- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] *** fix CVE-2025-37800 ***
by Lin Ruifeng 22 Jan '26

22 Jan '26

*** fix CVE-2025-37800 *** Dmitry Torokhov (1): [Backport] driver core: fix potential NULL pointer dereference in dev_uevent() Lin Ruifeng (1): [Huawei] Revert "Revert "Revert "driver core: Fix uevent_show() vs driver detach race""" drivers/base/base.h | 13 ++++++++++++- drivers/base/bus.c | 2 +- drivers/base/core.c | 42 ++++++++++++++++++++++++++++++++++-------- drivers/base/module.c | 4 ---- 4 files changed, 47 insertions(+), 14 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10] [Backport] drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
by Lin Ruifeng 22 Jan '26

22 Jan '26

From: Denis Arefev <arefev(a)swemel.ru> stable inclusion from stable-v5.10.237 commit 3cdd02cb70682d7d205ca6dc02a4d1eb76758d24 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/10440 CVE: CVE-2025-37768 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7c246a05df51c52fe0852ce56ba10c41e6ed1f39 upstream. The user can set any speed value. If speed is greater than UINT_MAX/8, division by zero is possible. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c52dcf49195d ("drm/amd/pp: Avoid divide-by-zero in fan_ctrl_set_fan_speed_rpm") Signed-off-by: Denis Arefev <arefev(a)swemel.ru> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c index 0b30f73649a8..49f97d612421 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c @@ -261,10 +261,10 @@ int smu7_fan_ctrl_set_fan_speed_rpm(struct pp_hwmgr *hwmgr, uint32_t speed) if (hwmgr->thermal_controller.fanInfo.bNoFan || (hwmgr->thermal_controller.fanInfo. ucTachometerPulsesPerRevolution == 0) || - speed == 0 || + (!speed || speed > UINT_MAX/8) || (speed < hwmgr->thermal_controller.fanInfo.ulMinRPM) || (speed > hwmgr->thermal_controller.fanInfo.ulMaxRPM)) - return 0; + return -EINVAL; if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) smu7_fan_ctrl_stop_smc_fan_control(hwmgr); -- 2.43.0

2 1

[PATCH OLK-5.10] [Backport] scsi: qla2xxx: Fix premature hw access after PCI error
by Lin Ruifeng 22 Jan '26

