Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion scripts/package-build/linux-kernel/build-linux-firmware.sh
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ if [ ! -d ${LINUX_FIRMWARE} ]; then
fi

# Retrieve firmware blobs from source files
FW_FILES=$(find ${KERNEL_DIR}/debian/linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/kernel/drivers/net -name *.ko | xargs modinfo | grep "^firmware:" | awk '{print $2}')
FW_FILES=$(find ${KERNEL_DIR}/debian/linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/kernel/drivers/net -name *.ko* | xargs modinfo | grep "^firmware:" | awk '{print $2}')

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Quote the pattern and avoid plain xargs.

Bash expands *.ko* before find receives it. If the working directory contains a matching filename, find can receive the filename instead of the pattern. This can omit compressed modules or fail the command. Because scripts/package-build/linux-kernel/build.py:212-216 runs this script with check=True, the firmware build can abort.

Quote the path and pattern. Use -exec modinfo {} + or -print0 | xargs -0 for filename-safe processing.

Proposed fix
-FW_FILES=$(find ${KERNEL_DIR}/debian/linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/kernel/drivers/net -name *.ko* | xargs modinfo | grep "^firmware:" | awk '{print $2}')
+FW_FILES=$(find "${KERNEL_DIR}/debian/linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/kernel/drivers/net" \
+    -name '*.ko*' -exec modinfo {} + | grep "^firmware:" | awk '{print $2}')
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
FW_FILES=$(find ${KERNEL_DIR}/debian/linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/kernel/drivers/net -name *.ko* | xargs modinfo | grep "^firmware:" | awk '{print $2}')
FW_FILES=$(find "${KERNEL_DIR}/debian/linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/kernel/drivers/net" \
-name '*.ko*' -exec modinfo {} + | grep "^firmware:" | awk '{print $2}')
🧰 Tools
🪛 Shellcheck (0.11.0)

[warning] 23-23: Use 'find .. -print0 | xargs -0 ..' or 'find .. -exec .. +' to allow non-alphanumeric filenames.

(SC2038)


[info] 23-23: Double quote to prevent globbing and word splitting.

(SC2086)


[info] 23-23: Double quote to prevent globbing and word splitting.

(SC2086)


[info] 23-23: Double quote to prevent globbing and word splitting.

(SC2086)


[info] 23-23: Double quote to prevent globbing and word splitting.

(SC2086)


[info] 23-23: Double quote to prevent globbing and word splitting.

(SC2086)


[warning] 23-23: Quote the parameter to -name so the shell won't interpret it.

(SC2061)


[info] 23-23: Use ./glob or -- glob so names with dashes won't become options.

(SC2035)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/package-build/linux-kernel/build-linux-firmware.sh` at line 23,
Update the firmware collection command assigned to FW_FILES to quote the kernel
module search path and '*.ko*' pattern, preventing shell expansion, and replace
plain xargs with find’s filename-safe -exec modinfo {} + (or an equivalent
null-delimited pipeline). Preserve the existing grep and awk extraction
behavior.

Source: Linters/SAST tools


# Debian package will use the descriptive Git commit as version
GIT_COMMIT=$(cd ${CWD}/${LINUX_FIRMWARE}; git describe --always)
Expand Down
Loading