* [OE-core][dunfell 00/10] Patch review
@ 2021-12-13 15:36 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2021-12-13 15:36 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Wednesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3026
with the exception of a known autobuilder intermittent issue which passed
on subsequent retest:
https://autobuilder.yoctoproject.org/typhoon/#/builders/86/builds/2924
The following changes since commit f788765e1b9832d0da8ec4ce49aa811115864b0e:
README.OE-Core.md: update URLs (2021-12-06 04:48:48 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Andrey Zhizhikin (1):
lttng-modules: do not search in non-existing folder during install
Markus Volk (1):
wic:direct.py: ignore invalid mountpoints during fstab update
Marta Rybczynska (1):
libgcrypt: solve CVE-2021-33560 and CVE-2021-40528
Richard Purdie (1):
gcc: Add CVE-2021-37322 to the list of CVEs to ignore
Ross Burton (1):
runqemu: check the qemu PID has been set before kill()ing it
Sana Kazi (1):
busybox: Fix multiple security issues in awk
Stefan Herbrechtsmeier (2):
recipetool: Set master branch only as fallback
selftest/devtool: Check branch in git fetch
Steve Sakoman (2):
cve-extra-exclusions: add db CVEs to exclusion list
selftest: skip virgl test on centos 8 entirely
.../distro/include/cve-extra-exclusions.inc | 9 +-
meta/lib/oeqa/selftest/cases/devtool.py | 5 +-
meta/lib/oeqa/selftest/cases/runtime_test.py | 2 +
meta/recipes-core/busybox/busybox_1.31.1.bb | 1 +
.../busybox/files/CVE-2021-423xx-awk.patch | 215 ++++++++++++++++++
meta/recipes-devtools/gcc/gcc-9.3.inc | 3 +
.../lttng/lttng-modules_2.11.6.bb | 4 +-
.../libgcrypt/files/CVE-2021-33560.patch | 138 +++++------
.../libgcrypt/files/CVE-2021-40528.patch | 109 +++++++++
.../libgcrypt/libgcrypt_1.8.5.bb | 1 +
scripts/lib/recipetool/create.py | 15 +-
scripts/lib/wic/plugins/imager/direct.py | 2 +-
scripts/runqemu | 3 +-
13 files changed, 408 insertions(+), 99 deletions(-)
create mode 100644 meta/recipes-core/busybox/files/CVE-2021-423xx-awk.patch
create mode 100644 meta/recipes-support/libgcrypt/files/CVE-2021-40528.patch
--
2.25.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][dunfell 00/10] Patch review
@ 2022-03-27 16:40 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2022-03-27 16:40 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end of
day Tuesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3433
The following changes since commit 71015408c60ddf2e9af00cc8574815971e1b689d:
oeqa/selftest/tinfoil: Improve tinfoil event test debugging (2022-03-21 04:17:02 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Davide Gardenal (3):
qemu: backport patch fix for CVE-2020-13791
apt: backport patch fix for CVE-2020-3810
ghostscript: backport patch fix for CVE-2021-3781
Minjae Kim (2):
gnu-config: update SRC_URI
virglrenderer: update SRC_URI
Ralph Siemsen (1):
libxml2: fix CVE-2022-23308 regression
Richard Purdie (1):
oeqa/selftest/tinfoil: Fix intermittent event loss issue in test
Ross Burton (1):
python3: ignore CVE-2022-26488
Steve Sakoman (2):
libsolv: fix CVE: CVE-2021-44568-71 and CVE-2021-44573-77
ghostscript: fix CVE-2020-15900 and CVE-2021-45949 for -native
meta/lib/oeqa/selftest/cases/tinfoil.py | 2 +-
.../CVE-2022-23308-fix-regression.patch | 98 ++++++++
meta/recipes-core/libxml/libxml2_2.9.10.bb | 1 +
meta/recipes-devtools/apt/apt.inc | 1 +
.../apt/apt/CVE-2020-3810.patch | 174 +++++++++++++
.../gnu-config/gnu-config_git.bb | 2 +-
.../recipes-devtools/python/python3_3.8.13.bb | 2 +-
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2020-13791.patch | 44 ++++
.../ghostscript/CVE-2021-3781_1.patch | 121 +++++++++
.../ghostscript/CVE-2021-3781_2.patch | 37 +++
.../ghostscript/CVE-2021-3781_3.patch | 238 ++++++++++++++++++
.../ghostscript/ghostscript_9.52.bb | 9 +-
.../libsolv/files/CVE-2021-3200.patch | 10 +
.../virglrenderer/virglrenderer_0.8.2.bb | 2 +-
15 files changed, 735 insertions(+), 7 deletions(-)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2022-23308-fix-regression.patch
create mode 100644 meta/recipes-devtools/apt/apt/CVE-2020-3810.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2020-13791.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_1.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_2.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_3.patch
--
2.25.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][dunfell 00/10] Patch review
@ 2023-06-30 2:33 Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 01/10] libjpeg-turbo: CVE-2020-35538 Null pointer dereference in jcopy_sample_rows() function Steve Sakoman
` (9 more replies)
0 siblings, 10 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-06-30 2:33 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for dunfell and have comments back by
end of day Monday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5542
The following changes since commit 2aa82324d43467e7c8bfbbb59570ee3306264b75:
systemd-systemctl: support instance expansion in WantedBy (2023-06-19 06:23:31 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Ashish Sharma (1):
go: Backport fix CVE-2023-29405
Bruce Ashfield (5):
linux-yocto/5.4: update to v5.4.246
linux-yocto/5.4: update to v5.4.247
linux-yocto/5.4: update to v5.4.248
linux-yocto-rt/54: fix 5.4-rt build breakage
linux-yocto/5.4: cfg: fix DECNET configuration warning
Hitendra Prajapati (1):
go: fix CVE-2023-29402 & CVE-2023-29404
Ross Burton (1):
ninja: Whitelist CVE-2021-4336, wrong ninja
Vijay Anusuri (2):
libjpeg-turbo: CVE-2020-35538 Null pointer dereference in
jcopy_sample_rows() function
libcap: backport Debian patches to fix CVE-2023-2602 and CVE-2023-2603
meta/recipes-devtools/go/go-1.14.inc | 4 +
.../go/go-1.14/CVE-2023-29402.patch | 201 ++++++++
.../go/go-1.14/CVE-2023-29404.patch | 84 ++++
.../go/go-1.14/CVE-2023-29405-1.patch | 112 +++++
.../go/go-1.14/CVE-2023-29405-2.patch | 38 ++
meta/recipes-devtools/ninja/ninja_1.10.0.bb | 3 +
.../jpeg/files/CVE-2020-35538-1.patch | 457 ++++++++++++++++++
.../jpeg/files/CVE-2020-35538-2.patch | 400 +++++++++++++++
.../jpeg/libjpeg-turbo_2.0.4.bb | 2 +
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +-
.../libcap/files/CVE-2023-2602.patch | 52 ++
.../libcap/files/CVE-2023-2603.patch | 58 +++
meta/recipes-support/libcap/libcap_2.32.bb | 2 +
15 files changed, 1431 insertions(+), 18 deletions(-)
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-29402.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-29404.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-29405-1.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-29405-2.patch
create mode 100644 meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch
create mode 100644 meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch
create mode 100644 meta/recipes-support/libcap/files/CVE-2023-2602.patch
create mode 100644 meta/recipes-support/libcap/files/CVE-2023-2603.patch
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][dunfell 01/10] libjpeg-turbo: CVE-2020-35538 Null pointer dereference in jcopy_sample_rows() function
2023-06-30 2:33 [OE-core][dunfell 00/10] Patch review Steve Sakoman
@ 2023-06-30 2:33 ` Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 02/10] ninja: Whitelist CVE-2021-4336, wrong ninja Steve Sakoman
` (8 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-06-30 2:33 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport
[https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9120a247436e84c0b4eea828cb11e8f665fcde30
&
https://github.com/libjpeg-turbo/libjpeg-turbo/commit/a46c111d9f3642f0ef3819e7298846ccc61869e0]
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../jpeg/files/CVE-2020-35538-1.patch | 457 ++++++++++++++++++
.../jpeg/files/CVE-2020-35538-2.patch | 400 +++++++++++++++
.../jpeg/libjpeg-turbo_2.0.4.bb | 2 +
3 files changed, 859 insertions(+)
create mode 100644 meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch
create mode 100644 meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch
diff --git a/meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch b/meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch
new file mode 100644
index 0000000000..8a52ed01e9
--- /dev/null
+++ b/meta/recipes-graphics/jpeg/files/CVE-2020-35538-1.patch
@@ -0,0 +1,457 @@
+From 9120a247436e84c0b4eea828cb11e8f665fcde30 Mon Sep 17 00:00:00 2001
+From: DRC <information@libjpeg-turbo.org>
+Date: Thu, 23 Jul 2020 21:24:38 -0500
+Subject: [PATCH] Fix jpeg_skip_scanlines() segfault w/merged upsamp
+
+The additional segfault mentioned in #244 was due to the fact that
+the merged upsamplers use a different private structure than the
+non-merged upsamplers. jpeg_skip_scanlines() was assuming the latter, so
+when merged upsampling was enabled, jpeg_skip_scanlines() clobbered one
+of the IDCT method pointers in the merged upsampler's private structure.
+
+For reasons unknown, the test image in #441 did not encounter this
+segfault (too small?), but it encountered an issue similar to the one
+fixed in 5bc43c7821df982f65aa1c738f67fbf7cba8bd69, whereby it was
+necessary to set up a dummy postprocessing function in
+read_and_discard_scanlines() when merged upsampling was enabled.
+Failing to do so caused either a segfault in merged_2v_upsample() (due
+to a NULL pointer being passed to jcopy_sample_rows()) or an error
+("Corrupt JPEG data: premature end of data segment"), depending on the
+number of scanlines skipped and whether the first scanline skipped was
+an odd- or even-numbered row.
+
+Fixes #441
+Fixes #244 (for real this time)
+
+Upstream-Status: Backport [https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9120a247436e84c0b4eea828cb11e8f665fcde30]
+CVE: CVE-2020-35538
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ ChangeLog.md | 7 +++++
+ jdapistd.c | 72 ++++++++++++++++++++++++++++++++++++++++++++++------
+ jdmerge.c | 46 +++++++--------------------------
+ jdmerge.h | 47 ++++++++++++++++++++++++++++++++++
+ jdmrg565.c | 10 ++++----
+ jdmrgext.c | 6 ++---
+ 6 files changed, 135 insertions(+), 53 deletions(-)
+ create mode 100644 jdmerge.h
+
+diff --git a/ChangeLog.md b/ChangeLog.md
+index 2ebfe71..19d18fa 100644
+--- a/ChangeLog.md
++++ b/ChangeLog.md
+@@ -54,6 +54,13 @@ a 16-bit binary PGM file into an RGB image buffer.
+ generated when using the `tjLoadImage()` function to load a 16-bit binary PPM
+ file into an extended RGB image buffer.
+
++2. Fixed segfaults or "Corrupt JPEG data: premature end of data segment" errors
++in `jpeg_skip_scanlines()` that occurred when decompressing 4:2:2 or 4:2:0 JPEG
++images using the merged (non-fancy) upsampling algorithms (that is, when
++setting `cinfo.do_fancy_upsampling` to `FALSE`.) 2.0.0[6] was a similar fix,
++but it did not cover all cases.
++
++
+ 2.0.3
+ =====
+
+diff --git a/jdapistd.c b/jdapistd.c
+index 2c808fa..91da642 100644
+--- a/jdapistd.c
++++ b/jdapistd.c
+@@ -4,7 +4,7 @@
+ * This file was part of the Independent JPEG Group's software:
+ * Copyright (C) 1994-1996, Thomas G. Lane.
+ * libjpeg-turbo Modifications:
+- * Copyright (C) 2010, 2015-2018, D. R. Commander.
++ * Copyright (C) 2010, 2015-2018, 2020, D. R. Commander.
+ * Copyright (C) 2015, Google, Inc.
+ * For conditions of distribution and use, see the accompanying README.ijg
+ * file.
+@@ -21,6 +21,8 @@
+ #include "jinclude.h"
+ #include "jdmainct.h"
+ #include "jdcoefct.h"
++#include "jdmaster.h"
++#include "jdmerge.h"
+ #include "jdsample.h"
+ #include "jmemsys.h"
+
+@@ -304,6 +306,16 @@ noop_quantize(j_decompress_ptr cinfo, JSAMPARRAY input_buf,
+ }
+
+
++/* Dummy postprocessing function used by jpeg_skip_scanlines() */
++LOCAL(void)
++noop_post_process (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
++ JDIMENSION *in_row_group_ctr,
++ JDIMENSION in_row_groups_avail, JSAMPARRAY output_buf,
++ JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail)
++{
++}
++
++
+ /*
+ * In some cases, it is best to call jpeg_read_scanlines() and discard the
+ * output, rather than skipping the scanlines, because this allows us to
+@@ -316,11 +328,17 @@ LOCAL(void)
+ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ {
+ JDIMENSION n;
++ my_master_ptr master = (my_master_ptr)cinfo->master;
+ void (*color_convert) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+ JDIMENSION input_row, JSAMPARRAY output_buf,
+ int num_rows) = NULL;
+ void (*color_quantize) (j_decompress_ptr cinfo, JSAMPARRAY input_buf,
+ JSAMPARRAY output_buf, int num_rows) = NULL;
++ void (*post_process_data) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
++ JDIMENSION *in_row_group_ctr,
++ JDIMENSION in_row_groups_avail,
++ JSAMPARRAY output_buf, JDIMENSION *out_row_ctr,
++ JDIMENSION out_rows_avail) = NULL;
+
+ if (cinfo->cconvert && cinfo->cconvert->color_convert) {
+ color_convert = cinfo->cconvert->color_convert;
+@@ -332,6 +350,12 @@ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ cinfo->cquantize->color_quantize = noop_quantize;
+ }
+
++ if (master->using_merged_upsample && cinfo->post &&
++ cinfo->post->post_process_data) {
++ post_process_data = cinfo->post->post_process_data;
++ cinfo->post->post_process_data = noop_post_process;
++ }
++
+ for (n = 0; n < num_lines; n++)
+ jpeg_read_scanlines(cinfo, NULL, 1);
+
+@@ -340,6 +364,9 @@ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+
+ if (color_quantize)
+ cinfo->cquantize->color_quantize = color_quantize;
++
++ if (post_process_data)
++ cinfo->post->post_process_data = post_process_data;
+ }
+
+
+@@ -382,7 +409,7 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ {
+ my_main_ptr main_ptr = (my_main_ptr)cinfo->main;
+ my_coef_ptr coef = (my_coef_ptr)cinfo->coef;
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ my_master_ptr master = (my_master_ptr)cinfo->master;
+ JDIMENSION i, x;
+ int y;
+ JDIMENSION lines_per_iMCU_row, lines_left_in_iMCU_row, lines_after_iMCU_row;
+@@ -445,8 +472,16 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ main_ptr->buffer_full = FALSE;
+ main_ptr->rowgroup_ctr = 0;
+ main_ptr->context_state = CTX_PREPARE_FOR_IMCU;
+- upsample->next_row_out = cinfo->max_v_samp_factor;
+- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
++ if (master->using_merged_upsample) {
++ my_merged_upsample_ptr upsample =
++ (my_merged_upsample_ptr)cinfo->upsample;
++ upsample->spare_full = FALSE;
++ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
++ } else {
++ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ upsample->next_row_out = cinfo->max_v_samp_factor;
++ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
++ }
+ }
+
+ /* Skipping is much simpler when context rows are not required. */
+@@ -458,8 +493,16 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ cinfo->output_scanline += lines_left_in_iMCU_row;
+ main_ptr->buffer_full = FALSE;
+ main_ptr->rowgroup_ctr = 0;
+- upsample->next_row_out = cinfo->max_v_samp_factor;
+- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
++ if (master->using_merged_upsample) {
++ my_merged_upsample_ptr upsample =
++ (my_merged_upsample_ptr)cinfo->upsample;
++ upsample->spare_full = FALSE;
++ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
++ } else {
++ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ upsample->next_row_out = cinfo->max_v_samp_factor;
++ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
++ }
+ }
+ }
+
+@@ -494,7 +537,14 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ cinfo->output_iMCU_row += lines_to_skip / lines_per_iMCU_row;
+ increment_simple_rowgroup_ctr(cinfo, lines_to_read);
+ }
+- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
++ if (master->using_merged_upsample) {
++ my_merged_upsample_ptr upsample =
++ (my_merged_upsample_ptr)cinfo->upsample;
++ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
++ } else {
++ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
++ }
+ return num_lines;
+ }
+
+@@ -535,7 +585,13 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ * bit odd, since "rows_to_go" seems to be redundantly keeping track of
+ * output_scanline.
