September 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v2] tracefs: Use generic inode RCU for synchronizing freeing
by Long Li 14 Sep '24

14 Sep '24

From: Steven Rostedt <rostedt(a)goodmis.org> stable inclusion from stable-v6.6.45 commit 726f4c241e17be75a9cf6870d80cd7479dc89e8f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXYV CVE: CVE-2024-44959 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 0b6743bd60a56a701070b89fb80c327a44b7b3e2 upstream. With structure layout randomization enabled for 'struct inode' we need to avoid overlapping any of the RCU-used / initialized-only-once members, e.g. i_lru or i_sb_list to not corrupt related list traversals when making use of the rcu_head. For an unlucky structure layout of 'struct inode' we may end up with the following splat when running the ftrace selftests: [<...>] list_del corruption, ffff888103ee2cb0->next (tracefs_inode_cache+0x0/0x4e0 [slab object]) is NULL (prev is tracefs_inode_cache+0x78/0x4e0 [slab object]) [<...>] ------------[ cut here ]------------ [<...>] kernel BUG at lib/list_debug.c:54! [<...>] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [<...>] CPU: 3 PID: 2550 Comm: mount Tainted: G N 6.8.12-grsec+ #122 ed2f536ca62f28b087b90e3cc906a8d25b3ddc65 [<...>] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [<...>] RIP: 0010:[<ffffffff84656018>] __list_del_entry_valid_or_report+0x138/0x3e0 [<...>] Code: 48 b8 99 fb 65 f2 ff ff ff ff e9 03 5c d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff e9 33 5a d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff <0f> 0b 4c 89 e9 48 89 ea 48 89 ee 48 c7 c7 60 8f dd 89 31 c0 e8 2f [<...>] RSP: 0018:fffffe80416afaf0 EFLAGS: 00010283 [<...>] RAX: 0000000000000098 RBX: ffff888103ee2cb0 RCX: 0000000000000000 [<...>] RDX: ffffffff84655fe8 RSI: ffffffff89dd8b60 RDI: 0000000000000001 [<...>] RBP: ffff888103ee2cb0 R08: 0000000000000001 R09: fffffbd0082d5f25 [<...>] R10: fffffe80416af92f R11: 0000000000000001 R12: fdf99c16731d9b6d [<...>] R13: 0000000000000000 R14: ffff88819ad4b8b8 R15: 0000000000000000 [<...>] RBX: tracefs_inode_cache+0x0/0x4e0 [slab object] [<...>] RDX: __list_del_entry_valid_or_report+0x108/0x3e0 [<...>] RSI: __func__.47+0x4340/0x4400 [<...>] RBP: tracefs_inode_cache+0x0/0x4e0 [slab object] [<...>] RSP: process kstack fffffe80416afaf0+0x7af0/0x8000 [mount 2550 2550] [<...>] R09: kasan shadow of process kstack fffffe80416af928+0x7928/0x8000 [mount 2550 2550] [<...>] R10: process kstack fffffe80416af92f+0x792f/0x8000 [mount 2550 2550] [<...>] R14: tracefs_inode_cache+0x78/0x4e0 [slab object] [<...>] FS: 00006dcb380c1840(0000) GS:ffff8881e0600000(0000) knlGS:0000000000000000 [<...>] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [<...>] CR2: 000076ab72b30e84 CR3: 000000000b088004 CR4: 0000000000360ef0 shadow CR4: 0000000000360ef0 [<...>] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [<...>] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [<...>] ASID: 0003 [<...>] Stack: [<...>] ffffffff818a2315 00000000f5c856ee ffffffff896f1840 ffff888103ee2cb0 [<...>] ffff88812b6b9750 0000000079d714b6 fffffbfff1e9280b ffffffff8f49405f [<...>] 0000000000000001 0000000000000000 ffff888104457280 ffffffff8248b392 [<...>] Call Trace: [<...>] <TASK> [<...>] [<ffffffff818a2315>] ? lock_release+0x175/0x380 fffffe80416afaf0 [<...>] [<ffffffff8248b392>] list_lru_del+0x152/0x740 fffffe80416afb48 [<...>] [<ffffffff8248ba93>] list_lru_del_obj+0x113/0x280 fffffe80416afb88 [<...>] [<ffffffff8940fd19>] ? _atomic_dec_and_lock+0x119/0x200 fffffe80416afb90 [<...>] [<ffffffff8295b244>] iput_final+0x1c4/0x9a0 fffffe80416afbb8 [<...>] [<ffffffff8293a52b>] dentry_unlink_inode+0x44b/0xaa0 fffffe80416afbf8 [<...>] [<ffffffff8293fefc>] __dentry_kill+0x23c/0xf00 fffffe80416afc40 [<...>] [<ffffffff8953a85f>] ? __this_cpu_preempt_check+0x1f/0xa0 fffffe80416afc48 [<...>] [<ffffffff82949ce5>] ? shrink_dentry_list+0x1c5/0x760 fffffe80416afc70 [<...>] [<ffffffff82949b71>] ? shrink_dentry_list+0x51/0x760 fffffe80416afc78 [<...>] [<ffffffff82949da8>] shrink_dentry_list+0x288/0x760 fffffe80416afc80 [<...>] [<ffffffff8294ae75>] shrink_dcache_sb+0x155/0x420 fffffe80416afcc8 [<...>] [<ffffffff8953a7c3>] ? debug_smp_processor_id+0x23/0xa0 fffffe80416afce0 [<...>] [<ffffffff8294ad20>] ? do_one_tree+0x140/0x140 fffffe80416afcf8 [<...>] [<ffffffff82997349>] ? do_remount+0x329/0xa00 fffffe80416afd18 [<...>] [<ffffffff83ebf7a1>] ? security_sb_remount+0x81/0x1c0 fffffe80416afd38 [<...>] [<ffffffff82892096>] reconfigure_super+0x856/0x14e0 fffffe80416afd70 [<...>] [<ffffffff815d1327>] ? ns_capable_common+0xe7/0x2a0 fffffe80416afd90 [<...>] [<ffffffff82997436>] do_remount+0x416/0xa00 fffffe80416afdd0 [<...>] [<ffffffff829b2ba4>] path_mount+0x5c4/0x900 fffffe80416afe28 [<...>] [<ffffffff829b25e0>] ? finish_automount+0x13a0/0x13a0 fffffe80416afe60 [<...>] [<ffffffff82903812>] ? user_path_at_empty+0xb2/0x140 fffffe80416afe88 [<...>] [<ffffffff829b2ff5>] do_mount+0x115/0x1c0 fffffe80416afeb8 [<...>] [<ffffffff829b2ee0>] ? path_mount+0x900/0x900 fffffe80416afed8 [<...>] [<ffffffff8272461c>] ? __kasan_check_write+0x1c/0xa0 fffffe80416afee0 [<...>] [<ffffffff829b31cf>] __do_sys_mount+0x12f/0x280 fffffe80416aff30 [<...>] [<ffffffff829b36cd>] __x64_sys_mount+0xcd/0x2e0 fffffe80416aff70 [<...>] [<ffffffff819f8818>] ? syscall_trace_enter+0x218/0x380 fffffe80416aff88 [<...>] [<ffffffff8111655e>] x64_sys_call+0x5d5e/0x6720 fffffe80416affa8 [<...>] [<ffffffff8952756d>] do_syscall_64+0xcd/0x3c0 fffffe80416affb8 [<...>] [<ffffffff8100119b>] entry_SYSCALL_64_safe_stack+0x4c/0x87 fffffe80416affe8 [<...>] </TASK> [<...>] <PTREGS> [<...>] RIP: 0033:[<00006dcb382ff66a>] vm_area_struct[mount 2550 2550 file 6dcb38225000-6dcb3837e000 22 55(read|exec|mayread|mayexec)]+0x0/0xb8 [userland map] [<...>] Code: 48 8b 0d 29 18 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f6 17 0d 00 f7 d8 64 89 01 48 [<...>] RSP: 002b:0000763d68192558 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [<...>] RAX: ffffffffffffffda RBX: 00006dcb38433264 RCX: 00006dcb382ff66a [<...>] RDX: 000017c3e0d11210 RSI: 000017c3e0d1a5a0 RDI: 000017c3e0d1ae70 [<...>] RBP: 000017c3e0d10fb0 R08: 000017c3e0d11260 R09: 00006dcb383d1be0 [<...>] R10: 000000000020002e R11: 0000000000000246 R12: 0000000000000000 [<...>] R13: 000017c3e0d1ae70 R14: 000017c3e0d11210 R15: 000017c3e0d10fb0 [<...>] RBX: vm_area_struct[mount 2550 2550 file 6dcb38433000-6dcb38434000 5b 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RCX: vm_area_struct[mount 2550 2550 file 6dcb38225000-6dcb3837e000 22 55(read|exec|mayread|mayexec)]+0x0/0xb8 [userland map] [<...>] RDX: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RSI: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RDI: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RBP: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RSP: vm_area_struct[mount 2550 2550 anon 763d68173000-763d68195000 7ffffffdd 100133(read|write|mayread|maywrite|growsdown|account)]+0x0/0xb8 [userland map] [<...>] R08: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R09: vm_area_struct[mount 2550 2550 file 6dcb383d1000-6dcb383d3000 1cd 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R13: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R14: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R15: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] </PTREGS> [<...>] Modules linked in: [<...>] ---[ end trace 0000000000000000 ]--- The list debug message as well as RBX's symbolic value point out that the object in question was allocated from 'tracefs_inode_cache' and that the list's '->next' member is at offset 0. Dumping the layout of the relevant parts of 'struct tracefs_inode' gives the following: struct tracefs_inode { union { struct inode { struct list_head { struct list_head * next; /* 0 8 */ struct list_head * prev; /* 8 8 */ } i_lru; [...] } vfs_inode; struct callback_head { void (*func)(struct callback_head *); /* 0 8 */ struct callback_head * next; /* 8 8 */ } rcu; }; [...] }; Above shows that 'vfs_inode.i_lru' overlaps with 'rcu' which will destroy the 'i_lru' list as soon as the 'rcu' member gets used, e.g. in call_rcu() or later when calling the RCU callback. This will disturb concurrent list traversals as well as object reuse which assumes these list heads will keep their integrity. For reproduction, the following diff manually overlays 'i_lru' with 'rcu' as, otherwise, one would require some good portion of luck for gambling an unlucky RANDSTRUCT seed: --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -629,6 +629,7 @@ struct inode { umode_t i_mode; unsigned short i_opflags; kuid_t i_uid; + struct list_head i_lru; /* inode LRU list */ kgid_t i_gid; unsigned int i_flags; @@ -690,7 +691,6 @@ struct inode { u16 i_wb_frn_avg_time; u16 i_wb_frn_history; #endif - struct list_head i_lru; /* inode LRU list */ struct list_head i_sb_list; struct list_head i_wb_list; /* backing dev writeback list */ union { The tracefs inode does not need to supply its own RCU delayed destruction of its inode. The inode code itself offers both a "destroy_inode()" callback that gets called when the last reference of the inode is released, and the "free_inode()" which is called after a RCU synchronization period from the "destroy_inode()". The tracefs code can unlink the inode from its list in the destroy_inode() callback, and the simply free it from the free_inode() callback. This should provide the same protection. Link: https://lore.kernel.org/all/20240807115143.45927-3-minipli@grsecurity.net/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Ajay Kaher <ajay.kaher(a)broadcom.com> Cc: Ilkka =?utf-8?b?TmF1bGFww6TDpA==?= <digirigawa(a)gmail.com> Link: https://lore.kernel.org/20240807185402.61410544@gandalf.local.home Fixes: baa23a8d4360 ("tracefs: Reset permissions on remount if permissions are options") Reported-by: Mathias Krause <minipli(a)grsecurity.net> Reported-by: Brad Spengler <spender(a)grsecurity.net> Suggested-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/fs.h [The patch which merged into stable-v6.6 has error, it shouldn't modify include/linux/fs.h] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/tracefs/inode.c | 10 ++++------ fs/tracefs/internal.h | 5 +---- 2 files changed, 5 insertions(+), 10 deletions(-) diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c index 859442b5371e..7d389dd5ed51 100644 --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -53,15 +53,14 @@ static struct inode *tracefs_alloc_inode(struct super_block *sb) return &ti->vfs_inode; } -static void tracefs_free_inode_rcu(struct rcu_head *rcu) +static void tracefs_free_inode(struct inode *inode) { - struct tracefs_inode *ti; + struct tracefs_inode *ti = get_tracefs(inode); - ti = container_of(rcu, struct tracefs_inode, rcu); kmem_cache_free(tracefs_inode_cachep, ti); } -static void tracefs_free_inode(struct inode *inode) +static void tracefs_destroy_inode(struct inode *inode) { struct tracefs_inode *ti = get_tracefs(inode); unsigned long flags; @@ -69,8 +68,6 @@ static void tracefs_free_inode(struct inode *inode) spin_lock_irqsave(&tracefs_inode_lock, flags); list_del_rcu(&ti->list); spin_unlock_irqrestore(&tracefs_inode_lock, flags); - - call_rcu(&ti->rcu, tracefs_free_inode_rcu); } static ssize_t default_read_file(struct file *file, char __user *buf, @@ -458,6 +455,7 @@ static int tracefs_drop_inode(struct inode *inode) static const struct super_operations tracefs_super_operations = { .alloc_inode = tracefs_alloc_inode, .free_inode = tracefs_free_inode, + .destroy_inode = tracefs_destroy_inode, .drop_inode = tracefs_drop_inode, .statfs = simple_statfs, .remount_fs = tracefs_remount, diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h index f704d8348357..d83c2a25f288 100644 --- a/fs/tracefs/internal.h +++ b/fs/tracefs/internal.h @@ -10,10 +10,7 @@ enum { }; struct tracefs_inode { - union { - struct inode vfs_inode; - struct rcu_head rcu; - }; + struct inode vfs_inode; /* The below gets initialized with memset_after(ti, 0, vfs_inode) */ struct list_head list; unsigned long flags; -- 2.39.2

2 1

[openeuler:OLK-5.10 29995/30000] versioncheck: ./drivers/net/ub/dev/network_mgmt/ip_notify/ip_notify.c: 18 linux/version.h not needed.
by kernel test robot 14 Sep '24

14 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 1b6ac823ff98dd4dbd1b6bff478a1b9b44855f67 commit: 97d137031d48299dbfc7dbf5d99f0475eb6ff1f4 [29995/30000] network_mgmt: Add ip_notify timer print. reproduce: (https://download.01.org/0day-ci/archive/20240914/202409141643.hAeJbyh0-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409141643.hAeJbyh0-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.58.0-bindgen-0.56.0/cargo/bin:/opt/cross/clang-18/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -Wtautological-compare -Wno-error=return-type -Wreturn-type -Wcast-function-type -funsigned-char -Wundef -fstrict-flex-arrays=3 -Wformat-overflow -Wformat-truncation -Wenum-conversion W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* \( -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git \) -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./arch/csky/include/asm/atomic.h: 6 linux/version.h not needed. ./arch/csky/include/asm/io.h: 9 linux/version.h not needed. ./arch/csky/include/asm/thread_info.h: 9 linux/version.h not needed. ./arch/csky/include/asm/uaccess.h: 15 linux/version.h not needed. ./arch/csky/kernel/process.c: 5 linux/version.h not needed. ./arch/csky/mm/dma-mapping.c: 12 linux/version.h not needed. ./arch/csky/mm/fault.c: 16 linux/version.h not needed. ./arch/s390/include/asm/setup.h: 183: need linux/version.h ./arch/um/drivers/vector_kern.c: 11 linux/version.h not needed. ./drivers/block/rsxx/rsxx_priv.h: 14 linux/version.h not needed. ./drivers/char/ipmi/ipmi_si_ls2k500.c: 19 linux/version.h not needed. ./drivers/crypto/cavium/cpt/cptpf_main.c: 13 linux/version.h not needed. ./drivers/crypto/cavium/zip/common.h: 59 linux/version.h not needed. ./drivers/crypto/ccree/cc_driver.h: 26 linux/version.h not needed. ./drivers/crypto/montage/tsse/tsse_vuart.c: 21 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c: 62 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c: 28 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c: 26 linux/version.h not needed. ./drivers/gpu/drm/inspur/inspur_drm_de.c: 513: need linux/version.h ./drivers/gpu/drm/inspur/inspur_drm_drv.c: 456: need linux/version.h ./drivers/gpu/drm/pl111/pl111_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/pl111/pl111_drv.c: 47 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_drv.c: 38 linux/version.h not needed. ./drivers/hv/hv.c: 16 linux/version.h not needed. ./drivers/i2c/busses/i2c-brcmstb.c: 25 linux/version.h not needed. ./drivers/i2c/busses/i2c-xgene-slimpro.c: 22 linux/version.h not needed. ./drivers/media/pci/cx25821/cx25821.h: 31 linux/version.h not needed. ./drivers/media/platform/s3c-camif/camif-core.c: 26 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-common.h: 16 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c: 31 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-dvb.c: 14 linux/version.h not needed. ./drivers/media/usb/uvc/uvc_driver.c: 18 linux/version.h not needed. ./drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h: 12 linux/version.h not needed. ./drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c: 21 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h: 12 linux/version.h not needed. ./drivers/net/ethernet/mucse/rnpm/rnpm_common.h: 7 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/common.h: 12 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/txrx.c: 9 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede.h: 10 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_ethtool.c: 7 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_main.c: 10 linux/version.h not needed. ./drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h: 26 linux/version.h not needed. >> ./drivers/net/ub/dev/network_mgmt/ip_notify/ip_notify.c: 18 linux/version.h not needed. ./drivers/net/usb/lan78xx.c: 5 linux/version.h not needed. ./drivers/net/wireless/rsi/rsi_91x_ps.c: 19 linux/version.h not needed. ./drivers/scsi/cxgbi/libcxgbi.h: 27 linux/version.h not needed. ./drivers/scsi/hisi_raid/hiraid_main.c: 9 linux/version.h not needed. ./drivers/scsi/huawei/hifc/hifc_knl_adp.h: 23 linux/version.h not needed. ./drivers/scsi/qedf/qedf.h: 15 linux/version.h not needed. ./drivers/scsi/qedf/qedf_dbg.h: 13 linux/version.h not needed. ./drivers/scsi/qedi/qedi_dbg.h: 14 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/soc/tegra/powergate-bpmp.c: 10 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/drv_types.h: 17 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/ioctl_cfg80211.h: 10 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_cdev_file.c: 23 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_device.c: 33 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_genl.c: 26 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_genl_admin.c: 20 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_main.c: 28 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_tp.c: 26 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_umem.c: 26 linux/version.h not needed. ./drivers/ub/urma/uburma/uburma_main.c: 29 linux/version.h not needed. ./drivers/ub/urma/uburma/uburma_mmap.c: 21 linux/version.h not needed. ./drivers/watchdog/ziirave_wdt.c: 21 linux/version.h not needed. ./fs/eulerfs/euler.h: 20 linux/version.h not needed. ./fs/eulerfs/euler_common.h: 25 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./include/linux/qed/qed_ll2_if.h: 15 linux/version.h not needed. ./kernel/bpf/syscall.c: 20 linux/version.h not needed. ./samples/bpf/sampleip_kern.c: 7 linux/version.h not needed. ./samples/bpf/trace_event_kern.c: 8 linux/version.h not needed. ./sound/soc/codecs/cs35l35.c: 12 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/libbpf_sched.h: 21 linux/version.h not needed. ./tools/perf/include/bpf/bpf.h: 70: need linux/version.h ./tools/perf/tests/bpf-script-example.c: 49: need linux/version.h ./tools/perf/tests/bpf-script-test-kbuild.c: 21: need linux/version.h ./tools/perf/tests/bpf-script-test-prologue.c: 47: need linux/version.h ./tools/perf/tests/bpf-script-test-relocation.c: 51: need linux/version.h ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 25 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 16810/23712] drivers/misc/uacce/uacce.c:739:13: error: implicit declaration of function 'module_refcount'
by kernel test robot 14 Sep '24

14 Sep '24

Hi Yu'an, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 451823febcb610969f048556cedc41b5e08fafb1 [16810/23712] UACCE backport from mainline config: arm64-randconfig-003-20240913 (https://download.01.org/0day-ci/archive/20240914/202409141543.TAtQxl6W-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240914/202409141543.TAtQxl6W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409141543.TAtQxl6W-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/misc/uacce/uacce.c: In function 'uacce_put_queue': >> drivers/misc/uacce/uacce.c:739:13: error: implicit declaration of function 'module_refcount' [-Werror=implicit-function-declaration] 739 | if (module_refcount(uacce->pdev->driver->owner) > 0) | ^~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/module_refcount +739 drivers/misc/uacce/uacce.c 1998d80a018804 drivers/uacce/uacce.c Mingqiang Ling 2019-04-23 717 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 718 /* 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 719 * While user space releases a queue, all the relatives on the queue 76dbd49be7fc95 drivers/uacce/uacce.c xuzaibo 2019-07-11 720 * should be released imediately by this putting. 1998d80a018804 drivers/uacce/uacce.c Mingqiang Ling 2019-04-23 721 */ f7acb5166348bf drivers/uacce/uacce.c Yu'an Wang 2020-02-20 722 static void uacce_put_queue(struct uacce_queue *q) 1998d80a018804 drivers/uacce/uacce.c Mingqiang Ling 2019-04-23 723 { 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 724 struct uacce *uacce = q->uacce; e3234bd66f0c97 drivers/uacce/uacce.c xuzaibo 2019-05-13 725 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 726 /* 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 727 * To do: we should vm_munmap mmio and dus regions, currently we munmap 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 728 * mmio and dus region before put queue. 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 729 */ 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 730 if (uacce->ops->stop_queue) 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 731 uacce->ops->stop_queue(q); 299b4bc20a682a drivers/uacce/uacce.c lingmingqiang 2019-05-06 732 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 733 if (uacce->ops->put_queue) 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 734 uacce->ops->put_queue(q); 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 735 8bf65d5558d0bd drivers/uacce/uacce.c Mingqiang Ling 2019-07-11 736 q->state = UACCE_Q_ZOMBIE; f7acb5166348bf drivers/uacce/uacce.c Yu'an Wang 2020-02-20 737 q->filep->private_data = NULL; f7acb5166348bf drivers/uacce/uacce.c Yu'an Wang 2020-02-20 738 uacce_queue_drain(q); f7acb5166348bf drivers/uacce/uacce.c Yu'an Wang 2020-02-20 @739 if (module_refcount(uacce->pdev->driver->owner) > 0) f7acb5166348bf drivers/uacce/uacce.c Yu'an Wang 2020-02-20 740 module_put(uacce->pdev->driver->owner); 1998d80a018804 drivers/uacce/uacce.c Mingqiang Ling 2019-04-23 741 } 1998d80a018804 drivers/uacce/uacce.c Mingqiang Ling 2019-04-23 742 :::::: The code at line 739 was first introduced by commit :::::: f7acb5166348bf6c75ac40c5e6e14726bc3ca578 uacce: Remove uacce mode 1 relatives :::::: TO: Yu'an Wang <wangyuan46(a)huawei.com> :::::: CC: Yang Yingliang <yangyingliang(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1835/13946] mm/page_cache_limit.c:103:52: sparse: sparse: incorrect type in argument 3 (different address spaces)
by kernel test robot 14 Sep '24

14 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e4beeb328d26e30afadf237e39b47aba637a978 commit: 7d1031b36ebd6c273d9aad316fd9e3e2daa01a85 [1835/13946] mm: support pagecache limit config: loongarch-randconfig-r133-20240913 (https://download.01.org/0day-ci/archive/20240914/202409141518.G41e90PW-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240914/202409141518.G41e90PW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409141518.G41e90PW-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_cache_limit.c:61:5: sparse: sparse: symbol 'cache_reclaim_enable_handler' was not declared. Should it be static? mm/page_cache_limit.c:77:5: sparse: sparse: symbol 'cache_reclaim_sysctl_handler' was not declared. Should it be static? >> mm/page_cache_limit.c:103:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/page_cache_limit.c:103:52: sparse: expected void * mm/page_cache_limit.c:103:52: sparse: got void [noderef] __user *buffer >> mm/page_cache_limit.c:94:5: sparse: sparse: symbol 'cache_limit_mbytes_sysctl_handler' was not declared. Should it be static? >> mm/page_cache_limit.c:187:35: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/page_cache_limit.c:187:35: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/page_cache_limit.c:187:35: sparse: got int ( * )( ... ) vim +103 mm/page_cache_limit.c 93 > 94 int cache_limit_mbytes_sysctl_handler(struct ctl_table *table, int write, 95 void __user *buffer, size_t *length, loff_t *ppos) 96 { 97 int ret; 98 unsigned long vm_cache_limit_mbytes_max; 99 unsigned long origin_mbytes = vm_cache_limit_mbytes; 100 int nr_retries = MAX_RECLAIM_RETRIES; 101 102 vm_cache_limit_mbytes_max = totalram_pages() >> (20 - PAGE_SHIFT); > 103 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 104 if (ret || !write) 105 return ret; 106 107 if (vm_cache_limit_mbytes > vm_cache_limit_mbytes_max) { 108 vm_cache_limit_mbytes = origin_mbytes; 109 return -EINVAL; 110 } 111 112 if (write) { 113 while (should_reclaim_page_cache() && page_cache_over_limit() && 114 nr_retries--) { 115 if (signal_pending(current)) 116 return -EINTR; 117 118 shrink_memory(node_reclaim_num(), false); 119 } 120 } 121 122 return 0; 123 } 124 125 static void shrink_shepherd(struct work_struct *w) 126 { 127 int node; 128 129 if (!should_periodical_reclaim()) 130 return; 131 132 for_each_online_node(node) { 133 if (!work_pending(&vmscan_works[node])) 134 queue_work_node(node, system_unbound_wq, &vmscan_works[node]); 135 } 136 137 queue_delayed_work(system_unbound_wq, &shepherd, 138 round_jiffies_relative((unsigned long)vm_cache_reclaim_s * HZ)); 139 } 140 141 static void shrink_page_work(struct work_struct *w) 142 { 143 shrink_memory(node_reclaim_num(), true); 144 } 145 146 static void shrink_shepherd_timer(void) 147 { 148 int i; 149 150 for (i = 0; i < MAX_NUMNODES; i++) 151 INIT_WORK(&vmscan_works[i], shrink_page_work); 152 } 153 154 static struct ctl_table page_cache_limit_table[] = { 155 { 156 .procname = "cache_reclaim_s", 157 .data = &vm_cache_reclaim_s, 158 .maxlen = sizeof(vm_cache_reclaim_s), 159 .mode = 0644, 160 .proc_handler = cache_reclaim_sysctl_handler, 161 .extra1 = SYSCTL_ZERO, 162 .extra2 = &vm_cache_reclaim_s_max, 163 }, 164 { 165 .procname = "cache_reclaim_weight", 166 .data = &vm_cache_reclaim_weight, 167 .maxlen = sizeof(vm_cache_reclaim_weight), 168 .mode = 0644, 169 .proc_handler = proc_dointvec_minmax, 170 .extra1 = SYSCTL_ONE, 171 .extra2 = &vm_cache_reclaim_weight_max, 172 }, 173 { 174 .procname = "cache_reclaim_enable", 175 .data = &vm_cache_reclaim_enable, 176 .maxlen = sizeof(vm_cache_reclaim_enable), 177 .mode = 0644, 178 .proc_handler = cache_reclaim_enable_handler, 179 .extra1 = SYSCTL_ZERO, 180 .extra2 = SYSCTL_ONE, 181 }, 182 { 183 .procname = "cache_limit_mbytes", 184 .data = &vm_cache_limit_mbytes, 185 .maxlen = sizeof(vm_cache_limit_mbytes), 186 .mode = 0644, > 187 .proc_handler = cache_limit_mbytes_sysctl_handler, 188 }, 189 }; 190 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] iommu: Restore lost return in iommu_report_device_fault()
by Lin Ruifeng 14 Sep '24

14 Sep '24

From: Barak Biber <bbiber(a)nvidia.com> stable inclusion from stable-v6.10.7 commit cc6bc2ab1663ec9353636416af22452b078510e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZS CVE: CVE-2024-44994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fca5b78511e98bdff2cdd55c172b23200a7b3404 ] When iommu_report_device_fault gets called with a partial fault it is supposed to collect the fault into the group and then return. Instead the return was accidently deleted which results in trying to process the fault and an eventual crash. Deleting the return was a typo, put it back. Fixes: 3dfa64aecbaf ("iommu: Make iommu_report_device_fault() return void") Signed-off-by: Barak Biber <bbiber(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Reviewed-by: Lu Baolu <baolu.lu(a)linux.intel.com> Link: https://lore.kernel.org/r/0-v1-e7153d9c8cee+1c6-iommu_fault_fix_jgg@nvidia.… Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/iommu/io-pgfault.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/io-pgfault.c b/drivers/iommu/io-pgfault.c index 06d78fcc79fd..f2c87c695a17 100644 --- a/drivers/iommu/io-pgfault.c +++ b/drivers/iommu/io-pgfault.c @@ -192,6 +192,7 @@ void iommu_report_device_fault(struct device *dev, struct iopf_fault *evt) report_partial_fault(iopf_param, fault); iopf_put_dev_fault_param(iopf_param); /* A request that is not the last does not need to be ack'd */ + return; } /* -- 2.17.1

2 1

[PATCH OLK-5.10 0/7] Backport bugfix from mainline
by Liu Shixin 14 Sep '24

14 Sep '24

Gavin Shan (1): mm: migrate: fix THP's mapcount on isolation Kemeng Shi (1): mm/compaction: correctly return failure with bogus compound_order in strict mode Liu Shixin (2): bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page bootmem: use kmemleak_free_part_phys in free_bootmem_page Naoya Horiguchi (1): mm/huge_memory: use pfn_to_online_page() in split_huge_pages_all() Xueshi Hu (1): mm/hugetlb: fix nodes huge page allocation when there are surplus pages Yuan Can (1): mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes include/linux/bootmem_info.h | 2 ++ mm/compaction.c | 28 ++++++++++++++-------------- mm/huge_memory.c | 7 ++----- mm/hugetlb.c | 4 +++- mm/hugetlb_vmemmap.c | 2 +- 5 files changed, 22 insertions(+), 21 deletions(-) -- 2.34.1

2 8

[openeuler:OLK-6.6 1870/13938] drivers/cpufreq/cppc_cpufreq.c:852:19: error: incomplete definition of type 'struct fb_ctr_pair'
by kernel test robot 14 Sep '24

14 Sep '24

Hi Zeng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 292de9750592324fa903dc314670538f50b4c19a commit: 12f136b2134d4ded731c3ef23ac08c85b9c0b1fa [1870/13938] cpufreq: CPPC: Keep the target core awake when reading its cpufreq rate config: arm64-randconfig-001-20240913 (https://download.01.org/0day-ci/archive/20240914/202409141237.GV6bZXKN-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240914/202409141237.GV6bZXKN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409141237.GV6bZXKN-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/cpufreq/cppc_cpufreq.c:852:19: error: incomplete definition of type 'struct fb_ctr_pair' int cpu = fb_ctrs->cpu; ~~~~~~~^ drivers/cpufreq/cppc_cpufreq.c:851:9: note: forward declaration of 'struct fb_ctr_pair' struct fb_ctr_pair *fb_ctrs = val; ^ drivers/cpufreq/cppc_cpufreq.c:855:40: error: incomplete definition of type 'struct fb_ctr_pair' ret = cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t0); ~~~~~~~^ drivers/cpufreq/cppc_cpufreq.c:851:9: note: forward declaration of 'struct fb_ctr_pair' struct fb_ctr_pair *fb_ctrs = val; ^ drivers/cpufreq/cppc_cpufreq.c:861:41: error: incomplete definition of type 'struct fb_ctr_pair' return cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t1); ~~~~~~~^ drivers/cpufreq/cppc_cpufreq.c:851:9: note: forward declaration of 'struct fb_ctr_pair' struct fb_ctr_pair *fb_ctrs = val; ^ >> drivers/cpufreq/cppc_cpufreq.c:866:21: error: variable has incomplete type 'struct fb_ctr_pair' struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^ drivers/cpufreq/cppc_cpufreq.c:866:9: note: forward declaration of 'struct fb_ctr_pair' struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^ 4 errors generated. vim +852 drivers/cpufreq/cppc_cpufreq.c 848 849 static int cppc_get_perf_ctrs_pair(void *val) 850 { 851 struct fb_ctr_pair *fb_ctrs = val; > 852 int cpu = fb_ctrs->cpu; 853 int ret; 854 855 ret = cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t0); 856 if (ret) 857 return ret; 858 859 udelay(2); /* 2usec delay between sampling */ 860 861 return cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t1); 862 } 863 864 static unsigned int cppc_cpufreq_get_rate(unsigned int cpu) 865 { > 866 struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; 867 struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); 868 struct cppc_cpudata *cpu_data = policy->driver_data; 869 u64 delivered_perf; 870 int ret; 871 872 cpufreq_cpu_put(policy); 873 874 if (cpu_has_amu_feat(cpu)) 875 ret = smp_call_on_cpu(cpu, cppc_get_perf_ctrs_pair, 876 &fb_ctrs, false); 877 else 878 ret = cppc_get_perf_ctrs_pair(&fb_ctrs); 879 880 if (ret) 881 return 0; 882 883 delivered_perf = cppc_perf_from_fbctrs(cpu_data, 884 &fb_ctrs.fb_ctrs_t0, 885 &fb_ctrs.fb_ctrs_t1); 886 887 return cppc_cpufreq_perf_to_khz(cpu_data, delivered_perf); 888 } 889 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] mm/ksm: fix possible UAF of stable_node
by Kaixiong Yu 14 Sep '24

14 Sep '24

From: Chengming Zhou <chengming.zhou(a)linux.dev> mainline inclusion from mainline-v6.10-rc1 commit 90e823498881fb8a91d83e9a8eed87c8c3ff2176 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARC7N CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The commit 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") introduced a possible failure case in the stable_tree_insert(), where we may free the new allocated stable_node_dup if we fail to prepare the missing chain node. Then that kfolio return and unlock with a freed stable_node set... And any MM activities can come in to access kfolio->mapping, so UAF. Fix it by moving folio_set_stable_node() to the end after stable_node is inserted successfully. Link: https://lkml.kernel.org/r/20240513-b4-ksm-stable-node-uaf-v1-1-f687de76f452… Fixes: 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") Signed-off-by: Chengming Zhou <chengming.zhou(a)linux.dev> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Stefan Roesch <shr(a)devkernel.io> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/ksm.c [HULK-4.19 didn't merge mainline inclusion commit 79899cce33e0887c06d41e767aa543aaaaef48e2("mm/ksm: convert chain series funcs and replace get_ksm_page")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/ksm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/ksm.c b/mm/ksm.c index 341e09c376e6..fc6b6526099f 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -1904,7 +1904,6 @@ static struct stable_node *stable_tree_insert(struct page *kpage) INIT_HLIST_HEAD(&stable_node_dup->hlist); stable_node_dup->kpfn = kpfn; - set_page_stable_node(kpage, stable_node_dup); stable_node_dup->rmap_hlist_len = 0; DO_NUMA(stable_node_dup->nid = nid); if (!need_chain) { @@ -1923,6 +1922,8 @@ static struct stable_node *stable_tree_insert(struct page *kpage) stable_node_chain_add_dup(stable_node_dup, stable_node); } + set_page_stable_node(kpage, stable_node_dup); + return stable_node_dup; } -- 2.34.1

2 1

[PATCH OLK-6.6] mm/ksm: fix possible UAF of stable_node
by Kaixiong Yu 14 Sep '24

14 Sep '24

From: Chengming Zhou <chengming.zhou(a)linux.dev> mainline inclusion from mainline-v6.10-rc1 commit 90e823498881fb8a91d83e9a8eed87c8c3ff2176 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARBRI CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The commit 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") introduced a possible failure case in the stable_tree_insert(), where we may free the new allocated stable_node_dup if we fail to prepare the missing chain node. Then that kfolio return and unlock with a freed stable_node set... And any MM activities can come in to access kfolio->mapping, so UAF. Fix it by moving folio_set_stable_node() to the end after stable_node is inserted successfully. Link: https://lkml.kernel.org/r/20240513-b4-ksm-stable-node-uaf-v1-1-f687de76f452… Fixes: 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") Signed-off-by: Chengming Zhou <chengming.zhou(a)linux.dev> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Stefan Roesch <shr(a)devkernel.io> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/ksm.c [OLK-6.6 didn't merge mainline inclusion commit 79899cce33e0887c06d41e767aa543aaaaef48e2("mm/ksm: convert chain series funcs and replace get_ksm_page")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/ksm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/ksm.c b/mm/ksm.c index c828630985c0..7d5c76746712 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -1965,7 +1965,6 @@ static struct ksm_stable_node *stable_tree_insert(struct page *kpage) INIT_HLIST_HEAD(&stable_node_dup->hlist); stable_node_dup->kpfn = kpfn; - set_page_stable_node(kpage, stable_node_dup); stable_node_dup->rmap_hlist_len = 0; DO_NUMA(stable_node_dup->nid = nid); if (!need_chain) { @@ -1984,6 +1983,8 @@ static struct ksm_stable_node *stable_tree_insert(struct page *kpage) stable_node_chain_add_dup(stable_node_dup, stable_node); } + set_page_stable_node(kpage, stable_node_dup); + return stable_node_dup; } -- 2.34.1

2 1

[PATCH OLK-5.10] mm/ksm: fix possible UAF of stable_node
by Kaixiong Yu 14 Sep '24

14 Sep '24

From: Chengming Zhou <chengming.zhou(a)linux.dev> mainline inclusion from mainline-v6.10-rc1 commit 90e823498881fb8a91d83e9a8eed87c8c3ff2176 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARCIF CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The commit 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") introduced a possible failure case in the stable_tree_insert(), where we may free the new allocated stable_node_dup if we fail to prepare the missing chain node. Then that kfolio return and unlock with a freed stable_node set... And any MM activities can come in to access kfolio->mapping, so UAF. Fix it by moving folio_set_stable_node() to the end after stable_node is inserted successfully. Link: https://lkml.kernel.org/r/20240513-b4-ksm-stable-node-uaf-v1-1-f687de76f452… Fixes: 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") Signed-off-by: Chengming Zhou <chengming.zhou(a)linux.dev> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Stefan Roesch <shr(a)devkernel.io> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/ksm.c [OLK-5.10 merged commit 6584e73a2ca62cf3b0bed42204f79f082801c3f7 ("[Huawei] mm: transplant ksm hugepage feature for kernel 5.10")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/ksm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/ksm.c b/mm/ksm.c index 21bb3e7cf3bc..b2cdbe6caa71 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -1922,7 +1922,6 @@ static struct stable_node *stable_tree_insert(struct page *kpage) INIT_HLIST_HEAD(&stable_node_dup->hlist); stable_node_dup->kpfn = kpfn; - set_page_stable_node(kpage, stable_node_dup); stable_node_dup->rmap_hlist_len = 0; DO_NUMA(stable_node_dup->nid = nid); if (!need_chain) { @@ -1941,6 +1940,8 @@ static struct stable_node *stable_tree_insert(struct page *kpage) stable_node_chain_add_dup(stable_node_dup, stable_node); } + set_page_stable_node(kpage, stable_node_dup); + return stable_node_dup; } -- 2.34.1

2 1