- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] iomap: avoid avoid truncating 64-bit offset to 32 bits
by Long Li 17 Feb '25

17 Feb '25

From: Marco Nelissen <marco.nelissen(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit c13094b894de289514d84b8db56d1f2931a0bade category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJXF0 CVE: CVE-2025-21667 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a 32-bit position due to folio_next_index() returning an unsigned long. This could lead to an infinite loop when writing to an xfs filesystem. Signed-off-by: Marco Nelissen <marco.nelissen(a)gmail.com> Link: https://lore.kernel.org/r/20250109041253.2494374-1-marco.nelissen@gmail.com Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Conflicts: fs/xfs/xfs_iomap.c fs/iomap/buffered-io.c [Conflicts due to not merged 492f53758fad ("iomap: pass the iomap to the punch callback")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/xfs_iomap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index dc01689988ab..7395674066cf 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -1191,11 +1191,11 @@ xfs_iomap_write_delalloc_scan( * the end of this data range, not the end of the folio. */ *punch_start_byte = min_t(loff_t, end_byte, - (page->index + 1) << PAGE_SHIFT); + page_offset(page) + PAGE_SIZE); } /* move offset to start of next folio in range */ - start_byte = (page->index + 1) << PAGE_SHIFT; + start_byte = page_offset(page) + PAGE_SIZE; unlock_page(page); put_page(page); } -- 2.39.2

2 1

[PATCH v2 OLK-5.10 00/10] Implementation of the uncore frequency modulation feature
by Xiangwei Li 17 Feb '25

17 Feb '25

Devfreq is a general DVFS framework for non-CPU devices in the kernel. It is generally used for bus devices. Implementation of uncore dynamic frequency modulation based on this framework. Jie Zhan (1): PM / devfreq: Add HiSilicon uncore frequency scaling driver Xiangwei Li (9): PM / devfreq: Adjust default HiSilicon uncore devfreq polling interval and workqueue PM / devfreq: event: Add devfreq_event_get_edev_by_dev interface PM / devfreq: event: Supplement the name content of the event in devfreq-event PM / devfreq: Add related-package parameter in HiSilicon uncore devfreq PM / devfreq: Add associated events configuration in HiSilicon uncore frequency PM / devfreq: event: Add L3C event for HiSilicon uncore devfreq PM / devfreq: Add until governor PM / devfreq: Add bandwidth verification mechanism PM / devfreq: event: Add DDRC event for HiSilicon uncore devfreq drivers/devfreq/Kconfig | 12 + drivers/devfreq/Makefile | 2 + drivers/devfreq/devfreq-event.c | 34 +- drivers/devfreq/event/Kconfig | 7 + drivers/devfreq/event/Makefile | 2 + drivers/devfreq/event/hisi-uncore-ddrc.c | 167 ++++++ drivers/devfreq/event/hisi-uncore-l3c.c | 166 ++++++ drivers/devfreq/event/hisi-uncore.c | 249 +++++++++ drivers/devfreq/event/hisi-uncore.h | 88 +++ drivers/devfreq/governor_util.c | 124 +++++ drivers/devfreq/hisi_uncore_freq.c | 681 +++++++++++++++++++++++ include/linux/devfreq-event.h | 8 + include/linux/devfreq.h | 15 + 13 files changed, 1554 insertions(+), 1 deletion(-) create mode 100644 drivers/devfreq/event/hisi-uncore-ddrc.c create mode 100644 drivers/devfreq/event/hisi-uncore-l3c.c create mode 100644 drivers/devfreq/event/hisi-uncore.c create mode 100644 drivers/devfreq/event/hisi-uncore.h create mode 100644 drivers/devfreq/governor_util.c create mode 100644 drivers/devfreq/hisi_uncore_freq.c -- 2.25.1

2 11

[PATCH OLK-5.10 00/10] Implementation of the uncore frequency modulation feature
by Xiangwei Li 17 Feb '25

17 Feb '25

Devfreq is a general DVFS framework for non-CPU devices in the kernel. It is generally used for bus devices. Implementation of uncore dynamic frequency modulation based on this framework. Jie Zhan (1): PM / devfreq: Add HiSilicon uncore frequency scaling driver Xiangwei Li (9): PM / devfreq: Adjust default HiSilicon uncore devfreq polling interval and workqueue PM / devfreq: event: Add devfreq_event_get_edev_by_dev interface PM / devfreq: event: Supplement the name content of the event in devfreq-event PM / devfreq: Add related-package parameter in HiSilicon uncore devfreq PM / devfreq: Add associated events configuration in HiSilicon uncore frequency PM / devfreq: event: Add L3C event for HiSilicon uncore devfreq PM / devfreq: Add until governor PM / devfreq: Add bandwidth verification mechanism PM / devfreq: event: Add DDRC event for HiSilicon uncore devfreq drivers/devfreq/Kconfig | 12 + drivers/devfreq/Makefile | 2 + drivers/devfreq/devfreq-event.c | 34 +- drivers/devfreq/event/Kconfig | 7 + drivers/devfreq/event/Makefile | 2 + drivers/devfreq/event/hisi-uncore-ddrc.c | 167 ++++++ drivers/devfreq/event/hisi-uncore-l3c.c | 166 ++++++ drivers/devfreq/event/hisi-uncore.c | 249 +++++++++ drivers/devfreq/event/hisi-uncore.h | 88 +++ drivers/devfreq/governor_util.c | 124 +++++ drivers/devfreq/hisi_uncore_freq.c | 681 +++++++++++++++++++++++ include/linux/devfreq-event.h | 8 + include/linux/devfreq.h | 15 + 13 files changed, 1554 insertions(+), 1 deletion(-) create mode 100644 drivers/devfreq/event/hisi-uncore-ddrc.c create mode 100644 drivers/devfreq/event/hisi-uncore-l3c.c create mode 100644 drivers/devfreq/event/hisi-uncore.c create mode 100644 drivers/devfreq/event/hisi-uncore.h create mode 100644 drivers/devfreq/governor_util.c create mode 100644 drivers/devfreq/hisi_uncore_freq.c -- 2.25.1

