- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] mm: fix uprobe pte be overwritten when expanding vma
by Pu Lehui 30 Jun '25

30 Jun '25

mainline inclusion from mainline-v6.16-rc1 commit 2b12d06c37fd3a394376f42f026a7478d826ed63 category: bugfix bugzilla: 190644 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Patch series "Fix uprobe pte be overwritten when expanding vma". This patch (of 4): We encountered a BUG alert triggered by Syzkaller as follows: BUG: Bad rss-counter state mm:00000000b4a60fca type:MM_ANONPAGES val:1 And we can reproduce it with the following steps: 1. register uprobe on file at zero offset 2. mmap the file at zero offset: addr1 = mmap(NULL, 2 * 4096, PROT_NONE, MAP_PRIVATE, fd, 0); 3. mremap part of vma1 to new vma2: addr2 = mremap(addr1, 4096, 2 * 4096, MREMAP_MAYMOVE); 4. mremap back to orig addr1: mremap(addr2, 4096, 4096, MREMAP_MAYMOVE | MREMAP_FIXED, addr1); In step 3, the vma1 range [addr1, addr1 + 4096] will be remap to new vma2 with range [addr2, addr2 + 8192], and remap uprobe anon page from the vma1 to vma2, then unmap the vma1 range [addr1, addr1 + 4096]. In step 4, the vma2 range [addr2, addr2 + 4096] will be remap back to the addr range [addr1, addr1 + 4096]. Since the addr range [addr1 + 4096, addr1 + 8192] still maps the file, it will take vma_merge_new_range to expand the range, and then do uprobe_mmap in vma_complete. Since the merged vma pgoff is also zero offset, it will install uprobe anon page to the merged vma. However, the upcomming move_page_tables step, which use set_pte_at to remap the vma2 uprobe pte to the merged vma, will overwrite the newly uprobe pte in the merged vma, and lead that pte to be orphan. Since the uprobe pte will be remapped to the merged vma, we can remove the unnecessary uprobe_mmap upon merged vma. This problem was first found in linux-6.6.y and also exists in the community syzkaller: https://lore.kernel.org/all/000000000000ada39605a5e71711@google.com/T/ Link: https://lkml.kernel.org/r/20250529155650.4017699-1-pulehui@huaweicloud.com Link: https://lkml.kernel.org/r/20250529155650.4017699-2-pulehui@huaweicloud.com Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Suggested-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Jann Horn <jannh(a)google.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: "Masami Hiramatsu (Google)" <mhiramat(a)kernel.org> Cc: Oleg Nesterov <oleg(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/userfaultfd.c include/linux/mm.h mm/madvise.c mm/mempolicy.c mm/mlock.c mm/mmap.c mm/mprotect.c mm/vma.h mm/vma.c [The conflicts were due to refactor commit 440703e082b9c and 2f1c6611b0a8] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/userfaultfd.c | 6 +++--- include/linux/mm.h | 6 +++--- mm/madvise.c | 2 +- mm/mempolicy.c | 2 +- mm/mlock.c | 2 +- mm/mmap.c | 43 ++++++++++++++++++++++++++++++++----------- mm/mprotect.c | 2 +- 7 files changed, 42 insertions(+), 21 deletions(-) diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 803c61f66d54..3e11e9763527 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -925,7 +925,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) new_flags, vma->anon_vma, vma->vm_file, vma->vm_pgoff, vma_policy(vma), - NULL_VM_UFFD_CTX); + NULL_VM_UFFD_CTX, false); if (prev) vma = prev; else @@ -1492,7 +1492,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, prev = vma_merge(mm, prev, start, vma_end, new_flags, vma->anon_vma, vma->vm_file, vma->vm_pgoff, vma_policy(vma), - ((struct vm_userfaultfd_ctx){ ctx })); + ((struct vm_userfaultfd_ctx){ ctx }), false); if (prev) { vma = prev; goto next; @@ -1654,7 +1654,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, prev = vma_merge(mm, prev, start, vma_end, new_flags, vma->anon_vma, vma->vm_file, vma->vm_pgoff, vma_policy(vma), - NULL_VM_UFFD_CTX); + NULL_VM_UFFD_CTX, false); if (prev) { vma = prev; goto next; diff --git a/include/linux/mm.h b/include/linux/mm.h index 67e299374ac8..8cae7fb6542a 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2367,16 +2367,16 @@ void anon_vma_interval_tree_verify(struct anon_vma_chain *node); extern int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin); extern int __vma_adjust(struct vm_area_struct *vma, unsigned long start, unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert, - struct vm_area_struct *expand); + struct vm_area_struct *expand, bool skip_vma_uprobe); static inline int vma_adjust(struct vm_area_struct *vma, unsigned long start, unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert) { - return __vma_adjust(vma, start, end, pgoff, insert, NULL); + return __vma_adjust(vma, start, end, pgoff, insert, NULL, false); } extern struct vm_area_struct *vma_merge(struct mm_struct *, struct vm_area_struct *prev, unsigned long addr, unsigned long end, unsigned long vm_flags, struct anon_vma *, struct file *, pgoff_t, - struct mempolicy *, struct vm_userfaultfd_ctx); + struct mempolicy *, struct vm_userfaultfd_ctx, bool skip_vma_uprobe); extern struct anon_vma *find_mergeable_anon_vma(struct vm_area_struct *); extern int __split_vma(struct mm_struct *, struct vm_area_struct *, unsigned long addr, int new_below); diff --git a/mm/madvise.c b/mm/madvise.c index 263c2c68b0de..0670786a23a5 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -145,7 +145,7 @@ static long madvise_behavior(struct vm_area_struct *vma, pgoff = vma->vm_pgoff + ((start - vma->vm_start) >> PAGE_SHIFT); *prev = vma_merge(mm, *prev, start, end, new_flags, vma->anon_vma, vma->vm_file, pgoff, vma_policy(vma), - vma->vm_userfaultfd_ctx); + vma->vm_userfaultfd_ctx, false); if (*prev) { vma = *prev; goto success; diff --git a/mm/mempolicy.c