Kernel

kernel@openeuler.org

27 participants
18548 discussions

[PATCH OLK-6.6 0/6] Introduce dynamic pool feature part 2
by Liu Shixin 28 Mar '24

28 Mar '24

This part include: 1. Compatible with memory reliable feature[1-3]. 2. Compatible with memory migration[4] 3. Fix an incorrect set of subpool[5]. 4. Make the lock in dynamic pool irq safe[6]. Liu Shixin (6): mm/dynamic_pool: Stop alloc reliable page from dynamic pool mm/mem_reliable: Treat page from dhugetlb pool as unreliable page mm/mem_reliable: Fallback to dpool if reliable memory is not enough mm/dynamic_pool: skip unexpected migration mm/dynamic_pool: don't set subpool for page from dynamic pool mm/dynamic_pool: disable irq for dynamic_pool lock include/linux/dynamic_pool.h | 6 ++ include/linux/mem_reliable.h | 3 + mm/compaction.c | 4 ++ mm/dynamic_pool.c | 112 +++++++++++++++++++---------------- mm/hugetlb.c | 3 +- mm/migrate.c | 7 +++ mm/page_alloc.c | 27 +++++++++ mm/page_isolation.c | 9 ++- 8 files changed, 118 insertions(+), 53 deletions(-) -- 2.25.1

2 7

[PATCH OLK-5.10 0/1] mm/mlock: return EINVAL for illegal user memory range in mlock
by Wupeng Ma 28 Mar '24

28 Mar '24

From: Ma Wupeng <mawupeng1(a)huawei.com> mlock return -EINVAL for invalid len. Ma Wupeng (1): mm/mlock: return EINVAL for illegal user memory range in mlock mm/mlock.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2021-47171
by Luo Gengkun 28 Mar '24

28 Mar '24

Dongliang Mu (1): net: usb: fix possible use-after-free in smsc75xx_bind Pavel Skripkin (1): net: usb: fix memory leak in smsc75xx_bind drivers/net/usb/smsc75xx.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) -- 2.34.1

2 9

[PATCH openEuler-1.0-LTS 0/3] CVE-2023-52622
by Yifan Qiao 28 Mar '24

28 Mar '24

Baokun Li (3): ext4: remove unnecessary check from alloc_flex_gd() ext4: unify the type of flexbg_size to unsigned int ext4: avoid online resizing failures due to oversized flex bg fs/ext4/resize.c | 37 ++++++++++++++++++++++--------------- 1 file changed, 22 insertions(+), 15 deletions(-) -- 2.39.2

2 12

[PATCH OLK-5.10 0/3] CVE-2023-52622
by Yifan Qiao 28 Mar '24

28 Mar '24

Baokun Li (3): ext4: remove unnecessary check from alloc_flex_gd() ext4: unify the type of flexbg_size to unsigned int ext4: avoid online resizing failures due to oversized flex bg fs/ext4/resize.c | 37 ++++++++++++++++++++++--------------- 1 file changed, 22 insertions(+), 15 deletions(-) -- 2.39.2

2 12

[PATCH OLK-5.10 0/3]
by Yifan Qiao 28 Mar '24

28 Mar '24

Baokun Li (3): ext4: remove unnecessary check from alloc_flex_gd() ext4: unify the type of flexbg_size to unsigned int ext4: avoid online resizing failures due to oversized flex bg fs/ext4/resize.c | 37 ++++++++++++++++++++++--------------- 1 file changed, 22 insertions(+), 15 deletions(-) -- 2.39.2

2 13

[PATCH openEuler-1.0-LTS 0/3]
by Yifan Qiao 28 Mar '24

28 Mar '24

Baokun Li (3): ext4: remove unnecessary check from alloc_flex_gd() ext4: unify the type of flexbg_size to unsigned int ext4: avoid online resizing failures due to oversized flex bg fs/ext4/resize.c | 37 ++++++++++++++++++++++--------------- 1 file changed, 22 insertions(+), 15 deletions(-) -- 2.39.2

2 13

[PATCH openEuler-1.0-LTS 0/3]
by Yifan Qiao 28 Mar '24

28 Mar '24

Baokun Li (3): ext4: remove unnecessary check from alloc_flex_gd() ext4: unify the type of flexbg_size to unsigned int ext4: avoid online resizing failures due to oversized flex bg fs/ext4/resize.c | 37 ++++++++++++++++++++++--------------- 1 file changed, 22 insertions(+), 15 deletions(-) -- 2.39.2

2 12

[openeuler:OLK-6.6] BUILD REGRESSION c8e916a3b26e752d8992dff4fa320353e1f0ec84
by kernel test robot 28 Mar '24

28 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: c8e916a3b26e752d8992dff4fa320353e1f0ec84 !5524 [OLK-6.6] fix 0day bugs reported by CI robot for Mont-TSSE Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202403281003.L0CYgKLz-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:413: warning: expecting prototype for prepare_cell(). Prototype was for wait_for_resp_polling() instead drivers/net/ethernet/huawei/hinic/hinic_eqs.c:369: warning: expecting prototype for hinic_aeq_register_sw_cb(). Prototype was for hinic_aeq_register_swe_cb() instead drivers/net/ethernet/huawei/hinic/hinic_eqs.c:391: warning: expecting prototype for hinic_aeq_unregister_sw_cb(). Prototype was for hinic_aeq_unregister_swe_cb() instead drivers/net/ethernet/huawei/hinic/hinic_eqs.c:417: warning: expecting prototype for hinic_ceq_register_sw_cb(). Prototype was for hinic_ceq_register_cb() instead drivers/net/ethernet/huawei/hinic/hinic_hwif.c:717: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst drivers/net/ethernet/huawei/hinic/hinic_mbox.c:373: warning: expecting prototype for hinic_unregister_ppf_mbox_cb(). Prototype was for hinic_unregister_pf_mbox_cb() instead drivers/net/ethernet/huawei/hinic/hinic_mbox.c:411: warning: expecting prototype for hinic_unregister_ppf_mbox_cb(). Prototype was for hinic_unregister_ppf_to_pf_mbox_cb() instead drivers/net/ethernet/huawei/hinic/hinic_mgmt.c:939: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst Error/Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-defconfig `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_cfg.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-) | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-) | |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dbg.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-) | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used | `-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) `-- x86_64-allyesconfig |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used |-- ld.lld:error:duplicate-symbol:__cfi_check_ari_mode |-- ld.lld:error:duplicate-symbol:__cfi_mbx_cookie_zalloc |-- ld.lld:error:duplicate-symbol:check_ari_mode |-- ld.lld:error:duplicate-symbol:mbx_cookie_zalloc `-- ld.lld:error:duplicate-symbol:rnp10_netdev_ops elapsed time: 1057m configs tested: 16 configs skipped: 142 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240328 gcc arm64 randconfig-002-20240328 gcc arm64 randconfig-003-20240328 gcc arm64 randconfig-004-20240328 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240328 gcc loongarch randconfig-002-20240328 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] mm: ksm: fix use-after-free kasan report in ksm_might_need_to_copy
by Jinjiang Tu 28 Mar '24

28 Mar '24

From: Nanyong Sun <sunnanyong(a)huawei.com> mainline inclusion from mainline-v5.17-rc1 commit e1c63e110f977205ab9dfb38989c54e6e7b52a7b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9BWES CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When under the stress of swapping in/out with KSM enabled, there is a low probability that kasan reports the BUG of use-after-free in ksm_might_need_to_copy() when do swap in. The freed object is the anon_vma got from page_anon_vma(page). It is because a swapcache page associated with one anon_vma now needed for another anon_vma, but the page's original vma was unmapped and the anon_vma was freed. In this case the if condition below always return false and then alloc a new page to copy. Swapin process then use the new page and can continue to run well, so this is harmless actually. } else if (anon_vma->root == vma->anon_vma->root && page->index == linear_page_index(vma, address)) { This patch exchange the order of above two judgment statement to avoid the kasan warning. Let cpu run "page->index == linear_page_index(vma, address)" firstly and return false basically to skip the read of anon_vma->root which may trigger the kasan use-after-free warning: ================================================================== BUG: KASAN: use-after-free in ksm_might_need_to_copy+0x12e/0x5b0 Read of size 8 at addr ffff88be9977dbd0 by task khugepaged/694 CPU: 8 PID: 694 Comm: khugepaged Kdump: loaded Tainted: G OE - 4.18.0.x86_64 Hardware name: 1288H V5/BC11SPSC0, BIOS 7.93 01/14/2021 Call Trace: dump_stack+0xf1/0x19b print_address_description+0x70/0x360 kasan_report+0x1b2/0x330 ksm_might_need_to_copy+0x12e/0x5b0 do_swap_page+0x452/0xe70 __collapse_huge_page_swapin+0x24b/0x720 khugepaged_scan_pmd+0xcae/0x1ff0 khugepaged+0x8ee/0xd70 kthread+0x1a2/0x1d0 ret_from_fork+0x1f/0x40 Allocated by task 2306153: kasan_kmalloc+0xa0/0xd0 kmem_cache_alloc+0xc0/0x1c0 anon_vma_clone+0xf7/0x380 anon_vma_fork+0xc0/0x390 copy_process+0x447b/0x4810 _do_fork+0x118/0x620 do_syscall_64+0x112/0x360 entry_SYSCALL_64_after_hwframe+0x65/0xca Freed by task 2306242: __kasan_slab_free+0x130/0x180 kmem_cache_free+0x78/0x1d0 unlink_anon_vmas+0x19c/0x4a0 free_pgtables+0x137/0x1b0 exit_mmap+0x133/0x320 mmput+0x15e/0x390 do_exit+0x8c5/0x1210 do_group_exit+0xb5/0x1b0 __x64_sys_exit_group+0x21/0x30 do_syscall_64+0x112/0x360 entry_SYSCALL_64_after_hwframe+0x65/0xca The buggy address belongs to the object at ffff88be9977dba0 which belongs to the cache anon_vma_chain of size 64 The buggy address is located 48 bytes inside of 64-byte region [ffff88be9977dba0, ffff88be9977dbe0) The buggy address belongs to the page: page:ffffea00fa65df40 count:1 mapcount:0 mapping:ffff888107717800 index:0x0 flags: 0x17ffffc0000100(slab) ================================================================== Link: https://lkml.kernel.org/r/20211202102940.1069634-1-sunnanyong@huawei.com Signed-off-by: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/ksm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/ksm.c b/mm/ksm.c index b656fa77f92f..341e09c376e6 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -2596,8 +2596,8 @@ struct page *ksm_might_need_to_copy(struct page *page, return page; /* no need to copy it */ } else if (!anon_vma) { return page; /* no need to copy it */ - } else if (anon_vma->root == vma->anon_vma->root && - page->index == linear_page_index(vma, address)) { + } else if (page->index == linear_page_index(vma, address) && + anon_vma->root == vma->anon_vma->root) { return page; /* still no need to copy it */ } if (!PageUptodate(page)) -- 2.25.1

2 1

Jump to page: