- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3075/3075] drivers/ub/ubus/resource.c:98:5: warning: no previous prototype for function 'ub_assign_resource'
by kernel test robot 03 Nov '25

03 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: f94773e30426af02371bc80aa047d1144f7b4291 [3075/3075] ub:ubus: Add UBUS resource space basic functions config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251103/202511031846.WZN8QTuN-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251103/202511031846.WZN8QTuN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511031846.WZN8QTuN-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/ubus/resource.c:98:5: warning: no previous prototype for function 'ub_assign_resource' [-Wmissing-prototypes] 98 | int ub_assign_resource(struct ub_entity *uent, int idx) | ^ drivers/ub/ubus/resource.c:98:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 98 | int ub_assign_resource(struct ub_entity *uent, int idx) | ^ | static >> drivers/ub/ubus/resource.c:124:6: warning: no previous prototype for function 'ub_release_resource' [-Wmissing-prototypes] 124 | void ub_release_resource(struct ub_entity *uent, int idx) | ^ drivers/ub/ubus/resource.c:124:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 124 | void ub_release_resource(struct ub_entity *uent, int idx) | ^ | static >> drivers/ub/ubus/resource.c:293:5: warning: no previous prototype for function 'ub_entity_alloc_mmio_idx' [-Wmissing-prototypes] 293 | int ub_entity_alloc_mmio_idx(struct ub_entity *dev, int idx) | ^ drivers/ub/ubus/resource.c:293:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 293 | int ub_entity_alloc_mmio_idx(struct ub_entity *dev, int idx) | ^ | static 3 warnings generated. vim +/ub_assign_resource +98 drivers/ub/ubus/resource.c 97 > 98 int ub_assign_resource(struct ub_entity *uent, int idx) 99 { 100 struct resource *res = &uent->zone[idx].res; 101 resource_size_t size; 102 resource_size_t page_size = PAGE_SIZE; 103 /* decoder mapped address unit 1M */ 104 resource_size_t align = page_size > SZ_1M ? page_size : SZ_1M; 105 int ret; 106 107 res->name = ub_name(uent); 108 res->flags |= IORESOURCE_UNSET | IORESOURCE_SIZEALIGN; 109 size = uent->zone[idx].region.size; 110 ret = _ub_assign_resource(uent, idx, size, align); 111 if (ret < 0) { 112 ub_err(uent, "RESOURCE %d: failed to assign, size=%#llx\n", 113 idx, size); 114 return ret; 115 } 116 117 res->flags &= ~IORESOURCE_UNSET; 118 res->flags &= ~IORESOURCE_STARTALIGN; 119 ub_info(uent, "RESOURCE %d: assigned %pR\n", idx, res); 120 121 return 0; 122 } 123 > 124 void ub_release_resource(struct ub_entity *uent, int idx) 125 { 126 int ret; 127 128 if (uent->zone[idx].res.parent) { 129 ret = release_resource(&uent->zone[idx].res); 130 if (ret) 131 ub_err(uent, "resource release failed, ret=%d.\n", ret); 132 } 133 } 134 135 static void __iomem *ub_iomap_range(struct ub_entity *uent, int res_id, 136 unsigned long offset, unsigned long maxlen, 137 bool is_wc) 138 { 139 resource_size_t start = ub_resource_start(uent, res_id); 140 resource_size_t len = ub_resource_len(uent, res_id); 141 unsigned long flags = ub_resource_flags(uent, res_id); 142 143 if (len <= offset || !start) 144 return NULL; 145 len -= offset; 146 start += offset; 147 if (maxlen && len > maxlen) 148 len = maxlen; 149 if (!(flags & IORESOURCE_MEM)) 150 return NULL; 151 152 if (is_wc) 153 return ioremap_wc(start, len); 154 else 155 return ioremap(start, len); 156 } 157 158 void __iomem *ub_iomap(struct ub_entity *uent, int res_id, unsigned long maxlen) 159 { 160 if (res_id >= MAX_UB_RES_NUM || !uent) 161 return NULL; 162 163 return ub_iomap_range(uent, res_id, 0, maxlen, false); 164 } 165 EXPORT_SYMBOL_GPL(ub_iomap); 166 167 void __iomem *ub_iomap_wc(struct ub_entity *uent, int res_id, unsigned long maxlen) 168 { 169 if (res_id >= MAX_UB_RES_NUM || !uent) 170 return NULL; 171 172 return ub_iomap_range(uent, res_id, 0, maxlen, true); 173 } 174 EXPORT_SYMBOL_GPL(ub_iomap_wc); 175 176 void ub_iounmap(void __iomem *addr) 177 { 178 iounmap(addr); 179 } 180 EXPORT_SYMBOL_GPL(ub_iounmap); 181 182 static int ub_read_ubba_reg(struct ub_entity *uent, size_t pg_size, int idx) 183 { 184 u32 addr_l_reg[MAX_UB_RES_NUM] = { UB_ERS0_UBBA_L, UB_ERS1_UBBA_L, 185 UB_ERS2_UBBA_L }; 186 u32 addr_h_reg[MAX_UB_RES_NUM] = { UB_ERS0_UBBA_H, UB_ERS1_UBBA_H, 187 UB_ERS2_UBBA_H }; 188 u32 ss_reg[MAX_UB_RES_NUM] = { UB_ERS0_SS, UB_ERS1_SS, UB_ERS2_SS }; 189 u32 hpa_l = 0, hpa_h = 0, size = 0; 190 int ret; 191 192 ret = ub_cfg_read_dword(uent, addr_l_reg[idx], &hpa_l); 193 ret |= ub_cfg_read_dword(uent, addr_h_reg[idx], &hpa_h); 194 ret |= ub_cfg_read_dword(uent, ss_reg[idx], &size); 195 if (ret) { 196 ub_err(uent, "read reg failed when request HPA resource\n"); 197 return -EINVAL; 198 } else if (size == 0) { 199 ub_err(uent, "size is 0 when request HPA resource\n"); 200 return -EINVAL; 201 } 202 203 uent->zone[idx].res.start = ubba_gen(hpa_h, hpa_l); 204 uent->zone[idx].res.end = 205 uent->zone[idx].res.start + ((u64)size * pg_size - 1); 206 207 uent->zone[idx].res.flags = IORESOURCE_MEM; 208 uent->zone[idx].res.name = ub_name(uent); 209 uent->zone[idx].ubba_used = 1; 210 211 ub_info(uent, "mmio idx %d, %pR\n", idx, &uent->zone[idx].res); 212 return 0; 213 } 214 215 static int ub_read_sa_reg(struct ub_entity *uent, size_t pg_size, int idx) 216 { 217 u32 sa_l_reg[MAX_UB_RES_NUM] = { UB_ERS0_SA_L, UB_ERS1_SA_L, 218 UB_ERS2_SA_L }; 219 u32 sa_h_reg[MAX_UB_RES_NUM] = { UB_ERS0_SA_H, UB_ERS1_SA_H, 220 UB_ERS2_SA_H }; 221 u32 ss_reg[MAX_UB_RES_NUM] = { UB_ERS0_SS, UB_ERS1_SS, UB_ERS2_SS }; 222 u32 sa_l = 0, sa_h = 0, size = 0; 223 int ret; 224 225 ret = ub_cfg_read_dword(uent, sa_l_reg[idx], &sa_l); 226 ret |= ub_cfg_read_dword(uent, sa_h_reg[idx], &sa_h); 227 ret |= ub_cfg_read_dword(uent, ss_reg[idx], &size); 228 if (ret) { 229 ub_err(uent, "read reg failed when request SA resource\n"); 230 return -EINVAL; 231 } else if (size == 0) { 232 ub_err(uent, "size is 0 when request SA resource\n"); 233 return -EINVAL; 234 } 235 236 /* Shift left 32 bits to get upper-bit address */ 237 uent->zone[idx].region.start = ((u64)sa_h << 32) | sa_l; 238 uent->zone[idx].region.size = size * pg_size; 239 uent->zone[idx].res.flags = IORESOURCE_MEM; 240 uent->zone[idx].sa_used = 1; 241 242 return 0; 243 } 244 245 static int ub_entity_read_mmio_idx(struct ub_entity *uent, int idx) 246 { 247 struct ub_entity *pue; 248 size_t pg_size = 0; 249 250 /* ue to its mue, mue to Entity0, Entity0 use itself */ 251 pue = uent->pue; 252 if (pue->entity_idx) /* to ensure Entity0 uent */ 253 pue = pue->pue; 254 255 (void)ub_cfg_read_byte(uent, UB_SYS_PGS, (u8 *)&pg_size); 256 if ((u8)pg_size & UB_SYS_PGS_SIZE) 257 pg_size = SZ_64K; 258 else 259 pg_size = SZ_4K; 260 261 if (pue->zone[idx].ubba_used) 262 return ub_read_ubba_reg(uent, pg_size, idx); 263 264 if (pue->zone[idx].sa_used) 265 return ub_read_sa_reg(uent, pg_size, idx); 266 267 return -EPERM; 268 } 269 270 int ub_insert_resource(struct ub_entity *dev, int idx) 271 { 272 struct resource *res, *root = NULL; 273 int ret; 274 275 if (idx >= MAX_UB_RES_NUM) 276 return -EINVAL; 277 278 res = &dev->zone[idx].res; 279 if (!(res->flags & IORESOURCE_MEM)) 280 return -EINVAL; 281 282 root = &iomem_resource; 283 284 ret = insert_resource(root, res); 285 if (ret) { 286 ub_warn(dev, "failed to claim uent resource %pR\n", res); 287 return -ENOMEM; 288 } 289 290 return 0; 291 } 292 > 293 int ub_entity_alloc_mmio_idx(struct ub_entity *dev, int idx) 294 { 295 if (is_ibus_controller(dev) || is_idev(dev)) 296 return ub_insert_resource(dev, idx); 297 return ub_assign_resource(dev, idx); 298 } 299 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openEuler-1.0-LTS 0/2] *** Fix CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** Fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