b/mm/mempolicy.c index e8c82f3235e2..882310ef3d93 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -818,7 +818,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, ((vmstart - vma->vm_start) >> PAGE_SHIFT); prev = vma_merge(mm, prev, vmstart, vmend, vma->vm_flags, vma->anon_vma, vma->vm_file, pgoff, - new_pol, vma->vm_userfaultfd_ctx); + new_pol, vma->vm_userfaultfd_ctx, false); if (prev) { vma = prev; goto replace; diff --git a/mm/mlock.c b/mm/mlock.c index d9040aea2be0..cb4e1207169a 100644 --- a/mm/mlock.c +++ b/mm/mlock.c @@ -540,7 +540,7 @@ static int mlock_fixup(struct vm_area_struct *vma, struct vm_area_struct **prev, pgoff = vma->vm_pgoff + ((start - vma->vm_start) >> PAGE_SHIFT); *prev = vma_merge(mm, *prev, start, end, newflags, vma->anon_vma, vma->vm_file, pgoff, vma_policy(vma), - vma->vm_userfaultfd_ctx); + vma->vm_userfaultfd_ctx, false); if (*prev) { vma = *prev; goto success; diff --git a/mm/mmap.c b/mm/mmap.c index ad643f9dd3a4..c27bbe5ea5ca 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -684,10 +684,13 @@ static inline void __vma_unlink_prev(struct mm_struct *mm, * The following helper function should be used when such adjustments * are necessary. The "insert" vma (if any) is to be inserted * before we drop the necessary locks. + * + * @skip_vma_uprobe: only valid for copy_vma process, others please + * mark it as false. */ int __vma_adjust(struct vm_area_struct *vma, unsigned long start, unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert, - struct vm_area_struct *expand) + struct vm_area_struct *expand, bool skip_vma_uprobe) { struct mm_struct *mm = vma->vm_mm; struct vm_area_struct *next = vma->vm_next, *orig_vma = vma; @@ -894,10 +897,12 @@ int __vma_adjust(struct vm_area_struct *vma, unsigned long start, i_mmap_unlock_write(mapping); if (root) { - uprobe_mmap(vma); + if (!skip_vma_uprobe) { + uprobe_mmap(vma); - if (adjust_next) - uprobe_mmap(next); + if (adjust_next) + uprobe_mmap(next); + } } if (remove_next) { @@ -1102,6 +1107,9 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags, * or other rmap walkers (if working on addresses beyond the "end" * parameter) may establish ptes with the wrong permissions of NNNN * instead of the right permissions of XXXX. + * + * @skip_vma_uprobe: only valid for copy_vma process, others please + * mark it as false. */ struct vm_area_struct *vma_merge(struct mm_struct *mm, struct vm_area_struct *prev, unsigned long addr, @@ -1160,10 +1168,11 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, /* cases 1, 6 */ err = __vma_adjust(prev, prev->vm_start, next->vm_end, prev->vm_pgoff, NULL, - prev); + prev, skip_vma_uprobe); } else /* cases 2, 5, 7 */ err = __vma_adjust(prev, prev->vm_start, - end, prev->vm_pgoff, NULL, prev); + end, prev->vm_pgoff, NULL, + prev, skip_vma_uprobe); if (err) return NULL; khugepaged_enter_vma_merge(prev, vm_flags); @@ -1180,10 +1189,12 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, vm_userfaultfd_ctx)) { if (prev && addr < prev->vm_end) /* case 4 */ err = __vma_adjust(prev, prev->vm_start, - addr, prev->vm_pgoff, NULL, next); + addr, prev->vm_pgoff, NULL, + next, skip_vma_uprobe); else { /* cases 3, 8 */ err = __vma_adjust(area, addr, next->vm_end, - next->vm_pgoff - pglen, NULL, next); + next->vm_pgoff - pglen, NULL, + next, skip_vma_uprobe); /* * In case 3 area is already equal to next and * this is a noop, but in case 8 "area" has @@ -1974,7 +1985,7 @@ static unsigned long __mmap_region(struct mm_struct *mm, struct file *file, * Can we just expand an old mapping? */ vma = vma_merge(mm, prev, addr, addr + len, vm_flags, - NULL, file, pgoff, NULL, NULL_VM_UFFD_CTX); + NULL, file, pgoff, NULL, NULL_VM_UFFD_CTX, false); if (vma) goto out; @@ -3381,7 +3392,7 @@ static int do_brk_flags(unsigned long addr, unsigned long len, unsigned long fla /* Can we just expand an old private anonymous mapping? */ vma = vma_merge(mm, prev, addr, addr + len, flags, - NULL, NULL, pgoff, NULL, NULL_VM_UFFD_CTX); + NULL, NULL, pgoff, NULL, NULL_VM_UFFD_CTX, false); if (vma) goto out; @@ -3566,6 +3577,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, struct vm_area_struct *new_vma, *prev; struct rb_node **rb_link, *rb_parent; bool faulted_in_anon_vma = true; + bool skip_vma_uprobe = false; /* * If anonymous vma has not yet been faulted, update new pgoff @@ -3578,9 +3590,18 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, if (find_vma_links(mm, addr, addr + len, &prev, &rb_link, &rb_parent)) return NULL; /* should never get here */ + + /* + * If the VMA we are copying might contain a uprobe PTE, ensure + * that we do not establish one upon merge. Otherwise, when mremap() + * moves page tables, it will orphan the newly created PTE. + */ + if (vma->vm_file) + skip_vma_uprobe = true; + new_vma = vma_merge(mm, prev, addr, addr + len, vma->vm_flags, vma->anon_vma, vma->vm_file, pgoff, vma_policy(vma), - vma->vm_userfaultfd_ctx); + vma->vm_userfaultfd_ctx, skip_vma_uprobe); if (new_vma) { /* * Source vma may have been merged into new_vma diff --git a/mm/mprotect.c b/mm/mprotect.c index 86837f25055b..4c7370fd3e90 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -432,7 +432,7 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev, pgoff = vma->vm_pgoff + ((start - vma->vm_start) >> PAGE_SHIFT); *pprev = vma_merge(mm, *pprev, start, end, newflags, vma->anon_vma, vma->vm_file, pgoff, vma_policy(vma), - vma->vm_userfaultfd_ctx); + vma->vm_userfaultfd_ctx, false); if (*pprev) { vma = *pprev; VM_WARN_ON((vma->vm_flags ^ newflags) & ~VM_SOFTDIRTY); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ipvs: fix WARNING in ip_vs_app_net_cleanup()
by Zhang Changzhong 30 Jun '25

30 Jun '25

From: Zhengchao Shao <shaozhengchao(a)huawei.com> stable inclusion from stable-v4.19.265 commit adc76740ccd52e4a1d910767cd1223e134a7078b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BRU CVE: CVE-2022-49917 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5663ed63adb9619c98ab7479aa4606fa9b7a548c ] During the initialization of ip_vs_app_net_init(), if file ip_vs_app fails to be created, the initialization is successful by default. Therefore, the ip_vs_app file doesn't be found during the remove in ip_vs_app_net_cleanup(). It will cause WRNING. The following is the stack information: name 'ip_vs_app' WARNING: CPU: 1 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460 Modules linked in: Workqueue: netns cleanup_net RIP: 0010:remove_proc_entry+0x389/0x460 Call Trace: <TASK> ops_exit_list+0x125/0x170 cleanup_net+0x4ea/0xb00 process_one_work+0x9bf/0x1710 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 </TASK> Fixes: 457c4cbc5a3d ("[NET]: Make /proc/net per network namespace") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Acked-by: Julian Anastasov <ja(a)ssi.bg> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Rui Xiang <rui.xiang(a)huawei.com> --- net/netfilter/ipvs/ip_vs_app.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c index 80759aa..21149f4 100644 --- a/net/netfilter/ipvs/ip_vs_app.c +++ b/net/netfilter/ipvs/ip_vs_app.c @@ -604,13 +604,19 @@ static const struct seq_operations ip_vs_app_seq_ops = { int __net_init ip_vs_app_net_init(struct netns_ipvs *ipvs) { INIT_LIST_HEAD(&ipvs->app_list); - proc_create_net("ip_vs_app", 0, ipvs->net->proc_net, &ip_vs_app_seq_ops, - sizeof(struct seq_net_private)); +#ifdef CONFIG_PROC_FS + if (!proc_create_net("ip_vs_app", 0, ipvs->net->proc_net, + &ip_vs_app_seq_ops, + sizeof(struct seq_net_private))) + return -ENOMEM; +#endif return 0; } void __net_exit ip_vs_app_net_cleanup(struct netns_ipvs *ipvs) { unregister_ip_vs_app(ipvs, NULL /* all */); +#ifdef CONFIG_PROC_FS remove_proc_entry("ip_vs_app", ipvs->net->proc_net); +#endif } -- 2.9.5

2 1

[openeuler:OLK-5.10 2882/2882] arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__x64_sys_landlock_create_ruleset'
by kernel test robot 30 Jun '25

30 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2264b0731bcc958f540da580ad93b9f103a8e271 commit: 21dd31f58b64b122a2d9fb62669d6191d1cf2c0f [2882/2882] landlock: Add syscall implementations config: x86_64-randconfig-2005-20250501 (https://download.01.org/0day-ci/archive/20250630/202506301345.R55BMO2e-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250630/202506301345.R55BMO2e-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506301345.R55BMO2e-lkp@intel.com/ All warnings (new ones prefixed by >>): | ^~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:259:1: note: in expansion of macro 'COND_SYSCALL' 259 | COND_SYSCALL(mremap); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__ia32_sys_mremap' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:120:9: note: in expansion of macro '__COND_SYSCALL' 120 | __COND_SYSCALL(ia32, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:257:9: note: in expansion of macro '__IA32_COND_SYSCALL' 257 | __IA32_COND_SYSCALL(name) | ^~~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:259:1: note: in expansion of macro 'COND_SYSCALL' 259 | COND_SYSCALL(mremap); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__x64_sys_add_key' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:100:9: note: in expansion of macro '__COND_SYSCALL' 100 | __COND_SYSCALL(x64, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:256:9: note: in expansion of macro '__X64_COND_SYSCALL' 256 | __X64_COND_SYSCALL(name) \ | ^~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:262:1: note: in expansion of macro 'COND_SYSCALL' 262 | COND_SYSCALL(add_key); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__ia32_sys_add_key' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:120:9: note: in expansion of macro '__COND_SYSCALL' 120 | __COND_SYSCALL(ia32, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:257:9: note: in expansion of macro '__IA32_COND_SYSCALL' 257 | __IA32_COND_SYSCALL(name) | ^~~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:262:1: note: in expansion of macro 'COND_SYSCALL' 262 | COND_SYSCALL(add_key); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__x64_sys_request_key' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:100:9: note: in expansion of macro '__COND_SYSCALL' 100 | __COND_SYSCALL(x64, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:256:9: note: in expansion of macro '__X64_COND_SYSCALL' 256 | __X64_COND_SYSCALL(name) \ | ^~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:263:1: note: in expansion of macro 'COND_SYSCALL' 263 | COND_SYSCALL(request_key); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__ia32_sys_request_key' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:120:9: note: in expansion of macro '__COND_SYSCALL' 120 | __COND_SYSCALL(ia32, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:257:9: note: in expansion of macro '__IA32_COND_SYSCALL' 257 | __IA32_COND_SYSCALL(name) | ^~~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:263:1: note: in expansion of macro 'COND_SYSCALL' 263 | COND_SYSCALL(request_key); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__x64_sys_keyctl' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:100:9: note: in expansion of macro '__COND_SYSCALL' 100 | __COND_SYSCALL(x64, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:256:9: note: in expansion of macro '__X64_COND_SYSCALL' 256 | __X64_COND_SYSCALL(name) \ | ^~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:264:1: note: in expansion of macro 'COND_SYSCALL' 264 | COND_SYSCALL(keyctl); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__ia32_sys_keyctl' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:120:9: note: in expansion of macro '__COND_SYSCALL' 120 | __COND_SYSCALL(ia32, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:257:9: note: in expansion of macro '__IA32_COND_SYSCALL' 257 | __IA32_COND_SYSCALL(name) | ^~~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:264:1: note: in expansion of macro 'COND_SYSCALL' 264 | COND_SYSCALL(keyctl); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__ia32_compat_sys_keyctl' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:148:9: note: in expansion of macro '__COND_SYSCALL' 148 | __COND_SYSCALL(ia32, compat_sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:218:9: note: in expansion of macro '__IA32_COMPAT_COND_SYSCALL' 218 | __IA32_COMPAT_COND_SYSCALL(name) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:265:1: note: in expansion of macro 'COND_SYSCALL_COMPAT' 265 | COND_SYSCALL_COMPAT(keyctl); | ^~~~~~~~~~~~~~~~~~~ >> arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__x64_sys_landlock_create_ruleset' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:100:9: note: in expansion of macro '__COND_SYSCALL' 100 | __COND_SYSCALL(x64, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:256:9: note: in expansion of macro '__X64_COND_SYSCALL' 256 | __X64_COND_SYSCALL(name) \ | ^~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:268:1: note: in expansion of macro 'COND_SYSCALL' 268 | COND_SYSCALL(landlock_create_ruleset); | ^~~~~~~~~~~~ >> arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__ia32_sys_landlock_create_ruleset' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:120:9: note: in expansion of macro '__COND_SYSCALL' 120 | __COND_SYSCALL(ia32, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:257:9: note: in expansion of macro '__IA32_COND_SYSCALL' 257 | __IA32_COND_SYSCALL(name) | ^~~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:268:1: note: in expansion of macro 'COND_SYSCALL' 268 | COND_SYSCALL(landlock_create_ruleset); | ^~~~~~~~~~~~ >> arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__x64_sys_landlock_add_rule' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:100:9: note: in expansion of macro '__COND_SYSCALL' 100 | __COND_SYSCALL(x64, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:256:9: note: in expansion of macro '__X64_COND_SYSCALL' 256 | __X64_COND_SYSCALL(name) \ | ^~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:269:1: note: in expansion of macro 'COND_SYSCALL' 269 | COND_SYSCALL(landlock_add_rule); | ^~~~~~~~~~~~ >> arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__ia32_sys_landlock_add_rule' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:120:9: note: in expansion of macro '__COND_SYSCALL' 120 | __COND_SYSCALL(ia32, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:257:9: note: in expansion of macro '__IA32_COND_SYSCALL' 257 | __IA32_COND_SYSCALL(name) | ^~~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:269:1: note: in expansion of macro 'COND_SYSCALL' 269 | COND_SYSCALL(landlock_add_rule); | ^~~~~~~~~~~~ >> arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__x64_sys_landlock_restrict_self' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:100:9: note: in expansion of macro '__COND_SYSCALL' 100 | __COND_SYSCALL(x64, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:256:9: note: in expansion of macro '__X64_COND_SYSCALL' 256 | __X64_COND_SYSCALL(name) \ | ^~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:270:1: note: in expansion of macro 'COND_SYSCALL' 270 | COND_SYSCALL(landlock_restrict_self); | ^~~~~~~~~~~~ >> arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__ia32_sys_landlock_restrict_self' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:120:9: note: in expansion of macro '__COND_SYSCALL' 120 | __COND_SYSCALL(ia32, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:257:9: note: in expansion of macro '__IA32_COND_SYSCALL' 257 | __IA32_COND_SYSCALL(name) | ^~~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:270:1: note: in expansion of macro 'COND_SYSCALL' 270 | COND_SYSCALL(landlock_restrict_self); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__x64_sys_fadvise64_64' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:100:9: note: in expansion of macro '__COND_SYSCALL' 100 | __COND_SYSCALL(x64, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:256:9: note: in expansion of macro '__X64_COND_SYSCALL' 256 | __X64_COND_SYSCALL(name) \ | ^~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:275:1: note: in expansion of macro 'COND_SYSCALL' 275 | COND_SYSCALL(fadvise64_64); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__ia32_sys_fadvise64_64' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:120:9: note: in expansion of macro '__COND_SYSCALL' 120 | __COND_SYSCALL(ia32, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:257:9: note: in expansion of macro '__IA32_COND_SYSCALL' 257 | __IA32_COND_SYSCALL(name) | ^~~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:275:1: note: in expansion of macro 'COND_SYSCALL' 275 | COND_SYSCALL(fadvise64_64); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__ia32_compat_sys_fadvise64_64' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:148:9: note: in expansion of macro '__COND_SYSCALL' 148 | __COND_SYSCALL(ia32, compat_sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:218:9: note: in expansion of macro '__IA32_COMPAT_COND_SYSCALL' 218 | __IA32_COMPAT_COND_SYSCALL(name) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:276:1: note: in expansion of macro 'COND_SYSCALL_COMPAT' 276 | COND_SYSCALL_COMPAT(fadvise64_64); | ^~~~~~~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__x64_sys_swapon' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:100:9: note: in expansion of macro '__COND_SYSCALL' 100 | __COND_SYSCALL(x64, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:256:9: note: in expansion of macro '__X64_COND_SYSCALL' 256 | __X64_COND_SYSCALL(name) \ | ^~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:279:1: note: in expansion of macro 'COND_SYSCALL' 279 | COND_SYSCALL(swapon); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__ia32_sys_swapon' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:120:9: note: in expansion of macro '__COND_SYSCALL' 120 | __COND_SYSCALL(ia32, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:257:9: note: in expansion of macro '__IA32_COND_SYSCALL' 257 | __IA32_COND_SYSCALL(name) | ^~~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:279:1: note: in expansion of macro 'COND_SYSCALL' 279 | COND_SYSCALL(swapon); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__x64_sys_swapoff' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:100:9: note: in expansion of macro '__COND_SYSCALL' 100 | __COND_SYSCALL(x64, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:256:9: note: in expansion of macro '__X64_COND_SYSCALL' 256 | __X64_COND_SYSCALL(name) \ | ^~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:280:1: note: in expansion of macro 'COND_SYSCALL' 280 | COND_SYSCALL(swapoff); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__ia32_sys_swapoff' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:120:9: note: in expansion of macro '__COND_SYSCALL' 120 | __COND_SYSCALL(ia32, sys_##name) | ^~~~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:257:9: note: in expansion of macro '__IA32_COND_SYSCALL' 257 | __IA32_COND_SYSCALL(name) | ^~~~~~~~~~~~~~~~~~~ kernel/sys_ni.c:280:1: note: in expansion of macro 'COND_SYSCALL' 280 | COND_SYSCALL(swapoff); | ^~~~~~~~~~~~ arch/x86/include/asm/syscall_wrapper.h:83:21: warning: no previous prototype for '__x64_sys_mprotect' [-Wmissing-prototypes] 83 | __weak long __##abi##_##name(const struct pt_regs *__unused) \ | ^~ arch/x86/include/asm/syscall_wrapper.h:100:9: note: in expansion of macro '__COND_SYSCALL' 100 | __COND_SYSCALL(x64, sys_##name) vim +/__x64_sys_landlock_create_ruleset +83 arch/x86/include/asm/syscall_wrapper.h cc42c045af1ff4 Brian Gerst 2020-03-13 13 25c619e59b395a Brian Gerst 2020-03-13 14 /* 25c619e59b395a Brian Gerst 2020-03-13 15 * Instead of the generic __SYSCALL_DEFINEx() definition, the x86 version takes 25c619e59b395a Brian Gerst 2020-03-13 16 * struct pt_regs *regs as the only argument of the syscall stub(s) named as: 25c619e59b395a Brian Gerst 2020-03-13 17 * __x64_sys_*() - 64-bit native syscall 25c619e59b395a Brian Gerst 2020-03-13 18 * __ia32_sys_*() - 32-bit native syscall or common compat syscall 25c619e59b395a Brian Gerst 2020-03-13 19 * __ia32_compat_sys_*() - 32-bit compat syscall 25c619e59b395a Brian Gerst 2020-03-13 20 * __x32_compat_sys_*() - 64-bit X32 compat syscall 25c619e59b395a Brian Gerst 2020-03-13 21 * 25c619e59b395a Brian Gerst 2020-03-13 22 * The registers are decoded according to the ABI: 25c619e59b395a Brian Gerst 2020-03-13 23 * 64-bit: RDI, RSI, RDX, R10, R8, R9 25c619e59b395a Brian Gerst 2020-03-13 24 * 32-bit: EBX, ECX, EDX, ESI, EDI, EBP 25c619e59b395a Brian Gerst 2020-03-13 25 * 25c619e59b395a Brian Gerst 2020-03-13 26 * The stub then passes the decoded arguments to the __se_sys_*() wrapper to 25c619e59b395a Brian Gerst 2020-03-13 27 * perform sign-extension (omitted for zero-argument syscalls). Finally the 25c619e59b395a Brian Gerst 2020-03-13 28 * arguments are passed to the __do_sys_*() function which is the actual 25c619e59b395a Brian Gerst 2020-03-13 29 * syscall. These wrappers are marked as inline so the compiler can optimize 25c619e59b395a Brian Gerst 2020-03-13 30 * the functions where appropriate. 25c619e59b395a Brian Gerst 2020-03-13 31 * 25c619e59b395a Brian Gerst 2020-03-13 32 * Example assembly (slightly re-ordered for better readability): 25c619e59b395a Brian Gerst 2020-03-13 33 * 25c619e59b395a Brian Gerst 2020-03-13 34 * <__x64_sys_recv>: <-- syscall with 4 parameters 25c619e59b395a Brian Gerst 2020-03-13 35 * callq <__fentry__> 25c619e59b395a Brian Gerst 2020-03-13 36 * 25c619e59b395a Brian Gerst 2020-03-13 37 * mov 0x70(%rdi),%rdi <-- decode regs->di 25c619e59b395a Brian Gerst 2020-03-13 38 * mov 0x68(%rdi),%rsi <-- decode regs->si 25c619e59b395a Brian Gerst 2020-03-13 39 * mov 0x60(%rdi),%rdx <-- decode regs->dx 25c619e59b395a Brian Gerst 2020-03-13 40 * mov 0x38(%rdi),%rcx <-- decode regs->r10 25c619e59b395a Brian Gerst 2020-03-13 41 * 25c619e59b395a Brian Gerst 2020-03-13 42 * xor %r9d,%r9d <-- clear %r9 25c619e59b395a Brian Gerst 2020-03-13 43 * xor %r8d,%r8d <-- clear %r8 25c619e59b395a Brian Gerst 2020-03-13 44 * 25c619e59b395a Brian Gerst 2020-03-13 45 * callq __sys_recvfrom <-- do the actual work in __sys_recvfrom() 25c619e59b395a Brian Gerst 2020-03-13 46 * which takes 6 arguments 25c619e59b395a Brian Gerst 2020-03-13 47 * 25c619e59b395a Brian Gerst 2020-03-13 48 * cltq <-- extend return value to 64-bit 25c619e59b395a Brian Gerst 2020-03-13 49 * retq <-- return 25c619e59b395a Brian Gerst 2020-03-13 50 * 25c619e59b395a Brian Gerst 2020-03-13 51 * This approach avoids leaking random user-provided register content down 25c619e59b395a Brian Gerst 2020-03-13 52 * the call chain. 25c619e59b395a Brian Gerst 2020-03-13 53 */ 25c619e59b395a Brian Gerst 2020-03-13 54 ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 55 /* Mapping of registers to parameters for syscalls on x86-64 and x32 */ ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 56 #define SC_X86_64_REGS_TO_ARGS(x, ...) \ ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 57 __MAP(x,__SC_ARGS \ ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 58 ,,regs->di,,regs->si,,regs->dx \ ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 59 ,,regs->r10,,regs->r8,,regs->r9) \ ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 60 ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 61 /* Mapping of registers to parameters for syscalls on i386 */ ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 62 #define SC_IA32_REGS_TO_ARGS(x, ...) \ ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 63 __MAP(x,__SC_ARGS \ ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 64 ,,(unsigned int)regs->bx,,(unsigned int)regs->cx \ ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 65 ,,(unsigned int)regs->dx,,(unsigned int)regs->si \ ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 66 ,,(unsigned int)regs->di,,(unsigned int)regs->bp) ebeb8c82ffaf94 Dominik Brodowski 2018-04-05 67 d2b5de495ee983 Brian Gerst 2020-03-13 68 #define __SYS_STUB0(abi, name) \ 0f78ff17112d8b Brian Gerst 2020-03-13 69 long __##abi##_##name(const struct pt_regs *regs); \ d2b5de495ee983 Brian Gerst 2020-03-13 70 ALLOW_ERROR_INJECTION(__##abi##_##name, ERRNO); \ 0f78ff17112d8b Brian Gerst 2020-03-13 71 long __##abi##_##name(const struct pt_regs *regs) \ d2b5de495ee983 Brian Gerst 2020-03-13 72 __alias(__do_##name); d2b5de495ee983 Brian Gerst 2020-03-13 73 4399e0cf494f73 Brian Gerst 2020-03-13 74 #define __SYS_STUBx(abi, name, ...) \ 0f78ff17112d8b Brian Gerst 2020-03-13 75 long __##abi##_##name(const struct pt_regs *regs); \ 4399e0cf494f73 Brian Gerst 2020-03-13 76 ALLOW_ERROR_INJECTION(__##abi##_##name, ERRNO); \ 0f78ff17112d8b Brian Gerst 2020-03-13 77 long __##abi##_##name(const struct pt_regs *regs) \ 4399e0cf494f73 Brian Gerst 2020-03-13 78 { \ 4399e0cf494f73 Brian Gerst 2020-03-13 79 return __se_##name(__VA_ARGS__); \ 4399e0cf494f73 Brian Gerst 2020-03-13 80 } 4399e0cf494f73 Brian Gerst 2020-03-13 81 6cc8d2b286d9e7 Brian Gerst 2020-03-13 82 #define __COND_SYSCALL(abi, name) \ 0f78ff17112d8b Brian Gerst 2020-03-13 @83 __weak long __##abi##_##name(const struct pt_regs *__unused) \ 6cc8d2b286d9e7 Brian Gerst 2020-03-13 84 { \ 6cc8d2b286d9e7 Brian Gerst 2020-03-13 85 return sys_ni_syscall(); \ 6cc8d2b286d9e7 Brian Gerst 2020-03-13 86 } 6cc8d2b286d9e7 Brian Gerst 2020-03-13 87 :::::: The code at line 83 was first introduced by commit :::::: 0f78ff17112d8b3469b805ff4ea9780cc1e5c93b x86/entry: Drop asmlinkage from syscalls :::::: TO: Brian Gerst <brgerst(a)gmail.com> :::::: CC: Thomas Gleixner <tglx(a)linutronix.de> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH 0/6] support NMI watchdog
by Yang Yingliang 30 Jun '25

