linux/poky.git, branch yocto-2.2.1

build-appliance-image: Update to morty head revision

2017-02-08T12:00:36+00:00

(From OE-Core rev: 55c835c73cc41b6fc809c941c295d62a612e49e0) Signed-off-by: Richard Purdie

openssl: CVE: CVE-2017-3731

2017-02-08T12:00:21+00:00

If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. Backported from: https://github.com/openssl/openssl/commit/8e20499629b6bcf868d0072c7011e590b5c2294d https://github.com/openssl/openssl/commit/2198b3a55de681e1f3c23edb0586afe13f438051 * CVE: CVE-2017-3731 Upstream-status: Backport (From OE-Core rev: 1fe1cb3e6e03b4f7f0d30b2b67edc8809a18fe70) Signed-off-by: Alexandru Moise Signed-off-by: Richard Purdie

libx11: CVE-2016-7943

2017-02-08T12:00:21+00:00

The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write operations. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7943 https://lists.x.org/archives/xorg-announce/2016-October/002720.html Upstream patch: https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8c29f1607a31dac0911e45a0dd3d74173822b3c9 (From OE-Core rev: d627e5bd50f66275cb3a77036ea3376a6f1e9a96) Signed-off-by: Sona Sarmadi Signed-off-by: Richard Purdie

libX11: CVE-2016-7942

2017-02-08T12:00:21+00:00

The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations. References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7942 Upstream patch https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8ea762f94f4c942d898fdeb590a1630c83235c17 (From OE-Core rev: 6d4421301a54c26e390fa943805574ced6e18c3a) Signed-off-by: Sona Sarmadi Signed-off-by: Richard Purdie

libXrandr: fix for CVE-2016-7947 and CVE-2016-7948

2017-02-08T12:00:21+00:00

CVE-2016-7947 Insufficient validation of server responses result in Integer overflows CVE-2016-7948 Insufficient validation of server responses result in various data mishandlings References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7947 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7948 https://lists.x.org/archives/xorg-announce/2016-October/002720.html Upstream patch for both CVEs: https://cgit.freedesktop.org/xorg/lib/libXrandr/commit/?id=a0df3e1c7728205e5c7650b2e6dce684139254a6 (From OE-Core rev: 1c293e889f6eeae36f8f6ddd9676c65d613ad0fc) Signed-off-by: Sona Sarmadi Signed-off-by: Richard Purdie

libxrender: CVE-2016-7949

2017-02-08T12:00:21+00:00

Insufficient validation of server responses results in overflow of previously reserved memory Upstream patch: https://cgit.freedesktop.org/xorg/lib/libXrender/commit/?id=9362c7ddd1af3b168953d0737877bc52d79c94f4 External References: https://lists.x.org/archives/xorg-announce/2016-October/002720.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7949 (From OE-Core rev: 87ffd7ce2e8ece8b44ff3f1c219a74b3590cf14b) Signed-off-by: Sona Sarmadi Signed-off-by: Richard Purdie

classes: Fix alternatives and rc.d ordering

2017-02-08T12:00:21+00:00

When using an alternative as an initscript, the ordering between update-rc.d and update-alternatives tasks during prerm and postinst tasks must always be the following in order to work: * prerm: - stop daemon - remove alternative * postinst: - add alternative - start daemon This patchset adds comments to the scripts generated by both classes and organize the generated sections based on those comments. [YOCTO #10433] (From OE-Core rev: b0c70bef015f1b2a30556a5db5e255592d5bf316) Signed-off-by: David Vincent Signed-off-by: Ross Burton (cherry picked from commit aa87b1a4dcc14e4dfe719b6c55045c5662bc59c2) Signed-off-by: Richard Purdie

bitbake: tinfoil: clean environment when starting up cooker

2017-02-03T09:52:19+00:00

During normal bitbake execution, the environment is cleaned of variables not on a whitelist while starting up cooker, and then restored afterwards. Prior to the tinfoil2 rework in master we were taking a number of shortcuts within tinfoil and one of those was not doing this environment cleaning. However, prior to OE-Core rev 3d39ca5c91dbb62fb43199f916bd390cd6212e3d we didn't have any code (as far as I'm aware) that was affected by this shortcut, hence why this wasn't an issue up to now. The result is the following error when attempting to run "devtool build" in the eSDK, as CCACHE_PATH is allowed through from the eSDK's environment setup script: ----------- snip ----------- ccache: error: Could not find compiler "gcc" in PATH ... subprocess.CalledProcessError: Command 'gcc --version' returned non-zero exit status 1 ----------- snip ----------- We can fix this by simply doing the environment filtering while we are starting up cooker, thus the environment when uninative.bbclass comes to do the gcc version check it is not affected by CCACHE_PATH or other variables in the external environment that should be filtered out. For clarity, this patch is only applicable to the bitbake 1.32 branch as used for the OE-Core morty branch - master uses the reworked tinfoil2 and doesn't need this fix. Fixes [YOCTO #10961]. (Bitbake rev: a240f5ff71092cb209c44a071cd6fa07756ccfa0) Signed-off-by: Paul Eggleton Signed-off-by: Richard Purdie

bitbake: bitbake-worker: Handle cooker/worker IO deadlocking

2017-02-03T09:52:19+00:00

I noiced builds where tasks seemed to be taking a surprisingly long time. When I looked at the output of top/pstree, these tasks were no longer running despite being listed in knotty. Some were in D/Z state waiting for their exit code to be collected, others were simply not present at all. strace showed communication problems between the worker and cooker, each was trying to write to the other and nearly deadlocking. Eventually, timeouts would allow them to echange 64kb of data but this was only happening every few seconds. Whilst this particularly affected builds on machines with large numbers of cores (and hence highly parallal task execution) and in cases where I had a lot of debug enabled, this situation is clearly bad in general. This patch introduces a thread to the worker which is used to write data back to cooker. This means that the deadlock can't occur and data flows much more freely and effectively. (Bitbake rev: f48befe1163147b02a9926ee38af0f7258a477e0) Signed-off-by: Richard Purdie

yocto-project-qs, poky.ent: Added "pexpect" to essential packages

2017-02-03T09:51:32+00:00

Fixes [YOCTO #10889] Missing this package. Speculation is that this package was part of the Python 2.7 stuff but not Python 3. So, adding it clears the issue up. (From yocto-docs rev: fc6bfab923f18a8ec91e29fed2404690d0afeb5d) Signed-off-by: Scott Rifenbark Signed-off-by: Richard Purdie