Pull in fixes for CVE-2023-6246, CVE-2023-6779 and CVE-2023-6780.
(From OE-Core rev: 07847f5945ff67340803149242a629741d619bf5)
Signed-off-by: Benjamin Bara <benjamin.bara@skidata.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
I'm not sure why this was included and enabled to begin with: the tests
predictably mass-fail if system time is set to after y2038.
(From OE-Core rev: 3d04849c741baeddd0677a18a468603b7112139d)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c9c7ebd6e447bce19803253afd881854f686b5f6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Set `CVE_STATUS`for those CVEs, they have already been fixed with the latest
pull for stable branch fixes done in rev
e444d2bed0ea140a574414fcd5a689867e8ba312. Hence the issues are fixed
already.
(From OE-Core rev: a7b92c9c675c2c111e0b41121c1232b2e79de4ea)
Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6e6fe23c95f1d0a8a0503cb71557cf3272bf9945)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Below commits on glibc-2.38 stable branch are updated.
44f757a636 LoongArch: Delete excessively allocated memory.
bf5aa419cb elf: Fix wrong break removal from 8ee878592c
63dbbc5c52 sysdeps: sem_open: Clear O_CREAT when semaphore file is expected to exist [BZ #30789]
1e04dcec49 Revert "elf: Move l_init_called_next to old place of l_text_end in link map"
719866ab2f Revert "elf: Always call destructors in reverse constructor order (bug 30785)"
e0b6c9706c Revert "elf: Remove unused l_text_end field from struct link_map"
(From OE-Core rev: 88e95c24c4b7b440e4ab4653fb93bddcb7524a58)
Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Pull in stable branch fixes including:
* tunables: Terminate if end of input is reached (CVE-2023-4911)
* Propagate GLIBC_TUNABLES in setxid binaries
* Document CVE-2023-4806 and CVE-2023-5156 in NEWS
* Fix leak in getaddrinfo introduced by the fix for CVE-2023-4806 [BZ #30843]
Also set CVE_STATUS accordingly for the fixes pulled in.
(From OE-Core rev: 7d77bce6158bf11a2de0944f75589382f153bb91)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Below commits on glibc-2.38 stable branch are updated.
0e1ef6779a (HEAD -> release/2.38/master, origin/release/2.38/master) manual/jobs.texi: Add missing @item EPERM for getpgid
d94461bb86 string: Fix tester build with fortify enable with gcc < 12
63250e9c57 iconv: restore verbosity with unrecognized encoding names (bug 30694)
00ae4f10b5 getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
b25508dd77 CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode
89da8bc588 NEWS: Add the 2.38.1 bug list
d3ba6c1333 elf: Move l_init_called_next to old place of l_text_end in link map
750f19526a elf: Remove unused l_text_end field from struct link_map
a3189f66a5 elf: Always call destructors in reverse constructor order (bug 30785)
7ae211a01b elf: Do not run constructors for proxy objects
92201f16cb libio: Fix oversized __io_vtables
5bdef6f27c io: Fix record locking contants for powerpc64 with __USE_FILE_OFFSET64
0024-CVE-2023-4527.patch is dropped
(From OE-Core rev: eae8634ff7a7dd6f84c4607b5f1b0c6fe5e39f37)
Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We've been removing PR values from recipes at upgrade time for a while. In general
anyone maintaining a binary distro would end up having to curate these themselves
so the values in OE-Core aren't really that useful anymore. In many ways it makes
sense to clear out the remaining ones (which are mostly for 'config' recipes that
are unlikely to increase in PV) and leave a clean slate for anyone implementing
a binary distro config.
References are left in meta-selftest since the tests there do involve them and
their removal upon upgrade.
(From OE-Core rev: d4c346e8ab8f3cae25d1b01c7331ed9f6d4f96ef)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The recipe originates from meta-y2038 where the name was not
confusing, but in oe-core it is.
(From OE-Core rev: 90bc7a66b08580207839fc6aafe1ac86c12981c5)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
file /usr/include/bits/math-vector.h from install of lib32-libc6-dev-2.38-r0.armv7ahf_neon conflicts with file from package libc6-dev-2.38-r0.aarch64
Reference to the git log of glibc, upstream modified math-vector.h for
aarch64, so this file has many differences from aarch32.
For detailed modifications, please refer to these two commit log of
glibc:
commit 4a9392ffc27ad280f84779eea3ba01f2c134d1d8
commit 78c01a5cbeb6717ffa2d4d66bb90ac5c39bd81a9
(From OE-Core rev: ecfa84f5bb238ef2252d6491a6cde2c5fd202213)
Signed-off-by: Lei Maohui <leimaohui@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Some tests e.g. tst-y2039-time64 from glibc 2.38+ needs it.
