009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
This commit is contained in:
sunfish-admin committed
1 parent
fd793b9471
commit
deaaf42caa
129 files changed
+11769
-141
No files matched your search
@@ -10,9 +10,11 @@ python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_f
|
||||
|
||||
- **Call recording**: EXTENDROM `er.sh` F_CALLREC / AXP GOLDEN
|
||||
(`extendrom_call_recording`). steadfasterX EXTENDROM.
|
||||
- **FLAG_SECURE**: AOSP `Settings.Secure.DISABLE_SECURE_WINDOWS` already
|
||||
wired in `WindowManagerService` on A16; DO preference
|
||||
`allow_flag_secure_override` writes that key.
|
||||
- **FLAG_SECURE**: AOSP `Settings.Secure.DISABLE_SECURE_WINDOWS` + DO
|
||||
preference `allow_flag_secure_override`. Stock WMS only applies the
|
||||
setting when `ro.debuggable=1`; we remove that gate via
|
||||
`apply_wms_disable_secure_debuggable_gate.py` so ship images keep
|
||||
`ro.debuggable=0` while the toggle still works.
|
||||
|
||||
## Touched paths
|
||||
|
||||
@@ -24,9 +26,15 @@ python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_f
|
||||
| Settings controllers | `…/ER_CallRec*.java`, `…/FlagSecureOverride*.java` |
|
||||
| Settings DO XML + strings | `res/xml/development_settings.xml`, `res/values/strings.xml` |
|
||||
| Dashboard | `DevelopmentSettingsDashboardFragment.java` |
|
||||
| Capture path | stock WMS `disable_secure_windows` (no extra WM patch) |
|
||||
| Capture path | WMS `updateDisableSecureWindows()` — **no** `ro.debuggable` gate |
|
||||
| WMS apply | `apply_wms_disable_secure_debuggable_gate.py` |
|
||||
|
||||
```bash
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
||||
```
|
||||
|
||||
Backups: `/srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots/`
|
||||
Marker: `SUNFISH_A16_008_CALL_REC_FLAG_SECURE`
|
||||
Markers: `SUNFISH_A16_008_CALL_REC_FLAG_SECURE`,
|
||||
`SUNFISH_A16_008_WMS_DISABLE_SECURE_NO_DEBUGGABLE_GATE`
|
||||
|
||||
See `docs/008-call-rec-flag-secure-runbook.md`.
|
||||
+23
-8
@@ -5,16 +5,18 @@ Call recording (AXP GOLDEN / EXTENDROM F_CALLREC):
|
||||
- Settings.Secure.ER_ALLOW_ANY_CALL_REC = \"extendrom_call_recording\"
|
||||
- DO switch + Dialer CallRecorder.canRecordInCurrentCountry early-return
|
||||
|
||||
FLAG_SECURE (AOSP A16 already implements WM path):
|
||||
FLAG_SECURE (AOSP A16 WM path + project WMS gate removal):
|
||||
- DO switch writes Settings.Secure.DISABLE_SECURE_WINDOWS
|
||||
(\"disable_secure_windows\"). WindowManagerService.updateDisableSecureWindows()
|
||||
already honours it on debuggable builds (LAB userdebug).
|
||||
(\"disable_secure_windows\").
|
||||
- Also run apply_wms_disable_secure_debuggable_gate.py so WMS honours the
|
||||
setting with ro.debuggable=0 (stock AOSP required debuggable).
|
||||
|
||||
Attribution: EXTENDROM (steadfasterX) for call-rec; AOSP DISABLE_SECURE_WINDOWS
|
||||
for capture; sunfish-a16 DO wiring.
|
||||
for capture; sunfish-a16 DO + WMS gate wiring.
|
||||
|
||||
Run on rom-dev01:
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
@@ -125,8 +127,9 @@ public class ER_CallRecInfo extends DeveloperOptionsPreferenceController
|
||||
|
||||
FLAG_SECURE_CTRL = """/*
|
||||
* sunfish-a16-rom ({marker}): Developer Options gate for AOSP
|
||||
* Settings.Secure.DISABLE_SECURE_WINDOWS (WindowManagerService already
|
||||
* honours this on debuggable builds).
|
||||
* Settings.Secure.DISABLE_SECURE_WINDOWS. Pair with
|
||||
* apply_wms_disable_secure_debuggable_gate.py so WMS honours the setting
|
||||
* when ro.debuggable=0.
|
||||
*/
|
||||
|
||||
package com.android.settings.development;
|
||||
@@ -406,8 +409,8 @@ def patch_strings() -> None:
|
||||
<!-- {MARKER}: FLAG_SECURE override (writes AOSP disable_secure_windows) -->
|
||||
<string name="flag_secure_override_category">Secure window screenshots</string>
|
||||
<string name="allow_flag_secure_override">Allow screenshots of secure windows</string>
|
||||
<string name="allow_flag_secure_override_summary">When enabled, apps that set FLAG_SECURE can still be captured by the system screenshot / screen record paths (debuggable builds). Weakens app privacy.</string>
|
||||
<string name="allow_flag_secure_override_details">Writes Settings.Secure.disable_secure_windows. On userdebug/eng, WindowManager treats FLAG_SECURE windows as capturable. Default OFF restores stock secure-window behaviour.</string>
|
||||
<string name="allow_flag_secure_override_summary">When enabled, apps that set FLAG_SECURE can still be captured by the system screenshot / screen record paths. Weakens app privacy. Does not change ro.debuggable.</string>
|
||||
<string name="allow_flag_secure_override_details">Writes Settings.Secure.disable_secure_windows. WindowManager treats FLAG_SECURE windows as capturable while this is ON (project build; ro.debuggable stays 0). Default OFF restores stock secure-window behaviour.</string>
|
||||
"""
|
||||
text = text.replace("</resources>", add + "</resources>", 1)
|
||||
path.write_text(text)
|
||||
@@ -458,6 +461,17 @@ def verify_dialer_config() -> None:
|
||||
print("Dialer config.xml: call_recording_audio_source=4 (OK)")
|
||||
|
||||
|
||||
def apply_wms_gate() -> None:
|
||||
"""Invoke sibling script that drops the ro.debuggable gate in WMS."""
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
sibling = Path(__file__).resolve().parent / "apply_wms_disable_secure_debuggable_gate.py"
|
||||
r = subprocess.run([sys.executable, str(sibling)], check=False)
|
||||
if r.returncode != 0:
|
||||
raise SystemExit(f"WMS disable-secure gate apply failed: {r.returncode}")
|
||||
|
||||
|
||||
def main() -> None:
|
||||
if not TREE.is_dir():
|
||||
raise SystemExit(f"LOS tree missing: {TREE}")
|
||||
@@ -475,6 +489,7 @@ def main() -> None:
|
||||
patch_development_xml()
|
||||
patch_dashboard()
|
||||
verify_dialer_config()
|
||||
apply_wms_gate()
|
||||
print("done:", MARKER)
|
||||
|
||||
|
||||
|
||||
Vendored
+81
@@ -0,0 +1,81 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Remove AOSP ro.debuggable gate on Settings.Secure.DISABLE_SECURE_WINDOWS.
|
||||
|
||||
LOS 23.2 / A16 WindowManagerService.updateDisableSecureWindows() returns early
|
||||
unless SystemProperties.getBoolean(\"ro.debuggable\") is true. That blocks the
|
||||
Developer Options toggle on builds that keep ro.debuggable=0 (including this
|
||||
project's LAB image labelled userdebug).
|
||||
|
||||
This patch removes ONLY that gate. Behaviour:
|
||||
disable_secure_windows=0 → stock FLAG_SECURE (mDisableSecureWindows=false)
|
||||
disable_secure_windows=1 → mDisableSecureWindows=true; isSecureLocked()/Task.isSecure()
|
||||
honour the override (no second debuggable check elsewhere)
|
||||
|
||||
Does NOT change ro.debuggable, Build.IS_DEBUGGABLE, ViewServer, or screen-share
|
||||
protections (DISABLE_SCREEN_SHARE_PROTECTIONS_FOR_APPS_AND_NOTIFICATIONS).
|
||||
|
||||
Audit (LOS23 frameworks/base, 2026-09-18): sole gate is updateDisableSecureWindows();
|
||||
WindowState.isSecureLocked / Task.isSecure only call getDisableSecureWindows().
|
||||
|
||||
Run on rom-dev01:
|
||||
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/\\
|
||||
apply_wms_disable_secure_debuggable_gate.py
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import shutil
|
||||
from pathlib import Path
|
||||
|
||||
TREE = Path("/srv/rom/src/lineage")
|
||||
MARKER = "SUNFISH_A16_008_WMS_DISABLE_SECURE_NO_DEBUGGABLE_GATE"
|
||||
BAK_ROOT = Path("/srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots")
|
||||
WMS = (
|
||||
TREE
|
||||
/ "frameworks/base/services/core/java/com/android/server/wm/"
|
||||
"WindowManagerService.java"
|
||||
)
|
||||
|
||||
OLD = """ void updateDisableSecureWindows() {
|
||||
if (!SystemProperties.getBoolean(SYSTEM_DEBUGGABLE, false)) {
|
||||
return;
|
||||
}
|
||||
|
||||
boolean disableSecureWindows;
|
||||
"""
|
||||
|
||||
NEW = f""" void updateDisableSecureWindows() {{
|
||||
// {MARKER}: honour Settings.Secure.DISABLE_SECURE_WINDOWS even when
|
||||
// ro.debuggable=0. Stock AOSP gated this on SYSTEM_DEBUGGABLE; ship
|
||||
// builds keep debuggable off and use the Secure setting alone.
|
||||
boolean disableSecureWindows;
|
||||
"""
|
||||
|
||||
|
||||
def backup(path: Path) -> None:
|
||||
BAK_ROOT.mkdir(parents=True, exist_ok=True)
|
||||
dest = BAK_ROOT / path.name
|
||||
if not dest.exists():
|
||||
shutil.copy2(path, dest)
|
||||
print(f"backup -> {dest}")
|
||||
|
||||
|
||||
def main() -> int:
|
||||
if not WMS.is_file():
|
||||
print(f"ERROR: missing {WMS}")
|
||||
return 2
|
||||
text = WMS.read_text()
|
||||
if MARKER in text:
|
||||
print(f"already applied: {WMS}")
|
||||
return 0
|
||||
if OLD not in text:
|
||||
print("ERROR: expected updateDisableSecureWindows debuggable gate not found")
|
||||
print("(tree already diverged — inspect manually)")
|
||||
return 3
|
||||
backup(WMS)
|
||||
WMS.write_text(text.replace(OLD, NEW, 1))
|
||||
print(f"applied -> {WMS}")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
+222
@@ -0,0 +1,222 @@
|
||||
/*
|
||||
* Copyright (C) 2022 The Android Open Source Project
|
||||
*
|
||||
* Attribute: AXP GOLDEN ConnectivityCheckPreferenceController (Settings.apk),
|
||||
* cloned for LOS 23.2 without axp.os / captiveportal.axpos.org endpoints.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
*/
|
||||
package com.android.settings.network;
|
||||
|
||||
import android.content.ContentResolver;
|
||||
import android.content.Context;
|
||||
import android.provider.Settings;
|
||||
|
||||
import androidx.preference.ListPreference;
|
||||
import androidx.preference.Preference;
|
||||
import androidx.preference.PreferenceScreen;
|
||||
|
||||
import com.android.settings.R;
|
||||
import com.android.settings.core.BasePreferenceController;
|
||||
import com.android.settings.core.PreferenceControllerMixin;
|
||||
import com.android.settingslib.RestrictedLockUtils;
|
||||
import com.android.settingslib.RestrictedLockUtils.EnforcedAdmin;
|
||||
import com.android.settingslib.RestrictedLockUtilsInternal;
|
||||
import com.android.settingslib.core.lifecycle.events.OnResume;
|
||||
|
||||
import android.os.UserHandle;
|
||||
import android.os.UserManager;
|
||||
|
||||
/** Internet connectivity check provider list (captive portal URLs). */
|
||||
public class ConnectivityCheckPreferenceController extends BasePreferenceController
|
||||
implements PreferenceControllerMixin, Preference.OnPreferenceChangeListener, OnResume {
|
||||
|
||||
private static final String KEY = "connectivity_check_settings";
|
||||
|
||||
private static final int DISABLED = 0;
|
||||
private static final int AMAZON = 1;
|
||||
private static final int CLOUDFLARE = 2;
|
||||
private static final int GOOGLE = 3;
|
||||
private static final int HUAWEI = 4;
|
||||
private static final int KUKETZ = 5;
|
||||
private static final int MICROSOFT = 6;
|
||||
private static final int OPENSUSE = 7;
|
||||
private static final int UBUNTU = 8;
|
||||
|
||||
private ListPreference mConnectivityPreference;
|
||||
|
||||
public ConnectivityCheckPreferenceController(Context context) {
|
||||
super(context, KEY);
|
||||
}
|
||||
|
||||
@Override
|
||||
public int getAvailabilityStatus() {
|
||||
return isDisabledByAdmin() ? DISABLED_FOR_USER : AVAILABLE;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getPreferenceKey() {
|
||||
return KEY;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void displayPreference(PreferenceScreen screen) {
|
||||
ListPreference pref = new ListPreference(screen.getContext());
|
||||
pref.setKey(KEY);
|
||||
pref.setOrder(30);
|
||||
pref.setIcon(R.drawable.ic_settings_language);
|
||||
pref.setTitle(R.string.connectivity_check_title);
|
||||
pref.setSummary(R.string.connectivity_check_summary);
|
||||
pref.setEntries(R.array.connectivity_check_entries);
|
||||
pref.setEntryValues(R.array.connectivity_check_values);
|
||||
pref.setOnPreferenceChangeListener(this);
|
||||
if (mConnectivityPreference == null) {
|
||||
screen.addPreference(pref);
|
||||
mConnectivityPreference = pref;
|
||||
}
|
||||
super.displayPreference(screen);
|
||||
updatePreferenceState();
|
||||
}
|
||||
|
||||
private void updatePreferenceState() {
|
||||
if (mConnectivityPreference == null) {
|
||||
return;
|
||||
}
|
||||
ContentResolver cr = mContext.getContentResolver();
|
||||
int mode = Settings.Global.getInt(cr, Settings.Global.CAPTIVE_PORTAL_MODE, 1);
|
||||
if (mode == 0) {
|
||||
mConnectivityPreference.setValueIndex(DISABLED);
|
||||
return;
|
||||
}
|
||||
String http = Settings.Global.getString(cr, Settings.Global.CAPTIVE_PORTAL_HTTP_URL);
|
||||
int idx = GOOGLE;
|
||||
if ("http://fireoscaptiveportal.com/generate_204".equals(http)) {
|
||||
idx = AMAZON;
|
||||
} else if ("http://cp.cloudflare.com".equals(http)) {
|
||||
idx = CLOUDFLARE;
|
||||
} else if ("http://connectivitycheck.gstatic.com/generate_204".equals(http)) {
|
||||
idx = GOOGLE;
|
||||
} else if ("http://connectivitycheck.platform.hicloud.com/generate_204".equals(http)) {
|
||||
idx = HUAWEI;
|
||||
} else if ("http://captiveportal.kuketz.de".equals(http)) {
|
||||
idx = KUKETZ;
|
||||
} else if ("http://edge-http.microsoft.com/captiveportal/generate_204".equals(http)) {
|
||||
idx = MICROSOFT;
|
||||
} else if ("http://conncheck.opensuse.org".equals(http)) {
|
||||
idx = OPENSUSE;
|
||||
} else if ("http://connectivity-check.ubuntu.com".equals(http)) {
|
||||
idx = UBUNTU;
|
||||
}
|
||||
mConnectivityPreference.setValueIndex(idx);
|
||||
}
|
||||
|
||||
private void setCaptivePortalURLs(ContentResolver cr, int value) {
|
||||
final String httpKey = Settings.Global.CAPTIVE_PORTAL_HTTP_URL;
|
||||
final String httpsKey = Settings.Global.CAPTIVE_PORTAL_HTTPS_URL;
|
||||
final String fallbackKey = Settings.Global.CAPTIVE_PORTAL_FALLBACK_URL;
|
||||
final String otherKey = Settings.Global.CAPTIVE_PORTAL_OTHER_FALLBACK_URLS;
|
||||
final String modeKey = Settings.Global.CAPTIVE_PORTAL_MODE;
|
||||
|
||||
String http;
|
||||
String https;
|
||||
String fallback;
|
||||
String other;
|
||||
int mode = 1;
|
||||
|
||||
switch (value) {
|
||||
case DISABLED:
|
||||
// Match GOLDEN: write Google URLs then mode=0
|
||||
http = "http://connectivitycheck.gstatic.com/generate_204";
|
||||
https = "https://www.google.com/generate_204";
|
||||
fallback = "http://www.google.com/gen_204";
|
||||
other = "http://play.googleapis.com/generate_204";
|
||||
mode = 0;
|
||||
break;
|
||||
case AMAZON:
|
||||
http = "http://fireoscaptiveportal.com/generate_204";
|
||||
https = "https://fireoscaptiveportal.com/generate_204";
|
||||
fallback = http;
|
||||
other = http;
|
||||
break;
|
||||
case CLOUDFLARE:
|
||||
http = "http://cp.cloudflare.com";
|
||||
https = "https://cp.cloudflare.com";
|
||||
fallback = http;
|
||||
other = http;
|
||||
break;
|
||||
case HUAWEI:
|
||||
http = "http://connectivitycheck.platform.hicloud.com/generate_204";
|
||||
https = "https://connectivitycheck.platform.hicloud.com/generate_204";
|
||||
fallback = http;
|
||||
other = http;
|
||||
break;
|
||||
case KUKETZ:
|
||||
http = "http://captiveportal.kuketz.de";
|
||||
https = "https://captiveportal.kuketz.de";
|
||||
fallback = http;
|
||||
other = http;
|
||||
break;
|
||||
case MICROSOFT:
|
||||
http = "http://edge-http.microsoft.com/captiveportal/generate_204";
|
||||
https = http;
|
||||
fallback = http;
|
||||
other = http;
|
||||
break;
|
||||
case OPENSUSE:
|
||||
http = "http://conncheck.opensuse.org";
|
||||
https = "https://conncheck.opensuse.org";
|
||||
fallback = http;
|
||||
other = http;
|
||||
break;
|
||||
case UBUNTU:
|
||||
http = "http://connectivity-check.ubuntu.com";
|
||||
https = "https://connectivity-check.ubuntu.com";
|
||||
fallback = http;
|
||||
other = http;
|
||||
break;
|
||||
case GOOGLE:
|
||||
default:
|
||||
http = "http://connectivitycheck.gstatic.com/generate_204";
|
||||
https = "https://www.google.com/generate_204";
|
||||
fallback = "http://www.google.com/gen_204";
|
||||
other = "http://play.googleapis.com/generate_204";
|
||||
break;
|
||||
}
|
||||
|
||||
Settings.Global.putString(cr, httpKey, http);
|
||||
Settings.Global.putString(cr, httpsKey, https);
|
||||
Settings.Global.putString(cr, fallbackKey, fallback);
|
||||
Settings.Global.putString(cr, otherKey, other);
|
||||
Settings.Global.putInt(cr, modeKey, mode);
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean onPreferenceChange(Preference preference, Object newValue) {
|
||||
if (KEY.equals(preference.getKey())) {
|
||||
setCaptivePortalURLs(
|
||||
mContext.getContentResolver(), Integer.parseInt((String) newValue));
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void onResume() {
|
||||
updatePreferenceState();
|
||||
if (mConnectivityPreference != null && mConnectivityPreference.getValue() != null) {
|
||||
setCaptivePortalURLs(
|
||||
mContext.getContentResolver(),
|
||||
Integer.parseInt(mConnectivityPreference.getValue()));
|
||||
}
|
||||
}
|
||||
|
||||
private EnforcedAdmin getEnforcedAdmin() {
|
||||
return RestrictedLockUtilsInternal.checkIfRestrictionEnforced(
|
||||
mContext, UserManager.DISALLOW_CONFIG_PRIVATE_DNS, UserHandle.myUserId());
|
||||
}
|
||||
|
||||
private boolean isDisabledByAdmin() {
|
||||
return getEnforcedAdmin() != null;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
# 009 AXP LOS23 port — patch / packaging README
|
||||
|
||||
**Track**: Magisk AXP resurrection on LOS 23.2 sunfish (`AXP_Resurection`).
|
||||
**Not ship**: KernelSU / SusFS (`007` standby / optional recycle only).
|
||||
|
||||
## Apply order (host tree under `/srv/rom/src/lineage/`)
|
||||
|
||||
1. **Google stack** — `vendor/sunfish-a16/gms.mk` + `Android.mk` (microG, GSF,
|
||||
Phonesky). Host APKs: `/srv/rom/prebuilts/{microg,phonesky}/` (never Git).
|
||||
2. **Signature spoofing** — `vendor/sunfish-a16/patches/005-sigspoof/`
|
||||
(`apply_005_sigspoof.py`). Attribute: LOS restricted spoofing + AXP/005.
|
||||
3. **Call recording unlock** — `vendor/sunfish-a16/patches/008-call-rec-flag-secure/`
|
||||
(`extendrom_call_recording`). Attribute: EXTENDROM `F_CALLREC`.
|
||||
4. **Magisk preroot** — EXTENDROM-class boot/`init_boot` patch using Magisk APK
|
||||
from `/srv/rom/prebuilts/magisk/` (see `docs/009-magisk-preinstall-runbook.md`).
|
||||
Stub: `vendor/sunfish-a16/magisk.mk`. Attribute: Magisk upstream + sfX
|
||||
extendrom Magisk patcher. **Host tree currently has no `vendor/extendrom`**
|
||||
— must vendor minimal patcher or checkout extendrom before first Magisk bacon.
|
||||
5. **Bundled apps** — `/srv/rom/prebuilts/axp-apps/` + `apps.mk` (Aurora,
|
||||
Droidify, Fossify Gallery). Symlink APKs into `vendor/sunfish-a16/prebuilt/`.
|
||||
6. **Private DNS presets** — `apply_009_private_dns_providers.py` (GOLDEN list).
|
||||
7. **Internet connectivity check** — `apply_009_connectivity_check.py` (GOLDEN
|
||||
list **minus** AXP.OS / `axpos.org`).
|
||||
8. **Disable for user apps** — `apply_009_disable_user_apps.py` (SPA gate).
|
||||
9. **Userspace hardening / signing** — staged: see `signing/README.md`,
|
||||
`hardening/README.md` (US-S4-1 OpenSSH trim), and
|
||||
`docs/009-hardening-signing-checklist.md` (US-S1 keys → US-S2 wire →
|
||||
US-S3 AVB → US-S4+ harden). Bootloader lock = wont.
|
||||
10. **Kernel hardening** — LOS23 `msm-4.14` + map in
|
||||
`docs/009-kernel-hardening-map.md` (FR-017). Stage 1:
|
||||
`vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh`
|
||||
(AXP Graphene/AH allowlist). Priority: AXP → LOS → Iodé → optional
|
||||
Graphene; no Divest hunt; no extra location lockdown.
|
||||
|
||||
## Product includes
|
||||
|
||||
Wire Magisk-resurrection product from `vendor/sunfish-a16/` into
|
||||
`lineage_sunfish` (same pattern as `004`/`005`). Keep Phonesky priv-app path.
|
||||
**No FakeStore. No KernelSU product packages.**
|
||||
|
||||
## Deferred
|
||||
|
||||
- Banking Gate E / Island validation (owner future).
|
||||
- Localization AXP-vs-LOS compare (`docs/009-localization-axp-vs-los.md` stub).
|
||||
|
||||
## Host paths (rom-dev01)
|
||||
|
||||
| What | Path |
|
||||
|------|------|
|
||||
| Magisk APK | `/srv/rom/prebuilts/magisk/Magisk-v30.7.apk` |
|
||||
| EXTENDROM Magisk patcher | `/srv/rom/references/extendrom/config/magisk/` |
|
||||
| Kernel source | `/srv/rom/src/lineage/kernel/google/msm-4.14` |
|
||||
| Product include (gms) | `device/google/sunfish/lineage_sunfish.mk` → `vendor/sunfish-a16/gms.mk` |
|
||||
| Vanilla baseline | `/srv/rom/artifacts/003-vanilla/20260914-lineage-23.2-sunfish/` |
|
||||
| Optional KSU boots | `/srv/rom/artifacts/007-kernelsu/` (non-ship) |
|
||||
|
||||
**Gap:** `vendor/extendrom` is **not** checked out in the lineage tree yet.
|
||||
Magisk bacon blocked on T011 (symlink/checkout + PREROOT or slim wire).
|
||||
+114
@@ -0,0 +1,114 @@
|
||||
#!/usr/bin/env python3
|
||||
"""009: port GOLDEN Internet connectivity check UI (sans axp.os).
|
||||
|
||||
Copies ConnectivityCheckPreferenceController, adds string/array resources,
|
||||
wires into NetworkDashboardFragment. Idempotent.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import pathlib
|
||||
import shutil
|
||||
import sys
|
||||
|
||||
MARKER = "sunfish-a16-009-connectivity-check"
|
||||
|
||||
ENTRIES = """ <!-- {m}: GOLDEN connectivity providers minus AXP.OS -->
|
||||
<string-array name="connectivity_check_entries" translatable="false">
|
||||
<item>Disabled</item>
|
||||
<item>Amazon Fire OS (US)</item>
|
||||
<item>Cloudflare (US)</item>
|
||||
<item>Google (US) [default]</item>
|
||||
<item>Huawei (CN)</item>
|
||||
<item>Kuketz (DE)</item>
|
||||
<item>Microsoft Edge (US)</item>
|
||||
<item>openSUSE (DE)</item>
|
||||
<item>Ubuntu (UK)</item>
|
||||
</string-array>
|
||||
<string-array name="connectivity_check_values" translatable="false">
|
||||
<item>0</item>
|
||||
<item>1</item>
|
||||
<item>2</item>
|
||||
<item>3</item>
|
||||
<item>4</item>
|
||||
<item>5</item>
|
||||
<item>6</item>
|
||||
<item>7</item>
|
||||
<item>8</item>
|
||||
</string-array>
|
||||
""".format(
|
||||
m=MARKER
|
||||
)
|
||||
|
||||
STRINGS = f""" <!-- {MARKER} -->
|
||||
<string name="connectivity_check_title" translatable="false">Internet connectivity check</string>
|
||||
<string name="connectivity_check_summary" translatable="false">HTTP endpoints to use for performing internet connectivity checks.</string>
|
||||
"""
|
||||
|
||||
|
||||
def ensure_arrays(path: pathlib.Path) -> None:
|
||||
text = path.read_text(encoding="utf-8")
|
||||
if "connectivity_check_entries" in text:
|
||||
return
|
||||
if "</resources>" not in text:
|
||||
raise SystemExit(f"FAIL: no </resources> in {path}")
|
||||
path.write_text(text.replace("</resources>", ENTRIES + "</resources>", 1), encoding="utf-8")
|
||||
|
||||
|
||||
def ensure_strings(path: pathlib.Path) -> None:
|
||||
text = path.read_text(encoding="utf-8")
|
||||
if "connectivity_check_title" in text:
|
||||
return
|
||||
path.write_text(text.replace("</resources>", STRINGS + "</resources>", 1), encoding="utf-8")
|
||||
|
||||
|
||||
def wire_fragment(path: pathlib.Path) -> None:
|
||||
text = path.read_text(encoding="utf-8")
|
||||
if "ConnectivityCheckPreferenceController" in text:
|
||||
return
|
||||
if "controllers.add(privateDnsPreferenceController);" not in text:
|
||||
raise SystemExit("FAIL: expected PrivateDns add site missing")
|
||||
text = text.replace(
|
||||
"controllers.add(privateDnsPreferenceController);",
|
||||
"controllers.add(privateDnsPreferenceController);\n"
|
||||
f" // {MARKER}\n"
|
||||
" controllers.add(new ConnectivityCheckPreferenceController(context));",
|
||||
1,
|
||||
)
|
||||
path.write_text(text, encoding="utf-8")
|
||||
|
||||
|
||||
def main() -> int:
|
||||
root = pathlib.Path(sys.argv[1] if len(sys.argv) > 1 else ".")
|
||||
here = pathlib.Path(__file__).resolve().parent
|
||||
src = here / "ConnectivityCheckPreferenceController.java"
|
||||
dst = root / (
|
||||
"packages/apps/Settings/src/com/android/settings/network/"
|
||||
"ConnectivityCheckPreferenceController.java"
|
||||
)
|
||||
arrays = root / "packages/apps/Settings/res/values/arrays.xml"
|
||||
# Prefer cm_strings for non-translated titles; fall back to strings.xml end
|
||||
cm = root / "packages/apps/Settings/res/values/cm_strings.xml"
|
||||
frag = root / (
|
||||
"packages/apps/Settings/src/com/android/settings/network/NetworkDashboardFragment.java"
|
||||
)
|
||||
for p in (src, arrays, cm, frag):
|
||||
if not p.is_file():
|
||||
print(f"FAIL: missing {p}", file=sys.stderr)
|
||||
return 1
|
||||
|
||||
if dst.is_file() and MARKER.split("-")[0] and "sans axp" in dst.read_text(encoding="utf-8"):
|
||||
# already copied
|
||||
pass
|
||||
else:
|
||||
dst.parent.mkdir(parents=True, exist_ok=True)
|
||||
shutil.copy2(src, dst)
|
||||
|
||||
ensure_arrays(arrays)
|
||||
ensure_strings(cm)
|
||||
wire_fragment(frag)
|
||||
print(f"OK: connectivity check wired -> {dst}")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
@@ -0,0 +1,52 @@
|
||||
#!/usr/bin/env python3
|
||||
"""009: allow classic Disable for non-system apps (A16 Archive era).
|
||||
|
||||
LOS AppDisableButton returns null for !isSystemApp. Graphene/AXP-class UX
|
||||
keeps Disable usable for user apps. Attribute: AXP/owner preference over Archive.
|
||||
Idempotent.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import pathlib
|
||||
import sys
|
||||
|
||||
MARKER = "sunfish-a16-009-disable-user-apps"
|
||||
|
||||
CANDIDATES = [
|
||||
pathlib.Path("packages/apps/Settings/src/com/android/settings/spa/app/appinfo/AppDisableButton.kt"),
|
||||
]
|
||||
|
||||
|
||||
def main() -> int:
|
||||
root = pathlib.Path(sys.argv[1] if len(sys.argv) > 1 else ".")
|
||||
path = None
|
||||
for rel in CANDIDATES:
|
||||
p = root / rel
|
||||
if p.is_file():
|
||||
path = p
|
||||
break
|
||||
if path is None:
|
||||
print("FAIL: AppDisableButton.kt not found", file=sys.stderr)
|
||||
return 1
|
||||
|
||||
text = path.read_text(encoding="utf-8")
|
||||
if MARKER in text:
|
||||
print(f"OK: already applied ({path})")
|
||||
return 0
|
||||
|
||||
old = " if (!app.isSystemApp) return null\n"
|
||||
if old not in text:
|
||||
print("FAIL: expected isSystemApp gate not found", file=sys.stderr)
|
||||
return 2
|
||||
|
||||
new = (
|
||||
f" // {MARKER}: allow Disable for user apps (not only system)\n"
|
||||
f" // if (!app.isSystemApp) return null\n"
|
||||
)
|
||||
path.write_text(text.replace(old, new, 1), encoding="utf-8")
|
||||
print(f"OK: patched {path}")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
+161
@@ -0,0 +1,161 @@
|
||||
#!/usr/bin/env python3
|
||||
"""US-S4-2 — drop Lineage Jelly + Gallery2 to match AXP.OS PRO product surface.
|
||||
|
||||
Oracle: AXP.OS-22.2-20260324-PRO-sunfish.zip product/app has neither Jelly nor
|
||||
Gallery2 (browser stub + FossifyGallery_FD live on system_ext). See
|
||||
docs/009-axp-pro-product-apps-20260324.md.
|
||||
|
||||
FossifyGallery already declares LOCAL_OVERRIDES_PACKAGES := Gallery Gallery2
|
||||
Glimpse, but Gallery2 still landed in product/app on the 162840Z ship — same
|
||||
class of failure as OpenSSH filter-out. Patch the Lineage PRODUCT_PACKAGES
|
||||
add sites and add belt-and-suspenders stubs.
|
||||
|
||||
Usage (from ANDROID_BUILD_TOP):
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_drop_jelly_gallery2.py
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
MARKER = "sunfish-a16-009-uss4-2-jelly-gallery2"
|
||||
|
||||
# Common Lineage shapes (tolerant).
|
||||
JELLY_BLOCK = re.compile(
|
||||
r"# Browser\n"
|
||||
r"PRODUCT_PACKAGES \+= \\\n"
|
||||
r" Jelly\n",
|
||||
re.MULTILINE,
|
||||
)
|
||||
|
||||
# ExactCalculator + Jelly list (common Lineage shape) → keep ExactCalculator only.
|
||||
JELLY_WITH_CALC = re.compile(
|
||||
r"(PRODUCT_PACKAGES \+= \\\n"
|
||||
r" ExactCalculator) \\\n"
|
||||
r" Jelly\n",
|
||||
re.MULTILINE,
|
||||
)
|
||||
|
||||
GALLERY2_IN_LIST = re.compile(
|
||||
r"( DeskClock \\\n)"
|
||||
r" Gallery2 \\\n",
|
||||
re.MULTILINE,
|
||||
)
|
||||
|
||||
|
||||
def patch_text(text: str, path: Path) -> tuple[str, list[str]]:
|
||||
notes: list[str] = []
|
||||
bad = f"# Jelly stripped ({MARKER})" in text or f"# Gallery2 stripped ({MARKER})" in text
|
||||
has_pkg = bool(re.search(r"(?m)^[ \t]*Jelly( \\)?$", text)) or bool(
|
||||
re.search(r"(?m)^[ \t]*Gallery2( \\)?$", text)
|
||||
)
|
||||
if MARKER in text and not bad and not has_pkg:
|
||||
notes.append("already")
|
||||
return text, notes
|
||||
|
||||
orig = text
|
||||
|
||||
text, n = JELLY_BLOCK.subn(
|
||||
f"# Browser (Jelly) omitted ({MARKER}) — AXP PRO uses noDefaultBrowserWebView\n",
|
||||
text,
|
||||
count=1,
|
||||
)
|
||||
if n:
|
||||
notes.append(f"jelly_block={n}")
|
||||
|
||||
text, n = JELLY_WITH_CALC.subn(
|
||||
rf"\1\n",
|
||||
text,
|
||||
count=1,
|
||||
)
|
||||
if n:
|
||||
notes.append(f"jelly_calc={n}")
|
||||
|
||||
text, n = GALLERY2_IN_LIST.subn(
|
||||
rf"\1",
|
||||
text,
|
||||
count=1,
|
||||
)
|
||||
if n:
|
||||
notes.append(f"gallery2_list={n}")
|
||||
|
||||
# Remove leftover broken comment-only continuations from older applicator.
|
||||
text2 = re.sub(
|
||||
r"^[ \t]*# (?:Jelly|Gallery2) stripped \(" + re.escape(MARKER) + r"\)\n",
|
||||
"",
|
||||
text,
|
||||
flags=re.MULTILINE,
|
||||
)
|
||||
if text2 != text:
|
||||
notes.append("scrub_bad_comments")
|
||||
text = text2
|
||||
|
||||
if text == orig and not notes:
|
||||
return orig, notes
|
||||
if MARKER not in text and text != orig:
|
||||
text = f"# {MARKER}\n" + text
|
||||
return text, notes
|
||||
|
||||
|
||||
def main() -> int:
|
||||
top = Path(os.environ.get("ANDROID_BUILD_TOP", ".")).resolve()
|
||||
candidates = [
|
||||
top / "vendor/lineage/config/common.mk",
|
||||
top / "vendor/lineage/config/common_mobile.mk",
|
||||
top / "vendor/lineage/config/common_full.mk",
|
||||
top / "vendor/lineage/config/telephony.mk",
|
||||
top / "build/make/target/product/handheld_product.mk",
|
||||
top / "build/make/target/product/handheld_system.mk",
|
||||
top / "build/make/target/product/generic_system.mk",
|
||||
]
|
||||
# Also scan device trees that often force Gallery2
|
||||
for p in (top / "device").rglob("*.mk") if (top / "device").is_dir() else []:
|
||||
if p.name in ("device.mk", "lineage.mk", "lineage_sunfish.mk", "aosp_sunfish.mk"):
|
||||
candidates.append(p)
|
||||
|
||||
touched = 0
|
||||
still_present = []
|
||||
for mk in candidates:
|
||||
if not mk.is_file():
|
||||
continue
|
||||
text = mk.read_text(encoding="utf-8", errors="replace")
|
||||
if "Jelly" not in text and "Gallery2" not in text:
|
||||
continue
|
||||
# Ignore mention-only in comments/docs after a clean strip.
|
||||
has_pkg = bool(re.search(r"(?m)^[ \t]*Jelly( \\)?$", text)) or bool(
|
||||
re.search(r"(?m)^[ \t]*Gallery2( \\)?$", text)
|
||||
)
|
||||
bad = f"# Jelly stripped ({MARKER})" in text or f"# Gallery2 stripped ({MARKER})" in text
|
||||
if not has_pkg and not bad:
|
||||
continue
|
||||
new, notes = patch_text(text, mk)
|
||||
if notes == ["already"]:
|
||||
print(f"OK: already applied ({mk})")
|
||||
touched += 1
|
||||
continue
|
||||
if new == text:
|
||||
print(f"WARN: {mk} mentions Jelly/Gallery2 but no pattern matched: {notes}")
|
||||
still_present.append(str(mk))
|
||||
continue
|
||||
mk.write_text(new, encoding="utf-8")
|
||||
print(f"OK: patched {mk} ({', '.join(notes)})")
|
||||
touched += 1
|
||||
|
||||
if still_present:
|
||||
print(
|
||||
"FAIL: Jelly/Gallery2 still present, patterns missed: "
|
||||
+ ", ".join(still_present),
|
||||
file=sys.stderr,
|
||||
)
|
||||
return 1
|
||||
if touched == 0:
|
||||
print("OK: Jelly/Gallery2 already absent from PRODUCT_PACKAGES sites")
|
||||
return 0
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
+99
@@ -0,0 +1,99 @@
|
||||
#!/usr/bin/env python3
|
||||
"""US-S4-1 — strip OpenSSH/rsync/procmem packages from Lineage common.mk.
|
||||
|
||||
AXP.OS PRO sunfish (A15) product/system lack sshd/ssh/rsync/procmem binaries but
|
||||
still ship init.openssh.rc. PRODUCT_PACKAGES filter-out via inherit-product did
|
||||
*not* remove them from the 20261002T125259Z ship image — patch the source block
|
||||
instead (same place Lineage adds them).
|
||||
|
||||
Keeps PRODUCT_COPY_FILES for init.openssh.rc (AXP surface).
|
||||
|
||||
Usage:
|
||||
python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_drop_openssh_packages.py
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
MARKER = "sunfish-a16-009-uss4-openssh"
|
||||
|
||||
OPENSSH_PACKAGES = re.compile(
|
||||
r"# Openssh\n"
|
||||
r"PRODUCT_PACKAGES \+= \\\n"
|
||||
r"(?: \S+ \\\n)*"
|
||||
r" start-ssh\n",
|
||||
re.MULTILINE,
|
||||
)
|
||||
|
||||
RSYNC_PACKAGES = re.compile(
|
||||
r"# rsync\n"
|
||||
r"PRODUCT_PACKAGES \+= \\\n"
|
||||
r" rsync\n",
|
||||
re.MULTILINE,
|
||||
)
|
||||
|
||||
PROCMEM_DEBUG = re.compile(
|
||||
r"# These packages are excluded from user builds\n"
|
||||
r"PRODUCT_PACKAGES_DEBUG \+= \\\n"
|
||||
r" procmem\n"
|
||||
r"\n"
|
||||
r"ifneq \(\$\(TARGET_BUILD_VARIANT\),user\)\n"
|
||||
r"PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST \+= \\\n"
|
||||
r" system/bin/procmem\n"
|
||||
r"endif\n",
|
||||
re.MULTILINE,
|
||||
)
|
||||
|
||||
|
||||
def main() -> int:
|
||||
top = Path(os.environ.get("ANDROID_BUILD_TOP", ".")).resolve()
|
||||
mk = top / "vendor/lineage/config/common.mk"
|
||||
if not mk.is_file():
|
||||
print(f"FAIL: missing {mk}", file=sys.stderr)
|
||||
return 1
|
||||
text = mk.read_text()
|
||||
if MARKER in text:
|
||||
print(f"OK: already applied ({mk})")
|
||||
return 0
|
||||
|
||||
orig = text
|
||||
text, n1 = OPENSSH_PACKAGES.subn(
|
||||
f"# Openssh packages stripped ({MARKER}) — keep init.openssh.rc below\n",
|
||||
text,
|
||||
count=1,
|
||||
)
|
||||
text, n2 = RSYNC_PACKAGES.subn(
|
||||
f"# rsync stripped ({MARKER})\n",
|
||||
text,
|
||||
count=1,
|
||||
)
|
||||
text, n3 = PROCMEM_DEBUG.subn(
|
||||
f"# procmem debug package stripped ({MARKER})\n",
|
||||
text,
|
||||
count=1,
|
||||
)
|
||||
if n1 != 1 or n2 != 1:
|
||||
print(
|
||||
f"FAIL: Openssh/rsync block match n1={n1} n2={n2} n3={n3}",
|
||||
file=sys.stderr,
|
||||
)
|
||||
return 1
|
||||
# procmem block optional if layout drifted
|
||||
if n3 == 0:
|
||||
print("WARN: procmem debug block not matched (layout drift)")
|
||||
|
||||
if "init.openssh.rc" not in text:
|
||||
print("FAIL: init.openssh.rc COPY_FILES missing after patch", file=sys.stderr)
|
||||
return 1
|
||||
|
||||
mk.write_text(text)
|
||||
print(f"OK: patched {mk} (openssh_pkgs={n1} rsync={n2} procmem={n3})")
|
||||
return 0 if text != orig else 1
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
+498
@@ -0,0 +1,498 @@
|
||||
#!/usr/bin/env python3
|
||||
"""009: expand Private DNS presets to AXP GOLDEN list (no axp.os).
|
||||
|
||||
Clones GOLDEN Settings radios/hostnames into LOS PrivateDnsModeDialogPreference
|
||||
(which already has a Cloudflare stub). Idempotent via marker comments.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import pathlib
|
||||
import re
|
||||
import sys
|
||||
|
||||
MARKER = "sunfish-a16-009-private-dns"
|
||||
|
||||
# key, UI label, DoT hostname — GOLDEN order (cloudflare hostname = security.*)
|
||||
PROVIDERS = [
|
||||
("adguard", "AdGuard (CT)", "dns.adguard.com"),
|
||||
("appliedprivacy", "AppliedPrivacy (AT)", "dot1.applied-privacy.net"),
|
||||
("cira", "CIRA (CA)", "protected.canadianshield.cira.ca"),
|
||||
("controld", "Control D (CA)", "p2.freedns.controld.com"),
|
||||
("cleanbrowsing", "CleanBrowsing (US)", "security-filter-dns.cleanbrowsing.org"),
|
||||
("cznic", "CZ.NIC (CZ)", "odvr.nic.cz"),
|
||||
("cloudflare", "Cloudflare (US)", "security.cloudflare-dns.com"),
|
||||
("dnszero", "DNS0 (FR)", "zero.dns0.eu"),
|
||||
("dnssb", "DNS.SB (DE)", "dot.sb"),
|
||||
("google", "Google (US)", "dns.google"),
|
||||
("mullvad", "Mullvad (SE)", "base.dns.mullvad.net"),
|
||||
("quadnine", "Quad9 (CH)", "dns.quad9.net"),
|
||||
("restena", "Restena (LU)", "kaitain.restena.lu"),
|
||||
("switch", "SWITCH (CH)", "dns.switch.ch"),
|
||||
("uncensoreddns", "UncensoredDNS (DK)", "anycast.censurfridns.dk"),
|
||||
]
|
||||
|
||||
|
||||
def patch_layout(path: pathlib.Path) -> bool:
|
||||
text = path.read_text(encoding="utf-8")
|
||||
if MARKER in text:
|
||||
return False
|
||||
# Insert provider radios after off, before opportunistic (keep provider+hostname)
|
||||
includes = []
|
||||
for key, _, _ in PROVIDERS:
|
||||
includes.append(
|
||||
f' <!-- {MARKER} -->\n'
|
||||
f' <include\n'
|
||||
f' android:id="@+id/private_dns_mode_{key}"\n'
|
||||
f' layout="@layout/preference_widget_dialog_radiobutton"/>\n'
|
||||
)
|
||||
block = "".join(includes)
|
||||
# Remove ALL existing cloudflare includes (re-added once via PROVIDERS)
|
||||
text2 = re.sub(
|
||||
r'\s*(?:<!--.*?-->\s*)?<include\s*\n\s*android:id="@\+id/private_dns_mode_cloudflare"\s*\n\s*layout="@layout/preference_widget_dialog_radiobutton"/>\s*',
|
||||
"\n",
|
||||
text,
|
||||
flags=re.DOTALL,
|
||||
)
|
||||
text2 = re.sub(
|
||||
r'\s*<include\s+android:id="@\+id/private_dns_mode_cloudflare"[^/]*/>\s*',
|
||||
"\n",
|
||||
text2,
|
||||
)
|
||||
needle = (
|
||||
' <include\n'
|
||||
' android:id="@+id/private_dns_mode_opportunistic"\n'
|
||||
' layout="@layout/preference_widget_dialog_radiobutton"/>'
|
||||
)
|
||||
if needle not in text2:
|
||||
# alternate formatting
|
||||
needle = 'android:id="@+id/private_dns_mode_opportunistic"'
|
||||
idx = text2.find(needle)
|
||||
if idx < 0:
|
||||
raise SystemExit(f"FAIL: opportunistic radio not in {path}")
|
||||
# find start of include element
|
||||
start = text2.rfind("<include", 0, idx)
|
||||
text2 = text2[:start] + block + text2[start:]
|
||||
else:
|
||||
text2 = text2.replace(needle, block + needle, 1)
|
||||
path.write_text(text2, encoding="utf-8")
|
||||
return True
|
||||
|
||||
|
||||
def patch_cm_strings(path: pathlib.Path) -> bool:
|
||||
text = path.read_text(encoding="utf-8")
|
||||
if MARKER in text and "private_dns_hostname_quadnine" in text:
|
||||
return False
|
||||
# Replace/extend cloudflare hostname to GOLDEN security.cloudflare-dns.com
|
||||
text = re.sub(
|
||||
r'<string name="private_dns_hostname_cloudflare"[^>]*>.*?</string>',
|
||||
'<string name="private_dns_hostname_cloudflare" translatable="false">'
|
||||
"security.cloudflare-dns.com</string>",
|
||||
text,
|
||||
count=1,
|
||||
)
|
||||
text = re.sub(
|
||||
r'<string name="private_dns_mode_cloudflare"[^>]*>.*?</string>',
|
||||
'<string name="private_dns_mode_cloudflare" translatable="false">'
|
||||
"Cloudflare (US)</string>",
|
||||
text,
|
||||
count=1,
|
||||
)
|
||||
lines = [f" <!-- {MARKER}: AXP GOLDEN Private DNS presets -->"]
|
||||
for key, label, host in PROVIDERS:
|
||||
if key == "cloudflare":
|
||||
continue # already present
|
||||
lines.append(
|
||||
f' <string name="private_dns_mode_{key}" translatable="false">{label}</string>'
|
||||
)
|
||||
lines.append(
|
||||
f' <string name="private_dns_hostname_{key}" translatable="false">{host}</string>'
|
||||
)
|
||||
insert = "\n".join(lines) + "\n"
|
||||
if "</resources>" not in text:
|
||||
raise SystemExit(f"FAIL: no </resources> in {path}")
|
||||
text = text.replace("</resources>", insert + "</resources>", 1)
|
||||
path.write_text(text, encoding="utf-8")
|
||||
return True
|
||||
|
||||
|
||||
def write_preference_java(path: pathlib.Path) -> None:
|
||||
"""Rewrite PrivateDnsModeDialogPreference with data-driven GOLDEN presets."""
|
||||
# Keep copyright / package; replace body after class declaration via full file.
|
||||
providers_java = ",\n".join(
|
||||
f' new Provider("{key}", R.id.private_dns_mode_{key}, '
|
||||
f"R.string.private_dns_mode_{key}, R.string.private_dns_hostname_{key})"
|
||||
for key, _, _ in PROVIDERS
|
||||
)
|
||||
# Assign custom mode ints starting at 4 (LOS cloudflare used 4)
|
||||
mode_consts = "\n".join(
|
||||
f" private static final int PRIVATE_DNS_MODE_{key.upper()} = {4 + i};"
|
||||
for i, (key, _, _) in enumerate(PROVIDERS)
|
||||
)
|
||||
map_puts = "\n".join(
|
||||
f" PRIVATE_DNS_MAP.put(PRIVATE_DNS_MODE_{key.upper()}, "
|
||||
f"R.id.private_dns_mode_{key});"
|
||||
for key, _, _ in PROVIDERS
|
||||
)
|
||||
content = f'''/*
|
||||
* Copyright (C) 2017 The Android Open Source Project
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package com.android.settings.network;
|
||||
|
||||
import static android.net.ConnectivitySettingsManager.PRIVATE_DNS_MODE_OFF;
|
||||
import static android.net.ConnectivitySettingsManager.PRIVATE_DNS_MODE_OPPORTUNISTIC;
|
||||
import static android.net.ConnectivitySettingsManager.PRIVATE_DNS_MODE_PROVIDER_HOSTNAME;
|
||||
|
||||
import static com.android.settingslib.RestrictedLockUtils.EnforcedAdmin;
|
||||
|
||||
import android.app.Dialog;
|
||||
import android.app.settings.SettingsEnums;
|
||||
import android.content.ActivityNotFoundException;
|
||||
import android.content.Context;
|
||||
import android.content.DialogInterface;
|
||||
import android.content.Intent;
|
||||
import android.net.ConnectivitySettingsManager;
|
||||
import android.os.UserHandle;
|
||||
import android.os.UserManager;
|
||||
import android.text.Editable;
|
||||
import android.text.TextWatcher;
|
||||
import android.text.method.LinkMovementMethod;
|
||||
import android.util.AttributeSet;
|
||||
import android.util.Log;
|
||||
import android.view.View;
|
||||
import android.widget.Button;
|
||||
import android.widget.EditText;
|
||||
import android.widget.RadioButton;
|
||||
import android.widget.RadioGroup;
|
||||
import android.widget.TextView;
|
||||
|
||||
import androidx.annotation.VisibleForTesting;
|
||||
import androidx.appcompat.app.AlertDialog;
|
||||
import androidx.preference.PreferenceViewHolder;
|
||||
|
||||
import com.android.settings.R;
|
||||
import com.android.settings.overlay.FeatureFactory;
|
||||
import com.android.settings.utils.AnnotationSpan;
|
||||
import com.android.settingslib.CustomDialogPreferenceCompat;
|
||||
import com.android.settingslib.HelpUtils;
|
||||
import com.android.settingslib.RestrictedLockUtils;
|
||||
import com.android.settingslib.RestrictedLockUtilsInternal;
|
||||
|
||||
import com.google.android.material.textfield.TextInputLayout;
|
||||
import com.google.common.net.InternetDomainName;
|
||||
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
|
||||
/**
|
||||
* Dialog to set the Private DNS.
|
||||
* {MARKER}: AXP GOLDEN provider presets (hostnames from GOLDEN Settings.apk).
|
||||
*/
|
||||
public class PrivateDnsModeDialogPreference extends CustomDialogPreferenceCompat implements
|
||||
RadioGroup.OnCheckedChangeListener, TextWatcher {{
|
||||
|
||||
public static final String ANNOTATION_URL = "url";
|
||||
|
||||
private static final String TAG = "PrivateDnsModeDialog";
|
||||
private static final Map<Integer, Integer> PRIVATE_DNS_MAP;
|
||||
|
||||
{mode_consts}
|
||||
|
||||
private static final Provider[] PROVIDERS = new Provider[] {{
|
||||
{providers_java}
|
||||
}};
|
||||
|
||||
static {{
|
||||
PRIVATE_DNS_MAP = new HashMap<>();
|
||||
PRIVATE_DNS_MAP.put(PRIVATE_DNS_MODE_OFF, R.id.private_dns_mode_off);
|
||||
PRIVATE_DNS_MAP.put(PRIVATE_DNS_MODE_OPPORTUNISTIC, R.id.private_dns_mode_opportunistic);
|
||||
PRIVATE_DNS_MAP.put(PRIVATE_DNS_MODE_PROVIDER_HOSTNAME, R.id.private_dns_mode_provider);
|
||||
{map_puts}
|
||||
}}
|
||||
|
||||
private static final class Provider {{
|
||||
final String key;
|
||||
final int radioId;
|
||||
final int labelRes;
|
||||
final int hostnameRes;
|
||||
|
||||
Provider(String key, int radioId, int labelRes, int hostnameRes) {{
|
||||
this.key = key;
|
||||
this.radioId = radioId;
|
||||
this.labelRes = labelRes;
|
||||
this.hostnameRes = hostnameRes;
|
||||
}}
|
||||
}}
|
||||
|
||||
@VisibleForTesting
|
||||
TextInputLayout mHostnameLayout;
|
||||
@VisibleForTesting
|
||||
EditText mHostnameText;
|
||||
@VisibleForTesting
|
||||
RadioGroup mRadioGroup;
|
||||
@VisibleForTesting
|
||||
int mMode;
|
||||
|
||||
public PrivateDnsModeDialogPreference(Context context) {{
|
||||
super(context);
|
||||
}}
|
||||
|
||||
public PrivateDnsModeDialogPreference(Context context, AttributeSet attrs) {{
|
||||
super(context, attrs);
|
||||
}}
|
||||
|
||||
public PrivateDnsModeDialogPreference(Context context, AttributeSet attrs, int defStyleAttr) {{
|
||||
super(context, attrs, defStyleAttr);
|
||||
}}
|
||||
|
||||
public PrivateDnsModeDialogPreference(Context context, AttributeSet attrs, int defStyleAttr,
|
||||
int defStyleRes) {{
|
||||
super(context, attrs, defStyleAttr, defStyleRes);
|
||||
}}
|
||||
|
||||
private final AnnotationSpan.LinkInfo mUrlLinkInfo = new AnnotationSpan.LinkInfo(
|
||||
ANNOTATION_URL, (widget) -> {{
|
||||
final Context context = widget.getContext();
|
||||
final Intent intent = HelpUtils.getHelpIntent(context,
|
||||
context.getString(R.string.help_uri_private_dns),
|
||||
context.getClass().getName());
|
||||
if (intent != null) {{
|
||||
try {{
|
||||
widget.startActivityForResult(intent, 0);
|
||||
}} catch (ActivityNotFoundException e) {{
|
||||
Log.w(TAG, "Activity was not found for intent, " + intent.toString());
|
||||
}}
|
||||
}}
|
||||
}});
|
||||
|
||||
private static int modeForRadioId(int radioId) {{
|
||||
if (radioId == R.id.private_dns_mode_off) return PRIVATE_DNS_MODE_OFF;
|
||||
if (radioId == R.id.private_dns_mode_opportunistic) return PRIVATE_DNS_MODE_OPPORTUNISTIC;
|
||||
if (radioId == R.id.private_dns_mode_provider) return PRIVATE_DNS_MODE_PROVIDER_HOSTNAME;
|
||||
for (int i = 0; i < PROVIDERS.length; i++) {{
|
||||
if (PROVIDERS[i].radioId == radioId) {{
|
||||
return 4 + i;
|
||||
}}
|
||||
}}
|
||||
return PRIVATE_DNS_MODE_OPPORTUNISTIC;
|
||||
}}
|
||||
|
||||
private static Provider providerForMode(int mode) {{
|
||||
int idx = mode - 4;
|
||||
if (idx >= 0 && idx < PROVIDERS.length) {{
|
||||
return PROVIDERS[idx];
|
||||
}}
|
||||
return null;
|
||||
}}
|
||||
|
||||
@Override
|
||||
public void onBindViewHolder(PreferenceViewHolder holder) {{
|
||||
super.onBindViewHolder(holder);
|
||||
if (isDisabledByAdmin()) {{
|
||||
holder.itemView.setEnabled(true);
|
||||
}}
|
||||
setSaveButtonListener();
|
||||
}}
|
||||
|
||||
@Override
|
||||
protected void onBindDialogView(View view) {{
|
||||
final Context context = getContext();
|
||||
mMode = ConnectivitySettingsManager.getPrivateDnsMode(context);
|
||||
if (mMode == PRIVATE_DNS_MODE_PROVIDER_HOSTNAME) {{
|
||||
final String host = ConnectivitySettingsManager.getPrivateDnsHostname(context);
|
||||
for (int i = 0; i < PROVIDERS.length; i++) {{
|
||||
if (host != null && host.equals(context.getString(PROVIDERS[i].hostnameRes))) {{
|
||||
mMode = 4 + i;
|
||||
break;
|
||||
}}
|
||||
}}
|
||||
}}
|
||||
mRadioGroup = view.findViewById(R.id.private_dns_radio_group);
|
||||
mRadioGroup.check(PRIVATE_DNS_MAP.getOrDefault(mMode, R.id.private_dns_mode_opportunistic));
|
||||
mRadioGroup.setOnCheckedChangeListener(this);
|
||||
|
||||
final RadioButton offRadioButton = view.findViewById(R.id.private_dns_mode_off);
|
||||
offRadioButton.setText(com.android.settingslib.R.string.private_dns_mode_off);
|
||||
for (Provider p : PROVIDERS) {{
|
||||
final RadioButton rb = view.findViewById(p.radioId);
|
||||
if (rb != null) {{
|
||||
rb.setText(p.labelRes);
|
||||
}}
|
||||
}}
|
||||
final RadioButton opportunisticRadioButton =
|
||||
view.findViewById(R.id.private_dns_mode_opportunistic);
|
||||
opportunisticRadioButton.setText(
|
||||
com.android.settingslib.R.string.private_dns_mode_opportunistic);
|
||||
final RadioButton providerRadioButton = view.findViewById(R.id.private_dns_mode_provider);
|
||||
providerRadioButton.setText(com.android.settingslib.R.string.private_dns_mode_provider);
|
||||
|
||||
mHostnameLayout = view.findViewById(R.id.private_dns_mode_provider_hostname_layout);
|
||||
mHostnameText = view.findViewById(R.id.private_dns_mode_provider_hostname);
|
||||
if (mHostnameText != null) {{
|
||||
mHostnameText.setText(ConnectivitySettingsManager.getPrivateDnsHostname(context));
|
||||
mHostnameText.addTextChangedListener(this);
|
||||
}}
|
||||
|
||||
final TextView helpTextView = view.findViewById(R.id.private_dns_help_info);
|
||||
helpTextView.setMovementMethod(LinkMovementMethod.getInstance());
|
||||
final Intent helpIntent = HelpUtils.getHelpIntent(context,
|
||||
context.getString(R.string.help_uri_private_dns),
|
||||
context.getClass().getName());
|
||||
final AnnotationSpan.LinkInfo linkInfo = new AnnotationSpan.LinkInfo(context,
|
||||
ANNOTATION_URL, helpIntent);
|
||||
if (linkInfo.isActionable()) {{
|
||||
helpTextView.setText(AnnotationSpan.linkify(
|
||||
context.getText(R.string.private_dns_help_message), linkInfo));
|
||||
}} else {{
|
||||
helpTextView.setText("");
|
||||
}}
|
||||
|
||||
updateDialogInfo();
|
||||
}}
|
||||
|
||||
@Override
|
||||
public void onCheckedChanged(RadioGroup group, int checkedId) {{
|
||||
mMode = modeForRadioId(checkedId);
|
||||
updateDialogInfo();
|
||||
}}
|
||||
|
||||
@Override
|
||||
public void beforeTextChanged(CharSequence s, int start, int count, int after) {{
|
||||
}}
|
||||
|
||||
@Override
|
||||
public void onTextChanged(CharSequence s, int start, int before, int count) {{
|
||||
}}
|
||||
|
||||
@Override
|
||||
public void afterTextChanged(Editable s) {{
|
||||
updateDialogInfo();
|
||||
}}
|
||||
|
||||
@Override
|
||||
public void performClick() {{
|
||||
EnforcedAdmin enforcedAdmin = getEnforcedAdmin();
|
||||
if (enforcedAdmin == null) {{
|
||||
super.performClick();
|
||||
}} else {{
|
||||
RestrictedLockUtils.sendShowAdminSupportDetailsIntent(getContext(), enforcedAdmin);
|
||||
}}
|
||||
}}
|
||||
|
||||
private EnforcedAdmin getEnforcedAdmin() {{
|
||||
return RestrictedLockUtilsInternal.checkIfRestrictionEnforced(
|
||||
getContext(), UserManager.DISALLOW_CONFIG_PRIVATE_DNS, UserHandle.myUserId());
|
||||
}}
|
||||
|
||||
private boolean isDisabledByAdmin() {{
|
||||
return getEnforcedAdmin() != null;
|
||||
}}
|
||||
|
||||
private void updateDialogInfo() {{
|
||||
final boolean modeProvider = PRIVATE_DNS_MODE_PROVIDER_HOSTNAME == mMode;
|
||||
if (mHostnameLayout != null) {{
|
||||
mHostnameLayout.setEnabled(modeProvider);
|
||||
mHostnameLayout.setErrorEnabled(false);
|
||||
}}
|
||||
}}
|
||||
|
||||
private void setSaveButtonListener() {{
|
||||
View.OnClickListener onClickListener = v -> doSaveButton();
|
||||
DialogInterface.OnShowListener onShowListener = dialog -> {{
|
||||
if (dialog == null) {{
|
||||
Log.e(TAG, "The DialogInterface is null!");
|
||||
return;
|
||||
}}
|
||||
Button saveButton = ((AlertDialog) dialog).getButton(DialogInterface.BUTTON_POSITIVE);
|
||||
if (saveButton == null) {{
|
||||
Log.e(TAG, "Can't get the save button!");
|
||||
return;
|
||||
}}
|
||||
saveButton.setOnClickListener(onClickListener);
|
||||
}};
|
||||
setOnShowListener(onShowListener);
|
||||
}}
|
||||
|
||||
@VisibleForTesting
|
||||
void doSaveButton() {{
|
||||
Context context = getContext();
|
||||
int modeToSet = mMode;
|
||||
Provider preset = providerForMode(mMode);
|
||||
if (preset != null) {{
|
||||
ConnectivitySettingsManager.setPrivateDnsHostname(context,
|
||||
context.getString(preset.hostnameRes));
|
||||
modeToSet = PRIVATE_DNS_MODE_PROVIDER_HOSTNAME;
|
||||
}} else if (mMode == PRIVATE_DNS_MODE_PROVIDER_HOSTNAME) {{
|
||||
if (mHostnameLayout == null || mHostnameText == null) {{
|
||||
Log.e(TAG, "Can't find hostname resources!");
|
||||
return;
|
||||
}}
|
||||
if (mHostnameText.getText().isEmpty()) {{
|
||||
mHostnameLayout.setError(context.getString(R.string.private_dns_field_require));
|
||||
Log.w(TAG, "The hostname is empty!");
|
||||
return;
|
||||
}}
|
||||
if (!InternetDomainName.isValid(mHostnameText.getText().toString())) {{
|
||||
mHostnameLayout.setError(context.getString(R.string.private_dns_hostname_invalid));
|
||||
Log.w(TAG, "The hostname is invalid!");
|
||||
return;
|
||||
}}
|
||||
ConnectivitySettingsManager.setPrivateDnsHostname(context,
|
||||
mHostnameText.getText().toString());
|
||||
}}
|
||||
|
||||
ConnectivitySettingsManager.setPrivateDnsMode(context, modeToSet);
|
||||
FeatureFactory.getFeatureFactory().getMetricsFeatureProvider()
|
||||
.action(context, SettingsEnums.ACTION_PRIVATE_DNS_MODE, modeToSet);
|
||||
Dialog dialog = getDialog();
|
||||
if (dialog != null) {{
|
||||
dialog.dismiss();
|
||||
}}
|
||||
}}
|
||||
}}
|
||||
'''
|
||||
# Fix f-string doubled braces - we used {{ for literal braces in the template
|
||||
# But MARKER was intended as comment - replace
|
||||
content = content.replace("{MARKER}", MARKER)
|
||||
path.write_text(content, encoding="utf-8")
|
||||
|
||||
|
||||
def main() -> int:
|
||||
root = pathlib.Path(sys.argv[1] if len(sys.argv) > 1 else ".")
|
||||
layout = root / "packages/apps/Settings/res/layout/private_dns_mode_dialog.xml"
|
||||
cm = root / "packages/apps/Settings/res/values/cm_strings.xml"
|
||||
java = root / (
|
||||
"packages/apps/Settings/src/com/android/settings/network/"
|
||||
"PrivateDnsModeDialogPreference.java"
|
||||
)
|
||||
for p in (layout, cm, java):
|
||||
if not p.is_file():
|
||||
print(f"FAIL: missing {p}", file=sys.stderr)
|
||||
return 1
|
||||
|
||||
if MARKER in java.read_text(encoding="utf-8") and "quadnine" in layout.read_text(
|
||||
encoding="utf-8"
|
||||
):
|
||||
print("OK: private DNS already applied")
|
||||
return 0
|
||||
|
||||
patch_layout(layout)
|
||||
patch_cm_strings(cm)
|
||||
write_preference_java(java)
|
||||
print(f"OK: private DNS providers applied ({len(PROVIDERS)} presets)")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
+41
@@ -0,0 +1,41 @@
|
||||
# Apply early TARGET_UNOFFICIAL_BUILD_ID to device product makefile.
|
||||
# Must run before breakfast: inherit-product of vendor/lineage parses version.mk
|
||||
# immediately; vendor/extra inherit-product is too late.
|
||||
#
|
||||
# Usage (on rom-dev01 tree):
|
||||
# python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_unofficial_build_id.py
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from pathlib import Path
|
||||
import os
|
||||
import sys
|
||||
|
||||
MARKER = "TARGET_UNOFFICIAL_BUILD_ID := AXP-Resurection-Pro"
|
||||
NEEDLE = "# Inherit some common Lineage stuff.\n"
|
||||
INSERT = (
|
||||
"# sunfish-a16: must precede vendor/lineage version.mk (via inherit below)\n"
|
||||
f"{MARKER}\n\n"
|
||||
)
|
||||
|
||||
|
||||
def main() -> int:
|
||||
top = Path(os.environ.get("ANDROID_BUILD_TOP", ".")).resolve()
|
||||
mk = top / "device/google/sunfish/lineage_sunfish.mk"
|
||||
if not mk.is_file():
|
||||
print(f"FAIL: missing {mk}", file=sys.stderr)
|
||||
return 1
|
||||
text = mk.read_text()
|
||||
if MARKER in text:
|
||||
print(f"OK: already applied ({mk})")
|
||||
return 0
|
||||
if NEEDLE not in text:
|
||||
print(f"FAIL: needle not found in {mk}", file=sys.stderr)
|
||||
return 1
|
||||
mk.write_text(text.replace(NEEDLE, INSERT + NEEDLE, 1))
|
||||
print(f"OK: patched {mk}")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
@@ -0,0 +1,67 @@
|
||||
# US-S4-1 — drop Lineage product OpenSSH binaries / rsync / procmem
|
||||
|
||||
**Track**: AXP Resurection Pro (Magisk), unlocked sunfish.
|
||||
**Not**: slim variant; not bootloader lock; not Yama (kernel).
|
||||
|
||||
## AXP reference (mandatory)
|
||||
|
||||
Oracle: `AXP.OS-22.2-20260324-PRO-sunfish.zip` → `payload.bin` → `product.img`
|
||||
(+ GOLDEN `ro.lineage.version=22.2-2026.003-sunfish-pro`, Android 15):
|
||||
|
||||
| Path | AXP PRO (A15) |
|
||||
|------|----------------|
|
||||
| `/bin/sshd`, `ssh`, `scp`, `sftp`, `ssh-keygen`, `start-ssh` | **absent** |
|
||||
| `/bin/rsync`, `/bin/procmem` | **absent** |
|
||||
| `/etc/init/init.openssh.rc` | **present** (`mkdir /data/ssh*`) |
|
||||
|
||||
### Was this an A16 Lineage add?
|
||||
|
||||
**No.** Lineage `vendor/lineage/config/common.mk` has shipped the Openssh
|
||||
block since 2012; lineage-20 / 21 / 22.2 all still include it. AXP PRO on
|
||||
A15 therefore **actively omitted** the binaries (same lineage generation
|
||||
still lists them upstream). Public `AXP.OS/android_vendor_lineage`
|
||||
`upstream_*` mirrors keep the Lineage Openssh block — use the **PRO zip /
|
||||
GOLDEN**, not that mirror, as product oracle.
|
||||
|
||||
## What we ship
|
||||
|
||||
Match AXP PRO product surface by stripping Lineage `common.mk` package
|
||||
adds (see `apply_009_drop_openssh_packages.py`) — a plain
|
||||
`PRODUCT_PACKAGES := $(filter-out …)` inherit did **not** drop `sshd` from
|
||||
ship `20261002T125259Z`:
|
||||
|
||||
- Remove packages: `scp`, `sftp`, `ssh`, `sshd`, `sshd_config`, `ssh-keygen`,
|
||||
`start-ssh`, `rsync`, `procmem` (debug)
|
||||
- **Keep** `init.openssh.rc` copy (AXP has it)
|
||||
|
||||
Remote shell / file transfer on this track remains **adb** (+ Magisk); the
|
||||
rc only creates `/data/ssh*` and does not start `sshd` without the binary.
|
||||
|
||||
## Verify (LAB after flash)
|
||||
|
||||
```text
|
||||
adb shell ls /product/bin/sshd # expect: No such file
|
||||
adb shell ls /product/bin/rsync # expect: No such file
|
||||
adb shell ls /product/etc/init/init.openssh.rc # expect: present (AXP)
|
||||
adb shell pidof magiskd # expect: non-empty
|
||||
```
|
||||
|
||||
## US-S4-2 — drop Jelly + Gallery2 (AXP PRO product)
|
||||
|
||||
**Oracle**: same PRO zip — `product/app` has **no** Jelly / Gallery2;
|
||||
`system_ext` ships Fossify + `noDefaultBrowserWebView`. Inventory:
|
||||
`docs/009-axp-pro-product-apps-20260324.md`.
|
||||
|
||||
- `apply_009_drop_jelly_gallery2.py` — remove Lineage `PRODUCT_PACKAGES`
|
||||
adds for Jelly / Gallery2
|
||||
- `NoLineageJelly` uninstallable override module (AXP stub class)
|
||||
- Keep `FossifyGallery` (already overrides Gallery/Gallery2/Glimpse)
|
||||
|
||||
LAB after flash: no `/product/app/Jelly`, no `/product/app/Gallery2`,
|
||||
FossifyGallery present.
|
||||
|
||||
## Out of scope
|
||||
|
||||
- `CONFIG_SECURITY_YAMA` (kernel / US-S5 — **done** on `162840Z`)
|
||||
- Switching lunch to `user` (US-S6)
|
||||
- NeoLauncher / Aosmium (wont / exception)
|
||||
@@ -0,0 +1,89 @@
|
||||
# 009 signing / AVB (userspace Gate G)
|
||||
|
||||
Clone AXP/GOLDEN posture: **`user` + `release-keys`**, device **unlocked**
|
||||
(`orange`). Not IOdes locked-bootloader.
|
||||
|
||||
Full checklist: `docs/009-hardening-signing-checklist.md`.
|
||||
|
||||
## Stages
|
||||
|
||||
| Stage | What |
|
||||
|-------|------|
|
||||
| US-S1 | Generate keys → `/srv/rom/secrets/android-certs/` |
|
||||
| US-S2 | Wire `PRODUCT_DEFAULT_DEV_CERTIFICATE` into bacon |
|
||||
| US-S3 | Project AVB key (`AVB_CUSTOM_KEY_PATH`); decide `WITH_AVB` |
|
||||
| US-S4+ | Userspace harden / CVE — separate patches |
|
||||
|
||||
## Generate (rom-dev01 only)
|
||||
|
||||
```bash
|
||||
# from synced repo copy or laptop scp of scripts/
|
||||
sudo -u android-build bash /srv/rom/src/lineage/vendor/sunfish-a16/../../../../\
|
||||
# prefer:
|
||||
bash /path/to/AXP_Resurection/scripts/009-generate-release-keys.sh
|
||||
```
|
||||
|
||||
Script writes under `/srv/rom/secrets/android-certs/` when that parent is
|
||||
writable, otherwise `$HOME/.android-certs` (Lineage default). On rom-dev01
|
||||
(2026-09-29) secrets/ is root-owned without group write → keys live in
|
||||
`/home/android-build/.android-certs/`. Refuses overwrite. Reminds about
|
||||
encrypted offline backup before first signed ship bacon.
|
||||
|
||||
## Wire (US-S2 — after keys exist)
|
||||
|
||||
In the bacon environment (not committed secrets):
|
||||
|
||||
```bash
|
||||
export PRODUCT_DEFAULT_DEV_CERTIFICATE=$HOME/.android-certs/releasekey
|
||||
# after root relocate: /srv/rom/secrets/android-certs/releasekey
|
||||
# lunch lineage_sunfish-userdebug # first signed build
|
||||
# later: lineage_sunfish-user
|
||||
```
|
||||
|
||||
`009-bacon-axp-stage1-combo4.sh` auto-exports when `$HOME/.android-certs/releasekey.pk8` exists.
|
||||
## AVB (US-S3)
|
||||
|
||||
Default tree falls back to AOSP `external/avb/test/data/testkey_rsa2048.pem`
|
||||
(and LAB has been observed with `testkey_rsa4096`) plus
|
||||
`BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --flags 3` unless `WITH_AVB=true`
|
||||
(`device/google/sunfish/BoardConfigLineage.mk`).
|
||||
|
||||
Project key generation is in `009-generate-release-keys.sh`
|
||||
(`avb.pem` + `avb_pkmd.bin`). **Wire in tree** (soong-safe path), not only env:
|
||||
|
||||
`vendor/sunfish-a16/BoardConfig.mk` sets `BOARD_AVB_KEY_PATH` /
|
||||
`BOARD_AVB_ALGORITHM=SHA256_RSA4096` when `certs/avb.pem` exists. Keep
|
||||
`WITH_AVB` unset → vbmeta **flags 3** =
|
||||
`HASHTREE_DISABLED|VERIFICATION_DISABLED` (libavb) → Magisk preroot on
|
||||
unlocked/orange. That is **signing infrastructure**, not runtime AVB harden.
|
||||
|
||||
Validate after bacon (script fail-closed) on **target_files `IMAGES/`** (the
|
||||
OTA pair). Do not use `out/target/product/$DEVICE/{boot,vbmeta}.img` alone —
|
||||
those make images can be stock and disagree with the Magisk payload in the zip.
|
||||
Gates: pubkey sha1 == `avb_pkmd.bin` (not AOSP testkey); flags 3;
|
||||
`verify_image --key` + `--expected_chain_partition vbmeta_system:1:avb_pkmd.bin`;
|
||||
`magiskboot cpio test` ≠ 0; LAB stays `flash.locked=0` + Magisk works.
|
||||
|
||||
**OEM unlocking:** leave enabled as a best-effort escape hatch (not a recovery
|
||||
guarantee). Do not relock the bootloader on this Magisk track.
|
||||
|
||||
## Branding
|
||||
|
||||
`TARGET_UNOFFICIAL_BUILD_ID=AXP-Resurection-Pro` is set at the **top** of
|
||||
`device/google/sunfish/lineage_sunfish.mk` (before inheriting
|
||||
`vendor/lineage` → `version.mk`). Helper:
|
||||
`apply_009_unofficial_build_id.py`. **Pro** = full Magisk resurrection track
|
||||
(not a future slim/minimal variant). Mirrors GOLDEN’s `…-sunfish-pro` /
|
||||
releasetype `PRO` intent without patching `vendor/lineage/config/version.mk`.
|
||||
|
||||
`branding.mk` adds `ro.axp.resurection.track=pro`. Ship scripts also publish
|
||||
`AXP-Resurection-Pro-<ver>-<date>-sunfish.zip` as a hardlink/copy of the
|
||||
Lineage `bacon` zip (no rebuild solely to rename).
|
||||
|
||||
|
||||
## Never
|
||||
|
||||
- Commit `*.pk8`, private `*.pem`, or pass files.
|
||||
- Relock LAB/GOLDEN as a project requirement (OEM unlock-always-on does not
|
||||
make Magisk+relock safe).
|
||||
- Flash old `kh-cve` / `kh-full` zips from 2026-09-18.
|
||||
@@ -0,0 +1,22 @@
|
||||
# Stage1 build fixes (FR-017)
|
||||
|
||||
> **2026-09-26 audit:** The FORTIFY BUG stubs below are a historical link
|
||||
> workaround, **not an accepted fix**. The latest ksync FORTIFY image fails
|
||||
> boot according to the owner. Clang exclusion in Kconfig references an
|
||||
> undefined CC_IS_CLANG symbol. See
|
||||
> [the FORTIFY audit](../../../../docs/009-fortify-boot-audit-20260926.md)
|
||||
> before reusing this workaround.
|
||||
|
||||
Applied on host `msm-4.14` when Stage1 Graphene/AH hit compile/link issues:
|
||||
|
||||
1. **slab 0014 misfuzz** — Graphene patch targeted `slab_equal_or_root`;
|
||||
fuzz applied to `is_root_cache`. Reverted `is_root_cache` to `return true`.
|
||||
LOS already has `slab_equal_or_root` → `s == p`.
|
||||
2. **FORTIFY + Clang LTO (historical, invalid as ship fix)** —
|
||||
`CONFIG_FORTIFY_SOURCE=y` caused modpost undefined `__read_overflow*` /
|
||||
`__write_overflow` in qcacld/techpack. Temporary `BUG()` stubs were
|
||||
added in `lib/string.c` to force a link; LAB then failed to boot.
|
||||
**Do not reuse.** Real work: Clang FORTIFY port — see
|
||||
`docs/009-fortify-clang-port.md` and `docs/009-fortify-boot-audit-20260926.md`.
|
||||
|
||||
See `docs/009-kernel-hardening-map.md`.
|
||||
@@ -0,0 +1,83 @@
|
||||
# 009 kernel hardening Stage 1 (FR-017)
|
||||
|
||||
**Source**: AXP `kernel_patches` @ `df3cab2155b3` (GrapheneOS / AndroidHardening
|
||||
series in Divest-era layout).
|
||||
**Base**: LOS `kernel/google/msm-4.14` @ `28f9290ae067` (`4.14.357-openela`).
|
||||
**Map**: `docs/009-kernel-hardening-map.md`.
|
||||
|
||||
## Files
|
||||
|
||||
| File | Role |
|
||||
|------|------|
|
||||
| `stage1.list` | Ordered allowlist (30 patches) |
|
||||
| `apply_stage1.sh` | Applies list onto a kernel tree |
|
||||
|
||||
## Host usage (`rom-dev01`)
|
||||
|
||||
```bash
|
||||
# dry-run
|
||||
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh \
|
||||
/srv/rom/src/lineage/kernel/google/msm-4.14 --dry-run
|
||||
|
||||
# apply (dirties the lineage kernel checkout)
|
||||
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh \
|
||||
/srv/rom/src/lineage/kernel/google/msm-4.14
|
||||
```
|
||||
|
||||
Optional: `AXP_KERNEL_PATCHES=/path/to/kernel_patches`.
|
||||
|
||||
After apply, flip `sunfish_defconfig` options that the new Kconfig allows
|
||||
(at least `CONFIG_FORTIFY_SOURCE=y`); see map `KH-CFG`.
|
||||
|
||||
## Boot-OK pack (2026-09-28 LAB) — prefer for Magisk bacon
|
||||
|
||||
Stage1 Graphene alone historically hung at the Google logo on LOS23/Clang.
|
||||
The pack that boots with Magisk-track `boot-make` is **combo4 + Clang FORTIFY**
|
||||
(no Stage1 mega-pack):
|
||||
|
||||
```bash
|
||||
# on a reset msm-4.14 @ 28f9290ae067:
|
||||
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_combo4_fortify.sh \
|
||||
/path/to/msm-4.14
|
||||
```
|
||||
|
||||
That applies `fortify-clang/` (incl. nested `__underlying_strlen` fix) +
|
||||
driver bounds + defconfig:
|
||||
`FORTIFY_SOURCE`, `INIT_ON_*`, `SECURITY_DMESG_RESTRICT`,
|
||||
`SLAB_FREELIST_HARDENED`. Bacon entrypoint:
|
||||
`scripts/009-bacon-axp-combo4-fortify.sh`.
|
||||
|
||||
## Stage1 + combo4 (full bacon, Wi‑Fi coherent)
|
||||
|
||||
```bash
|
||||
# reset msm-4.14 @ 28f9290ae067, then:
|
||||
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1_combo4.sh \
|
||||
/path/to/msm-4.14
|
||||
# bacon: scripts/009-bacon-axp-stage1-combo4.sh
|
||||
```
|
||||
|
||||
Order: Stage1 (30) → slab BUILD-FIXES if needed → combo4+FORTIFY.
|
||||
Ship via **sideload of the zip** (matching vendor/`wlan.ko`). Do not flash
|
||||
only the new boot onto an old slot.
|
||||
|
||||
**LAB accepted 2026-09-29:** see `docs/009-gate-g-kernel-attribution.md`.
|
||||
|
||||
## GPS / location (FR-018 — do not regress)
|
||||
|
||||
Owner wants **precise, fast GPS** (stock LOS behaviour). **Never** apply AXP
|
||||
location lockdown, SUPL/IMSI stripping that hurts TTFF, or extra location
|
||||
caps vs LOS 23.2. Stage1 list, `cve-strict.list`, and denylist must stay
|
||||
free of location-lockdown series (`KH-LOC` = skip). If a future CVE hunk
|
||||
touches GNSS/GPS paths only for a real security fix, keep LOS-equivalent
|
||||
behaviour and document; do not “harden location” as a side goal.
|
||||
|
||||
## Not in Stage 1 alone
|
||||
|
||||
- CVE mega — now staged via `apply_stage1_combo4_cve.sh` + `cve-strict.list`
|
||||
(~503 AXP allowlist from 2026-09-18 strict pass; `cve-denylist.txt` skipped).
|
||||
Bacon: `scripts/009-bacon-axp-stage1-combo4-cve.sh` (test-keys; after
|
||||
boot-OK Stage1 pack). **Do not** flash `20260918*-axp-kh-cve/full`.
|
||||
- LinuxIncrementals
|
||||
- Failed probe patches (port later)
|
||||
- Location lockdown (FR-018)
|
||||
- Iodé kernel (no sunfish 4.14 fork found)
|
||||
+51
@@ -0,0 +1,51 @@
|
||||
#!/bin/bash
|
||||
# Apply the LAB-verified combo4 + Clang FORTIFY pack onto a clean msm-4.14 tree.
|
||||
#
|
||||
# Boot-OK on sunfish LAB 2026-09-28 (ksync combo4-fortify-fix). This is NOT
|
||||
# the full Graphene Stage1 pack (Stage1 alone historically hung at Google logo).
|
||||
#
|
||||
# Usage: apply_combo4_fortify.sh <kernel-tree>
|
||||
# Expects a virgin / reset tree (apply_fortify_clang.py is not idempotent).
|
||||
set -e
|
||||
|
||||
K=${1:?kernel tree}
|
||||
HERE=$(cd "$(dirname "$0")" && pwd)
|
||||
FC="$HERE/fortify-clang"
|
||||
|
||||
test -d "$K/include/linux"
|
||||
test -f "$FC/apply_fortify_clang.py"
|
||||
test -f "$FC/0001-driver-bounds-rtac-fils.patch"
|
||||
|
||||
python3 "$FC/apply_fortify_clang.py" "$K"
|
||||
patch -p1 --forward --batch -d "$K" < "$FC/0001-driver-bounds-rtac-fils.patch"
|
||||
|
||||
DEF="$K/arch/arm64/configs/sunfish_defconfig"
|
||||
test -f "$DEF"
|
||||
|
||||
# Drop any prior toggles we manage, then enable the boot-OK set.
|
||||
for k in \
|
||||
FORTIFY_SOURCE \
|
||||
INIT_ON_ALLOC_DEFAULT_ON \
|
||||
INIT_ON_FREE_DEFAULT_ON \
|
||||
SECURITY_DMESG_RESTRICT \
|
||||
SLAB_FREELIST_HARDENED \
|
||||
SLAB_HARDENED
|
||||
do
|
||||
sed -i "/CONFIG_${k}/d" "$DEF"
|
||||
done
|
||||
|
||||
# Keep KernelSU off on this Magisk track.
|
||||
sed -i '/CONFIG_KSU/d' "$DEF"
|
||||
echo '# CONFIG_KSU is not set' >> "$DEF"
|
||||
|
||||
for k in \
|
||||
CONFIG_FORTIFY_SOURCE \
|
||||
CONFIG_INIT_ON_ALLOC_DEFAULT_ON \
|
||||
CONFIG_INIT_ON_FREE_DEFAULT_ON \
|
||||
CONFIG_SECURITY_DMESG_RESTRICT \
|
||||
CONFIG_SLAB_FREELIST_HARDENED
|
||||
do
|
||||
echo "${k}=y" >> "$DEF"
|
||||
done
|
||||
|
||||
echo "OK: combo4+FORTIFY applied on $K"
|
||||
@@ -0,0 +1,164 @@
|
||||
#!/usr/bin/env bash
|
||||
# Apply AXP CVE allowlist onto msm-4.14 (after Stage1+combo4).
|
||||
# Source: AXP kernel_patches + cve_checker strict list / bisect slices.
|
||||
#
|
||||
# Safety (2026-09-29 review):
|
||||
# - Default: ABORT on first patch failure (no continue-with-partial-tree).
|
||||
# - Keep *.rej / *.orig under CVE_REJECT_DIR (do not silently delete).
|
||||
# - Treat large line-offsets / fuzz as WARN or FAIL (mis-apply risk).
|
||||
# - Set CVE_STRICT_CONTINUE=1 only for forensic runs (explicit).
|
||||
set -euo pipefail
|
||||
|
||||
KP="${AXP_KERNEL_PATCHES:-/srv/rom/references/axp/kernel_patches}"
|
||||
KERNEL_DIR="${1:-/srv/rom/src/lineage/kernel/google/msm-4.14}"
|
||||
HERE="$(cd "$(dirname "$0")" && pwd)"
|
||||
LIST="${CVE_STRICT_LIST:-$HERE/cve-strict.list}"
|
||||
DENY="${CVE_DENYLIST:-$HERE/cve-denylist.txt}"
|
||||
LOG_DIR="${CVE_APPLY_LOG_DIR:-/srv/rom/artifacts/009-axp-los23-port/cve-stage}"
|
||||
CONTINUE="${CVE_STRICT_CONTINUE:-0}"
|
||||
# Reject apply if GNU patch reports fuzz >= this (0 = disable fuzz fail)
|
||||
MAX_FUZZ="${CVE_MAX_FUZZ:-1}"
|
||||
# Reject if any hunk offset abs(lines) >= this (0 = disable)
|
||||
MAX_ABS_OFFSET="${CVE_MAX_ABS_OFFSET:-200}"
|
||||
DRY_RUN=0
|
||||
[[ "${2:-}" == "--dry-run" ]] && DRY_RUN=1
|
||||
|
||||
if [[ ! -d "$KERNEL_DIR/include/linux" ]]; then
|
||||
echo "error: kernel dir missing: $KERNEL_DIR" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -d "$KP" ]]; then
|
||||
echo "error: AXP kernel_patches missing: $KP" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -f "$LIST" ]]; then
|
||||
echo "error: list missing: $LIST" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "$LOG_DIR"
|
||||
STAMP=$(date -u +%Y%m%dT%H%M%SZ)
|
||||
LOG="$LOG_DIR/apply-cve-strict-${STAMP}.log"
|
||||
FAIL_LIST="$LOG_DIR/apply-cve-strict-${STAMP}.fail.txt"
|
||||
REJECT_DIR="${CVE_REJECT_DIR:-$LOG_DIR/rejects-${STAMP}}"
|
||||
mkdir -p "$REJECT_DIR"
|
||||
: >"$FAIL_LIST"
|
||||
|
||||
declare -A DENY_MAP=()
|
||||
if [[ -f "$DENY" ]]; then
|
||||
while IFS= read -r d || [[ -n "$d" ]]; do
|
||||
[[ -z "$d" || "$d" =~ ^# ]] && continue
|
||||
if [[ "$d" == *"/kernel_patches/"* ]]; then
|
||||
DENY_MAP["${d##*/kernel_patches/}"]=1
|
||||
else
|
||||
DENY_MAP["$d"]=1
|
||||
fi
|
||||
done <"$DENY"
|
||||
fi
|
||||
|
||||
ok=0
|
||||
fail=0
|
||||
skip=0
|
||||
miss=0
|
||||
quality_fail=0
|
||||
|
||||
echo "=== CVE strict apply kernel=$KERNEL_DIR dry_run=$DRY_RUN continue=$CONTINUE max_fuzz=$MAX_FUZZ max_abs_offset=$MAX_ABS_OFFSET ===" | tee "$LOG"
|
||||
|
||||
while IFS= read -r rel || [[ -n "$rel" ]]; do
|
||||
[[ -z "$rel" || "$rel" =~ ^# ]] && continue
|
||||
if [[ -n "${DENY_MAP[$rel]:-}" ]]; then
|
||||
echo "SKIP_DENY $rel" | tee -a "$LOG"
|
||||
skip=$((skip + 1))
|
||||
continue
|
||||
fi
|
||||
p="$KP/$rel"
|
||||
if [[ ! -f "$p" ]]; then
|
||||
echo "MISS $rel" | tee -a "$LOG"
|
||||
miss=$((miss + 1))
|
||||
echo "$rel" >>"$FAIL_LIST"
|
||||
if [[ "$CONTINUE" != "1" ]]; then
|
||||
echo "error: missing patch (abort)" >&2
|
||||
exit 1
|
||||
fi
|
||||
continue
|
||||
fi
|
||||
|
||||
args=(-p1 --batch -d "$KERNEL_DIR" --forward --no-backup-if-mismatch)
|
||||
if [[ "$DRY_RUN" -eq 1 ]]; then
|
||||
args+=(--dry-run)
|
||||
fi
|
||||
|
||||
patch_log=$(mktemp)
|
||||
set +e
|
||||
patch "${args[@]}" <"$p" >"$patch_log" 2>&1
|
||||
prc=$?
|
||||
set -e
|
||||
cat "$patch_log" >>"$LOG"
|
||||
|
||||
# Quality: fuzz / large offsets even when exit 0
|
||||
fuzz_max=0
|
||||
abs_off_max=0
|
||||
eval "$(python3 -c '
|
||||
import re, sys
|
||||
text = open(sys.argv[1], errors="replace").read()
|
||||
fuzz = off = 0
|
||||
for m in re.finditer(r"with fuzz (\d+)", text):
|
||||
fuzz = max(fuzz, int(m.group(1)))
|
||||
for m in re.finditer(r"\(offset ([+-]?\d+) lines\)", text):
|
||||
off = max(off, abs(int(m.group(1))))
|
||||
print(f"fuzz_max={fuzz}")
|
||||
print(f"abs_off_max={off}")
|
||||
' "$patch_log")"
|
||||
rm -f "$patch_log"
|
||||
|
||||
qbad=0
|
||||
if [[ "$MAX_FUZZ" -gt 0 && "$fuzz_max" -ge "$MAX_FUZZ" ]]; then
|
||||
echo "QUALITY_FAIL fuzz=$fuzz_max>=$MAX_FUZZ $rel" | tee -a "$LOG"
|
||||
qbad=1
|
||||
fi
|
||||
if [[ "$MAX_ABS_OFFSET" -gt 0 && "$abs_off_max" -ge "$MAX_ABS_OFFSET" ]]; then
|
||||
echo "QUALITY_FAIL abs_offset=$abs_off_max>=$MAX_ABS_OFFSET $rel" | tee -a "$LOG"
|
||||
qbad=1
|
||||
fi
|
||||
|
||||
if [[ "$prc" -eq 0 && "$qbad" -eq 0 ]]; then
|
||||
echo "OK $rel (fuzz_max=$fuzz_max abs_off_max=$abs_off_max)" | tee -a "$LOG"
|
||||
ok=$((ok + 1))
|
||||
continue
|
||||
fi
|
||||
|
||||
# Failure path: preserve rejects
|
||||
echo "FAIL $rel patch_rc=$prc fuzz_max=$fuzz_max abs_off_max=$abs_off_max" | tee -a "$LOG"
|
||||
echo "$rel" >>"$FAIL_LIST"
|
||||
fail=$((fail + 1))
|
||||
[[ "$qbad" -eq 1 ]] && quality_fail=$((quality_fail + 1))
|
||||
|
||||
safe=$(echo "$rel" | tr '/' '_')
|
||||
dest="$REJECT_DIR/$safe"
|
||||
mkdir -p "$dest"
|
||||
# move any rej/orig created under kernel tree
|
||||
while IFS= read -r -d '' rej; do
|
||||
mv "$rej" "$dest/" 2>/dev/null || cp -a "$rej" "$dest/" || true
|
||||
done < <(find "$KERNEL_DIR" -name '*.rej' -print0 2>/dev/null)
|
||||
while IFS= read -r -d '' orig; do
|
||||
mv "$orig" "$dest/" 2>/dev/null || cp -a "$orig" "$dest/" || true
|
||||
done < <(find "$KERNEL_DIR" -name '*.orig' -print0 2>/dev/null)
|
||||
cp -a "$p" "$dest/patch" 2>/dev/null || true
|
||||
echo "rejects_kept=$dest" | tee -a "$LOG"
|
||||
|
||||
if [[ "$CONTINUE" != "1" ]]; then
|
||||
echo "error: abort on FAIL (set CVE_STRICT_CONTINUE=1 to keep going)" >&2
|
||||
echo "CVE strict ABORT OK=$ok FAIL=$fail QUALITY_FAIL=$quality_fail SKIP_DENY=$skip MISS=$miss log=$LOG" | tee -a "$LOG"
|
||||
exit 1
|
||||
fi
|
||||
done <"$LIST"
|
||||
|
||||
echo "CVE strict done OK=$ok FAIL=$fail QUALITY_FAIL=$quality_fail SKIP_DENY=$skip MISS=$miss dry_run=$DRY_RUN continue=$CONTINUE log=$LOG rejects=$REJECT_DIR" | tee -a "$LOG"
|
||||
|
||||
if [[ "$fail" -gt 0 && "$CONTINUE" != "1" ]]; then
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$ok" -eq 0 && "$DRY_RUN" -eq 0 ]]; then
|
||||
echo "error: zero CVE patches applied" >&2
|
||||
exit 1
|
||||
fi
|
||||
+49
@@ -0,0 +1,49 @@
|
||||
#!/usr/bin/env bash
|
||||
# Apply FR-017 Stage 1 AXP Graphene/AH patches to LOS msm-4.14.
|
||||
# Attribute: AXP kernel_patches (GrapheneOS / AndroidHardening series via Divest-era layout).
|
||||
set -euo pipefail
|
||||
|
||||
KP="${AXP_KERNEL_PATCHES:-/srv/rom/references/axp/kernel_patches}"
|
||||
KERNEL_DIR="${1:-/srv/rom/src/lineage/kernel/google/msm-4.14}"
|
||||
LIST="$(cd "$(dirname "$0")" && pwd)/stage1.list"
|
||||
DRY_RUN=0
|
||||
if [[ "${2:-}" == "--dry-run" ]]; then
|
||||
DRY_RUN=1
|
||||
fi
|
||||
|
||||
if [[ ! -d "$KERNEL_DIR" ]]; then
|
||||
echo "error: kernel dir missing: $KERNEL_DIR" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -d "$KP" ]]; then
|
||||
echo "error: AXP kernel_patches missing: $KP" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
ok=0
|
||||
fail=0
|
||||
while IFS= read -r rel || [[ -n "$rel" ]]; do
|
||||
[[ -z "$rel" || "$rel" =~ ^# ]] && continue
|
||||
p="$KP/$rel"
|
||||
if [[ ! -f "$p" ]]; then
|
||||
echo "FAIL missing $rel"
|
||||
fail=$((fail + 1))
|
||||
continue
|
||||
fi
|
||||
args=(-p1 --batch -d "$KERNEL_DIR")
|
||||
if [[ "$DRY_RUN" -eq 1 ]]; then
|
||||
args+=(--dry-run)
|
||||
fi
|
||||
if patch "${args[@]}" < "$p"; then
|
||||
echo "OK $rel"
|
||||
ok=$((ok + 1))
|
||||
else
|
||||
echo "FAIL $rel"
|
||||
fail=$((fail + 1))
|
||||
find "$KERNEL_DIR" -name '*.rej' -delete 2>/dev/null || true
|
||||
find "$KERNEL_DIR" -name '*.orig' -delete 2>/dev/null || true
|
||||
exit 1
|
||||
fi
|
||||
done < "$LIST"
|
||||
|
||||
echo "Stage1 done OK=$ok FAIL=$fail dry_run=$DRY_RUN"
|
||||
+47
@@ -0,0 +1,47 @@
|
||||
#!/bin/bash
|
||||
# Stage1 Graphene/AH (30 patches) + combo4 Clang FORTIFY pack on a clean msm-4.14.
|
||||
#
|
||||
# Order: Stage1 first (virgin tree), then apply_combo4_fortify.sh (Clang POS +
|
||||
# nested __underlying_strlen + driver bounds + combo4 defconfig).
|
||||
# Expects reset tree @ 28f9290ae067 (apply_fortify_clang.py is not idempotent).
|
||||
#
|
||||
# Full bacon with this pack ships matching vendor modules (Wi-Fi). Boot-only
|
||||
# flash onto an older vendor can break wlan CRC — prefer sideload of the zip.
|
||||
set -e
|
||||
|
||||
K=${1:?kernel tree}
|
||||
HERE=$(cd "$(dirname "$0")" && pwd)
|
||||
|
||||
test -d "$K/include/linux"
|
||||
test -x "$HERE/apply_stage1.sh" || chmod +x "$HERE/apply_stage1.sh"
|
||||
test -x "$HERE/apply_combo4_fortify.sh" || chmod +x "$HERE/apply_combo4_fortify.sh"
|
||||
|
||||
bash "$HERE/apply_stage1.sh" "$K"
|
||||
|
||||
# Historical Stage1 slab/0014 misfuzz: if is_root_cache was corrupted, restore.
|
||||
python3 - <<'PY' "$K"
|
||||
from pathlib import Path
|
||||
import sys
|
||||
p = Path(sys.argv[1]) / "mm/slab.h"
|
||||
t = p.read_text()
|
||||
bad = """static inline bool is_root_cache(struct kmem_cache *s)
|
||||
{
|
||||
#ifdef CONFIG_SLAB_HARDENED
|
||||
\treturn p == s;
|
||||
#else
|
||||
\treturn true;
|
||||
#endif
|
||||
}"""
|
||||
good = """static inline bool is_root_cache(struct kmem_cache *s)
|
||||
{
|
||||
\treturn true;
|
||||
}"""
|
||||
if bad in t:
|
||||
p.write_text(t.replace(bad, good, 1))
|
||||
print("OK: reverted Stage1 slab/0014 misfuzz in is_root_cache")
|
||||
else:
|
||||
print("OK: is_root_cache looks unmisfuzzed (no BUILD-FIXES edit)")
|
||||
PY
|
||||
|
||||
bash "$HERE/apply_combo4_fortify.sh" "$K"
|
||||
echo "OK: Stage1 + combo4+FORTIFY applied on $K"
|
||||
@@ -0,0 +1,12 @@
|
||||
#!/bin/bash
|
||||
# Stage1 + combo4+FORTIFY + AXP CVE strict allowlist on clean msm-4.14.
|
||||
# Boot-OK baseline first (LAB 2026-09-29), then CVE mega that compiled 2026-09-18.
|
||||
# FR-018: no location lockdown — keep GPS precise/fast (LOS defaults).
|
||||
set -e
|
||||
K=${1:?kernel tree}
|
||||
HERE=$(cd "$(dirname "$0")" && pwd)
|
||||
|
||||
test -d "$K/include/linux"
|
||||
bash "$HERE/apply_stage1_combo4.sh" "$K"
|
||||
bash "$HERE/apply_cve_strict.sh" "$K"
|
||||
echo "OK: Stage1 + combo4+FORTIFY + CVE-strict applied on $K (no location lockdown)"
|
||||
+31
@@ -0,0 +1,31 @@
|
||||
#!/bin/bash
|
||||
# US-S5-1 — enable remaining Graphene/AXP-class defconfig knobs on msm-4.14.
|
||||
#
|
||||
# Oracle: AXP/Graphene kernel hardening expects Yama + slab freelist random
|
||||
# (combo4 already ships SLAB_FREELIST_HARDENED). LOS sunfish_defconfig left both
|
||||
# off; CONFIG_LSM already lists yama but SECURITY_YAMA was unset so the LSM
|
||||
# never built.
|
||||
#
|
||||
# Does NOT apply high-offset CVE leftovers (nf_tables deliberately skipped) or
|
||||
# CVE-2022-49980 (denylist until lock-scope port).
|
||||
#
|
||||
# Usage: apply_uss5_1_defconfig.sh <kernel-tree>
|
||||
set -euo pipefail
|
||||
|
||||
K=${1:?kernel tree}
|
||||
DEF="$K/arch/arm64/configs/sunfish_defconfig"
|
||||
test -f "$DEF"
|
||||
test -f "$K/security/yama/Kconfig"
|
||||
|
||||
for k in SECURITY_YAMA SLAB_FREELIST_RANDOM; do
|
||||
sed -i "/CONFIG_${k}/d" "$DEF"
|
||||
# drop "# CONFIG_FOO is not set" lines too (sed above only matches CONFIG_FOO=)
|
||||
sed -i "/# CONFIG_${k} is not set/d" "$DEF"
|
||||
done
|
||||
|
||||
{
|
||||
echo "CONFIG_SECURITY_YAMA=y"
|
||||
echo "CONFIG_SLAB_FREELIST_RANDOM=y"
|
||||
} >> "$DEF"
|
||||
|
||||
echo "OK: US-S5-1 defconfig (YAMA + SLAB_FREELIST_RANDOM) on $K"
|
||||
@@ -0,0 +1 @@
|
||||
CVE-2022-49980/ANY/0001.patch
|
||||
@@ -0,0 +1,215 @@
|
||||
0003-syzkaller-Misc/ANY/0008.patch
|
||||
CVE-2015-7837/ANY/0001.patch
|
||||
CVE-2016-3695/ANY/0001.patch
|
||||
CVE-2017-5754/^4.19/0157.patch
|
||||
CVE-2017-18232/4.14/0002.patch
|
||||
CVE-2018-5897/ANY/0001.patch
|
||||
CVE-2018-9415/ANY/0005.patch
|
||||
CVE-2018-20855/^4.18/0001.patch
|
||||
CVE-2019-3874/^5.1/0002.patch
|
||||
CVE-2019-9444/ANY/0001.patch
|
||||
CVE-2019-10520/ANY/0001.patch
|
||||
CVE-2019-11191/^5.0/0001.patch
|
||||
CVE-2019-12378/^5.1.5/0001.patch
|
||||
CVE-2019-12455/^5.2/0001.patch
|
||||
CVE-2019-12456/^5.1.5/0002.patch
|
||||
CVE-2019-15291/4.14/0004.patch
|
||||
CVE-2019-16921/^4.16/0001.patch
|
||||
CVE-2019-18786/4.14/0002.patch
|
||||
CVE-2019-19051/4.14/0008.patch
|
||||
CVE-2019-19068/4.14/0002.patch
|
||||
CVE-2019-19602/^5.4/0001.patch
|
||||
CVE-2019-20908/^5.2/0001.patch
|
||||
CVE-2020-0255/^5.6/0001.patch
|
||||
CVE-2020-8832/^4.14/0001.patch
|
||||
CVE-2020-15780/^5.8/0001.patch
|
||||
CVE-2020-16119/^5.10/0002.patch
|
||||
CVE-2020-BleedingToothExtras/^5.10/0001.patch
|
||||
CVE-2021-3493/^5.10/0001.patch
|
||||
CVE-2021-28039/^5.11/0001.patch
|
||||
CVE-2021-28950/4.14/0002.patch
|
||||
CVE-2021-29154/^5.12/0002.patch
|
||||
CVE-2021-30337/4.14/0018.patch
|
||||
CVE-2021-46912/^5.12/0001.patch
|
||||
CVE-2021-46958/^5.12/0001.patch
|
||||
CVE-2021-46999/^5.12/0001.patch
|
||||
CVE-2021-47010/^5.12/0001.patch
|
||||
CVE-2021-47058/^5.12/0001.patch
|
||||
CVE-2021-47173/4.14/0003.patch
|
||||
CVE-2021-47234/^5.13/0001.patch
|
||||
CVE-2021-47266/^5.13/0001.patch
|
||||
CVE-2021-47346/^5.13/0001.patch
|
||||
CVE-2021-47430/^5.15/0001.patch
|
||||
CVE-2021-47472/4.14/0003.patch
|
||||
CVE-2021-47583/^5.15/0001.patch
|
||||
CVE-2021-47616/^5.16/0001.patch
|
||||
CVE-2021-47618/^5.16/0001.patch
|
||||
CVE-2021-47636/ANY/0001.patch
|
||||
CVE-2022-3061/^5.18/0001.patch
|
||||
CVE-2022-3903/^6.0/0001.patch
|
||||
CVE-2022-4382/^6.2/0001.patch
|
||||
CVE-2022-21546/ANY/0001.patch
|
||||
CVE-2022-27950/^5.16/0001.patch
|
||||
CVE-2022-48674/^6.0/0001.patch
|
||||
CVE-2022-48713/^5.17/0001.patch
|
||||
CVE-2022-48781/^5.17/0001.patch
|
||||
CVE-2022-48785/^5.17/0001.patch
|
||||
CVE-2022-48966/4.14/0002.patch
|
||||
CVE-2022-49034/ANY/0002.patch
|
||||
CVE-2022-49061/4.14/0002.patch
|
||||
CVE-2022-49073/ANY/0001.patch
|
||||
CVE-2022-49078/ANY/0001.patch
|
||||
CVE-2022-49146/ANY/0001.patch
|
||||
CVE-2022-49194/ANY/0001.patch
|
||||
CVE-2022-49205/ANY/0001.patch
|
||||
CVE-2022-49209/ANY/0001.patch
|
||||
CVE-2022-49285/ANY/0001.patch
|
||||
CVE-2022-49318/ANY/0001.patch
|
||||
CVE-2022-49363/ANY/0001.patch
|
||||
CVE-2022-49364/ANY/0001.patch
|
||||
CVE-2022-49380/ANY/0001.patch
|
||||
CVE-2022-49425/ANY/0001.patch
|
||||
CVE-2022-49428/ANY/0001.patch
|
||||
CVE-2022-49433/ANY/0001.patch
|
||||
CVE-2022-49500/ANY/0001.patch
|
||||
CVE-2022-49513/ANY/0001.patch
|
||||
CVE-2022-49563/ANY/0001.patch
|
||||
CVE-2022-49564/ANY/0001.patch
|
||||
CVE-2022-49566/ANY/0001.patch
|
||||
CVE-2022-49642/ANY/0001.patch
|
||||
CVE-2022-49705/ANY/0001.patch
|
||||
CVE-2022-49710/ANY/0001.patch
|
||||
CVE-2022-49777/ANY/0001.patch
|
||||
CVE-2022-49779/ANY/0001.patch
|
||||
CVE-2022-49784/ANY/0001.patch
|
||||
CVE-2022-49823/ANY/0001.patch
|
||||
CVE-2022-49824/ANY/0001.patch
|
||||
CVE-2022-49825/ANY/0001.patch
|
||||
CVE-2022-49839/ANY/0001.patch
|
||||
CVE-2022-49863/ANY/0001.patch
|
||||
CVE-2022-49980/ANY/0001.patch
|
||||
CVE-2022-49990/ANY/0001.patch
|
||||
CVE-2022-49993/4.14/0003.patch
|
||||
CVE-2022-50013/ANY/0001.patch
|
||||
CVE-2022-50062/ANY/0001.patch
|
||||
CVE-2022-50074/ANY/0001.patch
|
||||
CVE-2022-50248/ANY/0001.patch
|
||||
CVE-2022-50273/ANY/0001.patch
|
||||
CVE-2022-50326/ANY/0001.patch
|
||||
CVE-2022-50358/ANY/0001.patch
|
||||
CVE-2022-50364/ANY/0001.patch
|
||||
CVE-2022-50397/ANY/0001.patch
|
||||
CVE-2022-50473/ANY/0001.patch
|
||||
CVE-2022-50522/4.14/0003.patch
|
||||
CVE-2022-50537/ANY/0001.patch
|
||||
CVE-2023-1989/4.14/0003.patch
|
||||
CVE-2023-21657/4.14/0005.patch
|
||||
CVE-2023-23000/^5.16/0001.patch
|
||||
CVE-2023-28554/ANY/0002.patch
|
||||
CVE-2023-33070/ANY/0001.patch
|
||||
CVE-2023-52523/^6.6/0001.patch
|
||||
CVE-2023-52595/^6.6/0001.patch
|
||||
CVE-2023-52604/4.14/0009.patch
|
||||
CVE-2023-52746/^6.2/0001.patch
|
||||
CVE-2023-52884/^6.5/0001.patch
|
||||
CVE-2023-52979/4.14/0003.patch
|
||||
CVE-2023-53001/ANY/0001.patch
|
||||
CVE-2023-53016/ANY/0001.patch
|
||||
CVE-2023-53098/ANY/0001.patch
|
||||
CVE-2023-53125/4.14/0003.patch
|
||||
CVE-2023-53131/ANY/0001.patch
|
||||
CVE-2023-53137/ANY/0001.patch
|
||||
CVE-2023-53214/ANY/0001.patch
|
||||
CVE-2023-53227/4.14/0003.patch
|
||||
CVE-2023-53250/ANY/0001.patch
|
||||
CVE-2023-53259/ANY/0002.patch
|
||||
CVE-2023-53265/4.14/0003.patch
|
||||
CVE-2023-53288/ANY/0001.patch
|
||||
CVE-2023-53312/ANY/0001.patch
|
||||
CVE-2023-53436/4.14/0003.patch
|
||||
CVE-2023-53443/ANY/0001.patch
|
||||
CVE-2023-53487/ANY/0002.patch
|
||||
CVE-2023-53537/ANY/0001.patch
|
||||
CVE-2023-53599/ANY/0001.patch
|
||||
CVE-2023-53641/ANY/0001.patch
|
||||
CVE-2023-53693/ANY/0001.patch
|
||||
CVE-2023-53695/ANY/0001.patch
|
||||
CVE-2023-53712/ANY/0001.patch
|
||||
CVE-2023-53719/ANY/0001.patch
|
||||
CVE-2024-26645/^6.8/0001.patch
|
||||
CVE-2024-26720/4.14/0009.patch
|
||||
CVE-2024-26760/^6.8/0001.patch
|
||||
CVE-2024-26920/4.14/0009.patch
|
||||
CVE-2024-26961/^6.7/0001.patch
|
||||
CVE-2024-26972/^6.8/0001.patch
|
||||
CVE-2024-27009/^6.9/0001.patch
|
||||
CVE-2024-27033/^6.8/0001.patch
|
||||
CVE-2024-27393/^6.9/0001.patch
|
||||
CVE-2024-33032/ANY/0002.patch
|
||||
CVE-2024-34027/^6.9/0001.patch
|
||||
CVE-2024-35812/4.14/0009.patch
|
||||
CVE-2024-35824/^6.8/0001.patch
|
||||
CVE-2024-35879/^6.9/0001.patch
|
||||
CVE-2024-35933/4.14/0008.patch
|
||||
CVE-2024-35950/^6.9/0001.patch
|
||||
CVE-2024-35954/^6.9/0001.patch
|
||||
CVE-2024-35962/^6.9/0001.patch
|
||||
CVE-2024-40996/^6.10/0001.patch
|
||||
CVE-2024-41041/^6.10/0001.patch
|
||||
CVE-2024-42077/^6.10/0001.patch
|
||||
CVE-2024-42102/4.14/0009.patch
|
||||
CVE-2024-42296/^6.10/0001.patch
|
||||
CVE-2024-43894/^6.11/0001.patch
|
||||
CVE-2024-44938/^6.9/0001.patch
|
||||
CVE-2024-44939/^6.9/0001.patch
|
||||
CVE-2024-44952/4.14/0008.patch
|
||||
CVE-2024-46681/^6.11/0001.patch
|
||||
CVE-2024-47747/^6.11/0001.patch
|
||||
CVE-2024-50017/^6.11/0001.patch
|
||||
CVE-2024-50019/^6.12/0001.patch
|
||||
CVE-2024-50184/^6.11/0001.patch
|
||||
CVE-2024-50195/3.17-^6.12/0001.patch
|
||||
CVE-2024-50201/^6.12/0001.patch
|
||||
CVE-2024-50210/3.17-^6.6/0001.patch
|
||||
CVE-2024-50265/^6.12/0001.patch
|
||||
CVE-2024-50267/^6.12/0001.patch
|
||||
CVE-2024-50269/^6.12/0001.patch
|
||||
CVE-2024-50279/^6.12/0001.patch
|
||||
CVE-2024-50287/^6.12/0001.patch
|
||||
CVE-2024-50290/^6.12/0001.patch
|
||||
CVE-2024-50292/^6.12/0001.patch
|
||||
CVE-2024-50295/^6.12/0001.patch
|
||||
CVE-2024-50299/^6.12/0001.patch
|
||||
CVE-2024-50301/^6.12/0001.patch
|
||||
CVE-2024-52332/ANY/0002.patch
|
||||
CVE-2024-53045/^6.12/0001.patch
|
||||
CVE-2024-53101/^6.12/0001.patch
|
||||
CVE-2024-53103/^6.12/0001.patch
|
||||
CVE-2024-53112/^6.12/0001.patch
|
||||
CVE-2024-53127/^6.12/0001.patch
|
||||
CVE-2024-53140/^6.12/0001.patch
|
||||
CVE-2024-53141/^6.12/0001.patch
|
||||
CVE-2024-53156/ANY/0002.patch
|
||||
CVE-2024-53157/ANY/0002.patch
|
||||
CVE-2024-53165/ANY/0002.patch
|
||||
CVE-2024-53171/ANY/0001.patch
|
||||
CVE-2024-53172/ANY/0002.patch
|
||||
CVE-2024-53183/ANY/0002.patch
|
||||
CVE-2024-53190/ANY/0001.patch
|
||||
CVE-2024-53194/ANY/0002.patch
|
||||
CVE-2024-53214/ANY/0002.patch
|
||||
CVE-2024-53227/ANY/0002.patch
|
||||
CVE-2024-53239/ANY/0001.patch
|
||||
CVE-2024-53680/ANY/0002.patch
|
||||
CVE-2024-53690/ANY/0001.patch
|
||||
CVE-2024-56531/ANY/0002.patch
|
||||
CVE-2024-56532/ANY/0002.patch
|
||||
CVE-2024-56536/ANY/0001.patch
|
||||
CVE-2024-56539/ANY/0002.patch
|
||||
CVE-2024-56548/ANY/0002.patch
|
||||
CVE-2024-56570/ANY/0001.patch
|
||||
CVE-2024-56586/ANY/0001.patch
|
||||
CVE-2024-56587/ANY/0002.patch
|
||||
CVE-2024-56593/ANY/0001.patch
|
||||
CVE-2024-56595/ANY/0002.patch
|
||||
CVE-2024-56597/ANY/0002.patch
|
||||
@@ -0,0 +1,108 @@
|
||||
0003-syzkaller-Misc/ANY/0008.patch
|
||||
CVE-2015-7837/ANY/0001.patch
|
||||
CVE-2016-3695/ANY/0001.patch
|
||||
CVE-2017-5754/^4.19/0157.patch
|
||||
CVE-2017-18232/4.14/0002.patch
|
||||
CVE-2018-5897/ANY/0001.patch
|
||||
CVE-2018-9415/ANY/0005.patch
|
||||
CVE-2018-20855/^4.18/0001.patch
|
||||
CVE-2019-3874/^5.1/0002.patch
|
||||
CVE-2019-9444/ANY/0001.patch
|
||||
CVE-2019-10520/ANY/0001.patch
|
||||
CVE-2019-11191/^5.0/0001.patch
|
||||
CVE-2019-12378/^5.1.5/0001.patch
|
||||
CVE-2019-12455/^5.2/0001.patch
|
||||
CVE-2019-12456/^5.1.5/0002.patch
|
||||
CVE-2019-15291/4.14/0004.patch
|
||||
CVE-2019-16921/^4.16/0001.patch
|
||||
CVE-2019-18786/4.14/0002.patch
|
||||
CVE-2019-19051/4.14/0008.patch
|
||||
CVE-2019-19068/4.14/0002.patch
|
||||
CVE-2019-19602/^5.4/0001.patch
|
||||
CVE-2019-20908/^5.2/0001.patch
|
||||
CVE-2020-0255/^5.6/0001.patch
|
||||
CVE-2020-8832/^4.14/0001.patch
|
||||
CVE-2020-15780/^5.8/0001.patch
|
||||
CVE-2020-16119/^5.10/0002.patch
|
||||
CVE-2020-BleedingToothExtras/^5.10/0001.patch
|
||||
CVE-2021-3493/^5.10/0001.patch
|
||||
CVE-2021-28039/^5.11/0001.patch
|
||||
CVE-2021-28950/4.14/0002.patch
|
||||
CVE-2021-29154/^5.12/0002.patch
|
||||
CVE-2021-30337/4.14/0018.patch
|
||||
CVE-2021-46912/^5.12/0001.patch
|
||||
CVE-2021-46958/^5.12/0001.patch
|
||||
CVE-2021-46999/^5.12/0001.patch
|
||||
CVE-2021-47010/^5.12/0001.patch
|
||||
CVE-2021-47058/^5.12/0001.patch
|
||||
CVE-2021-47173/4.14/0003.patch
|
||||
CVE-2021-47234/^5.13/0001.patch
|
||||
CVE-2021-47266/^5.13/0001.patch
|
||||
CVE-2021-47346/^5.13/0001.patch
|
||||
CVE-2021-47430/^5.15/0001.patch
|
||||
CVE-2021-47472/4.14/0003.patch
|
||||
CVE-2021-47583/^5.15/0001.patch
|
||||
CVE-2021-47616/^5.16/0001.patch
|
||||
CVE-2021-47618/^5.16/0001.patch
|
||||
CVE-2021-47636/ANY/0001.patch
|
||||
CVE-2022-3061/^5.18/0001.patch
|
||||
CVE-2022-3903/^6.0/0001.patch
|
||||
CVE-2022-4382/^6.2/0001.patch
|
||||
CVE-2022-21546/ANY/0001.patch
|
||||
CVE-2022-27950/^5.16/0001.patch
|
||||
CVE-2022-48674/^6.0/0001.patch
|
||||
CVE-2022-48713/^5.17/0001.patch
|
||||
CVE-2022-48781/^5.17/0001.patch
|
||||
CVE-2022-48785/^5.17/0001.patch
|
||||
CVE-2022-48966/4.14/0002.patch
|
||||
CVE-2022-49034/ANY/0002.patch
|
||||
CVE-2022-49061/4.14/0002.patch
|
||||
CVE-2022-49073/ANY/0001.patch
|
||||
CVE-2022-49078/ANY/0001.patch
|
||||
CVE-2022-49146/ANY/0001.patch
|
||||
CVE-2022-49194/ANY/0001.patch
|
||||
CVE-2022-49205/ANY/0001.patch
|
||||
CVE-2022-49209/ANY/0001.patch
|
||||
CVE-2022-49285/ANY/0001.patch
|
||||
CVE-2022-49318/ANY/0001.patch
|
||||
CVE-2022-49363/ANY/0001.patch
|
||||
CVE-2022-49364/ANY/0001.patch
|
||||
CVE-2022-49380/ANY/0001.patch
|
||||
CVE-2022-49425/ANY/0001.patch
|
||||
CVE-2022-49428/ANY/0001.patch
|
||||
CVE-2022-49433/ANY/0001.patch
|
||||
CVE-2022-49500/ANY/0001.patch
|
||||
CVE-2022-49513/ANY/0001.patch
|
||||
CVE-2022-49563/ANY/0001.patch
|
||||
CVE-2022-49564/ANY/0001.patch
|
||||
CVE-2022-49566/ANY/0001.patch
|
||||
CVE-2022-49642/ANY/0001.patch
|
||||
CVE-2022-49705/ANY/0001.patch
|
||||
CVE-2022-49710/ANY/0001.patch
|
||||
CVE-2022-49777/ANY/0001.patch
|
||||
CVE-2022-49779/ANY/0001.patch
|
||||
CVE-2022-49784/ANY/0001.patch
|
||||
CVE-2022-49823/ANY/0001.patch
|
||||
CVE-2022-49824/ANY/0001.patch
|
||||
CVE-2022-49825/ANY/0001.patch
|
||||
CVE-2022-49839/ANY/0001.patch
|
||||
CVE-2022-49863/ANY/0001.patch
|
||||
CVE-2022-49980/ANY/0001.patch
|
||||
CVE-2022-49990/ANY/0001.patch
|
||||
CVE-2022-49993/4.14/0003.patch
|
||||
CVE-2022-50013/ANY/0001.patch
|
||||
CVE-2022-50062/ANY/0001.patch
|
||||
CVE-2022-50074/ANY/0001.patch
|
||||
CVE-2022-50248/ANY/0001.patch
|
||||
CVE-2022-50273/ANY/0001.patch
|
||||
CVE-2022-50326/ANY/0001.patch
|
||||
CVE-2022-50358/ANY/0001.patch
|
||||
CVE-2022-50364/ANY/0001.patch
|
||||
CVE-2022-50397/ANY/0001.patch
|
||||
CVE-2022-50473/ANY/0001.patch
|
||||
CVE-2022-50522/4.14/0003.patch
|
||||
CVE-2022-50537/ANY/0001.patch
|
||||
CVE-2023-1989/4.14/0003.patch
|
||||
CVE-2023-21657/4.14/0005.patch
|
||||
CVE-2023-23000/^5.16/0001.patch
|
||||
CVE-2023-28554/ANY/0002.patch
|
||||
@@ -0,0 +1,54 @@
|
||||
0003-syzkaller-Misc/ANY/0008.patch
|
||||
CVE-2015-7837/ANY/0001.patch
|
||||
CVE-2016-3695/ANY/0001.patch
|
||||
CVE-2017-5754/^4.19/0157.patch
|
||||
CVE-2017-18232/4.14/0002.patch
|
||||
CVE-2018-5897/ANY/0001.patch
|
||||
CVE-2018-9415/ANY/0005.patch
|
||||
CVE-2018-20855/^4.18/0001.patch
|
||||
CVE-2019-3874/^5.1/0002.patch
|
||||
CVE-2019-9444/ANY/0001.patch
|
||||
CVE-2019-10520/ANY/0001.patch
|
||||
CVE-2019-11191/^5.0/0001.patch
|
||||
CVE-2019-12378/^5.1.5/0001.patch
|
||||
CVE-2019-12455/^5.2/0001.patch
|
||||
CVE-2019-12456/^5.1.5/0002.patch
|
||||
CVE-2019-15291/4.14/0004.patch
|
||||
CVE-2019-16921/^4.16/0001.patch
|
||||
CVE-2019-18786/4.14/0002.patch
|
||||
CVE-2019-19051/4.14/0008.patch
|
||||
CVE-2019-19068/4.14/0002.patch
|
||||
CVE-2019-19602/^5.4/0001.patch
|
||||
CVE-2019-20908/^5.2/0001.patch
|
||||
CVE-2020-0255/^5.6/0001.patch
|
||||
CVE-2020-8832/^4.14/0001.patch
|
||||
CVE-2020-15780/^5.8/0001.patch
|
||||
CVE-2020-16119/^5.10/0002.patch
|
||||
CVE-2020-BleedingToothExtras/^5.10/0001.patch
|
||||
CVE-2021-3493/^5.10/0001.patch
|
||||
CVE-2021-28039/^5.11/0001.patch
|
||||
CVE-2021-28950/4.14/0002.patch
|
||||
CVE-2021-29154/^5.12/0002.patch
|
||||
CVE-2021-30337/4.14/0018.patch
|
||||
CVE-2021-46912/^5.12/0001.patch
|
||||
CVE-2021-46958/^5.12/0001.patch
|
||||
CVE-2021-46999/^5.12/0001.patch
|
||||
CVE-2021-47010/^5.12/0001.patch
|
||||
CVE-2021-47058/^5.12/0001.patch
|
||||
CVE-2021-47173/4.14/0003.patch
|
||||
CVE-2021-47234/^5.13/0001.patch
|
||||
CVE-2021-47266/^5.13/0001.patch
|
||||
CVE-2021-47346/^5.13/0001.patch
|
||||
CVE-2021-47430/^5.15/0001.patch
|
||||
CVE-2021-47472/4.14/0003.patch
|
||||
CVE-2021-47583/^5.15/0001.patch
|
||||
CVE-2021-47616/^5.16/0001.patch
|
||||
CVE-2021-47618/^5.16/0001.patch
|
||||
CVE-2021-47636/ANY/0001.patch
|
||||
CVE-2022-3061/^5.18/0001.patch
|
||||
CVE-2022-3903/^6.0/0001.patch
|
||||
CVE-2022-4382/^6.2/0001.patch
|
||||
CVE-2022-21546/ANY/0001.patch
|
||||
CVE-2022-27950/^5.16/0001.patch
|
||||
CVE-2022-48674/^6.0/0001.patch
|
||||
CVE-2022-48713/^5.17/0001.patch
|
||||
@@ -0,0 +1,54 @@
|
||||
CVE-2022-48781/^5.17/0001.patch
|
||||
CVE-2022-48785/^5.17/0001.patch
|
||||
CVE-2022-48966/4.14/0002.patch
|
||||
CVE-2022-49034/ANY/0002.patch
|
||||
CVE-2022-49061/4.14/0002.patch
|
||||
CVE-2022-49073/ANY/0001.patch
|
||||
CVE-2022-49078/ANY/0001.patch
|
||||
CVE-2022-49146/ANY/0001.patch
|
||||
CVE-2022-49194/ANY/0001.patch
|
||||
CVE-2022-49205/ANY/0001.patch
|
||||
CVE-2022-49209/ANY/0001.patch
|
||||
CVE-2022-49285/ANY/0001.patch
|
||||
CVE-2022-49318/ANY/0001.patch
|
||||
CVE-2022-49363/ANY/0001.patch
|
||||
CVE-2022-49364/ANY/0001.patch
|
||||
CVE-2022-49380/ANY/0001.patch
|
||||
CVE-2022-49425/ANY/0001.patch
|
||||
CVE-2022-49428/ANY/0001.patch
|
||||
CVE-2022-49433/ANY/0001.patch
|
||||
CVE-2022-49500/ANY/0001.patch
|
||||
CVE-2022-49513/ANY/0001.patch
|
||||
CVE-2022-49563/ANY/0001.patch
|
||||
CVE-2022-49564/ANY/0001.patch
|
||||
CVE-2022-49566/ANY/0001.patch
|
||||
CVE-2022-49642/ANY/0001.patch
|
||||
CVE-2022-49705/ANY/0001.patch
|
||||
CVE-2022-49710/ANY/0001.patch
|
||||
CVE-2022-49777/ANY/0001.patch
|
||||
CVE-2022-49779/ANY/0001.patch
|
||||
CVE-2022-49784/ANY/0001.patch
|
||||
CVE-2022-49823/ANY/0001.patch
|
||||
CVE-2022-49824/ANY/0001.patch
|
||||
CVE-2022-49825/ANY/0001.patch
|
||||
CVE-2022-49839/ANY/0001.patch
|
||||
CVE-2022-49863/ANY/0001.patch
|
||||
CVE-2022-49980/ANY/0001.patch
|
||||
CVE-2022-49990/ANY/0001.patch
|
||||
CVE-2022-49993/4.14/0003.patch
|
||||
CVE-2022-50013/ANY/0001.patch
|
||||
CVE-2022-50062/ANY/0001.patch
|
||||
CVE-2022-50074/ANY/0001.patch
|
||||
CVE-2022-50248/ANY/0001.patch
|
||||
CVE-2022-50273/ANY/0001.patch
|
||||
CVE-2022-50326/ANY/0001.patch
|
||||
CVE-2022-50358/ANY/0001.patch
|
||||
CVE-2022-50364/ANY/0001.patch
|
||||
CVE-2022-50397/ANY/0001.patch
|
||||
CVE-2022-50473/ANY/0001.patch
|
||||
CVE-2022-50522/4.14/0003.patch
|
||||
CVE-2022-50537/ANY/0001.patch
|
||||
CVE-2023-1989/4.14/0003.patch
|
||||
CVE-2023-21657/4.14/0005.patch
|
||||
CVE-2023-23000/^5.16/0001.patch
|
||||
CVE-2023-28554/ANY/0002.patch
|
||||
@@ -0,0 +1,27 @@
|
||||
CVE-2022-48781/^5.17/0001.patch
|
||||
CVE-2022-48785/^5.17/0001.patch
|
||||
CVE-2022-48966/4.14/0002.patch
|
||||
CVE-2022-49034/ANY/0002.patch
|
||||
CVE-2022-49061/4.14/0002.patch
|
||||
CVE-2022-49073/ANY/0001.patch
|
||||
CVE-2022-49078/ANY/0001.patch
|
||||
CVE-2022-49146/ANY/0001.patch
|
||||
CVE-2022-49194/ANY/0001.patch
|
||||
CVE-2022-49205/ANY/0001.patch
|
||||
CVE-2022-49209/ANY/0001.patch
|
||||
CVE-2022-49285/ANY/0001.patch
|
||||
CVE-2022-49318/ANY/0001.patch
|
||||
CVE-2022-49363/ANY/0001.patch
|
||||
CVE-2022-49364/ANY/0001.patch
|
||||
CVE-2022-49380/ANY/0001.patch
|
||||
CVE-2022-49425/ANY/0001.patch
|
||||
CVE-2022-49428/ANY/0001.patch
|
||||
CVE-2022-49433/ANY/0001.patch
|
||||
CVE-2022-49500/ANY/0001.patch
|
||||
CVE-2022-49513/ANY/0001.patch
|
||||
CVE-2022-49563/ANY/0001.patch
|
||||
CVE-2022-49564/ANY/0001.patch
|
||||
CVE-2022-49566/ANY/0001.patch
|
||||
CVE-2022-49642/ANY/0001.patch
|
||||
CVE-2022-49705/ANY/0001.patch
|
||||
CVE-2022-49710/ANY/0001.patch
|
||||
@@ -0,0 +1,27 @@
|
||||
CVE-2022-49777/ANY/0001.patch
|
||||
CVE-2022-49779/ANY/0001.patch
|
||||
CVE-2022-49784/ANY/0001.patch
|
||||
CVE-2022-49823/ANY/0001.patch
|
||||
CVE-2022-49824/ANY/0001.patch
|
||||
CVE-2022-49825/ANY/0001.patch
|
||||
CVE-2022-49839/ANY/0001.patch
|
||||
CVE-2022-49863/ANY/0001.patch
|
||||
CVE-2022-49980/ANY/0001.patch
|
||||
CVE-2022-49990/ANY/0001.patch
|
||||
CVE-2022-49993/4.14/0003.patch
|
||||
CVE-2022-50013/ANY/0001.patch
|
||||
CVE-2022-50062/ANY/0001.patch
|
||||
CVE-2022-50074/ANY/0001.patch
|
||||
CVE-2022-50248/ANY/0001.patch
|
||||
CVE-2022-50273/ANY/0001.patch
|
||||
CVE-2022-50326/ANY/0001.patch
|
||||
CVE-2022-50358/ANY/0001.patch
|
||||
CVE-2022-50364/ANY/0001.patch
|
||||
CVE-2022-50397/ANY/0001.patch
|
||||
CVE-2022-50473/ANY/0001.patch
|
||||
CVE-2022-50522/4.14/0003.patch
|
||||
CVE-2022-50537/ANY/0001.patch
|
||||
CVE-2023-1989/4.14/0003.patch
|
||||
CVE-2023-21657/4.14/0005.patch
|
||||
CVE-2023-23000/^5.16/0001.patch
|
||||
CVE-2023-28554/ANY/0002.patch
|
||||
@@ -0,0 +1,14 @@
|
||||
CVE-2022-49777/ANY/0001.patch
|
||||
CVE-2022-49779/ANY/0001.patch
|
||||
CVE-2022-49784/ANY/0001.patch
|
||||
CVE-2022-49823/ANY/0001.patch
|
||||
CVE-2022-49824/ANY/0001.patch
|
||||
CVE-2022-49825/ANY/0001.patch
|
||||
CVE-2022-49839/ANY/0001.patch
|
||||
CVE-2022-49863/ANY/0001.patch
|
||||
CVE-2022-49980/ANY/0001.patch
|
||||
CVE-2022-49990/ANY/0001.patch
|
||||
CVE-2022-49993/4.14/0003.patch
|
||||
CVE-2022-50013/ANY/0001.patch
|
||||
CVE-2022-50062/ANY/0001.patch
|
||||
CVE-2022-50074/ANY/0001.patch
|
||||
@@ -0,0 +1,7 @@
|
||||
CVE-2022-49777/ANY/0001.patch
|
||||
CVE-2022-49779/ANY/0001.patch
|
||||
CVE-2022-49784/ANY/0001.patch
|
||||
CVE-2022-49823/ANY/0001.patch
|
||||
CVE-2022-49824/ANY/0001.patch
|
||||
CVE-2022-49825/ANY/0001.patch
|
||||
CVE-2022-49839/ANY/0001.patch
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
CVE-2022-49863/ANY/0001.patch
|
||||
CVE-2022-49990/ANY/0001.patch
|
||||
CVE-2022-49993/4.14/0003.patch
|
||||
CVE-2022-50013/ANY/0001.patch
|
||||
CVE-2022-50062/ANY/0001.patch
|
||||
CVE-2022-50074/ANY/0001.patch
|
||||
@@ -0,0 +1,7 @@
|
||||
CVE-2022-49863/ANY/0001.patch
|
||||
CVE-2022-49980/ANY/0001.patch
|
||||
CVE-2022-49990/ANY/0001.patch
|
||||
CVE-2022-49993/4.14/0003.patch
|
||||
CVE-2022-50013/ANY/0001.patch
|
||||
CVE-2022-50062/ANY/0001.patch
|
||||
CVE-2022-50074/ANY/0001.patch
|
||||
@@ -0,0 +1,13 @@
|
||||
CVE-2022-50248/ANY/0001.patch
|
||||
CVE-2022-50273/ANY/0001.patch
|
||||
CVE-2022-50326/ANY/0001.patch
|
||||
CVE-2022-50358/ANY/0001.patch
|
||||
CVE-2022-50364/ANY/0001.patch
|
||||
CVE-2022-50397/ANY/0001.patch
|
||||
CVE-2022-50473/ANY/0001.patch
|
||||
CVE-2022-50522/4.14/0003.patch
|
||||
CVE-2022-50537/ANY/0001.patch
|
||||
CVE-2023-1989/4.14/0003.patch
|
||||
CVE-2023-21657/4.14/0005.patch
|
||||
CVE-2023-23000/^5.16/0001.patch
|
||||
CVE-2023-28554/ANY/0002.patch
|
||||
@@ -0,0 +1,107 @@
|
||||
CVE-2023-33070/ANY/0001.patch
|
||||
CVE-2023-52523/^6.6/0001.patch
|
||||
CVE-2023-52595/^6.6/0001.patch
|
||||
CVE-2023-52604/4.14/0009.patch
|
||||
CVE-2023-52746/^6.2/0001.patch
|
||||
CVE-2023-52884/^6.5/0001.patch
|
||||
CVE-2023-52979/4.14/0003.patch
|
||||
CVE-2023-53001/ANY/0001.patch
|
||||
CVE-2023-53016/ANY/0001.patch
|
||||
CVE-2023-53098/ANY/0001.patch
|
||||
CVE-2023-53125/4.14/0003.patch
|
||||
CVE-2023-53131/ANY/0001.patch
|
||||
CVE-2023-53137/ANY/0001.patch
|
||||
CVE-2023-53214/ANY/0001.patch
|
||||
CVE-2023-53227/4.14/0003.patch
|
||||
CVE-2023-53250/ANY/0001.patch
|
||||
CVE-2023-53259/ANY/0002.patch
|
||||
CVE-2023-53265/4.14/0003.patch
|
||||
CVE-2023-53288/ANY/0001.patch
|
||||
CVE-2023-53312/ANY/0001.patch
|
||||
CVE-2023-53436/4.14/0003.patch
|
||||
CVE-2023-53443/ANY/0001.patch
|
||||
CVE-2023-53487/ANY/0002.patch
|
||||
CVE-2023-53537/ANY/0001.patch
|
||||
CVE-2023-53599/ANY/0001.patch
|
||||
CVE-2023-53641/ANY/0001.patch
|
||||
CVE-2023-53693/ANY/0001.patch
|
||||
CVE-2023-53695/ANY/0001.patch
|
||||
CVE-2023-53712/ANY/0001.patch
|
||||
CVE-2023-53719/ANY/0001.patch
|
||||
CVE-2024-26645/^6.8/0001.patch
|
||||
CVE-2024-26720/4.14/0009.patch
|
||||
CVE-2024-26760/^6.8/0001.patch
|
||||
CVE-2024-26920/4.14/0009.patch
|
||||
CVE-2024-26961/^6.7/0001.patch
|
||||
CVE-2024-26972/^6.8/0001.patch
|
||||
CVE-2024-27009/^6.9/0001.patch
|
||||
CVE-2024-27033/^6.8/0001.patch
|
||||
CVE-2024-27393/^6.9/0001.patch
|
||||
CVE-2024-33032/ANY/0002.patch
|
||||
CVE-2024-34027/^6.9/0001.patch
|
||||
CVE-2024-35812/4.14/0009.patch
|
||||
CVE-2024-35824/^6.8/0001.patch
|
||||
CVE-2024-35879/^6.9/0001.patch
|
||||
CVE-2024-35933/4.14/0008.patch
|
||||
CVE-2024-35950/^6.9/0001.patch
|
||||
CVE-2024-35954/^6.9/0001.patch
|
||||
CVE-2024-35962/^6.9/0001.patch
|
||||
CVE-2024-40996/^6.10/0001.patch
|
||||
CVE-2024-41041/^6.10/0001.patch
|
||||
CVE-2024-42077/^6.10/0001.patch
|
||||
CVE-2024-42102/4.14/0009.patch
|
||||
CVE-2024-42296/^6.10/0001.patch
|
||||
CVE-2024-43894/^6.11/0001.patch
|
||||
CVE-2024-44938/^6.9/0001.patch
|
||||
CVE-2024-44939/^6.9/0001.patch
|
||||
CVE-2024-44952/4.14/0008.patch
|
||||
CVE-2024-46681/^6.11/0001.patch
|
||||
CVE-2024-47747/^6.11/0001.patch
|
||||
CVE-2024-50017/^6.11/0001.patch
|
||||
CVE-2024-50019/^6.12/0001.patch
|
||||
CVE-2024-50184/^6.11/0001.patch
|
||||
CVE-2024-50195/3.17-^6.12/0001.patch
|
||||
CVE-2024-50201/^6.12/0001.patch
|
||||
CVE-2024-50210/3.17-^6.6/0001.patch
|
||||
CVE-2024-50265/^6.12/0001.patch
|
||||
CVE-2024-50267/^6.12/0001.patch
|
||||
CVE-2024-50269/^6.12/0001.patch
|
||||
CVE-2024-50279/^6.12/0001.patch
|
||||
CVE-2024-50287/^6.12/0001.patch
|
||||
CVE-2024-50290/^6.12/0001.patch
|
||||
CVE-2024-50292/^6.12/0001.patch
|
||||
CVE-2024-50295/^6.12/0001.patch
|
||||
CVE-2024-50299/^6.12/0001.patch
|
||||
CVE-2024-50301/^6.12/0001.patch
|
||||
CVE-2024-52332/ANY/0002.patch
|
||||
CVE-2024-53045/^6.12/0001.patch
|
||||
CVE-2024-53101/^6.12/0001.patch
|
||||
CVE-2024-53103/^6.12/0001.patch
|
||||
CVE-2024-53112/^6.12/0001.patch
|
||||
CVE-2024-53127/^6.12/0001.patch
|
||||
CVE-2024-53140/^6.12/0001.patch
|
||||
CVE-2024-53141/^6.12/0001.patch
|
||||
CVE-2024-53156/ANY/0002.patch
|
||||
CVE-2024-53157/ANY/0002.patch
|
||||
CVE-2024-53165/ANY/0002.patch
|
||||
CVE-2024-53171/ANY/0001.patch
|
||||
CVE-2024-53172/ANY/0002.patch
|
||||
CVE-2024-53183/ANY/0002.patch
|
||||
CVE-2024-53190/ANY/0001.patch
|
||||
CVE-2024-53194/ANY/0002.patch
|
||||
CVE-2024-53214/ANY/0002.patch
|
||||
CVE-2024-53227/ANY/0002.patch
|
||||
CVE-2024-53239/ANY/0001.patch
|
||||
CVE-2024-53680/ANY/0002.patch
|
||||
CVE-2024-53690/ANY/0001.patch
|
||||
CVE-2024-56531/ANY/0002.patch
|
||||
CVE-2024-56532/ANY/0002.patch
|
||||
CVE-2024-56536/ANY/0001.patch
|
||||
CVE-2024-56539/ANY/0002.patch
|
||||
CVE-2024-56548/ANY/0002.patch
|
||||
CVE-2024-56570/ANY/0001.patch
|
||||
CVE-2024-56586/ANY/0001.patch
|
||||
CVE-2024-56587/ANY/0002.patch
|
||||
CVE-2024-56593/ANY/0001.patch
|
||||
CVE-2024-56595/ANY/0002.patch
|
||||
CVE-2024-56597/ANY/0002.patch
|
||||
@@ -0,0 +1,215 @@
|
||||
CVE-2024-56600/ANY/0001.patch
|
||||
CVE-2024-56602/ANY/0001.patch
|
||||
CVE-2024-56603/ANY/0002.patch
|
||||
CVE-2024-56619/ANY/0002.patch
|
||||
CVE-2024-56629/ANY/0001.patch
|
||||
CVE-2024-56637/ANY/0002.patch
|
||||
CVE-2024-56643/ANY/0002.patch
|
||||
CVE-2024-56659/ANY/0002.patch
|
||||
CVE-2024-56670/ANY/0002.patch
|
||||
CVE-2024-56681/ANY/0001.patch
|
||||
CVE-2024-56687/ANY/0001.patch
|
||||
CVE-2024-56700/ANY/0002.patch
|
||||
CVE-2024-56739/ANY/0002.patch
|
||||
CVE-2024-56747/ANY/0001.patch
|
||||
CVE-2024-56767/ANY/0002.patch
|
||||
CVE-2024-56769/ANY/0002.patch
|
||||
CVE-2024-57802/ANY/0002.patch
|
||||
CVE-2024-57850/ANY/0002.patch
|
||||
CVE-2024-57893/ANY/0001.patch
|
||||
CVE-2024-57901/ANY/0001.patch
|
||||
CVE-2024-57902/ANY/0001.patch
|
||||
CVE-2024-57904/ANY/0001.patch
|
||||
CVE-2024-57908/ANY/0001.patch
|
||||
CVE-2024-57912/ANY/0001.patch
|
||||
CVE-2024-57929/ANY/0001.patch
|
||||
CVE-2024-57938/ANY/0002.patch
|
||||
CVE-2024-57948/ANY/0001.patch
|
||||
CVE-2024-57973/ANY/0001.patch
|
||||
CVE-2024-58001/ANY/0001.patch
|
||||
CVE-2024-58010/ANY/0001.patch
|
||||
CVE-2024-58055/ANY/0001.patch
|
||||
CVE-2024-58094/ANY/0001.patch
|
||||
CVE-2024-58095/ANY/0001.patch
|
||||
CVE-2025-21664/ANY/0001.patch
|
||||
CVE-2025-21689/ANY/0001.patch
|
||||
CVE-2025-21699/ANY/0001.patch
|
||||
CVE-2025-21704/ANY/0001.patch
|
||||
CVE-2025-21718/ANY/0001.patch
|
||||
CVE-2025-21735/ANY/0001.patch
|
||||
CVE-2025-21736/ANY/0001.patch
|
||||
CVE-2025-21744/ANY/0001.patch
|
||||
CVE-2025-21772/ANY/0001.patch
|
||||
CVE-2025-21776/ANY/0001.patch
|
||||
CVE-2025-21781/ANY/0001.patch
|
||||
CVE-2025-21782/ANY/0001.patch
|
||||
CVE-2025-21785/ANY/0001.patch
|
||||
CVE-2025-21791/ANY/0001.patch
|
||||
CVE-2025-21835/ANY/0001.patch
|
||||
CVE-2025-21877/ANY/0001.patch
|
||||
CVE-2025-21904/ANY/0001.patch
|
||||
CVE-2025-21910/ANY/0001.patch
|
||||
CVE-2025-21916/ANY/0001.patch
|
||||
CVE-2025-21928/ANY/0001.patch
|
||||
CVE-2025-21934/ANY/0001.patch
|
||||
CVE-2025-21935/ANY/0001.patch
|
||||
CVE-2025-21948/ANY/0001.patch
|
||||
CVE-2025-21993/ANY/0001.patch
|
||||
CVE-2025-21996/ANY/0001.patch
|
||||
CVE-2025-22007/ANY/0001.patch
|
||||
CVE-2025-22018/ANY/0001.patch
|
||||
CVE-2025-22063/ANY/0001.patch
|
||||
CVE-2025-22073/ANY/0001.patch
|
||||
CVE-2025-22079/ANY/0001.patch
|
||||
CVE-2025-22086/ANY/0001.patch
|
||||
CVE-2025-23150/ANY/0001.patch
|
||||
CVE-2025-23163/ANY/0001.patch
|
||||
CVE-2025-37738/ANY/0001.patch
|
||||
CVE-2025-37739/ANY/0001.patch
|
||||
CVE-2025-37740/ANY/0001.patch
|
||||
CVE-2025-37741/ANY/0001.patch
|
||||
CVE-2025-37749/ANY/0001.patch
|
||||
CVE-2025-37757/ANY/0001.patch
|
||||
CVE-2025-37758/ANY/0001.patch
|
||||
CVE-2025-37780/ANY/0001.patch
|
||||
CVE-2025-37781/ANY/0001.patch
|
||||
CVE-2025-37782/ANY/0001.patch
|
||||
CVE-2025-37796/ANY/0001.patch
|
||||
CVE-2025-37797/ANY/0001.patch
|
||||
CVE-2025-37798/ANY/0001.patch
|
||||
CVE-2025-37817/ANY/0001.patch
|
||||
CVE-2025-37823/ANY/0001.patch
|
||||
CVE-2025-37825/ANY/0001.patch
|
||||
CVE-2025-37833/ANY/0001.patch
|
||||
CVE-2025-37838/ANY/0001.patch
|
||||
CVE-2025-37841/ANY/0001.patch
|
||||
CVE-2025-37851/ANY/0001.patch
|
||||
CVE-2025-37857/ANY/0001.patch
|
||||
CVE-2025-37858/ANY/0001.patch
|
||||
CVE-2025-37892/ANY/0001.patch
|
||||
CVE-2025-37925/ANY/0001.patch
|
||||
CVE-2025-37937/ANY/0002.patch
|
||||
CVE-2025-37982/ANY/0001.patch
|
||||
CVE-2025-37983/ANY/0001.patch
|
||||
CVE-2025-37990/ANY/0001.patch
|
||||
CVE-2025-38046/ANY/0001.patch
|
||||
CVE-2025-38058/ANY/0001.patch
|
||||
CVE-2025-38061/ANY/0001.patch
|
||||
CVE-2025-38066/ANY/0001.patch
|
||||
CVE-2025-38075/ANY/0001.patch
|
||||
CVE-2025-38090/ANY/0001.patch
|
||||
CVE-2025-38114/ANY/0001.patch
|
||||
CVE-2025-38115/ANY/0001.patch
|
||||
CVE-2025-38147/ANY/0001.patch
|
||||
CVE-2025-38157/ANY/0001.patch
|
||||
CVE-2025-38163/ANY/0001.patch
|
||||
CVE-2025-38174/ANY/0001.patch
|
||||
CVE-2025-38177/ANY/0001.patch
|
||||
CVE-2025-38180/ANY/0001.patch
|
||||
CVE-2025-38181/ANY/0001.patch
|
||||
CVE-2025-38184/ANY/0001.patch
|
||||
CVE-2025-38185/ANY/0001.patch
|
||||
CVE-2025-38190/ANY/0001.patch
|
||||
CVE-2025-38194/ANY/0001.patch
|
||||
CVE-2025-38203/ANY/0001.patch
|
||||
CVE-2025-38212/ANY/0001.patch
|
||||
CVE-2025-38213/ANY/0001.patch
|
||||
CVE-2025-38219/ANY/0001.patch
|
||||
CVE-2025-38222/ANY/0001.patch
|
||||
CVE-2025-38245/ANY/0001.patch
|
||||
CVE-2025-38251/ANY/0001.patch
|
||||
CVE-2025-38265/ANY/0001.patch
|
||||
CVE-2025-38312/ANY/0001.patch
|
||||
CVE-2025-38320/ANY/0001.patch
|
||||
CVE-2025-38324/ANY/0001.patch
|
||||
CVE-2025-38328/ANY/0001.patch
|
||||
CVE-2025-38336/ANY/0001.patch
|
||||
CVE-2025-38344/ANY/0001.patch
|
||||
CVE-2025-38345/ANY/0001.patch
|
||||
CVE-2025-38348/ANY/0001.patch
|
||||
CVE-2025-38386/ANY/0001.patch
|
||||
CVE-2025-38403/ANY/0001.patch
|
||||
CVE-2025-38406/ANY/0001.patch
|
||||
CVE-2025-38416/ANY/0001.patch
|
||||
CVE-2025-38420/ANY/0001.patch
|
||||
CVE-2025-38428/ANY/0001.patch
|
||||
CVE-2025-38445/ANY/0001.patch
|
||||
CVE-2025-38448/ANY/0001.patch
|
||||
CVE-2025-38458/ANY/0001.patch
|
||||
CVE-2025-38459/ANY/0001.patch
|
||||
CVE-2025-38460/ANY/0001.patch
|
||||
CVE-2025-38467/ANY/0001.patch
|
||||
CVE-2025-38468/ANY/0001.patch
|
||||
CVE-2025-38470/ANY/0001.patch
|
||||
CVE-2025-38474/ANY/0001.patch
|
||||
CVE-2025-38513/ANY/0001.patch
|
||||
CVE-2025-38514/ANY/0001.patch
|
||||
CVE-2025-38538/ANY/0001.patch
|
||||
CVE-2025-38542/ANY/0001.patch
|
||||
CVE-2025-38544/ANY/0001.patch
|
||||
CVE-2025-38546/ANY/0001.patch
|
||||
CVE-2025-38555/ANY/0001.patch
|
||||
CVE-2025-38574/ANY/0001.patch
|
||||
CVE-2025-38578/ANY/0001.patch
|
||||
CVE-2025-38581/ANY/0001.patch
|
||||
CVE-2025-38604/ANY/0001.patch
|
||||
CVE-2025-38611/ANY/0001.patch
|
||||
CVE-2025-38612/ANY/0001.patch
|
||||
CVE-2025-38618/ANY/0001.patch
|
||||
CVE-2025-38639/ANY/0001.patch
|
||||
CVE-2025-38691/ANY/0001.patch
|
||||
CVE-2025-38693/ANY/0001.patch
|
||||
CVE-2025-38694/ANY/0001.patch
|
||||
CVE-2025-38697/ANY/0001.patch
|
||||
CVE-2025-38698/ANY/0001.patch
|
||||
CVE-2025-38699/ANY/0001.patch
|
||||
CVE-2025-38701/ANY/0001.patch
|
||||
CVE-2025-38708/ANY/0001.patch
|
||||
CVE-2025-38712/ANY/0001.patch
|
||||
CVE-2025-38713/ANY/0001.patch
|
||||
CVE-2025-38717/ANY/0001.patch
|
||||
CVE-2025-39676/ANY/0001.patch
|
||||
CVE-2025-39691/ANY/0001.patch
|
||||
CVE-2025-39710/ANY/0001.patch
|
||||
CVE-2025-39714/ANY/0001.patch
|
||||
CVE-2025-39743/ANY/0001.patch
|
||||
CVE-2025-39756/ANY/0001.patch
|
||||
CVE-2025-39782/ANY/0001.patch
|
||||
CVE-2025-39794/ANY/0001.patch
|
||||
CVE-2025-39796/ANY/0001.patch
|
||||
CVE-2025-39808/ANY/0001.patch
|
||||
CVE-2025-39812/ANY/0001.patch
|
||||
CVE-2025-39817/ANY/0001.patch
|
||||
CVE-2025-39839/ANY/0001.patch
|
||||
CVE-2025-39846/ANY/0001.patch
|
||||
CVE-2025-39848/ANY/0001.patch
|
||||
CVE-2025-39885/ANY/0001.patch
|
||||
CVE-2025-39889/ANY/0001.patch
|
||||
CVE-2025-39898/ANY/0001.patch
|
||||
CVE-2025-39903/ANY/0001.patch
|
||||
CVE-2025-39913/ANY/0001.patch
|
||||
CVE-2025-39920/ANY/0001.patch
|
||||
CVE-2025-39945/ANY/0001.patch
|
||||
CVE-2025-39964/ANY/0001.patch
|
||||
CVE-2025-39967/ANY/0001.patch
|
||||
CVE-2025-39973/ANY/0001.patch
|
||||
CVE-2025-39996/ANY/0001.patch
|
||||
CVE-2025-40011/ANY/0001.patch
|
||||
CVE-2025-40020/ANY/0001.patch
|
||||
CVE-2025-40022/ANY/0001.patch
|
||||
CVE-2025-40028/ANY/0001.patch
|
||||
CVE-2025-40030/ANY/0001.patch
|
||||
CVE-2025-40035/ANY/0001.patch
|
||||
CVE-2025-40044/ANY/0001.patch
|
||||
CVE-2025-40049/ANY/0001.patch
|
||||
CVE-2025-40055/ANY/0001.patch
|
||||
CVE-2025-40082/ANY/0001.patch
|
||||
CVE-2019-12819/4.14/0006.patch
|
||||
CVE-2021-47472/4.14/0003.patch
|
||||
CVE-2023-53129/ANY/0001.patch
|
||||
CVE-2023-53626/ANY/0001.patch
|
||||
CVE-2024-26720/4.14/0009.patch
|
||||
CVE-2024-39501/4.14/0009.patch
|
||||
CVE-2024-42102/4.14/0009.patch
|
||||
CVE-2024-50195/3.17-^6.12/0001.patch
|
||||
CVE-2024-50210/3.17-^6.6/0001.patch
|
||||
@@ -0,0 +1,429 @@
|
||||
0003-syzkaller-Misc/ANY/0008.patch
|
||||
CVE-2015-7837/ANY/0001.patch
|
||||
CVE-2016-3695/ANY/0001.patch
|
||||
CVE-2017-5754/^4.19/0157.patch
|
||||
CVE-2017-18232/4.14/0002.patch
|
||||
CVE-2018-5897/ANY/0001.patch
|
||||
CVE-2018-9415/ANY/0005.patch
|
||||
CVE-2018-20855/^4.18/0001.patch
|
||||
CVE-2019-3874/^5.1/0002.patch
|
||||
CVE-2019-9444/ANY/0001.patch
|
||||
CVE-2019-10520/ANY/0001.patch
|
||||
CVE-2019-11191/^5.0/0001.patch
|
||||
CVE-2019-12378/^5.1.5/0001.patch
|
||||
CVE-2019-12455/^5.2/0001.patch
|
||||
CVE-2019-12456/^5.1.5/0002.patch
|
||||
CVE-2019-15291/4.14/0004.patch
|
||||
CVE-2019-16921/^4.16/0001.patch
|
||||
CVE-2019-18786/4.14/0002.patch
|
||||
CVE-2019-19051/4.14/0008.patch
|
||||
CVE-2019-19068/4.14/0002.patch
|
||||
CVE-2019-19602/^5.4/0001.patch
|
||||
CVE-2019-20908/^5.2/0001.patch
|
||||
CVE-2020-0255/^5.6/0001.patch
|
||||
CVE-2020-8832/^4.14/0001.patch
|
||||
CVE-2020-15780/^5.8/0001.patch
|
||||
CVE-2020-16119/^5.10/0002.patch
|
||||
CVE-2020-BleedingToothExtras/^5.10/0001.patch
|
||||
CVE-2021-3493/^5.10/0001.patch
|
||||
CVE-2021-28039/^5.11/0001.patch
|
||||
CVE-2021-28950/4.14/0002.patch
|
||||
CVE-2021-29154/^5.12/0002.patch
|
||||
CVE-2021-30337/4.14/0018.patch
|
||||
CVE-2021-46912/^5.12/0001.patch
|
||||
CVE-2021-46958/^5.12/0001.patch
|
||||
CVE-2021-46999/^5.12/0001.patch
|
||||
CVE-2021-47010/^5.12/0001.patch
|
||||
CVE-2021-47058/^5.12/0001.patch
|
||||
CVE-2021-47173/4.14/0003.patch
|
||||
CVE-2021-47234/^5.13/0001.patch
|
||||
CVE-2021-47266/^5.13/0001.patch
|
||||
CVE-2021-47346/^5.13/0001.patch
|
||||
CVE-2021-47430/^5.15/0001.patch
|
||||
CVE-2021-47472/4.14/0003.patch
|
||||
CVE-2021-47583/^5.15/0001.patch
|
||||
CVE-2021-47616/^5.16/0001.patch
|
||||
CVE-2021-47618/^5.16/0001.patch
|
||||
CVE-2021-47636/ANY/0001.patch
|
||||
CVE-2022-3061/^5.18/0001.patch
|
||||
CVE-2022-3903/^6.0/0001.patch
|
||||
CVE-2022-4382/^6.2/0001.patch
|
||||
CVE-2022-21546/ANY/0001.patch
|
||||
CVE-2022-27950/^5.16/0001.patch
|
||||
CVE-2022-48674/^6.0/0001.patch
|
||||
CVE-2022-48713/^5.17/0001.patch
|
||||
CVE-2022-48781/^5.17/0001.patch
|
||||
CVE-2022-48785/^5.17/0001.patch
|
||||
CVE-2022-48966/4.14/0002.patch
|
||||
CVE-2022-49034/ANY/0002.patch
|
||||
CVE-2022-49061/4.14/0002.patch
|
||||
CVE-2022-49073/ANY/0001.patch
|
||||
CVE-2022-49078/ANY/0001.patch
|
||||
CVE-2022-49146/ANY/0001.patch
|
||||
CVE-2022-49194/ANY/0001.patch
|
||||
CVE-2022-49205/ANY/0001.patch
|
||||
CVE-2022-49209/ANY/0001.patch
|
||||
CVE-2022-49285/ANY/0001.patch
|
||||
CVE-2022-49318/ANY/0001.patch
|
||||
CVE-2022-49363/ANY/0001.patch
|
||||
CVE-2022-49364/ANY/0001.patch
|
||||
CVE-2022-49380/ANY/0001.patch
|
||||
CVE-2022-49425/ANY/0001.patch
|
||||
CVE-2022-49428/ANY/0001.patch
|
||||
CVE-2022-49433/ANY/0001.patch
|
||||
CVE-2022-49500/ANY/0001.patch
|
||||
CVE-2022-49513/ANY/0001.patch
|
||||
CVE-2022-49563/ANY/0001.patch
|
||||
CVE-2022-49564/ANY/0001.patch
|
||||
CVE-2022-49566/ANY/0001.patch
|
||||
CVE-2022-49642/ANY/0001.patch
|
||||
CVE-2022-49705/ANY/0001.patch
|
||||
CVE-2022-49710/ANY/0001.patch
|
||||
CVE-2022-49777/ANY/0001.patch
|
||||
CVE-2022-49779/ANY/0001.patch
|
||||
CVE-2022-49784/ANY/0001.patch
|
||||
CVE-2022-49823/ANY/0001.patch
|
||||
CVE-2022-49824/ANY/0001.patch
|
||||
CVE-2022-49825/ANY/0001.patch
|
||||
CVE-2022-49839/ANY/0001.patch
|
||||
CVE-2022-49863/ANY/0001.patch
|
||||
CVE-2022-49990/ANY/0001.patch
|
||||
CVE-2022-49993/4.14/0003.patch
|
||||
CVE-2022-50013/ANY/0001.patch
|
||||
CVE-2022-50062/ANY/0001.patch
|
||||
CVE-2022-50074/ANY/0001.patch
|
||||
CVE-2022-50248/ANY/0001.patch
|
||||
CVE-2022-50273/ANY/0001.patch
|
||||
CVE-2022-50326/ANY/0001.patch
|
||||
CVE-2022-50358/ANY/0001.patch
|
||||
CVE-2022-50364/ANY/0001.patch
|
||||
CVE-2022-50397/ANY/0001.patch
|
||||
CVE-2022-50473/ANY/0001.patch
|
||||
CVE-2022-50522/4.14/0003.patch
|
||||
CVE-2022-50537/ANY/0001.patch
|
||||
CVE-2023-1989/4.14/0003.patch
|
||||
CVE-2023-21657/4.14/0005.patch
|
||||
CVE-2023-23000/^5.16/0001.patch
|
||||
CVE-2023-28554/ANY/0002.patch
|
||||
CVE-2023-33070/ANY/0001.patch
|
||||
CVE-2023-52523/^6.6/0001.patch
|
||||
CVE-2023-52595/^6.6/0001.patch
|
||||
CVE-2023-52604/4.14/0009.patch
|
||||
CVE-2023-52746/^6.2/0001.patch
|
||||
CVE-2023-52884/^6.5/0001.patch
|
||||
CVE-2023-52979/4.14/0003.patch
|
||||
CVE-2023-53001/ANY/0001.patch
|
||||
CVE-2023-53016/ANY/0001.patch
|
||||
CVE-2023-53098/ANY/0001.patch
|
||||
CVE-2023-53125/4.14/0003.patch
|
||||
CVE-2023-53131/ANY/0001.patch
|
||||
CVE-2023-53137/ANY/0001.patch
|
||||
CVE-2023-53214/ANY/0001.patch
|
||||
CVE-2023-53227/4.14/0003.patch
|
||||
CVE-2023-53250/ANY/0001.patch
|
||||
CVE-2023-53259/ANY/0002.patch
|
||||
CVE-2023-53265/4.14/0003.patch
|
||||
CVE-2023-53288/ANY/0001.patch
|
||||
CVE-2023-53312/ANY/0001.patch
|
||||
CVE-2023-53436/4.14/0003.patch
|
||||
CVE-2023-53443/ANY/0001.patch
|
||||
CVE-2023-53487/ANY/0002.patch
|
||||
CVE-2023-53537/ANY/0001.patch
|
||||
CVE-2023-53599/ANY/0001.patch
|
||||
CVE-2023-53641/ANY/0001.patch
|
||||
CVE-2023-53693/ANY/0001.patch
|
||||
CVE-2023-53695/ANY/0001.patch
|
||||
CVE-2023-53712/ANY/0001.patch
|
||||
CVE-2023-53719/ANY/0001.patch
|
||||
CVE-2024-26645/^6.8/0001.patch
|
||||
CVE-2024-26720/4.14/0009.patch
|
||||
CVE-2024-26760/^6.8/0001.patch
|
||||
CVE-2024-26920/4.14/0009.patch
|
||||
CVE-2024-26961/^6.7/0001.patch
|
||||
CVE-2024-26972/^6.8/0001.patch
|
||||
CVE-2024-27009/^6.9/0001.patch
|
||||
CVE-2024-27033/^6.8/0001.patch
|
||||
CVE-2024-27393/^6.9/0001.patch
|
||||
CVE-2024-33032/ANY/0002.patch
|
||||
CVE-2024-34027/^6.9/0001.patch
|
||||
CVE-2024-35812/4.14/0009.patch
|
||||
CVE-2024-35824/^6.8/0001.patch
|
||||
CVE-2024-35879/^6.9/0001.patch
|
||||
CVE-2024-35933/4.14/0008.patch
|
||||
CVE-2024-35950/^6.9/0001.patch
|
||||
CVE-2024-35954/^6.9/0001.patch
|
||||
CVE-2024-35962/^6.9/0001.patch
|
||||
CVE-2024-40996/^6.10/0001.patch
|
||||
CVE-2024-41041/^6.10/0001.patch
|
||||
CVE-2024-42077/^6.10/0001.patch
|
||||
CVE-2024-42102/4.14/0009.patch
|
||||
CVE-2024-42296/^6.10/0001.patch
|
||||
CVE-2024-43894/^6.11/0001.patch
|
||||
CVE-2024-44938/^6.9/0001.patch
|
||||
CVE-2024-44939/^6.9/0001.patch
|
||||
CVE-2024-44952/4.14/0008.patch
|
||||
CVE-2024-46681/^6.11/0001.patch
|
||||
CVE-2024-47747/^6.11/0001.patch
|
||||
CVE-2024-50017/^6.11/0001.patch
|
||||
CVE-2024-50019/^6.12/0001.patch
|
||||
CVE-2024-50184/^6.11/0001.patch
|
||||
CVE-2024-50195/3.17-^6.12/0001.patch
|
||||
CVE-2024-50201/^6.12/0001.patch
|
||||
CVE-2024-50210/3.17-^6.6/0001.patch
|
||||
CVE-2024-50265/^6.12/0001.patch
|
||||
CVE-2024-50267/^6.12/0001.patch
|
||||
CVE-2024-50269/^6.12/0001.patch
|
||||
CVE-2024-50279/^6.12/0001.patch
|
||||
CVE-2024-50287/^6.12/0001.patch
|
||||
CVE-2024-50290/^6.12/0001.patch
|
||||
CVE-2024-50292/^6.12/0001.patch
|
||||
CVE-2024-50295/^6.12/0001.patch
|
||||
CVE-2024-50299/^6.12/0001.patch
|
||||
CVE-2024-50301/^6.12/0001.patch
|
||||
CVE-2024-52332/ANY/0002.patch
|
||||
CVE-2024-53045/^6.12/0001.patch
|
||||
CVE-2024-53101/^6.12/0001.patch
|
||||
CVE-2024-53103/^6.12/0001.patch
|
||||
CVE-2024-53112/^6.12/0001.patch
|
||||
CVE-2024-53127/^6.12/0001.patch
|
||||
CVE-2024-53140/^6.12/0001.patch
|
||||
CVE-2024-53141/^6.12/0001.patch
|
||||
CVE-2024-53156/ANY/0002.patch
|
||||
CVE-2024-53157/ANY/0002.patch
|
||||
CVE-2024-53165/ANY/0002.patch
|
||||
CVE-2024-53171/ANY/0001.patch
|
||||
CVE-2024-53172/ANY/0002.patch
|
||||
CVE-2024-53183/ANY/0002.patch
|
||||
CVE-2024-53190/ANY/0001.patch
|
||||
CVE-2024-53194/ANY/0002.patch
|
||||
CVE-2024-53214/ANY/0002.patch
|
||||
CVE-2024-53227/ANY/0002.patch
|
||||
CVE-2024-53239/ANY/0001.patch
|
||||
CVE-2024-53680/ANY/0002.patch
|
||||
CVE-2024-53690/ANY/0001.patch
|
||||
CVE-2024-56531/ANY/0002.patch
|
||||
CVE-2024-56532/ANY/0002.patch
|
||||
CVE-2024-56536/ANY/0001.patch
|
||||
CVE-2024-56539/ANY/0002.patch
|
||||
CVE-2024-56548/ANY/0002.patch
|
||||
CVE-2024-56570/ANY/0001.patch
|
||||
CVE-2024-56586/ANY/0001.patch
|
||||
CVE-2024-56587/ANY/0002.patch
|
||||
CVE-2024-56593/ANY/0001.patch
|
||||
CVE-2024-56595/ANY/0002.patch
|
||||
CVE-2024-56597/ANY/0002.patch
|
||||
CVE-2024-56600/ANY/0001.patch
|
||||
CVE-2024-56602/ANY/0001.patch
|
||||
CVE-2024-56603/ANY/0002.patch
|
||||
CVE-2024-56619/ANY/0002.patch
|
||||
CVE-2024-56629/ANY/0001.patch
|
||||
CVE-2024-56637/ANY/0002.patch
|
||||
CVE-2024-56643/ANY/0002.patch
|
||||
CVE-2024-56659/ANY/0002.patch
|
||||
CVE-2024-56670/ANY/0002.patch
|
||||
CVE-2024-56681/ANY/0001.patch
|
||||
CVE-2024-56687/ANY/0001.patch
|
||||
CVE-2024-56700/ANY/0002.patch
|
||||
CVE-2024-56739/ANY/0002.patch
|
||||
CVE-2024-56747/ANY/0001.patch
|
||||
CVE-2024-56767/ANY/0002.patch
|
||||
CVE-2024-56769/ANY/0002.patch
|
||||
CVE-2024-57802/ANY/0002.patch
|
||||
CVE-2024-57850/ANY/0002.patch
|
||||
CVE-2024-57893/ANY/0001.patch
|
||||
CVE-2024-57901/ANY/0001.patch
|
||||
CVE-2024-57902/ANY/0001.patch
|
||||
CVE-2024-57904/ANY/0001.patch
|
||||
CVE-2024-57908/ANY/0001.patch
|
||||
CVE-2024-57912/ANY/0001.patch
|
||||
CVE-2024-57929/ANY/0001.patch
|
||||
CVE-2024-57938/ANY/0002.patch
|
||||
CVE-2024-57948/ANY/0001.patch
|
||||
CVE-2024-57973/ANY/0001.patch
|
||||
CVE-2024-58001/ANY/0001.patch
|
||||
CVE-2024-58010/ANY/0001.patch
|
||||
CVE-2024-58055/ANY/0001.patch
|
||||
CVE-2024-58094/ANY/0001.patch
|
||||
CVE-2024-58095/ANY/0001.patch
|
||||
CVE-2025-21664/ANY/0001.patch
|
||||
CVE-2025-21689/ANY/0001.patch
|
||||
CVE-2025-21699/ANY/0001.patch
|
||||
CVE-2025-21704/ANY/0001.patch
|
||||
CVE-2025-21718/ANY/0001.patch
|
||||
CVE-2025-21735/ANY/0001.patch
|
||||
CVE-2025-21736/ANY/0001.patch
|
||||
CVE-2025-21744/ANY/0001.patch
|
||||
CVE-2025-21772/ANY/0001.patch
|
||||
CVE-2025-21776/ANY/0001.patch
|
||||
CVE-2025-21781/ANY/0001.patch
|
||||
CVE-2025-21782/ANY/0001.patch
|
||||
CVE-2025-21785/ANY/0001.patch
|
||||
CVE-2025-21791/ANY/0001.patch
|
||||
CVE-2025-21835/ANY/0001.patch
|
||||
CVE-2025-21877/ANY/0001.patch
|
||||
CVE-2025-21904/ANY/0001.patch
|
||||
CVE-2025-21910/ANY/0001.patch
|
||||
CVE-2025-21916/ANY/0001.patch
|
||||
CVE-2025-21928/ANY/0001.patch
|
||||
CVE-2025-21934/ANY/0001.patch
|
||||
CVE-2025-21935/ANY/0001.patch
|
||||
CVE-2025-21948/ANY/0001.patch
|
||||
CVE-2025-21993/ANY/0001.patch
|
||||
CVE-2025-21996/ANY/0001.patch
|
||||
CVE-2025-22007/ANY/0001.patch
|
||||
CVE-2025-22018/ANY/0001.patch
|
||||
CVE-2025-22063/ANY/0001.patch
|
||||
CVE-2025-22073/ANY/0001.patch
|
||||
CVE-2025-22079/ANY/0001.patch
|
||||
CVE-2025-22086/ANY/0001.patch
|
||||
CVE-2025-23150/ANY/0001.patch
|
||||
CVE-2025-23163/ANY/0001.patch
|
||||
CVE-2025-37738/ANY/0001.patch
|
||||
CVE-2025-37739/ANY/0001.patch
|
||||
CVE-2025-37740/ANY/0001.patch
|
||||
CVE-2025-37741/ANY/0001.patch
|
||||
CVE-2025-37749/ANY/0001.patch
|
||||
CVE-2025-37757/ANY/0001.patch
|
||||
CVE-2025-37758/ANY/0001.patch
|
||||
CVE-2025-37780/ANY/0001.patch
|
||||
CVE-2025-37781/ANY/0001.patch
|
||||
CVE-2025-37782/ANY/0001.patch
|
||||
CVE-2025-37796/ANY/0001.patch
|
||||
CVE-2025-37797/ANY/0001.patch
|
||||
CVE-2025-37798/ANY/0001.patch
|
||||
CVE-2025-37817/ANY/0001.patch
|
||||
CVE-2025-37823/ANY/0001.patch
|
||||
CVE-2025-37825/ANY/0001.patch
|
||||
CVE-2025-37833/ANY/0001.patch
|
||||
CVE-2025-37838/ANY/0001.patch
|
||||
CVE-2025-37841/ANY/0001.patch
|
||||
CVE-2025-37851/ANY/0001.patch
|
||||
CVE-2025-37857/ANY/0001.patch
|
||||
CVE-2025-37858/ANY/0001.patch
|
||||
CVE-2025-37892/ANY/0001.patch
|
||||
CVE-2025-37925/ANY/0001.patch
|
||||
CVE-2025-37937/ANY/0002.patch
|
||||
CVE-2025-37982/ANY/0001.patch
|
||||
CVE-2025-37983/ANY/0001.patch
|
||||
CVE-2025-37990/ANY/0001.patch
|
||||
CVE-2025-38046/ANY/0001.patch
|
||||
CVE-2025-38058/ANY/0001.patch
|
||||
CVE-2025-38061/ANY/0001.patch
|
||||
CVE-2025-38066/ANY/0001.patch
|
||||
CVE-2025-38075/ANY/0001.patch
|
||||
CVE-2025-38090/ANY/0001.patch
|
||||
CVE-2025-38114/ANY/0001.patch
|
||||
CVE-2025-38115/ANY/0001.patch
|
||||
CVE-2025-38147/ANY/0001.patch
|
||||
CVE-2025-38157/ANY/0001.patch
|
||||
CVE-2025-38163/ANY/0001.patch
|
||||
CVE-2025-38174/ANY/0001.patch
|
||||
CVE-2025-38177/ANY/0001.patch
|
||||
CVE-2025-38180/ANY/0001.patch
|
||||
CVE-2025-38181/ANY/0001.patch
|
||||
CVE-2025-38184/ANY/0001.patch
|
||||
CVE-2025-38185/ANY/0001.patch
|
||||
CVE-2025-38190/ANY/0001.patch
|
||||
CVE-2025-38194/ANY/0001.patch
|
||||
CVE-2025-38203/ANY/0001.patch
|
||||
CVE-2025-38212/ANY/0001.patch
|
||||
CVE-2025-38213/ANY/0001.patch
|
||||
CVE-2025-38219/ANY/0001.patch
|
||||
CVE-2025-38222/ANY/0001.patch
|
||||
CVE-2025-38245/ANY/0001.patch
|
||||
CVE-2025-38251/ANY/0001.patch
|
||||
CVE-2025-38265/ANY/0001.patch
|
||||
CVE-2025-38312/ANY/0001.patch
|
||||
CVE-2025-38320/ANY/0001.patch
|
||||
CVE-2025-38324/ANY/0001.patch
|
||||
CVE-2025-38328/ANY/0001.patch
|
||||
CVE-2025-38336/ANY/0001.patch
|
||||
CVE-2025-38344/ANY/0001.patch
|
||||
CVE-2025-38345/ANY/0001.patch
|
||||
CVE-2025-38348/ANY/0001.patch
|
||||
CVE-2025-38386/ANY/0001.patch
|
||||
CVE-2025-38403/ANY/0001.patch
|
||||
CVE-2025-38406/ANY/0001.patch
|
||||
CVE-2025-38416/ANY/0001.patch
|
||||
CVE-2025-38420/ANY/0001.patch
|
||||
CVE-2025-38428/ANY/0001.patch
|
||||
CVE-2025-38445/ANY/0001.patch
|
||||
CVE-2025-38448/ANY/0001.patch
|
||||
CVE-2025-38458/ANY/0001.patch
|
||||
CVE-2025-38459/ANY/0001.patch
|
||||
CVE-2025-38460/ANY/0001.patch
|
||||
CVE-2025-38467/ANY/0001.patch
|
||||
CVE-2025-38468/ANY/0001.patch
|
||||
CVE-2025-38470/ANY/0001.patch
|
||||
CVE-2025-38474/ANY/0001.patch
|
||||
CVE-2025-38513/ANY/0001.patch
|
||||
CVE-2025-38514/ANY/0001.patch
|
||||
CVE-2025-38538/ANY/0001.patch
|
||||
CVE-2025-38542/ANY/0001.patch
|
||||
CVE-2025-38544/ANY/0001.patch
|
||||
CVE-2025-38546/ANY/0001.patch
|
||||
CVE-2025-38555/ANY/0001.patch
|
||||
CVE-2025-38574/ANY/0001.patch
|
||||
CVE-2025-38578/ANY/0001.patch
|
||||
CVE-2025-38581/ANY/0001.patch
|
||||
CVE-2025-38604/ANY/0001.patch
|
||||
CVE-2025-38611/ANY/0001.patch
|
||||
CVE-2025-38612/ANY/0001.patch
|
||||
CVE-2025-38618/ANY/0001.patch
|
||||
CVE-2025-38639/ANY/0001.patch
|
||||
CVE-2025-38691/ANY/0001.patch
|
||||
CVE-2025-38693/ANY/0001.patch
|
||||
CVE-2025-38694/ANY/0001.patch
|
||||
CVE-2025-38697/ANY/0001.patch
|
||||
CVE-2025-38698/ANY/0001.patch
|
||||
CVE-2025-38699/ANY/0001.patch
|
||||
CVE-2025-38701/ANY/0001.patch
|
||||
CVE-2025-38708/ANY/0001.patch
|
||||
CVE-2025-38712/ANY/0001.patch
|
||||
CVE-2025-38713/ANY/0001.patch
|
||||
CVE-2025-38717/ANY/0001.patch
|
||||
CVE-2025-39676/ANY/0001.patch
|
||||
CVE-2025-39691/ANY/0001.patch
|
||||
CVE-2025-39710/ANY/0001.patch
|
||||
CVE-2025-39714/ANY/0001.patch
|
||||
CVE-2025-39743/ANY/0001.patch
|
||||
CVE-2025-39756/ANY/0001.patch
|
||||
CVE-2025-39782/ANY/0001.patch
|
||||
CVE-2025-39794/ANY/0001.patch
|
||||
CVE-2025-39796/ANY/0001.patch
|
||||
CVE-2025-39808/ANY/0001.patch
|
||||
CVE-2025-39812/ANY/0001.patch
|
||||
CVE-2025-39817/ANY/0001.patch
|
||||
CVE-2025-39839/ANY/0001.patch
|
||||
CVE-2025-39846/ANY/0001.patch
|
||||
CVE-2025-39848/ANY/0001.patch
|
||||
CVE-2025-39885/ANY/0001.patch
|
||||
CVE-2025-39889/ANY/0001.patch
|
||||
CVE-2025-39898/ANY/0001.patch
|
||||
CVE-2025-39903/ANY/0001.patch
|
||||
CVE-2025-39913/ANY/0001.patch
|
||||
CVE-2025-39920/ANY/0001.patch
|
||||
CVE-2025-39945/ANY/0001.patch
|
||||
CVE-2025-39964/ANY/0001.patch
|
||||
CVE-2025-39967/ANY/0001.patch
|
||||
CVE-2025-39973/ANY/0001.patch
|
||||
CVE-2025-39996/ANY/0001.patch
|
||||
CVE-2025-40011/ANY/0001.patch
|
||||
CVE-2025-40020/ANY/0001.patch
|
||||
CVE-2025-40022/ANY/0001.patch
|
||||
CVE-2025-40028/ANY/0001.patch
|
||||
CVE-2025-40030/ANY/0001.patch
|
||||
CVE-2025-40035/ANY/0001.patch
|
||||
CVE-2025-40044/ANY/0001.patch
|
||||
CVE-2025-40049/ANY/0001.patch
|
||||
CVE-2025-40055/ANY/0001.patch
|
||||
CVE-2025-40082/ANY/0001.patch
|
||||
CVE-2019-12819/4.14/0006.patch
|
||||
CVE-2021-47472/4.14/0003.patch
|
||||
CVE-2023-53129/ANY/0001.patch
|
||||
CVE-2023-53626/ANY/0001.patch
|
||||
CVE-2024-26720/4.14/0009.patch
|
||||
CVE-2024-39501/4.14/0009.patch
|
||||
CVE-2024-42102/4.14/0009.patch
|
||||
CVE-2024-50195/3.17-^6.12/0001.patch
|
||||
CVE-2024-50210/3.17-^6.6/0001.patch
|
||||
@@ -0,0 +1,38 @@
|
||||
# relative to AXP kernel_patches
|
||||
# LAB 2026-10-01: alone ⇒ Google-logo hang (udc_lock recursive deadlock on
|
||||
# msm-4.14; needs lock-scope companion, not one-liner). Do not re-apply.
|
||||
CVE-2022-49980/ANY/0001.patch
|
||||
CVE-2017-15832/qcacld-3.0/0001.patch
|
||||
CVE-2021-29648/^5.11/0001.patch
|
||||
CVE-2022-33246/audio-kernel/0002.patch
|
||||
CVE-2022-49545/ANY/0001.patch
|
||||
CVE-2022-49552/ANY/0001.patch
|
||||
CVE-2022-49801/ANY/0001.patch
|
||||
CVE-2022-50421/ANY/0001.patch
|
||||
CVE-2023-33064/audio-kernel/0001.patch
|
||||
CVE-2023-33065/audio-kernel/0001.patch
|
||||
CVE-2023-43528/audio-kernel/0001.patch
|
||||
CVE-2023-52741/^6.2/0001.patch
|
||||
CVE-2023-53103/ANY/0001.patch
|
||||
CVE-2023-53660/ANY/0001.patch
|
||||
CVE-2024-21459/qca-wifi-host-cmn/0001.patch
|
||||
CVE-2024-38564/^6.9/0001.patch
|
||||
CVE-2024-56553/ANY/0001.patch
|
||||
CVE-2024-56554/ANY/0001.patch
|
||||
CVE-2024-56692/ANY/0001.patch
|
||||
CVE-2024-56780/ANY/0001.patch
|
||||
CVE-2025-21629/ANY/0001.patch
|
||||
CVE-2025-21653/ANY/0001.patch
|
||||
CVE-2025-21762/ANY/0001.patch
|
||||
CVE-2025-21764/ANY/0001.patch
|
||||
CVE-2025-21765/ANY/0001.patch
|
||||
CVE-2025-21859/ANY/0001.patch
|
||||
CVE-2025-21954/ANY/0001.patch
|
||||
CVE-2025-22035/ANY/0001.patch
|
||||
CVE-2025-37785/ANY/0001.patch
|
||||
CVE-2025-37960/ANY/0001.patch
|
||||
CVE-2025-38099/ANY/0001.patch
|
||||
CVE-2025-38253/ANY/0001.patch
|
||||
CVE-2025-38677/ANY/0001.patch
|
||||
CVE-2025-39770/ANY/0001.patch
|
||||
CVE-2025-39813/ANY/0001.patch
|
||||
@@ -0,0 +1,9 @@
|
||||
# High-offset sunfish batch1 (fuzz=0 spot-checked). Applied with CVE_MAX_ABS_OFFSET=9999
|
||||
# after cve-clean-offset. Dropped CVE-2023-3777: nft_chain_is_bound missing on 4.14.
|
||||
CVE-2020-29372/^5.7/0001.patch
|
||||
CVE-2021-47209/^5.15/0001.patch
|
||||
CVE-2022-50246/ANY/0001.patch
|
||||
CVE-2023-53669/ANY/0001.patch
|
||||
CVE-2024-40954/^6.10/0001.patch
|
||||
CVE-2024-50186/^6.12/0001.patch
|
||||
CVE-2024-43879/^6.10/0001.patch
|
||||
@@ -0,0 +1,10 @@
|
||||
# High-offset sunfish batch2 (after batch1 BOOT_OK #48). Elevated CVE_MAX_ABS_OFFSET=9999.
|
||||
# Prefer mm/sched/sysctl/f2fs/wifi/driver-core; skip nf_tables-style (missing helpers).
|
||||
CVE-2022-49641/ANY/0001.patch
|
||||
CVE-2023-52707/^6.2/0001.patch
|
||||
CVE-2023-53594/ANY/0001.patch
|
||||
CVE-2023-53709/ANY/0001.patch
|
||||
CVE-2024-40917/^6.10/0001.patch
|
||||
CVE-2024-56569/ANY/0001.patch
|
||||
CVE-2025-21909/ANY/0001.patch
|
||||
CVE-2025-38218/ANY/0001.patch
|
||||
@@ -0,0 +1,11 @@
|
||||
# High-offset sunfish batch3 — remaining KEEP after batch1+2 BOOT_OK #49.
|
||||
# Skip CVE-2023-3777 / CVE-2024-26643 (nf_tables helpers missing on 4.14).
|
||||
CVE-2021-47299/^5.13/0001.patch
|
||||
CVE-2022-49341/ANY/0001.patch
|
||||
CVE-2022-49412/ANY/0001.patch
|
||||
CVE-2023-52676/^6.7/0001.patch
|
||||
CVE-2024-46754/^6.10/0001.patch
|
||||
CVE-2025-37923/ANY/0001.patch
|
||||
CVE-2025-38285/ANY/0001.patch
|
||||
CVE-2025-39751/ANY/0001.patch
|
||||
CVE-2025-40078/ANY/0001.patch
|
||||
@@ -0,0 +1,73 @@
|
||||
CVE-2020-29372/^5.7/0001.patch
|
||||
CVE-2021-47209/^5.15/0001.patch
|
||||
CVE-2021-47299/^5.13/0001.patch
|
||||
CVE-2022-48825/^5.17/0001.patch
|
||||
CVE-2022-48969/^6.1/0001.patch
|
||||
CVE-2022-49086/ANY/0001.patch
|
||||
CVE-2022-49341/ANY/0001.patch
|
||||
CVE-2022-49412/ANY/0001.patch
|
||||
CVE-2022-49641/ANY/0001.patch
|
||||
CVE-2022-49687/ANY/0001.patch
|
||||
CVE-2022-49695/ANY/0001.patch
|
||||
CVE-2022-49715/ANY/0001.patch
|
||||
CVE-2022-50246/ANY/0001.patch
|
||||
CVE-2022-50304/ANY/0001.patch
|
||||
CVE-2023-3777/^6.5/0001.patch
|
||||
CVE-2023-52486/^6.7/0001.patch
|
||||
CVE-2023-52676/^6.7/0001.patch
|
||||
CVE-2023-52707/^6.2/0001.patch
|
||||
CVE-2023-52847/^6.6/0001.patch
|
||||
CVE-2023-53594/ANY/0001.patch
|
||||
CVE-2023-53669/ANY/0001.patch
|
||||
CVE-2023-53709/ANY/0001.patch
|
||||
CVE-2024-2201/^6.9/0001.patch
|
||||
CVE-2024-24855/^6.4/0001.patch
|
||||
CVE-2024-26643/^6.8/0001.patch
|
||||
CVE-2024-26900/^6.8/0001.patch
|
||||
CVE-2024-39296/^6.9/0001.patch
|
||||
CVE-2024-40917/^6.10/0001.patch
|
||||
CVE-2024-40923/^6.10/0001.patch
|
||||
CVE-2024-40954/^6.10/0001.patch
|
||||
CVE-2024-41014/^6.10/0001.patch
|
||||
CVE-2024-43879/^6.10/0001.patch
|
||||
CVE-2024-46754/^6.10/0001.patch
|
||||
CVE-2024-46830/^6.11/0001.patch
|
||||
CVE-2024-50186/^6.12/0001.patch
|
||||
CVE-2024-50273/^6.11/0001.patch
|
||||
CVE-2024-53066/^6.12/0001.patch
|
||||
CVE-2024-53173/ANY/0002.patch
|
||||
CVE-2024-53217/ANY/0002.patch
|
||||
CVE-2024-53240/ANY/0001.patch
|
||||
CVE-2024-56558/ANY/0001.patch
|
||||
CVE-2024-56569/ANY/0001.patch
|
||||
CVE-2024-56596/ANY/0002.patch
|
||||
CVE-2024-56598/ANY/0002.patch
|
||||
CVE-2024-56605/ANY/0002.patch
|
||||
CVE-2024-56779/ANY/0002.patch
|
||||
CVE-2024-57849/ANY/0002.patch
|
||||
CVE-2024-58009/ANY/0001.patch
|
||||
CVE-2024-58083/ANY/0001.patch
|
||||
CVE-2025-21671/ANY/0001.patch
|
||||
CVE-2025-21909/ANY/0001.patch
|
||||
CVE-2025-37789/ANY/0001.patch
|
||||
CVE-2025-37795/ANY/0001.patch
|
||||
CVE-2025-37839/ANY/0001.patch
|
||||
CVE-2025-37923/ANY/0001.patch
|
||||
CVE-2025-37932/ANY/0001.patch
|
||||
CVE-2025-38034/ANY/0001.patch
|
||||
CVE-2025-38044/ANY/0001.patch
|
||||
CVE-2025-38200/ANY/0001.patch
|
||||
CVE-2025-38204/ANY/0001.patch
|
||||
CVE-2025-38218/ANY/0001.patch
|
||||
CVE-2025-38285/ANY/0001.patch
|
||||
CVE-2025-38473/ANY/0001.patch
|
||||
CVE-2025-38495/ANY/0001.patch
|
||||
CVE-2025-38498/ANY/0002.patch
|
||||
CVE-2025-39742/ANY/0001.patch
|
||||
CVE-2025-39751/ANY/0001.patch
|
||||
CVE-2025-39824/ANY/0001.patch
|
||||
CVE-2025-39847/ANY/0001.patch
|
||||
CVE-2025-39874/ANY/0001.patch
|
||||
CVE-2025-39998/ANY/0001.patch
|
||||
CVE-2025-40078/ANY/0001.patch
|
||||
CVE-2025-40080/ANY/0001.patch
|
||||
+26
@@ -0,0 +1,26 @@
|
||||
CVE-2020-29372/^5.7/0001.patch
|
||||
CVE-2021-47209/^5.15/0001.patch
|
||||
CVE-2021-47299/^5.13/0001.patch
|
||||
CVE-2022-49341/ANY/0001.patch
|
||||
CVE-2022-49412/ANY/0001.patch
|
||||
CVE-2022-49641/ANY/0001.patch
|
||||
CVE-2022-50246/ANY/0001.patch
|
||||
CVE-2023-3777/^6.5/0001.patch
|
||||
CVE-2023-52676/^6.7/0001.patch
|
||||
CVE-2023-52707/^6.2/0001.patch
|
||||
CVE-2023-53594/ANY/0001.patch
|
||||
CVE-2023-53669/ANY/0001.patch
|
||||
CVE-2023-53709/ANY/0001.patch
|
||||
CVE-2024-26643/^6.8/0001.patch
|
||||
CVE-2024-40917/^6.10/0001.patch
|
||||
CVE-2024-40954/^6.10/0001.patch
|
||||
CVE-2024-43879/^6.10/0001.patch
|
||||
CVE-2024-46754/^6.10/0001.patch
|
||||
CVE-2024-50186/^6.12/0001.patch
|
||||
CVE-2024-56569/ANY/0001.patch
|
||||
CVE-2025-21909/ANY/0001.patch
|
||||
CVE-2025-37923/ANY/0001.patch
|
||||
CVE-2025-38218/ANY/0001.patch
|
||||
CVE-2025-38285/ANY/0001.patch
|
||||
CVE-2025-39751/ANY/0001.patch
|
||||
CVE-2025-40078/ANY/0001.patch
|
||||
+47
@@ -0,0 +1,47 @@
|
||||
CVE-2022-48825/^5.17/0001.patch # no_live_path_match
|
||||
CVE-2022-48969/^6.1/0001.patch # deadnet
|
||||
CVE-2022-49086/ANY/0001.patch # deadnet
|
||||
CVE-2022-49687/ANY/0001.patch # deadnet
|
||||
CVE-2022-49695/ANY/0001.patch # deadnet
|
||||
CVE-2022-49715/ANY/0001.patch # no_live_path_match
|
||||
CVE-2022-50304/ANY/0001.patch # no_live_path_match
|
||||
CVE-2023-52486/^6.7/0001.patch # no_live_path_match
|
||||
CVE-2023-52847/^6.6/0001.patch # no_live_path_match
|
||||
CVE-2024-2201/^6.9/0001.patch # offarch
|
||||
CVE-2024-24855/^6.4/0001.patch # no_live_path_match
|
||||
CVE-2024-26900/^6.8/0001.patch # no_live_path_match
|
||||
CVE-2024-39296/^6.9/0001.patch # deadnet
|
||||
CVE-2024-40923/^6.10/0001.patch # deadnet
|
||||
CVE-2024-41014/^6.10/0001.patch # deadfs
|
||||
CVE-2024-46830/^6.11/0001.patch # offarch
|
||||
CVE-2024-50273/^6.11/0001.patch # deadfs
|
||||
CVE-2024-53066/^6.12/0001.patch # deadfs
|
||||
CVE-2024-53173/ANY/0002.patch # deadfs
|
||||
CVE-2024-53217/ANY/0002.patch # deadfs
|
||||
CVE-2024-53240/ANY/0001.patch # deadnet
|
||||
CVE-2024-56558/ANY/0001.patch # deadfs
|
||||
CVE-2024-56596/ANY/0002.patch # no_live_path_match
|
||||
CVE-2024-56598/ANY/0002.patch # no_live_path_match
|
||||
CVE-2024-56605/ANY/0002.patch # no_live_path_match
|
||||
CVE-2024-56779/ANY/0002.patch # deadfs
|
||||
CVE-2024-57849/ANY/0002.patch # offarch
|
||||
CVE-2024-58009/ANY/0001.patch # no_live_path_match
|
||||
CVE-2024-58083/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-21671/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-37789/ANY/0001.patch # deadnet
|
||||
CVE-2025-37795/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-37839/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-37932/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-38034/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-38044/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-38200/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-38204/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-38473/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-38495/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-38498/ANY/0002.patch # no_live_path_match
|
||||
CVE-2025-39742/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-39824/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-39847/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-39874/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-39998/ANY/0001.patch # no_live_path_match
|
||||
CVE-2025-40080/ANY/0001.patch # no_live_path_match
|
||||
@@ -0,0 +1,503 @@
|
||||
0003-syzkaller-Misc/ANY/0008.patch
|
||||
CVE-2015-7837/ANY/0001.patch
|
||||
CVE-2016-3695/ANY/0001.patch
|
||||
CVE-2017-5754/^4.19/0157.patch
|
||||
CVE-2017-18232/4.14/0002.patch
|
||||
CVE-2018-5897/ANY/0001.patch
|
||||
CVE-2018-9415/ANY/0005.patch
|
||||
CVE-2018-20855/^4.18/0001.patch
|
||||
CVE-2019-3874/^5.1/0002.patch
|
||||
CVE-2019-9444/ANY/0001.patch
|
||||
CVE-2019-10520/ANY/0001.patch
|
||||
CVE-2019-11191/^5.0/0001.patch
|
||||
CVE-2019-12378/^5.1.5/0001.patch
|
||||
CVE-2019-12455/^5.2/0001.patch
|
||||
CVE-2019-12456/^5.1.5/0002.patch
|
||||
CVE-2019-15291/4.14/0004.patch
|
||||
CVE-2019-16921/^4.16/0001.patch
|
||||
CVE-2019-18786/4.14/0002.patch
|
||||
CVE-2019-19051/4.14/0008.patch
|
||||
CVE-2019-19068/4.14/0002.patch
|
||||
CVE-2019-19602/^5.4/0001.patch
|
||||
CVE-2019-20908/^5.2/0001.patch
|
||||
CVE-2020-0255/^5.6/0001.patch
|
||||
CVE-2020-8832/^4.14/0001.patch
|
||||
CVE-2020-15780/^5.8/0001.patch
|
||||
CVE-2020-16119/^5.10/0002.patch
|
||||
CVE-2020-29372/^5.7/0001.patch
|
||||
CVE-2020-BleedingToothExtras/^5.10/0001.patch
|
||||
CVE-2021-3493/^5.10/0001.patch
|
||||
CVE-2021-28039/^5.11/0001.patch
|
||||
CVE-2021-28950/4.14/0002.patch
|
||||
CVE-2021-29154/^5.12/0002.patch
|
||||
CVE-2021-30337/4.14/0018.patch
|
||||
CVE-2021-46912/^5.12/0001.patch
|
||||
CVE-2021-46958/^5.12/0001.patch
|
||||
CVE-2021-46999/^5.12/0001.patch
|
||||
CVE-2021-47010/^5.12/0001.patch
|
||||
CVE-2021-47058/^5.12/0001.patch
|
||||
CVE-2021-47173/4.14/0003.patch
|
||||
CVE-2021-47209/^5.15/0001.patch
|
||||
CVE-2021-47234/^5.13/0001.patch
|
||||
CVE-2021-47266/^5.13/0001.patch
|
||||
CVE-2021-47299/^5.13/0001.patch
|
||||
CVE-2021-47346/^5.13/0001.patch
|
||||
CVE-2021-47430/^5.15/0001.patch
|
||||
CVE-2021-47472/4.14/0003.patch
|
||||
CVE-2021-47583/^5.15/0001.patch
|
||||
CVE-2021-47616/^5.16/0001.patch
|
||||
CVE-2021-47618/^5.16/0001.patch
|
||||
CVE-2021-47636/ANY/0001.patch
|
||||
CVE-2022-3061/^5.18/0001.patch
|
||||
CVE-2022-3903/^6.0/0001.patch
|
||||
CVE-2022-4382/^6.2/0001.patch
|
||||
CVE-2022-21546/ANY/0001.patch
|
||||
CVE-2022-27950/^5.16/0001.patch
|
||||
CVE-2022-48674/^6.0/0001.patch
|
||||
CVE-2022-48713/^5.17/0001.patch
|
||||
CVE-2022-48781/^5.17/0001.patch
|
||||
CVE-2022-48785/^5.17/0001.patch
|
||||
CVE-2022-48825/^5.17/0001.patch
|
||||
CVE-2022-48966/4.14/0002.patch
|
||||
CVE-2022-48969/^6.1/0001.patch
|
||||
CVE-2022-49034/ANY/0002.patch
|
||||
CVE-2022-49061/4.14/0002.patch
|
||||
CVE-2022-49073/ANY/0001.patch
|
||||
CVE-2022-49078/ANY/0001.patch
|
||||
CVE-2022-49086/ANY/0001.patch
|
||||
CVE-2022-49146/ANY/0001.patch
|
||||
CVE-2022-49194/ANY/0001.patch
|
||||
CVE-2022-49205/ANY/0001.patch
|
||||
CVE-2022-49209/ANY/0001.patch
|
||||
CVE-2022-49285/ANY/0001.patch
|
||||
CVE-2022-49318/ANY/0001.patch
|
||||
CVE-2022-49341/ANY/0001.patch
|
||||
CVE-2022-49363/ANY/0001.patch
|
||||
CVE-2022-49364/ANY/0001.patch
|
||||
CVE-2022-49380/ANY/0001.patch
|
||||
CVE-2022-49412/ANY/0001.patch
|
||||
CVE-2022-49425/ANY/0001.patch
|
||||
CVE-2022-49428/ANY/0001.patch
|
||||
CVE-2022-49433/ANY/0001.patch
|
||||
CVE-2022-49500/ANY/0001.patch
|
||||
CVE-2022-49513/ANY/0001.patch
|
||||
CVE-2022-49563/ANY/0001.patch
|
||||
CVE-2022-49564/ANY/0001.patch
|
||||
CVE-2022-49566/ANY/0001.patch
|
||||
CVE-2022-49641/ANY/0001.patch
|
||||
CVE-2022-49642/ANY/0001.patch
|
||||
CVE-2022-49687/ANY/0001.patch
|
||||
CVE-2022-49695/ANY/0001.patch
|
||||
CVE-2022-49705/ANY/0001.patch
|
||||
CVE-2022-49710/ANY/0001.patch
|
||||
CVE-2022-49715/ANY/0001.patch
|
||||
CVE-2022-49777/ANY/0001.patch
|
||||
CVE-2022-49779/ANY/0001.patch
|
||||
CVE-2022-49784/ANY/0001.patch
|
||||
CVE-2022-49823/ANY/0001.patch
|
||||
CVE-2022-49824/ANY/0001.patch
|
||||
CVE-2022-49825/ANY/0001.patch
|
||||
CVE-2022-49839/ANY/0001.patch
|
||||
CVE-2022-49863/ANY/0001.patch
|
||||
CVE-2022-49980/ANY/0001.patch
|
||||
CVE-2022-49990/ANY/0001.patch
|
||||
CVE-2022-49993/4.14/0003.patch
|
||||
CVE-2022-50013/ANY/0001.patch
|
||||
CVE-2022-50062/ANY/0001.patch
|
||||
CVE-2022-50074/ANY/0001.patch
|
||||
CVE-2022-50246/ANY/0001.patch
|
||||
CVE-2022-50248/ANY/0001.patch
|
||||
CVE-2022-50273/ANY/0001.patch
|
||||
CVE-2022-50304/ANY/0001.patch
|
||||
CVE-2022-50326/ANY/0001.patch
|
||||
CVE-2022-50358/ANY/0001.patch
|
||||
CVE-2022-50364/ANY/0001.patch
|
||||
CVE-2022-50397/ANY/0001.patch
|
||||
CVE-2022-50473/ANY/0001.patch
|
||||
CVE-2022-50522/4.14/0003.patch
|
||||
CVE-2022-50537/ANY/0001.patch
|
||||
CVE-2023-1989/4.14/0003.patch
|
||||
CVE-2023-3777/^6.5/0001.patch
|
||||
CVE-2023-21657/4.14/0005.patch
|
||||
CVE-2023-23000/^5.16/0001.patch
|
||||
CVE-2023-28554/ANY/0002.patch
|
||||
CVE-2023-33070/ANY/0001.patch
|
||||
CVE-2023-52486/^6.7/0001.patch
|
||||
CVE-2023-52523/^6.6/0001.patch
|
||||
CVE-2023-52595/^6.6/0001.patch
|
||||
CVE-2023-52604/4.14/0009.patch
|
||||
CVE-2023-52676/^6.7/0001.patch
|
||||
CVE-2023-52707/^6.2/0001.patch
|
||||
CVE-2023-52746/^6.2/0001.patch
|
||||
CVE-2023-52847/^6.6/0001.patch
|
||||
CVE-2023-52884/^6.5/0001.patch
|
||||
CVE-2023-52979/4.14/0003.patch
|
||||
CVE-2023-53001/ANY/0001.patch
|
||||
CVE-2023-53016/ANY/0001.patch
|
||||
CVE-2023-53098/ANY/0001.patch
|
||||
CVE-2023-53125/4.14/0003.patch
|
||||
CVE-2023-53131/ANY/0001.patch
|
||||
CVE-2023-53137/ANY/0001.patch
|
||||
CVE-2023-53214/ANY/0001.patch
|
||||
CVE-2023-53227/4.14/0003.patch
|
||||
CVE-2023-53250/ANY/0001.patch
|
||||
CVE-2023-53259/ANY/0002.patch
|
||||
CVE-2023-53265/4.14/0003.patch
|
||||
CVE-2023-53288/ANY/0001.patch
|
||||
CVE-2023-53312/ANY/0001.patch
|
||||
CVE-2023-53436/4.14/0003.patch
|
||||
CVE-2023-53443/ANY/0001.patch
|
||||
CVE-2023-53487/ANY/0002.patch
|
||||
CVE-2023-53537/ANY/0001.patch
|
||||
CVE-2023-53594/ANY/0001.patch
|
||||
CVE-2023-53599/ANY/0001.patch
|
||||
CVE-2023-53641/ANY/0001.patch
|
||||
CVE-2023-53669/ANY/0001.patch
|
||||
CVE-2023-53693/ANY/0001.patch
|
||||
CVE-2023-53695/ANY/0001.patch
|
||||
CVE-2023-53709/ANY/0001.patch
|
||||
CVE-2023-53712/ANY/0001.patch
|
||||
CVE-2023-53719/ANY/0001.patch
|
||||
CVE-2024-2201/^6.9/0001.patch
|
||||
CVE-2024-24855/^6.4/0001.patch
|
||||
CVE-2024-26643/^6.8/0001.patch
|
||||
CVE-2024-26645/^6.8/0001.patch
|
||||
CVE-2024-26720/4.14/0009.patch
|
||||
CVE-2024-26760/^6.8/0001.patch
|
||||
CVE-2024-26900/^6.8/0001.patch
|
||||
CVE-2024-26920/4.14/0009.patch
|
||||
CVE-2024-26961/^6.7/0001.patch
|
||||
CVE-2024-26972/^6.8/0001.patch
|
||||
CVE-2024-27009/^6.9/0001.patch
|
||||
CVE-2024-27033/^6.8/0001.patch
|
||||
CVE-2024-27393/^6.9/0001.patch
|
||||
CVE-2024-33032/ANY/0002.patch
|
||||
CVE-2024-34027/^6.9/0001.patch
|
||||
CVE-2024-35812/4.14/0009.patch
|
||||
CVE-2024-35824/^6.8/0001.patch
|
||||
CVE-2024-35879/^6.9/0001.patch
|
||||
CVE-2024-35933/4.14/0008.patch
|
||||
CVE-2024-35950/^6.9/0001.patch
|
||||
CVE-2024-35954/^6.9/0001.patch
|
||||
CVE-2024-35962/^6.9/0001.patch
|
||||
CVE-2024-39296/^6.9/0001.patch
|
||||
CVE-2024-40917/^6.10/0001.patch
|
||||
CVE-2024-40923/^6.10/0001.patch
|
||||
CVE-2024-40954/^6.10/0001.patch
|
||||
CVE-2024-40996/^6.10/0001.patch
|
||||
CVE-2024-41014/^6.10/0001.patch
|
||||
CVE-2024-41041/^6.10/0001.patch
|
||||
CVE-2024-42077/^6.10/0001.patch
|
||||
CVE-2024-42102/4.14/0009.patch
|
||||
CVE-2024-42296/^6.10/0001.patch
|
||||
CVE-2024-43879/^6.10/0001.patch
|
||||
CVE-2024-43894/^6.11/0001.patch
|
||||
CVE-2024-44938/^6.9/0001.patch
|
||||
CVE-2024-44939/^6.9/0001.patch
|
||||
CVE-2024-44952/4.14/0008.patch
|
||||
CVE-2024-46681/^6.11/0001.patch
|
||||
CVE-2024-46754/^6.10/0001.patch
|
||||
CVE-2024-46830/^6.11/0001.patch
|
||||
CVE-2024-47747/^6.11/0001.patch
|
||||
CVE-2024-50017/^6.11/0001.patch
|
||||
CVE-2024-50019/^6.12/0001.patch
|
||||
CVE-2024-50184/^6.11/0001.patch
|
||||
CVE-2024-50186/^6.12/0001.patch
|
||||
CVE-2024-50195/3.17-^6.12/0001.patch
|
||||
CVE-2024-50201/^6.12/0001.patch
|
||||
CVE-2024-50210/3.17-^6.6/0001.patch
|
||||
CVE-2024-50265/^6.12/0001.patch
|
||||
CVE-2024-50267/^6.12/0001.patch
|
||||
CVE-2024-50269/^6.12/0001.patch
|
||||
CVE-2024-50273/^6.11/0001.patch
|
||||
CVE-2024-50279/^6.12/0001.patch
|
||||
CVE-2024-50287/^6.12/0001.patch
|
||||
CVE-2024-50290/^6.12/0001.patch
|
||||
CVE-2024-50292/^6.12/0001.patch
|
||||
CVE-2024-50295/^6.12/0001.patch
|
||||
CVE-2024-50299/^6.12/0001.patch
|
||||
CVE-2024-50301/^6.12/0001.patch
|
||||
CVE-2024-52332/ANY/0002.patch
|
||||
CVE-2024-53045/^6.12/0001.patch
|
||||
CVE-2024-53066/^6.12/0001.patch
|
||||
CVE-2024-53101/^6.12/0001.patch
|
||||
CVE-2024-53103/^6.12/0001.patch
|
||||
CVE-2024-53112/^6.12/0001.patch
|
||||
CVE-2024-53127/^6.12/0001.patch
|
||||
CVE-2024-53140/^6.12/0001.patch
|
||||
CVE-2024-53141/^6.12/0001.patch
|
||||
CVE-2024-53156/ANY/0002.patch
|
||||
CVE-2024-53157/ANY/0002.patch
|
||||
CVE-2024-53165/ANY/0002.patch
|
||||
CVE-2024-53171/ANY/0001.patch
|
||||
CVE-2024-53172/ANY/0002.patch
|
||||
CVE-2024-53173/ANY/0002.patch
|
||||
CVE-2024-53183/ANY/0002.patch
|
||||
CVE-2024-53190/ANY/0001.patch
|
||||
CVE-2024-53194/ANY/0002.patch
|
||||
CVE-2024-53214/ANY/0002.patch
|
||||
CVE-2024-53217/ANY/0002.patch
|
||||
CVE-2024-53227/ANY/0002.patch
|
||||
CVE-2024-53239/ANY/0001.patch
|
||||
CVE-2024-53240/ANY/0001.patch
|
||||
CVE-2024-53680/ANY/0002.patch
|
||||
CVE-2024-53690/ANY/0001.patch
|
||||
CVE-2024-56531/ANY/0002.patch
|
||||
CVE-2024-56532/ANY/0002.patch
|
||||
CVE-2024-56536/ANY/0001.patch
|
||||
CVE-2024-56539/ANY/0002.patch
|
||||
CVE-2024-56548/ANY/0002.patch
|
||||
CVE-2024-56558/ANY/0001.patch
|
||||
CVE-2024-56569/ANY/0001.patch
|
||||
CVE-2024-56570/ANY/0001.patch
|
||||
CVE-2024-56586/ANY/0001.patch
|
||||
CVE-2024-56587/ANY/0002.patch
|
||||
CVE-2024-56593/ANY/0001.patch
|
||||
CVE-2024-56595/ANY/0002.patch
|
||||
CVE-2024-56596/ANY/0002.patch
|
||||
CVE-2024-56597/ANY/0002.patch
|
||||
CVE-2024-56598/ANY/0002.patch
|
||||
CVE-2024-56600/ANY/0001.patch
|
||||
CVE-2024-56602/ANY/0001.patch
|
||||
CVE-2024-56603/ANY/0002.patch
|
||||
CVE-2024-56605/ANY/0002.patch
|
||||
CVE-2024-56619/ANY/0002.patch
|
||||
CVE-2024-56629/ANY/0001.patch
|
||||
CVE-2024-56637/ANY/0002.patch
|
||||
CVE-2024-56643/ANY/0002.patch
|
||||
CVE-2024-56659/ANY/0002.patch
|
||||
CVE-2024-56670/ANY/0002.patch
|
||||
CVE-2024-56681/ANY/0001.patch
|
||||
CVE-2024-56687/ANY/0001.patch
|
||||
CVE-2024-56700/ANY/0002.patch
|
||||
CVE-2024-56739/ANY/0002.patch
|
||||
CVE-2024-56747/ANY/0001.patch
|
||||
CVE-2024-56767/ANY/0002.patch
|
||||
CVE-2024-56769/ANY/0002.patch
|
||||
CVE-2024-56779/ANY/0002.patch
|
||||
CVE-2024-57802/ANY/0002.patch
|
||||
CVE-2024-57849/ANY/0002.patch
|
||||
CVE-2024-57850/ANY/0002.patch
|
||||
CVE-2024-57893/ANY/0001.patch
|
||||
CVE-2024-57901/ANY/0001.patch
|
||||
CVE-2024-57902/ANY/0001.patch
|
||||
CVE-2024-57904/ANY/0001.patch
|
||||
CVE-2024-57908/ANY/0001.patch
|
||||
CVE-2024-57912/ANY/0001.patch
|
||||
CVE-2024-57929/ANY/0001.patch
|
||||
CVE-2024-57938/ANY/0002.patch
|
||||
CVE-2024-57948/ANY/0001.patch
|
||||
CVE-2024-57973/ANY/0001.patch
|
||||
CVE-2024-58001/ANY/0001.patch
|
||||
CVE-2024-58009/ANY/0001.patch
|
||||
CVE-2024-58010/ANY/0001.patch
|
||||
CVE-2024-58055/ANY/0001.patch
|
||||
CVE-2024-58083/ANY/0001.patch
|
||||
CVE-2024-58094/ANY/0001.patch
|
||||
CVE-2024-58095/ANY/0001.patch
|
||||
CVE-2025-21664/ANY/0001.patch
|
||||
CVE-2025-21671/ANY/0001.patch
|
||||
CVE-2025-21689/ANY/0001.patch
|
||||
CVE-2025-21699/ANY/0001.patch
|
||||
CVE-2025-21704/ANY/0001.patch
|
||||
CVE-2025-21718/ANY/0001.patch
|
||||
CVE-2025-21735/ANY/0001.patch
|
||||
CVE-2025-21736/ANY/0001.patch
|
||||
CVE-2025-21744/ANY/0001.patch
|
||||
CVE-2025-21772/ANY/0001.patch
|
||||
CVE-2025-21776/ANY/0001.patch
|
||||
CVE-2025-21781/ANY/0001.patch
|
||||
CVE-2025-21782/ANY/0001.patch
|
||||
CVE-2025-21785/ANY/0001.patch
|
||||
CVE-2025-21791/ANY/0001.patch
|
||||
CVE-2025-21835/ANY/0001.patch
|
||||
CVE-2025-21877/ANY/0001.patch
|
||||
CVE-2025-21904/ANY/0001.patch
|
||||
CVE-2025-21909/ANY/0001.patch
|
||||
CVE-2025-21910/ANY/0001.patch
|
||||
CVE-2025-21916/ANY/0001.patch
|
||||
CVE-2025-21928/ANY/0001.patch
|
||||
CVE-2025-21934/ANY/0001.patch
|
||||
CVE-2025-21935/ANY/0001.patch
|
||||
CVE-2025-21948/ANY/0001.patch
|
||||
CVE-2025-21993/ANY/0001.patch
|
||||
CVE-2025-21996/ANY/0001.patch
|
||||
CVE-2025-22007/ANY/0001.patch
|
||||
CVE-2025-22018/ANY/0001.patch
|
||||
CVE-2025-22063/ANY/0001.patch
|
||||
CVE-2025-22073/ANY/0001.patch
|
||||
CVE-2025-22079/ANY/0001.patch
|
||||
CVE-2025-22086/ANY/0001.patch
|
||||
CVE-2025-23150/ANY/0001.patch
|
||||
CVE-2025-23163/ANY/0001.patch
|
||||
CVE-2025-37738/ANY/0001.patch
|
||||
CVE-2025-37739/ANY/0001.patch
|
||||
CVE-2025-37740/ANY/0001.patch
|
||||
CVE-2025-37741/ANY/0001.patch
|
||||
CVE-2025-37749/ANY/0001.patch
|
||||
CVE-2025-37757/ANY/0001.patch
|
||||
CVE-2025-37758/ANY/0001.patch
|
||||
CVE-2025-37780/ANY/0001.patch
|
||||
CVE-2025-37781/ANY/0001.patch
|
||||
CVE-2025-37782/ANY/0001.patch
|
||||
CVE-2025-37789/ANY/0001.patch
|
||||
CVE-2025-37795/ANY/0001.patch
|
||||
CVE-2025-37796/ANY/0001.patch
|
||||
CVE-2025-37797/ANY/0001.patch
|
||||
CVE-2025-37798/ANY/0001.patch
|
||||
CVE-2025-37817/ANY/0001.patch
|
||||
CVE-2025-37823/ANY/0001.patch
|
||||
CVE-2025-37825/ANY/0001.patch
|
||||
CVE-2025-37833/ANY/0001.patch
|
||||
CVE-2025-37838/ANY/0001.patch
|
||||
CVE-2025-37839/ANY/0001.patch
|
||||
CVE-2025-37841/ANY/0001.patch
|
||||
CVE-2025-37851/ANY/0001.patch
|
||||
CVE-2025-37857/ANY/0001.patch
|
||||
CVE-2025-37858/ANY/0001.patch
|
||||
CVE-2025-37892/ANY/0001.patch
|
||||
CVE-2025-37923/ANY/0001.patch
|
||||
CVE-2025-37925/ANY/0001.patch
|
||||
CVE-2025-37932/ANY/0001.patch
|
||||
CVE-2025-37937/ANY/0002.patch
|
||||
CVE-2025-37982/ANY/0001.patch
|
||||
CVE-2025-37983/ANY/0001.patch
|
||||
CVE-2025-37990/ANY/0001.patch
|
||||
CVE-2025-38034/ANY/0001.patch
|
||||
CVE-2025-38044/ANY/0001.patch
|
||||
CVE-2025-38046/ANY/0001.patch
|
||||
CVE-2025-38058/ANY/0001.patch
|
||||
CVE-2025-38061/ANY/0001.patch
|
||||
CVE-2025-38066/ANY/0001.patch
|
||||
CVE-2025-38075/ANY/0001.patch
|
||||
CVE-2025-38090/ANY/0001.patch
|
||||
CVE-2025-38114/ANY/0001.patch
|
||||
CVE-2025-38115/ANY/0001.patch
|
||||
CVE-2025-38147/ANY/0001.patch
|
||||
CVE-2025-38157/ANY/0001.patch
|
||||
CVE-2025-38163/ANY/0001.patch
|
||||
CVE-2025-38174/ANY/0001.patch
|
||||
CVE-2025-38177/ANY/0001.patch
|
||||
CVE-2025-38180/ANY/0001.patch
|
||||
CVE-2025-38181/ANY/0001.patch
|
||||
CVE-2025-38184/ANY/0001.patch
|
||||
CVE-2025-38185/ANY/0001.patch
|
||||
CVE-2025-38190/ANY/0001.patch
|
||||
CVE-2025-38194/ANY/0001.patch
|
||||
CVE-2025-38200/ANY/0001.patch
|
||||
CVE-2025-38203/ANY/0001.patch
|
||||
CVE-2025-38204/ANY/0001.patch
|
||||
CVE-2025-38212/ANY/0001.patch
|
||||
CVE-2025-38213/ANY/0001.patch
|
||||
CVE-2025-38218/ANY/0001.patch
|
||||
CVE-2025-38219/ANY/0001.patch
|
||||
CVE-2025-38222/ANY/0001.patch
|
||||
CVE-2025-38245/ANY/0001.patch
|
||||
CVE-2025-38251/ANY/0001.patch
|
||||
CVE-2025-38265/ANY/0001.patch
|
||||
CVE-2025-38285/ANY/0001.patch
|
||||
CVE-2025-38312/ANY/0001.patch
|
||||
CVE-2025-38320/ANY/0001.patch
|
||||
CVE-2025-38324/ANY/0001.patch
|
||||
CVE-2025-38328/ANY/0001.patch
|
||||
CVE-2025-38336/ANY/0001.patch
|
||||
CVE-2025-38344/ANY/0001.patch
|
||||
CVE-2025-38345/ANY/0001.patch
|
||||
CVE-2025-38348/ANY/0001.patch
|
||||
CVE-2025-38386/ANY/0001.patch
|
||||
CVE-2025-38403/ANY/0001.patch
|
||||
CVE-2025-38406/ANY/0001.patch
|
||||
CVE-2025-38416/ANY/0001.patch
|
||||
CVE-2025-38420/ANY/0001.patch
|
||||
CVE-2025-38428/ANY/0001.patch
|
||||
CVE-2025-38445/ANY/0001.patch
|
||||
CVE-2025-38448/ANY/0001.patch
|
||||
CVE-2025-38458/ANY/0001.patch
|
||||
CVE-2025-38459/ANY/0001.patch
|
||||
CVE-2025-38460/ANY/0001.patch
|
||||
CVE-2025-38467/ANY/0001.patch
|
||||
CVE-2025-38468/ANY/0001.patch
|
||||
CVE-2025-38470/ANY/0001.patch
|
||||
CVE-2025-38473/ANY/0001.patch
|
||||
CVE-2025-38474/ANY/0001.patch
|
||||
CVE-2025-38495/ANY/0001.patch
|
||||
CVE-2025-38498/ANY/0002.patch
|
||||
CVE-2025-38513/ANY/0001.patch
|
||||
CVE-2025-38514/ANY/0001.patch
|
||||
CVE-2025-38538/ANY/0001.patch
|
||||
CVE-2025-38542/ANY/0001.patch
|
||||
CVE-2025-38544/ANY/0001.patch
|
||||
CVE-2025-38546/ANY/0001.patch
|
||||
CVE-2025-38555/ANY/0001.patch
|
||||
CVE-2025-38574/ANY/0001.patch
|
||||
CVE-2025-38578/ANY/0001.patch
|
||||
CVE-2025-38581/ANY/0001.patch
|
||||
CVE-2025-38604/ANY/0001.patch
|
||||
CVE-2025-38611/ANY/0001.patch
|
||||
CVE-2025-38612/ANY/0001.patch
|
||||
CVE-2025-38618/ANY/0001.patch
|
||||
CVE-2025-38639/ANY/0001.patch
|
||||
CVE-2025-38691/ANY/0001.patch
|
||||
CVE-2025-38693/ANY/0001.patch
|
||||
CVE-2025-38694/ANY/0001.patch
|
||||
CVE-2025-38697/ANY/0001.patch
|
||||
CVE-2025-38698/ANY/0001.patch
|
||||
CVE-2025-38699/ANY/0001.patch
|
||||
CVE-2025-38701/ANY/0001.patch
|
||||
CVE-2025-38708/ANY/0001.patch
|
||||
CVE-2025-38712/ANY/0001.patch
|
||||
CVE-2025-38713/ANY/0001.patch
|
||||
CVE-2025-38717/ANY/0001.patch
|
||||
CVE-2025-39676/ANY/0001.patch
|
||||
CVE-2025-39691/ANY/0001.patch
|
||||
CVE-2025-39710/ANY/0001.patch
|
||||
CVE-2025-39714/ANY/0001.patch
|
||||
CVE-2025-39742/ANY/0001.patch
|
||||
CVE-2025-39743/ANY/0001.patch
|
||||
CVE-2025-39751/ANY/0001.patch
|
||||
CVE-2025-39756/ANY/0001.patch
|
||||
CVE-2025-39782/ANY/0001.patch
|
||||
CVE-2025-39794/ANY/0001.patch
|
||||
CVE-2025-39796/ANY/0001.patch
|
||||
CVE-2025-39808/ANY/0001.patch
|
||||
CVE-2025-39812/ANY/0001.patch
|
||||
CVE-2025-39817/ANY/0001.patch
|
||||
CVE-2025-39824/ANY/0001.patch
|
||||
CVE-2025-39839/ANY/0001.patch
|
||||
CVE-2025-39846/ANY/0001.patch
|
||||
CVE-2025-39847/ANY/0001.patch
|
||||
CVE-2025-39848/ANY/0001.patch
|
||||
CVE-2025-39874/ANY/0001.patch
|
||||
CVE-2025-39885/ANY/0001.patch
|
||||
CVE-2025-39889/ANY/0001.patch
|
||||
CVE-2025-39898/ANY/0001.patch
|
||||
CVE-2025-39903/ANY/0001.patch
|
||||
CVE-2025-39913/ANY/0001.patch
|
||||
CVE-2025-39920/ANY/0001.patch
|
||||
CVE-2025-39945/ANY/0001.patch
|
||||
CVE-2025-39964/ANY/0001.patch
|
||||
CVE-2025-39967/ANY/0001.patch
|
||||
CVE-2025-39973/ANY/0001.patch
|
||||
CVE-2025-39996/ANY/0001.patch
|
||||
CVE-2025-39998/ANY/0001.patch
|
||||
CVE-2025-40011/ANY/0001.patch
|
||||
CVE-2025-40020/ANY/0001.patch
|
||||
CVE-2025-40022/ANY/0001.patch
|
||||
CVE-2025-40028/ANY/0001.patch
|
||||
CVE-2025-40030/ANY/0001.patch
|
||||
CVE-2025-40035/ANY/0001.patch
|
||||
CVE-2025-40044/ANY/0001.patch
|
||||
CVE-2025-40049/ANY/0001.patch
|
||||
CVE-2025-40055/ANY/0001.patch
|
||||
CVE-2025-40078/ANY/0001.patch
|
||||
CVE-2025-40080/ANY/0001.patch
|
||||
CVE-2025-40082/ANY/0001.patch
|
||||
CVE-2019-12819/4.14/0006.patch
|
||||
CVE-2021-47472/4.14/0003.patch
|
||||
CVE-2023-53129/ANY/0001.patch
|
||||
CVE-2023-53626/ANY/0001.patch
|
||||
CVE-2024-26720/4.14/0009.patch
|
||||
CVE-2024-39501/4.14/0009.patch
|
||||
CVE-2024-42102/4.14/0009.patch
|
||||
CVE-2024-50195/3.17-^6.12/0001.patch
|
||||
CVE-2024-50210/3.17-^6.6/0001.patch
|
||||
Vendored
+27
@@ -0,0 +1,27 @@
|
||||
--- a/techpack/audio/dsp/rtac.c
|
||||
+++ b/techpack/audio/dsp/rtac.c
|
||||
@@ -652,6 +652,12 @@
|
||||
pr_debug("%s\n", __func__);
|
||||
|
||||
mutex_lock(&rtac_voice_mutex);
|
||||
+ if (rtac_voice_data.num_of_voice_combos > ARRAY_SIZE(rtac_voice_data.voice)) {
|
||||
+ pr_err("%s: invalid voice count %u\n", __func__,
|
||||
+ rtac_voice_data.num_of_voice_combos);
|
||||
+ mutex_unlock(&rtac_voice_mutex);
|
||||
+ return;
|
||||
+ }
|
||||
/* look for device */
|
||||
for (i = 0; i < rtac_voice_data.num_of_voice_combos; i++) {
|
||||
if (rtac_voice_data.voice[i].cvs_handle == cvs_handle) {
|
||||
--- a/drivers/staging/qcacld-3.0/core/mac/src/pe/lim/lim_process_fils.c
|
||||
+++ b/drivers/staging/qcacld-3.0/core/mac/src/pe/lim/lim_process_fils.c
|
||||
@@ -1092,6 +1092,9 @@
|
||||
return false;
|
||||
}
|
||||
|
||||
+ if (dot11f_ie_rsn.pmkid_count > ARRAY_SIZE(dot11f_ie_rsn.pmkid))
|
||||
+ return false;
|
||||
+
|
||||
for (i = 0; i < dot11f_ie_rsn.pmkid_count; i++) {
|
||||
if (qdf_mem_cmp(dot11f_ie_rsn.pmkid[i],
|
||||
pe_session->fils_info->fils_pmkid,
|
||||
@@ -0,0 +1,36 @@
|
||||
# FORTIFY Clang port for msm-4.14 (LOS sunfish)
|
||||
|
||||
Based on Kees Cook *fortify: Add Clang support* (upstream ~2022), adapted
|
||||
to 4.14’s in-`string.h` FORTIFY (no `fortify-string.h` yet).
|
||||
|
||||
**Not** AXP `0004` (strict-string). **Not** `BUG()` link stubs.
|
||||
|
||||
See `docs/009-fortify-clang-port.md`.
|
||||
|
||||
## Apply
|
||||
|
||||
```bash
|
||||
# on rom-dev01, after git reset of msm-4.14:
|
||||
python3 apply_fortify_clang.py /path/to/msm-4.14
|
||||
patch -p1 -d /path/to/msm-4.14 < 0001-driver-bounds-rtac-fils.patch
|
||||
```
|
||||
|
||||
`ksync-one.sh` with `CONFIG_FORTIFY_SOURCE` runs both automatically.
|
||||
|
||||
Then enable `CONFIG_FORTIFY_SOURCE=y` and build **without**
|
||||
`ALLOW_FORTIFY_BUG_STUBS`.
|
||||
|
||||
## Nested strlen (required)
|
||||
|
||||
With Clang `__pass_object_size`, fortified `strlcpy`/`strcpy` must call
|
||||
`__underlying_strlen(q)`, not fortified `strlen(q)`. Otherwise a known
|
||||
source object size makes `strlen` panic at boot (LAB: `strlen+strlcpy`
|
||||
fail; `strlen+strncpy` OK). `apply_fortify_clang.py` rewrites both.
|
||||
|
||||
## Diag capture (v4)
|
||||
|
||||
`apply_fortify_diag.py` — `early_ioremap` before `parse_early_param`, ordinary
|
||||
`ioremap` only after `mm_init`, never map from the failure handler; failure
|
||||
and milestone zones separated. See `docs/009-fortify-diag-capture-plan.md`
|
||||
and `docs/009-fortify-diag-v3-review-20260927.md`. Control:
|
||||
`PSTORE_ALT_PLAIN=1` / `scripts/009-bisect-ksync-pstore-alt-plain.sh`.
|
||||
+244
@@ -0,0 +1,244 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Apply minimal Clang FORTIFY adaptations to msm-4.14 (Kees-style).
|
||||
|
||||
Edits:
|
||||
- include/linux/compiler-clang.h — __pass_object_size / __overloadable / __diagnose_as
|
||||
- include/linux/string.h — __FORTIFY_INLINE + POS/POS0 on fortified params
|
||||
- security/Kconfig — allow FORTIFY on Clang when this port is present
|
||||
(tree lacks CC_IS_CLANG Kconfig symbols; !CC_IS_CLANG was a no-op)
|
||||
|
||||
Idempotent. Exit 0 on success.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import re
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
MARKER = "/* AXP_Resurection: fortify-clang port (Kees-style) */"
|
||||
|
||||
|
||||
def patch_compiler_clang(path: Path) -> None:
|
||||
t = path.read_text()
|
||||
if MARKER in t and "__pass_object_size" in t:
|
||||
print(f"skip {path} (already patched)")
|
||||
return
|
||||
if "__pass_object_size" in t:
|
||||
print(f"skip {path} (attrs already present)")
|
||||
return
|
||||
block = f"""
|
||||
{MARKER}
|
||||
/*
|
||||
* Clang FORTIFY helpers (upstream fortify Clang support / Kees Cook).
|
||||
* pass_object_size makes __builtin_object_size work through fortified inlines.
|
||||
*/
|
||||
#if __has_attribute(pass_object_size)
|
||||
# define __pass_object_size(type) __attribute__((__pass_object_size__(type)))
|
||||
#else
|
||||
# define __pass_object_size(type)
|
||||
#endif
|
||||
#if __has_attribute(overloadable)
|
||||
# define __overloadable __attribute__((__overloadable__))
|
||||
#else
|
||||
# define __overloadable
|
||||
#endif
|
||||
#if __has_attribute(diagnose_as_builtin)
|
||||
# define __diagnose_as(builtin...) __attribute__((__diagnose_as_builtin__(builtin)))
|
||||
#else
|
||||
# define __diagnose_as(builtin...)
|
||||
#endif
|
||||
"""
|
||||
path.write_text(t.rstrip() + "\n" + block + "\n")
|
||||
print(f"patched {path}")
|
||||
|
||||
|
||||
def patch_kconfig(path: Path) -> None:
|
||||
t = path.read_text()
|
||||
old = (
|
||||
"\t# https://bugs.llvm.org/show_bug.cgi?id=50322\n"
|
||||
"\t# https://bugs.llvm.org/show_bug.cgi?id=41459\n"
|
||||
"\tdepends on !CC_IS_CLANG\n"
|
||||
)
|
||||
new = (
|
||||
"\t# Clang: upstream disabled FORTIFY until wrappers existed (LLVM 41459).\n"
|
||||
"\t# This tree never defined CC_IS_CLANG, so !CC_IS_CLANG was a no-op.\n"
|
||||
"\t# Fortify-clang port (vendor/.../fortify-clang) supplies Kees-style\n"
|
||||
"\t# __pass_object_size / __overloadable wrappers for Clang 12+.\n"
|
||||
"\t# https://bugs.llvm.org/show_bug.cgi?id=41459\n"
|
||||
)
|
||||
if MARKER.split()[2] in t and "Fortify-clang port" in t:
|
||||
print(f"skip {path} (already patched)")
|
||||
return
|
||||
if old not in t:
|
||||
if "depends on !CC_IS_CLANG" in t:
|
||||
t2 = t.replace(
|
||||
"\tdepends on !CC_IS_CLANG\n",
|
||||
new,
|
||||
1,
|
||||
)
|
||||
if t2 == t:
|
||||
raise SystemExit(f"could not patch {path}")
|
||||
path.write_text(t2)
|
||||
print(f"patched {path} (depends line only)")
|
||||
return
|
||||
raise SystemExit(f"FORTIFY depends block not found in {path}")
|
||||
path.write_text(t.replace(old, new, 1))
|
||||
print(f"patched {path}")
|
||||
|
||||
|
||||
def patch_string_h(path: Path) -> None:
|
||||
t = path.read_text()
|
||||
if "AXP_Resurection: fortify-clang" in t and "POS0" in t:
|
||||
print(f"skip {path} (already patched)")
|
||||
return
|
||||
|
||||
old_inline = (
|
||||
"#define __FORTIFY_INLINE extern __always_inline __attribute__((gnu_inline))\n"
|
||||
)
|
||||
# 4.14 fortify bodies all use __builtin_object_size(*, 0) (whole object).
|
||||
# pass_object_size(N) must match that N or Clang returns -1 (no checking).
|
||||
# Do NOT use pass_object_size(1) here — that is STRICT_STRING / type-1 policy
|
||||
# (AXP 0004), a separate step. See docs/009-fortify-port-review-20260926.md.
|
||||
new_inline = (
|
||||
f"{MARKER}\n"
|
||||
"/* Clang: __overloadable + __pass_object_size matching bos type 0. */\n"
|
||||
"#ifdef __clang__\n"
|
||||
"# define __FORTIFY_INLINE extern __always_inline __attribute__((gnu_inline)) __overloadable\n"
|
||||
"# define POS __pass_object_size(0)\n"
|
||||
"# define POS0 __pass_object_size(0)\n"
|
||||
"#else\n"
|
||||
"# define __FORTIFY_INLINE extern __always_inline __attribute__((gnu_inline))\n"
|
||||
"# define POS\n"
|
||||
"# define POS0\n"
|
||||
"#endif\n"
|
||||
)
|
||||
if old_inline not in t:
|
||||
raise SystemExit("__FORTIFY_INLINE define not found")
|
||||
t = t.replace(old_inline, new_inline, 1)
|
||||
|
||||
# Rewrite fortified prototypes to pass object size (Kees-style POS/POS0).
|
||||
replacements = [
|
||||
(
|
||||
"__FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size)",
|
||||
"__FORTIFY_INLINE char *strncpy(char * const POS0 p, const char * const POS q, __kernel_size_t size)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE char *strcat(char *p, const char *q)",
|
||||
"__FORTIFY_INLINE char *strcat(char * const POS0 p, const char * const POS q)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE __kernel_size_t strlen(const char *p)",
|
||||
"__FORTIFY_INLINE __kernel_size_t strlen(const char * const POS p)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE __kernel_size_t strnlen(const char *p, __kernel_size_t maxlen)",
|
||||
"__FORTIFY_INLINE __kernel_size_t strnlen(const char * const POS p, __kernel_size_t maxlen)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size)",
|
||||
"__FORTIFY_INLINE size_t strlcpy(char * const POS0 p, const char * const POS q, size_t size)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE char *strncat(char *p, const char *q, __kernel_size_t count)",
|
||||
"__FORTIFY_INLINE char *strncat(char * const POS0 p, const char * const POS q, __kernel_size_t count)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE void *memset(void *p, int c, __kernel_size_t size)",
|
||||
"__FORTIFY_INLINE void *memset(void * const POS0 p, int c, __kernel_size_t size)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE void *memcpy(void *p, const void *q, __kernel_size_t size)",
|
||||
"__FORTIFY_INLINE void *memcpy(void * const POS0 p, const void * const POS0 q, __kernel_size_t size)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE void *memmove(void *p, const void *q, __kernel_size_t size)",
|
||||
"__FORTIFY_INLINE void *memmove(void * const POS0 p, const void * const POS0 q, __kernel_size_t size)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE void *memscan(void *p, int c, __kernel_size_t size)",
|
||||
"__FORTIFY_INLINE void *memscan(void * const POS0 p, int c, __kernel_size_t size)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE int memcmp(const void *p, const void *q, __kernel_size_t size)",
|
||||
"__FORTIFY_INLINE int memcmp(const void * const POS0 p, const void * const POS0 q, __kernel_size_t size)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE void *memchr(const void *p, int c, __kernel_size_t size)",
|
||||
"__FORTIFY_INLINE void *memchr(const void * const POS0 p, int c, __kernel_size_t size)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE void *memchr_inv(const void *p, int c, size_t size)",
|
||||
"__FORTIFY_INLINE void *memchr_inv(const void * const POS0 p, int c, size_t size)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE void *kmemdup(const void *p, size_t size, gfp_t gfp)",
|
||||
"__FORTIFY_INLINE void *kmemdup(const void * const POS0 p, size_t size, gfp_t gfp)",
|
||||
),
|
||||
(
|
||||
"__FORTIFY_INLINE char *strcpy(char *p, const char *q)",
|
||||
"__FORTIFY_INLINE char *strcpy(char * const POS0 p, const char * const POS q)",
|
||||
),
|
||||
]
|
||||
for a, b in replacements:
|
||||
if a not in t:
|
||||
raise SystemExit(f"missing fortify prototype:\n{a}")
|
||||
t = t.replace(a, b, 1)
|
||||
|
||||
# With Clang __pass_object_size, fortified strlen(q) sees a known object
|
||||
# size and panics when the C string is not NUL-terminated within that
|
||||
# bound. strlcpy/strcpy intentionally need the unbounded source length
|
||||
# (same as the GCC path when bos was usually -1). Use the underlying
|
||||
# strlen so enabling both wrappers does not brick boot.
|
||||
# LAB bisect 2026-09-28: strlen+strlcpy fails; strlen+strncpy boots.
|
||||
old_strlcpy_len = "\tret = strlen(q);\n"
|
||||
new_strlcpy_len = (
|
||||
"\t/* AXP_Resurection: fortify-clang — do not nest fortified strlen */\n"
|
||||
"\tret = __underlying_strlen(q);\n"
|
||||
)
|
||||
if "ret = __underlying_strlen(q);" not in t:
|
||||
if old_strlcpy_len not in t:
|
||||
raise SystemExit("strlcpy strlen(q) probe not found")
|
||||
t = t.replace(old_strlcpy_len, new_strlcpy_len, 1)
|
||||
|
||||
old_strcpy_len = "\tmemcpy(p, q, strlen(q) + 1);\n"
|
||||
new_strcpy_len = (
|
||||
"\tmemcpy(p, q, __underlying_strlen(q) + 1);\n"
|
||||
)
|
||||
if "memcpy(p, q, __underlying_strlen(q) + 1);" not in t:
|
||||
if old_strcpy_len not in t:
|
||||
raise SystemExit("strcpy strlen(q) probe not found")
|
||||
t = t.replace(old_strcpy_len, new_strcpy_len, 1)
|
||||
|
||||
# Undef POS macros at end of fortify block (before #endif of FORTIFY_SOURCE)
|
||||
end_marker = (
|
||||
"#undef __underlying_strncpy\n"
|
||||
"#endif\n"
|
||||
)
|
||||
end_repl = (
|
||||
"#undef __underlying_strncpy\n"
|
||||
"#undef POS\n"
|
||||
"#undef POS0\n"
|
||||
"#endif\n"
|
||||
)
|
||||
if end_marker not in t:
|
||||
raise SystemExit("fortify #endif marker not found")
|
||||
t = t.replace(end_marker, end_repl, 1)
|
||||
|
||||
path.write_text(t)
|
||||
print(f"patched {path}")
|
||||
|
||||
|
||||
def main() -> int:
|
||||
if len(sys.argv) != 2:
|
||||
print(f"usage: {sys.argv[0]} /path/to/msm-4.14", file=sys.stderr)
|
||||
return 2
|
||||
root = Path(sys.argv[1])
|
||||
patch_compiler_clang(root / "include/linux/compiler-clang.h")
|
||||
patch_string_h(root / "include/linux/string.h")
|
||||
patch_kconfig(root / "security/Kconfig")
|
||||
print("fortify-clang apply OK")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
Vendored
Executable
+597
@@ -0,0 +1,597 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Diagnostic overlays for FORTIFY / early boot capture (msm-4.14 sunfish LAB).
|
||||
|
||||
v4 — docs/009-fortify-diag-v3-review-20260927.md:
|
||||
|
||||
- Never map from the failure handler.
|
||||
- Early map: early_ioremap (FIXMAP_PAGE_IO) before setup_arch
|
||||
parse_early_param — same device attrs as permanent/access-ramoops.
|
||||
- Keep early map until after mm_init; ordinary ioremap only then
|
||||
(needs slab/vmalloc). Clear VA before retiring early map.
|
||||
- First-failure at offset 0; milestones at offset 2048 (no shared slots).
|
||||
- Adopt prior failure only if a complete record (header + \\n + mirror).
|
||||
- Atomic claim for first-failure; milestones never touch failure zone.
|
||||
|
||||
Readable: dd if=/dev/access-ramoops | strings | grep AXPDIAG
|
||||
|
||||
Idempotent via markers. Attempt id is bake-time only; wipe failure zone
|
||||
before repeating the same image (see capture plan).
