Add AnyKernel3 successful build for android14-6.1 with KernelSU-Next & SUSFS V2.1.0#12
Add AnyKernel3 successful build for android14-6.1 with KernelSU-Next & SUSFS V2.1.0#12IUenkodr wants to merge 8 commits into
Conversation
Add WildKernels SUSFS fix patch application to workflow.
Enhance SUSFS configuration options and error handling.
📝 WalkthroughWalkthroughSUSFS is bumped to v2.1.0 with new Kconfig options and public API extensions. A new SUSFS v2.1.0 + WildKernels Integration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (5)
android14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patch (1)
9-13: 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick winClose the
#ifndef CONFIG_KSU_SUSFSguardandroid14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patch:9-13adds#ifndef CONFIG_KSU_SUSFSwithout a matching#endif, so the patched C file will fail preprocessing.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@android14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patch` around lines 9 - 13, The `ksu_handle_faccessat` patch in `fix_sucompat.c.patch` opens a `#ifndef CONFIG_KSU_SUSFS` guard without closing it, so add the matching `#endif` in the same patch context. Make sure the conditional around `ksu_handle_faccessat` is properly terminated so the preprocessor can compile the generated C file cleanly.android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch (4)
1713-1725: 🩺 Stability & Availability | 🔴 Critical | 🏗️ Heavy lift
CONFIG_KSU_SUSFS_HARDENEDstill leaves a lockless UAF inSUS_KSTAT_HLIST.This branch deletes and frees
tmp_entrywhilesusfs_sus_ino_for_generic_fillattr()andsusfs_sus_ino_for_show_map_vma()still traverse the same table without the lock. The newrcu_headfield andhash_add_rcu()calls only make sense if readers move tohash_for_each_possible_rcu()underrcu_read_lock()and deleted nodes are retired withkfree_rcu().🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch` around lines 1713 - 1725, The CONFIG_KSU_SUSFS_HARDENED path still removes and frees SUS_KSTAT_HLIST entries in a way that can race with readers. Update the hardened flow around hash updates so readers in susfs_sus_ino_for_generic_fillattr() and susfs_sus_ino_for_show_map_vma() traverse the table under RCU using the corresponding RCU hash iterator, and retire deleted tmp_entry nodes with kfree_rcu() instead of freeing them immediately after hash_del().
1291-1315: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winHidden-name registration breaks same-package installs across Android users/profiles.
susfs_add_hidden_name()deduplicates only on the basename and drops later registrations, so the firstowner_uidwins permanently. If the same package name exists for a work profile or secondary user,susfs_is_hidden_name()will treat that second UID as foreign and hide its ownAndroid/data/Android/obbdirectory.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch` around lines 1291 - 1315, susfs_add_hidden_name() currently deduplicates hidden names only by basename, so the first owner_uid is kept and later registrations for the same package name are ignored. Update the lookup/add logic in susfs_add_hidden_name() to account for owner_uid as part of the identity, or merge multiple owner UIDs for the same name, and make sure susfs_is_hidden_name() uses the same matching rules so the same package can be hidden correctly across different Android users/profiles.
2068-2070: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winThe new unshare mount-id range is never treated as a SUS mount.
DEFAULT_UNSHARE_KSU_MNT_IDstarts at400000here, but the readers changed in this PR still key offmnt_id >= DEFAULT_KSU_MNT_ID(500000) infs/notify/fdinfo.c,fs/proc/fd.c,fs/proc_namespace.c, andfs/statfs.c. Any mount allocated from the 400000-range afterCL_COPY_MNT_NSwill bypass the SUSFS hide/remap logic and leak back into proc/statfs output.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch` around lines 2068 - 2070, The new unshared mount-id range is not being recognized by the SUS hide/remap paths, so mounts created from DEFAULT_UNSHARE_KSU_MNT_ID still bypass the checks. Update the mount-id comparisons in the readers touched by this patch—especially the logic in fdinfo, fd, proc_namespace, and statfs paths—to treat both DEFAULT_UNSHARE_KSU_MNT_ID and DEFAULT_KSU_MNT_ID ranges as SUS mounts. Make sure the relevant helper or conditional uses the new constant consistently wherever mount ids are classified.
648-656: 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick winRemove the
extern susfs_is_current_proc_umounted()redeclaration.susfs_def.halready declares this helper asstatic inline, so thisexternchanges the linkage and can trigger a conflicting-declaration build error.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch` around lines 648 - 656, Remove the redundant susfs_is_current_proc_umounted declaration from the header section in the patch, since susfs_def.h already provides it as a static inline helper and the extra extern in the same interface causes a linkage conflict. Keep the surrounding declarations for ksu_handle_faccessat and susfs_is_hidden_name intact, and make sure the fix preserves the existing guard structure around the CONFIG_KSU_SUSFS_HIDDEN_NAME block.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-ksu-next.yml:
- Around line 230-237: The patch-application loop in the workflow is using
outdated WildKernels filenames, so most SUSFS fixes are skipped. Update the
filename list in the build step that iterates over P to match the actual added
patch files (the ones with .c.patch in their names) so the apply logic can find
and process every patch, not just fix_Makefile.patch.
In `@android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch`:
- Around line 54-60: CONFIG_KSU_SUSFS_UID_GATED_HIDING is currently unused, so
make the hiding logic respect it. Update the relevant susfs hide predicates,
especially susfs_is_inode_sus_path() and the proc/mount hide paths, to check
this Kconfig symbol before applying UID-gated hiding behavior. If the option is
disabled, the existing sus_path/sus_mount hiding should be bypassed; if enabled,
preserve the current allowlist-based gating so the symbol actually changes
runtime behavior.
In `@android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksud.c.patch`:
- Around line 47-57: The fstat spoofing path in ksu_handle_vfs_fstat still
applies to init.rc even when ksu_init_rc_hook is disabled, so the SUSFS stop
path does not fully take effect. Update ksu_handle_vfs_fstat to check the same
ksu_init_rc_hook flag used around the read hook before calling is_init_rc and
modifying the reported size, so stop_init_rc_hook disables both read and stat
spoofing consistently.
In `@android14-6.1/KernelSU-Next/patches/wildkernels/fix_supercalls.c.patch`:
- Around line 39-45: The KSU_MARK_GET handling in fix_supercalls.c is returning
success for the SUSFS path even when pid-specific mark/unmark semantics are
unsupported, so update the branch around manage_mark/cmd.result to either honor
cmd.pid consistently or explicitly return an error for unsupported operations
instead of leaving ret as a successful no-op. Make sure the logic in the
KSU_MARK_GET case and the susfs_is_current_proc_umounted() path cannot report
success unless the requested mark operation was actually applied, and adjust the
related pid-based branches so they fail safely rather than reusing a default
success value.
---
Outside diff comments:
In `@android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch`:
- Around line 1713-1725: The CONFIG_KSU_SUSFS_HARDENED path still removes and
frees SUS_KSTAT_HLIST entries in a way that can race with readers. Update the
hardened flow around hash updates so readers in
susfs_sus_ino_for_generic_fillattr() and susfs_sus_ino_for_show_map_vma()
traverse the table under RCU using the corresponding RCU hash iterator, and
retire deleted tmp_entry nodes with kfree_rcu() instead of freeing them
immediately after hash_del().
- Around line 1291-1315: susfs_add_hidden_name() currently deduplicates hidden
names only by basename, so the first owner_uid is kept and later registrations
for the same package name are ignored. Update the lookup/add logic in
susfs_add_hidden_name() to account for owner_uid as part of the identity, or
merge multiple owner UIDs for the same name, and make sure
susfs_is_hidden_name() uses the same matching rules so the same package can be
hidden correctly across different Android users/profiles.
- Around line 2068-2070: The new unshared mount-id range is not being recognized
by the SUS hide/remap paths, so mounts created from DEFAULT_UNSHARE_KSU_MNT_ID
still bypass the checks. Update the mount-id comparisons in the readers touched
by this patch—especially the logic in fdinfo, fd, proc_namespace, and statfs
paths—to treat both DEFAULT_UNSHARE_KSU_MNT_ID and DEFAULT_KSU_MNT_ID ranges as
SUS mounts. Make sure the relevant helper or conditional uses the new constant
consistently wherever mount ids are classified.
- Around line 648-656: Remove the redundant susfs_is_current_proc_umounted
declaration from the header section in the patch, since susfs_def.h already
provides it as a static inline helper and the extra extern in the same interface
causes a linkage conflict. Keep the surrounding declarations for
ksu_handle_faccessat and susfs_is_hidden_name intact, and make sure the fix
preserves the existing guard structure around the CONFIG_KSU_SUSFS_HIDDEN_NAME
block.
