- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/3] CVE-2025-38501
by Yongjian Sun 03 Nov '25

03 Nov '25

Namjae Jeon (3): ksmbd: limit repeated connections from clients with the same IP ksmbd: extend the connection limiting mechanism to support IPv6 ksmbd: add max ip connections parameter fs/smb/server/connection.h | 6 +++++ fs/smb/server/ksmbd_netlink.h | 5 ++-- fs/smb/server/server.h | 1 + fs/smb/server/transport_ipc.c | 3 +++ fs/smb/server/transport_tcp.c | 43 +++++++++++++++++++++++++++++++++++ 5 files changed, 56 insertions(+), 2 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-1.0-LTS] wifi: ath9k: hif_usb: fix memory leak of remain_skbs
by Ziming Du 03 Nov '25

03 Nov '25

From: Fedor Pchelkin <pchelkin(a)ispras.ru> stable inclusion from stable-v4.19.283 commit 6719e3797ec52cd144c8a5ba8aaab36674800585 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VHF CVE: CVE-2023-53641 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7654cc03eb699297130b693ec34e25f77b17c947 ] hif_dev->remain_skb is allocated and used exclusively in ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is processed and subsequently freed (in error paths) only during the next call of ath9k_hif_usb_rx_stream(). So, if the urbs are deallocated between those two calls due to the device deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream() is not called next time and the allocated remain_skb is leaked. Our local Syzkaller instance was able to trigger that. remain_skb makes sense when receiving two consecutive urbs which are logically linked together, i.e. a specific data field from the first skb indicates a cached skb to be allocated, memcpy'd with some data and subsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs deallocation supposedly makes that link irrelevant so we need to free the cached skb in those cases. Fix the leak by introducing a function to explicitly free remain_skb (if it is not NULL) when the rx urbs have been deallocated. remain_skb is NULL when it has not been allocated at all (hif_dev struct is kzalloced) or when it has been processed in next call to ath9k_hif_usb_rx_stream(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Signed-off-by: Alexey Khoroshilov <khoroshilov(a)ispras.ru> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/20230216192301.171225-1-pchelkin@ispras.ru Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index 32672964e87e8..1688042f62362 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -525,6 +525,24 @@ static struct ath9k_htc_hif hif_usb = { .send = hif_usb_send, }; +/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream + * in case ath9k_hif_usb_rx_stream wasn't called next time to + * process the buffer and subsequently free it. + */ +static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev) +{ + unsigned long flags; + + spin_lock_irqsave(&hif_dev->rx_lock, flags); + if (hif_dev->remain_skb) { + dev_kfree_skb_any(hif_dev->remain_skb); + hif_dev->remain_skb = NULL; + hif_dev->rx_remain_len = 0; + RX_STAT_INC(hif_dev, skb_dropped); + } + spin_unlock_irqrestore(&hif_dev->rx_lock, flags); +} + static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, struct sk_buff *skb) { @@ -842,6 +860,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev) static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev) { usb_kill_anchored_urbs(&hif_dev->rx_submitted); + ath9k_hif_usb_free_rx_remain_skb(hif_dev); } static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) -- 2.43.0

2 1

[PATCH OLK-6.6] nbd: restrict sockets to TCP and UDP
by Zheng Qixing 03 Nov '25

03 Nov '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.112 commit 4f9e6ff6319dbcebea64b50af0304cf0ad7e97e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WIC CVE: CVE-2025-40080 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ] Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 ("nbd: verify socket is supported during setup") made sure the socket supported a shutdown() method. Explicitely accept TCP and UNIX stream sockets. Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup") Reported-by: syzbot+e1cd6bd8493060bd701d(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Mike Christie <mchristi(a)redhat.com> Cc: Richard W.M. Jones <rjones(a)redhat.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Yu Kuai <yukuai1(a)huaweicloud.com> Cc: linux-block(a)vger.kernel.org Cc: nbd(a)other.debian.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/block/nbd.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 7eeb4b6de6de..26e1cf7f666c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1128,6 +1128,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, if (!sock) return NULL; + if (!sk_is_tcp(sock->sk) && + !sk_is_stream_unix(sock->sk)) { + dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n"); + *err = -EINVAL; + sockfd_put(sock); + return NULL; + } + if (sock->ops->shutdown == sock_no_shutdown) { dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); *err = -EINVAL; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-53675
by Zheng Qixing 03 Nov '25

03 Nov '25

fix CVE-2023-53675 Tomas Henzl (1): scsi: ses: Fix possible desc_ptr out-of-bounds accesses Zheng Qixing (1): Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process" drivers/scsi/ses.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] *** CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

2 3

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-53675
by Zheng Qixing 03 Nov '25

03 Nov '25

fix CVE-2023-53675 Tomas Henzl (1): scsi: ses: Fix possible desc_ptr out-of-bounds accesses Zheng Qixing (1): Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process" drivers/scsi/ses.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
by Zheng Qixing 03 Nov '25

03 Nov '25

From: Konstantin Shelekhin <k.shelekhin(a)yadro.com> stable inclusion from stable-v4.19.295 commit 114b44dddea1f8f99576de3c0e6e9059012002fc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VIW CVE: CVE-2023-53676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit 801f287c93ff95582b0a2d2163f12870a2f076d4 ] The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a session without checking for the buffer length. With enough iSCSI connections it's possible to overflow the buffer provided by configfs and corrupt the memory. This patch replaces sprintf() with sysfs_emit_at() that checks for buffer boundries. Signed-off-by: Konstantin Shelekhin <k.shelekhin(a)yadro.com> Link: https://lore.kernel.org/r/20230722152657.168859-2-k.shelekhin@yadro.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/target/iscsi/iscsi_target_configfs.c | 54 ++++++++++---------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c index d25cadc4f4f1..ac071abae7e9 100644 --- a/drivers/target/iscsi/iscsi_target_configfs.c +++ b/drivers/target/iscsi/iscsi_target_configfs.c @@ -516,102 +516,102 @@ static ssize_t lio_target_nacl_info_show(struct config_item *item, char *page) spin_lock_bh(&se_nacl->nacl_sess_lock); se_sess = se_nacl->nacl_sess; if (!se_sess) { - rb += sprintf(page+rb, "No active iSCSI Session for Initiator" + rb += sysfs_emit_at(page, rb, "No active iSCSI Session for Initiator" " Endpoint: %s\n", se_nacl->initiatorname); } else { sess = se_sess->fabric_sess_ptr; - rb += sprintf(page+rb, "InitiatorName: %s\n", + rb += sysfs_emit_at(page, rb, "InitiatorName: %s\n", sess->sess_ops->InitiatorName); - rb += sprintf(page+rb, "InitiatorAlias: %s\n", + rb += sysfs_emit_at(page, rb, "InitiatorAlias: %s\n", sess->sess_ops->InitiatorAlias); - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "LIO Session ID: %u ISID: 0x%6ph TSIH: %hu ", sess->sid, sess->isid, sess->tsih); - rb += sprintf(page+rb, "SessionType: %s\n", + rb += sysfs_emit_at(page, rb, "SessionType: %s\n", (sess->sess_ops->SessionType) ? "Discovery" : "Normal"); - rb += sprintf(page+rb, "Session State: "); + rb += sysfs_emit_at(page, rb, "Session State: "); switch (sess->session_state) { case TARG_SESS_STATE_FREE: - rb += sprintf(page+rb, "TARG_SESS_FREE\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_FREE\n"); break; case TARG_SESS_STATE_ACTIVE: - rb += sprintf(page+rb, "TARG_SESS_STATE_ACTIVE\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_ACTIVE\n"); break; case TARG_SESS_STATE_LOGGED_IN: - rb += sprintf(page+rb, "TARG_SESS_STATE_LOGGED_IN\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_LOGGED_IN\n"); break; case TARG_SESS_STATE_FAILED: - rb += sprintf(page+rb, "TARG_SESS_STATE_FAILED\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_FAILED\n"); break; case TARG_SESS_STATE_IN_CONTINUE: - rb += sprintf(page+rb, "TARG_SESS_STATE_IN_CONTINUE\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_IN_CONTINUE\n"); break; default: - rb += sprintf(page+rb, "ERROR: Unknown Session" + rb += sysfs_emit_at(page, rb, "ERROR: Unknown Session" " State!\n"); break; } - rb += sprintf(page+rb, "---------------------[iSCSI Session" + rb += sysfs_emit_at(page, rb, "---------------------[iSCSI Session" " Values]-----------------------\n"); - rb += sprintf(page+rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN" + rb += sysfs_emit_at(page, rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN" " : MaxCmdSN : ITT : TTT\n"); max_cmd_sn = (u32) atomic_read(&sess->max_cmd_sn); - rb += sprintf(page+rb, " 0x%08x 0x%08x 0x%08x 0x%08x" + rb += sysfs_emit_at(page, rb, " 0x%08x 0x%08x 0x%08x 0x%08x" " 0x%08x 0x%08x\n", sess->cmdsn_window, (max_cmd_sn - sess->exp_cmd_sn) + 1, sess->exp_cmd_sn, max_cmd_sn, sess->init_task_tag, sess->targ_xfer_tag); - rb += sprintf(page+rb, "----------------------[iSCSI" + rb += sysfs_emit_at(page, rb, "----------------------[iSCSI" " Connections]-------------------------\n"); spin_lock(&sess->conn_lock); list_for_each_entry(conn, &sess->sess_conn_list, conn_list) { - rb += sprintf(page+rb, "CID: %hu Connection" + rb += sysfs_emit_at(page, rb, "CID: %hu Connection" " State: ", conn->cid); switch (conn->conn_state) { case TARG_CONN_STATE_FREE: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_FREE\n"); break; case TARG_CONN_STATE_XPT_UP: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_XPT_UP\n"); break; case TARG_CONN_STATE_IN_LOGIN: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_IN_LOGIN\n"); break; case TARG_CONN_STATE_LOGGED_IN: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_LOGGED_IN\n"); break; case TARG_CONN_STATE_IN_LOGOUT: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_IN_LOGOUT\n"); break; case TARG_CONN_STATE_LOGOUT_REQUESTED: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_LOGOUT_REQUESTED\n"); break; case TARG_CONN_STATE_CLEANUP_WAIT: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_CLEANUP_WAIT\n"); break; default: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "ERROR: Unknown Connection State!\n"); break; } - rb += sprintf(page+rb, " Address %pISc %s", &conn->login_sockaddr, + rb += sysfs_emit_at(page, rb, " Address %pISc %s", &conn->login_sockaddr, (conn->network_transport == ISCSI_TCP) ? "TCP" : "SCTP"); - rb += sprintf(page+rb, " StatSN: 0x%08x\n", + rb += sysfs_emit_at(page, rb, " StatSN: 0x%08x\n", conn->stat_sn); } spin_unlock(&sess->conn_lock); -- 2.39.2