+ */
+- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
++ if (master->using_merged_upsample) {
++ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
++ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
++ } else {
++ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
++ }
+
+ /* Always skip the requested number of lines. */
+ return num_lines;
+diff --git a/jdmerge.c b/jdmerge.c
+index dff5a35..833ad67 100644
+--- a/jdmerge.c
++++ b/jdmerge.c
+@@ -5,7 +5,7 @@
+ * Copyright (C) 1994-1996, Thomas G. Lane.
+ * libjpeg-turbo Modifications:
+ * Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB
+- * Copyright (C) 2009, 2011, 2014-2015, D. R. Commander.
++ * Copyright (C) 2009, 2011, 2014-2015, 2020, D. R. Commander.
+ * Copyright (C) 2013, Linaro Limited.
+ * For conditions of distribution and use, see the accompanying README.ijg
+ * file.
+@@ -40,41 +40,13 @@
+ #define JPEG_INTERNALS
+ #include "jinclude.h"
+ #include "jpeglib.h"
++#include "jdmerge.h"
+ #include "jsimd.h"
+ #include "jconfigint.h"
+
+ #ifdef UPSAMPLE_MERGING_SUPPORTED
+
+
+-/* Private subobject */
+-
+-typedef struct {
+- struct jpeg_upsampler pub; /* public fields */
+-
+- /* Pointer to routine to do actual upsampling/conversion of one row group */
+- void (*upmethod) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+- JDIMENSION in_row_group_ctr, JSAMPARRAY output_buf);
+-
+- /* Private state for YCC->RGB conversion */
+- int *Cr_r_tab; /* => table for Cr to R conversion */
+- int *Cb_b_tab; /* => table for Cb to B conversion */
+- JLONG *Cr_g_tab; /* => table for Cr to G conversion */
+- JLONG *Cb_g_tab; /* => table for Cb to G conversion */
+-
+- /* For 2:1 vertical sampling, we produce two output rows at a time.
+- * We need a "spare" row buffer to hold the second output row if the
+- * application provides just a one-row buffer; we also use the spare
+- * to discard the dummy last row if the image height is odd.
+- */
+- JSAMPROW spare_row;
+- boolean spare_full; /* T if spare buffer is occupied */
+-
+- JDIMENSION out_row_width; /* samples per output row */
+- JDIMENSION rows_to_go; /* counts rows remaining in image */
+-} my_upsampler;
+-
+-typedef my_upsampler *my_upsample_ptr;
+-
+ #define SCALEBITS 16 /* speediest right-shift on some machines */
+ #define ONE_HALF ((JLONG)1 << (SCALEBITS - 1))
+ #define FIX(x) ((JLONG)((x) * (1L << SCALEBITS) + 0.5))
+@@ -189,7 +161,7 @@ typedef my_upsampler *my_upsample_ptr;
+ LOCAL(void)
+ build_ycc_rgb_table(j_decompress_ptr cinfo)
+ {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
+ int i;
+ JLONG x;
+ SHIFT_TEMPS
+@@ -232,7 +204,7 @@ build_ycc_rgb_table(j_decompress_ptr cinfo)
+ METHODDEF(void)
+ start_pass_merged_upsample(j_decompress_ptr cinfo)
+ {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
+
+ /* Mark the spare buffer empty */
+ upsample->spare_full = FALSE;
+@@ -254,7 +226,7 @@ merged_2v_upsample(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+ JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail)
+ /* 2:1 vertical sampling case: may need a spare row. */
+ {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
+ JSAMPROW work_ptrs[2];
+ JDIMENSION num_rows; /* number of rows returned to caller */
+
+@@ -305,7 +277,7 @@ merged_1v_upsample(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+ JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail)
+ /* 1:1 vertical sampling case: much easier, never need a spare row. */
+ {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
+
+ /* Just do the upsampling. */
+ (*upsample->upmethod) (cinfo, input_buf, *in_row_group_ctr,
+@@ -566,11 +538,11 @@ h2v2_merged_upsample_565D(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+ GLOBAL(void)
+ jinit_merged_upsampler(j_decompress_ptr cinfo)
+ {
+- my_upsample_ptr upsample;
++ my_merged_upsample_ptr upsample;
+
+- upsample = (my_upsample_ptr)
++ upsample = (my_merged_upsample_ptr)
+ (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
+- sizeof(my_upsampler));
++ sizeof(my_merged_upsampler));
+ cinfo->upsample = (struct jpeg_upsampler *)upsample;
+ upsample->pub.start_pass = start_pass_merged_upsample;
+ upsample->pub.need_context_rows = FALSE;
+diff --git a/jdmerge.h b/jdmerge.h
+new file mode 100644
+index 0000000..b583396
+--- /dev/null
++++ b/jdmerge.h
+@@ -0,0 +1,47 @@
++/*
++ * jdmerge.h
++ *
++ * This file was part of the Independent JPEG Group's software:
++ * Copyright (C) 1994-1996, Thomas G. Lane.
++ * libjpeg-turbo Modifications:
++ * Copyright (C) 2020, D. R. Commander.
++ * For conditions of distribution and use, see the accompanying README.ijg
++ * file.
++ */
++
++#define JPEG_INTERNALS
++#include "jpeglib.h"
++
++#ifdef UPSAMPLE_MERGING_SUPPORTED
++
++
++/* Private subobject */
++
++typedef struct {
++ struct jpeg_upsampler pub; /* public fields */
++
++ /* Pointer to routine to do actual upsampling/conversion of one row group */
++ void (*upmethod) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
++ JDIMENSION in_row_group_ctr, JSAMPARRAY output_buf);
++
++ /* Private state for YCC->RGB conversion */
++ int *Cr_r_tab; /* => table for Cr to R conversion */
++ int *Cb_b_tab; /* => table for Cb to B conversion */
++ JLONG *Cr_g_tab; /* => table for Cr to G conversion */
++ JLONG *Cb_g_tab; /* => table for Cb to G conversion */
++
++ /* For 2:1 vertical sampling, we produce two output rows at a time.
++ * We need a "spare" row buffer to hold the second output row if the
++ * application provides just a one-row buffer; we also use the spare
++ * to discard the dummy last row if the image height is odd.
++ */
++ JSAMPROW spare_row;
++ boolean spare_full; /* T if spare buffer is occupied */
++
++ JDIMENSION out_row_width; /* samples per output row */
++ JDIMENSION rows_to_go; /* counts rows remaining in image */
++} my_merged_upsampler;
++
++typedef my_merged_upsampler *my_merged_upsample_ptr;
++
++#endif /* UPSAMPLE_MERGING_SUPPORTED */
+diff --git a/jdmrg565.c b/jdmrg565.c
+index 1b87e37..53f1e16 100644
+--- a/jdmrg565.c
++++ b/jdmrg565.c
+@@ -5,7 +5,7 @@
+ * Copyright (C) 1994-1996, Thomas G. Lane.
+ * libjpeg-turbo Modifications:
+ * Copyright (C) 2013, Linaro Limited.
+- * Copyright (C) 2014-2015, 2018, D. R. Commander.
++ * Copyright (C) 2014-2015, 2018, 2020, D. R. Commander.
+ * For conditions of distribution and use, see the accompanying README.ijg
+ * file.
+ *
+@@ -19,7 +19,7 @@ h2v1_merged_upsample_565_internal(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+ JDIMENSION in_row_group_ctr,
+ JSAMPARRAY output_buf)
+ {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
+ register int y, cred, cgreen, cblue;
+ int cb, cr;
+ register JSAMPROW outptr;
+@@ -90,7 +90,7 @@ h2v1_merged_upsample_565D_internal(j_decompress_ptr cinfo,
+ JDIMENSION in_row_group_ctr,
+ JSAMPARRAY output_buf)
+ {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
+ register int y, cred, cgreen, cblue;
+ int cb, cr;
+ register JSAMPROW outptr;
+@@ -163,7 +163,7 @@ h2v2_merged_upsample_565_internal(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+ JDIMENSION in_row_group_ctr,
+ JSAMPARRAY output_buf)
+ {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
+ register int y, cred, cgreen, cblue;
+ int cb, cr;
+ register JSAMPROW outptr0, outptr1;
+@@ -259,7 +259,7 @@ h2v2_merged_upsample_565D_internal(j_decompress_ptr cinfo,
+ JDIMENSION in_row_group_ctr,
+ JSAMPARRAY output_buf)
+ {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
+ register int y, cred, cgreen, cblue;
+ int cb, cr;
+ register JSAMPROW outptr0, outptr1;
+diff --git a/jdmrgext.c b/jdmrgext.c
+index b1c27df..c9a44d8 100644
+--- a/jdmrgext.c
++++ b/jdmrgext.c
+@@ -4,7 +4,7 @@
+ * This file was part of the Independent JPEG Group's software:
+ * Copyright (C) 1994-1996, Thomas G. Lane.
+ * libjpeg-turbo Modifications:
+- * Copyright (C) 2011, 2015, D. R. Commander.
++ * Copyright (C) 2011, 2015, 2020, D. R. Commander.
+ * For conditions of distribution and use, see the accompanying README.ijg
+ * file.
+ *
+@@ -25,7 +25,7 @@ h2v1_merged_upsample_internal(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+ JDIMENSION in_row_group_ctr,
+ JSAMPARRAY output_buf)
+ {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
+ register int y, cred, cgreen, cblue;
+ int cb, cr;
+ register JSAMPROW outptr;
+@@ -97,7 +97,7 @@ h2v2_merged_upsample_internal(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+ JDIMENSION in_row_group_ctr,
+ JSAMPARRAY output_buf)
+ {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
+ register int y, cred, cgreen, cblue;
+ int cb, cr;
+ register JSAMPROW outptr0, outptr1;
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch b/meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch
new file mode 100644
index 0000000000..f86175dff0
--- /dev/null
+++ b/meta/recipes-graphics/jpeg/files/CVE-2020-35538-2.patch
@@ -0,0 +1,400 @@
+From a46c111d9f3642f0ef3819e7298846ccc61869e0 Mon Sep 17 00:00:00 2001
+From: DRC <information@libjpeg-turbo.org>
+Date: Mon, 27 Jul 2020 14:21:23 -0500
+Subject: [PATCH] Further jpeg_skip_scanlines() fixes
+
+- Introduce a partial image decompression regression test script that
+ validates the correctness of jpeg_skip_scanlines() and
+ jpeg_crop_scanlines() for a variety of cropping regions and libjpeg
+ settings.
+
+ This regression test catches the following issues:
+ #182, fixed in 5bc43c7
+ #237, fixed in 6e95c08
+ #244, fixed in 398c1e9
+ #441, fully fixed in this commit
+
+ It does not catch the following issues:
+ #194, fixed in 773040f
+ #244 (additional segfault), fixed in
+ 9120a24
+
+- Modify the libjpeg-turbo regression test suite (make test) so that it
+ checks for the issue reported in #441 (segfault in
+ jpeg_skip_scanlines() when used with 4:2:0 merged upsampling/color
+ conversion.)
+
+- Fix issues in jpeg_skip_scanlines() that caused incorrect output with
+ h2v2 (4:2:0) merged upsampling/color conversion. The previous commit
+ fixed the segfault reported in #441, but that was a symptom of a
+ larger problem. Because merged 4:2:0 upsampling uses a "spare row"
+ buffer, it is necessary to allow the upsampler to run when skipping
+ rows (fancy 4:2:0 upsampling, which uses context rows, also requires
+ this.) Otherwise, if skipping starts at an odd-numbered row, the
+ output image will be incorrect.
+
+- Throw an error if jpeg_skip_scanlines() is called with two-pass color
+ quantization enabled. With two-pass color quantization, the first
+ pass occurs within jpeg_start_decompress(), so subsequent calls to
+ jpeg_skip_scanlines() interfere with the multipass state and prevent
+ the second pass from occurring during subsequent calls to
+ jpeg_read_scanlines().
+
+Upstream-Status: Backport [https://github.com/libjpeg-turbo/libjpeg-turbo/commit/a46c111d9f3642f0ef3819e7298846ccc61869e0]
+CVE: CVE-2020-35538
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ CMakeLists.txt | 9 +++--
+ ChangeLog.md | 15 +++++---
+ croptest.in | 95 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ jdapistd.c | 70 +++++++++++--------------------------
+ libjpeg.txt | 6 ++--
+ 5 files changed, 136 insertions(+), 59 deletions(-)
+ create mode 100755 croptest.in
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index aee74c9..de451f4 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -753,7 +753,7 @@ else()
+ set(MD5_PPM_3x2_IFAST fd283664b3b49127984af0a7f118fccd)
+ set(MD5_JPEG_420_ISLOW_ARI e986fb0a637a8d833d96e8a6d6d84ea1)
+ set(MD5_JPEG_444_ISLOW_PROGARI 0a8f1c8f66e113c3cf635df0a475a617)
+- set(MD5_PPM_420M_IFAST_ARI 72b59a99bcf1de24c5b27d151bde2437)
++ set(MD5_PPM_420M_IFAST_ARI 57251da28a35b46eecb7177d82d10e0e)
+ set(MD5_JPEG_420_ISLOW 9a68f56bc76e466aa7e52f415d0f4a5f)
+ set(MD5_PPM_420M_ISLOW_2_1 9f9de8c0612f8d06869b960b05abf9c9)
+ set(MD5_PPM_420M_ISLOW_15_8 b6875bc070720b899566cc06459b63b7)
+@@ -1131,7 +1131,7 @@ foreach(libtype ${TEST_LIBTYPES})
+
+ if(WITH_ARITH_DEC)
+ # CC: RGB->YCC SAMP: h2v2 merged IDCT: ifast ENT: arith
+- add_bittest(djpeg 420m-ifast-ari "-fast;-ppm"
++ add_bittest(djpeg 420m-ifast-ari "-fast;-skip;1,20;-ppm"
+ testout_420m_ifast_ari.ppm ${TESTIMAGES}/testimgari.jpg
+ ${MD5_PPM_420M_IFAST_ARI})
+
+@@ -1266,6 +1266,11 @@ endforeach()
+ add_custom_target(testclean COMMAND ${CMAKE_COMMAND} -P
+ ${CMAKE_CURRENT_SOURCE_DIR}/cmakescripts/testclean.cmake)
+
++configure_file(croptest.in croptest @ONLY)
++add_custom_target(croptest
++ COMMAND echo croptest
++ COMMAND ${BASH} ${CMAKE_CURRENT_BINARY_DIR}/croptest)
++
+ if(WITH_TURBOJPEG)
+ configure_file(tjbenchtest.in tjbenchtest @ONLY)
+ configure_file(tjexampletest.in tjexampletest @ONLY)
+diff --git a/ChangeLog.md b/ChangeLog.md
+index 19d18fa..4562eff 100644
+--- a/ChangeLog.md
++++ b/ChangeLog.md
+@@ -54,11 +54,16 @@ a 16-bit binary PGM file into an RGB image buffer.
+ generated when using the `tjLoadImage()` function to load a 16-bit binary PPM
+ file into an extended RGB image buffer.
+
+-2. Fixed segfaults or "Corrupt JPEG data: premature end of data segment" errors
+-in `jpeg_skip_scanlines()` that occurred when decompressing 4:2:2 or 4:2:0 JPEG
+-images using the merged (non-fancy) upsampling algorithms (that is, when
+-setting `cinfo.do_fancy_upsampling` to `FALSE`.) 2.0.0[6] was a similar fix,
+-but it did not cover all cases.
++2. Fixed or worked around multiple issues with `jpeg_skip_scanlines()`:
++
++ - Fixed segfaults or "Corrupt JPEG data: premature end of data segment"
++errors in `jpeg_skip_scanlines()` that occurred when decompressing 4:2:2 or
++4:2:0 JPEG images using merged (non-fancy) upsampling/color conversion (that
++is, when setting `cinfo.do_fancy_upsampling` to `FALSE`.) 2.0.0[6] was a
++similar fix, but it did not cover all cases.
++ - `jpeg_skip_scanlines()` now throws an error if two-pass color
++quantization is enabled. Two-pass color quantization never worked properly
++with `jpeg_skip_scanlines()`, and the issues could not readily be fixed.
+
+
+ 2.0.3
+diff --git a/croptest.in b/croptest.in
+new file mode 100755
+index 0000000..7e3c293
+--- /dev/null
++++ b/croptest.in
+@@ -0,0 +1,95 @@
++#!/bin/bash
++
++set -u
++set -e
++trap onexit INT
++trap onexit TERM
++trap onexit EXIT
++
++onexit()
++{
++ if [ -d $OUTDIR ]; then
++ rm -rf $OUTDIR
++ fi
++}
++
++runme()
++{
++ echo \*\*\* $*
++ $*
++}
++
++IMAGE=vgl_6548_0026a.bmp
++WIDTH=128
++HEIGHT=95
++IMGDIR=@CMAKE_CURRENT_SOURCE_DIR@/testimages
++OUTDIR=`mktemp -d /tmp/__croptest_output.XXXXXX`
++EXEDIR=@CMAKE_CURRENT_BINARY_DIR@
++
++if [ -d $OUTDIR ]; then
++ rm -rf $OUTDIR
++fi
++mkdir -p $OUTDIR
++
++exec >$EXEDIR/croptest.log
++
++echo "============================================================"
++echo "$IMAGE ($WIDTH x $HEIGHT)"
++echo "============================================================"
++echo
++
++for PROGARG in "" -progressive; do
++
++ cp $IMGDIR/$IMAGE $OUTDIR
++ basename=`basename $IMAGE .bmp`
++ echo "------------------------------------------------------------"
++ echo "Generating test images"
++ echo "------------------------------------------------------------"
++ echo
++ runme $EXEDIR/cjpeg $PROGARG -grayscale -outfile $OUTDIR/${basename}_GRAY.jpg $IMGDIR/${basename}.bmp
++ runme $EXEDIR/cjpeg $PROGARG -sample 2x2 -outfile $OUTDIR/${basename}_420.jpg $IMGDIR/${basename}.bmp
++ runme $EXEDIR/cjpeg $PROGARG -sample 2x1 -outfile $OUTDIR/${basename}_422.jpg $IMGDIR/${basename}.bmp
++ runme $EXEDIR/cjpeg $PROGARG -sample 1x2 -outfile $OUTDIR/${basename}_440.jpg $IMGDIR/${basename}.bmp
++ runme $EXEDIR/cjpeg $PROGARG -sample 1x1 -outfile $OUTDIR/${basename}_444.jpg $IMGDIR/${basename}.bmp
++ echo
++
++ for NSARG in "" -nosmooth; do
++
++ for COLORSARG in "" "-colors 256 -dither none -onepass"; do
++
++ for Y in {0..16}; do
++
++ for H in {1..16}; do
++
++ X=$(( (Y*16)%128 ))
++ W=$(( WIDTH-X-7 ))
++ if [ $Y -le 15 ]; then
++ CROPSPEC="${W}x${H}+${X}+${Y}"
++ else
++ Y2=$(( HEIGHT-H ));
++ CROPSPEC="${W}x${H}+${X}+${Y2}"
++ fi
++
++ echo "------------------------------------------------------------"
++ echo $PROGARG $NSARG $COLORSARG -crop $CROPSPEC
++ echo "------------------------------------------------------------"
++ echo
++ for samp in GRAY 420 422 440 444; do
++ $EXEDIR/djpeg $NSARG $COLORSARG -rgb -outfile $OUTDIR/${basename}_${samp}_full.ppm $OUTDIR/${basename}_${samp}.jpg
++ convert -crop $CROPSPEC $OUTDIR/${basename}_${samp}_full.ppm $OUTDIR/${basename}_${samp}_ref.ppm
++ runme $EXEDIR/djpeg $NSARG $COLORSARG -crop $CROPSPEC -rgb -outfile $OUTDIR/${basename}_${samp}.ppm $OUTDIR/${basename}_${samp}.jpg
++ runme cmp $OUTDIR/${basename}_${samp}.ppm $OUTDIR/${basename}_${samp}_ref.ppm
++ done
++ echo
++
++ done
++
++ done
++
++ done
++
++ done
++
++done
++
++echo SUCCESS!
+diff --git a/jdapistd.c b/jdapistd.c
+index 91da642..c502909 100644
+--- a/jdapistd.c
++++ b/jdapistd.c
+@@ -306,16 +306,6 @@ noop_quantize(j_decompress_ptr cinfo, JSAMPARRAY input_buf,
+ }
+
+
+-/* Dummy postprocessing function used by jpeg_skip_scanlines() */
+-LOCAL(void)
+-noop_post_process (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+- JDIMENSION *in_row_group_ctr,
+- JDIMENSION in_row_groups_avail, JSAMPARRAY output_buf,
+- JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail)
+-{
+-}
+-
+-
+ /*
+ * In some cases, it is best to call jpeg_read_scanlines() and discard the
+ * output, rather than skipping the scanlines, because this allows us to
+@@ -329,16 +319,12 @@ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ {
+ JDIMENSION n;
+ my_master_ptr master = (my_master_ptr)cinfo->master;
++ JSAMPARRAY scanlines = NULL;
+ void (*color_convert) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+ JDIMENSION input_row, JSAMPARRAY output_buf,
+ int num_rows) = NULL;
+ void (*color_quantize) (j_decompress_ptr cinfo, JSAMPARRAY input_buf,
+ JSAMPARRAY output_buf, int num_rows) = NULL;
+- void (*post_process_data) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+- JDIMENSION *in_row_group_ctr,
+- JDIMENSION in_row_groups_avail,
+- JSAMPARRAY output_buf, JDIMENSION *out_row_ctr,
+- JDIMENSION out_rows_avail) = NULL;
+
+ if (cinfo->cconvert && cinfo->cconvert->color_convert) {
+ color_convert = cinfo->cconvert->color_convert;
+@@ -350,23 +336,19 @@ read_and_discard_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ cinfo->cquantize->color_quantize = noop_quantize;
+ }
+
+- if (master->using_merged_upsample && cinfo->post &&
+- cinfo->post->post_process_data) {
+- post_process_data = cinfo->post->post_process_data;
+- cinfo->post->post_process_data = noop_post_process;
++ if (master->using_merged_upsample && cinfo->max_v_samp_factor == 2) {
++ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
++ scanlines = &upsample->spare_row;
+ }
+
+ for (n = 0; n < num_lines; n++)
+- jpeg_read_scanlines(cinfo, NULL, 1);
++ jpeg_read_scanlines(cinfo, scanlines, 1);
+
+ if (color_convert)
+ cinfo->cconvert->color_convert = color_convert;
+
+ if (color_quantize)
+ cinfo->cquantize->color_quantize = color_quantize;
+-
+- if (post_process_data)
+- cinfo->post->post_process_data = post_process_data;
+ }
+
+
+@@ -380,6 +362,12 @@ increment_simple_rowgroup_ctr(j_decompress_ptr cinfo, JDIMENSION rows)
+ {
+ JDIMENSION rows_left;
+ my_main_ptr main_ptr = (my_main_ptr)cinfo->main;
++ my_master_ptr master = (my_master_ptr)cinfo->master;
++
++ if (master->using_merged_upsample && cinfo->max_v_samp_factor == 2) {
++ read_and_discard_scanlines(cinfo, rows);
++ return;
++ }
+
+ /* Increment the counter to the next row group after the skipped rows. */
+ main_ptr->rowgroup_ctr += rows / cinfo->max_v_samp_factor;
+@@ -410,11 +398,16 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ my_main_ptr main_ptr = (my_main_ptr)cinfo->main;
+ my_coef_ptr coef = (my_coef_ptr)cinfo->coef;
+ my_master_ptr master = (my_master_ptr)cinfo->master;
++ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
+ JDIMENSION i, x;
+ int y;
+ JDIMENSION lines_per_iMCU_row, lines_left_in_iMCU_row, lines_after_iMCU_row;
+ JDIMENSION lines_to_skip, lines_to_read;
+
++ /* Two-pass color quantization is not supported. */
++ if (cinfo->quantize_colors && cinfo->two_pass_quantize)
++ ERREXIT(cinfo, JERR_NOTIMPL);
++
+ if (cinfo->global_state != DSTATE_SCANNING)
+ ERREXIT1(cinfo, JERR_BAD_STATE, cinfo->global_state);
+
+@@ -472,13 +465,7 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ main_ptr->buffer_full = FALSE;
+ main_ptr->rowgroup_ctr = 0;
+ main_ptr->context_state = CTX_PREPARE_FOR_IMCU;
+- if (master->using_merged_upsample) {
+- my_merged_upsample_ptr upsample =
+- (my_merged_upsample_ptr)cinfo->upsample;
+- upsample->spare_full = FALSE;
+- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+- } else {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ if (!master->using_merged_upsample) {
+ upsample->next_row_out = cinfo->max_v_samp_factor;
+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ }
+@@ -493,13 +480,7 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ cinfo->output_scanline += lines_left_in_iMCU_row;
+ main_ptr->buffer_full = FALSE;
+ main_ptr->rowgroup_ctr = 0;
+- if (master->using_merged_upsample) {
+- my_merged_upsample_ptr upsample =
+- (my_merged_upsample_ptr)cinfo->upsample;
+- upsample->spare_full = FALSE;
+- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+- } else {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ if (!master->using_merged_upsample) {
+ upsample->next_row_out = cinfo->max_v_samp_factor;
+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ }
+@@ -537,14 +518,8 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ cinfo->output_iMCU_row += lines_to_skip / lines_per_iMCU_row;
+ increment_simple_rowgroup_ctr(cinfo, lines_to_read);
+ }
+- if (master->using_merged_upsample) {
+- my_merged_upsample_ptr upsample =
+- (my_merged_upsample_ptr)cinfo->upsample;
+- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+- } else {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
++ if (!master->using_merged_upsample)
+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+- }
+ return num_lines;
+ }
+
+@@ -585,13 +560,8 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
+ * bit odd, since "rows_to_go" seems to be redundantly keeping track of
+ * output_scanline.
+ */
+- if (master->using_merged_upsample) {
+- my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
++ if (!master->using_merged_upsample)
+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+- } else {
+- my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
+- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+- }
+
+ /* Always skip the requested number of lines. */
+ return num_lines;
+diff --git a/libjpeg.txt b/libjpeg.txt
+index c50cf90..c233ecb 100644
+--- a/libjpeg.txt
++++ b/libjpeg.txt
+@@ -3,7 +3,7 @@ USING THE IJG JPEG LIBRARY
+ This file was part of the Independent JPEG Group's software:
+ Copyright (C) 1994-2013, Thomas G. Lane, Guido Vollbeding.
+ libjpeg-turbo Modifications:
+-Copyright (C) 2010, 2014-2018, D. R. Commander.
++Copyright (C) 2010, 2014-2018, 2020, D. R. Commander.
+ Copyright (C) 2015, Google, Inc.
+ For conditions of distribution and use, see the accompanying README.ijg file.
+
+@@ -750,7 +750,9 @@ multiple rows in the JPEG image.
+
+ Suspending data sources are not supported by this function. Calling
+ jpeg_skip_scanlines() with a suspending data source will result in undefined
+-behavior.
++behavior. Two-pass color quantization is also not supported by this function.
++Calling jpeg_skip_scanlines() with two-pass color quantization enabled will
++result in an error.
+
+ jpeg_skip_scanlines() will not allow skipping past the bottom of the image. If
+ the value of num_lines is large enough to skip past the bottom of the image,
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb b/meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb
index 6575582b0c..630b20300f 100644
--- a/meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb
+++ b/meta/recipes-graphics/jpeg/libjpeg-turbo_2.0.4.bb
@@ -14,6 +14,8 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BPN}-${PV}.tar.gz \
file://0001-libjpeg-turbo-fix-package_qa-error.patch \
file://CVE-2020-13790.patch \
file://CVE-2021-46822.patch \
+ file://CVE-2020-35538-1.patch \
+ file://CVE-2020-35538-2.patch \
"
SRC_URI[md5sum] = "d01d9e0c28c27bc0de9f4e2e8ff49855"
--
2.34.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][dunfell 02/10] ninja: Whitelist CVE-2021-4336, wrong ninja
2023-06-30 2:33 [OE-core][dunfell 00/10] Patch review Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 01/10] libjpeg-turbo: CVE-2020-35538 Null pointer dereference in jcopy_sample_rows() function Steve Sakoman
@ 2023-06-30 2:33 ` Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 03/10] go: Backport fix CVE-2023-29405 Steve Sakoman
` (7 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-06-30 2:33 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
(From OE-Core rev: c2dd2c13ff26c3f046e35a2f6b8afeb099ef422a)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9a106486ad7900924a87c5869702903204a35b54)
Signed-off-by: virendra thakur <virendrak@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/ninja/ninja_1.10.0.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-devtools/ninja/ninja_1.10.0.bb b/meta/recipes-devtools/ninja/ninja_1.10.0.bb
index ae3f3f1ea8..755b73a173 100644
--- a/meta/recipes-devtools/ninja/ninja_1.10.0.bb
+++ b/meta/recipes-devtools/ninja/ninja_1.10.0.bb
@@ -29,3 +29,6 @@ do_install() {
}
BBCLASSEXTEND = "native nativesdk"
+
+# This is a different Ninja
+CVE_CHECK_WHITELIST += "CVE-2021-4336"
--
2.34.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][dunfell 03/10] go: Backport fix CVE-2023-29405
2023-06-30 2:33 [OE-core][dunfell 00/10] Patch review Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 01/10] libjpeg-turbo: CVE-2020-35538 Null pointer dereference in jcopy_sample_rows() function Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 02/10] ninja: Whitelist CVE-2021-4336, wrong ninja Steve Sakoman
@ 2023-06-30 2:33 ` Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 04/10] go: fix CVE-2023-29402 & CVE-2023-29404 Steve Sakoman
` (6 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-06-30 2:33 UTC (permalink / raw)
To: openembedded-core
From: Ashish Sharma <asharma@mvista.com>
Upstream-Status: Backport
[https://github.com/golang/go/commit/fa60c381ed06c12f9c27a7b50ca44c5f84f7f0f4
&
https://github.com/golang/go/commit/1008486a9ff979dbd21c7466eeb6abf378f9c637]
Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/go/go-1.14.inc | 2 +
.../go/go-1.14/CVE-2023-29405-1.patch | 112 ++++++++++++++++++
.../go/go-1.14/CVE-2023-29405-2.patch | 38 ++++++
3 files changed, 152 insertions(+)
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-29405-1.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-29405-2.patch
diff --git a/meta/recipes-devtools/go/go-1.14.inc b/meta/recipes-devtools/go/go-1.14.inc
index 2c500e8331..ed505c01b3 100644
--- a/meta/recipes-devtools/go/go-1.14.inc
+++ b/meta/recipes-devtools/go/go-1.14.inc
@@ -63,6 +63,8 @@ SRC_URI += "\
file://CVE-2023-24538-3.patch \
file://CVE-2023-24539.patch \
file://CVE-2023-24540.patch \
+ file://CVE-2023-29405-1.patch \
+ file://CVE-2023-29405-2.patch \
"
SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch"
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2023-29405-1.patch b/meta/recipes-devtools/go/go-1.14/CVE-2023-29405-1.patch
new file mode 100644
index 0000000000..70d50cc08a
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.14/CVE-2023-29405-1.patch
@@ -0,0 +1,112 @@
+From fa60c381ed06c12f9c27a7b50ca44c5f84f7f0f4 Mon Sep 17 00:00:00 2001
+From: Ian Lance Taylor <iant@golang.org>
+Date: Thu, 4 May 2023 14:06:39 -0700
+Subject: [PATCH] [release-branch.go1.20] cmd/go,cmd/cgo: in _cgo_flags use one
+ line per flag
+
+The flags that we recorded in _cgo_flags did not use any quoting,
+so a flag containing embedded spaces was mishandled.
+Change the _cgo_flags format to put each flag on a separate line.
+That is a simple format that does not require any quoting.
+
+As far as I can tell only cmd/go uses _cgo_flags, and it is only
+used for gccgo. If this patch doesn't cause any trouble, then
+in the next release we can change to only using _cgo_flags for gccgo.
+
+Thanks to Juho Nurminen of Mattermost for reporting this issue.
+
+Updates #60306
+Fixes #60514
+Fixes CVE-2023-29405
+
+Change-Id: I36b6e188a44c80d7b9573efa577c386770bd2ba3
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1875094
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-by: Roland Shoemaker <bracewell@google.com>
+(cherry picked from commit bcdfcadd5612212089d958bc352a6f6c90742dcc)
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1902228
+Run-TryBot: Roland Shoemaker <bracewell@google.com>
+TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com>
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1904345
+Reviewed-by: Michael Knyszek <mknyszek@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/501220
+TryBot-Result: Gopher Robot <gobot@golang.org>
+Run-TryBot: David Chase <drchase@google.com>
+Auto-Submit: Michael Knyszek <mknyszek@google.com>
+---
+Upstream-Status: Backport [https://github.com/golang/go/commit/fa60c381ed06c12f9c27a7b50ca44c5f84f7f0f4]
+CVE: CVE-2023-29405
+Signed-off-by: Ashish Sharma <asharma@mvista.com>
+
+ src/cmd/cgo/out.go | 4 +++-
+ src/cmd/go/internal/work/gccgo.go | 14 ++++++-------
+ .../go/testdata/script/gccgo_link_ldflags.txt | 20 +++++++++++++++++++
+ 3 files changed, 29 insertions(+), 9 deletions(-)
+ create mode 100644 src/cmd/go/testdata/script/gccgo_link_ldflags.txt
+
+diff --git a/src/cmd/cgo/out.go b/src/cmd/cgo/out.go
+index d26f9e76a374a..d0c6fe3d4c2c2 100644
+--- a/src/cmd/cgo/out.go
++++ b/src/cmd/cgo/out.go
+@@ -47,7 +47,9 @@ func (p *Package) writeDefs() {
+
+ fflg := creat(*objDir + "_cgo_flags")
+ for k, v := range p.CgoFlags {
+- fmt.Fprintf(fflg, "_CGO_%s=%s\n", k, strings.Join(v, " "))
++ for _, arg := range v {
++ fmt.Fprintf(fflg, "_CGO_%s=%s\n", arg)
++ }
+ if k == "LDFLAGS" && !*gccgo {
+ for _, arg := range v {
+ fmt.Fprintf(fgo2, "//go:cgo_ldflag %q\n", arg)
+diff --git a/src/cmd/go/internal/work/gccgo.go b/src/cmd/go/internal/work/gccgo.go
+index 08a4c2d8166c7..a048b7f4eecef 100644
+--- a/src/cmd/go/internal/work/gccgo.go
++++ b/src/cmd/go/internal/work/gccgo.go
+@@ -280,14 +280,12 @@ func (tools gccgoToolchain) link(b *Builder, root *Action, out, importcfg string
+ const ldflagsPrefix = "_CGO_LDFLAGS="
+ for _, line := range strings.Split(string(flags), "\n") {
+ if strings.HasPrefix(line, ldflagsPrefix) {
+- newFlags := strings.Fields(line[len(ldflagsPrefix):])
+- for _, flag := range newFlags {
+- // Every _cgo_flags file has -g and -O2 in _CGO_LDFLAGS
+- // but they don't mean anything to the linker so filter
+- // them out.
+- if flag != "-g" && !strings.HasPrefix(flag, "-O") {
+- cgoldflags = append(cgoldflags, flag)
+- }
++ flag := line[len(ldflagsPrefix):]
++ // Every _cgo_flags file has -g and -O2 in _CGO_LDFLAGS
++ // but they don't mean anything to the linker so filter
++ // them out.
++ if flag != "-g" && !strings.HasPrefix(flag, "-O") {
++ cgoldflags = append(cgoldflags, flag)
+ }
+ }
+ }
+diff --git a/src/cmd/go/testdata/script/gccgo_link_ldflags.txt b/src/cmd/go/testdata/script/gccgo_link_ldflags.txt
+new file mode 100644
+index 0000000000000..4e91ae56505b6
+--- /dev/null
++++ b/src/cmd/go/testdata/script/gccgo_link_ldflags.txt
+@@ -0,0 +1,20 @@
++# Test that #cgo LDFLAGS are properly quoted.
++# The #cgo LDFLAGS below should pass a string with spaces to -L,
++# as though searching a directory with a space in its name.
++# It should not pass --nosuchoption to the external linker.
++
++[!cgo] skip
++
++go build
++
++[!exec:gccgo] skip
++
++go build -compiler gccgo
++
++-- go.mod --
++module m
++-- cgo.go --
++package main
++// #cgo LDFLAGS: -L "./ -Wl,--nosuchoption"
++import "C"
++func main() {}
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2023-29405-2.patch b/meta/recipes-devtools/go/go-1.14/CVE-2023-29405-2.patch
new file mode 100644
index 0000000000..369eca581e
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.14/CVE-2023-29405-2.patch
@@ -0,0 +1,38 @@
+From 1008486a9ff979dbd21c7466eeb6abf378f9c637 Mon Sep 17 00:00:00 2001
+From: Ian Lance Taylor <iant@golang.org>
+Date: Tue, 6 Jun 2023 12:51:17 -0700
+Subject: [PATCH] [release-branch.go1.20] cmd/cgo: correct _cgo_flags output
+
+For #60306
+For #60514
+
+Change-Id: I3f5d14aee7d7195030e8872e42b1d97aa11d3582
+Reviewed-on: https://go-review.googlesource.com/c/go/+/501298
+Run-TryBot: Ian Lance Taylor <iant@golang.org>
+TryBot-Result: Gopher Robot <gobot@golang.org>
+Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
+Reviewed-by: David Chase <drchase@google.com>
+Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
+---
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/1008486a9ff979dbd21c7466eeb6abf378f9c637]
+CVE: CVE-2023-29405
+Signed-off-by: Ashish Sharma <asharma@mvista.com>
+
+
+ src/cmd/cgo/out.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/cmd/cgo/out.go b/src/cmd/cgo/out.go
+index d0c6fe3d4c2c2..a48f52105628a 100644
+--- a/src/cmd/cgo/out.go
++++ b/src/cmd/cgo/out.go
+@@ -48,7 +48,7 @@ func (p *Package) writeDefs() {
+ fflg := creat(*objDir + "_cgo_flags")
+ for k, v := range p.CgoFlags {
+ for _, arg := range v {
+- fmt.Fprintf(fflg, "_CGO_%s=%s\n", arg)
++ fmt.Fprintf(fflg, "_CGO_%s=%s\n", k, arg)
+ }
+ if k == "LDFLAGS" && !*gccgo {
+ for _, arg := range v {
--
2.34.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][dunfell 04/10] go: fix CVE-2023-29402 & CVE-2023-29404
2023-06-30 2:33 [OE-core][dunfell 00/10] Patch review Steve Sakoman
` (2 preceding siblings ...)
2023-06-30 2:33 ` [OE-core][dunfell 03/10] go: Backport fix CVE-2023-29405 Steve Sakoman
@ 2023-06-30 2:33 ` Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 05/10] libcap: backport Debian patches to fix CVE-2023-2602 and CVE-2023-2603 Steve Sakoman
` (5 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-06-30 2:33 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
Backport fixes for:
* CVE-2023-29402 - Upstream-Status: Backport from https://github.com/golang/go/commit/c160b49b6d328c86bd76ca2fff9009a71347333f
* CVE-2023-29404 - Upstream-Status: Backport from https://github.com/golang/go/commit/bf3c8ce03e175e870763901a3850bca01381a828
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/go/go-1.14.inc | 2 +
.../go/go-1.14/CVE-2023-29402.patch | 201 ++++++++++++++++++
.../go/go-1.14/CVE-2023-29404.patch | 84 ++++++++
3 files changed, 287 insertions(+)
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-29402.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-29404.patch
diff --git a/meta/recipes-devtools/go/go-1.14.inc b/meta/recipes-devtools/go/go-1.14.inc
index ed505c01b3..ea7b9ea80f 100644
--- a/meta/recipes-devtools/go/go-1.14.inc
+++ b/meta/recipes-devtools/go/go-1.14.inc
@@ -65,6 +65,8 @@ SRC_URI += "\
file://CVE-2023-24540.patch \
file://CVE-2023-29405-1.patch \
file://CVE-2023-29405-2.patch \
+ file://CVE-2023-29402.patch \
+ file://CVE-2023-29404.patch \
"
SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch"
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2023-29402.patch b/meta/recipes-devtools/go/go-1.14/CVE-2023-29402.patch
new file mode 100644
index 0000000000..01eed9fe1b
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.14/CVE-2023-29402.patch
@@ -0,0 +1,201 @@
+rom c160b49b6d328c86bd76ca2fff9009a71347333f Mon Sep 17 00:00:00 2001
+From: "Bryan C. Mills" <bcmills@google.com>
+Date: Fri, 12 May 2023 14:15:16 -0400
+Subject: [PATCH] [release-branch.go1.19] cmd/go: disallow package directories
+ containing newlines
+
+Directory or file paths containing newlines may cause tools (such as
+cmd/cgo) that emit "//line" or "#line" -directives to write part of
+the path into non-comment lines in generated source code. If those
+lines contain valid Go code, it may be injected into the resulting
+binary.
+
+(Note that Go import paths and file paths within module zip files
+already could not contain newlines.)
+
+Thanks to Juho Nurminen of Mattermost for reporting this issue.
+
+Updates #60167.
+Fixes #60515.
+Fixes CVE-2023-29402.
+
+Change-Id: If55d0400c02beb7a5da5eceac60f1abeac99f064
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1882606
+Reviewed-by: Roland Shoemaker <bracewell@google.com>
+Run-TryBot: Roland Shoemaker <bracewell@google.com>
+Reviewed-by: Russ Cox <rsc@google.com>
+Reviewed-by: Damien Neil <dneil@google.com>
+(cherry picked from commit 41f9046495564fc728d6f98384ab7276450ac7e2)
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1902229
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1904343
+Reviewed-by: Michael Knyszek <mknyszek@google.com>
+Reviewed-by: Bryan Mills <bcmills@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/501218
+Run-TryBot: David Chase <drchase@google.com>
+Auto-Submit: Michael Knyszek <mknyszek@google.com>
+TryBot-Result: Gopher Robot <gobot@golang.org>
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/c160b49b6d328c86bd76ca2fff9009a71347333f]
+CVE: CVE-2023-29402
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ src/cmd/go/internal/load/pkg.go | 4 +
+ src/cmd/go/internal/work/exec.go | 6 ++
+ src/cmd/go/script_test.go | 1 +
+ .../go/testdata/script/build_cwd_newline.txt | 100 ++++++++++++++++++
+ 4 files changed, 111 insertions(+)
+ create mode 100644 src/cmd/go/testdata/script/build_cwd_newline.txt
+
+diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go
+index 369a79b..d2b63b0 100644
+--- a/src/cmd/go/internal/load/pkg.go
++++ b/src/cmd/go/internal/load/pkg.go
+@@ -1697,6 +1697,10 @@ func (p *Package) load(stk *ImportStack, bp *build.Package, err error) {
+ setError(ImportErrorf(p.ImportPath, "invalid import path %q", p.ImportPath))
+ return
+ }
++ if strings.ContainsAny(p.Dir, "\r\n") {
++ setError(fmt.Errorf("invalid package directory %q", p.Dir))
++ return
++ }
+
+ // Build list of imported packages and full dependency list.
+ imports := make([]*Package, 0, len(p.Imports))
+diff --git a/src/cmd/go/internal/work/exec.go b/src/cmd/go/internal/work/exec.go
+index 9a9650b..050b785 100644
+--- a/src/cmd/go/internal/work/exec.go
++++ b/src/cmd/go/internal/work/exec.go
+@@ -458,6 +458,12 @@ func (b *Builder) build(a *Action) (err error) {
+ b.Print(a.Package.ImportPath + "\n")
+ }
+
++ if p.Error != nil {
++ // Don't try to build anything for packages with errors. There may be a
++ // problem with the inputs that makes the package unsafe to build.
++ return p.Error
++ }
++
+ if a.Package.BinaryOnly {
+ p.Stale = true
+ p.StaleReason = "binary-only packages are no longer supported"
+diff --git a/src/cmd/go/script_test.go b/src/cmd/go/script_test.go
+index ec498bb..a1398ad 100644
+--- a/src/cmd/go/script_test.go
++++ b/src/cmd/go/script_test.go
+@@ -123,6 +123,7 @@ func (ts *testScript) setup() {
+ "devnull=" + os.DevNull,
+ "goversion=" + goVersion(ts),
+ ":=" + string(os.PathListSeparator),
++ "newline=\n",
+ }
+
+ if runtime.GOOS == "plan9" {
+diff --git a/src/cmd/go/testdata/script/build_cwd_newline.txt b/src/cmd/go/testdata/script/build_cwd_newline.txt
+new file mode 100644
+index 0000000..61c6966
+--- /dev/null
++++ b/src/cmd/go/testdata/script/build_cwd_newline.txt
+@@ -0,0 +1,100 @@
++[windows] skip 'filesystem normalizes / to \'
++[plan9] skip 'filesystem disallows \n in paths'
++
++# If the directory path containing a package to be built includes a newline,
++# the go command should refuse to even try to build the package.
++
++env DIR=$WORK${/}${newline}'package main'${newline}'func main() { panic("uh-oh")'${newline}'/*'
++
++mkdir $DIR
++cd $DIR
++exec pwd
++cp $WORK/go.mod ./go.mod
++cp $WORK/main.go ./main.go
++cp $WORK/main_test.go ./main_test.go
++
++! go build -o $devnull .
++stderr 'package example: invalid package directory .*uh-oh'
++
++! go build -o $devnull main.go
++stderr 'package command-line-arguments: invalid package directory .*uh-oh'
++
++! go run .
++stderr 'package example: invalid package directory .*uh-oh'
++
++! go run main.go
++stderr 'package command-line-arguments: invalid package directory .*uh-oh'
++
++! go test .
++stderr 'package example: invalid package directory .*uh-oh'
++
++! go test -v main.go main_test.go
++stderr 'package command-line-arguments: invalid package directory .*uh-oh'
++
++
++# Since we do preserve $PWD (or set it appropriately) for commands, and we do
++# not resolve symlinks unnecessarily, referring to the contents of the unsafe
++# directory via a safe symlink should be ok, and should not inject the data from
++# the symlink target path.
++
++[!symlink] stop 'remainder of test checks symlink behavior'
++[short] stop 'links and runs binaries'
++
++symlink $WORK${/}link -> $DIR
++
++go run $WORK${/}link${/}main.go
++! stdout panic
++! stderr panic
++stderr '^ok$'
++
++go test -v $WORK${/}link${/}main.go $WORK${/}link${/}main_test.go
++! stdout panic
++! stderr panic
++stdout '^ok$' # 'go test' combines the test's stdout into stderr
++
++cd $WORK/link
++
++! go run $DIR${/}main.go
++stderr 'package command-line-arguments: invalid package directory .*uh-oh'
++
++go run .
++! stdout panic
++! stderr panic
++stderr '^ok$'
++
++go run main.go
++! stdout panic
++! stderr panic
++stderr '^ok$'
++
++go test -v
++! stdout panic
++! stderr panic
++stdout '^ok$' # 'go test' combines the test's stdout into stderr
++
++go test -v .
++! stdout panic
++! stderr panic
++stdout '^ok$' # 'go test' combines the test's stdout into stderr
++
++
++-- $WORK/go.mod --
++module example
++go 1.19
++-- $WORK/main.go --
++package main
++
++import "C"
++
++func main() {
++ /* nothing here */
++ println("ok")
++}
++-- $WORK/main_test.go --
++package main
++
++import "testing"
++
++func TestMain(*testing.M) {
++ main()
++}
+--
+2.25.1
+
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2023-29404.patch b/meta/recipes-devtools/go/go-1.14/CVE-2023-29404.patch
new file mode 100644
index 0000000000..61336ee9ee
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.14/CVE-2023-29404.patch
@@ -0,0 +1,84 @@
+From bf3c8ce03e175e870763901a3850bca01381a828 Mon Sep 17 00:00:00 2001
+From: Roland Shoemaker <bracewell@google.com>
+Date: Fri, 5 May 2023 13:10:34 -0700
+Subject: [PATCH] [release-branch.go1.19] cmd/go: enforce flags with
+ non-optional arguments
+
+Enforce that linker flags which expect arguments get them, otherwise it
+may be possible to smuggle unexpected flags through as the linker can
+consume what looks like a flag as an argument to a preceding flag (i.e.
+"-Wl,-O -Wl,-R,-bad-flag" is interpreted as "-O=-R -bad-flag"). Also be
+somewhat more restrictive in the general format of some flags.
+
+Thanks to Juho Nurminen of Mattermost for reporting this issue.
+
+Updates #60305
+Fixes #60511
+Fixes CVE-2023-29404
+
+Change-Id: Icdffef2c0f644da50261cace6f43742783931cff
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1876275
+Reviewed-by: Ian Lance Taylor <iant@google.com>
+Reviewed-by: Damien Neil <dneil@google.com>
+(cherry picked from commit 896779503cf754cbdac24b61d4cc953b50fe2dde)
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1902225
+Run-TryBot: Roland Shoemaker <bracewell@google.com>
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1904342
+Reviewed-by: Michael Knyszek <mknyszek@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/501217
+Auto-Submit: Michael Knyszek <mknyszek@google.com>
+Run-TryBot: David Chase <drchase@google.com>
+TryBot-Bypass: Michael Knyszek <mknyszek@google.com>
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/bf3c8ce03e175e870763901a3850bca01381a828]
+CVE: CVE-2023-29404
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ src/cmd/go/internal/work/security.go | 6 +++---
+ src/cmd/go/internal/work/security_test.go | 5 +++++
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go
+index a823b20..8acb6dc 100644
+--- a/src/cmd/go/internal/work/security.go
++++ b/src/cmd/go/internal/work/security.go
+@@ -177,17 +177,17 @@ var validLinkerFlags = []*lazyregexp.Regexp{
+ re(`-Wl,-Bdynamic`),
+ re(`-Wl,-berok`),
+ re(`-Wl,-Bstatic`),
+- re(`-WL,-O([^@,\-][^,]*)?`),
++ re(`-Wl,-O[0-9]+`),
+ re(`-Wl,-d[ny]`),
+ re(`-Wl,--disable-new-dtags`),
+- re(`-Wl,-e[=,][a-zA-Z0-9]*`),
++ re(`-Wl,-e[=,][a-zA-Z0-9]+`),
+ re(`-Wl,--enable-new-dtags`),
+ re(`-Wl,--end-group`),
+ re(`-Wl,--(no-)?export-dynamic`),
+ re(`-Wl,-framework,[^,@\-][^,]+`),
+ re(`-Wl,-headerpad_max_install_names`),
+ re(`-Wl,--no-undefined`),
+- re(`-Wl,-R([^@\-][^,@]*$)`),
++ re(`-Wl,-R,?([^@\-,][^,@]*$)`),
+ re(`-Wl,--just-symbols[=,]([^,@\-][^,@]+)`),
+ re(`-Wl,-rpath(-link)?[=,]([^,@\-][^,]+)`),
+ re(`-Wl,-s`),
+diff --git a/src/cmd/go/internal/work/security_test.go b/src/cmd/go/internal/work/security_test.go
+index bd707ff..7b0b7d3 100644
+--- a/src/cmd/go/internal/work/security_test.go
++++ b/src/cmd/go/internal/work/security_test.go
+@@ -220,6 +220,11 @@ var badLinkerFlags = [][]string{
+ {"-Wl,-R,@foo"},
+ {"-Wl,--just-symbols,@foo"},
+ {"../x.o"},
++ {"-Wl,-R,"},
++ {"-Wl,-O"},
++ {"-Wl,-e="},
++ {"-Wl,-e,"},
++ {"-Wl,-R,-flag"},
+ }
+
+ func TestCheckLinkerFlags(t *testing.T) {
+--
+2.25.1
+
--
2.34.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][dunfell 05/10] libcap: backport Debian patches to fix CVE-2023-2602 and CVE-2023-2603
2023-06-30 2:33 [OE-core][dunfell 00/10] Patch review Steve Sakoman
` (3 preceding siblings ...)
2023-06-30 2:33 ` [OE-core][dunfell 04/10] go: fix CVE-2023-29402 & CVE-2023-29404 Steve Sakoman
@ 2023-06-30 2:33 ` Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 06/10] linux-yocto/5.4: update to v5.4.246 Steve Sakoman
` (4 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-06-30 2:33 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
import patches from ubuntu to fix
CVE-2023-2602
CVE-2023-2603
Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libcap2/tree/debian/patches?h=ubuntu/focal-security
Upstream commit
https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=bc6b36682f188020ee4770fae1d41bde5b2c97bb
&
https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=422bec25ae4a1ab03fd4d6f728695ed279173b18]
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libcap/files/CVE-2023-2602.patch | 52 +++++++++++++++++
.../libcap/files/CVE-2023-2603.patch | 58 +++++++++++++++++++
meta/recipes-support/libcap/libcap_2.32.bb | 2 +
3 files changed, 112 insertions(+)
create mode 100644 meta/recipes-support/libcap/files/CVE-2023-2602.patch
create mode 100644 meta/recipes-support/libcap/files/CVE-2023-2603.patch
diff --git a/meta/recipes-support/libcap/files/CVE-2023-2602.patch b/meta/recipes-support/libcap/files/CVE-2023-2602.patch
new file mode 100644
index 0000000000..ca04d7297a
--- /dev/null
+++ b/meta/recipes-support/libcap/files/CVE-2023-2602.patch
@@ -0,0 +1,52 @@
+Backport of:
+
+From bc6b36682f188020ee4770fae1d41bde5b2c97bb Mon Sep 17 00:00:00 2001
+From: "Andrew G. Morgan" <morgan@kernel.org>
+Date: Wed, 3 May 2023 19:18:36 -0700
+Subject: Correct the check of pthread_create()'s return value.
+
+This function returns a positive number (errno) on error, so the code
+wasn't previously freeing some memory in this situation.
+
+Discussion:
+
+ https://stackoverflow.com/a/3581020/14760867
+
+Credit for finding this bug in libpsx goes to David Gstir of
+X41 D-Sec GmbH (https://x41-dsec.de/) who performed a security
+audit of the libcap source code in April of 2023. The audit
+was sponsored by the Open Source Technology Improvement Fund
+(https://ostif.org/).
+
+Audit ref: LCAP-CR-23-01 (CVE-2023-2602)
+
+Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
+
+Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libcap2/tree/debian/patches/CVE-2023-2602.patch?h=ubuntu/focal-security
+Upstream commit https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=bc6b36682f188020ee4770fae1d41bde5b2c97bb]
+CVE: CVE-2023-2602
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ psx/psx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/libcap/psx.c
++++ b/libcap/psx.c
+@@ -272,7 +272,7 @@ int psx_pthread_create(pthread_t *thread
+
+ psx_wait_for_idle();
+ int ret = pthread_create(thread, attr, start_routine, arg);
+- if (ret != -1) {
++ if (ret == 0) {
+ psx_do_registration(*thread);
+ }
+ psx_resume_idle();
+@@ -287,7 +287,7 @@ int __wrap_pthread_create(pthread_t *thr
+ void *(*start_routine) (void *), void *arg) {
+ psx_wait_for_idle();
+ int ret = __real_pthread_create(thread, attr, start_routine, arg);
+- if (ret != -1) {
++ if (ret == 0) {
+ psx_do_registration(*thread);
+ }
+ psx_resume_idle();
diff --git a/meta/recipes-support/libcap/files/CVE-2023-2603.patch b/meta/recipes-support/libcap/files/CVE-2023-2603.patch
new file mode 100644
index 0000000000..cf86ac2a46
--- /dev/null
+++ b/meta/recipes-support/libcap/files/CVE-2023-2603.patch
@@ -0,0 +1,58 @@
+Backport of:
+
+From 422bec25ae4a1ab03fd4d6f728695ed279173b18 Mon Sep 17 00:00:00 2001
+From: "Andrew G. Morgan" <morgan@kernel.org>
+Date: Wed, 3 May 2023 19:44:22 -0700
+Subject: Large strings can confuse libcap's internal strdup code.
+
+Avoid something subtle with really long strings: 1073741823 should
+be enough for anybody. This is an improved fix over something attempted
+in libcap-2.55 to address some static analysis findings.
+
+Reviewing the library, cap_proc_root() and cap_launcher_set_chroot()
+are the only two calls where the library is potentially exposed to a
+user controlled string input.
+
+Credit for finding this bug in libcap goes to Richard Weinberger of
+X41 D-Sec GmbH (https://x41-dsec.de/) who performed a security audit
+of the libcap source code in April of 2023. The audit was sponsored
+by the Open Source Technology Improvement Fund (https://ostif.org/).
+
+Audit ref: LCAP-CR-23-02 (CVE-2023-2603)
+
+Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
+
+Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libcap2/tree/debian/patches/CVE-2023-2603.patch?h=ubuntu/focal-security
+Upstream commit https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=422bec25ae4a1ab03fd4d6f728695ed279173b18]
+CVE: CVE-2023-2603
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ libcap/cap_alloc.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/libcap/cap_alloc.c
++++ b/libcap/cap_alloc.c
+@@ -76,13 +76,22 @@ cap_t cap_init(void)
+ char *_libcap_strdup(const char *old)
+ {
+ __u32 *raw_data;
++ size_t len;
+
+ if (old == NULL) {
+ errno = EINVAL;
+ return NULL;
+ }
+
+- raw_data = malloc( sizeof(__u32) + strlen(old) + 1 );
++ len = strlen(old);
++ if ((len & 0x3fffffff) != len) {
++ _cap_debug("len is too long for libcap to manage");
++ errno = EINVAL;
++ return NULL;
++ }
++ len += sizeof(__u32) + 1;
++
++ raw_data = malloc(len);
+ if (raw_data == NULL) {
+ errno = ENOMEM;
+ return NULL;
diff --git a/meta/recipes-support/libcap/libcap_2.32.bb b/meta/recipes-support/libcap/libcap_2.32.bb
index d67babb5e9..64d5190aa7 100644
--- a/meta/recipes-support/libcap/libcap_2.32.bb
+++ b/meta/recipes-support/libcap/libcap_2.32.bb
@@ -13,6 +13,8 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/libs/security/linux-privs/${BPN}2/${BPN}-${
file://0001-ensure-the-XATTR_NAME_CAPS-is-defined-when-it-is-use.patch \
file://0002-tests-do-not-run-target-executables.patch \
file://0001-tests-do-not-statically-link-a-test.patch \
+ file://CVE-2023-2602.patch \
+ file://CVE-2023-2603.patch \
"
SRC_URI[md5sum] = "7416119c9fdcfd0e8dd190a432c668e9"
SRC_URI[sha256sum] = "1005e3d227f2340ad1e3360ef8b69d15e3c72a29c09f4894d7aac038bd26e2be"
--
2.34.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][dunfell 06/10] linux-yocto/5.4: update to v5.4.246
2023-06-30 2:33 [OE-core][dunfell 00/10] Patch review Steve Sakoman
` (4 preceding siblings ...)
2023-06-30 2:33 ` [OE-core][dunfell 05/10] libcap: backport Debian patches to fix CVE-2023-2602 and CVE-2023-2603 Steve Sakoman
@ 2023-06-30 2:33 ` Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 07/10] linux-yocto/5.4: update to v5.4.247 Steve Sakoman
` (3 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-06-30 2:33 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating to the latest korg -stable release that comprises
the following commits:
f568a20f058f Linux 5.4.246
6c0fc4725f6f drm/edid: fix objtool warning in drm_cvt_modes()
914bf541c3bb wifi: rtlwifi: 8192de: correct checking of IQK reload
58bc9baaef92 drm/edid: Fix uninitialized variable in drm_cvt_modes()
77e442733faa RDMA/bnxt_re: Remove the qp from list only if the qp destroy succeeds
a616aa258e46 RDMA/bnxt_re: Remove set but not used variable 'dev_attr'
4ffad598bff4 scsi: dpt_i2o: Do not process completions with invalid addresses
e2897f133acd scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD)
56a4a9dc5ed1 regmap: Account for register length when chunking
94f3bc7e84af test_firmware: fix the memory leak of the allocated firmware buffer
fb7dce686fd1 fbcon: Fix null-ptr-deref in soft_cursor
5ea6122caf51 ext4: add lockdep annotations for i_data_sem for ea_inode's
b06346ef5778 ext4: disallow ea_inodes with extended attributes
ec2a04f8fc9f ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find()
2e636c0c9344 ext4: add EA_INODE checking to ext4_iget()
d9de088797a0 tracing/probe: trace_probe_primary_from_call(): checked list_first_entry
7df474125c37 selinux: don't use make's grouped targets feature yet
b18bc3c9c2c5 tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
ae7fb0c8bf80 mmc: vub300: fix invalid response handling
9d8f5797d791 wifi: rtlwifi: remove always-true condition pointed out by GCC 12
843f51766784 lib/dynamic_debug.c: use address-of operator on section symbols
0638dcc7e75f treewide: Remove uninitialized_var() usage
1eb88dccb827 kernel/extable.c: use address-of operator on section symbols
d069c7ce3995 eth: sun: cassini: remove dead code
d04adc383f32 gcc-12: disable '-Wdangling-pointer' warning for now
253d70232573 ACPI: thermal: drop an always true check
a010f8e64689 x86/boot: Wrap literal addresses in absolute_pointer()
f0bb5135553c flow_dissector: work around stack frame size warning
cd943425c6aa ata: libata-scsi: Use correct device no in ata_find_dev()
76c67ff783ac scsi: stex: Fix gcc 13 warnings
cd91ead608f0 misc: fastrpc: reject new invocations during device removal
bf1d0b84dfd2 misc: fastrpc: return -EPIPE to invocations on device removal
d5f183881529 usb: gadget: f_fs: Add unbind event before functionfs_unbind
ac388cbbd97c net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818
e101e8160cf0 iio: dac: build ad5758 driver when AD5758 is selected
a87236446a62 iio: dac: mcp4725: Fix i2c_master_send() return value handling
c3b25245e3a8 iio: light: vcnl4035: fixed chip ID check
711049e31e09 HID: wacom: avoid integer overflow in wacom_intuos_inout()
4251ff7fd4a4 HID: google: add jewel USB id
f3b4e2a636d1 iio: adc: mxs-lradc: fix the order of two cleanup operations
030ca3f7b042 mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
11b084412055 atm: hide unused procfs functions
cea581b385ab ALSA: oss: avoid missing-prototype warnings
384fd08858da netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
f7e62f1b7229 wifi: b43: fix incorrect __packed annotation
8a9035110288 scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed
f1e6a1097141 arm64/mm: mark private VM_FAULT_X defines as vm_fault_t
c87334f4e705 ARM: dts: stm32: add pin map for CAN controller on stm32f7
a39f24357fdc wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value
353fd22693a6 media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
66a6d704c251 media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
ed47886a73db media: dvb-core: Fix use-after-free due on race condition at dvb_net
e9033a425ab2 media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table
08b20cb8e5b9 media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
46e8b0fe538b media: dvb_ca_en50221: fix a size write bug
b66849f35462 media: netup_unidvb: fix irq init by register it at the end of probe
88aef84eefb3 media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
6b9a534ec5cf media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
f3c8ed7366cd media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
65033ab2f930 media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
37e36b426197 media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
64f1b8296bef media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
d16f5dc3aa09 media: dvb_demux: fix a bug for the continuity counter
a7c87057f259 ASoC: ssm2602: Add workaround for playback distortions
619f008df14e xfrm: Check if_id in inbound policy/secpath match
21ca81704611 ASoC: dwc: limit the number of overrun messages
acd5f476c16e nbd: Fix debugfs_create_dir error checking
19ce1e1f348d fbdev: stifb: Fix info entry in sti_struct on error path
aa32f2fadb4c fbdev: modedb: Add 1920x1080 at 60 Hz video mode
199f9c5430f9 media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE
b950966b44f9 ARM: 9295/1: unwind:fix unwind abort for uleb128 case
a823d8e0bb02 mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
29bfbc8a63c4 watchdog: menz069_wdt: fix watchdog initialisation
0018639be2d9 mtd: rawnand: marvell: don't set the NAND frequency select
5f0043efdc24 mtd: rawnand: marvell: ensure timing values are written
6c0aacf1b4e1 net: dsa: mv88e6xxx: Increase wait after reset deactivation
94a00f1142c5 net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
dd4b5a204dfa udp6: Fix race condition in udp6_sendmsg & connect
cd4a37f0dcc9 net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report
cec562fbf8c5 ocfs2/dlm: move BITS_TO_BYTES() to bitops.h for wider use
9e6bb63e5e66 net: sched: fix NULL pointer dereference in mq_attach
2188c0f09532 net/sched: Prohibit regrafting ingress or clsact Qdiscs
80b20d528a71 net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs
321f38375517 net/sched: sch_clsact: Only create under TC_H_CLSACT
5f67d33c01b3 net/sched: sch_ingress: Only create under TC_H_INGRESS
381a703220fb tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
32e9a9ee285f tcp: deny tcp_disconnect() when threads are waiting
26e830858a2b af_packet: do not use READ_ONCE() in packet_bind()
43f1402dc2e9 mtd: rawnand: ingenic: fix empty stub helper definitions
dd3773e8c8c9 amd-xgbe: fix the false linkup in xgbe_phy_status
603eec060d14 af_packet: Fix data-races of pkt_sk(sk)->num.
bab2f42d8d8a netrom: fix info-leak in nr_write_internal()
d7aeb591b101 net/mlx5: fw_tracer, Fix event handling
c7ac3ebf41ee dmaengine: pl330: rename _start to prevent build error
17d70de57248 iommu/amd: Don't block updates to GATag if guest mode is on
fa961ad9ef91 iommu/rockchip: Fix unwind goto issue
5abb81b4d762 RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx
2bafc7f22db3 RDMA/bnxt_re: Refactor queue pair creation code
56446791bccd RDMA/bnxt_re: Enable SRIOV VF support on Broadcom's 57500 adapter series
cc5a673d85a9 RDMA/efa: Fix unsupported page sizes in device
cf0b1e5482ea Linux 5.4.245
ec14c6e0a2e5 netfilter: ctnetlink: Support offloaded conntrack entry deletion
5b7d4d91c047 ipv{4,6}/raw: fix output xfrm lookup wrt protocol
6c88024cab83 binder: fix UAF caused by faulty buffer cleanup
e6183912ee90 bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
9ba28194ea50 io_uring: have io_kill_timeout() honor the request references
6de3014d4bd8 io_uring: don't drop completion lock before timer is fully initialized
b0bfceaa8c0e io_uring: always grab lock in io_cancel_async_work()
00395fd7f9a0 cdc_ncm: Fix the build warning
672e59995e70 net/mlx5: Devcom, serialize devcom registration
f42feb29bad9 net/mlx5: devcom only supports 2 ports
67637a7ee6bd fs: fix undefined behavior in bit shift for SB_NOUSER
02281c23d069 power: supply: bq24190: Call power_supply_changed() after updating input current
f6518954c146 power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier()
db00ef8fd609 power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
ff484163dfb6 net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
a270ca35a949 cdc_ncm: Implement the 32-bit version of NCM Transfer Block
51d0ac4577c2 Linux 5.4.244
edec0d399907 3c589_cs: Fix an error handling path in tc589_probe()
3dfc1004d9af net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
c59106f8bca1 net/mlx5: Fix error message when failing to allocate device memory
8680d838c98c forcedeth: Fix an error handling path in nv_probe()
b8db4a4e2007 ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg
0099a29bc5a0 x86/show_trace_log_lvl: Ensure stack pointer is aligned, again
c60f38c9bdcb xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
9b13972e4f23 coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet()
f6b610730e8f power: supply: sbs-charger: Fix INHIBITED bit for Status reg
0c5f4cec7596 power: supply: bq27xxx: Fix poll_interval handling and races on remove
dafe9136be7b power: supply: bq27xxx: Fix I2C IRQ race on remove
7b3b11964979 power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition
96bfafbc7d80 power: supply: leds: Fix blink to LED on transition
011f47c8b838 ipv6: Fix out-of-bounds access in ipv6_find_tlv()
120cdad8b2ae bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields
9928ce5225d6 selftests: fib_tests: mute cleanup error message
58766252f6b2 net: fix skb leak in __skb_tstamp_tx()
2b580d0f03c4 media: radio-shark: Add endpoint checks
a730feb672c7 USB: sisusbvga: Add endpoint checks
80100e0863e5 USB: core: Add routines for endpoint checks in old drivers
7e3ae83371a4 udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
9ea0c5f90a27 net: fix stack overflow when LRO is disabled for virtual interfaces
1522dc58bff8 fbdev: udlfb: Fix endpoint check
be646802b3dc debugobjects: Don't wake up kswapd from fill_pool()
4e5a7181a6c3 x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms
6d091e0ddcf3 parisc: Fix flush_dcache_page() for usage from irq context
b556618baca5 selftests/memfd: Fix unknown type name build failure
04aee084a3fa x86/mm: Avoid incomplete Global INVLPG flushes
a9f5423460a6 btrfs: use nofs when cleaning up aborted transactions
4f92934d8073 gpio: mockup: Fix mode of debugfs files
da8adda57984 parisc: Allow to reboot machine after system halt
43ffe982a304 parisc: Handle kgdb breakpoints only in kernel context
f7d19a366cd2 m68k: Move signal frame following exception on 68020/030
8facb9cc168a ALSA: hda/realtek: Enable headset onLenovo M70/M90
5cc3e698c2bb ALSA: hda/ca0132: add quirk for EVGA X299 DARK
68e4c390173e mt76: mt7615: Fix build with older compilers
b558275c1b04 spi: fsl-cpm: Use 16 bit mode for large transfers with even size
d64a45c019ac spi: fsl-spi: Re-organise transfer bits_per_word adaptation
aabe8ca79139 watchdog: sp5100_tco: Immediately trigger upon starting.
aeff9e7e87c1 s390/qdio: fix do_sqbs() inline assembly constraint
ab196fe70a18 s390/qdio: get rid of register asm
a4e3c4c65ae8 vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
74e644795d37 vc_screen: rewrite vcs_size to accept vc, not inode
e9399d4ea5ee usb: gadget: u_ether: Fix host MAC address case
939cafcdf7de usb: gadget: u_ether: Convert prints to device prints
c8489e0fab18 lib/string_helpers: Introduce string_upper() and string_lower() helpers
7e15602c5073 HID: wacom: add three styli to wacom_intuos_get_tool_type
2a12339ce34f HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs
b5185f1b11c7 HID: wacom: Force pen out of prox if no events have been received in a while
e0c1b35239d9 netfilter: nf_tables: hold mutex on netns pre_exit path
6236af6936dd netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag
05b4105e6852 netfilter: nf_tables: stricter validation of element data
e832e4bae556 netfilter: nf_tables: allow up to 64 bytes in the set element data area
28fe10236a64 netfilter: nf_tables: add nft_setelem_parse_key()
eb5b579bd69f netfilter: nf_tables: validate registers coming from userspace.
cfe1b9719cce netfilter: nftables: statify nft_parse_register()
7c788393d453 netfilter: nftables: add nft_parse_register_store() and use it
25336cd96b03 netfilter: nftables: add nft_parse_register_load() and use it
116d53f09ff5 nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
df89b1753eb1 powerpc/64s/radix: Fix soft dirty tracking
60b9a9c8f370 tpm/tpm_tis: Disable interrupts for more Lenovo devices
a33c172c1e34 ceph: force updating the msg pointer in non-split case
6eb9ed0ab7b5 serial: Add support for Advantech PCI-1611U card
21f107a95965 statfs: enforce statfs[64] structure initialization
1eb3e32de7b1 KVM: x86: do not report a vCPU as preempted outside instruction boundaries
a88638a95407 can: kvaser_pciefd: Disable interrupts in probe error path
4579e2556767 can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt
33d5a0a4985a can: kvaser_pciefd: Clear listen-only bit if not explicitly requested
e5ac4f12074e can: kvaser_pciefd: Empty SRB buffer in probe
c0e9fb21b612 can: kvaser_pciefd: Call request_irq() before enabling interrupts
36cd7601e6b9 can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop()
e65811289346 can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag
880482525101 ALSA: hda/realtek: Add quirk for 2nd ASUS GU603
57fd0d122edd ALSA: hda/realtek: Add a quirk for HP EliteDesk 805
739056188ad3 ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table
4ef155ddf957 ALSA: hda: Fix Oops by 9.1 surround channel names
4f9c0a7c2726 usb: typec: altmodes/displayport: fix pin_assignment_show
33b6648d27b8 usb: dwc3: debugfs: Resume dwc3 before accessing registers
241491524ab0 USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value
1f36dc41616b usb-storage: fix deadlock when a scsi command timeouts more than once
7cef7681aa77 USB: usbtmc: Fix direction for 0-length ioctl control messages
f662f856acec vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
53bf7cda160b igb: fix bit_shift to be in [1..8] range
e20105d967ab cassini: Fix a memory leak in the error handling path of cas_init_one()
e519a404a5bb wifi: iwlwifi: mvm: don't trust firmware n_channels
d0baaadd1c5e net: bcmgenet: Restore phy_stop() depending upon suspend/close
2cca63d5bc4e net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
435855b0831b net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
ed50fcab1435 drm/exynos: fix g2d_open/close helper function definitions
1550bcf2983a media: netup_unidvb: fix use-after-free at del_timer()
69055f99900b net: hns3: fix reset delay time to avoid configuration timeout
304e5cb77eb8 net: hns3: fix sending pfc frames after reset issue
d1bcc606870e erspan: get the proto with the md version for collect_md
f185ede016c9 ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode
0eb3ec0a3553 ip6_gre: Make o_seqno start from 0 in native mode
304096241398 ip6_gre: Fix skb_under_panic in __gre6_xmit()
7525aa211758 serial: arc_uart: fix of_iomap leak in `arc_serial_probe`
5a90309002cd vsock: avoid to close connected socket after the timeout
5009aead17f0 ALSA: firewire-digi00x: prevent potential use after free
b22b514209ff net: fec: Better handle pm_runtime_get() failing in .remove()
033297ef3bba af_key: Reject optional tunnel/BEET mode templates in outbound policies
912a6cff0db1 cpupower: Make TSC read per CPU for Mperf monitor
131eb9c9b1a0 ASoC: fsl_micfil: register platform component before registering cpu dai
a3714a47b401 btrfs: fix space cache inconsistency after error loading it from disk
596898303745 btrfs: replace calls to btrfs_find_free_ino with btrfs_find_free_objectid
1e453cb55014 mfd: dln2: Fix memory leak in dln2_probe()
bdc33478d5d3 phy: st: miphy28lp: use _poll_timeout functions for waits
e6e917e82de4 Input: xpad - add constants for GIP interface numbers
9fcef1e37d54 iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any
4461f41ece4d clk: tegra20: fix gcc-7 constant overflow warning
c23e6383d7fe RDMA/core: Fix multiple -Warray-bounds warnings
3ed95a6f6c64 recordmcount: Fix memory leaks in the uwrite function
38a118fd545b sched: Fix KCSAN noinstr violation
cbe3063a9be1 mcb-pci: Reallocate memory region to avoid memory overlapping
d5cd2928d310 serial: 8250: Reinit port->pm on port specific driver unbind
ccb12585a735 usb: typec: tcpm: fix multiple times discover svids error
c5405c767173 HID: wacom: generic: Set battery quirk only when we see battery data
d3f32dc2ccc2 spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3
bf80dbd52899 HID: logitech-hidpp: Reconcile USB and Unifying serials
e28f9de2d4d7 HID: logitech-hidpp: Don't use the USB serial for USB devices
8a65476dd1ca staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE
2112c4c47d36 Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
fa57021262e9 wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
0ad8dd870aa1 wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
f6f2d16c77f9 wifi: iwlwifi: pcie: fix possible NULL pointer dereference
a7ec2f424f6e samples/bpf: Fix fout leak in hbm's run_bpf_prog
4ceedc2f8bdf f2fs: fix to drop all dirty pages during umount() if cp_error is set
8659c5f4ffaa ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()
cee78217a7ae ext4: set goal start correctly in ext4_mb_normalize_request
d43b1bdb1005 gfs2: Fix inode height consistency check
410e610a96c5 scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
cc2d2b3dbfb0 lib: cpu_rmap: Avoid use after free on rmap->obj array entries
89f5055f9b0b scsi: target: iscsit: Free cmds before session free
67236cf14db3 net: Catch invalid index in XPS mapping
92af9cb86ab0 net: pasemi: Fix return type of pasemi_mac_start_tx()
644a9d5e2276 scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
c4813f858e5c ext2: Check block size validity during mount
56c7e9c39bd5 wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
c409eb45f5dd ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects
710e09fd116e ACPICA: Avoid undefined behavior: applying zero offset to null pointer
99c8f2e6f33a drm/tegra: Avoid potential 32-bit integer overflow
ccae2233e993 ACPI: EC: Fix oops when removing custom query handlers
48ac727ea4a3 firmware: arm_sdei: Fix sleep from invalid context BUG
a2a5d3a584bf memstick: r592: Fix UAF bug in r592_remove due to race condition
d73e8c47675e regmap: cache: Return error in cache sync operations for REGCACHE_NONE
9b72cb394f96 drm/amd/display: Use DC_LOG_DC in the trasform pixel function
a75d9211a07f fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
196528ad4844 af_unix: Fix data races around sk->sk_shutdown.
7d17bc2d4e75 af_unix: Fix a data race of sk->sk_receive_queue->qlen.
699c9e7c9f66 net: datagram: fix data-races in datagram_poll()
1aa872e967f2 ipvlan:Fix out-of-bounds caused by unclear skb->cb
4188c5269475 net: add vlan_get_protocol_and_depth() helper
57a269d82f2e net: tap: check vlan with eth_type_vlan() method
1747aa98ab13 net: annotate sk->sk_err write from do_recvmmsg()
a507022c862e netlink: annotate accesses to nlk->cb_running
b47aae7038cc netfilter: conntrack: fix possible bug_on with enable_hooks=1
d7343f8de019 net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
42e1dafa65e2 linux/dim: Do nothing if no time delta between samples
7460ac5a66fb ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings
22b8ac608af5 drm/mipi-dsi: Set the fwnode for mipi_dsi_device
d4992b2b5c68 driver core: add a helper to setup both the of_node and fwnode of a device
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../linux/linux-yocto-rt_5.4.bb | 6 ++---
.../linux/linux-yocto-tiny_5.4.bb | 8 +++----
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb b/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
index 01eca24a00..a604e08822 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
@@ -11,13 +11,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "c705bb899d37bbd61a87a2f850e4d6f04613a908"
-SRCREV_meta ?= "c7d5b73674d53f51772862b951d8cc56683ef04f"
+SRCREV_machine ?= "5cc4655a187a2c5a1a30c6c2295fefab9c8c986d"
+SRCREV_meta ?= "e454f2ec4c69cd5afd7d13df74dd124b856e8765"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA}"
-LINUX_VERSION ?= "5.4.243"
+LINUX_VERSION ?= "5.4.246"
LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
index c3d4ff4608..0938c3d854 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
@@ -6,7 +6,7 @@ KCONFIG_MODE = "--allnoconfig"
require recipes-kernel/linux/linux-yocto.inc
-LINUX_VERSION ?= "5.4.243"
+LINUX_VERSION ?= "5.4.246"
LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -15,9 +15,9 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine_qemuarm ?= "140d4ff6bab1e5959377d4974ade490c837ef9cc"
-SRCREV_machine ?= "66990885cd865944a093b47ee7164ef2838f75a3"
-SRCREV_meta ?= "c7d5b73674d53f51772862b951d8cc56683ef04f"
+SRCREV_machine_qemuarm ?= "ffc4cd8db8b2c495a04a9f28e2da3b4c91f30711"
+SRCREV_machine ?= "9a992a65fe0346b8a7a86ffb2c491dadecada05a"
+SRCREV_meta ?= "e454f2ec4c69cd5afd7d13df74dd124b856e8765"
PV = "${LINUX_VERSION}+git${SRCPV}"
diff --git a/meta/recipes-kernel/linux/linux-yocto_5.4.bb b/meta/recipes-kernel/linux/linux-yocto_5.4.bb
index c361f0c701..28ef51f883 100644
--- a/meta/recipes-kernel/linux/linux-yocto_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_5.4.bb
@@ -12,16 +12,16 @@ KBRANCH_qemux86 ?= "v5.4/standard/base"
KBRANCH_qemux86-64 ?= "v5.4/standard/base"
KBRANCH_qemumips64 ?= "v5.4/standard/mti-malta64"
-SRCREV_machine_qemuarm ?= "3c105623bdba36118195e9c188d728edcc00345a"
-SRCREV_machine_qemuarm64 ?= "993c666984249097d093ee71eb3dffa0844fef6c"
-SRCREV_machine_qemumips ?= "2469bc35f1c2ef5ab2e85b7b705b32e33c6350c7"
-SRCREV_machine_qemuppc ?= "98229034b888ad319d7d030d279381a671c41dc0"
-SRCREV_machine_qemuriscv64 ?= "ba7e46214a9d60247170245cc09e2e1faf6622a1"
-SRCREV_machine_qemux86 ?= "ba7e46214a9d60247170245cc09e2e1faf6622a1"
-SRCREV_machine_qemux86-64 ?= "ba7e46214a9d60247170245cc09e2e1faf6622a1"
-SRCREV_machine_qemumips64 ?= "fb1936fa93be6bfd1b18cd8568cfc5b279904fa5"
-SRCREV_machine ?= "ba7e46214a9d60247170245cc09e2e1faf6622a1"
-SRCREV_meta ?= "c7d5b73674d53f51772862b951d8cc56683ef04f"
+SRCREV_machine_qemuarm ?= "0682b6432f4fb3931fc5a32938ae2957e97ad3fd"
+SRCREV_machine_qemuarm64 ?= "736062be272094d22416e228b92560302298f9fd"
+SRCREV_machine_qemumips ?= "db77f08d3d5176d1b079195beefd558a32e18b69"
+SRCREV_machine_qemuppc ?= "1dbaf2ab5019f7d114b2c309eb7539828f93f10b"
+SRCREV_machine_qemuriscv64 ?= "31ef22a71bebca6fda5592e2dec249886c29cfbb"
+SRCREV_machine_qemux86 ?= "31ef22a71bebca6fda5592e2dec249886c29cfbb"
+SRCREV_machine_qemux86-64 ?= "31ef22a71bebca6fda5592e2dec249886c29cfbb"
+SRCREV_machine_qemumips64 ?= "19c1ba85d643f819cf3e62ee57d05eec2855e97e"
+SRCREV_machine ?= "31ef22a71bebca6fda5592e2dec249886c29cfbb"
+SRCREV_meta ?= "e454f2ec4c69cd5afd7d13df74dd124b856e8765"
# remap qemuarm to qemuarma15 for the 5.4 kernel
# KMACHINE_qemuarm ?= "qemuarma15"
@@ -30,7 +30,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA}"
LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
-LINUX_VERSION ?= "5.4.243"
+LINUX_VERSION ?= "5.4.246"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
DEPENDS += "openssl-native util-linux-native"
--
2.34.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][dunfell 07/10] linux-yocto/5.4: update to v5.4.247
2023-06-30 2:33 [OE-core][dunfell 00/10] Patch review Steve Sakoman
` (5 preceding siblings ...)
2023-06-30 2:33 ` [OE-core][dunfell 06/10] linux-yocto/5.4: update to v5.4.246 Steve Sakoman
@ 2023-06-30 2:33 ` Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 08/10] linux-yocto/5.4: update to v5.4.248 Steve Sakoman
` (2 subsequent siblings)
9 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-06-30 2:33 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating to the latest korg -stable release that comprises
the following commits:
61a2f83e4762 Linux 5.4.247
4b0199bc8189 Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE"
85258ae30708 mtd: spinand: macronix: Add support for MX35LFxGE4AD
8e546674031f btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
4223d91ca1b5 btrfs: check return value of btrfs_commit_transaction in relocation
a35d89d3605b rbd: get snapshot context after exclusive lock is ensured to be held
52a40eaa55d6 drm/atomic: Don't pollute crtc_state->mode_blob with error pointers
2cc5d40e4d49 cifs: handle empty list of targets in cifs_reconnect()
307ffb716282 cifs: get rid of unused parameter in reconn_setup_dfs_targets()
73ed7996bbec ext4: only check dquot_initialize_needed() when debugging
7d0a29c74a31 eeprom: at24: also select REGMAP
0360652bf6ab i2c: sprd: Delete i2c adapter in .remove's error path
c73f1c2f6816 bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
ec946898039a usb: usbfs: Use consistent mmap functions
0147952d158b usb: usbfs: Enforce page requirements for mmap
090878903dd3 pinctrl: meson-axg: add missing GPIOA_18 gpio group
c6e842555050 rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting
69653f941619 Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk
953335a377b6 ceph: fix use-after-free bug for inodes when flushing capsnaps
2416bac0e7b2 can: j1939: avoid possible use-after-free when j1939_can_rx_register fails
bf0245bd44c0 can: j1939: change j1939_netdev_lock type to mutex
9eed68d62e2a can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket
2fc62d51d3e4 drm/amdgpu: fix xclk freq on CHIP_STONEY
e752bb1c039f ALSA: hda/realtek: Add Lenovo P3 Tower platform
ca599db7a5e0 ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01
d5ca4799e6d3 Input: psmouse - fix OOB access in Elantech protocol
282a96e3f88f Input: xpad - delete a Razer DeathAdder mouse VID/PID entry
a3a99a069eb9 batman-adv: Broken sync while rescheduling delayed work
df7044fc099b bnxt_en: Query default VLAN before VNIC setup on a VF
a6ca81297392 lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
198da74a4e8d net: sched: fix possible refcount leak in tc_chain_tmplt_add()
8f7cbd6d5e39 net: sched: move rtm_tca_policy declaration to include file
b8b90f92444b rfs: annotate lockless accesses to RFS sock flow table
28ac3cf2ac21 rfs: annotate lockless accesses to sk->sk_rxhash
a4c72805fda4 netfilter: ipset: Add schedule point in call_ad().
0b705ed9d403 netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper
c2c6133eebaf Bluetooth: L2CAP: Add missing checks for invalid DCID
0f841f80390d Bluetooth: Fix l2cap_disconnect_req deadlock
b0b1b97702a5 net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methods
7e0da73ce546 neighbour: fix unaligned access to pneigh_entry
314713ff4c9b neighbour: Replace zero-length array with flexible-array member
e96f52705a63 spi: qup: Request DMA before enabling clocks
1cc6435cd704 i40e: fix build warnings in i40e_alloc.h
fc75b8973de4 i40iw: fix build warning in i40iw_manage_apbvt()
c425e71826e4 block/blk-iocost (gcc13): keep large values in a new enum
ec97af8e8a36 blk-iocost: avoid 64-bit division in ioc_timer_fn
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../linux/linux-yocto-rt_5.4.bb | 6 ++---
.../linux/linux-yocto-tiny_5.4.bb | 8 +++----
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb b/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
index a604e08822..8e0f7ae217 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
@@ -11,13 +11,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "5cc4655a187a2c5a1a30c6c2295fefab9c8c986d"
-SRCREV_meta ?= "e454f2ec4c69cd5afd7d13df74dd124b856e8765"
+SRCREV_machine ?= "3ec10d880e38eb58af39c33094e455da59afd42b"
+SRCREV_meta ?= "b09511ad6dbb6f38303add48d2da78906bab1380"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA}"
-LINUX_VERSION ?= "5.4.246"
+LINUX_VERSION ?= "5.4.247"
LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
index 0938c3d854..6a6787a091 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
@@ -6,7 +6,7 @@ KCONFIG_MODE = "--allnoconfig"
require recipes-kernel/linux/linux-yocto.inc
-LINUX_VERSION ?= "5.4.246"
+LINUX_VERSION ?= "5.4.247"
LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -15,9 +15,9 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine_qemuarm ?= "ffc4cd8db8b2c495a04a9f28e2da3b4c91f30711"
-SRCREV_machine ?= "9a992a65fe0346b8a7a86ffb2c491dadecada05a"
-SRCREV_meta ?= "e454f2ec4c69cd5afd7d13df74dd124b856e8765"
+SRCREV_machine_qemuarm ?= "5780bc7b75d300e9b90b78c9297ff4717a78a893"
+SRCREV_machine ?= "45eaa635123abc1568c35d4abd0f31cc7c4f75a9"
+SRCREV_meta ?= "b09511ad6dbb6f38303add48d2da78906bab1380"
PV = "${LINUX_VERSION}+git${SRCPV}"
diff --git a/meta/recipes-kernel/linux/linux-yocto_5.4.bb b/meta/recipes-kernel/linux/linux-yocto_5.4.bb
index 28ef51f883..6c9cea6993 100644
--- a/meta/recipes-kernel/linux/linux-yocto_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_5.4.bb
@@ -12,16 +12,16 @@ KBRANCH_qemux86 ?= "v5.4/standard/base"
KBRANCH_qemux86-64 ?= "v5.4/standard/base"
KBRANCH_qemumips64 ?= "v5.4/standard/mti-malta64"
-SRCREV_machine_qemuarm ?= "0682b6432f4fb3931fc5a32938ae2957e97ad3fd"
-SRCREV_machine_qemuarm64 ?= "736062be272094d22416e228b92560302298f9fd"
-SRCREV_machine_qemumips ?= "db77f08d3d5176d1b079195beefd558a32e18b69"
-SRCREV_machine_qemuppc ?= "1dbaf2ab5019f7d114b2c309eb7539828f93f10b"
-SRCREV_machine_qemuriscv64 ?= "31ef22a71bebca6fda5592e2dec249886c29cfbb"
-SRCREV_machine_qemux86 ?= "31ef22a71bebca6fda5592e2dec249886c29cfbb"
-SRCREV_machine_qemux86-64 ?= "31ef22a71bebca6fda5592e2dec249886c29cfbb"
-SRCREV_machine_qemumips64 ?= "19c1ba85d643f819cf3e62ee57d05eec2855e97e"
-SRCREV_machine ?= "31ef22a71bebca6fda5592e2dec249886c29cfbb"
-SRCREV_meta ?= "e454f2ec4c69cd5afd7d13df74dd124b856e8765"
+SRCREV_machine_qemuarm ?= "5f8520357626b4a63278e222fa32b322f9811f34"
+SRCREV_machine_qemuarm64 ?= "5aae64158e118c7c96b6b2db41aa0c565d733c47"
+SRCREV_machine_qemumips ?= "50721182f0802cab035f92538c9fe60fa32e27a6"
+SRCREV_machine_qemuppc ?= "032f6844ab616a7c3c96a27a9f7c19c56e4b37a5"
+SRCREV_machine_qemuriscv64 ?= "2ded7ddaca7d93e0df26c4392b713dd7b016a402"
+SRCREV_machine_qemux86 ?= "2ded7ddaca7d93e0df26c4392b713dd7b016a402"
+SRCREV_machine_qemux86-64 ?= "2ded7ddaca7d93e0df26c4392b713dd7b016a402"
+SRCREV_machine_qemumips64 ?= "77a6c71bda43b4d11767ea3946385f6a5d2d24b6"
+SRCREV_machine ?= "2ded7ddaca7d93e0df26c4392b713dd7b016a402"
+SRCREV_meta ?= "b09511ad6dbb6f38303add48d2da78906bab1380"
# remap qemuarm to qemuarma15 for the 5.4 kernel
# KMACHINE_qemuarm ?= "qemuarma15"
@@ -30,7 +30,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA}"
LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
-LINUX_VERSION ?= "5.4.246"
+LINUX_VERSION ?= "5.4.247"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
DEPENDS += "openssl-native util-linux-native"
--
2.34.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][dunfell 08/10] linux-yocto/5.4: update to v5.4.248
2023-06-30 2:33 [OE-core][dunfell 00/10] Patch review Steve Sakoman
` (6 preceding siblings ...)
2023-06-30 2:33 ` [OE-core][dunfell 07/10] linux-yocto/5.4: update to v5.4.247 Steve Sakoman
@ 2023-06-30 2:33 ` Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 09/10] linux-yocto-rt/54: fix 5.4-rt build breakage Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 10/10] linux-yocto/5.4: cfg: fix DECNET configuration warning Steve Sakoman
9 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-06-30 2:33 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating to the latest korg -stable release that comprises
the following commits:
f2b499c27a95 Linux 5.4.248
1cdc48aaff18 mmc: block: ensure error propagation for non-blk
de517032ee39 drm/nouveau/kms: Fix NULL pointer dereference in nouveau_connector_detect_depth
d3f7f557d8a2 neighbour: delete neigh_lookup_nodev as not used
a433b85d1750 net: Remove unused inline function dst_hold_and_use()
fbc0209ae3a7 neighbour: Remove unused inline function neigh_key_eq16()
bc1ea55bf1cf afs: Fix vlserver probe RTT handling
98acd5f0ce10 selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET
1140f8bc29c2 net: tipc: resize nlattr array to correct size
b83f86ba414c net: lapbether: only support ethernet devices
ec694ad393cc net/sched: cls_api: Fix lockup on flushing explicitly created chain
0456f470fa02 drm/nouveau: add nv_encoder pointer check for NULL
b1d76d16af2a drm/nouveau/kms: Don't change EDID when it hasn't actually changed
f654b8a1325f drm/nouveau/dp: check for NULL nv_connector->native_mode
2ac7be7718a1 igb: fix nvm.ops.read() error handling
44008337f80e sctp: fix an error code in sctp_sf_eat_auth()
edd3d3dc4849 ipvlan: fix bound dev checking for IPv6 l3s mode
6718478c18a4 IB/isert: Fix incorrect release of isert connection
f8a91a024ab9 IB/isert: Fix possible list corruption in CMA handler
8a867ab71302 IB/isert: Fix dead lock in ib_isert
22125be516ef IB/uverbs: Fix to consider event queue closing also upon non-blocking mode
ea4cf04d3f19 iavf: remove mask from iavf_irq_enable_queues()
19a500f530c2 RDMA/rxe: Fix the use-before-initialization error of resp_pkts
42ab73534583 RDMA/rxe: Removed unused name from rxe_task struct
f99b6de58b5e RDMA/rxe: Remove the unused variable obj
46305daf8064 net/sched: cls_u32: Fix reference counter leak leading to overflow
88d6c1958bc0 ping6: Fix send to link-local addresses with VRF.
474e0adf29cf netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
67cafcd3e661 spi: fsl-dspi: avoid SCK glitches with continuous transfers
8231594e21d1 spi: spi-fsl-dspi: Remove unused chip->void_write_data
9d8b388a24c6 usb: dwc3: gadget: Reset num TRBs before giving back the request
94e52fac1519 serial: lantiq: add missing interrupt ack
b577b74f8f83 USB: serial: option: add Quectel EM061KGL series
6b1203ae83c3 Remove DECnet support from kernel
aad6addc17ae ALSA: hda/realtek: Add a quirk for Compaq N14JP6
def7e17c98f7 net: usb: qmi_wwan: add support for Compal RXM-G1
74bd53737372 RDMA/uverbs: Restrict usage of privileged QKEYs
a8997ffad359 nouveau: fix client work fence deletion race
01fd784b0762 powerpc/purgatory: remove PGO flags
b16bf76b3828 kexec: support purgatories with .text.hot sections
b27a5fbe3c87 nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
0dd2d8331eb4 nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key()
e1fb47f13970 nios2: dts: Fix tse_mac "max-frame-size" property
5e531f448e5a ocfs2: check new file size on fallocate call
f6878da39f47 ocfs2: fix use-after-free when unmounting read-only filesystem
82173fde61c7 drm:amd:amdgpu: Fix missing buffer object unlock in failure path
63afd766211b xen/blkfront: Only check REQ_FUA for writes
27447dada0b5 mips: Move initrd_start check after initrd address sanitisation.
a365600bba27 MIPS: Alchemy: fix dbdma2
6b39b06b8d5b parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory()
de873bce06a8 parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu()
28850d25a62c btrfs: handle memory allocation failure in btrfs_csum_one_bio
b31586747bae power: supply: Fix logic checking if system is running from battery
dd8804117d4b irqchip/meson-gpio: Mark OF related data as maybe unused
30ade27dbe66 regulator: Fix error checking for debugfs_create_dir
a12155f0b1b6 platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0
d26edc403c0a power: supply: Ratelimit no data debug output
af44b2ddfc08 ARM: dts: vexpress: add missing cache properties
bd725832eb50 power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule()
82bfd14f1359 power: supply: sc27xx: Fix external_power_changed race
66d5882dcc9f power: supply: ab8500: Fix external_power_changed race
a8f286bfbc71 s390/dasd: Use correct lock while counting channel queue length
d60be47f4357 dasd: refactor dasd_ioctl_information
7f3bb75a0484 KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
75d9e00f65cd test_firmware: fix a memory leak with reqs buffer
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../linux/linux-yocto-rt_5.4.bb | 6 ++---
.../linux/linux-yocto-tiny_5.4.bb | 8 +++----
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb b/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
index 8e0f7ae217..a98a64110a 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
@@ -11,13 +11,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "3ec10d880e38eb58af39c33094e455da59afd42b"
-SRCREV_meta ?= "b09511ad6dbb6f38303add48d2da78906bab1380"
+SRCREV_machine ?= "8472ed342e0ac3f529c10b474b12ef0e05995778"
+SRCREV_meta ?= "5c912968f2cb938ad084d457dae99bf8eb16032d"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA}"
-LINUX_VERSION ?= "5.4.247"
+LINUX_VERSION ?= "5.4.248"
LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
index 6a6787a091..46a8856963 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
@@ -6,7 +6,7 @@ KCONFIG_MODE = "--allnoconfig"
require recipes-kernel/linux/linux-yocto.inc
-LINUX_VERSION ?= "5.4.247"
+LINUX_VERSION ?= "5.4.248"
LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -15,9 +15,9 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine_qemuarm ?= "5780bc7b75d300e9b90b78c9297ff4717a78a893"
-SRCREV_machine ?= "45eaa635123abc1568c35d4abd0f31cc7c4f75a9"
-SRCREV_meta ?= "b09511ad6dbb6f38303add48d2da78906bab1380"
+SRCREV_machine_qemuarm ?= "ca5368c73bab4eb276a8e721df28c02ceb8f3eeb"
+SRCREV_machine ?= "abb579170926348d1518bc1a2de8cb1cdf403808"
+SRCREV_meta ?= "5c912968f2cb938ad084d457dae99bf8eb16032d"
PV = "${LINUX_VERSION}+git${SRCPV}"
diff --git a/meta/recipes-kernel/linux/linux-yocto_5.4.bb b/meta/recipes-kernel/linux/linux-yocto_5.4.bb
index 6c9cea6993..fae2de5c72 100644
--- a/meta/recipes-kernel/linux/linux-yocto_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_5.4.bb
@@ -12,16 +12,16 @@ KBRANCH_qemux86 ?= "v5.4/standard/base"
KBRANCH_qemux86-64 ?= "v5.4/standard/base"
KBRANCH_qemumips64 ?= "v5.4/standard/mti-malta64"
-SRCREV_machine_qemuarm ?= "5f8520357626b4a63278e222fa32b322f9811f34"
-SRCREV_machine_qemuarm64 ?= "5aae64158e118c7c96b6b2db41aa0c565d733c47"
-SRCREV_machine_qemumips ?= "50721182f0802cab035f92538c9fe60fa32e27a6"
-SRCREV_machine_qemuppc ?= "032f6844ab616a7c3c96a27a9f7c19c56e4b37a5"
-SRCREV_machine_qemuriscv64 ?= "2ded7ddaca7d93e0df26c4392b713dd7b016a402"
-SRCREV_machine_qemux86 ?= "2ded7ddaca7d93e0df26c4392b713dd7b016a402"
-SRCREV_machine_qemux86-64 ?= "2ded7ddaca7d93e0df26c4392b713dd7b016a402"
-SRCREV_machine_qemumips64 ?= "77a6c71bda43b4d11767ea3946385f6a5d2d24b6"
-SRCREV_machine ?= "2ded7ddaca7d93e0df26c4392b713dd7b016a402"
-SRCREV_meta ?= "b09511ad6dbb6f38303add48d2da78906bab1380"
+SRCREV_machine_qemuarm ?= "68775a8671944b96c6a1ee795809f81149951f2d"
+SRCREV_machine_qemuarm64 ?= "54bc3d459501d8df9baf093a34d8bb676c207a07"
+SRCREV_machine_qemumips ?= "ba2d346cc66307fa6332b9fb86eb8ca66f30ebcd"
+SRCREV_machine_qemuppc ?= "6703d4c7c75fab78e0c72227a98aba8071d5b1c3"
+SRCREV_machine_qemuriscv64 ?= "d18af0e8acb7c4cb245739fa8165a44845ff2ba0"
+SRCREV_machine_qemux86 ?= "d18af0e8acb7c4cb245739fa8165a44845ff2ba0"
+SRCREV_machine_qemux86-64 ?= "d18af0e8acb7c4cb245739fa8165a44845ff2ba0"
+SRCREV_machine_qemumips64 ?= "66cac7d41a43594760f6ac48e848d73315cc5dd3"
+SRCREV_machine ?= "d18af0e8acb7c4cb245739fa8165a44845ff2ba0"
+SRCREV_meta ?= "5c912968f2cb938ad084d457dae99bf8eb16032d"
# remap qemuarm to qemuarma15 for the 5.4 kernel
# KMACHINE_qemuarm ?= "qemuarma15"
@@ -30,7 +30,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA}"
LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
-LINUX_VERSION ?= "5.4.247"
+LINUX_VERSION ?= "5.4.248"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
DEPENDS += "openssl-native util-linux-native"
--
2.34.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][dunfell 09/10] linux-yocto-rt/54: fix 5.4-rt build breakage
2023-06-30 2:33 [OE-core][dunfell 00/10] Patch review Steve Sakoman
` (7 preceding siblings ...)
2023-06-30 2:33 ` [OE-core][dunfell 08/10] linux-yocto/5.4: update to v5.4.248 Steve Sakoman
@ 2023-06-30 2:33 ` Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 10/10] linux-yocto/5.4: cfg: fix DECNET configuration warning Steve Sakoman
9 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-06-30 2:33 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Integrating the following commit:
commit 8d8179549a233e7517523ac12887016451da2e20
Author: Bruce Ashfield <bruce.ashfield@gmail.com>
Date: Tue Jun 27 10:13:01 2023 -0400
rt: fix 5.4-stable introduced compile errors
The 5.4 stable series brough back two elements removed
by the -rt patch:
- tick_period
- deferred/safe printk
We fix the build by dropping the use of the period and
deferred printk
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb | 4 ++--
meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb | 2 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb b/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
index a98a64110a..541d169379 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
@@ -11,8 +11,8 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "8472ed342e0ac3f529c10b474b12ef0e05995778"
-SRCREV_meta ?= "5c912968f2cb938ad084d457dae99bf8eb16032d"
+SRCREV_machine ?= "8d8179549a233e7517523ac12887016451da2e20"
+SRCREV_meta ?= "b6e41788aebaf8058d1f15f6cdcf55a6edb77755"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA}"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
index 46a8856963..171ff8493c 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
@@ -17,7 +17,7 @@ KCONF_BSP_AUDIT_LEVEL = "2"
SRCREV_machine_qemuarm ?= "ca5368c73bab4eb276a8e721df28c02ceb8f3eeb"
SRCREV_machine ?= "abb579170926348d1518bc1a2de8cb1cdf403808"
-SRCREV_meta ?= "5c912968f2cb938ad084d457dae99bf8eb16032d"
+SRCREV_meta ?= "b6e41788aebaf8058d1f15f6cdcf55a6edb77755"
PV = "${LINUX_VERSION}+git${SRCPV}"
diff --git a/meta/recipes-kernel/linux/linux-yocto_5.4.bb b/meta/recipes-kernel/linux/linux-yocto_5.4.bb
index fae2de5c72..527728d9d0 100644
--- a/meta/recipes-kernel/linux/linux-yocto_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_5.4.bb
@@ -21,7 +21,7 @@ SRCREV_machine_qemux86 ?= "d18af0e8acb7c4cb245739fa8165a44845ff2ba0"
SRCREV_machine_qemux86-64 ?= "d18af0e8acb7c4cb245739fa8165a44845ff2ba0"
SRCREV_machine_qemumips64 ?= "66cac7d41a43594760f6ac48e848d73315cc5dd3"
SRCREV_machine ?= "d18af0e8acb7c4cb245739fa8165a44845ff2ba0"
-SRCREV_meta ?= "5c912968f2cb938ad084d457dae99bf8eb16032d"
+SRCREV_meta ?= "b6e41788aebaf8058d1f15f6cdcf55a6edb77755"
# remap qemuarm to qemuarma15 for the 5.4 kernel
# KMACHINE_qemuarm ?= "qemuarma15"
--
2.34.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][dunfell 10/10] linux-yocto/5.4: cfg: fix DECNET configuration warning
2023-06-30 2:33 [OE-core][dunfell 00/10] Patch review Steve Sakoman
` (8 preceding siblings ...)
2023-06-30 2:33 ` [OE-core][dunfell 09/10] linux-yocto-rt/54: fix 5.4-rt build breakage Steve Sakoman
@ 2023-06-30 2:33 ` Steve Sakoman
9 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-06-30 2:33 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Dropping CONFIG_DECNET as it has been removed from -stable
and we now get a configuration warning.
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb | 2 +-
meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb | 2 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb b/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
index 541d169379..d775a60e9f 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_5.4.bb
@@ -12,7 +12,7 @@ python () {
}
SRCREV_machine ?= "8d8179549a233e7517523ac12887016451da2e20"
-SRCREV_meta ?= "b6e41788aebaf8058d1f15f6cdcf55a6edb77755"
+SRCREV_meta ?= "465d61ba36f5c7e32d1fddef078d5d2068fcc2cc"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA}"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
index 171ff8493c..5e2b2ab6cf 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_5.4.bb
@@ -17,7 +17,7 @@ KCONF_BSP_AUDIT_LEVEL = "2"
SRCREV_machine_qemuarm ?= "ca5368c73bab4eb276a8e721df28c02ceb8f3eeb"
SRCREV_machine ?= "abb579170926348d1518bc1a2de8cb1cdf403808"
-SRCREV_meta ?= "b6e41788aebaf8058d1f15f6cdcf55a6edb77755"
+SRCREV_meta ?= "465d61ba36f5c7e32d1fddef078d5d2068fcc2cc"
PV = "${LINUX_VERSION}+git${SRCPV}"
diff --git a/meta/recipes-kernel/linux/linux-yocto_5.4.bb b/meta/recipes-kernel/linux/linux-yocto_5.4.bb
index 527728d9d0..336e72eede 100644
--- a/meta/recipes-kernel/linux/linux-yocto_5.4.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_5.4.bb
@@ -21,7 +21,7 @@ SRCREV_machine_qemux86 ?= "d18af0e8acb7c4cb245739fa8165a44845ff2ba0"
SRCREV_machine_qemux86-64 ?= "d18af0e8acb7c4cb245739fa8165a44845ff2ba0"
SRCREV_machine_qemumips64 ?= "66cac7d41a43594760f6ac48e848d73315cc5dd3"
SRCREV_machine ?= "d18af0e8acb7c4cb245739fa8165a44845ff2ba0"
-SRCREV_meta ?= "b6e41788aebaf8058d1f15f6cdcf55a6edb77755"
+SRCREV_meta ?= "465d61ba36f5c7e32d1fddef078d5d2068fcc2cc"
# remap qemuarm to qemuarma15 for the 5.4 kernel
# KMACHINE_qemuarm ?= "qemuarma15"
--
2.34.1
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][dunfell 00/10] Patch review
@ 2023-10-17 18:42 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-10-17 18:42 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for dunfell and have comments back by
end of day Thursday, October 19
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6058
with the exception of a reproducibility issue for the vim-common package
where we have:
"Content-Type:·text/plain;·charset=CP1251\n"
in the A build and:
"Content-Type:·text/plain;·charset=cp1251\n"
in the B build.
Dunfell autobuilder builds are currently using an older buildtools tarball
which is missing:
https://git.yoctoproject.org/poky/commit/?id=a2f1791f8d0118f44cf752341c4793d656a54a94
I'm sending a patch to the list to update dunfell to the latest buildtools tarball
The following changes since commit 0e167ef0eb7ac62ddb991ce80c27882863d8ee7c:
cpio: Replace fix wrong CRC with ASCII CRC for large files with upstream backport (2023-10-09 07:30:51 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Marek Vasut (2):
libtiff: Add fix for tiffcrop CVE-2023-1916
systemd: Backport systemd-resolved: use hostname for certificate
validation in DoT
Mike Crowe (2):
curl: Backport fix for CVE-2023-38545
curl: Backport fix for CVE-2023-38546
Pawan (1):
libwebp: Update CVE ID CVE-2023-4863
Ryan Eatmon (1):
kernel.bbclass: Add force flag to rm calls
Siddharth Doshi (4):
glib-2.0: Fix multiple vulnerabilities
vim: Upgrade 9.0.1894 -> 9.0.2009
xorg-lib-common: Add variable to set tarball type
libxpm: upgrade to 3.5.17
meta/classes/kernel.bbclass | 4 +-
.../glib-2.0/glib-2.0/CVE-2023-29499.patch | 290 ++++++++++++
.../glib-2.0/CVE-2023-32611-0001.patch | 89 ++++
.../glib-2.0/CVE-2023-32611-0002.patch | 255 +++++++++++
.../glib-2.0/glib-2.0/CVE-2023-32636.patch | 49 ++
.../glib-2.0/glib-2.0/CVE-2023-32643.patch | 154 +++++++
.../glib-2.0/CVE-2023-32665-0001.patch | 103 +++++
.../glib-2.0/CVE-2023-32665-0002.patch | 210 +++++++++
.../glib-2.0/CVE-2023-32665-0003.patch | 417 ++++++++++++++++++
.../glib-2.0/CVE-2023-32665-0004.patch | 113 +++++
.../glib-2.0/CVE-2023-32665-0005.patch | 80 ++++
.../glib-2.0/CVE-2023-32665-0006.patch | 396 +++++++++++++++++
.../glib-2.0/CVE-2023-32665-0007.patch | 49 ++
.../glib-2.0/CVE-2023-32665-0008.patch | 394 +++++++++++++++++
.../glib-2.0/CVE-2023-32665-0009.patch | 97 ++++
meta/recipes-core/glib-2.0/glib-2.0_2.62.6.bb | 14 +
.../systemd/systemd/CVE-2018-21029.patch | 120 +++++
meta/recipes-core/systemd/systemd_244.5.bb | 1 +
.../xorg-lib/libxpm/CVE-2022-46285.patch | 40 --
.../{libxpm_3.5.13.bb => libxpm_3.5.17.bb} | 9 +-
.../xorg-lib/xorg-lib-common.inc | 3 +-
.../libtiff/files/CVE-2023-1916.patch | 91 ++++
meta/recipes-multimedia/libtiff/tiff_4.1.0.bb | 1 +
.../webp/files/CVE-2023-5129.patch | 9 +-
.../curl/curl/CVE-2023-38545.patch | 148 +++++++
.../curl/curl/CVE-2023-38546.patch | 132 ++++++
meta/recipes-support/curl/curl_7.69.1.bb | 2 +
meta/recipes-support/vim/vim.inc | 4 +-
28 files changed, 3223 insertions(+), 51 deletions(-)
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-29499.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32611-0001.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32611-0002.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32636.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32643.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0001.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0002.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0003.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0004.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0005.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0006.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0007.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0008.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2023-32665-0009.patch
create mode 100644 meta/recipes-core/systemd/systemd/CVE-2018-21029.patch
delete mode 100644 meta/recipes-graphics/xorg-lib/libxpm/CVE-2022-46285.patch
rename meta/recipes-graphics/xorg-lib/{libxpm_3.5.13.bb => libxpm_3.5.17.bb} (68%)
create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2023-1916.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-38545.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-38546.patch
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2023-10-17 18:42 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-06-30 2:33 [OE-core][dunfell 00/10] Patch review Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 01/10] libjpeg-turbo: CVE-2020-35538 Null pointer dereference in jcopy_sample_rows() function Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 02/10] ninja: Whitelist CVE-2021-4336, wrong ninja Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 03/10] go: Backport fix CVE-2023-29405 Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 04/10] go: fix CVE-2023-29402 & CVE-2023-29404 Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 05/10] libcap: backport Debian patches to fix CVE-2023-2602 and CVE-2023-2603 Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 06/10] linux-yocto/5.4: update to v5.4.246 Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 07/10] linux-yocto/5.4: update to v5.4.247 Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 08/10] linux-yocto/5.4: update to v5.4.248 Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 09/10] linux-yocto-rt/54: fix 5.4-rt build breakage Steve Sakoman
2023-06-30 2:33 ` [OE-core][dunfell 10/10] linux-yocto/5.4: cfg: fix DECNET configuration warning Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2023-10-17 18:42 [OE-core][dunfell 00/10] Patch review Steve Sakoman
2022-03-27 16:40 Steve Sakoman
2021-12-13 15:36 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox