[Buildroot] [PATCH 1/2] package/libnl: fix build with kernel < 4.15

[Buildroot] [PATCH 1/2] package/libnl: fix build with kernel < 4.15

[Bernd Kuhls]

Buildroot commit 0f2e9cc8784715bdf18e72c433fe9bece4537f85 bumped the
package from 3.11.0 to 3.12.0. This bump includes upstream commit
https://github.com/thom311/libnl/commit/9f8945251da404fb59778edc74be5775091e1f44
which added the usage of enums not present in older kernel versions.

The Gitlab pipelines caught the build errors with the defconfig
bootlin-aarch64-glibc-old:

lib/route/nh_encap_ila.c:50:19: error: ‘ILA_ATTR_IDENT_TYPE’ undeclared
 (first use in this function)
lib/route/nh_encap_ila.c:53:19: error: ‘ILA_ATTR_HOOK_TYPE’ undeclared
 (first use in this function)

Both enums were added to the Linux kernel in version 4.15:
https://github.com/torvalds/linux/commit/fddb231ebe647749782a9ebf11106a81f7168ba7
https://github.com/torvalds/linux/commit/70d5aef48a421a68bd9d1bf8f8267af406681580

Add upstream commit to fix the problem.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/929b31b2321208683f5f3e7a601fe75188c2ca32

 ...ude-linux-include-linux-header-ila.h.patch | 107 ++++++++++++++++++
 package/libnl/libnl.mk                        |   4 +
 2 files changed, 111 insertions(+)
 create mode 100644 package/libnl/0002-include-linux-include-linux-header-ila.h.patch

diff --git a/package/libnl/0002-include-linux-include-linux-header-ila.h.patch b/package/libnl/0002-include-linux-include-linux-header-ila.h.patch
new file mode 100644
index 0000000000..3270366dac
--- /dev/null
+++ b/package/libnl/0002-include-linux-include-linux-header-ila.h.patch
@@ -0,0 +1,107 @@
+From 49f8b364c9a6f6db4ab535f999386fecfa38241b Mon Sep 17 00:00:00 2001
+From: Thomas Haller <thom311@gmail.com>
+Date: Thu, 11 Dec 2025 22:27:07 +0100
+Subject: [PATCH] include/linux: include linux header "ila.h"
+
+Taken from v6.18 (7d0a66e4bb9081d75c82ec4957c50034cb0ea449).
+
+https://github.com/thom311/libnl/issues/447
+
+Upstream: https://github.com/thom311/libnl/commit/49f8b364c9a6f6db4ab535f999386fecfa38241b
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ Makefile.am                       |  1 +
+ include/linux-private/linux/ila.h | 68 +++++++++++++++++++++++++++++++
+ 2 files changed, 69 insertions(+)
+ create mode 100644 include/linux-private/linux/ila.h
+
+diff --git a/Makefile.am b/Makefile.am
+index 2bd0c06e..e63e3112 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -278,6 +278,7 @@ noinst_HEADERS = \
+ 	include/linux-private/linux/if_packet.h \
+ 	include/linux-private/linux/if_tunnel.h \
+ 	include/linux-private/linux/if_vlan.h \
++	include/linux-private/linux/ila.h \
+ 	include/linux-private/linux/in.h \
+ 	include/linux-private/linux/in6.h \
+ 	include/linux-private/linux/in_route.h \
+diff --git a/include/linux-private/linux/ila.h b/include/linux-private/linux/ila.h
+new file mode 100644
+index 00000000..6a6c97cf
+--- /dev/null
++++ b/include/linux-private/linux/ila.h
+@@ -0,0 +1,68 @@
++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++/* ila.h - ILA Interface */
++
++#ifndef _LINUX_ILA_H
++#define _LINUX_ILA_H
++
++/* NETLINK_GENERIC related info */
++#define ILA_GENL_NAME		"ila"
++#define ILA_GENL_VERSION	0x1
++
++enum {
++	ILA_ATTR_UNSPEC,
++	ILA_ATTR_LOCATOR,			/* u64 */
++	ILA_ATTR_IDENTIFIER,			/* u64 */
++	ILA_ATTR_LOCATOR_MATCH,			/* u64 */
++	ILA_ATTR_IFINDEX,			/* s32 */
++	ILA_ATTR_DIR,				/* u32 */
++	ILA_ATTR_PAD,
++	ILA_ATTR_CSUM_MODE,			/* u8 */
++	ILA_ATTR_IDENT_TYPE,			/* u8 */
++	ILA_ATTR_HOOK_TYPE,			/* u8 */
++
++	__ILA_ATTR_MAX,
++};
++
++#define ILA_ATTR_MAX		(__ILA_ATTR_MAX - 1)
++
++enum {
++	ILA_CMD_UNSPEC,
++	ILA_CMD_ADD,
++	ILA_CMD_DEL,
++	ILA_CMD_GET,
++	ILA_CMD_FLUSH,
++
++	__ILA_CMD_MAX,
++};
++
++#define ILA_CMD_MAX	(__ILA_CMD_MAX - 1)
++
++#define ILA_DIR_IN	(1 << 0)
++#define ILA_DIR_OUT	(1 << 1)
++
++enum {
++	ILA_CSUM_ADJUST_TRANSPORT,
++	ILA_CSUM_NEUTRAL_MAP,
++	ILA_CSUM_NO_ACTION,
++	ILA_CSUM_NEUTRAL_MAP_AUTO,
++};
++
++enum {
++	ILA_ATYPE_IID = 0,
++	ILA_ATYPE_LUID,
++	ILA_ATYPE_VIRT_V4,
++	ILA_ATYPE_VIRT_UNI_V6,
++	ILA_ATYPE_VIRT_MULTI_V6,
++	ILA_ATYPE_NONLOCAL_ADDR,
++	ILA_ATYPE_RSVD_1,
++	ILA_ATYPE_RSVD_2,
++
++	ILA_ATYPE_USE_FORMAT = 32, /* Get type from type field in identifier */
++};
++
++enum {
++	ILA_HOOK_ROUTE_OUTPUT,
++	ILA_HOOK_ROUTE_INPUT,
++};
++
++#endif /* _LINUX_ILA_H */
+-- 
+2.47.3
+
diff --git a/package/libnl/libnl.mk b/package/libnl/libnl.mk
index 2dcb594141..5b79ea24a1 100644
--- a/package/libnl/libnl.mk
+++ b/package/libnl/libnl.mk
@@ -13,6 +13,10 @@ LIBNL_CPE_ID_VALID = YES
 LIBNL_INSTALL_STAGING = YES
 LIBNL_DEPENDENCIES = host-bison host-flex host-pkgconf
 
+# 0002-include-linux-include-linux-header-ila.h.patch
+LIBNL_AUTORECONF = YES
+HOST_LIBNL_AUTORECONF = YES
+
 HOST_LIBNL_DEPENDENCIES = host-bison host-flex host-pkgconf
 
 ifeq ($(BR2_PACKAGE_LIBNL_TOOLS),y)
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 2/2] package/hostapd: bump version to 2.12

[Bernd Kuhls]

https://lists.infradead.org/pipermail/hostap/2026-August/045441.html

Removed patches which are included in this release.

Removed the hostap driver from the package due to its upstream removal:
https://git.w1.fi/cgit/hostap/commit/?id=dfd207d96c1bbc4a2013db638bc1d48cc0865c27

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/1cab64c3f338d06bdf955a31ffebef1f751ffb7b

The build fix for libnl is included in this series because it is needed
for passing all pipelines of the hostapd bump.

 Config.in.legacy                              |  6 ++
 ...est-only-when-accepting-the-response.patch | 82 -------------------
 ...-RADIUS-Fix-pending-request-dropping.patch | 74 -----------------
 package/hostapd/Config.in                     |  8 --
 package/hostapd/hostapd.hash                  |  4 +-
 package/hostapd/hostapd.mk                    | 10 +--
 6 files changed, 9 insertions(+), 175 deletions(-)
 delete mode 100644 package/hostapd/0001-RADIUS-Drop-pending-request-only-when-accepting-the-response.patch
 delete mode 100644 package/hostapd/0002-RADIUS-Fix-pending-request-dropping.patch

diff --git a/Config.in.legacy b/Config.in.legacy
index 4da157fbba..d0d487f010 100644
--- a/Config.in.legacy
+++ b/Config.in.legacy
@@ -146,6 +146,12 @@ endif
 
 comment "Legacy options removed in 2026.08"
 
+config BR2_PACKAGE_HOSTAPD_DRIVER_HOSTAP
+	bool "hostapd hostap driver removed"
+	select BR2_LEGACY
+	help
+	  The hostap driver was removed from hostapd.
+
 config BR2_GDB_VERSION_ARC
 	bool "ARC-specific gdb version removed"
 	select BR2_LEGACY
diff --git a/package/hostapd/0001-RADIUS-Drop-pending-request-only-when-accepting-the-response.patch b/package/hostapd/0001-RADIUS-Drop-pending-request-only-when-accepting-the-response.patch
deleted file mode 100644
index fb86d1303d..0000000000
--- a/package/hostapd/0001-RADIUS-Drop-pending-request-only-when-accepting-the-response.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 726432d7622cc0088ac353d073b59628b590ea44 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <j@w1.fi>
-Date: Sat, 25 Jan 2025 11:21:16 +0200
-Subject: RADIUS: Drop pending request only when accepting the response
-
-The case of an invalid authenticator in a RADIUS response could imply
-that the response is not from the correct RADIUS server and as such,
-such a response should be discarded without changing internal state for
-the pending request. The case of an unknown response (RADIUS_RX_UNKNOWN)
-is somewhat more complex since it could have been indicated before
-validating the authenticator. In any case, it seems better to change the
-state for the pending request only when we have fully accepted the
-response.
-
-Allowing the internal state of pending RADIUS request to change based on
-responses that are not fully validation could have allow at least a
-theoretical DoS attack if an attacker were to have means for injecting
-RADIUS messages to the network using the IP address of the real RADIUS
-server and being able to do so more quickly than the real server and
-with the matching identifier from the request header (i.e., either by
-flooding 256 responses quickly or by having means to capture the RADIUS
-request). These should not really be realistic options in a properly
-protected deployment, but nevertheless it is good to be more careful in
-processing RADIUS responses.
-
-Remove a pending RADIUS request from the internal list only when having
-fully accepted a matching RADIUS response, i.e., after one of the
-registered handlers has confirmed that the authenticator is valid and
-processing of the response has succeeded.
-
-Upstream: https://git.w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44
-CVE: CVE-2025-24912
-
-Signed-off-by: Jouni Malinen <j@w1.fi>
-Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
----
- src/radius/radius_client.c | 15 +++++++--------
- 1 file changed, 7 insertions(+), 8 deletions(-)
-
-diff --git a/src/radius/radius_client.c b/src/radius/radius_client.c
-index 2a7f36170..7909b29a7 100644
---- a/src/radius/radius_client.c
-+++ b/src/radius/radius_client.c
-@@ -1259,13 +1259,6 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- 		       roundtrip / 100, roundtrip % 100);
- 	rconf->round_trip_time = roundtrip;
- 
--	/* Remove ACKed RADIUS packet from retransmit list */
--	if (prev_req)
--		prev_req->next = req->next;
--	else
--		radius->msgs = req->next;
--	radius->num_msgs--;
--
- 	for (i = 0; i < num_handlers; i++) {
- 		RadiusRxResult res;
- 		res = handlers[i].handler(msg, req->msg, req->shared_secret,
-@@ -1276,6 +1269,13 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- 			radius_msg_free(msg);
- 			/* fall through */
- 		case RADIUS_RX_QUEUED:
-+			/* Remove ACKed RADIUS packet from retransmit list */
-+			if (prev_req)
-+				prev_req->next = req->next;
-+			else
-+				radius->msgs = req->next;
-+			radius->num_msgs--;
-+
- 			radius_client_msg_free(req);
- 			return;
- 		case RADIUS_RX_INVALID_AUTHENTICATOR:
-@@ -1297,7 +1297,6 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- 		       msg_type, hdr->code, hdr->identifier,
- 		       invalid_authenticator ? " [INVALID AUTHENTICATOR]" :
- 		       "");
--	radius_client_msg_free(req);
- 
-  fail:
- 	radius_msg_free(msg);
--- 
-cgit v1.2.3
-
diff --git a/package/hostapd/0002-RADIUS-Fix-pending-request-dropping.patch b/package/hostapd/0002-RADIUS-Fix-pending-request-dropping.patch
deleted file mode 100644
index 474f40da0c..0000000000
--- a/package/hostapd/0002-RADIUS-Fix-pending-request-dropping.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 339a334551ca911187cc870f4f97ef08e11db109 Mon Sep 17 00:00:00 2001
-From: Jouni Malinen <quic_jouni@quicinc.com>
-Date: Wed, 5 Feb 2025 19:23:39 +0200
-Subject: RADIUS: Fix pending request dropping
-
-A recent change to this moved the place where the processed RADIUS
-request was removed from the pending list to happen after the message
-handler had been called. This did not take into account possibility of
-the handler adding a new pending request in the list and the prev_req
-pointer not necessarily pointing to the correct entry anymore. As such,
-some of the pending requests could have been lost and that would result
-in not being able to process responses to those requests and also, to a
-memory leak.
-
-Fix this by determining prev_req at the point when the pending request
-is being removed, i.e., after the handler function has already added a
-new entry.
-
-Fixes: 726432d7622c ("RADIUS: Drop pending request only when accepting the response")
-
-Upstream: https://git.w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109
-CVE: CVE-2025-24912
-
-Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
-Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
----
- src/radius/radius_client.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/src/radius/radius_client.c b/src/radius/radius_client.c
-index 7909b29a7..d4faa7936 100644
---- a/src/radius/radius_client.c
-+++ b/src/radius/radius_client.c
-@@ -1099,7 +1099,7 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- 	struct radius_hdr *hdr;
- 	struct radius_rx_handler *handlers;
- 	size_t num_handlers, i;
--	struct radius_msg_list *req, *prev_req;
-+	struct radius_msg_list *req, *prev_req, *r;
- 	struct os_reltime now;
- 	struct hostapd_radius_server *rconf;
- 	int invalid_authenticator = 0;
-@@ -1224,7 +1224,6 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- 		break;
- 	}
- 
--	prev_req = NULL;
- 	req = radius->msgs;
- 	while (req) {
- 		/* TODO: also match by src addr:port of the packet when using
-@@ -1236,7 +1235,6 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- 		    hdr->identifier)
- 			break;
- 
--		prev_req = req;
- 		req = req->next;
- 	}
- 
-@@ -1270,6 +1268,12 @@ static void radius_client_receive(int sock, void *eloop_ctx, void *sock_ctx)
- 			/* fall through */
- 		case RADIUS_RX_QUEUED:
- 			/* Remove ACKed RADIUS packet from retransmit list */
-+			prev_req = NULL;
-+			for (r = radius->msgs; r; r = r->next) {
-+				if (r == req)
-+					break;
-+				prev_req = r;
-+			}
- 			if (prev_req)
- 				prev_req->next = req->next;
- 			else
--- 
-cgit v1.2.3
-
diff --git a/package/hostapd/Config.in b/package/hostapd/Config.in
index 660274ddf0..40747a4e62 100644
--- a/package/hostapd/Config.in
+++ b/package/hostapd/Config.in
@@ -14,13 +14,6 @@ config BR2_PACKAGE_HOSTAPD
 
 if BR2_PACKAGE_HOSTAPD
 
-config BR2_PACKAGE_HOSTAPD_DRIVER_HOSTAP
-	bool "Enable hostap driver"
-	default y
-	select BR2_PACKAGE_HOSTAPD_HAS_WIFI_DRIVERS
-	help
-	  Enable support for Host AP driver.
-
 config BR2_PACKAGE_HOSTAPD_DRIVER_NL80211
 	bool "Enable nl80211 driver"
 	default y
@@ -41,7 +34,6 @@ config BR2_PACKAGE_HOSTAPD_DRIVER_WIRED
 config BR2_PACKAGE_HOSTAPD_DRIVER_NONE
 	bool
 	default y
-	depends on !BR2_PACKAGE_HOSTAPD_DRIVER_HOSTAP
 	depends on !BR2_PACKAGE_HOSTAPD_DRIVER_NL80211
 	depends on !BR2_PACKAGE_HOSTAPD_DRIVER_WIRED
 
diff --git a/package/hostapd/hostapd.hash b/package/hostapd/hostapd.hash
index 7921586172..8d9f384dae 100644
--- a/package/hostapd/hostapd.hash
+++ b/package/hostapd/hostapd.hash
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  2b3facb632fd4f65e32f4bf82a76b4b72c501f995a4f62e330219fe7aed1747a  hostapd-2.11.tar.gz
-sha256  f1b5992bbdd015c3ccb7faaadd62ef58ed821e15b9329bf2ceb27511ccc3f562  README
+sha256  f43502561c28ba47ab77e18e1a973d07361c68cc8b14178e619bd5796b70eabd  hostapd-2.12.tar.gz
+sha256  83be1b142c59ccf0d6c5dde0695d8f84dfba109bea058e78ec2942389ccf327f  README
diff --git a/package/hostapd/hostapd.mk b/package/hostapd/hostapd.mk
index d83b574fad..d673c84587 100644
--- a/package/hostapd/hostapd.mk
+++ b/package/hostapd/hostapd.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-HOSTAPD_VERSION = 2.11
+HOSTAPD_VERSION = 2.12
 HOSTAPD_SITE = http://w1.fi/releases
 HOSTAPD_SUBDIR = hostapd
 HOSTAPD_CONFIG = $(HOSTAPD_DIR)/$(HOSTAPD_SUBDIR)/.config
@@ -16,10 +16,6 @@ HOSTAPD_LICENSE_FILES = README
 HOSTAPD_CPE_ID_VENDOR = w1.fi
 HOSTAPD_SELINUX_MODULES = hostapd
 
-# 0001-RADIUS-Drop-pending-request-only-when-accepting-the-response.patch
-# 0002-RADIUS-Fix-pending-request-dropping.patch
-HOSTAPD_IGNORE_CVES += CVE-2025-24912
-
 HOSTAPD_CONFIG_ENABLE = \
 	CONFIG_INTERNAL_LIBTOMMATH \
 	CONFIG_DEBUG_FILE \
@@ -37,10 +33,6 @@ HOSTAPD_CONFIG_DISABLE += CONFIG_EAP_PWD CONFIG_EAP_TEAP
 HOSTAPD_CONFIG_EDITS += 's/\#\(CONFIG_TLS=\).*/\1internal/'
 endif
 
-ifeq ($(BR2_PACKAGE_HOSTAPD_DRIVER_HOSTAP),)
-HOSTAPD_CONFIG_DISABLE += CONFIG_DRIVER_HOSTAP
-endif
-
 ifeq ($(BR2_PACKAGE_HOSTAPD_DRIVER_NL80211),)
 HOSTAPD_CONFIG_DISABLE += CONFIG_DRIVER_NL80211
 endif
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/2] package/libnl: fix build with kernel < 4.15

[Julien Olivain via buildroot]

On 16/08/2026 23:15, Bernd Kuhls wrote:
> Buildroot commit 0f2e9cc8784715bdf18e72c433fe9bece4537f85 bumped the
> package from 3.11.0 to 3.12.0. This bump includes upstream commit
> https://github.com/thom311/libnl/commit/9f8945251da404fb59778edc74be5775091e1f44
> which added the usage of enums not present in older kernel versions.
> 
> The Gitlab pipelines caught the build errors with the defconfig
> bootlin-aarch64-glibc-old:
> 
> lib/route/nh_encap_ila.c:50:19: error: ‘ILA_ATTR_IDENT_TYPE’ undeclared
>  (first use in this function)
> lib/route/nh_encap_ila.c:53:19: error: ‘ILA_ATTR_HOOK_TYPE’ undeclared
>  (first use in this function)
> 
> Both enums were added to the Linux kernel in version 4.15:
> https://github.com/torvalds/linux/commit/fddb231ebe647749782a9ebf11106a81f7168ba7
> https://github.com/torvalds/linux/commit/70d5aef48a421a68bd9d1bf8f8267af406681580
> 
> Add upstream commit to fix the problem.
> 
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Series applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot