2026-01-14  Daniel Kiper  <daniel.kiper@oracle.com>

	Release 2.14

2026-01-14  Daniel Kiper  <daniel.kiper@oracle.com>

	build: Add grub-core/tests/crypto_cipher_mode_vectors.h file to EXTRA_DIST
	This file was not added to EXTRA_DIST during test creation.

	Fixes: 51ebc6f67 (tests: Add functional tests for ecb/cbc helpers)

	Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
	Reviewed-by: Srish Srinivasan <ssrish@linux.ibm.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>

2026-01-13  Radoslav Kolev  <radoslav.kolev@suse.com>

	configure: Print a more helpful error if autoconf-archive is not installed
	... because an undefined macro receives another macro as parameter and
	autoconf is not smart enough to produce a useful error message.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2026-01-13  Avnish Chouhan  <avnish@linux.ibm.com>

	kern/ieee1275/openfw: Add a check for invalid partition number
	The grub_strtoul() may fail in several scenarios like invalid input,
	overflow, etc. Lack of proper check may lead to unexpected failures
	in the code further.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2026-01-08  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	grub-mkimage: Do not generate empty SBAT metadata
	When creating core.elf with SBAT the grub-mkimage does not check if
	an SBAT metadata file contains at least an SBAT header or not. It leads to
	adding an empty SBAT ELF note for PowerPC and the .sbat section for EFI.
	Fix this by checking the SBAT metadata file size against the SBAT header
	size before adding SBAT contents to the ELF note or .sbat section.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2026-01-08  Yao Zi  <me@ziyao.cc>

	configure: Defer check for -mcmodel=large until PIC/PIE checks are done
	On RISC-V, large code model is only compatible with position-depedent
	code. However, the configure script checks availability of -mcmodel=large
	before determining whether PIC/PIE is enabled, and disable them.

	This is problematic with toolchains that enable PIE by default, where
	check for -mcmodel=large will always fail with,

	  cc1: sorry, unimplemented: code model 'large' with '-fPIC'

	and -mcmodel=medany will be silently used instead, causing relocation
	failures at runtime with some memory layouts since -mcmodel=medany
	requires all data and code to stay within a contiguous 4 GiB range.

	Let's defer the check for -mcmodel=large until PIC/PIE is ensured disabled.

	Fixes: f1957dc8a334 (RISC-V: Add to build system)

	Reported-by: Han Gao <gaohan@iscas.ac.cn>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2026-01-08  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	util/grub-mkimagexx: Stop generating unaligned appended signatures
	When creating the core image with an unaligned appended signature size,
	e.g. 479, for PowerPC, the grub-mkimage aligns the appended signature
	size to a multiple of 4 bytes, but it does not add a padding needed to
	align to multiple of 4 bytes appended signature size in the appended
	signature ELF note. Therefore, after signing and installing this core
	image, the firmware tries to read the magic string "~Module signature
	appended~" from the appended signature ELF note but gets the partial
	magic string like "Module signature appended~". It leads to the appended
	signature magic string match failure.

	Example:
	  grub-mkimage -O powerpc-ieee1275 -o core.elf -p /grub -x \
	    kernel.der --appended-signature-size 479 ...

	  sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed

	Without padding: hexdump -C ./core.elf.signed
	  ...
	  00383550  00 00 00 13 00 00 01 e0  41 53 69 67 41 70 70 65  |........ASigAppe|
	  00383560  6e 64 65 64 2d 53 69 67  6e 61 74 75 72 65 00 00  |nded-Signature..|
	  ...
	  003836f0  dd 47 cd ed 02 8e 15 af  5b 09 2e 44 6f da 67 88  |.G......[..Do.g.|
	  00383700  4d 94 17 31 26 9d 47 95  d8 7c ad 36 00 d2 9c 53  |M..1&.G..|.6...S|
	  00383710  20 e0 af 60 78 cd 22 e6  ed 45 1e b1 e7 7e cf b5  | ..`x."..E...~..|
	  00383720  fc 58 ec df 1b ab 7a 00  00 02 00 00 00 00 00 00  |.X....z.........|
	  00383730  00 01 b7 7e 4d 6f 64 75  6c 65 20 73 69 67 6e 61  |...~Module signa|
	  00383740  74 75 72 65 20 61 70 70  65 6e 64 65 64 7e 0a     |ture appended~.|

	Fix this by adding a padding required to align appended signature size in the
	appended signature ELF note to multiple of 4 bytes.

	Example:
	  grub-mkimage -O powerpc-ieee1275 -o core.elf -p /grub -x \
	    kernel.der --appended-signature-size 479 ...

	  sign-file SHA256 ./grub.key ./grub.pem ./core.elf ./core.elf.signed

	With padding: hexdump -C ./core.elf.signed
	  ...
	  00137460  62 00 00 00 00 00 00 13  00 00 01 ec 41 53 69 67  |b...........ASig|
	  00137470  41 70 70 65 6e 64 65 64  2d 53 69 67 6e 61 74 75  |Appended-Signatu|
	  ...
	  00137610  b7 07 cd b6 c8 ca 9a 5b  7c 13 8c 75 1d 1c 54 81  |.......[|..u..T.|
	  00137620  7f c4 9a 8b bd d7 73 8d  2f 7d d2 e6 d1 3c 52 a9  |......s./}...<R.|
	  00137630  4e 0b e5 24 ba 0a 82 aa  8e c5 86 fa e1 19 50 ec  |N..$..........P.|
	  00137640  9f a7 9a ed e5 ed 13 35  00 00 02 00 00 00 00 00  |.......5........|
	  00137650  00 00 01 c2 7e 4d 6f 64  75 6c 65 20 73 69 67 6e  |....~Module sign|
	  00137660  61 74 75 72 65 20 61 70  70 65 6e 64 65 64 7e 0a  |ature appended~.|

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2026-01-08  Srish Srinivasan  <ssrish@linux.ibm.com>

	tests: Add functional tests for ecb/cbc helpers
	Test the following helper functions using AES with 128, 192, and
	256 bit keys:
	  - grub_crypto_ecb_encrypt(),
	  - grub_crypto_ecb_decrypt(),
	  - grub_crypto_cbc_encrypt(),
	  - grub_crypto_cbc_decrypt().

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
	Reviewed-by: Glenn Washburn <development@efficientek.com>

2026-01-08  Srish Srinivasan  <ssrish@linux.ibm.com>

	osdep/aros/hostdisk: Fix use-after-free bug during MsgPort deletion
	... in function grub_util_fd_open() when creation of an I/O request or
	opening a device fails. The "ret", the file descriptor, will be freed
	before its associated MsgPort is deleted resulting in a use-after-free
	condition.

	Fix this issue by freeing "ret" after its associated MsgPort has been
	deleted.

	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2026-01-08  Ingo Breßler  <dev@ingobressler.net>

	kern/efi/sb: Enable loading GRUB_FILE_TYPE_CRYPTODISK_ENCRYPTION_KEY and GRUB_FILE_TYPE_CRYPTODISK_DETACHED_HEADER
	... file types when UEFI Secure Boot is enabled. Otherwise it is not
	possible to load cryptodisk encryption key or detached header.

	Fixes: https://savannah.gnu.org/bugs/?65889

	Reviewed-by: Alec Brown <alec.r.brown@oracle.com>

2025-12-21  Radoslav Kolev  <radoslav.kolev@suse.com>

	blsuki: Error out if unexpected arguments are supplied
	This can be especially helpful, as the Fedora version of the blscfg
	actually made use of positional arguments, but current implementation
	switched to parameters. For example what used to be "blscfg (hd0,gpt2)/..."
	now should be "blscfg --path (hd0,gpt2)/...)". In case of old configs/scripts
	still supplying positional arguments we will now error out instead of just
	ignoring them and falling back to defaults silently.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Radoslav Kolev  <radoslav.kolev@suse.com>

	blsuki: Fix default location in comment to /loader/entries
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Radoslav Kolev  <radoslav.kolev@suse.com>

	blsuki: Use specified device in case of fallback
	Currently if the fallback option is enabled and no files are found in
	the specified directory it searches the default (loader/conf) directory
	but always in the device set by the root environment variable. It makes
	more sense and also the comment in the code implies, that the default
	directory on the current device should be searched.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Radoslav Kolev  <radoslav.kolev@suse.com>

	blsuki: Fix position of DIR parameter in blscfg command summary
	The DIR parameter in the example should be specified after the -p|--path option
	instead of after -f|fallback.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Radoslav Kolev  <radoslav.kolev@suse.com>

	blsuki: Fix typo in entry parameter description
	Change "specificUKII entries" to "specific UKI entries".

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Khalid Ali  <khaliidcaliy@gmail.com>

	efi: Fix several memory leaks of UEFI handles
	Fix possible and absolute memory leaks of "handles"
	returned by grub_efi_locate_handle() using grub_malloc().

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Andreas K. Hüttel  <dilfridge@gentoo.org>

	util/grub-install: Allow recursive copying of theme dirs
	grub-install allows to pass a parameter to install a theme in the boot partition.
	This works fine for the default starfield theme. However, in general themes can
	contain subdirectories, as, e.g. "icons", and these are not copied by grub-install.
	As a result, the icons are missing on the screen.

	Fix this by simple recursive copying.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Heinrich Schuchardt  <heinrich.schuchardt@canonical.com>

	commands/efi/lsefisystab: Recognize EFI_MEMORY_ATTRIBUTES_TABLE_GUID and EFI_TCG2_FINAL_EVENTS_TABLE_GUID
	Let the lsefisystab command recognize the following table GUIDs:
	  - EFI_MEMORY_ATTRIBUTES_TABLE_GUID,
	  - EFI_TCG2_FINAL_EVENTS_TABLE_GUID.

	Reviewed-by: Vladimir Serbinenko <phcoder@gmail.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Glenn Washburn  <development@efficientek.com>

	tests/util/grub-fs-tester: Use CSMACINTOSH encoding instead of macroman
	From Debian 12 to 13, recode had a major overhaul and now does not support
	the macroman encoding. Its unclear if this is a bug or intentional.
	Regardless, use the CSMACINTOSH encoding instead as MacRoman and it are
	aliases and CSMACINTOSH is supported on both Debian 12 and 13.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Luca Boccassi  <luca.boccassi@gmail.com>

	commands/bli: Set UINT32_MAX in LoaderTpm2ActivePcrBanks if TPM2 present but no banks protocol
	The implementation in sd-boot was changed to return UINT32_MAX when
	the EFI environment detects a working TPM2, but with an older firmware
	that doesn't implement the protocol to get the list of active banks.
	This allows distinguishing with the case where there is no working TPM2,
	in which case userspace just gives up, and instead lets userspace try to
	figure it out later.

	Fixes: f326c5c47 (commands/bli: Set LoaderTpm2ActivePcrBanks runtime variable)

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Sridhar Markonda  <sridharm@linux.ibm.com>

	script/execute: Add a NULL check after grub_calloc() call
	... in gettext_append() to handle allocation errors. This prevents NULL
	pointer dereference and stops crashes during string translation.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Avnish Chouhan  <avnish@linux.ibm.com>

	disk/ieee1275/ofdisk: Fix memory leaks
	In case of an overflow "p" and "p->grub_devpath" will not be freed.
	Fix both issues.

	Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>

2025-12-21  Avnish Chouhan  <avnish@linux.ibm.com>

	efiemu/loadcore: Add grub_calloc() failure check
	Add a failure check after grub_calloc() call. If grub_calloc()
	fails, e.g., due to memory allocation failure, it returns NULL.
	Then using grub_efiemu_elfsyms, which will be NULL, later will
	result in a NULL pointer dereference.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  George Hu  <integral@archlinux.org>

	lib/x86_64/setjmp: Use 32-bit zero idiom for shorter encoding
	Switch from "xorq %rax, %rax" to "xorl %eax, %eax". In 64-bit mode
	zeroing EAX implicitly clears RAX and the 32-bit form encodes are one
	byte smaller while keeping identical semantics.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Glenn Washburn  <development@efficientek.com>

	tests: Fix nonnative tests labeled as native
	The tests asn1_test and tpm2_key_protector_test should be labelled as
	nonnative tests because they run tests on the target. A clue that
	indicates a nonnative test is the usage of the grub-shell script.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-12-21  Glenn Washburn  <development@efficientek.com>

	INSTALL: Add note that the GNU Autoconf Archive may be needed
	As of 1a5417f39a0c (configure: Check linker for --image-base support),
	the GNU Autoconf Archive is now required to bootstrap GRUB.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-21  Glenn Washburn  <development@efficientek.com>

	INSTALL: Fix a grammatical error
	Also, add more documentation mentioning that the tests require
	a "specially crafted environment" to run. Just running as root
	is not enough.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-21  Glenn Washburn  <development@efficientek.com>

	bootstrap: Condense and simplify LINGUAS generation
	Remove unnecessary subshells. Loop over autogenerated po files only once.
	Use existing LINGUAS created by bootstrap instead of finding po files
	again.

	Add wget as a soft requirement now that we are using bootstrap's code
	for updating translation files. This should only be needed if updated
	translations are desired, which is the default. There should be older
	translation files already, and wget is not necessary if those will
	suffice.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-21  Glenn Washburn  <development@efficientek.com>

	bootstrap: Migrate linguas.sh into bootstrap.conf
	Bootstrap has infrastructure for downloading/updating project po files
	and generating the LINGUAS file. It uses wget instead of rsync, but
	provides the same functionality, namely that only po files that have
	a modification date before the corresponding one on the server will get
	redownloaded. Bootstrap creates a pristine copy of the po files in
	po/.reference, so update .gitignore to ignore that directory.

	Bootstrap also creates the po/LINGUAS file, but it does not know to add
	in GRUB's autogenerated po files. So move that code from linguas.sh into
	the bootstrap epilogue.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-21  Glenn Washburn  <development@efficientek.com>

	bootstrap: Run linguas.sh in bootstrap epilogue
	Heretofore, linguas.sh had to be run by the user and a common mistake
	made when building GRUB was to not run the command. By adding it to
	the bootstrap epilogue it will by default get run at the end of the
	bootstrap script. The user no longer needs to remember to run it.
	If the --skip-po option is passed to bootstrap, do not run linguas.sh.
	This allows for bootstrap to be run without updating the translations,
	which might be desired in the future if we track po files so that
	translations can be used as they were at time of release.

	Update INSTALL file to reflect that it is no longer necessary to run
	linguas.sh. Also, fix a list numbering error.

	Fixes: 9f73ebd49be (* INSTALL: Document linguas.sh.)

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-21  Avnish Chouhan  <avnish@linux.ibm.com>

	normal/cmdline: Add grub_calloc() failure check and fix hist_lines state loss
	If grub_calloc() fails hist_lines becomes NULL. It means we loose the
	reference to the previously allocated hist_lines and leak memory. With
	this change on failure hist_lines still points to the old memory. So,
	no leak, no state corruption.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-20  Michael Chang  <mchang@suse.com>

	blsuki: Fix grub_errno leakage in blsuki_is_default_entry()
	The grub_strtol() call in blsuki_is_default_entry() can set grub_errno
	to either GRUB_ERR_BAD_NUMBER or GRUB_ERR_OUT_OF_RANGE if the input
	string is invalid or out of range.

	This grub_errno value is currently left uncleared, which can lead to
	unexpected behavior in subsequent functions that rely on checking
	current state of grub_errno.

	Clear grub_errno unconditionally when grub_strtol() reports error so
	that we can plug the leak.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-20  Glenn Washburn  <development@efficientek.com>

	Revert "tests: Remove -w param from mkfs.hfsplus command"
	The original commit removes testing of GRUB's support for HFS+
	wrapping and replaces it with testing that is an exact duplicate of
	another test, namely HFS+ without wrapping. To start, the change is
	misleading in that it suggests that the testing of HFS+ wrapping is
	still taking place, when it is not. If it was desired to remove support
	for testing the HFS+ wrapping, then the test should have been removed
	entirely. Second, having a series of tests that are exactly the same is
	just a waste of testing resources. And third, the justification for the
	change is nonsensical. Just because a required program may not have
	a required feature on a particular distro is not a reason that a test
	should be removed. Reducing test coverage because some distros do not
	have the tools GRUB needs to run certain tests goes against the testing
	priority to have test coverage be as broad as possible. The fact is
	that Debian, the officially supported distro for running the tests, does
	have a mkfs.hfsplus that supports the -w parameter.

	This reverts commit 2bc0929a2 (tests: Remove -w param from mkfs.hfsplus command).

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-20  Glenn Washburn  <development@efficientek.com>

	Revert "tests: Skip tests if required tools are not available"
	As explained in commit a21618c8a (tests: Test aborts due to missing
	requirements should be marked as error instead of skipped) and in the
	Automake manual[1], skipped tests are tests that should not be run, e.g.
	running the ohci test on the powerpc-ieee1275 as there are no native ohci
	drivers for that platform. Test that fail for reasons other than there is
	a bug in GRUB code that is causing the test to fail are hard errors.
	Commonly this is because the test is run in an improperly configured
	environment, like required programs are missing. If a hard error condition
	is identified with a SKIP return code, the person running the tests can not
	know without investigating every skip if a SKIP in the tests was because
	the test does not apply to the target being tested or because the user had
	a misconfigured environment that was causing the test not to run. By
	ensuring that a test is skipped only when it should not run, the person
	running the test can be sure that there is no need to investigate why the
	test was skipped.

	This reverts commit bf13fed5f (tests: Skip tests if required tools are not available).

	[1] https://www.gnu.org/software/automake/manual/automake.html#Generalities-about-Testing

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-20  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	osdep/linux/ofpath: Add missing strdup() failure checks
	Segmentation faults or undefined behaviour may result from a NULL pointer
	dereference in strip_trailing_digits() and grub_util_devname_to_ofpath()
	if strdup() fails. Therefore, I added a NULL check to fix this.

	Reviewed-by: Srish Srinivasan <ssrish@linux.ibm.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-20  Vladimir Serbinenko  <phcoder@gmail.com>

	lib/relocator: Fix dereference after NULL check
	In the function free_subchunk(), after checking that subchu->post isn't NULL,
	grub_memset() is called on subchu->pre->freebytes but it should be called on
	subchu->post->freebytes. If subchu->pre is NULL but subchu->post isn't NULL,
	then this could lead to a NULL pointer dereference.

	Fixes: CID 473882

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-20  Nicholas Vinson  <nvinson234@gmail.com>

	configure: Check linker for --image-base support
	In several scenarios, configure tests assume it's safe to use
	"-Wl,-Ttext,<address>", but starting with ld.lld-21, blindly using that
	flag may result in configure-test failures due to ld.lld failing to
	link. The failure is because ld.lld-21 no longer allows the specified
	address is less than the base address.

	However, ld.lld-21+ and ld.bfd-2.44+ both provide support for the
	--image-base flag making it preferable over the older -Ttext flag.

	Fixes: https://savannah.gnu.org/bugs/?67662

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-20  Glenn Washburn  <development@efficientek.com>

	INSTALL: Make note that Linux kernel 6.12.x or earlier is needed for reiserfs testing
	Also, remove wording suggesting that tests may be skipped if prerequisites
	are not installed. Tests should never be skipped because of an environment
	misconfiguration, instead they should return a hard error (code 99).

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-20  Glenn Washburn  <development@efficientek.com>

	docs: Reorganize test section and add section on writing tests
	Rename the main section to Tests and put the existing test section into
	a subsection. A new subsection called "Writing tests" is added to give
	a brief overview and make clear the difference in returning a SKIP code
	versus a HARD ERROR code.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-20  Glenn Washburn  <development@efficientek.com>

	docs: Add note and explanation that the privileged user is required for properly running the tests
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-20  Glenn Washburn  <development@efficientek.com>

	docs: Fix spelling, grammatical and usage issues with new Porting section
	There are some other fixes outside of this section as well.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-20  Glenn Washburn  <development@efficientek.com>

	util/grub-mkrescue: Fix spelling mistakes
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Jamie  <volticks@gmail.com>

	commands/usbtest: Ensure string length is sufficient in usb string processing
	If descstrp->length is less than 2 this will result in underflow in
	"descstrp->length / 2 - 1" math. Let's fix the check to make sure the
	value is sufficient.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Jamie  <volticks@gmail.com>

	commands/usbtest: Use correct string length field
	An incorrect length field is used for buffer allocation. This leads to
	grub_utf16_to_utf8() receiving an incorrect/different length and possibly
	causing OOB write. This makes sure to use the correct length.

	Fixes: CVE-2025-61661

	Reported-by: Jamie <volticks@gmail.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Alec Brown  <alec.r.brown@oracle.com>

	tests/lib/functional_test: Unregister commands on module unload
	When the functional_test module is loaded, both the functional_test and
	all_functional_test commands are registered but only the all_functional_test
	command is being unregistered since it was the last to set the cmd variable
	that gets unregistered when the module is unloaded. To unregister both
	commands, we need to create an additional grub_extcmd_t variable.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Alec Brown  <alec.r.brown@oracle.com>

	normal/main: Unregister commands on module unload
	When the normal module is loaded, the normal and normal_exit commands
	are registered but aren't unregistered when the module is unloaded. We
	need to add calls to grub_unregister_command() when unloading the module
	for these commands.

	Fixes: CVE-2025-61663
	Fixes: CVE-2025-61664

	Reported-by: Alec Brown <alec.r.brown@oracle.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Alec Brown  <alec.r.brown@oracle.com>

	gettext/gettext: Unregister gettext command on module unload
	When the gettext module is loaded, the gettext command is registered but
	isn't unregistered when the module is unloaded. We need to add a call to
	grub_unregister_command() when unloading the module.

	Fixes: CVE-2025-61662

	Reported-by: Alec Brown <alec.r.brown@oracle.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Thomas Frauendorfer | Miray Software  <tf@miray.de>

	net/net: Unregister net_set_vlan command on unload
	The commit 954c48b9c (net/net: Add net_set_vlan command) added command
	net_set_vlan to the net module. Unfortunately the commit only added the
	grub_register_command() call on module load but missed the
	grub_unregister_command() on unload. Let's fix this.

	Fixes: CVE-2025-54770
	Fixes: 954c48b9c (net/net: Add net_set_vlan command)

	Reported-by: Thomas Frauendorfer | Miray Software <tf@miray.de>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Thomas Frauendorfer | Miray Software  <tf@miray.de>

	kern/file: Call grub_dl_unref() after fs->fs_close()
	With commit 16f196874 (kern/file: Implement filesystem reference
	counting) files hold a reference to their file systems.

	When closing a file in grub_file_close() we should not expect
	file->fs to stay valid after calling grub_dl_unref() on file->fs->mod.
	So, grub_dl_unref() should be called after file->fs->fs_close().

	Fixes: CVE-2025-54771
	Fixes: 16f196874 (kern/file: Implement filesystem reference counting)

	Reported-by: Thomas Frauendorfer | Miray Software <tf@miray.de>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Thomas Frauendorfer | Miray Software  <tf@miray.de>

	commands/test: Fix error in recursion depth calculation
	The commit c68b7d236 (commands/test: Stack overflow due to unlimited
	recursion depth) added recursion depth tests to the test command. But in
	the error case it decrements the pointer to the depth value instead of
	the value itself. Fix it.

	Fixes: c68b7d236 (commands/test: Stack overflow due to unlimited recursion depth)

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Alec Brown  <alec.r.brown@oracle.com>

	fs/zfs/zfs: Avoid pointer downcasting in dnode_get()
	Coverity marks multiple issues in grub-core/fs/zfs/zfs.c as either "Untrusted
	value as argument", "Untrusted pointer read", or "Untrusted loop bound". Each
	of these issues share a common cause where Coverity finds that data->dnode_buf
	gets tainted by dnbuf since it is downcasting from (void *) to (dnode_phys_t *)
	and could imply that the data the pointer points to is tainted. However, the
	function zio_read(), which reads this data from disk, sanitizes this data by
	verifying its checksum. To resolve the issues for Coverity, setting dnbuf to
	(dnode_phys_t *) at the start of the function dnode_get() seems to do the trick.

	Fixes: CID 314020
	Fixes: CID 896330
	Fixes: CID 896331
	Fixes: CID 896334
	Fixes: CID 896336
	Fixes: CID 896340
	Fixes: CID 897337

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Alec Brown  <alec.r.brown@oracle.com>

	mmap/mmap: Fix resource leak
	In the function grub_mmap_iterate(), memory is allocated to
	"ctx.scanline_events" and "present" but isn't freed when error handling
	grub_malloc(). Prior to returning grub_errno, these variables should be
	freed to prevent a resource leak.

	Fixes: CID 96655

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Glenn Washburn  <development@efficientek.com>

	linguas: Ensure that linguas.sh runs from the directory that it resides
	The script assumes that it is run from the root of the source tree,
	which is where it is located. So this should be enforced to prevent
	accidental misuses.

	realpath is used instead of readlink as that is recommended in Debian's
	readlink manpage since at least Debian 11. Also, use the shell variable's
	parameter expansion for removing a suffix pattern to get the directory
	in which the script resides. This is preferable to using the dirname binary
	as it avoids creating a new process.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Glenn Washburn  <development@efficientek.com>

	gitignore: Remove po/*.po and po/LINGUAS
	po files will now be tracked. This has the following benefits as listed
	by Colin Watson:

	  * Build processes would no longer be vulnerable to an external server
	    potentially going down for an extended period of time; they'd be
	    stuck with outdated translations until the server was fixed or came
	    up with a workaround, but that's better than nothing.

	  * It would be easier to manage branches of stable releases, rather than
	    assuming that translations downloaded for master will match the POT
	    files for a stable release.

	  * Tests would be able to pass from a clean git checkout without relying
	    on an external server, improving QA reliability.

	  * It would be easier to make and test branches while offline.

	  * The translations shipped with a release tarball could be tagged in
	    git so that it's easy to investigate bugs in them.

	  * Downstream distributors would be able to use git branches without
	    having to fill in additional files.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Glenn Washburn  <development@efficientek.com>

	tests/grub_cmd_cryptomount: Use builddir shell variable and quote
	Using a shell variable instead of an autoconf macro creates less changes
	to the file, which can be desirable when modifying by hand later and
	then diffing with the unexpanded file. It also makes it simpler to
	change the builddir after expansion, which may need to happen when
	moving the build dir to a different path and not being able to rerun
	the autoconf expansion.

	Also, add quoting around the builddir variable as there may be spaces
	in the path.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>

2025-11-18  Glenn Washburn  <development@efficientek.com>

	tests/grub_cmd_cryptomount: Expect test success, now that GRUB supports Argon2
	This test was included to verify that, while GRUB did not have Argon2
	support, trying to open a LUKS2 volume with an Argon2 keyslot would fail
	Now that Argon2 support is included, the test is failing because it
	expected a failure, but is now getting success. Change the test to expect
	success.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>

2025-11-18  Glenn Washburn  <development@efficientek.com>

	tests/erofs_test: Improve accuracy of FSTIME check
	On resource constrained test runs, the last modification time on the
	image is an unreliable date to check against the filesystem creation
	time. Use dump.erofs to get the filesystem creation time from the
	superblock. This should get the timestamp as shown by GRUB's "ls -l".

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>

2025-11-18  Glenn Washburn  <development@efficientek.com>

	tests/erofs_test: Disable filetime check for erofs_compact
	Compact EROFS inodes do not allow for modification times that are
	different from FS creation times. The file modification time check is
	done between the EROFS image and the file system where test temporary
	files are written to, not the files as seen from the mounted EROFS image.
	So its likely that the file modification time will be different, more
	so when run on slower systems.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>

2025-11-18  Glenn Washburn  <development@efficientek.com>

	tests/erofs_test: Remove root check
	The erofs tests do not ever mount the generated erofs image. So root is
	not needed, as with the squashfs and iso9660 filesystems.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>

2025-11-18  Glenn Washburn  <development@efficientek.com>

	tests/erofs_test: Fix mkfs.erofs version test to not use process substitution bashism
	The shell used to run the tests is generally /bin/sh, which does not
	support process substitution.

	Fixes: b990df0bef9e (tests/util/grub-fs-tester: Fix EROFS label tests in grub-fs-tester)

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>

2025-11-18  Andrew Hamilton  <adhamilt@gmail.com>

	tests: Support changed mkfs.ext2 behavior for -r flag
	Correct nuisance ext234_test failure on newer Linux distros.

	Recently, the mkfs.ext2 utility removed support for the -r flag to
	specify old (version 0) formats of ext2. A new flag was added to allow
	the same behavior. Support both ways of specifying version 0 ext2 file
	systems when testing ext2 in GRUB.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
	Reviewed-by: Glenn Washburn <development@efficientek.com>

2025-11-18  Andrew Hamilton  <adhamilt@gmail.com>

	tests: Avoid test failure in erofs for label length
	Recently, mkfs.erofs began to enforce that the file system
	label is 15 characters or less (excluding NUL terminator).
	This causes the current erofs test in GRUB to fail. Reduce
	the test label used to fit in this limit allowing the test
	to work as expected.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
	Reviewed-by: Glenn Washburn <development@efficientek.com>

2025-11-18  Andrew Hamilton  <adhamilt@gmail.com>

	tests: Split ZFS ZSTD test into new file
	Split ZFS ZSTD test into its own test script. Add a check to the new
	test script to see if the zfs utility installed on the host supports
	"zstd" compression before running the test and fail the test if not. It
	seems at least some zfs-fuse binaries do not support zstd compression
	and the current test will fail in that case. Splitting into a new file
	will avoid masking other test failures due to missing zstd support.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
	Reviewed-by: Glenn Washburn <development@efficientek.com>

2025-11-18  Andrew Hamilton  <adhamilt@gmail.com>

	util/grub.d/00_header.in: Disable loading all_video for EFI
	Loading all_video for EFI can cause video issues in some cases
	since GRUB Bochs/Cirrus drivers may conflict with native EFI drivers.
	Change default behavior for EFI to only load EFI specific video
	modules. Also include a new environment variable to restore the old
	behavior if needed.

	Fixes: https://savannah.gnu.org/bugs/?66200

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Glenn Washburn  <development@efficientek.com>

	util/grub-mkrescue: Fix copy/paste issue referencing mdadm
	The check_xorriso() function appears to have been copy/pasted from
	somewhere that was originally checking the mdadm command. So the file
	handle to the output of the xorriso command is named "mdadm". Instead
	rename it to the more generic "fout". Also change a comment referencing
	mdadm to reference xorriso.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Avnish Chouhan  <avnish@linux.ibm.com>

	osdep/linux/getroot: Add missing strdup() failure checks
	If strdup() fails, it returns NULL and passing NULL further down to
	the code can lead to segmentation fault or an undefined behavior.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Avnish Chouhan  <avnish@linux.ibm.com>

	kern/mips/arc/init: Add missing grub_strdup() failure check
	If grub_strdup() fails, it returns NULL and passing NULL further down to
	the code can lead to segmentation fault or an undefined behavior.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Avnish Chouhan  <avnish@linux.ibm.com>

	script/execute: Add missing grub_strdup() failure check
	If grub_strdup() fails, it returns NULL and passing NULL further down to
	the code can lead to segmentation fault or an undefined behavior.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Avnish Chouhan  <avnish@linux.ibm.com>

	kern/ieee1275/openfw: Add missing grub_strdup() failure checks
	If grub_strdup() fails, it returns NULL and passing NULL further down to
	the code can lead to segmentation fault or an undefined behavior.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-18  Andrew Hamilton  <adhamilt@gmail.com>

	docs: Add security hardening suggestions
	Add some suggestions to the security section on maximizing the
	security hardening of GRUB.

	This change reveals sectioning issues introduced by commit 0b59d379f
	(docs/grub: Document signing GRUB under UEFI) and commit 0f2dda8cf
	(docs/grub: Document signing GRUB with an appended signature). Fix them
	on the occasion.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-06  Leo Sandoval  <lsandova@redhat.com>

	tests: Remove -w param from mkfs.hfsplus command
	Apparently the man page is outdated because the option "-w" is shown
	but not on "mkfs.hfsplus --usage". According to Gemini:

	  The -w option is used to add an HFS wrapper around an HFS Plus file
	  system, which is sometimes required for compatibility with older
	  Mac OS 9 systems. However, this is not a standard or commonly used
	  option and may not be available in all versions of the hfsprogs package,
	  especially on Linux.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-06  Leo Sandoval  <lsandova@redhat.com>

	tests: Increase verbosity in *_test.in checks
	In this case it does not hurt to increase bash execution verbosity so
	we can get more insight in case of issues.

	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-06  Leo Sandoval  <lsandova@redhat.com>

	tests: Skip tests if required tools are not available
	There is no reason to fail a test if the required testing tool is not
	present on the system, so skip the test instead of failing it.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Neal Gompa <ngompa13@gmail.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-06  Srish Srinivasan  <ssrish@linux.ibm.com>

	tests: Extend pbkdf2_test to cover HMAC-SHA{256,512}
	HMAC-SHA1 is the only HMAC variant tested in the existing vectors.
	Add vectors to test HMAC-SHA{256,512} as well.

	Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-06  Avnish Chouhan  <avnish@linux.ibm.com>

	lib/legacy_parse: Add missing grub_malloc() failure check
	This patch adds a NULL check after grub_malloc() call. Missing a failure
	check after calling grub_malloc() can lead to undefined behavior. If the
	allocation fails and returns NULL subsequent dereferencing or writing to
	the pointer will likely result in a runtime error such as a segmentation
	fault.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-06  Avnish Chouhan  <avnish@linux.ibm.com>

	mmap/mmap: Add missing grub_malloc() failure check
	This patch adds a NULL check after grub_malloc() call. Missing a failure
	check after calling grub_malloc() can lead to undefined behavior. If the
	allocation fails and returns NULL subsequent dereferencing or writing to
	the pointer will likely result in a runtime error such as a segmentation
	fault.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-06  Avnish Chouhan  <avnish@linux.ibm.com>

	partmap/msdos: Add missing grub_malloc() failure check
	This patch adds a NULL check after grub_malloc() call. Missing a failure
	check after calling grub_malloc() can lead to undefined behavior. If the
	allocation fails and returns NULL subsequent dereferencing or writing to
	the pointer will likely result in a runtime error such as a segmentation
	fault.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-06  Avnish Chouhan  <avnish@linux.ibm.com>

	normal/completion: Add missing grub_malloc() failure check
	This patch adds a NULL check after grub_malloc() call. Missing a failure
	check after calling grub_malloc() can lead to undefined behavior. If the
	allocation fails and returns NULL subsequent dereferencing or writing to
	the pointer will likely result in a runtime error such as a segmentation
	fault.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-06  Avnish Chouhan  <avnish@linux.ibm.com>

	term/ieee1275/serial: Fix memory leak
	The grub_zalloc() allocates memory for port. If the allocation for
	port->name fails the function returns NULL without freeing the
	previously allocated port memory. This results in a memory leak.
	To avoid this we must free port before return.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2025-11-06  Lars Wendler  <polynomial-c@gmx.de>

	configure: Avoid bashisms
	or else configure check doesn't succeed with non-bash shell (e.g. dash):

	  checking whether to enable AMD64 as(1) feature detection... /var/tmp/portage/sys-boot/grub-2.14_rc1/work/grub-2.14~rc1/configure: 39176: test: xx86_64: unexpected operator
	  no

	and later build fails with

	  /var/tmp/portage/sys-boot/grub-2.14_rc1/work/grub-2.14~rc1/grub-core/lib/libgcrypt-grub/src/hwf-x86.c: In function ‘detect_x86_gnuc’:
