Re: [OE-core] [PATCH] cve-check: Classify patched CVEs into 3 statuses

[Marta Rybczynska]

On Thu, 21 Sept 2023, 11:03 Matsunaga-Shinji, 
wrote:

> CVEs that are currently considered "Patched" are classified into the
> following 3 statuses:
> 1. "Patched"  - means that a patch file that fixed the vulnerability
> has been applied
> 2. "Out of range" - means that the package version (PV) is not subject to
> the vulnerability
> 3. "Undecidable"  - means that versions cannot be compared to determine if
> they are affected by the vulnerability


Hello,
Thank you for your patch. I'm wondering what you use case is. What do you
do with that data? Currently in YP we aim to do as much as automatic
classification as we can. We only adjust the classification manually when
it is clearly wrong.

Now, in this piece of code I don't see setting up 'out-of-range', while it
is possible to separate the not affected case and the case when we apply a
patch. I do not understand the 'undecideable' classification. Could you
give an exemple of a situation when it makes sense to use it?

On the naming side, I'd prefer 'Not Affected' for out-of-range, because
that term is often used in error conditions. In this case there is no error
at all.

Kind regards,
Marta



>

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188666): 
https://lists.openembedded.org/g/openembedded-core/message/188666
Mute This Topic: https://lists.openembedded.org/mt/101496298/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [OE-core] [PATCH] cve-check: Classify patched CVEs into 3 statuses

[Matsunaga-Shinji]

Sorry for the late reply.

In addition to the changes to meta/classes/cve-check.bbclass,
Does it mean that the following processing needs to be added to 
meta/conf/cve-check-map.conf?
CVE_CHECK_STATUSMAP[out-of-range] = "Patched"
CVE_CHECK_STATUSMAP[undecidable] = "Unpatched"

Shinji

-Original Message-
From: Marko, Peter  
Sent: Thursday, September 21, 2023 6:46 PM
To: Matsunaga, Shinji/松永 慎司 ; 
richard.pur...@linuxfoundation.org
Cc: openembedded-core@lists.openembedded.org
Subject: RE: [OE-core] [PATCH] cve-check: Classify patched CVEs into 3 statuses

We have recently introduced CVE_CHECK_STATUSMAP which should be used to declare 
more detailed status information instead of introducing additional statuses.
In this case, "out of range" should be subtype of patched and "undecidable" 
subtype of unpatched I think.

Peter

-Original Message-
From: openembedded-core@lists.openembedded.org 
 On Behalf Of Matsunaga-Shinji via 
lists.openembedded.org
Sent: Thursday, September 21, 2023 11:03
To: richard.pur...@linuxfoundation.org
Cc: openembedded-core@lists.openembedded.org; shin.matsun...@fujitsu.com
Subject: [OE-core] [PATCH] cve-check: Classify patched CVEs into 3 statuses

> CVEs that are currently considered "Patched" are classified into the 
> following 3 statuses:
> 1. "Patched"  - means that a patch file that fixed the vulnerability has 
> been applied
> 2. "Out of range" - means that the package version (PV) is not subject 
> to the vulnerability 3. "Undecidable"  - means that versions cannot be 
> compared to determine if they are affected by the vulnerability
> 
> Signed-off-by: Shinji Matsunaga 

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188665): 
https://lists.openembedded.org/g/openembedded-core/message/188665
Mute This Topic: https://lists.openembedded.org/mt/101496298/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [OE-core] [PATCH V3] glibc: stable 2.38 branch updates.

[Richard Purdie]

On Tue, 2023-10-03 at 21:05 +0100, Richard Purdie via
lists.openembedded.org wrote:
> On Mon, 2023-10-02 at 20:09 -0700, Hemraj, Deepthi via
> lists.openembedded.org wrote:
> > From: Deepthi Hemraj 
> > 
> > Below commits on glibc-2.38 stable branch are updated.
> > 0e1ef6779a (HEAD -> release/2.38/master, origin/release/2.38/master) 
> > manual/jobs.texi: Add missing @item EPERM for getpgid
> > d94461bb86 string: Fix tester build with fortify enable with gcc < 12
> > 63250e9c57 iconv: restore verbosity with unrecognized encoding names (bug 
> > 30694)
> > 00ae4f10b5 getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
> > b25508dd77 CVE-2023-4527: Stack read overflow with large TCP responses in 
> > no- mode
> > 89da8bc588 NEWS: Add the 2.38.1 bug list
> > d3ba6c1333 elf: Move l_init_called_next to old place of l_text_end in link 
> > map
> > 750f19526a elf: Remove unused l_text_end field from struct link_map
> > a3189f66a5 elf: Always call destructors in reverse constructor order (bug 
> > 30785)
> > 7ae211a01b elf: Do not run constructors for proxy objects
> > 92201f16cb libio: Fix oversized __io_vtables
> > 5bdef6f27c io: Fix record locking contants for powerpc64 with 
> > __USE_FILE_OFFSET64
> > 
> > 0024-CVE-2023-4527.patch is dropped
> > 
> > Signed-off-by: Deepthi Hemraj 
> > ---
> >  meta/recipes-core/glibc/glibc-version.inc |   2 +-
> >  .../glibc/glibc/0024-CVE-2023-4527.patch  | 219 --
> >  meta/recipes-core/glibc/glibc_2.38.bb |   1 -
> >  3 files changed, 1 insertion(+), 221 deletions(-)
> >  delete mode 100644 meta/recipes-core/glibc/glibc/0024-CVE-2023-4527.patch
> 
> I suspect that as well we deleting the patch, you need to add something
> like:
> 
> CVE_STATUS[CVE-2023-4527] = "fixed-version: Fixed in stable branch updates"
> 
> otherwise we'll see CVEs reported against this again?
> 
> There may be other CVEs which need adding too?

Since there appears to be a serious glibc issue we need to patch, I've
gone ahead and added an update on top of this patch to pull in the new
urgent pieces and set the CVE_STATUS accordingly. Please follow up with
an additional patch for any other CVE_STATUS pieces I didn't cover.

Cheers,

Richard



-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188664): 
https://lists.openembedded.org/g/openembedded-core/message/188664
Mute This Topic: https://lists.openembedded.org/mt/101727838/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core] [PATCH] glibc: Pull in stable branch fixes

[Richard Purdie]

Pull in stable branch fixes including:

* tunables: Terminate if end of input is reached (CVE-2023-4911)
* Propagate GLIBC_TUNABLES in setxid binaries
* Document CVE-2023-4806 and CVE-2023-5156 in NEWS
* Fix leak in getaddrinfo introduced by the fix for CVE-2023-4806 [BZ #30843]

Also set CVE_STATUS accordingly for the fixes pulled in.

Signed-off-by: Richard Purdie 
---
 meta/recipes-core/glibc/glibc-version.inc | 7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/meta/recipes-core/glibc/glibc-version.inc 
b/meta/recipes-core/glibc/glibc-version.inc
index f5ebbb2ee62..19b98bc11ad 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,8 +1,13 @@
 SRCBRANCH ?= "release/2.38/master"
 PV = "2.38+git"
-SRCREV_glibc ?= "0e1ef6779a90bc0f8a05bc367796df2793deecaa"
+SRCREV_glibc ?= "750a45a783906a19591fb8ff6b7841470f1f5701"
 SRCREV_localedef ?= "e0eca29583b9e0f62645c4316ced93cf4e4e26e1"
 
 GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
 
 UPSTREAM_CHECK_GITTAGREGEX = "(?P\d+\.\d+(\.(?!90)\d+)*)"
+
+CVE_STATUS[CVE-2023-4527] = "fixed-version: Fixed in stable branch updates"
+CVE_STATUS[CVE-2023-4911] = "fixed-version: Fixed in stable branch updates"
+CVE_STATUS[CVE-2023-4806] = "fixed-version: Fixed in stable branch updates"
+CVE_STATUS[CVE-2023-4527] = "fixed-version: Fixed in stable branch updates"
-- 
2.39.2


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188663): 
https://lists.openembedded.org/g/openembedded-core/message/188663
Mute This Topic: https://lists.openembedded.org/mt/101743525/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core] [PATCH] recipetool/create_buildsys_python: use importlib instead of imp

[Chris Laplante via lists.openembedded.org]

'imp' was deprecated in Python 3.4 and removed in 3.12. The
piece of importlib we use has been around since 3.3.

Signed-off-by: Chris Laplante 
---
 scripts/lib/recipetool/create_buildsys_python.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/scripts/lib/recipetool/create_buildsys_python.py 
b/scripts/lib/recipetool/create_buildsys_python.py
index 4675cc68fa..92468b2254 100644
--- a/scripts/lib/recipetool/create_buildsys_python.py
+++ b/scripts/lib/recipetool/create_buildsys_python.py
@@ -10,7 +10,7 @@ import codecs
 import collections
 import setuptools.command.build_py
 import email
-import imp
+import importlib
 import glob
 import itertools
 import logging
@@ -561,7 +561,6 @@ class PythonRecipeHandler(RecipeHandler):
 return deps
 
 def parse_pkgdata_for_python_packages(self):
-suffixes = [t[0] for t in imp.get_suffixes()]
 pkgdata_dir = tinfoil.config_data.getVar('PKGDATA_DIR')
 
 ldata = tinfoil.config_data.createCopy()
@@ -585,7 +584,7 @@ class PythonRecipeHandler(RecipeHandler):
 continue
 
 for fn in files_info:
-for suffix in suffixes:
+for suffix in importlib.machinery.all_suffixes():
 if fn.endswith(suffix):
 break
 else:
-- 
2.34.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188662): 
https://lists.openembedded.org/g/openembedded-core/message/188662
Mute This Topic: https://lists.openembedded.org/mt/101742170/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [OE-core] [PATCH V3] glibc: stable 2.38 branch updates.

[Richard Purdie]

On Mon, 2023-10-02 at 20:09 -0700, Hemraj, Deepthi via
lists.openembedded.org wrote:
> From: Deepthi Hemraj 
> 
> Below commits on glibc-2.38 stable branch are updated.
> 0e1ef6779a (HEAD -> release/2.38/master, origin/release/2.38/master) 
> manual/jobs.texi: Add missing @item EPERM for getpgid
> d94461bb86 string: Fix tester build with fortify enable with gcc < 12
> 63250e9c57 iconv: restore verbosity with unrecognized encoding names (bug 
> 30694)
> 00ae4f10b5 getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
> b25508dd77 CVE-2023-4527: Stack read overflow with large TCP responses in 
> no- mode
> 89da8bc588 NEWS: Add the 2.38.1 bug list
> d3ba6c1333 elf: Move l_init_called_next to old place of l_text_end in link map
> 750f19526a elf: Remove unused l_text_end field from struct link_map
> a3189f66a5 elf: Always call destructors in reverse constructor order (bug 
> 30785)
> 7ae211a01b elf: Do not run constructors for proxy objects
> 92201f16cb libio: Fix oversized __io_vtables
> 5bdef6f27c io: Fix record locking contants for powerpc64 with 
> __USE_FILE_OFFSET64
> 
> 0024-CVE-2023-4527.patch is dropped
> 
> Signed-off-by: Deepthi Hemraj 
> ---
>  meta/recipes-core/glibc/glibc-version.inc |   2 +-
>  .../glibc/glibc/0024-CVE-2023-4527.patch  | 219 --
>  meta/recipes-core/glibc/glibc_2.38.bb |   1 -
>  3 files changed, 1 insertion(+), 221 deletions(-)
>  delete mode 100644 meta/recipes-core/glibc/glibc/0024-CVE-2023-4527.patch

I suspect that as well we deleting the patch, you need to add something
like:

CVE_STATUS[CVE-2023-4527] = "fixed-version: Fixed in stable branch updates"

otherwise we'll see CVEs reported against this again?

There may be other CVEs which need adding too?

Cheers,

Richard

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188661): 
https://lists.openembedded.org/g/openembedded-core/message/188661
Mute This Topic: https://lists.openembedded.org/mt/101727838/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core][kirkstone 02/10] go: Update fix for CVE-2023-24538 & CVE-2023-39318

[Steve Sakoman]

From: Shubham Kulkarni 

Add missing files in fix for CVE-2023-24538 & CVE-2023-39318

Upstream Link -
CVE-2023-24538: 
https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b
CVE-2023-39318: 
https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c

Signed-off-by: Shubham Kulkarni 
Signed-off-by: Steve Sakoman 
---
 meta/recipes-devtools/go/go-1.17.13.inc   |   3 +-
 .../go/go-1.18/CVE-2023-24538_1.patch | 597 ++
 ...023-24538.patch => CVE-2023-24538_2.patch} | 175 -
 .../go/go-1.21/CVE-2023-39318.patch   |  44 +-
 4 files changed, 802 insertions(+), 17 deletions(-)
 create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2023-24538_1.patch
 rename meta/recipes-devtools/go/go-1.18/{CVE-2023-24538.patch => 
CVE-2023-24538_2.patch} (53%)

diff --git a/meta/recipes-devtools/go/go-1.17.13.inc 
b/meta/recipes-devtools/go/go-1.17.13.inc
index ed2645bc12..461819d80f 100644
--- a/meta/recipes-devtools/go/go-1.17.13.inc
+++ b/meta/recipes-devtools/go/go-1.17.13.inc
@@ -29,7 +29,8 @@ SRC_URI += "\
 file://CVE-2022-41722.patch \
 file://CVE-2023-24537.patch \
 file://CVE-2023-24534.patch \
-file://CVE-2023-24538.patch \
+file://CVE-2023-24538_1.patch \
+file://CVE-2023-24538_2.patch \
 file://CVE-2023-24540.patch \
 file://CVE-2023-24539.patch \
 file://CVE-2023-29404.patch \
diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2023-24538_1.patch 
b/meta/recipes-devtools/go/go-1.18/CVE-2023-24538_1.patch
new file mode 100644
index 00..bb0a416f46
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.18/CVE-2023-24538_1.patch
@@ -0,0 +1,597 @@
+From b1e4e8ec7e946ff2d3bb37ac99c5468ceb49c362 Mon Sep 17 00:00:00 2001
+From: Russ Cox 
+Date: Thu, 20 May 2021 12:46:33 -0400
+Subject: [PATCH 1/2] html/template, text/template: implement break and
+ continue for range loops
+
+Break and continue for range loops was accepted as a proposal in June 2017.
+It was implemented in CL 66410 (Oct 2017)
+but then rolled back in CL 92155 (Feb 2018)
+because html/template changes had not been implemented.
+
+This CL reimplements break and continue in text/template
+and then adds support for them in html/template as well.
+
+Fixes #20531.
+
+Change-Id: I05330482a976f1c078b4b49c2287bd9031bb7616
+Reviewed-on: https://go-review.googlesource.com/c/go/+/321491
+Trust: Russ Cox 
+Run-TryBot: Russ Cox 
+TryBot-Result: Go Bot 
+Reviewed-by: Rob Pike 
+
+Upstream-Status: Backport from 
https://github.com/golang/go/commit/d0dd26a88c019d54f22463daae81e785f5867565
+CVE: CVE-2023-24538
+Signed-off-by: Shubham Kulkarni 
+---
+ src/html/template/context.go  |  4 ++
+ src/html/template/escape.go   | 71 ++-
+ src/html/template/escape_test.go  | 24 
+ src/html/template/exec_test.go|  2 +
+ src/text/template/doc.go  |  8 
+ src/text/template/exec.go | 24 +++-
+ src/text/template/exec_test.go|  2 +
+ src/text/template/parse/lex.go| 13 ++-
+ src/text/template/parse/lex_test.go   |  2 +
+ src/text/template/parse/node.go   | 36 ++
+ src/text/template/parse/parse.go  | 42 -
+ src/text/template/parse/parse_test.go |  8 
+ 12 files changed, 232 insertions(+), 4 deletions(-)
+
+diff --git a/src/html/template/context.go b/src/html/template/context.go
+index f7d4849..aaa7d08 100644
+--- a/src/html/template/context.go
 b/src/html/template/context.go
+@@ -6,6 +6,7 @@ package template
+
+ import (
+   "fmt"
++  "text/template/parse"
+ )
+
+ // context describes the state an HTML parser must be in when it reaches the
+@@ -22,6 +23,7 @@ type context struct {
+   jsCtx   jsCtx
+   attrattr
+   element element
++  n   parse.Node // for range break/continue
+   err *Error
+ }
+
+@@ -141,6 +143,8 @@ const (
+   // stateError is an infectious error state outside any valid
+   // HTML/CSS/JS construct.
+   stateError
++  // stateDead marks unreachable code after a {{break}} or {{continue}}.
++  stateDead
+ )
+
+ // isComment is true for any state that contains content meant for template
+diff --git a/src/html/template/escape.go b/src/html/template/escape.go
+index 8739735..6dea79c 100644
+--- a/src/html/template/escape.go
 b/src/html/template/escape.go
+@@ -97,6 +97,15 @@ type escaper struct {
+   actionNodeEdits   map[*parse.ActionNode][]string
+   templateNodeEdits map[*parse.TemplateNode]string
+   textNodeEdits map[*parse.TextNode][]byte
++  // rangeContext holds context about the current range loop.
++  rangeContext *rangeContext
++}
++
++// rangeContext holds information about the current range loop.
++type rangeContext struct {
++  outer *rangeContext // outer loop
++  breaks[]context // context at each break action
++  continues []context // context at each 

[OE-core][kirkstone 10/10] fontcache.bbclass: avoid native recipes depending on target fontconfig

[Steve Sakoman]

From: Martin Jansa 

* this caused liberation-font-native to depend on TUNE_PKGARCH target fontconfig
  because ${MLPREFIX}fontconfig-utils is added to RDEPENDS in anonymous python

* the dependency tree for liberation-font-native got much shorter
  (just quilt-native and liberation-font-native itself):
   2 after/pn-buildlist
  78 before/pn-buildlist

* fixes graphviz-native signature issue as well as detected with 
sstate-diff-machines.sh

  $ bitbake-diffsigs \

sstate-after/mako/x86_64-linux/graphviz-native/8.1.0.do_populate_sysroot.sigdata.184d4fd355f1e7a2d7d929ef4b5f62b94e2071df9dd674b2067ec21bfc7bcc1b
 \

sstate-after/qemux86-64/x86_64-linux/graphviz-native/8.1.0.do_populate_sysroot.sigdata.35da674d2dbc275bac02869dfce4165466315023910bdef65a6026e2cb942a46
  Hash for task dependency liberation-fonts-native:do_populate_sysroot changed 
from 310d3da04ad9abf8ee7e53d1ffa71c2b7d9d60fb0e8de85171a9ab6a77d3 to 
048420ad1410c2b8d95498fc3c11681207335a2c722836f1f3e683cc449814da

Signed-off-by: Martin Jansa 
Signed-off-by: Steve Sakoman 
---
 meta/classes/fontcache.bbclass | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/classes/fontcache.bbclass b/meta/classes/fontcache.bbclass
index 442bfc7392..34688591f4 100644
--- a/meta/classes/fontcache.bbclass
+++ b/meta/classes/fontcache.bbclass
@@ -7,6 +7,7 @@ PACKAGE_WRITE_DEPS += "qemu-native"
 inherit qemu
 
 FONT_PACKAGES ??= "${PN}"
+FONT_PACKAGES:class-native = ""
 FONT_EXTRA_RDEPENDS ?= "${MLPREFIX}fontconfig-utils"
 FONTCONFIG_CACHE_DIR ?= "${localstatedir}/cache/fontconfig"
 FONTCONFIG_CACHE_PARAMS ?= "-v"
-- 
2.34.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188660): 
https://lists.openembedded.org/g/openembedded-core/message/188660
Mute This Topic: https://lists.openembedded.org/mt/101741383/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core][kirkstone 09/10] python3-jinja2: fix for the ptest result format

[Steve Sakoman]

From: Narpat Mali 

The output of python3-jinja2 ptest should follow a unified format as below
result: testname

Reference:
https://wiki.yoctoproject.org/wiki/Ptest

Signed-off-by: Narpat Mali 
Signed-off-by: Steve Sakoman 
---
 meta/recipes-devtools/python/python3-jinja2/run-ptest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/python/python3-jinja2/run-ptest 
b/meta/recipes-devtools/python/python3-jinja2/run-ptest
index 5cec711696..3004024619 100644
--- a/meta/recipes-devtools/python/python3-jinja2/run-ptest
+++ b/meta/recipes-devtools/python/python3-jinja2/run-ptest
@@ -1,3 +1,3 @@
 #!/bin/sh
 
-pytest
+pytest -o log_cli=true -o log_cli_level=INFO | sed -e 's/\[...%\]//g'| sed -e 
's/PASSED/PASS/g'| sed -e 's/FAILED/FAIL/g'| sed -e 's/SKIPPED/SKIP/g'| awk 
'{if ($NF=="PASS" || $NF=="FAIL" || $NF=="SKIP" || $NF=="XFAIL" || 
$NF=="XPASS"){printf "%s : %s\n", $NF, $0}else{print}}'| awk '{if ($NF=="PASS" 
|| $NF=="FAIL" || $NF=="SKIP" || $NF=="XFAIL" || $NF=="XPASS") {$NF="";print 
$0}else{print}}'
-- 
2.34.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188659): 
https://lists.openembedded.org/g/openembedded-core/message/188659
Mute This Topic: https://lists.openembedded.org/mt/101741382/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core][kirkstone 08/10] ccache: fix build with gcc-13

[Steve Sakoman]

From: Martin Jansa 

* needed on hosts with gcc-13 for ccache-native

Signed-off-by: Martin Jansa 
Signed-off-by: Steve Sakoman 
---
 ...x-FTBFS-with-not-yet-released-GCC-13.patch | 92 +++
 meta/recipes-devtools/ccache/ccache_4.6.bb|  4 +-
 2 files changed, 95 insertions(+), 1 deletion(-)
 create mode 100644 
meta/recipes-devtools/ccache/ccache/0001-build-Fix-FTBFS-with-not-yet-released-GCC-13.patch

diff --git 
a/meta/recipes-devtools/ccache/ccache/0001-build-Fix-FTBFS-with-not-yet-released-GCC-13.patch
 
b/meta/recipes-devtools/ccache/ccache/0001-build-Fix-FTBFS-with-not-yet-released-GCC-13.patch
new file mode 100644
index 00..d62e1ef26b
--- /dev/null
+++ 
b/meta/recipes-devtools/ccache/ccache/0001-build-Fix-FTBFS-with-not-yet-released-GCC-13.patch
@@ -0,0 +1,92 @@
+From 1523eaeff4669e421b3f60618b43c878e4860fe6 Mon Sep 17 00:00:00 2001
+From: Joel Rosdahl 
+Date: Tue, 5 Jul 2022 21:42:58 +0200
+Subject: [PATCH] build: Fix FTBFS with not yet released GCC 13
+
+Reference: https://gcc.gnu.org/gcc-13/porting_to.html#header-dep-changes
+
+Fixes #1105.
+
+Upstream-Status: Backport [v4.7 
https://github.com/ccache/ccache/commit/19ef6e267d38d4d8b3e11c915213472d5662d593]
+Signed-off-by: Martin Jansa 
+---
+ src/Stat.hpp  | 1 +
+ src/core/CacheEntryHeader.hpp | 2 ++
+ src/core/Sloppiness.hpp   | 1 +
+ src/core/Statistics.hpp   | 3 ++-
+ src/util/TextTable.hpp| 3 ++-
+ 5 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/Stat.hpp b/src/Stat.hpp
+index 2f56214a..074cdeeb 100644
+--- a/src/Stat.hpp
 b/src/Stat.hpp
+@@ -23,6 +23,7 @@
+ #include 
+ #include 
+ 
++#include 
+ #include 
+ #include 
+ 
+diff --git a/src/core/CacheEntryHeader.hpp b/src/core/CacheEntryHeader.hpp
+index 4c3e04c7..dcc32e1c 100644
+--- a/src/core/CacheEntryHeader.hpp
 b/src/core/CacheEntryHeader.hpp
+@@ -21,6 +21,8 @@
+ #include 
+ #include 
+ 
++#include 
++
+ // Cache entry format
+ // ==
+ //
+diff --git a/src/core/Sloppiness.hpp b/src/core/Sloppiness.hpp
+index 917526bf..1ab31d71 100644
+--- a/src/core/Sloppiness.hpp
 b/src/core/Sloppiness.hpp
+@@ -18,6 +18,7 @@
+ 
+ #pragma once
+ 
++#include 
+ #include 
+ 
+ namespace core {
+diff --git a/src/core/Statistics.hpp b/src/core/Statistics.hpp
+index 3e9ed816..54f32e9c 100644
+--- a/src/core/Statistics.hpp
 b/src/core/Statistics.hpp
+@@ -1,4 +1,4 @@
+-// Copyright (C) 2020-2021 Joel Rosdahl and other contributors
++// Copyright (C) 2020-2022 Joel Rosdahl and other contributors
+ //
+ // See doc/AUTHORS.adoc for a complete list of contributors.
+ //
+@@ -20,6 +20,7 @@
+ 
+ #include 
+ 
++#include 
+ #include 
+ #include 
+ #include 
+diff --git a/src/util/TextTable.hpp b/src/util/TextTable.hpp
+index 05c0e0e5..60edee75 100644
+--- a/src/util/TextTable.hpp
 b/src/util/TextTable.hpp
+@@ -1,4 +1,4 @@
+-// Copyright (C) 2021 Joel Rosdahl and other contributors
++// Copyright (C) 2021-2022 Joel Rosdahl and other contributors
+ //
+ // See doc/AUTHORS.adoc for a complete list of contributors.
+ //
+@@ -18,6 +18,7 @@
+ 
+ #pragma once
+ 
++#include 
+ #include 
+ #include 
+ 
diff --git a/meta/recipes-devtools/ccache/ccache_4.6.bb 
b/meta/recipes-devtools/ccache/ccache_4.6.bb
index f019679cf1..d94c5d591a 100644
--- a/meta/recipes-devtools/ccache/ccache_4.6.bb
+++ b/meta/recipes-devtools/ccache/ccache_4.6.bb
@@ -11,7 +11,9 @@ LIC_FILES_CHKSUM = 
"file://LICENSE.adoc;md5=ff5327dc93e2b286c931dda3d6079da9"
 
 DEPENDS = "zstd"
 
-SRC_URI = 
"https://github.com/ccache/ccache/releases/download/v${PV}/${BP}.tar.gz;
+SRC_URI = 
"https://github.com/ccache/ccache/releases/download/v${PV}/${BP}.tar.gz \
+file://0001-build-Fix-FTBFS-with-not-yet-released-GCC-13.patch \
+"
 SRC_URI[sha256sum] = 
"73a1767ac6b7c0404a1a55f761a746d338e702883c7137fbf587023062258625"
 
 UPSTREAM_CHECK_URI = "https://github.com/ccache/ccache/releases/;
-- 
2.34.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188658): 
https://lists.openembedded.org/g/openembedded-core/message/188658
Mute This Topic: https://lists.openembedded.org/mt/101741381/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core][kirkstone 07/10] linux-yocto/5.10: update to v5.10.197

[Steve Sakoman]

From: Bruce Ashfield 

Updating  to the latest korg -stable release that comprises
the following commits:

393e225fe8ff Linux 5.10.197
242c5740dd17 ext4: fix rec_len verify error
8768583b2509 scsi: pm8001: Setup IRQs on resume
f4fffa1abb7f scsi: megaraid_sas: Fix deadlock on firmware crashdump
3753e568d67f ata: libata: disallow dev-initiated LPM transitions to 
unsupported states
993bb01d228b i2c: aspeed: Reset the i2c controller when timeout occurs
f5e303fce3be tracefs: Add missing lockdown check to tracefs_create_dir()
96afb318ae5d nfsd: fix change_info in NFSv4 RENAME replies
b3183f5f05cd tracing: Have option files inc the trace array ref count
ec7eb8b06481 tracing: Have current_trace inc the trace array ref count
bb3e295a388c drm/amd/display: enable cursor degamma for DCN3+ DRM legacy 
gamma
2cdcf6481cb3 mm/filemap: fix infinite loop in generic_file_buffered_read()
0c5d5f8e0d2b proc: fix a dentry lock race between release_task and lookup
8db844077ec9 net/sched: Retire rsvp classifier
7a8f285cb58e drm/amdgpu: fix amdgpu_cs_p1_user_fence
7390bb377b5f btrfs: release path before inode lookup during the ino lookup 
ioctl
3d379dd109f8 btrfs: fix lockdep splat and potential deadlock after failure 
running delayed items
c6422e6f173d ovl: fix incorrect fdput() on aio completion
68308b0a33ed attr: block mode changes of symlinks
63dea898 md/raid1: fix error: ISO C90 forbids mixed declarations
7be3a38f0e37 samples/hw_breakpoint: fix building without module unloading
d20beafaa69b x86/boot/compressed: Reserve more memory for page tables
7635020b9bd4 scsi: lpfc: Fix the NULL vs IS_ERR() bug for 
debugfs_create_file()
f99005237684 selftests: tracing: Fix to unmount tracefs for recovering 
environment
ae889fffae52 scsi: qla2xxx: Fix NULL vs IS_ERR() bug for 
debugfs_create_dir()
82910aa5501d drm: gm12u320: Fix the timeout usage for usb_bulk_msg()
df380d6f5c06 btrfs: compare the correct fsid/metadata_uuid in 
btrfs_validate_super
ab90a3930d39 btrfs: add a helper to read the superblock metadata_uuid
cc87d2bb391c btrfs: move btrfs_pinned_by_swapfile prototype into volumes.h
e16f5f8cab65 perf tools: Add an option to build without libbfd
c56095812721 perf jevents: Make build dependency on test JSONs
4954c5a05494 mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 
controller
b87d03ed6ab7 mtd: rawnand: brcmnand: Allow SoC to provide I/O operations
5df582915851 kobject: Add sanity check for kset->kobj.ktype in 
kset_register()
a3efb2b57e9d media: pci: ipu3-cio2: Initialise timing struct to avoid a 
compiler warning
f354456f8df1 serial: cpm_uart: Avoid suspicious locking
bbe3ff47bf09 scsi: target: iscsi: Fix buffer overflow in 
lio_target_nacl_info_show()
6d3a1dd10537 usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
890d10e6b72f media: pci: cx23885: replace BUG with error return
2ae53dd15eef media: tuners: qt1010: replace BUG_ON with a regular error
578b67614ae0 media: dvb-usb-v2: gl861: Fix null-ptr-deref in 
gl861_i2c_master_xfer
a9def3e9718a media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
4a9763d2bc4a media: anysee: fix null-ptr-deref in anysee_master_xfer
c7e5ac737db2 media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
97fdbdb75034 media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
6c01ef65de0b media: dvb-usb-v2: af9035: Fix null-ptr-deref in 
af9035_i2c_master_xfer
9f3b2b666833 powerpc/pseries: fix possible memory leak in ibmebus_bus_init()
756747d4b439 jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
6f8b34458948 fs/jfs: prevent double-free in dbUnmount() after failed 
jfs_remount()
4bff1d95ba62 ext2: fix datatype of block number in ext2_xattr_set2()
7993cfc04148 md: raid1: fix potential OOB in raid1_remove_disk()
5933cd61399c bus: ti-sysc: Configure uart quirks for k3 SoC
5475b8bea148 drm/exynos: fix a possible null-pointer dereference due to 
data race in exynos_drm_crtc_atomic_disable()
d51d6c42d1e5 ALSA: hda: intel-dsp-cfg: add LunarLake support
fcfb71848e9e samples/hw_breakpoint: Fix kernel BUG 'invalid opcode: '
9726e8dcabae drm/bridge: tc358762: Instruct DSI host to generate HSE packets
672205c6f2d1 wifi: mac80211_hwsim: drop short frames
5bf52e431c83 netfilter: ebtables: fix fortify warnings in size_entry_mwt()
f6f0a687546e alx: fix OOB-read compiler warning
acf0019b93a6 mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450
c7a8813d91f9 tpm_tis: Resend command to recover from data transfer errors
0fc7147c6943 crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
03385b243bad wifi: wil6210: fix fortify warnings
269eb4e1d5ea wifi: mwifiex: fix fortify warning
08fdbe379022 wifi: ath9k: fix printk specifier
268a10c9eb0f wifi: ath9k: fix fortify warnings
8c19ddc21566 crypto: lrw,xts - Replace 

[OE-core][kirkstone 06/10] linux-yocto/5.10: update to v5.10.194

[Steve Sakoman]

From: Bruce Ashfield 

Updating  to the latest korg -stable release that comprises
the following commits:

006d5847646b Linux 5.10.194
d93ba6e46e5f rcu-tasks: Add trc_inspect_reader() checks for exiting 
critical section
3e22624f8fd3 rcu-tasks: Wait for trc_read_check_handler() IPIs
9190c1f0aed1 rcu-tasks: Fix IPI failure handling in trc_wait_for_one_reader
ad4f8c117b8b rcu: Prevent expedited GP from enabling tick on offline CPU
268e92252277 Revert "MIPS: Alchemy: fix dbdma2"
79ea9eb723b7 Revert "drm/amdgpu: install stub fence into potential unused 
fence pointers"
be4ccafc077f mhi: pci_generic: Fix implicit conversion warning
df3427204f1d ARM: module: Use module_init_layout_section() to spot init 
sections
b59cfee8d8a2 arm64: module: Use module_init_layout_section() to spot init 
sections
943ed7dc5ee4 arm64: module-plts: inline linux/moduleloader.h
ecd62c85120d module: Expose module_init_layout_section()
4566606fe3a4 Linux 5.10.193
b3ac2c1d725b mm,hwpoison: fix printing of page flags
7f92be110c0f ASoC: Intel: sof_sdw: include rt711.h for RT711 JD mode
32f71ef62737 mm: memory-failure: fix unexpected return value in 
soft_offline_page()
20c2db79f157 mm: memory-failure: kill soft_offline_free_page()
406166a3acd7 mm: fix page reference leak in soft_offline_page()
749630ce9147 mm,hwpoison: refactor get_any_page
0df5eaab03ed dma-buf/sw_sync: Avoid recursive lock during fence signal
7592a392b3e1 pinctrl: renesas: rza2: Add lock around 
pinctrl_generic{{add,remove}_group,{add,remove}_function}
91cbf41a9d8b clk: Fix undefined reference to `clk_rate_exclusive_{get,put}'
148a86651caf scsi: core: raid_class: Remove raid_component_add()
5d02f4320a95 scsi: snic: Fix double free in snic_tgt_create()
d643d3f322e8 ASoC: rt711: add two jack detection modes
c7b26063fcae drm/i915: Fix premature release of request's reusable memory
2d69f68ad409 cgroup/cpuset: Free DL BW in case can_attach() fails
4603c2a104bc sched/deadline: Create DL BW alloc, free & check overflow 
interface
c9546921a4b9 cgroup/cpuset: Iterate only if DEADLINE tasks are present
5ac05ce56843 sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets
b950133d9a73 sched/cpuset: Bring back cpuset_mutex
312713e3eae3 cgroup/cpuset: Rename functions dealing with DEADLINE 
accounting
b2125926ba66 timers/nohz: Switch to ONESHOT_STOPPED in the low-res handler 
when the tick is stopped
ae4f109b954d tick: Detect and fix jiffies update stall
c7e91047d345 torture: Fix hang during kthread shutdown phase
4bc6a4fca1f0 x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling 
OSXSAVE in CR4
9e0c0b4ce541 drm/display/dp: Fix the DP DSC Receiver cap size
8735d1c66c7c drm/vmwgfx: Fix shader stage validation
ff0639b222e7 PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() 
only for non-root bus
da4e9eff0f1e media: vcodec: Fix potential array out-of-bounds in encoder 
queue_setup
d2540b5f5aa1 of: dynamic: Refactor action prints to not use "%pOF" inside 
devtree_lock
851f686ed0f5 radix tree: remove unused variable
3b9a61570bc1 lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
72e4a5a28ebf batman-adv: Hold rtnl lock during MTU update via netlink
ee1d443eefb2 batman-adv: Fix batadv_v_ogm_aggr_send memory leak
0c6da1d84921 batman-adv: Fix TT global entry leak when client roamed back
6f5d10c0ac60 batman-adv: Do not get eth header before 
batadv_check_management_packet
7c0959088366 batman-adv: Don't increase MTU when set by user
480f2a129d8d batman-adv: Trigger events for auto adjusted MTU
0dbedf9afee3 selinux: set next pointer before attaching to list
a54c2048cd75 nfsd: Fix race to FREE_STATEID and cl_revoked
7c262127d264 NFS: Fix a use after free in nfs_direct_join_group()
f3c5697aae62 mm: add a call to flush_cache_vmap() in vmap_pfn()
c9a0e31d9239 clk: Fix slab-out-of-bounds error in devm_clk_release()
f979b92db1f5 NFSv4: Fix dropped lock for racing OPEN and delegation return
0a809e01578b ibmveth: Use dcbf rather than dcbfl
ffde5f9e8876 bonding: fix macvlan over alb bond support
615ea2603dc8 net: remove bond_slave_has_mac_rcu()
c8e1e17dee53 rtnetlink: Reject negative ifindexes in RTM_NEWLINK
7b79dabd639c rtnetlink: return ENODEV when ifname does not exist and group 
is given
d64cdb9cb629 netfilter: nf_tables: fix out of memory error handling
5db1249c70b1 net/sched: fix a qdisc modification with ambiguous command 
request
3847137cd167 igb: Avoid starting unnecessary workqueues
fa7d7a7f007b ice: fix receive buffer size miscalculation
70dfdbba3070 net: validate veth and vxcan peer ifindexes
67c8d7ef54df net: bcmgenet: Fix return value check for fixed_phy_register()
92b20b1569eb net: bgmac: Fix return value check for fixed_phy_register()
0b39e3070a00 ipvlan: Fix a reference count leak warning in 

[OE-core][kirkstone 05/10] linux-yocto/5.10: update to v5.10.192

[Steve Sakoman]

From: Bruce Ashfield 

Updating  to the latest korg -stable release that comprises
the following commits:

1599cb60bace Linux 5.10.192
0e8139f92304 x86/srso: Correct the mitigation status when SMT is disabled
23e59874657c objtool/x86: Fixup frame-pointer vs rethunk
26e3f7690cda x86/retpoline,kprobes: Fix position of thunk sections with 
CONFIG_LTO_CLANG
88e16ce7f8a6 x86/srso: Disable the mitigation on unaffected configurations
69712baf2495 x86/CPU/AMD: Fix the DIV(0) initial fix attempt
62ebfeb0dcf7 x86/retpoline: Don't clobber RFLAGS during srso_safe_ret()
91b349289ef1 x86/static_call: Fix __static_call_fixup()
d2be58f9215a x86/srso: Explain the untraining sequences a bit more
06597b650beb x86/cpu: Cleanup the untrain mess
e0f50b0e4186 x86/cpu: Rename srso_(.*)_alias to srso_alias_\1
0676a392539b x86/cpu: Rename original retbleed methods
8b0ff83e8ad3 x86/cpu: Clean up SRSO return thunk mess
20e24c8b4c2a x86/ibt: Add ANNOTATE_NOENDBR
bbbe1b23c7e6 objtool: Add frame-pointer-specific function ignore
bd3d12e6fda0 x86/alternative: Make custom return thunk unconditional
043d3bfe0a72 x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
d5b3c88d153c x86/cpu: Fix __x86_return_thunk symbol type
5962f64ed2b6 mmc: f-sdh30: fix order of function calls in 
sdhci_f_sdh30_remove
98c7fe38c41e net: fix the RTO timer retransmitting skb every 1ms if linear 
option is enabled
9aead733f5e0 virtio-net: set queues after driver_ok
c080cee93030 af_unix: Fix null-ptr-deref in unix_stream_sendpage().
7aa165d761e7 netfilter: set default timeout to 3 secs for sctp shutdown 
send and recv state
e62de63c63f3 mmc: block: Fix in_flight[issue_type] value error
9022e9e62db9 mmc: wbsd: fix double mmc_free_host() in wbsd_init()
6e74926ede96 cifs: Release folio lock on fscache read hit.
a04ac0c31881 ALSA: usb-audio: Add support for Mythware XA001AU capture and 
playback interfaces.
bd70d0b28010 serial: 8250: Fix oops for port->pm on uart_change_pm()
03a7f213af46 ALSA: hda/realtek - Remodified 3k pull low procedure
b7d1c719842d ASoC: meson: axg-tdm-formatter: fix channel slot allocation
e761b7e90ac9 ASoC: rt5665: add missed regulator_bulk_disable
d23dd85903c9 arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
70626b93d6eb arm64: dts: rockchip: sort nodes/properties on rk3399-rock-4
7ba9ac0b5a90 arm64: dts: rockchip: fix regulator name on rk3399-rock-4
fba59a4b55ae arm64: dts: rockchip: add SPDIF node for ROCK Pi 4
77806f63c317 arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4
1411c3e86e66 arm64: dts: rockchip: use USB host by default on 
rk3399-rock-pi-4
eb5b1e932c18 arm64: dts: rockchip: fix supplies on rk3399-rock-pi-4
73990370d63d bus: ti-sysc: Flush posted write on enable before reset
0a593e8a9d24 net: do not allow gso_size to be set to GSO_BY_FRAGS
51bc052db86d sock: Fix misuse of sk_under_memory_pressure()
773075d38a2f net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
0a9040dedec2 i40e: fix misleading debug logs
abe68922d774 team: Fix incorrect deletion of ETH_P_8021AD protocol vid from 
slaves
526d42c558f5 net: phy: broadcom: stub c45 read/write for 54810
a7653eaea0a5 netfilter: nft_dynset: disallow object maps
49f57a9087d1 ipvs: fix racy memcpy in proc_do_sync_threshold
c8d0d3811e20 drm/panel: simple: Fix AUO G121EAN01 panel timings according 
to the docs
86517421f470 selftests: mirror_gre_changes: Tighten up the TTL test match
614811692e21 xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
bd30aa9c7feb xfrm: add NULL check in xfrm_update_ae_params
0b4d69539fde ip_vti: fix potential slab-use-after-free in decode_session6
ec23b25e5687 ip6_vti: fix slab-use-after-free in decode_session6
bafa23638081 xfrm: fix slab-use-after-free in decode_session6
0f89909c80a9 net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
8b92d03cfcec net: af_key: fix sadb_x_filter validation
7e50815d2903 net: xfrm: Fix xfrm_address_filter OOB read
549e4e167a4d i2c: designware: Handle invalid SMBus block data response 
length value
bd7bef82ce0e btrfs: fix BUG_ON condition in btrfs_cancel_balance
483d713ba2f6 tty: serial: fsl_lpuart: Clear the error flags by writing 1 
for lpuart32 platforms
869ce5e59845 tty: n_gsm: fix the UAF caused by race condition in 
gsm_cleanup_mux
0ba7f969be59 powerpc/rtas_flash: allow user copy to flash block cache 
objects
c5f59de36202 fbdev: mmp: fix value check in mmphw_probe()
268cc9bc54bd i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
3ff54d904faf virtio-mmio: don't break lifecycle of vm_dev
b1fe05cc5126 virtio-mmio: Use to_virtio_mmio_device() to simply code
3b76d9263679 tracing/probes: Fix to update dynamic data counter if fetcharg 
uses it
265a979dedb1 tracing/probes: Have process_fetch_insn() take a void * 
instead of pt_regs

[OE-core][kirkstone 04/10] linux-yocto/5.10: update to v5.10.191

[Steve Sakoman]

From: Bruce Ashfield 

Updating  to the latest korg -stable release that comprises
the following commits:

da742ebfa00c Linux 5.10.191
3b55ce96efc5 sch_netem: fix issues in netem_change() vs get_dist_table()
db9d161a0407 alpha: remove __init annotation from exported page_is_ram()
4af122b5d7b8 scsi: qedf: Fix firmware halt over suspend and resume
3bb05745cacc scsi: qedi: Fix firmware halt over suspend and resume
aa9a76d5ffde scsi: core: Fix possible memory leak if device_add() fails
58889d5ad74c scsi: snic: Fix possible memory leak if device_add() fails
a370e2d653e5 scsi: 53c700: Check that command slot is not NULL
1678408d08f3 scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
267ad381c2fc scsi: core: Fix legacy /proc parsing buffer overflow
039ce5eb6ba2 netfilter: nf_tables: report use refcount overflow
93b3195d370a nvme-rdma: fix potential unbalanced freeze & unfreeze
9ad83e3e6121 nvme-tcp: fix potential unbalanced freeze & unfreeze
200ae5fa0b7e btrfs: set cache_block_group_error if we find an error
bd3175f9d597 btrfs: don't stop integrity writeback too early
c91d822127d3 ibmvnic: Handle DMA unmapping of login buffs in release 
functions
9024873b943d ibmvnic: Unmap DMA login rsp buffer on send login fail
d4750cea76f7 ibmvnic: Enforce stronger sanity checks on login response
879750c6a7e1 net/mlx5: Allow 0 for total host VFs
f8510dfa958b dmaengine: mcf-edma: Fix a potential un-allocated memory access
e8d349408a49 net: hns3: add wait until mac link down
70660e6faac5 net: hns3: refactor hclge_mac_link_status_wait for interface 
reuse
b564f32fb369 net: phy: at803x: remove set/get wol callbacks for AR8032
0d3573811894 wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
33c677d1e087 IB/hfi1: Fix possible panic during hotplug remove
13f7752f4adb drivers: net: prevent tun_build_skb() to exceed the packet 
size limit
6d701c95ee64 dccp: fix data-race around dp->dccps_mss_cache
6d0bd7b7b3a7 bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid 
from slaves
5850c391fd7e tunnels: fix kasan splat when generating ipv4 pmtu error
b3b6b9331abc net/packet: annotate data-races around tp->status
cafe399d4d50 mISDN: Update parameter type of dsp_cmx_send()
4f1d1cc16ad3 selftests: forwarding: tc_flower: Relax success criterion
501e3de09a53 selftests: forwarding: Switch off timeout
fe8fac37aa73 selftests: forwarding: Skip test when no interfaces are 
specified
44a47be97cf2 selftests: forwarding: ethtool_extended_state: Skip when using 
veth pairs
0a93fa240d7c selftests: forwarding: ethtool: Skip when using veth pairs
7e6af9c133c0 selftests: forwarding: Add a helper to skip test when using 
veth pairs
e731ad522159 selftests/rseq: Fix build with undefined __weak
cba47d0c95fb drm/nouveau/disp: Revert a NULL check inside 
nouveau_connector_get_modes
98eaa12c967b x86: Move gds_ucode_mitigated() declaration to header
09f78fc442fa x86/speculation: Add cpu_show_gds() prototype
5258281a930c x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
eda9f8ffca46 x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
cb1eefc04634 x86/srso: Fix build breakage with the LLVM linker
df8d390a210f usb: common: usb-conn-gpio: Prevent bailing out if initial 
role is none
598ccdb92dec usb: dwc3: Properly handle processing of pending events
fe7c3a445d22 usb-storage: alauda: Fix uninit-value in alauda_check_media()
d7e5e2b87f5d binder: fix memory leak in binder_init()
0439ce5aefcd iio: cros_ec: Fix the allocation size for cros_ec_command
aa425ee2278d io_uring: correct check for O_TMPFILE
372072408724 nilfs2: fix use-after-free of nilfs_root in dirtying inodes 
via iput
a16c66baa4de x86/pkeys: Revert a5eff7259790 ("x86/pkeys: Add PKRU value to 
init_fpstate")
04499d2c973a radix tree test suite: fix incorrect allocation size for 
pthreads
db0e1e2abddb hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for 
pfe1100
a73d999fdfd9 drm/amd/display: check attr flag before set cursor degamma on 
DCN3+
188e8e25ae24 drm/shmem-helper: Reset vma->vm_ops before calling 
dma_buf_mmap()
6b6839e440d7 drm/nouveau/gr: enable memory loads on helper invocation on 
all channels
002cde0b78d3 riscv,mmio: Fix readX()-to-delay() ordering
8362ad5367dc dmaengine: pl330: Return DMA_PAUSED when transaction is paused
7328c5319e08 selftests/bpf: Fix sk_assign on s390x
b1a3e27d6bfc selftests/bpf: Workaround verification failure for 
fexit_bpf2bpf/func_replace_return_code
4af2d9ddb7e7 selftests/bpf: make test_align selftest more robust
1952a4d5e4cf bpf: aggressively forget precise markings during state 
checkpointing
7ca3e7459f4a bpf: stop setting precise in current state
2474ec58b96d bpf: allow precision tracking for programs with subprogs
6796c2a0c5fc ipv6: adjust ndisc_is_useropt() to also 