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import re
|
||||
import sys
|
||||
import time
|
||||
from pathlib import Path
|
||||
|
||||
MARKER_PANIC = "/* AXP_Resurection: fortify-diag capture v4 */"
|
||||
MARKER_MAIN_MM = "/* AXP_Resurection: axp-diag mm_init */"
|
||||
MARKER_SETUP_EARLY = "/* AXP_Resurection: axp-diag early_map */"
|
||||
MARKER_MAKEFILE = "AXP_Resurection axp_diag_capture"
|
||||
ATTEMPT = time.strftime("%Y%m%dT%H%M%SZ", time.gmtime())
|
||||
|
||||
# Sunfish DT: alt_ramoops_region@A4C1F000 size 0x400000 (no-map).
|
||||
SUNFISH_ALT_PHYS = "0xA4C1F000ULL"
|
||||
|
||||
CAPTURE_C = r"""
|
||||
/* AXP_Resurection: axp_diag_capture — LAB early plaintext alt ramoops (v4) */
|
||||
#include <linux/kernel.h>
|
||||
#include <linux/io.h>
|
||||
#include <linux/init.h>
|
||||
#include <linux/export.h>
|
||||
#include <linux/notifier.h>
|
||||
#include <linux/atomic.h>
|
||||
#include <linux/types.h>
|
||||
#include <linux/mm.h>
|
||||
#include <asm/bug.h>
|
||||
#include <asm/early_ioremap.h>
|
||||
|
||||
#define AXP_ALT_PHYS __SUNFISH_ALT_PHYS__
|
||||
#define AXP_MAP_SIZE PAGE_SIZE
|
||||
#define AXP_ATTEMPT "__ATTEMPT__"
|
||||
|
||||
/* Layout within the first mapped page (no shared slots). */
|
||||
#define AXP_FAIL_OFF 0U
|
||||
#define AXP_FAIL_MIRROR 128U
|
||||
#define AXP_FAIL_SPAN 1024U /* primary + mirrors */
|
||||
#define AXP_MILE_OFF 2048U
|
||||
#define AXP_REC_MAX 120U
|
||||
|
||||
static void __iomem *axp_alt_va;
|
||||
static bool axp_va_is_early;
|
||||
static atomic_t axp_first_latch = ATOMIC_INIT(0);
|
||||
|
||||
static void notrace axp_bytes_out(void __iomem *dst, const char *src, size_t n)
|
||||
{
|
||||
size_t i;
|
||||
|
||||
for (i = 0; i < n; i++)
|
||||
writeb((u8)src[i], dst + i);
|
||||
}
|
||||
|
||||
static void notrace axp_bytes_in(char *dst, const void __iomem *src, size_t n)
|
||||
{
|
||||
size_t i;
|
||||
|
||||
for (i = 0; i < n; i++)
|
||||
dst[i] = (char)readb(src + i);
|
||||
}
|
||||
|
||||
static void axp_hex_u64(char *dst, unsigned long v)
|
||||
{
|
||||
static const char hex[] = "0123456789abcdef";
|
||||
int i;
|
||||
|
||||
dst[0] = '0';
|
||||
dst[1] = 'x';
|
||||
for (i = 0; i < 16; i++)
|
||||
dst[2 + i] = hex[(v >> (60 - 4 * i)) & 0xf];
|
||||
dst[18] = '\0';
|
||||
}
|
||||
|
||||
/*
|
||||
* Complete first-failure: AXPDIAG1,...\n at FAIL_OFF and matching mirror.
|
||||
* A truncated header alone must NOT suppress later captures.
|
||||
*/
|
||||
static bool notrace axp_first_complete(void)
|
||||
{
|
||||
char buf[AXP_REC_MAX];
|
||||
char mir[AXP_REC_MAX];
|
||||
size_t i, n;
|
||||
|
||||
if (!axp_alt_va)
|
||||
return false;
|
||||
axp_bytes_in(buf, axp_alt_va + AXP_FAIL_OFF, AXP_REC_MAX);
|
||||
if (buf[0] != 'A' || buf[1] != 'X' || buf[2] != 'P' || buf[3] != 'D' ||
|
||||
buf[4] != 'I' || buf[5] != 'A' || buf[6] != 'G' || buf[7] != '1' ||
|
||||
buf[8] != ',')
|
||||
return false;
|
||||
n = 0;
|
||||
for (i = 9; i < AXP_REC_MAX; i++) {
|
||||
if (buf[i] == '\n') {
|
||||
n = i + 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!n)
|
||||
return false;
|
||||
axp_bytes_in(mir, axp_alt_va + AXP_FAIL_MIRROR, n);
|
||||
for (i = 0; i < n; i++) {
|
||||
if (mir[i] != buf[i])
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
static void notrace axp_adopt_prior_first(void)
|
||||
{
|
||||
if (axp_first_complete())
|
||||
atomic_set(&axp_first_latch, 1);
|
||||
}
|
||||
|
||||
/* Failure-zone write: mirrors first, primary last (commit). */
|
||||
static void notrace axp_fail_commit(const char *rec, size_t n)
|
||||
{
|
||||
size_t i;
|
||||
|
||||
if (!axp_alt_va || !rec || !n)
|
||||
return;
|
||||
if (n > AXP_REC_MAX)
|
||||
n = AXP_REC_MAX;
|
||||
for (i = AXP_FAIL_MIRROR; i + n <= AXP_FAIL_SPAN; i += AXP_FAIL_MIRROR)
|
||||
axp_bytes_out(axp_alt_va + i, rec, n);
|
||||
wmb();
|
||||
axp_bytes_out(axp_alt_va + AXP_FAIL_OFF, rec, n);
|
||||
wmb();
|
||||
(void)readb(axp_alt_va + AXP_FAIL_OFF);
|
||||
}
|
||||
|
||||
static void notrace axp_mile_write(const char *rec, size_t n)
|
||||
{
|
||||
if (!axp_alt_va || !rec || !n)
|
||||
return;
|
||||
if (n > AXP_REC_MAX)
|
||||
n = AXP_REC_MAX;
|
||||
if (AXP_MILE_OFF + n > AXP_MAP_SIZE)
|
||||
return;
|
||||
axp_bytes_out(axp_alt_va + AXP_MILE_OFF, rec, n);
|
||||
wmb();
|
||||
(void)readb(axp_alt_va + AXP_MILE_OFF);
|
||||
}
|
||||
|
||||
/*
|
||||
* First durable failure. Format:
|
||||
* AXPDIAG1,<type>,<attempt>,<caller_hex>,<token>\n
|
||||
* Never maps. Null VA => lost (blind / transition window).
|
||||
*/
|
||||
void notrace __attribute__((no_sanitize("cfi")))
|
||||
axp_diag_mark_event(char type, const char *token, void *caller)
|
||||
{
|
||||
char rec[128];
|
||||
char hex[20];
|
||||
size_t n = 0;
|
||||
size_t ti;
|
||||
const char *tok;
|
||||
void __iomem *va = READ_ONCE(axp_alt_va);
|
||||
|
||||
if (!va)
|
||||
return;
|
||||
if (atomic_read(&axp_first_latch))
|
||||
return;
|
||||
if (axp_first_complete()) {
|
||||
atomic_set(&axp_first_latch, 1);
|
||||
return;
|
||||
}
|
||||
if (atomic_cmpxchg(&axp_first_latch, 0, 1) != 0)
|
||||
return;
|
||||
/* Re-check after claim (prior complete may have raced). */
|
||||
if (axp_first_complete())
|
||||
return;
|
||||
|
||||
axp_hex_u64(hex, (unsigned long)caller);
|
||||
tok = token ? token : "?";
|
||||
|
||||
{
|
||||
static const char pfx[] = "AXPDIAG1,";
|
||||
size_t i;
|
||||
|
||||
for (i = 0; i < sizeof(pfx) - 1; i++)
|
||||
rec[n++] = pfx[i];
|
||||
}
|
||||
rec[n++] = type;
|
||||
rec[n++] = ',';
|
||||
{
|
||||
size_t i;
|
||||
|
||||
for (i = 0; AXP_ATTEMPT[i] && n + 1 < sizeof(rec); i++)
|
||||
rec[n++] = AXP_ATTEMPT[i];
|
||||
}
|
||||
rec[n++] = ',';
|
||||
{
|
||||
size_t i;
|
||||
|
||||
for (i = 0; i < 18 && n + 1 < sizeof(rec); i++)
|
||||
rec[n++] = hex[i];
|
||||
}
|
||||
rec[n++] = ',';
|
||||
for (ti = 0; tok[ti] && n + 1 < sizeof(rec); ti++)
|
||||
rec[n++] = tok[ti];
|
||||
rec[n++] = '\n';
|
||||
|
||||
{
|
||||
int k;
|
||||
|
||||
for (k = 0; k < 4; k++)
|
||||
axp_fail_commit(rec, n);
|
||||
}
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(axp_diag_mark_event);
|
||||
|
||||
void notrace __attribute__((no_sanitize("cfi")))
|
||||
axp_diag_mark_panic(const char *why)
|
||||
{
|
||||
axp_diag_mark_event('P', why, __builtin_return_address(0));
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(axp_diag_mark_panic);
|
||||
|
||||
/* Milestones: separate offset; never touch failure zone. */
|
||||
void notrace __attribute__((no_sanitize("cfi")))
|
||||
axp_diag_milestone(const char *name)
|
||||
{
|
||||
char rec[96];
|
||||
size_t n = 0;
|
||||
size_t i;
|
||||
static const char pfx[] = "AXPDIAG0,M,";
|
||||
void __iomem *va = READ_ONCE(axp_alt_va);
|
||||
|
||||
if (!va)
|
||||
return;
|
||||
if (atomic_read(&axp_first_latch) || axp_first_complete()) {
|
||||
axp_adopt_prior_first();
|
||||
return;
|
||||
}
|
||||
|
||||
for (i = 0; i < sizeof(pfx) - 1; i++)
|
||||
rec[n++] = pfx[i];
|
||||
for (i = 0; AXP_ATTEMPT[i] && n + 1 < sizeof(rec); i++)
|
||||
rec[n++] = AXP_ATTEMPT[i];
|
||||
rec[n++] = ',';
|
||||
if (!name)
|
||||
name = "?";
|
||||
for (i = 0; name[i] && n + 1 < sizeof(rec); i++)
|
||||
rec[n++] = name[i];
|
||||
rec[n++] = '\n';
|
||||
|
||||
/* Abort if a first-failure claimed while we composed. */
|
||||
if (atomic_read(&axp_first_latch) || axp_first_complete()) {
|
||||
axp_adopt_prior_first();
|
||||
return;
|
||||
}
|
||||
axp_mile_write(rec, n);
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(axp_diag_milestone);
|
||||
|
||||
/*
|
||||
* Early: early_ioremap (device/IO attrs), before parse_early_param.
|
||||
* Kept across early_ioremap_reset until mm_init retires it.
|
||||
* Permanent: ordinary ioremap ONLY after mm_init (slab + vmalloc ready).
|
||||
* Failure handlers never call these.
|
||||
*/
|
||||
void __init axp_diag_map_early(void)
|
||||
{
|
||||
void __iomem *va;
|
||||
|
||||
if (axp_alt_va)
|
||||
return;
|
||||
/* FIXMAP_PAGE_IO — matches permanent ioremap / access-ramoops attrs. */
|
||||
va = early_ioremap(AXP_ALT_PHYS, AXP_MAP_SIZE);
|
||||
if (!va)
|
||||
return;
|
||||
WRITE_ONCE(axp_alt_va, va);
|
||||
axp_va_is_early = true;
|
||||
axp_adopt_prior_first();
|
||||
if (!atomic_read(&axp_first_latch))
|
||||
axp_diag_milestone("early_map");
|
||||
}
|
||||
|
||||
void __init axp_diag_map_permanent(void)
|
||||
{
|
||||
void __iomem *va;
|
||||
void __iomem *old;
|
||||
|
||||
/*
|
||||
* Ordinary ioremap needs get_vm_area → kzalloc / vmalloc.
|
||||
* Call only after mm_init(). Never from setup_arch/paging_init.
|
||||
*/
|
||||
va = ioremap(AXP_ALT_PHYS, AXP_MAP_SIZE);
|
||||
if (!va)
|
||||
return;
|
||||
|
||||
old = READ_ONCE(axp_alt_va);
|
||||
/* Publish permanent first so writers never see a stale early VA. */
|
||||
WRITE_ONCE(axp_alt_va, va);
|
||||
wmb();
|
||||
|
||||
if (axp_va_is_early && old) {
|
||||
early_iounmap(old, AXP_MAP_SIZE);
|
||||
axp_va_is_early = false;
|
||||
} else if (old && old != va) {
|
||||
iounmap(old);
|
||||
}
|
||||
|
||||
axp_adopt_prior_first();
|
||||
if (!atomic_read(&axp_first_latch))
|
||||
axp_diag_milestone("perm_map");
|
||||
}
|
||||
|
||||
void __init axp_diag_after_mm_init(void)
|
||||
{
|
||||
axp_diag_map_permanent();
|
||||
if (!atomic_read(&axp_first_latch))
|
||||
axp_diag_milestone("mm_init");
|
||||
}
|
||||
|
||||
static int __init axp_diag_pure_init(void)
|
||||
{
|
||||
if (!READ_ONCE(axp_alt_va))
|
||||
axp_diag_map_permanent();
|
||||
if (!atomic_read(&axp_first_latch))
|
||||
axp_diag_milestone("pure_init");
|
||||
return 0;
|
||||
}
|
||||
pure_initcall(axp_diag_pure_init);
|
||||
|
||||
static int __init axp_diag_core_init(void)
|
||||
{
|
||||
if (!atomic_read(&axp_first_latch))
|
||||
axp_diag_milestone("core_init");
|
||||
return 0;
|
||||
}
|
||||
core_initcall(axp_diag_core_init);
|
||||
|
||||
static int notrace axp_panic_notifier(struct notifier_block *nb,
|
||||
unsigned long action, void *data)
|
||||
{
|
||||
axp_diag_mark_event('P', data ? (const char *)data : "notifier",
|
||||
__builtin_return_address(0));
|
||||
return NOTIFY_OK;
|
||||
}
|
||||
|
||||
static struct notifier_block axp_panic_nb = {
|
||||
.notifier_call = axp_panic_notifier,
|
||||
.priority = INT_MAX,
|
||||
};
|
||||
|
||||
static int __init axp_diag_panic_reg(void)
|
||||
{
|
||||
atomic_notifier_chain_register(&panic_notifier_list, &axp_panic_nb);
|
||||
if (!atomic_read(&axp_first_latch))
|
||||
axp_diag_milestone("panic_reg");
|
||||
return 0;
|
||||
}
|
||||
postcore_initcall(axp_diag_panic_reg);
|
||||
"""
|
||||
|
||||
|
||||
def write_capture_c(root: Path) -> None:
|
||||
path = root / "kernel" / "axp_diag_capture.c"
|
||||
body = (
|
||||
CAPTURE_C.replace("__SUNFISH_ALT_PHYS__", SUNFISH_ALT_PHYS)
|
||||
.replace("__ATTEMPT__", ATTEMPT)
|
||||
)
|
||||
if body.startswith("\n"):
|
||||
body = body[1:]
|
||||
path.write_text(body)
|
||||
print(f"wrote {path} attempt={ATTEMPT}")
|
||||
|
||||
|
||||
def patch_makefile(path: Path) -> None:
|
||||
t = path.read_text()
|
||||
if "axp_diag_capture.o" in t:
|
||||
print(f"skip {path} (axp_diag_capture already listed)")
|
||||
return
|
||||
old = "obj-y = fork.o exec_domain.o panic.o \\"
|
||||
new = f"obj-y = fork.o exec_domain.o panic.o axp_diag_capture.o \\" # {MARKER_MAKEFILE}
|
||||
if old not in t:
|
||||
raise SystemExit(f"kernel/Makefile obj-y panic.o line not found in {path}")
|
||||
path.write_text(t.replace(old, new, 1))
|
||||
print(f"patched {path}")
|
||||
|
||||
|
||||
def patch_main_mm(path: Path) -> None:
|
||||
t = path.read_text()
|
||||
if "axp_diag_after_mm_init" in t:
|
||||
print(f"skip {path} (already patched)")
|
||||
return
|
||||
old = "\tmm_init();\n"
|
||||
if t.count(old) < 1:
|
||||
raise SystemExit(f"mm_init(); not found in {path}")
|
||||
new = f"""\tmm_init();
|
||||
{MARKER_MAIN_MM}
|
||||
{{
|
||||
extern void axp_diag_after_mm_init(void);
|
||||
axp_diag_after_mm_init();
|
||||
}}
|
||||
"""
|
||||
path.write_text(t.replace(old, new, 1))
|
||||
print(f"patched mm_init hook in {path}")
|
||||
|
||||
|
||||
def patch_arm64_setup(path: Path) -> None:
|
||||
"""Early IO map only — no ioremap before mm_init."""
|
||||
t = path.read_text()
|
||||
|
||||
# Strip obsolete v3 permanent hook after paging_init if present.
|
||||
perm_block = re.compile(
|
||||
r"\tpaging_init\(\);\n"
|
||||
r"/\* AXP_Resurection: axp-diag perm_map \*/\n"
|
||||
r"\t\{\n"
|
||||
r"\t\textern void axp_diag_map_permanent\(void\);\n"
|
||||
r"\t\taxp_diag_map_permanent\(\);\n"
|
||||
r"\t\}\n",
|
||||
)
|
||||
t2, n = perm_block.subn("\tpaging_init();\n", t, count=1)
|
||||
if n:
|
||||
t = t2
|
||||
print(f"removed obsolete paging_init ioremap hook from {path}")
|
||||
|
||||
if "axp_diag_map_early" in t:
|
||||
path.write_text(t)
|
||||
print(f"skip early hook in {path} (already present)")
|
||||
return
|
||||
|
||||
early_old = "\tjump_label_init();\n\tparse_early_param();\n"
|
||||
early_new = f"""\tjump_label_init();
|
||||
{MARKER_SETUP_EARLY}
|
||||
{{
|
||||
extern void axp_diag_map_early(void);
|
||||
axp_diag_map_early();
|
||||
}}
|
||||
parse_early_param();
|
||||
"""
|
||||
if early_old not in t:
|
||||
raise SystemExit(f"jump_label_init/parse_early_param block not found in {path}")
|
||||
path.write_text(t.replace(early_old, early_new, 1))
|
||||
print(f"patched arm64 setup early_ioremap in {path}")
|
||||
|
||||
|
||||
def _replace_fortify_panic(t: str) -> str:
|
||||
if "fortify-diag capture v4" in t:
|
||||
return t
|
||||
|
||||
new = f"""{MARKER_PANIC}
|
||||
extern void axp_diag_mark_event(char type, const char *token, void *caller);
|
||||
void fortify_panic(const char *name)
|
||||
{{
|
||||
void *caller = __builtin_return_address(0);
|
||||
|
||||
/* Durable record FIRST — before printk/stack (may fault). Never maps. */
|
||||
axp_diag_mark_event('F', name, caller);
|
||||
pr_emerg("FORTIFY_DIAG: overflow in %s caller=%pS attempt=%s\\n",
|
||||
name, caller, "{ATTEMPT}");
|
||||
dump_stack();
|
||||
BUG();
|
||||
}}
|
||||
"""
|
||||
|
||||
stock = """void fortify_panic(const char *name)
|
||||
{
|
||||
pr_emerg("detected buffer overflow in %s\\n", name);
|
||||
BUG();
|
||||
}
|
||||
"""
|
||||
if "AXP_Resurection: fortify-diag capture" in t:
|
||||
pat = re.compile(
|
||||
r"/\* AXP_Resurection: fortify-diag capture(?: v[0-9]+)? \*/.*?^void fortify_panic\(const char \*name\)\n\{.*?\n\}\n",
|
||||
re.S | re.M,
|
||||
)
|
||||
m = pat.search(t)
|
||||
if m:
|
||||
return t[: m.start()] + new + t[m.end() :]
|
||||
if stock in t:
|
||||
return t.replace(stock, new, 1)
|
||||
raise SystemExit("fortify_panic body not found / unrecognized")
|
||||
|
||||
|
||||
def patch_fortify_panic(path: Path) -> None:
|
||||
t = path.read_text()
|
||||
if "fortify-diag capture v4" in t:
|
||||
print(f"skip {path} (already v4)")
|
||||
return
|
||||
path.write_text(_replace_fortify_panic(t))
|
||||
print(f"patched fortify_panic v4 in {path}")
|
||||
|
||||
|
||||
def patch_sysrq(path: Path) -> None:
|
||||
t = path.read_text()
|
||||
if "axp-diag-sysrq-v4" in t:
|
||||
print(f"skip {path} (already v4)")
|
||||
return
|
||||
if "sysrq_handle_crash" not in t:
|
||||
raise SystemExit(f"sysrq_handle_crash missing in {path}")
|
||||
|
||||
new_crash = """/* AXP_Resurection: axp-diag-sysrq-v4 */
|
||||
extern void axp_diag_mark_event(char type, const char *token, void *caller);
|
||||
static void sysrq_handle_crash(int key)
|
||||
{
|
||||
rcu_read_unlock();
|
||||
axp_diag_mark_event('C', "sysrq-c", __builtin_return_address(0));
|
||||
panic("sysrq triggered crash\\n");
|
||||
}
|
||||
|
||||
static void sysrq_handle_axp_mark(int key)
|
||||
{
|
||||
axp_diag_mark_event('X', "sysrq-x", __builtin_return_address(0));
|
||||
}
|
||||
static struct sysrq_key_op sysrq_axp_mark_op = {
|
||||
.handler = sysrq_handle_axp_mark,
|
||||
.help_msg = "axp-mark(x)",
|
||||
.action_msg = "AXP alt diag mark",
|
||||
.enable_mask = SYSRQ_ENABLE_DUMP,
|
||||
};
|
||||
"""
|
||||
|
||||
if "AXP_Resurection: axp-diag-sysrq" in t or "pstore-alt-plain-sysrq" in t:
|
||||
pat = re.compile(
|
||||
r"/\* AXP_Resurection: (?:axp-diag-sysrq-v[0-9]+|pstore-alt-plain-sysrq) \*/.*?"
|
||||
r"(?:static struct sysrq_key_op sysrq_axp_mark_op = \{.*?\};\n|"
|
||||
r"panic\(\"sysrq triggered crash\\n\"\);\n\})",
|
||||
re.S,
|
||||
)
|
||||
m = pat.search(t)
|
||||
if m:
|
||||
t = t[: m.start()] + new_crash + t[m.end() :]
|
||||
else:
|
||||
raise SystemExit(f"could not replace prior sysrq axp block in {path}")
|
||||
else:
|
||||
stock = """static void sysrq_handle_crash(int key)
|
||||
{
|
||||
/* release the RCU read lock before crashing */
|
||||
rcu_read_unlock();
|
||||
|
||||
panic("sysrq triggered crash\\n");
|
||||
}
|
||||
"""
|
||||
if stock not in t:
|
||||
raise SystemExit(f"unrecognized sysrq_handle_crash form in {path}")
|
||||
t = t.replace(stock, new_crash, 1)
|
||||
|
||||
if "axp_sysrq_mark_init" not in t:
|
||||
t += """
|
||||
/* AXP_Resurection: axp-diag-sysrq-v4-reg */
|
||||
static int __init axp_sysrq_mark_init(void)
|
||||
{
|
||||
register_sysrq_key('x', &sysrq_axp_mark_op);
|
||||
return 0;
|
||||
}
|
||||
device_initcall(axp_sysrq_mark_init);
|
||||
"""
|
||||
else:
|
||||
t = re.sub(
|
||||
r"axp-diag-sysrq-v[0-9]+-reg",
|
||||
"axp-diag-sysrq-v4-reg",
|
||||
t,
|
||||
count=1,
|
||||
)
|
||||
|
||||
path.write_text(t)
|
||||
print(f"patched sysrq v4 in {path}")
|
||||
|
||||
|
||||
def main() -> int:
|
||||
if len(sys.argv) != 2:
|
||||
print(f"usage: {sys.argv[0]} /path/to/msm-4.14", file=sys.stderr)
|
||||
return 2
|
||||
root = Path(sys.argv[1])
|
||||
write_capture_c(root)
|
||||
patch_makefile(root / "kernel" / "Makefile")
|
||||
patch_arm64_setup(root / "arch" / "arm64" / "kernel" / "setup.c")
|
||||
patch_main_mm(root / "init" / "main.c")
|
||||
patch_fortify_panic(root / "lib" / "string.c")
|
||||
patch_sysrq(root / "drivers" / "tty" / "sysrq.c")
|
||||
print(f"fortify-diag v4 apply OK attempt={ATTEMPT}")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
@@ -0,0 +1,33 @@
|
||||
# Stage 1 — AXP Graphene/AH patches that apply clean on LOS msm-4.14 @ 28f9290ae067
|
||||
# Paths relative to /srv/rom/references/axp/kernel_patches
|
||||
# Source attribution: AXP/Divest kernel_patches @ df3cab2155b3 (GrapheneOS-derived series)
|
||||
0005-Graphene-Deny_USB/4.14/0003.patch
|
||||
0008-Graphene-Kernel_Hardening-allocsize/4.14/0002.patch
|
||||
0008-Graphene-Kernel_Hardening-allocsize/4.14/0011.patch
|
||||
0008-Graphene-Kernel_Hardening-allocsize/4.14/0016.patch
|
||||
0008-Graphene-Kernel_Hardening-allocsize/4.14/0021.patch
|
||||
0008-Graphene-Kernel_Hardening-bugon/4.14/0010.patch
|
||||
0008-Graphene-Kernel_Hardening-fortify/4.14/0004.patch
|
||||
0008-Graphene-Kernel_Hardening-misc/4.14/0001.patch
|
||||
0008-Graphene-Kernel_Hardening-misc/4.14/0005.patch
|
||||
0008-Graphene-Kernel_Hardening-misc/4.14/0010.patch
|
||||
0008-Graphene-Kernel_Hardening-misc/4.14/0018.patch
|
||||
0008-Graphene-Kernel_Hardening-random/4.14/0002.patch
|
||||
0008-Graphene-Kernel_Hardening-random/4.14/0007.patch
|
||||
0008-Graphene-Kernel_Hardening-random/4.14/0012.patch
|
||||
0008-Graphene-Kernel_Hardening-random/4.14/0017.patch
|
||||
0008-Graphene-Kernel_Hardening-ro/4.14/0002.patch
|
||||
0008-Graphene-Kernel_Hardening-ro/4.14/0012.patch
|
||||
0008-Graphene-Kernel_Hardening-ro/4.14/0017.patch
|
||||
0008-Graphene-Kernel_Hardening-ro/4.14/0028.patch
|
||||
0008-Graphene-Kernel_Hardening-ro/4.14/0030.patch
|
||||
0008-Graphene-Kernel_Hardening-ro/4.14/0032.patch
|
||||
0008-Graphene-Kernel_Hardening-ro/4.14/0038.patch
|
||||
0008-Graphene-Kernel_Hardening-sanitize/4.14/0005.patch
|
||||
0008-Graphene-Kernel_Hardening-sanitize/4.14/0009.patch
|
||||
0008-Graphene-Kernel_Hardening-sanitize/4.14/0015.patch
|
||||
0008-Graphene-Kernel_Hardening-sanitize/4.14/0017.patch
|
||||
0008-Graphene-Kernel_Hardening-slab/4.14/0006.patch
|
||||
0008-Graphene-Kernel_Hardening-slab/4.14/0014.patch
|
||||
0008-Graphene-Kernel_Hardening-unused/4.14/0001.patch
|
||||
0008-Graphene-Kernel_Hardening-unused/4.14/0002.patch
|
||||
@@ -0,0 +1,42 @@
|
||||
# US-S5-1 — Yama + SLAB freelist random (defconfig)
|
||||
|
||||
**Track**: AXP Resurection Pro Magisk, unlocked sunfish.
|
||||
**On top of**: Stage1 + combo4 + FORTIFY + CVE clean-429 + hi-batch1–3.
|
||||
|
||||
## Why
|
||||
|
||||
High-offset KEEP CVEs are already on the ship pack. Remaining ge200 KEPT
|
||||
items were **nf_tables** (`CVE-2023-3777`, `CVE-2024-26643`) — skipped on
|
||||
purpose in batch3. Next attributable kernel depth without reopening CVE
|
||||
quarantine:
|
||||
|
||||
| Knob | Before | After | Attribution |
|
||||
|------|--------|-------|-------------|
|
||||
| `CONFIG_SECURITY_YAMA` | unset (but `CONFIG_LSM` listed yama) | `=y` | Graphene/AXP LSM stack; ptrace scope |
|
||||
| `CONFIG_SLAB_FREELIST_RANDOM` | unset | `=y` | Graphene/AH slab hardening companion to existing `SLAB_FREELIST_HARDENED` |
|
||||
|
||||
## Apply
|
||||
|
||||
```bash
|
||||
bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_uss5_1_defconfig.sh \
|
||||
kernel/google/msm-4.14
|
||||
```
|
||||
|
||||
Wired into `scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh` after
|
||||
Stage1+combo4+CVE apply.
|
||||
|
||||
## LAB verify
|
||||
|
||||
```text
|
||||
zcat /proc/config.gz | grep CONFIG_SECURITY_YAMA=y
|
||||
zcat /proc/config.gz | grep CONFIG_SLAB_FREELIST_RANDOM=y
|
||||
cat /proc/sys/kernel/yama/ptrace_scope # expect 1 (default)
|
||||
pidof magiskd # still up
|
||||
```
|
||||
|
||||
## Out of scope here
|
||||
|
||||
- `CVE-2022-49980` lock-scope port (still denylist)
|
||||
- nf_tables high-offset CVEs
|
||||
- Stage1 slab FAIL patches (`0010`/`0018` still reject on this tree)
|
||||
- `hardened_malloc` / bootloader lock
|
||||
Reference in new issue
Block a user