Since Buildroot commit [1], util-linux libuuid is failing to build
with uclibc toolchains, when there is no thread support
(that is, when BR2_PTHREADS_NONE=y).
Builds are failing with error:
libuuid/src/gen_uuid.c:83:10: fatal error: pthread.h: No such file or directory
83 | #include <pthread.h>
| ^~~~~~~~~~~
This failure is due to the upstream commit [2], which introduced the
pthread dependency.
This commit fixes the issue by adding package patches, disabling
the uuidd cache in case the libptread (or the pthread_atfork function)
is not available.
Fixes:
https://autobuild.buildroot.org/results/e5856cf6f3b8512ededa17d20db2b330a478dd8e/
[1] f14929c657
[2] 25bd5396ab
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8489cb0932)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When glibc was bumped from 2.39 to 2.40 in commit
74cb378aff ("package/{glibc, localdef}:
bump to version 2.40"), the IGNORE_CVES entries should have been
dropped, as they were applicable to the 2.39 branch. Drop them now.
We did verify the pkg-stats output, and those CVEs don't show up as
affecting glibc even after this change, as expected.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4b133efbd3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Take a patch from meta-riscv, which was submitted upstream by Khem Raj
to fix a build issue on RISC-V 32-bit musl configurations. This issue
has been discussed with musl developers who believe this is a Busybox
issue. The patch from Khem works around the issue by making it a
runtime failure just affecting hwclock on RISC-V 32-bit musl instead
of a build failure. The correct fix is not really clear, as there
seems to be a disagreement between Busybox people and musl people on
what the C library settimeofday() function should do, and that's why
Busybox is bypassing settimeofday() on musl by making a direct system
call, except this system call doesn't exist on RISC-V 32-bit.
In the mean time, this patch fixes the long standing Gitlab CI issue:
- tests.toolchain.test_external_bootlin.TestExternalToolchainBootlinRiscv32ilp32dMuslStable
https://gitlab.com/buildroot.org/buildroot/-/jobs/8954291684
- tests.toolchain.test_external_bootlin.TestExternalToolchainBootlinRiscv32ilp32dMuslBleedingEdge
https://gitlab.com/buildroot.org/buildroot/-/jobs/8954291683
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a956eeb96b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit adds patches, which were all backported from upstream, or
submitted upstream, and that fix various CVEs. To facilitate the
backporting work, we took the backports from openembedded-core.
CVE-2021-42380: this one is not marked by NVD as affecting 1.36.1, but
its fix was merged after 1.36.1, so it seems like the NVD data is
incorrect. Therefore, no need for a BUSYBOX_IGNORE_CVES entry. Patch
is upstream, backport taken from openembedded-core.
CVE-2023-42363, CVE-2023-42364, CVE-2023-42365: patches are upstream,
backports taken from openembedded-core.
CVE-2023-42366: patch has been submitted upstream but not merged,
patch taken from openembedded-core.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 75c594d446)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
cuserid is deprecated and breaks the compilation on some new toolchains.
This patch fixes this issue.
Fixes:
#81
Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a141b117e0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
It fixes an arbitrary file overwrite vulnerability in the readline.sh.
(CVE-2024-54661)
see - http://www.dest-unreach.org/socat/contrib/socat-secadv9.html
README hash changed due to version update.
Note: Buildroot is not impacted by this vulnerability as the
readline.sh is not installed on target.
Quoting changelog [1]:
Mitigating factors: readline.sh is usually neither installed in a bin
directory nor is it documented. Major Linux distributions install it in
examples/ or doc/; however it is invoked by test.sh script.
[1] https://repo.or.cz/socat.git/blob/refs/tags/tag-1.8.0.2:/CHANGES
Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
[Julien: add note that Buildroot is not impacted in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d70df3ab44)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issues:
7.2.6:
- (CVE-2024-31449) Lua library commands may lead to stack overflow and
potential RCE
- (CVE-2024-31227) Potential Denial-of-service due to malformed ACL
selectors
- (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern
matching
7.2.7:
- (CVE-2024-46981) Lua script commands may lead to remote code execution
- (CVE-2024-51741) Denial-of-service due to malformed ACL selectors
https://github.com/redis/redis/releases/tag/7.2.6https://github.com/redis/redis/releases/tag/7.2.7
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f3e99436ee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security vulnerabilities:
Worker permission bypass via InternalWorker leak in diagnostics
(CVE-2025-23083) - (high)
With the aid of the diagnostics_channel utility, an event can be hooked into
whenever a worker thread is created. This is not limited only to workers
but also exposes internal workers, where an instance of them can be fetched,
and its constructor can be grabbed and reinstated for malicious usage.
This vulnerability affects Permission Model users (--permission) on Node.js
v20, v22, and v23.
GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) - (medium)
A memory leak could occur when a remote peer abruptly closes the socket
without sending a GOAWAY notification. Additionally, if an invalid header
was detected by nghttp2, causing the connection to be terminated by the
peer, the same leak was triggered. This flaw could lead to increased memory
consumption and potential denial of service under certain conditions.
This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.
For more details, see the announcement:
https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
Update the LICENSE hash for a an addition of the (MIT licensed) nlohmann
JSON library:
27bcd103e7
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15891236db)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The commit 6889056f1e (support/scripts/genimage.sh) adds support for
creating bmap images.
Since then, the script genimage.sh looses the error returned by the
genimage command.
As a consequence, the target-finalize target looses the error as well,
and so on up to make.
This adds the shell option -e to exit immediately if a command ends with
an error, so the error is not ignored.
Fixes:
gportay@archlinux ~/src/rtone-br2-external $ make
(...)
>>> Executing post-image script support/scripts/genimage.sh
INFO: cmd: "mkdir -p "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp"" (stderr):
INFO: cmd: "rm -rf "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp"/*" (stderr):
INFO: cmd: "mkdir -p "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp"" (stderr):
INFO: cmd: "cp -a "/tmp/tmp.EclKGwtA4R" "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp/root"" (stderr):
INFO: cmd: "mkdir -p "/home/gportay/src/rtone-br2-external/output/images"" (stderr):
INFO: vfat(efi-part.vfat): cmd: "mkdosfs '/home/gportay/src/rtone-br2-external/output/images/efi-part.vfat'" (stderr):
INFO: vfat(efi-part.vfat): adding file 'efi-part/EFI' as 'EFI' ...
INFO: vfat(efi-part.vfat): cmd: "MTOOLS_SKIP_CHECK=1 mcopy -sp -i '/home/gportay/src/rtone-br2-external/output/images/efi-part.vfat' '/home/gportay/src/rtone-br2-external/output/images/efi-part/EFI' '::EFI'" (stderr):
Disk full
INFO: vfat(efi-part.vfat): cmd: "rm -f "/home/gportay/src/rtone-br2-external/output/images/efi-part.vfat"" (stderr):
ERROR: vfat(efi-part.vfat): failed to generate efi-part.vfat
INFO: cmd: "rm -rf "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp/"" (stderr):
make[1]: Leaving directory '/home/gportay/src/rtone-br2-external/buildroot'
gportay@archlinux ~/src/rtone-br2-external $ echo $?
0
Signed-off-by: Gaël PORTAY <gael.portay+rtone@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 294d13bb85)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issues:
- CVE-2024-56826: A flaw was found in the OpenJPEG project. A heap buffer
overflow condition may be triggered when certain options are specified
while using the opj_decompress utility. This can lead to an application
crash or other undefined behavior.
https://access.redhat.com/security/cve/CVE-2024-56826
- CVE-2024-56827: A flaw was found in the OpenJPEG project. A heap buffer
overflow condition may be triggered when certain options are specified
while using the opj_decompress utility. This can lead to an application
crash or other undefined behavior.
https://access.redhat.com/security/cve/CVE-2024-56827
Release notes: https://github.com/uclouvain/openjpeg/blob/v2.5.3/NEWS.md
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3bfa5ebcbf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When the Xen tools are built, a number of init scripts are installed to
the target.
Some of those Xen scripts require bash to run:
- /etc/init.d/S50xencommons
- /etc/init.d/S50xen-watchdog
- /etc/init.d/S60xendomains
- /etc/xen/scripts/launch-xenstore
- /usr/lib/xen/bin/xendomains
Make sure to select bash when the Xen tools are selected (we need to
select "busybox show others" for that, too).
Suggested-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Alistair Francis <alistair@alistair23.me>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bf18fd4cd1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
For change log since 20240927, see:
https://github.com/user-attachments/files/18117996/changes.txt
Note: the change log mention "Fix 2 critical CVE addressing memory
leaks" without providing actual CVE numbers. For reference, the
upstream commits for those security fixes are [1] and [2]. From the log
of those commits, it seems those memory leaks can only happen in old
Kernels <= 4.9 (which is end-of-life since January 2023). Technically
those leaks could happen in any program embedding the apcica code
files. The impact seems very low, if any, on the acpica standalone
tools.
[1] 987a3b5cf7
[2] 8829e70e13
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 892e1608f5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The ARC toolchains from Synopsys unfortunately are not "pure"
toolchains: their sysroot no only contains the C library, but also
additional libraries, most notably libncurses and libexpat.
This confuses Buildroot, and causes build issues, and is anyway not a
supported situation. Until the toolchains get fixed, let's mark them
as broken.
Fixes:
http://autobuild.buildroot.net/results/38766332c391ce97a566c6e2255a947e6074152b/
(and possibly a number of others)
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 11a8cdd2bb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following vulnerability:
CVE-2024-56374: Potential denial-of-service vulnerability in IPv6 validation
Lack of upper bound limit enforcement in strings passed when performing IPv6
validation could lead to a potential denial-of-service attack. The
undocumented and private functions clean_ipv6_address and
is_valid_ipv6_address were vulnerable, as was the
django.forms.GenericIPAddressField form field, which has now been updated to
define a max_length of 39 characters.
The django.db.models.GenericIPAddressField model field was not affected.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c87726dd33)
[Peter: Mark as security bump, add CVE info]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The legal manifest currently stores the $(PKG)_VERSION variable.
However, that variable undergoes a set of changes so that it is
suitable for creating files and Makefile rules; that new value
is purely a technical, internal detail of how Buildroot handles
things.
In the legal manifest, we need access to the real value for the
version, as this is what will allow actual references to the
upstream package. If the version string is mangled, like slashes
replaced with underscores, this introduces ambiguities as to what
exactly the version is.
In Buildroot, there is no package, with a constant version, that
exhibits that issue; for those packages where it is possible to
set a custom git tree and version, like linux or uboot, such a
custom tree can have tags with a slash (not a colon or a space,
forbidden by git); packages in a br2-external can also use such
version strings as well.
The packages that do have such versions are not legion, but they
do exist. For example, Apache's ant buildsystem does use a slash
in their reelase tags, like rel/1.10.15:
https://github.com/apache/ant/tags
Change the legal manifest to include the actual, original value
as was set in the .mk file.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Luca Ceresoli <luca.ceresoli@bootlin.com>
Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 686694792b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since commit d10d22221f (utils/get-developers: read patch from stdin
when it's not a tty), get-developers accepts to read a patch fromn its
stdin when it is not a tty.
Add a test for this.
Reported-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 29e1af8430)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
get-developers will check its stdin to decide whether it is a tty or
not, and behave differently whether it is or not. So, when we run the
tests, we need an actual tty.
However, when running in a CI pipeline, like on Gitlab-CI, there is no
tty available on stdin.
Fake one. We don't need anything too fancy, so just a slave pty will
suffice.
Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/8830671800
Fixes: d10d22221f (utils/get-developers: read patch from stdin when
it's not a tty)
Reported-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3778f704cd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The gnu-efi code base is so far built with -fshort-wchar:
‘-fshort-wchar’
Override the underlying type for ‘wchar_t’ to be ‘short unsigned
int’ instead of the default for the target. This option is useful
for building programs to run under WINE.
*Warning:* the ‘-fshort-wchar’ switch causes GCC to generate code
that is not binary compatible with code generated without that
switch. Use it to conform to a non-default application binary
interface.
However, this is highly incompatible with the definitions of wchar_t
by musl, causing build issues:
/workdir/instance-0/output-1/build/gnu-efi-3.0.18//lib/console.c:84:68: error: passing argument 2 of 'ConOut->OutputString' from incompatible pointer type [-Werror=incompatible-pointer-types]
[...]
/workdir/instance-0/output-1/build/gnu-efi-3.0.18//lib/console.c:84:68: note: expected 'CHAR16 *' {aka 'int *'} but argument is of type 'short unsigned int *'
These have been addressed upstream by simply not using -fshort-wchar
anymore, so we backport the relevant patches.
The patch 0003-Use-char16_t-literals.patch was directly backported, it
was "redone" (it's a very mechanical patch) as backporting the patch
and fixing the conflicts was more effort than redoing the patch from
scratch. But in essence, it is the same patch as what is upstream.
Fixes:
http://autobuild.buildroot.net/results/8b2f5b38284e70dde8c5619e5050e7f201a0bcc3/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien: fix patch 0003 EOL modified by the mailing list]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d4fa17f441)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
No autobuilder failures reported, but it fixes build issues that can
be reproduced with:
BR2_x86_64=y
BR2_x86_corei7=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_X86_64_CORE_I7_GLIBC_BLEEDING_EDGE=y
BR2_TARGET_SYSLINUX=y
BR2_TARGET_SYSLINUX_EFI=y
First patch is backported from upstream. Last 3 patches are not from
upstream, and they have not been submitted as upstream is basically
dead (last release 10 years ago, last commit 5 years ago).
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a311245ff7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Backport two commits from upstream Xen to fix the build for AArch64
with gcc 14.
This repairs the tests.package.test_xen.TestXen runtime test
introduced in [1], which uses an external AArch64 toolchain that has
been upgraded to gcc 14 in [2].
Fixes:
utils/docker-run support/testing/run-tests \
-d dl -o output_folder -s \
tests.package.test_xen
...
checking for openpty et al... configure: error: in '/build/xen-4.14.6/tools':
configure: error: Unable to find library for openpty and login_tty
[1] 055f82ebbd
[2] e5a965a648
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Alistair Francis <alistair@alistair23.me>
[Julien:
- fix "make check-package" errors
- add info in the commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ea55aa2819)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following vulnerabilities:
- CVE-2024-50349:
Printing unsanitized URLs when asking for credentials made the
user susceptible to crafted URLs (e.g. in recursive clones) that
mislead the user into typing in passwords for trusted sites that
would then be sent to untrusted sites instead.
- CVE-2024-52006
Git may pass on Carriage Returns via the credential protocol to
credential helpers which use line-reading functions that
interpret said Carriage Returns as line endings, even though Git
did not intend that.
For more details, see the announcement:
https://lore.kernel.org/git/xmqq5xmh46oc.fsf@gitster.g/
Additionally, 2.47.1 contained a number of fixes:
https://lore.kernel.org/git/xmqq5xob6coo.fsf@gitster.g/
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Backport a patch fixing a segfault first introduced by
ca63c4409b in buildroot.
Fixes:
==4792== Invalid read of size 8
==4792== at 0x4FE7661: __gconv_close (gconv_close.c:33)
==4792== by 0x4FE70EE: iconv_close (iconv_close.c:34)
==4792== by 0x5AED422: xmlCharEncCloseFunc (encoding.c:2678)
==4792== by 0x587A78C: __pyx_f_4lxml_5etree__find_PyUCS4EncodingName (etree.c:126676)
==4792== by 0x5888666: __pyx_pymod_exec_etree (etree.c:289773)
==4792== by 0x4A06345: PyModule_ExecDef (moduleobject.c:440)
==4792== by 0x4AE23A8: _imp_exec_dynamic_impl (import.c:3801)
==4792== by 0x4AE23A8: _imp_exec_dynamic (import.c.h:534)
==4792== by 0x4A046A3: cfunction_vectorcall_O (methodobject.c:509)
==4792== by 0x4AAA203: _PyEval_EvalFrameDefault (bytecodes.c:3263)
==4792== by 0x49B9D2B: _PyObject_VectorcallTstate (pycore_call.h:92)
==4792== by 0x49B9D2B: object_vacall (call.c:850)
==4792== by 0x49B9F44: PyObject_CallMethodObjArgs (call.c:911)
==4792== by 0x4AE648A: import_find_and_load (import.c:2781)
==4792== by 0x4AE648A: PyImport_ImportModuleLevelObject (import.c:2864)
==4792== Address 0x8 is not stack'd, malloc'd or (recently) free'd
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e2e152496a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit [1]
"toolchain/toolchain-external/toolchain-external-synopsys-arc: mark
as broken" disabled BR2_TOOLCHAIN_EXTERNAL_SYNOPSYS_ARC by adding a
depends on BR2_BROKEN. This symbol does not exist and generates
check-symbol failures, see [2].
This commit fixes this issue by introducing the BR2_BROKEN hidden symbol
that will be used to track those known to be broken features. This
symbol will help to track features that were broken for too long and
remove them.
Fixes: [2]
[1] 11a8cdd2bb
[2] https://gitlab.com/buildroot.org/buildroot/-/jobs/8840476511
Reviewed-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2ddc5808cd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Bugfix release fixing regressions in 3.4.0:
- fixed handling of -H flag with conflict in internal flag values
- fixed a use after free in logging of failed rename
- fixed build on systems without openat()
- removed dependency on alloca() in bundled popt
For more details, see:
https://download.samba.org/pub/rsync/NEWS#3.4.1
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 593755f527)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
