- Kernel - mailweb.openeuler.org

Re: [PATCH OLK-6.6 v2 2/3] arm64: entry: Support hardware xint
by Jinjie Ruan 25 Mar '25

25 Mar '25

On 2025/3/25 15:00, Liao, Chang wrote: > > > 在 2025/3/24 21:53, Jinjie Ruan 写道: >> hulk inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/release-management/issues/IBV2E4 >> >> -------------------------------- >> >> Support hardware xint. Hardware xint provides a separate entry for >> interrupt handling, so we can use it to customize and respond to >> interrupts relatively quickly. >> >> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> >> --- >> v2: >> - Reuse the xint set and check logic in xint 1.0. >> - Introduce fast_handle_xint(). >> - Rename enable_xint_xcall() to enable_xfunc(). >> - Rename test_has_xint_xcall() to test_has_xfunc(). >> - Fix a typo, Harware -> Hardware. >> - Add a blank line after declarations in el0t_64_xint_handler(). >> --- >> arch/arm64/Kconfig | 7 +++ >> arch/arm64/include/asm/sysreg.h | 4 ++ >> arch/arm64/kernel/cpufeature.c | 75 ++++++++++++++++++++++++- >> arch/arm64/kernel/entry-common.c | 35 +++++++++--- >> arch/arm64/kernel/entry.S | 40 +++++++++++++- >> arch/arm64/tools/cpucaps | 2 +- >> drivers/irqchip/irq-gic-v3.c | 89 ++++++++++++++++++++++++++++-- >> include/linux/irqchip/arm-gic-v3.h | 6 +- >> kernel/irq/debugfs.c | 6 +- >> kernel/irq/internals.h | 3 +- >> 10 files changed, 244 insertions(+), 23 deletions(-) >> >> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig >> index 9da9d58f1c02..57d05cfbd29e 100644 >> --- a/arch/arm64/Kconfig >> +++ b/arch/arm64/Kconfig >> @@ -1717,6 +1717,13 @@ config ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG >> config ARCH_SUPPORTS_CRASH_DUMP >> def_bool y >> >> +config ARCH_SUPPORTS_XINT >> + bool "Hardware xint support" >> + default n >> + depends on ARM64_NMI >> + depends on ARM_GIC_V3 >> + depends on !COMPAT >> + >> config TRANS_TABLE >> def_bool y >> depends on HIBERNATION || KEXEC_CORE >> diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h >> index 435634a703c6..b34e8cc4476b 100644 >> --- a/arch/arm64/include/asm/sysreg.h >> +++ b/arch/arm64/include/asm/sysreg.h >> @@ -269,6 +269,10 @@ >> #define SYS_REVIDR_EL1 sys_reg(3, 0, 0, 0, 6) >> >> #define SYS_ACTLR_EL1 sys_reg(3, 0, 1, 0, 1) >> + >> +#define ACTLR_ELx_XINT_SHIFT 21 >> +#define ACTLR_ELx_XINT (BIT(ACTLR_ELx_XINT_SHIFT)) >> + > > I don't think sysreg.h is the best place for those ACTLR_ELx bits. This header's > more about the actual uint32 upcode of system register. not the details of the fields. > And since ACTLR_ELx fields vary implementation. I think we should put them in a new > heade, actlr.h like kernel does with esr.h. > > >> #define SYS_RGSR_EL1 sys_reg(3, 0, 1, 0, 5) >> #define SYS_GCR_EL1 sys_reg(3, 0, 1, 0, 6) >> >> diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c >> index a1736e9044da..b4de05241f7d 100644 >> --- a/arch/arm64/kernel/cpufeature.c >> +++ b/arch/arm64/kernel/cpufeature.c >> @@ -2406,8 +2406,12 @@ static bool has_xcall_support(const struct arm64_cpu_capabilities *entry, int __ >> } >> #endif >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> bool is_xint_support; >> +bool hw_xint_support; >> +#endif >> + >> +#ifdef CONFIG_FAST_IRQ >> static int __init xint_setup(char *str) >> { >> if (!cpus_have_cap(ARM64_HAS_GIC_CPUIF_SYSREGS)) >> @@ -2424,6 +2428,66 @@ static bool has_xint_support(const struct arm64_cpu_capabilities *entry, int __u >> } >> #endif >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +static bool test_has_xfunc(void) > > test_has_xfunc is a bit strange, could we just use has_arch_xint_support()? > >> +{ >> + u64 new, old = read_sysreg(actlr_el1); >> + >> + write_sysreg(old | ACTLR_ELx_XINT, actlr_el1); >> + isb(); >> + new = read_sysreg(actlr_el1); >> + if (new & ACTLR_ELx_XINT) { >> + write_sysreg(old, actlr_el1); >> + hw_xint_support = true; >> + return true; >> + } >> + >> + return false; >> +} >> + >> +static void enable_xfunc(void) > > Could we use cpu_enable_arch_xint()? it is not hard to find some helper functions > in this file has similar role as this. > >> +{ >> + u64 actlr_el1, actlr_el2; >> + u64 el; >> + >> + el = read_sysreg(CurrentEL); >> + if (el == CurrentEL_EL2) { >> + actlr_el2 = read_sysreg(actlr_el2); >> + actlr_el2 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el2, actlr_el2); >> + isb(); >> + actlr_el2 = read_sysreg(actlr_el2); >> + pr_info("actlr_el2: %llx, cpu:%d\n", actlr_el2, smp_processor_id()); >> + } >> + >> + actlr_el1 = read_sysreg(actlr_el1); >> + actlr_el1 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el1, actlr_el1); >> + isb(); >> + actlr_el1 = read_sysreg(actlr_el1); >> + pr_info("actlr_el1: %llx, cpu:%d\n", actlr_el1, smp_processor_id()); >> +} >> + >> +static bool test_has_xint(const struct arm64_cpu_capabilities *entry, int scope) >> +{ >> + if (!IS_ENABLED(CONFIG_ARM64_NMI)) >> + pr_info("CONFIG_ARM64_NMI disabled, using XINTs for guests only\n"); >> +#ifdef CONFIG_ARM64_PSEUDO_NMI >> + else if (IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) && enable_pseudo_nmi) { >> + pr_info("Pseudo NMI enabled, not using architected XINT\n"); >> + return false; >> + } >> +#endif >> + >> + return test_has_xfunc(); >> +} > > Fold this function into has_arch_xint_support(). > >> + >> +static void xint_enable(const struct arm64_cpu_capabilities *__unused) >> +{ >> + enable_xfunc(); > > Fold this function into cpu_enable_arch_xint(). > >> +} >> +#endif >> + >> static const struct arm64_cpu_capabilities arm64_features[] = { >> { >> .capability = ARM64_ALWAYS_BOOT, >> @@ -2971,6 +3035,15 @@ static const struct arm64_cpu_capabilities arm64_features[] = { >> .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> .matches = has_xint_support, >> }, >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + { >> + .desc = "Hardware xint Support", > > Mind the ppercase for first letter. > >> + .capability = ARM64_HAS_HW_XINT, >> + .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> + .matches = test_has_xint, >> + .cpu_enable = xint_enable, >> + }, >> #endif > > I really can't recall why we add "Xint support" data into arm64_feature array before. > Just to be clear, "Xint support' is a software solution, it's about making interrupt > handler faster. It's not tied to any particular CPU feature. "Hardware Xint Support" > would means something different, like a real CPU feature. So I think we should take > it out from the arm64_feature array upon CPU can support a hardware xint entry. 这个在实现xcall/xint 1.0代码的时候，是为了和后面硬件xcall/xint的检测代码兼容吧，当时检视意见是统一和xcall一样这样做 @邹贻鹏 > >> {}, >> }; >> diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c >> index 4602c107c40a..d09029dfcf02 100644 >> --- a/arch/arm64/kernel/entry-common.c >> +++ b/arch/arm64/kernel/entry-common.c >> @@ -6,6 +6,9 @@ >> */ >> >> #include <linux/context_tracking.h> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +#include <linux/irqchip/arm-gic-v3.h> >> +#endif >> #include <linux/kasan.h> >> #include <linux/linkage.h> >> #include <linux/lockdep.h> >> @@ -607,7 +610,7 @@ static void noinstr el0_xint(struct pt_regs *regs, u64 nmi_flag, >> } >> >> >> -asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +asmlinkage void noinstr el0t_64_sw_xint_handler(struct pt_regs *regs) >> { >> el0_xint(regs, ISR_EL1_IS, handle_arch_irq, handle_arch_nmi_irq); >> } >> @@ -966,6 +969,30 @@ asmlinkage void noinstr el0t_64_error_handler(struct pt_regs *regs) >> __el0_error_handler_common(regs); >> } >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +{ >> + u32 irqnr = read_sysreg_s(SYS_ICC_HPPIR1_EL1); >> + >> + if (gic_irqnr_is_special(irqnr)) >> + return; >> + >> + if (is_xint(irqnr)) >> + fast_handle_xint(regs, irqnr); >> + else >> + el0t_64_irq_handler(regs); >> +} > > Could we register fast_handle_xint() in gic-v3 driver, like kernel does for gic_handle_irq() > and gic_handle_nmi_irq(). By checking the return value, it still has chance to fall through > to the regular irq handler. > >> +#else >> +#ifdef CONFIG_AARCH32_EL0 >> +asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> +{ >> + __el0_irq_handler_common(regs); >> +} >> +#else /* CONFIG_AARCH32_EL0 */ >> +UNHANDLED(el0t, 32, irq) >> +#endif >> +#endif >> + >> #ifdef CONFIG_AARCH32_EL0 >> static void noinstr el0_cp15(struct pt_regs *regs, unsigned long esr) >> { >> @@ -1028,11 +1055,6 @@ asmlinkage void noinstr el0t_32_sync_handler(struct pt_regs *regs) >> } >> } >> >> -asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> -{ >> - __el0_irq_handler_common(regs); >> -} >> - >> asmlinkage void noinstr el0t_32_fiq_handler(struct pt_regs *regs) >> { >> __el0_fiq_handler_common(regs); >> @@ -1044,7 +1066,6 @@ asmlinkage void noinstr el0t_32_error_handler(struct pt_regs *regs) >> } >> #else /* CONFIG_AARCH32_EL0 */ >> UNHANDLED(el0t, 32, sync) >> -UNHANDLED(el0t, 32, irq) >> UNHANDLED(el0t, 32, fiq) >> UNHANDLED(el0t, 32, error) >> #endif /* CONFIG_AARCH32_EL0 */ >> diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S >> index da3809632f0f..046225fa2f90 100644 >> --- a/arch/arm64/kernel/entry.S >> +++ b/arch/arm64/kernel/entry.S >> @@ -565,7 +565,11 @@ SYM_CODE_START(vectors) >> kernel_ventry 0, t, 64, error // Error 64-bit EL0 >> >> kernel_ventry 0, t, 32, sync // Synchronous 32-bit EL0 >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + kernel_ventry 0, t, 64, xint // XINT 64-bit EL0 >> +#else >> kernel_ventry 0, t, 32, irq // IRQ 32-bit EL0 >> +#endif >> kernel_ventry 0, t, 32, fiq // FIQ 32-bit EL0 >> kernel_ventry 0, t, 32, error // Error 32-bit EL0 >> SYM_CODE_END(vectors) >> @@ -696,7 +700,7 @@ SYM_CODE_END(__bad_stack) >> kernel_entry 0, 64 >> #endif >> mov x0, sp >> - bl el0t_64_xint_handler >> + bl el0t_64_sw_xint_handler >> #ifdef CONFIG_SECURITY_FEATURE_BYPASS >> kernel_exit 0, xint >> #else >> @@ -729,6 +733,18 @@ SYM_CODE_START_LOCAL(el\el\ht\()_\regsize\()_\label) >> check_xint_pre_kernel_entry >> .Lskip_check_xint\@: >> .endif >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + .if \el == 0 && \regsize == 64 && \label == xint >> + alternative_if_not ARM64_HAS_HW_XINT >> + b .Lskip_hw_xint\@ >> + alternative_else_nop_endif >> + kernel_entry 0, 64, xint >> + mov x0, sp >> + bl el0t_64_xint_handler >> + kernel_exit 0, xint > > Could we fold the assembly code on else branch into its own macro？ > Let's give a the macro an name that has similar style with the ones > we uses in the code braced by CONFIG_FAST_IRQ/SYSCALL. > >> +.Lskip_hw_xint\@: >> + .endif >> #endif >> kernel_entry \el, \regsize >> mov x0, sp >> @@ -760,7 +776,11 @@ SYM_CODE_END(el\el\ht\()_\regsize\()_\label) >> entry_handler 0, t, 64, error >> >> entry_handler 0, t, 32, sync >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + entry_handler 0, t, 64, xint >> +#else >> entry_handler 0, t, 32, irq >> +#endif >> entry_handler 0, t, 32, fiq >> entry_handler 0, t, 32, error >> >> @@ -905,7 +925,14 @@ alternative_else_nop_endif >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> +#endif >> + >> + .rept 3 >> tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> .endr >> .endm >> @@ -955,7 +982,14 @@ SYM_CODE_END(tramp_exit) >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, 0, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, 0, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, 0, \bhb >> +#endif >> + >> + .rept 3 > >> tramp_ventry .Lvector_start\@, 32, 0, \bhb >> .endr >> .endm >> diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps >> index f2ddced689b5..b1f109f17e4f 100644 >> --- a/arch/arm64/tools/cpucaps >> +++ b/arch/arm64/tools/cpucaps >> @@ -110,7 +110,7 @@ WORKAROUND_HISI_HIP08_RU_PREFETCH >> WORKAROUND_HISILICON_1980005 >> HAS_XCALL >> HAS_XINT >> -KABI_RESERVE_3 >> +HAS_HW_XINT >> KABI_RESERVE_4 >> KABI_RESERVE_5 >> KABI_RESERVE_6 >> diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c >> index 4cc8b95d533f..32ffdf06f61e 100644 >> --- a/drivers/irqchip/irq-gic-v3.c >> +++ b/drivers/irqchip/irq-gic-v3.c >> @@ -35,7 +35,7 @@ >> >> #include "irq-gic-common.h" >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> #include "../../../kernel/irq/internals.h" >> #endif >> >> @@ -828,7 +828,7 @@ static bool gic_rpr_is_nmi_prio(void) >> return unlikely(gic_read_rpr() == GICD_INT_RPR_PRI(GICD_INT_NMI_PRI)); >> } >> >> -static bool gic_irqnr_is_special(u32 irqnr) >> +bool gic_irqnr_is_special(u32 irqnr) >> { >> return irqnr >= 1020 && irqnr <= 1023; >> } > > Please don't do this, left it static. > >> @@ -993,7 +993,11 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs >> __gic_handle_irq_from_irqson(regs); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +DECLARE_BITMAP(irqnr_nmi_map, 1024); >> +#endif >> + >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> DECLARE_BITMAP(irqnr_xint_map, 1024); >> >> static bool can_set_xint(unsigned int hwirq) >> @@ -1002,12 +1006,18 @@ static bool can_set_xint(unsigned int hwirq) >> __get_intid_range(hwirq) == SPI_RANGE) >> return true; >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (hw_xint_support && __get_intid_range(hwirq) == PPI_RANGE) >> + return true; >> +#endif >> + >> return false; >> } >> >> static bool xint_transform(int irqno, enum xint_op op) >> { >> struct irq_data *data = irq_get_irq_data(irqno); >> + struct irq_desc *desc; >> int hwirq; >> >> while (data->parent_data) >> @@ -1018,14 +1028,29 @@ static bool xint_transform(int irqno, enum xint_op op) >> if (!can_set_xint(hwirq)) >> return false; >> >> + desc = irq_data_to_desc(data); >> + >> switch (op) { >> case IRQ_TO_XINT: >> set_bit(hwirq, irqnr_xint_map); >> xint_add_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && !irq_is_nmi(desc)) { >> + gic_irq_enable_nmi(data); >> + set_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return true; >> case XINT_TO_IRQ: >> clear_bit(hwirq, irqnr_xint_map); >> xint_remove_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && irq_is_nmi(desc) && >> + test_bit(hwirq, irqnr_nmi_map)) { >> + gic_irq_disable_nmi(data); >> + clear_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return false; >> case XINT_SET_CHECK: >> return test_bit(hwirq, irqnr_xint_map); >> @@ -1096,7 +1121,7 @@ static const struct proc_ops xint_proc_ops = { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> /* create /proc/irq/<irq>/xint */ >> @@ -1105,12 +1130,63 @@ void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> >> void unregister_irqchip_proc(struct irq_desc *desc) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> remove_proc_entry("xint", desc->dir); >> } >> -#endif /* CONFIG_FAST_IRQ */ >> +#endif >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +bool is_xint(unsigned long hwirq) >> +{ >> + return test_bit(hwirq, irqnr_xint_map); >> +} >> + >> +static bool is_spi(unsigned long hwirq) >> +{ >> + if (__get_intid_range(hwirq) == SPI_RANGE || >> + __get_intid_range(hwirq) == ESPI_RANGE) >> + return true; >> + >> + return false; >> +} >> + >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr) >> +{ >> + struct pt_regs *old_regs; >> + struct irq_domain *domain; >> + struct irqaction *action; >> + struct irq_desc *desc; >> + struct irq_data *data; >> + >> + arch_nmi_enter(); >> + BUG_ON(in_nmi() == NMI_MASK); >> + __preempt_count_add(NMI_OFFSET + HARDIRQ_OFFSET); >> + old_regs = set_irq_regs(regs); >> + >> + domain = irq_get_default_host(); >> + data = radix_tree_lookup(&domain->revmap_tree, irqnr); >> + >> + desc = irq_data_to_desc(data); >> + action = desc->action; >> + >> + gic_read_nmiar(); >> + write_gicreg(irqnr, ICC_EOIR1_EL1); >> + isb(); >> + >> + if (is_spi(irqnr)) >> + action->handler(data->irq, action->dev_id); >> + else >> + action->handler(data->irq, raw_cpu_ptr(action->percpu_dev_id)); >> + gic_write_dir(irqnr); >> + >> + set_irq_regs(old_regs); >> + BUG_ON(!in_nmi()); >> + __preempt_count_sub(NMI_OFFSET + HARDIRQ_OFFSET); >> + arch_nmi_exit(); >> +} >> +#endif >> >> static u32 gic_get_pribits(void) >> { >> @@ -2358,6 +2434,7 @@ static int __init gic_init_bases(phys_addr_t dist_phys_base, >> goto out_free; >> } >> >> + irq_set_default_host(gic_data.domain); >> irq_domain_update_bus_token(gic_data.domain, DOMAIN_BUS_WIRED); >> >> gic_data.has_rss = !!