From 5d3013f04f92546951897e87f995f418e6d96ffd Mon Sep 17 00:00:00 2001
From: P Dheeraj Srujan Kumar
Date: Sun, 11 Dec 2022 17:22:53 +0530
Subject: Update to internal 1-0.92-41
Signed-off-by: P Dheeraj Srujan Kumar
---
.../recipes-core/dropbear/dropbear_%.bbappend | 1 +
.../dropbear/files/CVE-2021-36369.patch | 235 ++++++++++++++
...0001-configure-Pass-LDFLAGS-to-link-tests.patch | 80 +++++
.../recipes-core/zlib/zlib/CVE-2018-25032.patch | 343 ---------------------
.../recipes-core/zlib/zlib/CVE-2022-37434_1.patch | 32 --
.../recipes-core/zlib/zlib/CVE-2022-37434_2.patch | 29 --
.../meta-common/recipes-core/zlib/zlib/run-ptest | 7 +
.../meta-common/recipes-core/zlib/zlib_%.bbappend | 7 -
.../meta-common/recipes-core/zlib/zlib_1.2.13.bb | 47 +++
...ssing-prototypes-to-function-declarations.patch | 173 +++++++++++
...n-pedantic-errors-at-the-end-of-configure.patch | 68 ++++
.../recipes-devtools/rsync/files/determism.patch | 34 ++
.../rsync/files/makefile-no-rebuild.patch | 80 +++++
.../recipes-devtools/rsync/files/rsyncd.conf | 15 +
.../recipes-devtools/rsync/rsync_3.2.5.bb | 72 +++++
.../linux/linux-aspeed/CVE-2022-20158-1.patch | 55 ++++
.../linux/linux-aspeed/CVE-2022-2663-1.patch | 76 +++++
.../linux/linux-aspeed/CVE-2022-2663-2.patch | 35 +++
.../recipes-kernel/linux/linux-aspeed_%.bbappend | 3 +
19 files changed, 981 insertions(+), 411 deletions(-)
create mode 100644 meta-openbmc-mods/meta-common/recipes-core/dropbear/files/CVE-2021-36369.patch
create mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/0001-configure-Pass-LDFLAGS-to-link-tests.patch
delete mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2018-25032.patch
delete mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_1.patch
delete mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_2.patch
create mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/run-ptest
delete mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_%.bbappend
create mode 100644 meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_1.2.13.bb
create mode 100644 meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch
create mode 100644 meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch
create mode 100644 meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/determism.patch
create mode 100644 meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/makefile-no-rebuild.patch
create mode 100644 meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/rsyncd.conf
create mode 100644 meta-openbmc-mods/meta-common/recipes-devtools/rsync/rsync_3.2.5.bb
create mode 100644 meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20158-1.patch
create mode 100644 meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-1.patch
create mode 100644 meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-2.patch
(limited to 'meta-openbmc-mods')
diff --git a/meta-openbmc-mods/meta-common/recipes-core/dropbear/dropbear_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/dropbear/dropbear_%.bbappend
index 029defb67..ed8f0718c 100644
--- a/meta-openbmc-mods/meta-common/recipes-core/dropbear/dropbear_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-core/dropbear/dropbear_%.bbappend
@@ -2,6 +2,7 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
SRC_URI += "file://enable-ssh.sh \
file://0001-Enable-UART-mux-setting-before-SOL-activation-via-SS.patch \
+ file://CVE-2021-36369.patch \
"
do_install:append() {
diff --git a/meta-openbmc-mods/meta-common/recipes-core/dropbear/files/CVE-2021-36369.patch b/meta-openbmc-mods/meta-common/recipes-core/dropbear/files/CVE-2021-36369.patch
new file mode 100644
index 000000000..f641374f0
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-core/dropbear/files/CVE-2021-36369.patch
@@ -0,0 +1,235 @@
+From 7c2e8fcd0d162d2ba9fac116f96a5e82ac77f11c Mon Sep 17 00:00:00 2001
+From: Manfred Kaiser
+Date: Thu, 17 Jun 2021 11:11:03 +0200
+Subject: [PATCH 1/3] added option to disable trivial auth methods
+
+---
+ cli-auth.c | 3 +++
+ cli-authinteract.c | 1 +
+ cli-authpasswd.c | 2 +-
+ cli-authpubkey.c | 1 +
+ cli-runopts.c | 7 +++++++
+ cli-session.c | 1 +
+ runopts.h | 1 +
+ session.h | 1 +
+ 8 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/cli-auth.c b/cli-auth.c
+index 5fcacc3a7..20cb34857 100644
+--- a/cli-auth.c
++++ b/cli-auth.c
+@@ -261,6 +261,9 @@ void recv_msg_userauth_success() {
+ if DROPBEAR_CLI_IMMEDIATE_AUTH is set */
+
+ TRACE(("received msg_userauth_success"))
++ if (cli_opts.exit_on_trivial_auth && cli_ses.is_trivial_auth) {
++ dropbear_exit("trivial authentication not allowed");
++ }
+ /* Note: in delayed-zlib mode, setting authdone here
+ * will enable compression in the transport layer */
+ ses.authstate.authdone = 1;
+diff --git a/cli-authinteract.c b/cli-authinteract.c
+index e1cc9a161..f7128ee59 100644
+--- a/cli-authinteract.c
++++ b/cli-authinteract.c
+@@ -114,6 +114,7 @@ void recv_msg_userauth_info_request() {
+ m_free(instruction);
+
+ for (i = 0; i < num_prompts; i++) {
++ cli_ses.is_trivial_auth = 0;
+ unsigned int response_len = 0;
+ prompt = buf_getstring(ses.payload, NULL);
+ cleantext(prompt);
+diff --git a/cli-authpasswd.c b/cli-authpasswd.c
+index 00fdd8bc4..a24d43efa 100644
+--- a/cli-authpasswd.c
++++ b/cli-authpasswd.c
+@@ -155,7 +155,7 @@ void cli_auth_password() {
+
+ encrypt_packet();
+ m_burn(password, strlen(password));
+-
++ cli_ses.is_trivial_auth = 0;
+ TRACE(("leave cli_auth_password"))
+ }
+ #endif /* DROPBEAR_CLI_PASSWORD_AUTH */
+diff --git a/cli-authpubkey.c b/cli-authpubkey.c
+index 28c54fa9b..bdb855880 100644
+--- a/cli-authpubkey.c
++++ b/cli-authpubkey.c
+@@ -266,6 +266,7 @@ int cli_auth_pubkey() {
+ /* Send a trial request */
+ send_msg_userauth_pubkey(key, sigtype, 0);
+ cli_ses.lastprivkey = key;
++ cli_ses.is_trivial_auth = 0;
+ TRACE(("leave cli_auth_pubkey-success"))
+ return 1;
+ } else {
+diff --git a/cli-runopts.c b/cli-runopts.c
+index 3654b9a32..da3ad3d3e 100644
+--- a/cli-runopts.c
++++ b/cli-runopts.c
+@@ -152,6 +152,7 @@ void cli_getopts(int argc, char ** argv) {
+ #if DROPBEAR_CLI_ANYTCPFWD
+ cli_opts.exit_on_fwd_failure = 0;
+ #endif
++ cli_opts.exit_on_trivial_auth = 0;
+ #if DROPBEAR_CLI_LOCALTCPFWD
+ cli_opts.localfwds = list_new();
+ opts.listen_fwd_all = 0;
+@@ -889,6 +890,7 @@ static void add_extendedopt(const char* origstr) {
+ #if DROPBEAR_CLI_ANYTCPFWD
+ "\tExitOnForwardFailure\n"
+ #endif
++ "\tExitOnTrivialAuth\n"
+ #ifndef DISABLE_SYSLOG
+ "\tUseSyslog\n"
+ #endif
+@@ -916,5 +918,10 @@ static void add_extendedopt(const char* origstr) {
+ return;
+ }
+
++ if (match_extendedopt(&optstr, "ExitOnTrivialAuth") == DROPBEAR_SUCCESS) {
++ cli_opts.exit_on_trivial_auth = parse_flag_value(optstr);
++ return;
++ }
++
+ dropbear_log(LOG_WARNING, "Ignoring unknown configuration option '%s'", origstr);
+ }
+diff --git a/cli-session.c b/cli-session.c
+index 699286db1..eee760e74 100644
+--- a/cli-session.c
++++ b/cli-session.c
+@@ -165,6 +165,7 @@ static void cli_session_init(pid_t proxy_cmd_pid) {
+ /* Auth */
+ cli_ses.lastprivkey = NULL;
+ cli_ses.lastauthtype = 0;
++ cli_ses.is_trivial_auth = 1;
+
+ /* For printing "remote host closed" for the user */
+ ses.remoteclosed = cli_remoteclosed;
+diff --git a/runopts.h b/runopts.h
+index 6a4a94ccd..c626b0e7a 100644
+--- a/runopts.h
++++ b/runopts.h
+@@ -159,6 +159,7 @@ typedef struct cli_runopts {
+ #if DROPBEAR_CLI_ANYTCPFWD
+ int exit_on_fwd_failure;
+ #endif
++ int exit_on_trivial_auth;
+ #if DROPBEAR_CLI_REMOTETCPFWD
+ m_list * remotefwds;
+ #endif
+diff --git a/session.h b/session.h
+index fb5b8cbb6..6706592a8 100644
+--- a/session.h
++++ b/session.h
+@@ -316,6 +316,7 @@ struct clientsession {
+
+ int lastauthtype; /* either AUTH_TYPE_PUBKEY or AUTH_TYPE_PASSWORD,
+ for the last type of auth we tried */
++ int is_trivial_auth;
+ int ignore_next_auth_response;
+ #if DROPBEAR_CLI_INTERACT_AUTH
+ int auth_interact_failed; /* flag whether interactive auth can still
+
+From adbdb213eb0fe3e982cc57d7ae882c1915bef818 Mon Sep 17 00:00:00 2001
+From: Manfred Kaiser
+Date: Fri, 18 Jun 2021 07:48:47 +0200
+Subject: [PATCH 2/3] rename argument to match with other ssh clients
+
+---
+ cli-auth.c | 2 +-
+ cli-runopts.c | 8 ++++----
+ runopts.h | 2 +-
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/cli-auth.c b/cli-auth.c
+index 20cb34857..517923052 100644
+--- a/cli-auth.c
++++ b/cli-auth.c
+@@ -261,7 +261,7 @@ void recv_msg_userauth_success() {
+ if DROPBEAR_CLI_IMMEDIATE_AUTH is set */
+
+ TRACE(("received msg_userauth_success"))
+- if (cli_opts.exit_on_trivial_auth && cli_ses.is_trivial_auth) {
++ if (cli_opts.disable_trivial_auth && cli_ses.is_trivial_auth) {
+ dropbear_exit("trivial authentication not allowed");
+ }
+ /* Note: in delayed-zlib mode, setting authdone here
+diff --git a/cli-runopts.c b/cli-runopts.c
+index da3ad3d3e..255b47e8a 100644
+--- a/cli-runopts.c
++++ b/cli-runopts.c
+@@ -152,7 +152,7 @@ void cli_getopts(int argc, char ** argv) {
+ #if DROPBEAR_CLI_ANYTCPFWD
+ cli_opts.exit_on_fwd_failure = 0;
+ #endif
+- cli_opts.exit_on_trivial_auth = 0;
++ cli_opts.disable_trivial_auth = 0;
+ #if DROPBEAR_CLI_LOCALTCPFWD
+ cli_opts.localfwds = list_new();
+ opts.listen_fwd_all = 0;
+@@ -890,7 +890,7 @@ static void add_extendedopt(const char* origstr) {
+ #if DROPBEAR_CLI_ANYTCPFWD
+ "\tExitOnForwardFailure\n"
+ #endif
+- "\tExitOnTrivialAuth\n"
++ "\tDisableTrivialAuth\n"
+ #ifndef DISABLE_SYSLOG
+ "\tUseSyslog\n"
+ #endif
+@@ -918,8 +918,8 @@ static void add_extendedopt(const char* origstr) {
+ return;
+ }
+
+- if (match_extendedopt(&optstr, "ExitOnTrivialAuth") == DROPBEAR_SUCCESS) {
+- cli_opts.exit_on_trivial_auth = parse_flag_value(optstr);
++ if (match_extendedopt(&optstr, "DisableTrivialAuth") == DROPBEAR_SUCCESS) {
++ cli_opts.disable_trivial_auth = parse_flag_value(optstr);
+ return;
+ }
+
+diff --git a/runopts.h b/runopts.h
+index c626b0e7a..01201d2dc 100644
+--- a/runopts.h
++++ b/runopts.h
+@@ -159,7 +159,7 @@ typedef struct cli_runopts {
+ #if DROPBEAR_CLI_ANYTCPFWD
+ int exit_on_fwd_failure;
+ #endif
+- int exit_on_trivial_auth;
++ int disable_trivial_auth;
+ #if DROPBEAR_CLI_REMOTETCPFWD
+ m_list * remotefwds;
+ #endif
+
+From 318109125e747f0bc256a6d94d5756030ea2f5a0 Mon Sep 17 00:00:00 2001
+From: Manfred Kaiser
+Date: Thu, 1 Jul 2021 18:50:18 +0200
+Subject: [PATCH 3/3] fixed trivial auth detection for pubkeys
+
+---
+ cli-authpubkey.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/cli-authpubkey.c b/cli-authpubkey.c
+index bdb855880..c0da77f1e 100644
+--- a/cli-authpubkey.c
++++ b/cli-authpubkey.c
+@@ -176,6 +176,7 @@ static void send_msg_userauth_pubkey(sign_key *key, enum signature_type sigtype,
+ buf_putbytes(sigbuf, ses.writepayload->data, ses.writepayload->len);
+ cli_buf_put_sign(ses.writepayload, key, sigtype, sigbuf);
+ buf_free(sigbuf); /* Nothing confidential in the buffer */
++ cli_ses.is_trivial_auth = 0;
+ }
+
+ encrypt_packet();
+@@ -266,7 +267,6 @@ int cli_auth_pubkey() {
+ /* Send a trial request */
+ send_msg_userauth_pubkey(key, sigtype, 0);
+ cli_ses.lastprivkey = key;
+- cli_ses.is_trivial_auth = 0;
+ TRACE(("leave cli_auth_pubkey-success"))
+ return 1;
+ } else {
diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/0001-configure-Pass-LDFLAGS-to-link-tests.patch b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/0001-configure-Pass-LDFLAGS-to-link-tests.patch
new file mode 100644
index 000000000..e6cc915ba
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/0001-configure-Pass-LDFLAGS-to-link-tests.patch
@@ -0,0 +1,80 @@
+Upstream-Status: Submitted [https://github.com/madler/zlib/pull/599]
+Signed-off-by: Ross Burton
+
+From f15584918a7fbbe3cc794ad59100e5e8153ea9f6 Mon Sep 17 00:00:00 2001
+From: Khem Raj
+Date: Tue, 8 Mar 2022 22:38:47 -0800
+Subject: [PATCH] configure: Pass LDFLAGS to link tests
+
+LDFLAGS can contain critical flags without which linking wont succeed
+therefore ensure that all configure tests involving link time checks are
+using LDFLAGS on compiler commandline along with CFLAGS to ensure the
+tests perform correctly. Without this some tests may fail resulting in
+wrong confgure result, ending in miscompiling the package
+
+Signed-off-by: Khem Raj
+---
+ configure | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/configure b/configure
+index 52ff4a0..d04ee59 100755
+--- a/configure
++++ b/configure
+@@ -427,7 +427,7 @@ if test $shared -eq 1; then
+ echo Checking for shared library support... | tee -a configure.log
+ # we must test in two steps (cc then ld), required at least on SunOS 4.x
+ if try $CC -w -c $SFLAGS $test.c &&
+- try $LDSHARED $SFLAGS -o $test$shared_ext $test.o; then
++ try $LDSHARED $SFLAGS $LDFLAGS -o $test$shared_ext $test.o; then
+ echo Building shared library $SHAREDLIBV with $CC. | tee -a configure.log
+ elif test -z "$old_cc" -a -z "$old_cflags"; then
+ echo No shared library support. | tee -a configure.log
+@@ -503,7 +503,7 @@ int main(void) {
+ }
+ EOF
+ fi
+- if try $CC $CFLAGS -o $test $test.c; then
++ if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then
+ sizet=`./$test`
+ echo "Checking for a pointer-size integer type..." $sizet"." | tee -a configure.log
+ CFLAGS="${CFLAGS} -DNO_SIZE_T=${sizet}"
+@@ -537,7 +537,7 @@ int main(void) {
+ return 0;
+ }
+ EOF
+- if try $CC $CFLAGS -o $test $test.c; then
++ if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then
+ echo "Checking for fseeko... Yes." | tee -a configure.log
+ else
+ CFLAGS="${CFLAGS} -DNO_FSEEKO"
+@@ -554,7 +554,7 @@ cat > $test.c <
+ int main() { return strlen(strerror(errno)); }
+ EOF
+-if try $CC $CFLAGS -o $test $test.c; then
++if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then
+ echo "Checking for strerror... Yes." | tee -a configure.log
+ else
+ CFLAGS="${CFLAGS} -DNO_STRERROR"
+@@ -661,7 +661,7 @@ int main()
+ return (mytest("Hello%d\n", 1));
+ }
+ EOF
+- if try $CC $CFLAGS -o $test $test.c; then
++ if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then
+ echo "Checking for vsnprintf() in stdio.h... Yes." | tee -a configure.log
+
+ echo >> configure.log
+@@ -751,7 +751,7 @@ int main()
+ }
+ EOF
+
+- if try $CC $CFLAGS -o $test $test.c; then
++ if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then
+ echo "Checking for snprintf() in stdio.h... Yes." | tee -a configure.log
+
+ echo >> configure.log
+--
+2.25.1
+
diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2018-25032.patch b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2018-25032.patch
deleted file mode 100644
index 9f37ba5c5..000000000
--- a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2018-25032.patch
+++ /dev/null
@@ -1,343 +0,0 @@
-From 5c44459c3b28a9bd3283aaceab7c615f8020c531 Mon Sep 17 00:00:00 2001
-From: Mark Adler
-Date: Tue, 17 Apr 2018 22:09:22 -0700
-Subject: [PATCH] Fix a bug that can crash deflate on some input when using
- Z_FIXED.
-
-This bug was reported by Danilo Ramos of Eideticom, Inc. It has
-lain in wait 13 years before being found! The bug was introduced
-in zlib 1.2.2.2, with the addition of the Z_FIXED option. That
-option forces the use of fixed Huffman codes. For rare inputs with
-a large number of distant matches, the pending buffer into which
-the compressed data is written can overwrite the distance symbol
-table which it overlays. That results in corrupted output due to
-invalid distances, and can result in out-of-bound accesses,
-crashing the application.
-
-The fix here combines the distance buffer and literal/length
-buffers into a single symbol buffer. Now three bytes of pending
-buffer space are opened up for each literal or length/distance
-pair consumed, instead of the previous two bytes. This assures
-that the pending buffer cannot overwrite the symbol table, since
-the maximum fixed code compressed length/distance is 31 bits, and
-since there are four bytes of pending space for every three bytes
-of symbol space.
----
- deflate.c | 74 ++++++++++++++++++++++++++++++++++++++++---------------
- deflate.h | 25 +++++++++----------
- trees.c | 50 +++++++++++--------------------------
- 3 files changed, 79 insertions(+), 70 deletions(-)
-
-diff --git a/deflate.c b/deflate.c
-index 425babc00..19cba873a 100644
---- a/deflate.c
-+++ b/deflate.c
-@@ -255,11 +255,6 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
- int wrap = 1;
- static const char my_version[] = ZLIB_VERSION;
-
-- ushf *overlay;
-- /* We overlay pending_buf and d_buf+l_buf. This works since the average
-- * output size for (length,distance) codes is <= 24 bits.
-- */
--
- if (version == Z_NULL || version[0] != my_version[0] ||
- stream_size != sizeof(z_stream)) {
- return Z_VERSION_ERROR;
-@@ -329,9 +324,47 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
-
- s->lit_bufsize = 1 << (memLevel + 6); /* 16K elements by default */
-
-- overlay = (ushf *) ZALLOC(strm, s->lit_bufsize, sizeof(ush)+2);
-- s->pending_buf = (uchf *) overlay;
-- s->pending_buf_size = (ulg)s->lit_bufsize * (sizeof(ush)+2L);
-+ /* We overlay pending_buf and sym_buf. This works since the average size
-+ * for length/distance pairs over any compressed block is assured to be 31
-+ * bits or less.
-+ *
-+ * Analysis: The longest fixed codes are a length code of 8 bits plus 5
-+ * extra bits, for lengths 131 to 257. The longest fixed distance codes are
-+ * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest
-+ * possible fixed-codes length/distance pair is then 31 bits total.
-+ *
-+ * sym_buf starts one-fourth of the way into pending_buf. So there are
-+ * three bytes in sym_buf for every four bytes in pending_buf. Each symbol
-+ * in sym_buf is three bytes -- two for the distance and one for the
-+ * literal/length. As each symbol is consumed, the pointer to the next
-+ * sym_buf value to read moves forward three bytes. From that symbol, up to
-+ * 31 bits are written to pending_buf. The closest the written pending_buf
-+ * bits gets to the next sym_buf symbol to read is just before the last
-+ * code is written. At that time, 31*(n-2) bits have been written, just
-+ * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at
-+ * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1
-+ * symbols are written.) The closest the writing gets to what is unread is
-+ * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and
-+ * can range from 128 to 32768.
-+ *
-+ * Therefore, at a minimum, there are 142 bits of space between what is
-+ * written and what is read in the overlain buffers, so the symbols cannot
-+ * be overwritten by the compressed data. That space is actually 139 bits,
-+ * due to the three-bit fixed-code block header.
-+ *
-+ * That covers the case where either Z_FIXED is specified, forcing fixed
-+ * codes, or when the use of fixed codes is chosen, because that choice
-+ * results in a smaller compressed block than dynamic codes. That latter
-+ * condition then assures that the above analysis also covers all dynamic
-+ * blocks. A dynamic-code block will only be chosen to be emitted if it has
-+ * fewer bits than a fixed-code block would for the same set of symbols.
-+ * Therefore its average symbol length is assured to be less than 31. So
-+ * the compressed data for a dynamic block also cannot overwrite the
-+ * symbols from which it is being constructed.
-+ */
-+
-+ s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4);
-+ s->pending_buf_size = (ulg)s->lit_bufsize * 4;
-
- if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL ||
- s->pending_buf == Z_NULL) {
-@@ -340,8 +373,12 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
- deflateEnd (strm);
- return Z_MEM_ERROR;
- }
-- s->d_buf = overlay + s->lit_bufsize/sizeof(ush);
-- s->l_buf = s->pending_buf + (1+sizeof(ush))*s->lit_bufsize;
-+ s->sym_buf = s->pending_buf + s->lit_bufsize;
-+ s->sym_end = (s->lit_bufsize - 1) * 3;
-+ /* We avoid equality with lit_bufsize*3 because of wraparound at 64K
-+ * on 16 bit machines and because stored blocks are restricted to
-+ * 64K-1 bytes.
-+ */
-
- s->level = level;
- s->strategy = strategy;
-@@ -552,7 +589,7 @@ int ZEXPORT deflatePrime (strm, bits, value)
-
- if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
- s = strm->state;
-- if ((Bytef *)(s->d_buf) < s->pending_out + ((Buf_size + 7) >> 3))
-+ if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
- return Z_BUF_ERROR;
- do {
- put = Buf_size - s->bi_valid;
-@@ -1113,7 +1150,6 @@ int ZEXPORT deflateCopy (dest, source)
- #else
- deflate_state *ds;
- deflate_state *ss;
-- ushf *overlay;
-
-
- if (deflateStateCheck(source) || dest == Z_NULL) {
-@@ -1133,8 +1169,7 @@ int ZEXPORT deflateCopy (dest, source)
- ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte));
- ds->prev = (Posf *) ZALLOC(dest, ds->w_size, sizeof(Pos));
- ds->head = (Posf *) ZALLOC(dest, ds->hash_size, sizeof(Pos));
-- overlay = (ushf *) ZALLOC(dest, ds->lit_bufsize, sizeof(ush)+2);
-- ds->pending_buf = (uchf *) overlay;
-+ ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4);
-
- if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL ||
- ds->pending_buf == Z_NULL) {
-@@ -1148,8 +1183,7 @@ int ZEXPORT deflateCopy (dest, source)
- zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size);
-
- ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf);
-- ds->d_buf = overlay + ds->lit_bufsize/sizeof(ush);
-- ds->l_buf = ds->pending_buf + (1+sizeof(ush))*ds->lit_bufsize;
-+ ds->sym_buf = ds->pending_buf + ds->lit_bufsize;
-
- ds->l_desc.dyn_tree = ds->dyn_ltree;
- ds->d_desc.dyn_tree = ds->dyn_dtree;
-@@ -1925,7 +1959,7 @@ local block_state deflate_fast(s, flush)
- FLUSH_BLOCK(s, 1);
- return finish_done;
- }
-- if (s->last_lit)
-+ if (s->sym_next)
- FLUSH_BLOCK(s, 0);
- return block_done;
- }
-@@ -2056,7 +2090,7 @@ local block_state deflate_slow(s, flush)
- FLUSH_BLOCK(s, 1);
- return finish_done;
- }
-- if (s->last_lit)
-+ if (s->sym_next)
- FLUSH_BLOCK(s, 0);
- return block_done;
- }
-@@ -2131,7 +2165,7 @@ local block_state deflate_rle(s, flush)
- FLUSH_BLOCK(s, 1);
- return finish_done;
- }
-- if (s->last_lit)
-+ if (s->sym_next)
- FLUSH_BLOCK(s, 0);
- return block_done;
- }
-@@ -2170,7 +2204,7 @@ local block_state deflate_huff(s, flush)
- FLUSH_BLOCK(s, 1);
- return finish_done;
- }
-- if (s->last_lit)
-+ if (s->sym_next)
- FLUSH_BLOCK(s, 0);
- return block_done;
- }
-diff --git a/deflate.h b/deflate.h
-index 23ecdd312..d4cf1a98b 100644
---- a/deflate.h
-+++ b/deflate.h
-@@ -217,7 +217,7 @@ typedef struct internal_state {
- /* Depth of each subtree used as tie breaker for trees of equal frequency
- */
-
-- uchf *l_buf; /* buffer for literals or lengths */
-+ uchf *sym_buf; /* buffer for distances and literals/lengths */
-
- uInt lit_bufsize;
- /* Size of match buffer for literals/lengths. There are 4 reasons for
-@@ -239,13 +239,8 @@ typedef struct internal_state {
- * - I can't count above 4
- */
-
-- uInt last_lit; /* running index in l_buf */
--
-- ushf *d_buf;
-- /* Buffer for distances. To simplify the code, d_buf and l_buf have
-- * the same number of elements. To use different lengths, an extra flag
-- * array would be necessary.
-- */
-+ uInt sym_next; /* running index in sym_buf */
-+ uInt sym_end; /* symbol table full when sym_next reaches this */
-
- ulg opt_len; /* bit length of current block with optimal trees */
- ulg static_len; /* bit length of current block with static trees */
-@@ -325,20 +320,22 @@ void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf,
-
- # define _tr_tally_lit(s, c, flush) \
- { uch cc = (c); \
-- s->d_buf[s->last_lit] = 0; \
-- s->l_buf[s->last_lit++] = cc; \
-+ s->sym_buf[s->sym_next++] = 0; \
-+ s->sym_buf[s->sym_next++] = 0; \
-+ s->sym_buf[s->sym_next++] = cc; \
- s->dyn_ltree[cc].Freq++; \
-- flush = (s->last_lit == s->lit_bufsize-1); \
-+ flush = (s->sym_next == s->sym_end); \
- }
- # define _tr_tally_dist(s, distance, length, flush) \
- { uch len = (uch)(length); \
- ush dist = (ush)(distance); \
-- s->d_buf[s->last_lit] = dist; \
-- s->l_buf[s->last_lit++] = len; \
-+ s->sym_buf[s->sym_next++] = dist; \
-+ s->sym_buf[s->sym_next++] = dist >> 8; \
-+ s->sym_buf[s->sym_next++] = len; \
- dist--; \
- s->dyn_ltree[_length_code[len]+LITERALS+1].Freq++; \
- s->dyn_dtree[d_code(dist)].Freq++; \
-- flush = (s->last_lit == s->lit_bufsize-1); \
-+ flush = (s->sym_next == s->sym_end); \
- }
- #else
- # define _tr_tally_lit(s, c, flush) flush = _tr_tally(s, 0, c)
-diff --git a/trees.c b/trees.c
-index 4f4a65011..decaeb7c3 100644
---- a/trees.c
-+++ b/trees.c
-@@ -416,7 +416,7 @@ local void init_block(s)
-
- s->dyn_ltree[END_BLOCK].Freq = 1;
- s->opt_len = s->static_len = 0L;
-- s->last_lit = s->matches = 0;
-+ s->sym_next = s->matches = 0;
- }
-
- #define SMALLEST 1
-@@ -948,7 +948,7 @@ void ZLIB_INTERNAL _tr_flush_block(s, buf, stored_len, last)
-
- Tracev((stderr, "\nopt %lu(%lu) stat %lu(%lu) stored %lu lit %u ",
- opt_lenb, s->opt_len, static_lenb, s->static_len, stored_len,
-- s->last_lit));
-+ s->sym_next / 3));
-
- if (static_lenb <= opt_lenb) opt_lenb = static_lenb;
-
-@@ -1017,8 +1017,9 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc)
- unsigned dist; /* distance of matched string */
- unsigned lc; /* match length-MIN_MATCH or unmatched char (if dist==0) */
- {
-- s->d_buf[s->last_lit] = (ush)dist;
-- s->l_buf[s->last_lit++] = (uch)lc;
-+ s->sym_buf[s->sym_next++] = dist;
-+ s->sym_buf[s->sym_next++] = dist >> 8;
-+ s->sym_buf[s->sym_next++] = lc;
- if (dist == 0) {
- /* lc is the unmatched char */
- s->dyn_ltree[lc].Freq++;
-@@ -1033,30 +1034,7 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc)
- s->dyn_ltree[_length_code[lc]+LITERALS+1].Freq++;
- s->dyn_dtree[d_code(dist)].Freq++;
- }
--
--#ifdef TRUNCATE_BLOCK
-- /* Try to guess if it is profitable to stop the current block here */
-- if ((s->last_lit & 0x1fff) == 0 && s->level > 2) {
-- /* Compute an upper bound for the compressed length */
-- ulg out_length = (ulg)s->last_lit*8L;
-- ulg in_length = (ulg)((long)s->strstart - s->block_start);
-- int dcode;
-- for (dcode = 0; dcode < D_CODES; dcode++) {
-- out_length += (ulg)s->dyn_dtree[dcode].Freq *
-- (5L+extra_dbits[dcode]);
-- }
-- out_length >>= 3;
-- Tracev((stderr,"\nlast_lit %u, in %ld, out ~%ld(%ld%%) ",
-- s->last_lit, in_length, out_length,
-- 100L - out_length*100L/in_length));
-- if (s->matches < s->last_lit/2 && out_length < in_length/2) return 1;
-- }
--#endif
-- return (s->last_lit == s->lit_bufsize-1);
-- /* We avoid equality with lit_bufsize because of wraparound at 64K
-- * on 16 bit machines and because stored blocks are restricted to
-- * 64K-1 bytes.
-- */
-+ return (s->sym_next == s->sym_end);
- }
-
- /* ===========================================================================
-@@ -1069,13 +1047,14 @@ local void compress_block(s, ltree, dtree)
- {
- unsigned dist; /* distance of matched string */
- int lc; /* match length or unmatched char (if dist == 0) */
-- unsigned lx = 0; /* running index in l_buf */
-+ unsigned sx = 0; /* running index in sym_buf */
- unsigned code; /* the code to send */
- int extra; /* number of extra bits to send */
-
-- if (s->last_lit != 0) do {
-- dist = s->d_buf[lx];
-- lc = s->l_buf[lx++];
-+ if (s->sym_next != 0) do {
-+ dist = s->sym_buf[sx++] & 0xff;
-+ dist += (unsigned)(s->sym_buf[sx++] & 0xff) << 8;
-+ lc = s->sym_buf[sx++];
- if (dist == 0) {
- send_code(s, lc, ltree); /* send a literal byte */
- Tracecv(isgraph(lc), (stderr," '%c' ", lc));
-@@ -1100,11 +1079,10 @@ local void compress_block(s, ltree, dtree)
- }
- } /* literal or match pair ? */
-
-- /* Check that the overlay between pending_buf and d_buf+l_buf is ok: */
-- Assert((uInt)(s->pending) < s->lit_bufsize + 2*lx,
-- "pendingBuf overflow");
-+ /* Check that the overlay between pending_buf and sym_buf is ok: */
-+ Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow");
-
-- } while (lx < s->last_lit);
-+ } while (sx < s->sym_next);
-
- send_code(s, END_BLOCK, ltree);
- }
diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_1.patch b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_1.patch
deleted file mode 100644
index dc84d3a1d..000000000
--- a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_1.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001
-From: Mark Adler
-Date: Sat, 30 Jul 2022 15:51:11 -0700
-Subject: [PATCH] Fix a bug when getting a gzip header extra field with
- inflate().
-
-If the extra field was larger than the space the user provided with
-inflateGetHeader(), and if multiple calls of inflate() delivered
-the extra header data, then there could be a buffer overflow of the
-provided space. This commit assures that provided space is not
-exceeded.
----
- inflate.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/inflate.c b/inflate.c
-index 7be8c6366..7a7289749 100644
---- a/inflate.c
-+++ b/inflate.c
-@@ -763,9 +763,10 @@ int flush;
- copy = state->length;
- if (copy > have) copy = have;
- if (copy) {
-+ len = state->head->extra_len - state->length;
- if (state->head != Z_NULL &&
-- state->head->extra != Z_NULL) {
-- len = state->head->extra_len - state->length;
-+ state->head->extra != Z_NULL &&
-+ len < state->head->extra_max) {
- zmemcpy(state->head->extra + len, next,
- len + copy > state->head->extra_max ?
- state->head->extra_max - len : copy);
diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_2.patch b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_2.patch
deleted file mode 100644
index c5c95a92b..000000000
--- a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/CVE-2022-37434_2.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d Mon Sep 17 00:00:00 2001
-From: Mark Adler
-Date: Mon, 8 Aug 2022 10:50:09 -0700
-Subject: [PATCH] Fix extra field processing bug that dereferences NULL
- state->head.
-
-The recent commit to fix a gzip header extra field processing bug
-introduced the new bug fixed here.
----
- inflate.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/inflate.c b/inflate.c
-index 7a7289749..2a3c4fe98 100644
---- a/inflate.c
-+++ b/inflate.c
-@@ -763,10 +763,10 @@ int flush;
- copy = state->length;
- if (copy > have) copy = have;
- if (copy) {
-- len = state->head->extra_len - state->length;
- if (state->head != Z_NULL &&
- state->head->extra != Z_NULL &&
-- len < state->head->extra_max) {
-+ (len = state->head->extra_len - state->length) <
-+ state->head->extra_max) {
- zmemcpy(state->head->extra + len, next,
- len + copy > state->head->extra_max ?
- state->head->extra_max - len : copy);
diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/run-ptest b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/run-ptest
new file mode 100644
index 000000000..065863ef7
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib/run-ptest
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if ./examplesh ; then
+ echo "PASS: zlib"
+else
+ echo "FAIL: zlib"
+fi
diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_%.bbappend
deleted file mode 100644
index 482197c4f..000000000
--- a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_%.bbappend
+++ /dev/null
@@ -1,7 +0,0 @@
-FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
-
-SRC_URI += " \
- file://CVE-2018-25032.patch \
- file://CVE-2022-37434_1.patch \
- file://CVE-2022-37434_2.patch \
- "
diff --git a/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_1.2.13.bb b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_1.2.13.bb
new file mode 100644
index 000000000..ec977a303
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-core/zlib/zlib_1.2.13.bb
@@ -0,0 +1,47 @@
+SUMMARY = "Zlib Compression Library"
+DESCRIPTION = "Zlib is a general-purpose, patent-free, lossless data compression \
+library which is used by many different programs."
+HOMEPAGE = "http://zlib.net/"
+SECTION = "libs"
+LICENSE = "Zlib"
+LIC_FILES_CHKSUM = "file://zlib.h;beginline=6;endline=23;md5=5377232268e952e9ef63bc555f7aa6c0"
+
+# The source tarball needs to be .gz as only the .gz ends up in fossils/
+SRC_URI = "https://zlib.net/${BP}.tar.gz \
+ file://0001-configure-Pass-LDFLAGS-to-link-tests.patch \
+ file://run-ptest \
+ "
+UPSTREAM_CHECK_URI = "http://zlib.net/"
+
+SRC_URI[sha256sum] = "b3a24de97a8fdbc835b9833169501030b8977031bcb54b3b3ac13740f846ab30"
+
+# When a new release is made the previous release is moved to fossils/, so add this
+# to PREMIRRORS so it is also searched automatically.
+PREMIRRORS:append = " https://zlib.net/ https://zlib.net/fossils/"
+
+CFLAGS += "-D_REENTRANT"
+
+RDEPENDS:${PN}-ptest += "make"
+
+inherit ptest
+
+B = "${WORKDIR}/build"
+
+do_configure() {
+ LDCONFIG=true ${S}/configure --prefix=${prefix} --shared --libdir=${libdir} --uname=GNU
+}
+do_configure[cleandirs] += "${B}"
+
+do_compile() {
+ oe_runmake shared
+}
+
+do_install() {
+ oe_runmake DESTDIR=${D} install
+}
+
+do_install_ptest() {
+ install ${B}/examplesh ${D}${PTEST_PATH}
+}
+
+BBCLASSEXTEND = "native nativesdk"
diff --git a/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch
new file mode 100644
index 000000000..474d82db2
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch
@@ -0,0 +1,173 @@
+From 785c0072c80c2f6e0839478453cf65fdeac15da0 Mon Sep 17 00:00:00 2001
+From: Khem Raj
+Date: Mon, 29 Aug 2022 19:53:28 -0700
+Subject: [PATCH] Add missing prototypes to function declarations
+
+With Clang 15+ compiler -Wstrict-prototypes is triggering warnings which
+are turned into errors with -Werror, this fixes the problem by adding
+missing prototypes
+
+Fixes errors like
+| log.c:134:24: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes]
+| static void syslog_init()
+| ^
+| void
+
+Upstream-Status: Submitted [https://lists.samba.org/archive/rsync/2022-August/032858.html]
+Signed-off-by: Khem Raj
+---
+ checksum.c | 2 +-
+ exclude.c | 2 +-
+ hlink.c | 3 +--
+ lib/pool_alloc.c | 2 +-
+ log.c | 2 +-
+ main.c | 2 +-
+ syscall.c | 4 ++--
+ zlib/crc32.c | 2 +-
+ zlib/trees.c | 2 +-
+ zlib/zutil.c | 4 ++--
+ 10 files changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/checksum.c b/checksum.c
+index fb8c0a0..174c28c 100644
+--- a/checksum.c
++++ b/checksum.c
+@@ -629,7 +629,7 @@ int sum_end(char *sum)
+ return csum_len_for_type(cursum_type, 0);
+ }
+
+-void init_checksum_choices()
++void init_checksum_choices(void)
+ {
+ #ifdef SUPPORT_XXH3
+ char buf[32816];
+diff --git a/exclude.c b/exclude.c
+index adc82e2..79f5a82 100644
+--- a/exclude.c
++++ b/exclude.c
+@@ -358,7 +358,7 @@ void implied_include_partial_string(const char *s_start, const char *s_end)
+ memcpy(partial_string_buf, s_start, partial_string_len);
+ }
+
+-void free_implied_include_partial_string()
++void free_implied_include_partial_string(void)
+ {
+ if (partial_string_buf) {
+ free(partial_string_buf);
+diff --git a/hlink.c b/hlink.c
+index 66810a3..6511dfb 100644
+--- a/hlink.c
++++ b/hlink.c
+@@ -117,8 +117,7 @@ static void match_gnums(int32 *ndx_list, int ndx_count)
+ struct ht_int32_node *node = NULL;
+ int32 gnum, gnum_next;
+
+- qsort(ndx_list, ndx_count, sizeof ndx_list[0], (int (*)()) hlink_compare_gnum);
+-
++ qsort(ndx_list, ndx_count, sizeof ndx_list[0], (int (*)(const void *, const void *)) hlink_compare_gnum);
+ for (from = 0; from < ndx_count; from++) {
+ file = hlink_flist->sorted[ndx_list[from]];
+ gnum = F_HL_GNUM(file);
+diff --git a/lib/pool_alloc.c b/lib/pool_alloc.c
+index a1a7245..4eae062 100644
+--- a/lib/pool_alloc.c
++++ b/lib/pool_alloc.c
+@@ -9,7 +9,7 @@ struct alloc_pool
+ size_t size; /* extent size */
+ size_t quantum; /* allocation quantum */
+ struct pool_extent *extents; /* top extent is "live" */
+- void (*bomb)(); /* called if malloc fails */
++ void (*bomb)(const char *, const char *, int); /* called if malloc fails */
+ int flags;
+
+ /* statistical data */
+diff --git a/log.c b/log.c
+index 44344e2..991e359 100644
+--- a/log.c
++++ b/log.c
+@@ -131,7 +131,7 @@ static void logit(int priority, const char *buf)
+ }
+ }
+
+-static void syslog_init()
++static void syslog_init(void)
+ {
+ int options = LOG_PID;
+
+diff --git a/main.c b/main.c
+index 9ebfbea..affa244 100644
+--- a/main.c
++++ b/main.c
+@@ -244,7 +244,7 @@ void read_del_stats(int f)
+ stats.deleted_files += stats.deleted_specials = read_varint(f);
+ }
+
+-static void become_copy_as_user()
++static void become_copy_as_user(void)
+ {
+ char *gname;
+ uid_t uid;
+diff --git a/syscall.c b/syscall.c
+index d92074a..92ca86d 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -389,9 +389,9 @@ OFF_T do_lseek(int fd, OFF_T offset, int whence)
+ {
+ #ifdef HAVE_LSEEK64
+ #if !SIZEOF_OFF64_T
+- OFF_T lseek64();
++ OFF_T lseek64(int fd, OFF_T offset, int whence);
+ #else
+- off64_t lseek64();
++ off64_t lseek64(int fd, off64_t offset, int whence);
+ #endif
+ return lseek64(fd, offset, whence);
+ #else
+diff --git a/zlib/crc32.c b/zlib/crc32.c
+index 05733f4..50c6c02 100644
+--- a/zlib/crc32.c
++++ b/zlib/crc32.c
+@@ -187,7 +187,7 @@ local void write_table(out, table)
+ /* =========================================================================
+ * This function can be used by asm versions of crc32()
+ */
+-const z_crc_t FAR * ZEXPORT get_crc_table()
++const z_crc_t FAR * ZEXPORT get_crc_table(void)
+ {
+ #ifdef DYNAMIC_CRC_TABLE
+ if (crc_table_empty)
+diff --git a/zlib/trees.c b/zlib/trees.c
+index 9c66770..0d9047e 100644
+--- a/zlib/trees.c
++++ b/zlib/trees.c
+@@ -231,7 +231,7 @@ local void send_bits(s, value, length)
+ /* ===========================================================================
+ * Initialize the various 'constant' tables.
+ */
+-local void tr_static_init()
++local void tr_static_init(void)
+ {
+ #if defined(GEN_TREES_H) || !defined(STDC)
+ static int static_init_done = 0;
+diff --git a/zlib/zutil.c b/zlib/zutil.c
+index bbba7b2..61f8dc9 100644
+--- a/zlib/zutil.c
++++ b/zlib/zutil.c
+@@ -27,12 +27,12 @@ z_const char * const z_errmsg[10] = {
+ ""};
+
+
+-const char * ZEXPORT zlibVersion()
++const char * ZEXPORT zlibVersion(void)
+ {
+ return ZLIB_VERSION;
+ }
+
+-uLong ZEXPORT zlibCompileFlags()
++uLong ZEXPORT zlibCompileFlags(void)
+ {
+ uLong flags;
+
+--
+2.37.2
+
diff --git a/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch
new file mode 100644
index 000000000..1d9c4bfe4
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch
@@ -0,0 +1,68 @@
+From e64a58387db46239902b610871a0eb81626e99ff Mon Sep 17 00:00:00 2001
+From: Paul Eggert
+Date: Thu, 18 Aug 2022 07:46:28 -0700
+Subject: [PATCH] Turn on -pedantic-errors at the end of 'configure'
+
+Problem reported by Khem Raj in:
+https://lists.gnu.org/r/autoconf-patches/2022-08/msg00009.html
+Upstream-Status: Submitted [https://lists.samba.org/archive/rsync/2022-August/032862.html]
+---
+ configure.ac | 35 ++++++++++++++++++++---------------
+ 1 file changed, 20 insertions(+), 15 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index d185b2d3..7e9514f7 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1071,21 +1071,6 @@ elif test x"$ac_cv_header_popt_h" != x"yes"; then
+ with_included_popt=yes
+ fi
+
+-if test x"$GCC" = x"yes"; then
+- if test x"$with_included_popt" != x"yes"; then
+- # Turn pedantic warnings into errors to ensure an array-init overflow is an error.
+- CFLAGS="$CFLAGS -pedantic-errors"
+- else
+- # Our internal popt code cannot be compiled with pedantic warnings as errors, so try to
+- # turn off pedantic warnings (which will not lose the error for array-init overflow).
+- # Older gcc versions don't understand -Wno-pedantic, so check if --help=warnings lists
+- # -Wpedantic and use that as a flag.
+- case `$CC --help=warnings 2>/dev/null | grep Wpedantic` in
+- *-Wpedantic*) CFLAGS="$CFLAGS -pedantic-errors -Wno-pedantic" ;;
+- esac
+- fi
+-fi
+-
+ AC_MSG_CHECKING([whether to use included libpopt])
+ if test x"$with_included_popt" = x"yes"; then
+ AC_MSG_RESULT($srcdir/popt)
+@@ -1444,6 +1429,26 @@ case "$CC" in
+ ;;
+ esac
+
++# Enable -pedantic-errors last, so that it doesn't mess up other
++# 'configure' tests. For example, Autoconf uses empty function
++# prototypes like 'int main () {}' which Clang 15's -pedantic-errors
++# would reject. Generally it's not a good idea to try to run
++# 'configure' itself with strict compiler checking.
++if test x"$GCC" = x"yes"; then
++ if test x"$with_included_popt" != x"yes"; then
++ # Turn pedantic warnings into errors to ensure an array-init overflow is an error.
++ CFLAGS="$CFLAGS -pedantic-errors"
++ else
++ # Our internal popt code cannot be compiled with pedantic warnings as errors, so try to
++ # turn off pedantic warnings (which will not lose the error for array-init overflow).
++ # Older gcc versions don't understand -Wno-pedantic, so check if --help=warnings lists
++ # -Wpedantic and use that as a flag.
++ case `$CC --help=warnings 2>/dev/null | grep Wpedantic` in
++ *-Wpedantic*) CFLAGS="$CFLAGS -pedantic-errors -Wno-pedantic" ;;
++ esac
++ fi
++fi
++
+ AC_CONFIG_FILES([Makefile lib/dummy zlib/dummy popt/dummy shconfig])
+ AC_OUTPUT
+
+--
+2.37.1
+
diff --git a/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/determism.patch b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/determism.patch
new file mode 100644
index 000000000..e3494fdde
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/determism.patch
@@ -0,0 +1,34 @@
+The Makefile calls awk on a "*.c" glob. The results of this glob are sorted
+but the order depends on the locale settings, particularly whether
+"util.c" and "util2.c" sort before or after each other. In en_US.UTF-8
+they sort one way, in C, they sort the other. The sorting order changes
+the output binaries. The behaviour also changes dependning on whether
+SHELL (/bin/sh) is dash or bash.
+
+Specify a C locale setting to be deterministic.
+
+Signed-off-by: Richard Purdie
+Submitted: https://github.com/WayneD/rsync/pull/155
+
+Upstream-Status: Backport [ish, see below]
+
+After discussion upstream renamed util.c to util1.c which avoids the problem
+in a different way. This patch can be dropped when we upgrade to include:
+https://github.com/WayneD/rsync/commit/d3085f7add38a5cf833a0b31cb0637ff46c80f8d
+
+Index: rsync-3.2.3/Makefile.in
+===================================================================
+--- rsync-3.2.3.orig/Makefile.in
++++ rsync-3.2.3/Makefile.in
+@@ -26,6 +26,11 @@ MKDIR_P=@MKDIR_P@
+ VPATH=$(srcdir)
+ SHELL=/bin/sh
+
++# We use globbing in commands, need to be deterministic
++unexport LC_ALL
++LC_COLLATE=C
++export LC_COLLATE
++
+ .SUFFIXES:
+ .SUFFIXES: .c .o
+
diff --git a/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/makefile-no-rebuild.patch b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/makefile-no-rebuild.patch
new file mode 100644
index 000000000..92ed1f441
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/makefile-no-rebuild.patch
@@ -0,0 +1,80 @@
+From 81700d1a0e51391028c761cc8ef1cd660084d114 Mon Sep 17 00:00:00 2001
+From: Ross Burton
+Date: Tue, 12 Apr 2016 15:51:54 +0100
+Subject: [PATCH] rsync: remove upstream's rebuild logic
+
+Remove the Makefile rules to reinvoke autoconf, they're not out-of-tree safe and
+generally overcomplicated, and we ensure that autoreconf is invoked if required.
+
+Upstream-Status: Inappropriate
+Signed-off-by: Ross Burton
+
+---
+ Makefile.in | 54 -----------------------------------------------------
+ 1 file changed, 54 deletions(-)
+
+diff --git a/Makefile.in b/Makefile.in
+index 3cde955..d963a70 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -190,60 +190,6 @@ gensend: gen
+ fi
+ rsync -aic $(GENFILES) git-version.h $${SAMBA_HOST-samba.org}:/home/ftp/pub/rsync/generated-files/ || true
+
+-aclocal.m4: $(srcdir)/m4/*.m4
+- aclocal -I $(srcdir)/m4
+-
+-configure.sh config.h.in: configure.ac aclocal.m4
+- @if test -f configure.sh; then cp -p configure.sh configure.sh.old; else touch configure.sh.old; fi
+- @if test -f config.h.in; then cp -p config.h.in config.h.in.old; else touch config.h.in.old; fi
+- autoconf -o configure.sh
+- autoheader && touch config.h.in
+- @if diff configure.sh configure.sh.old >/dev/null 2>&1; then \
+- echo "configure.sh is unchanged."; \
+- rm configure.sh.old; \
+- else \
+- echo "configure.sh has CHANGED."; \
+- fi
+- @if diff config.h.in config.h.in.old >/dev/null 2>&1; then \
+- echo "config.h.in is unchanged."; \
+- rm config.h.in.old; \
+- else \
+- echo "config.h.in has CHANGED."; \
+- fi
+- @if test -f configure.sh.old || test -f config.h.in.old; then \
+- if test "$(MAKECMDGOALS)" = reconfigure; then \
+- echo 'Continuing with "make reconfigure".'; \
+- else \
+- echo 'You may need to run:'; \
+- echo ' make reconfigure'; \
+- exit 1; \
+- fi \
+- fi
+-
+-.PHONY: reconfigure
+-reconfigure: configure.sh
+- ./config.status --recheck
+- ./config.status
+-
+-.PHONY: restatus
+-restatus:
+- ./config.status
+-
+-Makefile: Makefile.in config.status configure.sh config.h.in
+- @if test -f Makefile; then cp -p Makefile Makefile.old; else touch Makefile.old; fi
+- @./config.status
+- @if diff Makefile Makefile.old >/dev/null 2>&1; then \
+- echo "Makefile is unchanged."; \
+- rm Makefile.old; \
+- else \
+- if test "$(MAKECMDGOALS)" = reconfigure; then \
+- echo 'Continuing with "make reconfigure".'; \
+- else \
+- echo "Makefile updated -- rerun your make command."; \
+- exit 1; \
+- fi \
+- fi
+-
+ stunnel-rsyncd.conf: $(srcdir)/stunnel-rsyncd.conf.in Makefile
+ sed 's;\@bindir\@;$(bindir);g' <$(srcdir)/stunnel-rsyncd.conf.in >stunnel-rsyncd.conf
+
diff --git a/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/rsyncd.conf b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/rsyncd.conf
new file mode 100644
index 000000000..845f5b33f
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/files/rsyncd.conf
@@ -0,0 +1,15 @@
+# /etc/rsyncd.conf
+
+# Minimal configuration file for rsync daemon
+# See rsync(1) and rsyncd.conf(5) man pages for help
+
+# This file is required by rsync --daemon
+pid file = /var/run/rsyncd.pid
+use chroot = yes
+read only = yes
+
+# Simple example for enabling your own local rsync server
+#[everything]
+# path = /
+# comment = Everything except /etc exposed
+# exclude = /etc
diff --git a/meta-openbmc-mods/meta-common/recipes-devtools/rsync/rsync_3.2.5.bb b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/rsync_3.2.5.bb
new file mode 100644
index 000000000..983bdd5ab
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-devtools/rsync/rsync_3.2.5.bb
@@ -0,0 +1,72 @@
+SUMMARY = "File synchronization tool"
+HOMEPAGE = "http://rsync.samba.org/"
+DESCRIPTION = "rsync is an open source utility that provides fast incremental file transfer."
+BUGTRACKER = "http://rsync.samba.org/bugzilla.html"
+SECTION = "console/network"
+# GPL-2.0-or-later (<< 3.0.0), GPL-3.0-or-later (>= 3.0.0)
+# Includes opennsh and xxhash dynamic link exception
+LICENSE = "GPL-3.0-or-later"
+LIC_FILES_CHKSUM = "file://COPYING;md5=24423708fe159c9d12be1ea29fcb18c7"
+
+DEPENDS = "popt"
+
+SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
+ file://rsyncd.conf \
+ file://makefile-no-rebuild.patch \
+ file://determism.patch \
+ file://0001-Add-missing-prototypes-to-function-declarations.patch \
+ file://0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch \
+ "
+
+SRC_URI[sha256sum] = "2ac4d21635cdf791867bc377c35ca6dda7f50d919a58be45057fd51600c69aba"
+
+# -16548 required for v3.1.3pre1. Already in v3.1.3.
+CVE_CHECK_IGNORE += " CVE-2017-16548 "
+
+inherit autotools-brokensep
+
+PACKAGECONFIG ??= "acl attr \
+ ${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)} \
+"
+
+PACKAGECONFIG[acl] = "--enable-acl-support,--disable-acl-support,acl,"
+PACKAGECONFIG[attr] = "--enable-xattr-support,--disable-xattr-support,attr,"
+PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6,"
+PACKAGECONFIG[lz4] = "--enable-lz4,--disable-lz4,lz4"
+PACKAGECONFIG[openssl] = "--enable-openssl,--disable-openssl,openssl"
+PACKAGECONFIG[xxhash] = "--enable-xxhash,--disable-xxhash,xxhash"
+PACKAGECONFIG[zstd] = "--enable-zstd,--disable-zstd,zstd"
+
+# By default, if crosscompiling, rsync disables a number of
+# capabilities, hardlinking symlinks and special files (i.e. devices)
+CACHED_CONFIGUREVARS += "rsync_cv_can_hardlink_special=yes rsync_cv_can_hardlink_symlink=yes"
+
+EXTRA_OEMAKE = 'STRIP=""'
+EXTRA_OECONF = "--disable-md2man --with-nobody-group=nogroup"
+
+#| ./simd-checksum-x86_64.cpp: In function 'uint32_t get_checksum1_cpp(char*, int32_t)':
+#| ./simd-checksum-x86_64.cpp:89:52: error: multiversioning needs 'ifunc' which is not supported on this target
+#| 89 | __attribute__ ((target("default"))) MVSTATIC int32 get_checksum1_avx2_64(schar* buf, int32 len, int32 i, uint32* ps1, uint32* ps2) { return i; }
+#| | ^~~~~~~~~~~~~~~~~~~~~
+#| ./simd-checksum-x86_64.cpp:480:1: error: use of multiversioned function without a default
+#| 480 | }
+#| | ^
+#| If you can't fix the issue, re-run ./configure with --disable-roll-simd.
+EXTRA_OECONF:append:libc-musl = " --disable-roll-simd"
+
+# rsync 3.0 uses configure.sh instead of configure, and
+# makefile checks the existence of configure.sh
+do_configure:prepend () {
+ rm -f ${S}/configure ${S}/configure.sh
+}
+
+do_configure:append () {
+ cp -f ${S}/configure ${S}/configure.sh
+}
+
+do_install:append() {
+ install -d ${D}${sysconfdir}
+ install -m 0644 ${WORKDIR}/rsyncd.conf ${D}${sysconfdir}
+}
+
+BBCLASSEXTEND = "native nativesdk"
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20158-1.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20158-1.patch
new file mode 100644
index 000000000..ace5ed4ab
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-20158-1.patch
@@ -0,0 +1,55 @@
+From 0b3ea0926afb8dde70cfab00316ae0a70b93a7cc Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig
+Date: Fri, 5 Nov 2021 13:36:58 -0700
+Subject: [PATCH] fs: explicitly unregister per-superblock BDIs
+
+Add a new SB_I_ flag to mark superblocks that have an ephemeral bdi
+associated with them, and unregister it when the superblock is shut
+down.
+
+Link: https://lkml.kernel.org/r/20211021124441.668816-4-hch@lst.de
+Signed-off-by: Christoph Hellwig
+Reviewed-by: Jan Kara
+Cc: Miquel Raynal
+Cc: Richard Weinberger
+Cc: Vignesh Raghavendra
+Signed-off-by: Andrew Morton
+Signed-off-by: Linus Torvalds
+---
+ fs/super.c | 3 +++
+ include/linux/fs.h | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/fs/super.c b/fs/super.c
+index bcef3a6f4c4b5..3bfc0f8fbd5bc 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -476,6 +476,8 @@ void generic_shutdown_super(struct super_block *sb)
+ spin_unlock(&sb_lock);
+ up_write(&sb->s_umount);
+ if (sb->s_bdi != &noop_backing_dev_info) {
++ if (sb->s_iflags & SB_I_PERSB_BDI)
++ bdi_unregister(sb->s_bdi);
+ bdi_put(sb->s_bdi);
+ sb->s_bdi = &noop_backing_dev_info;
+ }
+@@ -1562,6 +1564,7 @@ int super_setup_bdi_name(struct super_block *sb, char *fmt, ...)
+ }
+ WARN_ON(sb->s_bdi != &noop_backing_dev_info);
+ sb->s_bdi = bdi;
++ sb->s_iflags |= SB_I_PERSB_BDI;
+
+ return 0;
+ }
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index e7a633353fd20..226de651f52e6 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -1443,6 +1443,7 @@ extern int send_sigurg(struct fown_struct *fown);
+ #define SB_I_UNTRUSTED_MOUNTER 0x00000040
+
+ #define SB_I_SKIP_SYNC 0x00000100 /* Skip superblock at global sync */
++#define SB_I_PERSB_BDI 0x00000200 /* has a per-sb bdi */
+
+ /* Possible states of 'frozen' field */
+ enum {
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-1.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-1.patch
new file mode 100644
index 000000000..bc459492c
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-1.patch
@@ -0,0 +1,76 @@
+From e8d5dfd1d8747b56077d02664a8838c71ced948e Mon Sep 17 00:00:00 2001
+From: David Leadbeater
+Date: Fri, 26 Aug 2022 14:56:57 +1000
+Subject: [PATCH] netfilter: nf_conntrack_irc: Tighten matching on DCC message
+
+CTCP messages should only be at the start of an IRC message, not
+anywhere within it.
+
+While the helper only decodes packes in the ORIGINAL direction, its
+possible to make a client send a CTCP message back by empedding one into
+a PING request. As-is, thats enough to make the helper believe that it
+saw a CTCP message.
+
+Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port")
+Signed-off-by: David Leadbeater
+Signed-off-by: Florian Westphal
+---
+ net/netfilter/nf_conntrack_irc.c | 34 ++++++++++++++++++++++++++------
+ 1 file changed, 28 insertions(+), 6 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
+index 992decbcaa5c1e..5703846bea3b69 100644
+--- a/net/netfilter/nf_conntrack_irc.c
++++ b/net/netfilter/nf_conntrack_irc.c
+@@ -157,15 +157,37 @@ static int help(struct sk_buff *skb, unsigned int protoff,
+ data = ib_ptr;
+ data_limit = ib_ptr + datalen;
+
+- /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
+- * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
+- while (data < data_limit - (19 + MINMATCHLEN)) {
+- if (memcmp(data, "\1DCC ", 5)) {
++ /* Skip any whitespace */
++ while (data < data_limit - 10) {
++ if (*data == ' ' || *data == '\r' || *data == '\n')
++ data++;
++ else
++ break;
++ }
++
++ /* strlen("PRIVMSG x ")=10 */
++ if (data < data_limit - 10) {
++ if (strncasecmp("PRIVMSG ", data, 8))
++ goto out;
++ data += 8;
++ }
++
++ /* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26
++ * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26
++ */
++ while (data < data_limit - (21 + MINMATCHLEN)) {
++ /* Find first " :", the start of message */
++ if (memcmp(data, " :", 2)) {
+ data++;
+ continue;
+ }
++ data += 2;
++
++ /* then check that place only for the DCC command */
++ if (memcmp(data, "\1DCC ", 5))
++ goto out;
+ data += 5;
+- /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
++ /* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */
+
+ iph = ip_hdr(skb);
+ pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
+@@ -181,7 +203,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
+ pr_debug("DCC %s detected\n", dccprotos[i]);
+
+ /* we have at least
+- * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
++ * (21+MINMATCHLEN)-7-dccprotos[i].matchlen bytes valid
+ * data left (== 14/13 bytes) */
+ if (parse_dcc(data, data_limit, &dcc_ip,
+ &dcc_port, &addr_beg_p, &addr_end_p)) {
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-2.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-2.patch
new file mode 100644
index 000000000..849183f7d
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2022-2663-2.patch
@@ -0,0 +1,35 @@
+From 0efe125cfb99e6773a7434f3463f7c2fa28f3a43 Mon Sep 17 00:00:00 2001
+From: David Leadbeater
+Date: Fri, 26 Aug 2022 14:56:58 +1000
+Subject: [PATCH] netfilter: nf_conntrack_irc: Fix forged IP logic
+
+Ensure the match happens in the right direction, previously the
+destination used was the server, not the NAT host, as the comment
+shows the code intended.
+
+Additionally nf_nat_irc uses port 0 as a signal and there's no valid way
+it can appear in a DCC message, so consider port 0 also forged.
+
+Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port")
+Signed-off-by: David Leadbeater
+Signed-off-by: Pablo Neira Ayuso
+---
+ net/netfilter/nf_conntrack_irc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
+index 1796c456ac98be..992decbcaa5c1e 100644
+--- a/net/netfilter/nf_conntrack_irc.c
++++ b/net/netfilter/nf_conntrack_irc.c
+@@ -194,8 +194,9 @@ static int help(struct sk_buff *skb, unsigned int protoff,
+
+ /* dcc_ip can be the internal OR external (NAT'ed) IP */
+ tuple = &ct->tuplehash[dir].tuple;
+- if (tuple->src.u3.ip != dcc_ip &&
+- tuple->dst.u3.ip != dcc_ip) {
++ if ((tuple->src.u3.ip != dcc_ip &&
++ ct->tuplehash[!dir].tuple.dst.u3.ip != dcc_ip) ||
++ dcc_port == 0) {
+ net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
+ &tuple->src.u3.ip,
+ &dcc_ip, dcc_port);
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend
index a8d09586b..92620086d 100644
--- a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend
@@ -49,6 +49,9 @@ SRC_URI += " \
file://CVE-2022-20368.patch\
file://CVE-2022-0168.patch\
file://CVE-2022-40476.patch\
+ file://CVE-2022-2663-1.patch\
+ file://CVE-2022-2663-2.patch\
+ file://CVE-2022-20158-1.patch\
"
SRC_URI += "${@bb.utils.contains('IMAGE_FSTYPES', 'intel-pfr', 'file://1000-128MB-flashmap-for-PFR.patch', '', d)}"
--
cgit v1.2.3