- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v4 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Changes in v4: - Fix the missing Comma about check_xint_pre_kernel_entry. - When CONFIG_SECURITY_FEATURE_BYPASS not set, ret_to_user/kernel instead of "kernel_exit \el" for xcall/xint. Changes in v3: - Fix few typos in entry.S. Changes in v2: - Avoid enable xint without GICv3 enabled. - Fix cpucap KABI break. - Fix missing openeuler_defconfig update. - Correct the marco control for SECURITY_FEATURE_BYPASS in entry.S. - exit_to_user_mode_prepare_xcall() -> xcall_exit_to_user_mode_prepare(). Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++++ arch/arm64/kernel/entry-common.c | 162 ++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 168 ++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 123 ++++++++++++++++++ fs/proc/base.c | 112 +++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 +++++ kernel/irq/internals.h | 18 +++ kernel/irq/proc.c | 6 + kernel/softirq.c | 47 +++++++ 18 files changed, 834 insertions(+), 5 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 v4 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Changes in v4: - Fix the missing Comma about check_xint_pre_kernel_entry. - When CONFIG_SECURITY_FEATURE_BYPASS not set, ret_to_user/kernel instead of "kernel_exit \el" for xcall/xint. Changes in v3: - Fix few typos in entry.S. Changes in v2: - Avoid enable xint without GICv3 enabled. - Fix cpucap KABI break. - Fix missing openeuler_defconfig update. - Correct the marco control for SECURITY_FEATURE_BYPASS in entry.S. - exit_to_user_mode_prepare_xcall() -> xcall_exit_to_user_mode_prepare(). Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++++ arch/arm64/kernel/entry-common.c | 162 ++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 168 ++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 123 ++++++++++++++++++ fs/proc/base.c | 112 +++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 +++++ kernel/irq/internals.h | 18 +++ kernel/irq/proc.c | 6 + kernel/softirq.c | 47 +++++++ 18 files changed, 834 insertions(+), 5 deletions(-) -- 2.34.1

1 4

[PATCH OLK-6.6 v3 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Changes in v3: - Fix few typos in entry.S. Changes in v2: - Avoid enable xint without GICv3 enabled. - Fix cpucap KABI break. - Fix missing openeuler_defconfig update. - Correct the marco control for SECURITY_FEATURE_BYPASS in entry.S. - exit_to_user_mode_prepare_xcall() -> xcall_exit_to_user_mode_prepare(). Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++++ arch/arm64/kernel/entry-common.c | 162 ++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 164 ++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 123 +++++++++++++++++++ fs/proc/base.c | 112 +++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 +++++ kernel/irq/internals.h | 18 +++ kernel/irq/proc.c | 6 + kernel/softirq.c | 47 +++++++ 18 files changed, 830 insertions(+), 5 deletions(-) -- 2.34.1

2 9

[PATCH openEuler-1.0-LTS] tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
by Liu Jian 25 Nov '24

25 Nov '24

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> mainline inclusion from mainline-v6.12-rc4 commit e8c526f2bdf1845bedaf6a478816a3d06fa78b8f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2STS CVE: CVE-2024-50154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached to trace_tcp_retransmit_synack. The program passes the req->sk to the bpf_sk_storage_get_tracing kernel helper which does check for null before using it. """ The commit 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not to call del_timer_sync() from reqsk_timer_handler(), but it introduced a small race window. Before the timer is called, expire_timers() calls detach_timer(timer, true) to clear timer->entry.pprev and marks it as not pending. If reqsk_queue_unlink() checks timer_pending() just after expire_timers() calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will continue running and send multiple SYN+ACKs until it expires. The reported UAF could happen if req->sk is close()d earlier than the timer expiration, which is 63s by default. The scenario would be 1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(), but del_timer_sync() is missed 2. reqsk timer is executed and scheduled again 3. req->sk is accept()ed and reqsk_put() decrements rsk_refcnt, but reqsk timer still has another one, and inet_csk_accept() does not clear req->sk for non-TFO sockets 4. sk is close()d 5. reqsk timer is executed again, and BPF touches req->sk Let's not use timer_pending() by passing the caller context to __inet_csk_reqsk_queue_drop(). Note that reqsk timer is pinned, so the issue does not happen in most use cases. [1] [0] BUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0 Use-after-free read at 0x00000000a891fb3a (in kfence-#1): bpf_sk_storage_get_tracing+0x2e/0x1b0 bpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda bpf_trace_run2+0x4c/0xc0 tcp_rtx_synack+0xf9/0x100 reqsk_timer_handler+0xda/0x3d0 run_timer_softirq+0x292/0x8a0 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 intel_idle_irq+0x5a/0xa0 cpuidle_enter_state+0x94/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb kfence-#1: 0x00000000a72cc7b6-0x00000000d97616d9, size=2376, cache=TCPv6 allocated by task 0 on cpu 9 at 260507.901592s: sk_prot_alloc+0x35/0x140 sk_clone_lock+0x1f/0x3f0 inet_csk_clone_lock+0x15/0x160 tcp_create_openreq_child+0x1f/0x410 tcp_v6_syn_recv_sock+0x1da/0x700 tcp_check_req+0x1fb/0x510 tcp_v6_rcv+0x98b/0x1420 ipv6_list_rcv+0x2258/0x26e0 napi_complete_done+0x5b1/0x2990 mlx5e_napi_poll+0x2ae/0x8d0 net_rx_action+0x13e/0x590 irq_exit_rcu+0xf5/0x320 common_interrupt+0x80/0x90 asm_common_interrupt+0x22/0x40 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb freed by task 0 on cpu 9 at 260507.927527s: rcu_core_si+0x4ff/0xf10 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb Fixes: 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") Reported-by: Martin KaFai Lau <martin.lau(a)kernel.org> Closes: https://lore.kernel.org/netdev/eb6684d0-ffd9-4bdc-9196-33f690c25824@linux.d… Link: https://lore.kernel.org/netdev/b55e2ca0-42f2-4b7c-b445-6ffd87ca74a0@linux.d… [1] Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://patch.msgid.link/20241014223312.4254-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inet_connection_sock.c [Did not backport c905dee62232, 5903123f662e, 9b13df3fb64e.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv4/inet_connection_sock.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index c1f90e08761c..ffa0f8b3f21f 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -718,21 +718,31 @@ static bool reqsk_queue_unlink(struct request_sock_queue *queue, found = __sk_nulls_del_node_init_rcu(req_to_sk(req)); spin_unlock(lock); } - if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer)) - reqsk_put(req); + return found; } -bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) +static bool __inet_csk_reqsk_queue_drop(struct sock *sk, + struct request_sock *req, + bool from_timer) { bool unlinked = reqsk_queue_unlink(&inet_csk(sk)->icsk_accept_queue, req); + if (!from_timer && del_timer_sync(&req->rsk_timer)) + reqsk_put(req); + if (unlinked) { reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req); reqsk_put(req); } + return unlinked; } + +bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) +{ + return __inet_csk_reqsk_queue_drop(sk, req, false); +} EXPORT_SYMBOL(inet_csk_reqsk_queue_drop); void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req) @@ -805,7 +815,8 @@ static void reqsk_timer_handler(struct timer_list *t) return; } drop: - inet_csk_reqsk_queue_drop_and_put(sk_listener, req); + __inet_csk_reqsk_queue_drop(sk_listener, req, true); + reqsk_put(req); } static void reqsk_queue_hash_req(struct request_sock *req, -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Changes in v2: - Avoid enable xint without GICv3 enabled. - Fix cpucap KABI break. - Fix missing openeuler_defconfig update. - Correct the marco control for SECURITY_FEATURE_BYPASS in entry.S - exit_to_user_mode_prepare_xcall() -> xcall_exit_to_user_mode_prepare() Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++++ arch/arm64/kernel/entry-common.c | 162 ++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 164 ++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 123 +++++++++++++++++++ fs/proc/base.c | 112 +++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 +++++ kernel/irq/internals.h | 18 +++ kernel/irq/proc.c | 6 + kernel/softirq.c | 47 +++++++ 18 files changed, 830 insertions(+), 5 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/2] net/hinic3: Support new NIC feature
by s00851154 25 Nov '24

25 Nov '24

From: zhuyikai <zhuyikai1(a)h-partners.com> Support new TX WQE offload format and new RX WQE type. zhuyikai (2): net/hinic3: Support new TX feature net/hinic3: Support new RX feature drivers/net/ethernet/huawei/hinic3/hinic3_main.c | 8 + drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_mt.h | 2 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.c | 23 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h | 5 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_qp.h | 131 +++++++--- drivers/net/ethernet/huawei/hinic3/hinic3_rx.c | 162 ++++++++----- drivers/net/ethernet/huawei/hinic3/hinic3_rx.h | 10 +- drivers/net/ethernet/huawei/hinic3/hinic3_tx.c | 430 ++++++++++++++++++--------------- drivers/net/ethernet/huawei/hinic3/hinic3_tx.h | 10 +- 12 files changed, 498 insertions(+), 286 deletions(-) -- 2.45.1.windows.1

2 3

[PATCH OLK-6.6 0/2] Support new RX and TX feature
by s00851154 25 Nov '24

25 Nov '24

From: zhuyikai <zhuyikai1(a)h-partners.com> Support new TX WQE offload format and new RX WQE type. zhuyikai (2): net/hinic3: Support new TX feature net/hinic3: Support new RX feature drivers/net/ethernet/huawei/hinic3/hinic3_main.c | 8 + drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_mt.h | 2 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.c | 23 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h | 5 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_qp.h | 131 +++++++--- drivers/net/ethernet/huawei/hinic3/hinic3_rx.c | 162 ++++++++----- drivers/net/ethernet/huawei/hinic3/hinic3_rx.h | 10 +- drivers/net/ethernet/huawei/hinic3/hinic3_tx.c | 430 ++++++++++++++++++--------------- drivers/net/ethernet/huawei/hinic3/hinic3_tx.h | 10 +- 12 files changed, 498 insertions(+), 286 deletions(-) -- 2.45.1.windows.1

2 3

[openeuler:openEuler-1.0-LTS 1290/1290] kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v'
by kernel test robot 25 Nov '24

25 Nov '24

Hi Wang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 48fd60600c1344806a27e3bb33ab33ec5a9fea7c commit: ce35ded5d5774f055f6850b15032066ff4936414 [1290/1290] sched: smart grid: init sched_grid_qos structure on QOS purpose config: arm64-randconfig-001-20241112 (https://download.01.org/0day-ci/archive/20241125/202411251710.OUFik4Mp-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241125/202411251710.OUFik4Mp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411251710.OUFik4Mp-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/grid/qos.c:19: kernel/sched/grid/qos.c: In function 'sched_grid_preferred_interleave_nid': >> kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v' 84 | if (nodes_equal(policy->v.nodes, *preferred_nmask)) | ^~ include/linux/nodemask.h:202:41: note: in definition of macro 'nodes_equal' 202 | __nodes_equal(&(src1), &(src2), MAX_NUMNODES) | ^~~~ kernel/sched/grid/qos.c:91:32: error: 'struct mempolicy' has no member named 'v' 91 | nodes_and(nmask, policy->v.nodes, *preferred_nmask); | ^~ include/linux/nodemask.h:162:47: note: in definition of macro 'nodes_and' 162 | __nodes_and(&(dst), &(src1), &(src2), MAX_NUMNODES) | ^~~~ >> kernel/sched/grid/qos.c:95:31: error: 'struct task_struct' has no member named 'il_prev' 95 | next = next_node_in(me->il_prev, nmask); | ^~ include/linux/nodemask.h:278:46: note: in definition of macro 'next_node_in' 278 | #define next_node_in(n, src) __next_node_in((n), &(src)) | ^ kernel/sched/grid/qos.c:97:19: error: 'struct task_struct' has no member named 'il_prev' 97 | me->il_prev = next; | ^~ In file included from kernel/sched/grid/qos.c:20: include/linux/mempolicy.h: At top level: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +84 kernel/sched/grid/qos.c > 19 #include <linux/nodemask.h> 20 #include <linux/mempolicy.h> 21 #include <linux/slab.h> 22 #include <linux/sched.h> 23 #include <linux/sched/grid_qos.h> 24 #include "internal.h" 25 26 static int qos_affinity_set(struct task_struct *p) 27 { 28 int n; 29 struct sched_grid_qos_affinity *affinity = &p->grid_qos->affinity; 30 31 nodes_clear(affinity->mem_preferred_node_mask); 32 /* 33 * We want the memory allocation to be as close to the CPU 34 * as possible, and adjust after getting memory bandwidth usage. 35 */ 36 for (n = 0; n < nr_node_ids; n++) 37 if (cpumask_intersects(cpumask_of_node(n), p->prefer_cpus)) 38 node_set(n, affinity->mem_preferred_node_mask); 39 40 return 0; 41 } 42 43 int sched_grid_qos_fork(struct task_struct *p, struct task_struct *orig) 44 { 45 struct sched_grid_qos *qos; 46 47 qos = kzalloc(sizeof(*qos), GFP_KERNEL); 48 if (!qos) 49 return -ENOMEM; 50 51 qos_power_init(&qos->power); 52 qos_stat_init(&qos->stat); 53 54 nodes_clear(qos->affinity.mem_preferred_node_mask); 55 if (likely(orig->grid_qos)) 56 qos->affinity = orig->grid_qos->affinity; 57 qos->affinity_set = qos_affinity_set; 58 p->grid_qos = qos; 59 60 return 0; 61 } 62 63 void sched_grid_qos_free(struct task_struct *p) 64 { 65 kfree(p->grid_qos); 66 p->grid_qos = NULL; 67 } 68 69 /* dynamic select a more appropriate preferred interleave nid for process */ 70 int sched_grid_preferred_interleave_nid(struct mempolicy *policy) 71 { 72 nodemask_t nmask; 73 unsigned int next; 74 struct task_struct *me = current; 75 nodemask_t *preferred_nmask = NULL; 76 77 if (likely(me->grid_qos)) 78 preferred_nmask = 79 &me->grid_qos->affinity.mem_preferred_node_mask; 80 81 if (!preferred_nmask || !policy) 82 return NUMA_NO_NODE; 83 > 84 if (nodes_equal(policy->v.nodes, *preferred_nmask)) 85 return NUMA_NO_NODE; 86 /* 87 * We perceive the actual consumption of memory bandwidth 88 * in each node and post a preferred interleave nid in 89 * more appropriate range. 90 */ > 91 nodes_and(nmask, policy->v.nodes, *preferred_nmask); 92 if (nodes_empty(nmask)) 93 return NUMA_NO_NODE; 94 > 95 next = next_node_in(me->il_prev, nmask); 96 if (next < MAX_NUMNODES) 97 me->il_prev = next; 98 return next; 99 } 100 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix kernel bug due to missing clearing of checked flag
by Qi Xi 25 Nov '24

25 Nov '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.12-rc6 commit 41e192ad2779cae0102879612dfe46726e4396aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AW CVE: CVE-2024-50230 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write_begin_int(), which is called to prepare block writes, may fail the BUG_ON check for accesses exceeding the folio/page size, triggering a kernel bug. This was found to be because the "checked" flag of a page/folio was not cleared when it was discarded by nilfs2's own routine, which causes the sanity check of directory entries to be skipped when the directory page/folio is reloaded. So, fix that. This was necessary when the use of nilfs2's own page discard routine was applied to more than just metadata files. Link: https://lkml.kernel.org/r/20241017193359.5051-1-konishi.ryusuke@gmail.com Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+d6ca2daf692c7a82f959(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d6ca2daf692c7a82f959 Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- fs/nilfs2/page.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index 81992b9a219b..2a39b7485b99 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -403,6 +403,7 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) ClearPageUptodate(page); ClearPageMappedToDisk(page); + ClearPageChecked(page); if (page_has_buffers(page)) { struct buffer_head *bh, *head; -- 2.33.0

2 1

[PATCH OLK-5.10] nilfs2: fix kernel bug due to missing clearing of checked flag
by Qi Xi 25 Nov '24

25 Nov '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.12-rc6 commit 41e192ad2779cae0102879612dfe46726e4396aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AW CVE: CVE-2024-50230 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write_begin_int(), which is called to prepare block writes, may fail the BUG_ON check for accesses exceeding the folio/page size, triggering a kernel bug. This was found to be because the "checked" flag of a page/folio was not cleared when it was discarded by nilfs2's own routine, which causes the sanity check of directory entries to be skipped when the directory page/folio is reloaded. So, fix that. This was necessary when the use of nilfs2's own page discard routine was applied to more than just metadata files. Link: https://lkml.kernel.org/r/20241017193359.5051-1-konishi.ryusuke@gmail.com Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+d6ca2daf692c7a82f959(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d6ca2daf692c7a82f959 Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- fs/nilfs2/page.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index 81992b9a219b..2a39b7485b99 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -403,6 +403,7 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) ClearPageUptodate(page); ClearPageMappedToDisk(page); + ClearPageChecked(page); if (page_has_buffers(page)) { struct buffer_head *bh, *head; -- 2.33.0

2 1