RX_INVALID_AUTHENTICATOR; +-- +2.30.2 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch new file mode 100644 index 0000000000..e23d1e0047 --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch @@ -0,0 +1,47 @@ +From f302d9f9646704cce745734af21d540baa0da65f Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Sun, 17 Mar 2024 10:47:58 +0200 +Subject: [PATCH 9/9] RADIUS: Check Message-Authenticator if it is present even + if not required + +Always check the Message-Authenticator attribute in a received RADIUS +message if it is present. Previously, this would have been skipped if +the attribute was not required to be present. + +Signed-off-by: Jouni Malinen <j@w1.fi> + +CVE: CVE-2024-3596 +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=f302d9f9646704cce745734af21d540baa0da65f] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + src/radius/radius.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/src/radius/radius.c b/src/radius/radius.c +index 2d2e00b5c..a0e3ce399 100644 +--- a/src/radius/radius.c ++++ b/src/radius/radius.c +@@ -879,6 +879,20 @@ int radius_msg_verify(struct radius_msg *msg, const u8 *secret, + return 1; + } + ++ if (!auth) { ++ u8 *pos; ++ size_t alen; ++ ++ if (radius_msg_get_attr_ptr(msg, ++ RADIUS_ATTR_MESSAGE_AUTHENTICATOR, ++ &pos, &alen, NULL) == 0) { ++ /* Check the Message-Authenticator attribute since it ++ * was included even if we are configured to not ++ * require it. */ ++ auth = 1; ++ } ++ } ++ + if (auth && + radius_msg_verify_msg_auth(msg, secret, secret_len, + sent_msg->hdr->authenticator)) { +-- +2.30.2 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb index 01dc72b385..56c01ede54 100644 --- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb @@ -19,6 +19,15 @@ SRC_URI = "http://w1.fi/releases/wpa_supplicant-${PV}.tar.gz \ file://0002-Fix-removal-of-wpa_passphrase-on-make-clean.patch \ file://0001-Install-wpa_passphrase-when-not-disabled.patch \ file://0001-PEAP-client-Update-Phase-2-authentication-requiremen.patch \ + file://CVE-2024-3596_00.patch \ + file://CVE-2024-3596_01.patch \ + file://CVE-2024-3596_02.patch \ + file://CVE-2024-3596_03.patch \ + file://CVE-2024-3596_04.patch \ + file://CVE-2024-3596_05.patch \ + file://CVE-2024-3596_06.patch \ + file://CVE-2024-3596_07.patch \ + file://CVE-2024-3596_08.patch \ " SRC_URI[sha256sum] = "20df7ae5154b3830355f8ab4269123a87affdea59fe74fe9292a91d0d7e17b2f" -- 2.34.1 ^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 05/10] wpa-supplicant: Patch security advisory 2024-2 2024-10-07 1:54 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (3 preceding siblings ...) 2024-10-07 1:54 ` [OE-core][scarthgap 04/10] wpa-supplicant: Patch CVE-2024-3596 Steve Sakoman @ 2024-10-07 1:54 ` Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 06/10] glibc: stable 2.39 branch updates Steve Sakoman ` (5 subsequent siblings) 10 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2024-10-07 1:54 UTC (permalink / raw) To: openembedded-core From: Peter Marko <peter.marko@siemens.com> Pick patches according to http://w1.fi/security/2024-2/sae-h2h-and-incomplete-downgrade-protection-for-group-negotiation.txt SAE H2E and incomplete downgrade protection for group negotiation Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- ...valid-Rejected-Groups-element-length.patch | 52 +++++++++++++++++++ ...valid-Rejected-Groups-element-length.patch | 50 ++++++++++++++++++ ...id-Rejected-Groups-element-in-the-pa.patch | 38 ++++++++++++++ .../wpa-supplicant/wpa-supplicant_2.10.bb | 3 ++ 4 files changed, 143 insertions(+) create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch new file mode 100644 index 0000000000..5780f27f8b --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch @@ -0,0 +1,52 @@ +From 364c2da8741f0979dae497551e70b94c0e6c8636 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Sun, 7 Jul 2024 11:46:49 +0300 +Subject: [PATCH 1/3] SAE: Check for invalid Rejected Groups element length + explicitly + +Instead of practically ignoring an odd octet at the end of the element, +check for such invalid case explicitly. This is needed to avoid a +potential group downgrade attack. + +Signed-off-by: Jouni Malinen <j@w1.fi> + +CVE: CVE-2024-3596 +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=364c2da8741f0979dae497551e70b94c0e6c8636] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + src/ap/ieee802_11.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c +index db4104928..1a62e30cc 100644 +--- a/src/ap/ieee802_11.c ++++ b/src/ap/ieee802_11.c +@@ -1258,7 +1258,7 @@ static int check_sae_rejected_groups(struct hostapd_data *hapd, + struct sae_data *sae) + { + const struct wpabuf *groups; +- size_t i, count; ++ size_t i, count, len; + const u8 *pos; + + if (!sae->tmp) +@@ -1268,7 +1268,15 @@ static int check_sae_rejected_groups(struct hostapd_data *hapd, + return 0; + + pos = wpabuf_head(groups); +- count = wpabuf_len(groups) / 2; ++ len = wpabuf_len(groups); ++ if (len & 1) { ++ wpa_printf(MSG_DEBUG, ++ "SAE: Invalid length of the Rejected Groups element payload: %zu", ++ len); ++ return 1; ++ } ++ ++ count = len / 2; + for (i = 0; i < count; i++) { + int enabled; + u16 group; +-- +2.30.2 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch new file mode 100644 index 0000000000..3e96ae9e2e --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch @@ -0,0 +1,50 @@ +From 593a7c2f8c93edd6b552f2d42e28164464b4e6ff Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Tue, 9 Jul 2024 23:33:38 +0300 +Subject: [PATCH 2/3] SAE: Check for invalid Rejected Groups element length + explicitly on STA + +Instead of practically ignoring an odd octet at the end of the element, +check for such invalid case explicitly. This is needed to avoid a +potential group downgrade attack. + +Fixes: 444d76f74f65 ("SAE: Check that peer's rejected groups are not enabled") +Signed-off-by: Jouni Malinen <j@w1.fi> + +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=593a7c2f8c93edd6b552f2d42e28164464b4e6ff] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + wpa_supplicant/sme.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/wpa_supplicant/sme.c b/wpa_supplicant/sme.c +index 7f43216c6..c7289f6a8 100644 +--- a/wpa_supplicant/sme.c ++++ b/wpa_supplicant/sme.c +@@ -1222,14 +1222,21 @@ static int sme_sae_is_group_enabled(struct wpa_supplicant *wpa_s, int group) + static int sme_check_sae_rejected_groups(struct wpa_supplicant *wpa_s, + const struct wpabuf *groups) + { +- size_t i, count; ++ size_t i, count, len; + const u8 *pos; + + if (!groups) + return 0; + + pos = wpabuf_head(groups); +- count = wpabuf_len(groups) / 2; ++ len = wpabuf_len(groups); ++ if (len & 1) { ++ wpa_printf(MSG_DEBUG, ++ "SAE: Invalid length of the Rejected Groups element payload: %zu", ++ len); ++ return 1; ++ } ++ count = len / 2; + for (i = 0; i < count; i++) { + int enabled; + u16 group; +-- +2.30.2 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch new file mode 100644 index 0000000000..5e9e8bc01d --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch @@ -0,0 +1,38 @@ +From 9716bf1160beb677e965d9e6475d6c9e162e8374 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <j@w1.fi> +Date: Tue, 9 Jul 2024 23:34:34 +0300 +Subject: [PATCH 3/3] SAE: Reject invalid Rejected Groups element in the parser + +There is no need to depend on all uses (i.e., both hostapd and +wpa_supplicant) to verify that the length of the Rejected Groups field +in the Rejected Groups element is valid (i.e., a multiple of two octets) +since the common parser can reject the message when detecting this. + +Signed-off-by: Jouni Malinen <j@w1.fi> + +Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=9716bf1160beb677e965d9e6475d6c9e162e8374] +Signed-off-by: Peter Marko <peter.marko@siemens.com> +--- + src/common/sae.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/common/sae.c b/src/common/sae.c +index c0f154e91..620bdf753 100644 +--- a/src/common/sae.c ++++ b/src/common/sae.c +@@ -2076,6 +2076,12 @@ static int sae_parse_rejected_groups(struct sae_data *sae, + return WLAN_STATUS_UNSPECIFIED_FAILURE; + epos++; /* skip ext ID */ + len--; ++ if (len & 1) { ++ wpa_printf(MSG_DEBUG, ++ "SAE: Invalid length of the Rejected Groups element payload: %u", ++ len); ++ return WLAN_STATUS_UNSPECIFIED_FAILURE; ++ } + + wpabuf_free(sae->tmp->peer_rejected_groups); + sae->tmp->peer_rejected_groups = wpabuf_alloc(len); +-- +2.30.2 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb index 56c01ede54..c1a4383b47 100644 --- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant_2.10.bb @@ -28,6 +28,9 @@ SRC_URI = "http://w1.fi/releases/wpa_supplicant-${PV}.tar.gz \ file://CVE-2024-3596_06.patch \ file://CVE-2024-3596_07.patch \ file://CVE-2024-3596_08.patch \ + file://0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch \ + file://0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch \ + file://0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch \ " SRC_URI[sha256sum] = "20df7ae5154b3830355f8ab4269123a87affdea59fe74fe9292a91d0d7e17b2f" -- 2.34.1 ^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 06/10] glibc: stable 2.39 branch updates. 2024-10-07 1:54 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (4 preceding siblings ...) 2024-10-07 1:54 ` [OE-core][scarthgap 05/10] wpa-supplicant: Patch security advisory 2024-2 Steve Sakoman @ 2024-10-07 1:54 ` Steve Sakoman 2024-10-07 1:55 ` [OE-core][scarthgap 07/10] webkitgtk: upgrade 2.44.1 -> 2.44.3 Steve Sakoman ` (4 subsequent siblings) 10 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2024-10-07 1:54 UTC (permalink / raw) To: openembedded-core From: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Below commits on glibc-2.39 stable branch are updated. 84f6bfce2c libio: Attempt wide backup free only for non-legacy code 4e382ce01c debug: Fix read error handling in pcprofiledump 7f5027995f elf: Fix tst-dlopen-tlsreinit1.out test dependency 27a0c6b490 elf: Avoid re-initializing already allocated TLS in dlopen (bug 31717) e3d5d2d350 elf: Clarify and invert second argument of _dl_allocate_tls_init 28c4f32f71 elf: Support recursive use of dynamic TLS in interposed malloc 5ff30b2f75 nptl: Use <support/check.h> facilities in tst-setuid3 cae418638e posix: Use <support/check.h> facilities in tst-truncate and tst-truncate64 a500b48bd2 ungetc: Fix backup buffer leak on program exit [BZ #27821] 70939528c6 ungetc: Fix uninitialized read when putting into unused streams [BZ #27821] f0c308ab23 Make tst-ungetc use libsupport 3c5f493d87 stdio-common: Add test for vfscanf with matches longer than INT_MAX [BZ #27650] 98de2f2bae support: Add FAIL test failure helper e73fd06b7f string: strerror, strsignal cannot use buffer after dlmopen (bug 32026) 37c2aa4eaa Define __libc_initial for the static libc 49953727d1 x86: Fix bug in strchrnul-evex512 [BZ #32078] 81631a0dd1 Adjust check-local-headers test for libaudit 4.0 9fbbe86f7c x32/cet: Support shadow stack during startup for Linux 6.10 eeff407b19 x86-64: Remove sysdeps/x86_64/x32/dl-machine.h 1ab7faf86d support: Add options list terminator to the test driver 6eebc92cb2 manual/stdio: Further clarify putc, putwc, getc, and getwc afc15c2044 Fix name space violation in fortify wrappers (bug 32052) 5a5eb72d8e resolv: Fix tst-resolv-short-response for older GCC (bug 32042) 7f5ccdd8af Add mremap tests a8c230c881 mremap: Update manual entry 9f349d02c6 linux: Update the mremap C implementation [BZ #31968] 127ef30c46 Enhanced test coverage for strncmp, wcsncmp 3b25c7fa87 Enhance test coverage for strnlen, wcsnlen 4bdcc1963b manual: make setrlimit() description less ambiguous b71a51189d manual/stdio: Clarify putc and putwc 946006d37c malloc: add multi-threaded tests for aligned_alloc/calloc/malloc f11b7178a1 malloc: avoid global locks in tst-aligned_alloc-lib.c 51db012c94 resolv: Track single-request fallback via _res._flags (bug 31476) 8c9fbc6651 resolv: Do not wait for non-existing second DNS response after error (bug 30081) fc1dc39984 resolv: Allow short error responses to match any query (bug 31890) cb19cef087 elf: Fix localplt.awk for DT_RELR-enabled builds (BZ 31978) f6a75fddf4 Fix usage of _STACK_GROWS_DOWN and _STACK_GROWS_UP defines [BZ 31989] Results before updates as below: No. of passes 4581 No. of expected passes 2 No. of expected failures 16 No. of unexpected failures 214 No. of unsupported tests 45 Results after updates as below: No. of passes 4605 No. of expected passes 2 No. of expected failures 16 No. of unexpected failures 212 No. of unsupported tests 46 Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/recipes-core/glibc/glibc-version.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc index 955b22bc38..dc162b2946 100644 --- a/meta/recipes-core/glibc/glibc-version.inc +++ b/meta/recipes-core/glibc/glibc-version.inc @@ -1,6 +1,6 @@ SRCBRANCH ?= "release/2.39/master" PV = "2.39+git" -SRCREV_glibc ?= "e8f521709731ce3ae8d6f1eca30135d5c0606f02" +SRCREV_glibc ?= "84f6bfce2c37e32b9888321fc3131ffbbe6deeba" SRCREV_localedef ?= "fab74f31b3811df543e24b6de47efdf45b538abc" GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https" -- 2.34.1 ^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 07/10] webkitgtk: upgrade 2.44.1 -> 2.44.3 2024-10-07 1:54 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (5 preceding siblings ...) 2024-10-07 1:54 ` [OE-core][scarthgap 06/10] glibc: stable 2.39 branch updates Steve Sakoman @ 2024-10-07 1:55 ` Steve Sakoman 2024-10-07 1:55 ` [OE-core][scarthgap 08/10] cryptodev: upgrade 1.13 -> 1.14 Steve Sakoman ` (3 subsequent siblings) 10 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2024-10-07 1:55 UTC (permalink / raw) To: openembedded-core From: Hitendra Prajapati <hprajapati@mvista.com> Remove below patches which already fix in this upgraded version. 0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch 0002-More-dynamicDowncast-adoption-in-platform-code.patch Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- ...able-to-control-macro-__PAS_ALWAYS_I.patch | 6 +- ...spection.cmake-prefix-variables-obta.patch | 2 +- ...fic-declarations-in-FELighting.h-unn.patch | 44 ------------- ...icDowncast-adoption-in-platform-code.patch | 65 ------------------- ...d5e22213fdaca2a29ec3400c927d710a37a8.patch | 2 +- .../webkit/webkitgtk/no-musttail-arm.patch | 6 +- .../webkit/webkitgtk/reproducibility.patch | 2 +- .../webkit/webkitgtk/t6-not-declared.patch | 12 ++-- ...ebkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} | 6 +- 9 files changed, 16 insertions(+), 129 deletions(-) delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0002-More-dynamicDowncast-adoption-in-platform-code.patch rename meta/recipes-sato/webkit/{webkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} (96%) diff --git a/meta/recipes-sato/webkit/webkitgtk/0001-CMake-Add-a-variable-to-control-macro-__PAS_ALWAYS_I.patch b/meta/recipes-sato/webkit/webkitgtk/0001-CMake-Add-a-variable-to-control-macro-__PAS_ALWAYS_I.patch index a819e22127..a19008a41f 100644 --- a/meta/recipes-sato/webkit/webkitgtk/0001-CMake-Add-a-variable-to-control-macro-__PAS_ALWAYS_I.patch +++ b/meta/recipes-sato/webkit/webkitgtk/0001-CMake-Add-a-variable-to-control-macro-__PAS_ALWAYS_I.patch @@ -1,4 +1,4 @@ -From 575b848a3b3c14280679db80d0d518922c83d62a Mon Sep 17 00:00:00 2001 +From 99a21305ae683a216e9299e5dbdd763190a8cfe3 Mon Sep 17 00:00:00 2001 From: Kai Kang <kai.kang@windriver.com> Date: Fri, 11 Aug 2023 14:20:48 +0800 Subject: [PATCH] Add a variable to control macro @@ -57,10 +57,10 @@ index 5d5fb38c..a554f700 100644 #else #define __PAS_ALWAYS_INLINE_BUT_NOT_INLINE diff --git a/Source/cmake/WebKitCompilerFlags.cmake b/Source/cmake/WebKitCompilerFlags.cmake -index 9b2fecf9..7cdc2b6a 100644 +index 0732785e..4879ec40 100644 --- a/Source/cmake/WebKitCompilerFlags.cmake +++ b/Source/cmake/WebKitCompilerFlags.cmake -@@ -453,3 +453,10 @@ endif () +@@ -452,3 +452,10 @@ endif () # FIXME: Enable pre-compiled headers for all ports <https://webkit.org/b/139438> set(CMAKE_DISABLE_PRECOMPILE_HEADERS ON) diff --git a/meta/recipes-sato/webkit/webkitgtk/0001-FindGObjectIntrospection.cmake-prefix-variables-obta.patch b/meta/recipes-sato/webkit/webkitgtk/0001-FindGObjectIntrospection.cmake-prefix-variables-obta.patch index 8e29ce17ed..dda20a7b25 100644 --- a/meta/recipes-sato/webkit/webkitgtk/0001-FindGObjectIntrospection.cmake-prefix-variables-obta.patch +++ b/meta/recipes-sato/webkit/webkitgtk/0001-FindGObjectIntrospection.cmake-prefix-variables-obta.patch @@ -1,4 +1,4 @@ -From 6348f91c29e2350ad3fec5264aa57dd4994d4583 Mon Sep 17 00:00:00 2001 +From d1f6a1b6a1298f6ef2f1677e9996aa60a002134a Mon Sep 17 00:00:00 2001 From: Alexander Kanavin <alex.kanavin@gmail.com> Date: Tue, 27 Oct 2015 16:02:19 +0200 Subject: [PATCH] FindGObjectIntrospection.cmake: prefix variables obtained diff --git a/meta/recipes-sato/webkit/webkitgtk/0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch b/meta/recipes-sato/webkit/webkitgtk/0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch deleted file mode 100644 index 6ffe0a9454..0000000000 --- a/meta/recipes-sato/webkit/webkitgtk/0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch +++ /dev/null @@ -1,44 +0,0 @@ -From dbd1a59b239b3902e717fdeb063883dbb0b06ee9 Mon Sep 17 00:00:00 2001 -From: Adrian Perez de Castro <aperez@igalia.com> -Date: Sun, 26 May 2024 14:24:35 -0700 -Subject: [PATCH 1/2] Remove ARM-specific declarations in FELighting.h unneeded - after 272873@main - -Unreviewed build fix. - -* Source/WebCore/platform/graphics/filters/FELighting.h: Remove unneeded - declarations for the getPowerCoefficients() and platformApplyNeon() - functions, which are now defined elsewhere; and were causing a build - failure due to usage of the protected LightingData type. - -Canonical link: https://commits.webkit.org/279334@main - -Backport this patch for fixing following compile error: -webkitgtk-2.44.1/Source/WebCore/platform/graphics/filters/FELighting.h:73:41: error: 'LightingData' does not name a type - 73 | inline void platformApplyNeon(const LightingData&, const LightSource::PaintingData&); - -Upstream-Status: Backport [https://github.com/WebKit/WebKit/commit/36d1b5d7c0ef9a733ee8055b1f35b1d24435d538] -Signed-off-by: Changqing Li <changqing.li@windriver.com> ---- - Source/WebCore/platform/graphics/filters/FELighting.h | 5 ----- - 1 file changed, 5 deletions(-) - -diff --git a/Source/WebCore/platform/graphics/filters/FELighting.h b/Source/WebCore/platform/graphics/filters/FELighting.h -index 4efab920..dcd80b6f 100644 ---- a/Source/WebCore/platform/graphics/filters/FELighting.h -+++ b/Source/WebCore/platform/graphics/filters/FELighting.h -@@ -68,11 +68,6 @@ protected: - - std::unique_ptr<FilterEffectApplier> createSoftwareApplier() const override; - --#if CPU(ARM_NEON) && CPU(ARM_TRADITIONAL) && COMPILER(GCC_COMPATIBLE) -- static int getPowerCoefficients(float exponent); -- inline void platformApplyNeon(const LightingData&, const LightSource::PaintingData&); --#endif -- - Color m_lightingColor; - float m_surfaceScale; - float m_diffuseConstant; --- -2.25.1 - diff --git a/meta/recipes-sato/webkit/webkitgtk/0002-More-dynamicDowncast-adoption-in-platform-code.patch b/meta/recipes-sato/webkit/webkitgtk/0002-More-dynamicDowncast-adoption-in-platform-code.patch deleted file mode 100644 index a0c7b6bd57..0000000000 --- a/meta/recipes-sato/webkit/webkitgtk/0002-More-dynamicDowncast-adoption-in-platform-code.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 88fa4b49a10ecfb74c36c678c1e2b76136357153 Mon Sep 17 00:00:00 2001 -From: Changqing Li <changqing.li@windriver.com> -Date: Fri, 12 Jul 2024 10:16:05 +0800 -Subject: [PATCH 2/2] More dynamicDowncast<> adoption in platform code - -Backport part of commit [90d13e7 More dynamicDowncast<> adoption in -platform code] to fix following compile error for ARM_NEON: -webkitgtk-2.44.1/Source/WebCore/platform/graphics/cpu/arm/filters/FELightingNeonParallelApplier.cpp:545:37: error: 'LS_POINT' was not declared in this scope; did you mean 'WebCore::LightType::LS_POINT'? - 545 | if (data.lightSource->type() == LS_POINT) { - | ^~~~~~~~ - | WebCore::LightType::LS_POINT - -Upstream-Status: Backport [https://github.com/WebKit/WebKit/commit/90d13e77ab2192b7efa8e763eeb8b08dbbb6d5c3] - -Signed-off-by: Changqing Li <changqing.li@windriver.com> ---- - .../filters/FELightingNeonParallelApplier.cpp | 22 +++++++++---------- - 1 file changed, 10 insertions(+), 12 deletions(-) - -diff --git a/Source/WebCore/platform/graphics/cpu/arm/filters/FELightingNeonParallelApplier.cpp b/Source/WebCore/platform/graphics/cpu/arm/filters/FELightingNeonParallelApplier.cpp -index 04d855fa..dccc003d 100644 ---- a/Source/WebCore/platform/graphics/cpu/arm/filters/FELightingNeonParallelApplier.cpp -+++ b/Source/WebCore/platform/graphics/cpu/arm/filters/FELightingNeonParallelApplier.cpp -@@ -542,19 +542,17 @@ void FELightingNeonParallelApplier::applyPlatformParallel(const LightingData& da - floatArguments.colorBlue = color.blue; - floatArguments.padding4 = 0; - -- if (data.lightSource->type() == LS_POINT) { -+ if (auto* pointLightSource = dynamicDowncast<PointLightSource>(*data.lightSource)) { - neonData.flags |= FLAG_POINT_LIGHT; -- auto& pointLightSource = downcast<PointLightSource>(*data.lightSource); -- floatArguments.lightX = pointLightSource.position().x(); -- floatArguments.lightY = pointLightSource.position().y(); -- floatArguments.lightZ = pointLightSource.position().z(); -+ floatArguments.lightX = pointLightSource->position().x(); -+ floatArguments.lightY = pointLightSource->position().y(); -+ floatArguments.lightZ = pointLightSource->position().z(); - floatArguments.padding2 = 0; -- } else if (data.lightSource->type() == LS_SPOT) { -+ } else if (auto* spotLightSource = dynamicDowncast<SpotLightSource>(*data.lightSource)) { - neonData.flags |= FLAG_SPOT_LIGHT; -- auto& spotLightSource = downcast<SpotLightSource>(*data.lightSource); -- floatArguments.lightX = spotLightSource.position().x(); -- floatArguments.lightY = spotLightSource.position().y(); -- floatArguments.lightZ = spotLightSource.position().z(); -+ floatArguments.lightX = spotLightSource->position().x(); -+ floatArguments.lightY = spotLightSource->position().y(); -+ floatArguments.lightZ = spotLightSource->position().z(); - floatArguments.padding2 = 0; - - floatArguments.directionX = paintingData.directionVector.x(); -@@ -565,8 +563,8 @@ void FELightingNeonParallelApplier::applyPlatformParallel(const LightingData& da - floatArguments.coneCutOffLimit = paintingData.coneCutOffLimit; - floatArguments.coneFullLight = paintingData.coneFullLight; - floatArguments.coneCutOffRange = paintingData.coneCutOffLimit - paintingData.coneFullLight; -- neonData.coneExponent = getPowerCoefficients(spotLightSource.specularExponent()); -- if (spotLightSource.specularExponent() == 1) -+ neonData.coneExponent = getPowerCoefficients(spotLightSource->specularExponent()); -+ if (spotLightSource->specularExponent() == 1) - neonData.flags |= FLAG_CONE_EXPONENT_IS_1; - } else { - ASSERT(data.lightSource->type() == LS_DISTANT); --- -2.25.1 - diff --git a/meta/recipes-sato/webkit/webkitgtk/30e1d5e22213fdaca2a29ec3400c927d710a37a8.patch b/meta/recipes-sato/webkit/webkitgtk/30e1d5e22213fdaca2a29ec3400c927d710a37a8.patch index 76bcb3df99..0d8976c502 100644 --- a/meta/recipes-sato/webkit/webkitgtk/30e1d5e22213fdaca2a29ec3400c927d710a37a8.patch +++ b/meta/recipes-sato/webkit/webkitgtk/30e1d5e22213fdaca2a29ec3400c927d710a37a8.patch @@ -1,4 +1,4 @@ -From 1523e00a2a76e285262c8aa3721b5d99f3f2d612 Mon Sep 17 00:00:00 2001 +From 2ee948191de1c561b72ebf462605376cfb3ce7af Mon Sep 17 00:00:00 2001 From: Thomas Devoogdt <thomas.devoogdt@barco.com> Date: Mon, 16 Jan 2023 17:03:30 +0100 Subject: [PATCH] REGRESSION(257865@main): B3Validate.cpp: fix diff --git a/meta/recipes-sato/webkit/webkitgtk/no-musttail-arm.patch b/meta/recipes-sato/webkit/webkitgtk/no-musttail-arm.patch index 8ce37a01cc..793be48df2 100644 --- a/meta/recipes-sato/webkit/webkitgtk/no-musttail-arm.patch +++ b/meta/recipes-sato/webkit/webkitgtk/no-musttail-arm.patch @@ -1,4 +1,4 @@ -From a9c874f7418cefbe78f7cd26505ae495cb59bbcf Mon Sep 17 00:00:00 2001 +From 31dca9601888f2a539dfb22693ffd62c22ee8912 Mon Sep 17 00:00:00 2001 From: Khem Raj <raj.khem@gmail.com> Date: Fri, 12 Jan 2024 09:21:39 -0800 Subject: [PATCH] clang/arm: Do not use MUST_TAIL_CALL @@ -16,10 +16,10 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com> 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Source/WTF/wtf/Compiler.h b/Source/WTF/wtf/Compiler.h -index 0ea5cb76..c5480dbc 100644 +index 449ca502..daac29d7 100644 --- a/Source/WTF/wtf/Compiler.h +++ b/Source/WTF/wtf/Compiler.h -@@ -284,7 +284,7 @@ +@@ -321,7 +321,7 @@ /* MUST_TAIL_CALL */ #if !defined(MUST_TAIL_CALL) && defined(__cplusplus) && defined(__has_cpp_attribute) diff --git a/meta/recipes-sato/webkit/webkitgtk/reproducibility.patch b/meta/recipes-sato/webkit/webkitgtk/reproducibility.patch index 93a431a0b1..d614a1ee4f 100644 --- a/meta/recipes-sato/webkit/webkitgtk/reproducibility.patch +++ b/meta/recipes-sato/webkit/webkitgtk/reproducibility.patch @@ -1,4 +1,4 @@ -From d096b945113ddecaf33062296e20b6d5a007cab3 Mon Sep 17 00:00:00 2001 +From cb5458b5d15aafa3543a47a33975609026d45d32 Mon Sep 17 00:00:00 2001 From: Richard Purdie <richard.purdie@linuxfoundation.org> Date: Mon, 3 Jan 2022 14:18:34 +0000 Subject: [PATCH] webkitgtk: Add reproducibility fix diff --git a/meta/recipes-sato/webkit/webkitgtk/t6-not-declared.patch b/meta/recipes-sato/webkit/webkitgtk/t6-not-declared.patch index d4720e4f28..064925dace 100644 --- a/meta/recipes-sato/webkit/webkitgtk/t6-not-declared.patch +++ b/meta/recipes-sato/webkit/webkitgtk/t6-not-declared.patch @@ -1,10 +1,9 @@ -From 3d5373575695b293b8559155431d0079a6153aff Mon Sep 17 00:00:00 2001 +From 36c092723ec6d4908039341c9d157db8ab1c0a59 Mon Sep 17 00:00:00 2001 From: Michael Catanzaro <mcatanzaro@redhat.com> Date: Mon, 5 Feb 2024 11:00:49 -0600 -Subject: [PATCH] =?UTF-8?q?