Commit Graph

48398 Commits

Author SHA1 Message Date
Chin Huat Ang
16c0989eec toolchain-scripts: preserve host path in environment setup script
The environment setup script generated in the build directory sets the PATH
variable by expanding ${PATH} which would have host paths filtered. Sourcing
this script to run runqemu will not work as it complains host stty (/bin/stty)
cannot be found.

To resolve this, the script no longer expands ${PATH} during generation time,
instead it will now source oe-init-build-env to initialize the build
environment so that all host paths will be preserved. Also be sure to prepend
STAGING_BINDIR_TOOLCHAIN to the PATH variable so that the toolchain from the
build directory can be found.

[YOCTO #12695]

(From OE-Core rev: a64a144096c0637387244b89ed22f4b5352b2522)

(From OE-Core rev: d4657ac24542967ecd241726063da2d2dc3e9e23)

Signed-off-by: Chin Huat Ang <chin.huat.ang@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-05 16:02:44 +00:00
Jose Perez Carranza
d9122cb2d0 lsb/lsbtests: Update package lists to use latest version of binary
Currently  package list is pointing to  "lsb-setup-4.1.0-1.noarch.rpm"
which is not available anymore on
http://ftp.linuxfoundation.org/pub/lsb/base/released-all/binary/ hence
BASE_PACKAGES_LIST is updated to point to the latest available version.

[YOCTO #12240]

(From OE-Core rev: a1e61b05d83de0feeb6d05851477108902d1dfb0)

(From OE-Core rev: 5db7781c27bb4bb57e8a6749337bf52dc33355cc)

Signed-off-by: Jose Perez Carranza <jose.perez.carranza@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-05 16:02:44 +00:00
Anuj Mittal
0118c2d2aa perl: skip tests that are not useful
Some tests, like the one that compares the hashes for a list of files
against those stored in a .dat file, don't make sense for downstream
distros packaging perl.

Backport a patch from upstream that allows skipping of these tests at
runtime. Also remove the local patch trying to keep hashes up-to-date
for one of those tests.

Fixes [YOCTO #12787]

(From OE-Core rev: 557f4618b75b8739a647e46054ab587ae2bbdc25)

(From OE-Core rev: 5cabded0895a5634b194ba125d1231b52e09a5e9)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[Fix up for rocko context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-05 16:02:44 +00:00
Scott Rifenbark
0d6e6eb510 documentation: Updated release date for 2.4.4 release
It was September.  More likely to be November now.  All manual
history tables updated.

(From yocto-docs rev: ee04a4f2b95ab99d16b2c0418c12f91350c5bdef)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-20 14:28:09 +01:00
Ross Burton
cd3c8323d8 make: add missing Signed-off-by
(From OE-Core rev: 5282774e0a8df40a04808622e6d265157477488f)

(From OE-Core rev: 4aa55a2c338e38816275789ac89cdd617bda9b42)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-18 11:09:39 +01:00
Khem Raj
2832aa209d make: Backport fixes to not assume glibc internal glob implementation
Exposed with glibc 2.27

(From OE-Core rev: cdf370f1bd046ba6207b63c9a82bdfff2b261a7d)

(From OE-Core rev: bd81e47c12b8f3bbb8a9e24379b6632e36f11462)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-18 11:09:39 +01:00
Richard Purdie
076b057c46 recipes: Update git.gnome.org addresses after upstream changes
git.gnome.org is no more. It has ceased to be. It's an ex-git.

Please see here:
https://about.gitlab.com/2018/05/31/welcome-gnome-to-gitlab/

Note that gitlab does not support git://, only https:// (and ssh).