In `@android14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patch`:
- Around line 9-13: The `ksu_handle_faccessat` patch in `fix_sucompat.c.patch`
opens a `#ifndef CONFIG_KSU_SUSFS` guard without closing it, so add the matching
`#endif` in the same patch context. Make sure the conditional around
`ksu_handle_faccessat` is properly terminated so the preprocessor can compile
the generated C file cleanly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0a849e3a-12fa-4f2c-9daf-71a43cc736d4
📒 Files selected for processing (11)
.github/workflows/build-ksu-next.ymlandroid14-6.1/KernelSU-Next/patches/50_add_susfs_in_gki-android14-6.1.patchandroid14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patchandroid14-6.1/KernelSU-Next/patches/wildkernels/fix_Makefile.patchandroid14-6.1/KernelSU-Next/patches/wildkernels/fix_kernel_umount.c.patchandroid14-6.1/KernelSU-Next/patches/wildkernels/fix_ksu.c.patchandroid14-6.1/KernelSU-Next/patches/wildkernels/fix_ksud.c.patchandroid14-6.1/KernelSU-Next/patches/wildkernels/fix_rules.c.patchandroid14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patchandroid14-6.1/KernelSU-Next/patches/wildkernels/fix_supercalls.c.patchandroid14-6.1/defconfig.fragment
| for P in \ | ||
| fix_Makefile.patch \ | ||
| fix_ksu_c.patch \ | ||
| fix_ksud_c.patch \ | ||
| fix_supercalls_c.patch \ | ||
| fix_sucompat_c.patch \ | ||
| fix_kernel_umount_c.patch \ | ||
| fix_rules_c.patch; do |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Use the actual WildKernels patch filenames here.
Lines 232-237 look for fix_ksu_c.patch, fix_ksud_c.patch, fix_supercalls_c.patch, etc., but this PR adds fix_ksu.c.patch, fix_ksud.c.patch, fix_supercalls.c.patch, fix_sucompat.c.patch, fix_kernel_umount.c.patch, and fix_rules.c.patch. As written, only fix_Makefile.patch will match; the rest are silently skipped, so CI never applies most of the SUSFS fixes.
Proposed fix
for P in \
fix_Makefile.patch \
- fix_ksu_c.patch \
- fix_ksud_c.patch \
- fix_supercalls_c.patch \
- fix_sucompat_c.patch \
- fix_kernel_umount_c.patch \
- fix_rules_c.patch; do
+ fix_ksu.c.patch \
+ fix_ksud.c.patch \
+ fix_supercalls.c.patch \
+ fix_sucompat.c.patch \
+ fix_kernel_umount.c.patch \
+ fix_rules.c.patch; do📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| for P in \ | |
| fix_Makefile.patch \ | |
| fix_ksu_c.patch \ | |
| fix_ksud_c.patch \ | |
| fix_supercalls_c.patch \ | |
| fix_sucompat_c.patch \ | |
| fix_kernel_umount_c.patch \ | |
| fix_rules_c.patch; do | |
| for P in \ | |
| fix_Makefile.patch \ | |
| fix_ksu.c.patch \ | |
| fix_ksud.c.patch \ | |
| fix_supercalls.c.patch \ | |
| fix_sucompat.c.patch \ | |
| fix_kernel_umount.c.patch \ | |
| fix_rules.c.patch; do |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-ksu-next.yml around lines 230 - 237, The
patch-application loop in the workflow is using outdated WildKernels filenames,
so most SUSFS fixes are skipped. Update the filename list in the build step that
iterates over P to match the actual added patch files (the ones with .c.patch in
their names) so the apply logic can find and process every patch, not just
fix_Makefile.patch.
| +config KSU_SUSFS_UID_GATED_HIDING | ||
| + bool "UID-gated hiding (v2.1.0+)" | ||
| + depends on KSU_SUSFS | ||
| + default y | ||
| + help | ||
| + Gates sus_path and sus_mount hiding behind a per-UID allowlist. | ||
| + Requires susfs v2.1.0 or newer kernel patches. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
CONFIG_KSU_SUSFS_UID_GATED_HIDING is a dead switch right now.
This symbol is added here and enabled in android14-6.1/defconfig.fragment, but none of the provided hide predicates actually check it. In the same patch, susfs_is_inode_sus_path() and the proc/mount hide paths still run unconditionally once the process is marked umounted, so toggling this option will not change runtime behavior.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch`
around lines 54 - 60, CONFIG_KSU_SUSFS_UID_GATED_HIDING is currently unused, so
make the hiding logic respect it. Update the relevant susfs hide predicates,
especially susfs_is_inode_sus_path() and the proc/mount hide paths, to check
this Kconfig symbol before applying UID-gated hiding behavior. If the option is
disabled, the existing sus_path/sus_mount hiding should be bypassed; if enabled,
preserve the current allowlist-based gating so the symbol actually changes
runtime behavior.
| +void ksu_handle_vfs_fstat(int fd, loff_t *kstat_size_ptr) { | ||
| + loff_t new_size = *kstat_size_ptr + ksu_rc_len; | ||
| + struct file *file = fget(fd); | ||
| + | ||
| + if (!file) | ||
| + return; | ||
| + | ||
| + if (is_init_rc(file)) { | ||
| + pr_info("stat init.rc"); | ||
| + pr_info("adding ksu_rc_len: %lld -> %lld", *kstat_size_ptr, new_size); | ||
| + *kstat_size_ptr = new_size; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Honor ksu_init_rc_hook in the fstat spoof path.
Line 69 disables the init.rc hook under SUSFS, but ksu_handle_vfs_fstat() still spoofs init.rc size unconditionally. Gate the handler on the same flag so stop_init_rc_hook() actually stops both read and stat behavior.
Proposed fix
void ksu_handle_vfs_fstat(int fd, loff_t *kstat_size_ptr) {
- loff_t new_size = *kstat_size_ptr + ksu_rc_len;
- struct file *file = fget(fd);
+ loff_t new_size;
+ struct file *file;
+
+ if (!ksu_init_rc_hook || !kstat_size_ptr)
+ return;
+
+ new_size = *kstat_size_ptr + ksu_rc_len;
+ file = fget(fd);
if (!file)
return;Also applies to: 63-70
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksud.c.patch` around
lines 47 - 57, The fstat spoofing path in ksu_handle_vfs_fstat still applies to
init.rc even when ksu_init_rc_hook is disabled, so the SUSFS stop path does not
fully take effect. Update ksu_handle_vfs_fstat to check the same
ksu_init_rc_hook flag used around the read hook before calling is_init_rc and
modifying the reported size, so stop_init_rc_hook disables both read and stat
spoofing consistently.
| + if (susfs_is_current_proc_umounted()) { | ||
| + ret = 0; // SYSCALL_TRACEPOINT is NOT flagged | ||
| + } else { | ||
| + ret = 1; // SYSCALL_TRACEPOINT is flagged | ||
| + } | ||
| + pr_info("manage_mark: ret for pid %d: %d\n", cmd.pid, ret); | ||
| + cmd.result = (u32)ret; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Do not return success for unsupported mark operations.
The SUSFS branch ignores cmd.pid for KSU_MARK_GET and returns the existing ret value for pid-specific mark/unmark requests, which is likely 0; callers can observe a successful no-op. Either preserve pid-based semantics or fail unsupported operations explicitly.
Safer failure behavior
`#else`
+ if (cmd.pid != task_pid_nr(current)) {
+ return -EOPNOTSUPP;
+ }
if (susfs_is_current_proc_umounted()) {
ret = 0; // SYSCALL_TRACEPOINT is NOT flagged
} else {
@@
`#else`
- if (cmd.pid != 0) {
- return ret;
- }
+ return -EOPNOTSUPP;
`#endif` // `#ifndef` CONFIG_KSU_SUSFS
@@
`#else`
- if (cmd.pid != 0) {
- return ret;
- }
+ return -EOPNOTSUPP;
`#endif` // `#ifndef` CONFIG_KSU_SUSFS
@@
`#else`
- pr_info("susfs: cmd: KSU_MARK_REFRESH: do nothing\n");
+ return -EOPNOTSUPP;
`#endif` // `#ifndef` CONFIG_KSU_SUSFSAlso applies to: 58-61, 75-86
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@android14-6.1/KernelSU-Next/patches/wildkernels/fix_supercalls.c.patch`
around lines 39 - 45, The KSU_MARK_GET handling in fix_supercalls.c is returning
success for the SUSFS path even when pid-specific mark/unmark semantics are
unsupported, so update the branch around manage_mark/cmd.result to either honor
cmd.pid consistently or explicitly return an error for unsupported operations
instead of leaving ret as a successful no-op. Make sure the logic in the
KSU_MARK_GET case and the susfs_is_current_proc_umounted() path cannot report
success unless the requested mark operation was actually applied, and adjust the
related pid-based branches so they fail safely rather than reusing a default
success value.
1 participant
Summary
This contribution adds a successful AnyKernel3 build configuration focused for the
android14-6.1kernel common base. The build includes an optimized feature set centering around KernelSU-Next and comprehensive SUSFS support upgraded from V2.0.0 to V2.1.0, targeting generic device profiles without any patch rejects.Android Target:** Android 14 (OS Patch Level: 2025-06)
Device Profile:** Generic
Rejects:** 0 (Clean merge/build), 1 (6.1.157)
Feature Toggles & State
The following core configurations have been successfully implemented and toggled
| Feature / Config | State | Description |
|
CONFIG_KSU/ KernelSU-Next | Enabled (y) | Next-generation kernel-based root solution. ||
CONFIG_KSU_SUSFS& Extensions | Enabled (y) |SUSFS V2.1.0 tracking, path masking, and kstat redirection. ||
CONFIG_ZEROMOUNT| Enabled (y) | Advanced mounting optimization. ||
ZRAM (LZ4K/LZ4KD)&LZ4 v1.10.0| Enabled (y) | Updated and enabled memory compression stack. ||
Overlayfs Support| Enabled (y) | Native filesystem overlay capability. ||
Unicode Filter| Enabled (y) | Character filter support enabled in KSU. ||
Baseband Guard| Enabled (y) | Baseband isolation security features. ||
KPM| Disabled (—) | Kernel Patch Module disabled per generic configuration (non-SukiSU build). |Summary by CodeRabbit
New Features
Bug Fixes