Commit Graph

4642 Commits

Author SHA1 Message Date
Armin Kuster
22e02daa5b binutls: Security fix CVE-2018-10534
Affects <= 2.30

(From OE-Core rev: d18dfef01fb7d37029e5a612f79201adf7ff5921)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-06 16:24:03 +01:00
Armin Kuster
f9998b8ce6 binutls: Security fix CVE-2018-10535
Affects <= 2.30

(From OE-Core rev: 1ff22881249591d64fe61353a4d97ab91dc8efa0)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-06 16:24:03 +01:00
Armin Kuster
8126375423 binutls: Security fix CVE-2018-10372
Affects <= 2.30

(From OE-Core rev: 832316491aab8b90719cefeba2bfd94cef04b80f)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-06 16:24:03 +01:00
Armin Kuster
6d092834bd binutls: Security fix CVE-2018-10373
Affects <= 2.30

(From OE-Core rev: 3c83b9be884015e238249c0382299aedf4d81459)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-06 16:24:03 +01:00
Armin Kuster
ea6a69cb83 binutls: Security fix CVE-2018-7568
Affects <= 2.30

(From OE-Core rev: 9dee4cec26322604e71ca5db4b17b1088a98971b)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-06 16:24:02 +01:00
Armin Kuster
219deb5228 binutls: Security fix CVE-2018-7569
Affects <= 2.30

(From OE-Core rev: f79f5162088ceb29cf4820d2c3ef2aff263d7967)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-06 16:24:02 +01:00
Armin Kuster
3db593919b binutls: Security fix CVE-2018-7208
Affects <= 2.30

(From OE-Core rev: a994ef27a997bce0dd18f8e507b8d795b8111aeb)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-06 16:24:02 +01:00
Armin Kuster
e23d924838 binutls: Security fix CVE-2018-7642
Affects <= 2.30

(From OE-Core rev: 8c58ec80990a2c6b8b5e0832b3d5fe2c3f4378ff)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-06 16:24:02 +01:00
Armin Kuster
0112dfc031 binutls: Security fix CVE-2018-6759
Affects <= 2.30

(From OE-Core rev: 8f9b8ee0e7ad6526a3f93a8f0ca8e9fe055fdff6)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-06 16:24:02 +01:00
Armin Kuster
b283276544 binutls: Security fix CVE-2018-6872
Affects <= 2.30

(From OE-Core rev: 9626b58123eb50cb830443b3f514988f5417cc6c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-06 16:24:02 +01:00
Armin Kuster
b44ea09983 binutls: Security fix CVE-2018-7643
Affects <= 2.30

(From OE-Core rev: 70308a1133a3bd0e9d297bd66be4e05722484e7a)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-06 16:24:02 +01:00
Armin Kuster
b83fd9847f binutils: Security fix CVE-2018-8945
Affects <= 2.30

(From OE-Core rev: d128790b8593ee0cccd5e3c935ff28fb27644a8c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-06 16:24:02 +01:00
Ross Burton
72d2148535 python2: Fix build with gcc8
(From OE-Core rev: 910f68c9c8dc26e12d28ef29e956af63d100f121)

(From OE-Core rev: 04c2d53ef48a09747d0577d9ec1ffa548d247615)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Martin Hundebøll <martin@geanix.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-04 07:42:20 +01:00
Joel Stanley
b0d7de41e3 gcc-7.3: Backport fixes for std::pair high memory usage
C++ applications that contain a specfic use of std::pair with tempates
cause the build to require many gigabytes of RAM to build.

This is a fix that was applied to the upstream GCC 7 branch.

Change-Id: I213f96d1d6332e2dce5765482ff3413f1abd7ff8
(From OE-Core rev: 51a09ba2729a840a9f2f87b68c7f50a3e6ac0d04)

(From OE-Core rev: dc6d466edde2ebe26e2ece5601429baabff38bbb)

Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-01 23:00:28 +01:00
Joel Stanley
d2ad05e0b1 gcc-7.3: Fix build on ppc64le hosts
When building on ppc64le hosts that have GCC 8 (such as Ubuntu 18.10)
the GCC build bootstrap fails.

 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86162

This is a fix that was applied to the upstream GCC 7 branch.

Change-Id: I7796d2a999ec420805dd1c6cf0a1ecba1de5a897
(From OE-Core rev: c17f5e7e954487ad3e97e26c3e0d31443d658d5a)

(From OE-Core rev: 7d1ab4088f67f267b0c5a8ce9913feeedc3a7d7d)

Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-01 23:00:28 +01:00
Olof Johansson
66051c128d rpm: Avoid leaking temporary scriplet files
RPM writes each package scriptlet (post-/preinstall) to
/var/tmp/rpm-tmp.XXXXXX --- a lot of files potentially gets created.
When debugging is enabled, these temporary scriptlet files aren't
cleaned up at all and after a while this results in the filesystem
resources are eaten up (like running out of available inodes).

Normally, the temporary files would have been written to the tmp
directory of the target sysroot (which we can easily clean up), but in
this tree, you can't necessarily run the scriptlets.

Fixes [YOCTO #12792]

(From OE-Core rev: ffb0ece83e74797f4c3da3866bb3d691c388a5e5)

(From OE-Core rev: f0e1683d53e3b7436c04d665a181cdf5909e987c)

Signed-off-by: Olof Johansson <olofjn@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-19 10:53:52 +01:00
Otavio Salvador
66f380e4b0 go: Update 1.10.2 -> 1.10.3
go1.10.3 (released 2018/06/05) includes fixes to the go command, and
the crypto/tls, crypto/x509, and strings packages. In particular, it
adds minimal support to the go command for the vgo transition.

(From OE-Core rev: 37f288d783257cb9e6c035aaab1b661b1016b4c3)

(From OE-Core rev: aef0052ba416e24e503f5c984f254d023c32d5b3)

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-19 10:53:52 +01:00
Otavio Salvador
96341ef44f go: Update 1.9.6 -> 1.9.7
go1.9.7 (released 2018/06/05) includes fixes to the go command, and
the crypto/x509, and strings packages. In particular, it adds minimal
support to the go command for the vgo transition.

(From OE-Core rev: 98d3ec92e8953304db51c73aff7a4e81b97f668c)

(From OE-Core rev: 8c90d5c8ecc146d37de5d7f1076a963c18f04f4c)

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-19 10:53:52 +01:00
Ross Burton
21344f58ea chrpath: Alioth is dead, use DEBIAN_MIRROR
The previous host of chrpath, Alioth, is dead.  chrpath hasn't yet moved to
Salsa, so download the tarball from the Debian mirrors.

(From OE-Core rev: a8a2c5ec891286a1e7fd5ebdd33565f9ae3965c2)

(From OE-Core rev: 53d9da66dcb684cd2d1c703a4887c30ce7bf14d7)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-19 10:53:52 +01:00
Jeremy Puhlman
cb3a943773 Qemu: CVE-2018-11806 slirp-heap-buffer-overflow
(From OE-Core rev: d3d0798086177c463142e33f1493be6e34536c64)

Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com>
[Fixed up for Sumo context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-02 11:41:26 +01:00
Martin Jansa
41733717da qemu: refresh patches with devtool and make them applicable with git
(From OE-Core rev: e8fb42f3a54e8b8d68ae216a48534fa745ea99f1)

(From OE-Core rev: 0c0f1849ea0e40296117510b4d87a2505fe18e16)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-02 11:41:25 +01:00
Martin Kelly
28b0c96473 nativesdk-python*: suppress user site dirs
Currently, $HOME/.local is being added into sys.path in the Python SDK
causing subtle host contamination. Suppress this by exporting
PYTHONNOUSERSITE = "1" as documented in PEP 370.

This issue occurred in the past for python*-native and was fixed
similarly in OE-core commit 8fe9fb4d5a61dcbcb3fc5b9ee0234cc135af873f
("python*native.bbclass: suppress user site dirs").

(From OE-Core rev: 0dc36439cb9fe1cea50bed59da6302f78372a30b)

(From OE-Core rev: 376827d359a3769ee6477eac6e6b349a2050a867)

Signed-off-by: Martin Kelly <mkelly@xevo.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-02 11:41:25 +01:00
Ovidiu Panait
de85243b22 nativesdk-rpm: Add wrappers for nativesdk support
When installing the SDK to a non-default path, running "rpm --showrc" from the
sdk will produce the following error:
error: Unable to open /opt/windriver/wrlinux-small/10.17.41/sysroots/x86_64-wrlinuxsdk-linux/usr/lib/rpm/rpmrc for reading: No such file or directory.

Fix this by adding wrappers that dynamically export the RPM_CONFIGDIR,
RPM_ETCCONFIGDIR and MAGIC environment variables, pointing to the proper
sdk locations.

(From OE-Core rev: 760103cdaed3e820888d8984ec0b76cfc831d534)

(From OE-Core rev: bca05415510ebd847da0035536e32ab5fca1c3e2)

Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-02 11:41:25 +01:00
Peter Kjellerstedt
4b6ff20a44 rpm: Restore performance in Docker containers
If the maximum number of open file descriptors is much greater than the
usual 1024 (for example inside a Docker container), the performance
drops significantly.

This was reported upstream in:
https://bugzilla.redhat.com/show_bug.cgi?id=1537564
which resulted in:
https://github.com/rpm-software-management/rpm/pull/444

The pull request above has now been integrated and this commit contains
a backport of its three patches, which together change the behavior of
rpm so that its performance is now independent of the maximum number of
open file descriptors.

(From OE-Core rev: 6ecb10e3952af4a77bc79160ecd81117e97d022a)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:58 +01:00
Peter Kjellerstedt
a20981354f Revert "rpm: add a patch to help with Docker performance issues"
This reverts commit 6f1822e5f1eaafd8bc46e999de730c1fcca77f3a.

This patch only solved a part of the problem.

(From OE-Core rev: 00a243c532095b593267d0e5075ea255eaabe720)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:58 +01:00
Richard Purdie
11fdce318f rpm: Fix patch to ensure variables aren't used uninitialised
Recent patches were applied which removed a function which set the xx
variable. This means xx can be uninitalised and prerm functions can fail.

This adjusts the patch to ensure the xx value isn't used in such a way.

(From OE-Core rev: 3feebf7d28ef1049075a9d2ad3d64fc9b35015f2)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:58 +01:00
Armin Kuster
2b2ea2fa33 cmake: fix build issue with boost 1.66.0
this fixes a build issue with boost 1.66.0

[Yocto 12762]

(From OE-Core rev: 2ff3d3296deacb9af4d9ad0b92cd7ba5f94b7182)

(From OE-Core rev: eeb16e3601f884dfc0d3ddc54263f6bc5ccf8314)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:57 +01:00
Krzysztof Taborski
5878d5d3f9 perl: native modules will not trigger build perl for target.
Currently building perl-native modules triggers
build perl for target due to PACKAGES_DYNAMIC regex.

This commit will cause, that perl native modules will
trigger perl-native build.

(From OE-Core rev: 7dd9772eca6df52db09b65537fdf689f1aa3fd8f)

(From OE-Core rev: 3ad793c9ae1eb0b0599078298d55a37042f11239)

Signed-off-by: Krzysztof Taborski <taborskikrzysztof@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:57 +01:00
Juro Bystricky
642944f788 distcc-doc_3.2: improve reproducibility
Remove timestamps from metadata of gzip compressed files.

(From OE-Core rev: 8d009dd8c3c56601905a156cb06f339dd4a298e6)

(From OE-Core rev: 909e8a99e3ca2db524d82f8fab829379b0b7d88b)

Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:57 +01:00
Otavio Salvador
ee210d1086 go: Update 1.9.4 -> 1.9.6
The 1.9.6 fixes a number of issues since 1.9.4 release, mainly:

go1.9.5 (released 2018/03/28) includes fixes to the compiler, go
command, and net/http/pprof package.

go1.9.6 (released 2018/05/01) includes fixes to the compiler and go
command.

(From OE-Core rev: d4abc33c81f7aa33c432ead92ae16df01ebe36c8)

(From OE-Core rev: 020b0c2a85f259d92fc6c737a86d04824aa545d9)

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:57 +01:00
Otavio Salvador
0411a0d053 go: Upgrade 1.10.1 -> 1.10.2
This is a minor release that fixes many important issues found since
1.10.1 release.

(From OE-Core rev: 844f3191cd3d8746b7b31cff83e7655958226520)

(From OE-Core rev: 68eef4af5cfa466a7def567a8ce824e65accc708)

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:57 +01:00
Martin Lund
e54df7e22a mtd-utils: Add mtd-utils-tests package
Add mtd-utils-tests package which includes the test suites mtd-tests,
ubi-tests, fs-tests, etc.

These test suites are useful for verifying flash features or stress
testing.

(From OE-Core rev: 612d0468e34ca922b42a1176ab1e2feef72a2a13)

(From OE-Core rev: 1286cd2d3f5e37fed9021e0b3d6b8debd9ff3a71)

Signed-off-by: Martin Lund <malu@gomspace.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:57 +01:00
Hongxu Jia
379bc778e5 qemu: fix CVE-2017-16845
During Qemu guest migration, a destination process invokes ps2
post_load function. In that, if 'rptr' and 'count' values were
invalid, it could lead to OOB access or infinite loop issue.
Add check to avoid it.

(From OE-Core rev: 0d8f68fe43b4da1a0d356fe6bedb52b8f2a02081)

(From OE-Core rev: cdfceda098aa1a864cbb794065b9f555810c5c71)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:57 +01:00
Joe Slater
3452141b02 python3-native: correctly invoke regen-importlib make target
Redefiine regen-all in Makefile to invoke regen-importlib after
building other regen- targets.  Change the recipe to not build it
before regen-all.  This avoids trying to build it multiple times,
which can occasionally fail.

(From OE-Core rev: 72d62c9af07bf34bb8fbb3958742eb592985acc2)

(From OE-Core rev: 5b9af58be9194233a05a10c3e5b5efd053cc28d2)

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:57 +01:00
Niko Mauno
a455c16951 mtd-utils: Complement update-alternatives scope
Avoid collision of mtd-utils and mtd-utils-ubifs provided binaries
with identically named BusyBox provided applets in case packages
are installed to same rootfs, by adding relevant binaries to
update-alternatives scope

(From OE-Core rev: a9d8a8b27fc4bc6bdaa9133efd87430813a13212)

(From OE-Core rev: f06a276b7bd10f3ada796f943e7b702283da91eb)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:57 +01:00
Khem Raj
750e2e0ed4 llvm: Fix [compile-host-path] QA issue
Its trying to build NATIVE llvm-config which is
already built with llvm-native so we do not need
to rebuild it

Drop setting NINJA_STATUS explicitly, its no longer
needed, on the contrary it hinders the task status
update

(From OE-Core rev: f8393b2b4bc5fbd972be00cb17d0c574ae8deff9)

(From OE-Core rev: dae7d6abe71773962e0088b73b3584dd2d18c5f6)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:57 +01:00
Hongxu Jia
06b5932512 perl: fix CVE-2017-12837
https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5

(From OE-Core rev: bd53256e165f5bb59a28d77a466d71fce39080fa)

(From OE-Core rev: 5f808ec161d1604ffd1744f5d488b0ca9fc8f50f)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-06-15 17:56:57 +01:00
Armin Kuster
b90e694017 perl: Security fix CVE-2017-12883
Affects: Perl  < 5.24.3-rc1 and  5.26.x before 5.26.1-RC1

(From OE-Core rev: 60ebf7fcb7bfcef8a8e0cd52e737b082623ff109)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-23 17:26:05 +01:00
Matt Madison
00fe24fe8c go-runtime_1.9: pass BUILD_ flags to cgo for host-side build
When running the make.bash script to build the host-side
tools, make sure that cgo is using CFLAGS and LDFLAGS for
the build host, rather than those for the target.

[YOCTO #12704]

(From OE-Core rev: b1783e423444e0432d2653fbd00c18d119d82647)

Signed-off-by: Matt Madison <matt@madison.systems>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-23 17:26:05 +01:00
Martin Jansa
a2a7ce7b68 pseudo: use latest SRCREV
* the pseudo.log is significantly shorter with this revision

fddbe85 Fix symlink following errors
3a48dc4 Fix one more stray slash
691a230 Less chatty debugging
0c053e5 Change copyright default.

(From OE-Core rev: 935542f96c0706a6c5f9b0a77fce175733995f49)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-23 17:26:04 +01:00
Richard Purdie
fa742af158 uninative: Add allow-shlib-undefined to BUILD_LDFLAGS and drop other workarounds
We have a problem when for example, a glibc 2.27 based system builds some
library like libpopt-native and puts it into sstate then it is reused
on a pre glibc-2.27 system to build something which depends on popt like
rpm-native. This results in an error like:

recipe-sysroot-native/usr/lib/libpopt.so: undefined reference to `glob@GLIBC_2.27'

In the past we've had this problem with new symbols like getrandom and
getentropy, here its with a more complex symbol where there is an old
version and a newer version.

We've looked into various options, basically we cannot link against our
uninative libc/ld.so since we don't have the right headers or compiler
link libraries. The compiler doesn't allow you to switch in a new set
either, even if we did want to ship them. Shipping a complete compiler,
dev headers and libs also isn't an option.

On the other hand if we follow the ld man page, it does say:

"""
The reasons for allowing undefined symbol references in shared libraries
specified at link time are that:

- A shared library specified at link time may not be the same as the one
  that is available at load time, so the symbol might actually be
  resolvable at load time.
"""

which is exactly this case. By the time the binary runs, it will use
our uninative loader and libc and the symbol will be available.

Therefore we basically have a choice, we get weird intermittent bugs,
we drop uninative entirely, or we pass this option.

If we pass the option, we can drop the other workarounds too.

(From OE-Core rev: 75a62ede393bf6b4972390ef5290d50add19341a)

(From OE-Core rev: d18bf7fa8e80d6cfaf3fdbe1ab06eec84b954432)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-18 18:57:06 +01:00
Niko Mauno
5514c292ea run-postinsts: Replace pi_dir variable test
Since commit 5159ddcb62 string length test
performed against pi_dir has effectively never been able to succeed.

Change this to rather test if pi_dir is not an existing directory. By
doing we remove the chance of seeing the following console error message
during first boot to a pristine rootfs:

  'ls: /etc/ipk-postinsts: No such file or directory'

(From OE-Core rev: b1600ec8991dfbd3b73d209b9c620a171c5b13c4)

Signed-off-by: Niko Mauno <niko.mauno@iki.fi>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-18 18:57:06 +01:00
Juro Bystricky
2a3e8ad0b9 qemu_2.11.1.bb: support mingw build
The patch chardev-connect-socket-to-a-spawned-command.patch calls
"socketpair". This function is missing in mingw, so the patch
needs to be modified accordingly (by conditional compilation using
_WIN32 macro where appropriate), otherwise we end up with a broken
mingw build.

While it is possible to simply remove the whole patch for mingw build
(via a .bbappend file in meta-mingw), it makes more sense to modify
the patch itself.

(From OE-Core rev: 2d955bb53a8ee36c0a648c23293139612f33f97b)

Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-18 18:57:06 +01:00
Zhixiong Chi
18fd900468 valgrind: fix the shared object issue while prelink ptest
If valgrind-ptest is installed, we will get the some prelink error
like below at do_image:

  .../usr/sbin/prelink: /usr/lib64/valgrind/ptest/memcheck/tests/wrap7:\
  Could not find one of the dependencies: \
  .../usr/sbin//prelink-rtld: error   \
  while loading shared libraries: wrap7so.so: cannot open shared  \
  object file: No such file or directory

The wrap7 needs to link the shared object in the path
/usr/lib64/valgrind/ptest/memcheck/tests, but it fails.
So we correct the path for ptest.

(From OE-Core rev: 1ec0c977c55ae2c38252e1807dc15c56007d30dc)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-13 16:58:07 +01:00
Jackie Huang
16174d9342 patch: fix CVE-2018-1000156
* CVE detail: https://nvd.nist.gov/vuln/detail/CVE-2018-1000156

* upstream tracking: https://savannah.gnu.org/bugs/index.php?53566

* Fix arbitrary command execution in ed-style patches:
  - src/pch.c (do_ed_script): Write ed script to a temporary file instead
    of piping it to ed: this will cause ed to abort on invalid commands
    instead of rejecting them and carrying on.
  - tests/ed-style: New test case.
  - tests/Makefile.am (TESTS): Add test case.

(From OE-Core rev: 6b6ae212837a07aaefd2b675b5b527fbce2a4270)

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-13 16:58:07 +01:00
Jackie Huang
31714674e4 patch: fix CVE-2018-6951
* CVE detail: https://nvd.nist.gov/vuln/detail/CVE-2018-6951

* upstream tracking: http://savannah.gnu.org/bugs/?53132

* Fix segfault with mangled rename patch
  - src/pch.c (intuit_diff_type): Ensure that two filenames are specified
    for renames and copies (fix the existing check).

(From OE-Core rev: cdf74e1c67698b2d44a7460ff7d365d6da7b7b96)

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-13 16:58:07 +01:00
Joshua Watt
2400cbbfbc icecc-create-env: Add extra tools option
It can often be useful to include additional debugging tools the
toolchain such as strace. Add an option to include an arbitrary path.

(From OE-Core rev: 1fc1e3d59afd292ff8f7c4e1f64324134b73b8f4)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-13 16:58:07 +01:00
Joshua Watt
f8ba27d135 icecc-create-env: Fix library interpreter usage
Shared libraries sometimes (frequently?) don't have a program
interpreter specified. The previous code would fail to find the library
dependencies in these cases because no interpreter could be found.
Commonly, this meant that if a library depends on another library, it
might not be included toolchain because dependency scanning stops with
the first one.

Instead, capture the program interpreter from the program or library
that starts the dependency chain and use that interpreter to get all of
the dependencies in the chain, recursively.

Additionally, if no interpreter can be found, fallback to using ldd

(From OE-Core rev: 4f55e61e9e3dd921bd71a127580dc5fc71d7b339)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-13 16:58:07 +01:00
Joshua Watt
beb38c1117 icecc-create-env: Fix RUNPATH files
Some newer libraries and programs use RUNPATH to specify the library
search path. These executables were being skipped by the rpath fixup
code because it was grepping the ELF header for RPATH only. A more
correct solution is to ask patchelf to report the rpath, as that tool
will properly report either RPATH or RUNPATH as appropriate.

(From OE-Core rev: d1e88ad01df9b6419e02f632b1ba288d4cc3b2bf)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-13 16:58:07 +01:00
Joshua Watt
57ca83dac1 icecc-create-env: Allow logging to a file
Modifies the icecc-create-env script so that it can log output to a log
file. In addition, a --debug flag is added that allows verbose logging.
Finally, the silent flag was removed since it was never used in
icecc.bbclass

(From OE-Core rev: 3d0bd786fd79967cf8754d022044df311dd8ad3e)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-13 16:58:07 +01:00