* [OE-core][kirkstone 00/28] Patch review
@ 2022-08-23 22:35 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 01/28] libtiff: CVE-2022-34526 A stack overflow was discovered Steve Sakoman
` (27 more replies)
0 siblings, 28 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for kirkstone and have comments back by
end of day Thursday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4121
with the exception of a known autobuilder intermittent issue on qemux86-64-ltp:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=14789
which passed on subsequent retest:
https://autobuilder.yoctoproject.org/typhoon/#/builders/95/builds/3699
The following changes since commit 10891d4d955f347c328cf8c099031f05f5c855a2:
lttng-modules: replace mips compaction fix with upstream change (2022-08-17 04:55:49 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alexander Kanavin (9):
bluez5: update 5.64 -> 5.65
libwpe: upgrade 1.12.0 -> 1.12.2
ell: upgrade 0.49 -> 0.50
iso-codes: upgrade 4.10.0 -> 4.11.0
libcap: upgrade 2.64 -> 2.65
libwebp: upgrade 1.2.2 -> 1.2.3
mobile-broadband-provider-info: upgrade 20220511 -> 20220725
webkitgtk: upgrade 2.36.4 -> 2.36.5
weston: upgrade 10.0.1 -> 10.0.2
Beniamin Sandu (1):
libpam: use /run instead of /var/run in systemd tmpfiles
Changqing Li (1):
apt: fix nativesdk-apt build failure during the second time build
Daiane Angolini (1):
python3-pip: Fix RDEPENDS after the update
Ernst Sjöstrand (1):
cve-check: Don't use f-strings
Hitendra Prajapati (1):
libtiff: CVE-2022-34526 A stack overflow was discovered
Jose Quaresma (2):
archiver.bbclass: some recipes that uses the kernelsrc bbclass uses
the shared source
linux-yocto: prepend the the value with a space when append to
KERNEL_EXTRA_ARGS
Kai Kang (1):
packagegroup-self-hosted: update for strace
Khem Raj (4):
libxml2: Ignore CVE-2016-3709
connman: Backports for security fixes
cracklib: Drop using register keyword
tcp-wrappers: Fix implicit-function-declaration warnings
Peter Marko (1):
create-spdx: handle links to inaccessible locations
Richard Purdie (1):
perf: Fix reproducibility issues with 5.19 onwards
Sakib Sajal (3):
u-boot: fix CVE-2022-30552
u-boot: fix CVE-2022-33967
go: update v1.17.12 -> v1.17.13
Yongxin Liu (1):
grub2: fix several CVEs
wangmy (1):
libcap: upgrade 2.63 -> 2.64
meta/classes/archiver.bbclass | 4 +-
meta/classes/create-spdx.bbclass | 2 +-
meta/lib/oe/cve_check.py | 2 +-
...g-Drop-greyscale-support-to-fix-heap.patch | 179 +++++
...ng-Avoid-heap-OOB-R-W-inserting-huff.patch | 50 ++
...peg-Block-int-underflow-wild-pointer.patch | 84 +++
...3-net-ip-Do-IP-fragment-maths-safely.patch | 63 ++
...or-out-on-headers-with-LF-without-CR.patch | 58 ++
...Fix-OOB-write-for-split-http-headers.patch | 56 ++
...ct-non-kernel-files-in-the-shim_lock.patch | 111 +++
.../video-Remove-trailing-whitespaces.patch | 693 ++++++++++++++++++
...eg-Abort-sooner-if-a-read-operation-.patch | 264 +++++++
...eg-Refuse-to-handle-multiple-start-o.patch | 53 ++
meta/recipes-bsp/grub/grub2.inc | 10 +
...s-squashfs-Use-kcalloc-when-relevant.patch | 64 ++
...e-minimum-IP-fragmented-datagram-siz.patch | 207 ++++++
meta/recipes-bsp/u-boot/u-boot_2022.01.bb | 2 +
meta/recipes-connectivity/bluez5/bluez5.inc | 1 -
.../bluez5/bluez5/fix_service.patch | 30 -
.../bluez5/{bluez5_5.64.bb => bluez5_5.65.bb} | 2 +-
.../connman/connman/CVE-2022-32292.patch | 37 +
.../connman/connman/CVE-2022-32293_p1.patch | 141 ++++
.../connman/connman/CVE-2022-32293_p2.patch | 174 +++++
.../connman/connman_1.41.bb | 3 +
.../mobile-broadband-provider-info_git.bb | 4 +-
.../ell/{ell_0.49.bb => ell_0.50.bb} | 2 +-
meta/recipes-core/libxml/libxml2_2.9.14.bb | 4 +
.../packagegroups/packagegroup-self-hosted.bb | 5 +-
meta/recipes-devtools/apt/apt_2.4.5.bb | 2 +-
.../go/{go-1.17.12.inc => go-1.17.13.inc} | 2 +-
...1.17.12.bb => go-binary-native_1.17.13.bb} | 4 +-
....17.12.bb => go-cross-canadian_1.17.13.bb} | 0
...o-cross_1.17.12.bb => go-cross_1.17.13.bb} | 0
...ssdk_1.17.12.bb => go-crosssdk_1.17.13.bb} | 0
...native_1.17.12.bb => go-native_1.17.13.bb} | 0
...ntime_1.17.12.bb => go-runtime_1.17.13.bb} | 0
.../go/{go_1.17.12.bb => go_1.17.13.bb} | 0
.../python/python3-pip_22.0.3.bb | 2 +
...01-rules-Drop-using-register-keyword.patch | 278 +++++++
...rrect-parameter-types-to-Debug-calls.patch | 40 +
.../cracklib/cracklib_2.9.7.bb | 5 +-
meta/recipes-extended/pam/libpam/99_pam | 2 +-
...plicit-function-declaration-warnings.patch | 109 +++
.../tcp-wrappers/tcp-wrappers_7.6.bb | 1 +
.../weston/dont-use-plane-add-prop.patch | 32 -
.../{weston_10.0.1.bb => weston_10.0.2.bb} | 4 +-
meta/recipes-kernel/linux/linux-yocto.inc | 2 +-
meta/recipes-kernel/perf/perf.bb | 2 +-
.../libtiff/tiff/CVE-2022-34526.patch | 29 +
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb | 1 +
.../{libwebp_1.2.2.bb => libwebp_1.2.3.bb} | 2 +-
...ure-due-to-libc-using-libc-functions.patch | 42 ++
.../{libwpe_1.12.0.bb => libwpe_1.12.2.bb} | 6 +-
...ebkitgtk_2.36.4.bb => webkitgtk_2.36.5.bb} | 2 +-
...so-codes_4.10.0.bb => iso-codes_4.11.0.bb} | 2 +-
...-Raise-the-size-of-arrays-containing.patch | 2 +-
.../libcap/{libcap_2.63.bb => libcap_2.65.bb} | 2 +-
57 files changed, 2789 insertions(+), 89 deletions(-)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2021-3695-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2021-3696-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2021-3697-video-readers-jpeg-Block-int-underflow-wild-pointer.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28733-net-ip-Do-IP-fragment-maths-safely.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28734-net-http-Error-out-on-headers-with-LF-without-CR.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28734-net-http-Fix-OOB-write-for-split-http-headers.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28735-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
create mode 100644 meta/recipes-bsp/grub/files/video-Remove-trailing-whitespaces.patch
create mode 100644 meta/recipes-bsp/grub/files/video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
create mode 100644 meta/recipes-bsp/grub/files/video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
create mode 100644 meta/recipes-bsp/u-boot/files/0001-fs-squashfs-Use-kcalloc-when-relevant.patch
create mode 100644 meta/recipes-bsp/u-boot/files/0001-net-Check-for-the-minimum-IP-fragmented-datagram-siz.patch
delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/fix_service.patch
rename meta/recipes-connectivity/bluez5/{bluez5_5.64.bb => bluez5_5.65.bb} (95%)
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32292.patch
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32293_p1.patch
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32293_p2.patch
rename meta/recipes-core/ell/{ell_0.49.bb => ell_0.50.bb} (89%)
rename meta/recipes-devtools/go/{go-1.17.12.inc => go-1.17.13.inc} (92%)
rename meta/recipes-devtools/go/{go-binary-native_1.17.12.bb => go-binary-native_1.17.13.bb} (83%)
rename meta/recipes-devtools/go/{go-cross-canadian_1.17.12.bb => go-cross-canadian_1.17.13.bb} (100%)
rename meta/recipes-devtools/go/{go-cross_1.17.12.bb => go-cross_1.17.13.bb} (100%)
rename meta/recipes-devtools/go/{go-crosssdk_1.17.12.bb => go-crosssdk_1.17.13.bb} (100%)
rename meta/recipes-devtools/go/{go-native_1.17.12.bb => go-native_1.17.13.bb} (100%)
rename meta/recipes-devtools/go/{go-runtime_1.17.12.bb => go-runtime_1.17.13.bb} (100%)
rename meta/recipes-devtools/go/{go_1.17.12.bb => go_1.17.13.bb} (100%)
create mode 100644 meta/recipes-extended/cracklib/cracklib/0001-rules-Drop-using-register-keyword.patch
create mode 100644 meta/recipes-extended/cracklib/cracklib/0002-rules-Correct-parameter-types-to-Debug-calls.patch
create mode 100644 meta/recipes-extended/tcp-wrappers/tcp-wrappers-7.6/0001-Fix-implicit-function-declaration-warnings.patch
delete mode 100644 meta/recipes-graphics/wayland/weston/dont-use-plane-add-prop.patch
rename meta/recipes-graphics/wayland/{weston_10.0.1.bb => weston_10.0.2.bb} (97%)
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2022-34526.patch
rename meta/recipes-multimedia/webp/{libwebp_1.2.2.bb => libwebp_1.2.3.bb} (95%)
create mode 100644 meta/recipes-sato/webkit/libwpe/0001-Fix-build-failure-due-to-libc-using-libc-functions.patch
rename meta/recipes-sato/webkit/{libwpe_1.12.0.bb => libwpe_1.12.2.bb} (72%)
rename meta/recipes-sato/webkit/{webkitgtk_2.36.4.bb => webkitgtk_2.36.5.bb} (98%)
rename meta/recipes-support/iso-codes/{iso-codes_4.10.0.bb => iso-codes_4.11.0.bb} (94%)
rename meta/recipes-support/libcap/{libcap_2.63.bb => libcap_2.65.bb} (96%)
--
2.25.1
^ permalink raw reply [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 01/28] libtiff: CVE-2022-34526 A stack overflow was discovered
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 02/28] libxml2: Ignore CVE-2016-3709 Steve Sakoman
` (26 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
Source: https://gitlab.com/libtiff/libtiff
MR: 120544
Type: Security Fix
Disposition: Backport from https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990
ChangeID: 2f9df449974f5436c1690f3ace5d74b1ab4670c9
Description:
CVE-2022-34526 libtiff: A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit.
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libtiff/tiff/CVE-2022-34526.patch | 29 +++++++++++++++++++
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb | 1 +
2 files changed, 30 insertions(+)
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2022-34526.patch
diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2022-34526.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2022-34526.patch
new file mode 100644
index 0000000000..48ca56982f
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2022-34526.patch
@@ -0,0 +1,29 @@
+From 3fc1fdda0068981340cc7ae136173731275e2c5e Mon Sep 17 00:00:00 2001
+From: Hitendra Prajapati <hprajapati@mvista.com>
+Date: Thu, 18 Aug 2022 10:46:30 +0530
+Subject: [PATCH] CVE-2022-34526
+
+Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990]
+CVE: CVE-2022-34526
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ libtiff/tif_dirinfo.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c
+index 8565dfb..0f722a5 100644
+--- a/libtiff/tif_dirinfo.c
++++ b/libtiff/tif_dirinfo.c
+@@ -1157,6 +1157,9 @@ _TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag)
+ default:
+ return 1;
+ }
++ if( !TIFFIsCODECConfigured(tif->tif_dir.td_compression) ) {
++ return 0;
++ }
+ /* Check if codec specific tags are allowed for the current
+ * compression scheme (codec) */
+ switch (tif->tif_dir.td_compression) {
+--
+2.25.1
+
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb
index 149516508f..b5ccd859f3 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb
@@ -21,6 +21,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
file://0001-fix-the-FPE-in-tiffcrop-415-427-and-428.patch \
file://CVE-2022-1354.patch \
file://CVE-2022-1355.patch \
+ file://CVE-2022-34526.patch \
"
SRC_URI[sha256sum] = "0e46e5acb087ce7d1ac53cf4f56a09b221537fc86dfc5daaad1c2e89e1b37ac8"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 02/28] libxml2: Ignore CVE-2016-3709
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 01/28] libtiff: CVE-2022-34526 A stack overflow was discovered Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 03/28] connman: Backports for security fixes Steve Sakoman
` (25 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Khem Raj <raj.khem@gmail.com>
This is fixed via a revert in 2.9.11 [1]
[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 131b7010ae45b0c4e1c6a29dfc56b225d2ad2a69)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-core/libxml/libxml2_2.9.14.bb | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-core/libxml/libxml2_2.9.14.bb b/meta/recipes-core/libxml/libxml2_2.9.14.bb
index 3081ebf92f..e58298d3b0 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.14.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.14.bb
@@ -29,6 +29,10 @@ SRC_URI[testtar.sha256sum] = "96151685cec997e1f9f3387e3626d61e6284d4d6e66e0e440c
BINCONFIG = "${bindir}/xml2-config"
+# Fixed since 2.9.11 via
+# https://gitlab.gnome.org/GNOME/libxml2/-/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f
+CVE_CHECK_IGNORE += "CVE-2016-3709"
+
PACKAGECONFIG ??= "python \
${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)} \
"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 03/28] connman: Backports for security fixes
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 01/28] libtiff: CVE-2022-34526 A stack overflow was discovered Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 02/28] libxml2: Ignore CVE-2016-3709 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 04/28] u-boot: fix CVE-2022-30552 Steve Sakoman
` (24 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Khem Raj <raj.khem@gmail.com>
Fixes
CVE: CVE-2022-32292, CVE-2022-32293
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4b3caa1541d69826c14e010ce3ac1a1ca34f3c62)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../connman/connman/CVE-2022-32292.patch | 37 ++++
.../connman/connman/CVE-2022-32293_p1.patch | 141 ++++++++++++++
.../connman/connman/CVE-2022-32293_p2.patch | 174 ++++++++++++++++++
.../connman/connman_1.41.bb | 3 +
4 files changed, 355 insertions(+)
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32292.patch
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32293_p1.patch
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2022-32293_p2.patch
diff --git a/meta/recipes-connectivity/connman/connman/CVE-2022-32292.patch b/meta/recipes-connectivity/connman/connman/CVE-2022-32292.patch
new file mode 100644
index 0000000000..182c5ca29c
--- /dev/null
+++ b/meta/recipes-connectivity/connman/connman/CVE-2022-32292.patch
@@ -0,0 +1,37 @@
+From d1a5ede5d255bde8ef707f8441b997563b9312bd Mon Sep 17 00:00:00 2001
+From: Nathan Crandall <ncrandall@tesla.com>
+Date: Tue, 12 Jul 2022 08:56:34 +0200
+Subject: gweb: Fix OOB write in received_data()
+
+There is a mismatch of handling binary vs. C-string data with memchr
+and strlen, resulting in pos, count, and bytes_read to become out of
+sync and result in a heap overflow. Instead, do not treat the buffer
+as an ASCII C-string. We calculate the count based on the return value
+of memchr, instead of strlen.
+
+Fixes: CVE-2022-32292
+
+CVE: CVE-2022-32292
+
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d1a5ede5d255bde8ef707f8441b997563b9312bd]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ gweb/gweb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gweb/gweb.c b/gweb/gweb.c
+index 12fcb1d8..13c6c5f2 100644
+--- a/gweb/gweb.c
++++ b/gweb/gweb.c
+@@ -918,7 +918,7 @@ static gboolean received_data(GIOChannel *channel, GIOCondition cond,
+ }
+
+ *pos = '\0';
+- count = strlen((char *) ptr);
++ count = pos - ptr;
+ if (count > 0 && ptr[count - 1] == '\r') {
+ ptr[--count] = '\0';
+ bytes_read--;
+--
+cgit
+
diff --git a/meta/recipes-connectivity/connman/connman/CVE-2022-32293_p1.patch b/meta/recipes-connectivity/connman/connman/CVE-2022-32293_p1.patch
new file mode 100644
index 0000000000..b280203594
--- /dev/null
+++ b/meta/recipes-connectivity/connman/connman/CVE-2022-32293_p1.patch
@@ -0,0 +1,141 @@
+From 72343929836de80727a27d6744c869dff045757c Mon Sep 17 00:00:00 2001
+From: Daniel Wagner <wagi@monom.org>
+Date: Tue, 5 Jul 2022 08:32:12 +0200
+Subject: wispr: Add reference counter to portal context
+
+Track the connman_wispr_portal_context live time via a
+refcounter. This only adds the infrastructure to do proper reference
+counting.
+
+Fixes: CVE-2022-32293
+CVE: CVE-2022-32293
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=416bfaff988882c553c672e5bfc2d4f648d29e8a]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ src/wispr.c | 52 ++++++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 42 insertions(+), 10 deletions(-)
+
+diff --git a/src/wispr.c b/src/wispr.c
+index a07896ca..bde7e63b 100644
+--- a/src/wispr.c
++++ b/src/wispr.c
+@@ -56,6 +56,7 @@ struct wispr_route {
+ };
+
+ struct connman_wispr_portal_context {
++ int refcount;
+ struct connman_service *service;
+ enum connman_ipconfig_type type;
+ struct connman_wispr_portal *wispr_portal;
+@@ -97,6 +98,11 @@ static char *online_check_ipv4_url = NULL;
+ static char *online_check_ipv6_url = NULL;
+ static bool enable_online_to_ready_transition = false;
+
++#define wispr_portal_context_ref(wp_context) \
++ wispr_portal_context_ref_debug(wp_context, __FILE__, __LINE__, __func__)
++#define wispr_portal_context_unref(wp_context) \
++ wispr_portal_context_unref_debug(wp_context, __FILE__, __LINE__, __func__)
++
+ static void connman_wispr_message_init(struct connman_wispr_message *msg)
+ {
+ DBG("");
+@@ -162,9 +168,6 @@ static void free_connman_wispr_portal_context(
+ {
+ DBG("context %p", wp_context);
+
+- if (!wp_context)
+- return;
+-
+ if (wp_context->wispr_portal) {
+ if (wp_context->wispr_portal->ipv4_context == wp_context)
+ wp_context->wispr_portal->ipv4_context = NULL;
+@@ -201,9 +204,38 @@ static void free_connman_wispr_portal_context(
+ g_free(wp_context);
+ }
+
++static struct connman_wispr_portal_context *
++wispr_portal_context_ref_debug(struct connman_wispr_portal_context *wp_context,
++ const char *file, int line, const char *caller)
++{
++ DBG("%p ref %d by %s:%d:%s()", wp_context,
++ wp_context->refcount + 1, file, line, caller);
++
++ __sync_fetch_and_add(&wp_context->refcount, 1);
++
++ return wp_context;
++}
++
++static void wispr_portal_context_unref_debug(
++ struct connman_wispr_portal_context *wp_context,
++ const char *file, int line, const char *caller)
++{
++ if (!wp_context)
++ return;
++
++ DBG("%p ref %d by %s:%d:%s()", wp_context,
++ wp_context->refcount - 1, file, line, caller);
++
++ if (__sync_fetch_and_sub(&wp_context->refcount, 1) != 1)
++ return;
++
++ free_connman_wispr_portal_context(wp_context);
++}
++
+ static struct connman_wispr_portal_context *create_wispr_portal_context(void)
+ {
+- return g_try_new0(struct connman_wispr_portal_context, 1);
++ return wispr_portal_context_ref(
++ g_new0(struct connman_wispr_portal_context, 1));
+ }
+
+ static void free_connman_wispr_portal(gpointer data)
+@@ -215,8 +247,8 @@ static void free_connman_wispr_portal(gpointer data)
+ if (!wispr_portal)
+ return;
+
+- free_connman_wispr_portal_context(wispr_portal->ipv4_context);
+- free_connman_wispr_portal_context(wispr_portal->ipv6_context);
++ wispr_portal_context_unref(wispr_portal->ipv4_context);
++ wispr_portal_context_unref(wispr_portal->ipv6_context);
+
+ g_free(wispr_portal);
+ }
+@@ -452,7 +484,7 @@ static void portal_manage_status(GWebResult *result,
+ connman_info("Client-Timezone: %s", str);
+
+ if (!enable_online_to_ready_transition)
+- free_connman_wispr_portal_context(wp_context);
++ wispr_portal_context_unref(wp_context);
+
+ __connman_service_ipconfig_indicate_state(service,
+ CONNMAN_SERVICE_STATE_ONLINE, type);
+@@ -616,7 +648,7 @@ static void wispr_portal_request_wispr_login(struct connman_service *service,
+ return;
+ }
+
+- free_connman_wispr_portal_context(wp_context);
++ wispr_portal_context_unref(wp_context);
+ return;
+ }
+
+@@ -952,7 +984,7 @@ static int wispr_portal_detect(struct connman_wispr_portal_context *wp_context)
+
+ if (wp_context->token == 0) {
+ err = -EINVAL;
+- free_connman_wispr_portal_context(wp_context);
++ wispr_portal_context_unref(wp_context);
+ }
+ } else if (wp_context->timeout == 0) {
+ wp_context->timeout = g_idle_add(no_proxy_callback, wp_context);
+@@ -1001,7 +1033,7 @@ int __connman_wispr_start(struct connman_service *service,
+
+ /* If there is already an existing context, we wipe it */
+ if (wp_context)
+- free_connman_wispr_portal_context(wp_context);
++ wispr_portal_context_unref(wp_context);
+
+ wp_context = create_wispr_portal_context();
+ if (!wp_context)
+--
+cgit
+
diff --git a/meta/recipes-connectivity/connman/connman/CVE-2022-32293_p2.patch b/meta/recipes-connectivity/connman/connman/CVE-2022-32293_p2.patch
new file mode 100644
index 0000000000..56f8fc82de
--- /dev/null
+++ b/meta/recipes-connectivity/connman/connman/CVE-2022-32293_p2.patch
@@ -0,0 +1,174 @@
+From 416bfaff988882c553c672e5bfc2d4f648d29e8a Mon Sep 17 00:00:00 2001
+From: Daniel Wagner <wagi@monom.org>
+Date: Tue, 5 Jul 2022 09:11:09 +0200
+Subject: wispr: Update portal context references
+
+Maintain proper portal context references to avoid UAF.
