Debian Patches

Status for u-boot/2023.01+dfsg-2+deb12u2

Patch Description Author Forwarded Bugs Origin Last update
mx53loco Enables support for ext4, the "load" command, and using bootz with raw initrds. no
arndale/board-spl-rule.diff Add spl/arndale-spl.bin rule
===================================================================		 Ian Campbell <ijc@debian.org> no
test-imagetools-test-fixes This patch allows testing in an alternate directory and also detects
failures to execute commands, treating that as a failure.		 no
exynos/0001-arm-config-fix-default-console-only-to-specify-the-d.patch [PATCH] arm: config: fix default console only to specify the device
This reverts commit 767edf0f6b3eaa0303f3fd6afdc14ddce0aca70c and restores
commit 232ed3ca534708527a9515c7c41bc3542949525c.

Debian's flash-kernel expect the console variable to just contain the device,
because it will set the bootargs to "console=${console}". So revert adding
"console=" to the console parameter, but also adjust the shipped bootscripts
for exynos boards to cope with it.		 Dongjin Kim <tobetter@gmail.com> no debian 2017-10-28
riscv64/unmatched-prevent-relocating-initrd-and-fdt.patch prevent relocating initrd & fdt, that results in failure to boot=================================================================== Heinrich Schuchardt (xypron) no
disable-fit-image-tests Disable FIT image tests.

FIT images were made more robust in light of CVE-2021-27097 and
CVE-2021-27138, but test-imagetools.sh was not updated to reflect
those changes.

Reported upstream: https://lists.denx.de/pipermail/u-boot/2021-March/443460.html

diff --git a/test/image/test-imagetools.sh b/test/image/test-imagetools.sh
index 907f46a7b5..e3b341b9e9 100755		 no
rockchip/rockchip-inno-usb.patch [PATCH] phy: rockchip: inno-usb2: fix hang when multiple controllers exit

The OHCI and EHCI controllers are both bound to the same PHY. They will
both do init and power_on operations when the controller is brought up
and both do power_off and exit when the controller is stopped. However,
the PHY uclass of U-Boot is not as sane as we thought -- they won't
maintain a status mark for PHYs, and thus the functions of the PHYs
could be called for multiple times. Calling init/power_on for multiple
times have no severe problems, however calling power_off/exit for
multiple times have a problem -- the first exit call will stop the PHY
clock, and power_off/exit calls after it still trying to write to PHY
registers. The write operation to PHY registers will fail because clock
is already stopped.

Adapt the count mechanism from phy-sun4i-usb to both init/exit and
power_on/power_off functions to phy-rockchip-inno-usb2 to fix this
problem. With this stopping USB controllers (manually or before booting
a kernel) will work.		 Icenowy Zheng <icenowy@aosc.io> no 2021-04-06
rockchip/rockchip-roc-pc-rk3399-Enable-rockchip-efuse-support.patch configs: roc-pc-rk3399: Enable rockchip efuse support
Enable efuse support which allows reading of the cpuid#, serial#
and also generates a unique mac address from the board's serial.		 Christopher Obbard <chris.obbard@collabora.com> yes 2022-11-23
qemu/efi-secure-boot.patch enable support for secure boot on qemu arm64/amd64 Secure boot is now supported upstream in EFI mode. It is disabled
by default, and can be enabled by loading keys from the console:

https://u-boot.readthedocs.io/en/latest/develop/uefi/uefi.html#configuring-uefi-secure-boot		 Luca Boccassi <bluca@debian.org> no
fix-qemu-ppce500-with-binutils-2.38.patch Fix building qemu-ppce500 target with binutils ~2.38.

https://bugs.debian.org/1003490

The incompatibility was introduced in binutils commit:

https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=b25f942e18d6ecd7ec3e2d2e9930eb4f996c258a		 no
Makefile-Use-relative-paths-for-debugging-symbols.patch [PATCH] Makefile: Use relative paths for debugging symbols.
The KBUILD_CFLAGS and KBUILD_AFLAGS variables are adjusted to use
-ffile-prefix-map and --debug-prefix-map, respectively, to use
relative paths for occurrences of __FILE__ and debug paths.

This enables reproducible builds regardless of the absolute path to
the build directory:

https://reproducible-builds.org/docs/build-path/		 Vagrant Cascadian <vagrant@reproducible-builds.org> no 2022-08-16
tools-disable-video-logo Disable video logo as this breaks cross-building, which runs bmp_logo
during the build to generate the logo headers. Debian does not
currently ship the bmp_logo tool, so simply disable this feature.

===================================================================		 no
riscv64/vbe-Allow-probing-the-VBE-bootmeth-to-fail-in-OS-fixup.patch [PATCH v2] vbe: Allow probing the VBE bootmeth to fail in OS fixup
This device is created when there are no bootmeths defined in the device
tree. But it cannot be probed without a device tree node.

For now, ignore a probe failure.		 Simon Glass <sjg@chromium.org> no debian https://patchwork.ozlabs.org/project/uboot/patch/20230112234854.936325-1-sjg@chromium.org/ 2023-01-12
upstream/0001-timer-orion-timer-Fix-problem-in-early_init_done.patch [PATCH] timer: orion-timer: Fix problem in early_init_done()
It was noticed that Clearfog is currently broken with this newly
introduced early_init_done() function. Apparently the timer is enabled
here when U-Boot is run but not configured - at least not correctly.
Resulting in a hangup in the timer reading functions.

To fix this, also read the value of the reload register and check it's
value with the one written to by U-Boot. Only if this matches, the
init has already been done.		 Stefan Roese <sr@denx.de> no 2023-01-16
CVE-2024-57254.patch squashfs: Fix integer overflow in sqfs_inode_size()
A carefully crafted squashfs filesystem can exhibit an extremly large
inode size and overflow the calculation in sqfs_inode_size().
As a consequence, the squashfs driver will read from wrong locations.

Fix by using __builtin_add_overflow() to detect the overflow.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/c8e929e5758999933f9e905049ef2bf3fe6b140d 2024-08-02
CVE-2024-57255.patch squashfs: Fix integer overflow in sqfs_resolve_symlink()
A carefully crafted squashfs filesystem can exhibit an inode size of 0xffffffff,
as a consequence malloc() will do a zero allocation.
Later in the function the inode size is again used for copying data.
So an attacker can overwrite memory.
Avoid the overflow by using the __builtin_add_overflow() helper.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/233945eba63e24061dffeeaeb7cd6fe985278356 2024-08-02
CVE-2024-57256.patch ext4: Fix integer overflow in ext4fs_read_symlink()
While zalloc() takes a size_t type, adding 1 to the le32 variable
will overflow.
A carefully crafted ext4 filesystem can exhibit an inode size of 0xffffffff
and as consequence zalloc() will do a zero allocation.

Later in the function the inode size is again used for copying data.
So an attacker can overwrite memory.

Avoid the overflow by using the __builtin_add_overflow() helper.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/35f75d2a46e5859138c83a75cd2f4141c5479ab9 2024-08-09
CVE-2024-57257.patch squashfs: Fix stack overflow while symlink resolving
The squashfs driver blindly follows symlinks, and calls sqfs_size()
recursively. So an attacker can create a crafted filesystem and with
a deep enough nesting level a stack overflow can be achieved.

Fix by limiting the nesting level to 8.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/4f5cc096bfd0a591f8a11e86999e3d90a9484c34 2024-08-02
CVE-2024-57258-1.patch dlmalloc: Fix integer overflow in sbrk()
Make sure that the new break is within mem_malloc_start
and mem_malloc_end before making progress.
ulong new = old + increment; can overflow for extremely large
increment values and memset() can get wrongly called.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/0a10b49206a29b4aa2f80233a3e53ca0466bb0b3 2024-08-02
CVE-2024-57258-2.patch dlmalloc: Fix integer overflow in request2size()
req is of type size_t, casting it to long opens the door
for an integer overflow.
Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
cause and overflow such that request2size() returns MINSIZE.

Fix by removing the cast.
The origin of the cast is unclear, it's in u-boot and ppcboot since ever
and predates the CVS history.
Doug Lea's original dlmalloc implementation also doesn't have it.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/8642b2178d2c4002c99a0b69a845a48f2ae2706f 2024-08-02
CVE-2024-57258-3.patch x86: Fix ptrdiff_t for x86_64
sbrk() assumes ptrdiff_t is large enough to enlarge/shrink the heap
by LONG_MIN/LONG_MAX.
So, use the long type, also to match the rest of the Linux ecosystem.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/c17b2a05dd50a3ba437e6373093a0d6a359cdee0 2024-08-02
CVE-2024-57259.patch squashfs: Fix heap corruption in sqfs_search_dir()
res needs to be large enough to store both strings rem and target,
plus the path separator and the terminator.
Currently the space for the path separator is not accounted, so
the heap is corrupted by one byte.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/048d795bb5b3d9c5701b4855f5e74bcf6849bf5e 2024-08-02

All known versions for source package 'u-boot'

Links