mariadb: upgrade 11.4.12 -> 11.4.13

Fixes CVE-2026-107816: an out-of-bounds heap read in the qc_info plugin
when reading information_schema.query_cache_info after caching a query
that contains embedded null bytes, which could disclose adjacent heap
memory or crash the server.

Drop c21bb11be28ae9b2432b2a661bf38a197cf9514d.patch, which is already
included upstream in 11.4.13.

Disable the DuckDB storage engine (new in 11.4.13) via -DPLUGIN_DUCKDB=NO:
it bundles its own CMake subproject that is not cross-compile aware and
fails do_compile in a cross environment.

CVE: CVE-2026-107816
Signed-off-by: Poornima Lokesh <Poornima.Lokesh@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Poornima Lokesh authored and Khem Raj committed 2026-10-13 12:30:07 -07:00
1 parent cbf3962ed4
commit d2aa0f282c
4 files changed
+2 -54

No files matched your search

+2 -2
View File
@@ -25,10 +25,9 @@ SRC_URI = "https://archive.mariadb.org/${BP}/source/${BP}.tar.gz \
file://riscv32.patch \
file://0001-support-reproducible-builds.patch \
file://0001-storage-mroonga-CMakeLists.txt-fix-reproducible-buil.patch \
file://c21bb11be28ae9b2432b2a661bf38a197cf9514d.patch \
file://0001-MDEV-40287-AES_ENCRYPT-and-KDF-return-NULL-with-Open.patch \
"
SRC_URI[sha256sum] = "5ab7883db519bfcebfdd2aac09bc5544a12ce328f39edd46d0bf01690615ef6c"
SRC_URI[sha256sum] = "1bb254b106d0a7ca871cfa18fa6e18d4b80a7430f9ec9d1571ec4271a13def96"
UPSTREAM_CHECK_URI = "https://github.com/MariaDB/server/tags"
@@ -80,6 +79,7 @@ LDFLAGS:riscv32:toolchain-clang = "-latomic"
EXTRA_OECMAKE = "-DWITH_EMBEDDED_SERVER=ON \
-DWITH_JEMALLOC=no \
-DWITHOUT_TOKUDB=TRUE \
-DPLUGIN_DUCKDB=NO \
-DCMAKE_DISABLE_FIND_PACKAGE_Boost=TRUE \
-DGROFF=FALSE \
-DNROFF=FALSE \
@@ -1,52 +0,0 @@
From c21bb11be28ae9b2432b2a661bf38a197cf9514d Mon Sep 17 00:00:00 2001
From: Daniel Black <daniel@mariadb.org>
Date: Thu, 21 May 2026 11:54:35 +1000
Subject: [PATCH] MDEV-39692 innodb intrinsics fail to compile on ARMv8.3-A and
later (but not ARMv9.x)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Assembler messages:
{standard input}:169: Error: selected processor does not support `retaa'
{standard input}:271: Error: selected processor does not support `retaa'
It happens because the pmem_cvap() funciton manually inserts the `.arch
armv8-2.a` clause, making GAS believe that retaa instruction (inserted
by GCC) is invalid.
Replaced compiler dependent version by using the generic sys instruction:
__asm__ __volatile__(/* dc cvap, %0 */ "sys #3, c7, c12, 1, %0" ::
"r"(u) : "memory");
Co-authored-by: gemini-code-assist
Reported-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Marko Mäkelä
Original solution: https://lore.kernel.org/openembedded-devel/20260520113418.2523208-1-dmitry.baryshkov@oss.qualcomm.com/
Upstream-Status: Backport [https://github.com/MariaDB/server/commit/c21bb11be28ae9b2432b2a661bf38a197cf9514d]
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
storage/innobase/sync/cache.cc | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/storage/innobase/sync/cache.cc b/storage/innobase/sync/cache.cc
index c5e67709e22b2..064c29d6f0205 100644
--- a/storage/innobase/sync/cache.cc
+++ b/storage/innobase/sync/cache.cc
@@ -82,11 +82,8 @@ static void pmem_cvap(const void* buf, size_t size)
for (uintptr_t u= uintptr_t(buf) & ~(CPU_LEVEL1_DCACHE_LINESIZE),
end= uintptr_t(buf) + size;
u < end; u+= CPU_LEVEL1_DCACHE_LINESIZE)
-#if defined __ARM_ARCH && __ARM_ARCH == 9
- __asm__ __volatile__(".arch armv9.4-a\n dc cvap, %0" :: "r"(u) : "memory");
-#else
- __asm__ __volatile__(".arch armv8.2-a\n dc cvap, %0" :: "r"(u) : "memory");
-#endif
+ __asm__ __volatile__(/* dc cvap, %0 */ "sys #3, c7, c12, 1, %0" ::
+ "r"(u) : "memory");
__asm__ __volatile__("dmb ishst" ::: "memory");
}