- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-53675
by Zheng Qixing 03 Nov '25

03 Nov '25

fix CVE-2023-53675 Tomas Henzl (1): scsi: ses: Fix possible desc_ptr out-of-bounds accesses Zheng Qixing (1): Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process" drivers/scsi/ses.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
by Zheng Qixing 03 Nov '25

03 Nov '25

From: Konstantin Shelekhin <k.shelekhin(a)yadro.com> stable inclusion from stable-v4.19.295 commit 114b44dddea1f8f99576de3c0e6e9059012002fc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VIW CVE: CVE-2023-53676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit 801f287c93ff95582b0a2d2163f12870a2f076d4 ] The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a session without checking for the buffer length. With enough iSCSI connections it's possible to overflow the buffer provided by configfs and corrupt the memory. This patch replaces sprintf() with sysfs_emit_at() that checks for buffer boundries. Signed-off-by: Konstantin Shelekhin <k.shelekhin(a)yadro.com> Link: https://lore.kernel.org/r/20230722152657.168859-2-k.shelekhin@yadro.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/target/iscsi/iscsi_target_configfs.c | 54 ++++++++++---------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c index d25cadc4f4f1..ac071abae7e9 100644 --- a/drivers/target/iscsi/iscsi_target_configfs.c +++ b/drivers/target/iscsi/iscsi_target_configfs.c @@ -516,102 +516,102 @@ static ssize_t lio_target_nacl_info_show(struct config_item *item, char *page) spin_lock_bh(&se_nacl->nacl_sess_lock); se_sess = se_nacl->nacl_sess; if (!se_sess) { - rb += sprintf(page+rb, "No active iSCSI Session for Initiator" + rb += sysfs_emit_at(page, rb, "No active iSCSI Session for Initiator" " Endpoint: %s\n", se_nacl->initiatorname); } else { sess = se_sess->fabric_sess_ptr; - rb += sprintf(page+rb, "InitiatorName: %s\n", + rb += sysfs_emit_at(page, rb, "InitiatorName: %s\n", sess->sess_ops->InitiatorName); - rb += sprintf(page+rb, "InitiatorAlias: %s\n", + rb += sysfs_emit_at(page, rb, "InitiatorAlias: %s\n", sess->sess_ops->InitiatorAlias); - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "LIO Session ID: %u ISID: 0x%6ph TSIH: %hu ", sess->sid, sess->isid, sess->tsih); - rb += sprintf(page+rb, "SessionType: %s\n", + rb += sysfs_emit_at(page, rb, "SessionType: %s\n", (sess->sess_ops->SessionType) ? "Discovery" : "Normal"); - rb += sprintf(page+rb, "Session State: "); + rb += sysfs_emit_at(page, rb, "Session State: "); switch (sess->session_state) { case TARG_SESS_STATE_FREE: - rb += sprintf(page+rb, "TARG_SESS_FREE\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_FREE\n"); break; case TARG_SESS_STATE_ACTIVE: - rb += sprintf(page+rb, "TARG_SESS_STATE_ACTIVE\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_ACTIVE\n"); break; case TARG_SESS_STATE_LOGGED_IN: - rb += sprintf(page+rb, "TARG_SESS_STATE_LOGGED_IN\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_LOGGED_IN\n"); break; case TARG_SESS_STATE_FAILED: - rb += sprintf(page+rb, "TARG_SESS_STATE_FAILED\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_FAILED\n"); break; case TARG_SESS_STATE_IN_CONTINUE: - rb += sprintf(page+rb, "TARG_SESS_STATE_IN_CONTINUE\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_IN_CONTINUE\n"); break; default: - rb += sprintf(page+rb, "ERROR: Unknown Session" + rb += sysfs_emit_at(page, rb, "ERROR: Unknown Session" " State!\n"); break; } - rb += sprintf(page+rb, "---------------------[iSCSI Session" + rb += sysfs_emit_at(page, rb, "---------------------[iSCSI Session" " Values]-----------------------\n"); - rb += sprintf(page+rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN" + rb += sysfs_emit_at(page, rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN" " : MaxCmdSN : ITT : TTT\n"); max_cmd_sn = (u32) atomic_read(&sess->max_cmd_sn); - rb += sprintf(page+rb, " 0x%08x 0x%08x 0x%08x 0x%08x" + rb += sysfs_emit_at(page, rb, " 0x%08x 0x%08x 0x%08x 0x%08x" " 0x%08x 0x%08x\n", sess->cmdsn_window, (max_cmd_sn - sess->exp_cmd_sn) + 1, sess->exp_cmd_sn, max_cmd_sn, sess->init_task_tag, sess->targ_xfer_tag); - rb += sprintf(page+rb, "----------------------[iSCSI" + rb += sysfs_emit_at(page, rb, "----------------------[iSCSI" " Connections]-------------------------\n"); spin_lock(&sess->conn_lock); list_for_each_entry(conn, &sess->sess_conn_list, conn_list) { - rb += sprintf(page+rb, "CID: %hu Connection" + rb += sysfs_emit_at(page, rb, "CID: %hu Connection" " State: ", conn->cid); switch (conn->conn_state) { case TARG_CONN_STATE_FREE: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_FREE\n"); break; case TARG_CONN_STATE_XPT_UP: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_XPT_UP\n"); break; case TARG_CONN_STATE_IN_LOGIN: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_IN_LOGIN\n"); break; case TARG_CONN_STATE_LOGGED_IN: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_LOGGED_IN\n"); break; case TARG_CONN_STATE_IN_LOGOUT: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_IN_LOGOUT\n"); break; case TARG_CONN_STATE_LOGOUT_REQUESTED: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_LOGOUT_REQUESTED\n"); break; case TARG_CONN_STATE_CLEANUP_WAIT: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_CLEANUP_WAIT\n"); break; default: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "ERROR: Unknown Connection State!\n"); break; } - rb += sprintf(page+rb, " Address %pISc %s", &conn->login_sockaddr, + rb += sysfs_emit_at(page, rb, " Address %pISc %s", &conn->login_sockaddr, (conn->network_transport == ISCSI_TCP) ? "TCP" : "SCTP"); - rb += sprintf(page+rb, " StatSN: 0x%08x\n", + rb += sysfs_emit_at(page, rb, " StatSN: 0x%08x\n", conn->stat_sn); } spin_unlock(&sess->conn_lock); -- 2.39.2

2 1

[openeuler:OLK-6.6 3098/3098] include/linux/iommu.h:2001:12: warning: declaration of 'struct iommu_plb_gather' will not be visible outside of this function
by kernel test robot 03 Nov '25

03 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: d46a4bd5bdfd7f1d6e2fa159398df4c54345070c [3098/3098] iommu/ummu-core: introduce iommu sva permission operation config: loongarch-allnoconfig (https://download.01.org/0day-ci/archive/20251103/202511031912.GYyUucHm-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project d2625a438020ad35330cda29c3def102c1687b1b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251103/202511031912.GYyUucHm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511031912.GYyUucHm-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/fork.c:101: >> include/linux/iommu.h:2001:12: warning: declaration of 'struct iommu_plb_gather' will not be visible outside of this function [-Wvisibility] 2001 | struct iommu_plb_gather *plb_gather) {} | ^ 1 warning generated. vim +2001 include/linux/iommu.h 1993 1994 static inline int iommu_sva_ungrant(struct iommu_sva *sva, void *va, 1995 size_t size, void *cookie) 1996 { 1997 return -EOPNOTSUPP; 1998 } 1999 static inline void iommu_plb_sync_all(struct iommu_domain *domain) {} 2000 static inline void iommu_plb_sync(struct iommu_domain *domain, > 2001 struct iommu_plb_gather *plb_gather) {} -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3075/3075] drivers/ub/ubus/resource.c:98:5: warning: no previous prototype for function 'ub_assign_resource'
by kernel test robot 03 Nov '25

03 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: f94773e30426af02371bc80aa047d1144f7b4291 [3075/3075] ub:ubus: Add UBUS resource space basic functions config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251103/202511031846.WZN8QTuN-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251103/202511031846.WZN8QTuN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511031846.WZN8QTuN-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/ubus/resource.c:98:5: warning: no previous prototype for function 'ub_assign_resource' [-Wmissing-prototypes] 98 | int ub_assign_resource(struct ub_entity *uent, int idx) | ^ drivers/ub/ubus/resource.c:98:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 98 | int ub_assign_resource(struct ub_entity *uent, int idx) | ^ | static >> drivers/ub/ubus/resource.c:124:6: warning: no previous prototype for function 'ub_release_resource' [-Wmissing-prototypes] 124 | void ub_release_resource(struct ub_entity *uent, int idx) | ^ drivers/ub/ubus/resource.c:124:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 124 | void ub_release_resource(struct ub_entity *uent, int idx) | ^ | static >> drivers/ub/ubus/resource.c:293:5: warning: no previous prototype for function 'ub_entity_alloc_mmio_idx' [-Wmissing-prototypes] 293 | int ub_entity_alloc_mmio_idx(struct ub_entity *dev, int idx) | ^ drivers/ub/ubus/resource.c:293:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 293 | int ub_entity_alloc_mmio_idx(struct ub_entity *dev, int idx) | ^ | static 3 warnings generated. vim +/ub_assign_resource +98 drivers/ub/ubus/resource.c 97 > 98 int ub_assign_resource(struct ub_entity *uent, int idx) 99 { 100 struct resource *res = &uent->zone[idx].res; 101 resource_size_t size; 102 resource_size_t page_size = PAGE_SIZE; 103 /* decoder mapped address unit 1M */ 104 resource_size_t align = page_size > SZ_1M ? page_size : SZ_1M; 105 int ret; 106 107 res->name = ub_name(uent); 108 res->flags |= IORESOURCE_UNSET | IORESOURCE_SIZEALIGN; 109 size = uent->zone[idx].region.size; 110 ret = _ub_assign_resource(uent, idx, size, align); 111 if (ret < 0) { 112 ub_err(uent, "RESOURCE %d: failed to assign, size=%#llx\n", 113 idx, size); 114 return ret; 115 } 116 117 res->flags &= ~IORESOURCE_UNSET; 118 res->flags &= ~IORESOURCE_STARTALIGN; 119 ub_info(uent, "RESOURCE %d: assigned %pR\n", idx, res); 120 121 return 0; 122 } 123 > 124 void ub_release_resource(struct ub_entity *uent, int idx) 125 { 126 int ret; 127 128 if (uent->zone[idx].res.parent) { 129 ret = release_resource(&uent->zone[idx].res); 130 if (ret) 131 ub_err(uent, "resource release failed, ret=%d.\n", ret); 132 } 133 } 134 135 static void __iomem *ub_iomap_range(struct ub_entity *uent, int res_id, 136 unsigned long offset, unsigned long maxlen, 137 bool is_wc) 138 { 139 resource_size_t start = ub_resource_start(uent, res_id); 140 resource_size_t len = ub_resource_len(uent, res_id); 141 unsigned long flags = ub_resource_flags(uent, res_id); 142 143 if (len <= offset || !start) 144 return NULL; 145 len -= offset; 146 start += offset; 147 if (maxlen && len > maxlen) 148 len = maxlen; 149 if (!(flags & IORESOURCE_MEM)) 150 return NULL; 151 152 if (is_wc) 153 return ioremap_wc(start, len); 154 else 155 return ioremap(start, len); 156 } 157 158 void __iomem *ub_iomap(struct ub_entity *uent, int res_id, unsigned long maxlen) 159 { 160 if (res_id >= MAX_UB_RES_NUM || !uent) 161 return NULL; 162 163 return ub_iomap_range(uent, res_id, 0, maxlen, false); 164 } 165 EXPORT_SYMBOL_GPL(ub_iomap); 166 167 void __iomem *ub_iomap_wc(struct ub_entity *uent, int res_id, unsigned long maxlen) 168 { 169 if (res_id >= MAX_UB_RES_NUM || !uent) 170 return NULL; 171 172 return ub_iomap_range(uent, res_id, 0, maxlen, true); 173 } 174 EXPORT_SYMBOL_GPL(ub_iomap_wc); 175 176 void ub_iounmap(void __iomem *addr) 177 { 178 iounmap(addr); 179 } 180 EXPORT_SYMBOL_GPL(ub_iounmap); 181 182 static int ub_read_ubba_reg(struct ub_entity *uent, size_t pg_size, int idx) 183 { 184 u32 addr_l_reg[MAX_UB_RES_NUM] = { UB_ERS0_UBBA_L, UB_ERS1_UBBA_L, 185 UB_ERS2_UBBA_L }; 186 u32 addr_h_reg[MAX_UB_RES_NUM] = { UB_ERS0_UBBA_H, UB_ERS1_UBBA_H, 187 UB_ERS2_UBBA_H }; 188 u32 ss_reg[MAX_UB_RES_NUM] = { UB_ERS0_SS, UB_ERS1_SS, UB_ERS2_SS }; 189 u32 hpa_l = 0, hpa_h = 0, size = 0; 190 int ret; 191 192 ret = ub_cfg_read_dword(uent, addr_l_reg[idx], &hpa_l); 193 ret |= ub_cfg_read_dword(uent, addr_h_reg[idx], &hpa_h); 194 ret |= ub_cfg_read_dword(uent, ss_reg[idx], &size); 195 if (ret) { 196 ub_err(uent, "read reg failed when request HPA resource\n"); 197 return -EINVAL; 198 } else if (size == 0) { 199 ub_err(uent, "size is 0 when request HPA resource\n"); 200 return -EINVAL; 201 } 202 203 uent->zone[idx].res.start = ubba_gen(hpa_h, hpa_l); 204 uent->zone[idx].res.end = 205 uent->zone[idx].res.start + ((u64)size * pg_size - 1); 206 207 uent->zone[idx].res.flags = IORESOURCE_MEM; 208 uent->zone[idx].res.name = ub_name(uent); 209 uent->zone[idx].ubba_used = 1; 210 211 ub_info(uent, "mmio idx %d, %pR\n", idx, &uent->zone[idx].res); 212 return 0; 213 } 214 215 static int ub_read_sa_reg(struct ub_entity *uent, size_t pg_size, int idx) 216 { 217 u32 sa_l_reg[MAX_UB_RES_NUM] = { UB_ERS0_SA_L, UB_ERS1_SA_L, 218 UB_ERS2_SA_L }; 219 u32 sa_h_reg[MAX_UB_RES_NUM] = { UB_ERS0_SA_H, UB_ERS1_SA_H, 220 UB_ERS2_SA_H }; 221 u32 ss_reg[MAX_UB_RES_NUM] = { UB_ERS0_SS, UB_ERS1_SS, UB_ERS2_SS }; 222 u32 sa_l = 0, sa_h = 0, size = 0; 223 int ret; 224 225 ret = ub_cfg_read_dword(uent, sa_l_reg[idx], &sa_l); 226 ret |= ub_cfg_read_dword(uent, sa_h_reg[idx], &sa_h); 227 ret |= ub_cfg_read_dword(uent, ss_reg[idx], &size); 228 if (ret) { 229 ub_err(uent, "read reg failed when request SA resource\n"); 230 return -EINVAL; 231 } else if (size == 0) { 232 ub_err(uent, "size is 0 when request SA resource\n"); 233 return -EINVAL; 234 } 235 236 /* Shift left 32 bits to get upper-bit address */ 237 uent->zone[idx].region.start = ((u64)sa_h << 32) | sa_l; 238 uent->zone[idx].region.size = size * pg_size; 239 uent->zone[idx].res.flags = IORESOURCE_MEM; 240 uent->zone[idx].sa_used = 1; 241 242 return 0; 243 } 244 245 static int ub_entity_read_mmio_idx(struct ub_entity *uent, int idx) 246 { 247 struct ub_entity *pue; 248 size_t pg_size = 0; 249 250 /* ue to its mue, mue to Entity0, Entity0 use itself */ 251 pue = uent->pue; 252 if (pue->entity_idx) /* to ensure Entity0 uent */ 253 pue = pue->pue; 254 255 (void)ub_cfg_read_byte(uent, UB_SYS_PGS, (u8 *)&pg_size); 256 if ((u8)pg_size & UB_SYS_PGS_SIZE) 257 pg_size = SZ_64K; 258 else 259 pg_size = SZ_4K; 260 261 if (pue->zone[idx].ubba_used) 262 return ub_read_ubba_reg(uent, pg_size, idx); 263 264 if (pue->zone[idx].sa_used) 265 return ub_read_sa_reg(uent, pg_size, idx); 266 267 return -EPERM; 268 } 269 270 int ub_insert_resource(struct ub_entity *dev, int idx) 271 { 272 struct resource *res, *root = NULL; 273 int ret; 274 275 if (idx >= MAX_UB_RES_NUM) 276 return -EINVAL; 277 278 res = &dev->zone[idx].res; 279 if (!(res->flags & IORESOURCE_MEM)) 280 return -EINVAL; 281 282 root = &iomem_resource; 283 284 ret = insert_resource(root, res); 285 if (ret) { 286 ub_warn(dev, "failed to claim uent resource %pR\n", res); 287 return -ENOMEM; 288 } 289 290 return 0; 291 } 292 > 293 int ub_entity_alloc_mmio_idx(struct ub_entity *dev, int idx) 294 { 295 if (is_ibus_controller(dev) || is_idev(dev)) 296 return ub_insert_resource(dev, idx); 297 return ub_assign_resource(dev, idx); 298 } 299 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openEuler-1.0-LTS 0/2] *** Fix CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** Fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

1 2

[PATCH OLK-6.6 0/2] CVE-2025-38501
by Yongjian Sun 03 Nov '25

03 Nov '25

Namjae Jeon (2): ksmbd: limit repeated connections from clients with the same IP ksmbd: extend the connection limiting mechanism to support IPv6 fs/smb/server/connection.h | 6 ++++++ fs/smb/server/transport_tcp.c | 37 +++++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+) -- 2.39.2

2 3

[openEuler-1.0-LTS 0/2] *** Fix CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** Fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

1 2

[PATCH openEuler-1.0-LTS] wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
by Jiacheng Yu 03 Nov '25

03 Nov '25

From: Hector Martin <marcan(a)marcan.st> stable inclusion from stable-v4.19.284 commit 2bc34facb90ceeff6f8c17d2006575a6d07c3825 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID33EM CVE: CVE-2023-53715 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 89b89e52153fda2733562776c7c9d9d3ebf8dd6d ] Apparently the hex passphrase mechanism does not work on newer chips/firmware (e.g. BCM4387). It seems there was a simple way of passing it in binary all along, so use that and avoid the hexification. OpenBSD has been doing it like this from the beginning, so this should work on all chips. Also clear the structure before setting the PMK. This was leaking uninitialized stack contents to the device. Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Reviewed-by: Arend van Spriel <arend.vanspriel(a)broadcom.com> Signed-off-by: Hector Martin <marcan(a)marcan.st> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20230214092423.15175-6-marcan@marcan.st Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index e6ff4c64738e..454312ef960a 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -1240,13 +1240,14 @@ static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e) static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len) { struct brcmf_wsec_pmk_le pmk; - int i, err; + int err; + + memset(&pmk, 0, sizeof(pmk)); - /* convert to firmware key format */ - pmk.key_len = cpu_to_le16(pmk_len << 1); - pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE); - for (i = 0; i < pmk_len; i++) - snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]); + /* pass pmk directly */ + pmk.key_len = cpu_to_le16(pmk_len); + pmk.flags = cpu_to_le16(0); + memcpy(pmk.key, pmk_data, pmk_len); /* store psk in firmware */ err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK, -- 2.43.0

2 1

[openEuler-1.0-LTS 0/2] *** Fix CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** Fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

1 2

[PATCH OLK-5.10 0/5] mainline patch backport
by Xinyu Zheng 03 Nov '25

03 Nov '25

Daniel Tang (1): ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT Huisong Li (1): ACPI: processor: idle: Fix memory leak when register cpuidle device failed Rafael J. Wysocki (1): PM: sleep: core: Clear power.must_resume in noirq suspend error path Sean Christopherson (2): x86/umip: Check that the instruction opcode is at least two bytes x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) arch/x86/kernel/umip.c | 15 +++++++++++++-- drivers/acpi/acpi_tad.c | 3 +++ drivers/acpi/processor_idle.c | 3 +++ drivers/base/power/main.c | 14 +++++++++++++- 4 files changed, 32 insertions(+), 3 deletions(-) -- 2.34.1

2 6