Commit Graph

78054 Commits

Author SHA1 Message Date
Trevor Woerner
89da6e7a4a sphinx-lint: superfluous backtick in front of role
Fix all instances of backtick-before-role as reported by 'make sphinx-lint'.

(From yocto-docs rev: 758e46b10926ca0ce8db59c9c5cd9c4ed6c8826e)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit d38f9b25c0bd095fe1158f14226fb74f8645496a)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Alper Ak
e1f79f066d ref-manual/variables.rst: document INHIBIT_UPDATERCD_BBCLASS
Fix [YOCTO #15753]

(From yocto-docs rev: c808e7a080533d4b4deef318fb36a786ede4fb50)

Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 5f5a406d4acdfcbf655ac014d0d2807056f95291)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Etienne Cordonnier
b292d8f365 ref-manual/variables.rst: document SSTATE_SKIP_CREATION
(From yocto-docs rev: b3720565e7df427eef78520173e11047a73aec76)

Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 3982720668aafa18c9ed27304d09f896740b1653)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Alper Ak
07a064344d ref-manual/variables.rst: document INHIBIT_DEFAULT_RUST_DEPS
Fix [YOCTO #15755]

(From yocto-docs rev: fe915d6947b0835c481359f62c8b57721568644c)

Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit fd143a04bab38f6aeec23ec229657b16fcaecdf1)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Enrico Jörns
27c6700391 conf.py: tweak SearchEnglish to be hyphen-friendly
This modifies the default indexer split() and js splitQuery()
methods to support searching for words with hyphens.

While this might not be an ideal, rock solid, and fully future-proof
solution, it allows at least to search for strings inlcuding hyphens,
such as 'bitbake-layers', 'send-error-report', or 'oe-core'.

Below is a bit more detailed explanation of the two modifications done:

1) The default split regex in the sphinx-doc SearchLanguage base class
   is:

   | _word_re = re.compile(r'\w+')

   which we simply extend to include hyphens '-'.

   This will result in a searchindex.js that contains words with hyphens,
   too.

2) The 'searchtool.js' code notes for its splitQuery() implementation:

   | /**
   |  * Default splitQuery function. Can be overridden in ``sphinx.search`` with a
   |  * custom function per language.
   |  *
   |  * The regular expression works by splitting the string on consecutive characters
   |  * that are not Unicode letters, numbers, underscores, or emoji characters.
   |  * This is the same as ``\W+`` in Python, preserving the surrogate pair area.
   |  */
   | if (typeof splitQuery === "undefined") {
   |   var splitQuery = (query) => query
   |       .split(/[^\p{Letter}\p{Number}_\p{Emoji_Presentation}]+/gu)
   |       .filter(term => term)  // remove remaining empty strings
   | }

   The hook for this is documented in the sphinx-docs 'SearchLanguage'
   base class.

   |    .. attribute:: js_splitter_code
   |
   |       Return splitter function of JavaScript version.  The function should be
   |       named as ``splitQuery``.  And it should take a string and return list of
   |       strings.
   |
   |       .. versionadded:: 3.0

   We use this to define a simplified splitQuery() function with a split
   argument that splits on empty spaces only.

We extend SearchEnglish (which extends SearchLanguage) here to retain
the stemmer code and stopwords for English.

[YOCTO #14534]

(From yocto-docs rev: 15c2965bdb0040e5745022c8098f434cd1a156e9)

Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit d4a98ee19e0cbd6be96923dc72faee143a6b294b)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Christos Gavros
c3fcc45fea ref-manual/variables.rst: document the INITRAMFS_MAXSIZE variable
This variable specifies the maximum allowed size
of the initramfs image in Kbytes.
Fixes [YOCTO #15797]

CC: Yoann Congal <yoann.congal@smile.fr>
CC: Randy MacLeod <randy.macleod@windriver.com>
CC: Antonin Godard <antonin.godard@bootlin.com>
(From yocto-docs rev: 33dd2be43418bfdb61b73abc82e9aa8bdc331e70)

Signed-off-by: Christos Gavros <gavrosc@yahoo.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 07bcdddaf71c76cdec186cf0ddd97a47eec54972)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Christos Gavros
109a6addc2 ref-manual/variables.rst: document the IMAGE_ROOTFS_MAXSIZE variable
This variable specifies the maximum allowed size
of the generated image in kilobytes.

CC: Yoann Congal <yoann.congal@smile.fr>
CC: Randy MacLeod <randy.macleod@windriver.com>
CC: Antonin Godard <antonin.godard@bootlin.com>
CC: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: 7b3996064f539474d2204da7a8bb9ff531cf8b0c)

Signed-off-by: Christos Gavros <gavrosc@yahoo.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit f3ddc92081363aa7ef7d4fc2c3b918f32f7bda05)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Yi Zhao
e8b0982b15 python3-pygobject: RDEPENDS on gobject-introspection
Since 3.51.0, python3-pygobject depends on libgirepository 2.0 provided
by glib-2.0 instead of libgirepository 1.0 provided by
gobject-introspection[1]. It still needs the typelib files from
libgirepository-1.0 package. Add gobject-introspection as a runtime
dependency.

Fixes:
$ python3
Python 3.13.2 (main, Feb  4 2025, 14:51:09) [GCC 14.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import gi
>>> from gi.repository import Gtk
Traceback (most recent call last):
  File "/usr/lib64/python3.13/site-packages/gi/importer.py", line 139, in create_module
    introspection_module = get_introspection_module(namespace)
  File "/usr/lib64/python3.13/site-packages/gi/module.py", line 243, in get_introspection_module
    module = IntrospectionModule(namespace, version)
  File "/usr/lib64/python3.13/site-packages/gi/module.py", line 111, in __init__
    repository.require(namespace, version)
    ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
gi.RepositoryError: Typelib file for namespace 'xlib', version '2.0' not found

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "<python-input-1>", line 1, in <module>
    from gi.repository import Gtk
  File "/usr/lib64/python3.13/site-packages/gi/importer.py", line 141, in create_module
    raise ImportError(e) from e
ImportError: Typelib file for namespace 'xlib', version '2.0' not found

[1] https://gitlab.gnome.org/GNOME/pygobject/-/merge_requests/320

(From OE-Core rev: 6f9e02292c9305e795f2651c3bb6ef5b671e1c74)

(From OE-Core rev: e3fa9ef3239e8bc113e211f5258f84d08284872a)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Yash Shinde
90f63790e5 gcc: fix incorrect preprocessor line numbers in large files
Resolve static assertion failures caused by incorrect line numbers
after #include directives, introduced by the backport of PR108900 to GCC.
Update line map handling to correctly compute locations in large files,
including fixes for both LC_ENTER and LC_LEAVE to ensure accurate
line number resolution in rare edge cases.

https://gcc.gnu.org/cgit/gcc/commit/?id=edf745dc519ddbfef127e2789bf11bfbacd300b7

(From OE-Core rev: bc868507927fb21637e0ed63bb7ac86d69998d42)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Gyorgy Sarvari
020659f0d4 libmatchbox: upgrade 1.13 -> 1.14
Includes a fix for the library version to match the tagged version in git.

(From OE-Core rev: 3ba4b22ef7e50e017d25ba974666f2fdf190a8fd)

(From OE-Core rev: 34a33332d530278d42f9d402da051ad7272cf555)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Wang Mingyu
37597e36b4 epiphany: upgrade 48.0 -> 48.3
Changelog:
===========
- Fix crash when opening downloaded file
- Fix crash when opening incognito window
- Fix Crash when trying to select download location
- Fix Crash in escape_csv_field() when exporting passwords
- Fix Adding WhatsApp as a web app crashes
- Fix Pressing Escape key in addressbar resets the cursor to beginning of
  the widget
- Fix Epiphay shouldn't show the privacy dialog in incognito mode
- Fix (CVE-2025-3839) Require user interaction before opening URL in
  external application
- Fix Code cleanup
- Fix window: fix crash when force closing window without session
- Fix Several fixes for password export
- Fix Remove Granite support from Tech Preview and Canary
- Fix find-toolbar: fix crash on load-changed

(From OE-Core rev: fb8f221f92da60f4e1ae14e39fb3a577ff7bdb33)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

(master rev: 2c60159fffd76b5dbe75bf7d6758e5f78b166714)

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Peter Marko
688f74a370 libarchive: upgrade 3.7.8 -> 3.7.9
https://github.com/libarchive/libarchive/releases/tag/v3.7.9

Libarchive 3.7.9 is a bugfix release
Important bugfixes:
* a regression in libarchive 3.7.8 regarding GNU sparse entries was fixed (#2558)

Also remove CVE_STATUS which was obsolete already before this upgrade.

(From OE-Core rev: 670f3fa028f3e873acf4c5265d3f5e4a3aa0ec89)

(From OE-Core rev: 5219998cde17542ae02622de29c5b4a1258772b2)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Harish Sadineni
fb4c310a65 binutils: Fix CVE-2025-1180
Upstream-Status: Submitted [https://sourceware.org/pipermail/binutils/2025-May/141351.html]
CVE: CVE-2025-1180

cherry picked from upstream commit:
https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=f9978defb6fab0bd8583942d97c112b0932ac814

(From OE-Core rev: d3c7b8e15a7be8238969f9eb010bde95a2b6c5ca)

Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Deepesh Varatharajan
9776909c9b binutils: Fix CVE-2025-1178
Prevent an abort in the bfd linker when attempting to
generate dynamic relocs for a corrupt input file.

PR 32638

Backport a patch from upstream to fix CVE-2025-1178
Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0]

(From OE-Core rev: 3325b9dfd7a0da2236c96630b67ac2c6d4375840)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Peter Marko
717fb8a016 binutils: mark CVE-2025-1153 as fixed
We had this CVE patched but the patch was removed with last 2.44 branch
updates as it is now included.
Since there is no new version which could be set in NVD DB, this needs
to be explicitly handled.

(From OE-Core rev: 32f18145dee54f61203506daef339cd132908287)

(From OE-Core rev: b8ed40864e664e1cd50b2015569a406f49a0125e)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Peter Marko
64d92df698 binutils: drop obsolete CVE_STATUS
NVD has CVE-2023-25584 listed as < 2.40, so we don't need to ignore it
for version 2.44 anymore.

(From OE-Core rev: eaf80096f96e5bebed53076c1dfe7e35e539f383)

(From OE-Core rev: a0ffc4e44ba5e06eccf6d87fb16898454efcb1b2)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Peter Marko
32dddbf6b4 xz: patch CVE-2025-31115
Cherry-pick commits from [1] linked from [2] from branch v5.6

[1] https://tukaani.org/xz/xz-cve-2025-31115.patch
[2] https://tukaani.org/xz/threaded-decoder-early-free.html

(From OE-Core rev: 7c5d0f0e1830095d3e8c30c648081b5e52b0ef06)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Peter Marko
fdb3f69e74 ofono: patch CVE-2024-7537
Pick commit
https://web.git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=e6d8d526d5077c0b6ab459efeb6b882c28e0fdeb

(From OE-Core rev: 9ab0da6f0564787b753aedb90ea437b135243bdf)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Peter Marko
577bbcd237 sqlite3: mark CVE-2025-29087 as patched
Description of CVE-2025-29087 and CVE-2025-3277 are very similar.
There is no lonk from NVD, but [1] and [2] from Debian mark these two
CVEs as duplicates with the same link for patch.

[1] https://security-tracker.debian.org/tracker/CVE-2025-29087
[2] https://security-tracker.debian.org/tracker/CVE-2025-3277

(From OE-Core rev: a9386d9f3f4f5256dca2eee6355e3cc74d77af1d)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Peter Marko
11c14e791b sqlite3: patch CVE-2025-29088
Pick commit [1] mentioned in [2].

[1] 56d2fd008b
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-29088

(From OE-Core rev: bf22e18843bf10418e7f8f182036eaf78de98413)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Peter Marko
42f60f3fd1 sqlite3: patch CVE-2025-3277
Pick commit [1] mentioned in [2].

