From patchwork Tue Oct 20 23:22:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101437 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4761.1792538574453116961 for ; Tue, 20 Oct 2026 16:22:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=sPpdWoiy; spf=pass (domain: smile.fr, ip: 209.85.128.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-4a16af2a232so623505e9.1 for ; Tue, 20 Oct 2026 16:22:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538572; x=1793143372; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=35gcTE7SF3CSIusWkdcrVmGatku2cCZ3zyW64XHW84k=; b=sPpdWoiynaEDgCfhr+46Mkhn07ntvPFNs8Rcp7AJtsKsTlUkRwSAlT4EQrGQv74SWM mR0/Wfv1+tYxBen/8Nu6M7G+bDxsCC7LDyeR3e6BZgrJbXiwEGQAvxitbpCiZFSUYN4G DJ6trUBkhSMfRDbHRZkW7dWefdYvWJs4qh86bXJsfPbHLISeLNjdHPcV6V2fIooo7/EQ UXcKqDhugO95R/LLtnKWK1fP4Jqpc61unXCNAfQiuinQRbXWgq/Bx6d73E4/QySpD4ca ChN+Y7rRHdErIOp1y3MXtrpVD39o8coRUJPVFPOGTtKgpQZ2o0qHFQcTJoKdCSvVJi33 OlwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538572; x=1793143372; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=35gcTE7SF3CSIusWkdcrVmGatku2cCZ3zyW64XHW84k=; b=zYXtgyH10jEdjgr8eUffK0c7X8RHfR095PhFa/GwB5dKAilTPObhizegdWGOByci0P pUR1zpTzDB6uvF6UVy2sLXVkMdQEsPHvQ2/H5pEGFZM1dl4ERwdpPcjqZLCXJqi8NXiq 7c9ep0T+SLwACXJ0MZhM3FvYFQvMGp7gHW0fHiPkgUGlFvPTpmPJ7RfzCUXRWUcO5uqU V4+NXaHFGBeKiRCUdEN8isGRDZYtfYKqQKchJsCo3HAdiKFMgMXWbvlibEFEhgVIIiCp 5OCnpdyWMbaUIFmp6fNt5clbGbzaMYCBsQDvQ/qPd+cObJVnmEQx9J6Jg2CohkPuGk20 bNMg== X-Gm-Message-State: AFq9FYJmolwkjfRwiEVxrkUjf24hAaqcURQTFJYjYLfDpWfZ1CbG7S++ 8FKZd0jBGwPCXe5VkV5WwaxyRzKQjdLLlvNA19xybZQ2wZpWPeRXkbpQRhlGfOu1ZFEmgtoHLis fP7rUJt0= X-Gm-Gg: AYBFou25pYN0ShY+ye9hFt/5zV5Xfc5J7/hf+P7ZvCooJ26V5a/6Z6Q4YBIst2y8oyw i+K6mBQ/OluCk547G4+X84dQs2wfnEAQshI8P4j3BewBR2QuPD6vRcaV0V1HbVDfWfoq0uIuP9f Bo60DOng/03ltwqREstsgmXkC0R8oXSN6lhXcMMPhyLcET9YG8xKXz0NCzOGIWWT2F98/3MjcdK +KI823x2RbdJyn924yZGDYENtaxTT2gahpz9UUFriEl+Z5pECJ20CtdygUx+RFgsDTsyA3Am2Cj ec2hZaHZc0AgUEy0Ykb/Ph90yn5xVTXa0kpgrNRNfr6BueKmACuYxe8Er7H4gzbYf2fV6rZu6mX Pfky3X2Xn2VrOcElmieKcnka2n7QrUFmml0kejw6M9BxGGrHlLGJWTuV/h1v5zQIzZAugmBWlIF ztmO+YLVWGs+uuk40zrFp83okqWQwW9rYSzbQ1eo2BcgEotriOHOvpPS8VC6UvKdQKiWdIs6oQT iCGzVx5g1E0ocU4JnbHaWrcCIjUlb2UZjDgxgYKGJi/I1g3UsIqk/vwGS6ntxpm7UIZUecqFbqb CdiyGkcYuC1U5BN+TQcCeOXJ8c2PB9uMOb9gXOxJqHUmmIX+hc7uVRs= X-Received: by 2002:a05:600c:34c4:b0:49f:ce78:3562 with SMTP id 5b1f17b1804b1-4a1fdd37971mr3595885e9.19.1792538572356; Tue, 20 Oct 2026 16:22:52 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:52 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 01/25] libpng: upgrade 1.6.58 -> 1.6.59 Date: Wed, 21 Oct 2026 01:22:11 +0200 Message-ID: <91a342f8bf17605554ace45870ea72425100203b.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:22:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248319 From: Peter Marko Release notes [1]: Version 1.6.59 [September 28, 2026] Fixed CVE-2026-46675 (medium severity): Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression. (Reported independently by Ze Sheng and .) Fixed a regression introduced in version 1.6.47 that caused libpng to reject hIST chunks in their correct position, after PLTE. (Contributed by Yuki Sekiguchi.) Prevented a double free of `png_struct` members after an allocation failure. (Contributed by Anthony Hurtado.) Applied fixes and updates to the CMake build. Adopted the REUSE Specification for licensing the CI files. Note: cmake is not used in Yocto build of libpng. [1] https://github.com/pnggroup/libpng/blob/v1.6.59/CHANGES#L6388 Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 907c6fa2d0c4f8a8f765cde004c55fb2dd2c402d) Signed-off-by: Yoann Congal --- .../libpng/{libpng_1.6.58.bb => libpng_1.6.59.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-multimedia/libpng/{libpng_1.6.58.bb => libpng_1.6.59.bb} (97%) diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.58.bb b/meta/recipes-multimedia/libpng/libpng_1.6.59.bb similarity index 97% rename from meta/recipes-multimedia/libpng/libpng_1.6.58.bb rename to meta/recipes-multimedia/libpng/libpng_1.6.59.bb index 6e4e5e9f387..21f3a8ff3b6 100644 --- a/meta/recipes-multimedia/libpng/libpng_1.6.58.bb +++ b/meta/recipes-multimedia/libpng/libpng_1.6.59.bb @@ -14,7 +14,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BPN}${LIBV}/${BP}.tar.xz \ file://run-ptest \ " -SRC_URI[sha256sum] = "28eb403f51f0f7405249132cecfe82ea5c0ef97f1b32c5a65828814ae0d34775" +SRC_URI[sha256sum] = "d80dd2a38a37f803cb9b6ac7b14bd6e74ddc3b654780a8380bdf93523fdb4389" MIRRORS += "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/ ${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/older-releases/" From patchwork Tue Oct 20 23:22:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101443 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4732.1792538576736212911 for ; Tue, 20 Oct 2026 16:22:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=n2OynvUs; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-49d05d51553so573755e9.2 for ; Tue, 20 Oct 2026 16:22:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538575; x=1793143375; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=xKrXT3VGlyqTeL8zNPftEgVK3TVHTFWIp9k17g7pqKA=; b=n2OynvUs8DTX92o4rmUjl9PwS317tze5ObaPheBN5aVV2pDH3tjEkmTCHGwogdJntq Oc88iPucRbCLx1HNBgeO2D+9NFB3PEIUrwCA+0PgETw9GXbZcH0h4q2lLv/z8kzNDMHE sZovSeJy/9S5fyNC/CXzf84uOoICuM08d4S57vqtYqBfdDncaplUVWMy/ZL4XWAQoC+z 03vTEPcwX+AEJVqZW1KDaQ4FsfYfLoutc/0QupYMzh/b/jV9vAGXiUseuSYg4d+0t68Y z77es/OmdLFz8BkzXVn+CXWY33cttTuY1KLGdAE24g9Zzyy41cWfRKp+w37euIF4XkfP tGwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538575; x=1793143375; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=xKrXT3VGlyqTeL8zNPftEgVK3TVHTFWIp9k17g7pqKA=; b=yvl97HbdPGJ34a2dfYdNNGUFtDhZTXSFUkyVbeOs7vqKZoL0d8nFDz0K81Xwvpp8xu IaJnN6tSdfj7MeD90DsepE9JAwPzYC+wLPHEiX4Gg7VEAsYtS69tSncNLSVJEQAQZp3B 5+zGRZPoIdcQ2YL985JA0bFmKmaQJJ4454psHiDoHC1NloMIcLSCc0GysAR0ysThQHAV YPBgXQwSaNI/rG1vYd8AKy8Di6rf54tafDUOYIwbpCC2Ii7MRrObOLA+/LKie18cXUnR T0/KFkuwZVqMfIOpF24okcb33bFp7oGey6d7qQrwh45WOb+ZpiZDQl4fgxiNPfx3mgeV I34g== X-Gm-Message-State: AFq9FYJZ5i6IY1E5pnBMkqkL7rY5urq8YQYM/6gWZuuIGeLBOoFLe+zp shCqtHi7NJpdJe4WnqGzd1YZxVi9Gf5wms/si4VCPOOqRen6VCuCpTlK5r/A4ojwYMfHbpGPU72 FODpwpFQ= X-Gm-Gg: AYBFou1ppk4k6h4BmPZ6e4JmrsOfr+yuF376eyN2go55pNH7NerbuL7YageF1Tk493/ vU0EoNqKzeoxDCDFOA6oztfDMzJ5VJpGloYncQ1kgey/ruGw+EUDddI1wNBZoGZthEckUuGgQDO t9wf+icZN1myk0wwJoe8caGM5Xm8WJzl703Jn8vDkr6hIwFKnp+GVLhr704viBekLZKMbF3vCEc XxwXs5SrDuVZAzrlokqB1hhrVubuEJwSXow3sj6hUqpWqWb1PpDw0fGLp6gG1e4sGpbVxuWhvsr J18C7oqkD6VzIW7kYf1py6FC2OORIayZNEAXGnQAQIv8Le6AcyTrZoF6Tv2XhFQG/zKH+eA0gRb Rr0k7JtjgBl2v9Y1I7txa/9MVoZaYU+mFnGvJKjS9Nwq0wBVgITD5jhyFoWtvRrZcoK1qYmtI32 LkBDeP9fmPO+m2MheisVCbRDO5CIkWVO0w7iSmd+XIQ6+rXQ0AojvTGkQ6kVW3F6W9VM+izS7cP NZjR8ghIY3ktENMK4Abid4VgyalJB82VURKYsgW8SggbSoqFWp2qhRXtne/SXI49+Lpmuwo2g== X-Received: by 2002:a05:600c:8a09:10b0:4a0:4a8:d444 with SMTP id 5b1f17b1804b1-4a1fdd39ed0mr2444295e9.33.1792538573134; Tue, 20 Oct 2026 16:22:53 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:52 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 02/25] linux-yocto/6.18: update to v6.18.54 Date: Wed, 21 Oct 2026 01:22:12 +0200 Message-ID: <6669b0a3fb1e3064304083ca9762a41b2e1c66ce.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:22:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248325 From: Bruce Ashfield Updating linux-yocto/6.18 to the latest korg -stable release that comprises the following commits: 1b357ecb32139 Linux 6.18.54 c8c7639aa3243 smb/client: send lease break ACKs thru correct session for multiuser mounts 024eb5c4cea07 Revert "ksmbd: Fix to handle removal of rfc1002 header from smb_hdr" 74f179e75ab03 Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device 8a143f91f1f7d ASoC: sdw_utils: subtract the endpoint that is not present 3c8f0ae0d3b01 wifi: mac80211: fix list iteration in ieee80211_add_virtual_monitor() 5a93dbeb555dc ksmbd: fix partial normalized name responses d1152c96a3002 smb: client: fix reparse buffer bounds in cifs_query_reparse_point() ac7c08626f678 wifi: libipw: reject TKIP frames without a full MIC 87b9893107ea0 wifi: ipw2x00: Use michael_mic() from cfg80211 dcbb37bb1f1e8 wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211 47e09d6fd0bf5 wifi: ipw2x00: Rename michael_mic() to libipw_michael_mic() aeaa7bdc0ea2c drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments 801d8647dcb0d drm/amdgpu: lock bo before calling amdgpu_vm_bo_update_shared b8f46ca5cbd62 xfs: fix under-reservation of blocks when repairing sf directories 24beea233aae4 xfs: remove the i_ino field in struct xfs_inode 1e0a34f690e52 xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corrupt 34b3b32fb1a96 xfs: add a xfs_rmap_inode_owner helper a6767712902be smb: client: fix cifsFileInfo reference leak in deferred close 226e066932b5e scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU d2494dc0d9de1 scsi: fnic: Bump up version number again 8118e473d7a10 scsi: fnic: Make debug logging protocol independent d1b7ca587d810 scsi: fnic: Bump up version number 822214913b120 scsi: fnic: Rename fnic_scsi_fcpio_reset() abe15e643e576 wifi: mac80211: refuse to make a monitor active when it has no queue 07c78e1b16900 wifi: mac80211: track MU-MIMO configuration on disabled interfaces fb5400bff669c mm/vma: correctly unaccount on mmap_prepare() failure 88871ab548c1d 9p: Fix v9fs_issue_write() to update i_size and remote_i_size a548c7abf65b6 mm/huge_memory: bypass THP tuneables for huge pfnmap mappings 148db154066b0 xfrm: save input state data before secpath resets 1acd93259b6be xfrm: Fix dev use-after-free in xfrm async resumption e29d6ab39ea3e xfrm: Refactor xfrm_input lock to reduce contention with RSS 621c365739828 signal: Prevent exec() race 9eeb282ae6d57 signal: Move MMCID exit out of sighand lock 79c55a7b5d71c ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity 722ee726148ea ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling 9fc87899276af smb: client: fix busy dentry warning on unmount after DIO 4cc1bb9569930 ntsync: reject wait ioctls with zero owner fe474ad6dc481 ntsync: Honour caller's time namespace for absolute MONOTONIC timeouts 29bd40e111262 time/namespace: Export init_time_ns and do_timens_ktime_to_host() 36981ba106d91 HID: asus: fortify keyboard handshake 2f8ed71aaaba3 smb: client: fix missing iov bounds check in parse_posix_sids() 62b50ebc5ded4 smb: client: fix missing lower-bound check on DFS referral string offsets ebb8a075fdc7a smb: client: fix server->total_read for compound encrypted PDUs 1cdf0d304d820 smb: client: fix potential OOB read in smb3_enum_snapshots() 34a3942e787b9 smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() 96c436e4b0107 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs a1d2a407fdc19 smb: client: fix unaligned access in WSL reparse point parser 928edc4bd6a61 smb: client: fix smbd_connection leak on cifs_get_tcp_session() error a3e4c288e933f smb: client: reject short Next offsets in parse_server_interfaces() e99040e5e9c60 smb: client: fix use-after-free of iface in cifs_try_adding_channels() 04082b1833856 smb: client: fix rlist race and missing initialization 7ab9ceedd8602 smb: client: cancel reconnect work in clean_demultiplex_info() cd55dde2b6378 drm/amdgpu: fix rmmio iounmap skipped on device removal d81bf4581903b drm/msm: RCU-free the scheduler-containing ring and VM objects f41e64aca2e60 drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure 7b7b590d721f9 drm/msm/dpu: clear pending peripheral flush state 57322415b079f drm/msm/adreno: fix autosuspend cleanup during teardown e84425f789fa6 drm/gud: Ignore damage clips in full update mode 2c92af27ad23e drm/gud: fix out-of-bounds write in gud_plane_atomic_check() 432c8532d5ccc wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver 71612bda21155 wifi: mwifiex: validate action frame fixed fields 5747eaa38a7fc wifi: mwifiex: prevent authentication frame length truncation 9cff2f39ed38a wifi: mwifiex: validate scan response extents 8bbef2b1ebfba wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length d2fb6b588dc5b wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST 3bdcc4d61212b wifi: p54: validate curve data length in the calibration curve converters 4f86fb6f9dce0 wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() 68b786691ce24 wifi: wilc1000: fix out-of-bounds read in P2P public action frames 7f1f25b2db146 wifi: wlcore: release runtime PM ref on regdomain config failure 2bddc5d088cf4 wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown f4f2852b664c3 wifi: rsi: fix heap OOB write on key removal e82536aad653e wifi: libertas_tf: fix UAF in lbtf_free_adapter() 55d34422c0d91 wifi: iwlegacy: fix broadcast stations deallocation 1edb3ddd261e9 wifi: brcmsmac: fix UAF in brcms_free_timer() 405e575444b76 watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() 0e2302dc23249 watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() eb14ee406e1d0 watchdog: rzv2h: Avoid division by zero b4ede87765a2e watchdog: rtd119x: Avoid division by zero efb76b8ba522e watchdog: msc313e: Propagate error code in resume() 61bcb2403bdee watchdog: msc313e: Fix premature reset during timeout update 1e995d1eef00c watchdog: digicolor: Avoid division by zero 960d1c85381bc watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog 8319a4142f7d2 hwmon: (cgbc-hwmon) Add missing sensors 3a5bfc3145c02 hwmon: (cgbc-hwmon) Fix current sensors ID lookup 1fd330df340cc hwmon: (w83793) release probe data through kref 2c381e6e0f033 hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove a5ce3fe5335a2 hwmon: (pwm-fan) Stop RPM timer before freeing tach data d84769ab7aae3 hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 ec7443983cab4 hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding 9558fc1e042ac hwmon: (pmbus/core) increase number of phases and add new mask 72c85149794a1 hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() 0d05b43b55d47 Input: zero ff_effect before compat copy in input_ff_effect_from_user fa1713dc3d43d Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound f16f62b7462f6 Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) 8a70a192e3e5b Input: soc_button_array - check btns_desc->package.count 518c9f2b8ab43 Input: soc_button_array - fix MS Surface Pro 11 probe failure dc05ec97b8299 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() 8202e2cb3db23 Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P d1704059be95a Input: hp_sdc - shut down kicker timer on module exit 71e5619db11dd Input: evdev - zero absinfo before partial copy in EVIOCSABS 9eb261092d4c9 Input: cyttsp5 - clamp the HID report size before memcpy 143330cc00d56 Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 a0a73ae16b57b Input: adp5588-keys - cache GPIO state before registering the gpiochip bb8c4aa9a0dca mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure 818ec2ffc985e mmc: sdhci_am654: Clear ITAPDLY on tuning failure bf1e2c818559e mmc: sdhci_am654: Reset command and data lines on failed tuning f6bf12758013a mmc: sdhci_am654: Move tuning_loop to local variable 4885e587f1afa mmc: spi: reset bytes_xfered before retrying CRC failures ba4118e164abc mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt ac866db277a4c mmc: sdio_uart: fix xmit_fifo leak when the port table is full 15b5ffd8af2dd mmc: sdhci-of-aspeed: Remove children before releasing SDC resources 58c1a7a41c3f0 mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 23383e0578b58 mmc: mxcmmc: cancel data work and watchdog on remove 7fecf79f31568 mmc: mmci: Fix use-after-free in busy-timeout work 8439bf262ce32 mmc: hsq: Fix use-after-free in retry work 2d48c5a611b7f mmc: core: Fix OF node reference leak on card add failure 4553b5004eca9 mmc: core: Cancel SDIO IRQ work before freeing host a2890c1eb96d1 power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() 859880b07a75c power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() 244aacaa5e311 power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed 24e00850bcff4 selinux: always fill AVC decision in avc_has_perm_noaudit() d127c7e1f3e12 selinux: recheck intermediate backing files on mprotect() 9d99b770e7b67 selinux: preserve user SID across nested backing files 180752deb7270 IB/hfi1: Fix the PIO_CRED credit-return mmap 352eab79c0046 IB/hfi1: Resolve the credit-return buffer through the send context's node ffb80872617b5 IB/mlx4: Fix use-after-free on pkey sysfs registration failure 66c7c59cb74e1 i2c: imx: disable autosuspend on remove a114c27eb5a9b i2c: imx: release DMA channels on probe error 8b6230a174397 i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() eabf7a3d33cd9 i2c: atr: fix dangling adapter pointer on add failure 48285f2727708 i2c: at91: release DMA channels on remove and probe error 9ddbc5f4bb498 KEYS: trusted: Fix tpm2_load_cmd() boundary check cdc17d8ab62a3 keys: translate request_key_auth pid for the reading procfs instance a1a98eca102b1 KEYS: encrypted: fix integer overflow of datablob_len 2897601dffe57 mm: filemap: retain mapped dropbehind folios 6e3fe31020050 mm/mremap: account mm->locked_vm correctly for MREMAP_DONTUNMAP f5d0e92e23549 mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() 0a41a46859df0 mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count 6611f78ec3fd4 memstick: ms_block: destroy io_queue workqueue on removal d5cdff14c385b memcg: avoid charging the root memcg from obj_cgroup_charge_pages() 4450102d6aa2a soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node 4748c27e2e6a1 xfrm: use hlist_del_init_rcu for state_cache and state_cache_input 75fc4561772e2 xfrm: serialize state GC with device state flush 6233d0b3ef462 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() 2d432d59f10a4 net/packet: avoid truncating TPACKET_V3 private size 805edbdcb8681 net/packet: clear RX owner on VNET header error 1731ff1d20489 net/sched: hhf: cap hh_flows_limit at change time 1be63e4579af4 net/sched: act_api: release tail references on DELACTION failure 02eba5f36d202 net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value 8dad70ff7e25c net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain 9dbf13de4edff net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() 21b231c112759 net: phy: mediatek: do not report link and per-speed LED rules together 5c216bfa9fb7b net: lan743x: fix RX checksum use-after-free 9907325257b4b net: ip_tunnel: initialize `options_len` before referencing options 4c030a0400ebf ipv6: xfrm: use full sockets in local error paths b14e6c5287255 dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() 3c42546d6c7a0 dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status 31396d731b284 dmaengine: sun6i: fix non-atomic read of DMA position registers a32bedab8ece9 btrfs: clear free space tree creation state on rebuild failure 709f6a5e98653 btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() 4dc1ae5ff75b1 Bluetooth: hci_sync: Serialize local codec list cleanup f49a543d76d48 Bluetooth: hci_codec: validate vendor codec count length 4eb614045056a Bluetooth: eir: validate service data length before reading UUID 684d7252dc4e2 Bluetooth: btusb: fix NXP IW610 composite device handling 390742871a723 arm64: percpu: Fix LSE operations on {8,16}-bit types d575e0079149b arm64: percpu: Fix this_cpu_and() mask generation 0dd78559c1444 arm64: percpu: Fix this_cpu_write() casting 169b53d64a943 arm64: dts: renesas: r8a779f0: Set UFS lane count e80ea8118a073 arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc 8eaf3c3a994fe kselftest/arm64: Fix size of thread_data values for pthread_join() 4ed6f5d94cc86 HID: logitech-hidpp: fix race condition when accessing stale stack pointer cce630c751279 net: xfrm: reject unrepresentable espintcp transport headers d16f089bd700f openvswitch: avoid reallocating confirmed conntrack labels e15eb536be4f6 RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() 01cbdb724c584 RDMA/ucma: Serialize join and leave on copy_to_user failure 8fc1eaae65f51 spi: virtio: Use the per-transfer bits per word 6eeecd941f4e4 spi: spi-zynqmp-gqspi: stop the controller on shutdown ebeff6e7133a1 spi: fsl-qspi: Reprogram the clock rate when the operation frequency changes aa4709813b29d swiotlb: use the adjusted address for the highmem page lookup ff037920c688a tcp: exclude old ACKs from tcp fast path 857559b83c816 x86/microcode/intel: Reject problematic loading on Granite Rapids systems e0fbc37f09b1b x86/build/64: Prevent native builds from generating EGPR use 526d8f45c6ef4 drm/nouveau/gsp/r570: Enable S/R Display workaround in GSP 80b8a76823dee drm/nouveau/gsp/r570: Set GcOff = 0 in fbsr 28b898b5c7004 drm/nouveau/gsp: Increase delay for magic sleep in r535_gsp_fini() b0bd757f910a6 Revert "nouveau/gsp: fix suspend/resume regression on r570 firmware" f22d349940cb3 rust: net: phy: fix off-by-one bit positions in device status accessors 65ca0a5037152 rds: ib: use rds_conn_drop() on protocol version mismatch 9971dac1a7784 posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list 8a15369ad1daa phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context 44ab7420ab52a fs/dax: check zero or empty entry before converting xarray entry 75aa08b93c657 exec: Cleanup POSIX timers right after de_thread() fcc0a935bb6e3 cifs: Fix server use-after-free in cifs_chan_skip_or_disable() 7ab7aea170bc3 ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources() b691a3e244278 ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY d93988c9e58d3 ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type 3e24b4a6acfd3 ALSA: virtio: reset device before deleting virtqueues 2dec4642589a6 ALSA: core: Fix potential UAF after asynchronous card release c03fb163a8851 Input: xpad - fix PDP Marvel Xbox 360 controller 3e6dcea0e12f4 Input: xpad - add support for Azeron devices e97d781ec9c87 Input: xpad - add support for Victrix Pro BFG Controller 55ca2a79ebd72 wifi: rtw88: TX QOS Null data the same way as Null data aeab608c97008 ACPI: processor: Update cpuidle driver check in __acpi_processor_start() 38024286029f7 watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog 984e18de4fcf9 hwmon: (hp-wmi-sensors) Improve raw WMI string handling 63a31916448f4 hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler 7ddff1a7cc8ad Input: eeti_ts - publish the OF module alias 63c3d0435f2cd x86/fred: Reconstruct the #GP context for rejected INT instructions b2faf2cafd14f btrfs: check if there is space for chunk item when validating sys chunk array 9588850bfa75c btrfs: abort transaction on failure to update inode for hole punching and reflinking 37583946d8751 drm/amdgpu: check ras and obj before dereference bff8a8e53a6d2 net: skbuff: do not leave stale header offsets after pskb_carve() f0e7d62c1eb98 net: mvpp2: prevent buffer overflow in page_pool allocation 748b7a5aca248 net: macb: fix ordering around PTP timestamp read cfc1af3d054aa x86/kprobes: Fix crash when probing CS CALL instructions 1977c843c5777 x86/alternative: Refactor INT3 call emulation selftest a13cca5ba5375 net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() 598814c24620e net: stmmac: propagate FPE preemption-class mapping errors 4f33e036e827f net: ethernet: cortina: Ack RX overrun interrupt correctly d9f96bc2d8225 net: lock the socket in sock_gettstamp() 60ef74357a36e eth: fbnic: ring the doorbell if a burst ends in a drop 647b0ff3bdef3 net: netsec: fix device_node reference leak on phy_np 9ba5cd7430026 ASoC: amd: acp: fix ffs() operator precedence for SoundWire link ID a1b0456c90b1b ASoC: amd: acp: refactor codec config count in SOF SoundWire machine driver 32e85888af46b ASoC: sdw_utils: tidyup asoc_sdw_parse_sdw_endpoints() a4d56b384f825 ASoC: sdw_utils: tidyup .count_sidecar 91c2615e4dac3 ASoC: intel: sof_sdw: Add ability to have auxiliary devices 7939a4028c394 ASoC: sdw_utils: Add codec_conf for every DAI d1cb686d9ff12 ASoC: amd: acp: bounds-check SoundWire link ID in machine drivers 944e1a2c02250 ASoC: hdmi-codec: Report a change when the channel status moves 6d1c95803e1a5 ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments 4b7ecabd87dc4 btrfs: handle lack of space when cleaning up verity items 4a4294fe7cf7d btrfs: more trivial BTRFS_PATH_AUTO_FREE conversions 5468a4855b63b futex: Also allocate private hash on vfork() 0543813753ef5 powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba dfb8427493273 KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure fbf69b7d0555e KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() 82d4e43c6261a net: stmmac: do not overwrite phc_index when no PTP clock is registered 530ae0a145807 drop_monitor: fix out-of-bounds write in reset_per_cpu_data() 9616b0c67fbd8 drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown 1da515f2e3b27 drop_monitor: synchronize tracepoint unregistration on error path e2f5529b0016d pppoatm: ensure a writable skb header and linear data b8f71d69380a5 af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). bfce253f039eb Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup 18464860ce27a Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit 80f7bb41b0a83 Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown d42c798a14a3e Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events 49520ae0f2928 Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync e2b156a8d2596 Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() a5414b0a9464b Bluetooth: hci_qca: Do not write to the serial port after it is closed 18a9e9f0070f2 Bluetooth: qca: enable pwrseq support for WCN39xx devices aa7aba7164562 Bluetooth: qca: Refactor code on the basis of chipset names 7812a441617ad Bluetooth: hci_qca: Refactor HFP hardware offload capability handling dcaf10ef27f92 Bluetooth: coredump: Quiesce dump work on unregister 84f353256e170 Bluetooth: btintel_pcie: validate TX skb length in send_sync e220c1242a643 Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained bae65e4925928 dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() b0024111e4c2b ksmbd: keep compound responses on query info errors f86a9f901a941 ksmbd: fix partial file information responses bc616390103d4 ksmbd: return buffer overflow for partial filesystem info 7898bda1ebc19 tcp: do not let tcp_rmem be set below 4096 619bfbaacbff6 tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). d5c4ee1fa4e83 net: bridge: mst: move switchdev call outside rcu 72206aff346ff wifi: brcmfmac: fix lost 802.1x TX completion wakeup d6f63fdb298d5 net: fddi: skfp: fix NULL deref when setting the MAC address while down 1af2d87964d87 ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup 56db7ec462d6a net: bcmgenet: restore the hardware filters on open 2077a6997c455 net: bcmgenet: convert RX path to page_pool ddf60220c925b seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation 78cb2ee981594 drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL 441f80df60226 btrfs: tree-checker: print dev extent offset in error message 57bc3cd46458e wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() 8477643cb91c9 ALSA: hda: trace PCM open only after assigning a stream ee507691c18f9 drm/vc4: Use managed KMS polling to fix UAF on unbind 5d6c49d74a17e drm/xe/shrinker: Return the freed page count through a parameter fb2027f7e58c4 drm/xe/mmio_gem: Revoke drm_vma_node on xe_mmio_gem destroy 2a4555ed75717 drm/xe/mmio_gem: use write-back mapping for dummy page 6d726f1689cc7 drm/xe/mmio_gem: forbid VMA split 293c56a66510b wifi: virt_wifi: don't transfer operstate before register ea11ade10583c ALSA: 6fire: fix OOB write from device-reported iso length 999f433c09e46 ALSA: usb: 6fire: Avoid embedded URBs 84bfead4d4a1a gpio: virtuser: skip free_irq when no IRQ is installed 80f620951727a Input: trackpoint - fix the inertia attribute name in the ABI document 74b77820f923c spi: spi-qpic-snand: avoid writing QPIC_EBI2_ECC_BUF_CFG register e9aea09626975 ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params 2d3bc8ffb52f7 ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map 72f5fde1285d0 ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask 438f0ba25bb6b drm/msm/dp: fix link bandwidth check when wide bus is enabled dc57147549a10 drm/msm/dp: skip PUSH_IDLE when the link was never enabled d63f5a9f8121f ALSA: pcm: set timer->private_data before registering the PCM timer 3388f3b76ed0b phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting 7aa1360aca378 phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow 812ca56867bec ALSA: bcd2000: Fix race between rawmidi and disconnect 17ac813d4b78f neighbour: Skip default parms when resumed in neightbl_dump_info(). 8de873ba128f3 neighbour: Add missing RCU annotation for neightbl_dump_info(). b9d00ccdb40b5 neighbour: Convert RTM_GETNEIGHTBL to RCU. 982c7f66c0413 neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. 151c5a1e4fff0 keys: fix lost wakeup when reaping a dead key type daefd7ff159b0 drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr 739208827c0b9 arm64: hibernate: clone only the linear map that exists at runtime 7974314fe4cde perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations 12c1ac230f4ca netfilter: flowtable: hold reference on ct until flow is released 79084567cd082 netfilter: nf_nat: unregister and release hooks on error 197a03f5fa9d9 netfilter: nf_tables: fix device name and prefix match in hook lookup 0ce42c7b84032 netfilter: nft_nat: fully initialise new_addr in netmap setup ea27894904452 drm/msm/adreno: Fix the skip_gpu parameter description c30c774c2fa67 drm/msm: Fix the separate_gpu_kms parameter description b72dcfb9bf1f0 RDMA/siw: Bound fragmented header copies by the remaining length 38871ff47e2a0 RDMA/efa: Keep EQ resources alive while IRQ is registered d2a1c0bf4139c RDMA/efa: Keep admin queues alive while IRQ is registered 320bf29481fdf dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA c2337cb6d6f37 dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order 57537562b026c scsi: qla2xxx: Fix the ql2xfc2target parameter description f824f6b83b72f mm: memblock: show all region flags in debugfs 0fb37d2b6cb82 wifi: mac80211: set up the TX info early to fix failure paths 41bee71112db5 wifi: mac80211: mesh: release the channel if start fails bd3b21145ae2e wifi: mac80211: mesh: reset the CSA state when leaving ad5bd0f6a0c33 wifi: mac80211: add HE 6 GHz capability in the scan elems len c53040cf8bbdb wifi: mac80211: don't access the TSF of a down interface 7ef5774db0ed2 wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set 30c59052fe602 wifi: mac80211: don't allow link changes when iface is down fce36d242a18d wifi: mac80211: require a peer station for TDLS setup confirm 4b54d01b48445 wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown 73f48f7e16cad wifi: mac80211: don't allow injecting frames wider than the chanctx 5c79ef616aa16 wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping caa02072b2986 wifi: cfg80211: get the wiphy out of a dying network namespace d45bf731ec708 wifi: mac80211: unlist vifs when their netdev is unregistered 96bef5667b0c4 wifi: cfg80211: undo netns switch if renaming the wiphy fails fe50844cf94b1 wifi: cfg80211: restore netns_immutable on failures 5d5ff5b36f574 wifi: mac80211: reset state when starting AP fails 2e1d6e8014849 wifi: mac80211: abort chanswitch when leaving a mesh ae40190b7c5f3 wifi: mac80211: suppress chanctx warning for debugfs reset 9c34f01b8f217 wifi: mac80211: don't offload TC setup on AP_VLAN interfaces 5f139e17f5bdb wifi: mac80211: don't warn when an IBSS has no channel to scan 81baab8b645ec wifi: mac80211: don't start a ROC while scanning 6d2fd26185678 wifi: cfg80211: don't filter by BSS type when removing stale entries 86235be788094 wifi: cfg80211: only group hidden BSSes with beacon entries e8c75736cfd0c wifi: cfg80211: don't free driver-owned scan requests fc1f4884f1d46 dmaengine: wait for RCU readers before releasing dma_device 6cf31716b77a7 dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() 1a0d9b406febf dmaengine: Fix device kref underflow in dma_chan_put() 3b8633cae8b45 dma-coherent: report a failed reserved memory assignment 80aafcce8de2a MIPS: Octeon: apply USB FDT fixups also when USB is modular fa9ff3bb85a96 soundwire: cadence_master: wait and cancel cdns->work before clock stop a2cdb4a675ca0 wifi: cfg80211: check IP header size in cfg80211_classify8021d() 693d777846d52 wifi: cfg80211: don't get the radio mask for netdev-less wdevs 188b334a6db36 IB/IPoIB: Avoid restoring OPER_UP after multicast flush 14cb425ba1f3a wifi: libipw: reject too-short association responses 2c87bbc00dc93 wifi: libipw: reject too-short beacon and probe responses c2cf589c7d546 wifi: brcmfmac: cyw: pass PMKID to firmware if present 0969c9688389f wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 4f266738af456 wifi: virt_wifi: free skb when disconnected b96bc9784a61e wifi: mac80211: include TIM bitmap control for buffered S1G mcast traffic afc048e4d2acc dmaengine: sprd: Fix runtime PM reference leak in probe 8f253d5893f99 RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted 8433a15e414a1 RDMA/irdma: Enforce local fence for IB_WR_REG_MR 5091e25ec503f RDMA/mad: Fix receive buffer leak when PKey enforcement fails a0fb2007d00b4 RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup b96b8b3e41c30 IB/isert: wait for deferred control PDU completions before releasing the connection 6ed3ebaff3345 IB/iser: reject a remote invalidation of an unregistered direction 89d0406f77591 arm64: dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR 9d84572a2f7cb arm64: dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR 4a2cdf631dfb0 arm64: dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR 77ea927d924f4 power: sequencing: Fix build issue with COMPILE_TEST a219459fbd1b2 RDMA/core: Reject unregistering netdevs in ib_get_eth_speed 9cd08fdca43f6 RDMA/mlx5: Remove warn on missing representor in query_port_speed 02c0a2fa69c16 RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds c6f56982ec5c7 RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths e1188332a9110 clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate 69ec03cd48197 firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS 2f3b705144e3a RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access fe602c91a52e1 RDMA/rxe: validate access flags before swapping the MR's PD 9dcc0f4e488b7 RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept 593436d6e69f2 ARM: socfpga: select the PL310 erratum 753970 workaround 6cab554f2c0f2 esp: downgrade zerocopy managed frags before mutating skb frags 6eb3b071be8e2 xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() 248433942155b xfrm: fix compat ALLOCSPI request use-after-free c2c6e6f45f309 xfrm: avoid RCU warnings around the per-netns netlink socket a7018ee0ea862 xfrm: iptfs: fix runt reassembly panic from short inner tot_len 7e1c6884a0b49 xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk() e62a16848bf2c ipv6: Honor oif when choosing nexthop for locally generated traffic 94671f802bb07 ipv6: Select best matching nexthop object in fib6_table_lookup() ba9d1d3524664 media: video-i2c: fix buffer queue ordering 06724dd3da2e8 sunvdc: fix -EIO issue due to lack of retries 38984b41f9950 selftests/landlock: Add audit test for whiteout object creation ea9965b9474b1 selftests/landlock: Add tests for whiteout object creation 74bdf27404c24 selftests/landlock: Use an actual chardev for MAKE_CHAR audit test ac0a0d7696aa9 selftests/landlock: Add disconnected leafs and branch test suites f289962f00450 selftests/landlock: Add tests for access through disconnected paths cdc543c9eceb5 selftests/landlock: Explicitly disable audit in teardowns 3d6f8e2556d5a selftests/landlock: Increase default audit socket timeout 1be91aa4f5dcb selftests/landlock: Fix socket file descriptor leaks in audit helpers d54c0ec29dfa3 selftests/landlock: Add missing connect(minimal AF_UNSPEC) test ab115d19fb2c2 selftests/landlock: Add test for TCP fast open 27d09eaa8b5f2 landlock: Fix TCP Fast Open connection bypass 8c3b2bf7f39c7 Revert "perf annotate: Fix build with NO_SLANG=1" e8694cdbd7db9 Linux 6.18.53 a0a64525f3414 mptcp: fix bad accounting in __mptcp_subflow_push_pending() a09c87abf10a0 mptcp: close race between scheduler and state change b2dbcc1ed48b5 mptcp: avoid unneeded actions on subflow reset 97e684ddf082a mptcp: move the stale logic out of retrans scheduler 74a2626044de5 x86/mm: Fix and document DEBUG_PAGEALLOC 100b6b39fe201 misc: amd-sbi: Add null check for devm_kasprintf() 73867f2536704 drm/ttm: Fix bo resource use-after-free 329ddc5d438f9 drm/ttm: Drop tt->restore after successful restore b21c971e4cb11 drm/ttm: Tidy usage of local variables a little bit 9d9f6e0612300 smb: client: use atomic_t for mnt_cifs_flags 2ef532a01f446 smb: client: fail DACL rewrite when the new DACL exceeds 64K 7de073bbfed44 smb/client: fix security flag calculation when setting security descriptors 16971cac56f2c smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl() 374da2b9be128 mptcp: prevent race between disconnect() and rtx e2e10b5a45e1e mptcp: do not reschedule the RTX timer for fallback sockets 2b27760d6b9d9 tcp: remove icsk->icsk_retransmit_timer 1f4f1db8794b1 tcp: introduce icsk->icsk_keepalive_timer d87f96c0d7794 tcp: rename icsk_timeout() to tcp_timeout_expires() 4a17c73c83798 bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() a534569b5cd70 Reapply "bnxt_en: bring back rtnl_lock() in the bnxt_open() path" 08dd1b268b4bc fwctl/bnxt_en: Move common definitions to include/linux/bnxt/ 4d5834f38b725 mptcp: pm: reset retrans_time when ADD_ADDR entry is reused 379efd2ce8b26 landlock: Fix use-after-free of the source's parent directory c0c40a8f5dc42 landlock: Use mem_is_zero() in is_layer_masks_allowed() 8e4cc46aa847f landlock: Transpose the layer masks data structure b4e4655ba6017 landlock: Add access_mask_subset() helper 726264e266e1d landlock: Clarify documentation for the IOCTL access right 7e43129537882 idpf: disable DIM work before freeing q_vectors 524b781d6553c idpf: introduce idpf_q_vec_rsrc struct and move vector resources to it f21cc1e6b7349 idpf: introduce local idpf structure to store virtchnl queue chunks 1d98a5327fae5 idpf: Fix kernel-doc descriptions to avoid warnings e9acb45de8517 erofs: add sysfs feature entry for xattr prefixes b734ae4b0d897 erofs: separate plain and compressed filesystems formally a7d52d8fd501a net: macb: initialize PTP state before registering clock a9e3ae205f7ee net: macb: unify device pointer naming convention 482c1c7e8fcb0 net: macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI 061d8ae82c29c net: macb: Replace open-coded implementation with napi_schedule() bcb0936862f2b exit: hold a reference to thread_pid across proc_flush_pid 34d66c6cf3b54 ns: rename to exit_nsproxy_namespaces() 4567df9e2d91f ns: add __ns_ref_read() a7fdd86c386b7 netfilter: cttimeout: prevent UAF during module unload 44583fd5735cb netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount 2cf03ada03532 EDAC/altera: Use parent device for devres in altr_portb_setup() 962d03bd349c6 EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout 51b07104d563d tracing: Undo the registration when enabling the histogram trigger fails 2ffaade3611bd tracing: Take the reference before publishing the named histogram trigger cfad128171f8e tracing: Set the trace clock before registering the histogram trigger 3caff4fff9882 tracing: Merge struct event_trigger_ops into struct event_command 22eb27cdede65 tracing: Remove get_trigger_ops() and add count_func() from trigger ops c66e138af626c xfs: initialise args->total for parent pointer updates a0c5594541723 drm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work() 037a00dfd5838 drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output 6194e1b536dc6 drm/amd/display: Propagate HDMI RGB quantization selectability fab569a69c3ae drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches 925d9aa99a69d drm/amd/display: Rebuild InfoFrames on output color space changes cc580cee4dfa2 io_uring/rw: end write accounting from ->ki_complete 508387ad95ef9 genetlink: pin family module during policy dump 8d4343a411eaa bootconfig: Fix integer overflow in initrd size check 6ac44525905e7 init/main: read bootconfig header with get_unaligned_le32() 84e0cd79d57f0 x86/mm/pat: Allocate split page tables as kernel page tables e21a9ea81426a x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF 5029589bb7736 x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled() e164f4a25e23d x86/mm/pat: Convert split_large_page() to use ptdescs 5d7cbfb65e47c configfs: unhash the dentry before dropping the item in rmdir 0264b3ee09b11 ipmr: account multicast table and route memory e4331c6644db8 drm/pagemap: dma-unmap pages before handling migration errors 8d1adc3a058f9 drm/xe/i2c: Keep the i2c controller always enabled f87259781afcf i2c: designware: Global register definitions dc136795f9997 drm/amdgpu: avoid force-completing uninitialized UVD rings a335084eae7a1 drm/amdgpu: plumb timedout fence through to force completion f90d671463def drm/amdgpu: Make amdgpu_vm_flush() non-failing in submission path aa0136206cea8 drm/amdgpu: reorder IB schedule sequence 3d0162c5be362 drm/amdgpu: add a helper to calculate ring distance 015a7b68166c2 drm/amdgpu: Fix missing unwind in amdgpu_ib_schedule() error path e3c417ad50e63 f2fs: reject setattr size changes on large folio files e7a068672b4c5 Revert: "f2fs: check in-memory block bitmap" 9042867d47017 fou: Fix use-after-free in fou_create() ca31116fad095 f2fs: accurately adjust free_sections during free_segment_range 172dbcf813034 f2fs: fix to reclaim space in f2fs_allocate_pinning_section() 23eee01c732ec f2fs: embed f2fs_gc_kthread in f2fs_sb_info 35c5abccd0924 f2fs: limit recovery filename logging to stored length db13064669526 f2fs: validate MOVE_RANGE destination size 740f3458a4798 scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] b211d138cad86 scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock a95fc5f1c12bb scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error 359be8dd92a82 scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity 6e6c2ba9022eb scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature 6ee6dfd922faf scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot 78dada069bb44 scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs d61e8de98c5a5 scsi: qla2xxx: Skip vport under deletion in report ID acquisition 20b51ce082392 scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate 48a44e19746ea scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size 1710a69fd74d0 scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown f35cb67f2092b scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking a57570229edb7 scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path fff1ae8d0c8c9 media: qcom: iris: fix runtime PM reference leaks a91f4445077f8 media: remove conditional return with no effect 0454bf9b89c2e media: iris: turn platform data into constants d6e2411516bb9 scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak c343348473e71 media: chips-media: wave5: Add timeout while stop_streaming 83899a056aeb1 net: appletalk: fix NULL pointer dereference in aarp_send_ddp() c4b478bc50b7c i2c: smbus: reject oversized block transfers in the common path 7654812b65047 net: usb: pegasus: don't rely on id table pointer arithmetic 41a52d7e5f193 media: as102: do not rely on id table address comparison 3236431de8e51 usb: serial: spcp8x5: don't store usb_device_id 7442ff49371a5 usb: usbtmc: don't store usb_device_id 9d5e396578097 wifi: ath9k_htc: don't store usb_device_id 8944ef1bfda53 usb: xusbatm: don't rely on id table pointer arithmetic 101c68f6aed4f xdrgen: Fix union declarations 095e8d6e183ef Revert "arm64: dts: qcom: kodiak: Fix the PCIe iommu-map entries" d6e796c6ee721 Revert "arm64: dts: qcom: sar2130p: Fix the PCIe iommu-map entries" c2be076fa3ea7 Revert "arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries" 3922eef51fb75 Revert "arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries" 2708a8804d78e Revert "arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries" 1c58d6d3ebc37 Revert "arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries" 2b1d21337b37c Revert "arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries" c100af5dca42a Revert "arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries" 8ecf63859a17a Revert "arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries" bf61c869a6268 Revert "arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries" e0a03ff2cc815 Revert "arm64: dts: qcom: sm8750: Fix the PCIe iommu-map entries" e3a0e9a69f24c Revert "arm64: dts: qcom: talos: Fix the PCIe iommu-map entries" 7cca135e071ed Revert "arm64: dts: qcom: lemans: Fix the PCIe iommu-map entries" 7fdedca1d7bf7 Revert "arm64: dts: qcom: qcs6490-rb3gen2: Fix the PCIe iommu-map entries" ffd3a3df92be6 crypto: ccp - Fix possible deadlock in SEV init failure path 868c9038ffd4a ksmbd: don't hold ci->m_lock while waiting for a lease break ack 26d271aeb294f hwmon: (sht4x) Add missing locks 3f3f0f2d9847f smb: client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_range 3889bfff07ebf xfs: actually check internal-rtdev fields in the superblock 01b369500819f xfs: actually recover intended file sizes in xfs_xmi_item_recover_intent 0d51c607d80ab xfs: advance the findparent inode scan cursor while holding ILOCK 82a0fd3fe9089 xfs: bail out on bitmap errors in xrep_agfl_fill 2828fa1b51245 xfs: compute dquot checksum after resetting dd_lsn in repair 7418db04b8ccc xfs: count escaped corruption errors in scrub stats e1c9eba9ba78d xfs: cross-reference the rtgroup superblock extent, not block 0b756de8167f2 xfs: destroy seen inode bitmap when we fail to add a dirpath 7791970a76a3e xfs: don't leak dqacct if rhashtable insertion fails 176a53af77b43 xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails b7bf0cffd41b5 xfs: don't modify file attributes or poke fsnotify for dry runs 08754ebfa5c28 xfs: don't spin forever on zero-length dirents when salvaging them 6428adc1f8846 xfs: fix backwards mergeability logic in refcount scrubber 7756adee4e5a3 xfs: fix backwards skipping logic in xrep_quota_block 9417c1ecabc98 xfs: fix bnobt repair space reservation disposal failure fac32b9950a2a xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN 97fb5eb106f72 xfs: fix name string recording in slowpath pptr tracepoints e4e9ff719d516 xfs: fix parent rec lookup initialization in xrep_metapath_unlink aafc5bd3b014f xfs: fix reclaimed page accounting in xfs_buf_free 0040931d8b6f0 xfs: fix replaying dirent removals into the temporary directory 0f35ecedbef4f xfs: fix rtrefcount btree block counting in scrub 725ac9b344f7c xfs: fix rtrmap cross-referencing elision logic 044e1d972ecb8 xfs: fix short ifork reaping computation in xreap_bmapi_binval 108114437915e xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions b5089a328acc8 xfs: fix unit conversions in per_binval computation 2608354447376 xfs: fix xfs_rtrmapbt_mem_cursor for non-rmap filesystems ba949a14446b7 xfs: initialise error in xfs_defer_finish_one() 14ee7065cec64 xfs: log the tempip after we convert it to extents format 34c680b304664 xfs: make the rtsummary repair fix the file size too 6c12138eb088b xfs: preserve owner on in-memory btree creation 11c88bda09a36 xfs: release alleged child inode on metapath unlink error 57571fc7d9837 xfs: report healthy filesystem events in scrub stats 5c0e09d2e7aaf xfs: report nonexistent parents as a filesystem corruption afc5d6a24e14d xfs: reset parent pointer args before each dir tree unlink repair 058fc52fe461f xfs: signal inode btree xref error if get_rec returns an error 10b36be799c2b xfs: snapshot old AGFL before rewriting it e119d04706c9c xfs: snapshot scrub stats when rendering them 5a2c84b85ab8f xfs: strengthen the "is cow staging" helpers in scrub f268dd1cff0a7 xfs: truncate quota file correctly when repairing quota file 9f31c752733ff xfs: use the rtgroup extent count to find rtrefcount gaps 7fa84c9ca6906 smb: client: fix heap overflow in DACL owner/group rewrite dd03fd658ea59 smb: client: avoid leaking refcount when cifs_sb_tlink() fails 2ed2c29dd9593 smb: client: avoid leaking refcount in cifs_queue_oplock_break() 99daf75354451 smb: client: fix file type corruption in wsl_to_fattr() de54fde4c1861 smb: client: fix file type corruption in posix_reparse_to_fattr() 73bd76e223e88 smb: client: fix file type corruption in cifs_reparse_point_to_fattr() d1f173d28e964 smb: client: fix one-byte OOB read in smb2_parse_native_symlink() a6b6561522212 smb: client: pin DFS superblock in iterator callback 0f1f77b821506 smb: client: reject short READ responses in CIFSSMBRead() 96751028c0d4d smb: client: reject userspace cifs.idmap descriptions 78304f78c0956 mptcp: pm: userspace: fix address ID overflow d4a67a880654e mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 b193ecbd35c2d selftests: mptcp: fix an UAF in mptcp_connect.c 00b2bd518911e mptcp: syncookies: remember the request backup flag 109c192f906b6 mptcp: subflow: no need to copy thmac during ulp_clone 75f58acf5feb6 mptcp: options: handle MPC data + csum reqd + no csum c8050386a2209 bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() b4c40f2c80d7b bnxt_en: Propagate RX ring init failures in bnxt_init_nic() 8ade95619cbfd bnxt_en: Don't free the live ring's TPA state on queue restart failure cc647816fe6a6 bnxt_en: Only restore LRO if the device supports TPA c8891da0186fe media: v4l2-ctrls: validate AV1 tile counts c7b1ef6dc57f4 media: v4l2-ctrls: validate HEVC tile counts a41babf528f70 media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity 8f19d869a9f68 media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer 000b2a6eae2e3 media: v4l2-h264: Fix memcmp() size in B1 reference list comparison 7992059c04578 media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity 4f654c9bc9545 media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity 05720a828096c media: hevc: add bounded tile-count helpers 02d647428ab1d hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS 30755d3a5782c hwmon: (gpio-fan) Fix use-after-free in alarm work 21d2b1111abf7 hwmon: (chipcap2) fix channels in humidity alarm notifications 4d4ce5c3a136f hwmon: (applesmc) fix key backlight workqueue leak on register failure c7f77a11a1e71 afs: Clear stale peer app data after address list changes e5bc0fa9959dc afs: Fix incorrect free in candidate cleanup in afs_lookup_server() 9d6c703e24da3 afs: Fix double-unmap of directory block c5fa4eb9c4b2c afs: Fix missing kunmap in afs_dir_search_bucket() d508312d12ca1 perf: RISC-V: use BIT_ULL for u64 overflow masks 9bec7beaed074 perf: RISC-V: store available counter mask as bitmap f6b263679aa72 s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly 972e0d9b7d1d1 s390/crypto: Fix wrong return code to engine in asynch callbacks 7d1456d54b3c7 s390/crypto: Fix missing scrub of temp buffers with PAES algorithm 203702f0013f9 s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine 2ea6c036bb922 s390/crypto: Fix missing cra_flags in paes_s390 8b90a47c4fba2 s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm d722410191383 s390/crypto: Fix use of mutex in atomic context 35c3f97569306 s390/crypto: Fix skcipher_walk return code handling in aes_s390 8407815ae6371 s390/qeth: allow bridgeport queries despite OS_MISMATCH d0502ed0a1aae iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX 5aa22d76c193b KVM: PPC: Book3S HV: Set irqfd->producer only on success 07f0214018d72 mac802154: fix use-after-free of sdata via queued RX frames 50c3f06222eaf ipvs: reject invalid states in connection template sync records 2f1a6dd5c80ce ipv6: flowlabel: cap duplicate leases per socket fe9a906d2bff2 ipv4: fib: bound automatic table ID allocation d3b8f264ce095 ieee802154: hwsim: serialize pib updates to fix double-free c68fd52c73b67 ieee802154: cc2520: fix FIFOP work use-after-free 98ce5a42cde78 ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink 7cb5f4643a7fc inet: frags: invalidate queues before flushing them 5ff1effb047e4 fbdev: vfb: defer cleanup until the last reference 0b3c8c39e5024 erofs: preserve LZMA decoders on resize failure 9933ad1c4ff67 fs: autofs: fix memory leak in autofs_fill_super() 7466511903662 scripts/sorttable: Mark long_size as __maybe_unused 1efc978dc626b vdpa: solidrun: Free IRQs after request failure 5ae2dab5d88e5 vdpa: ifcvf: Put device on unsupported feature error 669fb15936356 netfilter: report NLM_F_DUMP_FILTERED when all is filtered out 64803ba0a0579 netfilter: nf_log: unregister loggers before per-net teardown 3d038eebdbd40 netfs: Fix uninitialized return value in netfs_unbuffered_write() ca5d2cbd7a307 net: phy: dp83td510: handle the active-high LED polarity mode a0d18d21d48a5 net: openvswitch: fix use-after-free of the flow table mask array da8c3a7f5d313 net: mpls: clear inner_protocol when the last label is popped 1e43c407624d2 net: mana: Reserve extra CQ slot for the fence completion CQE 49d592d5fd4dc net: hso: fix TIOCMIWAIT race 709451db123d9 net: dsa: tag_brcm: legacy FCS: request needed tailroom 994fd705ca498 net: bridge: use option bits for CFM/MRP frame handlers 64b36eaef6ea5 net/sched: act_api: release all action references on NEWACTION failure 9fd4ea952e6ac ring-buffer: Check resize_disabled before publishing the new subbuf order 136b443a69fb5 ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() 927d96f91c582 io_uring/net: don't overconsume buffers when using MSG_TRUNC fa5c0449f5faa io_uring/net: let io_recv_buf_select return the length of the buffer region 25dceb2c326e0 drm/sched: Create a fake device for KUnit tests 49f5268f43a79 drm/rockchip: analogix_dp: fix unchecked bound endpoint name length 9ac6db531abe9 drm/i915: Fix memory leak in query_perf_config_list() f3e74866018da drm/drm_exec: fix up contended obj when num_objects is 0 2831917ace195 drm/bridge: tc358768: Enforce input bus flags via atomic_check fc105d2621cd6 function_graph: Use the saved entry's size when reprinting it 76e478499913d fs: don't return -EINVAL for successful nested thaw 19ddef61ee0a4 exec: do_close_on_exec() before taking exec_update_lock 27c9b491bf760 cpufreq: initialize policy rwsem before sysfs publication 6e166b9281dec cpufreq: zero-initialize policy cpumask before sysfs publication 422f654725965 Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 2dcc2240b4e5f Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev 998ca92f69bc4 ASoC: sti: initialize IRQ lock before requesting IRQ ff63b0adc4f6a ASoC: sprd: validate compress buffer sizes against fixed allocations 5d06257359c90 accel/ivpu: Limit firmware log name prints to field size 40868f80a8919 accel/ivpu: Validate firmware log buffer metadata 43c68f52aecd5 accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr c80b2a8067d58 tracing: Keep the entry count when the histogram stats allocation fails 37b09bf1dbd91 tracing: Let histogram values keep the percent and graph modifiers b22dc0add7d72 tracing: Free histogram the field rejected for a bad modifier 4cff53bb19412 tracing: Free histogram var refs regardless of how often they are referenced 222abcbe7866f tracing: Free histogram the var ref when its initialization fails 0892da2272ec5 tracing/user_events: Don't destroy fields when event removal fails fb40c5a7eae89 tools/bootconfig: Fix integer overflow and truncation in size checks 3525b94b2f258 tick/broadcast: Plug clockevents replacement race 04b943f8756b0 tunnels: Drop stale dst when building an ICMP error for PMTUD 87b12dc360a00 ufs: validate cylinder group metadata before caching it 785e523b6c193 ufs: create the root dentry after loading cylinder metadata d60a3dbf176bb virtio_mmio: disable IRQ wake before free_irq e1daf1ef08e7c watchdog: sunxi_wdt: preserve boot-enabled watchdog 054022c8e74fe drm/amdgpu: skip gfx switch_power_profile during GPU reset 784f4e9a0bd6b dm/amdgpu: fix malformed link_settings debugfs output 26a9a55b58747 Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set" b0c30fe6c0d59 ALSA: usbusx2y: validate URB actual_length in interrupt callback 381495b5b3da1 ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf d9c537b14f498 ALSA: us122l: Prevent write upgrades for read mappings dba9369467af1 ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough fec4470173562 drm/panic: clean new `clippy::needless_range_loop` lint for Rust 1.100.0 f1bc7c7cfbc97 rust: allow `unknown_lints` in generated bindings for Rust < 1.88 d6e72b82f2144 rust: allow `clippy::as_underscore` in the generated bindings 9e026a91fe799 tracing: Fix memory corruption from a "STACKTRACE" histogram key 141f7ddee571f tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event() 57bfc2a17954d tracing: Fix memory corruption from the histogram stacktrace modifier ad72e2566643f reboot: fix cad_pid use-after-free race b89b691dd00bf ipv6: fix fib6 walker UAF on seq stop 281e6f536f2f3 x86/alternatives: Exclude text poking against change_page_attr() 35820cf8dd521 x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF cd9b4595d6283 x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash() 55ddbc2ca6d5d x86/mm: Fix user-space data loss with MADV_FREE and THP 84e3a71d11d85 x86/amd_node: Fix PCI device reference counting in amd_smn_init() 5206e1b65a49b crypto: x86/aria - add missing vzeroupper in AVX-512 code 8764a17eab6b2 crypto: x86/aria - add missing vzeroupper in AVX2 code fcd19bc829eca x86/amd_node: Fix potential NULL pointer dereference 9273a90465d58 x86/amd_node: Avoid divide by zero on virtualized systems eb47c2e85d6b8 powerpc: pci-ioda: Fix the stale irq chip reference 2920af33d097c powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver 05ae635ca64eb powerpc/ps3: Fix repository.c build failure 4f54beb2e7f6d configfs: pin the symlink target's dirent instead of chasing ->ci_dentry cd2bcee450bc9 ksmbd: prevent out-of-bounds reads in share config responses f6f6351e98c77 scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands 7c3d16e2d70cf scripts/mksysmap: fix escape of '$' in the __pi_ pattern 1bc4b322209fb scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms 6bf73fc588da7 erofs: add missing buf->off in erofs_bread() 57835952566f0 sunvdc: unmap LDC cookies when the descriptor send fails 447a4c362d9c4 openvswitch: fix wrong flag value in get_ipv6_ext_hdrs() 709eb0aad071c net: hsr: enable promiscuous mode on interlink port with fwd offload c28175220f808 net: stmmac: fix TX descriptor availability check for TSO traffic 29bc25bdfbbe4 net: stmmac: add TSO check for header length bd658b924befd net: stmmac: add stmmac_tso_header_size() 47411c5489369 net: stmmac: fix TSO support when some channels have TBS available 8cbfeb54bf781 net/rds: fix tcp stream corruption with large pages 5b3cdc9abd82b net: mana: restore the XDP program pointer when pre-allocation fails f1fd43ada27ed net: phy: dp83867: handle the active-high LED polarity mode 13b79c3475955 octeontx2-af: fix PF/CGX debugfs PCI bus lookup 4b20e66d2e52d net: net_failover: Fix the deadlock in net_failover_slave_name_change() 63756bdb693be net: phy: mediatek-ge: disable EEE on the MT7530 PHY 9edd644864787 net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support c364e92326809 net: ethernet: mtk_eth_soc: fix supported_interface set after phylink_create 3bfd924b4c415 net: ethernet: mtk_eth_soc: avoid writing to ESW registers on MT7628 3c367198e2e28 net: dsa: mt7530: populate lpi_interfaces to fix EEE support fe997254b17dc net: dsa: mt7530: add EN7528 support 9f6ad383901d0 net: hinic: fix mailbox segment buffer overflow 7aa02f2d88289 net: sun4i-emac: fix missing of_node_put() for phy_node 503ba58481e3b net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). 6cb09c50e6950 net/sched: cls_route: Fix in-place replace 84a02ebd1af2d net/sched: cls_route: Reject handle aliasing f8495d67434e1 net/sched: cls_route: free emptied bucket on filter move a7bdefb1e0096 sched/core: Call wq_worker_tick() for the execution context abb62a1cde7a7 sched: Account cgroup CPU time to the execution context 17eac15a45c54 sched/eevdf: Fix rb augmented with multi fields 0ac7bc0c06fea sched/eevdf: Fix augmented max_slice a5fe19dd8b3ed perf/x86/intel: Prevent drain_pebs() reentry 84874ffde459d perf/x86/intel: Correct pt_regs->flags update for PEBS path 997a27ce79b7f perf/x86/intel/ds: Factor out PEBS group processing code to functions 6d0b9ce3be221 perf/core: Allow list_del during perf_event_overflow() 5f1c9972cb274 selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value dcaba72c85c14 net/mlx5e: Move representor vnic reporter to eswitch devlink port eab1eec4fd049 net/mlx5: Register SF resource on PF port representor 95e281451039b devlink: Add port-level resource registration infrastructure 0ae06df01c929 devlink: Refactor resource functions to be generic 25cc0096efba8 net: stmmac: initialize ptp_lock at probe time 0996c3e6bcc6a ppp_synctty: ensure a writeable skb header bfb74c48ac2d3 vxlan: initialize _md in vxlan_xmit_one() 621c99be42e3f octeontx2-pf: reset HTB scheduler topology before freeing queues 2231c7f0067b4 hwmon: (nct6694) do not expose enable on DTIN temperature channels a5de53b08cc31 hwmon: (corsair-cpro) Remove debugfs entries when probe fails 6f0c3c5fcfd92 hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors 9c237c7eb0e87 hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() a58a966a44007 hwmon: (corsair-cpro) Create debugfs entries after hwmon registration 74bab088a7152 net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down c0870eeb5234b net/micrel: Fix typos in micrel driver code comments 312a6da9f42a0 net: dsa: lantiq_gswip: fix GSWIP_MDIO_PHY_FCONTX_EN value f324ff4f69c3c watchdog: msc313e: Sync timeout value if WDT was running at boot abda3de184785 watchdog: msc313e: Fix undefined behavior 037a82b74597a watchdog: msc313e: Fix spurious reset on suspend cf078e4322f10 watchdog: msc313e: Enable clock before accessing hardware registers 2abf99a57b0b7 watchdog: msc313e: Fix clock leak and spurious timer in settimeout() 47eae41c630b9 watchdog: msc313e: Avoid division by zero a67224b15bd25 watchdog: fix hrtimer start when pretimeout is zero d1fcb4c69f7e4 mptcp: remove unneeded READ_ONCE() annotation 5fba30080d298 net: macb: put the "mdio" child node reference on success e92a45b872b03 net: macb: destroy the phylink instance on the probe error path e7ff91f19c1aa ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() 03da1d13b0c01 net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() 8b28ff3728e41 Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset 61e9bf51c6df9 Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset eeabdb25c3209 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() 115d94b4ffe2d Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware 932a87444107e Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one 73a50c636425c Bluetooth: btintel_pcie: validate packet_len before skb_put_data 93b59937bda3f Bluetooth: btusb: Fix UAF of btusb_data by rx_work 0b0d2f9db2406 eth: ice: don't dereference pointers from TP_printk() f5463bc124c0d ice: add missing xa_destroy for sched_node_ids 325ed97a75518 idpf: account for VLAN header when parsing RSC packet header b3c5dcf9ae702 ALSA: hda: Report a change when only the channel status bytes move 89a5a885e45cd drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER be638c93d0a3e drm/adp: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER 34b968b0f912d net: ethernet: cortina: Count RX descriptors for freeq refill adc42c548c259 net: ethernet: cortina: Count RX drops once per frame 2368a3636634c net: ethernet: cortina: No mapping is a dropped rx cceb6cd7f0e5e net: ethernet: cortina: Count dropped frames as NAPI work 8b1330a102081 net: ethernet: cortina: Finish RX updates before NAPI completion 0ef8eaef5806c net: ethernet: cortina: Fix budget accounting 561ec9bd6eef1 net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward ce66352d3eb21 net: ipv6: Fix UDP length overflow with PMTU discover and big MTU 83fedc4741210 net: ipv4: Fix UDP length overflow with PMTU discover and big MTU d5dd55b316ca2 af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer. f1816b3d7ce80 af_unix: Update last skb marker in manage_oob(). a3ba86a270dd8 virtio_input: stop callbacks before unregistering input device 8407da8974326 virtio_input: reset device if input_register_device() fails 345dd80239556 virtio-pci: return IRQ_HANDLED after non-zero ISR 3af20238a09ca vdpa_sim_net: check TX pull result before RX copy a8a1413a2cfdb vdpa_sim_blk: reject out-of-range sector starts 5a075ee239892 vhost-vdpa: protect config_ctx from being freed under the config callback 65faf9eaa00e4 vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx 68232102f20fc vhost/vdpa: reject VRING_NUM larger than device max a80c33488e0bb virtio_console: do not free control-out buffers on remove 77dbd10a701a3 virtio: fix use-after-free in unregister_virtio_device() 42ccf20c5318e irqchip/gic-v5: Preserve ICC_CR0_EL1 state f76e4622ad037 ASoC: mt6351: Publish the OF module alias 465dba4a4380a netfilter: ip6_tables: set F_PROTO when proto value is nonzero 1a7a8ac9a9f0a netfilter: nfnetlink_log: cope with concurrent instance destruction d082265bb2c6b ASoC: Intel: SST: Publish the PCI module aliases 32ca4438c15d5 ASoC: bcm: bcm63xx: Publish the OF module aliases 267f7f78205cd hwmon: (sht4x) Fix return value from heater_enable_store() 97fe732231677 hwmon: (sht4x) Rely on subsystem locking d54d0b6766b7a Documentation: hwmon: replace full-width colon by a standard ASCII colon ec894ec755fd1 hwmon: (ina2xx) Decouple in0 and curr1 alarms 73f86661d5c1b hwmon: (ina2xx) Replace masks with enum in alert functions c95160c296c8a hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() 75824defbb6c6 hwmon: (ina2xx) Rely on subsystem locking 1961b2fe8e680 hwmon: (ina2xx) Acquire hwmon_lock in shunt_resistor_show() 8afab57bcdbc2 hwmon: Fix potential UAF in pec_store 7d72088801e77 Documentation/hwmon: Document hwmon_notify_event() 80b46a3d066d4 hwmon: (ltc4282) Make sure clk_init_data is fully initialized 01536047c2b73 iommu/amd: Fix premature break in init_iommu_one() again 94458b80d3b20 iommu/amd: Do not reallocate GA log buffers on resume b575a8fe6d647 iommu/amd: Add NUMA node affinity for IOMMU log buffers 13fbbb2a8caf0 iommu/riscv: Disable SADE 36b08f2f009e1 iommu/riscv: Add command queue lock 0c1b907d5db2f ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev e2e1161e03fec bpf: Reject non-scalar bpf_loop iteration counts 5710f6a74f63c net: macb: fix NULL pointer dereference on unbind with fixed-link 3ec7974b3f3e8 net: macb: rename bp->sgmii_phy field to bp->phy 8f80b113dea0b net/sched: ets: clamp quantum in parse and fallback paths d43cded350fe1 net/sched: drr: clamp quantum in change class e2a9a08303e5d net/sched: pie: clamp psched_mtu in pie_drop_early b9f96ce6eb4f3 net/sched: dualpi2: clamp psched_mtu at all call sites 2e77947bbf6c1 net/sched: hhf: clamp quantum in change and init paths 534cd7ecbbc6e net/sched: sfq: clamp quantum in change path c11e3a39807eb net/sched: fq_pie: clamp quantum in change path 4d3f907dc2b7b net/mlx5e: Keep HW timestamp stats monotonic across reconfiguration 72cfcb79026cf net/mlx5: E-Switch, prevent mc_list repopulation during vport disable e393789e92310 net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put 72324da8eeca2 net/mlx5e: Fix use-after-free race in sample_restore_put() 9f23cf6dcb3a9 net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% b3f2e71cb9ea1 net/mlx5: LAG, use local tracker to update active ports 50de5ca2210c2 net/mlx5e: Fix setting RS FEC after remapping a00bcb277e0cc net/mlx5e: Fix missing FEC mode mapping for RS_544_514_INTERLEAVED_QUAD 156a3bab69744 net/sched: defer qdisc freeing after failed creation 765c5e357e679 net: mctp: i3c: serialize probe with bus removal 1a01c88f51f19 powerpc/kexec_file: Use inclusive range checks for excluded memory 67b4df34f893a powerpc/kexec_file: Use inclusive range checks in add_usable_mem() 6410209796805 pds_core: don't release PCI regions for VFs on reset fa31bd14c5042 pds_core: fix cmd_regs access racing BAR unmap on reset 2fd0880f0272e net: reject oversized tx_queue_len at netlink parse time 081340cf70a78 net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations 53359916ceb64 vxlan: reject dynamic fdb entries that reference a nexthop id eebb6a9017b55 s390/ism: folio_put() after error 2afd5c230e720 dibs: Unregister dibs_class after error a1f77c6c7d8d4 dibs: change dibs_class to a const struct 0e079bbdcee72 dibs: Remove reset of static vars in dibs_init() 659654654eb14 net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow 5a0d7f40624aa ionic: use netif_txq_maybe_stop() in ionic_tx() 0866936086cfb octeontx2-af: mcs: Clear stale X2P calibration state before calibration 38ab2a435001a net: bridge: mcast: properly convert mglist to rcu 7a683c2b06281 net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size edaec279f59f8 eth: nfp: drop the replaced rule from the list when reprogramming fails a7e023c63e855 eth: nfp: bound the ntuple rule dump by the caller's buffer size fd1a78c16b1f6 net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size f27ac16357cfa bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() d643cea424866 nexthop: Initialize extack in remove_nh_grp_entry() fc204636300bc selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0 d6917eebe1798 tracing: Fix to avoid creating trace instances with duplicate names 96e2a8ab80587 tracing: Add boot-time backup of persistent ring buffer 135d542b97fa9 bpf: Reject untrusted allocated-object pointers 0bdd6121c8dd5 bpf: Require MEM_PERCPU for percpu kptr stores 5dc188b191513 thermal: sysfs: switch to use scnprintf() to suppress truncation warning e2ae33247e8b2 bpf: Don't predict JMP32 pointer vs zero comparisons 3484a99303912 bpf: Reject legacy packet loads from callbacks 3014e8a8bdad5 bpf: Mark faultable stack helpers as sleepable 4d8784226bd3c bpf: Mark bpf_btf_find_by_name_kind() as sleepable b545fa447e09e bpf: Check ancestor frames for rbtree callbacks 4965cf2770069 bpf: Track verifier instruction stats for each subprogram f9b36239f3a7a bpf: Report maximum combined stack depth 81a8cc0f81a64 bpf: Print breakdown of insns processed by subprogs 2b3abe0e90046 bpf: share several utility functions as internal API ba3c4c447fed0 bpf: Only enforce 8 frame call stack limit for all-static stacks 4375b3d1c2898 mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context a8bddab54aa68 net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times 47a5cecca925c net: bcmasp: clear txcb->last before writing each descriptor 75bd5ea9c858d ASoC: Intel: avs: Refactor and fix init_config access b199e3db839b1 ASoC: Intel: avs: Honor NHLT override when setting up a path 5ba5da8842383 ASoC: Intel: avs: Allow the topology to carry NHLT data 23ebd4ed57993 ASoC: Intel: avs: Fix unbalanced module reference count b230b2219e423 ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology 498bf26639e99 ASoC: Intel: avs: Clean up the bus when fetching ML caps fails cdaa2e829c4eb nvme-tcp: defer TLS inline send to io_work f56b2bb4b18b0 nvme: remove stale namespaces by NSID range during scan 3c03a1b8ded85 bpf: Mark sched_process_wait argument as nullable cc2e065ed206a bpf: Reject resilient lock operations in rbtree callbacks 617c8266e49f4 bpf: Reject tail calls directly from callback frames 0e78cb242a57e bpf: Mark signal tracepoint siginfo arguments as scalar ca086264e9810 bpf: Fix NULL-ptr-deref in btf_var_show() 98f1cb9522133 bpf: Fix NULL-ptr-deref when showing a void BTF type d9952b0ba20f1 drm/rockchip: rk3066_hdmi: Add missing Kconfig selects df7c96e390ffa drm/rockchip: dw_dp: Select DRM_BRIDGE_CONNECTOR 1dd715ca0568e ALSA: caiaq: Fix potential double-free at error path 7a0f287d71311 selftests/alsa: Fix the step check for INTEGER controls ec52dfed7b145 erofs: disable LZ4 rolling decompression for now a259c26061fa3 arm64: trans_pgd: clone only the linear map that exists at runtime 2c2b229d439a0 net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list() 364b6e4327f72 net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset 19811a68a7661 net: airoha: enable RX_DONE interrupt for RX queue 31 4cb9b6d3d31a2 net/rds: don't let rds_conn_shutdown() consume a concurrent drop 900e96c9749a0 net/rds: acquire the fastpath locks in rds_conn_shutdown() 8e4c3b7844c90 net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() 47a1cb4d194ee net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown 6b8d7563c28b8 net/rds: clear cp_flags bits individually in rds_conn_path_reset() ea6f65c4f9fe1 net/rds: use clear_bit_unlock() in release_refill() a269795107f45 net/rds: use wq_has_sleeper() in release_in_xmit() a29ea5b503465 net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). 19ba7ecfade15 bonding: do not clear curr_active_slave prematurely when releasing all slaves d6c39774ae093 bpf: reject BPF_PSEUDO_FUNC reference to the main program 411c9080a7765 tracing/probes: Fix use-after-free on field name/type of events with multiple probes 4be8380e3af00 netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() 524599714558d ipvs: fix reversed sequence option serialization 66c08e5ee8f97 drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit compile d8f5704952194 btrfs: zstd: fix lost wakeup when waiting for a workspace 203cbfb4fba59 btrfs: do not force reloc root creation during qgroup_account_snapshot() c9e0aa9967064 btrfs: send: fix lost error return value in will_overwrite_ref() 40370f02a1ca3 btrfs: zoned: finish active block group cleanup if call_zone_finish() fails d9b42f553c81c btrfs: return proper negative error code for update_raid_extent_item() 1b4d4e890c2c8 btrfs: fix the possible bioc_list memory leak during error 2fbfd02bdfe12 btrfs: fix transaction use-after-free in raid stripe insertion b6711a77aed3f btrfs: scrub: report the failing sector's address, not the stripe base 3c948b894fb0f ASoC: ux500: Program the MSP FIFO watermarks 271bb038cf198 ASoC: ux500: Allow repeated MSP prepare calls 1af5676c80aa2 ASoC: ux500: Remove obsolete PRCMU QoS calls 4c31f08819ed7 ASoC: ux500: Request the MSP MMIO resource a1e61026f0358 ASoC: ux500: Deassert the MSP reset during probe 23f993e6cdc18 mfd: db8500-prcmu: Fold dbx500 header into db8500 dafe8e402ace0 ASoC: ux500: Validate MSP DAI configuration 23e8d82fa7a28 ASoC: ux500: Correct MSP frame and bit clock setup 44f34dfd80e44 ASoC: ux500: Propagate MSP setup errors 25556165cec1d ASoC: ux500: Fix MSP stream lifecycle handling 64c605f7af901 printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY 228075f31b141 ALSA: ump: do not touch legacy_rmidi before it exists aa8e82904d4b5 octeontx2-af: Fix limiting SRIOV VF count logic c7acfb04c7e2e locking/lockdep: Invalidate stale class_cache entries for zapped classes e5cf7a6891975 perf/core: Skip empty AUX records with only format flags 0953b2ad67c48 x86/itmt: Don't make ITMT enablement depend on debugfs 755476d7ba92a sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate 6a1a15d86ba69 sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() 7b23144c3ff6e scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() 6af253bccc36c perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ 27314f96d29b5 bonding: alb: fix uninitialized transport header access in alb_determine_nd() e127ac29a5213 btrfs: restore active device pointers after failed sprout 8b001df2b37ca btrfs: detach failed sprout device from transaction update list b99621d17145a ALSA: dummy: Report a change when one capture switch channel moves b13dba708ca09 drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() ecd88ef5f1d20 ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() 4ec48a321a0eb ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits 470db2026a435 ASoC: fsl_micfil: balance mclk enable/disable 73eec5a0d5591 s390/boot: Avoid IPL parameter append past command line 17c25ee98eba6 s390/boot: Fix physical memory search range 4c9d9cd4d8882 ALSA: hda: restore MFG widget enumeration after core split f0c869df2c337 staging: fbtft: make dirty_lock IRQ-safe 72abe77e88c3f af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). 97b21ef57dfab ipv6: sr: restore network header before routing and forwarding 4ab2977323d5f tipc: Dont send random pad bytes in RESET/ACTIVATE messages ad805326d8740 tipc: fix NULL deref in tipc_named_node_up() on empty publication list 35a575df905b9 ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit 2c2091e2ee930 ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() 8d4fe5c13f505 ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() 335e50c8abe0f ppp: ppp_synctty: simplify tty disc_data access 152e946133e8f ppp: ppp_async: simplify tty disc_data access d3011d1f29347 igmp: convert struct ip_sf_list to RCU feab9261b537d net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted ada82338765c7 net: ethernet: oa_tc6: Fix for the wrong data type f690f83225b49 net: ethernet: oa_tc6: Disable tx queues on fatal error 9d3f6e714d5f8 net: ethernet: oa_tc6: Improve the error recovery 0deefb86f7775 net: ethernet: oa_tc6: Protect skb pointer used by two different kernel instances 3e0ff19d0c4d9 net: ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registers dfc4343e1212d net: ethernet: oa_tc6: Export standard defined registers d096135160135 net: ethernet: oa_tc6: Handle the OA TC6 SPI protected mode 4481f0b8384d2 net: ethernet: oa_tc6: Interrupt is active low, level triggered. 161abd6cefc84 ASoC: ab8500: Validate and program TDM slots correctly 353659d11a34e ASoC: ab8500: Correct digital interface format setup 4edc96d4184af ASoC: ab8500: Repair the DAPM capture graph c842af2c83705 ASoC: ab8500: Reset the audio block before configuring it eb1b43ec5d6b7 Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() 3d9fb936d8d9f Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM 6da5c0331fc3e Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect 5d5a625cbc854 Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan a11ebe8dc0333 Bluetooth: hci_core: Fix race condition during device registration 058f56de5f48b Bluetooth: btintel: bound firmware ID by TLV length 76948d207d097 Bluetooth: btintel: validate version TLV value lengths e9c2864ec4cf7 workqueue: reject watchdog thresholds that overflow jiffies 2f6ca6581ef1d Bluetooth: btintel_pcie: Clear automask on spurious interrupts 09d16f8580227 sched_ext: Fix vtime delta loss in scx_flatcg cgroup migration 5dff82f1aa96a sched_ext: Update demo schedulers and selftests to use scx_bpf_task_set_dsq_vtime() 7271eeb2935ce sched_ext: Fix timer pinning and return value in scx_central 88a31c7164503 s390/diag324: Preserve -EBUSY return code 8d7988e8116c3 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block 50f9c40768e84 s390/ipl: Fix NULL deref in kdump without re-IPL parm block 77cc8e8e882e5 s390/time: Use jiffies instead of jiffies_64 33c7fba9f9b18 s390/vtime: Use __this_cpu_read() / get rid of READ_ONCE() 30dbb08777b9a ksmbd: rate limit unmapped SID errors 37952f03d5171 ksmbd: propagate DACL parsing errors fd137bf8149bc ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF 68d459e6e609c cachefiles: Fix potential UAF/KASAN warning cf6f93b8b06ac netfs: break unbuffered write when netfs_alloc_subrequest() fails ebefb12122d13 netfs: Fix subreq ref leak 5d280d9cc2893 netfs: Fix i_size update for partial transfer b706527a90e25 netfs: Fix error vs transferred passed to ->ki_complete() 9bd43226f4506 netfs: Fix unbuffered/DIO write partial transfer error return cda45c3474f2c perf powerpc-vpadtl: Fix raw_size of DTL samples 31ba77e9001f3 OPP: of: Fix potential multiplication overflow when calculating freq d64300f3409dd perf symbol: Do not use debug file as the binary type 744b25040d820 watchdog: msc313e: Fix NULL pointer dereference in PM callbacks 74e2a56c82209 vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() 9be61da9d7c40 net: amd-xgbe: discard rx packets with bad FCS 0370abbc75b91 raw: annotate disconnect-side IPv4 match writers 3be02999ab913 sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration b66b9df8e6515 smb: client: transport: Fix debug printing in __release_mid() 75e85379a08ae smb/client: fix integer truncation in collapse range 50c4f40a221ef smb/client: fix data corruption in emulated insert range 716dc2b391de9 smb: move copychunk definitions to common/smb2pdu.h 430d0f002ce98 smb/client: mark file sparse before emulating insert range 06a4f9049cb6d smb/client: validate new EOF for zero range bc7602b9082ef smb/client: validate new EOF for insert range 06a7073b33b8f scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() 2f69ed909de9e scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() 00b841bac1023 sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START 10b5483278c18 net/sched: act_api: fix skb sizing and action leak on reoffload delete fe2bec63fa999 net/sched: act_api: size the RTM_GETACTION reply from the actions bbdc058b971f9 net/sched: act_api: budget all shared attributes in notify skbs e4a5b01e59f71 net: iptunnel: fix stale transport header during tunnel decapsulation c6bdc97ffd65c tcp: use GFP_ATOMIC in tcp_send_active_reset() 04c0d35bac512 net: icmp: avoid invalid transport header access in icmp_send tracepoint 26bd90c886218 drm/cirrus-qemu: Validate BAR0 size during probe f8dcbbf843d2b ufs: do not treat unreadable directory blocks as empty 93fa3e925b15b accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain b2cd682324b88 drm/gud: validate GUD_ROTATION_0 is present in supported rotations d623a4a58bb23 bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic 13cf95d19e84b selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter a204cfe4c8290 sched_ext: Fix nonexistent field in sched-ext.rst example 4f7cf573cdf0e nvmet-rdma: fix queue leak when connect backlog is exceeded cf3e706963ffb nvme-rdma: fix -EIO cleanup order in queue_rq 12deeade460d4 accel/qaic: Address potential out-of-bounds read in resp_worker() 93c557e947ef0 drm/virtio: use the DMA API for resource backing on Xen 45dc2788a5b0e drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() 528052af901d6 EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation 6890f18448f9f EDAC/igen6: Fix channel address decode for non-hash mode f6e326963e9d3 EDAC/igen6: Fix channel selection hash c9ebaf08e2f58 EDAC/igen6: Fix interleave boundary condition fda123f9e7c17 RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed 8ee846bd854ee ARM: ensure interrupts are enabled in __do_user_fault() 8a98ed4f7b706 ARM: 9484/1: enable interrupts when unhandled user faults are triggered 9811e2c321f77 rtc: cmos: Use platform_get_irq_optional() in cmos_platform_probe() fe198b077864f af_unix: Unlink scc_entry in unix_del_edge(). 8c4fde01bcf91 l2tp: fix tunnel and session refcount leak on seq_file release a386c83043015 ksmbd: use memcmp() to compare ClientGUIDs 6dd3701facc0c wifi: ath11k: cancel SSR work items during PCI shutdown 96f5b92d958bc ASoC: meson: aiu: Validate written enum values 5c2537cf24d67 ASoC: topology: Check PCM and DAI name strings before use bea03e887db5a ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). 4c03275bc4435 bnxt: fix head underflow on XDP head-grow a9f1395028c2b bpf: Guard __get_user acesss with access_ok for uprobe_multi data f956477c343aa RDMA/bnxt_re: Proper rollback if the ioremap fails 706591cccdd3a RDMA/irdma: Replace waitqueue and flag with completion 09c44549820df coresight: platform: defer connection counter increment until alloc succeeds 11b35d1906a72 md/raid10: fix writes_pending and barrier reference leaks on discard failures 1cae40d423a20 sctp: fix err_chunk memory leaks in INIT handling b96cb1235fcaa bpf: Mask pseudo pointer values in verifier logs 4cca4b44e561a netfs: Fix barriering when walking subrequest list 5e53e285f8c98 Bluetooth: ISO: fix malformed ISO_END/CONT handling aafb093adffad bpf: Reject redirect helpers without a bpf_net_context 708688ec31ac6 drm/vc4: hvs/v3d: Fix null dereference in unbind 7364014fdc289 tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() 89178ffe5bddc net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD 925669d4cfd47 drop_monitor: fix size calculations for 64-bit attributes 7d857cf5f0120 drop_monitor: perform u64_stats updates under IRQ-disabled section 0c53eb14975f0 ppp_async: drop the errored frame instead of resetting its headroom f60cd3867cb6d Bluetooth: btrtl: Add the support for RTL8761CUV cb64f655c5f85 leds: st1202: Validate pattern input before stopping the sequence 4400aa20fe932 wifi: mt76: mt7921: skip unknown CLC firmware records 3896be051e928 wifi: mt76: mt7921: validate CLC firmware records e15b21a10d57d iommu/arm-smmu-v3: Disable implementations during devm teardown a15cae16f4432 ksmbd: remove stale channels from all sessions on teardown bac4120fd8152 bpftool: Strip all -Wformat* flags from bootstrap libbpf build dc20050b6b12c netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state bb462621968ea ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx dc9e1b6b9080d scsi: core: Do not block on tag allocation in scsi_eh_lock_door() daa0eae8c858f ASoC: rt5645: Perform the initial jack detect at probe cd60b758dba6a spi: dw: fix wrong RX_SAMPLE_DLY setting after resume 985250453b772 ata: libata-core: Disable LPM on WDC WD141KFGX-68FH9N0 f7750422ebc06 hwmon: (corsair-psu) Fix linear11 calculation 6c1b802e36b05 vhost-scsi: flush backend after device ioctls dfad7293b9005 ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx ceb19f46e4758 Drivers: hv: vmbus: add VTL2 redirect connection ID 23d478fd5ab45 ata: libata-core: Disable LPM on WD Green 2.5 480GB 4e4de08510cd8 ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) def08a5290092 ata: libata-core: Disable LPM on some WD drives 5144ddfb71c18 ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) bbc310caa2b6b Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame 01cc395cecfaa wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() 8b12f65d7caf1 cifs: validate idmap key payload length d1148f03edead powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash ca9b1ac1bb990 ice: pass the return value of skb_checksum_help() 45f25ac3e3175 ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx 0fbfc59f7a710 ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 9f0243ca8e256 phonet: check register_netdevice_notifier() error in phonet_device_init() c268df0653ab0 drm/gma500: return errors from Oaktrail HDMI I2C reads 0093909becbda ksmbd: preserve VFS inherited POSIX ACL mask 13edd8ea7ff2c wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO 7d984d68150a0 regulator: core: clamp voltage constraints before applying apply_uV 03003506c86f9 smb: client: bound dirent name against end of SMB response in cifs_filldir dfbb9db16497e wifi: mwifiex: replace one-element arrays with flexible array members 0ba8608dd2d84 ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE 346a558491241 wifi: iwlwifi: acpi: validate WGDS table revision index 042d21f6db334 ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless 7aa9097623afb wifi: iwlwifi: bound aligned TLV advance in FW parser 414560cd623d0 ALSA: hda/realtek: Add quirk for HP Pavilion x360 52c4c623474df drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized a21bf9cb89312 arm64: kprobes: Allow reentering kprobes while single-stepping e8ac5e91b1296 wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif 59f64c2839022 wifi: iwlwifi: mvm: add a check on the tid coming from the firmware 3967499c6ed8e arm64: fixmap: Allow 256K early_ioremap() at any offset 83f32942a501c wifi: iwlwifi: mvm: fix a possible underflow 4d942dfc13aec wifi: iwlwifi: mvm: validate TX_CMD response layout 898e74a9115e9 ASoC: Intel: sof_sdw: Add quirks for new Dell laptops 39562a56cdb51 smb/client: flush dirty data before punching a hole 4c0d150fb98ea blk-cgroup: fix leaks and online flag on radix_tree_insert failure d16e1dcb260fd ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs 3456c5bcc987a wifi: iwlwifi: pcie: null RX pointers after free 0a63f98e5163a wifi: iwlwifi: mvm: fix sched scan IE sizing fa7249d1f3249 wifi: iwlwifi: mvm: parse beacon notif per layout 4d60332387336 wifi: iwlwifi: mvm: fix an off-by-1 boundary check cad3665dee627 wifi: iwlwifi: mvm: validate mac_link_id in session protect notif 63d6b1f04cd91 btrfs: fix reloc root cleanup in merge_reloc_roots() e35ae757c6462 wifi: iwlwifi: mvm: validate sta_id in BA window status notif 61b46ba803b46 spi: dw-dma: Wait for controller idle before completing Tx fda1b6636ff18 btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() c7a2dc9aa0760 btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr() 6e04cc5a30f47 cifs: Fix support for creating SFU fifo 7cf1d7c23ee55 ALSA: hda: cs35l56: Fail if wmfw file is missing 749f54ff34084 ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) bf8eab0aa48df ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series 22532dd88694e smb/client: zero-initialize stack-allocated cifs_open_info_data 54b6a5c615a00 cifs: Fix support for creating SFU socket c16dd04955df6 ASoC: rt712-sdca: reset codec at io_init to fix silent headphone 266f195d5a14e wifi: rsi: validate beacon length before fixed buffer copy ca9fab1ca1553 netfilter: ipset: mark the rcu locked areas properly c54b643e9a093 wifi: libipw: fix key index receive bound checks 169e172130eef gpio: dwapb: Mask interrupts at hardware initialization b3451e6971248 wifi: mac80211: ibss: wait for in-flight TX on disconnect 8f4127a93cf60 wifi: cfg80211: validate rx/tx MLME callback frame lengths before access 2360acb45a8ef ksmbd: validate SID namespace before mapping IDs 27768ff26c860 ksmbd: mark invalid session responses as signed 5a5b0b7a01fe1 ksmbd: find bound sessions during reauthentication 78ac450ad4624 wifi: cfg80211: validate assoc response length before status and IE access cdcfd662c6783 wifi: libertas: reject short monitor TX frames 55b86ef6c2e68 wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers 9df64ad43e1f2 wifi: mac80211: validate deauth frame length before reason access 9c8bfc99ef185 wifi: ralink: RT2X00: init EEPROM properly 74f3c639f64fa ALSA: usb-audio: caiaq: validate EP1 reply lengths 150afb1941f1a ksmbd: fix credit charge calculation for SMB2 QUERY_INFO 27d43ad57759c drm/amdgpu: flush pending RCU callbacks on module unload b9b79d6e7fa23 ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table 6cc7d711b8d99 netfs: Fix decision whether to disallow write-streaming due to fscache use 90b306eee037d cachefiles: Fix double fput 231542f4e43cf xen/gntalloc: validate grant count before allocation 405f13d7b2709 freevxfs: don't BUG() on unknown typed-extent type 6cbaea8ab703e xen/front-pgdir-shbuf: free grant reference head on errors 6e6329322ad73 ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling 4bc2e7259810c ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr 350b966d39f1e drm/arm/komeda: fix error handling for clk_prepare_enable() and callers 99901c249aedb ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED c521dd78e036b ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr a39ecb8565142 netfilter: nf_conntrack_expect: zero at allocation time f31c61369f4b1 drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend 8f75c19892263 btrfs: tree-checker: validate INODE_REF's namelen f6a0cafa265c8 spi: core: Abort active target transfer on controller suspend ac759ec8fbd8f ASoC: tas2781: Update default register address to TAS2563 f1e3691195c24 fbdev: pm2fb: unwind WC setup on probe failure 6b3d24620ed7a ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk 95d725736a3d5 eth: mlx5: fix macsec dependency 5af7d1f55afce rtc: bq32000: add delay between RTC reads cbb97fe2053e0 blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat() fc2233f1ab2a1 net: au1000: move free_irq out of the close-time spinlocked section 632dadecba13d regulator: da9121: Use subvariant ids in the I2C table ef6db657f4bfe PCI/sysfs: Use kstrtobool() to parse the ROM attribute input bc544b61889d6 PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() bc4c5f0784ae8 ksmbd: treat read-control opens as stat opens only for leases 7015f0e5973c9 ksmbd: break RH leases before delete-on-close 34603ca51c2b3 ksmbd: start file id allocation at 1 66775ee3c1398 ksmbd: deny renaming directory with open children 7821c9816cadf ksmbd: apply create security descriptor first a5366ea6b1485 ksmbd: treat unnamed DATA stream as base file 2c777b09e2be3 ksmbd: use connection ClientGUID for lease lookup 23b8be9aab0b8 ksmbd: align SMB2 oplock break ack handling 7410f21f01e38 ksmbd: validate SMB2 lease create contexts fba4653a0b4dc ksmbd: fix lease break and ack state handling 80d99549bb59e rtc: aspeed: add AST2700 compatible 85a3b2c632cab rtc: mv: add suspend/resume support for wakeup 7caa8a0ae94b1 f2fs: validate inline dentry name lengths before conversion 7510513be24d8 ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 cc8eb1715673d md/raid5: let stripe batch bm_seq comparison wrap-safe 25c1debf4dc8e mailbox: imx: use devm_of_platform_populate() 944d8509c2220 mailbox: imx: Add a channel shutdown field a5e9a81e7e477 md/raid5: account discard IO adcaa21d50c3a mailbox: imx: Use devm_pm_runtime_enable() 6f1853b2b9f38 perf: Fix addr_filter_ranges lifetime cb78a1d7a2787 PCI: plda: Protect root bus removal with rescan lock a568939487dcb PCI: mediatek: Protect root bus removal with rescan lock 9b19201f57d87 PCI: rockchip: Protect root bus removal with rescan lock 7cbb8f2750d91 PCI: altera: Protect root bus removal with rescan lock ee06aafc2d760 PCI: iproc: Protect root bus removal with rescan lock c6c290e408fe3 drm/amdkfd: Properly acquire queue buffers in CRIU restore 7a3b9c73ec965 ALSA: usb-audio: Add quirk for YAMAHA CDS3000 34c20c79e2a4d drm/amdgpu: Use system unbound workqueue for soft IH ring a7a2333f45b15 drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap 2d9fd0f01550a drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl 8c09528b9ea61 mfd: rsmu: Add 8a34002 support f27b4f6b0fb1b leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE f71b6f970a2c4 mfd: tps65219: Make poweroff handler conditional on system-power-controller 80141441dcef6 leds: pca9532: Don't stop blinking for non-zero brightness 1cf3b01582e92 leds: uleds: Return -EFAULT on copy_to_user() failure 641161f2c48db ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 a08e780b6cc11 tls: reject the combination of TLS and sockmap e8d895eb54838 ALSA: usb-audio: Add quirk flags for SC13A 72cc9c6d6fba5 spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() 2c9a956278ceb gpio: pisosr: Read "ngpios" as u32 da2d1a61fea8e scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() 37ad4cd204de8 fuse: set ff->flock only on success 3303398cc2aa2 HID: hidpp: fix potential UAF in hidpp_connect_event() 20ef4739b329b virtio-fs: avoid double-free on failed queue setup 0933634b4a690 ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT 2cc0b61234363 exfat: fix handling of damaged volume in exfat_create_upcase_table() a2adb52cf6440 sparc: Disable compat support with LLD b1cbbde23215d bpftool: Pass host flags to bootstrap libbpf 35a83ea4b7094 i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA 0eee1e6cddd1d smb: client: fix races in cifsd thread creation e7f217bc66412 net/sched: act_csum: don't mangle UDP tunnel GSO packets 0de429ddd5254 apparmor: propagate -ENOMEM correctly in unpack_table 45757484d1d28 net: hns3: improve the unused_tuple parameter setting 6a3f7fb3e15ca e1000e: limit endianness conversion to boundary words d6e12544ddb07 vsock: use sk_acceptq_is_full() helper in all transports 1ae3c612a2729 ptp: ocp: add shutdown callback 87e2826ed2058 net: stmmac: xgmac2: disable RBUE in default RX interrupt mask a17fce56882e9 sparc64: uprobes: add missing break b85ef6483d5b3 Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 adb5b79b2cae7 ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure 131b18787f2d2 ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence b2b5c2ca5a492 ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt 1280db765ca87 Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW ae69dca122f6d Bluetooth: L2CAP: validate connectionless PSM length a14ad2929f56b Bluetooth: btusb: Add support for TP-Link TL-UB250 4eb5a1ed6e1bf Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 a1fd0b931c74c Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 0f7f58ea62969 Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV e80184cf72740 Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 d40f3b5eb9f31 Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) c305c37da249d Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c 0f15f3036d010 spi: xilinx: let transfers timeout in case of no IRQ c9cebac673596 hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i 626e080d297db dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc 7e0e7cd4364af dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes 0d72270b5e7e6 PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems b199c6d13261c hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist fcd72403e65fd HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts a20ff930866d7 sctp: Unwind address notifier registration on failure dd39064d2948b nvme-fc: Do not cancel requests in io target before it is initialized d3f35b584b09b platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table 0a45107c416d0 ata: libata-pmp: add JMicron JMS562 quirk 489b23e15a828 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 1afbf16dc3da7 ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC ebed7211ba7ad vdpa/octeon_ep: Use 4 bytes for mailbox signature e70d47fba6575 vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add() b5a6462f46466 net: lan966x: restore RX state on reload failure a726cc53424a6 net: dsa: qca8k: Add support for force mode for fixed link topology 30ec6e0c97a88 btrfs: use lockless read in nr_cached_objects shrinker callback 991ed1e019bc2 btrfs: use on-disk uuid for s_uuid in temp_fsid mounts 89288dc01c7cf hwmon: (adt7462) Add of_match_table to support devicetree 78d830dd0cc07 hwmon: (raspberrypi) Fix delayed-work teardown race 41dee2dc83479 PCI: Avoid FLR for MediaTek MT7925 WiFi 8e536d8624cde fbcon: don't suspend/resume when vc is graphics mode 80cd97c5e9009 btrfs: protect sb_write_pointer() with invalidate lock fe8e6c0a2f28b netconsole: take target_cleanup_list_lock in drop_netconsole_target() 7d177cad4df5c wifi: mt76: transform aspm_conf for pci_disable_link_state 9d38a188fa1aa wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv cfde1b6d67a7f wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec cde306add3bf9 wifi: mt76: mt7925: add Netgear A8500 USB device ID 67b05e2d22ad6 platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen 26c4e981525b9 wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS d1017cf3c4716 platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table 6ad679fcddcd3 tls: Flush backlog before waiting for a new record c4cb9a728df66 net: ibm: emac: mal: fix potential system hang in mal_remove() 9eee6b90bee3d pds_core: quiesce DMA before freeing resources 1b788fa4cf549 configfs_depend_prep(): pass configfs_dirent instead of dentry 5094ea022e2f8 RDMA/mlx5: Create ODP EQ for non-pinned dmabuf MRs f8862e9c74b96 xprtrdma: Add request-pool slack for delayed recycling c76e9123ab91a RDMA/rtrs-srv: Fix integer underflow in process_read and process_write 1094d83ad3258 ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() d48cf0288f1ae NFS: fix eof updates after NFSv4.2 fallocate/zero-range 74f577c722c99 btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF 59f75e0c8724d btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() 662b064911dbd riscv: panic if IRQ handler stacks cannot be allocated 4abc1af7ac209 netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() d88c24b76f285 ALSA: es18xx: check control allocation before private data setup 640c1bd8d359a net: microchip: sparx5: clean up PSFP resources on flower setup failure 24b3f1a9982c1 hsr: broadcast netlink notifications in the device's net namespace 0a44945b0d342 net: cpsw_new: unregister devlink on port registration failure 3b2814dd842a5 bpf: NUL-terminate replaced sysctl value 73fc151ab09ab RDMA/mlx5: Fix state and counter desync on loopback enable failure dff6980fe10e2 firmware: stratix10-svc: fix FCS SMC call kernel-doc 1234db6e41bfe RDMA/umem: Make ib_umem_is_contiguous() safe on 32 bit 5fc5b73109540 RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() 0c6a4f8a0d437 wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications 125ed82d5b596 ipv6: use READ_ONCE() for bindv6only default in inet6_create() 1b39f46eec2f9 drm/amdkfd: Unwind debug trap enable on copy_to_user failure 5bb2dfa65d8da drm/amdkfd: fix SMI event cross-process information leak 8bf884a356865 net: ethtool: cmis_cdb: hold instance lock for ops locked devices 22814e3504b83 x86/microcode/AMD: Move the no-revision fixup to get_patch_level() 06322da06116f cxl/region: Validate partition index before array access eeacf99090288 ipmi: si: Use platform_get_irq_optional() to retrieve interrupt ac2c9384e2b83 perf/x86/intel/uncore: Guard against invalid box control address 12fb4ff2dda81 ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP c92611b4ea97c ALSA: hda/realtek: ALC882: Fixup for Clevo P775TM1 e5f28e0bed589 clk: keystone: don't cache clock rate 3d177f46ce3de net: ibm: emac: fix unchecked platform_get_irq return value 489d7ec35bd8b net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transition 001824103f2fe drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq d572215973e60 RDMA/irdma: Fix typo in SQ completions generation c8f268e7d6c73 net/mlx5e: Verify unique vhca_id count instead of range 805f11fb10ddb drm/amdgpu: validate RAS EEPROM tbl_size before record count 29fef371331e8 drm/amdgpu: fix buffer overflow during vBIOS update 95e13b2519629 drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error 3334985f8b4c7 drm/amd/pm: bound pp_dpm_set_pp_table() memcpy 4396d74b0c730 drm/amdgpu: harden FRU PIA parsing with bounded helpers d98c8032c2994 drm/amdkfd: fix UAF race in destroy_queue_cpsch 9bde188793a72 drm/amd/display: Check for sharpening case when calculating max vtaps for scaler a05e54c1eeaba xhci: Prevent queuing new commands if xhci is inaccessible f2463fc246d3c drm/amd/display: Avoid DPMS-on for phantom stream 388dd5c977782 usb: xhci: remove legacy 'num_trbs_free' tracking 23078553cee11 usb: xhci: Improve Soft Retries after short transfers 5983bfe3caa71 wifi: iwlwifi: add support for AX231 7be2fc679c8f6 wifi: iwlwifi: mvm: fix P2P-Device binding handling d4158bc784f4b wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect adc126a24ab2b wifi: cfg80211: harden cfg80211_defragment_element() 47bf1db8ef59e wifi: mac80211: unify link STA removal in vif link removal 176e9c96326e5 wifi: mac80211: clarify beacon parsing with MBSSID/EMA 97efd7a41aac0 nvme: validate FDP configuration descriptor sizes 9ad5697fd344c thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries f31c415b539f8 wifi: rtw89: 8851bu: add Mercusys MA60XNB (2c4e:0128) 6518f87771c88 dpaa2-switch: fix handling of NAPI on the remove path abd7511e12b23 net: dsa: sja1105: flower: reject cross-chip redirect fa232b4496cb5 dpaa2-switch: fix the error path in dpaa2_switch_rx() 5adbc4d02d7df dpaa2-switch: rework FDB management on the bridge leave path 20b8520d1ef99 ALSA: seq: oss: Reject reads that cannot fit the next event 2e333a2224795 ASoC: codecs: rk3328: Use managed GPIO and clock helpers 6a8149a20e460 ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() 0257e3ea00e19 fs/ntfs3: validate index entry key bounds bc8cfef261c99 nvme: refresh multipath head zoned limits from path limits 407ee19828a7d fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib 9299e7d1c7936 powerpc/fadump: Add timeout to RTAS busy-wait loops 08003cc005c83 iommu/rockchip: disable fetch dte time limit e766cc0911cea net: txgbe: fix phylink leak on AML init failure 9461d11ce1ad3 net: wwan: t7xx: Add delay between MD and SAP suspend 9d969c98732a4 net: qrtr: fix node refcount leak on ctrl packet alloc failure a3b3c69a24bb3 ppc/fadump: invoke kmsg_dump in fadump panic path 7d976afcb5130 ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach d404bb88ca371 ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge f2e291043c37a ata: ahci: fail probe if BAR too small for claimed ports 9fed6a7806358 wifi: ath12k: Prevent incorrect vif chanctx switch when handling multi-radio contexts 54c2414359fce ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive 2738d52a96d93 ASoC: qcom: q6apm: return error code to consumers on failures 1cec9da75a5b0 ASoC: codecs: pcm3168a: Prevent regulator double-disable in S4 00738665c875a wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi cab5bfff2e3ca net: ibm: emac: Reserve VLAN header in MJS limit 99e6c057f1e52 spi: tegra210-quad: Allocate DMA memory for DMA engine 4bc0c443d7dfd libbpf: Also reset {insn,data}_cur on realloc failure aa3e2c5ce5d5a iio: accel: mma8452: switch to non-devm request_threaded_irq() 7f845820afaad perf/ftrace: Fix WARNING in __unregister_ftrace_function 61ede56199da2 iio: light: stk3310: Deal with the ps interrupt issue in PM fe63db3544b91 media: qcom: camss: vfe-340: Proper client handling d6c51f3e60401 clk: samsung: exynos990: Fix PERIC0/1 USI clock types 4626eebf35dc9 mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC d6787ea5d7a9f tracing: Disable KCOV instrumentation for trace_irqsoff.o 31250800177ae ARM: tegra: p880: Lower CPU thermal limit e38226d308820 mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC 49ee15b11db63 ARM: tegra: tf600t: Invert accelerometer calibration matrix 41c72b3d627f5 mmc: davinci: fix mmc_add_host order in probe 971ba53c11747 soundwire: only handle alert events when the peripheral is attached 33ca906f79927 gfs2: page poisoning fix 0300131f0a92d soundwire: dmi-quirks: Disable ghost Realtek devices de81bc4f32432 soc/tegra: fuse: Register nvmem lookups at probe 08dc8e55bd72d libbpf: Add __NR_bpf definition for LoongArch ca5f986eb459e drm/nouveau/bios: skip the IFR header if present c11edd2975c97 ASoC: Intel: catpt: Complete coredump handling 4283835e918ea x86/topology: Add missing struct declaration and attribute dependency f29267ace0428 drm/nouveau/gsp: add SEC2 to GA100 chip table 29338bd2e2338 scripts: modpost: detect and report truncated buf_printf() output 29375e071ea20 host1x: bus: Fix missing ops null check in error teardown d5d7c6a3b7152 pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP c19e9e5493023 net: sfp: add quirk for OEM 2.5G optical modules 0f35d48ded79d hfs: rework hfsplus_readdir() logic 4de2cffef5e6b ACPICA: add boundary checks in two places d0fb1973f705c ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() 3cbf096a478f4 ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() d15c574022e09 ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() 21a73528579fc ACPICA: Add validation for node in acpi_ns_build_normalized_path() 1cac04312b77f ACPICA: Add package limit checks in parser functions 4c977d57a7846 ACPICA: validate handler object type in two places 293171dae7230 ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() b96401812cbfb ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) a6cd2fc2d5429 ACPICA: Prevent adding invalid references 9bc0e8c3df689 ACPICA: validate byte_count in acpi_ps_get_next_package_length() bc5b2158c7626 ACPICA: add boundary checks in acpi_ps_get_next_field() ef5a8d939c1e5 ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() 5d16f40b019e5 ACPICA: Fix condition check in acpi_ps_parse_loop() 00814fb7a08ae drm/amd/display: Initialize dsc_caps to 0 79527ce8d343e drm/amd/pm/si: Fix updating clock limits from power states 1429524673ac0 drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device 971852291bfa8 ALSA: hda: cs35l41: imply SERIAL_MULTI_INSTANTIATE 916d74343cd60 net: thunderx: fix PTP device ref leak in nicvf_probe() a0788aa9875f1 net: napi: Skip last poll when arming gro timer in busy poll 4df5597c65446 ipv6: addrconf: fix temp address generation after prefix deprecation 5883aae0a5553 net: hsr: require valid EOT supervision TLV eb833b94286d1 ALSA: usb-audio: Add quirk for Novation Mininova c8a911b3b07ba irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed 70c26330a8df9 iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind 83e5973b4164a mips: cps: Assemble jr.hb with an R2 ISA level e7d0deecf55db drm/panel: simple: Add AM-1280800W8TZQW-T00H 0583639ce8d22 genirq/manage: Make NMI cleanup RT safe 992c60771749d powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked() cb2da99604145 wifi: iwlwifi: mld: keep healthy link on EMLSR missed beacon exit 1b3b7b521041d wifi: iwlwifi: mld: purge async notifications upon nic error ed183461c3278 wifi: iwlwifi: mld: disallow puncturing in US/CA for WH 1412c8714c630 wifi: iwlwifi: pcie: add two LNL PCI IDs e960f690a3f64 wifi: iwlwifi: Transition to basic uAPSD with MAC_PM_POWER_TABLE API VER_3 e59b7cd595735 wifi: iwlwifi: mld: call iwl_mld_free_ap_early_key() for AP only 043c2c469c2b4 wifi: iwlwifi: pcie: fix ACPI DSM check 54c811bef719e wifi: iwlwifi: mld: honor BSS_CHANGED_BEACON_ENABLED 76ad89baf8545 wifi: iwlwifi: fix the access to CNVR TOP registers deaeb7be8e6b0 thermal/drivers/tegra/soctherma: Switch to devm cooling device registration 19fa3e00f7f4f clk: socfpga: agilex: implement l3_main_free_clk bffae18ba0488 s390/zcore: Removed unused variables b946e246ede90 rds: annotate data-race around rs_seen_congestion c4081e49ebe0e rds: filter RDS_INFO_* getsockopt by caller's netns 9fe33b272d7d0 ALSA: seq: Remove arbitrary prioq insertion limit da95cb016812c RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() 607492b1b38e0 netlabel: fix IPv6 unlabeled address add error handling 295c1b184d01c wifi: rtw89: pci: enable LTR based on pcie control register d8156aacfcabb virt: acrn: Fix irqfd use-after-free during eventfd shutdown 508e28930a161 rcu-tasks: Fix possible boot-time tests failed for the call_rcu_tasks() b3674e8c01b36 pwm: mediatek: set mt7628 pwm45_fixup flag to false c29bb5acd0cad irqchip/gic-v5: Immediately exec priority drop following activate ffb493032c6d3 gpib: Suppress setting END on error from NI_USB dongle 9c44f41699609 char/nvram: Remove redundant nvram_mutex 182bec9f9e37a crypto: atmel-sha204a - remove sysfs group before hwrng 73ea4ec0ec46d driver core: Avoid warning when removing a device while its supplier is unbinding 5cbab666721d9 tty: serial: 8250: protect against NULL uart->port.dev in register a5ff304195ca4 usb: host: add ARCH_AIROHA in XHCI MTK dependency 4295c58990b7a serial: 8250: fix possible ISR soft lockup 05171ef065465 usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue 45829816ef005 USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set 28d78783a871c usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log 549672a3fb6b3 usb: core: hcd: fix possible deadlock in rh control transfers dacd7c317ba12 usbip: vhci_hcd: fix NULL deref in status_show_vhci 89097c138061e drm/panel-edp: Add LG LP129WT232166 panel 9c18399327c32 HID: bpf: Add Huion Inspiroy Frego M button quirk 9584ab6283721 isofs: handle set_blocksize failures fd4d6593c5125 omfs: handle set_blocksize failures f27e21cf3c044 hpfs: handle set_blocksize failures 153374ee67a45 jfs: handle set_blocksize failures 60f7ccf669882 qnx4: handle set_blocksize failures cc30a36f9dd1e minix: handle set_blocksize failures ab1d6160d26e6 bfs: handle set_blocksize failures e01af5aa64103 affs: handle set_blocksize failures 78e10082f3e91 ntfs3: handle set_blocksize failures 28e4a2224c318 befs: handle set_blocksize failures 23a0b6d6a19b3 spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs 15fd44bc870cf net/mlx5: Switch vport HCA cap helpers to kvzalloc caa51e6da596e net/rds: Don't sleep inside rds_ib_conn_path_shutdown 7c1e87907b40f net/sched: sch_drr: make cl->quantum lockless 39679927fa7aa net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() c84cdea5684a8 net: usb: qmi_wwan: add MeiG SRM813Q fd45359dacb36 nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl ebd9e64e92f74 bitfield: wire __bf_shf to __builtin_ctzll eef9c7072eecf thunderbolt: Verify Router Ready bit is set after router enumeration 6fb64029457cd wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed caf8b9216f6de thunderbolt: Increase timeout for Configuration Ready bit cb77a50d1114c firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size 767789a58ae0d firmware: arm_scmi: Validate SENSOR_UPDATE payload size 8e11ea1401c52 thunderbolt: Verify PCIe adapter in detect state before tunnel setup 66f0196439aaa thunderbolt: Improve multi-display DisplayPort tunnel allocation ef9ea99efae42 thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() 4b65a3f6ca86d bridge: Add missing READ_ONCE() annotations around FDB destination port 8f62aa442b202 drm/amdgpu: check and drop invalid bad page records 054d856ce49f7 drm/amdgpu: avoid integer overflow in VA range check f8f0985375c3b drm/amdgpu: Bound GPIO I2C table entry count from VBIOS fc84416de710c drm/amdgpu: add first record offset check 1aa55af304a2d drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw b1d2b29d3115b drm/amdgpu: cap ATOM command table nesting depth a98d0d49757a1 drm/amd/ras: reset CPER ring on corrupt entry size 4486de65eb5e9 9p: use kvzalloc for readdir buffer 6d40846b8aa39 drm/imagination: Populate FW common context ID before passing to the FW 94bb5f46f117f arm64/daifflags: Make local_daif_*() helpers __always_inline 4953290c71861 arm64: panic from init_IRQ if IRQ handler stacks cannot be allocated 3e7b07202b35c 9p: invalidate readdir buffer on seek 2d607646909a5 drm/imagination: Don't timeout job if its fence has been signaled ea8bc0ea637a1 iommu: arm-smmu-qcom: Ensure smmu is powered up in set_ttbr0_cfg ab909a7ae2728 sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity 08e9e131aa16b drm/amdgpu: use atomic operation to achieve lockless serialization 7bb22751f72e7 ALSA: usx2y: Drain pending US-428 pipe-4 output commands db36881139b67 ALSA: ice1724: Fix blocking open for independent surround PCMs 70ff472d51f53 ALSA: hda/ca0132: add QUIRK_GENERIC path for Gigabyte GA-Z170X-Gaming G1 c2c89118c27cb drm/amdkfd: Check bounds on allocate_doorbell ec646686613d8 drm/amdkfd: Fix OOB memory exposure in get_wave_state() dd2870ca036e1 drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id d215e6dbe53b3 PCI: Wait for device readiness after D3hot -> D0uninitialized transition a16d9986b7b27 drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction 2bcae59fa1b60 mailbox: Make mbox_send_message() return error code when tx fails b20a70bd6a3d4 iomap: don't make REQ_POLLED imply REQ_NOWAIT a078b5165aa7c drm/mediatek: dsi: Add compatible for mt8167-dsi 14072fc75ee65 coresight: Disable source helpers in coresight_disable_path() 0f4cb08f30011 coresight: perf: Retrieve path and source from event data ef9ba2b334505 RDMA/mlx5: Use QP port when decoding responder CQEs c4606e9ba9fde media: imon: Add iMON VFD HID OEM v1.2 key mappings f137ae8376901 clk: qcom: clk-rpmh: Make all VRMs optional 20f46d0077f7a net: airoha: Reserve RX headroom to avoid skb reallocation 99e7269a91526 crypto: atmel-ecc - add support for atecc608b d6fdc93b37118 ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally 7fb387afd60c5 crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y 5b42cc975a903 scsi: pm8001: Reject non-fatal dump when controller is crashed c37923acd67a7 scsi: pm8001: Reject firmware update in fatal error state 4b569c3cc05b6 clk: samsung: exynos850: mark APM I3C clocks as critical c5b3326d12a96 soundwire: intel: Move suspend tracking from trigger to pm suspend a76f6e0782743 drivers/of: validate status properties in reconfig state changes 6b99feda4b85f drivers/of: validate live-tree string properties before string use d56cc5a921411 integrity: Check for NULL returned by asymmetric_key_public_key f3e0f9c64a855 net: dsa: realtek: rtl8365mb: add support for RTL8367SB 98e5720afd749 wifi: rtw89: phy: check length before parsing PHY status IE 7fe2e68675871 HID: multitouch: Fix Yoga Book 9 14IAH10 touchscreen misclassification 2583d6dcbf500 drm/panel-edp: Add AUO B133HAN06.6 and BOE NV133FHM-N4F V8.0 05b9953e40d53 bus: mhi: host: pci_generic: Round up nr_irqs to power of two 82e432c9ebfa1 media: video-i2c: use vb2_video_unregister_device on driver removal 144f24ec0fc1e media: chips-media: wave5: Add range checks for dec_output_info 34830acec129d drm/gud: Add RCade Display Adapter VID/PID pair f38d02e9f881d net: phy: motorcomm: use device properties for firmware tuning 3e7a6f5889132 hfsplus: rework hfsplus_readdir() logic 9e13495e4e3e6 PCI: intel-gw: Enable clock before PHY init e1023aac607c9 drm/amd/ras: Fix CPER ring debugfs read overflow 986b034b0592a pinctrl: mediatek: common-v1: bypass pinctrl GPIO layer in set GPIO direction 428b031dad390 pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction fcec938ce172c drm/amd/display: Fix CRC open failure during active rendering 546b3d5234846 platform/x86: sel3350-platform: Retain LED state on load and unload 5b7e151fe9ea9 mmc: davinci: avoid NULL deref of host->data in IRQ handler 9f67997353caa serial: 8250_port: recognize UPIO_AU d4b22fbae7003 genirq/proc: Size interrupt directory names for 10-digit interrupt numbers b037c2f7794aa mmc: core: Add validation for host-provided max_segs ac96ea0f03781 drm/panel/tdo-tl070wsh30: Use refcounted allocation in place of devm_kzalloc() f545ca99785c9 platform/chrome: Resolve kb_wake_angle visibility race 6efdc212627ce net/mlx5: HWS, Handle destroying table that has a miss table 7031801eb3281 net/mlx5: HWS, Check if device is down while polling for completion c9f1fb5564653 watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk df4509a4ffb16 watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 af2b6638a3dd3 watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform b16f07aaad1bd ASoC: ti: omap3pandora: update board check to use DT compatible c9f82e7c2a44b phy: qcom: m31-eusb2: Make USB repeater optional bafdd6284f1b9 drm/panel-edp: Add BOE NT140WHM-N4T, BOE NT140WHM-T05, BOE NV140FHM-N40 ed713c88b6bf7 drm/panel-edp: Add AUO B140XTN07.5, AUO B140HAK03.5, AUO B116XTN02.3, AUO B140XTK02.4, AUO B140HAN07.7 70af8451ceefc net/mlx5: Relax capability check for eswitch query paths d8c46c89d2cdb media: qcom: camss: avoid format string warning cbf0628c0b7db PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() 64760629b2160 dlm: add usercopy whitelist to dlm_cb cache 73eecf62219f0 drm/bridge: tc358768: Set pre_enable_prev_first for reverse order f22ee3d2ce5b2 clk: renesas: cpg-mssr: Add number of clock cells check 1931e06034c7d crypto: omap - add omap_des_unregister_algs helper 028a7f4f3d69e crypto: ixp4xx - fix buffer chain unwind on allocation failure d6d4b118c1e37 rtase: Fix flow control configuration 0a58cb7183638 wifi: mac80211: explicitly disable FTM responder on AP stop cb662a328a36a media: em28xx-video: fix missing res_free() on init_usb_xfer failure 8a630b1037fa9 net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family 222b03a6e095f media: v4l2-common: Always register clock with device-specific name 5f793ee869d0e net: dsa: mv88e6xxx: define .pot_clear() for 6321 7f626e4a3403e PCI: switchtec: Add Gen6 Device IDs a3e749c48fa99 net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family f3f135c4fac61 media: dm1105: fix missing error check for dma_alloc_coherent b2a75ce2af881 drm/panel: Enable GPIOLIB for panels which uses functions from it a513f711e0868 drm/amdgpu: Prefer ROM BAR for default VGA device 223ceba837ad9 drm/amd/display: Find link encoder for flexible DIG mapping cases 3e6ac4f692c0d thunderbolt: Don't create multiple DMA tunnels on firmware connection manager 99f019d2e9eb7 thunderbolt: Set tb->root_switch to NULL when domain is stopped 0a87af3b1e3aa thunderbolt: Keep the domain reference while processing hotplug ea60ae6233ca0 thunderbolt: Keep XDomain reference during the lifetime of a service 0325d017bf435 thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() 077fe32114792 thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible 1ca6a345248bf thunderbolt: Avoid reserved fields in path config space for USB4 routers 7f087f70e020b wifi: mac80211: avoid out-of-bounds access in monitor a5a7253924d28 media: platform: cros-ec: Add Kulnex and Moxoe to the match table 655b925ed1936 s390/cio: Purge based on the cdev's online status cc8c940e52da3 net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG b85d356b51c3a media: rc: mceusb: Add support for 04eb:e033 bb18a346271f8 spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM 00f16aa8fbaea dm-raid: only requeue bios when dm is suspending 04cda0b5c4ca3 media: chips-media: wave5: Release m2m_ctx after Instance Removed from List 072beef6a19f9 media: chips-media: wave5: Fix Reports from Kernel Lock Validator 87d6911f469c3 soundwire: validate DT compatible before parsing it 8bdd1ccd055f4 soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list 7d83f33c0990c bridge: Do not suppress ARP probes and DAD NS unconditionally 64862b78bb176 firmware: stratix10-svc: change get provision data to async SMC call 38cc5e49708cf kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() 1d9352c31bed4 ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit e9b139c4684ed i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 2bef8ba66c622 psp: validate IPv4 header fields in psp_dev_rcv() 958837ce53484 wifi: rtw89: disable CSI STBC for VHT 160MHz a910d2ba69d92 wifi: rtw89: disable HTC field in AP mode 290d37c09d9c2 wifi: rtw89: suspend DIG when remain-on-channel 1d1f250432cd8 wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() 1583636e0c53d clk: clk-axi-clkgen: Add support versal timings 7f52d554c4c8a wifi: mac80211: use chandef in ieee80211_get_sta_bw() 5780fdc944d19 wifi: mac80211: always allow transmitting null-data on TXQs e50965c702cfd wifi: nl80211: check link is beaconing for color change 0d635f0b4a634 wifi: nl80211: reject beacons with bad HE operation 09aa75bdd7c92 hfsplus: fix issue of direct writes beyond end-of-file 4cbb2360f4d8c wifi: cfg80211: reject duplicate wiphy cipher suite entries 2e7a4a7f5ebc4 PCI: Stop setting cached power state to 'unknown' on unbind 367b14b35a051 tools/nolibc: avoid call to wcslen() in _start_c() inserted by clang c33764acee65b tee: optee: Allow MT_NORMAL_TAGGED shared memory 961b880632101 usb: gadget: udc: skip pullup() if already connected 2f29f880e98bf ima: return error early if file xattr cannot be changed 4e28591d08543 pinctrl: renesas: rzg2l: Add SR register cache for PM suspend/resume cea5a8ba374ff ALSA: usb-audio: Propagate write errors in generic mixer put callbacks 8988e30c005d1 pinctrl: renesas: rzg2l: Handle RZ/V2H(P) IOLH configuration in PM cache edc70f4510841 iio: adc: rtq6056: add i2c_device_id support ce28e0aa23706 driver core: Replace dev->can_match with dev_can_match() f5c3144f783f9 drm/xe: Fix null pointer dereference in devcoredump cleanup 21a50a9373ada gfs2: move quota_init qc iterator increment 87baeb91c0e1a gpio: usbio: Add ACPI device-id for NVL platforms 812a766e2b0a8 gfs2: fix quota init duplicate scan 70d472076ce47 wifi: ath9k: Obtain system GPIOS from descriptors 7b6b9fc260b1a drm/amd/pm: Check SMUv13.0.6/12 metrics integrity db10ba9e7748b drm/panel: jadard-jd9365da-h3: set prepare_prev_first c54ef628c74c0 drm/amd/display: Fix DPMS using partially updated pipe context b1a5775e90430 drm: renesas: rzg2l_mipi_dsi: Fix deassert/assert of CMN_RSTB signal eb94c97199185 drm: rz-du: Ensure correct suspend/resume ordering with VSP 39a846d1a3a06 drm/xe/guc: Add support for NO_RESPONSE_BUSY in CTB 803eb90226fad bus: fsl-mc: wait for the MC firmware to complete its boot ba03f486672f4 drm/gem: Consider GEM object reclaimable if shrinking fails 7eeefe23a8196 drm/panel-edp: Add CSW PNB601LS1-2 and LGD LP116WHA-SPB1 50a7a5aec1aa4 mm/damon/core: avoid infinite kdamond_merge_regions() internal loop f2cf7c75d16bd drm/amd/display: Set gpuvm min page size to 4K on dcn35/36 Signed-off-by: Bruce Ashfield Signed-off-by: Richard Purdie (cherry picked from commit b57287ec872f4e8ec7fd74b37b09a5b935171078) Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.18.bb | 6 ++--- .../linux/linux-yocto-tiny_6.18.bb | 6 ++--- meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++---------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb index 03487e9f4a2..5db966af1e7 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb @@ -15,13 +15,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "a23529ae3d1aa70979a3399f370638f3086587e3" -SRCREV_meta ?= "2184786cc3deed04926e1cca6c320ed9314da9da" +SRCREV_machine ?= "f892d97a3d660b9e7f4dc0618e0737f6e23906a7" +SRCREV_meta ?= "366edfd67e22da481a7e6beb6386e1f7d19e71cf" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.18.52" +LINUX_VERSION ?= "6.18.54" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb index d2bd34732f9..ef90b3db194 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb @@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc include recipes-kernel/linux/cve-exclusion.inc include recipes-kernel/linux/cve-exclusion_6.18.inc -LINUX_VERSION ?= "6.18.52" +LINUX_VERSION ?= "6.18.54" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "364c4b44ab2dcc7dfff16076522b62827bcb0e7d" -SRCREV_meta ?= "2184786cc3deed04926e1cca6c320ed9314da9da" +SRCREV_machine ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" +SRCREV_meta ?= "366edfd67e22da481a7e6beb6386e1f7d19e71cf" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb index 3008f1751f6..8bf35579cda 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb @@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base" KBRANCH:qemuloongarch64 ?= "v6.18/standard/base" KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta" -SRCREV_machine:qemuarm ?= "49ec63d52f864d8cece5c6caa6be446362478003" -SRCREV_machine:qemuarm64 ?= "364c4b44ab2dcc7dfff16076522b62827bcb0e7d" -SRCREV_machine:qemuloongarch64 ?= "364c4b44ab2dcc7dfff16076522b62827bcb0e7d" +SRCREV_machine:qemuarm ?= "16672075f0d625c2a7186a00a0d47b34f8ac1e36" +SRCREV_machine:qemuarm64 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" +SRCREV_machine:qemuloongarch64 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e" -SRCREV_machine:qemuppc ?= "364c4b44ab2dcc7dfff16076522b62827bcb0e7d" -SRCREV_machine:qemuriscv64 ?= "364c4b44ab2dcc7dfff16076522b62827bcb0e7d" -SRCREV_machine:qemuriscv32 ?= "364c4b44ab2dcc7dfff16076522b62827bcb0e7d" -SRCREV_machine:qemux86 ?= "364c4b44ab2dcc7dfff16076522b62827bcb0e7d" -SRCREV_machine:qemux86-64 ?= "364c4b44ab2dcc7dfff16076522b62827bcb0e7d" +SRCREV_machine:qemuppc ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" +SRCREV_machine:qemuriscv64 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" +SRCREV_machine:qemuriscv32 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" +SRCREV_machine:qemux86 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" +SRCREV_machine:qemux86-64 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4" -SRCREV_machine ?= "364c4b44ab2dcc7dfff16076522b62827bcb0e7d" -SRCREV_meta ?= "2184786cc3deed04926e1cca6c320ed9314da9da" +SRCREV_machine ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" +SRCREV_meta ?= "366edfd67e22da481a7e6beb6386e1f7d19e71cf" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "8f3741e6feb045da5b406df0a80b42a1adfb289b" +SRCREV_machine:class-devupstream ?= "1b357ecb321392158d507b04672ffee57bfa071d" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.18/base" @@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.18.52" +LINUX_VERSION ?= "6.18.54" PV = "${LINUX_VERSION}+git" From patchwork Tue Oct 20 23:22:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101439 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4762.1792538575560379128 for ; Tue, 20 Oct 2026 16:22:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=YNJ58Ctl; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4a171b677d2so468765e9.0 for ; Tue, 20 Oct 2026 16:22:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538574; x=1793143374; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=9ji2/fNo3Y6Uf0I0b3XUE6Ztzvc+6SMqmJGILOTb/zs=; b=YNJ58Ctlcx4vMjwdg5Us9NfwZ+inTQs0wOolNNV4oMZdieIz42Hcw6kuMQ2CE/al81 5jGwf+OUo/+oW8LZNZzOx5mQdqipMqEeBoKxOQOBDh2YQyRlnpa0JcjPAWrgfJC3TUhg SGnhKHogiZ29QM5zvS20u8Vib6/z37FrydxKKhtTNZku+T13NtOTOd9cpG6kCOPhCrw9 7ClwNlUgoTGBghcCCEVyA0nRrFEG8E/pZ9/vgQDf/kFxe4di/I09BzQYaIE8DoOrdBkV K7A/rAxhcAzd00Uae/lLwNkrUjdJBH3ucBW1OaAzyB43BGuEBFI0DLxQVrRWp3AIRrbm 34oA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538574; x=1793143374; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=9ji2/fNo3Y6Uf0I0b3XUE6Ztzvc+6SMqmJGILOTb/zs=; b=C3l8tSBmaSWovbuRoVfpq7iQaR0J0qoKP8Vqe6HuXi9I8U+LtZCu/sTIqmtu3mj0BR 4TGGQheU5LZdfhZyXgpVPZdplBU2gKjlxs36ARCmylITD9MaoKzT/FB20Wo+oIlIRp4c rvtfp1rIPUH+MZmBc93+hrIcrIPltMdkckAPO7v9NOvk+6ePiNlzOpLoFaWzPBLLVTqt w3aR6E11bin9ibaBnCpiZEXf62usHCma+XGAuyT3yaWPU/P0L1D/ZHaoIySxeXHC7iSJ YFPS3+8zyrkqY0nnZMb8cFUBVEUVxqTPREhr7L92X3URfAQ35XNKEfRgdHM3mfMrtVWa n7bA== X-Gm-Message-State: AFq9FYLUBaF/RU8EMMybH6thA78ndEZSEvNNUR8huGtQSjrHD/6HvXpZ 0Q6t9+JdcTZe4JQ1fPWxhMpId5H0zxutM9GxzXEYCZqsvWO1DSNIib5gK3J1lTPvkNvtdhH+yHC hzT0RsRw= X-Gm-Gg: AYBFou1xQfnMy6kx+ZBNJbnTVN0U/Ko5i8ecHThC2AEswMiaA/uMftwCP7SHDSoLap/ tv5riArhum2jRyu3YpidqUCSIwPQjnx/eTaK+azDsCY5gB347/nSWmm+9TCk/qokE3s73icVz7R VnFIJA+bNTXjlQlVWOdJmfdTmXYkANaKKXl4nDfTB+9jbhvJRzbaixVOw2TPAStyKzl/quWVXbI 6fNRvj8FjdQSwRInVARXRVTLhLipwaP/qZ+/nfvewjMf8vFpO80Pi967D17Tv/ide2CkjgMvWzB OP1IhFpyBka9vz+b9McbDheKrluTIZKgAvTNDhE+E+aYefCB1i1D1HzLS4F8MMAElcglEnJQy+f rbCpqyyAASVbJEssC8cfVBcuQ7LSNl4eheraNGRy/YiiaqGUorsoL1XOL44wFXh7zivtGftEhlN TVXj10BZyQpdBdbz1uVZ7UsyqaKoyIivYQrCNZy+k9tsYhUV8AWmW0Vuu31mNU7tmDCIYkO50k7 i3NIzcdyJen7x8EyAF7zdhWt/6OU1j+HNu7AJ5G8DORSkP2ajo5BMpDs5Fm49MhPa9aVINQ2iS9 +976b6GsKSCz93o3LPxaTvCPvs6lwnCxKoF6muofuoStv/2WFpCSMKTB X-Received: by 2002:a05:600c:630e:b0:4a1:dfaf:f43e with SMTP id 5b1f17b1804b1-4a1fd8a7d87mr4948815e9.1.1792538573712; Tue, 20 Oct 2026 16:22:53 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:53 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 03/25] popt: patch CVE-2026-18743 Date: Wed, 21 Oct 2026 01:22:13 +0200 Message-ID: <4ced139b3e3fce64cec9bf50474ae7eb5a86ccce.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:22:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248321 From: Peter Marko Pick patch referencing this CVE. Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 6a47df77d4dda066f6c3651480546a79fd445ae6) Signed-off-by: Yoann Congal --- .../popt/popt/CVE-2026-18743.patch | 97 +++++++++++++++++++ meta/recipes-support/popt/popt_1.19.bb | 1 + 2 files changed, 98 insertions(+) create mode 100644 meta/recipes-support/popt/popt/CVE-2026-18743.patch diff --git a/meta/recipes-support/popt/popt/CVE-2026-18743.patch b/meta/recipes-support/popt/popt/CVE-2026-18743.patch new file mode 100644 index 00000000000..d57a39b4705 --- /dev/null +++ b/meta/recipes-support/popt/popt/CVE-2026-18743.patch @@ -0,0 +1,97 @@ +From ea2092edba8d6c1a9acd60d9fd7a587c624d6ffe Mon Sep 17 00:00:00 2001 +From: Panu Matilainen +Date: Tue, 11 Aug 2026 11:45:44 +0300 +Subject: [PATCH] Fix CVE-2026-18743: buffer overflow(s) in + poptConfigFileToString() + +Fix the reallocation logic thinko, repeated twice in the function: +if we need to reallocate, the current maximum value is not interesting +in any way. Just allocate double the required size instead. + +The reproducer test is obviously closely tied to the initial buffer +size of 480 and wouldn't work with other sizes, but with the current +default this reliably crashes popt under ASAN prior to this fix. +Also , the reproducer only exercises the first of these flaws. + +Fixes: CVE-2026-18743 + +CVE: CVE-2026-18743 +Upstream-Status: Backport [https://github.com/rpm-software-management/popt/commit/ea2092edba8d6c1a9acd60d9fd7a587c624d6ffe] +Signed-off-by: Peter Marko +--- + src/poptparse.c | 10 ++++------ + tests/test3-data/05.answer | 5 +++++ + tests/test3-data/05.input | 2 ++ + tests/testit.sh | 1 + + 4 files changed, 12 insertions(+), 6 deletions(-) + create mode 100644 tests/test3-data/05.answer + create mode 100644 tests/test3-data/05.input + +diff --git a/src/poptparse.c b/src/poptparse.c +index f405081..c2a5435 100644 +--- a/src/poptparse.c ++++ b/src/poptparse.c +@@ -139,7 +139,6 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + char * p; + char * q; + char * x; +- size_t t; + size_t argvlen = 0; + size_t maxlinelen = sizeof(line); + size_t linelen; +@@ -186,9 +185,9 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + if (*q == '\0') { + /* single command line option (ie, no name=val, just name) */ + q[-1] = '\0'; /* kill off newline from fgets() call */ +- argvlen += (t = (size_t)(q - p)) + (sizeof(" --")-1); ++ argvlen += ((size_t)(q - p)) + (sizeof(" --")-1); + if (argvlen >= maxargvlen) { +- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2; ++ maxargvlen = argvlen * 2; + argstr_tmp = realloc(argstr, maxargvlen); + if (argstr_tmp == NULL) { + free(argstr); +@@ -218,10 +217,9 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + *x = '\0'; /* null out last char if space (including fgets() NL) */ + + /* rest of line accept */ +- t = (size_t)(x - p); +- argvlen += t + (sizeof("' --='")-1); ++ argvlen += ((size_t)(x - p) + sizeof("' --='")-1); + if (argvlen >= maxargvlen) { +- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2; ++ maxargvlen = argvlen * 2; + argstr_tmp = realloc(argstr, maxargvlen); + if (argstr_tmp == NULL) { + free(argstr); +diff --git a/tests/test3-data/05.answer b/tests/test3-data/05.answer +new file mode 100644 +index 0000000..37b7fb8 +--- /dev/null ++++ b/tests/test3-data/05.answer +@@ -0,0 +1,5 @@ ++single string: ' --aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa --bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' ++popt array: size=2 ++'--aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' ++'--bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' ++ +diff --git a/tests/test3-data/05.input b/tests/test3-data/05.input +new file mode 100644 +index 0000000..2508292 +--- /dev/null ++++ b/tests/test3-data/05.input +@@ -0,0 +1,2 @@ ++aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ++bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb +diff --git a/tests/testit.sh b/tests/testit.sh +index 26724d6..4078f51 100755 +--- a/tests/testit.sh ++++ b/tests/testit.sh +@@ -179,6 +179,7 @@ fi + run_diff test3 "test3 - 1" test3-data/01.input test3-data/01.answer + run_diff test3 "test3 - 2" test3-data/02.input test3-data/02.answer + run_diff test3 "test3 - 3" test3-data/03.input test3-data/03.answer ++run_diff test3 "test3 - 5" test3-data/05.input test3-data/05.answer + + echo "" + echo "Passed." diff --git a/meta/recipes-support/popt/popt_1.19.bb b/meta/recipes-support/popt/popt_1.19.bb index 525bf553b10..3e9137c156a 100644 --- a/meta/recipes-support/popt/popt_1.19.bb +++ b/meta/recipes-support/popt/popt_1.19.bb @@ -10,6 +10,7 @@ DEPENDS = "virtual/libiconv" SRC_URI = "http://ftp.rpm.org/popt/releases/popt-1.x/${BP}.tar.gz \ file://run-ptest \ + file://CVE-2026-18743.patch \ " SRC_URI[sha256sum] = "c25a4838fc8e4c1c8aacb8bd620edb3084a3d63bf8987fdad3ca2758c63240f9" From patchwork Tue Oct 20 23:22:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101440 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f43.google.com (mail-wr1-f43.google.com [209.85.221.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4763.1792538576206233866 for ; Tue, 20 Oct 2026 16:22:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=jiOyggQY; spf=pass (domain: smile.fr, ip: 209.85.221.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f43.google.com with SMTP id ffacd0b85a97d-48c4649b35bso99447f8f.3 for ; Tue, 20 Oct 2026 16:22:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538574; x=1793143374; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=6V0xn0Wp8ZTPk82YtEnJCeLZNuboaF2a1CCN5mxH1U0=; b=jiOyggQY7vYPYW8gXkV527WrPDB1XxiI+3JltbtyhlsCK9m2qzbDqi+xwUPU91fxHo 85zVvB7UcG+8FmecIVVwFJzQgd6ncvfjz5UNhDlw23vl2CKityoYaDQFqMTx6n7st8px BpGSm2iZcLwkI1ZXUnDJDn4kEEukGLCeWhfRMfwrtHh1gUdumFhyvmcQewjH1NihmGXc xSsN2+pLNoxdb2XP/A1/oQid16f56n4fCytnb1fJqK9ij/qepavFghrzjTGSHUbGkMCQ i7swbiDpYxfnjli/vJMWLJy4XZbiMprlKpmECLQLPjDLPR8U3k0c6qdfd7bPByDBl1uj w4Cg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538574; x=1793143374; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=6V0xn0Wp8ZTPk82YtEnJCeLZNuboaF2a1CCN5mxH1U0=; b=OzI1xI2XyJ8aSxdD+OE41lTv8esnUwFrg5p0DLq7rEUt876VDteXylFGoEBgZSdp6n 8JuusZ3OktPitZSffuH0Hu4YGkkfhMI1BNmHpawf2CgG5M6979c7xxvTHDbmLEhemSzb DS48c+QYTueDQDAINa2NmXwkmUynXw2Mcagq2BRqwpAzmOYlvt8b7jm2ZmUqvrK5IUg6 oH80Ub0E2dppdTVkFGIE0dfe8OPbCNPhj5xAl4OZJtGacOZkWIgGFoNETA865f7H5ZBv s/Ocz/9DFz2VnQlZronuAIQjA+rpkx1LGt2h4aHmyic0lQa1my7mF1NZI4CKiwkWpG+x JWSw== X-Gm-Message-State: AFq9FYK70Jf17F40cEAkiiUOs863WC5XY+LdDRpFDQYdXbKyEp/6ZFLE y2zNOnIKKVZednP3pskQSdkmGojcNhUVV2xA6ztilxMJ/AdteEIOIWUpULrbx+IaaWM5N3XQyqT zIxt2jMI= X-Gm-Gg: AYBFou3QzmIxFZHUi6RHkZcnoySKHdgEFFsfMIY8Kdg3mQPfEDDwU3a/sfLGoKQIwAD s87mbuyeF97Y1B31Cmc8QlAV09kgHzlvn8SecV8YbO1ZGQVO7PqXsfeok5bvd+N5BGWE+ThrbzG FMrczKcusafnnv3NNzoLMY6IADtN85NDkmitDsFGSF4Kv1Ys6gu25HJpTK/K4qfpwVuKynASK7W ZNPXYlX9gpobEP+RKgWVyfN9wOf/x5tDVtbiSMUIxRco5seGImABzVHO0Ix62qVxSWRDvvit1tX BnLj0FsQg0G2GELvI7bS3puJW5aTLkS5x60eJJVx+ryqhEKJSauUdYNI/kXnwv97eLDFlXmJsb2 exF2kOSdjmsX95ZG1qDwSlGdhmBpYCZfe86OjRdtp2C8a5d9fHotrwNc7k/JIqV2HWgIeqjEISi dR7Ng7QC23KuQrgDElMvTZ2eJtPe4sh5UbULGomVJNnybW+SZkL9ZgkKMHpaeNzCII9mCqZBrqn mnJ9RIIbWAZ8zlLbnMuChSVBY5IAQhcaSLeDNAYoWQMjwHnCaUjkP4jT0StBlTPIkCrAW4alg== X-Received: by 2002:a05:6000:2003:b0:48d:ff71:dd97 with SMTP id ffacd0b85a97d-48e26427986mr416567f8f.7.1792538574079; Tue, 20 Oct 2026 16:22:54 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:53 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 04/25] popt: patch CVE-2026-18739 Date: Wed, 21 Oct 2026 01:22:14 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:22:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248322 From: Peter Marko Pick patch referencing this CVE. Convert change in cmake file to autotools/makefile. Install the new test in recipe. Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit c211972ad21e1801abc7dd15951093316c5528f4) Signed-off-by: Yoann Congal [YC: backport translated cmake to automake (the project migrated in between) ] --- .../popt/popt/CVE-2026-18739.patch | 92 +++++++++++++++++++ meta/recipes-support/popt/popt_1.19.bb | 3 +- 2 files changed, 94 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-support/popt/popt/CVE-2026-18739.patch diff --git a/meta/recipes-support/popt/popt/CVE-2026-18739.patch b/meta/recipes-support/popt/popt/CVE-2026-18739.patch new file mode 100644 index 00000000000..0a1e8f35907 --- /dev/null +++ b/meta/recipes-support/popt/popt/CVE-2026-18739.patch @@ -0,0 +1,92 @@ +From 14c42b415ba0c11640f7d4ee80920452d0287058 Mon Sep 17 00:00:00 2001 +From: Yao Zhang <294772273@qq.com> +Date: Wed, 5 Aug 2026 14:52:10 +0800 +Subject: [PATCH] Fix CVE-2026-18739: off-by-one error in poptStuffArgs() + +The poptStuffArgs function only checks whether (con->os - con->optionStack) +is equal to POPT_OPTION_DEPTH (10) before incrementing con->os, and does +not increment the value by 1 to perform boundary pre-checking, as +handleAlias does. + +Add a new test program as a reproducer for this case. + +Co-authored-by: Panu Matilainen + +Fixes: CVE-2026-18739 + +CVE: CVE-2026-18743 +Upstream-Status: Backport [https://github.com/rpm-software-management/popt/commit/14c42b415ba0c11640f7d4ee80920452d0287058] +Signed-off-by: Peter Marko +--- + src/popt.c | 2 +- + tests/Makefile.am | 5 ++++- + tests/testit.sh | 2 ++ + tests/tstuff.c | 17 +++++++++++++++++ + 4 files changed, 24 insertions(+), 2 deletions(-) + create mode 100644 tests/tstuff.c + +diff --git a/src/popt.c b/src/popt.c +index 9ea3dfe..458aadc 100644 +--- a/src/popt.c ++++ b/src/popt.c +@@ -1668,7 +1668,7 @@ int poptStuffArgs(poptContext con, const char ** argv) + int argc; + int rc; + +- if ((con->os - con->optionStack) == POPT_OPTION_DEPTH) ++ if ((con->os - con->optionStack + 1) == POPT_OPTION_DEPTH) + return POPT_ERROR_OPTSTOODEEP; + + for (argc = 0; argv[argc]; argc++) +diff --git a/tests/Makefile.am b/tests/Makefile.am +index c410389..99fbf64 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -11,7 +11,10 @@ EXTRA_DIST = testit.sh \ + + AM_CPPFLAGS = -I. -I$(top_srcdir)/src + +-noinst_PROGRAMS = test1 test2 tdict test3 ++noinst_PROGRAMS = test1 test2 tdict test3 tstuff ++tstuff_SOURCES = tstuff.c ++tstuff_LDFLAGS = ++tstuff_LDADD = $(top_builddir)/src/libpopt.la + test1_SOURCES = test1.c + test1_LDFLAGS = + test1_LDADD = $(top_builddir)/src/libpopt.la +diff --git a/tests/testit.sh b/tests/testit.sh +index 4078f51..d26be3a 100755 +--- a/tests/testit.sh ++++ b/tests/testit.sh +@@ -172,6 +172,8 @@ run test1 "test1 - 61" "" -x=f1 + + run test1 "test1 - 62" "arg1: 0 arg2: (none) aInt: 1" --randint=-1 + ++run tstuff "tstuff - 1" "-13" ++ + if ! [ -e test3-data ]; then + # create symlink for running during 'make distcheck' + ln -s "${srcdir}/test3-data" test3-data +diff --git a/tests/tstuff.c b/tests/tstuff.c +new file mode 100644 +index 0000000..b820c7b +--- /dev/null ++++ b/tests/tstuff.c +@@ -0,0 +1,17 @@ ++#include ++#include ++ ++int main(int argc, char *argv[]) ++{ ++ poptContext ctx = poptGetContext(argv[0], argc, (const char **)argv, NULL, 0); ++ int rc = 0; ++ for (int i = 0; i < 100; ++i) { ++ const char *ea[] = { "a", NULL }; ++ if ((rc = poptStuffArgs(ctx, ea))) ++ break; ++ } ++ printf("%d\n", rc); ++ ++ poptFreeContext(ctx); ++ return rc; ++} diff --git a/meta/recipes-support/popt/popt_1.19.bb b/meta/recipes-support/popt/popt_1.19.bb index 3e9137c156a..10c4b4b0af7 100644 --- a/meta/recipes-support/popt/popt_1.19.bb +++ b/meta/recipes-support/popt/popt_1.19.bb @@ -11,6 +11,7 @@ DEPENDS = "virtual/libiconv" SRC_URI = "http://ftp.rpm.org/popt/releases/popt-1.x/${BP}.tar.gz \ file://run-ptest \ file://CVE-2026-18743.patch \ + file://CVE-2026-18739.patch \ " SRC_URI[sha256sum] = "c25a4838fc8e4c1c8aacb8bd620edb3084a3d63bf8987fdad3ca2758c63240f9" @@ -23,7 +24,7 @@ do_compile_ptest() { } do_install_ptest() { - for f in test1 test2 tdict test3 testit.sh test-poptrc; do + for f in test1 test2 tdict test3 tstuff testit.sh test-poptrc; do ${B}/libtool --mode=install install ${B}/tests/$f ${D}/${PTEST_PATH} done } From patchwork Tue Oct 20 23:22:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101441 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f43.google.com (mail-wr1-f43.google.com [209.85.221.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4731.1792538576453277124 for ; Tue, 20 Oct 2026 16:22:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=0ly/EPu+; spf=pass (domain: smile.fr, ip: 209.85.221.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f43.google.com with SMTP id ffacd0b85a97d-48dc202a60eso49146f8f.3 for ; Tue, 20 Oct 2026 16:22:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538574; x=1793143374; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=S/n3F9sX0ygnVK6Nll3SWRtJ9EH2eCLVPl93dFAOOTM=; b=0ly/EPu+1VQJRji7nnmCvNmgQvgmjLUNcFHMs364o+aipzhG2h8iJXJt92Q2/8G0+6 gxi5Sf+rGCPC9ip377diYEbWuR+csPn0p3xuYg9DPMUKMSZbkXvRGwuWP+CkIW4ncbBf zS1w1i8PiDr+KT8DNDiYL6Uif9EYRGjeKEwQ0SurvSfv62uVBmeFsu6hl/AHGE27i4h2 Pv4Oki1ZzcfLrt7CFBzCFTQiwoGm5D5RQdO8F9Sfo2YI1jow9Jeoht8LqJgNgECZw1Bm CUnHZNH6bNqbZSYriicrofOqv/PJ9JhMwZ6x8loNNIuzMBhBwRiAtbsiNsG0xiKf51mM Xi2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538574; x=1793143374; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=S/n3F9sX0ygnVK6Nll3SWRtJ9EH2eCLVPl93dFAOOTM=; b=L5NlzIJxvLf8lNoPDwN/4kKSuSuEgbHSx1p//Q14dlemjjjoGE6KSDOROLvDRHp23G m7CphNebf/n52jMr6ZB6Z2chfy0GjiDw77YgVCvOAKHm5ZCtVY7zyl1++9NApFymB2s4 muMjQpq9NZ7EcYYQ1GYIl8ODBVCqNwJFRz+1rCossMzl2EzO1HhCZ6j3OsyNJbiW+cVh KgmYiGgERZ7pgT25J9Q2uYkvQvXzYNqOuZiePb3QyJmbJ3Oj+ZxRikM5selAf73+tTDR Ulx4cPe89j2pU36H35cVPag9//wGZ1r7oZaEju9GX1n/s1GIZZ19fzZXYMhlYx5YMTXw L9nw== X-Gm-Message-State: AFq9FYK8tlkdblfzt2REaQ5lGGU+so3hNVBkAUlJe98megmssIqntupT VuJPKe9JkhKS/1lorNsWDHHXE5Z1y2pHNIFpqDkvEm87WR4CnGJvQjXd+al4g4l7xfVJx7ntf0k 3LcZZRRw= X-Gm-Gg: AYBFou3BH7GMvrfXyhhEl1wSDnslRhmHGXjfE0PSQ6mdUI/rSH8ABSd8ROjDK/dFxL1 7af4VjcUQnN//LcEoDPGWgWmftKZ37DcCWAepZJj0nh1RjxmbE/fBFCwRHav1WvDovFt27LrBo4 ig8sQJUS+W0H+DVnO2Rqc2FyIFmTc8zt6TQ+ZZEyHf1s8085jPhVf0plEQ1PYU0mBTa5GRnLEH3 k9pVQZxXZx+MOyi9A4kY+RBmqlxILWWOCW7tkEm7RPYAZ4P4AIMfXSRXxLREEJLiX7PIbW/vbtg hz085rG6rO4yA76HPoPmrI3PyoMO1EeBAMJ83+/lDien0WmPPbpIGHKEhqJ8IzYTHwbUdPU/jpD sBcZp5qxdjJbaDbuxzvpTJ3BZlX1P5dCJ3y1f1YzUcywGDhh5r4zXqU1MYZgmNuGt97ezPbdjMh uGwJokwef9D+A1XJbt9xAS+SibNaEvWBWBpA+tyHCHioHBP9rtx0NPWZNhitXe508W9fBlSQh1z IetTnCuW+X1x+30BsO5eVRgaq7oOw0U9IOp10oE/9873ooV1Whvthe2TxnFvtTrS2FUoCSEYQ== X-Received: by 2002:a05:6000:400f:b0:488:8ad2:e169 with SMTP id ffacd0b85a97d-48e264fbb47mr358866f8f.56.1792538574539; Tue, 20 Oct 2026 16:22:54 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:54 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 05/25] expat: patch CVE-2026-102633 Date: Wed, 21 Oct 2026 01:22:15 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:22:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248323 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-102633 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../expat/expat/CVE-2026-102633.patch | 68 +++++++++++++++++++ meta/recipes-core/expat/expat_2.8.3.bb | 1 + 2 files changed, 69 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-102633.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-102633.patch b/meta/recipes-core/expat/expat/CVE-2026-102633.patch new file mode 100644 index 00000000000..17851201267 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-102633.patch @@ -0,0 +1,68 @@ +From 69edbec09f2cd3e0bd6e0a093b55ea38af902d7d Mon Sep 17 00:00:00 2001 +From: Filippo Tedeschi +Date: Thu, 24 Sep 2026 21:14:23 +0200 +Subject: [PATCH] lib|tests: Replace assert with runtime overflow check in + expat_realloc + +In expat_realloc, the size passed to realloc_fcn is calculated as +sizeof(size_t) + EXPAT_MALLOC_PADDING + size. Previously, expat_realloc +relied on an assertion: +assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size); +under the assumption that preceding accounting checks and parser +invariants preclude reaching an overflow state in practice. + +However, in release builds compiled with NDEBUG, assertions are +compiled out. Replace the assert with an explicit runtime check: +if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) { + return NULL; +} +immediately preceding the addition, ensuring consistent defensive +behavior across all build configurations. + +Also extend test_alloc_tracker_size_recorded in alloc_tests.c to +exercise SIZE_MAX and SIZE_MAX / 2 with expat_realloc, verifying +that the allocation fails and the recorded size remains unchanged. + +Signed-off-by: Filippo Tedeschi + +CVE: CVE-2026-102633 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/69edbec09f2cd3e0bd6e0a093b55ea38af902d7d] +Signed-off-by: Peter Marko +--- + lib/xmlparse.c | 7 ++++--- + tests/alloc_tests.c | 4 ++++ + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index dfcfb0c2..67005454 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -1023,9 +1023,10 @@ expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine) { + } + } + +- // NOTE: Integer overflow detection has already been done for us +- // by expat_heap_increase_tolerable(..) above +- assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size); ++ // Detect and prevent integer overflow ++ if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) { ++ return NULL; ++ } + + // Actually allocate + mallocedPtr = parser->m_mem.realloc_fcn( +diff --git a/tests/alloc_tests.c b/tests/alloc_tests.c +index 6be0a073..a5cea463 100644 +--- a/tests/alloc_tests.c ++++ b/tests/alloc_tests.c +@@ -2118,6 +2118,10 @@ START_TEST(test_alloc_tracker_size_recorded) { + assert_true(ptr != NULL); + assert_true(sizeRecordedFor(ptr) == 10); + ++ assert_true(expat_realloc(parser, ptr, SIZE_MAX, -1) == NULL); ++ ++ assert_true(sizeRecordedFor(ptr) == 10); // i.e. unchanged ++ + assert_true(expat_realloc(parser, ptr, SIZE_MAX / 2, -1) == NULL); + + assert_true(sizeRecordedFor(ptr) == 10); // i.e. unchanged diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb index 6d08a3fd94b..3a179db62cc 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.3.bb @@ -18,6 +18,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-76957-02.patch \ file://CVE-2026-93990-01.patch \ file://CVE-2026-93990-02.patch \ + file://CVE-2026-102633.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Tue Oct 20 23:22:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101442 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f54.google.com (mail-wr1-f54.google.com [209.85.221.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4764.1792538576867559012 for ; Tue, 20 Oct 2026 16:22:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=APaAbSnq; spf=pass (domain: smile.fr, ip: 209.85.221.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f54.google.com with SMTP id ffacd0b85a97d-48e10a70540so58104f8f.1 for ; Tue, 20 Oct 2026 16:22:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538575; x=1793143375; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=G5ExFhJSxl6Fuf2kVJZ0kw9yTp6dqT+hn+zSnF2Sp4o=; b=APaAbSnqff2dgH541JSiipFLYXn4BkbjMy8YPqRgwlQ7HMNUQ2F+bUJi/sjHB9l59A Xl9ozEnp8YiMJ70Y1/RItpvjBVO7FNZkKnwA7xVita2672HIARd5p3Owce0GFHXuH3Uh s87cWt30Ps9VpF29+1KhUOTJQvYhfss3QUwzVS3GZDlZ/tosGtPqIqBJDnthqI6Xxxyw Y2x91jF+8Yj2gdKtDwIoWHHr8DYkAEr//BZd5RZMNHPUFgNu++a64xQn//bL73vxA7vj TgJH/P9PdbFdGtqFa0APjItyviPOT5zw+IAp6x1g10p/uR5LZFPTu7PRttpomA/VzGpz TWHg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538575; x=1793143375; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=G5ExFhJSxl6Fuf2kVJZ0kw9yTp6dqT+hn+zSnF2Sp4o=; b=tvDFUvkwTWDMl+ZQqdeJ0RyP3k9DrGldd78PmhysQ4NZSz/DQv51pYXoZeK/KQKYlz HP/U25k4I6mzbkxyeHeUndDnqkw2G5d5UpWJPv/EXm1tNYSUaD3sasj1ws/hP6RqcWXI oZRdhp3ZsRn2BUqSsMoVM8rzIvb0vTDtWYzeTKVip+sp7dlP2TdixlFrqfeBWsnDC7vQ lygKWJ7bTBwlqGYwkTRKanEWamk7jROR84wewxUTiKS8RpX3E1LQ2JD2LM1RvVRht4HZ GG6W+Ywt0wrbrzj9SzIQJthtgtxxyUl+V/dfFj9pWpcd7wshq6txWL5Lshg325JzV8Sl i/ZA== X-Gm-Message-State: AFq9FYJ8Z5UHYhSBckYtIsPep1fg/6BU1rwVfK7zpHzPHBwF11zjNlKI e/owIXBwb/O+f9zCsn6sNTztm60dj5HC8cyErnxPaN/ziqsnfs1pKxDhEpOS/HXlobKa4rWB4tW E5mX9xsU= X-Gm-Gg: AYBFou0YlqT/m6TVROm658tXgIRU29z4WiuXmhknWCy19OnvSaXsVjPYcgOe0PfObnH 6VZodoAyijlytbkUzweKa2DxcmDKbSMekwiXtIbhn2UQyukkQOP+nArB/NjkK6zGmQCShiRrg3L fd6FhCzo+hCtCVpnlivr+CjIs322mg+LYU1U4avu+hwvN0SSmckGDuIpomNLnoUkWkC2XDYYIz2 h8b6J+4A8iHd3WK81NJ48LLDzf7Krwz4t0BODWtLk8UB7ffcz+67QF+FpYbWzyulJXmXyg6BUYg xjUEpduZRKg1xonnFoKiJ7zDKBXqSEeOPj0Z2v0Lu8tXQVfwM202msYu1SqkdyzlmoDxaqmaEPZ FH/XAzlXxKUNJj0OdGL4Ylf3TY96RnFlkQV7uYQ4PHdu6ixx2+4IkD96vIwXd/azLDqjjOiVWxN SvvMdzMV1m1UoFS00o7mO7bp3ysCCVdDUekGBOSt1LrTicQAEqX7TvVFO598nMsXywX91lmi4sK FBmNh8zlJUm9USbBtGOn+4cd16dsduWVZFnGdY+omAaLXkJoD3ahtMZ27BvTCyWl0lKo2Q1jQ== X-Received: by 2002:a05:6000:1049:b0:48d:ef7d:4b4c with SMTP id ffacd0b85a97d-48e264dd966mr238015f8f.44.1792538574920; Tue, 20 Oct 2026 16:22:54 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:54 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 06/25] expat: patch CVE-2026-77214 Date: Wed, 21 Oct 2026 01:22:16 +0200 Message-ID: <8c8ed2edcb616c3c07500b0378554dcf1b10ea6e.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:22:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248324 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-77214 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../expat/expat/CVE-2026-77214.patch | 106 ++++++++++++++++++ meta/recipes-core/expat/expat_2.8.3.bb | 1 + 2 files changed, 107 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-77214.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-77214.patch b/meta/recipes-core/expat/expat/CVE-2026-77214.patch new file mode 100644 index 00000000000..6d746487054 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-77214.patch @@ -0,0 +1,106 @@ +From 4d9b1c499ecb66323260a7274edcf86c5eab0517 Mon Sep 17 00:00:00 2001 +From: Filippo Tedeschi +Date: Fri, 25 Sep 2026 19:51:10 +0200 +Subject: [PATCH] lib|tests: Validate len against buffer capacity in + XML_ParseBuffer + +In XML_ParseBuffer(), if len exceeds the unoccupied capacity of the +internal buffer (EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd)), +parser->m_bufferEnd was previously advanced past parser->m_bufferLim. +This violated the parser's internal pointer invariant (m_bufferEnd <= +m_bufferLim) and caused callProcessor() to read unallocated or +uninitialized heap memory beyond the buffer bounds. + +Validate that len <= EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd) for +both XML_INITIALIZED and XML_PARSING states. If len exceeds the +available buffer capacity, return XML_STATUS_ERROR with +XML_ERROR_INVALID_ARGUMENT. + +Also add test_parse_buffer_exceeds_buffer in tests/basic_tests.c. + +Co-authored-by: Sebastian Pipping +Signed-off-by: Filippo Tedeschi + +CVE: CVE-2026-77214 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/4d9b1c499ecb66323260a7274edcf86c5eab0517] +Signed-off-by: Peter Marko +--- + lib/xmlparse.c | 5 +++++ + tests/basic_tests.c | 41 +++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 46 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 08ef9f72..6e3af97b 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -2465,6 +2465,11 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) { + parser->m_parsingStatus.parsing = XML_PARSING; + } + ++ if (len > EXPAT_SAFE_PTR_DIFF(parser->m_bufferLim, parser->m_bufferEnd)) { ++ parser->m_errorCode = XML_ERROR_INVALID_ARGUMENT; ++ return XML_STATUS_ERROR; ++ } ++ + // Detect and avoid integer overflow + if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) { + parser->m_errorCode = XML_ERROR_NO_MEMORY; +diff --git a/tests/basic_tests.c b/tests/basic_tests.c +index 06268469..35e17d31 100644 +--- a/tests/basic_tests.c ++++ b/tests/basic_tests.c +@@ -3605,6 +3605,46 @@ START_TEST(test_negative_len_parse_buffer) { + } + END_TEST + ++/* Test XML_ParseBuffer rejects calls where len exceeds available buffer */ ++START_TEST(test_parse_buffer_exceeds_buffer) { ++ for (int isFinal = 0; isFinal < 2; isFinal++) { ++ set_subtest("isFinal=%d", isFinal); ++ ++ XML_Parser parser = XML_ParserCreate(NULL); ++ ++ /* Calling XML_ParseBuffer without any prior XML_GetBuffer call */ ++ if (XML_ParseBuffer(parser, 10, isFinal) != XML_STATUS_ERROR) ++ fail("XML_ParseBuffer without XML_GetBuffer was expected to fail."); ++ if (XML_GetErrorCode(parser) != XML_ERROR_NO_BUFFER) ++ fail("Expected XML_ERROR_NO_BUFFER."); ++ ++ /* Acquire a small buffer */ ++ void *const buffer = XML_GetBuffer(parser, 10); ++ if (buffer == NULL) ++ fail("XML_GetBuffer failed."); ++ ++ /* Calling XML_ParseBuffer with len exceeding available buffer capacity */ ++ if (XML_ParseBuffer(parser, 10000, isFinal) != XML_STATUS_ERROR) ++ fail("XML_ParseBuffer with len > capacity was expected to fail."); ++ if (XML_GetErrorCode(parser) != XML_ERROR_INVALID_ARGUMENT) ++ fail("Expected XML_ERROR_INVALID_ARGUMENT."); ++ ++ /* Valid parse */ ++ memcpy(buffer, "", 7); ++ if (XML_ParseBuffer(parser, 7, XML_FALSE) != XML_STATUS_OK) ++ xml_failure(parser); ++ ++ /* Subsequent XML_ParseBuffer where len exceeds remaining capacity */ ++ if (XML_ParseBuffer(parser, 10000, isFinal) != XML_STATUS_ERROR) ++ fail("XML_ParseBuffer on subsequent chunk was expected to fail."); ++ if (XML_GetErrorCode(parser) != XML_ERROR_INVALID_ARGUMENT) ++ fail("Expected XML_ERROR_INVALID_ARGUMENT."); ++ ++ XML_ParserFree(parser); ++ } ++} ++END_TEST ++ + /* Test odd corners of the XML_GetBuffer interface */ + static enum XML_Status + get_feature(enum XML_FeatureEnum feature_id, long *presult) { +@@ -7054,6 +7094,7 @@ make_basic_test_case(Suite *s) { + tcase_add_test(tc_basic, test_empty_parse); + tcase_add_test(tc_basic, test_negative_len_parse); + tcase_add_test(tc_basic, test_negative_len_parse_buffer); ++ tcase_add_test(tc_basic, test_parse_buffer_exceeds_buffer); + tcase_add_test(tc_basic, test_get_buffer_1); + tcase_add_test(tc_basic, test_get_buffer_2); + #if XML_CONTEXT_BYTES > 0 diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb index 3a179db62cc..02a8536440d 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.3.bb @@ -19,6 +19,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-93990-01.patch \ file://CVE-2026-93990-02.patch \ file://CVE-2026-102633.patch \ + file://CVE-2026-77214.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Tue Oct 20 23:22:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101445 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4765.1792538577413047787 for ; Tue, 20 Oct 2026 16:22:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=ut3h1GFw; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4a180fbeef5so667225e9.1 for ; Tue, 20 Oct 2026 16:22:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538575; x=1793143375; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=y4oKVVORVt0IlZBUsroZsd+SseiUWFv5sj8mPT1SmJ8=; b=ut3h1GFw1BBXmWUImG8twt0F5epDpY9GZ9Ob5NjJrCWDkMznF6jVJBSZc/pry0qpX+ IEBlSGl39tZkFoCV2FngibgrSe+RmUessCpDlG6WeWS8cRA2sBqUSo5O+1dbG0oen65t v6b2H++106WEu7WhTCizd8i9TlF5Xjy2zttzHPsI8ctFck1bR32LyXobTRmYiEat5OAE rwYkZ5tZCmfkcALla2UcI10DLduPgqpNH+NZZKEmCj0FVx+V5V6TLsCD9TFEvxvm/glK zFkY/9wY5QjYceqmhEQFHb3RZGkIOFKQX+9A/J1jaUc+/uUTcuZ34iE+0VzTggdw0fYr z/Gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538575; x=1793143375; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=y4oKVVORVt0IlZBUsroZsd+SseiUWFv5sj8mPT1SmJ8=; b=cfZ4WmeBytQUy96mPDSHoGDe6djK1bNEluJY8B1nzlV12EquNdQum4W1nZRwNo03ze EqUkh8SAIOfNb8qLmEbMP1biKq+JKqdVfL+m2x2JoB8PPkLp61Wcc6qlQvm/UaO97okS KHZ7Ug0qCvItCeq+lKnNvw3ng7uonY4+pWo0SDQCbEfz3xS6yXUWlHW9yC+pgnFp7R6Q zM3sYpWtiHI1LRe21T+anKdrNXMs9yjVM0voPJjN2sLequeBhVyDDdDaUeEb2E1mjyCR uUhzzBWxX6xyna3rGU1E9/yjgKEVi9Fo6j32ffLyYZaby0+CzjaguuA8hr0D5ylXVGYa Dieg== X-Gm-Message-State: AFq9FYLsHZXkrlsfxo4Iq7svWgUzbAIEHHu+/YLPkZ3YJtivA1D0GCd5 iaC3KYb1P/p20Xob9tCelAPCiEXjtkDpDcB8jVgRelk8agLXLQemMM56/ux9yAkphKCwZGilVc2 VYeUjIJg= X-Gm-Gg: AYBFou0M/+fjo/+PbC1ygkq8daaIYXD6sOe36NG1KaC2qpqYQmgIxYG1rXwIe6s8nfO rhNk5fV600wwEJoElpA/xbAzK6pUEf7ZJq0tKSCjW9f8mPZKWR/6/Rh8Zkr68XFBHZ9ExFsxu8Z OpLoJY+107c0Qaixcr8AqQ0+O78nzhuCF1QiGKsdTjbrrCDxZT4NUbfa/dDD0AnxoS3WlgHL1vy 7qwhDPPVe0a5V9OCA3wf65CoVy4jbrMjJyW9WTtP/8uE9m0HH/YBZBXcxtp4AGZ6XWPVYIObYoe MSlGIiWydFiCQY2KwgarsVbrGq+cZB7dSihpmpZZoNfwEnpO0OjFoRKMrkhDC1WbGINm/IBkxBh noGlXcYAjWB/Rh5S7QRXxZLoE249Jolm8QWGhbyGY9QVZ1Zy2rGCytZBaL3dkMoSUPZE2iQs6eu 2tMMuYYjz/hW3PE6VoxhOQmxFblnS/HHtD+UkS2aodgMsU3dMi/ZGkvhS4AIENoSsxcgzYECRqS f+sOzgVICXh3qkdMqT1Ny72ioKVrCAzaeunz1iZRp0nopP1StfBMs+DMJ1TvkD5q3JovDaUSqyo l4Wkizg3b7/tYq1YP3fbk3ZWiHTO4oIajJ8DZUTfZBL1aG2uysBeBtnQaSE8pPuoKZZRuyKys2b N X-Received: by 2002:a05:600c:b86:b0:4a0:1fb9:2f51 with SMTP id 5b1f17b1804b1-4a1fdd2fa6cmr3723605e9.14.1792538575522; Tue, 20 Oct 2026 16:22:55 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:55 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 07/25] tzdata/tzcode-native: upgrade 2026d -> 2026e Date: Wed, 21 Oct 2026 01:22:17 +0200 Message-ID: <8bc3f14380f03e1c5dbbe6db5c4d001220067d22.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248326 From: Ankur Tyagi Changelog: https://www.iana.org/time-zones/releases/2026e Signed-off-by: Ankur Tyagi Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 35a0a18640e92bd98eca22ec9150be11daca1df7) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal --- meta/recipes-extended/timezone/timezone.inc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/meta/recipes-extended/timezone/timezone.inc b/meta/recipes-extended/timezone/timezone.inc index 6a65f2deb22..eb439701997 100644 --- a/meta/recipes-extended/timezone/timezone.inc +++ b/meta/recipes-extended/timezone/timezone.inc @@ -6,7 +6,7 @@ SECTION = "base" LICENSE = "PD & BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=c679c9d6b02bc2757b3eaf8f53c43fba" -PV = "2026d" +PV = "2026e" SRC_URI = "http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode;subdir=tz \ http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata;subdir=tz \ @@ -14,5 +14,5 @@ SRC_URI = "http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz S = "${UNPACKDIR}/tz" -SRC_URI[tzcode.sha256sum] = "2f5c9f7fe29e6b8cb863583667884b8ce17b0a485355a054b591c6bdfcd81791" -SRC_URI[tzdata.sha256sum] = "0cb2aa8e333c3dc049badc42a0c61f21987b8cd44e107fa900bad764aacc7767" +SRC_URI[tzcode.sha256sum] = "cc3d27ca2a0d8399504551b920970d80af83bfb9c216e8082a15491921935d54" +SRC_URI[tzdata.sha256sum] = "b26882805f26aac59d5b222978e6580484b834ccdc98be89df2f05a6dc53a652" From patchwork Tue Oct 20 23:22:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101444 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4766.1792538578004965234 for ; Tue, 20 Oct 2026 16:22:58 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=wtkOp5tQ; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-4a19cba5c14so830055e9.3 for ; Tue, 20 Oct 2026 16:22:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538576; x=1793143376; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=TUyMZ3BcIu4yyboe/ZjkC6js6wQrv8uhCTe4FIuD51U=; b=wtkOp5tQ+50lpt2T+Xek6rxDPodOWBe1UvLhfM63wTLJ/WJEJyME3Tw9gIdK6YUnvY Ya3a4Zj5LKZ6lGEirSi0Vq5/TK4y2TcpbeP++i85Dr8Gk935ynlgYXXgaydX26+Kqw5K lpuPIXJU7G3KPFGCXOC/hKUxThSuQffEc4wCG/yXgQbOd7FLTvYysllghFz8ONBvmtG1 fRg18nUOFQJ431to/GxdTxfWUJuT4LkN3D/kaumrIizWQPNSygVkBGfKU3LUXUtPGhUQ iz6CKu6LtiDFN23PlLL88Uwk5WPcYGON8jkwWbWBxzaTHCbAOidkIM8ABwS2u76FcOaN JRrQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538576; x=1793143376; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=TUyMZ3BcIu4yyboe/ZjkC6js6wQrv8uhCTe4FIuD51U=; b=Uh/idwTtzNrW8/rS713OLFw00tbKw9FCc2yDx8LU4gD01baJv+NAAQFtddltID8ZfD MlOOEPbBe8bHv+tYCmNtGxI5XtfMZ4mIKmm5IWv7TomCD5ddtKylx7VvuBV8wcbpTK0w 9NRCXRAL/nLU11H400EF5ZnNKP5TvQBECULgcnJ2r4ZXgS0Bv48KWhcuXo8IwYOmu56n 3JrFL2bnlwwtn+UWkhjSir/YGBMNNYBKDo/CvBqU/dOz0ZB1zjtNULi4YlQ4LxjKAYdw IVC5O97Q7I0gzyXzarr6vbnMK2remrK9JHJGeEizStOfuI3ejWVw71fqeI/s1Hez2gcQ uWpA== X-Gm-Message-State: AFq9FYKuH4obK74jueK3mbXcg7VKiVrl/654snPs3NO0WP/gEq409kYs f905eCW56t5ucHpZJCDhfaFy1uAeNFGdceFeL3ezERxJg4gf8DLKU5w3mdmS27rUKTzf7FJxJP9 y/1InhPk= X-Gm-Gg: AYBFou1DahG/tbgmIVinOku1+emGddLZnLbO72s+aJKDRfAn/oNYaxkSmPx/XiEJOI/ b1odeGnCe0m6LLBHrKDDuludye+/93Myvs4udPdBGmjZUTqqY7+Hck1La7fau85Bh0Y9QwcNuKx tF4dzfqEOxuv+zG2l4WV3xvHZDXwmb+gbUEQcnbMl71PFp2QToAJID18TWqTnf/4giLY6av/io5 5bpLoiE9bl8qaveMJD6Z/Z5GkeENwZu/fVIqBtS/GFy8RRP4rSxiwUN0YsuDCq3SATTHFJ8zyuT pYDaSY97DAb9iZjAKBdACwSky4gcIAeWtgj5/N0zQ6PjoOxbnoOaJXxogwIZqKSQov7wToPmb2G K9hTaC6o+Un+TdgrQrA7eZMFhbXE5M0pKamvfgyFSQdgcRWKBXzKVyRWm8Jse5dUjNYRZICXHyI fUKlgxkqpDyJUR5Z/ar+Y1bQR0JxfHde4hozUAFgG3S0ESEB31hyVgnzjFMOKdsoL93mHO4NEtn IQwyq3qfEuzMDlszkRuWvph96+c7taAoRvgH6N0ujQ3qbUsrVTamdyqQNmrbyWW3Ww5b4Mjow== X-Received: by 2002:a05:600c:3b82:b0:4a0:108:3b48 with SMTP id 5b1f17b1804b1-4a1fdaf7464mr4500645e9.7.1792538576109; Tue, 20 Oct 2026 16:22:56 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:55 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 08/25] gcc: Fix for CVE-2026-102010 Date: Wed, 21 Oct 2026 01:22:18 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248327 From: Hemanth Kumar M D PR 127656 use-after-free in libstdc++ pbds binary heap erase_if After reallocating the storage the m_a_entries pointer is left dangling and the new storage is leaked. Update m_a_entries after reallocation References: https://nvd.nist.gov/vuln/detail/CVE-2026-102010 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127656 https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6 Signed-off-by: Hemanth Kumar M D Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit afc275bd17dea41c2ea6a5c73c697052c2df4e38) Signed-off-by: Yoann Congal [YC: deindented the commit message] --- meta/recipes-devtools/gcc/gcc-15.3.inc | 1 + .../gcc/gcc/0029-CVE-2026-102010.patch | 73 +++++++++++++++++++ 2 files changed, 74 insertions(+) create mode 100644 meta/recipes-devtools/gcc/gcc/0029-CVE-2026-102010.patch diff --git a/meta/recipes-devtools/gcc/gcc-15.3.inc b/meta/recipes-devtools/gcc/gcc-15.3.inc index 2f743510850..ed719197bc3 100644 --- a/meta/recipes-devtools/gcc/gcc-15.3.inc +++ b/meta/recipes-devtools/gcc/gcc-15.3.inc @@ -75,6 +75,7 @@ SRC_URI = "${BASEURI} \ file://0028-fix-gcc-libitm-false-postives-02.patch \ file://0025-gcc-testsuite-tweaks-for-mips-OE.patch \ file://0001-mapper-localhost-might-not-be-known.patch \ + file://0029-CVE-2026-102010.patch \ " UNPACKDIR = "${TMPDIR}/work-shared/gcc-${PV}-${PR}/sources" diff --git a/meta/recipes-devtools/gcc/gcc/0029-CVE-2026-102010.patch b/meta/recipes-devtools/gcc/gcc/0029-CVE-2026-102010.patch new file mode 100644 index 00000000000..5eed94ab5a3 --- /dev/null +++ b/meta/recipes-devtools/gcc/gcc/0029-CVE-2026-102010.patch @@ -0,0 +1,73 @@ +From 29e51a820d76c766ae417fcba912714337b0eb17 Mon Sep 17 00:00:00 2001 +From: Jonathan Wakely +Date: Fri, 25 Sep 2026 18:14:34 +0100 +Subject: libstdc++: Fix use-after-free in pbds binary heap (CVE-2026-102010) + [PR127656] +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +After reallocating the storage the m_a_entries pointer is left dangling +and the new storage is leaked. + +libstdc++-v3/ChangeLog: + + PR libstdc++/127656 + * include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp + (erase_if): Update m_a_entries after reallocation. + * testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc: + New test. + +CVE: CVE-2026-102010 + +Upstream-Status: Backport [https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6] + +Reviewed-by: Tomasz Kamiński +Signed-off-by: Hemanth Kumar M D +(cherry picked from commit aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6) +--- + .../ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp | 1 + + .../ext/pb_ds/regression/priority_queues_erase_if.cc | 19 +++++++++++++++++++ + 2 files changed, 20 insertions(+) + create mode 100644 libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc + +diff --git a/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp b/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp +index 752688bb8e94..1eec3c9fb334 100644 +--- a/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp ++++ b/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp +@@ -121,6 +121,7 @@ erase_if(Pred pred) + entry_pointer new_entries = s_entry_allocator.allocate(new_size); + std::copy(m_a_entries, m_a_entries + left, new_entries); + s_entry_allocator.deallocate(m_a_entries, m_actual_size); ++ m_a_entries = new_entries; + m_actual_size = new_size; + resize_policy::notify_arbitrary(m_actual_size); + } +diff --git a/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc b/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc +new file mode 100644 +index 000000000000..30b8452eff96 +--- /dev/null ++++ b/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc +@@ -0,0 +1,19 @@ ++// { dg-do run } ++ ++// CVE-2026-201020 use-after-free in binary heap erase_if ++ ++#include ++ ++bool is_odd(int v) { return v & 1; } ++ ++int main() ++{ ++ using __gnu_pbds::priority_queue; ++ using __gnu_pbds::binary_heap_tag; ++ priority_queue, binary_heap_tag> q; ++ q.push(1); ++ q.push(2); ++ q.push(3); ++ q.erase_if(&is_odd); ++ q.clear(); ++} +-- +cgit + From patchwork Tue Oct 20 23:22:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101446 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4767.1792538578518206383 for ; Tue, 20 Oct 2026 16:22:58 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=au2JBZ61; spf=pass (domain: smile.fr, ip: 209.85.221.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-48dfaa3fa12so825436f8f.0 for ; Tue, 20 Oct 2026 16:22:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538577; x=1793143377; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=M0kkC5k69Ne+LFvUu4L/MIsGCpzgo+eBy/mbDEiqQ5U=; b=au2JBZ618wUQ1p3J94Dev42m707IBAfywnFBjdGZy5i/N810zHkyMBdhsUCjHOXWDv fY41+xxU4RmyxOL54t7easrvubETHG4Xx7iPnvoJWayaDtXFoJz4ejXtK1+38O5Pep/o +3EEQ+2evNkida2H0OiSGsmMMMboKdcQWPGPqYfScpxV3ZKJP9ptkXSTBmLEFUMoSMYJ Fb4FvFOb0OrGP5nzCePANqGpCepBdYhRSU3lWKG1JIftSFRtitF3oX8d5DPRbBX5JihB NvBcSr32v2culXY1fCf3of/lbDsbOSMNHs7mtU2XiSOW2Ox9XTVrGbQN2WoaMVhllL9k n2Fg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538577; x=1793143377; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=M0kkC5k69Ne+LFvUu4L/MIsGCpzgo+eBy/mbDEiqQ5U=; b=tWHngMnNbw9lwEy4BQkZOa/moz3Tv9mnt0a5qXPgpR5fCJv3rnyATljJB3pXlhmNQo unk5QJR4ucQQQubX9UXNmgwQx0/xyLidzvG0u4kttUNljstWqkauoinTRAJe0kYhEwPm qE8x0Pidxa8DGPJ6wqF1bPOPVPX+/snax8x2/KmXS+PUne3HWOidPZZLLXQHrX1zWrrO rN9WEsO+XYsWIuFNL+wgkxYSZAbwWnMq9QFDAXJp0lRvzmU1W0P0fsDtpjbplKMBJ77V CUigluJdEl9rclhKX8hoWVNJRzlMG3swC3KlHCBZ1kfxYvYQjrsQUlAuZ45gciy+FZQS 96/Q== X-Gm-Message-State: AFq9FYLftmI0OpaYJwvN6YaomANBhOFB8f8/uYgCfsfhO9ZlFS2SgaWd ArbS7kA3FO0tqjmMoYc1AdCfzaiwuvyR8P4tcfWEMGqCc6LhNSfvNktpnPmX0uxlruhZXs9UwrG oa6p0k8E= X-Gm-Gg: AYBFou0v3PTb2mTuiTMAaTfM6nf9ARegvofHMyNs90Dyt1MWqUVwyg1eZsf8YN7NhEF U4YOwN+rPae1WzoYMWi2soLioYU+Kup2KlQwQUYuWa030x27VvkMvre3l75XfgyzE2oRUjMIzS7 IvjzOZy92jrIUvJUyY5v85kYw03u+SKuoUVL2umAA18x628m/hOawQijvfu4+05qSwnLcJbJyI7 jTeEjJJY3UVOBbVdjcs7zvi8+8cJKpJiPY21Gv+JDXmFImuOyEunoTYJj7so3NH42AynPAhWOHO 4o18l2EQeFa4zmNBELE+/YkRdqvcDj5oXSSMPOwjzW1e/TvdzutYMfHCF8DFMuiRwdmtna83Ff3 ghDqxURSg90OIEWozv4OA39qDrqXT7uPdtfRj7sw+wzOR7nPjBNcV3NcNAJUrMAlHPcB2AWPTmk Hpmqs4TaEMubvzhTFfNTD2VKlDZcwjmyi0pARv4OhJRh/XHRUY28jNOXHs6V/TL1ZGZBANYM/IM J9Ld3/ZtLnZYRq+jOnCDTKslau9HwmzMdm82Vx+amyMIIqo2d7hjBptwocyh46djUcT0ueoZnX/ 2ujghzL+jsG+zR7IWtCIUCJh6DpZ72ntvGT+kUwYbUSAMAwTTvUXRPM= X-Received: by 2002:a05:600c:4f91:b0:4a1:a7f8:c124 with SMTP id 5b1f17b1804b1-4a1fdd0c00bmr3719575e9.7.1792538576555; Tue, 20 Oct 2026 16:22:56 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:56 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 09/25] glib-2.0: upgrade 2.88.2 -> 2.88.3 Date: Wed, 21 Oct 2026 01:22:19 +0200 Message-ID: <7e10ca136d7d4dbaf56814f3c8e1537c05999ce6.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248328 From: Peter Marko Changelog: https://gitlab.gnome.org/GNOME/glib/-/blob/2.88.3/NEWS#L1-L17 Source: NEWS Overview of changes in GLib 2.88.3, 2026-07-29 ============================================== * Fix potential miscompilation with GCC 17 with G_GNUC_CONST on get_type() functions (#3984, work by Sam James) * Bugs fixed: - #3984 G_GNUC_CONST vs get_type comes home to roost (Sam James) - #3985 (CVE-2026-15588) Security report: GDBusServer pre-authentication DoS via unbounded SASL line buffering (Philip Withnall) - !5225 Backport !5223 "Drop G_GNUC_CONST for *_get_type" to glib-2-88 - !5241 Backport !5240 "gdbusauth: Limit length of lines read from client" to glib-2-88 - !5242 Backport !5238 "gpoll: Correctly zero-out heap-allocated fd_sets on macOS" to glib-2-88 - !5243 gdbusauth: Unmark a new string as translatable - !5259 Backport !5248, !5249: several Meson/gcc fixes to glib-2-88 CVE-2026-58016 patches refreshed due to context changes in the new version. The patch content is unchanged, only line offsets updated. Backport fix for buildpaths QA error from upstream !5259: use the .in template as input for the installed service file. [https://gitlab.gnome.org/GNOME/glib/-/commit/ed5956d] Pre-existing failure: glib/gdbus-server-auth.test (SIGABRT, same in both versions) This commit is roughly equivalent to OE-Core rev: d44fcc04348344add7546d1e80806026aafbf108 Exact cherry-pick is not possible as the branches diverged a bit in patch formatting. Created by copying glib-2.0 directory from OE-Core rev: 8de7017a3161ffb04f36e9c6ba2f7ead402dc4a5 (and reverting LICENSE change) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- ...t-write-bindir-into-pkg-config-files.patch | 6 ++-- ...0001-Fix-DATADIRNAME-on-uclibc-Linux.patch | 2 +- ...-gio-querymodules-as-libexec_PROGRAM.patch | 21 +++++------ ...ng-about-deprecated-paths-in-schemas.patch | 2 +- ...ces.c-comment-out-a-build-host-only-.patch | 2 +- ...es-Fix-installed-service-file-using-.patch | 35 +++++++++++++++++++ ...on-Run-atomics-test-on-clang-as-well.patch | 4 +-- ...ot-enable-pidfd-features-on-native-g.patch | 4 +-- ...dcode-python-path-into-various-tools.patch | 4 +-- .../glib-2.0/files/CVE-2026-58016-1.patch | 14 ++++---- .../glib-2.0/files/CVE-2026-58016-2.patch | 10 +++--- .../glib-2.0/files/relocate-modules.patch | 4 +-- .../glib-2.0/files/skip-timeout.patch | 2 +- ...l_2.88.2.bb => glib-2.0-initial_2.88.3.bb} | 0 ...{glib-2.0_2.88.2.bb => glib-2.0_2.88.3.bb} | 0 meta/recipes-core/glib-2.0/glib.inc | 3 +- 16 files changed, 73 insertions(+), 40 deletions(-) create mode 100644 meta/recipes-core/glib-2.0/files/0001-gio-tests-services-Fix-installed-service-file-using-.patch rename meta/recipes-core/glib-2.0/{glib-2.0-initial_2.88.2.bb => glib-2.0-initial_2.88.3.bb} (100%) rename meta/recipes-core/glib-2.0/{glib-2.0_2.88.2.bb => glib-2.0_2.88.3.bb} (100%) diff --git a/meta/recipes-core/glib-2.0/files/0001-Do-not-write-bindir-into-pkg-config-files.patch b/meta/recipes-core/glib-2.0/files/0001-Do-not-write-bindir-into-pkg-config-files.patch index 8b783e81ea6..c22ef9fdb32 100644 --- a/meta/recipes-core/glib-2.0/files/0001-Do-not-write-bindir-into-pkg-config-files.patch +++ b/meta/recipes-core/glib-2.0/files/0001-Do-not-write-bindir-into-pkg-config-files.patch @@ -1,4 +1,4 @@ -From 6fe3965383d94b3030e85ab899955858710fec5c Mon Sep 17 00:00:00 2001 +From 94f8f5bf51db5219022f6a646e784cb67d284282 Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Fri, 15 Feb 2019 11:17:27 +0100 Subject: [PATCH] Do not prefix executables with $bindir in pkg-config files @@ -15,7 +15,7 @@ Signed-off-by: Alexander Kanavin 2 files changed, 13 insertions(+), 11 deletions(-) diff --git a/gio/meson.build b/gio/meson.build -index 2f8f188..57c48d2 100644 +index f9aa0c8..48ff2a5 100644 --- a/gio/meson.build +++ b/gio/meson.build @@ -934,17 +934,18 @@ libgio_dep = declare_dependency(link_with : libgio, @@ -46,7 +46,7 @@ index 2f8f188..57c48d2 100644 uninstalled_variables : [ 'gio=${prefix}/gio/gio', diff --git a/glib/meson.build b/glib/meson.build -index 209bcbf..a86cfd3 100644 +index 0fb6e26..9eebf73 100644 --- a/glib/meson.build +++ b/glib/meson.build @@ -480,9 +480,10 @@ pkg.generate(libglib, diff --git a/meta/recipes-core/glib-2.0/files/0001-Fix-DATADIRNAME-on-uclibc-Linux.patch b/meta/recipes-core/glib-2.0/files/0001-Fix-DATADIRNAME-on-uclibc-Linux.patch index b91624da8b3..bd7a04cccfd 100644 --- a/meta/recipes-core/glib-2.0/files/0001-Fix-DATADIRNAME-on-uclibc-Linux.patch +++ b/meta/recipes-core/glib-2.0/files/0001-Fix-DATADIRNAME-on-uclibc-Linux.patch @@ -1,4 +1,4 @@ -From 966c58aae35f9e2bcef5238e0331a119e0e51abd Mon Sep 17 00:00:00 2001 +From c80659ca01051f8e83dccd4eda15a811b0ea377d Mon Sep 17 00:00:00 2001 From: Khem Raj Date: Sat, 15 Mar 2014 22:42:29 -0700 Subject: [PATCH] Fix DATADIRNAME on uclibc/Linux diff --git a/meta/recipes-core/glib-2.0/files/0001-Install-gio-querymodules-as-libexec_PROGRAM.patch b/meta/recipes-core/glib-2.0/files/0001-Install-gio-querymodules-as-libexec_PROGRAM.patch index 5b7c3239962..8f6fd984727 100644 --- a/meta/recipes-core/glib-2.0/files/0001-Install-gio-querymodules-as-libexec_PROGRAM.patch +++ b/meta/recipes-core/glib-2.0/files/0001-Install-gio-querymodules-as-libexec_PROGRAM.patch @@ -1,4 +1,4 @@ -From 0de3a3a791ca32f2330eb3a8ad9da0fe6dce950c Mon Sep 17 00:00:00 2001 +From 25d6cb83b6b46181fbdad1a6f872a3788d6e4843 Mon Sep 17 00:00:00 2001 From: Jussi Kukkonen Date: Tue, 22 Mar 2016 15:14:58 +0200 Subject: [PATCH] Install gio-querymodules as libexec_PROGRAM @@ -9,18 +9,19 @@ renamer does not cope with library packages with files in ${bindir} Signed-off-by: Jussi Kukkonen Upstream-Status: Inappropriate [OE specific] --- - gio/meson.build | 1 + - 1 file changed, 1 insertion(+) + gio/meson.build | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gio/meson.build b/gio/meson.build -index 39256d3..2f8f188 100644 +index a3e6f18..f9aa0c8 100644 --- a/gio/meson.build +++ b/gio/meson.build -@@ -1071,6 +1071,7 @@ gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodu +@@ -1066,7 +1066,7 @@ executable('gresource', 'gresource-tool.c', + + gio_querymodules = executable('gio-querymodules', 'gio-querymodules.c', 'giomodule-priv.c', + install : true, +- install_dir : multiarch_bindir, ++ install_dir : glib_libexecdir, + install_tag : 'bin', c_args : gio_c_args, # intl.lib is not compatible with SAFESEH - link_args : noseh_link_args, -+ install_dir: glib_libexecdir, - dependencies : [libgio_dep, libgobject_dep, libgmodule_dep, libglib_dep, app_profile_dep]) - - glib_compile_schemas = executable('glib-compile-schemas', diff --git a/meta/recipes-core/glib-2.0/files/0001-Remove-the-warning-about-deprecated-paths-in-schemas.patch b/meta/recipes-core/glib-2.0/files/0001-Remove-the-warning-about-deprecated-paths-in-schemas.patch index d6dd66357ae..d64576b11e7 100644 --- a/meta/recipes-core/glib-2.0/files/0001-Remove-the-warning-about-deprecated-paths-in-schemas.patch +++ b/meta/recipes-core/glib-2.0/files/0001-Remove-the-warning-about-deprecated-paths-in-schemas.patch @@ -1,4 +1,4 @@ -From b829f3205e4d8390f02eaa8e7a7bf85e51cbb7ed Mon Sep 17 00:00:00 2001 +From 29be4e2681b78d7856143056f769040be076b03d Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Fri, 12 Jun 2015 17:08:46 +0300 Subject: [PATCH] Remove the warning about deprecated paths in schemas diff --git a/meta/recipes-core/glib-2.0/files/0001-gio-tests-resources.c-comment-out-a-build-host-only-.patch b/meta/recipes-core/glib-2.0/files/0001-gio-tests-resources.c-comment-out-a-build-host-only-.patch index 7a2fc0b7efa..579999fd6d0 100644 --- a/meta/recipes-core/glib-2.0/files/0001-gio-tests-resources.c-comment-out-a-build-host-only-.patch +++ b/meta/recipes-core/glib-2.0/files/0001-gio-tests-resources.c-comment-out-a-build-host-only-.patch @@ -1,4 +1,4 @@ -From 912e674bb0a3b51dabaa58da1834491ef94e6a2a Mon Sep 17 00:00:00 2001 +From 12bf3fded3b4c0c7b2d7ae7810d6eef47ed747e5 Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Wed, 8 Jan 2020 18:22:46 +0100 Subject: [PATCH] gio/tests/resources.c: comment out a build host-only test diff --git a/meta/recipes-core/glib-2.0/files/0001-gio-tests-services-Fix-installed-service-file-using-.patch b/meta/recipes-core/glib-2.0/files/0001-gio-tests-services-Fix-installed-service-file-using-.patch new file mode 100644 index 00000000000..755e51cdd3d --- /dev/null +++ b/meta/recipes-core/glib-2.0/files/0001-gio-tests-services-Fix-installed-service-file-using-.patch @@ -0,0 +1,35 @@ +From ed5956d0000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jaipaul Cheernam +Date: Thu, 30 Jul 2026 11:28:36 +0000 +Subject: [PATCH] gio/tests/services: Fix installed service file containing + build path + +The refactoring in !5259 changed the installed service file's +configure_file() to use the build output as input instead of the +original .in template. Since @installed_tests_dir@ is already +substituted in the build output, the installed version gets the +build directory path instead of the install prefix. + +Use the .in template directly as input for the installed version. + +Closes #4011 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/ed5956d] +Signed-off-by: Jaipaul Cheernam +--- + gio/tests/services/meson.build | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gio/tests/services/meson.build b/gio/tests/services/meson.build +index 1111111..2222222 100644 +--- a/gio/tests/services/meson.build ++++ b/gio/tests/services/meson.build +@@ -18,7 +18,7 @@ foreach service_file_name : dbus_service_files + # Build a second copy of the service file for the installed + # version of the tests. + installed_service_file = configure_file( +- input: service_file, ++ input: service_file_name + '.in', + output: service_file_name + '.to-install', + configuration: installed_cdata, + ) diff --git a/meta/recipes-core/glib-2.0/files/0001-meson-Run-atomics-test-on-clang-as-well.patch b/meta/recipes-core/glib-2.0/files/0001-meson-Run-atomics-test-on-clang-as-well.patch index 149833dc434..3f9b9e47413 100644 --- a/meta/recipes-core/glib-2.0/files/0001-meson-Run-atomics-test-on-clang-as-well.patch +++ b/meta/recipes-core/glib-2.0/files/0001-meson-Run-atomics-test-on-clang-as-well.patch @@ -1,4 +1,4 @@ -From 26ddae02d7677bcff7c3933ee856d34df41b548f Mon Sep 17 00:00:00 2001 +From 0530e624dd47ee18aab18c8d403da12bb297f26e Mon Sep 17 00:00:00 2001 From: Khem Raj Date: Sat, 12 Oct 2019 17:46:26 -0700 Subject: [PATCH] meson: Run atomics test on clang as well @@ -14,7 +14,7 @@ Signed-off-by: Khem Raj 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meson.build b/meson.build -index dab1d61..cc3a5ed 100644 +index 22ed181..87497b7 100644 --- a/meson.build +++ b/meson.build @@ -2100,7 +2100,7 @@ atomicdefine = ''' diff --git a/meta/recipes-core/glib-2.0/files/0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch b/meta/recipes-core/glib-2.0/files/0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch index efd5d3de1b1..0912859698c 100644 --- a/meta/recipes-core/glib-2.0/files/0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch +++ b/meta/recipes-core/glib-2.0/files/0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch @@ -1,4 +1,4 @@ -From c6cd3c0a66ae8f210185e0cb05b2172dc192ce9e Mon Sep 17 00:00:00 2001 +From 0147fb147548e0657f298ab8e050ef8aaad3c850 Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Sat, 16 Sep 2023 22:28:27 +0200 Subject: [PATCH] meson.build: do not enable pidfd features on native glib @@ -14,7 +14,7 @@ Signed-off-by: Alexander Kanavin 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/meson.build b/meson.build -index cc3a5ed..58dd87a 100644 +index 87497b7..6955b02 100644 --- a/meson.build +++ b/meson.build @@ -1098,7 +1098,8 @@ if cc.links('''#include diff --git a/meta/recipes-core/glib-2.0/files/0010-Do-not-hardcode-python-path-into-various-tools.patch b/meta/recipes-core/glib-2.0/files/0010-Do-not-hardcode-python-path-into-various-tools.patch index 8dbdf746b7d..c032d575eb0 100644 --- a/meta/recipes-core/glib-2.0/files/0010-Do-not-hardcode-python-path-into-various-tools.patch +++ b/meta/recipes-core/glib-2.0/files/0010-Do-not-hardcode-python-path-into-various-tools.patch @@ -1,4 +1,4 @@ -From 40e40230e6a3c52b79c6f92e8c060bd4d93f0374 Mon Sep 17 00:00:00 2001 +From 2bafa636db0241952b9168c62f051900ebf8b058 Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Tue, 3 Oct 2017 10:45:55 +0300 Subject: [PATCH] Do not hardcode python path into various tools @@ -32,7 +32,7 @@ index 0578b74..56e8e2e 100755 # pylint: disable=too-many-lines, missing-docstring, invalid-name diff --git a/gobject/glib-mkenums.in b/gobject/glib-mkenums.in -index 7e794e9..4b619f8 100755 +index f388714..37ed491 100755 --- a/gobject/glib-mkenums.in +++ b/gobject/glib-mkenums.in @@ -1,4 +1,4 @@ diff --git a/meta/recipes-core/glib-2.0/files/CVE-2026-58016-1.patch b/meta/recipes-core/glib-2.0/files/CVE-2026-58016-1.patch index 9beafd106d1..f6883ba85cc 100644 --- a/meta/recipes-core/glib-2.0/files/CVE-2026-58016-1.patch +++ b/meta/recipes-core/glib-2.0/files/CVE-2026-58016-1.patch @@ -1,8 +1,8 @@ -From 38eee3870fbcf6bdf8e6b1281bc7a98d32b68521 Mon Sep 17 00:00:00 2001 +From 9a59b64b294843842efc86148485c8b3530cdfd1 Mon Sep 17 00:00:00 2001 From: Philip Withnall Date: Thu, 16 Apr 2026 15:27:37 +0100 -Subject: [PATCH 1/2] gdbusintrospection: Fix XML parser state handling for - element nesting +Subject: [PATCH] gdbusintrospection: Fix XML parser state handling for + element nesting The check for whether a `` element in D-Bus introspection XML was nested correctly was broken. `` elements can only be at the top @@ -27,7 +27,7 @@ Signed-off-by: Benjamin Robin 2 files changed, 34 insertions(+), 1 deletion(-) diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c -index c7be334ce2f7..6f722ee6153d 100644 +index df5daa3..78a63e2 100644 --- a/gio/gdbusintrospection.c +++ b/gio/gdbusintrospection.c @@ -1258,7 +1258,7 @@ parser_start_element (GMarkupParseContext *context, @@ -40,7 +40,7 @@ index c7be334ce2f7..6f722ee6153d 100644 g_set_error_literal (error, G_MARKUP_ERROR, diff --git a/gio/tests/gdbus-introspection.c b/gio/tests/gdbus-introspection.c -index 44cb7a96af45..daca313f77e7 100644 +index cb99c94..05710d4 100644 --- a/gio/tests/gdbus-introspection.c +++ b/gio/tests/gdbus-introspection.c @@ -300,6 +300,38 @@ test_extra_data (void) @@ -89,6 +89,4 @@ index 44cb7a96af45..daca313f77e7 100644 + g_test_add_func ("/gdbus/introspection/invalid", test_invalid); ret = session_bus_run (); - --- -2.54.0 + diff --git a/meta/recipes-core/glib-2.0/files/CVE-2026-58016-2.patch b/meta/recipes-core/glib-2.0/files/CVE-2026-58016-2.patch index a07aa529ae8..3acb16f75d6 100644 --- a/meta/recipes-core/glib-2.0/files/CVE-2026-58016-2.patch +++ b/meta/recipes-core/glib-2.0/files/CVE-2026-58016-2.patch @@ -1,7 +1,7 @@ -From a75052ceeebea434f271b670766acd5416bc83b9 Mon Sep 17 00:00:00 2001 +From 02e38caa6265e25da87836ec46c9e514d4a81159 Mon Sep 17 00:00:00 2001 From: Philip Withnall Date: Thu, 16 Apr 2026 15:08:10 +0100 -Subject: [PATCH 2/2] gdbusintrospection: Add some assertions before array +Subject: [PATCH] gdbusintrospection: Add some assertions before array dereferences MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -27,7 +27,7 @@ Signed-off-by: Benjamin Robin 1 file changed, 8 insertions(+) diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c -index 6f722ee6153d..ed0d291f99f0 100644 +index 78a63e2..4df8e87 100644 --- a/gio/gdbusintrospection.c +++ b/gio/gdbusintrospection.c @@ -1096,6 +1096,7 @@ parse_data_get_annotation (ParseData *data, @@ -93,6 +93,4 @@ index 6f722ee6153d..ed0d291f99f0 100644 + g_assert (data->nodes->len > 0); return data->nodes->pdata[data->nodes->len - 1]; } - --- -2.54.0 + diff --git a/meta/recipes-core/glib-2.0/files/relocate-modules.patch b/meta/recipes-core/glib-2.0/files/relocate-modules.patch index 4c2638ae615..6c982ca7355 100644 --- a/meta/recipes-core/glib-2.0/files/relocate-modules.patch +++ b/meta/recipes-core/glib-2.0/files/relocate-modules.patch @@ -1,4 +1,4 @@ -From 14bbc77bc465b42454112bc6a33264c2c3e013e5 Mon Sep 17 00:00:00 2001 +From 226f4955e53c6b3f360f346e41a0a22b74cbbaae Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Fri, 11 Mar 2016 15:35:55 +0000 Subject: [PATCH] glib-2.0: relocate the GIO module directory for native builds @@ -21,7 +21,7 @@ Signed-off-by: Peter Marko 1 file changed, 18 insertions(+) diff --git a/gio/giomodule.c b/gio/giomodule.c -index 38761e4..afa7878 100644 +index 7311775..abc2c79 100644 --- a/gio/giomodule.c +++ b/gio/giomodule.c @@ -1312,6 +1312,24 @@ get_gio_module_dir (void) diff --git a/meta/recipes-core/glib-2.0/files/skip-timeout.patch b/meta/recipes-core/glib-2.0/files/skip-timeout.patch index 8ef140d0d7f..7bc83adf6bf 100644 --- a/meta/recipes-core/glib-2.0/files/skip-timeout.patch +++ b/meta/recipes-core/glib-2.0/files/skip-timeout.patch @@ -1,4 +1,4 @@ -From f77b9dd72dd0103c7a28dd7e1cdf6e316ecbf030 Mon Sep 17 00:00:00 2001 +From 64e957f0fb32ed54748ceb4f220cb4773743d6ec Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Thu, 28 Mar 2024 16:27:09 +0000 Subject: [PATCH] Skip /timeout/rounding test diff --git a/meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.2.bb b/meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.3.bb similarity index 100% rename from meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.2.bb rename to meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.3.bb diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.88.2.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.88.3.bb similarity index 100% rename from meta/recipes-core/glib-2.0/glib-2.0_2.88.2.bb rename to meta/recipes-core/glib-2.0/glib-2.0_2.88.3.bb diff --git a/meta/recipes-core/glib-2.0/glib.inc b/meta/recipes-core/glib-2.0/glib.inc index cad74f53f71..50cdeff1589 100644 --- a/meta/recipes-core/glib-2.0/glib.inc +++ b/meta/recipes-core/glib-2.0/glib.inc @@ -237,12 +237,13 @@ SRC_URI += "\ file://skip-timeout.patch \ file://CVE-2026-58016-1.patch \ file://CVE-2026-58016-2.patch \ + file://0001-gio-tests-services-Fix-installed-service-file-using-.patch \ " SRC_URI:append:class-native = " file://relocate-modules.patch \ file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \ " -SRC_URI[archive.sha256sum] = "cf3f215a640c8a4257f14317586b8f1fdd25a10a93cb4bdda147c0f9ad88e74f" +SRC_URI[archive.sha256sum] = "ab24d24e698dfa1e408b7bcdb508f4aafc906185a8b8ce72fdf79bbbdc9b383b" # Find any meson cross files in FILESPATH that are relevant for the current # build (using siteinfo) and add them to EXTRA_OEMESON. From patchwork Tue Oct 20 23:22:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101447 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4734.1792538579045719740 for ; Tue, 20 Oct 2026 16:22:59 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=tYuWoE0H; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a1e34ecb02so690315e9.2 for ; Tue, 20 Oct 2026 16:22:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538577; x=1793143377; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=8raidV7Zw4KrUEWE7Fhd23Veg2j7xVkSPcO/3jPZ5Bw=; b=tYuWoE0HBKJGBuVTyWWqKz3i+y3IwE/e9NHfHp1dB1r+J9BvobJSl4smBYcoxq+w0F dHl3Acf5EuRsgg2R/f3CprvWps6B55JoUB1x+8//6nF/eQqkBLnrGWM3E0F614Vht/q8 eg5/HqAgFk2uFPLA1hK9jUpc9S1b93GCuyyGThmQ0n+pcZzVVgU4cNIwW25ZjiqF8cpo sDCofnF6liHeKcsU5m1RADeARJDruY1njKgdDzEBYtRnvBKrQWiprQc9fuEiGsjXcaT+ iUdZ7VYc59Fu/GSipcaZbCKaJmfEVY8laBIDLW8A6EgN+l8xCAZXbuP9F1kF4dn11JAQ szgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538577; x=1793143377; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=8raidV7Zw4KrUEWE7Fhd23Veg2j7xVkSPcO/3jPZ5Bw=; b=lfJ5Qeu1vXF18rFDxYF2lVcQjfKhxPqHVMwhxoQua0NzHKiVmeZYYB5C2bOO4343iM 7fkjQBGsDkeh9XUnCfzsSycGYSE+epMHZ/fMajvCXwWMxM4a2bEoPYhkx/ssMgiUg6ZT M3AcAc1I3CN5QeMUJ8YvKrCfJg3IgZM2r4SJam9kY2kUgg0AHsm2ZQinb7lJ0QlMjHQx MfJdAfgvjG1sf+GCkAoHivLd6KCNFBuj7I/46cmZ8zPJcaYxPXfMfjdr+5oSqkB1eGKI 2//x0gy+edhmnz28ABL9J3qOkDxP9czCO3pysjfVkwAlSiFN/h4JtlfdloI+CUfMTfrS uBDw== X-Gm-Message-State: AFq9FYINmINwlUCjDDIpPwPzJ+kxFHHC+ChPdOVkwoziC0MmuTYI33RB ur3pkG8eMubklJCH67LiM1l47U7tOOQ2RhSXWk8PE3ddQo+rNJkI31v3OR1qeubXQE4t545m68n dfI+OR8g= X-Gm-Gg: AYBFou1hs2jXFXItvhKfS5WSFHjXHsQ2q3kjttADifiFll9b8yt7cikaLdK4T8Lrb52 Q9qFTKJfZO7QJS0ujXtW2KkjrwlS/csJ6CcjDOgphPD0yihewgfPxwP5MeIHZIraz4mJIDolVjW OkVSTiBxJMetodBWjymjMLNgX1whmrczCUI+5pERHPGvm2GskUU8u0TFzMBRFPXzqMLMIDh6R7t JHeYi3tmMVB+CxhWlAChO9zSh0Cp0ygqgqD/BqeYYpdl4CudmqVKkmYjiPec8aynPdgN5xy9DFI JXwET1gz69QZxOqtvVyOqMVDl/X6cNdjEIyGJNw1Gih5dhLo279YJ5xKKOY5m6q3kHp76zlzmVs hbCFb1c7am26XtQpqCgbnbL4XuNQxsAuD3MvMO2DY50yH6dr4IBl4nFEWMoQ2+f77NJsgGPqCzM sjyXF5qT/laxsEWx9z4N5YjSLVrAlk4FjYzMz5Aud9xaZCZGRZjLCh5TR1QIdRbK7KhKqB7/MlU nFCn4Rlvi64M4O8T/L26E5T6jPgCNBwdisB2wv1IjUnKiW5rzJitLIezEsOLD0yvzOyYRlIxWfG z0iyTMyXA8juzU/+xaXHBEAoYwoYNokPiGTKpKYC89x2L5ta93L9kuY= X-Received: by 2002:a05:600c:a48:b0:4a1:fae2:a8ab with SMTP id 5b1f17b1804b1-4a1fd8a7f99mr3798695e9.3.1792538577170; Tue, 20 Oct 2026 16:22:57 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:56 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 10/25] u-boot: fix CVE-2026-29009 Date: Wed, 21 Oct 2026 01:22:20 +0200 Message-ID: <59655f16cee60b3a718f5db51ab2766ebbb192de.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248329 From: Roopa Kalmath Backport commit[1] which fixes this vulnerability as mentioned NVD report in [2]. [1] https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc [2] https://nvd.nist.gov/vuln/detail/cve-2026-29009 Signed-off-by: Roopa Kalmath Signed-off-by: Yoann Congal --- .../u-boot/files/CVE-2026-29009.patch | 53 +++++++++++++++++++ meta/recipes-bsp/u-boot/u-boot_2026.01.bb | 4 +- 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch new file mode 100644 index 00000000000..35f168005e7 --- /dev/null +++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch @@ -0,0 +1,53 @@ +From d6694018eaddefac6aae974f9cec72fd6e58f1bc Mon Sep 17 00:00:00 2001 +From: Sebastian Josue Alba Vives +Date: Thu, 9 Apr 2026 10:44:40 -0600 +Subject: [PATCH] net: nfs: fix buffer overflow in nfs_readlink_reply() + +nfs_readlink_reply() validates rlen only against the incoming packet +length (inherited from CVE-2019-14195), but not against the destination +buffer nfs_path_buff[2048]. A malicious NFS server can send a valid +READLINK reply where pathlen + rlen exceeds sizeof(nfs_path_buff), +overflowing the BSS buffer into adjacent memory. + +The recent fix in fd6e3d34097f addressed the same overflow class in +net/lwip/nfs.c but left the legacy path in net/nfs-common.c unpatched. + +Add bounds checks before both memcpy calls in nfs_readlink_reply(): +- relative path branch: reject if pathlen + rlen >= + sizeof(nfs_path_buff) +- absolute path branch: reject if rlen >= sizeof(nfs_path_buff) + +Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195") + +CVE: CVE-2026-29009 + +Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc] + +Cc: stable@vger.kernel.org +Signed-off-by: Sebastian Alba Vives +Reviewed-by: Jerome Forissier +Signed-off-by: Roopa Kalmath +--- + net/nfs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/nfs.c b/net/nfs.c +index 537d4c62..9b628ecf 100644 +--- a/net/nfs.c ++++ b/net/nfs.c +@@ -698,11 +698,15 @@ static int nfs_readlink_reply(uchar *pkt, unsigned len) + + strcat(nfs_path, "/"); + pathlen = strlen(nfs_path); ++ if (pathlen + rlen >= sizeof(nfs_path_buff)) ++ return -NFS_RPC_DROP; + memcpy(nfs_path + pathlen, + (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]), + rlen); + nfs_path[pathlen + rlen] = 0; + } else { ++ if (rlen >= sizeof(nfs_path_buff)) ++ return -NFS_RPC_DROP; + memcpy(nfs_path, + (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]), + rlen); diff --git a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb index 9610d9e8fe0..8dd15cf9cdc 100644 --- a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb +++ b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb @@ -3,7 +3,9 @@ require u-boot.inc DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native" -SRC_URI += "file://CVE-2026-46728.patch" +SRC_URI += "file://CVE-2026-46728.patch \ + file://CVE-2026-29009.patch \ +" CVE_STATUS[CVE-2026-33243] = "cpe-incorrect: NVD currently maps this CVE to denx:u-boot, but that mapping is incorrect for U-Boot; the U-Boot-side FIT issue is tracked separately as CVE-2026-46728 and is fixed by the included U-Boot backport." From patchwork Tue Oct 20 23:22:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101448 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f42.google.com (mail-wr1-f42.google.com [209.85.221.42]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4735.1792538579792962785 for ; Tue, 20 Oct 2026 16:23:00 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=Tc+GayHU; spf=pass (domain: smile.fr, ip: 209.85.221.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f42.google.com with SMTP id ffacd0b85a97d-48afcd7ba9bso60267f8f.3 for ; Tue, 20 Oct 2026 16:22:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538578; x=1793143378; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=cbCQp96ESy3XDV3SmB7US7tFK6JCro1p6kX1f/9zG1g=; b=Tc+GayHUheml3uEDDiUro+p0GrxiwYG3XBm+lrDtnPxc87XN5vvBUBqnso5WsGd5yl +gfh8rPUR2LXHS6SvIUOGfcV9lCCfTEJ+kKqm5vVEHtATYrw8AGLAAcmvBGU30fycSxp TGAF1/X8+G/5XrssOxxDGDv0Pm1CGxB619jEiyxnIJmsw1l47TjcncBRzffXnxcysFyB +1f1RQFibiiAWsn5WuEOCyd4X6n36dIxMRCCyZZYgX2EYjOQbdtN9P3ZBBaGJ6Ep9AyB fa3lLxVtigiIwwPDQCErFqIvsMdnLTlMLmUF5D7TQYWEBZMwXflqVprgxC9lur6/Myfs xqIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538578; x=1793143378; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=cbCQp96ESy3XDV3SmB7US7tFK6JCro1p6kX1f/9zG1g=; b=Z6na9i723n1WlbWpX0dqbaQ00F7OnhmFbynIfiuwP4kklrhse5aJpb8x9sresbQMJ8 kIKgSOfkd6TqXftEZZHZDbGfnmkItgQTeC9Ff5ENaBBzdqn7I20RbaQD1chjl5SrHwsY RI9LaNKMBZiucAkLlwwOvKamntPM/hjb14Ia0OnjhPkgM78s0YHEoogL+EIztkwK/DII 9YSDhaF/+7Z5alZZdBZGJ4PkHBJjgBMphr+tGjowPiFuFIhBZ3fNfNqR3SppzSMsYa7o +myWCzrm91LqUAtsp4DBbxdS4aOwrF4sKXPGNwQaYO9tAFxXXDWaLt6xx5E+uBYDxUtv Gihg== X-Gm-Message-State: AFq9FYJfdumC6xqBn+OXYf9ZQM1V/SXMK0oIVFvohC53iaeJGYeJ1Cux 1JjiXCWqJPEj7Ij541Hm12UAOZh610ECHs+zYLmDKMg4LysWTr8b6d7pA7M/rLntTZ2Q+T5qZHJ AnTx4dIQ= X-Gm-Gg: AYBFou1aXG/q8NNLWN51L9jYkLrCg+sO2lS6rvUIgnmBDV5xXIwjjOyjlC+E6hXXJ3X c/lwtAY5enAzXwCZS6e4vTAYcw+KhuHFkN9gCyEURTb7e7bQeMHAftprPIZYZ21hl7Y2erNPTGt EuLrQD34uMWTKtYh1q1j/maBm76u3k7zTv8SkD9BWPO/zCkRpLA1N9AV3HHyrBkle3QXn8A0Ld1 y2U9Lbmvsh3hBFHIrqB+OdZjmaCQ/5hfHa28DTxAKq/V39hBSx2KeOw+WO0K1U1qTVU97EdHJWT QHpWEiyIWDR2jdFex4tpSGVLnM2Bo/PEVSsEQKNLoMOWPs8iwqE79rj1Ryp9amuuwcNeJrXurGR f1NnqjYzriJPDJx6TgQYTF3zFyMTy6jjuYIl8c4ccvrN2Hsf80sva1lAgT3aD3xysMRnZKFJ2uh GB7VjQaD1j0o6TCxu9GPXotEHzyFwbWiNxw6RQvn85kK90F3t4a8Y00IIVEAKzXKfobTHRQNq66 T+Dw/EX0FbCdwJMtjrCvsrRD1e9QJoIOvqZmihxI65ChACcWDnN9Cz5kLk/pZo5clJw8X/C9g== X-Received: by 2002:a05:6000:2990:20b0:48a:fba3:d5b1 with SMTP id ffacd0b85a97d-48e264ee716mr201241f8f.55.1792538577795; Tue, 20 Oct 2026 16:22:57 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:57 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 11/25] nasm: fix CVE-2026-6067 Date: Wed, 21 Oct 2026 01:22:21 +0200 Message-ID: <2c4556d979ad999e4f32987eb24629318ace5de1.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248330 From: Kris Gavvala When using obj output format, specifying more than 256 segments in the GROUP directive of the .asm file causes a heap-buffer-overflow. This patch applies the upstream fix given by the commit in [1] to address the issue in [2]. [1] https://github.com/netwide-assembler/nasm/commit/8890d723d0aa9ed1a790e2ce1c55eee8dfa0cf94 [2] https://github.com/netwide-assembler/nasm/issues/203 [3] https://nvd.nist.gov/vuln/detail/cve-2026-6067 Signed-off-by: Kris Gavvala Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 1a81d85a8a23fc1a5c8396c8a7cb5cb59e97a9b2) Signed-off-by: Yoann Congal --- .../nasm/nasm/CVE-2026-6067.patch | 36 +++++++++++++++++++ meta/recipes-devtools/nasm/nasm_3.01.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-devtools/nasm/nasm/CVE-2026-6067.patch diff --git a/meta/recipes-devtools/nasm/nasm/CVE-2026-6067.patch b/meta/recipes-devtools/nasm/nasm/CVE-2026-6067.patch new file mode 100644 index 00000000000..e43aafc7ee2 --- /dev/null +++ b/meta/recipes-devtools/nasm/nasm/CVE-2026-6067.patch @@ -0,0 +1,36 @@ +From cc006a1d57bebb6ea49db488539a1613014c062f Mon Sep 17 00:00:00 2001 +From: Nick Clifton +Date: Mon, 29 Jun 2026 13:53:14 -0700 +Subject: [PATCH] outobj: fix buffer overflow when too many segments in a group + +The number of entries in a group was hard-coded, but not enforced. + +CVE: CVE-2026-6067 +Upstream-Status: Backport [https://github.com/netwide-assembler/nasm/commit/8890d723d0aa9ed1a790e2ce1c55eee8dfa0cf94] + +Reported-by: +Fixes: https://github.com/netwide-assembler/nasm/issues/203 +Signed-off-by: H. Peter Anvin (Intel) +Signed-off-by: Kris Gavvala +--- + output/outobj.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/output/outobj.c b/output/outobj.c +index 685c5933e..9d8bf83c5 100644 +--- a/output/outobj.c ++++ b/output/outobj.c +@@ -1736,6 +1736,10 @@ obj_directive(enum directive directive, char *value) + */ + continue; + } ++ if (grp->nentries >= GROUP_MAX) { ++ nasm_nonfatal("too many segments in a group"); ++ return DIRR_ERROR; ++ } + for (seg = seghead; seg; seg = seg->next) + if (!strcmp(seg->name, p)) + break; +-- +2.43.0 + diff --git a/meta/recipes-devtools/nasm/nasm_3.01.bb b/meta/recipes-devtools/nasm/nasm_3.01.bb index 1e4719000f8..e8079732d43 100644 --- a/meta/recipes-devtools/nasm/nasm_3.01.bb +++ b/meta/recipes-devtools/nasm/nasm_3.01.bb @@ -9,6 +9,7 @@ SRC_URI = "http://www.nasm.us/pub/nasm/releasebuilds/${PV}/nasm-${PV}.tar.bz2 \ file://0001-stdlib-Add-strlcat.patch \ file://0002-Add-debug-prefix-map-option.patch \ file://0001-compiler.h-Backport-C23-support.patch \ + file://CVE-2026-6067.patch \ " SRC_URI[sha256sum] = "7a7b1ff3b0eef3247862f2fbe4ca605ccef770545d7af7979eba84a9d045c0b1" From patchwork Tue Oct 20 23:22:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101456 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f47.google.com (mail-wr1-f47.google.com [209.85.221.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4736.1792538580419794117 for ; Tue, 20 Oct 2026 16:23:00 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=mw3bsb8m; spf=pass (domain: smile.fr, ip: 209.85.221.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-48afbd2c386so60275f8f.3 for ; Tue, 20 Oct 2026 16:23:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538578; x=1793143378; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=mCBX6lDrj8FySr75U3MGSU57POz83EoRjB4RgNlyXck=; b=mw3bsb8mUHsEdiOJe0dp44YKVAiWFCYzbTCwgEVKZwouCMgYg7Vp7wq9xNq8ohcU2q fLWNmxZgodFkfCMWRJLUFIajIkGYCnslnKg9QctdJ3+C8cMFFkOlz+1P8oHIOPu5HpUn dL9gDdG7NfIKIMEgK0tJk0FPeXVtbnfESFSFXXBoMVZE4Rj56BGVan9R715vnWdOK0Sh UvV1B9+UYEzVVBhdO3lxHD2xydokDd45KaJYXHB+2yMSD3w1h3pt+3Xu4O0eEsZKOloA P2KfmOyQSZb/NJEn4qFKDPUqp05PFffWjpK8dyMO/O/+Eta0aA8rSmWF/jhGH5bVX8gx fi8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538578; x=1793143378; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=mCBX6lDrj8FySr75U3MGSU57POz83EoRjB4RgNlyXck=; b=vNtDbdmGiyo51t+uS6qVLSwiFAehZOxO0Yns9Dvof7AmnX1OjHHkHdnmnN4LZubcl1 HhEKlMtrfi6oLeGoK2Rqm0/AbUHlIUf8WxzTAfccRzH8Ov1anX8AzdqWecdbHOzvgdkf eerxoo512Jxzu8Zu2GM+QCAIyPuaXSeXhmJLiqLTnJLSnogB/nbeqfDUxj0SCLidhAfI TZ6+vXQqq1msTnUXNYFFoz7hbYDUt8i24vwBknDq1xXkp32viKKms8E/w6CYhb1OqEHz bGMlozk+bLFMjFA5HIVjg24DXQNYvluOXtcRWdvt4Vldb3SsxvF+KBNrMnGZnSOtw09B wYbw== X-Gm-Message-State: AFq9FYISFLdVCzTTyAUWO92TU64h8dVeA/PvbWpS2MiXt3V5RoQYbHS5 kaUjOvV4z4cc6ym7L8DJI73BbSAfcVMk7TbPm2C+PrcOwctUZME8rUkU4fc9UmjOcfGAROR30Bo t+8GjNOM= X-Gm-Gg: AYBFou398zrAp8iXrkfJ3fTtWn0AfpqHxUt1aVOD9IA+xfdFNrXY+oNPT+ViTShM0me seMtpiKwz9OICu4BMG1kSO+CLAne/Kl4Om9Sb3H59DV/ttqOCskgCLvEe/9mL21oGgp3NXVXWpn LC0TYsxUcODy7QrCuvR0UPoApX9Uxu+axnRzUEgZ3W/sR8ZaFvI1uYVTKLC3EseyT4MUdqqV1Gs EoQV5wZE3s12JHTEDbWZJxaapnvnCksWOqEetHiVLPHD+nsT2KkHmxIeCUWmLxhqu/QxV1c/aKl pK/vgSEPfYIhE4/RVmanID6Po6ixkrIlGqtpRoJFsKyivDu+yIh5Pf309H0PuYqRP5pp1SCZgJb lzb3HRpEpBRPcGttexxn5yJtFNbfY98APk3I20bggHqi6tyGEBB+z0zMEbCLnYTQ5F9bUUZCu8t 6x/IY9D6wPpU61zpeomAlrM2ExI5A3HEPPXenN5E4eeHOO/sookgyX+LAIo6HJygClMVVG+95Gh qs8U0IbHmGrvlBq79YgQMuItRptcJs2BLzi87N/qGFu1sHTO+j66oQLEoiy5Li2OE8PyFwQrw== X-Received: by 2002:a05:6000:1a8a:b0:48d:dc6f:219a with SMTP id ffacd0b85a97d-48e264ad992mr363349f8f.27.1792538578443; Tue, 20 Oct 2026 16:22:58 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:58 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 12/25] nasm: fix CVE-2026-6068 Date: Wed, 21 Oct 2026 01:22:22 +0200 Message-ID: <72e1f3638c4f03634de6d288802f78fef16f097e.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248331 From: Kris Gavvala - CVE-2026-6068-1.patch applies the upstream fix in [2], addressing the issue in [1]. - CVE-2026-6068-2.patch applies [3], adding helper functions used in [2]. - CVE-2026-6068-3.patch applies [4], which prevents the compilation warning: assignment discards 'const' qualifier [1] https://github.com/netwide-assembler/nasm/issues/222 [2] https://github.com/netwide-assembler/nasm/commit/7bc82e7daf4cceb6a8af7ad2876485c9b4b01a56 [3] https://github.com/netwide-assembler/nasm/commit/44245e4684be1fac6c2fb7ac67dce8a55a574956 [4] https://github.com/netwide-assembler/nasm/commit/7b4e77dae29156a283d31fe707939ce21bf3eb3e Signed-off-by: Kris Gavvala Signed-off-by: Yoann Congal --- .../nasm/nasm/CVE-2026-6068-1.patch | 98 +++++++++++++++++++ .../nasm/nasm/CVE-2026-6068-2.patch | 80 +++++++++++++++ .../nasm/nasm/CVE-2026-6068-3.patch | 51 ++++++++++ meta/recipes-devtools/nasm/nasm_3.01.bb | 3 + 4 files changed, 232 insertions(+) create mode 100644 meta/recipes-devtools/nasm/nasm/CVE-2026-6068-1.patch create mode 100644 meta/recipes-devtools/nasm/nasm/CVE-2026-6068-2.patch create mode 100644 meta/recipes-devtools/nasm/nasm/CVE-2026-6068-3.patch diff --git a/meta/recipes-devtools/nasm/nasm/CVE-2026-6068-1.patch b/meta/recipes-devtools/nasm/nasm/CVE-2026-6068-1.patch new file mode 100644 index 00000000000..44f691610a7 --- /dev/null +++ b/meta/recipes-devtools/nasm/nasm/CVE-2026-6068-1.patch @@ -0,0 +1,98 @@ +From e3a3fb40d21edb638f8191465574aaaaaacb336d Mon Sep 17 00:00:00 2001 +From: "H. Peter Anvin (Intel)" +Date: Fri, 26 Jun 2026 17:27:47 -0700 +Subject: [PATCH 2/3] asm/nasm.c: fix use-after-free for -M* options in -@ + files + +-M* options in response files would hold on to a pointer to the new +value, but in response files that is not a persistent buffer. Make +sure to make a copy instead. + +This uses the new nasm_str[dup]to() helpers. + +(Note that calling nasm_free() on a NULL pointer is guaranteed safe.) + +CVE: CVE-2026-6068 +Upstream-Status: Backport [https://github.com/netwide-assembler/nasm/commit/7bc82e7daf4cceb6a8af7ad2876485c9b4b01a56] + +Reported-by: +Fixes: https://github.com/netwide-assembler/nasm/issues/222 +Fixes: CVE-2026-6068 +Signed-off-by: H. Peter Anvin (Intel) +Signed-off-by: Kris Gavvala +--- + asm/nasm.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/asm/nasm.c b/asm/nasm.c +index 49fa00eb7..98bde83cb 100644 +--- a/asm/nasm.c ++++ b/asm/nasm.c +@@ -121,8 +121,8 @@ static unsigned int operating_mode; + /* Dependency flags */ + static bool depend_emit_phony = false; + static bool depend_missing_ok = false; +-static const char *depend_target = NULL; +-static const char *depend_file = NULL; ++static char *depend_target = NULL; ++static char *depend_file = NULL; + struct strlist *depend_list; + + static bool want_usage; +@@ -709,6 +709,8 @@ int main(int argc, char **argv) + stdscan_cleanup(); + src_free(); + strlist_free(&include_path); ++ nasm_free(depend_file); ++ nasm_free(depend_target); + + return terminate_after_phase; + } +@@ -750,7 +752,8 @@ static void copy_filename(const char **dst, const char *src, const char *what) + } + + /* +- * Convert a string to a POSIX make-safe form ++ * Convert a string to a POSIX make-safe form; returns a newly allocated ++ * string. + */ + static char *quote_for_pmake(const char *str) + { +@@ -830,7 +833,8 @@ static char *quote_for_pmake(const char *str) + } + + /* +- * Convert a string to a Watcom make-safe form ++ * Convert a string to a Watcom make-safe form; returns a newly allocated ++ * string. + */ + static char *quote_for_wmake(const char *str) + { +@@ -1188,20 +1192,20 @@ static bool process_arg(char *p, char *q, int pass) + case 'D': + operating_mode |= OP_DEPEND; + if (q && (q[0] != '-' || q[1] == '\0')) { +- depend_file = q; ++ nasm_strdupto(&depend_file, q); + advance = true; + } + break; + case 'F': +- depend_file = q; ++ nasm_strdupto(&depend_file, q); + advance = true; + break; + case 'T': +- depend_target = q; ++ nasm_strdupto(&depend_target, q); + advance = true; + break; + case 'Q': +- depend_target = quote_for_make(q); ++ nasm_strto(&depend_target, quote_for_make(q)); + advance = true; + break; + case 'W': +-- +2.43.0 + diff --git a/meta/recipes-devtools/nasm/nasm/CVE-2026-6068-2.patch b/meta/recipes-devtools/nasm/nasm/CVE-2026-6068-2.patch new file mode 100644 index 00000000000..4b2334776aa --- /dev/null +++ b/meta/recipes-devtools/nasm/nasm/CVE-2026-6068-2.patch @@ -0,0 +1,80 @@ +From 4dfcfe9b333230788be7328e8fe943bda1610011 Mon Sep 17 00:00:00 2001 +From: "H. Peter Anvin (Intel)" +Date: Fri, 26 Jun 2026 17:25:23 -0700 +Subject: [PATCH 1/3] Add nasm_strdupto() and nasm_strto(), to replace a string + variable + +It is common enough that one wants to set a string pointer to a newly +allocated string, freeing the old one if it is not NULL. + +Add specific helper functions for this. + +CVE: CVE-2026-6068 +Upstream-Status: Backport [https://github.com/netwide-assembler/nasm/commit/44245e4684be1fac6c2fb7ac67dce8a55a574956] + +Signed-off-by: H. Peter Anvin (Intel) +Signed-off-by: Kris Gavvala +--- + include/nasmlib.h | 23 +++++++++++++++++++++++ + nasmlib/alloc.c | 11 +++++++++++ + 2 files changed, 34 insertions(+) + +diff --git a/include/nasmlib.h b/include/nasmlib.h +index ed4222b11..fae86d3cd 100644 +--- a/include/nasmlib.h ++++ b/include/nasmlib.h +@@ -102,6 +102,29 @@ char * safe_alloc nasm_strndup(const char *, size_t); + char * safe_alloc nasm_strcat(const char *one, const char *two); + char * safe_alloc end_with_null nasm_strcatn(const char *one, ...); + ++/* ++ * Replace a string in a string pointer variable with a nasm_strdup() ++ * copy of the argument on the right, freeing the contents of the ++ * previous contents of the variable if non-NULL. ++ * ++ * If *str is NULL, simply return the old value of *ptrp. ++ */ ++char *nasm_strdupto(char **ptrp, const char *str); ++ ++/* ++ * Similar, but the new pointer must already have been heap allocated ++ * by the creating function. ++ */ ++static inline char *nasm_strto(char **ptrp, char *str) ++{ ++ char *ptr = *ptrp; ++ if (!str) ++ return ptr; ++ if (ptr) ++ nasm_free(ptr); ++ return *ptrp = str; ++} ++ + /* + * nasm_[v]asprintf() are variants of the semi-standard [v]asprintf() + * functions, except that we return the pointer instead of a count. +diff --git a/nasmlib/alloc.c b/nasmlib/alloc.c +index b77d48217..fa3e9e996 100644 +--- a/nasmlib/alloc.c ++++ b/nasmlib/alloc.c +@@ -101,6 +101,17 @@ char *nasm_strndup(const char *s, size_t len) + return memcpy(p, s, len); + } + ++char *nasm_strdupto(char **ptrp, const char *str) ++{ ++ char *ptr = *ptrp; ++ if (str) { ++ if (ptr) ++ nasm_free(ptr); ++ *ptrp = ptr = nasm_strdup(str); ++ } ++ return ptr; ++} ++ + char *nasm_strcat(const char *one, const char *two) + { + char *rslt; +-- +2.43.0 + diff --git a/meta/recipes-devtools/nasm/nasm/CVE-2026-6068-3.patch b/meta/recipes-devtools/nasm/nasm/CVE-2026-6068-3.patch new file mode 100644 index 00000000000..b25a6de5832 --- /dev/null +++ b/meta/recipes-devtools/nasm/nasm/CVE-2026-6068-3.patch @@ -0,0 +1,51 @@ +From db6cbdf6244ddb729b7c6331f62f42334bc00550 Mon Sep 17 00:00:00 2001 +From: Kris Gavvala +Date: Wed, 23 Sep 2026 00:57:12 -0500 +Subject: [PATCH] Drop const return type of filename_set_extension() + +filename_set_extension() always returns a newly allocated string +buffer, drop the "const" from the return type. + +CVE: CVE-2026-6068 +Upstream-Status: Backport [https://github.com/netwide-assembler/nasm/commit/7b4e77dae2] + +Signed-off-by: H. Peter Anvin (Intel) +Signed-off-by: Kris Gavvala +--- + include/nasmlib.h | 5 +++-- + nasmlib/filename.c | 2 +- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/include/nasmlib.h b/include/nasmlib.h +index 494d7842e..2771c5951 100644 +--- a/include/nasmlib.h ++++ b/include/nasmlib.h +@@ -366,9 +366,10 @@ struct debug_prefix_list { + extern struct debug_prefix_list *debug_prefixes; + + /* +- * Add/replace or remove an extension to the end of a filename ++ * Add/replace or remove an extension to the end of a filename; ++ * returns a newly allocated buffer with the modified filename. + */ +-const char *filename_set_extension(const char *inname, const char *extension); ++char *filename_set_extension(const char *inname, const char *extension); + char *filename_debug_remap(char *dest, char const *inname, size_t len); + + /* +diff --git a/nasmlib/filename.c b/nasmlib/filename.c +index 0e27f69e2..85c42a21c 100644 +--- a/nasmlib/filename.c ++++ b/nasmlib/filename.c +@@ -16,7 +16,7 @@ struct debug_prefix_list *debug_prefixes = NULL; + * field at the very end of the filename. Returns a newly allocated + * string buffer. + */ +-const char *filename_set_extension(const char *inname, const char *extension) ++char *filename_set_extension(const char *inname, const char *extension) + { + const char *q = inname; + char *p; +-- +2.43.0 + diff --git a/meta/recipes-devtools/nasm/nasm_3.01.bb b/meta/recipes-devtools/nasm/nasm_3.01.bb index e8079732d43..186ae57ce4c 100644 --- a/meta/recipes-devtools/nasm/nasm_3.01.bb +++ b/meta/recipes-devtools/nasm/nasm_3.01.bb @@ -10,6 +10,9 @@ SRC_URI = "http://www.nasm.us/pub/nasm/releasebuilds/${PV}/nasm-${PV}.tar.bz2 \ file://0002-Add-debug-prefix-map-option.patch \ file://0001-compiler.h-Backport-C23-support.patch \ file://CVE-2026-6067.patch \ + file://CVE-2026-6068-1.patch \ + file://CVE-2026-6068-2.patch \ + file://CVE-2026-6068-3.patch \ " SRC_URI[sha256sum] = "7a7b1ff3b0eef3247862f2fbe4ca605ccef770545d7af7979eba84a9d045c0b1" From patchwork Tue Oct 20 23:22:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101457 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f45.google.com (mail-wr1-f45.google.com [209.85.221.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4737.1792538581201252840 for ; Tue, 20 Oct 2026 16:23:01 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=AHB89UUf; spf=pass (domain: smile.fr, ip: 209.85.221.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f45.google.com with SMTP id ffacd0b85a97d-48df0fa43c5so82730f8f.0 for ; Tue, 20 Oct 2026 16:23:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538579; x=1793143379; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=oOfJDU/L67aE8812wEIY5aynw6bwn58L9cGnM5UNG7Y=; b=AHB89UUfIVuJZxnH/TCKWVmNO0EjJJ5RNIt8/+pKMArkURrW/zvCm5vvQKTrre7bPD U3V46KetFX8R/8jyhwFW4yDZoN986YlPuWVzyloRrr1YButdZWg9V9PUqP8QsHDn1B3d RAz5yNr5NIO5TNMl/QCRW9Sm6lky1QdRq1kg4ca82jwNZxl/YIWA0UwIS05WbVBrORRX 3dR+RcgfwtP9fHq8aJO8KGo85G0zmKzMcOKyc1Dp/OUR50F1XJtXGYRzEArqL2okC3lh riyjicA+vFF9SZNd7gHMkF5CJmF+Kw3H9kLnmlv16LQ4F+FECGoWJgCMyvVKgclBdJlR np4Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538579; x=1793143379; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=oOfJDU/L67aE8812wEIY5aynw6bwn58L9cGnM5UNG7Y=; b=Nyb8SRmoM9P+GU63Y/gHIl8ArBaqtd2KLTG/hgLXtyzVKVWOl6mYLyb4BtmhY8FjQM wdAXmMp4vvD6fWzwUE3yFgQVkk/OPlBV2L6VTMp8dpFiVlGQxU2313ehHOwNlW1crtiK IUVXiXUtapDfBJciBbv7hYq4hSjb2mG1md5L1cDxAcuO1b++1faulYwHGWpUUdUwsOw9 B4CfWSBFEYO8pqnYNo1/3+u7qTOO/5HIXkzk/Dk4vOCX7EhaEnvGZ8sSIW8pCS+ZJM7T qNsfPWmQ//FcOg9KUV2Vbl2tzbQeExLWE5TWBcIWz1/bTEp+0nvZTmrSyslczyjVDItV hggw== X-Gm-Message-State: AFq9FYJT+MUdRQvYSIsYGanGONwbRH3Hf5oQX3m/v17ZQnVCE+dSA6/H O+zOyFdQ7oCNPP9vFJ9O5B+4kDbezijLwkhQhlvH41I4RQKQ+vNt8v5mHQMUUy8+UqD3SgJUBgQ nUvuTvfg= X-Gm-Gg: AYBFou0QOh2hrGAr7ysh0wTRGtvGLB2uwFhLXrcQbqo/9YYUxTzYu04PeIKNziXXlxm uZ9tCGXL0HZYeXvPcvmFh4vhPuF7nKbcgtkPdo6KvQjofHVoR1bzor6sZBpU8sY6yJOXRkIu3vw 3d2ac6woKfoaMVTz8cQ8nHnku+dXs7ONsVmzyKFdvpipAj5WdBWXM+EI6jdIxBKmViZqV5S04Id DoxRVBNXG1xyyhAfvzuTNyTsIu3RPodZ1iqKc6SXbsKM7VKrWnVxp93d53HGFFqtb0JPS0LGoZo UvUy1iwy67nSLfz1xzQpRf0sK3y2Yi5WUOuV0544VWeIibAlAYLf2rQDPshwQ5+yI+QU/o71XeT D9ht4mRGwPOQ7OJB0iQzJxG1HdTA6oR8tVAyaFyfp68wYf9KBs6q9gH4lFoh0iMC6NxE9XxhDYg h/C18n/cqZTFW9hzQj9bfjj/l34q4UxnDtpQ4+pzfW8LWO6JVdLYKuA0CDqjjdK6ecbKNGku6QP dqlBjYbzO4o3M9owDjOY/f9qjhY6xsBzR2a5sAZvPTquhXfmmzbb7r/394A2tiqW6QzPmeejg== X-Received: by 2002:a05:6000:25c6:b0:48d:f1b3:7e67 with SMTP id ffacd0b85a97d-48e1e7cc1ffmr8285686f8f.18.1792538579045; Tue, 20 Oct 2026 16:22:59 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:58 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 13/25] python3-cryptography: fix CVE-2026-69247 Date: Wed, 21 Oct 2026 01:22:23 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248332 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. A direct backport is used because the fixed 50.0.0 release also contains backward-incompatible API changes and new features, which are unsuitable for a stable Wrynose update. [1] https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f [2] https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../python/python3-cryptography.bb | 1 + .../python3-cryptography/CVE-2026-69247.patch | 435 ++++++++++++++++++ 2 files changed, 436 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-cryptography/CVE-2026-69247.patch diff --git a/meta/recipes-devtools/python/python3-cryptography.bb b/meta/recipes-devtools/python/python3-cryptography.bb index f3cb755ed5b..a94b79ed4ce 100644 --- a/meta/recipes-devtools/python/python3-cryptography.bb +++ b/meta/recipes-devtools/python/python3-cryptography.bb @@ -19,6 +19,7 @@ SRC_URI += "file://0001-pyproject.toml-remove-benchmark-disable-option.patch \ file://CVE-2026-69249.patch \ file://check-memfree.py \ file://run-ptest \ + file://CVE-2026-69247.patch \ " require ${BPN}-crates.inc diff --git a/meta/recipes-devtools/python/python3-cryptography/CVE-2026-69247.patch b/meta/recipes-devtools/python/python3-cryptography/CVE-2026-69247.patch new file mode 100644 index 00000000000..85b47faac5c --- /dev/null +++ b/meta/recipes-devtools/python/python3-cryptography/CVE-2026-69247.patch @@ -0,0 +1,435 @@ +From 53fccd93413a8d7f07d6d8999681f27b75cffa3f Mon Sep 17 00:00:00 2001 +From: Alex Gaynor +Date: Fri, 31 Jul 2026 09:24:53 -0400 +Subject: [PATCH] Don't leak how PKCS#7 encryptedKey decryption failed (#15369) + +* Don't leak how PKCS#7 encryptedKey decryption failed + +pkcs7_decrypt_der and its PEM and S/MIME variants reported invalid RSA +PKCS#1 v1.5 padding, a recovered key of the wrong length, and a wrong +key as three distinct errors, and the middle one disclosed the exact +recovered length. That is a Bleichenbacher oracle for any caller that +decrypts untrusted messages. The wrong-length case also returned before +the AES-CBC pass, so the same distinction was observable by timing, +proportional to a content size the attacker chooses. + +Substitute a random key of the expected length on failure, per RFC 3218, +and continue down an identical path so that every outcome looks alike. + +EnvelopedData still authenticates nothing, so revealing whether +decryption succeeded remains a CBC padding oracle regardless. That is a +property of PKCS#7 rather than of this implementation, and is now +documented instead. + +Co-Authored-By: Claude Opus 5 + +* Cover the non-ValueError path out of encryptedKey decryption + +Only a ValueError from unwrapping the key is attacker controlled and so +deliberately silenced. A private key implemented outside of this library +can fail in other ways, and those still reach the caller -- but nothing +exercised that arm, leaving it uncovered. + +Add a DummyRSAPrivateKey double whose decrypt() raises a TypeError, and +tests for each of its methods. + +Co-Authored-By: Claude Opus 5 + +* fix? + +* error message + +--------- + +Co-authored-by: Claude Opus 5 + +CVE: CVE-2026-69247 +Upstream-Status: Backport [https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f] + +Backport Changes: +- Dropped the CHANGELOG.rst update because it targets the 50.0.0 release. +- Adapted DummyRSAPrivateKey to the 46.0.7 RSA abstract API, which lacks + NoDigestInfo and __deepcopy__. +- Added only the RSA tests from tests/test_doubles.py because the older + source does not contain the unrelated Ed25519 test double. + +(cherry picked from commit 53fccd93413a8d7f07d6d8999681f27b75cffa3f) +Signed-off-by: Hetvi Thakar +--- + .../primitives/asymmetric/serialization.rst | 21 +++++ + docs/spelling_wordlist.txt | 1 + + src/rust/src/pkcs7.rs | 81 +++++++++++-------- + tests/doubles.py | 46 ++++++++++- + tests/hazmat/primitives/test_pkcs7.py | 62 ++++++++++++++ + tests/test_doubles.py | 53 ++++++++++++ + 6 files changed, 229 insertions(+), 35 deletions(-) + create mode 100644 tests/test_doubles.py + +diff --git a/docs/hazmat/primitives/asymmetric/serialization.rst b/docs/hazmat/primitives/asymmetric/serialization.rst +index fb49c7d14..8364131da 100644 +--- a/docs/hazmat/primitives/asymmetric/serialization.rst ++++ b/docs/hazmat/primitives/asymmetric/serialization.rst +@@ -1436,6 +1436,15 @@ contain certificates, CRLs, and much more. PKCS7 files commonly have a ``p7b``, + Deserialize and decrypt a DER-encoded PKCS7 message. PKCS7 (or S/MIME) has multiple versions, + but this supports a subset of :rfc:`5751`, also known as S/MIME Version 3.2. + ++ .. warning:: ++ ++ ``EnvelopedData`` does not authenticate its content. An application ++ that decrypts attacker-supplied messages and reveals whether ++ decryption succeeded -- through an error, a status code, or timing -- ++ gives the attacker a CBC padding oracle sufficient to recover the ++ plaintext. This is a property of PKCS#7 and cannot be fixed here, ++ so avoid decrypting untrusted ``EnvelopedData``. ++ + :param data: The data, encoded in DER format. + :type data: bytes + +@@ -1491,6 +1500,12 @@ contain certificates, CRLs, and much more. PKCS7 files commonly have a ``p7b``, + Deserialize and decrypt a PEM-encoded PKCS7E message. PKCS7 (or S/MIME) has multiple versions, + but this supports a subset of :rfc:`5751`, also known as S/MIME Version 3.2. + ++ .. warning:: ++ ++ The padding oracle described in ++ :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der` ++ applies equally here. ++ + :param data: The data, encoded in PEM format. + :type data: bytes + +@@ -1548,6 +1563,12 @@ contain certificates, CRLs, and much more. PKCS7 files commonly have a ``p7b``, + Deserialize and decrypt a S/MIME-encoded PKCS7 message. PKCS7 (or S/MIME) has multiple versions, + but this supports a subset of :rfc:`5751`, also known as S/MIME Version 3.2. + ++ .. warning:: ++ ++ The padding oracle described in ++ :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der` ++ applies equally here. ++ + :param data: The data. It should be in S/MIME format, meaning MIME with content type + ``application/pkcs7-mime`` or ``application/x-pkcs7-mime``. + :type data: bytes +diff --git a/docs/spelling_wordlist.txt b/docs/spelling_wordlist.txt +index 831369fe9..956325782 100644 +--- a/docs/spelling_wordlist.txt ++++ b/docs/spelling_wordlist.txt +@@ -151,6 +151,7 @@ Ubuntu + unencrypted + unicode + unpadded ++untrusted + unpadding + validator + Ventura +diff --git a/src/rust/src/pkcs7.rs b/src/rust/src/pkcs7.rs +index 3fb5abf15..dd64c3aff 100644 +--- a/src/rust/src/pkcs7.rs ++++ b/src/rust/src/pkcs7.rs +@@ -266,27 +266,6 @@ fn decrypt_der<'p>( + } + }; + +- // Raise error when the key encryption algorithm is not RSA +- let key = match recipient_info.key_encryption_algorithm.oid() { +- &oid::RSA_OID => { +- let padding = types::PKCS1V15.get(py)?.call0()?; +- private_key +- .call_method1( +- pyo3::intern!(py, "decrypt"), +- (recipient_info.encrypted_key, &padding), +- )? +- .extract::()? +- } +- _ => { +- return Err(CryptographyError::from( +- exceptions::UnsupportedAlgorithm::new_err(( +- "Only RSA with PKCS #1 v1.5 padding is currently supported for key decryption.", +- exceptions::Reasons::UNSUPPORTED_SERIALIZATION, +- )), +- )); +- } +- }; +- + // The function can decrypt content encrypted with AES-128-CBC, which the S/MIME v3.2 + // RFC specifies as MUST support, and AES-256-CBC, which is specified as SHOULD+ + // support. More info: https://datatracker.ietf.org/doc/html/rfc5751#section-2.7 +@@ -294,19 +273,9 @@ fn decrypt_der<'p>( + let algorithm_identifier = enveloped_data + .encrypted_content_info + .content_encryption_algorithm; +- let (algorithm, mode) = match algorithm_identifier.params { +- AlgorithmParameters::Aes128Cbc(iv) => ( +- types::AES128.get(py)?.call1((key,))?, +- types::CBC +- .get(py)? +- .call1((pyo3::types::PyBytes::new(py, &iv),))?, +- ), +- AlgorithmParameters::Aes256Cbc(iv) => ( +- types::AES256.get(py)?.call1((key,))?, +- types::CBC +- .get(py)? +- .call1((pyo3::types::PyBytes::new(py, &iv),))?, +- ), ++ let (algorithm_type, key_size, iv) = match algorithm_identifier.params { ++ AlgorithmParameters::Aes128Cbc(iv) => (&types::AES128, 16, iv), ++ AlgorithmParameters::Aes256Cbc(iv) => (&types::AES256, 32, iv), + _ => { + return Err(CryptographyError::from( + exceptions::UnsupportedAlgorithm::new_err(( +@@ -317,6 +286,50 @@ fn decrypt_der<'p>( + } + }; + ++ // Raise error when the key encryption algorithm is not RSA ++ if recipient_info.key_encryption_algorithm.oid() != &oid::RSA_OID { ++ return Err(CryptographyError::from( ++ exceptions::UnsupportedAlgorithm::new_err(( ++ "Only RSA with PKCS #1 v1.5 padding is currently supported for key decryption.", ++ exceptions::Reasons::UNSUPPORTED_SERIALIZATION, ++ )), ++ )); ++ } ++ ++ // Unwrap the content encryption key. RFC 3218 requires that a ++ // failure to recover a usable key is not distinguishable from ++ // recovering a key that simply isn't the right one -- otherwise ++ // this becomes a Bleichenbacher oracle for anything that decrypts ++ // attacker-supplied data. We substitute a random key of the ++ // expected size, so that every failure surfaces as the same ++ // content decryption error. ++ let padding = types::PKCS1V15.get(py)?.call0()?; ++ let random_key = crate::backend::rand::get_rand_bytes(py, key_size)?; ++ let key = match private_key.call_method1( ++ pyo3::intern!(py, "decrypt"), ++ (recipient_info.encrypted_key, &padding), ++ ) { ++ Ok(key) => { ++ let key = key.extract::>()?; ++ if key.as_bytes().len() == key_size { ++ key ++ } else { ++ random_key ++ } ++ } ++ // A ValueError here is entirely attacker controlled (invalid ++ // padding, or an encrypted key of the wrong length) and must ++ // stay silent. Any other exception reflects a caller mistake ++ // rather than the contents of the message. ++ Err(e) if e.is_instance_of::(py) => random_key, ++ Err(e) => return Err(e.into()), ++ }; ++ ++ let algorithm = algorithm_type.get(py)?.call1((key,))?; ++ let mode = types::CBC ++ .get(py)? ++ .call1((pyo3::types::PyBytes::new(py, &iv),))?; ++ + // Decrypt the content using the key and proper algorithm + let encrypted_content = match enveloped_data.encrypted_content_info.encrypted_content { + Some(content) => content, +diff --git a/tests/doubles.py b/tests/doubles.py +index cf2c96a3e..25f1b4c59 100644 +--- a/tests/doubles.py ++++ b/tests/doubles.py +@@ -2,9 +2,11 @@ + # 2.0, and the BSD License. See the LICENSE file in the root of this repository + # for complete details. + ++from __future__ import annotations + + from cryptography.hazmat.primitives import hashes, serialization +-from cryptography.hazmat.primitives.asymmetric import padding ++from cryptography.hazmat.primitives.asymmetric import padding, rsa ++from cryptography.hazmat.primitives.asymmetric import utils as asym_utils + from cryptography.hazmat.primitives.ciphers import ( + BlockCipherAlgorithm, + CipherAlgorithm, +@@ -53,3 +55,45 @@ class DummyKeySerializationEncryption( + + class DummyAsymmetricPadding(padding.AsymmetricPadding): + name = "dummy-padding" ++ ++ ++class DummyRSAPrivateKey(rsa.RSAPrivateKey): ++ """ ++ A fake RSAPrivateKey whose decrypt() raises a non-ValueError. Used for ++ testing that a failure originating outside of this library is not ++ mistaken for an attacker controlled decryption failure. ++ """ ++ ++ def decrypt( ++ self, ciphertext: bytes, padding: padding.AsymmetricPadding ++ ) -> bytes: ++ raise TypeError("TypeError for testing") ++ ++ @property ++ def key_size(self) -> int: ++ raise NotImplementedError ++ ++ def public_key(self) -> rsa.RSAPublicKey: ++ raise NotImplementedError ++ ++ def sign( ++ self, ++ data: bytes, ++ padding: padding.AsymmetricPadding, ++ algorithm: asym_utils.Prehashed | hashes.HashAlgorithm, ++ ) -> bytes: ++ raise NotImplementedError ++ ++ def private_numbers(self) -> rsa.RSAPrivateNumbers: ++ raise NotImplementedError ++ ++ def private_bytes( ++ self, ++ encoding: serialization.Encoding, ++ format: serialization.PrivateFormat, ++ encryption_algorithm: serialization.KeySerializationEncryption, ++ ) -> bytes: ++ raise NotImplementedError ++ ++ def __copy__(self) -> rsa.RSAPrivateKey: ++ raise NotImplementedError +diff --git a/tests/hazmat/primitives/test_pkcs7.py b/tests/hazmat/primitives/test_pkcs7.py +index 1496a23e1..87f2bec1a 100644 +--- a/tests/hazmat/primitives/test_pkcs7.py ++++ b/tests/hazmat/primitives/test_pkcs7.py +@@ -18,6 +18,7 @@ from cryptography.hazmat.primitives import hashes, serialization + from cryptography.hazmat.primitives.asymmetric import ed25519, padding, rsa + from cryptography.hazmat.primitives.ciphers import algorithms + from cryptography.hazmat.primitives.serialization import pkcs7 ++from tests.doubles import DummyRSAPrivateKey + from tests.x509.test_x509 import _generate_ca_and_leaf + + from ...hazmat.primitives.fixtures_rsa import ( +@@ -1406,6 +1407,67 @@ class TestPKCS7Decrypt: + email_message.as_bytes(), certificate, private_key, [] + ) + ++ def test_decrypt_encrypted_key_is_not_an_oracle( ++ self, data, certificate, private_key ++ ): ++ # An attacker who replaces the encryptedKey must not be able to tell ++ # the RSA decryption outcomes apart. Recovering an unusable key, or ++ # failing to recover one at all, has to look exactly like recovering ++ # a key of the right length that simply isn't the right key. See ++ # RFC 3218 and Bleichenbacher's '98 attack. ++ enveloped = ( ++ pkcs7.PKCS7EnvelopeBuilder() ++ .set_data(data) ++ .add_recipient(certificate) ++ ) ++ der = enveloped.encrypt(serialization.Encoding.DER, []) ++ ++ public_key = certificate.public_key() ++ assert isinstance(public_key, rsa.RSAPublicKey) ++ ++ # The encryptedKey is the only OCTET STRING in the structure as long ++ # as the RSA modulus, so it can be located by its DER header. ++ key_bytes = public_key.key_size // 8 ++ marker = b"\x04\x82" + key_bytes.to_bytes(2, "big") ++ assert der.count(marker) == 1 ++ offset = der.index(marker) + len(marker) ++ ++ for encrypted_key in [ ++ # Invalid PKCS#1 v1.5 padding. ++ b"\x00" * key_bytes, ++ # Valid padding concealing a key of the wrong length. ++ public_key.encrypt(b"A" * 15, padding.PKCS1v15()), ++ public_key.encrypt(b"A" * 17, padding.PKCS1v15()), ++ public_key.encrypt(b"A" * 32, padding.PKCS1v15()), ++ # Valid padding concealing a correctly sized but wrong key. ++ public_key.encrypt(b"A" * 16, padding.PKCS1v15()), ++ ]: ++ tampered = der[:offset] + encrypted_key + der[offset + key_bytes :] ++ try: ++ pkcs7.pkcs7_decrypt_der(tampered, certificate, private_key, []) ++ except ValueError as exc: ++ # Decrypting under a substituted random key leaves plausible ++ # PKCS#7 padding roughly one time in 256, in which case the ++ # caller gets garbage instead of an error. That is equally ++ # uninformative, so it is an acceptable outcome here. ++ assert str(exc) == "Invalid padding bytes." ++ ++ def test_decrypt_key_error_is_not_swallowed(self, data, certificate): ++ # Only a ValueError from unwrapping the key is attacker controlled and ++ # therefore silenced. A private key implemented outside this library ++ # can fail in other ways, and those must still reach the caller. ++ enveloped = ( ++ pkcs7.PKCS7EnvelopeBuilder() ++ .set_data(data) ++ .add_recipient(certificate) ++ .encrypt(serialization.Encoding.DER, []) ++ ) ++ ++ with pytest.raises(TypeError, match="TypeError for testing"): ++ pkcs7.pkcs7_decrypt_der( ++ enveloped, certificate, DummyRSAPrivateKey(), [] ++ ) ++ + + @pytest.mark.supported( + only_if=lambda backend: backend.pkcs7_supported(), +diff --git a/tests/test_doubles.py b/tests/test_doubles.py +new file mode 100644 +index 000000000..f52bd3bbf +--- /dev/null ++++ b/tests/test_doubles.py +@@ -0,0 +1,53 @@ ++# This file is dual licensed under the terms of the Apache License, Version ++# 2.0, and the BSD License. See the LICENSE file in the root of this repository ++# for complete details. ++ ++import copy ++ ++import pytest ++ ++from cryptography.hazmat.primitives import hashes, serialization ++from cryptography.hazmat.primitives.asymmetric import padding ++ ++from .doubles import DummyRSAPrivateKey ++ ++ ++class TestDummyRSAPrivateKey: ++ def test_decrypt(self): ++ key = DummyRSAPrivateKey() ++ with pytest.raises(TypeError): ++ key.decrypt(b"ciphertext", padding.PKCS1v15()) ++ ++ def test_key_size_not_implemented(self): ++ key = DummyRSAPrivateKey() ++ with pytest.raises(NotImplementedError): ++ key.key_size ++ ++ def test_public_key_not_implemented(self): ++ key = DummyRSAPrivateKey() ++ with pytest.raises(NotImplementedError): ++ key.public_key() ++ ++ def test_sign_not_implemented(self): ++ key = DummyRSAPrivateKey() ++ with pytest.raises(NotImplementedError): ++ key.sign(b"data", padding.PKCS1v15(), hashes.SHA256()) ++ ++ def test_private_numbers_not_implemented(self): ++ key = DummyRSAPrivateKey() ++ with pytest.raises(NotImplementedError): ++ key.private_numbers() ++ ++ def test_private_bytes_not_implemented(self): ++ key = DummyRSAPrivateKey() ++ with pytest.raises(NotImplementedError): ++ key.private_bytes( ++ serialization.Encoding.PEM, ++ serialization.PrivateFormat.PKCS8, ++ serialization.NoEncryption(), ++ ) ++ ++ def test_copy_not_implemented(self): ++ key = DummyRSAPrivateKey() ++ with pytest.raises(NotImplementedError): ++ copy.copy(key) +-- +2.35.6 From patchwork Tue Oct 20 23:22:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101458 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f54.google.com (mail-wr1-f54.google.com [209.85.221.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4769.1792538581742692207 for ; Tue, 20 Oct 2026 16:23:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=EzhTSK7l; spf=pass (domain: smile.fr, ip: 209.85.221.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f54.google.com with SMTP id ffacd0b85a97d-487049569b6so59723f8f.1 for ; Tue, 20 Oct 2026 16:23:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538580; x=1793143380; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=YTNMfOvAFZf+EyCru/OsgvG726OeP1ZVXtatr+BAV/4=; b=EzhTSK7lidORq5sByKFt7DPfgd1LeHfYr3+w2MEBixAMx3wYUmFD6NOMZClZDsbgzB yLQbRAOapmt3dsjcI/3e1pccSdOgiRHX3G1F9c1olFPG38QKd3yPr4CdBfLkeFkRbayv p69ufADhT1H5QOF9KVc0t9WMvWq6ZgiPT24ftGpjC93Mecn/I6ly0shxhSQEPCAKt4SH rH/8PHMMP+yEUZJMpbhV27r5GvCbqr27klh3MnpaEYgwrHFvwyrGk7BXZckzje3iFOjy VUtWK9n4DdEGKKt+olAWeG7GwQFHh3zlWEYZovnEeTx6gFT0JD/+yLZYdzPFnWLwrDsm FzRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538580; x=1793143380; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=YTNMfOvAFZf+EyCru/OsgvG726OeP1ZVXtatr+BAV/4=; b=m6aRXcbqdWzodXBPTW7j9i937ipwv02G+MTkvErewP2XjhsyTmAC+2g1GW7fps7SUr pB59T0h8fLZS6Kd/UXECH5j9ZGRFsyo/g6RXGIRwmvUfZ7uKkRbwUpYOkCHZ6+hsZhtY Dal5ZCC6l8iFd27w1nAsDUhdMqPE+tEI2xyHbhdGkna02o6JV8Wr0M/uo/tUWI33EI1c jGK21yxJStaXXBkyP5yIBl6DtabGy9c4pQuxLXrRhBj9AMCGXgnG2WgvPmDJ1gj/L0fN uVOesbZJt1ZQjWzgNsZiQDAavib/eo33ekgkk1VMzDxKxwwvm5nR/aI2m9UvRoPhiDrY TvEA== X-Gm-Message-State: AFq9FYIhiJuRkphErl+oxQtYFPbPQ/VKAS1ymUtpTptzpdKDvTp4O4OY TihNjTYPUQWCSKnA5BsiOeQ9oe19Dgpi13RzwLBA5pnkZbfBBosIyiKLClwwTt+Gz4vITJZ8VRk 9/5V/kC8= X-Gm-Gg: AYBFou20zF/vYua4O8/6YzBbsea1s6PaNuYfRuLPEE7A4v0/qfnfbCw+aOI4RwdiGin RcIYLoHO4GuQAisLb+yqwY4+cLRJFhwfX7HB4rKhMsGzqbEIwJZCMZwrKRt0CvZzKvCXu/QmdHP iYShSgcszQ2SXMOLmg3vQlThavA2irwmo/y1vb6aNd89OLZbDWFxZVgqwQJfWNM8xf/GZe2CvS4 pkir54pxhzS9rQQ+ENcAs+992YQf7PGM1hVSfy+K27jz6B5a5G6+99HfHOcCgsbCWocNEA/6k3L wREWBd6wDqAluAgmVKhrPo7Zjj4V2KC7FSYfJ2hifZA5XIbn2ELHgycBMTnlhWdyeHjXa5Vdxaf I7+x4D0ZQCSiGcZ5qvSCKRctBchh2cv1UQpJXo2I1MrVaopqFRIiwmLLK5dNuAI2Dk/rlbtwnjT zFf0Z65MiLzfIMz8KauHE/p3tV6WFgEU3HJEWFXQDjkFAgxBBllK3hQtmMaswU7vlHPtgGxhxIJ t9mr6+qoZiJ8w093/kr1Z5npFQsanl09YomOjzSZjZ3Y4S086FPAY8zVj5XdfFVP1Gv5MAofA== X-Received: by 2002:a5d:4573:0:b0:48d:ef7a:e59f with SMTP id ffacd0b85a97d-48e264ab28amr288024f8f.17.1792538579825; Tue, 20 Oct 2026 16:22:59 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:59 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 14/25] curl: fix CVE-2026-80230 Date: Wed, 21 Oct 2026 01:22:24 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248333 From: Jaipaul Cheernam Backport the upstream fix [1] as mentioned in [2] [1] https://github.com/curl/curl/commit/5267ed859d545534d0c21 [2] https://curl.se/docs/CVE-2026-80230.html Signed-off-by: Jaipaul Cheernam Signed-off-by: Yoann Congal --- .../curl/curl/CVE-2026-80230.patch | 68 +++++++++++++++++++ meta/recipes-support/curl/curl_8.19.0.bb | 62 ++++++++--------- 2 files changed, 99 insertions(+), 31 deletions(-) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80230.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-80230.patch b/meta/recipes-support/curl/curl/CVE-2026-80230.patch new file mode 100644 index 00000000000..5a6bb359861 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80230.patch @@ -0,0 +1,68 @@ +From 7d34e6397166b10600c2ced93f95641d5e7c1575 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 24 Aug 2026 23:37:49 +0200 +Subject: [PATCH] openssl: no server cert is only okay if also not pinned + +Reported-by: Stanislav Fort +Closes #22660 + +CVE: CVE-2026-80230 +Upstream-Status: Backport [https://github.com/curl/curl/commit/5267ed859d545534d0c21675a2b70af5a3b6e3ef] + +Note: CURL_EASY_STR() macro does not exist in 8.19.0, so the pinned() +accesses data->set.str[] directly instead. + +Signed-off-by: Jaipaul Cheernam +--- + lib/vtls/openssl.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c +index 1cf357c..cb6fcc4 100644 +--- a/lib/vtls/openssl.c ++++ b/lib/vtls/openssl.c +@@ -4607,21 +4607,24 @@ out: + return result; + } + +-static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf, +- struct Curl_easy *data, +- X509 *server_cert) ++static const char *pinned(struct Curl_cfilter *cf, ++ struct Curl_easy *data) + { +- const char *ptr; +- CURLcode result = CURLE_OK; +- + (void)cf; ++ return + #ifndef CURL_DISABLE_PROXY +- ptr = Curl_ssl_cf_is_proxy(cf) ? ++ Curl_ssl_cf_is_proxy(cf) ? + data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] : +- data->set.str[STRING_SSL_PINNEDPUBLICKEY]; +-#else +- ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY]; + #endif ++ data->set.str[STRING_SSL_PINNEDPUBLICKEY]; ++} ++ ++static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf, ++ struct Curl_easy *data, ++ X509 *server_cert) ++{ ++ CURLcode result = CURLE_OK; ++ const char *ptr = pinned(cf, data); + if(ptr) { + result = ossl_pkp_pin_peer_pubkey(data, server_cert, ptr); + if(result) +@@ -4803,7 +4806,8 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf, + server_cert = SSL_get1_peer_certificate(octx->ssl); + if(!server_cert) { + /* no verification at all, this maybe acceptable */ +- if(!(conn_config->verifypeer || conn_config->verifyhost)) ++ if(!(conn_config->verifypeer || conn_config->verifyhost) && ++ !pinned(cf, data)) + goto out; + + failf(data, "SSL: could not get peer certificate"); diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb index 0573e08ea4a..c2697d6dd8c 100644 --- a/meta/recipes-support/curl/curl_8.19.0.bb +++ b/meta/recipes-support/curl/curl_8.19.0.bb @@ -9,37 +9,37 @@ SECTION = "console/network" LICENSE = "curl" LIC_FILES_CHKSUM = "file://COPYING;md5=0515352b285b9c3f66464b135c9c0fdc" -SRC_URI = " \ - https://curl.se/download/${BP}.tar.xz \ - file://run-ptest \ - file://disable-tests \ - file://no-test-timeout.patch \ - file://CVE-2026-6276.patch \ - file://CVE-2026-5773.patch \ - file://mbedtls.patch \ - file://CVE-2026-5545.patch \ - file://CVE-2026-6253.patch \ - file://CVE-2026-6429-dependent.patch \ - file://CVE-2026-6429.patch \ - file://CVE-2026-7168.patch \ - file://CVE-2026-4873.patch \ - file://CVE-2026-8286.patch \ - file://CVE-2026-8927.patch \ - file://CVE-2026-8932-dependent.patch \ - file://CVE-2026-8932.patch \ - file://CVE-2026-11352.patch \ - file://CVE-2026-11586.patch \ - file://CVE-2026-7009.patch \ - file://CVE-2026-8925.patch \ - file://CVE-2026-9080.patch \ - file://CVE-2026-9545-01.patch \ - file://CVE-2026-9545-02.patch \ - file://CVE-2026-9079.patch \ - file://CVE-2026-13608.patch \ - file://CVE-2026-80229.patch \ - file://CVE-2026-9546-01.patch \ - file://CVE-2026-9546-02.patch \ -" +SRC_URI = "https://curl.se/download/${BP}.tar.xz \ + file://run-ptest \ + file://disable-tests \ + file://no-test-timeout.patch \ + file://CVE-2026-6276.patch \ + file://CVE-2026-5773.patch \ + file://mbedtls.patch \ + file://CVE-2026-5545.patch \ + file://CVE-2026-6253.patch \ + file://CVE-2026-6429-dependent.patch \ + file://CVE-2026-6429.patch \ + file://CVE-2026-7168.patch \ + file://CVE-2026-4873.patch \ + file://CVE-2026-8286.patch \ + file://CVE-2026-8927.patch \ + file://CVE-2026-8932-dependent.patch \ + file://CVE-2026-8932.patch \ + file://CVE-2026-11352.patch \ + file://CVE-2026-11586.patch \ + file://CVE-2026-7009.patch \ + file://CVE-2026-8925.patch \ + file://CVE-2026-9080.patch \ + file://CVE-2026-9545-01.patch \ + file://CVE-2026-9545-02.patch \ + file://CVE-2026-9079.patch \ + file://CVE-2026-13608.patch \ + file://CVE-2026-80229.patch \ + file://CVE-2026-9546-01.patch \ + file://CVE-2026-9546-02.patch \ + file://CVE-2026-80230.patch \ + " SRC_URI:append:class-nativesdk = " \ file://environment.d-curl.sh \ From patchwork Tue Oct 20 23:22:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101459 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4738.1792538582100912059 for ; Tue, 20 Oct 2026 16:23:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=NZ0cHtRI; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4a1e34ecb02so690415e9.2 for ; Tue, 20 Oct 2026 16:23:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538580; x=1793143380; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=WZD5hx3ySZOizCvlESRUe29eoGnRf/XzXkqfKW1d0zA=; b=NZ0cHtRIyIhrUpC21eRsriHzQuIuAEo9KpdzEmrACI5IM8rdpumTKC9s8FQGpwZzmV +Gn2MOgF7m7ldjFPhjEMIIEU1o9yXC93yasINf/xftXjEBNQA4Q6WgvBxn2y8nk77O1j lgaMHCuv2ESclGR5fy7SP9vAGAKL/ms+g7HAkK5J7XM/cpZ1KtfmmKVRQyEIdp6TrN64 qzttNy28d1DECori15stFtWJD4tglOWSKMOuaXPZW1JOLpUNYN72m9v4paBXwWnYCIQh ZFAaLd7ihUMXffbjKvdMxGaTMwxtPTY+1iEY9IIQHFmvEOIK+IdnUCTgrv7OrJVaqXQv n5kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538580; x=1793143380; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=WZD5hx3ySZOizCvlESRUe29eoGnRf/XzXkqfKW1d0zA=; b=gbhETSv2RrxEhi+MnvbgLisBQ7W2LbVuthGM293Mp0LGqHmJ8MShJfFVSBxgdsFpYK 9HqiujkdZDGsw0W6HZugSTQZBopnziH3dJf6taNum3CCtwEichjKc934UowKmFzzWSi0 KcHAEhJF0jq6qzzuu/Oqcc85jO3IBwck3PFJTscv0qy1S4G+QVhIyme4zdzBtQnZYOmy KleN9en4I4ia41/89KtxpvCMsoyByBMwbZpz2cmSa5BjfjfgHvvkiwrgPYcw9mt7Emmp pyX/DVbUlK777je/bnLz56tsz01GsOBpqcV9bVjs6NWQr/oDvqYzKq0WQTvDbeUO3/94 1sIQ== X-Gm-Message-State: AFq9FYKxLU/V2+5tTRg0v1CRlp301rfbGnE5xPq4kPx1jeXV9JshvpQw VjaK3rIlXuQU4/lrHvkcgcGIktivVgQgwHxGPUCqzL1S0iWffahOOOLYXei6QJ8+t5a6aUL7ocf rah6CwXE= X-Gm-Gg: AYBFou2+inzNrF+pJ55nnBbU+VwGLey8+71qMwvLyIsSZhtilOPunB+XRkuGu0ge70f kPzPWy5gPtMUyrBmoyPLRBczF8hz6n0oDzdbi5L3rF+aRT/IVjtFM8Gkn0JIsZBvwaodo9blsyu 5WgNuUFOVqYBYiPASmc/FDd+1RC//Qq9N2dj+AWiIKjqv+/kM+iynT0CM+UlqWOigFBLFcrHnO7 VkGLS1wqwJ5Pz78wfoXykyRtdERy4dlFIkowzxJ4NvZB2GYnTFavmQjTShak9qIKCKBHogvX4Wv Hjc45UcPSNQz4sPJBvLEMdVm3n1o4b/R+2mov3eAtfaMUcKHRFTyLCzr6HkR9kc8rGbETXU8z8a H8rpr8FUkNj2X6YTpztfzwCMiX69+VzqRtPqpRBVQofLRdPue0E76ed6irGBSAY3kJG3HsWX2PQ q728OoUkg1IvCMokAxGoAqsavgV9S0BbcRu6FSMEezxhrCyv0/qBIC3hbqH0/yuCKNnp9Y0gMyJ x4FtklY7U7HyAq3P3x5Dbh1NHA9hyKpuXq8vClpv8cFH6W+Kk2x69pBKT/gUCp5r7Wqj+AbScaS aoRhwlXy2sAY81p+wpJyO7A59SDF/LeJnGO3v0b9E7DB2HpfQ7ycCexs X-Received: by 2002:a05:600c:8506:b0:4a1:d957:733e with SMTP id 5b1f17b1804b1-4a1fdd4b4d9mr3509735e9.26.1792538580285; Tue, 20 Oct 2026 16:23:00 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.22.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:22:59 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 15/25] libpcre2: update to latest release branch hash c084f99ae0 Date: Wed, 21 Oct 2026 01:22:25 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248334 From: Peter Marko Handles CVE-2026-103111, CVE-2026-86145, CVE-2026-89158, CVE-2026-89160, CVE-2026-89157, CVE-2026-89156, CVE-2026-89161, and CVE-2026-89162. The project committed to have 5 year security support for each release on a dedicated release branch. Switch from release tarball to git fetcher to use this feature. gitsm is used to fetch sljit subnmodule. It is not used by default but can be enabled in downstream layers via configuration option. Git log with all changes and manually created CVE annotations: $ git log --oneline pcre2-10.47..c084f99ae0af664e86819fd1839a13c56dc0918c c084f99a Backport of pcre2-10.49-Fix-large-stack-allocation.patch [CVE-2026-103111] cb7193ac Backport of pcre2-10.48-Fix-DFA-workspace-overflows.patch [CVE-2026-86145] 586e2ea0 Backport of pcre2-10.48-Fix-compiler-integer-overflows.patch [CVE-2026-89158] 2c7492a0 Backport of pcre2-10.48-Fix-invalid-UTF-backwards-scans.patch [CVE-2026-89160] 1d6cc92c Backport of pcre2-10.48-Keep-escape-error-offset-in-pattern.patch 75ca1974 Backport of pcre2-10.48-Fix-allocation-byte-sizing.patch [CVE-2026-89157] 5528f329 Backport of pcre2-10.48-Check-JIT-mode-before-validation.patch [CVE-2026-89156] 69aa0df5 Backport of pcre2-10.48-Fix-JIT-match-context-reuse.patch [CVE-2026-89161] 1e058b41 Backport of pcre2-10.48-Fix-JIT-STR_END.patch 120f76cb Backport of pcre2-10.48-Fix-scan-prefix-repeat-reset.patch e4d6d427 Backport of pcre2-10.48-Fix-repeated-substitute-escapes.patch 0ac26ee9 Backport of pcre2-10.48-Fix-character-list-generator.patch dcfab032 Backport of pcre2-10.48-Write-serialization-padding.patch [CVE-2026-89162] Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-support/libpcre/libpcre2_10.47.bb | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/meta/recipes-support/libpcre/libpcre2_10.47.bb b/meta/recipes-support/libpcre/libpcre2_10.47.bb index 70079e0b65b..5bdb647f52e 100644 --- a/meta/recipes-support/libpcre/libpcre2_10.47.bb +++ b/meta/recipes-support/libpcre/libpcre2_10.47.bb @@ -12,25 +12,27 @@ LIC_FILES_CHKSUM = "file://LICENCE.md;md5=6720bf3bcff57543b915c2b22e526df0 \ file://deps/sljit/LICENSE;md5=97268427d235c41c0be238ce8e5fda17 \ " -SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \ +BASE_VER = "${@d.getVar('PV').split('+')[0]}" +SRC_URI = "gitsm://github.com/PCRE2Project/pcre2;protocol=https;branch=release/pcre2-${BASE_VER} \ file://run-ptest \ " - -GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases" -UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P\d+(\.\d+)+)$" - -SRC_URI[sha256sum] = "47fe8c99461250d42f89e6e8fdaeba9da057855d06eb7fc08d9ca03fd08d7bc7" +SRCREV = "c084f99ae0af664e86819fd1839a13c56dc0918c" +PV .= "+git" CVE_PRODUCT = "pcre2" -S = "${UNPACKDIR}/pcre2-${PV}" +CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS" +CVE_STATUS_STABLE_BACKPORTS = "CVE-2026-103111 CVE-2026-86145 CVE-2026-89158 CVE-2026-89160 \ + CVE-2026-89157 CVE-2026-89156 CVE-2026-89161 CVE-2026-89162 \ +" +CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash" PROVIDES += "pcre2" DEPENDS += "bzip2 zlib" BINCONFIG = "${bindir}/pcre2-config" -inherit autotools binconfig-disabled github-releases ptest +inherit autotools binconfig-disabled ptest EXTRA_OECONF = "\ --enable-newline-is-lf \ From patchwork Tue Oct 20 23:22:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101460 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4739.1792538582534544914 for ; Tue, 20 Oct 2026 16:23:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=BfhH18Tq; spf=pass (domain: smile.fr, ip: 209.85.128.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-4a1e266fca2so668305e9.3 for ; Tue, 20 Oct 2026 16:23:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538581; x=1793143381; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=2fIBbwM15bOJivtg94721OTNd70lOl9KPSd5BxJk2pI=; b=BfhH18TqcP794aSanZsiExEh4V3RzhTUj0wQ5d4arGlXELVprO/oZx7zw2LqGXBzv0 1/Qpt2HnedtmEHP5T7Wk4U3bphmsPzVVr/KPut5gGusUnxII4DDwJr46Aa9XNnV44I5a NED0RuzL5sd+xAluIm4qN0Bhyca0be7k+Wx2OPcsJQo8hVC4Ev8OaF6ff0BuCjhzlPNQ Oe8faVDGwrXestZQrmpNrssE5//86XfWcSojd2CxP9Mq2qkKoqNIQu2e6hrdbFAvFMVy 8d1ZMD7cZzI+HmvHhZEs5EOqdmI985FrXwsv0IZe14O1DhCOrKjLxBtqNBVbmE+bZkWI jBQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538581; x=1793143381; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=2fIBbwM15bOJivtg94721OTNd70lOl9KPSd5BxJk2pI=; b=vZCUajYmtNeTZJmh+/VJ36JzOd4TSH16rmz1b3GUCfsDck1lybmQs/CUbuPci/hDUs TKw93WefwK5160vbnteCxo8d4l9Rf/xDTBfArYqph0Bp1gKURX/b6M0F4Wu/YbLe9Ono RZDl2TIrvgpYr+LlzB62P748ujt/dYeis9AMGoaEwtKk2jZYBuE+YH/5GMyOIebBV8zc j8AHzzMeKYpBeeJPuDkm5xXdrjWBfOKpxLjMuCJ6GFj3gOfdIS9Du3BhgvAzk2VRnDVD jLLq1t5Uss8Znyv8CkhnLcEyqZWnCU5uPcJyqzab7d3hhxxoxowRJV99g5W8to352DSU coLw== X-Gm-Message-State: AFq9FYK3x8CyL4AW2mJagMijJ22yA/hZf6cLdShWN7h0GShNobM0JNOx 2FLtSLJGHtWct5cvKJTh0Cn5MYMU/rhjxIZPrglHmlC6odcV4iKzxjaJOlZTvyR14KMXD6vv/TO YydoUbPY= X-Gm-Gg: AYBFou34ublMAX0bb4z5T82kTub/+6wsS20SbCgXZw8W0sHzPXVL4G2xmB17BFAT2tN fS3cdEI304AnF45qwo5J4jiorXARSu3QaJug9KTdxLoO0ShEyeOX2vWCmHihfeuX0kqhkSHUVcP wMTdYfJv1zNTbro3GeyUIapiwEzDMcMVmTMeXTIkMksUzME82uiCoDhflY2NFhMSjT51QehfgCp qjYvziy/9+f7dzdMjew7SkSpD3jFkbRWPVspkzAk3R4ZxGgEFRsYK8nGyrcUGuUV4YFdPenPBw+ gUowWvzrk5+AGjD2/770rk/xQ/0MLs78AleFOAv+K2k3r4volzRgSPNdev5ow3kQBHb0DaGhgdA MZ3OiRrVf4aHhsVwqGd+XSMJIQyWxLMa8UlkIebd3i8HbVTmBLZ4AZQ9I0dbdvLAi0pA1b2QdEX 4Cem8jdjPhX1tNhB6UHIgtTSEvwgnzQ6fO+RibDZz/ynKeLqIWcGRLJY0A6cqMYPYp6ITILVUNF EC19T+nwuQmE+On4JRbiSV0ukI4ofGeByp/+aW5/d0pLrHHoveGRIbpUYBus512YpElc9c0k74N GKcDuvHGx2EfYpWdpc9z9VAit9aE9+RzVd2BS3aTMMiDW5gGCnyC1gRb X-Received: by 2002:a05:600c:a204:b0:4a1:e9c2:6c84 with SMTP id 5b1f17b1804b1-4a1fdd2c140mr2142295e9.18.1792538580664; Tue, 20 Oct 2026 16:23:00 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.23.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:23:00 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 16/25] libarchive: fix CVE-2026-15028 Date: Wed, 21 Oct 2026 01:22:26 +0200 Message-ID: <96192dff907f6142903513c854e0a27361fa0949.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248335 From: Jakub Szczudlo (Nokia) Backport patch to fix CVE-2026-15028. References: https://nvd.nist.gov/vuln/detail/CVE-2026-15028 The link in NVD is wrong. Based on project own pull request: https://github.com/libarchive/libarchive/pull/3252 Fixing commit is the below one: https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2 Signed-off-by: Jakub Szczudlo Signed-off-by: Yoann Congal [YC: For master and blacksail, the proper fix is included in v3.8.9 via an upstream cherrypick https://github.com/libarchive/libarchive/commit/22ffe8e8e459970f3bc86b0267493fc4aa8249b8 ] --- .../libarchive/CVE-2026-15028.patch | 41 +++++++++++++++++++ .../libarchive/libarchive_3.8.7.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch new file mode 100644 index 00000000000..c63fcf22f20 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch @@ -0,0 +1,41 @@ +From 40b92de1def08e4fc319d55702785f82cedb7ef2 Mon Sep 17 00:00:00 2001 +From: datauwu +Date: Mon, 6 Jul 2026 21:51:15 +0800 +Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing + +header_pax_extension() passes PAX attribute values without the trailing +newline to pax_attribute(). The SUN.holesdata parser read one byte past +the supplied value when the last numeric field ended at the value +boundary. + +Handle length == 0 before checking *e. + +CVE: CVE-2026-15028 +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2] +Signed-off-by: Jakub Szczudlo +--- + libarchive/archive_read_support_format_tar.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c +index e07cfdb63b..1c0441db6c 100644 +--- a/libarchive/archive_read_support_format_tar.c ++++ b/libarchive/archive_read_support_format_tar.c +@@ -3448,13 +3448,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar, + return (ARCHIVE_FATAL); + tar->sparse_last->hole = hole; + } +- if (length == 0 || *e == '\n') { +- if (length == 0 && *e == '\n') { +- return (ARCHIVE_OK); +- } else { +- return (ARCHIVE_WARN); +- } +- } ++ if (length == 0) ++ return (ARCHIVE_OK); ++ if (*e == '\n') ++ return (ARCHIVE_WARN); + p = e + 1; + length--; + hole = hole == 0; diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb index c0a29211434..dea22287fce 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb @@ -31,6 +31,7 @@ EXTRA_OECONF += "--enable-largefile --without-iconv" SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://run-ptest \ + file://CVE-2026-15028.patch \ " UPSTREAM_CHECK_URI = "https://www.libarchive.org/" From patchwork Tue Oct 20 23:22:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101461 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f54.google.com (mail-wr1-f54.google.com [209.85.221.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4740.1792538582994444686 for ; Tue, 20 Oct 2026 16:23:03 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=KynkHlqD; spf=pass (domain: smile.fr, ip: 209.85.221.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f54.google.com with SMTP id ffacd0b85a97d-48af4d4e61fso65625f8f.2 for ; Tue, 20 Oct 2026 16:23:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538581; x=1793143381; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=uFmmA6h+J205ImWZoXQcGmU9Q0Fr0asVSi0VqiAJBfQ=; b=KynkHlqDxf24Ld4UI4mvxat+qktX7FmCsc5P3iC5p1UlrAPQApjbVcYShDBs/7bzXp oOpKZNUjRhvCcgi0gSqN1U8c4LsQ8+Jt1DSK15ejWNYxKPqdlZrElw9gpPJ5uGreBmlC q0FoyNjlsie1IgqUErUaoW/WOBMtWDh131ELdrfVcqnsxd095dF2PMsT4m5ZQ8vhJArh KQU9OVT4CfkHcLRQS6mT3uy1DGe12MOGsEhiXj4satbr84Ybq9z6pZ+eWTrNOrA4i6rW 9oT+hbue3AbPvfpcrvlFxg8DbVkXjMpr7dT6GDthyPgMfP5MtE0ml/v3/Z3Dy/RFUjjF 8CSw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538581; x=1793143381; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=uFmmA6h+J205ImWZoXQcGmU9Q0Fr0asVSi0VqiAJBfQ=; b=Jvy6hR1g2kdNgOSQWYP+yunGmGMcdmYs1f0Qsi1CWyw9nW7e90svK/O9xGsKzbZF0f jevdLUZm8qgKyNSrLlpKSt0WW06mwN2qCq6H0GDKuqvzIp2JoLko0ir2tY7yHQxyzcp2 U9MgWw2SHauww/UZzwlzX0TC1eqlUgMgHJS+OvoJ3ErNQZdieMO8agfBa5YHUKQZZb7E dW/emJM001OkxiOH4YOsAmpB5KFe2hGgnhNauLm5Ma4DybUnMwlv/YhrB2+8Z3N2tVOf R0+H2u4JRnyWZUuyChW5YLhbOjlf2zIh04BLe1px0SnNq+DOS+dwLoqQL+bnlvAy7hov V0Qw== X-Gm-Message-State: AFq9FYIlupkwCfRvQrnyolgxSwrGcu9fQGdelAKm6hwax6GOpbxsWrMj ENdzFqJJee6RLlkPpm/P6snOsYcFjOGlcAxB7UwqkO7Hkp3yqTo/tybovZjNynX5ZvdEOB1dwkI Goa2cQu0= X-Gm-Gg: AYBFou15hSpcM/PAOZal3DOSOq7IBNuo/c+Zc12AueuqLhG0j2kkSwyfbQcC6mKQeLa WjgVPCxXmZzk/hU1dwoj8tGuh+nJTQKyft7BNYk2UUCJ6bTUGxjCbCNmNDZ6RDGD7wojx6I5HR+ 2DLTeps07TyP+7wnD2FOt5r5dWtc2Vx56JtLJGvKQ9vmrwJJZ3YIDP0K1iO8LjBaDtP/HIdVls5 REmQ00EVE5xAouyEeoGsHuV+SR0wU3TFq5de8xSx0sxzmHHVb84JBIwP3e+q2hxMH6IJYTieX2F yCNoe/v/CJn4aq7bWR55kf/X2eouNEbMrO+qHD7TynSi5ZUONIKh0iLn8jJIqwVNFLQIMgaQhqK Qdo880CTEVjdwvY6Y92JyLpuffMO/WcU6JlZZNlSrpjMRnPcmb3PN/rjMKrTP0DyD0Agzg5lch0 ppkYc6sq9jCM2BB1wVYk+hyVlRD8sIWntvJSAIv6FQeghwVSL7IkhxCPSnMUTUFBs+YRSr1c1k5 v68SWlCgDnCeCUzQ6Bt9vnTsWKHaXoK3sKLZAgnc6xgxAhDdnlMHaJygedJDDeY3oA5K3loyQ== X-Received: by 2002:a05:6000:2c05:b0:48e:2406:57d0 with SMTP id ffacd0b85a97d-48e2649d9d0mr310877f8f.19.1792538581222; Tue, 20 Oct 2026 16:23:01 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.23.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:23:00 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 17/25] barebox: inherit upstream-stable-release-point Date: Wed, 21 Oct 2026 01:22:27 +0200 Message-ID: <1620b73c239757b638bb34a18ec240bccc1ac721.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248336 From: Lucas Stach Barebox uses a vYYYY.MM.stable versioning scheme, with the stable releases only carrying bug and security fixes. Thus we can use the upstream-stable-release-point class to mark those releases as suitable for inclusion in the oe-core stable series. Signed-off-by: Lucas Stach Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit dd7a67075c67ccd827242f098c41a12023e1a9ba) Signed-off-by: Yoann Congal --- meta/recipes-bsp/barebox/barebox.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-bsp/barebox/barebox.bb b/meta/recipes-bsp/barebox/barebox.bb index a48d97941cc..583fde5d187 100644 --- a/meta/recipes-bsp/barebox/barebox.bb +++ b/meta/recipes-bsp/barebox/barebox.bb @@ -6,5 +6,5 @@ Linux kernel driver API for making driver porting easier, \ and a subset of the POSIX C library for writing more command-line utilities." require barebox-common.inc -inherit barebox +inherit barebox upstream-stable-release-point From patchwork Tue Oct 20 23:22:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101462 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4741.1792538583693293874 for ; Tue, 20 Oct 2026 16:23:04 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=Y94NNFtB; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4a01933b584so814105e9.0 for ; Tue, 20 Oct 2026 16:23:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538582; x=1793143382; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=l/hySl3fvaUytXaqSCBboVIhGY75Qk3MvHdCXorukjk=; b=Y94NNFtBZD1t+wPSjEu+UO9OeZHBl2yJx6twFkdUIyuhTN5PvEWgDNmSgCIYFwNlrJ tk6X9Ph3gUfpE8g6O6rSy3lDET6/Ee/FRoUf3J/qwreHilYQT7Pj36r/fjuXZua5oqgT pmPEyzo4NDWuCON+8QGUu7U+gSrgLui1PCTyn7YoWTyNHOjvuyIwXtk67EYPTUZQh1CW lovNHb13yEE4RUDi7/MSomNp299++lkzPjuNqaAoMwF2W5ygjHdpts5zrKZmMxQfCLou UCLS8OT/Ug9BtN1DiAv0ZsXX6JTMI3pQ9GY0nAwE5eDjH4pZ15VeJvrK6pMswUxoUXwu Fcdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538582; x=1793143382; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=l/hySl3fvaUytXaqSCBboVIhGY75Qk3MvHdCXorukjk=; b=VxUoMPqY6BwFry0bbwGmTRzgNR7rv222OKb4izMU96/YzTpIiBdL/oO06e7ptQwKFc ErKGuxWO47r6uX43fedYfHqGC74oe/KSdt4JJspQ86kwnDN8L4e6//Se3wUcCd6qVIVf oydL8FlQ+WVuWT+u2gHdFVuYDpdmwIw+ezTh5k3UnD4ZuGjetQHC0lu+Tn+vfCiH3feE 0NbF8VvPivQQiV3j8pB21iwm2Gi6P8hWvZ+RwSucIfbTHe1Tep/HkLj7Nz0wqj0Tbyfy 43FOCqAyANPUtkynFrM3CkOG0fqlPpHT+AA0vXyWnozDz1NP8stlXO1LmuK23HYL33mh 8xdQ== X-Gm-Message-State: AFq9FYLNzdeVy0DAvZLplJcxrLaaLU2aP1ok76sB5pHVh8w/uNUmssg7 WPpb4g9kYlT64lkf+wJsW8N/zDGT+3JerZzNDhxKBkrttnyLSsQUA3HELAUUJb6zjgmGjtroqPs KKk8xzPY= X-Gm-Gg: AYBFou1leMfigDgeJtmjX9zPWIFH0aFsQC5mNDUvfoq9eOLXNRTuoYg9VpnUkZbQtIr JJiyiZBMiw6XTZxr/sIW6TeTco9XqJYLU+4nlzLgCeT9gjLlH1AFF94SZb5V3NE1EEgX3gp9yCz b6SGq1AbVNXcRxdojZHAGbg3LCQaquEhrA43Ahm3UQx1Wpim1LlvCNSEkm3njMUoIpZsq8Vsom7 eshaqFlBFjZsie/WRt69xG7sdZAJWQ4gHnSh1q2UYilE8qfOzk9sWBVWPXdA5XkgJd4aqCnp8YM ZA4p+bht08+2UA8tQHoKMXBdtil25rZPVmULmp/Tpgwlm0vOe9wR+IxGDDNTrBVHMnbBdBIdrdS bJNx0rr7MBfsUzeEYUeHuAD+qr1dgDogUh5YlRJ4h9RzgloO/U8KaJT4BW2Fk+XNkG3Bb7PUwV6 jGHqtLobNyz2/z0Jjaqz4MbNs6MN89W1mPUvvcX4hWIVAEfYBi8Bya96sJflNI5qxb37Esjomzy Rn4vzS72KoStI/mpaaDneI1FCfTaZOSMd9/13FWVYqG10AWFHBdDm5+EtMVEsd0OqN050dDCQ== X-Received: by 2002:a05:600c:8b6c:b0:4a0:1b14:e283 with SMTP id 5b1f17b1804b1-4a1fd8a7de3mr5391905e9.1.1792538581686; Tue, 20 Oct 2026 16:23:01 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.23.01 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:23:01 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 18/25] python3-urllib3: Fix CVE-2026-97689 Date: Wed, 21 Oct 2026 01:22:28 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248337 From: Jaipaul Cheernam Backport the upstream fix [1] as mentioned in [2] [1] https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed [2] https://nvd.nist.gov/vuln/detail/cve-2026-97689 Testing: - test_response.py::test_chunk_size_line_too_long - passed - test_response.py::test_chunk_trailer_line_length (6 cases) - passed - test_socketlevel.py::test_chunked_size_line_too_long_does_not_buffer - passed - Full test_response.py: 161 passed, 45 skipped (no regressions) Signed-off-by: Jaipaul Cheernam Signed-off-by: Yoann Congal --- .../python3-urllib3/CVE-2026-97689.patch | 251 ++++++++++++++++++ .../python/python3-urllib3_2.6.3.bb | 6 +- 2 files changed, 254 insertions(+), 3 deletions(-) create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97689.patch diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97689.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97689.patch new file mode 100644 index 00000000000..6e5e870c362 --- /dev/null +++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97689.patch @@ -0,0 +1,251 @@ +From e62cca8f9e4211fa005b238237509a1c669550ba Mon Sep 17 00:00:00 2001 +From: Quentin Pradet +Date: Tue, 15 Sep 2026 22:33:41 +0400 +Subject: [PATCH] Merge commit from fork + +* Bound chunk-size line reads to prevent memory exhaustion DoS + +The streaming chunked path (HTTPResponse.stream() / read_chunked()) read +each chunk-size line with an unbounded readline(), unlike the plain read() +path which delegates to http.client's _MAXLINE-capped reader. A malicious +server could advertise Transfer-Encoding: chunked and then send a very long +run of bytes with no newline, forcing the client to buffer the entire run +before the chunk size could be rejected. + +This caps the chunk-size line (and the trailing CRLF line) at _MAXLINE, +raising ProtocolError when exceeded, matching the behaviour read() already +had. Only the size line is bounded; chunk bodies still go through the sized +_safe_read(), so legitimate large chunks are unaffected. + +Verified with a local malicious server streaming a 200 MiB unterminated +size line: stream() previously grew RSS by ~530 MB, now stays at ~1 MB and +fails fast, matching read(). A 5 MiB chunk body still streams correctly. + +* Fix a black formatting issue + +* Test chunked response trailer length limits + +* Fix number in the changelog entry + +--------- + +Co-authored-by: Illia Volochii + +CVE: CVE-2026-97689 +Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed] + +Note: + - changeLog change is not backported + - Adjusted commit change as per 2.6.3 version + +Signed-off-by: Jaipaul Cheernam +--- + src/urllib3/response.py | 20 +++++- + test/test_response.py | 82 ++++++++++++++++++++++- + test/with_dummyserver/test_socketlevel.py | 34 ++++++++++ + 3 files changed, 132 insertions(+), 4 deletions(-) + +diff --git a/src/urllib3/response.py b/src/urllib3/response.py +index ff6d1f4..58f4587 100644 +--- a/src/urllib3/response.py ++++ b/src/urllib3/response.py +@@ -50,6 +50,13 @@ if typing.TYPE_CHECKING: + + log = logging.getLogger(__name__) + ++# Maximum length of a chunk-size line (and the trailing CRLF line) when reading a ++# chunked-transfer-encoded response. Matches ``http.client._MAXLINE`` so urllib3's ++# streaming path bounds these reads exactly like the stdlib ``.read()`` path does, ++# preventing a malicious server from forcing unbounded buffering (memory exhaustion) ++# via an unterminated chunk-size line. ++_MAX_CHUNK_LINE_LENGTH = 2**16 ++ + + class ContentDecoder: + def decompress(self, data: bytes, max_length: int = -1) -> bytes: +@@ -1330,7 +1337,12 @@ class HTTPResponse(BaseHTTPResponse): + # we'll try to read it from socket. + if self.chunk_left is not None: + return None +- line = self._fp.fp.readline() # type: ignore[union-attr] ++ line = self._fp.fp.readline(_MAX_CHUNK_LINE_LENGTH + 1) # type: ignore[union-attr] ++ if len(line) > _MAX_CHUNK_LINE_LENGTH: ++ self.close() ++ raise ProtocolError( ++ "Response chunk size line exceeded maximum allowed length" ++ ) from None + line = line.split(b";", 1)[0] + try: + self.chunk_left = int(line, 16) +@@ -1438,7 +1450,11 @@ class HTTPResponse(BaseHTTPResponse): + + # Chunk content ends with \r\n: discard it. + while self._fp is not None: +- line = self._fp.fp.readline() ++ line = self._fp.fp.readline(_MAX_CHUNK_LINE_LENGTH + 1) ++ if len(line) > _MAX_CHUNK_LINE_LENGTH: ++ raise ProtocolError( ++ "Response chunk trailer line exceeded maximum allowed length" ++ ) + if not line: + # Some sites may not end with '\r\n'. + break +diff --git a/test/test_response.py b/test/test_response.py +index f55809f..b54a006 100644 +--- a/test/test_response.py ++++ b/test/test_response.py +@@ -27,6 +27,7 @@ from urllib3.exceptions import ( + SSLError, + ) + from urllib3.response import ( # type: ignore[attr-defined] ++ _MAX_CHUNK_LINE_LENGTH, + BaseHTTPResponse, + BytesQueueBuffer, + HTTPResponse, +@@ -1682,6 +1683,63 @@ class TestResponse: + assert isinstance(orig_ex, InvalidChunkLength) + assert orig_ex.length == fp.BAD_LENGTH_LINE.encode() + ++ def test_chunk_size_line_too_long(self) -> None: ++ # A malicious server can send a chunk-size line with no newline. urllib3's ++ # streaming path must reject it with a bounded read rather than buffering ++ # the whole line (memory exhaustion). See GHSA / CVE for chunked DoS. ++ stream = [b"foooo"] ++ fp = MockChunkedEncodingLongChunkSizeLine(stream) ++ r = httplib.HTTPResponse(MockSock) # type: ignore[arg-type] ++ r.fp = fp # type: ignore[assignment] ++ r.chunked = True ++ r.chunk_left = None ++ resp = HTTPResponse( ++ r, preload_content=False, headers={"transfer-encoding": "chunked"} ++ ) ++ with pytest.raises(ProtocolError) as ctx: ++ next(resp.read_chunked()) ++ ++ assert "chunk size line exceeded maximum allowed length" in str(ctx.value) ++ ++ @pytest.mark.parametrize( ++ "trailer_length", ++ [ ++ _MAX_CHUNK_LINE_LENGTH - 1, ++ _MAX_CHUNK_LINE_LENGTH, ++ _MAX_CHUNK_LINE_LENGTH + 1, ++ ], ++ ) ++ @pytest.mark.parametrize("line_ending", [b"\r\n", b""]) ++ def test_chunk_trailer_line_length( ++ self, trailer_length: int, line_ending: bytes ++ ) -> None: ++ # The line limit includes its CRLF, but not the final blank line. ++ trailer = b"X:" + b"x" * (trailer_length - 2 - len(line_ending)) + line_ending ++ fp = BytesIO(b"3\r\nfoo\r\n0\r\n" + trailer + (b"\r\n" if line_ending else b"")) ++ r = httplib.HTTPResponse(MockSock, method="GET") # type: ignore[arg-type] ++ r.fp = fp # type: ignore[assignment] ++ resp = HTTPResponse( ++ r, ++ preload_content=False, ++ headers={"transfer-encoding": "chunked"}, ++ original_response=r, ++ ) ++ chunks = resp.read_chunked() ++ assert next(chunks) == b"foo" ++ ++ if trailer_length > _MAX_CHUNK_LINE_LENGTH: ++ with pytest.raises( ++ ProtocolError, ++ match="Response chunk trailer line exceeded maximum allowed length", ++ ): ++ next(chunks) ++ else: ++ assert list(chunks) == [] ++ ++ assert fp.closed ++ assert r.isclosed() ++ assert resp.closed ++ + def test_truncated_before_chunk(self) -> None: + stream = [b"foooo", b"bbbbaaaaar"] + fp = MockChunkedNoChunks(stream) +@@ -1941,8 +1999,20 @@ class MockChunkedEncodingResponse: + self.cur_chunk = self.cur_chunk[amt:] + return chunk_part + +- def readline(self) -> bytes: +- return self.pop_current_chunk(till_crlf=True) ++ def readline(self, amt: int = -1) -> bytes: ++ # Emulate a real file object's readline(size): return bytes up to and ++ # including the first newline, or at most ``amt`` bytes when ``amt >= 0``, ++ # whichever comes first. ++ if len(self.cur_chunk) <= 0: ++ self.cur_chunk = self._pop_new_chunk() ++ line = self.cur_chunk ++ newline_index = line.find(b"\n") ++ if newline_index != -1: ++ line = line[: newline_index + 1] ++ if 0 <= amt < len(line): ++ line = line[:amt] ++ self.cur_chunk = self.cur_chunk[len(line) :] ++ return line + + def read(self, amt: int = -1) -> bytes: + return self.pop_current_chunk(amt) +@@ -1970,6 +2040,14 @@ class MockChunkedInvalidChunkLength(MockChunkedEncodingResponse): + return f"{self.BAD_LENGTH_LINE}{chunk.decode()}\r\n".encode() + + ++class MockChunkedEncodingLongChunkSizeLine(MockChunkedEncodingResponse): ++ def _encode_chunk(self, chunk: bytes) -> bytes: ++ # A chunk-size line far longer than _MAX_CHUNK_LINE_LENGTH with no ++ # newline, simulating a malicious server that never terminates the ++ # size line (memory-exhaustion attack). ++ return b"f" * (2**16 + 1024) ++ ++ + class MockChunkedEncodingWithoutCRLFOnEnd(MockChunkedEncodingResponse): + def _encode_chunk(self, chunk: bytes) -> bytes: + return "{:X}\r\n{}{}".format( +diff --git a/test/with_dummyserver/test_socketlevel.py b/test/with_dummyserver/test_socketlevel.py +index 016484d..d603b8a 100644 +--- a/test/with_dummyserver/test_socketlevel.py ++++ b/test/with_dummyserver/test_socketlevel.py +@@ -2289,6 +2289,40 @@ class TestStream(SocketDummyServerTestCase): + + done_event.set() + ++ def test_chunked_size_line_too_long_does_not_buffer(self) -> None: ++ # A malicious server can advertise chunked encoding and then send an ++ # unterminated chunk-size line (no newline). The streaming path must ++ # reject it with a bounded read instead of buffering the whole run, ++ # which would exhaust memory. ++ done_event = Event() ++ # Well above the 65536-byte cap, but small enough for a fast test. ++ run_length = 512 * 1024 ++ ++ def socket_handler(listener: socket.socket) -> None: ++ sock = listener.accept()[0] ++ ++ buf = b"" ++ while not buf.endswith(b"\r\n\r\n"): ++ buf += sock.recv(65536) ++ ++ sock.sendall(b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n") ++ # A chunk-size line that never terminates with a newline. ++ with contextlib.suppress(OSError): ++ sock.sendall(b"f" * run_length) ++ ++ done_event.wait(5) ++ sock.close() ++ ++ self._start_server(socket_handler) ++ ++ with HTTPConnectionPool(self.host, self.port, retries=False) as pool: ++ r = pool.request("GET", "/", timeout=LONG_TIMEOUT, preload_content=False) ++ with pytest.raises(ProtocolError) as ctx: ++ next(r.stream(65536)) ++ assert "chunk size line exceeded maximum allowed length" in str(ctx.value) ++ ++ done_event.set() ++ + def test_large_compressed_stream(self) -> None: + done_event = Event() + expected_total_length = 296085 diff --git a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb index 5976c5c3b44..537a68cdabf 100644 --- a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb +++ b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb @@ -3,9 +3,9 @@ HOMEPAGE = "https://github.com/urllib3/urllib3" LICENSE = "MIT" LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=52d273a3054ced561275d4d15260ecda" -SRC_URI += " \ - file://CVE-2026-44431.patch \ -" +SRC_URI += "file://CVE-2026-44431.patch \ + file://CVE-2026-97689.patch \ + " SRC_URI[sha256sum] = "1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed" inherit pypi python_hatchling From patchwork Tue Oct 20 23:22:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101454 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4773.1792538584210707024 for ; Tue, 20 Oct 2026 16:23:04 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=msUDBHU6; spf=pass (domain: smile.fr, ip: 209.85.221.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-48b001cd92bso65401f8f.2 for ; Tue, 20 Oct 2026 16:23:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538582; x=1793143382; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=po84LSVX1H/5yAOd9XZT3wLXhTUWHWsJznFJ5iJBuG4=; b=msUDBHU6BHIIkKc7opzc+DsMS13DqbSeSnM5VNV3alWcp7a8Rvxc2OQNRu/8fA10c1 csrq4/g6gjor9BI89693J5Bb9K3RbUwk7Z3mYGdfc1TaZj8HxSzYKYv4qEdsloGQ4NEc D0OSjpvcKmxDmryNQ2zSTLIotpXAYL72HgTLm1wKxE8kEwtYaQja9/st7bNy9Qn4NdPX 87HKJ5TjzUq7E7CgcuIJx8FqDHpj4sox8OGWoWKwAhwzWvmj0yuJk5bTvvzrytkitLco d4NOUGnhGpCbyKslNoMqcFY8bJg7ckDcuEPatZ8Hsc/Fo+b//AvS5wpF/afCAw2JFWci py2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538582; x=1793143382; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=po84LSVX1H/5yAOd9XZT3wLXhTUWHWsJznFJ5iJBuG4=; b=zyBrt+/JrMaXiqRvE7IdnlCC8kK/3zsYBK5J2esAHHmK0Btng/UX7YeS9oG23aDUyL mxCqthGJ01Sqwtz5hLRjW0kQfPmrDilzsWyyk/guOAzNlVRglmLmB1dUpUGgTS+KRwES /Zmyan37ZXJxfDx/QN9bVwCfo5oGidh/1j5Onu5XGy0FI578SpEiSJrxHw/sLupjRsdr cRgquoR7uD8/tyG9xV92CM8JIunPs4L20H222PTJUGkRVyoxTrStZHYLvM7KvToxHKqU PSO/L4+4mUxFC82dQ/9Kx1/KoyNhRjN3jHllOetClabOMWhC4bBZ1Et/Iqdl9UdWOJJu AMiQ== X-Gm-Message-State: AFq9FYJ8te8Bj4uynJn+yRvau5nPaHwoX5idksqrMdDZmXFUxAXa6IKo t0kQrEwnYQZ0sClIFr7eb9YRei46o8PR7zXxmQAUYmbbHqJJeTvEG4EZF48hEj4KEdwJX6AQEQG GnjggiMg= X-Gm-Gg: AYBFou0KmlUP7Hz9gxDRGk3UeGxiE+pFN81MpkO7R0SdjqN0zTRTCpEJgKWT5sJcu2r N77MCHPU0a6EvCbUUXM9/gaXTH2bzD33jhve/uuM7Od+pdHJ/DjLa6jH3fANiCgWRmCkBZunPld Zxd2ZAVs2qUfXXJGlNmfOMJlcdAbPxe+BZhlj35+ESAYUbnnE2wpcJDu7opGzUIIpYaCMjHgntz ERX+ahbpbwnaJVSXzriAWECvRI1SYEDWvP5O3M1Lxi4OhNf4odyYKvaMxlKIghwxWUHgrKWZ/Wo r7uBzFzBeyoZiEeIQQkizjWuLwCFx/o6abFIegxSMvuplhFlChULISx4FD4VCbncam7xiJbwx1t oo7B8ykfGKHiVW8k3ikdJcpiH+8h/AQwSzS/9IdtWWv4fuLvag6B0m0cL/1SINeHoCo8Sq/nxpH b1ev2EOIpAXmdCqOvbczg9jl2BYLnZtv1Q1ZCqvi0Uba8/kXShP+8+2KbIgGCmdQH5qNafzPm2S olGxgAaICPB5ZNiyT0xAXvIhmWoCyoqPX64RVO7cS05cvJkUhnPB1dv0r/5Fsb5AbVc26SCwQ== X-Received: by 2002:a05:6000:2287:b0:48c:7f18:c85e with SMTP id ffacd0b85a97d-48e264ddf2emr348567f8f.45.1792538582210; Tue, 20 Oct 2026 16:23:02 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.23.01 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:23:01 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 19/25] xz: upgrade 5.8.2 -> 5.8.4 Date: Wed, 21 Oct 2026 01:22:29 +0200 Message-ID: <5133a3664fe4fe624b484509eea52b6cc1fdb2cc.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248338 From: Daniel Turull Security fixes in 5.8.3-5.8.4: - CVE-2026-34743: buffer overflow in lzma_index_append() when appending records to an lzma_index decoded from an Index with no Records - GHSA-5qpq-xqfv-j9pg: invalid memory access in the alone/lzip/auto/ microlzma decoders when reinitializing after a failed allocation - xz: use-after-free showing an error message for --files/--files0 from XZ_OPT/XZ_DEFAULTS, and another use-after-free with --verbose when stderr isn't a terminal The carried backport of the CVE-2026-34743 fix is dropped: it is included in 5.8.3 and applying it again duplicated the check in lzma_index_prealloc(). Other fixes: lzma_index_cat() performance/overflow, lzma_memused() misreporting, lzma_index_dup() check-type copying, threaded decoder progress sync, Landlock ABI 9 support. Signed-off-by: Daniel Turull Signed-off-by: Yoann Congal --- ...buffer-overflow-in-lzma_index_append.patch | 66 ------------------- .../xz/{xz_5.8.2.bb => xz_5.8.4.bb} | 3 +- 2 files changed, 1 insertion(+), 68 deletions(-) delete mode 100644 meta/recipes-extended/xz/xz/0001-liblzma-Fix-a-buffer-overflow-in-lzma_index_append.patch rename meta/recipes-extended/xz/{xz_5.8.2.bb => xz_5.8.4.bb} (95%) diff --git a/meta/recipes-extended/xz/xz/0001-liblzma-Fix-a-buffer-overflow-in-lzma_index_append.patch b/meta/recipes-extended/xz/xz/0001-liblzma-Fix-a-buffer-overflow-in-lzma_index_append.patch deleted file mode 100644 index d3918233eab..00000000000 --- a/meta/recipes-extended/xz/xz/0001-liblzma-Fix-a-buffer-overflow-in-lzma_index_append.patch +++ /dev/null @@ -1,66 +0,0 @@ -From c8c22869e780ff57c96b46939c3d79ff99395f87 Mon Sep 17 00:00:00 2001 -From: Lasse Collin -Date: Sun, 29 Mar 2026 19:11:21 +0300 -Subject: [PATCH] liblzma: Fix a buffer overflow in lzma_index_append() - -If lzma_index_decoder() was used to decode an Index that contained no -Records, the resulting lzma_index had an invalid internal "prealloc" -value. If lzma_index_append() was called on this lzma_index, too -little memory would be allocated and a buffer overflow would occur. - -While this combination of the API functions is meant to work, in the -real-world apps this call sequence is rare or might not exist at all. - -This bug is older than xz 5.0.0, so all stable releases are affected. - -Reported-by: GitHub user christos-spearbit - -CVE: CVE-2026-34743 -Upstream-Status: Backport [https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87] -Signed-off-by: Ross Burton ---- - src/liblzma/common/index.c | 21 +++++++++++++++++++++ - 1 file changed, 21 insertions(+) - -diff --git a/src/liblzma/common/index.c b/src/liblzma/common/index.c -index 6add6a68..c4aadb9b 100644 ---- a/src/liblzma/common/index.c -+++ b/src/liblzma/common/index.c -@@ -433,6 +433,26 @@ lzma_index_prealloc(lzma_index *i, lzma_vli records) - if (records > PREALLOC_MAX) - records = PREALLOC_MAX; - -+ // If index_decoder.c calls us with records == 0, it's decoding -+ // an Index that has no Records. In that case the decoder won't call -+ // lzma_index_append() at all, and i->prealloc isn't used during -+ // the Index decoding either. -+ // -+ // Normally the first lzma_index_append() call from the Index decoder -+ // would reset i->prealloc to INDEX_GROUP_SIZE. With no Records, -+ // lzma_index_append() isn't called and the resetting of prealloc -+ // won't occur either. Thus, if records == 0, use the default value -+ // INDEX_GROUP_SIZE instead. -+ // -+ // NOTE: lzma_index_append() assumes i->prealloc > 0. liblzma <= 5.8.2 -+ // didn't have this check and could set i->prealloc = 0, which would -+ // result in a buffer overflow if the application called -+ // lzma_index_append() after decoding an empty Index. Appending -+ // Records after decoding an Index is a rare thing to do, but -+ // it is supposed to work. -+ if (records == 0) -+ records = INDEX_GROUP_SIZE; -+ - i->prealloc = (size_t)(records); - return; - } -@@ -685,6 +705,7 @@ lzma_index_append(lzma_index *i, const lzma_allocator *allocator, - ++g->last; - } else { - // We need to allocate a new group. -+ assert(i->prealloc > 0); - g = lzma_alloc(sizeof(index_group) - + i->prealloc * sizeof(index_record), - allocator); --- -2.43.0 - diff --git a/meta/recipes-extended/xz/xz_5.8.2.bb b/meta/recipes-extended/xz/xz_5.8.4.bb similarity index 95% rename from meta/recipes-extended/xz/xz_5.8.2.bb rename to meta/recipes-extended/xz/xz_5.8.4.bb index 5e7ad1fc704..1c0e972c391 100644 --- a/meta/recipes-extended/xz/xz_5.8.2.bb +++ b/meta/recipes-extended/xz/xz_5.8.4.bb @@ -26,10 +26,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d38d562f6112174de93a9677682231b2 \ " SRC_URI = "https://github.com/tukaani-project/xz/releases/download/v${PV}/xz-${PV}.tar.gz \ - file://0001-liblzma-Fix-a-buffer-overflow-in-lzma_index_append.patch \ file://run-ptest \ " -SRC_URI[sha256sum] = "ce09c50a5962786b83e5da389c90dd2c15ecd0980a258dd01f70f9e7ce58a8f1" +SRC_URI[sha256sum] = "0014c7886930454fe8bd4228665b51af55eeae560ea135c9c4cd33f55b2591d9" UPSTREAM_CHECK_REGEX = "releases/tag/v(?P\d+(\.\d+)+)" UPSTREAM_CHECK_URI = "https://github.com/tukaani-project/xz/releases/" From patchwork Tue Oct 20 23:22:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101449 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4775.1792538584582374464 for ; Tue, 20 Oct 2026 16:23:04 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=o9H++uo7; spf=pass (domain: smile.fr, ip: 209.85.128.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-4a1f403aca0so541515e9.3 for ; Tue, 20 Oct 2026 16:23:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538583; x=1793143383; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Z5jEMQK+Go6xTd95e095Vcm2M64nczJwJYaTtXMec60=; b=o9H++uo7/gL8EpQGKDq1cWgK4v5AJOIxmrxbCXsZrZyIQr7Jgv4yPDuHbkBUIeJvZV 7KiNQxkB62S7b/J9TJTsKzkYLIo3AJiFP0Hh29czuPyHinOVsyo/kLJK7bXc58KfZo4V U3lDtTbpXfNH64FdK/37JQdO/E/8aEHUfW5XBPCULp46Fskn5Eb0/mv6pGKxMsMXu8fw xA1CbuqOtA3lZ5pV4O6K841wAT4Kv89eEzvKhMxHlpXbj8TZCGiZa7BBTMD94REEefib vYp9taYn5nQiPjuQB6psdAaoJzftLoKm/RUWvu7D6m9/2Do6X6nLFMwOSxev7i9wCgg3 RRww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538583; x=1793143383; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Z5jEMQK+Go6xTd95e095Vcm2M64nczJwJYaTtXMec60=; b=vN1YVjc0lGL2YUrJvgACAI6uXt8Mpkn03An+1GnKHZQDQpe6DP94nek2j0+rhBvwhC EKXjU4b6MNwu0Qb/NF9fm+R5tOparFx8OaaV23P8qKdyCTKehyQ5U6yLHqEp3e5SzqU6 VBjXNzYJejZVvWuq6r255B5ICYQtJW89na8k9PDj0nGq+r48mKvCdW0jhLvtN+WT+7K7 xBlyDYwMk4ube2BHhXjnWGHvvRNuHjnLyN4GbMx4LfRrXsQ40OHHT7eh371hd4A6d01O 6QmsbQqmE5KS/PT+POsw3YeA11+6qnUYmB1iGZbHkWT5RRIs6Bzrv4cipox4P15UHC7u 6m5w== X-Gm-Message-State: AFq9FYKNcKwMA8u0fxKZ32hAQELlavpa1eptvh6CHgm9tlO3GVVb+VgL 6vPruGzB+QeVhAcmYCS6Q2Wh2DGjh7Ejii+xsGpJ/XS7vEjJQaO0fhlrY3aXolhCqGeLd8Ek5JL wWMHiSaU= X-Gm-Gg: AYBFou07a5rffAQj1HAN3XRnR0JX7A6yFA7VoBceAio8nOT2MSVU4IY/mZ7r35sAY9M jyIvugKDxdK2TWeFh0XCE64/ZQNdJYmNuEUm3cXdGkcA0QzjHnwIMuvcNW6p+ulcaM1GSo7tz4D qmCu6yfE0KUWYs3BDJi8VeBH1gRB6hexA5et5wrEV9C/2wiU0jyc5Kf7+X2EsXCv68UgNgCEINS RE7oENDjRlPMJ0d4vKG5rqRz7RJ22fNouikOUmKEeriZzh4/bompBs0AUc0vwt3IMaz2GaGe+mR 4Hd6p5XytAVldFu0r02BdAX4CE0NUdJ/kjhxpzJAcm7NfYhDMmjOB3cp7otKF65kBToZ9nVXbmm qjFmxjOCTqYh+zRQ/sySImOjLM0huNHLI0IFvNhPg+KxDYDboZvTqZqz3wApRfmqZBZuTAqXX93 FfUhpb1+nRSWtR+6r9hyXGib40ZvVEe8RFq51Raz+QR4XgaT+JJJV1/ftAurn4olTcyDCa3Ssp7 WQTdcNkyjBcius3JAhd1UGkN+Fvx7X8zlxYYho5R45hIFju8xj+PA2bQ/dMl2dtsbfQoRbhKlg8 p9A/9NRtB4RkIttsjjg8pe0WjhtXLC3c2jucQ120zMC2wRxGvyi6TUY= X-Received: by 2002:a05:600c:b90:b0:4a1:d307:b526 with SMTP id 5b1f17b1804b1-4a1fd72a9ffmr4878065e9.0.1792538582693; Tue, 20 Oct 2026 16:23:02 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.23.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:23:02 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 20/25] lttng-modules: upgrade 2.14.4 -> 2.14.7 Date: Wed, 21 Oct 2026 01:22:30 +0200 Message-ID: <9b79cdc74091de846317f26b98d3abb3227f9a5f.1792537664.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248339 From: Daniel Turull Changes 2.14.5-2.14.7 (from ChangeLog): - fix: adjust range in btrfs probe for v6.18.14 - fix: ASoC: soc-dapm: move struct snd_soc_dapm_context (v7.0) - Fix: kallsyms on powerpc64 with ABI V1 - fix: hrtimer: Reduce trace noise in hrtimer_start() (v7.1, v6.1.175, Ubuntu-6.8.0-136) - fix: ext4/vfs/btrfs/mm tracepoint updates for newer kernels - fix: leaked file and fd on channel create error - fix: warning -Wordered-compare-function-pointers / -Wcast-function-type-strict with LLVM - Fix: ring buffer: zeroed UUID in populated empty packet headers Two carried patches backport the hrtimer and btrfs fixes above (b77f94c7a7, de7ca66c797), now redundant since both are in 2.14.7 natively; drop them. Only the OE-specific Kbuild CONFIG_TRACEPOINTS-to-warning patch is kept. Verified do_compile succeeds. AI-Generated: Uses Kiro with Claude Sonnet 5 Signed-off-by: Daniel Turull Signed-off-by: Yoann Congal --- ...st-range-in-btrfs-probe-for-v6.18.14.patch | 36 ------ ...ce-trace-noise-in-hrtimer_start-v7.1.patch | 103 ------------------ ...ules_2.14.4.bb => lttng-modules_2.14.7.bb} | 4 +- 3 files changed, 1 insertion(+), 142 deletions(-) delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0001-fix-adjust-range-in-btrfs-probe-for-v6.18.14.patch delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0001-fix-hrtimer-Reduce-trace-noise-in-hrtimer_start-v7.1.patch rename meta/recipes-kernel/lttng/{lttng-modules_2.14.4.bb => lttng-modules_2.14.7.bb} (87%) diff --git a/meta/recipes-kernel/lttng/lttng-modules/0001-fix-adjust-range-in-btrfs-probe-for-v6.18.14.patch b/meta/recipes-kernel/lttng/lttng-modules/0001-fix-adjust-range-in-btrfs-probe-for-v6.18.14.patch deleted file mode 100644 index 662a8036802..00000000000 --- a/meta/recipes-kernel/lttng/lttng-modules/0001-fix-adjust-range-in-btrfs-probe-for-v6.18.14.patch +++ /dev/null @@ -1,36 +0,0 @@ -From de7ca66c797ba0b3273a217a47c8fb791d896f7c Mon Sep 17 00:00:00 2001 -From: Michael Jeanson -Date: Fri, 27 Feb 2026 17:54:39 -0500 -Subject: [PATCH] fix: adjust range in btrfs probe for v6.18.14 - -Upstream commit c5667f9c8eb9 ("btrfs: headers cleanup to remove -unnecessary local includes") was backported in v6.18.14, adjust the -range accordingly in the btrfs probe. - -Upstream-Status: Backport from commit ca93dc3b05fcb - -Change-Id: I51c5cb6345c6a1e1aa4e5e3cb9a4af2ec962ecb2 -Signed-off-by: Michael Jeanson -Signed-off-by: Mathieu Desnoyers -Signed-off-by: Xiangyu Chen ---- - include/instrumentation/events/btrfs.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/include/instrumentation/events/btrfs.h b/include/instrumentation/events/btrfs.h -index feb4f40b..e87f0085 100644 ---- a/include/instrumentation/events/btrfs.h -+++ b/include/instrumentation/events/btrfs.h -@@ -12,7 +12,8 @@ - #include - #include - --#if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(6,19,0)) -+#if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(6,19,0) || \ -+ LTTNG_KERNEL_RANGE(6,18,14, 6,19,0)) - #include <../fs/btrfs/ordered-data.h> - #endif - --- -2.47.3 - diff --git a/meta/recipes-kernel/lttng/lttng-modules/0001-fix-hrtimer-Reduce-trace-noise-in-hrtimer_start-v7.1.patch b/meta/recipes-kernel/lttng/lttng-modules/0001-fix-hrtimer-Reduce-trace-noise-in-hrtimer_start-v7.1.patch deleted file mode 100644 index a6fe47737ec..00000000000 --- a/meta/recipes-kernel/lttng/lttng-modules/0001-fix-hrtimer-Reduce-trace-noise-in-hrtimer_start-v7.1.patch +++ /dev/null @@ -1,103 +0,0 @@ -From b77f94c7a7109e70a97bf936b72d66d611187d61 Mon Sep 17 00:00:00 2001 -From: Michael Jeanson -Date: Mon, 25 May 2026 10:38:18 -0400 -Subject: [PATCH] fix: hrtimer: Reduce trace noise in hrtimer_start() (v7.1) - -See upstream commit: - - commit f2e388a019e4cf83a15883a3d1f1384298e9a6aa - Author: Thomas Gleixner - Date: Tue Feb 24 17:36:59 2026 +0100 - - hrtimer: Reduce trace noise in hrtimer_start() - - hrtimer_start() when invoked with an already armed timer traces like: - - -.. [032] d.h2. 5.002263: hrtimer_cancel: hrtimer= .... - -.. [032] d.h1. 5.002263: hrtimer_start: hrtimer= .... - - Which is incorrect as the timer doesn't get canceled. Just the expiry time - changes. The internal dequeue operation which is required for that is not - really interesting for trace analysis. But it makes it tedious to keep real - cancellations and the above case apart. - - Remove the cancel tracing in hrtimer_start() and add a 'was_armed' - indicator to the hrtimer start tracepoint, which clearly indicates what the - state of the hrtimer is when hrtimer_start() is invoked: - - -.. [032] d.h1. 6.200103: hrtimer_start: hrtimer= .... was_armed=0 - -.. [032] d.h1. 6.200558: hrtimer_start: hrtimer= .... was_armed=1 - -Change-Id: I37ee0ae0af665a51fd4f92adffb6b1dcb2ecd9d2 -Signed-off-by: Michael Jeanson -Signed-off-by: Mathieu Desnoyers -Upstream-Status: Backport [https://github.com/lttng/lttng-modules/commit/b77f94c7a7109e70a97bf936b72d66d611187d61] -Signed-off-by: He Zhe ---- - include/instrumentation/events/timer.h | 39 ++++++++++++++++++++++++-- - 1 file changed, 37 insertions(+), 2 deletions(-) - -diff --git a/include/instrumentation/events/timer.h b/include/instrumentation/events/timer.h -index f69e069b..dfc295e0 100644 ---- a/include/instrumentation/events/timer.h -+++ b/include/instrumentation/events/timer.h -@@ -220,12 +220,43 @@ LTTNG_TRACEPOINT_EVENT_MAP(hrtimer_init, - ) - ) - -+#if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(7,1,0) || \ -+ LTTNG_KERNEL_RANGE(7,0,10, 7,1,0) || \ -+ LTTNG_KERNEL_RANGE(6,18,33, 6,19,0) || \ -+ LTTNG_KERNEL_RANGE(6,12,91, 6,13,0) || \ -+ LTTNG_KERNEL_RANGE(6,6,141, 6,7,0)) - /** - * hrtimer_start - called when the hrtimer is started -- * @timer: pointer to struct hrtimer -+ * @hrtimer: pointer to struct hrtimer -+ * @mode: the hrtimers mode -+ * @was_armed: Was armed when hrtimer_start*() was invoked - */ --#if (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(4,16,0) || \ -+LTTNG_TRACEPOINT_EVENT_MAP(hrtimer_start, -+ -+ timer_hrtimer_start, -+ -+ TP_PROTO(struct hrtimer *hrtimer, enum hrtimer_mode mode, bool was_armed), -+ -+ TP_ARGS(hrtimer, mode, was_armed), -+ -+ TP_FIELDS( -+ ctf_integer_hex(void *, hrtimer, hrtimer) -+ ctf_integer_hex(void *, function, hrtimer->function) -+ ctf_integer(s64, expires, -+ lttng_ktime_get_tv64(hrtimer_get_expires(hrtimer))) -+ ctf_integer(s64, softexpires, -+ lttng_ktime_get_tv64(hrtimer_get_softexpires(hrtimer))) -+ ctf_enum(hrtimer_mode, unsigned int, mode, mode) -+ ctf_integer(bool, was_armed, was_armed) -+ ) -+) -+#elif (LTTNG_LINUX_VERSION_CODE >= LTTNG_KERNEL_VERSION(4,16,0) || \ - LTTNG_RT_KERNEL_RANGE(4,14,0,0, 4,15,0,0)) -+/** -+ * hrtimer_start - called when the hrtimer is started -+ * @hrtimer: pointer to struct hrtimer -+ * @mode: the hrtimers mode -+ */ - LTTNG_TRACEPOINT_EVENT_MAP(hrtimer_start, - - timer_hrtimer_start, -@@ -245,6 +276,10 @@ LTTNG_TRACEPOINT_EVENT_MAP(hrtimer_start, - ) - ) - #else -+/** -+ * hrtimer_start - called when the hrtimer is started -+ * @hrtimer: pointer to struct hrtimer -+ */ - LTTNG_TRACEPOINT_EVENT_MAP(hrtimer_start, - - timer_hrtimer_start, --- -2.34.1 - diff --git a/meta/recipes-kernel/lttng/lttng-modules_2.14.4.bb b/meta/recipes-kernel/lttng/lttng-modules_2.14.7.bb similarity index 87% rename from meta/recipes-kernel/lttng/lttng-modules_2.14.4.bb rename to meta/recipes-kernel/lttng/lttng-modules_2.14.7.bb index d0983f58cbe..8a6ab93dc1a 100644 --- a/meta/recipes-kernel/lttng/lttng-modules_2.14.4.bb +++ b/meta/recipes-kernel/lttng/lttng-modules_2.14.7.bb @@ -20,10 +20,8 @@ SRC_URI = "https://lttng.org/files/${BPN}/${BPN}-${PV}.tar.bz2 \ # Use :append here so that the patch is applied also when using devupstream SRC_URI:append = " file://0001-src-Kbuild-change-missing-CONFIG_TRACEPOINTS-to-warn.patch \ - file://0001-fix-adjust-range-in-btrfs-probe-for-v6.18.14.patch \ - file://0001-fix-hrtimer-Reduce-trace-noise-in-hrtimer_start-v7.1.patch \ " -SRC_URI[sha256sum] = "63deefbc15d9ce7c43d858187533367b01dcb6e8469d6b69ccb757d6d3dbb0ad" +SRC_URI[sha256sum] = "fe304c31ad3e8f68a48f52b538ed2c1bf9b9fe62d8ee528ebc96d0a321287145" export INSTALL_MOD_DIR = "kernel/lttng-modules" From patchwork Tue Oct 20 23:22:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101450 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f54.google.com (mail-wr1-f54.google.com [209.85.221.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4776.1792538585301204138 for ; Tue, 20 Oct 2026 16:23:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=hSM6O8xr; spf=pass (domain: smile.fr, ip: 209.85.221.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f54.google.com with SMTP id ffacd0b85a97d-48e0d1c095dso53582f8f.1 for ; Tue, 20 Oct 2026 16:23:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538583; x=1793143383; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=2KZviL7KAvme2gCNPRYYnnvEFRsCDDXKVB1JQ2yL90Y=; b=hSM6O8xrPkDgFQcO9yAjkVbSsPX/tq+hCHdyn4Bds1/rd61WVz/jqIe5BlcbFBxqXo 0MG1Gq1355c1qgOjUeWBlvzEgv1opXV/6+5rhPNjse3YKTpm9uGiPz2h73XHBM6Rtjiv kUCXcVEojkizT4Y7v3zIpYRizGWrvrVWIeTsbo41dpcuGTV4wc4zq1Q46ngmV58AJpLj sZySgjzzXWcWtKrpo2Y2qzXyCvIDtarRAOczVWUWPX8a0Cb+BW6oIUFblVi3yLbrFmRN oDWXG+R1DltGam+gqZWhf1wkodEMwTojZBOwWIakfJQmlVJp5tTGqqcyceIRWxT2cZh0 MbAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538583; x=1793143383; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=2KZviL7KAvme2gCNPRYYnnvEFRsCDDXKVB1JQ2yL90Y=; b=AnAYygkcvT79oAW9NUZgLC30EUvdCmomu0SEhaSUtr2R63mODD4DdbdMgREIPRcNKJ /LEfgcexmbnIVwx/bAfmDtZitLhCaPnY5D/fDonoaC2jFPdGlkEzkfz4+ywfGaVCZ2fv 3WdwIhyD3FLaC47L3ta3d2xYmYsxFlsSzNKBNp8g4d6RZLI14MzHXdyWoflqJjOizkRA uqOXdOF1et6B1goUNy1uqqYLmgQN72AgZNpuwCwRl0gQSs9Ux4duo6F/sxWvo+1GEfMh ycxKBDczuIAM6gAQp/le3AnP639jJfK3S9TnRE+y6R13cPGGMXa1C5vgAWnRLvb4L7y4 Q3/Q== X-Gm-Message-State: AFq9FYKijC7gXNaB/Z71TVf90VSXkEZR3Mg8bmMTzlJIHq+q7U6Cmg91 ylz+x9/4fDcZHYsW258ZemQHZGZ1Y7cZodXD+yZqiBGRRv9KMlecC5zMA5HzKtrc3ucqnwpWLwl wmRGoIrI= X-Gm-Gg: AYBFou3pf1HJIkVG4s7EwyL7emOb9cI0q0dmcUqWmbd0+0iY6mRpbjdAdmhnRX7wjrg 60JCfU47e3w148M/EHJ4+HcOkpo2licd5iQLo2ElpvfscbzgZAnAd+TBLuDCGejr0SCP1Hav7Ct r3jRFpHLJYnT5BRWKF7FLKCG1kT7E53z5qStfzdXkyprxw7xq57N5C5HvkSBZPgngVnZbgfEqli gzY7/oFEsqkl1Bp9CVsSoPqg1koSs69yTdmHvUpf2nWdb0d9X+Ag1jw9qO02Fv78/heVMjfceSI HJv6ORVoIOzkXdRP5ql8RLoFnPJ9mYpFK7Z6z9WSjrHIyRba/yKFAOYy91BxIF7ppj4rPWtZis0 pf1Hxd530calPjksk5rcMVqeR0OW+AZKUyoP1vY2VjfwLLctgftFQhyPtrm7tGBDi8hGlUjVE1k 5nSa7rBtvdF76jK1fQyUKbl5XbraDm/6b9FI1eQl/utfDr9M4HmPmSNjBT6jDAensaQWKbh423C 8u+fK4nzUXCYGXrXztsonPGeh+QFnV1e6e8vT+DxGgLrTNWxPrnRcq+846rqWpQ16C/iXBluw== X-Received: by 2002:a05:6000:186f:b0:48d:f9dd:e3b9 with SMTP id ffacd0b85a97d-48e264a2d31mr445878f8f.17.1792538583405; Tue, 20 Oct 2026 16:23:03 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.23.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:23:02 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 21/25] lttng-tools: upgrade 2.14.1 -> 2.14.3 Date: Wed, 21 Oct 2026 01:22:31 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248340 From: Daniel Turull Changes 2.14.2-2.14.3 (from ChangeLog): - Fix: ust-consumerd/relayd crashes and overflow/path-traversal hardening in packet, filter, trigger, action, and session-path handling - Fix: sessiond deadlock on notification overflow, default kernel probe list, agent event-listing sanitization - Fix: common lockfile fd leak into consumerd via fork+exec - tests: add notification/test_rotation to the regression test list disable-tests.patch drops the flaky tools/notification/* tests from SERIAL_TESTS (bug 14263); extend it to also drop the new test_rotation entry added above, which conflicted with the patch. Verified do_compile succeeds. AI-Generated: Uses Kiro with Claude Sonnet 5 Signed-off-by: Daniel Turull Signed-off-by: Yoann Congal --- .../lttng/lttng-tools/disable-tests.patch | 11 ++++++----- .../{lttng-tools_2.14.1.bb => lttng-tools_2.14.3.bb} | 2 +- 2 files changed, 7 insertions(+), 6 deletions(-) rename meta/recipes-kernel/lttng/{lttng-tools_2.14.1.bb => lttng-tools_2.14.3.bb} (99%) diff --git a/meta/recipes-kernel/lttng/lttng-tools/disable-tests.patch b/meta/recipes-kernel/lttng/lttng-tools/disable-tests.patch index d32cf875356..5717fb6b3d4 100644 --- a/meta/recipes-kernel/lttng/lttng-tools/disable-tests.patch +++ b/meta/recipes-kernel/lttng/lttng-tools/disable-tests.patch @@ -1,4 +1,4 @@ -From 05cf8ed6cc42a2f6ff53009d0ae2713fe63f1245 Mon Sep 17 00:00:00 2001 +From 755c3e21b7f736f2f19727482bab3100849f7f90 Mon Sep 17 00:00:00 2001 From: Richard Purdie Date: Tue, 14 Dec 2021 12:34:04 +0000 Subject: [PATCH] lttng-tools: Disable problem tests @@ -14,14 +14,14 @@ https://bugzilla.yoctoproject.org/show_bug.cgi?id=14263 Signed-off-by: Richard Purdie --- - tests/regression/Makefile.am | 12 ------------ - 1 file changed, 12 deletions(-) + tests/regression/Makefile.am | 13 ------------- + 1 file changed, 13 deletions(-) diff --git a/tests/regression/Makefile.am b/tests/regression/Makefile.am -index 7076488..e5be904 100644 +index b64a8cc..e92547e 100644 --- a/tests/regression/Makefile.am +++ b/tests/regression/Makefile.am -@@ -40,18 +40,6 @@ SERIAL_TESTS = tools/base-path/test_ust \ +@@ -40,19 +40,6 @@ SERIAL_TESTS = tools/base-path/test_ust \ tools/regen-metadata/test_ust \ tools/regen-statedump/test_kernel \ tools/regen-statedump/test_ust \ @@ -37,6 +37,7 @@ index 7076488..e5be904 100644 - tools/notification/test_notification_notifier_discarded_count \ - tools/notification/test_notification_kernel_userspace_probe \ - tools/notification/test_notification_multi_app \ +- tools/notification/test_rotation \ tools/rotation/test_ust \ tools/rotation/test_kernel \ tools/rotation/test_ust_kernel \ diff --git a/meta/recipes-kernel/lttng/lttng-tools_2.14.1.bb b/meta/recipes-kernel/lttng/lttng-tools_2.14.3.bb similarity index 99% rename from meta/recipes-kernel/lttng/lttng-tools_2.14.1.bb rename to meta/recipes-kernel/lttng/lttng-tools_2.14.3.bb index 3df9ed1c00c..0b0e7aa4ea4 100644 --- a/meta/recipes-kernel/lttng/lttng-tools_2.14.1.bb +++ b/meta/recipes-kernel/lttng/lttng-tools_2.14.3.bb @@ -52,7 +52,7 @@ SRC_URI = "https://lttng.org/files/lttng-tools/lttng-tools-${PV}.tar.bz2 \ file://libc++.patch \ " -SRC_URI[sha256sum] = "0e68eb27923621c4bc127cfce40422d28cf7e473fedf6229ae6c32ba5c5b7c6d" +SRC_URI[sha256sum] = "473ebcf26cae02860ee23e7cbf4ec875586017bd06f32613ba21b6586420e2ed" inherit autotools ptest pkgconfig useradd python3-dir manpages systemd upstream-stable-release-point From patchwork Tue Oct 20 23:22:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101452 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4777.1792538585798795586 for ; Tue, 20 Oct 2026 16:23:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=nwoFn64M; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-4a1df146015so765335e9.0 for ; Tue, 20 Oct 2026 16:23:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538584; x=1793143384; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=1rUBt72Lyahg85E1nZecdNcffpsTWSU9wWe9BcqKoTo=; b=nwoFn64MGQcW0WFBDwyY6hDL20Z6+A+VVcoYv2Nbp8TIqR0xO+jEbJ6qpMGHzn1lYJ 3q5YQIOGcJlAr4pr1GJZ7aynLjBlL/MzH4ma1qUsf0pAx+6YMT+R4/eUoi8Oe3eB/oee 5p+h8h1grvJHzaExofFifhLurEFFcmo0/wxckW6UPxEh0ldMHNovp4by7vllZkrJH9Ds mmO6G26nmAgDubjFbn59NELX7pMx1UCF+O9al0jVvJqEeU4htpLWNUgqjQZTTZYxPFzm W5KPHui7VpftS6pOzszHOgp66CT6gd2goy8oUF1OD4ZncMlF20QSqpZ4A5UJbHFXTU+x 9wzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538584; x=1793143384; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=1rUBt72Lyahg85E1nZecdNcffpsTWSU9wWe9BcqKoTo=; b=IJ1Tpf1oqMoZoubgfJSTx2tE9nMsv16cNvOtwwV5qwZFRFWlpddscoUP0idK82nITJ wOVX9evOudWS1tEL8n2ATBQ7WbvM0BYbriX5FSbW0LJGKpR/p7136tq2iv2JGuIQUpLo 1ZrGjksxV7nhyRARLOv5lWrSyMoGHdm+j181iyVkAggOkA/VeVvqjbCUOtMjgahIcTma XChKR01fwZSILXoI3KAiNJoiCTQKbzV66x7NDiUp7FopNx9/bE/kCnmo6gD5CI3W4Gg7 pF2TIx5aG4LuvOvQh7ThKgzjgsfuWbkmSQy3BvTdoAqF0kL4G5aYXgOWX7UoOUKyUcrX bhqA== X-Gm-Message-State: AFq9FYIdnGnAzNu5pooFCNo0qWaJPRAoWJVyvNcQqeSVEZsL5P0UDvXb H/Eq4TQ9yc5ue9FcRNL9qw45uTLB15qdSr4Pjbt0p9GaGAl5HMMomQA+UeBdQk+lntBrY/WBnxR a27th9ns= X-Gm-Gg: AYBFou2p+s4G0/6EYyZihlBG7hK7oME6ofjZahpLgw/KiVa7i/9yMXf8dUwCGoJXigO QLmKkCKQpC/ZucT7wVWqN+gc99fH3PbXTxysv8+hXfUShjKyQbMgXBr/pscizyH7NSZrOXI+TRi q+L+2zJ4Wbp6Pf1Ad7lQpAhNdrAF/nqYalmFOfEGmqcVQNLkHcRmTEL/cf3UsbeG4OWrz8mvnLs 5h6OH9TOaiekVuV1g9p+4SWOheaZQ0ty+C/Umh9QfkxT1kSGyTFRdIxlzYCo4ur9vhErQqW4cEd PFZxvY/BfnlPYGxyxtF2CNEnce6ztl1U+He8ITfWHebTo0VYfQx/H4ZwqPI91kBQuxuz++oZGq1 32ljVXMw2fBVbmTtPDOv2dAjAQBu2NjlvbEEAOq/nHtZYBUBnqXI0y/Dx2FHv7bcyj33cl8+kae xo0vSPz4Bpzgy6yMKMq7akU9zTscvCHdgbZ40Nf8+rVwTa1kdDd4wX9xLs31Izf3bWMhpIzYt2B Nm3018yQL+E+5sA4BCS9pcPepvSHoXKETfpZQJFYlyGZDhE0j9y6gZRpz7vr/hswsLCM2dw+jbI A086bNXiaNj/xEqcOE3l1U3eerB/OZpfg5ddA8n55kjM+i+xLKgg0LVs X-Received: by 2002:a05:600c:c16e:b0:4a0:25c:8af2 with SMTP id 5b1f17b1804b1-4a1fdd12dbcmr3517535e9.17.1792538584018; Tue, 20 Oct 2026 16:23:04 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.23.03 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:23:03 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 22/25] lttng-ust: upgrade 2.14.0 -> 2.14.3 Date: Wed, 21 Oct 2026 01:22:32 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248341 From: Daniel Turull Changes 2.14.1-2.14.3 (from ChangeLog): - Fix: stream instance id mismatch for populated packets in per-channel ringbuffers - fix: shmp()/message-size/zero_file/sigevent hardening - fix: close_range and fd-tracker memory/efficiency issues - fix: lttng_ust_build_bug_on undefined behavior in C++ builds - fix: ustctl sigbus handling statement with no effect Both carried patches rebased cleanly, no changes needed. Verified do_compile succeeds. AI-Generated: Uses Kiro with Claude Sonnet 5 Signed-off-by: Daniel Turull Signed-off-by: Yoann Congal --- .../lttng/{lttng-ust_2.14.0.bb => lttng-ust_2.14.3.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-kernel/lttng/{lttng-ust_2.14.0.bb => lttng-ust_2.14.3.bb} (96%) diff --git a/meta/recipes-kernel/lttng/lttng-ust_2.14.0.bb b/meta/recipes-kernel/lttng/lttng-ust_2.14.3.bb similarity index 96% rename from meta/recipes-kernel/lttng/lttng-ust_2.14.0.bb rename to meta/recipes-kernel/lttng/lttng-ust_2.14.3.bb index 4285a445d67..b567dea1f6c 100644 --- a/meta/recipes-kernel/lttng/lttng-ust_2.14.0.bb +++ b/meta/recipes-kernel/lttng/lttng-ust_2.14.3.bb @@ -35,7 +35,7 @@ SRC_URI = "https://lttng.org/files/lttng-ust/lttng-ust-${PV}.tar.bz2 \ file://0001-lttng-ust-common-link-with-liburcu-explicitly.patch \ " -SRC_URI[sha256sum] = "82cdfd304bbb2b2b7d17cc951a6756b37a9f73868ec0ba7db448a0d5ca51b763" +SRC_URI[sha256sum] = "3c232b514f33c4248ce23155f64ad272fdaae3323255f69d5e7a5c3d6812b7ea" CVE_PRODUCT = "ust" From patchwork Tue Oct 20 23:22:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101451 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4745.1792538586536163984 for ; Tue, 20 Oct 2026 16:23:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=hgfttr+U; spf=pass (domain: smile.fr, ip: 209.85.128.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-4a1ec92f655so1480185e9.0 for ; Tue, 20 Oct 2026 16:23:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538584; x=1793143384; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=eIemcf4C6ZyXj9F5aG4w1s+yZFVtnpAUrFaUYQU+sjc=; b=hgfttr+U233juantgiJ9uHUHDzGsH0Xj46wAMXBFpP2QPkqYLK0qn9uDn7kAJ3+OXa owk/eR9sbnyE8Mc/dHYFjat1iHN7AGl2SodGVVKsJHvCtmkq6jn17Xim7ZQ58/ziaiai lo9JEycWOlBBez9fKx0CK+bdsHD5HemG6rNPI2rvuxjhfSK4Koy9aUhDJ5yDArHMOOE6 2+aIOb7u/+O3TMKC3nHgo3wnyW9HVdrF5FIwXS/3ZlkUb2osQwAM+c6q9dNbHvzrCfXW BA3tBh73wKXutNTXSEBcbyXKC3i9woj9SKc3INByM6WgPwacAx/rtwRznbtMi8vnVFcy 6yng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538584; x=1793143384; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=eIemcf4C6ZyXj9F5aG4w1s+yZFVtnpAUrFaUYQU+sjc=; b=vBsaY6zqd1FlKtZJ04g0T1u9Rd+b8+7Wrl8GkgXQdjgxhYwk6WA12656jcp5Z3fguQ j1EKnzjt0nGYdBzcBVRQ0MeuapmkOeR226XLR1lU6DA2yBsHGk76WLuB3xVJ5vyR+Iqd WzhkXb4LNsBqPHWZXp7MBiPC2789mhplPD4BkoPvObAI6Q2eCIlS/3R3GUEG4DHb7Jnd 8amchbLgEeQc2A6EITokCH6HrngxfjQURpm2F6BHniaUAKMxE32OFIyEMA9wgLfSE/uq cSLd/SVBIZLAQ7juoFwrEeLtfLSB/QaKVeImD33LEapKIve8dmOevLAv1yoedIigBYe/ pF3A== X-Gm-Message-State: AFq9FYLYLccgenaXR+QFvHo+iYepRx/HJniRVPAeXsd1oQ13Sj6V5OI/ oqasesfl1QoiSkuUFB1MhdmYixEchJQH3VAJqKjwepoVjmqsC1ZRjPSigGvkKt/hO0X4R/EGMaR rV3WOUCs= X-Gm-Gg: AYBFou1BFeFFb6zF4CZITYYZlbxwZJmpJ88J6GTKAprpcLnTpg+YcSf/1ZKvFZuppP6 8QHEVMteHHRW703wpOSWMfMgHz7BjzRXVldddfF93pNWCbIEChNq5+KgtJXB5SUlUGFYK4ogCqQ 6eYc1Ufqs7nuWdjlAhDPNpe32upaGg5yRIxfX0GCokbp2Czxjg9umxHBvWF+RwSd70nx/h4WSvW EFZ2NRCcG+GshXN6/U4EKnhQtopGLS8e0QvEHmuU9veXkPJcAbNjuJtcYMPwKOygnBhgm1Uxtau 71iUOcT2nQLDhsM6I7AHGqmIHd1cLSBq3D2FeeW41p1/i77qmNXwyuW2ECbjznjdXR68qQ1RIcE 6iQv6BDLdffx3vjhWs/XkTYM5MG5i2w8N6L7WzQYFD1Xmm39wdTThm+/5CN/mH1goLpW1V3+e/5 ogzBbkLYuYuR+dCPqkiqzWp9PyYA8ejJNHpTtFkwTA6vpNl3h0zOETIOlfU469kuM5avcwNyVVE dK/BY3Jm+8Mzyo1Ztr4PgBo71/SQv8FxHJbZ3PieaGmivjBr8AWCa8/PImeyBLn53uVbAIBO860 QsCSPNMIPzV9uvRNj9YoPBXNOt33Ny3lZ+hAMoDG44gOwQxaqeqbL/wE5781a17lWqRTG0LoxRm l X-Received: by 2002:a05:600c:255:b0:4a1:e478:7878 with SMTP id 5b1f17b1804b1-4a1fa092b29mr37832375e9.18.1792538584599; Tue, 20 Oct 2026 16:23:04 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.23.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:23:04 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 23/25] libgcrypt: upgrade 1.12.1 -> 1.12.4 Date: Wed, 21 Oct 2026 01:22:33 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248342 From: Daniel Turull Bug fixes in 1.12.2-1.12.4 (per NEWS): - T8208: missing bounds check in Dilithium context handling (CVE-2026-41990) - T8211: possible ECDH buffer overwrite with zeroes (CVE-2026-41989) - T8212: missing point validation in the new KEM interface - RSA PSS/OAEP salt-length and padding validation; s-expression parsing and KDF parameter hardening; various AEAD/MAC overflow and OOB-read fixes Both carried CVE patches backported the Dilithium and ECC fixes above, now redundant and dropped. The pubkey-dilithium.c conflict was caused by two unrelated upstream commits (dilithium glue fix, stronger signature nonce random) touching the same file. Verified do_compile succeeds on qemux86-64 and qemuarm_musl. License-Update: LICENSES gained a BSD-3-Clause notice for the new Intel SM3 AVX2 assembly file (cipher/sm3-intel-avx2-amd64.S). AI-Generated: Uses Kiro with Claude Sonnet 5 Signed-off-by: Daniel Turull Signed-off-by: Yoann Congal --- ...s-Fix-link-errors-for-t-thread-local.patch | 13 +- .../libgcrypt/files/CVE-2026-41989.patch | 42 --- .../libgcrypt/files/CVE-2026-41990.patch | 316 ------------------ ...ibgcrypt_1.12.1.bb => libgcrypt_1.12.4.bb} | 6 +- 4 files changed, 7 insertions(+), 370 deletions(-) delete mode 100644 meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch delete mode 100644 meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch rename meta/recipes-support/libgcrypt/{libgcrypt_1.12.1.bb => libgcrypt_1.12.4.bb} (89%) diff --git a/meta/recipes-support/libgcrypt/files/0001-tests-Fix-link-errors-for-t-thread-local.patch b/meta/recipes-support/libgcrypt/files/0001-tests-Fix-link-errors-for-t-thread-local.patch index 8dc2fe328c1..c4c59dcf870 100644 --- a/meta/recipes-support/libgcrypt/files/0001-tests-Fix-link-errors-for-t-thread-local.patch +++ b/meta/recipes-support/libgcrypt/files/0001-tests-Fix-link-errors-for-t-thread-local.patch @@ -1,4 +1,4 @@ -From 942e232ded48fa08d2bda417ae8ad8c03d644372 Mon Sep 17 00:00:00 2001 +From bf307ed66f9c33502f27c04c60f9e6c99d7dda7a Mon Sep 17 00:00:00 2001 From: Collin Funk Date: Wed, 27 Aug 2025 11:49:06 +0800 Subject: [PATCH] tests: Fix link errors for t-thread-local. @@ -21,18 +21,15 @@ Signed-off-by: Hongxu Jia 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/Makefile.am b/tests/Makefile.am -index 4800135..f0f7adb 100644 +index 3baaf48..cc2fd6b 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am -@@ -98,7 +98,7 @@ testapi_LDADD = $(standard_ldadd) @LDADD_FOR_TESTS_KLUDGE@ +@@ -103,7 +103,7 @@ testapi_LDADD = $(standard_ldadd) @LDADD_FOR_TESTS_KLUDGE@ t_lock_LDADD = $(standard_ldadd) $(GPG_ERROR_MT_LIBS) @LDADD_FOR_TESTS_KLUDGE@ t_lock_CFLAGS = $(GPG_ERROR_MT_CFLAGS) -lpthread t_thread_local_LDADD = $(standard_ldadd) $(GPG_ERROR_MT_LIBS) @LDADD_FOR_TESTS_KLUDGE@ -t_thread_local_CFLAGS = $(GPG_ERROR_MT_CFLAGS) +t_thread_local_CFLAGS = $(GPG_ERROR_MT_CFLAGS) -lpthread testdrv_LDADD = $(LDADD_FOR_TESTS_KLUDGE) - - # Build a version of the test driver for the build platform. --- -2.34.1 - + t_cipher_internal_CPPFLAGS = $(AM_CPPFLAGS) -I$(top_srcdir)/cipher + t_sntrup761_CPPFLAGS = $(AM_CPPFLAGS) -I$(top_srcdir)/cipher diff --git a/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch b/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch deleted file mode 100644 index aba3ca318b4..00000000000 --- a/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch +++ /dev/null @@ -1,42 +0,0 @@ -From d8874dd38f78454dd3a760617ebe8d9aa9270649 Mon Sep 17 00:00:00 2001 -From: NIIBE Yutaka -Date: Fri, 10 Apr 2026 16:58:57 +0900 -Subject: [PATCH] cipher:ecc: Fix decoding a point on Montgomery curve. - -* cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Fix the padding -mistake and add updating RAWMPILEN. - --- - -Reported by Calif.io in collaboration with Claude and Anthropic -Research. - -GnuPG-bug-id: 8211 -Fixes-commit: bbe15758c893dbf546416c1a6bccdad1ab000ad7 -Suggested-by: Bronson Yen -Signed-off-by: NIIBE Yutaka - -CVE: CVE-2026-41989 -Upstream-Status: Backport [https://github.com/gpg/libgcrypt/commit/2d3d732c9bf87cc10729f69678dd9e6862f99fa3] - -Signed-off-by: Leonid Iziumtsev ---- - cipher/ecc-misc.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/cipher/ecc-misc.c b/cipher/ecc-misc.c -index 615b0df2..ab3799dc 100644 ---- a/cipher/ecc-misc.c -+++ b/cipher/ecc-misc.c -@@ -438,7 +438,10 @@ _gcry_ecc_mont_decodepoint (gcry_mpi_t pk, mpi_ec_t ec, mpi_point_t result) - *--p = *buf++; - - if (rawmpilen < nbytes) -- memset (rawmpi + nbytes - rawmpilen, 0, nbytes - rawmpilen); -+ { -+ memset (rawmpi + rawmpilen, 0, nbytes - rawmpilen); -+ rawmpilen = nbytes; -+ } - } - else - { diff --git a/meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch b/meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch deleted file mode 100644 index a4f18092274..00000000000 --- a/meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch +++ /dev/null @@ -1,316 +0,0 @@ -From 024391fc505ebf9c47e51953d7d85995ba179576 Mon Sep 17 00:00:00 2001 -From: NIIBE Yutaka -Date: Mon, 13 Apr 2026 11:51:46 +0900 -Subject: [PATCH] cipher:dilithium: Check the label length by caller. - -* cipher/dilithium.h (dilithium_keypair, dilithium_sign) -(dilithium_verify): Return gpg_err_code_t. -* cipher/dilithium.c (dilithium_keypair): Return gpg_err_code_t. -(dilithium_sign, dilithium_verify): Ditto. Check CTXLEN. -* cipher/pubkey-dilithium.c (mldsa_generate): Follow the change. -(mldsa_sign, mldsa_verify): Likewise. - --- - -Reported by Calif.io in collaboration with Claude and Anthropic -Research. - -GnuPG-bug-id: 8208 -Co-authored-by: Thai Duong -Signed-off-by: NIIBE Yutaka - -CVE: CVE-2026-41990 -Upstream-Status: Backport [https://github.com/gpg/libgcrypt/commit/905e00f046a71e5670517779afaf85a354952832] - -Signed-off-by: Leonid Iziumtsev ---- - cipher/dilithium.c | 101 ++++++++++++++++++++++++++++---------- - cipher/dilithium.h | 20 ++++---- - cipher/pubkey-dilithium.c | 34 +++++-------- - 3 files changed, 99 insertions(+), 56 deletions(-) - -diff --git a/cipher/dilithium.c b/cipher/dilithium.c -index 955feb2a..212c4afe 100644 ---- a/cipher/dilithium.c -+++ b/cipher/dilithium.c -@@ -82,6 +82,7 @@ - #include "gcrypt-int.h" - #include "const-time.h" - -+/* With glue code, we only use the "_internal" API of Dilithium. */ - #define DILITHIUM_INTERNAL_API_ONLY 1 - - #include "dilithium.h" -@@ -120,23 +121,33 @@ static int crypto_sign_verify_internal_5 (const uint8_t *sig, size_t siglen, - const uint8_t *pre, size_t prelen, - const uint8_t *pk); - --int -+gpg_err_code_t - dilithium_keypair (int algo, uint8_t *pk, uint8_t *sk, - const uint8_t seed[SEEDBYTES]) - { -+ int r; -+ - switch (algo) - { - case GCRY_MLDSA44: -- return crypto_sign_keypair_internal_2 (pk, sk, seed); -+ r = crypto_sign_keypair_internal_2 (pk, sk, seed); -+ break; - case GCRY_MLDSA65: - default: -- return crypto_sign_keypair_internal_3 (pk, sk, seed); -+ r = crypto_sign_keypair_internal_3 (pk, sk, seed); -+ break; - case GCRY_MLDSA87: -- return crypto_sign_keypair_internal_5 (pk, sk, seed); -+ r = crypto_sign_keypair_internal_5 (pk, sk, seed); -+ break; - } -+ -+ if (r < 0) -+ return GPG_ERR_INTERNAL; -+ -+ return 0; - } - --int -+gpg_err_code_t - dilithium_sign (int algo, uint8_t *sig, size_t siglen, - const uint8_t *m, size_t mlen, - const uint8_t *ctx, size_t ctxlen, -@@ -145,9 +156,17 @@ dilithium_sign (int algo, uint8_t *sig, size_t siglen, - size_t i; - uint8_t pre[257]; - size_t prelen; -+ int r; - -- if (ctx == NULL && ctxlen == -1) -- prelen = 0; -+ if (ctx == NULL) -+ { -+ if (ctxlen == -1) -+ prelen = 0; -+ else -+ return GPG_ERR_INV_DATA; -+ } -+ else if (ctxlen > 255) -+ return GPG_ERR_INV_DATA; - else - { - /* Prepare pre = (0, ctxlen, ctx) */ -@@ -158,28 +177,44 @@ dilithium_sign (int algo, uint8_t *sig, size_t siglen, - prelen = 2 + ctxlen; - } - -+ /* -+ * Note that the second argument of the upstream routine is the -+ * pointer to output length of signature. It assumes the first -+ * argument (pointer to output signature) should have correct (or -+ * more) length, beforehand. -+ * -+ * Before calling the routine, we should check the length. -+ */ - switch (algo) - { - case GCRY_MLDSA44: - if (siglen != CRYPTO_BYTES_2) -- return -1; -- return crypto_sign_signature_internal_2 (sig, &siglen, m, mlen, -- pre, prelen, rnd, sk); -+ return GPG_ERR_INV_DATA; -+ r = crypto_sign_signature_internal_2 (sig, &siglen, m, mlen, -+ pre, prelen, rnd, sk); -+ break; - case GCRY_MLDSA65: - default: - if (siglen != CRYPTO_BYTES_3) -- return -1; -- return crypto_sign_signature_internal_3 (sig, &siglen, m, mlen, -- pre, prelen, rnd, sk); -+ return GPG_ERR_INV_DATA; -+ r = crypto_sign_signature_internal_3 (sig, &siglen, m, mlen, -+ pre, prelen, rnd, sk); -+ break; - case GCRY_MLDSA87: - if (siglen != CRYPTO_BYTES_5) -- return -1; -- return crypto_sign_signature_internal_5 (sig, &siglen, m, mlen, -- pre, prelen, rnd, sk); -+ return GPG_ERR_INV_DATA; -+ r = crypto_sign_signature_internal_5 (sig, &siglen, m, mlen, -+ pre, prelen, rnd, sk); -+ break; - } -+ -+ if (r < 0) -+ return GPG_ERR_INTERNAL; -+ -+ return 0; - } - --int -+gpg_err_code_t - dilithium_verify (int algo, const uint8_t *sig, size_t siglen, - const uint8_t *m, size_t mlen, - const uint8_t *ctx, size_t ctxlen, -@@ -188,9 +223,17 @@ dilithium_verify (int algo, const uint8_t *sig, size_t siglen, - size_t i; - uint8_t pre[257]; - size_t prelen; -+ int r; - -- if (ctx == NULL && ctxlen == -1) -- prelen = 0; -+ if (ctx == NULL) -+ { -+ if (ctxlen == -1) -+ prelen = 0; -+ else -+ return GPG_ERR_INV_DATA; -+ } -+ else if (ctxlen > 255) -+ return GPG_ERR_INV_DATA; - else - { - /* Prepare pre = (0, ctxlen, ctx) */ -@@ -204,16 +247,24 @@ dilithium_verify (int algo, const uint8_t *sig, size_t siglen, - switch (algo) - { - case GCRY_MLDSA44: -- return crypto_sign_verify_internal_2 (sig, siglen, m, mlen, -- pre, prelen, pk); -+ r = crypto_sign_verify_internal_2 (sig, siglen, m, mlen, -+ pre, prelen, pk); -+ break; - case GCRY_MLDSA65: - default: -- return crypto_sign_verify_internal_3 (sig, siglen, m, mlen, -- pre, prelen, pk); -+ r = crypto_sign_verify_internal_3 (sig, siglen, m, mlen, -+ pre, prelen, pk); -+ break; - case GCRY_MLDSA87: -- return crypto_sign_verify_internal_5 (sig, siglen, m, mlen, -- pre, prelen, pk); -+ r = crypto_sign_verify_internal_5 (sig, siglen, m, mlen, -+ pre, prelen, pk); -+ break; - } -+ -+ if (r < 0) -+ return GPG_ERR_BAD_SIGNATURE; -+ -+ return 0; - } - - typedef struct { -diff --git a/cipher/dilithium.h b/cipher/dilithium.h -index 88a48094..dc18f158 100644 ---- a/cipher/dilithium.h -+++ b/cipher/dilithium.h -@@ -64,16 +64,16 @@ - #define DILITHIUM_SIGN_STACK_BURN (161 * 1024) - #define DILITHIUM_VERIFY_STACK_BURN (122 * 1024) - --int dilithium_keypair (int algo, uint8_t *pk, uint8_t *sk, -- const uint8_t seed[SEEDBYTES]); --int dilithium_sign (int algo, uint8_t *sig, size_t siglen, -- const uint8_t *m, size_t mlen, -- const uint8_t *ctx, size_t ctxlen, -- const uint8_t *sk, const uint8_t rnd[RNDBYTES]); --int dilithium_verify (int algo, const uint8_t *sig, size_t siglen, -- const uint8_t *m, size_t mlen, -- const uint8_t *ctx, size_t ctxlen, -- const uint8_t *pk); -+gpg_err_code_t dilithium_keypair (int algo, uint8_t *pk, uint8_t *sk, -+ const uint8_t seed[SEEDBYTES]); -+gpg_err_code_t dilithium_sign (int algo, uint8_t *sig, size_t siglen, -+ const uint8_t *m, size_t mlen, -+ const uint8_t *ctx, size_t ctxlen, -+ const uint8_t *sk, const uint8_t rnd[RNDBYTES]); -+gpg_err_code_t dilithium_verify (int algo, const uint8_t *sig, size_t siglen, -+ const uint8_t *m, size_t mlen, -+ const uint8_t *ctx, size_t ctxlen, -+ const uint8_t *pk); - #endif - - #if defined(DILITHIUM_MODE) -diff --git a/cipher/pubkey-dilithium.c b/cipher/pubkey-dilithium.c -index 03958bb0..8c3f650e 100644 ---- a/cipher/pubkey-dilithium.c -+++ b/cipher/pubkey-dilithium.c -@@ -170,7 +170,7 @@ mldsa_generate (const gcry_sexp_t genparms, gcry_sexp_t *r_skey) - memcpy (seed, seed_supplied, SEEDBYTES); - } - -- dilithium_keypair (info->algo, pk, sk, seed); -+ rc = dilithium_keypair (info->algo, pk, sk, seed); - _gcry_burn_stack (DILITHIUM_KEYPAIR_STACK_BURN); - - if (!rc) -@@ -206,7 +206,6 @@ mldsa_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms) - size_t data_len; - const unsigned char *sk; - const struct mldsa_info *info = mldsa_get_info (keyparms); -- int r; - - if (!info) - return GPG_ERR_PUBKEY_ALGO; -@@ -258,17 +257,14 @@ mldsa_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms) - else - randombytes (rnd, RNDBYTES); - if (ctx.flags & PUBKEY_FLAG_NO_PREFIX) -- r = dilithium_sign (info->algo, sig, info->sig_len, data, data_len, -- NULL, -1, sk, rnd); -+ rc = dilithium_sign (info->algo, sig, info->sig_len, data, data_len, -+ NULL, -1, sk, rnd); - else -- r = dilithium_sign (info->algo, sig, info->sig_len, data, data_len, -- ctx.label, ctx.labellen, sk, rnd); -+ rc = dilithium_sign (info->algo, sig, info->sig_len, data, data_len, -+ ctx.label, ctx.labellen, sk, rnd); - _gcry_burn_stack (DILITHIUM_SIGN_STACK_BURN); -- if (r < 0) -- { -- rc = GPG_ERR_INTERNAL; -- goto leave; -- } -+ if (rc) -+ goto leave; - - rc = sexp_build (r_sig, NULL, "(sig-val(%s(s%b)))", info->name, - info->sig_len, sig); -@@ -300,7 +296,6 @@ mldsa_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms) - size_t data_len; - const unsigned char *pk; - const struct mldsa_info *info = mldsa_get_info (keyparms); -- int r; - - if (!info) - return GPG_ERR_PUBKEY_ALGO; -@@ -350,17 +345,14 @@ mldsa_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms) - } - - if (ctx.flags & PUBKEY_FLAG_NO_PREFIX) -- r = dilithium_verify (info->algo, sig, info->sig_len, data, data_len, -- NULL, -1, pk); -+ rc = dilithium_verify (info->algo, sig, info->sig_len, data, data_len, -+ NULL, -1, pk); - else -- r = dilithium_verify (info->algo, sig, info->sig_len, data, data_len, -- ctx.label, ctx.labellen, pk); -+ rc = dilithium_verify (info->algo, sig, info->sig_len, data, data_len, -+ ctx.label, ctx.labellen, pk); - _gcry_burn_stack (DILITHIUM_VERIFY_STACK_BURN); -- if (r < 0) -- { -- rc = GPG_ERR_BAD_SIGNATURE; -- goto leave; -- } -+ if (rc) -+ goto leave; - - leave: - _gcry_pk_util_free_encoding_ctx (&ctx); diff --git a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb b/meta/recipes-support/libgcrypt/libgcrypt_1.12.4.bb similarity index 89% rename from meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb rename to meta/recipes-support/libgcrypt/libgcrypt_1.12.4.bb index d7b3e182cd2..4dedcc49ce2 100644 --- a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb +++ b/meta/recipes-support/libgcrypt/libgcrypt_1.12.4.bb @@ -12,7 +12,7 @@ LICENSE:${PN}-dev = "GPL-2.0-or-later & LGPL-2.1-or-later" LIC_FILES_CHKSUM = "file://COPYING;md5=570a9b3749dd0463a1778803b12a6dce \ file://COPYING.LIB;md5=4bf661c1e3793e55c8d1051bc5e0ae21 \ - file://LICENSES;md5=034b4e369944ad4b52a68368f1cf98b8 \ + file://LICENSES;md5=47e346a71a2593d19f741408407fe91f \ " DEPENDS = "libgpg-error" @@ -25,10 +25,8 @@ SRC_URI = "${GNUPG_MIRROR}/libgcrypt/libgcrypt-${PV}.tar.bz2 \ file://no-native-gpg-error.patch \ file://no-bench-slope.patch \ file://run-ptest \ - file://CVE-2026-41989.patch \ - file://CVE-2026-41990.patch \ " -SRC_URI[sha256sum] = "7df5c08d952ba33f9b6bdabdb06a61a78b2cf62d2122c2d1d03a91a79832aa3c" +SRC_URI[sha256sum] = "d77f68f48879510e79a2f65977ccc68981781ea0923e5bdffac2a193ea3d660e" BINCONFIG = "${bindir}/libgcrypt-config" From patchwork Tue Oct 20 23:22:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101453 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f45.google.com (mail-wr1-f45.google.com [209.85.221.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4778.1792538587063530239 for ; Tue, 20 Oct 2026 16:23:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=K0Xh0BqP; spf=pass (domain: smile.fr, ip: 209.85.221.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f45.google.com with SMTP id ffacd0b85a97d-48e0d1c095dso53593f8f.1 for ; Tue, 20 Oct 2026 16:23:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538585; x=1793143385; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=5bsRFljaqME2jGZO7ADAXf0o9FXJMbgbI0vRXj05aOI=; b=K0Xh0BqPjeiUk+gABEGfr2+3NIadMKEDDNwWBVOzyJx36HUDNXV2OjXJCJdcNaCSi1 rQe3RCISDBJbxRs/kpY3aHp04hILDu2ZMLd29fysyZ+ylGZwvWNvY/CEHy6loogayeY6 s5V3WcZmwby+FXV9v2V0JhETHvG9NIAwLQH5vRYU2Wr2dRk7elpTp4OneYJviRsJTI5D 9jQ3VTg2n1T+a8YESKH6bM0YO75UKx591UNW0go/9T1oD2UFMZTCTLbBF+rVt2SzRtZy iEZb2CodAvl5IqhX+ABTEuQlosvDAgt17f3blQpODDbcfXyqqTVNFoGW120LesEBuv9j OPGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538585; x=1793143385; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=5bsRFljaqME2jGZO7ADAXf0o9FXJMbgbI0vRXj05aOI=; b=DkfrlxrzYs7IXRwTUPt56h5lGapiWmyghrUs9FhBls4XJOPWPqba9Z32vEmoiFJmcD zzHnHN01Nte7Je+YNUu9vIqlKCBjVU1cFGJiRPls8u6rpvOexksaM18iR706HK0P5UhX 9BCOJ2fwaAue+s0A0ejU5BAz0XEl4DunLFemAm1u38tM7hxz3f+0vGs5JdUBOa/Iq0E+ E9x3QZXhstR0qKpt3FhknJGy2VEvATS/mzRfnU6GZNMc+zPu3GqHX7al57Nnc7bZVSVY pLpTEE+7xUltVXdrPzB484TG8qPrxSfpXJJ+RIgPsXBYbdXcpA8XiYnT0erphroDDDEw EmGQ== X-Gm-Message-State: AFq9FYJDpPYkQ2G8lhxHuAp5/0OIWlb9ZLzBk/ceA/hEtPKlI0Lsq2ii pyFtifxnaNEr6ajeBfqTkMJ3OfyBXIYTfBpVfS2vl8bJY07zLFV3g81Mdd+HSBs0otKPtREnYbA HDu0dYEc= X-Gm-Gg: AYBFou1v7zFjJfD6HhfXXjMlucSaHACTes3ZXaCeFgXDlcmPhrv3lQZ2eIMdQ8jA5tY FEzy6wmEzpJo59n/AChLcI74nvb0y+Nd/0Y2Qo5UUAgywsGCisU/xU66R+6Yh9Nj913O7TSIgOQ qKoR+IpX+Q//yMEjTahKZ2YFPhF9l9PqcT8p0NgDpTdilpJpIROQmN/zxRmnl3eHNl9OOdXyhPc KKg2ysu6FfRUTas0MFpxrwSCA26PEtpXBb+EX1bBtLPQCOuZct0fIy09+n0729oiCD+lqobDHLh gmJ2SXR2ilPSIqhua4coF/AnTyvWk+e3ty+B1ByzLovqcjaj2ZN5EMYJmmpikHX1/3epcSIH5hF 0epaTEC25QeGLRlPI0qOyYM5w7geg9bqT0jx2G0JzqtFIRiHEO+md3pkACp/b4Njw/laM+CZKeh Uc3fOAULc9PfdLhibI+nPfyzzb8GBZEFVlTSpcLbZHc2ziiQ/AjFm+XvpAshq1UDoAszjGbXFAN 0uA4nACPre5I6dECNtn5yZHLbdO0WGOapKxWuOuPSet3I3QHfN+mT7UiFRmmcWNlnJGykbABg== X-Received: by 2002:a05:6000:29cc:b0:48e:159f:e33a with SMTP id ffacd0b85a97d-48e264ca494mr220935f8f.34.1792538585097; Tue, 20 Oct 2026 16:23:05 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.23.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:23:04 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 24/25] kernel-fit-image: reference the boot script as "script" Date: Wed, 21 Oct 2026 01:22:34 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248343 From: Sergio Prado The boot script added to a fitImage through FIT_UBOOT_ENV is referenced from the configuration nodes with a "bootscr" property. U-Boot does not know that name. It looks the boot script up through the "script" property, defined as FIT_SCRIPT_PROP in include/image.h and used by image_locate_script() in boot/image-board.c. The same name is used in the example image tree source in the documentation of the source command in [1]: configurations { default = "conf-2"; conf-1 { script = "script-1"; }; conf-2 { script = "script-2"; }; }; As a result the boot script cannot be reached through a configuration: source # fails with "Could not find script in " source falls back to the image named by the "default" property of the /images node, which is not generated either, and fails with "No FIT subimage unit name" source : works, as the name of the image node is not affected, but addresses the script directly and therefore cannot tie it to a configuration, which is a problem when one wants to boot exclusively from a signed configuration as part of a verified boot chain. To fix it, rename the property to "script". The entries of "sign-images" are property names of the configuration node, so rename that entry as well to keep the boot script covered by the configuration signature, and update the expected value in the fitimage selftest to match. Verified on an i.MX95 board with U-Boot 2025.04 booting a fitImage built with FIT_UBOOT_ENV. Before the change, 'source #conf-' stopped at "Could not find script in conf-". With the change, the configuration form runs the script and boots. [1] https://docs.u-boot.org/en/latest/usage/cmd/source.html#fit-image Signed-off-by: Sergio Prado Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 6bb0775e6ca56eb50119e9ad618dc5b865252f72) Signed-off-by: Bastien Curutchet Signed-off-by: Yoann Congal --- meta/lib/oe/fitimage.py | 4 ++-- meta/lib/oeqa/selftest/cases/fitimage.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/meta/lib/oe/fitimage.py b/meta/lib/oe/fitimage.py index a1040181a23..2304119902b 100644 --- a/meta/lib/oe/fitimage.py +++ b/meta/lib/oe/fitimage.py @@ -453,9 +453,9 @@ class ItsNodeRootKernel(ItsNode): if self._bootscr: conf_desc.append("u-boot script") - opt_props["bootscr"] = self._bootscr.name + opt_props["script"] = self._bootscr.name if self._sign_enable: - sign_entries.append("bootscr") + sign_entries.append("script") if self._setup: conf_desc.append("setup") diff --git a/meta/lib/oeqa/selftest/cases/fitimage.py b/meta/lib/oeqa/selftest/cases/fitimage.py index 84e21346abe..822b8c22c7e 100644 --- a/meta/lib/oeqa/selftest/cases/fitimage.py +++ b/meta/lib/oeqa/selftest/cases/fitimage.py @@ -697,7 +697,7 @@ class KernelFitImageBase(FitImageTestCase): if bb_vars['INITRAMFS_IMAGE'] and bb_vars['INITRAMFS_IMAGE_BUNDLE'] != "1": sign_images += ', "ramdisk"' if bb_vars['FIT_UBOOT_ENV']: - sign_images += ', "bootscr"' + sign_images += ', "script"' req_sigvalues_config = { 'algo': '"%s,%s"' % (bb_vars['FIT_HASH_ALG'], bb_vars['FIT_SIGN_ALG']), 'key-name-hint': '"%s"' % bb_vars['UBOOT_SIGN_KEYNAME'], From patchwork Tue Oct 20 23:22:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 101455 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4746.1792538587459654258 for ; Tue, 20 Oct 2026 16:23:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile-fr.20251104.gappssmtp.com header.s=20251104 header.b=xK8UhZpQ; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4a1f68a9855so585675e9.1 for ; Tue, 20 Oct 2026 16:23:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile-fr.20251104.gappssmtp.com; s=20251104; t=1792538586; x=1793143386; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=G+7vBrDEDXwSAzmrfw4r8yEroKyfQnKUmP/RZbX8p7Q=; b=xK8UhZpQGj1ywTcIEmTG3EW9O5InQf+Agk8crk59T22o6arDQRFyp2EncRAMPz7AN7 XHvTjq7xsrO/p/MyWIwpcCBmlZZ73cw5qZgJRXXFuEfcci10aP899Gl+Sr2zc3TYIa8r 72Ho+1/HCRjvzCRgu6Z9R1xeN4O8X974jDPBq5CJksh1SGFCB2iTtyyJeLKYK1nDbgmA qJo1U3kExzyv3xuGqOsoTmq1ujAyb4j8LtByeVrIc4xY8sCTKolqmA2WVZojxj6GOQzY 1oFGS7IQfdy3yU+lm7kUWo2oDA3HJxG5aqX9eqq0zYJ+6dF+3pJKlt7yEcYrm/VHsE/0 +KQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792538586; x=1793143386; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=G+7vBrDEDXwSAzmrfw4r8yEroKyfQnKUmP/RZbX8p7Q=; b=PfbR5Q76Y4ygj5AfYh5v1EVLc1Cm/6YNFssBs43zIyr2LLilWb2yaITF6zGQU7huW8 pRT1b6ZwxQimw+eic7pmWfr3tt6aid3SjLwfVawPX7RVJnS+kY+mD5ChIiVLujr/pBBw o75t+Tg2xhQzQ/q7i4JvIj4osoUgZMhWQVq0dRIOmZoH1+h8ccGFBwBQGFr0kCiKrfHB NYI7/j5PMhm3pHo0eW58Zv33sOa2OWivkqJI3uk32D98KKcIyv7Jk/WybZo1a01OpO/i GA7UWWhBdd9nOP8s/5HAR1tTQEfyuF1wr8lrhSQ8zzg1TwQ0lP6RytV3oxnoWZFHScxy BXzQ== X-Gm-Message-State: AFq9FYLHqr6qEN7E8UCbdeKoM32o8PRPx6/rWSeELupW+QKiPQPd1MFu pPoIUfs8e0V11E3VZ8Eg7pTHZDKPs3dIVdtxskor8LaNK3uSAq38/Vv8yaIOOlLyPC1vFtxb0JF 7IkV81zQ= X-Gm-Gg: AYBFou2J+xWz7hLrwTyvYvZ1CY4WY0W8aOnxHESRXWngzzumvzZ9qi7csduVR7vqxXL hTUkkBozm3YoTHEVWwwr3DaSQ3ApYYQM7YF6+unq8hPkyTJsGFrVTd7QZpY+15hXDXv4txPYmhI w+DvC7xkfpRfZb5cZIGFKIHVTgGS/lBRCO/+QYooXfu8PFA25y0c2gEPvCPjMbPAbRO7Dhrv18e CLlzAREKI6G4sR1+NwHgtCtnr3K8ep4NbGrXarBIcAIUxSZ58Q29nFJlzcdZweRhGwGpk6tE5HD LFSY+qm4gx1lVEeVzMATN1i3pRtfr/epyt7xtlESytqdaIZEyRoMmZd1kxQfPKdXm5D0R01uJ2g LGRFraZE4eM6JrnyUWk3QLyPsBGIEBRjJ4OxfWug3iYXuH2oMnFJ8D2H/M4sKpvqqZJYHabyvpo vXSr35SmsrygJXrL6ltVWCFZ87jcVbu82AIwsBZSWTwCcjpDFnHB6ThrXFhT5y7++LpW0tkUAD9 WzK3vFQK9wzqJQ4ExZ5OErTXblYhijQkD9B9ysP/SYBPFaex+DERkwWtYgl9MnhNeoxqz05K7uy uM9aUUxriW6ArQOC6WwLuV5gb0wpPQBkGe7it2Rjsaz4RYNHSSx7lXc= X-Received: by 2002:a05:600c:1c09:b0:4a1:777b:8a12 with SMTP id 5b1f17b1804b1-4a1fdafd654mr4662815e9.14.1792538585536; Tue, 20 Oct 2026 16:23:05 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48e2583523asm1436615f8f.37.2026.10.20.16.23.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 16:23:05 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 25/25] glib-2.0: upgrade 2.88.3 -> 2.88.4 Date: Wed, 21 Oct 2026 01:22:35 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 23:23:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248344 From: Daniel Turull Changelog: https://gitlab.gnome.org/GNOME/glib/-/blob/2.88.4/NEWS Source: NEWS Overview of changes in GLib 2.88.4, 2026-10-08 ============================================== * Bugs fixed: - #4011 gio/tests/services: Installed service file contains build path after !5259 (Jaipaul Cheernam) - #4020 'TLS callback not invoked' error on msys2-clang64 CI job (Luca Bacci) - !5262 Backport !5261 "gio/tests/services: Fix installed service file containing build path" to glib-2-88 - !5273 Backport !5266 "docs: Fix gio gi-docgen docs_url" to glib-2-88 - !5285 Backport !5283 "gconstructor: Reference _tls_used also on GCC, CLang" to glib-2-88 - !5323 Backport !5311 "fix: handle long filenames in trash by truncating from front" to glib-2-88 - !5379 Update Norwegian Nynorsk translation - !5394 Backport various security fixes to glib-2-88 Drop 0001-gio-tests-services-Fix-installed-service-file-using-.patch (local backport of #4011/!5262) as the fix is now included upstream. Assisted-by: kiro:claude-sonnet-5 Signed-off-by: Daniel Turull Signed-off-by: Yoann Congal --- ...es-Fix-installed-service-file-using-.patch | 35 ------------------- ...l_2.88.3.bb => glib-2.0-initial_2.88.4.bb} | 0 ...{glib-2.0_2.88.3.bb => glib-2.0_2.88.4.bb} | 0 meta/recipes-core/glib-2.0/glib.inc | 3 +- 4 files changed, 1 insertion(+), 37 deletions(-) delete mode 100644 meta/recipes-core/glib-2.0/files/0001-gio-tests-services-Fix-installed-service-file-using-.patch rename meta/recipes-core/glib-2.0/{glib-2.0-initial_2.88.3.bb => glib-2.0-initial_2.88.4.bb} (100%) rename meta/recipes-core/glib-2.0/{glib-2.0_2.88.3.bb => glib-2.0_2.88.4.bb} (100%) diff --git a/meta/recipes-core/glib-2.0/files/0001-gio-tests-services-Fix-installed-service-file-using-.patch b/meta/recipes-core/glib-2.0/files/0001-gio-tests-services-Fix-installed-service-file-using-.patch deleted file mode 100644 index 755e51cdd3d..00000000000 --- a/meta/recipes-core/glib-2.0/files/0001-gio-tests-services-Fix-installed-service-file-using-.patch +++ /dev/null @@ -1,35 +0,0 @@ -From ed5956d0000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Jaipaul Cheernam -Date: Thu, 30 Jul 2026 11:28:36 +0000 -Subject: [PATCH] gio/tests/services: Fix installed service file containing - build path - -The refactoring in !5259 changed the installed service file's -configure_file() to use the build output as input instead of the -original .in template. Since @installed_tests_dir@ is already -substituted in the build output, the installed version gets the -build directory path instead of the install prefix. - -Use the .in template directly as input for the installed version. - -Closes #4011 - -Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/ed5956d] -Signed-off-by: Jaipaul Cheernam ---- - gio/tests/services/meson.build | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/gio/tests/services/meson.build b/gio/tests/services/meson.build -index 1111111..2222222 100644 ---- a/gio/tests/services/meson.build -+++ b/gio/tests/services/meson.build -@@ -18,7 +18,7 @@ foreach service_file_name : dbus_service_files - # Build a second copy of the service file for the installed - # version of the tests. - installed_service_file = configure_file( -- input: service_file, -+ input: service_file_name + '.in', - output: service_file_name + '.to-install', - configuration: installed_cdata, - ) diff --git a/meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.3.bb b/meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.4.bb similarity index 100% rename from meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.3.bb rename to meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.4.bb diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.88.3.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.88.4.bb similarity index 100% rename from meta/recipes-core/glib-2.0/glib-2.0_2.88.3.bb rename to meta/recipes-core/glib-2.0/glib-2.0_2.88.4.bb diff --git a/meta/recipes-core/glib-2.0/glib.inc b/meta/recipes-core/glib-2.0/glib.inc index 50cdeff1589..7e7725f9bd3 100644 --- a/meta/recipes-core/glib-2.0/glib.inc +++ b/meta/recipes-core/glib-2.0/glib.inc @@ -237,13 +237,12 @@ SRC_URI += "\ file://skip-timeout.patch \ file://CVE-2026-58016-1.patch \ file://CVE-2026-58016-2.patch \ - file://0001-gio-tests-services-Fix-installed-service-file-using-.patch \ " SRC_URI:append:class-native = " file://relocate-modules.patch \ file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \ " -SRC_URI[archive.sha256sum] = "ab24d24e698dfa1e408b7bcdb508f4aafc906185a8b8ce72fdf79bbbdc9b383b" +SRC_URI[archive.sha256sum] = "25fd169f3b2f91fe2391ad297883ce0fcf30c69fc789ffd1c9672d1332b1c5a8" # Find any meson cross files in FILESPATH that are relevant for the current # build (using siteinfo) and add them to EXTRA_OEMESON.