From patchwork Mon Jul 27 22:55:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93601 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2369C54F4D for ; Mon, 27 Jul 2026 22:56:09 +0000 (UTC) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43788.1785192964676718363 for ; Mon, 27 Jul 2026 15:56:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=zjVz0xM3; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-490cf322ed0so22744245e9.1 for ; Mon, 27 Jul 2026 15:56:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192963; x=1785797763; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=sDRwXh+9GSdxQhptiXPjjMTmMT4v7UkcE1NWmlun2Bs=; b=zjVz0xM3O4nCwn1+dZrMzSPVdRdoBYC+rFLj/UiJfF50u3J1cmO8vWcAPoSgFwQge7 7TX8nxZTcZLRz9ty1x2iRxBHhLVAUG9PHmL2fJR0WgeiAQyqA3fzpJSBATRgnWUwfeZr rQAbvfrEYCimujPu61u99af7PtogQT9AIL0XM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192963; x=1785797763; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=sDRwXh+9GSdxQhptiXPjjMTmMT4v7UkcE1NWmlun2Bs=; b=L9JxzHCOsyGwKGkxfQmoKi+knyvenImGr5yBzbco1tco6wUAF3rJvtv9K31/kvl+qc eOrTLihPZiMkDU4VGBKmDipr8hExYhzN5pcwRj0xTF55HSQqr3WAsO1ejyZ1YgDsxYVX 92FssH5HV1jPRsC7MSK8fnKaziD1w8s0EVVG3ZywIwTFv69DECDm1wxs/lpT1a86g90a LdoyLYP1O/L+2ns0tmDxwqgwXpyI8HPhV7r9LBmxcdopwMHaEguz8JS/ZA7bLUCqbzPU hRtoA+WrGtb6T5X4B8M4PufoLm2gRrqiZOqiSQNjFIEw+DxXj2aroVVacrePLYSl87w3 eEbw== X-Gm-Message-State: AOJu0YyuljTvrnhN2IGSLyJRs/HcmbYXnOMAkoCMFmUuiPkpSkTu/Vb4 K1v5yD7xBCPhT17ofkKlhP6pHbh0sl9Zao1QNmMYuhL2KRjeqg24Au2VZgaoWLMKBPUziCLwmep NdOmsgnQ= X-Gm-Gg: AR+sD10eC7EnwzE1Q3rjWW+GwynlMBDFsRJEIzwQ7IRW0LQ1Is715VlfpZa+oTmD++q BIzPJNYNEmS8V/y7dkVfRLEU7FXbxT1AA4DsW7Ozy6uWYS97za7A8Fa/uabA/D8jrrQ6jheNOf+ VeucZq/XlcUY6WIFD+/JYGiXtfbJvlw6IK5/FFDyaUpvOujPh8mv8qAOOn9Sx/XOYap/ZNTspFe P/gvgRQF/3s7eZo4R5vFerFDBMxWRWOXowVc2TbaBv1Zd9Si+zLSIHtXzcCymD0oyXi+7jBM/d/ gD4Rr8tcMtGu/IxHiTwkgiOTBV+SQtFxgV4wURV51NA829Ww6O8rKdqmrfttMEdbN89nNLX2OAh 6T9pGWTaQLwOG4J/g4x6lLe2au/XPYRWkLTriPiHtXp1EpELBFe+E8WhpBvYgJul5ksUHd2PVeN 8TIHYfeeCYf3SriLYWIcOSHBNxIlZAOxDogLoo5uLYWik930yTCIyirjYoajy7UXtlm8gyRhBqm Ne2ZA== X-Received: by 2002:a05:600c:19c8:b0:495:7888:281c with SMTP id 5b1f17b1804b1-496b5689b16mr135240735e9.0.1785192962789; Mon, 27 Jul 2026 15:56:02 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:01 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 01/36] curl: fix CVE-2026-7168 Date: Tue, 28 Jul 2026 00:55:15 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242109 From: Deepak Rathore Backport the upstream fix [1] for proxy Digest state reuse across proxy switches described in [2] and tracked by [3]. [1] https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 [2] https://curl.se/docs/CVE-2026-7168.html [3] https://nvd.nist.gov/vuln/detail/CVE-2026-7168 Signed-off-by: Deepak Rathore Signed-off-by: Yoann Congal --- .../curl/curl/CVE-2026-7168.patch | 376 ++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 1 + 2 files changed, 377 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7168.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-7168.patch b/meta/recipes-support/curl/curl/CVE-2026-7168.patch new file mode 100644 index 00000000000..d547c849266 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-7168.patch @@ -0,0 +1,376 @@ +From c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 27 Apr 2026 09:14:51 +0200 +Subject: [PATCH] setopt: clear proxy auth properties when switching + +Verify with test 1588 + +Closes #21453 + +CVE: CVE-2026-7168 +Upstream-Status: Backport [https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507] + +Backport Changes: +- Adapted setproxy() insertion and test-list placement to the curl 8.19.0 wrynose layout. + +(cherry picked from commit c1cfdf59acbaf9504c4578d4cf56cdd7c8594507) +Signed-off-by: Deepak Rathore +--- + lib/setopt.c | 17 ++++- + lib/vauth/vauth.h | 1 + + tests/data/Makefile.am | 2 +- + tests/data/test1588 | 106 ++++++++++++++++++++++++++ + tests/libtest/Makefile.inc | 2 +- + tests/libtest/lib1588.c | 150 +++++++++++++++++++++++++++++++++++++ + 6 files changed, 275 insertions(+), 3 deletions(-) + create mode 100644 tests/data/test1588 + create mode 100644 tests/libtest/lib1588.c + +diff --git a/lib/setopt.c b/lib/setopt.c +index 84f3e02..d12ffb6 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -49,6 +49,7 @@ + #include "curlx/strdup.h" + #include "escape.h" + #include "bufref.h" ++#include "vauth/vauth.h" + + static CURLcode setopt_set_timeout_sec(timediff_t *ptimeout_ms, long secs) + { +@@ -1664,6 +1665,20 @@ static CURLcode cookiefile(struct Curl_easy *data, const char *ptr) + #endif + + #ifndef CURL_DISABLE_PROXY ++ ++static CURLcode setproxy(struct Curl_easy *data, const char *proxy) ++{ ++ if((data->set.str[STRING_PROXY] && proxy) && ++ /* there was one set, is this a new one? */ ++ !strcmp(data->set.str[STRING_PROXY], proxy)) ++ return CURLE_OK; /* same one as before */ ++ ++ Curl_auth_digest_cleanup(&data->state.proxydigest); ++ memset(&data->state.authproxy, 0, sizeof(data->state.authproxy)); ++ return Curl_setstropt(&data->set.str[STRING_PROXY], proxy); ++} ++ ++ + static CURLcode setopt_cptr_proxy(struct Curl_easy *data, CURLoption option, + const char *ptr) + { +@@ -1759,7 +1771,7 @@ static CURLcode setopt_cptr_proxy(struct Curl_easy *data, CURLoption option, + * Setting it to NULL, means no proxy but allows the environment variables + * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL). + */ +- return Curl_setstropt(&s->str[STRING_PROXY], ptr); ++ return setproxy(data, ptr); + case CURLOPT_PRE_PROXY: + /* + * Set proxy server:port to use as SOCKS proxy. +diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h +index 3e66c89..20ee51e 100644 +--- a/lib/vauth/vauth.h ++++ b/lib/vauth/vauth.h +@@ -117,6 +117,7 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data, + /* This is used to clean up the digest specific data */ + void Curl_auth_digest_cleanup(struct digestdata *digest); + #else ++#define Curl_auth_digest_cleanup(x) + #define Curl_auth_is_digest_supported() FALSE + #endif /* !CURL_DISABLE_DIGEST_AUTH */ + +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index 1b76b01..1e84b26 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -208,7 +208,7 @@ test1548 test1549 test1550 test1551 test1552 test1553 test1554 test1555 \ + test1556 test1557 test1558 test1559 test1560 test1561 test1562 test1563 \ + test1564 test1565 test1566 test1567 test1568 test1569 test1570 test1571 \ + test1572 test1573 test1574 test1575 test1576 test1577 test1578 test1579 \ +-test1580 test1581 test1582 test1583 test1584 test1585 \ ++test1580 test1581 test1582 test1583 test1584 test1585 test1588 \ + \ + test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \ + test1598 test1599 test1600 test1601 test1602 test1603 test1604 test1605 \ +diff --git a/tests/data/test1588 b/tests/data/test1588 +new file mode 100644 +index 0000000..753e98c +--- /dev/null ++++ b/tests/data/test1588 +@@ -0,0 +1,106 @@ ++ ++ ++ ++ ++HTTP ++HTTP GET ++HTTP proxy ++HTTP proxy Digest auth ++multi ++ ++ ++ ++# Server-side ++ ++ ++# this is returned first since we get no proxy-auth ++ ++HTTP/1.1 407 Authorization Required to proxy me my dear ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" ++Content-Length: 33 ++ ++And you should ignore this data. ++ ++ ++# then this is returned when we get proxy-auth ++ ++HTTP/1.1 200 OK ++Content-Length: 21 ++Server: no ++ ++Nice proxy auth sir! ++ ++ ++ ++HTTP/1.1 407 Authorization Required to proxy me my dear ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" ++Content-Length: 33 ++ ++HTTP/1.1 200 OK ++Content-Length: 21 ++Server: no ++ ++Nice proxy auth sir! ++HTTP/1.1 407 Authorization Required to proxy me my dear ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" ++Content-Length: 33 ++ ++HTTP/1.1 200 OK ++Content-Length: 21 ++Server: no ++ ++Nice proxy auth sir! ++ ++ ++ ++# Client-side ++ ++ ++http ++ ++# tool is what to use instead of 'curl' ++ ++lib%TESTNUMBER ++ ++ ++!SSPI ++crypto ++proxy ++digest ++ ++ ++HTTP proxy auth Digest, then change proxy and do it again ++ ++ ++http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT silly:person custom.set.host.name ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET http://test.remote.example.com/path/1588 HTTP/1.1 ++Host: test.remote.example.com ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++GET http://test.remote.example.com/path/1588 HTTP/1.1 ++Host: test.remote.example.com ++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a" ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++GET http://test.remote.example.com/path/1588 HTTP/1.1 ++Host: test.remote.example.com ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++GET http://test.remote.example.com/path/1588 HTTP/1.1 ++Host: test.remote.example.com ++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a" ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++ ++ ++ +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc +index 2f77c16..96b82bc 100644 +--- a/tests/libtest/Makefile.inc ++++ b/tests/libtest/Makefile.inc +@@ -97,7 +97,7 @@ TESTS_C = \ + lib1559.c lib1560.c lib1564.c lib1565.c \ + lib1567.c lib1568.c lib1569.c lib1571.c \ + lib1576.c \ +- lib1582.c \ ++ lib1582.c lib1588.c \ + lib1591.c lib1592.c lib1593.c lib1594.c lib1597.c \ + lib1598.c lib1599.c \ + lib1662.c \ +diff --git a/tests/libtest/lib1588.c b/tests/libtest/lib1588.c +new file mode 100644 +index 0000000..9b12f36 +--- /dev/null ++++ b/tests/libtest/lib1588.c +@@ -0,0 +1,150 @@ ++/*************************************************************************** ++ * _ _ ____ _ ++ * Project ___| | | | _ \| | ++ * / __| | | | |_) | | ++ * | (__| |_| | _ <| |___ ++ * \___|\___/|_| \_\_____| ++ * ++ * Copyright (C) Daniel Stenberg, , et al. ++ * ++ * This software is licensed as described in the file COPYING, which ++ * you should have received as part of this distribution. The terms ++ * are also available at https://curl.se/docs/copyright.html. ++ * ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell ++ * copies of the Software, and permit persons to whom the Software is ++ * furnished to do so, under the terms of the COPYING file. ++ * ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++ * KIND, either express or implied. ++ * ++ * SPDX-License-Identifier: curl ++ * ++ ***************************************************************************/ ++/* ++ * argv1 = URL ++ * argv2 = proxy host ++ * argv3 = proxy port ++ * argv4 = proxyuser:password ++ */ ++ ++#include "first.h" ++ ++static CURLcode init1588(CURL *curl, const char *url, ++ const char *userpwd, const char *proxy) ++{ ++ CURLcode result = CURLE_OK; ++ ++ res_easy_setopt(curl, CURLOPT_URL, url); ++ if(result) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXY, proxy); ++ if(result) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd); ++ if(result) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST); ++ if(result) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L); ++ if(result) ++ goto init_failed; ++#if 0 ++ res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L); ++ if(result) ++ goto init_failed; ++#endif ++ ++ res_easy_setopt(curl, CURLOPT_HEADER, 1L); ++ if(result) ++ goto init_failed; ++ ++ return CURLE_OK; /* success */ ++ ++init_failed: ++ return result; /* failure */ ++} ++ ++static CURLcode run1588(CURL *curl, const char *url, const char *userpwd, ++ const char *proxy) ++{ ++ CURLcode result = CURLE_OK; ++ ++ result = init1588(curl, url, userpwd, proxy); ++ if(result) ++ return result; ++ ++ return curl_easy_perform(curl); ++} ++ ++static CURLcode test_lib1588(const char *URL) ++{ ++ CURLcode result = CURLE_OK; ++ CURL *curl = NULL; ++ const char *proxyuserpws = libtest_arg4; ++ struct curl_slist *host = NULL; ++ struct curl_slist *host2 = NULL; ++ char proxy1_resolve[128]; ++ char proxy2_resolve[128]; ++ char proxy1_connect[128]; ++ char proxy2_connect[128]; ++ ++ if(test_argc < 3) ++ return TEST_ERR_MAJOR_BAD; ++ ++ curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve), ++ "firstproxy:%s:%s", libtest_arg3, libtest_arg2); ++ curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve), ++ "secondproxy:%s:%s", libtest_arg3, libtest_arg2); ++ ++ /* we connect to the fake host name but the right port number */ ++ curl_msnprintf(proxy1_connect, sizeof(proxy1_connect), ++ "firstproxy:%s", libtest_arg3); ++ curl_msnprintf(proxy2_connect, sizeof(proxy2_connect), ++ "secondproxy:%s", libtest_arg3); ++ ++ res_global_init(CURL_GLOBAL_ALL); ++ if(result) ++ return result; ++ ++ curl = curl_easy_init(); ++ if(!curl) { ++ curl_mfprintf(stderr, "curl_easy_init() failed\n"); ++ curl_global_cleanup(); ++ return TEST_ERR_MAJOR_BAD; ++ } ++ ++ host = curl_slist_append(NULL, proxy1_resolve); ++ if(!host) ++ goto test_cleanup; ++ host2 = curl_slist_append(host, proxy2_resolve); ++ if(!host2) ++ goto test_cleanup; ++ host = host2; ++ ++ start_test_timing(); ++ ++ easy_setopt(curl, CURLOPT_RESOLVE, host); ++ ++ result = run1588(curl, URL, proxyuserpws, proxy1_connect); ++ if(result) ++ goto test_cleanup; ++ ++ curl_mfprintf(stderr, "lib1588: now we do the request again\n"); ++ ++ result = run1588(curl, URL, proxyuserpws, proxy2_connect); ++ ++test_cleanup: ++ ++ /* proper cleanup sequence - type PB */ ++ ++ curl_easy_cleanup(curl); ++ curl_global_cleanup(); ++ curl_slist_free_all(host); ++ return result; ++} diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 6ad0daa59d4..bdd6e730199 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -21,6 +21,7 @@ SRC_URI = " \ file://CVE-2026-6253.patch \ file://CVE-2026-6429-dependent.patch \ file://CVE-2026-6429.patch \ + file://CVE-2026-7168.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Mon Jul 27 22:55:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93598 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1F21C54F4E for ; Mon, 27 Jul 2026 22:56:09 +0000 (UTC) Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43790.1785192966191847742 for ; Mon, 27 Jul 2026 15:56:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Tk4UBlZD; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-495437bb891so3377365e9.1 for ; Mon, 27 Jul 2026 15:56:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192964; x=1785797764; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=o577EwGe+r5EVVD8sOs4TV9AMcYS4ezs/+Hanb2FAXM=; b=Tk4UBlZDkThp8CncUsppaXbFKRyZPSCd6P16ZZ1x/QbrsPcxqXkVq0IE4PK6H5RxEh /7m9QOlK9Tx4wThnjamLrvUJ8Rk2qagYWhqYgp+22XTuoMjb7mIMrCJ+0VidTbZhKmmg pk4ulVrJdxlLfhTtjbjrlXUA1GputSxEEBElc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192964; x=1785797764; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=o577EwGe+r5EVVD8sOs4TV9AMcYS4ezs/+Hanb2FAXM=; b=MGQy4q2GNAOLdhYEkRE1EovnMb3zRv00JGTCo4fP3KBBJ2US/np4/NkgVATjntCDYK IT78/C7Q/se6tdzobDf8InRbbAccKyPw2X3qNJqaasfFanU5tg4ZKtY59s7GeRFWWzKy 0JHk++LKy1ADIaN1HK/1nsH8izD3eVK9wejEfMEnyX0CrKgQzClamjewqTuJLcTLfQex uRHM7PU/4uIE4fEOVi/ZR6RcfN0BAU8d0WJ2eodebXwrhYGwZZGQqFmp5Kfokff+Qmg+ L0OHsXiN9jgTPrx+I5zSYroB0gWMB3G0R2DK43Ahm51ZmNxIZU2f4IiD1Gk9yxhBb4v/ yxjw== X-Gm-Message-State: AOJu0YyaRq3XHjriiG0VPDOflj45B6cAAos/gWGYCgCA6aNIdKG43hb3 5qhfqFZBCugoDIhiGvq/u4MdQbfWoBMmSlBpJZW/VZsa0Nn2XLnE9SXbPNZTP7CVkIwc0N0VeOD CG4OPq5I= X-Gm-Gg: AR+sD121cqI5vuo4qVK/1VTLR2wnWrMqfzsomL+mHxmBcR4fRN0o57d1ZovnC69AnD6 9NLI8Vq5aBw4wnPZ5HHVe4gd4HM96dlAP8kkmAwwbYNUb2qv2bgL9KbujiaYreTgPOUTMz+ksHE sVWhhFdzZ2NY/aaWSDkz/LASI5DRTt2Juo6lXixasofbC+49+EFnIZGgaKJaAUHlhjiJvYchB9a ok85W95rMYsaWHrY1kgmdKaXOiRAlMI/Dj6iW8x+/lcbcYrT5TjD7jEcZboCOZ5GqWRauSBPTq9 3Bg1xZTXLlqRrPHbQQlxEzQsW1inkXEO1l99PBzdYzlso4Y2st6VCUKX2H8IQAW+Mei4ifJ+Cm5 2FTPHnsklBd3f3RC7dUTl5d9OcO5/itgwRFZJ0X35ZrmoAyW64fhJomiHEJ20eA6uHUhKflo2gK S2JZcKOKHJhUsig1iIrGa8AAhLSWMMy94gGg2+pV/HmDwlr8Ul8/pfLa6P/oUs2wsgq0Ye+K307 c2V5A== X-Received: by 2002:a05:600c:3b19:b0:495:6022:5a23 with SMTP id 5b1f17b1804b1-496c5690ca5mr5107635e9.19.1785192964367; Mon, 27 Jul 2026 15:56:04 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:03 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 02/36] gawk: Fix CVE-2026-40467 Date: Tue, 28 Jul 2026 00:55:16 +0200 Message-ID: <842d8b7d53be67209bb78750d833e73bc6bb4e66.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242110 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-40467 Signed-off-by: Darsh Kelaiya Reviewed-by: Leonid Iziumtsev Signed-off-by: Yoann Congal --- .../gawk/gawk/CVE-2026-40467.patch | 62 +++++++++++++++++++ meta/recipes-extended/gawk/gawk_5.4.0.bb | 1 + 2 files changed, 63 insertions(+) create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2026-40467.patch diff --git a/meta/recipes-extended/gawk/gawk/CVE-2026-40467.patch b/meta/recipes-extended/gawk/gawk/CVE-2026-40467.patch new file mode 100644 index 00000000000..772172c3737 --- /dev/null +++ b/meta/recipes-extended/gawk/gawk/CVE-2026-40467.patch @@ -0,0 +1,62 @@ +From 194a2884f21a6fc02c446ca4e2dc9107298832db Mon Sep 17 00:00:00 2001 +From: "Arnold D. Robbins" +Date: Fri, 3 Apr 2026 12:02:11 +0300 +Subject: [PATCH] Small memory management fix in io.c. + +CVE: CVE-2026-40467 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8] + +(cherry picked from commit a2d18c74109e41bec29a23098eba2e00057286d8) +Signed-off-by: Darsh Kelaiya +--- + ChangeLog | 6 ++++++ + io.c | 5 ++++- + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/ChangeLog b/ChangeLog +index a714ca1a..517aba91 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,3 +1,9 @@ ++2026-04-03 Arnold D. Robbins ++ ++ * io.c (do_getline_redir): Don't DEREF redir_exp too early. ++ Thanks to Michał Majchrowicz ++ for the report. ++ + 2026-02-22 Arnold D. Robbins + + * 5.4.0: Release tar ball made. +diff --git a/io.c b/io.c +index a3b877c4..7a547aa1 100644 +--- a/io.c ++++ b/io.c +@@ -2853,21 +2853,24 @@ do_getline_redir(int into_variable, enum redirval redirtype) + redir_exp = TOP(); + redir_exp = elem_new_to_scalar(redir_exp); + rp = redirect(redir_exp, redirtype, & redir_error, false); +- DEREF(redir_exp); + decr_sp(); + if (rp == NULL) { + if (redir_error) { /* failed redirect */ + update_ERRNO_int(redir_error); + } ++ DEREF(redir_exp); + return make_number((AWKNUM) -1.0); + } else if ((rp->flag & RED_TWOWAY) != 0 && rp->iop == NULL) { + if (is_non_fatal_redirect(redir_exp->stptr, redir_exp->stlen)) { + update_ERRNO_int(EBADF); ++ DEREF(redir_exp); + return make_number((AWKNUM) -1.0); + } + (void) close_rp(rp, CLOSE_ALL); ++ DEREF(redir_exp); // we're about to die, but what the heck, release it anyway + fatal(_("getline: attempt to read from closed read end of two-way pipe")); + } ++ DEREF(redir_exp); + iop = rp->iop; + if (iop == NULL) /* end of input */ + return make_number((AWKNUM) 0.0); +-- +2.53.0 + diff --git a/meta/recipes-extended/gawk/gawk_5.4.0.bb b/meta/recipes-extended/gawk/gawk_5.4.0.bb index d7211f28f33..59c4cb2536f 100644 --- a/meta/recipes-extended/gawk/gawk_5.4.0.bb +++ b/meta/recipes-extended/gawk/gawk_5.4.0.bb @@ -28,6 +28,7 @@ PACKAGECONFIG[pma-if-64bit] = "--enable-pma,--disable-pma, " SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.xz \ file://run-ptest \ file://0001-configure.ac-re-enable-disabled-printf-features.patch \ + file://CVE-2026-40467.patch \ " SRC_URI[sha256sum] = "3dd430f0cd3b4428c6c3f6afc021b9cd3c1f8c93f7a688dc268ca428a90b4ac1" From patchwork Mon Jul 27 22:55:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93599 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1CA1C53209 for ; Mon, 27 Jul 2026 22:56:09 +0000 (UTC) Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43739.1785192968518108512 for ; Mon, 27 Jul 2026 15:56:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=pu5J/E1N; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-49548e01d02so16344315e9.0 for ; Mon, 27 Jul 2026 15:56:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192967; x=1785797767; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=+VIQUGKxLmB7Uxm+JH34x2NuEl4e1M+/5i8rRp6mlbo=; b=pu5J/E1NKUC3XL9GZi/VmM+9Esy4pFa9cQ2lb3jOlUxWkCANSN/7WVvMY8GfGSKXyf JatEY8QZkA5iXhluumKNLuu/UMgfh7cUkb2+dWJQzf6It4++H32nltoEEWmHM2Ir8ZxF k3MsNDLmLGTkmiimkO+y0fOhyKx3g8rn7ljco= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192967; x=1785797767; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=+VIQUGKxLmB7Uxm+JH34x2NuEl4e1M+/5i8rRp6mlbo=; b=Yyp8I40A276Cc5RrZAIqYiKQGorBgKzpzzvG2ZkUaDnwFqRb3JEjwU1ZNIep7MmzXw w5YYLaupTq0tZPbuaaA7rBO6PQBzxYXgupqP401qzwWC8WQhUf3hGLg2nVL63PkDJ/9I u8fq9W7TH91TUMhaR9yWkLuOqKbaM51jsHSnRbKOu7Y18Yg0VNJy/ubsha/fkbAgIukh TbICMyLRd7r2suy8R5X8ceEqkaYXL/nUyPKX6dnJpbbDSyw+JLbsSZvOKkeMfuN7rXys ++jFx5QEi3qkwp/txJDXdF8+IJ4YCHVzTMbhyApgW2m6fs4qfg2XCVZBlUlxa+jyyPIM SF+Q== X-Gm-Message-State: AOJu0YwqsF+VXuKkV1GW7mBXhy7ahGd8a3CnahkJy/s2BndkZOOGQqBa xiUL5g3DvU1OT/jGiCL/f8ckVOw3pcW0uEsNblL20Ho+L8OQkLgVeri0zOq3KQOjOrhQi83o8o+ Ma29z5MQ= X-Gm-Gg: AR+sD122GzIPLBIVXzwkL0iX9viQ2nKOu46rPZL+2l6y9U9M0KhK79k1Yuv/Ohf41kE OmLfBLg0GFOPXDAl57luLoX6/Ak4d3hJZRFXF9ES7fRMVVEoIlLhEdJW5zA0A9Vdb61xvqn6N/C 6KP98AkHJ1D8OnpZU1y0WJibxxJOiWHbOKoF3uDwciJVreYNBXrY7DahIcSQ2DnyhC+5C7PhLSy RcaXFE81ZLoEQ0Lcm0o4c8+dIhRe+kbKQgfMl66GAg70JJemt+4KrkhowA0asUIPe/DsQqmR4nr Br0CocXxT2Ky5+JKnFlyEouTqouurmWb3dbp2mKN6yUF/uARkiFie5iFugnwriJdD4sDvQ+dDeC 5J9SgBWR17xiEBe10o8Aqp74DvItLw9hUQsgPN67igh+0ZlB5UqJC+8Q6gp5em0u6YuR0+kqY/C wrVrbMYV7e3SBA+Mo2fmd30TWoye6Fv0xfhXexQIwawHhqIUzG6jkgsyY46sVssNZw6xuVnsO4T GmbiA== X-Received: by 2002:a05:600c:c4a3:b0:495:51b6:174f with SMTP id 5b1f17b1804b1-496b5747d82mr130846155e9.20.1785192966677; Mon, 27 Jul 2026 15:56:06 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:04 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 03/36] gawk: Fix CVE-2026-40468 Date: Tue, 28 Jul 2026 00:55:17 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242111 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-40468 Signed-off-by: Darsh Kelaiya Reviewed-by: Leonid Iziumtsev Signed-off-by: Yoann Congal --- .../gawk/gawk/CVE-2026-40468.patch | 61 +++++++++++++++++++ meta/recipes-extended/gawk/gawk_5.4.0.bb | 1 + 2 files changed, 62 insertions(+) create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2026-40468.patch diff --git a/meta/recipes-extended/gawk/gawk/CVE-2026-40468.patch b/meta/recipes-extended/gawk/gawk/CVE-2026-40468.patch new file mode 100644 index 00000000000..6b767c3bead --- /dev/null +++ b/meta/recipes-extended/gawk/gawk/CVE-2026-40468.patch @@ -0,0 +1,61 @@ +From 1e0b3ebeb4a39680dcd9c8eeadd8e3bf1c7c6200 Mon Sep 17 00:00:00 2001 +From: "Arnold D. Robbins" +Date: Sat, 4 Apr 2026 21:45:58 +0300 +Subject: [PATCH] Minor integer overflow fixes. + +CVE: CVE-2026-40468 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7] + +(cherry picked from commit 062f2f2581b991362c046f7f2e238ffa34e6f8c7) +Signed-off-by: Darsh Kelaiya +--- + ChangeLog | 8 ++++++++ + builtin.c | 2 +- + node.c | 2 +- + 3 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/ChangeLog b/ChangeLog +index 517aba91..8cdf90f6 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,3 +1,11 @@ ++2026-04-04 Arnold D. Robbins ++ ++ * builtin.c (do_sub): Make `sofar' be size_t to avoid ++ integer overflows. Thanks to Michał Majchrowicz ++ for the report. ++ * node.c (parse_escape): Change `i' to int64_t to avoid ++ overflows. Thanks to ASan with gcc -m32. ++ + 2026-04-03 Arnold D. Robbins + + * io.c (do_getline_redir): Don't DEREF redir_exp too early. +diff --git a/builtin.c b/builtin.c +index 6305b541..d0e083da 100644 +--- a/builtin.c ++++ b/builtin.c +@@ -1806,7 +1806,7 @@ do_sub(int nargs, unsigned int flags) + char *repl; + char *replend; + size_t repllen; +- int sofar; ++ size_t sofar; + int ampersands; + int matches = 0; + Regexp *rp; +diff --git a/node.c b/node.c +index 0e2bfb0f..f1e14dff 100644 +--- a/node.c ++++ b/node.c +@@ -584,7 +584,7 @@ parse_escape(const char **string_ptr, const char **result, size_t *nbytes) + static char buf[MB_LEN_MAX]; + enum escape_results retval = ESCAPE_OK; + int c = *(*string_ptr)++; +- long i; ++ int64_t i; + int count; + int j; + const char *start; +-- +2.53.0 + diff --git a/meta/recipes-extended/gawk/gawk_5.4.0.bb b/meta/recipes-extended/gawk/gawk_5.4.0.bb index 59c4cb2536f..345103a7f0a 100644 --- a/meta/recipes-extended/gawk/gawk_5.4.0.bb +++ b/meta/recipes-extended/gawk/gawk_5.4.0.bb @@ -29,6 +29,7 @@ SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.xz \ file://run-ptest \ file://0001-configure.ac-re-enable-disabled-printf-features.patch \ file://CVE-2026-40467.patch \ + file://CVE-2026-40468.patch \ " SRC_URI[sha256sum] = "3dd430f0cd3b4428c6c3f6afc021b9cd3c1f8c93f7a688dc268ca428a90b4ac1" From patchwork Mon Jul 27 22:55:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93604 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 845FEC54F50 for ; Mon, 27 Jul 2026 22:56:20 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43740.1785192970970965307 for ; Mon, 27 Jul 2026 15:56:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=yhr0OJ8e; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4956242332dso28391295e9.2 for ; Mon, 27 Jul 2026 15:56:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192969; x=1785797769; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=c2bAa9S4jF6WgQWgv64Eqb8Pcbg06N/yF1o+mUqDKQw=; b=yhr0OJ8epTemXDPfhkKSX7RkQiVoP9C7PDBms78/BWU30DFF3msg08sMyty3zgyMnb wcBiT77krmwMXJG0uT0/XfWxPi1s9rt87zUZrDao7lt5QFCfNQ/Zf00JH4XGEhdAMOIX LEZaaPSlOvqGFYzV2It9jiTFrZKfvwhzABnok= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192969; x=1785797769; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=c2bAa9S4jF6WgQWgv64Eqb8Pcbg06N/yF1o+mUqDKQw=; b=ID7fPRFanLS2Zzt9qM76Jxtnw4HUBxwt4ncv41dsWnCluC6Z+0Vkg7pJtKvpCtz1tP 2r15YXgCEuktHG9e3KDAUS1lMYt0F+GAZTzuUYxkMclFoPqXHQviYQM5+t/m/unx+ZB6 4Oibp6StPT4W+0CQGsajXSQAh//9lNoiTiwZxTVzLTXagVc7PWTIu/5eYyFWXyRiUU6S cbDzCCMvD5gACnbYsK/Zs6orFVseKaJq9IiG704VqwUqvCS6w+Y3uS27JXWjnWO2sFPO URwxbXmuouctQF/GYY2ZEFZqTx0pDd1B8RamUKnbcHonv32a+Nf+Q4+WYKwBGSRj9biC SMNQ== X-Gm-Message-State: AOJu0Yz3zF3PzebT637w0/hw8a4X41dllC3Lgpzgr885YH5QG4414tWN LQFIHLtZD5SS9BxzgG+xXNpp+2/TvwxiM0ZsB4/5rGEYO0OQXfZGTlIJmG2uhN9O7MD9zbzi4PP 5FmLobVQ= X-Gm-Gg: AR+sD11OP9EzSH0/fTpm2JVnLdsLz/gHSsvK0XWyT+yiVu5j/Nz8jq0toF1GVx+3Dn4 zvywH9Elb+RhdEHesx9LKFVjnkaTiJG4gwDnB1sk34L9jbulBX8FLXnCF4eaZ3DqTI3FFaXfJtq aQMmQ76N0WABs94/gdB33IxnCigB9R9IdBy/io63AkY5Z9T5VwTDkPErus8jxxxzkyYvQle4HFM bTDovjd76sbNGszNXi6q4fn2E/Ksi/qrhVn0SY8m5Sa5qz1VsnyAjgJ++3OiAiMtVW0/e2YjCQL MJS0sllh18FWKBz/PWd5bnR6F5kJqSWMh7oDlSo9BjisDVm1Do0rMZhNqpQe7DBebAPH4NE5uvP iS5sajtCUxfHJ/cgqh508byDJV0577emNcdxHLQyR+nMNOTOIKm3Nea0EJ8ZzfmsNGO8M2jzbbc hy0VQnq3HAXhRXi6juVRER79VE58vIzOI0i9QAn1/WLWCzaw+flD9TktcN6E6MEvYyuKZ9TcKTW /B4Hg== X-Received: by 2002:a05:600c:4eca:b0:493:c42e:5be0 with SMTP id 5b1f17b1804b1-496b563fd7emr137183435e9.0.1785192969059; Mon, 27 Jul 2026 15:56:09 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:07 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 04/36] gawk: Fix CVE-2026-40469 Date: Tue, 28 Jul 2026 00:55:18 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242112 From: Darsh Kelaiya NVD [3] identifies upstream merge commit [2] as the fix. The CVE-specific change is its second parent [1], which adds 32-bit overflow checking in do_sub(). [1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=aa7272a6e1184cdd21ab8f89200219abd8053eda [2] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=ae1b2d508f46913269a9e62aceda3636afe8147b [3] https://nvd.nist.gov/vuln/detail/CVE-2026-40469 Signed-off-by: Darsh Kelaiya Reviewed-by: Leonid Iziumtsev Signed-off-by: Yoann Congal --- .../gawk/gawk/CVE-2026-40469.patch | 90 +++++++++++++++++++ meta/recipes-extended/gawk/gawk_5.4.0.bb | 1 + 2 files changed, 91 insertions(+) create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2026-40469.patch diff --git a/meta/recipes-extended/gawk/gawk/CVE-2026-40469.patch b/meta/recipes-extended/gawk/gawk/CVE-2026-40469.patch new file mode 100644 index 00000000000..73cda824a73 --- /dev/null +++ b/meta/recipes-extended/gawk/gawk/CVE-2026-40469.patch @@ -0,0 +1,90 @@ +From 436584a4302b1c6da55080c0a0408a98e551ea7e Mon Sep 17 00:00:00 2001 +From: "Arnold D. Robbins" +Date: Mon, 6 Apr 2026 10:56:38 +0300 +Subject: [PATCH] Add overflow checking in do_sub for 32 bit systems. + +CVE: CVE-2026-40469 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=aa7272a6e1184cdd21ab8f89200219abd8053eda] + +(cherry picked from commit aa7272a6e1184cdd21ab8f89200219abd8053eda) +Signed-off-by: Darsh Kelaiya +--- + ChangeLog | 9 +++++++++ + builtin.c | 25 ++++++++++++++++++++----- + 2 files changed, 29 insertions(+), 5 deletions(-) + +diff --git a/ChangeLog b/ChangeLog +index 8cdf90f6..c1b2e7f4 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,3 +1,12 @@ ++2026-04-06 Arnold D. Robbins ++ ++ * builtin.c (do_sub): Check for overflow in calculation of size ++ of result buffer by doing the math in 64 bits. This provides ++ a fatal message on 32 bit systems if overflow happens instead ++ of letting dynamic memory get corrupted and likely causing ++ a core dump. Thanks to Michał Majchrowicz ++ for the report and fix. ++ + 2026-04-04 Arnold D. Robbins + + * builtin.c (do_sub): Make `sofar' be size_t to avoid +diff --git a/builtin.c b/builtin.c +index d0e083da..3906d507 100644 +--- a/builtin.c ++++ b/builtin.c +@@ -1820,11 +1820,13 @@ do_sub(int nargs, unsigned int flags) + bool lastmatchnonzero; + char *mb_indices = NULL; + int searchflags = RE_NEED_START; ++ const char *fname = NULL; // for fatal message, below + + if ((flags & GENSUB) != 0) { + double d; + NODE *glob_flag; + ++ fname = "gensub"; + check_exact_args(nargs, "gensub", 4); + + tmp = PEEK(3); +@@ -1856,11 +1858,9 @@ do_sub(int nargs, unsigned int flags) + DEREF(glob_flag); + searchflags |= RE_NEED_SUB; + } else { +- if ((flags & GSUB) != 0) { +- check_exact_args(nargs, "gsub", 3); +- } else { +- check_exact_args(nargs, "sub", 3); +- } ++ fname = ((flags & GSUB) != 0) ? "gsub" : "sub"; ++ ++ check_exact_args(nargs, fname, 3); + + /* take care of regexp early, in case re_update is fatal */ + +@@ -1976,6 +1976,21 @@ do_sub(int nargs, unsigned int flags) + * vary since ampersand is actual text of regexp match. + */ + ++ // 4/2026: This overflow check simply provides a fatal ++ // message instead of letting realloc() die later after ++ // a buffer overrun. It simply makes the user experience better, ++ // but does not prevent gawk from dying miserably. I suppose ++ // it's worth the trouble, but just barely. ++ ++ /* uint64_t so the product is 64-bit even on 32-bit ILP32 builds */ ++ uint64_t repl_contribution = ++ (uint64_t)(unsigned int)ampersands ++ * (uint64_t)(uintptr_t)(matchend - matchstart); ++ if (repl_contribution > (uint64_t)SIZE_MAX ++ || repl_contribution > (uint64_t)SIZE_MAX - (size_t)(matchend - text) ++ - repllen - 1) ++ fatal(_("%s: replacement expansion too large"), fname); ++ + /* + * add 1 to len to handle "empty" case where + * matchend == matchstart and we force a match on a single +-- +2.53.0 + diff --git a/meta/recipes-extended/gawk/gawk_5.4.0.bb b/meta/recipes-extended/gawk/gawk_5.4.0.bb index 345103a7f0a..a7c88224ddf 100644 --- a/meta/recipes-extended/gawk/gawk_5.4.0.bb +++ b/meta/recipes-extended/gawk/gawk_5.4.0.bb @@ -30,6 +30,7 @@ SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.xz \ file://0001-configure.ac-re-enable-disabled-printf-features.patch \ file://CVE-2026-40467.patch \ file://CVE-2026-40468.patch \ + file://CVE-2026-40469.patch \ " SRC_URI[sha256sum] = "3dd430f0cd3b4428c6c3f6afc021b9cd3c1f8c93f7a688dc268ca428a90b4ac1" From patchwork Mon Jul 27 22:55:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93605 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70B17C54F4E for ; Mon, 27 Jul 2026 22:56:20 +0000 (UTC) Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43741.1785192971993790467 for ; Mon, 27 Jul 2026 15:56:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=0ohtEn34; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-4955aa106b1so31573025e9.0 for ; Mon, 27 Jul 2026 15:56:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192970; x=1785797770; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=WU+B07CSF1iTe9Hjn1I9bj5jA82zfVESlvb7YrV5XmQ=; b=0ohtEn34/cm9BqrFbbDiNutiBiusdFVe1sBNSSCHn5PIJ35Q7AhqrLn3xVN0h6ANnZ YA8AyUdhjQRH+b82NMML0ZNf0VGZNUc2QJg64i6qQznuCyIpLOmQj85sLLU5zX3gYWQN PlZKDtRzMqFy1VgSzIImFPtdS53J3fngpsdT0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192970; x=1785797770; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=WU+B07CSF1iTe9Hjn1I9bj5jA82zfVESlvb7YrV5XmQ=; b=RHMtpSVjioIH4tJfmmM9CqY1VudKxIhC22Gc30EbZ8g+I0cUs+IheTw3g66FBB5Mi/ XL57KtZCJViAskQSO+MqQ1W7eATvSKqQxjPmaypqSz4X9BlVsZpmE+6IhjbJ24W07UlT DD7I+G+NO2u9+M46n0IeYuBDPwDVCjcjNeOb02dbBw+WixaZXXmmlyyd3ypQ3OjBQNs8 itdx4A2M47GmN+kxrYkKTjOQ1pG/y3slfwup8pX/KdsUilcoB/enBlRGZnsSwvZcPNPs oLWRUt1zEg07G6IioJRi1oWvTwwNCukdhzf6jmFBW0NPJp4OOiXEHp6xEpirJ8TWffxE RakA== X-Gm-Message-State: AOJu0Yzvrlp9Z9vAj8M3t3EawZQBp2U4Wc/Y8kN8G325/nNFQkNTWTQe d/4FFoGwtHmadtRvWjbmwbfHKS5IroyNQ8KKEQBTrniO1iKKmAr89DoRpUtvlNiGsMBcx87L8i/ +GWPApyo= X-Gm-Gg: AR+sD11YUJ6lp9vTZaoJwzZHAyLCHZc24p+PsSb1ZqZK4sUE9kqiMqsQsGdaLfLw79i SLf9Ix2AJ1sOO8ztCrc4aup0yXP3wlAlHN8eCzqG7kwQyn20QW9DInoCuVtSva2DTfjzG9zPHVC b7yG/mbvaMMcUNYY3ue/qaUkOfRk4hzbHz/W/4zQuEYVkffYnT1D3rplNkp0a/Kuk/DTlIX3j+S XIH0vKJjzq4P0T6066nHoWOQK+XaN/psqx292KcwH1c/+crWFhiQdOIZqEY7xuQ886QPfhKIkSa tZ+A6l5Pn7j9fsQLNafqnI0Uc+LbNgIlBtLZ/yy0hAWkFKHB3hlMcC+THXDIN4azIpixlaU8UFi wnUR33a3wCsmMeUfad/DmhjK1wMkzlRzPz+wPPYt8iN8J+LaeUXqge2gAvaPkJrOGpQKFWBVxm9 /5gSrb5T520/15WrYO/sm/jAA+vX4MYCzBxvxy+3pfj0xNUl6cEv/HOjSWb3yAExFWBaLRZQY7e 0eECg== X-Received: by 2002:a05:600c:4595:b0:495:3a21:4e5d with SMTP id 5b1f17b1804b1-496b56f461dmr126958915e9.0.1785192970118; Mon, 27 Jul 2026 15:56:10 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.09 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:09 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 05/36] gawk: Fix CVE-2026-40553 Date: Tue, 28 Jul 2026 00:55:19 +0200 Message-ID: <279260734a9809abb681e04c39e0acd276b3ae27.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242113 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [3], using the commit shown in [1]. It also applies the corrective follow-up [2], which fixes the snprintf() truncation boundary check. Both commits are included in gawk 5.4.1, identified as the fixed release in [4]. [1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=cca0366144336b49aaa7d5d949966ce8e2c70843 [2] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=bfa2e4b890a44100a99d26b54af385479528b12e [3] https://nvd.nist.gov/vuln/detail/CVE-2026-40553 [4] https://cert.pl/en/posts/2026/07/CVE-2026-40467/ Signed-off-by: Darsh Kelaiya Reviewed-by: Leonid Iziumtsev Signed-off-by: Yoann Congal --- .../gawk/gawk/CVE-2026-40553_p1.patch | 50 +++++++++++++++++++ .../gawk/gawk/CVE-2026-40553_p2.patch | 44 ++++++++++++++++ meta/recipes-extended/gawk/gawk_5.4.0.bb | 2 + 3 files changed, 96 insertions(+) create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2026-40553_p1.patch create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2026-40553_p2.patch diff --git a/meta/recipes-extended/gawk/gawk/CVE-2026-40553_p1.patch b/meta/recipes-extended/gawk/gawk/CVE-2026-40553_p1.patch new file mode 100644 index 00000000000..81e2efd6b96 --- /dev/null +++ b/meta/recipes-extended/gawk/gawk/CVE-2026-40553_p1.patch @@ -0,0 +1,50 @@ +From 6e7695c994aa45c0f7e9f8b80aa6f99717bbaf60 Mon Sep 17 00:00:00 2001 +From: "Arnold D. Robbins" +Date: Wed, 15 Apr 2026 09:39:02 +0300 +Subject: [PATCH] Avoid buffer overflow in extension/readdir.c. + +CVE: CVE-2026-40553 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=cca0366144336b49aaa7d5d949966ce8e2c70843] + +(cherry picked from commit cca0366144336b49aaa7d5d949966ce8e2c70843) +Signed-off-by: Darsh Kelaiya +--- + extension/ChangeLog | 6 ++++++ + extension/readdir.c | 6 +++++- + 2 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/extension/ChangeLog b/extension/ChangeLog +index b11e83ac..6f88eb19 100644 +--- a/extension/ChangeLog ++++ b/extension/ChangeLog +@@ -1,3 +1,9 @@ ++2026-04-15 Arnold D. Robbins ++ ++ * readdir.c (ftype): Use snprintf() to check for buffer ++ overflow in the file name before calling stat(). Thanks to ++ Marcin Wyczechowski for the report. ++ + 2026-02-22 Arnold D. Robbins + + * 5.4.0: Release tar ball made. +diff --git a/extension/readdir.c b/extension/readdir.c +index f876e168..5bbee261 100644 +--- a/extension/readdir.c ++++ b/extension/readdir.c +@@ -118,8 +118,12 @@ ftype(struct dirent *entry, const char *dirname) + #endif + char fname[PATH_MAX]; + struct stat sbuf; ++ int count; ++ ++ count = snprintf(fname, sizeof(fname), "%s/%s", dirname, entry->d_name); ++ if (count > sizeof(fname)) ++ return "u"; // buffer overflow. skip stat() call. + +- sprintf(fname, "%s/%s", dirname, entry->d_name); + if (stat(fname, &sbuf) == 0) { + if (S_ISBLK(sbuf.st_mode)) + return "b"; +-- +2.53.0 + diff --git a/meta/recipes-extended/gawk/gawk/CVE-2026-40553_p2.patch b/meta/recipes-extended/gawk/gawk/CVE-2026-40553_p2.patch new file mode 100644 index 00000000000..84bfdc54187 --- /dev/null +++ b/meta/recipes-extended/gawk/gawk/CVE-2026-40553_p2.patch @@ -0,0 +1,44 @@ +From a98440e83cb19b042958a179293bd637c400a35b Mon Sep 17 00:00:00 2001 +From: "Arnold D. Robbins" +Date: Fri, 17 Apr 2026 11:48:19 +0300 +Subject: [PATCH] Small fix in extension/readdir.c. + +CVE: CVE-2026-40553 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=bfa2e4b890a44100a99d26b54af385479528b12e] + +(cherry picked from commit bfa2e4b890a44100a99d26b54af385479528b12e) +Signed-off-by: Darsh Kelaiya +--- + extension/ChangeLog | 5 +++++ + extension/readdir.c | 2 +- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/extension/ChangeLog b/extension/ChangeLog +index 6f88eb19..9fe216e6 100644 +--- a/extension/ChangeLog ++++ b/extension/ChangeLog +@@ -1,3 +1,8 @@ ++2026-04-15 Arnold D. Robbins ++ ++ * readdir.c (ftype): Use >= in check of snprintf() return ++ value. Thanks to Andrew Schorr . ++ + 2026-04-15 Arnold D. Robbins + + * readdir.c (ftype): Use snprintf() to check for buffer +diff --git a/extension/readdir.c b/extension/readdir.c +index 5bbee261..3cb31834 100644 +--- a/extension/readdir.c ++++ b/extension/readdir.c +@@ -121,7 +121,7 @@ ftype(struct dirent *entry, const char *dirname) + int count; + + count = snprintf(fname, sizeof(fname), "%s/%s", dirname, entry->d_name); +- if (count > sizeof(fname)) ++ if (count >= sizeof(fname)) + return "u"; // buffer overflow. skip stat() call. + + if (stat(fname, &sbuf) == 0) { +-- +2.53.0 + diff --git a/meta/recipes-extended/gawk/gawk_5.4.0.bb b/meta/recipes-extended/gawk/gawk_5.4.0.bb index a7c88224ddf..f44d82b37c5 100644 --- a/meta/recipes-extended/gawk/gawk_5.4.0.bb +++ b/meta/recipes-extended/gawk/gawk_5.4.0.bb @@ -31,6 +31,8 @@ SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.xz \ file://CVE-2026-40467.patch \ file://CVE-2026-40468.patch \ file://CVE-2026-40469.patch \ + file://CVE-2026-40553_p1.patch \ + file://CVE-2026-40553_p2.patch \ " SRC_URI[sha256sum] = "3dd430f0cd3b4428c6c3f6afc021b9cd3c1f8c93f7a688dc268ca428a90b4ac1" From patchwork Mon Jul 27 22:55:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93607 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4AE8AC54F4D for ; Mon, 27 Jul 2026 22:56:20 +0000 (UTC) Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43743.1785192973511981681 for ; Mon, 27 Jul 2026 15:56:14 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=D34zzOcr; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-49545ba3d4eso18999935e9.3 for ; Mon, 27 Jul 2026 15:56:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192972; x=1785797772; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=6D33guunJNFPnG/tIlx7kAaBpn4ZNu6BW7nm62z9ZDk=; b=D34zzOcrkHEe1zg/FPBimj/KQ74j5uGrrv/ur1kJHgWBpanrTuwYANx2Vdytine0ut NI1Dr+9cKEgWa9beFnC6l+orJ38kvf6s8BeJktnsZeTlq6wyqDGpeeP8MEe0loYQcPui YH/2HUN15Ftl18dZQiwi+OBW2zGcMyO+ZiGp4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192972; x=1785797772; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=6D33guunJNFPnG/tIlx7kAaBpn4ZNu6BW7nm62z9ZDk=; b=oL4PEeZuezTAaiDP1EOCxKQqqnEp11gG57X4m1OXIRdX+Fxvl+0IoBr1pFfL72EnNf yOYpsKtCRzCSpOaS4Bf3RVAo4oDGjJmE9JY8pdiegcpn1EuPqr+d7ztn/3TY+KGh5X5o Qpga5v+rBGb8V09WiB8sQvzMrMSJqXVWVHCxcJai9GtcKvYLnO+78F4HHmUILEVffN3V 2XuSolmez0hgO9j2mXwcQCTU3Ax3r2C9NhQt/9ruZiLpQA4NlTD5QrVYl7cV1v+fPY11 aafdh8rqAkbX7pXmPa/nzWUGLORHoYsMZAcHBm+avEH0kSSfWWs9mC7p2f760BeNr4k6 /KiA== X-Gm-Message-State: AOJu0Yy3ldd/D2ssXEJHMd8KFHMqwi03AQL4fsR9k4WumVUYMF7AC7M8 iLsldFnnyd/71vpODcl6aLXDyhFrSiMXl7uU63ufGzgAJagfzAQ/HNHhcx6+aN/mkcknlk9uxDE yQUvFK4c= X-Gm-Gg: AR+sD13UdQ688FfKz5NfGvJBi3ebtT2r5uuUMryqSdy0qDTtL2pnL4D1eanIFTBTwoa sowOOSIDLAlmm/DIc/vmj89wVVRzZMuOMcG07gyFxbhRllHC6vihVQg3198V317TxG4ipHGVeTk sh5y/oOHmfHhgeKZUokIJV2chpJMI95Ax5X7Uxy8YwxkASiBPPUe6JPfyksnja7IYaq6M50JsQB sXzajoZ0o3gbpn9AwU/pLzgd6MU8jT6s7N6WkoMKqITeOHGVmYDYuACTXs6RTB/6c3bVZSRxLjl V2UFWt+DQOlxcjDSDHAMHJVCHpWMeWrrM/3pmEnWcgKkoYcxVhPk2TyhSqUSju+eKtdBwMC5x/a pbZ73IskOeiFYiSDEnXCgVH0Ltg9UUI7/WNGB/vQunWOKj9BcQKa3YhxD3gxGt9HQ5X+2gwkJ9t v3gv4Q1R5pVrKemgtc2ddcs7owqGAwLo+nOwi3IWyrIsIaHzjzwr02XaHrQ8dKt8w2L/gOjjHpD NyZmA== X-Received: by 2002:a05:600c:190a:b0:493:c10c:22f0 with SMTP id 5b1f17b1804b1-496c4fc22e0mr7481655e9.20.1785192970965; Mon, 27 Jul 2026 15:56:10 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:10 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 06/36] rsync: Fix CVE-2026-29518 Date: Tue, 28 Jul 2026 00:55:20 +0200 Message-ID: <67924a75174d5bda50656096066a71681ed00ddb.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242114 From: Ashishkumar Parmar This patch backports the upstream rsync v3.4.3 security fix train for CVE-2026-29518. The direct CVE fixes are [3] and [4]: - [3] enables secure_relative_open() for daemon modules running with "use chroot = no", closing the receiver-side basis-file TOCTOU. - [4] routes the sender read path through secure_relative_open() from the trusted module root, closing the matching sender-side TOCTOU. This patch also carries [1] and [2] from the same upstream v3.4.3 security/update train. These are supporting secure_relative_open() changes, not standalone direct CVE fixes: [1] uses Linux openat2(RESOLVE_BENEATH) to preserve the same confinement while allowing legitimate in-tree symlinks, fixing upstream issue #715; [2] adds the equivalent FreeBSD/macOS O_RESOLVE_BENEATH path. Debian's rsync 3.4.1+ds1-5+deb13u3 security update also carries these commits before the direct CVE-2026-29518 commits. The upstream fixed release is referenced in [5], and the public CVE record is referenced in [6]. Individual backported commit links are also recorded in the embedded patch headers. [1] https://github.com/RsyncProject/rsync/commit/4fa7156ccdb2ad34b034d18fe2fd6cd79adef8a1 [2] https://github.com/RsyncProject/rsync/commit/7f60ec001a0be63b770707ec8b829524c3809a43 [3] https://github.com/RsyncProject/rsync/commit/f1c24ab03bc85cb2638a569faa60216582fb6c5d [4] https://github.com/RsyncProject/rsync/commit/859d44fa4f1420775e4ba050337ef32092f2894c [5] https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 [6] https://www.cve.org/CVERecord?id=CVE-2026-29518 Signed-off-by: Ashishkumar Parmar Signed-off-by: Yoann Congal --- .../rsync/files/CVE-2026-29518_p1.patch | 392 ++++++++++++++++++ .../rsync/files/CVE-2026-29518_p2.patch | 98 +++++ .../rsync/files/CVE-2026-29518_p3.patch | 328 +++++++++++++++ .../rsync/files/CVE-2026-29518_p4.patch | 71 ++++ meta/recipes-devtools/rsync/rsync_3.4.1.bb | 4 + 5 files changed, 893 insertions(+) create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p3.patch create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p4.patch diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch new file mode 100644 index 00000000000..fcb7b777fe1 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch @@ -0,0 +1,392 @@ +From e7b575413b962ac042079a55530577b20c7eee44 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Thu, 30 Apr 2026 08:39:22 +1000 +Subject: [PATCH] syscall: use openat2(RESOLVE_BENEATH) on Linux for + secure_relative_open + +The CVE fix in commit c35e283 made secure_relative_open() walk every +component of relpath with O_NOFOLLOW. That blocks every symlink in the +path, which is stricter than the threat model required: legitimate +directory symlinks within the destination tree (e.g. when using -K / +--copy-dirlinks) are also rejected, breaking delta transfers with +"failed verification -- update discarded". See issue #715. + +On Linux 5.6+, openat2(RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS) gives +us exactly what we want: the kernel rejects any resolution that would +escape the starting directory (via "..", absolute paths, or symlinks +pointing outside dirfd) while still following symlinks that resolve +within it. /proc magic-links are blocked too. + +Use openat2 first; fall back to the existing per-component O_NOFOLLOW +walk on ENOSYS (kernel < 5.6). The lexical "../" checks at the head +of the function are kept as defense in depth. The Linux gate is +plain #ifdef __linux__: the runtime ENOSYS fallback covers the only +case that actually matters (header present + old kernel), and any +Linux build environment without linux/openat2.h will fail with a +clear "no such file" error rather than silently disabling the +protection. + +Verified manually that openat2(RESOLVE_BENEATH) blocks all four +escape patterns (absolute symlink, ../ symlink, lexical .., absolute +path) while allowing direct and within-tree symlinks. The new +testsuite/symlink-dirlink-basis.test (taken from PR #864 by Samuel +Henrique) exercises the issue #715 regression and passes; full +make check passes 47/47. + +Test: testsuite/symlink-dirlink-basis.test (8 scenarios) +Fixes: https://github.com/RsyncProject/rsync/issues/715 + +Co-Authored-By: Claude Opus 4.7 (1M context) + +CVE: CVE-2026-29518 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/4fa7156ccdb2ad34b034d18fe2fd6cd79adef8a1] + +(cherry picked from commit 4fa7156ccdb2ad34b034d18fe2fd6cd79adef8a1) +Signed-off-by: Ashishkumar Parmar +--- + syscall.c | 62 ++++++- + testsuite/symlink-dirlink-basis.test | 247 +++++++++++++++++++++++++++ + 2 files changed, 304 insertions(+), 5 deletions(-) + create mode 100755 testsuite/symlink-dirlink-basis.test + +diff --git a/syscall.c b/syscall.c +index 34a9bba0..d66c9fdd 100644 +--- a/syscall.c ++++ b/syscall.c +@@ -33,6 +33,11 @@ + #include + #endif + ++#ifdef __linux__ ++#include ++#include ++#endif ++ + #include "ifuncs.h" + + extern int dry_run; +@@ -715,12 +720,49 @@ int do_open_nofollow(const char *pathname, int flags) + /* + open a file relative to a base directory. The basedir can be NULL, + in which case the current working directory is used. The relpath +- must be a relative path, and the relpath must not contain any +- elements in the path which follow symlinks (ie. like O_NOFOLLOW, but +- applies to all path components, not just the last component) +- +- The relpath must also not contain any ../ elements in the path ++ must be a relative path. The kernel must guarantee that resolution ++ cannot escape basedir (or the cwd, when basedir is NULL): no ".." ++ jumps above the start, no symlinks pointing outside, no absolute ++ paths, no /proc magic-link tricks. ++ ++ Symlinks *within* basedir are followed normally — earlier rsync ++ versions rejected every symlink with O_NOFOLLOW on each component, ++ which broke legitimate directory symlinks on the receiver side ++ (https://github.com/RsyncProject/rsync/issues/715). The escape ++ prevention is handled by the kernel via openat2(RESOLVE_BENEATH) ++ on Linux 5.6+; older systems fall back to the per-component ++ O_NOFOLLOW walk below. ++ ++ The relpath must also not contain any ../ elements in the path. + */ ++ ++#ifdef __linux__ ++static int secure_relative_open_linux(const char *basedir, const char *relpath, int flags, mode_t mode) ++{ ++ struct open_how how; ++ int dirfd, retfd; ++ ++ memset(&how, 0, sizeof how); ++ how.flags = flags; ++ how.mode = mode; ++ how.resolve = RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS; ++ ++ if (basedir == NULL) { ++ dirfd = AT_FDCWD; ++ } else { ++ dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY); ++ if (dirfd == -1) ++ return -1; ++ } ++ ++ retfd = syscall(SYS_openat2, dirfd, relpath, &how, sizeof how); ++ ++ if (dirfd != AT_FDCWD) ++ close(dirfd); ++ return retfd; ++} ++#endif ++ + int secure_relative_open(const char *basedir, const char *relpath, int flags, mode_t mode) + { + if (!relpath || relpath[0] == '/') { +@@ -734,6 +776,16 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo + return -1; + } + ++#ifdef __linux__ ++ { ++ int fd = secure_relative_open_linux(basedir, relpath, flags, mode); ++ /* ENOSYS = kernel < 5.6 doesn't have the syscall even though ++ * glibc/kernel-headers do; fall through to the portable path. */ ++ if (fd != -1 || errno != ENOSYS) ++ return fd; ++ } ++#endif ++ + #if !defined(O_NOFOLLOW) || !defined(O_DIRECTORY) || !defined(AT_FDCWD) + // really old system, all we can do is live with the risks + if (!basedir) { +diff --git a/testsuite/symlink-dirlink-basis.test b/testsuite/symlink-dirlink-basis.test +new file mode 100755 +index 00000000..9065dd81 +--- /dev/null ++++ b/testsuite/symlink-dirlink-basis.test +@@ -0,0 +1,247 @@ ++#!/bin/sh ++ ++# Test that updating a file through a directory symlink works when using ++# -K (--copy-dirlinks). This is a regression test for: ++# https://github.com/RsyncProject/rsync/issues/715 ++# ++# The CVE fix in commit c35e283 introduced secure_relative_open() which ++# uses O_NOFOLLOW on all path components, breaking legitimate directory ++# symlinks on the receiver side. The fix splits the path into basedir ++# (dirname, symlinks followed) and basename (O_NOFOLLOW) so that ++# directory symlinks are traversed while the final file component is ++# still protected. ++# ++# The regression only manifests when delta matching is triggered (i.e., ++# the sender finds matching blocks in the old file). Small files with ++# completely different content are transferred in full and don't trigger ++# the bug. We use a large file with a small modification to ensure ++# delta transfer is used. ++# ++# In addition to the original regression, this test covers edge cases ++# in the fix itself: ++# - --backup with directory symlinks (finish_transfer pointer identity) ++# - --partial-dir with protocol < 29 (fnamecmp != partialptr guard) ++# - --inplace with directory symlinks (updating_basis_or_equiv check) ++# - Files without a dirname (top-level files, no split needed) ++ ++. "$suitedir/rsync.fns" ++ ++RSYNC_RSH="$scratchdir/src/support/lsh.sh" ++export RSYNC_RSH ++ ++# $HOME is set to $scratchdir by rsync.fns ++# localhost: destination will cd to $HOME (i.e., $scratchdir) ++ ++# Helper: create a large file suitable for delta transfers. ++# ~32KB is large enough for rsync's block matching to find matches. ++make_testfile() { ++ dd if=/dev/urandom of="$1" bs=1024 count=32 2>/dev/null \ ++ || test_fail "failed to create test file $1" ++} ++ ++# Set up source tree ++srcbase="$tmpdir/src" ++ ++###################################################################### ++# Test 1: Basic directory symlink update (the original issue #715) ++###################################################################### ++ ++mkdir -p "$HOME/real-dir" ++ln -s real-dir "$HOME/dir" ++ ++mkdir -p "$srcbase/dir" ++make_testfile "$srcbase/dir/file" ++ ++# First transfer (initial): should create the file through the symlink ++(cd "$srcbase" && $RSYNC -KRlptv --rsync-path="$RSYNC" dir/file localhost:) \ ++ || test_fail "test 1: initial transfer failed" ++ ++if [ ! -f "$HOME/real-dir/file" ]; then ++ test_fail "test 1: initial transfer did not create file through symlink" ++fi ++ ++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \ ++ || test_fail "test 1: initial transfer content mismatch" ++ ++# Small modification to trigger delta transfer ++echo "appended update" >> "$srcbase/dir/file" ++sleep 1 ++touch "$srcbase/dir/file" ++ ++# Second transfer (update): was failing with "failed verification" ++(cd "$srcbase" && $RSYNC -KRlptv --rsync-path="$RSYNC" dir/file localhost:) \ ++ || test_fail "test 1: update through directory symlink failed" ++ ++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \ ++ || test_fail "test 1: update transfer content mismatch" ++ ++###################################################################### ++# Test 2: Compression (-z) as in the original reproducer ++###################################################################### ++ ++echo "another line" >> "$srcbase/dir/file" ++sleep 1 ++touch "$srcbase/dir/file" ++ ++(cd "$srcbase" && $RSYNC -KRlptzv --rsync-path="$RSYNC" dir/file localhost:) \ ++ || test_fail "test 2: compressed update through directory symlink failed" ++ ++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \ ++ || test_fail "test 2: compressed update content mismatch" ++ ++###################################################################### ++# Test 3: Nested directory symlinks (nested/sub/data.txt where ++# "nested" is a symlink to "nested_real") ++###################################################################### ++ ++mkdir -p "$HOME/nested_real/sub" ++ln -s nested_real "$HOME/nested" ++ ++mkdir -p "$srcbase/nested/sub" ++make_testfile "$srcbase/nested/sub/data.txt" ++ ++(cd "$srcbase" && $RSYNC -KRlptv --rsync-path="$RSYNC" nested/sub/data.txt localhost:) \ ++ || test_fail "test 3: initial nested transfer failed" ++ ++echo "appended nested" >> "$srcbase/nested/sub/data.txt" ++sleep 1 ++touch "$srcbase/nested/sub/data.txt" ++ ++(cd "$srcbase" && $RSYNC -KRlptv --rsync-path="$RSYNC" nested/sub/data.txt localhost:) \ ++ || test_fail "test 3: update through nested directory symlink failed" ++ ++diff "$srcbase/nested/sub/data.txt" "$HOME/nested_real/sub/data.txt" >/dev/null \ ++ || test_fail "test 3: nested update content mismatch" ++ ++###################################################################### ++# Test 4: --backup with directory symlinks ++# ++# Exercises the finish_transfer() "fnamecmp == fname" pointer ++# comparison that determines whether to update fnamecmp to the ++# backup name. If broken, --backup would reference a renamed file ++# for xattr handling. ++###################################################################### ++ ++# Reset destination ++rm -f "$HOME/real-dir/file" "$HOME/real-dir/file~" ++ ++make_testfile "$srcbase/dir/file" ++ ++(cd "$srcbase" && $RSYNC -KRlptv --rsync-path="$RSYNC" dir/file localhost:) \ ++ || test_fail "test 4: initial transfer for backup test failed" ++ ++echo "backup update" >> "$srcbase/dir/file" ++sleep 1 ++touch "$srcbase/dir/file" ++ ++(cd "$srcbase" && $RSYNC -KRlptv --backup --rsync-path="$RSYNC" dir/file localhost:) \ ++ || test_fail "test 4: update with --backup through directory symlink failed" ++ ++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \ ++ || test_fail "test 4: backup update content mismatch" ++ ++if [ ! -f "$HOME/real-dir/file~" ]; then ++ test_fail "test 4: backup file was not created" ++fi ++ ++###################################################################### ++# Test 5: --inplace with directory symlinks ++# ++# Exercises the updating_basis_or_equiv check which uses ++# "fnamecmp == fname". With --inplace, rsync writes directly to ++# the destination file instead of a temp file. ++###################################################################### ++ ++rm -f "$HOME/real-dir/file" "$HOME/real-dir/file~" ++ ++make_testfile "$srcbase/dir/file" ++ ++(cd "$srcbase" && $RSYNC -KRlptv --inplace --rsync-path="$RSYNC" dir/file localhost:) \ ++ || test_fail "test 5: initial inplace transfer failed" ++ ++echo "inplace update" >> "$srcbase/dir/file" ++sleep 1 ++touch "$srcbase/dir/file" ++ ++(cd "$srcbase" && $RSYNC -KRlptv --inplace --rsync-path="$RSYNC" dir/file localhost:) \ ++ || test_fail "test 5: inplace update through directory symlink failed" ++ ++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \ ++ || test_fail "test 5: inplace update content mismatch" ++ ++###################################################################### ++# Test 6: Top-level file (no dirname, no split needed) ++# ++# Ensures the dirname/basename split is not attempted for files ++# at the top level (file->dirname is NULL). ++###################################################################### ++ ++make_testfile "$srcbase/topfile" ++mkdir -p "$HOME" ++ ++(cd "$srcbase" && $RSYNC -Rlptv --rsync-path="$RSYNC" topfile localhost:) \ ++ || test_fail "test 6: initial top-level transfer failed" ++ ++echo "toplevel update" >> "$srcbase/topfile" ++sleep 1 ++touch "$srcbase/topfile" ++ ++(cd "$srcbase" && $RSYNC -Rlptv --rsync-path="$RSYNC" topfile localhost:) \ ++ || test_fail "test 6: top-level update failed" ++ ++diff "$srcbase/topfile" "$HOME/topfile" >/dev/null \ ++ || test_fail "test 6: top-level update content mismatch" ++ ++###################################################################### ++# Test 7: --partial-dir with protocol < 29 ++# ++# For protocol < 29, fnamecmp_type stays FNAMECMP_FNAME even when ++# fnamecmp is set to partialptr. The dirname/basename split must ++# NOT trigger in this case (guarded by "fnamecmp == fname"). ++###################################################################### ++ ++rm -f "$HOME/real-dir/file" ++make_testfile "$srcbase/dir/file" ++ ++(cd "$srcbase" && $RSYNC -KRlptv --protocol=28 --partial-dir=.rsync-partial \ ++ --rsync-path="$RSYNC" dir/file localhost:) \ ++ || test_fail "test 7: initial proto28 partial-dir transfer failed" ++ ++echo "partial-dir update" >> "$srcbase/dir/file" ++sleep 1 ++touch "$srcbase/dir/file" ++ ++(cd "$srcbase" && $RSYNC -KRlptv --protocol=28 --partial-dir=.rsync-partial \ ++ --rsync-path="$RSYNC" dir/file localhost:) \ ++ || test_fail "test 7: proto28 partial-dir update through dirlink failed" ++ ++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \ ++ || test_fail "test 7: proto28 partial-dir update content mismatch" ++ ++###################################################################### ++# Test 8: Protocol < 29 basic directory symlink update ++# ++# Exercises the protocol < 29 code path and its fallback logic ++# (clearing basedir on retry). ++###################################################################### ++ ++rm -f "$HOME/real-dir/file" ++make_testfile "$srcbase/dir/file" ++ ++(cd "$srcbase" && $RSYNC -KRlptv --protocol=28 \ ++ --rsync-path="$RSYNC" dir/file localhost:) \ ++ || test_fail "test 8: initial proto28 transfer