similarity index 74%
rename from meta/recipes-devtools/binutils/binutils-2.46.inc
rename to meta/recipes-devtools/binutils/binutils-2.47.inc
@@ -12,18 +12,13 @@ LIC_FILES_CHKSUM = "\
# When upgrading to next major release, ensure that there is no trailing .0, so
# that upstream version check can work correctly.
-PV = "2.46.1"
-CVE_VERSION = "2.46.1"
-SRCBRANCH ?= "binutils-2_46-branch"
+PV = "2.47"
+CVE_VERSION = "2.47"
+SRCBRANCH ?= "binutils-2_47-branch"
UPSTREAM_CHECK_GITTAGREGEX = "binutils-(?P<pver>\d+_(\d_?)*)"
-CVE_STATUS[CVE-2025-69650] = "disputed: observed behavior only in pre-release code, does not affect any tagged version"
-CVE_STATUS[CVE-2025-69651] = "disputed: observed behavior only in pre-release code, does not affect any tagged version"
-CVE_STATUS[CVE-2025-69649] = "fixed-version: Fixed from version 2.46"
-CVE_STATUS[CVE-2025-69652] = "fixed-version: Fixed from version 2.46"
-
-SRCREV ?= "5e56594815854de5eca35c7c04b11705d0f19c02"
+SRCREV ?= "6ce87bbc521cf46eaee9a1f7ef61cee2cdfb3e32"
BINUTILS_GIT_URI ?= "git://sourceware.org/git/binutils-gdb.git;branch=${SRCBRANCH};protocol=https"
SRC_URI = "\
${BINUTILS_GIT_URI} \
@@ -38,6 +33,4 @@ SRC_URI = "\
file://0012-Only-generate-an-RPATH-entry-if-LD_RUN_PATH-is-not-e.patch \
file://0013-Define-alignof-using-_Alignof-when-using-C11-or-newe.patch \
file://0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch \
- file://CVE-2026-4647.patch \
- file://CVE-2026-6846.patch \
"
similarity index 100%
rename from meta/recipes-devtools/binutils/binutils-cross-canadian_2.46.bb
rename to meta/recipes-devtools/binutils/binutils-cross-canadian_2.47.bb
similarity index 100%
rename from meta/recipes-devtools/binutils/binutils-cross_2.46.bb
rename to meta/recipes-devtools/binutils/binutils-cross_2.47.bb
similarity index 100%
rename from meta/recipes-devtools/binutils/binutils-crosssdk_2.46.bb
rename to meta/recipes-devtools/binutils/binutils-crosssdk_2.47.bb
similarity index 100%
rename from meta/recipes-devtools/binutils/binutils-testsuite_2.46.bb
rename to meta/recipes-devtools/binutils/binutils-testsuite_2.47.bb
@@ -5522,7 +5522,7 @@ index b97a2c6e6b6..3e171c6c536 100755
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
--#line 11153 "configure"
+-#line 11155 "configure"
+line $LINENO "configure"
#include "confdefs.h"
@@ -5544,7 +5544,7 @@ index b97a2c6e6b6..3e171c6c536 100755
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
--#line 11259 "configure"
+-#line 11261 "configure"
+#line $LINENO "configure"
#include "confdefs.h"
@@ -18,10 +18,10 @@ Cc: Zac Walker <zac.walker@linaro.org>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ld/configure.tgt b/ld/configure.tgt
-index 3e158913b89..be62b312a8e 100644
+index 60b62e69c08..60efa496910 100644
--- a/ld/configure.tgt
+++ b/ld/configure.tgt
-@@ -1008,7 +1008,7 @@ x86_64-*-cygwin) targ_emul=i386pep ;
+@@ -992,7 +992,7 @@ x86_64-*-cygwin) targ_emul=i386pep ;
;;
x86_64-*-mingw*) targ_emul=i386pep ;
targ_extra_emuls=i386pe
@@ -29,6 +29,6 @@ index 3e158913b89..be62b312a8e 100644
+ targ_extra_ofiles="deffilep.o pdb.o pe-dll.o"
;;
x86_64-*-gnu*) targ_emul=elf_x86_64
- targ_extra_emuls=elf_iamcu
---
+ targ_extra_libpath="elf_i386 elf32_x86_64"
+--
2.49.0
deleted file mode 100644
@@ -1,223 +0,0 @@
-From 9e99dbc1f19ffaf18d0250788951706066ebe7f2 Mon Sep 17 00:00:00 2001
-From: Alan Modra <amodra@gmail.com>
-Date: Fri, 13 Mar 2026 17:28:28 +1030
-Subject: [PATCH] PR33919 Out-of-bounds read in XCOFF relocation processing
-
- PR 33919
- * coff-rs6000.c (xcoff_calculate_relocation): Don't use explicit
- array size.
- (xcoff_complain_overflow): Likewise.
- (xcoff_rtype2howto): Return a NULL howto rather than aborting.
- (_bfd_xcoff_reloc_name_lookup): Use ARRAY_SIZE.
- (xcoff_ppc_relocate_section): Sanity check reloc r_type before
- accessing xcoff_howto_table. Print r_type using %#x. Remove
- now redundant later reloc r_type sanity check.
- * coff64-rs6000.c: Similarly.
- * libxcoff.h (XCOFF_MAX_CALCULATE_RELOCATION): Don't define.
- (XCOFF_MAX_COMPLAIN_OVERFLOW): Don't define.
-
-CVE: CVE-2026-4647
-Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=9e99dbc1f19ffaf18d0250788951706066ebe7f2]
-Signed-off-by: Peter Marko <peter.marko@siemens.com>
----
- bfd/coff-rs6000.c | 36 +++++++++++++++++++++---------------
- bfd/coff64-rs6000.c | 33 ++++++++++++++++++++-------------
- bfd/libxcoff.h | 3 ---
- 3 files changed, 41 insertions(+), 31 deletions(-)
-
-diff --git a/bfd/coff-rs6000.c b/bfd/coff-rs6000.c
-index 62caae64f4e..00e0f5442f7 100644
---- a/bfd/coff-rs6000.c
-+++ b/bfd/coff-rs6000.c
-@@ -155,8 +155,7 @@ static xcoff_complain_function xcoff_complain_overflow_bitfield_func;
- static xcoff_complain_function xcoff_complain_overflow_signed_func;
- static xcoff_complain_function xcoff_complain_overflow_unsigned_func;
-
--xcoff_reloc_function *const
--xcoff_calculate_relocation[XCOFF_MAX_CALCULATE_RELOCATION] =
-+xcoff_reloc_function *const xcoff_calculate_relocation[] =
- {
- xcoff_reloc_type_pos, /* R_POS (0x00) */
- xcoff_reloc_type_neg, /* R_NEG (0x01) */
-@@ -210,8 +209,7 @@ xcoff_calculate_relocation[XCOFF_MAX_CALCULATE_RELOCATION] =
- xcoff_reloc_type_toc, /* R_TOCL (0x31) */
- };
-
--xcoff_complain_function *const
--xcoff_complain_overflow[XCOFF_MAX_COMPLAIN_OVERFLOW] =
-+xcoff_complain_function *const xcoff_complain_overflow[] =
- {
- xcoff_complain_overflow_dont_func,
- xcoff_complain_overflow_bitfield_func,
-@@ -1158,8 +1156,11 @@ reloc_howto_type xcoff_howto_table[] =
- void
- xcoff_rtype2howto (arelent *relent, struct internal_reloc *internal)
- {
-- if (internal->r_type > R_TOCL)
-- abort ();
-+ if (internal->r_type >= ARRAY_SIZE (xcoff_howto_table))
-+ {
-+ relent->howto = NULL;
-+ return;
-+ }
-
- /* Default howto layout works most of the time */
- relent->howto = &xcoff_howto_table[internal->r_type];
-@@ -1183,7 +1184,7 @@ xcoff_rtype2howto (arelent *relent, struct internal_reloc *internal)
- if (relent->howto->dst_mask != 0
- && (relent->howto->bitsize
- != ((unsigned int) internal->r_size & 0x1f) + 1))
-- abort ();
-+ relent->howto = NULL;
- }
-
- reloc_howto_type *
-@@ -1236,9 +1237,7 @@ _bfd_xcoff_reloc_name_lookup (bfd *abfd ATTRIBUTE_UNUSED,
- {
- unsigned int i;
-
-- for (i = 0;
-- i < sizeof (xcoff_howto_table) / sizeof (xcoff_howto_table[0]);
-- i++)
-+ for (i = 0; i < ARRAY_SIZE (xcoff_howto_table); i++)
- if (xcoff_howto_table[i].name != NULL
- && strcasecmp (xcoff_howto_table[i].name, r_name) == 0)
- return &xcoff_howto_table[i];
-@@ -3763,6 +3762,14 @@ xcoff_ppc_relocate_section (bfd *output_bfd,
- the csect including the symbol which it references. */
- if (rel->r_type == R_REF)
- continue;
-+ if (rel->r_type >= ARRAY_SIZE (xcoff_howto_table))
-+ {
-+ /* xgettext:c-format */
-+ _bfd_error_handler (_("%pB: unsupported relocation type %#x"),
-+ input_bfd, rel->r_type);
-+ bfd_set_error (bfd_error_bad_value);
-+ return false;
-+ }
-
- /* Retrieve default value in HOWTO table and fix up according
- to r_size field, if it can be different.
-@@ -3782,7 +3789,7 @@ xcoff_ppc_relocate_section (bfd *output_bfd,
-
- default:
- _bfd_error_handler
-- (_("%pB: relocation (%d) at 0x%" PRIx64 " has wrong r_rsize (0x%x)\n"),
-+ (_("%pB: relocation (%#x) at 0x%" PRIx64 " has wrong r_rsize (0x%x)\n"),
- input_bfd, rel->r_type, (uint64_t) rel->r_vaddr, rel->r_size);
- return false;
- }
-@@ -3858,10 +3865,9 @@ xcoff_ppc_relocate_section (bfd *output_bfd,
- }
- }
-
-- if (rel->r_type >= XCOFF_MAX_CALCULATE_RELOCATION
-- || !((*xcoff_calculate_relocation[rel->r_type])
-- (input_bfd, input_section, output_bfd, rel, sym, &howto, val,
-- addend, &relocation, contents, info)))
-+ if (!((*xcoff_calculate_relocation[rel->r_type])
-+ (input_bfd, input_section, output_bfd, rel, sym, &howto, val,
-+ addend, &relocation, contents, info)))
- return false;
-
- /* address */
-diff --git a/bfd/coff64-rs6000.c b/bfd/coff64-rs6000.c
-index fa1759b5925..f6a60433e62 100644
---- a/bfd/coff64-rs6000.c
-+++ b/bfd/coff64-rs6000.c
-@@ -177,8 +177,7 @@ static bool xcoff64_bad_format_hook
- /* Relocation functions */
- static xcoff_reloc_function xcoff64_reloc_type_br;
-
--xcoff_reloc_function *const
--xcoff64_calculate_relocation[XCOFF_MAX_CALCULATE_RELOCATION] =
-+xcoff_reloc_function *const xcoff64_calculate_relocation[] =
- {
- xcoff_reloc_type_pos, /* R_POS (0x00) */
- xcoff_reloc_type_neg, /* R_NEG (0x01) */
-@@ -1439,8 +1438,11 @@ reloc_howto_type xcoff64_howto_table[] =
- void
- xcoff64_rtype2howto (arelent *relent, struct internal_reloc *internal)
- {
-- if (internal->r_type > R_TOCL)
-- abort ();
-+ if (internal->r_type >= ARRAY_SIZE (xcoff64_howto_table))
-+ {
-+ relent->howto = NULL;
-+ return;
-+ }
-
- /* Default howto layout works most of the time */
- relent->howto = &xcoff64_howto_table[internal->r_type];
-@@ -1473,7 +1475,7 @@ xcoff64_rtype2howto (arelent *relent, struct internal_reloc *internal)
- if (relent->howto->dst_mask != 0
- && (relent->howto->bitsize
- != ((unsigned int) internal->r_size & 0x3f) + 1))
-- abort ();
-+ relent->howto = NULL;
- }
-
- reloc_howto_type *
-@@ -1528,9 +1530,7 @@ xcoff64_reloc_name_lookup (bfd *abfd ATTRIBUTE_UNUSED,
- {
- unsigned int i;
-
-- for (i = 0;
-- i < sizeof (xcoff64_howto_table) / sizeof (xcoff64_howto_table[0]);
-- i++)
-+ for (i = 0; i < ARRAY_SIZE (xcoff64_howto_table); i++)
- if (xcoff64_howto_table[i].name != NULL
- && strcasecmp (xcoff64_howto_table[i].name, r_name) == 0)
- return &xcoff64_howto_table[i];
-@@ -1574,6 +1574,14 @@ xcoff64_ppc_relocate_section (bfd *output_bfd,
- the csect including the symbol which it references. */
- if (rel->r_type == R_REF)
- continue;
-+ if (rel->r_type >= ARRAY_SIZE (xcoff64_howto_table))
-+ {
-+ /* xgettext:c-format */
-+ _bfd_error_handler (_("%pB: unsupported relocation type %#x"),
-+ input_bfd, rel->r_type);
-+ bfd_set_error (bfd_error_bad_value);
-+ return false;
-+ }
-
- /* Retrieve default value in HOWTO table and fix up according
- to r_size field, if it can be different.
-@@ -1595,7 +1603,7 @@ xcoff64_ppc_relocate_section (bfd *output_bfd,
-
- default:
- _bfd_error_handler
-- (_("%pB: relocation (%d) at (0x%" PRIx64 ") has wrong"
-+ (_("%pB: relocation (%#x) at (0x%" PRIx64 ") has wrong"
- " r_rsize (0x%x)\n"),
- input_bfd, rel->r_type, rel->r_vaddr, rel->r_size);
- return false;
-@@ -1668,10 +1676,9 @@ xcoff64_ppc_relocate_section (bfd *output_bfd,
- }
- }
-
-- if (rel->r_type >= XCOFF_MAX_CALCULATE_RELOCATION
-- || !((*xcoff64_calculate_relocation[rel->r_type])
-- (input_bfd, input_section, output_bfd, rel, sym, &howto, val,
-- addend, &relocation, contents, info)))
-+ if (!((*xcoff64_calculate_relocation[rel->r_type])
-+ (input_bfd, input_section, output_bfd, rel, sym, &howto, val,
-+ addend, &relocation, contents, info)))
- return false;
-
- /* address */
-diff --git a/bfd/libxcoff.h b/bfd/libxcoff.h
-index c116d9b795f..e6b87975ff6 100644
---- a/bfd/libxcoff.h
-+++ b/bfd/libxcoff.h
-@@ -217,9 +217,6 @@ struct xcoff_backend_data_rec
- #define bfd_xcoff_text_align_power(a) ((xcoff_data (a)->text_align_power))
- #define bfd_xcoff_data_align_power(a) ((xcoff_data (a)->data_align_power))
-
--/* xcoff*_ppc_relocate_section macros */
--#define XCOFF_MAX_CALCULATE_RELOCATION (0x32)
--#define XCOFF_MAX_COMPLAIN_OVERFLOW (4)
- /* N_ONES produces N one bits, without overflowing machine arithmetic. */
- #ifdef N_ONES
- #undef N_ONES
deleted file mode 100644
@@ -1,59 +0,0 @@
-From 7a089e0302382f4d4e077941156e1eaa68d01393 Mon Sep 17 00:00:00 2001
-From: Alan Modra <amodra@gmail.com>
-Date: Mon, 6 Apr 2026 22:58:22 +0930
-Subject: [PATCH] PR 34049 buffer overflow in xcoff_link_add_symbols
-
-The fact that coffcode.h:coff_set_alignment_hook for rs6000 removes
-sections can result in target_index > section_count. Thus any array
-indexed by target_index must not be sized by section_count.
-
- PR ld/34049
- * xcofflink.c (xcoff_link_add_symbols): Size reloc_info array
- using max target_index.
-
-CVE: CVE-2026-6846
-Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=7a089e0302382f4d4e077941156e1eaa68d01393]
-
-Signed-off-by: Alan Modra <amodra@gmail.com>
-(cherry picked from commit 7a089e0302382f4d4e077941156e1eaa68d01393)
-Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
----
- bfd/xcofflink.c | 15 ++++++++++++++-
- 1 file changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/bfd/xcofflink.c b/bfd/xcofflink.c
-index 1781182fa6a..7f1c0df760f 100644
---- a/bfd/xcofflink.c
-+++ b/bfd/xcofflink.c
-@@ -1335,6 +1335,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
- } *reloc_info = NULL;
- bfd_size_type amt;
- unsigned short visibility;
-+ unsigned int max_target_index;
-
- keep_syms = obj_coff_keep_syms (abfd);
-
-@@ -1398,7 +1399,19 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info)
- order by VMA within a given section, so we handle this by
- scanning along the relocs as we process the csects. We index
- into reloc_info using the section target_index. */
-- amt = abfd->section_count + 1;
-+ max_target_index = 0;
-+ for (o = abfd->section_last; o != NULL; o = o->prev)
-+ if (o->target_index != 0)
-+ {
-+ /* The last section added from the object file will have the
-+ highest target_index. See coffgen.c coff_real_object_p and
-+ make_a_section_from_file. Sections added by
-+ xcoff_link_create_extra_sections will have a zero
-+ target_index. */
-+ max_target_index = o->target_index;
-+ break;
-+ }
-+ amt = max_target_index + 1;
- amt *= sizeof (struct reloc_info_struct);
- reloc_info = bfd_zmalloc (amt);
- if (reloc_info == NULL)
-2.43.7
-
similarity index 100%
rename from meta/recipes-devtools/binutils/binutils_2.46.bb
rename to meta/recipes-devtools/binutils/binutils_2.47.bb