Commit Graph

29659 Commits

Author SHA1 Message Date
Richard Purdie
e292e935b0 Revert "file: update SRCREV for 5.28 to fix fetch fail on missing commit"
This reverts commit 87c17b352daa63bc4f62e8802982288ab1839f1b.

Upstream restored the original hashes.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-21 22:39:46 +00:00
Paul Gortmaker
555d776785 file: update SRCREV for 5.28 to fix fetch fail on missing commit
Machines that cloned a while ago will have the commit, but new
deployments won't because it seems the upstream changed/rebased
and the old commit ID has been garbage-collected away.  Hence
the fetch fails to check out the named commit ID.

Both the old (gone) commit, and the "new" commit show the same
dates and commit log and point at 5.28, so hopefully this is
the right thing to do.  A git diff of the two seems to only show
a blanket uprev of CVS tags and deletion of a couple autogen'd
files, and no real source changes.

(From OE-Core rev: adb71e06768adadda7b69c3b5e81ca3ad67237f4)

Cc: Christos Zoulas <christos@zoulas.com>
(From OE-Core rev: 87c17b352daa63bc4f62e8802982288ab1839f1b)

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-20 13:59:22 +00:00
Markus Lehtonen
6c08cf277a lib/oe/gpg_sign: fix rpm signing with gpg > 2.1
We need to check the gpg version and alter its command line options
accordingly.

[YOCTO #11054]

(From OE-Core rev: 863459e6b565eb6b1a74b78bc01e884ffeac2085)

Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 44a44b7e582a5a654baf21829d168568481c13d9)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-14 15:21:07 +00:00
Markus Lehtonen
35c95af7a8 lib/oe/gpg_sign: make gpg version a property of the signer
(From OE-Core rev: 951d22cb62891c4bc078925c4af8445d7be940e0)

Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit a00a362e3dc18ba04230cbbd6f91264e5d76f40d)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-14 15:21:07 +00:00
Markus Lehtonen
5e874ac0b1 rpm: support customizing gpg command line
Add a new %_gpg_sign_cmd_extra_args macro that allows customizing the
gpg options used when signing rpm packages. This is needed to be able to
sign packages with gpg 2.1 which requires "--pinentry-mode loopback" to
allow non-interactive signing.

[YOCTO #11054]

(From OE-Core rev: 5cbba2c4016ad84a54f83531868aa6e66eef468e)

Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 373a7146d596d27376a003014df0d06f3df5348d)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-14 15:21:07 +00:00
Markus Lehtonen
fd78c35086 lib/oe/gpg_sign: sign rpm packages in chunks of 100
Split the file list into chunks in order to avoid
"OSError: [Errno 7] Argument list too long"

This would happend when a package has huge amount of subpackages, e.g.
glibc-locale.

[YOCTO #11069]

(From OE-Core rev: 786eafd7b1080eccfe1c7d417eede20d75d80cb0)

Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 874f5016fd4dc76bc867b68470297fe59e78a9e6)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-14 15:21:07 +00:00
Joe Slater
1038cb98e6 e2fsprogs: have configure expand @mkdir_p@
Without doing this, locale data is not written
into usr/src/locale.

We could also just use MKDIR_P instead of mkdir_p.

(From OE-Core rev: 6a767f6587a9d60e21fa1d9687c7c08efe3f89ab)

Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-14 15:20:42 +00:00
Juro Bystricky
8ab3fa3758 python-3.5-manifest: Add imp to importlib
The imp python module is the forerunner of importlib. Include imp in
the importlib subpackage instead of the misc subpackage so that it can
be depended on without bringing in a bunch of unrelated, unused modules.

(Slightly modified backport of afd9de380d
by George McCollister <george.mccollister@gmail.com>)

[YOCTO#11134]

(From OE-Core rev: 65f6010346c08bf90f381a2d834dd9908ba2100c)

Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-14 15:20:12 +00:00
George McCollister
b0f3c0fb99 gdb-cross-canadian: Depend on nativesdk-python3-importlib
Add missing dependency on nativesdk-python3-importlib so the imp Python
module is installed.

Before this patch, running gdb from the sdk would give the following
error:

Python Exception <class 'ImportError'> No module named 'imp':

(From OE-Core rev: ad00a31fbe93e073a2d83616efcd08c5a7ef37c9)

(From OE-Core rev: d6e7dc5cbf1cc09c8882a717cd4dd34d10ec7fa3)

Signed-off-by: George McCollister <george.mccollister@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-14 15:20:12 +00:00
Richard Purdie
6a1f33cc40 build-appliance-image: Update to morty head revision
(From OE-Core rev: 55c835c73cc41b6fc809c941c295d62a612e49e0)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-08 12:00:36 +00:00
Alexandru Moise
8ba5b9eae3 openssl: CVE: CVE-2017-3731
If an SSL/TLS server or client is running on a 32-bit host, and a
specific cipher is being used, then a truncated packet can cause that
server or client  to perform an out-of-bounds read, usually resulting
in a crash.

Backported from:
8e20499629
2198b3a55d

* CVE: CVE-2017-3731

Upstream-status: Backport

(From OE-Core rev: 1fe1cb3e6e03b4f7f0d30b2b67edc8809a18fe70)

Signed-off-by: Alexandru Moise <alexandru.moise@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-08 12:00:21 +00:00
Sona Sarmadi
a2f06ef254 libx11: CVE-2016-7943
The XListFonts function in X.org libX11 before 1.6.4 might allow
remote X servers to gain privileges via vectors involving length
fields, which trigger out-of-bounds write operations.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7943
https://lists.x.org/archives/xorg-announce/2016-October/002720.html

Upstream patch:
https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8c29f1607a31dac0911e45a0dd3d74173822b3c9

(From OE-Core rev: d627e5bd50f66275cb3a77036ea3376a6f1e9a96)

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-08 12:00:21 +00:00
Sona Sarmadi
eed433faba libX11: CVE-2016-7942
The XGetImage function in X.org libX11 before 1.6.4 might allow remote X
servers to gain privileges via vectors involving image type and geometry,
which triggers out-of-bounds read operations.

References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7942
Upstream patch
https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8ea762f94f4c942d898fdeb590a1630c83235c17

(From OE-Core rev: 6d4421301a54c26e390fa943805574ced6e18c3a)

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-08 12:00:21 +00:00
Sona Sarmadi
4f991d93f6 libXrandr: fix for CVE-2016-7947 and CVE-2016-7948
CVE-2016-7947
Insufficient validation of server responses result in Integer overflows

CVE-2016-7948
Insufficient validation of server responses result in various data mishandlings

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7947
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7948
https://lists.x.org/archives/xorg-announce/2016-October/002720.html

Upstream patch for both CVEs:
https://cgit.freedesktop.org/xorg/lib/libXrandr/commit/?id=a0df3e1c7728205e5c7650b2e6dce684139254a6

(From OE-Core rev: 1c293e889f6eeae36f8f6ddd9676c65d613ad0fc)

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-08 12:00:21 +00:00
Sona Sarmadi
b45822fe66 libxrender: CVE-2016-7949
Insufficient validation of server responses results
in overflow of previously reserved memory

Upstream patch:
https://cgit.freedesktop.org/xorg/lib/libXrender/commit/?id=9362c7ddd1af3b168953d0737877bc52d79c94f4

External References:
https://lists.x.org/archives/xorg-announce/2016-October/002720.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7949

(From OE-Core rev: 87ffd7ce2e8ece8b44ff3f1c219a74b3590cf14b)

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-08 12:00:21 +00:00
David Vincent
7cf454e23c classes: Fix alternatives and rc.d ordering
When using an alternative as an initscript, the ordering between
update-rc.d and update-alternatives tasks during prerm and postinst
tasks must always be the following in order to work:
  * prerm:
    - stop daemon
    - remove alternative

  * postinst:
    - add alternative
    - start daemon

This patchset adds comments to the scripts generated by both classes and
organize the generated sections based on those comments.

[YOCTO #10433]

(From OE-Core rev: b0c70bef015f1b2a30556a5db5e255592d5bf316)

Signed-off-by: David Vincent <freesilicon@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit aa87b1a4dcc14e4dfe719b6c55045c5662bc59c2)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-08 12:00:21 +00:00
Andreas Müller
62175510dc nspr: set correct version in pkg-config file
while we are at it clean up sed

(From OE-Core rev: 69e9f7ec8ba8649784a27e9c7dc7a6987a53c22e)

(From OE-Core rev: cb4f5ecf32006192baaf41218a3d7b43ca1c2951)

(From OE-Core rev: 79f821fb6c1b425ca5cb5e6db360c2743d6c989e)

Signed-off-by: Andreas Müller <schnitzeltony@googlemail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-03 09:51:32 +00:00
Denys Dmytriyenko
f2ff6a40c4 attr/ea-acl: pass --disable-gettext when USE_NLS=no
Fixes following error in configure:
  FATAL ERROR: msgfmt does not seem to be installed.
  attr cannot be built without a working gettext installation.

(From OE-Core rev: 85e087d9b323ad87c59900f01aad751c9c7a9e3a)

Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>

(From OE-Core rev: d044fad8a0ac5d57deb88b25106f3a39cb7c1636)

Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-03 09:51:32 +00:00
Denys Dmytriyenko
28b0f21342 linux-dtb: strip DTB extension properly in postinst/postrm
The use of awk -F "." in do_install/do_deploy to strip filename extension
was deprecated long time ago in 72980d5bb465f0640ed451d1ebb9c5d2a210ad0c.

Make a similar change in postinst/postrm to properly use basename command.

Otherwise DTB files that contain dots in the name result in broken symlinks
that point to non-existent truncated files.

(From OE-Core rev: ed0f9cf63cb1226f9d92377e13ef63e36a95d29d)

Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>

(From OE-Core rev: 40c2addf0f0ee16b1c1334cf00f1490ffeaac475)

Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-03 09:51:32 +00:00
Sona Sarmadi
6e43936704 libxtst: 1.2.2 -> 1.2.3
Upgrade libxtst from 1.2.2 to 1.2.3 to address:
Out of Bounds Write Denial of Service Vulnerability, CVE-2016-7951

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7951
https://cgit.freedesktop.org/xorg/lib/libXtst/commit/?id=9556ad67af3129ec4a7a4f4b54a0d59701beeae3

(From OE-Core rev: 02a0dd90c3f3b1fc6ebddc17feb824d11848b2a7)

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-03 09:51:32 +00:00
Manjukumar Matha
314c727daa binutils-2.27.inc: Fix alignment frags for aarch64
There was bug with alignment frags for aarch64 in binutils. This is fixed in
master of binutils. This patch backports the fix to binutils 2.27 version.

(From OE-Core rev: f6f87019073d4f3caa7766aca89faa6781690fba)

(From OE-Core rev: c2dcf53587957244e231e1489efa75062a7ceacc)

Signed-off-by: Manjukumar Matha <manjukumar.harthikote-matha@xilinx.com>
Signed-off-by: Nathan Rossi <nathan@nathanrossi.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-02-03 09:51:32 +00:00
Ed Bartosh
a3fa5ce876 populate_sdk_ext: whitelist do_package tasks
With enabled SSTATE_MIRRORS sstate code expects mirrors to
contain entries for all tasks, which is not the case for ext
installer as it uses reduced sstate cache.

Added do_package tasks to BB_SETSCENE_ENFORCE_WHITELIST to prevent
installer failing with ERROR: Sstate artifact unavailable

[YOCTO #10832]

(From OE-Core rev: 2ed46ada4b8e496493835e84b36f7e9c367f59d2)

(From OE-Core rev: eb2fc2cd9081a4533ed30fe81c9f491b06cc5ae1)

Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-12 17:52:04 +00:00
Ed Bartosh
fd30939f5f populate_sdk_ext: fix working with uninative sstate
Mapped uninative sstate directories to make ext SDK installer to
use them when it's run on systems with gcc version different from
gcc version used to build installer.

[YOCTO #10832]

(From OE-Core rev: fb945c0fd2e66d70461e6cf2e602020eeabe32f7)

Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-12 17:52:04 +00:00
Joshua Lock
e0b862b68c zlib: update SRC_URI to fix fetching
Upstream have removed the file from zlib.net as a new version has
been released, switch to fetching from the official sourceforge
mirror.

[YOCTO #10879]

(From OE-Core rev: bb99e4a620efd59556539c156cd98ea23aae74c8)

(From OE-Core rev: b7599330f1d629384e16a5fbeffc1a65c1555667)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-12 17:52:04 +00:00
Richard Purdie
4b8ddc4322 build-appliance-image: Update to morty head revision
(From OE-Core rev: ae3513b8e752d0dc1757fbfc681f644a3f2855b0)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:26:52 +00:00
Richard Purdie
6a3f93a377 libgcc-common: Don't apply symlinks for nativesdk
nativesdk-libgcc doesn't need a symlink into the target space and if we do this
sstate installation of the recipe can fail depending on whether it races with
the cross-canadian toolchains.

(From OE-Core rev: b2c1e1fe4221862e0dbf5d08960f0d0228e47c72)

(From OE-Core rev: 62012e81c6f7aaad5d9c5e8bec2e2417433572e3)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:46 +00:00
Richard Purdie
b4f432e390 bitbake.conf: Add inclusion of BB_CURRENT_MC.conf after local.conf
People are strugling with multiconfig as the up front inclusion of the
configuration file doesn't do what people expect. The only way to meet
user expectations is to include the file immediately after local.conf.

We add BB_CURRENT_MC to bitbake so that the metadata can determine when
to include the extra configuration.

(From OE-Core rev: a6a3894fb2cb2097d2404b8b8cb2b85df595cfa9)

(From OE-Core rev: 378ba0c92172ed7850ec1b0eb2971afb0dae427b)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:46 +00:00
Richard Purdie
6f65543778 uninative: Parameterise the use of STAGING_DIR
This means that a user can change TMPDIR in a multiconfig situation
and still only have one path to the uninative setup. Without this change
its not possile to make such a setup work.

(From OE-Core rev: 779422c5458f5f643b3a4a0dedaa4d9ad709367a)

(From OE-Core rev: f50547fb9d70a8ae079380c25e697da3d2c2b181)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:46 +00:00
Ed Bartosh
124df4ee35 selftest: wic: fix test_qemu
Setting WKS_FILE variable in qemux86-64 made wic test to
use wrong wks file to produce an image and resulted in
test_qemu failure.

Used conditional assignment in qemux86-64 and explicitly
set WKS_FILE in wic testing suite to make the suite to use
wic-image-minimal.wsk. This should fix test_qemu failure.

(From OE-Core rev: 3bca4d18c2712e3b154bacfb917f0a749ebaddeb)

(From OE-Core rev: bda4e3cceda2205a0a5d916ef5b674df560d43f9)

Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:46 +00:00
Ross Burton
6c5a52ca8f utils: Always use datastore's PATH for host_gcc_version
BUILD_CC may reference something like ccache and expect this to come from
ccache-native, we at least have some selftests which assume this. Modify the
code to use PATH when runnig BUILD_CC to ensure the tests continue to work
as expected.

(From OE-Core rev: f3e753372baac43d0921186340cf260df056de20)

(From OE-Core rev: e7ec3228d9a2f40165b60f273205c17438b2c9bb)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

Hand applied and used d.getVar(True)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:46 +00:00
Jackie Huang
51e2f226bd valgrind: make ld-XXX.so strlen intercept optional
Hack: Depending on how glibc was compiled (e.g. optimised
for size or built with _FORTIFY_SOURCE enabled) the strlen
symbol might not be found in ld-XXX.so. Therefore although
we should still try to intercept it, don't make it mandatory
to do so.

(From OE-Core rev: 84ec50e587e7464b260b1b189659b93b6dab0ef6)

(From OE-Core rev: 850735191c131d7baab72e7df6292b189ea56801)

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:46 +00:00
Ed Bartosh
8108c47740 uninative: rebuild uninative for gcc 4.8 and 4.9
Some c++ libraries fail to build if uninative is built
with gcc 5.x and host gcc version is either 4.8 or 4.9.

The issue should be solved by making separate uninative sstate
directory structure sstate-cache/universal-<gcc version> for host gcc
versions 4.8 and 4.9. This causes rebuilds of uninative if host gcc
is either 4.8 or 4.9 and it doesn't match gcc version used to build
uninative.

[YOCTO #10441]

(From OE-Core rev: d36f41e5658bbbb6080ee833027879c119edf3e0)

(From OE-Core rev: 3d39ca5c91dbb62fb43199f916bd390cd6212e3d)

Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:46 +00:00
Andrej Valek
c8f4fb15de libxml2: Fix more NULL pointer derefs
The NULL pointer dereferencing could produced some
security problems.
This is a preventive security fix.

(From OE-Core rev: 8f3008114d5000a0865f50833db7c3a3f9808601)

(From OE-Core rev: 401d552f9e4ed3341e42864e566dddb2b26019dc)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:46 +00:00
Andrej Valek
359189b6e6 libxml2: fix CVE-2016-4658 Disallow namespace nodes in XPointer points and ranges
Namespace nodes must be copied to avoid use-after-free errors.
But they don't necessarily have a physical representation in a
document, so simply disallow them in XPointer ranges.

(From OE-Core rev: 00e928bd1c2aed9caeaf9e411743805d2139a023)

(From OE-Core rev: cf810d5cc17cb6b9f53d21a404c89afe372accb7)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:46 +00:00
Andrej Valek
5ba779d5ab libxml2: Necessary changes before fixing CVE-2016-5131
xpath:
 - Check for errors after evaluating first operand.
 - Add sanity check for empty stack.
 - Include comparation in changes from xmlXPathCmpNodesExt to xmlXPathCmpNodes

(From OE-Core rev: 96ef568f75dded56a2123b63dcc8b443f796afe0)

(From OE-Core rev: 68b0f3a0bf8dfdf49be4aed1745a7f50662c555d)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:46 +00:00
Paul Eggleton
41e8df8228 lib/oe/rootfs: fix log_check warnings being printed twice with RPM packaging
We were calling _log_check() in the RPM-specific rootfs class as well as
in the base class; this is unnecessary and resulted in any errors/warnings
generated during the actual package installation time triggering two warnings
instead of one. Drop the call from RpmRootfs._create() to fix this.

(From OE-Core rev: 541c56d755ba0354297673e857628026ad9e4df2)

(From OE-Core rev: 9654a6a238a44ed1025a45e4ad1cb779a8684344)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Armin Kuster
baf73313b3 libtiff: Update to 4.0.7
Major changes:
The libtiff tools bmp2tiff, gif2tiff, ras2tiff, sgi2tiff, sgisv, and ycbcr are completely removed from the distribution, used for demos.

CVEs fixed:
CVE-2016-9297
CVE-2016-9448
CVE-2016-9273
CVE-2014-8127
CVE-2016-3658
CVE-2016-5875
CVE-2016-5652
CVE-2016-3632

plus more that are not identified in the changelog.

removed patches integrated into update.
more info: http://libtiff.maptools.org/v4.0.7.html

(From OE-Core rev: 9945cbccc4c737c84ad441773061acbf90c7baed)

(From OE-Core rev: 009b330591b27bd14d4c8ceb767c78fd7eb924fd)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Bruce Ashfield
985beaaa13 kernel-yocto: explicitly trap subcommand errors
To trap errors and halt processing, do_kernel_metadata was recently
switched to exit on any non zero return code. While the concept is
sound, there are subcommands that have legitimate non-zero return
codes.

Instead of removing set +e, we'll explicitly check the return code
of the commands that can error, and throw a bbfatal to alert the
user.

(From OE-Core rev: a4705e62d0973c290011fc0d250501d358b659e8)

(From OE-Core rev: a4888a63620fa05e1399355d9e20c2da586efb4c)

Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Bruce Ashfield
c5489cb14a linux-yocto/4.8: update to -rt7
Updating to the latest 4.8-rt

(From OE-Core rev: 9f4565a308be55c1bf11706041c0565d48bda4f4)

(From OE-Core rev: d7ca7a37c8a5f8baefadc44bdfc1a697d2fe4616)

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Yuanjie Huang
80d90725f5 glibc: Enable backtrace from abort on ARM
ARM stack frames for abort and raise were limited to the the actual
abort and raise call, such as:

Obtained 4 stack frames.
./test-app(print_trace+0x1c) [0x10a08]
./test-app() [0x10b3c]
/lib/libc.so.6(__default_sa_restorer+0) [0x4adae1e0]
/lib/libc.so.6(gsignal+0xa0) [0x4adacf74]

This is not terribly useful when trying to figure out what function
may have called called the abort, especially when using pthreads.

After the change the trace would now look like:

Obtained 8 stack frames.
./test-app(print_trace+0x1c) [0x10a08]
./test-app() [0x10b3c]
/lib/libc.so.6(__default_sa_restorer+0) [0x4befe1e0]
/lib/libc.so.6(gsignal+0xa0) [0x4befcf74]
/lib/libc.so.6(abort+0x134) [0x4befe358]
./test-app(dummy_function+0x50) [0x10adc]
./test-app(main+0xd4) [0x10c24]
/lib/libc.so.6(__libc_start_main+0x114) [0x4bee7a58]

(From OE-Core rev: 93bf8713d8e13c278543baea94fb8dad0cb80e49)

(From OE-Core rev: b0e6a6048fa09dceac78bf8c46d484690ff5b098)

Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Chen Qi
389d0a02d7 Use weak assignment for SERIAL_CONSOLES in qemu configuration files
Use weak assignment for SERIAL_CONSOLES in qemu configuration files so that
the value could serve as a default value and could be easily overridden in
configuration files like local.conf.

When using the default value for SERIAL_CONSOLES in qemux86-64,we would have
annoying messages on console complaining about respawning getty on ttyS1.
Although the value is set by purpose, at least we need to provide an easy way
to override it.

(From OE-Core rev: 5f060b66162c41a295995947b918253450870117)

(From OE-Core rev: 5a19335f0f1d763a066a8c9ead23bb332e229f93)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Ross Burton
ea584f108c archiver: don't change directory when generating tarball
There's no need to chdir() as tarfile.add() can be told what name to use in the
archive.

(From OE-Core rev: d0b282bce34db44dde4dd7f53a64dfaafe6789de)

(From OE-Core rev: d637d5f02be4eab26cfab7352a8ea584fb1f7e4d)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Awais Belal
29184b22d7 grub2: fix some quirks and div by zero
Rather than erroring out on a single attempt while
terminating EFI services, make a few retries because
such quirks are found in a few implementations.
Also fix a div by zero issue in the same framework
which causes an infinite reboot on the target.
Both patches included here are backports.

(From OE-Core rev: 5e6ac806bd9b8bf885ef1e88484e91e4cdaaa69a)

(From OE-Core rev: dbe597b317067362e7acddbefd0d6768f6a44e8c)

Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Chen Qi
2cfd1582df libarchive: fix ALTERNATIVE_PRIORITY to avoid conflict
'tar' utility from tar and bsdtar has the same alternative priority.
'cpio' utility from cpio and bsdcpio has the same alternative priority.

Lower the ALTERNATIVE_PRIORITY to avoid conflict.

(From OE-Core rev: 9a59ff628771b586666999d44923968a6bc58956)

(From OE-Core rev: 773ea033e973abd2b97c62b8095d7142c020ad24)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Ross Burton
6011f5658d cve-check: allow recipes to override the product name
Add a new variable CVE_PRODUCT for the product name to look up in the NVD
database.  Default this to BPN, but allow recipes such as tiff (which is libtiff
in NVD) to override it.

(From OE-Core rev: ba330051570a4c991885ee726cb187e0c911bd4f)

(From OE-Core rev: bee636b759feafba544e95d6355c52eb85e4ba72)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Ross Burton
b9879ad3f9 curl: set CVE_PRODUCT
This is 'libcurl' in NVD.

(From OE-Core rev: f5381da49ac781ef017a1b9816c00b512ca9c7c2)

(From OE-Core rev: ae9910f08207d0bb1c57e72e4463768bc0445e48)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Ross Burton
1c8b9df38c tiff: set CVE_PRODUCT
This is 'libtiff' in NVD.

(From OE-Core rev: 0c8d1523f3ad0ada2d1b8f9abffbc2b898a744ca)

(From OE-Core rev: e89a617a64e25036b4f172692c7a461b5291cabb)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Juro Bystricky
1933b492ca targetloader.py: drop test for ClassType
ClassType was removed from python3.
The code testing for ClassType kept throwing AttributeError exceptions:

    module 'types' has no attribute 'ClassType'

The exceptions prevented loading of any dynamically resolved target
controllers.

(From OE-Core rev: d62f18c39bc0ed3b0f5ac8465b393c15f2143ecf)

(From OE-Core rev: 6258471b7077839519898d537b99dce0a0fc8aa4)

Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Bruce Ashfield
da3332f2e2 linux-yocto/4.x: CVE-2016-8655
Backporting upstream commit 84ac726023 [packet: fix race condition in
packet_set_ring] to address CVE-2016-8655

(From OE-Core rev: db7799747b263507427e325638353142ae79403c)

(From OE-Core rev: 9ec9712436080bb08c99d5ac6783383955bb7dc1)

Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00
Bruce Ashfield
50cf219c3a linux-yocto-rt/4.4: update to -rt43
After the update to 4.4.36 -rt no longer builds. The fixes for the
issues are found in the v4.4-rt43 release.

(From OE-Core rev: 262fff10ba5cdedbee9ba9ecf00f98dc9159477c)

(From OE-Core rev: 86e24908bb28d4e0ee7defdc64a2efd8eefe37c7)

Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-11 17:21:45 +00:00