failed" ++ ++echo "proto28 update" >> "$srcbase/dir/file" ++sleep 1 ++touch "$srcbase/dir/file" ++ ++(cd "$srcbase" && $RSYNC -KRlptv --protocol=28 \ ++ --rsync-path="$RSYNC" dir/file localhost:) \ ++ || test_fail "test 8: proto28 update through directory symlink failed" ++ ++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \ ++ || test_fail "test 8: proto28 update content mismatch" ++ ++# The script would have aborted on error, so getting here means we've won. ++exit 0 diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch new file mode 100644 index 00000000000..661f23db765 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch @@ -0,0 +1,98 @@ +From 0675997f170b6463dd20306ee97e346e79196335 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Thu, 30 Apr 2026 08:44:11 +1000 +Subject: [PATCH] syscall: also use O_RESOLVE_BENEATH on FreeBSD and MacOS + +FreeBSD and MacOS have O_RESOLVE_BENEATH as an openat() flag with the same +"must not escape dirfd" semantics as Linux's RESOLVE_BENEATH. The +kernel rejects ".." escapes, absolute symlinks, and symlinks whose +target lies outside dirfd, while still following symlinks that +resolve within it -- the same trade-off that fixes issue #715 on +Linux. + +Add a parallel BSD path in secure_relative_open(), gated on +declared. Unlike Linux, BSD doesn't have the header/runtime split +where the symbol can exist without kernel support, so no runtime +fallback is needed: if the flag compiles in, the kernel honours it. + +OpenBSD and NetBSD have no equivalent kernel primitive and continue +to use the existing per-component O_NOFOLLOW walk; issue #715 +remains visible on those platforms (a userland resolver or +unveil(2)-based fence would be follow-up work). + +Co-Authored-By: Claude Opus 4.7 (1M context) + +CVE: CVE-2026-29518 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/7f60ec001a0be63b770707ec8b829524c3809a43] + +(cherry picked from commit 7f60ec001a0be63b770707ec8b829524c3809a43) +Signed-off-by: Ashishkumar Parmar +--- + syscall.c | 40 +++++++++++++++++++++++++++++++++++++--- + 1 file changed, 37 insertions(+), 3 deletions(-) + +diff --git a/syscall.c b/syscall.c +index d66c9fdd..9033196f 100644 +--- a/syscall.c ++++ b/syscall.c +@@ -729,9 +729,13 @@ int do_open_nofollow(const char *pathname, int flags) + versions rejected every symlink with O_NOFOLLOW on each component, + which broke legitimate directory symlinks on the receiver side + (https://github.com/RsyncProject/rsync/issues/715). The escape +- prevention is handled by the kernel via openat2(RESOLVE_BENEATH) +- on Linux 5.6+; older systems fall back to the per-component +- O_NOFOLLOW walk below. ++ prevention is handled by: ++ Linux 5.6+: openat2(RESOLVE_BENEATH) ++ FreeBSD 13+: openat() with O_RESOLVE_BENEATH ++ macOS 15+ / iOS 18+: openat() with O_RESOLVE_BENEATH (same ++ flag name, picked up by the same #ifdef; ++ flag value differs from FreeBSD) ++ Other systems fall back to the per-component O_NOFOLLOW walk below. + + The relpath must also not contain any ../ elements in the path. + */ +@@ -763,6 +767,32 @@ static int secure_relative_open_linux(const char *basedir, const char *relpath, + } + #endif + ++#ifdef O_RESOLVE_BENEATH ++/* FreeBSD 13+ and macOS 15+ (Sequoia) / iOS 18+: O_RESOLVE_BENEATH is ++ * an openat() flag with the same "must not escape dirfd" semantics as ++ * Linux's RESOLVE_BENEATH. The kernel rejects ".." escapes, absolute ++ * symlinks, and symlinks whose target lies outside dirfd. (FreeBSD and ++ * Apple use different flag bit values, but the same symbolic name.) */ ++static int secure_relative_open_resolve_beneath(const char *basedir, const char *relpath, int flags, mode_t mode) ++{ ++ int dirfd, retfd; ++ ++ if (basedir == NULL) { ++ dirfd = AT_FDCWD; ++ } else { ++ dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY); ++ if (dirfd == -1) ++ return -1; ++ } ++ ++ retfd = openat(dirfd, relpath, flags | O_RESOLVE_BENEATH, mode); ++ ++ if (dirfd != AT_FDCWD) ++ close(dirfd); ++ return retfd; ++} ++#endif ++ + int secure_relative_open(const char *basedir, const char *relpath, int flags, mode_t mode) + { + if (!relpath || relpath[0] == '/') { +@@ -786,6 +816,10 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo + } + #endif + ++#ifdef O_RESOLVE_BENEATH ++ return secure_relative_open_resolve_beneath(basedir, relpath, flags, mode); ++#endif ++ + #if !defined(O_NOFOLLOW) || !defined(O_DIRECTORY) || !defined(AT_FDCWD) + // really old system, all we can do is live with the risks + if (!basedir) { diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-29518_p3.patch b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p3.patch new file mode 100644 index 00000000000..9c138b5437e --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p3.patch @@ -0,0 +1,328 @@ +From edfd5b913c9afdb0f340cf8135544399206f6e62 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Wed, 31 Dec 2025 10:01:23 +1100 +Subject: [PATCH] syscall+clientserver: am_chrooted and use_secure_symlinks for + daemon-no-chroot (CVE-2026-29518) + +CVE-2026-29518: an rsync daemon configured with "use chroot = no" +is exposed to a TOCTOU race on parent path components. A local +attacker with write access to a module can replace a parent +directory component with a symlink between the receiver's check +and its open(), redirecting reads (basis-file disclosure) and +writes (file overwrite) outside the module. Under elevated daemon +privilege this allows privilege escalation. Default +"use chroot = yes" is not exposed. + +Add secure_relative_open() in syscall.c. It walks the parent +components under RESOLVE_BENEATH (Linux 5.6+) / +O_RESOLVE_BENEATH (FreeBSD 13+, macOS 15+) / per-component +O_NOFOLLOW elsewhere, anchored at a trusted dirfd, so a parent- +symlink swap is rejected by the kernel. Route the receiver's +basis-file open in receiver.c through it when use_secure_symlinks +is set in clientserver.c rsync_module(). + +Reporters: Nullx3D (Batuhan SANCAK); Damien Neil; Michael Stapelberg. + +Co-Authored-By: Claude Opus 4.7 (1M context) + +CVE: CVE-2026-29518 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/f1c24ab03bc85cb2638a569faa60216582fb6c5d] + +(cherry picked from commit f1c24ab03bc85cb2638a569faa60216582fb6c5d) +Signed-off-by: Ashishkumar Parmar +--- + clientserver.c | 25 +++++++++ + options.c | 9 ++++ + receiver.c | 22 ++++++-- + syscall.c | 139 +++++++++++++++++++++++++++++++++++++++++++++++++ + 4 files changed, 192 insertions(+), 3 deletions(-) + +diff --git a/clientserver.c b/clientserver.c +index 7c897abc..b6eba098 100644 +--- a/clientserver.c ++++ b/clientserver.c +@@ -30,6 +30,7 @@ extern int list_only; + extern int am_sender; + extern int am_server; + extern int am_daemon; ++extern int am_chrooted; + extern int am_root; + extern int msgs2stderr; + extern int rsync_port; +@@ -38,6 +39,7 @@ extern int ignore_errors; + extern int preserve_xattrs; + extern int kluge_around_eof; + extern int munge_symlinks; ++extern int use_secure_symlinks; + extern int open_noatime; + extern int sanitize_paths; + extern int numeric_ids; +@@ -981,6 +983,7 @@ static int rsync_module(int f_in, int f_out, int i, const char *addr, const char + io_printf(f_out, "@ERROR: chroot failed\n"); + return -1; + } ++ am_chrooted = 1; + module_chdir = module_dir; + } + +@@ -1003,6 +1006,15 @@ static int rsync_module(int f_in, int f_out, int i, const char *addr, const char + } + } + ++ /* Enable secure symlink handling for any non-chrooted daemon module. ++ * This prevents TOCTOU race attacks where an attacker could switch a ++ * directory to a symlink between path validation and file open. ++ * Match the gate used by the do_*_at() wrappers in syscall.c ++ * (am_daemon && !am_chrooted) -- the protection has nothing to do ++ * with symlink munging, so a module configured with ++ * "munge symlinks = false" must still get the secure-open path. */ ++ use_secure_symlinks = am_daemon && !am_chrooted; ++ + if (gid_list.count) { + gid_t *gid_array = gid_list.items; + if (setgid(gid_array[0])) { +@@ -1305,6 +1317,19 @@ int start_daemon(int f_in, int f_out) + rsyserr(FLOG, errno, "daemon chroot(\"%s\") failed", p); + return -1; + } ++ /* Deliberately do NOT set am_chrooted here. am_chrooted ++ * gates the per-module symlink-race defenses ++ * (secure_relative_open() and the do_*_at() wrappers in ++ * syscall.c) and means "the kernel is enforcing path ++ * confinement at the module boundary". The daemon chroot ++ * confines path resolution to the daemon-chroot directory, ++ * not to any individual module path -- modules sharing the ++ * daemon chroot are still distinguishable filesystem ++ * subtrees and a sender-controlled symlink in module A ++ * could redirect a syscall to module B (or to other files ++ * inside the daemon chroot) without the per-module ++ * defenses. Leave am_chrooted=0 here so secure_relative_open() ++ * still fires for "use chroot = no" modules. */ + if (chdir("/") < 0) { + rsyserr(FLOG, errno, "daemon chdir(\"/\") failed"); + return -1; +diff --git a/options.c b/options.c +index 578507c6..87c91376 100644 +--- a/options.c ++++ b/options.c +@@ -113,11 +113,20 @@ int mkpath_dest_arg = 0; + int allow_inc_recurse = 1; + int xfer_dirs = -1; + int am_daemon = 0; ++/* Set after a successful per-module chroot ("use chroot = yes") in ++ * clientserver.c. NOT set for the daemon-level "daemon chroot = /X" ++ * chroot: that confines path resolution to /X, but module paths ++ * /X/modA, /X/modB, etc. are not chroot boundaries, so the per-module ++ * symlink-race defenses (secure_relative_open() / do_*_at() in ++ * syscall.c, gated by `am_daemon && !am_chrooted`) must still fire ++ * even when the daemon is inside a daemon chroot. */ ++int am_chrooted = 0; + int connect_timeout = 0; + int keep_partial = 0; + int safe_symlinks = 0; + int copy_unsafe_links = 0; + int munge_symlinks = 0; ++int use_secure_symlinks = 0; + int size_only = 0; + int daemon_bwlimit = 0; + int bwlimit = 0; +diff --git a/receiver.c b/receiver.c +index edfbb210..5a2c8c5a 100644 +--- a/receiver.c ++++ b/receiver.c +@@ -70,6 +70,7 @@ extern int fuzzy_basis; + + extern struct name_num_item *xfer_sum_nni; + extern int xfer_sum_len; ++extern int use_secure_symlinks; + + static struct bitbag *delayed_bits = NULL; + static int phase = 0, redoing = 0; +@@ -214,7 +215,12 @@ int open_tmpfile(char *fnametmp, const char *fname, struct file_struct *file) + * access to ensure that there is no race condition. They will be + * correctly updated after the right owner and group info is set. + * (Thanks to snabb@epipe.fi for pointing this out.) */ +- fd = do_mkstemp(fnametmp, (file->mode|added_perms) & INITACCESSPERMS); ++ /* When use_secure_symlinks is on (non-chroot daemon with munge_symlinks), ++ * use secure_mkstemp to prevent symlink race attacks on parent directories. */ ++ if (use_secure_symlinks) ++ fd = secure_mkstemp(fnametmp, (file->mode|added_perms) & INITACCESSPERMS); ++ else ++ fd = do_mkstemp(fnametmp, (file->mode|added_perms) & INITACCESSPERMS); + + #if 0 + /* In most cases parent directories will already exist because their +@@ -854,11 +860,21 @@ int recv_files(int f_in, int f_out, char *local_name) + /* We now check to see if we are writing the file "inplace" */ + if (inplace || one_inplace) { + fnametmp = one_inplace ? partialptr : fname; +- fd2 = do_open(fnametmp, O_WRONLY|O_CREAT, 0600); ++ /* When use_secure_symlinks is on (non-chroot daemon), ++ * use secure open to prevent symlink race attacks where an ++ * attacker could switch a directory to a symlink between ++ * path validation and file open. */ ++ if (use_secure_symlinks) ++ fd2 = secure_relative_open(NULL, fnametmp, O_WRONLY|O_CREAT, 0600); ++ else ++ fd2 = do_open(fnametmp, O_WRONLY|O_CREAT, 0600); + #ifdef linux + if (fd2 == -1 && errno == EACCES) { + /* Maybe the error was due to protected_regular setting? */ +- fd2 = do_open(fname, O_WRONLY, 0600); ++ if (use_secure_symlinks) ++ fd2 = secure_relative_open(NULL, fname, O_WRONLY, 0600); ++ else ++ fd2 = do_open(fname, O_WRONLY, 0600); + } + #endif + if (fd2 == -1) { +diff --git a/syscall.c b/syscall.c +index 9033196f..dcecda1a 100644 +--- a/syscall.c ++++ b/syscall.c +@@ -877,6 +877,145 @@ cleanup: + #endif // O_NOFOLLOW, O_DIRECTORY + } + ++/* Fill buf with len random bytes. Prefers /dev/urandom for cryptographic ++ * quality; falls back to rand() if /dev/urandom cannot be opened or read ++ * (e.g. inside a chroot or container without /dev populated). */ ++static void rand_bytes(unsigned char *buf, size_t len) ++{ ++#ifndef O_CLOEXEC ++#define O_CLOEXEC 0 ++#endif ++ int fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC); ++ if (fd >= 0) { ++ ssize_t n = read(fd, buf, len); ++ close(fd); ++ if (n == (ssize_t)len) { ++ return; ++ } ++ } ++ for (size_t i = 0; i < len; i++) { ++ buf[i] = (unsigned char)rand(); ++ } ++} ++ ++/* ++ Secure version of mkstemp that prevents symlink attacks on parent directories. ++ Like secure_relative_open(), this walks the path checking each component ++ with O_NOFOLLOW to prevent TOCTOU race conditions. ++ ++ The template may be relative or absolute, but must not contain ../ components. ++ Returns fd on success, -1 on error. ++*/ ++int secure_mkstemp(char *template, mode_t perms) ++{ ++#if !defined(O_NOFOLLOW) || !defined(O_DIRECTORY) || !defined(AT_FDCWD) ++ /* Fall back to regular mkstemp on old systems */ ++ return do_mkstemp(template, perms); ++#else ++ char *lastslash; ++ int dirfd = AT_FDCWD; ++ int fd = -1; ++ ++ if (!template) { ++ errno = EINVAL; ++ return -1; ++ } ++ if (strncmp(template, "../", 3) == 0 || strstr(template, "/../")) { ++ errno = EINVAL; ++ return -1; ++ } ++ ++ /* For absolute paths, start the secure walk from "/" rather than CWD. */ ++ if (template[0] == '/') { ++ dirfd = open("/", O_RDONLY | O_DIRECTORY | O_NOFOLLOW); ++ if (dirfd < 0) ++ return -1; ++ } ++ ++ /* Find the last slash to separate directory from filename */ ++ lastslash = strrchr(template, '/'); ++ if (lastslash) { ++ char *path_copy = my_strdup(template, __FILE__, __LINE__); ++ if (!path_copy) ++ return -1; ++ ++ /* Null-terminate at the last slash to get directory part */ ++ path_copy[lastslash - template] = '\0'; ++ ++ /* Walk the directory path securely */ ++ for (const char *part = strtok(path_copy, "/"); ++ part != NULL; ++ part = strtok(NULL, "/")) ++ { ++ int next_fd = openat(dirfd, part, O_RDONLY | O_DIRECTORY | O_NOFOLLOW); ++ if (next_fd == -1) { ++ int save_errno = errno; ++ free(path_copy); ++ if (dirfd != AT_FDCWD) close(dirfd); ++ errno = (save_errno == ELOOP) ? ELOOP : save_errno; ++ return -1; ++ } ++ if (dirfd != AT_FDCWD) close(dirfd); ++ dirfd = next_fd; ++ } ++ free(path_copy); ++ } ++ ++ /* Now create the temp file in the securely-opened directory */ ++ perms |= S_IWUSR; ++ ++ /* Generate unique filename - we need to modify the template in place */ ++ char *filename = lastslash ? lastslash + 1 : template; ++ size_t filename_len = strlen(filename); ++ ++ if (filename_len < 6) { ++ if (dirfd != AT_FDCWD) close(dirfd); ++ errno = EINVAL; ++ return -1; ++ } ++ char *suffix = filename + filename_len - 6; /* Points to XXXXXX */ ++ if (strcmp(suffix, "XXXXXX") != 0) { ++ if (dirfd != AT_FDCWD) close(dirfd); ++ errno = EINVAL; ++ return -1; ++ } ++ ++ /* Try random suffixes until we find one that works */ ++ static const char letters[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; ++ for (int tries = 0; tries < 100; tries++) { ++ unsigned char rbytes[6]; ++ rand_bytes(rbytes, sizeof(rbytes)); ++ for (int i = 0; i < 6; i++) ++ suffix[i] = letters[rbytes[i] % (sizeof(letters) - 1)]; ++ ++ fd = openat(dirfd, filename, O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW, perms); ++ if (fd >= 0) ++ break; ++ if (errno != EEXIST) { ++ if (dirfd != AT_FDCWD) close(dirfd); ++ return -1; ++ } ++ } ++ ++ if (fd >= 0) { ++ if (fchmod(fd, perms) != 0 && preserve_perms) { ++ int errno_save = errno; ++ close(fd); ++ unlinkat(dirfd, filename, 0); ++ if (dirfd != AT_FDCWD) close(dirfd); ++ errno = errno_save; ++ return -1; ++ } ++#if defined HAVE_SETMODE && O_BINARY ++ setmode(fd, O_BINARY); ++#endif ++ } ++ ++ if (dirfd != AT_FDCWD) close(dirfd); ++ return fd; ++#endif ++} ++ + /* + varient of do_open/do_open_nofollow which does do_open() if the + copy_links or copy_unsafe_links options are set and does diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-29518_p4.patch b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p4.patch new file mode 100644 index 00000000000..ba9ef808b4e --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p4.patch @@ -0,0 +1,71 @@ +From 302e3116633ed953e0c1cc2d6878d7a22b6bf9b8 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Sun, 1 Mar 2026 09:28:40 +1100 +Subject: [PATCH] sender: fix read-path TOCTOU by opening from module root + (CVE-2026-29518) + +The sender's file open was vulnerable to the same TOCTOU symlink +race as the receiver-side basis-file open. change_pathname() calls +chdir() into subdirectories, which follows symlinks; an attacker +could race to swap a directory for a symlink between the chdir and +the file open, allowing reads of privileged files through the +daemon. + +Reconstruct the full relative path (F_PATHNAME + fname) and open +via secure_relative_open() from the trusted module_dir, which +walks each path component without following symlinks. This is +independent of CWD, so the chdir race is neutralised. + +CVE-2026-29518. + +Co-Authored-By: Claude Opus 4.6 + +CVE: CVE-2026-29518 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/859d44fa4f1420775e4ba050337ef32092f2894c] + +(cherry picked from commit 859d44fa4f1420775e4ba050337ef32092f2894c) +Signed-off-by: Ashishkumar Parmar +--- + sender.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/sender.c b/sender.c +index b1588b70..99f431fe 100644 +--- a/sender.c ++++ b/sender.c +@@ -48,6 +48,8 @@ extern int make_backups; + extern int inplace; + extern int inplace_partial; + extern int batch_fd; ++extern int use_secure_symlinks; ++extern char *module_dir; + extern int write_batch; + extern int file_old_total; + extern BOOL want_progress_now; +@@ -352,7 +354,25 @@ void send_files(int f_in, int f_out) + exit_cleanup(RERR_PROTOCOL); + } + +- fd = do_open_checklinks(fname); ++ if (use_secure_symlinks) { ++ /* Open from module root to prevent TOCTOU race where ++ * change_pathname's chdir follows a directory symlink. ++ * Reconstruct the full path relative to module_dir ++ * from F_PATHNAME (path) and f_name (fname). */ ++ char secure_path[MAXPATHLEN]; ++ int slen = snprintf(secure_path, sizeof secure_path, "%s%s%s", path, slash, fname); ++ if (slen >= (int)sizeof secure_path) { ++ io_error |= IOERR_GENERAL; ++ rprintf(FERROR_XFER, "path too long: %s%s%s\n", path, slash, fname); ++ free_sums(s); ++ if (protocol_version >= 30) ++ send_msg_int(MSG_NO_SEND, ndx); ++ continue; ++ } ++ fd = secure_relative_open(module_dir, secure_path, O_RDONLY, 0); ++ } else { ++ fd = do_open_checklinks(fname); ++ } + if (fd == -1) { + if (errno == ENOENT) { + enum logcode c = am_daemon && protocol_version < 28 ? FERROR : FWARNING; diff --git a/meta/recipes-devtools/rsync/rsync_3.4.1.bb b/meta/recipes-devtools/rsync/rsync_3.4.1.bb index 509be486b87..e2fe0128d53 100644 --- a/meta/recipes-devtools/rsync/rsync_3.4.1.bb +++ b/meta/recipes-devtools/rsync/rsync_3.4.1.bb @@ -16,6 +16,10 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \ file://determism.patch \ file://0001-Add-missing-prototypes-to-function-declarations.patch \ file://CVE-2025-10158.patch \ + file://CVE-2026-29518_p1.patch \ + file://CVE-2026-29518_p2.patch \ + file://CVE-2026-29518_p3.patch \ + file://CVE-2026-29518_p4.patch \ " SRC_URI[sha256sum] = "2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52" From patchwork Mon Jul 27 22:55:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93614 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F962C5321C for ; Mon, 27 Jul 2026 22:56:20 +0000 (UTC) Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43794.1785192976755324984 for ; Mon, 27 Jul 2026 15:56:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=JEmQ4MlZ; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-4954f5e8020so15636355e9.2 for ; Mon, 27 Jul 2026 15:56:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192975; x=1785797775; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=TdOpu0mGNqvVJt4o+2sU+3PdAPPG/V1hUSNi04CE4o8=; b=JEmQ4MlZuRoyKGgqm0o+EvYQtIofWGEHF2tyNqt/GNfe50FDwmivCAUQtgwyTwm5oZ aa4rl8UiuXuDzuLduLaDr2Mw2Dk40Cu0hukWOmQ8s4jBPTkKq8D0lh+v4rLJCizCrwd2 1XUvQU3i1MP1RN6S4Lqk6/NAXN32vVUiAkvgc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192975; x=1785797775; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=TdOpu0mGNqvVJt4o+2sU+3PdAPPG/V1hUSNi04CE4o8=; b=fbKn7fQJ5Ss5/ZV0ShbeGg8/CTLULBrhTyDZFArGBRKOleUZOF8eajgeFTomCSPmey FiMWy+DaryeN6PKAQyu8jaBWaaoi/s9IYLkQg0pNFcxsbWZK7jdG3PS1d+iCZHmxLueo R73wKn+96Sp5n1UKMB1k1OGEDRkhyH0Z7tUQS597vgNep3koLYn85tiuYZHUPf32ujHW jp6xaBJTkU3YAM62bWfROhTtkaAZWzRc1mP2F1QLE/ctZxdLTk1b9KBRN51VRFCL6i5D Xk0kGvsIAXbRhSrC8wkkfcB9lQAM/sWoYQhiGgUAf/v5jWARXyqCuEN/ck3Q3hXSonu2 z1eQ== X-Gm-Message-State: AOJu0YynNkyMWCbVyDZUGpOTtZABwrI0kRgGasjkBiIZuS8yYwUXBdcV afRaI/x8ieUcqBEYbVpz5XQjQU2v1hbhjRpeq87yuv6aBiErmyq5LyYmNbqOwi0PFAhjRVDPpAd kwYuCnzI= X-Gm-Gg: AR+sD11/y6O+JWYR3fSoElk2ArvVolIP1lmiamP8FhtQDiWH9ar10WNDEj0kVV0K+7L xaVmA5/t4v/SBY5c4goI/HrpW+ZgkB5LnQ1rLMLcLjWQkBaZZYQ6EUZZS7HlHTRMOvZHsgg6RTf Fv2QIfJl2G8+SdpPvXlEYDcc+zzQhjw8ys9q3v5T5EgwNdV2bTmyS0Y4j4hlUOJ97+WEGxhiIRA jrXwMoKTlH7mB855+0Vq6NP+7loLlfd7hW5pDG+p6pUfk4Ig1KMXBPtYiVW0NtDmxFtG/AmwmIS StlMwHxJKuCNvt86wglnfgopPy331EmZqxFfYCJeUg41VFBCZRdODpGYoM0BIAkI0PgDqrrstZO vs5JZnFFuLXFY/D8Cl9bfYr7p20OP+7bg+wycF6/1icTxaq4dL9jCdDtBV9VoltqqJktGbDEMYB 6fZmKJFIE1hIJaIPcPUEsS06JgnX8bUl9xSa1DlvN9r2uq7wwNz8BP0SPZa/kpCMW6cv9fp3Gjm Co1RA== X-Received: by 2002:a05:600c:a016:b0:495:63e6:5fb8 with SMTP id 5b1f17b1804b1-496b56fa3c4mr126520565e9.12.1785192972410; Mon, 27 Jul 2026 15:56:12 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:11 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 07/36] rsync: Fix CVE-2026-43619 Date: Tue, 28 Jul 2026 00:55:21 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242116 From: Ashishkumar Parmar This patch backports the upstream rsync v3.4.3 symlink-race fix chain for CVE-2026-43619. The upstream NEWS entry describes this CVE as symlink races on path-based system calls in "use chroot = no" daemon mode, generalizing CVE-2026-29518 beyond the receiver's open() path. The backported commits form the following linear upstream chain: - [1] closes the receiver-side do_chmod() path. - [2] closes the daemon-no-chroot change_dir() escape. - [3] adds the remaining symlink-race-safe do_*_at() wrappers and migrates the affected path-based syscall users. - [4] closes adjacent bare-path copy/open surfaces. Upstream titles this commit "defence-in-depth", but it is in the same linear v3.4.3 symlink-race fix chain and Debian's rsync 3.4.1+ds1-5+deb13u3 security update carries it as part of the CVE-2026-43619 patch train. The v3.4.3 security train also has portability and functional follow-ups that were released in v3.4.4, so this CVE-scoped backport includes them under CVE-2026-43619: - [5] adds the mknodat()/mkfifoat() configure fallback used by the new do_mknod_at() path. - [6] gates and openat2() use behind configure/runtime checks so systems without the header or usable syscall fall back safely. The upstream fixed security release is referenced in [7], the v3.4.4 follow-up release is referenced in [8], and the public advisory is referenced in [9]. The Debian tracker entry is referenced in [10]. Individual backported commit links are also recorded in the embedded patch headers. [1] https://github.com/RsyncProject/rsync/commit/862fe4eeaf82178324c66e504bf2c6c2e4038f99 [2] https://github.com/RsyncProject/rsync/commit/15d296425609a997f56eb8f9017ff73922f99b20 [3] https://github.com/RsyncProject/rsync/commit/30656c5e358b1c6033f4caf24f3e11b29d25c9f4 [4] https://github.com/RsyncProject/rsync/commit/3cc6a9e8cdcffb637ecdd41dae47833096dca317 [5] https://github.com/RsyncProject/rsync/commit/f3757a470ad3defdb2c4c6ad334e3839f3c7f1ae [6] https://github.com/RsyncProject/rsync/commit/c14e2258b59a3f16a99c6e83a28660ba438a73e9 [7] https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 [8] https://github.com/RsyncProject/rsync/releases/tag/v3.4.4 [9] https://github.com/RsyncProject/rsync/security/advisories/GHSA-4h9m-w5ff-j735 [10] https://security-tracker.debian.org/tracker/CVE-2026-43619 Signed-off-by: Ashishkumar Parmar Signed-off-by: Yoann Congal --- .../rsync/files/CVE-2026-43619_p1.patch | 471 +++++ .../rsync/files/CVE-2026-43619_p2.patch | 205 ++ .../rsync/files/CVE-2026-43619_p3.patch | 1783 +++++++++++++++++ .../rsync/files/CVE-2026-43619_p4.patch | 568 ++++++ .../rsync/files/CVE-2026-43619_p5.patch | 69 + .../rsync/files/CVE-2026-43619_p6.patch | 258 +++ meta/recipes-devtools/rsync/rsync_3.4.1.bb | 6 + 7 files changed, 3360 insertions(+) create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43619_p1.patch create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43619_p2.patch create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43619_p3.patch create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43619_p4.patch create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43619_p5.patch create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43619_p6.patch diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43619_p1.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p1.patch new file mode 100644 index 00000000000..b1556e51fa4 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p1.patch @@ -0,0 +1,471 @@ +From e406eb555ea1fadb7c0dd8ddef3fde1b92771aa7 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Mon, 4 May 2026 21:53:14 +1000 +Subject: [PATCH] syscall+receiver: secure receiver-side do_chmod against + symlink-race TOCTOU + +CVE-2026-29518's fix routed the receiver's open() through +secure_relative_open(), but every other path-based syscall the +receiver runs on sender-controllable paths is vulnerable to the +same TOCTOU primitive. This commit closes the chmod variant. + +Add do_chmod_at() that opens the parent of fname under +secure_relative_open() and uses fchmodat() against the resulting +dirfd. Gate the secure path on am_daemon && !am_chrooted (the same +gate use_secure_symlinks already uses for the receiver basis-file +open), so non-daemon callers and chrooted daemons keep the original +do_chmod() fast path. + +Migrate the receiver-side do_chmod() call sites in delete.c, +generator.c, rsync.c, and xattrs.c. + +Adds testsuite/chmod-symlink-race.test (with t_chmod_secure helper) +as regression coverage. + +Co-Authored-By: Claude Opus 4.7 (1M context) + +CVE: CVE-2026-43619 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/862fe4eeaf82178324c66e504bf2c6c2e4038f99] + +Backport Changes: +- Upstream also updates runtests.py and a newer Makefile.in test + helper list that includes simdtest. Wrynose 3.4.1 does not carry + runtests.py and its CHECK_PROGS list has no simdtest entry, so + those test-runner hunks were not applicable. + +(cherry picked from commit 862fe4eeaf82178324c66e504bf2c6c2e4038f99) +Signed-off-by: Ashishkumar Parmar +--- + Makefile.in | 9 ++- + delete.c | 4 +- + generator.c | 4 +- + rsync.c | 2 +- + syscall.c | 80 ++++++++++++++++++++ + t_chmod_secure.c | 117 ++++++++++++++++++++++++++++++ + t_stub.c | 2 + + testsuite/chmod-symlink-race.test | 68 +++++++++++++++++ + xattrs.c | 6 +- + 9 files changed, 282 insertions(+), 10 deletions(-) + create mode 100644 t_chmod_secure.c + create mode 100755 testsuite/chmod-symlink-race.test + +diff --git a/Makefile.in b/Makefile.in +index 2c5cf996..c30b8876 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -62,12 +62,13 @@ TLS_OBJ = tls.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/perms + + # Programs we must have to run the test cases + CHECK_PROGS = rsync$(EXEEXT) tls$(EXEEXT) getgroups$(EXEEXT) getfsdev$(EXEEXT) \ +- testrun$(EXEEXT) trimslash$(EXEEXT) t_unsafe$(EXEEXT) wildtest$(EXEEXT) ++ testrun$(EXEEXT) trimslash$(EXEEXT) t_unsafe$(EXEEXT) t_chmod_secure$(EXEEXT) \ ++ wildtest$(EXEEXT) + + CHECK_SYMLINKS = testsuite/chown-fake.test testsuite/devices-fake.test testsuite/xattrs-hlink.test + + # Objects for CHECK_PROGS to clean +-CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o trimslash.o wildtest.o ++CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o t_chmod_secure.o trimslash.o wildtest.o + + # note that the -I. is needed to handle config.h when using VPATH + .c.o: +@@ -183,6 +184,10 @@ T_UNSAFE_OBJ = t_unsafe.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/sn + t_unsafe$(EXEEXT): $(T_UNSAFE_OBJ) + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_UNSAFE_OBJ) $(LIBS) + ++T_CHMOD_SECURE_OBJ = t_chmod_secure.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o ++t_chmod_secure$(EXEEXT): $(T_CHMOD_SECURE_OBJ) ++ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_CHMOD_SECURE_OBJ) $(LIBS) ++ + .PHONY: conf + conf: configure.sh config.h.in + +diff --git a/delete.c b/delete.c +index 89c1f8d6..ded0ab2a 100644 +--- a/delete.c ++++ b/delete.c +@@ -98,7 +98,7 @@ static enum delret delete_dir_contents(char *fname, uint16 flags) + + strlcpy(p, fp->basename, remainder); + if (!(fp->mode & S_IWUSR) && !am_root && fp->flags & FLAG_OWNED_BY_US) +- do_chmod(fname, fp->mode | S_IWUSR); ++ do_chmod_at(fname, fp->mode | S_IWUSR); + /* Save stack by recursing to ourself directly. */ + if (S_ISDIR(fp->mode)) { + if (delete_dir_contents(fname, flags | DEL_RECURSE) != DR_SUCCESS) +@@ -139,7 +139,7 @@ enum delret delete_item(char *fbuf, uint16 mode, uint16 flags) + } + + if (flags & DEL_NO_UID_WRITE) +- do_chmod(fbuf, mode | S_IWUSR); ++ do_chmod_at(fbuf, mode | S_IWUSR); + + if (S_ISDIR(mode) && !(flags & DEL_DIR_IS_EMPTY)) { + /* This only happens on the first call to delete_item() since +diff --git a/generator.c b/generator.c +index b56fa569..e5aff654 100644 +--- a/generator.c ++++ b/generator.c +@@ -1499,7 +1499,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx, + #ifdef HAVE_CHMOD + if (!am_root && (file->mode & S_IRWXU) != S_IRWXU && dir_tweaking) { + mode_t mode = file->mode | S_IRWXU; +- if (do_chmod(fname, mode) < 0) { ++ if (do_chmod_at(fname, mode) < 0) { + rsyserr(FERROR_XFER, errno, + "failed to modify permissions on %s", + full_fname(fname)); +@@ -2111,7 +2111,7 @@ static void touch_up_dirs(struct file_list *flist, int ndx) + continue; + fname = f_name(file, NULL); + if (fix_dir_perms) +- do_chmod(fname, file->mode); ++ do_chmod_at(fname, file->mode); + if (need_retouch_dir_times) { + STRUCT_STAT st; + if (link_stat(fname, &st, 0) == 0 && mtime_differs(&st, file)) { +diff --git a/rsync.c b/rsync.c +index b130aba5..cc46a2f9 100644 +--- a/rsync.c ++++ b/rsync.c +@@ -657,7 +657,7 @@ int set_file_attrs(const char *fname, struct file_struct *file, stat_x *sxp, + + #ifdef HAVE_CHMOD + if (!BITS_EQUAL(sxp->st.st_mode, new_mode, CHMOD_BITS)) { +- int ret = am_root < 0 ? 0 : do_chmod(fname, new_mode); ++ int ret = am_root < 0 ? 0 : do_chmod_at(fname, new_mode); + if (ret < 0) { + rsyserr(FERROR_XFER, errno, + "failed to set permissions on %s", +diff --git a/syscall.c b/syscall.c +index dcecda1a..06d5ed3f 100644 +--- a/syscall.c ++++ b/syscall.c +@@ -281,6 +281,86 @@ int do_chmod(const char *path, mode_t mode) + return code; + return 0; + } ++ ++/* ++ Symlink-race-safe variant of do_chmod() for receiver-side use. ++ ++ Threat model: on a daemon running with "use chroot = no" (the prerequisite ++ for CVE-2026-29518), a local attacker can race a symlink swap of one of ++ the parent directory components of a path the receiver is about to chmod. ++ Because chmod() resolves symlinks at every component, the swap redirects ++ the chmod outside the receiver's confinement. ++ ++ Defence: open the *parent* directory of fname under secure_relative_open() ++ (which uses openat2(RESOLVE_BENEATH) on Linux 5.6+, openat() with ++ O_RESOLVE_BENEATH on FreeBSD 13+ and macOS 15+ (Sequoia), or a per-component ++ O_NOFOLLOW walk elsewhere) and do fchmodat() against that dirfd. A symlink ++ substituted into one of the parent components is then either followed ++ within the tree (legitimate dir-symlinks still work) or rejected by the ++ kernel (escape attempts fail). ++ ++ Final-component handling matches do_chmod(): fchmodat() with flag 0 ++ follows a symlink at the final component, which is the same behaviour as ++ chmod() and matches every current call site (the file being chmod'd is ++ one the receiver itself just created or transferred). For the rare case ++ where the caller wants to chmod a symlink-as-an-object (S_ISLNK in the ++ mode bits), we fall through to do_chmod() which has portability code for ++ that case. ++ ++ Falls back to do_chmod() for absolute paths and for paths with no parent ++ component, where there is nothing to protect against. ++*/ ++int do_chmod_at(const char *fname, mode_t mode) ++{ ++#ifdef AT_FDCWD ++ extern int am_daemon, am_chrooted; ++ char dirpath[MAXPATHLEN]; ++ const char *bname; ++ const char *slash; ++ int dfd, ret, e; ++ size_t dlen; ++ ++ if (dry_run) return 0; ++ RETURN_ERROR_IF_RO_OR_LO; ++ ++ /* Only the daemon-without-chroot case is exposed to the symlink- ++ * race attack: a chroot already confines the receiver, and a ++ * non-daemon rsync runs with the user's own authority so a ++ * symlink they planted can only redirect to files they could ++ * already access. Everywhere else, fall through to plain ++ * do_chmod() to avoid the dirfd-open overhead on every call. */ ++ if (!am_daemon || am_chrooted) ++ return do_chmod(fname, mode); ++ ++ if (!fname || !*fname || *fname == '/' || S_ISLNK(mode)) ++ return do_chmod(fname, mode); ++ ++ slash = strrchr(fname, '/'); ++ if (!slash) ++ return do_chmod(fname, mode); ++ ++ dlen = slash - fname; ++ if (dlen >= sizeof dirpath) { ++ errno = ENAMETOOLONG; ++ return -1; ++ } ++ memcpy(dirpath, fname, dlen); ++ dirpath[dlen] = '\0'; ++ bname = slash + 1; ++ ++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (dfd < 0) ++ return -1; ++ ++ ret = fchmodat(dfd, bname, mode, 0); ++ e = errno; ++ close(dfd); ++ errno = e; ++ return ret; ++#else ++ return do_chmod(fname, mode); ++#endif ++} + #endif + + int do_rename(const char *old_path, const char *new_path) +diff --git a/t_chmod_secure.c b/t_chmod_secure.c +new file mode 100644 +index 00000000..114dfb2d +--- /dev/null ++++ b/t_chmod_secure.c +@@ -0,0 +1,117 @@ ++/* ++ * Test harness for do_chmod_at(). Confirms the symlink-TOCTOU ++ * primitive used by CVE-2026-29518 (and its incomplete-fix follow-up ++ * for chmod) is closed by do_chmod_at(): a parent directory component ++ * being a symlink that escapes the receiver's confinement must be ++ * rejected, while a parent symlink that resolves *within* the tree ++ * must still work (so legitimate dir-symlinks are not regressed). ++ * ++ * Not linked into rsync itself. ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 as ++ * published by the Free Software Foundation. ++ */ ++ ++#include "rsync.h" ++ ++#include ++ ++int dry_run = 0; ++int am_root = 0; ++int am_sender = 0; ++int read_only = 0; ++int list_only = 0; ++int copy_links = 0; ++int copy_unsafe_links = 0; ++extern int am_daemon, am_chrooted; ++ ++short info_levels[COUNT_INFO], debug_levels[COUNT_DEBUG]; ++ ++static int errs = 0; ++ ++static void check(const char *label, int actual_rc, int expect_ok, ++ const char *path, mode_t expected_mode) ++{ ++ struct stat st; ++ int got_ok = (actual_rc == 0); ++ if (got_ok != expect_ok) { ++ fprintf(stderr, "FAIL [%s]: rc=%d errno=%d (%s), expected %s\n", ++ label, actual_rc, errno, strerror(errno), ++ expect_ok ? "success" : "rejection"); ++ errs++; ++ return; ++ } ++ if (path && stat(path, &st) < 0) { ++ fprintf(stderr, "FAIL [%s]: stat(%s) failed: %s\n", ++ label, path, strerror(errno)); ++ errs++; ++ return; ++ } ++ if (path && (st.st_mode & 07777) != expected_mode) { ++ fprintf(stderr, ++ "FAIL [%s]: %s mode is 0%o, expected 0%o\n", ++ label, path, st.st_mode & 07777, expected_mode); ++ errs++; ++ return; ++ } ++ fprintf(stderr, "OK [%s]\n", label); ++} ++ ++int main(int argc, char **argv) ++{ ++ if (argc != 2) { ++ fprintf(stderr, "usage: %s \n", argv[0]); ++ return 2; ++ } ++ if (chdir(argv[1]) < 0) { ++ perror("chdir"); ++ return 2; ++ } ++ ++ /* Simulate the daemon-without-chroot deployment that do_chmod_at() ++ * defends. With am_daemon=0 or am_chrooted=1 the wrapper falls ++ * through to plain do_chmod() and the symlink-race test would be ++ * meaningless. */ ++ am_daemon = 1; ++ am_chrooted = 0; ++ ++ /* Test layout (all inside the directory we just chdir'd to): ++ * ++ * ./realdir/sentinel -- regular target file ++ * ./inside_link -> realdir -- legitimate dir-symlink within the tree ++ * ./escape_link -> ../trap -- attacker swap, target outside tree ++ * ../trap/sentinel -- the file the attacker wants to alter ++ * ++ * The shell wrapper that calls this helper has set both sentinel ++ * files to mode 0600 so we have a clean baseline to compare. ++ */ ++ ++ /* Scenario A: legitimate parent dir-symlink, chmod must succeed. */ ++ int rc = do_chmod_at("inside_link/sentinel", 0640); ++ check("A: legit dir-symlink within tree", ++ rc, 1, "realdir/sentinel", 0640); ++ ++ /* Scenario B: parent symlink escapes the tree -- chmod must be ++ * rejected and the outside file's mode must be unchanged. */ ++ rc = do_chmod_at("escape_link/sentinel", 0666); ++ check("B: parent symlink escapes tree (the attack)", ++ rc, 0, "../trap/sentinel", 0600); ++ ++ /* Scenario C: plain relative path with no symlink components, ++ * regression check that the safe wrapper doesn't break the ++ * normal case. */ ++ rc = do_chmod_at("realdir/sentinel", 0644); ++ check("C: plain relative path (regression check)", ++ rc, 1, "realdir/sentinel", 0644); ++ ++ /* Scenario D: top-level file, no parent directory component. ++ * Falls back to do_chmod(); should succeed. */ ++ rc = do_chmod_at("topfile", 0640); ++ check("D: top-level file, no parent component", ++ rc, 1, "topfile", 0640); ++ ++ if (errs) ++ fprintf(stderr, "%d failure(s)\n", errs); ++ return errs ? 1 : 0; ++} +diff --git a/t_stub.c b/t_stub.c +index eee92729..63bc144c 100644 +--- a/t_stub.c ++++ b/t_stub.c +@@ -23,6 +23,8 @@ + + int do_fsync = 0; + int inplace = 0; ++int am_daemon = 0; ++int am_chrooted = 0; + int modify_window = 0; + int preallocate_files = 0; + int protect_args = 0; +diff --git a/testsuite/chmod-symlink-race.test b/testsuite/chmod-symlink-race.test +new file mode 100755 +index 00000000..48bbfbb4 +--- /dev/null ++++ b/testsuite/chmod-symlink-race.test +@@ -0,0 +1,68 @@ ++#!/bin/sh ++ ++# Copyright (C) 2026 by Andrew Tridgell ++ ++# This program is distributable under the terms of the GNU GPL (see ++# COPYING). ++ ++# Regression test for the symlink-TOCTOU class of bug applied to ++# chmod() on the receiver side. The CVE-2026-29518 fix used ++# secure_relative_open() for the basis-file open, but every other ++# path-based syscall the receiver runs on sender-controllable paths ++# is vulnerable to the same primitive: a local attacker swaps a ++# symlink into one of the parent directory components between the ++# receiver's check and its act, and the syscall escapes the module. ++# ++# This test exercises the new do_chmod_at() wrapper via the ++# t_chmod_secure helper. The helper sets up two scenarios: ++# - a parent dir-symlink that resolves WITHIN the module tree ++# (legitimate -K-style use, must continue to work) ++# - a parent dir-symlink that escapes the module tree (the ++# attack, must be rejected) ++# plus two regression scenarios (plain relative path, top-level ++# file) that just confirm the safe wrapper doesn't break the ++# normal case. ++# ++# The kernel-enforced "stay below dirfd" path resolution is ++# only available on Linux 5.6+, FreeBSD 13+, and macOS 15+. ++# Skip on platforms that fall back to per-component O_NOFOLLOW ++# (Solaris, OpenBSD, NetBSD, Cygwin); the per-component fallback ++# would also reject the attack but the legitimate dir-symlink ++# scenario would fail there. ++ ++. "$suitedir/rsync.fns" ++ ++case "$(uname -s)" in ++ SunOS|OpenBSD|NetBSD|CYGWIN*) ++ test_skipped "do_chmod_at relies on RESOLVE_BENEATH-equivalent kernel support not available on $(uname -s)" ++ ;; ++esac ++ ++mod="$scratchdir/module" ++trap_outside="$scratchdir/trap" ++rm -rf "$mod" "$trap_outside" ++mkdir -p "$mod/realdir" "$trap_outside" ++ ++# Set up the four file-system objects the helper expects: ++echo bystander > "$mod/realdir/sentinel" ++chmod 0600 "$mod/realdir/sentinel" ++echo target > "$trap_outside/sentinel" ++chmod 0600 "$trap_outside/sentinel" ++ln -s realdir "$mod/inside_link" ++ln -s ../trap "$mod/escape_link" ++echo top > "$mod/topfile" ++chmod 0600 "$mod/topfile" ++ ++"$TOOLDIR/t_chmod_secure" "$mod" || \ ++ test_fail "t_chmod_secure reported failures (see stderr above)" ++ ++# Sanity-check from the shell side too: the outside file's mode must ++# still be 0600 -- the helper checked this, but a second look from ++# the shell guards against a helper-internal stat() bug. ++mode=$(stat -c '%a' "$trap_outside/sentinel" 2>/dev/null \ ++ || stat -f '%Lp' "$trap_outside/sentinel" 2>/dev/null) ++if [ "$mode" != "600" ]; then ++ test_fail "outside sentinel mode changed from 600 to $mode -- chmod escaped the module" ++fi ++ ++exit 0 +diff --git a/xattrs.c b/xattrs.c +index 26e50a6f..4462d63b 100644 +--- a/xattrs.c ++++ b/xattrs.c +@@ -1086,7 +1086,7 @@ int set_xattr(const char *fname, const struct file_struct *file, const char *fna + && !S_ISLNK(sxp->st.st_mode) + #endif + && access(fname, W_OK) < 0 +- && do_chmod(fname, (sxp->st.st_mode & CHMOD_BITS) | S_IWUSR) == 0) ++ && do_chmod_at(fname, (sxp->st.st_mode & CHMOD_BITS) | S_IWUSR) == 0) + added_write_perm = 1; + + ndx = F_XATTR(file); +@@ -1094,7 +1094,7 @@ int set_xattr(const char *fname, const struct file_struct *file, const char *fna + lst = &glst->xa_items; + int return_value = rsync_xal_set(fname, lst, fnamecmp, sxp); + if (added_write_perm) /* remove the temporary write permission */ +- do_chmod(fname, sxp->st.st_mode); ++ do_chmod_at(fname, sxp->st.st_mode); + return return_value; + } + +@@ -1211,7 +1211,7 @@ int set_stat_xattr(const char *fname, struct file_struct *file, mode_t new_mode) + mode = (fst.st_mode & _S_IFMT) | (fmode & ACCESSPERMS) + | (S_ISDIR(fst.st_mode) ? 0700 : 0600); + if (fst.st_mode != mode) +- do_chmod(fname, mode); ++ do_chmod_at(fname, mode); + if (!IS_DEVICE(fst.st_mode)) + fst.st_rdev = 0; /* just in case */ + diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43619_p2.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p2.patch new file mode 100644 index 00000000000..9decc585456 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p2.patch @@ -0,0 +1,205 @@ +From a2269dd38ddc83bbc8738d8b0897400e8088c1a8 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Tue, 5 May 2026 14:34:33 +1000 +Subject: [PATCH] util1: secure change_dir() against symlink-race chdir-escape + +The receiver's chdir(2) into a destination subdirectory followed +attacker-planted symlinks at every path component. Once CWD +escaped the module, every subsequent path-relative syscall (open, +chmod, lchown, ...) inherited the escape -- defeating +secure_relative_open's RESOLVE_BENEATH anchor against AT_FDCWD, +since the anchor itself was now outside the module. + +Route change_dir's relative target through secure_relative_open() +and fchdir() to the resulting dirfd in am_daemon && !am_chrooted +mode, so the chdir step itself can no longer follow a parent- +symlink. Same treatment applied to the CD_SKIP_CHDIR / +set_path_only path so it also can't follow attacker symlinks +during path tracking. + +Adds testsuite/sender-flist-symlink-leak.test covering the +sender-side flist resolution variant of the same primitive. + +Co-Authored-By: Claude Opus 4.7 (1M context) + +CVE: CVE-2026-43619 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/15d296425609a997f56eb8f9017ff73922f99b20] + +(cherry picked from commit 15d296425609a997f56eb8f9017ff73922f99b20) +Signed-off-by: Ashishkumar Parmar +--- + testsuite/sender-flist-symlink-leak.test | 90 ++++++++++++++++++++++++ + util1.c | 56 +++++++++++++-- + 2 files changed, 142 insertions(+), 4 deletions(-) + create mode 100755 testsuite/sender-flist-symlink-leak.test + +diff --git a/testsuite/sender-flist-symlink-leak.test b/testsuite/sender-flist-symlink-leak.test +new file mode 100755 +index 00000000..011d93d0 +--- /dev/null ++++ b/testsuite/sender-flist-symlink-leak.test +@@ -0,0 +1,90 @@ ++#!/bin/sh ++ ++# Copyright (C) 2026 by Andrew Tridgell ++ ++# This program is distributable under the terms of the GNU GPL (see ++# COPYING). ++ ++# Regression test for codex re-check finding: the sender-side file- ++# list generator can still follow an attacker-planted symlink out of ++# the module via change_pathname() -> change_dir(...,CD_SKIP_CHDIR) ++# followed by change_dir(...,CD_NORMAL). The CD_SKIP_CHDIR sets ++# skipped_chdir=1, and the next CD_NORMAL call's secure-branch in ++# util1.c is gated on `!skipped_chdir`, so the secure path is ++# bypassed and a raw chdir(curr_dir) follows attacker-controlled ++# symlinks during flist generation. ++# ++# Reach: rsync daemon module with `use chroot = no`. A local ++# attacker plants module/cd -> /outside. A client (innocent or ++# malicious) pulls rsync:////cd/. The daemon, as ++# sender, enumerates files in /outside and ships their metadata ++# (names, sizes, modes, mtimes) to the client. The actual content ++# transfer fails later at the secure_relative_open step with EXDEV, ++# but by then the metadata has already leaked. ++# ++# We detect by running a dry-run pull of the symlinked subdir and ++# checking whether the client's --list-only output mentions any ++# file from /outside. With the bug, /outside/secret.txt appears in ++# the list with its size; with the fix, the daemon's chdir into ++# the symlinked subdir is rejected and no /outside file is listed. ++ ++. "$suitedir/rsync.fns" ++ ++case "$(uname -s)" in ++ SunOS|OpenBSD|NetBSD|CYGWIN*) ++ test_skipped "secure change_dir relies on RESOLVE_BENEATH-equivalent kernel support not available on $(uname -s)" ++ ;; ++esac ++ ++mod="$scratchdir/module" ++outside="$scratchdir/outside" ++listfile="$scratchdir/listed.txt" ++conf="$scratchdir/test-rsyncd.conf" ++ ++rm -rf "$mod" "$outside" ++mkdir -p "$mod" "$outside" ++ ++# Outside-the-module file the daemon should NOT enumerate to clients. ++# A distinctive name + non-trivial size makes the leak easy to spot. ++echo "OUTSIDE_PROTECTED_FILE_USED_AS_LEAK_DETECTOR" > "$outside/leak_marker.txt" ++chmod 0644 "$outside/leak_marker.txt" ++ ++# The symlink trap planted by the local attacker. ++ln -s "$outside" "$mod/cd" ++ ++my_uid=`get_testuid` ++root_uid=`get_rootuid` ++root_gid=`get_rootgid` ++uid_setting="uid = $root_uid" ++gid_setting="gid = $root_gid" ++if test x"$my_uid" != x"$root_uid"; then ++ uid_setting="#$uid_setting" ++ gid_setting="#$gid_setting" ++fi ++ ++cat > "$conf" < "$listfile" 2>&1 || true ++ ++if grep -q "leak_marker\.txt" "$listfile"; then ++ echo "----- leaked listing follows" >&2 ++ sed 's/^/ /' "$listfile" >&2 ++ echo "----- leaked listing ends" >&2 ++ test_fail "sender flist leak: outside/leak_marker.txt was enumerated to the client (daemon's chdir followed the cd symlink during flist generation)" ++fi ++ ++exit 0 +diff --git a/util1.c b/util1.c +index d84bc414..6e457d4f 100644 +--- a/util1.c ++++ b/util1.c +@@ -1112,6 +1112,7 @@ char *sanitize_path(char *dest, const char *p, const char *rootdir, int depth, i + * Also cleans the path using the clean_fname() function. */ + int change_dir(const char *dir, int set_path_only) + { ++ extern int am_daemon, am_chrooted; + static int initialised, skipped_chdir; + unsigned int len; + +@@ -1150,10 +1151,57 @@ int change_dir(const char *dir, int set_path_only) + curr_dir[curr_dir_len++] = '/'; + memcpy(curr_dir + curr_dir_len, dir, len + 1); + +- if (!set_path_only && chdir(curr_dir)) { +- curr_dir_len = save_dir_len; +- curr_dir[curr_dir_len] = '\0'; +- return 0; ++ if (!set_path_only) { ++ int chdir_failed; ++ /* In the daemon-without-chroot deployment we must not ++ * follow a symlink in any component of the chdir ++ * target -- otherwise CWD escapes the module and ++ * every subsequent path-relative syscall (open, ++ * chmod, lchown, ...) inherits the escape, which ++ * defeats secure_relative_open's RESOLVE_BENEATH ++ * anchor and re-opens the CVE-2026-29518 class of ++ * symlink TOCTOU attacks. Use the secure resolver ++ * to get a confined dirfd, then fchdir() to it. ++ * ++ * If skipped_chdir is set, a previous CD_SKIP_CHDIR ++ * call buffered an absolute prefix in curr_dir ++ * (e.g. change_pathname's CD_SKIP_CHDIR to orig_dir) ++ * without syncing the kernel's CWD. Resolve `dir` ++ * relative to that prefix as basedir so the secure ++ * branch still anchors at the operator-trusted ++ * directory rather than wherever the kernel CWD ++ * happens to be. */ ++ if (am_daemon && !am_chrooted) { ++ const char *basedir = NULL; ++ char prefix[MAXPATHLEN]; ++ int dfd; ++ if (skipped_chdir) { ++ if (save_dir_len >= sizeof prefix) { ++ errno = ENAMETOOLONG; ++ chdir_failed = 1; ++ goto chdir_cleanup; ++ } ++ memcpy(prefix, curr_dir, save_dir_len); ++ prefix[save_dir_len] = '\0'; ++ basedir = prefix; ++ } ++ dfd = secure_relative_open(basedir, dir, ++ O_RDONLY | O_DIRECTORY, 0); ++ if (dfd < 0) { ++ chdir_failed = 1; ++ } else { ++ chdir_failed = fchdir(dfd) != 0; ++ close(dfd); ++ } ++ } else { ++ chdir_failed = chdir(curr_dir) != 0; ++ } ++ chdir_cleanup: ++ if (chdir_failed) { ++ curr_dir_len = save_dir_len; ++ curr_dir[curr_dir_len] = '\0'; ++ return 0; ++ } + } + skipped_chdir = set_path_only; + } diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43619_p3.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p3.patch new file mode 100644 index 00000000000..fac413f3ea8 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p3.patch @@ -0,0 +1,1783 @@ +From a55d00c0f37fd811b0fddc1eaeb7f420215b1e05 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Tue, 5 May 2026 15:02:48 +1000 +Subject: [PATCH] syscall: add symlink-race-safe do_*_at() wrappers and harden + secure_relative_open + +Add the rest of the path-based syscall wrappers and migrate every +receiver-side caller: + - do_lchown_at, do_rename_at, do_mkdir_at, do_symlink_at, + do_mknod_at, do_link_at, do_unlink_at, do_rmdir_at, + do_utimensat_at, do_stat_at, do_lstat_at + +Same shape as do_chmod_at: open each parent under +secure_relative_open(), call the *at() variant against the dirfd, +fall through to the bare path-based syscall in non-daemon / +chrooted / absolute-path / no-parent cases. macOS's +setattrlist-based set_times tier is also routed through the +utimensat_at path on daemon-no-chroot. + +Hardenings to secure_relative_open() itself: + - confine basedir resolution under the same kernel mechanism + used for relpath (basedirs from --copy-dest / --link-dest are + sender-controllable in daemon mode) + - reject any '..' component (bare '..', 'foo/..', 'subdir/..') + so the per-component O_NOFOLLOW fallback can't escape + - return the dirfd we built up from the per-component fallback + when the caller passed O_DIRECTORY (otherwise every do_*_at + failed with EINVAL on platforms without RESOLVE_BENEATH) + +Adds testsuite/alt-dest-symlink-race.test and +testsuite/secure-relpath-validation.test (with t_secure_relpath +helper) as regression coverage for the new hardenings. + +Co-Authored-By: Claude Opus 4.7 (1M context) + +CVE: CVE-2026-43619 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/30656c5e358b1c6033f4caf24f3e11b29d25c9f4] + +Backport Changes: +- Upstream also updates runtests.py and a newer Makefile.in test + helper list that includes simdtest. Wrynose 3.4.1 does not carry + runtests.py and its CHECK_PROGS list has no simdtest entry, so + those test-runner hunks were not applicable. + +(cherry picked from commit 30656c5e358b1c6033f4caf24f3e11b29d25c9f4) +Signed-off-by: Ashishkumar Parmar +--- + Makefile.in | 8 +- + backup.c | 14 +- + cleanup.c | 2 +- + delete.c | 2 +- + generator.c | 22 +- + hlink.c | 2 +- + receiver.c | 8 +- + rsync.c | 6 +- + syscall.c | 841 ++++++++++++++++++++++- + t_secure_relpath.c | 151 ++++ + testsuite/alt-dest-symlink-race.test | 96 +++ + testsuite/secure-relpath-validation.test | 34 + + util1.c | 20 +- + xattrs.c | 9 +- + 14 files changed, 1164 insertions(+), 51 deletions(-) + create mode 100644 t_secure_relpath.c + create mode 100755 testsuite/alt-dest-symlink-race.test + create mode 100755 testsuite/secure-relpath-validation.test + +diff --git a/Makefile.in b/Makefile.in +index c30b8876..c0cc7a06 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -63,12 +63,12 @@ TLS_OBJ = tls.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/perms + # Programs we must have to run the test cases + CHECK_PROGS = rsync$(EXEEXT) tls$(EXEEXT) getgroups$(EXEEXT) getfsdev$(EXEEXT) \ + testrun$(EXEEXT) trimslash$(EXEEXT) t_unsafe$(EXEEXT) t_chmod_secure$(EXEEXT) \ +- wildtest$(EXEEXT) ++ t_secure_relpath$(EXEEXT) wildtest$(EXEEXT) + + CHECK_SYMLINKS = testsuite/chown-fake.test testsuite/devices-fake.test testsuite/xattrs-hlink.test + + # Objects for CHECK_PROGS to clean +-CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o t_chmod_secure.o trimslash.o wildtest.o ++CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o t_chmod_secure.o t_secure_relpath.o trimslash.o wildtest.o + + # note that the -I. is needed to handle config.h when using VPATH + .c.o: +@@ -188,6 +188,10 @@ T_CHMOD_SECURE_OBJ = t_chmod_secure.o syscall.o util1.o util2.o t_stub.o lib/com + t_chmod_secure$(EXEEXT): $(T_CHMOD_SECURE_OBJ) + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_CHMOD_SECURE_OBJ) $(LIBS) + ++T_SECURE_RELPATH_OBJ = t_secure_relpath.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o ++t_secure_relpath$(EXEEXT): $(T_SECURE_RELPATH_OBJ) ++ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_SECURE_RELPATH_OBJ) $(LIBS) ++ + .PHONY: conf + conf: configure.sh config.h.in + +diff --git a/backup.c b/backup.c +index 686cb297..ae8cb49e 100644 +--- a/backup.c ++++ b/backup.c +@@ -39,7 +39,7 @@ static int validate_backup_dir(void) + { + STRUCT_STAT st; + +- if (do_lstat(backup_dir_buf, &st) < 0) { ++ if (do_lstat_at(backup_dir_buf, &st) < 0) { + if (errno == ENOENT) + return 0; + rsyserr(FERROR, errno, "backup lstat %s failed", backup_dir_buf); +@@ -98,7 +98,7 @@ static BOOL copy_valid_path(const char *fname) + for ( ; b; name = b + 1, b = strchr(name, '/')) { + *b = '\0'; + +- while (do_mkdir(backup_dir_buf, ACCESSPERMS) < 0) { ++ while (do_mkdir_at(backup_dir_buf, ACCESSPERMS) < 0) { + if (errno == EEXIST) { + val = validate_backup_dir(); + if (val > 0) +@@ -197,7 +197,7 @@ static inline int link_or_rename(const char *from, const char *to, + if (IS_SPECIAL(stp->st_mode) || IS_DEVICE(stp->st_mode)) + return 0; /* Use copy code. */ + #endif +- if (do_link(from, to) == 0) { ++ if (do_link_at(from, to) == 0) { + if (DEBUG_GTE(BACKUP, 1)) + rprintf(FINFO, "make_backup: HLINK %s successful.\n", from); + return 2; +@@ -207,7 +207,7 @@ static inline int link_or_rename(const char *from, const char *to, + return 0; + } + #endif +- if (do_rename(from, to) == 0) { ++ if (do_rename_at(from, to) == 0) { + if (stp->st_nlink > 1 && !S_ISDIR(stp->st_mode)) { + /* If someone has hard-linked the file into the backup + * dir, rename() might return success but do nothing! */ +@@ -246,7 +246,7 @@ int make_backup(const char *fname, BOOL prefer_rename) + goto success; + if (errno == EEXIST || errno == EISDIR) { + STRUCT_STAT bakst; +- if (do_lstat(buf, &bakst) == 0) { ++ if (do_lstat_at(buf, &bakst) == 0) { + int flags = get_del_for_flag(bakst.st_mode) | DEL_FOR_BACKUP | DEL_RECURSE; + if (delete_item(buf, bakst.st_mode, flags) != 0) + return 0; +@@ -277,7 +277,7 @@ int make_backup(const char *fname, BOOL prefer_rename) + /* Check to see if this is a device file, or link */ + if ((am_root && preserve_devices && IS_DEVICE(file->mode)) + || (preserve_specials && IS_SPECIAL(file->mode))) { +- if (do_mknod(buf, file->mode, sx.st.st_rdev) < 0) ++ if (do_mknod_at(buf, file->mode, sx.st.st_rdev) < 0) + rsyserr(FERROR, errno, "mknod %s failed", full_fname(buf)); + else if (DEBUG_GTE(BACKUP, 1)) + rprintf(FINFO, "make_backup: DEVICE %s successful.\n", fname); +@@ -294,7 +294,7 @@ int make_backup(const char *fname, BOOL prefer_rename) + } + ret = 2; + } else { +- if (do_symlink(sl, buf) < 0) ++ if (do_symlink_at(sl, buf) < 0) + rsyserr(FERROR, errno, "link %s -> \"%s\"", full_fname(buf), sl); + else if (DEBUG_GTE(BACKUP, 1)) + rprintf(FINFO, "make_backup: SYMLINK %s successful.\n", fname); +diff --git a/cleanup.c b/cleanup.c +index 40d26baa..0493fbbb 100644 +--- a/cleanup.c ++++ b/cleanup.c +@@ -198,7 +198,7 @@ NORETURN void _exit_cleanup(int code, const char *file, int line) + switch_step++; + + if (cleanup_fname) +- do_unlink(cleanup_fname); ++ do_unlink_at(cleanup_fname); + if (exit_code) + kill_all(SIGUSR1); + if (cleanup_pid && cleanup_pid == getpid()) { +diff --git a/delete.c b/delete.c +index ded0ab2a..4a52122d 100644 +--- a/delete.c ++++ b/delete.c +@@ -160,7 +160,7 @@ enum delret delete_item(char *fbuf, uint16 mode, uint16 flags) + + if (S_ISDIR(mode)) { + what = "rmdir"; +- ok = do_rmdir(fbuf) == 0; ++ ok = do_rmdir_at(fbuf) == 0; + } else { + if (make_backups > 0 && !