[wrynose][PATCH 0/7] stable updates for wrynose

[wrynose][PATCH 0/7] stable updates for wrynose

[daniel.turull]

From: Daniel Turull <daniel.turull@ericsson.com>

Following the new stable policy and the work with the
auto-upgrade-helper I did run it against wrynose for the already
approved packages.

Used AI to resolve the build errors.

Fixes needed on top of the AUH output:
- util-linux: include linux/openat2.h in libmount hook_idmap.c
- lttng-tools: disable-tests.patch also drops test_rotation
- lttng-modules, perl, libgcrypt: redundant backports/CVE patches
  dropped (already upstream); libgcrypt LIC_FILES_CHKSUM updated
No changes: glib-2.0, openssl, python3, xz, lttng-ust.

I left systemd and perl for the next series.

Tests (qemux86-64, glibc and musl): do_compile of all recipes;
testimage with ping, ssh, systemd runtime tests and ptest for
openssl, util-linux, lttng-tools, libgcrypt, xz: all passed on
both. Not run: ptest for glib-2.0 and python3, other architectures,
lttng-tools regression suite on musl (disabled in the recipe, lttng
bug 1432).
Note: lttng-tools test_blocking needs 1 GB in /tmp (QB_MEM 4096).

Daniel Turull (7):
  xz: upgrade 5.8.2 -> 5.8.4
  glib-2.0-initial,glib-2.0: upgrade 2.88.2 -> 2.88.4
  python3: upgrade 3.14.7 -> 3.14.8
  lttng-modules: upgrade 2.14.4 -> 2.14.7
  lttng-tools: upgrade 2.14.1 -> 2.14.3
  lttng-ust: upgrade 2.14.0 -> 2.14.3
  libgcrypt: upgrade 1.12.1 -> 1.12.4

 ...l_2.88.2.bb => glib-2.0-initial_2.88.4.bb} |   0
 ...{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb} |   0
 meta/recipes-core/glib-2.0/glib.inc           |   2 +-
 .../{python3_3.14.7.bb => python3_3.14.8.bb}  |   2 +-
 ...buffer-overflow-in-lzma_index_append.patch |  66 ----
 .../xz/{xz_5.8.2.bb => xz_5.8.4.bb}           |   3 +-
 ...st-range-in-btrfs-probe-for-v6.18.14.patch |  36 --
 ...ce-trace-noise-in-hrtimer_start-v7.1.patch | 103 ------
 ...ules_2.14.4.bb => lttng-modules_2.14.7.bb} |   4 +-
 .../lttng/lttng-tools/disable-tests.patch     |  11 +-
 ...-tools_2.14.1.bb => lttng-tools_2.14.3.bb} |   2 +-
 ...ttng-ust_2.14.0.bb => lttng-ust_2.14.3.bb} |   2 +-
 ...s-Fix-link-errors-for-t-thread-local.patch |  13 +-
 .../libgcrypt/files/CVE-2026-41989.patch      |  42 ---
 .../libgcrypt/files/CVE-2026-41990.patch      | 316 ------------------
 ...ibgcrypt_1.12.1.bb => libgcrypt_1.12.4.bb} |   6 +-
 16 files changed, 19 insertions(+), 589 deletions(-)
 rename meta/recipes-core/glib-2.0/{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb} (100%)
 rename meta/recipes-core/glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb} (100%)
 rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (99%)
 delete mode 100644 meta/recipes-extended/xz/xz/0001-liblzma-Fix-a-buffer-overflow-in-lzma_index_append.patch
 rename meta/recipes-extended/xz/{xz_5.8.2.bb => xz_5.8.4.bb} (95%)
 delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0001-fix-adjust-range-in-btrfs-probe-for-v6.18.14.patch
 delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0001-fix-hrtimer-Reduce-trace-noise-in-hrtimer_start-v7.1.patch
 rename meta/recipes-kernel/lttng/{lttng-modules_2.14.4.bb => lttng-modules_2.14.7.bb} (87%)
 rename meta/recipes-kernel/lttng/{lttng-tools_2.14.1.bb => lttng-tools_2.14.3.bb} (99%)
 rename meta/recipes-kernel/lttng/{lttng-ust_2.14.0.bb => lttng-ust_2.14.3.bb} (96%)
 delete mode 100644 meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch
 delete mode 100644 meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch
 rename meta/recipes-support/libgcrypt/{libgcrypt_1.12.1.bb => libgcrypt_1.12.4.bb} (89%)

[wrynose][PATCH 1/7] xz: upgrade 5.8.2 -> 5.8.4

[daniel.turull]

From: Daniel Turull <daniel.turull@ericsson.com>

Security fixes in 5.8.3-5.8.4:
- CVE-2026-34743: buffer overflow in lzma_index_append() when
  appending records to an lzma_index decoded from an Index with no
  Records
- GHSA-5qpq-xqfv-j9pg: invalid memory access in the alone/lzip/auto/
  microlzma decoders when reinitializing after a failed allocation
- xz: use-after-free showing an error message for --files/--files0
  from XZ_OPT/XZ_DEFAULTS, and another use-after-free with --verbose
  when stderr isn't a terminal

The carried backport of the CVE-2026-34743 fix is dropped: it is
included in 5.8.3 and applying it again duplicated the check in
lzma_index_prealloc().

Other fixes: lzma_index_cat() performance/overflow, lzma_memused()
misreporting, lzma_index_dup() check-type copying, threaded decoder
progress sync, Landlock ABI 9 support.

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 ...buffer-overflow-in-lzma_index_append.patch | 66 -------------------
 .../xz/{xz_5.8.2.bb => xz_5.8.4.bb}           |  3 +-
 2 files changed, 1 insertion(+), 68 deletions(-)
 delete mode 100644 meta/recipes-extended/xz/xz/0001-liblzma-Fix-a-buffer-overflow-in-lzma_index_append.patch
 rename meta/recipes-extended/xz/{xz_5.8.2.bb => xz_5.8.4.bb} (95%)

diff --git a/meta/recipes-extended/xz/xz/0001-liblzma-Fix-a-buffer-overflow-in-lzma_index_append.patch b/meta/recipes-extended/xz/xz/0001-liblzma-Fix-a-buffer-overflow-in-lzma_index_append.patch
deleted file mode 100644
index d3918233ea..0000000000
--- a/meta/recipes-extended/xz/xz/0001-liblzma-Fix-a-buffer-overflow-in-lzma_index_append.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From c8c22869e780ff57c96b46939c3d79ff99395f87 Mon Sep 17 00:00:00 2001
-From: Lasse Collin <lasse.collin@tukaani.org>
-Date: Sun, 29 Mar 2026 19:11:21 +0300
-Subject: [PATCH] liblzma: Fix a buffer overflow in lzma_index_append()
-
-If lzma_index_decoder() was used to decode an Index that contained no
-Records, the resulting lzma_index had an invalid internal "prealloc"
-value. If lzma_index_append() was called on this lzma_index, too
-little memory would be allocated and a buffer overflow would occur.
-
-While this combination of the API functions is meant to work, in the
-real-world apps this call sequence is rare or might not exist at all.
-
-This bug is older than xz 5.0.0, so all stable releases are affected.
-
-Reported-by: GitHub user christos-spearbit
-
-CVE: CVE-2026-34743
-Upstream-Status: Backport [https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87]
-Signed-off-by: Ross Burton <ross.burton@arm.com>
----
- src/liblzma/common/index.c | 21 +++++++++++++++++++++
- 1 file changed, 21 insertions(+)
-
-diff --git a/src/liblzma/common/index.c b/src/liblzma/common/index.c
-index 6add6a68..c4aadb9b 100644
---- a/src/liblzma/common/index.c
-+++ b/src/liblzma/common/index.c
-@@ -433,6 +433,26 @@ lzma_index_prealloc(lzma_index *i, lzma_vli records)
- 	if (records > PREALLOC_MAX)
- 		records = PREALLOC_MAX;
- 
-+	// If index_decoder.c calls us with records == 0, it's decoding
-+	// an Index that has no Records. In that case the decoder won't call
-+	// lzma_index_append() at all, and i->prealloc isn't used during
-+	// the Index decoding either.
-+	//
-+	// Normally the first lzma_index_append() call from the Index decoder
-+	// would reset i->prealloc to INDEX_GROUP_SIZE. With no Records,
-+	// lzma_index_append() isn't called and the resetting of prealloc
-+	// won't occur either. Thus, if records == 0, use the default value
-+	// INDEX_GROUP_SIZE instead.
-+	//
-+	// NOTE: lzma_index_append() assumes i->prealloc > 0. liblzma <= 5.8.2
-+	// didn't have this check and could set i->prealloc = 0, which would
-+	// result in a buffer overflow if the application called
-+	// lzma_index_append() after decoding an empty Index. Appending
-+	// Records after decoding an Index is a rare thing to do, but
-+	// it is supposed to work.
-+	if (records == 0)
-+		records = INDEX_GROUP_SIZE;
-+
- 	i->prealloc = (size_t)(records);
- 	return;
- }
-@@ -685,6 +705,7 @@ lzma_index_append(lzma_index *i, const lzma_allocator *allocator,
- 		++g->last;
- 	} else {
- 		// We need to allocate a new group.
-+		assert(i->prealloc > 0);
- 		g = lzma_alloc(sizeof(index_group)
- 				+ i->prealloc * sizeof(index_record),
- 				allocator);
--- 
-2.43.0
-
diff --git a/meta/recipes-extended/xz/xz_5.8.2.bb b/meta/recipes-extended/xz/xz_5.8.4.bb
similarity index 95%
rename from meta/recipes-extended/xz/xz_5.8.2.bb
rename to meta/recipes-extended/xz/xz_5.8.4.bb
index 5e7ad1fc70..1c0e972c39 100644
--- a/meta/recipes-extended/xz/xz_5.8.2.bb
+++ b/meta/recipes-extended/xz/xz_5.8.4.bb
@@ -26,10 +26,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d38d562f6112174de93a9677682231b2 \
                     "
 
 SRC_URI = "https://github.com/tukaani-project/xz/releases/download/v${PV}/xz-${PV}.tar.gz \
-           file://0001-liblzma-Fix-a-buffer-overflow-in-lzma_index_append.patch \
            file://run-ptest \
           "
-SRC_URI[sha256sum] = "ce09c50a5962786b83e5da389c90dd2c15ecd0980a258dd01f70f9e7ce58a8f1"
+SRC_URI[sha256sum] = "0014c7886930454fe8bd4228665b51af55eeae560ea135c9c4cd33f55b2591d9"
 UPSTREAM_CHECK_REGEX = "releases/tag/v(?P<pver>\d+(\.\d+)+)"
 UPSTREAM_CHECK_URI = "https://github.com/tukaani-project/xz/releases/"
 

[wrynose][PATCH 2/7] glib-2.0-initial,glib-2.0: upgrade 2.88.2 -> 2.88.4

[daniel.turull]

From: Daniel Turull <daniel.turull@ericsson.com>

Changes in 2.88.3-2.88.4 (per NEWS):
- CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded
  SASL line buffering
- Security hardening backport: overflow/bounds checks in
  GSocketAddress, Unicode normalization, GResource, GVariant,
  logging, and GMarkup error paths
- Fix miscompilation with GCC 17 caused by G_GNUC_CONST on
  get_type() functions
- Fix handling of long filenames when moving files to trash

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 .../{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb}  | 0
 .../glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb}         | 0
 meta/recipes-core/glib-2.0/glib.inc                             | 2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/glib-2.0/{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb} (100%)
 rename meta/recipes-core/glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb} (100%)

diff --git a/meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.2.bb b/meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.4.bb
similarity index 100%
rename from meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.2.bb
rename to meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.4.bb
diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.88.2.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.88.4.bb
similarity index 100%
rename from meta/recipes-core/glib-2.0/glib-2.0_2.88.2.bb
rename to meta/recipes-core/glib-2.0/glib-2.0_2.88.4.bb
diff --git a/meta/recipes-core/glib-2.0/glib.inc b/meta/recipes-core/glib-2.0/glib.inc
index cad74f53f7..7e7725f9bd 100644
--- a/meta/recipes-core/glib-2.0/glib.inc
+++ b/meta/recipes-core/glib-2.0/glib.inc
@@ -242,7 +242,7 @@ SRC_URI:append:class-native = " file://relocate-modules.patch \
                                 file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \
                               "
 
-SRC_URI[archive.sha256sum] = "cf3f215a640c8a4257f14317586b8f1fdd25a10a93cb4bdda147c0f9ad88e74f"
+SRC_URI[archive.sha256sum] = "25fd169f3b2f91fe2391ad297883ce0fcf30c69fc789ffd1c9672d1332b1c5a8"
 
 # Find any meson cross files in FILESPATH that are relevant for the current
 # build (using siteinfo) and add them to EXTRA_OEMESON.

Re: [OE-core] [wrynose][PATCH 2/7] glib-2.0-initial,glib-2.0: upgrade 2.88.2 -> 2.88.4

[Yoann Congal]

On Tue Oct 20, 2026 at 10:26 AM CEST, Daniel Turull via lists.openembedded.org wrote:
> From: Daniel Turull <daniel.turull@ericsson.com>
>
> Changes in 2.88.3-2.88.4 (per NEWS):
> - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded
>   SASL line buffering
> - Security hardening backport: overflow/bounds checks in
>   GSocketAddress, Unicode normalization, GResource, GVariant,
>   logging, and GMarkup error paths
> - Fix miscompilation with GCC 17 caused by G_GNUC_CONST on
>   get_type() functions
> - Fix handling of long filenames when moving files to trash
>
> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> ---
>  .../{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb}  | 0
>  .../glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb}         | 0
>  meta/recipes-core/glib-2.0/glib.inc                             | 2 +-
>  3 files changed, 1 insertion(+), 1 deletion(-)
>  rename meta/recipes-core/glib-2.0/{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb} (100%)
>  rename meta/recipes-core/glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb} (100%)

Hello,

I already reviewed Peter's upgrade to .3.
Can you rebase on top of it[0]? Only this single patch, I took the others
of the series into my review branch.

[0]: https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review

Thanks,
-- 
Yoann Congal
Smile ECS

Re: [OE-core] [wrynose][PATCH 2/7] glib-2.0-initial,glib-2.0: upgrade 2.88.2 -> 2.88.4

[Daniel Turull]

On Tue, 2026-10-20 at 11:21 +0200, Yoann Congal via lists.openembedded.org
wrote:
> On Tue Oct 20, 2026 at 10:26 AM CEST, Daniel Turull via lists.openembedded.org wrote:
> > From: Daniel Turull <daniel.turull@ericsson.com>
> >
> > Changes in 2.88.3-2.88.4 (per NEWS):
> > - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded
> >   SASL line buffering
> > - Security hardening backport: overflow/bounds checks in
> >   GSocketAddress, Unicode normalization, GResource, GVariant,
> >   logging, and GMarkup error paths
> > - Fix miscompilation with GCC 17 caused by G_GNUC_CONST on
> >   get_type() functions
> > - Fix handling of long filenames when moving files to trash
> >
> > Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> > ---
> >  .../{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb}  | 0
> >  .../glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb}         | 0
> >  meta/recipes-core/glib-2.0/glib.inc                             | 2 +-
> >  3 files changed, 1 insertion(+), 1 deletion(-)
> >  rename meta/recipes-core/glib-2.0/{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.4.bb} (100%)
> >  rename meta/recipes-core/glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.4.bb} (100%)
>
> Hello,
>
> I already reviewed Peter's upgrade to .3.
> Can you rebase on top of it[0]? Only this single patch, I took the others
> of the series into my review branch.
>
> [0]: https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review
>

Yes, I'll send a single patch with the rebase for glib

Daniel
> Thanks,
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#248256): https://lists.openembedded.org/g/openembedded-core/message/248256
> Mute This Topic: https://lists.openembedded.org/mt/121845917/6330526
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [daniel.turull@ericsson.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>

[wrynose][PATCH 3/7] python3: upgrade 3.14.7 -> 3.14.8

[daniel.turull]

From: Daniel Turull <daniel.turull@ericsson.com>

Security fixes in 3.14.8:
- CVE-2026-19445: crash in ssl when sni_callback switches SSLContext
  and the original context is no longer referenced
- CVE-2026-15806: scope HTTPPasswordMgr credentials to the URL scheme
  so HTTPS credentials aren't reused for a matching HTTP URL
- asyncio/ssl: validate server_hostname when check_hostname is set,
  for start_tls(), create_connection() and SSLContext.wrap_bio()
- zipfile: bound decompressed data per read for bzip2/LZMA/Zstandard
  members, matching the existing deflate limit
- tarfile: fix extraction filters creating directories outside the
  destination for names that leave and re-enter it
- Bundle libexpat 2.8.5

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 .../python/{python3_3.14.7.bb => python3_3.14.8.bb}             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (99%)

diff --git a/meta/recipes-devtools/python/python3_3.14.7.bb b/meta/recipes-devtools/python/python3_3.14.8.bb
similarity index 99%
rename from meta/recipes-devtools/python/python3_3.14.7.bb
rename to meta/recipes-devtools/python/python3_3.14.8.bb
index e73dc8d772..99152fcb2b 100644
--- a/meta/recipes-devtools/python/python3_3.14.7.bb
+++ b/meta/recipes-devtools/python/python3_3.14.8.bb
@@ -40,7 +40,7 @@ SRC_URI:append:class-native = " \
            file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
            "
 
-SRC_URI[sha256sum] = "3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81"
+SRC_URI[sha256sum] = "c2215904f02b175596dc49351585104f4bc20341e1c47378b26a2c274360ce73"
 
 # exclude pre-releases for both python 2.x and 3.x
 UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"

Re: [OE-core] [wrynose][PATCH 3/7] python3: upgrade 3.14.7 -> 3.14.8

[Yoann Congal]

On Tue Oct 20, 2026 at 10:26 AM CEST, Daniel Turull via lists.openembedded.org wrote:
> From: Daniel Turull <daniel.turull@ericsson.com>
>
> Security fixes in 3.14.8:
> - CVE-2026-19445: crash in ssl when sni_callback switches SSLContext
>   and the original context is no longer referenced
> - CVE-2026-15806: scope HTTPPasswordMgr credentials to the URL scheme
>   so HTTPS credentials aren't reused for a matching HTTP URL
> - asyncio/ssl: validate server_hostname when check_hostname is set,
>   for start_tls(), create_connection() and SSLContext.wrap_bio()
> - zipfile: bound decompressed data per read for bzip2/LZMA/Zstandard
>   members, matching the existing deflate limit
> - tarfile: fix extraction filters creating directories outside the
>   destination for names that leave and re-enter it
> - Bundle libexpat 2.8.5
>
> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> ---
>  .../python/{python3_3.14.7.bb => python3_3.14.8.bb}             | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>  rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.8.bb} (99%)

That would put wrynose ahead of master.
I'll hold this one until master/blacksail are upgraded.

Regards,
-- 
Yoann Congal
Smile ECS

[wrynose][PATCH 4/7] lttng-modules: upgrade 2.14.4 -> 2.14.7

[daniel.turull]

From: Daniel Turull <daniel.turull@ericsson.com>

Changes 2.14.5-2.14.7 (from ChangeLog):
- fix: adjust range in btrfs probe for v6.18.14
- fix: ASoC: soc-dapm: move struct snd_soc_dapm_context (v7.0)
- Fix: kallsyms on powerpc64 with ABI V1
- fix: hrtimer: Reduce trace noise in hrtimer_start() (v7.1, v6.1.175,
  Ubuntu-6.8.0-136)
- fix: ext4/vfs/btrfs/mm tracepoint updates for newer kernels
- fix: leaked file and fd on channel create error
- fix: warning -Wordered-compare-function-pointers / -Wcast-function-type-strict
  with LLVM
- Fix: ring buffer: zeroed UUID in populated empty packet headers

Two carried patches backport the hrtimer and btrfs fixes above
(b77f94c7a7, de7ca66c797), now redundant since both are in 2.14.7
natively; drop them. Only the OE-specific Kbuild
CONFIG_TRACEPOINTS-to-warning patch is kept.

Verified do_compile succeeds.

AI-Generated: Uses Kiro with Claude Sonnet 5
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 ...st-range-in-btrfs-probe-for-v6.18.14.patch |  36 ------
 ...ce-trace-noise-in-hrtimer_start-v7.1.patch | 103 ------------------
 ...ules_2.14.4.bb => lttng-modules_2.14.7.bb} |   4 +-
 3 files changed, 1 insertion(+), 142 deletions(-)
 delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0001-fix-adjust-range-in-btrfs-probe-for-v6.18.14.patch
 delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0001-fix-hrtimer-Reduce-trace-noise-in-hrtimer_start-v7.1.patch
 rename meta/recipes-kernel/lttng/{lttng-modules_2.14.4.bb => lttng-modules_2.14.7.bb} (87%)

diff --git a/meta/recipes-kernel/lttng/lttng-modules/0001-fix-adjust-range-in-btrfs-probe-for-v6.18.14.patch b/meta/recipes-kernel/lttng/lttng-modules/0001-fix-adjust-range-in-btrfs-probe-for-v6.18.14.patch
deleted file mode 100644
index 662a803680..0000000000
--- a/meta/recipes-kernel/lttng/lttng-modules/0001-fix-adjust-range-in-btrfs-probe-for-v6.18.14.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From de7ca66c797ba0b3273a217a47c8fb791d896f7c Mon Sep 17 00:00:00 2001
-From: Michael Jeanson <mjeanson@efficios.com>
-Date: Fri, 27 Feb 2026 17:54:39 -0500
-Subject: [PATCH] fix: adjust range in btrfs probe for v6.18.14
-
-Upstream commit c5667f9c8eb9 ("btrfs: headers cleanup to remove
-unnecessary local includes") was backported in v6.18.14, adjust the
-range accordingly in the btrfs probe.
-
-Upstream-Status: Backport from commit ca93dc3b05fcb
-
-Change-Id: I51c5cb6345c6a1e1aa4e5e3cb9a4af2ec962ecb2
-Signed-off-by: Michael Jeanson <mjeanson@efficios.com>
-Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
-Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
----
- include/instrumentation/events/btrfs.h | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/include/instrumentation/events/btrfs.h b/include/instrumentation/events/btrfs.h
-index feb4f40b..e87f0085 100644
---- a/include/instrumentation/events/btrfs.h
-+++ b/include/instrumentation/events/btrfs.h
-@@ -12,7 +12,8 @@
- #include <linux/writeback.h>
- #include <lttng/kernel-version.h>
- 
--#if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(6,19,0))
-+#if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(6,19,0) || \
-+	LTTNG_KERNEL_RANGE(6,18,14, 6,19,0))
- #include <../fs/btrfs/ordered-data.h>
- #endif
- 
--- 
-2.47.3
-
diff --git a/meta/recipes-kernel/lttng/lttng-modules/0001-fix-hrtimer-Reduce-trace-noise-in-hrtimer_start-v7.1.patch b/meta/recipes-kernel/lttng/lttng-modules/0001-fix-hrtimer-Reduce-trace-noise-in-hrtimer_start-v7.1.patch
deleted file mode 100644
index a6fe47737e..0000000000
--- a/meta/recipes-kernel/lttng/lttng-modules/0001-fix-hrtimer-Reduce-trace-noise-in-hrtimer_start-v7.1.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From b77f94c7a7109e70a97bf936b72d66d611187d61 Mon Sep 17 00:00:00 2001
-From: Michael Jeanson <mjeanson@efficios.com>
-Date: Mon, 25 May 2026 10:38:18 -0400
-Subject: [PATCH] fix: hrtimer: Reduce trace noise in hrtimer_start() (v7.1)
-
-See upstream commit:
-
-  commit f2e388a019e4cf83a15883a3d1f1384298e9a6aa
-  Author: Thomas Gleixner <tglx@kernel.org>
-  Date:   Tue Feb 24 17:36:59 2026 +0100
-
-    hrtimer: Reduce trace noise in hrtimer_start()
-
-    hrtimer_start() when invoked with an already armed timer traces like:
-
-     <comm>-..   [032] d.h2. 5.002263: hrtimer_cancel: hrtimer= ....
-     <comm>-..   [032] d.h1. 5.002263: hrtimer_start: hrtimer= ....
-
-    Which is incorrect as the timer doesn't get canceled. Just the expiry time
-    changes. The internal dequeue operation which is required for that is not
-    really interesting for trace analysis. But it makes it tedious to keep real
-    cancellations and the above case apart.
-
-    Remove the cancel tracing in hrtimer_start() and add a 'was_armed'
-    indicator to the hrtimer start tracepoint, which clearly indicates what the
-    state of the hrtimer is when hrtimer_start() is invoked:
-
-    <comm>-..   [032] d.h1. 6.200103: hrtimer_start: hrtimer= .... was_armed=0
-     <comm>-..   [032] d.h1. 6.200558: hrtimer_start: hrtimer= .... was_armed=1
-
-Change-Id: I37ee0ae0af665a51fd4f92adffb6b1dcb2ecd9d2
-Signed-off-by: Michael Jeanson <mjeanson@efficios.com>
-Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
-Upstream-Status: Backport [https://github.com/lttng/lttng-modules/commit/b77f94c7a7109e70a97bf936b72d66d611187d61]
-Signed-off-by: He Zhe <zhe.he@windriver.com>
----
- include/instrumentation/events/timer.h | 39 ++++++++++++++++++++++++--
- 1 file changed, 37 insertions(+), 2 deletions(-)
-
-diff --git a/include/instrumentation/events/timer.h b/include/instrumentation/events/timer.h
-index f69e069b..dfc295e0 100644
---- a/include/instrumentation/events/timer.h
-+++ b/include/instrumentation/events/timer.h
-@@ -220,12 +220,43 @@ LTTNG_TRACEPOINT_EVENT_MAP(hrtimer_init,
- 	)
- )
- 
-+#if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(7,1,0) || \
-+	LTTNG_KERNEL_RANGE(7,0,10, 7,1,0) || \
-+	LTTNG_KERNEL_RANGE(6,18,33, 6,19,0) || \
-+	LTTNG_KERNEL_RANGE(6,12,91, 6,13,0) || \
-+	LTTNG_KERNEL_RANGE(6,6,141, 6,7,0))
- /**
-  * hrtimer_start - called when the hrtimer is started
-- * @timer: pointer to struct hrtimer
-+ * @hrtimer:	pointer to struct hrtimer
-+ * @mode:	the hrtimers mode
-+ * @was_armed:	Was armed when hrtimer_start*() was invoked
-  */
--#if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(4,16,0) || \
-+LTTNG_TRACEPOINT_EVENT_MAP(hrtimer_start,
-+
-+	timer_hrtimer_start,
-+
-+	TP_PROTO(struct hrtimer *hrtimer, enum hrtimer_mode mode, bool was_armed),
-+
-+	TP_ARGS(hrtimer, mode, was_armed),
-+
-+	TP_FIELDS(
-+		ctf_integer_hex(void *, hrtimer, hrtimer)
-+		ctf_integer_hex(void *, function, hrtimer->function)
-+		ctf_integer(s64, expires,
-+			lttng_ktime_get_tv64(hrtimer_get_expires(hrtimer)))
-+		ctf_integer(s64, softexpires,
-+			lttng_ktime_get_tv64(hrtimer_get_softexpires(hrtimer)))
-+		ctf_enum(hrtimer_mode, unsigned int, mode, mode)
-+		ctf_integer(bool, was_armed, was_armed)
-+	)
-+)
-+#elif (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(4,16,0) || \
- 	LTTNG_RT_KERNEL_RANGE(4,14,0,0, 4,15,0,0))
-+/**
-+ * hrtimer_start - called when the hrtimer is started
-+ * @hrtimer:	pointer to struct hrtimer
-+ * @mode:	the hrtimers mode
-+ */
- LTTNG_TRACEPOINT_EVENT_MAP(hrtimer_start,
- 
- 	timer_hrtimer_start,
-@@ -245,6 +276,10 @@ LTTNG_TRACEPOINT_EVENT_MAP(hrtimer_start,
- 	)
- )
- #else
-+/**
-+ * hrtimer_start - called when the hrtimer is started
-+ * @hrtimer: pointer to struct hrtimer
-+ */
- LTTNG_TRACEPOINT_EVENT_MAP(hrtimer_start,
- 
- 	timer_hrtimer_start,
--- 
-2.34.1
-
diff --git a/meta/recipes-kernel/lttng/lttng-modules_2.14.4.bb b/meta/recipes-kernel/lttng/lttng-modules_2.14.7.bb
similarity index 87%
rename from meta/recipes-kernel/lttng/lttng-modules_2.14.4.bb
rename to meta/recipes-kernel/lttng/lttng-modules_2.14.7.bb
index d0983f58cb..8a6ab93dc1 100644
--- a/meta/recipes-kernel/lttng/lttng-modules_2.14.4.bb
+++ b/meta/recipes-kernel/lttng/lttng-modules_2.14.7.bb
@@ -20,10 +20,8 @@ SRC_URI = "https://lttng.org/files/${BPN}/${BPN}-${PV}.tar.bz2 \
 
 # Use :append here so that the patch is applied also when using devupstream
 SRC_URI:append = " file://0001-src-Kbuild-change-missing-CONFIG_TRACEPOINTS-to-warn.patch \
-                   file://0001-fix-adjust-range-in-btrfs-probe-for-v6.18.14.patch \
-                   file://0001-fix-hrtimer-Reduce-trace-noise-in-hrtimer_start-v7.1.patch \
                 "
-SRC_URI[sha256sum] = "63deefbc15d9ce7c43d858187533367b01dcb6e8469d6b69ccb757d6d3dbb0ad"
+SRC_URI[sha256sum] = "fe304c31ad3e8f68a48f52b538ed2c1bf9b9fe62d8ee528ebc96d0a321287145"
 
 export INSTALL_MOD_DIR = "kernel/lttng-modules"
 

[wrynose][PATCH 5/7] lttng-tools: upgrade 2.14.1 -> 2.14.3

[daniel.turull]

From: Daniel Turull <daniel.turull@ericsson.com>

Changes 2.14.2-2.14.3 (from ChangeLog):
- Fix: ust-consumerd/relayd crashes and overflow/path-traversal
  hardening in packet, filter, trigger, action, and session-path
  handling
- Fix: sessiond deadlock on notification overflow, default kernel
  probe list, agent event-listing sanitization
- Fix: common lockfile fd leak into consumerd via fork+exec
- tests: add notification/test_rotation to the regression test list

disable-tests.patch drops the flaky tools/notification/* tests from
SERIAL_TESTS (bug 14263); extend it to also drop the new
test_rotation entry added above, which conflicted with the patch.

Verified do_compile succeeds.

AI-Generated: Uses Kiro with Claude Sonnet 5
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 .../lttng/lttng-tools/disable-tests.patch             | 11 ++++++-----
 .../{lttng-tools_2.14.1.bb => lttng-tools_2.14.3.bb}  |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)
 rename meta/recipes-kernel/lttng/{lttng-tools_2.14.1.bb => lttng-tools_2.14.3.bb} (99%)

diff --git a/meta/recipes-kernel/lttng/lttng-tools/disable-tests.patch b/meta/recipes-kernel/lttng/lttng-tools/disable-tests.patch
index d32cf87535..5717fb6b3d 100644
--- a/meta/recipes-kernel/lttng/lttng-tools/disable-tests.patch
+++ b/meta/recipes-kernel/lttng/lttng-tools/disable-tests.patch
@@ -1,4 +1,4 @@
-From 05cf8ed6cc42a2f6ff53009d0ae2713fe63f1245 Mon Sep 17 00:00:00 2001
+From 755c3e21b7f736f2f19727482bab3100849f7f90 Mon Sep 17 00:00:00 2001
 From: Richard Purdie <richard.purdie@linuxfoundation.org>
 Date: Tue, 14 Dec 2021 12:34:04 +0000
 Subject: [PATCH] lttng-tools: Disable problem tests
@@ -14,14 +14,14 @@ https://bugzilla.yoctoproject.org/show_bug.cgi?id=14263
 
 Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 ---
- tests/regression/Makefile.am | 12 ------------
- 1 file changed, 12 deletions(-)
+ tests/regression/Makefile.am | 13 -------------
+ 1 file changed, 13 deletions(-)
 
 diff --git a/tests/regression/Makefile.am b/tests/regression/Makefile.am
-index 7076488..e5be904 100644
+index b64a8cc..e92547e 100644
 --- a/tests/regression/Makefile.am
 +++ b/tests/regression/Makefile.am
-@@ -40,18 +40,6 @@ SERIAL_TESTS = tools/base-path/test_ust \
+@@ -40,19 +40,6 @@ SERIAL_TESTS = tools/base-path/test_ust \
  	tools/regen-metadata/test_ust \
  	tools/regen-statedump/test_kernel \
  	tools/regen-statedump/test_ust \
@@ -37,6 +37,7 @@ index 7076488..e5be904 100644
 -	tools/notification/test_notification_notifier_discarded_count \
 -	tools/notification/test_notification_kernel_userspace_probe \
 -	tools/notification/test_notification_multi_app \
+-	tools/notification/test_rotation \
  	tools/rotation/test_ust \
  	tools/rotation/test_kernel \
  	tools/rotation/test_ust_kernel \
diff --git a/meta/recipes-kernel/lttng/lttng-tools_2.14.1.bb b/meta/recipes-kernel/lttng/lttng-tools_2.14.3.bb
similarity index 99%
rename from meta/recipes-kernel/lttng/lttng-tools_2.14.1.bb
rename to meta/recipes-kernel/lttng/lttng-tools_2.14.3.bb
index 3df9ed1c00..0b0e7aa4ea 100644
--- a/meta/recipes-kernel/lttng/lttng-tools_2.14.1.bb
+++ b/meta/recipes-kernel/lttng/lttng-tools_2.14.3.bb
@@ -52,7 +52,7 @@ SRC_URI = "https://lttng.org/files/lttng-tools/lttng-tools-${PV}.tar.bz2 \
            file://libc++.patch \
            "
 
-SRC_URI[sha256sum] = "0e68eb27923621c4bc127cfce40422d28cf7e473fedf6229ae6c32ba5c5b7c6d"
+SRC_URI[sha256sum] = "473ebcf26cae02860ee23e7cbf4ec875586017bd06f32613ba21b6586420e2ed"
 
 inherit autotools ptest pkgconfig useradd python3-dir manpages systemd upstream-stable-release-point
 

[wrynose][PATCH 6/7] lttng-ust: upgrade 2.14.0 -> 2.14.3

[daniel.turull]

From: Daniel Turull <daniel.turull@ericsson.com>

Changes 2.14.1-2.14.3 (from ChangeLog):
- Fix: stream instance id mismatch for populated packets in
  per-channel ringbuffers
- fix: shmp()/message-size/zero_file/sigevent hardening
- fix: close_range and fd-tracker memory/efficiency issues
- fix: lttng_ust_build_bug_on undefined behavior in C++ builds
- fix: ustctl sigbus handling statement with no effect

Both carried patches rebased cleanly, no changes needed.

Verified do_compile succeeds.

AI-Generated: Uses Kiro with Claude Sonnet 5
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 .../lttng/{lttng-ust_2.14.0.bb => lttng-ust_2.14.3.bb}          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-kernel/lttng/{lttng-ust_2.14.0.bb => lttng-ust_2.14.3.bb} (96%)

diff --git a/meta/recipes-kernel/lttng/lttng-ust_2.14.0.bb b/meta/recipes-kernel/lttng/lttng-ust_2.14.3.bb
similarity index 96%
rename from meta/recipes-kernel/lttng/lttng-ust_2.14.0.bb
rename to meta/recipes-kernel/lttng/lttng-ust_2.14.3.bb
index 4285a445d6..b567dea1f6 100644
--- a/meta/recipes-kernel/lttng/lttng-ust_2.14.0.bb
+++ b/meta/recipes-kernel/lttng/lttng-ust_2.14.3.bb
@@ -35,7 +35,7 @@ SRC_URI = "https://lttng.org/files/lttng-ust/lttng-ust-${PV}.tar.bz2 \
            file://0001-lttng-ust-common-link-with-liburcu-explicitly.patch \
            "
 
-SRC_URI[sha256sum] = "82cdfd304bbb2b2b7d17cc951a6756b37a9f73868ec0ba7db448a0d5ca51b763"
+SRC_URI[sha256sum] = "3c232b514f33c4248ce23155f64ad272fdaae3323255f69d5e7a5c3d6812b7ea"
 
 CVE_PRODUCT = "ust"
 

[wrynose][PATCH 7/7] libgcrypt: upgrade 1.12.1 -> 1.12.4

[daniel.turull]

From: Daniel Turull <daniel.turull@ericsson.com>

Bug fixes in 1.12.2-1.12.4 (per NEWS):
- T8208: missing bounds check in Dilithium context handling
  (CVE-2026-41990)
- T8211: possible ECDH buffer overwrite with zeroes (CVE-2026-41989)
- T8212: missing point validation in the new KEM interface
- RSA PSS/OAEP salt-length and padding validation; s-expression
  parsing and KDF parameter hardening; various AEAD/MAC overflow and
  OOB-read fixes

Both carried CVE patches backported the Dilithium and ECC fixes above,
now redundant and dropped. The pubkey-dilithium.c conflict was caused
by two unrelated upstream commits (dilithium glue fix, stronger
signature nonce random) touching the same file.

Verified do_compile succeeds on qemux86-64 and qemuarm_musl.

License-Update: LICENSES gained a BSD-3-Clause notice for the new
Intel SM3 AVX2 assembly file (cipher/sm3-intel-avx2-amd64.S).

AI-Generated: Uses Kiro with Claude Sonnet 5
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 ...s-Fix-link-errors-for-t-thread-local.patch |  13 +-
 .../libgcrypt/files/CVE-2026-41989.patch      |  42 ---
 .../libgcrypt/files/CVE-2026-41990.patch      | 316 ------------------
 ...ibgcrypt_1.12.1.bb => libgcrypt_1.12.4.bb} |   6 +-
 4 files changed, 7 insertions(+), 370 deletions(-)
 delete mode 100644 meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch
 delete mode 100644 meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch
 rename meta/recipes-support/libgcrypt/{libgcrypt_1.12.1.bb => libgcrypt_1.12.4.bb} (89%)

diff --git a/meta/recipes-support/libgcrypt/files/0001-tests-Fix-link-errors-for-t-thread-local.patch b/meta/recipes-support/libgcrypt/files/0001-tests-Fix-link-errors-for-t-thread-local.patch
index 8dc2fe328c..c4c59dcf87 100644
--- a/meta/recipes-support/libgcrypt/files/0001-tests-Fix-link-errors-for-t-thread-local.patch
+++ b/meta/recipes-support/libgcrypt/files/0001-tests-Fix-link-errors-for-t-thread-local.patch
@@ -1,4 +1,4 @@
-From 942e232ded48fa08d2bda417ae8ad8c03d644372 Mon Sep 17 00:00:00 2001
+From bf307ed66f9c33502f27c04c60f9e6c99d7dda7a Mon Sep 17 00:00:00 2001
 From: Collin Funk <collin.funk1@gmail.com>
 Date: Wed, 27 Aug 2025 11:49:06 +0800
 Subject: [PATCH] tests: Fix link errors for t-thread-local.
@@ -21,18 +21,15 @@ Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/tests/Makefile.am b/tests/Makefile.am
-index 4800135..f0f7adb 100644
+index 3baaf48..cc2fd6b 100644
 --- a/tests/Makefile.am
 +++ b/tests/Makefile.am
-@@ -98,7 +98,7 @@ testapi_LDADD = $(standard_ldadd) @LDADD_FOR_TESTS_KLUDGE@
+@@ -103,7 +103,7 @@ testapi_LDADD = $(standard_ldadd) @LDADD_FOR_TESTS_KLUDGE@
  t_lock_LDADD = $(standard_ldadd) $(GPG_ERROR_MT_LIBS) @LDADD_FOR_TESTS_KLUDGE@
  t_lock_CFLAGS = $(GPG_ERROR_MT_CFLAGS) -lpthread
  t_thread_local_LDADD = $(standard_ldadd) $(GPG_ERROR_MT_LIBS) @LDADD_FOR_TESTS_KLUDGE@
 -t_thread_local_CFLAGS = $(GPG_ERROR_MT_CFLAGS)
 +t_thread_local_CFLAGS = $(GPG_ERROR_MT_CFLAGS) -lpthread
  testdrv_LDADD = $(LDADD_FOR_TESTS_KLUDGE)
- 
- # Build a version of the test driver for the build platform.
--- 
-2.34.1
-
+ t_cipher_internal_CPPFLAGS = $(AM_CPPFLAGS) -I$(top_srcdir)/cipher
+ t_sntrup761_CPPFLAGS = $(AM_CPPFLAGS) -I$(top_srcdir)/cipher
diff --git a/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch b/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch
deleted file mode 100644
index aba3ca318b..0000000000
--- a/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From d8874dd38f78454dd3a760617ebe8d9aa9270649 Mon Sep 17 00:00:00 2001
-From: NIIBE Yutaka <gniibe@fsij.org>
-Date: Fri, 10 Apr 2026 16:58:57 +0900
-Subject: [PATCH] cipher:ecc: Fix decoding a point on Montgomery curve.
-
-* cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Fix the padding
-mistake and add updating RAWMPILEN.
-
---
-
-Reported by Calif.io in collaboration with Claude and Anthropic
-Research.
-
-GnuPG-bug-id: 8211
-Fixes-commit: bbe15758c893dbf546416c1a6bccdad1ab000ad7
-Suggested-by: Bronson Yen <bronson@calif.io>
-Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
-
-CVE: CVE-2026-41989
-Upstream-Status: Backport [https://github.com/gpg/libgcrypt/commit/2d3d732c9bf87cc10729f69678dd9e6862f99fa3]
-
-Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
----
- cipher/ecc-misc.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/cipher/ecc-misc.c b/cipher/ecc-misc.c
-index 615b0df2..ab3799dc 100644
---- a/cipher/ecc-misc.c
-+++ b/cipher/ecc-misc.c
-@@ -438,7 +438,10 @@ _gcry_ecc_mont_decodepoint (gcry_mpi_t pk, mpi_ec_t ec, mpi_point_t result)
-         *--p = *buf++;
- 
-       if (rawmpilen < nbytes)
--        memset (rawmpi + nbytes - rawmpilen, 0, nbytes - rawmpilen);
-+        {
-+          memset (rawmpi + rawmpilen, 0, nbytes - rawmpilen);
-+          rawmpilen = nbytes;
-+        }
-     }
-   else
-     {
diff --git a/meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch b/meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch
deleted file mode 100644
index a4f1809227..0000000000
--- a/meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch
+++ /dev/null
@@ -1,316 +0,0 @@
-From 024391fc505ebf9c47e51953d7d85995ba179576 Mon Sep 17 00:00:00 2001
-From: NIIBE Yutaka <gniibe@fsij.org>
-Date: Mon, 13 Apr 2026 11:51:46 +0900
-Subject: [PATCH] cipher:dilithium: Check the label length by caller.
-
-* cipher/dilithium.h (dilithium_keypair, dilithium_sign)
-(dilithium_verify): Return gpg_err_code_t.
-* cipher/dilithium.c (dilithium_keypair): Return gpg_err_code_t.
-(dilithium_sign, dilithium_verify): Ditto.  Check CTXLEN.
-* cipher/pubkey-dilithium.c (mldsa_generate): Follow the change.
-(mldsa_sign, mldsa_verify): Likewise.
-
---
-
-Reported by Calif.io in collaboration with Claude and Anthropic
-Research.
-
-GnuPG-bug-id: 8208
-Co-authored-by: Thai Duong <thai@calif.io>
-Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
-
-CVE: CVE-2026-41990
-Upstream-Status: Backport [https://github.com/gpg/libgcrypt/commit/905e00f046a71e5670517779afaf85a354952832]
-
-Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
----
- cipher/dilithium.c        | 101 ++++++++++++++++++++++++++++----------
- cipher/dilithium.h        |  20 ++++----
- cipher/pubkey-dilithium.c |  34 +++++--------
- 3 files changed, 99 insertions(+), 56 deletions(-)
-
-diff --git a/cipher/dilithium.c b/cipher/dilithium.c
-index 955feb2a..212c4afe 100644
---- a/cipher/dilithium.c
-+++ b/cipher/dilithium.c
-@@ -82,6 +82,7 @@
- #include "gcrypt-int.h"
- #include "const-time.h"
- 
-+/* With glue code, we only use the "_internal" API of Dilithium.  */
- #define DILITHIUM_INTERNAL_API_ONLY 1
- 
- #include "dilithium.h"
-@@ -120,23 +121,33 @@ static int crypto_sign_verify_internal_5 (const uint8_t *sig, size_t siglen,
-                                           const uint8_t *pre, size_t prelen,
-                                           const uint8_t *pk);
- 
--int
-+gpg_err_code_t
- dilithium_keypair (int algo, uint8_t *pk, uint8_t *sk,
-                    const uint8_t seed[SEEDBYTES])
- {
-+  int r;
-+
-   switch (algo)
-     {
-     case GCRY_MLDSA44:
--      return crypto_sign_keypair_internal_2 (pk, sk, seed);
-+      r = crypto_sign_keypair_internal_2 (pk, sk, seed);
-+      break;
-     case GCRY_MLDSA65:
-     default:
--      return crypto_sign_keypair_internal_3 (pk, sk, seed);
-+      r = crypto_sign_keypair_internal_3 (pk, sk, seed);
-+      break;
-     case GCRY_MLDSA87:
--      return crypto_sign_keypair_internal_5 (pk, sk, seed);
-+      r = crypto_sign_keypair_internal_5 (pk, sk, seed);
-+      break;
-     }
-+
-+  if (r < 0)
-+    return GPG_ERR_INTERNAL;
-+
-+  return 0;
- }
- 
--int
-+gpg_err_code_t
- dilithium_sign (int algo, uint8_t *sig, size_t siglen,
-                 const uint8_t *m, size_t mlen,
-                 const uint8_t *ctx, size_t ctxlen,
-@@ -145,9 +156,17 @@ dilithium_sign (int algo, uint8_t *sig, size_t siglen,
-   size_t i;
-   uint8_t pre[257];
-   size_t prelen;
-+  int r;
- 
--  if (ctx == NULL && ctxlen == -1)
--    prelen = 0;
-+  if (ctx == NULL)
-+    {
-+      if (ctxlen == -1)
-+        prelen = 0;
-+      else
-+        return GPG_ERR_INV_DATA;
-+    }
-+  else if (ctxlen > 255)
-+    return GPG_ERR_INV_DATA;
-   else
-     {
-       /* Prepare pre = (0, ctxlen, ctx) */
-@@ -158,28 +177,44 @@ dilithium_sign (int algo, uint8_t *sig, size_t siglen,
-       prelen = 2 + ctxlen;
-     }
- 
-+  /*
-+   * Note that the second argument of the upstream routine is the
-+   * pointer to output length of signature.  It assumes the first
-+   * argument (pointer to output signature) should have correct (or
-+   * more) length, beforehand.
-+   *
-+   * Before calling the routine, we should check the length.
-+   */
-   switch (algo)
-     {
-     case GCRY_MLDSA44:
-       if (siglen != CRYPTO_BYTES_2)
--        return -1;
--      return crypto_sign_signature_internal_2 (sig, &siglen, m, mlen,
--                                               pre, prelen, rnd, sk);
-+        return GPG_ERR_INV_DATA;
-+      r = crypto_sign_signature_internal_2 (sig, &siglen, m, mlen,
-+                                            pre, prelen, rnd, sk);
-+      break;
-     case GCRY_MLDSA65:
-     default:
-       if (siglen != CRYPTO_BYTES_3)
--        return -1;
--      return crypto_sign_signature_internal_3 (sig, &siglen, m, mlen,
--                                               pre, prelen, rnd, sk);
-+        return GPG_ERR_INV_DATA;
-+      r = crypto_sign_signature_internal_3 (sig, &siglen, m, mlen,
-+                                            pre, prelen, rnd, sk);
-+      break;
-     case GCRY_MLDSA87:
-       if (siglen != CRYPTO_BYTES_5)
--        return -1;
--      return crypto_sign_signature_internal_5 (sig, &siglen, m, mlen,
--                                               pre, prelen, rnd, sk);
-+        return GPG_ERR_INV_DATA;
-+      r = crypto_sign_signature_internal_5 (sig, &siglen, m, mlen,
-+                                            pre, prelen, rnd, sk);
-+      break;
-     }
-+
-+  if (r < 0)
-+    return GPG_ERR_INTERNAL;
-+
-+  return 0;
- }
- 
--int
-+gpg_err_code_t
- dilithium_verify (int algo, const uint8_t *sig, size_t siglen,
-                   const uint8_t *m, size_t mlen,
-                   const uint8_t *ctx, size_t ctxlen,
-@@ -188,9 +223,17 @@ dilithium_verify (int algo, const uint8_t *sig, size_t siglen,
-   size_t i;
-   uint8_t pre[257];
-   size_t prelen;
-+  int r;
- 
--  if (ctx == NULL && ctxlen == -1)
--    prelen = 0;
-+  if (ctx == NULL)
-+    {
-+      if (ctxlen == -1)
-+        prelen = 0;
-+      else
-+        return GPG_ERR_INV_DATA;
-+    }
-+  else if (ctxlen > 255)
-+    return GPG_ERR_INV_DATA;
-   else
-     {
-       /* Prepare pre = (0, ctxlen, ctx) */
-@@ -204,16 +247,24 @@ dilithium_verify (int algo, const uint8_t *sig, size_t siglen,
-   switch (algo)
-     {
-     case GCRY_MLDSA44:
--      return crypto_sign_verify_internal_2 (sig, siglen, m, mlen,
--                                            pre, prelen, pk);
-+      r = crypto_sign_verify_internal_2 (sig, siglen, m, mlen,
-+                                         pre, prelen, pk);
-+      break;
-     case GCRY_MLDSA65:
-     default:
--      return crypto_sign_verify_internal_3 (sig, siglen, m, mlen,
--                                            pre, prelen, pk);
-+      r = crypto_sign_verify_internal_3 (sig, siglen, m, mlen,
-+                                         pre, prelen, pk);
-+      break;
-     case GCRY_MLDSA87:
--      return crypto_sign_verify_internal_5 (sig, siglen, m, mlen,
--                                            pre, prelen, pk);
-+      r = crypto_sign_verify_internal_5 (sig, siglen, m, mlen,
-+                                         pre, prelen, pk);
-+      break;
-     }
-+
-+  if (r < 0)
-+    return GPG_ERR_BAD_SIGNATURE;
-+
-+  return 0;
- }
- 
- typedef struct {
-diff --git a/cipher/dilithium.h b/cipher/dilithium.h
-index 88a48094..dc18f158 100644
---- a/cipher/dilithium.h
-+++ b/cipher/dilithium.h
-@@ -64,16 +64,16 @@
- #define DILITHIUM_SIGN_STACK_BURN (161 * 1024)
- #define DILITHIUM_VERIFY_STACK_BURN (122 * 1024)
- 
--int dilithium_keypair (int algo, uint8_t *pk, uint8_t *sk,
--                       const uint8_t seed[SEEDBYTES]);
--int dilithium_sign (int algo, uint8_t *sig, size_t siglen,
--                    const uint8_t *m, size_t mlen,
--                    const uint8_t *ctx, size_t ctxlen,
--                    const uint8_t *sk, const uint8_t rnd[RNDBYTES]);
--int dilithium_verify (int algo, const uint8_t *sig, size_t siglen,
--                      const uint8_t *m, size_t mlen,
--                      const uint8_t *ctx, size_t ctxlen,
--                      const uint8_t *pk);
-+gpg_err_code_t dilithium_keypair (int algo, uint8_t *pk, uint8_t *sk,
-+                                  const uint8_t seed[SEEDBYTES]);
-+gpg_err_code_t dilithium_sign (int algo, uint8_t *sig, size_t siglen,
-+                               const uint8_t *m, size_t mlen,
-+                               const uint8_t *ctx, size_t ctxlen,
-+                               const uint8_t *sk, const uint8_t rnd[RNDBYTES]);
-+gpg_err_code_t dilithium_verify (int algo, const uint8_t *sig, size_t siglen,
-+                                 const uint8_t *m, size_t mlen,
-+                                 const uint8_t *ctx, size_t ctxlen,
-+                                 const uint8_t *pk);
- #endif
- 
- #if defined(DILITHIUM_MODE)
-diff --git a/cipher/pubkey-dilithium.c b/cipher/pubkey-dilithium.c
-index 03958bb0..8c3f650e 100644
---- a/cipher/pubkey-dilithium.c
-+++ b/cipher/pubkey-dilithium.c
-@@ -170,7 +170,7 @@ mldsa_generate (const gcry_sexp_t genparms, gcry_sexp_t *r_skey)
-       memcpy (seed, seed_supplied, SEEDBYTES);
-     }
- 
--  dilithium_keypair (info->algo, pk, sk, seed);
-+  rc = dilithium_keypair (info->algo, pk, sk, seed);
-   _gcry_burn_stack (DILITHIUM_KEYPAIR_STACK_BURN);
- 
-   if (!rc)
-@@ -206,7 +206,6 @@ mldsa_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms)
-   size_t data_len;
-   const unsigned char *sk;
-   const struct mldsa_info *info = mldsa_get_info (keyparms);
--  int r;
- 
-   if (!info)
-     return GPG_ERR_PUBKEY_ALGO;
-@@ -258,17 +257,14 @@ mldsa_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms)
-   else
-     randombytes (rnd, RNDBYTES);
-   if (ctx.flags & PUBKEY_FLAG_NO_PREFIX)
--    r = dilithium_sign (info->algo, sig, info->sig_len, data, data_len,
--                        NULL, -1, sk, rnd);
-+    rc = dilithium_sign (info->algo, sig, info->sig_len, data, data_len,
-+                         NULL, -1, sk, rnd);
-   else
--    r = dilithium_sign (info->algo, sig, info->sig_len, data, data_len,
--                        ctx.label, ctx.labellen, sk, rnd);
-+    rc = dilithium_sign (info->algo, sig, info->sig_len, data, data_len,
-+                         ctx.label, ctx.labellen, sk, rnd);
-   _gcry_burn_stack (DILITHIUM_SIGN_STACK_BURN);
--  if (r < 0)
--    {
--      rc = GPG_ERR_INTERNAL;
--      goto leave;
--    }
-+  if (rc)
-+    goto leave;
- 
-   rc = sexp_build (r_sig, NULL, "(sig-val(%s(s%b)))", info->name,
-                    info->sig_len, sig);
-@@ -300,7 +296,6 @@ mldsa_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms)
-   size_t data_len;
-   const unsigned char *pk;
-   const struct mldsa_info *info = mldsa_get_info (keyparms);
--  int r;
- 
-   if (!info)
-     return GPG_ERR_PUBKEY_ALGO;
-@@ -350,17 +345,14 @@ mldsa_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms)
-     }
- 
-   if (ctx.flags & PUBKEY_FLAG_NO_PREFIX)
--    r = dilithium_verify (info->algo, sig, info->sig_len, data, data_len,
--                          NULL, -1, pk);
-+    rc = dilithium_verify (info->algo, sig, info->sig_len, data, data_len,
-+                           NULL, -1, pk);
-   else
--    r = dilithium_verify (info->algo, sig, info->sig_len, data, data_len,
--                          ctx.label, ctx.labellen, pk);
-+    rc = dilithium_verify (info->algo, sig, info->sig_len, data, data_len,
-+                           ctx.label, ctx.labellen, pk);
-   _gcry_burn_stack (DILITHIUM_VERIFY_STACK_BURN);
--  if (r < 0)
--    {
--      rc = GPG_ERR_BAD_SIGNATURE;
--      goto leave;
--    }
-+  if (rc)
-+    goto leave;
- 
- leave:
-   _gcry_pk_util_free_encoding_ctx (&ctx);
diff --git a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb b/meta/recipes-support/libgcrypt/libgcrypt_1.12.4.bb
similarity index 89%
rename from meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb
rename to meta/recipes-support/libgcrypt/libgcrypt_1.12.4.bb
index d7b3e182cd..4dedcc49ce 100644
--- a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb
+++ b/meta/recipes-support/libgcrypt/libgcrypt_1.12.4.bb
@@ -12,7 +12,7 @@ LICENSE:${PN}-dev = "GPL-2.0-or-later & LGPL-2.1-or-later"
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=570a9b3749dd0463a1778803b12a6dce \
                     file://COPYING.LIB;md5=4bf661c1e3793e55c8d1051bc5e0ae21 \
-                    file://LICENSES;md5=034b4e369944ad4b52a68368f1cf98b8 \
+                    file://LICENSES;md5=47e346a71a2593d19f741408407fe91f \
                     "
 
 DEPENDS = "libgpg-error"
@@ -25,10 +25,8 @@ SRC_URI = "${GNUPG_MIRROR}/libgcrypt/libgcrypt-${PV}.tar.bz2 \
            file://no-native-gpg-error.patch \
            file://no-bench-slope.patch \
            file://run-ptest \
-           file://CVE-2026-41989.patch \
-           file://CVE-2026-41990.patch \
            "
-SRC_URI[sha256sum] = "7df5c08d952ba33f9b6bdabdb06a61a78b2cf62d2122c2d1d03a91a79832aa3c"
+SRC_URI[sha256sum] = "d77f68f48879510e79a2f65977ccc68981781ea0923e5bdffac2a193ea3d660e"
 
 BINCONFIG = "${bindir}/libgcrypt-config"