- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] irqchip/mbigen: add check before deference 'mgn_chip'
by Bowen You 28 Apr '25

28 Apr '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC4H9T -------------------------------- In function vtimer_mbigen_set_regs, variable dereferenced before check and it caused a warning: drivers/irqchip/irq-mbigen.c:746 vtimer_mbigen_set_regs() warn: variable dereferenced before check 'mgn_chip' (see line 737) To fix this, move the null-check logic before access base member in mgn_chip. Fixes: b8b70fe6bcf0 ("mbigen: Sets the regs related to vtimer irqbypass") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 4e603fa73c33..56954d959629 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -719,6 +719,9 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) if (!vtimer_irqbypass) return 0; + if (!mgn_chip) + return -ENOMEM; + addr = mgn_chip->base + MBIGEN_CTLR_OFFSET; val = readl_relaxed(addr); mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; @@ -728,8 +731,6 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mgn_chip) - return -ENOMEM; if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Verify event formats that have "%*p.."
by Pu Lehui 27 Apr '25

27 Apr '25

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.15-rc1 commit ea8d7647f9ddf1f81e2027ed305299797299aa03 category: bugfix bugzilla: 190584 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself or in data that will never be freed. If an event references data that was allocated when the event triggered and that same data is freed before the event is read, then the kernel can crash by reading freed memory. The verifier runs at boot up (or module load) and scans the print formats of the events and checks their arguments to make sure that dereferenced pointers are safe. If the format uses "%*p.." the verifier will ignore it, and that could be dangerous. Cover this case as well. Also add to the sample code a use case of "%*pbl". Link: https://lore.kernel.org/all/bcba4d76-2c3f-4d11-baf0-02905db953dd@oracle.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Fixes: 5013f454a352c ("tracing: Add check of trace event print fmts for dereferencing pointers") Link: https://lore.kernel.org/20250327195311.2d89ec66@gandalf.local.home Reported-by: Libo Chen <libo.chen(a)oracle.com> Reviewed-by: Libo Chen <libo.chen(a)oracle.com> Tested-by: Libo Chen <libo.chen(a)oracle.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace_events.c samples/trace_events/trace-events-sample.h [The conflicts were due to some minor issues] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/trace_events.c | 7 +++++++ samples/trace_events/trace-events-sample.h | 8 ++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 9d22745cdea5..f2e07d470784 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -470,6 +470,7 @@ static void test_event_printk(struct trace_event_call *call) case '%': continue; case 'p': + do_pointer: /* Find dereferencing fields */ switch (fmt[i + 1]) { case 'B': case 'R': case 'r': @@ -498,6 +499,12 @@ static void test_event_printk(struct trace_event_call *call) continue; if (fmt[i + j] == '*') { star = true; + /* Handle %*pbl case */ + if (!j && fmt[i + 1] == 'p') { + arg++; + i++; + goto do_pointer; + } continue; } if ((fmt[i + j] == 's')) { diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h index 1c6b843b8c4e..6a5d4717f37a 100644 --- a/samples/trace_events/trace-events-sample.h +++ b/samples/trace_events/trace-events-sample.h @@ -315,7 +315,8 @@ TRACE_EVENT(foo_bar, __assign_cpumask(cpum, cpumask_bits(mask)); ), - TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s", __entry->foo, __entry->bar, + TP_printk("foo %s %d %s %s %s %s (%s) (%s) %s [%d] %*pbl", + __entry->foo, __entry->bar, /* * Notice here the use of some helper functions. This includes: @@ -360,7 +361,10 @@ TRACE_EVENT(foo_bar, __get_dynamic_array_len(list) / sizeof(int), sizeof(int)), __get_str(str), __get_bitmask(cpus), __get_cpumask(cpum), - __get_str(vstr)) + __get_str(vstr), + __get_dynamic_array_len(cpus), + __get_dynamic_array_len(cpus), + __get_dynamic_array(cpus)) ); /* -- 2.34.1

2 1

[PATCH OLK-6.6] irqchip/mbigen: add check before deference 'mgn_chip'
by Bowen You 27 Apr '25

