It seems that GCC 15.3 has added additional OOB checks for ARCH arm32.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23774
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
void pointer casting like this is unnecessary.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24177
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This must be some older compiler and kernel warning.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24177
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Now that all targets using NSS-DP and SSDK have been converted, we can
finally drop these.
Signed-off-by: Robert Marko <robimarko@gmail.com>Link: https://github.com/openwrt/openwrt/pull/22381
Signed-off-by: Robert Marko <robimarko@gmail.com>
Using UUID-based client IDs for DHCPv4/DHCPv6 with no option of falling
back to hardware IDs (ie. MAC-address or DUID-LL) resp. none at all (IPv4),
is causing regressions in some setups.
Introduce a new setting to override the preferred client ID to be used for
DHCPv4/DHCPv6 on a per-interface basis:
network.<ifname>.sendclientid='auto|global|hardware|none'
- "auto" (default if empty or not present) uses any explicitly defined
client ID, or falls back to the global DUID and finally to the DUID-LL
resp. MAC address (ie. identical to before this commit).
- "global" uses the global default DUID, if configured, for DHCPv4 and
DHCPv6 requests, even if a client ID is explicitly specified for the i/f
- "hardware" will not pass a client ID to udhcpc/odhcp6c, even if a global
default DUID is configured or an explicit client ID specified, resulting
in the i/f MAC address resp. type 3 DUID(-LL) to be used
- "none" (IPv4 only) will not add an option tag 61 to DHCPv4 requests at
all.
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/24107
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
struct gpio_keys_button has an unsigned int for its irq field. A signed
one is needed for fwnode_irq_get. Handle it before passing it to the
button member.
Fixes: 79b9a36959 ("gpio-button-hotplug: use device and fwnode")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24174
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Changes:
* removed upstreamed patches,
* refresh patches,
* add en7523/an7581/an7583 pinctrl support
* add basic PCS support for an7583
* add an7583 specific mdio bus support
Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
Link: https://github.com/openwrt/openwrt/pull/24165
Signed-off-by: Robert Marko <robimarko@gmail.com>
Update to the latest stable version. Also remove obsolete symbol
PKG_CONFIG_SYSROOT_DIR[1].
[1] 8ef8dee4f3
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/24123
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Upstream prefers these instead of OF functions.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24120
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This fixes a simple logic error of the macaddr lookup in utils.uc.
It read from the wrong sysfs file and compared it without trimming.
Signed-off-by: Harin Lee <me@harin.net>
Link: https://github.com/openwrt/openwrt/pull/24070
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
c0abf80df1c1 config: fix NULL pointer dereference when typed device creation fails
4a19d2568c0b device: migrate alias users when replacing a device
e2f28e5ec0a8 interface: defer interface removal to avoid use-after-free
34760f2aec34 interface: fix alias handling when the parent interface does not exist
0bab70f05296 bridge: cancel the member retry timer on teardown and free
a562a8eca41d bridge: fix memory leak of hotplug member vlan ranges
4c7b3f7caf88 proto-ext: clear the proto task kill flag when starting a new task
8a38aecd84de system-linux: include the priority when deleting ip rules
844c0fe78eed device: remove unused __devlock counter
dbdf0d0e5830 system-linux: initialise FMR prefix lengths before parsing
fb456b5e65df iprule: keep unchanged rules installed on reload
7d8f9900c273 vrf: sync changes with bonding.c/bridge.c
f0db4101c1ea vrf: remove incorrect IPv6 disable on VRF ports
9dfea5b242b2 vrf: remove unused vrf_empty field
6f6bf8bec23b vrf: rename vrf_state_type to vrf_device_type
37c770a6b86d vrf: add license header
35171a157516 system-linux: fix system_vrf_addif retry loop
6cbcc107e984 bonding: cancel the port retry timer on teardown and free
787848926a19 extdev: fix invalid frees and unwind order on handler registration failure
2a8ed44dc613 interface-ip: fix address family check when removing offlink null-routes
576e1f3de154 interface-ip: preserve subnet route state when keeping an address
10f25df801c1 bridge: fix parsing of the stp_kernel option
3132f007ebf0 bonding: skip present toggle in bonding_free_port() when device is active
24950e564fff bonding: fix stale primary_port pointer after port enable failure
4c8374dc0f79 interface: fix zone string leak on config reload
65e96ba990b2 ubus: fix netns fd leak in netns_updown error path
fa9ee5efd4b2 utils: fix out-of-bounds fallback in uci_get_validate_string
6ccbf71d7a97 utils: fix false positives and dead branch in check_pid_path
3ec503831ebd iprule: default src/dest masks to the host prefix length
9a520edc3be4 system-linux: implement the neighbour flush in system_if_clear_entries
62b6256bf95c system-linux: fix vxlan link creation with gbp disabled
6c0a837f10fc system-linux: fix rtnl socket desync when clearing kernel entries
d1a0ceb71991 macvlan: fix NULL dereference when dumping a device without parent
937c3aa801af vlandev: fix NULL dereference when dumping a device without parent
89025924ba51 vlan: fix device chain lookup for names with a non-vlan separator
c961d1e16814 vlan: fix rejection of maximum length vlan device names
1cbf89e3108c vlandev: fix type of vlan alias lookup result
08a4a7b33056 proto-ext: fix stuck state machine when the setup script fails to launch
c8c8b79a5bcb proto-ext: queue restart requests while a script task is running
0c990ce2ca09 ubus: report failure from the interface restart method
e6af4a5bf6f2 interface: fix undefined shift when computing the ip6hint mask
67f8107fb21c interface-ip: fix undefined shifts in prefix assignment arithmetic
903bd1c3daa5 interface-ip: fix out-of-bounds access in clear_if_addr for zero masks
56ffff895672 system-linux: fix ethtool feature block count
bbc818a6527f system-linux: fix EINTR retry in read_string_file
9c2970832d8f system-linux: fix off-by-one in vxlan VNI validation
c5b5d54ce2f9 bridge: validate the upper bound of hotplug vlan ranges
1595cd7b25da main: handle execvp failure on restart
24b2703171fe handler: guard against zero-length lines when parsing handler dumps
c2b760fc7cc5 handler: free glob results in netifd_init_extdev_handlers
60e3243bdcd8 handler: reject negative parameter types in handler descriptions
274b1594e0ca interface-ip: tear down the ULA prefix on an invalid prefix length
e692ec77d51b interface-ip: expire config routes with a valid option
684dc2d50902 device: fix error handling in device_create
c02101330247 interface: fully clean up partially constructed interfaces on free
1db485d6a39c handler: clear parameter list pointers on parse failure
5694c49f964f system-linux: stop receive loops on netlink errors
d108c504df4e system-linux: fix bogus master ifindex result for non-DSA devices
d6f609170f1e system-linux: fix swapped rx/tx in negotiated pause reporting
8a19380586ef extdev: fix NULL pointer dereference when parsing stats params
a1cc96488c02 extdev: fix memory leaks on device free
d2085a59abbc extdev: fix bridge config leak on no-op reload
4d1a4ae487b6 ucode: close pipe read end in spawned child processes
6c407410259c config: validate bridge vlan port and alias attributes
8afd58bead2f bridge: fix pvid clearing leaking to other vlan members
e8edb3f78652 bonding: fix port failure accounting in bonding_enable_port
6088f7b3b9d7 system-dummy: fix metric clobbering device name in route debug output
Signed-off-by: Felix Fietkau <nbd@nbd.name>
e2fa9dcf67a8 uloop: fix use-after-free when cancelling interval timers
329d823294a0 uloop: keep signal handler installed while other watchers remain
3362b39a1c03 kvlist: fix use-after-free when updating an entry in place
b33f74af02b2 list: define list_prev_entry used by list_for_each_entry_continue_reverse
65f62583c236 udebug: check hdr before dereferencing it in set_start_time
9d7fb82530b5 udebug: reject non-power-of-two ring metadata from a peer
2e0e7f0f4d38 udebug: verify shared-memory fd size before mapping
dda814a9750a usock: retry poll() on EINTR in usock_wait_ready()
72e2b396bd9a ustream: reset byte and buffer counters when freeing buffers
be161d0320da utils: guard cbuf_order against zero and one
08081477ad6c uloop: fix kevent() eventlist size argument in register_kevent
0c3eec553828 uloop: fix kqueue timer interval arithmetic
a9ab90bd1d5d uloop: fix use-after-free in signal_consume when a callback deletes a watcher
c08a4ab53129 uloop: fix use-after-free in uloop_handle_processes when a callback deletes a process
7677b7a4f3a4 vlist: pass the tree as comparator context in VLIST_TREE_INIT
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Currently, trying to start a 5GHz radio on 8devices Kiwi will fail as
despite the phy listing the 5GHz channels in iw phy dump, no radio actually
claims the 5GHz range.
This is because driver assumes that if radio supports 6GHz then it cannot
be used for 5Ghz, this is however not correct for wideband radios.
So, similar to the 103-wifi-ath12k-fix-5GHz-operation-on-wideband-QCN.patch
patch ath12k_regd_update() so that 5Ghz range is listed as well.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Link: https://github.com/openwrt/openwrt/pull/24106
Signed-off-by: Robert Marko <robimarko@gmail.com>
- When working with deeply nested imports, compile errors led to long
error messages or complete hangs by compiling the same module over
and over again.
- Fix for a function expression scope issue.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Replace sprintf() calls with snprintf() to bound writes into the
fixed-size filename[] and slnk[] stack buffers. While the current
inputs are hash-pinned firmware images, snprintf provides defense
in depth against buffer overflows if the format string output ever
exceeds buffer capacity.
Signed-off-by: OrbisAI Security <mediratta01.pally@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23172
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Update to Git HEAD as of 2026-05-21
Signed-off-by: Joshua Covington <joshuacov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23703
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Update to the latest Git HEAD (2026-06-21)
bcm27xx-utils:
Separate rpi-fw-crypto and piolib into separate packages
Update required dependencies
rpi-fw-crypto:
switch from GnuTLS to OpenSSL
piolib:
build as a separate lib. Update the CMakeLists.txt file
Signed-off-by: Joshua Covington <joshuacov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23703
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
bcm2712 uses a dedicated eeprom chip with closed-source blobs
provided via rpi-eeprom which is part of the bcm27xx-utils.
No need to install the old firmware files on this target.
Signed-off-by: Joshua Covington <joshuacov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23703
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The bcm27xx/bcm2708 all-kmods CI build fails when modpost reaches the
DesignWare I2C core module:
ERROR: modpost: "__aeabi_uldivmod"
[drivers/i2c/busses/i2c-designware-core.ko] undefined!
This is triggered by CONFIG_ALL_KMODS=y. The old 32-bit Raspberry Pi
subtargets do not normally select this driver for runtime use, but all-kmods
forces the kmod package to be built anyway. On 32-bit ARM, raw 64-bit
division in a module can cause GCC to emit the ARM EABI helper
__aeabi_uldivmod, which is not available as a kernel module symbol.
The failing reference comes from i2c-designware-master.c, where clock_calc()
uses raw u64 division for SCL timing calculations (introduced with commit
3805d13c3ead21494f7d00aa44f10e3656363d4c in rpi-6.18.y / "i2c: designware:
Support non-standard bus speeds"). That is a kernel-side portability issue,
but these old bcm27xx subtargets do not use DesignWare I2C hardware. They
use the Broadcom I2C controller instead.
The failure is emitted for i2c-designware-core.ko, so guard the hidden core
package itself rather than only guarding the platform or PCI frontend package.
This prevents CONFIG_ALL_KMODS from selecting the failing core module directly
on the affected 32-bit bcm27xx subtargets.
DesignWare I2C is relevant for newer Raspberry Pi 5 / RP1 based systems, so
keep it available for bcm2712.
A similar issue was reported by NixOS for Raspberry Pi ARM builds, where
i2c-designware-core.ko failed with the same unresolved __aeabi_uldivmod symbol.
Their workaround was to disable the DesignWare I2C symbols for older Raspberry
Pi targets that do not need them.
Link: https://github.com/NixOS/nixpkgs/issues/464515
Until the underlying ARM32 kernel-side issue is fixed, avoid building
the DesignWare core package on bcm2708, bcm2709 and bcm2710.
Signed-off-by: Joshua Covington <joshuacov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23703
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
ath10k and ath11k support reading calibration variants from the device
tree to locate the correct Board Description File (BDF). The ath12k-wsi
binding already describes using qcom,calibration-variant but it is not
implemented in the driver.
Many ath12k designs expose all the radios under a single phy, each of
which typically require a separate BDF. Without this, the radios may not
come up or will not be calibrated correctly.
Fix this by parsing the device tree for the generation-agnostic
qcom,calibration-variant. This allows the driver to properly select,
read and apply the correct BDF.
Additionally, the ath12k-wsi binding documentation describes using the
generation-specific qcom,ath12k-calibration-variant binding as well as
the generation-agnostic qcom,calibration-variant binding to load
board-specific calibration data from the device tree. However, the
driver never implemented either of these.
Given that no devices currently supported use
qcom,ath12k-calibration-variant and the previous patch implements
qcom,calibration-variant, drop the generation-specific version from the
binding to prevent future confusion.
Tested on Askey SBE1V1K.
Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21767
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The shell config generator read the client private key from the UCI
options priv_key / priv_key_pwd (and priv_key2 / priv_key2_pwd for the
inner tunnel). The ucode generator was switched to private_key /
private_key_passwd (matching the wpa_supplicant field names), and LuCI
was updated accordingly, but existing configurations still carry the old
option names.
Such configs silently lose their private key: for an EAP-TLS client this
leaves wpa_supplicant without a client key and authentication fails after
upgrading from 24.10.
The schema already lists priv_key / priv_key_pwd, but as plain strings,
so validate() never migrates them. Declare them (and the missing
priv_key2 / priv_key2_pwd) as aliases of the private_key* options so the
old names keep working.
Fixes: https://github.com/openwrt/openwrt/issues/22599
Fixes: 218f3884d2 ("wifi-scripts: add ucode based scripts")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24088
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The supplicant config generator emitted the altsubject_match,
domain_match and domain_suffix_match server certificate constraints
through the plain (unquoted) variable list. As these are UCI arrays,
they were rendered space-separated and without quotes, e.g.
altsubject_match=DNS:a.example.com DNS:b.example.com
wpa_supplicant parses an unquoted string value as a hex blob, so such a
line fails to parse and the constraint is dropped. wpa_supplicant
expects a single quoted, semicolon-separated string:
altsubject_match="DNS:a.example.com;DNS:b.example.com"
Join these lists with semicolons and emit them as quoted strings.
The inner-tunnel (phase 2) constraints subject_match2, altsubject_match2,
domain_match2 and domain_suffix_match2 were not written to the config at
all; emit them as well. Add the matching inner EAP-TLS options ca_cert2,
client_cert2, private_key2 and private_key2_passwd to the schema so they
validate cleanly.
Fixes: 218f3884d2 ("wifi-scripts: add ucode based scripts")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24088
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The supplicant config generator emitted the phase2 directive as
phase2="auth=${auth}" for every PEAP/TTLS/FAST configuration. That is
wrong whenever the configured inner method is an EAP method: for
auth='EAP-MSCHAPV2' it produced phase2="auth=EAP-MSCHAPV2", which
wpa_supplicant rejects with:
TLS: Unsupported Phase2 EAP method 'EAP-MSCHAPV2'
breaking WPA-Enterprise clients that use an EAP inner method.
Mirror the shell config generator (hostapd.sh): strip the "EAP-" prefix
and pick the phase2 prefix from the method type, i.e. "autheap=" for a
tunneled EAP method with TTLS and "auth=" for a non-EAP method or a
full "auth=..." spec provided by the user.
Fixes: https://github.com/openwrt/openwrt/issues/24086
Fixes: c92ded2f6e ("wifi-scripts: fix EAP STA support in supplicant config generation")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24088
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Commit 1f86f4e471 ("wifi-scripts: ucode: simplify wpa_pairwise default
selection") made HE and EHT BSSes default their pairwise cipher to
"GCMP-256 CCMP", and commit 86b9eec8f0 ("wifi-scripts: ucode: add
WPA3-Personal Compatibility Mode") always put GCMP-256 into the RSNE
Override 2 element on EHT compatibility-mode BSSes.
WPA3 Specification v3.5 only makes GCMP-256 mandatory when the BSS enables
EHT or MLO (section 2.5, item 5); for HE and below the WPA3 and Wi-Fi
Enhanced Open Deployment Guide v1.1 lists it as recommended, not required.
Advertising it by default causes interoperability problems: several
clients fail to associate when GCMP-256 is offered as a pairwise cipher
and connect again with CCMP only (Nanoleaf devices, a Motorola/Unisoc
phone, a Linux/iwd laptop).
Add a gcmp256 UCI option and, like sae_ext_key, default it on only where
GCMP-256 is both mandatory and safe: on Compatibility mode (sae-compat)
BSSes running an EHT htmode, which carry it in a separate RSNE Override 2
element that legacy clients ignore. It defaults off for WPA3-Personal
(sae) and Transition (sae-mixed) mode and on non-EHT BSSes. An explicit
'option gcmp256 0/1' overrides the default per BSS.
Both GCMP-256 pairwise defaults now key off config.gcmp256 (and, from the
earlier driver-support change, the phy actually implementing the cipher):
the sae/sae-mixed "GCMP-256 CCMP" pairwise cipher and the sae-compat RSNE
Override 2 element. The 'encryption sae+gcmp256' suffix and the wpa3-192
mode still force GCMP-256 as before.
Fixes: 1f86f4e471 ("wifi-scripts: ucode: simplify wpa_pairwise default selection")
Fixes: 86b9eec8f0 ("wifi-scripts: ucode: add WPA3-Personal Compatibility Mode")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24041
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Commit a12cec9ea3 ("wifi-scripts: ucode: advertise SAE-EXT-KEY AKM
alongside SAE") advertised the SAE-EXT-KEY AKM (00-0F-AC:24, SAE using a
group-dependent hash, aka SAE-GDH) by default on every sae, sae-mixed and
sae-compat BSS.
WPA3 Specification v3.5 only makes this AKM mandatory when the BSS enables
EHT or MLO (section 2.5, item 4); for HE and below it is merely
recommended (sections 2.2 and 2.3). In practice the FT-SAE-EXT-KEY AKM
(SAE-EXT-KEY combined with 802.11r), which gets added automatically once
Fast Transition is enabled, keeps some clients from associating (a Samsung
Galaxy Tab S10 FE) or makes them reboot shortly after connecting (a Poco
X6). Plain SAE-EXT-KEY without FT was seen to work on the same tablet, but
its interoperability is not well tested.
Drop the fixed schema default and pick the default from the auth type in
parse_encryption instead. Only default it on where it is both mandatory
and safe to offer: on Compatibility mode (sae-compat) BSSes running an EHT
htmode, which carry it in a separate RSN Override element that legacy
clients ignore. Keep it off for WPA3-Personal (sae) and Transition
(sae-mixed) mode, where it would sit in the main RSNE that a choking
client cannot ignore, and off on non-EHT BSSes. An explicit
'option sae_ext_key 0/1' still overrides this per BSS.
The SAE-EXT-KEY AKM in the sae-compat RSN Override 2 element now keys off
config.sae_ext_key alone; the extra config.rsn_override_pairwise_2 guard
is dropped, decoupling the AKM from the GCMP-256 pairwise cipher so each
follows its own option.
Fixes: a12cec9ea3 ("wifi-scripts: ucode: advertise SAE-EXT-KEY AKM alongside SAE")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24041
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The GCMP-256 pairwise cipher was advertised based only on the BSS htmode
(HE/EHT), without checking whether the driver actually implements it. On
phys that do not support GCMP-256 this makes hostapd reject the
configuration and fail to start.
Query the phy's NL80211 cipher suite list in device_capabilities() and
expose a phy_features.cipher_gcmp256 flag, then only offer GCMP-256 when
the driver advertises the GCMP-256 cipher suite (00-0F-AC:9, 0x000fac09),
mirroring how the HT/VHT feature flags are already gated on the reported
phy capabilities. This covers both the sae/sae-mixed "GCMP-256 CCMP"
pairwise default and the GCMP-256 pairwise cipher in the sae-compat RSNE
Override 2 element.
The "GCMP-256 CCMP" default now keys off driver support alone instead of
the htmode; a follow-up commit reintroduces the per-mode/EHT restriction
via a gcmp256 option.
Fixes: 1f86f4e471 ("wifi-scripts: ucode: simplify wpa_pairwise default selection")
Fixes: 86b9eec8f0 ("wifi-scripts: ucode: add WPA3-Personal Compatibility Mode")
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/24041
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Ensure -fPIC is passed during the linking stage to fix LTO build
failures (relocation errors) on MIPS and other architectures.
Signed-off-by: Anari Jalakas <anari.jalakas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24051
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
These path names are unlikely to change. There is no need for variables.
Tested on Turris Omnia, but not all of these drivers were tested. Variables
were replaced automatically (search-and-replace in text editor). There
shouldn't be any problems.
Signed-off-by: Marius Dinu <m95d+git@psihoexpert.ro>
Remove iptables kmod dependency from kmod-sched-connmark.
Both dependents
package/network/config/qos-scripts
../packages/net/trafficshaper
Already pull in ipt kmods via iptables-mod-conntrack-extra
Permits "clean" nftables migration at
https://github.com/openwrt/packages/pull/29830
Signed-off-by: Andris PE <neandris@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24019
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Avoid having to use of_fwnode_handle and use fwnode_handle directly.
Upstream prefers fwnode to of anyway.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24039
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Even though external_reset() is handled elsewhere, it seems some devices
need it here.
Fixes: 0ccc336c56 ("mac80211: ath9k: avoid a double reset")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24042
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
When rebuilding the package, iucode_tool fails with a "File exists"
error if the directory already contained firmware from the previous
build (incl. in the successful build case).
Fix this by removing the directory before invoking iucode_tool.
Fixes the following build error:
iucode_tool: 06-0f-02: cannot write to, or create file: File exists
make[2]: *** [Makefile:57: .../.built] Error 2
Signed-off-by: Rany Hany <rany_hany@riseup.net>
Link: https://github.com/openwrt/openwrt/pull/24077
Signed-off-by: Robert Marko <robimarko@gmail.com>
Cherry pick the patches recommended in the hostapd security advisory
2026-1:
https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt
Vulnerability
Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE
802.11be/Wi-Fi 7) information has been identified in hostapd and
wpa_supplicant. These issues show up in various cases where frames
including information on affiliated links are parsed and processed in
both AP and STA modes. The issues can result in process termination due
to buffer read overflow checks and memory corruption.
The issues for AP mode (hostapd or wpa_supplicant) can result in
denial-of-service attacks due to process termination and small memory
corruption that could theoretically cause other issues, but it does not
seem likely that those could be exploiting in practice. Affected areas
can be reached by sending invalid Management frames without needing
authentication or user action on the target device.
CVE-2026-58374
Link: https://github.com/openwrt/openwrt/pull/24043
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Commit 6f30f08d0e ("dnsmasq: add fallback for default dhcpv4/dhcpv6
values") changed dnsmasq.init to default the 'dhcpv4'/'dhcpv6' UCI
options to 'disabled' when a 'config dhcp' section leaves them unset:
- config_get dhcpv4 "$cfg" dhcpv4
- config_get dhcpv6 "$cfg" dhcpv6
+ config_get dhcpv4 "$cfg" dhcpv4 disabled
+ config_get dhcpv6 "$cfg" dhcpv6 disabled
The intent was to match odhcpd, which already treats an unset value
as disabled, so both backends behave the same way for newly created
configs. Its companion commit 85767ac8fe added explicit
'option dhcpv4/dhcpv6 server' lines to the stock 'lan' section in the
packaged dhcp.conf template, which covers fresh installs.
Neither commit accounts for configs that predate the change. Before
it, an unset dhcpv4/dhcpv6 option was implicitly treated as enabled,
so it was common (and still is, on any router upgraded from before
this landed) to have 'config dhcp' sections for additional
interfaces/VLANs with no explicit dhcpv4/dhcpv6 option at all. After
the change, dnsmasq.init silently skips '--dhcp-range' for every one
of those sections:
if [ "$dhcpv4" != "disabled" ]; then
...
fi
The result: any interface whose dhcp section never needed the option
before stops handing out leases entirely, with nothing logged beyond
a normal dnsmasq startup, while sections that happen to already carry
an explicit 'server' value keep working. On a router with several
VLANs this looks exactly like "DHCP only works on one interface."
Fix by shipping a one-time /etc/uci-defaults migration, matching the
existing 50-dnsmasq-migrate-resolv-conf-auto.sh /
50-dnsmasq-migrate-ipset.sh pattern in this package: for every
'config dhcp' section, if dhcpv4/dhcpv6 is unset, explicitly set it
to 'server', preserving the pre-6f30f08d0e behavior for existing
configs. Sections that already set the option (or set 'disabled'
deliberately) are left untouched, and sections that never reach the
check (e.g. 'wan' with 'option ignore 1') are unaffected.
Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/24068
Signed-off-by: Robert Marko <robimarko@gmail.com>
It seems that GCC 14.4 will generate larger binary compared to the
GCC 14.3 on ARM32 platforms. We have to increase the maximum allowed
SPL size to fix build errors.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/24058
Signed-off-by: Robert Marko <robimarko@gmail.com>
mux-mmio.ko depends on regmap-mmio.ko at runtime, but the kmod package
was missing the dependency, causing build failures when the module is
included.
Fixes: ac39016898 ("kernel: modules: package MMIO mux driver")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24028
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Indicate that there are some changes. This should make sure that the
package gets updated.
Fixes: 257aee0cc0 ("scripts: dhcpv6: don't report custom ip6class if default")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Indicate that there are some changes. This should make sure that the
package gets updated.
Fixes: 63c0767f3d ("ead: fix integer underflow in handle_send_a()")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
maintainer: Felix Fietkau <nbd@nbd.name>
The metric field is not used when wireGuard routes are created.
See: https://github.com/openwrt/openwrt/issues/23199
This patch is aimed at adding the metric field in the config to the created routes for WireGuard if
the metric field is not empty and not 0
Compile tested: X86, Openwrt-main
Run tested: X86
Please have a look and consider implementing
Signed-off-by: Erik Conijn <egc112@msn.com>
Link: https://github.com/openwrt/openwrt/pull/23280
Signed-off-by: Robert Marko <robimarko@gmail.com>
add ra/dhcpv4/dhcpv6
dhcpv6 service provided by dnsmasq without odhcpd
Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23445
Signed-off-by: Robert Marko <robimarko@gmail.com>
Create a package for ov5645 kernel module, required to support camera on
PICO-PI-IMX7D board.
Currently limit the visibility to imx_cortexa7 subtarget, but this can
be enabled on other platforms if needed.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17606
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Package the video-mux module, required by PICO-PI-IMX7D board, to
support included OV5645 camera.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17606
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Create a package for MMIO-based multiplexer driver, used as a backend by
video-mux on i.MX7 SoCs.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17606
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