[OE-core][kirkstone 03/10] linux-yocto/5.10: update to v5.10.189

[Steve Sakoman]

From: Bruce Ashfield 

Updating  to the latest korg -stable release that comprises
the following commits:

de5f63612d16 Linux 5.10.189
2ae9a73819a7 x86: fix backwards merge of GDS/SRSO bit
f9167a2d6b94 xen/netback: Fix buffer overrun triggered by unusual packet
8457fb5740b1 x86/srso: Tie SBPB bit setting to microcode patch detection
4873939c0e1c x86/srso: Fix return thunks in generated code
384d41bea948 x86/srso: Add IBPB on VMEXIT
4acaea47e3bc x86/srso: Add IBPB
e47af0c255ae x86/srso: Add SRSO_NO support
df76a59feba5 x86/srso: Add IBPB_BRTYPE support
3f9b7101bea1 x86/srso: Add a Speculative RAS Overflow mitigation
34f23ba8a399 x86/cpu, kvm: Add support for CPUID_8021_EAX
073a28a9b506 x86/bugs: Increase the x86 bugs vector size to two u32s
9b7fe7c6fbc0 tools headers cpufeatures: Sync with the kernel sources
437fa179f213 x86/cpufeatures: Assign dedicated feature word for 
CPUID_0x801F[EAX]
baf6d6c39e23 x86/cpu: Add VM page flush MSR availablility as a CPUID feature
675046878431 Documentation/x86: Fix backwards on/off logic about YMM support
79972c2b95ec x86/mm: Initialize text poking earlier
1ff14defdfc9 mm: Move mm_cachep initialization to mm_init()
6ee042fd240f x86/mm: Use mm_alloc() in poking_init()
f076d0817878 x86/mm: fix poking_init() for Xen PV guests
583016037a09 x86/xen: Fix secondary processors' FPU initialization
eb13cce48874 KVM: Add GDS_NO support to KVM
7db4ddcb8d8e x86/speculation: Add Kconfig option for GDS
363c98f9cfa8 x86/speculation: Add force option to GDS mitigation
288a2f6bc1ce x86/speculation: Add Gather Data Sampling mitigation
4ae1cbb730bd x86/fpu: Move FPU initialization into arch_cpu_finalize_init()
2462bc3ef061 x86/fpu: Mark init functions __init
7a2f42bce9ab x86/fpu: Remove cpuinfo argument from init functions
18fcd72da1ed init, x86: Move mem_encrypt_init() into 
arch_cpu_finalize_init()
09658b81d158 init: Invoke arch_cpu_finalize_init() earlier
bf2fa3a9d0e6 init: Remove check_bugs() leftovers
b05031c2bca7 um/cpu: Switch to arch_cpu_finalize_init()
2edb3b39ca79 sparc/cpu: Switch to arch_cpu_finalize_init()
3c45134b38b4 sh/cpu: Switch to arch_cpu_finalize_init()
75bb54c951e9 mips/cpu: Switch to arch_cpu_finalize_init()
1cd3fc18eb16 m68k/cpu: Switch to arch_cpu_finalize_init()
12d93c6c98d5 ia64/cpu: Switch to arch_cpu_finalize_init()
c0fff20d4efa ARM: cpu: Switch to arch_cpu_finalize_init()
e5eb18e164d0 x86/cpu: Switch to arch_cpu_finalize_init()
6e606e681873 init: Provide arch_cpu_finalize_init()

Signed-off-by: Bruce Ashfield 
Signed-off-by: Steve Sakoman 
---
 .../linux/linux-yocto-rt_5.10.bb  |  6 ++---
 .../linux/linux-yocto-tiny_5.10.bb|  8 +++
 meta/recipes-kernel/linux/linux-yocto_5.10.bb | 24 +--
 3 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_5.10.bb 
b/meta/recipes-kernel/linux/linux-yocto-rt_5.10.bb
index 5b59ebac16..772ffac071 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_5.10.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_5.10.bb
@@ -11,13 +11,13 @@ python () {
 raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to 
linux-yocto-rt to enable it")
 }
 
-SRCREV_machine ?= "40d51460c17be51e4ebcdcc54a8ee8c86707c56c"
-SRCREV_meta ?= "9b0d4e338b1bbdd683347cf9365bacfec2169035"
+SRCREV_machine ?= "63fd205e5d1e048a576d5ba03cdbdf5782a2f6b4"
+SRCREV_meta ?= "603507f09e4a22a650e37fb9dcfbcb69ceb36841"
 
 SRC_URI = 
"git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine \

git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.10;destsuffix=${KMETA}"
 
-LINUX_VERSION ?= "5.10.188"
+LINUX_VERSION ?= "5.10.189"
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
 
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_5.10.bb 
b/meta/recipes-kernel/linux/linux-yocto-tiny_5.10.bb
index 3a58a1a659..aebec33555 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_5.10.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_5.10.bb
@@ -6,7 +6,7 @@ KCONFIG_MODE = "--allnoconfig"
 
 require recipes-kernel/linux/linux-yocto.inc
 
-LINUX_VERSION ?= "5.10.188"
+LINUX_VERSION ?= "5.10.189"
 LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
 
 DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -15,9 +15,9 @@ DEPENDS += "openssl-native util-linux-native"
 KMETA = "kernel-meta"
 KCONF_BSP_AUDIT_LEVEL = "2"
 
-SRCREV_machine:qemuarm ?= "41daa5d20567419e303d0b684fd3c3c859446d24"
-SRCREV_machine ?= "085bed8577aa6435339ff83339e38dfd9e7994a6"
-SRCREV_meta ?= "9b0d4e338b1bbdd683347cf9365bacfec2169035"
+SRCREV_machine:qemuarm ?= "8f8fe5c5719959ad536be166937fc22606b7a7f3"
+SRCREV_machine ?= "452190ae123212f7d3c233fc48419c60874f4223"
+SRCREV_meta ?= 

[OE-core][kirkstone 00/10] Patch review

[Steve Sakoman]

Please review this set of patches for kirkstone and have comments back by
end of day Thursday, October 5

Passed a-full on autobuilder:

https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5984

except for the meta-aws test, which breaks due to recent commits there.  
Maintainer notified.

The following changes since commit 7e177848f97eb9958619c28b5e5dadee12f67507:

  kernel.bbclass: Add force flag to rm calls (2023-09-27 06:09:46 -1000)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
  
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut

Bruce Ashfield (5):
  linux-yocto/5.10: update to v5.10.189
  linux-yocto/5.10: update to v5.10.191
  linux-yocto/5.10: update to v5.10.192
  linux-yocto/5.10: update to v5.10.194
  linux-yocto/5.10: update to v5.10.197

Martin Jansa (2):
  ccache: fix build with gcc-13
  fontcache.bbclass: avoid native recipes depending on target fontconfig

Narpat Mali (1):
  python3-jinja2: fix for the ptest result format

Peter Marko (1):
  json-c: define CVE_VERSION

Shubham Kulkarni (1):
  go: Update fix for CVE-2023-24538 & CVE-2023-39318

 meta/classes/fontcache.bbclass|   1 +
 ...x-FTBFS-with-not-yet-released-GCC-13.patch |  92 +++
 meta/recipes-devtools/ccache/ccache_4.6.bb|   4 +-
 meta/recipes-devtools/go/go-1.17.13.inc   |   3 +-
 .../go/go-1.18/CVE-2023-24538_1.patch | 597 ++
 ...023-24538.patch => CVE-2023-24538_2.patch} | 175 -
 .../go/go-1.21/CVE-2023-39318.patch   |  44 +-
 meta/recipes-devtools/json-c/json-c_0.15.bb   |   3 +
 .../python/python3-jinja2/run-ptest   |   2 +-
 .../linux/linux-yocto-rt_5.10.bb  |   6 +-
 .../linux/linux-yocto-tiny_5.10.bb|   8 +-
 meta/recipes-kernel/linux/linux-yocto_5.10.bb |  24 +-
 12 files changed, 921 insertions(+), 38 deletions(-)
 create mode 100644 
meta/recipes-devtools/ccache/ccache/0001-build-Fix-FTBFS-with-not-yet-released-GCC-13.patch
 create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2023-24538_1.patch
 rename meta/recipes-devtools/go/go-1.18/{CVE-2023-24538.patch => 
CVE-2023-24538_2.patch} (53%)

-- 
2.34.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188650): 
https://lists.openembedded.org/g/openembedded-core/message/188650
Mute This Topic: https://lists.openembedded.org/mt/101741370/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core][kirkstone 01/10] json-c: define CVE_VERSION

[Steve Sakoman]

From: Peter Marko 

Recently NVD updated all CVEs for json-c and old fixed
CVE-2020-12762 is reported by cve_check now.
NVD match clause now includes full tag name including
date which is "greater" than tag without additional numbers.

Fix it by defining CVE_VERSION identical to full tag.
Put it close to hash so recipe update patch includes this line.

Signed-off-by: Peter Marko 
Signed-off-by: Steve Sakoman 
---
 meta/recipes-devtools/json-c/json-c_0.15.bb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/meta/recipes-devtools/json-c/json-c_0.15.bb 
b/meta/recipes-devtools/json-c/json-c_0.15.bb
index 4da30bc50c..b3679e0135 100644
--- a/meta/recipes-devtools/json-c/json-c_0.15.bb
+++ b/meta/recipes-devtools/json-c/json-c_0.15.bb
@@ -12,6 +12,9 @@ SRC_URI = " \
 
 SRC_URI[sha256sum] = 
"b8d80a1ddb718b3ba7492916237bbf86609e9709fb007e7f7d4322f02341a4c6"
 
+# NVD uses full tag name including date
+CVE_VERSION = "0.15-20200726"
+
 UPSTREAM_CHECK_URI = "https://github.com/${BPN}/${BPN}/tags;
 UPSTREAM_CHECK_REGEX = "json-c-(?P\d+(\.\d+)+)-\d+"
 
-- 
2.34.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188651): 
https://lists.openembedded.org/g/openembedded-core/message/188651
Mute This Topic: https://lists.openembedded.org/mt/101741372/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [OE-core] [mickledore][PATCH] glibc: Fix CVE-2023-5156

[Steve Sakoman]

Unfortunately this patch doesn't apply (even after I edited for the
previous addition of glibc: fix CVE-2023-4806

ERROR: glibc-2.37-r1 do_patch: Applying patch
'0024-CVE-2023-5156-1.patch' on target directory
'/home/steve/builds/poky-contrib-mickledore/build/tmp/work/core2-64-poky-linux/glibc/2.37-r1/git'
CmdError('quilt --quiltrc
/home/steve/builds/poky-contrib-mickledore/build/tmp/work/core2-64-poky-linux/glibc/2.37-r1/recipe-sysroot-native/etc/quiltrc
push', 0, 'stdout: Applying patch 0024-CVE-2023-5156-1.patch
patching file nss/Makefile
Hunk #1 FAILED at 82.
Hunk #2 FAILED at 145.
Hunk #3 FAILED at 180.
Hunk #4 FAILED at 195.
Hunk #5 FAILED at 215.
5 out of 5 hunks FAILED -- rejects in file nss/Makefile
The next patch would create the file nss/nss_test_gai_hv2_canonname.c,
which already exists!  Applying it anyway.
patching file nss/nss_test_gai_hv2_canonname.c
Hunk #1 FAILED at 1.
1 out of 1 hunk FAILED -- rejects in file nss/nss_test_gai_hv2_canonname.c
The next patch would create the file nss/tst-nss-gai-hv2-canonname.c,
which already exists!  Applying it anyway.
patching file nss/tst-nss-gai-hv2-canonname.c
Hunk #1 FAILED at 1.
1 out of 1 hunk FAILED -- rejects in file nss/tst-nss-gai-hv2-canonname.c
The next patch would create the file nss/tst-nss-gai-hv2-canonname.h,
which already exists!  Applying it anyway.
patching file nss/tst-nss-gai-hv2-canonname.h
Hunk #1 FAILED at 1.
1 out of 1 hunk FAILED -- rejects in file nss/tst-nss-gai-hv2-canonname.h
The next patch would empty out the file
nss/tst-nss-gai-hv2-canonname.root/postclean.req,
which is already empty!  Applying it anyway.
patching file nss/tst-nss-gai-hv2-canonname.root/postclean.req
The next patch would create the file
nss/tst-nss-gai-hv2-canonname.root/tst-nss-gai-hv2-canonname.script,
which already exists!  Applying it anyway.
patching file 
nss/tst-nss-gai-hv2-canonname.root/tst-nss-gai-hv2-canonname.script
Hunk #1 FAILED at 1.
1 out of 1 hunk FAILED -- rejects in file
nss/tst-nss-gai-hv2-canonname.root/tst-nss-gai-hv2-canonname.script
patching file sysdeps/posix/getaddrinfo.c
Hunk #1 FAILED at 120.
Hunk #2 FAILED at 165.
Hunk #3 FAILED at 203.
Hunk #4 succeeded at 248 with fuzz 2 (offset 10 lines).
Hunk #5 FAILED at 271.
Hunk #6 FAILED at 333.
Hunk #7 FAILED at 780.
6 out of 7 hunks FAILED -- rejects in file sysdeps/posix/getaddrinfo.c
Patch 0024-CVE-2023-5156-1.patch can be reverse-applied

Steve

On Tue, Oct 3, 2023 at 1:30 AM  wrote:
>
> From: Deepthi Hemraj 
>
> Signed-off-by: Deepthi Hemraj 
> ---
>  .../glibc/glibc/0024-CVE-2023-5156-1.patch| 329 ++
>  .../glibc/glibc/0024-CVE-2023-5156-2.patch|  93 +
>  meta/recipes-core/glibc/glibc_2.37.bb |   2 +
>  3 files changed, 424 insertions(+)
>  create mode 100644 meta/recipes-core/glibc/glibc/0024-CVE-2023-5156-1.patch
>  create mode 100644 meta/recipes-core/glibc/glibc/0024-CVE-2023-5156-2.patch
>
> diff --git a/meta/recipes-core/glibc/glibc/0024-CVE-2023-5156-1.patch 
> b/meta/recipes-core/glibc/glibc/0024-CVE-2023-5156-1.patch
> new file mode 100644
> index 00..65afaa446a
> --- /dev/null
> +++ b/meta/recipes-core/glibc/glibc/0024-CVE-2023-5156-1.patch
> @@ -0,0 +1,329 @@
> +From: Siddhesh Poyarekar 
> +Date: Fri, 15 Sep 2023 17:51:12 + (-0400)
> +Subject: getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
> +X-Git-Url: 
> https://sourceware.org/git/?p=glibc.git;a=commitdiff_plain;h=973fe93a5675c42798b2161c6f29c01b0e243994
> +
> +getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
> +
> +When an NSS plugin only implements the _gethostbyname2_r and
> +_getcanonname_r callbacks, getaddrinfo could use memory that was freed
> +during tmpbuf resizing, through h_name in a previous query response.
> +
> +The backing store for res->at->name when doing a query with
> +gethostbyname3_r or gethostbyname2_r is tmpbuf, which is reallocated in
> +gethosts during the query.  For AF_INET6 lookup with AI_ALL |
> +AI_V4MAPPED, gethosts gets called twice, once for a v6 lookup and second
> +for a v4 lookup.  In this case, if the first call reallocates tmpbuf
> +enough number of times, resulting in a malloc, th->h_name (that
> +res->at->name refers to) ends up on a heap allocated storage in tmpbuf.
> +Now if the second call to gethosts also causes the plugin callback to
> +return NSS_STATUS_TRYAGAIN, tmpbuf will get freed, resulting in a UAF
> +reference in res->at->name.  This then gets dereferenced in the
> +getcanonname_r plugin call, resulting in the use after free.
> +
> +Fix this by copying h_name over and freeing it at the end.  This
> +resolves BZ #30843, which is assigned CVE-2023-4806.
> +
> +Signed-off-by: Siddhesh Poyarekar 
> +
> +Upstream-Status: Backport 
> [https://sourceware.org/git/?p=glibc.git;a=commitdiff_plain;h=973fe93a5675c42798b2161c6f29c01b0e243994]
> +
> +CVE: CVE-2023-5156
> +
> +Signed-off-by: Deepthi Hemraj 
> +
> +---
> +
> +diff --git a/nss/Makefile b/nss/Makefile
> +index 06fcdc450f..8a5126ecf3 

[OE-core][dunfell][PATCH v5] go: Update fix for CVE-2023-24538 & CVE-2023-39318

[Shubham Kulkarni via lists.openembedded.org]

From: Shubham Kulkarni 

Add missing files in fix for CVE-2023-24538 & CVE-2023-39318

Upstream Link -
CVE-2023-24538: 
https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b
CVE-2023-39318: 
https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c

Signed-off-by: Shubham Kulkarni 
---
 meta/recipes-devtools/go/go-1.14.inc  |   5 +-
 .../go/go-1.14/CVE-2023-24538-1.patch |   4 +-
 .../go/go-1.14/CVE-2023-24538-2.patch | 447 -
 .../go/go-1.14/CVE-2023-24538_3.patch | 393 
 .../go/go-1.14/CVE-2023-24538_4.patch | 497 +++
 .../go/go-1.14/CVE-2023-24538_5.patch | 585 ++
 ...3-24538-3.patch => CVE-2023-24538_6.patch} | 175 +-
 .../go/go-1.14/CVE-2023-39318.patch   |  38 +-
 8 files changed, 2124 insertions(+), 20 deletions(-)
 create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_3.patch
 create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_4.patch
 create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_5.patch
 rename meta/recipes-devtools/go/go-1.14/{CVE-2023-24538-3.patch => 
CVE-2023-24538_6.patch} (53%)

diff --git a/meta/recipes-devtools/go/go-1.14.inc 
b/meta/recipes-devtools/go/go-1.14.inc
index be63f64825..091b778de8 100644
--- a/meta/recipes-devtools/go/go-1.14.inc
+++ b/meta/recipes-devtools/go/go-1.14.inc
@@ -60,7 +60,10 @@ SRC_URI += "\
 file://CVE-2023-24534.patch \
 file://CVE-2023-24538-1.patch \
 file://CVE-2023-24538-2.patch \
-file://CVE-2023-24538-3.patch \
+file://CVE-2023-24538_3.patch \
+file://CVE-2023-24538_4.patch \
+file://CVE-2023-24538_5.patch \
+file://CVE-2023-24538_6.patch \
 file://CVE-2023-24539.patch \
 file://CVE-2023-24540.patch \
 file://CVE-2023-29405-1.patch \
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-1.patch 
b/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-1.patch
index eda26e5ff6..23c5075e41 100644
--- a/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-1.patch
+++ b/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-1.patch
@@ -1,7 +1,7 @@
 From 8acd01094d9ee17f6e763a61e49a8a808b3a9ddb Mon Sep 17 00:00:00 2001
 From: Brad Fitzpatrick 
 Date: Mon, 2 Aug 2021 14:55:51 -0700
-Subject: [PATCH 1/3] net/netip: add new IP address package
+Subject: [PATCH 1/6] net/netip: add new IP address package
 
 Co-authored-by: Alex Willmer  (GitHub @moreati)
 Co-authored-by: Alexander Yastrebov 
@@ -31,7 +31,7 @@ Trust: Brad Fitzpatrick 
 
 Dependency Patch #1
 
-Upstream-Status: Backport 
[https://github.com/golang/go/commit/a59e33224e42d60a97fa720a45e1b74eb6aaa3d0]
+Upstream-Status: Backport from 
https://github.com/golang/go/commit/a59e33224e42d60a97fa720a45e1b74eb6aaa3d0
 CVE: CVE-2023-24538
 Signed-off-by: Shubham Kulkarni 
 ---
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-2.patch 
b/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-2.patch
index 5036f2890b..f200c41e16 100644
--- a/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-2.patch
+++ b/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-2.patch
@@ -1,7 +1,7 @@
 From 6fc21505614f36178df0dad7034b6b8e3f7588d5 Mon Sep 17 00:00:00 2001
 From: empijei 
 Date: Fri, 27 Mar 2020 19:27:55 +0100
-Subject: [PATCH 2/3] html/template,text/template: switch to Unicode escapes
+Subject: [PATCH 2/6] html/template,text/template: switch to Unicode escapes
  for JSON compatibility
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -31,10 +31,238 @@ Upstream-Status: Backport from 
https://github.com/golang/go/commit/d4d298040d072
 CVE: CVE-2023-24538
 Signed-off-by: Shubham Kulkarni 
 ---
- src/html/template/js.go| 70 +++---
- src/text/template/funcs.go |  8 +++---
- 2 files changed, 46 insertions(+), 32 deletions(-)
+ src/html/template/content_test.go  | 70 +++---
+ src/html/template/escape_test.go   |  6 ++--
+ src/html/template/example_test.go  |  6 ++--
+ src/html/template/js.go| 70 +++---
+ src/html/template/js_test.go   | 68 ++--
+ src/html/template/template_test.go | 39 +
+ src/text/template/exec_test.go |  6 ++--
+ src/text/template/funcs.go |  8 ++---
+ 8 files changed, 163 insertions(+), 110 deletions(-)
 
+diff --git a/src/html/template/content_test.go 
b/src/html/template/content_test.go
+index 72d56f5..bd86527 100644
+--- a/src/html/template/content_test.go
 b/src/html/template/content_test.go
+@@ -18,7 +18,7 @@ func TestTypedContent(t *testing.T) {
+   HTML(`Hello, World tc!`),
+   HTMLAttr(` dir="ltr"`),
+   JS(`c && alert("Hello, World!");`),
+-  JSStr(`Hello, World & O'Reilly\x21`),
++  JSStr(`Hello, World & O'Reilly\u0021`),
+   URL(`greeting=H%69,=(World)`),
+   

[OE-core] [PATCH] packages.bbclass: Correct the check for conflicts with renamed packages

[Peter Kjellerstedt]

The original solution replaced all overrides with the package name that
was being checked. This can have unforseen consequences where some
variable involved in defining the value for the PKG: variable
may rely on some override which is not set as expected. It also meant
that any PKG variable set using an override would not be caught, e.g.,
PKG:${PN}:${MACHINE} = "${PN}-dev" (made up example that would always
fail with the old code).

Signed-off-by: Peter Kjellerstedt 
---
 meta/classes-global/package.bbclass | 8 +++-
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/meta/classes-global/package.bbclass 
b/meta/classes-global/package.bbclass
index 0338a5c690..7787042e21 100644
--- a/meta/classes-global/package.bbclass
+++ b/meta/classes-global/package.bbclass
@@ -508,11 +508,9 @@ python do_package () {
 # Check for conflict between renamed packages and existing ones
 # for each package in PACKAGES, check if it will be renamed to an existing 
one
 for p in packages:
-localdata = bb.data.createCopy(d)
-localdata.setVar('OVERRIDES', p)
-rename = localdata.getVar('PKG')
-if (rename != None) and rename in packages:
-bb.fatal('package "%s" is renamed to "%s" using PKG:%s, but 
package name already exists'%(p,rename,p))
+rename = d.getVar('PKG:%s' % p)
+if rename and rename in packages:
+bb.fatal('package "%s" is renamed to "%s" using PKG:%s, but 
package name already exists' % (p, rename, p))
 
 ###
 # Optimisations

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188646): 
https://lists.openembedded.org/g/openembedded-core/message/188646
Mute This Topic: https://lists.openembedded.org/mt/101739066/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [OE-core][dunfell][PATCH v3] go: Update fix for CVE-2023-24538 & CVE-2023-39318

[Steve Sakoman]

On Tue, Oct 3, 2023 at 3:49 AM Shubham Kulkarni  wrote:
>
> Hi Steve,
>
> I have recreated the patch from scratch for dunfell and sent it as v4 - 
> https://lists.openembedded.org/g/openembedded-core/message/188639
> The issue in v3 might be due to whitespaces. But v4 should be good.

Sorry, it still fails:

Applying: go: Update fix for CVE-2023-24538 & CVE-2023-39318
error: corrupt patch at line 1074
error: could not build fake ancestor

To debug, try downloading your patch from the list and then applying
it to the dunfell HEAD.

Alternatively you could download from patchworks:
https://patchwork.yoctoproject.org/project/oe-core/patch/20231003134246.24630-1-skulka...@mvista.com/

Steve

> On Sat, Sep 30, 2023 at 9:11 PM Shubham Kulkarni via lists.openembedded.org 
>  wrote:
>>
>> Apologies Steve,
>>
>> I will look into the issue and send a new patch for Dunfell. It worked for 
>> me on my machine. Maybe something I missed.
>>
>> Thanks,
>> Shubham Kulkarni
>>
>> On Sat, Sep 30, 2023 at 8:02 AM Steve Sakoman  wrote:
>>>
>>> Sorry, this patch doesn't apply:
>>>
>>> Applying: go: Update fix for CVE-2023-24538 & CVE-2023-39318
>>> error: corrupt patch at line 478
>>> error: could not build fake ancestor
>>> Patch failed at 0001 go: Update fix for CVE-2023-24538 & CVE-2023-39318
>>>
>>> Steve
>>>
>>> On Fri, Sep 29, 2023 at 9:21 AM Shubham Kulkarni via
>>> lists.openembedded.org 
>>> wrote:
>>> >
>>> > From: Shubham Kulkarni 
>>> >
>>> > Add missing files in fix for CVE-2023-24538 & CVE-2023-39318
>>> >
>>> > Upstream Link -
>>> > CVE-2023-24538: 
>>> > https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b
>>> > CVE-2023-39318: 
>>> > https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c
>>> >
>>> > Signed-off-by: Shubham Kulkarni 
>>> > ---
>>> >  meta/recipes-devtools/go/go-1.14.inc  |   5 +-
>>> >  .../go/go-1.14/CVE-2023-24538-1.patch |   4 +-
>>> >  .../go/go-1.14/CVE-2023-24538-2.patch | 447 -
>>> >  .../go/go-1.14/CVE-2023-24538_3.patch | 393 
>>> >  .../go/go-1.14/CVE-2023-24538_4.patch | 497 +++
>>> >  .../go/go-1.14/CVE-2023-24538_5.patch | 585 ++
>>> >  ...3-24538-3.patch => CVE-2023-24538_6.patch} | 175 +-
>>> >  .../go/go-1.14/CVE-2023-39318.patch   |  38 +-
>>> >  8 files changed, 2124 insertions(+), 20 deletions(-)
>>> >  create mode 100644 
>>> > meta/recipes-devtools/go/go-1.14/CVE-2023-24538_3.patch
>>> >  create mode 100644 
>>> > meta/recipes-devtools/go/go-1.14/CVE-2023-24538_4.patch
>>> >  create mode 100644 
>>> > meta/recipes-devtools/go/go-1.14/CVE-2023-24538_5.patch
>>> >  rename meta/recipes-devtools/go/go-1.14/{CVE-2023-24538-3.patch => 
>>> > CVE-2023-24538_6.patch} (53%)
>>> >
>>> > diff --git a/meta/recipes-devtools/go/go-1.14.inc 
>>> > b/meta/recipes-devtools/go/go-1.14.inc
>>> > index be63f64825..091b778de8 100644
>>> > --- a/meta/recipes-devtools/go/go-1.14.inc
>>> > +++ b/meta/recipes-devtools/go/go-1.14.inc
>>> > @@ -60,7 +60,10 @@ SRC_URI += "\
>>> >  file://CVE-2023-24534.patch \
>>> >  file://CVE-2023-24538-1.patch \
>>> >  file://CVE-2023-24538-2.patch \
>>> > -file://CVE-2023-24538-3.patch \
>>> > +file://CVE-2023-24538_3.patch \
>>> > +file://CVE-2023-24538_4.patch \
>>> > +file://CVE-2023-24538_5.patch \
>>> > +file://CVE-2023-24538_6.patch \
>>> >  file://CVE-2023-24539.patch \
>>> >  file://CVE-2023-24540.patch \
>>> >  file://CVE-2023-29405-1.patch \
>>> > diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-1.patch 
>>> > b/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-1.patch
>>> > index eda26e5ff6..23c5075e41 100644
>>> > --- a/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-1.patch
>>> > +++ b/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-1.patch
>>> > @@ -1,7 +1,7 @@
>>> >  From 8acd01094d9ee17f6e763a61e49a8a808b3a9ddb Mon Sep 17 00:00:00 2001
>>> >  From: Brad Fitzpatrick 
>>> >  Date: Mon, 2 Aug 2021 14:55:51 -0700
>>> > -Subject: [PATCH 1/3] net/netip: add new IP address package
>>> > +Subject: [PATCH 1/6] net/netip: add new IP address package
>>> >
>>> >  Co-authored-by: Alex Willmer  (GitHub @moreati)
>>> >  Co-authored-by: Alexander Yastrebov 
>>> > @@ -31,7 +31,7 @@ Trust: Brad Fitzpatrick 
>>> >
>>> >  Dependency Patch #1
>>> >
>>> > -Upstream-Status: Backport 
>>> > [https://github.com/golang/go/commit/a59e33224e42d60a97fa720a45e1b74eb6aaa3d0]
>>> > +Upstream-Status: Backport from 
>>> > https://github.com/golang/go/commit/a59e33224e42d60a97fa720a45e1b74eb6aaa3d0
>>> >  CVE: CVE-2023-24538
>>> >  Signed-off-by: Shubham Kulkarni 
>>> >  ---
>>> > diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-2.patch 
>>> > b/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-2.patch
>>> > index 5036f2890b..3840617a32 100644
>>> > --- a/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-2.patch
>>> > +++ 

[OE-core] Yocto Project Status 03 October 2023 (WW40)

[Neal Caidin]

Current Dev Position: YP 4.3 M4 (Feature Freeze)

Next Deadline: 2nd October 2023 YP 4.3 M4 build date

Next Team Meetings:

   -

   Bug Triage meeting Thursday October 5th 7:30 am PDT (
   https://zoom.us/j/454367603?pwd=ZGxoa2ZXL3FkM3Y0bFd5aVpHVVZ6dz09)
   -

   Weekly Project Engineering Sync Tuesday October 3rd at 8 am PDT (
   https://zoom.us/j/990892712?pwd=cHU1MjhoM2x6ck81bkcrYjRrcmJsUT09)
   
   -

   Twitch -  See https://www.twitch.tv/theyoctojester


Key Status/Updates:

   -

   YP 4.3 M4 is due to build this week. We have challenges due to the
   kernel version.
   -

   YP 3.1.28 was released.
   -

   YP 4.0.13 is due to be released
   -

   The biggest challenge for the M4 build is that the 6.4 kernel was made
   EOL. Thanks to hard work from Bruce we have 6.5 recipes but this kernel
   version is throwing multiple errors in testing:
   -

  cryptodev breaks (patch in master-next)
  -

  x86 image testing randomly fails with login issues (both selftest and
  testimage)
  -

  arm kvm ptest images randomly throw jitterentropy errors and fail
  -

  strace ptest failures (x86 and arm)
  -

  arm LTP testing fails with OOM crashes

We don’t have fixes for the OOM issue or strace at this point, potential
ideas for other issues are undergoing testing.

   -

   The numpy reproducibility issue was finally root caused and resolved.
   -

   Issues with mesa-native and contamination with llvm from the host have
   been resolved
   -

   Improvements to bitbake-getvar output and handling of undefined values
   were merged
   -

   The openssh ptest intermittent failure does have better logs available
   but we’ve yet to decode what it means:

http://autobuilder.yocto.io/pub/non-release/20230917-2/testresults/qemuarm64-ptest/openssh.log

   -

   The project is working on improving its security processes and policies,
   there are emails on the mailing list discussing this. Please highlight
   these to any parties who may be interested or have useful feedback.


Ways to contribute:

   -

   As people are likely aware, the project has a number of components which
   are either unmaintained, or have people with little to no time trying to
   keep them alive. These components include: patchtest, layerindex, devtool,
   toaster, wic, oeqa, autobuilder, CROPs containers, pseudo and more. Many
   have open bugs. Help is welcome in trying to better look after these
   components!
   -

   There are bugs identified as possible for newcomers to the project:
   https://wiki.yoctoproject.org/wiki/Newcomers
   -

   There are bugs that are currently unassigned for YP 4.3. See:
   
https://wiki.yoctoproject.org/wiki/Bug_Triage#Medium.2B_4.3_Unassigned_Enhancements.2FBugs
   -

   We’d welcome new maintainers for recipes in OE-Core. Please see the list
   at:
   
http://git.yoctoproject.org/cgit.cgi/poky/tree/meta/conf/distro/include/maintainers.inc
   and discuss with the existing maintainer, or ask on the OE-Core mailing
   list. We will likely move a chunk of these to “Unassigned” soon to help
   facilitate this.
   -

   Help is very much welcome in trying to resolve our autobuilder
   intermittent issues. You can see the list of failures we’re continuing to
   see by searching for the “AB-INT” tag in bugzilla:
   https://bugzilla.yoctoproject.org/buglist.cgi?quicksearch=AB-INT.
   -

   Help us resolve CVE issues: CVE metrics
   
   -

   We have a growing number of bugs in bugzilla, any help with them is
   appreciated.


YP 4.3 Milestone Dates:

   -

   YP 4.3 M3 was released.
   -

   YP 4.3 M4 build date  2023/10/02
   -

   YP 4.3 M4 Release date 2023/10/27


YP 5.0 Milestone Dates:

   -

   YP 5.0 M1 build date 2023/12/04
   -

   YP 5.0 M1 Release date 2023/12/15
   -

   YP 5.0 M2 build date  2024/01/15
   -

   YP 5.0 M2 Release date 2024/01/24
   -

   YP 5.0 M3 build date  2024/02/19
   -

   YP 5.0 M3 Release date 2024/03/01
   -

   YP 5.0 M4 build date  2024/04/01
   -

   YP 5.0 M4 Release date 2024/04/30


Upcoming dot releases:

   -

   YP 3.1.28 is ready for release.
   -

   YP 4.0.13 is in QA.
   -

   YP 3.1.29 build date 2023/10/30
   -

   YP 3.1.29 Release date 2023/11/10
   -

   YP 4.0.14 build date 2023/11/06
   -

   YP 4.0.14 Release date 2023/11/17
   -

   YP 4.2.4 build date 2023/11/13
   -

   YP 4.2.4 Release date 2023/11/24
   -

   YP 4.3.1 build date 2023/11/27
   -

   YP 4.3.1 Release date 2023/12/08
   -

   YP 3.1.30 build date 2023/12/11
   -

   YP 3.1.30 Release date 2023/12/22
   -

   YP 4.0.15 build date 2023/12/18
   -

   YP 4.0.15 Release date 2023/12/29
   -

   YP 4.3.2 build date 2024/01/08
   -

   YP 4.3.2 Release date 2024/01/19
   -

   YP 3.1.31 build date 2024/01/22
   -

   YP 3.1.31 Release date 2024/02/02
   -

   YP 4.0.16 build date 2024/01/29
   -

   YP 4.0.16 Release date 2024/02/09
   -

   YP 4.3.3 build date 

[OE-core] [PATCH] scripts/oe-setup-layers: Update how to determine if directory is git repo

[Jermain Horsman]

From: Jermain Horsman 

Previously _is_repo_git_repo() would return a result containing b'true\n' or
b'false\n' if 'git rev-parse' ran successfully, instead of True of False.

While this can be solved using e.g. result.strip().decode("utf-8") == "true",
there are some other cases to consider.
First, .git can be a file and not a directory when using a worktree.
Second, an emtpy .git directory in 'repodir' for which some parent of
'repodir' is an actual git repo will still return True in this case.

To account for these cases as well, use 'git rev-parse --show-toplevel'
and compare the result against 'repodir' instead of
using 'git rev-parse --is-inside-git-dir'.

Signed-off-by: Jermain Horsman 
---
 scripts/oe-setup-layers | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/scripts/oe-setup-layers b/scripts/oe-setup-layers
index c8012fa670..6d49688a32 100755
--- a/scripts/oe-setup-layers
+++ b/scripts/oe-setup-layers
@@ -20,13 +20,13 @@ import os
 import subprocess
 
 def _is_repo_git_repo(repodir):
-git_dir = os.path.join(repodir, ".git")
-if not os.access(git_dir, os.R_OK):
-return False
 try:
-return subprocess.check_output("git -C %s rev-parse 
--is-inside-git-dir" % git_dir, shell=True, stderr=subprocess.DEVNULL)
+curr_toplevel = subprocess.check_output("git -C %s rev-parse 
--show-toplevel" % repodir, shell=True, stderr=subprocess.DEVNULL)
+if curr_toplevel.strip().decode("utf-8") == repodir:
+return True
 except subprocess.CalledProcessError:
-return False
+pass
+return False
 
 def _is_repo_at_rev(repodir, rev):
 try:
-- 
2.42.0.windows.2


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188642): 
https://lists.openembedded.org/g/openembedded-core/message/188642
Mute This Topic: https://lists.openembedded.org/mt/101735474/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [OE-core] An insight into the kind of help we need/maintainer overload

[Marta Rybczynska]

On Mon, Oct 2, 2023 at 12:40 PM Richard Purdie
 wrote:
>
> It isn't any secret that I'm overloaded and struggle to keep up with
> the demands of the project. People often ask me "how do you need
> help?". Today, we have a fairly good example of the kind of problem I
> struggle with. So it is documented, I'll describe my side of the
> challenge.
>
> We're supposed to be building the final release candidates for 4.3
> today. We've also just found out that the 6.4 kernel is EOL much sooner
> than we guessed. The choice is ship with a known working but
> unsupportable kernel (no security updates), or try and switch to 6.5.
>
> Over the weekend (when I should really be doing anything but work), I
> tested the preliminary 6.5 patches Bruce was kind enough to prepare on
> the autobuilder.
>
> Just getting to this point is a ton of work for Bruce which goes on
> quietly relatively unrecognised. The -dev kernel has been used to try
> and prepare for the future kernel upgrades and without that we wouldn't
> be at this point already. I'm going to focus on the challenges I have
> but I want to recognise others have already faced issues just to get to
> this point.
>
> On the autobuilder we found that:
>
> a) cryptodev breaks
> b) LTP ARM testing OOMs and crashes badly
> c) ARM ptests are hitting jitterentropy issues intermittently (~ a
>third fail)
> d) x86 qemu image tests are failing say 5% of the time which means 3-4
>of 5 oe-selftest fail plus some other random failures
> e) strace ptests are failing
> f) meta-virtualization breaks
>
> Bruce can't be expected to test or fix everything. Some of these issues
> have all the hallmarks of being really painful to fix.
>
> a) is trivial, there is a patch in master-next. Being selfish, f) isn't
> my problem. It is Bruce's though and will distract him from other
> kernel things. e) is probably deterministic and can either be fixed or
> disabled.
>
> This leaves b/c/d as the scary problems.
>
> c) has already been reported on the kernel lists but nobody responded.
> Not a good sign. I've looked to see if we can disable it but we'd have
> to disable the bluetooth stack to do so.
>
> The memory issues in b) if reported upstream will be pushed back with
> "why not add more memory?" or "what is using the memory? Please debug
> it and tell us how to fix it". Whilst I appreciate this is how the
> world works, it is frustrating as we're effectively on our own until we
> present it to upstream on a plate.
>
> The issues in d) are the scariest of the lot. A rare ish non-
> determinstic failure we can't talk to anyone about until we narrow the
> issue down. If I try and share with others, they'll ask how to
> reproduce and I simply don't know at this point. Engineers don't like
> to touch problems without a reproduction mechanism.
>
> Even just asking others about this has people asking "where is the bug
> report I can look at?". Given most of this happened over the weekend, I
> haven't written bug reports and that in itself is a lot of work even
> collecting up the information from the failed builds.
>
> So what do I do?
>
> I have no engineers I can "assign" to this. Our kernel maintainer will
> help but only has finite time they can spend on upstream work and the
> shear number of issues means they are unlikely to get all the issues
> resolved alone.
>
> Can we afford to fix this in several weeks time? No, we can't as we
> need to build 4.3 now so there is time pressure.
>
> I can ask for help from others and I will/have but most people can't
> drop everything and dive into this. This leaves my own time as about
> the only thing I can directly control/contribute.
>
> If these things happen very occasionally, they can be managed. It does
> feel like other upstreams are getting stretched more thinly,, quality
> is getting worse and they're pushing more bug resolution to their
> consumers. Yocto Project users are also pulling their engineers to
> internal/product focused work and I'm left in the middle with
> increasing work and fewer resources.
>
> I will likely take 48 hours to work out what we can do. If we can't
> find a line of sight on resolving the issues, the outcode after that
> time really has to be one of "ship 6.4, who cares about security" or
> "delay the release X (4?) weeks and hope for the best".
>
> If anyone has any idea of how to solve these process/resource issues,
> or what I should be going differently, let me know. I am really tempted
> just to stick with 6.4 as I really don't need these kind of problems.
>

Hello Richard,
I'm sorry hearing that. However, I find your analysis factual and complete.
I'm wondering about one thing (maybe missing some background): what about the
option of using 6.1 by default and disabling both 6.4 and 6.5 ?

Shipping EOLed 6.4 would have an seriously bad impact on the project
image, in my opinion.

Kind regards,
Marta

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188641): 

[OE-core][dunfell][PATCH v4] go: Update fix for CVE-2023-24538 & CVE-2023-39318

[Shubham Kulkarni via lists.openembedded.org]

From: Shubham Kulkarni 

Add missing files in fix for CVE-2023-24538 & CVE-2023-39318

Upstream Link -
CVE-2023-24538: 
https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b
CVE-2023-39318: 
https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c

Signed-off-by: Shubham Kulkarni 
---
 meta/recipes-devtools/go/go-1.14.inc  |   9 +-
 .../go/go-1.14/CVE-2023-24538-2.patch | 196 --
 .../go/go-1.14/CVE-2023-24538-3.patch | 208 --
 ...3-24538-1.patch => CVE-2023-24538_1.patch} |  15 +-
 .../go/go-1.14/CVE-2023-24538_2.patch | 636 ++
 .../go/go-1.14/CVE-2023-24538_3.patch | 394 +++
 .../go/go-1.14/CVE-2023-24538_4.patch | 498 ++
 .../go/go-1.14/CVE-2023-24538_5.patch | 586 
 .../go/go-1.14/CVE-2023-24538_6.patch | 372 ++
 .../go/go-1.14/CVE-2023-39318.patch   |  38 +-
 10 files changed, 2531 insertions(+), 421 deletions(-)
 delete mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538-2.patch
 delete mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538-3.patch
 rename meta/recipes-devtools/go/go-1.14/{CVE-2023-24538-1.patch => 
CVE-2023-24538_1.patch} (93%)
 create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_2.patch
 create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_3.patch
 create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_4.patch
 create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_5.patch
 create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_6.patch

diff --git a/meta/recipes-devtools/go/go-1.14.inc 
b/meta/recipes-devtools/go/go-1.14.inc
index be63f64825..cff8568450 100644
--- a/meta/recipes-devtools/go/go-1.14.inc
+++ b/meta/recipes-devtools/go/go-1.14.inc
@@ -58,9 +58,12 @@ SRC_URI += "\
 file://CVE-2020-29510.patch \
 file://CVE-2023-24537.patch \
 file://CVE-2023-24534.patch \
-file://CVE-2023-24538-1.patch \
-file://CVE-2023-24538-2.patch \
-file://CVE-2023-24538-3.patch \
+file://CVE-2023-24538_1.patch \
+file://CVE-2023-24538_2.patch \
+file://CVE-2023-24538_3.patch \
+file://CVE-2023-24538_4.patch \
+file://CVE-2023-24538_5.patch \
+file://CVE-2023-24538_6.patch \
 file://CVE-2023-24539.patch \
 file://CVE-2023-24540.patch \
 file://CVE-2023-29405-1.patch \
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-2.patch 
b/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-2.patch
deleted file mode 100644
index 5036f2890b..00
--- a/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-2.patch
+++ /dev/null
@@ -1,196 +0,0 @@
-From 6fc21505614f36178df0dad7034b6b8e3f7588d5 Mon Sep 17 00:00:00 2001
-From: empijei 
-Date: Fri, 27 Mar 2020 19:27:55 +0100
-Subject: [PATCH 2/3] html/template,text/template: switch to Unicode escapes
- for JSON compatibility
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The existing implementation is not compatible with JSON
-escape as it uses hex escaping.
-Unicode escape, instead, is valid for both JSON and JS.
-This fix avoids creating a separate escaping context for
-scripts of type "application/ld+json" and it is more
-future-proof in case more JSON+JS contexts get added
-to the platform (e.g. import maps).
-
-Fixes #33671
-Fixes #37634
-
-Change-Id: Id6f6524b4abc52e81d9d744d46bbe5bf2e081543
-Reviewed-on: https://go-review.googlesource.com/c/go/+/226097
-Reviewed-by: Carl Johnson 
-Reviewed-by: Daniel Martí 
-Run-TryBot: Daniel Martí 
-TryBot-Result: Gobot Gobot 
-
-Dependency Patch #2
-
-Upstream-Status: Backport from 
https://github.com/golang/go/commit/d4d298040d072ddacea0e0d6b55fb148fff18070
-CVE: CVE-2023-24538
-Signed-off-by: Shubham Kulkarni 

- src/html/template/js.go| 70 +++---
- src/text/template/funcs.go |  8 +++---
- 2 files changed, 46 insertions(+), 32 deletions(-)
-
-diff --git a/src/html/template/js.go b/src/html/template/js.go
-index 0e91458..ea9c183 100644
 a/src/html/template/js.go
-+++ b/src/html/template/js.go
-@@ -163,7 +163,6 @@ func jsValEscaper(args ...interface{}) string {
-   }
-   // TODO: detect cycles before calling Marshal which loops infinitely on
-   // cyclic data. This may be an unacceptable DoS risk.
--
-   b, err := json.Marshal(a)
-   if err != nil {
-   // Put a space before comment so that if it is flush against
-@@ -178,8 +177,8 @@ func jsValEscaper(args ...interface{}) string {
-   // TODO: maybe post-process output to prevent it from containing
-   // "", "", or "':  `\x3e`,
-+  '<':  `\u003c`,
-+  '>':  `\u003e`,
-   '\\': `\\`,
- }
-
- // jsStrNormReplacementTable is like jsStrReplacementTable but does not
- // overencode existing escapes since this table has no entry for `\`.
- var jsStrNormReplacementTable = []string{
--  0:`\0`,
-+   

Re: [OE-core] [PATCH V3] glibc: stable 2.38 branch updates.

[Randy MacLeod via lists.openembedded.org]

On 2023-10-03 1:34 a.m., Deepthi.Hemraj via lists.openembedded.org wrote:

Regression testing is done and below are the test results.

Before glibc update
Summary of test results:
213 FAIL
4805 PASS
16 XFAIL
4 XPASS
218 UNSUPPORTED

After glibc update
Summary of test results:
216 FAIL
4805 PASS
16 XFAIL
4 XPASS
218 UNSUPPORTED

These are the newly added test cases


Thanks for the update, summary and initial analysis.



PASS: io/tst-fcntl-lock-lfs
FAIL: nss/tst-nss-gai-hv2-canonname

It's a little odd that a new test case is failing.

Is this reproducible?

Is there a bug reported upstream or discussed on an email list?



PASS: resolv/tst-resolv-no-vc
And below are new failures
FAIL: nptl/tst-thread-affinity-sched
FAIL: malloc/tst-malloc_info-malloc-check


Are these reproducible?

Is there a bug reported upstream?

Please do some additional analysis of the failures
including whether they only happen in a bitbake build and
report back here so we can decide how to proceed.

Thanks again Deepthi,

../Randy







--
# Randy MacLeod
# Wind River Linux

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188638): 
https://lists.openembedded.org/g/openembedded-core/message/188638
Mute This Topic: https://lists.openembedded.org/mt/101727838/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [OE-core] [PATCH 0/4] QA, ptest: Add unimplemented-ptest checks

[Yoann Congal]

Hi,

Le sam. 30 sept. 2023 à 00:05, Yoann Congal  a
écrit :

> To increase ptest coverage we can check if the sources of a recipe looks
> like
> it contains unittest and warn the user that a test may be implemented
> there.
>
> This series provide the check infrastructure as a package QA check and
> some checks for :
> python pytest, perl Test::, meson, cmake, autotools-based tests... as well
> as
> the naive check of "Is there a test/ directory in the sources?" which work
> surprisingly well.
>
> Jérémy Rosen (4):
>   QA, ptest: Add unimplemented-ptest infrastructure
>   QA, ptest: Detect python and perl based tests
>   QA, ptest: Detect build-system test harnesses
>   QA, ptest: Add a naive heuristic to detect test subdirectories
>
>  meta/classes-global/insane.bbclass | 54 ++
>  1 file changed, 54 insertions(+)
>

Following on IRC discussion and some more internal testing :I will send a
v2 with
* correct shortlog commit tag (s/QA, ptest/insane/)
* a fix for source package containing symlink loops (e.g. md5deep)

Currently, this check find
* 309 unimplemented ptest in oe-core/meta-poky/meta-yocto-bsp
* 827 unimplemented ptest in meta-openembedded
Full list :
https://gist.githubusercontent.com/ycongal-smile/0969e92aec1ca37e61b6cdbcaf1f6885/raw/b1be8a5b576e144b6563f5481d31b32de9b22368/gistfile1.txt

Regards,
-- 
Yoann Congal
Smile ECS - Tech expert

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188637): 
https://lists.openembedded.org/g/openembedded-core/message/188637
Mute This Topic: https://lists.openembedded.org/mt/101667584/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core] [kirkstone[PATCH] libtiff: fix CVE-2022-40090 improved IFD-Loop handling

[Hitendra Prajapati via lists.openembedded.org]

Upstream-Status: Backport from 
https://gitlab.com/libtiff/libtiff/-/commit/c7caec9a4d8f24c17e667480d2c7d0d51c9fae41

Signed-off-by: Hitendra Prajapati 
---
 .../libtiff/tiff/CVE-2022-40090.patch | 569 ++
 meta/recipes-multimedia/libtiff/tiff_4.3.0.bb |   1 +
 2 files changed, 570 insertions(+)
 create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2022-40090.patch

diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2022-40090.patch 
b/meta/recipes-multimedia/libtiff/tiff/CVE-2022-40090.patch
new file mode 100644
index 00..fe48dc6028
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2022-40090.patch
@@ -0,0 +1,569 @@
+From c7caec9a4d8f24c17e667480d2c7d0d51c9fae41 Mon Sep 17 00:00:00 2001
+From: Su Laus 
+Date: Thu, 6 Oct 2022 10:11:05 +
+Subject: [PATCH] Improved IFD-Loop Handling (fixes #455)
+
+IFD infinite looping was not fixed by MR 20 (see #455).
+An improved IFD loop handling is proposed.
+
+Basic approach:
+
+- The order in the entire chain must be checked, and not only whether an 
offset has already been read once.
+- To do this, pairs of directory number and offset are stored and checked.
+- The offset of a directory number can change.
+- TIFFAdvanceDirectory() must also perform an IFD loop check.
+- TIFFCheckDirOffset() is replaced by _TIFFCheckDirNumberAndOffset().
+
+Rules for the check:
+
+- If an offset is already in the list, it must have the same IFD number. 
Otherwise it is an IDF loop.
+- If the offset is not in the list and the IFD number is greater than there 
are list entries, a new list entry is added.
+- Otherwise, the offset of the IFD number is updated.
+
+Reference is also made to old bugzilla bug 2772 and MR 20, which did not solve 
the general issue.
+This MR closes #455
+
+Upstream-Status: Backport 
[https://gitlab.com/libtiff/libtiff/-/commit/c7caec9a4d8f24c17e667480d2c7d0d51c9fae41]
+CVE: CVE-2022-40090
+Signed-off-by: Hitendra Prajapati 
+---
+ libtiff/tif_close.c   |   6 +-
+ libtiff/tif_dir.c | 129 +---
+ libtiff/tif_dir.h |   2 +
+ libtiff/tif_dirread.c | 147 +-
+ libtiff/tif_open.c|   3 +-
+ libtiff/tiffiop.h |   3 +-
+ 6 files changed, 219 insertions(+), 71 deletions(-)
+
+diff --git a/libtiff/tif_close.c b/libtiff/tif_close.c
+index 0fe7af4..2fe2bde 100644
+--- a/libtiff/tif_close.c
 b/libtiff/tif_close.c
+@@ -52,8 +52,10 @@ TIFFCleanup(TIFF* tif)
+   (*tif->tif_cleanup)(tif);
+   TIFFFreeDirectory(tif);
+ 
+-  if (tif->tif_dirlist)
+-  _TIFFfree(tif->tif_dirlist);
++  if (tif->tif_dirlistoff)
++  _TIFFfree(tif->tif_dirlistoff);
++  if (tif->tif_dirlistdirn)
++  _TIFFfree(tif->tif_dirlistdirn);
+ 
+   /*
+  * Clean up client info links.
+diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
+index 1402c8e..6d4bf58 100644
+--- a/libtiff/tif_dir.c
 b/libtiff/tif_dir.c
+@@ -1511,12 +1511,22 @@ TIFFDefaultDirectory(TIFF* tif)
+ }
+ 
+ static int
+-TIFFAdvanceDirectory(TIFF* tif, uint64_t* nextdir, uint64_t* off)
++TIFFAdvanceDirectory(TIFF* tif, uint64_t* nextdiroff, uint64_t* off, 
uint16_t* nextdirnum)
+ {
+   static const char module[] = "TIFFAdvanceDirectory";
++
++  /* Add this directory to the directory list, if not already in. */
++  if (!_TIFFCheckDirNumberAndOffset(tif, *nextdirnum, *nextdiroff)) {
++  TIFFErrorExt(tif->tif_clientdata, module, "Starting directory 
%"PRIu16" at offset 0x%"PRIx64" (%"PRIu64") might cause an IFD loop",
++  *nextdirnum, *nextdiroff, *nextdiroff);
++  *nextdiroff = 0;
++  *nextdirnum = 0;
++  return(0);
++  }
++
+   if (isMapped(tif))
+   {
+-  uint64_t poff=*nextdir;
++  uint64_t poff=*nextdiroff;
+   if (!(tif->tif_flags_BIGTIFF))
+   {
+   tmsize_t poffa,poffb,poffc,poffd;
+@@ -1527,7 +1537,7 @@ TIFFAdvanceDirectory(TIFF* tif, uint64_t* nextdir, 
uint64_t* off)
+   if (((uint64_t)poffa != poff) || (poffb < poffa) || 
(poffb < (tmsize_t)sizeof(uint16_t)) || (poffb > tif->tif_size))
+   {
+   TIFFErrorExt(tif->tif_clientdata,module,"Error 
fetching directory count");
+-  *nextdir=0;
++  *nextdiroff=0;
+   return(0);
+   }
+   
_TIFFmemcpy(,tif->tif_base+poffa,sizeof(uint16_t));
+@@ -1545,7 +1555,7 @@ TIFFAdvanceDirectory(TIFF* tif, uint64_t* nextdir, 
uint64_t* off)
+   
_TIFFmemcpy(,tif->tif_base+poffc,sizeof(uint32_t));
+   if (tif->tif_flags_SWAB)
+   TIFFSwabLong();
+-  *nextdir=nextdir32;
++  *nextdiroff=nextdir32;
+   }
+   else
+   

[OE-core] [PATCH] scritps/runqemu: Ensure we only have two serial ports

[Richard Purdie]

I have a theory that some of the console boot issues we're seeing are due to
starting images with three serial ports yet only starting gettys on two of them.

This means that occasionally, depending on the port numbering we may not get
a login prompt on the console we expect it on.

To fix this, change the runqemu code so that if serial ports are passed in on
the commandline (as is the case in automated testing), we don't add any other
GUI serial consoles.

We do need to make sure we do have at least two serial ports since we don't want
getty timeout warnings.

Signed-off-by: Richard Purdie 
---
 scripts/runqemu | 17 +
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/scripts/runqemu b/scripts/runqemu
index 3a170332689..0668e12e616 100755
--- a/scripts/runqemu
+++ b/scripts/runqemu
@@ -1467,6 +1467,19 @@ to your build configuration.
 for entry in self.get('SERIAL_CONSOLES').split(' '):
 self.kernel_cmdline_script += ' console=%s' 
%entry.split(';')[1]
 
+# We always wants ttyS0 and ttyS1 in qemu machines (see 
SERIAL_CONSOLES).
+# If no serial or serialtcp options were specified, only ttyS0 is 
created
+# and sysvinit shows an error trying to enable ttyS1:
+# INIT: Id "S1" respawning too fast: disabled for 5 minutes
+serial_num = len(re.findall("-serial", self.qemu_opt))
+
+# Assume if the user passed serial options, they know what they want
+# and pad to two devices
+if serial_num == 1:
+self.qemu_opt += " -serial null"
+elif serial_num >= 2:
+return
+
 if self.serialstdio == True or self.nographic == True:
 self.qemu_opt += " -serial mon:stdio"
 else:
@@ -1478,10 +1491,6 @@ to your build configuration.
 
 self.qemu_opt += " %s" % self.get("QB_SERIAL_OPT")
 
-# We always wants ttyS0 and ttyS1 in qemu machines (see 
SERIAL_CONSOLES).
-# If no serial or serialtcp options were specified, only ttyS0 is 
created
-# and sysvinit shows an error trying to enable ttyS1:
-# INIT: Id "S1" respawning too fast: disabled for 5 minutes
 serial_num = len(re.findall("-serial", self.qemu_opt))
 if serial_num < 2:
 self.qemu_opt += " -serial null"
-- 
2.39.2


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188635): 
https://lists.openembedded.org/g/openembedded-core/message/188635
Mute This Topic: https://lists.openembedded.org/mt/101732628/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core] [PATCH] oeqa/runtime/parselogs: ignore jitterentropy health failure

[Ross Burton]

From: Ross Burton 

Sometimes the jitterentropy RNG fails to initialise on boot.  My hunch
is that this is due to the hardware timer not being high resolution
enough combined with running inside a virtualised machine on a loaded
host, and whilst the message looks bad it basically says "driver not
suitable for hardware".

I've contacted the author of the jitterentropy code to confirm or deny
this hunch, but until then we can easily ignore the failure.

Signed-off-by: Ross Burton 
---
 meta/lib/oeqa/runtime/cases/parselogs.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/lib/oeqa/runtime/cases/parselogs.py 
b/meta/lib/oeqa/runtime/cases/parselogs.py
index a805edd79dd..a1ffb93b8e4 100644
--- a/meta/lib/oeqa/runtime/cases/parselogs.py
+++ b/meta/lib/oeqa/runtime/cases/parselogs.py
@@ -65,6 +65,7 @@ common_errors = [
 "Failed to read LoaderConfigTimeoutOneShot variable, ignoring: Operation 
not supported",
 "Failed to read LoaderEntryOneShot variable, ignoring: Operation not 
supported",
 "invalid BAR (can't size)",
+"jitterentropy: Initialization failed with host not compliant with 
requirements: 9"
 ]
 
 x86_common = [
-- 
2.34.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188634): 
https://lists.openembedded.org/g/openembedded-core/message/188634
Mute This Topic: https://lists.openembedded.org/mt/101732589/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core] [mickledore][PATCH] glibc: Fix CVE-2023-5156

[Hemraj, Deepthi via lists.openembedded.org]

From: Deepthi Hemraj 

Signed-off-by: Deepthi Hemraj 
---
 .../glibc/glibc/0024-CVE-2023-5156-1.patch| 329 ++
 .../glibc/glibc/0024-CVE-2023-5156-2.patch|  93 +
 meta/recipes-core/glibc/glibc_2.37.bb |   2 +
 3 files changed, 424 insertions(+)
 create mode 100644 meta/recipes-core/glibc/glibc/0024-CVE-2023-5156-1.patch
 create mode 100644 meta/recipes-core/glibc/glibc/0024-CVE-2023-5156-2.patch

diff --git a/meta/recipes-core/glibc/glibc/0024-CVE-2023-5156-1.patch 
b/meta/recipes-core/glibc/glibc/0024-CVE-2023-5156-1.patch
new file mode 100644
index 00..65afaa446a
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0024-CVE-2023-5156-1.patch
@@ -0,0 +1,329 @@
+From: Siddhesh Poyarekar 
+Date: Fri, 15 Sep 2023 17:51:12 + (-0400)
+Subject: getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
+X-Git-Url: 
https://sourceware.org/git/?p=glibc.git;a=commitdiff_plain;h=973fe93a5675c42798b2161c6f29c01b0e243994
+
+getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
+
+When an NSS plugin only implements the _gethostbyname2_r and
+_getcanonname_r callbacks, getaddrinfo could use memory that was freed
+during tmpbuf resizing, through h_name in a previous query response.
+
+The backing store for res->at->name when doing a query with
+gethostbyname3_r or gethostbyname2_r is tmpbuf, which is reallocated in
+gethosts during the query.  For AF_INET6 lookup with AI_ALL |
+AI_V4MAPPED, gethosts gets called twice, once for a v6 lookup and second
+for a v4 lookup.  In this case, if the first call reallocates tmpbuf
+enough number of times, resulting in a malloc, th->h_name (that
+res->at->name refers to) ends up on a heap allocated storage in tmpbuf.
+Now if the second call to gethosts also causes the plugin callback to
+return NSS_STATUS_TRYAGAIN, tmpbuf will get freed, resulting in a UAF
+reference in res->at->name.  This then gets dereferenced in the
+getcanonname_r plugin call, resulting in the use after free.
+
+Fix this by copying h_name over and freeing it at the end.  This
+resolves BZ #30843, which is assigned CVE-2023-4806.
+
+Signed-off-by: Siddhesh Poyarekar 
+
+Upstream-Status: Backport 
[https://sourceware.org/git/?p=glibc.git;a=commitdiff_plain;h=973fe93a5675c42798b2161c6f29c01b0e243994]
+
+CVE: CVE-2023-5156
+
+Signed-off-by: Deepthi Hemraj 
+
+---
+
+diff --git a/nss/Makefile b/nss/Makefile
+index 06fcdc450f..8a5126ecf3 100644
+--- a/nss/Makefile
 b/nss/Makefile
+@@ -82,6 +82,7 @@ tests-container := \
+   tst-nss-test3 \
+   tst-reload1 \
+   tst-reload2 \
++  tst-nss-gai-hv2-canonname \
+ # tests-container
+
+ # Tests which need libdl
+@@ -145,7 +146,8 @@ libnss_compat-inhibit-o= $(filter-out 
.os,$(object-suffixes))
+ ifeq ($(build-static-nss),yes)
+ tests-static  += tst-nss-static
+ endif
+-extra-test-objs   += nss_test1.os nss_test2.os nss_test_errno.os
++extra-test-objs   += nss_test1.os nss_test2.os nss_test_errno.os \
++ nss_test_gai_hv2_canonname.os
+
+ include ../Rules
+
+@@ -180,12 +182,16 @@ rtld-tests-LDFLAGS += -Wl,--dynamic-list=nss_test.ver
+ libof-nss_test1 = extramodules
+ libof-nss_test2 = extramodules
+ libof-nss_test_errno = extramodules
++libof-nss_test_gai_hv2_canonname = extramodules
+ $(objpfx)/libnss_test1.so: $(objpfx)nss_test1.os $(link-libc-deps)
+   $(build-module)
+ $(objpfx)/libnss_test2.so: $(objpfx)nss_test2.os $(link-libc-deps)
+   $(build-module)
+ $(objpfx)/libnss_test_errno.so: $(objpfx)nss_test_errno.os $(link-libc-deps)
+   $(build-module)
++$(objpfx)/libnss_test_gai_hv2_canonname.so: \
++  $(objpfx)nss_test_gai_hv2_canonname.os $(link-libc-deps)
++  $(build-module)
+ $(objpfx)nss_test2.os : nss_test1.c
+ # Use the nss_files suffix for these objects as well.
+ $(objpfx)/libnss_test1.so$(libnss_files.so-version): $(objpfx)/libnss_test1.so
+@@ -195,10 +201,14 @@ $(objpfx)/libnss_test2.so$(libnss_files.so-version): 
$(objpfx)/libnss_test2.so
+ $(objpfx)/libnss_test_errno.so$(libnss_files.so-version): \
+   $(objpfx)/libnss_test_errno.so
+   $(make-link)
++$(objpfx)/libnss_test_gai_hv2_canonname.so$(libnss_files.so-version): \
++  $(objpfx)/libnss_test_gai_hv2_canonname.so
++  $(make-link)
+ $(patsubst %,$(objpfx)%.out,$(tests) $(tests-container)) : \
+   $(objpfx)/libnss_test1.so$(libnss_files.so-version) \
+   $(objpfx)/libnss_test2.so$(libnss_files.so-version) \
+-  $(objpfx)/libnss_test_errno.so$(libnss_files.so-version)
++  $(objpfx)/libnss_test_errno.so$(libnss_files.so-version) \
++  $(objpfx)/libnss_test_gai_hv2_canonname.so$(libnss_files.so-version)
+
+ ifeq (yes,$(have-thread-library))
+ $(objpfx)tst-cancel-getpwuid_r: $(shared-thread-library)
+@@ -215,3 +225,4 @@ LDFLAGS-tst-nss-test3 = -Wl,--disable-new-dtags
+ LDFLAGS-tst-nss-test4 = -Wl,--disable-new-dtags
+ LDFLAGS-tst-nss-test5 = -Wl,--disable-new-dtags
+ LDFLAGS-tst-nss-test_errno = -Wl,--disable-new-dtags

Re: [OE-core] [PATCH 1/2] qemurunner.py: capture raw boot log

[Mikko Rapeli]

Hi,

These are for master-next.

