[PATCH] libseccomp: upgrade 2.6.0 -> 2.6.1

[PATCH] libseccomp: upgrade 2.6.0 -> 2.6.1

[Jaipaul Cheernam]

Changelog:
https://github.com/seccomp/libseccomp/blob/v2.6.1/CHANGELOG

git log --oneline v2.6.0..v2.6.1:
2f0f3b0e9121 tests: remove the fuzzer from test 62-sim-arch_transactions
7c3f80d95bcc doc: mention EINVAL in seccomp_transaction_start(3)
84005ecc603f hash: fix strict aliasing UB in MurMur hash implementation
dd759e8c4f56 api: fix seccomp_export_bpf_mem out-of-bounds read
8e31cd254be3 github: bump codeql version to @v3
38c524f982d4 gh: bump ubuntu 24.04
311cb32bcc4a tests: Skip tests 60 and 61 on x32
2d0ed0cbcc3b db: propagate notify_used when merging filter collections
7bf87a67bc87 db: Fix tab/space issue with previous commit
1e6797415029 doc: Add seccomp_transaction_start.3 to Makefile.am
c144002c9361 python: fix in-source python builds
4c21f22c31d1 doc: fix a missing CHANGELOG entry from v2.6.0
24033394ad69 tests: Fix shebang for python3
6abe14d1645e python: Fix shebang in setup.py
bcb9d0b35fa1 syscalls: fix s390 at Linux v6.18
792976a12e38 arch: Ignore comment lines in arch-syscall-validate
fea23415b090 syscalls: update syscall table to Linux v7.1.0-rc4
700b140cdd63 db: fix a copy-n-paste typo in _db_tree_add()
2d9db17cc0da bpf: properly reset/clear the bpf_program on error in _bpf_append_blk()
8d1f8a977177 helper: only clear memory on zrealloc() if the buffer grows
dc9fcd66d0c2 bpf: protect against addition overflows when building the filter
4121c0e04116 docs: update the CREDITS file
a81cc2de8ee7 doc: CHANGELOG entry for libseccomp v2.6.1

Drop 0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch [included in dd759e8c4f5685b526638fba9ec4fc24c37c9aec]

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 ...mp_export_bpf_mem-out-of-bounds-read.patch | 37 -------------------
 ...ibseccomp_2.6.0.bb => libseccomp_2.6.1.bb} |  3 +-
 2 files changed, 1 insertion(+), 39 deletions(-)
 delete mode 100644 meta/recipes-support/libseccomp/files/0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch
 rename meta/recipes-support/libseccomp/{libseccomp_2.6.0.bb => libseccomp_2.6.1.bb} (94%)

diff --git a/meta/recipes-support/libseccomp/files/0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch b/meta/recipes-support/libseccomp/files/0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch
deleted file mode 100644
index 0d2910846c..0000000000
--- a/meta/recipes-support/libseccomp/files/0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 83a56d74482ef6b6cc9311b14bf9ea23573f5d4e Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Thu, 13 Feb 2025 12:05:17 +0100
-Subject: [PATCH] api: fix seccomp_export_bpf_mem out-of-bounds read
-
-*len is the length of the destination buffer, but program->blks is
-probably not anywhere near that long.  It's already been checked above
-that BPF_PGM_SIZE(program) is less than or equal to *len, so that's
-the correct value to use here to avoid either reading or writing too
-much.
-
-I noticed this because tests/11-basic-basic_errors started failing on
-musl after e797591 ("all: add seccomp_precompute() functionality").
-
-Upstream-Status: Backport [https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec]
-Signed-off-by: Alyssa Ross <hi@alyssa.is>
-Acked-by: Tom Hromatka <tom.hromatka@oracle.com>
-Signed-off-by: Paul Moore <paul@paul-moore.com>
-(imported from commit e8dbc6b555fb936bdfb8ab86f9a45fda96a8b7a2)
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- src/api.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/api.c b/src/api.c
-index adccef3..65a277a 100644
---- a/src/api.c
-+++ b/src/api.c
-@@ -786,7 +786,7 @@ API int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf,
- 		if (BPF_PGM_SIZE(program) > *len)
- 			rc = _rc_filter(-ERANGE);
- 		else
--			memcpy(buf, program->blks, *len);
-+			memcpy(buf, program->blks, BPF_PGM_SIZE(program));
- 	}
- 	*len = BPF_PGM_SIZE(program);
- 
diff --git a/meta/recipes-support/libseccomp/libseccomp_2.6.0.bb b/meta/recipes-support/libseccomp/libseccomp_2.6.1.bb
similarity index 94%
rename from meta/recipes-support/libseccomp/libseccomp_2.6.0.bb
rename to meta/recipes-support/libseccomp/libseccomp_2.6.1.bb
index 44260e3032..5db0381ae9 100644
--- a/meta/recipes-support/libseccomp/libseccomp_2.6.0.bb
+++ b/meta/recipes-support/libseccomp/libseccomp_2.6.1.bb
@@ -7,10 +7,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=7c13b3376cea0ce68d2d2da0a1b3a72c"
 
