From patchwork Wed Nov 11 09:02:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103692 Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5575.1794387799287543762 for ; Wed, 11 Nov 2026 01:03:19 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=DOMOYCZ+; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4a2000d5fb1so16919425e9.1 for ; Wed, 11 Nov 2026 01:03:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387797; x=1794992597; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=wKTFi3lCzelK901L/mrbsNTWnBpzR39c5v2XnkAI4v8=; b=DOMOYCZ+I6iQuFht5sjr5fBSii7iuEnCL4qJ4C9CyNzl3bqtyw7+qVaQoCMsmG1z4/ 1tKl+RM1lbYZbms19t1YPLnUrEc/ExTspCj3fJSzQf8AFzNOv6vImeMc5jAuU0a9oRnD jNONp9QqAB6Uuy0yMgpmr2NVMaxm5VyREuHtt1Z8bK9BrLgy4BLAv3ruED7gl/KFrI1h t2Ub7OxnXdXPIHpGHmX+R0bM/KveYd1OgNAUuFgQ5ppf4GZIqzfxlxZQs+bbuAxZNPai jZH1ftEW2EFi8bwN1eSwSGAICTbDG0RAnI6fpZoWbMzAtFJ6Prr3QlfcrpELVU3/RARc MNPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387797; x=1794992597; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=wKTFi3lCzelK901L/mrbsNTWnBpzR39c5v2XnkAI4v8=; b=g5Dgbz65mq8/ei0blEMP/Dtz+SPmOJRDi9pCS9FAk3rVn70LkBbi1YLAEn7Q3Gjk0Y PTYIn8yJmPlRl3ywinEHSFx+l2iWr36lMvbDDACaczW8wNiKHSyqMOI6BRzNjSPRp3pj WgL25A2E7lgFECSmEQxRFM0IS7U7NDwPNKD0ykA0rZH9qqbyYPdXC7zh0OABXxjzOTPU 1gl7J5EG6awBEC6hu4hQtliC2QjyAl0HNteDtgXYR7Tg2NHZf4Nd+Idr8BUBvn+ovNPt R7WfOL1O3Xm//r/GCWLLydQ/O8vCWcvrKWdIcrLbfJGcd2MR4DL8HT6U4S9gB69LCF/O 3ebA== X-Gm-Message-State: APuU4Z9PfhdfWPyCbSgRb5UDSCZOn4XfYHF+8yg7gqpitxuAFrq5Xyjz j11ctKc8ciVbitY8NR9bw7aze0AIVbmMkrJNvA63AExZ0xyJv4MQp6CD9GeelsOeP9lz+pjEX/K W8LhqHjI= X-Gm-Gg: AYBFou1kKaKpaNiFoKp69IFOHaSS1XqflJvbXHG+eRdWjBTzVkyER+ozNx9Kg82Q4B4 LVuDMB9t5xeq4FLTzg3OsZ0a/euwQ7HMch4yxDrMBxVqAUDGc1roNT+9LvABzLZzvqqSIIEw6Qa B9cWtAb63SBkvmPnaioFmnhkTyR2wRAqIzBQKhtBVmiYACg6EwBjZjc92wVFLVg/e3MzLfYAXi3 td1eBFwAGf+jPLyChuEX625tR0KIKJk8IhX9P3FSdOM3oTuFJnAdyvu3gMTMtnyuIdHzcZnYe3g B5QYXqz3+m5Kpagza3u0lbgzjq4BZl3TJ+93/cVPM+i5teg1Im3d20cn5NHf/lVC/JV4oUbjDZd Viyl1lPk+qaT4CLepEPbu6KyMf5OaCqGaFgFqYAn9njhtkOJmpcmUTwFB1lEpK/ITAtl1WQKf0d xHRWNMJbRcyJT4X3U+MDjs3FeG9UPfN5MOH60tuSF16ZYkcyxSeFZP16EAXHq2Pab7PfxXLsy4a 7ZijCdn1jkjreXzywWR81DwoNKMZJ32nz5J2QPH8maNpsbrkeiE58CrSUWgqTcRCQHDOvsMKnSm MCMynx6frv34UO9zBJHKAi1LxfpPCfVez13n6HXPEC/dU9DPTbeKFkqK5PrJSoG4MaPouuSRZZG Zn8BfBP9HNWwj1dfansuavKvMaz04 X-Received: by 2002:a05:600c:1c25:b0:4a2:18d4:f9e0 with SMTP id 5b1f17b1804b1-4ba093a9f02mr33198735e9.25.1794387797442; Wed, 11 Nov 2026 01:03:17 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.17 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:17 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 01/35] bluez5: Fix error handling for AVDTP_OPEN cmd Date: Wed, 11 Nov 2026 10:02:27 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:24 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249973 From: Jinwang Li Return BAD_STATE instead of BAD_ACP_SEID when the SEID maps to a valid local SEP. Signed-off-by: Jinwang Li Signed-off-by: Yoann Congal --- meta/recipes-connectivity/bluez5/bluez5.inc | 1 + ...ix-error-handling-for-AVDTP_OPEN-cmd.patch | 48 +++++++++++++++++++ 2 files changed, 49 insertions(+) create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc index d857c23a577..169269d3771 100644 --- a/meta/recipes-connectivity/bluez5/bluez5.inc +++ b/meta/recipes-connectivity/bluez5/bluez5.inc @@ -76,6 +76,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \ file://0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch \ file://0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch \ file://0001-adapter-restrict-delta-0-RSSI-to-proximity-filters.patch \ + file://0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch \ " S = "${UNPACKDIR}/bluez-${PV}" diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch new file mode 100644 index 00000000000..ba77d1e0469 --- /dev/null +++ b/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch @@ -0,0 +1,48 @@ +From 4e0aba5a8ebd969b68cd3442e9f8066a4b15a366 Mon Sep 17 00:00:00 2001 +From: Simon Mikuda +Date: Mon, 8 Jun 2026 13:29:23 +0200 +Subject: [PATCH] avdtp: Fix error handling for AVDTP_OPEN cmd + +We have to return BAD_STATE when local SEP is available instead of +BAD_ACP_SEID. + +This fixes: AVDTP/SNK/ACP/SIG/SMG/BI-26-C +Upstream-Status: Backport [https://github.com/bluez/bluez/commit/7c1c90f7b6d0f653c581878a039e2d02362f33f5] +Signed-off-by: Jinwang Li +--- + profiles/audio/avdtp.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c +index b57ba609b..56d27b973 100644 +--- a/profiles/audio/avdtp.c ++++ b/profiles/audio/avdtp.c +@@ -1777,13 +1777,14 @@ static gboolean avdtp_open_cmd(struct avdtp *session, uint8_t transaction, + return FALSE; + } + +- stream = find_stream_by_lseid(session, req->acp_seid); +- if (!stream) { ++ sep = find_local_sep_by_seid(session, req->acp_seid); ++ if (!sep) { + err = AVDTP_BAD_ACP_SEID; + goto failed; + } + +- if (stream->state != AVDTP_STATE_CONFIGURED) { ++ stream = find_stream_by_lsep(session, sep); ++ if (!stream || stream->state != AVDTP_STATE_CONFIGURED) { + err = AVDTP_BAD_STATE; + goto failed; + } +@@ -1796,7 +1797,6 @@ static gboolean avdtp_open_cmd(struct avdtp *session, uint8_t transaction, + AVDTP_OPEN, NULL, 0); + } + +- sep = stream->lsep; + if (sep->ind && sep->ind->open && !session->pending_open) { + if (!sep->ind->open(session, sep, stream, &err, + sep->user_data)) +-- +2.34.1 + From patchwork Wed Nov 11 09:02:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103695 Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5596.1794387800016281697 for ; Wed, 11 Nov 2026 01:03:20 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=a8fEcQ2c; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4a207b02a2cso20228985e9.1 for ; Wed, 11 Nov 2026 01:03:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387798; x=1794992598; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=A6ALfuBkKFSyd08eY756kxmq016kK63NatAuKWod26U=; b=a8fEcQ2cPProQVVHSnXS+wxa5v//57xu9AswajIt0oU0Gz4GG0SKuEh0SkqvUPVlNl UTt/gPAs0zgTpWtkx78QbtsKLxMTfFuxM446TVH3hXJjJHJ/xIb4TG2APMENww1HjFQz a4JbbZajfETHubj7zJn1cF/6qbMwTvWV6b/buaN1raPmKkc6VFg+R5vKN5UW3UcbH/2z HUyMQfGUHNaDPKJRWkChSkmtfqf1RDygzaN4UY2IOH7AiOl1jOh7i5m2Wu+DzDmwL+xQ 7UhtdnEgm+reVSxJXsIi+c+g/JBAoCO0KxzmK3A9+2wh8Oo5zFlVC05Qdx63fxW2isJx hN3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387798; x=1794992598; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=A6ALfuBkKFSyd08eY756kxmq016kK63NatAuKWod26U=; b=aEekDObwPa8bYSbtLSvA1ZSq2feED30ThhoMSVYATQlPqsJiAFEOmYbMuOuQNlDYog tgp73AkSkVdY3S3oEbeFSXwAC9JO8cEGE33Ha3h+7jZja4G3mgTErJxNHyEiTg5R4ig/ VnM31UbGjTjPQkwfRocHK1dOScAPXdxnL8bljs/hHJ2mIA2viGC6ldCO1crfYqyRsCqd 4Kf2vJVuNH/AjtA+C2jKdkfD+jdSA6i5lzgSq2RNRyYBslGG7LcUoWjvB7VakfKYNbeT ptvMuekwZUsJ6X0T9lVqvE+snPLq6gue4rmd94NMT6yVfYgHF8NTLzXWaHUSTcmXbbti ssMQ== X-Gm-Message-State: APuU4Z+02KZEe6hcKx1yl6vgdTHHmLZ56Qg54jXXrMdKtwpdOUnaNZdY Wud0YpEHVdDpVDXo2wzJPgazEUBhsqyRUs0mEQtGyZaTVfItQ/QJ8xA/Y8K5i0cBTLAFbXicUQh htRUm1WY= X-Gm-Gg: AYBFou0f9aGIDMWPZV11fGiOArf4oi9q9EIXMi1HxRfKcM/9eoe5OHcc+oiTMPnvesu 300FaxyYmGPIOUUTb9xw6AzQOAm+u6WnaeeDuaqYU+g6UZrLtBpKNz/Uf63TffTNLEaHq4no212 YiIHcg9WuyDbAVOvUhrONKA9D+8bnfF5fbeyiUjYFx/DI4dst8vvyHI/adHENg7zWAWUYxWL2fb o8N9TmBMYIXVrp4Esy57/oHLGKG2vz4nuJK7/0lsrPmixQf8zLILkJ1G7VqriEmAhFmna250cqM TUQ39ZnlUs6Y5Wp+0km/5vpeHVrDUCc8tfQktCGgvgLLAFf9i81ZBv2pHqafFfhD0Pkxmelcn80 riItpkvCp/ySVeS+X94KNUHP7v36Ok+g3KZYdE8aKUlxMkN12/eC78hGfqlmJaRNXugAK+5u/nn HcAoSwxzE5sz+BmHekl/avjQVmFmzPMQiVexntUY3Ly0vmiUt3P0jjzmhHi6OMiosKR/tGTdfEo 0VVQfUE0iLI3pUceVnhrEzwmDAj0dyVfdQvFgGjhZkkAe3PPUlVJ2D1/fLXz8zMwPLw5RvIuGWi p6MfkXYTJuJhSGv4nIkbOTCIVc0HS0RqS8GAm58r+jfDVfL9ygSswBKJJ4HLgyMNUWvKFclUr3h 8Ji846VwuUVYA5KEhTWGuA2yt6GN9 X-Received: by 2002:a05:600c:190a:b0:4a3:59ee:86b with SMTP id 5b1f17b1804b1-4ba0931ed3amr30937945e9.4.1794387798182; Wed, 11 Nov 2026 01:03:18 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.17 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:17 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 02/35] bluez5: Fix GET_CONFIGURATION cmd Date: Wed, 11 Nov 2026 10:02:28 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249974 From: Jinwang Li Check the resolved stream instead of an always-NULL sep pointer when testing for BAD_ACP_SEID. Signed-off-by: Jinwang Li Signed-off-by: Yoann Congal --- meta/recipes-connectivity/bluez5/bluez5.inc | 1 + ...0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch | 36 +++++++++++++++++++ 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc index 169269d3771..7e05bda4f13 100644 --- a/meta/recipes-connectivity/bluez5/bluez5.inc +++ b/meta/recipes-connectivity/bluez5/bluez5.inc @@ -77,6 +77,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \ file://0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch \ file://0001-adapter-restrict-delta-0-RSSI-to-proximity-filters.patch \ file://0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch \ + file://0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch \ " S = "${UNPACKDIR}/bluez-${PV}" diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch new file mode 100644 index 00000000000..3226ba39bec --- /dev/null +++ b/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch @@ -0,0 +1,36 @@ +From 8e5ca68aeee22970e3ccf3bbb30c050938ba09a2 Mon Sep 17 00:00:00 2001 +From: Simon Mikuda +Date: Mon, 8 Jun 2026 13:29:22 +0200 +Subject: [PATCH] avdtp: Fix GET_CONFIGURATION cmd + +This fixes AVDTP/SNK/ACP/SIG/SMG/BV-12-C +Upstream-Status: Backport [https://github.com/bluez/bluez/commit/60437c06560e46d211aaf99620cc9510dfd8081f] +Signed-off-by: Jinwang Li +--- + profiles/audio/avdtp.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c +index d475a545e..7cfc9a80d 100644 +--- a/profiles/audio/avdtp.c ++++ b/profiles/audio/avdtp.c +@@ -1641,7 +1641,6 @@ static gboolean avdtp_getconf_cmd(struct avdtp *session, uint8_t transaction, + struct seid_req *req, int size) + { + GSList *l; +- struct avdtp_local_sep *sep = NULL; + struct avdtp_stream *stream; + int rsp_size; + uint8_t err; +@@ -1656,7 +1655,7 @@ static gboolean avdtp_getconf_cmd(struct avdtp *session, uint8_t transaction, + memset(buf, 0, sizeof(buf)); + + stream = find_stream_by_lseid(session, req->acp_seid); +- if (!sep) { ++ if (!stream) { + err = AVDTP_BAD_ACP_SEID; + goto failed; + } +-- +2.34.1 + From patchwork Wed Nov 11 09:02:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103693 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5576.1794387800824788645 for ; Wed, 11 Nov 2026 01:03:21 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=go0nbdCx; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-49d05d51553so20263145e9.2 for ; Wed, 11 Nov 2026 01:03:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387799; x=1794992599; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=t4AG7tLCFYlsk+ohqMOF6q1Hg9DeonWK5fRlFIIfyJg=; b=go0nbdCxISvNkWNIAD1vM9daqzKYoBf3i+InXfyy+5OwSiQuMV0VUj8eLR0qYzm8k5 pW6pUymIqpL11d2mSNQyjKtzsfYaPRd4ddLqtIWCSuI4EC2VNw446D/XyfuQ4uqyDYhW uVoVzDTe2iqh8SbjCwiSMgdLJICnKZrdg0KrqcXFX2NK9Xkq4cMcmT9BcoxwDigfLS+W n53gXXMpUlkSIUGkRRVIlfAsjJPZGstwXnNNYsW+kfZECPWsKiTM+p8jgM6ShgqIl/x3 IhNiH27AX9xwWHAqPTEFlc8GMtwGWyxLpFCKKrquEmJtnPIqfMTQRkPXNH4XrrwdabsL AAnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387799; x=1794992599; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=t4AG7tLCFYlsk+ohqMOF6q1Hg9DeonWK5fRlFIIfyJg=; b=Yh5VjdETYCee4zdJ4w9rc+esCLRtgWBPHXXbmyPDEHOZcI8V3jtJTuAPigmBwYQhL8 NK/tfWpB9ZEo1FNnZOdWLorPS+twWnngJN63mUGmezuMR7JBE+CTYCVVk5b9A6+wW6pw L6ozGwP7mStR59EjlbC/P0Y4bATp6jwt18Lb7IuykkD35nv1MIMhgtzSFOLP+x/cudut cfc/0NqK//eGWun/jmv+/KhZrIZ4JZlwqfIz+cCFNeobzBWaG/0B5V0JfgncDR2iZiY9 q+JGlW3/zZXweTFiBDKcVM0hKz51MzHB21Z8WYuEbp95Izs6d09bV3b4LaVJwMg6KjPS KVow== X-Gm-Message-State: APuU4Z/se6D6HQTVgXeEnGUbNUtNJcGjwzGqoidu23zEYRP9u7OTIL2f SK407KEp/NUCXi01Qwvw6BGT+Hx+AG05vntMwpZe3nmboR4Ast6oECsFZkHE4BEenq2z9dBkLlm TGTIdPzY= X-Gm-Gg: AYBFou3G8Z0HSZODQQ8Qq/7lEzmUu7ADlZxCno91cArHsYAon8MVbtwFPU6vEmfx/iF qjtAhUQt4HC5ZIke/jfMmJAzUJIwfAoxUGlhnSUataS8Lk0D7wjpYJ4eq5dO0cQj8Wm1Pekvwsh kC272NipL1ml8xk3RAVO/hMIvubrBy/xC2jpHq3xjsZsksrkZl1GR7RZFK9qE38bDS4qnmFA0gM Rbn6Nm/SNeq6rZvRNkq/TdMgsISrF+leTuCO/O+JFOaqd3xhoHewrHdHRA/NU2IHYTqQqQ7czO6 Bjko7VAtNfufk6g5VJ5dWwxBOTcYToJABEZpPqr/wnQv//AIyC5iYUBuNXCeQrhue3zX4SZk2y9 XP8o94Ae6q0SzQMQyK3uEuXu6KzMOO6dzZEGHWkIX3yID6y/HghPyBG/svb5s6f9j0d2daccXPZ VvBPoZUedBqJSrw0geJXq+Ihxij+AqtUiPjNqBQejnztfyI3JSqA7DTXCC+JXbn4ReXeU8F4OlN x0Uu6l7GSgj8yxN/fZjYtwEE0y4L+810MVNkNNDlNKMwS6aDPRNt8Y66XqP8D3yHFGOAy6jx0zW TA+L7ImZ4D3GOHxEM+Lz19kkak8B3758IlqXRB36leVTfiKgCybkin5hv8PE+E0jAE5wVujVTB1 nExVUuOIVmTq52yW6QrcMN0AWnBJvge9LgwyKiCiGMtBXClFxcg== X-Received: by 2002:a05:600d:82e5:b0:4a1:faa1:3813 with SMTP id 5b1f17b1804b1-4ba0939c32dmr33775165e9.27.1794387799091; Wed, 11 Nov 2026 01:03:19 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.18 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:18 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 03/35] bluez5: Return correct error when SEP is inuse Date: Wed, 11 Nov 2026 10:02:29 +0100 Message-ID: <5b7dca5eeee9b7acfddd87609e6b80acef541132.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:24 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249975 From: Jinwang Li Reject AVDTP_SET_CONFIGURATION with SEP_IN_USE when the SEID is already bound to an active stream. Signed-off-by: Jinwang Li Signed-off-by: Yoann Congal --- meta/recipes-connectivity/bluez5/bluez5.inc | 1 + ...turn-correct-error-when-SEP-is-inuse.patch | 32 +++++++++++++++++++ 2 files changed, 33 insertions(+) create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc index 7e05bda4f13..de9835e5a7f 100644 --- a/meta/recipes-connectivity/bluez5/bluez5.inc +++ b/meta/recipes-connectivity/bluez5/bluez5.inc @@ -78,6 +78,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \ file://0001-adapter-restrict-delta-0-RSSI-to-proximity-filters.patch \ file://0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch \ file://0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch \ + file://0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch \ " S = "${UNPACKDIR}/bluez-${PV}" diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch new file mode 100644 index 00000000000..583e2c2e230 --- /dev/null +++ b/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch @@ -0,0 +1,32 @@ +From f1bbe63447bcc69beb546bc1e26a4e99c529d70e Mon Sep 17 00:00:00 2001 +From: Simon Mikuda +Date: Tue, 9 Jun 2026 23:30:13 +0200 +Subject: [PATCH] avdtp: Return correct error when SEP is inuse + +This fixes AVDTP/SNK/ACP/SIG/SMG/BI-08-C +Upstream-Status: Backport [https://github.com/bluez/bluez/commit/39ad431de60b896a03904887a0f1d0285b719edd] +Signed-off-by: Jinwang Li +--- + profiles/audio/avdtp.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c +index 7cfc9a80d..b57ba609b 100644 +--- a/profiles/audio/avdtp.c ++++ b/profiles/audio/avdtp.c +@@ -1556,6 +1556,12 @@ static gboolean avdtp_setconf_cmd(struct avdtp *session, uint8_t transaction, + goto failed; + } + ++ /* check if SEID is in use */ ++ if (find_stream_by_lsep(session, sep)) { ++ err = AVDTP_SEP_IN_USE; ++ goto failed; ++ } ++ + switch (sep->info.type) { + case AVDTP_SEP_TYPE_SOURCE: + service = btd_device_get_service(session->device, +-- +2.34.1 + From patchwork Wed Nov 11 09:02:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103696 Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5577.1794387801700150934 for ; Wed, 11 Nov 2026 01:03:22 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=mqmzbSc8; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4a5177d78c7so24479045e9.2 for ; Wed, 11 Nov 2026 01:03:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387800; x=1794992600; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=VY2AH7NobCUBInYkBKPt2hsmwY6SEqyBFiGifHHOGY0=; b=mqmzbSc8waScAcx3W8RG8pU1rJVa/6uFB31+Uq72HcE2PTTLszh5r8gW1uYUyskp0n VLH95Ci2COpkH1gxLJ0VNi2cGPq2kLgoFR9Zld9BBrifBsmCHDfuMW998SR6XqWgu84t C0wyre49VS5rfgBni0mrL/TZEgWdjFxqGLOFStusvHVWVnY0GijTs1N9HI1McTCzzVQa farlB1t64UTVYKnuW0fB4C3/Xf/U6AJqSxKP+d2gLO9yBMyU4Dq2AL3fldd7NsAD4j6B wJ+Lu6VHMeQavhXP4e7xXCx/GNq3xZbh5Tt32ugLQtpDOEyhRzuY/6o2hug8DKzMKk88 bOFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387800; x=1794992600; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=VY2AH7NobCUBInYkBKPt2hsmwY6SEqyBFiGifHHOGY0=; b=jNK6e5RuKe1TGsNV9PuI5iChUJPDJvJ7Q8zoP3hfveuAbmH5hTRr48BIxvc768dhXb n7/xGdr60dV1NvtvkKYNkaJ1F0xh1raHV4M+lEFq3r9vwrp7RSc76QrXZhKykXZcupA7 UpttLyRlnkaeAVKZTmCIEuv07eW8e+iWlc5VNpmC2UZOM/Se4QRvpZ1VeF2adWyg0fmP 6EwdLveiZlbVSi4VefFe3GbheOSjGt0xa8h6U5DkutJmwELSUmAje+5gTfeE0hof6ZJ1 TA1waLW3lZx1CGPmWk4TxeocTkxLBBD8QksjKS8gwjYN76FhQk8Qe6X3XqkfNSElpQEv e4zw== X-Gm-Message-State: APuU4Z+wlKZ2Qy351Imh/Vr0vBbrtdUiJo4je4j1DJbM79qhOFpmZo2e oAQ9NkxuCkzJByixVG4qvk3+TiS9y6K6Z6upZVx3sWPAt+dmWR74zdk8Rvyu9LZJmKd24LUCQtK AC74ArHk= X-Gm-Gg: AYBFou0ubwbDnde2HzuZX4m/aWH9WP6kJ18SqMBz9rQMgP+6+W/1SiPO+YfdOd8tCFx bGvoRXVRVkT4px9qMO+YoC4tE9VmTIrMtmDzYwHcYLcK84YpdDmccI3f0D0wNYzzkRPtnTeZdl9 2PGqpvf59s4nKloxUcUayvikUlDIYFhfkTatymHy8S/48mdNU3cWkPtD228PsBJqS7UqsyBoUqK zGjhHEiJJCr2TzUBoAeZz2pQ45SCg8kLmDI0WvrCck3PByV9jE/N0upDyjuSXLdoX6GBk55veMO rtW8PRsxmZ11pUleKIFjZE3rdZYGq2IReUypRcHNihvHDxj7CSptmGc77Gp31KXABfJTP24HuHB orawBaKd9eIaNj/cD1mSyk1cNfNsIg2COjggD9ALMo+twhgj7IcUa6nUccCpaqDfEsnCwjKVBo/ sitmyPsXBbtyBEcYNAxed+hvWjJbNhyKy4zREC4C3OICsavBsxSvZFbKHmSBDxFS9n3wqW9P+Ox 9PkZq3sJPqoQqv/QyRi1mgoZejQR8k5PUYxGBn+VfJoWHSwW1qSp3NlhMn1II8kcEEtwH1A6m/m 7tWIYIQILpRTx7RaPL8YhQxIXZ03+Pu5FZZjdK8IymYBjZhLnd78fqk77OIaUKj7iAe2vImE1OW D0WTH0hxfUOTt60lIhAsc3aq+cN1v X-Received: by 2002:a05:600c:34d5:b0:4a1:e672:5721 with SMTP id 5b1f17b1804b1-4ba0936ee3bmr30332875e9.13.1794387799859; Wed, 11 Nov 2026 01:03:19 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.19 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:19 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 04/35] bluez5: Fix ABORT response being discarded Date: Wed, 11 Nov 2026 10:02:30 +0100 Message-ID: <63f20c186b05bd15eadcfb1f6f4414f5520ed597.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249976 From: Jinwang Li Send the ABORT response after transfer_complete(), since it clears the pending tx queue and was discarding the response first. Signed-off-by: Jinwang Li Signed-off-by: Yoann Congal [YC: upstream commit 27b8778e630e ("bluez5: Fix ABORT response being discarded")] --- meta/recipes-connectivity/bluez5/bluez5.inc | 1 + ...x-Fix-ABORT-response-being-discarded.patch | 44 +++++++++++++++++++ 2 files changed, 45 insertions(+) create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc index de9835e5a7f..db650acdd03 100644 --- a/meta/recipes-connectivity/bluez5/bluez5.inc +++ b/meta/recipes-connectivity/bluez5/bluez5.inc @@ -79,6 +79,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \ file://0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch \ file://0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch \ file://0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch \ + file://0001-gobex-Fix-ABORT-response-being-discarded.patch \ " S = "${UNPACKDIR}/bluez-${PV}" diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch new file mode 100644 index 00000000000..5c0d7414ee6 --- /dev/null +++ b/meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch @@ -0,0 +1,44 @@ +From 38a88cc433e0bc3cccb6dab126e484fc06ccd8bb Mon Sep 17 00:00:00 2001 +From: Jinwang Li +Date: Thu, 27 Aug 2026 16:36:51 +0800 +Subject: [PATCH] gobex: Fix ABORT response being discarded + +g_obex_drop_tx_queue() in transfer_complete() clears any pending tx, +so the ABORT success response should be enqueued after transfer_complete(). + +Fixes the following PTS test cases: +- OPP/SR/OPH/BV-27-I +- FTP/SR/OTR/BV-02-C +- PBAP/PSE/PDF/BV-06-I +- PBAP/PSE/PBF/BV-03-I + +Fixes: 7a35c12a6ceb ("gobex: Fix segfault caused by interrupted transfer") +Upstream-Status: Backport [https://github.com/bluez/bluez/commit/d094be10ff0cc9d48714d35557e0fd297f36f907] +Assisted-by: Claude:claude-sonnet-5 +Signed-off-by: Jinwang Li +--- + gobex/gobex-transfer.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/gobex/gobex-transfer.c b/gobex/gobex-transfer.c +index c94d018b2..e4c7c557d 100644 +--- a/gobex/gobex-transfer.c ++++ b/gobex/gobex-transfer.c +@@ -314,11 +314,12 @@ static void transfer_abort_req(GObex *obex, GObexPacket *req, gpointer user_data + + err = g_error_new(G_OBEX_ERROR, G_OBEX_ERROR_CANCELLED, + "Request was aborted"); +- rsp = g_obex_packet_new(G_OBEX_RSP_SUCCESS, TRUE, G_OBEX_HDR_INVALID); +- g_obex_send(obex, rsp, NULL); + + transfer_complete(transfer, err); + g_error_free(err); ++ ++ rsp = g_obex_packet_new(G_OBEX_RSP_SUCCESS, TRUE, G_OBEX_HDR_INVALID); ++ g_obex_send(obex, rsp, NULL); + } + + static guint8 put_get_bytes(struct transfer *transfer, GObexPacket *req) +-- +2.34.1 + From patchwork Wed Nov 11 09:02:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103691 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5578.1794387803668830109 for ; Wed, 11 Nov 2026 01:03:23 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=R11toNDS; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4a5720b0a57so17373345e9.0 for ; Wed, 11 Nov 2026 01:03:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387802; x=1794992602; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=6aQBoSfHu8+9ID9NUlHNwzNWSDkFw9barSE1k11kPYs=; b=R11toNDSNmNTIt78xb9Xf06gAoGtcKiRVJsoDfbhxT4jl8oo1QmxzmauU2DYU1u4Yg TcE930jMAfWeLeEJ514w5OxTECMiuHJMNk71ASe11L3Xj4dJ3rEfZr8ol4aYH0pntduO SemcC0hDHbqQ5T3bdfd1rjAX0Ap14S2Dquyd5nXdw9fW0kNV6Z0nwGxN5L42Me01Atzh yaeuDfnMszTlcOaY5vEuGmJ/vvolm0pNVWtAv01evUPhAvMpjG+ZrUV0eo6TqHbp/EsM y43tuAR1Fk3Lr1b2lpC2olS6qtJQ0kOYDC9TuQZ3lc87ixIAOVh76jJ8v3KCzcsdvP78 YBNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387802; x=1794992602; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=6aQBoSfHu8+9ID9NUlHNwzNWSDkFw9barSE1k11kPYs=; b=vEtHeV1W2G833niJk5oXkmL5Nzfhq46eci0zdOy9rnEBaqS5jJKdUzgv2Web5RyDSh 2LAZtKTdd4JJbeZGfYlpFpkmi8/lB33Qs4jgWTMy0ogxtfRPsusrnBAKc7XhbwzHLW/E +yxuP6/lf1dcpAo6/juQy+2PjkMGsVhJRhMcw7oK2xFblmH10DFpjzdANdmvlbm1U9jj w/6HZWR29UrnOT5CimnlQe/u3VrQPBD4xXPku/FXbMjCDYYMbcg+5XRj/CSmOv5vNGNO jwzi9sdHByuYtT4Ukc1ASyBvvTbTuww/sfbpUBxrslpFBtH19o1RRFeRtcnVESxSc585 b/1g== X-Gm-Message-State: APuU4Z8jFegPI9TZaZjAWA+2vh7ErtZpfYG4Wj/XacjrUUA2Be4hWvFy p/8zRRDeMkvY9zvmu+miX5dDQki72k+JrnBJMcIgu7V2ovoNKtePeKms62LIXp7qNpLkWk7LwPs isw3H3D8= X-Gm-Gg: AYBFou2/oMlLTW0dfNuHuyuoWFd/LQGEEiCq2boRN58KiloAWfzKIUJivZAGhooH6Hm N+uW0eSAQfFFwx0gGnTSZs/Zk47fqX9damwg2Xh04qLsdvhlDHV4ooFL+eUDUw7nu5IWmmwxLub 2nppxQmRz88LFeiLrAEhnBGNgfDNOOU8t3kNBhf2n6Vn6MamcwAW3vSyEHvvZx6IwGkZq2Bhfyt tpD9F32WbjSpy0/Iby8DxL60yj4rXIdLR6T2hxmP9aqPgr+THJT4L9RbbSpz9noX3aiJqgX4Chr ip6wgzBljibqkZYAYkr11RjR4pbwLMbNnn3hI1NsJVAQeYWIc9t6vcvey5epgHjX8DB4aqryJ6L k7Xctkp+3g8hzcQLGeekvxzR1shAq2t9GErIyBrbNDG5ZYLigbk/DLAEoNThIUANfiJ8mN7E0xP DjaT1OarhzRx6P95jVaRH+lkRDH/bD4PHkJKlq/HzAjxJTw5ncbRPahLqFH46t92XINE0qBnNAF GKxlChPU/xDIy47v5Iuzkg9bpRqe1l9pbodvJt0q4lIo0tCZCxoGcWOHnaVcS2ro4sncxl7a8sU Isx1DByrNZ+N8tjFzMO0VYJGiBZL1I+1nJHx7udT+/LZxVLIxUTwSzRTzHAtZqQO5gNule//gnV 08MrUqEQhUvvpf6kBYXiTz5X/y90vmg== X-Received: by 2002:a05:600c:3b04:b0:4a2:526b:d40f with SMTP id 5b1f17b1804b1-4ba091aa686mr29830225e9.0.1794387801822; Wed, 11 Nov 2026 01:03:21 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.19 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:20 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 05/35] bluez5: Fix u128_to_string skipping data[4] Date: Wed, 11 Nov 2026 10:02:31 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:24 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249977 From: Jinwang Li data[3] was used twice, skipping data[4] in the output string. Signed-off-by: Jinwang Li Signed-off-by: Yoann Congal --- meta/recipes-connectivity/bluez5/bluez5.inc | 1 + ...p-Fix-u128_to_string-skipping-data-4.patch | 33 +++++++++++++++++++ 2 files changed, 34 insertions(+) create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc index db650acdd03..75d76cf96de 100644 --- a/meta/recipes-connectivity/bluez5/bluez5.inc +++ b/meta/recipes-connectivity/bluez5/bluez5.inc @@ -80,6 +80,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \ file://0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch \ file://0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch \ file://0001-gobex-Fix-ABORT-response-being-discarded.patch \ + file://0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch \ " S = "${UNPACKDIR}/bluez-${PV}" diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch new file mode 100644 index 00000000000..338bc228c16 --- /dev/null +++ b/meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch @@ -0,0 +1,33 @@ +From 198f4e0785644cea2b2154b383fc4ad354707947 Mon Sep 17 00:00:00 2001 +From: Jinwang Li +Date: Wed, 23 Sep 2026 11:29:57 +0800 +Subject: [PATCH] obexd/pbap: Fix u128_to_string skipping data[4] + +u128_to_string uses data[3] twice causing data[4] to be skipped and +DatabaseIdentifier, PrimaryCounter and SecondaryCounter properties to +be printed with wrong values. + +Fixes: 5ee26d43c65c ("obexd/client: Add DatabaseIdentifier property") +Upstream-Status: Backport [https://github.com/bluez/bluez/commit/8b4a4176063831476bc9244d20f43b552e4b5554] +Assisted-by: opencode:claude-sonnet-5 +Signed-off-by: Jinwang Li +--- + obexd/client/pbap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/obexd/client/pbap.c b/obexd/client/pbap.c +index 0f575e61e..d89b6aafa 100644 +--- a/obexd/client/pbap.c ++++ b/obexd/client/pbap.c +@@ -1098,7 +1098,7 @@ static int u128_to_string(uint8_t *data, char *str, size_t len) + return snprintf(str, len, "%02X%02X%02X%02X%02X%02X%02X%02X" + "%02X%02X%02X%02X%02X%02X%02X%02X", + data[0], data[1], data[2], data[3], +- data[3], data[5], data[6], data[7], ++ data[4], data[5], data[6], data[7], + data[8], data[9], data[10], data[11], + data[12], data[13], data[14], data[15]); + } +-- +2.34.1 + From patchwork Wed Nov 11 09:02:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103697 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5599.1794387804856650632 for ; Wed, 11 Nov 2026 01:03:25 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=ERYdRStY; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-4a35ac4475dso19975005e9.2 for ; Wed, 11 Nov 2026 01:03:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387803; x=1794992603; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=RazqaQh/y0olDR+ZNEFY2KYYYnlPtCLDYR/bAzGegeQ=; b=ERYdRStYMSbsQHVZ5Cb/ArDi4FeBwDzZDuBQxX325ATNyZb4UwgH5qoBsta4kRa9Gl +u6oL88C7dvzu+83OP7osEPBjT2CqxMp+13zeVUXY7cZ81IeAHwnUCbqSJCB/Hot7mZo FkTE9w20atXoOI6xOtyb17D4gny3S6zMvN3skKZwudG4kYKX1UJ++Ll7KUOaWbLy9Dek ci+bm2N2QwC/Hnf1by49UDJc+1Yl14OTeEi5gS3XIdimJRA4AZtBbQmag06L/mpPe4km Kux4z0OiFLA9a9y8LL1GF2eifhCrNrkiwdjG/n7WCAky8tkgvJg1IKs26QhYQPIg9oqB 1+mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387803; x=1794992603; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=RazqaQh/y0olDR+ZNEFY2KYYYnlPtCLDYR/bAzGegeQ=; b=KoYZjAxRx9SAflUPR1lEnkHWWgeYoL9QdDmuR2DjQFY7S3F5MLwfGPMePVpqDr/Nbc W8Kl6jDOQGIY0TYjs3FozBjrEYieBRPhhrYL5S7AgTzUtUOOwMLYojsV+zy6MUDtrvtJ ayh9oDpam+ZFKXg3jhqeTH0KcnqXND7w4E0HKdQO3HyRJYZleqdJxoWolODdX+e8W1St UsGlNQ4IgrUAjW26w+MXEHBC7WD3eL5A2Hxi+6/C6a6ckCaYcX81oKUNPNUbbfn5An3+ n45LflBgtZm9aUPDUAgEzIyu0JcRF6VMzRVN4+4xHxvae3ZhPr7Y/BvSyDNSybydCkd4 rI7g== X-Gm-Message-State: APuU4Z8VN200GnztUVZGGpgRy4HgRQCdjpOGgpXijgyZ16tWQDmHzDQJ 3aEdW+NAOFGml4vNk49JFSvgv9HOPKVdfZCv8DFxn43I9+Mlmka55xTbbGTji2QaNj5bm0s8rw8 bveB/Nl4= X-Gm-Gg: AYBFou0xpIE9jojtTF72ukNfL7uvNN4VFDBnntTvRmdt0flDn8RWIxl9witqk9SzTa4 HksOH55qVuAe87ImT5wsQ8om3sCFZ+AcILopshorJKrw0/BfMwHOoYidog1pnTq6bCAR2Sums6Y UyYb/IzcajgUzMTkWCp3a9QdHiFsPx890tGYcJfViKsnLXFCHe/2AumoZpP5lilw2etb0rorj2x TIRnwE43QxOXEEHShmsfqU8eih+BQLkH/3ejAOukRRHTXM44yNNbT+NJLDF0pDbS2N1hf3UrQ9A KkzcJR8a9rFNmhIiO9qRvrLZ2ZA9Yex42d88FEYzE/m/mXvTPaFUYB7uI+rtDHEX97AF/Dtz6C/ Ekne3cSmwdrbc8EwmqbL79kRa4zIn2qmbwVJ4we9hGRLn/IJgrOMdfoT51WWvwif37B/s6OUExK L0RrlxYKyNAEIiut4MS7/WR1hD3kkl/jGvrHt24y9H59SDeCJFu2+zedkkujUvgZ50xumWRWXGk Ut+XHRc+VbKq5XKW9KTIpk39MwH7eX6iCWeLgD1kuxlCBljr9hDC+YbUUbEpUP+onC55tH3joJl FvPOvCGNgF6O4Aw+oDMyYgW++HQ3QCj5Sab2XZGb9CMmBCVGM3IfWEK0o6u+SRUdsz5pSZ4CS0t UcQGzZ8Gmw5KCP/xl1Lp5anrI3I9pBRqamwLaYvLl63wuUb5q6bk= X-Received: by 2002:a05:600c:8b2a:b0:49f:fd2d:23c7 with SMTP id 5b1f17b1804b1-4ba093921f6mr29285965e9.27.1794387802979; Wed, 11 Nov 2026 01:03:22 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.21 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:22 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 06/35] gstreamer1.0-plugins-bad: use gtk+3 dependency name Date: Wed, 11 Nov 2026 10:02:32 +0100 Message-ID: <365f56330b989f412fd562d72e4f6aed7426ed1e.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249978 From: Shantanu Majumdar Replace the PACKAGECONFIG gtk3 dependency from gtk3+ to gtk+3 to match the recipe name used in OE-Core. Signed-off-by: Shantanu Majumdar Signed-off-by: Tushar Darote Signed-off-by: Mathieu Dubois-Briand (cherry picked from commit 7993331246ac675eef1712ea7fba770518cef5b1) Signed-off-by: Yoann Congal --- .../gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb index 17e49ebbda2..1b6a8ac30ba 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb @@ -49,7 +49,7 @@ PACKAGECONFIG[faac] = "-Dfaac=enabled,-Dfaac=disabled,faac" PACKAGECONFIG[faad] = "-Dfaad=enabled,-Dfaad=disabled,faad2" PACKAGECONFIG[fdkaac] = "-Dfdkaac=enabled,-Dfdkaac=disabled,fdk-aac" PACKAGECONFIG[fluidsynth] = "-Dfluidsynth=enabled,-Dfluidsynth=disabled,fluidsynth" -PACKAGECONFIG[gtk3] = "-Dgtk3=enabled,-Dgtk3=disabled,gtk3+" +PACKAGECONFIG[gtk3] = "-Dgtk3=enabled,-Dgtk3=disabled,gtk+3" PACKAGECONFIG[hls] = "-Dhls=enabled,-Dhls=disabled," # Pick atleast one crypto backend below when enabling hls PACKAGECONFIG[nettle] = "-Dhls-crypto=nettle,,nettle" From patchwork Wed Nov 11 09:02:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103698 Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5600.1794387806052482797 for ; Wed, 11 Nov 2026 01:03:26 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=IKhRkEl8; spf=pass (domain: smile.fr, ip: 209.85.221.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f46.google.com with SMTP id ffacd0b85a97d-498f5fa4f70so1281178f8f.0 for ; Wed, 11 Nov 2026 01:03:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387804; x=1794992604; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=lBMzMSx8r51hkKwIjfGf3PA6N+6YQReEJk718h/Ownk=; b=IKhRkEl8r+fo16GpYNgqtOL+wRW1Rmus+U8QyZCKgJVffVqf0ZR8vT5129ShS1gHs9 boAHlGP4T8q5LQ+opbrewFnIl1sjNpvayu9dIqRK0m9A+jTsCvnEU6Bn0ZKplTQJQPyP gbpdD4oFZBsgWPp5tu8PoQl2ay6IyxJBhsSM/L4rcnYF3nIbWC7wpAv7Nj4mDopTEyI/ hV4t3Eg+DEqTDJ48nnSDop/8VD7HFFG76Yo+AiekVF+OUQThegktB0dJUs1eEGrKAQzW ystMRT6Mn5aTtkr9iHvisWStqMLfcrcH+K3ftubdhM5dNCvyGnH3/ITTpuhg2qFMjxyv n2Gg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387804; x=1794992604; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=lBMzMSx8r51hkKwIjfGf3PA6N+6YQReEJk718h/Ownk=; b=GGBshlP3Azo2IPHW7tuY6wawrDqsHztVGTUoQSf9TO5/Y16WgFtGIG5ueLMjvIPwjk RDb92hGQQoszeHHDtWBAut8bYVqQX/rFUpDkCYmxjVsGbn0vWBbkyzCVORjByQJzLuC0 KkG+Tuy/w4P4umAkZ4L8ngwmm7x7m9Bc7M9z0U8tVvj+imMSpVqI2ClmBwlUnjyA7+Wz 5sRLjdO68YGQ/uC+PvXEKmUWx++HOSL3hX3KBl3/4K05gfpaNLDDhl/uX5/DNUv0c1zR fnv2XUzK09BY2EFVtXKbRomPj+nbgR1bDWEDA7E5UTQ0oLBvfrEwJzREfZFjWoLYNceg hmWQ== X-Gm-Message-State: APuU4Z/fHV7dHYXiDwm9o3MF0A9CiGJ0UPCbIVn93o3TOI4UNLRiRAhV sli9Y6yxqEYBB7sOx7mRdCRDrN7v6a+pxO66O8RNLLd6ImuWLyeVp+ad9R/PUIZYS9XfHOCAvuZ n/PmdnFA= X-Gm-Gg: AYBFou3lvC9egldpObtpqbuqK3M3E3aXoIO/2qperYL7asMaF83rfFJFNv27iK1TmX6 5VsX956pp1JsA5fJNEm2jdAm3GneC6qCL2DLpkM774IxVY0K0WyY2ilotEJEslp6mI8AlwEPIlw zarzU3H7xu9Ax7ScsomWJQrZpqp+R62DvpCAT/iRwdRUUX2hsOSgxtC/L1MVa5jkkd2gQuBsjfT 4rzDLBJtW5OiB4IjMYiptn0bHuKdcnLy9h3SVZ3yWsFppqHxWA+34eO8CGy0pvATP9OKauKlwUR RXoftrKEi+3VeM2XLE7ZD3jBHVYdV1nNbB5ALzcYeIY0UsLt+Ot/Jw0kj5ddtrhDitwCTvIJKSc hyBa1u0OSpW45NwLI1o1v5M7nco4fcxGuzMdkc4y0Lm2r6aI+RyO9RTJibSSqS6vadNUIHVv8RS DN7lcpRhuPgJIn8v8/6MGsEeyQxDKKP4zYDIQ48izfpn/TZgsfQdV8gIbkjZSBK/SYPXpuctBw/ +D1L2TySt9gRFRPm8KdXuRhY8K7vlAKAT6ifxkX/iCDF3q4kdwX81Hqd5gwc28TPShKJ6xquWxd 0Dpv414bwAl5lVbukn5xJ1KsCR4C2a3AdbInWx/mOzXM7hyEdq9rjpXHRLybuQjBMJ4gXNIto7Q GFD6ra/SCn2BIeezipJmrL2OKayvynXi/nhCeaxxuB4B71ILqLqo= X-Received: by 2002:a05:600c:3baa:b0:4a2:1196:db0e with SMTP id 5b1f17b1804b1-4ba0938a445mr35624085e9.30.1794387803967; Wed, 11 Nov 2026 01:03:23 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.23 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:23 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 07/35] spdx_common: simplify get_patched_src() implementation Date: Wed, 11 Nov 2026 10:02:33 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249979 From: Benjamin Robin The behavior remains unchanged: - Instead of saving and restoring the values of various variables, use a copy of the data store via `d.createCopy()`. This prevents side effects for other tasks. - This allows removing the `try ... finally` block. - The function `is_work_shared_spdx()` no longer needs to be called twice. - In the work-shared case, there is no need to modify `WORKDIR` since no task is executed from that branch. Signed-off-by: Benjamin Robin Signed-off-by: Richard Purdie (cherry picked from commit e0bf8e7c5be3d87376a6c2aab5aca07fd0813763) Signed-off-by: Kazuyoshi Akiyama Signed-off-by: Yoann Congal --- meta/lib/oe/spdx_common.py | 81 ++++++++++++++++++-------------------- 1 file changed, 39 insertions(+), 42 deletions(-) diff --git a/meta/lib/oe/spdx_common.py b/meta/lib/oe/spdx_common.py index 6b1a409c40c..9d1e22629b2 100644 --- a/meta/lib/oe/spdx_common.py +++ b/meta/lib/oe/spdx_common.py @@ -172,50 +172,47 @@ def get_patched_src(d): Save patched source of the recipe in SPDX_WORKDIR. """ spdx_workdir = d.getVar("SPDXWORK") - spdx_sysroot_native = d.getVar("STAGING_DIR_NATIVE") - workdir = d.getVar("WORKDIR") + # The kernel class functions require it to be on work-shared, so we don't change WORKDIR + if not is_work_shared_spdx(d): + spdx_sysroot_native = d.getVar("STAGING_DIR_NATIVE") + localdata = d.createCopy() - try: - # The kernel class functions require it to be on work-shared, so we dont change WORKDIR - if not is_work_shared_spdx(d): - # Change the WORKDIR to make do_unpack do_patch run in another dir. - d.setVar("WORKDIR", spdx_workdir) - # Restore the original path to recipe's native sysroot (it's relative to WORKDIR). - d.setVar("STAGING_DIR_NATIVE", spdx_sysroot_native) - - # The changed 'WORKDIR' also caused 'B' changed, create dir 'B' for the - # possibly requiring of the following tasks (such as some recipes's - # do_patch required 'B' existed). - bb.utils.mkdirhier(d.getVar("B")) - - bb.build.exec_func("do_unpack", d) - - if d.getVar("SRC_URI") != "": - if bb.data.inherits_class("dos2unix", d): - bb.build.exec_func("do_convert_crlf_to_lf", d) - bb.build.exec_func("do_patch", d) - - # Copy source from work-share to spdx_workdir - if is_work_shared_spdx(d): - share_src = d.getVar("S") - d.setVar("WORKDIR", spdx_workdir) - d.setVar("STAGING_DIR_NATIVE", spdx_sysroot_native) - # Copy source to ${SPDXWORK}, same basename dir of ${S}; - src_dir = spdx_workdir + "/" + os.path.basename(share_src) - # For kernel souce, rename suffix dir 'kernel-source' - # to ${BP} (${BPN}-${PV}) - if bb.data.inherits_class("kernel", d): - src_dir = spdx_workdir + "/" + d.getVar("BP") - - bb.note(f"copyhardlinktree {share_src} to {src_dir}") - oe.path.copyhardlinktree(share_src, src_dir) - - # Some userland has no source. - if not os.path.exists(spdx_workdir): - bb.utils.mkdirhier(spdx_workdir) - finally: - d.setVar("WORKDIR", workdir) + # Change the WORKDIR to make do_unpack do_patch run in another dir. + localdata.setVar("WORKDIR", spdx_workdir) + # Restore the original path to recipe's native sysroot (it's relative to WORKDIR). + localdata.setVar("STAGING_DIR_NATIVE", spdx_sysroot_native) + + # The changed 'WORKDIR' also caused 'B' changed, create dir 'B' for the + # possibly requiring of the following tasks (such as some recipe's + # do_patch required 'B' existed). + bb.utils.mkdirhier(localdata.getVar("B")) + + bb.build.exec_func("do_unpack", localdata) + + if localdata.getVar("SRC_URI") != "": + if bb.data.inherits_class("dos2unix", localdata): + bb.build.exec_func("do_convert_crlf_to_lf", localdata) + bb.build.exec_func("do_patch", localdata) + + # Copy source from work-shared to spdx_workdir + else: + share_src = d.getVar("S") + + if bb.data.inherits_class("kernel", d): + # For kernel source, rename suffix dir 'kernel-source' to ${BP} (${BPN}-${PV}) + dir_name = d.getVar("BP") + else: + # Copy source to ${SPDXWORK}, same basename dir of ${S} + dir_name = os.path.basename(share_src) + + src_dir = f"{spdx_workdir}/{dir_name}" + bb.note(f"copyhardlinktree {share_src} to {src_dir}") + oe.path.copyhardlinktree(share_src, src_dir) + + # Some userland has no source. + if not os.path.exists(spdx_workdir): + bb.utils.mkdirhier(spdx_workdir) def has_task(d, task): From patchwork Wed Nov 11 09:02:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103699 Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5601.1794387806663371623 for ; Wed, 11 Nov 2026 01:03:26 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=kPDThV2m; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-4a5b2be99a8so24060385e9.2 for ; Wed, 11 Nov 2026 01:03:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387805; x=1794992605; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=hEgH3pCXU/3pGpqMhn30xhXTMRrMIcglMWtSonjRXWc=; b=kPDThV2mUn8LQAZIriWoWiTZeEdG7l4+5P8VCQUfjXMleSfYnZmF1bUsXXtw9YaCR4 vkX81PLL5lVI3nxQqFH2LynbDvIqBKRwgwGCaahN5qa9Bcb8ejf0pASCeBqN28JzWRRE aeoHZ4nTQ49Qy8Ob3kQGZgHoRHggcihXtB/ofE9nHa4RT5owAq6ydHsNJK7KiJA2P5Py oO6/WHGBWBudQ6DwK45wDXXNAHItxEc1WkV8N0qo0yXwPbx0sBX5W2JBoVf7C41yYLnr LzG94ewwwod7dMZDiRnkrPbXHcBWxm6sypEeZMatFzsPHerOWVgWvRb6p+ulhH1STV+Y cdqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387805; x=1794992605; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=hEgH3pCXU/3pGpqMhn30xhXTMRrMIcglMWtSonjRXWc=; b=fbK2Q+Btf9PBOK4W1JtQrIF4nCgMMNYaQ7339CYIotRnhuKcmjT4pLg59cHIastZ55 wfOQLSxuNkRSlUQ7aChhJlYeXdom44YKrb6zmdJNFN+vC9+stgDHWciHREqzIkaY68TL KyJWk9hoAIymkwNHYy0uoE6hGpyIOtTYcudGH4ILELi7Mt34FN7kKcfr4gw0d0nuVtS7 NNhV5wJ2OiQ7JI9zbQHP01bPV94iBjuWyp+vnH97CgsMkfzM/6mW2GCwHFyKLB0bsTN3 SJ2zSL/laEaStnnlfGETrgOB5k+1GvsKOV3/dE9StZjK2N1IvK6GOR4aubXOGZlSjz7X o/Kg== X-Gm-Message-State: APuU4Z/so5o7pIL9BzJdJ6vl2JmEWQOOMX3L5JSACRMnX9ZYhHDK4Oz9 LPtgkOrw6woctxD6n5qt10yAkgD6nm9ilbzXSZmzK7Tdn3BUVhnAnFAICVXT+QkvK/1ngL6FHz9 7jvUuiPE= X-Gm-Gg: AYBFou1ssS0zKD2Rili9DnIpbj8as/oBrrQZXkhM8bEg8HPQkChjGjn2fS+NwstCyxu YDCWdwQaukbcUdh7X0XykN5GEbr+kSFm5dTnUbPYQR9Rp2lKA8FyaxCOzH7t0fFWSNewKwybGcB y4/4TICoPDI13Js161w0PLtN0J7EuDzBDXyoYhiT42zFGapcZ/6bxoDzPykh9UKWLHju6l0+lL8 rtkMTrTWuo1tI6SPB4dN7DU6wn4a+SAIUlT+1tVjU9wv14uDknOtsakyIyAV+XJbhlML1KDSBro NHzBtG4jgDkCkY42skGg5UBGstDK9pA6r35LzkXSuSiUpXQLGRjfJNzBzCmM0RLVQnJqo/oaoIj adWZj8Av4eiKKy+7mfI40rp1VrZ8qici/8dhrkUXPncSya41qMmtcCqoqUoeTbYTST9BwDU1681 jBOVlJpXEgpGWGXmq6sWYX8edrLILC4qODDKrIfb9kOKjjMl5MgLDYklFkGQXM3hBL2LQAcYZHq 0AwFZUncH0ve3lMGCOAenCnbh3RzVeEs0UqcFOAXgVEOhdu6Ger2GzYO50Mpjt+3RCGZgKLizND DTtkTZ0SUjiEw6ha2ZuESeafbvJfrLfiXXktrllagkYlwho/OoGSuKGvbGqbyyprbpO15HXgX9V WBgZp3crkZperRawV+EbxNsr2InW4 X-Received: by 2002:a05:600c:1c0e:b0:4a1:fcfa:2a07 with SMTP id 5b1f17b1804b1-4ba0937df39mr32122265e9.30.1794387804870; Wed, 11 Nov 2026 01:03:24 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.24 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:24 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 08/35] spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src() Date: Wed, 11 Nov 2026 10:02:34 +0100 Message-ID: <2f9302882115ae7652fff0fb2bb6a0e3476f9125.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249980 From: Benjamin Robin This change will affect the SPDX output: the source file path will no longer be prefixed by `sources/`. The rest of the changes are safe because: - `S` should reference `UNPACKDIR` and not directly reference `WORKDIR`. - After analyzing all public layers, no `do_unpack()` or `do_patch()` was found to reference the `${B}` variable. The comment mentioning the `${B}` variable traces back to [1] (though no further explanation was provided). Additionally, this ensures proper capture of sources if the recipe modifies `UNPACKDIR` outside of `WORKDIR` (though such cases should be rare). With these changes, SPDXWORK is no longer a working directory which is "temporary" replacing WORKDIR, it is now a "temporary" directory containing unpacked source files. The run.do_patch.XXXX and associated files are now stored in ${WORKDIR}/temp. [1] https://github.com/doubleopen-io/meta-doubleopen/blob/e84f0c32663da9c743e4f1802042b733df0e36d7/classes/doubleopen.bbclass#L285 Signed-off-by: Benjamin Robin Signed-off-by: Richard Purdie (cherry picked from commit aa44a0f0eb5e260959ebd77f439a5d25b3c1aa2a) Signed-off-by: Kazuyoshi Akiyama Signed-off-by: Yoann Congal [YC: The SPDX change was judged a divergence from usual design where source paths do not have this "sources/" prefix. So, this patch is a bug fix. See https://lore.kernel.org/all/DM9S9QJC41I5.HBYN1E0X32YB@smile.fr/ ] --- meta/lib/oe/spdx30_tasks.py | 1 - meta/lib/oe/spdx_common.py | 18 +++++------------- 2 files changed, 5 insertions(+), 14 deletions(-) diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py index 1821dd7de4a..862e57c3d12 100644 --- a/meta/lib/oe/spdx30_tasks.py +++ b/meta/lib/oe/spdx30_tasks.py @@ -873,7 +873,6 @@ def create_spdx(d): lambda filepath: [oe.spdx30.software_SoftwarePurpose.source], license_data, ignore_dirs=[".git"], - ignore_top_level_dirs=["temp"], archive=None, ) build_inputs |= files diff --git a/meta/lib/oe/spdx_common.py b/meta/lib/oe/spdx_common.py index 9d1e22629b2..013f23ae7c6 100644 --- a/meta/lib/oe/spdx_common.py +++ b/meta/lib/oe/spdx_common.py @@ -169,28 +169,20 @@ def collect_package_providers(d, direct_deps): def get_patched_src(d): """ - Save patched source of the recipe in SPDX_WORKDIR. + Save patched source of the recipe in SPDXWORK. """ spdx_workdir = d.getVar("SPDXWORK") - # The kernel class functions require it to be on work-shared, so we don't change WORKDIR + # Do not unpack the sources again for the recipe using work-shared if not is_work_shared_spdx(d): - spdx_sysroot_native = d.getVar("STAGING_DIR_NATIVE") localdata = d.createCopy() - # Change the WORKDIR to make do_unpack do_patch run in another dir. - localdata.setVar("WORKDIR", spdx_workdir) - # Restore the original path to recipe's native sysroot (it's relative to WORKDIR). - localdata.setVar("STAGING_DIR_NATIVE", spdx_sysroot_native) - - # The changed 'WORKDIR' also caused 'B' changed, create dir 'B' for the - # possibly requiring of the following tasks (such as some recipe's - # do_patch required 'B' existed). - bb.utils.mkdirhier(localdata.getVar("B")) + # Change the UNPACKDIR to make do_unpack do_patch run in another dir. + localdata.setVar("UNPACKDIR", spdx_workdir) bb.build.exec_func("do_unpack", localdata) - if localdata.getVar("SRC_URI") != "": + if localdata.getVar("SRC_URI"): if bb.data.inherits_class("dos2unix", localdata): bb.build.exec_func("do_convert_crlf_to_lf", localdata) bb.build.exec_func("do_patch", localdata) From patchwork Wed Nov 11 09:02:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103703 Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5579.1794387807863171852 for ; Wed, 11 Nov 2026 01:03:28 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=WwBbfo8Q; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4a1fbd52ab6so19843665e9.0 for ; Wed, 11 Nov 2026 01:03:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387806; x=1794992606; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=gX/BR9DTbYAhDc3zvjYkoi8B/Yqsx1AOA3PcUDZSDoU=; b=WwBbfo8QgPhkF1x7o5Kjni+8INUdWmXgMOSWI3wtJqXleWm35DHweKoRkGxMWIKjTN C0f2ZJnHPIWya5Ck14aaIKeZQ8s1I+WbZAL0d9g80mCcqfMdvH9bln1D5m0J/c/IlC4e hWwAHsOdAVqGWie6KhmJWtBXmISvmGlPKhXzBPyn1R2PxUk07CVIzS3j1lR2VmgFHAYz Ost3vrtD0a5vbRN7ecblUeLUPY5stdec0Z1ikT0Zg8CVEBTfKEzNHAOkCusQmcHptMt3 I/gx6jAjeS4WPsxjuNx74xy6TQdIBGziXrF2Xfp7S+/c6p33cX0CsvxJXvZLxHEnpLvz azcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387806; x=1794992606; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=gX/BR9DTbYAhDc3zvjYkoi8B/Yqsx1AOA3PcUDZSDoU=; b=0+zup9zYh83xPNu7P1746+lk6sKjORAIs2Tn9dXnSEbaGV9frGureLsqbVhF0s0k2D 0PZ+x6+Ud0cHM9Byms7IK3UbimxwYET/ERXUdckiWXAXiRxF7ZD/dMkUNqc31PnZbBQZ oWZ0kQ3n1aPUESrKibqOGpUj2RaBPoIYpeP8LatC1WduGgeRf2dHhUoZzzI0z0w8LzI0 YdbYKroInFqeC1JX+6WmS/YdqdzPd0FoJq9LJ9JPqxWr4VoMFmfcMn2kCkkBGoaXJDNS 3Zo5xbGH4bdBirnWqAVvs9YwqfxsiX42k2GXe92SBtvIFdy97j5B07mesG9AaVhpTaxU mnbA== X-Gm-Message-State: APuU4Z8euTEFenINOge5L28rJWeW0Ho3JZTjg1pgk9AsGpzF7fqDgO7e VTPBOLF3qkiWer6YnOpr4I2CHY9WqyirRe0PHmC3QBy1AI/bJyjeyaCFKSjIWmbNXl/OOOcM3b7 TNc31aPc= X-Gm-Gg: AYBFou2LWstinsCa0gSjop4pE/DrAS2dYTQKR4q7ueCzg3XLJE3nHOYvZGWwddi5AYJ BITZtuBQ2z5H31QprrZxoAqkZVmJEW89XheHJC1JGndASYSq8R1PCeokF+NL0C2SZwEehW3qdE2 u4R1IAW9g0pTTrpaQZwHjRMLSZA4xW+brcmVrGlIIAAs1IP2OilP3UY3sEEeijn2N0WCn3cP2HP 0OZuf8BHA04/hpHzJMpZf+ETi306+j4Akqbg6JFcptGWQq/bPiwcSIkTTTnlZ+xg4P/njSthJKo MJv4zslhjnWW8pA3FqmxoRJyxkC8z3tTF9Ht/YOaCW52TjFLaCLAbXGSq2T/PBWL1VOkLofQLkW XGhA92iqU0Zmvc9C9Gn3Dr7iWeZIYUjqLBaXDKvM5j9f/iAtfy1REmeZOq7gQawBCLRjscIQzEe sTswcACnribXz45wIoZOZxyl5OI1oCnlsPVVrCL/0tcd+S++uf4xFqGPqSzeIeGcgz6IFmEu/al aNuQsJX0YY31UsjQ2VjpbtMh0LKNlu+/VUn1E93Yn6F8zAyhlEQNnMQERNGX/KfT0w7WCId3c6G NQUQ01308yCa1sluG8urP7OE00y6oxaqKAxKPza93tUirsefmJKkI892rGXppT6o1Hq+T3XJZDo Vs1BbkFLn5JLk+IohFcqXM1ot57X4 X-Received: by 2002:a05:600c:37c8:b0:4a7:6bc7:f778 with SMTP id 5b1f17b1804b1-4ba093cd0b0mr29194065e9.30.1794387805991; Wed, 11 Nov 2026 01:03:25 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.25 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:25 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 09/35] spdx_common: In get_patched_src() ensure kernel dir name to be ${BP} Date: Wed, 11 Nov 2026 10:02:35 +0100 Message-ID: <7402f4742d38bf20f724d459c732ee999b1baa4a.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249981 From: Benjamin Robin If a kernel recipe is using a tar file instead of git repository, it is necessary to override `S` to point to the unpacked tar archive. In this case `${S}` is not going to be in work-shared. So we must handle this case in get_patched_src() to ensure that the kernel is extracted in the following path: `${SPDXWORK}/${BP}`. For a full detailed analysis see [1], but in summary this change is necessary because: - In `save_debugsources_info()` the sources are extracted from the debug symbol. For the kernel Linux the source file path is modified to look like `${BP}/init/main.c` (`${KERNEL_SRC_PATH}` is replaced by `${BP}`). - In `get_patched_src()` the sources of the recipe are extracted (again) in a sub-directory of `${SPDXWORK}`. If `${S}` is in work-shared and if the recipe inherits the kernel class, then the sources are extracted in `${SPDXWORK}/${BP}`. - In `add_package_files()`, with topdir equal to `${SPDXWORK}`, all the files (recursively) found in topdir are listed. For each source file, if the file path (relative to topdir) is in the list of source files retrieved by save_debugsources_info, then the file is added to the SPDX SBoM. - If we are using a tar archive, `${S}` is set for example to `${UNPACKDIR}/linux-${PV}`, so in `get_patched_src()` the sources are extracted in `${SPDXWORK}/sources/linux-${PV}` since `UNPACKDIR = ${WORKDIR}/sources`. `${BP}/init/main.c` is not in `${SPDXWORK}`, but `sources/linux-${PV}/init/main.c` is. [1] https://github.com/bootlin/yocto-kiss/pull/26#discussion_r3626224833 Signed-off-by: Benjamin Robin Signed-off-by: Richard Purdie (cherry picked from commit 9bb9763c4c857edfc64aa2ad189a78a4bfb0c897) Signed-off-by: Kazuyoshi Akiyama Signed-off-by: Yoann Congal --- meta/lib/oe/spdx_common.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/meta/lib/oe/spdx_common.py b/meta/lib/oe/spdx_common.py index 013f23ae7c6..e40cf36bba1 100644 --- a/meta/lib/oe/spdx_common.py +++ b/meta/lib/oe/spdx_common.py @@ -187,6 +187,14 @@ def get_patched_src(d): bb.build.exec_func("do_convert_crlf_to_lf", localdata) bb.build.exec_func("do_patch", localdata) + if bb.data.inherits_class("kernel", localdata): + # For kernel source, rename suffix dir to ${BP} (${BPN}-${PV}) + dir_name = localdata.getVar("BP") + kernel_dst_path = f"{spdx_workdir}/{dir_name}" + kernel_src_path = localdata.getVar("S") + if not os.path.exists(kernel_dst_path): + shutil.move(kernel_src_path, kernel_dst_path) + # Copy source from work-shared to spdx_workdir else: share_src = d.getVar("S") From patchwork Wed Nov 11 09:02:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103704 Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5581.1794387808899216382 for ; Wed, 11 Nov 2026 01:03:29 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=etQN7QrG; spf=pass (domain: smile.fr, ip: 209.85.221.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f52.google.com with SMTP id ffacd0b85a97d-4918c2d727fso1595982f8f.3 for ; Wed, 11 Nov 2026 01:03:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387807; x=1794992607; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=8N3IKFuIYKLq9eiYhZdyOTHWwZ0Xxc7CIWz5RZ0+/UI=; b=etQN7QrGNk/9tniTA2BGxu51vXiTfGzYEBHn03TuEQDxlWdZWjqBIoT7QNLgcRqtpW jxRMCfr/X5vARPGvUl3XgB2c6Bkeo9JpxfJ2AR9hquWYNLJnRqulnv2wqvxzxuBKDXgX PyG5fpXW6IK2zHs7o87Si8Hi8F+0xrtmlbT0ahzkmIKWeKALs3fTGbriYIwMsetPLmFm fX12o+DlXH4cZhXkrykNZLrfAEsQHDhQ2/uEksvxwl7yDkcCZYIm3bEGPyLobpp0D0ld Hz6WjjOgZcQW4R5BTNL0tY8Ex16yPRUbb0afhdtRwrGN8zaImnmdxbtAAqFL3jIJXWC0 gW1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387807; x=1794992607; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=8N3IKFuIYKLq9eiYhZdyOTHWwZ0Xxc7CIWz5RZ0+/UI=; b=DnFfbtl+h+wVMy1GARDPDfEtRRKP13Ud5luZ3h7ULqQJEGHEPuGwKlqH7TyGIUl7+v mBqohXFgLFwb+mFlacN1jKeqajiw/VB04JjIj2shhNbZ9e2592XzPSDtpL6E20SQxiwr BrO53Y3JVrl+OWV8W0mFJNLguGrChe+IJTEY1mt4VH2hi2pzYrBbUye3u7izFaM5+i6U d1sCeNrk1JQ68Re8goQykmpaFdfK391LfHX3lhG3qEvQOLk1EmTiJCJFrO+vV6ncDl4/ Rcy4VJuhTcstnqWyFEF6XpWA/tY+UVIojM5THargu/idPSNkFpb973dKXWHPsTnp3MQT ppXw== X-Gm-Message-State: APuU4Z+rsiQNMvPl6c+QhCBY4WHR68ibFEDUOmcY2PExTkmt7afu0wzL Oh557GZ2MOnNiSpfa32aWh8cvOUIgnwc7Sfbt5QsO650DI77bi84EVbtZuARak26rz32Wr4rojb JAZ54Z7M= X-Gm-Gg: AYBFou2RkuyzGKwuJm8IzrP36+ukk2OIYhkZuw5VRDALqiyKmL/Bsk2/o7q0pVbtJmO yuOvwXwCnEu1C+4zVp+9VPNT/1Xl5zTl3AmftDBZ3XDfK0hZYwnb5DlUibTT6ZmwMbQR2tzdoX1 j6K2as82dGR1hFV8y/L8612Evl4Q0q7yX4WRA6vniNk8YbbtEfeHiDulgAQdMx3Z0mFjxRNyGaI 8VCNijsIGYV65s7y4mJpNNitTX0YnuEY1BfOeJ+XtVo4p3aIRwg8OxkO4tNbHOKXfHDnrtTvSWD BplQu9AR7MKqd77F0GQpHWJD3xiZwFnos5Q0JzeMAotFn4vjsC1Hy9SpNd9bcvZOBXr1xtupkdY FJlkQvickXZmzQpUQsuQgiWbliQ1akmDBnTp7MxzHb62wAALFtisuDkIvdhEQqhnkKv9SUPjqsN 7vRCZErj9oiTHtDPtf6vrBZed63TokQZ45vFl9hdKfKe1Hkl+a7zH2LsEHeiSBZUrV2/kJbwzla ALlqXt5Jvj7rVaSOqVtIjG3hV+D20/wNwwsP5n7LQncDpmKbyKGBzZ/Lri8utq+okUPZKs7ekWk RZHS7ZTc7iATfjT8fmsTuc2WWlweYkjwt6lCnY2lJuqgkE++hEhOfmukRrqskVGehJ5Ol2fwMEm eXv2KOkTI4eLqLQk1gJpA4w2eEvVi X-Received: by 2002:a05:600c:a311:b0:4ba:2bfc:c8ab with SMTP id 5b1f17b1804b1-4ba2bfcc988mr15299705e9.15.1794387806973; Wed, 11 Nov 2026 01:03:26 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.26 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:26 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 10/35] package: no longer modify paths in save_debugsources_info() Date: Wed, 11 Nov 2026 10:02:36 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249982 From: Benjamin Robin The source files saved in `${PN}-debugsources.json.zstd` are now saved as is: "/usr/src/kernel/" is no longer replaced by "${BP}/". However, the file list is still filtered to exclude "" or "", ... With this modification, the content of `${PN}-debugsources.json.zstd` is no longer specific or tied to SPDX generation. The logic that modified the source file paths to match what SPDX generation expects is now in `oe.spdx_common.get_compiled_sources()`. Furthermore, previously, for all non-kernel recipes the source paths were never "resolved", since the KERNEL_SRC_PATH variable is always defined. So the returned source file paths always started with `/usr/src/debug/${PN}/${PV}` (the value of TARGET_DBGSRC_DIR). Update the source file paths to match what the SPDX generation expects: - In `get_patched_src()`, the sources of the recipe are extracted (again). The unpack task runs in a modified local context with UNPACKDIR set to the value of `${SPDXWORK}`, so the sources end up extracted in a sub-directory of `${SPDXWORK}`. - In `add_package_files()`, all files below topdir, set to `${SPDXWORK}`, are (recursively) listed. For each source file, if its path (relative to topdir) is in the list returned by `get_compiled_sources()`, the file is added to the SPDX SBoM. Handle this by replacing ${TARGET_DBGSRC_DIR} with the relative path of ${S} relative to ${UNPACKDIR}. If ${S} is not relative to ${UNPACKDIR}, do nothing. Signed-off-by: Benjamin Robin Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit b567c2f0d91fbf36886d0c3a6f6ea90c07771044) Signed-off-by: Kazuyoshi Akiyama Signed-off-by: Yoann Congal --- meta/lib/oe/package.py | 54 ++++++++++++++++++-------------------- meta/lib/oe/spdx_common.py | 42 ++++++++++++++++++++++++----- 2 files changed, 61 insertions(+), 35 deletions(-) diff --git a/meta/lib/oe/package.py b/meta/lib/oe/package.py index c375acc1242..bef3c92a259 100644 --- a/meta/lib/oe/package.py +++ b/meta/lib/oe/package.py @@ -1060,37 +1060,33 @@ def copydebugsources(debugsrcdir, sources, d): os.rmdir(p) @bb.parse.vardepsexclude("BB_NUMBER_THREADS") -def save_debugsources_info(debugsrcdir, sources_raw, d): +def save_debugsources_info(sources_raw, d): import json import bb.compress.zstd - if debugsrcdir and sources_raw: - debugsources_file = d.expand("${PKGDESTWORK}/debugsources/${PN}-debugsources.json.zstd") - debugsources_dir = os.path.dirname(debugsources_file) - if not os.path.isdir(debugsources_dir): - bb.utils.mkdirhier(debugsources_dir) - bb.utils.remove(debugsources_file) - workdir = d.getVar("WORKDIR") - pn = d.getVar('PN') - - # Kernel sources are in a different directory and are special case - # we format the sources as expected by spdx by replacing /usr/src/kernel/ - # into BP/ - kernel_src = d.getVar('KERNEL_SRC_PATH') - bp = d.getVar('BP') - sources_dict = {} - for file, src_files in sources_raw: - file_clean = file.replace(f"{workdir}/package/","") - sources_clean = [ - src.replace(f"{debugsrcdir}/{pn}/", "") - if not kernel_src else src.replace(f"{kernel_src}/", f"{bp}/") - for src in src_files - if not any(keyword in src for keyword in ("", "")) and not src.endswith("/") - ] - sources_dict[file_clean] = sorted(sources_clean) - num_threads = int(d.getVar("BB_NUMBER_THREADS")) - with bb.compress.zstd.open(debugsources_file, "wt", encoding="utf-8", num_threads=num_threads) as f: - json.dump(sources_dict, f, sort_keys=True) + if not sources_raw: + return + + debugsources_file = d.expand("${PKGDESTWORK}/debugsources/${PN}-debugsources.json.zstd") + debugsources_dir = os.path.dirname(debugsources_file) + if not os.path.isdir(debugsources_dir): + bb.utils.mkdirhier(debugsources_dir) + bb.utils.remove(debugsources_file) + + workdir = d.getVar("WORKDIR") + + def _filter_src_file(src): + if src.endswith("/"): + return False + return not any(keyword in src for keyword in ("", "")) + + sources_dict = {} + for file, src_files in sources_raw: + file_clean = file.replace(f"{workdir}/package/", "") + sources_dict[file_clean] = sorted(filter(_filter_src_file, src_files)) + num_threads = int(d.getVar("BB_NUMBER_THREADS")) + with bb.compress.zstd.open(debugsources_file, "wt", encoding="utf-8", num_threads=num_threads) as f: + json.dump(sources_dict, f, sort_keys=True) @bb.parse.vardepsexclude("BB_NUMBER_THREADS") def read_debugsources_info(d): @@ -1337,7 +1333,7 @@ def process_split_and_strip_files(d): copydebugsources(dv["srcdir"], sources, d) # Save source info to be accessible to other tasks - save_debugsources_info(dv["srcdir"], results, d) + save_debugsources_info(results, d) # # End of debug splitting # diff --git a/meta/lib/oe/spdx_common.py b/meta/lib/oe/spdx_common.py index e40cf36bba1..f885f1832ae 100644 --- a/meta/lib/oe/spdx_common.py +++ b/meta/lib/oe/spdx_common.py @@ -277,14 +277,44 @@ def get_compiled_sources(d): bb.debug(1, "Do not have debugsources.list. Skipping") return [], [] - # Sources are not split now in SPDX, so we aggregate them - sources = set(itertools.chain.from_iterable(source_info.values())) - # Check extensions of files + unpackdir = d.getVar("UNPACKDIR") + srcdir = d.getVar("S") + bp = d.getVar("BP") + kernel_src = d.getVar("KERNEL_SRC_PATH") + dbgsrc_dir = d.getVar("TARGET_DBGSRC_DIR") + + # Compute the relative path of source directory from ${UNPACKDIR}. + # The goal is to replace ${TARGET_DBGSRC_DIR} by this relative path. + srcdir_rel = None + if srcdir and unpackdir: + srcdir_rel = os.path.relpath(srcdir, unpackdir) + if srcdir_rel.startswith(".."): + srcdir_rel = None + + sources = set() types = set() - for src in sources: + + # Sources are not split now in SPDX, so we aggregate them + for src in set(itertools.chain.from_iterable(source_info.values())): + # In the common case, the sources are located in ${S}. To format them as + # expected by SPDX, we replace /usr/src/debug/${PN}/${PV} with the path + # of ${S} relative to ${UNPACKDIR}. + if dbgsrc_dir and srcdir_rel: + src = src.replace(f"{dbgsrc_dir}/", f"{srcdir_rel}/") + + # Kernel sources are in a different directory and are special case + # we format the sources as expected by spdx by replacing /usr/src/kernel/ + # into ${BP}/ + if kernel_src and bp: + src = src.replace(f"{kernel_src}/", f"{bp}/") + + sources.add(src) + + # Check extensions of files basename = os.path.basename(src) ext = basename.partition(".")[2] - if ext not in types and ext: + if ext: types.add(ext) - bb.debug(1, f"Num of sources: {len(sources)} and types: {len(types)} {str(types)}") + + bb.debug(1, f"Num of sources: {len(sources)} and types: {len(types)} {types!s}") return sources, types From patchwork Wed Nov 11 09:02:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103705 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5582.1794387809556795451 for ; Wed, 11 Nov 2026 01:03:29 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=IO6skw1H; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4a1fbd52ab6so19843795e9.0 for ; Wed, 11 Nov 2026 01:03:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387808; x=1794992608; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=TBH1M5bT0jW4uIx3NJq5bAKSfphFvAvmA713AKE/Ilw=; b=IO6skw1HQQlAsn3JBYnvDgQ+ber3dtAl/RUziQAVYxBNAsVu3l4wGl0wuzu7B1ibT4 X998Gd9nung45OFimUlVm8jbiyHuHIeyMRq3RoSQRhq/0JPr8oHbwkpFNDNOSF25oqFR Ci1hW2+0zSdNpKQbvfsOz4w9KjEO0eCatro4uT3mx0K4I1rVLRik9+VVpHzgTXE8WATC XIZWpwF3O5M2Vv+06q0GZw+6fHW7f1+wTc7N1j7SDCUwyEslqY1RlPgOyPNa9+DxK7yP rJtF8isq17vMQTzLYLZFpmssDxPzIPWeCip8ObtDSChJJ0iA3a1jC3iu7dRQukD71yYk oEUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387808; x=1794992608; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=TBH1M5bT0jW4uIx3NJq5bAKSfphFvAvmA713AKE/Ilw=; b=crsxEHOsqPaWJibJV6UQZJUPa2qYUz19QN4Vrehrh115jZ+zMh31QwFss4opBAe8aR 6Wv+PaS95fDU/fsK5a8PKxlHKz0BThvZ7AXtYI5kd34YY7yyGhBp1FJUKSmw8WwZN6/M lnaM1PIXgmp1Rho4VEPgFdq07v1XHJoNKpjyzCusmgGU9xdQVN1SYHqw/4Dqco9zBF4m K4yc2O+QEybyfNEUhDsoqyNNPMRsXZudUT0eTSImqHUEsWEBg/dxIecmeXBUL0SLCpcy 76NWH4wnaD1FhWlY56p5JXZ++OSuV8yBdY4caqPepzJhesjg0dpD7H/glV9Sauecogyx PlaQ== X-Gm-Message-State: APuU4Z+DsYQiqThljhOO8Z8K/66miRsIFQDYgSx6QptG6fvOfWW8iu1U MDODuENQMx1kp1jz8WnCkx8RnyNelgy9TXqqoGCDWKVuFyIePuyA+NoswhVmMykGYDnx8MK8mgj a6VjMXi4= X-Gm-Gg: AYBFou3P5UeG/pV68KSVDS0z/I+7GhnJlj/ZoG04gehtQ7tHQjP/yDBOJ0ELX80xIa3 O4tI1fe4h9i4uMtYKqZ/0l15OIMNEUN538ll2laZ7AK0OD3qG4PY7Wvn5AyhrraTg3g+y9d1j1E yrQndAU1HUyIbx3eaIxTX1GEstsAslENzCskPZjcnfcqqQ9RDghJU17wOZK4C1fvMgT9zX9Shl3 wFUR/7iAtzt9Txhd+GbviUJ8ZCEbHoQEzFm+ijiLeH7X2PeEgcdPDGJayKTWbs/HnHzsa3J38PL Aym74HNXmHTvImuwShzbfVTJUa9if8iBcq9rV0OwbRIb5OIs3BKoQYZtTKmzl0yeo81hSUnZH5s qP2Lu4KM3zvtiVLlx9GZCHwaonXkx8+Wx6rCTs4WarqIg59phf6Ngmwd6L4qm2FC+8cfoOPMtoJ lxTj5Jeilus7fn2FpC1+zXLADCnbto83340hgeJmRhiJArg9rsB/1G5orRu06w5Un+wHBCXN2kw X5rhwb+3hPp3RUvogUAfnkv9mCb9v+9+or41azKprViJ7PHTSdIHtq2XrAxSWxc7A7/mnvBXoIT fwlNnOP42NkzamDnIwSX0O1HX7A3PBt2NjLySvW5rWA/Lce25J17J2Y8gsM+AlykDgaA8r3TSDh 6+YVwjcTcETsSuqB5kDr2FCLhbEy3 X-Received: by 2002:a05:600c:19d0:b0:4a3:7344:13b5 with SMTP id 5b1f17b1804b1-4ba093ab25dmr27840065e9.16.1794387807744; Wed, 11 Nov 2026 01:03:27 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.27 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:27 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 11/35] python3-pyelftools: add missing runtime dependencies Date: Wed, 11 Nov 2026 10:02:37 +0100 Message-ID: <120383a88934ad5a5653d9400da395d1d5873415.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249983 From: Theo Gaige (Schneider Electric) python3-asyncio and python3-json are needed as runtime dependencies of python3-pyelftools else the readelf.py script run into the following errors : ``` Traceback (most recent call last): File "/bin/readelf.py", line 30, in from elftools.common.utils import bytes2str, iterbytes File "/usr/lib/python3.14/site-packages/elftools/common/utils.py", line 11, in from ..construct import ConstructError, ULInt8 File "/usr/lib/python3.14/site-packages/elftools/construct/__init__.py", line 36, in from .debug import Probe, Debugger File "/usr/lib/python3.14/site-packages/elftools/construct/debug.py", line 7, in import pdb File "/usr/lib/python3.14/pdb.py", line 87, in import asyncio ModuleNotFoundError: No module named 'asyncio' ``` ``` Traceback (most recent call last): File "/bin/readelf.py", line 30, in from elftools.common.utils import bytes2str, iterbytes File "/usr/lib/python3.14/site-packages/elftools/common/utils.py", line 11, in from ..construct import ConstructError, ULInt8 File "/usr/lib/python3.14/site-packages/elftools/construct/__init__.py", line 36, in from .debug import Probe, Debugger File "/usr/lib/python3.14/site-packages/elftools/construct/debug.py", line 7, in import pdb File "/usr/lib/python3.14/pdb.py", line 77, in import json ModuleNotFoundError: No module named 'json' ``` Signed-off-by: Theo Gaige (Schneider Electric) Reviewed-by: Hugo SIMELIERE (Schneider Electric) Reviewed-by: Wahid ESSID Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 0dc1a2f9df58cf2dd1418426e38e95372aecdcde) Signed-off-by: Theo Gaige (Schneider Electric) Signed-off-by: Yoann Congal --- meta/recipes-devtools/python/python3-pyelftools_0.32.bb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/meta/recipes-devtools/python/python3-pyelftools_0.32.bb b/meta/recipes-devtools/python/python3-pyelftools_0.32.bb index 7e50cef2488..76cf22266bc 100644 --- a/meta/recipes-devtools/python/python3-pyelftools_0.32.bb +++ b/meta/recipes-devtools/python/python3-pyelftools_0.32.bb @@ -12,4 +12,10 @@ inherit pypi python_setuptools_build_meta BBCLASSEXTEND = "native" -RDEPENDS:${PN} += "python3-debugger python3-pprint python3-logging" +RDEPENDS:${PN} += " \ + python3-debugger \ + python3-pprint \ + python3-logging \ + python3-asyncio \ + python3-json \ +" From patchwork Wed Nov 11 09:02:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103706 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5602.1794387810582832850 for ; Wed, 11 Nov 2026 01:03:30 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=RATwAv4i; spf=pass (domain: smile.fr, ip: 209.85.128.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4a215e64962so33153565e9.1 for ; Wed, 11 Nov 2026 01:03:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387809; x=1794992609; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=TxIFThM+inTwaEWZt4QcUWgR5cl8bncdQcvNGuzBh84=; b=RATwAv4iuenvNh/q7pdT6JU3Ee15Nxap288oxTX3pMR4KwLw4oZFGLoowCs/cDnK4D W1DXcLC16XjP/mUjCoMLrQySjHGBFA2KYt4bHu+G4TJZmPZwm867hXk1I14a+fnmzpxT NEf/fvn+wzHBv5rJ9NPcQKunSmRjMGeEj6Vwgn7ABFEtg2T2/ZmreHcbgvywUqvKv9WN 2ZWaO7uhTd/nocFPUjats2Vbx8lvXS6Si+U0Vw/EzEbrwbCPVRqrAkG7IDn6z4w0LNZv 34Zlio4Ihw8SZ/mM3mn6G1g2seQXK+v3aEI6Z9dCcKNh4vA1H9oDE0KpUc0xkvMULPy/ fi1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387809; x=1794992609; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=TxIFThM+inTwaEWZt4QcUWgR5cl8bncdQcvNGuzBh84=; b=laETK41Bc7072Pualn21lJLZNloEbX7vnFSx2SnMdAx6r5wfFAkKQU5PxFr4VexotW CnKWdm0N5qDZ0X9z+T2kKP8LuGLIAhhMlwDDuO9fr7P/vi6KEETTRnc1Ierd6drejpTr uxqUbtAo4/LFLizjpHS0W5AbLEobQc7Cb0VYJGL1feSHJ/nuxyJP7kWPJ5VsQD6n5obe AEU+VrROVs6yVReWcv9dXsxr2ng0CONmHNxSluLnDhA9VAFpW4/FJbhVKf0aBt/vTBD2 F5muVLrQCoX9GxOsDKfupHivBptyFF+8MNLwX5tMSLwPj61r8D1YO/HHdPRuQAbg47TD GA/A== X-Gm-Message-State: APuU4Z8Lcw2j/LVtT+Q7vl5VUMN9Jq4UDAir3i8mxK+Xk2UkFx3k3Uks uYfvc5gfsh7DTsLvN2ZEMa2FOhasY5leY01l4KAId1MwHUQ7lDqbHmt3j/xhwR2oEpUhg0R6xKn 0HWQw8a0= X-Gm-Gg: AYBFou3QKLt1SCZ4X2R5BiF+oOkn0dots/Gvhb+5oOCxQN9Vg2c/pHWhNC+WqCQ3+qq LR6sqHUDvMXhl09LcCcMihrfVddQ8v5QaU1Vt9fT2sRJHGAZDKjk7KEp1hkzw8fNSbG8OLa/6Ye uIa908yHJSsnoI3QDDwNgzYKKxTYdZGLiPw2vk1AwbETduYKpsYYFq2T3PvZTctu+0rMpWddDGl iU+1Yh7+/zJyfWFGzl45FhpdTiIKwDFEYGCq6GPEO68Kj50h4UZ1ooaOUYhlrr2AHoGI40+WYYk ic86kHqN0AnjnVNjjfNbgsiEkmp3sqavxQ4rh9fVkTYZef12d4C/23aCia3oHsFvfrZs7Mm3uz+ B9csqrCXq+p5RAPpAM2VpWGp1fcmpaEl8HrhJt2yfhrgGCxxqeCy0PvoTo6z8iZUYUVmSvo6pSX An57TE7AUBa3eRIjR2LoFtLdbfQ4p+cxg6Sh0/NZRcmuA+GLK4ha59sFDPlC/St+NJ2WFxTvKnd iqSzUBi9VBSIr7IsTdqUXfkfVPDLhpZQ1dBCtJN4fmvKpFXtKL1kVFeUh8wLhs8RBOVjHIm0k3e za0+FqtWFm4+wWtm04y7njnnvCYcmL7jfiPvC9CE7cefRgs0GIqDwNrg3eiGaiVu8iM2/gX3+nQ DP7RYoNhpyhMejW/513RsGJLQy+1U X-Received: by 2002:a05:600c:3e0b:b0:4a4:4d57:8462 with SMTP id 5b1f17b1804b1-4ba09383e7cmr28315575e9.24.1794387808808; Wed, 11 Nov 2026 01:03:28 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.27 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:27 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 12/35] kernel-fit-image: add FIT_LOADABLE_* variables to do_compile vardeps Date: Wed, 11 Nov 2026 10:02:38 +0100 Message-ID: <99cab6528506fe9d78aa856484ca50c95490df38.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249984 From: Adrian Freihofer do_compile only reads the per-loadable flags of the FIT_LOADABLE_* variables with d.getVarFlag('FIT_LOADABLE_*', loadable), never their values. As the flag names are not literals, bitbake cannot track these accesses, so the flags are not part of the do_compile signature. Changing e.g. FIT_LOADABLE_LOADADDRESS[atf] did not trigger a rebuild and a stale FIT image was reused. When FIT_LOADABLES is set, add the FIT_LOADABLE_* variables to do_compile[vardeps] with a single appendVarFlag call after the loop that already processes them. Referencing a variable includes all its flags in the signature. While at it, fix the duplicated word in the comment. This is a fixup for commit 2535427d8de0 "kernel-fit-image: support arbitrary loadables" Signed-off-by: Adrian Freihofer Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 418a35dd0b4a6d0ccddb49047f059120907f6061) Signed-off-by: Yoann Congal --- meta/classes-recipe/kernel-fit-image.bbclass | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/meta/classes-recipe/kernel-fit-image.bbclass b/meta/classes-recipe/kernel-fit-image.bbclass index cfe43a5a306..db4798d0818 100644 --- a/meta/classes-recipe/kernel-fit-image.bbclass +++ b/meta/classes-recipe/kernel-fit-image.bbclass @@ -32,17 +32,19 @@ python () { # Parse loadables config loadables = d.getVar('FIT_LOADABLES') if loadables: - # Check that the loadables configuration variables are not set directly - # directly, then assign them a synthetic value for testability purposes - for v in ['FIT_LOADABLE_ARCH', 'FIT_LOADABLE_COMPRESSION', - 'FIT_LOADABLE_DESCRIPTION', 'FIT_LOADABLE_ENTRYPOINT', - 'FIT_LOADABLE_FILENAME', 'FIT_LOADABLE_LOADADDRESS', - 'FIT_LOADABLE_OS', 'FIT_LOADABLE_TYPE']: + # Forbid direct assignment, set synthetic values for testability and + # add the vars to vardeps so their flags are part of the signature. + loadable_vars = ['FIT_LOADABLE_ARCH', 'FIT_LOADABLE_COMPRESSION', + 'FIT_LOADABLE_DESCRIPTION', 'FIT_LOADABLE_ENTRYPOINT', + 'FIT_LOADABLE_FILENAME', 'FIT_LOADABLE_LOADADDRESS', + 'FIT_LOADABLE_OS', 'FIT_LOADABLE_TYPE'] + for v in loadable_vars: if d.getVar(v): raise bb.parse.SkipRecipe("You cannot use %s as a variable, you can only set flags." % v) synt_value = " ? ".join([ d.getVarFlag(v, loadable) or "" for loadable in loadables.split() ]) d.setVar(v, synt_value) + d.appendVarFlag('do_compile', 'vardeps', ' ' + ' '.join(loadable_vars)) } do_configure[noexec] = "1" From patchwork Wed Nov 11 09:02:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103707 Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5583.1794387811270436077 for ; Wed, 11 Nov 2026 01:03:31 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=b9DQDYgF; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-4a35ac4475dso19975655e9.2 for ; Wed, 11 Nov 2026 01:03:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387809; x=1794992609; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=RkLB38soqeHUvFOxU4a8VMAsI0/sITWngKYEjxBLg90=; b=b9DQDYgFzwlJrbxsRODy9aOSHOMWt/eu8Z6Lj+ZWhlvNyuDvXQb0FkkR0lejjQQ4JR 3zX6gwJBa5mjzuvwHpAeZbNcHJDhU/BYN6HbGiirFUBHrlHVFT4i1IWuhbIovFL0QzUQ Rb2o8frZwzD6iLJrwG3wHXZZWHpc7CIiNqrR1UPr137KQiNxNJADotuaDZqqClVxTTXZ ZP3XhjygaiQa37LqIuk1Ya44YbR36bhSlG+P9NyIuS3j4aN5C9c7VsV3WaR9qvT7WrSE cpN81ySjThHuIuuC2VH6btzJZ1xAhfsdSOjHC3Qy6qhnyERdNWIUWXPSbW5QKPpobYo6 dHRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387809; x=1794992609; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=RkLB38soqeHUvFOxU4a8VMAsI0/sITWngKYEjxBLg90=; b=zlXZNOedMh6ngRDV6ivqikDcbq2nNSYX9qIaOZtheowgwQYoDrivlQtT6ixyxse2jO icDoc6q5C1leUfuk1ruFIN0DZe12I2C0eEB/EW/Uv2IsqK+QujydlUCgY2hntnaaz5Rz iAJtn6PM9BlqZIWV0qOrJS6bzbhmxcNav76ppJuzz2dfKG317UUAnxGVBVhTfOVRgm6L oNn3Lqkl7VW0bpcLFzzH3WVS0AGRLS3FNvhNoA6nUkzzTlY6ew6GXvJwifTW4RkXl9CR NeXO5lRL0BQHSQs2GCaTSfIjV6EMMXipz30qW5md/E/OhDKEUk1g9uxymVhpOZsF8CZu yw8w== X-Gm-Message-State: APuU4Z8xc9wlYM41rs9ygPiUsydN/dMAhPZgTqvCvl3bubx3nwffaEAD BALYwnQrx7HqX70EQfmtxyFyRcDWiOAZvsOMi8bmAnfFqovVo5yAqJwuzpxnzLvmEbxkVmzCD4G rbLmepfY= X-Gm-Gg: AYBFou05vPX2zPYNnVHl/Mdz8uVqmREv/bEA9Lb8Gm7iPQax7+uO6lqZ+32zPW5TFjn IdGADoKa08mWqRPxx1dDBmVqTjTex81Xiq+QIz9FRkxt4HQ6JUPj3ci8hRxG5akB5PPn8I/0NH7 sNzsCrOzyfCMdg9V6tkeK0Mxbk7Aj+ekYPGNRqlL+U6Q8QxUXBSlEq2OwNqYzwrFMtUy0Gmy2Db Eybk+ybA9ZkDKS14dY5B5d5uxTfDFNvtwN0QzUZC3ifG7xw5NbULuQ77zwDpJ5wiLtSIrsgz0ph +O8euX6RwK5mGhoIYzeg01FQXn3Z/lE3R9D+krKe+wbcah0wf1RmtMSX84ohRQmzM+T4zXrP+Wp FTi20Xsf5bbNs1aR3Zx0h61hdEAi4iklScOmKuZogp8PWkI7hS/3ZjXrrfb7vV5naPRnp9Pdesf hYBPNBkpTCvcBZ/rlHgEQla1ldFBOIyB9V1m8pETwPXUD6rT++dfs/Xlio6ATzxrqTAyIz4ZM5d YTRjsafMvtlwiIlWGmPqY7Br/HC2ZXWCRm7D8gSoeBTBwVLCGmeuGYokWtX+qm5KSNg3br5DhjP 1doEwUN5Te1IuIdr0EJKoBS2ZU8iA2mPswt/fpFWgfqmxx652TuzmX5xl752JtfHy7RbV0gPwAt S2h4rTbHVDzJxZd1QXOPvUTaG+lLXjCewlKg0DRlM7cEi06R6cg== X-Received: by 2002:a05:600c:3486:b0:4ba:6d8:dfaa with SMTP id 5b1f17b1804b1-4ba0936e95bmr31835265e9.12.1794387809428; Wed, 11 Nov 2026 01:03:29 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.28 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:29 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 13/35] boost: patch CVE-2023-34399 Date: Wed, 11 Nov 2026 10:02:39 +0100 Message-ID: <5c95f8552caaf86ea1047b0e5ce96202f2d0435f.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249985 From: Peter Marko Pick patch referencing this CVE. Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit ba56fd3e9258e2351c31a402d63ac470d43c8d54) Signed-off-by: Yoann Congal --- .../boost/boost/CVE-2023-34399.patch | 35 +++++++++++++++++++ meta/recipes-support/boost/boost_1.90.0.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta/recipes-support/boost/boost/CVE-2023-34399.patch diff --git a/meta/recipes-support/boost/boost/CVE-2023-34399.patch b/meta/recipes-support/boost/boost/CVE-2023-34399.patch new file mode 100644 index 00000000000..f2dbccd67e9 --- /dev/null +++ b/meta/recipes-support/boost/boost/CVE-2023-34399.patch @@ -0,0 +1,35 @@ +From d772add4873bb2501d67554190c4272294d659f9 Mon Sep 17 00:00:00 2001 +From: Johnathan <39648915+TrebledJ@users.noreply.github.com> +Date: Wed, 19 Aug 2026 16:50:08 +0200 +Subject: [PATCH] Reject a negative class id when loading a pointer (#332) + +A pointer carries the class id of what it points at, and a null pointer +carries -1. On the way back in, only -1 was recognised as the null tag, +and the id then indexed the class table with an upper bound check but no +lower bound one, so an archive carrying any other negative id read that +table at an offset of its own choosing. This is CVE-2023-34399. + +Treat every negative id as the null tag. No archive a released version +ever wrote carries one other than -1, so nothing that used to load stops +loading. + +CVE: CVE-2023-34399 +Upstream-Status: Backport [https://github.com/boostorg/serialization/commit/d772add4873bb2501d67554190c4272294d659f9] +Signed-off-by: Peter Marko +--- + libs/serialization/src/basic_iarchive.cpp | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libs/serialization/src/basic_iarchive.cpp b/libs/serialization/src/basic_iarchive.cpp +index 1c6eb2047..b5c63c9ad 100644 +--- a/libs/serialization/src/basic_iarchive.cpp ++++ b/libs/serialization/src/basic_iarchive.cpp +@@ -427,7 +427,7 @@ basic_iarchive_impl::load_pointer( + class_id_type cid; + load(ar, cid); + +- if(BOOST_SERIALIZATION_NULL_POINTER_TAG == cid){ ++ if(/* BOOST_SERIALIZATION_NULL_POINTER_TAG */ cid < 0){ + t = NULL; + return bpis_ptr; + } diff --git a/meta/recipes-support/boost/boost_1.90.0.bb b/meta/recipes-support/boost/boost_1.90.0.bb index 4b580d078be..c66f182384d 100644 --- a/meta/recipes-support/boost/boost_1.90.0.bb +++ b/meta/recipes-support/boost/boost_1.90.0.bb @@ -4,4 +4,5 @@ require boost.inc SRC_URI += "file://boost-math-disable-pch-for-gcc.patch \ file://0001-Don-t-set-up-arch-instruction-set-flags-we-do-that-o.patch \ file://0001-dont-setup-compiler-flags-m32-m64.patch \ + file://CVE-2023-34399.patch \ " From patchwork Wed Nov 11 09:02:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103708 Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5603.1794387811797484176 for ; Wed, 11 Nov 2026 01:03:32 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=avdg2aEk; spf=pass (domain: smile.fr, ip: 209.85.221.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f52.google.com with SMTP id ffacd0b85a97d-492f0a1b685so2006381f8f.0 for ; Wed, 11 Nov 2026 01:03:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387810; x=1794992610; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=zh/1PiEA4O8qvUq31Ynz3dL5zmoZA1lU4wr+AaZd/P4=; b=avdg2aEk9uw0W1tRanJDkz6u2hs8tobP8ASVjk6Y2udRg8Ut3CUkmhQB9atXUKCCle LwRfHoK+0nAAHaPKq4RiyJOfyPXAo6xkgtTdPyAzPbSkm+jkCLvcj4HDnlkyBTSI9TGJ mC96V8FjbJg1PdUHBsjxeYpAjpqISJ8dTbYEm0SYk1vUVZQz0v3WhHIP9FwBC15ThYHe lxcaCgHbyRcKOFsF8k/8E1VjFryTQnDI7QPE+5kLflwjpVJnoGuxtGU5wX0AHcI7GAg9 i1CjHxzy10/hYlqNrSHiOnG0ex+3V5HiyS8pQBrGudl4n8n0x85i+azgny1+RmjGCYFD QteQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387810; x=1794992610; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=zh/1PiEA4O8qvUq31Ynz3dL5zmoZA1lU4wr+AaZd/P4=; b=AfgCqcQZomgbAP0qYQHKAi6TXAR+JcDj88dquBqzszz35yclsl7E5tk/tIfgMALgd8 JvEvrrtAyQhJgihleA2e118S/zQqFrPpej8t+/eQHTuhQkGjhr+ztfa8C1tHvxu2ZvuO SMpR/ff2H/Mk9PiH1GFPNkzj99ryO1Z5ZquSV8lk3WN5l3+FOYre6f+/LYbhH80r2bfV DKhNUCLS7KXUnFvVoI/nFrfJN+IeF6mU/JjMLTlrgQbPZ6Wf+9LdpzrF9AvM1Jcr/1uR BB2xzbGIBv/t5GMD2MHJfnXZCN6htI9wDKFLuh77pVGW+ue313W0Xmg6/udvdx7U8FXo Dicg== X-Gm-Message-State: APuU4Z9+y9nNTp7FfttHz1kWII8zahEaC8JWdtEnVYqoEYvk2wBlsc7g xZbGrLYbfsrAhv0XmwR/Zqy4mBRmax1d//EXw2rCy0lWyK58Rf5XmNQ2lIRBOTx06WpQPkGbl8K zYXmPO+A= X-Gm-Gg: AYBFou16UvvvuRtXWws1D/tUSTy8qzuFoVR7zpID+b3Uc3jqC5EZWfamCUXYRLFozx6 5ZHHhTt0hd6gJX0B0GVYLVIwPxyyGB0Cgk0YC/5iDfBfgem0plZQyPpwASTIYNtTFAGfhpHTAz6 4XKBSauhTpbMCfy1PbOzWeiETrh/XqqLwvuGU5UPUwdPCK5hTNi39Q4FyMRN0cUxxSxUPmWzht1 cVH/AopDxwTXWCd2M/BJEpNvfjJSXmzrpSVSU3Hp8y7GeKi1woXBTUfViQMBX9/T0K8+4I8PpXj 72fq9uJB5fMUb5jkl+yo3VCb5xlXD9XUeNWGZoQmbyi+EjtaMb8guIZRFOoSp6yNNGZ7bdRL3Gx 4hIXZGmDTJBn+MkqoTDTikPoLRjOfsaSaAgl+4bbsJDeXS/B1RQEQxBe5AV/LTFhtZZus70N83F vdIrHENkEX7eR3EXftpXSjvqfvwC1oWXEaNoGypE6pCDXSeb2Vu2I5rPA8lFUBs+XyvXcgedllp Izln3m/rkEvbt4xnUo8IfmE6n1SkU3SFa+bNDmTeM30dTulKgBbOjNQx4/qEk3lqCPLqjSfguQT PDiFHEYEB6SMVCooNUQgCCayn1aHamw5uJxTKZbFA17yBs5EE65LRnc/YHvBLPkuXC6wJuf4DSd eocQr1ytX4n2T4riGkCuK6geuo65S X-Received: by 2002:a05:600c:810c:b0:4a3:59c9:a756 with SMTP id 5b1f17b1804b1-4ba09364b9emr26022055e9.6.1794387809930; Wed, 11 Nov 2026 01:03:29 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.29 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:29 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 14/35] go: upgrade 1.26.9 -> 1.26.10 Date: Wed, 11 Nov 2026 10:02:40 +0100 Message-ID: <424a3c4187c0e04f65e6f6bc52ad75fba6427d70.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249986 From: Peter Marko Upgrade to latest 1.26.x release [1]: $ git --no-pager log --oneline go1.26.9..go1.26.10 4e8c85f531 (tag: go1.26.10) [release-branch.go1.26] go1.26.10 aa64342a9e [release-branch.go1.26] crypto/x509: distrust a handful of intermediates 51e7ce32a8 [release-branch.go1.26] cmd/internal/moddeps: restore tests Fixes CVE-2026-111943 Release information: [2] [1] https://github.com/golang/go/compare/go1.26.9...go1.26.10 [2] https://groups.google.com/g/golang-announce/c/66pojueaQek Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a typo in git log command] --- meta/recipes-devtools/go/{go-1.26.9.inc => go-1.26.10.inc} | 2 +- ...-binary-native_1.26.9.bb => go-binary-native_1.26.10.bb} | 6 +++--- ...ross-canadian_1.26.9.bb => go-cross-canadian_1.26.10.bb} | 0 .../go/{go-cross_1.26.9.bb => go-cross_1.26.10.bb} | 0 .../go/{go-crosssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} | 0 .../go/{go-runtime_1.26.9.bb => go-runtime_1.26.10.bb} | 0 meta/recipes-devtools/go/{go_1.26.9.bb => go_1.26.10.bb} | 0 7 files changed, 4 insertions(+), 4 deletions(-) rename meta/recipes-devtools/go/{go-1.26.9.inc => go-1.26.10.inc} (90%) rename meta/recipes-devtools/go/{go-binary-native_1.26.9.bb => go-binary-native_1.26.10.bb} (80%) rename meta/recipes-devtools/go/{go-cross-canadian_1.26.9.bb => go-cross-canadian_1.26.10.bb} (100%) rename meta/recipes-devtools/go/{go-cross_1.26.9.bb => go-cross_1.26.10.bb} (100%) rename meta/recipes-devtools/go/{go-crosssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} (100%) rename meta/recipes-devtools/go/{go-runtime_1.26.9.bb => go-runtime_1.26.10.bb} (100%) rename meta/recipes-devtools/go/{go_1.26.9.bb => go_1.26.10.bb} (100%) diff --git a/meta/recipes-devtools/go/go-1.26.9.inc b/meta/recipes-devtools/go/go-1.26.10.inc similarity index 90% rename from meta/recipes-devtools/go/go-1.26.9.inc rename to meta/recipes-devtools/go/go-1.26.10.inc index e2657cf8ad8..035da371f22 100644 --- a/meta/recipes-devtools/go/go-1.26.9.inc +++ b/meta/recipes-devtools/go/go-1.26.10.inc @@ -16,4 +16,4 @@ SRC_URI += "\ file://0009-go-Filter-build-paths-on-staticly-linked-arches.patch \ file://0010-cmd-go-clear-GOROOT-for-func-ldShared-when-trimpath-.patch \ " -SRC_URI[main.sha256sum] = "9735d7dcdb65b35d3fa577f04064737c03b89cf1a2b71e6e69fe2f3c6f9fd4ca" +SRC_URI[main.sha256sum] = "fd63e883ba2f2bfca93c1646b31ebef63e2b1e4d2b317c9789d976a68d81f36f" diff --git a/meta/recipes-devtools/go/go-binary-native_1.26.9.bb b/meta/recipes-devtools/go/go-binary-native_1.26.10.bb similarity index 80% rename from meta/recipes-devtools/go/go-binary-native_1.26.9.bb rename to meta/recipes-devtools/go/go-binary-native_1.26.10.bb index a42ce443604..67201c8b748 100644 --- a/meta/recipes-devtools/go/go-binary-native_1.26.9.bb +++ b/meta/recipes-devtools/go/go-binary-native_1.26.10.bb @@ -9,9 +9,9 @@ PROVIDES = "go-native" # Checksums available at https://go.dev/dl/ SRC_URI = "https://dl.google.com/go/go${PV}.${BUILD_GOOS}-${BUILD_GOARCH}.tar.gz;name=go_${BUILD_GOTUPLE}" -SRC_URI[go_linux_amd64.sha256sum] = "42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d" -SRC_URI[go_linux_arm64.sha256sum] = "4a97373d49fcacdcf3694fea368a500b00ee3e963974f3e7514132717632f052" -SRC_URI[go_linux_ppc64le.sha256sum] = "a21a65001146ca0c6c022c690d5418f8298c5513a81fb5eed42f6cdb29f40063" +SRC_URI[go_linux_amd64.sha256sum] = "ccfe7ae822d2c2f41f4fe7c956199967a4dac22d0ee0d2b2bfdb440aab3b20c5" +SRC_URI[go_linux_arm64.sha256sum] = "3f4227ce7b206a513e794f1393adb473a07b46e94d18bd15d1c684bbb7319797" +SRC_URI[go_linux_ppc64le.sha256sum] = "4492031a19657de3bd7e4c48dce9d9e5aa7b668300f7c2c98e620b9ac0ee84ee" UPSTREAM_CHECK_URI = "https://golang.org/dl/" UPSTREAM_CHECK_REGEX = "go(?P\d+(\.\d+)+)\.linux" diff --git a/meta/recipes-devtools/go/go-cross-canadian_1.26.9.bb b/meta/recipes-devtools/go/go-cross-canadian_1.26.10.bb similarity index 100% rename from meta/recipes-devtools/go/go-cross-canadian_1.26.9.bb rename to meta/recipes-devtools/go/go-cross-canadian_1.26.10.bb diff --git a/meta/recipes-devtools/go/go-cross_1.26.9.bb b/meta/recipes-devtools/go/go-cross_1.26.10.bb similarity index 100% rename from meta/recipes-devtools/go/go-cross_1.26.9.bb rename to meta/recipes-devtools/go/go-cross_1.26.10.bb diff --git a/meta/recipes-devtools/go/go-crosssdk_1.26.9.bb b/meta/recipes-devtools/go/go-crosssdk_1.26.10.bb similarity index 100% rename from meta/recipes-devtools/go/go-crosssdk_1.26.9.bb rename to meta/recipes-devtools/go/go-crosssdk_1.26.10.bb diff --git a/meta/recipes-devtools/go/go-runtime_1.26.9.bb b/meta/recipes-devtools/go/go-runtime_1.26.10.bb similarity index 100% rename from meta/recipes-devtools/go/go-runtime_1.26.9.bb rename to meta/recipes-devtools/go/go-runtime_1.26.10.bb diff --git a/meta/recipes-devtools/go/go_1.26.9.bb b/meta/recipes-devtools/go/go_1.26.10.bb similarity index 100% rename from meta/recipes-devtools/go/go_1.26.9.bb rename to meta/recipes-devtools/go/go_1.26.10.bb From patchwork Wed Nov 11 09:02:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103709 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5604.1794387812356130871 for ; Wed, 11 Nov 2026 01:03:32 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=TvFdyUGA; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a5b2be99a8so24060855e9.2 for ; Wed, 11 Nov 2026 01:03:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387810; x=1794992610; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=yjAxNga6EO4mmrQl2psT2pClfH4VGNw8u11BFyCc9tc=; b=TvFdyUGAZkQPMjuba+8SomR03XbCen5VUDEta4/fqNkq5Jp/YJ9ljc5rhBIyXmD3dj NuYPfUu01jCAUinlELesaGhTU+9oOlyvyAuOK3mkU+pJz3aAzagpgiGyARUejfv3xydj izqQY+7n8G+VqCnegIn4ojiqJxnrAqzJ9RGUgO7u3OOTLBmdR6inQLwGcr/fJbKQPC+9 TvBttOEDMDUb0g7mO2358+9aw7hYPl5wBXDrR3z2xNAm4ipXmSUaGVAj8XiIynQot1ID Fm3p2IzP5yaov8TQ6eAiy/4T2tyz3Bk99EQsXwyQ5mCQIS4qDBUso5tXEC3PFhVYzKJJ CFHg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387810; x=1794992610; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=yjAxNga6EO4mmrQl2psT2pClfH4VGNw8u11BFyCc9tc=; b=S4Yo+iIq3e/iXyCg1Mfc8NREzU2UgB6CZHG/jzvrz0kh+z2+GNwrqGw27997HQWq37 VK3kj3J9/O8e0q+l61yZJW97Ck+TSvuPLw7KfsgDThLvVB7cPNps5dQMg+F3JQsURRVi 3JRk3pdfGDphdk4vFHNnHkhRmhlVREh97Tw0oeyv7z6rP1nnDr1EHgLe14y5CV6NyPEI EN62r4WMCqXpzEdc/aOIbRgRhaGqDnAS/guAKg/SXoj9Ex+WZM+GAy/VnxG6xAjm8ZA7 dq6X7WdSbg5Ic+9voImWCEd2MLNmc9zlSFdwb7mHzPNuKuZ0aMtMgkANpDTXZDswWcxd FsPQ== X-Gm-Message-State: APuU4Z/QdlLHMAgkp6CoQeOxxzqDllzfGjKXZpGXlKiWgXhCjqpTErOv Dy7U6V10agZlwypck/UlSJrkeRWRKD83BRAgl5lZAtrFo4yGyr8YywnC/zN02p1STmixMi9kjix x1iLZ/z8= X-Gm-Gg: AYBFou1BtcZjf2if49SAVNJ7sd5BsVDY1FFP1JM6RjQhtbW9VJ9Wxg5t1Bs9M0c8SUN CDIIVXRDpPyNP0292vSX1xawvjmYVr7QI2eVf4OphOOix4R4vigY5EQeu9PI2nFKdwBCyFH/0Dp 76gBdUEdlnYvv/VUkNSUT8x6kT6AmFSOnWpsKnI2679fyu3FkHX4dfhisbF/Jhf9bRtGdC73v9l DvMNvIjV0RJ+w/WZyV0I7n+NgjzdAbOwekWWEhYqvWfa1O6uGU/G5bhX7fdZi+CNb8w4gpMs6Vi 5TKktlsM+zcEjv+EgE675RhK8QuHAZ8pSiTqPOzq3YXjQiIaTb+UKjs9TYGePMhC9NrCI5dtz78 Lkght4ULI+Gt47b11TZ+YNjfs07sedtcvc/hx1ZGPIHR7gfUJVJpjmgShZR1spTHbGXxdNKQdHY oQFR2HvAucIPVVE/fFNj0NhOcp3pPnVBdmNDUd2d3M2iVwJNr4/mxtlGoRZ/rwmmtqc/sjSBN30 cSr3KK1s5/5PG7IhPXw4oVgQR7pWqlbavWg7//mOYbQbCSJFQJsHJPBG3hvzPwRyFV4n0g5sb/t MLyONoJpIpMEzseZDc0v4IfSk2uAJ5fDdA4X34MR/h72Ok18Shpg/sOhsuapno0s8GLrTJnLqQM 5qlSxpXf52Wi/tyR7toH8MXTlWd6DBsrkEM+DqxfSjU8tPmpLWw== X-Received: by 2002:a05:600c:4e87:b0:4b2:61e5:b2f4 with SMTP id 5b1f17b1804b1-4ba09358157mr28021885e9.11.1794387810583; Wed, 11 Nov 2026 01:03:30 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:30 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 15/35] glib-2.0: patch CVE-2026-16118 Date: Wed, 11 Nov 2026 10:02:41 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249987 From: Peter Marko Pick patch referencing this CVE. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../glib-2.0/files/CVE-2026-16118.patch | 48 +++++++++++++++++++ meta/recipes-core/glib-2.0/glib.inc | 1 + 2 files changed, 49 insertions(+) create mode 100644 meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch diff --git a/meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch b/meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch new file mode 100644 index 00000000000..72a387079e0 --- /dev/null +++ b/meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch @@ -0,0 +1,48 @@ +From ca75aff83af9875ea2ad2bfbe48a85dfd99c2ce5 Mon Sep 17 00:00:00 2001 +From: Kashyap Ekbote +Date: Wed, 5 Aug 2026 20:50:10 +0530 +Subject: [PATCH] Fix CVE-2026-16118: heap-buffer-overflow in xdgmimemagic.c + +Fix out-of-bounds write in the byte-swap routine of +_xdg_mime_magic_parse_magic_line(). On little-endian systems, the +write side of the swap casts the base pointer to a wider type before +adding the byte offset, causing pointer arithmetic to scale by +sizeof(type) instead of 1. With value_length=4 and word_size=2, the +loop writes 2 bytes past the allocated matchlet->value buffer at i=2. + +Parenthesize (ptr + i) before the cast so both the read and write +sides use byte offsets. + +Upstream: https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41 + +CVE: CVE-2026-16118 +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/ca75aff83af9875ea2ad2bfbe48a85dfd99c2ce5] +Signed-off-by: Peter Marko +--- + gio/xdgmime/xdgmimemagic.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/gio/xdgmime/xdgmimemagic.c b/gio/xdgmime/xdgmimemagic.c +index 98a1274c8..fe374eb4e 100644 +--- a/gio/xdgmime/xdgmimemagic.c ++++ b/gio/xdgmime/xdgmimemagic.c +@@ -483,15 +483,15 @@ _xdg_mime_magic_parse_magic_line (FILE *magic_file, + for (i = 0; i < matchlet->value_length; i = i + matchlet->word_size) + { + if (matchlet->word_size == 2) +- *((xdg_uint16_t *) matchlet->value + i) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->value + i))); ++ *((xdg_uint16_t *) (matchlet->value + i)) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->value + i))); + else if (matchlet->word_size == 4) +- *((xdg_uint32_t *) matchlet->value + i) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->value + i))); ++ *((xdg_uint32_t *) (matchlet->value + i)) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->value + i))); + if (matchlet->mask) + { + if (matchlet->word_size == 2) +- *((xdg_uint16_t *) matchlet->mask + i) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->mask + i))); ++ *((xdg_uint16_t *) (matchlet->mask + i)) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->mask + i))); + else if (matchlet->word_size == 4) +- *((xdg_uint32_t *) matchlet->mask + i) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->mask + i))); ++ *((xdg_uint32_t *) (matchlet->mask + i)) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->mask + i))); + + } + } diff --git a/meta/recipes-core/glib-2.0/glib.inc b/meta/recipes-core/glib-2.0/glib.inc index 7e7725f9bd3..aec875a3dff 100644 --- a/meta/recipes-core/glib-2.0/glib.inc +++ b/meta/recipes-core/glib-2.0/glib.inc @@ -237,6 +237,7 @@ SRC_URI += "\ file://skip-timeout.patch \ file://CVE-2026-58016-1.patch \ file://CVE-2026-58016-2.patch \ + file://CVE-2026-16118.patch \ " SRC_URI:append:class-native = " file://relocate-modules.patch \ file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \ From patchwork Wed Nov 11 09:02:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103701 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5584.1794387813625743494 for ; Wed, 11 Nov 2026 01:03:33 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=Oq23Ys6O; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4a4d7ae1ae9so26923405e9.1 for ; Wed, 11 Nov 2026 01:03:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387812; x=1794992612; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=LBu0TR1KHx/CnTCDLb0WcZswaEplaUMLMGOPOpct+Ds=; b=Oq23Ys6O061vC6h+N515YjNrwk29FYIpPIk39O1I4ynTI14Zl9yC6/wVSbSLpOiKPM zdc8ZomcmoMILr1EkbQjrBR4JEy1itwEl5E3SpRttNqdBCvhXGpjpM+5Gfd4rH6Kd6Fc ouZOrlu0ojOMUC8eNH8aHLPOTPuR6Ro7Rk9vhzAyunzhhM2ue/GtZn47JqJgKJOk09nt Ht8nR8dK5HfWbg+C8mLQGS7f7pr5+MFpog1rv2f3D2K5IiUmbOEi21dJPAWkVLOU9wOX Lov1KxyDKu6oxVOfvjzmaQvnysauAg23Qpt8RCbOXArUZGYUF04l0UwggwrI56OXc7WY mJGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387812; x=1794992612; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=LBu0TR1KHx/CnTCDLb0WcZswaEplaUMLMGOPOpct+Ds=; b=RrjV62Txw2NXU11iOfZLzbuCFQ2bZRSHlfHsR8HnutQ8FyF5uwuir4oOrkISwj3xKe FuOTc7xz0mXX6MgTwUQtC1ZF0ZvFX88YYMyMjC5y4ERPkEsLKB4BSUhfBc4VV4vmanA3 LWbJto5590eYOoVhmCg5UrKHSnUqg3IR7Nr5cADzppv5f78Z2WSgJmPDGPnCwX1PxWvc 1CAp51D2AWBrYcGFit85k18+hWad/Jq+cUlEn4MFcGMXN5l7awxQU3n/9n1FFFFf/kqY PbNnJoopmpsDMVTXaChjGSbrkRlJWMKrA4IxXyc0b9tNDGbzdVfh5n0CsfVMUsRh44p2 FyNQ== X-Gm-Message-State: APuU4Z8tsfuR85AJaYuJnchoA4aqDdGA06SyG1CXYYCF518qr1YaP3zI cSc73nJGcYXFLKhdubz4i8xMNGkvkv9M/JM9gRNuKfbVcLBFP9ZfJmgTGd7Z8p5qSrjDc4rqsZU gxzcaRcA= X-Gm-Gg: AYBFou0pS5+08lyrbRA0UqvKjXoFh6c8Ovaim375HmPmTc7HyqfggFVnQZZiz2xZ9wa QOBzvueJaMHjaqsii9/V6/EBuMscqz7TBZhVr8HXXrBMSArWhQ/hxPCUc5bCFAaFxF5SfelrhtG 5H3ObzL1++jXNWT+WX3A2dG4GOeQE+48BZfEdDOlJZi7Ncwz0mqUQE6GCRIkrKG5c/W1QBceM9R xiEnoQaTYehnCv3t/JiqaTvMDfXPWt3vtb1lNg/HhUH/LDhW2p+97/UEP5EPrwHS4pTBGx0eiy6 yepMckydSOHKoaUy+xoohtrChRn/WJk7U7gpmBQJ5GVzvRhKM921qJiSgyZbjUL0ajIikchjIhY RO38+WoGvNmTcGxPl3zJVqObPT3n8o4+DHjJRA2UDCBVkLb/y6FvewkI2GpNrzSsMLxaF4flX0J K/ZgGTjShtRN4+D9oPgicOftDtI4MzEkZFIMrT+1IKIpU3URwu1wiigKO8gmkj5Cr/JQU56BY8U +rgiaN0knvMNCcVJQCOEftbgICqxnzVXLduO+2zCypllKDpa7qJBMJyJ7GhHalHnFSdW2hMAEd7 pf4lWN3pnfwDbWtTtNYuP6cunZk62F5Diz8T8f3Ji7ikzsop7ZnoOF+MR714XJkwgsMY9EL1qBn ZNunzifZ8YtzJ4/S45sy1/Hr/iiY1 X-Received: by 2002:a05:600c:5489:b0:4a3:5a98:c279 with SMTP id 5b1f17b1804b1-4ba093582abmr29579805e9.8.1794387811538; Wed, 11 Nov 2026 01:03:31 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:30 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 16/35] python3-pip: patch the vendored python3-certifi Date: Wed, 11 Nov 2026 10:02:42 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249988 From: Jeroen Hofstee Like python3-certifi: remove emSign CAs. See https://emudhra.we-have-a-problem.com. Signed-off-by: Jeroen Hofstee Signed-off-by: Yoann Congal --- .../python3-pip/0001-Remove-emsign-437.patch | 142 ++++++++++++++++++ ...tore-unaffected-emSign-roots-439-440.patch | 108 +++++++++++++ .../python/python3-pip_26.0.1.bb | 2 + 3 files changed, 252 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch create mode 100644 meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch diff --git a/meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch b/meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch new file mode 100644 index 00000000000..31baa73511d --- /dev/null +++ b/meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch @@ -0,0 +1,142 @@ +From 0802dcc6194b35b0eeb86e52248ace5eadc300cd Mon Sep 17 00:00:00 2001 +From: Alex Gaynor +Date: Sun, 18 Oct 2026 12:19:26 -0400 +Subject: [PATCH 1/2] Remove emsign (#437) + +* Remove emSign CAs + +Co-Authored-By: Claude Opus 5.5 + +* 2026.10.18 + +Co-Authored-By: Claude Opus 5.5 +Signed-off-by: Jeroen Hofstee + +--------- + +Co-authored-by: Claude Opus 5.5 +(cherry picked from commit 5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8) + +Upstream-Status: Backport [https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8] +--- + certifi/cacert.pem | 104 --------------------------------------------- + 1 file changed, 104 deletions(-) + +diff --git a/certifi/cacert.pem b/certifi/cacert.pem +index fac3c31..d4e81a7 100644 +--- a/certifi/cacert.pem ++++ b/certifi/cacert.pem +@@ -2954,110 +2954,6 @@ jWZSaX5LaAzHHjcng6WMxwLkFM1JAbBzs/3GkDpv0mztO+7skb6iQ12LAEpmJURw + 3kAP+HwV96LOPNdeE4yBFxgX0b3xdxA61GU5wSesVywlVP+i2k+KYTlerj1KjL0= + -----END CERTIFICATE----- + +-# Issuer: CN=emSign Root CA - G1 O=eMudhra Technologies Limited OU=emSign PKI +-# Subject: CN=emSign Root CA - G1 O=eMudhra Technologies Limited OU=emSign PKI +-# Label: "emSign Root CA - G1" +-# Serial: 235931866688319308814040 +-# MD5 Fingerprint: 9c:42:84:57:dd:cb:0b:a7:2e:95:ad:b6:f3:da:bc:ac +-# SHA1 Fingerprint: 8a:c7:ad:8f:73:ac:4e:c1:b5:75:4d:a5:40:f4:fc:cf:7c:b5:8e:8c +-# SHA256 Fingerprint: 40:f6:af:03:46:a9:9a:a1:cd:1d:55:5a:4e:9c:ce:62:c7:f9:63:46:03:ee:40:66:15:83:3d:c8:c8:d0:03:67 +------BEGIN CERTIFICATE----- +-MIIDlDCCAnygAwIBAgIKMfXkYgxsWO3W2DANBgkqhkiG9w0BAQsFADBnMQswCQYD +-VQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBU +-ZWNobm9sb2dpZXMgTGltaXRlZDEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBH +-MTAeFw0xODAyMTgxODMwMDBaFw00MzAyMTgxODMwMDBaMGcxCzAJBgNVBAYTAklO +-MRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJhIFRlY2hub2xv +-Z2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEcxMIIBIjAN +-BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAk0u76WaK7p1b1TST0Bsew+eeuGQz +-f2N4aLTNLnF115sgxk0pvLZoYIr3IZpWNVrzdr3YzZr/k1ZLpVkGoZM0Kd0WNHVO +-8oG0x5ZOrRkVUkr+PHB1cM2vK6sVmjM8qrOLqs1D/fXqcP/tzxE7lM5OMhbTI0Aq +-d7OvPAEsbO2ZLIvZTmmYsvePQbAyeGHWDV/D+qJAkh1cF+ZwPjXnorfCYuKrpDhM +-tTk1b+oDafo6VGiFbdbyL0NVHpENDtjVaqSW0RM8LHhQ6DqS0hdW5TUaQBw+jSzt +-Od9C4INBdN+jzcKGYEho42kLVACL5HZpIQ15TjQIXhTCzLG3rdd8cIrHhQIDAQAB +-o0IwQDAdBgNVHQ4EFgQU++8Nhp6w492pufEhF38+/PB3KxowDgYDVR0PAQH/BAQD +-AgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFn/8oz1h31x +-PaOfG1vR2vjTnGs2vZupYeveFix0PZ7mddrXuqe8QhfnPZHr5X3dPpzxz5KsbEjM +-wiI/aTvFthUvozXGaCocV685743QNcMYDHsAVhzNixl03r4PEuDQqqE/AjSxcM6d +-GNYIAwlG7mDgfrbESQRRfXBgvKqy/3lyeqYdPV8q+Mri/Tm3R7nrft8EI6/6nAYH +-6ftjk4BAtcZsCjEozgyfz7MjNYBBjWzEN3uBL4ChQEKF6dk4jeihU80Bv2noWgby +-RQuQ+q7hv53yrlc8pa6yVvSLZUDp/TGBLPQ5Cdjua6e0ph0VpZj3AYHYhX3zUVxx +-iN66zB+Afko= +------END CERTIFICATE----- +- +-# Issuer: CN=emSign ECC Root CA - G3 O=eMudhra Technologies Limited OU=emSign PKI +-# Subject: CN=emSign ECC Root CA - G3 O=eMudhra Technologies Limited OU=emSign PKI +-# Label: "emSign ECC Root CA - G3" +-# Serial: 287880440101571086945156 +-# MD5 Fingerprint: ce:0b:72:d1:9f:88:8e:d0:50:03:e8:e3:b8:8b:67:40 +-# SHA1 Fingerprint: 30:43:fa:4f:f2:57:dc:a0:c3:80:ee:2e:58:ea:78:b2:3f:e6:bb:c1 +-# SHA256 Fingerprint: 86:a1:ec:ba:08:9c:4a:8d:3b:be:27:34:c6:12:ba:34:1d:81:3e:04:3c:f9:e8:a8:62:cd:5c:57:a3:6b:be:6b +------BEGIN CERTIFICATE----- +-MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG +-EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo +-bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g +-RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ +-TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s +-b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw +-djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0 +-WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS +-fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB +-zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq +-hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB +-CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD +-+JbNR6iC8hZVdyR+EhCVBCyj +------END CERTIFICATE----- +- +-# Issuer: CN=emSign Root CA - C1 O=eMudhra Inc OU=emSign PKI +-# Subject: CN=emSign Root CA - C1 O=eMudhra Inc OU=emSign PKI +-# Label: "emSign Root CA - C1" +-# Serial: 825510296613316004955058 +-# MD5 Fingerprint: d8:e3:5d:01:21:fa:78:5a:b0:df:ba:d2:ee:2a:5f:68 +-# SHA1 Fingerprint: e7:2e:f1:df:fc:b2:09:28:cf:5d:d4:d5:67:37:b1:51:cb:86:4f:01 +-# SHA256 Fingerprint: 12:56:09:aa:30:1d:a0:a2:49:b9:7a:82:39:cb:6a:34:21:6f:44:dc:ac:9f:39:54:b1:42:92:f2:e8:c8:60:8f +------BEGIN CERTIFICATE----- +-MIIDczCCAlugAwIBAgILAK7PALrEzzL4Q7IwDQYJKoZIhvcNAQELBQAwVjELMAkG +-A1UEBhMCVVMxEzARBgNVBAsTCmVtU2lnbiBQS0kxFDASBgNVBAoTC2VNdWRocmEg +-SW5jMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEMxMB4XDTE4MDIxODE4MzAw +-MFoXDTQzMDIxODE4MzAwMFowVjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln +-biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMRwwGgYDVQQDExNlbVNpZ24gUm9v +-dCBDQSAtIEMxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz+upufGZ +-BczYKCFK83M0UYRWEPWgTywS4/oTmifQz/l5GnRfHXk5/Fv4cI7gklL35CX5VIPZ +-HdPIWoU/Xse2B+4+wM6ar6xWQio5JXDWv7V7Nq2s9nPczdcdioOl+yuQFTdrHCZH +-3DspVpNqs8FqOp099cGXOFgFixwR4+S0uF2FHYP+eF8LRWgYSKVGczQ7/g/IdrvH +-GPMF0Ybzhe3nudkyrVWIzqa2kbBPrH4VI5b2P/AgNBbeCsbEBEV5f6f9vtKppa+c +-xSMq9zwhbL2vj07FOrLzNBL834AaSaTUqZX3noleoomslMuoaJuvimUnzYnu3Yy1 +-aylwQ6BpC+S5DwIDAQABo0IwQDAdBgNVHQ4EFgQU/qHgcB4qAzlSWkK+XJGFehiq +-TbUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL +-BQADggEBAMJKVvoVIXsoounlHfv4LcQ5lkFMOycsxGwYFYDGrK9HWS8mC+M2sO87 +-/kOXSTKZEhVb3xEp/6tT+LvBeA+snFOvV71ojD1pM/CjoCNjO2RnIkSt1XHLVip4 +-kqNPEjE2NuLe/gDEo2APJ62gsIq1NnpSob0n9CAnYuhNlCQT5AoE6TyrLshDCUrG +-YQTlSTR+08TI9Q/Aqum6VF7zYytPT1DU/rl7mYw9wC68AivTxEDkigcxHpvOJpkT +-+xHqmiIMERnHXhuBUDDIlhJu58tBf5E7oke3VIAb3ADMmpDqw8NQBmIMMMAVSKeo +-WXzhriKi4gp6D/piq1JM4fHfyr6DDUI= +------END CERTIFICATE----- +- +-# Issuer: CN=emSign ECC Root CA - C3 O=eMudhra Inc OU=emSign PKI +-# Subject: CN=emSign ECC Root CA - C3 O=eMudhra Inc OU=emSign PKI +-# Label: "emSign ECC Root CA - C3" +-# Serial: 582948710642506000014504 +-# MD5 Fingerprint: 3e:53:b3:a3:81:ee:d7:10:f8:d3:b0:1d:17:92:f5:d5 +-# SHA1 Fingerprint: b6:af:43:c2:9b:81:53:7d:f6:ef:6b:c3:1f:1f:60:15:0c:ee:48:66 +-# SHA256 Fingerprint: bc:4d:80:9b:15:18:9d:78:db:3e:1d:8c:f4:f9:72:6a:79:5d:a1:64:3c:a5:f1:35:8e:1d:db:0e:dc:0d:7e:b3 +------BEGIN CERTIFICATE----- +-MIICKzCCAbGgAwIBAgIKe3G2gla4EnycqDAKBggqhkjOPQQDAzBaMQswCQYDVQQG +-EwJVUzETMBEGA1UECxMKZW1TaWduIFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJbmMx +-IDAeBgNVBAMTF2VtU2lnbiBFQ0MgUm9vdCBDQSAtIEMzMB4XDTE4MDIxODE4MzAw +-MFoXDTQzMDIxODE4MzAwMFowWjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln +-biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMSAwHgYDVQQDExdlbVNpZ24gRUND +-IFJvb3QgQ0EgLSBDMzB2MBAGByqGSM49AgEGBSuBBAAiA2IABP2lYa57JhAd6bci +-MK4G9IGzsUJxlTm801Ljr6/58pc1kjZGDoeVjbk5Wum739D+yAdBPLtVb4Ojavti +-sIGJAnB9SMVK4+kiVCJNk7tCDK93nCOmfddhEc5lx/h//vXyqaNCMEAwHQYDVR0O +-BBYEFPtaSNCAIEDyqOkAB2kZd6fmw/TPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB +-Af8EBTADAQH/MAoGCCqGSM49BAMDA2gAMGUCMQC02C8Cif22TGK6Q04ThHK1rt0c +-3ta13FaPWEBaLd4gTCKDypOofu4SQMfWh0/434UCMBwUZOR8loMRnLDRWmFLpg9J +-0wD8ofzkpf9/rdcw0Md3f76BB1UwUCAU9Vc4CqgxUQ== +------END CERTIFICATE----- +- + # Issuer: CN=Hongkong Post Root CA 3 O=Hongkong Post + # Subject: CN=Hongkong Post Root CA 3 O=Hongkong Post + # Label: "Hongkong Post Root CA 3" +-- +2.53.0 + diff --git a/meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch b/meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch new file mode 100644 index 00000000000..f129adc4bbc --- /dev/null +++ b/meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch @@ -0,0 +1,108 @@ +From e82ee82a34e70a4fbf5003ba6cf2fcd62a24d764 Mon Sep 17 00:00:00 2001 +From: Nathan Neulinger +Date: Mon, 19 Oct 2026 21:10:51 -0500 +Subject: [PATCH 2/2] Restore unaffected emSign roots (#439) (#440) + +(cherry picked from commit 662df63d7906df66f1f07c0751a3dfe9da14d914) +Upstream-Status: Backport [https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914] +Signed-off-by: Jeroen Hofstee + +--- + certifi/cacert.pem | 81 ++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 81 insertions(+) + +diff --git a/certifi/cacert.pem b/certifi/cacert.pem +index d4e81a7..4c74ecd 100644 +--- a/certifi/cacert.pem ++++ b/certifi/cacert.pem +@@ -2954,6 +2954,87 @@ jWZSaX5LaAzHHjcng6WMxwLkFM1JAbBzs/3GkDpv0mztO+7skb6iQ12LAEpmJURw + 3kAP+HwV96LOPNdeE4yBFxgX0b3xdxA61GU5wSesVywlVP+i2k+KYTlerj1KjL0= + -----END CERTIFICATE----- + ++# Issuer: CN=emSign Root CA - G1 O=eMudhra Technologies Limited OU=emSign PKI ++# Subject: CN=emSign Root CA - G1 O=eMudhra Technologies Limited OU=emSign PKI ++# Label: "emSign Root CA - G1" ++# Serial: 235931866688319308814040 ++# MD5 Fingerprint: 9c:42:84:57:dd:cb:0b:a7:2e:95:ad:b6:f3:da:bc:ac ++# SHA1 Fingerprint: 8a:c7:ad:8f:73:ac:4e:c1:b5:75:4d:a5:40:f4:fc:cf:7c:b5:8e:8c ++# SHA256 Fingerprint: 40:f6:af:03:46:a9:9a:a1:cd:1d:55:5a:4e:9c:ce:62:c7:f9:63:46:03:ee:40:66:15:83:3d:c8:c8:d0:03:67 ++-----BEGIN CERTIFICATE----- ++MIIDlDCCAnygAwIBAgIKMfXkYgxsWO3W2DANBgkqhkiG9w0BAQsFADBnMQswCQYD ++VQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBU ++ZWNobm9sb2dpZXMgTGltaXRlZDEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBH ++MTAeFw0xODAyMTgxODMwMDBaFw00MzAyMTgxODMwMDBaMGcxCzAJBgNVBAYTAklO ++MRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJhIFRlY2hub2xv ++Z2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEcxMIIBIjAN ++BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAk0u76WaK7p1b1TST0Bsew+eeuGQz ++f2N4aLTNLnF115sgxk0pvLZoYIr3IZpWNVrzdr3YzZr/k1ZLpVkGoZM0Kd0WNHVO ++8oG0x5ZOrRkVUkr+PHB1cM2vK6sVmjM8qrOLqs1D/fXqcP/tzxE7lM5OMhbTI0Aq ++d7OvPAEsbO2ZLIvZTmmYsvePQbAyeGHWDV/D+qJAkh1cF+ZwPjXnorfCYuKrpDhM ++tTk1b+oDafo6VGiFbdbyL0NVHpENDtjVaqSW0RM8LHhQ6DqS0hdW5TUaQBw+jSzt ++Od9C4INBdN+jzcKGYEho42kLVACL5HZpIQ15TjQIXhTCzLG3rdd8cIrHhQIDAQAB ++o0IwQDAdBgNVHQ4EFgQU++8Nhp6w492pufEhF38+/PB3KxowDgYDVR0PAQH/BAQD ++AgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFn/8oz1h31x ++PaOfG1vR2vjTnGs2vZupYeveFix0PZ7mddrXuqe8QhfnPZHr5X3dPpzxz5KsbEjM ++wiI/aTvFthUvozXGaCocV685743QNcMYDHsAVhzNixl03r4PEuDQqqE/AjSxcM6d ++GNYIAwlG7mDgfrbESQRRfXBgvKqy/3lyeqYdPV8q+Mri/Tm3R7nrft8EI6/6nAYH ++6ftjk4BAtcZsCjEozgyfz7MjNYBBjWzEN3uBL4ChQEKF6dk4jeihU80Bv2noWgby ++RQuQ+q7hv53yrlc8pa6yVvSLZUDp/TGBLPQ5Cdjua6e0ph0VpZj3AYHYhX3zUVxx ++iN66zB+Afko= ++-----END CERTIFICATE----- ++ ++# Issuer: CN=emSign Root CA - C1 O=eMudhra Inc OU=emSign PKI ++# Subject: CN=emSign Root CA - C1 O=eMudhra Inc OU=emSign PKI ++# Label: "emSign Root CA - C1" ++# Serial: 825510296613316004955058 ++# MD5 Fingerprint: d8:e3:5d:01:21:fa:78:5a:b0:df:ba:d2:ee:2a:5f:68 ++# SHA1 Fingerprint: e7:2e:f1:df:fc:b2:09:28:cf:5d:d4:d5:67:37:b1:51:cb:86:4f:01 ++# SHA256 Fingerprint: 12:56:09:aa:30:1d:a0:a2:49:b9:7a:82:39:cb:6a:34:21:6f:44:dc:ac:9f:39:54:b1:42:92:f2:e8:c8:60:8f ++-----BEGIN CERTIFICATE----- ++MIIDczCCAlugAwIBAgILAK7PALrEzzL4Q7IwDQYJKoZIhvcNAQELBQAwVjELMAkG ++A1UEBhMCVVMxEzARBgNVBAsTCmVtU2lnbiBQS0kxFDASBgNVBAoTC2VNdWRocmEg ++SW5jMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEMxMB4XDTE4MDIxODE4MzAw ++MFoXDTQzMDIxODE4MzAwMFowVjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln ++biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMRwwGgYDVQQDExNlbVNpZ24gUm9v ++dCBDQSAtIEMxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz+upufGZ ++BczYKCFK83M0UYRWEPWgTywS4/oTmifQz/l5GnRfHXk5/Fv4cI7gklL35CX5VIPZ ++HdPIWoU/Xse2B+4+wM6ar6xWQio5JXDWv7V7Nq2s9nPczdcdioOl+yuQFTdrHCZH ++3DspVpNqs8FqOp099cGXOFgFixwR4+S0uF2FHYP+eF8LRWgYSKVGczQ7/g/IdrvH ++GPMF0Ybzhe3nudkyrVWIzqa2kbBPrH4VI5b2P/AgNBbeCsbEBEV5f6f9vtKppa+c ++xSMq9zwhbL2vj07FOrLzNBL834AaSaTUqZX3noleoomslMuoaJuvimUnzYnu3Yy1 ++aylwQ6BpC+S5DwIDAQABo0IwQDAdBgNVHQ4EFgQU/qHgcB4qAzlSWkK+XJGFehiq ++TbUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL ++BQADggEBAMJKVvoVIXsoounlHfv4LcQ5lkFMOycsxGwYFYDGrK9HWS8mC+M2sO87 ++/kOXSTKZEhVb3xEp/6tT+LvBeA+snFOvV71ojD1pM/CjoCNjO2RnIkSt1XHLVip4 ++kqNPEjE2NuLe/gDEo2APJ62gsIq1NnpSob0n9CAnYuhNlCQT5AoE6TyrLshDCUrG ++YQTlSTR+08TI9Q/Aqum6VF7zYytPT1DU/rl7mYw9wC68AivTxEDkigcxHpvOJpkT +++xHqmiIMERnHXhuBUDDIlhJu58tBf5E7oke3VIAb3ADMmpDqw8NQBmIMMMAVSKeo ++WXzhriKi4gp6D/piq1JM4fHfyr6DDUI= ++-----END CERTIFICATE----- ++ ++# Issuer: CN=emSign ECC Root CA - C3 O=eMudhra Inc OU=emSign PKI ++# Subject: CN=emSign ECC Root CA - C3 O=eMudhra Inc OU=emSign PKI ++# Label: "emSign ECC Root CA - C3" ++# Serial: 582948710642506000014504 ++# MD5 Fingerprint: 3e:53:b3:a3:81:ee:d7:10:f8:d3:b0:1d:17:92:f5:d5 ++# SHA1 Fingerprint: b6:af:43:c2:9b:81:53:7d:f6:ef:6b:c3:1f:1f:60:15:0c:ee:48:66 ++# SHA256 Fingerprint: bc:4d:80:9b:15:18:9d:78:db:3e:1d:8c:f4:f9:72:6a:79:5d:a1:64:3c:a5:f1:35:8e:1d:db:0e:dc:0d:7e:b3 ++-----BEGIN CERTIFICATE----- ++MIICKzCCAbGgAwIBAgIKe3G2gla4EnycqDAKBggqhkjOPQQDAzBaMQswCQYDVQQG ++EwJVUzETMBEGA1UECxMKZW1TaWduIFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJbmMx ++IDAeBgNVBAMTF2VtU2lnbiBFQ0MgUm9vdCBDQSAtIEMzMB4XDTE4MDIxODE4MzAw ++MFoXDTQzMDIxODE4MzAwMFowWjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln ++biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMSAwHgYDVQQDExdlbVNpZ24gRUND ++IFJvb3QgQ0EgLSBDMzB2MBAGByqGSM49AgEGBSuBBAAiA2IABP2lYa57JhAd6bci ++MK4G9IGzsUJxlTm801Ljr6/58pc1kjZGDoeVjbk5Wum739D+yAdBPLtVb4Ojavti ++sIGJAnB9SMVK4+kiVCJNk7tCDK93nCOmfddhEc5lx/h//vXyqaNCMEAwHQYDVR0O ++BBYEFPtaSNCAIEDyqOkAB2kZd6fmw/TPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB ++Af8EBTADAQH/MAoGCCqGSM49BAMDA2gAMGUCMQC02C8Cif22TGK6Q04ThHK1rt0c ++3ta13FaPWEBaLd4gTCKDypOofu4SQMfWh0/434UCMBwUZOR8loMRnLDRWmFLpg9J ++0wD8ofzkpf9/rdcw0Md3f76BB1UwUCAU9Vc4CqgxUQ== ++-----END CERTIFICATE----- ++ + # Issuer: CN=Hongkong Post Root CA 3 O=Hongkong Post + # Subject: CN=Hongkong Post Root CA 3 O=Hongkong Post + # Label: "Hongkong Post Root CA 3" +-- +2.53.0 + diff --git a/meta/recipes-devtools/python/python3-pip_26.0.1.bb b/meta/recipes-devtools/python/python3-pip_26.0.1.bb index b6581575580..378fcd823ee 100644 --- a/meta/recipes-devtools/python/python3-pip_26.0.1.bb +++ b/meta/recipes-devtools/python/python3-pip_26.0.1.bb @@ -29,6 +29,8 @@ SRC_URI += "file://no_shebang_mangling.patch \ file://CVE-2026-8643.patch \ file://CVE-2026-8643-regression_p1.patch \ file://CVE-2026-8643-regression_p2.patch \ + file://0001-Remove-emsign-437.patch;patchdir=src/pip/_vendor \ + file://0002-Restore-unaffected-emSign-roots-439-440.patch;patchdir=src/pip/_vendor \ " SRC_URI[sha256sum] = "c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b296613346d8" From patchwork Wed Nov 11 09:02:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103710 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5605.1794387814144353962 for ; Wed, 11 Nov 2026 01:03:34 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=gPjy3GMF; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4a1fbd52ab6so19844205e9.0 for ; Wed, 11 Nov 2026 01:03:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387812; x=1794992612; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=TspG+xpTsUWduYoksj9gixzF6SBm0cxpPLRYk/gt0ac=; b=gPjy3GMFC6Wr35ptPtaVw7NaK5loPZJZ58AbFKFqJH75Xj3By36RKvMTzXCHqf5iww L1jmHtVJ3oyng8EoI/6D8qKF3SBipbrf+/rG4WATRWHRa2OVJxkbrRJheTbxv7YZByb0 17O9hswngsDSrE2enD5uDPbbzpcQXjBTGLt5YoPAnJe5ErNl446paIBkZhpIC1dRi9LV 01tCg1/VPgSWQOxRccfPOnvwfJuSkQ65Wl8zZEewNpIDCXGt3AlppWz0I0x7I+arPU6K OBkyfaPtIeVLum64iNPeAQjMrsx0JfGbqdLknmWDF21o+NCxkR6Hru+yI/zGPf2gbrRP BhIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387812; x=1794992612; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=TspG+xpTsUWduYoksj9gixzF6SBm0cxpPLRYk/gt0ac=; b=mGIBdOfY6DovhEXMKG2B4LQTBzuJ+6BVFVN0ZNhyNAQechCi6+IQrUFUuFACGmq39x cYhvinAPjS/RrLKZGqW5sb1AYh/zof1uuPKZR4TJe0VNcdAMBWCKzq/06OCKfjsy66iQ NvsWbzApR2jqwlvBW7dBOUqqoZy3ElqbLz76pfeWZv+nLjzhXnQs32r0d33Xq2S7ZLGI BWN0RMfrQ2ADjRARJqoKDD5YKbWkZthB9eioSnqVKCxEa9ftK6ddIMH6WPU3pxHt3gwa VHpyIaD4dJLFmBAC6XFWxX+PaRIDgskWKiLwxUyimipfTbGvtg5oJTCR0uIU+3Kf08X/ wjSA== X-Gm-Message-State: APuU4Z8C3+Uuw5Jqd00PEADrcZfNzSGcrp2rzpGi8g3zt6XJhewX462I 5fULVnDOlKOuYjyv6b4uuYYWtLzzWoJJSo6jrBZfk4HqaUamLnCcAluXWcCyuitfP7W1PGWST1v Vfzy55a0= X-Gm-Gg: AYBFou2BEhpIXABcmtEm0DDvmj7C+g9FfxNdInDt6js3S8MP6OdMHbNwEinN1ClH815 aih8j4ry/uAWzrhj8Q73BitWKBpo0Wjc8TteNQIpvrmIwZyFozUnMlgch6SmsZc+kz5RLPZ10V1 PQYRp9c/sXbD7zSggFaA0iXb8rGD1Mn+E/Yo2i2Ymh78NlziUoQCc9pCAB2w3e5Vkx9gPLKDHbt bZu8H7pbG9BGwjG9e58joWjArxGiMmazsD9B+s2DQTZCtddbPmchnWu5tIBbo5ahaHnQYdrTtuI APeyYbzD/zatipl/up0Qw9OCy2xxfCHlWIcrZcDfukK5dci58ZqULkl1PtyZYBQp0N5chK8Qepo 3xSuv59actpQLfjpcU0J22nTepM4l61MLGlep/ApviONtxCRKrnU5N78PufpEVuy5540RRhxnYE 8UnGgfeU5VVp4AeXyPkWau1T/A4cbj4n8KNUoU9iFMGFyV7fnk4/IQ63Tn+ItS+9EZt7tRY3LDe hTGJjcvEtayI6gyttdJtpaCpRbBRvFo42FGqx0Z2qF1jjamJd9xKmzT010mOkBnEJG2y1bho2IK oOWAi81FtRde22IkEGgPfj0FAKwrRN4sopZ9IQP9hYHsM38+KR4CpkeXJKkQZHxjehvNPki2SaD m9zeIk2ot6WSp2e29zLnVGNPsJGGZ X-Received: by 2002:a05:600c:e54a:20b0:4a1:9663:7633 with SMTP id 5b1f17b1804b1-4ba0939d261mr17842745e9.11.1794387812261; Wed, 11 Nov 2026 01:03:32 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.31 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:31 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 17/35] python3: upgrade 3.14.7 -> 3.14.9 Date: Wed, 11 Nov 2026 10:02:43 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249989 From: Ross Burton The release notes are long[1] but the highlight is upgrading the bundled pip wheel to 26.2.2, as pip bundles certifi which needed upgrading due to the eMudhra intermediate CA compromise. [1] https://docs.python.org/release/3.14.9/whatsnew/changelog.html [2] https://emudhra.we-have-a-problem.com Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (From OE-Core rev: 526baf80188308bc1e65b09ccb41186772cd6336) Dropped parts updating patches for openssl-4 or ptests. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../0001-Avoid-shebang-overflow-on-python-config.py.patch | 2 +- ...1-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch | 2 +- ...1-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch | 2 +- meta/recipes-devtools/python/python3/makerace.patch | 2 +- .../python/{python3_3.14.7.bb => python3_3.14.9.bb} | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.9.bb} (99%) diff --git a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch index 7a605383647..7cacaf0ff37 100644 --- a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch +++ b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch @@ -19,7 +19,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index e946018..345ed29 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2835,6 +2835,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh +@@ -2839,6 +2839,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh @ # Substitution happens here, as the completely-expanded BINDIR @ # is not available in configure sed -e "s,@EXENAME@,$(EXENAME)," < $(srcdir)/Misc/python-config.in >python-config.py diff --git a/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch b/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch index 60391e726bd..580d38a4031 100644 --- a/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch +++ b/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch @@ -21,7 +21,7 @@ diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py index 0a8bcc0..a2341f2 100644 --- a/Lib/sysconfig/__init__.py +++ b/Lib/sysconfig/__init__.py -@@ -538,12 +538,12 @@ def _init_config_vars(): +@@ -539,12 +539,12 @@ def _init_config_vars(): _CONFIG_VARS['py_version'] = _PY_VERSION _CONFIG_VARS['py_version_short'] = _PY_VERSION_SHORT _CONFIG_VARS['py_version_nodot'] = _PY_VERSION_SHORT_NO_DOT diff --git a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch index c7f14cad1e0..4e41b04a3bb 100644 --- a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch +++ b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch @@ -18,7 +18,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index 526d500..a7e536d 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -861,8 +861,7 @@ profile-run-stamp: +@@ -863,8 +863,7 @@ profile-run-stamp: # enabled. $(MAKE) profile-gen-stamp # Next, run the profile task to generate the profile information. diff --git a/meta/recipes-devtools/python/python3/makerace.patch b/meta/recipes-devtools/python/python3/makerace.patch index 248a521118c..b589dfb3460 100644 --- a/meta/recipes-devtools/python/python3/makerace.patch +++ b/meta/recipes-devtools/python/python3/makerace.patch @@ -20,7 +20,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index a7e536d..e946018 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2741,7 +2741,7 @@ COMPILEALL_OPTS=-j0 +@@ -2745,7 +2745,7 @@ COMPILEALL_OPTS=-j0 TEST_MODULES=@TEST_MODULES@ .PHONY: libinstall diff --git a/meta/recipes-devtools/python/python3_3.14.7.bb b/meta/recipes-devtools/python/python3_3.14.9.bb similarity index 99% rename from meta/recipes-devtools/python/python3_3.14.7.bb rename to meta/recipes-devtools/python/python3_3.14.9.bb index e73dc8d7728..2a5279480b2 100644 --- a/meta/recipes-devtools/python/python3_3.14.7.bb +++ b/meta/recipes-devtools/python/python3_3.14.9.bb @@ -40,7 +40,7 @@ SRC_URI:append:class-native = " \ file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \ " -SRC_URI[sha256sum] = "3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81" +SRC_URI[sha256sum] = "e02d9ac21cebda6e46435369744a92c65cc7cd8669697694122cf97ffacd1e53" # exclude pre-releases for both python 2.x and 3.x UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P\d+(\.\d+)+).tar" From patchwork Wed Nov 11 09:02:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103700 Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5585.1794387814768006842 for ; Wed, 11 Nov 2026 01:03:35 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=Xi5ZVzme; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4a5036bbac7so18794165e9.3 for ; Wed, 11 Nov 2026 01:03:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387813; x=1794992613; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=PDlkWfzbBy8b0yGZsy4NN5g6+T1EgwfGRyRUT5uQVRs=; b=Xi5ZVzmeQ5kLPjQkcEjyVm8Zl6Aop6a5t1lUdZ+ivojR+s9UFGviuSOa8hFuA7QbVn La/I5sh1VudNEe0Hm5hqbkjHAnORpITevtNdiCrqIFfAS+M3chGZBhUr4E3EVrrzMYOT twUp/vB7iKEOpEtrD9NZIbEZoDr+T8/tQv8kD2/bNYWc6O15lDrUqI8fCdl1IvUtsuVQ sGw/EQqQdpYb7yV44ZKU6UrEZXr9XztHaat6AUGlRdnApagqfbhHryuUaTjBAfm6thFa /iVepN2P+NE2ol+IqKAlbflnum3pVZv+R8sq8N1CcODQ+ebwFp2jdlmkKbBjjsggQYOi 0seQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387813; x=1794992613; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=PDlkWfzbBy8b0yGZsy4NN5g6+T1EgwfGRyRUT5uQVRs=; b=pvR+ZgV1QQYWB3kIpdT6xXMNVV3LctPE73Br4eYTfVyDpX1GXfMSsER0HMMjlbMrrY ctqTJrZA+xiXmAY2mgWp1yF5frMSXupP1HOAwLjwm6LECzRu8mI+by65N89G4hDvzSTE sqXEhbObmp6EMDdq6QqTfJzGBF1tzCKPAx1oWhTmLvH/P0k2ZSE6Q23rYYcIvoExZSgO S7CIv4QfABmDtfx02lYyPaINeRfnGV9JtNkQR2csR12u20Z2LQKzGa3S7EHJo0Qdzn0C 7Rlgx4gQ2e93oFUxmn7PvnoojBD2jghnd/jxFwAzGiMHwTq7FB7XSwfAq1qnpbQwfZxV 88Dw== X-Gm-Message-State: APuU4Z+R9kr9ivZB1XAj7eplMaoBDqZfCQDevveO+PBsTmyCvedZ7ifs BTcVWJsIMxsEjf+u9t9xEJmwKKGi1/rIC4X1hZWZF7eYOeEQw24Tf2+L93X8Eddl/4lZUH9nC1g 9gPnFH0k= X-Gm-Gg: AYBFou2K7YRuCdbUxTcFH+b5wcB8K+NFo3omeSArFZzeubc+shp6mK3FLODI+MmgwB5 FK4sX8hDr3mRZu57SC5dPo0Sdd5BhXS8Pkn00gNi8x9+E02tf6UieEMnn8skWqrck9YoxdUada5 1QZ/X/niWJK+2OQRsKXfBxpRQfgs0KwJN4lN+WrSSaZvnVgDuvBF471aK/1DXyT4khW0v8z5usJ ap6V8WWI4/3otW81cnxY3avRR3Zp9y7WKGMSUrnln2M3sl/DR984UQfLSkyX3o+dJEWBU5Yat5m QuZGCi1Oj4FODbYg46cKz/Khs6KyGkOWpz+ABhFg/p1Jo/qQ0z3wfnertsErdP3NY7nlhC2Oxhq +BklU3wl98seYJx9q9astI5Bqqtequu3WEG/d6fB1aTS3WbSZWlYvjqtTM7AZIf2ThNbgRE/NvV zdUIhum++8+wG+vVuvoqHfiTu/8PT2J+I+vcv2ugh8FKNp9+0Lr8l1em1IDUGeFEbRwo1wakS3G 00Spc+QUbSkyLUq4/XH7g2E5ZCJdKJjB2gO+xEiD9+08xxapeBzmMAOWbhEuGLw67Pa1HfootLX Yqezr0xSfOJA3pd3Ao1Izli6L2+0EfTWZMo+jdtXr+Hgath728baYEpZXGT70DYQl5eWguAG12Q Yq4Pi39Th4LXeyKzN803V/EgULwY/zVPR53hfyJeBWlITYPG+PA== X-Received: by 2002:a05:600c:8708:b0:4a1:dbdf:17a8 with SMTP id 5b1f17b1804b1-4ba0931c301mr32216735e9.2.1794387812956; Wed, 11 Nov 2026 01:03:32 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.32 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:32 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 18/35] python3: upgrade 3.14.9 -> 3.14.10 Date: Wed, 11 Nov 2026 10:02:44 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249990 From: Peter Marko This is an expedited security release to address the compromised eMudhra intermediate CA keys. These keys are now blocked by the ssl module as a last resort against their use. Normal uses of pip, including to upgrade pip itself, are now safe from attacks based on those compromised keys, even if pip hasn't been updated yet. Release information: [1] Security content in this release * CVE-2026-115557 gh-160040: Distrust compromised eMudhra intermediate CA keys * CVE-2026-114583 gh-160097: Reject links replacing the destination in tarfile.tar_filter * gh-160300: Reject cookies with a negative version in http.cookiejar [1] https://www.python.org/downloads/release/python-31410/ Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 4041f4a2e031f76e5a90207e855c735fd14259b1) Dropped parts updating patches for openssl-4 or ptests. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../0001-Avoid-shebang-overflow-on-python-config.py.patch | 2 +- ...1-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch | 2 +- .../0001-Update-test_sysconfig-for-posix_user-purelib.patch | 2 +- meta/recipes-devtools/python/python3/makerace.patch | 2 +- .../python/{python3_3.14.9.bb => python3_3.14.10.bb} | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) rename meta/recipes-devtools/python/{python3_3.14.9.bb => python3_3.14.10.bb} (99%) diff --git a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch index 7cacaf0ff37..79fee9803fe 100644 --- a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch +++ b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch @@ -19,7 +19,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index e946018..345ed29 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2839,6 +2839,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh +@@ -2844,6 +2844,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh @ # Substitution happens here, as the completely-expanded BINDIR @ # is not available in configure sed -e "s,@EXENAME@,$(EXENAME)," < $(srcdir)/Misc/python-config.in >python-config.py diff --git a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch index 4e41b04a3bb..d3f46c372a6 100644 --- a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch +++ b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch @@ -18,7 +18,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index 526d500..a7e536d 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -863,8 +863,7 @@ profile-run-stamp: +@@ -864,8 +864,7 @@ profile-run-stamp: # enabled. $(MAKE) profile-gen-stamp # Next, run the profile task to generate the profile information. diff --git a/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch b/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch index 5509b7475a9..0864f23926a 100644 --- a/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch +++ b/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch @@ -25,7 +25,7 @@ diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py index 1fe4b68..383142a 100644 --- a/Lib/test/test_sysconfig.py +++ b/Lib/test/test_sysconfig.py -@@ -434,7 +434,7 @@ class TestSysConfig(unittest.TestCase, VirtualEnvironmentMixin): +@@ -435,7 +435,7 @@ class TestSysConfig(unittest.TestCase, VirtualEnvironmentMixin): expected = os.path.normpath(global_path.replace(base, user, 1)) # bpo-44860: platlib of posix_user doesn't use sys.platlibdir, # whereas posix_prefix does. diff --git a/meta/recipes-devtools/python/python3/makerace.patch b/meta/recipes-devtools/python/python3/makerace.patch index b589dfb3460..7167d5b4e82 100644 --- a/meta/recipes-devtools/python/python3/makerace.patch +++ b/meta/recipes-devtools/python/python3/makerace.patch @@ -20,7 +20,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index a7e536d..e946018 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2745,7 +2745,7 @@ COMPILEALL_OPTS=-j0 +@@ -2750,7 +2750,7 @@ COMPILEALL_OPTS=-j0 TEST_MODULES=@TEST_MODULES@ .PHONY: libinstall diff --git a/meta/recipes-devtools/python/python3_3.14.9.bb b/meta/recipes-devtools/python/python3_3.14.10.bb similarity index 99% rename from meta/recipes-devtools/python/python3_3.14.9.bb rename to meta/recipes-devtools/python/python3_3.14.10.bb index 2a5279480b2..73d6e89854d 100644 --- a/meta/recipes-devtools/python/python3_3.14.9.bb +++ b/meta/recipes-devtools/python/python3_3.14.10.bb @@ -40,7 +40,7 @@ SRC_URI:append:class-native = " \ file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \ " -SRC_URI[sha256sum] = "e02d9ac21cebda6e46435369744a92c65cc7cd8669697694122cf97ffacd1e53" +SRC_URI[sha256sum] = "de414a57119abef52784d8993e341d53aed635fc2b05c2607d9f98a2c5b72032" # exclude pre-releases for both python 2.x and 3.x UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P\d+(\.\d+)+).tar" From patchwork Wed Nov 11 09:02:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103702 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5586.1794387815568514032 for ; Wed, 11 Nov 2026 01:03:35 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=Q/+Txxs6; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4ac95761c85so21515215e9.2 for ; Wed, 11 Nov 2026 01:03:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387814; x=1794992614; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=pI2pWpghdr533+926R8B6yD+oWpH8dC/g2U6DhucaII=; b=Q/+Txxs6IrF9EBstio3XWVkTDO3MQeODqP2W/pAmpsh6iabzYq09CAuQ/BU30viBM/ KuzsTW/28TmcB+L/t9xa7kOSigXefBcQPmyHKFNQheVZoH7jz5q94DvwgxIg8YW3t4LI tU+lMeqyllOKMIBqfq/dfR70rzvQ17KOS5lb5enIeIcZelyieWJFi9YBiZLXM6/VY7pS oaC4gRqqNoP3OrcsGC40neVKiMEUTYiNvw2K3JZc7MEkEqy3NpEro2NhWXkYKTw9YUzG OrIws7GDHNOy9BWAkUmGpChyAxeCTAoWvHa6062pdpVgGpcUXsQuokYFYxpeTw/n1h9c FbAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387814; x=1794992614; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=pI2pWpghdr533+926R8B6yD+oWpH8dC/g2U6DhucaII=; b=MoYIKPudgQb/X5La22hfr72uDY6NYuAiLVLnShhllnCRVKD2EBaowNfJT3z1AQS5Pi kILZ0A8FrRqbCDcA1RDXGUXx/OdJSBl7o55j4gFmuIX7O8QhRr3D7P5WneAJeNDT+DFG RCPf+uNhWtV0y3Df+7WZSNd6wu6C67eRkeoGhYbQcUNXNVJo/Wwf1nMsBOarDYA1q5A6 sZw22gLmLjU/2YPm+tEZP0gonn7ug086Cqc332dnP0/XEO+wcdlPwnj6z5eqUcxpFnlq 87LdxaS1+gpxqmaGcIzemH7yPTQy1ILHyI5/x2yW7ddn/tU8WzBYLaXIxpiOOW3QaVUQ 7WMQ== X-Gm-Message-State: APuU4Z/g5MQEXY5NQlRQTkbe6y60rV+ycQOOORIeOesQBUyNTF6MwETt +Yo2zTO3+aGqJxgbSqAOFSQLGJZ8EKZSvXViL82N4rkyok/vElTocLz3N/hBAmUulaBM+FKirNk Krc5UGvo= X-Gm-Gg: AYBFou2B2UhU7U/oAExwfwyX1qAIucddKaOQrwPtI2NsQoHAnHDGR7LtAtnf8H6BYXy JyKKE1FOFivW7O6trpsFyJz8OlR95WPB/7A6LnuXWW/yF38ytxZch+aqD9kaqZ4/dLvqOWXR9TF tMSyasABwRoN/5mjYWRIwURFTrkAoQYbIUkeTc1Kx7Cpdspjq8BunnFeGIryrGeii5Lklu8BTxB y2iSliB8pCqasCM4Kt+3FrQjUnq/wHSAwqqdhAiv2J5TqCgrPpJKhcIEjfeLKY5FggFvf+JK+9z CXlbOmfgS9U4rl2VL+HQALF4k7gzLkvzUFvq+MqufgCpjyYVR5X/agE398Qwv3uhbW8lCShX++W clsdgwaZ5L5DmZl9ALOsnvGVc4UTUwBCFpYnCiJtDxw6+ci1B5LDFNCVjgVZOLFHcihzcMoB6y7 y4izm8v+uWmI2n0Vgx/Djhcws6Keam7t7XhDC0GZh/m6QtG63CkaJuwXDsUnG+JPDBsILeRuiVB Gh5KEO6YiCiTyOBWMZ+GSE/QzYnPNAQl6XLMg9KmUmAh+uE5S4jQAPSbxdWaQwUNgYl1gvEut0X Hn1ot805Fh4XAaKs15FvvFSI01Pvava9zjtMyfk+0ug+cG27ToDwR6HXFhqxcUDl+q2lsbSpgrD BUX8t7PDBUA7+KgZX4LnbxlyO4PMZ X-Received: by 2002:a05:600c:b86:b0:4a1:dfaf:f465 with SMTP id 5b1f17b1804b1-4ba0931efefmr32016775e9.4.1794387813773; Wed, 11 Nov 2026 01:03:33 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.33 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:33 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 19/35] python3: skip test.test_readline.TestHistoryManipulation on musl Date: Wed, 11 Nov 2026 10:02:45 +0100 Message-ID: <729419b4855231191f47c84396686744fb256b16.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249991 From: Ross Burton Fixes to the editline integration have sadly introduced regressions on musl: FAIL: test_append_limited_history (test.test_readline.TestHistoryManipulation.test_append_limited_history) ---------------------------------------------------------------------- Traceback (most recent call last): File "/usr/lib/python3.14/test/test_readline.py", line 208, in test_append_limited_history self.assertEqual(readline.get_history_item(1), "second line") ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ AssertionError: '_HiStOrY_V2_' != 'second line' - _HiStOrY_V2_ + second line ====================================================================== FAIL: test_write_read_append (test.test_readline.TestHistoryManipulation.test_write_read_append) ---------------------------------------------------------------------- Traceback (most recent call last): File "/usr/lib/python3.14/test/test_readline.py", line 101, in test_write_read_append self.assertEqual(readline.get_current_history_length(), 3) ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ AssertionError: 4 != 3 A ticket has been filed upstream so skip the tests for now. Signed-off-by: Ross Burton Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 7ba31b6a42f884964d2cff04235a930f757b9e4b) Signed-off-by: Yoann Congal --- meta/recipes-devtools/python/python3_3.14.10.bb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meta/recipes-devtools/python/python3_3.14.10.bb b/meta/recipes-devtools/python/python3_3.14.10.bb index 73d6e89854d..a4cd0697d2a 100644 --- a/meta/recipes-devtools/python/python3_3.14.10.bb +++ b/meta/recipes-devtools/python/python3_3.14.10.bb @@ -274,6 +274,11 @@ SKIPPED_TESTS:append:class-target:libc-musl = " \ --ignore test.test_ctypes.test_dlerror.TestNullDlsym.test_null_dlsym \ " +# https://github.com/python/cpython/issues/159424 +SKIPPED_TESTS:append:libc-musl = " \ + --ignore test.test_readline.TestHistoryManipulation.test_append_limited_history \ + --ignore test.test_readline.TestHistoryManipulation.test_write_read_append \ +" do_install_ptest:append () { sed -i -e "s|SKIPPED_TESTS=|SKIPPED_TESTS=\"${SKIPPED_TESTS}\"|" ${D}${PTEST_PATH}/run-ptest From patchwork Wed Nov 11 09:02:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103711 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5606.1794387816603464513 for ; Wed, 11 Nov 2026 01:03:36 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=HvLS4cNN; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a208d93758so31403525e9.3 for ; Wed, 11 Nov 2026 01:03:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387815; x=1794992615; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=7fngxJDSFLy5oUlAiO4N/0ZmeR9umEvh7/cUDGmSha0=; b=HvLS4cNNnavcdihahm/mSFFLon9/mecn7U5VFIVpogcQsVIgTCZ2F2+Y07axBX6ZOA RwdY8972Kl1wg5e2N4Q2Vcs1Q34w9Ms0daVaOeDR9ipzxBtF3p1kWcAiDE3Ptk8Pd/0X wFjX89/vhGWSxw/aAqadc+vmoY+7Avs68yrTOL+YNjXoMVF9k47lJc+p2/Vdxb2yS44K yNbHXHvH1jxlr+zZ0ThepQb0+00q1oDHrmwqnD9mq4m5XqkSAXPKK3C/eaHfZeO0ZeVB JqRWBO3lJsFg8lOOyTRqjrLToE3UWqnnrPOELNPb7X2hAUU1qAaumUI09kwZY50KNuRG 64gQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387815; x=1794992615; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=7fngxJDSFLy5oUlAiO4N/0ZmeR9umEvh7/cUDGmSha0=; b=g4zmckxHNF1OoGemATU1L5QtoPXF9asVaMKIcRBP8F28O2WZi5+i1qBqxfFRM5vfE+ Nq1/s1ND3nwKHb3X/qp8zLpcXGmlbuvb1Mw3+hGlvhhghdJQzsXtwvLbVFHpFoZ2TJbv 5rR2b7X+W6eQWW5hKOcHGv2HuYna3A2oqFAG9Uzm5qK6N8e9QuQpNrIF/Yuh9W8BUlGS W+LMGJ7Sbce5r4C73g+VGQtEzvRcwIQV7zEAx6l2Wyc/pRTwXUWUnfk4MN2Y6YsOV5ny Jh9eMxWPfddHyTgrwUnUDO9h5IA8Tqsmi4rvyNLUT+nWksgx+FHfPZU+lNPTly1bgHef sbZw== X-Gm-Message-State: APuU4Z+2htp0YO0nLEvtcVf/sspNGCsZh40H5QRdoKgBElg7JAD3MlMs j3xJ/5IrJngj4/xXdFBUJNwKhgV+AuYurCeFVKgCLcqzL3oc78lyp4NhIbD4Aj/Ny0ejb9mLC2g 9pB/bNb8= X-Gm-Gg: AYBFou1zIYUBRRB085wPfUaQVWOw31px/96eyllORBS7pRXSccZO+7WCxmf9wr/TYlt maNBSlIrKEeBRGus404aYhD8q8cpiFV21QsDGBZiJo8s9w3sEbkZBwBGueAj/Hs18YjSo/9kZCN JqkhbuS36fY5BoCDZlt3D3LrQm2dIy+7hYC30odnx0BgV/edyFryy5IfDgkMXluoRfQdJYVNanU 0WcjZFwP8x9UepW0/u+J37pa9IO1SemcqWRwZLJTksHIWuh7cyS4qpxFMCjHR7HkZmwtVFzPs6r WP27Y4lRKHJ3JxpAK631Ae6OeTG7llD4WwQFcczBp0G93eFBZAmt4XXa5+EYmNDEdkIroDBJu9V /513AuwSzulrvKrs3kYKg0Jsi3lNqV5euqFqg05ZUG1PqN2WAltw/r21vpxVw3jNOCQCQ+NnBGT fJ/TizAPjLw2CJlj0b9vXugK3b1gJQagTmjiaUjEL11BMkcl0Fpdq3jDJJYgXjR876Qam5JZ907 jJcSQ37L1Fr8ieHYWGUlTROp7XSnuIbrWe3Yvlr3gpNw6hYMACYzy30wUOxrimKaE4mhE3aOxxu TT7jZW5ofRfLeHrZgG3SjGJNNJzz/ivS+hWgrkvkQxmMTHNFC2uD4k4zZBOemrS+GjSvPCdenj4 8EDrODZqnjlkTvdKZnAJIRMeFuPW7 X-Received: by 2002:a05:600c:354a:b0:4ba:6d8:df8f with SMTP id 5b1f17b1804b1-4ba0936f447mr29112015e9.15.1794387814777; Wed, 11 Nov 2026 01:03:34 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.33 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:33 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 20/35] piglit: fix build with Python 3.14.9 Date: Wed, 11 Nov 2026 10:02:46 +0100 Message-ID: <52a50198adadc887f4d8fb532a95116adfccf884.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249992 From: Ross Burton Python 3.14.9 added bounds checking to the mtime argument, so piglit passing the mtime as a string causes runtime errors: File "/usr/lib/python3.14/gzip.py", line 303, in _write_gzip_header if not 0 <= mtime < 2**32: TypeError: '<=' not supported between instances of 'int' and 'str' Signed-off-by: Ross Burton Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 66cf97860d9833b852298a6cd60334c372a18dc3) Signed-off-by: Yoann Congal --- ...-reproducible_mtime-should-be-an-int.patch | 33 +++++++++++++++++++ meta/recipes-graphics/piglit/piglit_git.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch diff --git a/meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch b/meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch new file mode 100644 index 00000000000..4578c296b0d --- /dev/null +++ b/meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch @@ -0,0 +1,33 @@ +From 58a5bea55a5f7972462124e7a8f1b1971ad5483d Mon Sep 17 00:00:00 2001 +From: Ross Burton +Date: Thu, 22 Oct 2026 14:09:08 +0100 +Subject: [PATCH] tests/serializer: reproducible_mtime should be an int +X-ARM-No-Footer: NoDisclaimer + +The mtime argument is an integer not a string, so parse it with int(). + +Passing a string breaks piglit with Python 3.14.9, which does integer +bound checks on the specified mtime. + +Upstream-Status: Submitted [https://gitlab.freedesktop.org/mesa/piglit/-/merge_requests/1269] +Signed-off-by: Ross Burton +--- + tests/serializer.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tests/serializer.py b/tests/serializer.py +index 5ee9a1578..f7fdadf43 100644 +--- a/tests/serializer.py ++++ b/tests/serializer.py +@@ -140,7 +140,7 @@ def serializer(name, profile, outfile): + tree = et.ElementTree(root) + reproducible_mtime = None + if 'SOURCE_DATE_EPOCH' in os.environ: +- reproducible_mtime=os.environ['SOURCE_DATE_EPOCH'] ++ reproducible_mtime=int(os.environ['SOURCE_DATE_EPOCH']) + with gzip.GzipFile(outfile, 'wb', mtime=reproducible_mtime) as f: + tree.write(f, encoding='utf-8', xml_declaration=True) + +-- +2.43.0 + diff --git a/meta/recipes-graphics/piglit/piglit_git.bb b/meta/recipes-graphics/piglit/piglit_git.bb index 76596350628..5d7cdafb070 100644 --- a/meta/recipes-graphics/piglit/piglit_git.bb +++ b/meta/recipes-graphics/piglit/piglit_git.bb @@ -14,6 +14,7 @@ SRC_URI = "git://gitlab.freedesktop.org/mesa/piglit.git;protocol=https;branch=ma file://0001-tests-egl-spec-make-egl_ext_surface_compression-cond.patch \ file://0001-tests-no_error.py-modify-_command-and-not-command.patch \ file://0001-generated_tests-use-shape-in-place-of-newshape-on-nu.patch \ + file://0001-tests-serializer-reproducible_mtime-should-be-an-int.patch \ " UPSTREAM_CHECK_COMMITS = "1" From patchwork Wed Nov 11 09:02:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103712 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5607.1794387821912654240 for ; Wed, 11 Nov 2026 01:03:42 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=AUDYfLl6; spf=pass (domain: smile.fr, ip: 209.85.128.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4a4d7ae1ae9so26924925e9.1 for ; Wed, 11 Nov 2026 01:03:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387820; x=1794992620; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=L2OCmjqYyWDw2FwO/fMjzdf828FgEi4Fjzo0dv6obJA=; b=AUDYfLl6m3WoKFlCMJx1A34pyX5GZ+Zw6Mqo9LJH5WEz0X7uPJ/mZZ6EUULGdWzj7S s610/IBUjxTlEzrFqZ+AbJQSpvJGpKJy6x1WliKTgQ2rLcMlDu0k0XgTVj4+JppcxD/9 CQOhwOEW+taIsAFJQVOxGQmIAHdp08IJhpoQtpSqYvIPYVJWsbmpFu4aSovWHEBx8mkJ q3Ux5CmVGYquw/51ghgV9/3IQNvD+lfJ7H2ZD8j83bzUMxI4jW5Zwke7Wn5B1tArUaiS NOZdsG17h1qAZU9er/lxLQVc/5Ay3YiebVyYQmw++Z1MSnCOv+ODo4Gdo+KLOxW4GOup fEZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387820; x=1794992620; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=L2OCmjqYyWDw2FwO/fMjzdf828FgEi4Fjzo0dv6obJA=; b=oVj8uLhi9oAq/qwSPD47r/ZmBUvwqERHhtOgjMhxNBpqpmT+ox/9YwgIG06lhpMx90 0LimrYGCcF9ZoiR1W+wirPJFODlf6ABeynKrRhuxwScsUhhJj2UKZENoV27f6Zh16+/v VGI0IBbBNq967kDEP2LHjYXkn/+dove6aw30Esv0yFeDiST6qnDB8rSqPa6HAUhLpzUM 1QD4kcwwlOiXMKJBnPZLAF35++1nobgep7zlnivD2SXl2UPgT0SSxD308NgyF45ybumn vQN0p+65dO8c/+Bm6Pn4qclo8ET+xHtg+InmAC/iUiedLskOSy0emfDgmZ3VDOR/oaTC lWoQ== X-Gm-Message-State: APuU4Z92L2U9chR7IUTHD5fXVLamow+aXtihPK/DtH/Ipaor+qCtnWRB hOiwa1gcQjkrfKjhng8NbbVuFuAg+BMw15P1sKrCJNpziHMdaUHLFgU4ijK0HVx1OMVymZRNFVX f2zaGiNE= X-Gm-Gg: AYBFou17kzW1gleyETC/BYUiYLpdvy61+PfqTx1t3j7F+vUNr6mshxbHT5Sdbyadg2A k2UKiKfBgX7XKJ3fqz5VuAKygNic2qjuYRBszmsM3wsIoFVGg9PnSiqlbZDI21453oaOVQg3ot0 e0QuNFqqNq0DM8ksB8raQIRo6IuEKOMpnNjDM132Id9GEoZo5/mNvGEbtksOMnH2Nca1rbz6Kim T8w5uGqUdQ5McFZkDftqo9pXwzQBEX8CrHNmux6Q1THyovsWc8zh80K87/9r47dfwJ2LvWuNHin /VXd9a4x7kyJfG6cFhTyLVqP4kihdFH2A0DbbSwNDFi3Nil/sj6NQt5UZVYCmddABQJ5FQB78IO Xgmz73INB5ZO7OFxubg+Z+WJrAgSPOzv3pHYTJfSUs6DJ/Qu140Xs2HZT5UTZ6yuPgcSddYABl/ 04ppc0yKKHMPiyfY0fSintQfWUhjZnFdsV7qweNJFTK0695Xnf7ajsBe/PQSTwuhVd/YftvBDV4 /dX8p2zz/y9pJpM6wUOtcpiTeswlmFNGg7aHLxChfaEqklMxj57LIUdUSv5Auhqrraftgs5DZdk h70dI3hwOhkHYcEcOB98SjmwPkb/6GEtBVdf82e6sPdNByntj7vh9kpLVBvzEqPAGjoP/JIF9Vv 5a+KbvWSLUYRuqBApZNP37ejZCTAhRRvPh42S57YBSqdv74vUWw== X-Received: by 2002:a05:600c:6819:b0:4a2:167a:c946 with SMTP id 5b1f17b1804b1-4ba0935f880mr28495905e9.13.1794387820147; Wed, 11 Nov 2026 01:03:40 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.34 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:36 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 21/35] systemd: add iproute2-devlink runtime dependency to udev Date: Wed, 11 Nov 2026 10:02:47 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:48 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249993 From: Peter Marko Service file ${nonarch_libdir}/udev/rules.d/81-net-bridge.rules executes /usr/sbin/devlink which causes errors seen in journal on systems which don't install this package explicitly. Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 69bf564780353d34cfd87bf73960cfadd8b2c6ac) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-core/systemd/systemd_259.5.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-core/systemd/systemd_259.5.bb b/meta/recipes-core/systemd/systemd_259.5.bb index e924884bf95..3c747545322 100644 --- a/meta/recipes-core/systemd/systemd_259.5.bb +++ b/meta/recipes-core/systemd/systemd_259.5.bb @@ -760,6 +760,7 @@ FILES:libsystemd-shared = "${libdir}/systemd/libsystemd-shared*.so" RPROVIDES:udev = "hotplug" +RDEPENDS:udev += "iproute2-devlink" RDEPENDS:udev-bash-completion += "bash-completion" RDEPENDS:udev-hwdb += "udev" From patchwork Wed Nov 11 09:02:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103713 Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5590.1794387827681598811 for ; Wed, 11 Nov 2026 01:03:48 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=MeuLu4vJ; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4b7252a32c8so31362615e9.0 for ; Wed, 11 Nov 2026 01:03:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387826; x=1794992626; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=dfs4UrmjX6OzGIS2v0Tu/p6JAqFu30iOf/wzHRLOmwc=; b=MeuLu4vJCp0aux+y7AEi7w/vdZG5yUifXesRJE/hfBpByWA5dCoMfm7jsCz5/ozQT0 2J09/ci8zrjBB2idC7Wa0Yec0V9ojcKFRzaQzaQ+ga4CDbturz5VzAtZ+6TM3NeoKUpy mcRrGKx/iLl/foZ+jLQNBhszqYVa0hVdgbQchwpeMj2ipxsMySz9p0vyDCUQqV+C2AVM UgS+D1QjQ41reYIxHxbgwzphaonoqtlUz3I9xROqqg0Z7K0jTYyOPGUhj7jIqIH9F04a K/oZMMkFQWnfNob3Rp3/y2xGQ/2p/wdmeyo6Z4xpuLC1qkS3hPvGYxxRj7UBoIVXSgFO s2wA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387826; x=1794992626; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=dfs4UrmjX6OzGIS2v0Tu/p6JAqFu30iOf/wzHRLOmwc=; b=LAaiIWYQxFxhxZjW2ImVznFAjEtfyyHYzX8zaTpkMqUUcfQ0bA4BiYogBK+vlS+EU0 qCRYJhQHf6CyYF6KDtakBLdEK/QKhzwzATfomyJjv/+mwpyD65MkflnDAowHei+nNw+h K7DULJnu6tlt8TkCdmTYiVFyhYmOVqKmBdGZThMp4RM0QApP4hxhVqoROnO7xwak27Xs VHojnw6oFOZWmVJ4E56lZsL869cXcoD9vCv/fODs/EXYEwNA92SXfjscaJZ9Xg89YZbt VBfURkBuBuVwrs6GDT6lBCg/JzBM1QWt2X1WQTFWXWNFpZZqUO+fwVaohtPBqC6jfkg/ 6zxQ== X-Gm-Message-State: APuU4Z/UotqayllonarkahyMaoOqjJeRObZWBO7Ov+Gnvb8ARNMqAbsC HqW/m0NPERqqZ5TuctcnTCAweH+UDt0d+iH+AzewKYqBIOFDWpKAhngyxBMhuJyeUjUhhbbYVl3 9Ctr74RU= X-Gm-Gg: AYBFou13T98y/AD39B60nfD8SPN0v8S/rbQKwBB3lsbUlWBLBRkNlu+Rizs+eH8f8iO WWk/cit9IEJcdZOjibuj294xg4FxYIfa2Y4mzF/doWi0508LcD4IO3M5OKGFIYed75aQFWi5HxI 5bLMYuno/arN34EgY3a7txpSG6wLUSKEAp3t9SGG53zbYhTWfYpyg5ztGFNUYjL8xbUwPGTsDGx yd/CGr5/YN8WLr34Zc4KDgNYfa0f+24pnPWN2cT3qVAk3KXFmel/Q3E6wvqHF25wjnX/llVBZdl u2f+RzVNRRayoiwrvTgKwGm/J97FthWM7coakZECw/DAtsTR+ao9Yefujohb1V5tUhptGnBHqtk xfyWy+buq5mJb7TjdKhO5WBjR5t/diPAYRrMlKR/82AUCYKZeq3+17HjbxR0cz78ENSGUhFRBLJ 9vgl1dnlmiaGgeZejaO9GmWHajCy2jDJGdTOfsY5BCfyOBPCmt41u6+zJbmoNOR92K8sBS7iqMW iAloc6itRoCWNGcGW1JX9owwIqgSOpqWkP7jcmvoluK3Dv1YTq3IPFm9Fq6cOLi+lB61Lu5vzI4 uWYEHH30lGYCcTGi2tmgaU0xyAyjLOD72/2IV7XPlL3cuIP5/TsLJpRbu1lgWL8nJiw1NiA+AHl b+gdIhinFjpBdKziKKLEM2sdeCFWa X-Received: by 2002:a05:600c:6214:b0:4b5:d95c:2378 with SMTP id 5b1f17b1804b1-4ba0939815cmr27602035e9.34.1794387825741; Wed, 11 Nov 2026 01:03:45 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:40 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 22/35] bind: upgrade 9.20.29 -> 9.20.30 Date: Wed, 11 Nov 2026 10:02:48 +0100 Message-ID: <99227f53c199fe086fa3cae57933d3d90dd92083.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249994 From: Jaipaul Cheernam ReleaseNotes: https://bind9.readthedocs.io/en/v9.20.30/notes.html#notes-for-bind-9-20-30 CVE fixes: CVE-2026-19630, CVE-2026-96888, CVE-2026-97313, CVE-2026-94300 - Other bug fixes are mentioned in ReleaseNotes. - Refresh existing patches Signed-off-by: Jaipaul Cheernam Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 3d52bad81bb24f84af630b9bbd3cadd7048ceec5) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../bind/bind/0001-avoid-start-failure-with-bind-user.patch | 2 +- .../0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch | 2 +- ...0001-named-lwresd-V-and-start-log-hide-build-options.patch | 4 ++-- ...bind-ensure-searching-for-json-headers-searches-sysr.patch | 4 ++-- meta/recipes-connectivity/bind/bind/conf.patch | 2 +- .../bind/bind/init.d-add-support-for-read-only-rootfs.patch | 2 +- .../bind/bind/make-etc-initd-bind-stop-work.patch | 2 +- .../bind/{bind_9.20.29.bb => bind_9.20.30.bb} | 2 +- 8 files changed, 10 insertions(+), 10 deletions(-) rename meta/recipes-connectivity/bind/{bind_9.20.29.bb => bind_9.20.30.bb} (97%) diff --git a/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch index 15796a15fba..d302bc14810 100644 --- a/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch +++ b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch @@ -1,4 +1,4 @@ -From 95141cf9494292fc5645165ef3d5e9e2ed2208c6 Mon Sep 17 00:00:00 2001 +From 1c087c24e8162c7a042cf1f19ad313e0f3a21196 Mon Sep 17 00:00:00 2001 From: Chen Qi Date: Mon, 15 Oct 2018 16:55:09 +0800 Subject: [PATCH] avoid start failure with bind user diff --git a/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch b/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch index 99e781799da..eb0adcfabef 100644 --- a/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch +++ b/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch @@ -1,4 +1,4 @@ -From 06e9624eb7e474a08ed7e1a456bfe9759ba211da Mon Sep 17 00:00:00 2001 +From aa978a473328123575af0270dc1dd274050bdfc0 Mon Sep 17 00:00:00 2001 From: Khem Raj Date: Fri, 10 Apr 2026 23:33:49 +0000 Subject: [PATCH] m4: Backport ax_prog_cc_for_build.m4 macros diff --git a/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch index 80a4f2abded..5871fb433cd 100644 --- a/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch +++ b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch @@ -1,4 +1,4 @@ -From f28920a59b658fcda24efde1c45322f785a0b0fe Mon Sep 17 00:00:00 2001 +From 525570781b873c3434df49ac753afca7c1bd9613 Mon Sep 17 00:00:00 2001 From: Hongxu Jia Date: Mon, 27 Aug 2018 21:24:20 +0800 Subject: [PATCH] `named/lwresd -V' and start log hide build options @@ -20,7 +20,7 @@ Signed-off-by: Armin Kuster 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac -index 0bc3965..e1c2b12 100644 +index 4d02c6e..225f59c 100644 --- a/configure.ac +++ b/configure.ac @@ -35,7 +35,7 @@ AC_DEFINE([PACKAGE_VERSION_EXTRA], ["][bind_VERSION_EXTRA]["], [BIND 9 Extra par diff --git a/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch index 323985a4025..73300b46e87 100644 --- a/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch +++ b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch @@ -1,4 +1,4 @@ -From f003f396067e6cc1e2ec609b296bb642b8ddf47b Mon Sep 17 00:00:00 2001 +From 4388bec9a8ebd7d9dded4b1942a5670cdaec064f Mon Sep 17 00:00:00 2001 From: Paul Gortmaker Date: Tue, 9 Jun 2015 11:22:00 -0400 Subject: [PATCH] bind: ensure searching for json headers searches sysroot @@ -32,7 +32,7 @@ Signed-off-by: Paul Gortmaker 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac -index 26c442a..0bc3965 100644 +index 75088e5..4d02c6e 100644 --- a/configure.ac +++ b/configure.ac @@ -872,7 +872,7 @@ AS_CASE([$with_lmdb], diff --git a/meta/recipes-connectivity/bind/bind/conf.patch b/meta/recipes-connectivity/bind/bind/conf.patch index 28ee4ae74d3..f88f93951f1 100644 --- a/meta/recipes-connectivity/bind/bind/conf.patch +++ b/meta/recipes-connectivity/bind/bind/conf.patch @@ -1,4 +1,4 @@ -From 5fc3dfd3f994b5fd97e97837eee2ad808cd8af93 Mon Sep 17 00:00:00 2001 +From 65c90b60cc9f30c383b8e30b900abd04bc977bd1 Mon Sep 17 00:00:00 2001 From: Qing He Date: Tue, 30 Nov 2010 13:35:42 +0800 Subject: [PATCH] bind: add new recipe diff --git a/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch index b373251c47e..388335b2711 100644 --- a/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch +++ b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch @@ -1,4 +1,4 @@ -From 42c109317070d19fda70635b7043cbc6f9ec36ef Mon Sep 17 00:00:00 2001 +From c58e1309e80449ecc1fa1fa793630b53c08f958e Mon Sep 17 00:00:00 2001 From: Chen Qi Date: Thu, 27 Mar 2014 02:34:41 +0000 Subject: [PATCH] init.d: add support for read-only rootfs diff --git a/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch index 74cf947787a..bd6ada88228 100644 --- a/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch +++ b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch @@ -1,4 +1,4 @@ -From 2e1314f2e71be15704ba18756250185b36a5c0da Mon Sep 17 00:00:00 2001 +From ad9cb821a119f441f6131e01715d5e0eab368fc0 Mon Sep 17 00:00:00 2001 From: Roy Li Date: Thu, 15 Nov 2012 02:27:54 +0000 Subject: [PATCH] bind: make "/etc/init.d/bind stop" work diff --git a/meta/recipes-connectivity/bind/bind_9.20.29.bb b/meta/recipes-connectivity/bind/bind_9.20.30.bb similarity index 97% rename from meta/recipes-connectivity/bind/bind_9.20.29.bb rename to meta/recipes-connectivity/bind/bind_9.20.30.bb index 5ce94d597b4..bf51c48b601 100644 --- a/meta/recipes-connectivity/bind/bind_9.20.29.bb +++ b/meta/recipes-connectivity/bind/bind_9.20.30.bb @@ -21,7 +21,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \ file://0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch \ " -SRC_URI[sha256sum] = "587029508b3b1b43229fae416c97e5543aba45809cefaca98a5004a02a5736c1" +SRC_URI[sha256sum] = "9e1443a40a72a30272cbc3196d020a6b2e26937111c83e59e101e82e1e3b4fef" UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/" # follow the ESV versions divisible by 2 From patchwork Wed Nov 11 09:02:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103714 Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5609.1794387832046817120 for ; Wed, 11 Nov 2026 01:03:52 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=R5DeJ5Mu; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4a35d5d4a20so34887275e9.2 for ; Wed, 11 Nov 2026 01:03:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387830; x=1794992630; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=OtSpbWACKe+WGV2pJKXTIetJE4+SH29LioSZ7zrwyd0=; b=R5DeJ5MusMrGk2IN1oki43i32hUmCYiMjlfvbwrqx+bSwXeC2326lwiZJeQgjE1ywa lwTT7ZxJySh2CIa+tlfCHH+qcj2n/xMqalrt/bFF9HVniUjJmC3o13mo2RXiuczAXsOs 7vGqVeUd1Hhcz13ZpTsGi6M1MYr+PHbWNCGRJnfABHrlWCWjg3qJxlyj8J6x9fJreVqq HG2ZAFajq6n3zpXkszpWGdaIpkzJkkJfNKb9nUsdT5BwoWa0KaISGBTXIWcw90IFthds 4KSLUybjreRROUG8C26KGeIrUQSqU1cM9zKxKr0EEil3Z5YJwY/BGqVkPxxKLeKqRoHa lPdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387830; x=1794992630; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=OtSpbWACKe+WGV2pJKXTIetJE4+SH29LioSZ7zrwyd0=; b=pkelHmPzx/xl1+REMot+OI20wg3MAbYAE4H50wNUvipskeW/wX4DiRwQM4Ac0UHCcq 4cJJzCpb1WxVKHdevXgYI4kTX+Vp5L3lAjLYQS8lr87TmGD92Tgw462XCoB0VfezhRDN H66T23bwT9uYvpof6/hs+ljPhYsp0+1Dxn+l43yxNUY+5B/YnHhfjd+qDJHAKz7K6gmz b8z4ELlwNLaa6JMNnVZCGqUE+6o0QtHWdkM08CQ0LZYV6jGLgav8JE+mbBgPWZunQpBq rlEs4wDRj/GTdLeVgCysEkDG4duFmGcO/44l+IhNDSdgPP6n1cP+CwEbjPXtmX1hEgJd Iz3g== X-Gm-Message-State: APuU4Z8dlmQ2SUbzbIKlp3g23dIbO6YFFk0wTO+qWAQPpKfKXNLDeAKU xpYpsYpr0q7M/Yd8MCTl4xb0OXRjxYmAvVLAI5zSLTnp8bGaRTt6UcBQvk5jOo5dVndSeq7c7j/ kZBDa2u0= X-Gm-Gg: AYBFou1vo/tIuHoy556l4jdxOVCy5ABn0wKO4HrE0PjIoYv3C37CZkabuZi7BtZTZWo 4BdQ9fZF6F0QlD9uci2fsmL7NQn06+6MwsnxM75SkoyHlz2GBEWY8AlmlSy1WXE0MWBsKSymDzO QIT8bJZu8JKvLrHijfCRCxgpRdbJAY3xyV00l9runQlP/A9UdOC5mwIXp1Hs7yujQPKnmK1s6rO g4/oDer0a8o/VRhcWJ1taFTuyAO+1LqavW0V8fqWy7aJEaEGdTAH96r0byIZLC8K4rczVNhKu2S ebqW44o+yqXVFQW36sR8RY5GPoXOHZidk2PHk7poSqT20zgl4PRO2zxEzok0xzqkGw911FkDM5f JQf2QX4ccHlIh9aIdGzn/U70Q6umT/ym8ynEsaK7m2IM///Fb4bD360AitLVpnELvPOFLAjv+32 fHQ/iZyngWXo9WJBJrTjj+i8IVcCY4oRNK2wzl0fZJk6TMHA3NbvXTUqhrdq5ckl8JvtkDcwP/P NgpVb8HwlqYlxW2byC0/mNv4W+JYocM5lwKXqj3tEOWZWB/75zuTPVyYy/K2jV6rmMCUDJGkjth s1kHzt7JhO5CXBQURHty3HD+ojIkAbh8zyAb9F6+gjxGjU/mooJ7hsf273AJwH2Tib5eMaYjg9p bJi4jTXhVePPpzhwHGyPrN/OOp6g/0cLEvn+IRf/2rS0jEjEMKg== X-Received: by 2002:a05:600c:4e45:b0:4a4:7a8d:c436 with SMTP id 5b1f17b1804b1-4ba0936c0c7mr30790955e9.11.1794387830252; Wed, 11 Nov 2026 01:03:50 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.45 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:47 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 23/35] recipe_sanity: Drop rename overwrite detection Date: Wed, 11 Nov 2026 10:02:49 +0100 Message-ID: <8e87f72f501cc1845a90cdb1c2b351a6cb63aee8.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249995 From: Richard Purdie Bitbake itself checks for probelmatic renames now during key expansion so this check shouldn't be needed anymore (it dates from pre 2011). (https://git.openembedded.org/bitbake/tree/lib/bb/data.py#n96 in expandKeys()) Signed-off-by: Richard Purdie (cherry picked from commit 7944665886cb0bf881807a5d849ebdf42a33d1bf) The corresponding bitbake change was merged in 2.18: 4986a548e (data: Fix expandKeys recursion issue). Include this in wrynose as well so layers using this class continue to work. Signed-off-by: Anuj Mittal Signed-off-by: Yoann Congal --- meta/classes/recipe_sanity.bbclass | 21 --------------------- 1 file changed, 21 deletions(-) diff --git a/meta/classes/recipe_sanity.bbclass b/meta/classes/recipe_sanity.bbclass index a5cc4315fb8..3c763de1f20 100644 --- a/meta/classes/recipe_sanity.bbclass +++ b/meta/classes/recipe_sanity.bbclass @@ -34,13 +34,6 @@ def req_vars(cfgdata, d): elif val == cfgval: __note("%s should be defined to something other than default (%s)" % (var, cfgval), d) -def var_renames_overwrite(cfgdata, d): - renames = d.getVar("__recipe_sanity_renames", False) - if renames: - for (key, newkey, oldvalue, newvalue) in renames: - if oldvalue != newvalue and oldvalue != cfgdata.get(newkey): - __note("rename of variable '%s' to '%s' overwrote existing value '%s' with '%s'." % (key, newkey, oldvalue, newvalue), d) - def incorrect_nonempty_PACKAGES(cfgdata, d): if bb.data.inherits_class("native", d) or \ bb.data.inherits_class("cross", d): @@ -113,7 +106,6 @@ python do_recipe_sanity () { __note(msg, d) can_delete_others(p, cfgdata, d) - var_renames_overwrite(cfgdata, d) req_vars(cfgdata, d) bad_runtime_vars(cfgdata, d) } @@ -137,19 +129,6 @@ python recipe_sanity_eh () { d.setVar("__recipe_sanity_cfgdata", cfgdata) #d.setVar("__recipe_sanity_cfgdata", d) - - # Sick, very sick.. - from bb.data_smart import DataSmart - old = DataSmart.renameVar - def myrename(self, key, newkey): - oldvalue = self.getVar(newkey, 0) - old(self, key, newkey) - newvalue = self.getVar(newkey, 0) - if oldvalue: - renames = self.getVar("__recipe_sanity_renames", 0) or set() - renames.add((key, newkey, oldvalue, newvalue)) - self.setVar("__recipe_sanity_renames", renames) - DataSmart.renameVar = myrename } addhandler recipe_sanity_eh recipe_sanity_eh[eventmask] = "bb.event.ConfigParsed" From patchwork Wed Nov 11 09:02:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103716 Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5592.1794387833249212292 for ; Wed, 11 Nov 2026 01:03:53 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=NAmEyP5V; spf=pass (domain: smile.fr, ip: 209.85.128.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-4a208d93758so31405825e9.3 for ; Wed, 11 Nov 2026 01:03:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387831; x=1794992631; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=YzsyIUBC6dwcc8Pccu/0DdyLFwc7oGHdw5dQGHVWaiE=; b=NAmEyP5Vl52dV4bejAUQIKHUFGsnI8tSB5nbKXBZkFQH0wXV7HIilV/DHmhmB/ldN8 5e1S1RjikzjnnSAwKpegiyKN693JhNaX5MPGgNqgp+e/TVKPhCohtoIuIceLlMrjATJ5 KSr+yKXQbVbNTXyMMbDTWgTgLVYybCPQmT3jboYkTj1uxyb7TkuBW4KP6UrOpmyL7uXu Eqt4WrBPsKmqRjYwbg6VZCHKGV5q/RfObktVf6C2EbOuEPVWFflHBF/WRP7q0z5zf2lY MayOMqwgBGdkd+MYCmnrtn6YI+lYlTrXYMQgoVO3ngup7z5cUwfrHKxtIUkqA+Qc4Gmb rpSw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387831; x=1794992631; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=YzsyIUBC6dwcc8Pccu/0DdyLFwc7oGHdw5dQGHVWaiE=; b=USBHzgc9MYktiieHvttlN2cQDRlTxjAJJYtDHn+cW0ldRE5+qkL5ba/2maXb+tWn+8 mBBl2s9ERfImKQol+L0v75fzDEuNgQllO1+5+0f89diBR2mEfAO3bhafAvqxRdiIFFzl vfPSGmvwCt7iHQk64i6Mwj4yKzB/UspgmhIXTKbj413E8dMezeMS4y5A/624zq3CwXI/ LjgKjK7uQlq+v6bwetHSdz7lep6uiTLD/CN/3tqzBE5o5+WB4za4HiMWav9zDxJYTPBr eSizeV09t8HiNx2YLPchaPZqFSgSpxiIjv/TkDciiYlP77i5mIxK7ZmWWMWdEFrmzgkq KQwQ== X-Gm-Message-State: APuU4Z80lC2vADQPMtWCxPAtsgN/qzU1TvTR6Ej8o6lxKeFK8IcoFJua n+KEL7IdF5PZA1/bXPEkcsmwX1RAOWMee/D2ZQcZUqukHCvjUZ9y8prEL3s1IixBqLhkEO8saA9 5hIsebcE= X-Gm-Gg: AYBFou3UVrIqzYR/JO63I0kc2tE9j8J4HbD27xsbw+EXAUHeNyPm4B0YyzESTcKcmkB r5ePPTWzgDoBc4dU2z5rSdB/NkgPCe2D9r6YTRocYoWfqSuBg90dECM9pWDWZ6KYU1w8bEJOLpT BLObqXqqP26dTU/fuVklJ6mWcWahdeEah64ID4R5SG7fZB60n4FL+h7ycEELwyhbWi+0uisMbcZ FrxlJycSDn4rPS14LhZEQrp+76wsx8ILso+MlJcMywwC8dJSfVZkRFZ2PCVDHkHtoa1W11S6lVx AQ+1Hu/PRLchHLnOn6JOwgY4Y1MjUCYKLQ0/2vdsh4f1WEOzuLGMC5Xx4DwR6F5fJN6A0/ISHXr CedPOIzab6dMy2FCTVWuM/r4BwBDtVQTOpvP2guoOT7EzjO0zLr9nRhLNzxdIFOEa1ZhuyrphIC I/PGdSiJmsMpA6NwaAx0+vyLhpgGLkmBcjIK4Z1O+ajKaFK+lA15EQeqjLA5Rp2ll3alX2OhMd0 mKIGpIM8KAGIb2UsaGL+8ldYONvtnud/WxenaXVIIvxO4zt8vnnMOzWBBSp8YXHjJTsyhezeops +ddsDTqd3kDduw5xqVAoubAURPnzNJV9dFmoVUNsCz1scj/m7B1RHaC+mIDVNo7o5/W/5X8gvCj MjyKUhMMI0U3buHqGfkuFMeyF/splKDWbtt7MXO8BihVFLyUldg== X-Received: by 2002:a05:600c:190a:b0:49f:e8bf:8f9b with SMTP id 5b1f17b1804b1-4ba0931da12mr29195535e9.4.1794387831293; Wed, 11 Nov 2026 01:03:51 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:50 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 24/35] dropbear: add follow-up patches for CVE-2019-6111 Date: Wed, 11 Nov 2026 10:02:50 +0100 Message-ID: <91e732820a06e83bf4ca334a09d5841c0a89d32a.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249996 From: Peter Marko Pick additional patches referencing this CVE from 2026.90 or 2026.91 releases. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: Note: this might change user-visible behavior: a Remote to local "scp -r" into an existing directory will now return an error. ] --- .../dropbear/dropbear/CVE-2019-6111-01.patch | 364 ++++++++++++++++++ .../dropbear/dropbear/CVE-2019-6111-02.patch | 43 +++ .../dropbear/dropbear/CVE-2019-6111-03.patch | 34 ++ .../dropbear/dropbear/CVE-2019-6111-04.patch | 43 +++ .../recipes-core/dropbear/dropbear_2025.89.bb | 4 + 5 files changed, 488 insertions(+) create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch new file mode 100644 index 00000000000..8e6da5fc23f --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch @@ -0,0 +1,364 @@ +From 143291baca6ebb3407a0c25c85bd53bf041a6ab7 Mon Sep 17 00:00:00 2001 +From: Matt Johnston +Date: Mon, 20 Apr 2026 20:57:11 +0800 +Subject: [PATCH] scp: more CVE-2019-6111 fix + +Cherrypicked from OpenSSH portable + +commit 3d896c157c722bc47adca51a58dca859225b5874 +djm Sun Feb 10 11:15:52 2019 +0000 + +upstream: when checking that filenames sent by the server side + +match what the client requested, be prepared to handle shell-style brace +alternations, e.g. "{foo,bar}". + +"looks good to me" millert@ + in snaps for the last week courtesy +deraadt@ + +CVE: CVE-2019-6111 +Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/143291baca6ebb3407a0c25c85bd53bf041a6ab7] +Signed-off-by: Peter Marko +--- + src/scp.c | 281 +++++++++++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 269 insertions(+), 12 deletions(-) + +diff --git a/src/scp.c b/src/scp.c +index bf98986c..d151587c 100644 +--- a/src/scp.c ++++ b/src/scp.c +@@ -74,7 +74,6 @@ + */ + + #include "includes.h" +-/*RCSID("$OpenBSD: scp.c,v 1.130 2006/01/31 10:35:43 djm Exp $");*/ + + #include + +@@ -600,6 +599,253 @@ tolocal(int argc, char **argv) + } + } + ++/* Appends a string to an array; returns 0 on success, -1 on alloc failure */ ++static int ++append(char *cp, char ***ap, size_t *np) ++{ ++ char **tmp; ++ ++ if ((tmp = reallocarray(*ap, *np + 1, sizeof(*tmp))) == NULL) ++ return -1; ++ tmp[(*np)] = cp; ++ (*np)++; ++ *ap = tmp; ++ return 0; ++} ++ ++/* ++ * Finds the start and end of the first brace pair in the pattern. ++ * returns 0 on success or -1 for invalid patterns. ++ */ ++static int ++find_brace(const char *pattern, int *startp, int *endp) ++{ ++ int i; ++ int in_bracket, brace_level; ++ ++ *startp = *endp = -1; ++ in_bracket = brace_level = 0; ++ for (i = 0; i < INT_MAX && *endp < 0 && pattern[i] != '\0'; i++) { ++ switch (pattern[i]) { ++ case '\\': ++ /* skip next character */ ++ if (pattern[i + 1] != '\0') ++ i++; ++ break; ++ case '[': ++ in_bracket = 1; ++ break; ++ case ']': ++ in_bracket = 0; ++ break; ++ case '{': ++ if (in_bracket) ++ break; ++ if (pattern[i + 1] == '}') { ++ /* Protect a single {}, for find(1), like csh */ ++ i++; /* skip */ ++ break; ++ } ++ if (*startp == -1) ++ *startp = i; ++ brace_level++; ++ break; ++ case '}': ++ if (in_bracket) ++ break; ++ if (*startp < 0) { ++ /* Unbalanced brace */ ++ return -1; ++ } ++ if (--brace_level <= 0) ++ *endp = i; ++ break; ++ } ++ } ++ /* unbalanced brackets/braces */ ++ if (*endp < 0 && (*startp >= 0 || in_bracket)) ++ return -1; ++ return 0; ++} ++ ++/* ++ * Assembles and records a successfully-expanded pattern, returns -1 on ++ * alloc failure. ++ */ ++static int ++emit_expansion(const char *pattern, int brace_start, int brace_end, ++ int sel_start, int sel_end, char ***patternsp, size_t *npatternsp) ++{ ++ char *cp; ++ int o = 0, tail_len = strlen(pattern + brace_end + 1); ++ ++ if ((cp = malloc(brace_start + (sel_end - sel_start) + ++ tail_len + 1)) == NULL) ++ return -1; ++ ++ /* Pattern before initial brace */ ++ if (brace_start > 0) { ++ memcpy(cp, pattern, brace_start); ++ o = brace_start; ++ } ++ /* Current braced selection */ ++ if (sel_end - sel_start > 0) { ++ memcpy(cp + o, pattern + sel_start, ++ sel_end - sel_start); ++ o += sel_end - sel_start; ++ } ++ /* Remainder of pattern after closing brace */ ++ if (tail_len > 0) { ++ memcpy(cp + o, pattern + brace_end + 1, tail_len); ++ o += tail_len; ++ } ++ cp[o] = '\0'; ++ if (append(cp, patternsp, npatternsp) != 0) { ++ free(cp); ++ return -1; ++ } ++ return 0; ++} ++ ++/* ++ * Expand the first encountered brace in pattern, appending the expanded ++ * patterns it yielded to the *patternsp array. ++ * ++ * Returns 0 on success or -1 on allocation failure. ++ * ++ * Signals whether expansion was performed via *expanded and whether ++ * pattern was invalid via *invalid. ++ */ ++static int ++brace_expand_one(const char *pattern, char ***patternsp, size_t *npatternsp, ++ int *expanded, int *invalid) ++{ ++ int i; ++ int in_bracket, brace_start, brace_end, brace_level; ++ int sel_start, sel_end; ++ ++ *invalid = *expanded = 0; ++ ++ if (find_brace(pattern, &brace_start, &brace_end) != 0) { ++ *invalid = 1; ++ return 0; ++ } else if (brace_start == -1) ++ return 0; ++ ++ in_bracket = brace_level = 0; ++ for (i = sel_start = brace_start + 1; i < brace_end; i++) { ++ switch (pattern[i]) { ++ case '{': ++ if (in_bracket) ++ break; ++ brace_level++; ++ break; ++ case '}': ++ if (in_bracket) ++ break; ++ brace_level--; ++ break; ++ case '[': ++ in_bracket = 1; ++ break; ++ case ']': ++ in_bracket = 0; ++ break; ++ case '\\': ++ if (i < brace_end - 1) ++ i++; /* skip */ ++ break; ++ } ++ if (pattern[i] == ',' || i == brace_end - 1) { ++ if (in_bracket || brace_level > 0) ++ continue; ++ /* End of a selection, emit an expanded pattern */ ++ ++ /* Adjust end index for last selection */ ++ sel_end = (i == brace_end - 1) ? brace_end : i; ++ if (emit_expansion(pattern, brace_start, brace_end, ++ sel_start, sel_end, patternsp, npatternsp) != 0) ++ return -1; ++ /* move on to the next selection */ ++ sel_start = i + 1; ++ continue; ++ } ++ } ++ if (in_bracket || brace_level > 0) { ++ *invalid = 1; ++ return 0; ++ } ++ /* success */ ++ *expanded = 1; ++ return 0; ++} ++ ++/* Expand braces from pattern. Returns 0 on success, -1 on failure */ ++static int ++brace_expand(const char *pattern, char ***patternsp, size_t *npatternsp) ++{ ++ char *cp, *cp2, **active = NULL, **done = NULL; ++ size_t i, nactive = 0, ndone = 0; ++ int ret = -1, invalid = 0, expanded = 0; ++ ++ *patternsp = NULL; ++ *npatternsp = 0; ++ ++ /* Start the worklist with the original pattern */ ++ if ((cp = strdup(pattern)) == NULL) ++ return -1; ++ if (append(cp, &active, &nactive) != 0) { ++ free(cp); ++ return -1; ++ } ++ while (nactive > 0) { ++ cp = active[nactive - 1]; ++ nactive--; ++ if (brace_expand_one(cp, &active, &nactive, ++ &expanded, &invalid) == -1) { ++ free(cp); ++ goto fail; ++ } ++ if (invalid) ++ fatal("%s: invalid brace pattern \"%s\"", __func__, cp); ++ if (expanded) { ++ /* ++ * Current entry expanded to new entries on the ++ * active list; discard the progenitor pattern. ++ */ ++ free(cp); ++ continue; ++ } ++ /* ++ * Pattern did not expand; append the finename component to ++ * the completed list ++ */ ++ if ((cp2 = strrchr(cp, '/')) != NULL) ++ *cp2++ = '\0'; ++ else ++ cp2 = cp; ++ if (append(xstrdup(cp2), &done, &ndone) != 0) { ++ free(cp); ++ goto fail; ++ } ++ free(cp); ++ } ++ /* success */ ++ *patternsp = done; ++ *npatternsp = ndone; ++ done = NULL; ++ ndone = 0; ++ ret = 0; ++ fail: ++ for (i = 0; i < nactive; i++) ++ free(active[i]); ++ free(active); ++ for (i = 0; i < ndone; i++) ++ free(done[i]); ++ free(done); ++ return ret; ++} ++ + void + source(int argc, char **argv) + { +@@ -841,7 +1087,8 @@ sink(int argc, char **argv, const char *src) + off_t size, statbytes; + int setimes, targisdir, wrerrno = 0; + char ch, *cp, *np, *targ, *why, *vect[1], buf[2048]; +- char *src_copy = NULL, *restrict_pattern = NULL; ++ char **patterns = NULL; ++ size_t n, npatterns = 0; + struct timeval tv[2]; + + #define atime tv[0] +@@ -868,16 +1115,13 @@ sink(int argc, char **argv, const char *src) + * Prepare to try to restrict incoming filenames to match + * the requested destination file glob. + */ +- if ((src_copy = strdup(src)) == NULL) +- fatal("strdup failed"); +- if ((restrict_pattern = strrchr(src_copy, '/')) != NULL) { +- *restrict_pattern++ = '\0'; +- } ++ if (brace_expand(src, &patterns, &npatterns) != 0) ++ fatal("%s: could not expand pattern", __func__); + } + for (first = 1;; first = 0) { + cp = buf; + if (atomicio(read, remin, cp, 1) != 1) +- return; ++ goto done; + if (*cp++ == '\n') + SCREWUP("unexpected "); + do { +@@ -900,7 +1144,7 @@ sink(int argc, char **argv, const char *src) + } + if (buf[0] == 'E') { + (void) atomicio(vwrite, remout, "", 1); +- return; ++ goto done; + } + if (ch == '\n') + *--cp = 0; +@@ -956,9 +1200,14 @@ sink(int argc, char **argv, const char *src) + run_err("error: unexpected filename: %s", cp); + exit(1); + } +- if (restrict_pattern != NULL && +- fnmatch(restrict_pattern, cp, 0) != 0) +- SCREWUP("filename does not match request"); ++ if (npatterns > 0) { ++ for (n = 0; n < npatterns; n++) { ++ if (fnmatch(patterns[n], cp, 0) == 0) ++ break; ++ } ++ if (n >= npatterns) ++ SCREWUP("filename does not match request"); ++ } + if (targisdir) { + static char *namebuf = NULL; + static size_t cursize = 0; +@@ -1123,7 +1372,15 @@ bad: run_err("%s: %s", np, strerror(errno)); + break; + } + } ++done: ++ for (n = 0; n < npatterns; n++) ++ free(patterns[n]); ++ free(patterns); ++ return; + screwup: ++ for (n = 0; n < npatterns; n++) ++ free(patterns[n]); ++ free(patterns); + run_err("protocol error: %s", why); + exit(1); + } diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch new file mode 100644 index 00000000000..99819b732ad --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch @@ -0,0 +1,43 @@ +From 61bd0e3e6573277de17359763aa5827a189c8d7f Mon Sep 17 00:00:00 2001 +From: Matt Johnston +Date: Sat, 2 May 2026 08:43:26 +0800 +Subject: [PATCH] scp: Disallow -r to an existing directory + +Checks of received paths don't catch all cases in -r recursive mode, so +disallow -r when the destination directory exists. This mitigates +CVE-2019-6111, where unexpected files would be accepted from a malicious +scp server. + +Alternatives like rsync could be used in that case. + +The new error message may be misleading if parent path components of the +destination are also missing, though the command would have failed +regardless. + +CVE: CVE-2019-6111 +Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/61bd0e3e6573277de17359763aa5827a189c8d7f] +Signed-off-by: Peter Marko +--- + src/scp.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/src/scp.c b/src/scp.c +index d151587c..09297a5b 100644 +--- a/src/scp.c ++++ b/src/scp.c +@@ -583,6 +583,15 @@ tolocal(int argc, char **argv) + if (*suser == '\0') + suser = NULL; + } ++ ++ char *dest = *(argv + argc - 1); ++ if (!(access(dest, F_OK) == 0 && errno == ENOENT)) { ++ /* paths sent from the server in recursive mode aren't adequately ++ * checked that they match the requested files, so disallow this */ ++ fprintf(stderr, "-r destination \"%s\" must not already exist\n", dest); ++ exit(1); ++ } ++ + host = cleanhostname(host); + len = strlen(src) + CMDNEEDS + 20; + bp = xmalloc(len); diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch new file mode 100644 index 00000000000..c70bf4bb68c --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch @@ -0,0 +1,34 @@ +From 0c5629a5d543ef5e4eff43345b1eedf2afef84ca Mon Sep 17 00:00:00 2001 +From: Matt Johnston +Date: Mon, 4 May 2026 21:35:57 +0800 +Subject: [PATCH] scp: don't use reallocarray + +reallocarray() isn't portable. An overflow check can be used instead. + +Fixes: 143291baca6e ("scp: more CVE-2019-6111 fix") + +CVE: CVE-2019-6111 +Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/0c5629a5d543ef5e4eff43345b1eedf2afef84ca] +Signed-off-by: Peter Marko +--- + src/scp.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/src/scp.c b/src/scp.c +index e5ce4e2f..2f7a6279 100644 +--- a/src/scp.c ++++ b/src/scp.c +@@ -614,7 +614,12 @@ append(char *cp, char ***ap, size_t *np) + { + char **tmp; + +- if ((tmp = reallocarray(*ap, *np + 1, sizeof(*tmp))) == NULL) ++ if (*np + 1 > (SIZE_MAX / sizeof(*tmp))) { ++ /* overflow */ ++ return -1; ++ } ++ ++ if ((tmp = realloc(*ap, (*np + 1) * sizeof(*tmp))) == NULL) + return -1; + tmp[(*np)] = cp; + (*np)++; diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch new file mode 100644 index 00000000000..810e7e7963c --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch @@ -0,0 +1,43 @@ +From 16ce059ed8e914e210af67e199041943ec747034 Mon Sep 17 00:00:00 2001 +From: Matt Johnston +Date: Mon, 4 May 2026 21:36:41 +0800 +Subject: [PATCH] scp: fix recursive overwrite check + +Non-recursive transfers were incorrectly disallowed to an existing +destination. + +In addition, the destination check logic was wrong. + +Fixes: 61bd0e3e6573 ("scp: Disallow -r to an existing directory") + +CVE: CVE-2019-6111 +Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/16ce059ed8e914e210af67e199041943ec747034] +Signed-off-by: Peter Marko +--- + src/scp.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/src/scp.c b/src/scp.c +index 2f7a6279..4b4990ea 100644 +--- a/src/scp.c ++++ b/src/scp.c +@@ -585,11 +585,14 @@ tolocal(int argc, char **argv) + } + + char *dest = *(argv + argc - 1); +- if (!(access(dest, F_OK) == 0 && errno == ENOENT)) { +- /* paths sent from the server in recursive mode aren't adequately +- * checked that they match the requested files, so disallow this */ +- fprintf(stderr, "-r destination \"%s\" must not already exist\n", dest); +- exit(1); ++ if (iamrecursive) { ++ /* Destination must not exist */ ++ if (!(access(dest, F_OK) == -1 && errno == ENOENT)) { ++ /* paths sent from the server in recursive mode aren't adequately ++ * checked that they match the requested files, so disallow this */ ++ fprintf(stderr, "-r destination \"%s\" must not already exist\n", dest); ++ exit(1); ++ } + } + + host = cleanhostname(host); diff --git a/meta/recipes-core/dropbear/dropbear_2025.89.bb b/meta/recipes-core/dropbear/dropbear_2025.89.bb index 685ecf9a1b3..6cb520f68d9 100644 --- a/meta/recipes-core/dropbear/dropbear_2025.89.bb +++ b/meta/recipes-core/dropbear/dropbear_2025.89.bb @@ -25,6 +25,10 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \ file://dropbear.socket \ file://dropbear.default \ ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \ + file://CVE-2019-6111-01.patch \ + file://CVE-2019-6111-02.patch \ + file://CVE-2019-6111-03.patch \ + file://CVE-2019-6111-04.patch \ " SRC_URI[sha256sum] = "0d1f7ca711cfc336dc8a85e672cab9cfd8223a02fe2da0a4a7aeb58c9e113634" From patchwork Wed Nov 11 09:02:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103717 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5611.1794387833967914782 for ; Wed, 11 Nov 2026 01:03:54 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=M/LCXhCD; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4a549cd7fd2so26477005e9.0 for ; Wed, 11 Nov 2026 01:03:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387832; x=1794992632; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=OrpKjzWNNHibYrJp4JK3jf10yTcz2hwXDjHmZPJ/00g=; b=M/LCXhCDsUgaBDZeQ2vcWiWxewHdpvw4YxgwhqEFF23R8bBIGWfNquCpKFkZtFKY9M zUv15trt3GEd1GqmSaT83ovsS9jXZ7kgw0UYR3sM1PIku6/p4CGNsFne3YL5PQ8hS6DZ T742E7cs+RfmebcqjaZW31Xf+1gwHA/mtb9pODeAnTs1XCLJmXBwyGqiAJNssmdj3xcA CKEDojFfwq7Pc7UN4jfYgLmnGXdAOi2OB5dyu7UYdGa0JjTu672YcOa2uBi5PyWwlpZK X4PZ50wjY34u8PJoCxc9SmzuervDwfpjyHs7BpT7hP6Y/vFe1jiE4ckyzxzy4AXtvCMT m0FQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387832; x=1794992632; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=OrpKjzWNNHibYrJp4JK3jf10yTcz2hwXDjHmZPJ/00g=; b=13S0uou88yX24oFJkdhda/gXUaa+NTzDx/e4ceX2K0Whpy90sl1L3Eblk3tpTjIBLj bHmUg2pGjj889jMMWiztLJ9e2PXhyYm//sVVkVDwA4qQGM9Rg2Jktgc74Ht+FQiFzexQ c5d2YNqUBgzKqtkW95usGXWlcCHkpWrcZBqh0DpMXUJ5uXUH1IziNbOOmkjQaFEYHYdi rZPOlhTInQtV3hpUjD6d088HE2U+jB52Q43ZlCDr9wgjO6Pax+kC5POBVzcT01Sbjew9 GKATUfqf7BJHBA9aGzuuuKTKkOcENtNPmC/xaVVo0LiPPNoD8wnhUZIkUfspRQgepdMe 3e0g== X-Gm-Message-State: APuU4Z/0QDj7gN/peC9NBGM7n2CCNRAVk6lHRQVmyfLGar+b8fcVvaWW 95FKtb55cEyqO0WWRpayOBCtRYdwADM/JEVQS13KpEhPJSObWZTjmUbXMgwujcBK9HCcqCxxxvN ZiI1r/V4= X-Gm-Gg: AYBFou1ElB+h2L5TpsBWh9+QhOYMb6MWiiYzLOFVYyw/sMRRyK0Co73y3hjF+dXUzmm sFHj/mmUkfGDtBC47uhQzmZGvetjhyQKN1PbIVcS9+oUrkg1rCxdnbOUqavgWJAC9T61zXSEBCZ kxhx9Ep90UlZjV1VRjQAyCZloBdsf32+pNXO6PoDLVWoytOynJjs9IW4YT6gsLUktztM3e/6dbU aigktSXicMTL7zWqM44o1eJQHQoGwPUkrjl0GEm4Uoz4x/+oziA0GZKxdpA/q8p/qG2H+1zY9c1 gfS7tkHjjsn2f3DavrGzA2TW5e+oJa0BzvMCK7VQ1roOG43IPKG8GMZAfsQAGIejul0xA7oPhc3 fZSxB/0//n5GJ7fa8+E6of/ehQghTrJD9SiIkW04tnwQjEcy0bqb3BfMPZclMp073Up17kNfDUd l7+Rp+tbUUZSF9zA006D8f+jbHBzY6e+k8ok3GrdiZxw4OgN+cPRz/5/A5U/YbOERTeV5Ysq6F5 HDm6m8ydSyfToN5rzxBfSFjScI7XgjZxnZrJ5PTOSHfESLf774p3wdIr+06LJ++nMeoqWqrmAm6 G8rkAl/ZuXWMLq7zjBOVsYIrKSk6/SINy6szJC0DBLXmMMFpD36YtYvynEkrb4KjBjDQBzMRyot wUoLP9oeOHOBGEvlpgCJv/+JRibToxBPqXy6iCmlI0ZVGk7J+ao4= X-Received: by 2002:a05:600c:4f82:b0:4a1:88df:8a2a with SMTP id 5b1f17b1804b1-4ba09376146mr29921955e9.13.1794387832087; Wed, 11 Nov 2026 01:03:52 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:51 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 25/35] dropbear: patch CVE-2026-35385 Date: Wed, 11 Nov 2026 10:02:51 +0100 Message-ID: <0edb50e9b5a2642cfc1a063599f877c71e4511a7.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249997 From: Peter Marko Pick patch referencing this CVE from 2026.90 release. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../dropbear/dropbear/CVE-2026-35385.patch | 42 +++++++++++++++++++ .../recipes-core/dropbear/dropbear_2025.89.bb | 1 + 2 files changed, 43 insertions(+) create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch b/meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch new file mode 100644 index 00000000000..6794acd57a0 --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch @@ -0,0 +1,42 @@ +From 443ccc1fd1b9a4e3747f6b5cd644b7af49064308 Mon Sep 17 00:00:00 2001 +From: Matt Johnston +Date: Sat, 2 May 2026 08:17:25 +0800 +Subject: [PATCH] scp: clear setuid/setgid bits on received files + +From openssh-portable 487e8ac146f7d6616f65c125d5edb210519b833a +Tracked as CVE-2026-35385 + +upstream: when downloading files as root in legacy (-O) mode and + +without the -p (preserve modes) flag set, clear setuid/setgid bits from +downloaded files as one might expect. + +AFAIK this bug dates back to the original Berkeley rcp program. + +Reported by Christos Papakonstantinou of Cantina and Spearbit. + +OpenBSD-Commit-ID: 49e902fca8dd933a92a9b547ab31f63e86729fa1 + +CVE: CVE-2026-35385 +Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/443ccc1fd1b9a4e3747f6b5cd644b7af49064308] +Signed-off-by: Peter Marko +--- + src/scp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/scp.c b/src/scp.c +index 09297a5b..79b0a12d 100644 +--- a/src/scp.c ++++ b/src/scp.c +@@ -1114,8 +1114,10 @@ sink(int argc, char **argv, const char *src) + + setimes = targisdir = 0; + mask = umask(0); +- if (!pflag) ++ if (!pflag) { ++ mask |= 07000; + (void) umask(mask); ++ } + if (argc != 1) { + run_err("ambiguous target"); + exit(1); diff --git a/meta/recipes-core/dropbear/dropbear_2025.89.bb b/meta/recipes-core/dropbear/dropbear_2025.89.bb index 6cb520f68d9..9f04327bd1a 100644 --- a/meta/recipes-core/dropbear/dropbear_2025.89.bb +++ b/meta/recipes-core/dropbear/dropbear_2025.89.bb @@ -29,6 +29,7 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \ file://CVE-2019-6111-02.patch \ file://CVE-2019-6111-03.patch \ file://CVE-2019-6111-04.patch \ + file://CVE-2026-35385.patch \ " SRC_URI[sha256sum] = "0d1f7ca711cfc336dc8a85e672cab9cfd8223a02fe2da0a4a7aeb58c9e113634" From patchwork Wed Nov 11 09:02:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103718 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5612.1794387834993499933 for ; Wed, 11 Nov 2026 01:03:55 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=W+V+wxm/; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4a549cd7fd2so26477145e9.0 for ; Wed, 11 Nov 2026 01:03:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387833; x=1794992633; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=oldsg4wJ3MLKNiIBmoRYkvoKdbS7zCdJh3VKTcaXVLk=; b=W+V+wxm/+kA5knRSuYkTuqrDaJ8xkTVi4bOUNsOOKTVaXhw7hHqBkVtOgwC5SMPci8 zCMfE1jgM7gC7WYMnSjF2BETh+r0faXM00BY82EE38UHb2w91NDBjFAZNfr4Tea6t+yX Nt1AH/YnHyPjwo3BGkj+7+xredgPW8NZKa2kycIp86TR+S7zTzs5H5i953HMBVO4BGVK /OIjhZMccEFd7nVLQFCqZve5sUOlJM6ZpfLVew6RI2mgKlDYLd+POvmgKHoVWv88JWuh FXE30njdbrhigoZ6Rh6uuO+vCFFS4K2++Iu1+xszvV2964JJwHAl/sDKh1NPelG1LT9b PGyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387833; x=1794992633; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=oldsg4wJ3MLKNiIBmoRYkvoKdbS7zCdJh3VKTcaXVLk=; b=aNnt+fzCQHsYTkhTNY6zpSVWhuLw5mw7a5L65RK9sWnATGUiN36jhC2je+rbJBfeWG 23bsOeSlfkmjqXh1fjzLrPq3sQ3GUshgCHdt+WqAnwIbbc1OA2ZF5JGbdRCvW9kT8ldG ZCmgGkFKUf5znXgw33VaVUA+DVwOYQkaRMxP5GVgeYGsEHJyzda2PVX//yddZYh/Z/xb nZebpCbAf3mPUMeIE4zpaCmJugREWt3Z9vFSIMZCnb0GanHEiR9w2cn0sIo7KVO6R+Sj anxt7/XFVu79nTS9441vmyTNcSQeASHFEl6NhX8n1LIw0/mwoG985Oc2qmOU2O19KR3a 0/WQ== X-Gm-Message-State: APuU4Z+oqEXv4wWFDpJ4dRji/+fPf1m736xy+LvtJSDISW4KE56/kAf1 fzLN06GfTUwaOGWfCOinyCZ6ojQGRF14SqSNq5gR/P6OlKdqsZLnq3dOmbpUQYoWbbcPdb2nFHc bLhAjngc= X-Gm-Gg: AYBFou1gTIz5XB4p8WGV05PHPPwKCmfB1pMGmCh5l21djoLGo/jJi+PkVC4Lagfamrw e9G3T5l6u98mYzaJW2/9Y8RyxuuLepPUyZD79dP7YxvVgTdA92H3ASs8ik3GJ7CMjU7JnqYbS67 tiCNngeeUxgYpmyG4RpTP6foR34roCgjMEqog8c4+8Fq+q9Os8gsTwEWejUa/RIHBRYODcS+vQe 1ofY+xtYPzul5rPd2YybPl3vLEe5HuTw40DNhOi5ifbSz4MaNesR6srm1F4skhYEHqi14CNxnaD EhLvWJVRKBGrZOKLWxniQX9tvJBhEsb+3jFb9uIct+bwB359ubrofUGVKjreULIrfovi237aAcU U6q2nB7m+hhojB6NMvfrdrIqc1+cpqmYaEn5bisoy/1t+tMb1RhCLWvWxcEn/I0EqAmpVQ7CFLQ 7MbZzeddeY2xevE1jOkhTnzkUC/LBcczxLlFBQ/9CMp8N4YKiMOixWz3i3w8gfw/BNEI/XAzEny KldKvwvKb93ibYvzHLib/x0gjauRb62g2HnNDueAUPxMEDYLts66HqnHZ1kCBvh23TnPdm/HZam n1oWgx10ryD8OPMCjFJfCfaouWYmfLG1Y7OK9mqfu0GusNqeWdKiLhEOuA+DZIbvkYxfJOXS+bn QpgPBUDvCyS8b+2f5TrDJ4pRd83PXcCPd3vnsqyy/3GxDx1fGhg== X-Received: by 2002:a05:600c:e556:10b0:4ba:4395:560f with SMTP id 5b1f17b1804b1-4ba43955a50mr13547995e9.8.1794387833016; Wed, 11 Nov 2026 01:03:53 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:52 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 26/35] python3-urllib3: Fix CVE-2026-44432 Date: Wed, 11 Nov 2026 10:02:52 +0100 Message-ID: <4b369eaaee6e7ffefac0af3258087b6941f6471f.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249998 From: Yogita Urade This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a [2] https://security-tracker.debian.org/tracker/CVE-2026-44432 Signed-off-by: Yogita Urade Signed-off-by: Yoann Congal --- .../python3-urllib3/CVE-2026-44432.patch | 157 ++++++++++++++++++ .../python/python3-urllib3_2.6.3.bb | 1 + 2 files changed, 158 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch new file mode 100644 index 00000000000..2cccc0a9a10 --- /dev/null +++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch @@ -0,0 +1,157 @@ +From 2bdcc44d1e163fb5cc48a8662425e35e15adfe6a Mon Sep 17 00:00:00 2001 +From: Illia Volochii +Date: Thu, 7 May 2026 18:39:03 +0300 +Subject: [PATCH] Merge commit from fork + +* Avoid any decoding in `HTTPResponse.drain_conn` + +* Add a comment + +* Simplify `drain_conn` + +* Add tests + +* Add additional checks to the test + +* Fix full decompression on the 2nd small read from response using Brotli + +* Add a changelog entry + +* Inverse the order in the changelog entry + +* Mention `stream` call + +CVE: CVE-2026-44432 +Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a] + +Backport Changes: +- Omitted changelog/GHSA-mf9v-mfxr-j63j.bugfix.rst because the OE recipe + backport applies the runtime fix and tests; the package does not ship it. + +Signed-off-by: Yogita Urade +--- + src/urllib3/response.py | 17 +++++++++++------ + test/test_response.py | 24 +++++++++++++++++++++--- + test/with_dummyserver/test_connection.py | 19 +++++++++++++++++++ + 3 files changed, 51 insertions(+), 9 deletions(-) + +diff --git a/src/urllib3/response.py b/src/urllib3/response.py +index 521c31b282..e9246b75e3 100644 +--- a/src/urllib3/response.py ++++ b/src/urllib3/response.py +@@ -798,13 +798,14 @@ def drain_conn(self) -> None: + Unread data in the HTTPResponse connection blocks the connection from being released back to the pool. + """ + try: +- self.read( +- # Do not spend resources decoding the content unless +- # decoding has already been initiated. +- decode_content=self._has_decoded_content, +- ) ++ self._raw_read() + except (HTTPError, OSError, BaseSSLError, HTTPException): + pass ++ if self._has_decoded_content: ++ # `_raw_read` skips decompression, so we should clean up the ++ # decoder to avoid keeping unnecessary data in memory. ++ self._decoded_buffer = BytesQueueBuffer() ++ self._decoder = None + + @property + def data(self) -> bytes: +@@ -1091,7 +1092,11 @@ def read( + elif amt is not None: + cache_content = False + +- if self._decoder and self._decoder.has_unconsumed_tail: ++ if ( ++ self._decoder ++ and self._decoder.has_unconsumed_tail ++ and len(self._decoded_buffer) < amt ++ ): + decoded_data = self._decode( + b"", + decode_content, + +diff --git a/test/test_response.py b/test/test_response.py +index c70262c04e..da521137bf 100644 +--- a/test/test_response.py ++++ b/test/test_response.py +@@ -858,22 +858,33 @@ def test_memory_usage_decode_with_max_length( + pytest.skip(f"Proper {request.node.callspec.id} decoder is not available") + + name, compressed_data = data +- limit = 1024 * 1024 # 1 MiB ++ limit1 = 1024 * 1024 # 1 MiB ++ # We test with two read calls because the second call may be ++ # able to use the internal buffer filled by the first call, and ++ # we want to ensure that full decompression is never triggered ++ # by the second call. The limit for the second call is lowered ++ # to make sure that the internal buffer is used for the Brotli ++ # case specifically https://github.com/google/brotli/issues/1396 ++ limit2 = 1024 # 1 KiB + if read_method in ("read_chunked", "stream"): + httplib_r = httplib.HTTPResponse(MockSock) # type: ignore[arg-type] ++ httplib_r.chunked = True ++ httplib_r.chunk_left = 1 + httplib_r.fp = MockChunkedEncodingResponse([compressed_data]) # type: ignore[assignment] + r = HTTPResponse( + httplib_r, + preload_content=False, + headers={"transfer-encoding": "chunked", "content-encoding": name}, + ) +- next(getattr(r, read_method)(amt=limit, decode_content=True)) ++ for limit in (limit1, limit2): ++ next(getattr(r, read_method)(amt=limit, decode_content=True)) + else: + fp = BytesIO(compressed_data) + r = HTTPResponse( + fp, headers={"content-encoding": name}, preload_content=False + ) +- getattr(r, read_method)(amt=limit, decode_content=True) ++ for limit in (limit1, limit2): ++ getattr(r, read_method)(amt=limit, decode_content=True) + + # Check that the internal decoded buffer is empty unless brotli + # is used. +@@ -883,6 +894,13 @@ def test_memory_usage_decode_with_max_length( + if name != "br" or brotli.__name__ == "brotlicffi": + assert len(r._decoded_buffer) == 0 + ++ # Check that memory usage is still within the limit while the ++ # connection is being drained, meaning that the call does not ++ # decompress the whole content. ++ r.drain_conn() ++ assert r._decoder is None ++ assert len(r._decoded_buffer) == 0 ++ + def test_multi_decoding_deflate_deflate(self) -> None: + data = zlib.compress(zlib.compress(b"foo")) + +diff --git a/test/with_dummyserver/test_connection.py b/test/with_dummyserver/test_connection.py +index b9c547c00f..940815dac2 100644 +--- a/test/with_dummyserver/test_connection.py ++++ b/test/with_dummyserver/test_connection.py +@@ -138,3 +138,22 @@ def test_invalid_tunnel_scheme(pool: HTTPConnectionPool) -> None: + str(e.value) + == "Invalid proxy scheme for tunneling: 'socks', must be either 'http' or 'https'" + ) ++ ++ ++def test_response_after_drain_conn(pool: HTTPConnectionPool) -> None: ++ """ ++ Test that a connection can be reused after calling `drain_conn` on ++ an unread response. ++ """ ++ conn = pool._get_conn() ++ ++ conn.request("GET", "/", preload_content=False) ++ response = conn.getresponse() ++ assert response.status == 200 ++ response.drain_conn() ++ ++ conn.request("GET", "/", preload_content=False) ++ response = conn.getresponse() ++ assert response.status == 200 ++ ++ conn.close() diff --git a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb index 537a68cdabf..b9d9b5671e4 100644 --- a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb +++ b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb @@ -5,6 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=52d273a3054ced561275d4d15260ecda" SRC_URI += "file://CVE-2026-44431.patch \ file://CVE-2026-97689.patch \ + file://CVE-2026-44432.patch \ " SRC_URI[sha256sum] = "1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed" From patchwork Wed Nov 11 09:02:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103715 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5593.1794387836227370267 for ; Wed, 11 Nov 2026 01:03:56 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=AINBj+HB; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4a140e7405dso25313985e9.3 for ; Wed, 11 Nov 2026 01:03:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387834; x=1794992634; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=EHqGUf6twg9TCIDxcPgtyTeT7PQNZkfiqC8k9WhnTeE=; b=AINBj+HBINxP7e8w9gEepMR48Bp/QGI5b5w6dl3MlrimMqHCJIeFNCqiUe3iKB+NnE YdPMgNRSJ1Osa2fM5GrOVc8G3c3e3DDDkVPetzQBRGqXrPtOG3nSG4ukZ/Nlsm7lN+rO rk2yv0T4nI6uPDff6uDDOQ9OVmz5e0ixGJJ6bIjZQE7xL6voiIZMwfMySIqIjdahbVFE NawONEK4nU6j0JlVw+TnnVWx9fDpFED1W1w3nKTWlQ8SYKBec42nhVumwN2sVZeI3fu+ qHLl8GEXhR8rerCp5Ls4FCCLhQ1CTi9ll+bxEE9h7B8yNjJ0Uj2M6KHEJO+XZk+dxOBO dO2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387834; x=1794992634; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=EHqGUf6twg9TCIDxcPgtyTeT7PQNZkfiqC8k9WhnTeE=; b=yh05jdBi+wIhG9yEUkW/Y0R9OEpIRam8ge2NvvvFxCsCr2j6cvoJ6YtaE3/8H+LKFo KkliWIuvu9Bh4d3cZYgh+I0iFaPq9bvxtvXpefkRbm+EZeLxWjNk+LdoPDZVT51qmmIn aWXgZXbTVc/WBqPX6gxQ9+HSMcOSnH5Pqo7N84/HryfJh+av3Urnsy0FHB9R8or29AzP mKx2ZddoA8a/CxpOIpAxmeuRqQ6gdeCYgCEE3mysTvQ6ReV1sdFy+AVlw/IURwIO5tBd V7vaxVWMwsfewWe4Jk7O37iRVa2DEvZi8mpwXc7LnQZjznWecclEv5yOW9SGjkiFVozt derA== X-Gm-Message-State: APuU4Z8Z/vV1R7lURFFwiCVyS1OJ7IxiZ/z6hvqJxiEH2j5kzRDCJXhT btRh3czQLhvsnj2L3SsIMmj3FPM6KcK/M9cBGaUgnnO9xLX8fWMqUQ5tl21oDap/SsjR+baVlVQ uYkuCiug= X-Gm-Gg: AYBFou19MOu+dDE3hcJqkKCeC0oss0joE7ioUqJL+ZCp9AdosYFr1KX3ljDSZFoSUGX B/Ge6MEpA/wfDy64rxnWcWOJr32irI4o5ydf29SrOk1qptAOM+5s1p1gf4pQCTxY2MSdrspjk4T J/cdbckNnM17dbsXvm0umPvp1NS9Hb8ukW7v6g8U8Tns4fNymJrVkdX3s/dAc5G/MgB8VWQSUid 6goaEjSVEAYQdBCy2Mr8ADdGozx48MJXW2hR+cfyjE0pDbcEfB3Bu5W26+n04kDZ1vsXIHqfOiS pDV3kTu76TrpLWdgA5gh6tQIGdaCZVzf475Vgn+t6GaAFtXPuprHloapd7O8XsKtSlNvE5+cIj+ ZrGRG/Haqj7NhhVLWHlE6SxAZMoaags7BwOt8ugqbtUFsCP1062H6tlEcuzvo2sPTEV+rWlyUFz O/zeMbNyTmYaEktJJldfvtFq8DASE1RlR2vSXm5IofuLOMMxv4jNbbKTiF7Qwy9YJij14klnoKm xeH5tMe+HbXULilhdtHifzPQQPhgJl1uZWJ3Brx0E6jBEKhurt9ndYCiwOkFwsvbWt9+7k/EKID eTA8CM+C2cBVbVEEHFeqmp7WBsGhnrj/Q4gxAfuuMb81Vy4nnsTXaogdDeNuENDkf8t+k8IxHFc r0Iq+4ZkXI9twmjpGOuZo2S1jOI8z X-Received: by 2002:a05:600c:482:b0:4a5:75d2:c104 with SMTP id 5b1f17b1804b1-4ba093be225mr20446505e9.22.1794387834023; Wed, 11 Nov 2026 01:03:54 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:53 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 27/35] python3-urllib3: Fix CVE-2026-97687 Date: Wed, 11 Nov 2026 10:02:53 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249999 From: Yogita Urade This patch applies the upstream fix as referenced in [3], using the commit shown in [1] and [2]. [1] https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3 [2] https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465 [3] https://security-tracker.debian.org/tracker/CVE-2026-97687 Signed-off-by: Yogita Urade Signed-off-by: Yoann Congal --- .../python3-urllib3/CVE-2026-97687_p1.patch | 277 +++++++++++ .../python3-urllib3/CVE-2026-97687_p2.patch | 450 ++++++++++++++++++ .../python/python3-urllib3_2.6.3.bb | 2 + 3 files changed, 729 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch new file mode 100644 index 00000000000..5bd1b8f2d71 --- /dev/null +++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch @@ -0,0 +1,277 @@ +From b6447295fff7b38fdffc67e0df9712d60cef3cc3 Mon Sep 17 00:00:00 2001 +From: Dustin Hoeppner +Date: Fri, 12 Jun 2026 08:27:08 -0500 +Subject: [PATCH] Fix `proxy_ssl_context` ignored for HTTPS forwarding proxies + (#3786) + +Co-authored-by: Illia Volochii + +CVE: CVE-2026-97687 +Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3] + +Backport Changes: +- Omitted changelog/2577.bugfix.rst because the OE recipe backport applies + the runtime fix and tests; the package does not ship it. + +Signed-off-by: Yogita Urade +--- + src/urllib3/connection.py | 16 ++ + src/urllib3/poolmanager.py | 15 ++ + test/with_dummyserver/test_proxy_poolmanager.py | 149 +++++++++++++++++++++-- + 3 files changed, 163 insertions(+), 17 deletions(-) + +diff --git a/src/urllib3/connection.py b/src/urllib3/connection.py +index 84e1dab945..49d1c11ea7 100644 +--- a/src/urllib3/connection.py ++++ b/src/urllib3/connection.py +@@ -793,6 +793,20 @@ def connect(self) -> None: + # Remove trailing '.' from fqdn hostnames to allow certificate validation + server_hostname_rm_dot = server_hostname.rstrip(".") + ++ # Forwarding proxies should use proxy SSL context for ++ # wrapping since that's the connection being established, ++ # whereas tunneling proxies should use the connection's SSL ++ # context. ++ # However, for backwards compatibility reasons, if the proxy ++ # is forwarding but no proxy SSL context is provided, we ++ # fall back to using the connection's SSL context until ++ # urllib3 v3.0. Appropriate warning is emitted in ++ # ``ProxyManager.__init__``. ++ if self.proxy_is_forwarding and self.proxy_config is not None: ++ ssl_context = self.proxy_config.ssl_context ++ else: ++ ssl_context = self.ssl_context ++ + sock_and_verified = _ssl_wrap_socket_and_match_hostname( + sock=sock, + cert_reqs=self.cert_reqs, +@@ -806,7 +820,7 @@ def connect(self) -> None: + key_file=self.key_file, + key_password=self.key_password, + server_hostname=server_hostname_rm_dot, +- ssl_context=self.ssl_context, ++ ssl_context=ssl_context, + tls_in_tls=tls_in_tls, + assert_hostname=self.assert_hostname, + assert_fingerprint=self.assert_fingerprint, + +diff --git a/src/urllib3/poolmanager.py b/src/urllib3/poolmanager.py +index 3914dec268..b7248d210d 100644 +--- a/src/urllib3/poolmanager.py ++++ b/src/urllib3/poolmanager.py +@@ -581,6 +581,21 @@ def __init__( + if proxy.scheme not in ("http", "https"): + raise ProxySchemeUnknown(proxy.scheme) + ++ if ( ++ use_forwarding_for_https ++ and proxy.scheme == "https" ++ and connection_pool_kw.get("ssl_context") is not None ++ ): ++ warnings.warn( ++ "Passing ssl_context when use_forwarding_for_https=True is deprecated " ++ "and will raise an error in urllib3 v3.0. " ++ "Use proxy_ssl_context to configure the TLS connection to the proxy.", ++ FutureWarning, ++ stacklevel=2, ++ ) ++ if proxy_ssl_context is None: ++ proxy_ssl_context = connection_pool_kw.get("ssl_context") ++ + if not proxy.port: + port = port_by_scheme.get(proxy.scheme, 80) + proxy = proxy._replace(port=port) + +diff --git a/test/with_dummyserver/test_proxy_poolmanager.py b/test/with_dummyserver/test_proxy_poolmanager.py +index 6921bc6d22..48f9704b9a 100644 +--- a/test/with_dummyserver/test_proxy_poolmanager.py ++++ b/test/with_dummyserver/test_proxy_poolmanager.py +@@ -10,6 +10,7 @@ + import socket + import ssl + import tempfile ++import typing + from test import LONG_TIMEOUT, SHORT_TIMEOUT, resolvesLocalhostFQDN, withPyOpenSSL + from test.conftest import ServerConfig + +@@ -24,7 +25,7 @@ + ) + from urllib3 import HTTPResponse + from urllib3._collections import HTTPHeaderDict +-from urllib3.connection import VerifiedHTTPSConnection ++from urllib3.connection import HTTPSConnection, VerifiedHTTPSConnection + from urllib3.connectionpool import connection_from_url + from urllib3.exceptions import ( + ConnectTimeoutError, +@@ -166,6 +167,43 @@ def test_https_proxy_forwarding_for_https(self) -> None: + r = https.request("GET", f"{self.https_url}/") + assert r.status == 200 + ++ @requires_network() ++ @pytest.mark.parametrize( ++ "proxy_ssl_context_kw", ++ [ ++ ("ssl_context",), ++ ("proxy_ssl_context",), ++ ("ssl_context", "proxy_ssl_context"), ++ ], ++ ) ++ def test_https_proxy_forwarding_for_https_with_custom_context( ++ self, proxy_ssl_context_kw: tuple[str, ...] ++ ) -> None: ++ """ ++ Test that an HTTP request succeeds when using a forwarding HTTPS ++ proxy with an SSL context provided via either ++ ``proxy_ssl_context``, ``ssl_context`` (fallback), or both. ++ """ ++ ++ proxy_ctx = ssl.create_default_context() ++ proxy_ctx.load_verify_locations(DEFAULT_CA) ++ ++ warning_checker: contextlib.AbstractContextManager[typing.Any] ++ if "ssl_context" in proxy_ssl_context_kw: ++ warning_checker = pytest.warns(FutureWarning, match="ssl_context") ++ else: ++ warning_checker = contextlib.nullcontext() ++ with warning_checker: ++ proxy = proxy_from_url( ++ self.https_proxy_url, ++ **{kw: proxy_ctx for kw in proxy_ssl_context_kw}, ++ use_forwarding_for_https=True, ++ ) ++ ++ with proxy: ++ resp = proxy.request("GET", self.https_url) ++ assert resp.status == 200 ++ + def test_nagle_proxy(self) -> None: + """Test that proxy connections do not have TCP_NODELAY turned on""" + with ProxyManager(self.proxy_url) as http: +@@ -694,20 +732,8 @@ def test_https_proxy_tls_error( + assert isinstance(e.value.reason.original_error, SSLError) + + @requires_network() +- @pytest.mark.parametrize( +- ["proxy_scheme", "use_forwarding_for_https"], +- [ +- ("http", False), +- ("https", False), +- ("https", True), +- ], +- ) +- def test_proxy_https_target_tls_error( +- self, proxy_scheme: str, use_forwarding_for_https: str +- ) -> None: +- if proxy_scheme == "https" and use_forwarding_for_https: +- pytest.skip("Test is expected to fail due to urllib3/urllib3#2577") +- ++ @pytest.mark.parametrize("proxy_scheme", ["http", "https"]) ++ def test_proxy_https_target_tls_error(self, proxy_scheme: str) -> None: + proxy_url = self.https_proxy_url if proxy_scheme == "https" else self.proxy_url + proxy_ctx = ssl.create_default_context() + proxy_ctx.load_verify_locations(DEFAULT_CA) +@@ -717,12 +743,103 @@ def test_proxy_https_target_tls_error( + proxy_url, + proxy_ssl_context=proxy_ctx, + ssl_context=ctx, +- use_forwarding_for_https=use_forwarding_for_https, + ) as proxy: + with pytest.raises(MaxRetryError) as e: + proxy.request("GET", self.https_url) + assert isinstance(e.value.reason, SSLError) + ++ @requires_network() ++ def test_forwarding_proxy_tls_error_with_fallback(self) -> None: ++ """ ++ Test that when only ``ssl_context`` is passed to a forwarding ++ HTTPS proxy, a ``FutureWarning`` is emitted and if the TLS ++ handshake with the proxy fails using that context, the error is ++ a ``ProxyError`` wrapping the original TLS error. ++ """ ++ ctx = ssl.create_default_context() ++ ++ with pytest.warns(FutureWarning, match="ssl_context"): ++ proxy = proxy_from_url( ++ self.https_proxy_url, ++ ssl_context=ctx, ++ use_forwarding_for_https=True, ++ ) ++ ++ with proxy: ++ with pytest.raises(MaxRetryError) as e: ++ proxy.request("GET", self.https_url) ++ assert isinstance(e.value.reason, ProxyError) ++ assert isinstance(e.value.reason.original_error, SSLError) ++ ++ @requires_network() ++ def test_forwarding_proxy_ssl_context_precedence(self) -> None: ++ """ ++ Test that when both ``ssl_context`` and ``proxy_ssl_context`` ++ are passed to a forwarding HTTPS proxy, ``proxy_ssl_context`` is ++ used for the proxy connection and ``ssl_context`` is ignored ++ (with a warning). ++ """ ++ ssl_context = ssl.create_default_context(cafile=DEFAULT_CA) ++ proxy_ssl_context = ssl.create_default_context(cafile=DEFAULT_CA) ++ ++ with pytest.warns(FutureWarning, match="ssl_context"): ++ proxy = proxy_from_url( ++ self.https_proxy_url, ++ proxy_ssl_context=proxy_ssl_context, ++ ssl_context=ssl_context, ++ use_forwarding_for_https=True, ++ ) ++ ++ with proxy: ++ pool = proxy.connection_from_url(self.https_url) ++ with contextlib.closing(pool._new_conn()) as conn: ++ conn = typing.cast(HTTPSConnection, conn) ++ conn.connect() ++ assert isinstance(conn.sock, ssl.SSLSocket) ++ assert conn.sock.context is proxy_ssl_context ++ ++ @requires_network() ++ def test_forwarding_proxy_ssl_context_fallback(self) -> None: ++ """ ++ Test that when only ``ssl_context`` is passed to a forwarding ++ HTTPS proxy, a ``FutureWarning`` is emitted and ``ssl_context`` ++ is used as the proxy TLS context (fallback). ++ """ ++ ssl_context = ssl.create_default_context(cafile=DEFAULT_CA) ++ ++ with pytest.warns(FutureWarning, match="ssl_context"): ++ proxy = proxy_from_url( ++ self.https_proxy_url, ++ ssl_context=ssl_context, ++ use_forwarding_for_https=True, ++ ) ++ ++ with proxy: ++ pool = proxy.connection_from_url(self.https_url) ++ with contextlib.closing(pool._new_conn()) as conn: ++ conn = typing.cast(HTTPSConnection, conn) ++ conn.connect() ++ assert isinstance(conn.sock, ssl.SSLSocket) ++ assert conn.sock.context is ssl_context ++ ++ @requires_network() ++ def test_forwarding_non_https_proxy_ssl_context_fallback(self) -> None: ++ """ ++ Test that when only ``ssl_context`` is passed to a forwarding ++ non-HTTPS proxy, no warning or error is emitted. ++ """ ++ ssl_context = ssl.create_default_context(cafile=DEFAULT_CA) ++ # No warning/error should be emitted even when ``ssl_context`` ++ # is provided to a non-HTTPS proxy for some reason. ++ proxy = proxy_from_url( ++ self.proxy_url, ++ ssl_context=ssl_context, ++ use_forwarding_for_https=True, ++ ) ++ with proxy: ++ resp = proxy.request("GET", self.https_url) ++ assert resp.status == 200 ++ + def test_scheme_host_case_insensitive(self) -> None: + """Assert that upper-case schemes and hosts are normalized.""" + with proxy_from_url(self.proxy_url.upper(), ca_certs=DEFAULT_CA) as http: diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch new file mode 100644 index 00000000000..8c2b26e89e0 --- /dev/null +++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch @@ -0,0 +1,450 @@ +From 07408cec79d1856d81bb42c74a904a24fdb9e465 Mon Sep 17 00:00:00 2001 +From: Andrey Petrov +Date: Wed, 29 Jul 2026 18:20:36 -0400 +Subject: [PATCH] Isolate HTTPS proxy TLS settings from target TLS (#5093) + +CVE: CVE-2026-97687 +Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465] + +Backport Changes: +- Omitted changelog/5093.bugfix.rst because the OE recipe backport applies + the runtime fix and tests; the package does not ship it. + +Signed-off-by: Yogita Urade +--- + src/urllib3/connection.py | 93 +++++++++----- + src/urllib3/poolmanager.py | 8 + + test/with_dummyserver/test_proxy_poolmanager.py | 150 ++++++++++++++++++++++- + 3 files changed, 205 insertions(+), 46 deletions(-) + +diff --git a/src/urllib3/connection.py b/src/urllib3/connection.py +index 8a89488d7c..443cb01be1 100644 +--- a/src/urllib3/connection.py ++++ b/src/urllib3/connection.py +@@ -838,30 +838,30 @@ def connect(self) -> None: + # fall back to using the connection's SSL context until + # urllib3 v3.0. Appropriate warning is emitted in + # ``ProxyManager.__init__``. ++ wrapped_socket: ssl.SSLSocket | SSLTransport + if self.proxy_is_forwarding and self.proxy_config is not None: +- ssl_context = self.proxy_config.ssl_context ++ wrapped_socket = self._connect_tls_proxy(self.host, sock) ++ is_verified = self.proxy_is_verified is True + else: +- ssl_context = self.ssl_context +- +- sock_and_verified = _ssl_wrap_socket_and_match_hostname( +- sock=sock, +- cert_reqs=self.cert_reqs, +- ssl_version=self.ssl_version, +- ssl_minimum_version=self.ssl_minimum_version, +- ssl_maximum_version=self.ssl_maximum_version, +- ca_certs=self.ca_certs, +- ca_cert_dir=self.ca_cert_dir, +- ca_cert_data=self.ca_cert_data, +- cert_file=self.cert_file, +- key_file=self.key_file, +- key_password=self.key_password, +- server_hostname=server_hostname_rm_dot, +- ssl_context=ssl_context, +- tls_in_tls=tls_in_tls, +- assert_hostname=self.assert_hostname, +- assert_fingerprint=self.assert_fingerprint, +- ) +- self.sock = sock_and_verified.socket ++ wrapped_socket, is_verified = _ssl_wrap_socket_and_match_hostname( ++ sock=sock, ++ cert_reqs=self.cert_reqs, ++ ssl_version=self.ssl_version, ++ ssl_minimum_version=self.ssl_minimum_version, ++ ssl_maximum_version=self.ssl_maximum_version, ++ ca_certs=self.ca_certs, ++ ca_cert_dir=self.ca_cert_dir, ++ ca_cert_data=self.ca_cert_data, ++ cert_file=self.cert_file, ++ key_file=self.key_file, ++ key_password=self.key_password, ++ server_hostname=server_hostname_rm_dot, ++ ssl_context=self.ssl_context, ++ tls_in_tls=tls_in_tls, ++ assert_hostname=self.assert_hostname, ++ assert_fingerprint=self.assert_fingerprint, ++ ) ++ self.sock = wrapped_socket + + # If an error occurs during connection/handshake we may need to release + # our lock so another connection can probe the origin. +@@ -882,7 +882,7 @@ def connect(self) -> None: + # If this connection doesn't know if the origin supports HTTP/2 + # we report back to the HTTP/2 probe our result. + if target_supports_http2 is None: +- supports_http2 = sock_and_verified.socket.selected_alpn_protocol() == "h2" ++ supports_http2 = wrapped_socket.selected_alpn_protocol() == "h2" + http2_probe.set_and_release( + host=probe_http2_host, + port=probe_http2_port, +@@ -896,7 +896,7 @@ def connect(self) -> None: + if self.proxy_is_forwarding: + self.is_verified = False + else: +- self.is_verified = sock_and_verified.is_verified ++ self.is_verified = is_verified + + # If there's a proxy to be connected to we are fully connected. + # This is set twice (once above and here) due to forwarding proxies +@@ -906,24 +906,47 @@ def connect(self) -> None: + # Set `self.proxy_is_verified` unless it's already set while + # establishing a tunnel. + if self._has_connected_to_proxy and self.proxy_is_verified is None: +- self.proxy_is_verified = sock_and_verified.is_verified ++ self.proxy_is_verified = is_verified + + def _connect_tls_proxy(self, hostname: str, sock: socket.socket) -> ssl.SSLSocket: + """ +- Establish a TLS connection to the proxy using the provided SSL context. ++ Establish a TLS connection to the proxy using proxy-specific policy. + """ +- # `_connect_tls_proxy` is called when self._tunnel_host is truthy. + proxy_config = typing.cast(ProxyConfig, self.proxy_config) +- ssl_context = proxy_config.ssl_context ++ proxy_ssl_context = proxy_config.ssl_context ++ ++ ssl_context: ssl.SSLContext | None ++ cert_reqs: int | str | None ++ if proxy_ssl_context is not None: ++ # Prefer the proxy's cert policy for the proxy connection ++ ssl_context = proxy_ssl_context ++ cert_reqs = proxy_ssl_context.verify_mode ++ ca_certs = None ++ ca_cert_dir = None ++ ca_cert_data = None ++ ssl_version = None ++ ssl_minimum_version = None ++ ssl_maximum_version = None ++ else: ++ # Otherwise we inherit the pool's cert policies ++ ssl_context = self.ssl_context if self.proxy_is_forwarding else None ++ cert_reqs = self.cert_reqs ++ ca_certs = self.ca_certs ++ ca_cert_dir = self.ca_cert_dir ++ ca_cert_data = self.ca_cert_data ++ ssl_version = self.ssl_version ++ ssl_minimum_version = self.ssl_minimum_version ++ ssl_maximum_version = self.ssl_maximum_version ++ + sock_and_verified = _ssl_wrap_socket_and_match_hostname( + sock, +- cert_reqs=self.cert_reqs, +- ssl_version=self.ssl_version, +- ssl_minimum_version=self.ssl_minimum_version, +- ssl_maximum_version=self.ssl_maximum_version, +- ca_certs=self.ca_certs, +- ca_cert_dir=self.ca_cert_dir, +- ca_cert_data=self.ca_cert_data, ++ cert_reqs=cert_reqs, ++ ssl_version=ssl_version, ++ ssl_minimum_version=ssl_minimum_version, ++ ssl_maximum_version=ssl_maximum_version, ++ ca_certs=ca_certs, ++ ca_cert_dir=ca_cert_dir, ++ ca_cert_data=ca_cert_data, + server_hostname=hostname, + ssl_context=ssl_context, + assert_hostname=proxy_config.assert_hostname, + +diff --git a/src/urllib3/poolmanager.py b/src/urllib3/poolmanager.py +index c10e5d53cf..c1eb131290 100644 +--- a/src/urllib3/poolmanager.py ++++ b/src/urllib3/poolmanager.py +@@ -583,6 +583,9 @@ def __init__( + if proxy.scheme not in ("http", "https"): + raise ProxySchemeUnknown(proxy.scheme) + ++ # Keep the deprecated ssl_context fallback on the manager for ++ # compatibility, while passing only explicit proxy policy to connections. ++ self.proxy_ssl_context = proxy_ssl_context + if ( + use_forwarding_for_https + and proxy.scheme == "https" +@@ -595,8 +598,8 @@ def __init__( + FutureWarning, + stacklevel=2, + ) +- if proxy_ssl_context is None: +- proxy_ssl_context = connection_pool_kw.get("ssl_context") ++ if self.proxy_ssl_context is None: ++ self.proxy_ssl_context = connection_pool_kw.get("ssl_context") + + if not proxy.port: + port = port_by_scheme.get(proxy.scheme, 80) +@@ -604,7 +607,6 @@ def __init__( + + self.proxy = proxy + self.proxy_headers = proxy_headers or {} +- self.proxy_ssl_context = proxy_ssl_context + self.proxy_config = ProxyConfig( + proxy_ssl_context, + use_forwarding_for_https, + +diff --git a/test/with_dummyserver/test_proxy_poolmanager.py b/test/with_dummyserver/test_proxy_poolmanager.py +index 48f9704b9a..0991f93a19 100644 +--- a/test/with_dummyserver/test_proxy_poolmanager.py ++++ b/test/with_dummyserver/test_proxy_poolmanager.py +@@ -114,6 +114,13 @@ def test_is_verified_https_proxy_to_http_target(self) -> None: + assert r.status == 200 + assert_is_verified(https, proxy=True, target=False) + ++ def test_is_verified_https_proxy_to_http_target_without_proxy_config(self) -> None: ++ with proxy_from_url(self.https_proxy_url, ca_certs=DEFAULT_CA) as https: ++ https.connection_pool_kw["_proxy_config"] = None ++ r = https.request("GET", f"{self.http_url}/") ++ assert r.status == 200 ++ assert_is_verified(https, proxy=True, target=False) ++ + def test_is_verified_https_proxy_to_https_target(self) -> None: + with proxy_from_url(self.https_proxy_url, ca_certs=DEFAULT_CA) as https: + r = https.request("GET", f"{self.https_url}/") +@@ -144,6 +151,18 @@ def test_https_proxy_with_proxy_ssl_context(self) -> None: + r = https.request("GET", f"{self.http_url}/") + assert r.status == 200 + ++ @withPyOpenSSL ++ def test_https_proxy_with_proxy_ssl_context_pyopenssl(self) -> None: ++ proxy_ssl_context = create_urllib3_context() ++ proxy_ssl_context.load_verify_locations(DEFAULT_CA) ++ ++ with proxy_from_url( ++ self.https_proxy_url, ++ proxy_ssl_context=proxy_ssl_context, ++ ) as https: ++ response = https.request("GET", f"{self.http_url}/") ++ assert response.status == 200 ++ + @withPyOpenSSL + def test_https_proxy_pyopenssl_not_supported(self) -> None: + with proxy_from_url(self.https_proxy_url, ca_certs=DEFAULT_CA) as https: +@@ -779,8 +798,8 @@ def test_forwarding_proxy_ssl_context_precedence(self) -> None: + used for the proxy connection and ``ssl_context`` is ignored + (with a warning). + """ +- ssl_context = ssl.create_default_context(cafile=DEFAULT_CA) +- proxy_ssl_context = ssl.create_default_context(cafile=DEFAULT_CA) ++ ssl_context = create_urllib3_context(cert_reqs=ssl.CERT_REQUIRED) ++ proxy_ssl_context = create_urllib3_context(cert_reqs=ssl.CERT_NONE) + + with pytest.warns(FutureWarning, match="ssl_context"): + proxy = proxy_from_url( +@@ -797,6 +816,7 @@ def test_forwarding_proxy_ssl_context_precedence(self) -> None: + conn.connect() + assert isinstance(conn.sock, ssl.SSLSocket) + assert conn.sock.context is proxy_ssl_context ++ assert proxy_ssl_context.verify_mode == ssl.CERT_NONE + + @requires_network() + def test_forwarding_proxy_ssl_context_fallback(self) -> None: +@@ -805,15 +825,21 @@ def test_forwarding_proxy_ssl_context_fallback(self) -> None: + HTTPS proxy, a ``FutureWarning`` is emitted and ``ssl_context`` + is used as the proxy TLS context (fallback). + """ +- ssl_context = ssl.create_default_context(cafile=DEFAULT_CA) ++ ssl_context = create_urllib3_context(cert_reqs=ssl.CERT_NONE) + + with pytest.warns(FutureWarning, match="ssl_context"): + proxy = proxy_from_url( + self.https_proxy_url, + ssl_context=ssl_context, ++ cert_reqs=ssl.CERT_REQUIRED, ++ ca_certs=DEFAULT_CA, + use_forwarding_for_https=True, + ) + ++ assert proxy.proxy_ssl_context is ssl_context ++ assert proxy.proxy_config is not None ++ assert proxy.proxy_config.ssl_context is None ++ + with proxy: + pool = proxy.connection_from_url(self.https_url) + with contextlib.closing(pool._new_conn()) as conn: +@@ -821,6 +847,23 @@ def test_forwarding_proxy_ssl_context_fallback(self) -> None: + conn.connect() + assert isinstance(conn.sock, ssl.SSLSocket) + assert conn.sock.context is ssl_context ++ assert ssl_context.verify_mode == ssl.CERT_REQUIRED ++ ++ @requires_network() ++ def test_https_proxy_to_http_target_ssl_context_fallback(self) -> None: ++ ssl_context = create_urllib3_context() ++ ssl_context.load_verify_locations(DEFAULT_CA) ++ ++ with proxy_from_url( ++ self.https_proxy_url, ++ ssl_context=ssl_context, ++ ) as proxy: ++ pool = proxy.connection_from_url(self.http_url) ++ with contextlib.closing(pool._new_conn()) as conn: ++ conn = typing.cast(HTTPSConnection, conn) ++ conn.connect() ++ assert isinstance(conn.sock, ssl.SSLSocket) ++ assert conn.sock.context is ssl_context + + @requires_network() + def test_forwarding_non_https_proxy_ssl_context_fallback(self) -> None: +@@ -921,32 +964,38 @@ def test_https_proxy_assert_fingerprint_md5( + destination_url = f"https://{server.host}:{server.port}" + + proxy_ctx = urllib3.util.ssl_.create_urllib3_context(verify_flags=0) ++ proxy_ctx.load_verify_locations(proxy.ca_certs) + proxy_fingerprint = self._get_proxy_fingerprint_md5(proxy.ca_certs) + with proxy_from_url( + proxy_url, +- ca_certs=proxy.ca_certs, ++ ca_certs=server.ca_certs, + proxy_ssl_context=proxy_ctx, + proxy_assert_fingerprint=proxy_fingerprint, + ) as https: + https.request("GET", destination_url) + ++ @pytest.mark.parametrize("use_forwarding_for_https", [False, True]) + def test_https_proxy_assert_fingerprint_md5_non_matching( +- self, no_san_proxy_with_server: tuple[ServerConfig, ServerConfig] ++ self, ++ no_san_proxy_with_server: tuple[ServerConfig, ServerConfig], ++ use_forwarding_for_https: bool, + ) -> None: + proxy, server = no_san_proxy_with_server + proxy_url = f"https://{proxy.host}:{proxy.port}" + destination_url = f"https://{server.host}:{server.port}" + + proxy_ctx = urllib3.util.ssl_.create_urllib3_context(verify_flags=0) ++ proxy_ctx.load_verify_locations(proxy.ca_certs) + proxy_fingerprint = self._get_proxy_fingerprint_md5(proxy.ca_certs) + new_char = "b" if proxy_fingerprint[5] == "a" else "a" + proxy_fingerprint = proxy_fingerprint[:5] + new_char + proxy_fingerprint[6:] + + with proxy_from_url( + proxy_url, +- ca_certs=proxy.ca_certs, ++ ca_certs=server.ca_certs, + proxy_ssl_context=proxy_ctx, + proxy_assert_fingerprint=proxy_fingerprint, ++ use_forwarding_for_https=use_forwarding_for_https, + ) as https: + with pytest.raises(MaxRetryError) as e: + https.request("GET", destination_url) +@@ -964,8 +1013,11 @@ def test_https_proxy_assert_hostname( + ) as https: + https.request("GET", destination_url) + ++ @pytest.mark.parametrize("use_forwarding_for_https", [False, True]) + def test_https_proxy_assert_hostname_non_matching( +- self, san_proxy_with_server: tuple[ServerConfig, ServerConfig] ++ self, ++ san_proxy_with_server: tuple[ServerConfig, ServerConfig], ++ use_forwarding_for_https: bool, + ) -> None: + proxy, server = san_proxy_with_server + destination_url = f"https://{server.host}:{server.port}" +@@ -975,6 +1027,7 @@ def test_https_proxy_assert_hostname_non_matching( + proxy.base_url, + ca_certs=proxy.ca_certs, + proxy_assert_hostname=proxy_hostname, ++ use_forwarding_for_https=use_forwarding_for_https, + ) as https: + with pytest.raises(MaxRetryError) as e: + https.request("GET", destination_url) +@@ -1064,6 +1117,7 @@ def test_https_proxy_no_san_hostname_checks_common_name( + destination_url = f"https://{server.host}:{server.port}" + + proxy_ctx = urllib3.util.ssl_.create_urllib3_context(verify_flags=0) ++ proxy_ctx.load_verify_locations(proxy.ca_certs) + try: + proxy_ctx.hostname_checks_common_name = True + # PyPy doesn't like us setting 'hostname_checks_common_name' +@@ -1074,6 +1128,86 @@ def test_https_proxy_no_san_hostname_checks_common_name( + pytest.skip("Test requires 'SSLContext.hostname_checks_common_name=True'") + + with proxy_from_url( +- proxy_url, ca_certs=proxy.ca_certs, proxy_ssl_context=proxy_ctx ++ proxy_url, ca_certs=server.ca_certs, proxy_ssl_context=proxy_ctx + ) as https: + https.request("GET", destination_url) ++ ++ @pytest.mark.parametrize( ++ "target_tls_kwargs", ++ [ ++ pytest.param({"server_hostname": "example.com"}, id="server-hostname"), ++ pytest.param({"assert_hostname": "example.com"}, id="assert-hostname"), ++ pytest.param({"assert_fingerprint": "00" * 32}, id="assert-fingerprint"), ++ ], ++ ) ++ def test_https_proxy_forwarding_ignores_target_identity_settings( ++ self, ++ san_proxy_with_server: tuple[ServerConfig, ServerConfig], ++ target_tls_kwargs: dict[str, typing.Any], ++ ) -> None: ++ proxy, server = san_proxy_with_server ++ proxy_ctx = create_urllib3_context() ++ proxy_ctx.load_verify_locations(proxy.ca_certs) ++ ++ with proxy_from_url( ++ proxy.base_url, ++ proxy_ssl_context=proxy_ctx, ++ proxy_assert_hostname=proxy.host, ++ use_forwarding_for_https=True, ++ **target_tls_kwargs, ++ ) as https: ++ pool = https.connection_from_url(server.base_url) ++ with contextlib.closing(pool._new_conn()) as conn: ++ conn = typing.cast(HTTPSConnection, conn) ++ conn.connect() ++ assert isinstance(conn.sock, ssl.SSLSocket) ++ assert conn.sock.context is proxy_ctx ++ ++ def test_https_proxy_forwarding_ignores_target_client_certificate( ++ self, ++ san_proxy_with_server: tuple[ServerConfig, ServerConfig], ++ ) -> None: ++ proxy, server = san_proxy_with_server ++ proxy_ctx = create_urllib3_context() ++ proxy_ctx.load_verify_locations(proxy.ca_certs) ++ missing_cert = str(pathlib.Path(proxy.ca_certs).with_name("missing-cert.pem")) ++ ++ with proxy_from_url( ++ proxy.base_url, ++ proxy_ssl_context=proxy_ctx, ++ cert_file=missing_cert, ++ use_forwarding_for_https=True, ++ ) as https: ++ pool = https.connection_from_url(server.base_url) ++ with contextlib.closing(pool._new_conn()) as conn: ++ conn = typing.cast(HTTPSConnection, conn) ++ conn.connect() ++ assert isinstance(conn.sock, ssl.SSLSocket) ++ assert conn.sock.context is proxy_ctx ++ ++ def test_https_proxy_forwarding_ignores_target_tls_policy( ++ self, ++ san_proxy_with_server: tuple[ServerConfig, ServerConfig], ++ ) -> None: ++ proxy, server = san_proxy_with_server ++ proxy_ctx = create_urllib3_context(cert_reqs=ssl.CERT_REQUIRED) ++ proxy_ctx.load_verify_locations(proxy.ca_certs) ++ proxy_cert_store_stats = proxy_ctx.cert_store_stats() ++ ++ with proxy_from_url( ++ proxy.base_url, ++ proxy_ssl_context=proxy_ctx, ++ cert_reqs=ssl.CERT_NONE, ++ ca_certs=DEFAULT_CA, ++ use_forwarding_for_https=True, ++ ) as https: ++ for target_url in (server.base_url, "https://example.com/"): ++ pool = https.connection_from_url(target_url) ++ with contextlib.closing(pool._new_conn()) as conn: ++ conn = typing.cast(HTTPSConnection, conn) ++ conn.connect() ++ assert isinstance(conn.sock, ssl.SSLSocket) ++ assert conn.sock.context is proxy_ctx ++ ++ assert proxy_ctx.verify_mode == ssl.CERT_REQUIRED ++ assert proxy_ctx.cert_store_stats() == proxy_cert_store_stats diff --git a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb index b9d9b5671e4..ad5dd190d8d 100644 --- a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb +++ b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb @@ -6,6 +6,8 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=52d273a3054ced561275d4d15260ecda" SRC_URI += "file://CVE-2026-44431.patch \ file://CVE-2026-97689.patch \ file://CVE-2026-44432.patch \ + file://CVE-2026-97687_p1.patch \ + file://CVE-2026-97687_p2.patch \ " SRC_URI[sha256sum] = "1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed" From patchwork Wed Nov 11 09:02:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103719 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5595.1794387836916666781 for ; Wed, 11 Nov 2026 01:03:57 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=ZnHjtHVS; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-4a20bde60a0so30333615e9.3 for ; Wed, 11 Nov 2026 01:03:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387835; x=1794992635; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=//Il0aBYrqZTwAPsZ43l1dxFDZpl3w9TfDoaZGzf8U0=; b=ZnHjtHVScTeCw4Zk5dUowLi0OyCis0XpPLHybVdjEkHFZGnezouLhabyHMm3EWPLlv nBwvf2/1dHwGgEEv8Ynik3+kIjdOuOJ9CCmiDhn2/aixPsvmfb6iQBQ2Sh2AmdCXrif3 gJsN8ZT6R26EaH6waiaE6fC4pSJiJPRevBOCkaWVVNG1ZXkwmC2znRbbHjAQjRWi91qY aPi8qsEGNHqkQzt3kNpAW7lT3wyFooX8cfA8PQN2DBK5NYwJOrKF99EbHLtxaQEEs4fJ LcUytmyfCyU3dT2ekMlEgkctNGJi3xqu+/MFmEhyWF9IQ9X9uxcudCG84BESVxS9BTeD zX4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387835; x=1794992635; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=//Il0aBYrqZTwAPsZ43l1dxFDZpl3w9TfDoaZGzf8U0=; b=th4paJo7bwI1R8fCx1mVDB/CMXG8RLY19il9M3z9Wa1xoExTOK1+el3c++LBN4Gvkc N/JU7H4JIStCxBE9vHCsk1GXcJmCp8B1kcoHzgbjgfFjrA2WEvaHOGIroaxFSfQ3KRG3 weTxkVN2Xn/z35FtmyYG2K/X4veCkKcILaI2iPTfb93mBUQ/O+A1TwM6OpliXEPii+Cc Qjg+xXAQ0utRcUOukSAqTr/LfDfQ5IGDauV1a7jd/1GAqNafqKwcBDqPDZ18plXKWOyM KzDm9NYETEZzcX8brIuX1tYQEymRElwK1+FrXW+JSxbaq87mTdHmHNnFs5JzvvdBlJou XWrQ== X-Gm-Message-State: APuU4Z/ihg1TBSS/XGXRHH5C3aQ7R45qw1LCh1FYUDCnoppgRxo2Vwm7 HfQ6tjlkuB0SylExP5lZlcUxU8hpLLP/U5BefihjjtGU7QBhiKdwNLJ5Zk35pnFBkodYjB3SjQK laZwwjNg= X-Gm-Gg: AYBFou0UXlqZ3w288V6ruolXxchje9snDm64LHkins/4LxbhgG5EICvCha2INvYautp EvM99cW/5Qkiwut3T8Ph+495zZAT7I0o5cfQ9m2Hwj8Rf/aBqtnNZy+6x9+ZRBNhQ4R/BGJ42Yj T/Fp+dWSsjM09Au6aty1PnuXUFXmNqbbTWGIC7rt0U2ek2wITgrrPcbk/D5kA97d6OC7+s5oeqj O0b4C6g2+rlqq3l1XsKAoZK3QCr7ILEI+AA207j7/3Qj1SjT++m4A9HmIwYNjpRseiIyy0aOJ9/ j0oKLGHlYXyGb25P+MMJbXzkGNcJ9v7/v7Z0nMhY4kOicz2c9LCOuSkrCQuipznCjlvhmZxNgdr H8LL0d7bfkzFZbZHXLWfLiIBXq4DjqW/3H5s6rWLtkOpk1HDk6fTXsuvNrsBQ5Wp79vKZWyYgM+ HOmW+5ysWxE4QXqURm2Ee9glewUzfgIWFExDP3uxW/t5P8cmsRoby8YWhM6jvS7GB1GQNsOXejf oMkPHeR5VLvUH9levHssofrhv5q3QdGGqLrJ0vcrzONQXJkZKRCzDcAgyaNNN5vT1rGoqE8Man5 OAHRknUx4/TDaJRi6It8Qr+Ka33RlObop2qzRvWepqJz8M2K/kKlQUUXFeQm2Yqqx3iptwJayKE fEQdazVTD9CTTXy75SvDf9Vsi/Q83TQ== X-Received: by 2002:a05:600c:840c:b0:4af:c210:5b3f with SMTP id 5b1f17b1804b1-4ba09377dbfmr29487705e9.24.1794387835056; Wed, 11 Nov 2026 01:03:55 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:54 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 28/35] python3-urllib3: Fix CVE-2026-97688 Date: Wed, 11 Nov 2026 10:02:54 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/250000 From: Yogita Urade This patch applies the upstream fix as referenced in [3], using the commit shown in [1] and regression commit from [2]. Regression test-only follow-up skips the Brotli case when urllib3 uses brotlicffi, because that trailing-data case is unsupported by that backend. The skip is limited to Brotli; the Deflate regression case remains covered. [1] https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f [2] https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e [3] https://security-tracker.debian.org/tracker/CVE-2026-97688 [4] https://github.com/urllib3/urllib3/pull/5258 Signed-off-by: Yogita Urade Signed-off-by: Yoann Congal --- .../CVE-2026-97688-regression.patch | 29 +++++ .../python3-urllib3/CVE-2026-97688.patch | 107 ++++++++++++++++++ .../python/python3-urllib3_2.6.3.bb | 2 + 3 files changed, 138 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch new file mode 100644 index 00000000000..220b024e1e8 --- /dev/null +++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch @@ -0,0 +1,29 @@ +From 9016d7e8afc68185496ef07f3c3a4a743d04922e Mon Sep 17 00:00:00 2001 +From: Illia Volochii +Date: Tue, 15 Sep 2026 22:04:41 +0300 +Subject: [PATCH] Skip `test_read_chunked_with_trailing_data_does_not_hang` for + brotlicffi (#5258) + +CVE: CVE-2026-97688 +Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e] + +Signed-off-by: Yogita Urade +--- + test/test_response.py | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/test/test_response.py b/test/test_response.py +index 5ecdbd9..24118f6 100644 +--- a/test/test_response.py ++++ b/test/test_response.py +@@ -831,6 +831,8 @@ class TestResponse: + # while trailing data remains in the decoder's input buffer. + original_data = b"A" * 100 + content_encoding, compress_func = data ++ if content_encoding == "br" and brotli.__name__ == "brotlicffi": ++ pytest.skip("This case is not supported by brotlicffi") + compressed_data = compress_func(original_data) + b"tail" + httplib_r = httplib.HTTPResponse(MockSock) # type: ignore[arg-type] + httplib_r.fp = MockChunkedEncodingResponse([compressed_data]) # type: ignore[assignment] +-- +2.35.6 diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch new file mode 100644 index 00000000000..4fcdce68fc2 --- /dev/null +++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch @@ -0,0 +1,107 @@ +From ea2ad7b21a80da3632f80016526a18864586077f Mon Sep 17 00:00:00 2001 +From: Illia Volochii +Date: Tue, 15 Sep 2026 21:32:04 +0300 +Subject: [PATCH] Merge commit from fork + +* Prevent an infinite loop when decoding Deflate responses + +* Move the new test to a better place + +* Add a changelog entry + +CVE: CVE-2026-97688 +Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f] + +Backport Changes: +- Omitted changelog/GHSA-gh4c-6fx4-qh6g.bugfix.rst because the OE recipe + backport applies the runtime fix and tests; the package does not ship it. + +Signed-off-by: Yogita Urade +--- + src/urllib3/response.py | 8 +++++++- + test/test_response.py | 38 +++++++++++++++++++++++++++++++++++++- + 2 files changed, 44 insertions(+), 2 deletions(-) + +diff --git a/src/urllib3/response.py b/src/urllib3/response.py +index e9e0cee75e..dccdb12936 100644 +--- a/src/urllib3/response.py ++++ b/src/urllib3/response.py +@@ -76,6 +76,10 @@ def __init__(self) -> None: + def decompress(self, data: bytes, max_length: int = -1) -> bytes: + data = self._unfed_data + data + self._unfed_data = b"" ++ # Data received after EOF cannot produce more output from this ++ # Deflate stream. ++ if self._obj.eof: ++ return b"" + if not data and not self._obj.unconsumed_tail: + return data + original_max_length = max_length +@@ -118,7 +122,9 @@ def decompress(self, data: bytes, max_length: int = -1) -> bytes: + @property + def has_unconsumed_tail(self) -> bool: + return bool(self._unfed_data) or ( +- bool(self._obj.unconsumed_tail) and not self._first_try ++ bool(self._obj.unconsumed_tail) ++ and not self._first_try ++ and not self._obj.eof + ) + + def flush(self) -> bytes: + +diff --git a/test/test_response.py b/test/test_response.py +index 799325b58c..4675646232 100644 +--- a/test/test_response.py ++++ b/test/test_response.py +@@ -11,7 +11,7 @@ + from base64 import b64decode + from http.client import IncompleteRead as httplib_IncompleteRead + from io import BufferedReader, BytesIO, TextIOWrapper +-from test import onlyBrotli, onlyZstd ++from test import LONG_TIMEOUT, onlyBrotli, onlyZstd + from unittest import mock + + import pytest +@@ -813,6 +813,42 @@ def test_read_chunked_with_all_data_already_in_decompressor( + assert len(result[-1]) == len(original_data) % 10240 + assert b"".join(result) == original_data + ++ @pytest.mark.timeout(LONG_TIMEOUT) ++ @pytest.mark.parametrize( ++ "data", ++ [d[1] for d in _test_compressor_params], ++ ids=[d[0] for d in _test_compressor_params], ++ ) ++ def test_read_chunked_with_trailing_data_does_not_hang( ++ self, ++ request: pytest.FixtureRequest, ++ data: tuple[str, typing.Callable[[bytes], bytes]] | None, ++ ) -> None: ++ if data is None: ++ pytest.skip(f"Proper {request.node.callspec.id} decoder is not available") ++ # The decoded body must fill multiple bounded reads so EOF is reached ++ # while trailing data remains in the decoder's input buffer. ++ original_data = b"A" * 100 ++ content_encoding, compress_func = data ++ compressed_data = compress_func(original_data) + b"tail" ++ httplib_r = httplib.HTTPResponse(MockSock) # type: ignore[arg-type] ++ httplib_r.fp = MockChunkedEncodingResponse([compressed_data]) # type: ignore[assignment] ++ r = HTTPResponse( ++ httplib_r, ++ preload_content=False, ++ headers={ ++ "transfer-encoding": "chunked", ++ "content-encoding": content_encoding, ++ }, ++ ) ++ ++ stream = r.stream(len(original_data) // 2, decode_content=True) ++ if content_encoding in ("br", "zstd"): ++ with pytest.raises(DecodeError): ++ list(stream) ++ else: ++ assert b"".join(stream) == original_data ++ + @pytest.mark.parametrize( + "delta", + ( diff --git a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb index ad5dd190d8d..73bfd369747 100644 --- a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb +++ b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb @@ -8,6 +8,8 @@ SRC_URI += "file://CVE-2026-44431.patch \ file://CVE-2026-44432.patch \ file://CVE-2026-97687_p1.patch \ file://CVE-2026-97687_p2.patch \ + file://CVE-2026-97688.patch \ + file://CVE-2026-97688-regression.patch \ " SRC_URI[sha256sum] = "1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed" From patchwork Wed Nov 11 09:02:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103720 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5614.1794387837967298681 for ; Wed, 11 Nov 2026 01:03:58 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=XqYFXYw9; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-4a2072b9832so16946245e9.1 for ; Wed, 11 Nov 2026 01:03:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387836; x=1794992636; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=3V9LOkFAlRLxLEi4JF3Fe2AtCSJ0Hvv+BedkqhOFuic=; b=XqYFXYw9UXSXp52mSnGs+7i7nn6ieZqQ8g49eLh7D1O2qIYonacRivaxCmT1Vpd2Lr aDhrFhxYsbbJ3NFWq7vngAKL3IIlAPM6xhAfl2mVIQcdKc+pIUfX/PfV9wrD6G71G4Dp MSGJlQI/hu6ecknRJLB/8KuUOKYIhSNHchSLTzYILFpIWgKLE7CQifaTDabxuf4dWcRb 3xZ/WG6rF1mUyyKrNFqN8ye6xqwVU4oHtGPIwGrvs0/K0BoBpnFOZoW+m9M2OiCOSPVI 7PJVZu3l9RkjtPife9uSIoDF67uBK/gFuZw+j2uuC9Aqngp7q6K1U2d84uwv1aX2HLVz sMRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387836; x=1794992636; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=3V9LOkFAlRLxLEi4JF3Fe2AtCSJ0Hvv+BedkqhOFuic=; b=p3OXBEBU7cNZzSzqEZm5PW54a7EYgObTTvDuicp9+2YwpCUUXN87s8nfqp+T8BHFx2 k/NHAxrTRMH87wZpAucF9cRXU4I9R//Nn2TOQOrvVOAkW8ngJ5tPPgjSVbGA3xdh50Bu RRqna3iu+knPsvesS25LTXElgSndMk4rknzbawUfK+ZbRuqmFFIM/fmJYzMgkOGR0lbM OSZUBbjjcGjnrPn63RB3pTc0jrCHhqXQktF1/07S1YmtSIMLUbGXXENbTn8/0EcOcCpS 2/aHb8o4QDqZA611SoL2e6UJNa/76m1qzOCNQNm57Dky0GClt4TStbkTh2b1s6lTpRaP zWjA== X-Gm-Message-State: APuU4Z9R/OkQy+vOxAZ2pCDRcwqNaVh7WiVpWA/8+UzFyjpp3YJBApAW FYZVHj1S7X+3RhNaS8w6jVq8d6cjxworto7tQE7WTt69ousaeDnvpA3jBb0O6Hby3uS+Vrz/qfb xea0tgbg= X-Gm-Gg: AYBFou0I+iQHZlaZ1lb83nvwlW/wq7nnCEYPsBYPPs+vml4egdYeP+ogJNijZjwcIfs Dn5ZPYn63HWRS8ZYwJLqZ0XuTr6dLflqAW8VN6r1Njjq8Jm5ekkldXZ299GB4cItxOMgUVTcWcM 65riNC56seAuj3MB55teGcJmFVtN6xASmOvmnrDfo6Fr8wkeJqnjc0b3Es+XEhBfK7axUdUuYpF 46Ewjv3gb57LqwSsehpF8h5Shaf2f3HWCfXtXIOg3hMlFOFFfcegP6zsFqnmtYRXpIPmp92aWRx x4d2R2Ekj7hB6vwi3Nb8nGX4OsKAtZyDFpJEbfnPL2zcTsU9jz5L9a7qIpXMMl2ZjlhxeE1i/OK JHtzrLL79Zv9uBiy2ZhnEcx9CL9vP7D7ZbVusrzqvu2Nd3hEgWomCVbqIsUCvCNkgRSZMJIoEoh 6Y1ua/84Ufbd1X02farI4cKKkaA7TQIOb2bcbETUME+tEp+4z48NAAGF31yh7D5jw1zvBWbNxLV 1nOA8q8fVNx2+BoSeTgbrNONAGB00YctfjFIX+lVob23dHs2OTXSLTsIEfynWt5vDOMdI8DVtS3 +pVExXOkKoA0DD1izG16DZMQcdFYU46a2eZoX/Vzv6T9yNCB1h6ckEaKC0g20AFYuJVspMNmI4P RRxSb0kiD1uHMbMHoW6+TVZg9lQyC X-Received: by 2002:a05:600c:1547:b0:4b4:a551:681a with SMTP id 5b1f17b1804b1-4ba0935bcdfmr30808615e9.3.1794387836011; Wed, 11 Nov 2026 01:03:56 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:55 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 29/35] gnupg: Fix CVE-2026-105712 Date: Wed, 11 Nov 2026 10:02:55 +0100 Message-ID: <200ec2cd3f398da5223f16763ad72491fca1fddf.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:03:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/250001 From: Deepak Rathore This patch backports the upstream gpgtar security fix and its follow-up to GnuPG 2.5.17. The security fix, directory handling follow-up, and public CVE advisory are referenced in [1], [2], and [3]. The follow-up includes a regression check for dry-run extraction with a non-existing -C directory. [1] https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88 [2] https://github.com/gpg/gnupg/commit/1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-105712 Signed-off-by: Deepak Rathore Signed-off-by: Yoann Congal --- .../gnupg/CVE-2026-105712-regression.patch | 39 ++++ .../gnupg/gnupg/CVE-2026-105712.patch | 194 ++++++++++++++++++ meta/recipes-support/gnupg/gnupg_2.5.17.bb | 2 + 3 files changed, 235 insertions(+) create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch diff --git a/meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch b/meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch new file mode 100644 index 00000000000..6097da38c30 --- /dev/null +++ b/meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch @@ -0,0 +1,39 @@ +From 1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5 Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka +Date: Tue, 14 Apr 2026 04:32:00 +0000 +Subject: [PATCH] tools:gpgtar: Fix for a case of non existing dir with -C. + +* tools/gpgtar-extract.c (gpgtar_extract): Call the +check_output_directory function only when DIRNAME exists. + +-- +GnuPG-bug-id: 8159 + +CVE: CVE-2026-105712 +Upstream-Status: Backport [https://github.com/gpg/gnupg/commit/1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5] + +Backport Changes: +- Used gnupg_access() for the existence check because 2.5.17 does not + have the upstream COMPAT_NO_DIR_CHECK compatibility flag. + +Signed-off-by: NIIBE Yutaka +(cherry picked from commit 1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5) +Signed-off-by: Deepak Rathore +--- + tools/gpgtar-extract.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/gpgtar-extract.c b/tools/gpgtar-extract.c +index 5ca80cb..a5a925c 100644 +--- a/tools/gpgtar-extract.c ++++ b/tools/gpgtar-extract.c +@@ -504,7 +504,8 @@ gpgtar_extract (const char *filename, int decrypt) + goto leave; + } + +- if (!check_output_directory (dirname)) ++ if (gnupg_access (dirname, F_OK) == 0 ++ && !check_output_directory (dirname)) + { + err = gpg_error (GPG_ERR_INV_ARG); + goto leave; diff --git a/meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch b/meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch new file mode 100644 index 00000000000..9b0bc1ca663 --- /dev/null +++ b/meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch @@ -0,0 +1,194 @@ +From 8df56dd913f3c910c9b265691efaac6c36a007a1 Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka +Date: Fri, 20 Mar 2026 13:33:00 +0900 +Subject: [PATCH] tool:gpgtar: Check the output directory with --directory. + +* doc/tools.texi (gpgtar): Clarify about the --directory option. +* tools/gpgtar-extract.c (check_output_directory): New. +(gpgtar_extract): Call check_output_directory. + +-- + +GnuPG-bug-id: 8159 + +CVE: CVE-2026-105712 +Upstream-Status: Backport [https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88] + +Signed-off-by: NIIBE Yutaka +(cherry picked from commit 7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88) +Signed-off-by: Deepak Rathore +--- + doc/tools.texi | 11 ++-- + tools/gpgtar-extract.c | 123 ++++++++++++++++++++++++++++++++++++++++- + 2 files changed, 128 insertions(+), 6 deletions(-) + +diff --git a/doc/tools.texi b/doc/tools.texi +index 45f3e897d..691b7dc9c 100644 +--- a/doc/tools.texi ++++ b/doc/tools.texi +@@ -2024,11 +2024,12 @@ Do not actually output the extracted files. + @item --directory @var{dir} + @itemx -C @var{dir} + @opindex directory +-Extract the files into the directory @var{dir}. The default is to +-take the directory name from the input filename. If no input filename +-is known a directory named @file{GPGARCH} is used. For tarball +-creation, switch to directory @var{dir} before performing any +-operations. ++Extract the files into the directory @var{dir}. It raises an error ++when @var{dir} is not empty, or @var{dir} is a symlink to other ++directory. When this option is not given, the default is to take the ++directory name from the input filename. If no input filename is known ++a directory, named @file{GPGARCH} is used. For tarball creation, ++switch to directory @var{dir} before performing any operations. + + @item --files-from @var{file} + @itemx -T @var{file} +diff --git a/tools/gpgtar-extract.c b/tools/gpgtar-extract.c +index d23ccc579..5ca80cb89 100644 +--- a/tools/gpgtar-extract.c ++++ b/tools/gpgtar-extract.c +@@ -24,6 +24,8 @@ + #include + #include + #include ++#include ++#include + #include + #include + #include +@@ -369,6 +371,112 @@ create_directory (const char *dirprefix) + } + + ++/* Check the output directory DIRNAME if it's not symlink and empty. ++ Return 1 if good, 0 otherwise. */ ++static int ++check_output_directory (const char *dirname) ++{ ++#ifdef HAVE_W32_SYSTEM ++#define dirent _wdirent ++#define DIR _WDIR ++#define readdir _wreaddir ++#define closedir _wclosedir ++#endif ++ DIR *d; ++ struct dirent *dent; ++ int count = 0; ++ ++#ifdef HAVE_W32_SYSTEM ++ wchar_t *wdirname; ++ DWORD attr; ++ ++ wdirname = utf8_to_wchar (dirname); ++ if (!wdirname) ++ return 0; ++ ++ attr = GetFileAttributesW (wdirname); ++ ++ if (attr == INVALID_FILE_ATTRIBUTES) ++ { ++ log_error ("error getting attributes '%s': %s\n", dirname, w32_strerror (-1)); ++ xfree (wdirname); ++ return 0; ++ } ++ else if ((attr & FILE_ATTRIBUTE_REPARSE_POINT)) ++ { ++ /* It's reparse point (possibly symlink), not good. */ ++ log_error ("Not a regular directory (may be symlink): %s\n", dirname); ++ xfree (wdirname); ++ return 0; ++ } ++ ++ d = _wopendir (wdirname); ++ xfree (wdirname); ++#else ++# if O_NOFOLLOW == 0 ++ struct stat sbuf; ++ ++ if (lstat (dirname, &sbuf)) ++ return 0; ++ ++ if (S_ISLNK (sbuf.st_mode)) ++ { ++ /* It's symlink, not good. */ ++ log_error ("It's symbolic link: %s\n", dirname); ++ return 0; ++ } ++ ++ d = opendir (dirname); ++# else ++ int fd; ++ ++ /* With O_NOFOLLOW, make sure it's not symlink. */ ++ fd = open (dirname, (O_RDONLY | O_NOFOLLOW)); ++ if (fd < 0) ++ { ++ log_error ("Can't open (symlink?): %s\n", dirname); ++ return 0; ++ } ++ ++ d = fdopendir (fd); ++# endif ++#endif ++ ++ if (d == NULL) ++ return 0; ++ ++ while ((dent = readdir (d)) != NULL) ++ { ++ if (dent->d_name[0] == '.' && dent->d_name[1] == 0) ++ continue; ++ ++ if (dent->d_name[0] == '.' && dent->d_name[1] == '.' ++ && dent->d_name[2] == 0) ++ continue; ++ ++ count++; ++ } ++ ++ /* In case of fdopendir, FD is released by closedir. */ ++ closedir (d); ++ ++ if (count) ++ { ++ /* It's not empty, not good. */ ++ log_error ("Directory not empty: %s\n", dirname); ++ return 0; ++ } ++ ++ /* Good. */ ++ return 1; ++} ++ ++#ifdef HAVE_W32_SYSTEM ++#undef dirent ++#undef DIR ++#undef readdir ++#undef closedir ++#endif + + gpg_error_t + gpgtar_extract (const char *filename, int decrypt) +@@ -388,7 +496,20 @@ gpgtar_extract (const char *filename, int decrypt) + memset (&tarinfo_buffer, 0, sizeof tarinfo_buffer); + + if (opt.directory) +- dirname = xtrystrdup (opt.directory); ++ { ++ dirname = xtrystrdup (opt.directory); ++ if (!dirname) ++ { ++ err = gpg_error_from_syserror (); ++ goto leave; ++ } ++ ++ if (!check_output_directory (dirname)) ++ { ++ err = gpg_error (GPG_ERR_INV_ARG); ++ goto leave; ++ } ++ } + else + { + if (opt.filename) diff --git a/meta/recipes-support/gnupg/gnupg_2.5.17.bb b/meta/recipes-support/gnupg/gnupg_2.5.17.bb index 6b2af1c96c9..04666ee8d77 100644 --- a/meta/recipes-support/gnupg/gnupg_2.5.17.bb +++ b/meta/recipes-support/gnupg/gnupg_2.5.17.bb @@ -20,6 +20,8 @@ SRC_URI = "${GNUPG_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \ file://0002-use-pkgconfig-instead-of-npth-config.patch \ file://0001-Woverride-init-is-not-needed-with-gcc-9.patch \ file://CVE-2026-57062.patch \ + file://CVE-2026-105712.patch \ + file://CVE-2026-105712-regression.patch \ " SRC_URI:append:class-native = " file://0001-configure.ac-use-a-custom-value-for-the-location-of-.patch \ file://relocate.patch" From patchwork Wed Nov 11 09:02:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103722 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5615.1794387838777013507 for ; Wed, 11 Nov 2026 01:03:59 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=jMGmu6m+; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4a140e7405dso25314185e9.3 for ; Wed, 11 Nov 2026 01:03:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387837; x=1794992637; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=we8QUMe5aMAIp34eX2g94QyhE2t++LhSNLwEOFRfHMc=; b=jMGmu6m+xeZWJG2ByWPRJ+6bIbaQBwhmh3cAyTnIDrgs0VeqzmYvRBK5+EMPNQyfT6 yoLFiY9BGM/mZKoqqtJ/mXZpv+0puhvthBE1/QqSw0aCrpM3Jfotj0buYOOgQgcTIVwi Hf3fmUre+fytCsIsvLdIYRuX/eE2ute9C+D5SwLsfrBsDSkQijzor9K2LLA05PPK+lPz bHiNEaaPQ1r7oLvZOrhVj3zoAYST4gGngNIwlqWFp9zEVvW6sqqBxw/JHRYh55tPyTI1 pC3owhBoQw2m3XAlar4BkeGTrF+4zXdLhLoiyXqHHgscip/hgVSKlY4lODhDkuzVIoN4 GQzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387837; x=1794992637; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=we8QUMe5aMAIp34eX2g94QyhE2t++LhSNLwEOFRfHMc=; b=NVI67dm6OAixv8NIbe4HGYQTV7TanS1Fn9w9wOXNYVzvnfS8H65zDLX/Y4mWEfGQSm G/nYifvtrSvS1GCp3MfNZeF44FahfbJkT1irV/dgMs7A+BmZyY+iC4wS0bOkyT7cHWzN PATv1dIX5Bi+tAXNtM+bIfcnCvLCwpEX4eQLym6uG80thooOYjeH8MYqNZqAviMQawzt dbmoOzMCaKTUp23B3G0f+UU8Fh/HakrrWWmC3z8Ef4+9bZPAuxU893rZ7qkeEq69ZUUn gMKwwAvYfKwFEbFpnjK9t0UVeR6PewOLseYP7hkuYbOtDNxo4lQB7Wj/keD32UkCyULD WHMQ== X-Gm-Message-State: APuU4Z+4n37cdQXmEXN1yhCNVGCAQe8SpjbfRhIl0u6rSB2HLTLR7Jj7 CM0L7rQBMFLtUNvaIqgeGM0hAdeqd06WMoh6MAGzAxuYyw1D/p8YtmDkevoempeZ/hoQNQaNdfO XgO8PR6A= X-Gm-Gg: AYBFou1jChdEQ/qjbn2Qzx1lzzM/ZgwsZLTZ89wrKAAPVVRFbGNpy1UdNSNLNvjZY5z 3wmJ6JUBRYNl9pbKcPnS/IT5FMevHKzaJtNwycdYoH5WGYFmkhNqp+YFtWMNIkHTaBhghlBX59D qgGGCQv+Nluv40EyzauYhEc0kTjJ39aKECJdKe21oGZF0HRA0oJwqHAzbk7xN57OhuPFdygGhbq Tx4qnUg9SiGIByZpnDYR+5eRiuoXSpVX4QITfjJ49Kcoib5H7LNJf00X5RzT+9jhzv12rf/3EgE A3TbZmWKhe8UxXmbbujT3q2MATjkTZmDtdLJ3RhsCAkuZhnsWpIS2iaukODiS83V3Tt6XfpvvZX 60exhgaxg74dL05U99R4nBD4/GSrZcv0cMW35K2rYUar+aCUCETdkjP7v5+yhv8WzPSYYg3v2Jr qkRg6cMcfkrrwAfGVC2qKwH5jFHUUGCICxkv1RBSG4qWhXk/bal2ACp1FAuxibwavZnDqkKFrfp vC+kCLnS4yG9TV2NeynhAQp4Ocs2yR1RNtbGiqR4QDgfz8S4xZlQhmBCSrhcJrYNsp9rJcCxCB2 F3G4gNRPcUWoH9PnveU097MCHa/KiKK+gd9J00JhM93D4qOVqGtZh5H5i9wjZAeZ6o2m+L95fHK nUY79RatmCWn4l7nynKjmVnLwbBuA X-Received: by 2002:a05:600c:470d:b0:4a2:133:45e1 with SMTP id 5b1f17b1804b1-4ba09380609mr30673115e9.24.1794387836854; Wed, 11 Nov 2026 01:03:56 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:56 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 30/35] linux-yocto/6.18: aufs: refresh to upstream aufs6.18 Date: Wed, 11 Nov 2026 10:02:56 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:04:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/250002 From: Bruce Ashfield Integrating the following commit(s) to linux-yocto/6.18: 1/2 [ Author: Bruce Ashfield Email: bruce.ashfield@gmail.com Subject: aufs: update to upstream aufs6.18 (latest) Date: Sat, 3 Oct 2026 22:06:19 -0400 Refresh the in-tree aufs to the current upstream aufs-standalone aufs6.18 snapshot (f8b3fda5). Brings in accumulated upstream aufs bugfixes plus the x86 CONFIG_PREEMPT_RT support, superseding the standalone backport posted to the linux-yocto list. Signed-off-by: Bruce Ashfield ] 2/2 [ Author: Bruce Ashfield Email: bruce.ashfield@gmail.com Subject: fs/aufs: route the FUSE mnt-ns check back through is_current_mnt_ns Date: Sat, 3 Oct 2026 23:54:11 -0400 The aufs6.18 refresh moved fs/aufs to the native upstream snapshot, whose vfsub.c calls our_mnt() directly. Upstream exports our_mnt() via its own standalone integration patch; our integration instead exports a small is_current_mnt_ns() wrapper. The refresh delta reverted that carried adaptation, leaving the aufs module with an unexported our_mnt() reference that fails to link whenever aufs is compiled. Restore the adaptation: route the CONFIG_AUFS_BR_FUSE mnt-ns check back through is_current_mnt_ns(). Unlike v7.x, 6.18 does not need the open-coded rename-lock helpers -- lock_rename()/unlock_rename() are still exported in the 6.18 kernel (the unexport landed upstream in v7.1), so the native vfsub.c rename-locking links as-is here. Signed-off-by: Bruce Ashfield ] Signed-off-by: Bruce Ashfield Signed-off-by: Richard Purdie (cherry picked from commit 4f2e85e25ddf35220fe8b12fa1f1f354930ef563) Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.18.bb | 4 ++-- .../linux/linux-yocto-tiny_6.18.bb | 4 ++-- meta/recipes-kernel/linux/linux-yocto_6.18.bb | 20 +++++++++---------- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb index 5db966af1e7..ac97f340da1 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb @@ -15,8 +15,8 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "f892d97a3d660b9e7f4dc0618e0737f6e23906a7" -SRCREV_meta ?= "366edfd67e22da481a7e6beb6386e1f7d19e71cf" +SRCREV_machine ?= "64ebedd888ed53620df352f568a8b55c5620d169" +SRCREV_meta ?= "b505aeae4f62715ec4801e292b32ad68593b3341" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb index ef90b3db194..4cbcfc0084c 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb @@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" -SRCREV_meta ?= "366edfd67e22da481a7e6beb6386e1f7d19e71cf" +SRCREV_machine ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" +SRCREV_meta ?= "b505aeae4f62715ec4801e292b32ad68593b3341" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb index 8bf35579cda..95cae43557d 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb @@ -17,18 +17,18 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base" KBRANCH:qemuloongarch64 ?= "v6.18/standard/base" KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta" -SRCREV_machine:qemuarm ?= "16672075f0d625c2a7186a00a0d47b34f8ac1e36" -SRCREV_machine:qemuarm64 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" -SRCREV_machine:qemuloongarch64 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" +SRCREV_machine:qemuarm ?= "f271f5b5cce5f2c67c00ccb5b4bf60502d4ddc0b" +SRCREV_machine:qemuarm64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" +SRCREV_machine:qemuloongarch64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e" -SRCREV_machine:qemuppc ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" -SRCREV_machine:qemuriscv64 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" -SRCREV_machine:qemuriscv32 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" -SRCREV_machine:qemux86 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" -SRCREV_machine:qemux86-64 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" +SRCREV_machine:qemuppc ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" +SRCREV_machine:qemuriscv64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" +SRCREV_machine:qemuriscv32 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" +SRCREV_machine:qemux86 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" +SRCREV_machine:qemux86-64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4" -SRCREV_machine ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc" -SRCREV_meta ?= "366edfd67e22da481a7e6beb6386e1f7d19e71cf" +SRCREV_machine ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" +SRCREV_meta ?= "b505aeae4f62715ec4801e292b32ad68593b3341" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same From patchwork Wed Nov 11 09:02:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103723 Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5618.1794387841713883150 for ; Wed, 11 Nov 2026 01:04:02 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=KVPWwlMH; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4a5036bbac7so18796305e9.3 for ; Wed, 11 Nov 2026 01:04:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387840; x=1794992640; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=w6e/dT13TNiR9aWfk+y2pZvG15JXoSjai02MX8kqrpA=; b=KVPWwlMHzlNZp5kh4qDIkCKBUqNKAhDao/yGr4QQqDg1FmhWhJ23eM37n/dcBiA05G nH+phlTi0NT/sPVBBvJ+ST5gbV5qxu+Is09f39opljuR6dlWGcpUJy7n2U6PBYv11Y2a C2j8gEd3dtlIvjKSkC35v7AyJ3voj+B76Zomg69M8T+RcnWtCIECEPnLwlcF4je1lGNl wGswUxoKUyxlOhBNW9DNEz3wMPawLnU3SL38Lp5bmrglUpVSzk7q+lNOCBZl4GkrKNZB 3lSDGlCaeToX3QD5FvOZ2N17kaVfSCfOU+Py+i3m7LxfkjdAiHaGCHYKCaZpQmgqeEzj yG2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387840; x=1794992640; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=w6e/dT13TNiR9aWfk+y2pZvG15JXoSjai02MX8kqrpA=; b=kRNQ1QLPwRj2p7Nx6q0lcCYH2uSZxFhu9Xjiui3uW+YYs637aQWYN8Rt6gaWJFNBDt we0hW7SUkT/xAXY7ETwkK14Llmtq+GkUKRrGvHe+3hxSyVg7vfZOOvlCjS1p3RNK8OFd +n8dSiy8nujlr/M71Xpl4pcq9RqpAOefgoF42MWwidYFlrTMxx3n9fLXOQcu6v1BZBuy uOIaNBFwB+jk3Miggrv3wD+xl7C8zytcIqBz5+lEYDXY+J4IPoa7nreivO4Jc6S7IE5u uhxyaD7+QqHJjSPMSa2EZqQtDwIL+Tyqgi2OrHuOBR025ORSAv83jG0ocmFgOE6mFoQY inug== X-Gm-Message-State: APuU4Z9/aHLXmDLttnTv2uP7otOJ+FpAEamjy6JbTr3YCJFVmBIpP38+ fGIa7/3mF/cOcsZ3wluAIYCid4wQIAitw5Oa2/4RRA7xZFZFQxeK1JPjuo+dbzCtvAMoeusCXAN eNCiz/KE= X-Gm-Gg: AYBFou1nqGxmVh/tdoNwc9Mnb6zUMEnTG0kwa/K9vDxn7Xo7TALC5awhEIkay0IMIJz kCNbXVQS5/5FW8SLb82/Q32N3KURshI21RB0xYJTPh/ViiKHwmfMH47s575/ahhuqvzdi47SmGa tcK9krF8gSHQN4C1RfiqTnBr4/kbIOVMBZRTfmXjBT04V+DKpEd5UzWPRD6ue6BSDQ8OtJmfQiR XzegxyhhRe/sQpH92uVVASKPraMdje4D7r3TdwGO5aEbLUZtj6/99ocWDLnRnwe8hUD2fNWL+Vw t6cdmr4QG1H0Ps5jw3O/jM2gq++dNv8dFstVEaWXc4JP5Kx/COkzRshSBV0mOgrN4Q6rBzDtT86 gS4aSWkhkM21IfsW5W0B2jEs1JKyK5KBbuOXIiuBxoOOD328Tnb50anwtkeN9/LuzU5hd8f8Z4N ocZr6zG354jZ5Vd9ySYI9YGMqmoooA/mcnJDeGyIIJ3SHoIenz90emFzsMeYFVlWRf4eWEX2H25 +KWMOuStvBMd487cAyUnbbHlAl+9doHAVcwY9PglpAdSSz/4I3XddcCWs3w4HohIFkRTjuDuAGm RTz6dA9kR8E9G4T++ryklIqiEIv1Zt8mdSzpLWqluILAjDAbOO4G0zR8utwC6NmdWfx71OIOfks eDoWt8Xry05bXNGzA7BWjdVbwkIlB X-Received: by 2002:a05:600c:6212:b0:4a3:5a42:b2a4 with SMTP id 5b1f17b1804b1-4ba09360578mr30619255e9.12.1794387838298; Wed, 11 Nov 2026 01:03:58 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:57 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 31/35] linux-yocto/6.18: update to v6.18.57 Date: Wed, 11 Nov 2026 10:02:57 +0100 Message-ID: <32719d7bfc6cd2d3d3fff62d0910fcccfb6fc425.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:04:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/250003 From: Bruce Ashfield Updating linux-yocto/6.18 to the latest korg -stable release that comprises the following commits: 2ff600d29ee47 Linux 6.18.57 d1e095c75d127 HID: steam: Clean up locking cf71a6ee1d4e3 HID: steam: Refactor registration 86724f4bcf604 HID: steam: Rearrange teardown sequence 05d39902539a3 HID: steam: Fully unregister controller when hidraw is opened 3142648c952d6 sched_ext: Generate qseq from a per-task counter f94a12ddd3184 drm/amd/display: Don't replace a sink mode that shares the native totals 82ac8c4939bdb regulator: of: fill in supply names in of_regulator_bulk_get_all() 32642616a8d73 SUNRPC: Add Kconfig dependency on CRYPTO_KRB5 69bf8d145ee1b can: fix unique skb identifier regression under RPS cf32eb20dfacf xfs: fix exchange-range-to-eof file size exchange 7d3b9b2c9dc57 xfs: stop exchanging reflink flags when exchanging mappings 87655adb5ddb1 xfs: remove duplicate INO1_WRITTEN check 30e08c92118cc ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons d0813c7c09dfa ACPI: scan: Do not mark button ACPI devices as wakeup-capable 5e9c814ee4da9 workqueue: Annotate alloc_workqueue_va() with __printf(1, 0) 2d2c32b1b9e32 accel/amdxdna: Fix crash when destroying a suspended hardware context a82142af837f6 accel/amdxdna: Fix race condition when checking rpm_on 27f52d4089ade accel/amdxdna: Resume power for creating and destroying hardware context 44e61f1834831 s390/zcrypt: Pad trailing CCA or EP11 message with zeros 00a44ff06bcff s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing f463f474773aa s390/zcrypt: Improve EP11 CPRB length and overflow checks 584400144020f s390/zcrypt: Improve CCA CPRB length and overflow checks 7673661a8adc0 workqueue: fix devm_alloc_workqueue() va_list misuse 5c03da7451714 netfs: Fix missing alloc tagging of direct mempool allocations 22adb6751bcf9 net: fix backlog_unlock_irq_restore() vs CONFIG_PREEMPT_RT 07861e84b766c media: verisilicon: Fix kernel panic due to __initconst misuse a582e7391fe35 netfs, afs: Fix symlink reading 4719852d14db2 cifs: consolidate time_last_write stamp into _cifsFileInfo_put() 8f7285d608ed0 btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock fdee3570b282a drm/panthor: validate userspace queue count against initialized firmware slot count e3e6779f77ab6 x86/CPU/AMD: Fix AMD TLBI Erratum #1718 bf0f3412d5a0d drm/vc4: Fix binner slot allocation failing on an idle GPU 4835dbcde5cc3 vsock: Fix memory leak in vmci_transport_recv_dgram_cb() 2594795fd832f net: openvswitch: validate transport header presence in set_ipv6_addr 0849ecf1c65e8 ptp: ocp: fix PCIe delay estimation calculation 3938430f0237c mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() 5b1fb3b105ff6 net/mlx5e: Order ICOSQ cc update after CQ doorbell e241465838e26 veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down 9caa2eca5cc83 drm/imagination: Fix reference and vm_bo handling in remap() cc18eb0e99411 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() cb0d55754b4f9 bnxt_en: Re-write the BARs following any type of PCIe errors fd6a2b055dbc8 bnxt_en: Drop pci_save_state() after pci_restore_state() 5026c5070b825 bnxt_en: Delay for 5 seconds after AER DPC for all chips f41becbee8fc6 bnxt_en: Fix driver init in kdump kernel 8ef2b3ce6d142 bnxt_en: Add bnxt_clear_bars() helper b18a649649549 pfcp: make sure the SEID is linear before reading it 75e7f850cabd5 net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET e378bd8705659 Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification" 972b9285ae530 net/sched: cls_route: reject change with no routing attribute 8de57bfec3825 devlink: fix devlink_rel reference leak when notify work is pending 27748588c9310 net: sparx5: start the TOD counters on non-PTP lan969x variants 9993e6a0ac1b5 flow_dissector: avoid u16 truncation of skb->len when computing thoff 0bcebf2c4305c cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug() 1194fd4c6dd1d spi: sg2044-nor: Honor SPI clock limits f3e80f5132dc4 spi: sg2044-nor: Return transfer errors 64bb35079dcbc ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM ef15a51966ee1 ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes 47c0c7a051b70 ASoC: adau1372: allow sleepy powerdown GPIOs 1bee950630df0 Revert "wifi: ath12k: add panic handler" e3f7cc4ef04d1 wifi: mt76: mt792x: pick the SAR table layout from the table itself 83ec70a640fe1 wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit 7fb2d37329c62 wifi: mt76: mt7925: don't put the band auto marker in TGID 0f9afe238eeb7 wifi: mt76: mt7915: disable rx napi when removing device f240282165821 wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout 0ed29ec00eb33 wifi: mt76: mt7925: restore the legacy BSS after MLO teardown 69aae4146191f wifi: mt76: use ALTX queue for packets to disassociated stations a18f68c1e72c8 wifi: mt76: route nullfunc frames to PSD/ALTX queue 9f28f50465086 wifi: mt76: account non-AQL frames per peer rather than per link 65b080310077c wifi: mt76: add PS buffering support for HW-managed TIM drivers 12b467683be5f wifi: mac80211: add ieee80211_txq_aql_pending() 09c6284b21f2e wifi: mac80211: add AQL support for multicast packets aafd1724f65ef wifi: mt76: don't return TXQ when exceeding max non-AQL packets 0cf84535c031a riscv: vector: Fix output operands in context save b56f9e11ac9f1 riscv: vector: Fix data pointer constraints in context save/restore 2c77af8bb5dc1 net: make dev_xdp_sb_prog_count() see programs attached through a link 63bc3cf8d7dd9 drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums 36d7e2da7a873 btrfs: fix lost error return value in btrfs_listxattr() a97114b9b00ed btrfs: fix xattr replace when multiple xattrs are packed in the same item 2797eb38773a9 btrfs: unlock inode and extent in caller when io_uring read extent fails 7a3addbdc5ad1 btrfs: free iov when btrfs_uring_read_extent() fails 033dda5b321f0 btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio 77de9adf46f5b zloop: zero out only the unread tail of short reads 7057b683922fc arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3 ce79a6c5cc1b8 nvmet: use the local P2P device on metadata allocation failure e76979e27f0c5 nvmet: return Invalid Field for invalid NSIDs feature 82h b7725acf9c574 ice: Restore Ordered MMIO Writes for Tx Doorbells cbab667ef8b5d tee: optee: ffa: support shared memory offsets on large-page kernels c83bf3973da6f tee: optee: fix kernel-doc warnings 7110c7f70c59e cxgb4/ch_ktls: disable softirqs around tid_list erases 181cb48c1e9af amt: send the relay's General Query directly from the receive path 85e5512369d4f net/sched: em_text: reject unterminated algo before autoload bea10b84e22ef drm/vc4: Free the BO cache size list on teardown 742619c8637b9 drm/aspeed: Balance the display clock enable on teardown 01318927a9055 gpio: exar: initialize the ID before registering its cleanup 5b26dbb27c0cb drm/dp: don't mark the AUX backlight enabled when enabling failed 73e8503fac49c Bluetooth: btintel_pcie: Add shared HW reset for clean start 39ab048cce70d Bluetooth: btintel_pcie: fix TX descriptor bounds check 62a167e7e6d8c fs: don't let a migrating task hide its reference from do_umount() 6850385e26bf2 fs: move mntput_no_expire() slowpath into a dedicated routine 7505f139d8995 mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount cc21cda4cac5d arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value 5a673697e4a3e arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single ab0f32981ce39 arm64: dts: lx2160a: fix incorrect pinmux fea9c705bbc61 smb/server: fix tree connection leak in smb2_tree_connect() 46a431c0a25a8 ksmbd: convert tree_conns_lock to rw_semaphore 0af43b52fe4b1 printk: Don't WARN on kthread_run failure. 9bf96b4347f54 bpf: check_cond_jmp_op(): properly infer if register is null 8a3257f142ae5 net: stmmac: fix dma mapping leak in stmmac_tso_xmit() afca229b39acc ipv6: mcast: use rcu_assign_pointer() for __rcu list updates 45462e5ba345a ipv6: mcast: annotate data-races around mca_users a0cd9e22f8fae bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge 3a39bc9707fbd bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks 65f636322ac40 bpf: Mark syscall helpers as sleepable 364a31052aa9e ring-buffer: Add checking nr_subbufs to persistent ring buffer validation 5b40198a0c69e ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer 6bb6ae5ab1bef bpf: zero extend the result of an arena 32-bit cmpxchg c4d3bdb3ab211 bpf: don't rewrite bpf_fastcall patterns entered by a jump 65bea674f43c0 bpf: Don't infer non-NULL from a pointer with an unbounded offset 8d19e2cdfba9b bpf: Keep refcount_acquire nullable for borrowed RCU kptrs bb667eb575c90 bpf: Mark NULL kptr stores precise 08b534bafdd9d bpf: Preserve inner map identity in callback frames 3f30b2cd4eba4 tracing: Fix subbuf resize races with trace_pipe_raw readers b1fe6379e401b bpf: mark a NULL call argument precise 787405e9e7bdc iommu/riscv: Serialize command queue publishing 3e6400e3b8b85 virtio_ring: fix stale descriptor flags after a failed packed add 831dab9b9bcc1 vduse: validate virtqueue alignment 7f8ee0b8f6324 vhost: invalidate vring access on IOTLB transitions d9232a90c6f7d tracing: Take trace_array reference when opening a tracer options file 30dacb56f0728 drm/amdgpu: skip the VMID 0 flush for VRAM 6ac7a29691558 smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid 2be31f252ade7 smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() 28289d880e6d1 ksmbd: fix maximum allowed access checks eb2e3bb27e78c ksmbd: remove redundant DACL check in smb_check_perm_dacl 2e7e39bb81913 remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 5c9ab0c9cede9 powerpc/xive: propagate IPI init errors to prevent use-after-free e3388edec1fff powerpc/xive: add error return value to xive_smp_probe() ebdd932dc24c1 ACPI: bus: Introduce acpi_bus_get_primary_device() 041cce629a08d drm/xe: don't WARN on kernel job timeout when device already wedged 40bab0da844c1 nfsd: convert nfsd_net boolean flags to unsigned long flags word 65aa0a4c4c1bf nfsd: use workqueue enable/disable APIs for v4_end_grace sync 96d4b275281b4 dm-pcache: validate seg_id fields from persistent memory 3d8391d3149a1 drm/amd/display: Fix dangling pointer in plane reset function 3a03827bb3cda drm/amd/display: Fix dangling pointer in CRTC reset function f786e7b3adbf3 dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout 7abc9b49ad01a uprobes/x86: Move optimized uprobe from nop5 to nop10 cf08ff2255de9 bpf: Reject MEM_ALLOC BTF accesses past object bounds 644cf4e77c277 bpf: Reject writes through untrusted BTF pointers 16a82add1918d platform/x86: dell-wmi-base: Fix handling of ultra performance key 93a20b14f8627 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max 0203146ad4509 usb: gadget: uac: validate rate list length before storing 8410cd2690d46 platform/x86: asus-wmi: fix resource leaks on probe failure 1ad6456898f6e esp: do not unref managed frag pages in esp_ssg_unref() 80968b42d1308 RDMA/rvt: Return NULL after port allocation failure 6a2e023429a41 fs/resctrl: Fix UAF from worker threads when domains are removed c6492e1741204 cxl/features: Serialize multi-part Get/Set Feature transfers a60bc2df2d323 firmware: arm_scmi: Fix SCMI device destroy lifetimes f85333284fcb6 firmware: arm_scmi: Fix OF node reference handling 21bc07293ec4f firmware: arm_scmi: Clear SystemPower flag on create failure 074d062040197 ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() 094f0a895cf97 bpf: Fix WARNING in bpf_tracing_link_release 01b5fcdc30c0a pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip f3480c59f4ce9 scsi: ufs: core: Validate string descriptors 9d39f6dda00f6 scsi: ufs: core: Convert string descriptor format macros to enum 268cbe3a36ae5 iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() c36816feff47f PCI: Fix UAF when probe runs concurrent to dyn ID removal 5e81d109f2e24 PCI: Fix dyn_id add TOCTOU 0787e34b894bd PCI: Make pci_match_one_device() match on ID instead of device 2fcd26f468014 RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() ffd56ada81f97 nvmet: fix return status of RMI log page on allocation failure f2be47fa8e225 drm/panthor: Add vm_bind region with kbo range overlap check 23bed4ef132c5 wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() ffcc9ea4e4d12 md: remove REQ_NOWAIT support from raid1/10/456 7a1b971b799ea wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx() 2aa3d3b9fac91 wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete aca0cd273b486 wifi: mt76: cancel reset and rc work on device unregister 9a9e902bd0556 bpf: Reject >8 byte return values on return-reading trampoline paths e512823aabbdc wifi: mt76: mt7996: clear stale link state on full reset e9e2854fcff57 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry 0ec1d14cf302a wifi: nl80211: clean up color-change beacon data on errors f334b26b884df wifi: brcmfmac: fix P2P action frame handling without device vif 9260a92ce90e6 serial: core: do fallible allocations before the console can be registered ddf51d74ee9f9 serial: core: clear freed pointers on uart_register_driver() failure 2af4c46b42990 tty: skip cdev_del() when no cdev is registered 2fd9c8112907c HID: logitech-hidpp: Fix FF device cleanup on init failure 8397942b67128 ublk: validate auto buf reg before taking uring_cmd f81972b235f3e bpf: Invalidate RCU pointers after final spin unlock 3556caa31a2bf PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers 9b405b3e7e131 thermal: hwmon: Remove hwmon class device along with its parent 9d44822ba34d6 ocfs2: o2hb: quiesce negotiate handlers and timeout work bf4bd72020f33 ocfs2/heartbeat: fix slot mapping rollback leaks on error paths 1f0f61573ba4c bpf: Clear buf on error in __bpf_get_task_stack 35ef785b25ee2 bpf: Remove trace_in argument from __bpf_get_stack 63669625833c4 bpf: Factor callchain_finalize function from __bpf_get_stack 8c30d9fd61ebf bpf: Factor callchain_store function from __bpf_get_stack 562d24ac214ba drm/amd/display: Resize MST HDCP per-connector arrays to 32 b5896fc269e9f drm/amd/display: disable replay when crc source is enabled d5f3dae82705d coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable e90f746f4ca38 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails fcee001f57bdb scsi: sd: Move the sd_config_discard() function definition ce8103676f4d4 btrfs: check if root is readonly when setting posix acl 172f349f2c59b btrfs: apply the AUTO_K(V)FREE macros throughout the code 58b0ab0340ce0 btrfs: zoned: flush active metadata block group at btree_writepages() start 243bf1e45e40b iommu/vt-d: Fix iopf_refcount leak on RID domain replacement 11dfe2896ea23 iommu: Pass in old domain to attach_dev callback functions 6822ba1ae9b6d NFS: Return a delegation the client fails to record e4ab436d5ba61 bpf: Compare iterator types during state pruning a25ea67a913f9 clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type 6e6f8e3bfc66d nvmet: fix max_qid race between configfs and controller allocation 5c6593422eb3c blk-iolatency: clear delay state when freeing policy data b399a88eb8b16 blk-iocost: clear delay state when freeing policy data f4ca62414f4fb blk-cgroup: delay freeing policy data after rcu grace period d4ba9d888ac0a bpf: Check pointer type for all atomic RMW paths 272c05a51285f ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() dc1e34f78dfab ksmbd: serialize oplock close with pending break ownership ff6870cf3b7ec ksmbd: defer publishing granted locks to prevent UAF/double-free race 52b91bc5253bb ksmbd: safely discard unregistered deferred locks f77d2accafca5 ksmbd: detach blocked lock requests before freeing 1ff0e41afbe73 ksmbd: scope session state changes to bound connections d39da3ff8d39c dpll: fix NULL deref in dpll_device_ops() during teardown race 5235abdb760bb virtio_net: Fix resize of the RX ring 0887d41abf766 irqchip/gic-v5: Clear per-CPU IRS data on teardown f57b0fd1c62e1 ip6mr: do not clone dst in ip6mr_cache_report() 884cbf15ccd39 net: bridge: arp/nd proxy: fix reading neigh ha f43ef9a3f9c12 vxlan: fix reading neigh ha f4d23937e1c41 NFSv4.1: zero referring call lists before decoding 68fb30607169c net/sched: account classifier filter allocations to memcg 1ca1df82d9248 fuse: Fix the condition to enable over-io-uring 8460dc49c9756 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt 8a8585e421d06 Bluetooth: do not leak an hci_conn when a second LE connect is rejected 7b3e08eea1e8c net: mana: Cap MSI-X vectors to the device MSI-X table size c08314f917829 octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init() c6b56b8d549a0 netfilter: nf_tables: skip double clone set expressions on element insert ef4dee4640c6a KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped 506f03b5f869c LoongArch: KVM: Validate MSI data before routing it to EIOINTC 34a2a7134fd66 LoongArch: KVM: Get VM PMU capability from HW GCFG register 56c2c5ad35614 media: chips-media: wave5: Resume device before setting EOS flag c26cbd5c33cd7 drm/amdgpu: force complete the KIQ ring fences on reset 7d722821e2f62 drm/amdgpu: force complete the MES ring fences on reset ef073edd7cfd3 zram: fix out-of-bounds access in writeback_store() 836ce2b99bcce lockd, nfsd: RCU-protect nlmsvc_ops dispatch df5500ab85df6 nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths 9646dfee88073 ceph: fix UAF in check_new_map() on session freed during unlock e1f692b6da3e6 cifs: call pagecache_isize_extended() in cifs_setsize() when extending 5481766125041 ext2: Fix lost inode updates for IS_SYNC inodes 0692a8fdf0222 kho: fix size calculation in kho_preserved_memory_reserve() 996dd15f60121 SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 5909f8f04e9b7 SUNRPC: Switch MIC token verification to crypto/krb5 ffb0423b4f4b0 SUNRPC: Switch MIC token generation to crypto/krb5 1e9125bb7948c SUNRPC: Switch wrap token decryption to crypto/krb5 5ec781a29eed1 SUNRPC: Switch wrap token encryption to crypto/krb5 6b4d0c9cf2b10 SUNRPC: Prepare crypto/krb5 encryption and checksum handles 5cf04fdbbf30e SUNRPC: Add errno-to-GSS status conversion helper 08efba8d62560 SUNRPC: Add crypto/krb5 enctype lookup to krb5_ctx 65f0f82f20334 svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails 35d5dd0c2fd1e svcrdma: wake sq waiters when the transport closes f35cf68b14422 svcrdma: Add Write chunk WRs to the RPC's Send WR chain ddbd71a378094 RISC-V: KVM: Fix PMU event info array size overflow 0d4316e30efc8 KVM: riscv: Fix Spectre-v1 in PMU counter access 0f035333e1994 ntb: Store original DMA address for future release b8cd3b632a0ce NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers 6a01c4d3a3ae1 NTB: core: Add .get_dma_dev() callback to ntb_dev_ops 7672973957e3e tipc: avoid busy looping in tipc_exit_net() ed7e9715849ab fbdev: Wrap user-invoked calls to fb_set_var() in helper 69164d6bdad5d drm/amdkfd: Add bounds check for CRAT subtype length 39841db9322cd drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length 22c2169770ad3 bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie bea1f73ad69ee drm/amd/display: check if dml21_add_phantom_plane() is successful 63844dc03960b dmaengine: idxd: fix double free of wq, engine, and group structs e299b7d1334eb idpf: bound interrupt-vector register fill to the allocated array a4de6fc95b2f3 Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks e124f7b170337 soc: xilinx: Fix race condition in event registration afef4b0de4f3c drivers: firmware: xilinx: Switch to new family code in zynqmp_pm_get_family_info() a19c48d9f5a73 drivers: firmware: xilinx: Add unique family code for all platforms 547ea9f567498 netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag be7fb59512ffc btrfs: lzo: reject compressed segment that overflows the compressed input 0977a6f234396 optee: ffa: Add NULL check in optee_ffa_lend_protmem fdc93f4a80107 scsi: core: pair EH runtime PM get and put 5cea365559449 ovpn: defer key slot crypto freeing to workqueue eb81c8e758f49 ipvs: revalidate ihl to prevent out-of-bounds access d10e73572cda4 eth: bnxt: avoid deadlock when canceling IRQ affinity notifier 21f5381a57a5f eth: bnxt: decrease indent in bnxt_request_irq() bf3f37c2d40b5 gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock 868c478abce85 soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read 056876c9db1e9 btrfs: lzo: reject inline extents without valid headers 618fc8dc219c1 accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() b3d05a335cbd3 accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() 4af94462c0ca2 bpf: Fix netns reference imbalance in conntrack kfuncs b57164cdddb46 vhost_iotlb: bound map allocation in add_range 2b80707b9e276 eventfs: Use children field for rcu head and add memory barriers 969a96479add6 btrfs: skip global block reserve accounting for rescue mounts f5427cab06564 btrfs: warn about extent buffer that can not be released 23b0f4117e970 btrfs: only invalidate btree inode pages after all ebs are released a6f972c50552e btrfs: split btrfs_fs_closing() and change return type to bool f8e5715a37378 KVM: arm64: vgic: Fix race between LPI release and re-registration 4b296d176580a nexthop: take nh->lock for f6i_list walks in replace check and notify f97fae992155b nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush 2c0a8cc97a9d9 xsk: reclaim invalid Tx descriptors in ZC batch path 1ff789fdfa231 xsk: provide sufficient space in pool->tx_descs 9990cac513e8b net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds 15ed8a9b7c63e netfs: Fix folio_queue ENOMEM in writeback by adding a mempool ff5625d27415a Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback ff926f3ef6c80 Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs 946dc5835c8fb net: Convert proto_ops bind() callbacks to use sockaddr_unsized f1b4c6aaf7655 hdlc_ppp: fix potential null pointer in ppp_cp_event logging 68ffe4265775e Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback a76243488740a octeontx2-af: Block VFs from clobbering special CGX PKIND state 59adeedebf02a s390/zcrypt: Close speculative mem read possibility 20b0b0159390f s390/zcrypt: Rework domain processing within zcrypt device driver 2a25ddf0bf6dd s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code 23a541c31b45f drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport 029b363c9b690 md/raid1,raid10: fix error-path detection with md_cloned_bio() bcf30e14d2bd5 md/raid1,raid10: fix bio accounting for split md cloned bios ea2d1d2ebf60b md/raid1,raid10: fix deadlock in read error recovery path e4a59511e1abd md: replace wait loop with wait_event() in md_handle_request() 55c6f05b66772 wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() c09314b8b4c62 wifi: ath12k: fix inconsistent arvif state in vdev_create error paths d94bf50756d7f ocfs2: validate fast symlink target during inode read b4059a1f57eff bpf: Reject sleepable BPF_LSM_CGROUP programs at load time 68cf46755894d wifi: mac80211: bound S1G TIM PVB walk to the TIM element 0901d2c894426 wifi: ieee80211: split S1G definitions out f488b83a38103 ixgbe: do not configure xps for XDP queues 29e07ec352f0a ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT 0bc97a4110e87 ext4: add mext_check_validity() to do basic check 6166cb1344f16 iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path 98c7e206af48b cxl/region: Block region delete during region creation 53fb46cf933dc netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them fcacd948b10a3 netfilter: nft_fwd_netdev: use recursion counter in neigh egress path 7d5a0dc8eaab4 netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding 33aed3ba04aa5 RDMA/bnxt_re: Free CQ toggle page after firmware teardown 2106c337905d7 RDMA/bnxt_re: Add a max slot check for SQ b422e3eff0edf net: serialize netif_running() check in enqueue_to_backlog() 9a6916a934277 net: fully inline backlog_unlock_irq_restore() 459536b3acf13 net: optimize enqueue_to_backlog() for the fast path 580896e330038 fs/ntfs3: call _ntfs_bad_inode() when failing to rename da6675b393516 fs/ntfs3: Reformat code and update terminology 308d7951ca221 i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() 7a45046068791 md/raid1: fix writes_pending and barrier reference leaks on write failures c642583adc136 md/raid10: fix writes_pending leak on write request failures 453f4f1e90de5 bpf: Guard conntrack opts error writes 644b4c05bd1a4 bpf: net: netfilter: drop dead NULL checks 3827ff67f9fbe tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() 9de9e8f279de0 drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock bc8f2d1c6f7cf xen/pvcalls: bound backend response req_id before indexing rsp[] 177d22d31a4eb iomap: release pages on atomic dio size mismatch 0be672071d6e8 net/mlx5: LAG, Fix off-by-one in single-FDB error rollback 31cc289d5b179 Bluetooth: 6lowpan: avoid untracked enable work 3dd12422653ad accel/amdxdna: Fix VMA access race 33819cca7b76d accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval bf63433873a06 accel/amdxdna: Fill invalid payload for failed command 08ff33dce6f91 net/liquidio: drop cached VF pci_dev LUT 241cf3b7455be accel/amdxdna: reject user command submission without a command BO 0a2c89d538fd4 ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD 4739b1b833cf2 ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC 1c3d9c6bd5b79 wifi: mac80211: validate extension-frame layout before RX 9cbad9c8125f5 net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains c59a693fbd213 drm/amd/display: use kvzalloc to allocate struct dc c2ddd180bbee7 wifi: cfg80211: use wiphy work for socket owner autodisconnect 01f8a354497ba bpf: Fix UAF in sock clone early bailouts 0b2c44363432a bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c 88c38ff74f834 drm/xe/guc: Keep scheduler timeline name alive 81f70f130eff9 drm/xe/guc: Hold device ref until queue teardown completes 8549ac21ab503 bnxt_en: Handle partially initialized auxiliary devices e611403f30928 fwctl/bnxt_en: Refactor aux bus functions to be more generic 5d3cea7d41dc7 tipc: serialize udp bearer replicast list updates 6089f561e2c31 cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths 984ce52ea0e01 cifs: prevent readdir from changing file size due to stale directory metadata 0c07e046e6391 drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers 16656c3d73469 LoongArch: BPF: Zero-extend signed ALU32 div/mod results 08fffd2881e28 idpf: fix max_vport related crash on allocation error during init c174969f6af6c drm/i915/gt: Fix NULL deref on sched_engine alloc failure f7e744bac9a72 drm/amdgpu: Fix kernel panic during driver load failure cfb5a56c21888 ksmbd: prevent path traversal bypass by restricting caseless retry 3eaec47518e12 smb/client: fix chown/chgrp with SMB3 POSIX Extensions d16713c060066 wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon 3f9c0fdefa043 KVM: guest_memfd: Treat memslot binding offset+size as unsigned values 5afc2d9b86bed netfs: Fix zeropoint update where i_size > remote_i_size b76568c672184 drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() fcb23bb31508b erofs: fix metabuf leak in inode xattr initialization 48d09dea506de net: hsr: defer node table free until after RCU readers a2650f8461cd8 wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb 3899d6f924925 wifi: mac80211: fix missing RX bitrate update for mesh forwarding path f669571a2bf50 netfilter: x_tables: allocate hook ops while under mutex a014668cbd95b netfilter: x_tables: allow initial table replace without emitting audit log message f048f297d93fd netfs: Fix missing barriers when accessing stream->subrequests locklessly 93531bca46707 afs: Fix the locking used by afs_get_link() 86f4c1586418d cachefiles: Fix error return when vfs_mkdir() fails b9390aa62fdca nvme-pci: fix dma_vecs leak on p2p memory fba32257979dd nvme-pci: fix dma mapping leak on data setup error c85f325d9ec31 ACPI: button: Fix ACPI GPE handler leak during removal 78677084cd090 ACPI: button: Tweak acpi_button_remove() 38c79dacc8063 ACPI: button: Convert the driver to a platform one bad88022f8949 ACPI: button: Adjust event notification routines 4ec3a8ca97394 net/sched: fix packet loop on netem when duplicate is on b050fd0c2063b net: Introduce skb tc depth field to track packet loops 2090c1a236833 KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor fa34d3e14cb76 drm/amdgpu: fix amdgpu_hmm_range_get_pages 768daa9f4276b netfilter: nf_tables: add hook transactions for device deletions 7e4ab3907f44d f2fs: read COW data with the original inode during atomic write 8363c219d88e7 fbdev: omap2: fix use-after-free in omapfb_mmap 48ac6bab9999b fbdev: omap2: fix inconsistent lock returns in omapfb_mmap 4338663dfd21b power: supply: max77705: Free allocated workqueue and fix removal order 4e1af66d855f5 power: supply: max77705: Drop duplicated IRQ error message fa4be2054a3e2 workqueue: devres: Add device-managed allocate workqueue 5459933a799aa net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind a8c1480bb066c drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED afe815a67ec8f wifi: cfg80211: enforce HE/EHT cap/oper consistency daacc9d1430b6 ptp: ocp: fix resource freeing order 9446167bef89b ptp: ocp: Make ptp_ocp_unregister_ext() NULL-aware de05e37d02f3f ublk: reset per-IO canceled flag on each fetch 09207dc57ab4c powerpc/64s: Fix unmap race with PMD migration entries e72ffe59e48a7 greybus: raw: fix use-after-free on cdev close cb06a07d835ba f2fs: fix data loss caused by incorrect use of nat_entry flag 910e498613d5b ice: fix double-free of tx_buf skb c789649d4334a ice: fix potential NULL pointer deref in error path of ice_set_ringparam() e98cea6d5562f ice: fix race condition in TX timestamp ring cleanup cbfbc9d446d98 ice: reshuffle and group Rx and Tx queue fields by cachelines 349499a65b6b5 ceph: put folios not suitable for writeback 5df268406ef38 libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() d0ce7b07dafe4 drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure 060f8f3020516 drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure dc24e03be0e4b Revert "net/smc: Introduce TCP ULP support" 2da62dbb4169e drm/amdgpu/userq: fix access to stale wptr mapping b33d6f5da16e0 pseries/papr-hvpipe: Fix race with interrupt handler 51a321dec76f7 papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() 1d15503e454bf drm/amd/display: Fix dc_link NULL handling in HPD init 96889fcdb0988 media: iris: fix use-after-free of fmt_src during MBPF check 46edfdcf95d2b media: iris: turn platform caps into constants b0eb0a8959ac2 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT 73df74544b552 udf: fix partition descriptor append bookkeeping 4456be93464a5 gfs2: fix memory leaks in gfs2_fill_super error path 370154a83a835 gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn 1b6a9f81c4715 gfs2: Get rid of delayed withdraws dfd14e14772c6 gfs2: Asynchronous withdraw 604dca7c20a15 gfs2: Add clean argument to lm_unmount hook 74b981f0d3b90 gfs2: Clean up quotad timeout handling 9e0652e243ef4 gfs2/sysfs: Replace sprintf/snprintf with sysfs_emit e0e31a7ed1191 ASoC: amd: acp-mach-common: Add missing error check for clock acquisition 4097a2afe8acc scsi: qla2xxx: Completely fix fcport double free 57a79c5df057d soc/tegra: pmc: Fix unsafe generic_handle_irq() call 5133ef7c893c2 media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC 6c5d98f24f995 media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure 6ad4caadc6343 btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() 6311ee6daa9cc btrfs: remove 'reserved' argument from btrfs_pin_extent() 81e1ae665004b btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() 559f856b109c4 hfs: Replace BUG_ON with error handling for CNID count checks 3a409a64b2d61 ASoC: qcom: q6asm: drop DSP responses for closed data streams d9bf525dff80b ASoC: qcom: q6asm: handle the responses after closing 02b033e18e08a drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 203a9241a7384 drm/amd/display: Rename FAMS2 global control lock to DMUB HW control lock 28768bc7ea0b1 srcu: Use irq_work to start GP in tiny SRCU 37419fa1b0bc2 irqwork: Move data struct to a types header d14847cb7f65d mshv: Fix error handling in mshv_region_pin f33de03b47c14 mshv: Move region management to mshv_regions.c 06c0ce18055a5 mshv: Centralize guest memory region destruction 93ed80634288d mshv: Refactor and rename memory region handling functions a40a75df33267 static_call: allow using STATIC_CALL_TRAMP_STR() from assembly 5cfa4f537a056 Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists 971854e7b6ddd ALSA: ctxfi: Check the error for index mapping 88cc09bb70651 ALSA: ctxfi: Refactor resource alloc for sparse mappings 1422b94887c5c ALSA: ctxfi: Use explicit output flag for DAIO resources c0904c424f7da ALSA: ctxfi: Add hw parameter to daio_mgr_dao_init() dbc8b8d33c9e1 Bluetooth: hci_event: move wake reason storage into validated event handlers c516c2e06fe58 net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path 2352d719cccfc net: ti: icssg-prueth: Make emac_run_xdp function independent of page 2157742f5c32f net: ti: icssg-prueth: Add functions to create and destroy Rx/Tx queues 41f3fa0d14bb8 ti: icssg: convert to ndo_hwtstamp API 6e5c3ddf17a2c blktrace: fix __this_cpu_read/write in preemptible context 6b3546e3a8c66 accel/amdxdna: Fix NULL pointer dereference of mgmt_chann 2f62f8be57882 PCI: endpoint: Add missing NULL check for alloc_workqueue() b0d908230b3d8 PCI: Add WQ_PERCPU to alloc_workqueue() users b569ff8a1bc1b accel/amdxdna: Fix potential NULL pointer dereference in context cleanup 09ed30edcfa1f accel/amdxdna: Add hardware specific attributes 3bdd26582d026 accel/amdxdna: Enhance runtime power management 5a7d0e2810891 ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands e01c79761c7b3 namespace: handle mount locking for automounts correctly 6b8dc3713a763 namespace: never expire a locked mount 494c57572d2d5 namespace: refuse an automount below a mount that is in no namespace fa75dae156df1 fcntl: refuse F_SET_RW_HINT on an immutable inode 5f97df8ca7fad namei: don't reveal overmounted entries in refwalk d29cd99db3db7 namespace: unhash a dentry before detaching the mounts on it 7e1c466011ba9 namespace: don't let a pseudo dentry become the root of a mount 390ddcea2a8ac dcache: don't put a mountpoint on a dentry that's being removed e3aba6900483f namespace: check the mounts before reading their parents in pivot_root() 888363d74c3b5 namespace: remove the fsnotify marks of a mount namespace in process context b9c40553f6ceb namespace: look at the topmost mount for a mount namespace file a0ba48256f5df namespace: check a recursive bind mount for mount namespace loops d73f04e92c1aa namespace: check a submount for references right before unmounting it acbe9e4418e2e namespace: queue a mount only once for mount notifications 33b4344f69013 namespace: check the target before walking it in do_mount_setattr() c44f5c30f0a97 fs: refuse fspick() on internal superblocks b47b40c4f0584 namespace: don't copy an unmounted mount tree eecc9cd0fc07d namespace: don't inherit MNT_UMOUNT in clone_mnt() 5e0a1f2c753a7 namespace: reset the old parent's ->overmount in mnt_change_mountpoint() bf2c8dec26fb7 fs: don't silently unmount busy mounts 9bd1181b36f2d mount: keep a copied mount unbindable c6307228af65a drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs d9da2f7bbbffb drm/amdgpu/userq: return the memdup_user() error for the user MQD 112dbe2b10d6d drm/amdgpu/userq: only accept doorbell BOs as queue doorbell 21aee7fc9310d drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks 1a5c03198ae86 drm/amdgpu: make Mac FB workaround generic 8d6f773d74790 drm/amdgpu: serialize vblank counter reads against GPU reset 3d4890b4ab04f drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info f009879ed9906 drm/amdkfd: align SDMA doorbell base for shader doorbell writes 3a11adcfd9a2d drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin 993c952e6832a drm/xe: Fix shrinker accounting double-subtraction on nested external pins 76e5ddd7d9822 drm/vmwgfx: validate pitch coming from userspace ea22f8a5d11a4 drm/vc4: Fix firmware reference leak in vc4_drm_bind() e61465d3e0292 drm/vc4: drain the hangcheck timer and works on V3D unbind f9b215b3e37a5 drm/imagination: Size page table preallocation by device address 0b4a0fb98b9ff drm/i915/gt: Unmask interrupts only when ACTIVE is true 152fb5083b933 drm/i915/gem: Prevent overstepping exec array boundary cd7bec509c180 drm/gud: don't keep a connector without a CRTC as connector_state 4e7b508c7c60d drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN a661f401f83b8 Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown 4f46de658ce61 Bluetooth: RFCOMM: free the skb when the DLC has no owner b108ea7ebba14 Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() ec227cddd13cd Bluetooth: MGMT: Fix status of pending commands flushed on power off c6489a3a0ac8c Bluetooth: ISO: Serialize concurrent connect calls 90b744066ca52 Bluetooth: ISO: Reject concurrent BIS listener setup 7db33b36213a3 Bluetooth: hci_sync: Fix command skb lifetime during scan setup c3d2799877906 Bluetooth: hci_sock: Serialize dead-device detachment c9c20d334cd5e Bluetooth: btintel_pcie: use managed IRQ teardown 71beae6f2e8bc riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header 2e5c80bbc062a riscv: futex: untag the user pointer before the atomic access b86e88a3dc6e1 riscv: fix load_unaligned_zeropad() fixup for RV32 fa465a7819ecb riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE 7d1367a53137e riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp 8bfcbd5022818 scsi: qedi: Initialize callback state before registration ce2eee635fd3e pmdomain: rockchip: propagate subdomain add errors 1072890e6c1af pmdomain: rockchip: fix clock leak on domain probe failure 5874c0e2bd030 pmdomain: rockchip: don't ignore clock lookup errors on attach 28606d4d4dbe8 pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains f6fbe9c6b3996 regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 199a62d70314d regulator: ltc3676: don't read the write-only HRST and CLIRQ registers 681adbc9c7a82 optee: register TEE devices only once fully initialized 55f12552b00a3 openvswitch: fix soft lockup in the netlink flow dump 558a189ca357d nvme: fix swapped ZRASF zone state values for full and read only 961563117626f net: team: free skb when broadcast has no txable port 0c0568c9d35c4 net: team: stop reusing skb after queue override 5b144f83f2179 net: usb: ax88179_178a: fix rx frame length for non-last packets cc7cc5955d22e net: sparx5: free the matchall entry on destroy 5551399751e2c net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() d7fea7141036f net: dsa: microchip: fix KSZ8765 fiber detection d109141ba1465 net: bridge: avoid recursive multicast port cleanup 6a1833f0d7dc0 net/smc: protect clcsock lifetime in smc_getname 3efe0e0944157 net/packet: guard the ll header push in packet_rcv_spkt() 3a1caa886d41d mmc: sdhci-sprd: disable runtime PM on remove 46e75703ca3f0 mmc: mtk-sd: Cancel request timeout work on remove 9ac3fd9dc917d mmc: cavium-thunderx: destroy slot platform devices on remove 8668f432a9bf7 mmc: cavium-octeon: destroy slot platform devices on remove e3bf232c913b7 dm: fix reading free memory in do_resume c86f80cd246c0 dm-snap: reject the transient exception store for snapshot-merge 4f0ee735dc68e dm-integrity: fix buffer overflow in inline mode with large tag size a1a875614dae4 dm-crypt: reject the lmk IV mode with AEAD ciphers 7a25ca170c12a mm: don't schedule deferred kernel page table freeing while booting d7e811c3a49cd memstick: rtsx_usb_ms: complete requests after eject instead of dropping them f2795c50144d5 memstick: core: wait for request completion before freeing card 11516a0c402a6 KEYS: Fix add_key() race with keyring restriction 955b1f75c4001 keys: finalize persistent keyring timeout after link attempt beb05f484a1e4 ice: fix metadata_dst refcount handling on representor teardown ca8a6285b11d0 ice: fix use-after-free in dynamic port cleanup bb8f6b89587d0 ibmveth: fix TX LTB and filter unwind on open-fail a065bd31ec462 ibmveth: h_free logical LAN on open-fail after register 06656aaa7e43a gve: fix XSK buffer leak on error descriptor 506f9de069d07 gve: fix XSK buffer leak when rings are stopped 42935a6100192 gve: fix napi_disable deadlock when attempting to disable XSK pools a027e0d7765d1 gpio: xilinx: fix runtime PM leak on request error path 76390ac0bca7e gpio: mpsse: fix race when arming the IRQ poll worker 1eb70d10bbb8a EDAC/amd64: Mask UMC chip select to the four implemented selects 2d79ddc9a0cc0 sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute 5509d498e1b9e selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts 5a41bcc5057dc selinux: fix data race on AVC latest_notif 215c29f7f4606 Revert "wifi: libertas: reject short monitor TX frames" 1428c5f1d346a tipc: hold a reference to nodes found by link name 0af8780bdfdfc tipc: destroy topsrv workqueues before closing connections 1c7463ac0e99c tcp: reject net_iov in zerocopy receive mapping hints 3d555c31b0d27 swiotlb: fix default_swiotlb_limit() for non-growable default pool d2b5f637b9b67 strparser: make sure __strp_recv isn't running before tearing down the parser 65cb86860a80f tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() 086944c1c2cbb xen/netfront: don't leak the skb when xennet_fill_frags() fails b12a25fb2b9d5 workqueue: Fix NULL current_pwq deref in chained work check 4d64a3d6e96aa wireguard: noise: reject response consumption after intermediate initiation 38da24fd5c9d0 wireguard: queueing: preserve tstamp_type when encapsulating packet d730b466496ce wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init() dd117d17e8aa2 wifi: mt76: mt7603: initialize global station WCID eef16a74ff8ed wifi: brcmfmac: fix P2P device removal race in brcmf_detach() 38bad3930b118 vsock/virtio: account only unread bytes in read_skb() 6139c710d8bee usb: f81604: fix struct f81604_int_data size mismatch 5680b6fb30546 dm ioctl: don't let data_start run past the buffer 2200fe1d6148b cipso: adjust cached option offsets when removing CIPSO 8d88d3221204f cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() 12ba7d8b9cd45 btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() a768b88cd157b ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) 13bbcfe755d46 arm64: irq: exclude the softirq stack switch from KCOV 1ea7241101753 ALSA: hda/tas2781: Accept V1 calibration data without CRC f7dc71c1ce885 ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers 0b0278e760d7b Input: xpad - add support for Corsair Novablade Pro 2e4f80c023119 Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox d738e51bf2c21 Input: ati_remote2 - fix type confusion in device attribute handlers 4ac7d92a4698e ipv6: do not warn on route notification size race 7dfa7ca97f3ac ipv4: do not warn on route notification size race c1f48d1c2d5e9 ipv4: stop route notification sizing when nexthop group shrinks 21cba134c30c1 ipv4: stop exception dump when nexthop group shrinks c6d670ac656ba ipv4: stop PMTU walk when nexthop group shrinks 71cbad138969e rust_binder: reschedule node refcount update on thread exit f3e835af6226f ipv4: validate checksum_start before completing checksum fa1bceba169b1 ipv6: Fix redirect exception creation for UDP/RAW sockets 61a32face36f7 crypto: drbg - Fix ineffective sanity check af98611ad109e net: dsa: mt7530: fix .get_stats64 sleeping in atomic context 4d8ed219b1921 f2fs: fix to reset all pinned status during fggc b2cf17d39dd2c f2fs: fix to shrink gc_lock coverage in f2fs_gc_range() 3f63f071bf82b accel/amdxdna: Bound the sync_bo flush range to the BO size d7b9770a487e1 ynl: fix schema check errors 3a49853272bd3 doc/netlink: netlink-raw: Add max check 56760e83aa4e8 netfs: zero the tail of a short DIO/unbuffered read 61519a5a1d70f net: mana: Skip WQ object destruction for uninitialized RXQ b5aa7f1773f80 net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() 867119b4b5880 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry 639522e5056ca net/mlx5e: Prevent stale XSK buffer release on refill retry 50cff3f112d64 fs: Free any excess xarray nodes in clear_inode() fbd977e513971 bnxt_en: fix DMA mapping length for padded small packets 17ad2612c11a7 Linux 6.18.56 a47406c769f72 ipv4: free inet_opt and ireq_opt after an RCU grace period b473ee29aa0d3 iio: adc: adi-axi-adc: Initialize state mutex bb29dd90885b4 iio: adc: adi-axi-adc: Make use of dev_err_probe() e05c55de819b4 iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs 845c959178cca net: mana: Sync page pool RX frags for CPU 55aa2774323e7 net: mana: remove double CQ cleanup in mana_create_rxq error path 72d2f54367895 xen/netfront: drop RX packets with a short Ethernet header 626deff23b544 net: usb: qmi_wwan: add Quectel EG120K-EA 525694a6021ec KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails 81d7875515906 KVM: x86: Add static calls for nested virtualization ops 69f1d46341c28 KVM: x86: Reject nested CAP enablement if nested virtualization is disabled 9a4605ac9045d KVM: move TSS constants from kvm_host.h to tss.h 318ef696fa3c7 KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted 267c586a090a4 KVM: arm64: Use stage-1 leaf size for VM_PFNMAP 1113374a17d7f KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT e4f086a7d7074 KVM: arm64: Always populate FGT masks at boot time a014b1a377e45 KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.h cf0654248c87f arm64: errata: Add Cortex-A725 erratum 3821522 workaround 424e851050f47 arm64: errata: Factor out broken AMU const counter cap 277c4d8eac0ba arm64: mm: Fix the break-before-make flush range for erratum 2645198 e506333d1b9f4 perf: Require kernel access for text poke events 2581b43e162cf perf/core: Check kernel access when kernel callchains are requested a16986dac7be5 perf: Replace perf_event_header__init_id with full header init 624370942abd3 unwind: Shorten lines 08bf919f041af tty: fix saved termios reset race 9e8595cbd31db usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 100f92cc90149 tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2 ba927133b3018 usb: dwc3: gadget: fix IRQ storm on invalid event buffer count 9b995b757a87d drm/amd/display: Fix fast updates on DCE 8.1 6f36088234647 drm/amdgpu: reset VI ASIC on MacBookPro14,3 d12b62677fb48 drm/amdgpu: reset VI ASIC on MacBookPro15,1 0e0fd96b26263 drm/amd/display: Preserve eDP mode on initial ASSR failure 8786c5bc77375 drm/amd/display: Mark DCE 6.4 as not APU 6b0cc4e32599f iio: adc: ad4030: fix invalid oversampling_ratio validation 23222e50948a2 iio: adc: ad4030: Use BIT macro to improve code readability 9c8158ef4ccce units: Add HZ_PER_GHZ a0a1929d66d6b smb: client: only require read lease for size-extending preallocate aec958676fb75 iio: adc: aspeed: propagate reset deassert errors 49c97ba1a3a3f iio: adc: aspeed: Simplify with dev_err_probe 74d723eee7296 smb: client: distinguish real EOF from a stale remote_i_size on read cecf4114069fc smb: client: flush dirty data before zeroing a range 405a969c0b335 thunderbolt: Don't access a DP tunnel after its DPRX read was canceled 9cedbfde14500 wifi: mac80211: set info->band for 802.3 encap offload frames cbdcf80683f53 wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() 03525b632908b wifi: mac80211: count only matching reservations in reserved switch 80e8b0ea73ba2 mtd: spinand: fix NULL pointer dereference with no ECC engine 2d86abd280714 nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known d3d6d7efdacc0 nvmet: copy the hostid into the ctrl before creating PR pc_refs dd053fc01eefa nvmet-tcp: Don't error if TLS is enabed on a reset 889c61e3d0f10 Bluetooth: Serialize SMP remote OOB data access e887e43bd5aa7 fsverity: add dependency on 64K or smaller pages b4c0c41b952c2 fs,fsverity: remove check for fsverity being enabled in setattr_prepare() 2efdeec99ca09 fs,fsverity: reject size changes on fsverity files in setattr_prepare 8f317daa50fe1 rust: irq: pass RegistrationInner as cookie to request_irq 333fa4bb5dbbe rust: devres: ensure revocation is complete before device finishes unbinding e7930d857cc79 rust: devres: fix race between concurrent revokers 5017fdcb5ad73 rust: devres: add 'static bound to Devres 8ae7e5dec4f34 rust: devres: fix race condition due to nesting 946ae2e1669b6 mm/vma: predicate setting mmap_prepare VMA fields on new vma alloc 60f3b22d501dd mm/vma: rename __mmap_prepare() function to avoid confusion 98f6a4589e0f5 netfs: clear post-EOF pagecache when extending a file via write 4b8ce1686dea1 pfcp: fix socket lifetime on netdevice registration failure 8bed333470a1b mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages 0a6c9b3801903 drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read e68380710fc97 svcrdma: Use svc_xprt_put to free listener on create failure d1d9694ae47da mptcp: fix msk->timer_ival reset e64703280ce7a iio: trigger: cancel reenable_work before freeing trigger e113bac1d5e72 iio: proximity: vl53l0x-i2c: claim direct mode for raw reads 28e76a775c304 iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler a70d84d2f6c32 iio: proximity: sx9324: Correct proximity channel resolution 20ebd7f4e35c0 iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure 58237debc18dd iio: proximity: isl29501: Fix return type of isl29501_register_write 6501b032be217 iio: proximity: aw96103: validate firmware data length 493e743ea1b59 iio: pressure: rohm-bm1390: Return error when read fails 4fd5a61e61d68 iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup 10a958e76c737 iio: light: rohm-bu27034: Fix infinite delay on error cc71400bc965c iio: light: gp2ap020a00f: drain irq_work after free_irq ce308ce18dedc iio: imu: adis16480: fix unprotected debugfs reads 50e8d70ba0743 iio: imu: adis16400: fix unprotected debugfs reads 60699102827fd iio: health: max30102: fix NULL dereference in interrupt handler b53dc6e15aead iio: gyro: adis16136: fix unprotected debugfs reads 786f0162fe6d2 iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() d6a83a5015071 iio: cdc: ad7150: fix OF matching and publish module aliases b134ef820610b iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. b466db9e68b47 iio: buffer: serialize buffer teardown with mode claims 8aef1e8bdd86d iio: admv1013: initialize callback mutex before registering notifier a5fe2d1b55fab iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind f44e2ac2fb114 iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls d74c2489acc5f iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure 6dd3bf785d030 iio: adc: stm32-adc: fix possible division by zero in processed channel 2754d336af34b iio: adc: stm32-adc: fix check on internal channel availability 56e8e9d9992b4 iio: adc: rohm-bd79124: Fix rising alarm 2a3fd11fd0e19 iio: adc: rohm-bd79124: Fix GPIO mask check 02a9e6a95a3bf iio: adc: rohm-bd79124: Fix channel initialization 1d8beaae5a745 iio: adc: rohm-bd79124: Catch regmap errors at measurement start/stop 2eb7f097e15dc iio: adc: pac1934: check ACPI label duplication fe0ceff995d91 iio: adc: max1363: sign-extend bipolar differential channel reads f87d392bb4ebf iio: adc: axp288: Add TS bias override for Haier HV103H ed1a6230155fd iio: adc: ade9000: request interrupts after powering the device f73b94acc7ec8 iio: adc: ade9000: handle Phase C dip events in IRQ1 handler fddb6cc28134b iio: adc: ade9000: fix overlapping scan_index for current and voltage channels d2400175228fb iio: adc: ade9000: fix NULL pointer dereference in clkout registration f20b94a7dc1ff iio: adc: ad_sigma_delta: fix use-after-free on unbind 0633f83c4caa9 iio: adc: ad7173: Fix digital filter configuration d2261795797bc iio: accel: sca3000: fix frequency divider condition check 3365209e758c8 iio: accel: kxcjk-1013: reject duplicate event disable 5c7ca8fe72064 iio: accel: kionix-kx022a: Prevent memory leak and fix state 4165641d06ef4 smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races f82242fe3109a smb: client: flush and commit data before querying allocated ranges dce9bca8afcbd smb: client: discard post-EOF pagecache when extending a file via copy range b75dadb50a25e smb: client: discard post-EOF pagecache when extending a file via zero range 2f97f929dad9e thunderbolt: Reject oversized XDomain properties responses 58cb2aa1d29f7 thunderbolt: Disable CL states for the Anker Prime TB5 dock 2f5893172fc61 thunderbolt: Fix domain reference leak when DPRX read is canceled 34a6e27c954e5 thunderbolt: Tear down inactive DP tunnels when the domain is stopped e09cbad4db58a thunderbolt: Mark discovered tunnels as active c444d2c17dc23 thunderbolt: Hold a router reference for each allocated HopID f18faa3d3b810 thunderbolt: Fix KASAN reported use-after-free when request is canceled 29664699216c6 USB: serial: option: add Compal EXC-T1 support af4224809ea1b USB: serial: option: add Quectel RG660QB 3ef1b5c9a7194 USB: serial: option: add Compal EXM-G1x support 8b495843267b9 USB: serial: option: add Quectel EG060W 02e1112182d8a USB: serial: option: add support for SIMCom SIM8260C 4597ddd6168ae USB: serial: fix ioctl hangup race a1aa474768f69 USB: serial: fix driver deregistration order 4d6da6867b4ac USB: serial: fix dynamic id driver deregistration race 02fc7a87f0291 USB: serial: ssu100: fix baud rate overflow 4e18c175cea26 USB: serial: quatech2: fix baud rate overflow 25a5f7239a43a USB: serial: cp210x: add Corsair AX1500i Power Supply 452f1c9b76f7a wifi: mac80211: handle empty FILS association request payload 128e800a41270 wifi: mac80211: fix mesh fast xmit path deletion UAF a613c891906b5 wifi: mac80211: release mesh path quota on failed additions 1892e71aa2e5e wifi: mac80211: reject invalid 320 MHz CSA bandwidth 42aa9feb27b60 wifi: mac80211: minstrel_ht: validate fixed rate index d0183cd1f6a2d wifi: mac80211: keep fallback association elements alive 3b75831ceee76 wifi: mac80211: account proxy paths against the mesh path limit 772bd89304ecf wifi: mac80211: drain PS delivery work during station teardown 481f9230284c2 wifi: mac80211: shut down RX BA session timer on teardown 1c82d0c5d5091 wifi: mac80211: keep paired old chanctx alive cd8f8f45d81aa wifi: iwlegacy: 3945: free EEPROM data on remove b0e97bd40e0c2 wifi: cw1200: fix TX padding OOB read leaking heap data to device 4c9a32a808104 wifi: cfg80211: fix RTS threshold setting for single-radio PHY 98abf374e5096 KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor b37ae6e65a1dc KVM: arm64: Clear HCR_EL2.RW for 32-bit non-protected vCPUs 97c1dcce17ef2 KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy 8b7d4f68fef96 KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state b1de3ebf59507 KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it f6189e26d0237 KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified 1a62eb293f60a mtd: spinand: Do not update the QE bit on devices without one b28120197cc15 mtd: spinand: fix zero oobavail when no ECC engine is used 23cef33571b19 mtd: spinand: Enable QE on all dies 2bbaa3f8df83f mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive() 875c57f2df09f mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB 1ed0ccd564915 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ cadf42f22438f mtd: mtd_intel_dg: reset poll counter for each erase a991c28066e7b mtd: block2mtd: Fix divide error when erase_size is zero 2423a05dd0f21 nvmet: pci-epf: reject too-short SGL segments 7fd3c363eba4f nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() 21ffcae171d11 nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT 49e8a3224c91f nvme-multipath: fix underflow in ANA log bounds checks e30a2406408d2 tpm: fix off-by-four bounds check in tpm2_get_random() aa480f05aed7a net: extend IPv6 exthdr detection of tunneled packets 6316d17324bd4 ipvs: bound LBLCR and LBLC cache growth 891bd8335a0de io_uring: fix task_work add use-after-free with SQPOLL a85d0f00671b4 fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching() bdbc8e78aa96d tracing: fprobe: fix suspicious rcu usage in fprobe_entry b0f76d4cb9be5 mm/damon/core: do non-safe region walk on kdamond_apply_schemes() d3c2d2692bdf4 x86/mm: Drop unnecessary PMD page copy when freeing fe23680e6f1d5 x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h 84df222de86ea Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() c3b5e6da4ba64 Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() c42ce5373405c Bluetooth: btintel: fix buffer over-read in btintel_hw_error() 708cdd203d0bb Bluetooth: hci_core: Serialize fragmented ISO packet queueing 1681f97afdf92 Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown 86e9708f9d19a Bluetooth: hci_core: Serialize ACL scheduling with channel deletion dd4db9f808ac2 Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems cabd58d9bb66d Bluetooth: hci_conn: Lock parent access during enhanced SCO setup 333257e6e4a7b Bluetooth: hci_sync: Fix inquiry cache use-after-free 0a554901bd227 Bluetooth: RFCOMM: Fix initial port reference race 4230d65032fcf i2c: xiic: don't clobber msg->len to signal block-read completion 51e1125ff7d63 i2c: xiic: preserve PEC byte length in SMBus block read setup ba0632683728e EDAC/altera: Fix device node reference leaks in the SDMMC ECC setup 865f3bdebbc9b EDAC/altera: Fix use-after-free in error paths 74eeb95c0478b EDAC/altera: Fix memory leak on dci allocation failure 9846b85c2eb8b EDAC/altera: Drop __init from ECC setup paths for re-probe safety 0c03cb91b5698 EDAC/altera: Do not allow driver unbinding 9d2d3b3dfe897 EDAC/versalnet: Drop remote processor handle refcount on driver removal e561c2740b628 ALSA: hda/realtek: Fix silent speaker on Higole F9B d8986de05cc6c ALSA: hda/realtek: Fix square wave output on ASUS Strix G615LR eb0c7fda59cf6 ALSA: ua101: reject mismatched capture/playback packet sizes fc5c52848e405 ALSA: seq: Serialize compat port-info ioctls 9590d16791625 ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 69d2b7a4c1151 ASoC: qcom: lpass-cpu: use DAI table index for playback constraints d195c8c763fdd ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type 7df8c39a50f36 ASoC: codecs: max98363: fix uninitialized stream_config->type 2bce6f006cfe0 arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems 1c17db14f2c23 serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL 8f9103651d6ab serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around 48e09369839fb serial: vt8500: Fix clock reference leak in vt8500_serial_probe() f895ed664cb7a serial: tegra: don't clear the Tx FIFO on an Rx-only reset d8233d6b391b4 serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() 7019a84c23c1f serial: fix TIOCMIWAIT race 3f151c2e86f5d serial: revert guards in uart_wait_modem_status() c3ba14c29d55b serial: 8250_omap: fix wake irq cleared during suspend e32440fa536af serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() 2c8614981d3e6 tty: serial: max3100: shut down timer before freeing port 94af6cd832e9b tty: abort break signalling on hangup c110c6eed54fb tty: serial: qcom_geni_serial: Keep console RX functional after deep idle 6b7be3b9b8579 tty: port: fix tty_port_tty_vhangup() race 7021acc84c2e0 tty: tty_port: restore TTY_IO_ERROR on activation failure 821050631750e tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup 4335278d0e753 tty: vcc: zero-initialize control packet in vcc_send_ctl() 3551bdf843a1f tty: amiserial: fix broken TIOCMIWAIT e8615dfe80cf5 tty: vt: fix memory leak in vc_allocate() d16046f1ace26 usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe 95160fe606e68 usb: cdns3: fix use-after-free in cdns3_gadget_exit() 072535f26dc5c usb: typec: ucsi: displayport: Current CAM OOB index fixup f5ed186d0cf38 usb: typec: ucsi: Get the connector fwnode based on reg value 41934f92e7a54 usb: typec: ucsi: glink: fix use-after-free of ucsi on remove 75dc6cb377efd usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() 282be6ae8be79 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() 30dbaf3c6696b usb: typec: tipd: don't send GAID when probe fails in APP mode b2ed8643face2 usb: typec: tcpm: recover after failure to start the frs ams 4333174ea52c8 USB: dwc2: shut down wakeup timer before freeing HCD state 1da16c46b8d71 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints bd89c4f42f564 usb: chipidea: tegra: disable runtime PM on resume failure 7811d8e26c77f usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC 5298c96bf0068 USB: gadget: dummy-hcd: Fix wait for outstanding request completions 474e9e1852fb5 usb: gadget: aspeed-vhub: cancel wake work on device removal 9f0321e8e9afb usb: dwc3: am62: Fix runtime PM usage count leak on probe error path 7b5ed2d30ccc6 usb: typec: port-mapper: Only match USB4 port if host interface is available 50a92c02551c1 usb: typec: anx7411 - stop the IRQ before destroying the workqueue 8c611876c002d usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd 87f2185423e01 usb: gadget: midi2: Fix the jack descriptor array sizes 772149e7badba usb: ohci-st: disable controller wakeup on removal ec69932b45585 usb: ohci-spear: disable controller wakeup on removal dc1b196ad5956 usb: ohci-s3c2410: disable controller wakeup on removal 83e8bd42bd17b usb: ohci-da8xx: disable controller wakeup on cleanup a12e803d22551 usb: octeon-hcd: fix the FIFO-flush timeout computation e9545dd8bc625 usb: hub: use shorter 120ms post resume hold for SS root hubs e2d62928f2666 usb: storage: sierra_ms: reject short SWoC info transfers 5e8980a81af19 USB: serial: fix port tear down use-after-free a0ed07b5bbb2d USB: cdc-acm: skip URB restart in port_shutdown if disconnected 108af6f585ddc USB: cdc-acm: fix racy TIOCMIWAIT implementation 9b5b83ca2a668 soc: qcom: geni-se: Correct QUP Core ICC vote constants d54df2de22f9a rust_binder: cancel deferred work items in thread exit f7fb6c2835ede nitro_enclaves: fix use-after-free on SLOT_ALLOC failure c5504e179135d Input: synaptics - limit T440p InterTouch quirk to LEN0036 fc92d4499f3fa Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 95e8d0a7b22fa Input: s6sy761 - fix resume ordering and restore sensing d79caaf07875c Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 bcfd26841471a Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 0278c68c59b94 kgdboc: Fix tty driver reference leak in configure_kgdboc() 1299cb3fb0615 binder: fix leaked fd fixups on TF_UPDATE_TXN supersede 86cdcc87d4ba6 binder: fix is_failure flag for superseded transaction cleanup 5b113e8ee3268 drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU 587469076e4ff drm/amdgpu: fix ACP MFD device leak on init failure 7ca44cb14d024 drm/amdgpu: fix IP instance memory leak on kobject add failure b84f1386d84b3 drm/mediatek: Fix pdev reference leak in mtk_drm_bind() 629458b7e4955 drm/mediatek: Fix ovl adaptor platform device leak 88f8a92dcb0cb drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device 4d12b763c2c55 drm/radeon: Read the VRAM VBIOS signature with readb() 652f631e2e3a8 drm/amdgpu/gfx6: fix firmware leak on teardown 36fa4159d0054 drm/amd/pm/si: Fix updating clock limits on AC/DC e67aef159f430 drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC 197946faa1b79 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend f3db2853e2a28 PCI: Accept AtomicOps already enabled by the hypervisor f3eaf31910087 spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260 d5a81039adc6a ALSA: ice1712: Fix the error handling via auto-cleanup at probe fc34dd95d3baa ALSA: core: Define auto-cleanup for snd_card_free() 524063fea29f8 perf: Fix race between perf_event_exit_task() and perf_pending_task() 7648757145aa9 i2c: at91: release DMA channels when probe defers efd0d161b0cb7 net: mvneta: clear XDP pfmemalloc flag between frames 53b21bc2df6e8 ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() f81d40e2eb695 net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference 9a76ae59fd637 net: sparx5: make ports inherit the switch base mac address type e3630ff89b777 of: Put coreboot node after compatibility check 47c5ac61e6fb6 net: microchip: vcap: stop scanning after deleting key field 4033e1a9262c5 netfilter: flowtable: generalize pending status bit f6143ae109df5 netfilter: bpf: reject invalid NAT manipulation types 55d033324f67a ipvs: filter some flags received in the backup server 7151f14d59155 ipvs: do not create invisible templates 60e9a6e2ba718 ipvs: fix missing counter decrement in lblc e5633d81b2daf tcp: refresh TS.Recent for accepted old ACKs 35c706d6eb196 net: sparx5: skip ptp deinit if init was skipped 297769d75dc67 net: sparx5: move PTP IRQ handling out of sparx5_start() 728138dcfc92f net: sparx5: move stats initialization and add deinit function 387478e9e9861 net: sparx5: move MAC table initialization and add deinit function a0a8687eb7878 net: sparx5: move VCAP initialization to probe ebb164ae76ad9 net: sparx5: move netdev and notifier block registration to probe a01c71ab74ea4 net: phy: qcom: at803x: Fix IPQ5018 short-cable DAC values 82be3d08de9e1 net: ethernet: mtk_eth_soc: allocate dummy netdev sooner 2f581814e4e3e net: cap skb->queue_mapping when the tx queue is picked 2294b62eaec6f net: bcmgenet: fix NULL dereference in set_coalesce before first open 507c895019a81 net: pcs: rzn1-miic: Clear MIIC protection state before unprotect sequence a4b63808f99a5 virtio_blk: set the zone write granularity ac4827cf96532 net/sched: sch_codel: match the no-drop threshold to the packet size ab6842a1c7bdd net/sched: fq_codel: match the no-drop threshold to the packet size e94970076d293 gve: DQO: accept TSO packets with non-protocol gso_type bits 5069ce898148b net: restrict SO_RESERVE_MEM to TCP sockets and cap max value 358d5ac5a5d57 net: stmmac: fix rx Scatter-Gather support 5847b60561a31 net: stmmac: convert priv->sph* to boolean and rename f78d45d5f1ac4 net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() f74f100e49588 tipc: prevent GCM nonce reuse on peer key changes adad3ff80e50c octeontx2-af: mcs: Fix SC resource cleanup loop 3a6e67ff267af net/mlx5: Fix slab-out-of-bounds when handling team device events 8438b4f65a179 net: systemport: Fix RUNT MIB counter register offset calculation 96d8b26be5bc4 net: systemport: Fix buffer overflow in bcm_sysport_get_stats() 7f16443a30f4e Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister 70d2afb554015 netfilter: ipset: do not update comments from kernel-side adds e50eaba0b34be ipv6: fix prefix route expiry in modify_prefix_route() 6598215a1d8e2 net: bcmgenet: allocate RX buffers as page fragments ebc9611ab154c net/sched: cls_api: reclaim an empty proto on the error path 63120572edde8 net/mctp: publish the mctp_dev only after it is initialised 380acb097059c ARC: arch_cmpxchg_relaxed to use size of pointed type not pointer a85823b074f9f arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz b0fce76873a5e Bluetooth: btintel: validate DDC record lengths 8ba754621f105 Bluetooth: hci_core: free the HCI ID if naming fails 790730e4d95de blk-mq: set RQF_USE_SCHED when the operation is known 2e8f3fdb0825c blk-mq: factor out a helper blk_mq_limit_depth() c97ef13ad96be block: reject polled dio with user integrity metadata ed389554fe22c ASoC: codecs: rt274: Fix format setting for 44100 rate eb04ba7d97809 ASoC: codecs: rt286: Revert delay value for jack setup 88e96d902efee wifi: mac80211: prevent AP VLAN tx from other interfaces 227ebe48704be wifi: mac80211: Add 802.3 multicast encapsulation offload support 9f4e5abe6bf72 wifi: mac80211: Add multicast to unicast support for 802.3 path dd7973a4130b0 wifi: cfg80211: preserve hidden-group beacon IE ownership cfd70c9b19846 rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() 9cff19ddd7f90 rtc: ac100: Fix clock provider use-after-free on probe failure 00dc50cede967 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak 345ce265cf604 wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE e0c21130c1c77 wifi: ath9k: reject short WMI command responses 9a9467f7cc633 wifi: ath11k: reset ar->num_stations on hardware start 9338b2dea74cb wifi: mac80211: drop oversized fragments to avoid extra_len overflow f9d075fa9fba9 wifi: mac80211: remove RX_DROP f41735133943b ASoC: tegra: Fix ASRC Stream6 input threshold control 71d140099165d wifi: wfx: validate MIB read length before copying to caller 9091199beced3 ASoC: wm8903: Move the DRC QR threshold to the register that holds it b8cbeda043e47 of/overlay: don't create "//" paths for fragments targeting the root 7a46f1917b320 of/overlay: don't leak fragment references when changeset init fails 2222a8b7dfeb3 random: fix vgetrandom_opaque_params kernel-doc 541d61d59f19a nvmet: preserve device path on allocation failure f971f1c63cf71 mtd: core: call _get_device() with the master MTD 4c73c1859fa64 iio: accel: kionix-kx022a: Fix array boundary check 489e51034910f iio: light: rohm-bu27034: Fix error return 09a9a2a9548f2 iio: dac: rohm-bd79703: Do not allow writing SCALE 7899d0530b411 mm/damon/core: don't skip damos_adjust_quota() while esz is not zero 122b8541f511d random: vDSO: avoid call to memset() when zeroing reserved parameter 3f75da1e4ee69 ALSA: line6: reject oversized playback packets 84727facd8506 ALSA: caiaq: unregister the input device when probe fails 9cec23424c598 wifi: wlcore: Fix runtime PM leak in wlcore_remove() ad06f7312d3f6 vt: skip screen update for DEC alignment test on backgroup consoles 037d7e3ca5c59 vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() 233a2e190b128 vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF 90c29158159e4 net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone 7d2ff870f0cf1 rds_tcp: close NULL deref window in rds_tcp_set_callbacks dc87b56b43c91 mm/huge_memory: initialise workingset state before folio split 9ebb974773bfa mm: shmem: ignore sysfs configs for shmem forced collapse 7a1e8daeaa466 virt: vmgenid: set driver_data before registering notification handlers 0af47cb2575d4 virt: vmgenid: remap memory as decrypted 258310d59a82e module: fix lost error code from codetag_load_module() 512eaf01ffabf netfs: zero gaps in read-gaps folio to avoid writing back stale data 96c46c75b0d47 tpm: Disable TPM on null key name mismatch e701345d886e8 sctp: check RCV_SHUTDOWN after the sendmsg connect wait e0cabda9b6f4d rtc: spear: initialize IRQ state before requesting alarm IRQ 160619b387072 rtc: ac100: Assign .num before accessing .hws 37286a49cc744 r8169: disable EEE on RTL8168h/8111h 69ca64bbb5288 net/packet: prevent TX_RING byte count overflow c5f91098edee9 netfilter: nft_flow_offload: drop flowtable reference on init error path ba56d6f9f1a8d net: phy: aquantia: fix system interface type not updated in forced mode ed997f875d03d net: fix checksum offsets in skb_splice_from_iter() 0d1525fdcd335 of/overlay: only treat a positive changeset id as registered 7dc6a769153c0 of/overlay: put property on deadprops only after changeset add succeeds 42f6d682e0ab5 of/irq: Fix remaining refcount leaks in of_irq_init() f7ea1916e8a80 octeontx2-pf: Fix RSS indirection table size 6745fa65f4115 kprobes: Skip disarmed probes when checking optkprobe overlap c2733ea2c15a1 kasan: unpoison task stack below watermark only in generic mode 2ebeba4f9e815 io_uring/zcrx: requeue multishot receives stopped by a local resource 4e9e016c4f498 io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full 0c19a6c1d25fd HID: multitouch: stop the release timer from being rearmed on remove 97be6396817bd HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request 308db93de666a crypto: x86/aes-gcm - fix always true check for last AAD segment 88633025f20ba audit: fix exe mark UAF in kill_rules() 745e83328dd69 ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices 224b56b7c02b2 smb: client: close completed creates on compound wait errors 78e718c5aa146 cifs: Remove the RFC1002 header from smb_hdr f09875ff901e9 smb: client: close handle after create-context parsing failure 080573f419506 smb/client: pass cifs_open_info_data to SMB2_open() 7bdc4b7d99a82 smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() 605ef5bd74d02 cifs: on replayable errors back-off before replay, not after 178820984f2cd Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table 60ba99f910b76 ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture f44d5d3b7e344 neighbour: Annotate access to neigh_parms fields. 3b91cdacb16b7 neighbour: Use RCU list helpers for neigh_parms.list writers. df057d89e0cc2 RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr() b15c79fca2806 xfs: don't let memory failures leak blocks and kill repairs 70a7918fda54a smb: client: use finish_no_open() for non-regular inodes 677aeec9783c8 mm/execmem: make the populate and alloc atomic 7ad8b185dd7e9 selftests/mm: hugetlb-mremap: add setup of HugeTLB pages 22e82acec93a6 KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction 81e3f065a6485 KVM: arm64: nv: Fix life cycle of the nested_mmus array e18b8236c57fc btrfs: initialize inode mapping flags for cached inodes 725bd2f3c81d5 Linux 6.18.55 fa047f2a02500 bpf: Reject key-less BTF for hash maps 98fd50aaaeb2a rose: don't warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in state 3 5454ea6e22e7d rose: use timer_shutdown_sync() for t0timer teardown bcf4c43f797ce rose: guard rose_transmit_link() against a NULL neighbour 7d10439345e2b rose: keep the route needed for routing loop detection 6c401ae426e20 sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags d3c8fb7094c53 hfsplus: avoid double unload_nls() on mount failure 500c9259f5a66 mm/damon/core: fix unconditionally skip last region f6660e9a3e1e6 rust: net: phy: fix off-by-one bit positions in device status accessors d50418db3b862 Revert "rust: net: phy: fix off-by-one bit positions in device status accessors" c525772c304c9 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration 5fdc644a4fea4 RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr() 4a04ed9157581 net/sched: act_ct: avoid modifying shared unconfirmed ct entry 812c16a255e77 net/sched: act_ct: fix helper UAF due to extensions realloc 9ba16ce8f3faa x86/sev: Make vTPM SVSM calls preemption-safe e43d42bd711e7 x86/sev: Remove redundant ghcbs_initialized checks around __sev_{get,put}_ghcb() 524becfebcd0f x86/sev: Carve out the SVSM code into a separate compilation unit b2a9d6ff593b5 x86/sev: Add internal header guards 1cad4f235e150 x86/sev: Move the internal header 99607d955be3b perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints 7ba97aa16778e perf/x86/intel: Update event constraints and cache_extra_regsfor LNL edc0309282aab perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification 51199c793bc05 perf/x86/intel: Update event constraints and cache_extra_regsfor ADL 24e79508b237d net: ipconfig: bound DHCP option construction 8fbfa861dfd4f net: ipconfig: Remove outdated comment and indent code block bda487567d0b7 net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths aa4845a710ae9 HID: alps: unregister DualPoint Stick input device on remove 48c5c02bf6fde HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM d0f6244f4af44 PCI: Fix BAR resize for devices on a root bus 85b1112945f21 super: make iterate_supers_type() deletion-safe ccf96a4b8626a mm/hugetlb: do not dissolve gigantic pages without runtime support 2ab4b6815d10e mm/hugetlb: create hstate_is_gigantic_no_runtime helper 4cef512a955e4 mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish a56e5bcc43310 mm/rmap: allocate anon_vma_chain objects unlocked when possible fcbedba553a9c drm/client: fix restore of partially initialized client 933145e2bbb4c drm/client: Pass force parameter to client restore 0589706ace3bd drm/client: Remove holds_console_lock parameter from suspend/resume 817dd706ee616 drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc() 13f299763f6c0 drm/i915/quirks: Limit eDP rate to HBR2 on HP Pavilion Plus 14-ew1 97e40aa29c10c drm/i915/psr: Disable PSR2 on Xiaomi Book Pro 14 2026 as a quirk 66f814e8af462 drm/i915/psr: Fixes for Dell XPS DA14260 quirk 782b5210e89e7 drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk 5815329988acf i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL f42562dd027dc vlan: require the MAC header to be present in __vlan_insert_inner_tag() 241e67b60308c cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict d186e0171c8a4 cgroup/cpuset: Ensure domain isolated CPUs stay in root or isolated partition 8a64ac9f03fc9 cgroup/cpuset: Move up prstate_housekeeping_conflict() helper 438bf73ca9775 net: tls: fix silent data drop under pipe back-pressure 66a2179d02668 xfs: fix cursor and pointer handling when recovering iunlink buckets 86b17699bd0c2 xfs: fix blockgc group quota scanning when usrquota isn't enforced 930a9c1c321ef xfs: don't let hidden_space go negative in xfs_metafile_resv_init 09ebf777ad4e2 xfs: call xfs_dquot_set_prealloc_limits if we installed default rtb limits d46492fb8018d xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots 543bc5fd7d8ec xfs: fix rtgroup repair estimations 6aabf4f351cd8 xfs: check di_forkoff correctly in scrub f99c672471797 xfs: use the correct reservations for rtrmap/refcount recovery adb80d620dabe xfs: don't call xfs_exchange_range_finish for a dry run 770d21b52c91b xfs: check padding field in xfs_ioc_commit_range 09b7a63e11c7c xfs: use correct jiffies comparison function in xchk_maybe_relax 6a65a68097a19 xfs: release orphanage dir inode if chown fails ac76f8df55980 xfs: fix attr fork block count checks in xrep_inode_blockcounts ef7a56c6630ff xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption c2ac475ddd737 smb: client: validate POSIX create context length 31107f79ad33b smb: client: preserve create-context parsing errors abab661eed00f smb: client: clean up failed cached directory opens 05a7fd80024ff smb: client: fix create context out-of-bounds reads 8f5b30cc12c40 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO 416546cd6a54e Bluetooth: mgmt: fix race in read_unconf_index_list() c6a288e6001bc Bluetooth: L2CAP: validate frame length before control and FCS access ed4c026cc4094 Bluetooth: ISO: release unused CIS holds after channel attach 4e49206d9574a Bluetooth: ISO: balance the parent hold in hci_bind_bis() 173457fa3e99e Bluetooth: hci_sock: reject out-of-range OCF values f894f6292d512 Bluetooth: hci_sock: validate event length before filtering 3ff5a8d949e3a Bluetooth: hci_conn: fix CIS hold ownership on reuse 57ccaa818307b RISC-V: KVM: Fix HSM hart status error propagation 5567ce11304db RISC-V: KVM: Propagate interrupted G-stage faults ea91f05a55b80 RISC-V: KVM: Synchronize hrtimer callback during teardown e5dd2a91a7ae3 KVM: arm64: Transfer the hyp stack pages out of the host stage-2 970de111c0874 KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race c23ed110d27ba KVM: arm64: Fix spurious warning for benign stage 2 teardown race 8530a05b304d3 KVM: arm64: Fix AArch32 DBGBXVR handling 37dfb676fafd1 KVM: SEV: Do cache maintenance on the source VM during intra-host migration 6aef7cf800098 KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV 066a53a0bc19e KVM: Don't treat reserved xarray entries as having memory attributes 7dcaf0107523f KVM: Ensure memory attributes xarray nodes are accounted to the caller's memcg cf441a0db681d s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config af295f0eab683 s390/pci: Don't report recovery success on skipped recovery eef5c8e1cca6f s390/pci: Report SCLP status on error events when no pdev is associated 743a8458978d1 s390/pci: Fix missing device lock in zpci_report_status() dd5ed64dadb07 s390/pci: Fix leak of struct pci_dev reference in zpci_report_status() 748ec2f7f5df9 s390/cmf: Fix virtual vs physical address confusion c3bbcb32deecc s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() 02664a8d8d592 pinctrl: sunxi: keep a shadow copy of the data register output latches 1deeeca89ea12 pinctrl: single: free the IRQ on domain creation failure a23f9f9b56b79 perf/core: Run sched_task() for PMUs with only CPU-wide events 249a2bd87a0e5 perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() 5023c70853ad9 parisc: Increase kernel stack size to 32kb ee56b5e18f566 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU cc444e4ad4346 nfc: trf7970a: power down on startup RX gain failure 14b1467cfc663 nfc: port100: reject frames whose declared length exceeds the received data 810f204ef8f61 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() 841af260ff477 nfc: fix use-after-free in nfc_get_local_general_bytes 12cf803edfffe netfilter: nf_tables: skip expired catchall elements on insert and delete 191239b093969 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read eafe081ea77d2 netfilter: ip6t_rpfilter: reject routes without inet6_dev 8a611f33216f4 net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() 7d2377868feb7 net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist 43ff11501ea6a net: txgbe: fix FDIR filter restore for VF rules 9447ddd8b9242 net: phy: micrel: Advance register data pointer in write loop 30ff01b4c7e41 net: ena: fix MMIO read buffer leak on probe failure e8a2f48bbff1f net: ena: fix PHC cleanup on probe failure ab3c4a4c85f2e net: bridge: mdb: restart port group walk after deletion 4b7161804d8f3 net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read 586847400b116 net: atl1c: fix soft lockup on out-of-range tpd_cons read 5f23080a625dd net: openvswitch: conntrack: fix helper UAF due to extensions realloc caefcd433ecb2 net: openvswitch: conntrack: remove 'add_helper' dead code e2829ae5459dd net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry 729737267e7c1 net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() 0f573b0576252 net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read ba664d8363864 net: arp: terminate device name before lookup aca91d8fa0ecb net: airoha: npu: cancel wdt_work after releasing the WDT IRQ 968550a439f64 net/sched: reject IDR error pointers when deleting actions 3803dc8477f08 net/mlx5e: fix swapped IPv6 IPsec policy masks 0c336ecabaf9d net/mlx5e: advertise MACsec offload only when supported 99d8dc5166374 net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() c3129e6f26e18 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() 5695ec5339d4d HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard 925da1d2a2478 HID: alps: fix use-after-free on input2 registration failure eda9bcb721f15 packet: use ubuf_info completion for TX_RING packets 879c911f77b8a PCI: of_property: Omit bus properties without a subordinate bus e59cb7eda7c06 mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() 850cc4a84b36a mm/hugetlb: preserve mremap address delta when skipping page tables b1db1ec5c8941 gpio: tps65219: Fix TPS65214 GPIO direction programming ac3c7eb6a44ba gpio: tps65219: Use the variant-specific direction callback fabe897e61e45 gpio: tps65219: Fix GPIO input value reads f2f1683955b95 drm/virtio: fix NULL pointer dereference on fence allocation failure 8fa78900fd242 drm/virtio: fix memory leak of fence event on execbuffer failure c2d4689c3ea92 drm/xe: Keep walking on SVM eviction failure c306b6419fd00 drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV 2bcbfc5e7bfa9 drm/xe: harden adjust_idledly() against divide-by-zero and overflow ba678c2b02e0d drm/xe/vm: nuke PTs only after unlinking contested VMAs 19f5a5839b308 drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() 35151e9a82741 drm/nouveau: RCU-free the scheduler-containing nouveau_sched 59aa1f8c95941 drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() 030e93fc91d55 drm/nouveau: Fix gem reference leak in validate_init() 109a8d2d5b7d2 drm/nouveau: fix double-free in nvif_vmm_dtor 6d497216c10af drm/nouveau: Fix bridge reference leak in nv1a_ram_new() 9132215d2c90e drm/nouveau: fix autosuspend cleanup during teardown 0d29bf51f8ddd drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM c83261854e19a drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() c28e74395ab09 drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() 0bfb0419a1480 drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() d197b15d4beb9 drm/amd/display: Bump frame warning limit for clang builds of dml 89a11c7efe387 drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() fe933dda0bb18 drm/i915/dp_mst: Fix configuring TUs for a disconnected stream 369f4e3264374 drm/i915/dp_mst: Fix configuring FEC for a disconnected stream cc890d3f1b15b drm/i915: fix incorrect RCU teardown order bbef7450e2b42 drm/imagination: Fix page count for page table for map() interface afe5b4d66d45b drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() e2ee061626008 rds: ib: Clear the sg list when mapping an MR fails e35cb500dd148 mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() e06f8b6e27cc6 llc: reserve device headroom for allocated frames 58a417a19d801 gpio: zynq: fix runtime PM leak on request error path cf3d043582e10 gpio: cdev: fix kernel stack leak to user-space in error path a9f738487c11f gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() 6fcfc362344ed ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST 1d42828565889 ipv6: do not let ipv6_find_hdr() return an offset past the packet end 599d0498a3931 ipe: protect the dm-verity root hash with RCU 48f7d0233c3cc ipe: fix use-after-free when auditing a newly loaded policy c2a5e59185862 fsl/fman: Fix clk reference leak in read_dts_node() fd3bf32279df9 writeback: report a Tasks-RCU quiescent state per cgwb drain pass 1dccf5dc2f8fe workqueue: Fix NULL current_pwq deref in flush dependency check dd4b920672387 writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes 37ec7353f4ac4 fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga b1229b210ef5a fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT 2f7042429a8e9 cgroup/pids: Restore pids.events notifications in local mode caf8b2d9b30c3 crypto: s390/hmac - Generate intermediate CV for API partial block handling 7504b677c4370 bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir 4d97a141e85a0 bna: prevent IOC timer rearm during teardown 1603abb0c5042 ata: libata-scsi: bound the ATA passthru sense descriptor writes cdccb760be1f1 arm64: errata: match the target implementation CPU's own MIDR 071f51188a5d8 arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 6279211e7d245 af_packet: fix integer overflow in prb_calc_retire_blk_tmo() ec23855274a73 sctp: discard the rest of the packet on a stale-cookie error 7ba87509c54cd tcp: prevent collapsing skbs across boundary in rtx queue 12cc3a1eac5a2 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow ca40f4df4ab2f virtio_net: copy zerocopy frags in start_xmit without NAPI 33da1ff56f955 x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 f50d2e8cc1f1d x86/mce: Fix hardware debug register corruption on task migration a557816c6e38e netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase 7b32eba3fad84 rculist: add list_splice_rcu() for private lists 162bf5f73f1b4 mptcp: return sk_wait_data() errors from recvmsg() 9fe317b999aa8 sched/core: Account PSI IRQ time to the execution context, not the scheduling context 23250517cd475 perf/core: Fix a refcount leak in attach_perf_ctx_data() 654fc8445ca8d perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs() 0688289753450 perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused 8cb5a01cb5f12 perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED c205e3fc9962c perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits 4bcb371019097 autofs: fix sbi->pipe file reference leak in autofs_kill_sb() c7ee4bea64f55 vlan: ensure sufficient headroom in vlan_dev_hard_header() 7f8b56c82919c net/sched: sch_teql: fix shadowed err in __teql_resolve() 15d00994a1bd2 bridge: check llc_mac_hdr_init() return value in br_send_bpdu() 41dcae82bece9 llc: fix skb UAF and leaks on llc_mac_hdr_init() failure 2dc3ae3942e15 gve: DQO: reject TSO packets with an out of range MSS 089e04db44754 gve: fix TX drop when GSO MSS is too small for hw feab3880a72b4 gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO 2f855c52a2e1d gve: add support for UDP GSO for DQO format 6d4a5ce75b6e3 gve: Enable hw-gro by default if device supported adbfc707ff6b9 gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO 6c7937db1d561 gve: Allow ethtool to configure rx_buf_len bcaedb514a5d2 gve: Use extack to log xdp config verification errors a0d644b8ff883 gve: Consolidate and persist ethtool ring changes 5f86408eba31b net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails d990b786abfd6 tipc: Fix a data race on mon->peer_cnt in mon_timeout() 3d65a2eb4449f net/smc: fix UAF on lgr list traversal in smcr_port_err() 8468d05aa08dc nfp: hold IPsec RX state under the XArray lock 4e7a4af364c20 net: phylink: record the PHY only once bringup cannot fail 631aa4cb45099 tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() 2357c682f6eaf net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq 62c0e38b2e503 net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 2b42adf3b8ee9 macsec: initialize SecY before registering the netdevice dc106fe25e9a8 bonding: crypto offload enabled, non-offload slave failover, rekey failed e0560db0ea6e1 drm/imagination: clamp freelist reconstruction requests 2cc1c3977acbf net: xps: reject an out of range traffic class a3c5eb6e382dd vxlan: use one headroom snapshot for neighbour replies bdd41b96e8143 ip_gre: Reject enabling collect metadata through changelink c3fab2f1d8a6e net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT d68899b50caf8 net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr b3ebe8983d86f net: bcmgenet: do not skip WoL power up on GENET V1 21a0de4858779 net: bcmgenet: initialize u64 stats seq counter for all queues aefa837c26674 net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems 501baaeca7d12 net: stmmac: clear stale buf->page after recycling on skb build failure 0f7ed27586acf tg3: use random MAC address when tg3_get_device_address fails e40990861074a bpf: Fix BSWAP 32 and 16 on MIPS64 876ef04c75c27 bpf: Fix immediate JMP JEQ/JNE on MIPS32 6d76ddce4f1ba vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets cfa643f2ca36c net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() 25bb7c3622522 veth: manage XDP program pointers during channel resize 63bcc2fee6419 net: bcmgenet: stop Tx NAPI before disabling the queues 284166f34b8fb net/sched: act_gate: budget the per-entry list in get_fill_size e72cbedc4596e nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() 8978dff632519 nfc: llcp: fix slab-out-of-bounds reads when logging service names f234197f3bda3 nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() 2386d107df6d2 nfc: llcp: fix -ENOMEM on connect with zero-length service name fdd95e819d828 nfc: st21nfca: validate ISO15693 inventory length cbde7f5d32617 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure 0b32dcc8a3f94 nfc: virtual_ncidev: Add missing ioctl compat handler 27cf04ba4e7ef selftests/nci: Fix out-of-bounds store on thread join f9cbe5c68d93a selftests: nci: Fix uninitialized family ID on missing attribute da8a077573836 nfc: llcp: Fix race condition in accept_queue lifecycle 3316903fdc3a3 selftests: nci: Correct pthread_create return value check b94cf09720543 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() 57919d0662d88 nfc: st21nfca: validate received frame size ed2e00bb22c73 nfc: nfcmrvl: validate helper command length before pull 940b626854de2 bpf: Reject dev-bound-only programs on other devices 9923e1c537f91 net/sched: fix potential stack infoleak in em_text_dump() 92c9f2ea634d9 eth: fbnic: Avoid rounding zero ring sizes 3ea177bdba25f net: stmmac: selftests: Account for alignment shift on dwmac1000 for Jumbo test b17959fb4d55f net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K 4c4217aaa5e4b net: stmmac: selftests: Capture all packets for vlan checks e7a8bbb6149b4 net: stmmac: selftests: Check the dev->features for S-TAG offload testing 74da0c1cede8a net: stmmac: selftests: Support running selftests on DSA conduits d18cb8fd1b6ba sctp: hold asoc or transport before mod_timer() in timer handlers 650dcd938e563 net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports cdeca5de4e186 net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports cea597519b9ca bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc d95dd5a6c6cd0 bpf: Fix bpf_sock context code generation 1196903a27cac bpf: Fix bounds check for skb-backed dynptrs fb1e2df8e2e28 thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds 0f5d8953cb63a net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure 54e98316ce5c1 genetlink: report the real command id for dump-only ops in policy dumps 41e444535c60f net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error ca9986cc824f2 net: spacemit: clear TX descriptor on fragment mapping failure 9c6af88fbefbe s390/debug: Fix NULL pointer dereference in debug_info_copy() 36831afe8eba0 s390/debug: Do not register views for failed static debug areas 8b661a045082c drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable 6515c41503eef tg3: clean up PHYLIB resources on probe failure c21daf37d5ce9 udp: remove a disconnected socket from the 4-tuple hash table 7a0bbe5654ecb udp: relocate a connected socket in the 4-tuple hash table on re-connect ed902d5546fb9 ipv6: Fix dst leak for uncached routes. 6ab6c9d120b30 net: usb: sr9700: include receive overhead in the length check e3c21e8b53906 dpll: use exact lookup for reference sync pin id 649ffc76ed548 ipv6: Prevent rt6_insert_exception() for dying fib6_info. ff8cff3aff673 octeontx2-af: Fix memory scaling limitation in SR-IOV mode be00deee60044 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() 8ec5838a35b03 Bluetooth: btintel_pcie: validate device-supplied DMA indices 8f31031326994 Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough a8f3a829f3a53 ovpn: reject invalid peer VPN addresses 7efbc134253c1 ovpn: reject multipeer peers without VPN addresses daab972893aec ovpn: reject duplicate peer VPN addresses 12ee72319805a ovpn: always unhash old VPN addresses before rehashing c44a04722f7da ovpn: replace bind when clearing stale local source 21dbc9f4d0bdd ovpn: replace bind when learning local endpoint 324ebbde06cd5 ovpn: validate peer state before caching UDP dst db97cfe9a5070 ovpn: track UDP socket route key for peer dst cache ba3877bdcc9aa ovpn: skip UDP source validation for unspecified addresses 8c1d7994a18ec ovpn: preserve IPv6 scope id for netlink peer endpoints ebffd70e4877b drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach d6b59a9fece4d drm/virtio: sync shmem backing on guest-bound transfers e7df00bb036e0 Revert "drm/virtio: Allow importing prime buffers when 3D is enabled" 5c2cb3dd14477 drm/virtio: release the GEM object on virtio_gpu_vram_create() errors 81c6769e069d7 drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() b516446a25bf3 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() a93dce15dfef2 drm/virtio: fix object leak when drm_gem_handle_create() fails 0fa25ba50a382 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget cd12d3e086202 bpf: Check params size before reading reserved fields dd9c6f8f05170 net: usb: catc: bound the RX packet length in catc_rx_done() 9c11e543fec32 bpf: Bound ownership depth through local kptrs and graph roots c9338057df102 sctp: avoid livelock while updating retransmit path c7a254c16c6fb eth: fbnic: Handle FW mailbox completions flagged with an error a85a019b3011a eth fbnic: Add debugfs hooks for firmware mailbox 6a112552d3055 eth: fbnic: Reuse RX mailbox pages 8a052cd4b2cae eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox c5b5aee41b9f5 eth: fbnic: reset num_napi when the napi vectors are freed 6c903188b6761 eth: fbnic: Handle maximum standalone channels 8dc5667770912 ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). 7254b702e5561 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure 40aeafbcbc7bc net: gue: reject invalid REMCSUM offsets 00734f3684fce net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure ca29834c8c146 drm/nouveau/disp: don't reject HDMI config on cards without SCDC 40afa1f7a5c77 drm/nouveau/clk: don't clobber reclock status when restoring volt/fan 0d096a7f7d792 drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update f2e9005aadb67 ocfs2: make ocfs2_calc_xattr_init() return void b17aa4955e3a6 arm64: io: Reject non-user protection in ioremap_prot() 0994c3e3b4e3e netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name f100578039b31 ipvs: revalidate ihl before icmp_send 302477c9ffefa netfilter: nft_synproxy: use the family-aware checksum helper 07a3ec8fdc5a1 netfilter: nfnetlink_queue: hold nfnl mutex in event notifier b0ef9450e93f2 netfilter: flowtable: publish HW_DEAD after worker is done 1363c71be27a7 ipv4: fib: fix data-race and stale genid check around nh->nh_saddr 5be5ccd3a5563 libbpf: Reject truncated ldimm64 CO-RE relocations 2d7d04357c41a bpf: Restrict CO-RE poisoning to relocatable instructions 2fe1569e32ddf net/mlx5: devcom, Base component size on linked devices 8ebfd34fef750 octeontx2-af: use seq_file for rsrc_alloc debugfs 6127164efa94e net: pcs: rzn1-miic: Fix config array initialization f6696481eedfd net/sched: cls_u32: fix manual hash table handle IDR aliasing f4277b19edbc6 eth: fbnic: Fix payload page pool error cleanup 6e271f093d15d bpf: Skip unsettled links in link iterator b5c0cff0c5331 xsk: Use a 32-bit compare in xsk_map_gen_lookup e4f3e476cd406 fs: avoid repeated scans in evict_inodes() 22225cd612b26 s390/cio: Guard PMCW field accesses with dnv check 5eae708cca8f4 s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points 591ba131193ee s390/cio: Fix cio_update_schib() to not cache invalid schib 8bd9905dfbd97 s390/pci/docs: Fix sriov_numvfs attribute name e163f1dccede7 docs: s390/pci: Improve and update PCI documentation 6675f801b0d60 scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() 0117e731435bd selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode 2189a219397d8 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel 8a36598050cd1 Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump() 6fdabd654578e Bluetooth: SMP: reject Security Request over BR/EDR 9c051b12ca106 pinctrl: sunxi: A523: fix voltage withstand encoding 0af16d8be3ec7 scsi: sd_zbc: Reject disks with too many zones 0cb85377daaef squashfs: Add dictionary size range check to prevent shift-out-of-bounds 5d54693bc457c KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP cb68b5589318f KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0 4efda20408714 KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2 f126952167146 KVM: arm64: Include VM type when checking VM capabilities in pKVM bbcd7e851d57d KVM: arm64: Fix MTE flag initialization for protected VMs c142034ad3a84 KVM: arm64: vgic-v3: Fix GICv3 trapping in protected mode bd46b41f412fb KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure faf66e55e8749 KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() 65bffaf100df8 KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save 80a6b712dc193 KVM: arm64: vgic-its: Free the caches when GITS_BASER changes c2230cd149507 RISC-V: KVM: Fix perf-backed counter accounting across stop and read f6f1d27e0c893 RISC-V: KVM: Report snapshot write failure to the guest f4363eede3e74 RISC-V: KVM: Preserve firmware counter value across stop/start d6de766d8d26d KVM: riscv: Fix NACL hfence entry update order 5c221f33a5183 HID: bpf: fix __hid_bpf_hw_check_params report length 5f9e2ecb725ad HID: amd_sfh: Validate PCI BAR size before mapping 905d1a40f34f7 pinctrl: meson: Fix typo in s4 group name b67b4c763f211 bpf, arm64: set up the frame pointer for the exception callback ae1ffd04e98be bpf, sockmap: Fix self-redirect copied_seq double-counting 1d6581b544a88 bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk 51a17f0ce19c4 bpf: Register dtor for freeing special fields 6785313d4fac9 bpf: Fix out-of-bounds read of rtt_min in sock_ops 44f9bcb5ab2b2 bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() 5ad116c23f149 KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() 08a4d55b26724 HID: elecom: fix bus type for M-XGL20DLBK 49688a0d1ac69 HID: multitouch: Add report ID mismatch quirk for ASUS ROG Z13 Folio 55bbebf2829c3 tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context 91a482a81eabd bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() 8eb4cd72daad3 bpf: Fix divide-by-zero in btf_struct_walk() 5334c609bf927 selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc 37b18688cd18f bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL 69fe51a3bd78d bpf: Fix bpf_skb_change_tail wrt csum partial skbs 04bb5b2eb9f1d s390/uv: Prevent potential out-of-bounds read 018e137ac1da2 s390/uv: Fix loop condition in uv_find_secrets a379ac504fcb8 KVM: s390: Fix IRQ injection with SIGP Stop and Store Status 7c7a6ba6128f2 remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage 50d844aead62c ALSA: hda/realtek: Add StarFighter HDA SSID 56b321df2863d ALSA: hda/realtek: Limit Star Labs internal mic boost 2945d3eb73d61 drm/amd/display: Atomize IRQ register read/modify/write ops d1079deec828d erofs: fix large folio race in erofs_fscache_req_complete 14ae74db795ab xfs: don't stash removename operations with unknown ftype Signed-off-by: Bruce Ashfield Signed-off-by: Richard Purdie (cherry picked from commit e5e96e09fcd99cd92fa30d57545eb986daf3d953) Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.18.bb | 6 ++--- .../linux/linux-yocto-tiny_6.18.bb | 6 ++--- meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++---------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb index ac97f340da1..9690d312b8b 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb @@ -15,13 +15,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "64ebedd888ed53620df352f568a8b55c5620d169" -SRCREV_meta ?= "b505aeae4f62715ec4801e292b32ad68593b3341" +SRCREV_machine ?= "f87ce4ad0a7f6290a8fd961a63fd1653c7308a14" +SRCREV_meta ?= "5978c5f530b91cfb62213506ee6f157897432ba3" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.18.54" +LINUX_VERSION ?= "6.18.57" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb index 4cbcfc0084c..939ca9c5b83 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb @@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc include recipes-kernel/linux/cve-exclusion.inc include recipes-kernel/linux/cve-exclusion_6.18.inc -LINUX_VERSION ?= "6.18.54" +LINUX_VERSION ?= "6.18.57" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" -SRCREV_meta ?= "b505aeae4f62715ec4801e292b32ad68593b3341" +SRCREV_machine ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" +SRCREV_meta ?= "5978c5f530b91cfb62213506ee6f157897432ba3" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb index 95cae43557d..ce4878d0f27 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb @@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base" KBRANCH:qemuloongarch64 ?= "v6.18/standard/base" KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta" -SRCREV_machine:qemuarm ?= "f271f5b5cce5f2c67c00ccb5b4bf60502d4ddc0b" -SRCREV_machine:qemuarm64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" -SRCREV_machine:qemuloongarch64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" +SRCREV_machine:qemuarm ?= "3881e81dea81f6aea84ea28b22899708f3fef903" +SRCREV_machine:qemuarm64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" +SRCREV_machine:qemuloongarch64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e" -SRCREV_machine:qemuppc ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" -SRCREV_machine:qemuriscv64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" -SRCREV_machine:qemuriscv32 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" -SRCREV_machine:qemux86 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" -SRCREV_machine:qemux86-64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" +SRCREV_machine:qemuppc ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" +SRCREV_machine:qemuriscv64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" +SRCREV_machine:qemuriscv32 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" +SRCREV_machine:qemux86 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" +SRCREV_machine:qemux86-64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4" -SRCREV_machine ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9" -SRCREV_meta ?= "b505aeae4f62715ec4801e292b32ad68593b3341" +SRCREV_machine ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" +SRCREV_meta ?= "5978c5f530b91cfb62213506ee6f157897432ba3" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "1b357ecb321392158d507b04672ffee57bfa071d" +SRCREV_machine:class-devupstream ?= "2ff600d29ee478d0a8d46ef8a58afb5e038fe692" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.18/base" @@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.18.54" +LINUX_VERSION ?= "6.18.57" PV = "${LINUX_VERSION}+git" From patchwork Wed Nov 11 09:02:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103724 Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5598.1794387842053212075 for ; Wed, 11 Nov 2026 01:04:02 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=gGp9Tbus; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-4afe2d546f9so37386015e9.3 for ; Wed, 11 Nov 2026 01:04:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387840; x=1794992640; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=twWFDxrvfh4z9M8lYteLYYmq8MqqUIWO9tSrEDAaxco=; b=gGp9TbusSG1sYGEpN3vWBwDi9xjCTXqAcMC7GQCSSbQaKbSwKUnxnXIYvF9jOJD356 TCTDFJA3bcfn8oBVXLNeySOyTauyyiZ4wllk421dSqpijSE4DOva8YKRx8nEeppD98eT WXYE/VE9FId3zI0wt7SkMFI1zu7cLrUbQG3VIL3K1uws2LF4DkotDoG2NMPnWRzhyMCQ F0c/5XpEi+0myiS4njwMW8d/q49Ik0iXYwZkP3OmvLlIJLtHwSVjHsJ7p5s7vbIkTf+x Q3yB7U5kGAfQ3oKby+ChExWVgFNH8EP/dkjm/sVvkKhTPs2zzeVXmfU737R7l7PdZzY0 hURw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387840; x=1794992640; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=twWFDxrvfh4z9M8lYteLYYmq8MqqUIWO9tSrEDAaxco=; b=wc4qVOIWfuCDTL10k63VmCTDQNrgNfq+PP802xnc2flpZiv3Yi1Gs0TL6IfXVIqMVB /fYcjjAVV7rlB8Sln3RPsh2sZGvs6ly9mjyy9V35NjasYJLlZw0Ap9em84xHal5gZOAM ZaHgtzzO9b0remFUBggNS5IVoQt/AE/oVV/i0nnIhJRi0rfreZ4v63oHgzR3qpdMGqP0 nTwFl5EBu5QbKFXNRvc7ZAHmlkc60t2tlz9faTnPHBUkTmzRPbBZFS3frA0iu6GYJwrY hvTneaNdgC4VW0F1WWEebi3604bt3Ti5s6EYNnunng/a/ZcxhoSsVSO/1oaPGE0xT4LL qxeA== X-Gm-Message-State: APuU4Z+QltROAiz7A3uFIPx2Sp1/BCg0j+EJCsZhE/J7TJg/vLrG29tT WkwiM7OhW50f8bcFA58840S0pdMbcnGBAQG4wKNcIU514HKUo01YqQ1+INxzquhbuGd/qy1rMiR XCRjTiLs= X-Gm-Gg: AYBFou3fbmiSD90WdlxrP367BSrfTZvEBTlw4KRzv2GzEmGbYR64s+WlFeZHScR1DfU vnSKyzonl1O0CaamRAMEn8Qhgcegm4hh17aKjbnaqhynrHJREeiotbXa2oHq20x/iDKR4QGTI98 0AbfiAMw4oGfUZ6b2GziYOmAUNGW34OhD26GQbWztJ4A4eBEQ3IZA1K6M6vifn7Z2oW61THJnNS DVgbKjb42jRU9CPKWMtsr9dpXCeXzoDYavDsz796wRqXtyG33TCMmdx2pn3ZhUBHgwsshRrFZuz m0Kzh+nlKEIu6W7aNoQDNd6zvaUPO+07jM54xnw4KFdgoGfVWC90Z3IkRk3lR2mnQ3PeIkb1mqn vUvJTTeV7b12Wg8QvA8+kSVWCdDh2bxef4YItAzUTIUabzeWZjyb0bIG8bPGw27rU+awfiFvNLv mXFHQDwh/ZQrdzRB61H5VLf91dpySuSbEOwxpljp6XsMOAd0uIGE1F2DmE8MCwXdhBW35ZsWIXg 2cJg5km05Dz7zFuSb8TZk4k5bTuZOJsSokhukM9o3WpwnIYoRSTRmn/UCz4OA6lTM40yVZykWok GHtiv0b59CZM31wtwVzmwAwtOlJlKDok45LQhQWF3qJfAF+2PpHWFyAxIpEicVg3TJ+6gNwj+u8 EgQ4sGmvErNriYTV2r/meZfTIXn9p X-Received: by 2002:a05:600c:3b86:b0:4a1:df52:3e36 with SMTP id 5b1f17b1804b1-4ba0939aef5mr33365035e9.27.1794387839845; Wed, 11 Nov 2026 01:03:59 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.03.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:03:58 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 32/35] linux-yocto/6.18: update to v6.18.59 Date: Wed, 11 Nov 2026 10:02:58 +0100 Message-ID: <60bd401f04e37549de563ad3d3566c10c68fea08.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:04:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/250004 From: Bruce Ashfield Updating linux-yocto/6.18 to the latest korg -stable release that comprises the following commits: 1253a6aa5d104 Linux 6.18.59 9a5d65b06dc33 smb: client: drain outstanding I/O before truncating on O_TRUNC open a4c584ea79d95 ice: fix crash in ethtool offline loopback test 9f158a9b10e1e ice: fix broken Rx on VFs f4a25618c3683 ice: switch to Page Pool 0026267561bc6 ice: drop page splitting and recycling c8bd04221f6a8 ice: remove legacy Rx and construct SKB 4d143608a0445 smb: client: fix data corruption with concurrent writes and O_TRUNC c027f8b429dbb vsock/vmci: validate packet source for connected sockets ecd7ead4bf05e ipv4: udp: Create exceptions before socket matching 6cd829de69efd vsock/virtio: validate packet source for connected sockets 569c34a35fbc9 virtio: set skb owner of virtio_transport_reset_no_sock() reply f320b85c90fe5 workqueue: Fix unbound pool lifetime for pending pwqs 299912bbc6455 workqueue: release pwq pools by pool type 94d13387b96e5 io_uring/cancel: don't spin on local work the task can't run 7123c79206e49 io_uring/cancel: move cancelation code from io_uring.c to cancel.c 76cb14d6f1433 io_uring/cancel: move __io_uring_cancel() into cancel.c 755e88e78beaf io_uring/cancel: move request/task cancelation logic into cancel.c de477667b890b cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() 242c7b3a71ddf smb/client: refresh allocation size after duplicate extents 8d891c218016b sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ 6ac46ae5ac561 drm/amdgpu: free the userptr ranges when a CS fails after parser_bos 2058a1fe791bb tracing: Keep the predicate limit separate from program capacity 07180a910e9d0 tracing: Fix ignored return value of resize_buffer_duplicate_size() a425e1c687595 sched_ext: idle: Respect task affinity in restricted CPU selection dfcfe2874e7c1 drm/i915/dmc: Harden DMC firmware payload parsing c8b1a48404679 ntfs3: free the sbi after a grace period d977b979081ef fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super() 129b0a64fe9ac ntfs3: fix double free of sbi->options->nls and clarify ownership of fc->fs_private e0ab437276575 ntfs3: fix use-after-free of sbi->options in cmp_fnames a1647b653549f scsi: st: Fix use-after-free race between st_remove() and st_open() d2f591e6c7304 smb: client: fix multiuser mount with krb5 d96f3365ce61c smb: client: fix heap overflow in cifs_do_set_acl() 45e60747a9db2 net/sched: cls_flower: validate mask pointer after nla_next() 898cb4f2e12a5 ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in d8c450ad0d089 ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION beba2ef6f66a7 ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION a9f14ea73e82d net: psp: do not inherit the Rx association on clone 8243d587a081e net: bridge: mcast: don't truncate the port group walk on teardown 80d5db1686b05 ext4: free the sbi after a grace period cad63a7798d6a ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture c17cc2027773e futex: Fix mm reuse handling for FUT_OFF_MMSHARED dce8f7f03a47b drm/amdgpu: keep the eviction fence until the last handle is closed 0caeefed99b37 KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes 7786dde1b5001 KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots dc29c0478b856 netfilter: nft_byteorder: remove multi-register support 61f376654fb9d drm/amdgpu: Fix VCE 3 ring align_mask d49fa454c2869 KVM: SVM: Stop toggling virtual VMSAVE/VMLOAD on intercept recalc 5dac5c7ba8f5f ipv4: avoid divide by zero in fib_rebalance ba5001db9bb23 s390/pci: Fix leak of uninitialized kernel data in SCLP report 34fa3607b7604 s390/ctcm: Prevent XID null dereference 813a72beaa5d3 page_pool: keep frag_offset aligned for odd-sized requests 40507f59f230d sctp: validate chunk length in the inqueue parser b8b7d28dc2b74 tipc: protect node reset trace dump with node lock f7e82f72b90ce workqueue: Annotate cb_lock nesting when draining a dead BH pool 6b26b3d39904c workqueue: Use raise_softirq() to trigger softirq in irq_work handler b6a0e5faf0dca netlink: specs: add missing mask attributes for conntrack dump 62ed32a1d4499 netlink: specs: fix the conntrack filter type e20e6b14e3b5c xfs: fix zoned write iomap flags assignments 19a1a22029ad3 xfs: fix capability check in xfs e5456dec79c71 xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf 8f2efa742f4cf net/iucv: fix the recvmsg window update 3cdd8b1abddeb mac802154: fix data race and NULL deref on local->assoc_dev c8922e7afb058 dm-integrity: require stable writes for internal hash modes fc512700f1413 dm-integrity: fix infinite loop on discard with large tag size 40791f07bad61 dm-ebs: fix incorrect device offset check in ebs_ctr() ac5d887ab9359 dm-crypt: fix a tiny race condition in crypt_dec_pending 73df2ff409f3d dm cache: fix issue with background work locking de9e8e587c07b dm cache: fix demotion stats in passthrough mode 04d020b3d0b58 cifs: don't update i_size in cifs_do_truncate without a cached handle 2f9dd8214d421 cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children 86814e5370068 tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) c1804ef016392 tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) f641066b0ddcd wifi: p54: validate firmware record lengths 09c7cce2e59e6 tracing: Fix hist trigger timestamps for buffered events 813e18881c647 tracing: Do not initialize tracefs work if tracing is disabled a866a8a753922 tracing: Check operator stack capacity before pushing 7c0c6d88a232a tracing: Take trace_types_lock when dropping the buffer_meta reference c4918c28b1baf tracing: Fix the shift out of bounds in the log2 histogram modifier 3a3c4503ba1b4 drm/xe: Bump LRU for external objects on exec and rebind ef82b4d5cb4a3 drm/i915/dmc: Add sanity check for DMC load address 22fd3f760845f drm/i915/cx0_phy: Fix ARL-S host bridge detection 96d9996e5dbcf drm/exec: don't immediately add prelocked obj to array of locked objs 07002a326c7cc drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES 652b1f26125fe drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr 05507b9b19f95 drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang 6cfc4a25d4f02 drm/amd/pm: add zero fan stop temperature support on smu 14.0.2 55a65ef61e277 scsi: libiscsi: Validate the task named by a management response 7215a69b6456f scsi: libiscsi: Validate the ITT reflected in a Reject PDU 6cadfa6f1f589 scsi: libiscsi: Reject a negative task index from parse_pdu_itt 1d91ec793d6c8 scsi: xen/scsifront: Check for a NULL shadow entry on a backend response 2effbe746452c scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies 029770f5baded ring-buffer: Fix false warning in ring_buffer_map_get_reader() 2f1248b728b56 ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() 8512d0312cc0e ring-buffer: Do not show buffer_meta for CPUs without a buffer 29469305a9390 perf: Update cgroup time when rotating multiplexed events b67fb3955b07d perf: Track the perf mlock gift separately 5d476bb76b7d7 i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() d2cb4d7451491 i2c: qcom-cci: Fix HALT_ACK reset request being dropped 1f36e4ddd05d5 tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields 13735c2cf4849 tools: gpio: fix building from the top level with O= 77a63d1b813b0 sctp: revalidate output stream after association connect wait 6232e93c3036c pinctrl: amd: Clear S4 wake bits when firmware has _AEI 5f23e4e3a31da net: rds: fix uninitialized trans dereference in CM event handler 2465d27ef90de net/sched: fix use-after-free in __tcf_action_put() 568323cddd54f lib/crypto: poly1305: Use memzero_explicit() in poly1305_final() ae6584eaaa4f1 lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state 492c10662177f namei: test for a negative dentry the way traverse_mounts() does 4586ef24ce390 eventfs: Free the eventfs_inode after an rcu grace period too 2e10b8a74f55b pid_namespace: make zap_pid_ns_processes() freezable 952501bfc6e5e fsnotify: prevent mark additions during connector teardown d00d5f534a823 KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry b77e9622bbade x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context 811fb6d0b0760 watch_queue: Fix note pool publication race in watch_queue_set_size() 2b54d3c971a1e unicode: free the map after a grace period d518fc5cced10 bootconfig: give the footer size static_assert a message 1a177064f501e autofs: ignore notification errors from a replaced pipe debb0f36bfe3d afs: free the super info after a grace period 5078c91f5c84b accel/rocket: search every core slot when a core is removed 7249a442ab261 PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV 7595bacee48bc printk: Postpone kthread startup 3eb08f09bfb36 perf: Fix perf_pmu_migrate_context() leaving events behind d0ffb0dc01166 gpio: mxc: fix race between gpiochip registration and IRQ domain setup 238f93bd1d063 gpio: mxc: fix wakeup_pads bit operations dab5c228a8468 gpio: mxc: use BIT() macro 911f606dd05d7 gpio: mxc: fix both_edges bit operations 261802c14e1a3 gpio: mxc: fix race between chained IRQ handler install and probe completion 78189c0e35abb gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths 1c9fcfca51e3c calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() e221a7d6f7c91 net/ipv6: Introduce payload_len helpers 40c04abcbc34e net: bcmgenet: unshare the skb before writing the control block bdd55b8a8acbf netlink: avoid hashing the network namespace pointer c9fb89246d992 scsi: libsas: Fix SMP IO deadlock during HA resume fbb5a6f0b06fb tracing: probes: error if BTF is required but unavailable 4c42ce499ce4b pipe: preserve existing fasync readers on writer setup failure 7780f9e828da0 samples: pidfd: fix userprogs typo 04d4571c00db6 ocfs2/dlm: Protect the recovery list during debugfs reads de3923caf0772 drm/panthor: fix immortalis condition 9b07828b133b3 scsi: target: iscsi: Fix race in discovery auth updates 71e12d43ef37e scsi: st: Save the visited block for the partition the drive is in e3bf250a2fda6 nios2: fix __wsum type degradation in csum_fold() e4d45c651d19f spi: tegra114: assert CS GPIO for every transfer in a message 21f41b6daf0db drm/xe/oa: Zero OA buffer at allocation 6046bb9cb2859 drm/xe: skip eviction of a BO with no resource 8d15821aa2de1 ASoC: amd: yc: disable MSI on resume efe1393e783f2 net/mlx5: HWS, fix flow meter offset within its bulk a3516f0704b96 net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool 79071b67182e1 accel/rocket: clear rdev on device init failure 06791594274f8 netlink: reset skb headers before unicast and multicast filtering 4a9fb8122a19d regmap: Drop map lock during cache init and exit bae057687f615 regcache: Do not overwrite error code when finalizing cache after error b498b70a8174b regcache: Add ->populate() callback to separate from ->init() 0a9a172d4cbfc ASoC: nau8822: Fix the 128x oversampling switch bits 9a87917b8f3d5 ASoC: wm8978: Fix the 128x oversampling switch bits 9b1a72628f125 ASoC: max98371: Fix the Speaker DHT Min Volume bits 384e00dd8908b ASoC: pcm3168a: Fix the DAC zero flag polarity bit db3a7a70cc214 ASoC: cs42l52: Fix the NG Type Switch bit 856ecf3c600af ASoC: cs42l56: Put the Limiter Cushion control on the limiter register 4528f8d38d893 ASoC: stm32: spdifrx: fix synchronization state check d3239b8f4fc46 ASoC: Intel: avs: Reset the stream unless it is already prepared a7c7d0ff87637 net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure c2c5359ef2c33 vsock: treat TCP_CLOSING as once-established fb5fb74fb4fff gpio: nct6694: Mark the GPIO controller as sleeping 6b03e354526f6 drm/vc4: hdmi: Move packet RAM enable to PM runtime 47b725c17dcb2 pinctrl: sunxi: dt: do not accumulate npins across probe attempts 9d0508bcf6743 pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12 2ac0256a28e15 power: supply: core: prevent unregistering a power supply while a callback runs dda0df37aabd8 power: supply: generic-adc-battery: Fix temperature IIO channel conversion 06e3e6dc2688f tools/power turbostat: Fix add_counter issue if > 24 counters. f573d257aad5a tools/power turbostat: Fix PMT error path fd handling b2af180dbc5f5 tools/power turbostat: Fix CWF PMT off-by-one e2c86984ccc0b tools/power turbostat: Fix fd_perf leak on reset e76e6284de2ba pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13 54e54a690bf13 pinctrl: qcom: qcs8300: Fix intr_target_width f47ce27af80b8 Drivers: hv: Don't reset VMBus connection state on error/exit paths 2b561786c9076 x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() 7141331f2d245 Drivers: hv: Avoid infinite retry loop in init_vp_index() c3e5854b2e8b6 power: supply: ds2780: Fix ds2780_get_capacity() returning raw value 7de3a5a49410a power: supply: Fix maintenance charge table kernel-doc ea9c08c33d57c ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition 0992d03e55e5a soc/tegra: fuse: Add missing newline to APBMISC error message 07fa8baa78d64 kho: free phys_bits bitmaps using free_page() in __kho_abort() 96d2abaa2e328 i2c: qcom-geni: Restore the source-clock selection policy cd3c05651d04b rose: purge rose_neigh->queue on final teardown 6b450cf6dd419 ax25: bound REJ-driven fast retransmits with the existing N2 counter c7bdc88b27cc6 ALSA: ctxfi: Use correct DAIO type for da_desc fb5e2dd6565a9 ALSA: ctxfi: Rename SPDIFI1 to SPDIFI_BAY 7fca3600e79e9 ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization b48ebe399b4e7 drm/ttm: fix swapped-out resources never leaving their bulk_move range 2926d88bb7fc4 Linux 6.18.58 2566780c684c9 KVM: x86: Use active memslots for the per-vCPU MMIO cache 517404e157395 ksmbd: fix heap out-of-bounds write in krb5_authenticate() 88c7c3aa8d0ff wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses" 5c0940abe76c9 bpf, sockmap: Account for receive queue in FIONREAD without a verdict program 8b7748e9904f8 kho: free chunks using free_page() instead of kfree() a6d84b420a848 io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK e46794d1936ca io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK 314b72d5e8273 rose: hold a reference on incoming sockets queued for accept() 30ec3025b7715 USB: iowarrior: fix use-after-free on disconnect race e8ed9a1dfc74f usb: iowarrior: remove inherent race with minor number c24d2e190b955 selinux: allow multiple opens of /sys/fs/selinux/policy 93a7f297362de mm/damon/core: fix damos_walk() vs kdamond_fn() exit race 7e54ed8a780c8 mm/damon/core: cancel damos_walk() before damon_ctx->kdamond reset 7ea3850b9ce00 xfs: close crash window in attr dabtree inactivation 4b963fddf470f xfs: factor out xfs_attr3_leaf_init 50144efd23ad9 xfs: factor out xfs_attr3_node_entry_remove 0f39d936a3493 ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec() 265ca3f6524be ima: Access decompressed kernel module to verify appended signature 7d6fd50746482 fat: stop reading directory entries past the end-of-directory marker f6c1e709a4f91 cifs: fix time_last_write stamp placement in setattr/truncate paths 2efa187fd4c9b drm/xe/i2c: cancel the client work on remove 97e736000731f scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() ee01d48f0f086 scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock() e36bac5923a3b scsi: ufs: core: Add debug log for MCQ command timeout d12c834b97c36 scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe() a34a230ccea1b scsi: ch: Do not keep references to data transfer element devices 8176ec7e36987 scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ 9e8fc7972b398 riscv: patch: fix handling of bpf-jit execmem addresses 420bf39a22a73 riscv: patch: Avoid early phys_to_page() 08275dcfbfc3b net: mana: reserve RX buffer headroom to fix forwarding performance eececf7c3a679 net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop cc7732b8549ec Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex 638ee6bca1975 sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler 454b67fcc28c1 dm-integrity: validate the superblock on resume 2e25842f0e442 dm-integrity: fix NULL pointer dereference when the 'R' flag is used 0c9d4f9c66ca7 wifi: mt76: connac: tolerate inactive BSS deactivation 22732b0f290ac nfsd: fix all-zero stateid in CB_OFFLOAD for async COPY 0c5595cba7224 mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge 5720bf6b91295 mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP fdf4f011c6004 iavf: send MAC change request synchronously 5aa9efb559174 iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test b030fde644501 drm/amd: Create a device link between APU display and XHCI devices 2d06cb25a497d ip6_gre: remove obsolete ERSPAN PMTU update 903a2ab8325a2 PCI: dwc: Return -EIO from dw_pcie_wait_for_link() if device is not active adc0d81b4d415 PCI: dwc: Return -ENODEV from dw_pcie_wait_for_link() if device is not found e32aa1d85126e RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables 3c03f6f7c6f2d usb: gadget: f_hid: Add missing error code 7820bca8cb207 spi: mpc52xx: clean up interrupt handling Signed-off-by: Bruce Ashfield Signed-off-by: Richard Purdie (cherry picked from commit 5d1656b394fb5c06269ff9251e1dd0b4a93b7821) Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.18.bb | 6 ++--- .../linux/linux-yocto-tiny_6.18.bb | 6 ++--- meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++---------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb index 9690d312b8b..cf6ed368c53 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb @@ -15,13 +15,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "f87ce4ad0a7f6290a8fd961a63fd1653c7308a14" -SRCREV_meta ?= "5978c5f530b91cfb62213506ee6f157897432ba3" +SRCREV_machine ?= "582762f4ac66e79c16b088b3fbb5a67a57a15d88" +SRCREV_meta ?= "cf1eb35154969907fb08e980fe6d1881c97d6a97" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.18.57" +LINUX_VERSION ?= "6.18.59" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb index 939ca9c5b83..d117eb8a205 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb @@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc include recipes-kernel/linux/cve-exclusion.inc include recipes-kernel/linux/cve-exclusion_6.18.inc -LINUX_VERSION ?= "6.18.57" +LINUX_VERSION ?= "6.18.59" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" -SRCREV_meta ?= "5978c5f530b91cfb62213506ee6f157897432ba3" +SRCREV_machine ?= "0aa9c16e54e9a318d97bae25e0082d7807186232" +SRCREV_meta ?= "cf1eb35154969907fb08e980fe6d1881c97d6a97" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb index ce4878d0f27..f579bacf7ac 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb @@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base" KBRANCH:qemuloongarch64 ?= "v6.18/standard/base" KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta" -SRCREV_machine:qemuarm ?= "3881e81dea81f6aea84ea28b22899708f3fef903" -SRCREV_machine:qemuarm64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" -SRCREV_machine:qemuloongarch64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" +SRCREV_machine:qemuarm ?= "5d45ccb59e84ed3f8071c55eeba225af3d8ff987" +SRCREV_machine:qemuarm64 ?= "0aa9c16e54e9a318d97bae25e0082d7807186232" +SRCREV_machine:qemuloongarch64 ?= "0aa9c16e54e9a318d97bae25e0082d7807186232" SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e" -SRCREV_machine:qemuppc ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" -SRCREV_machine:qemuriscv64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" -SRCREV_machine:qemuriscv32 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" -SRCREV_machine:qemux86 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" -SRCREV_machine:qemux86-64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" +SRCREV_machine:qemuppc ?= "0aa9c16e54e9a318d97bae25e0082d7807186232" +SRCREV_machine:qemuriscv64 ?= "0aa9c16e54e9a318d97bae25e0082d7807186232" +SRCREV_machine:qemuriscv32 ?= "0aa9c16e54e9a318d97bae25e0082d7807186232" +SRCREV_machine:qemux86 ?= "0aa9c16e54e9a318d97bae25e0082d7807186232" +SRCREV_machine:qemux86-64 ?= "0aa9c16e54e9a318d97bae25e0082d7807186232" SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4" -SRCREV_machine ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0" -SRCREV_meta ?= "5978c5f530b91cfb62213506ee6f157897432ba3" +SRCREV_machine ?= "0aa9c16e54e9a318d97bae25e0082d7807186232" +SRCREV_meta ?= "cf1eb35154969907fb08e980fe6d1881c97d6a97" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "2ff600d29ee478d0a8d46ef8a58afb5e038fe692" +SRCREV_machine:class-devupstream ?= "1253a6aa5d104312bf0992afacc15220ae35bdf9" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.18/base" @@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.18.57" +LINUX_VERSION ?= "6.18.59" PV = "${LINUX_VERSION}+git" From patchwork Wed Nov 11 09:02:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103721 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5620.1794387844323256124 for ; Wed, 11 Nov 2026 01:04:04 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=CpFIO55S; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-49d05d51553so20267265e9.2 for ; Wed, 11 Nov 2026 01:04:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387842; x=1794992642; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=KiKSqOXprLhPi+pSOgpcE3FL1MS8ogHSKKvfw30OJls=; b=CpFIO55SvbB2kw5pvFRR1OuewWZi19iBjuOFtCMP/WcGzQSy5SctHCvOcnKAKse1+C KSI0FN5ePEK7jODYpoy2Dgzu4PG+hAuzutDbEFM30qummm1l/c4iEHzuuzRYa1KVC3tw tu4Ws5Jbq+WSfp8ReNE4YaqV9Umw2Um444HVSehB9PvsrRs2CzJx0CnKbkqNmwtuM/Ax PebOLwLyFZ7od0YJrAfGj8/lQwWf7ltmVEJDRdeYtudddfRzT78ShOF1ufGZkrHcZVb8 +9QzJXJLdGCGhNoLhF6+eBH0lG8Juw2tWUPg5MHWjW6X1jNYH4SRRlGy2YQq/VewD+Ao cPVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387842; x=1794992642; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=KiKSqOXprLhPi+pSOgpcE3FL1MS8ogHSKKvfw30OJls=; b=LyGp3TDTyRPOasLGDRpELcsjnYqG+DVo/ZHrHeLDwWB6rGP5uMgD5VPAzRg2rN25A0 pAV2KAyRzWcaznslrxgZxUS40w0H2EBkzykecdjHsyBolI+JvaEWiE+yFx1+g3AihUu9 SaX7VRj793nvzuB1DCPrteB8PrpiH1D0JXSiIncnC6isAENPj953Zx6cch3fXykDYHNa App061XmqU5SumlgcwH6LFmO/1MaWZS9FVaTZzBudUijn5tZwr187TlnmVaTZaA/cKFy fnq5mk/NUYdrZjiJdUqCxaWliI+s+QsgR2BfeHYbogvm7WwamePZ2BEaJ1wUCWyzgmDW PGqA== X-Gm-Message-State: APuU4Z9DwId+VMWXfb0nIOZ9/RvCP/KA97bjJx+sTlqAiayAjny75bKs pSH5Eq/i1JT4DNihk1fihpS3zRxUVEsH1PmkUhrq2Gj0bB+wmnLqh3viRxExVfRrG3E1419Yn42 4Xei+rww= X-Gm-Gg: AYBFou1lRfOnD4znU2pNITbboI8ERXjiuZ8I+gErGcf6SGHHEVuhmP+7Nxw3Fayu5qL L4ukptq6PIloa4drC7WrP6OyqK+w+21CdlDa7PwpQOaHJNEWBqabJiZzwu9JxcS4PIjOFvmuBp+ IgfkTNmkBN2I88EsHHtdk4kqdykpxcO0r57lufpj4BAJV2H138PDjkJDxd9lRsSOUqMTtfXKyRd qHZY2kBa8db/nO8DVtP2l5TCqXzcA9rQ8W4gPQ3jemCIL7G2t6eM/3SEy7RNEJctZ+Nj+5HBiWL rs/Wz3ap5layidb4O+Wiji1O2SY0m/Okizy22rMuBn/xNA2Sl/baN63fOJTelnA06xvXhAWub8L jUd4JCufr+ENtEBOGuaVwWk6BKVZqlQkqTqVQrqiOHpgnnmdrcDB53QuK10U9ZEIlDZo3W2N2Qc RDPkLY53j0mDLmias0PmK1o9sOTGJLTFCoMui7FdRefCaOQXugQ22J00rkINJ3oDjBf0kpm+ACJ oL5hPivVXaWUieE+59ss8C9lapPCZGR5GLfSr33j0Nu3MFdET2jnx6yQTD9BZZuxMkCkXT8Cwbs k0IaMHgX9fNFMb4dRQ7nYozlz3rWbi6xp/JU/qO1YWKIH9SWiTsA/CusMlE3WCRo2Ogb8vpF3l7 MJQ+FQ7l0/KhlQNsQABO7mlPSrJ62 X-Received: by 2002:a05:600c:310e:b0:4a5:1cf1:b7bd with SMTP id 5b1f17b1804b1-4ba09383147mr26993005e9.16.1794387840840; Wed, 11 Nov 2026 01:04:00 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.04.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:04:00 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 33/35] groff: build less in groff-native Date: Wed, 11 Nov 2026 10:02:59 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:04:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/250007 From: Ross Burton When building groff-native we only really need enough of groff to build manpages, and don't need documentation or extra tools. Patch the Makefile to stop building the doc and contrib directories, which both take time and have incomplete build dependencies that cause intermittent failures[1][2]. This makes groff-native faster to build: groff-native do_compile -30.6s -33.7% 90.9s -> 60.3s And some tools are removed, which I don't believe are needed by anything we build: /usr/bin/chem was removed /usr/bin/eqn2graph was removed /usr/bin/gdiffmk was removed /usr/bin/gperl was removed /usr/bin/gpinyin was removed /usr/bin/mmroff was removed /usr/bin/pic2graph was removed /usr/share/groff/1.24.1/tmac/chem.pic was removed /usr/share/groff/1.24.1/tmac/hdmisc.tmac was removed /usr/share/groff/1.24.1/tmac/hdtbl.tmac was removed /usr/share/groff/1.24.1/tmac/mm was removed /usr/share/groff/1.24.1/tmac/mm/0.MT was removed /usr/share/groff/1.24.1/tmac/mm/4.MT was removed /usr/share/groff/1.24.1/tmac/mm/5.MT was removed /usr/share/groff/1.24.1/tmac/mm/ms.cov was removed /usr/share/groff/1.24.1/tmac/mm/se_ms.cov was removed /usr/share/groff/1.24.1/tmac/mmse.tmac was removed /usr/share/groff/1.24.1/tmac/mm.tmac was removed /usr/share/groff/1.24.1/tmac/mom.tmac was removed /usr/share/groff/1.24.1/tmac/mse.tmac was removed /usr/share/groff/1.24.1/tmac/m.tmac was removed /usr/share/groff/1.24.1/tmac/om.tmac was removed /usr/share/groff/1.24.1/tmac/refer-mm.tmac was removed /usr/share/groff/1.24.1/tmac/rfc1345.tmac was removed /usr/share/groff/1.24.1/tmac/sboxes.tmac was removed [1] oe-core d1a02bdd242 ("groff: Fix occasional build race failure") [2] https://bugzilla.yoctoproject.org/show_bug.cgi?id=16279 Signed-off-by: Ross Burton Signed-off-by: Antonin Godard Signed-off-by: Richard Purdie (cherry picked from commit 9deeb7474b2586eb031e4f00a644aed9ccf8cb19) Signed-off-by: Yoann Congal [YC: For [YOCTO #16279] ] --- .../groff/files/build-less.patch | 24 +++++++++++++++++++ meta/recipes-extended/groff/groff_1.24.1.bb | 8 +++++-- 2 files changed, 30 insertions(+), 2 deletions(-) create mode 100644 meta/recipes-extended/groff/files/build-less.patch diff --git a/meta/recipes-extended/groff/files/build-less.patch b/meta/recipes-extended/groff/files/build-less.patch new file mode 100644 index 00000000000..dc560fbb309 --- /dev/null +++ b/meta/recipes-extended/groff/files/build-less.patch @@ -0,0 +1,24 @@ +Build less bits of groff to save time and reduce random build +failures from missing dependencies in this logic. + +Upstream-Status: Inappropriate +Signed-off-by: Ross Burton + +--- a/Makefile.am~ 2026-05-15 13:23:08.000000000 +0100 ++++ b/Makefile.am 2026-05-15 13:29:17.053867035 +0100 +@@ -556,15 +556,0 @@ +-include $(top_srcdir)/contrib/chem/chem.am +-include $(top_srcdir)/contrib/eqn2graph/eqn2graph.am +-include $(top_srcdir)/contrib/gdiffmk/gdiffmk.am +-include $(top_srcdir)/contrib/glilypond/glilypond.am +-include $(top_srcdir)/contrib/gperl/gperl.am +-include $(top_srcdir)/contrib/gpinyin/gpinyin.am +-include $(top_srcdir)/contrib/grap2graph/grap2graph.am +-include $(top_srcdir)/contrib/hdtbl/hdtbl.am +-include $(top_srcdir)/contrib/install-font/install-font.am +-include $(top_srcdir)/contrib/mm/mm.am +-include $(top_srcdir)/contrib/mom/mom.am +-include $(top_srcdir)/contrib/pic2graph/pic2graph.am +-include $(top_srcdir)/contrib/rfc1345/rfc1345.am +-include $(top_srcdir)/contrib/sboxes/sboxes.am +-include $(top_srcdir)/doc/doc.am diff --git a/meta/recipes-extended/groff/groff_1.24.1.bb b/meta/recipes-extended/groff/groff_1.24.1.bb index 24b8146a727..dd5ebee3df2 100644 --- a/meta/recipes-extended/groff/groff_1.24.1.bb +++ b/meta/recipes-extended/groff/groff_1.24.1.bb @@ -15,6 +15,8 @@ SRC_URI = "${GNU_MIRROR}/groff/groff-${PV}.tar.gz \ file://builddep.patch \ " +SRC_URI:append:class-native = "file://build-less.patch" + SRC_URI[sha256sum] = "74e2819795b6aff431aeac983d63a9c8968eeaba2a2eba7df8ba4c7b41e7cfd8" DEPENDS = "bison-native groff-native" @@ -65,8 +67,10 @@ do_install:append() { rm -rf ${D}${bindir}/grap2graph rm -rf ${D}${mandir}/man1/grap2graph* - # strip hosttool path out of generated files - sed -i -e 's:${HOSTTOOLS_DIR}/::g' ${D}${docdir}/${BP}/examples/hdtbl/*.roff + # strip hosttool path out of generated files + if [ -d ${D}${docdir}/${BP}/examples/hdtbl/ ]; then + sed -i -e 's:${HOSTTOOLS_DIR}/::g' ${D}${docdir}/${BP}/examples/hdtbl/*.roff + fi } do_install:append:class-native() { From patchwork Wed Nov 11 09:03:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103725 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5599.1794387843217832333 for ; Wed, 11 Nov 2026 01:04:03 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=STunBhWh; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4a207b02a2cso20232815e9.1 for ; Wed, 11 Nov 2026 01:04:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387841; x=1794992641; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Xj6XdMSlRC3sM5M6MaSPjS6M+wbYOUhekz+7gfWsUpA=; b=STunBhWhP1kPxc6vZWb2Pz66ZClUQyUvFwDoMt1mo5Cr7ty2/YwY9KjQxpi5NntFQk dJAxN2VLmdVGjt1uz7rYM0DWIgrgk3iTRUPDxL3t6vqmYMrncSYOXocK0p4HQiGicrYX CUj3W+ddOP5OFNcHXd54Tt8JQcTRXXLOB2js8hZNhOQ/lU5e5ux8cCg2jIP//3tDqaz/ 6A0t0LTWvVMEUR1QRfTmpQ8V/hvfn14xCCOTPBncY08iraMEmNeDsuZX9LUG44xnfqhX /tubPWyGPbE7gaoK57A/eRFYsW94bSoIEuK4p0l0Eb145eacDc51By6m3tGh/UkLylpy D8OQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387841; x=1794992641; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Xj6XdMSlRC3sM5M6MaSPjS6M+wbYOUhekz+7gfWsUpA=; b=fLaPQ/IEAFitcL/xRSI4sEjiK2Gd/UGNwTkmsE9EI83whdGNSRZF3yTtdtRMbSdRD4 m4pHdV3xbTXExwfygc0bCh6HntGrBJ9Km5ErbUBfVQA4wm4DzFuC76qtmCZYCmLXfA0R N+DL3zlNlKvlz2RMglRQXFLVz4IorrZJSu646pRZP6BC2OBq2ZKF0KPn4HNgyLAgmVQl wJ8atwJrXoSGPpE920tAygEMf7D7puvlC16Gs8fHx4niCBRK3wOA1VhrrgO+4nSwiclf qbJ5ZVseayLEOl2UTNOh/M9DnvISz0ORE+xla0mvvw8ALgwpWbliNoiU8xgNYgUhtrVM CGow== X-Gm-Message-State: APuU4Z/leA63ctndtlKT4YhlFEGte/YuyoYlAK/X6QEhyeNVZ5w/Xvgx jtoEqUMGer/KLCk7AjUyp4Xh6FDt3EJPBpUOMWcCHniat2fEDUheVCldnBuOtVNT9KhWhA4YlQ+ 7bneWtNM= X-Gm-Gg: AYBFou2L8zo+TDKF/MB8ze29pzVIUO0aXlmomB2Fk+FSWKLcsxJ0sjZiUtE+rHwPePP YkI7hQL8V5aMBhuilxnrNeLzqK5IvzqV1oQVG1Dn/nIQdBOWAFLkqv+5nIo4D3jWYQYhp+b32sv A4kNKhLmMwH0fawtkVO9RoXqGlFYX4ojzuK3pAfo/2+azOoFWhfVnNSKLaY1w3YMrGOvQ+L86yT EF5K6avreosFgssUCTn8ANgaLSDg7+tR5az29mbTk0Nt6OSXv0isCl/7FG1DVOEVu8fQXMswsgO NF3ub7oo6rkyQiphspjgEZe8Sv01CSdLBC1w7dnB952M8lEGH2wyPbz6R4SZvEdy6GLaAzUAKbI RnrLRv3zFmiaZR1Tz3zFS+1pMcNs45zqVaRJgZXZGIyP6kW99APkRGknHNwGp8qAD1icIJANhod mqOz+taBn7MOPgJ0tupzUagkPHqblhB3QWkRq5t5kpBqJsWwazEj6NVwsZLt75sFFnnb7nWLEYr +vC/oBCa4XjuHIoNx6Y83Tb8jsF5rQtnLLoh6pV1imSXH1ckvILEekjhUPO78jQ9/RSBZ/hhfPI yVeVN8cKHY/oHQ0sl9xgYJvCFjICaRAISS9WRt9SW+cvEBtiGCK1ISvBHuACi7ZA0JdU+7p3x/7 odRB+M6WYVGVuMVavJpycEyFUUrsP X-Received: by 2002:a05:600c:3b01:b0:4b7:6942:39be with SMTP id 5b1f17b1804b1-4ba0939b4c7mr28456985e9.24.1794387841399; Wed, 11 Nov 2026 01:04:01 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.04.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:04:01 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 34/35] scripts/install-buildtools: Update to 6.0.4 Date: Wed, 11 Nov 2026 10:03:00 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:04:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/250005 From: Yoann Congal Update to the 6.0.4 release of the 6.0 series for buildtools Signed-off-by: Yoann Congal --- scripts/install-buildtools | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/install-buildtools b/scripts/install-buildtools index e1af05fca33..bc044f9b308 100755 --- a/scripts/install-buildtools +++ b/scripts/install-buildtools @@ -57,8 +57,8 @@ logger = scriptutils.logger_create(PROGNAME, stream=sys.stdout) DEFAULT_INSTALL_DIR = os.path.join(os.path.split(scripts_path)[0],'buildtools') DEFAULT_BASE_URL = 'https://downloads.yoctoproject.org/releases/yocto' -DEFAULT_RELEASE = 'yocto-6.0.3' -DEFAULT_INSTALLER_VERSION = '6.0.3' +DEFAULT_RELEASE = 'yocto-6.0.4' +DEFAULT_INSTALLER_VERSION = '6.0.4' DEFAULT_BUILDDATE = '202110XX' # Python version sanity check From patchwork Wed Nov 11 09:03:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 103726 Received: from mail-wr1-f51.google.com (mail-wr1-f51.google.com [209.85.221.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5600.1794387843948047892 for ; Wed, 11 Nov 2026 01:04:04 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=CafyIaml; spf=pass (domain: smile.fr, ip: 209.85.221.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f51.google.com with SMTP id ffacd0b85a97d-48e47347279so1879458f8f.1 for ; Wed, 11 Nov 2026 01:04:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1794387842; x=1794992642; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=U+yNf/4v7RSY6SMYGIY5LGyO1XOiGiLjESzag45ZgP4=; b=CafyIamliYrZ3ZpV9kZnI2J9rgKpYBS8NeIEy2CpBqmOQ+Hw4azcUjk3QZmCp97K+Q p2HuoHzmHjrf/Yx3IZ4L7uG8d/LORMqK28FXRsXoUv+94S2DwNuGhD0rEF0MThY3BTOO aUQcso0ZzYlL5MJWTidNYnrQb8fUG2sPjhEnbJWl2EtryXEw5QhBuZQ791MSgtlinjwp ywCgtKHm3yBK76Uk+HI+WalTiss92UKMiCuLPPtfU7oj6TGEaEhr6LeVh1186/2MZo02 9kC93LVggqB00k8+URRoL2bbNCcKiPfbT6PdWtfOl0BHnbbrUmPI5TLzLmNR+3LTIRqP HiFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794387842; x=1794992642; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=U+yNf/4v7RSY6SMYGIY5LGyO1XOiGiLjESzag45ZgP4=; b=jfMxIQtsuAl2LdXzW8i8TgQ5A5k9kLDKuj0bFDOxQMhHSKFpOTFx6NzX+YNwGnLRGD QN3x5IQQzaG7ou38HLEBRnnvoQSXh7Zc1rdmHwebyIFqUlUWM2clnyc+rYX8433A3uMN VKq7eBDNXPQC/YDD72QSFs/ffzSwhVfnQfXN+F0LHwbdjRhKcZsZXgIVrIRI+ouH+JjQ ukRawJRJpw7X9DOFNw/Q8PEdIbuV1u2mJZlYqJdvNFL08bnhsS9AvebLzwu9tW14f6BS RD1uqXwDjwpUl517NKhUNHkpZF9sirdVb7SGXqeuUbSn4DQQ9hY8vbzlTyzWlP+NTIQU Ha4Q== X-Gm-Message-State: APuU4Z/1MMLSgLeUn3g8xHMaN/JFX5NKealB7ybXkc0dhk+7ePBSFKkQ LCmXsD8o/5mFix2Y6e04NVKhzETsc8+C9vXNdMY8WSeGFn4lAciVb2zxbR4Ig2LRiKG/eYUoOtY asb1su9s= X-Gm-Gg: AYBFou0cqSQXmxMzuJtgw1jYfiA8UM/CdXEZAqi6n9T6oP/zgnCmUjIFlWPDxZ/fmom txBpYryLhvtf+FeFjKHQM1GNcL/tMysFpYoABZUJDVzBY1RJjLjNHZBhE3f/yBWXj2MdXvtWIrY G/8iJEWZpq5fs8ic7f7IJZ99+jOCTgYgYIqjxTC+1pbk3Lyl+n2V3hIFAB421Z1GqOkM5bU/KXO NvyapcHUsgAsKHc+iGgNEsJuWtsJOYyJIjMPM8cuuzUpe6tsnhUTuYLeyLUULPnZXoIobgRr/Ki HDq6OETkoebdLQFk29qDQJJbUcu9O6MnZktaDOZvkqnd0Q/ozGAFKgJ9MnmPkkoC0fyeH69mmOd FPDjlOpIU7RWF+Sq2R4yFHyn1rPGThVyfQp6zkq5UUiheAeKZd/QBtfdDzeOmsCgZz8rqi9jC9j CHYMRYtxKTtqvcpp/qzdo45ImSydr57Dv9Ysja5Srgjt+HDoaRuww4kG4eL1lFncGW8CA/x+3ul pw/8ygh/hmQHvffQ113DPCB+3EcN4T+euMv+SsUU+x5Mzo78LNIBTVH8k0v6eg08hhUuPev50To sKEPP4ZP+6sSuWb/PGhpqJ4Utsqsc6IBQKTcYExICfVkqazfe+vgM2uT/Q3Rii3jDyQuv4itBGa Y6eOV9Y8j8iNtKluR6jX9UbA6iPul X-Received: by 2002:a05:600c:4e41:b0:4a3:59c9:a754 with SMTP id 5b1f17b1804b1-4ba0939db52mr29096295e9.22.1794387842064; Wed, 11 Nov 2026 01:04:02 -0800 (PST) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ba01fe9357sm147623675e9.9.2026.11.11.01.04.01 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 01:04:01 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 35/35] populate_sdk_ext: Fix locale error handling in SDK Date: Wed, 11 Nov 2026 10:03:01 +0100 Message-ID: <33a6bd6cc8a9a976902081642414bd67adc74879.1794387482.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 09:04:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/250006 From: Richard Purdie During automated testing we occasionally we see the error: "ERROR: the installer requires the en_US.UTF-8 locale to be installed (but not selected), please install it first" This is puzzling as the locale *is* installed. The use of -q with grep in a pipeline is potentially problematic as grep can exit early and cause a pipefail/SIGPIPE. Tweak the code to avoid it and a few other issues (add quoting, handle the "." correctly, match a whole line). [YOCTO #16198] Signed-off-by: Richard Purdie (cherry picked from commit f290e76eef3bd175f71414b7f78aafd0af5e0ce2) Signed-off-by: Yoann Congal --- meta/classes-recipe/populate_sdk_ext.bbclass | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/classes-recipe/populate_sdk_ext.bbclass b/meta/classes-recipe/populate_sdk_ext.bbclass index 071cf959e7e..990113d1798 100644 --- a/meta/classes-recipe/populate_sdk_ext.bbclass +++ b/meta/classes-recipe/populate_sdk_ext.bbclass @@ -678,7 +678,7 @@ sdk_ext_preinst() { fi # Check setting of LC_ALL set above canonicalised_locale=`echo $LC_ALL | sed 's/UTF-8/utf8/'` - if ! locale -a | grep -q $canonicalised_locale ; then + if ! locale -a | grep -Fx "$canonicalised_locale" > /dev/null ; then echo "ERROR: the installer requires the $LC_ALL locale to be installed (but not selected), please install it first" exit 1 fi