(flags & DEL_FOR_BACKUP) && (backup_dir || !is_backup_file(fbuf))) { + what = "make_backup"; +diff --git a/generator.c b/generator.c +index e5aff654..e5b2d176 100644 +--- a/generator.c ++++ b/generator.c +@@ -984,7 +984,7 @@ static int try_dests_reg(struct file_struct *file, char *fname, int ndx, + if (find_exact_for_existing) { + if (alt_dest_type == LINK_DEST && real_st.st_dev == sxp->st.st_dev && real_st.st_ino == sxp->st.st_ino) + return -1; +- if (do_unlink(fname) < 0 && errno != ENOENT) ++ if (do_unlink_at(fname) < 0 && errno != ENOENT) + goto got_nothing_for_ya; + } + #ifdef SUPPORT_HARD_LINKS +@@ -1112,7 +1112,7 @@ static int try_dests_non(struct file_struct *file, char *fname, int ndx, + && !IS_SPECIAL(file->mode) && !IS_DEVICE(file->mode) + #endif + && !S_ISDIR(file->mode)) { +- if (do_link(cmpbuf, fname) < 0) { ++ if (do_link_at(cmpbuf, fname) < 0) { + rsyserr(FERROR_XFER, errno, + "failed to hard-link %s with %s", + cmpbuf, fname); +@@ -1315,7 +1315,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx, + } + } + if (relative_paths && !implied_dirs && file->mode != 0 +- && do_stat(dn, &sx.st) < 0) { ++ && do_stat_at(dn, &sx.st) < 0) { + if (dry_run) + goto parent_is_dry_missing; + if (make_path(fname, MKP_DROP_NAME | MKP_SKIP_SLASH) < 0) { +@@ -1427,7 +1427,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx, + && (stype == FT_DIR + || delete_item(fname, sx.st.st_mode, del_opts | DEL_FOR_DIR) != 0)) + goto cleanup; /* Any errors get reported later. */ +- if (do_mkdir(fname, (file->mode|added_perms) & 0700) == 0) ++ if (do_mkdir_at(fname, (file->mode|added_perms) & 0700) == 0) + file->flags |= FLAG_DIR_CREATED; + goto cleanup; + } +@@ -1469,10 +1469,10 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx, + itemize(fnamecmp, file, ndx, statret, &sx, + statret ? ITEM_LOCAL_CHANGE : 0, 0, NULL); + } +- if (real_ret != 0 && do_mkdir(fname,file->mode|added_perms) < 0 && errno != EEXIST) { ++ if (real_ret != 0 && do_mkdir_at(fname,file->mode|added_perms) < 0 && errno != EEXIST) { + if (!relative_paths || errno != ENOENT + || make_path(fname, MKP_DROP_NAME | MKP_SKIP_SLASH) < 0 +- || (do_mkdir(fname, file->mode|added_perms) < 0 && errno != EEXIST)) { ++ || (do_mkdir_at(fname, file->mode|added_perms) < 0 && errno != EEXIST)) { + rsyserr(FERROR_XFER, errno, + "recv_generator: mkdir %s failed", + full_fname(fname)); +@@ -1808,7 +1808,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx, + ; + else if (quick_check_ok(FT_REG, fnamecmp, file, &sx.st)) { + if (partialptr) { +- do_unlink(partialptr); ++ do_unlink_at(partialptr); + handle_partial_dir(partialptr, PDIR_DELETE); + } + set_file_attrs(fname, file, &sx, NULL, maybe_ATTRS_REPORT | maybe_ATTRS_ACCURATE_TIME); +@@ -2016,7 +2016,7 @@ int atomic_create(struct file_struct *file, char *fname, const char *slnk, const + + if (slnk) { + #ifdef SUPPORT_LINKS +- if (do_symlink(slnk, create_name) < 0) { ++ if (do_symlink_at(slnk, create_name) < 0) { + rsyserr(FERROR_XFER, errno, "symlink %s -> \"%s\" failed", + full_fname(create_name), slnk); + return 0; +@@ -2032,7 +2032,7 @@ int atomic_create(struct file_struct *file, char *fname, const char *slnk, const + return 0; + #endif + } else { +- if (do_mknod(create_name, file->mode, rdev) < 0) { ++ if (do_mknod_at(create_name, file->mode, rdev) < 0) { + rsyserr(FERROR_XFER, errno, "mknod %s failed", + full_fname(create_name)); + return 0; +@@ -2040,14 +2040,14 @@ int atomic_create(struct file_struct *file, char *fname, const char *slnk, const + } + + if (!skip_atomic) { +- if (do_rename(tmpname, fname) < 0) { ++ if (do_rename_at(tmpname, fname) < 0) { + char *full_tmpname = strdup(full_fname(tmpname)); + if (full_tmpname == NULL) + out_of_memory("atomic_create"); + rsyserr(FERROR_XFER, errno, "rename %s -> \"%s\" failed", + full_tmpname, full_fname(fname)); + free(full_tmpname); +- do_unlink(tmpname); ++ do_unlink_at(tmpname); + return 0; + } + } +diff --git a/hlink.c b/hlink.c +index 2c14407a..eb36730f 100644 +--- a/hlink.c ++++ b/hlink.c +@@ -454,7 +454,7 @@ int hard_link_check(struct file_struct *file, int ndx, char *fname, + int hard_link_one(struct file_struct *file, const char *fname, + const char *oldname, int terse) + { +- if (do_link(oldname, fname) < 0) { ++ if (do_link_at(oldname, fname) < 0) { + enum logcode code; + if (terse) { + if (!INFO_GTE(NAME, 1)) +diff --git a/receiver.c b/receiver.c +index 5a2c8c5a..8cf8366b 100644 +--- a/receiver.c ++++ b/receiver.c +@@ -442,7 +442,7 @@ static void handle_delayed_updates(char *local_name) + } + /* We don't use robust_rename() here because the + * partial-dir must be on the same drive. */ +- if (do_rename(partialptr, fname) < 0) { ++ if (do_rename_at(partialptr, fname) < 0) { + rsyserr(FERROR_XFER, errno, + "rename failed for %s (from %s)", + full_fname(fname), partialptr); +@@ -926,7 +926,7 @@ int recv_files(int f_in, int f_out, char *local_name) + recv_ok = -1; + else if (fnamecmp == partialptr) { + if (!one_inplace) +- do_unlink(partialptr); ++ do_unlink_at(partialptr); + handle_partial_dir(partialptr, PDIR_DELETE); + } + } else if (keep_partial && partialptr && (!one_inplace || delay_updates)) { +@@ -935,7 +935,7 @@ int recv_files(int f_in, int f_out, char *local_name) + "Unable to create partial-dir for %s -- discarding %s.\n", + local_name ? local_name : f_name(file, NULL), + recv_ok ? "completed file" : "partial file"); +- do_unlink(fnametmp); ++ do_unlink_at(fnametmp); + recv_ok = -1; + } else if (!finish_transfer(partialptr, fnametmp, fnamecmp, NULL, + file, recv_ok, !partial_dir)) +@@ -946,7 +946,7 @@ int recv_files(int f_in, int f_out, char *local_name) + } else + partialptr = NULL; + } else if (!one_inplace) +- do_unlink(fnametmp); ++ do_unlink_at(fnametmp); + + cleanup_disable(); + +diff --git a/rsync.c b/rsync.c +index cc46a2f9..1d2ae82a 100644 +--- a/rsync.c ++++ b/rsync.c +@@ -547,7 +547,7 @@ int set_file_attrs(const char *fname, struct file_struct *file, stat_x *sxp, + if (am_root >= 0) { + uid_t uid = change_uid ? (uid_t)F_OWNER(file) : sxp->st.st_uid; + gid_t gid = change_gid ? (gid_t)F_GROUP(file) : sxp->st.st_gid; +- if (do_lchown(fname, uid, gid) != 0) { ++ if (do_lchown_at(fname, uid, gid) != 0) { + /* We shouldn't have attempted to change uid + * or gid unless have the privilege. */ + rsyserr(FERROR_XFER, errno, "%s %s failed", +@@ -758,7 +758,7 @@ int finish_transfer(const char *fname, const char *fnametmp, + full_fname(fnametmp), fname); + if (!partialptr || (ret == -2 && temp_copy_name) + || robust_rename(fnametmp, partialptr, NULL, file->mode) < 0) +- do_unlink(fnametmp); ++ do_unlink_at(fnametmp); + return 0; + } + if (ret == 0) { +@@ -774,7 +774,7 @@ int finish_transfer(const char *fname, const char *fnametmp, + ok_to_set_time ? ATTRS_ACCURATE_TIME : ATTRS_SKIP_MTIME | ATTRS_SKIP_ATIME | ATTRS_SKIP_CRTIME); + + if (temp_copy_name) { +- if (do_rename(fnametmp, fname) < 0) { ++ if (do_rename_at(fnametmp, fname) < 0) { + rsyserr(FERROR_XFER, errno, "rename %s -> \"%s\"", + full_fname(fnametmp), fname); + return 0; +diff --git a/syscall.c b/syscall.c +index 06d5ed3f..ffd8df20 100644 +--- a/syscall.c ++++ b/syscall.c +@@ -93,6 +93,63 @@ int do_unlink(const char *path) + return unlink(path); + } + ++/* ++ Symlink-race-safe variant of do_unlink() for receiver-side use. See ++ the comment on do_chmod_at() for the threat model. unlink() resolves ++ parent components, so a parent-symlink swap can delete an outside ++ file under the daemon's authority. Defence: open the parent of path ++ under secure_relative_open() and use unlinkat() (flags=0) against ++ that dirfd. ++ ++ Falls through to do_unlink() for the same dry-run / non-daemon / ++ chrooted / no-parent / absolute-path cases as the other wrappers. ++*/ ++int do_unlink_at(const char *path) ++{ ++#ifdef AT_FDCWD ++ extern int am_daemon, am_chrooted; ++ char dirpath[MAXPATHLEN]; ++ const char *bname; ++ const char *slash; ++ int dfd, ret, e; ++ size_t dlen; ++ ++ if (dry_run) return 0; ++ RETURN_ERROR_IF_RO_OR_LO; ++ ++ if (!am_daemon || am_chrooted) ++ return unlink(path); ++ ++ if (!path || !*path || *path == '/') ++ return unlink(path); ++ ++ slash = strrchr(path, '/'); ++ if (!slash) ++ return unlink(path); ++ ++ dlen = slash - path; ++ if (dlen >= sizeof dirpath) { ++ errno = ENAMETOOLONG; ++ return -1; ++ } ++ memcpy(dirpath, path, dlen); ++ dirpath[dlen] = '\0'; ++ bname = slash + 1; ++ ++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (dfd < 0) ++ return -1; ++ ++ ret = unlinkat(dfd, bname, 0); ++ e = errno; ++ close(dfd); ++ errno = e; ++ return ret; ++#else ++ return do_unlink(path); ++#endif ++} ++ + #ifdef SUPPORT_LINKS + int do_symlink(const char *lnk, const char *path) + { +@@ -117,6 +174,70 @@ int do_symlink(const char *lnk, const char *path) + return symlink(lnk, path); + } + ++/* ++ Symlink-race-safe variant of do_symlink() for receiver-side use. See ++ the comment on do_chmod_at() for the threat model. Only the parent ++ directory of `path` needs protection -- symlinkat() does not resolve ++ the final component (it creates it). Defence: open parent of `path` ++ under secure_relative_open() and call symlinkat() against that ++ dirfd. The link target string `lnk` is stored verbatim and not ++ resolved at creation time, so it doesn't need scrutiny here. ++ ++ Falls through to do_symlink() for the --fake-super (am_root < 0) ++ path -- that code path opens `path` with do_open() which has its ++ own (separate) symlink-race exposure tracked elsewhere. ++*/ ++int do_symlink_at(const char *lnk, const char *path) ++{ ++#ifdef AT_FDCWD ++ extern int am_daemon, am_chrooted; ++ char dirpath[MAXPATHLEN]; ++ const char *bname; ++ const char *slash; ++ int dfd, ret, e; ++ size_t dlen; ++ ++ if (dry_run) return 0; ++ RETURN_ERROR_IF_RO_OR_LO; ++ ++ if (!am_daemon || am_chrooted) ++ return do_symlink(lnk, path); ++ ++#if defined NO_SYMLINK_XATTRS || defined NO_SYMLINK_USER_XATTRS ++ if (am_root < 0) ++ return do_symlink(lnk, path); ++#endif ++ ++ if (!path || !*path || *path == '/') ++ return do_symlink(lnk, path); ++ ++ slash = strrchr(path, '/'); ++ if (!slash) ++ return do_symlink(lnk, path); ++ ++ dlen = slash - path; ++ if (dlen >= sizeof dirpath) { ++ errno = ENAMETOOLONG; ++ return -1; ++ } ++ memcpy(dirpath, path, dlen); ++ dirpath[dlen] = '\0'; ++ bname = slash + 1; ++ ++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (dfd < 0) ++ return -1; ++ ++ ret = symlinkat(lnk, dfd, bname); ++ e = errno; ++ close(dfd); ++ errno = e; ++ return ret; ++#else ++ return do_symlink(lnk, path); ++#endif ++} ++ + #if defined NO_SYMLINK_XATTRS || defined NO_SYMLINK_USER_XATTRS + ssize_t do_readlink(const char *path, char *buf, size_t bufsiz) + { +@@ -153,6 +274,106 @@ int do_link(const char *old_path, const char *new_path) + return link(old_path, new_path); + #endif + } ++ ++/* ++ Symlink-race-safe variant of do_link() for receiver-side use. See ++ the comment on do_chmod_at() for the threat model. link() resolves ++ parent components of *both* old_path and new_path, so a parent- ++ symlink swap on either side can plant the new hard link outside ++ the module, or hard-link an outside file into the module (read ++ disclosure). ++ ++ Defence: open each parent under secure_relative_open() and use ++ linkat() between the two dirfds, reusing one when the parents ++ match. flags=0 matches the existing do_link() (don't follow a ++ symbolic-link old_path). Only available on systems with linkat(); ++ pre-AT_FDCWD systems fall through to do_link(). ++*/ ++int do_link_at(const char *old_path, const char *new_path) ++{ ++#if defined AT_FDCWD && defined HAVE_LINKAT ++ extern int am_daemon, am_chrooted; ++ char old_dirpath[MAXPATHLEN], new_dirpath[MAXPATHLEN]; ++ const char *old_bname, *new_bname; ++ const char *old_slash, *new_slash; ++ int old_dfd = AT_FDCWD, new_dfd = AT_FDCWD; ++ BOOL old_owns = False, new_owns = False; ++ int ret, e; ++ size_t old_dlen = 0, new_dlen = 0; ++ ++ if (dry_run) return 0; ++ RETURN_ERROR_IF_RO_OR_LO; ++ ++ if (!am_daemon || am_chrooted) ++ return do_link(old_path, new_path); ++ ++ if (!old_path || !*old_path || *old_path == '/' ++ || !new_path || !*new_path || *new_path == '/') ++ return do_link(old_path, new_path); ++ ++ old_slash = strrchr(old_path, '/'); ++ new_slash = strrchr(new_path, '/'); ++ ++ /* Resolve each path's parent dir independently. A path without a ++ * slash lives in CWD (AT_FDCWD), no parent open required. A path ++ * with a slash needs secure_relative_open to confine its parent ++ * resolution -- otherwise a parent symlink (e.g. --link-dest=cd ++ * where cd -> /outside) lets the kernel-level linkat(AT_FDCWD, ++ * "cd/target.txt", ...) escape the module. */ ++ if (old_slash) { ++ old_dlen = old_slash - old_path; ++ if (old_dlen >= sizeof old_dirpath) { errno = ENAMETOOLONG; return -1; } ++ memcpy(old_dirpath, old_path, old_dlen); ++ old_dirpath[old_dlen] = '\0'; ++ old_bname = old_slash + 1; ++ old_dfd = secure_relative_open(NULL, old_dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (old_dfd < 0) ++ return -1; ++ old_owns = True; ++ } else { ++ old_bname = old_path; ++ } ++ ++ if (new_slash) { ++ new_dlen = new_slash - new_path; ++ if (new_dlen >= sizeof new_dirpath) { ++ e = ENAMETOOLONG; ++ if (old_owns) close(old_dfd); ++ errno = e; ++ return -1; ++ } ++ memcpy(new_dirpath, new_path, new_dlen); ++ new_dirpath[new_dlen] = '\0'; ++ new_bname = new_slash + 1; ++ if (old_owns && old_dlen == new_dlen ++ && memcmp(old_dirpath, new_dirpath, old_dlen) == 0) { ++ new_dfd = old_dfd; ++ } else { ++ new_dfd = secure_relative_open(NULL, new_dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (new_dfd < 0) { ++ e = errno; ++ if (old_owns) close(old_dfd); ++ errno = e; ++ return -1; ++ } ++ new_owns = True; ++ } ++ } else { ++ new_bname = new_path; ++ } ++ ++ ret = linkat(old_dfd, old_bname, new_dfd, new_bname, 0); ++ e = errno; ++ if (new_owns) ++ close(new_dfd); ++ if (old_owns) ++ close(old_dfd); ++ errno = e; ++ return ret; ++#else ++ return do_link(old_path, new_path); ++#endif ++} + #endif + + int do_lchown(const char *path, uid_t owner, gid_t group) +@@ -165,6 +386,66 @@ int do_lchown(const char *path, uid_t owner, gid_t group) + return lchown(path, owner, group); + } + ++/* ++ Symlink-race-safe variant of do_lchown() for receiver-side use. See the ++ comment on do_chmod_at() for the threat model and design rationale. ++ ++ Resolves the parent directory under secure_relative_open() and invokes ++ fchownat(..., AT_SYMLINK_NOFOLLOW) against that dirfd, so that an ++ attacker who substitutes a symlink into one of the parent components ++ cannot redirect the chown outside the receiver's confinement. The ++ AT_SYMLINK_NOFOLLOW flag matches lchown()'s "do not follow a final- ++ component symlink" semantics. ++ ++ Falls through to do_lchown() in the dry-run / non-daemon / chrooted / ++ absolute-path / no-parent cases, identical to do_chmod_at(). ++*/ ++int do_lchown_at(const char *fname, uid_t owner, gid_t group) ++{ ++#ifdef AT_FDCWD ++ extern int am_daemon, am_chrooted; ++ char dirpath[MAXPATHLEN]; ++ const char *bname; ++ const char *slash; ++ int dfd, ret, e; ++ size_t dlen; ++ ++ if (dry_run) return 0; ++ RETURN_ERROR_IF_RO_OR_LO; ++ ++ if (!am_daemon || am_chrooted) ++ return do_lchown(fname, owner, group); ++ ++ if (!fname || !*fname || *fname == '/') ++ return do_lchown(fname, owner, group); ++ ++ slash = strrchr(fname, '/'); ++ if (!slash) ++ return do_lchown(fname, owner, group); ++ ++ dlen = slash - fname; ++ if (dlen >= sizeof dirpath) { ++ errno = ENAMETOOLONG; ++ return -1; ++ } ++ memcpy(dirpath, fname, dlen); ++ dirpath[dlen] = '\0'; ++ bname = slash + 1; ++ ++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (dfd < 0) ++ return -1; ++ ++ ret = fchownat(dfd, bname, owner, group, AT_SYMLINK_NOFOLLOW); ++ e = errno; ++ close(dfd); ++ errno = e; ++ return ret; ++#else ++ return do_lchown(fname, owner, group); ++#endif ++} ++ + int do_mknod(const char *pathname, mode_t mode, dev_t dev) + { + if (dry_run) return 0; +@@ -215,6 +496,76 @@ int do_mknod(const char *pathname, mode_t mode, dev_t dev) + #endif + } + ++/* ++ Symlink-race-safe variant of do_mknod() for receiver-side use. See ++ the comment on do_chmod_at() for the threat model. Defence: open ++ the parent of pathname under secure_relative_open() and use ++ mknodat() against that dirfd. mknodat() covers both regular-file ++ (S_IFREG with dev=0) and FIFO (S_IFIFO) and device-node creation. ++ ++ Falls through to do_mknod() for fake-super (am_root < 0) and for ++ sockets, both of which use auxiliary path-based syscalls that ++ don't have an *at() variant in any portable form. ++*/ ++int do_mknod_at(const char *pathname, mode_t mode, dev_t dev) ++{ ++#ifdef AT_FDCWD ++ extern int am_daemon, am_chrooted; ++ char dirpath[MAXPATHLEN]; ++ const char *bname; ++ const char *slash; ++ int dfd, ret, e; ++ size_t dlen; ++ ++ if (dry_run) return 0; ++ RETURN_ERROR_IF_RO_OR_LO; ++ ++ if (!am_daemon || am_chrooted) ++ return do_mknod(pathname, mode, dev); ++ ++ if (am_root < 0) ++ return do_mknod(pathname, mode, dev); ++ ++#if !defined MKNOD_CREATES_SOCKETS && defined HAVE_SYS_UN_H ++ if (S_ISSOCK(mode)) ++ return do_mknod(pathname, mode, dev); ++#endif ++ ++ if (!pathname || !*pathname || *pathname == '/') ++ return do_mknod(pathname, mode, dev); ++ ++ slash = strrchr(pathname, '/'); ++ if (!slash) ++ return do_mknod(pathname, mode, dev); ++ ++ dlen = slash - pathname; ++ if (dlen >= sizeof dirpath) { ++ errno = ENAMETOOLONG; ++ return -1; ++ } ++ memcpy(dirpath, pathname, dlen); ++ dirpath[dlen] = '\0'; ++ bname = slash + 1; ++ ++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (dfd < 0) ++ return -1; ++ ++#if !defined MKNOD_CREATES_FIFOS && defined HAVE_MKFIFO ++ if (S_ISFIFO(mode)) ++ ret = mkfifoat(dfd, bname, mode); ++ else ++#endif ++ ret = mknodat(dfd, bname, mode, dev); ++ e = errno; ++ close(dfd); ++ errno = e; ++ return ret; ++#else ++ return do_mknod(pathname, mode, dev); ++#endif ++} ++ + int do_rmdir(const char *pathname) + { + if (dry_run) return 0; +@@ -222,6 +573,57 @@ int do_rmdir(const char *pathname) + return rmdir(pathname); + } + ++/* ++ Symlink-race-safe variant of do_rmdir(). See do_unlink_at() above; ++ same shape but with AT_REMOVEDIR set to require the target be a ++ directory. ++*/ ++int do_rmdir_at(const char *pathname) ++{ ++#ifdef AT_FDCWD ++ extern int am_daemon, am_chrooted; ++ char dirpath[MAXPATHLEN]; ++ const char *bname; ++ const char *slash; ++ int dfd, ret, e; ++ size_t dlen; ++ ++ if (dry_run) return 0; ++ RETURN_ERROR_IF_RO_OR_LO; ++ ++ if (!am_daemon || am_chrooted) ++ return rmdir(pathname); ++ ++ if (!pathname || !*pathname || *pathname == '/') ++ return rmdir(pathname); ++ ++ slash = strrchr(pathname, '/'); ++ if (!slash) ++ return rmdir(pathname); ++ ++ dlen = slash - pathname; ++ if (dlen >= sizeof dirpath) { ++ errno = ENAMETOOLONG; ++ return -1; ++ } ++ memcpy(dirpath, pathname, dlen); ++ dirpath[dlen] = '\0'; ++ bname = slash + 1; ++ ++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (dfd < 0) ++ return -1; ++ ++ ret = unlinkat(dfd, bname, AT_REMOVEDIR); ++ e = errno; ++ close(dfd); ++ errno = e; ++ return ret; ++#else ++ return do_rmdir(pathname); ++#endif ++} ++ + int do_open(const char *pathname, int flags, mode_t mode) + { + if (flags != O_RDONLY) { +@@ -370,6 +772,89 @@ int do_rename(const char *old_path, const char *new_path) + return rename(old_path, new_path); + } + ++/* ++ Symlink-race-safe variant of do_rename() for receiver-side use. See ++ the comment on do_chmod_at() for the threat model and design rationale. ++ ++ rename() is the central tmp -> final operation in rsync; if either the ++ source or the destination has an attacker-substituted symlink in one ++ of its parent components, the rename can publish or vanish files ++ outside the module. Defence: open the parent of *each* path under ++ secure_relative_open() and use renameat() against the resulting ++ dirfds. When old_path and new_path share the same parent (the common ++ case -- tmp file living next to its final name), we reuse the same ++ dirfd for both sides. ++ ++ Falls through to do_rename() in dry-run, non-daemon, chrooted, no- ++ parent and absolute-path cases, identical to the other do_*_at() ++ wrappers. ++*/ ++int do_rename_at(const char *old_path, const char *new_path) ++{ ++#ifdef AT_FDCWD ++ extern int am_daemon, am_chrooted; ++ char old_dirpath[MAXPATHLEN], new_dirpath[MAXPATHLEN]; ++ const char *old_bname, *new_bname; ++ const char *old_slash, *new_slash; ++ int old_dfd = -1, new_dfd = -1, ret = -1, e; ++ size_t old_dlen, new_dlen; ++ ++ if (dry_run) return 0; ++ RETURN_ERROR_IF_RO_OR_LO; ++ ++ if (!am_daemon || am_chrooted) ++ return do_rename(old_path, new_path); ++ ++ if (!old_path || !*old_path || *old_path == '/' ++ || !new_path || !*new_path || *new_path == '/') ++ return do_rename(old_path, new_path); ++ ++ old_slash = strrchr(old_path, '/'); ++ new_slash = strrchr(new_path, '/'); ++ if (!old_slash || !new_slash) ++ return do_rename(old_path, new_path); ++ ++ old_dlen = old_slash - old_path; ++ new_dlen = new_slash - new_path; ++ if (old_dlen >= sizeof old_dirpath || new_dlen >= sizeof new_dirpath) { ++ errno = ENAMETOOLONG; ++ return -1; ++ } ++ memcpy(old_dirpath, old_path, old_dlen); ++ old_dirpath[old_dlen] = '\0'; ++ memcpy(new_dirpath, new_path, new_dlen); ++ new_dirpath[new_dlen] = '\0'; ++ old_bname = old_slash + 1; ++ new_bname = new_slash + 1; ++ ++ old_dfd = secure_relative_open(NULL, old_dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (old_dfd < 0) ++ return -1; ++ ++ if (old_dlen == new_dlen && memcmp(old_dirpath, new_dirpath, old_dlen) == 0) { ++ new_dfd = old_dfd; ++ } else { ++ new_dfd = secure_relative_open(NULL, new_dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (new_dfd < 0) { ++ e = errno; ++ close(old_dfd); ++ errno = e; ++ return -1; ++ } ++ } ++ ++ ret = renameat(old_dfd, old_bname, new_dfd, new_bname); ++ e = errno; ++ if (new_dfd != old_dfd) ++ close(new_dfd); ++ close(old_dfd); ++ errno = e; ++ return ret; ++#else ++ return do_rename(old_path, new_path); ++#endif ++} ++ + #ifdef HAVE_FTRUNCATE + int do_ftruncate(int fd, OFF_T size) + { +@@ -412,6 +897,66 @@ int do_mkdir(char *path, mode_t mode) + return mkdir(path, mode); + } + ++/* ++ Symlink-race-safe variant of do_mkdir() for receiver-side use. See ++ the comment on do_chmod_at() for the threat model and design rationale. ++ ++ mkdir() resolves parent symlinks at every component, so a parent- ++ component swap can place an attacker-named directory outside the ++ module. Defence: open the parent of fname under secure_relative_open() ++ and call mkdirat() against that dirfd. ++ ++ Mutates path in place to trim trailing slashes (matches do_mkdir()). ++ Falls through to do_mkdir() in dry-run, non-daemon, chrooted, no- ++ parent and absolute-path cases. ++*/ ++int do_mkdir_at(char *path, mode_t mode) ++{ ++#ifdef AT_FDCWD ++ extern int am_daemon, am_chrooted; ++ char dirpath[MAXPATHLEN]; ++ const char *bname; ++ const char *slash; ++ int dfd, ret, e; ++ size_t dlen; ++ ++ if (dry_run) return 0; ++ RETURN_ERROR_IF_RO_OR_LO; ++ trim_trailing_slashes(path); ++ ++ if (!am_daemon || am_chrooted) ++ return mkdir(path, mode); ++ ++ if (!path || !*path || *path == '/') ++ return mkdir(path, mode); ++ ++ slash = strrchr(path, '/'); ++ if (!slash) ++ return mkdir(path, mode); ++ ++ dlen = slash - path; ++ if (dlen >= sizeof dirpath) { ++ errno = ENAMETOOLONG; ++ return -1; ++ } ++ memcpy(dirpath, path, dlen); ++ dirpath[dlen] = '\0'; ++ bname = slash + 1; ++ ++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (dfd < 0) ++ return -1; ++ ++ ret = mkdirat(dfd, bname, mode); ++ e = errno; ++ close(dfd); ++ errno = e; ++ return ret; ++#else ++ return do_mkdir(path, mode); ++#endif ++} ++ + /* like mkstemp but forces permissions */ + int do_mkstemp(char *template, mode_t perms) + { +@@ -465,6 +1010,76 @@ int do_lstat(const char *path, STRUCT_STAT *st) + #endif + } + ++/* ++ Symlink-race-safe variants of do_stat() / do_lstat() for receiver- ++ side use. See the comment on do_chmod_at() for the threat model. ++ stat() and lstat() resolve parent components, so a parent-symlink ++ swap can make the receiver's stat see attributes of a victim file ++ outside the module -- which then drives later behaviour (e.g. ++ "this isn't a directory, delete it" -> attacker-controlled unlink ++ on something outside the module). ++ ++ Defence: open the parent under secure_relative_open() and use ++ fstatat() with AT_SYMLINK_NOFOLLOW (lstat) or 0 (stat) against ++ that dirfd. Same fall-through gating as the other wrappers. ++*/ ++static int do_xstat_at(const char *path, STRUCT_STAT *st, int at_flags, int (*fallback)(const char *, STRUCT_STAT *)) ++{ ++#ifdef AT_FDCWD ++ extern int am_daemon, am_chrooted; ++ char dirpath[MAXPATHLEN]; ++ const char *bname; ++ const char *slash; ++ int dfd, ret, e; ++ size_t dlen; ++ ++ if (!am_daemon || am_chrooted) ++ return fallback(path, st); ++ ++ if (!path || !*path || *path == '/') ++ return fallback(path, st); ++ ++ slash = strrchr(path, '/'); ++ if (!slash) ++ return fallback(path, st); ++ ++ dlen = slash - path; ++ if (dlen >= sizeof dirpath) { ++ errno = ENAMETOOLONG; ++ return -1; ++ } ++ memcpy(dirpath, path, dlen); ++ dirpath[dlen] = '\0'; ++ bname = slash + 1; ++ ++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (dfd < 0) ++ return -1; ++ ++ ret = fstatat(dfd, bname, st, at_flags); ++ e = errno; ++ close(dfd); ++ errno = e; ++ return ret; ++#else ++ return fallback(path, st); ++#endif ++} ++ ++int do_stat_at(const char *path, STRUCT_STAT *st) ++{ ++ return do_xstat_at(path, st, 0, do_stat); ++} ++ ++int do_lstat_at(const char *path, STRUCT_STAT *st) ++{ ++#ifdef SUPPORT_LINKS ++ return do_xstat_at(path, st, AT_SYMLINK_NOFOLLOW, do_lstat); ++#else ++ return do_xstat_at(path, st, 0, do_stat); ++#endif ++} ++ + int do_fstat(int fd, STRUCT_STAT *st) + { + #ifdef USE_STAT64_FUNCS +@@ -486,12 +1101,26 @@ OFF_T do_lseek(int fd, OFF_T offset, int whence) + #ifdef HAVE_SETATTRLIST + int do_setattrlist_times(const char *path, STRUCT_STAT *stp) + { ++ extern int am_daemon, am_chrooted; + struct attrlist attrList; + struct timespec ts[2]; + + if (dry_run) return 0; + RETURN_ERROR_IF_RO_OR_LO; + ++ /* setattrlist() takes a raw path and follows parent symlinks ++ * (FSOPT_NOFOLLOW only blocks the final component). On a ++ * daemon-no-chroot deployment, return ENOSYS so set_times()' ++ * tier walk falls through to do_utimensat_at(), which routes ++ * the timestamp update through a secure parent dirfd. The ++ * macOS-specific attribute set this function would have used ++ * (ATTR_CMN_MODTIME / ATTR_CMN_ACCTIME) is the same set ++ * utimensat() handles, so no functionality is lost. */ ++ if (am_daemon && !am_chrooted) { ++ errno = ENOSYS; ++ return -1; ++ } ++ + /* Yes, this is in the opposite order of utime and similar. */ + ts[0].tv_sec = stp->st_mtime; + ts[0].tv_nsec = stp->ST_MTIME_NSEC; +@@ -508,12 +1137,25 @@ int do_setattrlist_times(const char *path, STRUCT_STAT *stp) + #ifdef SUPPORT_CRTIMES + int do_setattrlist_crtime(const char *path, time_t crtime) + { ++ extern int am_daemon, am_chrooted; + struct attrlist attrList; + struct timespec ts; + + if (dry_run) return 0; + RETURN_ERROR_IF_RO_OR_LO; + ++ /* Same path-follows-parent-symlinks concern as ++ * do_setattrlist_times. There is no portable at-aware variant ++ * of setattrlist that targets ATTR_CMN_CRTIME, so on a ++ * daemon-no-chroot deployment we return -1 and accept that ++ * crtime preservation is silently dropped for that file (the ++ * caller treats this as "crtime not updated"). The transfer ++ * itself continues normally. */ ++ if (am_daemon && !am_chrooted) { ++ errno = ENOSYS; ++ return -1; ++ } ++ + ts.tv_sec = crtime; + ts.tv_nsec = 0; + +@@ -529,10 +1171,19 @@ int do_setattrlist_crtime(const char *path, time_t crtime) + time_t get_create_time(const char *path, STRUCT_STAT *stp) + { + #ifdef HAVE_GETATTRLIST ++ extern int am_daemon, am_chrooted; + static struct create_time attrBuf; + struct attrlist attrList; + + (void)stp; ++ /* getattrlist() is also path-based and follows parent ++ * symlinks. In daemon-no-chroot, refuse rather than read the ++ * crtime of a file the parent-symlink chain might point at ++ * outside the module. The caller's "no crtime available" ++ * path returns 0; the file gets a fresh crtime instead of ++ * preserving the source's. */ ++ if (am_daemon && !am_chrooted) ++ return 0; + memset(&attrList, 0, sizeof attrList); + attrList.bitmapcount = ATTR_BIT_MAP_COUNT; + attrList.commonattr = ATTR_CMN_CRTIME; +@@ -598,6 +1249,81 @@ int do_utimensat(const char *path, STRUCT_STAT *stp) + #endif + return utimensat(AT_FDCWD, path, t, AT_SYMLINK_NOFOLLOW); + } ++ ++/* ++ Symlink-race-safe variant of do_utimensat() for receiver-side use. ++ See the comment on do_chmod_at() for the threat model. utimes() ++ resolves parent components and follows a final-component symlink; ++ lutimes() doesn't follow the final component but still resolves ++ parents. Either way, a parent-symlink swap can redirect the ++ timestamp update outside the module. Defence: open the parent of ++ path under secure_relative_open() and call utimensat() with ++ AT_SYMLINK_NOFOLLOW against that dirfd. ++ ++ Falls through to do_utimensat() in the same dry-run / non-daemon / ++ chrooted / no-parent / absolute-path cases as the other wrappers. ++ Returns -1 with errno=ENOSYS on systems without utimensat() ++ (caller is expected to fall back to the legacy tier walk). ++*/ ++int do_utimensat_at(const char *path, STRUCT_STAT *stp) ++{ ++#ifdef AT_FDCWD ++ extern int am_daemon, am_chrooted; ++ struct timespec t[2]; ++ char dirpath[MAXPATHLEN]; ++ const char *bname; ++ const char *slash; ++ int dfd, ret, e; ++ size_t dlen; ++ ++ if (dry_run) return 0; ++ RETURN_ERROR_IF_RO_OR_LO; ++ ++ if (!am_daemon || am_chrooted) ++ return do_utimensat(path, stp); ++ ++ if (!path || !*path || *path == '/') ++ return do_utimensat(path, stp); ++ ++ slash = strrchr(path, '/'); ++ if (!slash) ++ return do_utimensat(path, stp); ++ ++ dlen = slash - path; ++ if (dlen >= sizeof dirpath) { ++ errno = ENAMETOOLONG; ++ return -1; ++ } ++ memcpy(dirpath, path, dlen); ++ dirpath[dlen] = '\0'; ++ bname = slash + 1; ++ ++ t[0].tv_sec = stp->st_atime; ++#ifdef ST_ATIME_NSEC ++ t[0].tv_nsec = stp->ST_ATIME_NSEC; ++#else ++ t[0].tv_nsec = 0; ++#endif ++ t[1].tv_sec = stp->st_mtime; ++#ifdef ST_MTIME_NSEC ++ t[1].tv_nsec = stp->ST_MTIME_NSEC; ++#else ++ t[1].tv_nsec = 0; ++#endif ++ ++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (dfd < 0) ++ return -1; ++ ++ ret = utimensat(dfd, bname, t, AT_SYMLINK_NOFOLLOW); ++ e = errno; ++ close(dfd); ++ errno = e; ++ return ret; ++#else ++ return do_utimensat(path, stp); ++#endif ++} + #endif + + #ifdef HAVE_LUTIMES +@@ -820,6 +1546,30 @@ int do_open_nofollow(const char *pathname, int flags) + The relpath must also not contain any ../ elements in the path. + */ + ++/* Returns 1 if path has any "/"-separated component that is exactly ++ * "..", 0 otherwise. Used by secure_relative_open's front-door ++ * validation to reject inputs that the per-component walk fallback ++ * would otherwise resolve through ".." -- e.g. bare "..", "foo/..", ++ * "subdir/.." -- which RESOLVE_BENEATH-equivalent kernels reject in ++ * the kernel but the per-component fallback (NetBSD/OpenBSD/Solaris/ ++ * Cygwin/pre-5.6 Linux) does not. */ ++static int path_has_dotdot_component(const char *path) ++{ ++ const char *p = path; ++ ++ while (*p) { ++ const char *q; ++ if (*p == '/') { p++; continue; } ++ q = p; ++ while (*q && *q != '/') ++ q++; ++ if (q - p == 2 && p[0] == '.' && p[1] == '.') ++ return 1; ++ p = q; ++ } ++ return 0; ++} ++ + #ifdef __linux__ + static int secure_relative_open_linux(const char *basedir, const char *relpath, int flags, mode_t mode) + { +@@ -833,10 +1583,25 @@ static int secure_relative_open_linux(const char *basedir, const char *relpath, + + if (basedir == NULL) { + dirfd = AT_FDCWD; +- } else { ++ } else if (basedir[0] == '/') { ++ /* Absolute basedir: operator-trusted (module_dir and the ++ * like). Plain openat. */ + dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY); + if (dirfd == -1) + return -1; ++ } else { ++ /* Relative basedir: may be wire-influenced via ++ * --link-dest / --copy-dest / --compare-dest. Resolve it ++ * under the same RESOLVE_BENEATH guarantee as relpath, so ++ * a parent symlink on basedir cannot redirect the dirfd ++ * outside the CWD anchor. */ ++ struct open_how bhow; ++ memset(&bhow, 0, sizeof bhow); ++ bhow.flags = O_RDONLY | O_DIRECTORY; ++ bhow.resolve = RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS; ++ dirfd = syscall(SYS_openat2, AT_FDCWD, basedir, &bhow, sizeof bhow); ++ if (dirfd == -1) ++ return -1; + } + + retfd = syscall(SYS_openat2, dirfd, relpath, &how, sizeof how); +@@ -859,10 +1624,17 @@ static int secure_relative_open_resolve_beneath(const char *basedir, const char + + if (basedir == NULL) { + dirfd = AT_FDCWD; +- } else { ++ } else if (basedir[0] == '/') { ++ /* Absolute basedir: operator-trusted, plain openat. */ + dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY); + if (dirfd == -1) + return -1; ++ } else { ++ /* Relative basedir: confine its resolution beneath CWD ++ * (see secure_relative_open_linux for the rationale). */ ++ dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY | O_RESOLVE_BENEATH); ++ if (dirfd == -1) ++ return -1; + } + + retfd = openat(dirfd, relpath, flags | O_RESOLVE_BENEATH, mode); +@@ -880,8 +1652,20 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo + errno = EINVAL; + return -1; + } +- if (strncmp(relpath, "../", 3) == 0 || strstr(relpath, "/../")) { +- // no ../ elements allowed in the relpath ++ /* Reject any path with a literal ".." component (bare "..", ++ * "../foo", "foo/..", "foo/../bar", "subdir/.."). The previous ++ * substring-based check caught only "../" prefix and "/../" ++ * substring; bare ".." and trailing "/.." escape on the per- ++ * component walk fallback used by NetBSD/OpenBSD/Solaris/Cygwin ++ * and pre-5.6 Linux. RESOLVE_BENEATH on Linux/FreeBSD/macOS ++ * catches some of these in-kernel with EXDEV, but the front ++ * door must reject them consistently with EINVAL across all ++ * platforms so callers can rely on the validation. */ ++ if (path_has_dotdot_component(relpath)) { ++ errno = EINVAL; ++ return -1; ++ } ++ if (basedir && basedir[0] != '/' && path_has_dotdot_component(basedir)) { + errno = EINVAL; + return -1; + } +@@ -911,15 +1695,47 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo + #else + int dirfd = AT_FDCWD; + if (basedir != NULL) { +- dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY); +- if (dirfd == -1) { +- return -1; ++ if (basedir[0] == '/') { ++ /* Absolute basedir: operator-trusted, plain openat. */ ++ dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY); ++ if (dirfd == -1) { ++ return -1; ++ } ++ } else { ++ /* Relative basedir: walk it component-by-component ++ * with O_NOFOLLOW. This is the per-component ++ * RESOLVE_BENEATH equivalent for platforms without ++ * kernel-supported confinement, and matches the ++ * relpath walk below. Symlinks in basedir are ++ * rejected outright on this fallback path; the ++ * Linux openat2 / O_RESOLVE_BENEATH paths above ++ * still allow within-tree symlinks. */ ++ char *bcopy = my_strdup(basedir, __FILE__, __LINE__); ++ if (!bcopy) ++ return -1; ++ for (const char *part = strtok(bcopy, "/"); ++ part != NULL; ++ part = strtok(NULL, "/")) ++ { ++ int next_fd = openat(dirfd, part, O_RDONLY | O_DIRECTORY | O_NOFOLLOW); ++ if (next_fd == -1) { ++ int save_errno = errno; ++ if (dirfd != AT_FDCWD) close(dirfd); ++ free(bcopy); ++ errno = save_errno; ++ return -1; ++ } ++ if (dirfd != AT_FDCWD) close(dirfd); ++ dirfd = next_fd; ++ } ++ free(bcopy); + } + } + int retfd = -1; + + char *path_copy = my_strdup(relpath, __FILE__, __LINE__); + if (!path_copy) { ++ if (dirfd != AT_FDCWD) close(dirfd); + return -1; + } + +@@ -945,8 +1761,15 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo + dirfd = next_fd; + } + +- // the path must be a directory +- errno = EINVAL; ++ /* All components walked as directories. If the caller asked for ++ * O_DIRECTORY, return the dirfd we built up; otherwise the path ++ * resolved to a directory but the caller wanted a regular file. */ ++ if ((flags & O_DIRECTORY) && dirfd != AT_FDCWD) { ++ retfd = dirfd; ++ dirfd = AT_FDCWD; ++ goto cleanup; ++ } ++ errno = EISDIR; + + cleanup: + free(path_copy); +diff --git a/t_secure_relpath.c b/t_secure_relpath.c +new file mode 100644 +index 00000000..a0fdf0d2 +--- /dev/null ++++ b/t_secure_relpath.c +@@ -0,0 +1,151 @@ ++/* ++ * Test harness for secure_relative_open()'s front-door input ++ * validation. Codex audit Finding 5 noted that the existing check ++ * ++ * if (strncmp(relpath, "../", 3) == 0 || strstr(relpath, "/../")) ++ * ++ * catches "../foo" and "foo/../bar" but misses bare ".." (an actual ++ * one-level escape on platforms that fall back to the per-component ++ * walk), as well as "a/..", "foo/..", and any other form that ++ * decomposes to a ".." component when split on "/". The kernel- ++ * enforced RESOLVE_BENEATH (Linux 5.6+) and O_RESOLVE_BENEATH ++ * (FreeBSD 13+, macOS 15+) reject these in-kernel; the per- ++ * component fallback used on NetBSD, OpenBSD, Solaris, Cygwin and ++ * pre-5.6 Linux does not, so the validation must happen at the ++ * front door. ++ * ++ * This helper invokes secure_relative_open() with each suspect ++ * input and checks both the failure (rc < 0) and the errno ++ * (EINVAL means "rejected at the front door"). Pre-fix, the kernel ++ * may reject with a different errno (EXDEV from RESOLVE_BENEATH); ++ * post-fix, the front-door check catches every variant up front ++ * with a consistent EINVAL across platforms. ++ * ++ * Not linked into rsync itself. ++ */ ++ ++#include "rsync.h" ++ ++#include ++ ++int dry_run = 0; ++int am_root = 0; ++int am_sender = 0; ++int read_only = 0; ++int list_only = 0; ++int copy_links = 0; ++int copy_unsafe_links = 0; ++extern int am_daemon, am_chrooted; ++ ++short info_levels[COUNT_INFO], debug_levels[COUNT_DEBUG]; ++ ++static int errs = 0; ++ ++static void check_relpath(const char *relpath) ++{ ++ int fd; ++ int saved_errno; ++ ++ errno = 0; ++ fd = secure_relative_open(NULL, relpath, O_RDONLY | O_DIRECTORY, 0); ++ saved_errno = errno; ++ ++ if (fd >= 0) { ++ fprintf(stderr, ++ "FAIL [relpath=%-12s]: returned valid fd %d (escape) -- expected -1 EINVAL\n", ++ relpath, fd); ++ close(fd); ++ errs++; ++ return; ++ } ++ ++ if (saved_errno != EINVAL) { ++ fprintf(stderr, ++ "FAIL [relpath=%-12s]: rejected but errno=%d (%s), expected EINVAL\n", ++ relpath, saved_errno, strerror(saved_errno)); ++ errs++; ++ return; ++ } ++ ++ fprintf(stderr, "OK [relpath=%-12s]: rejected with EINVAL\n", relpath); ++} ++ ++static void check_basedir(const char *basedir) ++{ ++ int fd; ++ int saved_errno; ++ ++ errno = 0; ++ fd = secure_relative_open(basedir, "ok", O_RDONLY | O_DIRECTORY, 0); ++ saved_errno = errno; ++ ++ if (fd >= 0) { ++ fprintf(stderr, ++ "FAIL [basedir=%-12s]: returned valid fd %d -- expected -1 EINVAL\n", ++ basedir, fd); ++ close(fd); ++ errs++; ++ return; ++ } ++ ++ if (saved_errno != EINVAL) { ++ fprintf(stderr, ++ "FAIL [basedir=%-12s]: rejected but errno=%d (%s), expected EINVAL\n", ++ basedir, saved_errno, strerror(saved_errno)); ++ errs++; ++ return; ++ } ++ ++ fprintf(stderr, "OK [basedir=%-12s]: rejected with EINVAL\n", basedir); ++} ++ ++int main(int argc, char **argv) ++{ ++ if (argc != 2) { ++ fprintf(stderr, "usage: %s \n", argv[0]); ++ return 2; ++ } ++ if (chdir(argv[1]) < 0) { ++ perror("chdir"); ++ return 2; ++ } ++ ++ /* secure_relative_open's daemon-only confinement protections only ++ * fire when am_daemon && !am_chrooted (the threat model is the ++ * daemon-no-chroot deployment), but the front-door input ++ * validation runs unconditionally. We set am_daemon anyway so the ++ * helper exercises the same code shape the receiver does. */ ++ am_daemon = 1; ++ am_chrooted = 0; ++ ++ mkdir("subdir", 0755); ++ ++ /* Each of these relpaths must be rejected with EINVAL at the ++ * secure_relative_open() front door. ".." is the actual one-level ++ * escape; the others ("subdir/..", "subdir/../subdir") resolve ++ * back to the start dir on systems that allow them, but we still ++ * reject them as defence-in-depth: a path containing a ".." token ++ * is suspicious and the caller should normalise before passing ++ * it in. The "../foo" / "foo/../bar" / "/foo" / "/" cases are ++ * regression checks for the existing checks. */ ++ check_relpath(".."); ++ check_relpath("../foo"); ++ check_relpath("subdir/.."); ++ check_relpath("subdir/../subdir"); ++ check_relpath("foo/../bar"); ++ check_relpath("/foo"); ++ check_relpath("/"); ++ ++ /* Same checks against basedir (which the codex Finding 2 fix ++ * routes through the same RESOLVE_BENEATH-equivalent). Absolute ++ * basedirs are operator-trusted and intentionally not validated ++ * here. */ ++ check_basedir(".."); ++ check_basedir("../subdir"); ++ check_basedir("subdir/.."); ++ check_basedir("foo/../bar"); ++ ++ if (errs) ++ fprintf(stderr, "\n%d failure(s)\n", errs); ++ return errs ? 1 : 0; ++} +diff --git a/testsuite/alt-dest-symlink-race.test b/testsuite/alt-dest-symlink-race.test +new file mode 100755 +index 00000000..2256f2f2 +--- /dev/null ++++ b/testsuite/alt-dest-symlink-race.test +@@ -0,0 +1,96 @@ ++#!/bin/sh ++ ++# Copyright (C) 2026 by Andrew Tridgell ++ ++# This program is distributable under the terms of the GNU GPL (see ++# COPYING). ++ ++# Regression test for the basedir-confinement gap in ++# secure_relative_open(). The function opens basedir with a plain ++# openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY), without ++# RESOLVE_BENEATH or a per-component O_NOFOLLOW walk, so a parent ++# symlink ON basedir is followed unrestrictedly. RESOLVE_BENEATH is ++# then applied only to relpath, anchored at the wrong directory. ++# ++# The receiver's basis-file lookup at receiver.c passes ++# basis_dir[fnamecmp_type] (from --copy-dest / --link-dest / ++# --compare-dest -- all sender-controllable in daemon mode) as ++# basedir. A daemon-module attacker with write access can plant a ++# symlink at module/cd -> /outside, then run --link-dest=cd to ++# make the daemon's basis-file lookup resolve into /outside, ++# leaking the contents of daemon-readable files via the rsync ++# delta-rolling read-disclosure primitive. ++# ++# We detect the escape by leveraging --link-dest: when basis ++# matches source exactly (content + mtime + mode), --link-dest ++# hard-links the destination to the basis file. With the bug, the ++# destination ends up as a hard link to the outside-the-module ++# file (same inode). With the fix, no basis is found and the ++# destination is a fresh copy (different inode). ++# ++# The vulnerable code path is the same on every platform ++# (including the per-component fallback on systems without ++# RESOLVE_BENEATH), so this test is not platform-gated. ++ ++. "$suitedir/rsync.fns" ++ ++mod="$scratchdir/module" ++outside="$scratchdir/outside" ++src="$scratchdir/src" ++conf="$scratchdir/test-rsyncd.conf" ++ ++rm -rf "$mod" "$outside" "$src" ++mkdir -p "$mod" "$outside" "$src" ++ ++# Portable inode-number helper (GNU coreutils stat -c, BSD stat -f). ++file_inode() { ++ stat -c %i "$1" 2>/dev/null || stat -f %i "$1" ++} ++ ++# Outside-the-module file an attacker would like the daemon to ++# treat as a basis. ++echo "OUTSIDE_SECRET_DATA" > "$outside/target.txt" ++chmod 0644 "$outside/target.txt" ++ ++# The symlink trap planted in the module by the local attacker. ++ln -s "$outside" "$mod/cd" ++ ++# Source file matches outside/target.txt exactly (content + mtime ++# + mode) so --link-dest will hard-link the destination to the ++# basis file iff the daemon's basedir lookup reaches outside/. ++echo "OUTSIDE_SECRET_DATA" > "$src/target.txt" ++touch -r "$outside/target.txt" "$src/target.txt" ++chmod 0644 "$src/target.txt" ++ ++cat > "$conf" </dev/null 2>&1 || true ++ ++if [ ! -f "$mod/target.txt" ]; then ++ test_fail "destination file was not created -- daemon transfer failed before the test could observe the basedir behaviour" ++fi ++ ++outside_inode=$(file_inode "$outside/target.txt") ++dst_inode=$(file_inode "$mod/target.txt") ++ ++if [ "$outside_inode" = "$dst_inode" ]; then ++ test_fail "basedir-escape: --link-dest hard-linked module/target.txt to outside/target.txt (inode $outside_inode); daemon's basis-file lookup followed the parent symlink on the basedir" ++fi ++ ++exit 0 +diff --git a/testsuite/secure-relpath-validation.test b/testsuite/secure-relpath-validation.test +new file mode 100755 +index 00000000..5b77f7cc +--- /dev/null ++++ b/testsuite/secure-relpath-validation.test +@@ -0,0 +1,34 @@ ++#!/bin/sh ++ ++# Copyright (C) 2026 by Andrew Tridgell ++ ++# This program is distributable under the terms of the GNU GPL (see ++# COPYING). ++ ++# Regression test for codex audit Finding 5: secure_relative_open()'s ++# front-door input check rejects "../foo" and "foo/../bar" but ++# misses bare "..", "subdir/..", and other variants whose "/"-split ++# components contain a literal "..". The kernel-enforced ++# RESOLVE_BENEATH (Linux 5.6+) and O_RESOLVE_BENEATH ++# (FreeBSD 13+, macOS 15+) reject these in-kernel; the per-component ++# walk fallback used on NetBSD, OpenBSD, Solaris, Cygwin and pre-5.6 ++# Linux does not -- so the validation must happen at the front door. ++# ++# This test invokes the t_secure_relpath helper, which calls ++# secure_relative_open() with each suspect input and verifies the ++# return value is -1 with errno == EINVAL. EINVAL is the marker ++# that the front-door rejected the input, not the kernel; pre-fix ++# the kernel returns -1 with EXDEV (or, on the per-component ++# fallback, may return a valid fd at all -- "escape"). ++ ++. "$suitedir/rsync.fns" ++ ++testdir="$scratchdir/relpath-test" ++rm -rf "$testdir" ++mkdir -p "$testdir" ++ ++if ! "$TOOLDIR/t_secure_relpath" "$testdir"; then ++ test_fail "t_secure_relpath rejected one or more inputs incorrectly (see stderr above for the specific case)" ++fi ++ ++exit 0 +diff --git a/util1.c b/util1.c +index 6e457d4f..8850019f 100644 +--- a/util1.c ++++ b/util1.c +@@ -141,7 +141,7 @@ int set_times(const char *fname, STRUCT_STAT *stp) + + #ifdef HAVE_UTIMENSAT + #include "case_N.h" +- if (do_utimensat(fname, stp) == 0) ++ if (do_utimensat_at(fname, stp) == 0) + break; + if (errno != ENOSYS) + return -1; +@@ -479,13 +479,13 @@ int copy_file(const char *source, const char *dest, int tmpfilefd, mode_t mode) + int robust_unlink(const char *fname) + { + #ifndef ETXTBSY +- return do_unlink(fname); ++ return do_unlink_at(fname); + #else + static int counter = 1; + int rc, pos, start; + char path[MAXPATHLEN]; + +- rc = do_unlink(fname); ++ rc = do_unlink_at(fname); + if (rc == 0 || errno != ETXTBSY) + return rc; + +@@ -515,7 +515,7 @@ int robust_unlink(const char *fname) + } + + /* maybe we should return rename()'s exit status? Nah. */ +- if (do_rename(fname, path) != 0) { ++ if (do_rename_at(fname, path) != 0) { + errno = ETXTBSY; + return -1; + } +@@ -538,7 +538,7 @@ int robust_rename(const char *from, const char *to, const char *partialptr, + return 0; + + while (tries--) { +- if (do_rename(from, to) == 0) ++ if (do_rename_at(from, to) == 0) + return 0; + + switch (errno) { +@@ -559,7 +559,7 @@ int robust_rename(const char *from, const char *to, const char *partialptr, + } + if (copy_file(from, to, -1, mode) != 0) + return -2; +- do_unlink(from); ++ do_unlink_at(from); + return 1; + default: + return -1; +@@ -1329,20 +1329,20 @@ int handle_partial_dir(const char *fname, int create) + dir = partial_fname; + if (create) { + STRUCT_STAT st; +- int statret = do_lstat(dir, &st); ++ int statret = do_lstat_at(dir, &st); + if (statret == 0 && !S_ISDIR(st.st_mode)) { +- if (do_unlink(dir) < 0) { ++ if (do_unlink_at(dir) < 0) { + *fn = '/'; + return 0; + } + statret = -1; + } +- if (statret < 0 && do_mkdir(dir, 0700) < 0) { ++ if (statret < 0 && do_mkdir_at(dir, 0700) < 0) { + *fn = '/'; + return 0; + } + } else +- do_rmdir(dir); ++ do_rmdir_at(dir); + *fn = '/'; + + return 1; +diff --git a/xattrs.c b/xattrs.c +index 4462d63b..2e16024b 100644 +--- a/xattrs.c ++++ b/xattrs.c +@@ -1249,7 +1249,12 @@ int set_stat_xattr(const char *fname, struct file_struct *file, mode_t new_mode) + + int x_stat(const char *fname, STRUCT_STAT *fst, STRUCT_STAT *xst) + { +- int ret = do_stat(fname, fst); ++ /* Use the *_at variants so that on a daemon-no-chroot deployment ++ * the metadata read goes through a secure parent dirfd instead ++ * of bare path resolution. The *_at wrappers fall through to ++ * plain do_stat outside the daemon-no-chroot context, so this ++ * change is transparent for non-daemon use. */ ++ int ret = do_stat_at(fname, fst); + if ((ret < 0 || get_stat_xattr(fname, -1, fst, xst) < 0) && xst) + xst->st_mode = 0; + return ret; +@@ -1257,7 +1262,7 @@ int x_stat(const char *fname, STRUCT_STAT *fst, STRUCT_STAT *xst) + + int x_lstat(const char *fname, STRUCT_STAT *fst, STRUCT_STAT *xst) + { +- int ret = do_lstat(fname, fst); ++ int ret = do_lstat_at(fname, fst); + if ((ret < 0 || get_stat_xattr(fname, -1, fst, xst) < 0) && xst) + xst->st_mode = 0; + return ret; diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43619_p4.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p4.patch new file mode 100644 index 00000000000..26d2122d7c9 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p4.patch @@ -0,0 +1,568 @@ +From 1efd7d95ad3813ea3d4b303d277cd46297f7c2f5 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Wed, 6 May 2026 09:45:30 +1000 +Subject: [PATCH] util1+syscall: secure copy_file source/dest opens; bare-path + defence-in-depth + +Three related codex audit findings: + + Finding 3a: copy_file()'s source open in util1.c used + do_open_nofollow(), which only rejects a final-component + symlink. A parent-component symlink (e.g. --copy-dest=cd where + cd -> /outside) follows freely and reads outside the module. + Route through secure_relative_open() with O_NOFOLLOW. + + Finding 3b: generator.c's in-place backup-file create still + used a bare do_open with O_CREAT, leaving a tiny but reachable + parent-symlink window between the secure unlink (already + through do_unlink_at) and the create. Add do_open_at() that + goes through a secure parent dirfd, and route the call site + through it. + + Finding 3c: copy_file()'s destination open in + unlink_and_reopen() had the same bare-do_open pattern; route + through do_open_at as well. + +Adds testsuite/copy-dest-source-symlink.test and +testsuite/bare-do-open-symlink-race.test as regression coverage +for both attack shapes. + +Co-Authored-By: Claude Opus 4.7 (1M context) + +CVE: CVE-2026-43619 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/3cc6a9e8cdcffb637ecdd41dae47833096dca317] + +(cherry picked from commit 3cc6a9e8cdcffb637ecdd41dae47833096dca317) +Signed-off-by: Ashishkumar Parmar +--- + generator.c | 2 +- + syscall.c | 138 +++++++++++++++-- + testsuite/bare-do-open-symlink-race.test | 186 +++++++++++++++++++++++ + testsuite/copy-dest-source-symlink.test | 83 ++++++++++ + util1.c | 21 ++- + 5 files changed, 416 insertions(+), 14 deletions(-) + create mode 100755 testsuite/bare-do-open-symlink-race.test + create mode 100755 testsuite/copy-dest-source-symlink.test + +diff --git a/generator.c b/generator.c +index e5b2d176..311e9b78 100644 +--- a/generator.c ++++ b/generator.c +@@ -1896,7 +1896,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx, + back_file = NULL; + goto cleanup; + } +- if ((f_copy = do_open(backupptr, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL, 0600)) < 0) { ++ if ((f_copy = do_open_at(backupptr, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL, 0600)) < 0) { + rsyserr(FERROR_XFER, errno, "open %s", full_fname(backupptr)); + unmake_file(back_file); + back_file = NULL; +diff --git a/syscall.c b/syscall.c +index ffd8df20..10a3c231 100644 +--- a/syscall.c ++++ b/syscall.c +@@ -203,11 +203,6 @@ int do_symlink_at(const char *lnk, const char *path) + if (!am_daemon || am_chrooted) + return do_symlink(lnk, path); + +-#if defined NO_SYMLINK_XATTRS || defined NO_SYMLINK_USER_XATTRS +- if (am_root < 0) +- return do_symlink(lnk, path); +-#endif +- + if (!path || !*path || *path == '/') + return do_symlink(lnk, path); + +@@ -228,6 +223,34 @@ int do_symlink_at(const char *lnk, const char *path) + if (dfd < 0) + return -1; + ++#if defined NO_SYMLINK_XATTRS || defined NO_SYMLINK_USER_XATTRS ++ /* For --fake-super, do_symlink writes the link target into a ++ * regular file rather than creating a real symlink. Do that ++ * here against the secure dirfd, with O_NOFOLLOW so a pre- ++ * planted symlink at the basename can't redirect the file ++ * creation. (Previously the fake-super branch fell through to ++ * the bare-path do_symlink at the top of the function.) */ ++ if (am_root < 0) { ++ int len = strlen(lnk); ++ int fd = openat(dfd, bname, ++ O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW, ++ S_IWUSR | S_IRUSR); ++ if (fd < 0) { ++ e = errno; ++ close(dfd); ++ errno = e; ++ return -1; ++ } ++ ret = (write(fd, lnk, len) == len) ? 0 : -1; ++ if (close(fd) < 0) ++ ret = -1; ++ e = errno; ++ close(dfd); ++ errno = e; ++ return ret; ++ } ++#endif ++ + ret = symlinkat(lnk, dfd, bname); + e = errno; + close(dfd); +@@ -503,9 +526,12 @@ int do_mknod(const char *pathname, mode_t mode, dev_t dev) + mknodat() against that dirfd. mknodat() covers both regular-file + (S_IFREG with dev=0) and FIFO (S_IFIFO) and device-node creation. + +- Falls through to do_mknod() for fake-super (am_root < 0) and for +- sockets, both of which use auxiliary path-based syscalls that +- don't have an *at() variant in any portable form. ++ Fake-super (am_root < 0) is handled inline against the secure ++ parent dirfd: it creates a regular empty file (the same file-as- ++ metadata-placeholder pattern do_mknod uses) via openat() with ++ O_NOFOLLOW. Sockets fall through to do_mknod() because their ++ bind(2) takes a path argument with no portable bindat() variant; ++ this is documented as a residual. + */ + int do_mknod_at(const char *pathname, mode_t mode, dev_t dev) + { +@@ -523,9 +549,6 @@ int do_mknod_at(const char *pathname, mode_t mode, dev_t dev) + if (!am_daemon || am_chrooted) + return do_mknod(pathname, mode, dev); + +- if (am_root < 0) +- return do_mknod(pathname, mode, dev); +- + #if !defined MKNOD_CREATES_SOCKETS && defined HAVE_SYS_UN_H + if (S_ISSOCK(mode)) + return do_mknod(pathname, mode, dev); +@@ -551,6 +574,29 @@ int do_mknod_at(const char *pathname, mode_t mode, dev_t dev) + if (dfd < 0) + return -1; + ++ if (am_root < 0) { ++ /* For --fake-super, do_mknod creates a regular empty ++ * file as a placeholder for the special-file metadata ++ * (which is stored in xattrs elsewhere). Do that against ++ * the secure dirfd, with O_NOFOLLOW so a pre-planted ++ * symlink at the basename can't redirect the file ++ * creation. */ ++ int fd = openat(dfd, bname, ++ O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW, ++ S_IWUSR | S_IRUSR); ++ if (fd < 0) { ++ e = errno; ++ close(dfd); ++ errno = e; ++ return -1; ++ } ++ ret = (close(fd) < 0) ? -1 : 0; ++ e = errno; ++ close(dfd); ++ errno = e; ++ return ret; ++ } ++ + #if !defined MKNOD_CREATES_FIFOS && defined HAVE_MKFIFO + if (S_ISFIFO(mode)) + ret = mkfifoat(dfd, bname, mode); +@@ -639,6 +685,76 @@ int do_open(const char *pathname, int flags, mode_t mode) + return open(pathname, flags | O_BINARY, mode); + } + ++/* ++ Symlink-race-safe variant of do_open() for receiver-side use. See ++ the comment on do_chmod_at() for the threat model. open() resolves ++ parent components, so a parent-symlink swap can redirect the open ++ to a file outside the module. This wrapper is defence-in-depth for ++ bare-path do_open() sites that callers know are otherwise ++ protected by secure parent-syscalls (e.g. generator.c's in-place ++ backup creation, where robust_unlink() rejects the symlinked ++ parent before this open is reached): if any of those upstream ++ protections is later removed or regresses, the open here still ++ refuses to escape the module. ++ ++ Defence: open the parent of pathname under secure_relative_open() ++ and call openat() against the resulting dirfd with O_NOFOLLOW ++ (so the basename itself isn't followed if it happens to be a ++ pre-planted symlink, which is what we want for O_CREAT|O_EXCL). ++*/ ++int do_open_at(const char *pathname, int flags, mode_t mode) ++{ ++#ifdef AT_FDCWD ++ extern int am_daemon, am_chrooted; ++ char dirpath[MAXPATHLEN]; ++ const char *bname; ++ const char *slash; ++ int dfd, ret, e; ++ size_t dlen; ++ ++ if (flags != O_RDONLY) { ++ RETURN_ERROR_IF(dry_run, 0); ++ RETURN_ERROR_IF_RO_OR_LO; ++ } ++ ++ if (!am_daemon || am_chrooted) ++ return do_open(pathname, flags, mode); ++ ++ if (!pathname || !*pathname || *pathname == '/') ++ return do_open(pathname, flags, mode); ++ ++ slash = strrchr(pathname, '/'); ++ if (!slash) ++ return do_open(pathname, flags, mode); ++ ++ dlen = slash - pathname; ++ if (dlen >= sizeof dirpath) { ++ errno = ENAMETOOLONG; ++ return -1; ++ } ++ memcpy(dirpath, pathname, dlen); ++ dirpath[dlen] = '\0'; ++ bname = slash + 1; ++ ++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0); ++ if (dfd < 0) ++ return -1; ++ ++#ifdef O_NOATIME ++ if (open_noatime) ++ flags |= O_NOATIME; ++#endif ++ ++ ret = openat(dfd, bname, flags | O_NOFOLLOW | O_BINARY, mode); ++ e = errno; ++ close(dfd); ++ errno = e; ++ return ret; ++#else ++ return do_open(pathname, flags, mode); ++#endif ++} ++ + #ifdef HAVE_CHMOD + int do_chmod(const char *path, mode_t mode) + { +diff --git a/testsuite/bare-do-open-symlink-race.test b/testsuite/bare-do-open-symlink-race.test +new file mode 100755 +index 00000000..b8c51bbe +--- /dev/null ++++ b/testsuite/bare-do-open-symlink-race.test +@@ -0,0 +1,186 @@ ++#!