- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Zhao Yipeng 28 Oct '25

28 Oct '25

*** BLURB HERE *** Jan Kara (2): udf: Preserve link count of system files udf: Detect system inodes linked into directory hierarchy fs/udf/inode.c | 16 +++++++++++++--- fs/udf/super.c | 1 + fs/udf/udf_i.h | 3 ++- 3 files changed, 16 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] xfrm: fix slab-use-after-free in decode_session6
by Dong Chenchen 28 Oct '25

28 Oct '25

From: Zhengchao Shao <shaozhengchao(a)huawei.com> stable inclusion from stable-v4.19.293 commit da4cbaa75ed088b6d70db77b9103a27e2359e243 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0RFJ CVE: CVE-2023-53500 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53223f2ed1ef5c90dad814daaaefea4e68a933c8 ] When the xfrm device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when the xfrm device sends IPv6 packets. The stack information is as follows: BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff8881111458ef by task swapper/3/0 CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.4.0-next-20230707 #409 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 xfrmi_xmit+0x173/0x1ca0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:intel_idle_hlt+0x23/0x30 Code: 1f 84 00 00 00 00 00 f3 0f 1e fa 41 54 41 89 d4 0f 1f 44 00 00 66 90 0f 1f 44 00 00 0f 00 2d c4 9f ab 00 0f 1f 44 00 00 fb f4 <fa> 44 89 e0 41 5c c3 66 0f 1f 44 00 00 f3 0f 1e fa 41 54 41 89 d4 RSP: 0018:ffffc90000197d78 EFLAGS: 00000246 RAX: 00000000000a83c3 RBX: ffffe8ffffd09c50 RCX: ffffffff8a22d8e5 RDX: 0000000000000001 RSI: ffffffff8d3f8080 RDI: ffffe8ffffd09c50 RBP: ffffffff8d3f8080 R08: 0000000000000001 R09: ffffed1026ba6d9d R10: ffff888135d36ceb R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff8d3f8100 R14: 0000000000000001 R15: 0000000000000000 cpuidle_enter_state+0xd3/0x6f0 cpuidle_enter+0x4e/0xa0 do_idle+0x2fe/0x3c0 cpu_startup_entry+0x18/0x20 start_secondary+0x200/0x290 secondary_startup_64_no_verify+0x167/0x16b </TASK> Allocated by task 939: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 inet6_ifa_notify+0x118/0x230 __ipv6_ifa_notify+0x177/0xbe0 addrconf_dad_completed+0x133/0xe00 addrconf_dad_work+0x764/0x1390 process_one_work+0xa32/0x16f0 worker_thread+0x67d/0x10c0 kthread+0x344/0x440 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888111145800 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 239 bytes inside of freed 640-byte region [ffff888111145800, ffff888111145a80) As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets. Fixes: f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/xfrm/xfrm_interface_core.c net/xfrm/xfrm_interface.c [commit ee9a113ab634 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_interface.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c index b08385b70f65..820e85c8be2e 100644 --- a/net/xfrm/xfrm_interface.c +++ b/net/xfrm/xfrm_interface.c @@ -354,8 +354,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev) switch (skb->protocol) { case htons(ETH_P_IPV6): - xfrm_decode_session(skb, &fl, AF_INET6); memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); + xfrm_decode_session(skb, &fl, AF_INET6); if (!dst) { fl.u.ip6.flowi6_oif = dev->ifindex; fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC; @@ -369,8 +369,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev) } break; case htons(ETH_P_IP): - xfrm_decode_session(skb, &fl, AF_INET); memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + xfrm_decode_session(skb, &fl, AF_INET); if (!dst) { struct rtable *rt; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] notifiers: Add oops check in blocking_notifier_call_chain()
by Yi Yang 28 Oct '25

28 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID3W9Y ------------------ In hrtimer_interrupt(), interrupts are disabled when acquiring a spinlock, which subsequently triggers an oops. During the oops call chain, blocking_notifier_call_chain() invokes _cond_resched, ultimately leading to a hard lockup. Call Stack: #0 [ffff8a317f6c3ac0] __cond_resched at ffffffffa10d29a6 #1 [ffff8a317f6c3ad8] _cond_resched at ffffffffa17292cf #2 [ffff8a317f6c3ae8] down_read at ffffffffa1728022 #3 [ffff8a317f6c3b00] __blocking_notifier_call_chain at ffffffffa10c5c37 #4 [ffff8a317f6c3b40] blocking_notifier_call_chain at ffffffffa10c5c86 #5 [ffff8a317f6c3b50] fb_notifier_call_chain at ffffffffa13c83eb #6 [ffff8a317f6c3b60] fb_blank at ffffffffa13c88eb #7 [ffff8a317f6c3ba0] fbcon_blank at ffffffffa13d4a4b #8 [ffff8a317f6c3ca0] do_unblank_screen at ffffffffa144cb30 #9 [ffff8a317f6c3cc0] unblank_screen at ffffffffa144cbf0 If the system is in an oops state, use down_read_trylock instead of a blocking lock acquisition. If the trylock fails, skip executing the notifier callbacks to avoid potential deadlocks or unsafe operations during the oops handling process. Fixes: fe9d4f576324 ("Add kernel/notifier.c") Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- kernel/notifier.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/kernel/notifier.c b/kernel/notifier.c index d2aecd64b109..29e1f5d51f12 100644 --- a/kernel/notifier.c +++ b/kernel/notifier.c @@ -318,10 +318,20 @@ int __blocking_notifier_call_chain(struct blocking_notifier_head *nh, * is, we re-check the list after having taken the lock anyway: */ if (rcu_access_pointer(nh->head)) { - down_read(&nh->rwsem); - ret = notifier_call_chain(&nh->head, val, v, nr_to_call, - nr_calls); - up_read(&nh->rwsem); + if (!oops_in_progress) { + down_read(&nh->rwsem); + ret = notifier_call_chain(&nh->head, val, v, + nr_to_call, nr_calls); + up_read(&nh->rwsem); + } else { + if (down_read_trylock(&nh->rwsem)) { + ret = notifier_call_chain(&nh->head, val, + v, nr_to_call, nr_calls); + up_read(&nh->rwsem); + } else { + ret = NOTIFY_BAD; + } + } } return ret; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-53648
by Yuan Can 28 Oct '25

28 Oct '25

Su Hui (2): ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer ALSA: ac97: Fix possible error value of *rac97 sound/pci/ac97/ac97_codec.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.22.0

2 3

[PATCH OLK-5.10 0/3] Fix CVE-2025-39993
by Yi Yang 28 Oct '25

28 Oct '25

1.media: imon: Fix race getting ictx->lock 2.media: imon: grab lock earlier in imon_ir_change_protocol() 3.media: rc: fix races with imon_disconnect() Larshin Sergey (1): media: rc: fix races with imon_disconnect() Ricardo Ribalda (1): media: imon: Fix race getting ictx->lock Tetsuo Handa (1): media: imon: grab lock earlier in imon_ir_change_protocol() drivers/media/rc/imon.c | 36 +++++++++++++++++++++++------------- 1 file changed, 23 insertions(+), 13 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 V2 00/12] Errata management for VM Live migration
by Jinqian Yang 28 Oct '25