27 Apr '25

Offering: HULK hulk inclusion category: bugfix bugzilla: 190582 -------------------------------- In function vtimer_mbigen_set_regs, variable dereferenced before check and it caused a warning: drivers/irqchip/irq-mbigen.c:746 vtimer_mbigen_set_regs() warn: variable dereferenced before check 'mgn_chip' (see line 737) To fix this, move the null-check logic before access base member in mgn_chip. Fixes: b8b70fe6bcf0 ("mbigen: Sets the regs related to vtimer irqbypass") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 4e603fa73c33..56954d959629 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -719,6 +719,9 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) if (!vtimer_irqbypass) return 0; + if (!mgn_chip) + return -ENOMEM; + addr = mgn_chip->base + MBIGEN_CTLR_OFFSET; val = readl_relaxed(addr); mpidr_aff3 = (val & MBIGEN_AFF3_MASK) >> MBIGEN_AFF3_SHIFT; @@ -728,8 +731,6 @@ static int vtimer_mbigen_set_regs(struct platform_device *pdev) } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!mgn_chip) - return -ENOMEM; if (res->start == CHIP0_TA_MBIGEN_PHY_BASE) { addr = ioremap(CHIP0_TA_PERI_PHY_BASE, 4); -- 2.34.1

2 1

[PATCH OLK-6.6] ext4: fix the logic to determine whether buffered IO can use iomap
by Yongjian Sun 27 Apr '25

27 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC2EYK ---------------------------------------- The current logic for determining whether buffered IO can use iomap only checks for the EXT4_MOUNT_JOURNAL_DATA mount flag. However, when a user dynamically sets the EXT4_INODE_JOURNAL_DATA flag for a specific file, that file should switch to `data=journal` mode and clear the EXT4_STATE_BUFFERED_IOMAP flag, falling back to the regular buffer head path. Therefore, we have added a new condition to the logic to check if the file has the EXT4_INODE_JOURNAL_DATA flag set. It is important to note that if this flag is set dynamically for a specific file during runtime, the setting cannot take effect immediately because the inode already exists in memory with the EXT4_STATE_BUFFERED_IOMAP flag set. To make it take effect immediately, the user needs to execute a drop cache operation. Fixes: c691783a086b ("ext4: partial enable iomap for regular file's buffered IO path") Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index bc5aa01cc6da..1e27155797cc 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -5359,7 +5359,8 @@ bool ext4_should_use_buffered_iomap(struct inode *inode) return false; if (ext4_has_feature_verity(sb)) return false; - if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) + if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA || + ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA)) return false; if (!S_ISREG(inode->i_mode)) return false; -- 2.39.2

2 1

[PATCH OLK-5.10] proc: fix UAF in proc_get_inode()
by Yongjian Sun 27 Apr '25

27 Apr '25

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.12-rc3 commit 654b33ada4ab5e926cd9c570196fefa7bec7c1df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYOFS CVE: CVE-2025-21999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered is a bug unless use_pde/unuse_pde() pair has been used. use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops never changes so information necessary for inode instantiation can be saved _before_ proc_register() in PDE itself and used later, avoiding pde->proc_ops->... dereference. rmmod lookup sys_delete_module proc_lookup_de pde_get(de); proc_get_inode(dir->i_sb, de); mod->exit() proc_remove remove_proc_subtree proc_entry_rundown(de); free_module(mod); if (S_ISREG(inode->i_mode)) if (de->proc_ops->proc_read_iter) --> As module is already freed, will trigger UAF BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e [adobriyan(a)gmail.com: don't do 2 atomic ops on the common path] Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183 Fixes: 778f3dd5a13c ("Fix procfs compat_ioctl regression") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Signed-off-by: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: David S. Miller <davem(a)davemloft.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akipm(a)linux-foundation.org> Conflicts: fs/proc/internal.h [ef1d61781bc67 not applied] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/proc/generic.c | 10 +++++++++- fs/proc/inode.c | 6 +++--- fs/proc/internal.h | 14 ++++++++++++++ include/linux/proc_fs.h | 7 +++++-- 4 files changed, 31 insertions(+), 6 deletions(-) diff --git a/fs/proc/generic.c b/fs/proc/generic.c index 5898761698c2..7b6d9c77b425 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -563,10 +563,16 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode, return p; } -static inline void pde_set_flags(struct proc_dir_entry *pde) +static void pde_set_flags(struct proc_dir_entry *pde) { if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) pde->flags |= PROC_ENTRY_PERMANENT; + if (pde->proc_ops->proc_read_iter) + pde->flags |= PROC_ENTRY_proc_read_iter; +#ifdef CONFIG_COMPAT + if (pde->proc_ops->proc_compat_ioctl) + pde->flags |= PROC_ENTRY_proc_compat_ioctl; +#endif } struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, @@ -630,6 +636,7 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode, p->proc_ops = &proc_seq_ops; p->seq_ops = ops; p->state_size = state_size; + pde_set_flags(p); return proc_register(parent, p); } EXPORT_SYMBOL(proc_create_seq_private); @@ -660,6 +667,7 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode, return NULL; p->proc_ops = &proc_single_ops; p->single_show = show; + pde_set_flags(p); return proc_register(parent, p); } EXPORT_SYMBOL(proc_create_single_data); diff --git a/fs/proc/inode.c b/fs/proc/inode.c index bde6b6f69852..ba35ffc426ea 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -684,13 +684,13 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) if (S_ISREG(inode->i_mode)) { inode->i_op = de->proc_iops; - if (de->proc_ops->proc_read_iter) + if (pde_has_proc_read_iter(de)) inode->i_fop = &proc_iter_file_ops; else inode->i_fop = &proc_reg_file_ops; #ifdef CONFIG_COMPAT - if (de->proc_ops->proc_compat_ioctl) { - if (de->proc_ops->proc_read_iter) + if (pde_has_proc_compat_ioctl(de)) { + if (pde_has_proc_read_iter(de)) inode->i_fop = &proc_iter_file_ops_compat; else inode->i_fop = &proc_reg_file_ops_compat; diff --git a/fs/proc/internal.h b/fs/proc/internal.h index 104945bbeb9f..c75d0db70a85 100644 --- a/fs/proc/internal.h +++ b/fs/proc/internal.h @@ -79,6 +79,20 @@ static inline bool pde_is_permanent(const struct proc_dir_entry *pde) return pde->flags & PROC_ENTRY_PERMANENT; } +static inline bool pde_has_proc_read_iter(const struct proc_dir_entry *pde) +{ + return pde->flags & PROC_ENTRY_proc_read_iter; +} + +static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde) +{ +#ifdef CONFIG_COMPAT + return pde->flags & PROC_ENTRY_proc_compat_ioctl; +#else + return false; +#endif +} + extern struct kmem_cache *proc_dir_entry_cache; void pde_free(struct proc_dir_entry *pde); diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h index 8c892730a1f1..9f8e0072b30f 100644 --- a/include/linux/proc_fs.h +++ b/include/linux/proc_fs.h @@ -20,10 +20,13 @@ enum { * If in doubt, ignore this flag. */ #ifdef MODULE - PROC_ENTRY_PERMANENT = 0U, + PROC_ENTRY_PERMANENT = 0U, #else - PROC_ENTRY_PERMANENT = 1U << 0, + PROC_ENTRY_PERMANENT = 1U << 0, #endif + + PROC_ENTRY_proc_read_iter = 1U << 1, + PROC_ENTRY_proc_compat_ioctl = 1U << 2, }; struct proc_ops { -- 2.39.2

2 1

[PATCH OLK-6.6 0/5] arm64/mpam: Extending MPAM's QoS capability
by Zeng Heng 27 Apr '25

27 Apr '25

Zeng Heng (5): fs/resctrl: As a pre-patch for extending MPAM's QoS capability arm64/mpam: Add CMAX feature arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add limit feature arch/x86/kernel/cpu/resctrl/core.c | 6 +- drivers/platform/mpam/mpam_devices.c | 85 +++++-- drivers/platform/mpam/mpam_internal.h | 16 +- drivers/platform/mpam/mpam_resctrl.c | 326 +++++++++++++++++++++++--- fs/resctrl/ctrlmondata.c | 13 +- fs/resctrl/rdtgroup.c | 13 +- include/linux/resctrl.h | 19 +- include/linux/resctrl_types.h | 9 + 8 files changed, 417 insertions(+), 70 deletions(-) -- 2.25.1

