July 2023 - Kernel - mailweb.openeuler.org

[PATCH v2 openEuler-23.09 00/46] ima: add IMA digest lists extension
by Zhou Shuiqing 31 Jul '23

31 Jul '23

Sync patched for IMA digest lists extension -Based on the kernel code of version 6.x v2: -Add patch0 to provide cover information for patch set. David Howells (4): PGPLIB: PGP definitions (RFC 4880) PGPLIB: Basic packet parser KEYS: Provide PGP key description autogeneration KEYS: Provide a function to load keys from a PGP keyring blob Mimi Zohar (1): initramfs: add file metadata Roberto Sassu (34): initramfs: read metadata from special file METADATA!!! gen_init_cpio: add support for file metadata init: Add kernel option to force usage of tmpfs for rootfs ima: Add enforce-evm and log-evm modes to strictly check EVM status ima: Allow choice of file hash algorithm for measurement and audit ima: Generalize ima_read_policy() ima: Generalize ima_write_policy() and raise uploaded data size limit ima: Generalize policy file operations ima: Use ima_show_htable_value to show violations and hash table data ima: Add parser of compact digest list ima: Prevent usage of digest lists not measured or appraised ima: Introduce new securityfs files ima: Introduce new hook DIGEST_LIST_CHECK ima: Load all digest lists from a directory at boot time ima: Add support for measurement with digest lists ima: Add support for appraisal with digest lists evm: Add support for digest lists of metadata ima: Add meta_immutable appraisal type ima: Introduce exec_tcb policy ima: Introduce appraise_exec_tcb policy ima: Introduce appraise_exec_immutable policy ima: Add Documentation/security/IMA-digest-lists.txt mpi: introduce mpi_key_length() rsa: add parser of raw format KEYS: PGP data parser KEYS: Introduce load_pgp_public_keyring() certs: Introduce search_trusted_key() ima: Search key in the built-in keyrings ima: Allow direct upload of digest lists to securityfs ima: Add parser keyword to the policy evm: Extend evm= with x509. allow_metadata_writes and complete values ima: Execute parser to upload digest lists not recognizable by the kernel evm: Propagate choice of HMAC algorithm in evm_crypto.c config: add digest list options for arm64 and x86 Zhang Tianxing (5): ima: fix a memory leak in ima_del_digest_data_entry ima: Add max size for IMA digest database ima: don't allow control characters in policy path ima: fix CONFIG_IMA_DIGEST_DB_MEGABYTES in openeuler_defconfig ima: fix db size overflow and Kconfig issues Zheng Zengkai (1): Revert "evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded" shenxiangwei (1): ima: bugfix for digest lists importing Documentation/ABI/testing/evm | 4 +- .../admin-guide/kernel-parameters.txt | 49 +- Documentation/security/IMA-digest-lists.txt | 259 ++++++++++ arch/arm64/configs/openeuler_defconfig | 11 + arch/x86/configs/openeuler_defconfig | 31 +- certs/Kconfig | 7 + certs/Makefile | 7 + certs/system_certificates.S | 18 + certs/system_keyring.c | 44 ++ crypto/asymmetric_keys/Kconfig | 25 + crypto/asymmetric_keys/Makefile | 10 + crypto/asymmetric_keys/pgp_library.c | 281 +++++++++++ crypto/asymmetric_keys/pgp_parser.h | 23 + crypto/asymmetric_keys/pgp_preload.c | 119 +++++ crypto/asymmetric_keys/pgp_public_key.c | 383 +++++++++++++++ crypto/rsa.c | 14 +- crypto/rsa_helper.c | 69 +++ include/crypto/internal/rsa.h | 6 + include/linux/initramfs.h | 21 + include/linux/kernel_read_file.h | 1 + include/linux/mpi.h | 2 + include/linux/pgp.h | 220 +++++++++ include/linux/pgplib.h | 48 ++ include/linux/verification.h | 4 + init/do_mounts.c | 11 +- init/initramfs.c | 138 +++++- lib/mpi/mpicoder.c | 33 +- security/integrity/digsig_asymmetric.c | 10 + security/integrity/evm/Kconfig | 32 ++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 24 +- security/integrity/evm/evm_main.c | 103 +++- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/iint.c | 2 + security/integrity/ima/Kconfig | 49 ++ security/integrity/ima/Makefile | 1 + security/integrity/ima/ima.h | 39 +- security/integrity/ima/ima_api.c | 42 +- security/integrity/ima/ima_appraise.c | 117 ++++- security/integrity/ima/ima_digest_list.c | 465 ++++++++++++++++++ security/integrity/ima/ima_digest_list.h | 54 ++ security/integrity/ima/ima_fs.c | 294 ++++++++--- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 128 ++++- security/integrity/ima/ima_policy.c | 116 ++++- security/integrity/integrity.h | 47 +- usr/Kconfig | 8 + usr/Makefile | 4 +- usr/gen_init_cpio.c | 136 ++++- usr/gen_initramfs.sh | 7 +- 50 files changed, 3302 insertions(+), 219 deletions(-) create mode 100644 Documentation/security/IMA-digest-lists.txt create mode 100644 crypto/asymmetric_keys/pgp_library.c create mode 100644 crypto/asymmetric_keys/pgp_parser.h create mode 100644 crypto/asymmetric_keys/pgp_preload.c create mode 100644 crypto/asymmetric_keys/pgp_public_key.c create mode 100644 include/linux/initramfs.h create mode 100644 include/linux/pgp.h create mode 100644 include/linux/pgplib.h create mode 100644 security/integrity/ima/ima_digest_list.c create mode 100644 security/integrity/ima/ima_digest_list.h -- 2.33.0

1 46

[PATCH OLK-5.10] ksmbd: fix out-of-bound read in deassemble_neg_contexts()
by Li Lingfeng 31 Jul '23

31 Jul '23

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.4-rc6 commit f1a411873c85b642f13b01f21b534c2bab81fc1b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7LU2Q CVE: CVE-2023-38427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/f… -------------------------------- The check in the beginning is `clen + sizeof(struct smb2_neg_context) <= len_of_ctxts`, but in the end of loop, `len_of_ctxts` will subtract `((clen + 7) & ~0x7) + sizeof(struct smb2_neg_context)`, which causes integer underflow when clen does the 8 alignment. We should use `(clen + 7) & ~0x7` in the check to avoid underflow from happening. Then there are some variables that need to be declared unsigned instead of signed. [ 11.671070] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x799/0x1610 [ 11.671533] Read of size 2 at addr ffff888005e86cf2 by task kworker/0:0/7 ... [ 11.673383] Call Trace: [ 11.673541] <TASK> [ 11.673679] dump_stack_lvl+0x33/0x50 [ 11.673913] print_report+0xcc/0x620 [ 11.674671] kasan_report+0xae/0xe0 [ 11.675171] kasan_check_range+0x35/0x1b0 [ 11.675412] smb2_handle_negotiate+0x799/0x1610 [ 11.676217] ksmbd_smb_negotiate_common+0x526/0x770 [ 11.676795] handle_ksmbd_work+0x274/0x810 ... Cc: stable(a)vger.kernel.org Signed-off-by: Chih-Yen Chang <cc85nod(a)gmail.com> Tested-by: Chih-Yen Chang <cc85nod(a)gmail.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflict: fs/smb/server/smb2pdu.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 18e176fcddf0..c357b2127774 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -978,13 +978,13 @@ static void decode_sign_cap_ctxt(struct ksmbd_conn *conn, static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, struct smb2_negotiate_req *req, - int len_of_smb) + unsigned int len_of_smb) { /* +4 is to account for the RFC1001 len field */ struct smb2_neg_context *pctx = (struct smb2_neg_context *)req; int i = 0, len_of_ctxts; - int offset = le32_to_cpu(req->NegotiateContextOffset); - int neg_ctxt_cnt = le16_to_cpu(req->NegotiateContextCount); + unsigned int offset = le32_to_cpu(req->NegotiateContextOffset); + unsigned int neg_ctxt_cnt = le16_to_cpu(req->NegotiateContextCount); __le32 status = STATUS_INVALID_PARAMETER; ksmbd_debug(SMB, "decoding %d negotiate contexts\n", neg_ctxt_cnt); @@ -1002,7 +1002,7 @@ static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, if (len_of_ctxts == 0) break; - if (len_of_ctxts < sizeof(struct smb2_neg_context)) + if (len_of_ctxts < (int)sizeof(struct smb2_neg_context)) break; pctx = (struct smb2_neg_context *)((char *)pctx + offset); @@ -1053,9 +1053,8 @@ static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, } /* offsets must be 8 byte aligned */ - clen = (clen + 7) & ~0x7; - offset = clen + sizeof(struct smb2_neg_context); - len_of_ctxts -= clen + sizeof(struct smb2_neg_context); + offset = (clen + sizeof(struct smb2_neg_context) + 7) & ~0x7; + len_of_ctxts -= offset; } return status; } -- 2.31.1

2 1

[PATCH openEuler-23.09 01/46] initramfs: add file metadata
by Zhou Shuiqing 31 Jul '23

31 Jul '23

From: Mimi Zohar <zohar(a)linux.vnet.ibm.com> hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- This patch adds metadata to a file from a supplied buffer. The buffer might contains multiple metadata records. The format of each record is: <metadata len (ASCII, 8 chars)><version><type><metadata> For now, only the TYPE_XATTR metadata type is supported. The specific format of this metadata type is: <xattr #N name>\0<xattr #N value> [kamensky: fixed restoring of xattrs for symbolic links by using sys_lsetxattr() instead of sys_setxattr()] [sassu: removed state management, kept only do_setxattrs(), added support for generic file metadata, replaced sys_lsetxattr() with vfs_setxattr(), added check for entry_size, added check for hdr->c_size, replaced strlen() with strnlen(); moved do_setxattrs() before do_name()] Signed-off-by: Mimi Zohar <zohar(a)linux.vnet.ibm.com> Signed-off-by: Victor Kamensky <kamensky(a)cisco.com> Signed-off-by: Taras Kondratiuk <takondra(a)cisco.com> Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> Signed-off-by: Tianxing Zhang <zhangtianxing3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Zhou Shuiqing<zhoushuiqing2(a)huawei.com> --- include/linux/initramfs.h | 21 ++++++++++ init/initramfs.c | 88 ++++++++++++++++++++++++++++++++++++++- 2 files changed, 107 insertions(+), 2 deletions(-) create mode 100644 include/linux/initramfs.h diff --git a/include/linux/initramfs.h b/include/linux/initramfs.h new file mode 100644 index 000000000000..2f8cee441236 --- /dev/null +++ b/include/linux/initramfs.h @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * include/linux/initramfs.h + * + * Include file for file metadata in the initial ram disk. + */ +#ifndef _LINUX_INITRAMFS_H +#define _LINUX_INITRAMFS_H + +#define METADATA_FILENAME "METADATA!!!" + +enum metadata_types { TYPE_NONE, TYPE_XATTR, TYPE__LAST }; + +struct metadata_hdr { + char c_size[8]; /* total size including c_size field */ + char c_version; /* header version */ + char c_type; /* metadata type */ + char c_metadata[]; /* metadata */ +} __packed; + +#endif /*LINUX_INITRAMFS_H*/ diff --git a/init/initramfs.c b/init/initramfs.c index e7a01c2ccd1b..3b272c56a987 100644 --- a/init/initramfs.c +++ b/init/initramfs.c @@ -15,6 +15,8 @@ #include <linux/memblock.h> #include <linux/mm.h> #include <linux/namei.h> +#include <linux/xattr.h> +#include <linux/initramfs.h> #include <linux/init_syscalls.h> #include <linux/task_work.h> #include <linux/umh.h> @@ -177,7 +179,7 @@ static __initdata time64_t mtime; static __initdata unsigned long ino, major, minor, nlink; static __initdata umode_t mode; -static __initdata unsigned long body_len, name_len; +static __initdata unsigned long body_len, name_len, metadata_len; static __initdata uid_t uid; static __initdata gid_t gid; static __initdata unsigned rdev; @@ -250,7 +252,7 @@ static void __init read_into(char *buf, unsigned size, enum state next) } } -static __initdata char *header_buf, *symlink_buf, *name_buf; +static __initdata char *header_buf, *symlink_buf, *name_buf, *metadata_buf; static int __init do_start(void) { @@ -351,6 +353,88 @@ static int __init maybe_link(void) return 0; } +static int __init do_setxattrs(char *pathname, char *buf, size_t size) +{ + struct path path; + char *xattr_name, *xattr_value; + uint32_t xattr_name_size, xattr_value_size; + int ret; + + xattr_name = buf; + xattr_name_size = strnlen(xattr_name, size); + if (xattr_name_size == size) { + error("malformed xattrs"); + return -EINVAL; + } + + xattr_value = xattr_name + xattr_name_size + 1; + xattr_value_size = buf + size - xattr_value; + + ret = kern_path(pathname, 0, &path); + if (!ret) { + ret = vfs_setxattr(&nop_mnt_idmap, path.dentry, xattr_name, xattr_value, + xattr_value_size, 0); + + path_put(&path); + } + + pr_debug("%s: %s size: %u val: %s (ret: %d)\n", pathname, + xattr_name, xattr_value_size, xattr_value, ret); + + return ret; +} + +static int __init __maybe_unused do_parse_metadata(char *pathname) +{ + char *buf = metadata_buf; + char *bufend = metadata_buf + metadata_len; + struct metadata_hdr *hdr; + char str[sizeof(hdr->c_size) + 1]; + uint32_t entry_size; + + if (!metadata_len) + return 0; + + str[sizeof(hdr->c_size)] = 0; + + while (buf < bufend) { + int ret; + + if (buf + sizeof(*hdr) > bufend) { + error("malformed metadata"); + break; + } + + hdr = (struct metadata_hdr *)buf; + if (hdr->c_version != 1) { + pr_debug("Unsupported header version\n"); + break; + } + + memcpy(str, hdr->c_size, sizeof(hdr->c_size)); + ret = kstrtou32(str, 16, &entry_size); + if (ret || buf + entry_size > bufend || + entry_size < sizeof(*hdr)) { + error("malformed xattrs"); + break; + } + + switch (hdr->c_type) { + case TYPE_XATTR: + do_setxattrs(pathname, buf + sizeof(*hdr), + entry_size - sizeof(*hdr)); + break; + default: + pr_debug("Unsupported metadata type\n"); + break; + } + + buf += entry_size; + } + + return 0; +} + static __initdata struct file *wfile; static __initdata loff_t wfile_pos; -- 2.33.0

2 46

[PATCH openEuler-1.0-LTS 0/4] net: nfc: Fix CVE-2023-3863
by Ziyang Xuan 31 Jul '23

