]> code.ossystems Code Review - openembedded-core.git/log
openembedded-core.git
9 years agogcc: Security fix CVE-2016-2226
Armin Kuster [Wed, 11 May 2016 00:32:55 +0000 (17:32 -0700)]
gcc: Security fix CVE-2016-2226

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agogcc: Security fix CVE-2016-4489
Armin Kuster [Wed, 11 May 2016 00:26:39 +0000 (17:26 -0700)]
gcc: Security fix CVE-2016-4489

Signed-off-by: Armin Kuster <akuster808@gmail.com>
9 years agogcc: Security fix CVE-2016-4488
Armin Kuster [Thu, 5 May 2016 22:12:58 +0000 (15:12 -0700)]
gcc: Security fix CVE-2016-4488

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agoopenssl: prevent ABI break from earlier jethro releases
Joshua Lock [Fri, 13 May 2016 23:49:58 +0000 (16:49 -0700)]
openssl: prevent ABI break from earlier jethro releases

The backported upgrade to 1.0.2h included an updated GNU LD
version-script which results in an ABI change. In order to try and
respect ABI for existing binaries built against fido this commit
partially reverts the version-script to maintain the existing ABI
and instead only add the new symbols required by 1.0.2h.

Suggested-by: Martin Jansa <martin.jansa@gmail.com>
(From OE-Core rev: 480db6be99f9a53d8657b31b846f0079ee1a124f)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoopenssh: Security Fix CVE-2016-3115
Armin Kuster [Wed, 27 Apr 2016 22:20:00 +0000 (15:20 -0700)]
openssh: Security Fix CVE-2016-3115

opehssh <= 7.2

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobusybox: Security fix CVE-2016-2147
Armin Kuster [Wed, 27 Apr 2016 20:29:51 +0000 (13:29 -0700)]
busybox: Security fix CVE-2016-2147

busybox <= 1.24.2

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobusybox: Security Fix CVE-2016-2148
Armin Kuster [Wed, 27 Apr 2016 20:28:01 +0000 (13:28 -0700)]
busybox: Security Fix CVE-2016-2148

busybox <= 1.24.2

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agolibtiff: Security fix CVE-2015-8664 and 8683
Armin Kuster [Tue, 26 Apr 2016 20:19:44 +0000 (13:19 -0700)]
libtiff: Security fix CVE-2015-8664 and 8683

CVE-2015-8665
CVE-2015-8683

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoopenssl: 1.0.2d -> 1.0.2h (mainly for CVEs)
Robert Yang [Wed, 11 May 2016 07:43:28 +0000 (00:43 -0700)]
openssl: 1.0.2d -> 1.0.2h (mainly for CVEs)

* CVEs:
  - CVE-2016-0705
  - CVE-2016-0798
  - CVE-2016-0797
  - CVE-2016-0799
  - CVE-2016-0702
  - CVE-2016-0703
  - CVE-2016-0704
  - CVE-2016-2105
  - CVE-2016-2106
  - CVE-2016-2109
  - CVE-2016-2176

* The LICENSE's checksum is changed because of date changes (2011 ->
  2016), the contents are the same.

* Remove backport patches
  - 0001-Add-test-for-CVE-2015-3194.patch
  - CVE-2015-3193-bn-asm-x86_64-mont5.pl-fix-carry-propagating-bug-CVE.patch
  - CVE-2015-3194-1-Add-PSS-parameter-check.patch
  - CVE-2015-3195-Fix-leak-with-ASN.1-combine.patch
  - CVE-2015-3197.patch
  - CVE-2016-0701_1.patch
  - CVE-2016-0701_2.patch
  - CVE-2016-0800.patch
  - CVE-2016-0800_2.patch
  - CVE-2016-0800_3.patch

* Update crypto_use_bigint_in_x86-64_perl.patch

* Add version-script.patch and update block_diginotar.patch (From master branch)

* Update openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch
  (From Armin)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoRevert "kernel/kernel-arch: Explicitly mapping between, i386/x86_64 and x86 for kerne...
Tom Zanussi [Tue, 10 May 2016 21:50:05 +0000 (16:50 -0500)]
Revert "kernel/kernel-arch: Explicitly mapping between, i386/x86_64 and x86 for kernel ARCH"

This reverts commit a6f52930a68d8462e23486d51cdda715072dd752.

In addition to also causing the problem in [YOCTO #9579], this commit
was reverted in krogoth and master but wasn't reverted in jethro but
should be.  The original revert message was:

This reverts commit 8d310b24927d0f348fb431895f0583733db2aad0.

That commit completely breaks KBUILD_DEFCONFIG because it relies on
$ARCH to match between the target OE arch and the kernel subdirectory
containing the defconfigs. In the kernel all defconfigs for everything
x86-based (including x86_64) is stored in dir arch/x86/configs/

kernel-yocto.bbclass correctly searches for all the defconfigs inside
${S}/arch/${ARCH}/configs/${KBUILD_DEFCONFIG}

Commit 8d310b249 makes it search in wrong places and _only_ if you
define TARGET_ARCH = "athlon" will it search x86 which is nonsensical.

The commit further adds an if clause to hack the mungled kernel arches
back to their original values (ugh) in do_shared_workdir which is run
after do compile, but of course the build breaks before that in
do_kernel_metadata because of the KBUILD_DEFCONFIG mentioned above (so
that hack is useless).

Please fix that corner case bug in another way which does not completely
screw up the kernel arch mapping & defconfig logic. If 64bit configs are
generated in the kernel for 32bit machines because the host is asked,
then it it a bug in the kernel, it is of no use to hack around it in OE.

(From OE-Core rev: bc02a478a5d4a5de7b3943ed809d5c22711f5b1f)

Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
9 years agoglew: Correct version in autotooling patches
Martyn Welch [Wed, 27 Apr 2016 11:25:00 +0000 (12:25 +0100)]
glew: Correct version in autotooling patches

The additional autotooling patched into glew claims the version is 1.9.0
whilst we are building 1.12.0. The version in the autotooling is used to
set the version number in the pkgconfig file, this results in the
configuration of packages which depend on glew > 1.9.0 failing.

This patch updates the version number used in the patches to match that of
the version being built.

Signed-off-by: Martyn Welch <martyn.welch@collabora.co.uk>
9 years agogdb: fix QA warning (uClibc)
André Draszik [Fri, 29 Apr 2016 10:52:38 +0000 (11:52 +0100)]
gdb: fix QA warning (uClibc)

WARNING: QA Issue: gdb rdepends on libiconv, but it isn't a build dependency? [build-deps]

We already have virtual/libiconv which is set appropriately
in all environments, so let's use it to fix the issue.

Signed-off-by: André Draszik <adraszik@tycoint.com>
9 years agobinutils: backport bug fix to the 2.25 branch for jethro
Tristan Van Berkom [Wed, 27 Apr 2016 21:39:40 +0000 (17:39 -0400)]
binutils: backport bug fix to the 2.25 branch for jethro

We fail to build webkit on aarch64 due to this binutils bug:

   https://sourceware.org/bugzilla/show_bug.cgi?id=19353

Applying patch which fixes this, stripped out changelog entry
from patch to make it apply without error.

9 years agoglibc: Fix CVE-2015-8778
Yuanjie Huang [Wed, 27 Apr 2016 09:32:55 +0000 (02:32 -0700)]
glibc: Fix CVE-2015-8778

CVE: CVE-2015-8778

Improve check against integer wraparound in hcreate_r [BZ #18240]

This is an integer overflow in hcreate and hcreate_r which can result in
an out-of-bound memory access.  This could lead to application crashes
or, potentially, arbitrary code execution.

Upstream-Status: Backport [2.23]
(cherry-picked from commit bae7c7c74bd228c8)

Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
9 years agoboot-directdisk.bbclass: remove HDDIMG before create
Robert Yang [Mon, 25 Apr 2016 01:10:38 +0000 (18:10 -0700)]
boot-directdisk.bbclass: remove HDDIMG before create

Fixed when rebuild:
mkdosfs: file /path/to/hdd.image already exists

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry-pick from 9abcd309c098558360cde2bff65be840ead25f83)
Signed-off-by: Tim Kilbourn <tkilbourn@gmail.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoopkg: backport fix for double remove of packges
Stefan Agner [Mon, 25 Apr 2016 01:10:37 +0000 (18:10 -0700)]
opkg: backport fix for double remove of packges

Backport the fix 7885da3974 ("pkg_get_provider_replacees: do not
add installed pkg to replacee list"). This avoids opkg trying to
remove a package twice e.g. when upgrading.

Suggested-by: Alejandro del Castillo <alejandro.delcastillo@ni.com>
Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobind: CVE-2016-1285 CVE-2016-1286
Sona Sarmadi [Mon, 25 Apr 2016 01:10:36 +0000 (18:10 -0700)]
bind: CVE-2016-1285 CVE-2016-1286

CVE-2016-1285 bind: malformed packet sent to rndc can trigger assertion failure
CVE-2016-1286 bind: malformed signature records for DNAME records can
trigger assertion failure

[YOCTO #9400]

External References:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1285
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1286
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1285
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1286

References to the Upstream commits and Security Advisories:

CVE-2016-1285: https://kb.isc.org/article/AA-01352
https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch;
h=e7e15d1302b26a96fa0a5307d6f2cb0d8ad4ea63

CVE-2016-1286: https://kb.isc.org/article/AA-01353
https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch;
h=456e1eadd2a3a2fb9617e60d4db90ef4ba7c6ba3

https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch;
h=499952eb459c9a41d2092f1d98899c131f9103b2

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agolicense.bbclass: fix warnings when run in unprivileged "container" env
Bjørn Forsman [Mon, 25 Apr 2016 01:10:35 +0000 (18:10 -0700)]
license.bbclass: fix warnings when run in unprivileged "container" env

An unprivileged "container" environment like this[1] doesn't have root
account (uid 0) which causes tons of "Invalid argument" warnings:

  $ bitbake ...
  ...
  WARNING: Could not copy license file [src] to [dest]: [Errno 22] Invalid argument: '[src]'
  WARNING: Could not copy license file [src] to [dest]: [Errno 22] Invalid argument: '[src]'
  WARNING: Could not copy license file [src] to [dest]: [Errno 22] Invalid argument: '[src]'
  ...

Fix it by handling EINVAL similar to existing handling of EPERM (which
was added for when not running under pseudo).

[1]: The real environemnt is buildFHSUserEnv from NixOS/nixpkgs, but a
  demonstration of the issue can be done like this:

    $ touch f
    $ unshare --user --mount chown 0:0 f
    chown: changing ownership of ‘f’: Invalid argument

(From OE-Core master rev: d00b2250a6afebd7d1373c04b4006290f0cd4043)

Signed-off-by: Bjørn Forsman <bjorn.forsman@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agotzdata: update to 2016d
Armin Kuster [Mon, 25 Apr 2016 01:10:34 +0000 (18:10 -0700)]
tzdata: update to 2016d

Changes affecting future time stamps

America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
(Thanks to Alexander Krivenyshev for the heads-up.)

Asia/Magadan switches from +10 to +11 on 2016-04-24 at 02:00.
(Thanks to Alexander Krivenyshev and Matt Johnson.)

New zone Asia/Tomsk, split off from Asia/Novosibirsk. It covers
Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
at 02:00.  (Thanks to Stepan Golosunov.)

Changes affecting past time stamps

New zone Europe/Kirov, split off from Europe/Volgograd.  It covers
Kirov Oblast, Russia, which switched from +04/+05 to +03/+04 on
1989-03-26 at 02:00, roughly a year after Europe/Volgograd made
the same change.  (Thanks to Stepan Golosunov.)

Russia and nearby locations had daylight-saving transitions on
1992-03-29 at 02:00 and 1992-09-27 at 03:00, instead of on
1992-03-28 at 23:00 and 1992-09-26 at 23:00.  (Thanks to Stepan
Golosunov.)

Many corrections to historical time in Kazakhstan from 1991
through 2005.  (Thanks to Stepan Golosunov.)  Replace Kazakhstan's
invented time zone abbreviations with numeric abbreviations.

(From OE-Core master rev: 10194ca3d8c2f4d8648a685c5c239a33d944b6fe)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agotzcode: update to 2016d
Armin Kuster [Mon, 25 Apr 2016 01:10:33 +0000 (18:10 -0700)]
tzcode: update to 2016d

they keep the versions in-sync. changes are all in data.

Changes affecting future time stamps

America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
(Thanks to Alexander Krivenyshev for the heads-up.)

Asia/Magadan switches from +10 to +11 on 2016-04-24 at 02:00.
(Thanks to Alexander Krivenyshev and Matt Johnson.)

New zone Asia/Tomsk, split off from Asia/Novosibirsk. It covers
Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
at 02:00.  (Thanks to Stepan Golosunov.)

Changes affecting past time stamps

New zone Europe/Kirov, split off from Europe/Volgograd.  It covers
Kirov Oblast, Russia, which switched from +04/+05 to +03/+04 on
1989-03-26 at 02:00, roughly a year after Europe/Volgograd made
the same change.  (Thanks to Stepan Golosunov.)

Russia and nearby locations had daylight-saving transitions on
1992-03-29 at 02:00 and 1992-09-27 at 03:00, instead of on
1992-03-28 at 23:00 and 1992-09-26 at 23:00.  (Thanks to Stepan
Golosunov.)

Many corrections to historical time in Kazakhstan from 1991
through 2005.  (Thanks to Stepan Golosunov.)  Replace Kazakhstan's
invented time zone abbreviations with numeric abbreviations.

(From OE-Core master rev: db8223e4dd2e513a656aedfae217d94e053c2366)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agotzcode: update to 2016c
Armin Kuster [Thu, 24 Mar 2016 01:21:50 +0000 (18:21 -0700)]
tzcode: update to 2016c

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agotzdata: update to 2016c
Armin Kuster [Thu, 24 Mar 2016 01:21:51 +0000 (18:21 -0700)]
tzdata: update to 2016c

The 2016c release of the tz code and data is available. Its most urgent change is for Asia/Baku, where the update takes effect this weekend.

This release reflects the following changes, which were either circulated on the tz mailing list or are relatively minor technical or administrative changes:

Changes affecting future time stamps

Azerbaijan no longer observes DST.  (Thanks to Steffen Thorsen.)

Chile reverts from permanent to seasonal DST.  (Thanks to Juan
Correa for the heads-up, and to Tim Parenti for corrections.)
Guess that future transitions are August's and May's second
Saturdays at 24:00 mainland time.  Also, call the period from
2014-09-07 through 2016-05-14 daylight saving time instead of
standard time, as that seems more appropriate now.

Changes affecting past time stamps

Europe/Kaliningrad and Europe/Vilnius changed from +03/+04 to
+02/+03 on 1989-03-26, not 1991-03-31.  Europe/Volgograd changed
from +04/+05 to +03/+04 on 1988-03-27, not 1989-03-26.
(Thanks to Stepan Golosunov.)

Changes to commentary
Several updates and URLs for historical and proposed Russian changes.
(Thanks to Stepan Golosunov, Matt Johnson, and Alexander Krivenyshev.)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agotzcode: update to 2016b
Armin Kuster [Fri, 18 Mar 2016 21:43:17 +0000 (14:43 -0700)]
tzcode: update to 2016b

change SRC_URI http seems more reliable

Changes to code

     tzselect's diagnostics and checking, and checktab.awk's checking,
     have been improved.  (Thanks to J William Piggott.)

     tzcode now builds under MinGW.  (Thanks to Ian Abbott and Esben Haabendal.)

     tzselect now tests Julian-date TZ settings more accurately.
     (Thanks to J William Piggott.)

Changes to commentary

     Comments in zone tables have been improved.  (Thanks to J William Piggott.)

     tzselect again limits its menu comments so that menus fit on a
     24x80 alphanumeric display.

     A new web page tz-how-to.html.  (Thanks to Bill Seymour.)

     In the Theory file, the description of possible time zone abbreviations in
     tzdata has been cleaned up, as the old description was unclear and
     inconsistent.  (Thanks to Alain Mouette for reporting the problem.)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agotzdata: update to 2016b
Armin Kuster [Fri, 18 Mar 2016 21:43:18 +0000 (14:43 -0700)]
tzdata: update to 2016b

updated SRC_URI to http as it seems more stable.

Changes affecting future time stamps

     New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
     Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
     2016-03-27 at 02:00 local time.  They need distinct zones since their
     post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
     Altai Republic, Russia, which will switch from +06 to +07 on the same date
     and local time.  Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27
     at 02:00.  (Thanks to Alexander Krivenyshev for the heads-up, and to
     Matt Johnson and Stepan Golosunov for followup.)

     As a trial of a new system that needs less information to be made up,
     the new zones use numeric time zone abbreviations like "+04"
     instead of invented abbreviations like "ASTT".

     Haiti will not observe DST in 2016.  (Thanks to Jean Antoine via
     Steffen Thorsen.)

     Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
     (Thanks to Hannah Kreitem.) Guess future transitions will be March's last
     Saturday at 01:00, not March's last Friday at 24:00.

Changes affecting past time stamps

     Europe/Chisinau observed DST during 1990, and switched from +04 to
     +03 at 1990-05-06 02:00, instead of switching from +03 to +02.
     (Thanks to Stepan Golosunov.)

     1991 abbreviations in Europe/Samara should be SAMT/SAMST, not
     KUYT/KUYST.  (Thanks to Stepan Golosunov.)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agolttng-tools: fix regression tests hang
Awais Belal [Mon, 11 Apr 2016 07:29:17 +0000 (00:29 -0700)]
lttng-tools: fix regression tests hang

Some of the lttng fast_regression ptests have race
conditions which end up in a deadlock so the test
case never returns and the only way around is to
kill the process.
This is fixed by picking up relevant patches from
lttng-tools mainstream that fix up the behavior
of these tests.

Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoncurses: update SRC_URI
Ross Burton [Mon, 11 Apr 2016 07:29:16 +0000 (00:29 -0700)]
ncurses: update SRC_URI

Upstream re-arranged their FTP server and deleted the tarball that we were
downloading.  This tarball is mirrors on downloads.yoctoproject.org but not
everyone uses that, so Work around this by pointing the SRC_URI at the Yocto
Project source mirror directly.

[ YOCTO #9379 ]

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agopython3: fix building nativesdk-python3
Juro Bystricky [Mon, 11 Apr 2016 07:29:15 +0000 (00:29 -0700)]
python3: fix building nativesdk-python3

When the class nativesdk.bbclass is inherited, it redefines TARGET_CC_ARCH,
in the case of python3, this enables debug, causing an error while linking.
Since we don't enable debug during configure some functions are not declared.
This patch makes sure we keep debug disabled, fixing the linking errors.

[YOCTO #9357]

Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agosystemd-serialgetty: allow baud rate overriding
Awais Belal [Mon, 11 Apr 2016 07:29:14 +0000 (00:29 -0700)]
systemd-serialgetty: allow baud rate overriding

In case a getty is required on a UART which is not being
used as the kernel console, the current agetty invocation
fails to obey the baud rate configured through the
SERIAL_CONSOLES variable because it uses --keep-baud.

(From OE-Core master rev: b54b73834e73d55de1038b55d0a4d7f49cda52d0)

Signed-off-by: Awais Belal <awais_belal@mentor.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoboost: ensure boost to remain an empty metapackage
Lukas Bulwahn [Mon, 11 Apr 2016 07:29:13 +0000 (00:29 -0700)]
boost: ensure boost to remain an empty metapackage

To ensure that boost remains an empty metapackage after version
updates, we explicitly require boost files to be empty. If new
libraries exist after a version update of the boost recipe,
bitbake will emit a warning at the do_package task. For example,
at the version update from 1.58.0 to 1.59.0, the new timer
library is indicated with:

WARNING: QA Issue: boost: Files/directories were installed but not shipped in any package:
  /usr/lib/libboost_timer.so.1.59.0
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
boost: 1 installed and not shipped files. [installed-vs-shipped]

Ross Burton suggested this improvement on the openembedded-core
mailing list during review of the boost recipe version update [1].

[1] http://lists.openembedded.org/pipermail/openembedded-core/2015-December/114314.html

(From OE-Core master rev: c4e33232db2da3594cc4ba38eea56ee1acb54d3a)

Signed-off-by: Lukas Bulwahn <lukas.bulwahn@oss.bmw-carit.de>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agosystemd: chown hwdb.bin to root:root for do_rootfs
Christopher Larson [Mon, 11 Apr 2016 07:29:12 +0000 (00:29 -0700)]
systemd: chown hwdb.bin to root:root for do_rootfs

This is created by qemu for the do_rootfs case, which bypasses pseudo, so we
need to correct the ownership. This fixes a warning issued by
rootfs_check_host_user_contaminated.

(From OE-Core master rev: 4ff6b8cadec10e17dbf884a873a227e29944f5d1)

Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agocdrtools: update SRC_URI
Ross Burton [Mon, 11 Apr 2016 07:29:11 +0000 (00:29 -0700)]
cdrtools: update SRC_URI

Upstream released their 3.01 so the alpha releases we were downloading have
moved.  Update the SRC_URI so it continues to download.

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agogcc-cross-canadian.inc: add INSANE_SKIP_ to avoid build warning
Li Xin [Mon, 11 Apr 2016 07:29:10 +0000 (00:29 -0700)]
gcc-cross-canadian.inc: add INSANE_SKIP_ to avoid build warning

WARNING: QA Issue: gcc-cross-canadian-i586-dbg: found library in wrong location:
/PATH/sysroots/x86_64-oesdk-linux/usr/libexec/i586-oe-linux/gcc/
i586-oe-linux/5.2.0/.debug/libcc1.so.0.0.0

This warning is introduced by commit f6e47aa(gcc-target 5.1: fix for libcc1)

Signed-off-by: Li Xin <lixin.fnst@cn.fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agosystemd: fix segfault on shutdown
Bill Randle [Mon, 11 Apr 2016 07:29:09 +0000 (00:29 -0700)]
systemd: fix segfault on shutdown

This applies upstream fixes to fix a segfault in systemd-logind on
shutdown.

[Fixes YOCTO #9265]

Signed-off-by: Bill Randle <william.c.randle@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agonfs-utils: bugfix: adjust name of statd service unit
Ulrich Ölmann [Mon, 11 Apr 2016 07:29:08 +0000 (00:29 -0700)]
nfs-utils: bugfix: adjust name of statd service unit

Upstream nfs-utils use 'rpc-statd.service' and Yocto introduced
'nfs-statd.service' instead but forgot to update the mount.nfs helper
'start-statd' accordingly.

Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobusybox_git: Fix SRCREV
Brad Mouring [Mon, 11 Apr 2016 07:29:07 +0000 (00:29 -0700)]
busybox_git: Fix SRCREV

The SRCREV in the busybox git recipe did not point to a commit ID
on the master branch. Point the variable to something reachable from
the master branch (which fixes this recipe's fetch()).

Suggested-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Brad Mouring <brad.mouring@ni.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobusybox-1.23: Backport patch to fix zcip false-conflict
Brad Mouring [Mon, 11 Apr 2016 07:29:06 +0000 (00:29 -0700)]
busybox-1.23: Backport patch to fix zcip false-conflict

Busybox upstream fixed the issue where an incorrect comparison of
addresses led to bogus renegotiation of a new ll ip in 1.24. Backport
this change to 1.23.2.

Signed-off-by: Brad Mouring <brad.mouring@ni.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobluez5: allow D-Bus to spawn obexd in systems without systemd
Javier Viguera [Mon, 11 Apr 2016 07:29:05 +0000 (00:29 -0700)]
bluez5: allow D-Bus to spawn obexd in systems without systemd

This includes a proper D-Bus service file for obexd in systems that do
not support systemd.

(From OE-Core rev: 75c5dc8d4a5506bf5b89292a96c7b9f91e9d71c8)

Signed-off-by: Javier Viguera <javier.viguera@digi.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoruby-native: Depend on openssl-native
Khem Raj [Mon, 11 Apr 2016 07:29:04 +0000 (00:29 -0700)]
ruby-native: Depend on openssl-native

This dependency is floating otherwise, It races against openssl-native
and when openssl config does not match with openssl on build host the
build fails occasionally

x86_64-linux/usr/include/openssl/ripemd.h:70:4: error: #error RIPEMD is
disabled.
 #  error RIPEMD is disabled.

Change-Id: I5ff6d8f058ff99c64ad4dc7c0377724071003ae6
(From OE-Core master rev: d0c8d98077622a700d92384f676770cb4d6d4f46)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agodevtool: extract: update SRCTREECOVEREDTASKS for kernel
Markus Lehtonen [Thu, 3 Dec 2015 13:54:25 +0000 (15:54 +0200)]
devtool: extract: update SRCTREECOVEREDTASKS for kernel

Add 'do_kernel_configme' and 'do_kernel_configcheck' to
SRCTREECOVEREDTASKS of kernel packages. These tasks should not be run
because kernel meta in the srctree is not necessarily up-to-date or
even present which causes build failures and/or invalid kernel config.
Especially so because 'do_patch' which is a dependency of
'do_kernel_configme' is not being run.

We now store .config in the srctree and 'do_configure' task is able to
run successfully.

(From OE-Core master rev: 7ce4c18a4ba1ebcb9f46e652a881ace1f21d2292)

Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agodevtool: extract: copy kernel config to srctree
Markus Lehtonen [Thu, 3 Dec 2015 13:54:24 +0000 (15:54 +0200)]
devtool: extract: copy kernel config to srctree

This makes the correct kernel config to be used when building kernel
from srctree (extrernalsrc). If no kernel config is present in the
builddir 'do_configure' task copies .config from the srctree.

(From OE-Core master rev: 3b516332e038a587685f6e0c14a7f04990bdd6cc)

Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agolib/oe/patch: Make GitApplyTree._applypatch() support read-only .git/hooks
Peter Kjellerstedt [Wed, 27 Jan 2016 14:39:52 +0000 (15:39 +0100)]
lib/oe/patch: Make GitApplyTree._applypatch() support read-only .git/hooks

Rather than modifying files in .git/hooks, which can be read-only
(e.g., if it is a link to a directory in /usr/share), move away the
entire .git/hooks directory temporarily.

(From OE-Core master rev: a88d603b51a9ebb39210d54b667519acfbe465c3)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
9 years agotune-corei7.inc: Fix PACKAGE_EXTRA_ARCHS for corei7-32
Chang Rebecca Swee Fun [Wed, 2 Mar 2016 09:55:41 +0000 (17:55 +0800)]
tune-corei7.inc: Fix PACKAGE_EXTRA_ARCHS for corei7-32

Change the name to core2-32 from core2.

There's no AVAILTUNES with the name core2. Make sure that we specify
the correct TUNE name so PACKAGE_EXTRA_ARCHS is expanded correctly.

[ YOCTO #9197 ]

(From OE-Core rev: 0903d6f0098f112d4263812df109e0c44c166db8)

Signed-off-by: Chang Rebecca Swee Fun <rebecca.swee.fun.chang@intel.com>
Signed-off-by: Anuj Mittal <anujx.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
9 years agolicense.bbclass: fix host contamination warnings for license files
Jagadeesh Krishnanjanappa [Sat, 28 Nov 2015 08:09:54 +0000 (13:39 +0530)]
license.bbclass: fix host contamination warnings for license files

We get below host contamination warnings of license files for
each recipe, when we try to create a separate ${PN}-lic package (which
contains license files), by setting LICENSE_CREATE_PACKAGE equal to "1"
in local.conf.

-- snip --
WARNING: QA Issue: libcgroup: /libcgroup-lic/usr/share/licenses/libcgroup/generic_LGPLv2.1 is owned by uid 5001, which is the same as the user running bitbake. This may be due to host contamination [host-user-contaminated]
WARNING: QA Issue: attr: /attr-lic/usr/share/licenses/attr/libattr.c is owned by uid 5001, which is the same as the user running bitbake. This may be due to host contamination [host-user-contaminated]
WARNING: QA Issue: bash: /bash-lic/usr/share/licenses/bash/COPYING is owned by uid 5001, which is the same as the user running bitbake. This may be due to host contamination [host-user-contaminated]
-- CUT --

Since the license files from source and OE-core, are populated in a normal
shell environment rather in pseudo environment (fakeroot); the ownership of
these files will be same as host user running bitbake. During the do_package
task (which runs in pseudo environment (fakeroot)), os.link preserves the
ownership of these license files as host user instead of root user.
This causes license files to have UID same as host user id and resulting in
above warnings during do_package_qa task.

Changing ownership of license files to root user (which has UID and GID as 0)
under pseudo environment will solve above warnings, and on exiting pseudo
environment the license files will continue to be owned by host user. Perform
this manipulation within try/except statements, as tasks which are not exected
under pseudo (such as do_populate_lic) result in OSError when trying to
change ownership of license files.

(From OE-Core master rev: a411e96c3989bc9ffbd870b54cd6a7ad2e9f2c61)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
9 years agodhcp: CVE-2015-8605
Mariano Lopez [Fri, 26 Feb 2016 14:34:17 +0000 (14:34 +0000)]
dhcp: CVE-2015-8605

ISC DHCP allows remote attackers to cause a denial of
service (application crash) via an invalid length field
in a UDP IPv4 packet.

(From OE-Core master rev: f9739b7fa8d08521dc5e42a169753d4c75074ec7)

Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
9 years agomake 4.1: fix segfault when ttyname fails
Chang Rebecca Swee Fun [Thu, 10 Mar 2016 04:01:48 +0000 (12:01 +0800)]
make 4.1: fix segfault when ttyname fails

GNU make segfaults when run in a chroot environment because
of a known bug in GNU make 4.1. See [1] for details.

Works if /dev/pts is mounted before chroot.

[1] http://savannah.gnu.org/bugs/?43434

[YOCTO #9067]

Reported-by: Alexander Larsson <alexl@redhat.com>
(From OE-Core master rev: 0fe2a4b428b1b9a937914d87ec089b5a64f641eb)

Signed-off-by: Anuj Mittal <anujx.mittal@intel.com>
Signed-off-by: Chang Rebecca Swee Fun <rebecca.swee.fun.chang@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
9 years agoxorg-lib: allow native building without x11 DISTRO_FEATURES
Ross Burton [Mon, 14 Mar 2016 20:35:35 +0000 (20:35 +0000)]
xorg-lib: allow native building without x11 DISTRO_FEATURES

The Xorg libraries use REQUIRED_DISTRO_FEATURES to stop building on
distributions without the x11 feature but this stops people building native
tooling that uses libX11, such as libsdl-native.

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobase: check for existing prefix when expanding names in PACKAGECONFIG
Ross Burton [Fri, 11 Mar 2016 20:54:00 +0000 (20:54 +0000)]
base: check for existing prefix when expanding names in PACKAGECONFIG

When the DEPENDS are added as part of the PACKAGECONFIG logic the list of
packages are expanded so that any required nativesdk-/-native/multilib prefixes
and suffixes are added.

However the special handling of virtual/foo names doesn't check that the prefix
already exists, which breaks under nativesdk as in that situation there's an
explicit nativesdk- prefix *and* MLPREFIX is set to nativesdk-.  This results in
the same prefix being applied twice, and virtual packages such as virtual/libx11
ending up as virtual/nativesdk-nativesdk-libx11.

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoos-release: put double-quotes around variable contents
Craig McQueen [Thu, 15 Oct 2015 05:13:09 +0000 (16:13 +1100)]
os-release: put double-quotes around variable contents

This makes the resulting /etc/os-release file have valid shell
assignment syntax. This makes it loadable by a shell script, using the
'source' command:

    source /etc/os-release

Signed-off-by: Ross Burton <ross.burton@intel.com>
(From OE-Core master rev: f6e0ea000fa3b9a726ab56500f643f9902371618)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
9 years agoimage_types_uboot: add cpio.gz.uboot to supported IMAGE_TYPES
Arnold Csorvasi [Wed, 10 Feb 2016 09:44:52 +0000 (11:44 +0200)]
image_types_uboot: add cpio.gz.uboot to supported IMAGE_TYPES

U-Boot needs the U-Boot header in a ramdisk image to boot it.
Add this header to the cpio.gz image, so that it can be booted
with U-Boot.

Signed-off-by: Arnold Csorvasi <arnold.csorvasi@ni.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(From OE-Core master rev: 8376fa3d4ef6175b83ab7f1ec8e4e20ec14964f4)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
9 years agoconf/local.conf.sample: comment out ASSUME_PROVIDED=libsdl-native
Ross Burton [Fri, 18 Dec 2015 16:56:18 +0000 (16:56 +0000)]
conf/local.conf.sample: comment out ASSUME_PROVIDED=libsdl-native

Ubuntu 15.10 and Debian testing can't build qemu-native against the host libsdl.
Now that libsdl-native is buildable, comment out the ASSUME_PROVIDED which meant
it wouldn't be used.

[ YOCTO #8553 ]

Signed-off-by: Ross Burton <ross.burton@intel.com>
(From OE-Core master rev: 81f009d173f24501ab0e04d845db74ecb5f8e332)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
9 years agolibsdl: expand PACKAGECONFIG and enable native builds
Ross Burton [Mon, 30 Nov 2015 11:31:14 +0000 (11:31 +0000)]
libsdl: expand PACKAGECONFIG and enable native builds

Use PACKAGECONFIG instead of using logic in DEPENDS and EXTRA_OECONF, adding new
options for PulseAudio, tslib, DirectFB, OpenGL and X11.  Pass
--disable-x11-shared so that it links to the X libraries instead of using
dlopen().

Disable tslib by default as the kernel event input subsystem is generally used.

SDL's OpenGL support requires X11 so check for both x11 and opengl, and merge
the dependencies.

Finally enable native builds, with a minimal PACKAGECONFIG that will build from
oe-core for native and nativesdk.

Signed-off-by: Ross Burton <ross.burton@intel.com>
(From OE-Core master rev: 3d6c31c3a4ff34376e17005a981bb55fc6f7a38f)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
9 years agoimage_types.bbclass: Rebuild when WICVARS change
Mariano Lopez [Wed, 30 Dec 2015 06:52:54 +0000 (06:52 +0000)]
image_types.bbclass: Rebuild when WICVARS change

The procces to do a wic image is to save a file with
variables required by wic and then call wic using this
file. Because this is external to bitbake if the vars
change, the image won't be rebuild; an example of such
is IMAGE_BOOT_FILES.

This patch adds these variables to vardeps of do_rootfs
when a wic image is build. This will rebuild the image
if a variable needed by wic changes.

[YOCTO #8693]

Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(From OE-Core master rev: 12c54d50ed4c321dc272beb3c6cb770965c979f1)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
9 years agoimage_types: improve wks path specification
Christopher Larson [Tue, 10 Nov 2015 21:18:20 +0000 (14:18 -0700)]
image_types: improve wks path specification

Hardcoding a full input path with zero flexibility goes against everything the
Yocto Project is about. Rework it to let the user specify the wks base
filename with WKS_FILE and it'll search the layers for the wks file and use
it.

Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(From OE-Core master rev: 8cc7f5229f5447c2183ac319dd52c7ed737ec89b)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
9 years agowic: rawcopy: Copy source file to build folder
Noor Ahsan [Wed, 23 Dec 2015 13:50:35 +0000 (15:50 +0200)]
wic: rawcopy: Copy source file to build folder

When a file is given using --sourceparams then wic directly use that file
instead of copying them to build folder. At time of assembling it os.rename
is called which renames all the files to name. In that process the original
file is renamed. When image recipe is rebuilt then wic complains about
missing file which was renamed in previous build.

[YOCTO #8854]

Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(From OE-Core master rev: 33c52b1f2d39feb641465bf42e8b16d0ab22a316)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
9 years agoopenssl: Security fix CVE-2016-0800
Armin Kuster [Wed, 2 Mar 2016 07:37:21 +0000 (23:37 -0800)]
openssl: Security fix CVE-2016-0800

CVE-2016-0800 SSL/TLS: Cross-protocol attack on TLS using SSLv2 (DROWN)

https://www.openssl.org/news/secadv/20160301.txt

Signed-off-by: Armin Kuster <akuster@mvista.com>
Not required for master, an update to 1.0.2g has been submitted.
Backport to fido is required.
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agowpa-supplicant: Fix CVE-2015-8041
Hongxu Jia [Fri, 13 Nov 2015 11:08:06 +0000 (19:08 +0800)]
wpa-supplicant: Fix CVE-2015-8041

Backport patch from http://w1.fi/security/2015-5/
and rebase for wpa-supplicant 2.4

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Not needed in master since the upgrade to 2.5
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobuild-appliance-image: Update to jethro head revision
Richard Purdie [Wed, 24 Feb 2016 09:04:05 +0000 (09:04 +0000)]
build-appliance-image: Update to jethro head revision

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoqemu: Security fix CVE-2016-2198
Armin Kuster [Wed, 10 Feb 2016 16:14:19 +0000 (08:14 -0800)]
qemu: Security fix CVE-2016-2198

CVE-2016-2198 Qemu: usb: ehci null pointer dereference in ehci_caps_write

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agoqemu: Security fix CVE-2016-2197
Armin Kuster [Wed, 10 Feb 2016 16:12:59 +0000 (08:12 -0800)]
qemu: Security fix CVE-2016-2197

CVE-2016-2197 Qemu: ide: ahci null pointer dereference when using FIS CLB engines

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agolibgcrypt: Security fix CVE-2015-7511
Armin Kuster [Sat, 13 Feb 2016 17:34:00 +0000 (09:34 -0800)]
libgcrypt: Security fix CVE-2015-7511

CVE-2015-7511 libgcrypt: side-channel attack on ECDH with Weierstrass curves

affects libgcrypt < 1.6.5

Patch 1 is a dependancy patch. simple macro name change.
Patch 2 is the cve fix.

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agouclibc: Security fix CVE-2016-2225
Armin Kuster [Wed, 10 Feb 2016 23:46:01 +0000 (15:46 -0800)]
uclibc: Security fix CVE-2016-2225

CVE-2016-2225 Make sure to always terminate decoded string

This change is being provide to comply to Yocto compatiblility.

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agouclibc: Security fix CVE-2016-2224
Armin Kuster [Wed, 10 Feb 2016 23:42:34 +0000 (15:42 -0800)]
uclibc: Security fix CVE-2016-2224

CVE-2016-2224 Do not follow compressed items forever.

This change is being provide to comply to Yocto compatiblity.

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agolibbsd: Security fix CVE-2016-2090
Armin Kuster [Fri, 12 Feb 2016 00:20:34 +0000 (16:20 -0800)]
libbsd: Security fix CVE-2016-2090

CVE-2016-2090 Heap buffer overflow in fgetwln function of libbsd

affects libbsd <= 0.8.1 (and therefore not needed in master)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoglibc: Security fix CVE-2015-7547
Armin Kuster [Wed, 17 Feb 2016 19:02:14 +0000 (11:02 -0800)]
glibc: Security fix CVE-2015-7547

CVE-2015-7547: getaddrinfo() stack-based buffer overflow

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobuild-appliance-image: Update to jethro head revision
Richard Purdie [Sun, 7 Feb 2016 22:57:00 +0000 (22:57 +0000)]
build-appliance-image: Update to jethro head revision

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agocurl: Secuirty fix CVE-2016-0755
Armin Kuster [Fri, 5 Feb 2016 16:58:42 +0000 (08:58 -0800)]
curl: Secuirty fix CVE-2016-0755

CVE-2016-0755 curl: NTLM credentials not-checked for proxy connection re-use

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agocurl: Security fix CVE-2016-0754
Armin Kuster [Fri, 5 Feb 2016 16:57:11 +0000 (08:57 -0800)]
curl: Security fix CVE-2016-0754

CVE-2016-0754 curl: remote file name path traversal in curl tool for Windows

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agonettle: Security fix CVE-2015-8804
Armin Kuster [Fri, 5 Feb 2016 16:41:24 +0000 (08:41 -0800)]
nettle: Security fix CVE-2015-8804

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agonettle: Security fix CVE-2015-8803 and CVE-2015-8805
Armin Kuster [Fri, 5 Feb 2016 16:37:29 +0000 (08:37 -0800)]
nettle: Security fix CVE-2015-8803 and CVE-2015-8805

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agosocat: Security fix CVE-2016-2217
Armin Kuster [Fri, 5 Feb 2016 14:31:06 +0000 (06:31 -0800)]
socat: Security fix CVE-2016-2217

this address both
Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in OpenSSL"
and Socat security advisory 8: "Stack overflow in arguments parser

[Yocto # 9024]

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agolibpng: Security fix CVE-2015-8472
Armin Kuster [Fri, 5 Feb 2016 14:05:08 +0000 (06:05 -0800)]
libpng: Security fix CVE-2015-8472

libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

this patch fixes an incomplete patch in CVE-2015-8126

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agolibpng: Security fix CVE-2015-8126
Armin Kuster [Fri, 5 Feb 2016 14:03:48 +0000 (06:03 -0800)]
libpng: Security fix CVE-2015-8126

libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agofoomatic-filters: Security fixes CVE-2015-8327
Armin Kuster [Mon, 1 Feb 2016 17:46:10 +0000 (09:46 -0800)]
foomatic-filters: Security fixes CVE-2015-8327

CVE-2015-8327 cups-filters: foomatic-rip did not consider the back tick as an illegal shell escape character

this time with the recipe changes.

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agofoomatic-filters: Security fix CVE-2015-8560
Armin Kuster [Mon, 1 Feb 2016 17:44:33 +0000 (09:44 -0800)]
foomatic-filters: Security fix CVE-2015-8560

CVE-2015-8560 cups-filters: foomatic-rip did not consider semicolon as illegal shell escape character

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agobuild-appliance-image: Update to jethro head revision
Richard Purdie [Sun, 7 Feb 2016 17:23:42 +0000 (17:23 +0000)]
build-appliance-image: Update to jethro head revision

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agocross-localedef-native: add ABI breaking glibc patch
Jens Rehsack [Fri, 5 Feb 2016 10:25:40 +0000 (11:25 +0100)]
cross-localedef-native: add ABI breaking glibc patch

Add patch from commit 96b1b5c127e9e0e637aaf7948cf3330a94a5cd57 to cross-localedef-native
to avoid broken images built with ENABLE_BINARY_LOCALE_GENERATION set to 1:

    $ sh -c "export LANG=de_DE; ls -la"
    sh: loadlocale.c:130: _nl_intern_locale_data: Assertion `cnt < (sizeof (_nl_value_type_LC_COLLATE) / sizeof (_nl_value_type_LC_COLLATE[0]))' failed.
    Aborted

Signed-off-by: Jens Rehsack <sno@netbsd.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobuild-appliance-image: Update to jethro head revision
Richard Purdie [Fri, 5 Feb 2016 11:17:03 +0000 (11:17 +0000)]
build-appliance-image: Update to jethro head revision

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agoe2fsprogs: Ensure we use the right mke2fs.conf when restoring from sstate
Richard Purdie [Fri, 5 Feb 2016 10:52:39 +0000 (10:52 +0000)]
e2fsprogs: Ensure we use the right mke2fs.conf when restoring from sstate

If we don't do this, we can use an mke2fs.conf from a different path which
may contain incompatible flags and lead to obtuse build failures such as:

Invalid filesystem option set: has_journal,extent,huge_file,flex_bg,metadata_csum,64bit,dir_nlink,extra_isize

To fix this, wrap the mke2fs binary and its hardlinks and point at the
correct configuration file.

In particular this fixes conflicts between master and jethro builds
affecting the main autobuilder.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agobuild-appliance-image: Update to jethro head revision
Richard Purdie [Thu, 4 Feb 2016 23:23:24 +0000 (23:23 +0000)]
build-appliance-image: Update to jethro head revision

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
9 years agopiglit: don't use /tmp to write generated sources to
Ross Burton [Tue, 2 Feb 2016 22:42:57 +0000 (22:42 +0000)]
piglit: don't use /tmp to write generated sources to

If there are multiple builds on the same machine then piglit writing it's
generated sources to /tmp will race.  Instead, export TEMP to tell the tempfile
module to use a temporary directory under ${B}.

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
9 years agogen-lockedsig-cache: fix bad destination path joining
Paul Eggleton [Tue, 26 Jan 2016 00:20:24 +0000 (13:20 +1300)]
gen-lockedsig-cache: fix bad destination path joining

When copying the sstate-cache into the extensible SDK, if the source
path had a trailing / and the destination path did not, there would be a
missing / between the path and the subdirectory name, and you'd end up
with subdirectories like "sstate-cacheCentOS-6.7". There are functions
in os.path for this sort of thing so let's just use them and avoid the
problem.

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 5eb8f15c48b5f39a10eb2b63b026cf1ebfd05533)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
9 years agolinux-yocto: Update SRCREV for qemux86* for 4.1, fixes CVE-2016-0728
Alejandro Hernandez [Tue, 2 Feb 2016 21:39:03 +0000 (21:39 +0000)]
linux-yocto: Update SRCREV for qemux86* for 4.1, fixes CVE-2016-0728

This addresses CVE-2016-0728: KEYS: Fix keyring ref leak in join_session_keyring(), and upgrades to LINUX_VERSION 4.1.17

Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
9 years agolinux-yocto: Update SRCREV for qemux86* for 3.19, fixes CVE-2016-0728
Alejandro Hernandez [Tue, 2 Feb 2016 21:39:02 +0000 (21:39 +0000)]
linux-yocto: Update SRCREV for qemux86* for 3.19, fixes CVE-2016-0728

This addresses CVE-2016-0728: KEYS: Fix keyring ref leak in join_session_keyring()

Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
9 years agolinux-yocto: Update SRCREV for qemux86* for 3.14, fixes CVE-2016-0728
Alejandro Hernandez [Tue, 2 Feb 2016 21:39:01 +0000 (21:39 +0000)]
linux-yocto: Update SRCREV for qemux86* for 3.14, fixes CVE-2016-0728

This addresses CVE-2016-0728: KEYS: Fix keyring ref leak in join_session_keyring(), and upgrades to LINUX_VERSION 3.14.39

Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
9 years agolibpng12: update URL that no longer exists
Maxin B. John [Tue, 2 Feb 2016 16:26:26 +0000 (18:26 +0200)]
libpng12: update URL that no longer exists

Fix the following warning:

WARNING: Failed to fetch URL http://downloads.sourceforge.net/project/
libpng/libpng12/1.2.53/libpng-1.2.53.tar.xz, attempting MIRRORS if
available.

[YOCTO #8739]

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
9 years agolibpng: update URL that no longer exists
Maxin B. John [Tue, 2 Feb 2016 16:26:25 +0000 (18:26 +0200)]
libpng: update URL that no longer exists

Fix the following warning:

WARNING: Failed to fetch URL http://downloads.sourceforge.net/
project/libpng/libpng16/1.6.17/libpng-1.6.17.tar.xz, attempting
MIRRORS if available

[YOCTO #8739]

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
9 years agobusybox: fix build of last applet
Ross Burton [Tue, 2 Feb 2016 15:31:07 +0000 (15:31 +0000)]
busybox: fix build of last applet

If CONFIG_FEATURE_LAST_SMALL is enabled the build fails because of a broken
__UT_NAMESIZE test.

[ YOCTO #8869 ]

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
9 years agoghostscript: add dependency for pnglibconf.h
Joe Slater [Fri, 4 Dec 2015 23:13:15 +0000 (15:13 -0800)]
ghostscript: add dependency for pnglibconf.h

When using parallel make jobs, we need to be sure that
pnglibconf.h is created before we try to reference it,
so add a rule to png.mak.

Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit fad19750d23aad2d14a1726c4e3c2c0d05f6e13d)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
9 years agogcr: Require x11 DISTRO_FEATURE
Jussi Kukkonen [Wed, 25 Nov 2015 13:05:40 +0000 (15:05 +0200)]
gcr: Require x11 DISTRO_FEATURE

This enables a world build without x11. GTK3DISTROFEATURES is not
enough because gtk+-x11.pc is still required.

Fixes [YOCTO #8611].

Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit dbdcd87144cc1cd6c5d50c800c7f266aaf25ca17)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
9 years agouClibc: enable utmp for shadow compatibility
Bogdan-Alexandru Voiculescu [Wed, 25 Nov 2015 09:18:13 +0000 (11:18 +0200)]
uClibc: enable utmp for shadow compatibility

with the enabling of utmpx in busybox and uClibc it was noted that shadow
support for utmpx also needs utmp explicitly enabled in uclibc. this is
a workaround that might be removed once shadow properly supports
--enable-utmpx to check for utmpx configuration instead of utmp like
it does now

[YOCTO #8243]
[YOCTO #8971]

Signed-off-by: Bogdan-Alexandru Voiculescu <bogdanx.a.voiculescu@intel.com>
Signed-off-by: Benjamin Esquivel <benjamin.esquivel@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 969158d63ba2c8e2e11af41c2a6d4f1aa5b0099f)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
9 years agogit: Security fix CVE-2015-7545
Armin Kuster [Sun, 31 Jan 2016 22:27:05 +0000 (14:27 -0800)]
git: Security fix CVE-2015-7545

CVE-2015-7545 git: arbitrary code execution via crafted URLs

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agoglibc-locale: fix QA warning
Armin Kuster [Sun, 31 Jan 2016 17:32:05 +0000 (09:32 -0800)]
glibc-locale: fix QA warning

WARNING: QA Issue: glibc-locale: /glibc-binary-localedata-sd-in/usr/lib/locale/sd_IN/LC_CTYPE is owned by uid 1000, which is the same as the user running bitbake. This may be due to host contamination [host-user-contaminated]

fix type
Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agogrub: Security fix CVE-2015-8370
Armin Kuster [Sun, 31 Jan 2016 15:46:32 +0000 (07:46 -0800)]
grub: Security fix CVE-2015-8370

CVE-2015-8370 grub2: buffer overflow when checking password entered during bootup

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agogdk-pixbuf: Security fix CVE-2015-7674
Armin Kuster [Sun, 31 Jan 2016 15:14:33 +0000 (07:14 -0800)]
gdk-pixbuf: Security fix CVE-2015-7674

CVE-2015-7674 Heap overflow with a gif file in gdk-pixbuf < 2.32.1

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agolibrsvg: Security fix CVE-2015-7558
Armin Kuster [Sun, 31 Jan 2016 04:45:31 +0000 (20:45 -0800)]
librsvg: Security fix CVE-2015-7558

CVE-2015-7558 librsvg2: Stack exhaustion causing DoS

including two supporting patches.

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agobind: Security fix CVE-2015-8461
Armin Kuster [Sun, 31 Jan 2016 03:29:32 +0000 (19:29 -0800)]
bind: Security fix CVE-2015-8461

CVE-2015-8461 bind: race condition when handling socket errors can lead to an assertion failure in resolver.c\

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agobind: Security fix CVE-2015-8000
Armin Kuster [Sun, 31 Jan 2016 02:55:39 +0000 (18:55 -0800)]
bind: Security fix CVE-2015-8000

CVE-2015-8000 bind: responses with a malformed class attribute can trigger an assertion failure in db.c

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agolibxml2: Security fix CVE-2015-8710
Armin Kuster [Sat, 30 Jan 2016 22:39:28 +0000 (14:39 -0800)]
libxml2: Security fix CVE-2015-8710

CVE-2015-8710 libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agolibxml2: Security fix CVE-2015-8241
Armin Kuster [Sat, 30 Jan 2016 22:37:35 +0000 (14:37 -0800)]
libxml2: Security fix CVE-2015-8241

CVE-2015-8241 libxml2: Buffer overread with XML parser in xmlNextChar

Signed-off-by: Armin Kuster <akuster@mvista.com>
9 years agodpkg: Security fix CVE-2015-0860
Armin Kuster [Sat, 30 Jan 2016 22:12:44 +0000 (14:12 -0800)]
dpkg: Security fix CVE-2015-0860

CVE-2015-0860 dpkg: stack overflows and out of bounds read

Signed-off-by: Armin Kuster <akuster@mvista.com>