14 files changed, 143 insertions, 313 deletions
diff --git a/poky/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-48434.patch b/poky/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-48434.patch
new file mode 100644
index 0000000000..3cd374dc39
--- /dev/null
+++ b/poky/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-48434.patch
@@ -0,0 +1,130 @@
+From e40c964a0678908e2c756741343ed50d6a99ee12 Mon Sep 17 00:00:00 2001
+From: Anton Khirnov <anton@khirnov.net>
+Date: Fri, 28 Apr 2023 11:45:30 +0000
+Subject: [PATCH] lavc/pthread_frame: avoid leaving stale hwaccel state in
+ worker threads
+
+This state is not refcounted, so make sure it always has a well-defined
+owner.
+
+Remove the block added in 091341f, as
+this commit also solves that issue in a more general way.
+
+CVE:CVE-2022-48434
+
+Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/cc867f2c09d2b69cee8a0eccd62aff002cbbfe11]
+
+Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
+---
+ libavcodec/pthread_frame.c | 46 +++++++++++++++++++++++++++++---------
+ 1 file changed, 35 insertions(+), 11 deletions(-)
+
+diff --git a/libavcodec/pthread_frame.c b/libavcodec/pthread_frame.c
+index 85a6bc9..e40dced 100644
+--- a/libavcodec/pthread_frame.c
++++ b/libavcodec/pthread_frame.c
+@@ -145,6 +145,12 @@ typedef struct FrameThreadContext {
+                                     * Set for the first N packets, where N is the number of threads.
+                                     * While it is set, ff_thread_en/decode_frame won't return any results.
+                                     */
++
++    /* hwaccel state is temporarily stored here in order to transfer its ownership
++     * to the next decoding thread without the need for extra synchronization */
++    const AVHWAccel *stash_hwaccel;
++    void            *stash_hwaccel_context;
++    void            *stash_hwaccel_priv;
+ } FrameThreadContext;
+ 
+ #if FF_API_THREAD_SAFE_CALLBACKS
+@@ -229,9 +235,17 @@ FF_ENABLE_DEPRECATION_WARNINGS
+             ff_thread_finish_setup(avctx);
+ 
+         if (p->hwaccel_serializing) {
++            /* wipe hwaccel state to avoid stale pointers lying around;
++             * the state was transferred to FrameThreadContext in
++             * ff_thread_finish_setup(), so nothing is leaked */
++            avctx->hwaccel                     = NULL;
++            avctx->hwaccel_context             = NULL;
++            avctx->internal->hwaccel_priv_data = NULL;
++
+             p->hwaccel_serializing = 0;
+             pthread_mutex_unlock(&p->parent->hwaccel_mutex);
+         }
++        av_assert0(!avctx->hwaccel);
+ 
+         if (p->async_serializing) {
+             p->async_serializing = 0;
+@@ -294,14 +308,10 @@ static int update_context_from_thread(AVCodecContext *dst, AVCodecContext *src,
+         dst->color_range = src->color_range;
+         dst->chroma_sample_location = src->chroma_sample_location;
+ 
+-        dst->hwaccel = src->hwaccel;
+-        dst->hwaccel_context = src->hwaccel_context;
+-
+         dst->channels       = src->channels;
+         dst->sample_rate    = src->sample_rate;
+         dst->sample_fmt     = src->sample_fmt;
+         dst->channel_layout = src->channel_layout;
+-        dst->internal->hwaccel_priv_data = src->internal->hwaccel_priv_data;
+ 
+         if (!!dst->hw_frames_ctx != !!src->hw_frames_ctx ||
+             (dst->hw_frames_ctx && dst->hw_frames_ctx->data != src->hw_frames_ctx->data)) {
+@@ -442,6 +452,12 @@ static int submit_packet(PerThreadContext *p, AVCodecContext *user_avctx,
+             pthread_mutex_unlock(&p->mutex);
+             return err;
+         }
++
++        /* transfer hwaccel state stashed from previous thread, if any */
++        av_assert0(!p->avctx->hwaccel);
++        FFSWAP(const AVHWAccel*, p->avctx->hwaccel,                     fctx->stash_hwaccel);
++        FFSWAP(void*,            p->avctx->hwaccel_context,             fctx->stash_hwaccel_context);
++        FFSWAP(void*,            p->avctx->internal->hwaccel_priv_data, fctx->stash_hwaccel_priv);
+     }
+ 
+     av_packet_unref(p->avpkt);
+@@ -647,6 +663,14 @@ void ff_thread_finish_setup(AVCodecContext *avctx) {
+         async_lock(p->parent);
+     }
+ 
++    /* save hwaccel state for passing to the next thread;
++     * this is done here so that this worker thread can wipe its own hwaccel
++     * state after decoding, without requiring synchronization */
++    av_assert0(!p->parent->stash_hwaccel);
++    p->parent->stash_hwaccel         = avctx->hwaccel;
++    p->parent->stash_hwaccel_context = avctx->hwaccel_context;
++    p->parent->stash_hwaccel_priv    = avctx->internal->hwaccel_priv_data;
++
+     pthread_mutex_lock(&p->progress_mutex);
+     if(atomic_load(&p->state) == STATE_SETUP_FINISHED){
+         av_log(avctx, AV_LOG_WARNING, "Multiple ff_thread_finish_setup() calls\n");
+@@ -700,13 +724,6 @@ void ff_frame_thread_free(AVCodecContext *avctx, int thread_count)
+ 
+     park_frame_worker_threads(fctx, thread_count);
+ 
+-    if (fctx->prev_thread && avctx->internal->hwaccel_priv_data !=
+-                             fctx->prev_thread->avctx->internal->hwaccel_priv_data) {
+-        if (update_context_from_thread(avctx, fctx->prev_thread->avctx, 1) < 0) {
+-            av_log(avctx, AV_LOG_ERROR, "Failed to update user thread.\n");
+-        }
+-    }
+-
+     if (fctx->prev_thread && fctx->prev_thread != fctx->threads)
+         if (update_context_from_thread(fctx->threads->avctx, fctx->prev_thread->avctx, 0) < 0) {
+             av_log(avctx, AV_LOG_ERROR, "Final thread update failed\n");
+@@ -760,6 +777,13 @@ void ff_frame_thread_free(AVCodecContext *avctx, int thread_count)
+     av_freep(&fctx->threads);
+     ff_pthread_free(fctx, thread_ctx_offsets);
+ 
++    /* if we have stashed hwaccel state, move it to the user-facing context,
++     * so it will be freed in avcodec_close() */
++    av_assert0(!avctx->hwaccel);
++    FFSWAP(const AVHWAccel*, avctx->hwaccel,                     fctx->stash_hwaccel);
++    FFSWAP(void*,            avctx->hwaccel_context,             fctx->stash_hwaccel_context);
++    FFSWAP(void*,            avctx->internal->hwaccel_priv_data, fctx->stash_hwaccel_priv);
++
+     av_freep(&avctx->internal->thread_ctx);
+ }
+ 
+-- 
+2.40.0
+
diff --git a/poky/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.1.bb b/poky/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.1.bb
index 4bcbda9976..6ece34fcfd 100644
--- a/poky/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.1.bb
+++ b/poky/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.1.bb
@@ -28,7 +28,8 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
            file://0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch \
            file://0001-avcodec-vp3-Add-missing-check-for-av_malloc.patch \
            file://0001-avformat-nutdec-Add-check-for-avformat_new_stream.patch \
-           "
+           file://CVE-2022-48434.patch \
+          "
 
 SRC_URI[sha256sum] = "ef2efae259ce80a240de48ec85ecb062cecca26e4352ffb3fda562c21a93007b"
 
diff --git a/poky/meta/recipes-multimedia/gstreamer/gst-devtools_1.20.5.bb b/poky/meta/recipes-multimedia/gstreamer/gst-devtools_1.20.6.bb
index 9db31c18e4..2eee50e6d8 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gst-devtools_1.20.5.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gst-devtools_1.20.6.bb
@@ -12,7 +12,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${PV}
            file://0001-connect-has-a-different-signature-on-musl.patch \
            "
 
-SRC_URI[sha256sum] = "5684436121b8bae07fd00b74395f95e44b5f26323dce4fa045fa665676807bba"
+SRC_URI[sha256sum] = "2c64037c823fb88751a47dacf3d4752a52b7951190d6e05fc44855e912e81d71"
 
 DEPENDS = "json-glib glib-2.0 glib-2.0-native gstreamer1.0 gstreamer1.0-plugins-base"
 RRECOMMENDS:${PN} = "git"
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.20.5.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.20.6.bb
index e5925c6510..c54913e8a1 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.20.5.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.20.6.bb
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=69333daa044cb77e486cc36129f7a770 \
                     "
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${PV}.tar.xz"
-SRC_URI[sha256sum] = "b152e3cc49d014899f53c39d8a6224a44e1399b4cf76aa5f9a903fdf9793c3cc"
+SRC_URI[sha256sum] = "7d619a030542a4a5a11e0302742a3d9b05f8e5cfc453025683a0379bc50aa013"
 
 S = "${WORKDIR}/gst-libav-${PV}"
 
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-omx_1.20.5.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-omx_1.20.6.bb
index ec5efcd408..b29d393bfe 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-omx_1.20.5.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-omx_1.20.6.bb
@@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c \
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/gst-omx/gst-omx-${PV}.tar.xz"
 
-SRC_URI[sha256sum] = "bcccbc02548cdc123fd49944dd44a4f1adc5d107e36f010d320eb526e2107806"
+SRC_URI[sha256sum] = "48e82008a2a0ad5f4b525aba8a6c49c4ca2d7d25c6b1b14d107dd747e26d5a8e"
 
 S = "${WORKDIR}/gst-omx-${PV}"
 
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.5.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.6.bb
index 80766b9166..fdb4509691 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.5.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.6.bb
@@ -11,7 +11,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad
            file://0003-ensure-valid-sentinals-for-gst_structure_get-etc.patch \
            file://0004-opencv-resolve-missing-opencv-data-dir-in-yocto-buil.patch \
            "
-SRC_URI[sha256sum] = "f431214b0754d7037adcde93c3195106196588973e5b32dcb24938805f866363"
+SRC_URI[sha256sum] = "d98c73fa5cdddb372a91199464515cfc80c89bbe05e3d4387ea4381e4224483a"
 
 S = "${WORKDIR}/gst-plugins-bad-${PV}"
 
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.5.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.6.bb
index c37b542c57..8d1aef1fc8 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.5.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.6.bb
@@ -11,7 +11,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-ba
            file://0003-viv-fb-Make-sure-config.h-is-included.patch \
            file://0002-ssaparse-enhance-SSA-text-lines-parsing.patch \
            "
-SRC_URI[sha256sum] = "11f911ef65f3095d7cf698a1ad1fc5242ac3ad6c9270465fb5c9e7f4f9c19b35"
+SRC_URI[sha256sum] = "54eac357d6cd66f183b94a26e493bf4d5781bc76bc60cad122742626caf8f1a3"
 
 S = "${WORKDIR}/gst-plugins-base-${PV}"
 
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.20.5.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.20.6.bb
index 80aed01973..81f5dd0932 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.20.5.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.20.6.bb
@@ -8,7 +8,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-go
            file://0001-qt-include-ext-qt-gstqtgl.h-instead-of-gst-gl-gstglf.patch \
            "
 
-SRC_URI[sha256sum] = "e83ab4d12ca24959489bbb0ec4fac9b90e32f741d49cda357cb554b2cb8b97f9"
+SRC_URI[sha256sum] = "e51365cfa9b19bd736dafe2c8828254a55d66996a3c60550bb0d50041c381a44"
 
 S = "${WORKDIR}/gst-plugins-good-${PV}"
 
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.20.5.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.20.6.bb
index f765e626c9..e62e9e9815 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.20.5.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.20.6.bb
@@ -14,7 +14,7 @@ LICENSE_FLAGS = "commercial"
 SRC_URI = " \
             https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${PV}.tar.xz \
             "
-SRC_URI[sha256sum] = "af67d8ba7cab230f64d0594352112c2c443e2aa36a87c35f9f98a43d11430b87"
+SRC_URI[sha256sum] = "ca3fb6abc9f6e981d204a736c254e50cc1786a2f5038d83023e42ea009b10246"
 
 S = "${WORKDIR}/gst-plugins-ugly-${PV}"
 
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.20.5.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.20.6.bb
index 05e9ace276..77745b8ba9 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.20.5.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.20.6.bb
@@ -8,7 +8,7 @@ LICENSE = "LGPL-2.1-or-later"
 LIC_FILES_CHKSUM = "file://COPYING;md5=c34deae4e395ca07e725ab0076a5f740"
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz"
-SRC_URI[sha256sum] = "27487652318659cfd7dc42784b713c78d29cc7a7df4fb397134c8c125f65e3b2"
+SRC_URI[sha256sum] = "aa619e08ddd9f92755f4bd24ba9577e81ae4c86bff170c3e574153ec3cdc80cc"
 
 DEPENDS = "gstreamer1.0 gstreamer1.0-plugins-base python3-pygobject"
 RDEPENDS:${PN} += "gstreamer1.0 gstreamer1.0-plugins-base python3-pygobject"
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.20.5.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.20.6.bb
index c9cf42903d..017edec426 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.20.5.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.20.6.bb
@@ -10,7 +10,7 @@ PNREAL = "gst-rtsp-server"
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz"
 
-SRC_URI[sha256sum] = "ba398a7ddd559cce56ef4b91f448d174e0dccad98a493563d2d59c41a2ef39c5"
+SRC_URI[sha256sum] = "800122a798387bd4b18b558737d30a010d94154f41bd210d4c4cc2d80ecae90f"
 
 S = "${WORKDIR}/${PNREAL}-${PV}"
 
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.20.5.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.20.6.bb
index 716f50ebe1..d67abf408c 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.20.5.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.20.6.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING.LIB;md5=4fbd65380cdd255951079008b364516c"
 
 SRC_URI = "https://gstreamer.freedesktop.org/src/${REALPN}/${REALPN}-${PV}.tar.xz"
 
-SRC_URI[sha256sum] = "510c6fb4ff3f676d7946ce1800e04ccf5aabe5a586d4e164d1961808fab8c94b"
+SRC_URI[sha256sum] = "57028a2cdabb749eb38a53f45cfa36f02b4e5368fb6d8684ef31d9e73ddf653b"
 
 S = "${WORKDIR}/${REALPN}-${PV}"
 DEPENDS = "libva gstreamer1.0 gstreamer1.0-plugins-base gstreamer1.0-plugins-bad"
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0/0005-bin-Fix-race-conditions-in-tests.patch b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0/0005-bin-Fix-race-conditions-in-tests.patch
deleted file mode 100644
index f1fac2df57..0000000000
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0/0005-bin-Fix-race-conditions-in-tests.patch
+++ /dev/null
@@ -1,300 +0,0 @@
-From e1e2d8d58c1e09e065849cdb1f6466c0537a7c51 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Tue, 21 Jun 2022 11:51:35 +0300
-Subject: [PATCH] bin: Fix race conditions in tests
-
-The latency messages are non-deterministic and can arrive before/after
-async-done or during state-changes as they are posted by e.g. sinks from
-their streaming thread but bins are finishing asynchronous state changes
-from a secondary helper thread.
-
-To solve this, expect latency messages at any time and assert that we
-receive one at some point during the test.
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2643>
-
-Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2643]
-Signed-off-by: Jose Quaresma <quaresma.jose@gmail.com>
----
- .../gstreamer/tests/check/gst/gstbin.c        | 132 ++++++++++++------
- 1 file changed, 92 insertions(+), 40 deletions(-)
-
-diff --git a/subprojects/gstreamer/tests/check/gst/gstbin.c b/subprojects/gstreamer/tests/check/gst/gstbin.c
-index e366d5fe20f..88ff44db0c3 100644
---- a/subprojects/gstreamer/tests/check/gst/gstbin.c
-+++ b/subprojects/gstreamer/tests/check/gst/gstbin.c
-@@ -27,50 +27,95 @@
- #include <gst/base/gstbasesrc.h>
- 
- static void
--pop_async_done (GstBus * bus)
-+pop_async_done (GstBus * bus, gboolean * had_latency)
- {
-   GstMessage *message;
-+  GstMessageType types = GST_MESSAGE_ASYNC_DONE;
-+
-+  if (!*had_latency)
-+    types |= GST_MESSAGE_LATENCY;
- 
-   GST_DEBUG ("popping async-done message");
--  message = gst_bus_poll (bus, GST_MESSAGE_ASYNC_DONE, -1);
- 
--  fail_unless (message && GST_MESSAGE_TYPE (message)
--      == GST_MESSAGE_ASYNC_DONE, "did not get GST_MESSAGE_ASYNC_DONE");
-+  do {
-+    message = gst_bus_poll (bus, types, -1);
- 
--  gst_message_unref (message);
--  GST_DEBUG ("popped message");
-+    fail_unless (message);
-+    GST_DEBUG ("popped message %s",
-+        gst_message_type_get_name (GST_MESSAGE_TYPE (message)));
-+
-+    if (GST_MESSAGE_TYPE (message) == GST_MESSAGE_LATENCY) {
-+      fail_unless (*had_latency == FALSE);
-+      *had_latency = TRUE;
-+      gst_clear_message (&message);
-+      types &= ~GST_MESSAGE_LATENCY;
-+      continue;
-+    }
-+
-+    fail_unless (GST_MESSAGE_TYPE (message)
-+        == GST_MESSAGE_ASYNC_DONE, "did not get GST_MESSAGE_ASYNC_DONE");
-+
-+    gst_clear_message (&message);
-+    break;
-+  } while (TRUE);
- }
- 
- static void
--pop_latency (GstBus * bus)
-+pop_latency (GstBus * bus, gboolean * had_latency)
- {
-   GstMessage *message;
- 
--  GST_DEBUG ("popping async-done message");
-+  if (*had_latency)
-+    return;
-+
-+  GST_DEBUG ("popping latency message");
-   message = gst_bus_poll (bus, GST_MESSAGE_LATENCY, -1);
- 
--  fail_unless (message && GST_MESSAGE_TYPE (message)
-+  fail_unless (message);
-+  fail_unless (GST_MESSAGE_TYPE (message)
-       == GST_MESSAGE_LATENCY, "did not get GST_MESSAGE_LATENCY");
- 
--  gst_message_unref (message);
--  GST_DEBUG ("popped message");
-+  GST_DEBUG ("popped message %s",
-+      gst_message_type_get_name (GST_MESSAGE_TYPE (message)));
-+  gst_clear_message (&message);
-+
-+  *had_latency = TRUE;
- }
- 
- static void
--pop_state_changed (GstBus * bus, int count)
-+pop_state_changed (GstBus * bus, int count, gboolean * had_latency)
- {
-   GstMessage *message;
--
-+  GstMessageType types = GST_MESSAGE_STATE_CHANGED;
-   int i;
- 
-+  if (!*had_latency)
-+    types |= GST_MESSAGE_LATENCY;
-+
-   GST_DEBUG ("popping %d messages", count);
-   for (i = 0; i < count; ++i) {
--    message = gst_bus_poll (bus, GST_MESSAGE_STATE_CHANGED, -1);
--
--    fail_unless (message && GST_MESSAGE_TYPE (message)
--        == GST_MESSAGE_STATE_CHANGED, "did not get GST_MESSAGE_STATE_CHANGED");
--
--    gst_message_unref (message);
-+    do {
-+      message = gst_bus_poll (bus, types, -1);
-+
-+      fail_unless (message);
-+      GST_DEBUG ("popped message %s",
-+          gst_message_type_get_name (GST_MESSAGE_TYPE (message)));
-+
-+      if (GST_MESSAGE_TYPE (message) == GST_MESSAGE_LATENCY) {
-+        fail_unless (*had_latency == FALSE);
-+        *had_latency = TRUE;
-+        gst_clear_message (&message);
-+        types &= ~GST_MESSAGE_LATENCY;
-+        continue;
-+      }
-+
-+      fail_unless (GST_MESSAGE_TYPE (message)
-+          == GST_MESSAGE_STATE_CHANGED,
-+          "did not get GST_MESSAGE_STATE_CHANGED");
-+
-+      gst_message_unref (message);
-+      break;
-+    } while (TRUE);
-   }
-   GST_DEBUG ("popped %d messages", count);
- }
-@@ -538,6 +583,7 @@ GST_START_TEST (test_message_state_changed_children)
-   GstBus *bus;
-   GstStateChangeReturn ret;
-   GstState current, pending;
-+  gboolean had_latency = FALSE;
- 
-   pipeline = GST_PIPELINE (gst_pipeline_new (NULL));
-   fail_unless (pipeline != NULL, "Could not create pipeline");
-@@ -576,7 +622,7 @@ GST_START_TEST (test_message_state_changed_children)
-   ASSERT_OBJECT_REFCOUNT (sink, "sink", 2);
-   ASSERT_OBJECT_REFCOUNT (pipeline, "pipeline", 2);
- 
--  pop_state_changed (bus, 3);
-+  pop_state_changed (bus, 3, &had_latency);
-   fail_if (gst_bus_have_pending (bus), "unexpected pending messages");
- 
-   ASSERT_OBJECT_REFCOUNT (bus, "bus", 2);
-@@ -619,9 +665,9 @@ GST_START_TEST (test_message_state_changed_children)
-    * its state_change message */
-   ASSERT_OBJECT_REFCOUNT_BETWEEN (pipeline, "pipeline", 3, 4);
- 
--  pop_state_changed (bus, 3);
--  pop_async_done (bus);
--  pop_latency (bus);
-+  pop_state_changed (bus, 3, &had_latency);
-+  pop_async_done (bus, &had_latency);
-+  pop_latency (bus, &had_latency);
-   fail_if ((gst_bus_pop (bus)) != NULL);
- 
-   ASSERT_OBJECT_REFCOUNT_BETWEEN (bus, "bus", 2, 3);
-@@ -648,7 +694,7 @@ GST_START_TEST (test_message_state_changed_children)
-   ASSERT_OBJECT_REFCOUNT_BETWEEN (sink, "sink", 2, 4);
-   ASSERT_OBJECT_REFCOUNT (pipeline, "pipeline", 3);
- 
--  pop_state_changed (bus, 3);
-+  pop_state_changed (bus, 3, &had_latency);
-   fail_if ((gst_bus_pop (bus)) != NULL);
- 
-   ASSERT_OBJECT_REFCOUNT (bus, "bus", 2);
-@@ -669,7 +715,7 @@ GST_START_TEST (test_message_state_changed_children)
-   ASSERT_OBJECT_REFCOUNT_BETWEEN (sink, "sink", 3, 4);
-   ASSERT_OBJECT_REFCOUNT (pipeline, "pipeline", 3);
- 
--  pop_state_changed (bus, 6);
-+  pop_state_changed (bus, 6, &had_latency);
-   fail_if ((gst_bus_pop (bus)) != NULL);
- 
-   ASSERT_OBJECT_REFCOUNT (src, "src", 1);
-@@ -696,6 +742,7 @@ GST_START_TEST (test_watch_for_state_change)
-   GstElement *src, *sink, *bin;
-   GstBus *bus;
-   GstStateChangeReturn ret;
-+  gboolean had_latency = FALSE;
- 
-   bin = gst_element_factory_make ("bin", NULL);
-   fail_unless (bin != NULL, "Could not create bin");
-@@ -722,9 +769,9 @@ GST_START_TEST (test_watch_for_state_change)
-       GST_CLOCK_TIME_NONE);
-   fail_unless (ret == GST_STATE_CHANGE_SUCCESS);
- 
--  pop_state_changed (bus, 6);
--  pop_async_done (bus);
--  pop_latency (bus);
-+  pop_state_changed (bus, 6, &had_latency);
-+  pop_async_done (bus, &had_latency);
-+  pop_latency (bus, &had_latency);
- 
-   fail_unless (gst_bus_have_pending (bus) == FALSE,
-       "Unexpected messages on bus");
-@@ -732,16 +779,17 @@ GST_START_TEST (test_watch_for_state_change)
-   ret = gst_element_set_state (GST_ELEMENT (bin), GST_STATE_PLAYING);
-   fail_unless (ret == GST_STATE_CHANGE_SUCCESS);
- 
--  pop_state_changed (bus, 3);
-+  pop_state_changed (bus, 3, &had_latency);
- 
-+  had_latency = FALSE;
-   /* this one might return either SUCCESS or ASYNC, likely SUCCESS */
-   ret = gst_element_set_state (GST_ELEMENT (bin), GST_STATE_PAUSED);
-   gst_element_get_state (GST_ELEMENT (bin), NULL, NULL, GST_CLOCK_TIME_NONE);
- 
--  pop_state_changed (bus, 3);
-+  pop_state_changed (bus, 3, &had_latency);
-   if (ret == GST_STATE_CHANGE_ASYNC) {
--    pop_async_done (bus);
--    pop_latency (bus);
-+    pop_async_done (bus, &had_latency);
-+    pop_latency (bus, &had_latency);
-   }
- 
-   fail_unless (gst_bus_have_pending (bus) == FALSE,
-@@ -898,6 +946,7 @@ GST_START_TEST (test_children_state_change_order_flagged_sink)
-   GstStateChangeReturn ret;
-   GstState current, pending;
-   GstBus *bus;
-+  gboolean had_latency = FALSE;
- 
-   pipeline = gst_pipeline_new (NULL);
-   fail_unless (pipeline != NULL, "Could not create pipeline");
-@@ -951,10 +1000,11 @@ GST_START_TEST (test_children_state_change_order_flagged_sink)
-   ASSERT_STATE_CHANGE_MSG (bus, sink, GST_STATE_READY, GST_STATE_PAUSED, 107);
- #else
- 
--  pop_state_changed (bus, 2);   /* pop remaining ready => paused messages off the bus */
-+  pop_state_changed (bus, 2, &had_latency);     /* pop remaining ready => paused messages off the bus */
-   ASSERT_STATE_CHANGE_MSG (bus, pipeline, GST_STATE_READY, GST_STATE_PAUSED,
-       108);
--  pop_async_done (bus);
-+  pop_async_done (bus, &had_latency);
-+  pop_latency (bus, &had_latency);
- #endif
-   /* PAUSED => PLAYING */
-   GST_DEBUG ("popping PAUSED -> PLAYING messages");
-@@ -972,8 +1022,8 @@ GST_START_TEST (test_children_state_change_order_flagged_sink)
-   fail_if (ret != GST_STATE_CHANGE_SUCCESS, "State change to READY failed");
- 
-   /* TODO: do we need to check downwards state change order as well? */
--  pop_state_changed (bus, 4);   /* pop playing => paused messages off the bus */
--  pop_state_changed (bus, 4);   /* pop paused => ready messages off the bus */
-+  pop_state_changed (bus, 4, &had_latency);     /* pop playing => paused messages off the bus */
-+  pop_state_changed (bus, 4, &had_latency);     /* pop paused => ready messages off the bus */
- 
-   while (GST_OBJECT_REFCOUNT_VALUE (pipeline) > 1)
-     THREAD_SWITCH ();
-@@ -1002,6 +1052,7 @@ GST_START_TEST (test_children_state_change_order_semi_sink)
-   GstStateChangeReturn ret;
-   GstState current, pending;
-   GstBus *bus;
-+  gboolean had_latency = FALSE;
- 
-   /* (2) Now again, but check other code path where we don't have
-    *     a proper sink correctly flagged as such, but a 'semi-sink' */
-@@ -1056,10 +1107,11 @@ GST_START_TEST (test_children_state_change_order_semi_sink)
-   ASSERT_STATE_CHANGE_MSG (bus, src, GST_STATE_READY, GST_STATE_PAUSED, 206);
-   ASSERT_STATE_CHANGE_MSG (bus, sink, GST_STATE_READY, GST_STATE_PAUSED, 207);
- #else
--  pop_state_changed (bus, 2);   /* pop remaining ready => paused messages off the bus */
-+  pop_state_changed (bus, 2, &had_latency);     /* pop remaining ready => paused messages off the bus */
-   ASSERT_STATE_CHANGE_MSG (bus, pipeline, GST_STATE_READY, GST_STATE_PAUSED,
-       208);
--  pop_async_done (bus);
-+  pop_async_done (bus, &had_latency);
-+  pop_latency (bus, &had_latency);
- 
-   /* PAUSED => PLAYING */
-   GST_DEBUG ("popping PAUSED -> PLAYING messages");
-@@ -1076,8 +1128,8 @@ GST_START_TEST (test_children_state_change_order_semi_sink)
-   fail_if (ret != GST_STATE_CHANGE_SUCCESS, "State change to READY failed");
- 
-   /* TODO: do we need to check downwards state change order as well? */
--  pop_state_changed (bus, 4);   /* pop playing => paused messages off the bus */
--  pop_state_changed (bus, 4);   /* pop paused => ready messages off the bus */
-+  pop_state_changed (bus, 4, &had_latency);     /* pop playing => paused messages off the bus */
-+  pop_state_changed (bus, 4, &had_latency);     /* pop paused => ready messages off the bus */
- 
-   GST_DEBUG ("waiting for pipeline to reach refcount 1");
-   while (GST_OBJECT_REFCOUNT_VALUE (pipeline) > 1)
--- 
-GitLab
-
diff --git a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.20.5.bb b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.20.6.bb
index ce9c1c116f..7ceb319d9b 100644
--- a/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.20.5.bb
+++ b/poky/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.20.6.bb
@@ -21,9 +21,8 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${PV}.tar.x
            file://0002-tests-add-support-for-install-the-tests.patch;striplevel=3 \
            file://0003-tests-use-a-dictionaries-for-environment.patch;striplevel=3 \
            file://0004-tests-add-helper-script-to-run-the-installed_tests.patch;striplevel=3 \
-           file://0005-bin-Fix-race-conditions-in-tests.patch;striplevel=3 \
            "
-SRC_URI[sha256sum] = "5a19083faaf361d21fc391124f78ba6d609be55845a82fa8f658230e5fa03dff"
+SRC_URI[sha256sum] = "0545b030960680f71a95f9d39c95daae54b4d317d335e8f239d81138773c9b90"
 
 PACKAGECONFIG ??= "${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)} \
                    check \