Debian Patches

Status for u-boot/2025.01-3.2

Patch Description Author Forwarded Bugs Origin Last update
arndale/board-spl-rule.diff Add spl/arndale-spl.bin rule
===================================================================		 Ian Campbell <ijc@debian.org> no
test-imagetools-test-fixes This patch allows testing in an alternate directory and also detects
failures to execute commands, treating that as a failure.		 no
exynos/0001-arm-config-fix-default-console-only-to-specify-the-d.patch arm: config: fix default console only to specify the device
This reverts commit 767edf0f6b3eaa0303f3fd6afdc14ddce0aca70c and restores
commit 232ed3ca534708527a9515c7c41bc3542949525c.

Debian's flash-kernel expect the console variable to just contain the device,
because it will set the bootargs to "console=${console}". So revert adding
"console=" to the console parameter, but also adjust the shipped bootscripts
for exynos boards to cope with it.		 Dongjin Kim <tobetter@gmail.com> no debian 2017-10-28
disable-fit-image-tests Disable FIT image tests.

FIT images were made more robust in light of CVE-2021-27097 and
CVE-2021-27138, but test-imagetools.sh was not updated to reflect
those changes.

Reported upstream: https://lists.denx.de/pipermail/u-boot/2021-March/443460.html

diff --git a/test/image/test-imagetools.sh b/test/image/test-imagetools.sh
index 907f46a7b5..e3b341b9e9 100755		 no
qemu/efi-secure-boot.patch enable support for secure boot on qemu arm64/amd64 Secure boot is now supported upstream in EFI mode. It is disabled
by default, and can be enabled by loading keys from the console:

https://u-boot.readthedocs.io/en/latest/develop/uefi/uefi.html#configuring-uefi-secure-boot
===================================================================		 Luca Boccassi <bluca@debian.org> no
Makefile-Use-relative-paths-for-debugging-symbols.patch Makefile: Use relative paths for debugging symbols.
The KBUILD_CFLAGS and KBUILD_AFLAGS variables are adjusted to use
-ffile-prefix-map and --debug-prefix-map, respectively, to use
relative paths for occurrences of __FILE__ and debug paths.

This enables reproducible builds regardless of the absolute path to
the build directory:

https://reproducible-builds.org/docs/build-path/		 Vagrant Cascadian <vagrant@reproducible-builds.org> no 2022-08-16
sitara/Don-t-attempt-to-build-final-firmware-images.patch sitara: Don't attempt to build final firmware images
The final firmware images require access to firmware not yet present in
linux-firmware. In certain instances it will be either desirable or
required to sign the elements that are included in the final firmware
images with device specific keys, which won't be present at build time.

Build and package the firmware elements that are required to form the
firmware images at a later date.		 Martyn Welch <martyn.welch@collabora.com> no 2024-02-05
binutils-output-target.patch Update objcopy --target argument to --output-target,
per binutils upstream commit 5e83077d552ed6f81dbc092eb3ccf827a43de42c.

diff --git i/arch/sandbox/config.mk w/arch/sandbox/config.mk
index 405843800e..2ee5981725 100644		 no
CVE-2024-42040.patch net: bootp: Prevent buffer overflow to avoid leaking the RAM content
CVE-2024-42040 describes a possible buffer overflow when calling
bootp_process_vendor() in bootp_handler() since the total length
of the packet is passed to bootp_process_vendor() without being
reduced to len-(offsetof(struct bootp_hdr,bp_vend)+4).

The packet length is also checked against its minimum size to avoid
reading data from struct bootp_hdr outside of the packet length.

(cherry picked from commit 81e5708cc2c865df606e49aed5415adb2a662171)		 Paul HENRYS <paul.henrys_ext@softathome.com> no 2025-10-09
CVE-2026-46728-1.patch boot/fit: declare (and use) new constant for conf's compatible prop
Fit conf node may have a compatible property[1] which stores the root
compatible of the first blob in the fdt property of the node. This can
be used to automatically select the proper conf node based on the
compatible from the running U-Boot (matching the former's compatible
with the latter)[2].

This adds (and uses) this constant for FIT node parsing.

Note that this property may also appear in fpga image nodes[3] but that
isn't done in this commit.

[1] https://fitspec.osfw.foundation/#optional-properties compatible paragraph
[2] https://fitspec.osfw.foundation/#select-a-configuration-to-boot
[3] https://fitspec.osfw.foundation/#images-node 2.3.2 Conditionally mandatory property

(cherry picked from commit 3059eb0c27dd1b4a40a06bda4a47e10246185aca)		 Quentin Schulz <quentin.schulz@cherry.de> no 2025-12-03
CVE-2026-46728-2.patch boot: Add fit_config_get_hash_list() to build signed node list
The hashed-nodes property in a FIT signature node lists which FDT paths
are included in the signature hash. It is intended as a hint so should
not be used for verification.

Add a function to build the node list from scratch by iterating the
configuration's image references. Skip properties known not to be image
references. For each image, collect the path plus all hash and cipher
subnodes.

Use the new function in fit_config_check_sig() instead of reading
'hashed-nodes'.

Update the test_vboot kernel@ test case: fit_check_sign now catches the
attack at signature-verification time (the @-suffixed node is hashed
instead of the real one, causing a mismatch) rather than at
fit_check_format() time.

Update the docs to cover this. The FIT spec can be updated separately.

(cherry picked from commit 2092322b31cc8b1f8c9e2e238d1043ae0637b241)		 Simon Glass <simon.glass@canonical.com> no 2026-03-05
CVE-2026-46728-3.patch tests: FIT: Add "clone" image attack image test
Related to the problem resolved with commit 2092322b31cc ("boot: Add
fit_config_get_hash_list() to build signed node list"), add a testcase
for the problem as well.

(cherry picked from commit a22e9e1b8ec7c96664072d7e629e811c318fb92a)		 Tom Rini <trini@konsulko.com> no 2026-03-18

All known versions for source package 'u-boot'

Links