/bin/sh ++ ++# Copyright (C) 2026 by Andrew Tridgell ++ ++# This program is distributable under the terms of the GNU GPL (see ++# COPYING). ++ ++# Regression test for codex audit Findings 3b and 3c: ++# ++# 3b: generator.c:1905 -- the in-place backup creation opens ++# backupptr via bare do_open(O_WRONLY|O_CREAT|O_TRUNC|O_EXCL). ++# With --backup-dir set to an attacker-planted parent symlink, ++# the backup file is written outside the module under the ++# daemon's authority. ++# ++# 3c-symlink: syscall.c:207 -- do_symlink_at falls through to bare ++# do_symlink for am_root < 0 (fake-super), which then opens ++# the destination path with bare open() (final-component ++# fake-super file). A parent symlink on the destination path ++# redirects the file creation outside the module. ++# ++# 3c-mknod: syscall.c:506 -- do_mknod_at falls through to bare ++# do_mknod for am_root < 0, same path-based open(). For ++# FIFOs/sockets/devices the bare path is also used. ++# ++# Each scenario plants a "secret" file outside the module at a ++# location the symlink trap points to. The check is that the ++# outside file's content and mode are unchanged after the attack ++# attempt. ++ ++. "$suitedir/rsync.fns" ++ ++# All three scenarios depend on receiver-side daemon code paths ++# that are only secured on platforms with a working ++# secure_relative_open. The chdir/chmod tests already skip the ++# same set; mirror that. ++case "$(uname -s)" in ++ SunOS|OpenBSD|NetBSD|CYGWIN*) ++ test_skipped "secure_relative_open relies on RESOLVE_BENEATH-equivalent kernel support not available on $(uname -s)" ++ ;; ++esac ++ ++mod="$scratchdir/module" ++outside="$scratchdir/outside" ++src="$scratchdir/src" ++conf="$scratchdir/test-rsyncd.conf" ++ ++# Portable inode-and-mode helpers. ++file_mode() { ++ stat -c %a "$1" 2>/dev/null || stat -f %Lp "$1" ++} ++ ++setup() { ++ rm -rf "$mod" "$outside" "$src" ++ mkdir -p "$mod" "$outside" "$src" ++ ++ echo "OUTSIDE_PROTECTED_DATA" > "$outside/target.txt" ++ chmod 0644 "$outside/target.txt" ++ outside_pristine="$scratchdir/outside-pristine.txt" ++ cp -p "$outside/target.txt" "$outside_pristine" ++ ++ ln -s "$outside" "$mod/cd" ++} ++ ++verify_outside_unchanged() { ++ label="$1" ++ mode=$(file_mode "$outside/target.txt") ++ case "$mode" in ++ 644|0644) ;; ++ *) test_fail "$label: outside/target.txt mode changed from 644 to $mode" ;; ++ esac ++ if ! cmp -s "$outside/target.txt" "$outside_pristine"; then ++ test_fail "$label: outside/target.txt content changed -- daemon followed the cd symlink" ++ fi ++} ++ ++verify_outside_unchanged_or_absent() { ++ label="$1" ++ target="$2" # specific file under outside/ to check absence of ++ if [ -e "$outside/$target" ]; then ++ test_fail "$label: outside/$target was created -- daemon followed the cd symlink" ++ fi ++} ++ ++ ++############################################################ ++# Scenario 3b: --inplace --backup --backup-dir=cd ++# ++# Pre-create module/target.txt so the receiver enters the in-place ++# update path; a backup of the existing content must be made ++# before the update. With --backup-dir=cd, backupptr resolves to ++# "cd/target.txt"; with the bug, robust_unlink and the bare ++# do_open at generator.c:1905 both follow the cd symlink, the ++# unlink deletes outside/target.txt and the create writes the ++# pre-existing module/target.txt content there. ++############################################################ ++ ++setup ++echo "EXISTING_MODULE_DATA" > "$mod/target.txt" ++chmod 0666 "$mod/target.txt" ++echo "NEW_DATA_FROM_SENDER" > "$src/target.txt" ++chmod 0644 "$src/target.txt" ++ ++cat > "$conf" </dev/null 2>&1 || true ++ ++verify_outside_unchanged "3b inplace+backup-dir=cd" ++ ++ ++############################################################ ++# Scenario 3c-symlink: fake-super symlink push to a path with a ++# symlinked parent ++# ++# With "fake super = yes" set on the module, the receiver ++# represents symlinks as fake-super files (regular files with the ++# link target written to them). The path-based open() in ++# do_symlink's fake-super branch follows parent symlinks. We push ++# a single symlink to the destination path "cd/sym" so the ++# receiver's create-file call lands at "cd/sym" relative to the ++# module root, where cd is the symlink trap. ++############################################################ ++ ++setup ++ ++mkdir -p "$src/cd" ++ln -s /etc/passwd "$src/cd/sym" ++ ++cat > "$conf" </dev/null 2>&1 || true ++ ++verify_outside_unchanged_or_absent "3c-symlink fake-super symlink push" "sym" ++ ++ ++############################################################ ++# Scenario 3c-mknod: fake-super FIFO push to a path with a ++# symlinked parent ++# ++# Similar to 3c-symlink but for special files. mkfifo works ++# without root; we push a FIFO and verify the receiver doesn't ++# create a fake-super file at outside/fifo. ++############################################################ ++ ++setup ++ ++mkdir -p "$src/cd" ++mkfifo "$src/cd/fifo" 2>/dev/null ++if [ ! -p "$src/cd/fifo" ]; then ++ test_skipped "mkfifo unavailable; cannot exercise 3c-mknod" ++fi ++ ++cat > "$conf" </dev/null 2>&1 || true ++ ++verify_outside_unchanged_or_absent "3c-mknod fake-super FIFO push" "fifo" ++ ++exit 0 +diff --git a/testsuite/copy-dest-source-symlink.test b/testsuite/copy-dest-source-symlink.test +new file mode 100755 +index 00000000..2d20fab4 +--- /dev/null ++++ b/testsuite/copy-dest-source-symlink.test +@@ -0,0 +1,83 @@ ++#!/bin/sh ++ ++# Copyright (C) 2026 by Andrew Tridgell ++ ++# This program is distributable under the terms of the GNU GPL (see ++# COPYING). ++ ++# Regression test for codex audit Finding 3a: copy_file()'s source ++# open in copy_altdest_file() is via do_open_nofollow(), which only ++# refuses a final-component symlink. Parent components are still ++# resolved with normal symlink-following. A daemon module attacker ++# who plants a parent symlink at module/cd -> /outside, then runs ++# --copy-dest=cd against a source file matching the size+mtime of ++# /outside/target.txt, drives the receiver to: ++# ++# 1. Find a match-level >= 2 basis at "cd/target.txt" ++# 2. Call copy_altdest_file -> copy_file(src="cd/target.txt", ...) ++# 3. do_open_nofollow follows the "cd" parent symlink and reads ++# the contents of /outside/target.txt under the daemon's ++# authority ++# 4. Copy that content into the module destination ++# ++# Result: outside/target.txt content lands at module/target.txt, ++# accessible to the attacker on a subsequent pull. ++# ++# We detect by content: src/target.txt and outside/target.txt have ++# identical metadata (size + mtime + mode) but different content. ++# After the transfer, module/target.txt should match src (no ++# basedir escape) -- if it matches outside, the bug copied across ++# the symlink boundary. ++ ++. "$suitedir/rsync.fns" ++ ++mod="$scratchdir/module" ++outside="$scratchdir/outside" ++src="$scratchdir/src" ++conf="$scratchdir/test-rsyncd.conf" ++ ++rm -rf "$mod" "$outside" "$src" ++mkdir -p "$mod" "$outside" "$src" ++ ++# Outside-the-module file the daemon should not read on the ++# attacker's behalf. ++echo "OUTSIDE_LEAKED_DATA!" > "$outside/target.txt" ++chmod 0644 "$outside/target.txt" ++ ++# The symlink trap. ++ln -s "$outside" "$mod/cd" ++ ++# Source: same size, same mtime, same mode as outside -- so the ++# generator's link_stat + quick_check_ok finds a match-level >= 2 ++# basis and calls copy_altdest_file. ++echo "ATTACKER_KNOWN_DATA!" > "$src/target.txt" ++touch -r "$outside/target.txt" "$src/target.txt" ++chmod 0644 "$src/target.txt" ++ ++cat > "$conf" </dev/null 2>&1 || true ++ ++if [ ! -f "$mod/target.txt" ]; then ++ test_fail "destination file was not created -- daemon transfer failed before the test could observe the basedir behaviour" ++fi ++ ++if cmp -s "$mod/target.txt" "$outside/target.txt"; then ++ test_fail "basedir-escape via copy_file source: module/target.txt now contains the contents of outside/target.txt -- daemon read /outside via the cd symlink and copied it into the module" ++fi ++ ++if ! cmp -s "$mod/target.txt" "$src/target.txt"; then ++ test_fail "destination doesn't match source content (and isn't outside content either): unexpected state" ++fi ++ ++exit 0 +diff --git a/util1.c b/util1.c +index 8850019f..d28a8e02 100644 +--- a/util1.c ++++ b/util1.c +@@ -336,7 +336,13 @@ static int unlink_and_reopen(const char *dest, mode_t mode) + mode |= S_IWUSR; + #endif + mode &= INITACCESSPERMS; +- if ((ofd = do_open(dest, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL, mode)) < 0) { ++ /* Use do_open_at so the create/truncate goes through a secure ++ * parent dirfd in the daemon-no-chroot deployment. Otherwise ++ * an attacker could swap a parent component with a symlink in ++ * the window between robust_unlink (which uses do_unlink_at, ++ * already secure) and the create here, and redirect the new ++ * file outside the module. */ ++ if ((ofd = do_open_at(dest, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL, mode)) < 0) { + int save_errno = errno; + rsyserr(FERROR_XFER, save_errno, "open %s", full_fname(dest)); + errno = save_errno; +@@ -360,12 +366,23 @@ static int unlink_and_reopen(const char *dest, mode_t mode) + * --copy-dest options. */ + int copy_file(const char *source, const char *dest, int tmpfilefd, mode_t mode) + { ++ extern int am_daemon, am_chrooted; + int ifd, ofd; + char buf[1024 * 8]; + int len; /* Number of bytes read into `buf'. */ + OFF_T prealloc_len = 0, offset = 0; + +- if ((ifd = do_open_nofollow(source, O_RDONLY)) < 0) { ++ /* On a daemon without chroot, route the source open through ++ * secure_relative_open so a parent-symlink on the source path ++ * (e.g. --copy-dest=cd where cd is a symlink to an outside ++ * directory) cannot redirect the read to a file the daemon can ++ * see but the attacker should not. Plain do_open_nofollow only ++ * refuses a final-component symlink; parents are still followed. */ ++ if (am_daemon && !am_chrooted && source && *source && source[0] != '/') ++ ifd = secure_relative_open(NULL, source, O_RDONLY | O_NOFOLLOW, 0); ++ else ++ ifd = do_open_nofollow(source, O_RDONLY); ++ if (ifd < 0) { + int save_errno = errno; + rsyserr(FERROR_XFER, errno, "open %s", full_fname(source)); + errno = save_errno; diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43619_p5.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p5.patch new file mode 100644 index 00000000000..8d2c3a75b78 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p5.patch @@ -0,0 +1,69 @@ +From d944dae7e5c1c194db23a1fefa443dd240d52afd Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Thu, 4 Jun 2026 14:46:38 +1000 +Subject: [PATCH] build: fall back to do_mknod() when mknodat() is unavailable + (#896) + +do_mknod_at() (the symlink-race-safe variant used by a non-chrooted +daemon receiver) calls mknodat()/mkfifoat(), but the at-variant was +gated only on AT_FDCWD. Older Darwin declares AT_FDCWD without +mknodat(), so the build failed with "mknodat undeclared". + +Probe mknodat()/mkfifoat() in configure and require HAVE_MKNODAT for the +at-variant; without it do_mknod_at() falls back to do_mknod(), exactly +as it already does where AT_FDCWD is missing. Linux keeps the mknodat +path since HAVE_MKNODAT is defined there. + +Thanks to @debohman for the report (#896). + +Fixes: #896 + +CVE: CVE-2026-43619 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/f3757a470ad3defdb2c4c6ad334e3839f3c7f1ae] + +(cherry picked from commit f3757a470ad3defdb2c4c6ad334e3839f3c7f1ae) +Signed-off-by: Ashishkumar Parmar +--- + configure.ac | 2 +- + syscall.c | 6 ++++-- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/configure.ac b/configure.ac +index d2bcb471..1d9b3713 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -888,7 +888,7 @@ AC_FUNC_UTIME_NULL + AC_FUNC_ALLOCA + AC_CHECK_FUNCS(waitpid wait4 getcwd chown chmod lchmod mknod mkfifo \ + fchmod fstat ftruncate strchr readlink link utime utimes lutimes strftime \ +- chflags getattrlist mktime innetgr linkat \ ++ chflags getattrlist mktime innetgr linkat mknodat mkfifoat \ + memmove lchown vsnprintf snprintf vasprintf asprintf setsid strpbrk \ + strlcat strlcpy stpcpy strtol mallinfo mallinfo2 getgroups setgroups geteuid getegid \ + setlocale setmode open64 lseek64 mkstemp64 mtrace va_copy __va_copy \ +diff --git a/syscall.c b/syscall.c +index 10a3c231..25c92aac 100644 +--- a/syscall.c ++++ b/syscall.c +@@ -535,7 +535,9 @@ int do_mknod(const char *pathname, mode_t mode, dev_t dev) + */ + int do_mknod_at(const char *pathname, mode_t mode, dev_t dev) + { +-#ifdef AT_FDCWD ++ /* HAVE_MKNODAT: older Darwin declares AT_FDCWD but not mknodat(), so ++ * the at-variant won't build there; fall back to do_mknod() (#896). */ ++#if defined(AT_FDCWD) && defined(HAVE_MKNODAT) + extern int am_daemon, am_chrooted; + char dirpath[MAXPATHLEN]; + const char *bname; +@@ -597,7 +599,7 @@ int do_mknod_at(const char *pathname, mode_t mode, dev_t dev) + return ret; + } + +-#if !defined MKNOD_CREATES_FIFOS && defined HAVE_MKFIFO ++#if !defined MKNOD_CREATES_FIFOS && defined HAVE_MKFIFO && defined HAVE_MKFIFOAT + if (S_ISFIFO(mode)) + ret = mkfifoat(dfd, bname, mode); + else +-- +2.35.6 diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43619_p6.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p6.patch new file mode 100644 index 00000000000..d023217a909 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p6.patch @@ -0,0 +1,258 @@ +From 94e63a8632a3c3bc10ac630a53a99ed01a82f9de Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Sat, 6 Jun 2026 15:37:25 +1000 +Subject: [PATCH] build: openat2 autodetect + android probe (R1 #924/#905/#900, + R10 #904) + +configure now probes for + SYS_openat2 and defines +HAVE_OPENAT2 only when both are present; syscall.c gates the openat2 include +and the openat2(RESOLVE_BENEATH) tier on HAVE_OPENAT2, so the build no longer +fails on kernels/headers that lack the openat2 header (3.4.3 included it +unconditionally on Linux). android.c probes openat2 usability behind a SIGSYS +handler so the Android/Termux seccomp sandbox falls back to the portable +resolver instead of killing the process. + +Backport combining c73e0063, 83a24c21, the syscall.c guards from 1d5b5ab8, and +4634b0ad; the --disable-openat2/gcov coverage knobs and test changes are omitted. + +Thanks to @mmayer (#924), @fda77 (#905), @darkshram (#900) and @ketas (#904) for the reports. + +CVE: CVE-2026-43619 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/c14e2258b59a3f16a99c6e83a28660ba438a73e9] + +(cherry picked from commit c14e2258b59a3f16a99c6e83a28660ba438a73e9) +Signed-off-by: Ashishkumar Parmar +--- + Makefile.in | 12 ++++----- + android.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + configure.ac | 22 +++++++++++++++++ + syscall.c | 23 +++++++++++++---- + 4 files changed, 128 insertions(+), 11 deletions(-) + create mode 100644 android.c + +diff --git a/Makefile.in b/Makefile.in +index c0cc7a06..f2590b69 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -49,7 +49,7 @@ LIBOBJ=lib/wildmatch.o lib/compat.o lib/snprintf.o lib/mdfour.o lib/md5.o \ + zlib_OBJS=zlib/deflate.o zlib/inffast.o zlib/inflate.o zlib/inftrees.o \ + zlib/trees.o zlib/zutil.o zlib/adler32.o zlib/compress.o zlib/crc32.o + OBJS1=flist.o rsync.o generator.o receiver.o cleanup.o sender.o exclude.o \ +- util1.o util2.o main.o checksum.o match.o syscall.o log.o backup.o delete.o ++ util1.o util2.o main.o checksum.o match.o syscall.o android.o log.o backup.o delete.o + OBJS2=options.o io.o compat.o hlink.o token.o uidlist.o socket.o hashtable.o \ + usage.o fileio.o batch.o clientname.o chmod.o acls.o xattrs.o + OBJS3=progress.o pipe.o @MD5_ASM@ @ROLL_SIMD@ @ROLL_ASM@ +@@ -58,7 +58,7 @@ popt_OBJS=popt/findme.o popt/popt.o popt/poptconfig.o \ + popt/popthelp.o popt/poptparse.o popt/poptint.o + OBJS=$(OBJS1) $(OBJS2) $(OBJS3) $(DAEMON_OBJ) $(LIBOBJ) @BUILD_ZLIB@ @BUILD_POPT@ + +-TLS_OBJ = tls.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/permstring.o lib/sysxattrs.o @BUILD_POPT@ ++TLS_OBJ = tls.o syscall.o android.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/permstring.o lib/sysxattrs.o @BUILD_POPT@ + + # Programs we must have to run the test cases + CHECK_PROGS = rsync$(EXEEXT) tls$(EXEEXT) getgroups$(EXEEXT) getfsdev$(EXEEXT) \ +@@ -176,19 +176,19 @@ getgroups$(EXEEXT): getgroups.o + getfsdev$(EXEEXT): getfsdev.o + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ getfsdev.o $(LIBS) + +-TRIMSLASH_OBJ = trimslash.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o ++TRIMSLASH_OBJ = trimslash.o syscall.o android.o util2.o t_stub.o lib/compat.o lib/snprintf.o + trimslash$(EXEEXT): $(TRIMSLASH_OBJ) + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(TRIMSLASH_OBJ) $(LIBS) + +-T_UNSAFE_OBJ = t_unsafe.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o ++T_UNSAFE_OBJ = t_unsafe.o syscall.o android.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o + t_unsafe$(EXEEXT): $(T_UNSAFE_OBJ) + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_UNSAFE_OBJ) $(LIBS) + +-T_CHMOD_SECURE_OBJ = t_chmod_secure.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o ++T_CHMOD_SECURE_OBJ = t_chmod_secure.o syscall.o android.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o + t_chmod_secure$(EXEEXT): $(T_CHMOD_SECURE_OBJ) + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_CHMOD_SECURE_OBJ) $(LIBS) + +-T_SECURE_RELPATH_OBJ = t_secure_relpath.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o ++T_SECURE_RELPATH_OBJ = t_secure_relpath.o syscall.o android.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o + t_secure_relpath$(EXEEXT): $(T_SECURE_RELPATH_OBJ) + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_SECURE_RELPATH_OBJ) $(LIBS) + +diff --git a/android.c b/android.c +new file mode 100644 +index 00000000..572f5f21 +--- /dev/null ++++ b/android.c +@@ -0,0 +1,82 @@ ++/* ++ * Android-specific helpers. ++ * ++ * openat2() usability probe ++ * ------------------------- ++ * openat2(2) is invoked directly via syscall() because the C library lacked a ++ * wrapper for it for years. Under a seccomp filter that uses ++ * SECCOMP_RET_TRAP -- as the Android application sandbox does -- a disallowed ++ * syscall raises SIGSYS and *kills the process* rather than failing with ++ * ENOSYS, so inspecting errno after the call is too late. We therefore probe ++ * openat2() once, behind a temporary SIGSYS handler, so a trapped syscall is ++ * caught and secure_relative_open_linux() can fall back to the portable ++ * per-component O_NOFOLLOW resolver instead of the whole process dying. ++ * ++ * This is only needed on Android, so the probe body is compiled only there. ++ * __ANDROID__ is defined by Bionic's headers and reflects the *target*, not ++ * the build host: it is set both for NDK cross-compiles (from a Linux/macOS ++ * host) and for native Termux builds, and is unset on every other platform. ++ * That makes it a reliable compile-time switch for cross builds -- there is ++ * nothing to detect in configure. Everywhere else openat2() is never ++ * seccomp-trapped to SIGSYS (a missing syscall simply returns ENOSYS), so ++ * openat2_usable() collapses to a constant 1 with no run-time cost. ++ */ ++ ++#include "rsync.h" ++ ++#if defined(__ANDROID__) && defined(HAVE_OPENAT2) ++ ++#include ++#include ++#include ++ ++static sigjmp_buf openat2_probe_env; ++ ++static void openat2_probe_handler(int signo) ++{ ++ (void)signo; ++ siglongjmp(openat2_probe_env, 1); ++} ++ ++#endif ++ ++int openat2_usable(void) ++{ ++#if defined(__ANDROID__) && defined(HAVE_OPENAT2) ++ static int cached = -1; ++ struct sigaction sa, old_sa; ++ ++ if (cached >= 0) ++ return cached; ++ ++ memset(&sa, 0, sizeof sa); ++ sa.sa_handler = openat2_probe_handler; ++ sigemptyset(&sa.sa_mask); ++ if (sigaction(SIGSYS, &sa, &old_sa) != 0) ++ return cached = 0; ++ ++ if (sigsetjmp(openat2_probe_env, 1) != 0) { ++ /* SIGSYS delivered: openat2 is blocked by a seccomp filter. */ ++ cached = 0; ++ } else { ++ struct open_how how; ++ int fd; ++ memset(&how, 0, sizeof how); ++ how.flags = O_RDONLY | O_DIRECTORY; ++ how.resolve = RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS; ++ fd = syscall(SYS_openat2, AT_FDCWD, ".", &how, sizeof how); ++ if (fd >= 0) ++ close(fd); ++ /* Usable only if the probe actually succeeded. Any failure -- ++ * ENOSYS (kernel < 5.6), a seccomp SECCOMP_RET_ERRNO denial ++ * (EPERM/EACCES), or EINVAL (RESOLVE_BENEATH unsupported) -- ++ * means we must fall back to the portable O_NOFOLLOW walk. */ ++ cached = fd >= 0; ++ } ++ ++ sigaction(SIGSYS, &old_sa, NULL); ++ return cached; ++#else ++ return 1; ++#endif ++} +diff --git a/configure.ac b/configure.ac +index 1d9b3713..123480e1 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -331,6 +331,28 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ ]], [[return 0;]])], + CFLAGS="$OLD_CFLAGS" + AC_SUBST(NOEXECSTACK) + ++dnl Only define HAVE_OPENAT2 when both the header and the ++dnl SYS_openat2 syscall number are present. syscall.c uses openat2(RESOLVE_BENEATH) ++dnl for the secure resolver on Linux 5.6+; defining it unconditionally broke the ++dnl build on older kernels/headers that lack the header (#924, #905, #900). ++AC_CACHE_CHECK([for openat2],rsync_cv_HAVE_OPENAT2,[ ++ AC_COMPILE_IFELSE([ ++ AC_LANG_PROGRAM([[ ++#include ++#include ++]], [[ ++struct open_how how; ++how.resolve = RESOLVE_BENEATH; ++return SYS_openat2 + (int)how.resolve; ++]]) ++ ], ++ [rsync_cv_HAVE_OPENAT2=yes], [rsync_cv_HAVE_OPENAT2=no]) ++]) ++if test x"$rsync_cv_HAVE_OPENAT2" = x"yes"; then ++ AC_DEFINE([HAVE_OPENAT2], 1, ++ [Define to use Linux openat2(RESOLVE_BENEATH) in secure_relative_open where available.]) ++fi ++ + # arrgh. libc in some old debian version screwed up the largefile + # stuff, getting byte range locking wrong + AC_CACHE_CHECK([for broken largefile support],rsync_cv_HAVE_BROKEN_LARGEFILE,[ +diff --git a/syscall.c b/syscall.c +index 25c92aac..f26b144d 100644 +--- a/syscall.c ++++ b/syscall.c +@@ -33,7 +33,7 @@ + #include + #endif + +-#ifdef __linux__ ++#if defined(__linux__) && defined(HAVE_OPENAT2) + #include + #include + #endif +@@ -1688,7 +1688,20 @@ static int path_has_dotdot_component(const char *path) + return 0; + } + +-#ifdef __linux__ ++#if defined(__linux__) && defined(HAVE_OPENAT2) ++/* openat2(RESOLVE_BENEATH) via the raw syscall, gated on openat2_usable() so a ++ * seccomp filter that traps openat2 with SIGSYS (e.g. the Android sandbox) ++ * makes us report ENOSYS and fall back rather than killing the process. Only ++ * the openat2 call is gated here; a plain openat() is always safe to attempt. */ ++static int openat2_beneath(int dirfd, const char *path, const struct open_how *how) ++{ ++ if (!openat2_usable()) { ++ errno = ENOSYS; ++ return -1; ++ } ++ return syscall(SYS_openat2, dirfd, path, how, sizeof *how); ++} ++ + static int secure_relative_open_linux(const char *basedir, const char *relpath, int flags, mode_t mode) + { + struct open_how how; +@@ -1717,12 +1726,12 @@ static int secure_relative_open_linux(const char *basedir, const char *relpath, + memset(&bhow, 0, sizeof bhow); + bhow.flags = O_RDONLY | O_DIRECTORY; + bhow.resolve = RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS; +- dirfd = syscall(SYS_openat2, AT_FDCWD, basedir, &bhow, sizeof bhow); ++ dirfd = openat2_beneath(AT_FDCWD, basedir, &bhow); + if (dirfd == -1) + return -1; + } + +- retfd = syscall(SYS_openat2, dirfd, relpath, &how, sizeof how); ++ retfd = openat2_beneath(dirfd, relpath, &how); + + if (dirfd != AT_FDCWD) + close(dirfd); +@@ -1788,7 +1797,7 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo + return -1; + } + +-#ifdef __linux__ ++#if defined(__linux__) && defined(HAVE_OPENAT2) + { + int fd = secure_relative_open_linux(basedir, relpath, flags, mode); + /* ENOSYS = kernel < 5.6 doesn't have the syscall even though diff --git a/meta/recipes-devtools/rsync/rsync_3.4.1.bb b/meta/recipes-devtools/rsync/rsync_3.4.1.bb index e2fe0128d53..47e195ef24a 100644 --- a/meta/recipes-devtools/rsync/rsync_3.4.1.bb +++ b/meta/recipes-devtools/rsync/rsync_3.4.1.bb @@ -20,6 +20,12 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \ file://CVE-2026-29518_p2.patch \ file://CVE-2026-29518_p3.patch \ file://CVE-2026-29518_p4.patch \ + file://CVE-2026-43619_p1.patch \ + file://CVE-2026-43619_p2.patch \ + file://CVE-2026-43619_p3.patch \ + file://CVE-2026-43619_p4.patch \ + file://CVE-2026-43619_p5.patch \ + file://CVE-2026-43619_p6.patch \ " SRC_URI[sha256sum] = "2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52" From patchwork Mon Jul 27 22:55:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93606 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28510C53219 for ; Mon, 27 Jul 2026 22:56:20 +0000 (UTC) Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43745.1785192976195368589 for ; Mon, 27 Jul 2026 15:56:16 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=MCmWT5hs; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4956242332dso28391635e9.2 for ; Mon, 27 Jul 2026 15:56:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192974; x=1785797774; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=7/4OWz8sfbRQOB1OMamG51+g5Xzvs6zAqwpw3/fkixg=; b=MCmWT5hs1TXTNhUQceydF+foCgxLOaLbaZBXM/4Cwh31wAXHYa0V27lW6derb43QlQ If0jKVOUgDMVOYwQl2oM3NsZH8MiD049ZpiVYzxltu+b16w6YXb/n4x11SKnnnfz+XHa vUG9o6zQQAKAf/p7OpUOn/E8iLoYsHcDyR4aA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192974; x=1785797774; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=7/4OWz8sfbRQOB1OMamG51+g5Xzvs6zAqwpw3/fkixg=; b=SQ5HJUFwvpp174qrVNPF+nEYVurnzb2f6H9obc73qg2NDMkGF88OipcE9iCmpyQ7Wz 9ZZ1FFva7E8AWBasl8/T/F+Mc4sf3VE5bcOSnpz5i5toFZUGgxjvbK92qxvdl8CRKvTj KOfmhfo9GSkGXzd/2zNcQyJylNYpadOyKeErGM8+PHH3PpxUtZ4+WPbYQEXGkGD5kmEa GXKAYj3w2PT84ikCTjwDzmkaVwTMf6GJRMh9Mdg3Fkf4O1qAHTVbdOuwwbAUdtPnjgvQ 6mjP0K+TYxTduD7A+3jb70ZrCXJWQ/+taJd/ispeLyOLnK919oYZ2h1oLCU1QBY+75pK IFWw== X-Gm-Message-State: AOJu0YzVotZeF3AWHjWtzKJkhfgr4OJXcfCqdKXkoLp8hClM/IL4sKFB 2aiqQ07xYEPz2BuTFdcaJl57cr3bNCdmy77gqtyfCrvUUnL6ZeBKhoT/iVpHex+RvtJN9y3yLPE K06AosrY= X-Gm-Gg: AR+sD11P4by/C5rgWI1tVNhgYwBNTGzUMp304ChzhHj8OtE+AXt3Csb/nrrO1O2ImUp KGjXJZlTIZahuuMVEfFBchBWwRcD7ioKEASwdQU9l0+UUtctk3aAxo99C8kewspBm5ajRmC6luV 6N+McsDR4oPnKh6d36zm/EVRjqxxEmnCz8WTD5REJo8iBw0O6Kb+s5n4OKdATHVoprbKqLQCoym P46ZzIrD24hhsVxQDaC8AeUpxAOV3o5czo3hsRoKVdGUBHyJN/6eHqSUa7nOX4aDQer5QapRnXh 39Pb6QPtyCsyvJ8UfihsUSNpW3B470mWkiJSlvLH974eck61tLkU81s4CviCECF9iBdwZZKZVr6 gcOws/nZIFMlbLC6iKQKaCmIO4zUAE77SkzLbrelZk6OXtIMUhbfeGcnVFassWT3E3un9CXj4X/ Xemv5xCh5gXvkn4QQ3oUN2zeWdviVPQavQCIP6L/gsCfLk01o2BhshVMZeTuTMUjm8P8bfyx+M1 SaM+A== X-Received: by 2002:a05:600c:1d0d:b0:493:f0f5:f2d7 with SMTP id 5b1f17b1804b1-496b56b1b23mr124315675e9.7.1785192974314; Mon, 27 Jul 2026 15:56:14 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.12 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:12 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 08/36] rsync: Fix CVE-2026-43618 Date: Tue, 28 Jul 2026 00:55:22 +0200 Message-ID: <137902bbf8f0f8311ba12a165dc481b8c70d2a0a.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242115 From: Ashishkumar Parmar This patch applies the upstream v3.4.3 backport for CVE-2026-43618. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/RsyncProject/rsync/commit/c44c90e9460c666c965446a8c0957f0b9fa4c66a [2] https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq Signed-off-by: Ashishkumar Parmar Signed-off-by: Yoann Congal --- .../rsync/files/CVE-2026-43618.patch | 248 ++++++++++++++++++ meta/recipes-devtools/rsync/rsync_3.4.1.bb | 1 + 2 files changed, 249 insertions(+) create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43618.patch diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43618.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43618.patch new file mode 100644 index 00000000000..d4b13d91818 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-43618.patch @@ -0,0 +1,248 @@ +From a93cfc86b6daa2dfd754bcbe261cf01afef056f4 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Wed, 29 Apr 2026 11:10:59 +1000 +Subject: [PATCH] token: harden compressed-token decoding against integer + overflow + +The receiver's three compressed-token decoders -- +recv_deflated_token (zlib), recv_zstd_token, and +recv_compressed_token (lz4) -- accumulated rx_token (a 32-bit +signed counter) without overflow checking. A malicious sender +could craft a compressed-token stream that walked rx_token past +INT32_MAX, with careful manipulation leaking process memory +contents to the wire (environment variables, passwords, heap +pointers, library pointers -- significantly weakening ASLR +and facilitating further exploitation). + +Cap rx_token at MAX_TOKEN_INDEX = 0x7ffffffe. Fold the +bookkeeping into recv_compressed_token_num() and +recv_compressed_token_run() shared by all three decoders. Reject +negative or out-of-range token values explicitly. Also cap the +simple_recv_token literal-block length at the source: any +wire-supplied length > CHUNK_SIZE is ill-formed (the matching +simple_send_token never writes a chunk larger than CHUNK_SIZE), +so reject before looping on attacker-controlled bytes. + +Reach: an authenticated daemon connection with compression +enabled (the default for protocols >= 30 when both peers +advertise it). Disabling compression on the daemon +("refuse options = compress" in rsyncd.conf) is the available +workaround. + +Reporter: Omar Elsayed (seks99x). + +Co-Authored-By: Claude Opus 4.7 (1M context) + +CVE: CVE-2026-43618 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/c44c90e9460c666c965446a8c0957f0b9fa4c66a] + +Backport Changes: +- Resolved token.c context differences against Wrynose's 3.4.1 + source, which lacks all three negative-token validation blocks + present in the upstream patch context. +- The Wrynose hunk replaces the older per-decoder token bookkeeping + with the upstream recv_compressed_token_num() and + recv_compressed_token_run() helper calls at the matching zlib, + zstd, and lz4 decoder sites. + +(cherry picked from commit c44c90e9460c666c965446a8c0957f0b9fa4c66a) +Signed-off-by: Ashishkumar Parmar +--- + receiver.c | 11 +++++- + token.c | 102 ++++++++++++++++++++++++++++++----------------------- + 2 files changed, 67 insertions(+), 46 deletions(-) + +diff --git a/receiver.c b/receiver.c +index 8cf8366b..a487ad5a 100644 +--- a/receiver.c ++++ b/receiver.c +@@ -318,7 +318,12 @@ static int receive_data(int f_in, char *fname_r, int fd_r, OFF_T size_r, + } + } + +- while ((i = recv_token(f_in, &data)) != 0) { ++ while (1) { ++ data = NULL; ++ i = recv_token(f_in, &data); ++ if (i == 0) ++ break; ++ + if (INFO_GTE(PROGRESS, 1)) + show_progress(offset, total_size); + +@@ -326,6 +331,10 @@ static int receive_data(int f_in, char *fname_r, int fd_r, OFF_T size_r, + maybe_send_keepalive(time(NULL), MSK_ALLOW_FLUSH | MSK_ACTIVE_RECEIVER); + + if (i > 0) { ++ if (!data) { ++ rprintf(FERROR, "Invalid literal token with no data [%s]\n", who_am_i()); ++ exit_cleanup(RERR_PROTOCOL); ++ } + if (DEBUG_GTE(DELTASUM, 3)) { + rprintf(FINFO,"data recv %d at %s\n", + i, big_num(offset)); +diff --git a/token.c b/token.c +index c108b3af..02dabd8d 100644 +--- a/token.c ++++ b/token.c +@@ -291,6 +291,14 @@ static int32 simple_recv_token(int f, char **data) + int32 i = read_int(f); + if (i <= 0) + return i; ++ /* simple_send_token caps each literal chunk at CHUNK_SIZE; ++ * reject anything larger so a hostile peer cannot drive the ++ * read_buf below past our static CHUNK_SIZE buffer. */ ++ if (i > CHUNK_SIZE) { ++ rprintf(FERROR, "invalid uncompressed token length %ld [%s]\n", ++ (long)i, who_am_i()); ++ exit_cleanup(RERR_PROTOCOL); ++ } + residue = i; + } + +@@ -493,9 +501,52 @@ static char *cbuf; + static char *dbuf; + + /* for decoding runs of tokens */ ++#define MAX_TOKEN_INDEX ((int32)0x7ffffffe) ++ + static int32 rx_token; + static int32 rx_run; + ++static NORETURN void invalid_compressed_token(void) ++{ ++ rprintf(FERROR, "invalid token number in compressed stream\n"); ++ exit_cleanup(RERR_PROTOCOL); ++} ++ ++static int32 recv_compressed_token_num(int f, int32 flag) ++{ ++ if (flag & TOKEN_REL) { ++ int32 incr = flag & 0x3f; ++ if (rx_token > MAX_TOKEN_INDEX - incr) ++ invalid_compressed_token(); ++ rx_token += incr; ++ flag >>= 6; ++ } else { ++ rx_token = read_int(f); ++ if (rx_token < 0 || rx_token > MAX_TOKEN_INDEX) ++ invalid_compressed_token(); ++ } ++ ++ if (flag & 1) { ++ rx_run = read_byte(f); ++ rx_run += read_byte(f) << 8; ++ if (rx_run <= 0 || rx_token > MAX_TOKEN_INDEX - rx_run) ++ invalid_compressed_token(); ++ recv_state = r_running; ++ } ++ ++ return -1 - rx_token; ++} ++ ++static int32 recv_compressed_token_run(void) ++{ ++ if (rx_run <= 0 || rx_token >= MAX_TOKEN_INDEX) ++ invalid_compressed_token(); ++ ++rx_token; ++ if (--rx_run == 0) ++ recv_state = r_idle; ++ return -1 - rx_token; ++} ++ + /* Receive a deflated token and inflate it */ + static int32 recv_deflated_token(int f, char **data) + { +@@ -586,17 +637,7 @@ static int32 recv_deflated_token(int f, char **data) + } + + /* here we have a token of some kind */ +- if (flag & TOKEN_REL) { +- rx_token += flag & 0x3f; +- flag >>= 6; +- } else +- rx_token = read_int(f); +- if (flag & 1) { +- rx_run = read_byte(f); +- rx_run += read_byte(f) << 8; +- recv_state = r_running; +- } +- return -1 - rx_token; ++ return recv_compressed_token_num(f, flag); + + case r_inflating: + rx_strm.next_out = (Bytef *)dbuf; +@@ -616,10 +657,7 @@ static int32 recv_deflated_token(int f, char **data) + break; + + case r_running: +- ++rx_token; +- if (--rx_run == 0) +- recv_state = r_idle; +- return -1 - rx_token; ++ return recv_compressed_token_run(); + } + } + } +@@ -828,17 +866,7 @@ static int32 recv_zstd_token(int f, char **data) + return 0; + } + /* here we have a token of some kind */ +- if (flag & TOKEN_REL) { +- rx_token += flag & 0x3f; +- flag >>= 6; +- } else +- rx_token = read_int(f); +- if (flag & 1) { +- rx_run = read_byte(f); +- rx_run += read_byte(f) << 8; +- recv_state = r_running; +- } +- return -1 - rx_token; ++ return recv_compressed_token_num(f, flag); + + case r_inflated: /* zstd doesn't get into this state */ + break; +@@ -869,10 +897,7 @@ static int32 recv_zstd_token(int f, char **data) + break; + + case r_running: +- ++rx_token; +- if (--rx_run == 0) +- recv_state = r_idle; +- return -1 - rx_token; ++ return recv_compressed_token_run(); + } + } + } +@@ -992,17 +1017,7 @@ static int32 recv_compressed_token(int f, char **data) + } + + /* here we have a token of some kind */ +- if (flag & TOKEN_REL) { +- rx_token += flag & 0x3f; +- flag >>= 6; +- } else +- rx_token = read_int(f); +- if (flag & 1) { +- rx_run = read_byte(f); +- rx_run += read_byte(f) << 8; +- recv_state = r_running; +- } +- return -1 - rx_token; ++ return recv_compressed_token_num(f, flag); + + case r_inflating: + avail_out = LZ4_decompress_safe(next_in, dbuf, avail_in, size); +@@ -1018,10 +1033,7 @@ static int32 recv_compressed_token(int f, char **data) + break; + + case r_running: +- ++rx_token; +- if (--rx_run == 0) +- recv_state = r_idle; +- return -1 - rx_token; ++ return recv_compressed_token_run(); + } + } + } diff --git a/meta/recipes-devtools/rsync/rsync_3.4.1.bb b/meta/recipes-devtools/rsync/rsync_3.4.1.bb index 47e195ef24a..f84f269692e 100644 --- a/meta/recipes-devtools/rsync/rsync_3.4.1.bb +++ b/meta/recipes-devtools/rsync/rsync_3.4.1.bb @@ -26,6 +26,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \ file://CVE-2026-43619_p4.patch \ file://CVE-2026-43619_p5.patch \ file://CVE-2026-43619_p6.patch \ + file://CVE-2026-43618.patch \ " SRC_URI[sha256sum] = "2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52" From patchwork Mon Jul 27 22:55:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93602 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01CA0C531D0 for ; Mon, 27 Jul 2026 22:56:20 +0000 (UTC) Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43746.1785192977709069469 for ; Mon, 27 Jul 2026 15:56:18 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=vPE+q9uT; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-493f75f7172so27169775e9.1 for ; Mon, 27 Jul 2026 15:56:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192976; x=1785797776; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=VmSYXyMdQlw/y6su6QgzpYNwY6XA0rzJORJR5TBJizQ=; b=vPE+q9uTC03UEBV6Ho+DxRCXY1HqHoVmmHoN3M6uIFFgZmVWB1EBecB8GUSh4lMWkJ aDpG+zE0PNo+luSnBeNS/kkL/6msktkthtWvMp5jeXbTQGDhw+RNM02g21kJA1l64BUl 5OMVGb4QBo8NMpIKGN/dUaGGdJqsDHMoDAZHc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192976; x=1785797776; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=VmSYXyMdQlw/y6su6QgzpYNwY6XA0rzJORJR5TBJizQ=; b=M1EeOtxmZ6hYaxOzJHMXZXv0TCwyH0OkYNtxtvWCfXZEMvOE5R1m1usF7QP01ZssXr Oz86PO/iYaJ9RIUQun+HOMZbQUD9eulKCun1I4qprw7/4kD0ib1ZvJM4wpnqSZX8hrAQ rxKeiZmlin/92Otp+eLdToQx+Pud9o1xxRa5C1o4lRDNGJSl1FZvb8QD8nwiO5rpatoj I4p6NhZD1/dAR2oJ+N0q7sU610Rlt0lJ3zcpI2u28oTN/16Pcx/zKo2zoo9y/tClMX03 f237i2PdczmY3oushnhKt0fkSnxzSBcHzUQH2gkBq+RLKq7h9keZ/jMsQ/hh65JLn7AA b+/Q== X-Gm-Message-State: AOJu0YxU5m3y94ru+VsNKuIXuDFI9CP97XBMf3/m68jqj0o9bPoPh5Xz T6iQC1EgLdOkbvR2zAuQYwtiPqkEOpx6p5+BSoJgcsmBPnKIl2zGCza3DBGxbw5+4APVGEtIiYl H8WB67yk= X-Gm-Gg: AR+sD13JfnEuk9cDbPwyv0JRSjDY6+WJQB9THagYH7WwOMjrk84M8rQv8wlXJt5cATB j+tezEAFAcy5m88zsq3r/Ya+zP9VhOcPEaephgX4EHU6VLCFf7+wXldrJjskiypJGLM1iOH79o9 swtHl8yFR1X8s8fz4Nq0t3JENXTt7wDgOJVSagomguoNjA1TSMVjK5v0U3egEFU5AT+QCw+AlAJ Af+CGKIutPRKgGEwM1wy+x4cC8eSrNIh+PKSgabRiWR0B1VsxGmvN6/Jy6v8Lxn3vNnmHAPKDIh cUs5/BhIZEO2INhnh0pe6sGnqWJqfXUm7S842GqD49l45EO6aNQcrIT7JHqXxoglcNf2jHTLqR7 IaIj1csMeMpupFiYd4gTPRwz0irTsIkXc4eoxGuJTfSPLada03k43jbJYvgPkGvQIv2VMDLhVNF 1gOB7A+XMFY/TKjkWTy+kIqZC7NRUWKICxyzjsyaYJ89SoLAFdrKJ9gCs7hIDT3ZFn0TLDuQk5U PJC2UL51AnMtdUQ X-Received: by 2002:a05:600c:a4f:b0:493:d741:5d72 with SMTP id 5b1f17b1804b1-496b57116e2mr160532815e9.38.1785192975869; Mon, 27 Jul 2026 15:56:15 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:14 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 09/36] rsync: Fix CVE-2026-43620 Date: Tue, 28 Jul 2026 00:55:23 +0200 Message-ID: <7c88d9dc29f948d178ff270c1b55fdfd1a26296c.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242117 From: Ashishkumar Parmar This patch applies the upstream v3.4.3 backport for CVE-2026-43620. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/RsyncProject/rsync/commit/0cf200ecbb8baaf58070d825c4fbd892b4a63b69 [2] https://github.com/RsyncProject/rsync/security/advisories/GHSA-28pw-r563-rxvm Signed-off-by: Ashishkumar Parmar Signed-off-by: Yoann Congal --- .../rsync/files/CVE-2026-43620.patch | 122 ++++++++++++++++++ meta/recipes-devtools/rsync/rsync_3.4.1.bb | 1 + 2 files changed, 123 insertions(+) create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43620.patch diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43620.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43620.patch new file mode 100644 index 00000000000..2852b74b8d4 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-43620.patch @@ -0,0 +1,122 @@ +From 271771f089f5f7acff5cce1ca3242849b0f6a6a0 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Tue, 5 May 2026 16:48:16 +1000 +Subject: [PATCH] receiver: add parent_ndx<0 guard, mirroring 797e17f + +Commit 797e17f ("fixed an invalid access to files array") added a +parent_ndx < 0 guard to send_files() in sender.c, but the visually- +identical block in recv_files() in receiver.c was not updated. A +malicious rsync:// server can therefore drive any connecting client +into the same out-of-bounds dir_flist->files[-1] read followed by a +file_struct dereference in f_name() one line later. + +Reach: protocol-30+ default (inc_recurse) makes flist.c:2745 set +parent_ndx = -1 on the first received flist when the sender omits a +leading "." entry; rsync.c flist_for_ndx() does not reject ndx == 0 +in that state because the range check evaluates 0 < 0 = false; and +read_ndx_and_attrs() only validates ndx with the ITEM_TRANSFER bit +set, so iflags=ITEM_IS_NEW (or any other non-transfer iflag word) +bypasses the check. + +Apply the same guard receiver-side. Confirmed: the same PoC (a +minimal Python rsyncd that handshakes with CF_INC_RECURSE, sends a +no-leading-"." flist, and emits ndx=0 with ITEM_IS_NEW) crashes +unpatched 3.4.2 with SEGV_MAPERR si_addr=0x4101a-class in the +receiver child; with this guard it exits cleanly with code 2 +(RERR_PROTOCOL). + +The attack surface delta over the sender variant is large: +the original was malicious-client -> daemon, this is +malicious-server -> any rsync client doing a normal rsync:// +or remote-shell pull. + +Reported by Pratham Gupta (alchemy1729). + +Co-Authored-By: Claude Opus 4.7 (1M context) + +CVE: CVE-2026-43620 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/0cf200ecbb8baaf58070d825c4fbd892b4a63b69] + +(cherry picked from commit 0cf200ecbb8baaf58070d825c4fbd892b4a63b69) +Signed-off-by: Ashishkumar Parmar +--- + generator.c | 4 ++++ + io.c | 3 +++ + receiver.c | 7 ++++++- + sender.c | 2 ++ + 4 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/generator.c b/generator.c +index 311e9b78..89f99db4 100644 +--- a/generator.c ++++ b/generator.c +@@ -2146,6 +2146,8 @@ void check_for_finished_files(int itemizing, enum logcode code, int check_redo) + if (send_failed) + ndx = get_hlink_num(); + flist = flist_for_ndx(ndx, "check_for_finished_files.1"); ++ if (ndx < flist->ndx_start) ++ exit_cleanup(RERR_PROTOCOL); + file = flist->files[ndx - flist->ndx_start]; + assert(file->flags & FLAG_HLINKED); + if (send_failed) +@@ -2174,6 +2176,8 @@ void check_for_finished_files(int itemizing, enum logcode code, int check_redo) + + flist = cur_flist; + cur_flist = flist_for_ndx(ndx, "check_for_finished_files.2"); ++ if (ndx < cur_flist->ndx_start) ++ exit_cleanup(RERR_PROTOCOL); + + file = cur_flist->files[ndx - cur_flist->ndx_start]; + if (solo_file) +diff --git a/io.c b/io.c +index bb60eeca..c654a7ba 100644 +--- a/io.c ++++ b/io.c +@@ -1090,6 +1090,9 @@ static void got_flist_entry_status(enum festatus status, int ndx) + { + struct file_list *flist = flist_for_ndx(ndx, "got_flist_entry_status"); + ++ if (ndx < flist->ndx_start) ++ exit_cleanup(RERR_PROTOCOL); ++ + if (remove_source_files) { + active_filecnt--; + active_bytecnt -= F_LENGTH(flist->files[ndx - flist->ndx_start]); +diff --git a/receiver.c b/receiver.c +index a487ad5a..3fa68d71 100644 +--- a/receiver.c ++++ b/receiver.c +@@ -467,7 +467,10 @@ static void handle_delayed_updates(char *local_name) + static void no_batched_update(int ndx, BOOL is_redo) + { + struct file_list *flist = flist_for_ndx(ndx, "no_batched_update"); +- struct file_struct *file = flist->files[ndx - flist->ndx_start]; ++ struct file_struct *file; ++ if (ndx < flist->ndx_start) ++ exit_cleanup(RERR_PROTOCOL); ++ file = flist->files[ndx - flist->ndx_start]; + + rprintf(FERROR_XFER, "(No batched update for%s \"%s\")\n", + is_redo ? " resend of" : "", f_name(file, NULL)); +@@ -604,6 +607,8 @@ int recv_files(int f_in, int f_out, char *local_name) + + if (ndx - cur_flist->ndx_start >= 0) + file = cur_flist->files[ndx - cur_flist->ndx_start]; ++ else if (cur_flist->parent_ndx < 0) ++ exit_cleanup(RERR_PROTOCOL); + else + file = dir_flist->files[cur_flist->parent_ndx]; + fname = local_name ? local_name : f_name(file, fbuf); +diff --git a/sender.c b/sender.c +index 99f431fe..033f87e5 100644 +--- a/sender.c ++++ b/sender.c +@@ -140,6 +140,8 @@ void successful_send(int ndx) + return; + + flist = flist_for_ndx(ndx, "successful_send"); ++ if (ndx < flist->ndx_start) ++ exit_cleanup(RERR_PROTOCOL); + file = flist->files[ndx - flist->ndx_start]; + if (!change_pathname(file, NULL, 0)) + return; diff --git a/meta/recipes-devtools/rsync/rsync_3.4.1.bb b/meta/recipes-devtools/rsync/rsync_3.4.1.bb index f84f269692e..2145d4ce7e3 100644 --- a/meta/recipes-devtools/rsync/rsync_3.4.1.bb +++ b/meta/recipes-devtools/rsync/rsync_3.4.1.bb @@ -27,6 +27,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \ file://CVE-2026-43619_p5.patch \ file://CVE-2026-43619_p6.patch \ file://CVE-2026-43618.patch \ + file://CVE-2026-43620.patch \ " SRC_URI[sha256sum] = "2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52" From patchwork Mon Jul 27 22:55:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93603 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8207C53209 for ; Mon, 27 Jul 2026 22:56:19 +0000 (UTC) Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43795.1785192978597790976 for ; Mon, 27 Jul 2026 15:56:18 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=AlmaoS2E; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-493b966dd74so20121375e9.3 for ; Mon, 27 Jul 2026 15:56:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192977; x=1785797777; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=+Llcd8N4eIBg0A0szl7RMNdk04OLH3nKppr+UE+F5jg=; b=AlmaoS2EBi63sLKmNMuASl8XfGr/KuIGLZpqjgmpF9psAjyO82pCiLAc5gX2rrKTzP gXtNVSBnPjm/O2mlqlB6lAAlQQbYsUuEGQZpiAMIfKciHd4Pd88GLw5nuGb1fEosBTOH XTSBVlULICG6A6sCFiAOFWzGvXrcm3fyOTI70= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192977; x=1785797777; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=+Llcd8N4eIBg0A0szl7RMNdk04OLH3nKppr+UE+F5jg=; b=m6y8/Uv6XruaA+OyXEVTevpWdfhMjRWzAdnsOmO67pyJ1Zlc55u9gjDck2ooljDL4O GnJOgWoXs08Ag7598mQbFHQqQVGWxgzyTc+SSDCmoeGn1A7fHixSiwSSuEIYT/9vAPuv F1eAChSrFideKa4PzLTDQiZiEefW6YCIrYvhLh9Z4jZvSc1sHNnNn76YVmYoIqPMbNLD oU9cH1wX/jLI61dGJgN+brM7kEA0YmMwhZUgiZfQ2/kBQi8HXObthMKFjbkPm7d0csjw JK/USYf6caNoh2WzQ8X4EMpzCf7SUC+TiZIuSZf1sl0tXCXAFmieeoi7eRAk0YlRCg5s VRMg== X-Gm-Message-State: AOJu0Yxkq9Nm0+EEZe6n0205jmQShh5KUHYHO6ZP9KN6Hyc3I3WTS7mc V8LjTg102Yj407hCdsvTaiN7GvmqZd01V6OcUNkDT0z6Nlwqr51KqtMtvgmchUJzGtKoa6TP63u 0fJspBsM= X-Gm-Gg: AR+sD10mDBcVMHWxtkm3rCR0G/KbdpecOmDtHhpBYTWG+g4h7xl2mHlpXsWCSJSiuAD CdOHIDpMRC+5U54DVBI9tZpWoAaooPW+/CUzHRNgnTsdTaki6U1LddnYsLJvAozpzqv1b9mGGx4 nEexI2XpSz7VPEVS/d+WhST2tbjw4ilhQtkeBljY5YIQPsUaE5/g7aJyKiOlunQDJW+HlFwttwB ic9UlVVKkn5XaneL7lsUMjaSIBK053c6ymX/ued44zfQ5yF4OFBuBvk8Nd7bMMqgnyO10tdKEF2 nE/kDyXhhPSFf0dWSbOjqDK3tULI+NDR1iAnSiYAbCM24hIVFghQJG1Vc9wi5PAtcMBRtmhPzza fV1F5okhcl96AM1Wtt9+xUd476nWJo7jAUNOrly2P0q1olZGk6U6Sr0kVbockd2Bti0E+jIvPXm oU/euViDmQvDCpPRnX9Kjm8lNGjbZyn1XyoSkn2/y1kDy7Vyutd6zmAF/gHkYlcq3WP0wSXba2L ol20Q== X-Received: by 2002:a05:600c:4594:b0:495:7287:293f with SMTP id 5b1f17b1804b1-496c4fe0969mr8417775e9.35.1785192976734; Mon, 27 Jul 2026 15:56:16 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:16 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 10/36] rsync: Fix CVE-2026-43617 Date: Tue, 28 Jul 2026 00:55:24 +0200 Message-ID: <8e83a7aa0f82ffea3e57a7025b5985b0d1a04046.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242118 From: Ashishkumar Parmar This patch applies the upstream v3.4.3 backport for CVE-2026-43617. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/RsyncProject/rsync/commit/c38f20c5ffabacd0c0c483786ab224a36e14bf43 [2] https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjfm-3w2m-jf4f Signed-off-by: Ashishkumar Parmar Signed-off-by: Yoann Congal --- .../rsync/files/CVE-2026-43617.patch | 201 ++++++++++++++++++ meta/recipes-devtools/rsync/rsync_3.4.1.bb | 1 + 2 files changed, 202 insertions(+) create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43617.patch diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43617.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43617.patch new file mode 100644 index 00000000000..5b3190224ed --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-43617.patch @@ -0,0 +1,201 @@ +From d811094dc63486a8b6acf23963daccc23e9dbf43 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Wed, 31 Dec 2025 13:50:35 +1100 +Subject: [PATCH] clientserver: fix hostname ACL bypass when using daemon + chroot + +On an rsync daemon configured with "daemon chroot", the reverse-DNS +lookup of the connecting client was performed *after* the chroot +had been entered. If the chroot did not contain the files glibc +needs for resolution (/etc/resolv.conf, /etc/nsswitch.conf, +/etc/hosts, NSS service modules), the lookup failed and +client_name() returned "UNKNOWN". Hostname-based deny rules +("hosts deny = *.evil.example") therefore could not match, and +an attacker controlling their PTR record could connect from a +hostname the administrator had intended to deny. IP-based ACLs +were unaffected. + +Do the reverse DNS lookup before chroot/setuid; client_name() +caches its result, so the post-chroot call uses the cached value +and hostname-based ACLs work even when DNS is unavailable +post-chroot. + +Adds testsuite/daemon-chroot-acl.test as end-to-end regression +coverage. The test sets up an empty chroot directory, configures +"hosts deny = " with daemon chroot, and +asserts the connection is refused with @ERROR access denied. +Uses unshare --user --map-root-user for non-root CAP_SYS_CHROOT; +skips cleanly on non-Linux or when user namespaces aren't +available. + +Reporter: Joshua Rogers (MegaManSec). + +Co-Authored-By: Claude Opus 4.7 (1M context) + +CVE: CVE-2026-43617 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/c38f20c5ffabacd0c0c483786ab224a36e14bf43] + +Backport Changes: +- Omitted upstream .github/workflows/macos-build.yml because the + Yocto recipe does not carry upstream CI workflow files. That + upstream hunk only adds daemon-chroot-acl to the macOS + RSYNC_EXPECT_SKIPPED list and has no rsync source/runtime effect. + +(cherry picked from commit c38f20c5ffabacd0c0c483786ab224a36e14bf43) +Signed-off-by: Ashishkumar Parmar +--- + clientserver.c | 22 ++++++ + testsuite/daemon-chroot-acl.test | 111 +++++++++++++++++++++++++++++++ + 2 files changed, 133 insertions(+) + create mode 100644 testsuite/daemon-chroot-acl.test + +diff --git a/clientserver.c b/clientserver.c +index b6eba098..3333aa96 100644 +--- a/clientserver.c ++++ b/clientserver.c +@@ -1310,6 +1310,28 @@ int start_daemon(int f_in, int f_out) + if (lp_proxy_protocol() && !read_proxy_protocol_header(f_in)) + return -1; + ++ /* Do reverse DNS lookup before chroot/setuid. The result is cached, ++ * so the later client_name() call will use this cached value. This ++ * ensures hostname-based ACLs work even when DNS is unavailable ++ * after chroot. ++ * ++ * "reverse lookup" can be set globally OR per-module, so we also ++ * scan each module: a deployment with "reverse lookup = no" in the ++ * global section but "reverse lookup = yes" in a specific module ++ * still triggers a post-chroot lookup at access-check time ++ * (rsync_module() in this file), which would also fail in the ++ * chroot and turn hostname-based deny rules into silent bypasses. */ ++ { ++ int need_reverse = lp_reverse_lookup(-1); ++ int j, num_modules = lp_num_modules(); ++ for (j = 0; !need_reverse && j < num_modules; j++) { ++ if (lp_reverse_lookup(j)) ++ need_reverse = 1; ++ } ++ if (need_reverse) ++ (void)client_name(client_addr(f_in)); ++ } ++ + p = lp_daemon_chroot(); + if (*p) { + log_init(0); /* Make use we've initialized syslog before chrooting. */ +diff --git a/testsuite/daemon-chroot-acl.test b/testsuite/daemon-chroot-acl.test +new file mode 100644 +index 00000000..9d1c1b63 +--- /dev/null ++++ b/testsuite/daemon-chroot-acl.test +@@ -0,0 +1,111 @@ ++#!/bin/sh ++ ++# Copyright (C) 2026 by Andrew Tridgell ++ ++# This program is distributable under the terms of the GNU GPL (see ++# COPYING). ++ ++# Regression test for GHSA-rjfm-3w2m-jf4f: a hostname-based "hosts deny" ++# rule must still match when the daemon performs a 'daemon chroot' and ++# the chroot does not contain the NSS files glibc needs for reverse DNS. ++# ++# Pre-fix, reverse DNS happened *after* the daemon chroot. With an empty ++# chroot the NSS lookup failed, client_name() returned "UNKNOWN", and a ++# deny rule referring to the connecting hostname silently failed to ++# match. ++# ++# Two scenarios are exercised so we can distinguish the case the fix ++# definitely covers from the per-module path that may still be ++# vulnerable: ++# A. global "reverse lookup = yes" (covered by b6abdb4c) ++# B. only module "reverse lookup = yes" (gap to verify) ++ ++. "$suitedir/rsync.fns" ++ ++case `uname -s` in ++Linux*) ;; ++*) test_skipped "test is Linux-specific (uses chroot+unshare)" ;; ++esac ++ ++# We need CAP_SYS_CHROOT. Re-exec under a user namespace if not root. ++if ! chroot / /bin/true 2>/dev/null; then ++ if [ -z "$RSYNC_UNSHARED" ] && unshare --user --map-root-user true 2>/dev/null; then ++ echo "Re-running under unshare --user --map-root-user..." ++ RSYNC_UNSHARED=1 exec unshare --user --map-root-user "$SHELL_PATH" $RUNSHFLAGS "$0" ++ fi ++ test_skipped "need CAP_SYS_CHROOT (root or unshare --user --map-root-user)" ++fi ++ ++# We need 127.0.0.1 to reverse-resolve to a real hostname while NSS is ++# still working (i.e. before the daemon's chroot). The daemon will ++# look that name up itself as part of its hostname-based ACL check; ++# we then deny that name and assert the connection is rejected. ++client_hostname=`getent hosts 127.0.0.1 2>/dev/null | awk 'NR==1 {print $2}'` ++if [ -z "$client_hostname" ] || [ "$client_hostname" = "127.0.0.1" ]; then ++ test_skipped "no reverse DNS for 127.0.0.1" ++fi ++ ++chrootdir="$scratchdir/chroot" ++rm -rf "$chrootdir" ++mkdir -p "$chrootdir/modroot" ++echo "from chroot" > "$chrootdir/modroot/file1" ++ ++conf="$scratchdir/test-rsyncd.conf" ++logfile="$scratchdir/rsyncd.log" ++ ++write_conf() { ++ cat >"$conf" <"$out" 2>&1 ++ rc=$? ++ ++ echo "----- $label (rsync exit $rc):" ++ cat "$out" ++ echo "----- daemon log:" ++ [ -f "$logfile" ] && cat "$logfile" ++ echo "-----" ++ ++ grep -q '@ERROR.*access denied' "$out" ++} ++ ++# Scenario A: global reverse lookup. Covered by b6abdb4c. ++write_conf yes yes ++if ! run_check "Scenario A (global reverse lookup = yes)"; then ++ test_fail "Scenario A: hostname deny rule was bypassed" ++fi ++ ++# Scenario B: only the per-module reverse-lookup setting is enabled. ++# The b6abdb4c fix only pre-warms client_name()'s cache when the ++# global setting is on, so the post-chroot lookup in this path may ++# still produce "UNKNOWN" and bypass the deny rule. ++write_conf no yes ++if ! run_check "Scenario B (per-module reverse lookup only)"; then ++ test_fail "Scenario B: hostname deny rule was bypassed (per-module reverse lookup with daemon chroot still has the bypass)" ++fi ++ ++exit 0 diff --git a/meta/recipes-devtools/rsync/rsync_3.4.1.bb b/meta/recipes-devtools/rsync/rsync_3.4.1.bb index 2145d4ce7e3..d0d57defe8d 100644 --- a/meta/recipes-devtools/rsync/rsync_3.4.1.bb +++ b/meta/recipes-devtools/rsync/rsync_3.4.1.bb @@ -28,6 +28,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \ file://CVE-2026-43619_p6.patch \ file://CVE-2026-43618.patch \ file://CVE-2026-43620.patch \ + file://CVE-2026-43617.patch \ " SRC_URI[sha256sum] = "2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52" From patchwork Mon Jul 27 22:55:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93608 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9272DC54F52 for ; Mon, 27 Jul 2026 22:56:20 +0000 (UTC) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43749.1785192979630425907 for ; Mon, 27 Jul 2026 15:56:20 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=afeL3AE6; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-49553515a8bso39036425e9.1 for ; Mon, 27 Jul 2026 15:56:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192978; x=1785797778; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=KLrYa6huvcFEUJEO14B4nxz14jfDg7IlorgCJuYTUcI=; b=afeL3AE6tvhGOrowsLbss+SNOaB1NIH1MHMLglo2Yq9x2XBsJbGin2dtsbIcc2cdpL lNJC/mgr3JaSAyDDwy6Ssa3NqpV+ElRtEgfGRb8j4gbId8EAtiynIij32hn8I0cVXMVv VqfzjLjIa30CwoBVp2Fg8LsUygcCbwoA/pG0Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192978; x=1785797778; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=KLrYa6huvcFEUJEO14B4nxz14jfDg7IlorgCJuYTUcI=; b=slVmHV85u2E8LuPrcWIOdnmX3bnfGMq34aIpkCeqdfYPzDlLZsGuE34pAm05j05MSv VlnPAubP1j7HAPFkWWtGnMEsK1k/xgLI68EgGrX1V97HKvSGIPHcIsX+YqlCi6l1QTzc uSlQ4QoqglwNOc4YYLJMfOQxLNK9KhVmUjx150WeFZyKf4V1qt85te3tNlXHtA/cyPDa rzd83p7gAfVe3sHwSX4J2h71EBme5ChrJADDa/E1TM4FIWKnJXvtYYVGwMPBifGwDAsC M67uFEpC/6tU3EP01kFn2jGDejOZtN2zqbn8vUxisuSz8C70dD4ldgpWVbSEC5Rsvvxj ALJg== X-Gm-Message-State: AOJu0YzGXYv7UFX6Y9/2Y+e2QatxD7rWRdbDssPbHpyjeoJGkmg4MbEn IxmP/LxkFbgYRSPtCNGppDXAHkWfIymXDHZEMJrvAbwgwe40KPYZrFpUm+CsEiY42ufVEIBOE+a u83HBGww= X-Gm-Gg: AR+sD11OOFZuMhkl6LDN3kmXzHqpB+d/6j+YvM7IGaw2uwMEmKv141Pw+XoCdRsw7Qa EhpgvvF8Oog7+Ux3ub/m2jgAkX98W9D6kHE8YzXlxGvsx4M8VbG2/UiJyAdzwnIo+f/ZbdHI77A SM3lfAsI3qHMJIrMO4opnuyijcXY6Z/o6/+v3C3ItFUVe0E8ophr+nRJx6u+l7heSF3Lf6ZFa+U oLuxaNSnLTAJBSvpiIavDetb+GBIk3xBY9CL/Fj9eyHybwwQDy/UDvutwsVDcWgHS1l04Ghld/w Xwms0sjg/m+aqWFNBP/JKyDamgZj7RDhFxXyfNxTh0N7wGq6oSeGBeXmu3GljDDtw7RBk8N3Lnc GcjykfbmyByHabGOCitW9QEDpuwz4Z3h48VR2tKVExOikM7biMswybVhfmxm4Z10QfvG2P4h117 3cmO/+VvledxkaCu5yineT9CTF3E97wIK7+7Rsevf67NoXT86vpEFrriXfBdo71sS+01SvyF7Vo 5yyGg== X-Received: by 2002:a05:600c:870c:b0:493:f7c8:eae2 with SMTP id 5b1f17b1804b1-496b56f9749mr120537195e9.15.1785192977734; Mon, 27 Jul 2026 15:56:17 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.16 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:16 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 11/36] rsync: Fix CVE-2026-45232 Date: Tue, 28 Jul 2026 00:55:25 +0200 Message-ID: <9e76a8e19462dab7f04cfa36116ed882fa4947d9.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242119 From: Ashishkumar Parmar This patch applies the upstream v3.4.3 backport for CVE-2026-45232. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/RsyncProject/rsync/commit/a5fc5ebe7a8ef1aa72f6e344599f97fd4427ecba [2] https://github.com/RsyncProject/rsync/security/advisories/GHSA-8f85-j2cv-59m8 Signed-off-by: Ashishkumar Parmar Signed-off-by: Yoann Congal --- .../rsync/files/CVE-2026-45232.patch | 240 ++++++++++++++++++ meta/recipes-devtools/rsync/rsync_3.4.1.bb | 1 + 2 files changed, 241 insertions(+) create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-45232.patch diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-45232.patch b/meta/recipes-devtools/rsync/files/CVE-2026-45232.patch new file mode 100644 index 00000000000..544793bd1d1 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/CVE-2026-45232.patch @@ -0,0 +1,240 @@ +From de47c801a8083f1913e149c6ee6d0e864b728995 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell +Date: Wed, 13 May 2026 20:35:35 +1000 +Subject: [PATCH] socket: reject over-long proxy response line + +fixes a one byte stack overflow when using RSYNC_PROXY with a +malicious proxy. + +Reach: only when RSYNC_PROXY is set and a malicious or MITM'd +proxy returns the pathological response. The byte written is +always '\0' and the attacker doesn't choose the offset, so impact +is corruption of one adjacent stack byte and possible later +misbehaviour or crash -- no information disclosure beyond the +existing rprintf of buffer contents. + +Reported by Aisle Research via Michal Ruprich + +CVE: CVE-2026-45232 +Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/a5fc5ebe7a8ef1aa72f6e344599f97fd4427ecba] + +(cherry picked from commit a5fc5ebe7a8ef1aa72f6e344599f97fd4427ecba) +Signed-off-by: Ashishkumar Parmar +--- + socket.c | 30 +++-- + testsuite/proxy-response-line-too-long.test | 128 ++++++++++++++++++++ + 2 files changed, 145 insertions(+), 13 deletions(-) + create mode 100755 testsuite/proxy-response-line-too-long.test + +diff --git a/socket.c b/socket.c +index c2075adf..6a8f6f4a 100644 +--- a/socket.c ++++ b/socket.c +@@ -47,21 +47,23 @@ static struct sigaction sigact; + + static int sock_exec(const char *prog); + ++#define PROXY_BUF_SIZE 1024 ++ + /* Establish a proxy connection on an open socket to a web proxy by using the + * CONNECT method. If proxy_user and proxy_pass are not NULL, they are used to + * authenticate to the proxy using the "Basic" proxy-authorization protocol. */ + static int establish_proxy_connection(int fd, char *host, int port, char *proxy_user, char *proxy_pass) + { +- char *cp, buffer[1024]; +- char *authhdr, authbuf[1024]; ++ char *cp, buffer[PROXY_BUF_SIZE + 1]; ++ char *authhdr, authbuf[PROXY_BUF_SIZE + 1]; + int len; + + if (proxy_user && proxy_pass) { +- stringjoin(buffer, sizeof buffer, ++ stringjoin(buffer, PROXY_BUF_SIZE, + proxy_user, ":", proxy_pass, NULL); + len = strlen(buffer); + +- if ((len*8 + 5) / 6 >= (int)sizeof authbuf - 3) { ++ if ((len*8 + 5) / 6 >= PROXY_BUF_SIZE - 3) { + rprintf(FERROR, + "authentication information is too long\n"); + return -1; +@@ -74,14 +76,14 @@ static int establish_proxy_connection(int fd, char *host, int port, char *proxy_ + authhdr = ""; + } + +- len = snprintf(buffer, sizeof buffer, "CONNECT %s:%d HTTP/1.0%s%s\r\n\r\n", host, port, authhdr, authbuf); +- assert(len > 0 && len < (int)sizeof buffer); ++ len = snprintf(buffer, PROXY_BUF_SIZE, "CONNECT %s:%d HTTP/1.0%s%s\r\n\r\n", host, port, authhdr, authbuf); ++ assert(len > 0 && len < PROXY_BUF_SIZE); + if (write(fd, buffer, len) != len) { + rsyserr(FERROR, errno, "failed to write to proxy"); + return -1; + } + +- for (cp = buffer; cp < &buffer[sizeof buffer - 1]; cp++) { ++ for (cp = buffer; cp < &buffer[PROXY_BUF_SIZE - 1]; cp++) { + if (read(fd, cp, 1) != 1) { + rsyserr(FERROR, errno, "failed to read from proxy"); + return -1; +@@ -90,11 +92,13 @@ static int establish_proxy_connection(int fd, char *host, int port, char *proxy_ + break; + } + +- if (*cp != '\n') +- cp++; +- *cp-- = '\0'; +- if (*cp == '\r') +- *cp = '\0'; ++ if (cp == &buffer[PROXY_BUF_SIZE - 1]) { ++ rprintf(FERROR, "proxy response line too long\n"); ++ return -1; ++ } ++ *cp = '\0'; ++ if (cp > buffer && cp[-1] == '\r') ++ cp[-1] = '\0'; + if (strncmp(buffer, "HTTP/", 5) != 0) { + rprintf(FERROR, "bad response from proxy -- %s\n", + buffer); +@@ -110,7 +114,7 @@ static int establish_proxy_connection(int fd, char *host, int port, char *proxy_ + } + /* throw away the rest of the HTTP header */ + while (1) { +- for (cp = buffer; cp < &buffer[sizeof buffer - 1]; cp++) { ++ for (cp = buffer; cp < &buffer[PROXY_BUF_SIZE]; cp++) { + if (read(fd, cp, 1) != 1) { + rsyserr(FERROR, errno, + "failed to read from proxy"); +diff --git a/testsuite/proxy-response-line-too-long.test b/testsuite/proxy-response-line-too-long.test +new file mode 100755 +index 00000000..7f55c43b +--- /dev/null ++++ b/testsuite/proxy-response-line-too-long.test +@@ -0,0 +1,128 @@ ++#!/bin/sh ++ ++# Copyright (C) 2026 by Andrew Tridgell ++ ++# This program is distributable under the terms of the GNU GPL (see ++# COPYING). ++ ++# Regression test for the off-by-one stack OOB write in ++# establish_proxy_connection() in socket.c when a malicious or ++# man-in-the-middle HTTP proxy returns a first response line of ++# 1023+ bytes without a '\n' terminator. ++# ++# Pre-fix: the read loop walked buffer[0..sizeof-2] one byte at a ++# time, then post-loop logic did "if (*cp != '\n') cp++; *cp-- = ++# '\0';". If no newline arrived before the loop filled the buffer, ++# cp was left at &buffer[sizeof-1] (never written by the loop), ++# *cp held stale stack bytes, and cp++ pushed cp one past the array. ++# The null-termination then wrote one byte out of bounds on the ++# stack. AddressSanitizer reports stack-buffer-overflow at the ++# null-termination site. ++# ++# Post-fix: the bound-exhaustion case is detected by position and ++# rejected with an "proxy response line too long" message, so no ++# OOB write occurs and rsync exits with a non-signal status. ++ ++. "$suitedir/rsync.fns" ++ ++command -v python3 >/dev/null 2>&1 || test_skipped "python3 not available" ++ ++workdir="$scratchdir/workdir" ++mkdir -p "$workdir" ++cd "$workdir" ++ ++port_file="$workdir/port" ++proxy_log="$workdir/proxy.log" ++ ++# A minimal TCP listener: binds to an ephemeral port on 127.0.0.1, ++# writes the chosen port to $port_file *before* accept() so the test ++# can synchronise without a sleep, accepts one connection, reads ++# until end-of-headers or 64 KiB, sends exactly 1023 bytes of 'X' ++# with no '\n', then closes. ++python3 - "$port_file" >"$proxy_log" 2>&1 <<'PYEOF' & ++import socket, sys, os ++port_file = sys.argv[1] ++s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) ++s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) ++s.bind(("127.0.0.1", 0)) ++port = s.getsockname()[1] ++tmp = port_file + ".tmp" ++with open(tmp, "w") as fp: ++ fp.write("%d\n" % port) ++os.rename(tmp, port_file) # atomic visibility to the shell side ++s.listen(1) ++conn, _ = s.accept() ++conn.settimeout(5) ++try: ++ data = b"" ++ while b"\r\n\r\n" not in data and len(data) < 65536: ++ chunk = conn.recv(8192) ++ if not chunk: ++ break ++ data += chunk ++except socket.timeout: ++ pass ++conn.sendall(b"X" * 1023) # exactly the buffer-1 trigger size ++try: ++ conn.shutdown(socket.SHUT_RDWR) ++except OSError: ++ pass ++conn.close() ++s.close() ++PYEOF ++proxy_pid=$! ++ ++# Wait up to ~10s for the listener to publish its port. ++i=0 ++while [ ! -s "$port_file" ] && [ $i -lt 10 ]; do ++ sleep 1 ++ i=$((i + 1)) ++done ++ ++if [ ! -s "$port_file" ]; then ++ kill "$proxy_pid" 2>/dev/null ++ cat "$proxy_log" >&2 2>/dev/null ++ test_fail "proxy listener never published a port" ++fi ++ ++port=`cat "$port_file"` ++case "$port" in ++ *[!0-9]*|"") kill "$proxy_pid" 2>/dev/null; test_fail "bogus port from listener: '$port'" ;; ++esac ++ ++# Run rsync through the malicious proxy. Any rsync:// URL works: ++# the proxy intercepts the CONNECT and never forwards anywhere. ++rsync_err="$workdir/rsync.err" ++ ++# rsync MUST exit non-zero here (the proxy is misbehaving). ++# Use `|| status=$?` so we capture the real exit code under `sh -e`; ++# `if ! cmd; then status=$?` would only ever see 0 because the `!` ++# is the last command before `$?`. ++status=0 ++RSYNC_PROXY="127.0.0.1:$port" \ ++ $RSYNC rsync://example.invalid:873/whatever/ "$workdir/out/" \ ++ >/dev/null 2>"$rsync_err" || status=$? ++ ++# Reap the listener. ++wait "$proxy_pid" 2>/dev/null || true ++ ++# 1. rsync must not have crashed (SIGSEGV/SIGABRT report >= 128). ++if [ "$status" -ge 128 ]; then ++ cat "$rsync_err" >&2 ++ test_fail "rsync killed by signal (status=$status) -- possible stack OOB regression" ++fi ++ ++# 2. rsync must have actually exited non-zero (i.e. saw the bad proxy). ++if [ "$status" -eq 0 ]; then ++ cat "$rsync_err" >&2 ++ test_fail "rsync returned success despite malformed proxy response" ++fi ++ ++# 3. The new error message must appear. ++if ! grep -q "proxy response line too long" "$rsync_err"; then ++ cat "$rsync_err" >&2 ++ test_fail "expected 'proxy response line too long' in rsync stderr" ++fi ++ ++echo "OK: over-long proxy response line rejected cleanly without crashing" ++exit 0 diff --git a/meta/recipes-devtools/rsync/rsync_3.4.1.bb b/meta/recipes-devtools/rsync/rsync_3.4.1.bb index d0d57defe8d..2744b3a80f7 100644 --- a/meta/recipes-devtools/rsync/rsync_3.4.1.bb +++ b/meta/recipes-devtools/rsync/rsync_3.4.1.bb @@ -29,6 +29,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \ file://CVE-2026-43618.patch \ file://CVE-2026-43620.patch \ file://CVE-2026-43617.patch \ + file://CVE-2026-45232.patch \ " SRC_URI[sha256sum] = "2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52" From patchwork Mon Jul 27 22:55:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93624 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF1D5C54F5D for ; Mon, 27 Jul 2026 22:56:31 +0000 (UTC) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43750.1785192980646452714 for ; Mon, 27 Jul 2026 15:56:20 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=31XEp1SP; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4921eed3fa2so22442205e9.0 for ; Mon, 27 Jul 2026 15:56:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192979; x=1785797779; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=EMOi7/T+pdSwLO7Kua/i2XnP5PwZNoDRSBsLD5R9v8U=; b=31XEp1SPGu+kFRxdVXBjNNRYA8gC+b12yrrKZZPoTMSEBWCOVJNdZe6HJ/O0VVTMKO KpS+rdY8/ozSiwWBzO6w/HOYLAV4iaDp0tIfOyV/IbVY94SQqsPqleyhdP/j4ZPjHC3i oMcefQof06v4D13uFjmGvMeAXciatdbAEF+T8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192979; x=1785797779; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=EMOi7/T+pdSwLO7Kua/i2XnP5PwZNoDRSBsLD5R9v8U=; b=DXVSnxKhGFMoIo+rVerfeu1k8DH3T5s8QWxoYA1xB0ltKis14yuFdR1v3SlKafFRZu ylmRHh0cs8nFgoD1kZwVX/tcK+DpKJSq8yTFFqQs2uvxI7Je4j5UX3R59Bh+Xz/LWRc5 NPDEVRDTDm3lqSJn2BG+ng1ZKV+CPevJrDy0zEQQT+aeX1o2cSSpEtv+GZ+DTO91g3TG xrUaJJ/fD3uHlh3L3OWkvA2uJmdLWzPdT1+XdZZlG470A8yqL4FHsu8/QCrSGohXgfbU 3lkNvt8iJz1XNJgVpCXujKJRIv0pzZU7k8Jl8zz8l8xvKL185iI+V+2DpwIdX6UbxIw1 PAqQ== X-Gm-Message-State: AOJu0Yys6WBw+AJevYWYhCePbZ5uafZtu2rH+hixsNNFcC40uTo1Yb5i D/y40wUW7HiW/CT7Jy/+Auh07o+itib+X34hO6TWJS+YANSwUKf9TEqVRuPrbATBbxN/fOYlLl7 PEY0LKis= X-Gm-Gg: AR+sD10MeEa7+73DIzGGF8nnicoAleG9Xgh0/HAUrpeQOwIW6tuBeNik81GXod+nu+2 H/Zq01tsJvrqS5rBpTa+94m9ZavdGAHrCGJmZxBjZ3OrPyKRsoLMA2/iDAeU1Z+Qz/p3DNhROBp eSqUncMQbzb71cVoxnHLl/ViLamsL9kmnBt41SlAyK0myfoysYPwFB6tDvurjHiKzg2w6yfCXKl 8n053Eh/QLadQM8Jbw4wo9ZAt02iuaXjff6flT26Dxd8tFAgDmL12des38XuTdo+Juzfi63MIG4 QjA4LhS9XlKt13OrTq7Q+VRq9mfkLRifWL4zCTA7J0GTwk3ZCBYpQNPQ05CquDziLdxksaKdf35 g8+xqPGvMDSUSjGqfrsIxxOcQYJHqC957zSARkpCwf53bEpr7DlTvYtPRoIdps8f1grbsoEH8Ie 1jeoByKV325iawVLfsfR5ByPwxcQ8ygPE+6Df1npTQqAm+jgm2pp3IWqheHb8pjRJufQW9uDAYB 27rpg== X-Received: by 2002:a05:600c:5253:b0:495:4732:1eb9 with SMTP id 5b1f17b1804b1-496c4fce74dmr9591115e9.21.1785192978785; Mon, 27 Jul 2026 15:56:18 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.17 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:17 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 12/36] gnutls: fix CVE-2026-3833 Date: Tue, 28 Jul 2026 00:55:26 +0200 Message-ID: <2001fccf97571e04a87769f02e76896bfc1cfcb6.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242120 From: Adarsh Jagadish Kamini Backport patch to fix CVE-2026-3833. References: https://nvd.nist.gov/vuln/detail/CVE-2026-3833 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/19f6508647bdcd3ce21130201e484d7ca6d962c5 Tested with ptest: Before: PASSED: 371, FAILED: 0, SKIPPED: 15 After: PASSED: 371, FAILED: 0, SKIPPED: 15 Signed-off-by: Adarsh Jagadish Kamini Signed-off-by: Yoann Congal --- .../gnutls/gnutls/CVE-2026-3833.patch | 90 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.12.bb | 1 + 2 files changed, 91 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch new file mode 100644 index 00000000000..25ba126054c --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch @@ -0,0 +1,90 @@ +From 0af3e60734ade8e89e6bec6c2687164e273fcbf2 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Mon, 16 Mar 2026 15:29:40 +0100 +Subject: [PATCH] x509/name-constraints: compare domain names case-insensitive + +RFC 5280 7.2: +> When comparing DNS names for equality, conforming implementations +> MUST perform a case-insensitive exact match on the entire DNS name. +> When evaluating name constraints, conforming implementations MUST +> perform a case-insensitive exact match on a label-by-label basis. + +Domain name comparison during name constraints processing +was case-sensitive. For excluded name constraints, this could lead to +incorrectly accepting domain names that should've been rejected. +The code for comparing domain names and domain name parts of emails +has been modified to perform case-insensitive comparison instead. + +Reported-by: Oleh Konko +Reported-by: Joshua Rogers of AISLE Research Team +Fixes: #1223 +Fixes: #1803 +Fixes: #1852 +Fixes: CVE-2026-3833 +Fixes: GNUTLS-SA-2026-04-29-5 +CVSS: 7.4 High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N +Signed-off-by: Alexander Sosedkin + +CVE: CVE-2026-3833 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/19f6508647bdcd3ce21130201e484d7ca6d962c5] + +Signed-off-by: Adarsh Jagadish Kamini +--- + lib/x509/name_constraints.c | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index 04722bdf4..dee045d25 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -35,6 +35,7 @@ + #include "x509_int.h" + #include "x509_ext_int.h" + #include ++#include "c-strcase.h" + + #include "ip.h" + #include "ip-in-cidr.h" +@@ -80,7 +81,7 @@ enum name_constraint_relation { + NC_SORTS_AFTER = 2 /* unrelated constraints */ + }; + +-/* A helper to compare just a pair of strings with this rich comparison */ ++/* Helpers to compare just a pair of strings with this rich comparison */ + static enum name_constraint_relation + compare_strings(const void *n1, size_t n1_len, const void *n2, size_t n2_len) + { +@@ -96,6 +97,22 @@ compare_strings(const void *n1, size_t n1_len, const void *n2, size_t n2_len) + return NC_EQUAL; + } + ++static enum name_constraint_relation ++compare_strings_case_insensitive(const void *n1, size_t n1_len, const void *n2, ++ size_t n2_len) ++{ ++ int r = c_strncasecmp(n1, n2, MIN(n1_len, n2_len)); ++ if (r < 0) ++ return NC_SORTS_BEFORE; ++ if (r > 0) ++ return NC_SORTS_AFTER; ++ if (n1_len < n2_len) ++ return NC_SORTS_BEFORE; ++ if (n1_len > n2_len) ++ return NC_SORTS_AFTER; ++ return NC_EQUAL; ++} ++ + /* Rich-compare DNS names. Example order/relationships: + * z.x.a INCLUDED_BY x.a BEFORE y.a INCLUDED_BY a BEFORE x.b BEFORE y.b */ + static enum name_constraint_relation compare_dns_names(const gnutls_datum_t *n1, +@@ -121,8 +138,8 @@ static enum name_constraint_relation compare_dns_names(const gnutls_datum_t *n1, + while (j && n2->data[j - 1] != '.') + j--; + +- rel = compare_strings(&n1->data[i], i_end - i, &n2->data[j], +- j_end - j); ++ rel = compare_strings_case_insensitive(&n1->data[i], i_end - i, ++ &n2->data[j], j_end - j); + if (rel == NC_SORTS_BEFORE) /* x.a BEFORE y.a */ + return NC_SORTS_BEFORE; + if (rel == NC_SORTS_AFTER) /* y.a AFTER x.a */ diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb index 3085a62310a..3ad011742e4 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb @@ -36,6 +36,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-3832_p2.patch \ file://CVE-2026-42009_p1.patch \ file://CVE-2026-42009_p2.patch \ + file://CVE-2026-3833.patch \ " SRC_URI[sha256sum] = "a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51" From patchwork Mon Jul 27 22:55:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93623 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CFAC5C54F5C for ; Mon, 27 Jul 2026 22:56:31 +0000 (UTC) Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43752.1785192981849824923 for ; Mon, 27 Jul 2026 15:56:22 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=g2780X+h; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4955aa106b1so31573495e9.0 for ; Mon, 27 Jul 2026 15:56:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192980; x=1785797780; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=QKaHyEuykbAmzrVBoggjcul0Xxjx58+VPkjTgonvpQ8=; b=g2780X+hh2u2TpPTC95iko+3eOstezb+d83RMQrjVlFdqwFyBMJJNxvSatACopvV1m tzLvwwk8SlDQDZFASHOfH2e0ublUW64YzLNU+eJI1uTIti8KCNgXVmL2BxMKkYBaJejR 8D4n2/n+7yz7PEhNNhf8rGcTMXrct18mQBV2U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192980; x=1785797780; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=QKaHyEuykbAmzrVBoggjcul0Xxjx58+VPkjTgonvpQ8=; b=kIb9Lj3s8R96/1bRh+q0puKTVxvmS2DLBwv8ZgZhNny7GiPrXTMX6sGMtsY7D9ilmh tLfm/9MLi9XYLP6naoA5jwWMYE1Sa22qN/vX6HO/VT690Weo0RK4AIxWIX1DfzqaSW9r w8sGWc3oYABaR9r1rytNHlhiDSUjb5hTuHF5TwuE7I937rxgNM2fvp2CqXeEBU8X1dYN 0BF55yNvpSgLSTgeVRiCUGtIVKnkG/8I5jZ6Fd46WzWmIxCN1qxhHZhJQ1BnBQU0Vdq5 YOz5XkhAXik/yT6ssxtkyu0EFJM12OGHuzigkM9nr/DI68p2pOOv3fX5AkNL/3yOzycc SRSQ== X-Gm-Message-State: AOJu0Yy4IU3b9P/mryEYzpYXmxsMMK7stJlm1Cp4xgga2nWu+7UHVPAS +ukV17cOYlC0faH6nWxr9+irc7fUfCyE7HLXmL8IclwciavUUgHvsAsuDLi81ed6WN91oKD5QkG Y7+05Wkk= X-Gm-Gg: AR+sD10nEeAB2epZ0B5kWtPX+wzdGFJ1WVfAARzfBxAACVF0gAnJ7gqmh4aeQKkSG2h XC3TTOpsCJ0u4vtx4vte0yMWhtpEnNe7H19UZEWJZWxE9NHyeFzmigIEFsFUQhgAaJxleFFCbZu YERTmj7ViNAcbmf2A0XyQylspzUOGx513eQvuxfH06QP2pBhMeRiXEDo5+e3xWCAeQ1bV/StcEf XDpSMTsr2hx5Eb0gygo9fpjXqf2NWHcrL4hey4u3bR+mK0QzPPkJ/Qtyen7s14kNbVk3KQQ5Utf 4rtcOfKhnlKIrmrM2QKyH7T1Ags2Si7Ik3zjcvbryUJcM9zxTT7DMSP7Ik0azA8MxwDpE2v9gCe yUkysm6ujdEI0qE6U3odq73xljnsK+F78o0Qb1pEKZWLqKXlfqe8z+wTpSto6U5fhrJQL8ytiWf 3vAYieCG0phoEbyeZ3Q0rgS9L0cMl/c2KzwrbCPF/yKWIaTRr0riq8zg24zD2GR9Fj4xL6cqjYb Tdj8Q== X-Received: by 2002:a05:600c:45d5:b0:493:df1d:7488 with SMTP id 5b1f17b1804b1-496b56d51aemr122956965e9.16.1785192980075; Mon, 27 Jul 2026 15:56:20 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.18 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:19 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 13/36] libpng: set status for CVE-2026-40930 Date: Tue, 28 Jul 2026 00:55:27 +0200 Message-ID: <6d16a4aac261162704f5d5974081d061fe1cf630.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242121 From: Peter Marko Per [1]: * The vulnerable code originates from the third-party libpng-apng patch, which adds APNG support to libpng 1.6.x. * Upstream libpng 1.6.x (without the apng patch) is not affected. As Yocto never included libpng-apng patch, we can ignore this CVE. [1] https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (cherry picked from commit 8a4758455a2534050ee4b5cedcfdf86da9f243c2) Signed-off-by: Yoann Congal --- meta/recipes-multimedia/libpng/libpng_1.6.56.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.56.bb b/meta/recipes-multimedia/libpng/libpng_1.6.56.bb index 9dbd0d26e06..9a85d44f52b 100644 --- a/meta/recipes-multimedia/libpng/libpng_1.6.56.bb +++ b/meta/recipes-multimedia/libpng/libpng_1.6.56.bb @@ -72,3 +72,5 @@ do_install_ptest() { } BBCLASSEXTEND = "native nativesdk" + +CVE_STATUS[CVE-2026-40930] = "cpe-incorrect: Yocto never included affected libpng-apng patch" From patchwork Mon Jul 27 22:55:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93621 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AB2C6C54F5B for ; Mon, 27 Jul 2026 22:56:31 +0000 (UTC) Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43753.1785192982668069370 for ; Mon, 27 Jul 2026 15:56:22 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=XJ2ci+MS; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4954f5e8020so15636545e9.2 for ; Mon, 27 Jul 2026 15:56:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192981; x=1785797781; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=OQRySA8FFcgoLCak0R720yown2ebhLpBB3Zcrz2McSA=; b=XJ2ci+MS70vCHX6yU8w8dmOPBheAZ4RinewmQeWZNmIWPymuJa6BhvjHnJk2ww7HtO bjG9LIbPrO6B4dLdtlKr/ugoUniyj4u8uDJbx5PdRuQ6GU25YDrVQbF975uCDdS9Vir3 m5Zkw7BqITzmaq1cazOt3J0BitDO+Uw2RAGfk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192981; x=1785797781; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=OQRySA8FFcgoLCak0R720yown2ebhLpBB3Zcrz2McSA=; b=ZyOLuWHmmIATY1PHg3B3Wk6nPWX/uOW8L3cF3qQJURHJ237DYnq3VNCy8FX46Vw5jY Oo4dRofX/Qzh+vBTVZ34cw+BoJ6K5EbG6tj8EKZPfRQ7HM5n/chPbsiUmUlIpRCnw8qg GplA+gRG01YECKK4pgOnvBK8V17njNinfs1YGCiMdZjD232/7Ly0ZunBFUlLnQzKnOlZ TDvtLrMDPtyQ+bg7ccVizoF7u5ThYwGtuRo6NzmcfQGdc6sFrml7XZRpqBEhGuhOVVG2 HhMaK8mbPbPh0fjsoxS4NW+fzrROIASxFglJTspglCjFOKrdlKEowZ0xSfILSG0KYkxx HQCA== X-Gm-Message-State: AOJu0YzR6zusKmSxUAMqWsXsuCFEYN30jErn3EPljoGQc1RgNgJh614j 0TNHEQ3retywlZrXq1f8XLI5UtxoYJK1hk0iYRLAQqwBVLko9ylbXQP8ZMvR20HSPlaWMo9X3Z6 dmjukJJ4= X-Gm-Gg: AR+sD12prjJZ9BouQvS/n8XsWMWp9mykuAe3q1uqp9X9NsoUAIcBHo4RbO+lT4U7kFT 88cpX5QKPJppULd0g9a9KVCPcy9pohX6H91E/rywmPfmLJ/HDnTg3sN7fitKMvVUr91MqhwOCIq Oh5PZ7+auiIYuQxNZivVa5lBUZEJI8WOgavsI9dXO623QqwnHRod/lTvwMf2BR/s2rec8UCY8cv vxZUmK6yk8FKFce91w3R0Jy3zBar5378DYkt/puIgK2U4IeyxxvAhctsfc3G36h4rWquYK5sOxa RaRH35e7ut5mV1ZHLz741FA7dAgmyLd6C8M6Jhblkwqp+2mW6hbjMkG79p7C8tgcFEWrvIE5wH9 60WY3o5hefeWJ8ud4Zl0dv1WbTf2LijbD6pqSYJfb05W/gghFpXKdrj1GfB+obvUgqAC3XqR2+J L905Fgygyaq5WjTada6S8nf8wcZ7P46x3t1PkTYy4SRP5nn6fVWQDtY8SeohsDpwlAv6KvWm31z +xiz/fp/hQuVEi7 X-Received: by 2002:a05:600c:c87:b0:495:3e81:76fa with SMTP id 5b1f17b1804b1-496b56ff0fdmr133932315e9.15.1785192981018; Mon, 27 Jul 2026 15:56:21 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:20 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 14/36] python3-cryptography: set CVE_PRODUCT Date: Tue, 28 Jul 2026 00:55:28 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242122 From: mark.yang NVD lists it as cryptography.io:cryptography and CNA lists it as pyca:cryptography, so set both vendor:product pairs to match correctly and precisely. Suggested-by: Ross Burton Signed-off-by: mark.yang Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit b721019e0b2ccbaa8de267e14b282c48a5a3de8b) Signed-off-by: Himanshu Jadon Signed-off-by: Yoann Congal --- meta/recipes-devtools/python/python3-cryptography.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-cryptography.bb b/meta/recipes-devtools/python/python3-cryptography.bb index fc5cb50b029..42e8c5ff19c 100644 --- a/meta/recipes-devtools/python/python3-cryptography.bb +++ b/meta/recipes-devtools/python/python3-cryptography.bb @@ -73,4 +73,6 @@ FILES:${PN}-dbg += " \ ${PYTHON_SITEPACKAGES_DIR}/${SRCNAME}/hazmat/bindings/.debug \ " +CVE_PRODUCT = "cryptography.io:cryptography pyca:cryptography" + BBCLASSEXTEND = "native nativesdk" From patchwork Mon Jul 27 22:55:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93619 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 98F8BC54F57 for ; Mon, 27 Jul 2026 22:56:31 +0000 (UTC) Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43801.1785192983682785751 for ; Mon, 27 Jul 2026 15:56:23 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=NOjFsgy6; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-49557167508so31086505e9.1 for ; Mon, 27 Jul 2026 15:56:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192982; x=1785797782; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=qHqvvf2a1aTv9Wx3hEdxQtZgrBUjY4aRWiX+nXmy7oI=; b=NOjFsgy6AdJNm8HVs/KEP6Lw3RHvLTdPHVJzVSgjRWINVFdIIU3I+7ltFHl8AkO3rg 6UR0lZ4WF1WxwpNxz79FAIM8E0lpixJG0bnmqjT05Zjt8K33MMjvoaI4Kw7HEdalFzz/ MX0h31ygikwrqMKuL9qVWzsUgceekRv46Cs2Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192982; x=1785797782; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=qHqvvf2a1aTv9Wx3hEdxQtZgrBUjY4aRWiX+nXmy7oI=; b=IoMRIdOxAoBmblxzheAn4J3ed2aA70KJXpEbO4dTAado6XjRd1+A3PitKJKlWo2ICT dNYY7XGcDU54rsa4joIfTDFZJUK44N+ch6vHXlVtn66tHIXyMO/53nwozcOXz5GoEQCm N/YezSkk6LVzNSx3pX8c+3R6W4DLb+BmItLrP66YoqZ9F2qjPUAH88J9nsfYtMatoYIb DqAJkJ9qH8pzaQDbfIouILlhvgMpnGZTXrIf7sblpaloq1S4g6djV6OhxDgNkIXvf5Vr E9VOChnyVkXHoOGE0ba8WlwlfCIFCO72l0iTAgsLkVodqNSZidSbaI44smR1Pp2Jy4Oa RLCA== X-Gm-Message-State: AOJu0YyboKdMnXGK4WsLCmLjLQsiWGvivHS52gt5jTV4fNtH9lLWzdNB rE1rSD1/j/gMs+aGMhY+url216/nDwAFH9zkJadkxrEnxlfHkdiBwDh9G+pBbO6RzCPKn2C+Xel z6+vPADU= X-Gm-Gg: AR+sD11u3kpMyZNj4MT5G0rayt2aBwv0finWE3XyLoTny59KnV6G9bFPJZmFxPT9TOu MFlfQSj1tggNiegycv74Kpjou318PUyNwHw4prezxif0W7z0fVD2b3UXrIJUq9/g5nD9jrt53Mn kOEUQFezaP7yYnlcfrv1TRRXQUe+nXQLYa53jXYdIR36DCIuptJ70oMuasNvbdpLlpRAimXu/6Q Id4JeMl/VfNoMyBorcOnedGKE9UUm3uoWIM2GlIGRKKtImqANgDSVn2HoEuQHLzh5KTh3CZOR5I XGDkmmxcGk2y4EbqNfsUGL44gcvd/M2nYA5bJKFnL0ceWfiyoddxPByf1BlZFY55av5ykAcPzko tQPi/lzdBsiMwVra7Rp3gs99raq7lrlsXQ8gN87Z0B7TSFGOqqnXeNmdHG9RjM7crwCtLHK2a9i 4A94+nAJfK8l8a5JOippJgHidmdc8J8DzlSNppwJVL89zg8wISKifP62wXTyuXRaRe3D/MVbSSD qAOww== X-Received: by 2002:a05:600c:6089:b0:495:6482:9d8c with SMTP id 5b1f17b1804b1-496c4fd630fmr8099885e9.37.1785192981950; Mon, 27 Jul 2026 15:56:21 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.21 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:21 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 15/36] python3-ply: set CVE_PRODUCT Date: Tue, 28 Jul 2026 00:55:29 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242123 From: mark.yang NVD registers ply as dabeaz:ply, so the default python:ply vendor prefix never matches and no CVEs are reported. Use the exact vendor:product pair. CVE-2025-56005 will then show as unpatched; no fixed release exists. Suggested-by: Paul Barker Signed-off-by: mark.yang Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit bb80fef9a76649fb1144408fbc7e2903439cd556) Signed-off-by: Himanshu Jadon Signed-off-by: Yoann Congal --- meta/recipes-devtools/python/python3-ply_3.11.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb b/meta/recipes-devtools/python/python3-ply_3.11.bb index 2c5fa3f215e..06393ac4fed 100644 --- a/meta/recipes-devtools/python/python3-ply_3.11.bb +++ b/meta/recipes-devtools/python/python3-ply_3.11.bb @@ -14,4 +14,6 @@ RDEPENDS:${PN}:class-target += "\ python3-shell \ " +CVE_PRODUCT = "dabeaz:ply" + BBCLASSEXTEND = "native nativesdk" From patchwork Mon Jul 27 22:55:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93611 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F609C54F54 for ; Mon, 27 Jul 2026 22:56:31 +0000 (UTC) Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43804.1785192985595760299 for ; Mon, 27 Jul 2026 15:56:25 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Y10VMjdi; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-49548aebcd8so23934245e9.3 for ; Mon, 27 Jul 2026 15:56:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192984; x=1785797784; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=6jDLIHv4DLgNGI4sdQKwr8nddqqyp2rRSKH/Bpntxpc=; b=Y10VMjdiD3y4wAlvwiauzAAY7nttSNV7ogYyDK2rJKXMCDft/PWhRqaRUSQdGi7vHc UhyLxITIM9/j6fBIc4oWcp84GNMbXDvS6DYrg1oVjgawBjTW2AI9f+DV5c01biZy10w8 /l+bwI9bJdqzgg8TJeAp4eu+JdXVxflHxuomA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192984; x=1785797784; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=6jDLIHv4DLgNGI4sdQKwr8nddqqyp2rRSKH/Bpntxpc=; b=iaq8ZV+W9tcD3+e3Y51npFPyAv5Cet44IhUXAElibQ318Zacz1E6X2SgqXosk7w1J+ Zy5wmb6hWdACp4LlcJ3ZRpyTdXLodMx62Nm/8y06EdW6jWM3He/ei/I6YpiXGzGhgKPX 7h8tyg69jMe/HUHS6chBahnupnxny9BMUuB77vdNwAOV45HbeLCP7XE/bKbOtX4t83qD xfoRDA7aAgA36NFFKxK2/58JJ871AmEoIDPuNRo0T4nk5uVGhMCW/mw69LR2zwa/RQfI z002Jz1Wk8VBKZVsyL6jxqkDoaMssGZxMq3rLkx+OA9iZ9bf1uxeag84xp2dD7ig0oED HcDA== X-Gm-Message-State: AOJu0YyBT4KWvpUwYzXI63phrA7+lb4YQsh+ipa03pMCN0zJNpZPRqo8 jhrjUijuoTe/bZZl9/QhnwF0WNvlE4XT3/APJSDF1JGdnaf7C7PDAv3/1KVvvumTXEi5kzJJWYU YsE59viI= X-Gm-Gg: AR+sD12NARAjs+0cspP66Yb0tMUCiEeVm1tUAcmMcERkSiCxWL727WqsG88qGwMpgMy y1uN41oJggm32v0/WDSdgU4/11ebrV6WQy4waF0G2Gp1vL+TyhKmU/N+2snmN8kBu6Hk1NHHvIC 4Qoz1jvCsHtcEEuRHNr606HqU9gYVoLrQ+xelfOqknKWIuJLkPEtXP/qun5v1moUgqDFXBVml7I xaGMaTt/TnBFNy9UrWQ+MVprPc9/wpqaFLwKuK2ohSVNWjbY5LA1wJuq0yTu5Uv+lAceC0jOZ46 DIeSfmtH3vboZJ5YhueE1DK3LglGdSCydqaB5N2ko+B494hTvVbQRTZKNQBn4pHpbCkmhXMWeHf ujMjvD96kBkRqWsfa2TKGalArHTkSA+Zaebh4exbNpO16eiJks6eUl5zDCcmYTN8C5A9+/63cFx D3vPU/iBJj3niDqk7/eNRg+sXvVxwHF/gfPZVVEZmTPVZuthesONTGL2K9vV3kkpvXrf6CyF6Nh QOhJrAJasSmFZMh X-Received: by 2002:a05:600c:3b27:b0:495:3c6d:f294 with SMTP id 5b1f17b1804b1-496b5717d1bmr126258035e9.23.1785192983872; Mon, 27 Jul 2026 15:56:23 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.22 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:22 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 16/36] python3-pyasn1: set CVE_PRODUCT Date: Tue, 28 Jul 2026 00:55:30 +0200 Message-ID: <676fcd8a20ab5b83835fcf9f56b5fb493384c60e.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242127 From: mark.yang The default python:pyasn1 does not match the NVD/CNA entries which use pyasn1 as vendor, so CVEs like CVE-2026-30922 are never reported. Use the exact pyasn1:pyasn1 pair. Suggested-by: Ross Burton Signed-off-by: mark.yang Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 4971337840e8855740409e8f5dadb3ab3661f033) Signed-off-by: Himanshu Jadon Signed-off-by: Yoann Congal --- meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb b/meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb index 01157e251e6..b44e8774474 100644 --- a/meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb +++ b/meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb @@ -14,4 +14,6 @@ RDEPENDS:${PN}:class-target += " \ python3-shell \ " +CVE_PRODUCT = "pyasn1:pyasn1" + BBCLASSEXTEND = "native nativesdk" From patchwork Mon Jul 27 22:55:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93610 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97A44C53219 for ; Mon, 27 Jul 2026 22:56:30 +0000 (UTC) Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43759.1785192987153679687 for ; Mon, 27 Jul 2026 15:56:27 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=JYlBLbaZ; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-495635a85d2so26735415e9.0 for ; Mon, 27 Jul 2026 15:56:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192985; x=1785797785; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=oQP9kmGZtDRiGDCuhv1OONPJlazP83lTcDijGwNtdhs=; b=JYlBLbaZo5ayI4knIGxYfa2NEn4LbULZySfZ7AouBt1yBif1CxyNiEjMc/QS3fq5W8 GVvJeUqEuh6wZqfmem+XBY1poei3vYPNf/4/WA38HN4uNmSh7Emr0DS9wpQkaf3+OQny 9ufgWaONzZG9uCAy4yb9olegH3bFTZbXWniZw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192985; x=1785797785; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=oQP9kmGZtDRiGDCuhv1OONPJlazP83lTcDijGwNtdhs=; b=a6HkEMOXFT+RhOcrSQUOa9sRK2W+SujXJali1PjPdxDkpmWX8XQ7hHD5QdJe/V2FCH xrGjM5kSkPQp+9HagLwAYf/z3rAvClS6kxZZVUDfWzLV+oyraVuhzLEE93uol9phNaN1 HLuEujFxVTmPu0nPUoMOc59Qqe7OuhZTP7YqfvAYlLJwXHEN273KFXjoFtw40epEgMmP LFUQCS/QaPbcz2Jt1F4m6zD/je/Jh3HwSSM87royfrBSkaWgmTCrJmHJWgrtdoGqd/OX d0NBhyNI1nGVJinX3xlXmSyxIxjih1VP94mfVDKO9zP49deRx5VC9B0r3SPK3VKI17uU +XCg== X-Gm-Message-State: AOJu0YygZ6LIfKsAUxKENM5ebKzv3fBFiVKpvqrF2G0391cjr+CZjJsz 1HpfZKOR5765bGJ0hrnA63jHlBHbBxGfBPoGL/aDjKsV8e1IXib7ZMhD42U5H2dgvrv2bb1Nv9d PLZ7mWtY= X-Gm-Gg: AR+sD12Wy1XSIZyPmJqMlnA83dq02AbSNEOLiR4TpYcL4AuzWMKridEph2zUtyacADd bdvt1idObKeKoqrRNrQJCtBqvT/RCdRl0SNJjiqxl4LUzh3jYFwvqNG4CPHrs5A5ZrMXVJOeWrO 4HFgAx85q1N7pYaiYuyZoIczPqkUQTfIBWJsBIL+jyS6iEYs7gAWhX5oPqOhWJy70z/d5cyJDNi 8u99LevABWHzdg3szd5rFY2f8WRiV/4cXHbB4m+ir7QofKy26cCj0L81aXSUqWOXWfs1kvl9xWf DaJgNXlbXP5YtgyIZUW/KBXvGwodZrOHmPULi+BvSvXFNYZaFAvLxMW0Nd63P6kvqhSduV7DFwL CbcRxSN/rycqkgCwgKVMH99uLHLdswYkppWkWWGsq3fW506ijactI6BLrqRcqcCZF7rr9d3rB2v hZ6Fi8nyyQpxJ54Y3idpt0lasnnr1juRthDMtcWs6drNOxkxQpSziyenCtpSo9q1kOgNqjOU7dK 2yxCw== X-Received: by 2002:a05:600c:35d5:b0:496:bbce:fc with SMTP id 5b1f17b1804b1-496c4f8ddb8mr9811265e9.12.1785192985306; Mon, 27 Jul 2026 15:56:25 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.24 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:24 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 17/36] python3-setuptools: Fix CVE-2026-59890 Date: Tue, 28 Jul 2026 00:55:31 +0200 Message-ID: <0d900632d3c064a9c0c61cfeb5c1d003b4eb81e4.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242134 From: Darsh Kelaiya This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f [2] https://nvd.nist.gov/vuln/detail/CVE-2026-59890 Signed-off-by: Darsh Kelaiya Signed-off-by: Yoann Congal --- .../python3-setuptools/CVE-2026-59890.patch | 194 ++++++++++++++++++ .../python/python3-setuptools_82.0.1.bb | 3 +- 2 files changed, 196 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-devtools/python/python3-setuptools/CVE-2026-59890.patch diff --git a/meta/recipes-devtools/python/python3-setuptools/CVE-2026-59890.patch b/meta/recipes-devtools/python/python3-setuptools/CVE-2026-59890.patch new file mode 100644 index 00000000000..7a6c86b40a4 --- /dev/null +++ b/meta/recipes-devtools/python/python3-setuptools/CVE-2026-59890.patch @@ -0,0 +1,194 @@ +From 22e38898b6cec34f7e816c2664016e95afb024ad Mon Sep 17 00:00:00 2001 +From: "Jason R. Coombs" +Date: Sat, 27 Jun 2026 10:46:34 -0400 +Subject: [PATCH] Normalize Unicode form when matching MANIFEST.in patterns + +FileList matched MANIFEST.in patterns against on-disk names byte-for-byte +with no Unicode normalization. On macOS APFS/HFS+, a file stored NFD and a +pattern authored NFC denote the same file but differ byte-for-byte, so an +exclude/global-exclude/recursive-exclude/prune rule could silently fail to +drop a non-ASCII-named file, publishing it in the sdist despite the rule. + +Normalize both the pattern and the candidate path to NFC before matching, +via a new unicode_utils.normalize() helper and a _NormalizedMatcher wrapper +around the compiled pattern in translate_pattern. + +Fixes GHSA-h35f-9h28-mq5c. + +CVE: CVE-2026-59890 +Upstream-Status: Backport [https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f] + +Co-Authored-By: Claude Opus 4.8 +(cherry picked from commit dd9f436a36486b4cb8a4c70a2321548b0be09b8f) +Signed-off-by: Darsh Kelaiya +--- + newsfragments/+ghsa-h35f-9h28-mq5c.bugfix.rst | 7 +++ + setuptools/command/egg_info.py | 28 +++++++++++- + setuptools/tests/test_manifest.py | 45 +++++++++++++++++++ + setuptools/unicode_utils.py | 14 ++++++ + 4 files changed, 93 insertions(+), 1 deletion(-) + create mode 100644 newsfragments/+ghsa-h35f-9h28-mq5c.bugfix.rst + +diff --git a/newsfragments/+ghsa-h35f-9h28-mq5c.bugfix.rst b/newsfragments/+ghsa-h35f-9h28-mq5c.bugfix.rst +new file mode 100644 +index 000000000..42d6c4cfe +--- /dev/null ++++ b/newsfragments/+ghsa-h35f-9h28-mq5c.bugfix.rst +@@ -0,0 +1,7 @@ ++``MANIFEST.in`` matching (via ``FileList``) is now insensitive to Unicode ++normalization form. A pattern authored in one form (e.g. NFC, as typically ++saved by editors) now matches a file whose name is stored on disk in another ++(e.g. NFD, as produced by macOS APFS/HFS+). Previously an ``exclude``, ++``global-exclude``, ``recursive-exclude``, or ``prune`` rule could silently ++fail to drop a non-ASCII-named file from the source distribution, publishing ++it despite the exclusion -- see GHSA-h35f-9h28-mq5c. +diff --git a/setuptools/command/egg_info.py b/setuptools/command/egg_info.py +index a5b593270..138e29ee6 100644 +--- a/setuptools/command/egg_info.py ++++ b/setuptools/command/egg_info.py +@@ -37,6 +37,27 @@ from distutils.util import convert_path + PY_MAJOR = f'{sys.version_info.major}.{sys.version_info.minor}' + + ++class _NormalizedMatcher: ++ """ ++ Wrap a compiled pattern so that matching is insensitive to Unicode ++ normalization form. ++ ++ File names walked from disk (NFD on macOS APFS/HFS+) and patterns from ++ ``MANIFEST.in`` (typically NFC) can denote the same file while differing ++ byte-for-byte. Normalizing both sides before matching keeps an exclusion ++ (or inclusion) from silently failing. See GHSA-h35f-9h28-mq5c. ++ """ ++ ++ def __init__(self, pattern: re.Pattern) -> None: ++ self._pattern = pattern ++ ++ def match(self, path): ++ return self._pattern.match(unicode_utils.normalize(path)) ++ ++ def search(self, path): ++ return self._pattern.search(unicode_utils.normalize(path)) ++ ++ + def translate_pattern(glob): # noqa: C901 # is too complex (14) # FIXME + """ + Translate a file path glob like '*.txt' in to a regular expression. +@@ -46,6 +67,11 @@ def translate_pattern(glob): # noqa: C901 # is too complex (14) # FIXME + """ + pat = '' + ++ # Normalize the pattern so it matches paths regardless of the Unicode ++ # normalization form used on disk (GHSA-h35f-9h28-mq5c). Candidate paths ++ # are normalized to the same form by ``_NormalizedMatcher``. ++ glob = unicode_utils.normalize(glob) ++ + # This will split on '/' within [character classes]. This is deliberate. + chunks = glob.split(os.path.sep) + +@@ -117,7 +143,7 @@ def translate_pattern(glob): # noqa: C901 # is too complex (14) # FIXME + pat += sep + + pat += r'\Z' +- return re.compile(pat, flags=re.MULTILINE | re.DOTALL) ++ return _NormalizedMatcher(re.compile(pat, flags=re.MULTILINE | re.DOTALL)) + + + class InfoCommon: +diff --git a/setuptools/tests/test_manifest.py b/setuptools/tests/test_manifest.py +index 903a528db..10bd41b88 100644 +--- a/setuptools/tests/test_manifest.py ++++ b/setuptools/tests/test_manifest.py +@@ -10,6 +10,7 @@ import os + import shutil + import sys + import tempfile ++import unicodedata + + import pytest + +@@ -157,6 +158,21 @@ def test_translated_pattern_mismatch(pattern_mismatch): + assert not translate_pattern(pattern).match(target) + + ++def test_translate_pattern_unicode_normalization(): ++ """ ++ Matching is insensitive to Unicode normalization form: a pattern authored ++ in one form matches a path stored on disk in another (and vice versa), so ++ that an exclusion cannot be bypassed by an NFC/NFD mismatch. ++ ++ Regression test for GHSA-h35f-9h28-mq5c. ++ """ ++ nfc = unicodedata.normalize('NFC', 'café.txt') # 'café.txt' composed ++ nfd = unicodedata.normalize('NFD', 'café.txt') # 'café.txt' decomposed ++ assert nfc != nfd # the two byte forms genuinely differ ++ assert translate_pattern(nfc).match(nfd) ++ assert translate_pattern(nfd).match(nfc) ++ ++ + class TempDirTestCase: + def setup_method(self, method): + self.temp_dir = tempfile.mkdtemp() +@@ -331,6 +347,35 @@ class TestManifestTest(TempDirTestCase): + files = default_files | set([ml('app/a.txt'), ml('app/b.txt'), ml('app/c.rst')]) + assert files == self.get_files() + ++ def test_global_exclude_unicode_normalization(self): ++ """ ++ A ``global-exclude`` authored NFC must drop a file whose on-disk name ++ is NFD: on macOS APFS/HFS+ the two are the same file, and even on ++ case/normalization-exact filesystems the decomposed name can be ++ committed and reach the build. Otherwise the file is published in the ++ sdist despite the exclusion. ++ ++ Regression test for GHSA-h35f-9h28-mq5c. ++ """ ++ nfc_name = unicodedata.normalize('NFC', 'café.txt') ++ nfd_name = unicodedata.normalize('NFD', 'café.txt') ++ assert nfc_name != nfd_name ++ # write the file under its decomposed (NFD) name ... ++ touch(os.path.join(self.temp_dir, 'app', nfd_name)) ++ # ... and exclude it with the composed (NFC) form. ++ self.make_manifest( ++ f""" ++ global-include *.txt ++ global-exclude {nfc_name} ++ """ ++ ) ++ leaked = { ++ f ++ for f in self.get_files() ++ if unicodedata.normalize('NFC', os.path.basename(f)) == nfc_name ++ } ++ assert not leaked, f"excluded file leaked into manifest: {leaked}" ++ + + class TestFileListTest(TempDirTestCase): + """ +diff --git a/setuptools/unicode_utils.py b/setuptools/unicode_utils.py +index f502f5b08..dbce03e1d 100644 +--- a/setuptools/unicode_utils.py ++++ b/setuptools/unicode_utils.py +@@ -19,6 +19,20 @@ def decompose(path): + return path + + ++def normalize(text): ++ """ ++ Return *text* in a canonical Unicode form (NFC) so that names which are ++ visually identical but encoded differently compare equal. ++ ++ macOS APFS/HFS+ store file names in decomposed form (NFD), while patterns ++ in ``MANIFEST.in`` are typically authored composed (NFC). The two denote ++ the same file but differ byte-for-byte, so matching them directly lets an ++ exclusion silently fail. Normalizing both the walked path and the pattern ++ to a single form before matching avoids that (GHSA-h35f-9h28-mq5c). ++ """ ++ return unicodedata.normalize('NFC', text) if isinstance(text, str) else text ++ ++ + def filesys_decode(path): + """ + Ensure that the given path is decoded, +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-setuptools_82.0.1.bb b/meta/recipes-devtools/python/python3-setuptools_82.0.1.bb index c413578faf5..36cfd91e94a 100644 --- a/meta/recipes-devtools/python/python3-setuptools_82.0.1.bb +++ b/meta/recipes-devtools/python/python3-setuptools_82.0.1.bb @@ -9,7 +9,8 @@ inherit pypi python_setuptools_build_meta CVE_PRODUCT = "python3-setuptools python:setuptools" SRC_URI += " \ - file://0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch" + file://0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch \ + file://CVE-2026-59890.patch" SRC_URI[sha256sum] = "7d872682c5d01cfde07da7bccc7b65469d3dca203318515ada1de5eda35efbf9" From patchwork Mon Jul 27 22:55:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93609 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88CD2C531D0 for ; Mon, 27 Jul 2026 22:56:30 +0000 (UTC) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43806.1785192988826720393 for ; Mon, 27 Jul 2026 15:56:29 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=qWPrHkfD; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-49556f97a9dso22037555e9.1 for ; Mon, 27 Jul 2026 15:56:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192987; x=1785797787; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=JZv3fIQ6X3aaQ5JyI9oMn4ebZH+CE+tRB2J5FCShdJ8=; b=qWPrHkfDoeXmKxk/nRMkg7pUq5lMKP0fvpK94Pfdz7AJyFprIJDOgQgOr2ZS+b97XL 61Bcei5PZ/Q+IDPH/BhvzCiwgT3yyzwQBG7R+PE/dp9BIznemOp9kiqAocf3JA2ZW8wp xwpmB19YkMo34uJdmuUV5feuy5J3kU+f4DTyk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192987; x=1785797787; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=JZv3fIQ6X3aaQ5JyI9oMn4ebZH+CE+tRB2J5FCShdJ8=; b=fIf/8OEoi6A4en5P97BSay14RIMWJcDuTxThckmh+irFEPM61fT02EG7YnL9UeOf6W 1iqY2VydCxEmXCnmCZqKxOy9RH5z4kScfvMkfEsu66Y1xN3HuSjR8abI+d/cOE2sUjDC dMRMeQyFV1UlRTdCNPgZzhgycF5O+3wQ8Vzh7Uflf2WvEN8iY+2b8cf8tCy5YBupdlU/ FxfRmQirpDy3ZWaKvJoLn//XoG6VhW6Z0wY7VcPmAQxQeTC3U9Ukdq4OEvI+O0rXAhl6 KrGc0SDmY3SzdK0m7vB/aesBRR7ySG++sHicGJ7yyULR7VQ/qTS/VRD5ZvCnQRMUnJXa D4mQ== X-Gm-Message-State: AOJu0YxMTJvsa42lKFLS3P2TnUa1uJ/qiz/1jSi8Hl0siv6ShWUNWMZT LfWmSP3xJgYI4yoQdLgkBWLVwfLYGyCGUKNDyydXHgfn3fhY1YO0zoNOCoFaiDF+M9D4mSN0R2i wBtKb0Ng= X-Gm-Gg: AR+sD13baCJWK8Jl4jLY4bO8Y7JIbyccYUQsKuTe8L95Iiav9DGdKYVQolJLoedxXOm iU5ZMGdJbB4vV3pYfNYrGOHLco23mEGyZvIzO0oZfq1+9G71pGKWRwx3WfJ/qJTrHQYE2qB2bf5 Sve0zo2mbBzoyRIvjvfNETLkKmfJEgr+HRBpq1ivSFrLDPF9DE0pXziMZ65VYPEfm33YmXWrwhs 7O2GrjJsww8/Jf8sweq0xwio+DEDRE+r/MthvaY/cUmIW5rbiH6zrLe9/Z5Jbr32jPNcwsdiYS7 9tJFijpAB1a9US2z5wzP5Vmocu0TjLDosXLypsacWjeR8jqbpEDZvBAU2pAOu3WT4kKjgo8I0t8 12hd67Ykueojxc15U1j7z7eRtuZjChPJFjsMeGDvJbN/2MJvX9DXjHeHSiNAWr3J+X1/D9otbWm /p4yP8rQjHXhZR43OFBsd3zJjbkg3uPlPPXZLnNvWTXrRKVJahgIX5/uJZrhzjvvbF/q27p+C9f Av4eg== X-Received: by 2002:a05:600c:2192:b0:493:b56b:c45c with SMTP id 5b1f17b1804b1-496c4fd94ebmr6385555e9.30.1785192987016; Mon, 27 Jul 2026 15:56:27 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.25 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:25 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 18/36] openssh: set status for CVE-2026-59998 Date: Tue, 28 Jul 2026 00:55:32 +0200 Message-ID: <5bdde909a864cb73f795224ee5f06c5c89dab85b.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242135 From: Devansh Patel Analysis: - CVE-2026-59998 concerns an undocumented limitation of GSSAPIStrictAcceptorCheck in Windows Active Directory environments [1]. - Upstream OpenSSH 10.4 only documents the existing behavior and provides no code remediation [2]. - The recipe disables Kerberos/GSSAPI by default. Mark the CVE not-applicable-config when PACKAGECONFIG lacks kerberos, and unpatched when kerberos is enabled. Reference: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-59998 [2] https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432 Signed-off-by: Devansh Patel [YC: See previous version of this patch for context about ignoring vs this CVE vs patching: https://patchwork.yoctoproject.org/project/oe-core/patch/20260720175518.3546447-3-devanshp@cisco.com/#40497 ] Signed-off-by: Yoann Congal --- meta/recipes-connectivity/openssh/openssh_10.3p1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index f5184b1fce3..b13488e2652 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -44,6 +44,7 @@ Red Hat Enterprise Linux 7 and when running in a Kerberos environment" CVE_STATUS[CVE-2008-3844] = "not-applicable-platform: Only applies to some distributed RHEL binaries." CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1." CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh." +CVE_STATUS[CVE-2026-59998] = "${@bb.utils.contains('PACKAGECONFIG', 'kerberos', 'unpatched', 'not-applicable-config: GSSAPI/Kerberos support is disabled in the default OpenSSH configuration', d)}" PAM_SRC_URI = "file://sshd" From patchwork Mon Jul 27 22:55:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93622 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C2ECC54F5F for ; Mon, 27 Jul 2026 22:56:32 +0000 (UTC) Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43760.1785192990154458313 for ; Mon, 27 Jul 2026 15:56:30 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=tXTisG0Z; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-493f6de72faso2743345e9.0 for ; Mon, 27 Jul 2026 15:56:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192988; x=1785797788; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=RAYbAO3yz0HgBfZKL+8QFnT3xh8K5sIV4NyKAQbwoXk=; b=tXTisG0ZunISyyWsT+NlIWSkmF/WIvRgwlFnWsAHODldPhhJ8WXIRa77mVZzD6G8a1 U8Qb7lKL3g6iXasbszEuGtpXOhuJW6LjLkuH9sigz4viwjIf3Ildyq0KxLVHSrRc23/E 9vGlD7vozQHmEpNQ9qKKPFpUCHMp7YsT7CpEo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192988; x=1785797788; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=RAYbAO3yz0HgBfZKL+8QFnT3xh8K5sIV4NyKAQbwoXk=; b=sJgy0jOe6y9WFxNP3gutTcktAqG3RcpNZ9cGGdUtT9ZeAvEDWk1N6eR51A0kM7UY6f HHmykviDa5x9Gg5YeJ+xje1l1mQOYuDuuBjTRTgTZVbnT+1+rAqEeukOSv4NVNFzobD0 rmIP0iQg9rBsgr9ff36v8PJCKRK9K++9FLM26XtM7bqkPKQvM9zXzh0FNYtOVdZBcAEO 610shmzrwU4TkO+02bEcAwehM8rLzx8SGc28ZiXNPmzbWbO46dBrnobNi2BNmLDOsCGW NU5yLPWHdF4a5qJFyfISFoGpzm/KAFxUGDQ/RFYbkVFx4KUP8c/90djl+DKY1c4JURxR xaOA== X-Gm-Message-State: AOJu0YxRFXHvn37zHVFmLHHrUB7TzJakQ0c4IC3Vo+8c+YbjQmN3Gf2K qbuPvldwvpqA1hM3OHZJRhs2PwMg7YeKEz4NPE6wK/8x7PNpYNUEG83HbE/WAjcpSW9Ooq4RHEi sthzInWU= X-Gm-Gg: AR+sD13PL1YPoHVsLHtGLnOjeunRRTm5dkJuCqeACVZJ1h/fEyMrwjlLW0c9B2hS9QO wtFXjlO5wQY1f/HHMWhwl0RxlhRoRDu2AhHuO/KN10YwZyQ+ui8Mm/rfPZX1IGVp+caeoBrWVpm rDoqLtmT3iCAPDjbfhJ4hf7nXd2ekL1bJi8oSMdZFDcADKPa6ewUfYbXys7p3rB1GSAhm/ZTngl CH+6v/TGKzPGwtA5I1Vp4i9qr3Rvld7ve9evCPxF4Sd4di6JDeHGBIW0GVRZ12r/zqizIHYMjJy I/WB/Q44EZnLrAhEUo2wAVm2vs+oPKphZSgWJiII6UZjFRD/iuCAyWZVgmyKc9WBHlf3HJG4LUu EJNRAIFZ5ISkbF8wk1EFpZHMaPHAxMf6V+vOHItWzdXpqPHmW4WS+cLc/tCLLmU2r/zvmsYMOCg lkKZVT5sPXrdA324HzCgaY1He1i4a5TeYQnqI6zRklsdij68K66dqqS0ZUYgKEJm4n/gm1jgakZ mBZjA== X-Received: by 2002:a05:600c:b99:b0:48f:e230:29f5 with SMTP id 5b1f17b1804b1-496c56840c5mr3617665e9.16.1785192988359; Mon, 27 Jul 2026 15:56:28 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.27 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:27 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 19/36] libgcrypt: fix CVE-2026-41989 Date: Tue, 28 Jul 2026 00:55:33 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:32 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242136 From: Leonid Iziumtsev Backport patch to fix CVE-2026-41989. References: https://nvd.nist.gov/vuln/detail/CVE-2026-41989 https://osv.dev/list?q=CVE-2026-41989 Upstream fix: https://github.com/gpg/libgcrypt/commit/2d3d732c9bf87cc10729f69678dd9e6862f99fa3 Signed-off-by: Leonid Iziumtsev Signed-off-by: Yoann Congal --- .../libgcrypt/files/CVE-2026-41989.patch | 42 +++++++++++++++++++ .../libgcrypt/libgcrypt_1.12.1.bb | 1 + 2 files changed, 43 insertions(+) create mode 100644 meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch diff --git a/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch b/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch new file mode 100644 index 00000000000..aba3ca318b4 --- /dev/null +++ b/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch @@ -0,0 +1,42 @@ +From d8874dd38f78454dd3a760617ebe8d9aa9270649 Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka +Date: Fri, 10 Apr 2026 16:58:57 +0900 +Subject: [PATCH] cipher:ecc: Fix decoding a point on Montgomery curve. + +* cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Fix the padding +mistake and add updating RAWMPILEN. + +-- + +Reported by Calif.io in collaboration with Claude and Anthropic +Research. + +GnuPG-bug-id: 8211 +Fixes-commit: bbe15758c893dbf546416c1a6bccdad1ab000ad7 +Suggested-by: Bronson Yen +Signed-off-by: NIIBE Yutaka + +CVE: CVE-2026-41989 +Upstream-Status: Backport [https://github.com/gpg/libgcrypt/commit/2d3d732c9bf87cc10729f69678dd9e6862f99fa3] + +Signed-off-by: Leonid Iziumtsev +--- + cipher/ecc-misc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/cipher/ecc-misc.c b/cipher/ecc-misc.c +index 615b0df2..ab3799dc 100644 +--- a/cipher/ecc-misc.c ++++ b/cipher/ecc-misc.c +@@ -438,7 +438,10 @@ _gcry_ecc_mont_decodepoint (gcry_mpi_t pk, mpi_ec_t ec, mpi_point_t result) + *--p = *buf++; + + if (rawmpilen < nbytes) +- memset (rawmpi + nbytes - rawmpilen, 0, nbytes - rawmpilen); ++ { ++ memset (rawmpi + rawmpilen, 0, nbytes - rawmpilen); ++ rawmpilen = nbytes; ++ } + } + else + { diff --git a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb b/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb index b3c0d050b7d..55872a5c237 100644 --- a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb +++ b/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb @@ -25,6 +25,7 @@ SRC_URI = "${GNUPG_MIRROR}/libgcrypt/libgcrypt-${PV}.tar.bz2 \ file://no-native-gpg-error.patch \ file://no-bench-slope.patch \ file://run-ptest \ + file://CVE-2026-41989.patch \ " SRC_URI[sha256sum] = "7df5c08d952ba33f9b6bdabdb06a61a78b2cf62d2122c2d1d03a91a79832aa3c" From patchwork Mon Jul 27 22:55:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93631 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6AE80C54F52 for ; Mon, 27 Jul 2026 22:56:42 +0000 (UTC) Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43809.1785192991811246845 for ; Mon, 27 Jul 2026 15:56:32 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=MEEg4gzk; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-496bb7cdf51so16560965e9.2 for ; Mon, 27 Jul 2026 15:56:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192990; x=1785797790; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=SHTGtIJLCqN0gSY3gHKrNDBnlpRFCn4s8osEzxeE+Aw=; b=MEEg4gzkTN5pNjXvbucwIn+NQq0FDUjZyhJxZgeqGSr3AOSWgpff80BUT9rD1rP0Za mwnjRMbQzvzBQnDyG4xSglWmlK48MxkszTI9Z6hsRfBXxQqVlu6ULeYVQratG2fh5YJP INGGR3fHqd25zzuunxRg91fEjUNAsHfa3tpTk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192990; x=1785797790; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=SHTGtIJLCqN0gSY3gHKrNDBnlpRFCn4s8osEzxeE+Aw=; b=ps4OGhThxA/J4QF7ZB0ICWjZu7If0hs/ssxBDwCHclW5BCD9b1MQcc5TIWdA+Yd0nF NdTLIHv8ZBJ7q8WxzmCHdSMWnOTblkkL7dztV0Ik7AlaSugXqQZwkj6fWUuKoZ0lLCW2 UCOf2IyQkomDuwu5tzaUUbWJzIsYd/D8FP2hrqYqMNKsNioo21K14AZFZveI2cyFpOg/ 79li4ow4qwqOJqgZH2dUQLtfS+rXbpWpBT/fO+j2HYGQmwCgoPWuPoOmklR1Df3cevXP Nxuq0oVt3VL2nXgvaaG4fxUGDN0AQRZyp2b++0RTGAnA9W0SQhv/0+rI+p0CIqx7I4E3 QwKQ== X-Gm-Message-State: AOJu0YzgArHyH/+wOk7ipa9WuvthhfDI5WO3JrS8RSq5pvuexjExXaEq EyzPdSDwGXZnVir8fuHaGomGNqQypj614zE989huP1t9jkNbbSJssDB4kjAJd3NoN8mCNX905L8 KcsNRqQk= X-Gm-Gg: AR+sD10eAxY5QdgykcIipbCFdq6N/IcZ+6azbZBcNHqatQGnIg73ZvdwThlhjW4vvg9 3XGsfYRX3qsjF8xPUWV0MjlgBErJNoUkY6Kev121JUalsRipUEyNnPj+pLP9yuN4A6wvW1FtcwX IrMpPSHO0H4Ym+9ZHGTh8hD1K2KoNc8Srj0yCuLcZCYwWMPOhbrqB7v8YVQOUat5rTVLsbNPdFl Wf1sxygvS5UV68+sJCnAPfcfP1M3lcvvZuqAerrB3JRVVnIwpK4XIZNVHhunZeB1k1GVU8SVk9G OCWfQQ6QQOoD2r7RbuHIaNkMY6Db1uZBU+3B9jgmDGms94L6bbkJTkMzjbCxRDUReuycZHnub2v O2+yNVTW43W22b76CKd8txhyN1pSFC4NDanZwtF9iNPLWoBp5cOmsAkBgWy1xsRh8UFMaJ5FXNp +6OsaqhHMcnoP1j9ap12aegRVdbih1vzJP2UkPOp0ye7Nkt+geatXZQmio1uwJzwudfjweaDCOI +irOA== X-Received: by 2002:a7b:c305:0:b0:493:c182:6b08 with SMTP id 5b1f17b1804b1-496c4fd7a03mr6128145e9.36.1785192989944; Mon, 27 Jul 2026 15:56:29 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.28 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:28 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 20/36] libgcrypt: fix CVE-2026-41990 Date: Tue, 28 Jul 2026 00:55:34 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242137 From: Leonid Iziumtsev Backport patch to fix CVE-2026-41990. References: https://nvd.nist.gov/vuln/detail/CVE-2026-41990 https://osv.dev/list?q=CVE-2026-41990 Upstream fix: https://github.com/gpg/libgcrypt/commit/905e00f046a71e5670517779afaf85a354952832 Signed-off-by: Leonid Iziumtsev Signed-off-by: Yoann Congal --- .../libgcrypt/files/CVE-2026-41990.patch | 316 ++++++++++++++++++ .../libgcrypt/libgcrypt_1.12.1.bb | 1 + 2 files changed, 317 insertions(+) create mode 100644 meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch diff --git a/meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch b/meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch new file mode 100644 index 00000000000..a4f18092274 --- /dev/null +++ b/meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch @@ -0,0 +1,316 @@ +From 024391fc505ebf9c47e51953d7d85995ba179576 Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka +Date: Mon, 13 Apr 2026 11:51:46 +0900 +Subject: [PATCH] cipher:dilithium: Check the label length by caller. + +* cipher/dilithium.h (dilithium_keypair, dilithium_sign) +(dilithium_verify): Return gpg_err_code_t. +* cipher/dilithium.c (dilithium_keypair): Return gpg_err_code_t. +(dilithium_sign, dilithium_verify): Ditto. Check CTXLEN. +* cipher/pubkey-dilithium.c (mldsa_generate): Follow the change. +(mldsa_sign, mldsa_verify): Likewise. + +-- + +Reported by Calif.io in collaboration with Claude and Anthropic +Research. + +GnuPG-bug-id: 8208 +Co-authored-by: Thai Duong +Signed-off-by: NIIBE Yutaka + +CVE: CVE-2026-41990 +Upstream-Status: Backport [https://github.com/gpg/libgcrypt/commit/905e00f046a71e5670517779afaf85a354952832] + +Signed-off-by: Leonid Iziumtsev +--- + cipher/dilithium.c | 101 ++++++++++++++++++++++++++++---------- + cipher/dilithium.h | 20 ++++---- + cipher/pubkey-dilithium.c | 34 +++++-------- + 3 files changed, 99 insertions(+), 56 deletions(-) + +diff --git a/cipher/dilithium.c b/cipher/dilithium.c +index 955feb2a..212c4afe 100644 +--- a/cipher/dilithium.c ++++ b/cipher/dilithium.c +@@ -82,6 +82,7 @@ + #include "gcrypt-int.h" + #include "const-time.h" + ++/* With glue code, we only use the "_internal" API of Dilithium. */ + #define DILITHIUM_INTERNAL_API_ONLY 1 + + #include "dilithium.h" +@@ -120,23 +121,33 @@ static int crypto_sign_verify_internal_5 (const uint8_t *sig, size_t siglen, + const uint8_t *pre, size_t prelen, + const uint8_t *pk); + +-int ++gpg_err_code_t + dilithium_keypair (int algo, uint8_t *pk, uint8_t *sk, + const uint8_t seed[SEEDBYTES]) + { ++ int r; ++ + switch (algo) + { + case GCRY_MLDSA44: +- return crypto_sign_keypair_internal_2 (pk, sk, seed); ++ r = crypto_sign_keypair_internal_2 (pk, sk, seed); ++ break; + case GCRY_MLDSA65: + default: +- return crypto_sign_keypair_internal_3 (pk, sk, seed); ++ r = crypto_sign_keypair_internal_3 (pk, sk, seed); ++ break; + case GCRY_MLDSA87: +- return crypto_sign_keypair_internal_5 (pk, sk, seed); ++ r = crypto_sign_keypair_internal_5 (pk, sk, seed); ++ break; + } ++ ++ if (r < 0) ++ return GPG_ERR_INTERNAL; ++ ++ return 0; + } + +-int ++gpg_err_code_t + dilithium_sign (int algo, uint8_t *sig, size_t siglen, + const uint8_t *m, size_t mlen, + const uint8_t *ctx, size_t ctxlen, +@@ -145,9 +156,17 @@ dilithium_sign (int algo, uint8_t *sig, size_t siglen, + size_t i; + uint8_t pre[257]; + size_t prelen; ++ int r; + +- if (ctx == NULL && ctxlen == -1) +- prelen = 0; ++ if (ctx == NULL) ++ { ++ if (ctxlen == -1) ++ prelen = 0; ++ else ++ return GPG_ERR_INV_DATA; ++ } ++ else if (ctxlen > 255) ++ return GPG_ERR_INV_DATA; + else + { + /* Prepare pre = (0, ctxlen, ctx) */ +@@ -158,28 +177,44 @@ dilithium_sign (int algo, uint8_t *sig, size_t siglen, + prelen = 2 + ctxlen; + } + ++ /* ++ * Note that the second argument of the upstream routine is the ++ * pointer to output length of signature. It assumes the first ++ * argument (pointer to output signature) should have correct (or ++ * more) length, beforehand. ++ * ++ * Before calling the routine, we should check the length. ++ */ + switch (algo) + { + case GCRY_MLDSA44: + if (siglen != CRYPTO_BYTES_2) +- return -1; +- return crypto_sign_signature_internal_2 (sig, &siglen, m, mlen, +- pre, prelen, rnd, sk); ++ return GPG_ERR_INV_DATA; ++ r = crypto_sign_signature_internal_2 (sig, &siglen, m, mlen, ++ pre, prelen, rnd, sk); ++ break; + case GCRY_MLDSA65: + default: + if (siglen != CRYPTO_BYTES_3) +- return -1; +- return crypto_sign_signature_internal_3 (sig, &siglen, m, mlen, +- pre, prelen, rnd, sk); ++ return GPG_ERR_INV_DATA; ++ r = crypto_sign_signature_internal_3 (sig, &siglen, m, mlen, ++ pre, prelen, rnd, sk); ++ break; + case GCRY_MLDSA87: + if (siglen != CRYPTO_BYTES_5) +- return -1; +- return crypto_sign_signature_internal_5 (sig, &siglen, m, mlen, +- pre, prelen, rnd, sk); ++ return GPG_ERR_INV_DATA; ++ r = crypto_sign_signature_internal_5 (sig, &siglen, m, mlen, ++ pre, prelen, rnd, sk); ++ break; + } ++ ++ if (r < 0) ++ return GPG_ERR_INTERNAL; ++ ++ return 0; + } + +-int ++gpg_err_code_t + dilithium_verify (int algo, const uint8_t *sig, size_t siglen, + const uint8_t *m, size_t mlen, + const uint8_t *ctx, size_t ctxlen, +@@ -188,9 +223,17 @@ dilithium_verify (int algo, const uint8_t *sig, size_t siglen, + size_t i; + uint8_t pre[257]; + size_t prelen; ++ int r; + +- if (ctx == NULL && ctxlen == -1) +- prelen = 0; ++ if (ctx == NULL) ++ { ++ if (ctxlen == -1) ++ prelen = 0; ++ else ++ return GPG_ERR_INV_DATA; ++ } ++ else if (ctxlen > 255) ++ return GPG_ERR_INV_DATA; + else + { + /* Prepare pre = (0, ctxlen, ctx) */ +@@ -204,16 +247,24 @@ dilithium_verify (int algo, const uint8_t *sig, size_t siglen, + switch (algo) + { + case GCRY_MLDSA44: +- return crypto_sign_verify_internal_2 (sig, siglen, m, mlen, +- pre, prelen, pk); ++ r = crypto_sign_verify_internal_2 (sig, siglen, m, mlen, ++ pre, prelen, pk); ++ break; + case GCRY_MLDSA65: + default: +- return crypto_sign_verify_internal_3 (sig, siglen, m, mlen, +- pre, prelen, pk); ++ r = crypto_sign_verify_internal_3 (sig, siglen, m, mlen, ++ pre, prelen, pk); ++ break; + case GCRY_MLDSA87: +- return crypto_sign_verify_internal_5 (sig, siglen, m, mlen, +- pre, prelen, pk); ++ r = crypto_sign_verify_internal_5 (sig, siglen, m, mlen, ++ pre, prelen, pk); ++ break; + } ++ ++ if (r < 0) ++ return GPG_ERR_BAD_SIGNATURE; ++ ++ return 0; + } + + typedef struct { +diff --git a/cipher/dilithium.h b/cipher/dilithium.h +index 88a48094..dc18f158 100644 +--- a/cipher/dilithium.h ++++ b/cipher/dilithium.h +@@ -64,16 +64,16 @@ + #define DILITHIUM_SIGN_STACK_BURN (161 * 1024) + #define DILITHIUM_VERIFY_STACK_BURN (122 * 1024) + +-int dilithium_keypair (int algo, uint8_t *pk, uint8_t *sk, +- const uint8_t seed[SEEDBYTES]); +-int dilithium_sign (int algo, uint8_t *sig, size_t siglen, +- const uint8_t *m, size_t mlen, +- const uint8_t *ctx, size_t ctxlen, +- const uint8_t *sk, const uint8_t rnd[RNDBYTES]); +-int dilithium_verify (int algo, const uint8_t *sig, size_t siglen, +- const uint8_t *m, size_t mlen, +- const uint8_t *ctx, size_t ctxlen, +- const uint8_t *pk); ++gpg_err_code_t dilithium_keypair (int algo, uint8_t *pk, uint8_t *sk, ++ const uint8_t seed[SEEDBYTES]); ++gpg_err_code_t dilithium_sign (int algo, uint8_t *sig, size_t siglen, ++ const uint8_t *m, size_t mlen, ++ const uint8_t *ctx, size_t ctxlen, ++ const uint8_t *sk, const uint8_t rnd[RNDBYTES]); ++gpg_err_code_t dilithium_verify (int algo, const uint8_t *sig, size_t siglen, ++ const uint8_t *m, size_t mlen, ++ const uint8_t *ctx, size_t ctxlen, ++ const uint8_t *pk); + #endif + + #if defined(DILITHIUM_MODE) +diff --git a/cipher/pubkey-dilithium.c b/cipher/pubkey-dilithium.c +index 03958bb0..8c3f650e 100644 +--- a/cipher/pubkey-dilithium.c ++++ b/cipher/pubkey-dilithium.c +@@ -170,7 +170,7 @@ mldsa_generate (const gcry_sexp_t genparms, gcry_sexp_t *r_skey) + memcpy (seed, seed_supplied, SEEDBYTES); + } + +- dilithium_keypair (info->algo, pk, sk, seed); ++ rc = dilithium_keypair (info->algo, pk, sk, seed); + _gcry_burn_stack (DILITHIUM_KEYPAIR_STACK_BURN); + + if (!rc) +@@ -206,7 +206,6 @@ mldsa_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms) + size_t data_len; + const unsigned char *sk; + const struct mldsa_info *info = mldsa_get_info (keyparms); +- int r; + + if (!info) + return GPG_ERR_PUBKEY_ALGO; +@@ -258,17 +257,14 @@ mldsa_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms) + else + randombytes (rnd, RNDBYTES); + if (ctx.flags & PUBKEY_FLAG_NO_PREFIX) +- r = dilithium_sign (info->algo, sig, info->sig_len, data, data_len, +- NULL, -1, sk, rnd); ++ rc = dilithium_sign (info->algo, sig, info->sig_len, data, data_len, ++ NULL, -1, sk, rnd); + else +- r = dilithium_sign (info->algo, sig, info->sig_len, data, data_len, +- ctx.label, ctx.labellen, sk, rnd); ++ rc = dilithium_sign (info->algo, sig, info->sig_len, data, data_len, ++ ctx.label, ctx.labellen, sk, rnd); + _gcry_burn_stack (DILITHIUM_SIGN_STACK_BURN); +- if (r < 0) +- { +- rc = GPG_ERR_INTERNAL; +- goto leave; +- } ++ if (rc) ++ goto leave; + + rc = sexp_build (r_sig, NULL, "(sig-val(%s(s%b)))", info->name, + info->sig_len, sig); +@@ -300,7 +296,6 @@ mldsa_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms) + size_t data_len; + const unsigned char *pk; + const struct mldsa_info *info = mldsa_get_info (keyparms); +- int r; + + if (!info) + return GPG_ERR_PUBKEY_ALGO; +@@ -350,17 +345,14 @@ mldsa_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms) + } + + if (ctx.flags & PUBKEY_FLAG_NO_PREFIX) +- r = dilithium_verify (info->algo, sig, info->sig_len, data, data_len, +- NULL, -1, pk); ++ rc = dilithium_verify (info->algo, sig, info->sig_len, data, data_len, ++ NULL, -1, pk); + else +- r = dilithium_verify (info->algo, sig, info->sig_len, data, data_len, +- ctx.label, ctx.labellen, pk); ++ rc = dilithium_verify (info->algo, sig, info->sig_len, data, data_len, ++ ctx.label, ctx.labellen, pk); + _gcry_burn_stack (DILITHIUM_VERIFY_STACK_BURN); +- if (r < 0) +- { +- rc = GPG_ERR_BAD_SIGNATURE; +- goto leave; +- } ++ if (rc) ++ goto leave; + + leave: + _gcry_pk_util_free_encoding_ctx (&ctx); diff --git a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb b/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb index 55872a5c237..d7f8563ae6e 100644 --- a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb +++ b/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb @@ -26,6 +26,7 @@ SRC_URI = "${GNUPG_MIRROR}/libgcrypt/libgcrypt-${PV}.tar.bz2 \ file://no-bench-slope.patch \ file://run-ptest \ file://CVE-2026-41989.patch \ + file://CVE-2026-41990.patch \ " SRC_URI[sha256sum] = "7df5c08d952ba33f9b6bdabdb06a61a78b2cf62d2122c2d1d03a91a79832aa3c" From patchwork Mon Jul 27 22:55:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93629 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D856C54F51 for ; Mon, 27 Jul 2026 22:56:42 +0000 (UTC) Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43811.1785192993075881626 for ; Mon, 27 Jul 2026 15:56:33 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=HcjB28xX; spf=pass (domain: smile.fr, ip: 209.85.128.