2 11

[openeuler:openEuler-1.0-LTS 1424/1424] mm/memory_hotplug.c:926:23: warning: unused variable 'start_pfn'
by kernel test robot 17 Feb '25

17 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bd6fde5ff5b73d04068bdad2dc7730479d4df355 commit: 2f5f99f3efc5d34c37f9918c50808a4cfe36c211 [1424/1424] mm: handle uninitialized numa nodes gracefully config: x86_64-buildonly-randconfig-004-20250217 (https://download.01.org/0day-ci/archive/20250217/202502171533.xL4t91Bt-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250217/202502171533.xL4t91Bt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502171533.xL4t91Bt-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/memory_hotplug.c: In function '__remove_section': mm/memory_hotplug.c:481:23: warning: variable 'start_pfn' set but not used [-Wunused-but-set-variable] 481 | unsigned long start_pfn; | ^~~~~~~~~ mm/memory_hotplug.c: In function 'hotadd_init_pgdat': >> mm/memory_hotplug.c:926:23: warning: unused variable 'start_pfn' [-Wunused-variable] 926 | unsigned long start_pfn = PFN_DOWN(start); | ^~~~~~~~~ mm/memory_hotplug.c: At top level: >> mm/memory_hotplug.c:971:13: warning: 'rollback_node_hotadd' defined but not used [-Wunused-function] 971 | static void rollback_node_hotadd(int nid) | ^~~~~~~~~~~~~~~~~~~~ In file included from include/linux/migrate.h:6, from mm/memory_hotplug.c:27: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +/start_pfn +926 mm/memory_hotplug.c 0bd85420087389 Tang Chen 2014-11-13 921 e13193319d3a55 Hidetoshi Seto 2009-11-17 922 /* we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG */ 2f5f99f3efc5d3 Michal Hocko 2023-11-08 923 static pg_data_t __ref *hotadd_init_pgdat(int nid, u64 start) 9af3c2dea3a3ae Yasunori Goto 2006-06-27 924 { 9af3c2dea3a3ae Yasunori Goto 2006-06-27 925 struct pglist_data *pgdat; c8e861a531b019 Fabian Frederick 2014-06-04 @926 unsigned long start_pfn = PFN_DOWN(start); 9af3c2dea3a3ae Yasunori Goto 2006-06-27 927 a1e565aa3cfc7c Tang Chen 2013-02-22 928 pgdat = NODE_DATA(nid); 9af3c2dea3a3ae Yasunori Goto 2006-06-27 929 2f5f99f3efc5d3 Michal Hocko 2023-11-08 930 /* 2f5f99f3efc5d3 Michal Hocko 2023-11-08 931 * NODE_DATA is preallocated (free_area_init) but its internal 2f5f99f3efc5d3 Michal Hocko 2023-11-08 932 * state is not allocated completely. Add missing pieces. 2f5f99f3efc5d3 Michal Hocko 2023-11-08 933 * Completely offline nodes stay around and they just need 2f5f99f3efc5d3 Michal Hocko 2023-11-08 934 * reintialization. 2f5f99f3efc5d3 Michal Hocko 2023-11-08 935 */ 2f5f99f3efc5d3 Michal Hocko 2023-11-08 936 if (pgdat->per_cpu_nodestats == &boot_nodestats) { b0dc3a342af36f Gu Zheng 2015-03-25 937 } else { e716f2eb24defb Mel Gorman 2017-05-03 938 /* e716f2eb24defb Mel Gorman 2017-05-03 939 * Reset the nr_zones, order and classzone_idx before reuse. e716f2eb24defb Mel Gorman 2017-05-03 940 * Note that kswapd will init kswapd_classzone_idx properly e716f2eb24defb Mel Gorman 2017-05-03 941 * when it starts in the near future. e716f2eb24defb Mel Gorman 2017-05-03 942 */ b0dc3a342af36f Gu Zheng 2015-03-25 943 pgdat->nr_zones = 0; 38087d9b036098 Mel Gorman 2016-07-28 944 pgdat->kswapd_order = 0; 38087d9b036098 Mel Gorman 2016-07-28 945 pgdat->kswapd_classzone_idx = 0; a1e565aa3cfc7c Tang Chen 2013-02-22 946 } 9af3c2dea3a3ae Yasunori Goto 2006-06-27 947 2f5f99f3efc5d3 Michal Hocko 2023-11-08 948 pgdat->node_start_pfn = 0; 03e85f9d5f1f8c Oscar Salvador 2018-08-21 949 9af3c2dea3a3ae Yasunori Goto 2006-06-27 950 /* init node's zones as empty zones, we don't have any present pages.*/ 03e85f9d5f1f8c Oscar Salvador 2018-08-21 951 free_area_init_core_hotplug(nid); 5830169f47269f Reza Arbab 2016-08-11 952 pgdat->per_cpu_nodestats = alloc_percpu(struct per_cpu_nodestat); 9af3c2dea3a3ae Yasunori Goto 2006-06-27 953 959ecc48fc7506 KAMEZAWA Hiroyuki 2011-06-15 954 /* 959ecc48fc7506 KAMEZAWA Hiroyuki 2011-06-15 955 * The node we allocated has no zone fallback lists. For avoiding 959ecc48fc7506 KAMEZAWA Hiroyuki 2011-06-15 956 * to access not-initialized zonelist, build here. 959ecc48fc7506 KAMEZAWA Hiroyuki 2011-06-15 957 */ 72675e131eb418 Michal Hocko 2017-09-06 958 build_all_zonelists(pgdat); 959ecc48fc7506 KAMEZAWA Hiroyuki 2011-06-15 959 0bd85420087389 Tang Chen 2014-11-13 960 /* 0bd85420087389 Tang Chen 2014-11-13 961 * When memory is hot-added, all the memory is in offline state. So 0bd85420087389 Tang Chen 2014-11-13 962 * clear all zones' present_pages because they will be updated in 0bd85420087389 Tang Chen 2014-11-13 963 * online_pages() and offline_pages(). 0bd85420087389 Tang Chen 2014-11-13 964 */ 03e85f9d5f1f8c Oscar Salvador 2018-08-21 965 reset_node_managed_pages(pgdat); 0bd85420087389 Tang Chen 2014-11-13 966 reset_node_present_pages(pgdat); 0bd85420087389 Tang Chen 2014-11-13 967 9af3c2dea3a3ae Yasunori Goto 2006-06-27 968 return pgdat; 9af3c2dea3a3ae Yasunori Goto 2006-06-27 969 } 9af3c2dea3a3ae Yasunori Goto 2006-06-27 970 b9ff036082cd17 Oscar Salvador 2018-08-17 @971 static void rollback_node_hotadd(int nid) 9af3c2dea3a3ae Yasunori Goto 2006-06-27 972 { b9ff036082cd17 Oscar Salvador 2018-08-17 973 pg_data_t *pgdat = NODE_DATA(nid); b9ff036082cd17 Oscar Salvador 2018-08-17 974 9af3c2dea3a3ae Yasunori Goto 2006-06-27 975 arch_refresh_nodedata(nid, NULL); 5830169f47269f Reza Arbab 2016-08-11 976 free_percpu(pgdat->per_cpu_nodestats); 9af3c2dea3a3ae Yasunori Goto 2006-06-27 977 arch_free_nodedata(pgdat); 9af3c2dea3a3ae Yasunori Goto 2006-06-27 978 return; 9af3c2dea3a3ae Yasunori Goto 2006-06-27 979 } 9af3c2dea3a3ae Yasunori Goto 2006-06-27 980 :::::: The code at line 926 was first introduced by commit :::::: c8e861a531b0199dc6ef9e402e29c474dfa507ce mm/memory_hotplug.c: use PFN_DOWN() :::::: TO: Fabian Frederick <fabf(a)skynet.be> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1424/1424] mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type
by kernel test robot 17 Feb '25

17 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bd6fde5ff5b73d04068bdad2dc7730479d4df355 commit: eb761d6521c32c006a4987260394a61c6684fb35 [1424/1424] mm: parallelize deferred struct page initialization within each node config: x86_64-buildonly-randconfig-003-20250217 (https://download.01.org/0day-ci/archive/20250217/202502171430.Coc968oj-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250217/202502171430.Coc968oj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502171430.Coc968oj-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/page_alloc.c:21: include/linux/pagemap.h:401:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 401 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/page_alloc.c:58: include/linux/mm_inline.h:32:43: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 32 | __mod_node_page_state(pgdat, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:34:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/page_alloc.c:1412:6: warning: no previous prototype for function 'set_zone_contiguous' [-Wmissing-prototypes] 1412 | void set_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1412:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1412 | void set_zone_contiguous(struct zone *zone) | ^ | static mm/page_alloc.c:1433:6: warning: no previous prototype for function 'clear_zone_contiguous' [-Wmissing-prototypes] 1433 | void clear_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1433:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1433 | void clear_zone_contiguous(struct zone *zone) | ^ | static >> mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-strict] 1645 | DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1646 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1661:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-strict] 1661 | DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1662 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:3050:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3050 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:126:34: note: expanded from macro '__count_zid_vm_events' 126 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:3098:2: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3098 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:126:34: note: expanded from macro '__count_zid_vm_events' 126 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ 9 warnings generated. vim +1645 mm/page_alloc.c 1587 1588 /* Initialise remaining memory on a node */ 1589 static int __init deferred_init_memmap(void *data) 1590 { 1591 pg_data_t *pgdat = data; 1592 int nid = pgdat->node_id; 1593 unsigned long start = jiffies; 1594 unsigned long nr_init = 0, nr_free = 0; 1595 unsigned long spfn, epfn, first_init_pfn, flags; 1596 phys_addr_t spa, epa; 1597 int zid; 1598 struct zone *zone; 1599 const struct cpumask *cpumask = cpumask_of_node(pgdat->node_id); 1600 u64 i; 1601 unsigned long nr_node_cpus; 1602 struct ktask_node kn; 1603 1604 /* Bind memory initialisation thread to a local node if possible */ 1605 if (!cpumask_empty(cpumask)) 1606 set_cpus_allowed_ptr(current, cpumask); 1607 1608 pgdat_resize_lock(pgdat, &flags); 1609 first_init_pfn = pgdat->first_deferred_pfn; 1610 if (first_init_pfn == ULONG_MAX) { 1611 pgdat_resize_unlock(pgdat, &flags); 1612 pgdat_init_report_one_done(); 1613 return 0; 1614 } 1615 1616 /* 1617 * We'd like to know the memory bandwidth of the chip to calculate the 1618 * most efficient number of threads to start, but we can't. In 1619 * testing, a good value for a variety of systems was a quarter of the 1620 * CPUs on the node. 1621 */ 1622 nr_node_cpus = DIV_ROUND_UP(cpumask_weight(cpumask), 4); 1623 1624 /* Sanity check boundaries */ 1625 BUG_ON(pgdat->first_deferred_pfn < pgdat->node_start_pfn); 1626 BUG_ON(pgdat->first_deferred_pfn > pgdat_end_pfn(pgdat)); 1627 pgdat->first_deferred_pfn = ULONG_MAX; 1628 1629 /* Only the highest zone is deferred so find it */ 1630 for (zid = 0; zid < MAX_NR_ZONES; zid++) { 1631 zone = pgdat->node_zones + zid; 1632 if (first_init_pfn < zone_end_pfn(zone)) 1633 break; 1634 } 1635 first_init_pfn = max(zone->zone_start_pfn, first_init_pfn); 1636 1637 /* 1638 * Initialize and free pages. We do it in two loops: first we initialize 1639 * struct page, than free to buddy allocator, because while we are 1640 * freeing pages we can access pages that are ahead (computing buddy 1641 * page in __free_one_page()). 1642 */ 1643 for_each_free_mem_range(i, nid, MEMBLOCK_NONE, &spa, &epa, NULL) { 1644 struct deferred_args args = { nid, zid, ATOMIC64_INIT(0) }; > 1645 DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, 1646 KTASK_PTE_MINCHUNK); 1647 ktask_ctl_set_max_threads(&ctl, nr_node_cpus); 1648 1649 spfn = max_t(unsigned long, first_init_pfn, PFN_UP(spa)); 1650 epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); 1651 1652 kn.kn_start = (void *)spfn; 1653 kn.kn_task_size = (spfn < epfn) ? epfn - spfn : 0; 1654 kn.kn_nid = nid; 1655 (void) ktask_run_numa(&kn, 1, &ctl); 1656 1657 nr_init += atomic64_read(&args.nr_pages); 1658 } 1659 for_each_free_mem_range(i, nid, MEMBLOCK_NONE, &spa, &epa, NULL) { 1660 struct deferred_args args = { nid, zid, ATOMIC64_INIT(0) }; 1661 DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, 1662 KTASK_PTE_MINCHUNK); 1663 ktask_ctl_set_max_threads(&ctl, nr_node_cpus); 1664 1665 spfn = max_t(unsigned long, first_init_pfn, PFN_UP(spa)); 1666 epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); 1667 1668 kn.kn_start = (void *)spfn; 1669 kn.kn_task_size = (spfn < epfn) ? epfn - spfn : 0; 1670 kn.kn_nid = nid; 1671 (void) ktask_run_numa(&kn, 1, &ctl); 1672 1673 nr_free += atomic64_read(&args.nr_pages); 1674 } 1675 pgdat_resize_unlock(pgdat, &flags); 1676 1677 /* Sanity check that the next zone really is unpopulated */ 1678 WARN_ON(++zid < MAX_NR_ZONES && populated_zone(++zone)); 1679 VM_BUG_ON(nr_init != nr_free); 1680 1681 zone->managed_pages += nr_free; 1682 1683 pr_info("node %d initialised, %lu pages in %ums\n", nid, nr_free, 1684 jiffies_to_msecs(jiffies - start)); 1685 1686 pgdat_init_report_one_done(); 1687 return 0; 1688 } 1689 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH v2 OLK-5.10 0/3] fix CVE-2024-53056 for olk-5.10
by Wupeng Ma 17 Feb '25