Cheers,

-Mikko

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188632): 
https://lists.openembedded.org/g/openembedded-core/message/188632
Mute This Topic: https://lists.openembedded.org/mt/101731194/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core] [PATCH 1/2] qemurunner.py: capture raw boot log

[Mikko Rapeli]

Don't process captured boot log in case it contains
invalid utf8 characters etc which may filter out important
log entries.

Signed-off-by: Mikko Rapeli 
---
 meta/lib/oeqa/utils/qemurunner.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/meta/lib/oeqa/utils/qemurunner.py 
b/meta/lib/oeqa/utils/qemurunner.py
index 3cd656df82..df290fc091 100644
--- a/meta/lib/oeqa/utils/qemurunner.py
+++ b/meta/lib/oeqa/utils/qemurunner.py
@@ -115,7 +115,6 @@ class QemuRunner:
 
 def log(self, msg):
 if self.logfile:
-self.msg += self.decode_qemulog(msg)
 with codecs.open(self.logfile, "ab") as f:
 f.write(msg)
 
-- 
2.34.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188630): 
https://lists.openembedded.org/g/openembedded-core/message/188630
Mute This Topic: https://lists.openembedded.org/mt/101731194/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core] [PATCH 2/2] qemurunner.py: detect login prompt from byte stream

[Mikko Rapeli]

Converting boot log to utf-8 strings may drop content
breaking the prompt detection resulting in timeouts.

Signed-off-by: Mikko Rapeli 
---
 meta/lib/oeqa/utils/qemurunner.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/meta/lib/oeqa/utils/qemurunner.py 
b/meta/lib/oeqa/utils/qemurunner.py
index df290fc091..27166282ea 100644
--- a/meta/lib/oeqa/utils/qemurunner.py
+++ b/meta/lib/oeqa/utils/qemurunner.py
@@ -482,9 +482,7 @@ class QemuRunner:
 
 data = b''
 
-decodedlog = self.decode_qemulog(bootlog)
-self.logger.debug('Searching in %s chars' % 
len(decodedlog))
-if self.boot_patterns['search_reached_prompt'] in 
decodedlog:
+if bytes(self.boot_patterns['search_reached_prompt'], 
'utf-8') in bootlog:
 self.server_socket.close()
 self.server_socket = qemusock
 stopread = True
-- 
2.34.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188631): 
https://lists.openembedded.org/g/openembedded-core/message/188631
Mute This Topic: https://lists.openembedded.org/mt/101731195/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [OE-core] [PATCH] cups: fix error in patch for CVE-2023-32360

[Claus Stovgaard]

Hi folks.

It should have been marked with kirkstone - sory for missing this.

On Tue, 2023-10-03 at 12:24 +0200, Claus Stovgaard via
lists.openembedded.org wrote:
> A spelling error was missed when backporting fix for CVE-2023-32360
> 
> Signed-off-by: Claus Stovgaard 
> ---
>  meta/recipes-extended/cups/cups/CVE-2023-32360.patch | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/meta/recipes-extended/cups/cups/CVE-2023-32360.patch
> b/meta/recipes-extended/cups/cups/CVE-2023-32360.patch
> index f1b0f9f918..c3db722f1f 100644
> --- a/meta/recipes-extended/cups/cups/CVE-2023-32360.patch
> +++ b/meta/recipes-extended/cups/cups/CVE-2023-32360.patch
> @@ -27,7 +27,7 @@ index b258849..08f5070 100644
>  +  
>  +
>  +  
> -+    AuthType Defaul
> ++    AuthType Default
>   Require user @OWNER @SYSTEM
>   Order deny,allow
>     
> 
> 
> 


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188629): 
https://lists.openembedded.org/g/openembedded-core/message/188629
Mute This Topic: https://lists.openembedded.org/mt/101731071/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core] [PATCH] cups: fix error in patch for CVE-2023-32360

[Claus Stovgaard]

A spelling error was missed when backporting fix for CVE-2023-32360

Signed-off-by: Claus Stovgaard 
---
 meta/recipes-extended/cups/cups/CVE-2023-32360.patch | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-extended/cups/cups/CVE-2023-32360.patch 
b/meta/recipes-extended/cups/cups/CVE-2023-32360.patch
index f1b0f9f918..c3db722f1f 100644
--- a/meta/recipes-extended/cups/cups/CVE-2023-32360.patch
+++ b/meta/recipes-extended/cups/cups/CVE-2023-32360.patch
@@ -27,7 +27,7 @@ index b258849..08f5070 100644
 +  
 +
 +  
-+AuthType Defaul
++AuthType Default
  Require user @OWNER @SYSTEM
  Order deny,allow

-- 
2.41.0


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188628): 
https://lists.openembedded.org/g/openembedded-core/message/188628
Mute This Topic: https://lists.openembedded.org/mt/101731071/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core][PATCH v2 1/3] rust-cross-canadian: set CARGO_TARGET__RUSTFLAGS

[Sean Nyekjaer]

Avoid setting sdk-wide RUSTFLAGS as these flags only are valid when
building for target.
This will enable building for different targets with different
RUSTFLAGS.

Signed-off-by: Sean Nyekjaer 
---
 meta/recipes-devtools/rust/rust-cross-canadian.inc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/meta/recipes-devtools/rust/rust-cross-canadian.inc 
b/meta/recipes-devtools/rust/rust-cross-canadian.inc
index d569ac59f5..d25646237c 100644
--- a/meta/recipes-devtools/rust/rust-cross-canadian.inc
+++ b/meta/recipes-devtools/rust/rust-cross-canadian.inc
@@ -54,8 +54,10 @@ do_install () {
 mkdir "${ENV_SETUP_DIR}"
 RUST_ENV_SETUP_SH="${ENV_SETUP_DIR}/rust.sh"
 
+RUST_TARGET_TRIPLE=`echo ${RUST_TARGET_SYS} | tr '[:lower:]' '[:upper:]' | 
sed 's/-/_/g'`
+
 cat <<- EOF > "${RUST_ENV_SETUP_SH}"
-   export RUSTFLAGS="--sysroot=\$OECORE_TARGET_SYSROOT/usr -C 
link-arg=--sysroot=\$OECORE_TARGET_SYSROOT"
+   export 
CARGO_TARGET_${RUST_TARGET_TRIPLE}_RUSTFLAGS="--sysroot=\$OECORE_TARGET_SYSROOT/usr
 -C link-arg=--sysroot=\$OECORE_TARGET_SYSROOT"
export 
RUST_TARGET_PATH="\$OECORE_NATIVE_SYSROOT/usr/lib/${TARGET_SYS}/rustlib"
EOF
 
-- 
2.42.0


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188625): 
https://lists.openembedded.org/g/openembedded-core/message/188625
Mute This Topic: https://lists.openembedded.org/mt/101729592/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core][PATCH v2 3/3] oeqa/sdk/rust: Add build and run test of rust binary with SDK host

[Sean Nyekjaer]

Add a QA test to the SDK to test that a basic cargo build works for the
SDK host.

Signed-off-by: Sean Nyekjaer 
---

Changes since v1:
 - use SDK_SYS for compiling for SDK Host

 meta/lib/oeqa/sdk/cases/rust.py | 22 ++
 1 file changed, 22 insertions(+)

diff --git a/meta/lib/oeqa/sdk/cases/rust.py b/meta/lib/oeqa/sdk/cases/rust.py
index 31036f0f14..f5d437bb19 100644
--- a/meta/lib/oeqa/sdk/cases/rust.py
+++ b/meta/lib/oeqa/sdk/cases/rust.py
@@ -33,3 +33,25 @@ class RustCompileTest(OESDKTestCase):
 
 def test_cargo_build(self):
 self._run('cd %s/hello; cargo build' % self.tc.sdk_dir)
+
+class RustHostCompileTest(OESDKTestCase):
+td_vars = ['MACHINE', 'SDK_SYS']
+
+@classmethod
+def setUpClass(self):
+targetdir = os.path.join(self.tc.sdk_dir, "hello")
+try:
+shutil.rmtree(targetdir)
+except FileNotFoundError:
+pass
+shutil.copytree(os.path.join(self.tc.sdk_files_dir, "rust/hello"), 
targetdir)
+
+def setUp(self):
+machine = self.td.get("MACHINE")
+if not self.tc.hasHostPackage("packagegroup-rust-cross-canadian-%s" % 
machine):
+raise unittest.SkipTest("RustCompileTest class: SDK doesn't 
contain a Rust cross-canadian toolchain")
+
+def test_cargo_build(self):
+sdksys = self.td.get("SDK_SYS")
+self._run('cd %s/hello; cargo build --target %s-gnu' % 
(self.tc.sdk_dir, sdksys))
+self._run('cd %s/hello; cargo run --target %s-gnu' % (self.tc.sdk_dir, 
sdksys))
-- 
2.42.0


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188627): 
https://lists.openembedded.org/g/openembedded-core/message/188627
Mute This Topic: https://lists.openembedded.org/mt/101729594/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core][PATCH v2 2/3] rust-cross-canadian: set CARGO_TARGET__RUNNER for nativesdk

[Sean Nyekjaer]

This will enable us to build and run rust programs on the sdk host.

% cargo run --target x86_64-oesdk-linux-gnu -vv
   Fresh hello v0.1.0 (~/development/hello)
Finished dev [unoptimized + debuginfo] target(s) in 0.02s
 Running 
`/usr/local/sdk/sysroots/x86_64-oesdk-linux/lib/ld-linux-x86-64.so.2 
target/x86_64-oesdk-linux-gnu/debug/hello`
Hello, world

Signed-off-by: Sean Nyekjaer 
---
 meta/recipes-devtools/rust/rust-cross-canadian.inc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/meta/recipes-devtools/rust/rust-cross-canadian.inc 
b/meta/recipes-devtools/rust/rust-cross-canadian.inc
index d25646237c..5b89216658 100644
--- a/meta/recipes-devtools/rust/rust-cross-canadian.inc
+++ b/meta/recipes-devtools/rust/rust-cross-canadian.inc
@@ -55,9 +55,12 @@ do_install () {
 RUST_ENV_SETUP_SH="${ENV_SETUP_DIR}/rust.sh"
 
 RUST_TARGET_TRIPLE=`echo ${RUST_TARGET_SYS} | tr '[:lower:]' '[:upper:]' | 
sed 's/-/_/g'`
+RUST_HOST_TRIPLE=`echo ${RUST_HOST_SYS} | tr '[:lower:]' '[:upper:]' | sed 
's/-/_/g'`
+SDKARCH=`echo ${SDK_ARCH} | sed 's/_/-/g'`
 
 cat <<- EOF > "${RUST_ENV_SETUP_SH}"
export 
CARGO_TARGET_${RUST_TARGET_TRIPLE}_RUSTFLAGS="--sysroot=\$OECORE_TARGET_SYSROOT/usr
 -C link-arg=--sysroot=\$OECORE_TARGET_SYSROOT"
+   export 
CARGO_TARGET_${RUST_HOST_TRIPLE}_RUNNER="\$OECORE_NATIVE_SYSROOT/lib/ld-linux-${SDKARCH}.so.2"
export 
RUST_TARGET_PATH="\$OECORE_NATIVE_SYSROOT/usr/lib/${TARGET_SYS}/rustlib"
EOF
 
-- 
2.42.0


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188626): 
https://lists.openembedded.org/g/openembedded-core/message/188626
Mute This Topic: https://lists.openembedded.org/mt/101729593/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-

[OE-core][dunfell][PATCH] gawk: backport Debian patch to fix CVE-2023-4156

[Vijay Anusuri via lists.openembedded.org]

From: Vijay Anusuri 

Upstream-Status: Backport
[https://git.launchpad.net/ubuntu/+source/gawk/tree/debian/patches?h=ubuntu/focal-security
&
https://git.savannah.gnu.org/gitweb/?p=gawk.git;a=commitdiff;h=e709eb829448ce040087a3fc5481db6bfcaae212]

Signed-off-by: Vijay Anusuri 
---
 .../gawk/gawk/CVE-2023-4156.patch | 28 +++
 meta/recipes-extended/gawk/gawk_5.0.1.bb  |  1 +
 2 files changed, 29 insertions(+)
 create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch

diff --git a/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch 
b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
new file mode 100644
index 00..c6cba058a7
--- /dev/null
+++ b/meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
@@ -0,0 +1,28 @@
+From e709eb829448ce040087a3fc5481db6bfcaae212 Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" 
+Date: Wed, 3 Aug 2022 13:00:54 +0300
+Subject: [PATCH] Smal bug fix in builtin.c.
+
+Upstream-Status: Backport [import from ubuntu 
https://git.launchpad.net/ubuntu/+source/gawk/tree/debian/patches/CVE-2023-4156.patch?h=ubuntu/focal-security
+Upstream commit 
https://git.savannah.gnu.org/gitweb/?p=gawk.git;a=commitdiff;h=e709eb829448ce040087a3fc5481db6bfcaae212]
+CVE: CVE-2023-4156
+Signed-off-by: Vijay Anusuri 
+---
+ ChangeLog | 6 ++
+ builtin.c | 5 -
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+--- gawk-5.1.0.orig/builtin.c
 gawk-5.1.0/builtin.c
+@@ -957,7 +957,10 @@ check_pos:
+   s1++;
+   n0--;
+   }
+-  if (val >= num_args) {
++  // val could be less than zero if someone 
provides a field width
++  // so large that it causes integer overflow. 
Mainly fuzzers do this,
++  // but let's try to be good anyway.
++  if (val < 0 || val >= num_args) {
+   toofew = true;
+   break;
+   }
diff --git a/meta/recipes-extended/gawk/gawk_5.0.1.bb 
b/meta/recipes-extended/gawk/gawk_5.0.1.bb
index 1b29ec3113..c71890c19e 100644
--- a/meta/recipes-extended/gawk/gawk_5.0.1.bb
+++ b/meta/recipes-extended/gawk/gawk_5.0.1.bb
@@ -18,6 +18,7 @@ PACKAGECONFIG[mpfr] = "--with-mpfr,--without-mpfr, mpfr"
 SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.gz \
file://remove-sensitive-tests.patch \
file://run-ptest \
+   file://CVE-2023-4156.patch \
 "
 
 SRC_URI[md5sum] = "c5441c73cc451764055ee65e9a4292bb"
-- 
2.25.1


-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#188624): 
https://lists.openembedded.org/g/openembedded-core/message/188624
Mute This Topic: https://lists.openembedded.org/mt/101729230/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-