- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/1] Fix CVE-2022-50230
by Hongbo Li 24 Jun '25

24 Jun '25

Fix CVE-2022-50230. Peter Collingbourne (1): arm64: set UXN on swapper page tables arch/arm64/include/asm/kernel-pgtable.h | 4 ++-- arch/arm64/kernel/head.S | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.10] ALSA: pcm: Fix race of buffer access at PCM OSS layer
by Luo Gengkun 24 Jun '25

24 Jun '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.93 commit 74d90875f3d43f3eff0e9861c4701418795d3455 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGACK CVE: CVE-2025-38078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 93a81ca0657758b607c3f4ba889ae806be9beb73 upstream. The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed runtime->dma_area might be freed concurrently, as it's performed outside the PCM ops. For avoiding it, move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed during the operation. Reported-by: syzbot+32d4647f551007595173(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- include/sound/pcm.h | 2 ++ sound/core/oss/pcm_oss.c | 3 +-- sound/core/pcm_native.c | 11 +++++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/include/sound/pcm.h b/include/sound/pcm.h index 2a815373dac1..ed4449cbdf80 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -1427,6 +1427,8 @@ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_s #define snd_pcm_lib_mmap_iomem NULL #endif +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime); + /** * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer * @dma: DMA number diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 728c211142d1..471de2d1b37a 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1085,8 +1085,7 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) runtime->oss.params = 0; runtime->oss.prepare = 1; runtime->oss.buffer_used = 0; - if (runtime->dma_area) - snd_pcm_format_set_silence(runtime->format, runtime->dma_area, bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_runtime_buffer_set_silence(runtime); runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size); diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index e40de64ec85c..31fc20350fd9 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -703,6 +703,17 @@ static void snd_pcm_buffer_access_unlock(struct snd_pcm_runtime *runtime) atomic_inc(&runtime->buffer_accessing); } +/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime) +{ + snd_pcm_buffer_access_lock(runtime); + if (runtime->dma_area) + snd_pcm_format_set_silence(runtime->format, runtime->dma_area, + bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_buffer_access_unlock(runtime); +} +EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence); + #if IS_ENABLED(CONFIG_SND_PCM_OSS) #define is_oss_stream(substream) ((substream)->oss.oss) #else -- 2.34.1

1 0

[PATCH OLK-5.10] ALSA: pcm: Fix race of buffer access at PCM OSS layer
by Luo Gengkun 24 Jun '25

24 Jun '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.238 commit 8170d8ec4efd0be352c14cb61f374e30fb0c2a25 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGACK CVE: CVE-2025-38078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 93a81ca0657758b607c3f4ba889ae806be9beb73 upstream. The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed runtime->dma_area might be freed concurrently, as it's performed outside the PCM ops. For avoiding it, move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed during the operation. Reported-by: syzbot+32d4647f551007595173(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- include/sound/pcm.h | 2 ++ sound/core/oss/pcm_oss.c | 3 +-- sound/core/pcm_native.c | 11 +++++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/include/sound/pcm.h b/include/sound/pcm.h index 6554a9f71c62..c573c6a7da12 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -1334,6 +1334,8 @@ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_s #define snd_pcm_lib_mmap_iomem NULL #endif +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime); + /** * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer * @dma: DMA number diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index de6f94bee50b..8eb5fef41dbe 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1078,8 +1078,7 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) runtime->oss.params = 0; runtime->oss.prepare = 1; runtime->oss.buffer_used = 0; - if (runtime->dma_area) - snd_pcm_format_set_silence(runtime->format, runtime->dma_area, bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_runtime_buffer_set_silence(runtime); runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size); diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index 9425fcd30c4c..98bd6fe850d3 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -685,6 +685,17 @@ static void snd_pcm_buffer_access_unlock(struct snd_pcm_runtime *runtime) atomic_inc(&runtime->buffer_accessing); } +/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime) +{ + snd_pcm_buffer_access_lock(runtime); + if (runtime->dma_area) + snd_pcm_format_set_silence(runtime->format, runtime->dma_area, + bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_buffer_access_unlock(runtime); +} +EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence); + #if IS_ENABLED(CONFIG_SND_PCM_OSS) #define is_oss_stream(substream) ((substream)->oss.oss) #else -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 5e8b5c945557e13053f64d08e9859d56c789362f
by kernel test robot 24 Jun '25

24 Jun '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 5e8b5c945557e13053f64d08e9859d56c789362f !16774 bpf: Fix prog_array_map_poke_run map poke update Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202505280024.8UbNlKSa-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202505280046.3lWnWdOg-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202505301434.xq8uzhGR-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202506042153.UZ29KeGA-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202506231925.HQ2gIERd-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202506232147.n7w5pLY6-lkp@intel.com drivers/irqchip/irq-gic-v3-its.c:524:6: warning: no previous prototype for 'build_devid_pools' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c:331:68: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:13:44: warning: no previous prototype for 'cqm3_cmd_alloc' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:14:44: warning: no previous prototype for 'cqm3_cmd_free' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:15:44: warning: no previous prototype for 'cqm3_send_cmd_box' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:16:44: warning: no previous prototype for 'cqm3_lb_send_cmd_box' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:17:44: warning: no previous prototype for 'cqm3_lb_send_cmd_box_async' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:342:5: warning: no previous prototype for 'hinic3_rx_queue_stat_pack' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:357:5: warning: no previous prototype for 'hinic3_tx_queue_stat_pack' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_irq.c:23:5: warning: no previous prototype for 'hinic3_poll' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:1678:5: warning: no previous prototype for 'set_fecparam' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:1706:5: warning: no previous prototype for 'get_fecparam' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:623:6: warning: no previous prototype for 'print_port_info' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:802:6: warning: no previous prototype for 'hinic3_notify_vf_bond_status' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:832:6: warning: no previous prototype for 'hinic3_notify_all_vfs_bond_changed' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_main.c:1211:6: warning: no previous prototype for 'hinic3_need_proc_link_event' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_main.c:1258:6: warning: no previous prototype for 'hinic3_need_proc_bond_event' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.c:111:5: warning: no previous prototype for 'hinic3_dbg_get_rq_info' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.c:19:5: warning: no previous prototype for 'hinic3_dbg_get_wqe_info' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c:787:5: warning: no previous prototype for 'hinic3_ethtool_flow_replace' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_rx.c:1329:5: warning: no previous prototype for 'rxq_restore' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hinic3_rx.c:782:5: warning: no previous prototype for 'hinic3_run_xdp' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c:618:6: warning: no previous prototype for 'hinic3_write_oshr_info' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.c:1671:6: warning: no previous prototype for 'hinic3_is_optical_module_mode' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:865:5: warning: no previous prototype for 'hinic3_global_func_id_hw' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:103:6: warning: no previous prototype for 'hinic3_uld_lock_init' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:1796:6: warning: no previous prototype for 'hinic3_set_func_state' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:1822:6: warning: no previous prototype for 'slave_host_mgmt_work' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:525:5: warning: no previous prototype for 'hinic3_pdev_is_virtfn' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:785:5: warning: no previous prototype for '__set_vroce_func_state' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:826:6: warning: no previous prototype for 'slave_host_mgmt_vroce_work' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:834:7: warning: no previous prototype for 'hinic3_get_roce_uld_by_pdev' [-Wmissing-prototypes] drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.c:176:5: warning: no previous prototype for 'hinic3_pci_sriov_check' [-Wmissing-prototypes] mm/damon/core-test.h:284:2: warning: comparison of distinct pointer types ('typeof (__left) *' (aka 'unsigned int *') and 'typeof (__right) *' (aka 'int *')) [-Wcompare-distinct-pointer-types] mm/hugetlb.c:2223:9: warning: variable 'gfp' set but not used [-Wunused-but-set-variable] mm/khugepaged.c:1703: warning: Function parameter or member 'reliable' not described in 'collapse_file' mm/page_alloc.c:3040:6: warning: no previous prototype for '__drain_all_pages' [-Wmissing-prototypes] mm/page_alloc.c:3040:6: warning: no previous prototype for function '__drain_all_pages' [-Wmissing-prototypes] mm/page_alloc.c:6794:23: warning: no previous prototype for function 'arch_memmap_init' [-Wmissing-prototypes] mm/page_alloc.c:6912:6: warning: no previous prototype for '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] mm/page_alloc.c:6912:6: warning: no previous prototype for function '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] mm/slub.o: warning: objtool: kmem_cache_free()+0x43a: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-allnoconfig | |-- drivers-irqchip-irq-gic-v3-its.c:warning:no-previous-prototype-for-build_devid_pools | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-001-20250623 | |-- drivers-irqchip-irq-gic-v3-its.c:warning:no-previous-prototype-for-build_devid_pools | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-002-20250623 | |-- drivers-irqchip-irq-gic-v3-its.c:warning:no-previous-prototype-for-build_devid_pools | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-003-20250623 | |-- drivers-irqchip-irq-gic-v3-its.c:warning:no-previous-prototype-for-build_devid_pools | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-arch_memmap_init |-- x86_64-allyesconfig | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-arch_memmap_init |-- x86_64-buildonly-randconfig-001-20250623 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-arch_memmap_init |-- x86_64-buildonly-randconfig-002-20250623 | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:warning:suggest-braces-around-empty-body-in-an-if-statement | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_define.h:warning:no-previous-prototype-for-cqm3_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_define.h:warning:no-previous-prototype-for-cqm3_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_define.h:warning:no-previous-prototype-for-cqm3_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_define.h:warning:no-previous-prototype-for-cqm3_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_define.h:warning:no-previous-prototype-for-cqm3_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-hinic3_ethtool_stats.c:warning:no-previous-prototype-for-hinic3_rx_queue_stat_pack | |-- drivers-net-ethernet-huawei-hinic3-hinic3_ethtool_stats.c:warning:no-previous-prototype-for-hinic3_tx_queue_stat_pack | |-- drivers-net-ethernet-huawei-hinic3-hinic3_irq.c:warning:no-previous-prototype-for-hinic3_poll | |-- drivers-net-ethernet-huawei-hinic3-hinic3_mag_cfg.c:warning:no-previous-prototype-for-get_fecparam | |-- drivers-net-ethernet-huawei-hinic3-hinic3_mag_cfg.c:warning:no-previous-prototype-for-hinic3_notify_all_vfs_bond_changed | |-- drivers-net-ethernet-huawei-hinic3-hinic3_mag_cfg.c:warning:no-previous-prototype-for-hinic3_notify_vf_bond_status | |-- drivers-net-ethernet-huawei-hinic3-hinic3_mag_cfg.c:warning:no-previous-prototype-for-print_port_info | |-- drivers-net-ethernet-huawei-hinic3-hinic3_mag_cfg.c:warning:no-previous-prototype-for-set_fecparam | |-- drivers-net-ethernet-huawei-hinic3-hinic3_main.c:warning:no-previous-prototype-for-hinic3_need_proc_bond_event | |-- drivers-net-ethernet-huawei-hinic3-hinic3_main.c:warning:no-previous-prototype-for-hinic3_need_proc_link_event | |-- drivers-net-ethernet-huawei-hinic3-hinic3_nic_dbg.c:warning:no-previous-prototype-for-hinic3_dbg_get_rq_info | |-- drivers-net-ethernet-huawei-hinic3-hinic3_nic_dbg.c:warning:no-previous-prototype-for-hinic3_dbg_get_wqe_info | |-- drivers-net-ethernet-huawei-hinic3-hinic3_ntuple.c:warning:no-previous-prototype-for-hinic3_ethtool_flow_replace | |-- drivers-net-ethernet-huawei-hinic3-hinic3_rx.c:warning:no-previous-prototype-for-hinic3_run_xdp | |-- drivers-net-ethernet-huawei-hinic3-hinic3_rx.c:warning:no-previous-prototype-for-rxq_restore | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_dev_mgmt.c:warning:no-previous-prototype-for-hinic3_write_oshr_info | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hw_comm.c:warning:no-previous-prototype-for-hinic3_is_optical_module_mode | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-hinic3_global_func_id_hw | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_lld.c:warning:no-previous-prototype-for-__set_vroce_func_state | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_lld.c:warning:no-previous-prototype-for-hinic3_get_roce_uld_by_pdev | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_lld.c:warning:no-previous-prototype-for-hinic3_pdev_is_virtfn | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_lld.c:warning:no-previous-prototype-for-hinic3_set_func_state | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_lld.c:warning:no-previous-prototype-for-hinic3_uld_lock_init | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_lld.c:warning:no-previous-prototype-for-slave_host_mgmt_vroce_work | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_lld.c:warning:no-previous-prototype-for-slave_host_mgmt_work | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_sriov.c:warning:no-previous-prototype-for-hinic3_pci_sriov_check | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250623 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250623 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250623 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250623 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-arch_memmap_init |-- x86_64-defconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch `-- x86_64-rhel-9.4-rust |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-arch_memmap_init `-- mm-slub.o:warning:objtool:kmem_cache_free:unreachable-instruction elapsed time: 731m configs tested: 16 configs skipped: 62 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-15.1.0 arm64 randconfig-001-20250623 gcc-14.3.0 arm64 randconfig-002-20250623 gcc-14.3.0 arm64 randconfig-003-20250623 gcc-9.5.0 arm64 randconfig-004-20250623 clang-16 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250623 clang-20 x86_64 buildonly-randconfig-002-20250623 gcc-12 x86_64 buildonly-randconfig-003-20250623 gcc-12 x86_64 buildonly-randconfig-004-20250623 gcc-12 x86_64 buildonly-randconfig-005-20250623 gcc-12 x86_64 buildonly-randconfig-006-20250623 clang-20 x86_64 defconfig gcc-11 x86_64 rhel-9.4-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH v2 OLK-6.6 00/31] Support CCA Guest
by Cai Xinchen 23 Jun '25

23 Jun '25

This series adds support for running Linux in a protected VM under the Arm Confidential Compute Architecture (CCA). To support CCA guest, we do things as follow: 1. Revert virtcca patches Revert "virtcca feature : disable swiotlb for passthrough device" Revert "gicv3: add lpi support for cvm guest" 2. Support CCA encrypt part arm64: mm: Add top-level dispatcher for internal mem_encrypt API arm64: mm: Add confidential computing hook to ioremap_prot() arm64: rsi: Add RSI definitions arm64: Detect if in a realm and set RIPAS RAM arm64: realm: Query IPA size from the RMM arm64: rsi: Add support for checking whether an MMIO is protected arm64: rsi: Map unprotected MMIO as decrypted efi: arm64: Map Device with Prot Shared arm64: Enforce bounce buffers for realm DMA arm64: mm: Avoid TLBI when marking pages as valid arm64: Enable memory encrypt for Realms irqchip/gic-v3-its: Share ITS tables with a non-trusted hypervisor irqchip/gic-v3-its: Fix over allocation in itt_alloc_pool() irqchip/gic-v3-its: Rely on genpool alignment jump_label,module: Don't alloc static_key_mod for __ro_after_init keys parisc: Delay write-protection until mark_rodata_ro() call arm64: realm: ioremap: Allow mapping memory as encrypted rme: make sure realm guest map memory in page granularity dma: Fix encryption bit clearing for dma_to_phys dma: Introduce generic dma_addr_*crypted helpers arm64: realm: Use aliased addresses for device DMA to shared buffers 3. Support tsm report for arm-cca-guest virt: coco: Add a coco/Makefile and coco/Kconfig configfs-tsm: Introduce a shared ABI for attestation reports mm/slab: Add __free() support for kvfree virt: arm-cca-guest: TSM_REPORT support for realms arm64: Document Arm Confidential Compute configfs-tsm-report: Fix NULL dereference of tsm_ops MAINTAINERS: Add CCA and pKVM CoCO guest support to the ARM64 entry 4. Recover virtcca gicv3: add lpi support for virtcca cvm guest V2: Add 5 bugfix patch commit fba4ceaa242d ("configfs-tsm-report: Fix NULL dereference of tsm_ops") commit 92230596252a ("MAINTAINERS: Add CCA and pKVM CoCO guest support to the ARM64 entry") commit 7d953a062416 ("arm64: realm: Use aliased addresses for device DMA to shared buffers") commit b66e2ee7b6c8 ("dma: Introduce generic dma_addr_*crypted helpers") commit c380931712d1 ("dma: Fix encryption bit clearing for dma_to_phys") Cai Xinchen (2): Revert "virtcca feature : disable swiotlb for passthrough device" Revert "gicv3: add lpi support for cvm guest" Dan Williams (4): virt: coco: Add a coco/Makefile and coco/Kconfig configfs-tsm: Introduce a shared ABI for attestation reports mm/slab: Add __free() support for kvfree configfs-tsm-report: Fix NULL dereference of tsm_ops Helge Deller (1): parisc: Delay write-protection until mark_rodata_ro() call Peter Zijlstra (1): jump_label,module: Don't alloc static_key_mod for __ro_after_init keys Sami Mujawar (1): virt: arm-cca-guest: TSM_REPORT support for realms Steven Price (7): arm64: realm: Query IPA size from the RMM arm64: Enforce bounce buffers for realm DMA arm64: mm: Avoid TLBI when marking pages as valid irqchip/gic-v3-its: Share ITS tables with a non-trusted hypervisor irqchip/gic-v3-its: Fix over allocation in itt_alloc_pool() irqchip/gic-v3-its: Rely on genpool alignment arm64: Document Arm Confidential Compute Suzuki K Poulose (10): arm64: rsi: Add RSI definitions arm64: Detect if in a realm and set RIPAS RAM arm64: rsi: Add support for checking whether an MMIO is protected arm64: rsi: Map unprotected MMIO as decrypted efi: arm64: Map Device with Prot Shared arm64: Enable memory encrypt for Realms arm64: realm: ioremap: Allow mapping memory as encrypted dma: Fix encryption bit clearing for dma_to_phys dma: Introduce generic dma_addr_*crypted helpers arm64: realm: Use aliased addresses for device DMA to shared buffers Will Deacon (3): arm64: mm: Add top-level dispatcher for internal mem_encrypt API arm64: mm: Add confidential computing hook to ioremap_prot() MAINTAINERS: Add CCA and pKVM CoCO guest support to the ARM64 entry Yiwei Zhuang (1): rme: make sure realm guest map memory in page granularity yxk (1): gicv3: add lpi support for virtcca cvm guest Documentation/ABI/testing/configfs-tsm | 82 ++++ Documentation/arch/arm64/arm-cca.rst | 69 +++ Documentation/arch/arm64/booting.rst | 3 + Documentation/arch/arm64/index.rst | 1 + MAINTAINERS | 10 + arch/arm64/Kconfig | 4 + arch/arm64/include/asm/io.h | 12 + arch/arm64/include/asm/mem_encrypt.h | 35 ++ arch/arm64/include/asm/pgtable-prot.h | 4 + arch/arm64/include/asm/pgtable.h | 5 + arch/arm64/include/asm/rsi.h | 68 +++ arch/arm64/include/asm/rsi_cmds.h | 160 +++++++ arch/arm64/include/asm/rsi_smc.h | 193 ++++++++ arch/arm64/include/asm/set_memory.h | 4 + arch/arm64/include/asm/virtcca_cvm_guest.h | 8 + arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/efi.c | 12 +- arch/arm64/kernel/rsi.c | 165 +++++++ arch/arm64/kernel/setup.c | 3 + arch/arm64/kernel/virtcca_cvm_guest.c | 24 + arch/arm64/mm/Makefile | 2 +- arch/arm64/mm/init.c | 10 +- arch/arm64/mm/ioremap.c | 23 +- arch/arm64/mm/mem_encrypt.c | 50 ++ arch/arm64/mm/pageattr.c | 98 +++- arch/parisc/mm/init.c | 16 +- drivers/irqchip/irq-gic-v3-its.c | 329 +++++-------- drivers/virt/Kconfig | 8 +- drivers/virt/Makefile | 5 +- drivers/virt/coco/Kconfig | 18 + drivers/virt/coco/Makefile | 10 + drivers/virt/coco/arm-cca-guest/Kconfig | 11 + drivers/virt/coco/arm-cca-guest/Makefile | 2 + .../virt/coco/arm-cca-guest/arm-cca-guest.c | 224 +++++++++ drivers/virt/coco/tsm.c | 452 ++++++++++++++++++ include/asm-generic/sections.h | 5 + include/linux/dma-direct.h | 13 +- include/linux/jump_label.h | 3 + include/linux/mem_encrypt.h | 23 + include/linux/slab.h | 2 + include/linux/tsm.h | 69 +++ include/linux/virtcca_cvm_domain.h | 10 + init/main.c | 1 + kernel/jump_label.c | 53 ++ 44 files changed, 2062 insertions(+), 239 deletions(-) create mode 100644 Documentation/ABI/testing/configfs-tsm create mode 100644 Documentation/arch/arm64/arm-cca.rst create mode 100644 arch/arm64/include/asm/mem_encrypt.h create mode 100644 arch/arm64/include/asm/rsi.h create mode 100644 arch/arm64/include/asm/rsi_cmds.h create mode 100644 arch/arm64/include/asm/rsi_smc.h create mode 100644 arch/arm64/kernel/rsi.c create mode 100644 arch/arm64/mm/mem_encrypt.c create mode 100644 drivers/virt/coco/Kconfig create mode 100644 drivers/virt/coco/Makefile create mode 100644 drivers/virt/coco/arm-cca-guest/Kconfig create mode 100644 drivers/virt/coco/arm-cca-guest/Makefile create mode 100644 drivers/virt/coco/arm-cca-guest/arm-cca-guest.c create mode 100644 drivers/virt/coco/tsm.c create mode 100644 include/linux/tsm.h -- 2.18.0.huawei.25

2 32

[openeuler:OLK-5.10 2978/2978] drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c:331:68: warning: suggest braces around empty body in an 'if' statement
by kernel test robot 23 Jun '25

23 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 5e8b5c945557e13053f64d08e9859d56c789362f commit: 79871cd2cd720225eb582c9ed49fb4a96a270b3b [2978/2978] net/hinic3: Synchronize new NIC features and bug fixes config: x86_64-buildonly-randconfig-002-20250623 (https://download.01.org/0day-ci/archive/20250623/202506232147.n7w5pLY6-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250623/202506232147.n7w5pLY6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506232147.n7w5pLY6-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:103:6: warning: no previous prototype for 'hinic3_uld_lock_init' [-Wmissing-prototypes] 103 | void hinic3_uld_lock_init(void) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:525:5: warning: no previous prototype for 'hinic3_pdev_is_virtfn' [-Wmissing-prototypes] 525 | u32 hinic3_pdev_is_virtfn(struct pci_dev *pdev) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:785:5: warning: no previous prototype for '__set_vroce_func_state' [-Wmissing-prototypes] 785 | int __set_vroce_func_state(struct hinic3_pcidev *pci_adapter) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:826:6: warning: no previous prototype for 'slave_host_mgmt_vroce_work' [-Wmissing-prototypes] 826 | void slave_host_mgmt_vroce_work(struct work_struct *work) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:834:7: warning: no previous prototype for 'hinic3_get_roce_uld_by_pdev' [-Wmissing-prototypes] 834 | void *hinic3_get_roce_uld_by_pdev(struct pci_dev *pdev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:1796:6: warning: no previous prototype for 'hinic3_set_func_state' [-Wmissing-prototypes] 1796 | void hinic3_set_func_state(struct hinic3_pcidev *pci_adapter) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:1822:6: warning: no previous prototype for 'slave_host_mgmt_work' [-Wmissing-prototypes] 1822 | void slave_host_mgmt_work(struct work_struct *work) | ^~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c:618:6: warning: no previous prototype for 'hinic3_write_oshr_info' [-Wmissing-prototypes] 618 | void hinic3_write_oshr_info(struct os_hot_replace_info *out_oshr_info, | ^~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:865:5: warning: no previous prototype for 'hinic3_global_func_id_hw' [-Wmissing-prototypes] 865 | u16 hinic3_global_func_id_hw(void *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c: In function 'cqm_buf_vram_free': >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c:331:68: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] 331 | (u64)buf->buf_size * buf->buf_number); | ^ -- >> drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:342:5: warning: no previous prototype for 'hinic3_rx_queue_stat_pack' [-Wmissing-prototypes] 342 | int hinic3_rx_queue_stat_pack(struct hinic3_show_item *item, | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:357:5: warning: no previous prototype for 'hinic3_tx_queue_stat_pack' [-Wmissing-prototypes] 357 | int hinic3_tx_queue_stat_pack(struct hinic3_show_item *item, | ^~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.c:1671:6: warning: no previous prototype for 'hinic3_is_optical_module_mode' [-Wmissing-prototypes] 1671 | bool hinic3_is_optical_module_mode(void *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:623:6: warning: no previous prototype for 'print_port_info' [-Wmissing-prototypes] 623 | void print_port_info(struct hinic3_nic_io *nic_io, | ^~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:802:6: warning: no previous prototype for 'hinic3_notify_vf_bond_status' [-Wmissing-prototypes] 802 | void hinic3_notify_vf_bond_status(struct hinic3_nic_io *nic_io, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:832:6: warning: no previous prototype for 'hinic3_notify_all_vfs_bond_changed' [-Wmissing-prototypes] 832 | void hinic3_notify_all_vfs_bond_changed(void *hwdev, u8 bond_status) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:1678:5: warning: no previous prototype for 'set_fecparam' [-Wmissing-prototypes] 1678 | int set_fecparam(void *hwdev, u8 fecparam) | ^~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:1706:5: warning: no previous prototype for 'get_fecparam' [-Wmissing-prototypes] 1706 | int get_fecparam(void *hwdev, u8 *advertised_fec, u8 *supported_fec) | ^~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic3/hinic3_main.c:1211:6: warning: no previous prototype for 'hinic3_need_proc_link_event' [-Wmissing-prototypes] 1211 | bool hinic3_need_proc_link_event(struct hinic3_lld_dev *lld_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hinic3_main.c:1258:6: warning: no previous prototype for 'hinic3_need_proc_bond_event' [-Wmissing-prototypes] 1258 | bool hinic3_need_proc_bond_event(struct hinic3_lld_dev *lld_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic3/cqm/cqm_object.h:7, from drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.h:11, from drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:15: >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:13:44: warning: no previous prototype for 'cqm3_cmd_alloc' [-Wmissing-prototypes] 13 | #define cqm_cmd_alloc cqm3_cmd_alloc | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:24:25: note: in expansion of macro 'cqm_cmd_alloc' 24 | struct tag_cqm_cmd_buf *cqm_cmd_alloc(void *ex_handle) | ^~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:14:44: warning: no previous prototype for 'cqm3_cmd_free' [-Wmissing-prototypes] 14 | #define cqm_cmd_free cqm3_cmd_free | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:44:6: note: in expansion of macro 'cqm_cmd_free' 44 | void cqm_cmd_free(void *ex_handle, struct tag_cqm_cmd_buf *cmd_buf) | ^~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:15:44: warning: no previous prototype for 'cqm3_send_cmd_box' [-Wmissing-prototypes] 15 | #define cqm_send_cmd_box cqm3_send_cmd_box | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:79:5: note: in expansion of macro 'cqm_send_cmd_box' 79 | s32 cqm_send_cmd_box(void *ex_handle, u8 mod, u8 cmd, struct tag_cqm_cmd_buf *buf_in, | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:16:44: warning: no previous prototype for 'cqm3_lb_send_cmd_box' [-Wmissing-prototypes] 16 | #define cqm_lb_send_cmd_box cqm3_lb_send_cmd_box | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:120:5: note: in expansion of macro 'cqm_lb_send_cmd_box' 120 | s32 cqm_lb_send_cmd_box(void *ex_handle, u8 mod, u8 cmd, u8 cos_id, | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_define.h:17:44: warning: no previous prototype for 'cqm3_lb_send_cmd_box_async' [-Wmissing-prototypes] 17 | #define cqm_lb_send_cmd_box_async cqm3_lb_send_cmd_box_async | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/cqm/cqm_cmd.c:158:5: note: in expansion of macro 'cqm_lb_send_cmd_box_async' 158 | s32 cqm_lb_send_cmd_box_async(void *ex_handle, u8 mod, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.c:176:5: warning: no previous prototype for 'hinic3_pci_sriov_check' [-Wmissing-prototypes] 176 | int hinic3_pci_sriov_check(struct hinic3_sriov_info *sriov_info, struct pci_dev *dev, int num_vfs) | ^~~~~~~~~~~~~~~~~~~~~~ vim +/if +331 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c 320 321 static void cqm_buf_vram_free(struct tag_cqm_buf *buf) 322 { 323 s32 i; 324 325 if (buf->buf_list == NULL) { 326 return; 327 } 328 329 if (buf->buf_list[0].va) 330 hi_vram_kfree(buf->buf_list[0].va, buf->buf_info.buf_vram_name, > 331 (u64)buf->buf_size * buf->buf_number); 332 333 for (i = 0; i < (s32)buf->buf_number; i++) 334 buf->buf_list[i].va = NULL; 335 } 336 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V2] sched: More flexible use of CPU quota when CPU is idle
by Cheng Yu 23 Jun '25

23 Jun '25

From: Zheng Zucheng <zhengzucheng(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICE7WC -------------------------------- This feature allows users to use CPU quota more flexibly when CPU is idle and it will cause the CPU quota to be exceeded. So, it cannot be used in scenarios where there are strict restrictions on the use of the CPU quota, such as some commercial scenarios that charge based on the use of CPU quota. Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Signed-off-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- arch/arm64/Kconfig | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/kernel/topology.c | 32 ++++++ include/linux/sched/sysctl.h | 4 + init/Kconfig | 18 +++ kernel/sched/core.c | 35 ++++++ kernel/sched/fair.c | 147 ++++++++++++++++++++++++- kernel/sched/features.h | 4 + kernel/sched/idle.c | 15 +++ kernel/sched/sched.h | 12 ++ kernel/sysctl.c | 11 ++ 11 files changed, 276 insertions(+), 4 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index eb30ef59aca2..4ba485650d0a 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -80,6 +80,7 @@ config ARM64 select ARCH_SUPPORTS_NUMA_BALANCING select ARCH_SUPPORTS_SCHED_KEEP_ON_CORE select ARCH_SUPPORTS_SCHED_PARAL + select ARCH_SUPPORTS_SCHED_SOFT_QUOTA select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH select ARCH_WANT_COMPAT_IPC_PARSE_VERSION if COMPAT select ARCH_WANT_DEFAULT_BPF_JIT diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index be1faf2da008..1e1e70a6736d 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -191,6 +191,7 @@ CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y CONFIG_SCHED_KEEP_ON_CORE=y CONFIG_SCHED_PARAL=y +CONFIG_SCHED_SOFT_QUOTA=y CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c index 785de5b9696d..b3ae5c6de81e 100644 --- a/arch/arm64/kernel/topology.c +++ b/arch/arm64/kernel/topology.c @@ -363,6 +363,38 @@ void topology_scale_freq_tick(void) this_cpu_write(arch_const_cycles_prev, const_cnt); } +#ifdef CONFIG_SCHED_SOFT_QUOTA +static DEFINE_PER_CPU(int, sibling_idle) = 1; + +int is_sibling_idle(void) +{ + return this_cpu_read(sibling_idle); +} + +static void smt_measurement_begin(void) +{ + // TODO +} + +static void smt_measurement_done(void) +{ + // TODO +} +#else +static inline void smt_measurement_begin(void) { } +static inline void smt_measurement_done(void) { } +#endif + +void arch_cpu_idle_enter(void) +{ + smt_measurement_begin(); +} + +void arch_cpu_idle_exit(void) +{ + smt_measurement_done(); +} + #ifdef CONFIG_ACPI_CPPC_LIB #include <acpi/cppc_acpi.h> diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index 9f998be56bdd..90021477ea4c 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -48,6 +48,10 @@ extern unsigned int sysctl_smart_grid_strategy_ctrl; extern int sysctl_affinity_adjust_delay_ms; #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +extern unsigned int sysctl_soft_runtime_ratio; +#endif + enum sched_tunable_scaling { SCHED_TUNABLESCALING_NONE, SCHED_TUNABLESCALING_LOG, diff --git a/init/Kconfig b/init/Kconfig index 5f88cce193e8..2ee50c638ca3 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1411,6 +1411,24 @@ config SCHED_PARAL 3. The existing "qos dynamic affinity" and "qos smart grid" features must not be used simultaneously. +# +# For architectures that want to enable the support for SCHED_SOFT_QUOTA +# +config ARCH_SUPPORTS_SCHED_SOFT_QUOTA + bool + +config SCHED_SOFT_QUOTA + bool "More flexible use of CPU quota" + depends on ARCH_SUPPORTS_SCHED_SOFT_QUOTA + depends on CFS_BANDWIDTH + default n + help + This option allows users to use CPU quota more flexibly when CPU + is idle. It is better for users to have some understanding of + CFS_BANDWIDTH. It cannot be used in scenarios where there are strict + restrictions on the use of the CPU quota, such as some commercial + scenarios that charge based on the use of CPU quota. + config CHECKPOINT_RESTORE bool "Checkpoint/restore support" select PROC_CHILDREN diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 457eeebc7b62..f14ba71f26ce 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -9902,6 +9902,33 @@ static int cpu_steal_task_write(struct cgroup_subsys_state *css, } #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +static int cpu_soft_quota_write(struct cgroup_subsys_state *css, + struct cftype *cftype, s64 soft_quota) +{ + struct task_group *tg = css_tg(css); + + if (!sched_feat(SOFT_QUOTA)) + return -EINVAL; + + if (soft_quota != 1 && soft_quota != 0) + return -EINVAL; + + if (tg->soft_quota == soft_quota) + return 0; + + tg->soft_quota = soft_quota; + + return 0; +} + +static inline s64 cpu_soft_quota_read(struct cgroup_subsys_state *css, + struct cftype *cft) +{ + return css_tg(css)->soft_quota; +} +#endif + #ifdef CONFIG_BPF_SCHED void sched_settag(struct task_struct *tsk, s64 tag) { @@ -10064,6 +10091,14 @@ static struct cftype cpu_legacy_files[] = { .write_s64 = cpu_qos_write, }, #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + { + .name = "soft_quota", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_soft_quota_read, + .write_s64 = cpu_soft_quota_write, + }, +#endif #ifdef CONFIG_QOS_SCHED_SMT_EXPELLER { .name = "smt_expell", diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index b7544a14225c..8c4993ec7059 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -140,6 +140,10 @@ static int unthrottle_qos_cfs_rqs(int cpu); static bool qos_smt_expelled(int this_cpu); #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +static DEFINE_PER_CPU_SHARED_ALIGNED(struct list_head, soft_quota_throttled_cfs_rq); +#endif + #ifdef CONFIG_QOS_SCHED_MULTILEVEL #define QOS_LEVEL_WEIGHT_OFFLINE_EX 1 #define QOS_LEVEL_WEIGHT_OFFLINE 10 @@ -439,10 +443,11 @@ static inline struct sched_entity *parent_entity(struct sched_entity *se) return se->parent; } -static void +static bool find_matching_se(struct sched_entity **se, struct sched_entity **pse) { int se_depth, pse_depth; + bool ret = false; /* * preemption test can be made between sibling entities who are in the @@ -456,6 +461,11 @@ find_matching_se(struct sched_entity **se, struct sched_entity **pse) pse_depth = (*pse)->depth; while (se_depth > pse_depth) { +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (sched_feat(SOFT_QUOTA) && !ret && + cfs_rq_of(*se)->soft_quota_enable == 1) + ret = true; +#endif se_depth--; *se = parent_entity(*se); } @@ -466,9 +476,16 @@ find_matching_se(struct sched_entity **se, struct sched_entity **pse) } while (!is_same_group(*se, *pse)) { +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (sched_feat(SOFT_QUOTA) && !ret && + cfs_rq_of(*se)->soft_quota_enable == 1) + ret = true; +#endif *se = parent_entity(*se); *pse = parent_entity(*pse); } + + return ret; } #else /* !CONFIG_FAIR_GROUP_SCHED */ @@ -503,9 +520,10 @@ static inline struct sched_entity *parent_entity(struct sched_entity *se) return NULL; } -static inline void +static inline bool find_matching_se(struct sched_entity **se, struct sched_entity **pse) { + return false; } #endif /* CONFIG_FAIR_GROUP_SCHED */ @@ -5396,6 +5414,14 @@ static bool throttle_cfs_rq(struct cfs_rq *cfs_rq) */ cfs_rq->throttled = 1; cfs_rq->throttled_clock = rq_clock(rq); + +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (sched_feat(SOFT_QUOTA) && cfs_rq->tg->soft_quota == 1) { + list_add(&cfs_rq->soft_quota_throttled_list, + &per_cpu(soft_quota_throttled_cfs_rq, cpu_of(rq))); + } +#endif + return true; } @@ -5414,6 +5440,11 @@ void unthrottle_cfs_rq(struct cfs_rq *cfs_rq) se = cfs_rq->tg->se[cpu_of(rq)]; +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (sched_feat(SOFT_QUOTA)) + list_del_init(&cfs_rq->soft_quota_throttled_list); +#endif + #ifdef CONFIG_QOS_SCHED /* * if this cfs_rq throttled by qos, not need unthrottle it. @@ -5531,6 +5562,16 @@ static void distribute_cfs_runtime(struct cfs_bandwidth *cfs_b) struct rq_flags rf; rq_lock_irqsave(rq, &rf); + +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (sched_feat(SOFT_QUOTA) && cfs_rq->soft_quota_enable == 1) { + if (cfs_rq->runtime_remaining > 0) + cfs_rq->runtime_remaining = 0; + + cfs_rq->soft_quota_enable = 0; + } +#endif + if (!cfs_rq_throttled(cfs_rq)) goto next; @@ -5573,6 +5614,17 @@ static void distribute_cfs_runtime(struct cfs_bandwidth *cfs_b) rcu_read_unlock(); } +#ifdef CONFIG_SCHED_SOFT_QUOTA +static inline void init_tg_sum_soft_runtime(struct cfs_bandwidth *cfs_b) +{ + unsigned int cpu; + struct task_group *tg = container_of(cfs_b, struct task_group, cfs_bandwidth); + + for_each_possible_cpu(cpu) + tg->cfs_rq[cpu]->sum_soft_runtime = 0; +} +#endif + /* * Responsible for refilling a task_group's bandwidth and unthrottling its * cfs_rqs as appropriate. If there has been no activity within the last @@ -5590,6 +5642,11 @@ static int do_sched_cfs_period_timer(struct cfs_bandwidth *cfs_b, int overrun, u throttled = !list_empty(&cfs_b->throttled_cfs_rq); cfs_b->nr_periods += overrun; +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (sched_feat(SOFT_QUOTA)) + init_tg_sum_soft_runtime(cfs_b); +#endif + /* Refill extra burst quota even if cfs_b->idle */ __refill_cfs_bandwidth_runtime(cfs_b); @@ -5898,6 +5955,9 @@ static void init_cfs_rq_runtime(struct cfs_rq *cfs_rq) #ifdef CONFIG_QOS_SCHED INIT_LIST_HEAD(&cfs_rq->qos_throttled_list); #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + INIT_LIST_HEAD(&cfs_rq->soft_quota_throttled_list); +#endif } void start_cfs_bandwidth(struct cfs_bandwidth *cfs_b) @@ -8536,6 +8596,7 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ struct cfs_rq *cfs_rq = task_cfs_rq(curr); int scale = cfs_rq->nr_running >= sched_nr_latency; int next_buddy_marked = 0; + bool ret = 0; if (unlikely(se == pse)) return; @@ -8590,7 +8651,13 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ if (unlikely(p->policy != SCHED_NORMAL) || !sched_feat(WAKEUP_PREEMPTION)) return; - find_matching_se(&se, &pse); + ret = find_matching_se(&se, &pse); + +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (sched_feat(SOFT_QUOTA) && ret) + goto preempt; +#endif + update_curr(cfs_rq_of(se)); BUG_ON(!pse); if (wakeup_preempt_entity(se, pse) == 1) { @@ -13823,6 +13890,9 @@ static void task_change_group_fair(struct task_struct *p, int type) void free_fair_sched_group(struct task_group *tg) { int i; +#ifdef CONFIG_SCHED_SOFT_QUOTA + struct cfs_rq *cfs_rq; +#endif destroy_cfs_bandwidth(tg_cfs_bandwidth(tg)); destroy_auto_affinity(tg); @@ -13831,6 +13901,12 @@ void free_fair_sched_group(struct task_group *tg) #ifdef CONFIG_QOS_SCHED if (tg->cfs_rq && tg->cfs_rq[i]) unthrottle_qos_sched_group(tg->cfs_rq[i]); +#endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (tg->cfs_rq && tg->cfs_rq[i]) { + cfs_rq = tg->cfs_rq[i]; + list_del_init(&cfs_rq->soft_quota_throttled_list); + } #endif if (tg->cfs_rq) kfree(tg->cfs_rq[i]); @@ -14209,13 +14285,20 @@ void task_tick_relationship(struct rq *rq, struct task_struct *curr) __init void init_sched_fair_class(void) { -#ifdef CONFIG_QOS_SCHED +#if defined(CONFIG_QOS_SCHED) || defined(CONFIG_SCHED_SOFT_QUOTA) int i; +#endif +#ifdef CONFIG_QOS_SCHED for_each_possible_cpu(i) INIT_LIST_HEAD(&per_cpu(qos_throttled_cfs_rq, i)); #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + for_each_possible_cpu(i) + INIT_LIST_HEAD(&per_cpu(soft_quota_throttled_cfs_rq, i)); +#endif + init_sched_numa_icon(); #ifdef CONFIG_SMP @@ -14327,3 +14410,59 @@ int sched_trace_rq_nr_running(struct rq *rq) return rq ? rq->nr_running : -1; } EXPORT_SYMBOL_GPL(sched_trace_rq_nr_running); + +#ifdef CONFIG_SCHED_SOFT_QUOTA +unsigned int sysctl_soft_runtime_ratio = 20; +static bool check_soft_runtime(struct task_group *tg, int slice) +{ + int cpu; + u64 sum_soft_runtime = slice; + struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth; + + if (cfs_b->quota == RUNTIME_INF) + return true; + + for_each_possible_cpu(cpu) + sum_soft_runtime += tg->cfs_rq[cpu]->sum_soft_runtime; + + return sum_soft_runtime < sysctl_soft_runtime_ratio * cfs_b->quota / 100; +} + +bool unthrottle_cfs_rq_soft_quota(struct rq *rq) +{ + int max_cnt = 0; + bool ret = false; + struct cfs_rq *cfs_rq, *tmp_rq; + struct cfs_bandwidth *cfs_b; + int slice = sched_cfs_bandwidth_slice(); + + list_for_each_entry_safe(cfs_rq, tmp_rq, &per_cpu(soft_quota_throttled_cfs_rq, cpu_of(rq)), + soft_quota_throttled_list) { + if (max_cnt++ > 20) + break; + + if (cfs_rq->throttled) { + cfs_b = tg_cfs_bandwidth(cfs_rq->tg); + raw_spin_lock(&cfs_b->lock); + + if (!check_soft_runtime(cfs_rq->tg, slice)) { + raw_spin_unlock(&cfs_b->lock); + continue; + } + + raw_spin_unlock(&cfs_b->lock); + + if (cfs_rq->runtime_remaining + slice > 0) { + cfs_rq->runtime_remaining += slice; + cfs_rq->sum_soft_runtime += slice; + cfs_rq->soft_quota_enable = 1; + unthrottle_cfs_rq(cfs_rq); + ret = true; + break; + } + } + } + + return ret; +} +#endif diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 1fd89af55681..c887b0d384ae 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -78,6 +78,10 @@ SCHED_FEAT(KEEP_ON_CORE, false) SCHED_FEAT(PARAL, false) #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +SCHED_FEAT(SOFT_QUOTA, false) +#endif + /* * Issue a WARN when we do multiple update_rq_clock() calls * in a single rq->lock section. Default disabled because the diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c index 3c6396d61a04..7aa0a1653bd0 100644 --- a/kernel/sched/idle.c +++ b/kernel/sched/idle.c @@ -439,10 +439,25 @@ static struct task_struct *pick_task_idle(struct rq *rq) } #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +int __weak is_sibling_idle(void) +{ + return 0; +} +#endif + struct task_struct *pick_next_task_idle(struct rq *rq) { struct task_struct *next = rq->idle; +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (sched_feat(SOFT_QUOTA)) { + if (unthrottle_cfs_rq_soft_quota(rq) && rq->cfs.nr_running && + is_sibling_idle()) + return pick_next_task_fair(rq, NULL, NULL); + } +#endif + set_next_task_idle(rq, next, true); return next; diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index fe6342305b0f..9b2779e8fc91 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -508,6 +508,9 @@ struct task_group { #else KABI_RESERVE(4) #endif +#if defined(CONFIG_SCHED_SOFT_QUOTA) + KABI_EXTEND(u64 soft_quota) +#endif }; #ifdef CONFIG_SCHED_STEAL @@ -606,6 +609,10 @@ static inline int init_auto_affinity(struct task_group *tg) static inline void tg_update_affinity_domains(int cpu, int online) {} #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +extern bool unthrottle_cfs_rq_soft_quota(struct rq *rq); +#endif + #ifdef CONFIG_FAIR_GROUP_SCHED extern int sched_group_set_shares(struct task_group *tg, unsigned long shares); @@ -734,6 +741,11 @@ struct cfs_rq { KABI_RESERVE(3) KABI_RESERVE(4) #endif +#if defined(CONFIG_SCHED_SOFT_QUOTA) + KABI_EXTEND(u64 soft_quota_enable) + KABI_EXTEND(u64 sum_soft_runtime) + KABI_EXTEND(struct list_head soft_quota_throttled_list) +#endif }; static inline int rt_bandwidth_enabled(void) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 0b1c13a05332..738d9a4455c1 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2831,6 +2831,17 @@ static struct ctl_table kern_table[] = { .extra2 = &one_hundred, }, #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + { + .procname = "sched_soft_runtime_ratio", + .data = &sysctl_soft_runtime_ratio, + .maxlen = sizeof(sysctl_soft_runtime_ratio), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ONE, + .extra2 = &one_hundred, + }, +#endif #ifdef CONFIG_SCHED_STEAL { .procname = "sched_max_steal_count", -- 2.25.1

2 1

[PATCH OLK-6.10] ALSA: pcm: Fix race of buffer access at PCM OSS layer
by Luo Gengkun 23 Jun '25

23 Jun '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.93 commit 74d90875f3d43f3eff0e9861c4701418795d3455 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGACK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 93a81ca0657758b607c3f4ba889ae806be9beb73 upstream. The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed runtime->dma_area might be freed concurrently, as it's performed outside the PCM ops. For avoiding it, move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed during the operation. Reported-by: syzbot+32d4647f551007595173(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- include/sound/pcm.h | 2 ++ sound/core/oss/pcm_oss.c | 3 +-- sound/core/pcm_native.c | 11 +++++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/include/sound/pcm.h b/include/sound/pcm.h index 2a815373dac1..ed4449cbdf80 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -1427,6 +1427,8 @@ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_s #define snd_pcm_lib_mmap_iomem NULL #endif +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime); + /** * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer * @dma: DMA number diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 728c211142d1..471de2d1b37a 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1085,8 +1085,7 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) runtime->oss.params = 0; runtime->oss.prepare = 1; runtime->oss.buffer_used = 0; - if (runtime->dma_area) - snd_pcm_format_set_silence(runtime->format, runtime->dma_area, bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_runtime_buffer_set_silence(runtime); runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size); diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index e40de64ec85c..31fc20350fd9 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -703,6 +703,17 @@ static void snd_pcm_buffer_access_unlock(struct snd_pcm_runtime *runtime) atomic_inc(&runtime->buffer_accessing); } +/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime) +{ + snd_pcm_buffer_access_lock(runtime); + if (runtime->dma_area) + snd_pcm_format_set_silence(runtime->format, runtime->dma_area, + bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_buffer_access_unlock(runtime); +} +EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence); + #if IS_ENABLED(CONFIG_SND_PCM_OSS) #define is_oss_stream(substream) ((substream)->oss.oss) #else -- 2.34.1

1 0

[PATCH OLK-5.10] ALSA: pcm: Fix race of buffer access at PCM OSS layer
by Luo Gengkun 23 Jun '25

23 Jun '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.238 commit 8170d8ec4efd0be352c14cb61f374e30fb0c2a25 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGACK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 93a81ca0657758b607c3f4ba889ae806be9beb73 upstream. The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed runtime->dma_area might be freed concurrently, as it's performed outside the PCM ops. For avoiding it, move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed during the operation. Reported-by: syzbot+32d4647f551007595173(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- include/sound/pcm.h | 2 ++ sound/core/oss/pcm_oss.c | 3 +-- sound/core/pcm_native.c | 11 +++++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/include/sound/pcm.h b/include/sound/pcm.h index 6554a9f71c62..c573c6a7da12 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -1334,6 +1334,8 @@ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_s #define snd_pcm_lib_mmap_iomem NULL #endif +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime); + /** * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer * @dma: DMA number diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index de6f94bee50b..8eb5fef41dbe 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1078,8 +1078,7 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) runtime->oss.params = 0; runtime->oss.prepare = 1; runtime->oss.buffer_used = 0; - if (runtime->dma_area) - snd_pcm_format_set_silence(runtime->format, runtime->dma_area, bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_runtime_buffer_set_silence(runtime); runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size); diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index 9425fcd30c4c..98bd6fe850d3 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -685,6 +685,17 @@ static void snd_pcm_buffer_access_unlock(struct snd_pcm_runtime *runtime) atomic_inc(&runtime->buffer_accessing); } +/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime) +{ + snd_pcm_buffer_access_lock(runtime); + if (runtime->dma_area) + snd_pcm_format_set_silence(runtime->format, runtime->dma_area, + bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_buffer_access_unlock(runtime); +} +EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence); + #if IS_ENABLED(CONFIG_SND_PCM_OSS) #define is_oss_stream(substream) ((substream)->oss.oss) #else -- 2.34.1

2 1

[openeuler:OLK-5.10 2978/2978] drivers/net/ethernet/huawei/hinic3/hinic3_irq.c:22:5: warning: no previous prototype for 'hinic3_poll'
by kernel test robot 23 Jun '25

23 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 04dbc107e40be138cc70f7d15d50779f5538f412 commit: ebcedbe6ddb7bfcb756769994b3a796c771b43f5 [2978/2978] net/hinic3: Add Huawei Intelligent Network Card Driver: hinic3 config: x86_64-buildonly-randconfig-002-20250623 (https://download.01.org/0day-ci/archive/20250623/202506231925.HQ2gIERd-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250623/202506231925.HQ2gIERd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506231925.HQ2gIERd-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/huawei/hinic3/hinic3_irq.c:22:5: warning: no previous prototype for 'hinic3_poll' [-Wmissing-prototypes] 22 | int hinic3_poll(struct napi_struct *napi, int budget) | ^~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:76:6: warning: no previous prototype for 'hinic3_uld_lock_init' [-Wmissing-prototypes] 76 | void hinic3_uld_lock_init(void) | ^~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic3/hinic3_rx.c:740:5: warning: no previous prototype for 'hinic3_run_xdp' [-Wmissing-prototypes] 740 | int hinic3_run_xdp(struct hinic3_rxq *rxq, u32 pkt_len) | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hinic3_rx.c:1156:5: warning: no previous prototype for 'rxq_restore' [-Wmissing-prototypes] 1156 | int rxq_restore(struct hinic3_nic_dev *nic_dev, u16 q_id, u16 hw_ci) | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_rx.c:1254:6: warning: no previous prototype for 'rxq_is_normal' [-Wmissing-prototypes] 1254 | bool rxq_is_normal(struct hinic3_rxq *rxq, struct rxq_check_info rxq_info) | ^~~~~~~~~~~~~ -- drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c:346:6: warning: no previous prototype for 'hinic3_flush_rx_flow_rule' [-Wmissing-prototypes] 346 | void hinic3_flush_rx_flow_rule(struct hinic3_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c:785:5: warning: no previous prototype for 'hinic3_ethtool_flow_replace' [-Wmissing-prototypes] 785 | int hinic3_ethtool_flow_replace(struct hinic3_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c:830:5: warning: no previous prototype for 'hinic3_ethtool_flow_remove' [-Wmissing-prototypes] 830 | int hinic3_ethtool_flow_remove(struct hinic3_nic_dev *nic_dev, u32 location) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c:852:5: warning: no previous prototype for 'hinic3_ethtool_get_flow' [-Wmissing-prototypes] 852 | int hinic3_ethtool_get_flow(const struct hinic3_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c:875:5: warning: no previous prototype for 'hinic3_ethtool_get_all_flows' [-Wmissing-prototypes] 875 | int hinic3_ethtool_get_all_flows(const struct hinic3_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c:893:6: warning: no previous prototype for 'hinic3_validate_channel_setting_in_ntuple' [-Wmissing-prototypes] 893 | bool hinic3_validate_channel_setting_in_ntuple(const struct hinic3_nic_dev *nic_dev, u32 q_num) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.c:19:5: warning: no previous prototype for 'hinic3_dbg_get_wqe_info' [-Wmissing-prototypes] 19 | int hinic3_dbg_get_wqe_info(void *hwdev, u16 q_id, u16 idx, u16 wqebb_cnt, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.c:60:5: warning: no previous prototype for 'hinic3_dbg_get_sq_info' [-Wmissing-prototypes] 60 | int hinic3_dbg_get_sq_info(void *hwdev, u16 q_id, struct nic_sq_info *sq_info, | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.c:103:5: warning: no previous prototype for 'hinic3_dbg_get_rq_info' [-Wmissing-prototypes] 103 | int hinic3_dbg_get_rq_info(void *hwdev, u16 q_id, struct nic_rq_info *rq_info, | ^~~~~~~~~~~~~~~~~~~~~~ vim +/hinic3_poll +22 drivers/net/ethernet/huawei/hinic3/hinic3_irq.c 21 > 22 int hinic3_poll(struct napi_struct *napi, int budget) 23 { 24 int tx_pkts, rx_pkts; 25 struct hinic3_irq *irq_cfg = 26 container_of(napi, struct hinic3_irq, napi); 27 struct hinic3_nic_dev *nic_dev = netdev_priv(irq_cfg->netdev); 28 29 rx_pkts = hinic3_rx_poll(irq_cfg->rxq, budget); 30 31 tx_pkts = hinic3_tx_poll(irq_cfg->txq, budget); 32 if (tx_pkts >= budget || rx_pkts >= budget) 33 return budget; 34 35 napi_complete(napi); 36 37 hinic3_set_msix_state(nic_dev->hwdev, irq_cfg->msix_entry_idx, 38 HINIC3_MSIX_ENABLE); 39 40 return max(tx_pkts, rx_pkts); 41 } 42 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0