[Commit message from Alexander Kanavin]

(From OE-Core rev: 8382cdc0888ca645a44aacaac1155afb8dcde979)

(From OE-Core rev: d40c87b003b290a1739039156b27f194f68f12c2)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[Fixup for sumo context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-18 11:09:39 +01:00
He Zhe
caa4a47877 cryptodev: Fix build errors with v4.17+
Backport from upstream to update internal syscall function usage.
https://github.com/cryptodev-linux/cryptodev-linux
f60aa08c63fc02780554a0a12180a478ca27d49f

(From OE-Core rev: 270a1e9bcf26a43f5cbdc5b901c4c6f79495311d)

(From OE-Core rev: 87718444c054bad8d83e19d4ead2397420c63289)

Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-18 11:09:39 +01:00
Armin Kuster
cfcbc502a7 shadow: CVE-2016-6252
Backport patch from the upstream
https://github.com/shadow-maint/shadow/commit/
1d5a926cc2d6078d23a96222b1ef3e558724dad1

(From OE-Core rev: dd9e2dedb9ab41f509bae26f12704cbee1eb765d)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-10 13:27:02 +01:00
Kai Kang
fbe29a7e5f shadow: update ownership and permission of /var/spool/mail
Update shadow to change ownership of /var/spool/mail from root:root to
root:mail and permission from 0755 to 0775 just as in most popular
distributions such as fedora and debian(It also set setgid bit in debian
but we don't need it).

(From OE-Core rev: b3ab5fe359c38cdd5cd86cb8ffe076d7a2baac18)

(From OE-Core rev: a77eff19be1d5812999bf584364000440f218fbb)

(From OE-Core rev: 1af360c925a044fa4fa093cd109f3f2a5cbe7944)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-10 13:27:02 +01:00
Jagadeesh Krishnanjanappa
9833879d81 shadow: CVE-2018-7169
newgidmap: enforce setgroups=deny if self-mapping a group

This is necessary to match the kernel-side policy of "self-mapping in a
user namespace is fine, but you cannot drop groups" -- a policy that was
created in order to stop user namespaces from allowing trivial privilege
escalation by dropping supplementary groups that were "blacklisted" from
certain paths.

This is the simplest fix for the underlying issue, and effectively makes
it so that unless a user has a valid mapping set in /etc/subgid (which
only administrators can modify) -- and they are currently trying to use
that mapping -- then /proc/$pid/setgroups will be set to deny. This
workaround is only partial, because ideally it should be possible to set
an "allow_setgroups" or "deny_setgroups" flag in /etc/subgid to allow
administrators to further restrict newgidmap(1).

We also don't write anything in the "allow" case because "allow" is the
default, and users may have already written "deny" even if they
technically are allowed to use setgroups. And we don't write anything if
the setgroups policy is already "deny".

Ref: https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
Fixes: CVE-2018-7169

Affects shadow <= 4.5

(From OE-Core rev: a875522540372a4fa6658885692e564dfd729f54)

(From OE-Core rev: cfc8931d53cf9959995a4068a7e397e100922358)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-10 13:27:02 +01:00
Andrej Valek
2f89032e5f shadow: fix CVE-2017-2616
(From OE-Core rev: 94a1e2794df15f0f2cb62ae030cd81e6c0798b1f)

(From OE-Core rev: 8894c70ae5a44974f74434d251def3148818a866)

(From OE-Core rev: eec9169658733335c6f8251b5122706fa8ab467d)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-10 13:27:02 +01:00
Martin Jansa
f29617bf18 license.bbclass: be a bit more strict when searching ${PN}-${LICENSE_PACKAGE_SUFFIX} in packages
* linux-firmware contains ${PN}-license package since this commit:
  commit 1ee083da0730408fffdbbf5f29abc299c0e61be9
  Author: Jackie Huang <jackie.huang@windriver.com>
  Date:   Mon Apr 13 10:17:21 2015 +0800

    linux-firmware: fix the mess of licenses
* LICENSE_CREATE_PACKAGE functionality in license.bbclass when enabled
  adds new package with suffix:
  LICENSE_PACKAGE_SUFFIX ??= "-lic"
  but then it checks if ${PN}-${LICENSE_PACKAGE_SUFFIX} is included
  in PACKAGES before adding it and when found it shows:
  WARNING: linux-firmware-1_0.0+gitAUTOINC+4c0bf113a5-r0 do_package: linux-firmware-lic package already existed in linux-firmware.
  and doesn't add the ${PN}-lic to PACKAGES and causes another warning:
  WARNING: linux-firmware-1_0.0+gitAUTOINC+4c0bf113a5-r0 do_package: QA Issue: linux-firmware: Files/directories were installed but not shipped in any package:
  /usr
  /usr/share
  /usr/share/licenses
  /usr/share/licenses/linux-firmware

  that's because it was searching ${PN}-lic in PACKAGES as a string
  so it found ${PN}-lic as a substring of ${PN}-license, add a split
  to search in an list

(From OE-Core rev: 9b9897fc034819385a9d4ce591cc79dd458f3f24)

(From OE-Core rev: 9aed83eb8694a0bd409a6a2481bfd2a1b98919e1)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[Yocto 12572]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-10 13:27:02 +01:00
Peter Kjellerstedt
c5d9b77ba8 license.bbclass: Minor simplification of get_deployed_dependencies()
Since ${SSTATE_ARCHS} now contains ${PACKAGE_EXTRA_ARCHS} there is no
longer any need to add those extra architectures to the list of
architectures handled in get_deployed_dependencies().

(From OE-Core rev: e55e6df4f1434458cdfa0e2d3610b48119e5a782)

(From OE-Core rev: 64ca9e513eabc85db9648a6483bd3024c7fe8746)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-10 13:27:02 +01:00
Hongxu Jia
05711ba185 patch: fix CVE-2018-6952
(From OE-Core rev: 1314a6953aa647706107557faaba8574e307d2bd)

(From OE-Core rev: 7d518d342eb67d25aa071fb08d03f06d6da576c6)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-13 10:55:38 +01:00
Daniel Díaz
40a817a038 multilib_header: recognize BPF as a target
When building with `clang -target bpf` using the
multilib_header, a recursion was unavoidable because
bits/wordsize.h would #include itself, still lacking
a definition for __MHWORDSIZE or __WORDSIZE.

(From OE-Core rev: 70b41b3c335a80b4ac243f468f22331d261299db)

(From OE-Core rev: 58abe666d3bad7a915c244c61085482e94b3d549)

(From OE-Core rev: edb02f0d1d313fb026e39cc320e63be7e0132e7b)

Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-13 10:55:38 +01:00
Ross Burton
094c364e4e python2: Fix build with gcc8
(From OE-Core rev: 910f68c9c8dc26e12d28ef29e956af63d100f121)

(From OE-Core rev: 04c2d53ef48a09747d0577d9ec1ffa548d247615)

(From OE-Core rev: 9a3772e9411864301ca2799b4d5827476a6b7fcf)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Martin Hundebøll <martin@geanix.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-13 10:55:38 +01:00
Derek Straka
33bf568714 python-native: add dependency for gdbm and db native packages
These two packages are required to ensure the manifest files contain
all of the generated packages.  Without this, the db and gdbm packages
will not contain the .so files as they are skipped during the compilation steps

(From OE-Core rev: 912c06615269f42230db2d93d70db2b340ed270a)

(From OE-Core rev: 1e2d12f87445361cc57b7fc1e4ba5eec0265087d)

Signed-off-by: Derek Straka <derek@asterius.io>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-13 10:55:38 +01:00
Derek Straka
5a353c4210 python: Upgrade both python and python-native to 2.7.14
Rebased:
  - python/01-use-proper-tools-for-cross-build.patch
  - python/fix-makefile-for-ptest.patch
  - python/parallel-makeinst-create-bindir.patch

Removed Upstreamed Patch:
  - python/Don-t-use-getentropy-on-Linux.patch

Updated license checksum for changes in the copyright date.  The license
terms remain unchanged

Added an extra do_compile item to create the native pgen that no longer
gets compiled by default

(From OE-Core rev: 9f2de4f9cf1eb6de75dc789bd0549f45c7a68c55)

(From OE-Core rev: 00bdc9752e76fb66bb7eb8d6c3249aa031f14fdb)

Signed-off-by: Derek Straka <derek@asterius.io>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

[Bug fix release only]
CVE-2017-9233
CVE-2016-0718
CVE-2012-0876
CVE-2016-4472

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-13 10:55:38 +01:00
Jagadeesh Krishnanjanappa
a47d077ff4 libvorbis: CVE-2018-10392
Sanity check number of channels in setup.

