Fixes CVE-2018-18310: An invalid memory address dereference was
discovered in dwfl_segment_report_module.c in libdwfl in elfutils
through v0.174. The vulnerability allows attackers to cause a denial of
service (application crash) with a crafted ELF file, as demonstrated by
consider_notes.
Fixes CVE-2018-18520: An Invalid Memory Address Dereference exists in
the function elf_end in libelf in elfutils through v0.174. Although
eu-size is intended to support ar files inside ar files,
handle_ar in size.c closes the outer ar file before handling all inner
entries. The vulnerability allows attackers to cause a denial of service
(application crash) with a crafted ELF file.
Fixes CVE-2018-18521: Divide-by-zero vulnerabilities in the function
arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers
to cause a denial of service (application crash) with a crafted ELF
file, as demonstrated by eu-ranlib, because a zero sh_entsize is
mishandled.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since version 1.5, mosquitto can be built with explicit support for
systemd. If enabled, libmosquitto will link against libsystemd: when
started, the mosquitto broker notifies systemd that it is ready (ie.
initialized and ready to accept connections), so that services that
depend on the mqtt broker can be started only at that point.
To enable this feature, the systemd service config file needs to change
to Type=notify. Upstream now provides such a file, so we can remove
ours.
Signed-off-by: Titouan Christophe <titouan.christophe@railnova.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since version 1.5, it is possible to build mosquitto as a static lib.
However, the broker still needs a toolchain with support for shared libraries,
because it contains code to dynamically load modules at runtime. This
code makes use of dlfcn.h, which is only available for dylib enabled
systems.
Signed-off-by: Titouan Christophe <titouan.christophe@railnova.eu>
[Peter: adjust broker comment]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
In commit a589325405
("support/config-fragments/autobuild: rename br-riscv64-musl config"),
the RISC-V 64-bit musl toolchain config snippet was renamed, but the
toolchain.csv file was not updated accordingly.
Due to this, utils/genrandconfig was no longer able to generate any
configuration.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Package prboom builds using -O2 flag ignoring Buildroot settings, this
is due to the fact that -O2 is appended at the end of compiler flags.
Remove -O2 from 'configure.ac' file and set PRBOOM_AUTORECONF to YES,
this way CFLAGS_OPTS will contain Buildroot TARGET_CFLAGS.
Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
BR2_TOOLCHAIN_HAS_GCC_BUG_85180 dependency is already satisfied because
BR2_PACKAGE_BOOST_FIBER depends on
BR2_PACKAGE_BOOST_CONTEXT_ARCH_SUPPORTS that doesn't contain
BR2_microblaze and BR2_TOOLCHAIN_HAS_GCC_BUG_85180 depends right on
BR2_microblaze. So let's remove 'depends on
BR2_TOOLCHAIN_HAS_GCC_BUG_85180'.
Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Package libnss had a BR2_TOOLCHAIN_HAS_GCC_BUG_85862 dependency and
since ecryptfs-utils depends on libnss it does have this dependnecy as
well.
However, gcc bug 85862 has been worked around now in libnss by
disabling optimization, so libnss no longer has this
BR2_TOOLCHAIN_HAS_GCC_BUG_85862 dependency. We can therefore drop it
from ecryptfs-utils as well.
Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
With Microblaze Gcc version < 8.x the build hangs due to bug 85862:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85862
To avoid this, the libnss package has a !BR2_TOOLCHAIN_HAS_GCC_BUG_85862
dependency. However, gcc bug 85862 only triggers when optimization is
enabled, so we can work around the issue by passing -O0, which is what
we do in other Buildroot packages to work around this bug.
Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
With a C library which does not provide fenv.h, it won't work at runtime:
Crash after an "import numpy" on python.
Since numpy v1.16.0:
"Alpine Linux (and other musl c library distros) support
We now default to use fenv.h for floating point status error reporting.
Previously we had a broken default that sometimes would not report
underflow, overflow, and invalid floating point operations. Now we can
support non-glibc distrubutions like Alpine Linux as long as they ship
fenv.h."
Disable python-numpy for uClibc to avoid the runtime errors.
ARC's glibc used to have an incomplete fenv.h, but this has been fixed
since commit be0aaaaecd ("toolchain: bump ARC tools to arc-2019.03
release"), so we don't need an exception for ARC.
Two patches attempted to fix the build for uclibc and glibc for ARC, but
didn't fix the runtime issue. Remove those patches.
Signed-off-by: Damien DUVAL <damien.duval@smile.fr>
Signed-off-by: Alexandre PAYEN <alexandre.payen@smile.fr>
Cc: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Qt5 has predefined optimization flags depending if you're building for
size, for debug etc. These flags are defined in
mkspecs/common/gcc-base.conf:
QMAKE_CFLAGS_OPTIMIZE = -O2
QMAKE_CFLAGS_OPTIMIZE_FULL = -O3
QMAKE_CFLAGS_OPTIMIZE_DEBUG = -Og
QMAKE_CFLAGS_OPTIMIZE_SIZE = -Os
Then, in common/features/default_post.prf, they add those flags to
QMAKE_CFLAGS_RELEASE/QMAKE_CXXFLAGS_RELEASE depending on various build
options (optimize_size, optimize_full, optimize_debug):
optimize_size {
!isEmpty(QMAKE_CFLAGS_OPTIMIZE):!isEmpty(QMAKE_CFLAGS_OPTIMIZE_SIZE) {
QMAKE_CFLAGS_RELEASE -= $$QMAKE_CFLAGS_OPTIMIZE
QMAKE_CXXFLAGS_RELEASE -= $$QMAKE_CFLAGS_OPTIMIZE
QMAKE_CFLAGS_RELEASE += $$QMAKE_CFLAGS_OPTIMIZE_SIZE
QMAKE_CXXFLAGS_RELEASE += $$QMAKE_CFLAGS_OPTIMIZE_SIZE
}
} else: optimize_full {
!isEmpty(QMAKE_CFLAGS_OPTIMIZE):!isEmpty(QMAKE_CFLAGS_OPTIMIZE_FULL) {
QMAKE_CFLAGS_RELEASE -= $$QMAKE_CFLAGS_OPTIMIZE
QMAKE_CXXFLAGS_RELEASE -= $$QMAKE_CFLAGS_OPTIMIZE
QMAKE_CFLAGS_RELEASE += $$QMAKE_CFLAGS_OPTIMIZE_FULL
QMAKE_CXXFLAGS_RELEASE += $$QMAKE_CFLAGS_OPTIMIZE_FULL
}
}
Since this default_post.prf is included *after* our qmake.conf file,
these flags override our optimizations flags, which is not good.
However, our qmake.conf file is included *after* gcc-base.conf, so we
can simply reset those variables to have the empty value, and our
optimization flags will be used.
Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
[Thomas: completely change the approach, by simply resetting the
QMAKE_CFLAGS_OPTIMIZE_* variables in qmake.conf]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
In qmake.conf.in has been left 'QMAKE_CXXFLAGS_RELEASE += -O3' but this
leads to not use Buildroot CXXFLAGS when building in release
mode(without debugging symbols). So let's remove it to let Qt5 to follow
Buildroot optimization flags like other packages do.
Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
sshguard protects hosts from brute-force attacks against SSH and other
services.
Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
[Peter: cleanup, start init script at S49, correct license, select iptables]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Includes the newest firmware as shipped by Raspbian Buster,
the Raspbian release designed for the Pi4
Signed-off-by: Michael Cullen <michael@michaelcullen.name>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Includes the newest firmware as shipped by Raspbian Buster,
the Raspbian release designed for the Pi4
Signed-off-by: Michael Cullen <michael@michaelcullen.name>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This is based on the pi3 defconfig. There is currently no 64-bit support
since the upstream kernel does not build in this configuration.
Signed-off-by: Michael Cullen <michael@michaelcullen.name>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit pulls in the latest version of rpi-firmware to enable support
for the new Pi4. The Pi4 uses a different set of start files, so it adds
variant selection and copies the Pi4 variant of the files if selected.
Signed-off-by: Michael Cullen <michael@michaelcullen.name>
[Peter: reword / rework slightly]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The numpy build system attempts to find lapack/blas at build time. It
tries a lot of different implementations, e.g. lapack, openblas, atlas,
... It is possible to help this automatic discovery by specifying
libraries to load in site.cfg and/or by setting environment variables
BLAS and LAPACK.
Unfortunately, the build system's logic is really hard to understand and
it's fragile. For example, regardless of what is specified as libraries
to load, it *will* try to find libblas.so and liblapack.so. However,
when something is specified explicitly in site.cfg, it will use a
different code path.
It turns out that when we specified the blas and lapack libraries
explicitly, as is done now, the build system logic will assume (without
checking) that cblas is used. This causes calls to cblas_* to be linked
in - again without checking, because numpy contains a copy of the header
and it uses dlopen to load it. clapack, however, does *not* provide
cblas (although it does provide a library libblas.so, but no
libcblas.so). Therefore, when importing numpy at runtime, we get an
error like:
ImportError: /usr/lib/python3.7/site-packages/numpy/core/_multiarray_umath.cpython-37m-arm-linux-gnueabihf.so: undefined symbol: cblas_sgemm
The initial attempt to fix this added cblas to the libraries. This
happens to work because apparently the entire libraries line is ignored
when a non-existing library is added to it (remember, clapack does not
provide libcblas).
Another attempt was to set BLAS=None in the environment. This didn't
have any effect. Setting both BLAS=None and LAPACK=None does disable
lapack and blas, but then we don't use clapack at all.
In fact, it is not necessary to provide a libraries line at all: the
build system will attempt to find liblapack, libblas and libcblas
without any help.
Therefore, remove the libraries line from site.cfg and remove
PYTHON_NUMPY_SITE_CFG_LIBS.
Note that the paths to staging's /usr/include and /usr/lib need to be
specified explicitly. Indeed, the numpy build system doesn't use the
compiler to check the presence/absence of includes and libraries; it
searches the paths itself. It also hardcodes paths to /usr/lib etc, but
this is something that will be tackled in a separate commit.
Note that there is another problem: both lapack and clapack provide
libblas.so and liblapack.so. This will be handled in a later commit.
Also, openblas provides a cblas implementation in libopenblas.so, so
there should be a dependency on openblas to make sure numpy can find it.
This part is not entirely clear yet, so it will also be handled in a
separate commit.
Runtime testing is essential to be able to track this kind of issue, so
that is something that will be added in a separate commit as well.
Fixes:
http://lists.busybox.net/pipermail/buildroot/2019-June/252380.html
Initial patch from Giulio Benetti :
[v1] http://patchwork.ozlabs.org/patch/1100100/
[v2] http://patchwork.ozlabs.org/patch/1100208/
Signed-off-by: Alexandre PAYEN <alexandre.payen@smile.fr>
Cc: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Remove patch, it does not seem to be needed anymore as issue was not
reproduced (see https://github.com/slimm609/checksec.sh/issues/54)
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This patch adds support for the HiFive Unleashed board. This includes
building the firmware, kernel and rootFS for the HiFive Unleashed.
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
[Thomas:
- fix the directory name hifive_unleased -> hifive-unleashed
- drop from readme.txt the instructions about manually flashing each
partition, since we have a full SD card image
- drop the custom post-image.sh script]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
[Thomas:
- Config.in: move the BR2_TARGET_OPENSBI_PLAT dependency to a
"depends on", there's no need to have an if...endif block just for
that.
- Config.in: drop the BR2_TARGET_OPENSBI_LIBRARY_ONLY dependency,
since this option doesn't exist
- opensbi.mk: don't use qstrip on BR2_TARGET_OPENSBI_LINUX_PAYLOAD,
since it's a boolean option
- opensbi.mk: use += when adding linux to DEPENDENCIES
- opensbki.mk: refactor the firmware file installation with a loop]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This initial support includes:
Custom u-boot
Linux v5.1
ATF v2.0
Buildroot default packages
Tested-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Shyam Saini <shyam.saini@amarulasolutions.com>
[Thomas:
- Use BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_1
- Use final 5.1 kernel
- Use default ext2 filesystem]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This initial support includes:
u-boot v2019.04
Linux v5.0
Buildroot default packages
Signed-off-by: Shyam Saini <shyam.saini@amarulasolutions.com>
[Thomas: use BR2_TARGET_UBOOT_BOOT_SCRIPT to generate the U-Boot
script, instead of doing it in the post-build]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This initial support includes:
Linux 5.1
Custom U-Boot
Arm Trusted Firmware v2.0
Buildroot default packages
Signed-off-by: Shyam Saini <shyam.saini@amarulasolutions.com>
[Thomas:
- Use the headers from the kernel, by using
BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_1=y
- Use the default ext2 rootfs size]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This initial support includes:
Linux 5.1
Custom U-Boot
Arm Trusted Firmware v2.0
Buildroot default packages
Signed-off-by: Shyam Saini <shyam.saini@amarulasolutions.com>
[Thomas:
- Use the headers from the kernel, by using
BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_1=y
- Use the default ext2 rootfs size]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This initial support includes:
Linux 5.1
Custom U-Boot
Arm Trusted Firmware v2.0
Buildroot default packages
Tested-by: Akash Gajjar <akash@openedev.com>
Signed-off-by: Shyam Saini <shyam.saini@amarulasolutions.com>
[Thomas:
- Use the headers from the kernel, by using
BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_1=y
- Use the default ext2 rootfs size]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This initial support includes:
Linux v5.2
Custom U-Boot
Arm Trusted Firmware v2.0
Buildroot default packages
Signed-off-by: Shyam Saini <shyam.saini@amarulasolutions.com>
[Thomas:
- Use the kernel headers from the kernel, by using
BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_2=y
- Use the final 5.2 kernel instead of rc1.
- Use the default ext2 rootfs size]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
And also add the hash of the COPYING file
Signed-off-by: Zoltan Gyarmati <zgyarmati@zgyarmati.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Such config allows to setup gitlab tests for various
qemu architectures (x86, mips, nios2, microblaze, ..., etc)
using the same Qemu version.
Signed-off-by: Jugurtha BELKALEM <jugurtha.belkalem@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
sh64 has been removed since commit [1]:
[1] 4338a319b7
Signed-off-by: Jugurtha BELKALEM <jugurtha.belkalem@smile.fr>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This change enables host qemu support for sparc64 which among other
things allows to test this architecture in gitlab.
Signed-off-by: Jugurtha BELKALEM <jugurtha.belkalem@smile.fr>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This change enables host qemu support for nios2 which among other
things allows to test this architecture in gitlab.
Signed-off-by: Jugurtha BELKALEM <jugurtha.belkalem@smile.fr>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The most important change is to use the toolchain compiled by
buildroot itself. We also bump kernel to 5.0 with kernel.org.
Gx6605s' PHYS_OFFSET if 0x10000000 and we make qemu and gx6605s the
same to ease maintaince. This PHYS_OFFSET is also OK for 610 qemu.
In this patch we add gx6605s.dts in board/csky, because linux-5.0
doesn't contain gx6605s.dts in its tree.
Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
We do not have any configuration that tests the very bleeding edge gcc
and binutils versions, so let's change br-arm-internal-glibc to use
the latest version of gcc (9.x right now) and binutils (2.32 right
now). The idea is that this defconfig should be updated to the latest
version of gcc and binutils when their version is bumped.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
All toolchains have been rebuilt with Buildroot 2019.05.1. A number of
toolchains are now using Linux headers 5.1 instead of 4.19, because
5.1 is now the default version.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
For internal toolchains, we have a policy of naming the files with
"internal", to clearly distinguish them from external toolchain
configurations.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
See https://github.com/libevent/libevent/releases
Also remove upstreamed patch (already in version)
Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
- Switch to meson-package
- Add patch to fix build without gupnp-av
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Theses defconfig was added at the when gcc 6 was not the default version
used by Buildroot, so the gcc version was explicitely set.
Since then, gcc 8.x is used as the default. So drop BR2_GCC_VERSION_6_X.
Tested with Qemu 2.8.1 (Debian 1:2.8+dfsg-6+deb9u7)
qemu_mips32r6_malta_defconfig
qemu_mips32r6el_malta_defconfig
qemu_mips64r6_malta_defconfig
qemu_mips64r6el_malta_defconfig
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