2 1

[openeuler:OLK-6.6 3098/3098] include/linux/iommu.h:2001:12: warning: declaration of 'struct iommu_plb_gather' will not be visible outside of this function
by kernel test robot 03 Nov '25

03 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: d46a4bd5bdfd7f1d6e2fa159398df4c54345070c [3098/3098] iommu/ummu-core: introduce iommu sva permission operation config: loongarch-allnoconfig (https://download.01.org/0day-ci/archive/20251103/202511031912.GYyUucHm-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project d2625a438020ad35330cda29c3def102c1687b1b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251103/202511031912.GYyUucHm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511031912.GYyUucHm-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/fork.c:101: >> include/linux/iommu.h:2001:12: warning: declaration of 'struct iommu_plb_gather' will not be visible outside of this function [-Wvisibility] 2001 | struct iommu_plb_gather *plb_gather) {} | ^ 1 warning generated. vim +2001 include/linux/iommu.h 1993 1994 static inline int iommu_sva_ungrant(struct iommu_sva *sva, void *va, 1995 size_t size, void *cookie) 1996 { 1997 return -EOPNOTSUPP; 1998 } 1999 static inline void iommu_plb_sync_all(struct iommu_domain *domain) {} 2000 static inline void iommu_plb_sync(struct iommu_domain *domain, > 2001 struct iommu_plb_gather *plb_gather) {} -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3075/3075] drivers/ub/ubus/resource.c:98:5: warning: no previous prototype for function 'ub_assign_resource'
by kernel test robot 03 Nov '25

03 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: f94773e30426af02371bc80aa047d1144f7b4291 [3075/3075] ub:ubus: Add UBUS resource space basic functions config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251103/202511031846.WZN8QTuN-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251103/202511031846.WZN8QTuN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511031846.WZN8QTuN-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/ubus/resource.c:98:5: warning: no previous prototype for function 'ub_assign_resource' [-Wmissing-prototypes] 98 | int ub_assign_resource(struct ub_entity *uent, int idx) | ^ drivers/ub/ubus/resource.c:98:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 98 | int ub_assign_resource(struct ub_entity *uent, int idx) | ^ | static >> drivers/ub/ubus/resource.c:124:6: warning: no previous prototype for function 'ub_release_resource' [-Wmissing-prototypes] 124 | void ub_release_resource(struct ub_entity *uent, int idx) | ^ drivers/ub/ubus/resource.c:124:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 124 | void ub_release_resource(struct ub_entity *uent, int idx) | ^ | static >> drivers/ub/ubus/resource.c:293:5: warning: no previous prototype for function 'ub_entity_alloc_mmio_idx' [-Wmissing-prototypes] 293 | int ub_entity_alloc_mmio_idx(struct ub_entity *dev, int idx) | ^ drivers/ub/ubus/resource.c:293:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 293 | int ub_entity_alloc_mmio_idx(struct ub_entity *dev, int idx) | ^ | static 3 warnings generated. vim +/ub_assign_resource +98 drivers/ub/ubus/resource.c 97 > 98 int ub_assign_resource(struct ub_entity *uent, int idx) 99 { 100 struct resource *res = &uent->zone[idx].res; 101 resource_size_t size; 102 resource_size_t page_size = PAGE_SIZE; 103 /* decoder mapped address unit 1M */ 104 resource_size_t align = page_size > SZ_1M ? page_size : SZ_1M; 105 int ret; 106 107 res->name = ub_name(uent); 108 res->flags |= IORESOURCE_UNSET | IORESOURCE_SIZEALIGN; 109 size = uent->zone[idx].region.size; 110 ret = _ub_assign_resource(uent, idx, size, align); 111 if (ret < 0) { 112 ub_err(uent, "RESOURCE %d: failed to assign, size=%#llx\n", 113 idx, size); 114 return ret; 115 } 116 117 res->flags &= ~IORESOURCE_UNSET; 118 res->flags &= ~IORESOURCE_STARTALIGN; 119 ub_info(uent, "RESOURCE %d: assigned %pR\n", idx, res); 120 121 return 0; 122 } 123 > 124 void ub_release_resource(struct ub_entity *uent, int idx) 125 { 126 int ret; 127 128 if (uent->zone[idx].res.parent) { 129 ret = release_resource(&uent->zone[idx].res); 130 if (ret) 131 ub_err(uent, "resource release failed, ret=%d.\n", ret); 132 } 133 } 134 135 static void __iomem *ub_iomap_range(struct ub_entity *uent, int res_id, 136 unsigned long offset, unsigned long maxlen, 137 bool is_wc) 138 { 139 resource_size_t start = ub_resource_start(uent, res_id); 140 resource_size_t len = ub_resource_len(uent, res_id); 141 unsigned long flags = ub_resource_flags(uent, res_id); 142 143 if (len <= offset || !start) 144 return NULL; 145 len -= offset; 146 start += offset; 147 if (maxlen && len > maxlen) 148 len = maxlen; 149 if (!(flags & IORESOURCE_MEM)) 150 return NULL; 151 152 if (is_wc) 153 return ioremap_wc(start, len); 154 else 155 return ioremap(start, len); 156 } 157 158 void __iomem *ub_iomap(struct ub_entity *uent, int res_id, unsigned long maxlen) 159 { 160 if (res_id >= MAX_UB_RES_NUM || !uent) 161 return NULL; 162 163 return ub_iomap_range(uent, res_id, 0, maxlen, false); 164 } 165 EXPORT_SYMBOL_GPL(ub_iomap); 166 167 void __iomem *ub_iomap_wc(struct ub_entity *uent, int res_id, unsigned long maxlen) 168 { 169 if (res_id >= MAX_UB_RES_NUM || !uent) 170 return NULL; 171 172 return ub_iomap_range(uent, res_id, 0, maxlen, true); 173 } 174 EXPORT_SYMBOL_GPL(ub_iomap_wc); 175 176 void ub_iounmap(void __iomem *addr) 177 { 178 iounmap(addr); 179 } 180 EXPORT_SYMBOL_GPL(ub_iounmap); 181 182 static int ub_read_ubba_reg(struct ub_entity *uent, size_t pg_size, int idx) 183 { 184 u32 addr_l_reg[MAX_UB_RES_NUM] = { UB_ERS0_UBBA_L, UB_ERS1_UBBA_L, 185 UB_ERS2_UBBA_L }; 186 u32 addr_h_reg[MAX_UB_RES_NUM] = { UB_ERS0_UBBA_H, UB_ERS1_UBBA_H, 187 UB_ERS2_UBBA_H }; 188 u32 ss_reg[MAX_UB_RES_NUM] = { UB_ERS0_SS, UB_ERS1_SS, UB_ERS2_SS }; 189 u32 hpa_l = 0, hpa_h = 0, size = 0; 190 int ret; 191 192 ret = ub_cfg_read_dword(uent, addr_l_reg[idx], &hpa_l); 193 ret |= ub_cfg_read_dword(uent, addr_h_reg[idx], &hpa_h); 194 ret |= ub_cfg_read_dword(uent, ss_reg[idx], &size); 195 if (ret) { 196 ub_err(uent, "read reg failed when request HPA resource\n"); 197 return -EINVAL; 198 } else if (size == 0) { 199 ub_err(uent, "size is 0 when request HPA resource\n"); 200 return -EINVAL; 201 } 202 203 uent->zone[idx].res.start = ubba_gen(hpa_h, hpa_l); 204 uent->zone[idx].res.end = 205 uent->zone[idx].res.start + ((u64)size * pg_size - 1); 206 207 uent->zone[idx].res.flags = IORESOURCE_MEM; 208 uent->zone[idx].res.name = ub_name(uent); 209 uent->zone[idx].ubba_used = 1; 210 211 ub_info(uent, "mmio idx %d, %pR\n", idx, &uent->zone[idx].res); 212 return 0; 213 } 214 215 static int ub_read_sa_reg(struct ub_entity *uent, size_t pg_size, int idx) 216 { 217 u32 sa_l_reg[MAX_UB_RES_NUM] = { UB_ERS0_SA_L, UB_ERS1_SA_L, 218 UB_ERS2_SA_L }; 219 u32 sa_h_reg[MAX_UB_RES_NUM] = { UB_ERS0_SA_H, UB_ERS1_SA_H, 220 UB_ERS2_SA_H }; 221 u32 ss_reg[MAX_UB_RES_NUM] = { UB_ERS0_SS, UB_ERS1_SS, UB_ERS2_SS }; 222 u32 sa_l = 0, sa_h = 0, size = 0; 223 int ret; 224 225 ret = ub_cfg_read_dword(uent, sa_l_reg[idx], &sa_l); 226 ret |= ub_cfg_read_dword(uent, sa_h_reg[idx], &sa_h); 227 ret |= ub_cfg_read_dword(uent, ss_reg[idx], &size); 228 if (ret) { 229 ub_err(uent, "read reg failed when request SA resource\n"); 230 return -EINVAL; 231 } else if (size == 0) { 232 ub_err(uent, "size is 0 when request SA resource\n"); 233 return -EINVAL; 234 } 235 236 /* Shift left 32 bits to get upper-bit address */ 237 uent->zone[idx].region.start = ((u64)sa_h << 32) | sa_l; 238 uent->zone[idx].region.size = size * pg_size; 239 uent->zone[idx].res.flags = IORESOURCE_MEM; 240 uent->zone[idx].sa_used = 1; 241 242 return 0; 243 } 244 245 static int ub_entity_read_mmio_idx(struct ub_entity *uent, int idx) 246 { 247 struct ub_entity *pue; 248 size_t pg_size = 0; 249 250 /* ue to its mue, mue to Entity0, Entity0 use itself */ 251 pue = uent->pue; 252 if (pue->entity_idx) /* to ensure Entity0 uent */ 253 pue = pue->pue; 254 255 (void)ub_cfg_read_byte(uent, UB_SYS_PGS, (u8 *)&pg_size); 256 if ((u8)pg_size & UB_SYS_PGS_SIZE) 257 pg_size = SZ_64K; 258 else 259 pg_size = SZ_4K; 260 261 if (pue->zone[idx].ubba_used) 262 return ub_read_ubba_reg(uent, pg_size, idx); 263 264 if (pue->zone[idx].sa_used) 265 return ub_read_sa_reg(uent, pg_size, idx); 266 267 return -EPERM; 268 } 269 270 int ub_insert_resource(struct ub_entity *dev, int idx) 271 { 272 struct resource *res, *root = NULL; 273 int ret; 274 275 if (idx >= MAX_UB_RES_NUM) 276 return -EINVAL; 277 278 res = &dev->zone[idx].res; 279 if (!(res->flags & IORESOURCE_MEM)) 280 return -EINVAL; 281 282 root = &iomem_resource; 283 284 ret = insert_resource(root, res); 285 if (ret) { 286 ub_warn(dev, "failed to claim uent resource %pR\n", res); 287 return -ENOMEM; 288 } 289 290 return 0; 291 } 292 > 293 int ub_entity_alloc_mmio_idx(struct ub_entity *dev, int idx) 294 { 295 if (is_ibus_controller(dev) || is_idev(dev)) 296 return ub_insert_resource(dev, idx); 297 return ub_assign_resource(dev, idx); 298 } 299 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openEuler-1.0-LTS 0/2] *** Fix CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** Fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

1 2