Kernel: T9010: update existing patches to remove "hunk off" notices - #1226
Merged
Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds an IPv6 ChangesIPv6 link_filter plumbing
linux-perf package build
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches✨ Simplify code
Comment |
11 tasks
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (4)
scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patch (2)
145-151: 🩺 Stability & Availability | 🔴 Critical | ⚡ Quick winGuard
__in6_dev_get(dev)before dereference to avoid crashAt Line 148,
__in6_dev_get(dev)is dereferenced unconditionally. If it returnsNULL, this is a kernel NULL-pointer dereference in route scoring path.Proposed fix
static inline int rt6_link_filter(const struct fib6_nh *nh) { const struct net_device *dev = nh->fib_nh_dev; - int linkf = __in6_dev_get(dev)->cnf.link_filter; + const struct inet6_dev *idev = __in6_dev_get(dev); + int linkf; + + if (!idev) + return 0; + + linkf = idev->cnf.link_filter; return (linkf && !netif_running(dev)) || (linkf > 1 && !netif_carrier_ok(dev)); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patch` around lines 145 - 151, The rt6_link_filter helper dereferences __in6_dev_get(dev) without checking for NULL, which can crash in the route scoring path. Update rt6_link_filter to first store the __in6_dev_get(dev) result in a local pointer and guard the cnf.link_filter access with a NULL check before using it; keep the existing netif_running and netif_carrier_ok logic unchanged.
37-46: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winEnforce documented
link_filterrange (0..2) in sysctl handlersLines 37-46 document only
0/1/2, but Line 107 and Lines 127-133 register unrestricted integer writes. Out-of-range values are currently accepted, creating a doc/UAPI contract break and undefined admin behavior.Proposed fix (IPv6 table pattern)
{ .procname = "link_filter", .data = &ipv6_devconf.link_filter, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, + .extra1 = (void *)SYSCTL_ZERO, + .extra2 = (void *)SYSCTL_TWO, },Apply equivalent min/max enforcement for the IPv4
link_filtersysctl entry as well.Also applies to: 107-107, 127-133
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patch` around lines 37 - 46, The `link_filter` sysctl accepts unrestricted integers in the IPv4 and IPv6 handlers, which conflicts with the documented 0..2 range. Update the sysctl registration/handler setup around the `link_filter` entries to enforce minimum 0 and maximum 2 for both tables, following the IPv6 table pattern and applying the same bounds to the IPv4 `link_filter` entry as well.scripts/package-build/linux-kernel/patches/kernel/0002-build-linux-perf-package.patch (2)
69-77: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winGuard
binary-perftarget creation on package presence.
binary-targetsincludesbinary-perfunconditionally (Line 69), butperf-packageis conditional (Line 76). When nolinux-perf-*package is emitted, this target can execute with an empty package binding.Proposed fix
-binary-targets := $(addprefix binary-, image image-dbg headers libc-dev perf) +binary-targets := $(addprefix binary-, image image-dbg headers libc-dev) @@ perf-package = $(filter linux-perf-%, $(all-packages)) +ifneq ($(strip $(perf-package)),) +binary-targets += binary-perf +endif🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/package-build/linux-kernel/patches/kernel/0002-build-linux-perf-package.patch` around lines 69 - 77, Guard the unconditional binary-perf target in the packaging make logic: binary-targets currently always includes binary-perf while perf-package in the same block may be empty, so adjust the target list or the perf package selection in the kernel packaging rules to only create binary-perf when a linux-perf-* package exists. Use the existing binary-targets and perf-package symbols in the build rules to keep the perf target conditional alongside the other package-specific targets.
91-95: 🎯 Functional Correctness | 🟠 MajorUse debhelper substvars for
linux-perf-${KERNELRELEASE}dependencies.scripts/package-build/linux-kernel/patches/kernel/0002-build-linux-perf-package.patch:91-95hardcodes runtime libs only; add${shlibs:Depends}and${misc:Depends}soperftracks its actual ELF and package metadata dependencies.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/package-build/linux-kernel/patches/kernel/0002-build-linux-perf-package.patch` around lines 91 - 95, The linux-perf package stanza is missing debhelper-generated dependency substitution, so update the package metadata in the linux-perf patch to use substvars instead of only hardcoded runtime libraries. In the package definition for linux-perf-${KERNELRELEASE}, add ${shlibs:Depends} and ${misc:Depends} to the Depends field alongside the existing libs so the package tracks ELF and metadata dependencies correctly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In
`@scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patch`:
- Around line 145-151: The rt6_link_filter helper dereferences
__in6_dev_get(dev) without checking for NULL, which can crash in the route
scoring path. Update rt6_link_filter to first store the __in6_dev_get(dev)
result in a local pointer and guard the cnf.link_filter access with a NULL check
before using it; keep the existing netif_running and netif_carrier_ok logic
unchanged.
- Around line 37-46: The `link_filter` sysctl accepts unrestricted integers in
the IPv4 and IPv6 handlers, which conflicts with the documented 0..2 range.
Update the sysctl registration/handler setup around the `link_filter` entries to
enforce minimum 0 and maximum 2 for both tables, following the IPv6 table
pattern and applying the same bounds to the IPv4 `link_filter` entry as well.
In
`@scripts/package-build/linux-kernel/patches/kernel/0002-build-linux-perf-package.patch`:
- Around line 69-77: Guard the unconditional binary-perf target in the packaging
make logic: binary-targets currently always includes binary-perf while
perf-package in the same block may be empty, so adjust the target list or the
perf package selection in the kernel packaging rules to only create binary-perf
when a linux-perf-* package exists. Use the existing binary-targets and
perf-package symbols in the build rules to keep the perf target conditional
alongside the other package-specific targets.
- Around line 91-95: The linux-perf package stanza is missing
debhelper-generated dependency substitution, so update the package metadata in
the linux-perf patch to use substvars instead of only hardcoded runtime
libraries. In the package definition for linux-perf-${KERNELRELEASE}, add
${shlibs:Depends} and ${misc:Depends} to the Depends field alongside the
existing libs so the package tracks ELF and metadata dependencies correctly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 6d31f33c-800a-43f5-b361-4133d26a7ea5
📒 Files selected for processing (2)
scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patchscripts/package-build/linux-kernel/patches/kernel/0002-build-linux-perf-package.patch
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
ansible/ansible(manual)
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: Mergify Merge Protections
- GitHub Check: Summary
🧰 Additional context used
🔍 Remote MCP
Additional context
- A 2009 netdev RFC proposed IPv4
link_filterwith values0/1/2to ignore packets when the interface is down or has no carrier, but David Miller rejected the idea in-thread. (groups.google.com) - Current kernel IP sysctl docs don’t mention
link_filterat all; I found no matches in the 6.8, 6.18, or generic docs pages. (docs.kernel.org) - Debian currently ships
linux-perfas the perf-tools package. An older kernelbuilddebperf patch usedlinux-tools-$versioninstead. (packages.debian.org) - VyOS downstream already writes
/proc/sys/net/ipv4/conf/<iface>/link_filterduring interface setup, so this sysctl is already part of the IPv4 config flow. (vyos.dev)
asklymenko
approved these changes
Jun 26, 2026
asklymenko
left a comment
asklymenko
left a comment
Contributor
There was a problem hiding this comment.
This change is to clean up the patch.
sever-sever
approved these changes
Jun 26, 2026
sever-sever
left a comment
sever-sever
left a comment
Member
There was a problem hiding this comment.
Cleanup Kernel patches
no functional changes
vyos-bot
Bot
added
mirror-initiated
11 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change summary
Just update the existing Kernel patches to cleanly apply to the latest Kernel version.
Types of changes
Related Task(s)
Related PR(s)
How to test / Smoketest result
Kernel compiles and no "hunk off" lines appear.
Checklist: