Commit Graph

24448 Commits

Author SHA1 Message Date
David Bauer ebbe3a08a7 odhcpd: update to latest HEAD
c6792ba odhcpd: fix integer underflow in dhcpv6_ia_handle_IAs
d329a15 odhcpd: fix out-of-bounds write in build_ia

Signed-off-by: David Bauer <mail@david-bauer.net>
2026-06-15 00:15:42 +02:00
Ryan Leung 1e3474ebbd uboot-envtools: mediatek_filogic: wavlink wl-wn536ax6 rev a: add config
Add config for WAVLINK WL-WN536AX6 Rev a to be able to read and write U-Boot environment variables.

Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23682
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-14 12:31:36 +02:00
Qingfang Deng 00b2bbfdbf kernel: modules: mppe: clean up
Remove kmod-crypto-arc4 and kmod-crypto-ecb from depends, as it no
longer uses skcipher API for encryption.
Remove the non-existent CONFIG_PPP_MPPE_MPPC symbol.

Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23464
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-14 12:00:01 +02:00
Qingfang Deng 0160d8b7b9 kernel: modules: slhc: remove CRC_CCITT depends
slhc does not depends on CRC_CCITT according to kernel Kconfig.

Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23464
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-14 12:00:00 +02:00
Seo Suchan 24662e811e busybox: fix signal handling in non-interactive envirement
fixes  https://github.com/openwrt/openwrt/issues/23745

upstream had bug bb_got_signal to be never cleared in noninteractive session, this fixes this while waiting for upstream merge.

the patch iself is written by  Ian Cooper <iancooper@hotmail.com>

Signed-off-by: Seo Suchan <tjtncks@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23787
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-14 11:51:50 +02:00
Qingfang Deng b25d90b7e4 ppp: update to 2.5.3
Update to 2.5.3 and use the official tarball.

Changelog: https://github.com/ppp-project/ppp/releases/tag/v2.5.3

Removed upstreamed:
- 000-pppd-session-fixed-building-with-gcc-15.patch
- 001-pppdump-fixed-building-with-gcc-15.patch
- 501-fix-memcpy-fortify.patch
- 502-remove_mru.patch

Manually rebased:
- 500-add-pptp-plugin.patch

Add a pending patch to relax the check to avoid breaking existing
configurations.

Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23540
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-13 01:34:23 +02:00
Shiji Yang b2501d1f16 uboot-mediatek: migrate memsize cmd to the upstream implementation
The upstream repository accepted a newer patch revision[1].

[1] https://github.com/u-boot/u-boot/commit/e202eca183b0f1d6747b934482dc6249abdd742b
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
2026-06-12 13:55:42 +01:00
Shiji Yang e96713670c uboot-mediatek: drop redundant TOOLS_LIBCRYPTO symbol hack
This symbol was already disabled via UBOOT_CUSTOMIZE_CONFIG.

Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
2026-06-12 13:55:41 +01:00
Shiji Yang 03accb46ef uboot-mediatek: use kernel DTC on mediatek ARM targets
The u-boot build for mediatek ARM SoCs doesn't require pylibfdt. We
can use pre-build kernel DTC to save some build time.

Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
2026-06-12 13:55:41 +01:00
Shiji Yang b6ecbb0374 uboot-mediatek: update to v2026.04
Remove upstreamed patches:
  001-pinctrl-mediatek-MT7981-fix-GPIO9-register-map.patch [1]
  010-clk-mediatek-mt7622-fix-infracfg-and-pericfg-clock-o.patch [2]

We also need to backport two new patches from v2026.07-rc2 to address
the yaml build error[3] and MT7621 boot issue[4].

[1] https://github.com/u-boot/u-boot/commit/a1d1fc8d8c8699d80e1b9ab3214752e5882d3740
[2] https://github.com/u-boot/u-boot/commit/52d84fccfd7d8b99e91a70192eec8e0379d63b4b
[3] https://github.com/u-boot/u-boot/commit/8ef8dee4f3a2b2021decfefd853dbd2a1632b77f
[4] https://github.com/u-boot/u-boot/commit/de79075f0f6b8795d1f9e30ff36435583b1a119a
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
2026-06-12 13:55:41 +01:00
Shiji Yang 3ede0b1489 uboot-mediatek: drop upstreamed patch
Patch 280 was already included in u-boot v2022.07.

Link: https://github.com/u-boot/u-boot/commit/5f2d5915f8ea4785bc2b8a26955e176a7898c15b
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Suggested-by: Daniel Golle <daniel@makrotopia.org>
2026-06-12 13:55:41 +01:00
John Audia 117f10e9a2 dnsmasq: update to 2.93
Changelog: https://github.com/imp/dnsmasq/blob/master/CHANGELOG#L1-L35

Removed upstreamed patches:
- 001-CVE-2026-2291.patch
- 002-CVE-2026-4890.dnsmasq-2.92.patch
- 003-CVE-2026-4891.patch
- 004-CVE-2026-4892.patch
- 005-CVE-2026-4893.patch
- 006-CVE-2026-5172.patch

All other patches rebased.

Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc

Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23669
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-12 09:29:47 +02:00
Shine 9ba54d2d9e scripts: dhcp/dhcpv6: handling of invalid client ID values
Verify and clean up client ID and global DUID config values before use, in
order to prevent DHCP client malfunction and loss of IPv4 and/or IPv6
connectivity.

- Accept common separators in the string (colon, dash, spaces/tabs, lf)
- Ignore invalid values (non-hex or odd-numbered length)
- Log a warning for invalid settings

The fall back mechanism is as follows:

If a (user-configured) network.<ifname>.clientid setting is found invalid,
ignore and fall back to using network.globals.dhcp_default_duid. In case
that's also invalid (e.g. has been tampered with), don't pass a client
ID to updhc/odhcpc. In that case, udhcpc/odhcpc will use their defaults,
which currently is the i/f MAC address resp. the i/f DUID-LL.

Only error handling is introduced, no behavior change for valid settings.

Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23662
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-06-11 10:40:57 +02:00
Rosen Penev f079f0252b nvram: use strdup
No need for malloc + strcpy.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22370
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-11 10:33:00 +02:00
Rosen Penev 113d3edce0 nvram: move variable assignment out of if
More readable.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22370
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-11 10:33:00 +02:00
Rosen Penev 55d146432f nvram: use flex array
Clarifies that the struct needs to be over allocated.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22370
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-11 10:32:59 +02:00
John Audia 7329e1be21 libnl: add host package
Add a host package, which is a new requirement for nfs-kernel-server.

Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/22889
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-10 21:30:40 +02:00
Paul Spooren 86184b18d2 package: nftables backport of reproducible builds patches
Building `nftables` twice results in slightly different binaries and since
it's including in the OpenWrt default firmware, breaks reproducibility of
shipped artifacts.

Enabling autoreconf, since the patches introduce a `nftvbersion.h.in` file.

This commit backports patches netfilter to fix this:

* https://git.netfilter.org/nftables/commit/?id=ca86f206c92704170a295b8dc7a41f6448835dde
* https://git.netfilter.org/nftables/commit/?id=b92571cc59ce49fdd9fe2daac9350529adfb2424
* https://git.netfilter.org/nftables/commit/?id=2a0ec8a7246e5c5eb85270e3d4de43e20a00c577

Fixes: https://github.com/openwrt/openwrt/issues/23709
Link: https://github.com/openwrt/openwrt/pull/23735
Signed-off-by: Paul Spooren <mail@aparcar.org>
2026-06-10 20:15:49 +02:00
Paul Spooren 353e23dfbc package: make APK embedded help gzip reproducible
APK compresses it's helptext using LUA and require `zlib`, which isn't
available on the Buildbots. It thens falls back to `gzip`, which embeds the
MTIME, making the binary itself unreproducible.

This commits adds a downstream patch to run `gzip` with `-n`, setting the time
to 0.

Link: https://github.com/openwrt/openwrt/pull/23736
Signed-off-by: Paul Spooren <mail@aparcar.org>
2026-06-10 20:15:15 +02:00
Rosen Penev 076eefdc2c treewide: remove usage of of_device.h
of_device.h was used only for of_match_device. That is no longer
used in most places so we can drop the extra header.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23071
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-10 09:03:11 +02:00
Thomas Richard e005805489 kernel: iio: add kmod-iio-ad7405 package
Create kernel package for the AD7405 ADC driver.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/22989
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-09 09:10:23 +02:00
Hauke Mehrtens ab253fb4bb uclient: update to Git HEAD (2026-06-07)
f227ab4f1285 uclient: fix memory leak of url when backend alloc fails
645236607a3d uclient: free proxy_url in uclient_free
53d2d11fb00d uclient-http: fix NULL deref when digest WWW-Authenticate lacks params
0ba1b8718be5 ucode: check calloc return in uc_uclient_new
5cb19466d076 uclient-fetch: reset redirect counter per request
568c447950c1 uclient-fetch: retry short writes and surface errors
4c4a61a69ac3 uclient-fetch: use strtoull to parse Content-Length
440ca260622d uclient-http: validate Content-Length and chunk sizes from the server
8658324bd234 uclient: cast to unsigned char before ctype classifications
bf403fa0f8e5 uclient-fetch: reject CR in --header values
ec47f4176b1e uclient-fetch: always allocate auth_str and free it on exit
391dacd10d31 uclient-http: fail digest auth when the cnonce cannot be randomized
ba1f4311b099 ucode: clamp read length to the size of the static buffer
0ba47f319b09 uclient-fetch: advance to the next URL between requests
9dd0055d527d uclient: initialize *port for unknown address families
f816506651d5 uclient-http: start digest nonce count at 1
9b9b2da40835 uclient-http: fix 2-byte buffer undercount in digest add_field
80fb1e5ee68b ucode: avoid double-free of SSL context on ssl_init error
d44fb561bbcf ucode: don't clear an unrelated registry slot on free
02562403d2a3 uclient-fetch: close the output file before fetching the next URL
4a63561d0012 uclient-http: initialize fd to -1 so a failed connect can't close stdin
428ae8342118 uclient: cancel pending timers in uclient_free()
ffd8db308289 uclient-fetch: guard SSL debug setup against a missing SSL context
9f4db039a263 ucode: release callback argument references
d2af92b0aad9 uclient-http: resolve redirects against the proxy target URL
5dddda023267 uclient-utils: avoid out-of-bounds pointer in get_url_filename
8507588e7ce7 uclient-http: use the proxy target URL for HTTP authentication
322c89c6ca0a uclient-http: retry 401 auth for all body-less request methods
db3bb00ddda7 uclient-http: accept unquoted digest auth parameter values
5ce9983b2a11 uclient-http: follow 303 and 308 redirects
070c868486dc uclient-fetch: finalize request on invalid 206 Content-Range
83659a5a9bc1 uclient-fetch: concatenate multiple URLs into a single -O file
43bed2753998 ucode: don't leak string references in status()/get_headers()
03b17e4fc793 uclient-fetch: attach credentials to the proxy target, not the proxy
74c07b12f7ab uclient-fetch: don't run the progress meter in spider mode
daad21fa2c17 uclient-fetch: handle init_request failure on the 204 resume retry

Link: https://github.com/openwrt/openwrt/pull/23693
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-06-09 00:57:32 +02:00
Anna Kiri a5107ad58c mtd: fix buffer leak and fd leak in mtd_dump()
Two leaks in mtd_dump():

- The buffer allocated with malloc(erasesize) is never freed before
  returning, leaking erasesize bytes on every call.
- The pre-existing malloc-NULL early return path also leaked the just-
  opened fd by returning directly instead of going through cleanup.

Initialize buf to NULL, route the malloc-NULL case through the
existing 'out:' label, and add free(buf) on the cleanup path so both
fd and buf are released consistently on every exit.

Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23706
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-08 16:18:23 +02:00
Anna Kiri 2818ac5ccd mtd: check malloc() return value in mtd_check()
After malloc(erasesize) in mtd_check(), the result was never checked
for NULL. On allocation failure, the buf pointer remained NULL and
would later be used in image_check() via read(imagefd, buf + buflen,
...), causing a NULL pointer dereference.

Add a NULL check after the allocation and return early. The early
return path also closes the just-opened fd and frees the strdup'd
colon-separated device-list copy to avoid leaks.

Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23705
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-08 16:17:42 +02:00
Anna Kiri 2f809f9cff mtd: check return values of lseek() and write() in mtd_write_buffer()
Two ignored return values in mtd_write_buffer() caused silent failures:

- lseek() return value was ignored. A failed seek (e.g. EBADF, ESPIPE)
  followed by write() would silently write at the wrong offset.
- write() return value was ignored, silently discarding write errors.
  This could lead to data corruption on the MTD device without any
  indication.

Check both return values, report errors to stderr and return -1 on
failure.

Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23552
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-08 16:17:02 +02:00
Tim Small e122d49577 linux-firmware: improve firmware package descriptions
Improve some descriptions so that they make the purpose of the
particular firmware package clearer to the user (e.g. as viewed in
verbose package listings).

Signed-off-by: Tim Small <tim@seoss.co.uk>
Link: https://github.com/openwrt/openwrt/pull/23688
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-06-08 14:44:12 +02:00
Andre Heider 1888d5060a uboot-omap: update to 2024.07
This is the last version supporting the boards omap3_beagle and omap4_panda.

Because we use a boot script we need to enable CONFIG_LEGACY_IMAGE_FORMAT.

Signed-off-by: Andre Heider <a.heider@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22728
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-07 11:45:36 +02:00
Florian Maurer 60d68afbb9 ramips: enable fw_printenv for D-Link COVR-X1860 A1
Vendor U-Boot stores its environment at offset 0x2000 inside the
"config" partition (size 0x4000). The offset is not erase-block
aligned, so the fw_env tool's alignment check rejects the natural
secsize=0x20000. Declaring secsize=0x2000 passes the check, lets
fw_printenv read the real env (factory_mac, hw_version,
bundle_number, ...), and causes fw_setenv to fail cleanly on erase
rather than corrupting anything (the kernel rejects sub-erase-block
MEMERASE).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Florian Maurer <fmaurer@disroot.org>
Link: https://github.com/openwrt/openwrt/pull/23192
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-07 11:29:12 +02:00
Fengyu Wu 8aaa8d4013 ca-certificates: update to 20260601
changelog: https://salsa.debian.org/debian/ca-certificates/-/blob/master/debian/changelog

  * Remove ca-certificates-local example (closes: #988912, #1127101).
  * Update Mozilla certificate authority bundle to version 2.86
    The following certificate authority was added (+):
    + e-Szigno TLS Root CA 2023
    The following certificate authorities were removed (-):
    - QuoVadis Root CA 2
    - QuoVadis Root CA 3
    - DigiCert Assured ID Root CA
    - DigiCert Global Root CA
    - DigiCert High Assurance EV Root CA
    - SwissSign Gold CA - G2
    - SecureTrust CA
    - Secure Global CA
    - COMODO Certification Authority
    - Certigna
    - certSIGN ROOT CA
    - AffirmTrust Commercial
    - AffirmTrust Networking
    - AffirmTrust Premium
    - AffirmTrust Premium ECC
    - TeliaSonera Root CA v1
    - Entrust Root Certification Authority - G2
    - Entrust Root Certification Authority - EC1
    - Trustwave Global Certification Authority
    - Trustwave Global ECC P256 Certification Authority
    - Trustwave Global ECC P384 Certification Authority
    - GLOBALTRUST 2020
    - GTS Root R2
    - FIRMAPROFESIONAL CA ROOT-A WEB
    The following certificate authority was renamed (~):
    ~ "OISTE Server Root RSA G1" (removed leading space)

Signed-off-by: Fengyu Wu <saldry@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23675
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-07 10:47:20 +02:00
Florian Eckert ca54521988 base-files: move config_generate to preinit
The mutex file via '/tmp/.config_pending' should prevent the command
'/sbin/wifi config' from being called in the ieee80211 hotplug when loading
the kernel modules [1]. Since the file '/etc/board.json' does not yet exist
and could be incomplete.

The '/etc/board.json' file is modified in the '/sbin/wifi config' script.
This is only generated during the first boot when '/bin/config_generate' is
called.

This whole handling is unclean. Therefore the creation of the default
configuration '/etc/config/network', '/etc/config/system' and
'/etc/board.json' via '/sbin/config_generate' is moved to the preinint
after the rootfile system has been mounted

The advantage now is that on an ieee80211 hotplug event, the
'/etc/board.json' is already present which simplifies the whole thing.

[1] https://github.com/openwrt/openwrt/blob/main/package/network/config/wifi-scripts/files/etc/hotplug.d/ieee80211/10-wifi-detect

Fixes: b993a00b82 ("base-files: fix duplicate wifi radio sections when using phy renaming")

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-06-05 20:53:18 +02:00
Mieczyslaw Nalewaj 2aa1185fb0 leds: add "network" LED trigger (lan/wan/wlan)
LED trigger for network interfaces.

 - Aggregated per-family (lan/wan/wlan).
 - Family and flags are taken from device tree properties:
   - "family" : simple family string "lan" | "wan" | "wlan"
   - "mode"   : any combination of "link", "tx", "rx" flags
  Priority/combination:
   * If "mode" present: flags come from "mode" and take precedence.
     Family is taken from "family" if present, otherwise from the LED name.
   * If only "family" present: use its family and default flags = link+tx+rx.
   * If neither present: fall back to LED device name parsing.

 - Suffix "-online" is valid ONLY in the LED name (label),
   e.g. "green:wlan-online". It indicates the online variant but is applied
   only when DT "mode" is absent.

Behaviour:
 - wlan (normal): blink/solid driven by throughput table
 - lan/wan (normal): one-shot blink on TX/RX packet change
 - *-online variants: steady ON while any interface of the family has carrier

 Interfaces are auto-tracked by name match (lan0, wan1, wlan2, phy0, wl1,
 ath0, ra0...). Up to MAX_IFACES (16) interfaces per family

This trigger is intended for board/device authors and drivers to provide simple
network-activity LED behaviour without per-interface wiring in userspace.

Refresh bcm27xx patches in the same commit to account for line shifts in
drivers/leds/trigger/Kconfig and Makefile, ensuring clean applies for
bisectability.

Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/19903
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-06-05 20:30:34 +02:00
Hafiz Zafran 848c54b5f4 wireless-regdb: update to version 2026.05.30
Change-log since version 2026.03.18, retrieved from the wireless-regdb mailing lists:
  wireless-regdb: update regulatory database based on preceding changes
  wireless-regdb: Update regulatory info for Brunei Darussalam (BN) for 2022
  wireless-regdb: allow 320MHz channel width for Russia
  wireless-regdb: Update 6 GHz rules for Hong Kong (HK)
  wireless-regdb: Update 5/6 GHz power rules for Russia (RU)
  wireless-regdb: Fix 60 GHz power unit for Ukraine (UA)
  wireless-regdb: Update 6 GHz rules for South Africa (ZA)
  wireless-regdb: Update 6 GHz rules for South Korea (KR)
  wireless-regdb: Update regulatory rules for Sri Lanka (LK)
  wireless-regdb: Add regulatory info for CEPT countries FO, GI, IM, SM and VA listed by WiFi Alliance

Signed-off-by: Hafiz Zafran <hfzz7@duck.com>
Link: https://github.com/openwrt/openwrt/pull/23594
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-06-05 16:50:05 +02:00
Hauke Mehrtens f15ed4610b odhcp6c: update to Git HEAD (2026-06-04)
08bd058e0246 ra: skip malformed options instead of aborting RA processing
2550a1dd276e dhcpv6: fix inverted Authentication option validation in Reply
496e55d43de6 dhcpv6: use host-order option length in Authentication validation
b6f0c70f5fc2 dhcpv6: fix out-of-bounds end pointer when parsing IA in Advertise
92fd11cd9547 dhcpv6: fix OOB read and 1-byte heap overflow on captive-portal option
0dab8feec55a ra: fix OOB read on captive-portal option comparison
a4d6a3232c24 script: fix string_to_env writing garbage and reading past input
2521bf732b9f script: avoid kill(0) when SIGCHLD races script_call
56cec7a15816 odhcp6c: drop stale hash_ifname() declaration
49d9c0112bb8 odhcp6c: propagate allocation failure from insert_state
4bd976fd60c0 dhcpv6: ensure hostname buffer is NUL-terminated for dn_comp
6d12865fb89c ubus: validate element type when parsing reconfigure_dhcp opt_send
01130f80338a script: handle allocation failures in env helpers
0a19052dc9fb odhcp6c: refuse to follow symlinks when writing pidfile
d6c2fbdc255c odhcp6c: skip malformed /proc/net/if_inet6 entries
b6add6c0e30e dhcpv6: avoid signed-shift undefined behaviour in IAID derivation
ce52fe118b13 ubus: clear cached object type id on disconnect
91f88c694f6f config: stop mutating caller-supplied buffers in send-options parser
c938c168cbef script: handle fork() failure when launching state script
1546a48255b2 ubus: avoid out-of-bounds read when serializing captive-portal URI
3270f081039d all: fix inverted captive-portal URI equality check (RFC 8910 §3)
e9a9e9d45f38 odhcp6c: bound the address length when parsing the -P argument
5ad94c86e864 script: walk entries with odhcp6c_next_entry in entry_to_env
df4f199c02fc ubus: walk entries correctly and don't leak an open table in entry_to_blob
6c1c4c48d4a2 ubus: don't leak an open table on malformed S46 rule/bind in s46_to_blob
1797d2bca3c0 odhcp6c: remove pidfile on exit
86a6665e4bb0 ra: clear captive-portal state when router signals unrestricted URI
0a4e51db30d5 dhcpv6: require known SERVERID when validating Reconfigure
afc3c8534864 dhcpv6: reject Reconfigure with malformed or duplicate Message option
df27a49c98d8 dhcpv6: enforce monotonic replay counter on Reconfigure RKAP
9177f236c2d7 odhcp6c: do not treat DHCPv6 option type 0 as end-of-list
daf4ec3054e7 example: write all DNS servers to resolv.conf

Link: https://github.com/openwrt/openwrt/pull/23652
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-06-05 16:37:16 +02:00
Hauke Mehrtens 1fecb61b71 odhcpd: update to Git HEAD (2026-06-04)
b3e65ef700e6 config: add dhcpv6_relay_servers
e432dd62c288 dhcpv6: relay to dhcpv6_relay_server server(s)
ed38cffa927d dhcpv6: fix out-of-bounds read in self-loop detection memcmp
ee0a11f40fa4 dhcpv6: bound nested-relay recursion to HOP_COUNT_LIMIT
d89caa59c005 dhcpv6: reject undersized encapsulated DHCPv4 messages in 4o6 path
db034cfd5eab dhcpv4: honor Pad/End option encoding when iterating options
a6fe4633bb69 ubus: drop spurious ntohl() of DHCPv4 lease IAID
19bf3b73580b dhcpv6-ia: avoid undefined shifts in assign_pd()
a212daeace27 netlink: avoid 32-bit-wide shift when computing /0 IPv4 netmask
374d8174207d dhcpv4: never return NULL from dhcpv4_msg_to_string()
0eade3d4b7a3 ndp: enforce RFC4861 §7.1.1 hop-limit and ICMP-code checks on NS
cc04882b3fac dhcpv6: validate minimum length in relay_client_request()
a14884ea7d01 config: guard captive_portal_uri parsing against strdup() failure
7c834a54ae6d dhcpv4: copy ifname into arpreq without reading past the source
2b1ade346f1d statefiles: skip dn_expand() when no search domain is configured
fa270221504c dhcpv6: avoid unaligned uint16_t reads in ORO option parsing
f3743a862b36 config: invert ipv6_pxe_from_uci() return value
3e1dd3b16c9a dhcpv6-pxe: free previous default entry on replacement
78aa06a30da8 statefiles: clean up tmpfile error path
f3fdcf4d3fe2 dhcpv6: validate length and alignment when reading CLIENT_ARCH option
f2275efc72a8 dhcpv6-ia: validate IA_NA/IA_PD option size before reading header
461043731085 config: bound DNR 'mandatory' SvcParam key count
d119e1abc35f router: restore upstream DNS/MTU between relayed RAs
60f488192d5d router: keep RA DNS option lengths within the uint8 length field
c2f94ee5c8e7 dhcpv4: pass &dest.sin_addr to inet_ntop() when logging
5b1e3befb0b2 dhcpv6: validate rewritten RELAY_MSG length in update_nested_message()
1782f3f2aad2 dhcpv6-ia: signal buffer-full from build_ia() IA_ADDR branch

Link: https://github.com/openwrt/openwrt/pull/23651
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-06-05 16:36:15 +02:00
Hauke Mehrtens b49a369fa9 rpcd: update to Git HEAD (2026-06-04)
69b62b1990bc rpc-sys: packagelist: increase input buffer size
e655a0d69492 exec: defer async reply teardown to avoid use-after-free
5b078674a592 optimize by reusing timeout member
d005c885dbe4 session: clamp uloop timeout to avoid int overflow
a545f008da91 ucode: add request.defer() for async method handling
ab6549a99c7c file: avoid sending uninitialized stack memory for broken symlinks
7af2dd81cd53 main: prevent integer overflow when parsing -t timeout argument
680705e4b76d plugin: use snprintf in ubus lookup callback to prevent buffer overflow
fb0302dc0e51 session: detect short read of /dev/urandom in rpc_random()
dc091afa5860 rpc-sys: packagelist: check calloc() result for world array
4fbd48515d6a rpc-sys: packagelist: avoid size_t underflow when stripping ABI version
46fce7d5efc9 ucode: fix off-by-one truncation of generated ubus object type name
26dba5206e17 exec: prevent double close() of exec pipe descriptors
af5d6f431186 uci: prevent integer overflow of client supplied apply timeout
d06d2a81dc29 rc: fix memory leak of list request context
0de666811559 rc: copy list "name" filter to avoid use-after-free
75470f4b5124 rc: use a per-request blob_buf for the list reply
3037a0e36856 treat exec failures in forked children with _exit() instead of return
f5ffec54d7c7 rc: reap killed child on list "running" check timeout
fd4fcdeb186b rpc-sys: packagelist: close status file on world parsing error paths
e22aea1a51df rpc-sys: packagelist: read world file instead of mmap to avoid SIGBUS
79c8087c8e8e file: avoid zero-length b64_decode() on empty write data
cd1d9588da63 ucode: bound recursion when converting blob arguments to ucode values
2decaec3ef1b iwinfo: fix error handling and backend leak in survey
28faf6403792 cast char arguments to unsigned char for ctype.h functions

Link: https://github.com/openwrt/openwrt/pull/23650
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-06-05 16:35:07 +02:00
Roland Reinl 9f7d9aa167 ipq40xx: add support for Linksys MR9000
This pull request is based on
- the discussions in https://forum.openwrt.org/t/support-for-the-linksys-mr9000

Device Specs:
- Router is similar to EA8300 but with 512MB RAM and changed GPIOs
- IPQ4019
- Quad Core CPU
- 512 MB RAM
- 256 MB FLASH
- 4 LAN ports, 1 WAN port
- 1x2.4GHz (802.11n) and 2x5GHz (802.11c) wifi
- 3 LEDs (Red, blue, green) which are routed to one indicator at the top of the case
- 2 buttons (Reset, WPS)

Disassembling the device:
- There are 4 T10 screws at the bottom of the device which must be removed
- All 4 screws are located under the rubber feet

Serial interface:
- The serial interface is already populated on the device with a 5-pin header
- Pinout from front to back: 1:GND, 2: unknown, 3: RX, 4: TX, 5: VCC
- Settings: 115200, 8N1

MAC address layout:
- Same as on MR8300
  - MAC address is stored in the "devinfo" partition (entry "hw_mac_addr")
  - The MAC address on the label is identical with the one in the devinfo partition
  - The MAC address on the label is the WAN MAC address
  - LAN MAC address is the one from the label + 1
  - Wifi (2.4GHz) MAC is the one from the label + 2
  - Wifi (1st 5GHz) MAC is the one from the label + 3
  - Wifi (2nd 5GHz) MAC is the one from the label + 4

Migrating to OpenWrt requires multiple steps:
- Load and boot the initramfs image
- Adapt U-Boot settings to support bigger kernels
- Flash the sysupgrade image

Load and boot initramfs:
- Connect serial interface
- Set up a TFTP server on IP 192.168.1.254
- Copy openwrt-ipq40xx-generic-linksys_mr9000-initramfs-zImage.itb to TFTP server
- Rename file to C0A80101.img
- Boot up the device and stop in U-Boot
- Run the following U-Boot commands after a link has been established:
  tftp
  bootm
- Initramfs image is started now.

Adapt U-Boot settings to support bigger kernels:
- Run "fw_printenv" in the initramfs image  after booting
- There should be an entry kernsize=300000 which indicates the maximum size for the kernel is 3MB
- Execute "fw_setenv kernsize 500000" to increase the max kernel size to 5MB
- Check that the change are applied with "fw_printenv"

Flash the sysupgrade image:
- Default sysupgrade routine either with a initramfs image containing LuCI or via command line.

Revert back to OEM firmware:
- Flash the OEM firmware via sysupgrade
- Forced update is required

Signed-off-by: Karsten Rehn <rekados@posteo.de>
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22744
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-06-04 22:49:38 +02:00
Michael Pfeifroth 75e7ea1b93 ath11k-firmware: move Download eval to top level
Move the $(eval $(call Download,ath11k-legacy-firmware)) from inside
Build/Prepare to the top level, right after the Download definition.

When the eval is inside Build/Prepare, it only runs at recipe execution
time (during compilation). This makes the legacy firmware source
invisible to 'make download', which only evaluates Download definitions
at Makefile parse time. As a result, offline builds fail because the
source was never fetched during the download phase.

This is consistent with how ath10k-ct-firmware handles multiple
Download definitions (all at top level).

Signed-off-by: Michael Pfeifroth <michael.pfeifroth@westermo.com>
Link: https://github.com/openwrt/openwrt/pull/23628
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-06-04 22:40:44 +02:00
Robert Marko 15fb4966a5 qca-ssdk: update to Git HEAD (2026-06-04)
c3bf07a66f7e make: honor SOURCE_DATE_EPOCH in BUILD_DATE
bb4f3f0b947e Revert "MP: fix uniphy reset in phy to phy link scenario"

Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-06-04 22:21:21 +02:00
Seo Suchan e288f421f8 libmd: update to 1.2.0
this brings sha3 and black support into it.

90c4f43 Release libmd 1.2.0
fc4f75a build: Set TAR_OPTIONS to avoid leaking maintainer information on dist
36d829e build: Request tar-ustar format for distribution
c1b3bff Remove spurious blank lines at the beginning of functions
0ae00e2 Fix and hook SHA3 and SHAKE support
2c0d2f0 Add internal endian conversion functions support
3bb8921 Add internal explicit_bzero() support
4442c4b Add SHA3 and SHAKE support
7b740a6 doc: Move derived code attribution to a Comment field
bb5a08e doc: Remove redundant «Copyright ©» prefix from Copyright field in COPYING
9b03479 build: Add Maintainer and License fields to the .pc file
8fffa5f doc: Remove «All rights reserved» from COPYING
d5b8e85 build: Rename LIBMD_ABI to SOVERSION
ea62163 build: Add a coverage regex to the CI job
7e32142 man: Sync SHA2 changes from OpenBSD
488d585 build: Add a new vpath-tests CI test
b49ee25 build: Refactor autogen call into before_script
137dd4e build: Fix out-of-tree build

Signed-off-by: Seo Suchan <tjtncks@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23643
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-04 09:59:32 +02:00
Seo Suchan 43ee70c53f libxml2: update to 2.15.3
Update to latest release. new maintainer upstream didn't make changelog, so see https://gitlab.gnome.org/GNOME/libxml2/-/commits/2.15?ref_type=heads for commits betwwen 2.15.1 and 2.15.3

Signed-off-by: Seo Suchan <tjtncks@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23642
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-04 09:49:44 +02:00
Shiji Yang c82f2724f5 uboot-imx: do not build efimkcapsule tool
This tool requires gnutls. In fact, we do not have to build it.
Fix build error:

tools/mkeficapsule.c:20:10: fatal error: gnutls/gnutls.h: No such file or directory
   20 | #include <gnutls/gnutls.h>
      |          ^~~~~~~~~~~~~~~~~

Fixes: 158651a6d7 ("uboot-imx: bump to 2026.04 release")
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23635
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-04 00:47:20 +02:00
Pavlo Samko 84f4f77920 nilfs-utils: update to 2.3.0
Changelog: https://nilfs.sourceforge.io/download/ChangeLog-utils-v2

Signed-off-by: Pavlo Samko <bulldozerbsg@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21932
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-03 13:46:09 +02:00
John Crispin 5526366fea unetd: cli: convey network name from inviter to joiner
The unet CLI's join handler used the joiner's --network value as the
local network name, so an unspecified --network fell back to the
literal 'unet'. The inviter typically uses a different name (e.g.
ucoord_<venue>), so the two sides ended up keyed differently and any
upper layer subscribing to the network-named unetmsg channel never
saw each other.

The inviter now passes enroll_info={ network } to enroll_start so
the inviter's network name rides along in enroll_meta. The joiner
prefers data.enroll_meta?.network when present, falling back to its
own --network value for backwards compatibility with older inviters.

Signed-off-by: John Crispin <john@phrozen.org>
2026-06-03 11:19:06 +00:00
Felix Fietkau 4b7d5538bc procd: update to Git HEAD (2026-05-22)
ac5cc72f6cfa jail: mount ucode related bits into netifd jail
81119d3f249d instance: disable console logging
8013c0cd2755 jail: mount tools used by dhcp.sh in the netifd jail
876981d0516d jail: fix reading the oci device gid value
c92dbcd460d7 jail: make /dev/tty accessible by others
74bfbee8adb8 service: fix calloc_a argument

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-03 11:18:29 +00:00
Felix Fietkau 76e6216c8a ucode: update to Git HEAD (2026-06-03)
1ac496a91a30 math: min and max
4c917958038d math: clamp
c6404b6af75c math: sign functions
597b17d0edea math: copysign
9747c8bbfa27 math: floor
933b11802060 math: ceil
46581cf13149 math: round
4aee92d5aa89 math: trunc
c8f71433a3d6 math: log functions
840aa6e61196 math: Infinity handling note
990558c2a027 math: isinf
c3e76e45fdad math: tan
08c6ef98fa2f math: acos, asin, atan
21a0f37d4c7c math: cosh, sinh, tanh
28ec6e4466b5 math: cbrt, hypot
fb2fc094875c math: expm1, log1p
1a911dbc72b0 math: jsdoc fixes
7b3b15dc7d25 math: add double/int output toggle flag to floor/ceil/round/trunc
7424c3bd14e0 make: improve make (install) on macOS
965d76557dee types: release previous prototype reference in ucv_prototype_set
b702323ec137 uloop: unregister task output fd from uloop before closing it
106b1179765a uloop: clear resource values when releasing callback resources
acc70db934fc ubus: clear resource values when releasing connection/object resources
9d7ade9e4c68 ubus: prevent UAF when channel disconnect_cb triggers re-entrant disconnect

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-06-03 13:13:17 +02:00
Anna Kiri 2b4e46345f mtd: imagetag: remove unused imagestart variable
The imagestart variable was assigned sizeof(tag) (which incorrectly
computed the pointer size rather than the struct size), but was never
actually read after the assignment in either trx_fixup() or
mtd_fixtrx(). The CRC calculations that follow use
offsetof(struct bcm_tag, header_crc) directly.

Remove the dead variable and its assignments entirely rather than fixing
the sizeof expression. No functional change.

Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23546
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-02 21:32:27 +02:00
Seo Suchan fe04581880 busybox: update to 1.38.0
changelog:
https://busybox.net/news.html
remove upstreamed patches:
001-fix-non-x86-build.patch
002-upstream-fix.hexdump.patch
003-hexdump-fix-regression-for-unit16-on-big-endian-systems.patch

see https://github.com/openwrt/openwrt/pull/17107 for updating config

Config refresh:

Refresh commands, run after busybox is first built once, slash or lack of slash at end of path matters!:

cd package/utils/busybox/config/
../convert_menuconfig.pl ../../../../build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/busybox-default/busybox-1.38.0
cd ..
./convert_defaults.pl ../../../build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/busybox-default/busybox-1.38.0/.config > Config-defaults.in

Manual edits needed after config refresh:

* Config-defaults.in: OpenWrt config symbol IPV6 logic applied to
  BUSYBOX_DEFAULT_FEATURE_IPV6

* Config-defaults.in: OpenWrt config TARGET_bcm53xx logic applied to
  BUSYBOX_DEFAULT_TRUNCATE (commit 547f1ec)

* Config-defaults.in: OpenWrt logic applied to
  BUSYBOX_DEFAULT_LOGIN_SESSION_AS_CHILD (commit dc92917)

* Config-defaults.in: correct the default ports that get reset
  BUSYBOX_DEFAULT_FEATURE_HTTPD_PORT_DEFAULT    80
  BUSYBOX_DEFAULT_FEATURE_TELNETD_PORT_DEFAULT  23

* config/editors/Config.in: Add USE_GLIBC dependency to
  BUSYBOX_CONFIG_FEATURE_VI_REGEX_SEARCH (commit f141090)

* config/shell/Config.in: change at "Options common to all shells" the conditional symbol
  SHELL_ASH --> BUSYBOX_CONFIG_SHELL_ASH
  (discussion in http://lists.openwrt.org/pipermail/openwrt-devel/2021-January/033140.html
  Apparently our script does not see the hidden option while
  prepending config options with "BUSYBOX_CONFIG_" which leads to a
  missed dependency when the options are later evaluated.)

* Edit a few Config.in files by adding quotes to sourced items in
  config/Config.in, config/networking/Config.in and config/util-linux/Config.in (commit 1da014f)

Signed-off-by: Seo Suchan <tjtncks@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23609
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-02 20:43:53 +02:00
Marek Behún 2f93ba1b5b omnia-mcutool: Bump version to 0.3-rc4
Bump version to 0.3-rc4, which fixes building with C23.

Signed-off-by: Marek Behún <kabel@kernel.org>
Link: https://github.com/openwrt/openwrt/pull/23620
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-06-02 13:37:37 +02:00
Martin Schiller a35efecca8 kernel/modules: add RV3028 I2C RTC kernel module support
Add support for the Micro Crystal RV3028 I2C real-time clock chip.

Tested on a Kontron OSM-S/BL i.MX8MP eval board.

Signed-off-by: Martin Schiller <ms@dev.tdt.de>
2026-06-01 17:49:36 +02:00
Martin Schiller 1076584bc3 uboot-imx: add support for Kontron OSM-S/BL i.MX8MP
Add mainline U-Boot flavour for Kontron OSM-S/BL i.MX8MP board.

Signed-off-by: Martin Schiller <ms@dev.tdt.de>
2026-06-01 17:49:36 +02:00