| Age | Commit message (Collapse) | Author |
|---|
|
|
|
The Kernel 6.18.33 now has an upstream fix for the fragnesia vulnerability
|
|
Kernel: T8880: reduce size of Kernel source TAR
|
|
* Kernel: T8846: consolidate config for CPU/Task time and stats accounting
* Kernel: T8879: add config section for hypervisor Virtual Socket Protocol
* Kernel: T8879: add missing Hyper-V drivers after 6.18 upgrade
Add drivers for Hyper-V hypervisor which got lost in transition from 6.6 to
6.18 Kernel upgrade.
|
|
Enable "make mrproper" before packaging kernel source tarball. After enabling
PWRU support in T8496, the auto-generated kernel source tarball grew from under
1 GB to ~4 GB, largely due to intermediate build artifacts (for example,
vmlinuz.o growing from 54 MB to 618 MB with additional debug symbols).
Since the tarball is intended to contain kernel sources and custom patches and
not intermediate objects, we now clean the tree with "make mrproper" before
creating the tarball. This keeps package size down while preserving
rebuildability.
|
|
This fixes the LPE https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn
|
|
that allows unprivileged users to read files owned by any other user
|
|
Fragnesia is a universal Linux local privilege escalation exploit, discovered
with V12 by William Bowling with the V12 team. Fragnesia is a member of the
Dirty Frag vulnerability class. This is a separate bug in the ESP/XFRM from
dirtyfrag which has received its own patch. However, it is in the same surface
and the mitigation is the same as for dirtyfrag.
It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve
arbitrary byte writes into the kernel page cache of read-only files, without
requiring any race condition.
The technique extends the page-cache write bug class that includes Dirty Pipe:
when a TCP socket transitions to espintcp ULP mode after data has already been
spliced from a file into the receive queue, the kernel processes the queued
file pages as ESP ciphertext. The AES-GCM keystream byte at counter block
position 2, byte 0 is XORed directly into the cached file page. By selecting
the IV nonce to produce a desired keystream byte, any target byte in the file
can be set to any value — one byte per trigger invocation.
From: https://github.com/v12-security/pocs/blob/532994fc003a7/fragnesia/README.md
|
|
kernel: T8847: Enable PSI metric data
|
|
Enable the kernel [Pressure Stall Information][PSI] accounting feature.
This allows users to gather data on CPU and memory starvation. It's very
useful to help find cases where the system performance is impacted by
overloaded CPUs.
[PSI]: https://docs.kernel.org/accounting/psi.html
Signed-off-by: SuperQ <superq@gmail.com>
|
|
The Intel iavf driver (formerly i40evf) is the Linux virtual function driver
for modern Intel Ethernet adapters supporting SR-IOV, including the X700/E800
series.
Renamed to iavf to support future devices, it replaced i40evf entirely by 2019.
The driver facilitates high-performance networking in virtualized environments.
This commit contains custom patches to make the driver build.
|
|
Instead of one build function per driver (ixgbe, i40, ice) which will anyways
result in the same Python code path to be executed - use one common helper
name: build_intel_nic
|
|
The current version of the Intel ice driver does not compile with a recent
LTS Kernel due to missing internal Kernel API adjustments in the Intel driver.
This commit contains custom patches to make the driver build.
|
|
The current version of the Intel i40e driver does not compile with a recent
LTS Kernel due to missing internal Kernel API adjustments in the Intel driver.
This commit contains custom patches to make the driver build.
|
|
|
|
|
|
It does not make sense to have the common VyOS functionality for e.g VXLAN,
GENEVE, PPP, WireGuard, filesystems crypto or module signing duplicated for
both arm64 and x86_64.
Split out common configuration parts to be defined only once.
|
|
* Forwared port all out-of-tree driver patches
* Add Intel QAT patch to make it compile for LInux 6.18
* Remove out-of-tree OpenVPN DCO module - now available upstream
|
|
|
|
|
|
|
|
|
|
|
|
The inotify support for overlayfs is no longer needed. Native upstream support
landed in kernel 4.16 (commit 31747eda41ef/764baba80168 in 2018, which made
overlayfs hash inodes by their lower inode so fsnotify works on overlay mounts),
and kernel 6.8 (commit bc2473c90fca in 2023) extended it so fsnotify generates
events for operations on the real underlying files of an overlay.
The patch was an out-of-tree workaround that never went upstream and predates
these solutions.
|
|
linux-kernel: T8506: Use scripts/kconfig/merge_config.sh for merging kernel config fragments
|
|
fragments
Using scripts/kconfig/merge_config.sh for merging config fragments provides
validation and insights compared to the previously used simple
concatenation
|
|
With this addition we can always sign a Kernel module later and ship it if
needed, without re-compiling the Kernel.
Kernel will report:
[ 1.223891] Loaded X.509 cert 'VyOS Networks Secure Boot Signer 2025 - linux: 6ca57e2add335babd08da69b48c70693edd2b037'
Issuer: CN = VyOS Networks Secure Boot CA
Validity
Not Before: Apr 26 09:07:06 2025 GMT
Not After : Apr 24 09:07:06 2035 GMT
Subject: CN = VyOS Networks Secure Boot Signer 2025 - linux
|
|
PWRU (https://github.com/cilium/pwru) is a very useful tool to debug complex networking issues on Linux, as it allows you to trace how packets travel through the kernel functions
|
|
|
|
for the memory corruption vulnerability
|
|
T8410: Fix typos and mistakes in scripts and comments
|
|
Fix typos and mistakes in the comments
No functional changes
|
|
The custom patch "nft_ct: Added nfct_seqadj_ext_add() for DNAT'ed - conntrack."
is now available upstream in the Kernel tree.
|
|
Add CONFIG_RTC_DRV_EFI, CONFIG_RTC_DRV_PL031 kernel options for
system time update
|
|
Enable several additional kernel modules required for specific hardware
platforms.
Network:
- CONFIG_OCTEONTX2_AF
- CONFIG_OCTEONTX2_PF
eMMC:
- CONFIG_MMC_SDHCI_CADENCE
LED:
- CONFIG_GPIO_PCA953X
- CONFIG_LEDS_PCA955X_GPIO
I2C:
- CONFIG_I2C_THUNDERX
These drivers are built as modules to provide support for Marvell
OCTEON TX2 network devices, Cadence SDHCI eMMC controllers, PCA95xx
GPIO/LED expanders, and ThunderX I2C controllers.
|
|
|
|
Re-use a building block for WWAN support to de-duplicate individual configs for
both ARM64 and AMD64/X86.
|
|
Both architectures share common Kernel features - place them in single
config snippets so we have to maintain them only once.
This can for sure be further improved.
|
|
|
|
|
|
Fail vefore building VPP to not waste time.
|
|
|
|
|
|
If build.py detects a local "linux" directory which could be a
Git repository - it is used over downloading the released tarball.
|
|
|
|
|
|
|
|
|
|
Kernel: T8203: Update Linux Kernel to 6.6.121
|
|
|
