Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=v6.6.132 2026-01-11T14:21:43+00:00 2026-01-11T14:21:43+00:00 Mikhail Malyshev mike.malyshev@gmail.com 2025-10-15T16:34:52+00:00 urn:sha1:fb9e2f99ac100a20ccd8d35727559afdce906208 [ Upstream commit af61da281f52aba0c5b090bafb3a31c5739850ff ] When building out-of-tree modules with CONFIG_MODULE_SIG_FORCE=y, module signing fails because the private key path uses $(srctree) while the public key path uses $(objtree). Since signing keys are generated in the build directory during kernel compilation, both paths should use $(objtree) for consistency. This causes SSL errors like: SSL error:02001002:system library:fopen:No such file or directory sign-file: /kernel-src/certs/signing_key.pem The issue occurs because: - sig-key uses: $(srctree)/certs/signing_key.pem (source tree) - cmd_sign uses: $(objtree)/certs/signing_key.x509 (build tree) But both keys are generated in $(objtree) during the build. This complements commit 25ff08aa43e37 ("kbuild: Fix signing issue for external modules") which fixed the scripts path and public key path, but missed the private key path inconsistency. Fixes out-of-tree module signing for configurations with separate source and build directories (e.g., O=/kernel-out). Signed-off-by: Mikhail Malyshev <mike.malyshev@gmail.com> Reviewed-by: Nathan Chancellor <nathan@kernel.org> Tested-by: Nicolas Schier <nsc@kernel.org> Link: https://patch.msgid.link/20251015163452.3754286-1-mike.malyshev@gmail.com Signed-off-by: Nicolas Schier <nsc@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 2023-09-25T07:01:05+00:00 Martin Nybo Andersen tweek@tweek.dk 2023-09-15T10:15:39+00:00 urn:sha1:fbf5892df21a8ccfcb2fda0fd65bc3169c89ed28 Kmod is now (since kmod commit 09c9f8c5df04 ("libkmod: Use kernel decompression when available")) using the kernel decompressor, when loading compressed modules. However, the kernel XZ decompressor is XZ Embedded, which doesn't handle CRC64 and dictionaries larger than 1MiB. Use CRC32 and 1MiB dictionary when XZ compressing and installing kernel modules. Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1050582 Signed-off-by: Martin Nybo Andersen <tweek@tweek.dk> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> 2023-09-14T17:39:24+00:00 Michal Kubecek mkubecek@suse.cz 2023-09-11T08:01:29+00:00 urn:sha1:552c5013f2bc648611395ea80df6250aa4fe28f6 Running "make modules_install" may fail with make[2]: execvp: /bin/sh: Argument list too long if many modules are built and INSTALL_MOD_PATH is long. This is because scripts/Makefile.modinst creates all directories with one mkdir command. Use $(foreach ...) instead to prevent an excessive argument list. Fixes: 2dfec887c0fd ("kbuild: reduce the number of mkdir calls during modules_install") Signed-off-by: Michal Kubecek <mkubecek@suse.cz> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> 2023-09-01T06:58:17+00:00 Masahiro Yamada masahiroy@kernel.org 2023-08-23T11:50:48+00:00 urn:sha1:151aeca2179290fb9eb63bb3ee60c47fffd86c5e The modules_sign target is currently only available for in-tree modules, but it actually works for external modules as well. Move the modules_sign rule to the common part. Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Reviewed-by: Nicolas Schier <nicolas@fjasle.eu> 2023-09-01T06:58:17+00:00 Masahiro Yamada masahiroy@kernel.org 2023-08-23T11:50:47+00:00 urn:sha1:02e8487bbf1b68b29f7759154728071af08091cb Commit d890f510c8e4 ("MODSIGN: Add modules_sign make target") introduced 'make modules_sign' to manually sign modules. Some time later, commit d9d8d7ed498e ("MODSIGN: Add option to not sign modules during modules_install") introduced CONFIG_MODULE_SIG_ALL. If it was disabled, mod_sign_cmd was set to no-op ('true' command). It affected not only 'make modules_install' but also 'make modules_sign'. With CONFIG_MODULE_SIG_ALL=n, neither modules_install nor modules_sign is able to sign modules. Kbuild has kept that behavior, and nobody has complained about it, but I think it is weird. CONFIG_MODULE_SIG_ALL=n should turn off signing only for modules_install. If users want to sign modules manually, modules_sign should be offered. Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Reviewed-by: Nicolas Schier <nicolas@fjasle.eu> 2023-09-01T06:58:16+00:00 Masahiro Yamada masahiroy@kernel.org 2023-08-23T11:50:46+00:00 urn:sha1:5e02797b8eb093ba73fcbdc6048d02a3f9fb7379 Move more relevant code to scripts/Makefile.modinst. Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Reviewed-by: Nicolas Schier <nicolas@fjasle.eu> 2023-09-01T06:56:30+00:00 Masahiro Yamada masahiroy@kernel.org 2023-08-23T11:50:45+00:00 urn:sha1:2dfec887c0fd7d25d26b2ba7e60479208f9b6fb8 Calling 'mkdir' for every module results in redundant syscalls. Use $(sort ...) to drop the duplicated directories. Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Reviewed-by: Nicolas Schier <nicolas@fjasle.eu> 2023-08-29T13:38:23+00:00 Masahiro Yamada masahiroy@kernel.org 2023-08-23T11:50:43+00:00 urn:sha1:79b96c332241c06b4c63cfa0e23a539558b79b90 depmod is a part of the module installation. scripts/Makefile.modinst is a better place to run it. Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Reviewed-by: Nicolas Schier <nicolas@fjasle.eu> 2023-02-23T22:05:08+00:00 Linus Torvalds torvalds@linux-foundation.org 2023-02-23T22:05:08+00:00 urn:sha1:c538944d8efb14e9809b685608490b017bfc2d48 Pull modules updates from Luis Chamberlain: "Nothing exciting at all for modules for v6.3. The biggest change is just the change of INSTALL_MOD_DIR from "extra" to "updates" which I found lingered for ages for no good reason while testing the CXL mock driver [0]. The CXL mock driver has no kconfig integration and requires building an external module... and re-building the *rest* of the production drivers. This mock driver when loaded but not the production ones will crash. All this can obviously be fixed by integrating kconfig semantics into such test module, however that's not desirable by the maintainer, and so sensible defaults must be used to ensure a default "make modules_install" will suffice for most distros which do not have a file like /etc/depmod.d/dist.conf with something like `search updates extra built-in`. Since most distros rely on kmod and since its inception the "updates" directory is always in the search path it makes more sense to use that than the "extra" which only *some* RH based systems rely on. All this stuff has been on linux-next for a while" [0] https://lkml.kernel.org/r/20221209062919.1096779-1-mcgrof@kernel.org * tag 'modules-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: Documentation: livepatch: module-elf-format: Remove local klp_modinfo definition module.h: Document klp_modinfo struct using kdoc module: Use kstrtobool() instead of strtobool() kernel/params.c: Use kstrtobool() instead of strtobool() test_kmod: stop kernel-doc warnings kbuild: Modify default INSTALL_MOD_DIR from extra to updates 2023-01-31T08:53:01+00:00 Jan Luebbe jlu@pengutronix.de 2023-01-31T08:43:23+00:00 urn:sha1:22e46f6480e83bcf49b6d5e6b66c81872c97a902 When CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*), signing of modules fails: scripts/sign-file sha256 /.../linux/pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509 /.../kernel/crypto/tcrypt.ko Usage: scripts/sign-file [-dp] <hash algo> <key> <x509> <module> [<dest>] scripts/sign-file -s <raw sig> <hash algo> <x509> <module> [<dest>] First, we need to avoid adding the $(srctree)/ prefix to the URL. Second, since the kconfig string values no longer include quotes, we need to add them again when passing a PKCS#11 URI to sign-file. This avoids splitting by the shell if the URI contains semicolons. Fixes: 4db9c2e3d055 ("kbuild: stop using config_filename in scripts/Makefile.modsign") Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf") Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>