- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 2882/2882] mm/hugetlb.c:2216:9: warning: variable 'gfp' set but not used
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fdf755b0cabc80fc65da83c9da27ec2cee144dc commit: 27a782f719fdab073c5b0e19764fad1f93cddd00 [2882/2882] mm/hugetlb: add support for mempolicy MPOL_PREFERRED_MANY config: x86_64-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507020936.wpYnAMsn-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507020936.wpYnAMsn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507020936.wpYnAMsn-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/hugetlb.c:2216:9: warning: variable 'gfp' set but not used [-Wunused-but-set-variable] 2216 | gfp_t gfp = gfp_mask | __GFP_NOWARN; | ^ 1 warning generated. vim +/gfp +2216 mm/hugetlb.c 2200 2201 /* 2202 * Use the VMA's mpolicy to allocate a huge page from the buddy. 2203 */ 2204 static 2205 struct page *alloc_buddy_huge_page_with_mpol(struct hstate *h, 2206 struct vm_area_struct *vma, unsigned long addr) 2207 { 2208 struct page *page = NULL; 2209 struct mempolicy *mpol; 2210 gfp_t gfp_mask = htlb_alloc_mask(h); 2211 int nid; 2212 nodemask_t *nodemask; 2213 2214 nid = huge_node(vma, addr, gfp_mask, &mpol, &nodemask); 2215 if (mpol_is_preferred_many(mpol)) { > 2216 gfp_t gfp = gfp_mask | __GFP_NOWARN; 2217 2218 gfp &= ~(__GFP_DIRECT_RECLAIM | __GFP_NOFAIL); 2219 page = alloc_surplus_huge_page(h, gfp_mask, nid, nodemask); 2220 2221 /* Fallback to all nodes if page==NULL */ 2222 nodemask = NULL; 2223 } 2224 2225 if (!page) 2226 page = alloc_surplus_huge_page(h, gfp_mask, nid, nodemask); 2227 mpol_cond_put(mpol); 2228 return page; 2229 } 2230 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1605/1605] net/9p/client.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: a6fb923f7803f40a567445dfe1ff3a539c8adc1f [1605/1605] 9p: Use a slab for allocating requests config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507020802.Dmvtg8wR-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507020802.Dmvtg8wR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507020802.Dmvtg8wR-lkp@intel.com/ All warnings (new ones prefixed by >>): net/9p/client.c:376: warning: Function parameter or member 'c' not described in 'p9_client_cb' net/9p/client.c:376: warning: Function parameter or member 'req' not described in 'p9_client_cb' net/9p/client.c:376: warning: Function parameter or member 'status' not described in 'p9_client_cb' net/9p/client.c:523: warning: Function parameter or member 'uidata' not described in 'p9_check_zc_errors' net/9p/client.c:774: warning: Function parameter or member 'in_hdrlen' not described in 'p9_client_zc_rpc' net/9p/client.c:774: warning: Excess function parameter 'hdrlen' description in 'p9_client_zc_rpc' >> net/9p/client.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/3] CVE-2025-37784
by GONG Ruiqi 02 Jul '25

02 Jul '25

Fixing CVE-2025-37784. Meghana Malladi (3): net: ti: icss-iep: Add pwidth configuration for perout signal net: ti: icss-iep: Add phase offset configuration for perout signal net: ti: icss-iep: Fix possible NULL pointer dereference for perout request drivers/net/ethernet/ti/icssg/icss_iep.c | 154 +++++++++++++++-------- 1 file changed, 102 insertions(+), 52 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6] drm/v3d: Add job to pending list if the reset was skipped
by GONG Ruiqi 02 Jul '25

02 Jul '25

From: Maíra Canal <mcanal(a)igalia.com> stable inclusion from stable-v6.6.91 commit 12125f7d9c15e6d8ac91d10373b2db2f17dcf767 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC9933 CVE: CVE-2025-37951 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 35e4079bf1a2570abffce6ababa631afcf8ea0e5 upstream. When a CL/CSD job times out, we check if the GPU has made any progress since the last timeout. If so, instead of resetting the hardware, we skip the reset and let the timer get rearmed. This gives long-running jobs a chance to complete. However, when `timedout_job()` is called, the job in question is removed from the pending list, which means it won't be automatically freed through `free_job()`. Consequently, when we skip the reset and keep the job running, the job won't be freed when it finally completes. This situation leads to a memory leak, as exposed in [1] and [2]. Similarly to commit 704d3d60fec4 ("drm/etnaviv: don't block scheduler when GPU is still active"), this patch ensures the job is put back on the pending list when extending the timeout. Cc: stable(a)vger.kernel.org # 6.0 Reported-by: Daivik Bhatia <dtgs1208(a)gmail.com> Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/12227 [1] Closes: https://github.com/raspberrypi/linux/issues/6817 [2] Reviewed-by: Iago Toral Quiroga <itoral(a)igalia.com> Acked-by: Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> Link: https://lore.kernel.org/r/20250430210643.57924-1-mcanal@igalia.com Signed-off-by: Maíra Canal <mcanal(a)igalia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- drivers/gpu/drm/v3d/v3d_sched.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c index 06238e6d7f5c..aa862a1b7fd2 100644 --- a/drivers/gpu/drm/v3d/v3d_sched.c +++ b/drivers/gpu/drm/v3d/v3d_sched.c @@ -282,11 +282,16 @@ v3d_gpu_reset_for_timeout(struct v3d_dev *v3d, struct drm_sched_job *sched_job) return DRM_GPU_SCHED_STAT_NOMINAL; } -/* If the current address or return address have changed, then the GPU - * has probably made progress and we should delay the reset. This - * could fail if the GPU got in an infinite loop in the CL, but that - * is pretty unlikely outside of an i-g-t testcase. - */ +static void +v3d_sched_skip_reset(struct drm_sched_job *sched_job) +{ + struct drm_gpu_scheduler *sched = sched_job->sched; + + spin_lock(&sched->job_list_lock); + list_add(&sched_job->list, &sched->pending_list); + spin_unlock(&sched->job_list_lock); +} + static enum drm_gpu_sched_stat v3d_cl_job_timedout(struct drm_sched_job *sched_job, enum v3d_queue q, u32 *timedout_ctca, u32 *timedout_ctra) @@ -296,9 +301,16 @@ v3d_cl_job_timedout(struct drm_sched_job *sched_job, enum v3d_queue q, u32 ctca = V3D_CORE_READ(0, V3D_CLE_CTNCA(q)); u32 ctra = V3D_CORE_READ(0, V3D_CLE_CTNRA(q)); + /* If the current address or return address have changed, then the GPU + * has probably made progress and we should delay the reset. This + * could fail if the GPU got in an infinite loop in the CL, but that + * is pretty unlikely outside of an i-g-t testcase. + */ if (*timedout_ctca != ctca || *timedout_ctra != ctra) { *timedout_ctca = ctca; *timedout_ctra = ctra; + + v3d_sched_skip_reset(sched_job); return DRM_GPU_SCHED_STAT_NOMINAL; } @@ -338,11 +350,13 @@ v3d_csd_job_timedout(struct drm_sched_job *sched_job) struct v3d_dev *v3d = job->base.v3d; u32 batches = V3D_CORE_READ(0, V3D_CSD_CURRENT_CFG4); - /* If we've made progress, skip reset and let the timer get - * rearmed. + /* If we've made progress, skip reset, add the job to the pending + * list, and let the timer get rearmed. */ if (job->timedout_batches != batches) { job->timedout_batches = batches; + + v3d_sched_skip_reset(sched_job); return DRM_GPU_SCHED_STAT_NOMINAL; } -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] net/tipc/topsrv.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 02 Jul '25

02 Jul '25

Hi Junwei, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: e373fab80587f72c98463df1f4511d06011f915c [1605/1605] tipc: fix modprobe tipc failed after switch order of device registration config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507020608.4lfjVJFL-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507020608.4lfjVJFL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507020608.4lfjVJFL-lkp@intel.com/ All warnings (new ones prefixed by >>): net/tipc/topsrv.c:82: warning: Function parameter or member 'awork' not described in 'tipc_topsrv' net/tipc/topsrv.c:82: warning: Function parameter or member 'listener' not described in 'tipc_topsrv' >> net/tipc/topsrv.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] arch/x86/events/amd/core.c:716:24: warning: variable 'hwc' set but not used
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fdf755b0cabc80fc65da83c9da27ec2cee144dc commit: f760d3d70f9029c226c09529168977f860e83950 [2882/2882] perf/x86/amd: Add AMD Fam19h Branch Sampling support config: x86_64-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507020623.TJsJ79Ng-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507020623.TJsJ79Ng-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507020623.TJsJ79Ng-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/events/amd/core.c:716:24: warning: variable 'hwc' set but not used [-Wunused-but-set-variable] 716 | struct hw_perf_event *hwc; | ^ 1 warning generated. vim +/hwc +716 arch/x86/events/amd/core.c 712 713 static void amd_pmu_enable_all(int added) 714 { 715 struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); > 716 struct hw_perf_event *hwc; 717 int idx; 718 719 amd_brs_enable_all(); 720 721 for (idx = 0; idx < x86_pmu.num_counters; idx++) { 722 hwc = &cpuc->events[idx]->hw; 723 724 /* only activate events which are marked as active */ 725 if (!test_bit(idx, cpuc->active_mask)) 726 continue; 727 728 amd_pmu_enable_event(cpuc->events[idx]); 729 } 730 } 731 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2439/2439] kismet: WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE when selected by ARM64
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 5cdbc324acd417828860d3425c4f769518485c7c commit: 6df2e969a6de3481167ace4fe42f69812a6c7fc8 [2439/2439] arm64: add config for cpuidle-haltpoll config: arm64-kismet-CONFIG_HALTPOLL_CPUIDLE-CONFIG_ARM64-0-0 (https://download.01.org/0day-ci/archive/20250702/202507021253.zjMMyzmu-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250702/202507021253.zjMMyzmu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021253.zjMMyzmu-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE when selected by ARM64 WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE Depends on [n]: CPU_IDLE [=n] && ARCH_CPUIDLE_HALTPOLL [=y] && ARCH_HAS_OPTIMIZED_POLL [=y] Selected by [y]: - ARM64 [=y] WARNING: unmet direct dependencies detected for RESCTRL_FS Depends on [n]: MISC_FILESYSTEMS [=n] && ARCH_HAS_CPU_RESCTRL [=y] Selected by [y]: - ARM64_MPAM [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH v5.10-next] vhost-scsi: protect vq->log_used with vq->mutex
by ZHENG Xinyu 02 Jul '25

02 Jul '25

From: Dongli Zhang <dongli.zhang(a)oracle.com> [ Upstream commit f591cf9fce724e5075cc67488c43c6e39e8cbe27 ] The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU disables vq->log_used via VHOST_SET_VRING_ADDR. mutex_lock(&vq->mutex); vq->log_used = false now! mutex_unlock(&vq->mutex); QEMU gfree(vq->log_base) log_used() -> log_write(vq->log_base) Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace. The control queue path has the same issue. CVE-2025-38074 Cc: stable(a)vger.kernel.org#5.10.x Cc: gregkh(a)linuxfoundation.org Signed-off-by: Dongli Zhang <dongli.zhang(a)oracle.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Message-Id: <20250403063028.16045-2-dongli.zhang(a)oracle.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> [ Conflicts in drivers/vhost/scsi.c bacause vhost_scsi_complete_cmd_work() has been refactored. ] Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/vhost/scsi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index a23a65e7d828..fcde3752b4f1 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -579,8 +579,10 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter); if (likely(ret == sizeof(v_rsp))) { struct vhost_scsi_virtqueue *q; - vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0); q = container_of(cmd->tvc_vq, struct vhost_scsi_virtqueue, vq); + mutex_lock(&q->vq.mutex); + vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0); + mutex_unlock(&q->vq.mutex); vq = q - vs->vqs; __set_bit(vq, signal); } else @@ -1193,8 +1195,11 @@ static void vhost_scsi_tmf_resp_work(struct vhost_work *work) else resp_code = VIRTIO_SCSI_S_FUNCTION_REJECTED; + mutex_lock(&tmf->svq->vq.mutex); vhost_scsi_send_tmf_resp(tmf->vhost, &tmf->svq->vq, tmf->in_iovs, tmf->vq_desc, &tmf->resp_iov, resp_code); + mutex_unlock(&tmf->svq->vq.mutex); + vhost_scsi_release_tmf_res(tmf); } -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS v3] mm: fix uprobe pte be overwritten when expanding vma
by Pu Lehui 02 Jul '25

02 Jul '25

mainline inclusion from mainline-v6.16-rc1 commit 2b12d06c37fd3a394376f42f026a7478d826ed63 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICIYRH Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Patch series "Fix uprobe pte be overwritten when expanding vma". This patch (of 4): We encountered a BUG alert triggered by Syzkaller as follows: BUG: Bad rss-counter state mm:00000000b4a60fca type:MM_ANONPAGES val:1 And we can reproduce it with the following steps: 1. register uprobe on file at zero offset 2. mmap the file at zero offset: addr1 = mmap(NULL, 2 * 4096, PROT_NONE, MAP_PRIVATE, fd, 0); 3. mremap part of vma1 to new vma2: addr2 = mremap(addr1, 4096, 2 * 4096, MREMAP_MAYMOVE); 4. mremap back to orig addr1: mremap(addr2, 4096, 4096, MREMAP_MAYMOVE | MREMAP_FIXED, addr1); In step 3, the vma1 range [addr1, addr1 + 4096] will be remap to new vma2 with range [addr2, addr2 + 8192], and remap uprobe anon page from the vma1 to vma2, then unmap the vma1 range [addr1, addr1 + 4096]. In step 4, the vma2 range [addr2, addr2 + 4096] will be remap back to the addr range [addr1, addr1 + 4096]. Since the addr range [addr1 + 4096, addr1 + 8192] still maps the file, it will take vma_merge_new_range to expand the range, and then do uprobe_mmap in vma_complete. Since the merged vma pgoff is also zero offset, it will install uprobe anon page to the merged vma. However, the upcomming move_page_tables step, which use set_pte_at to remap the vma2 uprobe pte to the merged vma, will overwrite the newly uprobe pte in the merged vma, and lead that pte to be orphan. Since the uprobe pte will be remapped to the merged vma, we can remove the unnecessary uprobe_mmap upon merged vma. This problem was first found in linux-6.6.y and also exists in the community syzkaller: https://lore.kernel.org/all/000000000000ada39605a5e71711@google.com/T/ Link: https://lkml.kernel.org/r/20250529155650.4017699-1-pulehui@huaweicloud.com Link: https://lkml.kernel.org/r/20250529155650.4017699-2-pulehui@huaweicloud.com Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Suggested-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Jann Horn <jannh(a)google.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: "Masami Hiramatsu (Google)" <mhiramat(a)kernel.org> Cc: Oleg Nesterov <oleg(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/userfaultfd.c include/linux/mm.h mm/madvise.c mm/mempolicy.c mm/mlock.c mm/mmap.c mm/mprotect.c mm/vma.h mm/vma.c [The conflicts were due to refactor commit 440703e082b9c and 2f1c6611b0a8] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/userfaultfd.c | 6 +++--- include/linux/mm.h | 6 +++--- mm/madvise.c | 2 +- mm/mempolicy.c | 2 +- mm/mlock.c | 2 +- mm/mmap.c | 46 ++++++++++++++++++++++++++++++++++------------ mm/mprotect.c | 2 +- 7 files changed, 44 insertions(+), 22 deletions(-) diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 803c61f66d54..3e11e9763527 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -925,7 +925,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) new_flags, vma->anon_vma, vma->vm_file, vma->vm_pgoff, vma_policy(vma), - NULL_VM_UFFD_CTX); + NULL_VM_UFFD_CTX, false); if (prev) vma = prev; else @@ -1492,7 +1492,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, prev = vma_merge(mm, prev, start, vma_end, new_flags, vma->anon_vma, vma->vm_file, vma->vm_pgoff, vma_policy(vma), - ((struct vm_userfaultfd_ctx){ ctx })); + ((struct vm_userfaultfd_ctx){ ctx }), false); if (prev) { vma = prev; goto next; @@ -1654,7 +1654,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, prev = vma_merge(mm, prev, start, vma_end, new_flags, vma->anon_vma, vma->vm_file, vma->vm_pgoff, vma_policy(vma), - NULL_VM_UFFD_CTX); + NULL_VM_UFFD_CTX, false); if (prev) { vma = prev; goto next; diff --git a/include/linux/mm.h b/include/linux/mm.h index 67e299374ac8..8cae7fb6542a 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2367,16 +2367,16 @@ void anon_vma_interval_tree_verify(struct anon_vma_chain *node); extern int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin); extern int __vma_adjust(struct vm_area_struct *vma, unsigned long start, unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert, - struct vm_area_struct *expand); + struct vm_area_struct *expand, bool skip_vma_uprobe); static inline int vma_adjust(struct vm_area_struct *vma, unsigned long start, unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert) { - return __vma_adjust(vma, start, end, pgoff, insert, NULL); + return __vma_adjust(vma, start, end, pgoff, insert, NULL, false); } extern struct vm_area_struct *vma_merge(struct mm_struct *, struct vm_area_struct *prev, unsigned long addr, unsigned long end, unsigned long vm_flags, struct anon_vma *, struct file *, pgoff_t, - struct mempolicy *, struct vm_userfaultfd_ctx); + struct mempolicy *, struct vm_userfaultfd_ctx, bool skip_vma_uprobe); extern struct anon_vma *find_mergeable_anon_vma(struct vm_area_struct *); extern int __split_vma(struct mm_struct *, struct vm_area_struct *, unsigned long addr, int new_below); diff --git a/mm/madvise.c b/mm/madvise.c index 263c2c68b0de..0670786a23a5 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -145,7 +145,7 @@ static long madvise_behavior(struct vm_area_struct *vma, pgoff = vma->vm_pgoff + ((start - vma->vm_start) >> PAGE_SHIFT); *prev = vma_merge(mm, *prev, start, end, new_flags, vma->anon_vma, vma->vm_file, pgoff, vma_policy(vma), - vma->vm_userfaultfd_ctx); + vma->vm_userfaultfd_ctx, false); if (*prev) { vma = *prev; goto success; diff --git a/mm/mempolicy.c b/mm/mempolicy.c index e8c82f3235e2..882310ef3d93 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -818,7 +818,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, ((vmstart - vma->vm_start) >> PAGE_SHIFT); prev = vma_merge(mm, prev, vmstart, vmend, vma->vm_flags, vma->anon_vma, vma->vm_file, pgoff, - new_pol, vma->vm_userfaultfd_ctx); + new_pol, vma->vm_userfaultfd_ctx, false); if (prev) { vma = prev; goto replace; diff --git a/mm/mlock.c b/mm/mlock.c index d9040aea2be0..cb4e1207169a 100644 --- a/mm/mlock.c +++ b/mm/mlock.c @@ -540,7 +540,7 @@ static int mlock_fixup(struct vm_area_struct *vma, struct vm_area_struct **prev, pgoff = vma->vm_pgoff + ((start - vma->vm_start) >> PAGE_SHIFT); *prev = vma_merge(mm, *prev, start, end, newflags, vma->anon_vma, vma->vm_file, pgoff, vma_policy(vma), - vma->vm_userfaultfd_ctx); + vma->vm_userfaultfd_ctx, false); if (*prev) { vma = *prev; goto success; diff --git a/mm/mmap.c b/mm/mmap.c index ad643f9dd3a4..e9ae6c7af7aa 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -684,10 +684,13 @@ static inline void __vma_unlink_prev(struct mm_struct *mm, * The following helper function should be used when such adjustments * are necessary. The "insert" vma (if any) is to be inserted * before we drop the necessary locks. + * + * @skip_vma_uprobe: only valid for vma_merge process, others please + * mark it as false. */ int __vma_adjust(struct vm_area_struct *vma, unsigned long start, unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert, - struct vm_area_struct *expand) + struct vm_area_struct *expand, bool skip_vma_uprobe) { struct mm_struct *mm = vma->vm_mm; struct vm_area_struct *next = vma->vm_next, *orig_vma = vma; @@ -894,10 +897,12 @@ int __vma_adjust(struct vm_area_struct *vma, unsigned long start, i_mmap_unlock_write(mapping); if (root) { - uprobe_mmap(vma); + if (!skip_vma_uprobe) { + uprobe_mmap(vma); - if (adjust_next) - uprobe_mmap(next); + if (adjust_next) + uprobe_mmap(next); + } } if (remove_next) { @@ -1102,13 +1107,17 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags, * or other rmap walkers (if working on addresses beyond the "end" * parameter) may establish ptes with the wrong permissions of NNNN * instead of the right permissions of XXXX. + * + * @skip_vma_uprobe: only valid for copy_vma process, others please + * mark it as false. */ struct vm_area_struct *vma_merge(struct mm_struct *mm, struct vm_area_struct *prev, unsigned long addr, unsigned long end, unsigned long vm_flags, struct anon_vma *anon_vma, struct file *file, pgoff_t pgoff, struct mempolicy *policy, - struct vm_userfaultfd_ctx vm_userfaultfd_ctx) + struct vm_userfaultfd_ctx vm_userfaultfd_ctx, + bool skip_vma_uprobe) { pgoff_t pglen = (end - addr) >> PAGE_SHIFT; struct vm_area_struct *area, *next; @@ -1160,10 +1169,11 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, /* cases 1, 6 */ err = __vma_adjust(prev, prev->vm_start, next->vm_end, prev->vm_pgoff, NULL, - prev); + prev, skip_vma_uprobe); } else /* cases 2, 5, 7 */ err = __vma_adjust(prev, prev->vm_start, - end, prev->vm_pgoff, NULL, prev); + end, prev->vm_pgoff, NULL, + prev, skip_vma_uprobe); if (err) return NULL; khugepaged_enter_vma_merge(prev, vm_flags); @@ -1180,10 +1190,12 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, vm_userfaultfd_ctx)) { if (prev && addr < prev->vm_end) /* case 4 */ err = __vma_adjust(prev, prev->vm_start, - addr, prev->vm_pgoff, NULL, next); + addr, prev->vm_pgoff, NULL, + next, skip_vma_uprobe); else { /* cases 3, 8 */ err = __vma_adjust(area, addr, next->vm_end, - next->vm_pgoff - pglen, NULL, next); + next->vm_pgoff - pglen, NULL, + next, skip_vma_uprobe); /* * In case 3 area is already equal to next and * this is a noop, but in case 8 "area" has @@ -1974,7 +1986,7 @@ static unsigned long __mmap_region(struct mm_struct *mm, struct file *file, * Can we just expand an old mapping? */ vma = vma_merge(mm, prev, addr, addr + len, vm_flags, - NULL, file, pgoff, NULL, NULL_VM_UFFD_CTX); + NULL, file, pgoff, NULL, NULL_VM_UFFD_CTX, false); if (vma) goto out; @@ -3381,7 +3393,7 @@ static int do_brk_flags(unsigned long addr, unsigned long len, unsigned long fla /* Can we just expand an old private anonymous mapping? */ vma = vma_merge(mm, prev, addr, addr + len, flags, - NULL, NULL, pgoff, NULL, NULL_VM_UFFD_CTX); + NULL, NULL, pgoff, NULL, NULL_VM_UFFD_CTX, false); if (vma) goto out; @@ -3566,6 +3578,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, struct vm_area_struct *new_vma, *prev; struct rb_node **rb_link, *rb_parent; bool faulted_in_anon_vma = true; + bool skip_vma_uprobe = false; /* * If anonymous vma has not yet been faulted, update new pgoff @@ -3578,9 +3591,18 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, if (find_vma_links(mm, addr, addr + len, &prev, &rb_link, &rb_parent)) return NULL; /* should never get here */ + + /* + * If the VMA we are copying might contain a uprobe PTE, ensure + * that we do not establish one upon merge. Otherwise, when mremap() + * moves page tables, it will orphan the newly created PTE. + */ + if (vma->vm_file) + skip_vma_uprobe = true; + new_vma = vma_merge(mm, prev, addr, addr + len, vma->vm_flags, vma->anon_vma, vma->vm_file, pgoff, vma_policy(vma), - vma->vm_userfaultfd_ctx); + vma->vm_userfaultfd_ctx, skip_vma_uprobe); if (new_vma) { /* * Source vma may have been merged into new_vma diff --git a/mm/mprotect.c b/mm/mprotect.c index 86837f25055b..4c7370fd3e90 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -432,7 +432,7 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev, pgoff = vma->vm_pgoff + ((start - vma->vm_start) >> PAGE_SHIFT); *pprev = vma_merge(mm, *pprev, start, end, newflags, vma->anon_vma, vma->vm_file, pgoff, vma_policy(vma), - vma->vm_userfaultfd_ctx); + vma->vm_userfaultfd_ctx, false); if (*pprev) { vma = *pprev; VM_WARN_ON((vma->vm_flags ^ newflags) & ~VM_SOFTDIRTY); -- 2.34.1

2 1

[PATCH OLK-5.10 v5 00/12] HiSock Redirect Framework
by Pu Lehui 02 Jul '25

02 Jul '25

HiSock Redirect Framework, which bypasses net filter rules for specific connections selected by bpf prog on both TX and RX directions. Julien Thierry (1): arm64: insn: Add some opcodes to instruction decoder Pu Lehui (10): bpf: Add CONFIG_HISOCK bpf: Add XDP_HISOCK_REDIRECT action bpf: Add BPF_PROG_TYPE_HISOCK prog type bpf: Add HISOCK_EGRESS hook on network egress path bpf: Add bpf_get_ingress_dst helper bpf: Add hisock_xdp_buff wrapper for xdp_buff bpf: Add bpf_set_ingress_dst helper bpf: Add bpf_change_skb_dev helper openeuler_defconfig: Enable CONFIG_HISOCK samples/bpf: Add HiSock Redirect sample Xu Kuohai (1): bpf: Add bpf_ext_memcpy extension helper for arm64 arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/insn.h | 13 + arch/arm64/kernel/insn.c | 8 + arch/arm64/net/bpf_jit.h | 15 + arch/arm64/net/bpf_jit_comp.c | 266 ++++++++++++++++ arch/x86/configs/openeuler_defconfig | 1 + include/linux/bpf-cgroup.h | 35 +++ include/linux/bpf_types.h | 4 + include/linux/filter.h | 3 + include/net/xdp.h | 5 + include/uapi/linux/bpf.h | 45 +++ kernel/bpf/cgroup.c | 43 +++ kernel/bpf/core.c | 7 + kernel/bpf/helpers.c | 27 ++ kernel/bpf/syscall.c | 19 ++ kernel/bpf/verifier.c | 28 ++ net/Kconfig | 10 + net/core/dev.c | 77 ++++- net/core/filter.c | 184 +++++++++++ net/ipv4/ip_output.c | 68 +++++ samples/bpf/.gitignore | 1 + samples/bpf/Makefile | 3 + samples/bpf/hisock/bpf.c | 247 +++++++++++++++ samples/bpf/hisock/hisock_cmd.c | 405 +++++++++++++++++++++++++ tools/bpf/bpftool/common.c | 1 + tools/bpf/bpftool/prog.c | 1 + tools/include/uapi/linux/bpf.h | 45 +++ tools/lib/bpf/libbpf.c | 2 + 28 files changed, 1561 insertions(+), 3 deletions(-) create mode 100644 samples/bpf/hisock/bpf.c create mode 100644 samples/bpf/hisock/hisock_cmd.c -- 2.34.1

2 13