Fixes #2335.
Link: https://gitlab.xiph.org/xiph/vorbis/issues/2335

(From OE-Core rev: a8e6ce64d4561826f2f5926c2dc67939c95a8626)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-13 10:55:38 +01:00
Jagadeesh Krishnanjanappa
6f7c2da540 libvorbis: CVE-2017-14160 CVE-2018-10393
CVE-2017-14160: fix bounds check on very low sample rates.

(From OE-Core rev: 5bed33fbd29eea9449114186d42b4b2a5e88b32f)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-13 10:55:38 +01:00
Ross Burton
3cbd516bd1 bzip2: use Yocto Project mirror for SRC_URI
The bzip.org domain expired and is now a holding site for adverts, so we can't
trust a tarball that appears on that site (luckily we have source checksums to
detect this).

For now, point SRC_URI at the tarball in the Yocto Project source mirror, but
set HOMEPAGE and UPSTREAM_CHECK_URI to the sourceware.org/bzip2/ page which
apparently will be resurrected as the new canonical home page.

(From OE-Core rev: 9e291d9923efc988abe8689c64bafbb29da06339)

(From OE-Core rev: aa427fd4a54f0f082705d86a487ecc601c725c3a)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-13 10:55:38 +01:00
Ross Burton
66550feb26 classes: sanity-check LIC_FILES_CHKSUM
We assume that LIC_FILES_CHKSUM is a file: URI but don't actually verify this,
which can lead to problems if you have a URI that resolves to a path of / as
Bitbake will then dutifully checksum / recursively.

[ YOCTO #12883 ]

(From OE-Core rev: e2b8a3d5a10868f9c0dec8d7b9f5f89fdd100fc8)

(From OE-Core rev: f6f54155420ae54a34f1ab87e76623c536adf2f9)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-30 15:57:44 +01:00
Denys Dmytriyenko
02b05d1ff4 module-base.bbclass: fix out-of-tree module builds with custom EXTRA_OEMAKE
Commit d2aa88a6a92985f21414fceea2dc0facbf7f8779 was meant to backport build
dependencies on bc-native and openssl-native, but it also changed execution
of do_make_scripts() from calling make directly to using oe_runmake. That
change was made in master/sumo as part of a separate make-mod-scripts recipe.

Unfortunately, that doesn't work here in rocko in the context of module-base
class, as it gets executed inside out-of-tree module environment. Quite often
those out-of-tree modules provide own Makefile with custom EXTRA_OEMAKE var
defined. But do_make_scripts() gets executed within STAGING_KERNEL_DIR and
cannot simply use custom EXTRA_OEMAKE set by a module.

Move back to calling make and passing HOSTCC/HOSTCPP directly w/o using
EXTRA_OEMAKE.

For more details please see:
http://lists.openembedded.org/pipermail/openembedded-core/2018-August/154189.html

(From OE-Core rev: eb3eaa6970bb8c3647187593df23e2784dd26935)

Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Cc: Bruce Ashfield <bruce.ashfield@windriver.com>
Cc: Richard Purdie <richard.purdie@linuxfoundation.org>
Cc: Anuj Mittal <anuj.mittal@intel.com>
Cc: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 17:16:03 +01:00
Ross Burton
61da85778a bitbake: checksum: sanity check path when recursively checksumming
In case something goes tragically wrong, catch a request to checksum / and
refuse.

(Bitbake rev: 8bd16328a9332c57b03198826e22b48fadcd21d9)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:58 +01:00
Ross Burton
1b966ffd5f bitbake: utils/md5_file: don't iterate line-by-line
Opening a file in binary mode and iterating it seems like the simple solution
but will still break on newlines, which for binary files isn't really useful as
the size of the chunks could be huge or tiny.

Instead, let's be a bit more clever: we'll be MD5ing lots of files, but we don't
want to fill up memory: use mmap() to open the file and read the file in 8k
blocks.

(Bitbake rev: f3f28ec7e6cad5003014462feeb9178496107e08)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 15:23:58 +01:00
Richard Purdie
f7a8c088ae bitbake: tests/fetch: Update gnome.org urls after upstream changes
(Bitbake rev: cdda992d4eedcf8e23b9a7222c16d49dee1586bd)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-29 10:44:21 +01:00
Scott Rifenbark
2731fd35d5 documentation: Preparation for 2.4.4 release
poky.ent - updated variables for 2.4.4
mega-manual.sed - updated string from "2.4.3" to "2.4.4"
<manual>.xml - updated manual revision tables for 2.4.4 and
               September 2018 date

(From yocto-docs rev: 1bba098ba20f2b1349ac840fd36f62de401f8701)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:28:18 +01:00
Jagadeesh Krishnanjanappa
4a59df45f8 libxcursor: CVE-2017-16612
affects: <= 1.1.14

CVE-2017-16612: Fix heap overflows when parsing malicious files

It is possible to trigger heap overflows due to an integer overflow
while parsing images and a signedness issue while parsing comments.

The integer overflow occurs because the chosen limit 0x10000 for
dimensions is too large for 32 bit systems, because each pixel takes 4 bytes.
Properly chosen values allow an overflow which in turn will lead to less
allocated memory than needed for subsequent reads.

The signedness bug is triggered by reading the length of a comment
as unsigned int, but casting it to int when calling the function
XcursorCommentCreate. Turning length into a negative value allows the
check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
addition of sizeof (XcursorComment) + 1 makes it possible to allocate
less memory than needed for subsequent reads.

(From OE-Core rev: bdf13518e79ab949c4320226a399ee4a3913ee30)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:46 +01:00
Chen Qi
3259b70497 devtool/sdk.py: error out in case of downloading file failure
It's possible that downloading file from updateserver fails. In
this case, we should error out instead of continue.

We have users reporting unexpected behavior of 'devtool sdk-update'.
When an invalid url is supplied, e.g., `devtool sdk-update http://invalid',
the program reports 'Note: Already up-to-date'.

This is obviously not expected. We should error out in such case.

(From OE-Core rev: 449564783dfb162536a2f772b3a8704973221e0f)

(From OE-Core rev: 4b022a62998e38dbefe1f882bcb9a229485ac9da)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:46 +01:00
Rasmus Villemoes
b332766553 perf: disable parallelism for 'make clean'
Whenever perf got rebuilt, I was consistently getting errors such as

| find: '[...]/perf/1.0-r9/perf-1.0/plugin_mac80211.so': No such file or directory
| find: '[...]/perf/1.0-r9/perf-1.0/plugin_mac80211.so': No such file or directory
| find: find: '[...]/perf/1.0-r9/perf-1.0/libtraceevent.a''[...]/perf/1.0-r9/perf-1.0/libtraceevent.a': No such file or directory: No such file or directory
|
[...]
| find: cannot delete '/mnt/xfs/devel/pil/yocto/tmp-glibc/work/wandboard-oe-linux-gnueabi/perf/1.0-r9/perf-1.0/util/.pstack.o.cmd': No such file or directory

breaking the whole build. The root cause seems to be that the implicit
'make clean' done during do_configure ends up running in parallel, and
thus multiple find commands attempt to stat and/or delete the same
file.

A patch disabling parallelism for the clean target has been ack'ed
upstream (lkml.kernel.org/r/20180705134955.GB3686@krava), but it should
be harmless to pass JOBS=1 even with a fixed kernel. This can be removed
if and when all relevant -stable kernels have that patch.

(From OE-Core rev: bb58203b668df42fd08c2e5fa4a172cf63e37369)

(From OE-Core rev: d12722681a4c13c1a6bc9c965cc43c4544ce7aa9)

(From OE-Core rev: ad21736cf1be017af4b211b5cdd577cdf28dee20)

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:46 +01:00
Armin Kuster
58356f3322 glibc: Update 2.26 to tip
CVES: CVE-2018-11236, CVE-2017-18269,  CVE-2018-11237

LIC_FILES_CHKSUM for LICENSE changed do to removal of
"stdio-common/tst-printf.c is copyright C E Chew" text

changelog:
c9570bd x86: Populate COMMON_CPUID_INDEX_80000001 for Intel CPUs [BZ #23459]
86e0996 x86: Correct index_cpu_LZCNT [BZ #23456]
cf6deb0 conform/conformtest.pl: Escape literal braces in regular expressions
b12bed3 stdio-common/tst-printf.c: Remove part under a non-free license [BZ #23363]
20dc7a9 libio: Add tst-vtables, tst-vtables-interposed
4b10e69 Synchronize support/ infrastructure with master
762e9d6 NEWS: Reorder out-of-order bugs
2781bd5 libio: Disable vtable validation in case of interposition [BZ #23313]
74d16a5 Check length of ifname before copying it into to ifreq structure.
3aaf8bd getifaddrs: Don't return ifa entries with NULL names [BZ #21812]
f958b45 Use _STRUCT_TIMESPEC as guard in <bits/types/struct_timespec.h> [BZ #23349]
81b994b Fix parameter type in C++ version of iseqsig (bug 23171)
7b52c8a libio: Avoid _allocate_buffer, _free_buffer function pointers [BZ #23236]
4df8479 Add NEWS entry for CVE-2018-11236
a5bc5ec Add references to CVE-2018-11236, CVE-2017-18269
58ad5f8 Add a test case for [BZ #23196]
6b4362f Don't write beyond destination in __mempcpy_avx512_no_vzeroupper (bug 23196)
af7519f Fix path length overflow in realpath [BZ #22786]
365722a Fix stack overflow with huge PT_NOTE segment [BZ #20419]
be056fa Fix blocking pthread_join. [BZ #23137]
02f0dd8 Fix signed integer overflow in random_r (bug 17343).
3241353 i386: Fix i386 sigaction sa_restorer initialization (BZ#21269)
677e6d1 [BZ #22342] Fix netgroup cache keys.
71d339c Fix i386 memmove issue (bug 22644).
31e2d15 Fix crash in resolver on memory allocation failure (bug 23005)
1f7c474 getlogin_r: return early when linux sentinel value is set
7e7a5f0 resolv: Fully initialize struct mmsghdr in send_dg [BZ #23037]

(From OE-Core rev: 1c6b71d4ee2b12d1360d53740a1f00e05832d40d)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:46 +01:00
Ross Burton
f6e03ac1a7 cryptodev: refresh patches
The patch tool will apply patches by default with "fuzz", which is where if the
hunk context isn't present but what is there is close enough, it will force the
patch in.

Whilst this is useful when there's just whitespace changes, when applied to
source it is possible for a patch applied with fuzz to produce broken code which
still compiles (see #10450).  This is obviously bad.

We'd like to eventually have do_patch() rejecting any fuzz on these grounds. For
that to be realistic the existing patches with fuzz need to be rebased and
reviewed.

(From OE-Core rev: cecd562742c94f223c92bf5426148967fc9a8054)

(From OE-Core rev: ce0554c6807b3a67bd770b172e81595797715e9e)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:46 +01:00
Alexander Kanavin
ed79a8ccbe cryptodev: switch SRC_URI to git
One of the tarball mirrors is down; the other is blocked by Intel's corporate proxy
for being deemed 'suspicious' (the same problem might pop up in other
companies as well). Let's just take the source from github.

(From OE-Core rev: 69f60f6ef9061760643d6b4e378052ddad424754)

(From OE-Core rev: b5d9098b2df889c7394296eeab1fc4fab036e704)

Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:46 +01:00
Daniel Schultz
037fa41038 cryptodev: Fix build errors with v4.13+
Without this compiles of 4.13 and later kernels fail.

Backport from https://github.com/cryptodev-linux/cryptodev-linux
Based on commit f0d69774afb27ffc62bf353465fba145e70cb85a

(From OE-Core rev: 317fd9814653ee22496dda63a02e628e8a16899b)

(From OE-Core rev: 8894f352fd1f2a087528808cc3dc52d7a5cc72bd)

Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:46 +01:00
Christopher Larson
f29fea340f ovmf: set PARALLEL_MAKE for target as well
This can fail for target, not just native.

(From OE-Core rev: 747c7dc8702d2241475894876d06a2f1f2b29fed)

(From OE-Core rev: 0d4ccd6eac41c878b5a9eec10e1a00b76241b846)

(From OE-Core rev: 7786a7d99cfe1695b4a1017021dee826b4994167)

Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:46 +01:00
Khem Raj
7add7e5892 ovmf: Fix build with gcc8
(From OE-Core rev: 278b00ddccb274150ed85e48e984675b40fc9aaa)

(From OE-Core rev: 2e4a05879f56e96bcdc0770d3fe27abc8b9af35e)

(From OE-Core rev: 2b3d976392d53afc3033ddf37d2404d61904bf78)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:46 +01:00
Ross Burton
9c8021f2fb ovmf: refresh patches
The patch tool will apply patches by default with "fuzz", which is where if the
hunk context isn't present but what is there is close enough, it will force the
patch in.

Whilst this is useful when there's just whitespace changes, when applied to
source it is possible for a patch applied with fuzz to produce broken code which
still compiles (see #10450).  This is obviously bad.

We'd like to eventually have do_patch() rejecting any fuzz on these grounds. For
that to be realistic the existing patches with fuzz need to be rebased and
reviewed.

(From OE-Core rev: 68d567bd64debc3dfb37df3c814287549da56a3b)

(From OE-Core rev: d2882641a0b4df887c0af974ce36ff50834b7f29)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:46 +01:00
Martin Jansa
ecb366b52d perf: fix build with kernel older than 4.8
* perf is failing to build for me since this oe-core commit:
  commit 9b38c824961fc9dce51bda95c25dac91a69fc64f
  Author: Hongxu Jia <hongxu.jia@windriver.com>
  Date:   Tue Apr 24 11:33:47 2018 +0800

    perf: make a copy of kernel source to perf workdir

  the problem is that perf sources in kernel older than 4.8 (in my case
  4.4) are depending on the "global" include headers outside tools
  directory, e.g. swab.h in:
  kernel-source/tools$ git grep swab.h
  perf/MANIFEST:include/linux/swab.h
  perf/MANIFEST:include/uapi/linux/swab.h
  perf/util/include/asm/byteorder.h:#include "../../../../include/uapi/linux/swab.h"

  this was resolved in 4.8 with:
  commit 7e3f36411342a54f1981fa97b43550b8406a3d69
  Author: Arnaldo Carvalho de Melo <acme@redhat.com>
  Date:   Mon Jul 18 17:42:16 2016 -0300

    perf tools: Remove tools/perf/util/include/asm/byteorder.h

    Not used anymore. This also stops include linux/swab.h directly
    from the kernel sources, remove that reference from the MANIFEST.

  and few more changes to make tools/include more complete and standalone:
  tools/include in 4.15:
  asm  asm-generic  linux  tools  trace  uapi

  tools/include in 4.4:
  asm  asm-generic  linux  tools

  but copying the include header even for kernels which don't really
  need it doesn't add big overhead, so just copy include to perf sources
  for all kernels.

(From OE-Core rev: 19fb2d11a8bb3c6dfdd5edc1b9155d642dc0f5e0)

(From OE-Core rev: 7950b1ed077eaecff1523221c297158aa54b7ecf)

(From OE-Core rev: c2fa80c4cfedd993d07b20db0315e91f9481d11c)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:45 +01:00
Hongxu Jia
42eadd3dea perf: make a copy of kernel source to perf workdir
Since perf contaminates linux shared workdir, it probably caused
kernel-devsrc compile failure at world build.
...
|0 blocks
|cpio: ./tools/perf/arch/arm/util/sedr7ORqk: Cannot stat:
No such file or directory
|0 blocks
...
cpio tried to find a file at ${S}/tools/perf and failed
if the input list is not valid.

Make a copy of kernel shared source directory into a perf workdir
could fix the issue.

Drop `Fix for rebuilding' which is obsolete

[YOCTO #10880]

(From OE-Core rev: 9b38c824961fc9dce51bda95c25dac91a69fc64f)

(From OE-Core rev: 1a39330bf79f3d36a1a0f6d34b421de53ff36405)

(From OE-Core rev: 6f9117c0bceeedbfce08647825edf86966457bfc)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:45 +01:00
Anuj Mittal
8b2dbbddc4 perf: enable support for libaudit
perf needs audit-python to be able to show syscall names and for
'perf trace' to work.

Enable dependency on audit-python if present in PACKAGECONFIG. It's
disabled by default since audit as of now is in meta-selinux.

Fixes [YOCTO #3343]
Fixes [YOCTO #3358]

(From OE-Core rev: c386abacae89a148e77ffa51630c7917e90406f9)

(From OE-Core rev: 5b7550a62fa0fa7892c28ae920ee243c223bf3c2)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:45 +01:00
Armin Kuster
b33d89d5ea Binutils: Security fix for CVE-2018-7642
Affects: <= 2.30

(From OE-Core rev: a424ac771bfceed2cef4dad8c0fd698764bc62a6)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:45 +01:00
Armin Kuster
bdb3981466 Binutils: Security fix for CVE-2018-7569
Affects: <= 2.30

(From OE-Core rev: b99d1f2212ea73ddafd3fbf9426b37a04d89b809)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:45 +01:00
Armin Kuster
3552c38b32 Binutils: Security fix for CVE-2018-7568
Affects: <= 2.30

(From OE-Core rev: d407e48c7e925806e162bb91e9b14088acedb05c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:45 +01:00
Armin Kuster
1b709e6837 Binutils: Security fix for CVE-2018-7208
Affects: <= 2.30

(From OE-Core rev: fc5adfb0af0cae0071c0136068f37fd35529fc7f)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:45 +01:00
Armin Kuster
5281adb885 Binutils: Security fix for CVE-2018-6759
Affects: <= 2.30

(From OE-Core rev: 7baa3e4c8e920caa09082f88e412687cc1590454)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:45 +01:00
Armin Kuster
53df81889a Binutils: Security fix for CVE-2018-6323
Affected: <= 2.29.1

(From OE-Core rev: 52a93bb4c5b5128ff3fa8be84c41309cfeff8224)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:45 +01:00
Armin Kuster
1b202d632b Binutils: Security fix for CVE-2018-13033
Affects: <= 2.30

(From OE-Core rev: 64afab325facc55f4a49247e4033b1d3c8b22b67)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:45 +01:00
Armin Kuster
8eeacb689b Binutils: Security fix for CVE-2018-10535
Affects: <= 2.30

(From OE-Core rev: 5fc41ff3341074497a1359969baf880d8035826b)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:45 +01:00
Armin Kuster
5a60b74887 Binutils: Security fix for CVE-2018-10534
Affects: <= 2.30

(From OE-Core rev: 7934bbc460009f52824e142273f2ecce957fc123)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-15 10:22:45 +01:00