30 Jun '25

Douglas Anderson (1): arm64: enable perf events based hard lockup detector Ionela Voinescu (1): cpufreq: add function to get the hardware max frequency Jingyi Wang (1): arm64: watchdog: add switch to select sdei_watchdog/pmu_watchdog Lecopzer Chen (1): arm64: add hw_nmi_get_sample_period for preparation of lockup detector Wei Li (1): arm64: add new config CONFIG_PMU_WATCHDOG Yicong Yang (1): irqchip/gic-v3: Fix one race condition due to NMI withdraw arch/arm64/Kconfig | 1 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/watchdog_hld.c | 24 ++++++++++++++++++++++++ arch/arm64/kernel/watchdog_sdei.c | 23 +++++++++++++++++------ drivers/cpufreq/cpufreq.c | 20 ++++++++++++++++++++ drivers/irqchip/irq-gic-v3.c | 22 ++++++++++++++++++++++ include/linux/cpufreq.h | 5 +++++ include/linux/nmi.h | 11 +++++++++++ kernel/watchdog.c | 28 +++++++++++++++++++++------- lib/Kconfig.debug | 10 ++++++++++ 10 files changed, 132 insertions(+), 13 deletions(-) create mode 100644 arch/arm64/kernel/watchdog_hld.c -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS] ftrace: Fix UAF when lookup kallsym after ftrace disabled
by Tengda Wu 30 Jun '25

30 Jun '25

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.16-rc1 commit f914b52c379c12288b7623bb814d0508dbe7481d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICIHX1 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The following issue happens with a buggy module: BUG: unable to handle page fault for address: ffffffffc05d0218 PGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN PTI Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS RIP: 0010:sized_strscpy+0x81/0x2f0 RSP: 0018:ffff88812d76fa08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffffffc0601010 RCX: dffffc0000000000 RDX: 0000000000000038 RSI: dffffc0000000000 RDI: ffff88812608da2d RBP: 8080808080808080 R08: ffff88812608da2d R09: ffff88812608da68 R10: ffff88812608d82d R11: ffff88812608d810 R12: 0000000000000038 R13: ffff88812608da2d R14: ffffffffc05d0218 R15: fefefefefefefeff FS: 00007fef552de740(0000) GS:ffff8884251c7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc05d0218 CR3: 00000001146f0000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ftrace_mod_get_kallsym+0x1ac/0x590 update_iter_mod+0x239/0x5b0 s_next+0x5b/0xa0 seq_read_iter+0x8c9/0x1070 seq_read+0x249/0x3b0 proc_reg_read+0x1b0/0x280 vfs_read+0x17f/0x920 ksys_read+0xf3/0x1c0 do_syscall_64+0x5f/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The above issue may happen as follows: (1) Add kprobe tracepoint; (2) insmod test.ko; (3) Module triggers ftrace disabled; (4) rmmod test.ko; (5) cat /proc/kallsyms; --> Will trigger UAF as test.ko already removed; ftrace_mod_get_kallsym() ... strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN); ... The problem is when a module triggers an issue with ftrace and sets ftrace_disable. The ftrace_disable is set when an anomaly is discovered and to prevent any more damage, ftrace stops all text modification. The issue that happened was that the ftrace_disable stops more than just the text modification. When a module is loaded, its init functions can also be traced. Because kallsyms deletes the init functions after a module has loaded, ftrace saves them when the module is loaded and function tracing is enabled. This allows the output of the function trace to show the init function names instead of just their raw memory addresses. When a module is removed, ftrace_release_mod() is called, and if ftrace_disable is set, it just returns without doing anything more. The problem here is that it leaves the mod_list still around and if kallsyms is called, it will call into this code and access the module memory that has already been freed as it will return: strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN); Where the "mod" no longer exists and triggers a UAF bug. Link: https://lore.kernel.org/all/20250523135452.626d8dcd@gandalf.local.home/ Cc: stable(a)vger.kernel.org Fixes: aba4b5c22cba ("ftrace: Save module init functions kallsyms symbols for tracing") Link: https://lore.kernel.org/20250529111955.2349189-2-yebin@huaweicloud.com Signed-off-by: Ye Bin <yebin10(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/ftrace.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 8199571d9ab3..77d31a2189ef 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -5788,9 +5788,10 @@ void ftrace_release_mod(struct module *mod) mutex_lock(&ftrace_lock); - if (ftrace_disabled) - goto out_unlock; - + /* + * To avoid the UAF problem after the module is unloaded, the + * 'mod_map' resource needs to be released unconditionally. + */ list_for_each_entry_safe(mod_map, n, &ftrace_mod_maps, list) { if (mod_map->mod == mod) { list_del_rcu(&mod_map->list); @@ -5799,6 +5800,9 @@ void ftrace_release_mod(struct module *mod) } } + if (ftrace_disabled) + goto out_unlock; + /* * Each module has its own ftrace_pages, remove * them from the list. -- 2.34.1

2 1

[PATCH OLK-6.6 v1] drm/amd/display: Increase block_sequence array size
by Wei Li 30 Jun '25

30 Jun '25

From: Joshua Aberback <joshua.aberback(a)amd.com> mainline inclusion from mainline-v6.15-rc1 commit 3a7810c212bcf2f722671dadf4b23ff70a7d23ee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGADE CVE: CVE-2025-38080 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- [Why] It's possible to generate more than 50 steps in hwss_build_fast_sequence, for example with a 6-pipe asic where all pipes are in one MPC chain. This overflows the block_sequence buffer and corrupts block_sequence_steps, causing a crash. [How] Expand block_sequence to 100 items. A naive upper bound on the possible number of steps for a 6-pipe asic, ignoring the potential for steps to be mutually exclusive, is 91 with current code, therefore 100 is sufficient. Reviewed-by: Alvin Lee <alvin.lee2(a)amd.com> Signed-off-by: Joshua Aberback <joshua.aberback(a)amd.com> Signed-off-by: Wayne Lin <wayne.lin(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Wei Li <liwei391(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/inc/core_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/inc/core_types.h b/drivers/gpu/drm/amd/display/dc/inc/core_types.h index eaad1260bfd18..4b284ce669ae5 100644 --- a/drivers/gpu/drm/amd/display/dc/inc/core_types.h +++ b/drivers/gpu/drm/amd/display/dc/inc/core_types.h @@ -532,7 +532,7 @@ struct dc_state { */ struct bw_context bw_ctx; - struct block_sequence block_sequence[50]; + struct block_sequence block_sequence[100]; unsigned int block_sequence_steps; struct dc_dmub_cmd dc_dmub_cmd[10]; unsigned int dmub_cmd_count; -- 2.25.1

2 1

[PATCH 00/13] arm64/nmi: Support for FEAT_NMI
by Yang Yingliang 30 Jun '25

30 Jun '25

Jinjie Ruan (1): irqchip/gic-v3: Fix hard LOCKUP caused by NMI being masked Lorenzo Pieralisi (1): irqchip/gic-v3: Implement FEAT_GICv3_NMI support Mark Brown (11): arm64/booting: Document boot requirements for FEAT_NMI arm64/sysreg: Add definitions for immediate versions of MSR ALLINT arm64/asm: Introduce assembly macros for managing ALLINT arm64/hyp-stub: Enable access to ALLINT arm64/cpufeature: Detect PE support for FEAT_NMI KVM: arm64: Hide FEAT_NMI from guests arm64/nmi: Manage masking for superpriority interrupts along with DAIF arm64/entry: Don't call preempt_schedule_irq() with NMIs masked arm64/irq: Document handling of FEAT_NMI in irqflags.h arm64/nmi: Add handling of superpriority interrupts as NMIs arm64/nmi: Add Kconfig for NMI Documentation/arm64/booting.rst | 6 ++ arch/arm64/Kconfig | 13 +++ arch/arm64/include/asm/assembler.h | 18 +++++ arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/cpufeature.h | 8 ++ arch/arm64/include/asm/daifflags.h | 20 +++++ arch/arm64/include/asm/irqflags.h | 10 +++ arch/arm64/include/asm/ptrace.h | 5 +- arch/arm64/include/asm/sysreg.h | 26 ++++++ arch/arm64/include/uapi/asm/ptrace.h | 1 + arch/arm64/kernel/cpufeature.c | 64 ++++++++++++++- arch/arm64/kernel/head.S | 13 +++ arch/arm64/kernel/process.c | 9 +++ arch/arm64/kvm/hyp/switch.c | 7 ++ arch/arm64/kvm/sys_regs.c | 2 + drivers/irqchip/irq-gic-v3.c | 116 ++++++++++++++++++++++++--- include/linux/irqchip/arm-gic-v3.h | 4 + 17 files changed, 310 insertions(+), 14 deletions(-) -- 2.25.1

1 13

[PATCH OLK-5.10 v4 0/8] Introduce soft domain v4
by Zhang Qiao 30 Jun '25

30 Jun '25

v3: - Rebase OLK-5.10 - Add a bugfix for atomic sleep Zhang Qiao (8): sched: topology: Build soft domain for LLC sched: Attach task group to soft domain sched: fair: Select idle cpu in soft domain sched: fair: Disable numa migrate for soft domian task sched: Add cmdline sched_soft_domain switch for soft domain feature config: Configurate CONFIG_SCHED_SOFT_DOMAIN sched: Balance newly task to soft domain sched: Fix might sleep in atomic section issue arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/sched/topology.h | 21 + init/Kconfig | 12 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 85 +++++ kernel/sched/fair.c | 156 +++++++- kernel/sched/features.h | 4 + kernel/sched/sched.h | 43 +++ kernel/sched/soft_domain.c | 505 +++++++++++++++++++++++++ 10 files changed, 827 insertions(+), 2 deletions(-) create mode 100644 kernel/sched/soft_domain.c -- 2.18.0.huawei.25

2 9

[PATCH 00/13] arm64/nmi: Support for FEAT_NMI
by Yang Yingliang 30 Jun '25

30 Jun '25

Jinjie Ruan (1): irqchip/gic-v3: Fix hard LOCKUP caused by NMI being masked Lorenzo Pieralisi (1): irqchip/gic-v3: Implement FEAT_GICv3_NMI support Mark Brown (11): arm64/booting: Document boot requirements for FEAT_NMI arm64/sysreg: Add definitions for immediate versions of MSR ALLINT arm64/asm: Introduce assembly macros for managing ALLINT arm64/hyp-stub: Enable access to ALLINT arm64/cpufeature: Detect PE support for FEAT_NMI KVM: arm64: Hide FEAT_NMI from guests arm64/nmi: Manage masking for superpriority interrupts along with DAIF arm64/entry: Don't call preempt_schedule_irq() with NMIs masked arm64/irq: Document handling of FEAT_NMI in irqflags.h arm64/nmi: Add handling of superpriority interrupts as NMIs arm64/nmi: Add Kconfig for NMI Documentation/arm64/booting.rst | 6 ++ arch/arm64/Kconfig | 17 ++++ arch/arm64/include/asm/assembler.h | 18 +++++ arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/cpufeature.h | 29 +++++++ arch/arm64/include/asm/daifflags.h | 20 +++++ arch/arm64/include/asm/irqflags.h | 10 +++ arch/arm64/include/asm/ptrace.h | 5 +- arch/arm64/include/asm/sysreg.h | 26 ++++++ arch/arm64/include/uapi/asm/ptrace.h | 1 + arch/arm64/kernel/cpufeature.c | 64 ++++++++++++++- arch/arm64/kernel/head.S | 13 +++ arch/arm64/kernel/process.c | 9 +++ arch/arm64/kvm/hyp/switch.c | 7 ++ arch/arm64/kvm/sys_regs.c | 2 + drivers/irqchip/irq-gic-v3.c | 116 ++++++++++++++++++++++++--- include/linux/irqchip/arm-gic-v3.h | 4 + 17 files changed, 335 insertions(+), 14 deletions(-) -- 2.25.1