(From OE-Core rev: d41e6b8c9ff1d42fd6211fd2c24f666cac188f79)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Its removed and is implicit default in 2.38+ [1]
[1] https://mail.gnu.org/archive/html/info-gnu/2023-07/msg00010.html
(From OE-Core rev: e2af021f5b918c619396eecb20fa30a71cf5e776)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This resolves two issues:
1. metapackages were depending on themselves (except -binaries which wouldn't match against 'glibc-binary').
2. for the nativesdk variant, due to a non-empty dependency list at parsing time caused by
issue 1, map_depends_variable() from meta/lib/oe/classextend.py was forcibly setting PACKAGES
to the initial parse-time value (e.g. missing the dynamically created packages). This meant that
three out of four nativesdk- metapackages were entireyly missing the dependencies on the
respective dynamic package sets.
(From OE-Core rev: a90fd3afe9184aa1870b34a826e3ba0563477d4b)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Dont fill up the test log with ssh warning about having added the host
to list of known hosts.
Also helps fix a test case failure where stderr log was being compared
to a known value.
(From OE-Core rev: 63b31ff7e54a171c4c02fca2e6b07aec64a410af)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Try to add convert and apply statuses for old CVEs
- Drop some obsolete ignores, while they are not relevant for current
version
(From OE-Core rev: 1634ed4048cf56788cd5c2c1bdc979b70afcdcd7)
Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Reviewed-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The check target for the glibc testsuite uses networking to access
a QEMU in system mode. This was resulting in large numbers of test
failures for the x86 targets that use it.
Enable network access to resolve this.
(From OE-Core rev: 088e022f80e57ca345838bf57df9abad3d8b9313)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
glibc configury tries to detect ld version and assumes BFD or gold
linker but when system ld is pointing to lld or mold it might fail the
linker check, therefore pass LD variable to explicitly point at ld.bfd
we are using BFD linker only to link glibc after all.
Second problem in such a case is that some partial objects are linked
with CC -r which will fail if we do not inform the compiler to use BFD
linker thusly pass it via appending to CC variable
(From OE-Core rev: 63248d2cbd7a15aec5b864d0058fe919eb17c46c)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The recommendation from server maintainers is that the https protocol
is both faster and more reliable than the dedicated git protocol at this point.
Switch to it where possible.
(From OE-Core rev: 139102a73d4151f4748b4a861bd4ab28dda7dab7)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is little point in having "crosssdk" suffex added to the virtual provider within
binutils since the TARGET_PREFIX or SDK_PREFIX already encapsulates this. Remove it
allowing some of the special case overriding to be removed.
(From OE-Core rev: 6856fc5c848cc2564bebe03a007ef109f46d0adb)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
A recent package.py change has highlighted some corruption issues with -dev
pkgconfig package dependencies. Bump the output versions to trigger a rebuild
and ensure everything is consistent.
Take the opportunity to also drop all HASHEQUIV_HASH_VERSION entries since the
main version is changing.
(From OE-Core rev: f45ddfbf007de858327eef0ffefd5840ef4c69b8)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
As distro builders this option helps using different compilers to build
glibc
(From OE-Core rev: 4b082870d425b94cd2a7859d7d113d5c178b92b7)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The script has a bashism and needs bash to execute correctly. Mark it
as such and add the missing bash dependency so it executes in minimal
images.
(From OE-Core rev: a1b5afac108d9c94e8fc2ad8cfebfee16f6f243b)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There are cached reproducibility issues on the autobuilder due to the PRServ
sstate checksum issues, flush the bad data out the system by bumping the
versions.
(From OE-Core rev: b2b33e387c523d5936f6948115a73772b2cf9f2b)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
glibc has it's dependencies handled more manually due to it's place
in the toolchain bootstrap. It depends upon the compiler and indirectly
through that to binutils. This did mean that if binutils changes and the
compiler does not, sstate and hash equivalence could mean that glibc
wouldn't rebuild.
Add a direct dependency on binutils that if it changes, it forces glibc
to rebuild, as it should.
(From OE-Core rev: c4a7b3decff636292f5e76e95406a22b6fe4a994)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Remove some obsolete CVE ignores now that releases have been made, CPEs
updated, or upgrades done:
CVE-2020-10029 is marked as fixed in 2.32.
CVE-2021-27645 is marked as fixed in 2.34.
CVE-2022-39046 is marked as fixed in 2.37.
(From OE-Core rev: a383d0e726011007419dd102cd6484733d80d9f6)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This CVE has been fixed in the 2.37 release branch (07b9521fc6) and
we're now using a SHA that incorporates that commit, so manually mark it
as ignored.
(From OE-Core rev: b143e355ef362dac89f8b125904d2e47c74e597e)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is a redundant change in
0016-wordsize.h-Unify-the-header-between-arm-and-aarch64.patch that
causes wordsize.h to be different in arm and aarch64. This causes the
build error when enable multilib:
Error: Transaction test error:
file /usr/include/bits/wordsize.h conflicts between attempted installs of lib32-libc6-dev-2.37-r0.armv7vet2hf_vfp and libc6-dev-2.37-r0.cortexa57
(From OE-Core rev: 303bb3b735da434eb135ee857c2c49c55da61918)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Patch so ppoll is properly redirected to it's 64bit time variant even
when source fortification is active.
(From OE-Core rev: 8cb7008090e98d990e7249b4ef723f65825915ae)
Signed-off-by: Ola x Nilsson <olani@axis.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The tests are packaged into the main glibc-tests package which is fine,
but then glibc-tests-ptest package needs to depend on that.
Which is what this commit addresses.
(From OE-Core rev: d37c2d428b09b9d0cbb875f083c6a1e9883a7fed)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The glibc-locale recipe already partially depends on the base depends in
order to satisfy the do_package dependency on binutils. However since
commit d6ffd683bf6 NM has defaulted to gcc-nm, meaning do_package
depends on gcc (for minidebuginfo).
Whilst the do_package task could handle having the dependencies
explicitly defined (either in glibc-locale or in package.bbclass),
setting these would require some amount of conditional dependency
configuration (cross/crosssdk/etc.). Since both binutils and gcc are
already dependencies of virtual/libc (although compilerlibs is not),
having glibc-locale not inhibit the default depends simplifies the
handling of this situation for both glibc-locale and package.bbclass.
(From OE-Core rev: 8a40d0a6039e87a5b4b26a0e84dd797fe5c75cba)
Signed-off-by: Nathan Rossi <nathan.rossi@digi.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
glibc-locale defaults to ENABLE_BINARY_LOCALE_GENERATION ?= "0", but gets
changed to "1" in the default-distrovars.inc
When it is explicitly set back to "0", it fails with this error:
ERROR: glibc-locale-2.36-r0 do_package: QA Issue: glibc-locale: Files/directories were installed but not shipped in any package:
/usr/lib/locale
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
glibc-locale: 1 installed and not shipped files. [installed-vs-shipped]
ERROR: glibc-locale-2.36-r0 do_package: Fatal QA errors were found, failing task.
There's a code to remove empty dirs in ${libdir}, but it's keyed off of
PACKAGE_NO_GCONV to clean up $[libdir]/gconv, just extend it to also cover
other empty dirs, including ${libdir}/locale.
(From OE-Core rev: b2565de1d9fb513c61f80a4f02be39ee9c31e7dd)
Signed-off-by: Denys Dmytriyenko <denis@denix.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The fix for this CVE has been merged into the 2.36 branch and fixed in
oe-core as of 055ce284.
(From OE-Core rev: ebb0220bf211ec1318a0a7f6a9ab80cf7775a848)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Adresses CVE-2022-39046
Brings in following changeset
* c399271c10 nscd: Fix netlink cache invalidation if epoll is used [BZ #29415]
* b46412fb17 Add NEWS entry for CVE-2022-39046
* 645d94808a syslog: Remove extra whitespace between timestamp and message (BZ#29544)
* b3736d1a3c elf: Restore how vDSO dependency is printed with LD_TRACE_LOADED_OBJECTS (BZ #29539)
* 3c791f2031 Apply asm redirections in wchar.h before first use
* 924e4f3eaa elf: Call __libc_early_init for reused namespaces (bug 29528)
* b0e7888d1f syslog: Fix large messages (BZ#29536)
(From OE-Core rev: 055ce284cb4770026c6b0de34d4444568e03d47f)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
:append can not be modified in bbappends and thus += is
better in re-usable, generic layers and recipes.
(From OE-Core rev: da88406ba592504a718f516b985adc0d4553080d)
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Solves the mount.h conflict with linux kernel headers with needed
backports from trunk
These are the complete list of changes this brings
* 3bd3c612e9 Linux: Fix enum fsconfig_command detection in <sys/mount.h>
* bb1e8b0ca9 linux: Fix sys/mount.h usage with kernel headers
* d48813227b linux: Use compile_c_snippet to check linux/mount.h availability
* 4dad97e2a2 linux: Mimic kernel defition for BLOCK_SIZE
* 1cc5513114 linux: Use compile_c_snippet to check linux/pidfd.h availability
* 0062e7dd1c glibcextract.py: Add compile_c_snippet
* 5c62874f42 NEWS: Add entry for bug 28846
* d13a7a6f10 socket: Check lengths before advancing pointer in CMSG_NXTHDR
* 8b139cd4f1 alpha: Fix generic brk system call emulation in __brk_call (bug 29490)
* e982657073 Linux: Terminate subprocess on late failure in tst-pidfd (bug 29485)
(From OE-Core rev: 344378cc811a9a2630b178ca58b946ecd10b53bc)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