[1] https://sqlite.org/src/info/498e3f1cf57f164f
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-3277

(From OE-Core rev: 341297828a5b7c77e6d9113d5abcd22c3a0c224a)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Steve Sakoman
fd9b605507 build-appliance-image: Update to walnascar head revision
(From OE-Core rev: 17affdaa600896282e07fb4d64cb23195673baa1)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-23 08:46:09 -07:00
Steve Sakoman
fd9c569615 poky.conf: bump version for 5.2.1
(From meta-yocto rev: 73ef61468496fd129b90c3f0afe26859b441b26b)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-23 08:42:34 -07:00
Khem Raj
19ad025a8d gcc: Fix LDRD register overlap in register-indexed mode
Issue is seen with nodejs ending with Illegal instruction on OE
Its also in QT5base and perhaps many other packages using 64bit
atomics.

Thanks to jeroen (oe IRC) to report and help reduce the problem.

(From OE-Core rev: bd62158946e214076686e0709d24771acb60665f)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-23 08:42:34 -07:00
Deepesh Varatharajan
cfd8e09d42 glibc: stable 2.41 branch update
Below commits on glibc-2.41 stable branch are updated.
5cb575ca9a elf: tst-audit10: split AVX512F code into dedicated functions [BZ #32882]
046b33800c x86: Detect Intel Diamond Rapids
a53e764657 x86: Handle unknown Intel processor with default tuning
aca31d2712 x86: Add ARL/PTL/CWF model detection support
f68b407d4b x86: Optimize xstate size calculation
d6d56af6e7 elf: Fix arm-linux-gnueabihf build break from b861755a84
b861755a84 elf: Extend glibc.rtld.execstack tunable to force executable stack (BZ 32653)
200d20123c x86: Link tst-gnu2-tls2-x86-noxsave{,c,xsavec} with libpthread
80cd656649 x86: Use separate variable for TLSDESC XSAVE/XSAVEC state size (bug 32810)
a282e2c0ae x86: Skip XSAVE state size reset if ISA level requires XSAVE
bcd4cf9d5f x86_64: Add atanh with FMA
7e72fa7577 x86_64: Add sinh with FMA
6a3a4a5e58 x86_64: Add tanh with FMA
ce9b765522 nptl: Check if thread is already terminated in sigcancel_handler (BZ 32782)
98c712855d nptl: PTHREAD_COND_INITIALIZER compatibility with pre-2.41 versions (bug 32786)
e22c132484 nptl: clear the whole rseq area before registration
33bfd9020f Linux: Remove attribute access from sched_getattr (bug 32781)
66fc3bd758 math: Remove an extra semicolon in math function declarations
1a3083b999 posix: Move environ helper variables next to environ definition (bug 32541)
91f8cff2c4 configure: Fix spelling of -Wl,--no-error-execstack option
fd202462c5 elf: Check if __attribute__ ((aligned (65536))) is supported
746ef8e939 static-pie: Skip the empty PT_LOAD segment at offset 0 [BZ #32763]
56609f8df1 Pass -Wl,--no-error-execstack for tests where -Wl,-z,execstack is used [PR32717]
89be78704e AArch64: Use prefer_sve_ifuncs for SVE memset
c47c3890f1 AArch64: Add SVE memset
e0bc5f64ea math: Improve layout of exp/exp10 data
009c5a2dca aarch64: Add GCS test with signal handler
8d98ee8d70 aarch64: Add GCS tests for dlopen
61ba3cdfa9 aarch64: Add GCS tests for transitive dependencies
fda5730898 aarch64: Add tests for Guarded Control Stack
6d1f97bb06 aarch64: Add configure checks for GCS support
7774a9d07a AArch64: Improve codegen for SVE powf
2025e27a81 AArch64: Improve codegen for SVE pow
f3d9c116cb AArch64: Improve codegen for SVE erfcf
94859e8680 Aarch64: Improve codegen in SVE exp and users, and update expf_inline
7c9a086807 Aarch64: Improve codegen in SVE asinh
30992cb5e9 RISC-V: Fix IFUNC resolver cannot access gp pointer
07288c7445 math: Add optimization barrier to ensure a1 + u.d is not reused [BZ #30664]
2cb04444b9 math: Fix `unknown type name '__float128'` for clang 3.4 to 3.8.1 (bug 32694)
a900dbaf70 x86 (__HAVE_FLOAT128): Defined to 0 for Intel SYCL compiler [BZ #32723]
1e0e33e1b1 Fix tst-aarch64-pkey to handle ENOSPC as not supported
69fda28279 assert: Add test for CVE-2025-0395
cf88351b68 math: Fix tanf for some inputs (BZ 32630)
cb7f206537 nptl: Correct stack size attribute when stack grows up [BZ #32574]
d85a771953 math: Fix sinhf for some inputs (BZ 32627)
bdccbfbc52 math: Fix log10p1f internal table value (BZ 32626)

Testresults:
Before update	|After update	 |Difference
PASS:  5816	|PASS:  5826	 |PASS: +10
FAIL:  239	|FAIL:  239	 |FAIL:  0
XPASS: 4	|XPASS: 4	 |XPASS: 0
XFAIL: 16	|XFAIL: 16	 |XFAIL: 0
UNSUPPORTED: 164|UNSUPPORTED: 164|UNSUPPORTED: 0

(From OE-Core rev: 60fb9e5200e641d0d108f283d23a7c79b09966d1)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-23 08:42:34 -07:00
Divya Chellam
72f37893fc libxml2: upgrade 2.13.6 -> 2.13.8
This includes CVE-fix for CVE-2025-32414 and CVE-2025-32415.

Changelog:
===========
https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.7
https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8

Regressions

* tree: Fix xmlTextMerge with NULL args
* io: Fix compressed flag for uncompressed stdin
* parser: Fix parsing of DTD content

Security

* [CVE-2025-32415] schemas: Fix heap buffer overflow inxmlSchemaIDCFillNodeTables
* [CVE-2025-32414] python: Read at most len/4 characters. (Maks Verver)

(From OE-Core rev: 7680e9a11a63ab8bfbc915e4cf6a385f0970c4a5)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0b24113405ab0bbb3200bb47fa8ed6abeaa7481b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-23 08:42:34 -07:00
Divya Chellam
f281324f3f ruby: upgrade 3.4.2 -> 3.4.3
This includes CVE-fix for CVE-2025-27219, CVE-2025-27220 and
CVE-2025-27221

Changes between 3.4.2 -> 3.4.3
==============================
https://github.com/ruby/ruby/compare/v3_4_2...v3_4_3

(From OE-Core rev: 37747c99ee32153120b67e65a2f3da34c6d58b0f)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d739c52558af986c2ce4c65e1197e8d524d14d22)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-23 08:42:33 -07:00
Yi Zhao
54301c2e35 makedumpfile: upgrade 1.7.6 -> 1.7.7
ChangeLog:
https://github.com/makedumpfile/makedumpfile/releases/tag/1.7.7

This version supports the following new kernels:
  - 6.12, 6.13, 6.14

Drop backport patch.

(From OE-Core rev: 364e15aadcbb3ac754c2c484f7920420b4cb3138)

(From OE-Core rev: f2100e704b06913805d0d6d21df0cd73c8199388)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-23 08:42:33 -07:00
Archana Polampalli
9d251db722 openssh: fix CVE-2025-32728
In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the
documentation stating that it disables X11 and agent forwarding.

(From OE-Core rev: fff41e824bb56d4879c65d6dec3605fabb406071)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-23 08:42:33 -07:00
Yi Zhao
e14b2fdbb7 iputils: Security fix for CVE-2025-47268
CVE-2025-47268
ping in iputils through 20240905 allows a denial of service (application
error or incorrect data collection) via a crafted ICMP Echo Reply
packet, because of a signed 64-bit integer overflow in timestamp
multiplication.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-47268

Patch from:
070cfacd73

(From OE-Core rev: 59f0d3befe0c828bdc16664af1f8b64b7f3911e7)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-23 08:42:33 -07:00
Praveen Kumar
c413376afc connman :fix CVE-2025-32366
In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length
that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen)
and memcpy(response+offset,*end,*rdlen) without a check for whether
the sum of *end and *rdlen exceeds max. Consequently, *rdlen may be
larger than the amount of remaining packet data in the current state
of parsing. Values of stack memory locations may be sent over the
network in a response.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-32366

Upstream-patch:
https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=8d3be0285f1d4667bfe85dba555c663eb3d704b4

(From OE-Core rev: 1c908b1c44a006b6707a1f0da59781a6750cf8ce)

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-23 08:42:33 -07:00
Trevor Woerner
ea026b8c98 ref-manual/variables.rst: document WIC_CREATE_EXTRA_ARGS
Fixes [YOCTO #15509]

Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: 6b7019c13054bf11fb16657a3fac85831352cea9)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit f1cdecb6da91dbfac59359c83038cb4a4c36ad0a)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Trevor Woerner
fafdc5bd96 sphinx-lint: various fixes
A 'make sphinx-lint' pass found the following issues:
	trailing-whitespace
	missing-space-after-literal
	role-with-double-backticks
	missing-space-before-role (role missing opening tag colon)

(From yocto-docs rev: 9f4fab1727bcf010cd3631ce5ae769797b9fba99)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 1020d82aff4dab5b3d64e7035e87763a80cf5b70)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Mikko Rapeli
eed3e6c2c8 sbom.rst: how to disable SPDX generation
Generating SPDX is enabled by default in poky but
it can take a lot of build time resources so document
how to disable it.

(From yocto-docs rev: d26a3f2ed8f24e1b72f58ecb8b7cdba7007ba77b)

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit bcd58b7a9455fbb0ea5944089d663e327f0eb38f)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Trevor Woerner
81d9f2c877 contributor-guide/submit-changes: encourage patch version changelogs
Add a section after the 'git format-patch' information encouraging developers
to add patch version changelogs to their patch updates.

(From yocto-docs rev: dff4d470193c1b5c961f4725b796050fb79b2b5c)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 2e3a37c4607b296956993e557d1786c4876e5722)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Lee Chee Yang
1c8f786d2e migration-guides: add release notes for 5.0.9
(From yocto-docs rev: f27d37d4b657dd5a0c93a5749ba7b288f5303f5c)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 0d070439259d72f66a71c148f6c7926f6f233b6d)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Enrico Jörns
55c59d8d66 ref-manual/variables.rst: update ROOT_HOME documentation
* Since scarthgap [1], the default will be overridden when using
  'systemd' as INIT_MANAGER. Reflect this in the documentation.
* The distro configuration is probably the better place for
  customization, thus at least mention this together with the
  local.conf.
* While at it, drop the probably redundant description on how to
  override weak default variables.
  The example on how to set "/root" is still given indirectly, anyway.

[1] ebafe463 ("systemd: upgrade to 255.1")

(From yocto-docs rev: 84c55a224f16644a42e51294a6ad0b2568f84ea2)

Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 50e92009d309fc4ae406174feb8f6578142748cc)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Adrian Freihofer
0305df4ec4 ref-manual: kernel-fitimage.bbclass does not use SPL_SIGN_KEYNAME
The kernel-fitimage.bbclass uses the UBOOT_* variables. The SPL_*
variables are handled by uboot-sign.bbclass.

(From yocto-docs rev: 4a836be25193aeff2b03bd5b49959d41d7752dfa)

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 8ceffee908a039deb1021361faa7637e83ef26f3)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Lee Chee Yang
bc68afb939 migration-guides: add release notes for 4.0.26
(From yocto-docs rev: 73ace7506bb27ebd6c9c2d16bdfe465a871d6a24)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 656dc03101705bba718517b7017f71ce00541b72)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Antonin Godard
5ec2420b53 ref-manual/release-process: update releases.svg
- Add the future "Whinlatter" (5.3) and "Wrynose" (6.0) releases.
- Make the "Walnascar" release a current release.
- Update the month in Current.

(From yocto-docs rev: 63d00925b77a723750ee1126a1242e332d052689)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit adb8573b54626e033921a9f4e3db259312b79207)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Leonard Anderweit
6ca9eeea7f ref-manual: classes: uki: Fix git links
Fix links to files in git by adding a leading / to the path.

(From yocto-docs rev: 20447dbf40b07f6b7493dee0b4c4082376d96796)

Signed-off-by: Leonard Anderweit <l.anderweit@phytec.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit cc5daf15f5999bc217f8729e259ae720736beaaa)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Antonin Godard
d92d8894a4 test-manual/intro: remove Buildbot version used
The version has changed now (3.10.12 as of writing). Avoid having to
maintain this information by removing the version info from the intro.
Also fix a typo ("uses now uses") and give a link to yocto-autobuilder2.

Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: cdfa58f08ab98b233c466501e1a3567b869d312b)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 1ed64dbdf4a60b000305cdc2c67dc24f4bc97ef7)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
rajmohan r
958da8c6ad glibc-y2038-tests: remove glibc-y2038-tests_2.41.bb recipe
This recipe takes longer time >20min when bitbake for package
write stage. When cross-verified for longer time duration, found
that do_check() stage taking 20min while other stages completes
before 6min.

This recipe gives only below two test binaries in the packages to
test (ptest: glibc-y2038-tests):
     io/ftwtest
     io/ftwtest-time64

The above test binaries are already included for testing in recipe
glibc-testsuite_2.41.bb.

It is by now well established that glibc itself works as it should,
that all affected 32 bit targets are configured to use 64 bit time_t,
and that any lingering y2038 issues are in components other than the c
library, and usually come from C programming mistakes (e.g. storing
timestamps in long). Maybe we can simply remove the recipe?

Review comments for fixing above longer time duration ended up in
removing this recipe as a proposal is below
https://lists.openembedded.org/g/openembedded-core/topic/112188476#msg214636

Removed lines having reference to glibc-y2038-tests in the files.

(From OE-Core rev: dea859e904d9eacede147a627f4c176433ac9efc)

Signed-off-by: rajmohan r <semc.2042@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fbe3679ba3c12c52a502511f5dde91fb4de7a6b6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Changqing Li
f780b27120 icu: set ac_cv_path_install to ensure install tool reproducibility
icu will check program install path during do_configure, eg:
checking for a BSD-compatible install... /path/to/install -c

And this path will be writen into pkgdata.inc:
INSTALL_CMD=$(INSTALL-L)

Decided by if install is installed into recipe-sysroot-native during
do_configure stage, the INSTALL_CMD could be
/build/tmp/work/corei7-64-wrs-linux/icu/76-1/recipe-sysroot-native/usr/bin/install
or /build/tmp/hosttools/install if the build is rerun after the sysroot was
extended.

set ac_cv_path_install to install under hosttools to make a deterministic
result of INSTALL_CMD, avoid vary caused by the execute sequence of
another task which DEPENDS on coreutils-native and independent with
do_configure

[RP: Removed paths from ac_cv_path_install to simplify and avoid QA error too]
(From OE-Core rev: 208143e060cda6e22ae1e8c618e033fa9144b323)

(From OE-Core rev: 60a38959a5b740b16044bf8644046b3ed4816ae7)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Alon Bar-Lev
8b86f59197 module.bbclass: add KBUILD_EXTRA_SYMBOLS to install
Symbols are used during install as well, adding KBUILD_EXTRA_SYMBOLS enables
successful installation.

    | DEBUG: Executing shell function do_install
    | NOTE: make -j 22 KERNEL_SRC=xxx/kernel-source -C xxx/drivers
    KDIR=xxx/kernel-source DEPMOD=echo
    MODLIB=xxx/image/lib/modules/6.6.75-yocto-standard-00189-g530c419bc9db
    INSTALL_FW_PATH=xxx/image/lib/firmware CC=aarch64-poky-linux-gcc
    -fuse-ld=bfd -fcanon-prefix-map  LD=aarch64-poky-linux-ld.bfd
    OBJCOPY=aarch64-poky-linux-objcopy  STRIP=aarch64-poky-linux-strip
    O=xxx/kernel-build-artifacts modules_install
    | make: Entering directory 'xxx/drivers'
    | make -C xxx/kernel-source M=xxx/drivers modules
    | make[1]: Entering directory 'xxx/kernel-source'
    | make[2]: Entering directory 'xxx/kernel-build-artifacts'
    |   MODPOST xxx/drivers/Module.symvers
    | ERROR: modpost: "xxx" [xxx/xxx.ko] undefined!

(From OE-Core rev: c6ded848334807962967d2c6c7589fcc9feceb0d)

Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0ef80eeda967a9e04ff91c3583aabbc35c9868e8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Deepesh Varatharajan
f9ff1188df binutils: stable 2.44 branch updates
Below commits on binutils-2.44 stable branch are updated.

33578177adc dwarf: Dump .debug_loclists only for DWARF-5
fe459e33c67 PR 32603, revert message changes in 0b7f992b78fe and 31e9e2e8d109
37d12dd25d8 gdb/compile: add missing entry in bfd_link_callbacks array
31e9e2e8d10 PR 32603, more ld -w misbehaviour
0b7f992b78f PR 32603, ld -w misbehaviour
8cb98edf123 s390: Add support for z17 as CPU name
ed70d86b491 x86: Remove AVX10.2 256 bit rounding support
e1af7e590a5 elf: Clear the SEC_ALLOC bit for NOLOAD note sections
35db8c6dd2f ld: Pass -Wl,-z,lazy to compiler for i386 lazy binding tests
cc7ec316a45 Updated translations for bfd and gold
bf088ee09a7 PR 32731 ub sanitizer accessing filenames_reversed
78082591ec7 score-elf gas SEGV
d4c7ee9fbc1 gas: fix rs_fill_nop listing
a68d096a0ab Open the 2.44 branch for further development

Dropped: 0015-CVE-2025-1153.patch

Testing was done and there were no regressions found

(From OE-Core rev: e06b23897d51d075327012440afbabfe2d5a3de0)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Peter Marko
a59046018c go: upgrade 1.24.2 -> 1.24.3
Upgrade to latest 1.24.x release [1]:

$ git --no-pager log --oneline go1.24.2..go1.24.3
34c8b14ca9 (release-branch.go1.24) [release-branch.go1.24] go1.24.3
8947f3395e [release-branch.go1.24] os: avoid escape from Root via paths ending in ../
06fd2f115b [release-branch.go1.24] cmd/compile: remove no-longer-necessary recursive inlining checks
f66ab6521c [release-branch.go1.24] cmd/internal/obj/wasm: use i64 for large return addr
c1f9c2c7b0 [release-branch.go1.24] cmd/go/internal/load: join incompatible and dirty build specifiers with .
0ab64e2caa [release-branch.go1.24] runtime: cleanup M vgetrandom state before dropping P
56eb99859d [release-branch.go1.24] internal/runtime/maps: pass proper func PC to race.WritePC/race.ReadPC
43130aff52 [release-branch.go1.24] runtime: fix 9-arg syscall on darwin/amd64
b2c005e7b2 [release-branch.go1.24] crypto/tls: fix ECH compatibility
a9d9b55709 [release-branch.go1.24] cmd/link: choose one with larger size for duplicated BSS symbols
fa7217f74d [release-branch.go1.24] os: avoid panic in Root when symlink references the root

Fixes CVE-2025-22873

[1] https://github.com/golang/go/compare/go1.24.2...go1.24.3

(From OE-Core rev: f53e4b16d1b4e4a25f9cd9118d17c52f096fbae2)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Archana Polampalli
b0cb523695 go: upgrade 1.24.1 -> 1.24.2
Fixes CVE-2025-22871

https://github.com/golang/go/compare/go1.24.1...go1.24.2

(From OE-Core rev: 0507f4709fb379e369f0abd5c37b9cee8de1fcb1)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Archana Polampalli
01c2e38dac perl: upgrade 5.40.0 -> 5.40.2
https://metacpan.org/pod/perldelta

This provides a fix for CVE-2024-56406

(From OE-Core rev: 8e91cd8293a13d21eb1df5b9b750d9b498bb3530)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Archana Polampalli
2ca75e2fff perlcross: 1.6 -> 1.6.2
Provide support for Perl 5.40.2

https://github.com/arsv/perl-cross/releases/tag/1.6.2

(From OE-Core rev: 9fde5d3657a5842dcdac20eea140077b1e8ae06b)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00