diff mbox series

[1/2] linux/generate-cve-exclusions: add version check warning

Message ID 20230825142507.2128190-1-ross.burton@arm.com
State Accepted, archived
Commit 645066ecec0f52eac0225a144285f44882003856
Headers show
Series [1/2] linux/generate-cve-exclusions: add version check warning | expand

Commit Message

Ross Burton Aug. 25, 2023, 2:25 p.m. UTC 
From: Ross Burton <ross.burton@arm.com>

Embed the version that this file was generated for in the include, and
compare it to the version that is being checked.

This should act as a reminder to update the file when the kernel is
upgraded.

Signed-off-by: Ross Burton <ross.burton@arm.com>
---
 .../linux/generate-cve-exclusions.py              | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/meta/recipes-kernel/linux/generate-cve-exclusions.py b/meta/recipes-kernel/linux/generate-cve-exclusions.py
index 34f9ee731dc..f73afebb7e0 100755
--- a/meta/recipes-kernel/linux/generate-cve-exclusions.py
+++ b/meta/recipes-kernel/linux/generate-cve-exclusions.py
@@ -42,9 +42,18 @@  def main(argp=None):
     with open(datadir / "data" / "stream_fixes.json", "r") as f:
         stream_data = json.load(f)
 
-    print("# Auto-generated CVE metadata, DO NOT EDIT BY HAND.")
-    print(f"# Generated at {datetime.datetime.now()} for version {version}")
-    print()
+    print(f"""
+# Auto-generated CVE metadata, DO NOT EDIT BY HAND.
+# Generated at {datetime.datetime.now()} for version {version}"
+
+python check_kernel_cve_status_version() {{
+    this_version = "{version}"
+    kernel_version = d.getVar("LINUX_VERSION")
+    if kernel_version != this_version:
+        bb.warn("Kernel CVE status needs updating: generated for %s but kernel is %s" % (this_version, kernel_version))
+}}
+do_cve_check[prefuncs] += "check_kernel_cve_status_version"
+""")
 
     for cve, data in cve_data.items():
         if "affected_versions" not in data: