A device without UBI, such as an x86 VM or a device on eMMC, can keep its
provisioning data on a block partition named `provisioning`. The data
uses the same header as the UBI volume.
open() and create() prefer the UBI volume and then look for the partition
through the PARTNAME of each block device in sysfs. A commit checks the
flush, because close() reports no error. A partition cannot be removed
from here, so destroy erases the header and the data.
The provision command now exits with an error when a commit or a
destroy fails, for both backends.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The "name=value\0 ... \0\0" walk over the mmap()ed nvram used strchr()
and strlen() without a bound, so an nvram without the terminating
double NUL made it run past the end of the mapping.
Search with memchr() up to the length from the nvram header, or up to
the end of the mapping when that length does not fit, so a broken
header is still readable. A variable that is not terminated in this
area ends the parsing.
Map a regular file, like the /tmp staging file, only as far as it is
backed, rounded down to 4 bytes for the padding in nvram_commit(),
instead of the partition size which raised SIGBUS. Only search the
start of a mapping smaller than NVRAM_MIN_SPACE for the magic instead
of underflowing the loop boundary; bcm47xxpart creates such nvram
partitions on flashes with 4 KiB erase blocks.
"nvram info" clamps the header length before the CRC8, it read beyond
the mapping or underflowed into a 4 GB read before.
This is reachable with a crafted nvram partition or staging file, on
bcm47xx the nvram partition is also parsed while booting.
Reported by @tonoyx91 and @0xROI.
Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-5m25-qmhm-crr4
Fixes: 400c1a7fbf ("Add unvram, a nvram manipulation tool suitable for brcm-2.4 and bcm47xx platforms")
Assisted-by: Claude:claude-opus-5
Link: https://github.com/openwrt/openwrt/pull/25240
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The tool opens /dev/fb0 and mmaps it. Legacy fbdev and DRM fbdev
emulation are gone from every target except the exempt ones, so the
device node it needs is absent there. Nothing depends on the package.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
px5g uses a 512 bit RSA key by default, for rsakey without a size and
for selfsigned without -newkey. mbedtls 3.6 refuses to generate RSA
keys smaller than MBEDTLS_RSA_GEN_KEY_MIN_BITS, which is 1024 bits, so
both commands fail with "error: key generation failed". OpenWrt uses
mbedtls 3.6 since 24.10.
Use 2048 bits as the default RSA key size, like px5g-wolfssl and
OpenSSL do.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25629
Signed-off-by: Robert Marko <robimarko@gmail.com>
Use a generic procd service around the foreground BlueZ btattach utility.
Configure the UART, protocol and speed through UCI, without router
identity checks or GPIO operations in the attachment service.
Leave attachment disabled and the device unset by default. Keep board
wiring in the device tree and use the existing HCI UART and BlueZ packages.
Tested controller startup after cold power-on, LE discovery, connection
and service discovery on LN6001.
Signed-off-by: Satoshi Ikeuchi <satosan.ikm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25594
Signed-off-by: Robert Marko <robimarko@gmail.com>
An -addext value is only consumed if it starts with "extendedKeyUsage="
or with "subjectAltName=" and contains a colon. Any other value, for
example "subjectAltName=localhost" or the OpenSSL spelling
"subjectAltName = DNS:x", stops the option parser, so px5g ignores all
options after it, for example -keyout and -out. A comma separated list
like "DNS:a,DNS:b", as OpenSSL takes it, ends up as a single bogus
name. An empty name like "subjectAltName=DNS:" is written into the
certificate, although OpenSSL refuses it. Email addresses are only
accepted with the type EMAIL, while OpenSSL calls it email.
extendedKeyUsage has similar problems. A value other than serverAuth or
any leaves an empty OID in the extension, values are matched by prefix,
and only the last of several extendedKeyUsage options is used.
Fail with an error on unsupported values, on empty names and on any
comma in a subjectAltName, which OpenSSL takes as a separator even in a
URI. Accept the type email as well. Compare the usage exactly, also
accepting the OpenSSL name anyExtendedKeyUsage, and keep all given
usages. Check the result of adding them and fail if mbedtls refuses
them, for example 26 serverAuth values, which do not fit its buffer.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25604
Signed-off-by: Robert Marko <robimarko@gmail.com>
The subjectAltName support added in commit efca89daef ("px5g-mbedtls:
add subjectAltName and extendedKeyUsage to SSL certs") has these bugs:
- Every IP entry is written with a length of 16 bytes. An IPv4 address
ends up as a zero padded IPv6 address, so 192.168.1.1 becomes
C0A8:101:: and clients reject the certificate for that address.
