- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 00/12] mm: more thp control for large folio
by Kefeng Wang 18 May '24

18 May '24

Barry Song (4): mm: add per-order mTHP anon_fault_alloc and anon_fault_fallback counters mm: add per-order mTHP anon_swpout and anon_swpout_fallback counters mm: add docs for per-order mTHP counters and transhuge_page ABI mm: correct the docs for thp_fault_alloc and thp_fault_fallback Kefeng Wang (4): mm: filemap: make mTHP configurable for exec mapping mm: huge_memory: add folio_get_unmapped_area() mm: huge_memory: add thp mapping align control mm: add control to allow specified high-order pages stored on PCP list Matthew Wilcox (Oracle) (3): mm: remove inc/dec lruvec page state functions mm/khugepaged: use a folio more in collapse_file() mm/memcontrol: remove __mod_lruvec_page_state() Ryan Roberts (1): mm/filemap: Allow arch to request folio size for exec memory .../sysfs-kernel-mm-transparent-hugepage | 18 ++ Documentation/admin-guide/mm/transhuge.rst | 58 +++- arch/arm64/include/asm/pgtable.h | 12 + include/linux/gfp.h | 1 + include/linux/huge_mm.h | 27 ++ include/linux/pgtable.h | 12 + include/linux/vmstat.h | 60 ++--- mm/filemap.c | 42 +++ mm/huge_memory.c | 252 +++++++++++++++++- mm/khugepaged.c | 16 +- mm/memcontrol.c | 9 +- mm/memory.c | 5 + mm/page_alloc.c | 18 +- mm/page_io.c | 1 + mm/vmscan.c | 3 + 15 files changed, 460 insertions(+), 74 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-transparent-hugepage -- 2.27.0

2 13

[PATCH OLK-6.6 00/12] mm: more thp control for large folio
by Kefeng Wang 17 May '24

17 May '24

Barry Song (4): mm: add per-order mTHP anon_fault_alloc and anon_fault_fallback counters mm: add per-order mTHP anon_swpout and anon_swpout_fallback counters mm: add docs for per-order mTHP counters and transhuge_page ABI mm: correct the docs for thp_fault_alloc and thp_fault_fallback Kefeng Wang (4): mm: filemap: make mTHP configurable for exec mapping mm: huge_memory: add folio_get_unmapped_area() mm: huge_memory: add thp mapping align control mm: add control to allow specified high-order pages stored on PCP list Matthew Wilcox (Oracle) (3): mm: remove inc/dec lruvec page state functions mm/khugepaged: use a folio more in collapse_file() mm/memcontrol: remove __mod_lruvec_page_state() Ryan Roberts (1): mm/filemap: Allow arch to request folio size for exec memory .../sysfs-kernel-mm-transparent-hugepage | 18 ++ Documentation/admin-guide/mm/transhuge.rst | 58 +++- arch/arm64/include/asm/pgtable.h | 12 + include/linux/gfp.h | 1 + include/linux/huge_mm.h | 27 ++ include/linux/pgtable.h | 12 + include/linux/vmstat.h | 60 ++--- mm/filemap.c | 42 +++ mm/huge_memory.c | 252 +++++++++++++++++- mm/khugepaged.c | 16 +- mm/memcontrol.c | 9 +- mm/memory.c | 5 + mm/page_alloc.c | 18 +- mm/page_io.c | 1 + mm/vmscan.c | 3 + 15 files changed, 460 insertions(+), 74 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-transparent-hugepage -- 2.27.0

2 13

[PATCH OLK-6.6 00/18] arm64: perf: Add support for event counting threshold
by Junhao He 17 May '24

17 May '24

counting of PMU events depending on how much the event increments on a single cycle. Two new config fields for perf_event_open have been added, and a PMU cap file for reading the max_threshold. See the second commit message and the docs in the last commit for more details. The feature is not currently supported on KVM guests, and PMMIR is set to read as zero, so it's not advertised as available. But it can be added at a later time. Writes to PMEVTYPER.TC and TH from guests are already RES0. The change has been validated on the Arm FVP model: # Zero values, works as expected (as before). $ perf stat -e dtlb_walk/threshold=0,threshold_compare=0/ -- true 5962 dtlb_walk/threshold=0,threshold_compare=0/ # Threshold >= 255 causes count to be 0 because dtlb_walk doesn't # increase by more than 1 per cycle. $ perf stat -e dtlb_walk/threshold=255,threshold_compare=2/ -- true 0 dtlb_walk/threshold=255,threshold_compare=2/ # Keeping comparison as >= but lowering the threshold to 1 makes the # count return. $ perf stat -e dtlb_walk/threshold=1,threshold_compare=2/ -- true 6329 dtlb_walk/threshold=1,threshold_compare=2/ Anshuman Khandual (3): drivers: perf: arm_pmuv3: Read PMMIR_EL1 unconditionally drivers: perf: arm_pmuv3: Drop some unused arguments from armv8_pmu_init() drivers: perf: arm_pmuv3: Add new macro PMUV3_INIT_MAP_EVENT() James Clark (11): arm: perf: Remove inlines from arm_pmuv3.c arm: perf/kvm: Use GENMASK for ARMV8_PMU_PMCR_N arm: perf: Use GENMASK for PMMIR fields arm: perf: Convert remaining fields to use GENMASK arm64: perf: Include threshold control fields in PMEVTYPER mask arm: pmu: Share user ABI format mechanism with SPE perf/arm_dmc620: Remove duplicate format attribute #defines arm: pmu: Move error message and -EOPNOTSUPP to individual PMUs arm64: perf: Add support for event counting threshold Documentation: arm64: Document the PMU event counting threshold feature arm: perf: Fix ARCH=arm build with GCC Oliver Upton (2): KVM: arm64: Make PMEVTYPER<n>_EL0.NSH RES0 if EL2 isn't advertised KVM: arm64: Add PMU event filter bits required if EL3 is implemented Reiji Watanabe (1): KVM: arm64: PMU: Add a helper to read a vCPU's PMCR_EL0 Will Deacon (1): Revert "perf/arm_dmc620: Remove duplicate format attribute #defines" Documentation/arch/arm64/perf.rst | 72 ++++++++ arch/arm/kernel/perf_event_v7.c | 6 +- arch/arm64/kvm/arm.c | 3 +- arch/arm64/kvm/pmu-emul.c | 58 +++++-- arch/arm64/kvm/sys_regs.c | 21 ++- drivers/perf/apple_m1_cpu_pmu.c | 6 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmuv3.c | 266 ++++++++++++++++++------------ drivers/perf/arm_spe_pmu.c | 22 --- include/kvm/arm_pmu.h | 11 ++ include/linux/perf/arm_pmu.h | 22 +++ include/linux/perf/arm_pmuv3.h | 43 +++-- 12 files changed, 359 insertions(+), 182 deletions(-) -- 2.33.0

2 19

[PATCH OLK-6.6 0/2] ext4 iomap performance optimize
by Yang Erkun 17 May '24

17 May '24

*** BLURB HERE *** Yang Erkun (2): iomap: export __iomap_write_{begin|end} ext4: fallback to generic_perform_write once iov_iter_count <= PAGE_SIZE fs/ext4/file.c | 3 +- fs/ext4/inode.c | 124 ++++++++++++++++++++++++++++++++++++ fs/iomap/buffered-io.c | 6 +- include/linux/iomap.h | 4 ++ include/trace/events/ext4.h | 15 +++++ 5 files changed, 149 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] add cvm TSI interface
by Shengjie Li 17 May '24

17 May '24

virtcca inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9Q85J -------------------------------- Add TSI interface for Confidential VMs: 1. Add smc call for Confidential cVMs 2. Add TSI interface driver Signed-off-by: Shengjie Li <lishengjie12(a)huawei.com> --- arch/arm64/include/asm/tsi.h | 18 ++ arch/arm64/include/asm/tsi_cmds.h | 79 +++++++++ arch/arm64/include/asm/tsi_smc.h | 81 +++++++++ arch/arm64/include/uapi/asm/tsi_tmm.h | 73 ++++++++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/setup.c | 11 ++ arch/arm64/kernel/tsi.c | 45 +++++ arch/arm64/kernel/tsi_tmm.c | 246 ++++++++++++++++++++++++++ 8 files changed, 554 insertions(+), 1 deletion(-) create mode 100644 arch/arm64/include/asm/tsi.h create mode 100644 arch/arm64/include/asm/tsi_cmds.h create mode 100644 arch/arm64/include/asm/tsi_smc.h create mode 100644 arch/arm64/include/uapi/asm/tsi_tmm.h create mode 100644 arch/arm64/kernel/tsi.c create mode 100644 arch/arm64/kernel/tsi_tmm.c diff --git a/arch/arm64/include/asm/tsi.h b/arch/arm64/include/asm/tsi.h new file mode 100644 index 0000000000..13dee2ddd4 --- /dev/null +++ b/arch/arm64/include/asm/tsi.h @@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef __ASM_TSI_H_ +#define __ASM_TSI_H_ + +#include <linux/jump_label.h> + +extern struct static_key_false tsi_present; + +void arm64_setup_memory(void); + +void __init arm64_tsi_init(void); + +static inline bool is_cvm_world(void) +{ + return static_branch_unlikely(&tsi_present); +} + +#endif /* __ASM_TSI_H_ */ diff --git a/arch/arm64/include/asm/tsi_cmds.h b/arch/arm64/include/asm/tsi_cmds.h new file mode 100644 index 0000000000..e558619b46 --- /dev/null +++ b/arch/arm64/include/asm/tsi_cmds.h @@ -0,0 +1,79 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef __ASM_TSI_CMDS_H_ +#define __ASM_TSI_CMDS_H_ + +#include <linux/arm-smccc.h> +#include <asm/tsi_smc.h> +#include <asm/tsi_tmm.h> + +static inline unsigned long tsi_get_version(void) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_ABI_VERSION, &res); + + return res.a0; +} + +static inline unsigned long tsi_measurement_extend(struct cvm_measurement_extend *cvm_meas_ext) +{ + + struct arm_smccc_res res; + unsigned char value[MAX_MEASUREMENT_SIZE]; + + memcpy(value, &cvm_meas_ext->value, sizeof(cvm_meas_ext->value)); + + arm_smccc_1_1_smc(SMC_TSI_MEASUREMENT_EXTEND, cvm_meas_ext->index, + cvm_meas_ext->size, virt_to_phys(value), &res); + + return res.a0; +} + +static inline unsigned long tsi_measurement_read(struct cvm_measurement *cvm_meas) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_MEASUREMENT_READ, cvm_meas->index, &res); + + memcpy(cvm_meas->value, &res.a1, sizeof(cvm_meas->value)); + + return res.a0; +} + +static inline unsigned long tsi_attestation_token_init(struct cvm_attestation_cmd *attest_cmd) +{ + struct arm_smccc_res res; + unsigned char challenge[CHALLENGE_SIZE]; + + memcpy(challenge, attest_cmd->challenge, sizeof(attest_cmd->challenge)); + + arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_INIT, virt_to_phys(challenge), &res); + + return res.a0; +} + +static inline unsigned long tsi_attestation_token_continue(struct cvm_attestation_cmd *attest_cmd) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_ATTESTATION_TOKEN_CONTINUE, virt_to_phys(attest_cmd->granule_ipa), + attest_cmd->offset, attest_cmd->size, &res); + + attest_cmd->num_wr_bytes = res.a1; + + return res.a0; +} + +static inline unsigned long tsi_get_device_cert(struct cca_device_cert *dev_cert, + unsigned char *cert_buf) +{ + struct arm_smccc_res res; + + arm_smccc_1_1_smc(SMC_TSI_DEVICE_CERT, virt_to_phys(cert_buf), MAX_DEV_CERT_SIZE, &res); + + dev_cert->size = res.a1; + + return res.a0; +} + +#endif /* __ASM_TSI_CMDS_H_ */ diff --git a/arch/arm64/include/asm/tsi_smc.h b/arch/arm64/include/asm/tsi_smc.h new file mode 100644 index 0000000000..9353e3befe --- /dev/null +++ b/arch/arm64/include/asm/tsi_smc.h @@ -0,0 +1,81 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef __ASM_TSI_SMC_H_ +#define __ASM_TSI_SMC_H_ + +#define SMC_TSI_CALL_BASE 0xC4000000 +#define TSI_ABI_VERSION_MAJOR 1 +#define TSI_ABI_VERSION_MINOR 0 +#define TSI_ABI_VERSION ((TSI_ABI_VERSION_MAJOR << 16) | \ + TSI_ABI_VERSION_MINOR) + +#define TSI_ABI_VERSION_GET_MAJOR(_version) ((_version) >> 16) +#define TSI_ABI_VERSION_GET_MINOR(_version) ((_version) & 0xFFFF) + +#define TSI_SUCCESS 0 +#define TSI_ERROR_INPUT 1 +#define TSI_ERROR_STATE 2 +#define TSI_INCOMPLETE 3 + +#define SMC_TSI_FID(_x) (SMC_TSI_CALL_BASE + (_x)) +#define SMC_TSI_ABI_VERSION SMC_TSI_FID(0x190) + +/* + * arg1 == Index, which measurements slot to read + * ret0 == Status / error + * ret1 == Measurement value, bytes: 0 - 7 + * ret2 == Measurement value, bytes: 8 - 15 + * ret3 == Measurement value, bytes: 16 - 23 + * ret4 == Measurement value, bytes: 24 - 31 + * ret5 == Measurement value, bytes: 32 - 39 + * ret6 == Measurement value, bytes: 40 - 47 + * ret7 == Measurement value, bytes: 48 - 55 + * ret8 == Measurement value, bytes: 56 - 63 + */ +#define SMC_TSI_MEASUREMENT_READ SMC_TSI_FID(0x192) + +/* + * arg1 == Index, which measurements slot to extend + * arg2 == Size of realm measurement in bytes, max 64 bytes + * arg3 == Measurement value, bytes: 0 - 7 + * arg4 == Measurement value, bytes: 8 - 15 + * arg5 == Measurement value, bytes: 16 - 23 + * arg6 == Measurement value, bytes: 24 - 31 + * arg7 == Measurement value, bytes: 32 - 39 + * arg8 == Measurement value, bytes: 40 - 47 + * arg9 == Measurement value, bytes: 48 - 55 + * arg10 == Measurement value, bytes: 56 - 63 + * ret0 == Status / error + */ +#define SMC_TSI_MEASUREMENT_EXTEND SMC_TSI_FID(0x193) + +/* + * arg1: Challenge value, bytes: 0 - 7 + * arg2: Challenge value, bytes: 8 - 15 + * arg3: Challenge value, bytes: 16 - 23 + * arg4: Challenge value, bytes: 24 - 31 + * arg5: Challenge value, bytes: 32 - 39 + * arg6: Challenge value, bytes: 40 - 47 + * arg7: Challenge value, bytes: 48 - 55 + * arg8: Challenge value, bytes: 56 - 63 + * ret0: Status / error + * ret1: Upper bound on attestation token size in bytes + */ +#define SMC_TSI_ATTESTATION_TOKEN_INIT SMC_TSI_FID(0x194) + +/* + * arg1: IPA of the Granule to which the token will be written + * arg2: Offset within Granule to start of buffer in bytes + * arg3: Size of buffer in bytes + * ret0: Status / error + * ret1: Number of bytes written to buffer + */ +#define SMC_TSI_ATTESTATION_TOKEN_CONTINUE SMC_TSI_FID(0x195) + +/* + * arg1 == struct realm_config addr + * ret0 == Status / error + */ +#define SMC_TSI_DEVICE_CERT SMC_TSI_FID(0x196) + + +#endif /* __ASM_TSI_SMC_H_ */ diff --git a/arch/arm64/include/uapi/asm/tsi_tmm.h b/arch/arm64/include/uapi/asm/tsi_tmm.h new file mode 100644 index 0000000000..fd24385575 --- /dev/null +++ b/arch/arm64/include/uapi/asm/tsi_tmm.h @@ -0,0 +1,73 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef __ASM_TSI_TMM_H_ +#define __ASM_TSI_TMM_H_ + +#include <linux/ioctl.h> + +#define TSI_MAGIC 'T' + +/* Measurement slot reserved for RIM */ +#define RIM_MEASUREMENT_SLOT (0U) + +/* Maximum number of measurements */ +#define MEASUREMENT_SLOT_NR (5U) + +/* Size in bytes of the SHA256 measurement */ +#define SHA256_SIZE (32U) + +/* Size in bytes of the SHA512 measurement */ +#define SHA512_SIZE (64U) + +/* + * Size in bytes of the largest measurement type that can be supported. + * This macro needs to be updated accordingly if new algorithms are supported. + */ +#define MAX_MEASUREMENT_SIZE SHA512_SIZE +#define MAX_DEV_CERT_SIZE 4096 + +#define MAX_TOKEN_GRANULE_PAGE (10U) +#define CHALLENGE_SIZE (64U) + +struct cvm_attester { + int dev_fd; +}; + +struct cvm_measurement { + int index; + unsigned char value[MAX_MEASUREMENT_SIZE]; +}; + +struct cvm_tsi_version { + int major; + int minor; +}; + +struct cvm_measurement_extend { + unsigned long long index; + unsigned long long size; + unsigned char value[MAX_MEASUREMENT_SIZE]; +}; + +struct cvm_attestation_cmd { + unsigned char challenge[CHALLENGE_SIZE]; /* input: challenge value */ + unsigned long token_size; /* return: challenge value */ + void *granule_head; + void *granule_ipa; /* IPA of the Granule to which the token will be written */ + unsigned long granule_count; + unsigned long offset; /* Offset within Granule to start of buffer in bytes */ + unsigned long size; /* Size of buffer in bytes */ + unsigned long num_wr_bytes; /* Number of bytes written to buffer */ +}; + +struct cca_device_cert { + unsigned long long size; + unsigned char value[MAX_DEV_CERT_SIZE]; +}; + +#define TMM_GET_TSI_VERSION _IOR(TSI_MAGIC, 0, struct cvm_tsi_version) + +#define TMM_GET_ATTESTATION_TOKEN _IOWR(TSI_MAGIC, 4, struct cvm_attestation_cmd) + +#define TMM_GET_DEVICE_CERT _IOR(TSI_MAGIC, 5, struct cca_device_cert) + +#endif /* __ASM_TSI_TMM_H_ */ diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index 4c6eb5e78e..781c2216a2 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -73,7 +73,7 @@ obj-$(CONFIG_ARM64_PTR_AUTH) += pointer_auth.o obj-$(CONFIG_SHADOW_CALL_STACK) += scs.o obj-$(CONFIG_ARM64_MTE) += mte.o obj-$(CONFIG_MPAM) += mpam/ -obj-$(CONFIG_CVM_GUEST) += cvm_guest.o +obj-$(CONFIG_CVM_GUEST) += cvm_guest.o tsi.o tsi_tmm.o obj-y += vdso/ probes/ obj-$(CONFIG_COMPAT_VDSO) += vdso32/ diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c index c687866612..22c0284cbd 100644 --- a/arch/arm64/kernel/setup.c +++ b/arch/arm64/kernel/setup.c @@ -43,6 +43,11 @@ #include <asm/cpu_ops.h> #include <asm/kasan.h> #include <asm/numa.h> + +#ifdef CONFIG_CVM_GUEST +#include <asm/tsi.h> +#endif + #include <asm/sections.h> #include <asm/setup.h> #include <asm/smp_plat.h> @@ -384,6 +389,12 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p) * cpufeature code and early parameters. */ jump_label_init(); + +#ifdef CONFIG_CVM_GUEST + /* Init TSI after jump_labels are active */ + arm64_tsi_init(); +#endif + parse_early_param(); /* diff --git a/arch/arm64/kernel/tsi.c b/arch/arm64/kernel/tsi.c new file mode 100644 index 0000000000..40da8a8aec --- /dev/null +++ b/arch/arm64/kernel/tsi.c @@ -0,0 +1,45 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include <linux/jump_label.h> +#include <linux/memblock.h> +#include <linux/swiotlb.h> +#include <linux/cc_platform.h> +#include <asm/tsi_tmm.h> +#include <asm/tsi_cmds.h> +#include <asm/tsi.h> + +unsigned long prot_ns_shared; +EXPORT_SYMBOL(prot_ns_shared); + +unsigned int phys_mask_shift = CONFIG_ARM64_PA_BITS; + +DEFINE_STATIC_KEY_FALSE_RO(tsi_present); + +static bool tsi_version_matches(void) +{ + unsigned long ver = tsi_get_version(); + + if (ver == SMCCC_RET_NOT_SUPPORTED) + return false; + + pr_info("RME: TSI version %lu.%lu advertised\n", + TSI_ABI_VERSION_GET_MAJOR(ver), + TSI_ABI_VERSION_GET_MINOR(ver)); + + return (ver >= TSI_ABI_VERSION && + TSI_ABI_VERSION_GET_MAJOR(ver) == TSI_ABI_VERSION_MAJOR); +} + + +void arm64_setup_memory(void) +{ + if (!static_branch_unlikely(&tsi_present)) + return; +} + +void __init arm64_tsi_init(void) +{ + if (!tsi_version_matches()) + return; + + static_branch_enable(&tsi_present); +} diff --git a/arch/arm64/kernel/tsi_tmm.c b/arch/arm64/kernel/tsi_tmm.c new file mode 100644 index 0000000000..2f4076f074 --- /dev/null +++ b/arch/arm64/kernel/tsi_tmm.c @@ -0,0 +1,246 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include <linux/module.h> +#include <linux/memblock.h> +#include <linux/slab.h> +#include <linux/miscdevice.h> +#include <linux/preempt.h> +#include <asm/tsi_cmds.h> +#include <asm/tsi_tmm.h> + +#define GRANULE_SIZE PAGE_SIZE + +struct attestation_token { + void *buf; + unsigned long size; +}; + +static struct attestation_token token; + +static long tmm_tsi_ioctl(struct file *file, unsigned int cmd, unsigned long arg); +static int tmm_tsi_open(struct inode *inode, struct file *file); +static int tmm_tsi_release(struct inode *inode, struct file *file); +static ssize_t tmm_token_read(struct file *file, char __user *user_buffer, + size_t size, loff_t *offset); + +static int tmm_get_tsi_version(struct cvm_tsi_version *arg); +static int tmm_get_attestation_token(struct cvm_attestation_cmd *arg, + struct attestation_token *attest_token); +static int tmm_get_device_cert(struct cca_device_cert *arg); + +static const struct file_operations tmm_tsi_fops = { + .owner = THIS_MODULE, + .open = tmm_tsi_open, + .read = tmm_token_read, + .release = tmm_tsi_release, + .unlocked_ioctl = tmm_tsi_ioctl +}; + +static struct miscdevice ioctl_dev = { + MISC_DYNAMIC_MINOR, + "tsi", + &tmm_tsi_fops, +}; + +static int __init tmm_tsi_init(void) +{ + unsigned long ver; + int ret; + + ver = tsi_get_version(); + + if (ver == SMCCC_RET_NOT_SUPPORTED) { + pr_err("tmm_tsi: SMC return not supported!\n"); + return -EIO; + } + + ret = misc_register(&ioctl_dev); + if (ret) { + pr_err("tmm_tsi: misc device register failed (%d)!\n", ret); + return ret; + } + + pr_warn("tmm_tsi: module loaded (version %lu.%lu).\n", + TSI_ABI_VERSION_GET_MAJOR(ver), + TSI_ABI_VERSION_GET_MINOR(ver)); + + return 0; +} + +static void __exit tmm_tsi_exit(void) +{ + if (token.buf != NULL) + kfree(token.buf); + misc_deregister(&ioctl_dev); + pr_warn("tmm_tsi: module unloaded.\n"); +} + +static long tmm_tsi_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +{ + int ret; + + switch (cmd) { + case TMM_GET_TSI_VERSION: + ret = tmm_get_tsi_version((struct cvm_tsi_version *)arg); + break; + case TMM_GET_ATTESTATION_TOKEN: + ret = tmm_get_attestation_token((struct cvm_attestation_cmd *)arg, &token); + break; + case TMM_GET_DEVICE_CERT: + ret = tmm_get_device_cert((struct cca_device_cert *)arg); + break; + default: + pr_err("tmm_tsi: unknown ioctl command (0x%x)!\n", cmd); + return -ENOTTY; + } + + return ret; +} + +static int tmm_tsi_open(struct inode *inode, struct file *file) +{ + token.buf = NULL; + return 0; +} + +static ssize_t tmm_token_read(struct file *file, char __user *user_buffer, + size_t size, loff_t *offset) +{ + int ret; + int to_copy; + + if (*offset >= token.size) + return 0; + + to_copy = min((int)size, (int)(token.size - *offset)); + ret = copy_to_user(user_buffer, token.buf + *offset, to_copy); + if (ret) { + pr_err("tmm_tsi: copy token to user failed (%d)!\n", ret); + return -1; + } + + *offset += to_copy; + return to_copy; +} + +static int tmm_tsi_release(struct inode *inode, struct file *file) +{ + if (token.buf != NULL) + kfree(token.buf); + return 0; +} + +static int tmm_get_tsi_version(struct cvm_tsi_version *arg) +{ + struct cvm_tsi_version ver_measured = {0}; + unsigned long ver; + unsigned long ret; + + ver = tsi_get_version(); + ver_measured.major = TSI_ABI_VERSION_GET_MAJOR(ver); + ver_measured.minor = TSI_ABI_VERSION_GET_MINOR(ver); + + ret = copy_to_user(arg, &ver_measured, sizeof(struct cvm_tsi_version)); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + return -EFAULT; + } + + return 0; +} + +static int tmm_get_attestation_token(struct cvm_attestation_cmd *arg, + struct attestation_token *attest_token) +{ + unsigned long ret; + struct cvm_attestation_cmd cmd = {0}; + + ret = copy_from_user(&(cmd.challenge), &(arg->challenge), sizeof(cmd.challenge)); + if (ret) { + pr_err("tmm_tsi: copy data from user failed (%lu)!\n", ret); + return -EFAULT; + } + + /* Allocate a large memory */ + attest_token->buf = kmalloc(GRANULE_SIZE * MAX_TOKEN_GRANULE_PAGE, GFP_KERNEL); + if (!attest_token->buf) + return -ENOMEM; + cmd.granule_head = attest_token->buf; + cmd.granule_ipa = cmd.granule_head; + + /* preempt_disable(); */ + + ret = tsi_attestation_token_init(&cmd); + if (ret) { + pr_err("tmm_tsi: tsi call tsi_attestation_token_init failed (%lu)!\n", ret); + return -EIO; + } + + do { /* Retrieve one Granule of data per loop iteration */ + cmd.granule_ipa = cmd.granule_head + + (unsigned long)(cmd.granule_count * GRANULE_SIZE); + cmd.offset = 0; + + do { /* Retrieve sub-Granule chunk of data per loop iteration */ + cmd.size = GRANULE_SIZE - cmd.offset; + ret = tsi_attestation_token_continue(&cmd); + cmd.offset += cmd.num_wr_bytes; + } while (ret == TSI_INCOMPLETE && cmd.offset < GRANULE_SIZE); + + cmd.granule_count += 1; + if (cmd.granule_count >= MAX_TOKEN_GRANULE_PAGE && ret == TSI_INCOMPLETE) { + pr_err("tmm_tsi: macro MAX_TOKEN_GRANULE_PAGE (%d) is too small!\n", + MAX_TOKEN_GRANULE_PAGE); + return -ENOMEM; + } + + } while (ret == TSI_INCOMPLETE); + + /* preempt_enable(); */ + + /* Send to user space the total size of the token */ + cmd.granule_count = cmd.granule_count - 1; + cmd.token_size = (unsigned long)(GRANULE_SIZE * cmd.granule_count) + cmd.offset; + attest_token->size = cmd.token_size; + + ret = copy_to_user(&(arg->token_size), &(cmd.token_size), sizeof(cmd.token_size)); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + return -EFAULT; + } + + return 0; +} + +static int tmm_get_device_cert(struct cca_device_cert *arg) +{ + unsigned long ret; + struct cca_device_cert cmd = {0}; + unsigned char *cert_buf; + + cert_buf = kmalloc(GRANULE_SIZE, GFP_KERNEL); + if (!cert_buf) + return -ENOMEM; + ret = tsi_get_device_cert(&cmd, cert_buf); + if (ret != TSI_SUCCESS) { + pr_err("tmm_tsi: tsi call tsi_get_device_cert failed (%lu)!\n", ret); + kfree(cert_buf); + return -EIO; + } + memcpy(cmd.value, cert_buf, cmd.size); + kfree(cert_buf); + + ret = copy_to_user(arg, &cmd, sizeof(struct cca_device_cert)); + if (ret) { + pr_err("tmm_tsi: copy data to user failed (%lu)!\n", ret); + return -EFAULT; + } + + return 0; +} + +module_init(tmm_tsi_init); +module_exit(tmm_tsi_exit); + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("HUAWEI TECHNOLOGIES CO., LTD."); +MODULE_DESCRIPTION("Interacting with TMM through TSI interface from user space."); -- 2.37.2.windows.2

2 1

[PATCH OLK-6.6 v2 0/2] Avoiding false sharing in field access of tk_core
by Zheng Zengkai 17 May '24

17 May '24

Backport patch from OLK-5.10 to stabilize the performance of unixbench context1. Wang ShaoBo (1): timekeeping: Avoiding false sharing in field access of tk_core Zheng Zengkai (1): openeuler_defconfig: Enable CONFIG_ARCH_LLC_128_LINE_SIZE for Hisilicon platforms arch/arm64/Kconfig | 9 +++++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cache.h | 6 ++++++ kernel/time/timekeeping.c | 7 +++++++ 4 files changed, 23 insertions(+) -- 2.20.1

2 3

[PATCH OLK-5.10] drm/i915/gt: Reset queue_priority_hint on parking
by Wenyu Huang 17 May '24

17 May '24

From: Chris Wilson <chris(a)chris-wilson.co.uk> stable inclusion from stable-v5.10.216 commit fe34587acc995e7b1d7a5d3444a0736721ec32b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5FX CVE: CVE-2024-26937 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4a3859ea5240365d21f6053ee219bb240d520895 upstream. Originally, with strict in order execution, we could complete execution only when the queue was empty. Preempt-to-busy allows replacement of an active request that may complete before the preemption is processed by HW. If that happens, the request is retired from the queue, but the queue_priority_hint remains set, preventing direct submission until after the next CS interrupt is processed. This preempt-to-busy race can be triggered by the heartbeat, which will also act as the power-management barrier and upon completion allow us to idle the HW. We may process the completion of the heartbeat, and begin parking the engine before the CS event that restores the queue_priority_hint, causing us to fail the assertion that it is MIN. <3>[ 166.210729] __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 166.210781] Dumping ftrace buffer: <0>[ 166.210795] --------------------------------- ... <0>[ 167.302811] drm_fdin-1097 2..s1. 165741070us : trace_ports: 0000:00:02.0 rcs0: promote { ccid:20 1217:2 prio 0 } <0>[ 167.302861] drm_fdin-1097 2d.s2. 165741072us : execlists_submission_tasklet: 0000:00:02.0 rcs0: preempting last=1217:2, prio=0, hint=2147483646 <0>[ 167.302928] drm_fdin-1097 2d.s2. 165741072us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 1217:2, current 0 <0>[ 167.302992] drm_fdin-1097 2d.s2. 165741073us : __i915_request_submit: 0000:00:02.0 rcs0: fence 3:4660, current 4659 <0>[ 167.303044] drm_fdin-1097 2d.s1. 165741076us : execlists_submission_tasklet: 0000:00:02.0 rcs0: context:3 schedule-in, ccid:40 <0>[ 167.303095] drm_fdin-1097 2d.s1. 165741077us : trace_ports: 0000:00:02.0 rcs0: submit { ccid:40 3:4660* prio 2147483646 } <0>[ 167.303159] kworker/-89 11..... 165741139us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence c90:2, current 2 <0>[ 167.303208] kworker/-89 11..... 165741148us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:c90 unpin <0>[ 167.303272] kworker/-89 11..... 165741159us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 1217:2, current 2 <0>[ 167.303321] kworker/-89 11..... 165741166us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:1217 unpin <0>[ 167.303384] kworker/-89 11..... 165741170us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 3:4660, current 4660 <0>[ 167.303434] kworker/-89 11d..1. 165741172us : __intel_context_retire: 0000:00:02.0 rcs0: context:1216 retire runtime: { total:56028ns, avg:56028ns } <0>[ 167.303484] kworker/-89 11..... 165741198us : __engine_park: 0000:00:02.0 rcs0: parked <0>[ 167.303534] <idle>-0 5d.H3. 165741207us : execlists_irq_handler: 0000:00:02.0 rcs0: semaphore yield: 00000040 <0>[ 167.303583] kworker/-89 11..... 165741397us : __intel_context_retire: 0000:00:02.0 rcs0: context:1217 retire runtime: { total:325575ns, avg:0ns } <0>[ 167.303756] kworker/-89 11..... 165741777us : __intel_context_retire: 0000:00:02.0 rcs0: context:c90 retire runtime: { total:0ns, avg:0ns } <0>[ 167.303806] kworker/-89 11..... 165742017us : __engine_park: __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 167.303811] --------------------------------- <4>[ 167.304722] ------------[ cut here ]------------ <2>[ 167.304725] kernel BUG at drivers/gpu/drm/i915/gt/intel_engine_pm.c:283! <4>[ 167.304731] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI <4>[ 167.304734] CPU: 11 PID: 89 Comm: kworker/11:1 Tainted: G W 6.8.0-rc2-CI_DRM_14193-gc655e0fd2804+ #1 <4>[ 167.304736] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 <4>[ 167.304738] Workqueue: i915-unordered retire_work_handler [i915] <4>[ 167.304839] RIP: 0010:__engine_park+0x3fd/0x680 [i915] <4>[ 167.304937] Code: 00 48 c7 c2 b0 e5 86 a0 48 8d 3d 00 00 00 00 e8 79 48 d4 e0 bf 01 00 00 00 e8 ef 0a d4 e0 31 f6 bf 09 00 00 00 e8 03 49 c0 e0 <0f> 0b 0f 0b be 01 00 00 00 e8 f5 61 fd ff 31 c0 e9 34 fd ff ff 48 <4>[ 167.304940] RSP: 0018:ffffc9000059fce0 EFLAGS: 00010246 <4>[ 167.304942] RAX: 0000000000000200 RBX: 0000000000000000 RCX: 0000000000000006 <4>[ 167.304944] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009 <4>[ 167.304946] RBP: ffff8881330ca1b0 R08: 0000000000000001 R09: 0000000000000001 <4>[ 167.304947] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8881330ca000 <4>[ 167.304948] R13: ffff888110f02aa0 R14: ffff88812d1d0205 R15: ffff88811277d4f0 <4>[ 167.304950] FS: 0000000000000000(0000) GS:ffff88844f780000(0000) knlGS:0000000000000000 <4>[ 167.304952] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 167.304953] CR2: 00007fc362200c40 CR3: 000000013306e003 CR4: 0000000000770ef0 <4>[ 167.304955] PKRU: 55555554 <4>[ 167.304957] Call Trace: <4>[ 167.304958] <TASK> <4>[ 167.305573] ____intel_wakeref_put_last+0x1d/0x80 [i915] <4>[ 167.305685] i915_request_retire.part.0+0x34f/0x600 [i915] <4>[ 167.305800] retire_requests+0x51/0x80 [i915] <4>[ 167.305892] intel_gt_retire_requests_timeout+0x27f/0x700 [i915] <4>[ 167.305985] process_scheduled_works+0x2db/0x530 <4>[ 167.305990] worker_thread+0x18c/0x350 <4>[ 167.305993] kthread+0xfe/0x130 <4>[ 167.305997] ret_from_fork+0x2c/0x50 <4>[ 167.306001] ret_from_fork_asm+0x1b/0x30 <4>[ 167.306004] </TASK> It is necessary for the queue_priority_hint to be lower than the next request submission upon waking up, as we rely on the hint to decide when to kick the tasklet to submit that first request. Fixes: 22b7a426bbe1 ("drm/i915/execlists: Preempt-to-busy") Closes: https://gitlab.freedesktop.org/drm/intel/issues/10154 Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Cc: Mika Kuoppala <mika.kuoppala(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> # v5.4+ Reviewed-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240318135906.716055-2-janus… (cherry picked from commit 98850e96cf811dc2d0a7d0af491caff9f5d49c1e) Signed-off-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_engine_pm.c | 3 --- drivers/gpu/drm/i915/gt/intel_lrc.c | 3 +++ 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/intel_engine_pm.c b/drivers/gpu/drm/i915/gt/intel_engine_pm.c index f7b2e07e2229..f9fdbd79c0f3 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_pm.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_pm.c @@ -250,9 +250,6 @@ static int __engine_park(struct intel_wakeref *wf) intel_engine_park_heartbeat(engine); intel_breadcrumbs_park(engine->breadcrumbs); - /* Must be reset upon idling, or we may miss the busy wakeup. */ - GEM_BUG_ON(engine->execlists.queue_priority_hint != INT_MIN); - if (engine->park) engine->park(engine); diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c index ee9b33c3aff8..5a414d989dca 100644 --- a/drivers/gpu/drm/i915/gt/intel_lrc.c +++ b/drivers/gpu/drm/i915/gt/intel_lrc.c @@ -5032,6 +5032,9 @@ static void execlists_park(struct intel_engine_cs *engine) { cancel_timer(&engine->execlists.timer); cancel_timer(&engine->execlists.preempt); + + /* Reset upon idling, or we may delay the busy wakeup. */ + WRITE_ONCE(engine->execlists.queue_priority_hint, INT_MIN); } void intel_execlists_set_default_submission(struct intel_engine_cs *engine) -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] MPAM: Fix use-after-free and deadlock issues
by Yu Liao 17 May '24

17 May '24

MPAM: Fix use-after-free and deadlock issues Yu Liao (4): mpam/resctrl: Fix a deadlock due to inaccurate reference mpam/resctrl: Clean up unused function parameter in mkdir path mpam/resctrl: Clean up resctrl_group_rmdir_[ctrl/mon]() mpam/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup fs/resctrlfs.c | 57 +++++++++++++++++++------------------------------- 1 file changed, 21 insertions(+), 36 deletions(-) -- 2.33.0

2 5

[PATCH OLK-5.10 0/2] fix CVE-2024-26661
by Liao Chen 17 May '24

17 May '24

In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;" pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to ensure the tg is not NULL. Dan Carpenter (1): drm/amd/display: Fix && vs || typos Srinivasan Shanmugam (1): drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()' drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
by Zeng Heng 17 May '24

17 May '24

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.9 commit 483bc08181827fc475643272ffb69c533007e546 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9OZA9 CVE: CVE-2024-27398 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When the sco connection is established and then, the sco socket is releasing, timeout_work will be scheduled to judge whether the sco disconnection is timeout. The sock will be deallocated later, but it is dereferenced again in sco_sock_timeout. As a result, the use-after-free bugs will happen. The root cause is shown below: Cleanup Thread | Worker Thread sco_sock_release | sco_sock_close | __sco_sock_close | sco_sock_set_timer | schedule_delayed_work | sco_sock_kill | (wait a time) sock_put(sk) //FREE | sco_sock_timeout | sock_hold(sk) //USE The KASAN report triggered by POC is shown below: [ 95.890016] ================================================================== [ 95.890496] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x5e/0x1c0 [ 95.890755] Write of size 4 at addr ffff88800c388080 by task kworker/0:0/7 ... [ 95.890755] Workqueue: events sco_sock_timeout [ 95.890755] Call Trace: [ 95.890755] <TASK> [ 95.890755] dump_stack_lvl+0x45/0x110 [ 95.890755] print_address_description+0x78/0x390 [ 95.890755] print_report+0x11b/0x250 [ 95.890755] ? __virt_addr_valid+0xbe/0xf0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_report+0x139/0x170 [ 95.890755] ? update_load_avg+0xe5/0x9f0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_check_range+0x2c3/0x2e0 [ 95.890755] sco_sock_timeout+0x5e/0x1c0 [ 95.890755] process_one_work+0x561/0xc50 [ 95.890755] worker_thread+0xab2/0x13c0 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] kthread+0x279/0x300 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork+0x34/0x60 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork_asm+0x11/0x20 [ 95.890755] </TASK> [ 95.890755] [ 95.890755] Allocated by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] __kasan_kmalloc+0x86/0x90 [ 95.890755] __kmalloc+0x17f/0x360 [ 95.890755] sk_prot_alloc+0xe1/0x1a0 [ 95.890755] sk_alloc+0x31/0x4e0 [ 95.890755] bt_sock_alloc+0x2b/0x2a0 [ 95.890755] sco_sock_create+0xad/0x320 [ 95.890755] bt_sock_create+0x145/0x320 [ 95.890755] __sock_create+0x2e1/0x650 [ 95.890755] __sys_socket+0xd0/0x280 [ 95.890755] __x64_sys_socket+0x75/0x80 [ 95.890755] do_syscall_64+0xc4/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] Freed by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] kasan_save_free_info+0x40/0x50 [ 95.890755] poison_slab_object+0x118/0x180 [ 95.890755] __kasan_slab_free+0x12/0x30 [ 95.890755] kfree+0xb2/0x240 [ 95.890755] __sk_destruct+0x317/0x410 [ 95.890755] sco_sock_release+0x232/0x280 [ 95.890755] sock_close+0xb2/0x210 [ 95.890755] __fput+0x37f/0x770 [ 95.890755] task_work_run+0x1ae/0x210 [ 95.890755] get_signal+0xe17/0xf70 [ 95.890755] arch_do_signal_or_restart+0x3f/0x520 [ 95.890755] syscall_exit_to_user_mode+0x55/0x120 [ 95.890755] do_syscall_64+0xd1/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] The buggy address belongs to the object at ffff88800c388000 [ 95.890755] which belongs to the cache kmalloc-1k of size 1024 [ 95.890755] The buggy address is located 128 bytes inside of [ 95.890755] freed 1024-byte region [ffff88800c388000, ffff88800c388400) [ 95.890755] [ 95.890755] The buggy address belongs to the physical page: [ 95.890755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800c38a800 pfn:0xc388 [ 95.890755] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.890755] anon flags: 0x100000000000840(slab|head|node=0|zone=1) [ 95.890755] page_type: 0xffffffff() [ 95.890755] raw: 0100000000000840 ffff888006842dc0 0000000000000000 0000000000000001 [ 95.890755] raw: ffff88800c38a800 000000000010000a 00000001ffffffff 0000000000000000 [ 95.890755] head: 0100000000000840 ffff888006842dc0 0000000000000000 0000000000000001 [ 95.890755] head: ffff88800c38a800 000000000010000a 00000001ffffffff 0000000000000000 [ 95.890755] head: 0100000000000003 ffffea000030e201 ffffea000030e248 00000000ffffffff [ 95.890755] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000 [ 95.890755] page dumped because: kasan: bad access detected [ 95.890755] [ 95.890755] Memory state around the buggy address: [ 95.890755] ffff88800c387f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 95.890755] ffff88800c388000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.890755] >ffff88800c388080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.890755] ^ [ 95.890755] ffff88800c388100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.890755] ffff88800c388180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 95.890755] ================================================================== Fix this problem by adding a check protected by sco_conn_lock to judget whether the conn->hcon is null. Because the conn->hcon will be set to null, when the sock is releasing. Fixes: ba316be1b6a0 ("Bluetooth: schedule SCO timeouts with delayed_work") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- net/bluetooth/sco.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 608de7e66132..493872e6747c 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -82,6 +82,10 @@ static void sco_sock_timeout(struct work_struct *work) struct sock *sk; sco_conn_lock(conn); + if (!conn->hcon) { + sco_conn_unlock(conn); + return; + } sk = conn->sk; if (sk) sock_hold(sk); -- 2.25.1

2 1