* [OE-core][scarthgap 01/28] openssh: fix CVE-2025-26465
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 02/28] ruby: Fix CVE-2025-27219 Steve Sakoman
` (26 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled.
A machine-in-the-middle attack can be performed by a malicious machine impersonating
a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific
conditions when verifying the host key. For an attack to be considered successful,
the attacker needs to manage to exhaust the client's memory resource first, turning
the attack complexity high.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../openssh/openssh/CVE-2025-26465.patch | 169 ++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 170 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2025-26465.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2025-26465.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2025-26465.patch
new file mode 100644
index 0000000000..0a3cf1496b
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2025-26465.patch
@@ -0,0 +1,169 @@
+From 0832aac79517611dd4de93ad0a83577994d9c907 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Tue, 18 Feb 2025 08:02:48 +0000
+Subject: [PATCH] upstream: Fix cases where error codes were not correctly set
+
+Reported by the Qualys Security Advisory team. ok markus@
+
+OpenBSD-Commit-ID: 7bcd4ffe0fa1e27ff98d451fb9c22f5fae6e610d
+
+CVE: CVE-2025-26465
+
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/0832aac79517611dd4de93ad0a83577994d9c907]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ krl.c | 4 +++-
+ ssh-agent.c | 5 +++++
+ ssh-sk-client.c | 4 +++-
+ sshconnect2.c | 5 ++++-
+ sshsig.c | 1 +
+ 5 files changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/krl.c b/krl.c
+index e2efdf0..0d0f695 100644
+--- a/krl.c
++++ b/krl.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: krl.c,v 1.59 2023/07/17 05:22:30 djm Exp $ */
++/* $OpenBSD: krl.c,v 1.60 2025/02/18 08:02:48 djm Exp $ */
+ /*
+ * Copyright (c) 2012 Damien Miller <djm@mindrot.org>
+ *
+@@ -674,6 +674,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
+ break;
+ case KRL_SECTION_CERT_SERIAL_BITMAP:
+ if (rs->lo - bitmap_start > INT_MAX) {
++ r = SSH_ERR_INVALID_FORMAT;
+ error_f("insane bitmap gap");
+ goto out;
+ }
+@@ -1059,6 +1060,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp)
+ }
+
+ if ((krl = ssh_krl_init()) == NULL) {
++ r = SSH_ERR_ALLOC_FAIL;
+ error_f("alloc failed");
+ goto out;
+ }
+diff --git a/ssh-agent.c b/ssh-agent.c
+index b6a3f48..2d2c6fc 100644
+--- a/ssh-agent.c
++++ b/ssh-agent.c
+@@ -1204,6 +1204,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ "restrict-destination-v00@openssh.com") == 0) {
+ if (*dcsp != NULL) {
+ error_f("%s already set", ext_name);
++ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ if ((r = sshbuf_froms(m, &b)) != 0) {
+@@ -1213,6 +1214,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ while (sshbuf_len(b) != 0) {
+ if (*ndcsp >= AGENT_MAX_DEST_CONSTRAINTS) {
+ error_f("too many %s constraints", ext_name);
++ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ *dcsp = xrecallocarray(*dcsp, *ndcsp, *ndcsp + 1,
+@@ -1230,6 +1232,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ }
+ if (*certs != NULL) {
+ error_f("%s already set", ext_name);
++ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ if ((r = sshbuf_get_u8(m, &v)) != 0 ||
+@@ -1241,6 +1244,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
+ while (sshbuf_len(b) != 0) {
+ if (*ncerts >= AGENT_MAX_EXT_CERTS) {
+ error_f("too many %s constraints", ext_name);
++ r = SSH_ERR_INVALID_FORMAT;
+ goto out;
+ }
+ *certs = xrecallocarray(*certs, *ncerts, *ncerts + 1,
+@@ -1737,6 +1741,7 @@ process_ext_session_bind(SocketEntry *e)
+ /* record new key/sid */
+ if (e->nsession_ids >= AGENT_MAX_SESSION_IDS) {
+ error_f("too many session IDs recorded");
++ r = -1;
+ goto out;
+ }
+ e->session_ids = xrecallocarray(e->session_ids, e->nsession_ids,
+diff --git a/ssh-sk-client.c b/ssh-sk-client.c
+index 321fe53..06fad22 100644
+--- a/ssh-sk-client.c
++++ b/ssh-sk-client.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: ssh-sk-client.c,v 1.12 2022/01/14 03:34:00 djm Exp $ */
++/* $OpenBSD: ssh-sk-client.c,v 1.13 2025/02/18 08:02:48 djm Exp $ */
+ /*
+ * Copyright (c) 2019 Google LLC
+ *
+@@ -439,6 +439,7 @@ sshsk_load_resident(const char *provider_path, const char *device,
+ }
+ if ((srk = calloc(1, sizeof(*srk))) == NULL) {
+ error_f("calloc failed");
++ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ srk->key = key;
+@@ -450,6 +451,7 @@ sshsk_load_resident(const char *provider_path, const char *device,
+ if ((tmp = recallocarray(srks, nsrks, nsrks + 1,
+ sizeof(*srks))) == NULL) {
+ error_f("recallocarray keys failed");
++ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ debug_f("srks[%zu]: %s %s uidlen %zu", nsrks,
+diff --git a/sshconnect2.c b/sshconnect2.c
+index fab1e36..a5f92f0 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -101,7 +101,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+ options.required_rsa_size)) != 0)
+ fatal_r(r, "Bad server host key");
+ if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
+- xxx_conn_info) == -1)
++ xxx_conn_info) != 0)
+ fatal("Host key verification failed.");
+ return 0;
+ }
+@@ -709,6 +709,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+
+ if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) {
+ debug_f("server sent unknown pkalg %s", pkalg);
++ r = SSH_ERR_INVALID_FORMAT;
+ goto done;
+ }
+ if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
+@@ -719,6 +720,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ error("input_userauth_pk_ok: type mismatch "
+ "for decoded key (received %d, expected %d)",
+ key->type, pktype);
++ r = SSH_ERR_INVALID_FORMAT;
+ goto done;
+ }
+
+@@ -738,6 +740,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ SSH_FP_DEFAULT);
+ error_f("server replied with unknown key: %s %s",
+ sshkey_type(key), fp == NULL ? "<ERROR>" : fp);
++ r = SSH_ERR_INVALID_FORMAT;
+ goto done;
+ }
+ ident = format_identity(id);
+diff --git a/sshsig.c b/sshsig.c
+index d50d65f..1b7f40d 100644
+--- a/sshsig.c
++++ b/sshsig.c
+@@ -874,6 +874,7 @@ cert_filter_principals(const char *path, u_long linenum,
+ }
+ if ((principals = sshbuf_dup_string(nprincipals)) == NULL) {
+ error_f("buffer error");
++ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ /* success */
+--
+2.40.0
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index ea5face097..6ae4c81a42 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -30,6 +30,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2024-39894.patch \
file://0001-Fix-missing-header-for-systemd-notification.patch \
file://CVE-2025-26466.patch \
+ file://CVE-2025-26465.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 02/28] ruby: Fix CVE-2025-27219
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 01/28] openssh: fix CVE-2025-26465 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 03/28] puzzles: ignore three new CVEs for a different puzzles Steve Sakoman
` (25 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Ashish Sharma <asharma@mvista.com>
Upstream-Status: Backport from [https://github.com/ruby/cgi/commit/9907b76dad0777ee300de236dad4b559e07596ab]
Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ruby/ruby/CVE-2025-27219.patch | 31 +++++++++++++++++++
meta/recipes-devtools/ruby/ruby_3.3.5.bb | 1 +
2 files changed, 32 insertions(+)
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2025-27219.patch
diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2025-27219.patch b/meta/recipes-devtools/ruby/ruby/CVE-2025-27219.patch
new file mode 100644
index 0000000000..7813a6143c
--- /dev/null
+++ b/meta/recipes-devtools/ruby/ruby/CVE-2025-27219.patch
@@ -0,0 +1,31 @@
+From 9907b76dad0777ee300de236dad4b559e07596ab Mon Sep 17 00:00:00 2001
+From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
+Date: Fri, 21 Feb 2025 16:01:17 +0900
+Subject: [PATCH] Use String#concat instead of String#+ for reducing cpu usage
+
+Co-authored-by: "Yusuke Endoh" <mame@ruby-lang.org>
+
+Upstream-Status: Backport [https://github.com/ruby/cgi/commit/9907b76dad0777ee300de236dad4b559e07596ab]
+CVE: CVE-2025-27219
+Signed-off-by: Ashish Sharma <asharma@mvista.com>
+
+ lib/cgi/cookie.rb | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/lib/cgi/cookie.rb b/lib/cgi/cookie.rb
+index 9498e2f..1c4ef6a 100644
+--- a/lib/cgi/cookie.rb
++++ b/lib/cgi/cookie.rb
+@@ -190,9 +190,10 @@ def self.parse(raw_cookie)
+ values ||= ""
+ values = values.split('&').collect{|v| CGI.unescape(v,@@accept_charset) }
+ if cookies.has_key?(name)
+- values = cookies[name].value + values
++ cookies[name].concat(values)
++ else
++ cookies[name] = Cookie.new(name, *values)
+ end
+- cookies[name] = Cookie.new(name, *values)
+ end
+
+ cookies
diff --git a/meta/recipes-devtools/ruby/ruby_3.3.5.bb b/meta/recipes-devtools/ruby/ruby_3.3.5.bb
index fb0d711765..4354107a85 100644
--- a/meta/recipes-devtools/ruby/ruby_3.3.5.bb
+++ b/meta/recipes-devtools/ruby/ruby_3.3.5.bb
@@ -26,6 +26,7 @@ SRC_URI = "http://cache.ruby-lang.org/pub/ruby/${SHRT_VER}/ruby-${PV}.tar.gz \
file://0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch \
file://0006-Make-gemspecs-reproducible.patch \
file://0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch \
+ file://CVE-2025-27219.patch \
"
UPSTREAM_CHECK_URI = "https://www.ruby-lang.org/en/downloads/"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 03/28] puzzles: ignore three new CVEs for a different puzzles
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 01/28] openssh: fix CVE-2025-26465 Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 02/28] ruby: Fix CVE-2025-27219 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 04/28] cve-check.bbclass: Mitigate symlink related error Steve Sakoman
` (24 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
As we just match on product by default, ignore three CVEs which are
for the "Puzzles" WordPress theme by ThemeREX (CPE themerex:puzzles).
(From OE-Core rev: 87326573c82ac1e8dc335319442236ef2341501e)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-sato/puzzles/puzzles_git.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-sato/puzzles/puzzles_git.bb b/meta/recipes-sato/puzzles/puzzles_git.bb
index e9403ee130..48886b3039 100644
--- a/meta/recipes-sato/puzzles/puzzles_git.bb
+++ b/meta/recipes-sato/puzzles/puzzles_git.bb
@@ -47,3 +47,6 @@ STOP
done
}
+CVE_STATUS[CVE-2024-13769] = "cpe-incorrect: issue in ThemeREX's Wordpress theme Puzzles"
+CVE_STATUS[CVE-2024-13770] = "cpe-incorrect: issue in ThemeREX's Wordpress theme Puzzles"
+CVE_STATUS[CVE-2025-0837] = "cpe-incorrect: issue in ThemeREX's Wordpress theme Puzzles"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 04/28] cve-check.bbclass: Mitigate symlink related error
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 03/28] puzzles: ignore three new CVEs for a different puzzles Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 05/28] grub: drop obsolete CVE statuses Steve Sakoman
` (23 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Niko Mauno <niko.mauno@vaisala.com>
According to Yocto reference manual, in description of the
IMAGE_LINK_NAME variable, it is said that
It is possible to set this to "" to disable symlink creation,
however, you also need to set :term:`IMAGE_NAME` to still have
a reasonable value e.g.::
IMAGE_LINK_NAME = ""
IMAGE_NAME = "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}${IMAGE_VERSION_SUFFIX}"
However, when using following additions in local.conf file:
INHERIT += "cve-check"
IMAGE_LINK_NAME = ""
IMAGE_NAME = "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}${IMAGE_VERSION_SUFFIX}"
the implicit symlink creation in cve_check_write_rootfs_manifest leads
to following build failure
$ bitbake core-image-minimal core-image-base
...
ERROR: core-image-base-1.0-r0 do_image_complete: Recipe core-image-base is trying to install files into a shared area when those files already exist. The files and the manifests listing them are:
/home/poky/build/tmp/deploy/images/qemux86-64/.json
(matched in manifest-qemux86_64-core-image-minimal.image_complete)
Please adjust the recipes so only one recipe provides a given file.
Mitigate the issue by creating the symlink only in case IMAGE_LINK_NAME
has not been set to empty string.
(From OE-Core rev: 64bfec359bd909761ce0a6a716286d938ed162d1)
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/cve-check.bbclass | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index ed219bf472..badfee550c 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -281,13 +281,15 @@ python cve_check_write_rootfs_manifest () {
if enable_json:
manifest_name_suffix = d.getVar("CVE_CHECK_MANIFEST_JSON_SUFFIX")
- link_path = os.path.join(deploy_dir, "%s.%s" % (link_name, manifest_name_suffix))
manifest_name = d.getVar("CVE_CHECK_MANIFEST_JSON")
with open(manifest_name, "w") as f:
json.dump(json_data, f, indent=2)
- update_symlinks(manifest_name, link_path)
+ if link_name:
+ link_path = os.path.join(deploy_dir, "%s.%s" % (link_name, manifest_name_suffix))
+ update_symlinks(manifest_name, link_path)
+
bb.plain("Image CVE JSON report stored in: %s" % manifest_name)
}
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 05/28] grub: drop obsolete CVE statuses
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 04/28] cve-check.bbclass: Mitigate symlink related error Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 06/28] grub: backport strlcpy function Steve Sakoman
` (22 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
CVE-2021-46705 was needed only with 2.06
CVE-2023-4692 and CVE-2023-4693 were fixed in NVD DB meanwhile
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-bsp/grub/grub2.inc | 3 ---
1 file changed, 3 deletions(-)
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 54c0e9bdd5..c160d15717 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -24,11 +24,8 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
CVE_STATUS[CVE-2019-14865] = "not-applicable-platform: applies only to RHEL"
-CVE_STATUS[CVE-2021-46705] = "not-applicable-platform: Applies only to SUSE"
CVE_STATUS[CVE-2023-4001] = "not-applicable-platform: Applies only to RHEL/Fedora"
CVE_STATUS[CVE-2024-1048] = "not-applicable-platform: Applies only to RHEL/Fedora"
-CVE_STATUS[CVE-2023-4692] = "cpe-incorrect: Fixed in version 2.12 already"
-CVE_STATUS[CVE-2023-4693] = "cpe-incorrect: Fixed in version 2.12 already"
DEPENDS = "flex-native bison-native gettext-native"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 06/28] grub: backport strlcpy function
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 05/28] grub: drop obsolete CVE statuses Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 07/28] grup: patch CVE-2024-45781 Steve Sakoman
` (21 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
It is used to fix multiple CVEs.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../0001-misc-Implement-grub_strlcpy.patch | 68 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 69 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch
diff --git a/meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch b/meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch
new file mode 100644
index 0000000000..0ff6dff33a
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch
@@ -0,0 +1,68 @@
+From ea703528a8581a2ea7e0bad424a70fdf0aec7d8f Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Sat, 15 Jun 2024 02:33:08 +0100
+Subject: [PATCH 1/2] misc: Implement grub_strlcpy()
+
+grub_strlcpy() acts the same way as strlcpy() does on most *NIX,
+returning the length of src and ensuring dest is always NUL
+terminated except when size is 0.
+
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ include/grub/misc.h | 39 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/include/grub/misc.h b/include/grub/misc.h
+index 1578f36c3..14d8f37ac 100644
+--- a/include/grub/misc.h
++++ b/include/grub/misc.h
+@@ -64,6 +64,45 @@ grub_stpcpy (char *dest, const char *src)
+ return d - 1;
+ }
+
++static inline grub_size_t
++grub_strlcpy (char *dest, const char *src, grub_size_t size)
++{
++ char *d = dest;
++ grub_size_t res = 0;
++ /*
++ * We do not subtract one from size here to avoid dealing with underflowing
++ * the value, which is why to_copy is always checked to be greater than one
++ * throughout this function.
++ */
++ grub_size_t to_copy = size;
++
++ /* Copy size - 1 bytes to dest. */
++ if (to_copy > 1)
++ while ((*d++ = *src++) != '\0' && ++res && --to_copy > 1)
++ ;
++
++ /*
++ * NUL terminate if size != 0. The previous step may have copied a NUL byte
++ * if it reached the end of the string, but we know dest[size - 1] must always
++ * be a NUL byte.
++ */
++ if (size != 0)
++ dest[size - 1] = '\0';
++
++ /* If there is still space in dest, but are here, we reached the end of src. */
++ if (to_copy > 1)
++ return res;
++
++ /*
++ * If we haven't reached the end of the string, iterate through to determine
++ * the strings total length.
++ */
++ while (*src++ != '\0' && ++res)
++ ;
++
++ return res;
++}
++
+ /* XXX: If grub_memmove is too slow, we must implement grub_memcpy. */
+ static inline void *
+ grub_memcpy (void *dest, const void *src, grub_size_t n)
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index c160d15717..f3279f7d2b 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -19,6 +19,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://grub-module-explicitly-keeps-symbole-.module_license.patch \
file://0001-grub.d-10_linux.in-add-oe-s-kernel-name.patch \
file://0001-RISC-V-Restore-the-typcast-to-long.patch \
+ file://0001-misc-Implement-grub_strlcpy.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 07/28] grup: patch CVE-2024-45781
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (5 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 06/28] grub: backport strlcpy function Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 08/28] grub: patch CVE-2024-45782 and CVE-2024-56737 Steve Sakoman
` (20 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../grub/files/CVE-2024-45781.patch | 35 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 36 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2024-45781.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45781.patch b/meta/recipes-bsp/grub/files/CVE-2024-45781.patch
new file mode 100644
index 0000000000..bd0b6aa04a
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45781.patch
@@ -0,0 +1,35 @@
+From c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Sun, 12 May 2024 02:03:33 +0100
+Subject: [PATCH 2/2] fs/ufs: Fix a heap OOB write
+
+grub_strcpy() was used to copy a symlink name from the filesystem
+image to a heap allocated buffer. This led to a OOB write to adjacent
+heap allocations. Fix by using grub_strlcpy().
+
+Fixes: CVE-2024-45781
+
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2024-45781
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/ufs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c
+index a354c92d9..01235101b 100644
+--- a/grub-core/fs/ufs.c
++++ b/grub-core/fs/ufs.c
+@@ -463,7 +463,7 @@ grub_ufs_lookup_symlink (struct grub_ufs_data *data, int ino)
+ /* Check against zero is paylindromic, no need to swap. */
+ if (data->inode.nblocks == 0
+ && INODE_SIZE (data) <= sizeof (data->inode.symlink))
+- grub_strcpy (symlink, (char *) data->inode.symlink);
++ grub_strlcpy (symlink, (char *) data->inode.symlink, sz);
+ else
+ {
+ if (grub_ufs_read_file (data, 0, 0, 0, sz, symlink) < 0)
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index f3279f7d2b..bace594ac4 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -20,6 +20,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://0001-grub.d-10_linux.in-add-oe-s-kernel-name.patch \
file://0001-RISC-V-Restore-the-typcast-to-long.patch \
file://0001-misc-Implement-grub_strlcpy.patch \
+ file://CVE-2024-45781.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 08/28] grub: patch CVE-2024-45782 and CVE-2024-56737
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (6 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 07/28] grup: patch CVE-2024-45781 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 09/28] grub: patch CVE-2024-45780 Steve Sakoman
` (19 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning these CVEs.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../files/CVE-2024-45782_CVE-2024-56737.patch | 36 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch b/meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch
new file mode 100644
index 0000000000..41cc025b81
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch
@@ -0,0 +1,36 @@
+From 417547c10410b714e43f08f74137c24015f8f4c3 Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Sun, 12 May 2024 02:48:33 +0100
+Subject: [PATCH] fs/hfs: Fix stack OOB write with grub_strcpy()
+
+Replaced with grub_strlcpy().
+
+Fixes: CVE-2024-45782
+Fixes: CVE-2024-56737
+Fixes: https://savannah.gnu.org/bugs/?66599
+
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2024-45782
+CVE: CVE-2024-56737
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=417547c10410b714e43f08f74137c24015f8f4c3]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/hfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c
+index 91dc0e69c..920112b03 100644
+--- a/grub-core/fs/hfs.c
++++ b/grub-core/fs/hfs.c
+@@ -379,7 +379,7 @@ grub_hfs_mount (grub_disk_t disk)
+ volume name. */
+ key.parent_dir = grub_cpu_to_be32_compile_time (1);
+ key.strlen = data->sblock.volname[0];
+- grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1));
++ grub_strlcpy ((char *) key.str, (char *) (data->sblock.volname + 1), sizeof (key.str));
+
+ if (grub_hfs_find_node (data, (char *) &key, data->cat_root,
+ 0, (char *) &dir, sizeof (dir)) == 0)
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index bace594ac4..8146ead5db 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -21,6 +21,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://0001-RISC-V-Restore-the-typcast-to-long.patch \
file://0001-misc-Implement-grub_strlcpy.patch \
file://CVE-2024-45781.patch \
+ file://CVE-2024-45782_CVE-2024-56737.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 09/28] grub: patch CVE-2024-45780
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (7 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 08/28] grub: patch CVE-2024-45782 and CVE-2024-56737 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 10/28] grub: patch CVE-2024-45783 Steve Sakoman
` (18 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../grub/files/CVE-2024-45780.patch | 93 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 94 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2024-45780.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45780.patch b/meta/recipes-bsp/grub/files/CVE-2024-45780.patch
new file mode 100644
index 0000000000..1de0099f94
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45780.patch
@@ -0,0 +1,93 @@
+From 0087bc6902182fe5cedce2d034c75a79cf6dd4f3 Mon Sep 17 00:00:00 2001
+From: Lidong Chen <lidong.chen@oracle.com>
+Date: Fri, 22 Nov 2024 06:27:58 +0000
+Subject: [PATCH] fs/tar: Integer overflow leads to heap OOB write
+
+Both namesize and linksize are derived from hd.size, a 12-digit octal
+number parsed by read_number(). Later direct arithmetic calculation like
+"namesize + 1" and "linksize + 1" may exceed the maximum value of
+grub_size_t leading to heap OOB write. This patch fixes the issue by
+using grub_add() and checking for an overflow.
+
+Fixes: CVE-2024-45780
+
+Reported-by: Nils Langius <nils@langius.de>
+Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
+
+CVE: CVE-2024-45780
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/tar.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c
+index 646bce5eb..386c09022 100644
+--- a/grub-core/fs/tar.c
++++ b/grub-core/fs/tar.c
+@@ -25,6 +25,7 @@
+ #include <grub/mm.h>
+ #include <grub/dl.h>
+ #include <grub/i18n.h>
++#include <grub/safemath.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -76,6 +77,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
+ {
+ struct head hd;
+ int reread = 0, have_longname = 0, have_longlink = 0;
++ grub_size_t sz;
+
+ data->hofs = data->next_hofs;
+
+@@ -97,7 +99,11 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
+ {
+ grub_err_t err;
+ grub_size_t namesize = read_number (hd.size, sizeof (hd.size));
+- *name = grub_malloc (namesize + 1);
++
++ if (grub_add (namesize, 1, &sz))
++ return grub_error (GRUB_ERR_BAD_FS, N_("name size overflow"));
++
++ *name = grub_malloc (sz);
+ if (*name == NULL)
+ return grub_errno;
+ err = grub_disk_read (data->disk, 0,
+@@ -117,15 +123,19 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
+ {
+ grub_err_t err;
+ grub_size_t linksize = read_number (hd.size, sizeof (hd.size));
+- if (data->linkname_alloc < linksize + 1)
++
++ if (grub_add (linksize, 1, &sz))
++ return grub_error (GRUB_ERR_BAD_FS, N_("link size overflow"));
++
++ if (data->linkname_alloc < sz)
+ {
+ char *n;
+- n = grub_calloc (2, linksize + 1);
++ n = grub_calloc (2, sz);
+ if (!n)
+ return grub_errno;
+ grub_free (data->linkname);
+ data->linkname = n;
+- data->linkname_alloc = 2 * (linksize + 1);
++ data->linkname_alloc = 2 * (sz);
+ }
+
+ err = grub_disk_read (data->disk, 0,
+@@ -148,7 +158,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
+ while (extra_size < sizeof (hd.prefix)
+ && hd.prefix[extra_size])
+ extra_size++;
+- *name = grub_malloc (sizeof (hd.name) + extra_size + 2);
++
++ if (grub_add (sizeof (hd.name) + 2, extra_size, &sz))
++ return grub_error (GRUB_ERR_BAD_FS, N_("long name size overflow"));
++ *name = grub_malloc (sz);
+ if (*name == NULL)
+ return grub_errno;
+ if (hd.prefix[0])
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 8146ead5db..6fa096c57b 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -22,6 +22,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://0001-misc-Implement-grub_strlcpy.patch \
file://CVE-2024-45781.patch \
file://CVE-2024-45782_CVE-2024-56737.patch \
+ file://CVE-2024-45780.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 10/28] grub: patch CVE-2024-45783
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (8 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 09/28] grub: patch CVE-2024-45780 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 11/28] grub: patch CVE-2025-0624 Steve Sakoman
` (17 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../grub/files/CVE-2024-45783.patch | 39 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 40 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2024-45783.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45783.patch b/meta/recipes-bsp/grub/files/CVE-2024-45783.patch
new file mode 100644
index 0000000000..99c769961b
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45783.patch
@@ -0,0 +1,39 @@
+From f7c070a2e28dfab7137db0739fb8db1dc02d8898 Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Sun, 12 May 2024 06:22:51 +0100
+Subject: [PATCH] fs/hfsplus: Set a grub_errno if mount fails
+
+It was possible for mount to fail but not set grub_errno. This led to
+a possible double decrement of the module reference count if the NULL
+page was mapped.
+
+Fixing in general as a similar bug was fixed in commit 61b13c187
+(fs/hfsplus: Set grub_errno to prevent NULL pointer access) and there
+are likely more variants around.
+
+Fixes: CVE-2024-45783
+
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2024-45783
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/hfsplus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c
+index 295822f69..de71fd486 100644
+--- a/grub-core/fs/hfsplus.c
++++ b/grub-core/fs/hfsplus.c
+@@ -405,7 +405,7 @@ grub_hfsplus_mount (grub_disk_t disk)
+
+ fail:
+
+- if (grub_errno == GRUB_ERR_OUT_OF_RANGE)
++ if (grub_errno == GRUB_ERR_OUT_OF_RANGE || grub_errno == GRUB_ERR_NONE)
+ grub_error (GRUB_ERR_BAD_FS, "not a HFS+ filesystem");
+
+ grub_free (data);
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 6fa096c57b..604c2fe568 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -23,6 +23,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2024-45781.patch \
file://CVE-2024-45782_CVE-2024-56737.patch \
file://CVE-2024-45780.patch \
+ file://CVE-2024-45783.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 11/28] grub: patch CVE-2025-0624
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (9 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 10/28] grub: patch CVE-2024-45783 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 12/28] grub: patch CVE-2024-45774 Steve Sakoman
` (16 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../grub/files/CVE-2025-0624.patch | 84 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 85 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-0624.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0624.patch b/meta/recipes-bsp/grub/files/CVE-2025-0624.patch
new file mode 100644
index 0000000000..229fe6399e
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0624.patch
@@ -0,0 +1,84 @@
+From 5eef88152833062a3f7e017535372d64ac8ef7e1 Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Fri, 15 Nov 2024 13:12:09 +0000
+Subject: [PATCH] net: Fix OOB write in grub_net_search_config_file()
+
+The function included a call to grub_strcpy() which copied data from an
+environment variable to a buffer allocated in grub_cmd_normal(). The
+grub_cmd_normal() didn't consider the length of the environment variable.
+So, the copy operation could exceed the allocation and lead to an OOB
+write. Fix the issue by replacing grub_strcpy() with grub_strlcpy() and
+pass the underlying buffers size to the grub_net_search_config_file().
+
+Fixes: CVE-2025-0624
+
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2025-0624
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=5eef88152833062a3f7e017535372d64ac8ef7e1]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/net/net.c | 7 ++++---
+ grub-core/normal/main.c | 2 +-
+ include/grub/net.h | 2 +-
+ 3 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/grub-core/net/net.c b/grub-core/net/net.c
+index 0e41e21a5..9939ff601 100644
+--- a/grub-core/net/net.c
++++ b/grub-core/net/net.c
+@@ -1909,14 +1909,15 @@ grub_config_search_through (char *config, char *suffix,
+ }
+
+ grub_err_t
+-grub_net_search_config_file (char *config)
++grub_net_search_config_file (char *config, grub_size_t config_buf_len)
+ {
+- grub_size_t config_len;
++ grub_size_t config_len, suffix_len;
+ char *suffix;
+
+ config_len = grub_strlen (config);
+ config[config_len] = '-';
+ suffix = config + config_len + 1;
++ suffix_len = config_buf_len - (config_len + 1);
+
+ struct grub_net_network_level_interface *inf;
+ FOR_NET_NETWORK_LEVEL_INTERFACES (inf)
+@@ -1942,7 +1943,7 @@ grub_net_search_config_file (char *config)
+
+ if (client_uuid)
+ {
+- grub_strcpy (suffix, client_uuid);
++ grub_strlcpy (suffix, client_uuid, suffix_len);
+ if (grub_config_search_through (config, suffix, 1, 0) == 0)
+ return GRUB_ERR_NONE;
+ }
+diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
+index 90879dc21..838f57fa5 100644
+--- a/grub-core/normal/main.c
++++ b/grub-core/normal/main.c
+@@ -344,7 +344,7 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)),
+
+ if (grub_strncmp (prefix + 1, "tftp", sizeof ("tftp") - 1) == 0 &&
+ !disable_net_search)
+- grub_net_search_config_file (config);
++ grub_net_search_config_file (config, config_len);
+
+ grub_enter_normal_mode (config);
+ grub_free (config);
+diff --git a/include/grub/net.h b/include/grub/net.h
+index 228d04963..58a4f83fc 100644
+--- a/include/grub/net.h
++++ b/include/grub/net.h
+@@ -579,7 +579,7 @@ void
+ grub_net_remove_dns_server (const struct grub_net_network_level_address *s);
+
+ grub_err_t
+-grub_net_search_config_file (char *config);
++grub_net_search_config_file (char *config, grub_size_t config_buf_len);
+
+ extern char *grub_net_default_server;
+
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 604c2fe568..9e037e953e 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -24,6 +24,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2024-45782_CVE-2024-56737.patch \
file://CVE-2024-45780.patch \
file://CVE-2024-45783.patch \
+ file://CVE-2025-0624.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 12/28] grub: patch CVE-2024-45774
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (10 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 11/28] grub: patch CVE-2025-0624 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 13/28] grub: patch CVE-2024-45775 Steve Sakoman
` (15 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../grub/files/CVE-2024-45774.patch | 37 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 38 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2024-45774.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45774.patch b/meta/recipes-bsp/grub/files/CVE-2024-45774.patch
new file mode 100644
index 0000000000..55aecc17d7
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45774.patch
@@ -0,0 +1,37 @@
+From 2c34af908ebf4856051ed29e46d88abd2b20387f Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Fri, 8 Mar 2024 22:47:20 +1100
+Subject: [PATCH] video/readers/jpeg: Do not permit duplicate SOF0 markers in
+ JPEG
+
+Otherwise a subsequent header could change the height and width
+allowing future OOB writes.
+
+Fixes: CVE-2024-45774
+
+Reported-by: Nils Langius <nils@langius.de>
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2024-45774
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2c34af908ebf4856051ed29e46d88abd2b20387f]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/video/readers/jpeg.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
+index ae634fd41..631a89356 100644
+--- a/grub-core/video/readers/jpeg.c
++++ b/grub-core/video/readers/jpeg.c
+@@ -339,6 +339,10 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data)
+ if (grub_errno != GRUB_ERR_NONE)
+ return grub_errno;
+
++ if (data->image_height != 0 || data->image_width != 0)
++ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
++ "jpeg: cannot have duplicate SOF0 markers");
++
+ if (grub_jpeg_get_byte (data) != 8)
+ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
+ "jpeg: only 8-bit precision is supported");
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 9e037e953e..4e13b0eb43 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -25,6 +25,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2024-45780.patch \
file://CVE-2024-45783.patch \
file://CVE-2025-0624.patch \
+ file://CVE-2024-45774.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 13/28] grub: patch CVE-2024-45775
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (11 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 12/28] grub: patch CVE-2024-45774 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 14/28] grub: patch CVE-2025-0622 Steve Sakoman
` (14 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../grub/files/CVE-2024-45775.patch | 38 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 39 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2024-45775.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45775.patch b/meta/recipes-bsp/grub/files/CVE-2024-45775.patch
new file mode 100644
index 0000000000..70492b8c2e
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45775.patch
@@ -0,0 +1,38 @@
+From 05be856a8c3aae41f5df90cab7796ab7ee34b872 Mon Sep 17 00:00:00 2001
+From: Lidong Chen <lidong.chen@oracle.com>
+Date: Fri, 22 Nov 2024 06:27:55 +0000
+Subject: [PATCH] commands/extcmd: Missing check for failed allocation
+
+The grub_extcmd_dispatcher() calls grub_arg_list_alloc() to allocate
+a grub_arg_list struct but it does not verify the allocation was successful.
+In case of failed allocation the NULL state pointer can be accessed in
+parse_option() through grub_arg_parse() which may lead to a security issue.
+
+Fixes: CVE-2024-45775
+
+Reported-by: Nils Langius <nils@langius.de>
+Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
+
+CVE: CVE-2024-45775
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/commands/extcmd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c
+index 90a5ca24a..c236be13a 100644
+--- a/grub-core/commands/extcmd.c
++++ b/grub-core/commands/extcmd.c
+@@ -49,6 +49,9 @@ grub_extcmd_dispatcher (struct grub_command *cmd, int argc, char **args,
+ }
+
+ state = grub_arg_list_alloc (ext, argc, args);
++ if (state == NULL)
++ return grub_errno;
++
+ if (grub_arg_parse (ext, argc, args, state, &new_args, &new_argc))
+ {
+ context.state = state;
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 4e13b0eb43..0378d5ee72 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -26,6 +26,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2024-45783.patch \
file://CVE-2025-0624.patch \
file://CVE-2024-45774.patch \
+ file://CVE-2024-45775.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 14/28] grub: patch CVE-2025-0622
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (12 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 13/28] grub: patch CVE-2024-45775 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 15/28] grub: patch CVE-2024-45776 Steve Sakoman
` (13 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../grub/files/CVE-2025-0622-01.patch | 35 ++++++++++++++++
.../grub/files/CVE-2025-0622-02.patch | 41 +++++++++++++++++++
.../grub/files/CVE-2025-0622-03.patch | 38 +++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 3 ++
4 files changed, 117 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch b/meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch
new file mode 100644
index 0000000000..09dbfce5f8
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch
@@ -0,0 +1,35 @@
+From 2123c5bca7e21fbeb0263df4597ddd7054700726 Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Fri, 1 Nov 2024 19:24:29 +0000
+Subject: [PATCH 1/3] commands/pgp: Unregister the "check_signatures" hooks on
+ module unload
+
+If the hooks are not removed they can be called after the module has
+been unloaded leading to an use-after-free.
+
+Fixes: CVE-2025-0622
+
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2025-0622
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2123c5bca7e21fbeb0263df4597ddd7054700726]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/commands/pgp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c
+index c6766f044..5fadc33c4 100644
+--- a/grub-core/commands/pgp.c
++++ b/grub-core/commands/pgp.c
+@@ -1010,6 +1010,8 @@ GRUB_MOD_INIT(pgp)
+
+ GRUB_MOD_FINI(pgp)
+ {
++ grub_register_variable_hook ("check_signatures", NULL, NULL);
++ grub_env_unset ("check_signatures");
+ grub_verifier_unregister (&grub_pubkey_verifier);
+ grub_unregister_extcmd (cmd);
+ grub_unregister_extcmd (cmd_trust);
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch b/meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch
new file mode 100644
index 0000000000..be01da3355
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch
@@ -0,0 +1,41 @@
+From 9c16197734ada8d0838407eebe081117799bfe67 Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Fri, 1 Nov 2024 23:46:55 +0000
+Subject: [PATCH 2/3] normal: Remove variables hooks on module unload
+
+The normal module does not entirely cleanup after itself in
+its GRUB_MOD_FINI() leaving a few variables hooks in place.
+It is not possible to unload normal module now but fix the
+issues for completeness.
+
+On the occasion replace 0s with NULLs for "pager" variable
+hooks unregister.
+
+Fixes: CVE-2025-0622
+
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2025-0622
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=9c16197734ada8d0838407eebe081117799bfe67]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/normal/main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
+index 838f57fa5..04d058f55 100644
+--- a/grub-core/normal/main.c
++++ b/grub-core/normal/main.c
+@@ -582,7 +582,9 @@ GRUB_MOD_FINI(normal)
+ grub_xputs = grub_xputs_saved;
+
+ grub_set_history (0);
+- grub_register_variable_hook ("pager", 0, 0);
++ grub_register_variable_hook ("pager", NULL, NULL);
++ grub_register_variable_hook ("color_normal", NULL, NULL);
++ grub_register_variable_hook ("color_highlight", NULL, NULL);
+ grub_fs_autoload_hook = 0;
+ grub_unregister_command (cmd_clear);
+ }
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch b/meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch
new file mode 100644
index 0000000000..79078a4350
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch
@@ -0,0 +1,38 @@
+From 7580addfc8c94cedb0cdfd7a1fd65b539215e637 Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Fri, 1 Nov 2024 23:52:06 +0000
+Subject: [PATCH 3/3] gettext: Remove variables hooks on module unload
+
+The gettext module does not entirely cleanup after itself in
+its GRUB_MOD_FINI() leaving a few variables hooks in place.
+It is not possible to unload gettext module because normal
+module depends on it. Though fix the issues for completeness.
+
+Fixes: CVE-2025-0622
+
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2025-0622
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/gettext/gettext.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
+index 7a1c14e4f..e4f4f8ee6 100644
+--- a/grub-core/gettext/gettext.c
++++ b/grub-core/gettext/gettext.c
+@@ -535,6 +535,10 @@ GRUB_MOD_INIT (gettext)
+
+ GRUB_MOD_FINI (gettext)
+ {
++ grub_register_variable_hook ("locale_dir", NULL, NULL);
++ grub_register_variable_hook ("secondary_locale_dir", NULL, NULL);
++ grub_register_variable_hook ("lang", NULL, NULL);
++
+ grub_gettext_delete_list (&main_context);
+ grub_gettext_delete_list (&secondary_context);
+
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 0378d5ee72..3c8860948c 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -27,6 +27,9 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2025-0624.patch \
file://CVE-2024-45774.patch \
file://CVE-2024-45775.patch \
+ file://CVE-2025-0622-01.patch \
+ file://CVE-2025-0622-02.patch \
+ file://CVE-2025-0622-03.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 15/28] grub: patch CVE-2024-45776
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (13 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 14/28] grub: patch CVE-2025-0622 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 16/28] grub: patch CVE-2024-45777 Steve Sakoman
` (12 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../grub/files/CVE-2024-45776.patch | 39 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 40 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2024-45776.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45776.patch b/meta/recipes-bsp/grub/files/CVE-2024-45776.patch
new file mode 100644
index 0000000000..8deea958b8
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45776.patch
@@ -0,0 +1,39 @@
+From 09bd6eb58b0f71ec273916070fa1e2de16897a91 Mon Sep 17 00:00:00 2001
+From: Lidong Chen <lidong.chen@oracle.com>
+Date: Fri, 22 Nov 2024 06:27:56 +0000
+Subject: [PATCH] gettext: Integer overflow leads to heap OOB write or read
+
+Calculation of ctx->grub_gettext_msg_list size in grub_mofile_open() may
+overflow leading to subsequent OOB write or read. This patch fixes the
+issue by replacing grub_zalloc() and explicit multiplication with
+grub_calloc() which does the same thing in safe manner.
+
+Fixes: CVE-2024-45776
+
+Reported-by: Nils Langius <nils@langius.de>
+Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
+
+CVE: CVE-2024-45776
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/gettext/gettext.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
+index e4f4f8ee6..63bb1ab73 100644
+--- a/grub-core/gettext/gettext.c
++++ b/grub-core/gettext/gettext.c
+@@ -323,8 +323,8 @@ grub_mofile_open (struct grub_gettext_context *ctx,
+ for (ctx->grub_gettext_max_log = 0; ctx->grub_gettext_max >> ctx->grub_gettext_max_log;
+ ctx->grub_gettext_max_log++);
+
+- ctx->grub_gettext_msg_list = grub_zalloc (ctx->grub_gettext_max
+- * sizeof (ctx->grub_gettext_msg_list[0]));
++ ctx->grub_gettext_msg_list = grub_calloc (ctx->grub_gettext_max,
++ sizeof (ctx->grub_gettext_msg_list[0]));
+ if (!ctx->grub_gettext_msg_list)
+ {
+ grub_file_close (fd);
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 3c8860948c..e4dca6613c 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -30,6 +30,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2025-0622-01.patch \
file://CVE-2025-0622-02.patch \
file://CVE-2025-0622-03.patch \
+ file://CVE-2024-45776.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 16/28] grub: patch CVE-2024-45777
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (14 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 15/28] grub: patch CVE-2024-45776 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 17/28] grub: patch CVE-2025-0690 Steve Sakoman
` (11 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../grub/files/CVE-2024-45777.patch | 57 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 58 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2024-45777.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45777.patch b/meta/recipes-bsp/grub/files/CVE-2024-45777.patch
new file mode 100644
index 0000000000..0305a95fd5
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45777.patch
@@ -0,0 +1,57 @@
+From b970a5ed967816bbca8225994cd0ee2557bad515 Mon Sep 17 00:00:00 2001
+From: Lidong Chen <lidong.chen@oracle.com>
+Date: Fri, 22 Nov 2024 06:27:57 +0000
+Subject: [PATCH] gettext: Integer overflow leads to heap OOB write
+
+The size calculation of the translation buffer in
+grub_gettext_getstr_from_position() may overflow
+to 0 leading to heap OOB write. This patch fixes
+the issue by using grub_add() and checking for
+an overflow.
+
+Fixes: CVE-2024-45777
+
+Reported-by: Nils Langius <nils@langius.de>
+Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
+
+CVE: CVE-2024-45777
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=b970a5ed967816bbca8225994cd0ee2557bad515]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/gettext/gettext.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
+index 63bb1ab73..9ffc73428 100644
+--- a/grub-core/gettext/gettext.c
++++ b/grub-core/gettext/gettext.c
+@@ -26,6 +26,7 @@
+ #include <grub/file.h>
+ #include <grub/kernel.h>
+ #include <grub/i18n.h>
++#include <grub/safemath.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -99,6 +100,7 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx,
+ char *translation;
+ struct string_descriptor desc;
+ grub_err_t err;
++ grub_size_t alloc_sz;
+
+ internal_position = (off + position * sizeof (desc));
+
+@@ -109,7 +111,10 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx,
+ length = grub_cpu_to_le32 (desc.length);
+ offset = grub_cpu_to_le32 (desc.offset);
+
+- translation = grub_malloc (length + 1);
++ if (grub_add (length, 1, &alloc_sz))
++ return NULL;
++
++ translation = grub_malloc (alloc_sz);
+ if (!translation)
+ return NULL;
+
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index e4dca6613c..fb33c2bd98 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -31,6 +31,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2025-0622-02.patch \
file://CVE-2025-0622-03.patch \
file://CVE-2024-45776.patch \
+ file://CVE-2024-45777.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 17/28] grub: patch CVE-2025-0690
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (15 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 16/28] grub: patch CVE-2024-45777 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 18/28] grub: patch CVE-2025-1118 Steve Sakoman
` (10 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../grub/files/CVE-2025-0690.patch | 73 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 74 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-0690.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0690.patch b/meta/recipes-bsp/grub/files/CVE-2025-0690.patch
new file mode 100644
index 0000000000..be585c96ad
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0690.patch
@@ -0,0 +1,73 @@
+From dad8f502974ed9ad0a70ae6820d17b4b142558fc Mon Sep 17 00:00:00 2001
+From: Jonathan Bar Or <jonathanbaror@gmail.com>
+Date: Thu, 23 Jan 2025 19:17:05 +0100
+Subject: [PATCH] commands/read: Fix an integer overflow when supplying more
+ than 2^31 characters
+
+The grub_getline() function currently has a signed integer variable "i"
+that can be overflown when user supplies more than 2^31 characters.
+It results in a memory corruption of the allocated line buffer as well
+as supplying large negative values to grub_realloc().
+
+Fixes: CVE-2025-0690
+
+Reported-by: Jonathan Bar Or <jonathanbaror@gmail.com>
+Signed-off-by: Jonathan Bar Or <jonathanbaror@gmail.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2025-0690
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/commands/read.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/grub-core/commands/read.c b/grub-core/commands/read.c
+index 597c90706..8d72e45c9 100644
+--- a/grub-core/commands/read.c
++++ b/grub-core/commands/read.c
+@@ -25,6 +25,7 @@
+ #include <grub/types.h>
+ #include <grub/extcmd.h>
+ #include <grub/i18n.h>
++#include <grub/safemath.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -37,13 +38,14 @@ static const struct grub_arg_option options[] =
+ static char *
+ grub_getline (int silent)
+ {
+- int i;
++ grub_size_t i;
+ char *line;
+ char *tmp;
+ int c;
++ grub_size_t alloc_size;
+
+ i = 0;
+- line = grub_malloc (1 + i + sizeof('\0'));
++ line = grub_malloc (1 + sizeof('\0'));
+ if (! line)
+ return NULL;
+
+@@ -59,8 +61,17 @@ grub_getline (int silent)
+ line[i] = (char) c;
+ if (!silent)
+ grub_printf ("%c", c);
+- i++;
+- tmp = grub_realloc (line, 1 + i + sizeof('\0'));
++ if (grub_add (i, 1, &i))
++ {
++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
++ return NULL;
++ }
++ if (grub_add (i, 1 + sizeof('\0'), &alloc_size))
++ {
++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
++ return NULL;
++ }
++ tmp = grub_realloc (line, alloc_size);
+ if (! tmp)
+ {
+ grub_free (line);
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index fb33c2bd98..af6f434c5f 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -32,6 +32,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2025-0622-03.patch \
file://CVE-2024-45776.patch \
file://CVE-2024-45777.patch \
+ file://CVE-2025-0690.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 18/28] grub: patch CVE-2025-1118
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (16 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 17/28] grub: patch CVE-2025-0690 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 19/28] grub: patch CVE-2024-45778 and CVE-2024-45779 Steve Sakoman
` (9 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../grub/files/CVE-2025-1118.patch | 37 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 38 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-1118.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-1118.patch b/meta/recipes-bsp/grub/files/CVE-2025-1118.patch
new file mode 100644
index 0000000000..e6906d909c
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-1118.patch
@@ -0,0 +1,37 @@
+From 34824806ac6302f91e8cabaa41308eaced25725f Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Thu, 18 Apr 2024 20:29:39 +0100
+Subject: [PATCH] commands/minicmd: Block the dump command in lockdown mode
+
+The dump enables a user to read memory which should not be possible
+in lockdown mode.
+
+Fixes: CVE-2025-1118
+
+Reported-by: B Horn <b@horn.uk>
+Reported-by: Jonathan Bar Or <jonathanbaror@gmail.com>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2025-1118
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=34824806ac6302f91e8cabaa41308eaced25725f]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/commands/minicmd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c
+index 286290866..8c5ee3e60 100644
+--- a/grub-core/commands/minicmd.c
++++ b/grub-core/commands/minicmd.c
+@@ -203,8 +203,8 @@ GRUB_MOD_INIT(minicmd)
+ grub_register_command ("help", grub_mini_cmd_help,
+ 0, N_("Show this message."));
+ cmd_dump =
+- grub_register_command ("dump", grub_mini_cmd_dump,
+- N_("ADDR [SIZE]"), N_("Show memory contents."));
++ grub_register_command_lockdown ("dump", grub_mini_cmd_dump,
++ N_("ADDR [SIZE]"), N_("Show memory contents."));
+ cmd_rmmod =
+ grub_register_command ("rmmod", grub_mini_cmd_rmmod,
+ N_("MODULE"), N_("Remove a module."));
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index af6f434c5f..dbceaf9931 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -33,6 +33,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2024-45776.patch \
file://CVE-2024-45777.patch \
file://CVE-2025-0690.patch \
+ file://CVE-2025-1118.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 19/28] grub: patch CVE-2024-45778 and CVE-2024-45779
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (17 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 18/28] grub: patch CVE-2025-1118 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 20/28] grub: patch CVE-2025-0677, CVE-2025-0684, CVE-2025-0685, CVE-2025-0686 and CVE-2025-0689 Steve Sakoman
` (8 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning these CVEs.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../files/CVE-2024-45778_CVE-2024-45779.patch | 55 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 56 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch b/meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch
new file mode 100644
index 0000000000..eba013897f
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch
@@ -0,0 +1,55 @@
+From 26db6605036bd9e5b16d9068a8cc75be63b8b630 Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Sat, 23 Mar 2024 15:59:43 +1100
+Subject: [PATCH] fs/bfs: Disable under lockdown
+
+The BFS is not fuzz-clean. Don't allow it to be loaded under lockdown.
+This will also disable the AFS.
+
+Fixes: CVE-2024-45778
+Fixes: CVE-2024-45779
+
+Reported-by: Nils Langius <nils@langius.de>
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2024-45778
+CVE: CVE-2024-45779
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/bfs.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c
+index 022f69fe2..78aeb051f 100644
+--- a/grub-core/fs/bfs.c
++++ b/grub-core/fs/bfs.c
+@@ -30,6 +30,7 @@
+ #include <grub/types.h>
+ #include <grub/i18n.h>
+ #include <grub/fshelp.h>
++#include <grub/lockdown.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -1106,7 +1107,10 @@ GRUB_MOD_INIT (bfs)
+ {
+ COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE ==
+ sizeof (struct grub_bfs_extent));
+- grub_fs_register (&grub_bfs_fs);
++ if (!grub_is_lockdown ())
++ {
++ grub_fs_register (&grub_bfs_fs);
++ }
+ }
+
+ #ifdef MODE_AFS
+@@ -1115,5 +1119,6 @@ GRUB_MOD_FINI (afs)
+ GRUB_MOD_FINI (bfs)
+ #endif
+ {
+- grub_fs_unregister (&grub_bfs_fs);
++ if (!grub_is_lockdown ())
++ grub_fs_unregister (&grub_bfs_fs);
+ }
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index dbceaf9931..ef16242ed3 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -34,6 +34,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2024-45777.patch \
file://CVE-2025-0690.patch \
file://CVE-2025-1118.patch \
+ file://CVE-2024-45778_CVE-2024-45779.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 20/28] grub: patch CVE-2025-0677, CVE-2025-0684, CVE-2025-0685, CVE-2025-0686 and CVE-2025-0689
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (18 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 19/28] grub: patch CVE-2024-45778 and CVE-2024-45779 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 21/28] grub: patch CVE-2025-0678 and CVE-2025-1125 Steve Sakoman
` (7 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning these CVEs.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...025-0685_CVE-2025-0686_CVE-2025-0689.patch | 377 ++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 378 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch b/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch
new file mode 100644
index 0000000000..d5563cecc4
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch
@@ -0,0 +1,377 @@
+From 47b2dfc7953f70f98ddf35dfdd6e7f4f20283b10 Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Sat, 23 Mar 2024 16:20:45 +1100
+Subject: [PATCH] fs: Disable many filesystems under lockdown
+
+The idea is to permit the following: btrfs, cpio, exfat, ext, f2fs, fat,
+hfsplus, iso9660, squash4, tar, xfs and zfs.
+
+The JFS, ReiserFS, romfs, UDF and UFS security vulnerabilities were
+reported by Jonathan Bar Or <jonathanbaror@gmail.com>.