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-49557167508so31087135e9.1 for ; Mon, 27 Jul 2026 15:56:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192991; x=1785797791; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=D9CFKnEVXInVse50D3hSUd+RoGCuSHrb2RgDBWoGhAM=; b=HcjB28xXu3Y1PkGOFI2eqvyRHrRb0uzABDMgo7v9alA29Zzi72yue2N1NbJXVHF3wg GvOBTihEXNGJqMyt7fJtnMuVNDbZUQDjcgX+//JI4/rxd8bFBUQPvoLFTYyeWCFlyqO8 qWhsm5fc+TdL7b7SpQ9t/ibG/YlslErfggyyI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192991; x=1785797791; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=D9CFKnEVXInVse50D3hSUd+RoGCuSHrb2RgDBWoGhAM=; b=KE1EUjNGXbKLJmsU7TbJJTlpmQzp6XY9y5pIoZ78KqG9SF1B/PhEqrkDvUAYNQ1gN1 Tn5NfuUWAimP6N/L10EIcje8KKFHWpQW27eIrlDU8nQLpOli/6oZW64wA+cn8SUxWO/Q cqtliwjdbr4D+ODk431HgT9ZYutodg7fJCQfBOQhL95R0XYFJwkp0tpcnVPn+uKPnqi1 VMAqW/LugFe1k6uH4JiiFxKHNPTFmclu42gMl13KMha/3CBQKHl5XHN6bZI+f0jGUfps jCa5dqcOZXURBNpI/IUPMi1O7Me2xJ+yIKOxt6TZL1J6HVzzMfo2dx8FN7tFWCxUvIwv Yr8w== X-Gm-Message-State: AOJu0YyveCHalRb4V8z/RN6vl4r7/Ulh/lso6GVV0gyPzNLjMQZDueTD XGDscIvncBxbehbGItCrjeUDfr5sQ+R5FJIq0rVI8p9MZysCEHNGh93l4Z5Lnq/zb1fdTvFrzaG 7qR3DCqo= X-Gm-Gg: AR+sD10tGBe4R6QUtp3XOWrk3ngp9+AzDynkqQ7/AvQuyTX1BQkOGSpVcj7UemJee9m S2rpWVkImzwE43JjbOL2cglIegCC95pvtYIOZkxmxBLyqiC4pSoHYQ2CIjaJxC17wveuaCqfYBQ FcpUfCOCXjy2abOTe8VLkA0sPQrR2rXovjavs3/4nuMlAKZNnwT98SgqGhzE5PHlbRMj2lKSEfJ 2V0MUeAk87LljedRxMXfniGdhC/4bRFPE5MSx+TziCAUx9R0oNazfig76u7jP4ComYAAwBE442y Nj62TfqGDOKJ+/Zi6PZTHEPoboHCf7xhilXTjuldrzfdYFsedfUH8JjTSh+3U27BRFuEnnxPOph XFi4413mP7k8XGtR81LByFQwPPxzAJVgvgirfvg71SyUR8oiIormvPaXMI6iaHLgNCeHYXxQEPS HA+3Id1xccoJKGALrj0L16p7rAt0zF/1U8P5Goq1YUi4IeCyu0s+TWXSKUUI8fWi/saDDBJONia HSvng== X-Received: by 2002:a05:600c:8010:b0:495:7838:7e25 with SMTP id 5b1f17b1804b1-496c4f91af8mr10094815e9.15.1785192991305; Mon, 27 Jul 2026 15:56:31 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:30 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 21/36] sqlite3: fix CVE-2026-11822 and CVE-2026-11824 Date: Tue, 28 Jul 2026 00:55:35 +0200 Message-ID: <9f5f7f47b4626c22419e9d815b2352ea8ac80d47.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242138 From: Deepak Rathore This patch applies the upstream fix [1], which addresses memory corruption vulnerabilities in the SQLite FTS5 full-text search extension. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/e0b995b2a62b78979eb65bb8dadfa912eaa8e62f [2] https://sqlite.org/src/info/061febcf41ca Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-11822 https://nvd.nist.gov/vuln/detail/CVE-2026-11824 Signed-off-by: Deepak Rathore Signed-off-by: Yoann Congal --- .../CVE-2026-11822_CVE-2026-11824.patch | 41 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 5 ++- 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch new file mode 100644 index 00000000000..0bac4412b18 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch @@ -0,0 +1,41 @@ +From d38b8fb5636c6d77f76dbeb5291f49ab594dcad4 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Mon, 11 May 2026 12:00:19 +0000 +Subject: [PATCH] Fix potential buffer overwrite that could occur in fts5 when + processing corrupt records. + +FossilOrigin-Name: 061febcf41ca4872a0f407951e1507209daca7895122b909a7806c60b6e200c4 + +CVE: CVE-2026-11822 CVE-2026-11824 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e0b995b2a62b78979eb65bb8dadfa912eaa8e62f] + +Backport Changes: +- Applied the upstream fts5LeafRead() fix from ext/fts5/fts5_index.c + to sqlite3.c because the Yocto sqlite-autoconf source uses the + amalgamated SQLite layout. +- Omitted ext/fts5/test/fts5corruptA.test because this extracted + recipe source contains the SQLite autoconf/amalgamation layout and + does not carry the upstream Tcl test tree. +- Omitted Git mirror metadata files manifest and manifest.uuid because + they are not required for the security fix in this source layout. + +Signed-off-by: Deepak Rathore +--- + sqlite3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 851a2504c..2f4b77429 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -248157,7 +248157,7 @@ static void fts5DataRelease(Fts5Data *pData){ + static Fts5Data *fts5LeafRead(Fts5Index *p, i64 iRowid){ + Fts5Data *pRet = fts5DataRead(p, iRowid); + if( pRet ){ +- if( pRet->nn<4 || pRet->szLeaf>pRet->nn ){ ++ if( pRet->szLeaf<4 || pRet->szLeaf>pRet->nn ){ + FTS5_CORRUPT_ROWID(p, iRowid); + fts5DataRelease(pRet); + pRet = 0; +-- +2.51.0 diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index 0a8727e4f2c..2b0a9c0e4d7 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -6,4 +6,7 @@ LIC_FILES_CHKSUM = "file://sqlite3.h;endline=11;md5=786d3dc581eff03f4fd9e4a77ed0 SRC_URI = "http://www.sqlite.org/2026/sqlite-autoconf-${SQLITE_PV}.tar.gz" SRC_URI[sha256sum] = "81f5be397049b0cae1b167f2225af7646fc0f82e4a9b3c48c9ea3a533e21d77a" -SRC_URI += "file://0001-Add-option-to-disable-zlib.patch" +SRC_URI += "\ + file://0001-Add-option-to-disable-zlib.patch \ + file://CVE-2026-11822_CVE-2026-11824.patch \ +" From patchwork Mon Jul 27 22:55:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93628 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48059C54F4E for ; Mon, 27 Jul 2026 22:56:42 +0000 (UTC) Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43812.1785192995285556987 for ; Mon, 27 Jul 2026 15:56:35 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=4Igo/FLv; spf=pass (domain: smile.fr, ip: 209.85.128.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-49545ba3d4eso19000685e9.3 for ; Mon, 27 Jul 2026 15:56:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192993; x=1785797793; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=isOKa4yi69cnqbhWlZPc4oOJ4eGKb/0pQg74X6p8MwQ=; b=4Igo/FLvd424S8X4Sl4112v+4fXe2E2ZdKzJt49gkh5o0cLR9TAmbzoYS3yXytaBMr QR8/Ija5VoISWV2tK2oaqBz7H0e01w9Z2T0XBYv6CnzalM4PmjU/z6Y3Z++RaVW2rsIw PCBykQfeYgVerwzv33ZtioLzb7Q+QmU96Mrdw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192993; x=1785797793; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=isOKa4yi69cnqbhWlZPc4oOJ4eGKb/0pQg74X6p8MwQ=; b=RfLajVES3FghpOyiicmU5ychz/D+/OCGWj5INNubdvAh0inv+IFXOb8fx4fPNCIbAZ u79DIESWOO5WXj9r5jjxRwnLBU0x8MWqV8vEpzJWslgN8wcY4eRhQSnZSi5hv05enlDl 00VgogWR/XGuG4+w95BbO5tzvtq1RdR/4vqDz4Lss09uAxEhaOnMIVzKkNoBr4/FM8rY I5KB2n0S/py6c0GC2ZnYOKSim5l+5+NQtoJOXIKBEWBZjru8OBWvDo9kGpUgo6d0++e5 k7i1yJxE61lvnHdxdGODog9cvCCIocQEVRbhopF4068RO/yAVEx0leBTDyTc+MLGnQ5T Vojw== X-Gm-Message-State: AOJu0YyiVO9e58aXXF/dROdN/vd08GX4mnodWIOcuTWJdKkMTBZO9j0v MNTtbn3dfwl3jBYo/49KvBv9DdRdC+DUZvMFTd3JIfw7OYUVJsAgY/Z3GG0a3QIA/XFFUc4fiEJ qmKMAuE4= X-Gm-Gg: AR+sD11NKRElTBBGIl/GZS6Sdm/jr0lOn1gct39MgH1K9QLX2ux25u8+XLdfthkDPRw g4Cug+jxL6J1GFtYiNNCuSV+V1fHsKdV2lbODawxkKuylJvWHLIO7Ih5R2HSmVtGLY2odWS3Cwv TtP7CoTJ8YinKYNVfap8wDGM4ktRlPTf9/kPhuYmzZmAOJpWa7y5X13I6+IKMPzkADlUYSUvWOe Clfz3ZrsDD7/VlIsk2AiU6exlycM9WoTCL5xAhGmH/Z8/0jYrk6w6KDRkz0yfMGvXXKmkO0pbxc vBD82s0cMhPJ8ydfSW8y6k6v6BzjcVkw9XrwpDqXuLouymWb6uwN5u19yI10jegov4GFOgtp1jv tU3VkDbV1O/tHCLm05s8jeUW9tbWQA9wjG7b7fFvbT8X37i1YRIcx4UZmk4gTXKHOsgPwKTcY7I c6P5M9O1bOVKxGWJ4FEqjm1qrhjLXV9S591YtWCLldMeKkz3appQozJZClK1wBNDMLAPWzS2J2k Su8bg== X-Received: by 2002:a05:600c:1c04:b0:495:5d6d:9cb3 with SMTP id 5b1f17b1804b1-496c4fd61c8mr9632335e9.37.1785192993432; Mon, 27 Jul 2026 15:56:33 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.31 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:31 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 22/36] curl: add annotation for CVE-2026-10536 Date: Tue, 28 Jul 2026 00:55:36 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242139 From: João Marcos Costa This CVE is detailed here: https://curl.se/docs/CVE-2026-10536.html and the fix essentially consolidates the fact that HTTP2 stream dependency is deprecated. While oe-core provides a PACKAGECONFIG to enable HTTP2, it is not actually used so the affected part of the code is not compiled. For instance, in the do_configure logs: """ (...) HTTP2: no (--with-nghttp2, --with-hyper) (...) """ Ignore this CVE unless 'nghttp2' is enabled. Signed-off-by: João Marcos Costa (Schneider Electric) Signed-off-by: Yoann Congal --- meta/recipes-support/curl/curl_8.19.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index bdd6e730199..097b3056d8e 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -33,6 +33,7 @@ SRC_URI[sha256sum] = "4eb41489790d19e190d7ac7e18e82857cdd68af8f4e66b292ced562d33 # Curl has used many names over the years... CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl" CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack" +CVE_STATUS[CVE-2026-10536] = "${@bb.utils.contains('PACKAGECONFIG', 'nghttp2', 'unpatched', 'not-applicable-config: applicable only with HTTP/2', d)}" inherit autotools pkgconfig binconfig multilib_header ptest From patchwork Mon Jul 27 22:55:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93626 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2D5DEC5321C for ; Mon, 27 Jul 2026 22:56:42 +0000 (UTC) Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43813.1785192996386352677 for ; Mon, 27 Jul 2026 15:56:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=pzJHCBDY; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-495635a85d2so26735885e9.0 for ; Mon, 27 Jul 2026 15:56:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192995; x=1785797795; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=R1Qf7yHHD7r5n4e7NLDEwLyAXThFZ4bAYeVsjCvJkco=; b=pzJHCBDYuXwgKUtPBUFHOG8lmrO16NQ6N0IRehJv5qdT/0whhGFcKBebaFfjl+6Ilx 0mNHEbQqdlB5P81l1swhn0Vqwxngf4OtZeMQ7vep66c5zr1+gDilYpVvupnh/M21Q3Lb FNlIlWp9olmw9kLtamZI7oRQWbYmjTmiMZBNg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192995; x=1785797795; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=R1Qf7yHHD7r5n4e7NLDEwLyAXThFZ4bAYeVsjCvJkco=; b=HzUM4v6Ge2LbWI51qTxcVy2tgwXz6MN6BfnU4L6YLZ8RJX6p5jymb14RHRICYfC2py 9MXr8xLNpM354aNIYg+/2rqiw5WwCplvfgGztaIEW5Klnr15+EdLn4cqe5fdUC5yeb3f 2+reA4B+9gQrZxhYuMiluLtIxvoWt+YDrOg8ok8B8fCvr6bN0f0HCzBHiHIqMboxfe3W K+EFqfYSHi4Pl6SBRjEG3bhbmjMpNP8tEX1bRO06SKfAVN8q03H0wX5VwJlxf3sRdX35 Av27JbXSScVQGTChBXb1i2/Xg82/n23l2D0fDYu1EqgWFJF5rerEhz3uXdxxCiQ8ttLi p08Q== X-Gm-Message-State: AOJu0YyPZFI9lAp3bod3sDYn6UqF7qTlzQRyI23MwVFrsb3WWUJhxRHD 85Sw9zFgoT+qoMa6997kNdxA5CybTJiDfhF7prxbzEF9YjyKXBynAQ8gzv+/C2wqWZa9HYLQFtU wXRC352o= X-Gm-Gg: AR+sD121nJu9ZScJIgCgtzwlIIExRgv45KSKokxwekJTMHIqv19CGt1xqbj0EnMdF13 qHHFTF7ozUUc2fH/9nHS+aW20/2HR3qP9V5sjiFXTtIDDEORnlaqqaRpRD/zQqJkzXHXzZwHGHe CjUZeDFiOncCp6GF3X3IhoEgN2zkDbscMT+CckYWg1CP0ILOcbcWe0hYVvzx+Gi96v3uqCZ0T1S ugIxdqdru7LQ4lgMDT4zYlZeW5jWXOvZBWSkg0vOcyvXaW+fgwOAph66G82zxX4YcJrel6JHsNa 9oKRHtrVsN5YoLiQ7hm2F6igOVhx+yX4py3w9ImY+gBdVxFdVqLG7BffsMRNdU/4T1RQX6C0TtD nHxzYFgIoYkrjhEpy/3A/2U2ZWyS7P/zPv3ihVbCn8AK2Wn0RSuljmPviX9LnEXuQp7R5ynaHdw wa/L8iGs2EHuwPOenxDIFb6hIdt8/GKPiIsih5UorBkO8Fw4WAPsO6OYIfUnfm734gavMoxXvuw 2Z/tw== X-Received: by 2002:a05:600c:4c1a:b0:495:6b8a:5227 with SMTP id 5b1f17b1804b1-496c4fc2af3mr4569235e9.23.1785192994612; Mon, 27 Jul 2026 15:56:34 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.33 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:33 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 23/36] package.bbclass: hardcode emit_pkgdata to run last Date: Tue, 28 Jul 2026 00:55:37 +0200 Message-ID: <17625781da8d9f1f1026d961c24bd1d7dd486f6f.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242140 From: AshishKumar Mishra Ensure emit_pkgdata runs after all PACKAGEFUNCS to allow layers to extend packaging behavior. Layers can now append custom functions via PACKAGEFUNCS += "func_name" and they will run before emit_pkgdata generates package metadata. Signed-off-by: AshishKumar Mishra Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit aa85baff9ebdd3f932811c3b43d1918c38373cb9) Signed-off-by: Yoann Congal --- meta/classes-global/package.bbclass | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/meta/classes-global/package.bbclass b/meta/classes-global/package.bbclass index 67148fc1acb..0d1be442c1e 100644 --- a/meta/classes-global/package.bbclass +++ b/meta/classes-global/package.bbclass @@ -472,8 +472,7 @@ PACKAGEFUNCS += " \ package_do_shlibs \ package_do_pkgconfig \ read_shlibdeps \ - package_depchains \ - emit_pkgdata" + package_depchains" python do_package () { # Change the following version to cause sstate to invalidate the package @@ -564,9 +563,13 @@ python do_package () { for file in files: pkgfiles[pkg].append(walkroot + os.sep + file) + + # We want emit_pkgdata to run last, after everything for f in (d.getVar('PACKAGEFUNCS') or '').split(): bb.build.exec_func(f, d) + bb.build.exec_func("emit_pkgdata", d) + oe.qa.exit_if_errors(d) } From patchwork Mon Jul 27 22:55:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93627 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A6EEC54F4D for ; Mon, 27 Jul 2026 22:56:42 +0000 (UTC) Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43763.1785192997223966042 for ; Mon, 27 Jul 2026 15:56:37 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=yTdND8Qv; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4953e04ef16so34967485e9.2 for ; Mon, 27 Jul 2026 15:56:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192995; x=1785797795; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=/TLKPNuTjlQqfuEtfQuFvKgecLuvF0qdtT9CMyAashg=; b=yTdND8QvpRi6G8Ry7rBTn42B/8PUrqetuSSZUEpACaiu0WPSWzB1tF/tmFf/VJRGSk 1DIlrryTPvLF9EMs1vEUDp2zWBPN1WOUckWzbcxU+KB2kvAkY49c17fuS9bUgqRqrd7m kxkmTb3qs4sY7MGQxZEc7A836WwyyThju63FM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192995; x=1785797795; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=/TLKPNuTjlQqfuEtfQuFvKgecLuvF0qdtT9CMyAashg=; b=iDqfos2tPIhm+pZMCH+QtkQ+3Q3/fiNqE8Q+g7h8/BR5bhMVPST64JLRKlnCGDsgQA ZSBX1sxZ3Z/ydLnCKIEoOWO6+hE0q71oJ5vHSeu4cdrCo1xec5s7CsO6WTgnQc5AGpqp R9IQtLcq6aDVpRt5RNLjER9O/tM4u+SnjvjXTn7rNEb00uQHzojz7G50T7MsR8bK92XX tnu1IgNUZSr2X2O1ZtEcv+PX7sFHLc/jFS5FaYg9sQFl3+V9BfZGHlIiP1ndUUiuWLm/ 6EgCAqeIHohQkHCbzaOA1WKVDUypFVu/4dE8UwGZoOycbbNf13BosfuTEj4ZHyRYiTBf kWJw== X-Gm-Message-State: AOJu0YyNtMWF63a2kPosVEs1PVmMCS+0nQskboTloeJ9vr65oN0pFpQD 9sL8x5iyKqOr7065PdPexjrpvoU3QJdg1gQTtuR7Ywk6KV76GuRBfZFbF9CbR2jL4OqZIOFr80r 7Jk37GSs= X-Gm-Gg: AR+sD13z7yYnhj2CKIRCXX59ZYgSQp7BLHgX6+akVHPsy5safSXW29Rkz+3Uj3f0D5U PPCbLdyly7cNCjxndkg12U9pXdVWVYTf2S2xv1U+3hClhqwGQHglRz65RTtWKWAdC9DEGNGfXYC kcaIcBmVo63aoznzr4XWHtuHlE0F1UROKblXOrpM88K2PI6fk9AmWDozOkJSNKXB14WNw3TDFL5 3rwJQQPvm8qC3wGrJ0aRJtv1oqKDQZKgu8hqJR8/e6Z5/UFtpT3WtU1nnAF3AC2MORjhTWgyEv5 rYJQtuyBMztN9z307LD7MCpmX0NHdIkFyUH1ErZCMjxNNKeUH8zHgAkj1vEpCgDT4FMQmxF7Pew xpRrjG8JUI30xB7dimXOd28MSgc4KsiWYAklYTArF3kisHjIwLCgluxHEIsdl55Ocp67FJYR6kl MFMccmZsyXFi4/GedRMgR7UvTdlV/wB+QNrWHlUh2G7TX/YGhVmpWHChSsYUkQL84WOtEq8G5N0 aRGJA== X-Received: by 2002:a05:600c:3e19:b0:493:a570:df7d with SMTP id 5b1f17b1804b1-496b5717da1mr115235185e9.20.1785192995469; Mon, 27 Jul 2026 15:56:35 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.34 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:34 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 24/36] systemd-systemctl-native: disable libpam meson option Date: Tue, 28 Jul 2026 00:55:38 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242141 From: Daniel Turull When building on rhel8.10 we got the following crash during do_compile systemctl-259.5/src/shared/pam-util.c | ../sources/systemd-systemctl-259.5/src/shared/pam-util.c:3:10: fatal error: security/pam_ext.h: No such file or directory | 3 | #include | | ^~~~~~~~~~~~~~~~~~~~ | compilation terminated. | ninja: build stopped: subcommand failed. | INFO: autodetecting backend as ninja libpam is not needed for systemctl task done by bitbake, therfore disable MESON option. Signed-off-by: Daniel Turull [YC: On master, this is done in "systemd: upgrade to 261.1"] Signed-off-by: Yoann Congal --- meta/recipes-core/systemd/systemd-systemctl-native_259.5.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-core/systemd/systemd-systemctl-native_259.5.bb b/meta/recipes-core/systemd/systemd-systemctl-native_259.5.bb index 3d01d60e9c1..3c0dcd35a32 100644 --- a/meta/recipes-core/systemd/systemd-systemctl-native_259.5.bb +++ b/meta/recipes-core/systemd/systemd-systemctl-native_259.5.bb @@ -12,6 +12,7 @@ MESON_TARGET = "systemctl:executable" MESON_INSTALL_TAGS = "systemctl" EXTRA_OEMESON += "-Dlink-systemctl-shared=false" EXTRA_OEMESON += "-Dsysvinit-path= -Dsysvrcnd-path=" +EXTRA_OEMESON += "-Dpam=disabled" # Systemctl is supposed to operate on target, but the target sysroot is not # determined at run-time, but rather set during configure From patchwork Mon Jul 27 22:55:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93630 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 094FBC53219 for ; Mon, 27 Jul 2026 22:56:42 +0000 (UTC) Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43814.1785192998282517170 for ; Mon, 27 Jul 2026 15:56:38 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=1PMxfyDJ; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-495437bb891so3379155e9.1 for ; Mon, 27 Jul 2026 15:56:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192996; x=1785797796; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=GvrBTGmXy6XQ8FqeUMYmnCfN5hi8y4eRAgYv9rbFIf8=; b=1PMxfyDJgYYATxMIVwgFy9ITdsAAGgqx4XnBN6FUJ/LZA52XSGah2zo1jNRYFmtNex xmtFCBNXTK0dImBoTLfgx4MSI8L+J+kPeFLQAz/Th5Qx6ur9sRW5Fi7Nwdh0g0GR6IPc gNMAx34AN3sTsRD5MYDehRMcoYZiU5PiPPYRY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192996; x=1785797796; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=GvrBTGmXy6XQ8FqeUMYmnCfN5hi8y4eRAgYv9rbFIf8=; b=Dbq58a85fI8pWz4VEU03dufoxhN61IwAgmnvnPnIWWzfRVgF9k+FQbgHO4MOycHa+h DUyd5ouf4JmDevPhW6MS4sED0lu7zI4vK3nX2CaEx02KL9dk6nmwlpHz2380aoIKeUeB nmuXEyK/jLTBgd5fZYOUXonVfwjr7Jf4gBcU/4rIeIMUi0RckNxD72wZ4GxfziYho0zD gwL8c30sbmjbFE/r/cLYSsO75YK7ImKqrI/WTtzwE9zI2SKiOGN9un7LdwPQMVkviwuk 6gat0yQ2V4rNf9W66vc6k3zINxqZlBbXTwTJuTjFe0facI4/ULMcfCKcWLxZFoppuKsm 7DiA== X-Gm-Message-State: AOJu0YxAs8Oub0R1BC+VwiAxKShYfeGIkw0cMrENXYYIMo0/cY9wDRTG QrXC3QT9XVFJ+ajEWhHoxN5FUBEMZSETT0DbPCKvYNDDd+eJlrvp+v42E/xaqvrNx2tsW3kxSrN CUvGJSQM= X-Gm-Gg: AR+sD1150zzup2z/xSO1nJKxqL++EOoPD2Qp2weYiM+GZqbcVgClx5sAu337AiHItzt xkvEyzObZ7CizF2lYaiU5X2Mf5Hfp4r/MO80/sqj9I9JYigZbDGN9yVfK3kkAxDC6OQrg3IMLHN 77ZARSGrAZ/SOhTKwj7kJkJFCCzmgMCXfFrNESYM2JabuS66KXbe4SdLNgIOzCvhZ7aqg3RvRbC uU5SBj2FJGTIx1P/+DdPWLuPkuT7k02lcnR72aRX4DvPokeGsanS/JqIj9VHFcvHWt2MiwVdL6c kMoNYpXhw6KjHokPa107m/U6qkcUxYhihz2qyB4ZznnNc+goahyM0GKvn5ssSPsBq8KY8fhS29v SHRkdoLfHP5w9V2MCPuy+VRBOMq7cQAFgsfiJ/8/1ISIdnOwp+kq8L/9v66yO3feNOPR1mc+Frg TCLtniZLMgkmHgIITrhjJCtDoW1YEHyghXS+P1fLyMTEOjfjKJhHLH0P9pRnS3EkYOgxn7Vi9o0 jU3mg== X-Received: by 2002:a05:600c:4585:b0:495:6934:4146 with SMTP id 5b1f17b1804b1-496c567ab59mr5100145e9.11.1785192996358; Mon, 27 Jul 2026 15:56:36 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:35 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 25/36] util-linux: upgrade 2.41.3 -> 2.41.5 Date: Tue, 28 Jul 2026 00:55:39 +0200 Message-ID: <140bc60bc02a8eb24ddd3b7199e1d8175c7884bd.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242142 From: Siva Balasubramanian 2.41.4 and 2.41.5 are point releases in the same 2.41 stable series and contain only bug fixes and security fixes (no new features, no API/ABI breaks), so the upgrade complies with the stable branch policy. Among the fixes pulled in: - Several mount(8) TOCTOU / symlink hardening fixes (incl. CVE-2026-27456) - libblkid integer overflow in parse_dos_extended() and a use-after-free in partition probing - pam_lastlog2: fix libpam linking in the autotools build so pam_lastlog2.so links against libpam, fixing the runtime "undefined symbol: pam_syslog" / dlopen failure [YOCTO #16320] Drop the loopdev symlink-attack backport that is now part of the release: - 0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch (upstream f55f9906, released in 2.41.4) Full changes: https://github.com/util-linux/util-linux/compare/v2.41.3...v2.41.5 Signed-off-by: Siva Balasubramanian [YC: Also dropped CVE-2026-13595.patch merged 2.41.5: https://github.com/util-linux/util-linux/commit/132d9c8aa15a8efd0a23d8ca7ed8b98f365e84fa ] Signed-off-by: Yoann Congal --- ...2.41.3.bb => util-linux-libuuid_2.41.5.bb} | 0 meta/recipes-core/util-linux/util-linux.inc | 4 +- ...DEV_FL_NOFOLLOW-to-prevent-symlink-a.patch | 114 -------------- .../util-linux/CVE-2026-13595.patch | 148 ------------------ ...l-linux_2.41.3.bb => util-linux_2.41.5.bb} | 0 5 files changed, 1 insertion(+), 265 deletions(-) rename meta/recipes-core/util-linux/{util-linux-libuuid_2.41.3.bb => util-linux-libuuid_2.41.5.bb} (100%) delete mode 100644 meta/recipes-core/util-linux/util-linux/0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch delete mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch rename meta/recipes-core/util-linux/{util-linux_2.41.3.bb => util-linux_2.41.5.bb} (100%) diff --git a/meta/recipes-core/util-linux/util-linux-libuuid_2.41.3.bb b/meta/recipes-core/util-linux/util-linux-libuuid_2.41.5.bb similarity index 100% rename from meta/recipes-core/util-linux/util-linux-libuuid_2.41.3.bb rename to meta/recipes-core/util-linux/util-linux-libuuid_2.41.5.bb diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc index 2a994d7a386..aec8721ca32 100644 --- a/meta/recipes-core/util-linux/util-linux.inc +++ b/meta/recipes-core/util-linux/util-linux.inc @@ -20,10 +20,8 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin file://0001-lsfd-mkfds-foreign-sockets-skip-when-lacking-sock_di.patch \ file://0001-ts-kill-decode-use-RTMIN-from-kill-L-instead-of-hard.patch \ file://0001-tests-script-Disable-size-option-test.patch \ - file://0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch \ - file://CVE-2026-13595.patch \ " -SRC_URI[sha256sum] = "3330d873f0fceb5560b89a7dc14e4f3288bbd880e96903ed9b50ec2b5799e58b" +SRC_URI[sha256sum] = "f586e35d320ff537aab3ffeca37e9ecd482ccbe013590db4429a414d8aa6a728" CVE_PRODUCT = "util-linux" diff --git a/meta/recipes-core/util-linux/util-linux/0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch b/meta/recipes-core/util-linux/util-linux/0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch deleted file mode 100644 index 0951c9f5fbe..00000000000 --- a/meta/recipes-core/util-linux/util-linux/0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch +++ /dev/null @@ -1,114 +0,0 @@ -From f55f9906b4f6eeb2b4a4120317df9de935253c10 Mon Sep 17 00:00:00 2001 -From: Karel Zak -Date: Thu, 19 Feb 2026 13:59:46 +0100 -Subject: [PATCH] loopdev: add LOOPDEV_FL_NOFOLLOW to prevent symlink attacks - -Add a new LOOPDEV_FL_NOFOLLOW flag for loop device context that -prevents symlink following in both path canonicalization and file open. - -When set: -- loopcxt_set_backing_file() uses strdup() instead of - ul_canonicalize_path() (which calls realpath() and follows symlinks) -- loopcxt_setup_device() adds O_NOFOLLOW to open() flags - -The flag is set for non-root (restricted) mount operations in -libmount's loop device hook. This prevents a TOCTOU race condition -where an attacker could replace the backing file (specified in -/etc/fstab) with a symlink to an arbitrary root-owned file between -path resolution and open(). - -Vulnerable Code Flow: - - mount /mnt/point (non-root, SUID) - mount.c: sanitize_paths() on user args (mountpoint only) - mnt_context_mount() - mnt_context_prepare_mount() - mnt_context_apply_fstab() <-- source path from fstab - hooks run at MNT_STAGE_PREP_SOURCE - hook_loopdev.c: setup_loopdev() - backing_file = fstab source path ("/home/user/disk.img") - loopcxt_set_backing_file() <-- calls realpath() as ROOT - ul_canonicalize_path() <-- follows symlinks! - loopcxt_setup_device() - open(lc->filename, O_RDWR|O_CLOEXEC) <-- no O_NOFOLLOW - -Two vulnerabilities in the path: - -1) loopcxt_set_backing_file() calls ul_canonicalize_path() which uses - realpath() -- this follows symlinks as euid=0. If the attacker swaps - the file to a symlink before this call, lc->filename becomes the - resolved target path (e.g., /root/secret.img). - -2) loopcxt_setup_device() opens lc->filename without O_NOFOLLOW. Even - if canonicalization happened correctly, the file can be swapped to a - symlink between canonicalize and open. - -Addresses: https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g -Signed-off-by: Karel Zak -(cherry picked from commit 5e390467b26a3cf3fecc04e1a0d482dff3162fc4) - -CVE: CVE-2026-27456 -Upstream-Status: Backport -Signed-off-by: Ross Burton ---- - include/loopdev.h | 3 ++- - lib/loopdev.c | 7 ++++++- - libmount/src/hook_loopdev.c | 3 ++- - 3 files changed, 10 insertions(+), 3 deletions(-) - -diff --git a/include/loopdev.h b/include/loopdev.h -index e5ec1c98a..6bdb1393a 100644 ---- a/include/loopdev.h -+++ b/include/loopdev.h -@@ -140,7 +140,8 @@ enum { - LOOPDEV_FL_NOIOCTL = (1 << 6), - LOOPDEV_FL_DEVSUBDIR = (1 << 7), - LOOPDEV_FL_CONTROL = (1 << 8), /* system with /dev/loop-control */ -- LOOPDEV_FL_SIZELIMIT = (1 << 9) -+ LOOPDEV_FL_SIZELIMIT = (1 << 9), -+ LOOPDEV_FL_NOFOLLOW = (1 << 10) /* O_NOFOLLOW, don't follow symlinks */ - }; - - /* -diff --git a/lib/loopdev.c b/lib/loopdev.c -index 2359bf781..76685be70 100644 ---- a/lib/loopdev.c -+++ b/lib/loopdev.c -@@ -1267,7 +1267,10 @@ int loopcxt_set_backing_file(struct loopdev_cxt *lc, const char *filename) - if (!lc) - return -EINVAL; - -- lc->filename = canonicalize_path(filename); -+ if (lc->flags & LOOPDEV_FL_NOFOLLOW) -+ lc->filename = strdup(filename); -+ else -+ lc->filename = canonicalize_path(filename); - if (!lc->filename) - return -errno; - -@@ -1408,6 +1411,8 @@ int loopcxt_setup_device(struct loopdev_cxt *lc) - - if (lc->config.info.lo_flags & LO_FLAGS_DIRECT_IO) - flags |= O_DIRECT; -+ if (lc->flags & LOOPDEV_FL_NOFOLLOW) -+ flags |= O_NOFOLLOW; - - if ((file_fd = open(lc->filename, mode | flags)) < 0) { - if (mode != O_RDONLY && (errno == EROFS || errno == EACCES)) -diff --git a/libmount/src/hook_loopdev.c b/libmount/src/hook_loopdev.c -index 444d69d6f..34351116c 100644 ---- a/libmount/src/hook_loopdev.c -+++ b/libmount/src/hook_loopdev.c -@@ -272,7 +272,8 @@ static int setup_loopdev(struct libmnt_context *cxt, - } - - DBG(LOOP, ul_debugobj(cxt, "not found; create a new loop device")); -- rc = loopcxt_init(&lc, 0); -+ rc = loopcxt_init(&lc, -+ mnt_context_is_restricted(cxt) ? LOOPDEV_FL_NOFOLLOW : 0); - if (rc) - goto done_no_deinit; - if (mnt_opt_has_value(loopopt)) { --- -2.43.0 - diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch deleted file mode 100644 index 894844bc1f4..00000000000 --- a/meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch +++ /dev/null @@ -1,148 +0,0 @@ -From c3844c348f2903d929dd5ded0ea8147394cce607 Mon Sep 17 00:00:00 2001 -From: Karel Zak -Date: Thu, 7 May 2026 12:50:48 +0200 -Subject: [PATCH] libblkid: fix use-after-free in nested partition probing - -The partitions list stores partitions in a contiguous array grown by -reallocarray(). When the array is reallocated to a new address, all -existing blkid_partition pointers (tab->parent, ls->next_parent, local -parent variables in nested probers) become dangling. - -Fix this by changing the storage from an array of structs to an array -of pointers, where each partition is individually allocated via -calloc(). This makes all blkid_partition pointers stable across -reallocations -- only the pointer array itself may move, which is -harmless since no code caches pointers into the pointer array. - -This eliminates the need for callers to re-fetch parent pointers after -every blkid_partlist_add_partition() call. - -CVE: CVE-2026-13595 -Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/132d9c8aa15a8efd0a23d8ca7ed8b98f365e84fa] - -Reported-by: Thai Duong -Signed-off-by: Karel Zak -(cherry picked from commit c0186f14fbdb02f64c8e0ba701ce727ea764ff4c) -(cherry picked from commit 132d9c8aa15a8efd0a23d8ca7ed8b98f365e84fa) -Signed-off-by: Deepak Rathore ---- - libblkid/src/partitions/partitions.c | 34 +++++++++++++++++----------- - 1 file changed, 21 insertions(+), 13 deletions(-) - -diff --git a/libblkid/src/partitions/partitions.c b/libblkid/src/partitions/partitions.c -index 9df813c92..e600e5e45 100644 ---- a/libblkid/src/partitions/partitions.c -+++ b/libblkid/src/partitions/partitions.c -@@ -198,7 +198,7 @@ struct blkid_struct_partlist { - - int nparts; /* number of partitions */ - int nparts_max; /* max.number of partitions */ -- blkid_partition parts; /* array of partitions */ -+ blkid_partition *parts; /* array of pointers to partitions */ - - struct list_head l_tabs; /* list of partition tables */ - }; -@@ -357,13 +357,16 @@ static void reset_partlist(blkid_partlist ls) - free_parttables(ls); - - if (ls->next_partno) { -- /* already initialized - reset */ -- int tmp_nparts = ls->nparts_max; -- blkid_partition tmp_parts = ls->parts; -+ /* already initialized - free individually allocated partitions */ -+ int i, tmp_nparts_max = ls->nparts_max; -+ blkid_partition *tmp_parts = ls->parts; -+ -+ for (i = 0; i < ls->nparts; i++) -+ free(ls->parts[i]); - - memset(ls, 0, sizeof(struct blkid_struct_partlist)); - -- ls->nparts_max = tmp_nparts; -+ ls->nparts_max = tmp_nparts_max; - ls->parts = tmp_parts; - } - -@@ -398,6 +401,7 @@ static void partitions_free_data(blkid_probe pr __attribute__((__unused__)), - void *data) - { - blkid_partlist ls = (blkid_partlist) data; -+ int i; - - if (!ls) - return; -@@ -405,6 +409,8 @@ static void partitions_free_data(blkid_probe pr __attribute__((__unused__)), - free_parttables(ls); - - /* deallocate partitions and partlist */ -+ for (i = 0; i < ls->nparts; i++) -+ free(ls->parts[i]); - free(ls->parts); - free(ls); - } -@@ -438,15 +444,17 @@ static blkid_partition new_partition(blkid_partlist ls, blkid_parttable tab) - * generic Linux machine -- let start with 32 partitions. - */ - void *tmp = reallocarray(ls->parts, ls->nparts_max + 32, -- sizeof(struct blkid_struct_partition)); -+ sizeof(blkid_partition)); - if (!tmp) - return NULL; - ls->parts = tmp; - ls->nparts_max += 32; - } - -- par = &ls->parts[ls->nparts++]; -- memset(par, 0, sizeof(struct blkid_struct_partition)); -+ par = calloc(1, sizeof(struct blkid_struct_partition)); -+ if (!par) -+ return NULL; -+ ls->parts[ls->nparts++] = par; - - ref_parttable(tab); - par->tab = tab; -@@ -851,7 +859,7 @@ int blkid_probe_is_covered_by_pt(blkid_probe pr, - - /* check if the partition table fits into the device */ - for (i = 0; i < nparts; i++) { -- blkid_partition par = &ls->parts[i]; -+ blkid_partition par = ls->parts[i]; - - if (par->start + par->size > (pr->size >> 9)) { - DBG(LOWPROBE, ul_debug("partition #%d overflows " -@@ -863,7 +871,7 @@ int blkid_probe_is_covered_by_pt(blkid_probe pr, - - /* check if the requested area is covered by PT */ - for (i = 0; i < nparts; i++) { -- blkid_partition par = &ls->parts[i]; -+ blkid_partition par = ls->parts[i]; - - if (start >= par->start && end <= par->start + par->size) { - rc = 1; -@@ -962,7 +970,7 @@ blkid_partition blkid_partlist_get_partition(blkid_partlist ls, int n) - if (n < 0 || n >= ls->nparts) - return NULL; - -- return &ls->parts[n]; -+ return ls->parts[n]; - } - - blkid_partition blkid_partlist_get_partition_by_start(blkid_partlist ls, uint64_t start) -@@ -1074,7 +1082,7 @@ blkid_partition blkid_partlist_devno_to_partition(blkid_partlist ls, dev_t devno - * and an entry in partition table. - */ - for (i = 0; i < ls->nparts; i++) { -- blkid_partition par = &ls->parts[i]; -+ blkid_partition par = ls->parts[i]; - - if (partno != blkid_partition_get_partno(par)) - continue; -@@ -1090,7 +1098,7 @@ blkid_partition blkid_partlist_devno_to_partition(blkid_partlist ls, dev_t devno - DBG(LOWPROBE, ul_debug("searching by offset/size")); - - for (i = 0; i < ls->nparts; i++) { -- blkid_partition par = &ls->parts[i]; -+ blkid_partition par = ls->parts[i]; - - if ((uint64_t)blkid_partition_get_start(par) == start && - (uint64_t)blkid_partition_get_size(par) == size) diff --git a/meta/recipes-core/util-linux/util-linux_2.41.3.bb b/meta/recipes-core/util-linux/util-linux_2.41.5.bb similarity index 100% rename from meta/recipes-core/util-linux/util-linux_2.41.3.bb rename to meta/recipes-core/util-linux/util-linux_2.41.5.bb From patchwork Mon Jul 27 22:55:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93632 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EB3E5C531D0 for ; Mon, 27 Jul 2026 22:56:41 +0000 (UTC) Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43764.1785192999737837819 for ; Mon, 27 Jul 2026 15:56:40 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=ooGGz+Et; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-49545ba3d4eso19000785e9.3 for ; Mon, 27 Jul 2026 15:56:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785192998; x=1785797798; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=g95VyMbvrxM2YikndhKI7lHHFFVIPQnUgY0EDI94Qo4=; b=ooGGz+EtepbCMVd+wG8foAc5rTOfFWfQGVjmg7moeCJ6Sp7H8ifYv4vf7lROVwlY5M oVThDbWw7epISStASrdcJBoqzgvlsmMXsbml7yGMg2O0T4EtKgPLDyilUxynECvZ7y9g JSDrn70pqsvJZY7DRC2iXAfPgc3caTly2VgiE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785192998; x=1785797798; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=g95VyMbvrxM2YikndhKI7lHHFFVIPQnUgY0EDI94Qo4=; b=m4E5cpQuYdN5RjFmnUdk2rAt6X8OQuhr5VZQo/Y1uJ3FJLDuiXWL2liNLqnlJxfkgw 7pvKCJGdIKOog1xiXw846pZnNWcS7gHuOLqmFE13EgxDCS+H/8fA9uNHLOVxOiWF6d97 LuYaBQM7j/WIbRVCJJXuVyzSYi642apMwjLtDn7Ks+Izep8uluP9wcTK8LxLoMzKd6NL iKyMuaYgPJy5Z62oW/fwVkjR9VV8q8jON8DmEbeAbz5QqJh+JrtWD2Om4cBW7Y+HBkbh nyAdXrxnYvDp0/+WBaWLShJwhbStqt0ETndBLHElbeodkvCLC2UHgFY45J0NGieaOSmR bLfg== X-Gm-Message-State: AOJu0Yy74Zi6sMKNnuyU0azqJFrREfc9pBPB4OTU3BkdvE1oE1mQ2pZV BwYlO4L27bOIxo85JvfSzFBzoG9+7/Jsp4rEZer2o7p+DD88J8VOImWeAwt8SOgZJ+UueSquPYg n4n8tdfE= X-Gm-Gg: AR+sD111LLB6V0bRkcvorJTKN4jgdcz6t8o+76fSRSp8ZOM/FO0CqXWOgEKTkWdKj6s SYoxbXCKjvkDM3xS/37ckbcC8e0xCXdzbtssV3ipQ7epK1KjA4d6Ipimd3tNAppbfT1tltRHzQx 8P4+1LFuAkRW4KzPbErBgQVY6XoRoO3QMvoJYKwcfTU2Mq2/yzkg+9ucLXm6nCacI2y/7QWpDhZ p7AXPOrqvbowlaBhtZljw2JIgCx7gIHHJ197cnmqUXh6hbq/howoR05SlzDg+iMPtXyDYElF/fr 7BhMMrzscPNj6p2pBqpzaZmNr7/NJD5EF/u+oZqAxf3XMTzOVVZHOVGeinZrz0QO11DZf0C7Wjm Immjg0kdr5JMPbKKGByBPxFu5mH4qwQtnwirm0YDvj+Ftt66rOOJZbL+aq3cuh7tqN3VjtE47Ox FZN+LfNP4iIB1bjWOuK0VLBfcuEZ4qtDKCvyp+MQ6U7dDc0QSQqWCn9AeYAb7eWvWVRgWIb5pd8 JZAp3mANv/EN8FA X-Received: by 2002:a05:600c:4685:b0:496:c361:fb96 with SMTP id 5b1f17b1804b1-496c4c2ffe3mr10110985e9.0.1785192997707; Mon, 27 Jul 2026 15:56:37 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.36 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:36 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 26/36] linux-yocto/6.18: update to v6.18.36 Date: Tue, 28 Jul 2026 00:55:40 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242143 From: Bruce Ashfield Updating linux-yocto/6.18 to the latest korg -stable release that comprises the following commits: 275d294b2b24 Linux 6.18.36 5d634afb8b83 netfilter: require Ethernet MAC header before using eth_hdr() bf7a9cacd95e cfi: Include uaccess.h for get_kernel_nofault() f455405e3207 vsock/virtio: fix skb overhead overflow on 32-bit builds 36a0faaa4e3d block: fix handling of dead zone write plugs 7b569b3a2f29 arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU 99abe00c605e arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU d4fd42822040 arm64: errata: Mitigate TLBI errata on various Arm CPUs 8097f93f9b77 arm64: cputype: Add C1-Premium definitions e9ea7cb17677 arm64: cputype: Add C1-Ultra definitions eca6743b148a vsock/virtio: fix skb overhead accounting to preserve full buf_alloc 9bdc637fde66 vsock/virtio: fix potential unbounded skb queue cdce1e797add ipvs: skip ipv6 extension headers for csum checks afd35fec9297 RDMA/umem: Fix truncation for block sizes >= 4G cd26d54bfbc2 RDMA: Move DMA block iterator logic into dedicated files ebf22feff492 RDMA/umem: fix kernel-doc warnings 84d8f58cf28a netfilter: nft_fib: fix stale stack leak via the OIFNAME register 2904e985a291 RDMA: During rereg_mr ensure that REREG_ACCESS is compatible f58efaf9fcf7 RDMA/umem: Add helpers for umem dmabuf revoke lock 5f3286ca5fbb RDMA/umem: Move umem dmabuf revoke logic into helper function ceddd32231dd RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper 0ffcad63b19a sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() 37c059d4d92f wifi: mac80211: tests: mark HT check strict 4dac39a4db14 wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode 17faa39ba980 driver core: reject devices with unregistered buses 20a93e397abe fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling e09689286385 drm/amd/display: Use krealloc_array() in dal_vector_reserve() 454d3b3d499c drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() bb6f705b73b5 drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs c000da79df78 drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs 3f32d52ec604 drm/amd/display: Clamp VBIOS HDMI retimer register count to array size 1906064d50d1 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size 0e56f460bddb drm/amd/display: Bound VBIOS record-chain walk loops 57607fe55e6d drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range 932642791cb1 drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 8979ded4d899 drm/amd/pm: fix smu13 power limit default/cap calculation 39b5397bf8de drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14) fcd51a085e9a drm/amdgpu: restart the CS if some parts of the VM are still invalidated 68455b117258 drm/amdgpu: fix waiting for all submissions for userptrs 9655b56b6de9 drm/v3d: Skip CSD when it has zeroed workgroups 90b629269088 drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups 3e1947573140 drm/v3d: Fix global performance monitor reference counting 11e9bdf8824b drm/v3d: Wait for pending L2T flush before cleaning caches 4c10fd55187a drm/xe: Clear pending_disable before signaling suspend fence 0f68ddfaaebf drm/xe/display: fix oops in suspend/shutdown without display d3efcadfe3ee drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 72e259a32084 drm/amdkfd: fix NULL dereference in get_queue_ids() c0639ede2f24 drm/gem: Try to fix change_handle ioctl, attempt 4 9f0d45d509b4 slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock 8f4b371f4939 slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD 5204cd22c1c7 slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership dd8e1025a84e slimbus: qcom-ngd-ctrl: Initialize controller resources in controller 24ec89123fc9 slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd 3bb2ac834ed3 slimbus: qcom-ngd-ctrl: Fix probe error path ordering d6cb003e4661 slimbus: qcom-ngd-ctrl: Fix up platform_driver registration 6890bd2451a9 slimbus: qcom-ngd-ctrl: fix OF node refcount b5daa920f44c thunderbolt: Limit XDomain response copy to actual frame size 46da5c3ea011 thunderbolt: Validate XDomain request packet size before type cast fcbd0cdab928 thunderbolt: Clamp XDomain response data copy to allocation size 60ba62174607 thunderbolt: Bound root directory content to block size 2e0ddac549eb thunderbolt: Reject zero-length property entries in validator d5ea0b3e261f sctp: stream: fully roll back denied add-stream state 78c4f964b2f9 sctp: diag: reject stale associations in dump_one path 566c4c1244de rxrpc: Fix the ACK parser to extract the SACK table for parsing 1bf84f4013fa rtase: Reset TX subqueue when clearing TX ring 54f9cdcd7311 rtase: Avoid sleeping in get_stats64() ddcf84b25af0 pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source 0d11992d1898 pmdomain: imx: fix OF node refcount 0aecf3c7b8f8 mmc: sdhci: add signal voltage switch in sdhci_resume_host 535ff092b686 mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC 2f72d36f8acc mmc: litex_mmc: Set mandatory idle clocks before CMD0 7f8007be13e6 mmc: dw_mmc-rockchip: Add missing private data for very old controllers c677b13671dc mmc: core: Fix host controller programming for fixed driver type a8f91ddf67f6 mm/mincore: handle non-swap entries before !CONFIG_SWAP guard c19ff4351214 mm/list_lru: drain before clearing xarray entry on reparent c72469ac0f27 mm/hugetlb: restore reservation on error in hugetlb folio copy paths ecc24f0a8a30 mm/hugetlb: avoid false positive lockdep assertion 66bc00ea37fa mm/damon/reclaim: handle ctx allocation failure 6d48f1565939 mm/damon/lru_sort: handle ctx allocation failure d83390b21a02 mm/cma_debug: fix invalid accesses for inactive CMA areas 52078596dce1 mm/cma: fix reserved page leak on activation failure d5d37b7b72a9 io_uring/wait: fix min_timeout behavior c888d5198ffc io_uring/kbuf: don't truncate end buffer for bundles 3fdcca838f97 pinctrl: mcp23s08: Read spi-present-mask as u8 not u32 e646b86b3b48 octeontx2-af: fix memory leak in rvu_setup_hw_resources() 4a4d21f531cc nvmem: layouts: onie-tlv: fix hang on unknown types cb85ef5a227b nvmem: core: fix use-after-free bugs in error paths bef389a210e7 net: sfp: initialize i2c_block_size at adapter configure time 1d4ec754ee38 net: rds: clear i_sends on setup unwind 52b8f5ef82c8 net: phonet: free phonet_device after RCU grace period 4a73cacb5586 net: mv643xx: fix OF node refcount bcb8fad90f27 net: bonding: fix NULL pointer dereference in bond_do_ioctl() 01f7d4b50458 net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues() e0df4d9c0909 net/mlx5: Reorder completion before putting command entry in cmd_work_handler 0a46c7a5646d firmware: samsung: acpm: Fix mailbox channel leak on probe error d5de9cb5355d misc: fastrpc: Fix NULL pointer dereference in rpmsg callback 53e06f8a3c2b misc: fastrpc: fix DMA address corruption due to find_vma misuse 992f121796b7 misc: fastrpc: fix use-after-free race in fastrpc_map_create 5278ccd357e0 misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context 89bd8215e25a memcg: use round-robin victim selection in refill_stock a388e3dfaf95 locking/rtmutex: Skip remove_waiter() when waiter is not enqueued db752ebfdaf2 ipc/shm: serialize orphan cleanup with shm_nattch updates ab61c990a87d iommu/dma: Do not try to iommu_map a 0 length region in swiotlb f35a368fee8a Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard a3dff1e1a554 Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) 7f59e4f72a78 i2c: tegra: Fix NOIRQ suspend/resume 6018d73137cd i2c: stm32f7: fix timing computation ignoring i2c-analog-filter a162a260c8c4 i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() 9fa82cf393ba i2c: imx: fix clock and pinctrl state inconsistency in runtime PM b39f30c0a72f i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan() 16f8e17184b3 futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock 56763afa0134 fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios 12df4cfa738a fuse: reject fuse_notify() pagecache ops on directories 57a9c085be07 fs/qnx6: fix pointer arithmetic in directory iteration 2990f143ec86 pidfd: refuse access to tasks that have started exiting harder 89b909e97045 inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush df422fd273c9 IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN 32138633e51e fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() 3884976f8744 bnxt_en: Fix NULL pointer dereference 6f72b902c34d ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write 735dabdf2156 staging: rtl8723bs: fix buffer over-read in rtw_update_protection 1d6c2062b77b timers/migration: Fix livelock in tmigr_handle_remote_up() ba9ad6015937 vsock/vmci: fix sk_ack_backlog leak on failed handshake 265c07c09c83 wifi: nl80211: reject oversized EMA RNR lists ac2000be0cbe wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used fcfdff42e841 xfs: fix rtgroup cleanup in CoW fork repair d84ed2f9718e xfs: fix error returns in CoW fork repair 9f21885c11ba mptcp: add-addr: always drop other suboptions 6ea1134f1b5f selftests: mptcp: add test for extra_subflows underflow on userspace PM 7bbc11437a20 mptcp: sockopt: set sockopt on all subflows f591cbc088c9 mptcp: sockopt: check timestamping ret value c0c152fc4ae6 mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation 653245266913 mptcp: allow subflow rcv wnd to shrink 3b8cbba7c0ed mptcp: close TOCTOU race while computing rcv_wnd edaf0c955ace mptcp: fix retransmission loop when csum is enabled 95f27fcda681 arm64: mm: call pagetable dtor when freeing hot-removed page tables 517720913bd3 ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow da295adc9dab ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O 6243a363ec90 ARM: socfpga: Fix OF node refcount leak in SMP setup 6822eed69572 udp: clear skb->dev before running a sockmap verdict c96786d6ff1a zram: fix use-after-free in zram_bvec_write_partial() f92a285db7ff RDMA/srp: bound SRP_RSP sense copy by the received length bd5e818be796 RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc 96b6e98ff12d RDMA/core: Validate the passed in fops for ib_get_ucaps() e99807bdcd20 mm/huge_memory: update file PUD counter before folio_put() cb5230b6d8a0 mm/damon/ops-common: call folio_test_lru() after folio_get() 5f5b604e1e6b mm/huge_memory: update file PMD counter before folio_put() edabfe80e34e drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() 8348567a6afb drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() 0bbc9481f970 io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries 3d39da65b5c4 ALSA: timer: Fix UAF at snd_timer_user_params() f46093dd2296 ALSA: timer: Forcibly close timer instances at closing 372f33ebed74 USB: serial: kl5kusb105: fix bulk-out buffer overflow 85bd2b3afa0a USB: serial: option: add usb-id for Dell Wireless DW5826e-m 294692d3296e USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() f96cf7bf9fbf USB: serial: io_ti: fix heap overflow in get_manuf_info() a13ca53e47e5 xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() dd66f7f6e360 xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() f9b38a8fbfa0 xfrm: espintcp: do not reuse an in-progress partial send 14d2eee0193a ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL 0b38870d81ab hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf 32d4c5d328a3 drm/i915/gem: Fix phys BO pread/pwrite with offset 0b79bcff7210 KVM: arm64: Restore POR_EL0 access to host EL0 196f1ee137eb KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA 343e95c8ecc4 KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying 0864bdde152e mshv: add a missing padding field 8bcbedce9bfa mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation a0a4600b396b rust: kasan/kbuild: fix rustc-option when cross-compiling d0f25a1755f2 rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES 5037b2ee1a17 ARM: Do not select HAVE_RUST when KASAN is enabled 00875811f372 rust: x86: support Rust >= 1.98.0 target spec 592be0dc491d tracing/probes: Point the error offset correctly for eprobe argument error 09df291fdf96 tracing: Fix CFI violation in probestub being called by tprobes 45cb105b8642 accel/ivpu: Fix signed integer truncation in IPC receive fa598556ecef accel/ivpu: Add buffer overflow check in MS get_info_ioctl 8ec70c0dbdf0 accel/ivpu: Add bounds checks for firmware log indices dd77a83915b0 mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison cc160ce08540 soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() dedc92b96dc1 Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig dafc9f57140e Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend c10c9c48b290 tee: shm: fix shm leak in register_shm_helper() 07acb9798477 netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register 941d7394efda netfilter: nft_tunnel: fix use-after-free on object destroy e83fc4c28226 accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() 361e97d81331 drm/xe: fix refcount leak in xe_range_fence_insert() 02f5e4db57c0 drm/vc4: fix krealloc() memory leak 19a6a00ff50c drm/virtio: Fix driver removal with disabled KMS dda720b2928d drm/i915/edp: Check supported link rates DPCD read 489f6d759fa4 clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time 3a4fc3617b7e clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs 656939c67595 clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked f34689e7a0b3 KVM: VMX: Update SVI during runtime APICv activation 07d9a0870a17 ipv6: Fix a potential NPD in cleanup_prefix_route() 2c98343c9b23 net: txgbe: initialize module info buffer 19a4d2aace1d net: txgbe: rename the SFP related 9157060fed92 net: txgbe: support CR modules for AML devices 7649ba2b1291 net: txgbe: optimize the flow to setup PHY for AML devices af08fe9ba091 net: mvpp2: build skb from XDP-adjusted data on XDP_PASS 8a2126c5afe8 net: mvpp2: refill RX buffers before XDP or skb use 910617a4e67d net: mvpp2: limit XDP frame size to the RX buffer a13199fa224e net: mvpp2: sync RX data at the hardware packet offset 78069a6d8bc8 netfilter: nft_exthdr: fix register tracking for F_PRESENT flag af1b7699466f netfilter: nf_log: validate MAC header was set before dumping it 08a3e218064d netfilter: x_tables: avoid leaking percpu counter pointers 9d017671dcfc netfilter: nf_conntrack: destroy stale expectfn expectations on unregister 4beffcd726e2 netfilter: revalidate bridge ports 865e94f6d8a5 spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX 5ae8a38169fc rds: mark snapshot pages dirty in rds_info_getsockopt() 2abfb19bbb81 ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() 5fd1fa5a4254 tun: zero the whole vnet header in tun_put_user() dcf458120add net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion 3dde4fb941fa net: guard timestamp cmsgs to real error queue skbs 7560afb8cdda sctp: validate embedded INIT chunk and address list lengths in cookie ecf8904067dc ip6_vti: set netns_immutable on the fallback device. f76a8b323e28 sctp: fix uninit-value in __sctp_rcv_asconf_lookup() d23d53355300 ASoC: SOF: amd: fix for ipc flags check 6c75ee4d1d40 net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission 9c46f3ee1837 net: mctp: usb: fix race between urb completion and rx_retry cancellation bace7b99bfa5 gpio: rockchip: fix generic IRQ chip leak on remove 5d4bca5cbb69 gpio: zynq: fix runtime PM leak on remove c838ffc154cb r8152: handle the return value of usb_reset_device() ecc55aad3390 net: openvswitch: fix possible kfree_skb of ERR_PTR 2fa49b2715e1 ipv6: sit: reload inner IPv6 header after GSO offloads 289c06418ed9 net/mlx5: Use effective affinity mask for IRQ selection 2789b74ae1f4 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure 0f807764bb12 net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list ab269990ed58 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove 3a254779c169 net: phy: clean the sfp upstream if phy probing fails c299321bc623 netdev: fix double-free in netdev_nl_bind_rx_doit() c09c2e236eef net: ibm: emac: Fix use-after-free during device removal 8b0541231091 net/mlx4: avoid GCC 10 __bad_copy_from() false positive 0cde3a004119 net: add pskb_may_pull() to skb_gro_receive_list() ede69b8f6670 tcp: restrict SO_ATTACH_FILTER to priv users 12e579b88962 ASoC: wm_adsp: Fix NULL dereference when removing firmware controls 6136c1474db8 gpio: mvebu: fix NULL pointer dereference in suspend/resume 0c4bb32ad7fd netlabel: validate unlabeled address and mask attribute lengths 972c106f5d01 bnge: fix context mem iteration 6b8baf42b1b7 net: ena: PHC: Add missing barrier 640edc281d2f idpf: fix mailbox capability for set device clock time 6bdbe6f43ecf ice: fix missing priority callbacks for U.FL DPLL pins b5316e2b8614 xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() 5513dcb378f9 dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device 4ee4d628c4d9 dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments 8d9a79fbf517 xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload e27c17346628 tap: free page on error paths in tap_get_user_xdp() 0c03692e2372 verification/rvgen: Fix ltl2k writing True as a literal 43ad0a0da486 verification/rvgen: Fix options shared among commands 73590b4cfd05 tools/rv: Fix cleanup after failed trace setup fd1923910bbf tools/rv: Fix substring match when listing container monitors 2122d68f0864 tools/rv: Fix substring match bug in monitor name search 618193aba6fe tools/rv: Ensure monitor name and desc are NUL-terminated 65046b0d853d cpufreq/amd-pstate: drop stale @epp_cached kdoc 63a9f6012f45 spi: cadence-quadspi: fix unclocked access on unbind 6671a46144f8 ALSA: seq: dummy: fix UMP event stack overread cd98837db15f ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams 6b71956c25f9 time: Fix off-by-one in settimeofday() usec validation ed0ad6574126 hyperv: Clean up and fix the guest ID comment in hvgdk.h 8c046f36222c signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() 6dc6e5b5c32e selftests: harness: fix pidfd leak in __wait_for_test 752e22ecf4df drm/hyperv: During panic do VMBus unload after frame buffer is flushed b0f77f76231b Drivers: hv: vmbus: Provide option to skip VMBus unload on panic 1639df1a9844 Drivers: hv: VMBus protocol version 6.0 a6207349e703 sctp: purge outqueue on stale COOKIE-ECHO handling 42446ca0f357 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr 285b0842f2e0 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() 3b7ee029b556 vxlan: vnifilter: fix spurious notification on VNI update 8e4d1188bad7 vxlan: vnifilter: send notification on VNI add eb676fb14427 octeontx2-af: npc: Fix CPT channel mask in npc_install_flow cc272185c9a9 sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing b198ed4e5258 net/sched: fix pedit partial COW leading to page cache corruption e634408d2b0c net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown 6f829e2c17a5 net: airoha: Fix use-after-free in metadata dst teardown 9a263bbd1ec0 ptp: vclock: Switch from RCU to SRCU a4f3fd651692 ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options 91106d0348a5 af_unix: Fix inq_len update problem in partial read f010cf9aea01 octeontx2-af: Fix initialization of mcam's entry2target_pffunc field ddf930f28be6 octeontx2-pf: Fix NDC sync operation errors 0dfe05b93843 xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() 58d810354de1 Bluetooth: MGMT: Fix backward compatibility with userspace 446a17b1b509 Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect ab84fd7779a2 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls 33d677d2e371 Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync ce4b4cac3c57 Bluetooth: fix memory leak in error path of hci_alloc_dev() c893e17d2809 Bluetooth: bnep: reject short frames before parsing 7f5367f1ad9b Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling 3eabc6d47a0a Bluetooth: RFCOMM: validate skb length in MCC handlers 1a3c8ffbb469 Bluetooth: MGMT: validate advertising TLV before type checks 8802413ce631 Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() fb8db813eba2 wifi: fix leak if split 6 GHz scanning fails 15be7e9fdbff ipv6: anycast: insert aca into global hash under idev->lock 23bf7d5c250b net: fec: fix pinctrl default state restore order on resume 76244b33640b net: lan743x: permit VLAN-tagged packets up to configured MTU 04e22fefac1a net: garp: fix unsigned integer underflow in garp_pdu_parse_attr 66a46e22396f hsr: Remove WARN_ONCE() in hsr_addr_is_self(). 