* [gatesgarth][PATCH 01/19] libsdl2: Add directfb to PACKAGECONFIG rdepends
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
@ 2020-12-14 3:34 ` Anuj Mittal
2020-12-14 3:34 ` [gatesgarth][PATCH 02/19] cve-update-db-native: handle all-wildcard versions Anuj Mittal
` (17 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:34 UTC (permalink / raw)
To: openembedded-core
From: Mark Jonas <toertel@gmail.com>
PACKAGECONFIG[directfb] already adds directfb to the build
dependencies. But the automatically generated runtime
dependencies do not add the directfb package to the runtime
dependencies. Most likely this happens because libsdl2 does not link
against directfb but uses dlopen() or similar. Thus, the runtime
dependency to directfb needs to be declared explicitly.
Signed-off-by: Mark Jonas <toertel@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 62d3cbe7c8261c1c875ff6da11572409262aaf02)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-graphics/libsdl2/libsdl2_2.0.12.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-graphics/libsdl2/libsdl2_2.0.12.bb b/meta/recipes-graphics/libsdl2/libsdl2_2.0.12.bb
index 0b75eb0c1d..1513746492 100644
--- a/meta/recipes-graphics/libsdl2/libsdl2_2.0.12.bb
+++ b/meta/recipes-graphics/libsdl2/libsdl2_2.0.12.bb
@@ -57,7 +57,7 @@ PACKAGECONFIG ??= " \
"
PACKAGECONFIG[alsa] = "--enable-alsa --disable-alsatest,--disable-alsa,alsa-lib,"
PACKAGECONFIG[arm-neon] = "--enable-arm-neon,--disable-arm-neon"
-PACKAGECONFIG[directfb] = "--enable-video-directfb,--disable-video-directfb,directfb"
+PACKAGECONFIG[directfb] = "--enable-video-directfb,--disable-video-directfb,directfb,directfb"
PACKAGECONFIG[gles2] = "--enable-video-opengles,--disable-video-opengles,virtual/libgles2"
PACKAGECONFIG[jack] = "--enable-jack,--disable-jack,jack"
PACKAGECONFIG[kmsdrm] = "--enable-video-kmsdrm,--disable-video-kmsdrm,libdrm virtual/libgbm"
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 02/19] cve-update-db-native: handle all-wildcard versions
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
2020-12-14 3:34 ` [gatesgarth][PATCH 01/19] libsdl2: Add directfb to PACKAGECONFIG rdepends Anuj Mittal
@ 2020-12-14 3:34 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 03/19] sudo: fix multilib conflict Anuj Mittal
` (16 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:34 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross@burtonini.com>
If a CPE version field is just *:*:*:* it should be handled the same as
-:*:*:*, that is 'all versions'. To ease handling, transform this case
to use -.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 04a9bc4ca5294fe6834513669c7746a824d12b04)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-core/meta/cve-update-db-native.bb | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-core/meta/cve-update-db-native.bb b/meta/recipes-core/meta/cve-update-db-native.bb
index cf2b251e21..cf62e1e32c 100644
--- a/meta/recipes-core/meta/cve-update-db-native.bb
+++ b/meta/recipes-core/meta/cve-update-db-native.bb
@@ -172,7 +172,12 @@ def parse_node_and_insert(c, node, cveId):
op_end = '<'
v_end = cpe['versionEndExcluding']
- yield [cveId, vendor, product, v_start, op_start, v_end, op_end]
+ if op_start or op_end or v_start or v_end:
+ yield [cveId, vendor, product, v_start, op_start, v_end, op_end]
+ else:
+ # This is no version information, expressed differently.
+ # Save processing by representing as -.
+ yield [cveId, vendor, product, '-', '', '', '']
c.executemany("insert into PRODUCTS values (?, ?, ?, ?, ?, ?, ?)", cpe_generator())
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 03/19] sudo: fix multilib conflict
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
2020-12-14 3:34 ` [gatesgarth][PATCH 01/19] libsdl2: Add directfb to PACKAGECONFIG rdepends Anuj Mittal
2020-12-14 3:34 ` [gatesgarth][PATCH 02/19] cve-update-db-native: handle all-wildcard versions Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 04/19] buildtools-tarball: add wic dependency into extended buildtools Anuj Mittal
` (15 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Kai Kang <kai.kang@windriver.com>
It fails to install sudo and lib32-sudo at same time:
| Error: Transaction test error:
| file /usr/libexec/sudo/audit_json.so conflicts between attempted
installs of lib32-sudo-1.9.3p1-r0.core2_32 and sudo-1.9.3p1-r0.core2_64
| file /usr/libexec/sudo/group_file.so conflicts between attempted
installs of lib32-sudo-1.9.3p1-r0.core2_32 and sudo-1.9.3p1-r0.core2_64
Pass ${libdir} to configure option --libexecdir of sudo that it installs
plugin libraries to /usr/lib{,64} rather than /usr/libexec/. Then add a
patch to fix multilib conflict of sudo.conf.
[RP: Add missing Upstream-Status]
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c9b6974cfcac370c6848d28400e0546ac85512e9)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
...o.conf.in-fix-conflict-with-multilib.patch | 52 +++++++++++++++++++
meta/recipes-extended/sudo/sudo_1.9.3.bb | 6 ++-
2 files changed, 56 insertions(+), 2 deletions(-)
create mode 100644 meta/recipes-extended/sudo/files/0001-sudo.conf.in-fix-conflict-with-multilib.patch
diff --git a/meta/recipes-extended/sudo/files/0001-sudo.conf.in-fix-conflict-with-multilib.patch b/meta/recipes-extended/sudo/files/0001-sudo.conf.in-fix-conflict-with-multilib.patch
new file mode 100644
index 0000000000..f7ccfdd623
--- /dev/null
+++ b/meta/recipes-extended/sudo/files/0001-sudo.conf.in-fix-conflict-with-multilib.patch
@@ -0,0 +1,52 @@
+sudo.conf.in: fix conflict with multilib
+
+When pass ${libdir} to --libexecdir of sudo, it fails to install sudo
+and lib32-sudo at same time:
+
+| Error: Transaction test error:
+| file /etc/sudo.conf conflicts between attempted installs of
+ sudo-1.9.3p1-r0.core2_64 and lib32-sudo-1.9.3p1-r0.core2_32
+
+Update the comments in sudo.conf.in to avoid the conflict.
+
+Signed-off-by: Kai Kang <kai.kang@windriver.com>
+
+Upstream-Status: Inappropriate [OE configuration specific]
+---
+ examples/sudo.conf.in | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/examples/sudo.conf.in b/examples/sudo.conf.in
+index 19e33ff..af78235 100644
+--- a/examples/sudo.conf.in
++++ b/examples/sudo.conf.in
+@@ -4,7 +4,7 @@
+ # Sudo plugins:
+ # Plugin plugin_name plugin_path plugin_options ...
+ #
+-# The plugin_path is relative to @plugindir@ unless
++# The plugin_path is relative to $plugindir such as /usr/lib/sudo unless
+ # fully qualified.
+ # The plugin_name corresponds to a global symbol in the plugin
+ # that contains the plugin interface structure.
+@@ -50,7 +50,7 @@ Plugin sudoers_audit sudoers.so
+ # The compiled-in value is usually sufficient and should only be changed
+ # if you rename or move the sudo_noexec.so file.
+ #
+-#Path noexec @plugindir@/sudo_noexec.so
++#Path noexec $plugindir/sudo_noexec.so
+
+ #
+ # Sudo plugin directory:
+@@ -59,7 +59,7 @@ Plugin sudoers_audit sudoers.so
+ # The default directory to use when searching for plugins that are
+ # specified without a fully qualified path name.
+ #
+-#Path plugin_dir @plugindir@
++#Path plugin_dir $plugindir
+
+ #
+ # Sudo developer mode:
+--
+2.17.1
+
diff --git a/meta/recipes-extended/sudo/sudo_1.9.3.bb b/meta/recipes-extended/sudo/sudo_1.9.3.bb
index 270625ebe8..0d0be9ab8b 100644
--- a/meta/recipes-extended/sudo/sudo_1.9.3.bb
+++ b/meta/recipes-extended/sudo/sudo_1.9.3.bb
@@ -2,6 +2,7 @@ require sudo.inc
SRC_URI = "https://www.sudo.ws/dist/sudo-${PV}.tar.gz \
${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
+ file://0001-sudo.conf.in-fix-conflict-with-multilib.patch \
"
PAM_SRC_URI = "file://sudo.pam"
@@ -24,6 +25,7 @@ EXTRA_OECONF += " \
${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '--enable-tmpfiles.d=${nonarch_libdir}/tmpfiles.d', '--disable-tmpfiles.d', d)} \
--with-rundir=/run/sudo \
--with-vardir=/var/lib/sudo \
+ --libexecdir=${libdir} \
"
do_install_append () {
@@ -43,5 +45,5 @@ do_install_append () {
}
FILES_${PN} += "${nonarch_libdir}/tmpfiles.d"
-FILES_${PN}-dev += "${libexecdir}/${BPN}/lib*${SOLIBSDEV} ${libexecdir}/${BPN}/*.la \
- ${libexecdir}/lib*${SOLIBSDEV} ${libexecdir}/*.la"
+FILES_${PN}-dev += "${libdir}/${BPN}/lib*${SOLIBSDEV} ${libdir}/${BPN}/*.la \
+ ${libdir}/lib*${SOLIBSDEV} ${libdir}/*.la"
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 04/19] buildtools-tarball: add wic dependency into extended buildtools
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (2 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 03/19] sudo: fix multilib conflict Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 05/19] lz4: Use the new branch naming from upstream Anuj Mittal
` (14 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Changqing Li <changqing.li@windriver.com>
fix below error:
wic ls ./core-image-minimal-intel-x86-64.wic
ERROR: Can't find executable parted
wic depend on some tools like parted/mtools/..., and we have those
tools in native_sysroot. so above problem can be avoided by
run command like wic ls imagename.wic --native-sysroot <path>
but this cannot cover condition that usr don't have build the
image, the image just copy from somewhere.
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c0eda6ec09395f3a04cb80107a3ca33a063b21f8)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-core/meta/buildtools-extended-tarball.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-core/meta/buildtools-extended-tarball.bb b/meta/recipes-core/meta/buildtools-extended-tarball.bb
index c32d0107c3..0816486754 100644
--- a/meta/recipes-core/meta/buildtools-extended-tarball.bb
+++ b/meta/recipes-core/meta/buildtools-extended-tarball.bb
@@ -29,6 +29,9 @@ TOOLCHAIN_HOST_TASK += "\
nativesdk-pkgconfig \
nativesdk-glibc-utils \
nativesdk-libxcrypt-dev \
+ nativesdk-parted \
+ nativesdk-dosfstools \
+ nativesdk-gptfdisk \
"
TOOLCHAIN_OUTPUTNAME = "${SDK_ARCH}-buildtools-extended-nativesdk-standalone-${DISTRO_VERSION}"
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 05/19] lz4: Use the new branch naming from upstream
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (3 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 04/19] buildtools-tarball: add wic dependency into extended buildtools Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 06/19] oeqa/devtool: use Yocto mirror for pv-1.5.3 tarball Anuj Mittal
` (13 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
Upstream renamed master -> dev, update SRC_URI to match.
[YOCTO #14135]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3369aa0322693604533ef7d30dca234e52605fe2)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-support/lz4/lz4_1.9.2.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-support/lz4/lz4_1.9.2.bb b/meta/recipes-support/lz4/lz4_1.9.2.bb
index 6510156ed0..455d2a5141 100644
--- a/meta/recipes-support/lz4/lz4_1.9.2.bb
+++ b/meta/recipes-support/lz4/lz4_1.9.2.bb
@@ -11,7 +11,7 @@ PE = "1"
SRCREV = "fdf2ef5809ca875c454510610764d9125ef2ebbd"
-SRC_URI = "git://github.com/lz4/lz4.git \
+SRC_URI = "git://github.com/lz4/lz4.git;branch=dev \
file://run-ptest \
"
UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>.*)"
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 06/19] oeqa/devtool: use Yocto mirror for pv-1.5.3 tarball
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (4 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 05/19] lz4: Use the new branch naming from upstream Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 07/19] qemu: CVE-2020-29129 CVE-2020-29130 Anuj Mittal
` (12 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross@burtonini.com>
Some of the selftests failed over the weekend with "access denied" errors
fetching this tarball. Instead of relying on upstream when fetching the
tarball, use the Yocto source mirrors instead.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 988e0ff4131f46dfed14516ff5f61d72b9fb6941)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/lib/oeqa/selftest/cases/devtool.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/lib/oeqa/selftest/cases/devtool.py b/meta/lib/oeqa/selftest/cases/devtool.py
index d3d2e04c20..b8edc89768 100644
--- a/meta/lib/oeqa/selftest/cases/devtool.py
+++ b/meta/lib/oeqa/selftest/cases/devtool.py
@@ -269,7 +269,7 @@ class DevtoolAddTests(DevtoolBase):
self.track_for_cleanup(tempdir)
pn = 'pv'
pv = '1.5.3'
- url = 'http://www.ivarch.com/programs/sources/pv-1.5.3.tar.bz2'
+ url = 'http://downloads.yoctoproject.org/mirror/sources/pv-1.5.3.tar.bz2'
result = runCmd('wget %s' % url, cwd=tempdir)
result = runCmd('tar xfv %s' % os.path.basename(url), cwd=tempdir)
srcdir = os.path.join(tempdir, '%s-%s' % (pn, pv))
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 07/19] qemu: CVE-2020-29129 CVE-2020-29130
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (5 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 06/19] oeqa/devtool: use Yocto mirror for pv-1.5.3 tarball Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 08/19] image_types: sort tarball file listings Anuj Mittal
` (11 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Li Wang <li.wang@windriver.com>
References:
https://nvd.nist.gov/vuln/detail/CVE-2020-29129
https://nvd.nist.gov/vuln/detail/CVE-2020-29130
backport patch from:
https://git.qemu.org/?p=libslirp.git;a=commit;h=2e1dcbc0c2af64fcb17009eaf2ceedd81be2b27f
Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e5eda809a41732dfa4988799360be3d1280c1209)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/CVE-2020-29129-CVE-2020-29130.patch | 64 +++++++++++++++++++
2 files changed, 65 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2020-29129-CVE-2020-29130.patch
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 11be545cb5..bbe2a39755 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -33,6 +33,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://usb-fix-setup_len-init.patch \
file://0001-target-mips-Increase-number-of-TLB-entries-on-the-34.patch \
file://CVE-2020-24352.patch \
+ file://CVE-2020-29129-CVE-2020-29130.patch \
"
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-29129-CVE-2020-29130.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-29129-CVE-2020-29130.patch
new file mode 100644
index 0000000000..e5829f6dad
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2020-29129-CVE-2020-29130.patch
@@ -0,0 +1,64 @@
+From 2e1dcbc0c2af64fcb17009eaf2ceedd81be2b27f Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Thu, 26 Nov 2020 19:27:06 +0530
+Subject: [PATCH] slirp: check pkt_len before reading protocol header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf8
+Content-Transfer-Encoding: 8bit
+
+While processing ARP/NCSI packets in 'arp_input' or 'ncsi_input'
+routines, ensure that pkt_len is large enough to accommodate the
+respective protocol headers, lest it should do an OOB access.
+Add check to avoid it.
+
+CVE-2020-29129 CVE-2020-29130
+ QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets
+ -> https://www.openwall.com/lists/oss-security/2020/11/27/1
+
+Reported-by: Qiuhao Li <Qiuhao.Li@outlook.com>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Message-Id: <20201126135706.273950-1-ppandit@redhat.com>
+Reviewed-by: Marc-Andrà Lureau <marcandre.lureau@redhat.com>
+
+Upstream-Status: Backport
+CVE: CVE-2020-29129 CVE-2020-29130
+[https://git.qemu.org/?p=libslirp.git;a=commit;h=2e1dcbc0c2af64fcb17009eaf2ceedd81be2b27f]
+Signed-off-by: Li Wang <li.wang@windriver.com>
+---
+ slirp/src/ncsi.c | 4 ++++
+ slirp/src/slirp.c | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/slirp/src/ncsi.c b/slirp/src/ncsi.c
+index 3c1dfef..75dcc08 100644
+--- a/slirp/src/ncsi.c
++++ b/slirp/src/ncsi.c
+@@ -148,6 +148,10 @@ void ncsi_input(Slirp *slirp, const uint8_t *pkt, int pkt_len)
+ uint32_t checksum;
+ uint32_t *pchecksum;
+
++ if (pkt_len < ETH_HLEN + sizeof(struct ncsi_pkt_hdr)) {
++ return; /* packet too short */
++ }
++
+ memset(ncsi_reply, 0, sizeof(ncsi_reply));
+
+ memset(reh->h_dest, 0xff, ETH_ALEN);
+diff --git a/slirp/src/slirp.c b/slirp/src/slirp.c
+index dba7c98..9be58e2 100644
+--- a/slirp/src/slirp.c
++++ b/slirp/src/slirp.c
+@@ -756,6 +756,10 @@ static void arp_input(Slirp *slirp, const uint8_t *pkt, int pkt_len)
+ return;
+ }
+
++ if (pkt_len < ETH_HLEN + sizeof(struct slirp_arphdr)) {
++ return; /* packet too short */
++ }
++
+ ar_op = ntohs(ah->ar_op);
+ switch (ar_op) {
+ case ARPOP_REQUEST:
+--
+2.17.1
+
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 08/19] image_types: sort tarball file listings
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (6 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 07/19] qemu: CVE-2020-29129 CVE-2020-29130 Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 09/19] image_types: remove obsolete tar comment Anuj Mittal
` (10 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross@burtonini.com>
Help rootfs tarballs be reproducible by sorting the file listing.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4fa68626bbcfd9795577e1426c27d00f4d9d1c17)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/classes/image_types.bbclass | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/classes/image_types.bbclass b/meta/classes/image_types.bbclass
index 66884af8e0..9a508a911f 100644
--- a/meta/classes/image_types.bbclass
+++ b/meta/classes/image_types.bbclass
@@ -120,7 +120,7 @@ IMAGE_CMD_squashfs-lz4 = "mksquashfs ${IMAGE_ROOTFS} ${IMGDEPLOYDIR}/${IMAGE_NAM
# required when extracting, but it seems prudent to use it in both cases.
IMAGE_CMD_TAR ?= "tar"
# ignore return code 1 "file changed as we read it" as other tasks(e.g. do_image_wic) may be hardlinking rootfs
-IMAGE_CMD_tar = "${IMAGE_CMD_TAR} --numeric-owner -cf ${IMGDEPLOYDIR}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.tar -C ${IMAGE_ROOTFS} . || [ $? -eq 1 ]"
+IMAGE_CMD_tar = "${IMAGE_CMD_TAR} --sort=name --numeric-owner -cf ${IMGDEPLOYDIR}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.tar -C ${IMAGE_ROOTFS} . || [ $? -eq 1 ]"
do_image_cpio[cleandirs] += "${WORKDIR}/cpio_append"
IMAGE_CMD_cpio () {
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 09/19] image_types: remove obsolete tar comment
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (7 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 08/19] image_types: sort tarball file listings Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 10/19] qemu: CVE-2020-25624 Anuj Mittal
` (9 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross@burtonini.com>
We now depend on tar 1.28, so talking about older tar versions is just
confusing.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f19e43dec63a86c200e04ba14393583588550380)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/classes/image_types.bbclass | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/meta/classes/image_types.bbclass b/meta/classes/image_types.bbclass
index 9a508a911f..286009057e 100644
--- a/meta/classes/image_types.bbclass
+++ b/meta/classes/image_types.bbclass
@@ -108,16 +108,6 @@ IMAGE_CMD_squashfs-xz = "mksquashfs ${IMAGE_ROOTFS} ${IMGDEPLOYDIR}/${IMAGE_NAME
IMAGE_CMD_squashfs-lzo = "mksquashfs ${IMAGE_ROOTFS} ${IMGDEPLOYDIR}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.squashfs-lzo ${EXTRA_IMAGECMD} -noappend -comp lzo"
IMAGE_CMD_squashfs-lz4 = "mksquashfs ${IMAGE_ROOTFS} ${IMGDEPLOYDIR}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.squashfs-lz4 ${EXTRA_IMAGECMD} -noappend -comp lz4"
-# By default, tar from the host is used, which can be quite old. If
-# you need special parameters (like --xattrs) which are only supported
-# by GNU tar upstream >= 1.27, then override that default:
-# IMAGE_CMD_TAR = "tar --xattrs --xattrs-include=*"
-# do_image_tar[depends] += "tar-replacement-native:do_populate_sysroot"
-# EXTRANATIVEPATH += "tar-native"
-#
-# The GNU documentation does not specify whether --xattrs-include is necessary.
-# In practice, it turned out to be not needed when creating archives and
-# required when extracting, but it seems prudent to use it in both cases.
IMAGE_CMD_TAR ?= "tar"
# ignore return code 1 "file changed as we read it" as other tasks(e.g. do_image_wic) may be hardlinking rootfs
IMAGE_CMD_tar = "${IMAGE_CMD_TAR} --sort=name --numeric-owner -cf ${IMGDEPLOYDIR}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.tar -C ${IMAGE_ROOTFS} . || [ $? -eq 1 ]"
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 10/19] qemu: CVE-2020-25624
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (8 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 09/19] image_types: remove obsolete tar comment Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 11/19] meta/lib/oeqa/manual/oe-core.json: Update test_bitbake_devshell Anuj Mittal
` (8 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Li Wang <li.wang@windriver.com>
References:
https://nvd.nist.gov/vuln/detail/CVE-2020-25624
backport patch from:
https://git.qemu.org/?p=qemu.git;a=commit;h=1328fe0c32d5474604105b8105310e944976b058
Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 88d05be28da522fb390ee24f2871a113adf4366e)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2020-25624.patch | 101 ++++++++++++++++++
2 files changed, 102 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2020-25624.patch
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index bbe2a39755..274c855d35 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -34,6 +34,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://0001-target-mips-Increase-number-of-TLB-entries-on-the-34.patch \
file://CVE-2020-24352.patch \
file://CVE-2020-29129-CVE-2020-29130.patch \
+ file://CVE-2020-25624.patch \
"
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-25624.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-25624.patch
new file mode 100644
index 0000000000..7631bab39f
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2020-25624.patch
@@ -0,0 +1,101 @@
+From 1328fe0c32d5474604105b8105310e944976b058 Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Tue, 15 Sep 2020 23:52:58 +0530
+Subject: [PATCH] hw: usb: hcd-ohci: check len and frame_number variables
+
+While servicing the OHCI transfer descriptors(TD), OHCI host
+controller derives variables 'start_addr', 'end_addr', 'len'
+etc. from values supplied by the host controller driver.
+Host controller driver may supply values such that using
+above variables leads to out-of-bounds access issues.
+Add checks to avoid them.
+
+AddressSanitizer: stack-buffer-overflow on address 0x7ffd53af76a0
+ READ of size 2 at 0x7ffd53af76a0 thread T0
+ #0 ohci_service_iso_td ../hw/usb/hcd-ohci.c:734
+ #1 ohci_service_ed_list ../hw/usb/hcd-ohci.c:1180
+ #2 ohci_process_lists ../hw/usb/hcd-ohci.c:1214
+ #3 ohci_frame_boundary ../hw/usb/hcd-ohci.c:1257
+ #4 timerlist_run_timers ../util/qemu-timer.c:572
+ #5 qemu_clock_run_timers ../util/qemu-timer.c:586
+ #6 qemu_clock_run_all_timers ../util/qemu-timer.c:672
+ #7 main_loop_wait ../util/main-loop.c:527
+ #8 qemu_main_loop ../softmmu/vl.c:1676
+ #9 main ../softmmu/main.c:50
+
+Reported-by: Gaoning Pan <pgn@zju.edu.cn>
+Reported-by: Yongkang Jia <j_kangel@163.com>
+Reported-by: Yi Ren <yunye.ry@alibaba-inc.com>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Message-id: 20200915182259.68522-2-ppandit@redhat.com
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+Upstream-Status: Backport
+CVE: CVE-2020-25624
+[https://git.qemu.org/?p=qemu.git;a=commit;h=1328fe0c32d5474604105b8105310e944976b058]
+Signed-off-by: Li Wang <li.wang@windriver.com>
+---
+ hw/usb/hcd-ohci.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
+index 1e6e85e..9dc5910 100644
+--- a/hw/usb/hcd-ohci.c
++++ b/hw/usb/hcd-ohci.c
+@@ -731,7 +731,11 @@ static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed,
+ }
+
+ start_offset = iso_td.offset[relative_frame_number];
+- next_offset = iso_td.offset[relative_frame_number + 1];
++ if (relative_frame_number < frame_count) {
++ next_offset = iso_td.offset[relative_frame_number + 1];
++ } else {
++ next_offset = iso_td.be;
++ }
+
+ if (!(OHCI_BM(start_offset, TD_PSW_CC) & 0xe) ||
+ ((relative_frame_number < frame_count) &&
+@@ -764,7 +768,12 @@ static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed,
+ }
+ } else {
+ /* Last packet in the ISO TD */
+- end_addr = iso_td.be;
++ end_addr = next_offset;
++ }
++
++ if (start_addr > end_addr) {
++ trace_usb_ohci_iso_td_bad_cc_overrun(start_addr, end_addr);
++ return 1;
+ }
+
+ if ((start_addr & OHCI_PAGE_MASK) != (end_addr & OHCI_PAGE_MASK)) {
+@@ -773,6 +782,9 @@ static int ohci_service_iso_td(OHCIState *ohci, struct ohci_ed *ed,
+ } else {
+ len = end_addr - start_addr + 1;
+ }
++ if (len > sizeof(ohci->usb_buf)) {
++ len = sizeof(ohci->usb_buf);
++ }
+
+ if (len && dir != OHCI_TD_DIR_IN) {
+ if (ohci_copy_iso_td(ohci, start_addr, end_addr, ohci->usb_buf, len,
+@@ -975,8 +987,16 @@ static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed)
+ if ((td.cbp & 0xfffff000) != (td.be & 0xfffff000)) {
+ len = (td.be & 0xfff) + 0x1001 - (td.cbp & 0xfff);
+ } else {
++ if (td.cbp > td.be) {
++ trace_usb_ohci_iso_td_bad_cc_overrun(td.cbp, td.be);
++ ohci_die(ohci);
++ return 1;
++ }
+ len = (td.be - td.cbp) + 1;
+ }
++ if (len > sizeof(ohci->usb_buf)) {
++ len = sizeof(ohci->usb_buf);
++ }
+
+ pktlen = len;
+ if (len && dir != OHCI_TD_DIR_IN) {
+--
+2.17.1
+
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 11/19] meta/lib/oeqa/manual/oe-core.json: Update test_bitbake_devshell
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (9 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 10/19] qemu: CVE-2020-25624 Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 12/19] populate_sdk_ext: use SDK_CUSTOM_TEPLATECONF variable to enable custom templateconf.cfg Anuj Mittal
` (7 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: sangeeta jain <sangeeta.jain@intel.com>
Update command used for cross compilation to include ${CONFIGUREOPTS}
to ensure right arguments are passed for cross compiling on any host.
Signed-off-by: sangeeta jain <sangeeta.jain@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e995e67bc7a3d30adf9f8d0d2f4df92a941baeae)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/lib/oeqa/manual/oe-core.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/lib/oeqa/manual/oe-core.json b/meta/lib/oeqa/manual/oe-core.json
index fb47c5ec36..4ad524d89b 100644
--- a/meta/lib/oeqa/manual/oe-core.json
+++ b/meta/lib/oeqa/manual/oe-core.json
@@ -80,7 +80,7 @@
"expected_results": ""
},
"7": {
- "action": "Run command:./configure && make ",
+ "action": "Run command:./configure ${CONFIGUREOPTS} && make ",
"expected_results": "Verify that \"matchbox-desktop\" binary file was created successfully under \"src/\" directory "
},
"8": {
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 12/19] populate_sdk_ext: use SDK_CUSTOM_TEPLATECONF variable to enable custom templateconf.cfg
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (10 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 11/19] meta/lib/oeqa/manual/oe-core.json: Update test_bitbake_devshell Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 13/19] meta/lib/oe/reproducible.py: gitsm:// works just as fine as git:// for timestamps Anuj Mittal
` (6 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Chandana kalluri <ckalluri@xilinx.com>
The current implementation will always pick an existing templateconf.cfg if
present else it will use the one from OE. A user might not always want to pick
an existing tempalteconf.cfg even if its present. Introduce
SDK_CUSTOM_TEMPLATECONF variable to provide an option for the user to specify if he
wants to use an existing custom templateconf.cfg or not
If SDK_CUSTOM_TEMPLATECONF=='1' then enable custom templateconf.cfg. By default
SDK_CUSTOM_TEMPLATECONF is set to '0'
Signed-off-by: Sai Hari Chandana Kalluri <chandana.kalluri@xilinx.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d0f863a24d05bddeb21e181fb01fa0051c79d7d8)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/classes/populate_sdk_ext.bbclass | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/meta/classes/populate_sdk_ext.bbclass b/meta/classes/populate_sdk_ext.bbclass
index 6f35b612c2..e6bf27cf38 100644
--- a/meta/classes/populate_sdk_ext.bbclass
+++ b/meta/classes/populate_sdk_ext.bbclass
@@ -24,6 +24,7 @@ SDK_INCLUDE_NATIVESDK ?= "0"
SDK_INCLUDE_BUILDTOOLS ?= '1'
SDK_RECRDEP_TASKS ?= ""
+SDK_CUSTOM_TEMPLATECONF ?= "0"
SDK_LOCAL_CONF_WHITELIST ?= ""
SDK_LOCAL_CONF_BLACKLIST ?= "CONF_VERSION \
@@ -199,6 +200,9 @@ python copy_buildsystem () {
buildsystem = oe.copy_buildsystem.BuildSystem('extensible SDK', d)
baseoutpath = d.getVar('SDK_OUTPUT') + '/' + d.getVar('SDKPATH')
+ #check if custome templateconf path is set
+ use_custom_templateconf = d.getVar('SDK_CUSTOM_TEMPLATECONF')
+
# Determine if we're building a derivative extensible SDK (from devtool build-sdk)
derivative = (d.getVar('SDK_DERIVATIVE') or '') == '1'
if derivative:
@@ -390,7 +394,7 @@ python copy_buildsystem () {
shutil.copyfile(builddir + '/cache/bb_unihashes.dat', baseoutpath + '/cache/bb_unihashes.dat')
# Use templateconf.cfg file from builddir if exists
- if os.path.exists(builddir + '/conf/templateconf.cfg'):
+ if os.path.exists(builddir + '/conf/templateconf.cfg') and use_custom_templateconf == '1':
shutil.copyfile(builddir + '/conf/templateconf.cfg', baseoutpath + '/conf/templateconf.cfg')
else:
# Write a templateconf.cfg
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 13/19] meta/lib/oe/reproducible.py: gitsm:// works just as fine as git:// for timestamps
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (11 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 12/19] populate_sdk_ext: use SDK_CUSTOM_TEPLATECONF variable to enable custom templateconf.cfg Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 14/19] llvm: fix reproducibility Anuj Mittal
` (5 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
This in particular addresses vulkan-samples reproducibility which made me scratch my
head for a while.
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4a2936126f12eeacecced051fa339c32c1f16576)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/lib/oe/reproducible.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/lib/oe/reproducible.py b/meta/lib/oe/reproducible.py
index 421bb12f54..0fb02ccdb0 100644
--- a/meta/lib/oe/reproducible.py
+++ b/meta/lib/oe/reproducible.py
@@ -47,7 +47,7 @@ def find_git_folder(d, sourcedir):
return None
def get_source_date_epoch_from_git(d, sourcedir):
- if not "git://" in d.getVar('SRC_URI'):
+ if not "git://" in d.getVar('SRC_URI') and not "gitsm://" in d.getVar('SRC_URI'):
return None
gitpath = find_git_folder(d, sourcedir)
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 14/19] llvm: fix reproducibility
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (12 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 13/19] meta/lib/oe/reproducible.py: gitsm:// works just as fine as git:// for timestamps Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 15/19] webkitgtk: " Anuj Mittal
` (4 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a467c0a03d077861c37e317dcb2905b6388cb64c)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-devtools/llvm/llvm_git.bb | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/meta/recipes-devtools/llvm/llvm_git.bb b/meta/recipes-devtools/llvm/llvm_git.bb
index 4c2d490315..b146d0e6e3 100644
--- a/meta/recipes-devtools/llvm/llvm_git.bb
+++ b/meta/recipes-devtools/llvm/llvm_git.bb
@@ -99,6 +99,11 @@ do_configure_prepend() {
sed -ri "s#lib/${LLVM_DIR}#${baselib}/${LLVM_DIR}#g" ${S}/tools/llvm-config/llvm-config.cpp
}
+# patch out build host paths for reproducibility
+do_compile_prepend_class-target() {
+ sed -i -e "s,${WORKDIR},,g" ${B}/tools/llvm-config/BuildVariables.inc
+}
+
do_compile() {
ninja -v ${PARALLEL_MAKE}
}
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 15/19] webkitgtk: fix reproducibility
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (13 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 14/19] llvm: fix reproducibility Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 16/19] coreutils: add SUSE-specific issues to CVE whitelist Anuj Mittal
` (3 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1e7c673ab8d14766190843c6d8747510b37c71bf)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-sato/webkit/webkitgtk_2.28.4.bb | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/meta/recipes-sato/webkit/webkitgtk_2.28.4.bb b/meta/recipes-sato/webkit/webkitgtk_2.28.4.bb
index 34b14f86ea..45b3ee2bce 100644
--- a/meta/recipes-sato/webkit/webkitgtk_2.28.4.bb
+++ b/meta/recipes-sato/webkit/webkitgtk_2.28.4.bb
@@ -134,3 +134,15 @@ GI_DATA_ENABLED_libc-musl_armv7ve = "False"
# Can't be built with ccache
CCACHE_DISABLE = "1"
+
+PACKAGE_PREPROCESS_FUNCS += "src_package_preprocess"
+src_package_preprocess () {
+ # Trim build paths from comments in generated sources to ensure reproducibility
+ sed -i -e "s,${WORKDIR},,g" \
+ ${B}/DerivedSources/webkit2gtk/webkit2/*.cpp \
+ ${B}/DerivedSources/ForwardingHeaders/JavaScriptCore/*.h \
+ ${B}/DerivedSources/JavaScriptCore/*.h \
+ ${B}/DerivedSources/JavaScriptCore/yarr/*.h \
+ ${B}/DerivedSources/MiniBrowser/*.c
+}
+
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 16/19] coreutils: add SUSE-specific issues to CVE whitelist
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (14 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 15/19] webkitgtk: " Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 17/19] kernel-module-split.bbclass: fix kernel modules getting marked as CONFFILES Anuj Mittal
` (2 subsequent siblings)
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross@burtonini.com>
CVE-2013-0221 through -223 are all SUSE-specific, so add them to the
whitelist.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 59f2120de3b6d53bbfb9db858ffb8b7b20c8d1ce)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/recipes-core/coreutils/coreutils_8.32.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-core/coreutils/coreutils_8.32.bb b/meta/recipes-core/coreutils/coreutils_8.32.bb
index 9d1eceef54..4eb357e310 100644
--- a/meta/recipes-core/coreutils/coreutils_8.32.bb
+++ b/meta/recipes-core/coreutils/coreutils_8.32.bb
@@ -199,3 +199,6 @@ do_install_ptest () {
}
FILES_${PN}-ptest += "${bindir}/getlimits"
+
+# These are specific to Opensuse
+CVE_WHITELIST += "CVE-2013-0221 CVE-2013-0222 CVE-2013-0223"
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 17/19] kernel-module-split.bbclass: fix kernel modules getting marked as CONFFILES
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (15 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 16/19] coreutils: add SUSE-specific issues to CVE whitelist Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 18/19] uninative: Don't use single sstate for pseudo-native Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 19/19] wireless-regdb: upgrade 2020.04.29 -> 2020.11.20 Anuj Mittal
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Gratian Crisan <gratian.crisan@ni.com>
Yi pointed out that commit 1a70a92d1f10 ("kernel-module-split.bbclass:
identify kernel modconf files as configuration files") is
unintentionally adding the actual kernel /lib/modules .ko files to the
CONFFILES variable.
The root cause is the re-use of the 'files' variable in that commit.
Fix it by using a separate variable to keep track of the generated
module .conf files that need to be marked as configuration files.
Fixes: 1a70a92d1f10 ("kernel-module-split.bbclass: identify kernel modconf files as configuration files")
Reported-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Gratian Crisan <gratian.crisan@ni.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit db5f2ca532db4f0d2e05b7cb5f9d146e1dd76ab3)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/classes/kernel-module-split.bbclass | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/meta/classes/kernel-module-split.bbclass b/meta/classes/kernel-module-split.bbclass
index c8ede26996..baa32e0a90 100644
--- a/meta/classes/kernel-module-split.bbclass
+++ b/meta/classes/kernel-module-split.bbclass
@@ -120,7 +120,10 @@ python split_kernel_module_packages () {
files = d.getVar('FILES_%s' % pkg)
files = "%s /etc/modules-load.d/%s.conf /etc/modprobe.d/%s.conf" % (files, basename, basename)
d.setVar('FILES_%s' % pkg, files)
- d.setVar('CONFFILES_%s' % pkg, files)
+
+ conffiles = d.getVar('CONFFILES_%s' % pkg)
+ conffiles = "%s /etc/modules-load.d/%s.conf /etc/modprobe.d/%s.conf" % (conffiles, basename, basename)
+ d.setVar('CONFFILES_%s' % pkg, conffiles)
if "description" in vals:
old_desc = d.getVar('DESCRIPTION_' + pkg) or ""
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 18/19] uninative: Don't use single sstate for pseudo-native
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (16 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 17/19] kernel-module-split.bbclass: fix kernel modules getting marked as CONFFILES Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
2020-12-14 3:35 ` [gatesgarth][PATCH 19/19] wireless-regdb: upgrade 2020.04.29 -> 2020.11.20 Anuj Mittal
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
pseudo-native is a bit special. It conditionally compiles in support for
xattr, statx and statvfs amongst other options. If a pseudo-native binary is
used on a system where these functions are present but it wasn't compiled in
we see hard to debug permissions problems.
An example is the devtool.DevtoolExtractTests.test_devtool_deploy_target
oe-selftest which shows a cryptic error:
File "/home/pokybuild/yocto-worker/oe-selftest-fedora/build/meta/lib/oeqa/selftest/cases/devtool.py", line 1388, in test_devtool_deploy_target
self.assertEqual(filelist1, filelist2)
File "/usr/lib64/python3.9/unittest/case.py", line 831, in assertEqual
assertion_func(first, second, msg=msg)
File "/usr/lib64/python3.9/unittest/case.py", line 1037, in assertListEqual
self.assertSequenceEqual(list1, list2, msg, seq_type=list)
File "/usr/lib64/python3.9/unittest/case.py", line 1019, in assertSequenceEqual
self.fail(msg)
File "/usr/lib64/python3.9/unittest/case.py", line 670, in fail
raise self.failureException(msg)
AssertionError: Lists differ: ['-rwxr-xr-x 6000 6000 /etc/init.d/mdmonitor', '-rw-r-[10124 chars]n.8'] != ['-rwxr-xr-x root root /etc/init.d/mdmonitor', '-rw-r-[10124 chars]n.8']
First differing element 0:
'-rwxr-xr-x 6000 6000 /etc/init.d/mdmonitor'
'-rwxr-xr-x root root /etc/init.d/mdmonitor'
This is due to a version of pseudo without statx being used on a system where
ls uses statx, hence the files are displayed as 6000.6000 instead of root.root.
Avoid this by always building pseudo-native for the specific distro in question rather
than using a universal sstate feed.
This hopefully fixes one of the mysterious AB-INT issues.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6e3785a3f1f3cf68f5fe101cd6bebe91db165973)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
meta/classes/base.bbclass | 1 +
meta/classes/sstate.bbclass | 4 ++++
meta/lib/oe/sstatesig.py | 2 +-
3 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/meta/classes/base.bbclass b/meta/classes/base.bbclass
index 5a0b0c6b3e..78ae28bb0f 100644
--- a/meta/classes/base.bbclass
+++ b/meta/classes/base.bbclass
@@ -231,6 +231,7 @@ python base_eventhandler() {
if isinstance(e, bb.event.ConfigParsed):
if not d.getVar("NATIVELSBSTRING", False):
d.setVar("NATIVELSBSTRING", lsb_distro_identifier(d))
+ d.setVar("ORIGNATIVELSBSTRING", d.getVar("NATIVELSBSTRING", False))
d.setVar('BB_VERSION', bb.__version__)
# There might be no bb.event.ConfigParsed event if bitbake server is
diff --git a/meta/classes/sstate.bbclass b/meta/classes/sstate.bbclass
index a8ae75101d..d08d950e76 100644
--- a/meta/classes/sstate.bbclass
+++ b/meta/classes/sstate.bbclass
@@ -72,6 +72,7 @@ BB_HASHFILENAME = "False ${SSTATE_PKGSPEC} ${SSTATE_SWSPEC}"
SSTATE_ARCHS = " \
${BUILD_ARCH} \
+ ${BUILD_ARCH}_${ORIGNATIVELSBSTRING} \
${BUILD_ARCH}_${SDK_ARCH}_${SDK_OS} \
${BUILD_ARCH}_${TARGET_ARCH} \
${SDK_ARCH}_${SDK_OS} \
@@ -80,6 +81,7 @@ SSTATE_ARCHS = " \
${PACKAGE_ARCH} \
${PACKAGE_EXTRA_ARCHS} \
${MACHINE_ARCH}"
+SSTATE_ARCHS[vardepsexclude] = "ORIGNATIVELSBSTRING"
SSTATE_MANMACH ?= "${SSTATE_PKGARCH}"
@@ -121,6 +123,8 @@ SSTATE_HASHEQUIV_REPORT_TASKDATA[doc] = "Report additional useful data to the \
python () {
if bb.data.inherits_class('native', d):
d.setVar('SSTATE_PKGARCH', d.getVar('BUILD_ARCH', False))
+ if d.getVar("PN") == "pseudo-native":
+ d.appendVar('SSTATE_PKGARCH', '_${ORIGNATIVELSBSTRING}')
elif bb.data.inherits_class('crosssdk', d):
d.setVar('SSTATE_PKGARCH', d.expand("${BUILD_ARCH}_${SDK_ARCH}_${SDK_OS}"))
elif bb.data.inherits_class('cross', d):
diff --git a/meta/lib/oe/sstatesig.py b/meta/lib/oe/sstatesig.py
index 64fb84ec92..34558a6672 100644
--- a/meta/lib/oe/sstatesig.py
+++ b/meta/lib/oe/sstatesig.py
@@ -439,7 +439,7 @@ def find_sstate_manifest(taskdata, taskdata2, taskname, d, multilibcache):
d2 = multilibcache[variant]
if taskdata.endswith("-native"):
- pkgarchs = ["${BUILD_ARCH}"]
+ pkgarchs = ["${BUILD_ARCH}", "${BUILD_ARCH}_${ORIGNATIVELSBSTRING}"]
elif taskdata.startswith("nativesdk-"):
pkgarchs = ["${SDK_ARCH}_${SDK_OS}", "allarch"]
elif "-cross-canadian" in taskdata:
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread* [gatesgarth][PATCH 19/19] wireless-regdb: upgrade 2020.04.29 -> 2020.11.20
2020-12-14 3:34 [gatesgarth][PATCH 00/19] patch review request Anuj Mittal
` (17 preceding siblings ...)
2020-12-14 3:35 ` [gatesgarth][PATCH 18/19] uninative: Don't use single sstate for pseudo-native Anuj Mittal
@ 2020-12-14 3:35 ` Anuj Mittal
18 siblings, 0 replies; 20+ messages in thread
From: Anuj Mittal @ 2020-12-14 3:35 UTC (permalink / raw)
To: openembedded-core
From: zangrc <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c5461c6b0e21877c58a75834f62324a4798c2000)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
...ireless-regdb_2020.04.29.bb => wireless-regdb_2020.11.20.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-kernel/wireless-regdb/{wireless-regdb_2020.04.29.bb => wireless-regdb_2020.11.20.bb} (94%)
diff --git a/meta/recipes-kernel/wireless-regdb/wireless-regdb_2020.04.29.bb b/meta/recipes-kernel/wireless-regdb/wireless-regdb_2020.11.20.bb
similarity index 94%
rename from meta/recipes-kernel/wireless-regdb/wireless-regdb_2020.04.29.bb
rename to meta/recipes-kernel/wireless-regdb/wireless-regdb_2020.11.20.bb
index a5827b9ef0..05ab95ed7f 100644
--- a/meta/recipes-kernel/wireless-regdb/wireless-regdb_2020.04.29.bb
+++ b/meta/recipes-kernel/wireless-regdb/wireless-regdb_2020.11.20.bb
@@ -5,7 +5,7 @@ LICENSE = "ISC"
LIC_FILES_CHKSUM = "file://LICENSE;md5=07c4f6dea3845b02a18dc00c8c87699c"
SRC_URI = "https://www.kernel.org/pub/software/network/${BPN}/${BP}.tar.xz"
-SRC_URI[sha256sum] = "89fd031aed5977c219a71501e144375a10e7c90d1005d5d086ea7972886a2c7a"
+SRC_URI[sha256sum] = "b4164490d82ff7b0086e812ac42ab27baf57be24324d4c0ee1c5dd6ba27f2a52"
inherit bin_package allarch
--
2.29.2
^ permalink raw reply related [flat|nested] 20+ messages in thread