Fixes the following security issues:
GLIBC-SA-2024-0004:
ISO-2022-CN-EXT: fix out-of-bound writes when writing escape
sequence (CVE-2024-2961)
GLIBC-SA-2024-0005:
nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599)
GLIBC-SA-2024-0006:
nscd: Null pointer crash after notfound response (CVE-2024-33600)
GLIBC-SA-2024-0007:
nscd: netgroup cache may terminate daemon on memory allocation
failure (CVE-2024-33601)
GLIBC-SA-2024-0008:
nscd: netgroup cache assumes NSS callback uses in-buffer strings
(CVE-2024-33602)
In addition, the following bugs are fixed:
[19622] network: Support aliasing with struct sockaddr
[30701] time: getutxent misbehaves on 32-bit x86 when _TIME_BITS=64
[30994] REP MOVSB performance suffers from page aliasing on Zen 4
[31339] libc: arm32 loader crash after cleanup in 2.36
[31325] mips: clone3 is wrong for o32
[31335] math: Compile glibc with -march=x86-64-v3 should disable FMA4
multi-arch version
[31402] libc: clone (NULL, NULL, ...) clobbers %r7 register on
s390{,x}
[31479] libc: Missing #include <sys/rseq.h> in sched_getcpu.c may
result in a loss of rseq acceleration
[31316] build: Fails test misc/tst-dirname "Didn't expect signal from
child: got `Illegal instruction'" on non SSE CPUs
[31371] x86-64: APX and Tile registers aren't preserved in ld.so
trampoline
[31372] dynamic-link: _dl_tlsdesc_dynamic doesn't preserve all caller-
saved registers
[31429] build: Glibc failed to build with -march=x86-64-v3
[31501] dynamic-link: _dl_tlsdesc_dynamic_xsavec may clobber %rbx
[31640] dynamic-link: POWER10 ld.so crashes in
elf_machine_load_address with GCC 14
[31676] Configuring with CC="gcc -march=x86-64-v3"
--with-rtld-early-cflags=-march=x86-64 results in linker failure
[31677] nscd: nscd: netgroup cache: invalid memcpy under low
memory/storage conditions
[31678] nscd: nscd: Null pointer dereferences after failed netgroup
cache insertion
[31679] nscd: nscd: netgroup cache may terminate daemon on memory
allocation failure
[31680] nscd: nscd: netgroup cache assumes NSS callback uses in-buffer
strings
[31686] dynamic-link: Stack-based buffer overflow in
parse_tunables_string
[31719] dynamic-link: --enable-hardcoded-path-in-tests doesn't work
with -Wl,--enable-new-dtags
[31782] Test build failure with recent GCC trunk
(x86/tst-cpu-features-supports.c:69:3: error: parameter to builtin
not valid: avx5124fmaps)
[31798] pidfd_getpid.c is miscompiled by GCC 6.4
[31867] build: "CPU ISA level is lower than required" on SSE2-free
CPUs
[31883] build: ISA level support configure check relies on bashism /
is otherwise broken for arithmetic
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Commit b5680f53d6 (package/glibc: bump to 2.39) forgot to drop the ignores
for the 2.38 specific CVEs. Do that now.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Fix the following build failure with gcc 14:
In file included from /home/autobuild/autobuild/instance-6/output-1/build/avro-c-1.11.3/src/avro/legacy.h:33,
from /home/autobuild/autobuild/instance-6/output-1/build/avro-c-1.11.3/src/avro/io.h:31,
from /home/autobuild/autobuild/instance-6/output-1/build/avro-c-1.11.3/src/avro/consumer.h:30,
from /home/autobuild/autobuild/instance-6/output-1/build/avro-c-1.11.3/src/avro.h:28,
from /home/autobuild/autobuild/instance-6/output-1/build/avro-c-1.11.3/examples/quickstop.c:18:
/home/autobuild/autobuild/instance-6/output-1/build/avro-c-1.11.3/examples/quickstop.c: In function 'print_person':
/home/autobuild/autobuild/instance-6/output-1/build/avro-c-1.11.3/examples/quickstop.c:123:61: error: passing argument 3 of 'first_value.iface->get_string' from incompatible pointer type [-Wincompatible-pointer-types]
123 | avro_value_get_string(&first_value, &p, &size);
| ^~
| |
| int32_t ** {aka int **}
Fixes:
- http://autobuild.buildroot.org/results/fdbc6a888ba8bb51f4e076a450919477d1378eb3
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
This patch removes the package/versal-firmware as this package is replaced
by the boot/xilinx-prebuilt target boot firmware package.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Brandon Maier <brandon.maier@collins.com>
[yann.morin.1998@free.fr: handle legacy]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The new BR2_TARGET_UBOOT_ZYNQMP_PMUFW_PREBUILT option will enable u-boot to
use the xilinx-prebuilt package for downloading a pmufw.elf that gets included
in the generated boot.bin.
If the BR2_TARGET_UBOOT_ZYNQMP_PMUFW_PREBUILT option is enabled, then the
BR2_TARGET_UBOOT_ZYNQMP_PMUFW config for downloading a prebuilt pmufw will
be ignored.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Brandon Maier <brandon.maier@collins.com>
[yann.morin.1998@free.fr:
- add 'custom' to prompt for BR2_TARGET_UBOOT_ZYNQMP_PMUFW
- fix checkpackage
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
This patch add a new boot package for downloading prebuilt firmware for Xilinx
versal and zynqmp evaluation boards.
It solves the problem of being able to verify the hash when downloading a
prebuilt zynqmp pmufw.elf binary.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Brandon Maier <brandon.maier@collins.com>
[yann.morin.1998@free.fr:
- move the hash file to the package dir, not the board dir
- move board name after familly choice
- add default board name for each family
- qstrip the Kconfig strings before use
- introduce XILINX_PREBUILT_BOARD_DIR to simplify paths
- explain the *.pdi glob
- simplify non-versal install
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The per-package-rsync stage can add a significant amount of time to
builds. They can also be annoying as the target-finalize and
host-finalize targets are the slowest and run on every `make all`, which
is used frequently for partial rebuilds.
The per-package-rsync is slow because it launches a new rsync for each
source tree, and each rsync must rescan the destination directory and
potentially overwrite files multiple times. We can instead merge all the
rsync calls down into one call, and rsync is smarter about scanning all
the source directories and only copying over the files it needs to.
We feed the source trees to rsync in reverse-order, as this preserves
the original behaviour. I.e. when using multiple rsyncs, the last source
tree would overwrite anything in the destination. Now when using a
single rsync, we put the last tree first as rsync will select the first
file it finds.
This only supports the 'copy' mode, which is used in the finalize step.
The 'hardlink' mode would require specifying each source tree with the
--link-dest flag, and rsync only support at most 20 such trees at a
time, so we'd need a clever loop, so the 'hardlink' mode is left out, at
least for now.
Below is a benchmark running the host-finalize target for a build with
200 packages.
Benchmark 1: before copy
Time (mean ± σ): 27.171 s ± 0.777 s [User: 6.170 s, System: 14.830 s]
Range (min … max): 26.343 s … 28.566 s 10 runs
Benchmark 2: after copy
Time (mean ± σ): 6.296 s ± 0.196 s [User: 2.874 s, System: 5.600 s]
Range (min … max): 6.094 s … 6.709 s 10 runs
Summary
after copy ran
4.32 ± 0.18 times faster than before copy
Cc: Herve Codina <herve.codina@bootlin.com>
Cc: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: Brandon Maier <brandon.maier@collins.com>
Tested-by: Yann E. MORIN <yann.morin@orange.com>
Reviewed-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The 6.8.x series is now EOL upstream, so drop the linux-headers option
and add legacy handling for it.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Our Bugzilla is so slow and unstable that it has become
unusable. Let's switch to using the Gitlab issue tracker instead.
There are still lots of references to the Bugzilla bug tracker in our
News page at https://buildroot.org/news.html, but these are for older
news.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[yann.morin.1998@free.fr: don't needlessly re-flow]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Instead of downloading a different version of the kernel for the headers as
for the runtime kernel itself, use the same one. By doing so, we now need
to add the hash file for linux-headers.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
It is perfectly valid for a patch file to have trailing spaces, when for
example an empty or space-only line is appears in a hunk: if the line if
part of the context, whether it be empty or with only spaces, there will
aways be the leading space introduced by the patch itsef, making for a
sapce-only line; if the line is space-only and removed (or added) that
will also appear as a space-only line.
Currently, our editorconfig wants to unconditionally drop trailing
spaces, so when one edits a patch file to add their SoB and Upstream
tags, such a patch would get badly mangled and would not apply, causing
quite some grief and questioning (sad experience looming in the recent
past here)...
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The matching in genrandconfig is idiomatically done by matching whole
lines, i.e. with the terminating \n but a few places are missing that.
Those are only matching against '=y', a boolean symbol, so it is in
practice not causing any issue. Still, for consistency, fix those.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Previously, when running `PYTHON3_REMOVE_USELESS_FILES`, the hook to
clean up files from the python config directory assumed a pattern of
"config-$(VERSION)m-$(PLATFORM_TRIPLET)".
However, the "m" ABI suffix was dropped in python 3.8, so the hook would
never actually find files to delete. No error was raised due to the use
of a subshell to invoke find.
Also, if a platform triplet is not detected during the configure stage,
the config directory (LIBPL) defaults to `config-$VERSION`, and has no
trailing `-$PLATFORM_TRIPLET`.
Now, we glob anything after the version to ensure files get deleted.
Signed-off-by: Vincent Fazio <vfazio@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
If a platform triplet is not detected during the configure stage, the
config directory (LIBPL) defaults to `config-$VERSION`.
In this scenario, the `PYTHON3_REMOVE_USELESS_FILES` hook would fail due
to `find` incorrectly expecting a second dash and then the triplet.
Now, we glob anything after the version which will match in both cases.
Fixes: 54d48c8cad ("package/python3: miscellaneous fixups")
Signed-off-by: Vincent Fazio <vfazio@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Building with GCC 14 fails at the configure step with:
./configure: error: libatomic_ops library was not found.
The error is not caused by a missing library, but by an unrelated
"incompatible pointer type" error in the test program:
...
checking for atomic_ops library
objs/autotest.c: In function 'main':
objs/autotest.c:9:48: error: passing argument 1 of 'AO_compare_and_swap' from incompatible pointer type [-Wincompatible-pointer-types]
This used to be a warning, but it is an error since GCC 14.[1]
Fix this by patching the test program in order to use the correct
pointer types.
Fixes: http://autobuild.buildroot.net/results/a3d/a3d8c6fd631b31e272e4d8cc6c3318f2e4151882
[1] https://gcc.gnu.org/gcc-14/porting_to.html#incompatible-pointer-types
Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
When running a test that uses host-python-setuptools using the Buildroot
Docker image, for example running the following command,
> ./utils/docker-run ./support/testing/run-tests -o output -s -k tests.package.test_python_pytest.TestPythonPy3Pytest
The build fails with the following error,
> File "/home/blmaier/buildroot/output/TestPythonPy3Pytest/build/host-python-setuptools-69.2.0/setuptools/_distutils/dist.py", line 354, in _gen_paths
> yield pathlib.Path('~').expanduser() / filename
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "/home/blmaier/buildroot/output/TestPythonPy3Pytest/host/lib/python3.11/pathlib.py", line 1385, in expanduser
> raise RuntimeError("Could not determine home directory.")
> RuntimeError: Could not determine home directory.
>
> ERROR Backend subprocess exited when trying to invoke get_requires_for_build_wheel
Python setuptools is looking for $HOME but failing to find it.
Signed-off-by: Brandon Maier <brandon.maier@collins.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
With newer versions of DM or DMSC firmware (>v09.02.07) invalid clock
requests will be NAKed and generate a warning in the kernel logs rather
than being ignored like in previous versions of firmware. This, together
with the linux clk driver assuming that all clock IDs are contiguous,
can generate a significant amount of warnings during boot when many
drivers are being probed.
A fix for this has been merged into Linux (commit: ad3ac13c6ec31)
however the backport to older kernels was missed which unfortunately
affects the current v6.8 kernel.
Manually backport this fix while we're using the v6.8 kernel
Signed-off-by: Bryan Brattlof <bb@ti.com>
Tested-by: Gero Schwäricke <gero.schwaericke@grandcentrix.net>
[Arnout: add Upsream tag]
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
With newer versions of DM or DMSC firmware (v09.02.07+) invalid clock
requests will be NAKed and generate a warning in the kernel logs rather
than being ignored like in previous versions of firmware. This, together
with the linux clk driver assuming that all clock IDs are contiguous,
can generate a significant amount of warnings during boot when many
drivers are being probed.
A fix for this has been merged into Linux (commit: ad3ac13c6ec31)
however the backport to older kernels was missed which unfortunately
affects the current v6.8 kernel.
Manually backport this fix while we're using the v6.8 kernel
Signed-off-by: Bryan Brattlof <bb@ti.com>
Tested-by: Gero Schwäricke <gero.schwaericke@grandcentrix.net>
[Arnout: add Upstream tag]
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
This patch bumps the zynqmp_zcu106_defconfig to xilinx-v2024.1 which includes
the following updates:
- Linux v6.6.10
- U-Boot v2024.01
- ATF v2.10
- PMUFW xilinx-v2024.1
Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
This patch bumps the zynqmp_zcu104_defconfig to xilinx-v2024.1 which includes
the following updates:
- Linux v6.6.10
- U-Boot v2024.01
- ATF v2.10
- PMUFW xilinx-v2024.1
Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
This patch bumps the zynqmp_zcu102_defconfig to xilinx-v2024.1 which includes
the following updates:
- Linux v6.6.10
- U-Boot v2024.01
- ATF v2.10
- PMUFW xilinx-v2024.1
Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