+
+Fixes: CVE-2025-0677
+Fixes: CVE-2025-0684
+Fixes: CVE-2025-0685
+Fixes: CVE-2025-0686
+Fixes: CVE-2025-0689
+
+Suggested-by: Daniel Axtens <dja@axtens.net>
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2025-0677
+CVE: CVE-2025-0684
+CVE: CVE-2025-0685
+CVE: CVE-2025-0686
+CVE: CVE-2025-0689
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=47b2dfc7953f70f98ddf35dfdd6e7f4f20283b10]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/affs.c | 9 +++++++--
+ grub-core/fs/cbfs.c | 9 +++++++--
+ grub-core/fs/jfs.c | 9 +++++++--
+ grub-core/fs/minix.c | 9 +++++++--
+ grub-core/fs/nilfs2.c | 9 +++++++--
+ grub-core/fs/ntfs.c | 9 +++++++--
+ grub-core/fs/reiserfs.c | 9 +++++++--
+ grub-core/fs/romfs.c | 9 +++++++--
+ grub-core/fs/sfs.c | 9 +++++++--
+ grub-core/fs/udf.c | 9 +++++++--
+ grub-core/fs/ufs.c | 9 +++++++--
+ 11 files changed, 77 insertions(+), 22 deletions(-)
+
+diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c
+index ed606b3f1..352f5d232 100644
+--- a/grub-core/fs/affs.c
++++ b/grub-core/fs/affs.c
+@@ -26,6 +26,7 @@
+ #include <grub/types.h>
+ #include <grub/fshelp.h>
+ #include <grub/charset.h>
++#include <grub/lockdown.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -703,11 +704,15 @@ static struct grub_fs grub_affs_fs =
+
+ GRUB_MOD_INIT(affs)
+ {
+- grub_fs_register (&grub_affs_fs);
++ if (!grub_is_lockdown ())
++ {
++ grub_fs_register (&grub_affs_fs);
++ }
+ my_mod = mod;
+ }
+
+ GRUB_MOD_FINI(affs)
+ {
+- grub_fs_unregister (&grub_affs_fs);
++ if (!grub_is_lockdown ())
++ grub_fs_unregister (&grub_affs_fs);
+ }
+diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c
+index 8ab7106af..f6349df34 100644
+--- a/grub-core/fs/cbfs.c
++++ b/grub-core/fs/cbfs.c
+@@ -26,6 +26,7 @@
+ #include <grub/dl.h>
+ #include <grub/i18n.h>
+ #include <grub/cbfs_core.h>
++#include <grub/lockdown.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -390,12 +391,16 @@ GRUB_MOD_INIT (cbfs)
+ #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN)
+ init_cbfsdisk ();
+ #endif
+- grub_fs_register (&grub_cbfs_fs);
++ if (!grub_is_lockdown ())
++ {
++ grub_fs_register (&grub_cbfs_fs);
++ }
+ }
+
+ GRUB_MOD_FINI (cbfs)
+ {
+- grub_fs_unregister (&grub_cbfs_fs);
++ if (!grub_is_lockdown ())
++ grub_fs_unregister (&grub_cbfs_fs);
+ #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN)
+ fini_cbfsdisk ();
+ #endif
+diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
+index 6f7c43904..c0bbab8a9 100644
+--- a/grub-core/fs/jfs.c
++++ b/grub-core/fs/jfs.c
+@@ -26,6 +26,7 @@
+ #include <grub/types.h>
+ #include <grub/charset.h>
+ #include <grub/i18n.h>
++#include <grub/lockdown.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -963,11 +964,15 @@ static struct grub_fs grub_jfs_fs =
+
+ GRUB_MOD_INIT(jfs)
+ {
+- grub_fs_register (&grub_jfs_fs);
++ if (!grub_is_lockdown ())
++ {
++ grub_fs_register (&grub_jfs_fs);
++ }
+ my_mod = mod;
+ }
+
+ GRUB_MOD_FINI(jfs)
+ {
+- grub_fs_unregister (&grub_jfs_fs);
++ if (!grub_is_lockdown ())
++ grub_fs_unregister (&grub_jfs_fs);
+ }
+diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c
+index 5354951d1..c267298b5 100644
+--- a/grub-core/fs/minix.c
++++ b/grub-core/fs/minix.c
+@@ -25,6 +25,7 @@
+ #include <grub/dl.h>
+ #include <grub/types.h>
+ #include <grub/i18n.h>
++#include <grub/lockdown.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -734,7 +735,10 @@ GRUB_MOD_INIT(minix)
+ #endif
+ #endif
+ {
+- grub_fs_register (&grub_minix_fs);
++ if (!grub_is_lockdown ())
++ {
++ grub_fs_register (&grub_minix_fs);
++ }
+ my_mod = mod;
+ }
+
+@@ -756,5 +760,6 @@ GRUB_MOD_FINI(minix)
+ #endif
+ #endif
+ {
+- grub_fs_unregister (&grub_minix_fs);
++ if (!grub_is_lockdown ())
++ grub_fs_unregister (&grub_minix_fs);
+ }
+diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c
+index fc7374ead..08abf173f 100644
+--- a/grub-core/fs/nilfs2.c
++++ b/grub-core/fs/nilfs2.c
+@@ -34,6 +34,7 @@
+ #include <grub/dl.h>
+ #include <grub/types.h>
+ #include <grub/fshelp.h>
++#include <grub/lockdown.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -1231,11 +1232,15 @@ GRUB_MOD_INIT (nilfs2)
+ grub_nilfs2_dat_entry));
+ COMPILE_TIME_ASSERT (1 << LOG_INODE_SIZE
+ == sizeof (struct grub_nilfs2_inode));
+- grub_fs_register (&grub_nilfs2_fs);
++ if (!grub_is_lockdown ())
++ {
++ grub_fs_register (&grub_nilfs2_fs);
++ }
+ my_mod = mod;
+ }
+
+ GRUB_MOD_FINI (nilfs2)
+ {
+- grub_fs_unregister (&grub_nilfs2_fs);
++ if (!grub_is_lockdown ())
++ grub_fs_unregister (&grub_nilfs2_fs);
+ }
+diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
+index de435aa14..8cc2ba3d5 100644
+--- a/grub-core/fs/ntfs.c
++++ b/grub-core/fs/ntfs.c
+@@ -27,6 +27,7 @@
+ #include <grub/fshelp.h>
+ #include <grub/ntfs.h>
+ #include <grub/charset.h>
++#include <grub/lockdown.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -1320,11 +1321,15 @@ static struct grub_fs grub_ntfs_fs =
+
+ GRUB_MOD_INIT (ntfs)
+ {
+- grub_fs_register (&grub_ntfs_fs);
++ if (!grub_is_lockdown ())
++ {
++ grub_fs_register (&grub_ntfs_fs);
++ }
+ my_mod = mod;
+ }
+
+ GRUB_MOD_FINI (ntfs)
+ {
+- grub_fs_unregister (&grub_ntfs_fs);
++ if (!grub_is_lockdown ())
++ grub_fs_unregister (&grub_ntfs_fs);
+ }
+diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c
+index 36b26ac98..cdef2eba0 100644
+--- a/grub-core/fs/reiserfs.c
++++ b/grub-core/fs/reiserfs.c
+@@ -39,6 +39,7 @@
+ #include <grub/types.h>
+ #include <grub/fshelp.h>
+ #include <grub/i18n.h>
++#include <grub/lockdown.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -1417,11 +1418,15 @@ static struct grub_fs grub_reiserfs_fs =
+
+ GRUB_MOD_INIT(reiserfs)
+ {
+- grub_fs_register (&grub_reiserfs_fs);
++ if (!grub_is_lockdown ())
++ {
++ grub_fs_register (&grub_reiserfs_fs);
++ }
+ my_mod = mod;
+ }
+
+ GRUB_MOD_FINI(reiserfs)
+ {
+- grub_fs_unregister (&grub_reiserfs_fs);
++ if (!grub_is_lockdown ())
++ grub_fs_unregister (&grub_reiserfs_fs);
+ }
+diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c
+index 1f7dcfca1..acf8dd21e 100644
+--- a/grub-core/fs/romfs.c
++++ b/grub-core/fs/romfs.c
+@@ -23,6 +23,7 @@
+ #include <grub/disk.h>
+ #include <grub/fs.h>
+ #include <grub/fshelp.h>
++#include <grub/lockdown.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -475,10 +476,14 @@ static struct grub_fs grub_romfs_fs =
+
+ GRUB_MOD_INIT(romfs)
+ {
+- grub_fs_register (&grub_romfs_fs);
++ if (!grub_is_lockdown ())
++ {
++ grub_fs_register (&grub_romfs_fs);
++ }
+ }
+
+ GRUB_MOD_FINI(romfs)
+ {
+- grub_fs_unregister (&grub_romfs_fs);
++ if (!grub_is_lockdown ())
++ grub_fs_unregister (&grub_romfs_fs);
+ }
+diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c
+index 983e88008..f64bdd2df 100644
+--- a/grub-core/fs/sfs.c
++++ b/grub-core/fs/sfs.c
+@@ -26,6 +26,7 @@
+ #include <grub/types.h>
+ #include <grub/fshelp.h>
+ #include <grub/charset.h>
++#include <grub/lockdown.h>
+ #include <grub/safemath.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+@@ -779,11 +780,15 @@ static struct grub_fs grub_sfs_fs =
+
+ GRUB_MOD_INIT(sfs)
+ {
+- grub_fs_register (&grub_sfs_fs);
++ if (!grub_is_lockdown ())
++ {
++ grub_fs_register (&grub_sfs_fs);
++ }
+ my_mod = mod;
+ }
+
+ GRUB_MOD_FINI(sfs)
+ {
+- grub_fs_unregister (&grub_sfs_fs);
++ if (!grub_is_lockdown ())
++ grub_fs_unregister (&grub_sfs_fs);
+ }
+diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
+index b836e6107..a60643be1 100644
+--- a/grub-core/fs/udf.c
++++ b/grub-core/fs/udf.c
+@@ -27,6 +27,7 @@
+ #include <grub/fshelp.h>
+ #include <grub/charset.h>
+ #include <grub/datetime.h>
++#include <grub/lockdown.h>
+ #include <grub/udf.h>
+ #include <grub/safemath.h>
+
+@@ -1455,11 +1456,15 @@ static struct grub_fs grub_udf_fs = {
+
+ GRUB_MOD_INIT (udf)
+ {
+- grub_fs_register (&grub_udf_fs);
++ if (!grub_is_lockdown ())
++ {
++ grub_fs_register (&grub_udf_fs);
++ }
+ my_mod = mod;
+ }
+
+ GRUB_MOD_FINI (udf)
+ {
+- grub_fs_unregister (&grub_udf_fs);
++ if (!grub_is_lockdown ())
++ grub_fs_unregister (&grub_udf_fs);
+ }
+diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c
+index 01235101b..6b496e7b8 100644
+--- a/grub-core/fs/ufs.c
++++ b/grub-core/fs/ufs.c
+@@ -25,6 +25,7 @@
+ #include <grub/dl.h>
+ #include <grub/types.h>
+ #include <grub/i18n.h>
++#include <grub/lockdown.h>
+
+ GRUB_MOD_LICENSE ("GPLv3+");
+
+@@ -899,7 +900,10 @@ GRUB_MOD_INIT(ufs1)
+ #endif
+ #endif
+ {
+- grub_fs_register (&grub_ufs_fs);
++ if (!grub_is_lockdown ())
++ {
++ grub_fs_register (&grub_ufs_fs);
++ }
+ my_mod = mod;
+ }
+
+@@ -913,6 +917,7 @@ GRUB_MOD_FINI(ufs1)
+ #endif
+ #endif
+ {
+- grub_fs_unregister (&grub_ufs_fs);
++ if (!grub_is_lockdown ())
++ grub_fs_unregister (&grub_ufs_fs);
+ }
+
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index ef16242ed3..f34b5ee50e 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -35,6 +35,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2025-0690.patch \
file://CVE-2025-1118.patch \
file://CVE-2024-45778_CVE-2024-45779.patch \
+ file://CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 21/28] grub: patch CVE-2025-0678 and CVE-2025-1125
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (19 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 20/28] grub: patch CVE-2025-0677, CVE-2025-0684, CVE-2025-0685, CVE-2025-0686 and CVE-2025-0689 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 22/28] vim: Upgrade 9.1.1043 -> 9.1.1115 Steve Sakoman
` (6 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Cherry-pick patch mentioning these CVEs.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../files/CVE-2025-0678_CVE-2025-1125.patch | 87 +++++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
2 files changed, 88 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch b/meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch
new file mode 100644
index 0000000000..14e67cf35b
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch
@@ -0,0 +1,87 @@
+From 84bc0a9a68835952ae69165c11709811dae7634e Mon Sep 17 00:00:00 2001
+From: Lidong Chen <lidong.chen@oracle.com>
+Date: Tue, 21 Jan 2025 19:02:37 +0000
+Subject: [PATCH] fs: Prevent overflows when allocating memory for arrays
+
+Use grub_calloc() when allocating memory for arrays to ensure proper
+overflow checks are in place.
+
+The HFS+ and squash4 security vulnerabilities were reported by
+Jonathan Bar Or <jonathanbaror@gmail.com>.
+
+Fixes: CVE-2025-0678
+Fixes: CVE-2025-1125
+
+Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+
+CVE: CVE-2025-0678
+CVE: CVE-2025-1125
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=84bc0a9a68835952ae69165c11709811dae7634e]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/btrfs.c | 4 ++--
+ grub-core/fs/hfspluscomp.c | 9 +++++++--
+ grub-core/fs/squash4.c | 8 ++++----
+ 3 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
+index 0625b1166..9c1e925c9 100644
+--- a/grub-core/fs/btrfs.c
++++ b/grub-core/fs/btrfs.c
+@@ -1276,8 +1276,8 @@ grub_btrfs_mount (grub_device_t dev)
+ }
+
+ data->n_devices_allocated = 16;
+- data->devices_attached = grub_malloc (sizeof (data->devices_attached[0])
+- * data->n_devices_allocated);
++ data->devices_attached = grub_calloc (data->n_devices_allocated,
++ sizeof (data->devices_attached[0]));
+ if (!data->devices_attached)
+ {
+ grub_free (data);
+diff --git a/grub-core/fs/hfspluscomp.c b/grub-core/fs/hfspluscomp.c
+index 48ae438d8..a80954ee6 100644
+--- a/grub-core/fs/hfspluscomp.c
++++ b/grub-core/fs/hfspluscomp.c
+@@ -244,14 +244,19 @@ hfsplus_open_compressed_real (struct grub_hfsplus_file *node)
+ return 0;
+ }
+ node->compress_index_size = grub_le_to_cpu32 (index_size);
+- node->compress_index = grub_malloc (node->compress_index_size
+- * sizeof (node->compress_index[0]));
++ node->compress_index = grub_calloc (node->compress_index_size,
++ sizeof (node->compress_index[0]));
+ if (!node->compress_index)
+ {
+ node->compressed = 0;
+ grub_free (attr_node);
+ return grub_errno;
+ }
++
++ /*
++ * The node->compress_index_size * sizeof (node->compress_index[0]) is safe here
++ * due to relevant checks done in grub_calloc() above.
++ */
+ if (grub_hfsplus_read_file (node, 0, 0,
+ 0x104 + sizeof (index_size),
+ node->compress_index_size
+diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c
+index f91ff3bfa..cf2bca822 100644
+--- a/grub-core/fs/squash4.c
++++ b/grub-core/fs/squash4.c
+@@ -816,10 +816,10 @@ direct_read (struct grub_squash_data *data,
+ break;
+ }
+ total_blocks = ((total_size + data->blksz - 1) >> data->log2_blksz);
+- ino->block_sizes = grub_malloc (total_blocks
+- * sizeof (ino->block_sizes[0]));
+- ino->cumulated_block_sizes = grub_malloc (total_blocks
+- * sizeof (ino->cumulated_block_sizes[0]));
++ ino->block_sizes = grub_calloc (total_blocks,
++ sizeof (ino->block_sizes[0]));
++ ino->cumulated_block_sizes = grub_calloc (total_blocks,
++ sizeof (ino->cumulated_block_sizes[0]));
+ if (!ino->block_sizes || !ino->cumulated_block_sizes)
+ {
+ grub_free (ino->block_sizes);
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index f34b5ee50e..7c83febaa2 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -36,6 +36,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2025-1118.patch \
file://CVE-2024-45778_CVE-2024-45779.patch \
file://CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch \
+ file://CVE-2025-0678_CVE-2025-1125.patch \
"
SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 22/28] vim: Upgrade 9.1.1043 -> 9.1.1115
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (20 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 21/28] grub: patch CVE-2025-0678 and CVE-2025-1125 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 23/28] xserver-xorg: upgrade 21.1.14 -> 21.1.15 Steve Sakoman
` (5 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Divya Chellam <divya.chellam@windriver.com>
This includes CVE-fix for CVE-2025-26603 and CVE-2025-1215
Changes between 9.1.1043 -> 9.1.1115
====================================
https://github.com/vim/vim/compare/v9.1.1043...v9.1.1115
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/vim/vim.inc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 4ac9c58c80..823cfe24c7 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -18,8 +18,8 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
file://no-path-adjust.patch \
"
-PV .= ".1043"
-SRCREV = "9d1bed5eccdbb46a26b8a484f5e9163c40e63919"
+PV .= ".1115"
+SRCREV = "c0f0e2380e5954f4a52a131bf6b8499838ad1dae"
# Do not consider .z in x.y.z, as that is updated with every commit
UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+\.\d+)\.0"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 23/28] xserver-xorg: upgrade 21.1.14 -> 21.1.15
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (21 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 22/28] vim: Upgrade 9.1.1043 -> 9.1.1115 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 24/28] xserver-xf86-config: add a configuration fragment to disable screen blanking Steve Sakoman
` (4 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ba94110d70ebfb1b4798ecf05389f7ea602b1f55)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../{xserver-xorg_21.1.14.bb => xserver-xorg_21.1.15.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-graphics/xorg-xserver/{xserver-xorg_21.1.14.bb => xserver-xorg_21.1.15.bb} (92%)
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.14.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.15.bb
similarity index 92%
rename from meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.14.bb
rename to meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.15.bb
index 28c98eb527..080e6d220e 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.14.bb
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.15.bb
@@ -3,7 +3,7 @@ require xserver-xorg.inc
SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch \
file://0001-Avoid-duplicate-definitions-of-IOPortBase.patch \
"
-SRC_URI[sha256sum] = "8f2102cebdc4747d1656c1099ef610f5063c7422c24a177e300de569b354ee35"
+SRC_URI[sha256sum] = "841c82901282902725762df03adbbcd68153d4cdfb0d61df0cfd73ad677ae089"
# These extensions are now integrated into the server, so declare the migration
# path for in-place upgrades.
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 24/28] xserver-xf86-config: add a configuration fragment to disable screen blanking
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (22 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 23/28] xserver-xorg: upgrade 21.1.14 -> 21.1.15 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 25/28] xserver-xf86-config: remove obsolete configuration files Steve Sakoman
` (3 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
Add a configuration fragment that disables screen blanking, and add it
to all qemu machines.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 780a5ccaa51d5aed18200883a686387e70847e4b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xorg-xserver/xserver-xf86-config/qemuall/noblank.conf | 7 +++++++
.../xorg-xserver/xserver-xf86-config_0.1.bb | 6 ++++++
2 files changed, 13 insertions(+)
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemuall/noblank.conf
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemuall/noblank.conf b/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemuall/noblank.conf
new file mode 100644
index 0000000000..9d40a9599a
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemuall/noblank.conf
@@ -0,0 +1,7 @@
+# Disable screen blanking
+Section "ServerFlags"
+ Option "BlankTime" "0"
+ Option "StandbyTime" "0"
+ Option "SuspendTime" "0"
+ Option "OffTime" "0"
+EndSection
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config_0.1.bb b/meta/recipes-graphics/xorg-xserver/xserver-xf86-config_0.1.bb
index 03f14cef2b..841d931e82 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config_0.1.bb
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xf86-config_0.1.bb
@@ -5,6 +5,7 @@ LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
SRC_URI = "file://xorg.conf"
+SRC_URI:append:qemuall = " file://noblank.conf"
S = "${WORKDIR}"
@@ -18,4 +19,9 @@ do_install () {
install -d ${D}/${sysconfdir}/X11
install -m 0644 ${WORKDIR}/xorg.conf ${D}/${sysconfdir}/X11/
fi
+
+ if test -s ${S}/noblank.conf; then
+ install -d ${D}/${sysconfdir}/X11/xorg.conf.d
+ install -m 0644 ${S}/noblank.conf ${D}/${sysconfdir}/X11/xorg.conf.d/
+ fi
}
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 25/28] xserver-xf86-config: remove obsolete configuration files
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (23 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 24/28] xserver-xf86-config: add a configuration fragment to disable screen blanking Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 26/28] xserver-xorg: upgrade 21.1.15 -> 21.1.16 Steve Sakoman
` (2 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
For reasons we have explicit xorg.conf files for a number of the qemu
machines, but not all of them. These mainly disabled screen blanking
(which is now down with a separate fragment) but also explictly set the
device driver to fbdev which meant they didn't use the modesettings
driver as they should (with the virtio framebuffer from qemu).
This is the root cause of why the xserver 21.1.16 upgrade doesn't work
on a number of machines: the /sys probing changed and the fbdev driver
now refuses to use the PCI framebuffer device as there are better
drivers, but we've explictly told xorg to use the wrong driver.
For more details, see https://gitlab.freedesktop.org/xorg/xserver/-/issues/1798.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8c8039bf4c2d011e3d12c970ce45036b184902a9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xserver-xf86-config/qemuarm/xorg.conf | 42 -------------------
.../xserver-xf86-config/qemuppc/xorg.conf | 42 -------------------
.../xserver-xf86-config/qemush4/xorg.conf | 42 -------------------
.../xserver-xf86-config/qemux86-64/xorg.conf | 37 ----------------
.../xserver-xf86-config/qemux86/xorg.conf | 37 ----------------
5 files changed, 200 deletions(-)
delete mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemuarm/xorg.conf
delete mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemuppc/xorg.conf
delete mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemush4/xorg.conf
delete mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemux86-64/xorg.conf
delete mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemux86/xorg.conf
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemuarm/xorg.conf b/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemuarm/xorg.conf
deleted file mode 100644
index 3eb380a0a4..0000000000
--- a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemuarm/xorg.conf
+++ /dev/null
@@ -1,42 +0,0 @@
-
-Section "Files"
-EndSection
-
-Section "Device"
- Identifier "Graphics Controller"
- Driver "fbdev"
-EndSection
-
-Section "Monitor"
- Identifier "Generic Monitor"
- Option "DPMS"
- # 1024x600 59.85 Hz (CVT) hsync: 37.35 kHz; pclk: 49.00 MHz
- Modeline "1024x600_60.00" 49.00 1024 1072 1168 1312 600 603 613 624 -hsync +vsync
- # 640x480 @ 60Hz (Industry standard) hsync: 31.5kHz
- ModeLine "640x480" 25.2 640 656 752 800 480 490 492 525 -hsync -vsync
- # 640x480 @ 72Hz (VESA) hsync: 37.9kHz
- ModeLine "640x480" 31.5 640 664 704 832 480 489 491 520 -hsync -vsync
- # 640x480 @ 75Hz (VESA) hsync: 37.5kHz
- ModeLine "640x480" 31.5 640 656 720 840 480 481 484 500 -hsync -vsync
- # 640x480 @ 85Hz (VESA) hsync: 43.3kHz
- ModeLine "640x480" 36.0 640 696 752 832 480 481 484 509 -hsync -vsync
-EndSection
-
-Section "Screen"
- Identifier "Default Screen"
- Device "Graphics Controller"
- Monitor "Generic Monitor"
- SubSection "Display"
- Modes "640x480"
- EndSubSection
-EndSection
-
-Section "ServerLayout"
- Identifier "Default Layout"
- Screen "Default Screen"
- Option "AllowEmptyInput" "no"
- Option "BlankTime" "0"
- Option "StandbyTime" "0"
- Option "SuspendTime" "0"
- Option "OffTime" "0"
-EndSection
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemuppc/xorg.conf b/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemuppc/xorg.conf
deleted file mode 100644
index 3eb380a0a4..0000000000
--- a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemuppc/xorg.conf
+++ /dev/null
@@ -1,42 +0,0 @@
-
-Section "Files"
-EndSection
-
-Section "Device"
- Identifier "Graphics Controller"
