[yocto] kernel patches

[Bruce Ashfield]

On 14-08-22 12:02 PM, Sona Sarmadi wrote:
> Bruce,
> Thanks for quick response. See inline my comments.
>
> Have a nice weekend
> /Sona
>
>>> Please let me know if this is the correct way. And also let me know if I upstream this kernel patch to yocto, will yocto accept it (if the patch looks correct > of course). Please let me know if you prefer to apply security patches to kernels in some different way.
>
>> If this is for your own local builds, a layer with a bbappend and the patches is a better idea.
> Sona: No this is not local, I wanted to backport a security patch from 3.15 to lLinux Yoctp 3.14 and upstreamed to Yocto.
>
>> For the main linux-yocto recipes, everything is maintained in the git repositories, not patched at build time, so changes go to the linux-yocto mailing list, and I merge them from there.
>
>> On this particular topic, I already track all the -stable updates for our linux-yocto kernels, and CVEs are picked up by -stable. So there's a process in place to get security related fixes into the linux-yocto trees.
> Sona: very good :)
>
>> I'm a few releases behind at the moment, due to a 2 week vacation, but 3.4, 3.10 and 3.14 will all be updated shortly.
> Sona: So if a security patch is only fixed in later versions, you don't want to backport the fix to older yocto versions (e.g.3.10, 3.14) even if the bug is present in these versions. You rather prefer to inherit these from k.org.

We are at a slight advantage in this area, since we've moved to a model
of releasing and supporting the LTSI kernel versions. As such, they
continue to get korg stable maintenance for a cycle that matches our
Yocto support window.

That means there are few, if any, CVEs that don't get addressed via
the flow I described.

That being said, if there's a linux-yocto kernel version that isn't
LTSI and isn't get standard korg -stable updates (i.e. the non-LTSI
kernel version that will be released with Yocto 1.7), then backported
fixes to that version can come to the linux-yocto list, and I can
apply them to the tree.

Cheers,

Bruce

>
>
>> If you do notice a CVE that isn't part of the k.org -stable updates, that is or more interest, and we should nominate it for -stable upstream and have it > flow to all kernels via that process.
>
> Sona: I see, this would be a better approach.
>
>> Bruce
>