staging/nbd/package/system, branch master

fstools: update to git HEAD of 2026-07-25

2026-07-25T16:30:51Z

2aa1640 block: preen a registered volume before mount on request d43ffba block: use preen mode for the f2fs filesystem check a71e97d blockd: do not let a slow startup helper hold back readiness 1c17d24 blockd: expose storage readiness via a queryable status method f60b3a3 blockd: pass registrant mount options down to block on autofs mount 998f6ab blockd: notify when an idle autofs mount is unmounted 0008996 block: mount ubus-registered devices without an fstab entry 4fd1502 blockd: coldplug block devices 89a6f52 blockd: retry interrupted waitpid() in synchronous block() helper 37cf94d blockd: fix bounds of the ubus event name buffer Signed-off-by: Daniel Golle

rpcd: update to Git HEAD (2026-07-19)

2026-07-21T20:59:58Z

e37ed9d81469 file: re-authorize ACL against resolved path to close symlink bypass Link: https://github.com/openwrt/openwrt/pull/24329 Signed-off-by: Hauke Mehrtens

mtd: fis: fix buffer overflow from negative memset size

2026-07-17T08:02:59Z

In fis_remap(), when desc < last, the memset size is computed as 'tmp - end'. Since tmp is calculated as 'end - positive_value', tmp is always less than end, making 'tmp - end' negative. When cast to size_t, this wraps to a very large value, causing a massive buffer overflow. Fix by swapping the operands to 'end - tmp' which correctly computes the number of bytes to clear. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23550 Signed-off-by: Jonas Jelonek

ubus: update to Git HEAD (2026-06-28)

2026-06-28T14:48:20Z

24864e7840b3 ubusd_id: use GRND_INSECURE to avoid blocking boot on getrandom() Fixes: https://github.com/openwrt/ubus/issues/21 Signed-off-by: Hauke Mehrtens

procd: update to Git HEAD (2026-06-17)

2026-06-24T09:21:28Z

9ff6e43bb75f service: notify instance exit details via ubus 4f42296dc4f0 jail: mount rootfs overlay with userxattr in user namespace 60fdbf00e924 jail: chown rootfs overlay dir to mapped root in user namespace Signed-off-by: Felix Fietkau

mtd: bump package release

2026-06-16T09:32:52Z

This commit fixes "a5107ad58c6 mtd: fix buffer leak and fd leak in mtd_dump()" which changed the code but did not increase the release. This causes two packages with the same version to have different content and thereby hashes. Signed-off-by: Paul Spooren Link: https://github.com/openwrt/openwrt/pull/23827 Signed-off-by: Christian Marangi

package: make APK embedded help gzip reproducible

2026-06-10T18:15:15Z

APK compresses it's helptext using LUA and require `zlib`, which isn't available on the Buildbots. It thens falls back to `gzip`, which embeds the MTIME, making the binary itself unreproducible. This commits adds a downstream patch to run `gzip` with `-n`, setting the time to 0. Link: https://github.com/openwrt/openwrt/pull/23736 Signed-off-by: Paul Spooren

mtd: fix buffer leak and fd leak in mtd_dump()

2026-06-08T14:18:23Z

Two leaks in mtd_dump(): - The buffer allocated with malloc(erasesize) is never freed before returning, leaking erasesize bytes on every call. - The pre-existing malloc-NULL early return path also leaked the just- opened fd by returning directly instead of going through cleanup. Initialize buf to NULL, route the malloc-NULL case through the existing 'out:' label, and add free(buf) on the cleanup path so both fd and buf are released consistently on every exit. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23706 Signed-off-by: Jonas Jelonek

mtd: check malloc() return value in mtd_check()

2026-06-08T14:17:42Z

After malloc(erasesize) in mtd_check(), the result was never checked for NULL. On allocation failure, the buf pointer remained NULL and would later be used in image_check() via read(imagefd, buf + buflen, ...), causing a NULL pointer dereference. Add a NULL check after the allocation and return early. The early return path also closes the just-opened fd and frees the strdup'd colon-separated device-list copy to avoid leaks. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23705 Signed-off-by: Jonas Jelonek

mtd: check return values of lseek() and write() in mtd_write_buffer()

2026-06-08T14:17:02Z

Two ignored return values in mtd_write_buffer() caused silent failures: - lseek() return value was ignored. A failed seek (e.g. EBADF, ESPIPE) followed by write() would silently write at the wrong offset. - write() return value was ignored, silently discarding write errors. This could lead to data corruption on the MTD device without any indication. Check both return values, report errors to stderr and return -1 on failure. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23552 Signed-off-by: Jonas Jelonek