[PATCH OLK-5.10 0/3] Fix CVE-2024-44958 for olk-5.10

Yang Yingliang (2): sched/smt: Introduce sched_smt_present_inc/dec() helper sched/smt: Fix unbalance sched_smt_present dec/inc Zheng Zucheng (1): sched: Revert fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) -- 2.34.1

hulk inclusion category: other bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYI CVE: CVE-2024-44958 -------------------------------- The solution has been fixed in the community. So revert "[Huawei] sched/smt: fix unbalance sched_smt_present dec/inc" This reverts commit 5da5a36af93b4a1ccdd62a74a124e2413f1944af. Conflicts: kernel/sched/core.c [Some contexts around sched_cpu_deactivate different. No functional impact.] Signed-off-by: Zheng Zucheng <zhengzucheng@huawei.com> --- kernel/sched/core.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 18f0dc8275d3..c4da19b0b7bf 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -8111,10 +8111,6 @@ int sched_cpu_deactivate(unsigned int cpu) ret = cpuset_cpu_inactive(cpu); if (ret) { -#ifdef CONFIG_SCHED_SMT - if (cpumask_weight(cpu_smt_mask(cpu)) == 2) - static_branch_inc_cpuslocked(&sched_smt_present); -#endif set_cpu_active(cpu, true); return ret; } -- 2.34.1

From: Yang Yingliang <yangyingliang@huawei.com> mainline inclusion from mainline-v6.11-rc1 commit 31b164e2e4af84d08d2498083676e7eeaa102493 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYI CVE: CVE-2024-44958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Introduce sched_smt_present_inc/dec() helper, so it can be called in normal or error path simply. No functional changed. Cc: stable@kernel.org Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/r/20240703031610.587047-2-yangyingliang@huaweicloud.... Conflicts: kernel/sched/core.c [Some contexts around sched_cpu_deactivate different. No functional impact.] Signed-off-by: Zheng Zucheng <zhengzucheng@huawei.com> --- kernel/sched/core.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index c4da19b0b7bf..f38916d98db1 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -8041,18 +8041,31 @@ static int cpuset_cpu_inactive(unsigned int cpu) return 0; } +static inline void sched_smt_present_inc(int cpu) +{ +#ifdef CONFIG_SCHED_SMT + if (cpumask_weight(cpu_smt_mask(cpu)) == 2) + static_branch_inc_cpuslocked(&sched_smt_present); +#endif +} + +static inline void sched_smt_present_dec(int cpu) +{ +#ifdef CONFIG_SCHED_SMT + if (cpumask_weight(cpu_smt_mask(cpu)) == 2) + static_branch_dec_cpuslocked(&sched_smt_present); +#endif +} + int sched_cpu_activate(unsigned int cpu) { struct rq *rq = cpu_rq(cpu); struct rq_flags rf; -#ifdef CONFIG_SCHED_SMT /* * When going up, increment the number of cores with SMT present. */ - if (cpumask_weight(cpu_smt_mask(cpu)) == 2) - static_branch_inc_cpuslocked(&sched_smt_present); -#endif + sched_smt_present_inc(cpu); set_cpu_active(cpu, true); #ifdef CONFIG_QOS_SCHED_SMART_GRID tg_update_affinity_domains(cpu, 1); @@ -8096,13 +8109,12 @@ int sched_cpu_deactivate(unsigned int cpu) */ synchronize_rcu(); -#ifdef CONFIG_SCHED_SMT /* * When going down, decrement the number of cores with SMT present. */ - if (cpumask_weight(cpu_smt_mask(cpu)) == 2) - static_branch_dec_cpuslocked(&sched_smt_present); + sched_smt_present_dec(cpu); +#ifdef CONFIG_SCHED_SMT sched_core_cpu_deactivate(cpu); #endif -- 2.34.1

From: Yang Yingliang <yangyingliang@huawei.com> mainline inclusion from mainline-v6.11-rc1 commit e22f910a26cc2a3ac9c66b8e935ef2a7dd881117 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYI CVE: CVE-2024-44958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- I got the following warn report while doing stress test: jump label: negative count! WARNING: CPU: 3 PID: 38 at kernel/jump_label.c:263 static_key_slow_try_dec+0x9d/0xb0 Call Trace: <TASK> __static_key_slow_dec_cpuslocked+0x16/0x70 sched_cpu_deactivate+0x26e/0x2a0 cpuhp_invoke_callback+0x3ad/0x10d0 cpuhp_thread_fun+0x3f5/0x680 smpboot_thread_fn+0x56d/0x8d0 kthread+0x309/0x400 ret_from_fork+0x41/0x70 ret_from_fork_asm+0x1b/0x30 </TASK> Because when cpuset_cpu_inactive() fails in sched_cpu_deactivate(), the cpu offline failed, but sched_smt_present is decremented before calling sched_cpu_deactivate(), it leads to unbalanced dec/inc, so fix it by incrementing sched_smt_present in the error path. Fixes: c5511d03ec09 ("sched/smt: Make sched_smt_present track topology") Cc: stable@kernel.org Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Chen Yu <yu.c.chen@intel.com> Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com> Link: https://lore.kernel.org/r/20240703031610.587047-3-yangyingliang@huaweicloud.... Conflicts: kernel/sched/core.c [Some contexts around sched_cpu_deactivate different. No functional impact.] Signed-off-by: Zheng Zucheng <zhengzucheng@huawei.com> --- kernel/sched/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index f38916d98db1..457eeebc7b62 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -8123,6 +8123,7 @@ int sched_cpu_deactivate(unsigned int cpu) ret = cpuset_cpu_inactive(cpu); if (ret) { + sched_smt_present_inc(cpu); set_cpu_active(cpu, true); return ret; } -- 2.34.1

反馈: 您发送到kernel@openeuler.org的补丁/补丁集,已成功转换为PR! PR链接地址: https://gitee.com/openeuler/kernel/pulls/12028 邮件列表地址:https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/L... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/12028 Mailing list address: https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/L...
participants (2)
-
patchwork bot
-
Zheng Zucheng