- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 2954/2954] arch/arm64/net/bpf_jit_comp.c:1647:73: sparse: sparse: incorrect type in argument 5 (different base types)
by kernel test robot 11 Jun '25

11 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 90ff3e07cc268a8e40bd578dcc4907a3db419c52 commit: 43be0c0544c8e70723951433fd2dae258fff3dff [2954/2954] bpf, arm64: Fix bpf trampoline instruction endianness config: arm64-randconfig-r133-20250610 (https://download.01.org/0day-ci/archive/20250611/202506112030.xet5A4D9-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 reproduce: (https://download.01.org/0day-ci/archive/20250611/202506112030.xet5A4D9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506112030.xet5A4D9-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/arm64/net/bpf_jit_comp.c:1515:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] * @@ got restricted __le32 [usertype] * @@ arch/arm64/net/bpf_jit_comp.c:1515:29: sparse: expected unsigned int [usertype] * arch/arm64/net/bpf_jit_comp.c:1515:29: sparse: got restricted __le32 [usertype] * >> arch/arm64/net/bpf_jit_comp.c:1647:73: sparse: sparse: incorrect type in argument 5 (different base types) @@ expected unsigned int [usertype] **branches @@ got restricted __le32 [usertype] **[assigned] branches @@ arch/arm64/net/bpf_jit_comp.c:1647:73: sparse: expected unsigned int [usertype] **branches arch/arm64/net/bpf_jit_comp.c:1647:73: sparse: got restricted __le32 [usertype] **[assigned] branches vim +1647 arch/arm64/net/bpf_jit_comp.c 2a5ab77af7f94d Xu Kuohai 2024-04-13 1496 2a5ab77af7f94d Xu Kuohai 2024-04-13 1497 static void invoke_bpf_mod_ret(struct jit_ctx *ctx, struct bpf_tramp_progs *tp, 2a5ab77af7f94d Xu Kuohai 2024-04-13 1498 int args_off, int retval_off, u32 **branches) 2a5ab77af7f94d Xu Kuohai 2024-04-13 1499 { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1500 int i; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1501 2a5ab77af7f94d Xu Kuohai 2024-04-13 1502 /* The first fmod_ret program will receive a garbage return value. 2a5ab77af7f94d Xu Kuohai 2024-04-13 1503 * Set this to 0 to avoid confusing the program. 2a5ab77af7f94d Xu Kuohai 2024-04-13 1504 */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1505 emit(A64_STR64I(A64_ZR, A64_SP, retval_off), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1506 for (i = 0; i < tp->nr_progs; i++) { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1507 invoke_bpf_prog(ctx, tp->progs[i], args_off, retval_off, true); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1508 /* if (*(u64 *)(sp + retval_off) != 0) 2a5ab77af7f94d Xu Kuohai 2024-04-13 1509 * goto do_fexit; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1510 */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1511 emit(A64_LDR64I(A64_R(10), A64_SP, retval_off), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1512 /* Save the location of branch, and generate a nop. 2a5ab77af7f94d Xu Kuohai 2024-04-13 1513 * This nop will be replaced with a cbnz later. 2a5ab77af7f94d Xu Kuohai 2024-04-13 1514 */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 @1515 branches[i] = ctx->image + ctx->idx; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1516 emit(A64_NOP, ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1517 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1518 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1519 2a5ab77af7f94d Xu Kuohai 2024-04-13 1520 static void save_args(struct jit_ctx *ctx, int args_off, int nargs) 2a5ab77af7f94d Xu Kuohai 2024-04-13 1521 { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1522 int i; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1523 2a5ab77af7f94d Xu Kuohai 2024-04-13 1524 for (i = 0; i < nargs; i++) { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1525 emit(A64_STR64I(i, A64_SP, args_off), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1526 args_off += 8; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1527 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1528 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1529 2a5ab77af7f94d Xu Kuohai 2024-04-13 1530 static void restore_args(struct jit_ctx *ctx, int args_off, int nargs) 2a5ab77af7f94d Xu Kuohai 2024-04-13 1531 { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1532 int i; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1533 2a5ab77af7f94d Xu Kuohai 2024-04-13 1534 for (i = 0; i < nargs; i++) { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1535 emit(A64_LDR64I(i, A64_SP, args_off), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1536 args_off += 8; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1537 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1538 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1539 2a5ab77af7f94d Xu Kuohai 2024-04-13 1540 /* Based on the x86's implementation of arch_prepare_bpf_trampoline(). 2a5ab77af7f94d Xu Kuohai 2024-04-13 1541 * 2a5ab77af7f94d Xu Kuohai 2024-04-13 1542 * bpf prog and function entry before bpf trampoline hooked: 2a5ab77af7f94d Xu Kuohai 2024-04-13 1543 * mov x9, lr 2a5ab77af7f94d Xu Kuohai 2024-04-13 1544 * nop 2a5ab77af7f94d Xu Kuohai 2024-04-13 1545 * 2a5ab77af7f94d Xu Kuohai 2024-04-13 1546 * bpf prog and function entry after bpf trampoline hooked: 2a5ab77af7f94d Xu Kuohai 2024-04-13 1547 * mov x9, lr 2a5ab77af7f94d Xu Kuohai 2024-04-13 1548 * bl <bpf_trampoline or plt> 2a5ab77af7f94d Xu Kuohai 2024-04-13 1549 * 2a5ab77af7f94d Xu Kuohai 2024-04-13 1550 */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1551 static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, 2a5ab77af7f94d Xu Kuohai 2024-04-13 1552 struct bpf_tramp_progs *tprogs, void *orig_call, 2a5ab77af7f94d Xu Kuohai 2024-04-13 1553 int nargs, u32 flags) 2a5ab77af7f94d Xu Kuohai 2024-04-13 1554 { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1555 int i; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1556 int stack_size; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1557 int retaddr_off; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1558 int regs_off; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1559 int retval_off; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1560 int args_off; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1561 struct bpf_tramp_progs *fentry = &tprogs[BPF_TRAMP_FENTRY]; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1562 struct bpf_tramp_progs *fexit = &tprogs[BPF_TRAMP_FEXIT]; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1563 struct bpf_tramp_progs *fmod_ret = &tprogs[BPF_TRAMP_MODIFY_RETURN]; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1564 bool save_ret; 43be0c0544c8e7 Xu Kuohai 2024-04-13 1565 __le32 **branches = NULL; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1566 2a5ab77af7f94d Xu Kuohai 2024-04-13 1567 /* trampoline stack layout: 2a5ab77af7f94d Xu Kuohai 2024-04-13 1568 * [ parent ip ] 2a5ab77af7f94d Xu Kuohai 2024-04-13 1569 * [ FP ] 2a5ab77af7f94d Xu Kuohai 2024-04-13 1570 * SP + retaddr_off [ self ip ] 2a5ab77af7f94d Xu Kuohai 2024-04-13 1571 * [ FP ] 2a5ab77af7f94d Xu Kuohai 2024-04-13 1572 * 2a5ab77af7f94d Xu Kuohai 2024-04-13 1573 * [ padding ] align SP to multiples of 16 2a5ab77af7f94d Xu Kuohai 2024-04-13 1574 * 2a5ab77af7f94d Xu Kuohai 2024-04-13 1575 * SP + regs_off [ x19 ] callee saved reg x19 2a5ab77af7f94d Xu Kuohai 2024-04-13 1576 * 2a5ab77af7f94d Xu Kuohai 2024-04-13 1577 * SP + retval_off [ return value ] BPF_TRAMP_F_CALL_ORIG or 2a5ab77af7f94d Xu Kuohai 2024-04-13 1578 * BPF_TRAMP_F_RET_FENTRY_RET 2a5ab77af7f94d Xu Kuohai 2024-04-13 1579 * 2a5ab77af7f94d Xu Kuohai 2024-04-13 1580 * [ argN ] 2a5ab77af7f94d Xu Kuohai 2024-04-13 1581 * [ ... ] 2a5ab77af7f94d Xu Kuohai 2024-04-13 1582 * SP + args_off [ arg1 ] 2a5ab77af7f94d Xu Kuohai 2024-04-13 1583 */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1584 2a5ab77af7f94d Xu Kuohai 2024-04-13 1585 stack_size = 0; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1586 2a5ab77af7f94d Xu Kuohai 2024-04-13 1587 args_off = stack_size; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1588 /* room for args */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1589 stack_size += nargs * 8; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1590 2a5ab77af7f94d Xu Kuohai 2024-04-13 1591 /* room for return value */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1592 retval_off = stack_size; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1593 save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1594 if (save_ret) 2a5ab77af7f94d Xu Kuohai 2024-04-13 1595 stack_size += 8; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1596 2a5ab77af7f94d Xu Kuohai 2024-04-13 1597 /* room for callee saved registers, currently only x19 is used */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1598 regs_off = stack_size; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1599 stack_size += 8; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1600 2a5ab77af7f94d Xu Kuohai 2024-04-13 1601 /* round up to multiples of 16 to avoid SPAlignmentFault */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1602 stack_size = round_up(stack_size, 16); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1603 2a5ab77af7f94d Xu Kuohai 2024-04-13 1604 /* return address locates above FP */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1605 retaddr_off = stack_size + 8; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1606 2a5ab77af7f94d Xu Kuohai 2024-04-13 1607 /* bpf trampoline may be invoked by 3 instruction types: 2a5ab77af7f94d Xu Kuohai 2024-04-13 1608 * 1. bl, attached to bpf prog or kernel function via short jump 2a5ab77af7f94d Xu Kuohai 2024-04-13 1609 * 2. br, attached to bpf prog or kernel function via long jump 2a5ab77af7f94d Xu Kuohai 2024-04-13 1610 * 3. blr, working as a function pointer, used by struct_ops. 2a5ab77af7f94d Xu Kuohai 2024-04-13 1611 * So BTI_JC should used here to support both br and blr. 2a5ab77af7f94d Xu Kuohai 2024-04-13 1612 */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1613 emit_bti(A64_BTI_JC, ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1614 2a5ab77af7f94d Xu Kuohai 2024-04-13 1615 /* frame for parent function */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1616 emit(A64_PUSH(A64_FP, A64_R(9), A64_SP), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1617 emit(A64_MOV(1, A64_FP, A64_SP), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1618 2a5ab77af7f94d Xu Kuohai 2024-04-13 1619 /* frame for patched function */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1620 emit(A64_PUSH(A64_FP, A64_LR, A64_SP), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1621 emit(A64_MOV(1, A64_FP, A64_SP), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1622 2a5ab77af7f94d Xu Kuohai 2024-04-13 1623 /* allocate stack space */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1624 emit(A64_SUB_I(1, A64_SP, A64_SP, stack_size), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1625 2a5ab77af7f94d Xu Kuohai 2024-04-13 1626 /* save args */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1627 save_args(ctx, args_off, nargs); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1628 2a5ab77af7f94d Xu Kuohai 2024-04-13 1629 /* save callee saved registers */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1630 emit(A64_STR64I(A64_R(19), A64_SP, regs_off), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1631 2a5ab77af7f94d Xu Kuohai 2024-04-13 1632 if (flags & BPF_TRAMP_F_CALL_ORIG) { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1633 emit_addr_mov_i64(A64_R(0), (const u64)im, ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1634 emit_call((const u64)__bpf_tramp_enter, ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1635 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1636 2a5ab77af7f94d Xu Kuohai 2024-04-13 1637 for (i = 0; i < fentry->nr_progs; i++) 2a5ab77af7f94d Xu Kuohai 2024-04-13 1638 invoke_bpf_prog(ctx, fentry->progs[i], args_off, 2a5ab77af7f94d Xu Kuohai 2024-04-13 1639 retval_off, flags & BPF_TRAMP_F_RET_FENTRY_RET); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1640 2a5ab77af7f94d Xu Kuohai 2024-04-13 1641 if (fmod_ret->nr_progs) { 43be0c0544c8e7 Xu Kuohai 2024-04-13 1642 branches = kcalloc(fmod_ret->nr_progs, sizeof(__le32 *), 2a5ab77af7f94d Xu Kuohai 2024-04-13 1643 GFP_KERNEL); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1644 if (!branches) 2a5ab77af7f94d Xu Kuohai 2024-04-13 1645 return -ENOMEM; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1646 2a5ab77af7f94d Xu Kuohai 2024-04-13 @1647 invoke_bpf_mod_ret(ctx, fmod_ret, args_off, retval_off, branches); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1648 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1649 2a5ab77af7f94d Xu Kuohai 2024-04-13 1650 if (flags & BPF_TRAMP_F_CALL_ORIG) { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1651 restore_args(ctx, args_off, nargs); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1652 /* call original func */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1653 emit(A64_LDR64I(A64_R(10), A64_SP, retaddr_off), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1654 emit(A64_BLR(A64_R(10)), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1655 /* store return value */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1656 emit(A64_STR64I(A64_R(0), A64_SP, retval_off), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1657 /* reserve a nop for bpf_tramp_image_put */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1658 im->ip_after_call = ctx->image + ctx->idx; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1659 emit(A64_NOP, ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1660 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1661 2a5ab77af7f94d Xu Kuohai 2024-04-13 1662 /* update the branches saved in invoke_bpf_mod_ret with cbnz */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1663 for (i = 0; i < fmod_ret->nr_progs && ctx->image != NULL; i++) { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1664 int offset = &ctx->image[ctx->idx] - branches[i]; 43be0c0544c8e7 Xu Kuohai 2024-04-13 1665 *branches[i] = cpu_to_le32(A64_CBNZ(1, A64_R(10), offset)); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1666 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1667 2a5ab77af7f94d Xu Kuohai 2024-04-13 1668 for (i = 0; i < fexit->nr_progs; i++) 2a5ab77af7f94d Xu Kuohai 2024-04-13 1669 invoke_bpf_prog(ctx, fexit->progs[i], args_off, retval_off, false); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1670 2a5ab77af7f94d Xu Kuohai 2024-04-13 1671 if (flags & BPF_TRAMP_F_CALL_ORIG) { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1672 im->ip_epilogue = ctx->image + ctx->idx; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1673 emit_addr_mov_i64(A64_R(0), (const u64)im, ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1674 emit_call((const u64)__bpf_tramp_exit, ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1675 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1676 2a5ab77af7f94d Xu Kuohai 2024-04-13 1677 if (flags & BPF_TRAMP_F_RESTORE_REGS) 2a5ab77af7f94d Xu Kuohai 2024-04-13 1678 restore_args(ctx, args_off, nargs); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1679 2a5ab77af7f94d Xu Kuohai 2024-04-13 1680 /* restore callee saved register x19 */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1681 emit(A64_LDR64I(A64_R(19), A64_SP, regs_off), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1682 2a5ab77af7f94d Xu Kuohai 2024-04-13 1683 if (save_ret) 2a5ab77af7f94d Xu Kuohai 2024-04-13 1684 emit(A64_LDR64I(A64_R(0), A64_SP, retval_off), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1685 2a5ab77af7f94d Xu Kuohai 2024-04-13 1686 /* reset SP */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1687 emit(A64_MOV(1, A64_SP, A64_FP), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1688 2a5ab77af7f94d Xu Kuohai 2024-04-13 1689 /* pop frames */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1690 emit(A64_POP(A64_FP, A64_LR, A64_SP), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1691 emit(A64_POP(A64_FP, A64_R(9), A64_SP), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1692 2a5ab77af7f94d Xu Kuohai 2024-04-13 1693 if (flags & BPF_TRAMP_F_SKIP_FRAME) { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1694 /* skip patched function, return to parent */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1695 emit(A64_MOV(1, A64_LR, A64_R(9)), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1696 emit(A64_RET(A64_R(9)), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1697 } else { 2a5ab77af7f94d Xu Kuohai 2024-04-13 1698 /* return to patched function */ 2a5ab77af7f94d Xu Kuohai 2024-04-13 1699 emit(A64_MOV(1, A64_R(10), A64_LR), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1700 emit(A64_MOV(1, A64_LR, A64_R(9)), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1701 emit(A64_RET(A64_R(10)), ctx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1702 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1703 2a5ab77af7f94d Xu Kuohai 2024-04-13 1704 if (ctx->image) 2a5ab77af7f94d Xu Kuohai 2024-04-13 1705 bpf_flush_icache(ctx->image, ctx->image + ctx->idx); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1706 2a5ab77af7f94d Xu Kuohai 2024-04-13 1707 kfree(branches); 2a5ab77af7f94d Xu Kuohai 2024-04-13 1708 2a5ab77af7f94d Xu Kuohai 2024-04-13 1709 return ctx->idx; 2a5ab77af7f94d Xu Kuohai 2024-04-13 1710 } 2a5ab77af7f94d Xu Kuohai 2024-04-13 1711 :::::: The code at line 1647 was first introduced by commit :::::: 2a5ab77af7f94dc99ac894566927f4f934ed675b bpf, arm64: Add bpf trampoline for arm64 :::::: TO: Xu Kuohai <xukuohai(a)huawei.com> :::::: CC: Pu Lehui <pulehui(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] irqchip/gic-v3: Fix xint sleeping function called from invalid context
by Jinjie Ruan 11 Jun '25

11 Jun '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICEDX1 ------------------ disable_irq() and debugfs_create_symlink() might sleep, local_irq_disable() will mask IRQS on current PE. Because sleep is not allowed when interrupts are disabled, the following bug occurs. So move them out of local_irq_disable/enable() to fix it. BUG: sleeping function called from invalid context at kernel/irq/manage.c:737 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 1033, name: bash preempt_count: 0, expected: 0 CPU: 1 PID: 1033 Comm: bash Not tainted 6.6.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0xf8/0x290 show_stack+0x3c/0x70 dump_stack_lvl+0x1a8/0x2e8 dump_stack+0x34/0x50 __might_resched+0x31c/0x5f8 __might_sleep+0xc8/0x1d8 disable_irq+0x48/0xb8 xint_proc_write+0x1b0/0x3f8 proc_reg_write+0x218/0x348 vfs_write+0x244/0xfd0 ksys_write+0x11c/0x290 __arm64_sys_write+0x8c/0xd8 invoke_syscall+0xb4/0x300 el0_svc_common.constprop.0+0x1f8/0x310 do_el0_svc+0x5c/0x88 el0_svc+0x44/0x200 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x3b8/0x3c0 BUG: sleeping function called from invalid context at mm/slab.h:494 in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 414, name: bash CPU: 0 PID: 414 Comm: bash Tainted: G W 5.10.0-00033-gee505d161ada #4 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x430 show_stack+0x34/0x4c dump_stack+0x1d0/0x248 ___might_sleep+0x15c/0x1bc __might_sleep+0x7c/0x114 __kmalloc_track_caller+0x198/0x87c kstrdup+0x134/0x1d0 debugfs_create_symlink+0x3c/0x250 xint_add_debugfs_entry+0xd4/0x140 xint_transform+0x1f4/0x210 xint_proc_write+0x26c/0x344 proc_reg_write+0x184/0x210 vfs_write+0x17c/0x634 ksys_write+0x104/0x230 __arm64_sys_write+0x54/0x80 invoke_syscall+0x84/0x230 el0_xcall_common.constprop.0+0x1ec/0x204 do_el0_xcall+0x98/0x18c el0_xcall_handler+0x24/0x3c el0_sync+0x17c/0x194 Fixes: 63f9ef213a47 ("arm64: Add debugfs dir for xint") Fixes: 3053668e6b21 ("arm64: Introduce Xint software solution") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/irqchip/irq-gic-v3.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c index 9d2a5cc50c33..4805b3280acc 100644 --- a/drivers/irqchip/irq-gic-v3.c +++ b/drivers/irqchip/irq-gic-v3.c @@ -1030,11 +1030,9 @@ static bool xint_transform(int irqno, enum xint_op op) switch (op) { case IRQ_TO_XINT: set_bit(hwirq, irqnr_xint_map); - xint_add_debugfs_entry(irqno); return true; case XINT_TO_IRQ: clear_bit(hwirq, irqnr_xint_map); - xint_remove_debugfs_entry(irqno); return false; case XINT_SET_CHECK: return test_bit(hwirq, irqnr_xint_map); @@ -1049,6 +1047,7 @@ static ssize_t xint_proc_write(struct file *file, const char __user *buffer, size_t count, loff_t *pos) { int irq = (int)(long)pde_data(file_inode(file)); + enum xint_op switch_type; bool xint_state = false; unsigned long val; char *buf = NULL; @@ -1071,13 +1070,21 @@ static ssize_t xint_proc_write(struct file *file, return -EBUSY; } - local_irq_disable(); + if (xint_state) { + switch_type = XINT_TO_IRQ; + xint_remove_debugfs_entry(irq); + } else { + switch_type = IRQ_TO_XINT; + xint_add_debugfs_entry(irq); + } + disable_irq(irq); + local_irq_disable(); - xint_transform(irq, xint_state ? XINT_TO_IRQ : IRQ_TO_XINT); + xint_transform(irq, switch_type); - enable_irq(irq); local_irq_enable(); + enable_irq(irq); kfree(buf); -- 2.34.1

2 1

[openeuler:OLK-5.10 2954/2954] arch/arm64/net/bpf_jit_comp.c:1514:29: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 11 Jun '25

11 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 90ff3e07cc268a8e40bd578dcc4907a3db419c52 commit: 2a5ab77af7f94dc99ac894566927f4f934ed675b [2954/2954] bpf, arm64: Add bpf trampoline for arm64 config: arm64-randconfig-r133-20250610 (https://download.01.org/0day-ci/archive/20250611/202506111719.ynqhjFZY-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 reproduce: (https://download.01.org/0day-ci/archive/20250611/202506111719.ynqhjFZY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506111719.ynqhjFZY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/arm64/net/bpf_jit_comp.c:1514:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] * @@ got restricted __le32 [usertype] * @@ arch/arm64/net/bpf_jit_comp.c:1514:29: sparse: expected unsigned int [usertype] * arch/arm64/net/bpf_jit_comp.c:1514:29: sparse: got restricted __le32 [usertype] * arch/arm64/net/bpf_jit_comp.c:1663:52: sparse: sparse: subtraction of different types can't work (different base types) vim +1514 arch/arm64/net/bpf_jit_comp.c 1495 1496 static void invoke_bpf_mod_ret(struct jit_ctx *ctx, struct bpf_tramp_progs *tp, 1497 int args_off, int retval_off, u32 **branches) 1498 { 1499 int i; 1500 1501 /* The first fmod_ret program will receive a garbage return value. 1502 * Set this to 0 to avoid confusing the program. 1503 */ 1504 emit(A64_STR64I(A64_ZR, A64_SP, retval_off), ctx); 1505 for (i = 0; i < tp->nr_progs; i++) { 1506 invoke_bpf_prog(ctx, tp->progs[i], args_off, retval_off, true); 1507 /* if (*(u64 *)(sp + retval_off) != 0) 1508 * goto do_fexit; 1509 */ 1510 emit(A64_LDR64I(A64_R(10), A64_SP, retval_off), ctx); 1511 /* Save the location of branch, and generate a nop. 1512 * This nop will be replaced with a cbnz later. 1513 */ > 1514 branches[i] = ctx->image + ctx->idx; 1515 emit(A64_NOP, ctx); 1516 } 1517 } 1518 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] mm: slub: add __GFP_NOWARN when allocations with GFP_NOWAIT
by Nanyong Sun 11 Jun '25

11 Jun '25

From: Kaixiong Yu <yukaixiong(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICAVPP -------------------------------- GFP_NOWAIT callers are always prepared for their allocations to fail because they fail so frequently. In such case, don't need to generate a warning. So, add __GFP_NOWARN to flag when allocations. Fixes: 76e3125423ba ("mm/slub: Reduce memory consumption in extreme scenarios") Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/slub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/slub.c b/mm/slub.c index d4e7e88df7ff..bcc00a95c368 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -2782,7 +2782,7 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, */ if (unlikely(node != NUMA_NO_NODE && !(gfpflags & __GFP_THISNODE) && try_thisnode)) - pc_gfpflags = GFP_NOWAIT | __GFP_THISNODE; + pc_gfpflags = GFP_NOWAIT | __GFP_THISNODE | __GFP_NOWARN; freelist = new_slab_objects(s, pc_gfpflags, node, &c); -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
by Nanyong Sun 11 Jun '25

11 Jun '25

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.1.129 commit d817e510662fd1c9797952408d94806f97a5fffd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED7 CVE: CVE-2024-58083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e7381f3617d14b3c11da80ff5f8a93ab14cfc46 upstream. Explicitly verify the target vCPU is fully online _prior_ to clamping the index in kvm_get_vcpu(). If the index is "bad", the nospec clamping will generate '0', i.e. KVM will return vCPU0 instead of NULL. In practice, the bug is unlikely to cause problems, as it will only come into play if userspace or the guest is buggy or misbehaving, e.g. KVM may send interrupts to vCPU0 instead of dropping them on the floor. However, returning vCPU0 when it shouldn't exist per online_vcpus is problematic now that KVM uses an xarray for the vCPUs array, as KVM needs to insert into the xarray before publishing the vCPU to userspace (see commit c5b077549136 ("KVM: Convert the kvm->vcpus array to a xarray")), i.e. before vCPU creation is guaranteed to succeed. As a result, incorrectly providing access to vCPU0 will trigger a use-after-free if vCPU0 is dereferenced and kvm_vm_ioctl_create_vcpu() bails out of vCPU creation due to an error and frees vCPU0. Commit afb2acb2e3a3 ("KVM: Fix vcpu_array[0] races") papered over that issue, but in doing so introduced an unsolvable teardown conundrum. Preventing accesses to vCPU0 before it's fully online will allow reverting commit afb2acb2e3a3, without re-introducing the vcpu_array[0] UAF race. Fixes: 1d487e9bf8ba ("KVM: fix spectrev1 gadgets") Cc: stable(a)vger.kernel.org Cc: Will Deacon <will(a)kernel.org> Cc: Michal Luczaj <mhal(a)rbox.co> Reviewed-by: Pankaj Gupta <pankaj.gupta(a)amd.com> Acked-by: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20241009150455.1057573-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- include/linux/kvm_host.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index b8ae37549e2a..0bbfd625dd6c 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -670,6 +670,15 @@ static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx) static inline struct kvm_vcpu *kvm_get_vcpu(struct kvm *kvm, int i) { int num_vcpus = atomic_read(&kvm->online_vcpus); + + /* + * Explicitly verify the target vCPU is online, as the anti-speculation + * logic only limits the CPU's ability to speculate, e.g. given a "bad" + * index, clamping the index to 0 would return vCPU0, not NULL. + */ + if (i >= num_vcpus) + return NULL; + i = array_index_nospec(i, num_vcpus); /* Pairs with smp_wmb() in kvm_vm_ioctl_create_vcpu. */ -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2023-53039
by Xiaomeng Zhang 11 Jun '25

11 Jun '25

Reka Norman (1): HID: intel-ish-hid: ipc: Fix potential use-after-free in work function Zhang Lixu (1): HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc drivers/hid/intel-ish-hid/ipc/ipc.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] cifs: fix mount deadlock by avoiding super block iteration in DFS reconnect
by Wang Zhaolong 11 Jun '25

11 Jun '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICE4PV CVE: NA -------------------------------- A deadlock issue occurs when network interruption during mount triggers DFS reconnection logic that calls iterate_supers_type(). The detailed call process is as follows: mount.cifs cifsd path_mount do_new_mount vfs_get_tree legacy_get_tree cifs_smb3_do_mount sget alloc_super down_write_nested(&s->s_umount, ..); // hold lock cifs_read_super cifs_root_iget cifs_get_inode_info smb2_query_path_info smb2_compound_op compound_send_recv wait_for_response // wait for cifsd to wake it up cifs_demultiplex_thread cifs_read_from_socket cifs_readv_from_socket server_unresponsive cifs_reconnect cifs_get_tcp_super __cifs_get_super iterate_supers_type down_read(&sb->s_umount); // block mid->callback() cifs_wake_up_task wake_up_process // won't be executed do_new_mount_fc up_write(&sb->s_umount); // release lock here This patch fixes the problem by doing the following: - Add vfs_sb back-pointer to cifs_sb_info for direct access - Protect list traversal with existing tcon->sb_list_lock - Use atomic operations to safely manage super block references - Remove complex callback-based iteration in favor of simple loop Fixes: 93d5cb517db3 ("cifs: Add support for failover in cifs_reconnect()") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/cifs_fs_sb.h | 1 + fs/cifs/cifsfs.c | 1 + fs/cifs/connect.c | 10 ++-- fs/cifs/misc.c | 121 +++++++++++++++++++++---------------------- 4 files changed, 66 insertions(+), 67 deletions(-) diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h index d14002d67b6a..d180ef3f9d89 100644 --- a/fs/cifs/cifs_fs_sb.h +++ b/fs/cifs/cifs_fs_sb.h @@ -58,10 +58,11 @@ struct cifs_sb_info { struct rb_root tlink_tree; struct list_head tcon_sb_link; spinlock_t tlink_tree_lock; + struct super_block *vfs_sb; struct tcon_link *master_tlink; struct nls_table *local_nls; unsigned int bsize; unsigned int rsize; unsigned int wsize; diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c index dac20bbc2786..a86a1fb34e59 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -778,10 +778,11 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb) static int cifs_set_super(struct super_block *sb, void *data) { struct cifs_mnt_data *mnt_data = data; sb->s_fs_info = mnt_data->cifs_sb; + mnt_data->cifs_sb->vfs_sb = sb; return set_anon_super(sb, NULL); } static struct dentry * cifs_smb3_do_mount(struct file_system_type *fs_type, diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 56afed6d9ef8..23798ab5d5f1 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -405,16 +405,11 @@ cifs_reconnect(struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); server->nr_targets = 1; #ifdef CONFIG_CIFS_DFS_UPCALL spin_unlock(&GlobalMid_Lock); sb = cifs_get_tcp_super(server); - if (IS_ERR(sb)) { - rc = PTR_ERR(sb); - cifs_dbg(FYI, "%s: will not do DFS failover: rc = %d\n", - __func__, rc); - sb = NULL; - } else { + if (sb) { cifs_sb = CIFS_SB(sb); rc = reconn_setup_dfs_targets(cifs_sb, &tgt_list); if (rc) { cifs_sb = NULL; if (rc != -EOPNOTSUPP) { @@ -422,10 +417,13 @@ cifs_reconnect(struct TCP_Server_Info *server) __func__); } } else { server->nr_targets = dfs_cache_get_nr_tgts(&tgt_list); } + } else { + cifs_dbg(FYI, "%s: will not do DFS failover\n", __func__); + rc = -EINVAL; } cifs_dbg(FYI, "%s: will retry %d target(s)\n", __func__, server->nr_targets); spin_lock(&GlobalMid_Lock); #endif diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c index 12131a5d5073..2b52750acc07 100644 --- a/fs/cifs/misc.c +++ b/fs/cifs/misc.c @@ -1034,66 +1034,52 @@ int copy_path_name(char *dst, const char *src) struct super_cb_data { void *data; struct super_block *sb; }; -static void tcp_super_cb(struct super_block *sb, void *arg) +struct super_block *cifs_get_tcp_super(struct TCP_Server_Info *server) { - struct super_cb_data *sd = arg; - struct TCP_Server_Info *server = sd->data; - struct cifs_sb_info *cifs_sb; + struct super_block *sb; + struct cifs_ses *ses; struct cifs_tcon *tcon; + struct cifs_sb_info *cifs_sb; - if (sd->sb) - return; - - cifs_sb = CIFS_SB(sb); - tcon = cifs_sb_master_tcon(cifs_sb); - if (tcon->ses->server == server) - sd->sb = sb; -} + if (!server) + return NULL; -static struct super_block *__cifs_get_super(void (*f)(struct super_block *, void *), - void *data) -{ - struct super_cb_data sd = { - .data = data, - .sb = NULL, - }; - struct file_system_type **fs_type = (struct file_system_type *[]) { - &cifs_fs_type, &smb3_fs_type, NULL, - }; - - for (; *fs_type; fs_type++) { - iterate_supers_type(*fs_type, f, &sd); - if (sd.sb) { - /* - * Grab an active reference in order to prevent automounts (DFS links) - * of expiring and then freeing up our cifs superblock pointer while - * we're doing failover. - */ - cifs_sb_active(sd.sb); - return sd.sb; + spin_lock(&cifs_tcp_ses_lock); + list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { + list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { + spin_lock(&tcon->sb_list_lock); + list_for_each_entry(cifs_sb, &tcon->cifs_sb_list, tcon_sb_link) { + sb = cifs_sb->vfs_sb; + + /* Safely increment s_active only if it's not zero. + * + * When s_active == 0, the super block is being deactivated + * and should not be used. This prevents UAF scenarios + * where we might grab a reference to a super block that's + * in the middle of destruction. + */ + if (!atomic_add_unless(&sb->s_active, 1, 0)) + continue; + spin_unlock(&tcon->sb_list_lock); + spin_unlock(&cifs_tcp_ses_lock); + return sb; + } + spin_unlock(&tcon->sb_list_lock); } } - return ERR_PTR(-EINVAL); -} - -static void __cifs_put_super(struct super_block *sb) -{ - if (!IS_ERR_OR_NULL(sb)) - cifs_sb_deactive(sb); -} + spin_unlock(&cifs_tcp_ses_lock); -struct super_block *cifs_get_tcp_super(struct TCP_Server_Info *server) -{ - return __cifs_get_super(tcp_super_cb, server); + return NULL; } void cifs_put_tcp_super(struct super_block *sb) { - __cifs_put_super(sb); + if (!IS_ERR_OR_NULL(sb)) + cifs_sb_deactive(sb); } #ifdef CONFIG_CIFS_DFS_UPCALL int match_target_ip(struct TCP_Server_Info *server, const char *share, size_t share_len, @@ -1138,33 +1124,46 @@ int match_target_ip(struct TCP_Server_Info *server, kfree(tip); return rc; } -static void tcon_super_cb(struct super_block *sb, void *arg) +static inline struct super_block *cifs_get_tcon_super(struct cifs_tcon *tcon) { - struct super_cb_data *sd = arg; - struct cifs_tcon *tcon = sd->data; struct cifs_sb_info *cifs_sb; + struct super_block *sb = ERR_PTR(-EINVAL); + + if (!tcon && list_empty(&tcon->cifs_sb_list)) + return sb; + + spin_lock(&tcon->sb_list_lock); + list_for_each_entry(cifs_sb, &tcon->cifs_sb_list, tcon_sb_link) { + sb = cifs_sb->vfs_sb; + + if (!tcon->dfs_path) + continue; + if (!cifs_sb->origin_fullpath) + continue; + if (strcasecmp(tcon->dfs_path, cifs_sb->origin_fullpath)) + continue; + /* + * Use atomic_add_unless to safely increment s_active. + * This ensures we don't add a reference to a super block + * that has s_active == 0 (being destroyed). + */ + if (!atomic_add_unless(&sb->s_active, 1, 0)) + continue; + break; + } + spin_unlock(&tcon->sb_list_lock); - if (sd->sb) - return; - - cifs_sb = CIFS_SB(sb); - if (tcon->dfs_path && cifs_sb->origin_fullpath && - !strcasecmp(tcon->dfs_path, cifs_sb->origin_fullpath)) - sd->sb = sb; -} - -static inline struct super_block *cifs_get_tcon_super(struct cifs_tcon *tcon) -{ - return __cifs_get_super(tcon_super_cb, tcon); + return sb; } static inline void cifs_put_tcon_super(struct super_block *sb) { - __cifs_put_super(sb); + if (!IS_ERR_OR_NULL(sb)) + cifs_sb_deactive(sb); } #else static inline struct super_block *cifs_get_tcon_super(struct cifs_tcon *tcon) { return ERR_PTR(-EOPNOTSUPP); -- 2.34.3

2 1

[PATCH OLK-5.10 0/2] CVE-2023-53039
by Xiaomeng Zhang 11 Jun '25

11 Jun '25

Reka Norman (1): HID: intel-ish-hid: ipc: Fix potential use-after-free in work function Zhang Lixu (1): HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc drivers/hid/intel-ish-hid/ipc/ipc.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 v8 00/12] arm64: Support xcall prefetch
by Jinjie Ruan 11 Jun '25

11 Jun '25

Support xcall prefetch. Changes in v8: - Support xcall prefetch on and off runtime. - Refactor the xcall proc interface code, move to /fs/proc/proc_xcall.c. - Fix xint irqnr_xint_map array out of bounds access problem in __handle_domain_irq() by introducing is_hwirq_xint() helper. - Introduce system_supports_xint() and system_supports_xcall() to reduce the overhead, and remove fast_syscall_enabeld(), remove extern is_xint_support. - Limit the task xinfo alloc and xcall prefetch init by system_supports_xcall() to reduce the overhead. Changes in v7: - Remove "echo @xxx > /proc/$PID/xcall" usage, replace with "echo 1 > /proc/$PID/prefetch". Now the xcall enable and prefetch can be enabled separately. Changes in v6: - Only use one reserved kabi in task_struct for xcall. - Free prefetch item after eventpoll_release_file() to avoid possible competition between ep_prefetch_item_enqueue() and pfi free. - Fix "echo > /proc/xcall/cpu_list" show problem. Changes in v5: - Fix dentry free before free_prefetch_item() and then UAF in prefetch work by cancel_work_sync() before free pfi and move free_prefetch_item() to the first of __fput(). - Fix __queue_work() oops bug. - /proc/xcall/mask_list -> /proc/xcall/cpu_list - Fix xcall_prefetch print data type. - Update prefetch tracepoint, move xcall points definition to separete header file. - Make xcall_prefetch depends on EPOLL. - Adjust xcall prefetch buf to 16KB by default. - Add xcall_prefetch_init() function. - Only use write lock in free_prefetch_item(). - Simplify xcall_read() and add some comment. - Update commit message. Changes in v4: - Enable FAST_SYSCALL/IRQ and XCALL_PREFETCH by default. - Fix xint sleeping function called from invalid context bug. - free_prefetch_item() in file_free() instead of filp_close(), which fix the alloc-queue and free competition. - Fix kernel_read() warning for FMODE_READ not set. - Add sock_from_file() limit for prefetch. - Check NULL for rc_work. - Simplfy the cpumask interface code, and rename to "/proc/xcall/mask_list". - Remove the xcall_cache_pages_order interface. - tracepoint update: fd -> file. - Simplify the xcall_read() function again. - Handle copy_to_user() return value. - Remove unused XCALL_CACHE_QUEUED. - Update the commit message. Changes in v3: - Add XCALL_PREFETCH config to isolate feature code. - Split the /proc/xxx interface code out to independent patches, which will make it clear. - Update the cpumask interface to "/proc/xcall/numa_mask", and it can set the numa mask of all numas one time. - Add xcall select count to make xcall_cache_pages_order adjust safe. - Introduce xcall_read_start/end() to make it clear. - Simplify the xcall_read() function. - Use cpumask_next() instead of get_nth_cpu_in_cpumask() function. - Use independent cpu select policy function. - Remove some unnecessary pr_err(). - Update the commit message. Changes in v2: - Upadte the xcall prefetch state machine, remove the queued state and add prefetch, cancel states. - Remove the pfi lock and use atomic variables. - Change the 'xcall select' semantics and simplify the code a lot. - Remove keep_running, remove unrelated code. - Remove the count in struct read_cache_entry, and use percpu hit/miss count. - Remove sync mode, so remove struct read_cache_entry in struct task_struct. - Use hash table to find prefetch item for a file, which will not change the file struct KABI. - Use rwlock instead of spinlock for hash table. - Use alloc_page() instead kmalloc() to align 4KB. - Update the commit message. Jinjie Ruan (9): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint arm64: Reserve a kabi in task_struct exclusively for xcall arm64: Introduce xcall prefetch enable interface eventpoll: Support xcall async prefetch eventpoll: Add /proc/xcall/prefetch dir for performance tuning eventpoll: Add /proc/xcall/cpu_list for performance tuning xcall: Add tracepoints for different prefetching stages config: Enable FAST_SYSCALL/IRQ and XCALL_PREFETCH by default Liao Chen (1): arm64: revert kpti bypass Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 81 +++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 7 + arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/cpufeature.h | 12 + arch/arm64/include/asm/exception.h | 3 + arch/arm64/include/asm/xcall.h | 18 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 49 +++ arch/arm64/kernel/entry-common.c | 22 ++ arch/arm64/kernel/entry.S | 183 ++++++++++- arch/arm64/kernel/syscall.c | 57 ++++ arch/arm64/kernel/xcall.c | 38 +++ drivers/irqchip/irq-gic-v3.c | 145 +++++++++ fs/eventpoll.c | 412 +++++++++++++++++++++++++ fs/file_table.c | 1 + fs/proc/Makefile | 1 + fs/proc/base.c | 6 + fs/proc/internal.h | 7 + fs/proc/proc_xcall.c | 181 +++++++++++ fs/read_write.c | 10 +- include/linux/fs.h | 35 +++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 12 + include/linux/sched.h | 4 + include/trace/events/xcall.h | 106 +++++++ kernel/fork.c | 19 ++ kernel/irq/debugfs.c | 36 +++ kernel/irq/internals.h | 16 + kernel/irq/irqdesc.c | 19 ++ kernel/irq/proc.c | 10 + kernel/softirq.c | 73 +++++ 33 files changed, 1573 insertions(+), 3 deletions(-) create mode 100644 arch/arm64/include/asm/xcall.h create mode 100644 arch/arm64/kernel/xcall.c create mode 100644 fs/proc/proc_xcall.c create mode 100644 include/trace/events/xcall.h -- 2.34.1

2 13

[PATCH OLK-5.10] HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
by Xiaomeng Zhang 11 Jun '25

11 Jun '25

From: Reka Norman <rekanorman(a)chromium.org> mainline inclusion from mainline-v6.3-rc2 commit 8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5DGB CVE: CVE-2023-53039 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a reset notify IPC message is received, the ISR schedules a work function and passes the ISHTP device to it via a global pointer ishtp_dev. If ish_probe() fails, the devm-managed device resources including ishtp_dev are freed, but the work is not cancelled, causing a use-after-free when the work function tries to access ishtp_dev. Use devm_work_autocancel() instead, so that the work is automatically cancelled if probe fails. Signed-off-by: Reka Norman <rekanorman(a)chromium.org> Acked-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/hid/intel-ish-hid/ipc/ipc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c index a45ac7fa417b..b950873c300b 100644 --- a/drivers/hid/intel-ish-hid/ipc/ipc.c +++ b/drivers/hid/intel-ish-hid/ipc/ipc.c @@ -5,6 +5,7 @@ * Copyright (c) 2014-2016, Intel Corporation. */ +#include <linux/devm-helpers.h> #include <linux/sched.h> #include <linux/spinlock.h> #include <linux/delay.h> @@ -594,7 +595,6 @@ static void recv_ipc(struct ishtp_device *dev, uint32_t doorbell_val) case MNG_RESET_NOTIFY: if (!ishtp_dev) { ishtp_dev = dev; - INIT_WORK(&fw_reset_work, fw_reset_work_fn); } schedule_work(&fw_reset_work); break; @@ -885,6 +885,7 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev) { struct ishtp_device *dev; int i; + int ret; dev = devm_kzalloc(&pdev->dev, sizeof(struct ishtp_device) + sizeof(struct ish_hw), @@ -920,6 +921,12 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev) list_add_tail(&tx_buf->link, &dev->wr_free_list); } + ret = devm_work_autocancel(&pdev->dev, &fw_reset_work, fw_reset_work_fn); + if (ret) { + dev_err(dev->devc, "Failed to initialise FW reset work\n"); + return NULL; + } + dev->ops = &ish_hw_ops; dev->devc = &pdev->dev; dev->mtu = IPC_PAYLOAD_SIZE - sizeof(struct ishtp_msg_hdr); -- 2.34.1

2 1