+
+Fixes: CVE-2022-32293
+CVE: CVE-2022-32293
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=72343929836de80727a27d6744c869dff045757c]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ src/wispr.c | 34 ++++++++++++++++++++++------------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+diff --git a/src/wispr.c b/src/wispr.c
+index bde7e63b..84bed33f 100644
+--- a/src/wispr.c
++++ b/src/wispr.c
+@@ -105,8 +105,6 @@ static bool enable_online_to_ready_transition = false;
+
+ static void connman_wispr_message_init(struct connman_wispr_message *msg)
+ {
+- DBG("");
+-
+ msg->has_error = false;
+ msg->current_element = NULL;
+
+@@ -166,8 +164,6 @@ static void free_wispr_routes(struct connman_wispr_portal_context *wp_context)
+ static void free_connman_wispr_portal_context(
+ struct connman_wispr_portal_context *wp_context)
+ {
+- DBG("context %p", wp_context);
+-
+ if (wp_context->wispr_portal) {
+ if (wp_context->wispr_portal->ipv4_context == wp_context)
+ wp_context->wispr_portal->ipv4_context = NULL;
+@@ -483,9 +479,6 @@ static void portal_manage_status(GWebResult *result,
+ &str))
+ connman_info("Client-Timezone: %s", str);
+
+- if (!enable_online_to_ready_transition)
+- wispr_portal_context_unref(wp_context);
+-
+ __connman_service_ipconfig_indicate_state(service,
+ CONNMAN_SERVICE_STATE_ONLINE, type);
+
+@@ -546,14 +539,17 @@ static void wispr_portal_request_portal(
+ {
+ DBG("");
+
++ wispr_portal_context_ref(wp_context);
+ wp_context->request_id = g_web_request_get(wp_context->web,
+ wp_context->status_url,
+ wispr_portal_web_result,
+ wispr_route_request,
+ wp_context);
+
+- if (wp_context->request_id == 0)
++ if (wp_context->request_id == 0) {
+ wispr_portal_error(wp_context);
++ wispr_portal_context_unref(wp_context);
++ }
+ }
+
+ static bool wispr_input(const guint8 **data, gsize *length,
+@@ -618,13 +614,15 @@ static void wispr_portal_browser_reply_cb(struct connman_service *service,
+ return;
+
+ if (!authentication_done) {
+- wispr_portal_error(wp_context);
+ free_wispr_routes(wp_context);
++ wispr_portal_error(wp_context);
++ wispr_portal_context_unref(wp_context);
+ return;
+ }
+
+ /* Restarting the test */
+ __connman_service_wispr_start(service, wp_context->type);
++ wispr_portal_context_unref(wp_context);
+ }
+
+ static void wispr_portal_request_wispr_login(struct connman_service *service,
+@@ -700,11 +698,13 @@ static bool wispr_manage_message(GWebResult *result,
+
+ wp_context->wispr_result = CONNMAN_WISPR_RESULT_LOGIN;
+
++ wispr_portal_context_ref(wp_context);
+ if (__connman_agent_request_login_input(wp_context->service,
+ wispr_portal_request_wispr_login,
+- wp_context) != -EINPROGRESS)
++ wp_context) != -EINPROGRESS) {
+ wispr_portal_error(wp_context);
+- else
++ wispr_portal_context_unref(wp_context);
++ } else
+ return true;
+
+ break;
+@@ -753,6 +753,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+ if (length > 0) {
+ g_web_parser_feed_data(wp_context->wispr_parser,
+ chunk, length);
++ wispr_portal_context_unref(wp_context);
+ return true;
+ }
+
+@@ -770,6 +771,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+
+ switch (status) {
+ case 000:
++ wispr_portal_context_ref(wp_context);
+ __connman_agent_request_browser(wp_context->service,
+ wispr_portal_browser_reply_cb,
+ wp_context->status_url, wp_context);
+@@ -781,11 +783,14 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+ if (g_web_result_get_header(result, "X-ConnMan-Status",
+ &str)) {
+ portal_manage_status(result, wp_context);
++ wispr_portal_context_unref(wp_context);
+ return false;
+- } else
++ } else {
++ wispr_portal_context_ref(wp_context);
+ __connman_agent_request_browser(wp_context->service,
+ wispr_portal_browser_reply_cb,
+ wp_context->redirect_url, wp_context);
++ }
+
+ break;
+ case 300:
+@@ -798,6 +803,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+ !g_web_result_get_header(result, "Location",
+ &redirect)) {
+
++ wispr_portal_context_ref(wp_context);
+ __connman_agent_request_browser(wp_context->service,
+ wispr_portal_browser_reply_cb,
+ wp_context->status_url, wp_context);
+@@ -808,6 +814,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+
+ wp_context->redirect_url = g_strdup(redirect);
+
++ wispr_portal_context_ref(wp_context);
+ wp_context->request_id = g_web_request_get(wp_context->web,
+ redirect, wispr_portal_web_result,
+ wispr_route_request, wp_context);
+@@ -820,6 +827,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+
+ break;
+ case 505:
++ wispr_portal_context_ref(wp_context);
+ __connman_agent_request_browser(wp_context->service,
+ wispr_portal_browser_reply_cb,
+ wp_context->status_url, wp_context);
+@@ -832,6 +840,7 @@ static bool wispr_portal_web_result(GWebResult *result, gpointer user_data)
+ wp_context->request_id = 0;
+ done:
+ wp_context->wispr_msg.message_type = -1;
++ wispr_portal_context_unref(wp_context);
+ return false;
+ }
+
+@@ -890,6 +899,7 @@ static void proxy_callback(const char *proxy, void *user_data)
+ xml_wispr_parser_callback, wp_context);
+
+ wispr_portal_request_portal(wp_context);
++ wispr_portal_context_unref(wp_context);
+ }
+
+ static gboolean no_proxy_callback(gpointer user_data)
+--
+cgit
+
diff --git a/meta/recipes-connectivity/connman/connman_1.41.bb b/meta/recipes-connectivity/connman/connman_1.41.bb
index 736b78eaeb..79542b2175 100644
--- a/meta/recipes-connectivity/connman/connman_1.41.bb
+++ b/meta/recipes-connectivity/connman/connman_1.41.bb
@@ -5,6 +5,9 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/network/${BPN}/${BP}.tar.xz \
file://0001-connman.service-stop-systemd-resolved-when-we-use-co.patch \
file://connman \
file://no-version-scripts.patch \
+ file://CVE-2022-32293_p1.patch \
+ file://CVE-2022-32293_p2.patch \
+ file://CVE-2022-32292.patch \
"
SRC_URI:append:libc-musl = " file://0002-resolve-musl-does-not-implement-res_ninit.patch"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 04/28] u-boot: fix CVE-2022-30552
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (2 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 03/28] connman: Backports for security fixes Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 05/28] u-boot: fix CVE-2022-33967 Steve Sakoman
` (23 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Sakib Sajal <sakib.sajal@windriver.com>
Backport patch to fix CVE-2022-30552.
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...e-minimum-IP-fragmented-datagram-siz.patch | 207 ++++++++++++++++++
meta/recipes-bsp/u-boot/u-boot_2022.01.bb | 1 +
2 files changed, 208 insertions(+)
create mode 100644 meta/recipes-bsp/u-boot/files/0001-net-Check-for-the-minimum-IP-fragmented-datagram-siz.patch
diff --git a/meta/recipes-bsp/u-boot/files/0001-net-Check-for-the-minimum-IP-fragmented-datagram-siz.patch b/meta/recipes-bsp/u-boot/files/0001-net-Check-for-the-minimum-IP-fragmented-datagram-siz.patch
new file mode 100644
index 0000000000..3f9cc7776b
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/0001-net-Check-for-the-minimum-IP-fragmented-datagram-siz.patch
@@ -0,0 +1,207 @@
+From c7cab39de5e4b22620248a190b3d2ee46cff38c2 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@denx.de>
+Date: Thu, 26 May 2022 11:14:37 -0300
+Subject: [PATCH] net: Check for the minimum IP fragmented datagram size
+
+Nicolas Bidron and Nicolas Guigo reported the two bugs below:
+
+"
+----------BUG 1----------
+
+In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
+`ip->ip_len` (IP packet header's Total Length) higher than `IP_HDR_SIZE`
+and strictly lower than `IP_HDR_SIZE+8` will lead to a value for `len`
+comprised between `0` and `7`. This will ultimately result in a
+truncated division by `8` resulting value of `0` forcing the hole
+metadata and fragment to point to the same location. The subsequent
+memcopy will overwrite the hole metadata with the fragment data. Through
+a second fragment, this can be exploited to write to an arbitrary offset
+controlled by that overwritten hole metadata value.
+
+This bug is only exploitable locally as it requires crafting two packets
+the first of which would most likely be dropped through routing due to
+its unexpectedly low Total Length. However, this bug can potentially be
+exploited to root linux based embedded devices locally.
+
+```C
+static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
+{
+ static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
+ static u16 first_hole, total_len;
+ struct hole *payload, *thisfrag, *h, *newh;
+ struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
+ uchar *indata = (uchar *)ip;
+ int offset8, start, len, done = 0;
+ u16 ip_off = ntohs(ip->ip_off);
+
+ /* payload starts after IP header, this fragment is in there */
+ payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
+ offset8 = (ip_off & IP_OFFS);
+ thisfrag = payload + offset8;
+ start = offset8 * 8;
+ len = ntohs(ip->ip_len) - IP_HDR_SIZE;
+```
+
+The last line of the previous excerpt from `u-boot/net/net.c` shows how
+the attacker can control the value of `len` to be strictly lower than
+`8` by issuing a packet with `ip_len` between `21` and `27`
+(`IP_HDR_SIZE` has a value of `20`).
+
+Also note that `offset8` here is `0` which leads to `thisfrag = payload`.
+
+```C
+ } else if (h >= thisfrag) {
+ /* overlaps with initial part of the hole: move this hole */
+ newh = thisfrag + (len / 8);
+ *newh = *h;
+ h = newh;
+ if (h->next_hole)
+ payload[h->next_hole].prev_hole = (h - payload);
+ if (h->prev_hole)
+ payload[h->prev_hole].next_hole = (h - payload);
+ else
+ first_hole = (h - payload);
+
+ } else {
+```
+
+Lower down the same function, execution reaches the above code path.
+Here, `len / 8` evaluates to `0` leading to `newh = thisfrag`. Also note
+that `first_hole` here is `0` since `h` and `payload` point to the same
+location.
+
+```C
+ /* finally copy this fragment and possibly return whole packet */
+ memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
+```
+
+Finally, in the above excerpt the `memcpy` overwrites the hole metadata
+since `thisfrag` and `h` both point to the same location. The hole
+metadata is effectively overwritten with arbitrary data from the
+fragmented IP packet data. If `len` was crafted to be `6`, `last_byte`,
+`next_hole`, and `prev_hole` of the `first_hole` can be controlled by
+the attacker.
+
+Finally the arbitrary offset write occurs through a second fragment that
+only needs to be crafted to write data in the hole pointed to by the
+previously controlled hole metadata (`next_hole`) from the first packet.
+
+ ### Recommendation
+
+Handle cases where `len` is strictly lower than 8 by preventing the
+overwrite of the hole metadata during the memcpy of the fragment. This
+could be achieved by either:
+* Moving the location where the hole metadata is stored when `len` is
+lower than `8`.
+* Or outright rejecting fragmented IP datagram with a Total Length
+(`ip_len`) lower than 28 bytes which is the minimum valid fragmented IP
+datagram size (as defined as the minimum fragment of 8 octets in the IP
+Specification Document:
+[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 25).
+
+----------BUG 2----------
+
+In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
+`ip->ip_len` (IP packet header's Total Length) lower than `IP_HDR_SIZE`
+will lead to a negative value for `len` which will ultimately result in
+a buffer overflow during the subsequent `memcpy` that uses `len` as it's
+`count` parameter.
+
+This bug is only exploitable on local ethernet as it requires crafting
+an invalid packet to include an unexpected `ip_len` value in the IP UDP
+header that's lower than the minimum accepted Total Length of a packet
+(21 as defined in the IP Specification Document:
+[RFC791](https://datatracker.ietf.org/doc/html/rfc791)). Such packet
+would in all likelihood be dropped while being routed to its final
+destination through most routing equipment and as such requires the
+attacker to be in a local position in order to be exploited.
+
+```C
+static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
+{
+ static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
+ static u16 first_hole, total_len;
+ struct hole *payload, *thisfrag, *h, *newh;
+ struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
+ uchar *indata = (uchar *)ip;
+ int offset8, start, len, done = 0;
+ u16 ip_off = ntohs(ip->ip_off);
+
+ /* payload starts after IP header, this fragment is in there */
+ payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
+ offset8 = (ip_off & IP_OFFS);
+ thisfrag = payload + offset8;
+ start = offset8 * 8;
+ len = ntohs(ip->ip_len) - IP_HDR_SIZE;
+```
+
+The last line of the previous excerpt from `u-boot/net/net.c` shows
+where the underflow to a negative `len` value occurs if `ip_len` is set
+to a value strictly lower than 20 (`IP_HDR_SIZE` being 20). Also note
+that in the above excerpt the `pkt_buff` buffer has a size of
+`CONFIG_NET_MAXDEFRAG` which defaults to 16 KB but can range from 1KB to
+64 KB depending on configurations.
+
+```C
+ /* finally copy this fragment and possibly return whole packet */
+ memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
+```
+
+In the above excerpt the `memcpy` overflows the destination by
+attempting to make a copy of nearly 4 gigabytes in a buffer that's
+designed to hold `CONFIG_NET_MAXDEFRAG` bytes at most which leads to a DoS.
+
+ ### Recommendation
+
+Stop processing of the packet if `ip_len` is lower than 21 (as defined
+by the minimum length of a data carrying datagram in the IP
+Specification Document:
+[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 34)."
+
+Add a check for ip_len lesser than 28 and stop processing the packet
+in this case.
+
+Such a check covers the two reported bugs.
+
+Reported-by: Nicolas Bidron <nicolas.bidron@nccgroup.com>
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+
+Upstream-Status: Backport [b85d130ea0cac152c21ec38ac9417b31d41b5552]
+CVE: CVE-2022-30552
+
+Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
+---
+ include/net.h | 2 ++
+ net/net.c | 3 +++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/include/net.h b/include/net.h
+index cec8c98618..09d7e9b9e8 100644
+--- a/include/net.h
++++ b/include/net.h
+@@ -397,6 +397,8 @@ struct ip_hdr {
+
+ #define IP_HDR_SIZE (sizeof(struct ip_hdr))
+
++#define IP_MIN_FRAG_DATAGRAM_SIZE (IP_HDR_SIZE + 8)
++
+ /*
+ * Internet Protocol (IP) + UDP header.
+ */
+diff --git a/net/net.c b/net/net.c
+index c2992a0908..f5400e6dbc 100644
+--- a/net/net.c
++++ b/net/net.c
+@@ -907,6 +907,9 @@ static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
+ int offset8, start, len, done = 0;
+ u16 ip_off = ntohs(ip->ip_off);
+
++ if (ip->ip_len < IP_MIN_FRAG_DATAGRAM_SIZE)
++ return NULL;
++
+ /* payload starts after IP header, this fragment is in there */
+ payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
+ offset8 = (ip_off & IP_OFFS);
+--
+2.33.0
+
diff --git a/meta/recipes-bsp/u-boot/u-boot_2022.01.bb b/meta/recipes-bsp/u-boot/u-boot_2022.01.bb
index a6a15d698f..04f60adaa5 100644
--- a/meta/recipes-bsp/u-boot/u-boot_2022.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot_2022.01.bb
@@ -5,6 +5,7 @@ SRC_URI:append = " file://0001-riscv32-Use-double-float-ABI-for-rv32.patch \
file://0001-riscv-fix-build-with-binutils-2.38.patch \
file://0001-i2c-fix-stack-buffer-overflow-vulnerability-in-i2c-m.patch \
file://0001-fs-squashfs-sqfs_read-Prevent-arbitrary-code-executi.patch \
+ file://0001-net-Check-for-the-minimum-IP-fragmented-datagram-siz.patch \
"
DEPENDS += "bc-native dtc-native python3-setuptools-native"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 05/28] u-boot: fix CVE-2022-33967
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (3 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 04/28] u-boot: fix CVE-2022-30552 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 06/28] grub2: fix several CVEs Steve Sakoman
` (22 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Sakib Sajal <sakib.sajal@windriver.com>
Backport patch to fix CVE-2022-33967.
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...s-squashfs-Use-kcalloc-when-relevant.patch | 64 +++++++++++++++++++
meta/recipes-bsp/u-boot/u-boot_2022.01.bb | 1 +
2 files changed, 65 insertions(+)
create mode 100644 meta/recipes-bsp/u-boot/files/0001-fs-squashfs-Use-kcalloc-when-relevant.patch
diff --git a/meta/recipes-bsp/u-boot/files/0001-fs-squashfs-Use-kcalloc-when-relevant.patch b/meta/recipes-bsp/u-boot/files/0001-fs-squashfs-Use-kcalloc-when-relevant.patch
new file mode 100644
index 0000000000..70fdbb1031
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/0001-fs-squashfs-Use-kcalloc-when-relevant.patch
@@ -0,0 +1,64 @@
+From 50d4b8b9effcf9dc9e5a90034de2f0003fb063f0 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Mon, 27 Jun 2022 12:20:03 +0200
+Subject: [PATCH] fs/squashfs: Use kcalloc when relevant
+
+A crafted squashfs image could embed a huge number of empty metadata
+blocks in order to make the amount of malloc()'d memory overflow and be
+much smaller than expected. Because of this flaw, any random code
+positioned at the right location in the squashfs image could be memcpy'd
+from the squashfs structures into U-Boot code location while trying to
+access the rearmost blocks, before being executed.
+
+In order to prevent this vulnerability from being exploited in eg. a
+secure boot environment, let's add a check over the amount of data
+that is going to be allocated. Such a check could look like:
+
+if (!elem_size || n > SIZE_MAX / elem_size)
+ return NULL;
+
+The right way to do it would be to enhance the calloc() implementation
+but this is quite an impacting change for such a small fix. Another
+solution would be to add the check before the malloc call in the
+squashfs implementation, but this does not look right. So for now, let's
+use the kcalloc() compatibility function from Linux, which has this
+check.
+
+Fixes: c5100613037 ("fs/squashfs: new filesystem")
+Reported-by: Tatsuhiko Yasumatsu <Tatsuhiko.Yasumatsu@sony.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Tested-by: Tatsuhiko Yasumatsu <Tatsuhiko.Yasumatsu@sony.com>
+
+Upstream-Status: Backport [7f7fb9937c6cb49dd35153bd6708872b390b0a44]
+CVE: CVE-2022-33967
+
+Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
+---
+ fs/squashfs/sqfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
+index e2d91c654c..10e63afbce 100644
+--- a/fs/squashfs/sqfs.c
++++ b/fs/squashfs/sqfs.c
+@@ -13,6 +13,7 @@
+ #include <linux/types.h>
+ #include <linux/byteorder/little_endian.h>
+ #include <linux/byteorder/generic.h>
++#include <linux/compat.h>
+ #include <memalign.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -725,7 +726,8 @@ static int sqfs_read_inode_table(unsigned char **inode_table)
+ goto free_itb;
+ }
+
+- *inode_table = malloc(metablks_count * SQFS_METADATA_BLOCK_SIZE);
++ *inode_table = kcalloc(metablks_count, SQFS_METADATA_BLOCK_SIZE,
++ GFP_KERNEL);
+ if (!*inode_table) {
+ ret = -ENOMEM;
+ goto free_itb;
+--
+2.33.0
+
diff --git a/meta/recipes-bsp/u-boot/u-boot_2022.01.bb b/meta/recipes-bsp/u-boot/u-boot_2022.01.bb
index 04f60adaa5..54033698be 100644
--- a/meta/recipes-bsp/u-boot/u-boot_2022.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot_2022.01.bb
@@ -6,6 +6,7 @@ SRC_URI:append = " file://0001-riscv32-Use-double-float-ABI-for-rv32.patch \
file://0001-i2c-fix-stack-buffer-overflow-vulnerability-in-i2c-m.patch \
file://0001-fs-squashfs-sqfs_read-Prevent-arbitrary-code-executi.patch \
file://0001-net-Check-for-the-minimum-IP-fragmented-datagram-siz.patch \
+ file://0001-fs-squashfs-Use-kcalloc-when-relevant.patch \
"
DEPENDS += "bc-native dtc-native python3-setuptools-native"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 06/28] grub2: fix several CVEs
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (4 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 05/28] u-boot: fix CVE-2022-33967 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 07/28] cve-check: Don't use f-strings Steve Sakoman
` (21 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Yongxin Liu <yongxin.liu@windriver.com>
Backport CVE patches from upstream to fix:
CVE-2021-3695
CVE-2021-3696
CVE-2021-3697
CVE-2022-28733
CVE-2022-28734
CVE-2022-28735
Backport the following 5 patches to make CVE patches be applied smoothly.
video-Remove-trailing-whitespaces.patch
video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit db43401a3a4c201f02f4128fa4bac8ce993bfec0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...g-Drop-greyscale-support-to-fix-heap.patch | 179 +++++
...ng-Avoid-heap-OOB-R-W-inserting-huff.patch | 50 ++
...peg-Block-int-underflow-wild-pointer.patch | 84 +++
...3-net-ip-Do-IP-fragment-maths-safely.patch | 63 ++
| 58 ++
| 56 ++
...ct-non-kernel-files-in-the-shim_lock.patch | 111 +++
.../video-Remove-trailing-whitespaces.patch | 693 ++++++++++++++++++
...eg-Abort-sooner-if-a-read-operation-.patch | 264 +++++++
...eg-Refuse-to-handle-multiple-start-o.patch | 53 ++
meta/recipes-bsp/grub/grub2.inc | 10 +
11 files changed, 1621 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2021-3695-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2021-3696-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2021-3697-video-readers-jpeg-Block-int-underflow-wild-pointer.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28733-net-ip-Do-IP-fragment-maths-safely.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28734-net-http-Error-out-on-headers-with-LF-without-CR.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28734-net-http-Fix-OOB-write-for-split-http-headers.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28735-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
create mode 100644 meta/recipes-bsp/grub/files/video-Remove-trailing-whitespaces.patch
create mode 100644 meta/recipes-bsp/grub/files/video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
create mode 100644 meta/recipes-bsp/grub/files/video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2021-3695-video-readers-png-Drop-greyscale-support-to-fix-heap.patch b/meta/recipes-bsp/grub/files/CVE-2021-3695-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
new file mode 100644
index 0000000000..7f7bb1acfe
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2021-3695-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
@@ -0,0 +1,179 @@
+From e623866d9286410156e8b9d2c82d6253a1b22d08 Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Tue, 6 Jul 2021 18:51:35 +1000
+Subject: [PATCH] video/readers/png: Drop greyscale support to fix heap
+ out-of-bounds write
+
+A 16-bit greyscale PNG without alpha is processed in the following loop:
+
+ for (i = 0; i < (data->image_width * data->image_height);
+ i++, d1 += 4, d2 += 2)
+ {
+ d1[R3] = d2[1];
+ d1[G3] = d2[1];
+ d1[B3] = d2[1];
+ }
+
+The increment of d1 is wrong. d1 is incremented by 4 bytes per iteration,
+but there are only 3 bytes allocated for storage. This means that image
+data will overwrite somewhat-attacker-controlled parts of memory - 3 bytes
+out of every 4 following the end of the image.
+
+This has existed since greyscale support was added in 2013 in commit
+3ccf16dff98f (grub-core/video/readers/png.c: Support grayscale).
+
+Saving starfield.png as a 16-bit greyscale image without alpha in the gimp
+and attempting to load it causes grub-emu to crash - I don't think this code
+has ever worked.
+
+Delete all PNG greyscale support.
+
+Fixes: CVE-2021-3695
+
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+Upstream-Status: Backport
+CVE: CVE-2021-3695
+
+Reference to upstream patch:
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=e623866d9286410156e8b9d2c82d6253a1b22d08
+
+Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
+---
+ grub-core/video/readers/png.c | 87 +++--------------------------------
+ 1 file changed, 7 insertions(+), 80 deletions(-)
+
+diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c
+index 35ae553c8..a3161e25b 100644
+--- a/grub-core/video/readers/png.c
++++ b/grub-core/video/readers/png.c
+@@ -100,7 +100,7 @@ struct grub_png_data
+
+ unsigned image_width, image_height;
+ int bpp, is_16bit;
+- int raw_bytes, is_gray, is_alpha, is_palette;
++ int raw_bytes, is_alpha, is_palette;
+ int row_bytes, color_bits;
+ grub_uint8_t *image_data;
+
+@@ -296,13 +296,13 @@ grub_png_decode_image_header (struct grub_png_data *data)
+ data->bpp = 3;
+ else
+ {
+- data->is_gray = 1;
+- data->bpp = 1;
++ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
++ "png: color type not supported");
+ }
+
+ if ((color_bits != 8) && (color_bits != 16)
+ && (color_bits != 4
+- || !(data->is_gray || data->is_palette)))
++ || !data->is_palette))
+ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
+ "png: bit depth must be 8 or 16");
+
+@@ -331,7 +331,7 @@ grub_png_decode_image_header (struct grub_png_data *data)
+ }
+
+ #ifndef GRUB_CPU_WORDS_BIGENDIAN
+- if (data->is_16bit || data->is_gray || data->is_palette)
++ if (data->is_16bit || data->is_palette)
+ #endif
+ {
+ data->image_data = grub_calloc (data->image_height, data->row_bytes);
+@@ -899,27 +899,8 @@ grub_png_convert_image (struct grub_png_data *data)
+ int shift;
+ int mask = (1 << data->color_bits) - 1;
+ unsigned j;
+- if (data->is_gray)
+- {
+- /* Generic formula is
+- (0xff * i) / ((1U << data->color_bits) - 1)
+- but for allowed bit depth of 1, 2 and for it's
+- equivalent to
+- (0xff / ((1U << data->color_bits) - 1)) * i
+- Precompute the multipliers to avoid division.
+- */
+-
+- const grub_uint8_t multipliers[5] = { 0xff, 0xff, 0x55, 0x24, 0x11 };
+- for (i = 0; i < (1U << data->color_bits); i++)
+- {
+- grub_uint8_t col = multipliers[data->color_bits] * i;
+- palette[i][0] = col;
+- palette[i][1] = col;
+- palette[i][2] = col;
+- }
+- }
+- else
+- grub_memcpy (palette, data->palette, 3 << data->color_bits);
++
++ grub_memcpy (palette, data->palette, 3 << data->color_bits);
+ d1c = d1;
+ d2c = d2;
+ for (j = 0; j < data->image_height; j++, d1c += data->image_width * 3,
+@@ -957,60 +938,6 @@ grub_png_convert_image (struct grub_png_data *data)
+ return;
+ }
+
+- if (data->is_gray)
+- {
+- switch (data->bpp)
+- {
+- case 4:
+- /* 16-bit gray with alpha. */
+- for (i = 0; i < (data->image_width * data->image_height);
+- i++, d1 += 4, d2 += 4)
+- {
+- d1[R4] = d2[3];
+- d1[G4] = d2[3];
+- d1[B4] = d2[3];
+- d1[A4] = d2[1];
+- }
+- break;
+- case 2:
+- if (data->is_16bit)
+- /* 16-bit gray without alpha. */
+- {
+- for (i = 0; i < (data->image_width * data->image_height);
+- i++, d1 += 4, d2 += 2)
+- {
+- d1[R3] = d2[1];
+- d1[G3] = d2[1];
+- d1[B3] = d2[1];
+- }
+- }
+- else
+- /* 8-bit gray with alpha. */
+- {
+- for (i = 0; i < (data->image_width * data->image_height);
+- i++, d1 += 4, d2 += 2)
+- {
+- d1[R4] = d2[1];
+- d1[G4] = d2[1];
+- d1[B4] = d2[1];
+- d1[A4] = d2[0];
+- }
+- }
+- break;
+- /* 8-bit gray without alpha. */
+- case 1:
+- for (i = 0; i < (data->image_width * data->image_height);
+- i++, d1 += 3, d2++)
+- {
+- d1[R3] = d2[0];
+- d1[G3] = d2[0];
+- d1[B3] = d2[0];
+- }
+- break;
+- }
+- return;
+- }
+-
+ {
+ /* Only copy the upper 8 bit. */
+ #ifndef GRUB_CPU_WORDS_BIGENDIAN
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/grub/files/CVE-2021-3696-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff.patch b/meta/recipes-bsp/grub/files/CVE-2021-3696-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff.patch
new file mode 100644
index 0000000000..f06514e665
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2021-3696-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff.patch
@@ -0,0 +1,50 @@
+From 210245129c932dc9e1c2748d9d35524fb95b5042 Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Tue, 6 Jul 2021 23:25:07 +1000
+Subject: [PATCH] video/readers/png: Avoid heap OOB R/W inserting huff table
+ items
+
+In fuzzing we observed crashes where a code would attempt to be inserted
+into a huffman table before the start, leading to a set of heap OOB reads
+and writes as table entries with negative indices were shifted around and
+the new code written in.
+
+Catch the case where we would underflow the array and bail.
+
+Fixes: CVE-2021-3696
+
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+Upstream-Status: Backport
+CVE: CVE-2021-3696
+
+Reference to upstream patch:
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=210245129c932dc9e1c2748d9d35524fb95b5042
+
+Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
+---
+ grub-core/video/readers/png.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c
+index a3161e25b..d7ed5aa6c 100644
+--- a/grub-core/video/readers/png.c
++++ b/grub-core/video/readers/png.c
+@@ -438,6 +438,13 @@ grub_png_insert_huff_item (struct huff_table *ht, int code, int len)
+ for (i = len; i < ht->max_length; i++)
+ n += ht->maxval[i];
+
++ if (n > ht->num_values)
++ {
++ grub_error (GRUB_ERR_BAD_FILE_TYPE,
++ "png: out of range inserting huffman table item");
++ return;
++ }
++
+ for (i = 0; i < n; i++)
+ ht->values[ht->num_values - i] = ht->values[ht->num_values - i - 1];
+
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/grub/files/CVE-2021-3697-video-readers-jpeg-Block-int-underflow-wild-pointer.patch b/meta/recipes-bsp/grub/files/CVE-2021-3697-video-readers-jpeg-Block-int-underflow-wild-pointer.patch
new file mode 100644
index 0000000000..e9fc52df86
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2021-3697-video-readers-jpeg-Block-int-underflow-wild-pointer.patch
@@ -0,0 +1,84 @@
+From 22a3f97d39f6a10b08ad7fd1cc47c4dcd10413f6 Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Wed, 7 Jul 2021 15:38:19 +1000
+Subject: [PATCH] video/readers/jpeg: Block int underflow -> wild pointer write
+
+Certain 1 px wide images caused a wild pointer write in
+grub_jpeg_ycrcb_to_rgb(). This was caused because in grub_jpeg_decode_data(),
+we have the following loop:
+
+for (; data->r1 < nr1 && (!data->dri || rst);
+ data->r1++, data->bitmap_ptr += (vb * data->image_width - hb * nc1) * 3)
+
+We did not check if vb * width >= hb * nc1.
+
+On a 64-bit platform, if that turns out to be negative, it will underflow,
+be interpreted as unsigned 64-bit, then be added to the 64-bit pointer, so
+we see data->bitmap_ptr jump, e.g.:
+
+0x6180_0000_0480 to
+0x6181_0000_0498
+ ^
+ ~--- carry has occurred and this pointer is now far away from
+ any object.
+
+On a 32-bit platform, it will decrement the pointer, creating a pointer
+that won't crash but will overwrite random data.
+
+Catch the underflow and error out.
+
+Fixes: CVE-2021-3697
+
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+Upstream-Status: Backport
+CVE: CVE-2021-3697
+
+Reference to upstream patch:
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=22a3f97d39f6a10b08ad7fd1cc47c4dcd10413f6
+
+Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
+---
+ grub-core/video/readers/jpeg.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
+index 579bbe8a4..09596fbf5 100644
+--- a/grub-core/video/readers/jpeg.c
++++ b/grub-core/video/readers/jpeg.c
+@@ -23,6 +23,7 @@
+ #include <grub/mm.h>
+ #include <grub/misc.h>
+ #include <grub/bufio.h>
++#include <grub/safemath.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -699,6 +700,7 @@ static grub_err_t
+ grub_jpeg_decode_data (struct grub_jpeg_data *data)
+ {
+ unsigned c1, vb, hb, nr1, nc1;
++ unsigned stride_a, stride_b, stride;
+ int rst = data->dri;
+ grub_err_t err = GRUB_ERR_NONE;
+
+@@ -711,8 +713,14 @@ grub_jpeg_decode_data (struct grub_jpeg_data *data)
+ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
+ "jpeg: attempted to decode data before start of stream");
+
++ if (grub_mul(vb, data->image_width, &stride_a) ||
++ grub_mul(hb, nc1, &stride_b) ||
++ grub_sub(stride_a, stride_b, &stride))
++ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
++ "jpeg: cannot decode image with these dimensions");
++
+ for (; data->r1 < nr1 && (!data->dri || rst);
+- data->r1++, data->bitmap_ptr += (vb * data->image_width - hb * nc1) * 3)
++ data->r1++, data->bitmap_ptr += stride * 3)
+ for (c1 = 0; c1 < nc1 && (!data->dri || rst);
+ c1++, rst--, data->bitmap_ptr += hb * 3)
+ {
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/grub/files/CVE-2022-28733-net-ip-Do-IP-fragment-maths-safely.patch b/meta/recipes-bsp/grub/files/CVE-2022-28733-net-ip-Do-IP-fragment-maths-safely.patch
new file mode 100644
index 0000000000..8bf9090f94
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2022-28733-net-ip-Do-IP-fragment-maths-safely.patch
@@ -0,0 +1,63 @@
+From 3e4817538de828319ba6d59ced2fbb9b5ca13287 Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Mon, 20 Dec 2021 19:41:21 +1100
+Subject: [PATCH] net/ip: Do IP fragment maths safely
+
+We can receive packets with invalid IP fragmentation information. This
+can lead to rsm->total_len underflowing and becoming very large.
+
+Then, in grub_netbuff_alloc(), we add to this very large number, which can
+cause it to overflow and wrap back around to a small positive number.
+The allocation then succeeds, but the resulting buffer is too small and
+subsequent operations can write past the end of the buffer.
+
+Catch the underflow here.
+
+Fixes: CVE-2022-28733
+
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-28733
+
+Reference to upstream patch:
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=3e4817538de828319ba6d59ced2fbb9b5ca13287
+
+Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
+
+---
+ grub-core/net/ip.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/net/ip.c b/grub-core/net/ip.c
+index e3d62e97f..3c3d0be0e 100644
+--- a/grub-core/net/ip.c
++++ b/grub-core/net/ip.c
+@@ -25,6 +25,7 @@
+ #include <grub/net/netbuff.h>
+ #include <grub/mm.h>
+ #include <grub/priority_queue.h>
++#include <grub/safemath.h>
+ #include <grub/time.h>
+
+ struct iphdr {
+@@ -512,7 +513,14 @@ grub_net_recv_ip4_packets (struct grub_net_buff *nb,
+ {
+ rsm->total_len = (8 * (grub_be_to_cpu16 (iph->frags) & OFFSET_MASK)
+ + (nb->tail - nb->data));
+- rsm->total_len -= ((iph->verhdrlen & 0xf) * sizeof (grub_uint32_t));
++
++ if (grub_sub (rsm->total_len, (iph->verhdrlen & 0xf) * sizeof (grub_uint32_t),
++ &rsm->total_len))
++ {
++ grub_dprintf ("net", "IP reassembly size underflow\n");
++ return GRUB_ERR_NONE;
++ }
++
+ rsm->asm_netbuff = grub_netbuff_alloc (rsm->total_len);
+ if (!rsm->asm_netbuff)
+ {
+--
+2.34.1
+
--git a/meta/recipes-bsp/grub/files/CVE-2022-28734-net-http-Error-out-on-headers-with-LF-without-CR.patch b/meta/recipes-bsp/grub/files/CVE-2022-28734-net-http-Error-out-on-headers-with-LF-without-CR.patch
new file mode 100644
index 0000000000..f31167d315
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2022-28734-net-http-Error-out-on-headers-with-LF-without-CR.patch
@@ -0,0 +1,58 @@
+From b26b4c08e7119281ff30d0fb4a6169bd2afa8fe4 Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Tue, 8 Mar 2022 19:04:40 +1100
+Subject: [PATCH] net/http: Error out on headers with LF without CR
+
+In a similar vein to the previous patch, parse_line() would write
+a NUL byte past the end of the buffer if there was an HTTP header
+with a LF rather than a CRLF.
+
+RFC-2616 says:
+
+ Many HTTP/1.1 header field values consist of words separated by LWS
+ or special characters. These special characters MUST be in a quoted
+ string to be used within a parameter value (as defined in section 3.6).
+
+We don't support quoted sections or continuation lines, etc.
+
+If we see an LF that's not part of a CRLF, bail out.
+
+Fixes: CVE-2022-28734
+
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-28734
+
+Reference to upstream patch:
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=b26b4c08e7119281ff30d0fb4a6169bd2afa8fe4
+
+Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
+---
+ grub-core/net/http.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/grub-core/net/http.c b/grub-core/net/http.c
+index 33a0a28c4..9291a13e2 100644
+--- a/grub-core/net/http.c
++++ b/grub-core/net/http.c
+@@ -68,7 +68,15 @@ parse_line (grub_file_t file, http_data_t data, char *ptr, grub_size_t len)
+ char *end = ptr + len;
+ while (end > ptr && *(end - 1) == '\r')
+ end--;
++
++ /* LF without CR. */
++ if (end == ptr + len)
++ {
++ data->errmsg = grub_strdup (_("invalid HTTP header - LF without CR"));
++ return GRUB_ERR_NONE;
++ }
+ *end = 0;
++
+ /* Trailing CRLF. */
+ if (data->in_chunk_len == 1)
+ {
+--
+2.34.1
+
--git a/meta/recipes-bsp/grub/files/CVE-2022-28734-net-http-Fix-OOB-write-for-split-http-headers.patch b/meta/recipes-bsp/grub/files/CVE-2022-28734-net-http-Fix-OOB-write-for-split-http-headers.patch
new file mode 100644
index 0000000000..e0ca1eec44
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2022-28734-net-http-Fix-OOB-write-for-split-http-headers.patch
@@ -0,0 +1,56 @@
+From ec6bfd3237394c1c7dbf2fd73417173318d22f4b Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Tue, 8 Mar 2022 18:17:03 +1100
+Subject: [PATCH] net/http: Fix OOB write for split http headers
+
+GRUB has special code for handling an http header that is split
+across two packets.
+
+The code tracks the end of line by looking for a "\n" byte. The
+code for split headers has always advanced the pointer just past the
+end of the line, whereas the code that handles unsplit headers does
+not advance the pointer. This extra advance causes the length to be
+one greater, which breaks an assumption in parse_line(), leading to
+it writing a NUL byte one byte past the end of the buffer where we
+reconstruct the line from the two packets.
+
+It's conceivable that an attacker controlled set of packets could
+cause this to zero out the first byte of the "next" pointer of the
+grub_mm_region structure following the current_line buffer.
+
+Do not advance the pointer in the split header case.
+
+Fixes: CVE-2022-28734
+
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-28734
+
+Reference to upstream patch:
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=ec6bfd3237394c1c7dbf2fd73417173318d22f4b
+
+Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
+---
+ grub-core/net/http.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/grub-core/net/http.c b/grub-core/net/http.c
+index f8d7bf0cd..33a0a28c4 100644
+--- a/grub-core/net/http.c
++++ b/grub-core/net/http.c
+@@ -190,9 +190,7 @@ http_receive (grub_net_tcp_socket_t sock __attribute__ ((unused)),
+ int have_line = 1;
+ char *t;
+ ptr = grub_memchr (nb->data, '\n', nb->tail - nb->data);
+- if (ptr)
+- ptr++;
+- else
++ if (ptr == NULL)
+ {
+ have_line = 0;
+ ptr = (char *) nb->tail;
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/grub/files/CVE-2022-28735-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch b/meta/recipes-bsp/grub/files/CVE-2022-28735-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
new file mode 100644
index 0000000000..7a59f10bfb
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2022-28735-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
@@ -0,0 +1,111 @@
+From 6fe755c5c07bb386fda58306bfd19e4a1c974c53 Mon Sep 17 00:00:00 2001
+From: Julian Andres Klode <julian.klode@canonical.com>
+Date: Thu, 2 Dec 2021 15:03:53 +0100
+Subject: [PATCH] kern/efi/sb: Reject non-kernel files in the shim_lock
+ verifier
+
+We must not allow other verifiers to pass things like the GRUB modules.
+Instead of maintaining a blocklist, maintain an allowlist of things
+that we do not care about.
+
+This allowlist really should be made reusable, and shared by the
+lockdown verifier, but this is the minimal patch addressing
+security concerns where the TPM verifier was able to mark modules
+as verified (or the OpenPGP verifier for that matter), when it
+should not do so on shim-powered secure boot systems.
+
+Fixes: CVE-2022-28735
+
+Signed-off-by: Julian Andres Klode <julian.klode@canonical.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+Upstream-Status: Backport
+CVE:CVE-2022-28735
+
+Reference to upstream patch:
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=6fe755c5c07bb386fda58306bfd19e4a1c974c53
+
+Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
+---
+ grub-core/kern/efi/sb.c | 39 ++++++++++++++++++++++++++++++++++++---
+ include/grub/verify.h | 1 +
+ 2 files changed, 37 insertions(+), 3 deletions(-)
+
+diff --git a/grub-core/kern/efi/sb.c b/grub-core/kern/efi/sb.c
+index c52ec6226..89c4bb3fd 100644
+--- a/grub-core/kern/efi/sb.c
++++ b/grub-core/kern/efi/sb.c
+@@ -119,10 +119,11 @@ shim_lock_verifier_init (grub_file_t io __attribute__ ((unused)),
+ void **context __attribute__ ((unused)),
+ enum grub_verify_flags *flags)
+ {
+- *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION;
++ *flags = GRUB_VERIFY_FLAGS_NONE;
+
+ switch (type & GRUB_FILE_TYPE_MASK)
+ {
++ /* Files we check. */
+ case GRUB_FILE_TYPE_LINUX_KERNEL:
+ case GRUB_FILE_TYPE_MULTIBOOT_KERNEL:
+ case GRUB_FILE_TYPE_BSD_KERNEL:
+@@ -130,11 +131,43 @@ shim_lock_verifier_init (grub_file_t io __attribute__ ((unused)),
+ case GRUB_FILE_TYPE_PLAN9_KERNEL:
+ case GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE:
+ *flags = GRUB_VERIFY_FLAGS_SINGLE_CHUNK;
++ return GRUB_ERR_NONE;
+
+- /* Fall through. */
++ /* Files that do not affect secureboot state. */
++ case GRUB_FILE_TYPE_NONE:
++ case GRUB_FILE_TYPE_LOOPBACK:
++ case GRUB_FILE_TYPE_LINUX_INITRD:
++ case GRUB_FILE_TYPE_OPENBSD_RAMDISK:
++ case GRUB_FILE_TYPE_XNU_RAMDISK:
++ case GRUB_FILE_TYPE_SIGNATURE:
++ case GRUB_FILE_TYPE_PUBLIC_KEY:
++ case GRUB_FILE_TYPE_PUBLIC_KEY_TRUST:
++ case GRUB_FILE_TYPE_PRINT_BLOCKLIST:
++ case GRUB_FILE_TYPE_TESTLOAD:
++ case GRUB_FILE_TYPE_GET_SIZE:
++ case GRUB_FILE_TYPE_FONT:
++ case GRUB_FILE_TYPE_ZFS_ENCRYPTION_KEY:
++ case GRUB_FILE_TYPE_CAT:
++ case GRUB_FILE_TYPE_HEXCAT:
++ case GRUB_FILE_TYPE_CMP:
++ case GRUB_FILE_TYPE_HASHLIST:
++ case GRUB_FILE_TYPE_TO_HASH:
++ case GRUB_FILE_TYPE_KEYBOARD_LAYOUT:
++ case GRUB_FILE_TYPE_PIXMAP:
++ case GRUB_FILE_TYPE_GRUB_MODULE_LIST:
++ case GRUB_FILE_TYPE_CONFIG:
++ case GRUB_FILE_TYPE_THEME:
++ case GRUB_FILE_TYPE_GETTEXT_CATALOG:
++ case GRUB_FILE_TYPE_FS_SEARCH:
++ case GRUB_FILE_TYPE_LOADENV:
++ case GRUB_FILE_TYPE_SAVEENV:
++ case GRUB_FILE_TYPE_VERIFY_SIGNATURE:
++ *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION;
++ return GRUB_ERR_NONE;
+
++ /* Other files. */
+ default:
+- return GRUB_ERR_NONE;
++ return grub_error (GRUB_ERR_ACCESS_DENIED, N_("prohibited by secure boot policy"));
+ }
+ }
+
+diff --git a/include/grub/verify.h b/include/grub/verify.h
+index cd129c398..672ae1692 100644
+--- a/include/grub/verify.h
++++ b/include/grub/verify.h
+@@ -24,6 +24,7 @@
+
+ enum grub_verify_flags
+ {
++ GRUB_VERIFY_FLAGS_NONE = 0,
+ GRUB_VERIFY_FLAGS_SKIP_VERIFICATION = 1,
+ GRUB_VERIFY_FLAGS_SINGLE_CHUNK = 2,
+ /* Defer verification to another authority. */
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/grub/files/video-Remove-trailing-whitespaces.patch b/meta/recipes-bsp/grub/files/video-Remove-trailing-whitespaces.patch
new file mode 100644
index 0000000000..2db9bcbbc5
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/video-Remove-trailing-whitespaces.patch
@@ -0,0 +1,693 @@
+From 1f48917d8ddb490dcdc70176e0f58136b7f7811a Mon Sep 17 00:00:00 2001
+From: Elyes Haouas <ehaouas@noos.fr>
+Date: Fri, 4 Mar 2022 07:42:13 +0100
+Subject: [PATCH] video: Remove trailing whitespaces
+
+Signed-off-by: Elyes Haouas <ehaouas@noos.fr>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+Upstream-Status: Backport
+
+Reference to upstream patch:
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=1f48917d8ddb490dcdc70176e0f58136b7f7811a
+
+Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
+---
+ grub-core/video/bochs.c | 2 +-
+ grub-core/video/capture.c | 2 +-
+ grub-core/video/cirrus.c | 4 ++--
+ grub-core/video/coreboot/cbfb.c | 2 +-
+ grub-core/video/efi_gop.c | 22 +++++++++----------
+ grub-core/video/fb/fbblit.c | 8 +++----
+ grub-core/video/fb/video_fb.c | 10 ++++-----
+ grub-core/video/i386/pc/vbe.c | 34 ++++++++++++++---------------
+ grub-core/video/i386/pc/vga.c | 6 ++---
+ grub-core/video/ieee1275.c | 4 ++--
+ grub-core/video/radeon_fuloong2e.c | 6 ++---
+ grub-core/video/radeon_yeeloong3a.c | 6 ++---
+ grub-core/video/readers/png.c | 2 +-
+ grub-core/video/readers/tga.c | 2 +-
+ grub-core/video/sis315_init.c | 2 +-
+ grub-core/video/sis315pro.c | 8 +++----
+ grub-core/video/sm712.c | 10 ++++-----
+ grub-core/video/video.c | 8 +++----
+ 18 files changed, 69 insertions(+), 69 deletions(-)
+
+diff --git a/grub-core/video/bochs.c b/grub-core/video/bochs.c
+index 30ea1bd82..edc651697 100644
+--- a/grub-core/video/bochs.c
++++ b/grub-core/video/bochs.c
+@@ -212,7 +212,7 @@ find_card (grub_pci_device_t dev, grub_pci_id_t pciid, void *data)
+
+ if (((class >> 16) & 0xffff) != 0x0300 || pciid != 0x11111234)
+ return 0;
+-
++
+ addr = grub_pci_make_address (dev, GRUB_PCI_REG_ADDRESS_REG0);
+ framebuffer.base = grub_pci_read (addr) & GRUB_PCI_ADDR_MEM_MASK;
+ if (!framebuffer.base)
+diff --git a/grub-core/video/capture.c b/grub-core/video/capture.c
+index 4d3195e01..c653d89f9 100644
+--- a/grub-core/video/capture.c
++++ b/grub-core/video/capture.c
+@@ -92,7 +92,7 @@ grub_video_capture_start (const struct grub_video_mode_info *mode_info,
+ framebuffer.ptr = grub_calloc (framebuffer.mode_info.height, framebuffer.mode_info.pitch);
+ if (!framebuffer.ptr)
+ return grub_errno;
+-
++
+ err = grub_video_fb_create_render_target_from_pointer (&framebuffer.render_target,
+ &framebuffer.mode_info,
+ framebuffer.ptr);
+diff --git a/grub-core/video/cirrus.c b/grub-core/video/cirrus.c
+index e2149e8ce..f5542ccdc 100644
+--- a/grub-core/video/cirrus.c
++++ b/grub-core/video/cirrus.c
+@@ -354,11 +354,11 @@ grub_video_cirrus_setup (unsigned int width, unsigned int height,
+ grub_uint8_t sr_ext = 0, hidden_dac = 0;
+
+ grub_vga_set_geometry (&config, grub_vga_cr_write);
+-
++
+ grub_vga_gr_write (GRUB_VGA_GR_MODE_256_COLOR | GRUB_VGA_GR_MODE_READ_MODE1,
+ GRUB_VGA_GR_MODE);
+ grub_vga_gr_write (GRUB_VGA_GR_GR6_GRAPHICS_MODE, GRUB_VGA_GR_GR6);
+-
++
+ grub_vga_sr_write (GRUB_VGA_SR_MEMORY_MODE_NORMAL, GRUB_VGA_SR_MEMORY_MODE);
+
+ grub_vga_cr_write ((config.pitch >> CIRRUS_CR_EXTENDED_DISPLAY_PITCH_SHIFT)
+diff --git a/grub-core/video/coreboot/cbfb.c b/grub-core/video/coreboot/cbfb.c
+index 9af81fa5b..986003c51 100644
+--- a/grub-core/video/coreboot/cbfb.c
++++ b/grub-core/video/coreboot/cbfb.c
+@@ -106,7 +106,7 @@ grub_video_cbfb_setup (unsigned int width, unsigned int height,
+
+ grub_video_fb_set_palette (0, GRUB_VIDEO_FBSTD_NUMCOLORS,
+ grub_video_fbstd_colors);
+-
++
+ return err;
+ }
+
+diff --git a/grub-core/video/efi_gop.c b/grub-core/video/efi_gop.c
+index b7590dc6c..7a5054631 100644
+--- a/grub-core/video/efi_gop.c
++++ b/grub-core/video/efi_gop.c
+@@ -273,7 +273,7 @@ grub_video_gop_iterate (int (*hook) (const struct grub_video_mode_info *info, vo
+ grub_efi_status_t status;
+ struct grub_efi_gop_mode_info *info = NULL;
+ struct grub_video_mode_info mode_info;
+-
++
+ status = efi_call_4 (gop->query_mode, gop, mode, &size, &info);
+
+ if (status)
+@@ -390,7 +390,7 @@ grub_video_gop_setup (unsigned int width, unsigned int height,
+ found = 1;
+ }
+ }
+-
++
+ if (!found)
+ {
+ unsigned mode;
+@@ -399,7 +399,7 @@ grub_video_gop_setup (unsigned int width, unsigned int height,
+ {
+ grub_efi_uintn_t size;
+ grub_efi_status_t status;
+-
++
+ status = efi_call_4 (gop->query_mode, gop, mode, &size, &info);
+ if (status)
+ {
+@@ -472,11 +472,11 @@ grub_video_gop_setup (unsigned int width, unsigned int height,
+ framebuffer.ptr = (void *) (grub_addr_t) gop->mode->fb_base;
+ framebuffer.offscreen
+ = grub_malloc (framebuffer.mode_info.height
+- * framebuffer.mode_info.width
++ * framebuffer.mode_info.width
+ * sizeof (struct grub_efi_gop_blt_pixel));
+
+ buffer = framebuffer.offscreen;
+-
++
+ if (!buffer)
+ {
+ grub_dprintf ("video", "GOP: couldn't allocate shadow\n");
+@@ -485,11 +485,11 @@ grub_video_gop_setup (unsigned int width, unsigned int height,
+ &framebuffer.mode_info);
+ buffer = framebuffer.ptr;
+ }
+-
++
+ grub_dprintf ("video", "GOP: initialising FB @ %p %dx%dx%d\n",
+ framebuffer.ptr, framebuffer.mode_info.width,
+ framebuffer.mode_info.height, framebuffer.mode_info.bpp);
+-
++
+ err = grub_video_fb_create_render_target_from_pointer
+ (&framebuffer.render_target, &framebuffer.mode_info, buffer);
+
+@@ -498,15 +498,15 @@ grub_video_gop_setup (unsigned int width, unsigned int height,
+ grub_dprintf ("video", "GOP: Couldn't create FB target\n");
+ return err;
+ }
+-
++
+ err = grub_video_fb_set_active_render_target (framebuffer.render_target);
+-
++
+ if (err)
+ {
+ grub_dprintf ("video", "GOP: Couldn't set FB target\n");
+ return err;
+ }
+-
++
+ err = grub_video_fb_set_palette (0, GRUB_VIDEO_FBSTD_NUMCOLORS,
+ grub_video_fbstd_colors);
+
+@@ -514,7 +514,7 @@ grub_video_gop_setup (unsigned int width, unsigned int height,
+ grub_dprintf ("video", "GOP: Couldn't set palette\n");
+ else
+ grub_dprintf ("video", "GOP: Success\n");
+-
++
+ return err;
+ }
+
+diff --git a/grub-core/video/fb/fbblit.c b/grub-core/video/fb/fbblit.c
+index d55924837..1010ef393 100644
+--- a/grub-core/video/fb/fbblit.c
++++ b/grub-core/video/fb/fbblit.c
+@@ -466,7 +466,7 @@ grub_video_fbblit_replace_24bit_indexa (struct grub_video_fbblit_info *dst,
+ for (i = 0; i < width; i++)
+ {
+ register grub_uint32_t col;
+- if (*srcptr == 0xf0)
++ if (*srcptr == 0xf0)
+ col = palette[16];
+ else
+ col = palette[*srcptr & 0xf];
+@@ -478,7 +478,7 @@ grub_video_fbblit_replace_24bit_indexa (struct grub_video_fbblit_info *dst,
+ *dstptr++ = col >> 0;
+ *dstptr++ = col >> 8;
+ *dstptr++ = col >> 16;
+-#endif
++#endif
+ srcptr++;
+ }
+
+@@ -651,7 +651,7 @@ grub_video_fbblit_blend_24bit_indexa (struct grub_video_fbblit_info *dst,
+ for (i = 0; i < width; i++)
+ {
+ register grub_uint32_t col;
+- if (*srcptr != 0xf0)
++ if (*srcptr != 0xf0)
+ {
+ col = palette[*srcptr & 0xf];
+ #ifdef GRUB_CPU_WORDS_BIGENDIAN
+@@ -662,7 +662,7 @@ grub_video_fbblit_blend_24bit_indexa (struct grub_video_fbblit_info *dst,
+ *dstptr++ = col >> 0;
+ *dstptr++ = col >> 8;
+ *dstptr++ = col >> 16;
+-#endif
++#endif
+ }
+ else
+ dstptr += 3;
+diff --git a/grub-core/video/fb/video_fb.c b/grub-core/video/fb/video_fb.c
+index ae6b89f9a..fa4ebde26 100644
+--- a/grub-core/video/fb/video_fb.c
++++ b/grub-core/video/fb/video_fb.c
+@@ -754,7 +754,7 @@ grub_video_fb_unmap_color_int (struct grub_video_fbblit_info * source,
+ *alpha = 0;
+ return;
+ }
+-
++
+ /* If we have an out-of-bounds color, return transparent black. */
+ if (color > 255)
+ {
+@@ -1141,7 +1141,7 @@ grub_video_fb_scroll (grub_video_color_t color, int dx, int dy)
+ /* If everything is aligned on 32-bit use 32-bit copy. */
+ if ((grub_addr_t) grub_video_fb_get_video_ptr (&target, src_x, src_y)
+ % sizeof (grub_uint32_t) == 0
+- && (grub_addr_t) grub_video_fb_get_video_ptr (&target, dst_x, dst_y)
++ && (grub_addr_t) grub_video_fb_get_video_ptr (&target, dst_x, dst_y)
+ % sizeof (grub_uint32_t) == 0
+ && linelen % sizeof (grub_uint32_t) == 0
+ && linedelta % sizeof (grub_uint32_t) == 0)
+@@ -1155,7 +1155,7 @@ grub_video_fb_scroll (grub_video_color_t color, int dx, int dy)
+ else if ((grub_addr_t) grub_video_fb_get_video_ptr (&target, src_x, src_y)
+ % sizeof (grub_uint16_t) == 0
+ && (grub_addr_t) grub_video_fb_get_video_ptr (&target,
+- dst_x, dst_y)
++ dst_x, dst_y)
+ % sizeof (grub_uint16_t) == 0
+ && linelen % sizeof (grub_uint16_t) == 0
+ && linedelta % sizeof (grub_uint16_t) == 0)
+@@ -1170,7 +1170,7 @@ grub_video_fb_scroll (grub_video_color_t color, int dx, int dy)
+ {
+ grub_uint8_t *src, *dst;
+ DO_SCROLL
+- }
++ }
+ }
+
+ /* 4. Fill empty space with specified color. In this implementation
+@@ -1615,7 +1615,7 @@ grub_video_fb_setup (unsigned int mode_type, unsigned int mode_mask,
+ framebuffer.render_target = framebuffer.back_target;
+ return GRUB_ERR_NONE;
+ }
+-
++
+ mode_info->mode_type &= ~(GRUB_VIDEO_MODE_TYPE_DOUBLE_BUFFERED
+ | GRUB_VIDEO_MODE_TYPE_UPDATING_SWAP);
+
+diff --git a/grub-core/video/i386/pc/vbe.c b/grub-core/video/i386/pc/vbe.c
+index b7f911926..0e65b5206 100644
+--- a/grub-core/video/i386/pc/vbe.c
++++ b/grub-core/video/i386/pc/vbe.c
+@@ -219,7 +219,7 @@ grub_vbe_disable_mtrr (int mtrr)
+ }
+
+ /* Call VESA BIOS 0x4f09 to set palette data, return status. */
+-static grub_vbe_status_t
++static grub_vbe_status_t
+ grub_vbe_bios_set_palette_data (grub_uint32_t color_count,
+ grub_uint32_t start_index,
+ struct grub_vbe_palette_data *palette_data)
+@@ -237,7 +237,7 @@ grub_vbe_bios_set_palette_data (grub_uint32_t color_count,
+ }
+
+ /* Call VESA BIOS 0x4f00 to get VBE Controller Information, return status. */
+-grub_vbe_status_t
++grub_vbe_status_t
+ grub_vbe_bios_get_controller_info (struct grub_vbe_info_block *ci)
+ {
+ struct grub_bios_int_registers regs;
+@@ -251,7 +251,7 @@ grub_vbe_bios_get_controller_info (struct grub_vbe_info_block *ci)
+ }
+
+ /* Call VESA BIOS 0x4f01 to get VBE Mode Information, return status. */
+-grub_vbe_status_t
++grub_vbe_status_t
+ grub_vbe_bios_get_mode_info (grub_uint32_t mode,
+ struct grub_vbe_mode_info_block *mode_info)
+ {
+@@ -285,7 +285,7 @@ grub_vbe_bios_set_mode (grub_uint32_t mode,
+ }
+
+ /* Call VESA BIOS 0x4f03 to return current VBE Mode, return status. */
+-grub_vbe_status_t
++grub_vbe_status_t
+ grub_vbe_bios_get_mode (grub_uint32_t *mode)
+ {
+ struct grub_bios_int_registers regs;
+@@ -298,7 +298,7 @@ grub_vbe_bios_get_mode (grub_uint32_t *mode)
+ return regs.eax & 0xffff;
+ }
+
+-grub_vbe_status_t
++grub_vbe_status_t
+ grub_vbe_bios_getset_dac_palette_width (int set, int *dac_mask_size)
+ {
+ struct grub_bios_int_registers regs;
+@@ -346,7 +346,7 @@ grub_vbe_bios_get_memory_window (grub_uint32_t window,
+ }
+
+ /* Call VESA BIOS 0x4f06 to set scanline length (in bytes), return status. */
+-grub_vbe_status_t
++grub_vbe_status_t
+ grub_vbe_bios_set_scanline_length (grub_uint32_t length)
+ {
+ struct grub_bios_int_registers regs;
+@@ -354,14 +354,14 @@ grub_vbe_bios_set_scanline_length (grub_uint32_t length)
+ regs.ecx = length;
+ regs.eax = 0x4f06;
+ /* BL = 2, Set Scan Line in Bytes. */
+- regs.ebx = 0x0002;
++ regs.ebx = 0x0002;
+ regs.flags = GRUB_CPU_INT_FLAGS_DEFAULT;
+ grub_bios_interrupt (0x10, ®s);
+ return regs.eax & 0xffff;
+ }
+
+ /* Call VESA BIOS 0x4f06 to return scanline length (in bytes), return status. */
+-grub_vbe_status_t
++grub_vbe_status_t
+ grub_vbe_bios_get_scanline_length (grub_uint32_t *length)
+ {
+ struct grub_bios_int_registers regs;
+@@ -377,7 +377,7 @@ grub_vbe_bios_get_scanline_length (grub_uint32_t *length)
+ }
+
+ /* Call VESA BIOS 0x4f07 to set display start, return status. */
+-static grub_vbe_status_t
++static grub_vbe_status_t
+ grub_vbe_bios_set_display_start (grub_uint32_t x, grub_uint32_t y)
+ {
+ struct grub_bios_int_registers regs;
+@@ -390,7 +390,7 @@ grub_vbe_bios_set_display_start (grub_uint32_t x, grub_uint32_t y)
+ regs.edx = y;
+ regs.eax = 0x4f07;
+ /* BL = 80h, Set Display Start during Vertical Retrace. */
+- regs.ebx = 0x0080;
++ regs.ebx = 0x0080;
+ regs.flags = GRUB_CPU_INT_FLAGS_DEFAULT;
+ grub_bios_interrupt (0x10, ®s);
+
+@@ -401,7 +401,7 @@ grub_vbe_bios_set_display_start (grub_uint32_t x, grub_uint32_t y)
+ }
+
+ /* Call VESA BIOS 0x4f07 to get display start, return status. */
+-grub_vbe_status_t
++grub_vbe_status_t
+ grub_vbe_bios_get_display_start (grub_uint32_t *x,
+ grub_uint32_t *y)
+ {
+@@ -419,7 +419,7 @@ grub_vbe_bios_get_display_start (grub_uint32_t *x,
+ }
+
+ /* Call VESA BIOS 0x4f0a. */
+-grub_vbe_status_t
++grub_vbe_status_t
+ grub_vbe_bios_get_pm_interface (grub_uint16_t *segment, grub_uint16_t *offset,
+ grub_uint16_t *length)
+ {
+@@ -896,7 +896,7 @@ vbe2videoinfo (grub_uint32_t mode,
+ case GRUB_VBE_MEMORY_MODEL_YUV:
+ mode_info->mode_type |= GRUB_VIDEO_MODE_TYPE_YUV;
+ break;
+-
++
+ case GRUB_VBE_MEMORY_MODEL_DIRECT_COLOR:
+ mode_info->mode_type |= GRUB_VIDEO_MODE_TYPE_RGB;
+ break;
+@@ -923,10 +923,10 @@ vbe2videoinfo (grub_uint32_t mode,
+ break;
+ case 8:
+ mode_info->bytes_per_pixel = 1;
+- break;
++ break;
+ case 4:
+ mode_info->bytes_per_pixel = 0;
+- break;
++ break;
+ }
+
+ if (controller_info.version >= 0x300)
+@@ -976,7 +976,7 @@ grub_video_vbe_iterate (int (*hook) (const struct grub_video_mode_info *info, vo
+
+ static grub_err_t
+ grub_video_vbe_setup (unsigned int width, unsigned int height,
+- grub_video_mode_type_t mode_type,
++ grub_video_mode_type_t mode_type,
+ grub_video_mode_type_t mode_mask)
+ {
+ grub_uint16_t *p;
+@@ -1193,7 +1193,7 @@ grub_video_vbe_print_adapter_specific_info (void)
+ controller_info.version & 0xFF,
+ controller_info.oem_software_rev >> 8,
+ controller_info.oem_software_rev & 0xFF);
+-
++
+ /* The total_memory field is in 64 KiB units. */
+ grub_printf_ (N_(" total memory: %d KiB\n"),
+ (controller_info.total_memory << 6));
+diff --git a/grub-core/video/i386/pc/vga.c b/grub-core/video/i386/pc/vga.c
+index b2f776c99..50d0b5e02 100644
+--- a/grub-core/video/i386/pc/vga.c
++++ b/grub-core/video/i386/pc/vga.c
+@@ -48,7 +48,7 @@ static struct
+ int back_page;
+ } framebuffer;
+
+-static unsigned char
++static unsigned char
+ grub_vga_set_mode (unsigned char mode)
+ {
+ struct grub_bios_int_registers regs;
+@@ -182,10 +182,10 @@ grub_video_vga_setup (unsigned int width, unsigned int height,
+
+ is_target = 1;
+ err = grub_video_fb_set_active_render_target (framebuffer.render_target);
+-
++
+ if (err)
+ return err;
+-
++
+ err = grub_video_fb_set_palette (0, GRUB_VIDEO_FBSTD_NUMCOLORS,
+ grub_video_fbstd_colors);
+
+diff --git a/grub-core/video/ieee1275.c b/grub-core/video/ieee1275.c
+index f437fb0df..ca3d3c3b2 100644
+--- a/grub-core/video/ieee1275.c
++++ b/grub-core/video/ieee1275.c
+@@ -233,7 +233,7 @@ grub_video_ieee1275_setup (unsigned int width, unsigned int height,
+ /* TODO. */
+ return grub_error (GRUB_ERR_IO, "can't set mode %dx%d", width, height);
+ }
+-
++
+ err = grub_video_ieee1275_fill_mode_info (dev, &framebuffer.mode_info);
+ if (err)
+ {
+@@ -260,7 +260,7 @@ grub_video_ieee1275_setup (unsigned int width, unsigned int height,
+
+ grub_video_ieee1275_set_palette (0, framebuffer.mode_info.number_of_colors,
+ grub_video_fbstd_colors);
+-
++
+ return err;
+ }
+
+diff --git a/grub-core/video/radeon_fuloong2e.c b/grub-core/video/radeon_fuloong2e.c
+index b4da34b5e..40917acb7 100644
+--- a/grub-core/video/radeon_fuloong2e.c
++++ b/grub-core/video/radeon_fuloong2e.c
+@@ -75,7 +75,7 @@ find_card (grub_pci_device_t dev, grub_pci_id_t pciid, void *data)
+ if (((class >> 16) & 0xffff) != GRUB_PCI_CLASS_SUBCLASS_VGA
+ || pciid != 0x515a1002)
+ return 0;
+-
++
+ *found = 1;
+
+ addr = grub_pci_make_address (dev, GRUB_PCI_REG_ADDRESS_REG0);
+@@ -139,7 +139,7 @@ grub_video_radeon_fuloong2e_setup (unsigned int width, unsigned int height,
+ framebuffer.mapped = 1;
+
+ /* Prevent garbage from appearing on the screen. */
+- grub_memset (framebuffer.ptr, 0x55,
++ grub_memset (framebuffer.ptr, 0x55,
+ framebuffer.mode_info.height * framebuffer.mode_info.pitch);
+
+ #ifndef TEST
+@@ -152,7 +152,7 @@ grub_video_radeon_fuloong2e_setup (unsigned int width, unsigned int height,
+ return err;
+
+ err = grub_video_fb_set_active_render_target (framebuffer.render_target);
+-
++
+ if (err)
+ return err;
+
+diff --git a/grub-core/video/radeon_yeeloong3a.c b/grub-core/video/radeon_yeeloong3a.c
+index 52614feb6..48631c181 100644
+--- a/grub-core/video/radeon_yeeloong3a.c
++++ b/grub-core/video/radeon_yeeloong3a.c
+@@ -74,7 +74,7 @@ find_card (grub_pci_device_t dev, grub_pci_id_t pciid, void *data)
+ if (((class >> 16) & 0xffff) != GRUB_PCI_CLASS_SUBCLASS_VGA
+ || pciid != 0x96151002)
+ return 0;
+-
++
+ *found = 1;
+
+ addr = grub_pci_make_address (dev, GRUB_PCI_REG_ADDRESS_REG0);
+@@ -137,7 +137,7 @@ grub_video_radeon_yeeloong3a_setup (unsigned int width, unsigned int height,
+ #endif
+
+ /* Prevent garbage from appearing on the screen. */
+- grub_memset (framebuffer.ptr, 0,
++ grub_memset (framebuffer.ptr, 0,
+ framebuffer.mode_info.height * framebuffer.mode_info.pitch);
+
+ #ifndef TEST
+@@ -150,7 +150,7 @@ grub_video_radeon_yeeloong3a_setup (unsigned int width, unsigned int height,
+ return err;
+
+ err = grub_video_fb_set_active_render_target (framebuffer.render_target);
+-
++
+ if (err)
+ return err;
+
+diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c
+index 0157ff742..54dfedf43 100644
+--- a/grub-core/video/readers/png.c
++++ b/grub-core/video/readers/png.c
+@@ -916,7 +916,7 @@ grub_png_convert_image (struct grub_png_data *data)
+ }
+ return;
+ }
+-
++
+ if (data->is_gray)
+ {
+ switch (data->bpp)
+diff --git a/grub-core/video/readers/tga.c b/grub-core/video/readers/tga.c
+index 7cb9d1d2a..a9ec3a1b6 100644
+--- a/grub-core/video/readers/tga.c
++++ b/grub-core/video/readers/tga.c
+@@ -127,7 +127,7 @@ tga_load_palette (struct tga_data *data)
+
+ if (len > sizeof (data->palette))
+ len = sizeof (data->palette);
+-
++
+ if (grub_file_read (data->file, &data->palette, len)
+ != (grub_ssize_t) len)
+ return grub_errno;
+diff --git a/grub-core/video/sis315_init.c b/grub-core/video/sis315_init.c
+index ae5c1419c..09c3c7bbe 100644
+--- a/grub-core/video/sis315_init.c
++++ b/grub-core/video/sis315_init.c
+@@ -1,4 +1,4 @@
+-static const struct { grub_uint8_t reg; grub_uint8_t val; } sr_dump [] =
++static const struct { grub_uint8_t reg; grub_uint8_t val; } sr_dump [] =
+ {
+ { 0x28, 0x81 },
+ { 0x2a, 0x00 },
+diff --git a/grub-core/video/sis315pro.c b/grub-core/video/sis315pro.c
+index 22a0c85a6..4d2f9999a 100644
+--- a/grub-core/video/sis315pro.c
++++ b/grub-core/video/sis315pro.c
+@@ -103,7 +103,7 @@ find_card (grub_pci_device_t dev, grub_pci_id_t pciid, void *data)
+ if (((class >> 16) & 0xffff) != GRUB_PCI_CLASS_SUBCLASS_VGA
+ || pciid != GRUB_SIS315PRO_PCIID)
+ return 0;
+-
++
+ *found = 1;
+
+ addr = grub_pci_make_address (dev, GRUB_PCI_REG_ADDRESS_REG0);
+@@ -218,7 +218,7 @@ grub_video_sis315pro_setup (unsigned int width, unsigned int height,
+
+ #ifndef TEST
+ /* Prevent garbage from appearing on the screen. */
+- grub_memset (framebuffer.ptr, 0,
++ grub_memset (framebuffer.ptr, 0,
+ framebuffer.mode_info.height * framebuffer.mode_info.pitch);
+ grub_arch_sync_dma_caches (framebuffer.ptr,
+ framebuffer.mode_info.height
+@@ -231,7 +231,7 @@ grub_video_sis315pro_setup (unsigned int width, unsigned int height,
+ | GRUB_VGA_IO_MISC_EXTERNAL_CLOCK_0
+ | GRUB_VGA_IO_MISC_28MHZ
+ | GRUB_VGA_IO_MISC_ENABLE_VRAM_ACCESS
+- | GRUB_VGA_IO_MISC_COLOR,
++ | GRUB_VGA_IO_MISC_COLOR,
+ GRUB_VGA_IO_MISC_WRITE + GRUB_MACHINE_PCI_IO_BASE);
+
+ grub_vga_sr_write (0x86, 5);
+@@ -335,7 +335,7 @@ grub_video_sis315pro_setup (unsigned int width, unsigned int height,
+ {
+ if (read_sis_cmd (0x5) != 0xa1)
+ write_sis_cmd (0x86, 0x5);
+-
++
+ write_sis_cmd (read_sis_cmd (0x20) | 0xa1, 0x20);
+ write_sis_cmd (read_sis_cmd (0x1e) | 0xda, 0x1e);
+
+diff --git a/grub-core/video/sm712.c b/grub-core/video/sm712.c
+index 10c46eb65..65f59f84b 100644
+--- a/grub-core/video/sm712.c
++++ b/grub-core/video/sm712.c
+@@ -167,7 +167,7 @@ enum
+ GRUB_SM712_CR_SHADOW_VGA_VBLANK_START = 0x46,
+ GRUB_SM712_CR_SHADOW_VGA_VBLANK_END = 0x47,
+ GRUB_SM712_CR_SHADOW_VGA_VRETRACE_START = 0x48,
+- GRUB_SM712_CR_SHADOW_VGA_VRETRACE_END = 0x49,
++ GRUB_SM712_CR_SHADOW_VGA_VRETRACE_END = 0x49,
+ GRUB_SM712_CR_SHADOW_VGA_OVERFLOW = 0x4a,
+ GRUB_SM712_CR_SHADOW_VGA_CELL_HEIGHT = 0x4b,
+ GRUB_SM712_CR_SHADOW_VGA_HDISPLAY_END = 0x4c,
+@@ -375,7 +375,7 @@ find_card (grub_pci_device_t dev, grub_pci_id_t pciid, void *data)
+ if (((class >> 16) & 0xffff) != GRUB_PCI_CLASS_SUBCLASS_VGA
+ || pciid != GRUB_SM712_PCIID)
+ return 0;
+-
++
+ *found = 1;
+
+ addr = grub_pci_make_address (dev, GRUB_PCI_REG_ADDRESS_REG0);
+@@ -471,7 +471,7 @@ grub_video_sm712_setup (unsigned int width, unsigned int height,
+
+ #if !defined (TEST) && !defined(GENINIT)
+ /* Prevent garbage from appearing on the screen. */
+- grub_memset ((void *) framebuffer.cached_ptr, 0,
++ grub_memset ((void *) framebuffer.cached_ptr, 0,
+ framebuffer.mode_info.height * framebuffer.mode_info.pitch);
+ #endif
+
+@@ -482,7 +482,7 @@ grub_video_sm712_setup (unsigned int width, unsigned int height,
+ grub_sm712_sr_write (0x2, 0x6b);
+ grub_sm712_write_reg (0, GRUB_VGA_IO_PIXEL_MASK);
+ grub_sm712_sr_write (GRUB_VGA_SR_RESET_ASYNC, GRUB_VGA_SR_RESET);
+- grub_sm712_write_reg (GRUB_VGA_IO_MISC_NEGATIVE_VERT_POLARITY
++ grub_sm712_write_reg (GRUB_VGA_IO_MISC_NEGATIVE_VERT_POLARITY
+ | GRUB_VGA_IO_MISC_NEGATIVE_HORIZ_POLARITY
+ | GRUB_VGA_IO_MISC_UPPER_64K
+ | GRUB_VGA_IO_MISC_EXTERNAL_CLOCK_0
+@@ -694,7 +694,7 @@ grub_video_sm712_setup (unsigned int width, unsigned int height,
+ for (i = 0; i < ARRAY_SIZE (dda_lookups); i++)
+ grub_sm712_write_dda_lookup (i, dda_lookups[i].compare, dda_lookups[i].dda,
+ dda_lookups[i].vcentering);
+-
++
+ /* Undocumented */
+ grub_sm712_cr_write (0, 0x9c);
+ grub_sm712_cr_write (0, 0x9d);
+diff --git a/grub-core/video/video.c b/grub-core/video/video.c
+index 983424107..8937da745 100644
+--- a/grub-core/video/video.c
++++ b/grub-core/video/video.c
+@@ -491,13 +491,13 @@ parse_modespec (const char *current_mode, int *width, int *height, int *depth)
+ current_mode);
+
+ param++;
+-
++
+ *width = grub_strtoul (value, 0, 0);
+ if (grub_errno != GRUB_ERR_NONE)
+ return grub_error (GRUB_ERR_BAD_ARGUMENT,
+ N_("invalid video mode specification `%s'"),
+ current_mode);
+-
++
+ /* Find height value. */
+ value = param;
+ param = grub_strchr(param, 'x');
+@@ -513,13 +513,13 @@ parse_modespec (const char *current_mode, int *width, int *height, int *depth)
+ {
+ /* We have optional color depth value. */
+ param++;
+-
++
+ *height = grub_strtoul (value, 0, 0);
+ if (grub_errno != GRUB_ERR_NONE)
+ return grub_error (GRUB_ERR_BAD_ARGUMENT,
+ N_("invalid video mode specification `%s'"),
+ current_mode);
+-
++
+ /* Convert color depth value. */
+ value = param;
+ *depth = grub_strtoul (value, 0, 0);
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/grub/files/video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch b/meta/recipes-bsp/grub/files/video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
new file mode 100644
index 0000000000..0c7deae858
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
@@ -0,0 +1,264 @@
+From d5caac8ab79d068ad9a41030c772d03a4d4fbd7b Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Mon, 28 Jun 2021 14:16:14 +1000
+Subject: [PATCH] video/readers/jpeg: Abort sooner if a read operation fails
+
+Fuzzing revealed some inputs that were taking a long time, potentially
+forever, because they did not bail quickly upon encountering an I/O error.