22 Jan '26

From: Quinn Tran <qutran(a)marvell.com> stable inclusion from stable-v5.15.33 commit 5ef6319f9882699613d5182fbd7929b017e8c5ab category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/296 CVE: CVE-2022-49157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e35920ab7874d5e2faeb4f958a74bfa793f1ce5a upstream. After a recoverable PCI error has been detected and recovered, qla driver needs to check to see if the error condition still persist and/or wait for the OS to give the resume signal. Sep 8 22:26:03 localhost kernel: WARNING: CPU: 9 PID: 124606 at qla_tmpl.c:440 qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx] Sep 8 22:26:03 localhost kernel: RIP: 0010:qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx] Sep 8 22:26:03 localhost kernel: Call Trace: Sep 8 22:26:03 localhost kernel: ? qla27xx_walk_template+0xb1/0x1b0 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla27xx_execute_fwdt_template+0x12a/0x160 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla27xx_fwdump+0xa0/0x1c0 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla2xxx_pci_mmio_enabled+0xfb/0x120 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? report_mmio_enabled+0x44/0x80 Sep 8 22:26:03 localhost kernel: ? report_slot_reset+0x80/0x80 Sep 8 22:26:03 localhost kernel: ? pci_walk_bus+0x70/0x90 Sep 8 22:26:03 localhost kernel: ? aer_dev_correctable_show+0xc0/0xc0 Sep 8 22:26:03 localhost kernel: ? pcie_do_recovery+0x1bb/0x240 Sep 8 22:26:03 localhost kernel: ? aer_recover_work_func+0xaa/0xd0 Sep 8 22:26:03 localhost kernel: ? process_one_work+0x1a7/0x360 .. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-8041:22: detected PCI disconnect. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: qla27xx_fwdt_entry_t262: dump ram MB failed. Area 5h start 198013h end 198013h Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: Unable to capture FW dump Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-1015:22: cmd=0x0, waited 5221 msecs Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-680d:22: mmio enabled returning. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-d04c:22: MBX Command timeout for cmd 0, iocontrol=ffffffff jiffies=10140f2e5 mb[0-3]=[0xffff 0xffff 0xffff 0xffff] Link: https://lore.kernel.org/r/20220110050218.3958-6-njavali@marvell.com Cc: stable(a)vger.kernel.org Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Quinn Tran <qutran(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/scsi/qla2xxx/qla_os.c | 10 +++++++++- drivers/scsi/qla2xxx/qla_tmpl.c | 9 +++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index 2775262a57c5..50d96055fa9b 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -7479,7 +7479,7 @@ qla2xxx_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state) switch (state) { case pci_channel_io_normal: - ha->flags.eeh_busy = 0; + qla_pci_set_eeh_busy(vha); if (ql2xmqsupport || ql2xnvmeenable) { set_bit(QPAIR_ONLINE_CHECK_NEEDED, &vha->dpc_flags); qla2xxx_wake_dpc(vha); @@ -7520,9 +7520,16 @@ qla2xxx_pci_mmio_enabled(struct pci_dev *pdev) "mmio enabled\n"); ha->pci_error_state = QLA_PCI_MMIO_ENABLED; + if (IS_QLA82XX(ha)) return PCI_ERS_RESULT_RECOVERED; + if (qla2x00_isp_reg_stat(ha)) { + ql_log(ql_log_info, base_vha, 0x803f, + "During mmio enabled, PCI/Register disconnect still detected.\n"); + goto out; + } + spin_lock_irqsave(&ha->hardware_lock, flags); if (IS_QLA2100(ha) || IS_QLA2200(ha)){ stat = rd_reg_word(&reg->hccr); @@ -7544,6 +7551,7 @@ qla2xxx_pci_mmio_enabled(struct pci_dev *pdev) "RISC paused -- mmio_enabled, Dumping firmware.\n"); qla2xxx_dump_fw(base_vha); } +out: /* set PCI_ERS_RESULT_NEED_RESET to trigger call to qla2xxx_pci_slot_reset */ ql_dbg(ql_dbg_aer, base_vha, 0x600d, "mmio enabled returning.\n"); diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c index 26c13a953b97..b0a74b036cf4 100644 --- a/drivers/scsi/qla2xxx/qla_tmpl.c +++ b/drivers/scsi/qla2xxx/qla_tmpl.c @@ -435,8 +435,13 @@ qla27xx_fwdt_entry_t266(struct scsi_qla_host *vha, { ql_dbg(ql_dbg_misc, vha, 0xd20a, "%s: reset risc [%lx]\n", __func__, *len); - if (buf) - WARN_ON_ONCE(qla24xx_soft_reset(vha->hw) != QLA_SUCCESS); + if (buf) { + if (qla24xx_soft_reset(vha->hw) != QLA_SUCCESS) { + ql_dbg(ql_dbg_async, vha, 0x5001, + "%s: unable to soft reset\n", __func__); + return INVALID_ENTRY; + } + } return qla27xx_next_entry(ent); } -- 2.43.0

2 1

[PATCH OLK-6.6] [Backport] ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
by Lin Ruifeng 22 Jan '26

