Commit Graph

51515 Commits

Author SHA1 Message Date
Yi Zhao
62917950b7 blktrace: Security fix CVE-2018-10689
CVE-2018-10689: blktrace (aka Block IO Tracing) 1.2.0, as used with the
Linux kernel and Android, has a buffer overflow in the dev_map_read
function in btt/devmap.c because the device and devno arrays are too
small, as demonstrated by an invalid free when using the btt program
with a crafted file.

References:
https://nvd.nist.gov/vuln/detail/CVE-2018-10689

Patch from:
https://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git/commit/?id=d61ff409cb4dda31386373d706ea0cfb1aaac5b7

(From OE-Core rev: 6a7ed8b1db10abd38bdd20c77a8f27427d381156)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-28 10:30:28 +01:00
Hongxu Jia
c0abc412bc package.bbclass: only one hardlink of separated debug info file in each directory
While multiple hardlinks of binary located in different dirs,
there are also multiple hardlinks of separated debug info file
with the same binary name in same debug dirs. But in each dir,
only one debug file with original name works. Because all of
binary hardlinks have one `.gnu_debuglink' which is added in
`splitdebuginfo'. It caused gdb could not find debugging
symbols.

[Before the patch]
$ find .
./usr/bin/foo
./usr/bin/foo-hd1
./usr/bin/.debug
./usr/bin/.debug/foo
./usr/bin/.debug/foo-hd1
./usr/libexec/foo-hd2
./usr/libexec/.debug
./usr/libexec/.debug/foo-hd2

$ readelf --debug-dump usr/libexec/foo-hd2
Contents of the .gnu_debuglink section:
  Separate debug info file: foo

$ gdb usr/libexec/foo-hd2
Reading symbols from usr/libexec/foo-hd2...(no debugging symbols found)...done.
[Before the patch]

[Apply the patch]
$ find .
./usr/bin/foo
./usr/bin/foo-hd1
./usr/bin/.debug
./usr/bin/.debug/foo
./usr/libexec/foo-hd2
./usr/libexec/.debug
./usr/libexec/.debug/foo

$ gdb usr/libexec/foo-hd2
Reading symbols from usr/libexec/foo-hd2...Reading symbols from usr/libexec/.debug/foo...done.
[Apply the patch]

(From OE-Core rev: d4eaf42f7708f8d3a31a04d958bd7420dd7dd6b9)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-28 10:30:28 +01:00
Paul Eggleton
87d3a9685d bitbake: parse/ast: ensure saved event handlers really do get restored
In finalize() we save event handlers, register the ones relevant to the
recipe being finalised, trigger events, and then restore the handlers so
that one recipe's custom handlers (actually implemented within a class
inherited by the recipe) do not affect other recipes. However, if an
exception occurs during parsing, the saved handlers were not being
restored. Use a try...finally block to ensure that the handlers are
always restored.

This issue became apparent since in OpenEmbedded-Core we have recently
introduced a find_intercepts() handler for the
bb.event.RecipePreFinalise event in image-postinst-intercepts.bbclass
that images and old-style SDK recipes will end up inheriting. So far it
doesn't seem that the the error has manifested itself in normal builds,
but when parsing OE-Core recipes in the OE layer index it has:
core-image-rt-* image recipes were parsed which in the default
configuration raise SkipRecipe. The next non-image recipe that is parsed
will trigger a real exception, because the find_intercepts() handler is
still registered and gets fired, but in the context of the new recipe
the POSTINST_INTERCEPTS_PATHS variable is not set, and the code in
find_intercepts() is written with the reasonable assumption that that
isn't possible given that the class itself sets a default, and thus it
fails.

(Bitbake rev: e5f1f8fa201774e0c3c554d59b277baa2128708f)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-24 07:53:14 +01:00
Chen Qi
34ec08dc28 utils.bbclass: fix KeyError exception
The following statement was accidently removed. Add it back.

  values['ml'] = ['']

This patch fixes the following error.

  Exception: KeyError: 'ml'

(From OE-Core rev: 0791c4d39edbedaa493a9fc6aa6e7415f14980bb)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-24 07:53:14 +01:00
Mingli Yu
950d863a6e mingetty: fix usrmerge install path
Update /sbin to $base_sbindir to fix the
below warning when usrmerge enabled in
DISTRO_FEATURES.

WARNING: mingetty-1.08-r3 do_package: mingetty: NOT adding alternative provide /usr/sbin/getty: /usr/sbin/mingetty does not exist
WARNING: mingetty-1.08-r3 do_package: QA Issue: mingetty: Files/directories were installed but not shipped in any package:
  /sbin
  /usr/sbin

(From OE-Core rev: 35b92053c5bc0f4ae4b92ca75456535ff78797a2)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-24 07:53:14 +01:00
Mingli Yu
238e027f20 mdadm: fix usrmerge install path
Update /lib to $nonarch_base_libdir to fix
the below error when usrmerge enabled in
DISTRO_FEATURES.

ERROR: mdadm-4.0-r0 do_package_qa: QA Issue: mdadm package is not obeying usrmerge distro feature. /lib should be relocated to /usr. [usrmerge]

(From OE-Core rev: 4b2c86ff0031effd4cfdb477f67bc213d39ae0fd)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-24 07:53:14 +01:00
Joshua Watt
409c8a3265 swig: Remove superfluous python dependency
The actual dependency on native Python and is handled by inheriting
python3native

(From OE-Core rev: 115a6dea664c9b18fd19b79659029afb52b1a660)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-24 07:53:14 +01:00
Richard Purdie
317bf10d4d scripts: Add autobuilder worker test script
Add a script which can be run on new autobuilder workers to check all needed configuration
is present. Designed to be run in a repo where bitbake/oe-core are already present.

This means when we add new autobuilder workers, we can quickly test whether all the needed
funcationality to support the standard yocto project autobuilder (ie. the standard
OE-Core tests) are present.

It uses images prebuilt in a previous release to cut build/testing time.

(From OE-Core rev: c9dd81fe9c88d8d9881686e60c17e6fab4b230f1)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-24 07:53:14 +01:00
Chen Qi
bd37421604 util-linux: upgrade 2.32 -> 2.32.1
(From OE-Core rev: 711f867b1d036aba04e839e955e0fa9d81d3c794)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Robert Yang
d32da706eb distcc: 3.3 -> 3.3.2
(From OE-Core rev: 3e9fd6ebd1a22885688908d32bddf21ebafb4d30)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Robert Yang
11f58843df elfutils: 0.172 -> 0.173
(From OE-Core rev: ab3f8e58485d0e90da3a0255d771737852ba345b)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Robert Yang
5306acd218 dbus-test: 1.12.8 -> 1.12.10
(From OE-Core rev: de09efcfac778cbdc5b2c582d16fc75206e96111)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Robert Yang
cf3d05f378 dbus: 1.12.8 -> 1.12.10
(From OE-Core rev: 35104cc5899faf3b39cd44c1c6192f8adeaf7cab)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Robert Yang
632836de27 pciutils: 3.6.1 -> 3.6.2
(From OE-Core rev: 3347b7e5641646348e06a6f4c603d83c6be867c9)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Robert Yang
66452579a1 diffstat: 1.61 -> 1.62
Refresh avoid-check-user-break-cc.patch to fix fuzz warning.

(From OE-Core rev: 6d9ab12ac113f0f33289200ca3c9df24d9fc1cc2)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Robert Yang
6b1f822445 strace: 4.23 -> 4.24
Remove backported patch 0001-tests-fix-build-with-fresh-glibc.patch.

(From OE-Core rev: 20b45274681892cc761bbef87360dc1088d040a1)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Richard Leitner
a0de8a6fb8 oeqa/core/decorator: add skipIfInDataVar
skipIfInDataVar will skip a test if a value is in a certain variable.

(From OE-Core rev: 10b935c713748346aea6c36c2f41e0ae6c320821)

Signed-off-by: Richard Leitner <richard.leitner@skidata.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
He Zhe
6185e3d23c ltp: Fix ftest06 too small file path string
The name string is too small to contain normal full path names and causes
the following failure.

"ftest06     2  TFAIL  :  ftest06.c:223: Can't chdir(): errno=ENOENT(2): No such file or directory"

(From OE-Core rev: 24faf8b9bbee82033d5f636f254e59b8d3d31ea5)

Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Andre McCurdy
f54806852b openssl: remove dependency on relative_symlinks class
Although the relative_symlinks class converts any absolute symlinks
in ${D} into relative symlinks automatically, it's a little clearer
to create relative symlinks directly where possible.

(From OE-Core rev: 959b4d30b5b11e4a098654b0d4469bbdf01b3812)

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Robert Yang
9b0bc119b7 compress_doc.bbclass: Clean up getstatusoutput usage
Replace usage of oe.utils.getstatusoutput() with direct subprocess calls.

(From OE-Core rev: f1a1b31add242380490023c2ee7eec1b4fbcd85b)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Robert Yang
1ad6e2cd04 psplash: Clean up getstatusoutput usage
Replace usage of oe.utils.getstatusoutput() with direct subprocess calls.

(From OE-Core rev: 2a06abb258768504a3ad97f61c987709227d7109)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Robert Yang
37b1ed066d lib/oe/patch.py: Clean up getstatusoutput usage
We can't use subprocess.check_output() or subprocess.call() here since the one
who invokes runcmd() needs handle CmdError() exception (error out or ignore
it).

(From OE-Core rev: c3e7739987d804f7865428442479d5bece5ff2dd)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Robert Yang
7cb2ece8b5 lib/oe/gpg_sign.py: Clean up getstatusoutput usage
Replace usage of oe.utils.getstatusoutput() with direct subprocess calls.

(From OE-Core rev: 90c730a898f11adb2ecd377cdd913af83123bcb7)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 18:02:23 +01:00
Richard Purdie
00b360c75b utils: Fix patch merging error
The previous patch has duplicate split calls and one needs to be removed
to avoid failures

(From OE-Core rev: 02c8d048cbab38a48f698504d0f5e912d3d24a36)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 17:58:59 +01:00
Richard Purdie
99d40ac092 utils: Rely on get_multilib_datastore() to get the original datastore
get_multilib_datastore() should be able to handle the original datastore
correctly now so rely upon this rather than custom coding.

(From OE-Core rev: 2ae85af480066e252fca01f3005ecac2ff37a8d4)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 17:58:59 +01:00
Richard Purdie
2988d730a3 glibc-ld: Simplify/cleanup multilib handling to use library functions
We have library functions to handle multilib variables/datastores, lets
use them so we have good common functions.

(From OE-Core rev: 774219567987956fb7bbb50e64eb6cebef1efe5b)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 17:58:59 +01:00
Richard Purdie
5875571f03 lib/oe/utils: Fix get_multilib_datastore to work for original tune
Currently the original datastore returned by this function doesn't
always work as the tune isn't set back to the original. Fix it
to work like all_multilib_tune_list() in utils.bbclass and correct
the data returned.

(From OE-Core rev: 4e1dc858fbf671ef27089a2b9bcdc965fe19d698)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 17:58:59 +01:00
Richard Purdie
14dfb7ea59 glibc: Improve ldd loader specification
Currently if a tune isn't specified in the table, the loader defaults for the
architecture are used which may or may not match our path specification. This
leads to general confusion.

Change the code to use the linuxloader class which works of architecture, not
tune.

This still isn't perfect as n32/x32 aren't covered but its an improvement
to listing all tunes here.

(From OE-Core rev: 46a6da24b51426bedd9af8a2d63b2992b9d3fa5a)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 17:58:59 +01:00
Richard Purdie
516697bed6 linuxloader: Convert to python function
We could do with one decent general purpose python function to query the
path to the dynamic loader. Convert the shell code into python.

Also correct baremetal to return "None", not musl loaders.

(From OE-Core rev: 73fab4ede12d8ae31be72b5cb4ab29d7ef7dae17)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 17:58:59 +01:00
Rasmus Villemoes
7b23f6124b lib/oe/package.py: use bb.utils.break_hardlinks helper
This does the same thing, but is more efficient in case st_nlinks
is (already) 1.

Depends on bitbake commit 7ae93cf40ab91965147055100432961436bce46c .

(From OE-Core rev: a09f8e32044c8daec2d2fb3ff0e830c21402df6e)

Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 09:04:29 +01:00
Rasmus Villemoes
9873b21e89 package.bbclass: use bb.utils.break_hardlinks helper
This does the same thing, but is more efficient in case st_nlinks
is (already) 1.

Depends on bitbake commit 7ae93cf40ab91965147055100432961436bce46c .

(From OE-Core rev: 38180b5c1044be13458fb927ad1babae61e4c51f)

Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 09:04:29 +01:00
Richard Purdie
04d2f75b4a sanity.conf: Update minimum bitbake version to 1.39.1
We need this for the new break_hardlinks helper function.

(From OE-Core rev: d6ccefd347bf31acf8d31996d796717acb4da74f)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 09:04:29 +01:00
Richard Purdie
d2ef693c9a bitbake: bitbake: Bump version 1.39.0 -> 1.39.1
(Bitbake rev: 49c3fd2489867c09dec6919a25b53d935a8204bb)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 09:02:54 +01:00
Joshua Watt
cbe2d3cb0a bitbake: daemonize: Flush stdio on exit
In spite of a comment suggesting otherwise, os._exit() does not flush
buffered output from file descriptors before exiting the process like
os.exit() does. This means that any un-flushed output is lost in the
daemon process, in particular the traceback from any thrown exceptions,
making debugging exceptions in the daemon quite difficult.

The solution is to flush stdout and stderr before exiting.

(Bitbake rev: fcc8e1ff53696f78dd64b4ee32f3c433b7a47df0)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 08:50:23 +01:00
Karsten Strand
b6bc5f068a bitbake: toaster: Fix comparison in recipe template
Use == instead of = when comparing task outcome to OUTCOME_FAILED.

Prior to this fix the recipe template would cause a TemplateSyntaxError
exception.

(Bitbake rev: a53ffec4ed3d0f9221bca398e20e8f480fb2b325)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 08:50:23 +01:00
Hongxu Jia
a11008a90d patch: fix CVE-2018-6952
(From OE-Core rev: 1314a6953aa647706107557faaba8574e307d2bd)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:01 +01:00
Jagadeesh Krishnanjanappa
227a6c1acb perl: CVE-2018-12015
Remove existing files before overwriting them

Archive should extract only the latest same-named entry.
Extracted regular file should not be writtent into existing block
device (or any other one).

https://rt.cpan.org/Ticket/Display.html?id=125523

Affects perl <= 5.26.2

(From OE-Core rev: 037b205e89ae4c7d638a5c15d64f60e16facbaa2)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:01 +01:00
Jagadeesh Krishnanjanappa
79c8c36471 libarchive: CVE-2017-14503
Reject LHA archive entries with negative size.

Affects libarchive = 3.3.2

(From OE-Core rev: d6479f5d2e6de17bac8662f5057d87176524c6fa)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:01 +01:00
Jagadeesh Krishnanjanappa
2128c21a0c libsndfile1: CVE-2017-14634
double64_init: Check psf->sf.channels against upper bound

This prevents division by zero later in the code.

While the trivial case to catch this (i.e. sf.channels < 1) has already
been covered, a crafted file may report a number of channels that is
so high (i.e. > INT_MAX/sizeof(double)) that it "somehow" gets
miscalculated to zero (if this makes sense) in the determination of the
blockwidth. Since we only support a limited number of channels anyway,
make sure to check here as well.

CVE-2017-14634

Closes: #318

Affects libsndfile1 = 1.0.28

(From OE-Core rev: eee93149a49274dc3deed7d89754ee4bda240575)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:01 +01:00
Jagadeesh Krishnanjanappa
ae3da5fa84 libsndfile1: CVE-2017-14245 CVE-2017-14246
sfe_copy_data_fp: check value of "max" variable for being normal
and check elements of the data[] array for being finite.

Both checks use functions provided by the <math.h> header as declared
by the C99 standard.

Fixes #317
CVE-2017-14245
CVE-2017-14246

Affects libsndfile1 = 1.0.28

(From OE-Core rev: ad842a3a0e6ef78fb9449362753ae3592c775192)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:01 +01:00
Andre McCurdy
5bd9e094ec gnutls: drop PACKAGECONFIG options for SSL v3 and TLS v1.3
By including PACKAGECONFIG options, the recipe takes responsibility
for defining the default state of these options. Although the recipe
currently aligns with the gnutls defaults (ie both disabled) tracking
new gnutls releases will be a maintenance effort. Unless there's a
clear reason to do otherwise, it seems safer to leave the choice of
which SSL/TLS versions to enable by default up to the gnutls
developers.

(From OE-Core rev: 4c1d03eb226aa838622852b70a87260ab1ac9d91)

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:01 +01:00
Andre McCurdy
57191c57c2 gnutls: drop obsolete configure.ac patch
>From gnutls 3.5.8 onwards, the code in configure.ac has been passing
"basename $i" to sed, rather than "echo $i". Since the full ${srcdir}
path is not being processed, there's no risk of unexpected matches.

  478179316b

(From OE-Core rev: bce938174d1207685c67c40e341a36ab1158e6eb)

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:01 +01:00
Andre McCurdy
48e3b5fa99 gnutls: merge gnutls.inc into the gnutls recipe
(From OE-Core rev: 0119335af368dffa42d9cda673e7aaafbc6f657f)

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:00 +01:00
Richard Purdie
652d25c09d oeqa/runtime/ldd: Clean up test
* Merge the two tests together as having them separate is pointless
* Test that ldd runs correctly
* Add in a dependency on the "ldd" package being installed instead of
  the sdk tools feature

(From OE-Core rev: 80db456387fb63ee74d53a9719ab3997432f4c80)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:00 +01:00
Changqing Li
f99a77a2db u-boot: patch for CVE-2018-1000205
(From OE-Core rev: a8db39548d9985962e4f8764b10856af5226d210)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:00 +01:00
Andre McCurdy
fa3529e117 perl: avoid using += with an over-ride
Using += with an over-ride can be a source of confusion so try to
avoid the construct in core recipes.

(From OE-Core rev: 2588c2aae11b7b480022dc11575295fdc792bf3f)

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:00 +01:00
Changqing Li
a3928b3463 freetype: Upgrade 2.9 -> 2.9.1
The -config script can now be disabled from configure.

Drop backported patch now merged.

(From OE-Core rev: f2c1d7109014ef9d804c3a6967b96143834ff7bd)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:00 +01:00
Jens Rehsack
292471701b libxml-parser-perl: fix "...contains bad RPATH"
The perl distribution "XML-Parser" relies for configuration
on the tooling of Devel::CheckLib - which is not aware of
sysroot locations nor of reasonable compiler/link definitions
from outside.

This causes

    ERROR: libxml-parser-perl-2.44-r0 do_package_qa: QA Issue: package libxml-parser-perl contains bad RPATH ${BUILDDIR}/tmp/work/core2-64-poky-linux/libxml-parser-perl/2.44-r0/recipe-sysroot/usr/lib in file ${BUILDDIR}/tmp/work/core2-64-poky-linux/libxml-parser-perl/2.44-r0/packages-split/libxml-parser-perl/usr/lib/perl/vendor_perl/5.24.4/auto/XML/Parser/Expat/Expat.so
    package libxml-parser-perl contains bad RPATH ${BUILDDIR}/tmp/work/core2-64-poky-linux/libxml-parser-perl/2.44-r0/recipe-sysroot/usr/lib in file ${BUILDDIR}/tmp/work/core2-64-poky-linux/libxml-parser-perl/2.44-r0/packages-split/libxml-parser-perl/usr/lib/perl/vendor_perl/5.24.4/auto/XML/Parser/Expat/Expat.so [rpaths]
    ERROR: libxml-parser-perl-2.44-r0 do_package_qa: QA run found fatal errors. Please consider fixing them.
    ERROR: libxml-parser-perl-2.44-r0 do_package_qa: Function failed: do_package_qa

It's strongly encouraged to the maintainer @toddr to rework the
toolchain for up to date environments.

[RP: Added fix for nativesdk RPATH issues too]

(From OE-Core rev: b103bb9426c0e5e3ef0fe0c34274ad3a06af8b6a)

Signed-off-by: Jens Rehsack <sno@netbsd.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:00 +01:00
Jens Rehsack
454443647a cpan.bbclass: adopt to recent EU::MM
The modern the time, the improvements in ExtUtils::MakeMaker.

Nowadays, .packlist and perllocal.pod aren't touched anymore when appropriate
flags set during configure stage. Controlling the flags globally avoids
dual-life recipes need share patching.

Further: remove prepending ${PERL_ARCHLIB} in PERL5LIB - it's wrong (search
order is site_lib, vendor_lib, core) - and ${PERL_ARCHLIB} contains core
libpath only ...

(From OE-Core rev: 2e61533e7c1b1cfd49dc771e907207f11a15c44f)

Signed-off-by: Jens Rehsack <sno@netbsd.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:00 +01:00
Hongzhi.Song
01f70f0265 cryptodev-linux: Fixes a kernel crash observed with cipher-gcm test
The crypto API for AEAD ciphers changed in recent kernels, so that
associated data is now part of both source and destination scatter
gathers. The source, destination and associated data buffers need
to be stiched accordingly for the operations to succeed.

(From OE-Core rev: 76da04571b8cb2241b3f46dec4935ff299639b7d)

Signed-off-by: Hongzhi.Song <hongzhi.song@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:00 +01:00