1 2

[PATCH OLK-6.6 0/2] CVE-2025-38501
by Yongjian Sun 03 Nov '25

03 Nov '25

Namjae Jeon (2): ksmbd: limit repeated connections from clients with the same IP ksmbd: extend the connection limiting mechanism to support IPv6 fs/smb/server/connection.h | 6 ++++++ fs/smb/server/transport_tcp.c | 37 +++++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+) -- 2.39.2

2 3

[openEuler-1.0-LTS 0/2] *** Fix CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** Fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

1 2

[PATCH openEuler-1.0-LTS] wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
by Jiacheng Yu 03 Nov '25

03 Nov '25

From: Hector Martin <marcan(a)marcan.st> stable inclusion from stable-v4.19.284 commit 2bc34facb90ceeff6f8c17d2006575a6d07c3825 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID33EM CVE: CVE-2023-53715 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 89b89e52153fda2733562776c7c9d9d3ebf8dd6d ] Apparently the hex passphrase mechanism does not work on newer chips/firmware (e.g. BCM4387). It seems there was a simple way of passing it in binary all along, so use that and avoid the hexification. OpenBSD has been doing it like this from the beginning, so this should work on all chips. Also clear the structure before setting the PMK. This was leaking uninitialized stack contents to the device. Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Reviewed-by: Arend van Spriel <arend.vanspriel(a)broadcom.com> Signed-off-by: Hector Martin <marcan(a)marcan.st> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20230214092423.15175-6-marcan@marcan.st Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index e6ff4c64738e..454312ef960a 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -1240,13 +1240,14 @@ static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e) static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len) { struct brcmf_wsec_pmk_le pmk; - int i, err; + int err; + + memset(&pmk, 0, sizeof(pmk)); - /* convert to firmware key format */ - pmk.key_len = cpu_to_le16(pmk_len << 1); - pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE); - for (i = 0; i < pmk_len; i++) - snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]); + /* pass pmk directly */ + pmk.key_len = cpu_to_le16(pmk_len); + pmk.flags = cpu_to_le16(0); + memcpy(pmk.key, pmk_data, pmk_len); /* store psk in firmware */ err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK, -- 2.43.0

2 1

[openEuler-1.0-LTS 0/2] *** Fix CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** Fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

1 2

[PATCH OLK-5.10 0/5] mainline patch backport
by Xinyu Zheng 03 Nov '25

03 Nov '25

Daniel Tang (1): ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT Huisong Li (1): ACPI: processor: idle: Fix memory leak when register cpuidle device failed Rafael J. Wysocki (1): PM: sleep: core: Clear power.must_resume in noirq suspend error path Sean Christopherson (2): x86/umip: Check that the instruction opcode is at least two bytes x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) arch/x86/kernel/umip.c | 15 +++++++++++++-- drivers/acpi/acpi_tad.c | 3 +++ drivers/acpi/processor_idle.c | 3 +++ drivers/base/power/main.c | 14 +++++++++++++- 4 files changed, 32 insertions(+), 3 deletions(-) -- 2.34.1

2 6

[PATCH] [Backport] ext4: factor out ext4_fc_get_tl()
by Yongjian Sun 03 Nov '25

03 Nov '25

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.1-rc1 commit dcc5827484d6e53ccda12334f8bbfafcc593ceda category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY4BC CVE: CVE-2022-50306 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Factor out ext4_fc_get_tl() to fill 'tl' with host byte order. Signed-off-by: Ye Bin <yebin10(a)huawei.com> Link: https://lore.kernel.org/r/20220924075233.2315259-3-yebin10@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/fast_commit.c [4978c659e7b5 not applied] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/fast_commit.c | 46 +++++++++++++++++++++++-------------------- 1 file changed, 25 insertions(+), 21 deletions(-) diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c index affa7a19ea61..c33482c65ebe 100644 --- a/fs/ext4/fast_commit.c +++ b/fs/ext4/fast_commit.c @@ -1256,7 +1256,7 @@ struct dentry_info_args { }; static inline void tl_to_darg(struct dentry_info_args *darg, - struct ext4_fc_tl *tl, u8 *val) + struct ext4_fc_tl *tl, u8 *val) { struct ext4_fc_dentry_info fcd; @@ -1265,8 +1265,14 @@ static inline void tl_to_darg(struct dentry_info_args *darg, darg->parent_ino = le32_to_cpu(fcd.fc_parent_ino); darg->ino = le32_to_cpu(fcd.fc_ino); darg->dname = val + offsetof(struct ext4_fc_dentry_info, fc_dname); - darg->dname_len = le16_to_cpu(tl->fc_len) - - sizeof(struct ext4_fc_dentry_info); + darg->dname_len = tl->fc_len - sizeof(struct ext4_fc_dentry_info); +} + +static inline void ext4_fc_get_tl(struct ext4_fc_tl *tl, u8 *val) +{ + memcpy(tl, val, EXT4_FC_TAG_BASE_LEN); + tl->fc_len = le16_to_cpu(tl->fc_len); + tl->fc_tag = le16_to_cpu(tl->fc_tag); } /* Unlink replay function */ @@ -1431,7 +1437,7 @@ static int ext4_fc_replay_inode(struct super_block *sb, struct ext4_fc_tl *tl, struct ext4_inode *raw_fc_inode; struct inode *inode = NULL; struct ext4_iloc iloc; - int inode_len, ino, ret, tag = le16_to_cpu(tl->fc_tag); + int inode_len, ino, ret, tag = tl->fc_tag; struct ext4_extent_header *eh; memcpy(&fc_inode, val, sizeof(fc_inode)); @@ -1456,7 +1462,7 @@ static int ext4_fc_replay_inode(struct super_block *sb, struct ext4_fc_tl *tl, if (ret) goto out; - inode_len = le16_to_cpu(tl->fc_len) - sizeof(struct ext4_fc_inode); + inode_len = tl->fc_len - sizeof(struct ext4_fc_inode); raw_inode = ext4_raw_inode(&iloc); memcpy(raw_inode, raw_fc_inode, offsetof(struct ext4_inode, i_block)); @@ -1969,12 +1975,12 @@ static int ext4_fc_replay_scan(journal_t *journal, state->fc_replay_expected_off++; for (cur = start; cur < end; - cur = cur + EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)) { - memcpy(&tl, cur, EXT4_FC_TAG_BASE_LEN); + cur = cur + EXT4_FC_TAG_BASE_LEN + tl.fc_len) { + ext4_fc_get_tl(&tl, cur); val = cur + EXT4_FC_TAG_BASE_LEN; jbd_debug(3, "Scan phase, tag:%s, blk %lld\n", - tag2str(le16_to_cpu(tl.fc_tag)), bh->b_blocknr); - switch (le16_to_cpu(tl.fc_tag)) { + tag2str(tl.fc_tag), bh->b_blocknr); + switch (tl.fc_tag) { case EXT4_FC_TAG_ADD_RANGE: memcpy(&ext, val, sizeof(ext)); ex = (struct ext4_extent *)&ext.fc_ex; @@ -1994,7 +2000,7 @@ static int ext4_fc_replay_scan(journal_t *journal, case EXT4_FC_TAG_PAD: state->fc_cur_tag++; state->fc_crc = ext4_chksum(sbi, state->fc_crc, cur, - EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)); + EXT4_FC_TAG_BASE_LEN + tl.fc_len); break; case EXT4_FC_TAG_TAIL: state->fc_cur_tag++; @@ -2027,7 +2033,7 @@ static int ext4_fc_replay_scan(journal_t *journal, } state->fc_cur_tag++; state->fc_crc = ext4_chksum(sbi, state->fc_crc, cur, - EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)); + EXT4_FC_TAG_BASE_LEN + tl.fc_len); break; default: ret = state->fc_replay_num_tags ? @@ -2083,8 +2089,8 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, end = (__u8 *)bh->b_data + journal->j_blocksize - 1; for (cur = start; cur < end; - cur = cur + EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)) { - memcpy(&tl, cur, EXT4_FC_TAG_BASE_LEN); + cur = cur + EXT4_FC_TAG_BASE_LEN + tl.fc_len) { + ext4_fc_get_tl(&tl, cur); val = cur + EXT4_FC_TAG_BASE_LEN; if (state->fc_replay_num_tags == 0) { @@ -2092,10 +2098,9 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, ext4_fc_set_bitmaps_and_counters(sb); break; } - jbd_debug(3, "Replay phase, tag:%s\n", - tag2str(le16_to_cpu(tl.fc_tag))); + ext4_debug("Replay phase, tag:%s\n", tag2str(tl.fc_tag)); state->fc_replay_num_tags--; - switch (le16_to_cpu(tl.fc_tag)) { + switch (tl.fc_tag) { case EXT4_FC_TAG_LINK: ret = ext4_fc_replay_link(sb, &tl, val); break; @@ -2116,19 +2121,18 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, break; case EXT4_FC_TAG_PAD: trace_ext4_fc_replay(sb, EXT4_FC_TAG_PAD, 0, - le16_to_cpu(tl.fc_len), 0); + tl.fc_len, 0); break; case EXT4_FC_TAG_TAIL: - trace_ext4_fc_replay(sb, EXT4_FC_TAG_TAIL, 0, - le16_to_cpu(tl.fc_len), 0); + trace_ext4_fc_replay(sb, EXT4_FC_TAG_TAIL, + 0, tl.fc_len, 0); memcpy(&tail, val, sizeof(tail)); WARN_ON(le32_to_cpu(tail.fc_tid) != expected_tid); break; case EXT4_FC_TAG_HEAD: break; default: - trace_ext4_fc_replay(sb, le16_to_cpu(tl.fc_tag), 0, - le16_to_cpu(tl.fc_len), 0); + trace_ext4_fc_replay(sb, tl.fc_tag, 0, tl.fc_len, 0); ret = -ECANCELED; break; } -- 2.39.2

1 3

[PATCH OLK-6.6 0/5] *** Mainline PATCH backport ***
by Xinyu Zheng 03 Nov '25

03 Nov '25

Daniel Tang (1): ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT Huisong Li (1): ACPI: processor: idle: Fix memory leak when register cpuidle device failed Rafael J. Wysocki (1): PM: sleep: core: Clear power.must_resume in noirq suspend error path Sean Christopherson (2): x86/umip: Check that the instruction opcode is at least two bytes x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) arch/x86/kernel/umip.c | 15 +++++++++++++-- drivers/acpi/acpi_tad.c | 3 +++ drivers/acpi/processor_idle.c | 3 +++ drivers/base/power/main.c | 14 +++++++++++++- 4 files changed, 32 insertions(+), 3 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-1.0] tty: vt: Fix vc_origin buffer copy overflow in fbcon_prepare_logo()
by Chen Jun 03 Nov '25

03 Nov '25

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: NA CVE: NA ---------------------------------------------------------------------- I got some KASAN report as below: BUG: KASAN: slab-use-after-free in fbcon_prepare_logo+0x61e/0xc90 Read of size 14 at addr ffff88812c9a4c38 by task syz.0.3549/19016 CPU: 0 PID: 19016 Comm: syz.0.3549 Not tainted 6.6.0+ #80 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x72/0xa0 print_address_description.constprop.0+0x6b/0x3d0 ? fbcon_prepare_logo+0x61e/0xc90 print_report+0xba/0x280 ? fbcon_prepare_logo+0x61e/0xc90 ? kasan_addr_to_slab+0xd/0xa0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_report+0xaf/0xe0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_check_range+0x100/0x1c0 __asan_memcpy+0x23/0x60 fbcon_prepare_logo+0x61e/0xc90 fbcon_init+0xeb9/0x1db0 ? __pfx_drm_fb_helper_set_par+0x10/0x10 visual_init+0x310/0x5c0 do_bind_con_driver.isra.0+0x627/0xbd0 store_bind+0x60b/0x710 ? __pfx_store_bind+0x10/0x10 dev_attr_store+0x5a/0x90 ? __pfx_dev_attr_store+0x10/0x10 sysfs_kf_write+0x145/0x1b0 kernfs_fop_write_iter+0x367/0x580 ? __pfx_sysfs_kf_write+0x10/0x10 new_sync_write+0x1b1/0x2d0 ? __pfx_new_sync_write+0x10/0x10 ? rb_commit+0x121/0x910 ? avc_policy_seqno+0xe/0x20 ? selinux_file_permission+0x129/0x5d0 ? security_file_permission+0xa8/0x700 vfs_write+0x71a/0x960 ksys_write+0x12e/0x260 fbcon_init() -> vc_resize() //success resize vc_origin buffer size=224=7(cols)*2*16(rows) -> bcon_prepare_logo(vc, info, old_cols, old_rows, new_cols, new_rows) //old_cols=256，old_rows=4，new_cols=7，new_rows=16 There happened to be a vc_origin buffer copy overflow error in fbcon_prepare_logo(), scrolling screen down when using old cols after vc resize would trigger out of lower bound of vc_origin buffer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Acked-by: Thomas Zimmermann <tzimmermann(a)suse.de> --- drivers/video/fbdev/core/fbcon.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index f5178eefec64..83a4949e2497 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -592,6 +592,8 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info, /* We can scroll screen down */ r = q - step - cols; for (cnt = rows - logo_lines; cnt > 0; cnt--) { + if (r < (unsigned short *) vc->vc_origin) + break; scr_memcpyw(r + step, r, vc->vc_size_row); r -= cols; } -- 2.22.0

1 0