 DEPENDS += "gperf-native"
 
-SRCREV = "c7c0caed1d04292500ed4b9bb386566053eb9775"
+SRCREV = "a81cc2de8ee7a33633defc88bb8a2d986b421613"
 
 SRC_URI = "git://github.com/seccomp/libseccomp.git;branch=release-2.6;protocol=https;tag=v${PV} \
-           file://0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch \
            file://run-ptest \
            "
 

Patchtest results for [PATCH] libseccomp: upgrade 2.6.0 -> 2.6.1

[patchtest]

[-- Attachment #1: Type: text/plain, Size: 3044 bytes --]

Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:

---
Testing patch /home/patchtest/share/mboxes/libseccomp-upgrade-2.6.0---2.6.1.patch

FAIL: test commit message user tags: Mbox includes one or more GitHub-style username tags. Ensure that any "@" symbols are stripped out of usernames (test_mbox.TestMbox.test_commit_message_user_tags)

PASS: pretest src uri left files (test_metadata.TestMetadata.pretest_src_uri_left_files)
PASS: test CVE check ignore (test_metadata.TestMetadata.test_cve_check_ignore)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test lic files chksum modified not mentioned (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
PASS: test src uri left files (test_metadata.TestMetadata.test_src_uri_left_files)
PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list)

SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)

---

Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!

Re: Patchtest results for [PATCH] libseccomp: upgrade 2.6.0 -> 2.6.1

[Jaipaul Cheernam]

[-- Attachment #1: Type: text/plain, Size: 3950 bytes --]

 Hi,

This is a false positive. The @v3 flagged by patchtest is from a verbatim upstream git log entry:

  8e31cd254be3 github: bump codeql version to @v3

It refers to a GitHub Actions version tag (actions/codeql-action@v3), not a GitHub username mention. I'd prefer to keep the upstream log intact rather than modify it.

Happy to resend with the @ stripped if maintainers prefer, but wanted to flag this as a patchtest false positive that might be worth addressing in the test itself.

Thanks,
 Jaipaul


From: patchtest@automation.yoctoproject.org <patchtest@automation.yoctoproject.org>
Date: Thursday, 23 July 2026 at 16:31
To: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Cc: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Patchtest results for [PATCH] libseccomp: upgrade 2.6.0 -> 2.6.1

Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:

---
Testing patch /home/patchtest/share/mboxes/libseccomp-upgrade-2.6.0---2.6.1.patch

FAIL: test commit message user tags: Mbox includes one or more GitHub-style username tags. Ensure that any "@" symbols are stripped out of usernames (test_mbox.TestMbox.test_commit_message_user_tags)

PASS: pretest src uri left files (test_metadata.TestMetadata.pretest_src_uri_left_files)
PASS: test CVE check ignore (test_metadata.TestMetadata.test_cve_check_ignore)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test lic files chksum modified not mentioned (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
PASS: test src uri left files (test_metadata.TestMetadata.test_src_uri_left_files)
PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list)

SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)

---

Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!

[-- Attachment #2: Type: text/html, Size: 7378 bytes --]

Re: [OE-core] Patchtest results for [PATCH] libseccomp: upgrade 2.6.0 -> 2.6.1

[Quentin Schulz]

Hi Jaipaul,

On 7/23/26 4:58 PM, Jaipaul Cheernam via lists.openembedded.org wrote:
>   Hi,
> 
> This is a false positive. The @v3 flagged by patchtest is from a verbatim upstream git log entry:
> 
>    8e31cd254be3 github: bump codeql version to @v3
> 
> It refers to a GitHub Actions version tag (actions/codeql-action@v3), not a GitHub username mention. I'd prefer to keep the upstream log intact rather than modify it.
> 

That's not the point. The point is that GitHub is stupid and will notify 
any GitHub user wherever and whenever their username appears in commit 
logs on GitHub. Considering we mirror our various git repos on GitHub, 
we have decided to stop having @xxx in commit logs due to many people 
complaining to us.

v3 is actually a valid GitHub username, see https://github.com/v3.

> Happy to resend with the @ stripped if maintainers prefer, but wanted to flag this as a patchtest false positive that might be worth addressing in the test itself.
> 

Please send a v2 with this fixed.

Thanks!
Quentin

Re: [PATCH] libseccomp: upgrade 2.6.0 -> 2.6.1

[Jaipaul Cheernam]

[-- Attachment #1: Type: text/plain, Size: 519 bytes --]

Hi,

This is a false positive. The @v3 flagged by patchtest is from a verbatim upstream git log entry:

8e31cd254be3 github: bump codeql version to @v3

It refers to a GitHub Actions version tag (actions/codeql-action@v3), not a GitHub username mention.

I'd prefer to keep the upstream log intact rather than modify it.

Happy to resend with the @ stripped if maintainers prefer, but wanted to flag this as a patchtest false positive that might be worth addressing in the test itself.

Thanks,
Jaipaul

[-- Attachment #2: Type: text/html, Size: 2327 bytes --]

[PATCH v2] libseccomp: upgrade 2.6.0 -> 2.6.1

[Jaipaul Cheernam]

Changelog:
https://github.com/seccomp/libseccomp/blob/v2.6.1/CHANGELOG

git log --oneline v2.6.0..v2.6.1:
2f0f3b0e9121 tests: remove the fuzzer from test 62-sim-arch_transactions
7c3f80d95bcc doc: mention EINVAL in seccomp_transaction_start(3)
84005ecc603f hash: fix strict aliasing UB in MurMur hash implementation
dd759e8c4f56 api: fix seccomp_export_bpf_mem out-of-bounds read
8e31cd254be3 github: bump codeql version to v3
38c524f982d4 gh: bump ubuntu 24.04
311cb32bcc4a tests: Skip tests 60 and 61 on x32
2d0ed0cbcc3b db: propagate notify_used when merging filter collections
7bf87a67bc87 db: Fix tab/space issue with previous commit
1e6797415029 doc: Add seccomp_transaction_start.3 to Makefile.am
c144002c9361 python: fix in-source python builds
4c21f22c31d1 doc: fix a missing CHANGELOG entry from v2.6.0
24033394ad69 tests: Fix shebang for python3
6abe14d1645e python: Fix shebang in setup.py
bcb9d0b35fa1 syscalls: fix s390 at Linux v6.18
792976a12e38 arch: Ignore comment lines in arch-syscall-validate
fea23415b090 syscalls: update syscall table to Linux v7.1.0-rc4
700b140cdd63 db: fix a copy-n-paste typo in _db_tree_add()
2d9db17cc0da bpf: properly reset/clear the bpf_program on error in _bpf_append_blk()
8d1f8a977177 helper: only clear memory on zrealloc() if the buffer grows
dc9fcd66d0c2 bpf: protect against addition overflows when building the filter
4121c0e04116 docs: update the CREDITS file
a81cc2de8ee7 doc: CHANGELOG entry for libseccomp v2.6.1

Note: GitHub-style username tag removed from upstream log entry to
avoid unintended notifications on mirrored repos.

Drop 0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch [included in dd759e8c4f5685b526638fba9ec4fc24c37c9aec]

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
Changes in v2:
- Removed GitHub-style username tag from upstream log entry to avoid
  unintended notifications on mirrored repos.
---
 ...mp_export_bpf_mem-out-of-bounds-read.patch | 37 -------------------
 ...ibseccomp_2.6.0.bb => libseccomp_2.6.1.bb} |  3 +-
 2 files changed, 1 insertion(+), 39 deletions(-)
 delete mode 100644 meta/recipes-support/libseccomp/files/0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch
 rename meta/recipes-support/libseccomp/{libseccomp_2.6.0.bb => libseccomp_2.6.1.bb} (94%)

diff --git a/meta/recipes-support/libseccomp/files/0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch b/meta/recipes-support/libseccomp/files/0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch
deleted file mode 100644
index 0d2910846c..0000000000
--- a/meta/recipes-support/libseccomp/files/0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 83a56d74482ef6b6cc9311b14bf9ea23573f5d4e Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Thu, 13 Feb 2025 12:05:17 +0100
-Subject: [PATCH] api: fix seccomp_export_bpf_mem out-of-bounds read
-
-*len is the length of the destination buffer, but program->blks is
-probably not anywhere near that long.  It's already been checked above
-that BPF_PGM_SIZE(program) is less than or equal to *len, so that's
-the correct value to use here to avoid either reading or writing too
-much.
-
-I noticed this because tests/11-basic-basic_errors started failing on
-musl after e797591 ("all: add seccomp_precompute() functionality").
-
-Upstream-Status: Backport [https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec]
-Signed-off-by: Alyssa Ross <hi@alyssa.is>
-Acked-by: Tom Hromatka <tom.hromatka@oracle.com>
-Signed-off-by: Paul Moore <paul@paul-moore.com>
-(imported from commit e8dbc6b555fb936bdfb8ab86f9a45fda96a8b7a2)
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- src/api.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/api.c b/src/api.c
-index adccef3..65a277a 100644
---- a/src/api.c
-+++ b/src/api.c
-@@ -786,7 +786,7 @@ API int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf,
- 		if (BPF_PGM_SIZE(program) > *len)
- 			rc = _rc_filter(-ERANGE);
- 		else
--			memcpy(buf, program->blks, *len);
-+			memcpy(buf, program->blks, BPF_PGM_SIZE(program));
- 	}
- 	*len = BPF_PGM_SIZE(program);
- 
diff --git a/meta/recipes-support/libseccomp/libseccomp_2.6.0.bb b/meta/recipes-support/libseccomp/libseccomp_2.6.1.bb
similarity index 94%
rename from meta/recipes-support/libseccomp/libseccomp_2.6.0.bb
rename to meta/recipes-support/libseccomp/libseccomp_2.6.1.bb
index 44260e3032..5db0381ae9 100644
--- a/meta/recipes-support/libseccomp/libseccomp_2.6.0.bb
+++ b/meta/recipes-support/libseccomp/libseccomp_2.6.1.bb
@@ -7,10 +7,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=7c13b3376cea0ce68d2d2da0a1b3a72c"
 
 DEPENDS += "gperf-native"
 
-SRCREV = "c7c0caed1d04292500ed4b9bb386566053eb9775"
+SRCREV = "a81cc2de8ee7a33633defc88bb8a2d986b421613"
 
 SRC_URI = "git://github.com/seccomp/libseccomp.git;branch=release-2.6;protocol=https;tag=v${PV} \
-           file://0001-api-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch \
            file://run-ptest \
            "