- All IP entries share one buffer, so each of them carries the address
given last.
- An invalid IP address is not rejected but written as :: or as the
address of an earlier IP entry.
- The list is linked after every option instead of only after a new
entry. If any other option follows the last subjectAltName, that
entry points to itself. Adding the extension then loops until the
size counter overflows, which never ends on 64-bit targets and drops
the whole extension on 32-bit targets.
- An unknown entry type only prints a warning. It stays in the list
with type 0, which mbedtls cannot write, so the whole extension is
dropped while px5g still exits with 0.
- Without any subjectAltName, the extension is written with an empty
list, which RFC 5280 does not allow. Chrome rejects such a
certificate with ERR_CERT_INVALID and, unlike for other self-signed
certificates, does not offer to proceed.
Use the length returned by mbedtls_x509_crt_parse_cn_inet_pton(),
allocate a buffer for each IP entry and link only new entries. Reject
invalid IP addresses and unknown entry types with an error. Add the
extension only if there are entries and fail with an error if mbedtls
refuses it.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25604
Signed-off-by: Robert Marko <robimarko@gmail.com>
The message told the user to run "provision enable", but no such command
exists. The command that makes the partition is "provision create".
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The sound and DRM modules carry a dependency on audio-support and
video-support, which is what decides whether an image handles those
devices. The AUDIO_SUPPORT and DISPLAY_SUPPORT tokens beside them add a
second, per-SoC-family condition that a board cannot influence, and that
DISPLAY_SUPPORT is half derived from whatever kernel configuration was
copied into a target's fragment.
Drop the tokens from the module dependencies and from fbtest.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Update to Git HEAD as of 2026-09-17
Update patches:
- 0001-raspinfo-adapt-to-OpenWrt.patch: rebase, note vclog alongside
vcdbg when neither is found
- 1001-rpifwcrypto-switch-from-GnuTLS-to-OpenSSL.patch: add proper
commit message; update documentation where needed; fix hash_file()
to bound the memcpy by the actual digest length instead of always
copying SHA256_HASH_SIZE bytes
- 1002-piolib-make-piolib-a-shared-library.patch: add proper commit
message and update documentation where needed
- Add 1003-cmake-disable-splashasm.patch: splashasm is not needed
for the OpenWrt build at this time
Fixes: a296a5adf7 ("bcm27xx-utils: update to 20260621, add rpi-fw-crypto and piolib")
Signed-off-by: Joshua Covington <joshuacov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25243
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
A package builds with -j1 unless it sets PKG_BUILD_PARALLEL, and 171 of
the 220 packages do not set it. These three gain the most from the job
server on a cold build of this tree:
mtd-utils 24.77 s -> 6.43 s
libsepol 17.99 s -> 2.18 s
libselinux 7.82 s -> 1.89 s
mtd-utils runs while nothing else does, so its 18 s count against the
wall clock in full.
Each one builds three times out of three with the job server, and each
build writes a tree that is identical to the one a serial build writes.
nftables gains as well, 17.9 s to 13.0 s, but it is left alone: its
build directory differs between two serial builds, so the check that
covers the other three says nothing about it.
Signed-off-by: John Crispin <john@phrozen.org>
Following on from e23b37b, it makes sense to also enable searching
the history rather that just relying on up and down arrow while
scanning the results.
On both x86 and ath79, busybox binary is ~4.2k bigger. The resulting
x86 .apk is 447 bytes bigger and mips_24kc .apk is 324 bytes bigger.
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23953
Signed-off-by: Robert Marko <robimarko@gmail.com>
ADB authentication signs the 20-byte challenge directly as a SHA-1
digest. The mbedTLS port hashes the challenge before signing it,
causing adbd to reject every signature and request user approval
after each server restart.
Pass the challenge directly to mbedtls_pk_sign(), matching the former
RSA_sign() behavior.
Signed-off-by: Vladimir Zadirei <v.zadirei@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24946
Signed-off-by: Robert Marko <robimarko@gmail.com>
Scripts need the map type to know how to interact with a map, e.g.
per-CPU value handling or keyless queue/stack semantics. Add an
info() map method returning type, key/value size and max_entries,
along with BPF_MAP_TYPE constants for comparison.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Add consumer support for BPF_MAP_TYPE_RINGBUF and
BPF_MAP_TYPE_PERF_EVENT_ARRAY maps. ringbuf(callback) and
perf_buffer(callback, pages, lost_callback) map methods return a
buffer resource with fileno, poll and consume methods. The fileno
method exposes the epoll fd and matches the interface uloop.handle()
expects, so a buffer can be passed directly to uloop for event loop
integration.
The ring buffer callback receives the sample data and may return a
negative integer to stop consumption; the perf callbacks additionally
receive the CPU number.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Updates on array/hash-of-maps and prog array maps take the fd of the
inner object as a 4-byte value. Accept bpf.map and bpf.program
resources as map values and convert them to their fd.
Lookups on map-in-map types return the inner map id; add open_map_id
and open_program_id to obtain a usable object from such an id.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Queue and stack maps have zero-sized keys and require a NULL key
pointer; the kernel rejects any non-NULL key with EINVAL, making
these maps unusable. Accept a null key argument on maps without a
key, mapping get() to peek, set() to push and delete() with return
to pop.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lookup, update and lookup-and-delete on per-CPU maps use buffers of
roundup(value_size, 8) * num_possible_cpus bytes. The previous code
sized buffers for a single value, so get() on a per-CPU map made the
kernel overflow the stack buffer and set() passed undersized data.
Track the map type and size the buffers accordingly. get() and
delete() with return now yield an array with one value per CPU, set()
accepts either such an array or a single value replicated to all
CPUs.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Failures in the detach path returned NULL without recording any error
state, so error() reported a stale or empty error. Attach failures
reported a hardcoded ENOENT regardless of the actual cause. Record
errno for all failures; if_nametoindex, bpf_tc_attach and
bpf_tc_detach all set it.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
bpf_object__next_map does not set errno when it runs out of maps, so
the reported error code was whatever errno happened to hold. With
errno 0 the failure was invisible to error(). Report ENOENT instead.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The iterator key buffer is a flexible array member placed directly
after a bool, leaving it without natural alignment for the u32/u64
loads in next_int. Copy the key via memcpy instead of dereferencing
a misaligned pointer, which traps on strict-alignment targets.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
uc_bpf_map_arg converted integer arguments through a single static
buffer. When map set was called with both an integer key and an integer
value, the second conversion overwrote the first, so the element was
written at the wrong key. Convert into a caller-provided buffer
instead.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
uc_fn_thisval can return NULL when a method is called with a foreign or
missing this context. pin, foreach and the iterator next functions
dereferenced the result without checking it, crashing the VM.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
20a2ae469089 io: support older linux ioctls
16929698e2d3 fs: implement ioctl for macOS
395bb888bd69 io: implement ioctl for macOS
8d7d15ee1a08 compiler: add support for shorthand method declarations
7d9febd13305 nl80211: add mesh peer link enum macros to constants list
e851bb64df91 lib: avoid allocating print buffer before NULL check in uc_error_message_indent
5f3a7b87d962 compiler: prevent unbounded recompilation on failed module imports
e2493b577250 compiler: scope named function expression names to their own body
c3f0d27d812e tests: add regression test for named function expression scoping
738b55299966 vm: release owned value when property assignment fails
1ffd7c5a1011 vm: fix out-of-bounds read in single-name module import
a255256db106 vm: fix SIGFPE on INT64_MIN division and modulo by -1
3f4b313d7d78 vm: do not assign to undeclared variables in strict mode
e523682670a2 vm: release upvalue reference when resolving it on stack push
6a837090bea3 vm: release module scope reference in dynamic import
395a0a16b4f9 vm: guard error context capture against empty callframe stack
04f103bb2270 vm: respect exponent parity in integer exponentiation
bd814a4b2ae3 vm: use UC_ARRAY instead of json_type_array in object spread
5a79aa56c15e vm: release resource type prototypes after the final GC
9c5f16c8e33a lexer: do not treat /*/ as a complete block comment
a018067fd12e lexer: preserve NUL bytes in regular expression literals
65d41a1929de lexer: do not consume a sign into hexadecimal number literals
05f9bf9e5d53 lexer: fix source position of ternary question mark token
7bca646e5f88 lib: preserve embedded NUL bytes in reverse()
6fc93bf5bd95 lib: preserve embedded NUL bytes in lc() and uc()
a51f4843bce5 lib: avoid passing a signed char to isxdigit() in hex()
e8af70e4375c compiler: fix use-after-free of shorthand method name
467fb4406a47 compiler: declare leading variable in counting for loop initializer
d256e153799b rtnl: fix stack buffer overflow parsing IFLA_LINKINFO
f741ac0a144c rtnl: fix stack buffer overflow parsing RTA_MULTIPATH nexthops
c41310f7c2df rtnl: fix inverted address check in multipath nexthop parsing
Signed-off-by: Felix Fietkau <nbd@nbd.name>
- When working with deeply nested imports, compile errors led to long
error messages or complete hangs by compiling the same module over
and over again.
- Fix for a function expression scope issue.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Update to the latest Git HEAD (2026-06-21)
bcm27xx-utils:
Separate rpi-fw-crypto and piolib into separate packages
Update required dependencies
rpi-fw-crypto:
switch from GnuTLS to OpenSSL
piolib:
build as a separate lib. Update the CMakeLists.txt file
Signed-off-by: Joshua Covington <joshuacov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23703
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add a proto_dhcp_restart() handler that re-acquires the DHCP lease via a
single ubus call, releasing the previous lease and triggering a fresh
DHCPDISCOVER without bouncing the interface.
The re-acquire is implemented by sending SIGHUP to udhcpc, which releases
the current lease (if any) and immediately transitions the state machine
to INIT_SELECTING so the next main-loop iteration sends a fresh
DHCPDISCOVER. A single signal thus expresses 'release this lease and get
a new one' without exiting the client, so upstream watchdogs (e.g. a
DNS-health monitor) can request a clean re-lease without tearing down the
interface.
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
When growing the segment array in find_entry(), the memset() that zeroes
the newly allocated slots computed the destination with redundant sizeof
scaling:
memset(segments + (num_segments * sizeof(struct tffs_entry_segment)), ...)
segments is a typed pointer, so pointer arithmetic already scales by the
element size. Multiplying the offset by sizeof again advances the
destination by num_segments * sizeof^2 bytes, landing far outside the
realloc()'d buffer and zeroing unrelated heap memory whenever a TFFS
entry spans multiple segments that require array expansion.
Drop the redundant multiplication so the memset targets segments[num_segments].
This is a robustness fix for malformed/corrupt TFFS content; the parser
only reads the on-device nand-tffs MTD partition as root, so it is not
considered security relevant.
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/23763
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
changelog:
https://busybox.net/news.html
remove upstreamed patches:
001-fix-non-x86-build.patch
002-upstream-fix.hexdump.patch
003-hexdump-fix-regression-for-unit16-on-big-endian-systems.patch
see https://github.com/openwrt/openwrt/pull/17107 for updating config
Config refresh:
Refresh commands, run after busybox is first built once, slash or lack of slash at end of path matters!:
cd package/utils/busybox/config/
../convert_menuconfig.pl ../../../../build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/busybox-default/busybox-1.38.0
cd ..
./convert_defaults.pl ../../../build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/busybox-default/busybox-1.38.0/.config > Config-defaults.in
Manual edits needed after config refresh:
* Config-defaults.in: OpenWrt config symbol IPV6 logic applied to
BUSYBOX_DEFAULT_FEATURE_IPV6
* Config-defaults.in: OpenWrt config TARGET_bcm53xx logic applied to
BUSYBOX_DEFAULT_TRUNCATE (commit 547f1ec)
* Config-defaults.in: OpenWrt logic applied to
BUSYBOX_DEFAULT_LOGIN_SESSION_AS_CHILD (commit dc92917)
* Config-defaults.in: correct the default ports that get reset
BUSYBOX_DEFAULT_FEATURE_HTTPD_PORT_DEFAULT 80
BUSYBOX_DEFAULT_FEATURE_TELNETD_PORT_DEFAULT 23
* config/editors/Config.in: Add USE_GLIBC dependency to
BUSYBOX_CONFIG_FEATURE_VI_REGEX_SEARCH (commit f141090)
* config/shell/Config.in: change at "Options common to all shells" the conditional symbol
SHELL_ASH --> BUSYBOX_CONFIG_SHELL_ASH
(discussion in http://lists.openwrt.org/pipermail/openwrt-devel/2021-January/033140.html
Apparently our script does not see the hidden option while
prepending config options with "BUSYBOX_CONFIG_" which leads to a
missed dependency when the options are later evaluated.)
* Edit a few Config.in files by adding quotes to sourced items in
config/Config.in, config/networking/Config.in and config/util-linux/Config.in (commit 1da014f)
Signed-off-by: Seo Suchan <tjtncks@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23609
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Felix Fietkau
Hauke Mehrtens
Daniel Golle
Josef Schlehofer
Satoshi Ikeuchi
Joshua Covington
John Crispin
Eric Fahlgren
Vladimir Zadirei
Pavlo Samko
Carsten Schuette
Thomas Weißschuh
Seo Suchan
Rosen Penev
Marek Behún
Alexandru Ardelean