31 Jul '23

Backport CVE-2023-3863 fix commits. Aditya Pakki (1): nfc: Fix to check for kmemdup failure Krzysztof Kozlowski (2): nfc: llcp: nullify llcp_sock->dev on connect() error paths nfc: llcp: simplify llcp_sock_connect() error paths Lin Ma (1): net: nfc: Fix use-after-free caused by nfc_llcp_find_local net/nfc/llcp.h | 1 - net/nfc/llcp_commands.c | 12 +++++++--- net/nfc/llcp_core.c | 49 +++++++++++++++++++++++++++++++++++------ net/nfc/llcp_sock.c | 32 +++++++++++++++++---------- net/nfc/netlink.c | 20 ++++++++++++----- net/nfc/nfc.h | 1 + 6 files changed, 87 insertions(+), 28 deletions(-) -- 2.25.1

2 5

[PATCH OLK-5.10] net/sched: cls_u32: Fix reference counter leak leading to overflow
by Lu Wei 31 Jul '23

31 Jul '23

From: Lee Jones <lee(a)kernel.org> stable inclusion from stable-v5.10.185 commit af6eaa57986e82d7efd81984ee607927c6de61e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7N3N2 CVE: CVE-2023-3609 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 04c55383fa5689357bcdd2c8036725a55ed632bc ] In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Lee Jones <lee(a)kernel.org> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/sched/cls_u32.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index da042bc8b239..1ac8ff445a6d 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -716,12 +716,18 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, struct nlattr *est, bool ovr, struct netlink_ext_ack *extack) { - int err; + int err, ifindex = -1; err = tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, true, extack); if (err < 0) return err; + if (tb[TCA_U32_INDEV]) { + ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); + if (ifindex < 0) + return -EINVAL; + } + if (tb[TCA_U32_LINK]) { u32 handle = nla_get_u32(tb[TCA_U32_LINK]); struct tc_u_hnode *ht_down = NULL, *ht_old; @@ -756,13 +762,9 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, tcf_bind_filter(tp, &n->res, base); } - if (tb[TCA_U32_INDEV]) { - int ret; - ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); - if (ret < 0) - return -EINVAL; - n->ifindex = ret; - } + if (ifindex >= 0) + n->ifindex = ifindex; + return 0; } -- 2.31.1

2 1

[PATCH OLK-5.10 v2] ksmbd: fix global-out-of-bounds in smb2_find_context_vals
by Long Li 31 Jul '23

31 Jul '23

From: Chih-Yen Chang <cc85nod(a)gmail.com> mainline inclusion from mainline-v6.4-rc2 commit 02f76c401d17e409ed45bf7887148fcc22c93c85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7LU2N CVE: CVE-2023-38426 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add tag_len argument in smb2_find_context_vals() to avoid out-of-bound read when create_context's name_len is larger than tag length. [ 7.995411] ================================================================== [ 7.995866] BUG: KASAN: global-out-of-bounds in memcmp+0x83/0xa0 [ 7.996248] Read of size 8 at addr ffffffff8258d940 by task kworker/0:0/7 ... [ 7.998191] Call Trace: [ 7.998358] <TASK> [ 7.998503] dump_stack_lvl+0x33/0x50 [ 7.998743] print_report+0xcc/0x620 [ 7.999458] kasan_report+0xae/0xe0 [ 7.999895] kasan_check_range+0x35/0x1b0 [ 8.000152] memcmp+0x83/0xa0 [ 8.000347] smb2_find_context_vals+0xf7/0x1e0 [ 8.000635] smb2_open+0x1df2/0x43a0 [ 8.006398] handle_ksmbd_work+0x274/0x810 [ 8.006666] process_one_work+0x419/0x760 [ 8.006922] worker_thread+0x2a2/0x6f0 [ 8.007429] kthread+0x160/0x190 [ 8.007946] ret_from_fork+0x1f/0x30 [ 8.008181] </TASK> Cc: stable(a)vger.kernel.org Signed-off-by: Chih-Yen Chang <cc85nod(a)gmail.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/oplock.c | 5 +++-- fs/ksmbd/oplock.h | 2 +- fs/ksmbd/smb2pdu.c | 14 +++++++------- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/fs/ksmbd/oplock.c b/fs/ksmbd/oplock.c index 3721fd44a43a..fc5b2137002f 100644 --- a/fs/ksmbd/oplock.c +++ b/fs/ksmbd/oplock.c @@ -1449,11 +1449,12 @@ struct lease_ctx_info *parse_lease_state(void *open_req) * smb2_find_context_vals() - find a particular context info in open request * @open_req: buffer containing smb2 file open(create) request * @tag: context name to search for + * @tag_len: the length of tag * * Return: pointer to requested context, NULL if @str context not found * or error pointer if name length is invalid. */ -struct create_context *smb2_find_context_vals(void *open_req, const char *tag) +struct create_context *smb2_find_context_vals(void *open_req, const char *tag, int tag_len) { struct create_context *cc; unsigned int next = 0; @@ -1492,7 +1493,7 @@ struct create_context *smb2_find_context_vals(void *open_req, const char *tag) return ERR_PTR(-EINVAL); name = (char *)cc + name_off; - if (memcmp(name, tag, name_len) == 0) + if (name_len == tag_len && !memcmp(name, tag, name_len)) return cc; remain_len -= next; diff --git a/fs/ksmbd/oplock.h b/fs/ksmbd/oplock.h index 0cf7a2b5bbc0..e1ba363b412a 100644 --- a/fs/ksmbd/oplock.h +++ b/fs/ksmbd/oplock.h @@ -118,7 +118,7 @@ void create_durable_v2_rsp_buf(char *cc, struct ksmbd_file *fp); void create_mxac_rsp_buf(char *cc, int maximal_access); void create_disk_id_rsp_buf(char *cc, __u64 file_id, __u64 vol_id); void create_posix_rsp_buf(char *cc, struct ksmbd_file *fp); -struct create_context *smb2_find_context_vals(void *open_req, const char *str); +struct create_context *smb2_find_context_vals(void *open_req, const char *tag, int tag_len); struct oplock_info *lookup_lease_in_table(struct ksmbd_conn *conn, char *lease_key); int find_same_lease_key(struct ksmbd_session *sess, struct ksmbd_inode *ci, diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 18e176fcddf0..d8b47cacb356 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -2453,7 +2453,7 @@ static int smb2_create_sd_buffer(struct ksmbd_work *work, return -ENOENT; /* Parse SD BUFFER create contexts */ - context = smb2_find_context_vals(req, SMB2_CREATE_SD_BUFFER); + context = smb2_find_context_vals(req, SMB2_CREATE_SD_BUFFER, 4); if (!context) return -ENOENT; else if (IS_ERR(context)) @@ -2649,7 +2649,7 @@ int smb2_open(struct ksmbd_work *work) if (req->CreateContextsOffset) { /* Parse non-durable handle create contexts */ - context = smb2_find_context_vals(req, SMB2_CREATE_EA_BUFFER); + context = smb2_find_context_vals(req, SMB2_CREATE_EA_BUFFER, 4); if (IS_ERR(context)) { rc = PTR_ERR(context); goto err_out1; @@ -2669,7 +2669,7 @@ int smb2_open(struct ksmbd_work *work) } context = smb2_find_context_vals(req, - SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST); + SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST, 4); if (IS_ERR(context)) { rc = PTR_ERR(context); goto err_out1; @@ -2680,7 +2680,7 @@ int smb2_open(struct ksmbd_work *work) } context = smb2_find_context_vals(req, - SMB2_CREATE_TIMEWARP_REQUEST); + SMB2_CREATE_TIMEWARP_REQUEST, 4); if (IS_ERR(context)) { rc = PTR_ERR(context); goto err_out1; @@ -2692,7 +2692,7 @@ int smb2_open(struct ksmbd_work *work) if (tcon->posix_extensions) { context = smb2_find_context_vals(req, - SMB2_CREATE_TAG_POSIX); + SMB2_CREATE_TAG_POSIX, 16); if (IS_ERR(context)) { rc = PTR_ERR(context); goto err_out1; @@ -3084,7 +3084,7 @@ int smb2_open(struct ksmbd_work *work) struct create_alloc_size_req *az_req; az_req = (struct create_alloc_size_req *)smb2_find_context_vals(req, - SMB2_CREATE_ALLOCATION_SIZE); + SMB2_CREATE_ALLOCATION_SIZE, 4); if (IS_ERR(az_req)) { rc = PTR_ERR(az_req); goto err_out; @@ -3111,7 +3111,7 @@ int smb2_open(struct ksmbd_work *work) err); } - context = smb2_find_context_vals(req, SMB2_CREATE_QUERY_ON_DISK_ID); + context = smb2_find_context_vals(req, SMB2_CREATE_QUERY_ON_DISK_ID, 4); if (IS_ERR(context)) { rc = PTR_ERR(context); goto err_out; -- 2.31.1

2 1

[PATCH OLK-5.10] psi: fix compile error for psi cgroupv1 when CONFIG_CGROUP=n
by Lu Jialin 31 Jul '23

31 Jul '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7OOZR ------------------------------- When CONFIG_CGROUP=n ,the compile error is: In file included from kernel/sched/core.c:13: kernel/sched/sched.h:2679:22: error: array type has incomplete element type ‘struct cftype’ extern struct cftype cgroup_v1_psi_files[]; ^~~~~~~~~~~~~~~~~~~ the reason is then CONFIG_CGROUP=n, struct cftype is not defined. We also find that, cgroup_v1_psi_files is used only in kernel/cgroup/cgroup.c and kernel/sched/cpuacct.c. Therefore, move extern struct cftype cgroup_v1_psi_files to kernel/sched/cpuacct.c.This also solved the compile error, because, then CONFIG_CGROUP=n, CONFIG_CGROUP_CPUACCT=n, the kernel/sched/cpuacct.c is not compiled, which will solve the compile error. Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- kernel/sched/cpuacct.c | 1 + kernel/sched/sched.h | 4 ---- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c index 5c00d3dcee8d..28ed182b6801 100644 --- a/kernel/sched/cpuacct.c +++ b/kernel/sched/cpuacct.c @@ -390,6 +390,7 @@ static int __init setup_psi_v1(char *str) } __setup("psi_v1=", setup_psi_v1); +extern struct cftype cgroup_v1_psi_files[]; static int __init cgroup_v1_psi_init(void) { if (!psi_v1_enable) diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 95ae9ac553fc..50f1a11ac2fd 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -2977,10 +2977,6 @@ unsigned long scale_irq_capacity(unsigned long util, unsigned long irq, unsigned } #endif -#ifdef CONFIG_PSI -extern struct cftype cgroup_v1_psi_files[]; -#endif - #if defined(CONFIG_ENERGY_MODEL) && defined(CONFIG_CPU_FREQ_GOV_SCHEDUTIL) #define perf_domain_span(pd) (to_cpumask(((pd)->em_pd->cpus))) -- 2.17.1

2 1

[PATCH OLK-5.10] tracing: Fix warning in trace_buffered_event_disable()
by Zheng Yejian 31 Jul '23

31 Jul '23

mainline inclusion from mainline-v6.5-rc4 commit dea499781a1150d285c62b26659f62fb00824fce category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7P78X Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Warning happened in trace_buffered_event_disable() at WARN_ON_ONCE(!trace_buffered_event_ref) Call Trace: ? __warn+0xa5/0x1b0 ? trace_buffered_event_disable+0x189/0x1b0 __ftrace_event_enable_disable+0x19e/0x3e0 free_probe_data+0x3b/0xa0 unregister_ftrace_function_probe_func+0x6b8/0x800 event_enable_func+0x2f0/0x3d0 ftrace_process_regex.isra.0+0x12d/0x1b0 ftrace_filter_write+0xe6/0x140 vfs_write+0x1c9/0x6f0 [...] The cause of the warning is in __ftrace_event_enable_disable(), trace_buffered_event_enable() was called once while trace_buffered_event_disable() was called twice. Reproduction script show as below, for analysis, see the comments: ``` #!/bin/bash cd /sys/kernel/tracing/ # 1. Register a 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was set; # 2) trace_buffered_event_enable() was called first time; echo 'cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter # 2. Enable the event registered, then: # 1) SOFT_DISABLED_BIT was cleared; # 2) trace_buffered_event_disable() was called first time; echo 1 > events/initcall/initcall_finish/enable # 3. Try to call into cmdline_proc_show(), then SOFT_DISABLED_BIT was # set again!!! cat /proc/cmdline # 4. Unregister the 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was cleared again; # 2) trace_buffered_event_disable() was called second time!!! echo '!cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter ``` To fix it, IIUC, we can change to call trace_buffered_event_enable() at fist time soft-mode enabled, and call trace_buffered_event_disable() at last time soft-mode disabled. Link: https://lore.kernel.org/linux-trace-kernel/20230726095804.920457-1-zhengyej… Cc: <mhiramat(a)kernel.org> Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace_events.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index f0dede12b238..d2ca0ca0943b 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -368,7 +368,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, { struct trace_event_call *call = file->event_call; struct trace_array *tr = file->tr; - unsigned long file_flags = file->flags; int ret = 0; int disable; @@ -392,6 +391,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, break; disable = file->flags & EVENT_FILE_FL_SOFT_DISABLED; clear_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags); + /* Disable use of trace_buffered_event */ + trace_buffered_event_disable(); } else disable = !(file->flags & EVENT_FILE_FL_SOFT_MODE); @@ -430,6 +431,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, if (atomic_inc_return(&file->sm_ref) > 1) break; set_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags); + /* Enable use of trace_buffered_event */ + trace_buffered_event_enable(); } if (!(file->flags & EVENT_FILE_FL_ENABLED)) { @@ -469,15 +472,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, break; } - /* Enable or disable use of trace_buffered_event */ - if ((file_flags & EVENT_FILE_FL_SOFT_DISABLED) != - (file->flags & EVENT_FILE_FL_SOFT_DISABLED)) { - if (file->flags & EVENT_FILE_FL_SOFT_DISABLED) - trace_buffered_event_enable(); - else - trace_buffered_event_disable(); - } - return ret; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] tracing: Fix warning in trace_buffered_event_disable()
by Zheng Yejian 31 Jul '23

31 Jul '23

mainline inclusion from mainline-v6.5-rc4 commit dea499781a1150d285c62b26659f62fb00824fce category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7P78X CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Warning happened in trace_buffered_event_disable() at WARN_ON_ONCE(!trace_buffered_event_ref) Call Trace: ? __warn+0xa5/0x1b0 ? trace_buffered_event_disable+0x189/0x1b0 __ftrace_event_enable_disable+0x19e/0x3e0 free_probe_data+0x3b/0xa0 unregister_ftrace_function_probe_func+0x6b8/0x800 event_enable_func+0x2f0/0x3d0 ftrace_process_regex.isra.0+0x12d/0x1b0 ftrace_filter_write+0xe6/0x140 vfs_write+0x1c9/0x6f0 [...] The cause of the warning is in __ftrace_event_enable_disable(), trace_buffered_event_enable() was called once while trace_buffered_event_disable() was called twice. Reproduction script show as below, for analysis, see the comments: ``` #!/bin/bash cd /sys/kernel/tracing/ # 1. Register a 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was set; # 2) trace_buffered_event_enable() was called first time; echo 'cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter # 2. Enable the event registered, then: # 1) SOFT_DISABLED_BIT was cleared; # 2) trace_buffered_event_disable() was called first time; echo 1 > events/initcall/initcall_finish/enable # 3. Try to call into cmdline_proc_show(), then SOFT_DISABLED_BIT was # set again!!! cat /proc/cmdline # 4. Unregister the 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was cleared again; # 2) trace_buffered_event_disable() was called second time!!! echo '!cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter ``` To fix it, IIUC, we can change to call trace_buffered_event_enable() at fist time soft-mode enabled, and call trace_buffered_event_disable() at last time soft-mode disabled. Link: https://lore.kernel.org/linux-trace-kernel/20230726095804.920457-1-zhengyej… Cc: <mhiramat(a)kernel.org> Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace_events.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 531e6e8f765b..a000adbbe64f 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -371,7 +371,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, { struct trace_event_call *call = file->event_call; struct trace_array *tr = file->tr; - unsigned long file_flags = file->flags; int ret = 0; int disable; @@ -395,6 +394,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, break; disable = file->flags & EVENT_FILE_FL_SOFT_DISABLED; clear_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags); + /* Disable use of trace_buffered_event */ + trace_buffered_event_disable(); } else disable = !(file->flags & EVENT_FILE_FL_SOFT_MODE); @@ -433,6 +434,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, if (atomic_inc_return(&file->sm_ref) > 1) break; set_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags); + /* Enable use of trace_buffered_event */ + trace_buffered_event_enable(); } if (!(file->flags & EVENT_FILE_FL_ENABLED)) { @@ -472,15 +475,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, break; } - /* Enable or disable use of trace_buffered_event */ - if ((file_flags & EVENT_FILE_FL_SOFT_DISABLED) != - (file->flags & EVENT_FILE_FL_SOFT_DISABLED)) { - if (file->flags & EVENT_FILE_FL_SOFT_DISABLED) - trace_buffered_event_enable(); - else - trace_buffered_event_disable(); - } - return ret; } -- 2.25.1

2 1

[OLK-5.10] Perf: add wperf support
by Xiongfeng Wang 31 Jul '23

31 Jul '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7P697 Add wperf support for openeuler. This patch is from https://github.com/OSUSysLab/wPerf.git Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/perf/Kconfig | 6 + drivers/perf/Makefile | 1 + drivers/perf/wperf.c | 2082 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 2089 insertions(+) create mode 100644 drivers/perf/wperf.c diff --git a/drivers/perf/Kconfig b/drivers/perf/Kconfig index 1e82ab01e75f..ae7b398ab6e0 100644 --- a/drivers/perf/Kconfig +++ b/drivers/perf/Kconfig @@ -130,6 +130,12 @@ config ARM_SPE_PMU Extension, which provides periodic sampling of operations in the CPU pipeline and reports this via the perf AUX interface. +config WPERF + tristate "Enable support for wPerf" + depends on ARM64 + help + Enable support for wPerf + source "drivers/perf/hisilicon/Kconfig" endmenu diff --git a/drivers/perf/Makefile b/drivers/perf/Makefile index 5365fd56f88f..5afa723fe2d7 100644 --- a/drivers/perf/Makefile +++ b/drivers/perf/Makefile @@ -13,3 +13,4 @@ obj-$(CONFIG_QCOM_L3_PMU) += qcom_l3_pmu.o obj-$(CONFIG_THUNDERX2_PMU) += thunderx2_pmu.o obj-$(CONFIG_XGENE_PMU) += xgene_pmu.o obj-$(CONFIG_ARM_SPE_PMU) += arm_spe_pmu.o +obj-$(CONFIG_WPERF) += wperf.o diff --git a/drivers/perf/wperf.c b/drivers/perf/wperf.c new file mode 100644 index 000000000000..33ba6ff3e2b5 --- /dev/null +++ b/drivers/perf/wperf.c @@ -0,0 +1,2082 @@ +#include <linux/init.h> +//#include <linux/highmem.h> +#include <linux/export.h> +//#include <linux/swap.h> /* for totalram_pages */ +#include <linux/kprobes.h> +//#include <linux/bootmem.h> +#include <linux/interrupt.h> + +#include <linux/slab.h> +#include <linux/file.h> +#include <linux/syscalls.h> +#include <linux/module.h> +#include <linux/kernel.h> +#include <linux/list.h> +#include <linux/mm.h> +#include <linux/sched.h> +#include <linux/fs.h> // required for various structures related to files liked fops. +#include <linux/semaphore.h> +#include <linux/cdev.h> +#include <linux/vmalloc.h> +#include <linux/futex.h> +#include <linux/stop_machine.h> +#include <linux/genhd.h> +#include <linux/uio.h> +#include <asm/uaccess.h> +#include <asm/processor.h> +#include "ioctl_perf.h" + +#define BMAXBYTE 500 +#define BSIZEBYTE (BMAXBYTE-50) +#define BMAX (BMAXBYTE * 1024 * 1024) +#define BSIZE (BSIZEBYTE * 1024 * 1024) + +static int Major; +volatile int tag = -1; +volatile int step = -1; + +struct task_struct *p = NULL; + +unsigned long pid = -1; +unsigned long gdbpid = -1; +int ret; + +struct task_struct *ptmp; +struct task_struct *ttmp; +struct task_struct *t; + +char *switch_result; +char *switch_result_bak; +char *switch_result_tmp; +char *futex_result; +char *futex_result_bak; +char *futex_result_tmp; +char *state_result; +char *state_result_bak; +char *state_result_tmp; + +char *wait_result; +char *wait_result_bak; +char *wait_result_tmp; + +//New Added for missing event solution +volatile int ipnum = 0; +volatile int fnum = 0; +volatile int wnum = 0; +long switch_pos = 0; +long state_pos = 0; +long futex_pos = 0; +long wait_pos = 0; +int state_total = 0; +int futex_total = 0; +long tmpip; + +//For softirq events +u64 stime[NR_CPUS]; + +spinlock_t switch_lock; +spinlock_t state_lock; +spinlock_t futex_lock; +spinlock_t wait_lock; + +struct wperf_struct *perf_struct; + +struct task_struct *(*fang_curr_task)(int); +int (*fang_get_futex_key)(u32 __user *, int, union futex_key *, int); +struct futex_hash_bucket *(*fang_hash_futex)(union futex_key *); +static const struct futex_q futex_q_init = { + /* list gets initialized in queue_me()*/ + .key = FUTEX_KEY_INIT, + .bitset = FUTEX_BITSET_MATCH_ANY +}; +int (*fang_futex_wait_setup)(u32 __user *, u32, unsigned int, struct futex_q *, struct futex_hash_bucket **); +long (fang_futex_wait_restart)(struct restart_block *); +//For kernel version larger than 4.8 +//#ifdef NEWKERNEL +//u64 (*local_clock)(void); +//#endif + +long firstsec, firstusec, lastsec, lastusec; + +//Fang newly added +volatile int softirq[NR_CPUS]; +volatile int softirq1[NR_CPUS]; +#define HARDIRQ_SIZE 900 +volatile short hardirq[NR_CPUS][HARDIRQ_SIZE+1]; +volatile short hardirq_pos[NR_CPUS]; +volatile int irq[NR_CPUS]; +volatile int target[PIDNUM]; +volatile int aiotag[NR_CPUS]; +#define NETSEND_SIZE 655350 +long netsend[NETSEND_SIZE+1]; +//long futextag[65535]; +//long futexsum[65535]; +//long futexstart[65535]; +struct fang_result spin_result[NR_CPUS]; + +//Only for test +//volatile short dump_check[100000]; +//volatile short dump_cpu_check[32]; + +volatile long futex_to = 0; +volatile long futex_noto = 0; + +//static long disk_work = 0; + +int dnum; +char dname[200][200]; +long disk_work[200]; + +/*static __inline__ unsigned long long tsc_now(void) +{ + unsigned hi, lo; + __asm__ __volatile__ ("rdtsc" : "=a"(lo), "=d"(hi)); + return ( (unsigned long long)lo)|( ((unsigned long long)hi)<<32 ); +}*/ + +inline u64 fang_clock(void) { + struct timespec64 now; + u64 ret = 0; + + //getnstimeofday64(&now); + //get_monotonic_boottime(&now); + + //ret = now.tv_sec*1000000000+now.tv_nsec; + + //ret = tsc_now(); + ret = ktime_get(); + //printk(KERN_INFO "current time = %lu\n", ret); + return ret; +} + +inline u64 wperfclock(void) { + //struct timespec64 now; + //u64 ret = 0; + + //getrawmonotonic(&now); + //ret = now.tv_sec*1000000000+now.tv_nsec; + + //return ret; + //return local_clock(); + return ktime_get(); +} + +//We'll check target ID & jbd thread & ksoftirq threads +int containOfPID(int core, int pid) { + int i = 0; + for (i = 0; i < PIDNUM; i++) { + if (target[i] == 0) break; + if (target[i] == pid) + return 1; + } + //if (target[0] == pid) { + // return 1; + //} + //if (target[1] == pid) { + // return 1; + //} + //if (target[2+core] == pid) { + // return 1; + //} + return 0; +} + +__visible __notrace_funcgraph int j___switch_to(struct kprobe *p, struct pt_regs *regs) { + //struct timeval start; + struct task_struct *prev_p = regs->regs[0]; + struct task_struct *next_p = regs->regs[1]; + struct fang_result fresult; + struct futex_result furesult; + char *chartmp; + int cpu = 0; + u64 ts; + + if (step == 1) { + cpu = smp_processor_id(); + if (containOfPID(cpu, prev_p->tgid)||containOfPID(cpu, next_p->tgid)) { + ts = fang_clock(); + fresult.type = 0; + fresult.ts = ts; + fresult.perfts = wperfclock(); + fresult.core = cpu; + fresult.pid1 = prev_p->pid; + fresult.pid2 = next_p->pid; + trace_printk("switch to prev %s next %s\n", prev_p->comm, next_p->comm); + + if (in_irq()) { + //fresult.irq = hardirq[cpu][hardirq_pos[cpu]]; + fresult.irq = HARDIRQ; + } + else if (in_serving_softirq()) { + fresult.irq = softirq[cpu]; + } + else { + fresult.irq = 0; + } + fresult.pid1state = prev_p->state; + fresult.pid2state = next_p->state; + + //if (prev_p->pid == 18183) { + // printk(KERN_INFO "pid1 = %d, pid2 = %d, pid1state = %d, pid2state = %d\n", prev_p->pid, next_p->pid, prev_p->state, next_p->state); + //} + + spin_lock(&switch_lock); + chartmp = (char *)(switch_result + switch_pos); + memcpy(chartmp, &fresult, sizeof(fresult)); + switch_pos+=sizeof(fresult); + if (switch_pos >= BSIZE) + pr_info("fresult exceed !!!!!!!!!\n"); + spin_unlock(&switch_lock); + + //if (futextag[next_p->pid] == 1) { + // futexstart[next_p->pid] = ts; + // //printk(KERN_INFO "pid=%d, ts=%ld\n", next_p->pid, futexstart[prev_p->pid]); + //} + //if (futextag[prev_p->pid] == 1 && futexstart[prev_p->pid] > 0) { + // futexsum[prev_p->pid] += ts - futexstart[prev_p->pid]; + + // if (prev_p->state>0) { + // spin_lock(&state_lock); + // chartmp = (char *)(state_result + state_pos); + // furesult.pid = prev_p->pid; + // furesult.time = futexsum[prev_p->pid]; + // memcpy(chartmp, &furesult, sizeof(furesult)); + // state_pos+=sizeof(furesult); + // futexsum[prev_p->pid] = 0; + // futextag[prev_p->pid] = 0; + // futexstart[prev_p->pid] = 0; + // spin_unlock(&state_lock); + // } + //} + } + } + //return 0; + return 0; +} + +/* We need this jprobe by both steps + * First, we need to record the time entry in the first step. + * Second, we need to record the last state for GDB stack. + * */ + +static int j_try_to_wake_up(struct kprobe *kp, struct pt_regs *regs) { + struct task_struct *p = regs->regs[0]; + unsigned int state = regs->regs[1]; + int wake_flags = regs->regs[2]; + char tmp[200]; + //struct timeval start; + struct fang_result fresult; + char *chartmp = NULL; + int cpu = 0; + int i = 0; + u64 ts; + + if (step == 1) { + //if (p->pid==p->tgid+8) { + // printk(KERN_INFO "Thread %d wakes up IO thread\n", current->pid); + // dump_stack(); + // if (aiotag[cpu] == 1) { + // aiotag = 0; + // printk(KERN_INFO "Thread %d is waken up by aio_complete\n", p->pid); + // } + //} + //if (p->tgid == target[1]) { + // if (in_serving_softirq()) { + // printk(KERN_INFO "It's in softirq context\n"); + // } + // else { + // printk(KERN_INFO "It's NOT in softirq context\n"); + // dump_stack(); + // printk(KERN_INFO "------------------------\n"); + // } + //} + //if (current->pid == 4145 && p->pid == 4144) dump_stack(); + //if (p->pid == 4145) dump_stack(); + cpu = smp_processor_id(); + //if (containOfPID(cpu, p->tgid) ) { + //if (current->pid == 2381) dump_stack(); + if (containOfPID(cpu, p->tgid)) { + // Check if in hardirq context + //if (in_irq() && hardirq_pos[cpu]<=0) { + // printk(KERN_INFO "[cpu %d][hardirq_pos = %d] hardirq missing, %d wakes up %d\n", cpu, hardirq_pos[cpu], current->pid, p->pid); + // dump_stack(); + //} + //else if (in_serving_softirq() && softirq1[cpu] == 0) { + // printk(KERN_INFO "softirq missing, %d wakes up %d\n", current->pid, p->pid); + // dump_stack(); + //} + + //if (current->pid == target[cpu+2] && p->pid == 376) { + // dump_stack(); + //} + + if ((p->state & state)) { + //if (current->pid != 0 && current->tgid != target[0] && p->pid == 1935) { + //printk(KERN_INFO "%d [parent %d] wakes up %d\n", current->pid, current->tgid, p->pid); + //} + //if (aiotag[cpu] == 1) { + // aiotag[p->pid] = 1; + // aiotag[cpu] = 0; + //} + + ts = fang_clock(); + + fresult.type = 1; + fresult.ts = ts; + fresult.perfts = wperfclock(); + fresult.core = cpu; + fresult.pid1 = current->pid; + fresult.pid2 = p->pid; + trace_printk("try to wakeup cur %s next %s\n", current->comm, p->comm); + if (in_irq()) { + fresult.irq = HARDIRQ; + //dump_check[p->pid] ++; + //if (dump_check[p->pid] == 10) { + // dump_cpu_check[cpu] = p->pid; + // dump_check[p->pid]=0; + //} + } + else if (in_serving_softirq()) { + fresult.irq = softirq[cpu]; + //if (softirq[cpu] == -2 && p->pid == 4145) dump_stack(); + } + else { + fresult.irq = 0; + // Added for futex Result + //futextag[p->pid] = 1; + } + + fresult.pid1state = current->state; + fresult.pid2state = p->state; + + spin_lock(&switch_lock); + chartmp = (char *)(switch_result + switch_pos); + memcpy(chartmp, &fresult, sizeof(fresult)); + switch_pos+=sizeof(fresult); + if (switch_pos >= BSIZE) + pr_info("fresult2 exceed !!!!!!!!!\n"); + spin_unlock(&switch_lock); + } + } + } + +// return 0; + return 0; +} + +static int j_tasklet_hi_action(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = TASKLET_HI; + } + //return 0; + return 0; +} + +static int j_run_timer_softirq(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = TIMER; + } + //return 0; + return 0; +} + +static int j_net_tx_action(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = NET_TX; + } + //return 0; + return 0; +} + +static int j_net_rx_action(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = NET_RX; + //if (cpu == 7) { + // printk(KERN_INFO "[%d]softirq[cpu] = %d\n", cpu, softirq[cpu]); + //} + } + //return 0; + return 0; +} + +static int j_blk_done_softirq(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = BLK_DONE; + } + //return 0; + return 0; +} + +static int j_blk_iopoll_softirq(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = BLK_IOPOLL; + } + //return 0; + return 0; +} + +static int j_tasklet_action(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = TASKLET; + } + //return 0; + return 0; +} + +static int j_run_rebalance_domains(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = SCHED; + } + //return 0; + return 0; +} + +static int j_run_hrtimer_softirq(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = HRTIMER; + } + //return 0; + return 0; +} + +//rcu moved from softirq to kthread +static int j_rcu_process_callbacks(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = RCU; + } + //return 0; + return 0; +} + +//void j_hrtimer_interrupt(void) { +int j_local_apic_timer_interrupt(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + int vector = 0; + if (step == 1) { + // Get information for do_IRQ + vector = APICTIMER; + cpu = smp_processor_id(); + + hardirq[cpu][hardirq_pos[cpu]] = vector; + hardirq_pos[cpu]+=1; + //printk(KERN_INFO "[%d] local_apic_timer starts\n", cpu); + //printk(KERN_INFO "hardirq[%d] = %d, hardirq_pos[%d] = %d\n", cpu, hardirq[cpu][hardirq_pos[cpu]], cpu, hardirq_pos[cpu]); + } + return 0; +} + +int j_do_IRQ(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + int vector = 0; + if (step == 1) { + // Get information for do_IRQ +// vector = ~regs->orig_ax; + cpu = smp_processor_id(); + + hardirq[cpu][hardirq_pos[cpu]] = vector; + hardirq_pos[cpu]+=1; + //printk(KERN_INFO "[%d] local_apic_timer starts\n", cpu); + //printk(KERN_INFO "hardirq[%d] = %d, hardirq_pos[%d] = %d\n", cpu, hardirq[cpu][hardirq_pos[cpu]], cpu, hardirq_pos[cpu]); + } + return 0; + return 0; +} + +int j__handle_domain_irq(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + int vector = 0; + unsigned int hwirq = regs->regs[1]; + if (step == 1) { + // Get information for do_IRQ +// vector = ~regs->orig_ax; + cpu = smp_processor_id(); + + hardirq[cpu][hardirq_pos[cpu]] = hwirq; + hardirq_pos[cpu]+=1; + if (hardirq_pos[cpu] >= HARDIRQ_SIZE) + pr_info("hardirq pos overflow !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + //printk(KERN_INFO "[%d] local_apic_timer starts\n", cpu); + //printk(KERN_INFO "hardirq[%d] = %d, hardirq_pos[%d] = %d\n", cpu, hardirq[cpu][hardirq_pos[cpu]], cpu, hardirq_pos[cpu]); + } + return 0; + return 0; +} + +int j_do_handle_IPI(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + int vector = 0; + int ipinr = regs->regs[0]; + if (step == 1) { + // Get information for do_IRQ +// vector = ~regs->orig_ax; + cpu = smp_processor_id(); + + hardirq[cpu][hardirq_pos[cpu]] = ipinr; + hardirq_pos[cpu]+=1; + if (hardirq_pos[cpu] >= HARDIRQ_SIZE) + pr_info("hardirq pos overflow !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + //printk(KERN_INFO "[%d] local_apic_timer starts\n", cpu); + //printk(KERN_INFO "hardirq[%d] = %d, hardirq_pos[%d] = %d\n", cpu, hardirq[cpu][hardirq_pos[cpu]], cpu, hardirq_pos[cpu]); + } + return 0; + return 0; +} + +static int j_aio_complete(struct kprobe *p, struct pt_regs *regs) { + int cpu = smp_processor_id(); + aiotag[cpu] = 1; + //return 0; + return 0; +} + +static int j_wakeup_softirqd(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = KSOFTIRQ; + } + //return 0; + return 0; +} + +static struct kprobe jp1 = { + .pre_handler = j___switch_to, + .symbol_name = "__switch_to", +}; + +static struct kprobe jp2 = { + .pre_handler = j_try_to_wake_up, + .symbol_name = "try_to_wake_up", +}; + +static struct kprobe jp3 = { + .pre_handler = j_tasklet_hi_action, + .symbol_name = "tasklet_hi_action", +}; + +static struct kprobe jp4 = { + .pre_handler = j_run_timer_softirq, + .symbol_name = "run_timer_softirq", +}; + +static struct kprobe jp5 = { + .pre_handler = j_net_tx_action, + .symbol_name = "net_tx_action", +}; + +static struct kprobe jp6 = { + .pre_handler = j_net_rx_action, + .symbol_name = "net_rx_action", +}; + +static struct kprobe jp7 = { + .pre_handler = j_blk_done_softirq, + .symbol_name = "blk_done_softirq", +}; + +static struct kprobe jp8 = { + .pre_handler = j_blk_iopoll_softirq, + .symbol_name = "irq_poll_softirq", +}; + +static struct kprobe jp9 = { + .pre_handler = j_tasklet_action, + .symbol_name = "tasklet_action", +}; + +static struct kprobe jp10 = { + .pre_handler = j_run_rebalance_domains, + .symbol_name = "run_rebalance_domains", +}; + +static struct kprobe jp11 = { + .pre_handler = j_run_hrtimer_softirq, + .symbol_name = "run_hrtimer_softirq", +}; + +static struct kprobe jp12 = { + .pre_handler = j_rcu_process_callbacks, + .symbol_name = "rcu_process_callbacks", +}; + +// For Local APIC Timer Interrupt +/*static struct kprobe jp13 = { + .pre_handler = j_local_apic_timer_interrupt, + .symbol_name = "local_apic_timer_interrupt", +}; + +// For HardIRQ +static struct kprobe jp14 = { + .pre_handler = j_do_IRQ, + .symbol_name = "do_IRQ", +};*/ + +static struct kprobe jp13 = { + .pre_handler = j__handle_domain_irq, + .symbol_name = "__handle_domain_irq", +}; + +// For HardIRQ +static struct kprobe jp14 = { + .pre_handler = j_do_handle_IPI, + .symbol_name = "do_handle_IPI", +}; +//static struct kprobe jp15 = { +// .pre_handler = j_aio_complete, +// .kp = { +// .symbol_name = "aio_complete", +// }, +//}; +// For ksoftirq waking up +//static struct kprobe jp15 = { +// .pre_handler = j_wakeup_softirqd, +// .kp = { +// .symbol_name = "wakeup_softirqd", +// }, +//}; + + +// Add it temporarily for do_softirq +static int j___do_softirq(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + u64 ts; + char *chartmp; + struct softirq_result sr; + if (step == 1) { + cpu = smp_processor_id(); + ts = fang_clock(); + spin_lock(&futex_lock); + stime[cpu] = ts; + spin_unlock(&futex_lock); + } + //return 0; + return 0; +} + +static struct kprobe jp16 = { + .pre_handler = j___do_softirq, + .symbol_name = "__do_softirq", +}; + +int j_add_interrupt_randomness(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + int vector = 0; + if (step == 1) { + cpu = smp_processor_id(); + + hardirq[cpu][hardirq_pos[cpu]] = RANDOM; + hardirq_pos[cpu]+=1; + if (hardirq_pos[cpu] >= HARDIRQ_SIZE) + pr_info("hardirq pos overflow !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + //printk(KERN_INFO "[%d] local_apic_timer starts\n", cpu); + //printk(KERN_INFO "hardirq[%d] = %d, hardirq_pos[%d] = %d\n", cpu, hardirq[cpu][hardirq_pos[cpu]], cpu, hardirq_pos[cpu]); + } + return 0; +} + +// Special case for add_interrupt_randomness +static struct kprobe jp17 = { + .pre_handler = j_add_interrupt_randomness, + .symbol_name = "add_interrupt_randomness", +}; + + +inline int compareDisk(const char *dname_tmp) { + int i = 0; + for (; i < dnum; i++) { + if (strcmp(dname_tmp, dname[i]) == 0) { + return i; + } + } + return -1; +} + +#ifdef NEWKERNEL +static int j_part_round_stats(struct kprobe *p, struct pt_regs *regs) { + //return 0; + return 0; +} +#else +static void old_part_round_stats_single(struct hd_struct *part, unsigned long now) { + int inflight; + const char *dname_tmp = NULL; + struct device *ddev = NULL; + int pos = 0; + + ddev = part_to_dev(part); + dname_tmp = dev_name(ddev); + + pos = compareDisk(dname_tmp); + + if (pos >= 0) { + if (now == part->stamp) { + } + else { + inflight = part_in_flight(part); + if (inflight) { + disk_work[pos] += now - part->stamp; + } + } + } +} + +static void j_part_round_stats(int cpu, struct hd_struct *part) { + unsigned long now = jiffies; + + if (step == 1) { + if (part->partno) { + old_part_round_stats_single(&part_to_disk(part)->part0, now); + } + old_part_round_stats_single(part, now); + } + return 0; +} +#endif +/* +static void j_part_round_stats_single(int cpu, struct hd_struct *part, unsigned long now) { + int inflight; + const char *dname_tmp = NULL; + struct device *ddev = NULL; + int pos = 0; + + if (step == 1) { + ddev = part_to_dev(part); + dname_tmp = dev_name(ddev); + + pos = compareDisk(dname_tmp); + if (pos >= 0) { + if (now == part->stamp) { + } + else { + #ifndef NEWKERNEL + inflight = part_in_flight(part); + #endif + if (inflight) { + disk_work[pos] += now - part->stamp; + //spin_lock(&futex_lock); + //sr.type = 1; + //sr.stime = part->stamp; + //sr.etime = now; + //sr.core = cpu; + //chartmp = (char *)(futex_result + futex_pos); + //memcpy(chartmp, &sr, sizeof(sr)); + //futex_pos+=sizeof(sr); + //spin_unlock(&futex_lock); + } + } + } + } + return 0; +} +*/ +static struct kprobe jp18 = { + .pre_handler = j_part_round_stats, + .symbol_name = "part_round_stats", +}; + +static int j_futex_wait_queue_me(struct kprobe *p, struct pt_regs *regs) { + struct futex_hash_bucket *hb = regs->regs[0]; + struct futex_q *q = regs->regs[1]; + struct hrtimer_sleeper *timeout = regs->regs[2]; + struct fang_uds fuds; + char *chartmp = NULL; + if (step == 1) { + if (current->tgid==target[0]) { + fuds.ts = fang_clock(); + fuds.pid = current->pid; + fuds.type = 1; + + spin_lock(&wait_lock); + chartmp = (char *)(wait_result + wait_pos); + memcpy(chartmp, &fuds, sizeof(fuds)); + wait_pos+=sizeof(fuds); + spin_unlock(&wait_lock); + } + } + //return 0; + return 0; +} + +static struct kprobe jp19 = { + .pre_handler = j_futex_wait_queue_me, + .symbol_name = "futex_wait_queue_me", +}; + +static int j_journal_end_buffer_io_sync(struct kprobe *p, struct pt_regs *regs) { + printk(KERN_INFO "I/O sync is happended in softirq context? %s", in_serving_softirq()>0?"True":"False"); + return 0; + //return 0; +} + +static struct kprobe jp20 = { + .pre_handler = j_journal_end_buffer_io_sync, + .symbol_name = "journal_end_buffer_io_sync", +}; + +int j_wake_up_new_task(struct kprobe *kp, struct pt_regs *regs) { + struct task_struct *p = regs->regs[0]; + if (step == 1) { + if (p->tgid == target[0]) { + u64 ts = fang_clock(); + int cpu = smp_processor_id(); + struct fang_result fresult; + char *chartmp = NULL; + fresult.type = 2; + fresult.ts = ts; + fresult.perfts = wperfclock(); + fresult.core = cpu; + fresult.pid1 = current->pid; + fresult.pid2 = p->pid; + fresult.pid1state = current->state; + fresult.pid2state = p->state; + trace_printk("wake up new cur %s next %s\n", current->comm, p->comm); + + spin_lock(&switch_lock); + chartmp = (char *)(switch_result + switch_pos); + memcpy(chartmp, &fresult, sizeof(fresult)); + switch_pos+=sizeof(fresult); + spin_unlock(&switch_lock); + + printk(KERN_INFO "[Create] Thread %d creates thread %d time %lld\n", current->pid, p->pid, ts); + trace_printk("create cur %s p %s\n", current->comm, p->comm); + } + } + return 0; +} + +static struct kprobe jp21 = { + .pre_handler = j_wake_up_new_task, + .symbol_name = "wake_up_new_task", +}; + +int j_do_exit(struct kprobe *p, struct pt_regs *regs) { + if (step == 1) { + if (current->tgid == target[0]) { + u64 ts = fang_clock(); + int cpu = smp_processor_id(); + char *chartmp = NULL; + struct fang_result fresult; + fresult.type = 3; + fresult.ts = ts; + fresult.perfts = wperfclock(); + fresult.core = cpu; + fresult.pid1 = current->pid; + fresult.pid2 = 0; + fresult.pid1state = current->state; + fresult.pid2state = 0; + + spin_lock(&switch_lock); + chartmp = (char *)(switch_result + switch_pos); + memcpy(chartmp, &fresult, sizeof(fresult)); + switch_pos+=sizeof(fresult); + spin_unlock(&switch_lock); + + printk(KERN_INFO "[Finish] Thread %d finishes time %lld\n", current->pid, ts); + } + } + return 0; +} + +static struct kprobe jp22 = { + .pre_handler = j_do_exit, + .symbol_name = "do_exit", +}; + +int j_tcp_sendmsg(struct kprobe *p, struct pt_regs *regs) { + struct sock *sk = regs->regs[0]; + struct msghdr *msg = regs->regs[1]; + if (step == 1) { + if (containOfPID(0, current->tgid)) { + if (current->pid >= NETSEND_SIZE) + pr_info("netsend overflow !!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + netsend[current->pid] += (&msg->msg_iter)->count; + } + } + return 0; + return 0; +} + +static struct kprobe jp26 = { + .pre_handler = j_tcp_sendmsg, + .symbol_name = "tcp_sendmsg", +}; + + +int j_udp_sendmsg(struct kprobe *p, struct pt_regs *regs) { + struct sock *sk = regs->regs[0]; + struct msghdr *msg = regs->regs[1]; + if (step == 1) { + if (containOfPID(0, current->tgid)) { + if (current->pid >= NETSEND_SIZE) + pr_info("netsend overflow !!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + netsend[current->pid] += (&msg->msg_iter)->count; + } + } + return 0; + return 0; +} + +static struct kprobe jp27 = { + .pre_handler = j_udp_sendmsg, + .symbol_name = "udp_sendmsg", +}; + +int j_tcp_sendpage(struct kprobe *p, struct pt_regs *regs) { + struct sock *sk = regs->regs[0]; + struct page *page = regs->regs[1]; + int offset = regs->regs[2]; + size_t size = regs->regs[3]; + if (step == 1) { + if (containOfPID(0, current->tgid)) { + if (current->pid >= NETSEND_SIZE) + pr_info("netsend overflow !!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + netsend[current->pid] += size; + } + } + return 0; + return 0; +} + +static struct kprobe jp28 = { + .pre_handler = j_tcp_sendpage, + .symbol_name = "tcp_sendpage", +}; + +int j_udp_sendpage(struct kprobe *p, struct pt_regs *regs) { + struct sock *sk = regs->regs[0]; + struct page *page = regs->regs[1]; + int offset = regs->regs[2]; + size_t size = regs->regs[3]; + if (step == 1) { + if (containOfPID(0, current->tgid)) { + if (current->tgid >= NETSEND_SIZE) + pr_info("netsend overflow !!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + netsend[current->pid] += size; + } + } + return 0; + return 0; +} + +static struct kprobe jp29 = { + .pre_handler = j_udp_sendpage, + .symbol_name = "udp_sendpage", +}; + + +int j_sock_sendmsg(struct kprobe *p, struct pt_regs *regs) { + struct socket *sock = regs->regs[0]; + struct msghdr *msg = regs->regs[1]; + //struct fang_uds fuds; + //char *chartmp = NULL; + if (step == 1) { + if (containOfPID(0, current->tgid)) { + if (current->pid >= NETSEND_SIZE) + pr_info("netsend overflow !!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + netsend[current->pid] += (&msg->msg_iter)->count; + + //fuds.ts = fang_clock(); + //fuds.pid = current->pid; + //fuds.type = 2; + + //spin_lock(&wait_lock); + //chartmp = (char *)(wait_result + wait_pos); + //memcpy(chartmp, &fuds, sizeof(fuds)); + //wait_pos+=sizeof(fuds); + //spin_unlock(&wait_lock); + } + } + return 0; + return 0; +} + +static struct kprobe jp23 = { + .pre_handler = j_sock_sendmsg, + .symbol_name = "sock_sendmsg", +}; + +static long j_futex_wait_restart(struct kprobe *p, struct pt_regs *regs) { + if (step == 1) { + printk(KERN_INFO "Core %d Thread %d futex_wait_restart Time %llu\n", smp_processor_id(), current->pid, fang_clock()); + } + return 0; + return 0; +} + +int j_do_futex(struct kprobe *p, struct pt_regs *regs) { +// u32 __user *uaddr, int op, u32 val, ktime_t *timeout, +// u32 __user *uaddr2, u32 val2, u32 val3) { +//static int j_futex_wake(u32 __user *uaddr, unsigned int flags, int nr_wake, u32 bitset) { + struct fang_uds fuds; + char *chartmp = NULL; + if (step == 1) { + if (current->tgid==target[0]) { + fuds.ts = fang_clock(); + fuds.pid = current->pid; + fuds.type = 1; + + spin_lock(&wait_lock); + chartmp = (char *)(wait_result + wait_pos); + memcpy(chartmp, &fuds, sizeof(fuds)); + wait_pos+=sizeof(fuds); + spin_unlock(&wait_lock); + } + } + return 0; + return 0; +} + +static struct kprobe jp24 = { + //.pre_handler = j_futex_wake, + .pre_handler = j_do_futex, + .symbol_name = "do_futex", + //.addr = (kprobe_opcode_t *) kallsyms_lookup_name("futex_wait_restart"), +}; + +static int j___lock_sock(struct kprobe *p, struct pt_regs *regs) { + struct fang_uds fuds; + char *chartmp = NULL; + if (step == 1) { + if (current->tgid==target[0]) { + fuds.ts = fang_clock(); + fuds.pid = current->pid; + fuds.type = 3; + + spin_lock(&wait_lock); + chartmp = (char *)(wait_result + wait_pos); + memcpy(chartmp, &fuds, sizeof(fuds)); + wait_pos+=sizeof(fuds); + spin_unlock(&wait_lock); + } + } + return 0; +} +static struct kprobe jp25 = { + //.pre_handler = j_futex_wake, + .pre_handler = j___lock_sock, + .symbol_name = "__lock_sock", + //.addr = (kprobe_opcode_t *) kallsyms_lookup_name("futex_wait_restart"), +}; + + + + +int open(struct inode *inode, struct file *filp) +{ + trace_printk("inside open\n"); + printk(KERN_INFO "Inside open %llu\n", fang_clock()); + return 0; +} + +int release(struct inode *inode, struct file *filp) { + int i = 0; + printk (KERN_INFO "Inside close %llu\n", fang_clock()); + for (i = 0; i < dnum; i++) { + printk(KERN_INFO "Disk %s work time: %ld\n", dname[i], disk_work[i]); + } + for (i = 0; i < NETSEND_SIZE; i++) { + if (netsend[i] != 0) { + printk(KERN_INFO "Thread %d sends bytes: %ld\n",i, netsend[i]); + } + } + +// printk(KERN_INFO "futex with timeout: %ld\n", futex_to); +// printk(KERN_INFO "futex without timeout: %ld\n", futex_noto); + + return 0; +} + +static int tasklet_hi_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret3 = { + .handler = tasklet_hi_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "tasklet_hi_action", }, + //.maxactive = MAX_CPU_NR, +}; + +static int timer_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret4 = { + .handler = timer_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "run_timer_softirq", }, + //.maxactive = MAX_CPU_NR, +}; + +static int net_tx_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret5 = { + .handler = net_tx_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "net_tx_action", }, + //.maxactive = MAX_CPU_NR, +}; + +static int net_rx_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + //if (cpu == 7) { + // printk(KERN_INFO "[%d]softirq[cpu] = %d\n", cpu, softirq[cpu]); + //} + } + return 0; +} + +static struct kretprobe kret6 = { + .handler = net_rx_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "net_rx_action", }, + //.maxactive = MAX_CPU_NR, +}; + +static int blk_done_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret7 = { + .handler = blk_done_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "blk_done_softirq", }, + //.maxactive = MAX_CPU_NR, +}; + +static int blk_iopoll_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret8 = { + .handler = blk_iopoll_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "irq_poll_softirq", }, + //.maxactive = MAX_CPU_NR, +}; + +static int tasklet_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret9 = { + .handler = tasklet_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "tasklet_action", }, + //.maxactive = MAX_CPU_NR, +}; + +static int sched_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret10 = { + .handler = sched_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "run_rebalance_domains", }, + //.maxactive = MAX_CPU_NR, +}; + +static int hrtimer_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret11 = { + .handler = hrtimer_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "run_hrtimer_softirq", }, + //.maxactive = MAX_CPU_NR, +}; + +static int rcu_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret12 = { + .handler = rcu_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "rcu_process_callbacks", }, + //.maxactive = MAX_CPU_NR, +}; + +static int handle_domain_irq_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + if (hardirq_pos[cpu] != 0) hardirq_pos[cpu]-=1; + //printk(KERN_INFO "[%d] local_apic_timer ends\n", cpu); + //printk(KERN_INFO "hardirq_pos[%d] = %d\n", cpu, hardirq_pos[cpu]); + } + return 0; +} + +static struct kretprobe kret13 = { + .handler = handle_domain_irq_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "__handle_domain_irq", }, + //.maxactive = 1024, +}; + +static int do_handle_IPI_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + if (hardirq_pos[cpu] != 0) hardirq_pos[cpu]-=1; + //printk(KERN_INFO "[%d] local_apic_timer ends\n", cpu); + //printk(KERN_INFO "hardirq_pos[%d] = %d\n", cpu, hardirq_pos[cpu]); + } + return 0; +} + +static struct kretprobe kret14 = { + .handler = do_handle_IPI_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "do_handle_IPI", }, + //.maxactive = 1024, +}; + +static int KSOFTIRQ_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +//static struct kretprobe kret15 = { +// .handler = KSOFTIRQ_return, +// .maxactive = NR_CPUS, +// .kp = { .symbol_name = "wakeup_softirqd", }, +// //.maxactive = MAX_CPU_NR, +//}; + +static int SOFTIRQ_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + u64 ts; + char *chartmp; + struct softirq_result sr; + if (step == 1) { + cpu = smp_processor_id(); + ts = fang_clock(); + spin_lock(&futex_lock); + sr.type = 0; + sr.stime = stime[cpu]; + sr.etime = ts; + sr.core = cpu; + chartmp = (char *)(futex_result + futex_pos); + memcpy(chartmp, &sr, sizeof(sr)); + futex_pos+=sizeof(sr); + spin_unlock(&futex_lock); + } + return 0; +} + +static struct kretprobe kret16 = { + .handler = SOFTIRQ_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "__do_softirq", }, + //.maxactive = MAX_CPU_NR, +}; + +// Special for random generator in do_IRQ +static int RANDOM_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + if (hardirq_pos[cpu] != 0) hardirq_pos[cpu]-=1; + } + return 0; +} + +static struct kretprobe kret17 = { + .handler = RANDOM_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "add_interrupt_randomness", }, + //.maxactive = MAX_CPU_NR, +}; + +static int switch_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu=smp_processor_id(); + //if (dump_cpu_check[cpu]>0) { + //printk(KERN_INFO "threadID = %d\n", dump_cpu_check[cpu]); + //dump_stack(); + //dump_cpu_check[cpu]=0; + //} + } + return 0; +} + +static struct kretprobe kret18 = { + .handler = switch_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "finish_task_switch", }, + //.maxactive = MAX_CPU_NR, +}; + +static int futex_wait_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + struct fang_uds fuds; + char *chartmp = NULL; + if (step == 1) { + //int retval = regs_return_value(regs); + //int cpu = smp_processor_id(); + if (current->tgid==target[0]) { + fuds.ts = fang_clock(); + fuds.pid = current->pid; + fuds.type = 4; + + spin_lock(&wait_lock); + chartmp = (char *)(wait_result + wait_pos); + memcpy(chartmp, &fuds, sizeof(fuds)); + wait_pos+=sizeof(fuds); + spin_unlock(&wait_lock); + } + + /* + if (containOfPID(cpu, current->tgid) && retval < 0) { + + //printk(KERN_INFO "Core %d Thread %d RetValue %d Time %llu\n", smp_processor_id(), current->pid, retval, fang_clock()); + fuds.ts = fang_clock(); + fuds.pid = current->pid; + fuds.type = (short)retval; + + spin_lock(&wait_lock); + chartmp = (char *)(wait_result + wait_pos); + memcpy(chartmp, &fuds, sizeof(fuds)); + wait_pos+=sizeof(fuds); + spin_unlock(&wait_lock); + } + */ + } + return 0; +} + +static struct kretprobe kret19 = { + .handler = futex_wait_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "futex_wait", }, + //.maxactive = MAX_CPU_NR, +}; + +long