[GTK]=20[2.42.5]=20LowLevelInterpreter.cpp:339:?= - =?UTF-8?q?21:=20error:=20=E2=80=98t6=E2=80=99=20was=20not=20declared=20in?= - =?UTF-8?q?=20this=20scope=20https://bugs.webkit.org/show=5Fbug.cgi=3Fid?= - =?UTF-8?q?=3D268739?= +Subject: [PATCH] =?UTF-8?q?LowLevelInterpreter.cpp:339:21:=20error:=20?= + =?UTF-8?q?=E2=80=98t6=E2=80=99=20was=20not=20declared=20in=20this=20scope?= + =?UTF-8?q?=20https://bugs.webkit.org/show=5Fbug.cgi=3Fid=3D268739?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -22,7 +21,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> 1 file changed, 2 deletions(-) diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp b/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp -index 5064ead6cd2e7..9a2e2653b1219 100644 +index 75cecbbd..b1020ea4 100644 --- a/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp +++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp @@ -336,8 +336,6 @@ JSValue CLoop::execute(OpcodeID entryOpcodeID, void* executableAddress, VM* vm, @@ -34,4 +33,3 @@ index 5064ead6cd2e7..9a2e2653b1219 100644 struct StackPointerScope { StackPointerScope(CLoopStack& stack) - diff --git a/meta/recipes-sato/webkit/webkitgtk_2.44.1.bb b/meta/recipes-sato/webkit/webkitgtk_2.44.3.bb similarity index 96% rename from meta/recipes-sato/webkit/webkitgtk_2.44.1.bb rename to meta/recipes-sato/webkit/webkitgtk_2.44.3.bb index c4a3c464c1..90fb7a1d42 100644 --- a/meta/recipes-sato/webkit/webkitgtk_2.44.1.bb +++ b/meta/recipes-sato/webkit/webkitgtk_2.44.3.bb @@ -16,10 +16,8 @@ SRC_URI = "https://www.webkitgtk.org/releases/${BPN}-${PV}.tar.xz \ file://no-musttail-arm.patch \ file://t6-not-declared.patch \ file://30e1d5e22213fdaca2a29ec3400c927d710a37a8.patch \ - file://0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch \ - file://0002-More-dynamicDowncast-adoption-in-platform-code.patch \ " -SRC_URI[sha256sum] = "425b1459b0f04d0600c78d1abb5e7edfa3c060a420f8b231e9a6a2d5d29c5561" +SRC_URI[sha256sum] = "dc82d042ecaca981a4852357c06e5235743319cf10a94cd36ad41b97883a0b54" inherit cmake pkgconfig gobject-introspection perlnative features_check upstream-version-is-even gi-docgen @@ -95,7 +93,7 @@ EXTRA_OECMAKE = " \ # Unless DEBUG_BUILD is enabled, pass -g1 to massively reduce the size of the # debug symbols (4.3GB to 700M at time of writing) -DEBUG_FLAGS:append = "${@oe.utils.vartrue('DEBUG_BUILD', '', ' -g1', d)}" +DEBUG_LEVELFLAG = "-g1" # Javascript JIT is not supported on ARC EXTRA_OECMAKE:append:arc = " -DENABLE_JIT=OFF " -- 2.34.1 ^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 08/10] cryptodev: upgrade 1.13 -> 1.14 2024-10-07 1:54 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (6 preceding siblings ...) 2024-10-07 1:55 ` [OE-core][scarthgap 07/10] webkitgtk: upgrade 2.44.1 -> 2.44.3 Steve Sakoman @ 2024-10-07 1:55 ` Steve Sakoman 2024-10-07 1:55 ` [OE-core][scarthgap 09/10] populate_sdk_base: inherit nopackages Steve Sakoman ` (2 subsequent siblings) 10 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2024-10-07 1:55 UTC (permalink / raw) To: openembedded-core From: Wang Mingyu <wangmy@fujitsu.com> 0001-Disable-installing-header-file-provided-by-another-p.patch 0001-tests-Makefile-do-not-use-Werror.patch removed since they're included in 1.14 Changelog: =========== * Fix compilation issues after API changes in several Linux kernels * Split install targets to help package maintainers Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Acked-by: Chirag Shilwant <c-shilwant@ti.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- ...-linux_1.13.bb => cryptodev-linux_1.14.bb} | 0 ...odule_1.13.bb => cryptodev-module_1.14.bb} | 3 --- ...-tests_1.13.bb => cryptodev-tests_1.14.bb} | 4 --- meta/recipes-kernel/cryptodev/cryptodev.inc | 4 +-- ...ng-header-file-provided-by-another-p.patch | 25 ------------------- ...001-tests-Makefile-do-not-use-Werror.patch | 25 ------------------- 6 files changed, 2 insertions(+), 59 deletions(-) rename meta/recipes-kernel/cryptodev/{cryptodev-linux_1.13.bb => cryptodev-linux_1.14.bb} (100%) rename meta/recipes-kernel/cryptodev/{cryptodev-module_1.13.bb => cryptodev-module_1.14.bb} (74%) rename meta/recipes-kernel/cryptodev/{cryptodev-tests_1.13.bb => cryptodev-tests_1.14.bb} (74%) delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-Disable-installing-header-file-provided-by-another-p.patch delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-tests-Makefile-do-not-use-Werror.patch diff --git a/meta/recipes-kernel/cryptodev/cryptodev-linux_1.13.bb b/meta/recipes-kernel/cryptodev/cryptodev-linux_1.14.bb similarity index 100% rename from meta/recipes-kernel/cryptodev/cryptodev-linux_1.13.bb rename to meta/recipes-kernel/cryptodev/cryptodev-linux_1.14.bb diff --git a/meta/recipes-kernel/cryptodev/cryptodev-module_1.13.bb b/meta/recipes-kernel/cryptodev/cryptodev-module_1.14.bb similarity index 74% rename from meta/recipes-kernel/cryptodev/cryptodev-module_1.13.bb rename to meta/recipes-kernel/cryptodev/cryptodev-module_1.14.bb index 5192cf03ed..6fb75675bb 100644 --- a/meta/recipes-kernel/cryptodev/cryptodev-module_1.13.bb +++ b/meta/recipes-kernel/cryptodev/cryptodev-module_1.14.bb @@ -7,9 +7,6 @@ inherit module # Header file provided by a separate package DEPENDS += "cryptodev-linux" -SRC_URI += "file://0001-Disable-installing-header-file-provided-by-another-p.patch \ - " - EXTRA_OEMAKE='KERNEL_DIR="${STAGING_KERNEL_DIR}" PREFIX="${D}"' RCONFLICTS:${PN} = "ocf-linux" diff --git a/meta/recipes-kernel/cryptodev/cryptodev-tests_1.13.bb b/meta/recipes-kernel/cryptodev/cryptodev-tests_1.14.bb similarity index 74% rename from meta/recipes-kernel/cryptodev/cryptodev-tests_1.13.bb rename to meta/recipes-kernel/cryptodev/cryptodev-tests_1.14.bb index 458ad8ecf2..f6a286e1b7 100644 --- a/meta/recipes-kernel/cryptodev/cryptodev-tests_1.13.bb +++ b/meta/recipes-kernel/cryptodev/cryptodev-tests_1.14.bb @@ -4,10 +4,6 @@ SUMMARY = "A test suite for /dev/crypto device driver" DEPENDS += "openssl" -SRC_URI += " \ - file://0001-tests-Makefile-do-not-use-Werror.patch \ - " - EXTRA_OEMAKE='KERNEL_DIR="${STAGING_EXECPREFIXDIR}" PREFIX="${D}"' do_compile() { diff --git a/meta/recipes-kernel/cryptodev/cryptodev.inc b/meta/recipes-kernel/cryptodev/cryptodev.inc index 64a9c2926b..8d0aad4a01 100644 --- a/meta/recipes-kernel/cryptodev/cryptodev.inc +++ b/meta/recipes-kernel/cryptodev/cryptodev.inc @@ -10,8 +10,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" SRC_URI = "git://github.com/cryptodev-linux/cryptodev-linux;branch=master;protocol=https \ " -SRCREV = "bb8bc7cf60d2c0b097c8b3b0e807f805b577a53f" -PV = "1.13+git${SRCPV}" +SRCREV = "135cbff90af2ba97d88f1472be595ce78721972c" +PV = "1.14" S = "${WORKDIR}/git" diff --git a/meta/recipes-kernel/cryptodev/files/0001-Disable-installing-header-file-provided-by-another-p.patch b/meta/recipes-kernel/cryptodev/files/0001-Disable-installing-header-file-provided-by-another-p.patch deleted file mode 100644 index c7fdef4da4..0000000000 --- a/meta/recipes-kernel/cryptodev/files/0001-Disable-installing-header-file-provided-by-another-p.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 66d85d3f26e21cf7c38b27de0dcc42376f5d853e Mon Sep 17 00:00:00 2001 -From: Denys Dmytriyenko <denys@ti.com> -Date: Sun, 6 Apr 2014 19:51:39 -0400 -Subject: [PATCH] Disable installing header file provided by another package - -Signed-off-by: Denys Dmytriyenko <denys@ti.com> - -Upstream-Status: Inappropriate [ OE specific ] - ---- - Makefile | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/Makefile b/Makefile -index d83aee6..c8d8ae5 100644 ---- a/Makefile -+++ b/Makefile -@@ -36,7 +36,6 @@ install: modules_install - - modules_install: - $(MAKE) $(KERNEL_MAKE_OPTS) modules_install -- install -m 644 -D crypto/cryptodev.h $(DESTDIR)/$(includedir)/crypto/cryptodev.h - - install_tests: tests - $(MAKE) -C tests install DESTDIR=$(PREFIX) diff --git a/meta/recipes-kernel/cryptodev/files/0001-tests-Makefile-do-not-use-Werror.patch b/meta/recipes-kernel/cryptodev/files/0001-tests-Makefile-do-not-use-Werror.patch deleted file mode 100644 index 3285548a57..0000000000 --- a/meta/recipes-kernel/cryptodev/files/0001-tests-Makefile-do-not-use-Werror.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 47438e53e1156db0916c0f4683a24fe4d82152f2 Mon Sep 17 00:00:00 2001 -From: Alexander Kanavin <alex@linutronix.de> -Date: Fri, 10 Sep 2021 10:44:42 +0200 -Subject: [PATCH] tests/Makefile: do not use -Werror - -Otherwise, openssl 3 deprecation warnings become errors. -Reported at https://github.com/cryptodev-linux/cryptodev-linux/issues/67 - -Upstream-Status: Inappropriate [upstream needs to update the code] -Signed-off-by: Alexander Kanavin <alex@linutronix.de> - ---- - tests/Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/tests/Makefile b/tests/Makefile -index 2fb7a9a..e94f80e 100644 ---- a/tests/Makefile -+++ b/tests/Makefile -@@ -1,4 +1,4 @@ --CFLAGS += -I.. $(CRYPTODEV_CFLAGS) -Wall -Werror -+CFLAGS += -I.. $(CRYPTODEV_CFLAGS) -Wall - - comp_progs := cipher_comp hash_comp hmac_comp - -- 2.34.1 ^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 09/10] populate_sdk_base: inherit nopackages 2024-10-07 1:54 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (7 preceding siblings ...) 2024-10-07 1:55 ` [OE-core][scarthgap 08/10] cryptodev: upgrade 1.13 -> 1.14 Steve Sakoman @ 2024-10-07 1:55 ` Steve Sakoman 2024-10-07 1:55 ` [OE-core][scarthgap 10/10] meta-world-pkgdata: Inherit nopackages Steve Sakoman 2024-10-07 3:23 ` [OE-core][scarthgap 00/10] Patch review Khem Raj 10 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2024-10-07 1:55 UTC (permalink / raw) To: openembedded-core From: Martin Jansa <martin.jansa@gmail.com> Since this bbclass sets PACKAGES = "", inherit the nopackages class to skip the various packaging functions which wouldn't do anything anyway. This fixes errors from buildhistory changes where packages-split would be empty. e.g. meta-toolchain build now fails with: | DEBUG: Executing shell function buildhistory_list_pkg_files | find: ".../meta-toolchain/1.0/packages-split/*": No such file or directory | WARNING: exit code 1 from a shell command. | DEBUG: Python function buildhistory_emit_pkghistory finished Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Atharva Nandanwar <atharvanandanwar@outlook.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/classes-recipe/populate_sdk_base.bbclass | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/classes-recipe/populate_sdk_base.bbclass b/meta/classes-recipe/populate_sdk_base.bbclass index a103e7b738..5c738dbf2a 100644 --- a/meta/classes-recipe/populate_sdk_base.bbclass +++ b/meta/classes-recipe/populate_sdk_base.bbclass @@ -13,7 +13,7 @@ PACKAGES = "" # SDK processing context. This class happens to be common to these usages. SPDX_MULTILIB_SSTATE_ARCHS = "${@all_multilib_tune_values(d, 'SSTATE_ARCHS')}" -inherit image-postinst-intercepts image-artifact-names +inherit image-postinst-intercepts image-artifact-names nopackages # Wildcards specifying complementary packages to install for every package that has been explicitly # installed into the rootfs -- 2.34.1 ^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 10/10] meta-world-pkgdata: Inherit nopackages 2024-10-07 1:54 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (8 preceding siblings ...) 2024-10-07 1:55 ` [OE-core][scarthgap 09/10] populate_sdk_base: inherit nopackages Steve Sakoman @ 2024-10-07 1:55 ` Steve Sakoman 2024-10-07 3:23 ` [OE-core][scarthgap 00/10] Patch review Khem Raj 10 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2024-10-07 1:55 UTC (permalink / raw) To: openembedded-core From: Martin Jansa <martin.jansa@gmail.com> Since this is a recipe with PACKAGES = "", inherit the nopackages class to skip the various packaging functions which wouldn't do anything anyway. This fixes errors from buildhistory changes where packages-split would be empty. Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/recipes-core/meta/meta-world-pkgdata.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-core/meta/meta-world-pkgdata.bb b/meta/recipes-core/meta/meta-world-pkgdata.bb index 0438bf6138..954675f383 100644 --- a/meta/recipes-core/meta/meta-world-pkgdata.bb +++ b/meta/recipes-core/meta/meta-world-pkgdata.bb @@ -27,6 +27,7 @@ python do_collect_packagedata() { oe.copy_buildsystem.generate_locked_sigs(sigfile, d) } +inherit nopackages deltask do_fetch deltask do_unpack deltask do_patch -- 2.34.1 ^ permalink raw reply related [flat|nested] 19+ messages in thread
* Re: [OE-core][scarthgap 00/10] Patch review 2024-10-07 1:54 [OE-core][scarthgap 00/10] Patch review Steve Sakoman ` (9 preceding siblings ...) 2024-10-07 1:55 ` [OE-core][scarthgap 10/10] meta-world-pkgdata: Inherit nopackages Steve Sakoman @ 2024-10-07 3:23 ` Khem Raj 10 siblings, 0 replies; 19+ messages in thread From: Khem Raj @ 2024-10-07 3:23 UTC (permalink / raw) To: steve; +Cc: openembedded-core series looks ok to me. On Sun, Oct 6, 2024 at 6:55 PM Steve Sakoman via lists.openembedded.org <steve=sakoman.com@lists.openembedded.org> wrote: > > Please review this set of changes for scarthgap and have comments back by > end of day Tuesday, October 8 > > Passed a-full on autobuilder: > > https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7374 > > The following changes since commit 3d894863f442188bad446095bd7fdd82665bb54b: > > makedevs: Fix issue when rootdir of / is given (2024-09-28 05:21:51 -0700) > > are available in the Git repository at: > > https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut > https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut > > Deepesh Varatharajan (1): > glibc: stable 2.39 branch updates. > > Hitendra Prajapati (1): > webkitgtk: upgrade 2.44.1 -> 2.44.3 > > Khem Raj (2): > gnupg: Document CVE-2022-3219 and mark wontfix > openssh: Mark CVE-2023-51767 as wont-fix > > Martin Jansa (2): > populate_sdk_base: inherit nopackages > meta-world-pkgdata: Inherit nopackages > > Peter Marko (3): > wpa-supplicant: Ignore CVE-2024-5290 > wpa-supplicant: Patch CVE-2024-3596 > wpa-supplicant: Patch security advisory 2024-2 > > Wang Mingyu (1): > cryptodev: upgrade 1.13 -> 1.14 > > meta/classes-recipe/populate_sdk_base.bbclass | 2 +- > .../openssh/openssh_9.6p1.bb | 1 + > ...valid-Rejected-Groups-element-length.patch | 52 ++++++ > ...valid-Rejected-Groups-element-length.patch | 50 ++++++ > ...id-Rejected-Groups-element-in-the-pa.patch | 38 ++++ > .../wpa-supplicant/CVE-2024-3596_00.patch | 82 +++++++++ > .../wpa-supplicant/CVE-2024-3596_01.patch | 165 ++++++++++++++++++ > .../wpa-supplicant/CVE-2024-3596_02.patch | 62 +++++++ > .../wpa-supplicant/CVE-2024-3596_03.patch | 37 ++++ > .../wpa-supplicant/CVE-2024-3596_04.patch | 52 ++++++ > .../wpa-supplicant/CVE-2024-3596_05.patch | 51 ++++++ > .../wpa-supplicant/CVE-2024-3596_06.patch | 46 +++++ > .../wpa-supplicant/CVE-2024-3596_07.patch | 67 +++++++ > .../wpa-supplicant/CVE-2024-3596_08.patch | 47 +++++ > .../wpa-supplicant/wpa-supplicant_2.10.bb | 14 ++ > meta/recipes-core/glibc/glibc-version.inc | 2 +- > meta/recipes-core/meta/meta-world-pkgdata.bb | 1 + > ...-linux_1.13.bb => cryptodev-linux_1.14.bb} | 0 > ...odule_1.13.bb => cryptodev-module_1.14.bb} | 3 - > ...