- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] [Backport] backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
by Yuntao Liu 12 May '25

12 May '25

From: Herve Codina <herve.codina(a)bootlin.com> stable inclusion from stable-v5.10.237 commit 87d947a0607be384bfe7bb0935884a711e35ca07 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BJZ CVE: CVE-2025-23144 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 276822a00db3c1061382b41e72cafc09d6a0ec30 ] Lockdep detects the following issue on led-backlight removal: [ 142.315935] ------------[ cut here ]------------ [ 142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80 ... [ 142.500725] Call trace: [ 142.503176] led_sysfs_enable+0x54/0x80 (P) [ 142.507370] led_bl_remove+0x80/0xa8 [led_bl] [ 142.511742] platform_remove+0x30/0x58 [ 142.515501] device_remove+0x54/0x90 ... Indeed, led_sysfs_enable() has to be called with the led_access lock held. Hold the lock when calling led_sysfs_disable(). Fixes: ae232e45acf9 ("backlight: add led-backlight driver") Cc: stable(a)vger.kernel.org Signed-off-by: Herve Codina <herve.codina(a)bootlin.com> Link: https://lore.kernel.org/r/20250122091914.309533-1-herve.codina@bootlin.com Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/video/backlight/led_bl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/video/backlight/led_bl.c b/drivers/video/backlight/led_bl.c index f54d256e2d54..1020e4405a4d 100644 --- a/drivers/video/backlight/led_bl.c +++ b/drivers/video/backlight/led_bl.c @@ -226,8 +226,11 @@ static int led_bl_remove(struct platform_device *pdev) backlight_device_unregister(bl); led_bl_power_off(priv); - for (i = 0; i < priv->nb_leds; i++) + for (i = 0; i < priv->nb_leds; i++) { + mutex_lock(&priv->leds[i]->led_access); led_sysfs_enable(priv->leds[i]); + mutex_unlock(&priv->leds[i]->led_access); + } return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
by Yuntao Liu 12 May '25

12 May '25

From: Herve Codina <herve.codina(a)bootlin.com> stable inclusion from stable-v6.6.88 commit 1c82f5a393d8b9a5c1ea032413719862098afd4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BJZ CVE: CVE-2025-23144 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 276822a00db3c1061382b41e72cafc09d6a0ec30 upstream. Lockdep detects the following issue on led-backlight removal: [ 142.315935] ------------[ cut here ]------------ [ 142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80 ... [ 142.500725] Call trace: [ 142.503176] led_sysfs_enable+0x54/0x80 (P) [ 142.507370] led_bl_remove+0x80/0xa8 [led_bl] [ 142.511742] platform_remove+0x30/0x58 [ 142.515501] device_remove+0x54/0x90 ... Indeed, led_sysfs_enable() has to be called with the led_access lock held. Hold the lock when calling led_sysfs_disable(). Fixes: ae232e45acf9 ("backlight: add led-backlight driver") Cc: stable(a)vger.kernel.org Signed-off-by: Herve Codina <herve.codina(a)bootlin.com> Link: https://lore.kernel.org/r/20250122091914.309533-1-herve.codina@bootlin.com Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/video/backlight/led_bl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/video/backlight/led_bl.c b/drivers/video/backlight/led_bl.c index 032f8bddf872..0e53e427a91d 100644 --- a/drivers/video/backlight/led_bl.c +++ b/drivers/video/backlight/led_bl.c @@ -229,8 +229,11 @@ static void led_bl_remove(struct platform_device *pdev) backlight_device_unregister(bl); led_bl_power_off(priv); - for (i = 0; i < priv->nb_leds; i++) + for (i = 0; i < priv->nb_leds; i++) { + mutex_lock(&priv->leds[i]->led_access); led_sysfs_enable(priv->leds[i]); + mutex_unlock(&priv->leds[i]->led_access); + } } static const struct of_device_id led_bl_of_match[] = { -- 2.34.1

2 1

[PATCH OLK-6.6] cifs: avoid NULL pointer dereference in dbg call
by Wang Zhaolong 12 May '25

12 May '25

From: Alexandra Diupina <adiupina(a)astralinux.ru> mainline inclusion from mainline-v6.15-rc1 commit b4885bd5935bb26f0a414ad55679a372e53f9b9b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6Q1P CVE: CVE-2025-37844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cifs_server_dbg() implies server to be non-NULL so move call under condition to avoid NULL pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: e79b0332ae06 ("cifs: ignore cached share root handle closing errors") Cc: stable(a)vger.kernel.org Signed-off-by: Alexandra Diupina <adiupina(a)astralinux.ru> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/smb/client/smb2misc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c index 677ef6f99a5b..fadc5fc274eb 100644 --- a/fs/smb/client/smb2misc.c +++ b/fs/smb/client/smb2misc.c @@ -814,15 +814,16 @@ smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, netfs_trace_tcon_ref_see_cancelled_close); WARN_ONCE(tcon->tc_count < 0, "tcon refcount is negative"); spin_unlock(&cifs_tcp_ses_lock); - if (tcon->ses) + if (tcon->ses) { server = tcon->ses->server; - - cifs_server_dbg(FYI, "tid=0x%x: tcon is closing, skipping async close retry of fid %llu %llu\n", - tcon->tid, persistent_fid, volatile_fid); + cifs_server_dbg(FYI, + "tid=0x%x: tcon is closing, skipping async close retry of fid %llu %llu\n", + tcon->tid, persistent_fid, volatile_fid); + } return 0; } tcon->tc_count++; trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, -- 2.34.3

2 1

[PATCH OLK-5.10] cifs: avoid NULL pointer dereference in dbg call
by Wang Zhaolong 12 May '25

12 May '25

From: Alexandra Diupina <adiupina(a)astralinux.ru> mainline inclusion from mainline-v6.15-rc1 commit b4885bd5935bb26f0a414ad55679a372e53f9b9b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6Q1P CVE: CVE-2025-37844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cifs_server_dbg() implies server to be non-NULL so move call under condition to avoid NULL pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: e79b0332ae06 ("cifs: ignore cached share root handle closing errors") Cc: stable(a)vger.kernel.org Signed-off-by: Alexandra Diupina <adiupina(a)astralinux.ru> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/smb2misc.c fs/cifs/smb2misc.c [The file path has been changed.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/smb2misc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c index edffa5657d26..074a56796092 100644 --- a/fs/cifs/smb2misc.c +++ b/fs/cifs/smb2misc.c @@ -807,15 +807,16 @@ smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, struct TCP_Server_Info *server = NULL; WARN_ONCE(tcon->tc_count < 0, "tcon refcount is negative"); spin_unlock(&cifs_tcp_ses_lock); - if (tcon->ses) + if (tcon->ses) { server = tcon->ses->server; - cifs_server_dbg(FYI, "tid=%u: tcon is closing, skipping async close retry of fid %llu %llu\n", - tcon->tid, persistent_fid, volatile_fid); + cifs_server_dbg(FYI, "tid=%u: tcon is closing, skipping async close retry of fid %llu %llu\n", + tcon->tid, persistent_fid, volatile_fid); + } return 0; } tcon->tc_count++; spin_unlock(&cifs_tcp_ses_lock); -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] jbd2: remove wrong sb->s_sequence check
by Zizhi Wo 12 May '25

12 May '25

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.237 commit b479839525fe7906966cdc4b5b2afbca048558a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6LPS CVE: CVE-2025-37839 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e6eff39dd0fe4190c6146069cc16d160e71d1148 upstream. Journal emptiness is not determined by sb->s_sequence == 0 but rather by sb->s_start == 0 (which is set a few lines above). Furthermore 0 is a valid transaction ID so the check can spuriously trigger. Remove the invalid WARN_ON. CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20250206094657.20865-3-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/jbd2/journal.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index bf83e1c64aa4..5dddfc493ca7 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1517,7 +1517,6 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, /* Log is no longer empty */ write_lock(&journal->j_state_lock); - WARN_ON(!sb->s_sequence); journal->j_flags &= ~JBD2_FLUSHED; write_unlock(&journal->j_state_lock); -- 2.39.2

2 1

[PATCH OLK-5.10] jbd2: remove wrong sb->s_sequence check
by Zizhi Wo 12 May '25

12 May '25

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.237 commit b479839525fe7906966cdc4b5b2afbca048558a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6LPS CVE: CVE-2025-37839 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e6eff39dd0fe4190c6146069cc16d160e71d1148 upstream. Journal emptiness is not determined by sb->s_sequence == 0 but rather by sb->s_start == 0 (which is set a few lines above). Furthermore 0 is a valid transaction ID so the check can spuriously trigger. Remove the invalid WARN_ON. CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20250206094657.20865-3-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/jbd2/journal.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index 7775ad53b291..cc83decc6425 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1705,7 +1705,6 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, /* Log is no longer empty */ write_lock(&journal->j_state_lock); - WARN_ON(!sb->s_sequence); journal->j_flags &= ~JBD2_FLUSHED; write_unlock(&journal->j_state_lock); -- 2.39.2

2 1

[PATCH openeuler-1.0-LTS] jbd2: remove wrong sb->s_sequence check
by Zizhi Wo 12 May '25

12 May '25

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.237 commit b479839525fe7906966cdc4b5b2afbca048558a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6LPS CVE: CVE-2025-37839 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e6eff39dd0fe4190c6146069cc16d160e71d1148 upstream. Journal emptiness is not determined by sb->s_sequence == 0 but rather by sb->s_start == 0 (which is set a few lines above). Furthermore 0 is a valid transaction ID so the check can spuriously trigger. Remove the invalid WARN_ON. CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20250206094657.20865-3-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/jbd2/journal.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index bf83e1c64aa4..5dddfc493ca7 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1517,7 +1517,6 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, /* Log is no longer empty */ write_lock(&journal->j_state_lock); - WARN_ON(!sb->s_sequence); journal->j_flags &= ~JBD2_FLUSHED; write_unlock(&journal->j_state_lock); -- 2.39.2

2 1

[PATCH OLK-5.10] cachefiles: Fix non-taking of sb_writers around set/removexattr
by Zizhi Wo 12 May '25

12 May '25

From: David Howells <dhowells(a)redhat.com> stable inclusion from stable-v6.6.54 commit 81b048b9484bf8b3c0ad6e901a6b79fb941173b0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC711Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 80887f31672970abae3aaa9cf62ac72a124e7c89 ] Unlike other vfs_xxxx() calls, vfs_setxattr() and vfs_removexattr() don't take the sb_writers lock, so the caller should do it for them. Fix cachefiles to do this. Fixes: 9ae326a69004 ("CacheFiles: A cache that backs onto a mounted filesystem") Signed-off-by: David Howells <dhowells(a)redhat.com> cc: Christian Brauner <brauner(a)kernel.org> cc: Gao Xiang <xiang(a)kernel.org> cc: netfs(a)lists.linux.dev cc: linux-erofs(a)lists.ozlabs.org cc: linux-fsdevel(a)vger.kernel.org Link: https://lore.kernel.org/r/20240814203850.2240469-3-dhowells@redhat.com/ # v2 Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/cachefiles/internal.h fs/cachefiles/bind.c fs/cachefiles/xattr.c [The code has changed and relevant adaptations have been made.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cachefiles/bind.c | 2 +- fs/cachefiles/internal.h | 3 +- fs/cachefiles/xattr.c | 69 +++++++++++++++++++++++++++++----------- 3 files changed, 54 insertions(+), 20 deletions(-) diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c index 3a88bef9ed4b..8c84bfcde991 100644 --- a/fs/cachefiles/bind.c +++ b/fs/cachefiles/bind.c @@ -206,7 +206,7 @@ static int cachefiles_daemon_add_cache(struct cachefiles_cache *cache) fsdef->dentry = cachedir; fsdef->fscache.cookie = NULL; - ret = cachefiles_check_object_type(fsdef); + ret = cachefiles_check_object_type(fsdef, cache); if (ret < 0) goto error_unsupported; diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h index 97c4b4c639b4..96d96926017e 100644 --- a/fs/cachefiles/internal.h +++ b/fs/cachefiles/internal.h @@ -368,7 +368,8 @@ static inline void cachefiles_end_secure(struct cachefiles_cache *cache, /* * xattr.c */ -extern int cachefiles_check_object_type(struct cachefiles_object *object); +extern int cachefiles_check_object_type(struct cachefiles_object *object, + struct cachefiles_cache *cache); extern int cachefiles_set_object_xattr(struct cachefiles_object *object, struct cachefiles_xattr *auxdata); extern int cachefiles_update_object_xattr(struct cachefiles_object *object, diff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c index 4aadace026d2..bac55fc7359e 100644 --- a/fs/cachefiles/xattr.c +++ b/fs/cachefiles/xattr.c @@ -45,7 +45,8 @@ static int cachefiles_check_new_obj_xattr(struct cachefiles_object *object); * check the type label on an object * - done using xattrs */ -int cachefiles_check_object_type(struct cachefiles_object *object) +int cachefiles_check_object_type(struct cachefiles_object *object, + struct cachefiles_cache *cache) { struct dentry *dentry = object->dentry; char type[3], xtype[3]; @@ -62,8 +63,12 @@ int cachefiles_check_object_type(struct cachefiles_object *object) _enter("%p{%s}", object, type); /* attempt to install a type label directly */ - ret = vfs_setxattr(dentry, cachefiles_xattr_cache, type, 2, - XATTR_CREATE); + ret = mnt_want_write(cache->mnt); + if (ret == 0) { + ret = vfs_setxattr(dentry, cachefiles_xattr_cache, type, 2, + XATTR_CREATE); + mnt_drop_write(cache->mnt); + } if (ret == 0) { _debug("SET"); /* we succeeded */ goto error; @@ -123,6 +128,7 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object, struct cachefiles_xattr *auxdata) { struct dentry *dentry = object->dentry; + struct cachefiles_cache *cache; int ret; ASSERT(dentry); @@ -132,15 +138,22 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object, /* attempt to install the cache metadata directly */ _debug("SET #%u", auxdata->len); + cache = container_of(object->fscache.cache, + struct cachefiles_cache, cache); + clear_bit(FSCACHE_COOKIE_AUX_UPDATED, &object->fscache.cookie->flags); - if (data_new_version(object->fscache.cookie)) - ret = cachefiles_set_new_obj_xattr(object); - else if (volume_new_version(object->fscache.cookie)) - ret = cachefiles_set_new_vol_xattr(object); - else - ret = vfs_setxattr(dentry, cachefiles_xattr_cache, - &auxdata->type, auxdata->len, - XATTR_CREATE); + ret = mnt_want_write(cache->mnt); + if (ret == 0) { + if (data_new_version(object->fscache.cookie)) + ret = cachefiles_set_new_obj_xattr(object); + else if (volume_new_version(object->fscache.cookie)) + ret = cachefiles_set_new_vol_xattr(object); + else + ret = vfs_setxattr(dentry, cachefiles_xattr_cache, + &auxdata->type, auxdata->len, + XATTR_CREATE); + mnt_drop_write(cache->mnt); + } if (ret < 0 && ret != -ENOMEM) cachefiles_io_error_obj( object, @@ -157,6 +170,7 @@ int cachefiles_update_object_xattr(struct cachefiles_object *object, struct cachefiles_xattr *auxdata) { struct dentry *dentry = object->dentry; + struct cachefiles_cache *cache; int ret; if (!dentry) @@ -167,10 +181,17 @@ int cachefiles_update_object_xattr(struct cachefiles_object *object, /* attempt to install the cache metadata directly */ _debug("SET #%u", auxdata->len); + cache = container_of(object->fscache.cache, + struct cachefiles_cache, cache); + clear_bit(FSCACHE_COOKIE_AUX_UPDATED, &object->fscache.cookie->flags); - ret = vfs_setxattr(dentry, cachefiles_xattr_cache, - &auxdata->type, auxdata->len, - XATTR_REPLACE); + ret = mnt_want_write(cache->mnt); + if (ret == 0) { + ret = vfs_setxattr(dentry, cachefiles_xattr_cache, + &auxdata->type, auxdata->len, + XATTR_REPLACE); + mnt_drop_write(cache->mnt); + } if (ret < 0 && ret != -ENOMEM) cachefiles_io_error_obj( object, @@ -222,6 +243,7 @@ int cachefiles_check_old_object_xattr(struct cachefiles_object *object, struct cachefiles_xattr *auxdata) { struct cachefiles_xattr *auxbuf; + struct cachefiles_cache *cache; unsigned int len = sizeof(struct cachefiles_xattr) + 512; struct dentry *dentry = object->dentry; int ret; @@ -279,10 +301,17 @@ int cachefiles_check_old_object_xattr(struct cachefiles_object *object, BUG(); } + cache = container_of(object->fscache.cache, + struct cachefiles_cache, cache); + /* update the current label */ - ret = vfs_setxattr(dentry, cachefiles_xattr_cache, - &auxdata->type, auxdata->len, - XATTR_REPLACE); + ret = mnt_want_write(cache->mnt); + if (ret == 0) { + ret = vfs_setxattr(dentry, cachefiles_xattr_cache, + &auxdata->type, auxdata->len, + XATTR_REPLACE); + mnt_drop_write(cache->mnt); + } if (ret < 0) { cachefiles_io_error_obj(object, "Can't update xattr on %lu" @@ -364,7 +393,11 @@ int cachefiles_remove_object_xattr(struct cachefiles_cache *cache, { int ret; - ret = vfs_removexattr(dentry, cachefiles_xattr_cache); + ret = mnt_want_write(cache->mnt); + if (ret == 0) { + ret = vfs_removexattr(dentry, cachefiles_xattr_cache); + mnt_drop_write(cache->mnt); + } if (ret < 0) { if (ret == -ENOENT || ret == -ENODATA) ret = 0; -- 2.39.2

2 1

[PATCH OLK-6.6] bpf: Fix kmemleak warning for percpu hashmap
by Pu Lehui 12 May '25

12 May '25

From: Yonghong Song <yonghong.song(a)linux.dev> mainline inclusion from mainline-v6.15-rc1 commit 11ba7ce076e5903e7bdc1fd1498979c331b3c286 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6BRF CVE: CVE-2025-37807 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Vlad Poenaru reported the following kmemleak issue: unreferenced object 0x606fd7c44ac8 (size 32): backtrace (crc 0): pcpu_alloc_noprof+0x730/0xeb0 bpf_map_alloc_percpu+0x69/0xc0 prealloc_init+0x9d/0x1b0 htab_map_alloc+0x363/0x510 map_create+0x215/0x3a0 __sys_bpf+0x16b/0x3e0 __x64_sys_bpf+0x18/0x20 do_syscall_64+0x7b/0x150 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Further investigation shows the reason is due to not 8-byte aligned store of percpu pointer in htab_elem_set_ptr(): *(void __percpu **)(l->key + key_size) = pptr; Note that the whole htab_elem alignment is 8 (for x86_64). If the key_size is 4, that means pptr is stored in a location which is 4 byte aligned but not 8 byte aligned. In mm/kmemleak.c, scan_block() scans the memory based on 8 byte stride, so it won't detect above pptr, hence reporting the memory leak. In htab_map_alloc(), we already have htab->elem_size = sizeof(struct htab_elem) + round_up(htab->map.key_size, 8); if (percpu) htab->elem_size += sizeof(void *); else htab->elem_size += round_up(htab->map.value_size, 8); So storing pptr with 8-byte alignment won't cause any problem and can fix kmemleak too. The issue can be reproduced with bpf selftest as well: 1. Enable CONFIG_DEBUG_KMEMLEAK config 2. Add a getchar() before skel destroy in test_hash_map() in prog_tests/for_each.c. The purpose is to keep map available so kmemleak can be detected. 3. run './test_progs -t for_each/hash_map &' and a kmemleak should be reported. Reported-by: Vlad Poenaru <thevlad(a)meta.com> Signed-off-by: Yonghong Song <yonghong.song(a)linux.dev> Acked-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://lore.kernel.org/r/20250224175514.2207227-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/hashtab.c [The conflicts were due to not merge commit 0b56e637f7058] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/hashtab.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index fc34f72702cc..fdc74aeaa164 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -197,12 +197,12 @@ static bool htab_is_percpu(const struct bpf_htab *htab) static inline void htab_elem_set_ptr(struct htab_elem *l, u32 key_size, void __percpu *pptr) { - *(void __percpu **)(l->key + key_size) = pptr; + *(void __percpu **)(l->key + roundup(key_size, 8)) = pptr; } static inline void __percpu *htab_elem_get_ptr(struct htab_elem *l, u32 key_size) { - return *(void __percpu **)(l->key + key_size); + return *(void __percpu **)(l->key + roundup(key_size, 8)); } static void *fd_htab_map_get_ptr(const struct bpf_map *map, struct htab_elem *l) -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Fix deadlock between rcu_tasks_trace and event_mutex.
by Pu Lehui 12 May '25

12 May '25

From: Alexei Starovoitov <ast(a)kernel.org> stable inclusion from stable-v6.6.89 commit b5a528a34e1f613565115a7a6016862ccbfcb9ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6LWA CVE: CVE-2025-37884 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4580f4e0ebdf8dc8d506ae926b88510395a0c1d1 ] Fix the following deadlock: CPU A _free_event() perf_kprobe_destroy() mutex_lock(&event_mutex) perf_trace_event_unreg() synchronize_rcu_tasks_trace() There are several paths where _free_event() grabs event_mutex and calls sync_rcu_tasks_trace. Above is one such case. CPU B bpf_prog_test_run_syscall() rcu_read_lock_trace() bpf_prog_run_pin_on_cpu() bpf_prog_load() bpf_tracing_func_proto() trace_set_clr_event() mutex_lock(&event_mutex) Delegate trace_set_clr_event() to workqueue to avoid such lock dependency. Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20250224221637.4780-1-alexei.starovoitov@gmail.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/bpf_trace.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index dd70275d406b..042077a3abfe 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -400,7 +400,7 @@ static const struct bpf_func_proto bpf_trace_printk_proto = { .arg2_type = ARG_CONST_SIZE, }; -static void __set_printk_clr_event(void) +static void __set_printk_clr_event(struct work_struct *work) { /* * This program might be calling bpf_trace_printk, @@ -413,10 +413,11 @@ static void __set_printk_clr_event(void) if (trace_set_clr_event("bpf_trace", "bpf_trace_printk", 1)) pr_warn_ratelimited("could not enable bpf_trace_printk events"); } +static DECLARE_WORK(set_printk_work, __set_printk_clr_event); const struct bpf_func_proto *bpf_get_trace_printk_proto(void) { - __set_printk_clr_event(); + schedule_work(&set_printk_work); return &bpf_trace_printk_proto; } @@ -459,7 +460,7 @@ static const struct bpf_func_proto bpf_trace_vprintk_proto = { const struct bpf_func_proto *bpf_get_trace_vprintk_proto(void) { - __set_printk_clr_event(); + schedule_work(&set_printk_work); return &bpf_trace_vprintk_proto; } -- 2.34.1

2 1