2 6

[PATCH OLK-6.6 00/21] swap-in support large folio
by Tong Tiangen 27 Apr '25

27 Apr '25

Mainly include two patchset and bugfix: 1. mm: enable large folios swap-in support 2. More swap folio conversions Andy Shevchenko (1): mm: remove unused stub for can_swapin_thp() Barry Song (4): mm: add nr argument in mem_cgroup_swapin_uncharge_swap() helper to support large folios mm: zswap: fix zswap_never_enabled() for CONFIG_ZSWAP==N mm: fix PSWPIN counter for large folios swap-in mm: add per-order mTHP swpin counters Chuanhua Han (1): mm: support large folios swap-in for sync io devices Matthew Wilcox (Oracle) (13): mm: return the folio from __read_swap_cache_async() mm: pass a folio to __swap_writepage() mm: pass a folio to swap_writepage_fs() mm: pass a folio to swap_writepage_bdev_sync() mm: pass a folio to swap_writepage_bdev_async() mm: pass a folio to swap_readpage_fs() mm: pass a folio to swap_readpage_bdev_sync() mm: pass a folio to swap_readpage_bdev_async() mm: convert swap_page_sector() to swap_folio_sector() mm: convert swap_readpage() to swap_read_folio() mm: remove page_swap_info() mm: return a folio from read_swap_cache_async() mm: convert swap_cluster_readahead and swap_vma_readahead to return a folio Wenchao Hao (1): mm: add per-order mTHP swap-in fallback/fallback_charge counters Yosry Ahmed (1): mm: zswap: add zswap_never_enabled() Documentation/admin-guide/mm/transhuge.rst | 14 ++ include/linux/huge_mm.h | 3 + include/linux/memcontrol.h | 5 +- include/linux/mmzone.h | 1 + include/linux/swap.h | 5 +- include/linux/zswap.h | 6 + mm/huge_memory.c | 9 + mm/madvise.c | 22 +- mm/memcontrol.c | 7 +- mm/memory.c | 264 ++++++++++++++++++--- mm/page_io.c | 86 +++---- mm/shmem.c | 8 +- mm/swap.h | 23 +- mm/swap_state.c | 76 +++--- mm/swapfile.c | 16 +- mm/zswap.c | 62 +++-- 16 files changed, 423 insertions(+), 184 deletions(-) -- 2.25.1

2 22

[PATCH OLK-5.10 V1] sched/fair: Fix the bug in dynamic smt when getting physical core load
by Cheng Yu 27 Apr '25

27 Apr '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC4CNP CVE: NA -------------------------------- Fix a bug in the dynamic smt feature. Specifically, when determining whether a physical core has idle capacity, there is a bug in obtaining the load of the core. We should use "core_id" instead of "cpu". Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 5fc8d6a25b9a..e9e4765b0d6e 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7334,7 +7334,7 @@ static bool core_has_spare(int cpu) { int core_id = cpumask_first(cpu_smt_mask(cpu)); struct rq *rq = cpu_rq(core_id); - unsigned long util = cpu_util(cpu); + unsigned long util = cpu_util(core_id); unsigned long capacity = rq->cpu_capacity; if (sysctl_sched_util_ratio == 100) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: atm: fix use after free in lec_send()
by Wang Liang 27 Apr '25

27 Apr '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.14 commit f3009d0d6ab78053117f8857b921a8237f4d17b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYOFX CVE: CVE-2025-22004 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/c751531d-4af4-42fe-affe-6104b34b791d@stanley.mount… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/atm/lec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/atm/lec.c b/net/atm/lec.c index ad4f829193f0..c43e0bb2ae13 100644 --- a/net/atm/lec.c +++ b/net/atm/lec.c @@ -180,6 +180,7 @@ static void lec_send(struct atm_vcc *vcc, struct sk_buff *skb) { struct net_device *dev = skb->dev; + unsigned int len = skb->len; ATM_SKB(skb)->vcc = vcc; atm_account_tx(vcc, skb); @@ -190,7 +191,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb) } dev->stats.tx_packets++; - dev->stats.tx_bytes += skb->len; + dev->stats.tx_bytes += len; } static void lec_tx_timeout(struct net_device *dev) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49647
by Chen Ridong 27 Apr '25

27 Apr '25

CVE-2022-49647 Chen Ridong (1): cgroup: fix kabi for css_set Tejun Heo (1): cgroup: Use separate src/dst nodes when preloading css_sets for migration include/linux/cgroup-defs.h | 14 ++++++++++---- kernel/cgroup/cgroup.c | 37 +++++++++++++++++++++++-------------- 2 files changed, 33 insertions(+), 18 deletions(-) -- 2.34.1

2 3