ioctl_funcs(struct file *filp,unsigned int cmd, unsigned long arg) +{ + + unsigned long ret = 0; + int tres; + char tmp[200]; + char *chartmp = NULL; + //struct timeval start; + unsigned long start; + struct fang_uds fuds; + struct fang_spin_uds spin_uds; + struct uds_spin_res spin_res; + int i = 0, cpu = 0; + + switch(cmd) { + case IOCTL_ADDWAIT: + if (step == 1) { + fuds.ts = fang_clock(); + fuds.pid = current->pid; + fuds.type = (short)arg; + spin_lock(&wait_lock); + chartmp = (char *)(wait_result + wait_pos); + memcpy(chartmp, &fuds, sizeof(fuds)); + wait_pos+=sizeof(fuds); + spin_unlock(&wait_lock); + } + break; + case IOCTL_ADDUDS: + if (step == 1) { + spin_uds.ts = fang_clock(); + spin_uds.pid = current->pid; + copy_from_user(&spin_res, (void*)arg, 12); + spin_uds.lock = spin_res.addr; + spin_uds.type = spin_res.type; + //fuds.ts = fang_clock(); + //fuds.pid = current->pid; + //fuds.type = (short)arg; + spin_lock(&state_lock); + //chartmp = (char *)(state_result + state_pos); + chartmp = (char *)(state_result + state_pos); + memcpy(chartmp, &spin_uds, sizeof(spin_uds)); + state_pos+=sizeof(spin_uds); + spin_unlock(&state_lock); + } + break; + case IOCTL_PID: + //printk(KERN_INFO "Setting PID = %d\n", (int)pid); + //for_each_process(p) { + // if (task_pid_nr(p)==pid) break; + //} + //target[0] = pid; + switch_pos = 0; + futex_pos = 0; + state_pos = 0; + wait_pos = 0; + + for (i=0;i<20;i++){ + disk_work[i] = 0; + } + + for (i=0; i<NETSEND_SIZE; i++) { + netsend[i] = 0; + //futextag[i] = 0; + //futexstart[i] = 0; + //futexsum[i] = 0; + } + + for (i = 0; i < PIDNUM; i++) { + target[i] = 0; + } + + dnum = 0; + + futex_to = 0; + futex_noto = 0; + + readTarget(); + + step = 1; + break; + + case IOCTL_INIT: + step = -1; + break; + + case IOCTL_COPYSWITCH: + spin_lock(&switch_lock); + ret = switch_pos; + switch_pos = 0; + switch_result_tmp = switch_result; + switch_result = switch_result_bak; + spin_unlock(&switch_lock); + switch_result_bak = switch_result_tmp; + tres = copy_to_user((void*)arg, switch_result_bak, ret); + break; + + case IOCTL_COPYWAIT: + spin_lock(&wait_lock); + ret = wait_pos; + wait_pos = 0; + wait_result_tmp = wait_result; + wait_result = wait_result_bak; + spin_unlock(&wait_lock); + wait_result_bak = wait_result_tmp; + tres = copy_to_user((void*)arg, wait_result_bak, ret); + break; + + case IOCTL_STATE_BEGIN: + sprintf(tmp, "Sample %d\n", state_total); + spin_lock(&switch_lock); + chartmp = (char *)(switch_result + switch_pos); + memcpy(chartmp, tmp, strlen(tmp)); + switch_pos+=strlen(tmp); + spin_unlock(&switch_lock); + step = 2; + state_total++; + break; + + case IOCTL_STATE_END: + step = -1; + + if (switch_pos > BSIZE) { + ret = 1; + } + else { + ret = 0; + } + //ret = 1; + break; + case IOCTL_FUTEX: + spin_lock(&futex_lock); + tag = 0; + fnum = 0; + wnum = 0; + chartmp = (char *)(futex_result + futex_pos); + memcpy(chartmp, tmp, strlen(tmp)); + futex_pos+=strlen(tmp); + futex_total++; + spin_unlock(&futex_lock); + break; + + case IOCTL_JPROBE: + break; + + case IOCTL_UNJPROBE: + break; + case IOCTL_JSWITCH: + break; + case IOCTL_COPYSTATE: + spin_lock(&state_lock); + ret = state_pos; + state_pos = 0; + state_result_tmp = state_result; + state_result = state_result_bak; + spin_unlock(&state_lock); + state_result_bak = state_result_tmp; + tres = copy_to_user((void*)arg, state_result_bak, ret); + //printk(KERN_INFO "state_pos = %d\n", state_pos); + break; + case IOCTL_COPYFUTEX: + spin_lock(&futex_lock); + ret = futex_pos; + futex_pos = 0; + futex_result_tmp = futex_result; + futex_result = futex_result_bak; + spin_unlock(&futex_lock); + futex_result_bak = futex_result_tmp; + tres = copy_to_user((void*)arg, futex_result_bak, ret); + break; + case IOCTL_COPYBUFFER: + break; + case IOCTL_GETENTRY: + spin_lock(&switch_lock); + ret = copy_to_user((void*)arg, switch_result, switch_pos); + ret = switch_pos; + switch_pos = 0; + spin_unlock(&switch_lock); + break; + case IOCTL_STEP1_BEGIN: + switch_pos = 0; + state_pos = 0; + futex_pos = 0; + wait_pos = 0; + spin_lock(&switch_lock); + t = p; + ptmp = p; + do { + start = ktime_get_ns(); + //do_gettimeofday(&start); + } while_each_thread(ptmp, t); + + printk(KERN_INFO "start time: sec = %ld usec = %ld\n", start/NSEC_PER_SEC, (start%NSEC_PER_SEC)/1000); + //step = 1; + spin_unlock(&switch_lock); + break; + case IOCTL_STEP1_END: + spin_lock(&switch_lock); + start = ktime_get_ns(); + //do_gettimeofday(&start); + lastsec = start/NSEC_PER_SEC;//start.tv_sec; + lastusec = (start%NSEC_PER_SEC)/1000;//start.tv_usec; + printk(KERN_INFO "end time: sec = %ld usec = %ld\n", lastsec, lastusec); + step = -1; + spin_unlock(&switch_lock); + break; + case IOCTL_USER_STACK: + //for_each_process(p) { + // if (task_pid_nr(p)==pid) break; + //} + //struct pt_regs *regs = task_pt_regs(p); + //printk(KERN_INFO "IP=%ld, BP=%ld\n", regs->ip, regs->bp); + //long currbp = regs->bp; + //int currpos = 0; + //while(currbp!=0 || currpos > 10) { + // copy_from_user(&currbp, currbp, 8); + // printk(KERN_INFO "Next BP = %ld", currbp); + //} + break; + case IOCTL_DNAME: + tres = copy_from_user(&dname[dnum], (void*)arg, 20); + printk(KERN_INFO "Monitored Disk: %s\n", dname[dnum]); + dnum++; + break; + case IOCTL_SPINLOCK: + cpu = smp_processor_id(); + spin_result[cpu].type = (short)arg; + spin_result[cpu].core = cpu; + spin_result[cpu].ts = fang_clock(); + spin_result[cpu].pid1 = current->pid; + spin_lock(&switch_lock); + chartmp = (char *)(switch_result + switch_pos); + memcpy(chartmp, &spin_result[cpu], sizeof(spin_result[cpu])); + switch_pos+=sizeof(spin_result[cpu]); + spin_unlock(&switch_lock); + break; + case IOCTL_TIME: + printk(KERN_INFO "now = %llu\n", ktime_get()); + break; + } + return ret; +} + +struct file_operations fops = { + open: open, + unlocked_ioctl: ioctl_funcs, + release: release +}; + +struct cdev *kernel_cdev; +dev_t dev_no, dev; + + +#include <asm/uaccess.h> +#include <asm/processor.h> + +//Fang added +int readTarget(void) { + //mm_segment_t fs; + struct file *filp = NULL; + char buf[10240] = { 0}; + int tmppos= 0; + int pidpos = 0; + char buftmp[64] = {0 }; + char* buftmp1; + int i = 0; + int ret; + + //fs = get_fs(); + //set_fs(KERNEL_DS); + trace_printk("in read target\n"); + + filp = filp_open("/tmp/target", O_RDONLY, 0); + if (filp==NULL) { + printk(KERN_ERR "Error: something wrong with the pid target file!\n"); + return -1; + } + //pr_info("filp %lx\n", filp); +#ifdef NEWKERNEL + ret = kernel_read(filp, buf, 10240, &filp->f_pos); + trace_printk("kernel read return %d\n", ret); + //kernel_read(filp, &filp->f_pos, buf, 10240); +#else + vfs_read(filp, buf, 10240, &filp->f_pos); +#endif + //filp->f_op->read(filp, buf, 1024, &filp->f_pos); + filp_close(filp,NULL); + //set_fs(fs); + //pr_info("buf %x\n", buf); + + i=0; + tmppos= 0; + + while(buf[i]) { + if (buf[i]=='\n') { + buftmp[tmppos]='\0'; + //printk(KERN_INFO "%d\n", simple_strtol(buftmp, &buftmp1, 10)); + target[pidpos] = simple_strtol(buftmp, &buftmp1, 10); + //trace_printk("target %d\n", target[pidpos]); + pidpos++; + tmppos = 0; + if (pidpos >= PIDNUM) + pr_info("pidpos exceed !!!!!!!!!\n"); + } + else { + buftmp[tmppos] = buf[i]; + tmppos++; + if (tmppos >= 64) { + pr_info("tmp pos exceedd!!!!!!!!!!\n"); + return 0; + } + } + i++; + if (i >= 10240) + pr_info("i exceed !!!!!!!!!!!!!!\n"); + } + return 0; +} + +int char_arr_init (void) { + int ret = 0; + int i = 0; + + for (i= 0;i<PIDNUM;i++) { + target[i] = 0; + } + + for (i= 0;i<NR_CPUS;i++) { + softirq[i] = 0; + hardirq_pos[i] = 0; + aiotag[i] = 0; + } + + for (i=0; i<NETSEND_SIZE; i++) { + netsend[i] = 0; + //futextag[i] = 0; + //futexstart[i] = 0; + //futexsum[i] = 0; + } + + readTarget(); + + //Check dname + //if (strcmp(dname, "") == 0) { + // printk(KERN_ERR "Error: no device name!\n"); + // return 1; + //} + //else { + // printk(KERN_INFO "Device name: %s\n", dname); + //} + //Init the file read + //fang_curr_task = (struct task_struct *(*)(int))0xffffffff870d0180; + //fang_curr_task = (struct task_struct *(*)(int))kallsyms_lookup_name("curr_task"); + //fang_get_futex_key = (int (*)(u32 __user *, int, union futex_key *, int))kallsyms_lookup_name("get_futex_key"); + //fang_hash_futex = (struct futex_hash_bucket *(*)(union futex_key *))kallsyms_lookup_name("hash_futex"); + //fang_futex_wait_setup = (int (*)(u32 __user *, u32, unsigned int, struct futex_q *, struct futex_hash_bucket **))kallsyms_lookup_name("futex_wait_setup"); + //fang_futex_wait_restart = (long (*)(struct restart_block *)kallsyms_lookup_name("futex_wait_restart"); + //For kernel version larger than 4.8 + //#ifdef NEWKERNEL + //local_clock = (u64 (*)(void))kallsyms_lookup_name("local_clock"); + //#endif + + //printk(KERN_INFO "curr_task = %lx\n", kallsyms_lookup_name("curr_task")); + //printk(KERN_INFO "get_futex_key = %lx\n", kallsyms_lookup_name("get_futex_key")); + //printk(KERN_INFO "hash_futex = %lx\n", kallsyms_lookup_name("hash_futex")); + //printk(KERN_INFO "futex_wait_setup = %lx\n", kallsyms_lookup_name("futex_wait_setup")); + + ret = alloc_chrdev_region(&dev, 0, 1, "wperf"); + if (ret) + pr_info("alloc chrdev failed\n"); + + kernel_cdev = cdev_alloc(); + kernel_cdev->ops = &fops; + kernel_cdev->owner = THIS_MODULE; + printk (" Inside init module\n"); + + ret = cdev_add( kernel_cdev,dev,1); + + if(ret < 0 ) + { + printk(KERN_INFO "Unable to allocate cdev"); + return ret; + } + + Major = MAJOR(dev); + //dev = MKDEV(Major,0); + printk (" The major number for your device is %d\n", Major); + + state_result = (char*)vmalloc(BMAX*sizeof(char)); + state_result_bak = (char*)vmalloc(BMAX*sizeof(char)); + futex_result = (char*)vmalloc(BMAX*sizeof(char)); + futex_result_bak = (char*)vmalloc(BMAX*sizeof(char)); + switch_result = (char*)vmalloc(BMAX*sizeof(char)); + switch_result_bak = (char*)vmalloc(BMAX*sizeof(char)); + + wait_result = (char*)vmalloc(BMAX*sizeof(char)); + wait_result_bak = (char*)vmalloc(BMAX*sizeof(char)); + + spin_lock_init(&switch_lock); + spin_lock_init(&state_lock); + spin_lock_init(&futex_lock); + spin_lock_init(&wait_lock); + + ret = register_kprobe(&jp1); + if (ret ) + printk(KERN_INFO "register_kprobe failed, returned %d\n", ret); + else + pr_info("register kprobe success\n"); + ret = register_kprobe(&jp2); + if (ret) { + printk(KERN_INFO "register_kprobe failed, returned %d\n", ret); + //return ret; + } + ret = register_kprobe(&jp3); + if (ret) + pr_info("register kprobe failed1\n"); + ret = register_kprobe(&jp4); + if (ret) + pr_info("register kprobe failed2\n"); + ret = register_kprobe(&jp5); + if (ret) + pr_info("register kprobe failed3\n"); + if (register_kprobe(&jp6)) { + printk(KERN_INFO "register net_rx jprobe failed!\n"); + } + ret = register_kprobe(&jp7); + if (ret) + pr_info("register kprobe failed4\n"); + ret = register_kprobe(&jp8); + if (ret) + pr_info("register kprobe failed5\n"); + ret = register_kprobe(&jp9); + if (ret) + pr_info("register kprobe failed6\n"); + ret = register_kprobe(&jp10); + if (ret) + pr_info("register kprobe failed7\n"); + //register_kprobe(&jp11); + ret = register_kprobe(&jp12); + if (ret) + pr_info("register kprobe rcu_process_callbacks failed8\n"); + //if (register_kprobe(&jp13)) { + // printk(KERN_INFO "register apic jprobe failed!%d\n"); + //} + + //register_kprobe(&jp14); + //register_kprobe(&jp15); + ret = register_kprobe(&jp16); + if (ret) + pr_info("register kprobe failed9\n"); + //register_kprobe(&jp17); + ret = register_kprobe(&jp18); + if (ret) + pr_info("register kprobe part_round_stats failed0\n"); + //register_kprobe(&jp19); + //register_kprobe(&jp20); + ret = register_kprobe(&jp21); + if (ret) + pr_info("register kprobe failed12\n"); + ret = register_kprobe(&jp22); + if (ret) + pr_info("register kprobe failed13\n"); + //register_kprobe(&jp23); + //jp24.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("futex_wait_restart"), + //register_kprobe(&jp24); + //register_kprobe(&jp25); + ret = register_kprobe(&jp26); + if (ret) + pr_info("register kprobe failed14\n"); + ret = register_kprobe(&jp27); + if (ret) + pr_info("register kprobe failed15\n"); + ret = register_kprobe(&jp28); + if (ret) + pr_info("register kprobe failed16\n"); + ret = register_kprobe(&jp29); + if (ret) + pr_info("register kprobe failed17\n"); + + + /*kret3.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("tasklet_hi_action"); + kret4.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("run_timer_softirq"); + kret5.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("net_tx_action"); + kret6.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("net_rx_action"); + kret7.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("blk_done_softirq"); + kret8.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("irq_poll_softirq"); + kret9.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("tasklet_action"); + kret10.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("run_rebalance_domains"); + kret11.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("run_hrtimer_softirq"); + kret12.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("rcu_process_callbacks"); + kret13.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("local_apic_timer_interrupt"); + kret14.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("do_IRQ"); +// kret15.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("wakeup_softirqd"); + kret16.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("__do_softirq"); + kret17.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("add_interrupt_randomness"); + //kret18.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("finish_task_switch"); + //kret19.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("futex_wait"); + //kret19.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("__lock_sock"); +*/ + + ret = register_kretprobe(&kret3); + if (ret) { + printk(KERN_INFO "register_kretprobe failed, returned %d\n", ret); + //return ret; + } else + pr_info("register kretprobe success\n"); + ret = register_kretprobe(&kret4); + if (ret) { + printk(KERN_INFO "register_kretprobe2 failed, returned %d\n", ret); + //return ret; + } + ret = register_kretprobe(&kret5); + if (ret) + pr_info("register kretprobe failed1\n"); + ret = register_kretprobe(&kret6); + if (ret) + pr_info("register kretprobe failed2\n"); + ret = register_kretprobe(&kret7); + if (ret) + pr_info("register kretprobe failed3\n"); + ret = register_kretprobe(&kret8); + if (ret) + pr_info("register kretprobe failed4\n"); + ret = register_kretprobe(&kret9); + if (ret) + pr_info("register kretprobe failed5\n"); + ret = register_kretprobe(&kret10); + if (ret) + pr_info("register kretprobe failed6\n"); + //register_kretprobe(&kret11); + ret = register_kretprobe(&kret12); + if (ret) + pr_info("register kretprobe rcu_process_callbacks failed7\n"); + //register_kretprobe(&kret13); + //register_kretprobe(&kret14); + ret = register_kretprobe(&kret16); + if (ret) + pr_info("register kretprobe failed8\n"); + //register_kretprobe(&kret17); + //register_kretprobe(&kret18); + //register_kretprobe(&kret19); + + return 0; +} + +void char_arr_cleanup(void) { + //cdev_del(kernel_cdev); + + unregister_kprobe(&jp1); + + unregister_kprobe(&jp2); + unregister_kprobe(&jp3); + unregister_kprobe(&jp4); + unregister_kprobe(&jp5); + unregister_kprobe(&jp6); + unregister_kprobe(&jp7); + unregister_kprobe(&jp8); + unregister_kprobe(&jp9); + unregister_kprobe(&jp10); + //unregister_kprobe(&jp11); + unregister_kprobe(&jp12); + //unregister_kprobe(&jp13); + //unregister_kprobe(&jp14); + //unregister_kprobe(&jp15); + unregister_kprobe(&jp16); + //unregister_kprobe(&jp17); + unregister_kprobe(&jp18); + //unregister_kprobe(&jp19); + //unregister_kprobe(&jp20); + unregister_kprobe(&jp21); + unregister_kprobe(&jp22); + //unregister_kprobe(&jp23); + //unregister_kprobe(&jp24); + //unregister_kprobe(&jp25); + unregister_kprobe(&jp26); + unregister_kprobe(&jp27); + unregister_kprobe(&jp28); + unregister_kprobe(&jp29); + + + //unregister_kretprobe(&futex_return); + //unregister_kretprobe(&sleep_return); + //unregister_kretprobe(&signal_return); + //unregister_kretprobe(&aio_return); + + unregister_kretprobe(&kret3); + unregister_kretprobe(&kret4); + unregister_kretprobe(&kret5); + unregister_kretprobe(&kret6); + unregister_kretprobe(&kret7); + unregister_kretprobe(&kret8); + unregister_kretprobe(&kret9); + unregister_kretprobe(&kret10); + //unregister_kretprobe(&kret11); + unregister_kretprobe(&kret12); + //unregister_kretprobe(&kret13); + //unregister_kretprobe(&kret14); + unregister_kretprobe(&kret16); + //unregister_kretprobe(&kret17); + //unregister_kretprobe(&kret18); + //unregister_kretprobe(&kret19); + + /* nmissed > 0 suggests that maxactive was set too low. */ + //printk("Missed probing %d instances of %s\n", + // futex_return.nmissed, "do_futex return"); + + unregister_chrdev_region(MKDEV(Major, 0), 1); + cdev_del(kernel_cdev); + + vfree(switch_result); + vfree(switch_result_bak); + vfree(state_result); + vfree(state_result_bak); + vfree(futex_result); + vfree(futex_result_bak); + + vfree(wait_result); + vfree(wait_result_bak); + + printk(KERN_INFO " Inside cleanup_module\n"); +} +MODULE_LICENSE("GPL"); +module_init(char_arr_init); +module_exit(char_arr_cleanup); -- 2.20.1

1 0

[PATCH OLK-5.10] ksmbd: fix out-of-bound read in deassemble_neg_contexts()
by Li Lingfeng 29 Jul '23

29 Jul '23

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.4-rc6 commit f1a411873c85b642f13b01f21b534c2bab81fc1b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7LU2Q CVE: CVE-2023-38427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/f… -------------------------------- The check in the beginning is `clen + sizeof(struct smb2_neg_context) <= len_of_ctxts`, but in the end of loop, `len_of_ctxts` will subtract `((clen + 7) & ~0x7) + sizeof(struct smb2_neg_context)`, which causes integer underflow when clen does the 8 alignment. We should use `(clen + 7) & ~0x7` in the check to avoid underflow from happening. Then there are some variables that need to be declared unsigned instead of signed. [ 11.671070] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x799/0x1610 [ 11.671533] Read of size 2 at addr ffff888005e86cf2 by task kworker/0:0/7 ... [ 11.673383] Call Trace: [ 11.673541] <TASK> [ 11.673679] dump_stack_lvl+0x33/0x50 [ 11.673913] print_report+0xcc/0x620 [ 11.674671] kasan_report+0xae/0xe0 [ 11.675171] kasan_check_range+0x35/0x1b0 [ 11.675412] smb2_handle_negotiate+0x799/0x1610 [ 11.676217] ksmbd_smb_negotiate_common+0x526/0x770 [ 11.676795] handle_ksmbd_work+0x274/0x810 ... Cc: stable(a)vger.kernel.org Signed-off-by: Chih-Yen Chang <cc85nod(a)gmail.com> Tested-by: Chih-Yen Chang <cc85nod(a)gmail.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflict: fs/smb/server/smb2pdu.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 18e176fcddf0..c357b2127774 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -978,13 +978,13 @@ static void decode_sign_cap_ctxt(struct ksmbd_conn *conn, static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, struct smb2_negotiate_req *req, - int len_of_smb) + unsigned int len_of_smb) { /* +4 is to account for the RFC1001 len field */ struct smb2_neg_context *pctx = (struct smb2_neg_context *)req; int i = 0, len_of_ctxts; - int offset = le32_to_cpu(req->NegotiateContextOffset); - int neg_ctxt_cnt = le16_to_cpu(req->NegotiateContextCount); + unsigned int offset = le32_to_cpu(req->NegotiateContextOffset); + unsigned int neg_ctxt_cnt = le16_to_cpu(req->NegotiateContextCount); __le32 status = STATUS_INVALID_PARAMETER; ksmbd_debug(SMB, "decoding %d negotiate contexts\n", neg_ctxt_cnt); @@ -1002,7 +1002,7 @@ static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, if (len_of_ctxts == 0) break; - if (len_of_ctxts < sizeof(struct smb2_neg_context)) + if (len_of_ctxts < (int)sizeof(struct smb2_neg_context)) break; pctx = (struct smb2_neg_context *)((char *)pctx + offset); @@ -1053,9 +1053,8 @@ static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, } /* offsets must be 8 byte aligned */ - clen = (clen + 7) & ~0x7; - offset = clen + sizeof(struct smb2_neg_context); - len_of_ctxts -= clen + sizeof(struct smb2_neg_context); + offset = (clen + sizeof(struct smb2_neg_context) + 7) & ~0x7; + len_of_ctxts -= offset; } return status; } -- 2.31.1

2 1

[PATCH OLK-5.10 0/2] net: nfc: Fix CVE-2023-3863
by Ziyang Xuan 29 Jul '23

29 Jul '23

Backport CVE-2023-3863 fix commit. Krzysztof Kozlowski (1): nfc: llcp: simplify llcp_sock_connect() error paths Lin Ma (1): net: nfc: Fix use-after-free caused by nfc_llcp_find_local net/nfc/llcp.h | 1 - net/nfc/llcp_commands.c | 12 +++++++--- net/nfc/llcp_core.c | 49 +++++++++++++++++++++++++++++++++++------ net/nfc/llcp_sock.c | 21 ++++++++++-------- net/nfc/netlink.c | 20 ++++++++++++----- net/nfc/nfc.h | 1 + 6 files changed, 79 insertions(+), 25 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] net/sched: cls_u32: Fix reference counter leak leading to overflow
by Lu Wei 29 Jul '23

29 Jul '23

From: Lee Jones <lee(a)kernel.org> stable inclusion from stable-v5.10.185 commit af6eaa57986e82d7efd81984ee607927c6de61e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7N3N2 CVE: CVE-2023-3609 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 04c55383fa5689357bcdd2c8036725a55ed632bc ] In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Lee Jones <lee(a)kernel.org> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/sched/cls_u32.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index da042bc8b239..1ac8ff445a6d 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -716,12 +716,18 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, struct nlattr *est, bool ovr, struct netlink_ext_ack *extack) { - int err; + int err, ifindex = -1; err = tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, true, extack); if (err < 0) return err; + if (tb[TCA_U32_INDEV]) { + ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); + if (ifindex < 0) + return -EINVAL; + } + if (tb[TCA_U32_LINK]) { u32 handle = nla_get_u32(tb[TCA_U32_LINK]); struct tc_u_hnode *ht_down = NULL, *ht_old; @@ -756,13 +762,9 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, tcf_bind_filter(tp, &n->res, base); } - if (tb[TCA_U32_INDEV]) { - int ret; - ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); - if (ret < 0) - return -EINVAL; - n->ifindex = ret; - } + if (ifindex >= 0) + n->ifindex = ifindex; + return 0; } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] net/sched: cls_u32: Fix reference counter leak leading to overflow
by Lu Wei 28 Jul '23

28 Jul '23

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.4-rc7 commit 04c55383fa5689357bcdd2c8036725a55ed632bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7N3N2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Lee Jones <lee(a)kernel.org> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> conflict: net/sched/cls_u32.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/sched/cls_u32.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 23d95db99121..9c92978c8684 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -778,11 +778,22 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, struct netlink_ext_ack *extack) { int err; +#ifdef CONFIG_NET_CLS_IND + int ifindex = -1; +#endif err = tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, extack); if (err < 0) return err; +#ifdef CONFIG_NET_CLS_IND + if (tb[TCA_U32_INDEV]) { + ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); + if (ifindex < 0) + return -EINVAL; + } +#endif + if (tb[TCA_U32_LINK]) { u32 handle = nla_get_u32(tb[TCA_U32_LINK]); struct tc_u_hnode *ht_down = NULL, *ht_old; @@ -814,13 +825,8 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, } #ifdef CONFIG_NET_CLS_IND - if (tb[TCA_U32_INDEV]) { - int ret; - ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); - if (ret < 0) - return -EINVAL; - n->ifindex = ret; - } + if (ifindex >= 0) + n->ifindex = ifindex; #endif return 0; } -- 2.34.1

2 1

[openEuler-1.0-LTS,v2] net/sched: cls_u32: Fix reference counter leak leading to overflow
by Lu Wei 28 Jul '23

28 Jul '23

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.4-rc7 commit 04c55383fa5689357bcdd2c8036725a55ed632bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7N3N2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Lee Jones <lee(a)kernel.org> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> conflict: net/sched/cls_u32.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- V2: add macro separation for ifindex definition net/sched/cls_u32.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 23d95db99121..9c92978c8684 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -778,11 +778,22 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, struct netlink_ext_ack *extack) { int err; +#ifdef CONFIG_NET_CLS_IND + int ifindex = -1; +#endif err = tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, extack); if (err < 0) return err; +#ifdef CONFIG_NET_CLS_IND + if (tb[TCA_U32_INDEV]) { + ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); + if (ifindex < 0) + return -EINVAL; + } +#endif + if (tb[TCA_U32_LINK]) { u32 handle = nla_get_u32(tb[TCA_U32_LINK]); struct tc_u_hnode *ht_down = NULL, *ht_old; @@ -814,13 +825,8 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, } #ifdef CONFIG_NET_CLS_IND - if (tb[TCA_U32_INDEV]) { - int ret; - ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); - if (ret < 0) - return -EINVAL; - n->ifindex = ret; - } + if (ifindex >= 0) + n->ifindex = ifindex; #endif return 0; } -- 2.34.1

1 0

[PATCH OLK-5.10 00/10] rcu: Add RCU stall diagnosis information
by Zhen Lei 28 Jul '23

28 Jul '23

In some extreme cases, such as the I/O pressure test, the CPU usage may be 100%, causing RCU stall. In this case, the printed information about current is not useful. Displays the number and usage of hard interrupts, soft interrupts, and context switches that are generated within half of the CPU stall timeout, can help us make a general judgment. In other cases, we can preliminarily determine whether an infinite loop occurs when local_irq, local_bh or preempt is disabled. Neeraj Upadhyay (1): rcu: Check and report missed fqs timer wakeup on RCU stall Paul E. McKenney (3): rcu: Prevent lockdep-RCU splats on lock acquisition/release rcu: For RCU grace-period kthread starvation, dump last CPU it ran on rcu: Do not NMI offline CPUs Zhen Lei (6): sched/debug: Try trigger_single_cpu_backtrace(cpu) in dump_cpu_task() sched/debug: Show the registers of 'current' in dump_cpu_task() sched: Add helper kstat_cpu_softirqs_sum() sched: Add helper nr_context_switches_cpu() rcu: Add RCU stall diagnosis information rcu: Align the output of RCU CPU stall warning messages Documentation/RCU/stallwarn.rst | 23 ++++- .../admin-guide/kernel-parameters.txt | 6 ++ include/linux/kernel_stat.h | 12 +++ kernel/rcu/Kconfig.debug | 13 +++ kernel/rcu/rcu.h | 1 + kernel/rcu/tree.c | 64 +++++++++++--- kernel/rcu/tree.h | 20 +++++ kernel/rcu/tree_stall.h | 86 +++++++++++++++++-- kernel/rcu/update.c | 2 + kernel/sched/core.c | 19 ++++ kernel/smp.c | 3 +- 11 files changed, 230 insertions(+), 19 deletions(-) -- 2.34.1

2 11

[PATCH OLK-5.10] psi: fix compile error for psi cgroupv1 when CONFIG_CGROUP=n
by Lu Jialin 28 Jul '23

28 Jul '23

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7OOZR ------------------------------- When CONFIG_CGROUP=n ,the compile error is: In file included from kernel/sched/core.c:13: kernel/sched/sched.h:2679:22: error: array type has incomplete element type ‘struct cftype’ extern struct cftype cgroup_v1_psi_files[]; ^~~~~~~~~~~~~~~~~~~ the reason is then CONFIG_CGROUP=n, struct cftype is not defined. We also find that, cgroup_v1_psi_files is used only in kernel/cgroup/cgroup.c and kernel/sched/cpuacct.c. Therefore, move extern struct cftype cgroup_v1_psi_files to kernel/sched/cpuacct.c.This also solved the compile error, because, then CONFIG_CGROUP=n, CONFIG_CGROUP_CPUACCT=n, the kernel/sched/cpuacct.c is not compiled, which will solve the compile error. Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- kernel/sched/cpuacct.c | 1 + kernel/sched/sched.h | 4 ---- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c index 5c00d3dcee8d..28ed182b6801 100644 --- a/kernel/sched/cpuacct.c +++ b/kernel/sched/cpuacct.c @@ -390,6 +390,7 @@ static int __init setup_psi_v1(char *str) } __setup("psi_v1=", setup_psi_v1); +extern struct cftype cgroup_v1_psi_files[]; static int __init cgroup_v1_psi_init(void) { if (!psi_v1_enable) diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 95ae9ac553fc..50f1a11ac2fd 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -2977,10 +2977,6 @@ unsigned long scale_irq_capacity(unsigned long util, unsigned long irq, unsigned } #endif -#ifdef CONFIG_PSI -extern struct cftype cgroup_v1_psi_files[]; -#endif - #if defined(CONFIG_ENERGY_MODEL) && defined(CONFIG_CPU_FREQ_GOV_SCHEDUTIL) #define perf_domain_span(pd) (to_cpumask(((pd)->em_pd->cpus))) -- 2.17.1

2 1

[PATCH OLK-5.10] net/sched: cls_fw: Fix improper refcount update leads to use-after-free
by Dong Chenchen 27 Jul '23

27 Jul '23

From: M A Ramdhan <ramdhan(a)starlabs.sg> stable inclusion from stable-v5.10.187 commit 80e0e8d5f54397c5048fa2274144134dd9dc91b5 category: bugfix bugzilla: 189032,https://gitee.com/src-openeuler/kernel/issues/I7N3N3 CVE: CVE-2023-3776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 0323bce598eea038714f941ce2b22541c46d488f ] In the event of a failure in tcf_change_indev(), fw_set_parms() will immediately return an error after incrementing or decrementing reference counter in tcf_bind_filter(). If attacker can control reference counter to zero and make reference freed, leading to use after free. In order to prevent this, move the point of possible failure above the point where the TC_FW_CLASSID is handled. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: M A Ramdhan <ramdhan(a)starlabs.sg> Signed-off-by: M A Ramdhan <ramdhan(a)starlabs.sg> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Pedro Tammela <pctammela(a)mojatatu.com> Message-ID: <20230705161530.52003-1-ramdhan(a)starlabs.sg> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/cls_fw.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c index ec945294626a..41f0898a5a56 100644 --- a/net/sched/cls_fw.c +++ b/net/sched/cls_fw.c @@ -210,11 +210,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, if (err < 0) return err; - if (tb[TCA_FW_CLASSID]) { - f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); - tcf_bind_filter(tp, &f->res, base); - } - if (tb[TCA_FW_INDEV]) { int ret; ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack); @@ -231,6 +226,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, } else if (head->mask != 0xFFFFFFFF) return err; + if (tb[TCA_FW_CLASSID]) { + f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); + tcf_bind_filter(tp, &f->res, base); + } + return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net/sched: cls_fw: Fix improper refcount update leads to use-after-free
by Dong Chenchen 27 Jul '23

27 Jul '23

From: M A Ramdhan <ramdhan(a)starlabs.sg> mainline inclusion from mainline-v6.4 commit 0323bce598eea038714f941ce2b22541c46d488f category: bugfix bugzilla: 189032, https://gitee.com/src-openeuler/kernel/issues/I7N3N3 CVE: CVE-2023-3776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In the event of a failure in tcf_change_indev(), fw_set_parms() will immediately return an error after incrementing or decrementing reference counter in tcf_bind_filter(). If attacker can control reference counter to zero and make reference freed, leading to use after free. In order to prevent this, move the point of possible failure above the point where the TC_FW_CLASSID is handled. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: M A Ramdhan <ramdhan(a)starlabs.sg> Signed-off-by: M A Ramdhan <ramdhan(a)starlabs.sg> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Pedro Tammela <pctammela(a)mojatatu.com> Message-ID: <20230705161530.52003-1-ramdhan(a)starlabs.sg> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflict: net/sched/cls_fw.c Signed-off-by: dongchenchen <dongchenchen2(a)huawei.com> --- net/sched/cls_fw.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c index 29eeeaf3ea44..0c21e58d52bf 100644 --- a/net/sched/cls_fw.c +++ b/net/sched/cls_fw.c @@ -221,11 +221,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, if (err < 0) return err; - if (tb[TCA_FW_CLASSID]) { - f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); - tcf_bind_filter(tp, &f->res, base); - } - #ifdef CONFIG_NET_CLS_IND if (tb[TCA_FW_INDEV]) { int ret; @@ -244,6 +239,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, } else if (head->mask != 0xFFFFFFFF) return err; + if (tb[TCA_FW_CLASSID]) { + f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); + tcf_bind_filter(tp, &f->res, base); + } + return 0; } -- 2.25.1

2 1

关于oEEP-0006 kernel SIG的相关工作
by kai.liu 27 Jul '23

27 Jul '23

Hi 刘超，以下是我初步分析的工作分解，请帮忙提出意见，谢谢！ 1. Kernel config review a) 分析Fedora 38、openSUSE 15.5和Debian 12的内核配置文件，目标是达到与它们接近的50% =m比例。需分析清楚： i. 它们主要是哪些类型的驱动开启了，哪些未开启。 ii. 它们的策略是否一致。如不一致，openEuler应采用何种策略？ b) 按上一条决策对openEuler kconfig进行修改，并提交PR。 c) Kernel SIG maintainer对PR进行review，反馈意见，达成共识。 d) 提交TC确认，正式合入PR。 2. Kernel RPM拆包：将kernel二进制包拆分成3个，名字待定，参见TC仓PR#57。 a) 定义各子包的内核模块列表： i. min：含内核文件本身如vmlinuz，system.map，config，以及在虚拟化环境下启动和运行常见业务负载所必须的模块，如virtio，iptables，fs，以及少量虚拟化中常见模拟真实的硬件的驱动如LSI HBA，Intel e1000网卡等。 ii. base：包含对常见服务器硬件的驱动，如RAID卡，HBA卡，网卡。主要基于现在kernel包的模块列表。 iii. extras：新开启的模块，少量服务器相关的驱动放入基础包，其它PC/桌面/嵌入式等相关的模块放入扩展包。 b) 定义升级策略：当前kernel包应升级到新定义的base内核包。原因为： i. Base包的模块范围与原kernel包的最接近。 ii. Base包适用的服务器场景依然是openEuler的主流场景。 c) Spec文件重构。 i. 拆分包，根据上面定义的模块列表分别打包。 ii. 定义好依赖关系：extras依赖base，base依赖min。 iii. 根据升级策略，定义好Provides和Obsoletes，使得升级时可正常从原来的kernel包升级。以上1、2任务可以并行。2a、2b、2c又可以并行。1a和2a强相关，需紧密关联合作。刘恺 Email: kai.liu(a)xfusion.com<mailto:kai.liu@xfusion.com> | Mobile: 181 2600 8111

2 2

[PATCH OLK-5.10] ksmbd: allocate one more byte for implied bcc[0]
by Li Nan 27 Jul '23

27 Jul '23

From: Chih-Yen Chang <cc85nod(a)gmail.com> mainline inclusion from mainline-v6.4-rc3 commit 443d61d1fa9faa60ef925513d83742902390100f category: bugfix bugzilla: 189030, https://gitee.com/openeuler/kernel/issues/I7LU2I CVE: CVE-2023-38429 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… ---------------------------------------- ksmbd_smb2_check_message allows client to return one byte more, so we need to allocate additional memory in ksmbd_conn_handler_loop to avoid out-of-bound access. Cc: stable(a)vger.kernel.org Signed-off-by: Chih-Yen Chang <cc85nod(a)gmail.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflict: fs/ksmbd/connection.c Signed-off-by: Li Nan <linan122(a)huawei.com> --- fs/ksmbd/connection.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ksmbd/connection.c b/fs/ksmbd/connection.c index 8e15ec9e8f43..9c4ca0bbd71e 100644 --- a/fs/ksmbd/connection.c +++ b/fs/ksmbd/connection.c @@ -309,7 +309,8 @@ int ksmbd_conn_handler_loop(void *p) } /* 4 for rfc1002 length field */ - size = pdu_size + 4; + /* 1 for implied bcc[0] */ + size = pdu_size + 4 + 1; conn->request_buf = kvmalloc(size, GFP_KERNEL); if (!conn->request_buf) continue; -- 2.39.2

2 1

[PATCH V2 OLK-5.10 0/6] Sync patches for sharepool
by Zhang Zekun 27 Jul '23

27 Jul '23

Sync patches for sharepool - Fix some bugs in code - Add a new feature for sharepool v2: - Fix some errors in patch 1, missing some code because of using git format-patch wrongly. Chen Jun (1): mm/sharepool: Add mg_sp_alloc_nodemask Xu Qiang (5): mm/sharepool: Change data type of members in sp_spa_stat to atomic64. mm/sharepool: Delete SPG_FLAG_NON_DVPP. mm/sharepool: Add sp_group_sem protection. mm/sharepool: Delete total_num and total_size in sp_spa_stat mm/sharepool: Delete unused flag in sp_group. include/linux/hugetlb.h | 15 ++ include/linux/share_pool.h | 12 +- include/linux/share_pool_interface.h | 19 +++ mm/hugetlb.c | 30 +++- mm/mempolicy.c | 4 +- mm/share_pool.c | 222 ++++++++++++++------------- 6 files changed, 180 insertions(+), 122 deletions(-) create mode 100644 include/linux/share_pool_interface.h -- 2.17.1

2 7

[PATCH openEuler-1.0-LTS] binder: fix UAF caused by faulty buffer cleanup
by Longlong Xia 27 Jul '23

27 Jul '23

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.182 commit 2218752325a98861dfb10f59a9b0270d6d4abe21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7L0Z9 CVE: CVE-2023-21255 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bdc1c5fac982845a58d28690cdb56db8c88a530d upstream. In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d87 ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan <zifantan(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Acked-by: Todd Kjos <tkjos(a)google.com> Link: https://lore.kernel.org/r/20230505203020.4101154-1-cmllamas@google.com [cmllamas: resolve trivial conflict due to missing commit 9864bb4801331] Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- drivers/android/binder.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index d73b0df55967..98c785ebfa5d 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2302,24 +2302,23 @@ static void binder_deferred_fd_close(int fd) static void binder_transaction_buffer_release(struct binder_proc *proc, struct binder_thread *thread, struct binder_buffer *buffer, - binder_size_t failed_at, + binder_size_t off_end_offset, bool is_failure) { int debug_id = buffer->debug_id; - binder_size_t off_start_offset, buffer_offset, off_end_offset; + binder_size_t off_start_offset, buffer_offset; binder_debug(BINDER_DEBUG_TRANSACTION, "%d buffer release %d, size %zd-%zd, failed at %llx\n", proc->pid, buffer->debug_id, buffer->data_size, buffer->offsets_size, - (unsigned long long)failed_at); + (unsigned long long)off_end_offset); if (buffer->target_node) binder_dec_node(buffer->target_node, 1, 0); off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); - off_end_offset = is_failure && failed_at ? failed_at : - off_start_offset + buffer->offsets_size; + for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; buffer_offset += sizeof(binder_size_t)) { struct binder_object_header *hdr; @@ -2479,6 +2478,21 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, } } +/* Clean up all the objects in the buffer */ +static inline void binder_release_entire_buffer(struct binder_proc *proc, + struct binder_thread *thread, + struct binder_buffer *buffer, + bool is_failure) +{ + binder_size_t off_end_offset; + + off_end_offset = ALIGN(buffer->data_size, sizeof(void *)); + off_end_offset += buffer->offsets_size; + + binder_transaction_buffer_release(proc, thread, buffer, + off_end_offset, is_failure); +} + static int binder_translate_binder(struct flat_binder_object *fp, struct binder_transaction *t, struct binder_thread *thread) @@ -3949,7 +3963,7 @@ binder_free_buf(struct binder_proc *proc, binder_node_inner_unlock(buf_node); } trace_binder_transaction_buffer_release(buffer); - binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure); + binder_release_entire_buffer(proc, thread, buffer, is_failure); binder_alloc_free_buf(&proc->alloc, buffer); } -- 2.25.1

2 1

[PATCH OLK-5.10] mm: memcontrol: fix cannot alloc the maximum memcg ID
by Lu Jialin 27 Jul '23

27 Jul '23

From: Muchun Song <songmuchun(a)bytedance.com> mainline inclusion from mainline-v5.18-rc1 commit be740503ed03ea04ca362330baf082e6a38fe462 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7NXZ6?from=project-issue Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The idr_alloc() does not include @max ID. So in the current implementation, the maximum memcg ID is 65534 instead of 65535. It seems a bug. So fix this. Link: https://lkml.kernel.org/r/20220228122126.37293-15-songmuchun@bytedance.com Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Cc: Alex Shi <alexs(a)kernel.org> Cc: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Cc: Chao Yu <chao(a)kernel.org> Cc: Dave Chinner <david(a)fromorbit.com> Cc: Fam Zheng <fam.zheng(a)bytedance.com> Cc: Jaegeuk Kim <jaegeuk(a)kernel.org> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Kari Argillander <kari.argillander(a)gmail.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Theodore Ts'o <tytso(a)mit.edu> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Wei Yang <richard.weiyang(a)gmail.com> Cc: Xiongchun Duan <duanxiongchun(a)bytedance.com> Cc: Yang Shi <shy828301(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflict: mm/memcontrol.c Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- mm/memcontrol.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index dfe0f1127153..5082d0664adf 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -6277,8 +6277,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void) goto fail; memcg->id.id = idr_alloc(&mem_cgroup_idr, NULL, - 1, MEM_CGROUP_ID_MAX, - GFP_KERNEL); + 1, MEM_CGROUP_ID_MAX + 1, GFP_KERNEL); if (memcg->id.id < 0) { error = memcg->id.id; goto fail; -- 2.17.1

2 1

[PATCH OLK-5.10] binder: fix UAF caused by faulty buffer cleanup
by Longlong Xia 27 Jul '23

27 Jul '23

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.182 commit 2218752325a98861dfb10f59a9b0270d6d4abe21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7L0Z9 CVE: CVE-2023-21255 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bdc1c5fac982845a58d28690cdb56db8c88a530d upstream. In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d87 ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan <zifantan(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Acked-by: Todd Kjos <tkjos(a)google.com> Link: https://lore.kernel.org/r/20230505203020.4101154-1-cmllamas@google.com [cmllamas: resolve trivial conflict due to missing commit 9864bb4801331] Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> --- drivers/android/binder.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index b403c7f063b0..dbae98f09658 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2267,24 +2267,23 @@ static void binder_deferred_fd_close(int fd) static void binder_transaction_buffer_release(struct binder_proc *proc, struct binder_thread *thread, struct binder_buffer *buffer, - binder_size_t failed_at, + binder_size_t off_end_offset, bool is_failure) { int debug_id = buffer->debug_id; - binder_size_t off_start_offset, buffer_offset, off_end_offset; + binder_size_t off_start_offset, buffer_offset; binder_debug(BINDER_DEBUG_TRANSACTION, "%d buffer release %d, size %zd-%zd, failed at %llx\n", proc->pid, buffer->debug_id, buffer->data_size, buffer->offsets_size, - (unsigned long long)failed_at); + (unsigned long long)off_end_offset); if (buffer->target_node) binder_dec_node(buffer->target_node, 1, 0); off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); - off_end_offset = is_failure && failed_at ? failed_at : - off_start_offset + buffer->offsets_size; + for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; buffer_offset += sizeof(binder_size_t)) { struct binder_object_header *hdr; @@ -2444,6 +2443,21 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, } } +/* Clean up all the objects in the buffer */ +static inline void binder_release_entire_buffer(struct binder_proc *proc, + struct binder_thread *thread, + struct binder_buffer *buffer, + bool is_failure) +{ + binder_size_t off_end_offset; + + off_end_offset = ALIGN(buffer->data_size, sizeof(void *)); + off_end_offset += buffer->offsets_size; + + binder_transaction_buffer_release(proc, thread, buffer, + off_end_offset, is_failure); +} + static int binder_translate_binder(struct flat_binder_object *fp, struct binder_transaction *t, struct binder_thread *thread) @@ -3926,7 +3940,7 @@ binder_free_buf(struct binder_proc *proc, binder_node_inner_unlock(buf_node); } trace_binder_transaction_buffer_release(buffer); - binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure); + binder_release_entire_buffer(proc, thread, buffer, is_failure); binder_alloc_free_buf(&proc->alloc, buffer); } -- 2.25.1

2 1