- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] [Backport] btrfs: check folio mapping after unlock in relocate_one_folio()
by Yongjian Sun 09 Jan '25

09 Jan '25

mainline inclusion from mainline-v6.12-rc3 commit 3e74859ee35edc33a022c3f3971df066ea0ca6b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PL CVE: CVE-2024-56758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When we call btrfs_read_folio() to bring a folio uptodate, we unlock the folio. The result of that is that a different thread can modify the mapping (like remove it with invalidate) before we call folio_lock(). This results in an invalid page and we need to try again. In particular, if we are relocating concurrently with aborting a transaction, this can result in a crash like the following: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 76 PID: 1411631 Comm: kworker/u322:5 Workqueue: events_unbound btrfs_reclaim_bgs_work RIP: 0010:set_page_extent_mapped+0x20/0xb0 RSP: 0018:ffffc900516a7be8 EFLAGS: 00010246 RAX: ffffea009e851d08 RBX: ffffea009e0b1880 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffc900516a7b90 RDI: ffffea009e0b1880 RBP: 0000000003573000 R08: 0000000000000001 R09: ffff88c07fd2f3f0 R10: 0000000000000000 R11: 0000194754b575be R12: 0000000003572000 R13: 0000000003572fff R14: 0000000000100cca R15: 0000000005582fff FS: 0000000000000000(0000) GS:ffff88c07fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000407d00f002 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die+0x78/0xc0 ? page_fault_oops+0x2a8/0x3a0 ? __switch_to+0x133/0x530 ? wq_worker_running+0xa/0x40 ? exc_page_fault+0x63/0x130 ? asm_exc_page_fault+0x22/0x30 ? set_page_extent_mapped+0x20/0xb0 relocate_file_extent_cluster+0x1a7/0x940 relocate_data_extent+0xaf/0x120 relocate_block_group+0x20f/0x480 btrfs_relocate_block_group+0x152/0x320 btrfs_relocate_chunk+0x3d/0x120 btrfs_reclaim_bgs_work+0x2ae/0x4e0 process_scheduled_works+0x184/0x370 worker_thread+0xc6/0x3e0 ? blk_add_timer+0xb0/0xb0 kthread+0xae/0xe0 ? flush_tlb_kernel_range+0x90/0x90 ret_from_fork+0x2f/0x40 ? flush_tlb_kernel_range+0x90/0x90 ret_from_fork_asm+0x11/0x20 </TASK> This occurs because cleanup_one_transaction() calls destroy_delalloc_inodes() which calls invalidate_inode_pages2() which takes the folio_lock before setting mapping to NULL. We fail to check this, and subsequently call set_extent_mapping(), which assumes that mapping != NULL (in fact it asserts that in debug mode) Note that the "fixes" patch here is not the one that introduced the race (the very first iteration of this code from 2009) but a more recent change that made this particular crash happen in practice. Fixes: e7f1326cc24e ("btrfs: set page extent mapped after read_folio in relocate_one_page") CC: stable(a)vger.kernel.org # 6.1+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/relocation.c [The Evolution from Page to Folio] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/btrfs/relocation.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index 299eac696eb4..f73920063572 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -2931,6 +2931,7 @@ static int relocate_one_page(struct inode *inode, struct file_ra_state *ra, int ret; ASSERT(page_index <= last_index); +again: page = find_lock_page(inode->i_mapping, page_index); if (!page) { page_cache_sync_readahead(inode->i_mapping, ra, NULL, @@ -2952,6 +2953,11 @@ static int relocate_one_page(struct inode *inode, struct file_ra_state *ra, ret = -EIO; goto release_page; } + if (page->mapping != inode->i_mapping) { + unlock_page(page); + put_page(page); + goto again; + } } /* -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 1402/1402] block/blk-merge.c:688:16: warning: no previous prototype for 'blk_try_req_merge'
by kernel test robot 09 Jan '25

09 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 97f98c391a1fd153ae010a2faf73f9e03270da6e commit: 5f100bc6aabbe30e55cf20af8e163bb6dba3a3aa [1402/1402] block: fix the DISCARD request merge config: x86_64-buildonly-randconfig-006-20250109 (https://download.01.org/0day-ci/archive/20250109/202501092100.YDIEEEHw-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250109/202501092100.YDIEEEHw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501092100.YDIEEEHw-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/blk-merge.c:688:16: warning: no previous prototype for 'blk_try_req_merge' [-Wmissing-prototypes] 688 | enum elv_merge blk_try_req_merge(struct request *req, struct request *next) | ^~~~~~~~~~~~~~~~~ vim +/blk_try_req_merge +688 block/blk-merge.c 687 > 688 enum elv_merge blk_try_req_merge(struct request *req, struct request *next) 689 { 690 if (blk_discard_mergable(req)) 691 return ELEVATOR_DISCARD_MERGE; 692 else if (blk_rq_pos(req) + blk_rq_sectors(req) == blk_rq_pos(next)) 693 return ELEVATOR_BACK_MERGE; 694 695 return ELEVATOR_NO_MERGE; 696 } 697 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] [Backport] ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
by Yongjian Sun 09 Jan '25

09 Jan '25

mainline inclusion from mainline-v6.12-rc3 commit 313dab082289e460391c82d855430ec8a28ddf81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP7 CVE: CVE-2024-56626 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An offset from client could be a negative value, It could allows to write data outside the bounds of the allocated buffer. Note that this issue is coming when setting 'vfs objects = streams_xattr parameter' in ksmbd.conf. Cc: stable(a)vger.kernel.org # v5.15+ Reported-by: Jordy Zomer <jordyzomer(a)google.com> Signed-off-by: Jordy Zomer <jordyzomer(a)google.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [Location and context differences.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index b6194837028a..32aa702921ba 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -6535,6 +6535,11 @@ int smb2_write(struct ksmbd_work *work) return smb2_write_pipe(work); } + offset = le64_to_cpu(req->Offset); + if (offset < 0) + return -EINVAL; + length = le32_to_cpu(req->Length); + if (req->Channel == SMB2_CHANNEL_RDMA_V1 || req->Channel == SMB2_CHANNEL_RDMA_V1_INVALIDATE) { unsigned int ch_offset = le16_to_cpu(req->WriteChannelInfoOffset); @@ -6573,9 +6578,6 @@ int smb2_write(struct ksmbd_work *work) goto out; } - offset = le64_to_cpu(req->Offset); - length = le32_to_cpu(req->Length); - if (length > work->conn->vals->max_write_size) { ksmbd_debug(SMB, "limiting write size to max size(%u)\n", work->conn->vals->max_write_size); -- 2.39.2

2 1

[PATCH OLK-6.6] cgroup/cpuset: remove kernfs active break
by Chen Ridong 09 Jan '25

09 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBGLXT -------------------------------- A warning was found: WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G RIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0 RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202 RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000 RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04 RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180 R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08 R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0 FS: 00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kernfs_drain+0x15e/0x2f0 __kernfs_remove+0x165/0x300 kernfs_remove_by_name_ns+0x7b/0xc0 cgroup_rm_file+0x154/0x1c0 cgroup_addrm_files+0x1c2/0x1f0 css_clear_dir+0x77/0x110 kill_css+0x4c/0x1b0 cgroup_destroy_locked+0x194/0x380 cgroup_rmdir+0x2a/0x140 It can be explained by: rmdir echo 1 > cpuset.cpus kernfs_fop_write_iter // active=0 cgroup_rm_file kernfs_remove_by_name_ns kernfs_get_active // active=1 __kernfs_remove // active=0x80000002 kernfs_drain cpuset_write_resmask wait_event //waiting (active == 0x80000001) kernfs_break_active_protection // active = 0x80000001 // continue kernfs_unbreak_active_protection // active = 0x80000002 ... kernfs_should_drain_open_files // warning occurs kernfs_put_active This warning is caused by 'kernfs_break_active_protection' when it is writing to cpuset.cpus, and the cgroup is removed concurrently. The commit 3a5a6d0c2b03 ("cpuset: don't nest cgroup_mutex inside get_online_cpus()") made cpuset_hotplug_workfn asynchronous, This change involves calling flush_work(), which can create a multiple processes circular locking dependency that involve cgroup_mutex, potentially leading to a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 ("cpuset: break kernfs active protection in cpuset_write_resmask()") added 'kernfs_break_active_protection' in the cpuset_write_resmask. This could lead to this warning. After the commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset_write_resmask no longer needs to wait the hotplug to finish, which means that concurrent hotplug and cpuset operations are no longer possible. Therefore, the deadlock doesn't exist anymore and it does not have to 'break active protection' now. To fix this warning, just remove kernfs_break_active_protection operation in the 'cpuset_write_resmask'. Fixes: bdb2fd7fc56e ("kernfs: Skip kernfs_drain_open_files() more aggressively") Fixes: 76bb5ab8f6e3 ("cpuset: break kernfs active protection in cpuset_write_resmask()") Reported-by: Ji Fa <jifa(a)huawei.com> Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- kernel/cgroup/cpuset.c | 25 ------------------------- 1 file changed, 25 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 7ea0a6d005192..53ba804a81603 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -3676,29 +3676,6 @@ static ssize_t cpuset_write_resmask(struct kernfs_open_file *of, int retval = -ENODEV; buf = strstrip(buf); - - /* - * CPU or memory hotunplug may leave @cs w/o any execution - * resources, in which case the hotplug code asynchronously updates - * configuration and transfers all tasks to the nearest ancestor - * which can execute. - * - * As writes to "cpus" or "mems" may restore @cs's execution - * resources, wait for the previously scheduled operations before - * proceeding, so that we don't end up keep removing tasks added - * after execution capability is restored. - * - * cpuset_handle_hotplug may call back into cgroup core asynchronously - * via cgroup_transfer_tasks() and waiting for it from a cgroupfs - * operation like this one can lead to a deadlock through kernfs - * active_ref protection. Let's break the protection. Losing the - * protection is okay as we check whether @cs is online after - * grabbing cpuset_mutex anyway. This only happens on the legacy - * hierarchies. - */ - css_get(&cs->css); - kernfs_break_active_protection(of->kn); - cpus_read_lock(); mutex_lock(&cpuset_mutex); if (!is_cpuset_online(cs)) @@ -3734,8 +3711,6 @@ static ssize_t cpuset_write_resmask(struct kernfs_open_file *of, out_unlock: mutex_unlock(&cpuset_mutex); cpus_read_unlock(); - kernfs_unbreak_active_protection(of->kn); - css_put(&cs->css); flush_workqueue(cpuset_migrate_mm_wq); return retval ?: nbytes; } -- 2.34.1

2 1

[PATCH OLK-6.6] smb: client: fix use-after-free of signing key
by Long Li 09 Jan '25

09 Jan '25

From: Paulo Alcantara <pc(a)manguebit.com> mainline inclusion from mainline-v6.10-rc2 commit 343d7fe6df9e247671440a932b6a73af4fa86d95 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEZ CVE: CVE-2024-53179 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race: task A task B cifs_mount() dfs_mount_share() get_session() cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() compound_send_recv() cifs_setup_session() smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() *UAF* Fix this by ensuring that we have a valid @ses->auth_key.response by checking whether @ses->ses_status is SES_GOOD or SES_EXITING with @ses->ses_lock held. After commit 24a9799aa8ef ("smb: client: fix UAF in smb2_reconnect_server()"), we made sure to call ->logoff() only when @ses was known to be good (e.g. valid ->auth_key.response), so it's safe to access signing key when @ses->ses_status == SES_EXITING. Cc: stable(a)vger.kernel.org Reported-by: Jay Shin <jaeshin(a)redhat.com> Signed-off-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/smb2transport.c [context in smb2_calc_signature() conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/client/smb2proto.h | 2 -- fs/smb/client/smb2transport.c | 56 +++++++++++++++++++++++++---------- 2 files changed, 40 insertions(+), 18 deletions(-) diff --git a/fs/smb/client/smb2proto.h b/fs/smb/client/smb2proto.h index f6fafa997e99..0a49f653530f 100644 --- a/fs/smb/client/smb2proto.h +++ b/fs/smb/client/smb2proto.h @@ -37,8 +37,6 @@ extern struct mid_q_entry *smb2_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst); extern struct mid_q_entry *smb2_setup_async_request( struct TCP_Server_Info *server, struct smb_rqst *rqst); -extern struct cifs_ses *smb2_find_smb_ses(struct TCP_Server_Info *server, - __u64 ses_id); extern struct cifs_tcon *smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid); extern int smb2_calc_signature(struct smb_rqst *rqst, diff --git a/fs/smb/client/smb2transport.c b/fs/smb/client/smb2transport.c index 4ca04e62a993..4a43802375b3 100644 --- a/fs/smb/client/smb2transport.c +++ b/fs/smb/client/smb2transport.c @@ -74,7 +74,7 @@ smb311_crypto_shash_allocate(struct TCP_Server_Info *server) static -int smb2_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key) +int smb3_get_sign_key(__u64 ses_id, struct TCP_Server_Info *server, u8 *key) { struct cifs_chan *chan; struct TCP_Server_Info *pserver; @@ -168,16 +168,41 @@ smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id) return NULL; } -struct cifs_ses * -smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id) +static int smb2_get_sign_key(struct TCP_Server_Info *server, + __u64 ses_id, u8 *key) { struct cifs_ses *ses; + int rc = -ENOENT; + + if (SERVER_IS_CHAN(server)) + server = server->primary_server; spin_lock(&cifs_tcp_ses_lock); - ses = smb2_find_smb_ses_unlocked(server, ses_id); - spin_unlock(&cifs_tcp_ses_lock); + list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { + if (ses->Suid != ses_id) + continue; - return ses; + rc = 0; + spin_lock(&ses->ses_lock); + switch (ses->ses_status) { + case SES_EXITING: /* SMB2_LOGOFF */ + case SES_GOOD: + if (likely(ses->auth_key.response)) { + memcpy(key, ses->auth_key.response, + SMB2_NTLMV2_SESSKEY_SIZE); + } else { + rc = -EIO; + } + break; + default: + rc = -EAGAIN; + break; + } + spin_unlock(&ses->ses_lock); + break; + } + spin_unlock(&cifs_tcp_ses_lock); + return rc; } static struct cifs_tcon * @@ -236,14 +261,16 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, unsigned char *sigptr = smb2_signature; struct kvec *iov = rqst->rq_iov; struct smb2_hdr *shdr = (struct smb2_hdr *)iov[0].iov_base; - struct cifs_ses *ses; struct shash_desc *shash = NULL; struct smb_rqst drqst; + __u64 sid = le64_to_cpu(shdr->SessionId); + u8 key[SMB2_NTLMV2_SESSKEY_SIZE]; - ses = smb2_find_smb_ses(server, le64_to_cpu(shdr->SessionId)); - if (unlikely(!ses)) { - cifs_server_dbg(VFS, "%s: Could not find session\n", __func__); - return -ENOENT; + rc = smb2_get_sign_key(server, sid, key); + if (unlikely(rc)) { + cifs_server_dbg(FYI, "%s: [sesid=0x%llx] couldn't find signing key: %d\n", + __func__, sid, rc); + return rc; } memset(smb2_signature, 0x0, SMB2_HMACSHA256_SIZE); @@ -260,8 +287,7 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, shash = server->secmech.hmacsha256; } - rc = crypto_shash_setkey(shash->tfm, ses->auth_key.response, - SMB2_NTLMV2_SESSKEY_SIZE); + rc = crypto_shash_setkey(shash->tfm, key, sizeof(key)); if (rc) { cifs_server_dbg(VFS, "%s: Could not update with response\n", @@ -303,8 +329,6 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, out: if (allocate_crypto) cifs_free_hash(&shash); - if (ses) - cifs_put_smb_ses(ses); return rc; } @@ -570,7 +594,7 @@ smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, struct smb_rqst drqst; u8 key[SMB3_SIGN_KEY_SIZE]; - rc = smb2_get_sign_key(le64_to_cpu(shdr->SessionId), server, key); + rc = smb3_get_sign_key(le64_to_cpu(shdr->SessionId), server, key); if (unlikely(rc)) { cifs_server_dbg(FYI, "%s: Could not get signing key\n", __func__); return rc; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v2] mm: hugetlb: independent PMD page table shared count
by Liu Shixin 09 Jan '25

09 Jan '25

mainline inclusion from mainline-v6.13-rc6 commit 59d9094df3d79443937add8700b2ef1a866b1081 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBBGL0 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The folio refcount may be increased unexpectly through try_get_folio() by caller such as split_huge_pages. In huge_pmd_unshare(), we use refcount to check whether a pmd page table is shared. The check is incorrect if the refcount is increased by the above caller, and this can cause the page table leaked: BUG: Bad page state in process sh pfn:109324 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x66 pfn:0x109324 flags: 0x17ffff800000000(node=0|zone=2|lastcpupid=0xfffff) page_type: f2(table) raw: 017ffff800000000 0000000000000000 0000000000000000 0000000000000000 raw: 0000000000000066 0000000000000000 00000000f2000000 0000000000000000 page dumped because: nonzero mapcount ... CPU: 31 UID: 0 PID: 7515 Comm: sh Kdump: loaded Tainted: G B 6.13.0-rc2master+ #7 Tainted: [B]=BAD_PAGE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 dump_stack+0x18/0x28 bad_page+0x8c/0x130 free_page_is_bad_report+0xa4/0xb0 free_unref_page+0x3cc/0x620 __folio_put+0xf4/0x158 split_huge_pages_all+0x1e0/0x3e8 split_huge_pages_write+0x25c/0x2d8 full_proxy_write+0x64/0xd8 vfs_write+0xcc/0x280 ksys_write+0x70/0x110 __arm64_sys_write+0x24/0x38 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x34/0x128 el0t_64_sync_handler+0xc8/0xd0 el0t_64_sync+0x190/0x198 The issue may be triggered by damon, offline_page, page_idle, etc, which will increase the refcount of page table. 1. The page table itself will be discarded after reporting the "nonzero mapcount". 2. The HugeTLB page mapped by the page table miss freeing since we treat the page table as shared and a shared page table will not be unmapped. Fix it by introducing independent PMD page table shared count. As described by comment, pt_index/pt_mm/pt_frag_refcount are used for s390 gmap, x86 pgds and powerpc, pt_share_count is used for x86/arm64/riscv pmds, so we can reuse the field as pt_share_count. Link: https://lkml.kernel.org/r/20241216071147.3984217-1-liushixin2@huawei.com Fixes: 39dde65c9940 ("[PATCH] shared page table for hugetlb page") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Ken Chen <kenneth.w.chen(a)intel.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Jane Chu <jane.chu(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/hugetlb.h include/linux/mm.h include/linux/mm_types.h mm/hugetlb.c mm/rmap.c [ Context conflict with commit ea919671517a and 38ca8a185389. Config conflict with commit 188cac58a8bc. Add missing vma in huge_pmd_unshare() from commit 34ae204f1851. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- v1->v2: add __GENKSYMS__ to fix kabi broken. include/linux/hugetlb.h | 7 ++++--- include/linux/mm.h | 1 + include/linux/mm_types.h | 29 +++++++++++++++++++++++++++++ mm/hugetlb.c | 26 +++++++++++++------------- mm/rmap.c | 2 +- 5 files changed, 48 insertions(+), 17 deletions(-) diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 86519e714986..303ae0d4ada1 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -138,7 +138,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz); pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, unsigned long sz); -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep); +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep); void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end); struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address, @@ -171,8 +172,8 @@ static inline unsigned long hugetlb_total_pages(void) return 0; } -static inline int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, - pte_t *ptep) +static inline int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { return 0; } diff --git a/include/linux/mm.h b/include/linux/mm.h index 72532a1d2d20..67e299374ac8 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2104,6 +2104,7 @@ static inline bool pgtable_pmd_page_ctor(struct page *page) #ifdef CONFIG_TRANSPARENT_HUGEPAGE page->pmd_huge_pte = NULL; #endif + page_pmd_pts_init(page); return ptlock_init(page); } diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index f2142a5eab6e..0a46332b79d9 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -145,6 +145,9 @@ struct page { union { struct mm_struct *pt_mm; /* x86 pgds only */ atomic_t pt_frag_refcount; /* powerpc */ +#if defined(CONFIG_ARCH_WANT_HUGE_PMD_SHARE) && !defined(__GENKSYMS__) + atomic_t pt_share_count; +#endif }; #if ALLOC_SPLIT_PTLOCKS spinlock_t *ptl; @@ -209,6 +212,32 @@ struct page { #endif } _struct_page_alignment; +#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE +static inline void page_pmd_pts_init(struct page *page) +{ + atomic_set(&page->pt_share_count, 0); +} + +static inline void page_pmd_pts_inc(struct page *page) +{ + atomic_inc(&page->pt_share_count); +} + +static inline void page_pmd_pts_dec(struct page *page) +{ + atomic_dec(&page->pt_share_count); +} + +static inline int page_pmd_pts_count(struct page *page) +{ + return atomic_read(&page->pt_share_count); +} +#else +static inline void page_pmd_pts_init(struct page *page) +{ +} +#endif + #define PAGE_FRAG_CACHE_MAX_SIZE __ALIGN_MASK(32768, ~PAGE_MASK) #define PAGE_FRAG_CACHE_MAX_ORDER get_order(PAGE_FRAG_CACHE_MAX_SIZE) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index bde2e7b632db..69dd1e096a48 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5054,7 +5054,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, continue; ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, &address, ptep)) { + if (huge_pmd_unshare(mm, vma, &address, ptep)) { spin_unlock(ptl); tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE); force_flush = true; @@ -6126,7 +6126,7 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma, if (!ptep) continue; ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, &address, ptep)) { + if (huge_pmd_unshare(mm, vma, &address, ptep)) { pages++; spin_unlock(ptl); shared_pmd = true; @@ -6444,7 +6444,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) spte = huge_pte_offset(svma->vm_mm, saddr, vma_mmu_pagesize(svma)); if (spte) { - get_page(virt_to_page(spte)); + page_pmd_pts_inc(virt_to_page(spte)); break; } } @@ -6459,7 +6459,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) (pmd_t *)((unsigned long)spte & PAGE_MASK)); mm_inc_nr_pmds(mm); } else { - put_page(virt_to_page(spte)); + page_pmd_pts_dec(virt_to_page(spte)); } spin_unlock(ptl); out: @@ -6471,27 +6471,26 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) /* * unmap huge page backed by shared pte. * - * Hugetlb pte page is ref counted at the time of mapping. If pte is shared - * indicated by page_count > 1, unmap is achieved by clearing pud and - * decrementing the ref count. If count == 1, the pte page is not shared. - * * called with page table lock held. * * returns: 1 successfully unmapped a shared pte page * 0 the underlying pte page is not shared, or it is the last user */ -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep) +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { + unsigned long sz = huge_page_size(hstate_vma(vma)); pgd_t *pgd = pgd_offset(mm, *addr); p4d_t *p4d = p4d_offset(pgd, *addr); pud_t *pud = pud_offset(p4d, *addr); - BUG_ON(page_count(virt_to_page(ptep)) == 0); - if (page_count(virt_to_page(ptep)) == 1) + if (sz != PMD_SIZE) + return 0; + if (!page_pmd_pts_count(virt_to_page(ptep))) return 0; pud_clear(pud); - put_page(virt_to_page(ptep)); + page_pmd_pts_dec(virt_to_page(ptep)); mm_dec_nr_pmds(mm); *addr = ALIGN(*addr, HPAGE_SIZE * PTRS_PER_PTE) - HPAGE_SIZE; return 1; @@ -6503,7 +6502,8 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) return NULL; } -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep) +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { return 0; } diff --git a/mm/rmap.c b/mm/rmap.c index bf26f9c8edac..e6724fd0617c 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -1449,7 +1449,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, address = pvmw.address; if (PageHuge(page)) { - if (huge_pmd_unshare(mm, &address, pvmw.pte)) { + if (huge_pmd_unshare(mm, vma, &address, pvmw.pte)) { /* * huge_pmd_unshare unmapped an entire PMD * page. There is no way of knowing exactly -- 2.34.1

2 1

[openeuler:OLK-6.6 1799/1799] drivers/net/ethernet/huawei/hibifur/bifur_main.c:175:5: warning: no previous prototype for function 'bifur_enable_disable_vf_all'
by kernel test robot 09 Jan '25

09 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 89cbe2e2a9d5402e079b95f36d33d4669614e0dc commit: a544f0ba62857476ae73fd4305dbe293b7ee7532 [1799/1799] Add Huawei Intelligent Network Card Driver:hibifur config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250109/202501091220.UhgFHZVc-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250109/202501091220.UhgFHZVc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501091220.UhgFHZVc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/huawei/hibifur/bifur_main.c:175:5: warning: no previous prototype for function 'bifur_enable_disable_vf_all' [-Wmissing-prototypes] 175 | int bifur_enable_disable_vf_all(bool enable) | ^ drivers/net/ethernet/huawei/hibifur/bifur_main.c:175:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 175 | int bifur_enable_disable_vf_all(bool enable) | ^ | static 1 warning generated. -- >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:88:6: warning: no previous prototype for function 'bifur_vf_info_hold' [-Wmissing-prototypes] 88 | void bifur_vf_info_hold(struct bifur_vf_info *dev) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:88:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 88 | void bifur_vf_info_hold(struct bifur_vf_info *dev) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:93:6: warning: no previous prototype for function 'bifur_vf_info_put' [-Wmissing-prototypes] 93 | void bifur_vf_info_put(struct bifur_vf_info *dev) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:93:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 93 | void bifur_vf_info_put(struct bifur_vf_info *dev) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:99:6: warning: no previous prototype for function 'bifur_dev_file_add' [-Wmissing-prototypes] 99 | void bifur_dev_file_add(struct bifur_dev_file_t *dev_file) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:99:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 99 | void bifur_dev_file_add(struct bifur_dev_file_t *dev_file) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:106:6: warning: no previous prototype for function 'bifur_dev_file_del' [-Wmissing-prototypes] 106 | void bifur_dev_file_del(struct bifur_dev_file_t *dev_file) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:106:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 106 | void bifur_dev_file_del(struct bifur_dev_file_t *dev_file) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:113:5: warning: no previous prototype for function 'bifur_proc_open' [-Wmissing-prototypes] 113 | int bifur_proc_open(struct inode *inode, struct file *filp) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:113:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 113 | int bifur_proc_open(struct inode *inode, struct file *filp) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:133:5: warning: no previous prototype for function 'bifur_proc_close' [-Wmissing-prototypes] 133 | int bifur_proc_close(struct inode *inode, struct file *filp) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:133:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 133 | int bifur_proc_close(struct inode *inode, struct file *filp) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:171:5: warning: no previous prototype for function 'bifur_dev_proc_build' [-Wmissing-prototypes] 171 | int bifur_dev_proc_build(struct bifur_vf_info *dev) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:171:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 171 | int bifur_dev_proc_build(struct bifur_vf_info *dev) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:204:5: warning: no previous prototype for function 'bifur_dev_proc_destroy' [-Wmissing-prototypes] 204 | int bifur_dev_proc_destroy(struct bifur_vf_info *dev) | ^ drivers/net/ethernet/huawei/hibifur/bifur_vf_mgr.c:204:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 204 | int bifur_dev_proc_destroy(struct bifur_vf_info *dev) | ^ | static 8 warnings generated. -- >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:43:6: warning: no previous prototype for function 'bifur_global_file_del' [-Wmissing-prototypes] 43 | void bifur_global_file_del(struct bifur_proc_file_t *proc_file) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:43:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 43 | void bifur_global_file_del(struct bifur_proc_file_t *proc_file) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:50:5: warning: no previous prototype for function 'bifur_global_dev_close' [-Wmissing-prototypes] 50 | int bifur_global_dev_close(struct inode *inode, struct file *filp) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:50:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 50 | int bifur_global_dev_close(struct inode *inode, struct file *filp) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:62:5: warning: no previous prototype for function 'bifur_global_file_add' [-Wmissing-prototypes] 62 | int bifur_global_file_add(struct bifur_proc_file_t *add_proc_file) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:62:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 62 | int bifur_global_file_add(struct bifur_proc_file_t *add_proc_file) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:83:27: warning: no previous prototype for function 'bifur_alloc_proc_file' [-Wmissing-prototypes] 83 | struct bifur_proc_file_t *bifur_alloc_proc_file(void) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:83:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 83 | struct bifur_proc_file_t *bifur_alloc_proc_file(void) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:95:5: warning: no previous prototype for function 'bifur_global_dev_open' [-Wmissing-prototypes] 95 | int bifur_global_dev_open(struct inode *inode, struct file *filp) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:95:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 95 | int bifur_global_dev_open(struct inode *inode, struct file *filp) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:370:5: warning: no previous prototype for function 'bifur_cmd_exec' [-Wmissing-prototypes] 370 | int bifur_cmd_exec(struct file *file, struct bifur_msg *msg) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:370:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 370 | int bifur_cmd_exec(struct file *file, struct bifur_msg *msg) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:383:5: warning: no previous prototype for function 'bifur_msg_copy_from_usr' [-Wmissing-prototypes] 383 | int bifur_msg_copy_from_usr(const char __user *ubuf, size_t size, struct bifur_msg *usr, | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:383:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 383 | int bifur_msg_copy_from_usr(const char __user *ubuf, size_t size, struct bifur_msg *usr, | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:431:6: warning: no previous prototype for function 'bifur_free_knl_msg_buf' [-Wmissing-prototypes] 431 | void bifur_free_knl_msg_buf(struct bifur_msg *msg) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:431:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 431 | void bifur_free_knl_msg_buf(struct bifur_msg *msg) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:437:5: warning: no previous prototype for function 'bifur_msg_copy_to_usr' [-Wmissing-prototypes] 437 | int bifur_msg_copy_to_usr(struct bifur_msg *usr, struct bifur_msg *knl) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:437:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 437 | int bifur_msg_copy_to_usr(struct bifur_msg *usr, struct bifur_msg *knl) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:457:9: warning: no previous prototype for function 'bifur_file_write' [-Wmissing-prototypes] 457 | ssize_t bifur_file_write(struct file *file, const char __user *ubuf, size_t size, loff_t *pos) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:457:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 457 | ssize_t bifur_file_write(struct file *file, const char __user *ubuf, size_t size, loff_t *pos) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:488:9: warning: no previous prototype for function 'bifur_proc_write' [-Wmissing-prototypes] 488 | ssize_t bifur_proc_write(struct file *file, const char __user *ubuf, size_t size, loff_t *pos) | ^ drivers/net/ethernet/huawei/hibifur/bifur_pfile.c:488:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 488 | ssize_t bifur_proc_write(struct file *file, const char __user *ubuf, size_t size, loff_t *pos) | ^ | static 11 warnings generated. -- >> drivers/net/ethernet/huawei/hibifur/bifur_event.c:257:6: warning: no previous prototype for function 'bifur_notify_vf_link_status' [-Wmissing-prototypes] 257 | void bifur_notify_vf_link_status(struct hinic3_lld_dev *lld_dev, u8 port_id, u16 vf_id, | ^ drivers/net/ethernet/huawei/hibifur/bifur_event.c:257:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 257 | void bifur_notify_vf_link_status(struct hinic3_lld_dev *lld_dev, u8 port_id, u16 vf_id, | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_event.c:282:6: warning: no previous prototype for function 'bifur_notify_all_vfs_link_changed' [-Wmissing-prototypes] 282 | void bifur_notify_all_vfs_link_changed(struct hinic3_lld_dev *lld_dev, u32 dbdf, u8 link_status) | ^ drivers/net/ethernet/huawei/hibifur/bifur_event.c:282:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 282 | void bifur_notify_all_vfs_link_changed(struct hinic3_lld_dev *lld_dev, u32 dbdf, u8 link_status) | ^ | static >> drivers/net/ethernet/huawei/hibifur/bifur_event.c:341:5: warning: no previous prototype for function 'bifur_net_event_callback' [-Wmissing-prototypes] 341 | int bifur_net_event_callback(struct notifier_block *nb, unsigned long event, void *ptr) | ^ drivers/net/ethernet/huawei/hibifur/bifur_event.c:341:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 341 | int bifur_net_event_callback(struct notifier_block *nb, unsigned long event, void *ptr) | ^ | static 3 warnings generated. vim +/bifur_enable_disable_vf_all +175 drivers/net/ethernet/huawei/hibifur/bifur_main.c 174 > 175 int bifur_enable_disable_vf_all(bool enable) 176 { 177 int err = 0; 178 int num_vfs = enable ? BIFUR_VF_NUM : 0; 179 struct bifur_lld_dev *bifur_dev = NULL; 180 struct bifur_lld_dev *tmp_dev = NULL; 181 struct bifur_adapter *adp = bifur_get_adp(); 182 struct list_head *head = &adp->lld_dev_head; 183 184 list_for_each_entry_safe(bifur_dev, tmp_dev, head, list) { 185 if (bifur_dev->pf_type != BIFUR_RESOURCE_PF) 186 continue; 187 188 bifur_dev_hold(bifur_dev); 189 err = bifur_enable_disable_vfs(bifur_dev, num_vfs); 190 bifur_dev_put(bifur_dev); 191 if (err) 192 return err; 193 } 194 195 return 0; 196 } 197 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] mm: hugetlb: independent PMD page table shared count
by Liu Shixin 09 Jan '25

09 Jan '25

mainline inclusion from mainline-v6.13-rc6 commit 59d9094df3d79443937add8700b2ef1a866b1081 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBBGL0 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The folio refcount may be increased unexpectly through try_get_folio() by caller such as split_huge_pages. In huge_pmd_unshare(), we use refcount to check whether a pmd page table is shared. The check is incorrect if the refcount is increased by the above caller, and this can cause the page table leaked: BUG: Bad page state in process sh pfn:109324 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x66 pfn:0x109324 flags: 0x17ffff800000000(node=0|zone=2|lastcpupid=0xfffff) page_type: f2(table) raw: 017ffff800000000 0000000000000000 0000000000000000 0000000000000000 raw: 0000000000000066 0000000000000000 00000000f2000000 0000000000000000 page dumped because: nonzero mapcount ... CPU: 31 UID: 0 PID: 7515 Comm: sh Kdump: loaded Tainted: G B 6.13.0-rc2master+ #7 Tainted: [B]=BAD_PAGE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 dump_stack+0x18/0x28 bad_page+0x8c/0x130 free_page_is_bad_report+0xa4/0xb0 free_unref_page+0x3cc/0x620 __folio_put+0xf4/0x158 split_huge_pages_all+0x1e0/0x3e8 split_huge_pages_write+0x25c/0x2d8 full_proxy_write+0x64/0xd8 vfs_write+0xcc/0x280 ksys_write+0x70/0x110 __arm64_sys_write+0x24/0x38 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x34/0x128 el0t_64_sync_handler+0xc8/0xd0 el0t_64_sync+0x190/0x198 The issue may be triggered by damon, offline_page, page_idle, etc, which will increase the refcount of page table. 1. The page table itself will be discarded after reporting the "nonzero mapcount". 2. The HugeTLB page mapped by the page table miss freeing since we treat the page table as shared and a shared page table will not be unmapped. Fix it by introducing independent PMD page table shared count. As described by comment, pt_index/pt_mm/pt_frag_refcount are used for s390 gmap, x86 pgds and powerpc, pt_share_count is used for x86/arm64/riscv pmds, so we can reuse the field as pt_share_count. Link: https://lkml.kernel.org/r/20241216071147.3984217-1-liushixin2@huawei.com Fixes: 39dde65c9940 ("[PATCH] shared page table for hugetlb page") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Ken Chen <kenneth.w.chen(a)intel.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Jane Chu <jane.chu(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: include/linux/hugetlb.h include/linux/mm.h include/linux/mm_types.h mm/hugetlb.c mm/rmap.c [ Context conflict with commit ea919671517a and 38ca8a185389. Config conflict with commit 188cac58a8bc. Add missing vma in huge_pmd_unshare() from commit 34ae204f1851. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- include/linux/hugetlb.h | 7 ++++--- include/linux/mm.h | 1 + include/linux/mm_types.h | 29 +++++++++++++++++++++++++++++ mm/hugetlb.c | 26 +++++++++++++------------- mm/rmap.c | 2 +- 5 files changed, 48 insertions(+), 17 deletions(-) diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 86519e714986..303ae0d4ada1 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -138,7 +138,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz); pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, unsigned long sz); -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep); +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep); void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end); struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address, @@ -171,8 +172,8 @@ static inline unsigned long hugetlb_total_pages(void) return 0; } -static inline int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, - pte_t *ptep) +static inline int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { return 0; } diff --git a/include/linux/mm.h b/include/linux/mm.h index 72532a1d2d20..67e299374ac8 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2104,6 +2104,7 @@ static inline bool pgtable_pmd_page_ctor(struct page *page) #ifdef CONFIG_TRANSPARENT_HUGEPAGE page->pmd_huge_pte = NULL; #endif + page_pmd_pts_init(page); return ptlock_init(page); } diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index f2142a5eab6e..2cf5d0aaeb97 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -145,6 +145,9 @@ struct page { union { struct mm_struct *pt_mm; /* x86 pgds only */ atomic_t pt_frag_refcount; /* powerpc */ +#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE + atomic_t pt_share_count; +#endif }; #if ALLOC_SPLIT_PTLOCKS spinlock_t *ptl; @@ -209,6 +212,32 @@ struct page { #endif } _struct_page_alignment; +#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE +static inline void page_pmd_pts_init(struct page *page) +{ + atomic_set(&page->pt_share_count, 0); +} + +static inline void page_pmd_pts_inc(struct page *page) +{ + atomic_inc(&page->pt_share_count); +} + +static inline void page_pmd_pts_dec(struct page *page) +{ + atomic_dec(&page->pt_share_count); +} + +static inline int page_pmd_pts_count(struct page *page) +{ + return atomic_read(&page->pt_share_count); +} +#else +static inline void page_pmd_pts_init(struct page *page) +{ +} +#endif + #define PAGE_FRAG_CACHE_MAX_SIZE __ALIGN_MASK(32768, ~PAGE_MASK) #define PAGE_FRAG_CACHE_MAX_ORDER get_order(PAGE_FRAG_CACHE_MAX_SIZE) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index bde2e7b632db..69dd1e096a48 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5054,7 +5054,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, continue; ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, &address, ptep)) { + if (huge_pmd_unshare(mm, vma, &address, ptep)) { spin_unlock(ptl); tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE); force_flush = true; @@ -6126,7 +6126,7 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma, if (!ptep) continue; ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, &address, ptep)) { + if (huge_pmd_unshare(mm, vma, &address, ptep)) { pages++; spin_unlock(ptl); shared_pmd = true; @@ -6444,7 +6444,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) spte = huge_pte_offset(svma->vm_mm, saddr, vma_mmu_pagesize(svma)); if (spte) { - get_page(virt_to_page(spte)); + page_pmd_pts_inc(virt_to_page(spte)); break; } } @@ -6459,7 +6459,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) (pmd_t *)((unsigned long)spte & PAGE_MASK)); mm_inc_nr_pmds(mm); } else { - put_page(virt_to_page(spte)); + page_pmd_pts_dec(virt_to_page(spte)); } spin_unlock(ptl); out: @@ -6471,27 +6471,26 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) /* * unmap huge page backed by shared pte. * - * Hugetlb pte page is ref counted at the time of mapping. If pte is shared - * indicated by page_count > 1, unmap is achieved by clearing pud and - * decrementing the ref count. If count == 1, the pte page is not shared. - * * called with page table lock held. * * returns: 1 successfully unmapped a shared pte page * 0 the underlying pte page is not shared, or it is the last user */ -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep) +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { + unsigned long sz = huge_page_size(hstate_vma(vma)); pgd_t *pgd = pgd_offset(mm, *addr); p4d_t *p4d = p4d_offset(pgd, *addr); pud_t *pud = pud_offset(p4d, *addr); - BUG_ON(page_count(virt_to_page(ptep)) == 0); - if (page_count(virt_to_page(ptep)) == 1) + if (sz != PMD_SIZE) + return 0; + if (!page_pmd_pts_count(virt_to_page(ptep))) return 0; pud_clear(pud); - put_page(virt_to_page(ptep)); + page_pmd_pts_dec(virt_to_page(ptep)); mm_dec_nr_pmds(mm); *addr = ALIGN(*addr, HPAGE_SIZE * PTRS_PER_PTE) - HPAGE_SIZE; return 1; @@ -6503,7 +6502,8 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) return NULL; } -int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep) +int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long *addr, pte_t *ptep) { return 0; } diff --git a/mm/rmap.c b/mm/rmap.c index bf26f9c8edac..e6724fd0617c 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -1449,7 +1449,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, address = pvmw.address; if (PageHuge(page)) { - if (huge_pmd_unshare(mm, &address, pvmw.pte)) { + if (huge_pmd_unshare(mm, vma, &address, pvmw.pte)) { /* * huge_pmd_unshare unmapped an entire PMD * page. There is no way of knowing exactly -- 2.34.1

2 1

[openeuler:OLK-5.10 2668/2668] fs/erofs/fscache.c:22:33: sparse: sparse: symbol 'erofs_fscache_super_index_def' was not declared. Should it be static?
by kernel test robot 09 Jan '25

09 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ed8467e701e8f5ed9f2b39cf55710a156fc2593f commit: 6de602b09314b731285d7807eb912ac04dbacfb8 [2668/2668] erofs: register fscache volume config: x86_64-randconfig-121-20250108 (https://download.01.org/0day-ci/archive/20250109/202501091137.E9nwi2KG-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250109/202501091137.E9nwi2KG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501091137.E9nwi2KG-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) fs/erofs/fscache.c:7:22: sparse: sparse: symbol 'erofs_fscache_netfs' was not declared. Should it be static? >> fs/erofs/fscache.c:22:33: sparse: sparse: symbol 'erofs_fscache_super_index_def' was not declared. Should it be static? vim +/erofs_fscache_super_index_def +22 fs/erofs/fscache.c 6 > 7 struct fscache_netfs erofs_fscache_netfs = { 8 .name = "erofs", 9 .version = 0, 10 }; 11 12 int erofs_fscache_register(void) 13 { 14 return fscache_register_netfs(&erofs_fscache_netfs); 15 } 16 17 void erofs_fscache_unregister(void) 18 { 19 fscache_unregister_netfs(&erofs_fscache_netfs); 20 } 21 > 22 const struct fscache_cookie_def erofs_fscache_super_index_def = { 23 .name = "EROFS.super", 24 .type = FSCACHE_COOKIE_TYPE_INDEX, 25 .check_aux = NULL, 26 }; 27 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] [Backport] ALSA: 6fire: Release resources at card release
by Lin Ruifeng 09 Jan '25

09 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit f2d06d4e129e2508e356136f99bb20a332ff1a00 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEC CVE: CVE-2024-53239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a0810c3d6dd2d29a9b92604d682eacd2902ce947 ] The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()). For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback. Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Link: https://patch.msgid.link/20241113111042.15058-6-tiwai@suse.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/usb/6fire/chip.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c index 08c6e6a52eb9..ad6f89845a5c 100644 --- a/sound/usb/6fire/chip.c +++ b/sound/usb/6fire/chip.c @@ -62,8 +62,10 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) } } -static void usb6fire_chip_destroy(struct sfire_chip *chip) +static void usb6fire_card_free(struct snd_card *card) { + struct sfire_chip *chip = card->private_data; + if (chip) { if (chip->pcm) usb6fire_pcm_destroy(chip); @@ -73,8 +75,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip) usb6fire_comm_destroy(chip); if (chip->control) usb6fire_control_destroy(chip); - if (chip->card) - snd_card_free(chip->card); } } @@ -137,6 +137,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, chip->regidx = regidx; chip->intf_count = 1; chip->card = card; + card->private_free = usb6fire_card_free; ret = usb6fire_comm_init(chip); if (ret < 0) @@ -163,7 +164,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, return 0; destroy_chip: - usb6fire_chip_destroy(chip); + snd_card_free(card); return ret; } @@ -182,7 +183,6 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) chip->shutdown = true; usb6fire_chip_abort(chip); - usb6fire_chip_destroy(chip); } } } -- 2.22.0

2 1