From d2aa0f282ca14afd47c764fb2fbbc775abca5d8b Mon Sep 17 00:00:00 2001 From: Poornima Lokesh Date: Tue, 13 Oct 2026 17:26:03 +0530 Subject: [PATCH] mariadb: upgrade 11.4.12 -> 11.4.13 Fixes CVE-2026-107816: an out-of-bounds heap read in the qc_info plugin when reading information_schema.query_cache_info after caching a query that contains embedded null bytes, which could disclose adjacent heap memory or crash the server. Drop c21bb11be28ae9b2432b2a661bf38a197cf9514d.patch, which is already included upstream in 11.4.13. Disable the DuckDB storage engine (new in 11.4.13) via -DPLUGIN_DUCKDB=NO: it bundles its own CMake subproject that is not cross-compile aware and fails do_compile in a cross environment. CVE: CVE-2026-107816 Signed-off-by: Poornima Lokesh Signed-off-by: Khem Raj --- ...e_11.4.12.bb => mariadb-native_11.4.13.bb} | 0 meta-oe/recipes-dbs/mysql/mariadb.inc | 4 +- ...b11be28ae9b2432b2a661bf38a197cf9514d.patch | 52 ------------------- ...{mariadb_11.4.12.bb => mariadb_11.4.13.bb} | 0 4 files changed, 2 insertions(+), 54 deletions(-) rename meta-oe/recipes-dbs/mysql/{mariadb-native_11.4.12.bb => mariadb-native_11.4.13.bb} (100%) delete mode 100644 meta-oe/recipes-dbs/mysql/mariadb/c21bb11be28ae9b2432b2a661bf38a197cf9514d.patch rename meta-oe/recipes-dbs/mysql/{mariadb_11.4.12.bb => mariadb_11.4.13.bb} (100%) diff --git a/meta-oe/recipes-dbs/mysql/mariadb-native_11.4.12.bb b/meta-oe/recipes-dbs/mysql/mariadb-native_11.4.13.bb similarity index 100% rename from meta-oe/recipes-dbs/mysql/mariadb-native_11.4.12.bb rename to meta-oe/recipes-dbs/mysql/mariadb-native_11.4.13.bb diff --git a/meta-oe/recipes-dbs/mysql/mariadb.inc b/meta-oe/recipes-dbs/mysql/mariadb.inc index 1cf90c8f93..390f9853bc 100644 --- a/meta-oe/recipes-dbs/mysql/mariadb.inc +++ b/meta-oe/recipes-dbs/mysql/mariadb.inc @@ -25,10 +25,9 @@ SRC_URI = "https://archive.mariadb.org/${BP}/source/${BP}.tar.gz \ file://riscv32.patch \ file://0001-support-reproducible-builds.patch \ file://0001-storage-mroonga-CMakeLists.txt-fix-reproducible-buil.patch \ - file://c21bb11be28ae9b2432b2a661bf38a197cf9514d.patch \ file://0001-MDEV-40287-AES_ENCRYPT-and-KDF-return-NULL-with-Open.patch \ " -SRC_URI[sha256sum] = "5ab7883db519bfcebfdd2aac09bc5544a12ce328f39edd46d0bf01690615ef6c" +SRC_URI[sha256sum] = "1bb254b106d0a7ca871cfa18fa6e18d4b80a7430f9ec9d1571ec4271a13def96" UPSTREAM_CHECK_URI = "https://github.com/MariaDB/server/tags" @@ -80,6 +79,7 @@ LDFLAGS:riscv32:toolchain-clang = "-latomic" EXTRA_OECMAKE = "-DWITH_EMBEDDED_SERVER=ON \ -DWITH_JEMALLOC=no \ -DWITHOUT_TOKUDB=TRUE \ + -DPLUGIN_DUCKDB=NO \ -DCMAKE_DISABLE_FIND_PACKAGE_Boost=TRUE \ -DGROFF=FALSE \ -DNROFF=FALSE \ diff --git a/meta-oe/recipes-dbs/mysql/mariadb/c21bb11be28ae9b2432b2a661bf38a197cf9514d.patch b/meta-oe/recipes-dbs/mysql/mariadb/c21bb11be28ae9b2432b2a661bf38a197cf9514d.patch deleted file mode 100644 index a58b6f112f..0000000000 --- a/meta-oe/recipes-dbs/mysql/mariadb/c21bb11be28ae9b2432b2a661bf38a197cf9514d.patch +++ /dev/null @@ -1,52 +0,0 @@ -From c21bb11be28ae9b2432b2a661bf38a197cf9514d Mon Sep 17 00:00:00 2001 -From: Daniel Black -Date: Thu, 21 May 2026 11:54:35 +1000 -Subject: [PATCH] MDEV-39692 innodb intrinsics fail to compile on ARMv8.3-A and - later (but not ARMv9.x) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Assembler messages: -{standard input}:169: Error: selected processor does not support `retaa' -{standard input}:271: Error: selected processor does not support `retaa' - -It happens because the pmem_cvap() funciton manually inserts the `.arch -armv8-2.a` clause, making GAS believe that retaa instruction (inserted -by GCC) is invalid. - -Replaced compiler dependent version by using the generic sys instruction: - -__asm__ __volatile__(/* dc cvap, %0 */ "sys #3, c7, c12, 1, %0" :: - "r"(u) : "memory"); - -Co-authored-by: gemini-code-assist -Reported-by: Dmitry Baryshkov -Reviewed-by: Marko Mäkelä - -Original solution: https://lore.kernel.org/openembedded-devel/20260520113418.2523208-1-dmitry.baryshkov@oss.qualcomm.com/ - -Upstream-Status: Backport [https://github.com/MariaDB/server/commit/c21bb11be28ae9b2432b2a661bf38a197cf9514d] -Signed-off-by: Dmitry Baryshkov ---- - storage/innobase/sync/cache.cc | 7 ++----- - 1 file changed, 2 insertions(+), 5 deletions(-) - -diff --git a/storage/innobase/sync/cache.cc b/storage/innobase/sync/cache.cc -index c5e67709e22b2..064c29d6f0205 100644 ---- a/storage/innobase/sync/cache.cc -+++ b/storage/innobase/sync/cache.cc -@@ -82,11 +82,8 @@ static void pmem_cvap(const void* buf, size_t size) - for (uintptr_t u= uintptr_t(buf) & ~(CPU_LEVEL1_DCACHE_LINESIZE), - end= uintptr_t(buf) + size; - u < end; u+= CPU_LEVEL1_DCACHE_LINESIZE) --#if defined __ARM_ARCH && __ARM_ARCH == 9 -- __asm__ __volatile__(".arch armv9.4-a\n dc cvap, %0" :: "r"(u) : "memory"); --#else -- __asm__ __volatile__(".arch armv8.2-a\n dc cvap, %0" :: "r"(u) : "memory"); --#endif -+ __asm__ __volatile__(/* dc cvap, %0 */ "sys #3, c7, c12, 1, %0" :: -+ "r"(u) : "memory"); - - __asm__ __volatile__("dmb ishst" ::: "memory"); - } diff --git a/meta-oe/recipes-dbs/mysql/mariadb_11.4.12.bb b/meta-oe/recipes-dbs/mysql/mariadb_11.4.13.bb similarity index 100% rename from meta-oe/recipes-dbs/mysql/mariadb_11.4.12.bb rename to meta-oe/recipes-dbs/mysql/mariadb_11.4.13.bb