[OE-core] CVE related consulting on linux-yocto on zeus branch

[Bruce Ashfield]

On Thu, Mar 12, 2020 at 2:28 AM zangrc <zangrc.fnst at cn.fujitsu.com> wrote:
>
> Our team plans to submit CVE-related patches that are not included in
> -stable, but we found that the current version of the linux-yocto recipe
> is lower than the linux-yocto git repository. On which version should we
> make the patch.

Send patches against the latest linux-yocto kernel tree, following the
upstream kernel process. Also, consider nominating the patches for
upstream -stable as well (but we can still integrate them to
linux-yocto first).

I can generate SRCREV bumps for the actual recipes, for the stable
branches, after that.

Cheers,

Bruce

>
> On 3/11/20 8:36 PM, Bruce Ashfield wrote:
> > On Wed, Mar 11, 2020 at 2:02 AM zangrc <zangrc.fnst at cn.fujitsu.com> wrote:
> >>
> >> Hello,
> >>
> >>
> >> our team is currently working on CVE-related work. I would like to ask
> >> if the zeus branch of yocto has an update plan for linux-yocto in the
> >> near future. If not, can we submit a CVE-related patch for the
> >> linux-yocto of the zeus branch.
> > If it is part of -stable, then yes, it will be integrated into any of
> > the active upstream kernels. If it is in 5.2, we also have a -stable
> > process for those kernels as well.
> >
> > If it doesn't fall into those categories, then send any patches
> > (against the kernel itself) to the linux-yocto mailing list, do not
> > send them as patches to the linux-yocto recipe itself.
> >
> > Cheers,
> >
> > Bruce
> >
> >>    --
> >> Best Regards!
> >> Zang Ruochen
> >>
> >>
> >>
> >
>
>


-- 
- Thou shalt not follow the NULL pointer, for chaos and madness await
thee at its end
- "Use the force Harry" - Gandalf, Star Trek II