1 13

[PATCH OLK-6.6] tracing: probes: Fix a possible race in trace_probe_log APIs
by Tengda Wu 30 Jun '25

30 Jun '25

From: "Masami Hiramatsu (Google)" <mhiramat(a)kernel.org> stable inclusion from stable-6.6.94 commit 70417bada46dcfb91b59757bad343f753d9d9345 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICIOVW Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fd837de3c9cb1a162c69bc1fb1f438467fe7f2f5 ] Since the shared trace_probe_log variable can be accessed and modified via probe event create operation of kprobe_events, uprobe_events, and dynamic_events, it should be protected. In the dynamic_events, all operations are serialized by `dyn_event_ops_mutex`. But kprobe_events and uprobe_events interfaces are not serialized. To solve this issue, introduces dyn_event_create(), which runs create() operation under the mutex, for kprobe_events and uprobe_events. This also uses lockdep to check the mutex is held when using trace_probe_log* APIs. Link: https://lore.kernel.org/all/174684868120.551552.3068655787654268804.stgit@d… Reported-by: Paul Cacheux <paulcacheux(a)gmail.com> Closes: https://lore.kernel.org/all/20250510074456.805a16872b591e2971a4d221@kernel.… Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events") Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_dynevent.c | 16 +++++++++++++++- kernel/trace/trace_dynevent.h | 1 + kernel/trace/trace_kprobe.c | 2 +- kernel/trace/trace_probe.c | 9 +++++++++ kernel/trace/trace_uprobe.c | 2 +- 5 files changed, 27 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace_dynevent.c b/kernel/trace/trace_dynevent.c index 4376887e0d8a..c9b0533407ed 100644 --- a/kernel/trace/trace_dynevent.c +++ b/kernel/trace/trace_dynevent.c @@ -16,7 +16,7 @@ #include "trace_output.h" /* for trace_event_sem */ #include "trace_dynevent.h" -static DEFINE_MUTEX(dyn_event_ops_mutex); +DEFINE_MUTEX(dyn_event_ops_mutex); static LIST_HEAD(dyn_event_ops_list); bool trace_event_dyn_try_get_ref(struct trace_event_call *dyn_call) @@ -125,6 +125,20 @@ int dyn_event_release(const char *raw_command, struct dyn_event_operations *type return ret; } +/* + * Locked version of event creation. The event creation must be protected by + * dyn_event_ops_mutex because of protecting trace_probe_log. + */ +int dyn_event_create(const char *raw_command, struct dyn_event_operations *type) +{ + int ret; + + mutex_lock(&dyn_event_ops_mutex); + ret = type->create(raw_command); + mutex_unlock(&dyn_event_ops_mutex); + return ret; +} + static int create_dyn_event(const char *raw_command) { struct dyn_event_operations *ops; diff --git a/kernel/trace/trace_dynevent.h b/kernel/trace/trace_dynevent.h index 936477a111d3..beee3f8d7544 100644 --- a/kernel/trace/trace_dynevent.h +++ b/kernel/trace/trace_dynevent.h @@ -100,6 +100,7 @@ void *dyn_event_seq_next(struct seq_file *m, void *v, loff_t *pos); void dyn_event_seq_stop(struct seq_file *m, void *v); int dyn_events_release_all(struct dyn_event_operations *type); int dyn_event_release(const char *raw_command, struct dyn_event_operations *type); +int dyn_event_create(const char *raw_command, struct dyn_event_operations *type); /* * for_each_dyn_event - iterate over the dyn_event list diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c index 5d056ec79119..73ebe6700eb9 100644 --- a/kernel/trace/trace_kprobe.c +++ b/kernel/trace/trace_kprobe.c @@ -1002,7 +1002,7 @@ static int create_or_delete_trace_kprobe(const char *raw_command) if (raw_command[0] == '-') return dyn_event_release(raw_command, &trace_kprobe_ops); - ret = trace_kprobe_create(raw_command); + ret = dyn_event_create(raw_command, &trace_kprobe_ops); return ret == -ECANCELED ? -EINVAL : ret; } diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 5390e5306913..3a7fbe1da879 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -154,9 +154,12 @@ static const struct fetch_type *find_fetch_type(const char *type, unsigned long } static struct trace_probe_log trace_probe_log; +extern struct mutex dyn_event_ops_mutex; void trace_probe_log_init(const char *subsystem, int argc, const char **argv) { + lockdep_assert_held(&dyn_event_ops_mutex); + trace_probe_log.subsystem = subsystem; trace_probe_log.argc = argc; trace_probe_log.argv = argv; @@ -165,11 +168,15 @@ void trace_probe_log_init(const char *subsystem, int argc, const char **argv) void trace_probe_log_clear(void) { + lockdep_assert_held(&dyn_event_ops_mutex); + memset(&trace_probe_log, 0, sizeof(trace_probe_log)); } void trace_probe_log_set_index(int index) { + lockdep_assert_held(&dyn_event_ops_mutex); + trace_probe_log.index = index; } @@ -178,6 +185,8 @@ void __trace_probe_log_err(int offset, int err_type) char *command, *p; int i, len = 0, pos = 0; + lockdep_assert_held(&dyn_event_ops_mutex); + if (!trace_probe_log.argv) return; diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c index 9110a759e882..89b467c6560a 100644 --- a/kernel/trace/trace_uprobe.c +++ b/kernel/trace/trace_uprobe.c @@ -730,7 +730,7 @@ static int create_or_delete_trace_uprobe(const char *raw_command) if (raw_command[0] == '-') return dyn_event_release(raw_command, &trace_uprobe_ops); - ret = trace_uprobe_create(raw_command); + ret = dyn_event_create(raw_command, &trace_uprobe_ops); return ret == -ECANCELED ? -EINVAL : ret; } -- 2.34.1

2 1