+
+Try to catch I/O errors sooner and bail out.
+
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+Upstream-Status: Backport
+
+Reference to upstream patch:
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=d5caac8ab79d068ad9a41030c772d03a4d4fbd7b
+
+Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
+---
+ grub-core/video/readers/jpeg.c | 86 +++++++++++++++++++++++++++-------
+ 1 file changed, 70 insertions(+), 16 deletions(-)
+
+diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
+index c47ffd651..806c56c78 100644
+--- a/grub-core/video/readers/jpeg.c
++++ b/grub-core/video/readers/jpeg.c
+@@ -109,9 +109,17 @@ static grub_uint8_t
+ grub_jpeg_get_byte (struct grub_jpeg_data *data)
+ {
+ grub_uint8_t r;
++ grub_ssize_t bytes_read;
+
+ r = 0;
+- grub_file_read (data->file, &r, 1);
++ bytes_read = grub_file_read (data->file, &r, 1);
++
++ if (bytes_read != 1)
++ {
++ grub_error (GRUB_ERR_BAD_FILE_TYPE,
++ "jpeg: unexpected end of data");
++ return 0;
++ }
+
+ return r;
+ }
+@@ -120,9 +128,17 @@ static grub_uint16_t
+ grub_jpeg_get_word (struct grub_jpeg_data *data)
+ {
+ grub_uint16_t r;
++ grub_ssize_t bytes_read;
+
+ r = 0;
+- grub_file_read (data->file, &r, sizeof (grub_uint16_t));
++ bytes_read = grub_file_read (data->file, &r, sizeof (grub_uint16_t));
++
++ if (bytes_read != sizeof (grub_uint16_t))
++ {
++ grub_error (GRUB_ERR_BAD_FILE_TYPE,
++ "jpeg: unexpected end of data");
++ return 0;
++ }
+
+ return grub_be_to_cpu16 (r);
+ }
+@@ -135,6 +151,11 @@ grub_jpeg_get_bit (struct grub_jpeg_data *data)
+ if (data->bit_mask == 0)
+ {
+ data->bit_save = grub_jpeg_get_byte (data);
++ if (grub_errno != GRUB_ERR_NONE) {
++ grub_error (GRUB_ERR_BAD_FILE_TYPE,
++ "jpeg: file read error");
++ return 0;
++ }
+ if (data->bit_save == JPEG_ESC_CHAR)
+ {
+ if (grub_jpeg_get_byte (data) != 0)
+@@ -143,6 +164,11 @@ grub_jpeg_get_bit (struct grub_jpeg_data *data)
+ "jpeg: invalid 0xFF in data stream");
+ return 0;
+ }
++ if (grub_errno != GRUB_ERR_NONE)
++ {
++ grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: file read error");
++ return 0;
++ }
+ }
+ data->bit_mask = 0x80;
+ }
+@@ -161,7 +187,7 @@ grub_jpeg_get_number (struct grub_jpeg_data *data, int num)
+ return 0;
+
+ msb = value = grub_jpeg_get_bit (data);
+- for (i = 1; i < num; i++)
++ for (i = 1; i < num && grub_errno == GRUB_ERR_NONE; i++)
+ value = (value << 1) + (grub_jpeg_get_bit (data) != 0);
+ if (!msb)
+ value += 1 - (1 << num);
+@@ -208,6 +234,8 @@ grub_jpeg_decode_huff_table (struct grub_jpeg_data *data)
+ while (data->file->offset + sizeof (count) + 1 <= next_marker)
+ {
+ id = grub_jpeg_get_byte (data);
++ if (grub_errno != GRUB_ERR_NONE)
++ return grub_errno;
+ ac = (id >> 4) & 1;
+ id &= 0xF;
+ if (id > 1)
+@@ -258,6 +286,8 @@ grub_jpeg_decode_quan_table (struct grub_jpeg_data *data)
+
+ next_marker = data->file->offset;
+ next_marker += grub_jpeg_get_word (data);
++ if (grub_errno != GRUB_ERR_NONE)
++ return grub_errno;
+
+ if (next_marker > data->file->size)
+ {
+@@ -269,6 +299,8 @@ grub_jpeg_decode_quan_table (struct grub_jpeg_data *data)
+ <= next_marker)
+ {
+ id = grub_jpeg_get_byte (data);
++ if (grub_errno != GRUB_ERR_NONE)
++ return grub_errno;
+ if (id >= 0x10) /* Upper 4-bit is precision. */
+ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
+ "jpeg: only 8-bit precision is supported");
+@@ -300,6 +332,9 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data)
+ next_marker = data->file->offset;
+ next_marker += grub_jpeg_get_word (data);
+
++ if (grub_errno != GRUB_ERR_NONE)
++ return grub_errno;
++
+ if (grub_jpeg_get_byte (data) != 8)
+ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
+ "jpeg: only 8-bit precision is supported");
+@@ -325,6 +360,8 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data)
+ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: invalid index");
+
+ ss = grub_jpeg_get_byte (data); /* Sampling factor. */
++ if (grub_errno != GRUB_ERR_NONE)
++ return grub_errno;
+ if (!id)
+ {
+ grub_uint8_t vs, hs;
+@@ -504,7 +541,7 @@ grub_jpeg_idct_transform (jpeg_data_unit_t du)
+ }
+ }
+
+-static void
++static grub_err_t
+ grub_jpeg_decode_du (struct grub_jpeg_data *data, int id, jpeg_data_unit_t du)
+ {
+ int h1, h2, qt;
+@@ -519,6 +556,9 @@ grub_jpeg_decode_du (struct grub_jpeg_data *data, int id, jpeg_data_unit_t du)
+ data->dc_value[id] +=
+ grub_jpeg_get_number (data, grub_jpeg_get_huff_code (data, h1));
+
++ if (grub_errno != GRUB_ERR_NONE)
++ return grub_errno;
++
+ du[0] = data->dc_value[id] * (int) data->quan_table[qt][0];
+ pos = 1;
+ while (pos < ARRAY_SIZE (data->quan_table[qt]))
+@@ -533,11 +573,13 @@ grub_jpeg_decode_du (struct grub_jpeg_data *data, int id, jpeg_data_unit_t du)
+ num >>= 4;
+ pos += num;
+
++ if (grub_errno != GRUB_ERR_NONE)
++ return grub_errno;
++
+ if (pos >= ARRAY_SIZE (jpeg_zigzag_order))
+ {
+- grub_error (GRUB_ERR_BAD_FILE_TYPE,
+- "jpeg: invalid position in zigzag order!?");
+- return;
++ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
++ "jpeg: invalid position in zigzag order!?");
+ }
+
+ du[jpeg_zigzag_order[pos]] = val * (int) data->quan_table[qt][pos];
+@@ -545,6 +587,7 @@ grub_jpeg_decode_du (struct grub_jpeg_data *data, int id, jpeg_data_unit_t du)
+ }
+
+ grub_jpeg_idct_transform (du);
++ return GRUB_ERR_NONE;
+ }
+
+ static void
+@@ -603,7 +646,8 @@ grub_jpeg_decode_sos (struct grub_jpeg_data *data)
+ data_offset += grub_jpeg_get_word (data);
+
+ cc = grub_jpeg_get_byte (data);
+-
++ if (grub_errno != GRUB_ERR_NONE)
++ return grub_errno;
+ if (cc != 3 && cc != 1)
+ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
+ "jpeg: component count must be 1 or 3");
+@@ -616,7 +660,8 @@ grub_jpeg_decode_sos (struct grub_jpeg_data *data)
+ id = grub_jpeg_get_byte (data) - 1;
+ if ((id < 0) || (id >= 3))
+ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: invalid index");
+-
++ if (grub_errno != GRUB_ERR_NONE)
++ return grub_errno;
+ ht = grub_jpeg_get_byte (data);
+ data->comp_index[id][1] = (ht >> 4);
+ data->comp_index[id][2] = (ht & 0xF) + 2;
+@@ -624,11 +669,14 @@ grub_jpeg_decode_sos (struct grub_jpeg_data *data)
+ if ((data->comp_index[id][1] < 0) || (data->comp_index[id][1] > 3) ||
+ (data->comp_index[id][2] < 0) || (data->comp_index[id][2] > 3))
+ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: invalid hufftable index");
++ if (grub_errno != GRUB_ERR_NONE)
++ return grub_errno;
+ }
+
+ grub_jpeg_get_byte (data); /* Skip 3 unused bytes. */
+ grub_jpeg_get_word (data);
+-
++ if (grub_errno != GRUB_ERR_NONE)
++ return grub_errno;
+ if (data->file->offset != data_offset)
+ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: extra byte in sos");
+
+@@ -646,6 +694,7 @@ grub_jpeg_decode_data (struct grub_jpeg_data *data)
+ {
+ unsigned c1, vb, hb, nr1, nc1;
+ int rst = data->dri;
++ grub_err_t err = GRUB_ERR_NONE;
+
+ vb = 8 << data->log_vs;
+ hb = 8 << data->log_hs;
+@@ -666,17 +715,22 @@ grub_jpeg_decode_data (struct grub_jpeg_data *data)
+
+ for (r2 = 0; r2 < (1U << data->log_vs); r2++)
+ for (c2 = 0; c2 < (1U << data->log_hs); c2++)
+- grub_jpeg_decode_du (data, 0, data->ydu[r2 * 2 + c2]);
++ {
++ err = grub_jpeg_decode_du (data, 0, data->ydu[r2 * 2 + c2]);
++ if (err != GRUB_ERR_NONE)
++ return err;
++ }
+
+ if (data->color_components >= 3)
+ {
+- grub_jpeg_decode_du (data, 1, data->cbdu);
+- grub_jpeg_decode_du (data, 2, data->crdu);
++ err = grub_jpeg_decode_du (data, 1, data->cbdu);
++ if (err != GRUB_ERR_NONE)
++ return err;
++ err = grub_jpeg_decode_du (data, 2, data->crdu);
++ if (err != GRUB_ERR_NONE)
++ return err;
+ }
+
+- if (grub_errno)
+- return grub_errno;
+-
+ nr2 = (data->r1 == nr1 - 1) ? (data->image_height - data->r1 * vb) : vb;
+ nc2 = (c1 == nc1 - 1) ? (data->image_width - c1 * hb) : hb;
+
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/grub/files/video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch b/meta/recipes-bsp/grub/files/video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
new file mode 100644
index 0000000000..91ecaad98a
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
@@ -0,0 +1,53 @@
+From 166a4d61448f74745afe1dac2f2cfb85d04909bf Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Mon, 28 Jun 2021 14:25:17 +1000
+Subject: [PATCH] video/readers/jpeg: Refuse to handle multiple start of
+ streams
+
+An invalid file could contain multiple start of stream blocks, which
+would cause us to reallocate and leak our bitmap. Refuse to handle
+multiple start of streams.
+
+Additionally, fix a grub_error() call formatting.
+
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+Upstream-Status: Backport
+
+Reference to upstream patch:
+https://git.savannah.gnu.org/cgit/grub.git/commit/?id=166a4d61448f74745afe1dac2f2cfb85d04909bf
+
+Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
+---
+ grub-core/video/readers/jpeg.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
+index 2284a6c06..579bbe8a4 100644
+--- a/grub-core/video/readers/jpeg.c
++++ b/grub-core/video/readers/jpeg.c
+@@ -683,6 +683,9 @@ grub_jpeg_decode_sos (struct grub_jpeg_data *data)
+ if (data->file->offset != data_offset)
+ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: extra byte in sos");
+
++ if (*data->bitmap)
++ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: too many start of scan blocks");
++
+ if (grub_video_bitmap_create (data->bitmap, data->image_width,
+ data->image_height,
+ GRUB_VIDEO_BLIT_FORMAT_RGB_888))
+@@ -705,8 +708,8 @@ grub_jpeg_decode_data (struct grub_jpeg_data *data)
+ nc1 = (data->image_width + hb - 1) >> (3 + data->log_hs);
+
+ if (data->bitmap_ptr == NULL)
+- return grub_error(GRUB_ERR_BAD_FILE_TYPE,
+- "jpeg: attempted to decode data before start of stream");
++ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
++ "jpeg: attempted to decode data before start of stream");
+
+ for (; data->r1 < nr1 && (!data->dri || rst);
+ data->r1++, data->bitmap_ptr += (vb * data->image_width - hb * nc1) * 3)
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 45852ab9b1..47ea561002 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -22,6 +22,16 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://0001-RISC-V-Restore-the-typcast-to-long.patch \
file://CVE-2021-3981-grub-mkconfig-Restore-umask-for-the-grub.cfg.patch \
file://0001-configure.ac-Use-_zicsr_zifencei-extentions-on-riscv.patch \
+ file://video-Remove-trailing-whitespaces.patch \
+ file://CVE-2021-3695-video-readers-png-Drop-greyscale-support-to-fix-heap.patch \
+ file://CVE-2021-3696-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff.patch \
+ file://video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch \
+ file://video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch \
+ file://CVE-2021-3697-video-readers-jpeg-Block-int-underflow-wild-pointer.patch \
+ file://CVE-2022-28733-net-ip-Do-IP-fragment-maths-safely.patch \
+ file://CVE-2022-28734-net-http-Fix-OOB-write-for-split-http-headers.patch \
+ file://CVE-2022-28734-net-http-Error-out-on-headers-with-LF-without-CR.patch \
+ file://CVE-2022-28735-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch \
"
SRC_URI[sha256sum] = "23b64b4c741569f9426ed2e3d0e6780796fca081bee4c99f62aa3f53ae803f5f"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 07/28] cve-check: Don't use f-strings
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (5 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 06/28] grub2: fix several CVEs Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 08/28] go: update v1.17.12 -> v1.17.13 Steve Sakoman
` (20 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Ernst Sjöstrand <ernstp@gmail.com>
Since we're keeping cve-check aligned between the active branches,
and dunfell is supported on Python 3.5, we can't use f-strings.
Signed-off-by: Ernst Sjöstrand <ernstp@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1821cf7464cbba521b55a9c128fe8812c0cc5eca)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/lib/oe/cve_check.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/lib/oe/cve_check.py b/meta/lib/oe/cve_check.py
index aa06497727..f40f16d7ab 100644
--- a/meta/lib/oe/cve_check.py
+++ b/meta/lib/oe/cve_check.py
@@ -143,7 +143,7 @@ def get_cpe_ids(cve_product, version):
else:
vendor = "*"
- cpe_id = f'cpe:2.3:a:{vendor}:{product}:{version}:*:*:*:*:*:*:*'
+ cpe_id = 'cpe:2.3:a:{}:{}:{}:*:*:*:*:*:*:*'.format(vendor, product, version)
cpe_ids.append(cpe_id)
return cpe_ids
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 08/28] go: update v1.17.12 -> v1.17.13
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (6 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 07/28] cve-check: Don't use f-strings Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 09/28] bluez5: update 5.64 -> 5.65 Steve Sakoman
` (19 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Sakib Sajal <sakib.sajal@windriver.com>
Update to latest v1.17.x release.
Contains fix for CVE-2022-32189.
go.git$ git log --oneline go1.17.12^..go1.17.13
15da892a49 (tag: go1.17.13, origin/release-branch.go1.17) [release-branch.go1.17] go1.17.13
703c8ab7e5 [release-branch.go1.17] math/big: check buffer lengths in GobDecode
d9242f7a8c [release-branch.go1.17] cmd/compile: do not use special literal assignment if LHS is address-taken
489c148578 [release-branch.go1.17] cmd/compile: fix prove pass when upper condition is <= maxint
66c60f076c [release-branch.go1.17] runtime: clear timerModifiedEarliest when last timer is deleted
c25b12fb81 [release-branch.go1.17] runtime: use saved LR when unwinding through morestack
1ed3c127da (tag: go1.17.12) [release-branch.go1.17] go1.17.12
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/go/{go-1.17.12.inc => go-1.17.13.inc} | 2 +-
...o-binary-native_1.17.12.bb => go-binary-native_1.17.13.bb} | 4 ++--
...cross-canadian_1.17.12.bb => go-cross-canadian_1.17.13.bb} | 0
.../go/{go-cross_1.17.12.bb => go-cross_1.17.13.bb} | 0
.../go/{go-crosssdk_1.17.12.bb => go-crosssdk_1.17.13.bb} | 0
.../go/{go-native_1.17.12.bb => go-native_1.17.13.bb} | 0
.../go/{go-runtime_1.17.12.bb => go-runtime_1.17.13.bb} | 0
meta/recipes-devtools/go/{go_1.17.12.bb => go_1.17.13.bb} | 0
8 files changed, 3 insertions(+), 3 deletions(-)
rename meta/recipes-devtools/go/{go-1.17.12.inc => go-1.17.13.inc} (92%)
rename meta/recipes-devtools/go/{go-binary-native_1.17.12.bb => go-binary-native_1.17.13.bb} (83%)
rename meta/recipes-devtools/go/{go-cross-canadian_1.17.12.bb => go-cross-canadian_1.17.13.bb} (100%)
rename meta/recipes-devtools/go/{go-cross_1.17.12.bb => go-cross_1.17.13.bb} (100%)
rename meta/recipes-devtools/go/{go-crosssdk_1.17.12.bb => go-crosssdk_1.17.13.bb} (100%)
rename meta/recipes-devtools/go/{go-native_1.17.12.bb => go-native_1.17.13.bb} (100%)
rename meta/recipes-devtools/go/{go-runtime_1.17.12.bb => go-runtime_1.17.13.bb} (100%)
rename meta/recipes-devtools/go/{go_1.17.12.bb => go_1.17.13.bb} (100%)
diff --git a/meta/recipes-devtools/go/go-1.17.12.inc b/meta/recipes-devtools/go/go-1.17.13.inc
similarity index 92%
rename from meta/recipes-devtools/go/go-1.17.12.inc
rename to meta/recipes-devtools/go/go-1.17.13.inc
index 77a983f9d0..95d0fb7e98 100644
--- a/meta/recipes-devtools/go/go-1.17.12.inc
+++ b/meta/recipes-devtools/go/go-1.17.13.inc
@@ -17,7 +17,7 @@ SRC_URI += "\
file://0001-exec.go-do-not-write-linker-flags-into-buildids.patch \
file://0001-src-cmd-dist-buildgo.go-do-not-hardcode-host-compile.patch \
"
-SRC_URI[main.sha256sum] = "0d51b5b3f280c0f01f534598c0219db5878f337da6137a9ee698777413607209"
+SRC_URI[main.sha256sum] = "a1a48b23afb206f95e7bbaa9b898d965f90826f6f1d1fc0c1d784ada0cd300fd"
# Upstream don't believe it is a signifiant real world issue and will only
# fix in 1.17 onwards where we can drop this.
diff --git a/meta/recipes-devtools/go/go-binary-native_1.17.12.bb b/meta/recipes-devtools/go/go-binary-native_1.17.13.bb
similarity index 83%
rename from meta/recipes-devtools/go/go-binary-native_1.17.12.bb
rename to meta/recipes-devtools/go/go-binary-native_1.17.13.bb
index b034950721..4ee0148417 100644
--- a/meta/recipes-devtools/go/go-binary-native_1.17.12.bb
+++ b/meta/recipes-devtools/go/go-binary-native_1.17.13.bb
@@ -8,8 +8,8 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=5d4950ecb7b26d2c5e4e7b4e0dd74707"
PROVIDES = "go-native"
SRC_URI = "https://dl.google.com/go/go${PV}.${BUILD_GOOS}-${BUILD_GOARCH}.tar.gz;name=go_${BUILD_GOTUPLE}"
-SRC_URI[go_linux_amd64.sha256sum] = "6e5203fbdcade4aa4331e441fd2e1db8444681a6a6c72886a37ddd11caa415d4"
-SRC_URI[go_linux_arm64.sha256sum] = "74a4832d0f150a2d768a6781553494ba84152e854ebef743c4092cd9d1f66a9f"
+SRC_URI[go_linux_amd64.sha256sum] = "4cdd2bc664724dc7db94ad51b503512c5ae7220951cac568120f64f8e94399fc"
+SRC_URI[go_linux_arm64.sha256sum] = "914daad3f011cc2014dea799bb7490442677e4ad6de0b2ac3ded6cee7e3f493d"
UPSTREAM_CHECK_URI = "https://golang.org/dl/"
UPSTREAM_CHECK_REGEX = "go(?P<pver>\d+(\.\d+)+)\.linux"
diff --git a/meta/recipes-devtools/go/go-cross-canadian_1.17.12.bb b/meta/recipes-devtools/go/go-cross-canadian_1.17.13.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-cross-canadian_1.17.12.bb
rename to meta/recipes-devtools/go/go-cross-canadian_1.17.13.bb
diff --git a/meta/recipes-devtools/go/go-cross_1.17.12.bb b/meta/recipes-devtools/go/go-cross_1.17.13.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-cross_1.17.12.bb
rename to meta/recipes-devtools/go/go-cross_1.17.13.bb
diff --git a/meta/recipes-devtools/go/go-crosssdk_1.17.12.bb b/meta/recipes-devtools/go/go-crosssdk_1.17.13.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-crosssdk_1.17.12.bb
rename to meta/recipes-devtools/go/go-crosssdk_1.17.13.bb
diff --git a/meta/recipes-devtools/go/go-native_1.17.12.bb b/meta/recipes-devtools/go/go-native_1.17.13.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-native_1.17.12.bb
rename to meta/recipes-devtools/go/go-native_1.17.13.bb
diff --git a/meta/recipes-devtools/go/go-runtime_1.17.12.bb b/meta/recipes-devtools/go/go-runtime_1.17.13.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-runtime_1.17.12.bb
rename to meta/recipes-devtools/go/go-runtime_1.17.13.bb
diff --git a/meta/recipes-devtools/go/go_1.17.12.bb b/meta/recipes-devtools/go/go_1.17.13.bb
similarity index 100%
rename from meta/recipes-devtools/go/go_1.17.12.bb
rename to meta/recipes-devtools/go/go_1.17.13.bb
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 09/28] bluez5: update 5.64 -> 5.65
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (7 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 08/28] go: update v1.17.12 -> v1.17.13 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 10/28] libwpe: upgrade 1.12.0 -> 1.12.2 Steve Sakoman
` (18 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
ver 5.65 changes:
Fix issue with A2DP cache invalidation handling.
Fix issue with A2DP and not initialized SEP codec.
Fix issue with A2DP and multiple SetConfiguration to same SEP
Fix issue with AVRCP and not properly initialized volume.
Fix issue with SDP records when operating in LE only mode.
Fix issue with HoG and not reading report map of instances.
Fix issue with GATT server crashing while disconnecting.
Fix issue with not removing connected devices.
Fix issue with enabling wake support without RPA Resolution.
Fix issue with pairing failed due to the error of Already Paired.
Add support for CONFIGURATION_DIRECTORY environment variable.
Add support for STATE_DIRECTORY environment variable.
Add support for "Bonded" property with Device API.
Add experimental support for ISO socket.
Drop fix_service.patch as it is merged upstream.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 10374b5ed4b5550eadacbcd71ae20b751ce5c038)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-connectivity/bluez5/bluez5.inc | 1 -
.../bluez5/bluez5/fix_service.patch | 30 -------------------
.../bluez5/{bluez5_5.64.bb => bluez5_5.65.bb} | 2 +-
3 files changed, 1 insertion(+), 32 deletions(-)
delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/fix_service.patch
rename meta/recipes-connectivity/bluez5/{bluez5_5.64.bb => bluez5_5.65.bb} (95%)
diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc
index 22dd07b348..79d4645ca8 100644
--- a/meta/recipes-connectivity/bluez5/bluez5.inc
+++ b/meta/recipes-connectivity/bluez5/bluez5.inc
@@ -53,7 +53,6 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \
${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '', 'file://0001-Allow-using-obexd-without-systemd-in-the-user-sessio.patch', d)} \
file://0001-tests-add-a-target-for-building-tests-without-runnin.patch \
file://0001-test-gatt-Fix-hung-issue.patch \
- file://fix_service.patch \
"
S = "${WORKDIR}/bluez-${PV}"
diff --git a/meta/recipes-connectivity/bluez5/bluez5/fix_service.patch b/meta/recipes-connectivity/bluez5/bluez5/fix_service.patch
deleted file mode 100644
index 96fdf6b299..0000000000
--- a/meta/recipes-connectivity/bluez5/bluez5/fix_service.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-The systemd bluetooth service failed to start because the /var/lib/bluetooth
-path of ReadWritePaths= is created by the bluetooth daemon itself.
-
-The commit systemd: Add more filesystem lockdown (442d211) add ReadWritePaths=/etc/bluetooth
-and ReadOnlyPaths=/var/lib/bluetooth options to the bluetooth systemd service.
-The existing ProtectSystem=full option mounts the /usr, the boot loader
-directories and /etc read-only. This means the two option are useless and could be removed.
-
-Upstream-Status: Submitted [https://github.com/bluez/bluez/issues/329]
-
-Index: bluez-5.64/src/bluetooth.service.in
-===================================================================
---- bluez-5.64.orig/src/bluetooth.service.in
-+++ bluez-5.64/src/bluetooth.service.in
-@@ -15,12 +15,12 @@ LimitNPROC=1
-
- # Filesystem lockdown
- ProtectHome=true
--ProtectSystem=full
-+ProtectSystem=strict
- PrivateTmp=true
- ProtectKernelTunables=true
- ProtectControlGroups=true
--ReadWritePaths=@statedir@
--ReadOnlyPaths=@confdir@
-+ConfigurationDirectory=bluetooth
-+StateDirectory=bluetooth
-
- # Execute Mappings
- MemoryDenyWriteExecute=true
diff --git a/meta/recipes-connectivity/bluez5/bluez5_5.64.bb b/meta/recipes-connectivity/bluez5/bluez5_5.65.bb
similarity index 95%
rename from meta/recipes-connectivity/bluez5/bluez5_5.64.bb
rename to meta/recipes-connectivity/bluez5/bluez5_5.65.bb
index 4319f9aae8..4c15aeb46d 100644
--- a/meta/recipes-connectivity/bluez5/bluez5_5.64.bb
+++ b/meta/recipes-connectivity/bluez5/bluez5_5.65.bb
@@ -1,6 +1,6 @@
require bluez5.inc
-SRC_URI[sha256sum] = "ae437e65b6b3070c198bc5b0109fe9cdeb9eaa387380e2072f9de65fe8a1de34"
+SRC_URI[sha256sum] = "2565a4d48354b576e6ad92e25b54ed66808296581c8abb80587051f9993d96d4"
# These issues have kernel fixes rather than bluez fixes so exclude here
CVE_CHECK_IGNORE += "CVE-2020-12352 CVE-2020-24490"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 10/28] libwpe: upgrade 1.12.0 -> 1.12.2
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (8 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 09/28] bluez5: update 5.64 -> 5.65 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 11/28] ell: upgrade 0.49 -> 0.50 Steve Sakoman
` (17 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
What’s new in libwpe 1.12.1?
- Fix pasteboard to use the generic interface by default.
- Fix memory allocation to always abort execution on failure.
What’s new in libwpe 1.12.1?
- Fix pasteboard to use the generic interface by default.
- Fix memory allocation to always abort execution on failure.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 03b7bfb0f011ba812808fa353611178cd5618e81)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...ure-due-to-libc-using-libc-functions.patch | 42 +++++++++++++++++++
.../{libwpe_1.12.0.bb => libwpe_1.12.2.bb} | 6 ++-
2 files changed, 46 insertions(+), 2 deletions(-)
create mode 100644 meta/recipes-sato/webkit/libwpe/0001-Fix-build-failure-due-to-libc-using-libc-functions.patch
rename meta/recipes-sato/webkit/{libwpe_1.12.0.bb => libwpe_1.12.2.bb} (72%)
diff --git a/meta/recipes-sato/webkit/libwpe/0001-Fix-build-failure-due-to-libc-using-libc-functions.patch b/meta/recipes-sato/webkit/libwpe/0001-Fix-build-failure-due-to-libc-using-libc-functions.patch
new file mode 100644
index 0000000000..6d27b4835d
--- /dev/null
+++ b/meta/recipes-sato/webkit/libwpe/0001-Fix-build-failure-due-to-libc-using-libc-functions.patch
@@ -0,0 +1,42 @@
+From ccf8a58c3536ca0e62748e0ea477514e14d821bc Mon Sep 17 00:00:00 2001
+From: Adrian Perez de Castro <aperez@igalia.com>
+Date: Thu, 4 Aug 2022 12:19:05 +0300
+Subject: [PATCH] Fix build failure due to libc++ using libc functions
+
+Include the "alloc-private.h" header after the C++ standard library
+headers. This sidesteps build failures caused by implementations of
+std::map and std::string which use libc memory allocation functions
+in expanded templates after they have been marked with the "poison"
+pragma.
+
+Fixes #115
+
+Upstream-Status: Backport
+Signed-off-by: Alexander Kanavin <alex@linutronix.de>
+---
+ src/pasteboard-generic.cpp | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/src/pasteboard-generic.cpp b/src/pasteboard-generic.cpp
+index 86fe4ee..a357027 100644
+--- a/src/pasteboard-generic.cpp
++++ b/src/pasteboard-generic.cpp
+@@ -26,12 +26,15 @@
+
+ #include "pasteboard-private.h"
+
+-#include "alloc-private.h"
+-#include <cstdlib>
+-#include <cstring>
+ #include <map>
+ #include <string>
+
++// We need to include this header last, in order to avoid template expansions
++// from the C++ standard library happening after it forbids usage of the libc
++// memory functions.
++#include "alloc-private.h"
++#include <cstring>
++
+ namespace Generic {
+ using Pasteboard = std::map<std::string, std::string>;
+ }
diff --git a/meta/recipes-sato/webkit/libwpe_1.12.0.bb b/meta/recipes-sato/webkit/libwpe_1.12.2.bb
similarity index 72%
rename from meta/recipes-sato/webkit/libwpe_1.12.0.bb
rename to meta/recipes-sato/webkit/libwpe_1.12.2.bb
index ac4ee3eb23..e23a9ac32d 100644
--- a/meta/recipes-sato/webkit/libwpe_1.12.0.bb
+++ b/meta/recipes-sato/webkit/libwpe_1.12.2.bb
@@ -10,8 +10,10 @@ inherit cmake features_check pkgconfig
REQUIRED_DISTRO_FEATURES = "opengl"
-SRC_URI = "https://wpewebkit.org/releases/${BPN}-${PV}.tar.xz"
-SRC_URI[sha256sum] = "e8eeca228a6b4c36294cfb63f7d3ba9ada47a430904a5a973b3c99c96a44c18c"
+SRC_URI = "https://wpewebkit.org/releases/${BPN}-${PV}.tar.xz \
+ file://0001-Fix-build-failure-due-to-libc-using-libc-functions.patch \
+ "
+SRC_URI[sha256sum] = "4ac4fd0a8b562b721bffd0f46ae9f06c2b5a3114407581978be875a9d651642a"
# This is a tweak of upstream-version-is-even needed because
# ipstream directory contains tarballs for other components as well.
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 11/28] ell: upgrade 0.49 -> 0.50
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (9 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 10/28] libwpe: upgrade 1.12.0 -> 1.12.2 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 12/28] iso-codes: upgrade 4.10.0 -> 4.11.0 Steve Sakoman
` (16 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
ver 0.50:
Fix issue with D-Bus use-after-free crash when removing objects.
Fix issue with DHCP lease expiry based on frame reception times.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9a9c78fb94d04c1b38d8d0f2cb283e19ed513a12)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-core/ell/{ell_0.49.bb => ell_0.50.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-core/ell/{ell_0.49.bb => ell_0.50.bb} (89%)
diff --git a/meta/recipes-core/ell/ell_0.49.bb b/meta/recipes-core/ell/ell_0.50.bb
similarity index 89%
rename from meta/recipes-core/ell/ell_0.49.bb
rename to meta/recipes-core/ell/ell_0.50.bb
index 9edd6fc92a..243ac01530 100644
--- a/meta/recipes-core/ell/ell_0.49.bb
+++ b/meta/recipes-core/ell/ell_0.50.bb
@@ -16,7 +16,7 @@ inherit autotools pkgconfig
SRC_URI = "https://mirrors.edge.kernel.org/pub/linux/libs/${BPN}/${BPN}-${PV}.tar.xz \
"
-SRC_URI[sha256sum] = "a7ff8ecbc76b187d942dd22b61cb489711400897c790319ffb7e944791687c3f"
+SRC_URI[sha256sum] = "0fe51d51c6eddc2a2784092f1dfdd1143a5ef27f15c274ecfbadd680d3a72fd9"
do_configure:prepend () {
mkdir -p ${S}/build-aux
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 12/28] iso-codes: upgrade 4.10.0 -> 4.11.0
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (10 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 11/28] ell: upgrade 0.49 -> 0.50 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 13/28] libcap: upgrade 2.63 -> 2.64 Steve Sakoman
` (15 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
Changes from 4.10.0:
- Update ISO 639-3 codes from SIL website. Fixes #40
- Translation updates for ISO 3166-1
- Translation updates for ISO 3166-2
- Translation updates for ISO 3166-3
- Translation updates for ISO 639-2
- Translation updates for ISO 639-3
- Translation updates for ISO 639-5
- Translation updates for ISO 4217
- Translation updates for ISO 15924
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a269e59a960a56ac038f4e96c199a7577202b186)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../iso-codes/{iso-codes_4.10.0.bb => iso-codes_4.11.0.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-support/iso-codes/{iso-codes_4.10.0.bb => iso-codes_4.11.0.bb} (94%)
diff --git a/meta/recipes-support/iso-codes/iso-codes_4.10.0.bb b/meta/recipes-support/iso-codes/iso-codes_4.11.0.bb
similarity index 94%
rename from meta/recipes-support/iso-codes/iso-codes_4.10.0.bb
rename to meta/recipes-support/iso-codes/iso-codes_4.11.0.bb
index 857fe463ef..be573981b0 100644
--- a/meta/recipes-support/iso-codes/iso-codes_4.10.0.bb
+++ b/meta/recipes-support/iso-codes/iso-codes_4.11.0.bb
@@ -9,7 +9,7 @@ LICENSE = "LGPL-2.1-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
SRC_URI = "git://salsa.debian.org/iso-codes-team/iso-codes.git;protocol=https;branch=main;"
-SRCREV = "9a6c24ee40e737ab34273c1af13a8dabcae888dd"
+SRCREV = "2651d7fe65582263c57385a852b0c6d8a49f6985"
# inherit gettext cannot be used, because it adds gettext-native to BASEDEPENDS which
# are inhibited by allarch
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 13/28] libcap: upgrade 2.63 -> 2.64
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (11 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 12/28] iso-codes: upgrade 4.10.0 -> 4.11.0 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 14/28] libcap: upgrade 2.64 -> 2.65 Steve Sakoman
` (14 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: wangmy <wangmy@fujitsu.com>
Changes from 2.63:
- Fix memory leak in libpsx at program exit. (Bug: 215551 reported by Kalen Hall)
- Be more resilient to CGo configuration with Go compiler when building tests. (Bug: 215603)
- Fix cap_*prctl() return code/errno handling. (Bug: 215772 reported by Anderson Toshiyuki Sasaki)
- Minor clarification to cap_get_pid() man page concerning pid value within namespaces. (Bug: 215812)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bfbf8f05d1789b8a8a6826b83a21fd09b8e903ad)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/libcap/{libcap_2.63.bb => libcap_2.64.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-support/libcap/{libcap_2.63.bb => libcap_2.64.bb} (96%)
diff --git a/meta/recipes-support/libcap/libcap_2.63.bb b/meta/recipes-support/libcap/libcap_2.64.bb
similarity index 96%
rename from meta/recipes-support/libcap/libcap_2.63.bb
rename to meta/recipes-support/libcap/libcap_2.64.bb
index 9e341c4bd0..7690d3e9a5 100644
--- a/meta/recipes-support/libcap/libcap_2.63.bb
+++ b/meta/recipes-support/libcap/libcap_2.64.bb
@@ -20,7 +20,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/libs/security/linux-privs/${BPN}2/${BPN}-${
SRC_URI:append:class-nativesdk = " \
file://0001-nativesdk-libcap-Raise-the-size-of-arrays-containing.patch \
"
-SRC_URI[sha256sum] = "0c637b8f44fc7d8627787e9cf57f15ac06c1ddccb53e41feec5496be3466f77f"
+SRC_URI[sha256sum] = "c8465e1f0b068d5fc06199231135ccac7adb56d662b1de93589252e8cd071e13"
UPSTREAM_CHECK_URI = "https://www.kernel.org/pub/linux/libs/security/linux-privs/${BPN}2/"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 14/28] libcap: upgrade 2.64 -> 2.65
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (12 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 13/28] libcap: upgrade 2.63 -> 2.64 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 15/28] libwebp: upgrade 1.2.2 -> 1.2.3 Steve Sakoman
` (13 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
CHanges from 2.64:
- Fix syntax error in DEBUG build of protected code in setcap.c. (Bug reported by yixiangzhike.)
- Prevent bash from reading the wrong startup files when the capsh --user=xxx argument is used to invoke a shell as the user xxx. (Bug: 215926)
- Man page info for cap_get_pid() and cap_reset_ambient(). (Bug reports from nomonemo and Tinkerer One.)
- Improve documentation and help for the captree program.
- Updated go/Makefile comment about an unfixed Go runtime bug in go1.16 and go1.17 (resolved in go1.18+), and the deadlock behavior of the psx-fd test.
- Refresh the signatures on the two GPG keys morgan@ uses. The 4096 bit one is preferred, but the older one is also used for continuity reasons. This set of signatures should also be available from the various key servers out there.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c3b16a6d0d0d4246b44dec3b1818f435d32d04e5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...1-nativesdk-libcap-Raise-the-size-of-arrays-containing.patch | 2 +-
meta/recipes-support/libcap/{libcap_2.64.bb => libcap_2.65.bb} | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-support/libcap/{libcap_2.64.bb => libcap_2.65.bb} (96%)
diff --git a/meta/recipes-support/libcap/files/0001-nativesdk-libcap-Raise-the-size-of-arrays-containing.patch b/meta/recipes-support/libcap/files/0001-nativesdk-libcap-Raise-the-size-of-arrays-containing.patch
index 9884fb5641..3f4c7e57ae 100644
--- a/meta/recipes-support/libcap/files/0001-nativesdk-libcap-Raise-the-size-of-arrays-containing.patch
+++ b/meta/recipes-support/libcap/files/0001-nativesdk-libcap-Raise-the-size-of-arrays-containing.patch
@@ -1,4 +1,4 @@
-From fc60e000169618a4adced845b9462d36ced1efdd Mon Sep 17 00:00:00 2001
+From 1c234bc39446eb9b23896e85dd67b02976d46c3d Mon Sep 17 00:00:00 2001
From: Hongxu Jia <hongxu.jia@windriver.com>
Date: Thu, 14 Oct 2021 15:57:36 +0800
Subject: [PATCH] nativesdk-libcap: Raise the size of arrays containing dl
diff --git a/meta/recipes-support/libcap/libcap_2.64.bb b/meta/recipes-support/libcap/libcap_2.65.bb
similarity index 96%
rename from meta/recipes-support/libcap/libcap_2.64.bb
rename to meta/recipes-support/libcap/libcap_2.65.bb
index 7690d3e9a5..8013d40769 100644
--- a/meta/recipes-support/libcap/libcap_2.64.bb
+++ b/meta/recipes-support/libcap/libcap_2.65.bb
@@ -20,7 +20,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/libs/security/linux-privs/${BPN}2/${BPN}-${
SRC_URI:append:class-nativesdk = " \
file://0001-nativesdk-libcap-Raise-the-size-of-arrays-containing.patch \
"
-SRC_URI[sha256sum] = "c8465e1f0b068d5fc06199231135ccac7adb56d662b1de93589252e8cd071e13"
+SRC_URI[sha256sum] = "73e350020cc31fe15360879d19384ffa3395a825f065fcf6bda3a5cdf965bebd"
UPSTREAM_CHECK_URI = "https://www.kernel.org/pub/linux/libs/security/linux-privs/${BPN}2/"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 15/28] libwebp: upgrade 1.2.2 -> 1.2.3
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (13 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 14/28] libcap: upgrade 2.64 -> 2.65 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 16/28] mobile-broadband-provider-info: upgrade 20220511 -> 20220725 Steve Sakoman
` (12 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
- 6/30/2022: version 1.2.3
This is a binary compatible release.
* security fix for lossless encoder (#565, chromium:1313709)
* improved progress granularity in WebPReportProgress() when using lossless
* improved precision in Sharp YUV (-sharp_yuv) conversion
* many corrections to webp-lossless-bitstream-spec.txt (#551)
* crash/leak fixes on error/OOM and other bug fixes (#558, #563, #569, #573)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1ab7d3bd94f8aeffc1e126a1ef80d5ca6bd3d6c1)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../webp/{libwebp_1.2.2.bb => libwebp_1.2.3.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-multimedia/webp/{libwebp_1.2.2.bb => libwebp_1.2.3.bb} (95%)
diff --git a/meta/recipes-multimedia/webp/libwebp_1.2.2.bb b/meta/recipes-multimedia/webp/libwebp_1.2.3.bb
similarity index 95%
rename from meta/recipes-multimedia/webp/libwebp_1.2.2.bb
rename to meta/recipes-multimedia/webp/libwebp_1.2.3.bb
index 281cff1bf2..2d523df749 100644
--- a/meta/recipes-multimedia/webp/libwebp_1.2.2.bb
+++ b/meta/recipes-multimedia/webp/libwebp_1.2.3.bb
@@ -14,7 +14,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=6e8dee932c26f2dab503abf70c96d8bb \
file://PATENTS;md5=c6926d0cb07d296f886ab6e0cc5a85b7"
SRC_URI = "http://downloads.webmproject.org/releases/webp/${BP}.tar.gz"
-SRC_URI[sha256sum] = "7656532f837af5f4cec3ff6bafe552c044dc39bf453587bd5b77450802f4aee6"
+SRC_URI[sha256sum] = "f5d7ab2390b06b8a934a4fc35784291b3885b557780d099bd32f09241f9d83f9"
UPSTREAM_CHECK_URI = "http://downloads.webmproject.org/releases/webp/index.html"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 16/28] mobile-broadband-provider-info: upgrade 20220511 -> 20220725
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (14 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 15/28] libwebp: upgrade 1.2.2 -> 1.2.3 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 17/28] webkitgtk: upgrade 2.36.4 -> 2.36.5 Steve Sakoman
` (11 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 96185dac787e14fa9eb77d009653a2fd4d926e3f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../mobile-broadband-provider-info_git.bb | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-connectivity/mobile-broadband-provider-info/mobile-broadband-provider-info_git.bb b/meta/recipes-connectivity/mobile-broadband-provider-info/mobile-broadband-provider-info_git.bb
index e6f216e5cb..2cc92b7b47 100644
--- a/meta/recipes-connectivity/mobile-broadband-provider-info/mobile-broadband-provider-info_git.bb
+++ b/meta/recipes-connectivity/mobile-broadband-provider-info/mobile-broadband-provider-info_git.bb
@@ -5,8 +5,8 @@ SECTION = "network"
LICENSE = "PD"
LIC_FILES_CHKSUM = "file://COPYING;md5=87964579b2a8ece4bc6744d2dc9a8b04"
-SRCREV = "3d5c8d0f7e0264768a2c000d0fd4b4d4a991e041"
-PV = "20220511"
+SRCREV = "fe19892a8168bf19d81e3bc4ee319bf7f9f058f5"
+PV = "20220725"
PE = "1"
SRC_URI = "git://gitlab.gnome.org/GNOME/mobile-broadband-provider-info.git;protocol=https;branch=main"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 17/28] webkitgtk: upgrade 2.36.4 -> 2.36.5
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (15 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 16/28] mobile-broadband-provider-info: upgrade 20220511 -> 20220725 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 18/28] weston: upgrade 10.0.1 -> 10.0.2 Steve Sakoman
` (10 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
This is a bug fix release in the stable 2.36 series.
What’s new in the WebKitGTK 2.36.5 release?
- Add support for PAC proxy in the WebDriver implementation.
- Fix video playback when loaded through custom URIs, this fixes video playback in the Yelp documentation browser.
- Fix WebKitWebView::context-menu when using GTK4.
- Fix LTO builds with GCC.
- Fix several crashes and rendering issues.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 31e57deaed0fd46396d22dd6fcb75e955c1aa2f6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../webkit/{webkitgtk_2.36.4.bb => webkitgtk_2.36.5.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-sato/webkit/{webkitgtk_2.36.4.bb => webkitgtk_2.36.5.bb} (98%)
diff --git a/meta/recipes-sato/webkit/webkitgtk_2.36.4.bb b/meta/recipes-sato/webkit/webkitgtk_2.36.5.bb
similarity index 98%
rename from meta/recipes-sato/webkit/webkitgtk_2.36.4.bb
rename to meta/recipes-sato/webkit/webkitgtk_2.36.5.bb
index df4ff63121..b3fe357010 100644
--- a/meta/recipes-sato/webkit/webkitgtk_2.36.4.bb
+++ b/meta/recipes-sato/webkit/webkitgtk_2.36.5.bb
@@ -17,7 +17,7 @@ SRC_URI = "https://www.webkitgtk.org/releases/${BPN}-${PV}.tar.xz \
file://0001-When-building-introspection-files-do-not-quote-CFLAG.patch \
"
-SRC_URI[sha256sum] = "b6bebe1f85a479d968c19e44a4704622ef8cef61636ad1b2406b77d16ae2e2a8"
+SRC_URI[sha256sum] = "d5532fa884c943dc48f1911473dd663aba407a3b35caa7b04bac1419b41e5908"
inherit cmake pkgconfig gobject-introspection perlnative features_check upstream-version-is-even gtk-doc
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 18/28] weston: upgrade 10.0.1 -> 10.0.2
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (16 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 17/28] webkitgtk: upgrade 2.36.4 -> 2.36.5 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 19/28] python3-pip: Fix RDEPENDS after the update Steve Sakoman
` (9 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
This is a bugfix release
Full commit history below.
Daniel Stone (1):
tests: Use test-desktop-shell for devices-test
Pekka Paalanen (1):
tests: preserve ivi runner section
Simon Ser (1):
build: bump to version 10.0.2 for the point release
Drop dont-use-plane-add-prop.patch as issue is fixed elsewhere
(see the link in the patch).
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ed54ef8f094fb6759316781a5ac626af40ad8ffc)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../weston/dont-use-plane-add-prop.patch | 32 -------------------
.../{weston_10.0.1.bb => weston_10.0.2.bb} | 4 +--
2 files changed, 1 insertion(+), 35 deletions(-)
delete mode 100644 meta/recipes-graphics/wayland/weston/dont-use-plane-add-prop.patch
rename meta/recipes-graphics/wayland/{weston_10.0.1.bb => weston_10.0.2.bb} (97%)
diff --git a/meta/recipes-graphics/wayland/weston/dont-use-plane-add-prop.patch b/meta/recipes-graphics/wayland/weston/dont-use-plane-add-prop.patch
deleted file mode 100644
index 1ac0695222..0000000000
--- a/meta/recipes-graphics/wayland/weston/dont-use-plane-add-prop.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From ece4c3d261aeec230869c0304ed1011ff6837c16 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Sat, 12 Sep 2020 14:04:04 -0700
-Subject: [PATCH] Fix atomic modesetting with musl
-
-atomic modesetting seems to fail with drm weston backend and this patch fixes
-it, below errors are seen before weston exits
-
-atomic: couldn't commit new state: Invalid argument
-
-Upstream-Status: Submitted [https://gitlab.freedesktop.org/wayland/weston/-/issues/158]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-
----
- libweston/backend-drm/kms.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/libweston/backend-drm/kms.c b/libweston/backend-drm/kms.c
-index 780d007..9994da1 100644
---- a/libweston/backend-drm/kms.c
-+++ b/libweston/backend-drm/kms.c
-@@ -1142,8 +1142,8 @@ drm_pending_state_apply_atomic(struct drm_pending_state *pending_state,
- wl_list_for_each(plane, &b->plane_list, link) {
- drm_debug(b, "\t\t[atomic] starting with plane %lu disabled\n",
- (unsigned long) plane->plane_id);
-- plane_add_prop(req, plane, WDRM_PLANE_CRTC_ID, 0);
-- plane_add_prop(req, plane, WDRM_PLANE_FB_ID, 0);
-+ //plane_add_prop(req, plane, WDRM_PLANE_CRTC_ID, 0);
-+ //plane_add_prop(req, plane, WDRM_PLANE_FB_ID, 0);
- }
-
- flags |= DRM_MODE_ATOMIC_ALLOW_MODESET;
diff --git a/meta/recipes-graphics/wayland/weston_10.0.1.bb b/meta/recipes-graphics/wayland/weston_10.0.2.bb
similarity index 97%
rename from meta/recipes-graphics/wayland/weston_10.0.1.bb
rename to meta/recipes-graphics/wayland/weston_10.0.2.bb
index e27dac164e..f81a33fd1e 100644
--- a/meta/recipes-graphics/wayland/weston_10.0.1.bb
+++ b/meta/recipes-graphics/wayland/weston_10.0.2.bb
@@ -13,9 +13,7 @@ SRC_URI = "https://gitlab.freedesktop.org/wayland/weston/-/releases/${PV}/downlo
file://systemd-notify.weston-start \
"
-SRC_URI:append:libc-musl = " file://dont-use-plane-add-prop.patch "
-
-SRC_URI[sha256sum] = "8a9e52506a865a7410981b04f8341b89b84106db8531ab1f9fdd37b5dc034115"
+SRC_URI[sha256sum] = "89646ca0d9f8d413c2767e5c3828eaa3fa149c2a105b3729a6894fa7cf1549e7"
UPSTREAM_CHECK_URI = "https://wayland.freedesktop.org/releases.html"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 19/28] python3-pip: Fix RDEPENDS after the update
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (17 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 18/28] weston: upgrade 10.0.1 -> 10.0.2 Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 20/28] cracklib: Drop using register keyword Steve Sakoman
` (8 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Daiane Angolini <daiane.angolini@foundries.io>
Fix the following error messages:
ModuleNotFoundError: No module named 'distutils'
ModuleNotFoundError: No module named 'colorsys'
Signed-off-by: Daiane Angolini <daiane.angolini@foundries.io>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8beef93e6e341566eba8a125f75ad836ac6a3d69)
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/python/python3-pip_22.0.3.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/python/python3-pip_22.0.3.bb b/meta/recipes-devtools/python/python3-pip_22.0.3.bb
index 09a305edf8..6e28b87ba3 100644
--- a/meta/recipes-devtools/python/python3-pip_22.0.3.bb
+++ b/meta/recipes-devtools/python/python3-pip_22.0.3.bb
@@ -55,6 +55,8 @@ RDEPENDS:${PN} = "\
python3-unixadmin \
python3-xmlrpc \
python3-pickle \
+ python3-distutils \
+ python3-image \
"
BBCLASSEXTEND = "native nativesdk"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 20/28] cracklib: Drop using register keyword
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (18 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 19/28] python3-pip: Fix RDEPENDS after the update Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 21/28] tcp-wrappers: Fix implicit-function-declaration warnings Steve Sakoman
` (7 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Khem Raj <raj.khem@gmail.com>
Fixes
incompatible integer to pointer conversion passing
These errors are found with newer compilers e.g. clang-15
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 71eb15c474d891855a5b18e6835993848ffa7c51)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...01-rules-Drop-using-register-keyword.patch | 278 ++++++++++++++++++
...rrect-parameter-types-to-Debug-calls.patch | 40 +++
.../cracklib/cracklib_2.9.7.bb | 5 +-
3 files changed, 322 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-extended/cracklib/cracklib/0001-rules-Drop-using-register-keyword.patch
create mode 100644 meta/recipes-extended/cracklib/cracklib/0002-rules-Correct-parameter-types-to-Debug-calls.patch
diff --git a/meta/recipes-extended/cracklib/cracklib/0001-rules-Drop-using-register-keyword.patch b/meta/recipes-extended/cracklib/cracklib/0001-rules-Drop-using-register-keyword.patch
new file mode 100644
index 0000000000..a8446653eb
--- /dev/null
+++ b/meta/recipes-extended/cracklib/cracklib/0001-rules-Drop-using-register-keyword.patch
@@ -0,0 +1,278 @@
+From fe49471cfa7fe0618615c065f4c0ad04e888bf92 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sun, 7 Aug 2022 12:24:39 -0700
+Subject: [PATCH 1/2] rules: Drop using register keyword
+
+This is a deprecated keyword
+
+Upstream-Status: Submitted [https://github.com/cracklib/cracklib/pull/48]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ src/lib/rules.c | 94 ++++++++++++++++++++++++-------------------------
+ 1 file changed, 47 insertions(+), 47 deletions(-)
+
+diff --git a/lib/rules.c b/lib/rules.c
+index 3a2aa46..6e7a12a 100644
+--- a/lib/rules.c
++++ b/lib/rules.c
+@@ -67,8 +67,8 @@ Suffix(myword, suffix)
+ char *myword;
+ char *suffix;
+ {
+- register int i;
+- register int j;
++ int i;
++ int j;
+ i = strlen(myword);
+ j = strlen(suffix);
+
+@@ -83,10 +83,10 @@ Suffix(myword, suffix)
+
+ char *
+ Reverse(str) /* return a pointer to a reversal */
+- register char *str;
++ char *str;
+ {
+- register int i;
+- register int j;
++ int i;
++ int j;
+ static char area[STRINGSIZE];
+ j = i = strlen(str);
+ while (*str)
+@@ -99,9 +99,9 @@ Reverse(str) /* return a pointer to a reversal */
+
+ char *
+ Uppercase(str) /* return a pointer to an uppercase */
+- register char *str;
++ char *str;
+ {
+- register char *ptr;
++ char *ptr;
+ static char area[STRINGSIZE];
+ ptr = area;
+ while (*str)
+@@ -116,9 +116,9 @@ Uppercase(str) /* return a pointer to an uppercase */
+
+ char *
+ Lowercase(str) /* return a pointer to an lowercase */
+- register char *str;
++ char *str;
+ {
+- register char *ptr;
++ char *ptr;
+ static char area[STRINGSIZE];
+ ptr = area;
+ while (*str)
+@@ -133,9 +133,9 @@ Lowercase(str) /* return a pointer to an lowercase */
+
+ char *
+ Capitalise(str) /* return a pointer to an capitalised */
+- register char *str;
++ char *str;
+ {
+- register char *ptr;
++ char *ptr;
+ static char area[STRINGSIZE];
+ ptr = area;
+
+@@ -152,9 +152,9 @@ Capitalise(str) /* return a pointer to an capitalised */
+
+ char *
+ Pluralise(string) /* returns a pointer to a plural */
+- register char *string;
++ char *string;
+ {
+- register int length;
++ int length;
+ static char area[STRINGSIZE];
+ length = strlen(string);
+ strcpy(area, string);
+@@ -193,11 +193,11 @@ Pluralise(string) /* returns a pointer to a plural */
+
+ char *
+ Substitute(string, old, new) /* returns pointer to a swapped about copy */
+- register char *string;
+- register char old;
+- register char new;
++ char *string;
++ char old;
++ char new;
+ {
+- register char *ptr;
++ char *ptr;
+ static char area[STRINGSIZE];
+ ptr = area;
+ while (*string)
+@@ -211,11 +211,11 @@ Substitute(string, old, new) /* returns pointer to a swapped about copy */
+
+ char *
+ Purge(string, target) /* returns pointer to a purged copy */
+- register char *string;
+- register char target;
++ char *string;
++ char target;
+ {
+- register char *ptr;
+- static char area[STRINGSIZE];
++ char *ptr;
++ char area[STRINGSIZE];
+ ptr = area;
+ while (*string)
+ {
+@@ -238,11 +238,11 @@ Purge(string, target) /* returns pointer to a purged copy */
+
+ int
+ MatchClass(class, input)
+- register char class;
+- register char input;
++ char class;
++ char input;
+ {
+- register char c;
+- register int retval;
++ char c;
++ int retval;
+ retval = 0;
+
+ switch (class)
+@@ -357,8 +357,8 @@ MatchClass(class, input)
+
+ char *
+ PolyStrchr(string, class)
+- register char *string;
+- register char class;
++ char *string;
++ char class;
+ {
+ while (*string)
+ {
+@@ -373,11 +373,11 @@ PolyStrchr(string, class)
+
+ char *
+ PolySubst(string, class, new) /* returns pointer to a swapped about copy */
+- register char *string;
+- register char class;
+- register char new;
++ char *string;
++ char class;
++ char new;
+ {
+- register char *ptr;
++ char *ptr;
+ static char area[STRINGSIZE];
+ ptr = area;
+ while (*string)
+@@ -391,10 +391,10 @@ PolySubst(string, class, new) /* returns pointer to a swapped about copy */
+
+ char *
+ PolyPurge(string, class) /* returns pointer to a purged copy */
+- register char *string;
+- register char class;
++ char *string;
++ char class;
+ {
+- register char *ptr;
++ char *ptr;
+ static char area[STRINGSIZE];
+ ptr = area;
+ while (*string)
+@@ -433,7 +433,7 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */
+ char *control;
+ {
+ int limit;
+- register char *ptr;
++ char *ptr;
+ static char area[STRINGSIZE * 2] = {0};
+ char area2[STRINGSIZE * 2] = {0};
+ strcpy(area, input);
+@@ -523,7 +523,7 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */
+ return NULL;
+ } else
+ {
+- register char *string;
++ char *string;
+ string = area;
+ while (*(string++));
+ string[-1] = *(++ptr);
+@@ -537,7 +537,7 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */
+ return NULL;
+ } else
+ {
+- register int i;
++ int i;
+ int start;
+ int length;
+ start = Char2Int(*(++ptr));
+@@ -563,7 +563,7 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */
+ return NULL;
+ } else
+ {
+- register int i;
++ int i;
+ i = Char2Int(*(++ptr));
+ if (i < 0)
+ {
+@@ -587,9 +587,9 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */
+ return NULL;
+ } else
+ {
+- register int i;
+- register char *p1;
+- register char *p2;
++ int i;
++ char *p1;
++ char *p2;
+ i = Char2Int(*(++ptr));
+ if (i < 0)
+ {
+@@ -696,7 +696,7 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */
+ return NULL;
+ } else
+ {
+- register int i;
++ int i;
+ if ((i = Char2Int(ptr[1])) < 0)
+ {
+ Debug(1, "Mangle: '=' weird argument in '%s'\n", control);
+@@ -723,7 +723,7 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */
+ case RULE_DFIRST:
+ if (area[0])
+ {
+- register int i;
++ int i;
+ for (i = 1; area[i]; i++)
+ {
+ area[i - 1] = area[i];
+@@ -735,7 +735,7 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */
+ case RULE_DLAST:
+ if (area[0])
+ {
+- register int i;
++ int i;
+ for (i = 1; area[i]; i++);
+ area[i - 1] = '\0';
+ }
+@@ -771,7 +771,7 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */
+ return NULL;
+ } else
+ {
+- register int i;
++ int i;
+
+ for (i = 0; area[i]; i++);
+
+@@ -815,8 +815,8 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */
+
+ int
+ PMatch(control, string)
+-register char *control;
+-register char *string;
++char *control;
++char *string;
+ {
+ while (*string && *control)
+ {
+--
+2.37.1
+
diff --git a/meta/recipes-extended/cracklib/cracklib/0002-rules-Correct-parameter-types-to-Debug-calls.patch b/meta/recipes-extended/cracklib/cracklib/0002-rules-Correct-parameter-types-to-Debug-calls.patch
new file mode 100644
index 0000000000..a8692b0cca
--- /dev/null
+++ b/meta/recipes-extended/cracklib/cracklib/0002-rules-Correct-parameter-types-to-Debug-calls.patch
@@ -0,0 +1,40 @@
+From 793921a8ee4ae7f20e1fd2bbec5196bc83176b01 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sun, 7 Aug 2022 12:25:24 -0700
+Subject: [PATCH 2/2] rules: Correct parameter types to Debug() calls
+
+Fixes
+src/lib/rules.c:346:45: error: incompatible integer to pointer conversion passing 'char' to parameter of type 'char *'; take the address with & [-Wint-conversion]
+src/lib/rules.c:804:53: error: incompatible integer to pointer conversion passing 'char' to parameter of type 'char *'; remove * [-Wint-conversion] Debug(1, "Mangle: unknown command %c in %s\n", *ptr, control);
+ ^~~~
+Upstream-Status: Submitted [https://github.com/cracklib/cracklib/pull/48]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ src/lib/rules.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/rules.c b/lib/rules.c
+index 6e7a12a..4a34f91 100644
+--- a/lib/rules.c
++++ b/lib/rules.c
+@@ -343,7 +343,7 @@ MatchClass(class, input)
+ break;
+
+ default:
+- Debug(1, "MatchClass: unknown class %c\n", class);
++ Debug(1, "MatchClass: unknown class %c\n", &class);
+ return (0);
+ break;
+ }
+@@ -801,7 +801,7 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */
+ }
+
+ default:
+- Debug(1, "Mangle: unknown command %c in %s\n", *ptr, control);
++ Debug(1, "Mangle: unknown command %c in %s\n", ptr, control);
+ return NULL;
+ break;
+ }
+--
+2.37.1
+
diff --git a/meta/recipes-extended/cracklib/cracklib_2.9.7.bb b/meta/recipes-extended/cracklib/cracklib_2.9.7.bb
index 629069e844..ffed88ed01 100644
--- a/meta/recipes-extended/cracklib/cracklib_2.9.7.bb
+++ b/meta/recipes-extended/cracklib/cracklib_2.9.7.bb
@@ -11,7 +11,10 @@ EXTRA_OECONF = "--without-python --libdir=${base_libdir}"
SRC_URI = "git://github.com/cracklib/cracklib;protocol=https;branch=master \
file://0001-packlib.c-support-dictionary-byte-order-dependent.patch \
- file://0002-craklib-fix-testnum-and-teststr-failed.patch"
+ file://0002-craklib-fix-testnum-and-teststr-failed.patch \
+ file://0001-rules-Drop-using-register-keyword.patch \
+ file://0002-rules-Correct-parameter-types-to-Debug-calls.patch \
+ "
SRCREV = "f83934cf3cced0c9600c7d81332f4169f122a2cf"
S = "${WORKDIR}/git/src"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 21/28] tcp-wrappers: Fix implicit-function-declaration warnings
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (19 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 20/28] cracklib: Drop using register keyword Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 22/28] libpam: use /run instead of /var/run in systemd tmpfiles Steve Sakoman
` (6 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Khem Raj <raj.khem@gmail.com>
This is seen with clang-15+
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4b882afd6c1a67b48cf4e7ace95d46ca2ff12aa0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...plicit-function-declaration-warnings.patch | 109 ++++++++++++++++++
.../tcp-wrappers/tcp-wrappers_7.6.bb | 1 +
2 files changed, 110 insertions(+)
create mode 100644 meta/recipes-extended/tcp-wrappers/tcp-wrappers-7.6/0001-Fix-implicit-function-declaration-warnings.patch
diff --git a/meta/recipes-extended/tcp-wrappers/tcp-wrappers-7.6/0001-Fix-implicit-function-declaration-warnings.patch b/meta/recipes-extended/tcp-wrappers/tcp-wrappers-7.6/0001-Fix-implicit-function-declaration-warnings.patch
new file mode 100644
index 0000000000..ec793ac8ff
--- /dev/null
+++ b/meta/recipes-extended/tcp-wrappers/tcp-wrappers-7.6/0001-Fix-implicit-function-declaration-warnings.patch
@@ -0,0 +1,109 @@
+From 9c97b5db237a793e0d1b6b0241570bdc6e35ee24 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sun, 7 Aug 2022 17:42:24 -0700
+Subject: [PATCH] Fix implicit-function-declaration warnings
+
+These are seen with clang-15+
+
+Upstream-Status: Inappropriate [upstream is dead]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ hosts_access.c | 3 +++
+ safe_finger.c | 1 +
+ shell_cmd.c | 3 +++
+ tcpd.c | 2 +-
+ tcpdchk.c | 1 +
+ workarounds.c | 1 +
+ 6 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/hosts_access.c b/hosts_access.c
+index 0133e5e..58697ea 100644
+--- a/hosts_access.c
++++ b/hosts_access.c
+@@ -33,6 +33,7 @@ static char sccsid[] = "@(#) hosts_access.c 1.21 97/02/12 02:13:22";
+ #endif
+ #include <netinet/in.h>
+ #include <arpa/inet.h>
++#include <rpcsvc/ypclnt.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <syslog.h>
+@@ -45,6 +46,8 @@ static char sccsid[] = "@(#) hosts_access.c 1.21 97/02/12 02:13:22";
+ #endif
+
+ extern int errno;
++extern int match_pattern_ylo(const char *s, const char *pattern);
++extern unsigned long cidr_mask_addr(char* str);
+
+ #ifndef INADDR_NONE
+ #define INADDR_NONE (-1) /* XXX should be 0xffffffff */
+diff --git a/safe_finger.c b/safe_finger.c
+index 23afab1..a6458fb 100644
+--- a/safe_finger.c
++++ b/safe_finger.c
+@@ -34,6 +34,7 @@ static char sccsid[] = "@(#) safe_finger.c 1.4 94/12/28 17:42:41";
+ #include <syslog.h>
+
+ extern void exit();
++extern int pipe_stdin(char **argv);
+
+ /* Local stuff */
+
+diff --git a/shell_cmd.c b/shell_cmd.c
+index 62d31bc..a566092 100644
+--- a/shell_cmd.c
++++ b/shell_cmd.c
+@@ -16,10 +16,13 @@ static char sccsid[] = "@(#) shell_cmd.c 1.5 94/12/28 17:42:44";
+
+ #include <sys/types.h>
+ #include <sys/param.h>
++#include <sys/wait.h>
++#include <fcntl.h>
+ #include <signal.h>
+ #include <stdio.h>
+ #include <syslog.h>
+ #include <string.h>
++#include <unistd.h>
+
+ extern void exit();
+
+diff --git a/tcpd.c b/tcpd.c
+index dc9ff17..4353caa 100644
+--- a/tcpd.c
++++ b/tcpd.c
+@@ -46,7 +46,7 @@ void fix_options(struct request_info *);
+ int allow_severity = SEVERITY; /* run-time adjustable */
+ int deny_severity = LOG_WARNING; /* ditto */
+
+-main(argc, argv)
++void main(argc, argv)
+ int argc;
+ char **argv;
+ {
+diff --git a/tcpdchk.c b/tcpdchk.c
+index 5dca8bd..67c12ce 100644
+--- a/tcpdchk.c
++++ b/tcpdchk.c
+@@ -38,6 +38,7 @@ static char sccsid[] = "@(#) tcpdchk.c 1.8 97/02/12 02:13:25";
+
+ extern int errno;
+ extern void exit();
++extern unsigned long cidr_mask_addr(char* str);
+ extern int optind;
+ extern char *optarg;
+
+diff --git a/workarounds.c b/workarounds.c
+index b22b378..6335049 100644
+--- a/workarounds.c
++++ b/workarounds.c
+@@ -21,6 +21,7 @@ char sccsid[] = "@(#) workarounds.c 1.6 96/03/19 16:22:25";
+ #include <stdio.h>
+ #include <syslog.h>
+ #include <string.h>
++#include <unistd.h>
+
+ extern int errno;
+
+--
+2.37.1
+
diff --git a/meta/recipes-extended/tcp-wrappers/tcp-wrappers_7.6.bb b/meta/recipes-extended/tcp-wrappers/tcp-wrappers_7.6.bb
index 814d7fd913..8137d257c8 100644
--- a/meta/recipes-extended/tcp-wrappers/tcp-wrappers_7.6.bb
+++ b/meta/recipes-extended/tcp-wrappers/tcp-wrappers_7.6.bb
@@ -50,6 +50,7 @@ SRC_URI = "http://ftp.porcupine.org/pub/security/tcp_wrappers_${PV}.tar.gz \
file://fix_warnings.patch \
file://fix_warnings2.patch \
file://0001-Remove-fgets-extern-declaration.patch \
+ file://0001-Fix-implicit-function-declaration-warnings.patch \
"
SRC_URI[md5sum] = "e6fa25f71226d090f34de3f6b122fb5a"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 22/28] libpam: use /run instead of /var/run in systemd tmpfiles
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (20 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 21/28] tcp-wrappers: Fix implicit-function-declaration warnings Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 23/28] perf: Fix reproducibility issues with 5.19 onwards Steve Sakoman
` (5 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Beniamin Sandu <beniaminsandu@gmail.com>
Update the deprecated path to remove the systemd warning:
/etc/tmpfiles.d/pam.conf:2: Line references path below
legacy directory /var/run/, updating /var/run/console
/run/console; please update the tmpfiles.d/
Signed-off-by: Beniamin Sandu <beniaminsandu@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 7865234fadf01a434d1f7097881b70905c1b8aa2)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-extended/pam/libpam/99_pam | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-extended/pam/libpam/99_pam b/meta/recipes-extended/pam/libpam/99_pam
index 97e990d10b..a88247be13 100644
--- a/meta/recipes-extended/pam/libpam/99_pam
+++ b/meta/recipes-extended/pam/libpam/99_pam
@@ -1 +1 @@
-d root root 0755 /var/run/sepermit none
+d root root 0755 /run/sepermit none
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 23/28] perf: Fix reproducibility issues with 5.19 onwards
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (21 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 22/28] libpam: use /run instead of /var/run in systemd tmpfiles Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 24/28] archiver.bbclass: some recipes that uses the kernelsrc bbclass uses the shared source Steve Sakoman
` (4 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
In 5.19 onwards the build process changed and encoded full build paths
into the output. Adapt the code to look more like our setuptools class
calls. This seems to work ok with older kernels too.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 138673f833a72c636a7fa185089f25dda350dc54)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-kernel/perf/perf.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-kernel/perf/perf.bb b/meta/recipes-kernel/perf/perf.bb
index 95e7eae9fe..95b4362958 100644
--- a/meta/recipes-kernel/perf/perf.bb
+++ b/meta/recipes-kernel/perf/perf.bb
@@ -203,7 +203,7 @@ do_configure:prepend () {
if [ -e "${S}/tools/perf/Makefile.perf" ]; then
sed -i -e 's,\ .config-detected, $(OUTPUT)/config-detected,g' \
${S}/tools/perf/Makefile.perf
- sed -i -e "s,prefix='\$(DESTDIR_SQ)/usr'$,prefix='\$(DESTDIR_SQ)/usr' --install-lib='\$(DESTDIR)\$(PYTHON_SITEPACKAGES_DIR)',g" \
+ sed -i -e "s,prefix='\$(DESTDIR_SQ)/usr'$,prefix='\$(DESTDIR_SQ)/usr' --install-lib='\$(PYTHON_SITEPACKAGES_DIR)' --root='\$(DESTDIR)',g" \
${S}/tools/perf/Makefile.perf
# backport https://github.com/torvalds/linux/commit/e4ffd066ff440a57097e9140fa9e16ceef905de8
sed -i -e 's,\($(Q)$(SHELL) .$(arch_errno_tbl).\) $(CC) $(arch_errno_hdr_dir),\1 $(firstword $(CC)) $(arch_errno_hdr_dir),g' \
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 24/28] archiver.bbclass: some recipes that uses the kernelsrc bbclass uses the shared source
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (22 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 23/28] perf: Fix reproducibility issues with 5.19 onwards Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 25/28] apt: fix nativesdk-apt build failure during the second time build Steve Sakoman
` (3 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Jose Quaresma <quaresma.jose@gmail.com>
This fix a race that happens when building some of the followning recipes
with kernel at same time.
The kernelsrc uses the kernel shared source dir as their source
S = "${STAGING_KERNEL_DIR}" and this will cause a race in the
do_unpack_and_patch task, when bitbake runs the
bb.build.exec_func('do_unpack', d) because do_unpack will
clean the source dir on startup.
| ok: note that S != "${STAGING_KERNEL_DIR} for this ones
openembedded-core/meta/recipes-kernel/perf/perf.bb:inherit kernelsrc
meta-openembedded/meta-oe/recipes-kernel/usbip-tools/usbip-tools.bb:inherit kernelsrc autotools-brokensep
| broken
meta-openembedded/meta-oe/recipes-kernel/cpupower/cpupower.bb:inherit kernelsrc kernel-arch bash-completion
meta-openembedded/meta-oe/recipes-kernel/spidev-test/spidev-test.bb:inherit bash-completion kernelsrc kernel-arch
meta-openembedded/meta-oe/recipes-kernel/intel-speed-select/intel-speed-select.bb:inherit kernelsrc
meta-openembedded/meta-oe/recipes-kernel/bpftool/bpftool.bb:inherit bash-completion kernelsrc kernel-arch
The issue can be replicated with:
INHERIT += "archiver"
ARCHIVER_MODE[src] = "original"
ARCHIVER_MODE[diff] = "1"
And:
R=<recipe> bitbake -c cleansstate virtual/kernel $R && bitbake $R
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5487dee2e1237fb57c5e59b2bbbfbcdfc8c97ab6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/archiver.bbclass | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/meta/classes/archiver.bbclass b/meta/classes/archiver.bbclass
index 5da369d422..dca4271a69 100644
--- a/meta/classes/archiver.bbclass
+++ b/meta/classes/archiver.bbclass
@@ -459,7 +459,9 @@ def create_diff_gz(d, src_orig, src, ar_outdir):
def is_work_shared(d):
pn = d.getVar('PN')
- return bb.data.inherits_class('kernel', d) or pn.startswith('gcc-source')
+ return pn.startswith('gcc-source') or \
+ bb.data.inherits_class('kernel', d) or \
+ (bb.data.inherits_class('kernelsrc', d) and d.getVar('S') == d.getVar('STAGING_KERNEL_DIR'))
# Run do_unpack and do_patch
python do_unpack_and_patch() {
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 25/28] apt: fix nativesdk-apt build failure during the second time build
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (23 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 24/28] archiver.bbclass: some recipes that uses the kernelsrc bbclass uses the shared source Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 26/28] linux-yocto: prepend the the value with a space when append to KERNEL_EXTRA_ARGS Steve Sakoman
` (2 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Changqing Li <changqing.li@windriver.com>
Run following commands:
bitbake nativesdk-apt
bitbake nativesdk-apt -c install -f
The second command's do_install will fail with following error:
| /build/tmp-glibc/work/x86_64-nativesdk-wrlinuxsdk-linux/nativesdk-apt/2.4.5-r0/recipe-sysroot-native/usr/bin/x86_64-wrlinuxsdk-linux/x86_64-wrlinuxsdk-linux-g++ -D_WITH_GETLINE=1 -Dapt_pkg_EXPORTS -I/build/tmp-glibc/work/x86_64-nativesdk-wrlinuxsdk-linux/nativesdk-apt/2.4.5-r0/build/include -I/build/tmp-glibc/work/x86_64-nativesdk-wrlinuxsdk-linux/nativesdk-apt/2.4.5-r0/build/include/apt-pkg --sysroot=/build/tmp-glibc/work/x86_64-nativesdk-wrlinuxsdk-linux/nativesdk-apt/2.4.5-r0/recipe-sysroot -O2 -pipe -fmacro-prefix-map=/build/tmp-glibc/work/x86_64-nativesdk-wrlinuxsdk-linux/nativesdk-apt/2.4.5-r0=/usr/src/debug/nativesdk-apt/2.4.5-r0 -fdebug-prefix-map=/build/tmp-glibc/work/x86_64-nativesdk-wrlinuxsdk-linux/nativesdk-apt/2.4.5-r0=/usr/src/debug/nativesdk-apt/2.4.5-r0 -fdebug-prefix-map=/build/tmp-glibc/work/x86_64-nativesdk-wrlinuxsdk-linux/nativesdk-apt/2.4.5-r0/recipe-sysroot= -fdebug-prefix-map=/build/tmp-glibc/work/x86_64-nativesdk-wrlinuxsdk-linux/nativesdk-apt/2.4.5-r0/recipe-sysroot-native= -fPIC -fvisibility=hidden -fvisibility-inlines-hidden -Wall -Wextra -Wcast-align -Wlogical-op -Wredundant-decls -Wmissing-declarations -Wunsafe-loop-optimizations -Wctor-dtor-privacy -Wdisabled-optimization -Winit-self -Wmissing-include-dirs -Wnoexcept -Wsign-promo -Wundef -Wdouble-promotion -Wsuggest-override -Werror=suggest-override -Werror=return-type -std=gnu++17 -MD -MT apt-pkg/CMakeFiles/apt-pkg.dir/tagfile-keys.cc.o -MF apt-pkg/CMakeFiles/apt-pkg.dir/tagfile-keys.cc.o.d -o apt-pkg/CMakeFiles/apt-pkg.dir/tagfile-keys.cc.o -c /build/tmp-glibc/work/x86_64-nativesdk-wrlinuxsdk-linux/nativesdk-apt/2.4.5-r0/build/apt-pkg/tagfile-keys.cc
| /build/tmp-glibc/work/x86_64-nativesdk-wrlinuxsdk-linux/nativesdk-apt/2.4.5-r0/build/apt-pkg/tagfile-keys.cc:1:10: fatal error: /include/apt-pkg/tagfile-keys.h: No such file or directory
| 1 | #include "/include/apt-pkg/tagfile-keys.h"
0/build/tmp-glibc/work/x86_64-nativesdk-wrlinuxsdk-linux/nativesdk-apt/2.4.5-r0/build/apt-pkg/tagfile-keys.cc
During the first command, do_install task changed tagfile-keys.cc, this
will make tagfile-keys.cc is newer than the built tagfile-keys.cc.o. So the second
do_install will rebuild tagfile-keys.cc.o. But the header path is
replaced wrongly, so fix the header path
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 3e18bd4dbddacfd878317ebcf0a039b46d6d6342)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/apt/apt_2.4.5.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-devtools/apt/apt_2.4.5.bb b/meta/recipes-devtools/apt/apt_2.4.5.bb
index 95c25e3036..b5ada2ef55 100644
--- a/meta/recipes-devtools/apt/apt_2.4.5.bb
+++ b/meta/recipes-devtools/apt/apt_2.4.5.bb
@@ -132,5 +132,5 @@ do_install:append:class-target() {
do_install:append() {
# Avoid non-reproducible -src package
- sed -i -e "s,${B},,g" ${B}/apt-pkg/tagfile-keys.cc
+ sed -i -e "s,${B}/include/,,g" ${B}/apt-pkg/tagfile-keys.cc
}
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 26/28] linux-yocto: prepend the the value with a space when append to KERNEL_EXTRA_ARGS
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (24 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 25/28] apt: fix nativesdk-apt build failure during the second time build Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 27/28] create-spdx: handle links to inaccessible locations Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 28/28] packagegroup-self-hosted: update for strace Steve Sakoman
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Jose Quaresma <quaresma.jose@gmail.com>
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f6183b2d2f625515ea767dba3d8076a53a246874)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-kernel/linux/linux-yocto.inc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto.inc b/meta/recipes-kernel/linux/linux-yocto.inc
index cabc8f4975..7ea661e138 100644
--- a/meta/recipes-kernel/linux/linux-yocto.inc
+++ b/meta/recipes-kernel/linux/linux-yocto.inc
@@ -60,7 +60,7 @@ do_install:append(){
KERNEL_FEATURES:append:qemuall=" features/kernel-sample/kernel-sample.scc"
KERNEL_DEBUG_OPTIONS ?= "stack"
-KERNEL_EXTRA_ARGS:append:x86-64 = "${@bb.utils.contains('KERNEL_DEBUG_OPTIONS', 'stack', 'HOST_LIBELF_LIBS="-L${RECIPE_SYSROOT_NATIVE}/usr/lib/pkgconfig/../../../usr/lib/ -lelf"', '', d)}"
+KERNEL_EXTRA_ARGS:append:x86-64 = " ${@bb.utils.contains('KERNEL_DEBUG_OPTIONS', 'stack', 'HOST_LIBELF_LIBS="-L${RECIPE_SYSROOT_NATIVE}/usr/lib/pkgconfig/../../../usr/lib/ -lelf"', '', d)}"
do_devshell:prepend() {
# setup native pkg-config variables (kconfig scripts call pkg-config directly, cannot generically be overriden to pkg-config-native)
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 27/28] create-spdx: handle links to inaccessible locations
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (25 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 26/28] linux-yocto: prepend the the value with a space when append to KERNEL_EXTRA_ARGS Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 28/28] packagegroup-self-hosted: update for strace Steve Sakoman
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
When a link is pointing to location inaccessible to build user (e.g. "/root/something"),
filepath.is_file() throws "PermissionError: [Errno 13] Permission denied".
Fix this by first checking if it is a link.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e105befbe4ee0d85e94c2048a744f0373e2dbcdf)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/create-spdx.bbclass | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/classes/create-spdx.bbclass b/meta/classes/create-spdx.bbclass
index ae484328fb..d735f20c20 100644
--- a/meta/classes/create-spdx.bbclass
+++ b/meta/classes/create-spdx.bbclass
@@ -210,7 +210,7 @@ def add_package_files(d, doc, spdx_pkg, topdir, get_spdxid, get_types, *, archiv
filepath = Path(subdir) / file
filename = str(filepath.relative_to(topdir))
- if filepath.is_file() and not filepath.is_symlink():
+ if not filepath.is_symlink() and filepath.is_file():
spdx_file = oe.spdx.SPDXFile()
spdx_file.SPDXID = get_spdxid(file_counter)
for t in get_types(filepath):
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 28/28] packagegroup-self-hosted: update for strace
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
` (26 preceding siblings ...)
2022-08-23 22:35 ` [OE-core][kirkstone 27/28] create-spdx: handle links to inaccessible locations Steve Sakoman
@ 2022-08-23 22:35 ` Steve Sakoman
27 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2022-08-23 22:35 UTC (permalink / raw)
To: openembedded-core
From: Kai Kang <kai.kang@windriver.com>
strace has been set imcompatible with riscv32, so update in
packagegroup-self-hosted.bb accordingly.
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d326c561f90666f292d55b029e358c86b765b7c4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-core/packagegroups/packagegroup-self-hosted.bb | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-core/packagegroups/packagegroup-self-hosted.bb b/meta/recipes-core/packagegroups/packagegroup-self-hosted.bb
index 9523aadd15..e62567894b 100644
--- a/meta/recipes-core/packagegroups/packagegroup-self-hosted.bb
+++ b/meta/recipes-core/packagegroups/packagegroup-self-hosted.bb
@@ -98,11 +98,14 @@ RDEPENDS:packagegroup-self-hosted-sdk:append:libc-glibc = "\
glibc-utils \
rpcsvc-proto \
"
+
+STRACE = "strace"
+STRACE:riscv32 = ""
RDEPENDS:packagegroup-self-hosted-debug = " \
gdb \
gdbserver \
rsync \
- strace \
+ ${STRACE} \
tcf-agent"
--
2.25.1
^ permalink raw reply related [flat|nested] 30+ messages in thread
* [OE-core][kirkstone 00/28] Patch review
@ 2023-07-06 15:06 Steve Sakoman
0 siblings, 0 replies; 30+ messages in thread
From: Steve Sakoman @ 2023-07-06 15:06 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Monday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5564
The following changes since commit f20a12ead2d5890e88e7f4ce149a777de47edc48:
blktrace: ask for python3 specifically (2023-06-27 12:49:55 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alexander Kanavin (6):
scripts/runqemu: split lock dir creation into a reusable function
scripts/runqemu: allocate unfsd ports in a way that doesn't race or
clash with unrelated processes
maintainers.inc: unassign Adrian Bunk from wireless-regdb
maintainers.inc: unassign Alistair Francis from opensbi
maintainers.inc: unassign Ricardo Neri from ovmf
grub: submit determinism.patch upstream
BELOUARGA Mohamed (1):
meta: lib: oe: npm_registry: Add more safe caracters
Bruce Ashfield (6):
linux-yocto/5.15: update to v5.15.114
linux-yocto/5.15: update to v5.15.115
linux-yocto/5.15: update to v5.15.116
linux-yocto/5.15: update to v5.15.117
linux-yocto/5.15: update to v5.15.118
linux-yocto/5.15: cfg: fix DECNET configuration warning
Charlie Wu (1):
devtool: Fix the wrong variable in srcuri_entry
Etienne Cordonnier (1):
libxcrypt: fix hard-coded ".so" extension
Fabien Mahot (1):
oeqa/selftest/bbtests: add non-existent prefile/postfile tests
Frieder Paape (1):
image_types: Fix reproducible builds for initramfs and UKI img
Khem Raj (1):
babeltrace2: Always use BFD linker when building tests with ld-is-lld
distro feature
Marek Vasut (1):
cpio: Replace fix wrong CRC with ASCII CRC for large files with
upstream backport
Mikko Rapeli (1):
useradd-staticids.bbclass: improve error message
Richard Purdie (4):
v86d: Improve kernel dependency
strace: Disable failing test
strace: Merge two similar patches
strace: Update patches/tests with upstream fixes
Rusty Howell (1):
oe-depends-dot: Handle new format for task-depends.dot
Vivek Kumbhar (3):
go: fix CVE-2023-29400 html/template improper handling of empty HTML
attributes
libcap: fix CVE-2023-2603 Integer Overflow in _libcap_strdup()
cups: fix CVE-2023-34241 use-after-free in cupsdAcceptClient() in
scheduler/client.c
meta/classes/image_types.bbclass | 5 +-
meta/classes/useradd-staticids.bbclass | 2 +-
meta/conf/distro/include/maintainers.inc | 8 +-
meta/lib/oe/npm_registry.py | 2 +-
meta/lib/oeqa/selftest/cases/bbtests.py | 8 +
meta/recipes-bsp/grub/files/determinism.patch | 2 +-
meta/recipes-bsp/v86d/v86d_0.1.10.bb | 1 -
meta/recipes-core/libxcrypt/libxcrypt.inc | 6 -
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.18/CVE-2023-29400.patch | 99 ++++++
...0001-caps-abbrev.awk-fix-gawk-s-path.patch | 47 ---
...b541b258baec9eba674b5d8dc30007a61542.patch | 50 +++
...2f4494779e5c5f170ad10539bfc2dfafe967.patch | 50 +++
.../strace/strace/update-gawk-paths.patch | 30 ++
meta/recipes-devtools/strace/strace_5.16.bb | 3 +-
...g-CRC-with-ASCII-CRC-for-large-files.patch | 39 ---
...-calculation-of-CRC-in-copy-out-mode.patch | 58 ++++
...appending-to-archives-bigger-than-2G.patch | 312 ++++++++++++++++++
meta/recipes-extended/cpio/cpio_2.13.bb | 3 +-
meta/recipes-extended/cups/cups.inc | 1 +
.../cups/cups/CVE-2023-34241.patch | 68 ++++
.../linux/linux-yocto-rt_5.15.bb | 6 +-
.../linux/linux-yocto-tiny_5.15.bb | 6 +-
meta/recipes-kernel/linux/linux-yocto_5.15.bb | 26 +-
.../recipes-kernel/lttng/babeltrace2_2.0.5.bb | 1 +
.../libcap/files/CVE-2023-2603.patch | 60 ++++
meta/recipes-support/libcap/libcap_2.66.bb | 1 +
scripts/lib/devtool/standard.py | 2 +-
scripts/lib/wic/plugins/source/bootimg-efi.py | 2 +
scripts/oe-depends-dot | 21 +-
scripts/runqemu | 48 ++-
31 files changed, 816 insertions(+), 152 deletions(-)
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2023-29400.patch
delete mode 100644 meta/recipes-devtools/strace/strace/0001-caps-abbrev.awk-fix-gawk-s-path.patch
create mode 100644 meta/recipes-devtools/strace/strace/3bbfb541b258baec9eba674b5d8dc30007a61542.patch
create mode 100644 meta/recipes-devtools/strace/strace/f31c2f4494779e5c5f170ad10539bfc2dfafe967.patch
delete mode 100644 meta/recipes-extended/cpio/cpio-2.13/0001-Wrong-CRC-with-ASCII-CRC-for-large-files.patch
create mode 100644 meta/recipes-extended/cpio/cpio-2.13/0003-Fix-calculation-of-CRC-in-copy-out-mode.patch
create mode 100644 meta/recipes-extended/cpio/cpio-2.13/0004-Fix-appending-to-archives-bigger-than-2G.patch
create mode 100644 meta/recipes-extended/cups/cups/CVE-2023-34241.patch
create mode 100644 meta/recipes-support/libcap/files/CVE-2023-2603.patch
--
2.34.1
^ permalink raw reply [flat|nested] 30+ messages in thread
end of thread, other threads:[~2023-07-06 15:06 UTC | newest]
Thread overview: 30+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-08-23 22:35 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 01/28] libtiff: CVE-2022-34526 A stack overflow was discovered Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 02/28] libxml2: Ignore CVE-2016-3709 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 03/28] connman: Backports for security fixes Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 04/28] u-boot: fix CVE-2022-30552 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 05/28] u-boot: fix CVE-2022-33967 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 06/28] grub2: fix several CVEs Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 07/28] cve-check: Don't use f-strings Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 08/28] go: update v1.17.12 -> v1.17.13 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 09/28] bluez5: update 5.64 -> 5.65 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 10/28] libwpe: upgrade 1.12.0 -> 1.12.2 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 11/28] ell: upgrade 0.49 -> 0.50 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 12/28] iso-codes: upgrade 4.10.0 -> 4.11.0 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 13/28] libcap: upgrade 2.63 -> 2.64 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 14/28] libcap: upgrade 2.64 -> 2.65 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 15/28] libwebp: upgrade 1.2.2 -> 1.2.3 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 16/28] mobile-broadband-provider-info: upgrade 20220511 -> 20220725 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 17/28] webkitgtk: upgrade 2.36.4 -> 2.36.5 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 18/28] weston: upgrade 10.0.1 -> 10.0.2 Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 19/28] python3-pip: Fix RDEPENDS after the update Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 20/28] cracklib: Drop using register keyword Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 21/28] tcp-wrappers: Fix implicit-function-declaration warnings Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 22/28] libpam: use /run instead of /var/run in systemd tmpfiles Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 23/28] perf: Fix reproducibility issues with 5.19 onwards Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 24/28] archiver.bbclass: some recipes that uses the kernelsrc bbclass uses the shared source Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 25/28] apt: fix nativesdk-apt build failure during the second time build Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 26/28] linux-yocto: prepend the the value with a space when append to KERNEL_EXTRA_ARGS Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 27/28] create-spdx: handle links to inaccessible locations Steve Sakoman
2022-08-23 22:35 ` [OE-core][kirkstone 28/28] packagegroup-self-hosted: update for strace Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2023-07-06 15:06 [OE-core][kirkstone 00/28] Patch review Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox