Debian Patches

Status for u-boot/2023.01+dfsg-2+deb12u3

Patch Description Author Forwarded Bugs Origin Last update
riscv64/vbe-Allow-probing-the-VBE-bootmeth-to-fail-in-OS-fixup.patch [PATCH v2] vbe: Allow probing the VBE bootmeth to fail in OS fixup
This device is created when there are no bootmeths defined in the device
tree. But it cannot be probed without a device tree node.

For now, ignore a probe failure.		 Simon Glass <sjg@chromium.org> no debian https://patchwork.ozlabs.org/project/uboot/patch/20230112234854.936325-1-sjg@chromium.org/ 2023-01-12
mx53loco Enables support for ext4, the "load" command, and using bootz with raw initrds. no
arndale/board-spl-rule.diff Add spl/arndale-spl.bin rule
===================================================================		 Ian Campbell <ijc@debian.org> no
test-imagetools-test-fixes This patch allows testing in an alternate directory and also detects
failures to execute commands, treating that as a failure.		 no
exynos/0001-arm-config-fix-default-console-only-to-specify-the-d.patch arm: config: fix default console only to specify the device
This reverts commit 767edf0f6b3eaa0303f3fd6afdc14ddce0aca70c and restores
commit 232ed3ca534708527a9515c7c41bc3542949525c.

Debian's flash-kernel expect the console variable to just contain the device,
because it will set the bootargs to "console=${console}". So revert adding
"console=" to the console parameter, but also adjust the shipped bootscripts
for exynos boards to cope with it.		 Dongjin Kim <tobetter@gmail.com> no debian 2017-10-28
riscv64/unmatched-prevent-relocating-initrd-and-fdt.patch prevent relocating initrd & fdt, that results in failure to boot=================================================================== Heinrich Schuchardt (xypron) no
disable-fit-image-tests Disable FIT image tests.

FIT images were made more robust in light of CVE-2021-27097 and
CVE-2021-27138, but test-imagetools.sh was not updated to reflect
those changes.

Reported upstream: https://lists.denx.de/pipermail/u-boot/2021-March/443460.html

diff --git a/test/image/test-imagetools.sh b/test/image/test-imagetools.sh
index 907f46a7b5..e3b341b9e9 100755		 no
rockchip/rockchip-inno-usb.patch phy: rockchip: inno-usb2: fix hang when multiple controllers exit

The OHCI and EHCI controllers are both bound to the same PHY. They will
both do init and power_on operations when the controller is brought up
and both do power_off and exit when the controller is stopped. However,
the PHY uclass of U-Boot is not as sane as we thought -- they won't
maintain a status mark for PHYs, and thus the functions of the PHYs
could be called for multiple times. Calling init/power_on for multiple
times have no severe problems, however calling power_off/exit for
multiple times have a problem -- the first exit call will stop the PHY
clock, and power_off/exit calls after it still trying to write to PHY
registers. The write operation to PHY registers will fail because clock
is already stopped.

Adapt the count mechanism from phy-sun4i-usb to both init/exit and
power_on/power_off functions to phy-rockchip-inno-usb2 to fix this
problem. With this stopping USB controllers (manually or before booting
a kernel) will work.		 Icenowy Zheng <icenowy@aosc.io> no 2021-04-06
rockchip/rockchip-roc-pc-rk3399-Enable-rockchip-efuse-support.patch configs: roc-pc-rk3399: Enable rockchip efuse support
Enable efuse support which allows reading of the cpuid#, serial#
and also generates a unique mac address from the board's serial.		 Christopher Obbard <chris.obbard@collabora.com> yes 2022-11-23
qemu/efi-secure-boot.patch enable support for secure boot on qemu arm64/amd64 Secure boot is now supported upstream in EFI mode. It is disabled
by default, and can be enabled by loading keys from the console:

https://u-boot.readthedocs.io/en/latest/develop/uefi/uefi.html#configuring-uefi-secure-boot		 Luca Boccassi <bluca@debian.org> no
fix-qemu-ppce500-with-binutils-2.38.patch Fix building qemu-ppce500 target with binutils ~2.38.

https://bugs.debian.org/1003490

The incompatibility was introduced in binutils commit:

https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=b25f942e18d6ecd7ec3e2d2e9930eb4f996c258a		 no
Makefile-Use-relative-paths-for-debugging-symbols.patch Makefile: Use relative paths for debugging symbols.
The KBUILD_CFLAGS and KBUILD_AFLAGS variables are adjusted to use
-ffile-prefix-map and --debug-prefix-map, respectively, to use
relative paths for occurrences of __FILE__ and debug paths.

This enables reproducible builds regardless of the absolute path to
the build directory:

https://reproducible-builds.org/docs/build-path/		 Vagrant Cascadian <vagrant@reproducible-builds.org> no 2022-08-16
tools-disable-video-logo Disable video logo as this breaks cross-building, which runs bmp_logo
during the build to generate the logo headers. Debian does not
currently ship the bmp_logo tool, so simply disable this feature.

===================================================================		 no
upstream/0001-timer-orion-timer-Fix-problem-in-early_init_done.patch timer: orion-timer: Fix problem in early_init_done()
It was noticed that Clearfog is currently broken with this newly
introduced early_init_done() function. Apparently the timer is enabled
here when U-Boot is run but not configured - at least not correctly.
Resulting in a hangup in the timer reading functions.

To fix this, also read the value of the reload register and check it's
value with the one written to by U-Boot. Only if this matches, the
init has already been done.		 Stefan Roese <sr@denx.de> no 2023-01-16
CVE-2024-57254.patch squashfs: Fix integer overflow in sqfs_inode_size()
A carefully crafted squashfs filesystem can exhibit an extremly large
inode size and overflow the calculation in sqfs_inode_size().
As a consequence, the squashfs driver will read from wrong locations.

Fix by using __builtin_add_overflow() to detect the overflow.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/c8e929e5758999933f9e905049ef2bf3fe6b140d 2024-08-02
CVE-2024-57255.patch squashfs: Fix integer overflow in sqfs_resolve_symlink()
A carefully crafted squashfs filesystem can exhibit an inode size of 0xffffffff,
as a consequence malloc() will do a zero allocation.
Later in the function the inode size is again used for copying data.
So an attacker can overwrite memory.
Avoid the overflow by using the __builtin_add_overflow() helper.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/233945eba63e24061dffeeaeb7cd6fe985278356 2024-08-02
CVE-2024-57256.patch ext4: Fix integer overflow in ext4fs_read_symlink()
While zalloc() takes a size_t type, adding 1 to the le32 variable
will overflow.
A carefully crafted ext4 filesystem can exhibit an inode size of 0xffffffff
and as consequence zalloc() will do a zero allocation.

Later in the function the inode size is again used for copying data.
So an attacker can overwrite memory.

Avoid the overflow by using the __builtin_add_overflow() helper.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/35f75d2a46e5859138c83a75cd2f4141c5479ab9 2024-08-09
CVE-2024-57257.patch squashfs: Fix stack overflow while symlink resolving
The squashfs driver blindly follows symlinks, and calls sqfs_size()
recursively. So an attacker can create a crafted filesystem and with
a deep enough nesting level a stack overflow can be achieved.

Fix by limiting the nesting level to 8.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/4f5cc096bfd0a591f8a11e86999e3d90a9484c34 2024-08-02
CVE-2024-57258-1.patch dlmalloc: Fix integer overflow in sbrk()
Make sure that the new break is within mem_malloc_start
and mem_malloc_end before making progress.
ulong new = old + increment; can overflow for extremely large
increment values and memset() can get wrongly called.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/0a10b49206a29b4aa2f80233a3e53ca0466bb0b3 2024-08-02
CVE-2024-57258-2.patch dlmalloc: Fix integer overflow in request2size()
req is of type size_t, casting it to long opens the door
for an integer overflow.
Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
cause and overflow such that request2size() returns MINSIZE.

Fix by removing the cast.
The origin of the cast is unclear, it's in u-boot and ppcboot since ever
and predates the CVS history.
Doug Lea's original dlmalloc implementation also doesn't have it.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/8642b2178d2c4002c99a0b69a845a48f2ae2706f 2024-08-02
CVE-2024-57258-3.patch x86: Fix ptrdiff_t for x86_64
sbrk() assumes ptrdiff_t is large enough to enlarge/shrink the heap
by LONG_MIN/LONG_MAX.
So, use the long type, also to match the rest of the Linux ecosystem.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/c17b2a05dd50a3ba437e6373093a0d6a359cdee0 2024-08-02
CVE-2024-57259.patch squashfs: Fix heap corruption in sqfs_search_dir()
res needs to be large enough to store both strings rem and target,
plus the path separator and the terminator.
Currently the space for the path separator is not accounted, so
the heap is corrupted by one byte.		 Richard Weinberger <richard@nod.at> yes debian upstream https://source.denx.de/u-boot/u-boot/-/commit/048d795bb5b3d9c5701b4855f5e74bcf6849bf5e 2024-08-02
CVE-2024-42040.patch net: bootp: Prevent buffer overflow to avoid leaking the RAM content
CVE-2024-42040 describes a possible buffer overflow when calling
bootp_process_vendor() in bootp_handler() since the total length
of the packet is passed to bootp_process_vendor() without being
reduced to len-(offsetof(struct bootp_hdr,bp_vend)+4).

The packet length is also checked against its minimum size to avoid
reading data from struct bootp_hdr outside of the packet length.

(cherry picked from commit 81e5708cc2c865df606e49aed5415adb2a662171)		 Paul HENRYS <paul.henrys_ext@softathome.com> no 2025-10-09
CVE-2026-46728-1.patch boot/fit: declare (and use) new constant for conf's compatible prop
Fit conf node may have a compatible property[1] which stores the root
compatible of the first blob in the fdt property of the node. This can
be used to automatically select the proper conf node based on the
compatible from the running U-Boot (matching the former's compatible
with the latter)[2].

This adds (and uses) this constant for FIT node parsing.

Note that this property may also appear in fpga image nodes[3] but that
isn't done in this commit.

[1] https://fitspec.osfw.foundation/#optional-properties compatible paragraph
[2] https://fitspec.osfw.foundation/#select-a-configuration-to-boot
[3] https://fitspec.osfw.foundation/#images-node 2.3.2 Conditionally mandatory property

(cherry picked from commit 3059eb0c27dd1b4a40a06bda4a47e10246185aca)		 Quentin Schulz <quentin.schulz@cherry.de> no 2025-12-03
CVE-2026-46728-2.patch boot: Add fit_config_get_hash_list() to build signed node list
The hashed-nodes property in a FIT signature node lists which FDT paths
are included in the signature hash. It is intended as a hint so should
not be used for verification.

Add a function to build the node list from scratch by iterating the
configuration's image references. Skip properties known not to be image
references. For each image, collect the path plus all hash and cipher
subnodes.

Use the new function in fit_config_check_sig() instead of reading
'hashed-nodes'.

Update the test_vboot kernel@ test case: fit_check_sign now catches the
attack at signature-verification time (the @-suffixed node is hashed
instead of the real one, causing a mismatch) rather than at
fit_check_format() time.

Update the docs to cover this. The FIT spec can be updated separately.

(cherry picked from commit 2092322b31cc8b1f8c9e2e238d1043ae0637b241)		 Simon Glass <simon.glass@canonical.com> no 2026-03-05
CVE-2026-46728-3.patch tests: FIT: Add "clone" image attack image test
Related to the problem resolved with commit 2092322b31cc ("boot: Add
fit_config_get_hash_list() to build signed node list"), add a testcase
for the problem as well.

(cherry picked from commit a22e9e1b8ec7c96664072d7e629e811c318fb92a)		 Tom Rini <trini@konsulko.com> no 2026-03-18

All known versions for source package 'u-boot'

Links