07f13816be5a net: Annotate sk->sk_write_space() for UDP SOCKMAP. 83810d51d699 pcnet32: stop holding device spin lock during napi_complete_done 9b40c59bab08 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap e3f6ba5f8cf3 drm/imx: Fix three kernel-doc warnings in dcss-scaler.c 927f96861f93 devlink: Release nested relation on devlink free e251d4cdfc72 l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() c32f30ef5e66 6lowpan: fix off-by-one in multicast context address compression b60e9391142e net/sched: act_api: use RCU with deferred freeing for action lifecycle 42ff6774ecd9 dm cache policy smq: check allocation under invalidate lock b18675263db1 netfilter: bridge: make ebt_snat ARP rewrite writable f071b0bf0781 netfilter: nft_ct: bail out on template ct in get eval 9e5da2379f96 netfilter: conntrack_irc: fix possible out-of-bounds read aaf80701dc2f netfilter: synproxy: add mutex to guard hook reference counting 25918720ba97 ipvs: clear the svc scheduler ptr early on edit cdaf13260c99 netfilter: xt_NFQUEUE: prefer raw_smp_processor_id e735dbd489e3 ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers 9dca67624721 wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares 00bf6868df65 erofs: fix use-after-free on sbi->sync_decompress 50fd261b1ec4 erofs: tidy up synchronous decompression 8db2fabb5ecd tee: qcomtee: add missing va_end in early return qcomtee_object_user_init() ac7eca1ae4e5 tee: fix tee_ioctl_object_invoke_arg padding 633db9a1991a soc: qcom: ice: Return -ENODEV if the ICE platform device is not found 40fc6ed12f91 ARM: dts: microchip: sam9x7: fix GMAC clock configuration 9cb93ec617fb arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins a171bc68e9af soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE d5b57bb314d7 tee: optee: prevent use-after-free when the client exits before the supplicant dcd90f42a33e net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS 4203806f700b ipv6: mcast: Fix use-after-free when processing MLD queries ffbcf31f032e i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl 97706097f9b8 KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation 9e767af5f109 ARM: fix branch predictor hardening 05e22564a4f9 ARM: fix hash_name() fault 8bdb574b2176 ARM: allow __do_kernel_fault() to report execution of memory faults 22e26df355af ARM: group is_permission_fault() with is_translation_fault() 87dfb977bdb6 bpf: Free reuseport cBPF prog after RCU grace period. Signed-off-by: Bruce Ashfield Signed-off-by: Richard Purdie (cherry picked from commit 358c27b4e0011285b4e329c90d2c4c3b1f581537) Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.18.bb | 6 ++--- .../linux/linux-yocto-tiny_6.18.bb | 6 ++--- meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++---------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb index 00c0b090df0..c4c68844ce9 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb @@ -15,13 +15,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "35a623d1a755631bbc73e11fa02eee0e1092188b" -SRCREV_meta ?= "4dafe0e420087b6381728e68eeeff6d9af0a32e7" +SRCREV_machine ?= "f477695299adc9d29b883d1642a6672e4899a83f" +SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.18.35" +LINUX_VERSION ?= "6.18.36" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb index e2fd09a403e..d8eb5724c8f 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb @@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc include recipes-kernel/linux/cve-exclusion.inc include recipes-kernel/linux/cve-exclusion_6.18.inc -LINUX_VERSION ?= "6.18.35" +LINUX_VERSION ?= "6.18.36" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d" -SRCREV_meta ?= "4dafe0e420087b6381728e68eeeff6d9af0a32e7" +SRCREV_machine ?= "f1d01f240ab00120824a557c26509996d02ac37c" +SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb index 2b1298dedf9..148b440fd4d 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb @@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base" KBRANCH:qemuloongarch64 ?= "v6.18/standard/base" KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta" -SRCREV_machine:qemuarm ?= "84b49a9fef57bf4ff3a2919591fde336fe7944bf" -SRCREV_machine:qemuarm64 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d" -SRCREV_machine:qemuloongarch64 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d" +SRCREV_machine:qemuarm ?= "15e3830e8c3a3c15924ce4e6f65430e6e9800512" +SRCREV_machine:qemuarm64 ?= "f1d01f240ab00120824a557c26509996d02ac37c" +SRCREV_machine:qemuloongarch64 ?= "f1d01f240ab00120824a557c26509996d02ac37c" SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e" -SRCREV_machine:qemuppc ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d" -SRCREV_machine:qemuriscv64 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d" -SRCREV_machine:qemuriscv32 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d" -SRCREV_machine:qemux86 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d" -SRCREV_machine:qemux86-64 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d" +SRCREV_machine:qemuppc ?= "f1d01f240ab00120824a557c26509996d02ac37c" +SRCREV_machine:qemuriscv64 ?= "f1d01f240ab00120824a557c26509996d02ac37c" +SRCREV_machine:qemuriscv32 ?= "f1d01f240ab00120824a557c26509996d02ac37c" +SRCREV_machine:qemux86 ?= "f1d01f240ab00120824a557c26509996d02ac37c" +SRCREV_machine:qemux86-64 ?= "f1d01f240ab00120824a557c26509996d02ac37c" SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4" -SRCREV_machine ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d" -SRCREV_meta ?= "4dafe0e420087b6381728e68eeeff6d9af0a32e7" +SRCREV_machine ?= "f1d01f240ab00120824a557c26509996d02ac37c" +SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "acb7cf4c1184e27622be0faf89244d5001ed1e87" +SRCREV_machine:class-devupstream ?= "275d294b2b24abcd65452198551cd8a5b8d4f775" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.18/base" @@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.18.35" +LINUX_VERSION ?= "6.18.36" PV = "${LINUX_VERSION}+git" From patchwork Mon Jul 27 22:55:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93633 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 80E85C54F53 for ; Mon, 27 Jul 2026 22:56:42 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43765.1785193001473293013 for ; Mon, 27 Jul 2026 15:56:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=qkt5JHUO; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4954d383e64so19884125e9.1 for ; Mon, 27 Jul 2026 15:56:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785193000; x=1785797800; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=TSvTa4vboQbN3tuF0qNvZiUBI6V+xic74aQexPs6rPc=; b=qkt5JHUOA6sF7Pxx9qFvbu5lO1XNUJZ4wkY/wSXep+b+lhaIFS4vtf2h9VNFzKsywO 9oO72qcSWHoLIUWKiDRB73ZKYZKkdzCUPyWp/oeix3f+DQMhkKLczo3RvDvE5rr1Ni9O z+L2Lxng9eKrKKGfyS9jRrNwEC9HIMpJ84uig= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785193000; x=1785797800; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=TSvTa4vboQbN3tuF0qNvZiUBI6V+xic74aQexPs6rPc=; b=ar0aZdigQMlJmgGOmb5p7aFQDpxG2su1dOKEianSBXVoAvRp0hckfaYv6TBuRQrzgD 597bNyeVGOPJHnEavDIG81T7EswwTbWa3Vax0I0hf/jpRddQ6mfG/b1aAy662KHw+jKf JkC57wkWmpc+P9w6CLu7639aheQHGPrBQ96a3kv4UEkPNQFcF0tGG1advi1V67iFVwZg 8zBcXT9EC1FZq+1jTHPTBcyultjyfe7U0PMUUBBfXu1RDJB7E2EDNLzQx7+JMjMpSNir dtS7gofagber9vNklY1PbP4hQRkNj+WI5XW/x53ZO6I/ZA2/oei9vgGsGgS6t59vmT/M NfQQ== X-Gm-Message-State: AOJu0Yxu4gs8o7lpwK3wGtpcByRhpIuRA3IsPsIbaEeaj1Ijzn+wAncd myjPet15MpkK3zBhI/sT0E89DGUfSRRJR/vOcaI4EXcVieNgrFHeEPIVs8AZmGmtNSweG9V7EIn S/wYuX6E= X-Gm-Gg: AR+sD12C04EvuvLwQJtEFS7jypccWwC76k+acvGGAN74I+Y7xYb1d63CU0SjWI89XRJ WGu+kzYgW6xkXNAdYdJVnn0Tl9It5pkX54XhoT1q3OBrrAfR/Fa5Tg5WC8rp1G+OmqQEMs02vEF HBFAE7l94+wn7zWzvMw2McZp9fjxzkAfPDewTHc/ldKpdcQe6eA6/YxHerbi269qH4tcWugcF0a 9oaVptlhdjouZ2W3Zg/UkBww5N00o+LpzcbPJP4BIQLf+QOQ5K/WofR6bFkjDRb4QdvQaCUWJHy Fggt3iwxXcCIGTHpzUKtdHGmXtanpnr2FaUyt696zgD1QcyOuATFxCvCBIJqkIfLGO8bUs5HnoP pNBRfDHZHU9pqapE433ZhDu0ovLWiBFRlHd9a1ZNe4Mmn/++C61kK94iLCm4TfDRnRR6Qy7nf36 7M9B62TrV5xMUBqjF8y9IEHe/IGS/egVeRhyN+aq5Vf8VpCZQeSJ4wdbHAfm/U//s5JDmkBFqhd tI7/w== X-Received: by 2002:a05:600c:1d0d:b0:495:727f:40d2 with SMTP id 5b1f17b1804b1-496b571354amr133975185e9.38.1785192999511; Mon, 27 Jul 2026 15:56:39 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:38 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 27/36] linux-yocto/6.18: update to v6.18.38 Date: Tue, 28 Jul 2026 00:55:41 +0200 Message-ID: <6c9273c7f73969fee78055d784a5e9139d6d8243.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242144 From: Bruce Ashfield Updating linux-yocto/6.18 to the latest korg -stable release that comprises the following commits: e46dc0adfe397 Linux 6.18.38 92c63a5ef3c7a apparmor: advertise the tcp fast open fix is applied e77fbefd1269b net/tcp-ao: fix use-after-free of key in del_async path 3d205fe80f218 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails 7627ff8c4f991 ksmbd: fix out-of-bounds read in smb_check_perm_dacl() 62c26720121bf NFS: Prevent resource leak in nfs_alloc_server() 6919eb549e8f3 NFSv4: clear exception state on successful mkdir retry 012d37a568bfb NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr d8c90c7cc0612 NFSv4/flexfiles: reject zero filehandle version count 4367afc119c51 nfsd: reset write verifier on deferred writeback errors 017a6150106b0 nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race 0f28337f54cfb nfsd: check get_user() return when reading princhashlen dba7da4835de7 nfsd: fix inverted cp_ttl check in async copy reaper 136b416593f13 nfsd: fix posix_acl leak on SETACL decode failure c8a24effd96d4 NFSD: Fix SECINFO_NO_NAME decode error cleanup 6a946038f2a5a i2c: core: fix adapter registration race fc6aa9bdbae60 fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode 4d418cf8daf57 fbdev: modedb: fix a possible UAF in fb_find_mode() eea16b6f805c0 fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var 7643e5622994f riscv: kfence: Call mark_new_valid_map() for kfence_unprotect() 3b33dbb43e21a riscv: mm: Extract helper mark_new_valid_map() 2205275be9be9 power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() 720949ed666f3 KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path e36095d8d922b KVM: x86: hyper-v: Bound the bank index when querying sparse banks f9b57a0015c24 MIPS: smp: report dying CPU to RCU in stop_this_cpu() 6dbe9443d9f5f 9p: avoid putting oldfid in p9_client_walk() error path 4cd57ebee3950 ocfs2: reject oversized group bitmap descriptors 104d100212396 rpmsg: char: Fix use-after-free on probe error path 369496d885b4c fpga: region: fix use-after-free in child_regions_with_firmware() b3a3831b2eb88 irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove 200e7637f4d6a pNFS: Fix use-after-free in pnfs_update_layout() 90e254f18b8c2 LoongArch: Report dying CPU to RCU in stop_this_cpu() e18769616fd5a tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done 5e5b7f2ef8549 blk-cgroup: fix UAF in __blkcg_rstat_flush() 5a84398101bf9 hdlc_ppp: sync per-proto timers before freeing hdlc state e91df6d273445 pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() b85ef03f726b1 gfs2: fix use-after-free in gfs2_qd_dealloc 8d8507a457667 crypto: nx - fix nx_crypto_ctx_exit argument 5da9b1a87ec7c KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() 18587f9831612 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level adfacfbaeae2c exfat: fix potential use-after-free in exfat_find_dir_entry() 6e61fc2e06e44 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS 65bd0c0afb0e1 bpf: use kvfree() for replaced sysctl write buffer 3804e6de30ae7 block: Avoid mounting the bdev pseudo-filesystem in userspace db2c5b9fb9087 f2fs: keep atomic write retry from zeroing original data 20190e4980579 f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() ff83de56882cb f2fs: validate ACL entry sizes in f2fs_acl_from_disk() 888d94cc9afbf f2fs: fix to round down start offset of fallocate for pin file 77f216ff9ce5c f2fs: validate compress cache inode only when enabled 8aad54746c251 f2fs: validate orphan inode entry count 1e48fefac682c f2fs: pass correct iostat type for single node writes 1de92789ce31e wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers b0b07e04f0c72 wifi: iwlwifi: mld: fix race condition in PTP removal df626f284cb90 wifi: iwlwifi: mvm: fix race condition in PTP removal 200d58c851b8f wifi: rtw88: usb: fix memory leaks on USB write failures 73d427d271f7a wifi: rtw88: increase TX report timeout to fix race condition 0aeb4d3ff6ced wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor 40aa3c2b0cb8e wifi: ath11k: fix warning when unbinding a7cdc384c9c57 wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer 7e25b5e22c1f4 wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S ec1c9e8962555 userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing 7216ce8cb12fe keys: Pin request_key_auth payload in instantiate paths b11c1fa326676 KEYS: fix overflow in keyctl_pkey_params_get_2() 49d893b9cbcfc gcov: use atomic counter updates to fix concurrent access crashes 2b7ec72786094 err.h: use __always_inline on all error pointer helpers 1fcca1260c6e7 KVM: arm64: Omit tag sync on stage-2 mappings of the zero page 97e1044e79c5d block: invalidate cached plug timestamp after task switch 99e6c712cc300 kernel/fork: clear PF_BLOCK_TS in copy_process() 0d35f9f194a85 fbdev: fix use-after-free in store_modes() 81371dbd23601 NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR c3ca2631073b2 apparmor: fix use-after-free in rawdata dedup loop 4a69b83045d31 apparmor: mediate the implicit connect of TCP fast open sendmsg 1697957eb0971 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink 1acdd14c0990d net: skmsg: preserve sg.copy across SG transforms bd968bdd568be mac802154: llsec: add skb_cow_data() before in-place crypto 0cfa78c050662 af_unix: Set gc_in_progress to true in unix_gc(). 3c499851753a2 wifi: mt76: add wcid publish check in mt76_sta_add 5e658b9245a52 ntfs3: reject direct userspace writes to reserved $LX* xattrs 77798d7be6ef7 ipv4: account for fraggap on the paged allocation path 6374fb9edf72c ipv6: account for fraggap on the paged allocation path 565ab66005b14 batman-adv: tvlv: avoid race of cifsnotfound handler state 4cc9f7711bb89 batman-adv: tvlv: enforce 2-byte alignment 04e1a6557fbf8 batman-adv: dat: prevent false sharing between VLANs 3f82fc92cf523 batman-adv: tt: track roam count per VID 3470d583fc652 batman-adv: tt: don't merge change entries with different VIDs af5a069805f67 batman-adv: tp_meter: handle overlapping packets d511c72a83dd5 batman-adv: tp_meter: prevent parallel modifications of last_recv 1dafdd0794be1 batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE 2233787658db8 batman-adv: tp_meter: restrict number of unacked list entries 3d4548c96d6f2 batman-adv: v: prevent OGM aggregation on disabled hardif 44ae137a2acef batman-adv: frag: avoid underflow of TTL 116e94025f0f4 batman-adv: frag: ensure fragment is writable before modifying TTL 0473ae882624a batman-adv: fix (m|b)cast csum after decrementing TTL 49bf27fcd7ee4 batman-adv: ensure bcast is writable before modifying TTL 646b68639c06b batman-adv: gw: don't deselect gateway with active hardif 95a061f587b76 batman-adv: tp_meter: initialize last_recv_time during init 75612c100a9e2 batman-adv: prevent ELP transmission interval underflow 43733e5b525fb batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE 23d085bd63086 batman-adv: tp_meter: add only finished tp_vars to lists b8bf8400e50cb batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection 1db02f3e315da batman-adv: tp_meter: fix fast recovery precondition 7d2a44bc6bbe3 batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd 8e77fe0414f5c batman-adv: tp_meter: avoid window underflow 7cb88d91d5f9f batman-adv: tp_meter: initialize dec_cwnd explicitly 696c4cae872cc batman-adv: tp_meter: initialize dup_acks explicitly 1c5a1268418e8 batman-adv: tp_meter: keep unacked list in ascending ordered e055e74b80eb8 lockd: fix TEST handling when not all permissions are available. 671ec2eabb874 Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support" d844702198395 selinux: fix overlayfs mmap() and mprotect() access checks 5dfcb15974e7d lsm: add backing_file LSM hooks 5e470998a23e4 KVM: x86: Fix shadow paging use-after-free due to unexpected role 0c503cf3dde2e Linux 6.18.37 71003a32bef54 mm: do not copy page tables unnecessarily for VM_UFFD_WP 2abfd3ffbd945 virtiofs: fix UAF on submount umount f965cf22dda7f media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si 7cad3ceaf679c ksmbd: reject non-VALID session in compound request branch 6c25bf4e44a2b drivers/base/memory: set mem->altmap after successful device registration 50b72074c5e8d serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero 7cc3dd79777f6 vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write b8ebf008696de crypto: qat - remove unused character device and IOCTLs d08d82d83ed45 iio: adc: ti-ads1298: add bounds check to pga_settings index 0a89002737ee3 iio: light: veml6075: add bounds check to veml6075_it_ms index 76db054931846 net: net_failover: Fix the deadlock in slave register c5b3871b567c2 net: export netif_open for self_test usage cc1494fd6c65d testing/selftests/mm: add soft-dirty merge self-test f563ce913a831 mm: propagate VM_SOFTDIRTY on merge b836839c1fd94 mm: set the VM_MAYBE_GUARD flag on guard region install 3d6cb2ed06f7f mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one 05cdec24a8589 mm: implement sticky VMA flags a093c80a1f139 mm: update vma_modify_flags() to handle residual flags, document bdeadba743375 mm: add atomic VMA flags and set VM_MAYBE_GUARD as such efce8a486bffc mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps 0de7db2eb27e8 sctp: disable BH before calling udp_tunnel_xmit_skb() eee6be6ab6375 firmware: samsung: acpm: Fix cross-thread RX length corruption 02ac3ba41628a Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs 072bbd2846d1b hv: utils: handle and propagate errors in kvp_register bde74af8d4466 regulator: core: fix locking in regulator_resolve_supply() error path 9477cbc5107a8 rose: don't free fd-owned sockets when reaping in the heartbeat 395b6573b389f rose: clear neighbour pointer in rose_kill_by_device() 9e8fc2195f8b5 rose: cancel neighbour timers in rose_neigh_put() before freeing c31a0fa15a4b4 rose: drop CALL_REQUEST in loopback timer when device is not running 74cbe94c913a4 rose: release netdev ref and destroy orphaned incoming sockets c794d35f73a7b rose: fix netdev double-hold in rose_make_new() ce27bcdd857a9 rose: disconnect orphaned STATE_2 sockets when device is gone ab849a6972c99 rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup c98cc00c2d3b1 rose: fix notifier unregistered too early in rose_exit() 19139026dc1c0 rose: fix netdev double-hold in rose_rx_call_request() 1d94857c11d60 rose: guard rose_neigh_put() against NULL in timer expiry 270ef709257eb rose: clear neighbour pointer after rose_neigh_put() in state machines 940f39e153323 rose: fix race between loopback timer and module removal fe8cbcc3e79d4 rose: hold loopback neighbour reference across timer callback 7dac298524b41 rose: fix dev_put() leak in rose_loopback_timer() 19b3691ec9402 ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() 53483a9f4ee9e agp/amd64: Fix broken error propagation in agp_amd64_probe() 8b17adf6d4fb6 net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() 5f4d2bd028ebb i2c: stub: Reject I2C block transfers with invalid length e2b143df29003 RDMA/bnxt_re: zero shared page before exposing to userspace 44b8b03a9fb5c debugobjects: Dont call fill_pool() in early boot hardirq context 3a408cae608d9 debugobjects: Do not fill_pool() if pi_blocked_on 9cd2087cd7026 debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP a460935022f51 debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING 95f9eb19d5e65 Revert "NFSD: Defer sub-object cleanup in export put callbacks" af2892249d982 fuse: re-lock request before replacing page cache folio 29706ac73f93b net: stmmac: fix stm32 (and potentially others) resume regression b6099150949f8 io_uring/net: Avoid msghdr on op_connect/op_bind async data Signed-off-by: Bruce Ashfield Signed-off-by: Richard Purdie (cherry picked from commit dd5c480785a427fff97907646fb298f5002336ed) Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.18.bb | 6 ++--- .../linux/linux-yocto-tiny_6.18.bb | 6 ++--- meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++---------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb index c4c68844ce9..23c43c0cc19 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb @@ -15,13 +15,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "f477695299adc9d29b883d1642a6672e4899a83f" -SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438" +SRCREV_machine ?= "0d0c54addf4ff32e49c485061bd9ea5bde241d94" +SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.18.36" +LINUX_VERSION ?= "6.18.38" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb index d8eb5724c8f..e186b5f9926 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb @@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc include recipes-kernel/linux/cve-exclusion.inc include recipes-kernel/linux/cve-exclusion_6.18.inc -LINUX_VERSION ?= "6.18.36" +LINUX_VERSION ?= "6.18.38" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "f1d01f240ab00120824a557c26509996d02ac37c" -SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438" +SRCREV_machine ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" +SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb index 148b440fd4d..5c849202ada 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb @@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base" KBRANCH:qemuloongarch64 ?= "v6.18/standard/base" KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta" -SRCREV_machine:qemuarm ?= "15e3830e8c3a3c15924ce4e6f65430e6e9800512" -SRCREV_machine:qemuarm64 ?= "f1d01f240ab00120824a557c26509996d02ac37c" -SRCREV_machine:qemuloongarch64 ?= "f1d01f240ab00120824a557c26509996d02ac37c" +SRCREV_machine:qemuarm ?= "053c98bdd6c074a24771d69d24ff077f6016b299" +SRCREV_machine:qemuarm64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" +SRCREV_machine:qemuloongarch64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e" -SRCREV_machine:qemuppc ?= "f1d01f240ab00120824a557c26509996d02ac37c" -SRCREV_machine:qemuriscv64 ?= "f1d01f240ab00120824a557c26509996d02ac37c" -SRCREV_machine:qemuriscv32 ?= "f1d01f240ab00120824a557c26509996d02ac37c" -SRCREV_machine:qemux86 ?= "f1d01f240ab00120824a557c26509996d02ac37c" -SRCREV_machine:qemux86-64 ?= "f1d01f240ab00120824a557c26509996d02ac37c" +SRCREV_machine:qemuppc ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" +SRCREV_machine:qemuriscv64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" +SRCREV_machine:qemuriscv32 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" +SRCREV_machine:qemux86 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" +SRCREV_machine:qemux86-64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4" -SRCREV_machine ?= "f1d01f240ab00120824a557c26509996d02ac37c" -SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438" +SRCREV_machine ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" +SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "275d294b2b24abcd65452198551cd8a5b8d4f775" +SRCREV_machine:class-devupstream ?= "e46dc0adfe39724bcf52cea47b8f9c9aed86a394" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.18/base" @@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.18.36" +LINUX_VERSION ?= "6.18.38" PV = "${LINUX_VERSION}+git" From patchwork Mon Jul 27 22:55:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93639 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D48B9C54F4E for ; Mon, 27 Jul 2026 22:56:52 +0000 (UTC) Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43766.1785193003455854405 for ; Mon, 27 Jul 2026 15:56:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Q3JOIFGv; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4954f5e8020so15637415e9.2 for ; Mon, 27 Jul 2026 15:56:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785193002; x=1785797802; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Fe8u2f8tDl6WGn8TPLKQ78WqVMT9PNU3j/ydFjfFPsw=; b=Q3JOIFGvPhJR0yXgGeLj3Epo/1Rtx0seNHul43qvAd5b79/TAG4HUpXq61SsYx2Pot mT0yOtSVUKBRq8SaXRA28tnZlVS/yXWc6k1+9TIaDU+Y1ScgGo5WjuEDtST8gSRzLY+J LfolfzpcrgMp+UqRF19878MIW0GjVTqmaUmJY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785193002; x=1785797802; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Fe8u2f8tDl6WGn8TPLKQ78WqVMT9PNU3j/ydFjfFPsw=; b=D65XxAD/YHRJWmWfgE7IxKlLah+IE0RuJl8vqSopCp761PxJQI51cFuODjgMzJFzGK sfZA65bE1jZSTq9LskLbd0x8TsRzIfV/+uU6w5it4h/mMwDla7SlNwCUkX0ckGWXaNon RUwblrneRxBW8m0vD6yUtIooIdzOYSdLBATXuSR3YgHb7Tjkuq+cLgpYhX9km/RpAf0u N1Lp4rCUqmhc8Jh4mlajNVrWSlc4lIaxVIfmfiNq9Yb4tvy0kwpoRwXSnvW/ZWP9Mowt e+AtMrziFD8tT7cas/rHV4l5zla3rYMVGKR36JZzLoCzRuD4UHjs8mXqxSMR168UuKN6 m+pg== X-Gm-Message-State: AOJu0Yyyd6TlYTAhLCbr/xnPZWf7DSUBYhb2dkXKbnwsZ/7uOWfdIo15 fcZ/q7c6LElFJPIbuqL2IQ3SwetW7Esy76Qdb5IdGQ8bOdLFMUifnz4b4czv0Xm6SAG5bc1r/RW rps71GFs= X-Gm-Gg: AR+sD12Ki++vJjLfJ6JsUk+urQ6UgLWCoCiMuoZbw5fCGfaf/VF0ePJNEQkgM9LwiNq xYJub7MqTOqlxKwYAjT8uncAsRK5xrGQr3EESdk2IN0ZWuebKnP7oZztMY+pKK3+plFEQHExC6j RzVjrRXXyLZAo079KyTJQ8X5TeGGLTUl5qVucaMYGAYrMPzkBsSymP8sDANDoNKuaQKpM6MDR2P 8qqwdNGYD/zkok7zzqAbjqkSMqbScRsC6V4vKYoDgUkQPxvhH4kdJrVTCCy+GGWejRINyJ79Yf8 i8Ym+Wpr8Bu8S1X5mhrdmq6pbF9k39km2KE9ApEr6A2jyPRWQqs6RhVaQnJgmEaezMQ0QS6Le0y ORTIL3TGIuIZTBPXBNcdz/WewgiDAD2qIqUYGz7RvYqehggLrClnVI16jm+J/RNd7zOQJSuVSlu yKSmB+YKKtn2ZYO1k4wCCW+DBJPl1VRHUGf89qSMF9NT13rCSPNzbLb4HT/C5LXx3KqyTAxXI4+ 68xfw== X-Received: by 2002:a05:600c:253:b0:493:df5d:6ca6 with SMTP id 5b1f17b1804b1-496b571c5fdmr103974605e9.25.1785193001134; Mon, 27 Jul 2026 15:56:41 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.39 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:39 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 28/36] linux-yocto/6.18: update to v6.18.39 Date: Tue, 28 Jul 2026 00:55:42 +0200 Message-ID: <1fda5a399877a47203f245bd6309eec7ef16ded1.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242145 From: Bruce Ashfield Updating linux-yocto/6.18 to the latest korg -stable release that comprises the following commits: f89c296854b75 Linux 6.18.39 06b1729436efc xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging 457a93a233bd7 xfs: write the rg superblock when fixing it e696ef088f557 xfs: fix off-by-one error when calling xchk_xref_has_rt_owner 6403ef9a81e6c xfs: don't zap bmbt forks if they are MAXLEVELS tall 1ea0868a477b7 xfs: fully check the parent handle when it points to the rootdir c9662ffd62c4e xfs: clamp timestamp nanoseconds correctly 424be21ed8cd4 xfs: handle non-inode owners for rtrmap record checking d399b026a6b34 xfs: set xfarray killable sort correctly 08b191ae64659 xfs: use the rt version of the cow staging checker 104584477883b xfs: grab rtrmap btree when checking rgsuper d1c4c40599c37 xfs: don't wrap around quota ids in dqiterate 206c09b04dc54 xfs: resample the data fork mapping after cycling ILOCK d98f22d2e11e0 xfs: fail recovery on a committed log item with no regions dca861f2cc9e6 xfs: fix null pointer dereference in tracepoint fdafa1e68dc75 smb: client: reject overlapping data areas in SMB2 responses 1991d49433e90 Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" 1c56c46519353 Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev e697df336662b timekeeping: Register default clocksource before taking tk_core.lock 9e04055ab5fc0 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks 75e1d2787005d sched/fair: Only update stats for allowed CPUs when looking for dst group 0b466cf1b96e1 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref e1711479e9068 fuse-uring: make a fuse_req on SQE commit only findable after memcpy 39c8e925b207a fuse-uring: Avoid queue->stopped races and set/read that value under lock 23a356e0bd96c fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues bb476ef8e1027 fuse-uring: end fuse_req on io-uring cancel task work 50f3e03db823c fuse-uring: fix moving cancelled entry to ent_in_userspace list b156bb9966972 fuse-uring: fix data races on ring->ready 0483fffdeeb36 fuse-uring: fix EFAULT clobber in fuse_uring_commit 7366e6f4d2b4c fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req 096cb2e58a6db fuse: fix io-uring background queue dispatch on request completion be353caffa864 fuse: re-lock request before returning from fuse_ref_folio() e6620208bdd34 fuse: fix device node leak in cuse_process_init_reply() 6e2d84fdeac05 fuse: avoid 32-bit prune notification count wrap 69cfae58b9a32 fuse: back uncached readdir buffers with pages 423a78ff7928c RDMA/siw: bound Read Response placement to the RREAD length ab45808c141a3 RDMA/core: Fix broadcast address falsely detected as local 5a45d0aa1fa50 RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg 95de76f6ad474 Input: maplecontrol - set driver data before registering input device 9376c744bea2c Input: maplemouse - set driver data before registering input device 699e3abac02de Input: maple_keyb - set driver data before registering input device d7f66fbab5d21 Input: mms114 - fix multi-touch slot corruption 1b4cb75f254fb Input: maplemouse - fix NULL pointer dereference in open() 37fbe63bccf21 Input: gscps2 - advance receive buffer write index 8301c33530534 Input: mms114 - reject an oversized device packet size 3e6f007b43e2f Input: touchwin - reset the packet index on every complete packet 05dee4007cf30 Input: ads7846 - don't use scratch for tx_buf when clearing register 75b12874b4172 Input: mms114 - fix touch indexing for MMS134S and MMS136 70019779325f2 Input: iforce - bound the device-reported force-feedback effect index 3b32303460155 Input: goodix - clamp the device-reported contact count 01e0317c256c5 Input: elan_i2c - prevent division by zero and arithmetic underflow e849c6f51e687 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count 8db211aed8373 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count 11f275f01c46b Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure bb5133a7d5f3f i2c: i801: fix hardware state machine corruption in error path b2523f26979e0 i2c: imx-lpi2c: mark I2C adapter when hardware is powered down 369635fbcf7f3 i2c: stm32f7: truncate clock period instead of rounding it b65667ec5e9a9 i2c: davinci: Unregister cpufreq notifier on probe failure 56945871123e2 i2c: mpc: Fix timeout calculations b6d2af6fe9c1f i2c: core: fix adapter deregistration race 71b7da959031f i2c: core: fix adapter debugfs creation 0345994d64761 i2c: core: fix adapter probe deferral loop 3351c5e77749a i2c: core: fix NULL-deref on adapter registration failure 9ec02cc9a04e5 i2c: core: fix irq domain leak on adapter registration failure 59070040fd12e fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() 34696563461c9 dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning f8e1dc70efe48 udmabuf: fix DMA direction mismatch in release_udmabuf() 0c93681aea0a1 KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier 4ad73ef0e7966 KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits ab253cf6e1118 KVM: VMX: Handle bad values on proxied writes to LBR MSRs eeb456eb35565 KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs 35f3ea7e49a37 KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated 7949aa38e1094 KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports 4b200e0c9c339 KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs 6bea2f8becdb2 KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU 2d710d4fcd2cd LoongArch: KVM: Add missing slots_lock for device register/unregister 7c73a269a880b KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB b51a7439c166a selftests/landlock: Filter dealloc records in audit_count_records() 859fef2c3d40a landlock: Set audit_net.sk for socket access checks e4427c19554b5 audit: fix removal of dangling executable rules 32ca4aed2a662 iommufd: Set upper bounds on cache invalidation entry_num and entry_len 67daea4c09351 iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() 5539da127d03c iommufd: Break the loop on failure in iommufd_fault_fops_read() f2dbe1dba01e6 iommufd: Reject invalid read count in iommufd_fault_fops_read() f549a749b6255 iommufd: Reject invalid read count in iommufd_veventq_fops_read() 64011399d8819 iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails f565297edf316 iommufd: Set veventq_depth upper bound 5c5f1b5184f7d iommufd: Fix data_len byte-count vs element-count mismatch 04a177f91160e iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read 50612ce318b1c iommu/amd: Don't split flush for amd_iommu_domain_flush_all() bb354384f40bb iommu/vt-d: Avoid WARNING in sva unbind path 037ec8353711c crypto: loongson - Remove broken and unused loongson-rng 6bbe2000d9f9f selftests/mm: pagemap_ioctl: use the correct page size for transact_test() 5c942ad7df759 mm: do file ownership checks with the proper mount idmap 8dcaa0f87a88d mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access 785ebd42b8b50 selftests: mm: fix and speedup "droppable" test 279c2fa731122 mm: fix mmap errno value when MAP_DROPPABLE is not supported 4d730cab96e6b riscv: mm: Unconditionally sfence.vma for spurious fault 90405c8822c5d riscv: mm: Define DIRECT_MAP_PHYSMEM_END 1c8889e0db01f NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() 33c0b96d7e167 exfat: bound uniname advance in exfat_find_dir_entry() a82e170637e05 module: decompress: check return value of module_extend_max_pages() b883733302508 rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule a937e92c1d005 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC 75ca99875aa4e audit: fix potential integer overflow in audit_log_n_hex() 2dad64a97e1df tracing: Prevent out-of-bounds read in glob matching c8b7e113f7b61 perf/aux: Fix page UAF in map_range() af6048e913052 i2c: core: fix hang on adapter registration failure 22cb337370e65 regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() 6b01ed165d298 watchdog: apple: Add "apple,t8103-wdt" compatible f4dd5621a6eef EDAC/i10nm: Don't fail probing if ADXL is missing add1e4112e00b x86/mm: Fix freeing of PMD-sized vmemmap pages 808033d80d5c9 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path 18d6048b1b1b4 spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() 75422f5e50222 arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() 93f000e89976e crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation fda9cb9b7191c crypto: talitos/hash - remove useless wrapper 99cc3f5511d8b crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request b960edc92c81b crypto: talitos/hash - drop workqueue mechanism for SEC1 042730207a991 crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue 40a2e90acdb1a crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor a8decb89920a1 crypto: talitos - move code in current_desc_hdr() into a standalone function aea8cfbd60da9 crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function 3fa1846f75edf crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function 664e7f16e74fc crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 f52aa95e3cae1 crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header 7584c92f72447 crypto: qat - factor out AER reset helpers 6fb62b767f3e2 crypto: qat - validate RSA CRT component lengths fabf364ef9db5 crypto: qat - skip restart for down devices c3c5925791cff crypto: qat - protect service table iterations with service_lock e310e8dc8ce72 crypto: qat - notify fatal error before AER reset preparation 45b65a21edbe0 crypto: qat - keep VFs enabled during reset 33cfc0ce28ac9 crypto: qat - handle sysfs-triggered reset callbacks 050bded706ee5 crypto: qat - centralize bus master enable 5337b5cd3608a crypto: drbg - Fix the fips_enabled priority boost 53d38b93cadc0 crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels 23b8b188cb32e crypto: drbg - Fix returning success on failure in CTR_DRBG 441ea32cf2755 crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) 92567ed9306d5 crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) 7a361c74bb12f crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) 9e983d0a74a6a crypto: ccp - Do not initialize SNP for SEV ioctls 53b8fb85f332b crypto: loongson - Select CRYPTO_RNG cc4e42b3ee9fc crypto: tegra - fix refcount leak in tegra_se_host1x_submit() c4bd2f4c35b0e crypto: pcrypt - restore callback for non-parallel fallback ee6a2a25665c6 crypto: hisi-trng - Remove crypto_rng interface 774ddddf5eb26 crypto: ecc - Fix carry overflow in vli multiplication ac667f9f18c6b crypto: crypto4xx - Remove insecure and unused rng_alg 0016d3c21c6ab crypto: chacha20poly1305 - validate poly1305 template argument d0b8cafd529b4 crypto: caam - use print_hex_dump_devel to guard key hex dumps again 6f7b8e0321f3a crypto: caam - use print_hex_dump_devel to guard key hex dumps 7465ed1524ace crypto: af_alg - Remove zero-copy support from skcipher and aead b5699642640d6 isofs: bound Rock Ridge symlink components to the SL record ce93228e2193a partitions: aix: bound the pp_count scan to the ppe array 7a64521802997 btrfs: do not trim a device which is not writeable 0912b98151eea btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC 6d7649c1231da nvmet-auth: validate reply message payload bounds against transfer length 56c021a086926 nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page 7a69463e9ad23 nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks 13f2f5defb4d7 dm-ioctl: report an error if a device has no table 427c82497e269 block: partitions: fix of_node refcount leak in of_partition() a8803c4f0ac3f nvme: target: rdma: fix ndev refcount leak on queue connect d161d47aba31d crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A c60932d6f8373 hwrng: jh7110 - fix refcount leak in starfive_trng_read() 04f4599a9efb9 udf: validate sparing table length as an entry count, not a byte count e610fb113cdfa udf: validate VAT header length against the VAT inode size 335202ab25b01 udf: validate free block extents against the partition length d944b8add3318 bpf: Prefer dirty packs for eBPF allocations 0229944ba7923 bpf: Prefer packs that won't trigger an IBPB flush on allocation f1f36bf9bb117 bpf: Skip redundant IBPB in pack allocator 666fc2e6e4d0a bpf: Restrict JIT predictor flush to cBPF 8a4c8af9ae67e x86/bugs: Enable IBPB flush on BPF JIT allocation 8ff183ee4d8c4 bpf: Support for hardening against JIT spraying bd818dcf4783e rust_binder: fix BINDER_GET_EXTENDED_ERROR e5049526a7aac rust_binder: introduce TransactionInfo be1567992417d x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled b7b2d2ccdbc4d mm: shmem: fix potential livelock issue for shmem direct swapin 9818bcae3c0ca block: skip sync_blockdev() on surprise removal in bdev_mark_dead() e086c16962a1b usb: gadget: f_fs: Fix DMA fence leak b45be66ed47d4 usb: typec: ucsi: cancel pending work on system suspend f5c772b76bbd9 usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove b1dfdff51a865 usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode 8c00aec752ce1 usb: typec: ucsi: Invert DisplayPort role assignment 3e1b1ac47e816 usb: typec: tcpm: Validate SVID index in svdm_consume_modes() 0bc177820bd38 usb: typec: tcpm: Fix VDM type for Enter Mode commands bf6aa6c0ce0db usb: typec: class: drop PD lookup reference 1126f1110b86c usb: typec: anx7411: use devm_pm_runtime_enable() 347b59e9f9671 usbip: vudc: fix NULL deref in vep_dequeue() 6c7e8e2514374 usbip: tools: support SuperSpeedPlus devices 2d84c8376f7aa USB: usb-storage: ene_ub6250: restore media-ready check 1967a7f0cd5c0 USB: ulpi: fix memory leak on registration failure 1243f12079004 USB: serial: digi_acceleport: fix write buffer corruption 2b7dc482f859f USB: serial: digi_acceleport: fix hard lockup on disconnect eab394781e932 USB: serial: digi_acceleport: fix broken rx after throttle 4b147eb6ae6e0 USB: serial: option: add Telit Cinterion FE990D50 compositions cf6ca0aefae03 USB: serial: keyspan_pda: fix information leak 8c29d9cfab1c3 usb: mtu3: unmap request DMA on queue failure 729b68a5bad71 USB: misc: uss720: unregister parport on probe failure 48394f94211cf usb: misc: usbio: bound bulk IN response length to the received transfer 964d572b6c009 USB: storage: include US_FL_NO_SAME in quirks mask e0886775952e3 usb: sl811-hcd: disable controller wakeup on remove 766738ecf2b81 USB: legousbtower: fix use-after-free on disconnect race 6af28345cbf8b USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD b748f97aff339 USB: iowarrior: fix use-after-free on disconnect 2107a4fc8ff1c USB: ldusb: fix use-after-free on disconnect race 54c2b7356b4ae USB: idmouse: fix use-after-free on disconnect race 8a5eba992c862 usb: gadget: f_printer: take kref only for successful open b52476a83d9e1 usb: gadget: udc: Fix use-after-free in gadget_match_driver 01feaf024f296 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler 6bc17a78a0567 usb: free iso schedules on failed submit 0bbab8882a319 usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() 4b0779207e36d USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub c00826e87bb75 usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() e22f044b0b20d usb: cdc_acm: Add quirk for Uniden BC125AT scanner e24eb271061db net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() cd407de2ef5dc bpf: Validate BTF repeated field counts before expansion d94ab0e91d3ff bpf: Restore sysctl new-value from 1 to 0 a9bb2d9c798cb bpf: Reject fragmented frames in devmap c3d3d2212c296 xfs: fix memory leak in xfs_dqinode_metadir_create() a62ef2d13d6e7 xfs: fix exchmaps reservation limit check 55e4d8413fb54 xfs: fix pointer arithmetic error on 32-bit systems dd8d0665cdabf xfs: fix unreachable BIGTIME check in dquot flush validation 936618643591c xfs: release dquot buffer after dqflush failure 200794d0354cd xfs: use null daddr for unset first bad log block 1cd54e217c6e2 serial: 8250_mid: Disable DMA for selected platforms 973408ceab145 media: mtk-jpeg: cancel workqueue on release for supported platforms only 223463c488b05 nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers f3461b84a4865 hfs/hfsplus: zero-initialize buffer in hfs_bnode_read c63bc6308da71 HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads 4d0d51bc12d24 HID: lg-g15: cancel pending work on remove to fix a use-after-free b363d964ca829 HID: appleir: fix UAF on pending key_up_timer in remove() 37daa8c96bd56 HID: multitouch: fix out-of-bounds bit access on mt_io_flags 3eca1a8165b5e HID: letsketch: fix UAF on inrange_timer at driver unbind bbe1e55629bfa HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() ca899a926c11a HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert cb90a01e478c2 HID: pidff: Use correct effect type in effect update 416095e9a6037 HID: wacom: stop hardware after post-start probe failures 7ce2c7dd28ab8 HID: uhid: convert to hid_safe_input_report() dae1d000ddfd5 HID: hid-goodix-spi: validate report size to prevent stack buffer overflow abf07f5c3584f tools/mm/slabinfo: fix total_objects attribute name e0eec7497bcc7 tools/mm/slabinfo: Fix trace disable logic inversion 2382971aaaef5 mm/slab: do not limit zeroing to orig_size when only red zoning is enabled 18d90dc05d98b X.509: Fix validation of ASN.1 certificate header 28390912740a2 perf/arm-cmn: Fix DVM node events be79d285bea70 s390: Revert support for DCACHE_WORD_ACCESS 2421a7b24f9c8 clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances cd25e9819620a time/jiffies: Register jiffies clocksource before usage 7776f9226e99e posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path 6ba6f6783be2f cpufreq: pcc: fix use-after-free and double free in _OSC evaluation 6e175c00c62dc cpufreq: Fix hotplug-suspend race during reboot 4bd0da48fbc1d sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT f77e55baeeb8c cpufreq: intel_pstate: Sync policy->cur during CPU offline 59626d0d29217 perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() b9d45d328fcda libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo() 92f41769e5fd1 firmware_loader: fix device reference leak in firmware_upload_register() e904961332801 cpufreq: qcom-cpufreq-hw: Fix possible double free a277489337c7d OPP: of: Fix potential memory leak in opp_parse_supplies() 685fc15a41088 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() c6c484a7d5bff smb: client: mask server-provided mode to 07777 in modefromsid 157c67a657a7d smb: client: fix atime clamp check in read completion 86c5d470f5d42 smb: client: harden POSIX SID length parsing 3d89ae65ef78a smb: client: use unaligned reads in parse_posix_ctxt() 297243e365fc9 smb: client: Fix next buffer leak in receive_encrypted_standard() d15d83125007f smb: client: fix double-free in SMB2_close() replay 14498ff5ce0f2 smb: client: fix double-free in SMB2_open() replay 3407240cde132 smb: client: fix double-free in SMB2_flush() replay 52af1975f0dfa smb: client: fix change notify replay double-free 276c8efbc49f9 smb: client: fix double-free in SMB2_ioctl() replay f1add4acb656f smb: client: fix query_info() replay double-free 00b0fa4259414 smb: client: fix query directory replay double-free 2b4592cea2146 ksmbd: use opener credentials for ADS I/O e72c15085b6d8 ksmbd: use opener credentials for delete-on-close df501c0f320b5 ksmbd: add per-handle permission check to FILE_LINK_INFORMATION 2ca82bfff49c8 ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION 20ee516a62989 ksmbd: run set info with opener credentials f56535db508ea ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY db231af842868 ksmbd: require source read access for duplicate extents 5aa1cb01155f9 ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation a1d5d31cad593 ksmbd: serialize QUERY_DIRECTORY requests per file 57f2042fd87d7 ksmbd: add a permission check for FSCTL_SET_ZERO_DATA baae7b39673ec ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE a187883cc1dc7 smb/client: Fix error code in smb2_aead_req_alloc() 91b8a58c6ac15 smb: client: resolve SWN tcon from live registrations 661a019ac0413 coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() 08fad5d5a26cc fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() 6dd58c56ab864 fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() 764e6f76fdbd4 fs/ntfs3: fsync files by syncing parent inodes 38cbb1feebcf5 fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr 4718007870547 iommu/vt-d: Fix race condition during PASID entry replacement 73abbaf91aa33 Bluetooth: L2CAP: validate option length before reading conf opt value d5616beb3355b Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock b84eeb7636d69 Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() b9dd39cf1667e Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled 61701912c58a0 Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() 26168db1ce5a9 Bluetooth: fix UAF in bt_accept_dequeue() 2a68a77308920 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() a6b22dbd80926 Bluetooth: bnep: pin L2CAP connection during netdev registration 0039bdde36b23 Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() 81a5971cbe18b netfilter: flowtable: fix offloaded ct timeout never being extended 6fe8d3cecd20b netfilter: ebtables: terminate table name before find_table_lock() 13a5f532e3a4f netfilter: ebtables: module names must be null-terminated 9f74d28e903fa netfilter: ebtables: zero chainstack array fc5bfe63bacf8 netfilter: handle unreadable frags a8f03a3793289 netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump 69c0e6246575b mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup b415c00bf23df mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host 006467ab93269 mm: shrinker: fix NULL pointer dereference in debugfs 6465ff3ce6513 mm: shrinker: fix shrinker_info teardown race with expansion 560e21e8ccff8 mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() b5f41d5bf08e7 mfd: cros_ec: Delay dev_set_drvdata() until probe success bbae351c0f32f net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes 2ca18df1c2611 ipv4: igmp: remove multicast group from hash table on device destruction a33f37f8d079d netpoll: fix a use-after-free on shutdown path f090acf881a26 io_uring/rw: preserve partial result for iopoll 1636d85dc139b io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item 722869fcff598 io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE 4508366ab7dd0 gpio: sch: use raw_spinlock_t in the irq startup path 4750909a40da9 gpio: eic-sprd: use raw_spinlock_t in the irq startup path f71e8d9875069 NTB: epf: Avoid calling pci_irq_vector() from hardirq context cf28fc1658463 fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns c00164c9e7fa6 debugobjects: Plug race against a concurrent OOM disable cbb684ef39e9f coresight: etb10: restore atomic_t for shared reading state b346efa825b5e Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete d3b739db5dc6f Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref fe997a84a385f audit: Fix data races of skb_queue_len() readers on audit_queue e8417353cbd07 net: af_key: initialize alg_key_len for IPComp states 94083db751930 ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL ef6feb77e2d91 crypto: krb5 - filter out async aead implementations at alloc 84a00be9b736a crypto: amlogic - avoid double cleanup in meson_crypto_probe() 6f91621fc4502 staging: rtl8723bs: fix OOB write in HT_caps_handler() a6105ea8ca6eb staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop c38d16b1ffac3 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() 69f174a0673b6 staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop 04f612dc03427 staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop 64ec4192d9c10 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() b9c4bf133c3c4 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() b5ddc7257bee7 staging: media: ipu7: fix double-free and use-after-free in error paths 1ca4f310c6b1f staging: media: atomisp: reduce load_primary_binaries() stack usage b4ba13dafa13c media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe e3ceafa6d8ee6 staging: vme_user: fix location monitor leak in tsi148 bridge a921486313975 staging: vme_user: fix location monitor leak in fake bridge ceb875a375ded smb: client: restrict implied bcc[0] exemption to responses without data area e99f2df433c63 staging: vme_user: bound slave read/write to the kern_buf size 2de42e2681747 tipc: fix out-of-bounds read in broadcast Gap ACK blocks 0beccbcf50de1 6lowpan: fix NHC entry use-after-free on error path c40090f8d19b4 usb: misc: usbio: fix disconnect UAF in client teardown c4e232bd07fe2 usb: dwc3: run gadget disconnect from sleepable suspend context 2a52d55c86a42 USB: chaoskey: Fix slab-use-after-free in chaoskey_release() 285e17c44e387 hwrng: virtio: clamp device-reported used.len at copy_data() 65e93ec592f5b virtio-mmio: fix device release warning on module unload 075bc3c779e1e virtio_pci: fix vq info pointer lookup via wrong index 81d54c766337b netfilter: ipset: fix race between dump and ip_set_list resize 9c8f31eaae614 mm/damon/ops-common: handle extreme intervals in damon_hot_score() 657646c08c94e tcp: restore RCU grace period in tcp_ao_destroy_sock b775246212504 PCI/IOV: Skip VF Resizable BAR restore on read error 1115680bca1d7 PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts 6e6a529d6f779 PCI: mediatek: Fix IRQ domain leak when port fails to enable 69416a5308675 PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling 1d2e66a4bc0dd PCI: host-common: Request bus reassignment when not probe-only 9c698af5c2a12 PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining 09c43b7b7d29c PCI: altera: Fix resource leaks on probe failure 5e42a981887d2 PCI: altera: Do not dispose parent IRQ mapping d666c5aec822d PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series e5406c8fb71cd usb: typec: tcpci_rt1711h: unregister TCPCI port with devres 99d00a9e35e31 xhci: sideband: fix ring sg table pages leak f90586129cf9e usb: xhci: Fix sleep in atomic context in xhci_free_streams() 91b27f8172cdb rust_binder: clear freeze listener on node removal 281335996ab21 rust_binder: synchronize Rust Binder stats with freeze commands 08e21d86d2722 rust_binder: reject context manager self-transaction 89b8cc948dce6 rust_binder: use a u64 stride when cleaning up the offsets array 328ccf32acb87 binder: fix UAF in binder_free_transaction() ea02df466df60 binder: fix UAF in binder_thread_release() 17a2d3f903455 Bluetooth: btusb: fix wakeup source leak on probe failure a7e941a395711 Bluetooth: btusb: fix use-after-free on marvell probe failure 8db0ce3de7836 Bluetooth: btusb: fix use-after-free on registration failure 79f9e221dddec Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB a53109ffb6b51 vfio: Remove device debugfs before releasing devres 7f2d6b31089e4 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc ba96666d991e6 vfio/pci: Fix racy bitfields and tighten struct layout 52adb2dff7ce3 vfio/pci: Release the VGA arbiter client on register_device() failure f6c67cf0051f9 vfio/pci: Latch disable_idle_d3 per device a385d3435a7af vfio/pci: Use a private flag to prevent power state change with VFs afc90150551dd ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes 54c448e4f26a7 ALSA: usb-audio: Update Babyface Pro control caches only after successful writes f3e8a6cca15b8 ALSA: usb-audio: Roll back quirk control caches on write errors 3061b6c114458 ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks bfd28b07541e5 ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() a263eb12cbe2e ALSA: usb-audio: avoid kobject path lookup in DualSense match 16f14f55141d4 ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission 651ba82fe2a14 ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() 71b87108ad93d ALSA: ice1712: check snd_ctl_new1() return value 04dd210180575 ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW 1933e6ee136b1 ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson 4dd2552e559bd ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini ce0a903d0591e ALSA: hda/cs35l41: Fix firmware load work teardown 5e74e5e8cb7cc ALSA: gus: check snd_ctl_new1() return value 8e48a29813df8 ALSA: firewire: isight: bound the sample count to the packet payload db25755e7629d ALSA: FCP: Add Focusrite ISA C8X support 9e53e99b6fa3c ALSA: es1938: check snd_ctl_new1() return value b27a75d42044d ALSA: compress: Fix task creation error unwind af2b009b773bc ALSA: cmipci: check snd_ctl_new1() return value a5fd3122283bf ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser fd786466889e4 ALSA: aoa: check snd_ctl_new1() return value f6538a318947b ALSA: ymfpci: check snd_ctl_new1() return value 5da9742de22db ALSA: virtio: Validate control metadata from the device df0fe53a7104b ALSA: virtio: Add missing 384 kHz PCM rate mapping c071df05bcda0 ALSA: usx2y: us144mkii: fix work UAF on disconnect a4f8491da9563 iio: temperature: tmp006: use devm_iio_trigger_register 62a0d75bedd4b iio: temperature: ltc2983: Fix reinit_completion() called after conversion start e16258913be6a iio: temperature: ltc2983: Fix n_wires default bypassing rotation check b50344ab202f3 iio: temperature: Build mlx90635 with CONFIG_MLX90635 7d4d60f7c0541 iio: resolver: ad2s1210: notify trigger and clear state on fault read error c6ca87c7bbb3f iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths b3f1af4ba8e9c iio: pressure: mpl115: fix runtime PM leak on read error e2d5b9673bf71 iio: pressure: bmp280: zero-init bmp580 trigger handler buffer f829d6c32f31b iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call 0975e013179d3 iio: light: veml6030: fix channel type when pushing events ef6c2a521454f iio: light: tsl2591: return actual error from probe IRQ failure 9d421c2827ea1 iio: light: opt3001: fix missing state reset on timeout 0c655d067ac69 iio: light: gp2ap002: fix runtime PM leak on read error a60bf629a760d iio: light: al3320a: read both ALS ADC registers again a1dafc918d793 iio: light: al3320a: add missing REGMAP_I2C to Kconfig a00d471cf3580 iio: light: al3010: read both ALS ADC registers again cd278561640c7 iio: light: al3010: fix incorrect scale for the highest gain range 9fb4ff07d97e3 iio: light: al3010: add missing REGMAP_I2C to Kconfig 6afb69bb969ed iio: light: al3000a: add missing REGMAP_I2C to Kconfig 482b24660ec3b iio: imu: st_lsm6dsx: deselect shub page before reading whoami 76e12a71ac053 iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading 34656a59322e5 iio: imu: inv_icm42600: fix timestamp clock period by using lower value 0522819228284 iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ bdafd53ae671e iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ 001527e2382e3 iio: gyro: bmg160: wait full startup time after mode change at probe 7bbf02b63961f iio: gyro: bmg160: bail out when bandwidth/filter is not in table 9edefd4c56bee iio: event: Fix event FIFO reset race 2358da87315d1 iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source() e166a8cfb28a3 iio: core: fix uninitialized data in debugfs b947bde73461f iio: common: st_sensors: honour channel endianness in read_axis_data 82accdd574043 iio: chemical: scd30: Cleanup initializations and fix sign-extension bug c28835b8618ec iio: backend: fix uninitialized data in debugfs 0f30e68dd6c1f iio: adc: ti-ads124s08: Return reset GPIO lookup errors ffb2195921c3d iio: adc: ti-ads1119: fix PM reference leak in buffer preenable bbfebae473ac2 iio: adc: spear: Initialize completion before requesting IRQ 9e2e8b8cdfd37 iio: adc: lpc32xx: Initialize completion before requesting IRQ c313bb7c38855 iio: adc: ad_sigma_delta: fix CS held asserted and state leaks 3394e0b332842 iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices 46e93fcbe7c2c iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig 24a9514b606e7 iio: adc: ad7768-1: Select GPIOLIB e6ade81631d76 iio: adc: ad7380: select REGMAP 6293211d14260 iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error 3e766526827ac iio: accel: bmc150: clamp the device-reported FIFO frame count 7515a6d4a9e9e usb: gadget: function: rndis: add length check for header e01e7814b4223 usb: gadget: function: rndis: add length check to response query 9d1dc507b99ce fscrypt: Replace mk_users keyring with simple list 85f8b440a09ba fscrypt: Fix key setup in edge case with multiple data unit sizes 20133754d46fe rust: kasan: KASAN+RUST requires clang a2d5d3ee7b6e3 perf/core: Detach event groups during remove_on_exec 94396fd93226a futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" 1cc8f512cd905 rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER 70fe1ac8647b0 rust: doctest: fix incorrect pattern in replacement e7636f26f7707 rust: block: fix GenDisk cleanup paths c1dd0b1071004 rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0 30d5d4eef35a9 LoongArch: Add PIO for early access before ACPI PCI root register 86df6499dfd23 platform/x86: intel-hid: Protect ACPI notify handler against recursion 452945662fd8e ACPI: NFIT: core: Fix possible NULL pointer dereference f29dc6132d496 ACPI: CPPC: Suppress UBSAN warning caused by field misuse ff9c4c6428883 KVM: x86: Unconditionally recompute CR8 intercept on PPR update 3dcfb04dd43b1 KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode 0d0187a46b16e KVM: x86: Move update_cr8_intercept() to lapic.c 9baa2833e6bc8 perf trace beauty fcntl: Fix build with older kernel headers 47e4c6e06e78e slab: recognize @GFP parameter as optional in kernel-doc 1776f29327a13 default_gfp(): avoid using the "newfangled" __VA_OPT__ trick 50c26b461b8e7 add default_gfp() helper macro and use it in the new *alloc_obj() helpers 2dca62902eb35 slab: Introduce kmalloc_flex() and family 1c2672781b1b3 mm/khugepaged: write all dirty file folios when collapsing 2539f67b75461 nfsd: change nfs4_client_to_reclaim() to allocate data 05e48af3bf58d nfsd: move name lookup out of nfsd4_list_rec_dir() c4b70c1512b8f net/sched: dualpi2: fix GSO backlog accounting 076b1aa65f77a fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() 406c28af75123 f2fs: fix to do sanity check on f2fs_get_node_folio_ra() 3f42fbd3c891d f2fs: detect more inconsistent cases in sanity_check_node_footer() ed87e57558dc5 f2fs: optimize trace_f2fs_write_checkpoint with enums 8dbc4c5686820 f2fs: introduce f2fs_schedule_timeout() 599d7d82eeecc f2fs: use memalloc_retry_wait() as much as possible ec9f79c8d5b28 f2fs: fix listxattr handling of corrupted xattr entries 89479a27fa4e1 f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() 998536c96b6ad f2fs: fix potential deadlock in f2fs_balance_fs() 4ce2d52f680c1 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes a499f77c06050 f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode 5a4d3968cf820 f2fs: remove non-uptodate folio from the page cache in move_data_block 9c86a1f930bb2 device property: initialize the remaining fields of fwnode_handle in fwnode_init() 60d696a037eee userfaultfd: gate must_wait writability check on pte_present() 3436a7dd067c5 rust: str: clean unused import for Rust >= 1.98 3603500c868a1 rust: str: use the "kernel vertical" imports style 8dee7c278f1c2 nfsd: release layout stid on setlease failure 6f88ca186a984 nfsd: update mtime/ctime on COPY in presence of delegated attributes 7c702bb4f8d83 nfsd: update mtime/ctime on CLONE in presense of delegated attributes 501543207378f bpf, arm64: Reject out-of-range B.cond targets Signed-off-by: Bruce Ashfield Signed-off-by: Richard Purdie (cherry picked from commit d98dedd769718f70bac1c6b963eeba5a58d1c769) Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.18.bb | 6 ++--- .../linux/linux-yocto-tiny_6.18.bb | 6 ++--- meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++---------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb index 23c43c0cc19..6d287cdc7d5 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb @@ -15,13 +15,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "0d0c54addf4ff32e49c485061bd9ea5bde241d94" -SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b" +SRCREV_machine ?= "0156acd2db993abc3baa366fee892d503aab1ccc" +SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.18.38" +LINUX_VERSION ?= "6.18.39" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb index e186b5f9926..8b9201a73e3 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb @@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc include recipes-kernel/linux/cve-exclusion.inc include recipes-kernel/linux/cve-exclusion_6.18.inc -LINUX_VERSION ?= "6.18.38" +LINUX_VERSION ?= "6.18.39" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" -SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b" +SRCREV_machine ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" +SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb index 5c849202ada..8528869a5ed 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb @@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base" KBRANCH:qemuloongarch64 ?= "v6.18/standard/base" KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta" -SRCREV_machine:qemuarm ?= "053c98bdd6c074a24771d69d24ff077f6016b299" -SRCREV_machine:qemuarm64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" -SRCREV_machine:qemuloongarch64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" +SRCREV_machine:qemuarm ?= "162946cfb65f28f0a5f60e927bdae5615e6356a8" +SRCREV_machine:qemuarm64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" +SRCREV_machine:qemuloongarch64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e" -SRCREV_machine:qemuppc ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" -SRCREV_machine:qemuriscv64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" -SRCREV_machine:qemuriscv32 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" -SRCREV_machine:qemux86 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" -SRCREV_machine:qemux86-64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" +SRCREV_machine:qemuppc ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" +SRCREV_machine:qemuriscv64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" +SRCREV_machine:qemuriscv32 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" +SRCREV_machine:qemux86 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" +SRCREV_machine:qemux86-64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4" -SRCREV_machine ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636" -SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b" +SRCREV_machine ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" +SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "e46dc0adfe39724bcf52cea47b8f9c9aed86a394" +SRCREV_machine:class-devupstream ?= "f89c296854b755a66657065c35b05406fc18264d" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.18/base" @@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.18.38" +LINUX_VERSION ?= "6.18.39" PV = "${LINUX_VERSION}+git" From patchwork Mon Jul 27 22:55:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93637 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB2BDC54F4D for ; Mon, 27 Jul 2026 22:56:52 +0000 (UTC) Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43817.1785193004407629708 for ; Mon, 27 Jul 2026 15:56:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=i3MyJq9F; spf=pass (domain: smile.fr, ip: 209.85.128.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-493f75f7172so27171385e9.1 for ; Mon, 27 Jul 2026 15:56:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785193003; x=1785797803; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=u1afVMIvEaNVALGHOcx4gFGRscQ2BEVVE06ihxp+vqk=; b=i3MyJq9F0RldqCfrCHhXKV8NCPlK4pxGDQyZqaArRS4qQjxZD/i/s09nIhgfWbYJLQ mtnQGrW+VjsZyy3wmd3nnn9ReM6Qnm1Tzj2lBftsbnGiXmtcFnb9RInpt3YHr1ar/TKi 5ZeMieKSg9E8fHeGCy8ShhE4b40I6tO4VJreo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785193003; x=1785797803; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=u1afVMIvEaNVALGHOcx4gFGRscQ2BEVVE06ihxp+vqk=; b=jAMtwg3gDDJyRzmGiTflOhXOySYKUFYHnRtGMlLQYztf1BJ186bupELnY8MuKgvksi 7NF/4OGidzvhJl68qtLVgRsOU/m5MGOWzQkKd3wM0m3Sf0pPUHc0LuQi4lbPPJG0BY7A KCR7H1komaXC5x08Zb59d0RTPYjZ9N+UCL3CwWJuGZ05/WQOyRDk9rfeU4g9v5fJEaTz 6+kq9P2Y8XYbXM3brQ8X/OmUHAkNZk/uUGfqDcur/l8qxawQm3LyBVtAUTxJTULfGhtz L77YG79X31w8C6HbpiWNmLaBaa04Pacmn+Eq8HM5iVXLfVlU7jsHoyqC2Vh3KluOG+3+ 4Tkw== X-Gm-Message-State: AOJu0Yypun7R5w/+X28A59ltO7m5VEN3vPv2yzjptZLz/7LrSFXEMqU/ O4N0Ubc73qIqWTO/7oX+BT0urPbbdlwZQ8yf1nS/W6dOiO9Hzd4c/j9UNNj+eXXXkO74kzyRmr1 +1J1ft3k= X-Gm-Gg: AR+sD12WX4QMbofakqJ/YyLv+SrXM+hYrHUr2IH2PHP19gFYVdcZHbagMAY8DZFnZaE VtNuDk6dE5Mo+uqi21V7sp586dc/9YyARDCYdvhoRGwHG3uBN1OwgA1XbeYOrDz3vZI4RK+PVlT NBesIl3kog797+H+Y3zKXwJpdbfgDCYzXjOGcg5bOvq5tVzd8BIZOV16GlEmBWSVaxbAsI17NQJ 1fzBzjWUSy09j1xMxnj4OKKdcrZMWUZL2GjfbCKZI5unVZse1rqfsKhsQEzD5+dNoXxGd1LY8PK 9oMmLa6aLuFr/c8NBBgL+EorvzhXNVDOgP2PvzCHlvkBI+4U4KwqZcmZyDUHcvD1KwKlAlqYA57 mmOPl01r3eHiE1QRhrxG1XIh01q8R/bl8GY7TezztjJfrOq/kGllSQyc02QY2yX2ER0W0LbWTNt 1k5JhCwBIGFjsPsavGzaLVlIAi5x1APp4CPFRt9DQxyqRLZoTzEsA9Ut7tx1MTJeI/DAT8JnBdp Tl7bQ== X-Received: by 2002:a05:600c:4595:b0:495:3a21:4e5d with SMTP id 5b1f17b1804b1-496b56f461dmr126968375e9.0.1785193002580; Mon, 27 Jul 2026 15:56:42 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.41 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:41 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 29/36] linux-yocto/6.18: drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker Date: Tue, 28 Jul 2026 00:55:43 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242146 From: Bruce Ashfield To partially (or fully) address: https://bugzilla.yoctoproject.org/show_bug.cgi?id=16217 Integrating the following commit(s) to linux-yocto/6.18: 1/1 [ Author: Ryosuke Yasuoka Email: ryasuoka@redhat.com Subject: drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker Date: Mon, 13 Jul 2026 22:01:00 +0900 A probe-time deadlock can occur between the dequeue worker and drm_client_register(). During probe, drm_client_register() holds clientlist_mutex and calls the fbdev hotplug callback, which triggers an atomic commit that ends up sleeping in virtio_gpu_queue_ctrl_sgs() waiting for virtqueue space. The dequeue worker that would free that space calls virtio_gpu_cmd_get_display_info_cb(), which invokes drm_kms_helper_hotplug_event() -> drm_client_dev_hotplug(), attempting to acquire the same clientlist_mutex. Since wake_up() is only called after the resp_cb loop, the probe thread is never woken and both threads deadlock. Fix this by removing the hotplug notification from virtio_gpu_cmd_get_display_info_cb(). The display data (outputs[i].info) is still updated synchronously in the callback. For the init path, drm_client_register() already fires an initial hotplug when the client is registered, which picks up the connector state updated by display_info_cb. For the runtime config_changed path, add a wait_event_timeout() in config_changed_work_func() so that display_info_cb updates the connector data before the hotplug notification is sent. Also replace drm_helper_hpd_irq_event() with drm_kms_helper_hotplug_event() since virtio-gpu never calls drm_kms_helper_poll_init() and thus drm_helper_hpd_irq_event() always returns false without doing anything. Fixes: 27655b9bb9f0 ("drm/client: Send hotplug event after registering a client") Closes: https://syzkaller.appspot.com/bug?id=d6dd6f86d3aaf7eebe7406e45c1c6e549453f224 Closes: https://syzkaller.appspot.com/bug?id=908bd910da5dd79b88de4cf7baf376cc873a922e Suggested-by: Dmitry Osipenko Signed-off-by: Ryosuke Yasuoka Signed-off-by: Dmitry Osipenko Link: https://patch.msgid.link/20260713-virtiogpu_syzbot-v2-1-2958fa37d46d@redhat.com Signed-off-by: Bruce Ashfield ] Signed-off-by: Bruce Ashfield Signed-off-by: Richard Purdie (cherry picked from commit 496ab6151ead169d9f4873d1e2a3f5e646c73b07) Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.18.bb | 2 +- .../linux/linux-yocto-tiny_6.18.bb | 2 +- meta/recipes-kernel/linux/linux-yocto_6.18.bb | 18 +++++++++--------- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb index 6d287cdc7d5..9d44c803eb9 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb @@ -15,7 +15,7 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "0156acd2db993abc3baa366fee892d503aab1ccc" +SRCREV_machine ?= "56572c42354027a50e261f16fe13b057604873e7" SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb index 8b9201a73e3..7ff47505aa0 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb @@ -18,7 +18,7 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" +SRCREV_machine ?= "9eb7db1359675f27707b030ba228f381c10cd53e" SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb index 8528869a5ed..6111ae89daa 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb @@ -17,17 +17,17 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base" KBRANCH:qemuloongarch64 ?= "v6.18/standard/base" KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta" -SRCREV_machine:qemuarm ?= "162946cfb65f28f0a5f60e927bdae5615e6356a8" -SRCREV_machine:qemuarm64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" -SRCREV_machine:qemuloongarch64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" +SRCREV_machine:qemuarm ?= "78e0248ce3cecd33f63926cd1d54c64e163d076c" +SRCREV_machine:qemuarm64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e" +SRCREV_machine:qemuloongarch64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e" SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e" -SRCREV_machine:qemuppc ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" -SRCREV_machine:qemuriscv64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" -SRCREV_machine:qemuriscv32 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" -SRCREV_machine:qemux86 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" -SRCREV_machine:qemux86-64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" +SRCREV_machine:qemuppc ?= "9eb7db1359675f27707b030ba228f381c10cd53e" +SRCREV_machine:qemuriscv64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e" +SRCREV_machine:qemuriscv32 ?= "9eb7db1359675f27707b030ba228f381c10cd53e" +SRCREV_machine:qemux86 ?= "9eb7db1359675f27707b030ba228f381c10cd53e" +SRCREV_machine:qemux86-64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e" SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4" -SRCREV_machine ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e" +SRCREV_machine ?= "9eb7db1359675f27707b030ba228f381c10cd53e" SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll From patchwork Mon Jul 27 22:55:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93636 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AECEFC5321C for ; Mon, 27 Jul 2026 22:56:52 +0000 (UTC) Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43818.1785193005773887882 for ; Mon, 27 Jul 2026 15:56:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=ygNipWrX; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-495590dde14so35718035e9.0 for ; Mon, 27 Jul 2026 15:56:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785193004; x=1785797804; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=58Tld4c479Yk1LoDc11qq19Ph/wtx6C/vTq24Vx5ehI=; b=ygNipWrXoH7H0Ew8ENS5cPv1pBLzZC9fFkuqUfbAOEeDeNgjh3TAJmXU+Mn+2t94pQ 4ZPiJhYYRgzmDWo/Mk5Gw9J45zUia78uhpzdgJJoCcDRDp8+AjR+bkayj67j+jRfXyED SUE328ylu+qoZPI/Nq7D/EOH58icKXJsEHMyg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785193004; x=1785797804; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=58Tld4c479Yk1LoDc11qq19Ph/wtx6C/vTq24Vx5ehI=; b=S+XavOQk/GbIz9cDMWkonjlN7g/5EAt/2szrdanq4owPDsXJn8n5lYZtxOvLJgM2Jb JsECA6V9eGBaZdfuH3jrNe7+AE0RYJjLycdOm5HCG/kYv7xTm8yK1EjJDtC+a3X3T4lM mIrJkBl+jqWVPwaNCu5AIgphiHai89NtqgRw2pmelmqD6u+mQKDF94sBoVo4SS3NItI2 z1nYMg1ZvgGG5aBAAzZjOZQ/I06H/Cr+AXyE26BplUJYDchIYS1/DFfwm3CTlG0e2w8x VVxosNB6wQURuovybH3TyVFHc+M9HmNwhwdvi1qVOz9OGVHIIk+5Hiou41xbjfA8piJ2 sJhg== X-Gm-Message-State: AOJu0YwqKru+QSW8UNo+uBsT/PCfwJhezWTwI62r89ENS7jYf0+GeA67 uu3cPq7uTKEO6+HpLSPaC03VXTFwnivnq1uz6ih8V/NMh2ubHP7JmW4hi9O8VhhOpN0yfoUuFl/ 33afoB+I= X-Gm-Gg: AR+sD12/Hpua7RXJ5/8AElNi1j3PmakrbIenXogozOsXILl6sKZrOqVBi3MdnWrqMK2 grDaO8bTIJT9RCy8Q31J6iUjGXf9DBT78hQUv/6UF5we4x6wmDnHUppg3i/xwWCC2AGNqrXp/pR qbIiCJkjuYD8tYcq/r/bq27GIisCqo0cU6rHwAUX0BA2WfP7K/7dmAhhCvQ0YtbpXDpsKT8XPsm kPVZ1/TqRuw+5PmItlnIWZlJDGN7wZwW857jwTiFpFJyFgiBIfeJHWf4UoIGoqSb3Phc+63cBaE mtdjC+B62jiQsASWwtvu0c/g+9EZSfncwlNIgKMGsjpup3xB9kTXVwdOMqXOlPCWTbC6YJp+5aC HnULwdaIUqQYNzqCChF/tuLmCVNLLXp2HCWXpn3cQb+dhq39dEe+JjEqEpNt6PV/8PMWbPerYue zzncpeoSYIwdKNMp4X6S7S6cF5f12rG951/lkV/OX4MBYsyfbyn9ufzwybuUqiHhRhgvlwdota3 /f6ew== X-Received: by 2002:a05:600c:3b2a:b0:495:4d5c:903e with SMTP id 5b1f17b1804b1-496c4f7ecabmr8591935e9.7.1785193004037; Mon, 27 Jul 2026 15:56:44 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.42 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:42 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 30/36] xmlto: correct srcrev to point to released version Date: Tue, 28 Jul 2026 00:55:44 +0200 Message-ID: <202cb3b918924583c5f73b5413a9f8ad0d54f38b.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242147 From: Daniel Turull 0.0.29 released has done Jun 11, 2024, 635dcd5bc8 https://codeberg.org/xmlto/xmlto/tags current srcrev was 1 commit ahead https://codeberg.org/xmlto/xmlto/commit/74862a684907ada3d4ed2ce0f8111adf626e1456 Signed-off-by: Daniel Turull Signed-off-by: Richard Purdie (cherry picked from commit 0813c7dc9f379636b9f7adf0fee082187e24b26a) Signed-off-by: Yoann Congal --- meta/recipes-devtools/xmlto/xmlto_0.0.29.bb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meta/recipes-devtools/xmlto/xmlto_0.0.29.bb b/meta/recipes-devtools/xmlto/xmlto_0.0.29.bb index c26cd21dd07..29652bd7d64 100644 --- a/meta/recipes-devtools/xmlto/xmlto_0.0.29.bb +++ b/meta/recipes-devtools/xmlto/xmlto_0.0.29.bb @@ -6,8 +6,8 @@ LICENSE = "GPL-2.0-only" LIC_FILES_CHKSUM = "file://COPYING;md5=59530bdf33659b29e73d4adb9f9f6552" -SRCREV = "74862a684907ada3d4ed2ce0f8111adf626e1456" -SRC_URI = "git://codeberg.org/xmlto/xmlto.git;protocol=https;branch=master" +SRCREV = "635dcd5bc84a7b67a3a2050a179d96e1d3050b15" +SRC_URI = "git://codeberg.org/xmlto/xmlto.git;protocol=https;branch=master;tag=${PV}" inherit autotools From patchwork Mon Jul 27 22:55:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93638 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95598C531D0 for ; Mon, 27 Jul 2026 22:56:52 +0000 (UTC) Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43771.1785193007669706619 for ; Mon, 27 Jul 2026 15:56:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=BrAw+9Un; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-49550ec592cso2473245e9.0 for ; Mon, 27 Jul 2026 15:56:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785193006; x=1785797806; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=5WvF8ID8cSF83mM1b46EuZ/P66IYFTGCrk39pp4ggxU=; b=BrAw+9UnxQXynE0TbL1vs3iRqe9+fUJQjvGM/+H/M021moG2eWBPtRCYyvbUtnkCeG Cc4Zar6yT8wqn9B1yWNCwjikKDteGaNNchNcBBNxczbaXT84KxpMipBsmMWbY5rLaZSY pPRaLt7/PEZLFlsMpvJzA0y/meLID8mrrNSIg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785193006; x=1785797806; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=5WvF8ID8cSF83mM1b46EuZ/P66IYFTGCrk39pp4ggxU=; b=Zf5wWHoWRPFkLuhXKSriS9M5HgYq8gFt0T2TLHawE2W9eFG9dmk0Zgn4yT55+Ny9bI jVX9TLwyC7RlfjCc/R4/+y90bleXlR3GJWPhG+hslmfXCJH6ElboWrxUTrmMIucjRykM tZK8hPnzO6Cww8RWp3ssg4Kjj+92pYRiDz+H/LQ5czLn6SYbkp8SIl+cUxSI6q3kpAyx KgWE+LEbNTKtP5R3p4byZ6q1g8Kmyv27bc99bigxl1YSLmojK00TNoglJ2U8KPn484SR ULYB1QvqypNVtkp/wzBSPW+Gx+tEhpoaS/ulfdpGcvYHjLKwKQfeLyFdjIdOM5+lAuIN 1kiQ== X-Gm-Message-State: AOJu0YwWe60L9ldjmwOopmvI+yhiMDUEBcbYXVhZpblMQGpmi4IsgcOH 3oxXAn4fWjdiHQtGRaWIlB9kEmdkYRnhQ/H/uwIvrVQtmjE+X59EECMwLmqjCN38l5i/GyLdTFS r9mvfB0I= X-Gm-Gg: AR+sD12mcdcVI2WlNUtek0uGwKBvahSby9Fh0bf9FXWnqQVM68g7rqqwKqB/v/sMEMX 8VMBCW8bH4yeGi5aEbT9TzLJ3cJY9JOcnj7yZEfyWLzrEW0infi2t7a8kV0Q2Fy9J/JAmdwSJjM jMluN7UQ1p8a4u675bh6aoYLxazwoi72MCTMkvkNLOKoOOvo8T3qFjS6IbGYWmRmoZpI6r/gqh0 eaVs9fYnSA+lK5u+hdzeT9kGITJlR6OCOt7y1JBoMwb99wXGZ+hRGmRvGS70o4L1JJgLoelZsBd 6ytvxSbZjvGiYallCppWMmBmgCfKdfz1yK2xzMhMfELxTNIXWinn+S1zwKKBc/QcGSywYONc4kx GeyOnoT5acwcjmqbR9IkVZ/YPKRgxgc+mFTNdGLLjxRMCKwQrCqPsdH4j8mVfiQztizmkPlKY5G HzetGW8jc5Epov6xQI4l1/qUoK8LBIWG8L7eGQBLuW0tKPNoYgernI010v1GHXSaVeaM/360ZXl zDmQw== X-Received: by 2002:a05:600c:4654:b0:495:6193:c6c0 with SMTP id 5b1f17b1804b1-496c568ada1mr2657095e9.18.1785193005702; Mon, 27 Jul 2026 15:56:45 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.44 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:44 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 31/36] vim: Security Fix for CVE-2026-42307 Date: Tue, 28 Jul 2026 00:55:45 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242148 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-42307 [2] https://security-tracker.debian.org/tracker/CVE-2026-42307 Signed-off-by: Siddharth Doshi Signed-off-by: Yoann Congal --- .../vim/files/CVE-2026-42307.patch | 177 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 178 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-42307.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-42307.patch b/meta/recipes-support/vim/files/CVE-2026-42307.patch new file mode 100644 index 00000000000..037f6cba273 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-42307.patch @@ -0,0 +1,177 @@ +From 405e2fb6d54d5653523809e2853d99d1c000a5fc Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Tue, 21 Apr 2026 19:03:02 +0000 +Subject: [PATCH] patch 9.2.0383: [security]: runtime(netrw): shell-injection + via sftp: and file: URLs + +Problem: runtime(netrw): shell-injection via sftp: and file: URLs + (Joshua Rogers) +Solution: Escape temporary file names, harden filename suffix regex, + drop unused g:netrw_tmpfile_escape variable + +Supported by AI + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc] +CVE: CVE-2026-42307 +Signed-off-by: Siddharth Doshi +--- + runtime/doc/pi_netrw.txt | 4 --- + runtime/doc/tags | 1 - + .../pack/dist/opt/netrw/autoload/netrw.vim | 16 +++++----- + runtime/pack/dist/opt/netrw/doc/netrw.txt | 4 --- + src/testdir/test_plugin_netrw.vim | 30 +++++++++++++++++++ + src/version.c | 2 ++ + 6 files changed, 41 insertions(+), 16 deletions(-) + +diff --git a/runtime/doc/pi_netrw.txt b/runtime/doc/pi_netrw.txt +index a86cac36ba..2d98a8407b 100644 +--- a/runtime/doc/pi_netrw.txt ++++ b/runtime/doc/pi_netrw.txt +@@ -2854,10 +2854,6 @@ your browsing preferences. (see also: |netrw-settings|) + such as listing, file removal, etc. + default: ssh + +- *g:netrw_tmpfile_escape* =' &;' +- escape() is applied to all temporary files +- to escape these characters. +- + *g:netrw_timefmt* specify format string to vim's strftime(). + The default, "%c", is "the preferred date + and time representation for the current +diff --git a/runtime/doc/tags b/runtime/doc/tags +index 1e0720b21a..023996c0eb 100644 +--- a/runtime/doc/tags ++++ b/runtime/doc/tags +@@ -7966,7 +7966,6 @@ g:netrw_ssh_browse_reject pi_netrw.txt /*g:netrw_ssh_browse_reject* + g:netrw_ssh_cmd pi_netrw.txt /*g:netrw_ssh_cmd* + g:netrw_sshport pi_netrw.txt /*g:netrw_sshport* + g:netrw_timefmt pi_netrw.txt /*g:netrw_timefmt* +-g:netrw_tmpfile_escape pi_netrw.txt /*g:netrw_tmpfile_escape* + g:netrw_uid pi_netrw.txt /*g:netrw_uid* + g:netrw_use_noswf pi_netrw.txt /*g:netrw_use_noswf* + g:netrw_use_nt_rcp pi_netrw.txt /*g:netrw_use_nt_rcp* +diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +index 8e5fdb5397..78ce0cbc3c 100644 +--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim ++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +@@ -398,7 +398,6 @@ else + call s:NetrwInit("g:netrw_glob_escape",'*[]?`{~$\') + endif + call s:NetrwInit("g:netrw_menu_escape",'.&? \') +-call s:NetrwInit("g:netrw_tmpfile_escape",' &;') + call s:NetrwInit("s:netrw_map_escape","<|\n\r\\\\"") + if has("gui_running") && (&enc == 'utf-8' || &enc == 'utf-16' || &enc == 'ucs-4') + let s:treedepthstring= "│ " +@@ -1819,14 +1818,14 @@ function netrw#NetRead(mode,...) + "......................................... + " NetRead: (sftp) NetRead Method #9 {{{3 + elseif b:netrw_method == 9 +- call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_sftp_cmd." ".netrw#os#Escape(g:netrw_machine.":".b:netrw_fname,1)." ".tmpfile) ++ call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_sftp_cmd." ".netrw#os#Escape(g:netrw_machine.":".b:netrw_fname,1)." ".netrw#os#Escape(tmpfile,1)) + let result = s:NetrwGetFile(readcmd, tmpfile, b:netrw_method) + let b:netrw_lastfile = choice + + "......................................... + " NetRead: (file) NetRead Method #10 {{{3 + elseif b:netrw_method == 10 && exists("g:netrw_file_cmd") +- call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_file_cmd." ".netrw#os#Escape(b:netrw_fname,1)." ".tmpfile) ++ call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_file_cmd." ".netrw#os#Escape(b:netrw_fname,1)." ".netrw#os#Escape(tmpfile,1)) + let result = s:NetrwGetFile(readcmd, tmpfile, b:netrw_method) + let b:netrw_lastfile = choice + +@@ -8959,14 +8958,17 @@ function s:GetTempfile(fname) + endif + + " use fname's suffix for the temporary file ++ " Restrict the suffix to word characters so shell metacharacters in a ++ " remote filename (e.g. sftp://host/foo.txt;id) cannot ride along into ++ " the tempfile name and out into a downstream shell command. + if a:fname != "" +- if a:fname =~ '\.[^./]\+$' ++ if a:fname =~ '\.\w\+$' + if a:fname =~ '\.tar\.gz$' || a:fname =~ '\.tar\.bz2$' || a:fname =~ '\.tar\.xz$' +- let suffix = ".tar".substitute(a:fname,'^.*\(\.[^./]\+\)$','\1','e') ++ let suffix = ".tar".substitute(a:fname,'^.*\(\.\w\+\)$','\1','e') + elseif a:fname =~ '.txz$' +- let suffix = ".txz".substitute(a:fname,'^.*\(\.[^./]\+\)$','\1','e') ++ let suffix = ".txz".substitute(a:fname,'^.*\(\.\w\+\)$','\1','e') + else +- let suffix = substitute(a:fname,'^.*\(\.[^./]\+\)$','\1','e') ++ let suffix = substitute(a:fname,'^.*\(\.\w\+\)$','\1','e') + endif + let tmpfile= substitute(tmpfile,'\.tmp$','','e') + let tmpfile .= suffix +diff --git a/runtime/pack/dist/opt/netrw/doc/netrw.txt b/runtime/pack/dist/opt/netrw/doc/netrw.txt +index 01a5bda597..144bab5fb3 100644 +--- a/runtime/pack/dist/opt/netrw/doc/netrw.txt ++++ b/runtime/pack/dist/opt/netrw/doc/netrw.txt +@@ -2854,10 +2854,6 @@ your browsing preferences. (see also: |netrw-settings|) + such as listing, file removal, etc. + default: ssh + +- *g:netrw_tmpfile_escape* =' &;' +- escape() is applied to all temporary files +- to escape these characters. +- + *g:netrw_timefmt* specify format string to vim's strftime(). + The default, "%c", is "the preferred date + and time representation for the current +diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim +index b234670928..6be32911ce 100644 +--- a/src/testdir/test_plugin_netrw.vim ++++ b/src/testdir/test_plugin_netrw.vim +@@ -604,6 +604,36 @@ func Test_netrw_FileUrlEdit_pipe_injection() + call assert_false(filereadable(fname), 'Command injection via pipe in file URL') + endfunc + ++" The remote filename after '.' was allowed to contain shell metacharacters ++" and rode unescaped into the tempfile name passed to sftp/file_cmd, giving a ++" shell injection on :e sftp://host/foo.txt;. ++func Test_netrw_tempfile_suffix_injection() ++ CheckUnix ++ CheckExecutable id ++ let save_sftp = g:netrw_sftp_cmd ++ let save_file = exists('g:netrw_file_cmd') ? g:netrw_file_cmd : v:null ++ let g:netrw_sftp_cmd = 'true' ++ let g:netrw_file_cmd = 'true' ++ let fname = 'Xrce_marker' ++ try ++ call delete(fname) ++ sil! call netrw#NetRead(2, 'sftp://localhost/foo.txt;id>'..fname) ++ call assert_false(filereadable(fname), 'Command injection via sftp:// tempfile suffix') ++ ++ call delete(fname) ++ sil! call netrw#NetRead(2, 'file://localhost/foo.txt;id>'..fname) ++ call assert_false(filereadable(fname), 'Command injection via file:// tempfile suffix') ++ finally ++ call delete(fname) ++ let g:netrw_sftp_cmd = save_sftp ++ if save_file is v:null ++ unlet! g:netrw_file_cmd ++ else ++ let g:netrw_file_cmd = save_file ++ endif ++ endtry ++endfunc ++ + func Test_netrw_RFC2396() + let fname = 'a%20b' + call assert_equal('a b', netrw#RFC2396(fname)) +diff --git a/src/version.c b/src/version.c +index 560233fafc..4508ae3f18 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 383, + /**/ + 340, + /**/ +-- +2.34.1 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index e34cc17fe57..0ad78ab4f08 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -23,6 +23,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-52858.patch \ file://CVE-2026-52859.patch \ file://CVE-2026-52860.patch \ + file://CVE-2026-42307.patch \ " PV .= ".0340" From patchwork Mon Jul 27 22:55:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93634 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88EC4C53219 for ; Mon, 27 Jul 2026 22:56:52 +0000 (UTC) Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43772.1785193009263059819 for ; Mon, 27 Jul 2026 15:56:49 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=1aD33n0x; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-490cf322ed0so22748035e9.1 for ; Mon, 27 Jul 2026 15:56:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785193007; x=1785797807; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=LJDqynC2cQbCjODUICBgQO9nvU1mBlfqq/GWM9XpYvs=; b=1aD33n0xeoJKZGWIgqa4o0vg3Y6zHGnF6ZNDWZFREfIqW7izm3iDWQP0E59DT6f5pz a3rjU4KE0scviYnF7ozZoZbxsWIBk4bzhhUF07udOp+ZkP2hHxykfMVzkki4Eb3tFMn8 x007X2HvtePzET6cUjO56nHO5PkqHty/B2aIo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785193007; x=1785797807; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=LJDqynC2cQbCjODUICBgQO9nvU1mBlfqq/GWM9XpYvs=; b=D0Xhl+ClBSrK0jfhFM4XmVr83M2W6JXEcki1MISUG1Cl3IylVgzh72hlg8LrXFo3Wa UHa0GOZvIH3ezORZ/AT1OKHxy8HPXhDKnclf0A7oeVOPis9kV9C/q/xqQuw/BPo3RSSc cHgZvsArXTN5Cm6UPb8vwBh916pWufWtjC6vuU/DTAC8VK4LU/OLCw5OtFLxXofJDiCY ROXR7VhJ/vOYsDjMXSorYLeOtbvlimh9+vFaXa7N6ptw03tTtGGkgeaqXD01vIq9bw7q nF+IWamCl1yoDSDCwuEmRn0Re4jDhCtNd09+glE181Elcbicl3zA04LddKKx12KNmDjz rRJw== X-Gm-Message-State: AOJu0Yzsi9AeybMV+BA5t5bYMkkkg39JI4Qf6hdN/2mTBjJ+5ukc6aJg 3XV+vXgYEArlpTGH4XbYLIuxOhNKz/TIAG84Pj5n59YcHGwYrFU9hXjqZtNCNpzTs+a4qv/weJk cprx7uVk= X-Gm-Gg: AR+sD12r6znxUfczFXbe169udSJ3nTsM12Q1KKrW8+jV93VZObfsU1jBSRIIsETmiNa VFAYTDnPiLi2qze76h5BFrmAGVJkVynfayClmwjHKGgQMENiZOj4YiSbbqzEZCb+TG88KxoXFyK xHBy4gEAM2oPIQ6AGK4VFkamUPbDOlh0GpXCIz5jxZs3klunSGc8nfLMhME5CsPcniEzaK5saWW D5634oa0gEmAH2oyIqaOEds06/f0jBf8NuPk2L1YrfmQTohkUVqcMy8/HdsKFV7G+v80LH++ov1 SQZsxve6R9XoyNbSC6XyZhDreFZcwYylQzISgdDPcSDKopFy+JnvoDPV9WTNiITsJYTHlznP5t1 hwpTGj3GAOclZsRvbiir/RjKGCbANhfcB4rEsxYixB/k1+3dIyCGI3I78HP1xbq3xdOy40qd+PL K77T4gTiTCpxMnyhrAFutKRq4g+QIneYsjLR0mRw4NN6R4ie1H1+WWZpckk8kxWLyviFFr+Fyox pC0Nw== X-Received: by 2002:a05:600c:1d1b:b0:495:6f6b:fb75 with SMTP id 5b1f17b1804b1-496b57678e5mr147051695e9.38.1785193007516; Mon, 27 Jul 2026 15:56:47 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.45 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:46 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 32/36] vim: Security Fix for CVE-2026-43961 Date: Tue, 28 Jul 2026 00:55:46 +0200 Message-ID: <0e510b075bb664e506c58ba467dd90e21c6e8e47.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242149 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://github.com/vim/vim/commit/8af0f098c3a42a28661d0295364e [2] https://security-tracker.debian.org/tracker/CVE-2026-43961 Signed-off-by: Siddharth Doshi Signed-off-by: Yoann Congal --- .../vim/files/CVE-2026-43961.patch | 104 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 105 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-43961.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-43961.patch b/meta/recipes-support/vim/files/CVE-2026-43961.patch new file mode 100644 index 00000000000..e2633ac04f1 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-43961.patch @@ -0,0 +1,104 @@ +From 8af0f098c3a42a28661d0295364e6e0fd7dbc92c Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Thu, 14 May 2026 16:43:15 +0000 +Subject: [PATCH] patch 9.2.0480: [security]: runtime(netrw): code injection + via mf command + +Problem: [security]: runtime(netrw): code injection via mf command + (Christopher Lusk, Zdenek Dohnal) +Solution: Do not use string concatenation inside the filter() commands + (Zdenek Dohnal) + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3 + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/8af0f098c3a42a28661d0295364e] +CVE: CVE-2026-43961 +Signed-off-by: Siddharth Doshi +--- + runtime/pack/dist/opt/netrw/autoload/netrw.vim | 7 +++---- + src/testdir/test_plugin_netrw.vim | 15 +++++++++++++++ + src/version.c | 2 ++ + 3 files changed, 20 insertions(+), 4 deletions(-) + +diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +index 78ce0cbc3c..3a460e675b 100644 +--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim ++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +@@ -5175,7 +5175,7 @@ function s:NetrwMarkFile(islocal,fname) + + else + " remove filename from buffer's markfilelist +- call filter(s:netrwmarkfilelist_{curbufnr},'v:val != a:fname') ++ call filter(s:netrwmarkfilelist_{curbufnr}, {_, v -> v !=# a:fname}) + if s:netrwmarkfilelist_{curbufnr} == [] + " local markfilelist is empty; remove it entirely + call s:NetrwUnmarkList(curbufnr,curdir) +@@ -5196,7 +5196,6 @@ function s:NetrwMarkFile(islocal,fname) + + else + " initialize new markfilelist +- + let s:netrwmarkfilelist_{curbufnr}= [] + call add(s:netrwmarkfilelist_{curbufnr},substitute(a:fname,'[|@]$','','')) + +@@ -5216,7 +5215,7 @@ function s:NetrwMarkFile(islocal,fname) + call add(s:netrwmarkfilelist,netrw#fs#ComposePath(b:netrw_curdir,a:fname)) + else + " remove new filename from global markfilelist +- call filter(s:netrwmarkfilelist,'v:val != "'.dname.'"') ++ call filter(s:netrwmarkfilelist, {_, v -> v !=# dname}) + if s:netrwmarkfilelist == [] + unlet s:netrwmarkfilelist + endif +@@ -7235,7 +7234,7 @@ function s:NetrwTreeDisplay(dir,depth) + " hide given patterns + let listhide= split(g:netrw_list_hide,',') + for pat in listhide +- call filter(w:netrw_treedict[dir],'v:val !~ "'.escape(pat,'\\').'"') ++ call filter(w:netrw_treedict[dir], {_, v -> v !~# pat}) + endfor + + elseif g:netrw_hide == 2 +diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim +index 6be32911ce..7b34b52562 100644 +--- a/src/testdir/test_plugin_netrw.vim ++++ b/src/testdir/test_plugin_netrw.vim +@@ -639,4 +639,19 @@ func Test_netrw_RFC2396() + call assert_equal('a b', netrw#RFC2396(fname)) + endfunc + ++func Test_netrw_mf_command_injection() ++ CheckUnix ++ CheckExecutable touch ++ let path = tempname() ++ let fname = 'x" . execute("silent! !touch poc") . "' ++ call mkdir(path, 'R') ++ exe "cd " path ++ call writefile([], fname) ++ Explore . ++ call search('^x') ++ :norm mf ++ :norm mf ++ call assert_false(filereadable('poc'), 'Command injection via mf command') ++endfunc ++ + " vim:ts=8 sts=2 sw=2 et +diff --git a/src/version.c b/src/version.c +index 4508ae3f18..64008e0f37 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 480, + /**/ + 383, + /**/ +-- +2.34.1 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 0ad78ab4f08..fd835a3cdbf 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -24,6 +24,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-52859.patch \ file://CVE-2026-52860.patch \ file://CVE-2026-42307.patch \ + file://CVE-2026-43961.patch \ " PV .= ".0340" From patchwork Mon Jul 27 22:55:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93635 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7132EC53209 for ; Mon, 27 Jul 2026 22:56:52 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.43822.1785193010794134214 for ; Mon, 27 Jul 2026 15:56:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=UVbXa9eQ; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4954a2e73a9so17166415e9.3 for ; Mon, 27 Jul 2026 15:56:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785193009; x=1785797809; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=fiEdpvYtOA0lQVCLqH/Df/8Mjqfwh4H7EbeDIqIEtdA=; b=UVbXa9eQOBNIDYvnKE0IS62shpfVFos4SrmoqYuG3oTudtChd/MN51ApNfQWmcUchc Ed/TIuqGOhEk+jFcwZMFoEhcHhhuZhZe8cPruS6xfPFZywWeYsAJtJSWh1IspEXiSK1R EaF8kfyJjlqmO/JsMuSne3LQXs4MJUZLCGJZU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785193009; x=1785797809; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=fiEdpvYtOA0lQVCLqH/Df/8Mjqfwh4H7EbeDIqIEtdA=; b=Cg/yyeaSFtDJJaJF4SQhbZOvp1V6mQN22hn3MZYedonDPk+dMITK+FNoC4v624SbGQ cDfRPoWWfuzBdHZaxSDWsFlh/NFoANOUg6+fYxt/3ZYkwLvrEDxP+2NFq31Q7sxOoZ1s Upql8LL/7JvS1pdGEIjg20Lb8FRpusBUUBmxG0TnBN7DxPuCg9I1JJ6XDx8OnQA2xTtY knD72sMbsNSqnxs/YCJt+2l1r3sw7ILskJHTmqn440HAffEge7ag5srhHWWDKeP5cLb1 636F263UwScvwtfb41/LXux9mA3g7ydQJN96ar7ZtvZBU+RqHDO/ppmnrZCLajf/IkhJ LBSw== X-Gm-Message-State: AOJu0YyT9g+1vP/VO1vQoKrN0jto5IsIoC2Gr/OHhSeSiD5tuG33DY8t E1uHHCB19HNBDeSP2w/jzdGOjhRvVR9LacMKJkliE+2pSpFA+rZxmjwF08obm5cMGm6mia7PZf/ Uo8BldiQ= X-Gm-Gg: AR+sD12IW8rf4yUO8+Nl/EYnwDx9HNrIv0O967EBqYPWL1evRhOrZhMEryveNlaDx0q RNHRNoiCQGTjm3s65aqMZuDRgvqp6hkIEljQNB05VIm/1bH7uFoh2jPvll9f5X92FWdQx82RBBk HTIYAPHuqLfcUAgDWbtWqvU74HOAqevccScnsgPSFx1dRw7EIyx3nnGG5yXSiPlkeGyUbY150d1 I0Hes2pBYtyR4Xs4qGH9hYwH45Z/bQnqscT2J4KSDJVuzWXbV9XRFXvXwtdqV/K2gZm5vOFl1pM r2olb5zYIGEnRM1RKe/chKgvCOPPOaZzQEC/EFmuoZGpr06yZfYU0MUlGmrQvIkxdcYZ7mbnPoR 2LyGaWyhRZp4c6uUgVGWBnJkAvI7fD33hxoh8BbgR+gQ3GmzZEcTTIIlc+0mil76CIytzK7/3XL dKyxNE8Uv5xGdfHbfGV4vr0jHr59A310wWGccNs+RAOGzrXpaK/Kq8idOvKqulWQEzZPXMFCCw4 wZqWw== X-Received: by 2002:a05:600c:5801:b0:495:71fc:3a64 with SMTP id 5b1f17b1804b1-496c4fc3eb2mr5728315e9.25.1785193008964; Mon, 27 Jul 2026 15:56:48 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:47 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 33/36] vim: Security Fix for CVE-2026-47162 Date: Tue, 28 Jul 2026 00:55:47 +0200 Message-ID: <4cadd4155f05e4c6a1268045ef597b9081dfcc0d.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:56:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242150 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-47162 [2] https://security-tracker.debian.org/tracker/CVE-2026-47162 Signed-off-by: Siddharth Doshi Signed-off-by: Yoann Congal --- .../vim/files/CVE-2026-47162.patch | 83 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 84 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-47162.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-47162.patch b/meta/recipes-support/vim/files/CVE-2026-47162.patch new file mode 100644 index 00000000000..69714493d49 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-47162.patch @@ -0,0 +1,83 @@ +From f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sun, 17 May 2026 18:53:48 +0000 +Subject: [PATCH] patch 9.2.0495: [security]: runtime(netrw): code injection + via NetrwBookHistSave() + +Problem: [security]: runtime(netrw): code injection via + NetrwBookHistSave() +Solution: Properly quote the directory name using string() function + (Srinivas Piskala Ganesh Babu) + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b] +CVE: CVE-2026-47162 +Signed-off-by: Siddharth Doshi +--- + .../pack/dist/opt/netrw/autoload/netrw.vim | 2 +- + src/testdir/test_plugin_netrw.vim | 20 +++++++++++++++++++ + src/version.c | 2 ++ + 3 files changed, 23 insertions(+), 1 deletion(-) + +diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +index 3a460e675b..a04120d5f6 100644 +--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim ++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +@@ -2957,7 +2957,7 @@ function s:NetrwBookHistSave() + while ( first || cnt != g:netrw_dirhistcnt ) + let lastline= lastline + 1 + if exists("g:netrw_dirhist_{cnt}") +- call setline(lastline,'let g:netrw_dirhist_'.cnt."='".g:netrw_dirhist_{cnt}."'") ++ call setline(lastline,'let g:netrw_dirhist_'.cnt.'='.string(g:netrw_dirhist_{cnt})) + endif + let first = 0 + let cnt = ( cnt - 1 ) % g:netrw_dirhistmax +diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim +index 7b34b52562..cfce82f68a 100644 +--- a/src/testdir/test_plugin_netrw.vim ++++ b/src/testdir/test_plugin_netrw.vim +@@ -654,4 +654,24 @@ func Test_netrw_mf_command_injection() + call assert_false(filereadable('poc'), 'Command injection via mf command') + endfunc + ++func Test_netrw_injection() ++ let g:netrw_home = getcwd() ++ let savefile = g:netrw_home . '/.netrwhist' ++ let g:netrw_dirhistmax = 10 ++ let g:netrw_dirhistcnt = 1 ++ let g:netrw_dirhist_1 = "x'|let g:injected = 1|let y='z" ++ call delete(savefile) ++ try ++ call netrw#Call('NetrwBookHistSave') ++ call assert_true(filereadable(savefile), savefile . ' must be written') ++ unlet g:netrw_dirhist_1 ++ execute 'source ' . fnameescape(savefile) ++ call assert_false(exists("g:injected"), 'injected statement must not execute') ++ call assert_equal("x'|let g:injected = 1|let y='z", g:netrw_dirhist_1, 'dirname must round-trip') ++ finally ++ call delete(savefile) ++ unlet! g:netrw_home g:netrw_dirhistmax g:netrw_dirhistcnt g:netrw_dirhist_1 g:injected ++ endtry ++endfunc ++ + " vim:ts=8 sts=2 sw=2 et +diff --git a/src/version.c b/src/version.c +index 64008e0f37..cf62805e44 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 495, + /**/ + 480, + /**/ +-- +2.34.1 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index fd835a3cdbf..8360b1622de 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -25,6 +25,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-52860.patch \ file://CVE-2026-42307.patch \ file://CVE-2026-43961.patch \ + file://CVE-2026-47162.patch \ " PV .= ".0340" From patchwork Mon Jul 27 22:55:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93642 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E43FCC53209 for ; Mon, 27 Jul 2026 22:57:02 +0000 (UTC) Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43773.1785193012388092797 for ; Mon, 27 Jul 2026 15:56:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=PjUsFf6p; spf=pass (domain: smile.fr, ip: 209.85.128.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-496bb7cdf51so16562665e9.2 for ; Mon, 27 Jul 2026 15:56:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785193011; x=1785797811; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=mh2E/BaXX6Ww6jkY+pELSdt1Jk0PpoAhpGrY6CuQwfc=; b=PjUsFf6pStUvnKGvEusgH9ynATS/MlU9YKW1g9Z3ZNxFP2FD0bs30iOlRR7m2AFId0 saGXfFd0gHvIolQv3c2u+Ywz/fUWqILzskQRvviIaFtfnp0j6zGBvmvc1maY7hoWR2yK 5PIqVzIQHqdwDmSG5gS8cEeBBvpH4ZAzzF6Ng= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785193011; x=1785797811; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=mh2E/BaXX6Ww6jkY+pELSdt1Jk0PpoAhpGrY6CuQwfc=; b=eJgqLhos8SvHvHZNQ6/o7W4nT2L5irrprQK3JjG/9YxL5q7PU8q3yUk2PpiqXvKcYZ 0WTMQr8bkFR6JG7DERLSm2Go56zKmfKJ5XEvLPmW1WzBtpQtjPJAfgOOaejgUFRrRMp/ po2N6Xnp+vXAvHuCoi1saCn1+u36GmrTq6i93iZFjoB6MlauEXGLN59GqVY9N27fSRfQ ZWv3fkyscxW2JJ1DVoUymJ3s7j0GByQ/TqRYBdyUBwVmUfgeZ2U6mhOwhav+kKhLWeyj pqrkasUSAsI3b5Kam3w9vgrMvKWpyfTT2K+zqgFtYfYyBL0hzXHRLYwH2p2nwNIedw13 bqKA== X-Gm-Message-State: AOJu0YyI1stzBRyHazzuBBiWjcyozbzI/SCdOH7esQLRoscRSQDKBePI c2uGux97OOe0okkd21jXFtmYpxplmtp9u+1yWTiUxUvoe0xWHqeijS2FIvjdqnMrNtB4th8jhHu 4/wqq2qQ= X-Gm-Gg: AR+sD10zbNNRQm53jGS50vNADkQyyBucAr/OE5qYJiyHge0ebc9wXTnmACst5aHzTLj BWXD3qvLiOCVaNJa4pKvOXCeXbFhQwe6m3oRPcBQ3Vw6nvwNVd1Zf7qj4PXyC4FvPU0M1LwkeM+ pHHKRlB9HIajMg1FzC8gJ0WABWo4X+POXLKu0T/mV3K7ZYohAlNrj9DNZBsczKNuOLrfB1FxLh3 4UCJbh3FmJXpjsafyAW+2zyPD/HRaiDrh88gs6ceQhr0heCODAHLBMir0bkaP8ZJ3MVkud89Gy1 54DsokbErnirVVClRe7JqcSCMPVCVW2sSAuKK2P9GwH+GU2ecUkkuUBybeIB0eI95w5aDnICiDs +Q4OswQtPpt4W62AalG0a9Xm53jj8mjnYxmggTejTZSXlLMSVW20BPIhPlkJdkIOODjAHX4fp+Y DZ94JFEnX1mzRJebei9maiR53bwoGsrYGbj4xvPI7GefprbkOBNprQyrbMdHmgrwtFaSz6aXbCd af+Cw== X-Received: by 2002:a05:600c:6089:b0:495:6482:9d8c with SMTP id 5b1f17b1804b1-496c4fd630fmr8108095e9.37.1785193010609; Mon, 27 Jul 2026 15:56:50 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:49 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 34/36] vim: Security Fix for CVE-2026-47167 Date: Tue, 28 Jul 2026 00:55:48 +0200 Message-ID: <4f3baf03aaa48fa864edd9a30fb9828c655159a5.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:57:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242151 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-47167 [2] https://security-tracker.debian.org/tracker/CVE-2026-47167 Signed-off-by: Siddharth Doshi Signed-off-by: Yoann Congal --- .../vim/files/CVE-2026-47167.patch | 102 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 103 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-47167.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-47167.patch b/meta/recipes-support/vim/files/CVE-2026-47167.patch new file mode 100644 index 00000000000..f9a989cf3af --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-47167.patch @@ -0,0 +1,102 @@ +From 5eb4bd1c12801f9ffb451f22b4d459ff2b7ff962 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sun, 17 May 2026 19:39:24 +0000 +Subject: [PATCH 4/6] patch 9.2.0496: [security]: Code Injection in cucumber + filetype plugin + +Problem: [security]: Code Injection in cucumber filetype plugin + (Christopher Lusk) +Solution: Use rubys Regexp.new() with the untrusted pattern + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9 + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934] +CVE: CVE-2026-47167 +Signed-off-by: Siddharth Doshi +--- + runtime/ftplugin/cucumber.vim | 5 ++++- + src/testdir/test_filetype.vim | 30 ++++++++++++++++++++++++++++++ + src/version.c | 2 ++ + 3 files changed, 36 insertions(+), 1 deletion(-) + +diff --git a/runtime/ftplugin/cucumber.vim b/runtime/ftplugin/cucumber.vim +index f4848d1c60..9723898d15 100644 +--- a/runtime/ftplugin/cucumber.vim ++++ b/runtime/ftplugin/cucumber.vim +@@ -2,6 +2,8 @@ + " Language: Cucumber + " Maintainer: Tim Pope + " Last Change: 2016 Aug 29 ++" 2026 May 26 by Vim Project: prevent Code Injection ++" https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9 + + " Only do this when not done yet for this buffer + if (exists("b:did_ftplugin")) +@@ -96,7 +98,8 @@ function! s:stepmatch(receiver,target) + catch + endtry + if has("ruby") && pattern !~ '\\\@ s:steps -> s:stepmatch on every discovered step, ++ " including the malicious one. Suppress preview and error messages. ++ silent! normal [d ++ call assert_false(filereadable(marker), 'Ruby injection executed') ++ bwipe! ++ filetype plugin off ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index cf62805e44..03a520b146 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 496, + /**/ + 495, + /**/ +-- +2.34.1 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 8360b1622de..7a4a0bc932f 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -26,6 +26,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-42307.patch \ file://CVE-2026-43961.patch \ file://CVE-2026-47162.patch \ + file://CVE-2026-47167.patch \ " PV .= ".0340" From patchwork Mon Jul 27 22:55:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93641 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D80BFC53219 for ; Mon, 27 Jul 2026 22:57:02 +0000 (UTC) Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43774.1785193014826523254 for ; Mon, 27 Jul 2026 15:56:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=sonGVZLS; spf=pass (domain: smile.fr, ip: 209.85.128.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-4955aa106b1so31575575e9.0 for ; Mon, 27 Jul 2026 15:56:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785193013; x=1785797813; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=YLjb6Gob0g851dySNYRNtjBBDqW1iTZDQpU+m5Xas68=; b=sonGVZLSXO3p0bh/1BBsbvPq2pT5Bf/ucIPYFSjL7LClWQry3LiefmCDZ3Qd6aCHWC EDROETHa4Rxs4aTDTVTGMzZUJ7Y1J3IjLmdt37d3eVqy7GXlzkiD5OSvbUDc3qoQuMP0 SZkfhVf8NXlPPbmwEks08RgQfJuShD3tkYLBM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785193013; x=1785797813; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=YLjb6Gob0g851dySNYRNtjBBDqW1iTZDQpU+m5Xas68=; b=gF9M4NA4rhK4Cf27g1DKije14t3kJ6ARiOmL5O6P+nbZHd9O0E1UMUNtp8SjrKZ+wm hP18deS83tw+zUc626ricZYTRUS/NGpXf4BsHVWyjMTGHyXLv+P9nnw1deIsMnaEn6EN jX6pQM868zxkhAXxc24+YHIPVUTjZujSJ+V1ZNrS58ZYVEIh0F/KmvfcJKnNi0vxHxUF gj+vR9c7jPE49yHIuu7tLG4V3AYGoMi8FACsBIikrQR38L33JRjaEE6psdQgItowkye1 v3tGHY7ihRUqSTMkLreEumgJCNS+TAgnMRqW9DHame9z9QnYTSaVOE1JnLfC1G4UYBxQ fFSw== X-Gm-Message-State: AOJu0Yw18nMlrP2RIEDcfcRu5HwwWrGz8ECOqe2ZzFtcjTSeDDd4qpVy sx0c5ANX/2wbetmStxNPjTWdkg0mBIEx2NQqbkbjerDcZRW/7qmy3cHLEezXnKn85SB4yz7Ve0c AqBhK+QE= X-Gm-Gg: AR+sD10V05MP5XGsR7FQAayDrljzxvU7opGZVnN/yEO1zcJkZ6WJuqitbs6Jk6JrKoI pzTbbrllhrLpJBP+4c7pwkN+eq13uQH4aMqdo3NnSVU11HGoLORNIoNAbd7R/5NIohOvTrLndxc 3SiCsxrspDoBMFdLH0Hoat156SOESaRKGb8I68JHRCPbaaBInHN2ozg4vkSJwL1NUMrtjcfbCH4 8+CeXmtDDzHxshMH02DRW6czLXSWzuVABIB2zUZTuuUg7/WwHflfzDc1hDk6qrOaSyWnLhmZW8p w3F6z8a9kKVpAoMdkk3h3LwOaW04d+ap6RWIIq9vD3J4DukB53bViV2JXSJ0I9PaVcwMtYN+uTI JPfudKUe50DyssLQoNbB0kYn4CT1bjvErTLQGbmRtPJ2IQx+y6mZ439vQSMuHKgHQUZhUSQEy5S kylxOxE7NcknsmOAH4dqPaWhLbH89U+yOQSVk8aujtmiBfIKirSsw9TxIixI+aGORs0cpIME1kT 9uv0w== X-Received: by 2002:a05:600c:4683:b0:492:4e09:9fc1 with SMTP id 5b1f17b1804b1-496b56d443fmr131827475e9.15.1785193012985; Mon, 27 Jul 2026 15:56:52 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:50 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 35/36] vim: Security Fix for CVE-2026-55892 Date: Tue, 28 Jul 2026 00:55:49 +0200 Message-ID: <7957a3e2ccd97a5730f90dde9abdf7165bb12c3c.1785190123.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:57:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242152 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-55892 [2] https://security-tracker.debian.org/tracker/CVE-2026-55892 Signed-off-by: Siddharth Doshi Signed-off-by: Yoann Congal --- .../vim/files/CVE-2026-55892.patch | 95 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 96 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-55892.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-55892.patch b/meta/recipes-support/vim/files/CVE-2026-55892.patch new file mode 100644 index 00000000000..fc430953623 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-55892.patch @@ -0,0 +1,95 @@ +From 8325b193bba5f01e7a7d8241fc8633d93dff996b Mon Sep 17 00:00:00 2001 +From: Yasuhiro Matsumoto +Date: Tue, 16 Jun 2026 20:32:21 +0000 +Subject: [PATCH] patch 9.2.0662: [security] Stack out-of-bounds write in + dump_prefixes() + +Problem: [security]: a crafted spell file with a self-referential + BY_INDEX node in the prefix tree can drive dump_prefixes() + past the end of its MAXWLEN-sized depth arrays on :spelldump + (cipher-creator) +Solution: only descend while depth < MAXWLEN - 1, as the sibling trie + walkers already do (Yasuhiro Matsumoto) + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h + +Supported by AI + +Signed-off-by: Yasuhiro Matsumoto +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/8325b193bba5f01e7a7d8241fc8633d93dff996b] +CVE: CVE-2026-55892 +Signed-off-by: Siddharth Doshi +--- + src/spell.c | 2 +- + src/testdir/test_spell.vim | 27 +++++++++++++++++++++++++++ + src/version.c | 2 ++ + 3 files changed, 30 insertions(+), 1 deletion(-) + +diff --git a/src/spell.c b/src/spell.c +index 01eb57e3a9..72d1f0b521 100644 +--- a/src/spell.c ++++ b/src/spell.c +@@ -4325,7 +4325,7 @@ dump_prefixes( + } + } + } +- else ++ else if (depth < MAXWLEN - 1) + { + // Normal char, go one level deeper. + prefix[depth++] = c; +diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim +index 58a2d58707..77eac49fd8 100644 +--- a/src/testdir/test_spell.vim ++++ b/src/testdir/test_spell.vim +@@ -1581,4 +1581,31 @@ func Test_suggest_spell_restore() + bwipe! + endfunc + ++" A crafted .spl with a self-referential BY_INDEX node in the PREFIXTREE drove ++" dump_prefixes() past its MAXWLEN-sized depth arrays (stack out-of-bounds ++" write). The tree parses cleanly (shared refs aren't recursed); the walk ++" happens on :spelldump. Reaching the assert means no OOB. Same class as the ++" tree_count_words() fix (9.2.0653). ++func Test_spelldump_prefixtree_overflow() ++ CheckUnix ++ call mkdir('Xrtp/spell', 'pR') ++ " VIMspell + v50, SN_PREFCOND(prefixcnt=1), SN_END, ++ " LWORDTREE word "a" with affixID=1 (so dump_prefixes runs), ++ " empty KWORDTREE, PREFIXTREE child BY_INDEX -> nodeidx 0 (self-cycle), 'A' ++ let spl = eval('0z56494D7370656C6C32030000000003000100FF00000004' ++ \ .. '0161010220010000000000000002010100000041') ++ call writefile(spl, 'Xrtp/spell/xx.utf-8.spl', 'b') ++ ++ new ++ set runtimepath+=./Xrtp ++ set spelllang=xx ++ set spell ++ spelldump ++ call assert_true(line('$') > 1) ++ ++ set spell& spelllang& runtimepath& ++ bwipe! ++ bwipe! ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index 03a520b146..b40bd9be93 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 662, + /**/ + 496, + /**/ +-- +2.34.1 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 7a4a0bc932f..f423e4d5cb0 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -27,6 +27,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-43961.patch \ file://CVE-2026-47162.patch \ file://CVE-2026-47167.patch \ + file://CVE-2026-55892.patch \ " PV .= ".0340" From patchwork Mon Jul 27 22:55:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 93640 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C24E7C531D0 for ; Mon, 27 Jul 2026 22:57:02 +0000 (UTC) Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43777.1785193016318090229 for ; Mon, 27 Jul 2026 15:56:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=m8AJfSm9; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4954d29264cso16116535e9.2 for ; Mon, 27 Jul 2026 15:56:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1785193014; x=1785797814; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=/pY15swq9FDDIaGhklN9EEvrA4tmhbHSl26MoI1uTgU=; b=m8AJfSm9KyDY9MJUabGyS1nt8mmEht5It3yvT8EK5yi4vTItK6piE/hZ/Miay9hx8/ MtQpy9gY6tNQxXklUPDkDHpbhRsMRWiegCjOA6UyF2XMd7nrZhqN7ohLG+1VyCuQAq2T Ht1yG1oYEZI3haS21tScjDr1b5cSJj3vzBsJo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785193014; x=1785797814; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=/pY15swq9FDDIaGhklN9EEvrA4tmhbHSl26MoI1uTgU=; b=Djn/49/O1YGFYwg7raK84tEKT4kEbDFSRqLdoV2kHeWGHs69id7uWSP37UNLD4okYp +IeObR+dI/O8P774s/dIWyHgZ2bR9oZmOY1OVDCQQA3LlfOqCK5cyR01nG2mEN0eJ9Mm llFflky+CwlD3yVqGRTgKbifRSW3sJymX3IASryBEof0exG0Gx4nf82zbkc2XnDU/BmN WsgIshQ70N024kUY/DODUyKd71jqvzWoNR8K5yOECvL3DTsIPZKOd8qXGwX8iVqkjiYz +odHrOlAVzs7CHgbyySMGNXsrLQ0F8hsc95UyhEj8DtLJRixfi1SB7Eyg0CIgBv+YM+Q nJXA== X-Gm-Message-State: AOJu0YxSS8MR0aQEb0gRXpUdMbvqjquQUN/eDL7HPBz7INmAro5goTNR TbXJgBu/3XDQsicw7oBvFe+yfK4BOn3dN3lqq6UqoD1uhh0oNWxN9mTyOkiOSq/7WPOBeBjtcOJ 3DD9dWEk= X-Gm-Gg: AR+sD10vBrqIBZO25gD+dqUBJLZ7GYxAUN+VkjR47ThqcjOgVg/IJwvnESt0ENNtOtW tlotRKy9I5ESur3N7qwfYK0BjqjtUqpkuQmvD2q0ZBBPyaFGzHTEV0zd7XfbOLtF37/oE70qEFn rP3cR6EKH8yxyItwIS2wLSyLvr3zFamHSSgh5WInVTpzey58cERVcE9n5j8zl8rxRYcWTDIXRxb 79LkN2bU8b6N94FmfchICimgGN9SByXGE6nK1Dg1Y1xEYiehpoEd+a5wqttr5WrcZ9X4HcnALs3 guocP1JA1GwA4jauteTNlHPAQBOdrSLvMiY9T12gxYNNzOQG7uCEcl4eIQ6OiBrMuKXIbr7NeYJ kBJZr2r9ncUZNtmmRVQKnasc8m2Ld/MTZwfpoX1qi6I5uhi8F5ed+tiLWJEleDLMdK16Uz1Gi0f eiHKMgkpsyQZRgoFozvWmlS/36pXPHU+UpjpRBCE8/ekpNGm6vQuiNWc35z6jt6IR3fcpRl84wT MM6RA== X-Received: by 2002:a05:600c:8483:b0:495:7a5a:d96c with SMTP id 5b1f17b1804b1-496c4fc2210mr9852385e9.18.1785193014521; Mon, 27 Jul 2026 15:56:54 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496c45de1a3sm31513055e9.11.2026.07.27.15.56.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 15:56:53 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 36/36] vim: Security Fix for CVE-2026-57452 Date: Tue, 28 Jul 2026 00:55:50 +0200 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 27 Jul 2026 22:57:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242153 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-57452 [2] https://security-tracker.debian.org/tracker/CVE-2026-57452 Signed-off-by: Siddharth Doshi Signed-off-by: Yoann Congal --- .../vim/files/CVE-2026-57452.patch | 90 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 91 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-57452.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-57452.patch b/meta/recipes-support/vim/files/CVE-2026-57452.patch new file mode 100644 index 00000000000..e87007c00a2 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-57452.patch @@ -0,0 +1,90 @@ +From c8777cec25dcfae89c42e9aff51af61f71c5745f Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Thu, 18 Jun 2026 18:41:16 +0000 +Subject: [PATCH] patch 9.2.0671: [security]: possible out-of-bounds read with + sodium encrypted files + +Problem: [security]: possible out-of-bounds read with sodium encrypted + files (cipher-creator) +Solution: Verify that there is enough space before calling + crypto_secretstream_xchacha20poly1305_init_pull() + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-c4j9-wr9j-4486 + +Supported by AI + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/c8777cec25dcfae89c42e9aff51af61f71c5745f] +CVE: CVE-2026-57452 +Signed-off-by: Siddharth Doshi +--- + src/crypt.c | 3 ++- + src/testdir/test_crypt.vim | 24 ++++++++++++++++++++++++ + src/version.c | 2 ++ + 3 files changed, 28 insertions(+), 1 deletion(-) + +diff --git a/src/crypt.c b/src/crypt.c +index 2fade5db9d..879ecbf6ce 100644 +--- a/src/crypt.c ++++ b/src/crypt.c +@@ -1262,7 +1262,8 @@ crypt_sodium_buffer_decode( + + if (sod_st->count == 0) + { +- if (crypto_secretstream_xchacha20poly1305_init_pull(&sod_st->state, ++ if (len < crypto_secretstream_xchacha20poly1305_HEADERBYTES || ++ crypto_secretstream_xchacha20poly1305_init_pull(&sod_st->state, + from, sod_st->key) != 0) + { + emsg(_(e_libsodium_decryption_failed_header_incomplete)); +diff --git a/src/testdir/test_crypt.vim b/src/testdir/test_crypt.vim +index d540fbbd62..5c9dfe3baf 100644 +--- a/src/testdir/test_crypt.vim ++++ b/src/testdir/test_crypt.vim +@@ -491,4 +491,28 @@ func Test_crypt_off_by_one() + bwipe! + endfunc + ++func Test_crypt_sodium_short_body() ++ CheckFeature sodium ++ " A VimCrypt~04! file with a complete 36-byte header (12 magic + 16 salt + ++ " 8 seed) but a body shorter than one secretstream header (24 bytes) used to ++ " underflow the body length and crash with a wild out-of-bounds read in ++ " crypto_secretstream_xchacha20poly1305_pull(). It must now fail cleanly. ++ " Bytes: "VimCrypt~04!" + 16 salt + 8 seed + 8-byte body = 44 bytes. ++ call writefile(0z56696D43727970747E303421 ++ \ + 0zA0A1A2A3A4A5A6A7A8A9AAABACADAEAF ++ \ + 0zB0B1B2B3B4B5B6B7 ++ \ + 0z0000000000000000, 'Xtest_sodium_short') ++ ++ let v:errmsg = '' ++ try ++ call feedkeys(":split Xtest_sodium_short\foobar\", "xt") ++ catch /^Vim\%((\S\+)\)\=:E1198:/ ++ " no-op ++ endtry ++ ++ bwipe! ++ call delete('Xtest_sodium_short') ++ set key= ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/version.c b/src/version.c +index b40bd9be93..6eac3fc927 100644 +--- a/src/version.c ++++ b/src/version.c +@@ -734,6 +734,8 @@ static char *(features[]) = + + static int included_patches[] = + { /* Add new patch number below this line */ ++/**/ ++ 671, + /**/ + 662, + /**/ +-- +2.34.1 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index f423e4d5cb0..20a5f7a0546 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -28,6 +28,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV} file://CVE-2026-47162.patch \ file://CVE-2026-47167.patch \ file://CVE-2026-55892.patch \ + file://CVE-2026-57452.patch \ " PV .= ".0340"