22 Jan '26

From: Bard Liao <yung-chuan.liao(a)linux.intel.com> stable inclusion from stable-v6.12.14 commit e012a77e4d7632cf615ba9625b1600ed8985c3b5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/30 CVE: CVE-2024-58012 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 569922b82ca660f8b24e705f6cf674e6b1f99cc7 ] Each cpu DAI should associate with a widget. However, the topology might not create the right number of DAI widgets for aggregated amps. And it will cause NULL pointer deference. Check that the DAI widget associated with the CPU DAI is valid to prevent NULL pointer deference due to missing DAI widgets in topologies with aggregated amps. Signed-off-by: Bard Liao <yung-chuan.liao(a)linux.intel.com> Reviewed-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Reviewed-by: Péter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood(a)intel.com> Link: https://patch.msgid.link/20241203104853.56956-1-yung-chuan.liao@linux.intel… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: sound/soc/sof/intel/hda-dai.c sound/soc/sof/intel/hda.c Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/soc/sof/intel/hda-dai.c | 6 ++++++ sound/soc/sof/intel/hda.c | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c index 19ec1a45737e..cebd9db94215 100644 --- a/sound/soc/sof/intel/hda-dai.c +++ b/sound/soc/sof/intel/hda-dai.c @@ -439,6 +439,12 @@ int sdw_hda_dai_hw_params(struct snd_pcm_substream *substream, struct snd_sof_dev *sdev; int ret; + if (!w) { + dev_err(cpu_dai->dev, "%s widget not found, check amp link num in the topology\n", + cpu_dai->name); + return -EINVAL; + } + ret = non_hda_dai_hw_params(substream, params, cpu_dai); if (ret < 0) { dev_err(cpu_dai->dev, "%s: non_hda_dai_hw_params failed %d\n", __func__, ret); diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c index 15e6779efaa3..aa3f9c961173 100644 --- a/sound/soc/sof/intel/hda.c +++ b/sound/soc/sof/intel/hda.c @@ -102,6 +102,11 @@ static int sdw_params_stream(struct device *dev, struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(d, params_data->substream->stream); struct snd_sof_dai_config_data data = { 0 }; + if (!w) { + dev_err(dev, "%s widget not found, check amp link num in the topology\n", + d->name); + return -EINVAL; + } data.dai_index = (params_data->link_id << 8) | d->id; data.dai_data = params_data->alh_stream_id; -- 2.43.0

2 1

[PATCH OLK-5.10] ACPI: APEI: Handle repeated SEA error interrupts storm
by Junxian Huang 22 Jan '26

22 Jan '26

From: Junhao He <hejunhao3(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8377 --------------------------------------------------------------------------- The do_sea() function defaults to using firmware-first mode, if supported. It invoke acpi/apei/ghes ghes_notify_sea() to report and handling the SEA error, The GHES uses a buffer to cache the most recent 4 kinds of SEA errors. If the same kind SEA error occurs again, GHES will skip to reporting this SEA error and will not add it to the "ghes_estatus_llist" list until the cache times out after 10 seconds, at which point the SEA error will be reprocessed. The GHES invoke ghes_proc_in_irq() to handle the SEA error, which ultimately executes memory_failure to process the page with hardware memory corruption. If the same SEA error appears multiple times consecutively, it indicates that the previous handling was incomplete or unable to resolve the fault. In such cases, it is more appropriate to return a failure when encountering the same error again, and then proceed to arm64_do_kernel_sea for further processing. When hardware memory corruption occurs, a memory error interrupt is triggered. If the kernel accesses this erroneous data, it will trigget the SEA error exception handler. All such handlers will call memory_failure() to handle the faulty page. If a memory error interrupt occurs first, followed by an SEA error interrupt, the faulty page is first marked as poisoned by the memory error interrupt process, and then the SEA error interrupt handling process will send a SIGBUS signel to the process accessing the poisoned page. However, if the SEA interrupt is reported first, the following exceptional scenario occurs: When a user process directly requests and accesses a page with hardware memory corruption via mmap (such as with devmem), the page containing this address may still be in a free buddy state in the kernel. At this point, the page is marked as "poisoned" during the SEA claim memory_failure(). However, since the process does not request the page through the kernel's MMU, the kernel cannot send SIGBUS signel to the processes. And the memory error interrupt handling process not support send SIGBUS signel. As a result, these processes continues to access the faulty page, causing repeated entries into the SEA exception handler. At this time, it lead to an SEA error interrupt storm. The following error logs is explained using the devmem process: NOTICE: SEA Handle NOTICE: SpsrEl3 = 0x60001000, ELR_EL3 = 0xffffc6ab42671400 NOTICE: skt[0x0]die[0x0]cluster[0x0]core[0x1] NOTICE: EsrEl3 = 0x92000410 NOTICE: PA is valid: 0x1000093c00 NOTICE: Hest Set GenericError Data [ 1419.542401][ C1] {57}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 9 [ 1419.551435][ C1] {57}[Hardware Error]: event severity: recoverable [ 1419.557865][ C1] {57}[Hardware Error]: Error 0, type: recoverable [ 1419.564295][ C1] {57}[Hardware Error]: section_type: ARM processor error [ 1419.571421][ C1] {57}[Hardware Error]: MIDR: 0x0000000000000000 [ 1419.571434][ C1] {57}[Hardware Error]: Multiprocessor Affinity Register (MPIDR): 0x0000000081000100 [ 1419.586813][ C1] {57}[Hardware Error]: error affinity level: 0 [ 1419.586821][ C1] {57}[Hardware Error]: running state: 0x1 [ 1419.602714][ C1] {57}[Hardware Error]: Power State Coordination Interface state: 0 [ 1419.602724][ C1] {57}[Hardware Error]: Error info structure 0: [ 1419.614797][ C1] {57}[Hardware Error]: num errors: 1 [ 1419.614804][ C1] {57}[Hardware Error]: error_type: 0, cache error [ 1419.629226][ C1] {57}[Hardware Error]: error_info: 0x0000000020400014 [ 1419.629234][ C1] {57}[Hardware Error]: cache level: 1 [ 1419.642006][ C1] {57}[Hardware Error]: the error has not been corrected [ 1419.642013][ C1] {57}[Hardware Error]: physical fault address: 0x0000001000093c00 [ 1419.654001][ C1] {57}[Hardware Error]: Vendor specific error info has 48 bytes: [ 1419.654014][ C1] {57}[Hardware Error]: 00000000: 00000000 00000000 00000000 00000000 ................ [ 1419.670685][ C1] {57}[Hardware Error]: 00000010: 00000000 00000000 00000000 00000000 ................ [ 1419.670692][ C1] {57}[Hardware Error]: 00000020: 00000000 00000000 00000000 00000000 ................ [ 1419.783606][T54990] Memory failure: 0x1000093: recovery action for free buddy page: Recovered [ 1419.919580][ T9955] EDAC MC0: 1 UE Multi-bit ECC on unknown memory (node:0 card:1 module:71 bank:7 row:0 col:0 page:0x1000093 offset:0xc00 grain:1 - APEI location: node:0 card:257 module:71 bank:7 row:0 col:0) NOTICE: SEA Handle NOTICE: SpsrEl3 = 0x60001000, ELR_EL3 = 0xffffc6ab42671400 NOTICE: skt[0x0]die[0x0]cluster[0x0]core[0x1] NOTICE: EsrEl3 = 0x92000410 NOTICE: PA is valid: 0x1000093c00 NOTICE: Hest Set GenericError Data NOTICE: SEA Handle NOTICE: SpsrEl3 = 0x60001000, ELR_EL3 = 0xffffc6ab42671400 NOTICE: skt[0x0]die[0x0]cluster[0x0]core[0x1] NOTICE: EsrEl3 = 0x92000410 NOTICE: PA is valid: 0x1000093c00 NOTICE: Hest Set GenericError Data ... ---> Hapend SEA error interrupt storm NOTICE: SEA Handle NOTICE: SpsrEl3 = 0x60001000, ELR_EL3 = 0xffffc6ab42671400 NOTICE: skt[0x0]die[0x0]cluster[0x0]core[0x1] NOTICE: EsrEl3 = 0x92000410 NOTICE: PA is valid: 0x1000093c00 NOTICE: Hest Set GenericError Data [ 1429.818080][ T9955] Memory failure: 0x1000093: already hardware poisoned [ 1429.825760][ C1] ghes_print_estatus: 1 callbacks suppressed [ 1429.825763][ C1] {59}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 9 [ 1429.843731][ C1] {59}[Hardware Error]: event severity: recoverable [ 1429.861800][ C1] {59}[Hardware Error]: Error 0, type: recoverable [ 1429.874658][ C1] {59}[Hardware Error]: section_type: ARM processor error [ 1429.887516][ C1] {59}[Hardware Error]: MIDR: 0x0000000000000000 [ 1429.901159][ C1] {59}[Hardware Error]: Multiprocessor Affinity Register (MPIDR): 0x0000000081000100 [ 1429.901166][ C1] {59}[Hardware Error]: error affinity level: 0 [ 1429.914896][ C1] {59}[Hardware Error]: running state: 0x1 [ 1429.914903][ C1] {59}[Hardware Error]: Power State Coordination Interface state: 0 [ 1429.933319][ C1] {59}[Hardware Error]: Error info structure 0: [ 1429.946261][ C1] {59}[Hardware Error]: num errors: 1 [ 1429.946269][ C1] {59}[Hardware Error]: error_type: 0, cache error [ 1429.970847][ C1] {59}[Hardware Error]: error_info: 0x0000000020400014 [ 1429.970854][ C1] {59}[Hardware Error]: cache level: 1 [ 1429.988406][ C1] {59}[Hardware Error]: the error has not been corrected [ 1430.013419][ C1] {59}[Hardware Error]: physical fault address: 0x0000001000093c00 [ 1430.013425][ C1] {59}[Hardware Error]: Vendor specific error info has 48 bytes: [ 1430.025424][ C1] {59}[Hardware Error]: 00000000: 00000000 00000000 00000000 00000000 ................ [ 1430.053736][ C1] {59}[Hardware Error]: 00000010: 00000000 00000000 00000000 00000000 ................ [ 1430.066341][ C1] {59}[Hardware Error]: 00000020: 00000000 00000000 00000000 00000000 ................ [ 1430.294255][T54990] Memory failure: 0x1000093: already hardware poisoned [ 1430.305518][T54990] 0x1000093: Sending SIGBUS to devmem:54990 due to hardware memory corruption Signed-off-by: Junhao He <hejunhao3(a)h-partners.com> --- drivers/acpi/apei/ghes.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index e638fa4b7426..5b585e43a4cc 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -1129,8 +1129,10 @@ static int ghes_in_nmi_queue_one_entry(struct ghes *ghes, ghes_clear_estatus(ghes, &tmp_header, buf_paddr, fixmap_idx); /* This error has been reported before, don't process it again. */ - if (ghes_estatus_cached(estatus)) + if (ghes_estatus_cached(estatus)) { + rc = -ECANCELED; goto no_work; + } llist_add(&estatus_node->llnode, &ghes_estatus_llist); -- 2.33.0

2 1

[PATCH OLK-6.6 0/2] *** fix CVE-2025-37800 ***
by Lin Ruifeng 22 Jan '26

22 Jan '26

*** fix CVE-2025-37800 *** Dmitry Torokhov (1): [Backport] driver core: fix potential NULL pointer dereference in dev_uevent() Lin Ruifeng (1): [Huawei] Revert "Revert "Revert "driver core: Fix uevent_show() vs driver detach race""" drivers/base/base.h | 13 ++++++++++++- drivers/base/bus.c | 2 +- drivers/base/core.c | 42 ++++++++++++++++++++++++++++++++++-------- drivers/base/module.c | 4 ---- 4 files changed, 47 insertions(+), 14 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10] [Backport] scsi: qla2xxx: Fix premature hw access after PCI error
by Lin Ruifeng 22 Jan '26

22 Jan '26

From: Quinn Tran <qutran(a)marvell.com> stable inclusion from stable-v5.15.33 commit 5ef6319f9882699613d5182fbd7929b017e8c5ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/296 CVE: CVE-2022-49157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e35920ab7874d5e2faeb4f958a74bfa793f1ce5a upstream. After a recoverable PCI error has been detected and recovered, qla driver needs to check to see if the error condition still persist and/or wait for the OS to give the resume signal. Sep 8 22:26:03 localhost kernel: WARNING: CPU: 9 PID: 124606 at qla_tmpl.c:440 qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx] Sep 8 22:26:03 localhost kernel: RIP: 0010:qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx] Sep 8 22:26:03 localhost kernel: Call Trace: Sep 8 22:26:03 localhost kernel: ? qla27xx_walk_template+0xb1/0x1b0 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla27xx_execute_fwdt_template+0x12a/0x160 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla27xx_fwdump+0xa0/0x1c0 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla2xxx_pci_mmio_enabled+0xfb/0x120 [qla2xxx] Sep 8 22:26:03 localhost kernel: ? report_mmio_enabled+0x44/0x80 Sep 8 22:26:03 localhost kernel: ? report_slot_reset+0x80/0x80 Sep 8 22:26:03 localhost kernel: ? pci_walk_bus+0x70/0x90 Sep 8 22:26:03 localhost kernel: ? aer_dev_correctable_show+0xc0/0xc0 Sep 8 22:26:03 localhost kernel: ? pcie_do_recovery+0x1bb/0x240 Sep 8 22:26:03 localhost kernel: ? aer_recover_work_func+0xaa/0xd0 Sep 8 22:26:03 localhost kernel: ? process_one_work+0x1a7/0x360 .. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-8041:22: detected PCI disconnect. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: qla27xx_fwdt_entry_t262: dump ram MB failed. Area 5h start 198013h end 198013h Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: Unable to capture FW dump Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-1015:22: cmd=0x0, waited 5221 msecs Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-680d:22: mmio enabled returning. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-d04c:22: MBX Command timeout for cmd 0, iocontrol=ffffffff jiffies=10140f2e5 mb[0-3]=[0xffff 0xffff 0xffff 0xffff] Link: https://lore.kernel.org/r/20220110050218.3958-6-njavali@marvell.com Cc: stable(a)vger.kernel.org Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Quinn Tran <qutran(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/scsi/qla2xxx/qla_os.c | 10 +++++++++- drivers/scsi/qla2xxx/qla_tmpl.c | 9 +++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index 2775262a57c5..50d96055fa9b 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -7479,7 +7479,7 @@ qla2xxx_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state) switch (state) { case pci_channel_io_normal: - ha->flags.eeh_busy = 0; + qla_pci_set_eeh_busy(vha); if (ql2xmqsupport || ql2xnvmeenable) { set_bit(QPAIR_ONLINE_CHECK_NEEDED, &vha->dpc_flags); qla2xxx_wake_dpc(vha); @@ -7520,9 +7520,16 @@ qla2xxx_pci_mmio_enabled(struct pci_dev *pdev) "mmio enabled\n"); ha->pci_error_state = QLA_PCI_MMIO_ENABLED; + if (IS_QLA82XX(ha)) return PCI_ERS_RESULT_RECOVERED; + if (qla2x00_isp_reg_stat(ha)) { + ql_log(ql_log_info, base_vha, 0x803f, + "During mmio enabled, PCI/Register disconnect still detected.\n"); + goto out; + } + spin_lock_irqsave(&ha->hardware_lock, flags); if (IS_QLA2100(ha) || IS_QLA2200(ha)){ stat = rd_reg_word(&reg->hccr); @@ -7544,6 +7551,7 @@ qla2xxx_pci_mmio_enabled(struct pci_dev *pdev) "RISC paused -- mmio_enabled, Dumping firmware.\n"); qla2xxx_dump_fw(base_vha); } +out: /* set PCI_ERS_RESULT_NEED_RESET to trigger call to qla2xxx_pci_slot_reset */ ql_dbg(ql_dbg_aer, base_vha, 0x600d, "mmio enabled returning.\n"); diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c index 26c13a953b97..b0a74b036cf4 100644 --- a/drivers/scsi/qla2xxx/qla_tmpl.c +++ b/drivers/scsi/qla2xxx/qla_tmpl.c @@ -435,8 +435,13 @@ qla27xx_fwdt_entry_t266(struct scsi_qla_host *vha, { ql_dbg(ql_dbg_misc, vha, 0xd20a, "%s: reset risc [%lx]\n", __func__, *len); - if (buf) - WARN_ON_ONCE(qla24xx_soft_reset(vha->hw) != QLA_SUCCESS); + if (buf) { + if (qla24xx_soft_reset(vha->hw) != QLA_SUCCESS) { + ql_dbg(ql_dbg_async, vha, 0x5001, + "%s: unable to soft reset\n", __func__); + return INVALID_ENTRY; + } + } return qla27xx_next_entry(ent); } -- 2.43.0

2 1

[PATCH OLK-6.6] [Backport] ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
by Lin Ruifeng 22 Jan '26

22 Jan '26

From: Bard Liao <yung-chuan.liao(a)linux.intel.com> stable inclusion from stable-v6.12.14 commit e012a77e4d7632cf615ba9625b1600ed8985c3b5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/30 CVE: CVE-2024-58012 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 569922b82ca660f8b24e705f6cf674e6b1f99cc7 ] Each cpu DAI should associate with a widget. However, the topology might not create the right number of DAI widgets for aggregated amps. And it will cause NULL pointer deference. Check that the DAI widget associated with the CPU DAI is valid to prevent NULL pointer deference due to missing DAI widgets in topologies with aggregated amps. Signed-off-by: Bard Liao <yung-chuan.liao(a)linux.intel.com> Reviewed-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Reviewed-by: Péter Ujfalusi <peter.ujfalusi(a)linux.intel.com> Reviewed-by: Liam Girdwood <liam.r.girdwood(a)intel.com> Link: https://patch.msgid.link/20241203104853.56956-1-yung-chuan.liao@linux.intel… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: sound/soc/sof/intel/hda-dai.c sound/soc/sof/intel/hda.c Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/soc/sof/intel/hda-dai.c | 6 ++++++ sound/soc/sof/intel/hda.c | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c index 19ec1a45737e..cebd9db94215 100644 --- a/sound/soc/sof/intel/hda-dai.c +++ b/sound/soc/sof/intel/hda-dai.c @@ -439,6 +439,12 @@ int sdw_hda_dai_hw_params(struct snd_pcm_substream *substream, struct snd_sof_dev *sdev; int ret; + if (!w) { + dev_err(cpu_dai->dev, "%s widget not found, check amp link num in the topology\n", + cpu_dai->name); + return -EINVAL; + } + ret = non_hda_dai_hw_params(substream, params, cpu_dai); if (ret < 0) { dev_err(cpu_dai->dev, "%s: non_hda_dai_hw_params failed %d\n", __func__, ret); diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c index 15e6779efaa3..aa3f9c961173 100644 --- a/sound/soc/sof/intel/hda.c +++ b/sound/soc/sof/intel/hda.c @@ -102,6 +102,11 @@ static int sdw_params_stream(struct device *dev, struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(d, params_data->substream->stream); struct snd_sof_dai_config_data data = { 0 }; + if (!w) { + dev_err(dev, "%s widget not found, check amp link num in the topology\n", + d->name); + return -EINVAL; + } data.dai_index = (params_data->link_id << 8) | d->id; data.dai_data = params_data->alh_stream_id; -- 2.43.0

2 1

[PATCH OLK-5.10] [Backport] drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
by Lin Ruifeng 22 Jan '26

22 Jan '26

From: Denis Arefev <arefev(a)swemel.ru> stable inclusion from stable-v5.10.237 commit 3cdd02cb70682d7d205ca6dc02a4d1eb76758d24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/10440 CVE: CVE-2025-37768 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7c246a05df51c52fe0852ce56ba10c41e6ed1f39 upstream. The user can set any speed value. If speed is greater than UINT_MAX/8, division by zero is possible. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c52dcf49195d ("drm/amd/pp: Avoid divide-by-zero in fan_ctrl_set_fan_speed_rpm") Signed-off-by: Denis Arefev <arefev(a)swemel.ru> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c index 0b30f73649a8..49f97d612421 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c @@ -261,10 +261,10 @@ int smu7_fan_ctrl_set_fan_speed_rpm(struct pp_hwmgr *hwmgr, uint32_t speed) if (hwmgr->thermal_controller.fanInfo.bNoFan || (hwmgr->thermal_controller.fanInfo. ucTachometerPulsesPerRevolution == 0) || - speed == 0 || + (!speed || speed > UINT_MAX/8) || (speed < hwmgr->thermal_controller.fanInfo.ulMinRPM) || (speed > hwmgr->thermal_controller.fanInfo.ulMaxRPM)) - return 0; + return -EINVAL; if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) smu7_fan_ctrl_stop_smc_fan_control(hwmgr); -- 2.43.0

2 1

[PATCH] rtc: class: Remove duplicate check for alarm
by Jinjie Ruan 22 Jan '26

22 Jan '26

In __devm_rtc_register_device(), the callee rtc_initialize_alarm() will check the alarm, there is no need to check in advance, so remove it. Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/rtc/class.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c index b1a2be1f9e3b..84885ba6135c 100644 --- a/drivers/rtc/class.c +++ b/drivers/rtc/class.c @@ -410,7 +410,7 @@ int __devm_rtc_register_device(struct module *owner, struct rtc_device *rtc) /* Check to see if there is an ALARM already set in hw */ err = __rtc_read_alarm(rtc, &alrm); - if (!err && !rtc_valid_tm(&alrm.time)) + if (!err) rtc_initialize_alarm(rtc, &alrm); rtc_dev_prepare(rtc); -- 2.34.1

1 0