- Driver "fbdev"
-EndSection
-
-Section "Monitor"
- Identifier "Generic Monitor"
- Option "DPMS"
- # 1024x600 59.85 Hz (CVT) hsync: 37.35 kHz; pclk: 49.00 MHz
- Modeline "1024x600_60.00" 49.00 1024 1072 1168 1312 600 603 613 624 -hsync +vsync
- # 640x480 @ 60Hz (Industry standard) hsync: 31.5kHz
- ModeLine "640x480" 25.2 640 656 752 800 480 490 492 525 -hsync -vsync
- # 640x480 @ 72Hz (VESA) hsync: 37.9kHz
- ModeLine "640x480" 31.5 640 664 704 832 480 489 491 520 -hsync -vsync
- # 640x480 @ 75Hz (VESA) hsync: 37.5kHz
- ModeLine "640x480" 31.5 640 656 720 840 480 481 484 500 -hsync -vsync
- # 640x480 @ 85Hz (VESA) hsync: 43.3kHz
- ModeLine "640x480" 36.0 640 696 752 832 480 481 484 509 -hsync -vsync
-EndSection
-
-Section "Screen"
- Identifier "Default Screen"
- Device "Graphics Controller"
- Monitor "Generic Monitor"
- SubSection "Display"
- Modes "640x480"
- EndSubSection
-EndSection
-
-Section "ServerLayout"
- Identifier "Default Layout"
- Screen "Default Screen"
- Option "AllowEmptyInput" "no"
- Option "BlankTime" "0"
- Option "StandbyTime" "0"
- Option "SuspendTime" "0"
- Option "OffTime" "0"
-EndSection
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemush4/xorg.conf b/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemush4/xorg.conf
deleted file mode 100644
index 3eb380a0a4..0000000000
--- a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemush4/xorg.conf
+++ /dev/null
@@ -1,42 +0,0 @@
-
-Section "Files"
-EndSection
-
-Section "Device"
- Identifier "Graphics Controller"
- Driver "fbdev"
-EndSection
-
-Section "Monitor"
- Identifier "Generic Monitor"
- Option "DPMS"
- # 1024x600 59.85 Hz (CVT) hsync: 37.35 kHz; pclk: 49.00 MHz
- Modeline "1024x600_60.00" 49.00 1024 1072 1168 1312 600 603 613 624 -hsync +vsync
- # 640x480 @ 60Hz (Industry standard) hsync: 31.5kHz
- ModeLine "640x480" 25.2 640 656 752 800 480 490 492 525 -hsync -vsync
- # 640x480 @ 72Hz (VESA) hsync: 37.9kHz
- ModeLine "640x480" 31.5 640 664 704 832 480 489 491 520 -hsync -vsync
- # 640x480 @ 75Hz (VESA) hsync: 37.5kHz
- ModeLine "640x480" 31.5 640 656 720 840 480 481 484 500 -hsync -vsync
- # 640x480 @ 85Hz (VESA) hsync: 43.3kHz
- ModeLine "640x480" 36.0 640 696 752 832 480 481 484 509 -hsync -vsync
-EndSection
-
-Section "Screen"
- Identifier "Default Screen"
- Device "Graphics Controller"
- Monitor "Generic Monitor"
- SubSection "Display"
- Modes "640x480"
- EndSubSection
-EndSection
-
-Section "ServerLayout"
- Identifier "Default Layout"
- Screen "Default Screen"
- Option "AllowEmptyInput" "no"
- Option "BlankTime" "0"
- Option "StandbyTime" "0"
- Option "SuspendTime" "0"
- Option "OffTime" "0"
-EndSection
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemux86-64/xorg.conf b/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemux86-64/xorg.conf
deleted file mode 100644
index c01c3331c5..0000000000
--- a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemux86-64/xorg.conf
+++ /dev/null
@@ -1,37 +0,0 @@
-
-Section "Files"
-EndSection
-
-Section "Monitor"
- Identifier "Generic Monitor"
- Option "DPMS"
- # 1024x600 59.85 Hz (CVT) hsync: 37.35 kHz; pclk: 49.00 MHz
- Modeline "1024x600_60.00" 49.00 1024 1072 1168 1312 600 603 613 624 -hsync +vsync
- # 640x480 @ 60Hz (Industry standard) hsync: 31.5kHz
- ModeLine "640x480" 25.2 640 656 752 800 480 490 492 525 -hsync -vsync
- # 640x480 @ 72Hz (VESA) hsync: 37.9kHz
- ModeLine "640x480" 31.5 640 664 704 832 480 489 491 520 -hsync -vsync
- # 640x480 @ 75Hz (VESA) hsync: 37.5kHz
- ModeLine "640x480" 31.5 640 656 720 840 480 481 484 500 -hsync -vsync
- # 640x480 @ 85Hz (VESA) hsync: 43.3kHz
- ModeLine "640x480" 36.0 640 696 752 832 480 481 484 509 -hsync -vsync
-EndSection
-
-Section "Screen"
- Identifier "Default Screen"
- Device "Graphics Controller"
- Monitor "Generic Monitor"
- SubSection "Display"
- Modes "640x480"
- EndSubSection
-EndSection
-
-Section "ServerLayout"
- Identifier "Default Layout"
- Screen "Default Screen"
- Option "AllowEmptyInput" "no"
- Option "BlankTime" "0"
- Option "StandbyTime" "0"
- Option "SuspendTime" "0"
- Option "OffTime" "0"
-EndSection
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemux86/xorg.conf b/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemux86/xorg.conf
deleted file mode 100644
index c01c3331c5..0000000000
--- a/meta/recipes-graphics/xorg-xserver/xserver-xf86-config/qemux86/xorg.conf
+++ /dev/null
@@ -1,37 +0,0 @@
-
-Section "Files"
-EndSection
-
-Section "Monitor"
- Identifier "Generic Monitor"
- Option "DPMS"
- # 1024x600 59.85 Hz (CVT) hsync: 37.35 kHz; pclk: 49.00 MHz
- Modeline "1024x600_60.00" 49.00 1024 1072 1168 1312 600 603 613 624 -hsync +vsync
- # 640x480 @ 60Hz (Industry standard) hsync: 31.5kHz
- ModeLine "640x480" 25.2 640 656 752 800 480 490 492 525 -hsync -vsync
- # 640x480 @ 72Hz (VESA) hsync: 37.9kHz
- ModeLine "640x480" 31.5 640 664 704 832 480 489 491 520 -hsync -vsync
- # 640x480 @ 75Hz (VESA) hsync: 37.5kHz
- ModeLine "640x480" 31.5 640 656 720 840 480 481 484 500 -hsync -vsync
- # 640x480 @ 85Hz (VESA) hsync: 43.3kHz
- ModeLine "640x480" 36.0 640 696 752 832 480 481 484 509 -hsync -vsync
-EndSection
-
-Section "Screen"
- Identifier "Default Screen"
- Device "Graphics Controller"
- Monitor "Generic Monitor"
- SubSection "Display"
- Modes "640x480"
- EndSubSection
-EndSection
-
-Section "ServerLayout"
- Identifier "Default Layout"
- Screen "Default Screen"
- Option "AllowEmptyInput" "no"
- Option "BlankTime" "0"
- Option "StandbyTime" "0"
- Option "SuspendTime" "0"
- Option "OffTime" "0"
-EndSection
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 26/28] xserver-xorg: upgrade 21.1.15 -> 21.1.16
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (24 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 25/28] xserver-xf86-config: remove obsolete configuration files Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 27/28] babeltrace: extend to nativesdk Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 28/28] babeltrace2: " Steve Sakoman
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Includes security fix
* CVE-2025-26594
* CVE-2025-26595
* CVE-2025-26596
* CVE-2025-26597
* CVE-2025-26598
* CVE-2025-26599
* CVE-2025-26600
* CVE-2025-26601
Ref: https://lists.x.org/archives/xorg-announce/2025-February/003584.html
https://lists.x.org/archives/xorg-announce/2025-February/003585.html
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b5491688a045e52b2a1a00d04b746ed6af456784)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../{xserver-xorg_21.1.15.bb => xserver-xorg_21.1.16.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-graphics/xorg-xserver/{xserver-xorg_21.1.15.bb => xserver-xorg_21.1.16.bb} (92%)
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.15.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.16.bb
similarity index 92%
rename from meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.15.bb
rename to meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.16.bb
index 080e6d220e..38c81f2372 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.15.bb
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.16.bb
@@ -3,7 +3,7 @@ require xserver-xorg.inc
SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch \
file://0001-Avoid-duplicate-definitions-of-IOPortBase.patch \
"
-SRC_URI[sha256sum] = "841c82901282902725762df03adbbcd68153d4cdfb0d61df0cfd73ad677ae089"
+SRC_URI[sha256sum] = "b14a116d2d805debc5b5b2aac505a279e69b217dae2fae2dfcb62400471a9970"
# These extensions are now integrated into the server, so declare the migration
# path for in-place upgrades.
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 27/28] babeltrace: extend to nativesdk
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (25 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 26/28] xserver-xorg: upgrade 21.1.15 -> 21.1.16 Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
2025-03-12 19:55 ` [OE-core][scarthgap 28/28] babeltrace2: " Steve Sakoman
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Changqing Li <changqing.li@windriver.com>
This allows anyone using the SDK to be able to analyze the logs
collected on target
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-kernel/lttng/babeltrace_1.5.11.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-kernel/lttng/babeltrace_1.5.11.bb b/meta/recipes-kernel/lttng/babeltrace_1.5.11.bb
index f4d9b5e42a..2585747fb6 100644
--- a/meta/recipes-kernel/lttng/babeltrace_1.5.11.bb
+++ b/meta/recipes-kernel/lttng/babeltrace_1.5.11.bb
@@ -96,3 +96,5 @@ do_install_ptest () {
sed -i 's:^BTBIN.*:BTBIN=/usr/bin/babeltrace:' ${f}
done
}
+
+BBCLASSEXTEND = "nativesdk"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [OE-core][scarthgap 28/28] babeltrace2: extend to nativesdk
2025-03-12 19:55 [OE-core][scarthgap 00/28] Patch review Steve Sakoman
` (26 preceding siblings ...)
2025-03-12 19:55 ` [OE-core][scarthgap 27/28] babeltrace: extend to nativesdk Steve Sakoman
@ 2025-03-12 19:55 ` Steve Sakoman
27 siblings, 0 replies; 29+ messages in thread
From: Steve Sakoman @ 2025-03-12 19:55 UTC (permalink / raw)
To: openembedded-core
From: Changqing Li <changqing.li@windriver.com>
This allows anyone using the SDK to be able to analyze the logs
collected on target
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-kernel/lttng/babeltrace2_2.0.6.bb | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/meta/recipes-kernel/lttng/babeltrace2_2.0.6.bb b/meta/recipes-kernel/lttng/babeltrace2_2.0.6.bb
index d6c75d7580..bd6eb9ba1c 100644
--- a/meta/recipes-kernel/lttng/babeltrace2_2.0.6.bb
+++ b/meta/recipes-kernel/lttng/babeltrace2_2.0.6.bb
@@ -93,3 +93,15 @@ do_install_ptest () {
# Remove architechture specific testfiles
rm -rf ${D}${PTEST_PATH}/tests/data/plugins/flt.lttng-utils.debug-info/*
}
+
+do_install:append:class-nativesdk() {
+ mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d
+ cat <<- EOF > ${D}${SDKPATHNATIVE}/environment-setup.d/babeltrace2.sh
+ export BABELTRACE_PLUGIN_PATH="${libdir}/babeltrace2/plugins"
+ export LIBBABELTRACE2_PLUGIN_PROVIDER_DIR="${libdir}/babeltrace2/plugin-providers"
+ EOF
+}
+
+FILES:${PN}:append:class-nativesdk = " ${SDKPATHNATIVE}/environment-setup.d/babeltrace2.sh"
+
+BBCLASSEXTEND = "nativesdk"
--
2.43.0
^ permalink raw reply related [flat|nested] 29+ messages in thread