-tests_1.13.bb => cryptodev-tests_1.14.bb} | 4 - > meta/recipes-kernel/cryptodev/cryptodev.inc | 4 +- > ...ng-header-file-provided-by-another-p.patch | 25 --- > ...001-tests-Makefile-do-not-use-Werror.patch | 25 --- > ...able-to-control-macro-__PAS_ALWAYS_I.patch | 6 +- > ...spection.cmake-prefix-variables-obta.patch | 2 +- > ...fic-declarations-in-FELighting.h-unn.patch | 44 ----- > ...icDowncast-adoption-in-platform-code.patch | 65 ------- > ...d5e22213fdaca2a29ec3400c927d710a37a8.patch | 2 +- > .../webkit/webkitgtk/no-musttail-arm.patch | 6 +- > .../webkit/webkitgtk/reproducibility.patch | 2 +- > .../webkit/webkitgtk/t6-not-declared.patch | 12 +- > ...ebkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} | 6 +- > meta/recipes-support/gnupg/gnupg_2.4.4.bb | 1 + > 33 files changed, 786 insertions(+), 190 deletions(-) > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch > create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch > rename meta/recipes-kernel/cryptodev/{cryptodev-linux_1.13.bb => cryptodev-linux_1.14.bb} (100%) > rename meta/recipes-kernel/cryptodev/{cryptodev-module_1.13.bb => cryptodev-module_1.14.bb} (74%) > rename meta/recipes-kernel/cryptodev/{cryptodev-tests_1.13.bb => cryptodev-tests_1.14.bb} (74%) > delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-Disable-installing-header-file-provided-by-another-p.patch > delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-tests-Makefile-do-not-use-Werror.patch > delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch > delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0002-More-dynamicDowncast-adoption-in-platform-code.patch > rename meta/recipes-sato/webkit/{webkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} (96%) > > -- > 2.34.1 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#205248): https://lists.openembedded.org/g/openembedded-core/message/205248 > Mute This Topic: https://lists.openembedded.org/mt/108861069/1997914 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [raj.khem@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > ^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 00/10] Patch review @ 2025-08-19 20:07 Steve Sakoman 0 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2025-08-19 20:07 UTC (permalink / raw) To: openembedded-core Please review this set of changes for kirkstone and have comments back by end of day Thursday, August 21 Passed a-full on autobuilder: https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/2234 The following changes since commit fa45d6d5bec8fe503ff6b9166a3b4af31ea95369: go-helloworld: fix license (2025-08-14 07:34:07 -0700) are available in the Git repository at: https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut Daniel Turull (2): xz: ignore CVE-2024-47611 libxml2: ignore CVE-2025-8732 Khem Raj (3): e2fsprogs: Fix build failure with gcc 15 parted: Fix build with GCC 15 bash: Stick to C17 std Martin Jansa (2): cairo: fix build with gcc-15 on host bash: use -std=gnu17 also for native CFLAGS Peter Marko (2): dropbear: patch CVE-2025-47203 glib-2.0: ignore CVE-2025-4056 Philip Lorenz (1): cve-check: Add missing call to exit_if_errors meta/classes/cve-check.bbclass | 1 + ...iable-with-DROPBEAR_CLI_PUBKEY_AUTH-.patch | 27 ++ ...-length-paths-and-commands-in-multih.patch | 63 +++ ...and-also-forward-this-when-multihop-.patch | 81 ++++ ...add-missing-DROPBEAR_CLI_PUBKEY_AUTH.patch | 29 ++ .../dropbear/dropbear/CVE-2025-47203.patch | 367 ++++++++++++++++++ .../recipes-core/dropbear/dropbear_2022.83.bb | 5 + meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 2 + meta/recipes-core/libxml/libxml2_2.12.10.bb | 4 + ...-libext2fs-fix-std-c23-build-failure.patch | 42 ++ .../e2fsprogs/e2fsprogs_1.47.0.bb | 1 + meta/recipes-extended/bash/bash_5.2.21.bb | 5 + ...CH-parted-fix-do_version-declaration.patch | 40 ++ meta/recipes-extended/parted/parted_3.6.bb | 1 + meta/recipes-extended/xz/xz_5.4.7.bb | 2 + .../cairo/cairo/0001-Require-C11.patch | 25 ++ .../cairo/cairo/0002-Meson-Require-C-11.patch | 22 ++ meta/recipes-graphics/cairo/cairo_1.18.0.bb | 2 + 18 files changed, 719 insertions(+) create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Avoid-unused-variable-with-DROPBEAR_CLI_PUBKEY_AUTH-.patch create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Handle-arbitrary-length-paths-and-commands-in-multih.patch create mode 100644 meta/recipes-core/dropbear/dropbear/0001-add-o-BatchMode-and-also-forward-this-when-multihop-.patch create mode 100644 meta/recipes-core/dropbear/dropbear/0001-cli-runopts.c-add-missing-DROPBEAR_CLI_PUBKEY_AUTH.patch create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2025-47203.patch create mode 100644 meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-libext2fs-fix-std-c23-build-failure.patch create mode 100644 meta/recipes-extended/parted/files/0001-bug-74444-PATCH-parted-fix-do_version-declaration.patch create mode 100644 meta/recipes-graphics/cairo/cairo/0001-Require-C11.patch create mode 100644 meta/recipes-graphics/cairo/cairo/0002-Meson-Require-C-11.patch -- 2.43.0 ^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 00/10] Patch review @ 2025-03-27 19:44 Steve Sakoman 0 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2025-03-27 19:44 UTC (permalink / raw) To: openembedded-core Please review this set of changes for scarthgap and have comments back by end of day Monday, March 31 Passed a-full on autobuilder: https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1283 The following changes since commit a720df7ad77af1f8b1c00a211c88537e5f23edbc: nativesdk-libtool: sanitize the script, remove buildpaths (2025-03-20 12:51:41 -0700) are available in the Git repository at: https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut Bruce Ashfield (6): linux-yocto/6.6: update to v6.6.77 linux-yocto/6.6: update to v6.6.78 linux-yocto/6.6: update to v6.6.80 linux-yocto/6.6: update to v6.6.82 linux-yocto/6.6: update to v6.6.83 linux-yocto/6.6: update to v6.6.84 Divya Chellam (1): ruby: fix CVE-2025-27220 Madhu Marri (1): qemu 8.2.7: ignore CVE-2023-1386 Stefan Mueller-Klieser (1): kernel-arch: add macro-prefix-map in KERNEL_CC Vijay Anusuri (1): vim: Upgrade 9.1.1115 -> 9.1.1198 meta/classes-recipe/kernel-arch.bbclass | 8 +- meta/recipes-devtools/qemu/qemu.inc | 2 + .../ruby/ruby/CVE-2025-27220.patch | 78 +++++++++++++++++++ meta/recipes-devtools/ruby/ruby_3.3.5.bb | 1 + .../linux/linux-yocto-rt_6.6.bb | 6 +- .../linux/linux-yocto-tiny_6.6.bb | 6 +- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++---- meta/recipes-support/vim/vim.inc | 4 +- 8 files changed, 110 insertions(+), 23 deletions(-) create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2025-27220.patch -- 2.43.0 ^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2025-02-25 20:56 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Thursday, February 27
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1081
The following changes since commit fc46705cc629a151f85717a57f7d789de8fd9b64:
icu: remove host references in nativesdk to fix reproducibility (2025-02-19 06:28:10 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Etienne Cordonnier (1):
python3-setuptools-scm: respect GIT_CEILING_DIRECTORIES
Hitendra Prajapati (1):
libcap: fix CVE-2025-1390
Hongxu Jia (6):
u-boot: fix CVE-2024-57254
u-boot: fix CVE-2024-57255
u-boot: fix CVE-2024-57256
u-boot: fix CVE-2024-57257
u-boot: fix CVE-2024-57258
u-boot: fix CVE-2024-57259
Peter Marko (1):
libxml2: upgrade 2.12.9 -> 2.12.10
Vijay Anusuri (1):
bind: Upgrade 9.18.28 -> 9.18.33
.../u-boot/files/CVE-2024-57254.patch | 47 ++++
.../u-boot/files/CVE-2024-57255.patch | 53 ++++
.../u-boot/files/CVE-2024-57256.patch | 51 ++++
.../u-boot/files/CVE-2024-57257.patch | 227 ++++++++++++++++++
.../u-boot/files/CVE-2024-57258-1.patch | 47 ++++
.../u-boot/files/CVE-2024-57258-2.patch | 43 ++++
.../u-boot/files/CVE-2024-57258-3.patch | 40 +++
.../u-boot/files/CVE-2024-57259.patch | 41 ++++
meta/recipes-bsp/u-boot/u-boot-common.inc | 11 +-
.../bind/{bind_9.18.28.bb => bind_9.18.33.bb} | 2 +-
.../{libxml2_2.12.9.bb => libxml2_2.12.10.bb} | 2 +-
...0001-respect-GIT_CEILING_DIRECTORIES.patch | 36 +++
.../python/python3-setuptools-scm_8.0.4.bb | 1 +
.../libcap/files/CVE-2025-1390.patch | 36 +++
meta/recipes-support/libcap/libcap_2.69.bb | 1 +
15 files changed, 635 insertions(+), 3 deletions(-)
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57254.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57255.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57256.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57257.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-1.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-2.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-3.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57259.patch
rename meta/recipes-connectivity/bind/{bind_9.18.28.bb => bind_9.18.33.bb} (97%)
rename meta/recipes-core/libxml/{libxml2_2.12.9.bb => libxml2_2.12.10.bb} (97%)
create mode 100644 meta/recipes-devtools/python/python3-setuptools-scm/0001-respect-GIT_CEILING_DIRECTORIES.patch
create mode 100644 meta/recipes-support/libcap/files/CVE-2025-1390.patch
--
2.43.0
^ permalink raw reply [flat|nested] 19+ messages in thread* [OE-core][scarthgap 00/10] Patch review @ 2024-12-18 22:02 Steve Sakoman 0 siblings, 0 replies; 19+ messages in thread From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw) To: openembedded-core Please review this set of changes for scarthgap and have comments back by end of day Friday, December 20 Passed a-full on autobuilder: https://valkyrie.yoctoproject.org/#/builders/29/builds/674 The following changes since commit b19b1e905d966443c4e4d17dfaeb299ae2526575: cve-update-nvd2-native: Tweak to work better with NFS DL_DIR (2024-12-18 06:41:14 -0800) are available in the Git repository at: https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut Alexander Kanavin (1): rust: add reproducibility patch to eliminate host leakage Archana Polampalli (3): ffmpeg: fix CVE-2024-35366 ffmpeg: fix CVE-2024-35367 ffmpeg: fix CVE-2024-35368 Hongxu Jia (1): kern-tools-native: fix SyntaxWarning for RegEx calls on Python 3.12 Jiaying Song (1): subversion: fix CVE-2024-46901 Khem Raj (1): python3: Drop empty patch Ross Burton (1): python3: add dependency on -compression to -core Sunil Dora (1): gcc: Fix c++: tweak for Wrange-loop-construct Yash Shinde (1): binutils: Fix CVE-2024-53589 .../binutils/binutils-2.42.inc | 1 + .../binutils/0016-CVE-2024-53589.patch | 92 ++++++++++ meta/recipes-devtools/gcc/gcc-13.3.inc | 1 + ...ix-c-tweak-for-Wrange-loop-construct.patch | 113 ++++++++++++ ...lize-struct-termios-before-calling-t.patch | 26 --- .../python/python3/python3-manifest.json | 2 +- .../recipes-devtools/python/python3_3.12.6.bb | 1 - ...te-host-information-into-compilation.patch | 51 ++++++ meta/recipes-devtools/rust/rust-source.inc | 1 + .../subversion/CVE-2024-46901.patch | 161 ++++++++++++++++++ .../subversion/subversion_1.14.3.bb | 3 +- ...yntaxWarning-for-RegEx-calls-on-Pyth.patch | 60 +++++++ .../kern-tools/kern-tools-native_git.bb | 4 +- .../ffmpeg/ffmpeg/CVE-2024-35366.patch | 35 ++++ .../ffmpeg/ffmpeg/CVE-2024-35367.patch | 47 +++++ .../ffmpeg/ffmpeg/CVE-2024-35368.patch | 41 +++++ .../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 3 + 17 files changed, 612 insertions(+), 30 deletions(-) create mode 100644 meta/recipes-devtools/binutils/binutils/0016-CVE-2024-53589.patch create mode 100644 meta/recipes-devtools/gcc/gcc/0028-gcc-Fix-c-tweak-for-Wrange-loop-construct.patch delete mode 100644 meta/recipes-devtools/python/python3/0001-gh-114492-Initialize-struct-termios-before-calling-t.patch create mode 100644 meta/recipes-devtools/rust/files/0001-cargo-do-not-write-host-information-into-compilation.patch create mode 100644 meta/recipes-devtools/subversion/subversion/CVE-2024-46901.patch create mode 100644 meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35366.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35367.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35368.patch -- 2.34.1 ^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2024-11-07 3:37 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for scarthgap and have comments back by
end of day Friday, November 8
Passed a-full on autobuilder:
https://valkyrie.yoctoproject.org/#/builders/29/builds/400
The following changes since commit bcd4e6d77dc7455a453e69b6d37769ec94cc02ad:
lsb-release: fix Distro Codename shell escaping (2024-10-24 06:09:29 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Aditya Tayade (1):
e2fsprogs: removed 'sed -u' option
Deepthi Hemraj (1):
rust-llvm: Fix CVE-2024-0151
Hiago De Franco (1):
weston: backport patch to allow neatvnc < v0.9.0
Martin Jansa (1):
python3-lxml=v5.0.2
Peter Marko (3):
cve-check: add support for cvss v4.0
go: upgrade 1.22.6 -> 1.22.7
go: upgrade 1.22.7 -> 1.22.8
Richard Purdie (1):
cve_check: Use a local copy of the database during builds
Vijay Anusuri (1):
xserver-xorg: upgrade 21.1.13 -> 21.1.14
Wang Mingyu (1):
orc: upgrade 0.4.39 -> 0.4.40
meta/classes/cve-check.bbclass | 16 +-
.../meta/cve-update-nvd2-native.bb | 32 +-
.../e2fsprogs/e2fsprogs/run-ptest | 3 +-
.../go/{go-1.22.6.inc => go-1.22.8.inc} | 2 +-
...e_1.22.6.bb => go-binary-native_1.22.8.bb} | 6 +-
..._1.22.6.bb => go-cross-canadian_1.22.8.bb} | 0
...{go-cross_1.22.6.bb => go-cross_1.22.8.bb} | 0
...osssdk_1.22.6.bb => go-crosssdk_1.22.8.bb} | 0
...runtime_1.22.6.bb => go-runtime_1.22.8.bb} | 0
.../go/{go_1.22.6.bb => go_1.22.8.bb} | 0
.../orc/{orc_0.4.39.bb => orc_0.4.40.bb} | 2 +-
...n3-lxml_5.0.0.bb => python3-lxml_5.0.2.bb} | 3 +-
.../0004-llvm-Fix-CVE-2024-0151.patch | 1086 +++++++++++++++++
.../recipes-devtools/rust/rust-llvm_1.75.0.bb | 3 +-
...1-vnc-Allow-neatvnc-in-version-0.8.0.patch | 27 +
.../recipes-graphics/wayland/weston_13.0.1.bb | 1 +
...org_21.1.13.bb => xserver-xorg_21.1.14.bb} | 2 +-
17 files changed, 1158 insertions(+), 25 deletions(-)
rename meta/recipes-devtools/go/{go-1.22.6.inc => go-1.22.8.inc} (89%)
rename meta/recipes-devtools/go/{go-binary-native_1.22.6.bb => go-binary-native_1.22.8.bb} (78%)
rename meta/recipes-devtools/go/{go-cross-canadian_1.22.6.bb => go-cross-canadian_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go-cross_1.22.6.bb => go-cross_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go-crosssdk_1.22.6.bb => go-crosssdk_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go-runtime_1.22.6.bb => go-runtime_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go_1.22.6.bb => go_1.22.8.bb} (100%)
rename meta/recipes-devtools/orc/{orc_0.4.39.bb => orc_0.4.40.bb} (92%)
rename meta/recipes-devtools/python/{python3-lxml_5.0.0.bb => python3-lxml_5.0.2.bb} (94%)
create mode 100644 meta/recipes-devtools/rust/rust-llvm/0004-llvm-Fix-CVE-2024-0151.patch
create mode 100644 meta/recipes-graphics/wayland/weston/0001-vnc-Allow-neatvnc-in-version-0.8.0.patch
rename meta/recipes-graphics/xorg-xserver/{xserver-xorg_21.1.13.bb => xserver-xorg_21.1.14.bb} (92%)
--
2.34.1
^ permalink raw reply [flat|nested] 19+ messages in thread* [OE-core][scarthgap 00/10] Patch review
@ 2024-08-08 2:28 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2024-08-08 2:28 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Friday, August 9
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7220
with the exception of a load related parsing failure on qemuarm64-armhost
which passed on subsequent re-test:
https://autobuilder.yoctoproject.org/typhoon/#/builders/97/builds/8717
The following changes since commit 136a25567499191b23a4d000a06bf83a473224ca:
rust: Add new varaible RUST_ENABLE_EXTRA_TOOLS (2024-08-03 11:45:57 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Archana Polampalli (1):
ffmpeg: fix CVE-2024-31582
Ashish Sharma (1):
bind: Upgrade 9.18.25 -> 9.18.28
Changqing Li (2):
curl: correct the PACKAGECONFIG for native/nativesdk
libpng: update SRC_URI
Peter Marko (4):
curl: Patch CVE-2024-6197
glibc: cleanup old cve status
qemu: set cve status for CVE-2023-6683
libmnl: explicitly disable doxygen
Richard Purdie (1):
nasm: Upgrade 2.16.01 -> 2.16.03
Wang Mingyu (1):
orc: upgrade 0.4.38 -> 0.4.39
.../bind/{bind_9.18.25.bb => bind_9.18.28.bb} | 2 +-
meta/recipes-core/glibc/glibc-version.inc | 2 --
.../nasm/{nasm_2.16.01.bb => nasm_2.16.03.bb} | 2 +-
.../orc/{orc_0.4.38.bb => orc_0.4.39.bb} | 2 +-
meta/recipes-devtools/qemu/qemu.inc | 2 ++
meta/recipes-extended/libmnl/libmnl_1.0.5.bb | 2 ++
.../ffmpeg/ffmpeg/CVE-2024-31582.patch | 34 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 1 +
.../libpng/libpng_1.6.42.bb | 2 +-
.../curl/curl/CVE-2024-6197.patch | 24 +++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 5 +--
11 files changed, 70 insertions(+), 8 deletions(-)
rename meta/recipes-connectivity/bind/{bind_9.18.25.bb => bind_9.18.28.bb} (97%)
rename meta/recipes-devtools/nasm/{nasm_2.16.01.bb => nasm_2.16.03.bb} (88%)
rename meta/recipes-devtools/orc/{orc_0.4.38.bb => orc_0.4.39.bb} (92%)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-31582.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-6197.patch
--
2.34.1
^ permalink raw reply [flat|nested] 19+ messages in thread* [OE-core][scarthgap 00/10] Patch review
@ 2024-06-11 13:07 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2024-06-11 13:07 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Thursday, June 13.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7024
The following changes since commit a3f5ac9f9fee2c8e10fec7c3f758e49513fef724:
git: set --with-gitconfig=/etc/gitconfig for -native builds (2024-05-31 14:02:17 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Deepthi Hemraj (1):
gcc : upgrade to v13.3
Lei Maohui (1):
run-postinsts.service: Removed --no-reload to fix reload warning when
users execute systemctl in the first boot.
Mark Hatle (1):
binutils: Fix aarch64 disassembly abort
Martin Hundeb?ll (1):
classes: image_types: quote variable assignment needed by dash
Robert Joslyn (1):
libgloss: Do not apply non-existent patch
Ross Burton (1):
gdk-pixbuf: upgrade 2.42.11 -> 2.42.12
Siddharth (1):
openssl: Upgrade 3.2.1 -> 3.2.2
Soumya Sambu (2):
util-linux: Fix CVE-2024-28085
git: upgrade 2.44.0 -> 2.44.1
Wang Mingyu (1):
gdk-pixbuf: upgrade 2.42.10 -> 2.42.11
meta/classes-recipe/image_types.bbclass | 2 +-
meta/conf/distro/include/maintainers.inc | 2 +-
.../openssl/openssl/CVE-2024-2511.patch | 120 -
.../openssl/openssl/CVE-2024-4603.patch | 179 -
.../openssl/openssl/bti.patch | 58 -
.../{openssl_3.2.1.bb => openssl_3.2.2.bb} | 5 +-
meta/recipes-core/newlib/libgloss_git.bb | 1 -
meta/recipes-core/util-linux/util-linux.inc | 2 +
.../util-linux/CVE-2024-28085-0001.patch | 36 +
.../util-linux/CVE-2024-28085-0002.patch | 34 +
.../binutils/binutils-2.42.inc | 1 +
...sserts-from-operand-qualifier-decode.patch | 382 ++
.../gcc/{gcc-13.2.inc => gcc-13.3.inc} | 9 +-
...ian_13.2.bb => gcc-cross-canadian_13.3.bb} | 0
.../{gcc-cross_13.2.bb => gcc-cross_13.3.bb} | 0
...-crosssdk_13.2.bb => gcc-crosssdk_13.3.bb} | 0
...cc-runtime_13.2.bb => gcc-runtime_13.3.bb} | 0
...itizers_13.2.bb => gcc-sanitizers_13.3.bb} | 0
...{gcc-source_13.2.bb => gcc-source_13.3.bb} | 0
...AMIC_LINKER-and-UCLIBC_DYNAMIC_LINKE.patch | 9 +-
...ch64-Fix-loose-ldpstp-check-PR111411.patch | 117 -
.../gcc/gcc/CVE-2023-4039.patch | 3093 -----------------
.../gcc/gcc/CVE-2024-0151.patch | 315 --
.../gcc/{gcc_13.2.bb => gcc_13.3.bb} | 0
...initial_13.2.bb => libgcc-initial_13.3.bb} | 0
.../gcc/{libgcc_13.2.bb => libgcc_13.3.bb} | 0
...ibgfortran_13.2.bb => libgfortran_13.3.bb} | 0
.../git/{git_2.44.0.bb => git_2.44.1.bb} | 2 +-
.../run-postinsts/run-postinsts.service | 2 +-
...w-a-subset-of-tests-in-cross-compile.patch | 10 +-
.../gdk-pixbuf/gdk-pixbuf/fatal-loader.patch | 7 +-
...ixbuf_2.42.10.bb => gdk-pixbuf_2.42.12.bb} | 2 +-
32 files changed, 479 insertions(+), 3909 deletions(-)
delete mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-2511.patch
delete mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-4603.patch
delete mode 100644 meta/recipes-connectivity/openssl/openssl/bti.patch
rename meta/recipes-connectivity/openssl/{openssl_3.2.1.bb => openssl_3.2.2.bb} (97%)
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0001.patch
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0002.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0016-aarch64-Remove-asserts-from-operand-qualifier-decode.patch
rename meta/recipes-devtools/gcc/{gcc-13.2.inc => gcc-13.3.inc} (94%)
rename meta/recipes-devtools/gcc/{gcc-cross-canadian_13.2.bb => gcc-cross-canadian_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-cross_13.2.bb => gcc-cross_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-crosssdk_13.2.bb => gcc-crosssdk_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-runtime_13.2.bb => gcc-runtime_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-sanitizers_13.2.bb => gcc-sanitizers_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-source_13.2.bb => gcc-source_13.3.bb} (100%)
delete mode 100644 meta/recipes-devtools/gcc/gcc/0026-aarch64-Fix-loose-ldpstp-check-PR111411.patch
delete mode 100644 meta/recipes-devtools/gcc/gcc/CVE-2023-4039.patch
delete mode 100644 meta/recipes-devtools/gcc/gcc/CVE-2024-0151.patch
rename meta/recipes-devtools/gcc/{gcc_13.2.bb => gcc_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc-initial_13.2.bb => libgcc-initial_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc_13.2.bb => libgcc_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{libgfortran_13.2.bb => libgfortran_13.3.bb} (100%)
rename meta/recipes-devtools/git/{git_2.44.0.bb => git_2.44.1.bb} (98%)
rename meta/recipes-gnome/gdk-pixbuf/{gdk-pixbuf_2.42.10.bb => gdk-pixbuf_2.42.12.bb} (98%)
--
2.34.1
^ permalink raw reply [flat|nested] 19+ messages in threadend of thread, other threads:[~2025-08-19 20:08 UTC | newest] Thread overview: 19+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2024-10-07 1:54 [OE-core][scarthgap 00/10] Patch review Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 01/10] gnupg: Document CVE-2022-3219 and mark wontfix Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 02/10] openssh: Mark CVE-2023-51767 as wont-fix Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 03/10] wpa-supplicant: Ignore CVE-2024-5290 Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 04/10] wpa-supplicant: Patch CVE-2024-3596 Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 05/10] wpa-supplicant: Patch security advisory 2024-2 Steve Sakoman 2024-10-07 1:54 ` [OE-core][scarthgap 06/10] glibc: stable 2.39 branch updates Steve Sakoman 2024-10-07 1:55 ` [OE-core][scarthgap 07/10] webkitgtk: upgrade 2.44.1 -> 2.44.3 Steve Sakoman 2024-10-07 1:55 ` [OE-core][scarthgap 08/10] cryptodev: upgrade 1.13 -> 1.14 Steve Sakoman 2024-10-07 1:55 ` [OE-core][scarthgap 09/10] populate_sdk_base: inherit nopackages Steve Sakoman 2024-10-07 1:55 ` [OE-core][scarthgap 10/10] meta-world-pkgdata: Inherit nopackages Steve Sakoman 2024-10-07 3:23 ` [OE-core][scarthgap 00/10] Patch review Khem Raj -- strict thread matches above, loose matches on Subject: below -- 2025-08-19 20:07 Steve Sakoman 2025-03-27 19:44 Steve Sakoman 2025-02-25 20:56 Steve Sakoman 2024-12-18 22:02 Steve Sakoman 2024-11-07 3:37 Steve Sakoman 2024-08-08 2:28 Steve Sakoman 2024-06-11 13:07 Steve Sakoman
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.