- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] net: dlink: handle copy_thresh allocation failure
by Ziming Du 24 Nov '25

24 Nov '25

From: Yeounsu Moon <yyyynoom(a)gmail.com> stable inclusion from stable-v6.6.112 commit ea87151df398d407a632c7bf63013290f01c5009 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WGB CVE: CVE-2025-40053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ] The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a NULL pointer dereference. This patch tries to allocate `skb`. If the allocation fails, it falls back to the normal path. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Jakub Kicinski <kuba(a)kernel.org> Tested-on: D-Link DGE-550T Rev-A3 Signed-off-by: Yeounsu Moon <yyyynoom(a)gmail.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c index db6615aa921b1..8fa9f7bf20abc 100644 --- a/drivers/net/ethernet/dlink/dl2k.c +++ b/drivers/net/ethernet/dlink/dl2k.c @@ -947,15 +947,18 @@ receive_packet (struct net_device *dev) } else { struct sk_buff *skb; + skb = NULL; /* Small skbuffs for short packets */ - if (pkt_len > copy_thresh) { + if (pkt_len <= copy_thresh) + skb = netdev_alloc_skb_ip_align(dev, pkt_len); + if (!skb) { dma_unmap_single(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz, DMA_FROM_DEVICE); skb_put (skb = np->rx_skbuff[entry], pkt_len); np->rx_skbuff[entry] = NULL; - } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { + } else { dma_sync_single_for_cpu(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz, -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2025-40202
by Yi Yang 24 Nov '25

24 Nov '25

CVE fix patch: ipmi: Rework user message limit handling new bugfix: ipmi: Fix handling of messages with provided receive message pointer Corey Minyard (1): ipmi: Rework user message limit handling Guenter Roeck (1): ipmi: Fix handling of messages with provided receive message pointer drivers/char/ipmi/ipmi_msghandler.c | 416 +++++++++++++--------------- 1 file changed, 200 insertions(+), 216 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/5] CVE-2022-49722
by Xiaomeng Zhang 24 Nov '25

24 Nov '25

Jacob Keller (2): ice: convert ice_reset_vf to standard error codes ice: convert ice_reset_vf to take flags Michal Jaron (1): ice: Fix call trace with null VSI during VF reset Norbert Zulinski (1): ice: Fix spurious interrupt during removal of trusted VF Przemyslaw Patynowski (1): ice: Fix memory corruption in VF driver drivers/net/ethernet/intel/ice/ice_base.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 28 ++++++++++ drivers/net/ethernet/intel/ice/ice_lib.h | 1 + drivers/net/ethernet/intel/ice/ice_main.c | 2 +- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 52 ++++++++++++++----- .../net/ethernet/intel/ice/ice_virtchnl_pf.h | 17 ++++-- 6 files changed, 86 insertions(+), 18 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
by Zhang Yuwei 24 Nov '25

24 Nov '25

From: Takashi Iwai <tiwai(a)suse.de> mainline inclusion from mainline-v6.18-rc1 commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BB3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------- When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results like OOB access. This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed. Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Message-ID: <20250902171826.27329-4-tiwai(a)suse.de> Signed-off-by: Mark Brown <broonie(a)kernel.org> --- sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c index a8289f74463e..f5bcf68841c3 100644 --- a/sound/soc/intel/boards/bytcr_rt5651.c +++ b/sound/soc/intel/boards/bytcr_rt5651.c @@ -58,7 +58,8 @@ enum { BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), }; -#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5651_MAP_MASK GENMASK(3, 0) +#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) @@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); static void log_quirks(struct device *dev) { - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) + int map; + + map = BYT_RT5651_MAP(byt_rt5651_quirk); + switch (map) { + case BYT_RT5651_DMIC_MAP: dev_info(dev, "quirk DMIC_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) + break; + case BYT_RT5651_IN1_MAP: dev_info(dev, "quirk IN1_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) + break; + case BYT_RT5651_IN2_MAP: dev_info(dev, "quirk IN2_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) + break; + case BYT_RT5651_IN1_IN2_MAP: dev_info(dev, "quirk IN1_IN2_MAP enabled"); + break; + default: + dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); + byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; + byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; + break; + } + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { dev_info(dev, "quirk realtek,jack-detect-source %ld\n", BYT_RT5651_JDSRC(byt_rt5651_quirk)); -- 2.43.0

2 1

[PATCH OLK-6.6] uburma: add tp_type in urma ioctl operation.
by Bowen You 24 Nov '25

24 Nov '25

From: Yongqiang Guo <guoyongqiang12(a)huawei.com> urma inclusion category: feature bugzilla: https://gitee.com/openeuler/release-management/issues/ID3WJX ---------------------------------------------- This patch resolves the issue of the tp_type field being lost in ioctl call during the connection establishment between urma_import_jetty and urma_bind_jetty, which causes consistent RC connection establishment failures. Signed-off-by: Yongqiang Guo <guoyongqiang12(a)huawei.com> --- drivers/ub/urma/uburma/uburma_cmd.c | 4 ++++ drivers/ub/urma/uburma/uburma_cmd.h | 4 ++++ drivers/ub/urma/uburma/uburma_cmd_tlv.c | 4 ++++ drivers/ub/urma/uburma/uburma_cmd_tlv.h | 4 ++++ 4 files changed, 16 insertions(+) diff --git a/drivers/ub/urma/uburma/uburma_cmd.c b/drivers/ub/urma/uburma/uburma_cmd.c index 2c32cf62bddc..79cbb7a999dd 100644 --- a/drivers/ub/urma/uburma/uburma_cmd.c +++ b/drivers/ub/urma/uburma/uburma_cmd.c @@ -1668,6 +1668,7 @@ static int uburma_cmd_import_jfr(struct ubcore_device *ubc_dev, cfg.flag.value = arg.in.flag; cfg.token_value.token = arg.in.token; cfg.trans_mode = arg.in.trans_mode; + cfg.tp_type = (enum ubcore_tp_type)arg.in.tp_type; cfg.eid_index = file->ucontext->eid_index; fill_udata(&udata, file->ucontext, &arg.udata); @@ -1724,6 +1725,7 @@ static int uburma_cmd_import_jfr_ex(struct ubcore_device *ubc_dev, cfg.flag.value = arg.in.flag; cfg.token_value.token = arg.in.token; cfg.trans_mode = arg.in.trans_mode; + cfg.tp_type = (enum ubcore_tp_type)arg.in.tp_type; cfg.eid_index = file->ucontext->eid_index; active_tp_cfg.tp_handle.value = arg.in.tp_handle; @@ -1812,6 +1814,7 @@ static int uburma_cmd_import_jetty(struct ubcore_device *ubc_dev, cfg.flag.value = arg.in.flag; cfg.policy = (enum ubcore_jetty_grp_policy)arg.in.policy; cfg.type = (enum ubcore_target_type)arg.in.type; + cfg.tp_type = (enum ubcore_tp_type)arg.in.tp_type; cfg.eid_index = file->ucontext->eid_index; fill_udata(&udata, file->ucontext, &arg.udata); @@ -3045,6 +3048,7 @@ static int uburma_cmd_import_jetty_ex(struct ubcore_device *ubc_dev, cfg.flag.value = arg.in.flag; cfg.policy = (enum ubcore_jetty_grp_policy)arg.in.policy; cfg.type = (enum ubcore_target_type)arg.in.type; + cfg.tp_type = (enum ubcore_tp_type)arg.in.tp_type; cfg.eid_index = file->ucontext->eid_index; active_tp_cfg.tp_handle.value = arg.in.tp_handle; diff --git a/drivers/ub/urma/uburma/uburma_cmd.h b/drivers/ub/urma/uburma/uburma_cmd.h index 547eb5a27266..ef5dc2db5e52 100644 --- a/drivers/ub/urma/uburma/uburma_cmd.h +++ b/drivers/ub/urma/uburma/uburma_cmd.h @@ -390,6 +390,7 @@ struct uburma_cmd_import_jfr { /* correspond to urma_token_t */ uint32_t token; uint32_t trans_mode; + uint32_t tp_type; } in; struct { uint32_t tpn; @@ -407,6 +408,7 @@ struct uburma_cmd_import_jfr_ex { /* correspond to ubcore_token */ uint32_t token; uint32_t trans_mode; + uint32_t tp_type; /* correspond to struct ubcore_active_tp_cfg */ uint64_t tp_handle; uint64_t peer_tp_handle; @@ -546,6 +548,7 @@ struct uburma_cmd_import_jetty { uint32_t trans_mode; uint32_t policy; uint32_t type; + uint32_t tp_type; } in; struct { uint32_t tpn; @@ -565,6 +568,7 @@ struct uburma_cmd_import_jetty_ex { uint32_t trans_mode; uint32_t policy; uint32_t type; + uint32_t tp_type; /* correspond to struct ubcore_active_tp_cfg */ uint64_t tp_handle; uint64_t peer_tp_handle; diff --git a/drivers/ub/urma/uburma/uburma_cmd_tlv.c b/drivers/ub/urma/uburma/uburma_cmd_tlv.c index 41df179f0654..028be3acc6a7 100644 --- a/drivers/ub/urma/uburma/uburma_cmd_tlv.c +++ b/drivers/ub/urma/uburma/uburma_cmd_tlv.c @@ -588,6 +588,7 @@ uburma_import_jfr_fill_spec_in(void *arg_addr, SPEC(s++, IMPORT_JFR_IN_FLAG, arg->in.flag); SPEC(s++, IMPORT_JFR_IN_TOKEN, arg->in.token); SPEC(s++, IMPORT_JFR_IN_TRANS_MODE, arg->in.trans_mode); + SPEC(s++, IMPORT_JFR_IN_TP_TYPE, arg->in.tp_type); SPEC(s++, IMPORT_JFR_IN_UDATA, arg->udata); } @@ -805,6 +806,7 @@ uburma_import_jetty_fill_spec_in(void *arg_addr, SPEC(s++, IMPORT_JETTY_IN_TRANS_MODE, arg->in.trans_mode); SPEC(s++, IMPORT_JETTY_IN_POLICY, arg->in.policy); SPEC(s++, IMPORT_JETTY_IN_TYPE, arg->in.type); + SPEC(s++, IMPORT_JETTY_IN_TP_TYPE, arg->in.tp_type); SPEC(s++, IMPORT_JETTY_IN_UDATA, arg->udata); } @@ -1287,6 +1289,7 @@ uburma_import_jetty_ex_fill_spec_in(void *arg_addr, SPEC(s++, IMPORT_JETTY_EX_IN_TRANS_MODE, arg->in.trans_mode); SPEC(s++, IMPORT_JETTY_EX_IN_POLICY, arg->in.policy); SPEC(s++, IMPORT_JETTY_EX_IN_TYPE, arg->in.type); + SPEC(s++, IMPORT_JETTY_EX_IN_TP_TYPE, arg->in.tp_type); SPEC(s++, IMPORT_JETTY_EX_IN_TP_HANDLE, arg->in.tp_handle); SPEC(s++, IMPORT_JETTY_EX_IN_PEER_TP_HANDLE, arg->in.peer_tp_handle); @@ -1320,6 +1323,7 @@ uburma_import_jfr_ex_fill_spec_in(void *arg_addr, SPEC(s++, IMPORT_JFR_EX_IN_FLAG, arg->in.flag); SPEC(s++, IMPORT_JFR_EX_IN_TOKEN, arg->in.token); SPEC(s++, IMPORT_JFR_EX_IN_TRANS_MODE, arg->in.trans_mode); + SPEC(s++, IMPORT_JFR_EX_IN_TP_TYPE, arg->in.tp_type); SPEC(s++, IMPORT_JFR_EX_IN_TP_HANDLE, arg->in.tp_handle); SPEC(s++, IMPORT_JFR_EX_IN_PEER_TP_HANDLE, arg->in.peer_tp_handle); diff --git a/drivers/ub/urma/uburma/uburma_cmd_tlv.h b/drivers/ub/urma/uburma/uburma_cmd_tlv.h index c79cfc489e85..7dc179c70ded 100644 --- a/drivers/ub/urma/uburma/uburma_cmd_tlv.h +++ b/drivers/ub/urma/uburma/uburma_cmd_tlv.h @@ -382,6 +382,7 @@ enum uburma_cmd_import_jfr_type { IMPORT_JFR_IN_FLAG, IMPORT_JFR_IN_TOKEN, IMPORT_JFR_IN_TRANS_MODE, + IMPORT_JFR_IN_TP_TYPE, IMPORT_JFR_IN_UDATA, /* Consider udata as an ordinary member of in specs */ IMPORT_JFR_IN_NUM, /* Only for calculating number of types */ /* Out type */ @@ -399,6 +400,7 @@ enum uburma_cmd_import_jfr_ex_type { IMPORT_JFR_EX_IN_FLAG, IMPORT_JFR_EX_IN_TOKEN, IMPORT_JFR_EX_IN_TRANS_MODE, + IMPORT_JFR_EX_IN_TP_TYPE, IMPORT_JFR_EX_IN_TP_HANDLE, IMPORT_JFR_EX_IN_PEER_TP_HANDLE, IMPORT_JFR_EX_IN_TAG, @@ -539,6 +541,7 @@ enum uburma_cmd_import_jetty_type { IMPORT_JETTY_IN_TRANS_MODE, IMPORT_JETTY_IN_POLICY, IMPORT_JETTY_IN_TYPE, + IMPORT_JETTY_IN_TP_TYPE, IMPORT_JETTY_IN_UDATA, /* Consider udata as an in/out attr */ IMPORT_JETTY_IN_NUM, /* Only for calculating number of types */ /* Out type */ @@ -558,6 +561,7 @@ enum uburma_cmd_import_jetty_ex_type { IMPORT_JETTY_EX_IN_TRANS_MODE, IMPORT_JETTY_EX_IN_POLICY, IMPORT_JETTY_EX_IN_TYPE, + IMPORT_JETTY_EX_IN_TP_TYPE, IMPORT_JETTY_EX_IN_TP_HANDLE, IMPORT_JETTY_EX_IN_PEER_TP_HANDLE, IMPORT_JETTY_EX_IN_TAG, -- 2.34.1

2 1

[PATCH OLK-6.6] iommu/vt-d: debugfs: Fix legacy mode page table dump logic
by Zhang Yuwei 24 Nov '25

24 Nov '25

From: "Vineeth Pillai (Google)" <vineeth(a)bitbyteword.org> mainline inclusion from mainline-v6.18-rc1 commit fbe6070c73badca726e4ff7877320e6c62339917 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B92 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault, probably for non-canonical address 0xf00087d3f000f000: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 RIP: 0010:pgtable_walk_level+0x98/0x150 RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> pgtable_walk_level+0x88/0x150 domain_translation_struct_show.isra.0+0x2d9/0x300 dev_domain_translation_struct_show+0x20/0x40 seq_read_iter+0x12d/0x490 ... Avoid walking the page table if TT is not 00b or 01b. Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table") Signed-off-by: Vineeth Pillai (Google) <vineeth(a)bitbyteword.org> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> --- drivers/iommu/intel/debugfs.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c index 86b506af7daa..7223adfabd7d 100644 --- a/drivers/iommu/intel/debugfs.c +++ b/drivers/iommu/intel/debugfs.c @@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m, } pgd &= VTD_PAGE_MASK; } else { /* legacy mode */ - pgd = context->lo & VTD_PAGE_MASK; - agaw = context->hi & 7; + u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2; + + /* + * According to Translation Type(TT), + * get the page table pointer(SSPTPTR). + */ + switch (tt) { + case CONTEXT_TT_MULTI_LEVEL: + case CONTEXT_TT_DEV_IOTLB: + pgd = context->lo & VTD_PAGE_MASK; + agaw = context->hi & 7; + break; + default: + goto iommu_unlock; + } } seq_printf(m, "Device %04x:%02x:%02x.%x ", -- 2.43.0

2 1

[PATCH OLK-6.6] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
by Zhang Yuwei 24 Nov '25

24 Nov '25

From: Takashi Iwai <tiwai(a)suse.de> mainline inclusion from mainline-v6.18-rc1 commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BB3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------- When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results like OOB access. This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed. Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Message-ID: <20250902171826.27329-4-tiwai(a)suse.de> Signed-off-by: Mark Brown <broonie(a)kernel.org> --- sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c index 805afaf47b29..2abe47303ecd 100644 --- a/sound/soc/intel/boards/bytcr_rt5651.c +++ b/sound/soc/intel/boards/bytcr_rt5651.c @@ -58,7 +58,8 @@ enum { BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), }; -#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5651_MAP_MASK GENMASK(3, 0) +#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) @@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); static void log_quirks(struct device *dev) { - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) + int map; + + map = BYT_RT5651_MAP(byt_rt5651_quirk); + switch (map) { + case BYT_RT5651_DMIC_MAP: dev_info(dev, "quirk DMIC_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) + break; + case BYT_RT5651_IN1_MAP: dev_info(dev, "quirk IN1_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) + break; + case BYT_RT5651_IN2_MAP: dev_info(dev, "quirk IN2_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) + break; + case BYT_RT5651_IN1_IN2_MAP: dev_info(dev, "quirk IN1_IN2_MAP enabled"); + break; + default: + dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); + byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; + byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; + break; + } + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { dev_info(dev, "quirk realtek,jack-detect-source %ld\n", BYT_RT5651_JDSRC(byt_rt5651_quirk)); -- 2.43.0

2 1

[PATCH OLK-6.6] crypto: af_alg - Set merge to zero early in af_alg_sendmsg
by Gu Bowen 24 Nov '25

24 Nov '25

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v6.6.108 commit 2374c11189ef704a3e4863646369f1b8e6a27d71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0U94 CVE: CVE-2025-39931 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9574b2330dbd2b5459b74d3b5e9619d39299fc6f ] If an error causes af_alg_sendmsg to abort, ctx->merge may contain a garbage value from the previous loop. This may then trigger a crash on the next entry into af_alg_sendmsg when it attempts to do a merge that can't be done. Fix this by setting ctx->merge to zero near the start of the loop. Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations") Reported-by: Muhammad Alifa Ramdhan <ramdhan(a)starlabs.sg> Reported-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- crypto/af_alg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/af_alg.c b/crypto/af_alg.c index 68cc9290cabe..80e95d0d0c45 100644 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -1018,6 +1018,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, continue; } + ctx->merge = 0; + if (!af_alg_writable(sk)) { err = af_alg_wait_for_wmem(sk, msg->msg_flags); if (err) @@ -1057,7 +1059,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, ctx->used += plen; copied += plen; size -= plen; - ctx->merge = 0; } else { do { struct page *pg; -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2025-40200
by Long Li 24 Nov '25

24 Nov '25

Fix CVE-2025-40200. Phillip Lougher (2): Squashfs: add additional inode sanity checking Squashfs: reject negative file sizes in squashfs_read_inode() fs/squashfs/inode.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 0/3] cve-2025-40300-r
by Bowen You 24 Nov '25

24 Nov '25

fix cve 2025 40300 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 8 ++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 86 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + include/linux/cpu.h | 1 + 11 files changed, 170 insertions(+), 18 deletions(-) -- 2.34.1

2 4