[yocto] kernel patches

[Bruce Ashfield]

On 14-08-22 08:17 AM, Sona Sarmadi wrote:
> Hi all,
>
> I wonder how you handle the kernel patches?
>
> I want to apply a security kernel patch to Linux-yocto 3.10  which is used by Romely:
>
> meta-inte/meta-romley/conf/machine/romley-ivb.conf:PREFERRED_VERSION_linux-yocto ?= "3.10%"
>
> For me the obvious way to fix this is:
> 1) Create >> "poky/meta/recipes-kernel/linux/files" directory and add the patch file there
>
> 2) modify: poky/meta/recipes-kernel/linux/linux-yocto_3.10.bb
>
>
> -SRC_URI = "git://git.yoctoproject.org/linux-yocto-3.10.git;bareclone=1;branch=${KBRANCH},${KMETA};name=machine,meta"
> +FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
>
> +SRC_URI = "git://git.yoctoproject.org/linux-yocto-3.10.git;bareclone=1;branch=${KBRANCH},${KMETA};name=machine,meta \
> +          file://Fix_for_CVE-2014-0196_pty_layer_race_condition.patch \
> +          "
>
> Please let me know if this is the correct way. And also let me know if I upstream this kernel patch to yocto, will yocto accept it (if the patch looks correct of course). Please let me know if you prefer to apply security patches to kernels in some different way.

If this is for your own local builds, a layer with a bbappend and the
patches is a better idea.

For the main linux-yocto recipes, everything is maintained in the
git repositories, not patched at build time, so changes go to the
linux-yocto mailing list, and I merge them from there.

On this particular topic, I already track all the -stable updates for
our linux-yocto kernels, and CVEs are picked up by -stable. So there's
a process in place to get security related fixes into the linux-yocto
trees.

I'm a few releases behind at the moment, due to a 2 week vacation,
but 3.4, 3.10 and 3.14 will all be updated shortly.

If you do notice a CVE that isn't part of the k.org -stable updates,
that is or more interest, and we should nominate it for -stable upstream
and have it flow to all kernels via that process.

Bruce

>
> Thanks
> BR - Sona
>