17 Feb '25

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-53056 for olk-5.10. changelog since v1: - drop commit("mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling") which is not releated to this cve and will lead to kabi changes. Lorenzo Stoakes (3): mm: avoid unsafe VMA hook invocation when error arises on mmap hook mm: unconditionally close VMAs on error mm: resolve faulty mmap_region() error path behaviour mm/internal.h | 19 ++++++++++ mm/mmap.c | 97 ++++++++++++++++++++++++++++++--------------------- mm/nommu.c | 7 ++-- mm/util.c | 33 ++++++++++++++++++ 4 files changed, 113 insertions(+), 43 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/2] mm, madvise: fix potential workingset node list_lru leaks
by Wupeng Ma 17 Feb '25

17 Feb '25

From: Ma Wupeng <mawupeng1(a)huawei.com> fix potential workingset node list_lru leaks. Christoph Hellwig (1): [Backport] mm: move mapping_set_update out of <linux/swap.h> Kairui Song (1): [Backport] mm, madvise: fix potential workingset node list_lru leaks include/linux/swap.h | 10 ---------- mm/internal.h | 10 ++++++++++ mm/khugepaged.c | 3 +++ mm/workingset.c | 1 + 4 files changed, 14 insertions(+), 10 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] KVM: arm64: Get rid of userspace_irqchip_in_use
by Zhao Yipeng 17 Feb '25

17 Feb '25

From: Raghavendra Rao Ananta <rananta(a)google.com> stable inclusion from stable-v6.6.64 commit dd2f9861f27571d47998d71e7516bf7216db0b52 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADT CVE: CVE-2024-53195 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- KVM: arm64: Get rid of userspace_irqchip_in_use commit 38d7aacca09230fdb98a34194fec2af597e8e20d upstream. Improper use of userspace_irqchip_in_use led to syzbot hitting the following WARN_ON() in kvm_timer_update_irq(): WARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/arch_timer.c:459 kvm_timer_update_irq+0x21c/0x394 Call trace: kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459 kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968 kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264 kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [inline] kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [inline] kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695 kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The following sequence led to the scenario: - Userspace creates a VM and a vCPU. - The vCPU is initialized with KVM_ARM_VCPU_PMU_V3 during KVM_ARM_VCPU_INIT. - Without any other setup, such as vGIC or vPMU, userspace issues KVM_RUN on the vCPU. Since the vPMU is requested, but not setup, kvm_arm_pmu_v3_enable() fails in kvm_arch_vcpu_run_pid_change(). As a result, KVM_RUN returns after enabling the timer, but before incrementing 'userspace_irqchip_in_use': kvm_arch_vcpu_run_pid_change() ret = kvm_arm_pmu_v3_enable() if (!vcpu->arch.pmu.created) return -EINVAL; if (ret) return ret; [...] if (!irqchip_in_kernel(kvm)) static_branch_inc(&userspace_irqchip_in_use); - Userspace ignores the error and issues KVM_ARM_VCPU_INIT again. Since the timer is already enabled, control moves through the following flow, ultimately hitting the WARN_ON(): kvm_timer_vcpu_reset() if (timer->enabled) kvm_timer_update_irq() if (!userspace_irqchip()) ret = kvm_vgic_inject_irq() ret = vgic_lazy_init() if (unlikely(!vgic_initialized(kvm))) if (kvm->arch.vgic.vgic_model != KVM_DEV_TYPE_ARM_VGIC_V2) return -EBUSY; WARN_ON(ret); Theoretically, since userspace_irqchip_in_use's functionality can be simply replaced by '!irqchip_in_kernel()', get rid of the static key to avoid the mismanagement, which also helps with the syzbot issue. Cc: <stable(a)vger.kernel.org> Reported-by: syzbot <syzkaller(a)googlegroups.com> Suggested-by: Marc Zyngier <maz(a)kernel.org> Signed-off-by: Raghavendra Rao Ananta <rananta(a)google.com> Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/arm64/kvm/arm.c [The conflicts in the arm.c file are contextual conflicts.] Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- arch/arm64/include/asm/kvm_host.h | 2 -- arch/arm64/kvm/arch_timer.c | 3 +-- arch/arm64/kvm/arm.c | 21 +++------------------ 3 files changed, 4 insertions(+), 22 deletions(-) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index 4db5ee87988a..ac4e59256f8e 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -77,8 +77,6 @@ enum kvm_mode kvm_get_mode(void); static inline enum kvm_mode kvm_get_mode(void) { return KVM_MODE_NONE; }; #endif -DECLARE_STATIC_KEY_FALSE(userspace_irqchip_in_use); - extern unsigned int __ro_after_init kvm_sve_max_vl; int __init kvm_arm_init_sve(void); diff --git a/arch/arm64/kvm/arch_timer.c b/arch/arm64/kvm/arch_timer.c index 3f1129d3df6a..34d5ff836188 100644 --- a/arch/arm64/kvm/arch_timer.c +++ b/arch/arm64/kvm/arch_timer.c @@ -291,8 +291,7 @@ void get_timer_map(struct kvm_vcpu *vcpu, struct timer_map *map) static inline bool userspace_irqchip(struct kvm *kvm) { - return static_branch_unlikely(&userspace_irqchip_in_use) && - unlikely(!irqchip_in_kernel(kvm)); + return unlikely(!irqchip_in_kernel(kvm)); } static void soft_timer_start(struct hrtimer *hrt, u64 ns) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index f4194603eae5..c0126a9203ae 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -68,7 +68,6 @@ bool kvm_ncsnp_support; bool kvm_dvmbm_support; static DEFINE_PER_CPU(unsigned char, kvm_hyp_initialized); -DEFINE_STATIC_KEY_FALSE(userspace_irqchip_in_use); bool is_kvm_arm_initialised(void) { @@ -521,9 +520,6 @@ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu) void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu) { - if (vcpu_has_run_once(vcpu) && unlikely(!irqchip_in_kernel(vcpu->kvm))) - static_branch_dec(&userspace_irqchip_in_use); - kvm_mmu_free_memory_cache(&vcpu->arch.mmu_page_cache); kvm_timer_vcpu_terminate(vcpu); kvm_pmu_vcpu_destroy(vcpu); @@ -805,17 +801,6 @@ int kvm_arch_vcpu_run_pid_change(struct kvm_vcpu *vcpu) return ret; } - if (!irqchip_in_kernel(kvm)) { - /* - * Tell the rest of the code that there are userspace irqchip - * VMs in the wild. - */ -#ifdef CONFIG_HISI_VIRTCCA_HOST - if (!kvm_is_virtcca_cvm(kvm)) -#endif - static_branch_inc(&userspace_irqchip_in_use); - } - /* * Initialize traps for protected VMs. * NOTE: Move to run in EL2 directly, rather than via a hypercall, once @@ -1055,7 +1040,7 @@ static bool kvm_vcpu_exit_request(struct kvm_vcpu *vcpu, int *ret) * state gets updated in kvm_timer_update_run and * kvm_pmu_update_run below). */ - if (static_branch_unlikely(&userspace_irqchip_in_use)) { + if (unlikely(!irqchip_in_kernel(vcpu->kvm))) { if (kvm_timer_should_notify_user(vcpu) || kvm_pmu_should_notify_user(vcpu)) { *ret = -EINTR; @@ -1193,7 +1178,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) vcpu->mode = OUTSIDE_GUEST_MODE; isb(); /* Ensure work in x_flush_hwstate is committed */ kvm_pmu_sync_hwstate(vcpu); - if (static_branch_unlikely(&userspace_irqchip_in_use)) + if (unlikely(!irqchip_in_kernel(vcpu->kvm))) kvm_timer_sync_user(vcpu); kvm_vgic_sync_hwstate(vcpu); local_irq_enable(); @@ -1246,7 +1231,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) * we don't want vtimer interrupts to race with syncing the * timer virtual interrupt state. */ - if (static_branch_unlikely(&userspace_irqchip_in_use)) + if (unlikely(!irqchip_in_kernel(vcpu->kvm))) kvm_timer_sync_user(vcpu); kvm_arch_vcpu_ctxsync_fp(vcpu); -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] fix CVE-2024-53056 for olk-5.10
by Wupeng Ma 17 Feb '25

17 Feb '25

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-53056 for olk-5.10. Lorenzo Stoakes (4): mm: avoid unsafe VMA hook invocation when error arises on mmap hook mm: unconditionally close VMAs on error mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling mm: resolve faulty mmap_region() error path behaviour arch/arm64/include/asm/mman.h | 10 +++- include/linux/mman.h | 7 ++- mm/internal.h | 19 +++++++ mm/mmap.c | 101 ++++++++++++++++++++-------------- mm/nommu.c | 9 ++- mm/shmem.c | 3 - mm/util.c | 33 +++++++++++ 7 files changed, 127 insertions(+), 55 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6] mm: resolve faulty mmap_region() error path behaviour
by Wupeng Ma 17 Feb '25

17 Feb '25

From: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> stable inclusion from stable-v6.6.63 commit bdc136e2b05fabcd780fe5f165d154eb779dfcb0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB7051 CVE: CVE-2024-53096 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5de195060b2e251a835f622759550e6202167641 ] The mmap_region() function is somewhat terrifying, with spaghetti-like control flow and numerous means by which issues can arise and incomplete state, memory leaks and other unpleasantness can occur. A large amount of the complexity arises from trying to handle errors late in the process of mapping a VMA, which forms the basis of recently observed issues with resource leaks and observable inconsistent state. Taking advantage of previous patches in this series we move a number of checks earlier in the code, simplifying things by moving the core of the logic into a static internal function __mmap_region(). Doing this allows us to perform a number of checks up front before we do any real work, and allows us to unwind the writable unmap check unconditionally as required and to perform a CONFIG_DEBUG_VM_MAPLE_TREE validation unconditionally also. We move a number of things here: 1. We preallocate memory for the iterator before we call the file-backed memory hook, allowing us to exit early and avoid having to perform complicated and error-prone close/free logic. We carefully free iterator state on both success and error paths. 2. The enclosing mmap_region() function handles the mapping_map_writable() logic early. Previously the logic had the mapping_map_writable() at the point of mapping a newly allocated file-backed VMA, and a matching mapping_unmap_writable() on success and error paths. We now do this unconditionally if this is a file-backed, shared writable mapping. If a driver changes the flags to eliminate VM_MAYWRITE, however doing so does not invalidate the seal check we just performed, and we in any case always decrement the counter in the wrapper. We perform a debug assert to ensure a driver does not attempt to do the opposite. 3. We also move arch_validate_flags() up into the mmap_region() function. This is only relevant on arm64 and sparc64, and the check is only meaningful for SPARC with ADI enabled. We explicitly add a warning for this arch if a driver invalidates this check, though the code ought eventually to be fixed to eliminate the need for this. With all of these measures in place, we no longer need to explicitly close the VMA on error paths, as we place all checks which might fail prior to a call to any driver mmap hook. This eliminates an entire class of errors, makes the code easier to reason about and more robust. Link: https://lkml.kernel.org/r/6e0becb36d2f5472053ac5d544c0edfe9b899e25.17302246… Fixes: deb0f6562884 ("mm/mmap: undo ->mmap() when arch_validate_flags() fails") Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Reported-by: Jann Horn <jannh(a)google.com> Reviewed-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Reviewed-by: Vlastimil Babka <vbabka(a)suse.cz> Tested-by: Mark Brown <broonie(a)kernel.org> Cc: Andreas Larsson <andreas(a)gaisler.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: David S. Miller <davem(a)davemloft.net> Cc: Helge Deller <deller(a)gmx.de> Cc: James E.J. Bottomley <James.Bottomley(a)HansenPartnership.com> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: Peter Xu <peterx(a)redhat.com> Cc: Will Deacon <will(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/mmap.c [Ma Wupeng: conflict with ascend's modify on mmap] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- mm/mmap.c | 128 +++++++++++++++++++++++++++++++----------------------- 1 file changed, 73 insertions(+), 55 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 266025c0f6183..4a36526d8caf8 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1254,7 +1254,7 @@ static inline bool file_mmap_ok(struct file *file, struct inode *inode, return true; } -static unsigned long __mmap_region(struct mm_struct *mm, +static unsigned long __mmap_region_ext(struct mm_struct *mm, struct file *file, unsigned long addr, unsigned long len, vm_flags_t vm_flags, unsigned long pgoff, struct list_head *uf); @@ -1431,7 +1431,7 @@ unsigned long __do_mmap_mm(struct mm_struct *mm, struct file *file, unsigned lon vm_flags |= VM_NORESERVE; } - addr = __mmap_region(mm, file, addr, len, vm_flags, pgoff, uf); + addr = __mmap_region_ext(mm, file, addr, len, vm_flags, pgoff, uf); if (!IS_ERR_VALUE(addr) && ((vm_flags & VM_LOCKED) || (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE)) @@ -2739,14 +2739,14 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len, return do_vmi_munmap(&vmi, mm, start, len, uf, false); } -static unsigned long __mmap_region(struct mm_struct *mm, - struct file *file, unsigned long addr, - unsigned long len, vm_flags_t vm_flags, - unsigned long pgoff, struct list_head *uf) +static unsigned long __mmap_region(struct mm_struct *mm, struct file *file, + unsigned long addr, unsigned long len, + vm_flags_t vm_flags, unsigned long pgoff, + struct list_head *uf) { struct vm_area_struct *vma = NULL; struct vm_area_struct *next, *prev, *merge; - pgoff_t pglen = len >> PAGE_SHIFT; + pgoff_t pglen = PHYS_PFN(len); unsigned long charged = 0; unsigned long end = addr + len; unsigned long merge_start = addr, merge_end = end; @@ -2843,25 +2843,26 @@ static unsigned long __mmap_region(struct mm_struct *mm, vma->vm_page_prot = vm_get_page_prot(vm_flags); vma->vm_pgoff = pgoff; - if (file) { - if (vm_flags & VM_SHARED) { - error = mapping_map_writable(file->f_mapping); - if (error) - goto free_vma; - } + if (vma_iter_prealloc(&vmi, vma)) { + error = -ENOMEM; + goto free_vma; + } + if (file) { vma->vm_file = get_file(file); error = call_mmap(file, vma); if (error) - goto unmap_and_free_vma; + goto unmap_and_free_file_vma; + /* Drivers cannot alter the address of the VMA. */ + WARN_ON_ONCE(addr != vma->vm_start); /* - * Expansion is handled above, merging is handled below. - * Drivers should not alter the address of the VMA. + * Drivers should not permit writability when previously it was + * disallowed. */ - error = -EINVAL; - if (WARN_ON((addr != vma->vm_start))) - goto close_and_free_vma; + VM_WARN_ON_ONCE(vm_flags != vma->vm_flags && + !(vm_flags & VM_MAYWRITE) && + (vma->vm_flags & VM_MAYWRITE)); vma_iter_config(&vmi, addr, end); /* @@ -2873,6 +2874,7 @@ static unsigned long __mmap_region(struct mm_struct *mm, vma->vm_end, vma->vm_flags, NULL, vma->vm_file, vma->vm_pgoff, NULL, NULL_VM_UFFD_CTX, NULL); + if (merge) { /* * ->mmap() can change vma->vm_file and fput @@ -2886,7 +2888,7 @@ static unsigned long __mmap_region(struct mm_struct *mm, vma = merge; /* Update vm_flags to pick up the change. */ vm_flags = vma->vm_flags; - goto unmap_writable; + goto file_expanded; } } @@ -2894,24 +2896,15 @@ static unsigned long __mmap_region(struct mm_struct *mm, } else if (vm_flags & VM_SHARED) { error = shmem_zero_setup(vma); if (error) - goto free_vma; + goto free_iter_vma; } else { vma_set_anonymous(vma); } - if (map_deny_write_exec(vma->vm_flags, vma->vm_flags)) { - error = -EACCES; - goto close_and_free_vma; - } - - /* Allow architectures to sanity-check the vm_flags */ - error = -EINVAL; - if (!arch_validate_flags(vma->vm_flags)) - goto close_and_free_vma; - - error = -ENOMEM; - if (vma_iter_prealloc(&vmi, vma)) - goto close_and_free_vma; +#ifdef CONFIG_SPARC64 + /* TODO: Fix SPARC ADI! */ + WARN_ON_ONCE(!arch_validate_flags(vm_flags)); +#endif /* Lock the VMA since it is modified after insertion into VMA tree */ vma_start_write(vma); @@ -2925,10 +2918,7 @@ static unsigned long __mmap_region(struct mm_struct *mm, */ khugepaged_enter_vma(vma, vma->vm_flags); - /* Once vma denies write, undo our temporary denial count */ -unmap_writable: - if (file && vm_flags & VM_SHARED) - mapping_unmap_writable(file->f_mapping); +file_expanded: file = vma->vm_file; ksm_add_vma(vma); expanded: @@ -2958,38 +2948,66 @@ static unsigned long __mmap_region(struct mm_struct *mm, vma_set_page_prot(vma); - validate_mm(mm); return addr; -close_and_free_vma: - vma_close(vma); - - if (file || vma->vm_file) { -unmap_and_free_vma: - fput(vma->vm_file); - vma->vm_file = NULL; +unmap_and_free_file_vma: + fput(vma->vm_file); + vma->vm_file = NULL; - vma_iter_set(&vmi, vma->vm_end); - /* Undo any partial mapping done by a device driver. */ - unmap_region(mm, &vmi.mas, vma, prev, next, vma->vm_start, - vma->vm_end, vma->vm_end, true); - } - if (file && (vm_flags & VM_SHARED)) - mapping_unmap_writable(file->f_mapping); + vma_iter_set(&vmi, vma->vm_end); + /* Undo any partial mapping done by a device driver. */ + unmap_region(mm, &vmi.mas, vma, prev, next, vma->vm_start, + vma->vm_end, vma->vm_end, true); +free_iter_vma: + vma_iter_free(&vmi); free_vma: vm_area_free(vma); unacct_error: if (charged) vm_unacct_memory(charged); - validate_mm(mm); return error; } +static unsigned long __mmap_region_ext(struct mm_struct *mm, struct file *file, + unsigned long addr, unsigned long len, + vm_flags_t vm_flags, unsigned long pgoff, + struct list_head *uf) +{ + unsigned long ret; + bool writable_file_mapping = false; + + /* Check to see if MDWE is applicable. */ + if (map_deny_write_exec(vm_flags, vm_flags)) + return -EACCES; + + /* Allow architectures to sanity-check the vm_flags. */ + if (!arch_validate_flags(vm_flags)) + return -EINVAL; + + /* Map writable and ensure this isn't a sealed memfd. */ + if (file && (vm_flags & VM_SHARED)) { + int error = mapping_map_writable(file->f_mapping); + + if (error) + return error; + writable_file_mapping = true; + } + + ret = __mmap_region(mm, file, addr, len, vm_flags, pgoff, uf); + + /* Clear our write mapping regardless of error. */ + if (writable_file_mapping) + mapping_unmap_writable(file->f_mapping); + + validate_mm(current->mm); + return ret; +} + unsigned long mmap_region(struct file *file, unsigned long addr, unsigned long len, vm_flags_t vm_flags, unsigned long pgoff, struct list_head *uf) { - return __mmap_region(current->mm, file, addr, len, vm_flags, pgoff, uf); + return __mmap_region_ext(current->mm, file, addr, len, vm_flags, pgoff, uf); } static int __vm_munmap(unsigned long start, size_t len, bool unlock) -- 2.43.0

2 1