28 Oct '25

v1: https://gitee.com/openeuler/kernel/pulls/18596 v1->v2 changes: 1、Patch#2与Patch#7的KABI修改合并后放到最后一个patch; 2、Patch#5中ERRATUM_1980005的is_midr_in_range_list函数添加static inline; 3、按照主线的合入顺序进行patches的排序。 Patch#1 KVM: arm64: Set HCR_EL2.TID1 unconditionally Patch#2 KVM: arm64: Maintain per-VM copy of implementation ID regs Patch#3 KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value Patch#4 KVM: arm64: Allow userspace to change the implementation ID registers Reference: https://lore.kernel.org/all/20250225005401.679536-1-oliver.upton@linux.dev/ selftest相关未合入 Patch#5 arm64: Modify _midr_range() functions to read MIDR/REVIDR internally Patch#6 KVM: arm64: Specify hypercall ABI for retrieving target implementations Patch#7 KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 Patch#8 arm64: Make _midr_in_range_list() an exported function Patch#9 smccc/kvm_guest: Enable errata based on implementation CPUs Reference: https://lore.kernel.org/all/20250221140229.12588-1-shameerali.kolothum.thod… selftest相关未合入 Patch#10 smccc: kvm_guest: Fix kernel builds for 32 bit arm Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… 单patch合入 Patch#11 smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Reference: https://lore.kernel.org/all/20250327163613.2516073-1-oliver.upton@linux.dev/ 单patch合入 Patch#12 KVM: arm64: fix kvm kabi conflict KABI屏蔽, Patch#2与Patch#7引入, 使用KABI_EXTEND屏蔽。 Jinqian Yang (1): KVM: arm64: fix kvm kabi conflict Oliver Upton (3): KVM: arm64: Set HCR_EL2.TID1 unconditionally KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Sebastian Ott (2): KVM: arm64: Maintain per-VM copy of implementation ID regs KVM: arm64: Allow userspace to change the implementation ID registers Shameer Kolothum (6): arm64: Modify _midr_range() functions to read MIDR/REVIDR internally KVM: arm64: Specify hypercall ABI for retrieving target implementations KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 arm64: Make _midr_in_range_list() an exported function smccc/kvm_guest: Enable errata based on implementation CPUs smccc: kvm_guest: Fix kernel builds for 32 bit arm Documentation/virt/kvm/api.rst | 18 ++ arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 40 ++-- arch/arm64/include/asm/hypervisor.h | 1 + arch/arm64/include/asm/kvm_arm.h | 4 +- arch/arm64/include/asm/kvm_host.h | 13 ++ arch/arm64/include/uapi/asm/kvm.h | 12 + arch/arm64/kernel/cpu_errata.c | 75 ++++++- arch/arm64/kernel/cpufeature.c | 12 +- arch/arm64/kernel/proton-pack.c | 20 +- arch/arm64/kvm/arm.c | 9 + arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 30 ++- arch/arm64/kvm/hyp/nvhe/sysreg-sr.c | 4 +- arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 2 +- arch/arm64/kvm/hypercalls.c | 13 ++ arch/arm64/kvm/sys_regs.c | 245 ++++++++++++--------- arch/arm64/kvm/vgic/vgic-v3.c | 2 +- drivers/clocksource/arm_arch_timer.c | 2 +- drivers/firmware/efi/libstub/arm64.c | 17 ++ drivers/firmware/smccc/kvm_guest.c | 66 ++++++ drivers/perf/arm_pmuv3.c | 2 +- drivers/platform/mpam/mpam_devices.c | 6 +- include/linux/arm-smccc.h | 16 ++ include/uapi/linux/kvm.h | 3 + 24 files changed, 447 insertions(+), 167 deletions(-) -- 2.33.0

2 13

[PATCH openEuler-1.0-LTS 1/2] ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
by Yuan Can 28 Oct '25

28 Oct '25

From: Su Hui <suhui(a)nfschina.com> stable inclusion from stable-v4.19.291 commit e4cccff1e7ab6ea30995b6fbbb007d02647e025c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VHK CVE: CVE-2023-53648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 79597c8bf64ca99eab385115743131d260339da5 ] smatch error: sound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() error: we previously assumed 'rac97' could be null (see line 2072) remove redundant assignment, return error if rac97 is NULL. Fixes: da3cec35dd3c ("ALSA: Kill snd_assert() in sound/pci/*") Signed-off-by: Su Hui <suhui(a)nfschina.com> Link: https://lore.kernel.org/r/20230615021732.1972194-1-suhui@nfschina.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- sound/pci/ac97/ac97_codec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c index fee9ffecd584..202f8bc0a78a 100644 --- a/sound/pci/ac97/ac97_codec.c +++ b/sound/pci/ac97/ac97_codec.c @@ -2026,8 +2026,8 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template, .dev_disconnect = snd_ac97_dev_disconnect, }; - if (rac97) - *rac97 = NULL; + if (!rac97) + return -EINVAL; if (snd_BUG_ON(!bus || !template)) return -EINVAL; if (snd_BUG_ON(template->num >= 4)) -- 2.22.0

2 3

[PATCH OLK-6.6] mm: fix __count_zid_vm_events when CONFIG_ZONE_EXTMEM is enabled
by Jinjiang Tu 28 Oct '25

28 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID3R2F -------------------------------- FOR_ALL_ZONES macro doesn't define for ZONE_EXTMEM, thus vm_event_states doesn't contain PGALLOC, ALLOCSTALL, and PGSCAN_SKIP slots for ZONE_EXTMEM. As a result, __count_zid_vm_events() counts wrongly. pgalloc_device in /proc/vmstat will show the count of PGALLOC_MOVABLE, for example. Normally, we should add ZONE_EXTMEM in FOR_ALL_ZONES macro to add slots for ZONE_EXTMEM. But it will break kabi. To fix without breaking kabi, skip counting ZONE_EXTMEM items, and offset 1 slot for zones after ZONE_EXTMEM to count in the correct slots. Fixes: 6097ddd1df0a ("mm: add ZONE_EXTMEM for future extension to avoid kabi broken") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/vmstat.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h index d783d5a27352..5493c84b0d45 100644 --- a/include/linux/vmstat.h +++ b/include/linux/vmstat.h @@ -131,8 +131,27 @@ static inline void vm_events_fold_cpu(int cpu) #define count_vm_vma_lock_event(x) do {} while (0) #endif +/* + * FOR_ALL_ZONES macro doesn't define for ZONE_EXTMEM, thus + * vm_event_states doesn't contain slots of ZONE_EXTMEM, leading + * to count ZONE_MOVABLE and ZONE_DEVICE items to wrong slots. + * + * To fix without breaking kabi, skip counting ZONE_EXTMEM items, + * and offset 1 slot for zones after ZONE_EXTMEM to count in the + * correct slots. + */ +#ifndef CONFIG_ZONE_EXTMEM #define __count_zid_vm_events(item, zid, delta) \ __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) +#else +#define __count_zid_vm_events(item, zid, delta) \ + do { \ + if (zid < ZONE_EXTMEM) \ + __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta); \ + else if (zid > ZONE_EXTMEM) \ + __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid - 1, delta); \ + } while (0) +#endif /* * Zone and node-based page accounting with per cpu differentials. -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS 1/2] ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
by Yuan Can 28 Oct '25

28 Oct '25

From: Su Hui <suhui(a)nfschina.com> stable inclusion from stable-v4.19.291 commit e4cccff1e7ab6ea30995b6fbbb007d02647e025c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VHK CVE: CVE-2023-53648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 79597c8bf64ca99eab385115743131d260339da5 ] smatch error: sound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() error: we previously assumed 'rac97' could be null (see line 2072) remove redundant assignment, return error if rac97 is NULL. Fixes: da3cec35dd3c ("ALSA: Kill snd_assert() in sound/pci/*") Signed-off-by: Su Hui <suhui(a)nfschina.com> Link: https://lore.kernel.org/r/20230615021732.1972194-1-suhui@nfschina.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- sound/pci/ac97/ac97_codec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c index fee9ffecd584..202f8bc0a78a 100644 --- a/sound/pci/ac97/ac97_codec.c +++ b/sound/pci/ac97/ac97_codec.c @@ -2026,8 +2026,8 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template, .dev_disconnect = snd_ac97_dev_disconnect, }; - if (rac97) - *rac97 = NULL; + if (!rac97) + return -EINVAL; if (snd_BUG_ON(!bus || !template)) return -EINVAL; if (snd_BUG_ON(template->num >= 4)) -- 2.22.0

2 2

[PATCH openEuler-1.0-LTS] wifi: mwifiex: avoid possible NULL skb pointer dereference
by Zhang Yuwei 28 Oct '25

28 Oct '25

From: Dmitry Antipov <dmantipov(a)yandex.ru> stable inclusion from stable-v4.19.295 commit 139d285e7695279f030dbb172e2d0245425c86c6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYQMB CVE: CVE-2023-53384 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 35a7a1ce7c7d61664ee54f5239a1f120ab95a87e ] In 'mwifiex_handle_uap_rx_forward()', always check the value returned by 'skb_copy()' to avoid potential NULL pointer dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop original skb in case of copying failure. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 838e4f449297 ("mwifiex: improve uAP RX handling") Acked-by: Brian Norris <briannorris(a)chromium.org> Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20230814095041.16416-1-dmantipov@yandex.ru Signed-off-by: Sasha Levin <sashal(a)kernel.org> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei(a)huawei.com> --- drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c index 5ce85d5727e4..5256e254f547 100644 --- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c @@ -256,7 +256,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv, if (is_multicast_ether_addr(ra)) { skb_uap = skb_copy(skb, GFP_ATOMIC); - mwifiex_uap_queue_bridged_pkt(priv, skb_uap); + if (likely(skb_uap)) { + mwifiex_uap_queue_bridged_pkt(priv, skb_uap); + } else { + mwifiex_dbg(adapter, ERROR, + "failed to copy skb for uAP\n"); + priv->stats.rx_dropped++; + dev_kfree_skb_any(skb); + return -1; + } } else { if (mwifiex_get_sta_entry(priv, ra)) { /* Requeue Intra-BSS packet */ -- 2.22.0

2 1