- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] arm64: uaccess: avoid blocking within critical sections
by Yuntao Liu 12 Jun '25

12 Jun '25

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.16-rc3 commit 94902d849e85093aafcdbea2be8e2beff47233e6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICERQ4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 94902d849e85093aafcdbea2be8e2beff47233e6 ] As Vincent reports in: https://lore.kernel.org/r/20211118163417.21617-1-vincent.whitchurch@axis.com The put_user() in schedule_tail() can get stuck in a livelock, similar to a problem recently fixed on riscv in commit: 285a76bb2cf51b0c ("riscv: evaluate put_user() arg before enabling user access") In __raw_put_user() we have a critical section between uaccess_ttbr0_enable() and uaccess_ttbr0_disable() where we cannot safely call into the scheduler without having taken an exception, as schedule() and other scheduling functions will not save/restore the TTBR0 state. If either of the `x` or `ptr` arguments to __raw_put_user() contain a blocking call, we may call into the scheduler within the critical section. This can result in two problems: 1) The access within the critical section will occur without the required TTBR0 tables installed. This will fault, and where the required tables permit access, the access will be retried without the required tables, resulting in a livelock. 2) When TTBR0 SW PAN is in use, check_and_switch_context() does not modify TTBR0, leaving a stale value installed. The mappings of the blocked task will erroneously be accessible to regular accesses in the context of the new task. Additionally, if the tables are subsequently freed, local TLB maintenance required to reuse the ASID may be lost, potentially resulting in TLB corruption (e.g. in the presence of CnP). The same issue exists for __raw_get_user() in the critical section between uaccess_ttbr0_enable() and uaccess_ttbr0_disable(). A similar issue exists for __get_kernel_nofault() and __put_kernel_nofault() for the critical section between __uaccess_enable_tco_async() and __uaccess_disable_tco_async(), as the TCO state is not context-switched by direct calls into the scheduler. Here the TCO state may be lost from the context of the current task, resulting in unexpected asynchronous tag check faults. It may also be leaked to another task, suppressing expected tag check faults. To fix all of these cases, we must ensure that we do not directly call into the scheduler in their respective critical sections. This patch reworks __raw_put_user(), __raw_get_user(), __get_kernel_nofault(), and __put_kernel_nofault(), ensuring that parameters are evaluated outside of the critical sections. To make this requirement clear, comments are added describing the problem, and line spaces added to separate the critical sections from other portions of the macros. For __raw_get_user() and __raw_put_user() the `err` parameter is conditionally assigned to, and we must currently evaluate this in the critical section. This behaviour is relied upon by the signal code, which uses chains of put_user_error() and get_user_error(), checking the return value at the end. In all cases, the `err` parameter is a plain int rather than a more complex expression with a blocking call, so this is safe. In future we should try to clean up the `err` usage to remove the potential for this to be a problem. Aside from the changes to time of evaluation, there should be no functional change as a result of this patch. Reported-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com> Link: https://lore.kernel.org/r/20211118163417.21617-1-vincent.whitchurch@axis.com Fixes: f253d827f33c ("arm64: uaccess: refactor __{get,put}_user") Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Link: https://lore.kernel.org/r/20211122125820.55286-1-mark.rutland@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/arm64/include/asm/uaccess.h [adjust context] Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- arch/arm64/include/asm/uaccess.h | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h index 635436bd8712..03c2db710f92 100644 --- a/arch/arm64/include/asm/uaccess.h +++ b/arch/arm64/include/asm/uaccess.h @@ -256,12 +256,22 @@ do { \ (x) = (__force __typeof__(*(ptr)))__gu_val; \ } while (0) +/* + * We must not call into the scheduler between uaccess_ttbr0_enable() and + * uaccess_ttbr0_disable(). As `x` and `ptr` could contain blocking functions, + * we must evaluate these outside of the critical section. + */ #define __raw_get_user(x, ptr, err) \ do { \ + __typeof__(*(ptr)) __user *__rgu_ptr = (ptr); \ + __typeof__(x) __rgu_val; \ __chk_user_ptr(ptr); \ + \ uaccess_ttbr0_enable(); \ - __raw_get_mem("ldtr", x, ptr, err, U); \ + __raw_get_mem("ldtr", __rgu_val, __rgu_ptr, err, U); \ uaccess_ttbr0_disable(); \ + \ + (x) = __rgu_val; \ } while (0) #define __get_user_error(x, ptr, err) \ @@ -329,11 +339,19 @@ do { \ } \ } while (0) +/* + * We must not call into the scheduler between uaccess_ttbr0_enable() and + * uaccess_ttbr0_disable(). As `x` and `ptr` could contain blocking functions, + * we must evaluate these outside of the critical section. + */ #define __raw_put_user(x, ptr, err) \ do { \ - __chk_user_ptr(ptr); \ + __typeof__(*(ptr)) __user *__rpu_ptr = (ptr); \ + __typeof__(*(ptr)) __rpu_val = (x); \ + __chk_user_ptr(__rpu_ptr); \ + \ uaccess_ttbr0_enable(); \ - __raw_put_mem("sttr", x, ptr, err, U); \ + __raw_put_mem("sttr", __rpu_val, __rpu_ptr, err, U); \ uaccess_ttbr0_disable(); \ } while (0) -- 2.34.1

2 1

[PATCH OLK-5.10] arm64: uaccess: avoid blocking within critical sections
by Yuntao Liu 12 Jun '25

12 Jun '25

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v5.16-rc3 commit 94902d849e85093aafcdbea2be8e2beff47233e6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICERQ4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 94902d849e85093aafcdbea2be8e2beff47233e6 ] As Vincent reports in: https://lore.kernel.org/r/20211118163417.21617-1-vincent.whitchurch@axis.com The put_user() in schedule_tail() can get stuck in a livelock, similar to a problem recently fixed on riscv in commit: 285a76bb2cf51b0c ("riscv: evaluate put_user() arg before enabling user access") In __raw_put_user() we have a critical section between uaccess_ttbr0_enable() and uaccess_ttbr0_disable() where we cannot safely call into the scheduler without having taken an exception, as schedule() and other scheduling functions will not save/restore the TTBR0 state. If either of the `x` or `ptr` arguments to __raw_put_user() contain a blocking call, we may call into the scheduler within the critical section. This can result in two problems: 1) The access within the critical section will occur without the required TTBR0 tables installed. This will fault, and where the required tables permit access, the access will be retried without the required tables, resulting in a livelock. 2) When TTBR0 SW PAN is in use, check_and_switch_context() does not modify TTBR0, leaving a stale value installed. The mappings of the blocked task will erroneously be accessible to regular accesses in the context of the new task. Additionally, if the tables are subsequently freed, local TLB maintenance required to reuse the ASID may be lost, potentially resulting in TLB corruption (e.g. in the presence of CnP). The same issue exists for __raw_get_user() in the critical section between uaccess_ttbr0_enable() and uaccess_ttbr0_disable(). A similar issue exists for __get_kernel_nofault() and __put_kernel_nofault() for the critical section between __uaccess_enable_tco_async() and __uaccess_disable_tco_async(), as the TCO state is not context-switched by direct calls into the scheduler. Here the TCO state may be lost from the context of the current task, resulting in unexpected asynchronous tag check faults. It may also be leaked to another task, suppressing expected tag check faults. To fix all of these cases, we must ensure that we do not directly call into the scheduler in their respective critical sections. This patch reworks __raw_put_user(), __raw_get_user(), __get_kernel_nofault(), and __put_kernel_nofault(), ensuring that parameters are evaluated outside of the critical sections. To make this requirement clear, comments are added describing the problem, and line spaces added to separate the critical sections from other portions of the macros. For __raw_get_user() and __raw_put_user() the `err` parameter is conditionally assigned to, and we must currently evaluate this in the critical section. This behaviour is relied upon by the signal code, which uses chains of put_user_error() and get_user_error(), checking the return value at the end. In all cases, the `err` parameter is a plain int rather than a more complex expression with a blocking call, so this is safe. In future we should try to clean up the `err` usage to remove the potential for this to be a problem. Aside from the changes to time of evaluation, there should be no functional change as a result of this patch. Reported-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com> Link: https://lore.kernel.org/r/20211118163417.21617-1-vincent.whitchurch@axis.com Fixes: f253d827f33c ("arm64: uaccess: refactor __{get,put}_user") Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Link: https://lore.kernel.org/r/20211122125820.55286-1-mark.rutland@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/arm64/include/asm/uaccess.h [adjust context] Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- arch/arm64/include/asm/uaccess.h | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h index 635436bd8712..ec7ca14adb91 100644 --- a/arch/arm64/include/asm/uaccess.h +++ b/arch/arm64/include/asm/uaccess.h @@ -256,12 +256,22 @@ do { \ (x) = (__force __typeof__(*(ptr)))__gu_val; \ } while (0) +/* + * We must not call into the scheduler between uaccess_ttbr0_enable() and + * uaccess_ttbr0_disable(). As `x` and `ptr` could contain blocking functions, + * we must evaluate these outside of the critical section. + */ #define __raw_get_user(x, ptr, err) \ do { \ + __typeof__(*(ptr)) __user *__rgu_ptr = (ptr); \ + __typeof__(x) __rgu_val; \ __chk_user_ptr(ptr); \ + uaccess_ttbr0_enable(); \ - __raw_get_mem("ldtr", x, ptr, err, U); \ + __raw_get_mem("ldtr", __rgu_val, __rgu_ptr, err, U); \ uaccess_ttbr0_disable(); \ + \ + (x) = __rgu_val; \ } while (0) #define __get_user_error(x, ptr, err) \ @@ -329,11 +339,19 @@ do { \ } \ } while (0) +/* + * We must not call into the scheduler between uaccess_ttbr0_enable() and + * uaccess_ttbr0_disable(). As `x` and `ptr` could contain blocking functions, + * we must evaluate these outside of the critical section. + */ #define __raw_put_user(x, ptr, err) \ do { \ - __chk_user_ptr(ptr); \ + __typeof__(*(ptr)) __user *__rpu_ptr = (ptr); \ + __typeof__(*(ptr)) __rpu_val = (x); \ + __chk_user_ptr(__rpu_ptr); \ + \ uaccess_ttbr0_enable(); \ - __raw_put_mem("sttr", x, ptr, err, U); \ + __raw_put_mem("sttr", __rpu_val, __rpu_ptr, err, U); \ uaccess_ttbr0_disable(); \ } while (0) -- 2.34.1

2 1

[PATCH OLK-6.6 v3 0/2] Rewrite smt interference account logic
by Pu Lehui 12 Jun '25

12 Jun '25

Tengda Wu (1): interference: Fix the compilation warning of sched_task_is_throttled() Xu Kuohai (1): interference: Rewrite smt interference account logic kernel/cgroup/ifs.c | 110 +++++++++++++++++++++++++++++-------------- kernel/sched/sched.h | 18 +++---- 2 files changed, 83 insertions(+), 45 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v2 0/2] Rewrite smt interference account logic
by Pu Lehui 12 Jun '25

12 Jun '25

Tengda Wu (1): interference: Fix the compilation warning of sched_task_is_throttled() Xu Kuohai (1): interference: Rewrite smt interference account logic kernel/cgroup/ifs.c | 110 +++++++++++++++++++++++++++++-------------- kernel/sched/sched.h | 18 +++---- 2 files changed, 83 insertions(+), 45 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v2 0/5] Soft domain improves and bugfixes
by Zhang Qiao 12 Jun '25

12 Jun '25

v2: - Add fixes tag v1: - Fix compilation error Zhang Qiao (5): sched: Add cmdline sched_soft_domain switch for soft domain feature sched: Rework cpu.soft_domain_nr_cpu sched: Fix soft domain group memleak sched: Consider task affinity in wake_soft_domain() sched: Fix might sleep in atomic section issue kernel/sched/core.c | 16 ++-- kernel/sched/fair.c | 63 +++++++-------- kernel/sched/sched.h | 17 +++- kernel/sched/soft_domain.c | 162 ++++++++++++++++++++++++++++++++----- 4 files changed, 199 insertions(+), 59 deletions(-) -- 2.18.0.huawei.25

2 6

[PATCH OLK-6.6 0/2] Rewrite smt interference account logic
by Pu Lehui 12 Jun '25

12 Jun '25

Tengda Wu (1): interference: Fix the compilation warning of sched_task_is_throttled() Xu Kuohai (1): interference: Rewrite smt interference account logic kernel/cgroup/ifs.c | 109 +++++++++++++++++++++++++++++-------------- kernel/sched/sched.h | 18 +++---- 2 files changed, 82 insertions(+), 45 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/4] Fix file content inconsistency issue and incorporate subsequent fix patches
by Li Lingfeng 12 Jun '25

12 Jun '25

Li Lingfeng (1): fs: add fsnotify_open in backing_file_open NeilBrown (3): NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly. NFS: abort nfs_atomic_open_v23 if name is too long. vfs: generate FS_CREATE before FS_OPEN when ->atomic_open used. fs/backing-file.c | 3 +++ fs/namei.c | 10 ++++++-- fs/nfs/dir.c | 57 +++++++++++++++++++++++++++++++++++++++--- fs/nfs/nfs3proc.c | 1 + fs/nfs/proc.c | 1 + fs/open.c | 22 ++++++++++------ include/linux/nfs_fs.h | 3 +++ 7 files changed, 85 insertions(+), 12 deletions(-) -- 2.31.1

2 5

[PATCH OLK-5.10 00/36] OLK-5.10 Bperf
by Xiaomeng Zhang 12 Jun '25

12 Jun '25

Dmitrii Dolgov (1): perf stat: Separate bperf from bpf_profiler Ian Rogers (3): perf test bpf-counters: Add test for BPF event modifier perf docs: Document bpf event modifier perf build: Properly guard libbpf includes Namhyung Kim (12): bpf: Allow bpf_get_current_ancestor_cgroup_id for tracing perf core: Factor out __perf_sw_event_sched perf core: Add PERF_COUNT_SW_CGROUP_SWITCHES event perf tools: Add 'cgroup-switches' software event perf tools: Add read_cgroup_id() function perf tools: Add cgroup_is_v2() helper perf bpf_counter: Move common functions to bpf_counter.h perf stat: Enable BPF counter with --for-each-cgroup perf stat: Fix BPF program section name perf stat: Fix handling of unsupported cgroup events when using BPF counters perf stat: Fix error check for bpf_program__attach perf test shell stat_bpf_counters: Fix test on Intel Song Liu (13): bpftool: Add Makefile target bootstrap perf build: Support build BPF skeletons with perf perf stat: Enable counting events for BPF programs perf stat: Introduce 'bperf' to share hardware PMCs with BPF perf stat: Measure 't0' and 'ref_time' after enable_counters() perf util: Move bpf_perf definitions to a libperf header perf bpf: check perf_attr_map is compatible with the perf binary perf stat: Introduce config stat.bpf-counter-events perf stat: Introduce ':b' modifier perf stat: Introduce bpf_counter_ops->disable() perf bpf: Fix building perf with BUILD_BPF_SKEL=1 by default in more distros perf bpf_skel: Do not use typedef to avoid error on old clang perf test: Add a shell test for 'perf stat --bpf-counters' new option Tengda Wu (2): perf stat: Support inherit events during fork() for bperf perf test: Use sqrtloop workload to test bperf event Veronika Molnarova (1): perf test stat_bpf_counter.sh: Stabilize the test results Xiaomeng Zhang (2): perf stat: Increase perf_attr_map entries perf stat: Fix incorrect display of bperf when event count is 0 Yonghong Song (1): bpf: Add rcu_read_lock in bpf_get_current_[ancestor_]cgroup_id() helpers Yu Kuai (1): perf stat: Fix error return code in bperf__load() include/linux/perf_event.h | 40 +- include/uapi/linux/perf_event.h | 1 + kernel/bpf/helpers.c | 22 +- kernel/trace/bpf_trace.c | 2 + tools/bpf/bpftool/Makefile | 2 + tools/build/Makefile.feature | 4 +- tools/include/uapi/linux/perf_event.h | 1 + tools/lib/perf/include/perf/bpf_perf.h | 32 + tools/perf/Documentation/perf-list.txt | 1 + tools/perf/Documentation/perf-stat.txt | 31 + tools/perf/Makefile.config | 9 + tools/perf/Makefile.perf | 65 +- tools/perf/builtin-stat.c | 110 ++- tools/perf/builtin-trace.c | 2 + tools/perf/tests/shell/stat_bpf_counters.sh | 76 ++ tools/perf/util/Build | 2 + tools/perf/util/bpf_counter.c | 833 ++++++++++++++++++ tools/perf/util/bpf_counter.h | 137 +++ tools/perf/util/bpf_counter_cgroup.c | 299 +++++++ tools/perf/util/bpf_skel/.gitignore | 3 + tools/perf/util/bpf_skel/bperf_cgroup.bpf.c | 191 ++++ tools/perf/util/bpf_skel/bperf_follower.bpf.c | 162 ++++ tools/perf/util/bpf_skel/bperf_leader.bpf.c | 55 ++ tools/perf/util/bpf_skel/bperf_u.h | 19 + .../util/bpf_skel/bpf_prog_profiler.bpf.c | 93 ++ tools/perf/util/cgroup.c | 47 + tools/perf/util/cgroup.h | 13 + tools/perf/util/config.c | 4 + tools/perf/util/evlist.c | 4 + tools/perf/util/evsel.c | 27 + tools/perf/util/evsel.h | 37 + tools/perf/util/parse-events.c | 12 +- tools/perf/util/parse-events.l | 3 +- tools/perf/util/python.c | 27 + tools/perf/util/stat-display.c | 4 +- tools/perf/util/stat.c | 2 +- tools/perf/util/target.c | 34 +- tools/perf/util/target.h | 8 + tools/scripts/Makefile.include | 1 + 39 files changed, 2364 insertions(+), 51 deletions(-) create mode 100644 tools/lib/perf/include/perf/bpf_perf.h create mode 100755 tools/perf/tests/shell/stat_bpf_counters.sh create mode 100644 tools/perf/util/bpf_counter.c create mode 100644 tools/perf/util/bpf_counter.h create mode 100644 tools/perf/util/bpf_counter_cgroup.c create mode 100644 tools/perf/util/bpf_skel/.gitignore create mode 100644 tools/perf/util/bpf_skel/bperf_cgroup.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_follower.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_leader.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_u.h create mode 100644 tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c -- 2.34.1

2 37

[PATCH OLK-6.6 v1 0/5] Soft domain improves and bugfixes
by Zhang Qiao 12 Jun '25

12 Jun '25

v1: - Fix compilation error Zhang Qiao (5): sched: Add cmdline sched_soft_domain switch for soft domain feature sched: Rework cpu.soft_domain_nr_cpu sched: Fix soft domain group memleak sched: Consider task affinity in wake_soft_domain() sched: Fix might sleep in atomic section issue kernel/sched/core.c | 16 ++-- kernel/sched/fair.c | 63 +++++++-------- kernel/sched/sched.h | 17 +++- kernel/sched/soft_domain.c | 162 ++++++++++++++++++++++++++++++++----- 4 files changed, 199 insertions(+), 59 deletions(-) -- 2.18.0.huawei.25

2 6

[PATCH OLK-5.10 0/4] CVE-2023-53039
by Xiaomeng Zhang 12 Jun '25

12 Jun '25

Matti Vaittinen (2): workqueue: Add resource managed version of delayed work init devm-helpers: Add resource managed version of work init Reka Norman (1): HID: intel-ish-hid: ipc: Fix potential use-after-free in work function Zhang Lixu (1): HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc drivers/hid/intel-ish-hid/ipc/ipc.c | 11 +++- include/linux/devm-helpers.h | 78 +++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+), 2 deletions(-) create mode 100644 include/linux/devm-helpers.h -- 2.34.1

2 5