(typer & GICD_TYPER_RSS); >> diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h >> index 548b8a5c46cf..3c0f04b86c15 100644 >> --- a/include/linux/irqchip/arm-gic-v3.h >> +++ b/include/linux/irqchip/arm-gic-v3.h >> @@ -721,8 +721,9 @@ static inline enum gic_intid_range __get_intid_range(irq_hw_number_t hwirq) >> } >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> enum xint_op { >> XINT_TO_IRQ, >> @@ -733,6 +734,9 @@ enum xint_op { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp); >> void unregister_irqchip_proc(struct irq_desc *desc); >> +bool gic_irqnr_is_special(u32 irqnr); >> +bool is_xint(unsigned long hwirq); >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr); >> #endif >> #endif >> >> diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c >> index dc94c360b54b..2152125f8ae2 100644 >> --- a/kernel/irq/debugfs.c >> +++ b/kernel/irq/debugfs.c >> @@ -242,7 +242,7 @@ void irq_add_debugfs_entry(unsigned int irq, struct irq_desc *desc) >> &dfs_irq_ops); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> static struct dentry *xint_dir; >> >> void xint_add_debugfs_entry(unsigned int irq) >> @@ -281,8 +281,8 @@ static int __init irq_debugfs_init(void) >> >> irq_dir = debugfs_create_dir("irqs", root_dir); >> >> -#ifdef CONFIG_FAST_IRQ >> - if (is_xint_support) >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> + if (is_xint_support || hw_xint_support) >> xint_dir = debugfs_create_dir("xints", root_dir); >> #endif >> >> diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h >> index 2fb08139a9e4..1c64854102f5 100644 >> --- a/kernel/irq/internals.h >> +++ b/kernel/irq/internals.h >> @@ -506,8 +506,9 @@ static inline void irq_remove_debugfs_entry(struct irq_desc *desc) >> kfree(desc->dev_name); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> void xint_add_debugfs_entry(unsigned int irq); >> void xint_remove_debugfs_entry(unsigned int irq); >

1 0

[openeuler:openEuler-1.0-LTS 1513/1513] mm/page_ext.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3e8e3ea77f0dd528b080f91d615144093b741003 commit: 5f0e34d2aceec67c169be7599d82f0e8519c37f7 [1513/1513] mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning config: x86_64-buildonly-randconfig-005-20250324 (https://download.01.org/0day-ci/archive/20250325/202503251400.xG2WACIP-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503251400.xG2WACIP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503251400.xG2WACIP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/page_ext.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] btrfs: do proper folio cleanup when cow_file_range() failed
by Zizhi Wo 25 Mar '25

25 Mar '25

From: Qu Wenruo <wqu(a)suse.com> stable inclusion from stable-v6.13.2 commit 692cf71173bb41395c855acbbbe197d3aedfa5d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBJV CVE: CVE-2024-57976 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 06f364284794f149d2abc167c11d556cf20c954b upstream. [BUG] When testing with COW fixup marked as BUG_ON() (this is involved with the new pin_user_pages*() change, which should not result new out-of-band dirty pages), I hit a crash triggered by the BUG_ON() from hitting COW fixup path. This BUG_ON() happens just after a failed btrfs_run_delalloc_range(): BTRFS error (device dm-2): failed to run delalloc range, root 348 ino 405 folio 65536 submit_bitmap 6-15 start 90112 len 106496: -28 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1444! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 0 UID: 0 PID: 434621 Comm: kworker/u24:8 Tainted: G OE 6.12.0-rc7-custom+ #86 Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs] pc : extent_writepage_io+0x2d4/0x308 [btrfs] lr : extent_writepage_io+0x2d4/0x308 [btrfs] Call trace: extent_writepage_io+0x2d4/0x308 [btrfs] extent_writepage+0x218/0x330 [btrfs] extent_write_cache_pages+0x1d4/0x4b0 [btrfs] btrfs_writepages+0x94/0x150 [btrfs] do_writepages+0x74/0x190 filemap_fdatawrite_wbc+0x88/0xc8 start_delalloc_inodes+0x180/0x3b0 [btrfs] btrfs_start_delalloc_roots+0x174/0x280 [btrfs] shrink_delalloc+0x114/0x280 [btrfs] flush_space+0x250/0x2f8 [btrfs] btrfs_async_reclaim_data_space+0x180/0x228 [btrfs] process_one_work+0x164/0x408 worker_thread+0x25c/0x388 kthread+0x100/0x118 ret_from_fork+0x10/0x20 Code: aa1403e1 9402f3ef aa1403e0 9402f36f (d4210000) ---[ end trace 0000000000000000 ]--- [CAUSE] That failure is mostly from cow_file_range(), where we can hit -ENOSPC. Although the -ENOSPC is already a bug related to our space reservation code, let's just focus on the error handling. For example, we have the following dirty range [0, 64K) of an inode, with 4K sector size and 4K page size: 0 16K 32K 48K 64K |///////////////////////////////////////| |#######################################| Where |///| means page are still dirty, and |###| means the extent io tree has EXTENT_DELALLOC flag. - Enter extent_writepage() for page 0 - Enter btrfs_run_delalloc_range() for range [0, 64K) - Enter cow_file_range() for range [0, 64K) - Function btrfs_reserve_extent() only reserved one 16K extent So we created extent map and ordered extent for range [0, 16K) 0 16K 32K 48K 64K |////////|//////////////////////////////| |<- OE ->|##############################| And range [0, 16K) has its delalloc flag cleared. But since we haven't yet submit any bio, involved 4 pages are still dirty. - Function btrfs_reserve_extent() returns with -ENOSPC Now we have to run error cleanup, which will clear all EXTENT_DELALLOC* flags and clear the dirty flags for the remaining ranges: 0 16K 32K 48K 64K |////////| | | | | Note that range [0, 16K) still has its pages dirty. - Some time later, writeback is triggered again for the range [0, 16K) since the page range still has dirty flags. - btrfs_run_delalloc_range() will do nothing because there is no EXTENT_DELALLOC flag. - extent_writepage_io() finds page 0 has no ordered flag Which falls into the COW fixup path, triggering the BUG_ON(). Unfortunately this error handling bug dates back to the introduction of btrfs. Thankfully with the abuse of COW fixup, at least it won't crash the kernel. [FIX] Instead of immediately unlocking the extent and folios, we keep the extent and folios locked until either erroring out or the whole delalloc range finished. When the whole delalloc range finished without error, we just unlock the whole range with PAGE_SET_ORDERED (and PAGE_UNLOCK for !keep_locked cases), with EXTENT_DELALLOC and EXTENT_LOCKED cleared. And the involved folios will be properly submitted, with their dirty flags cleared during submission. For the error path, it will be a little more complex: - The range with ordered extent allocated (range (1)) We only clear the EXTENT_DELALLOC and EXTENT_LOCKED, as the remaining flags are cleaned up by btrfs_mark_ordered_io_finished()->btrfs_finish_one_ordered(). For folios we finish the IO (clear dirty, start writeback and immediately finish the writeback) and unlock the folios. - The range with reserved extent but no ordered extent (range(2)) - The range we never touched (range(3)) For both range (2) and range(3) the behavior is not changed. Now even if cow_file_range() failed halfway with some successfully reserved extents/ordered extents, we will keep all folios clean, so there will be no future writeback triggered on them. CC: stable(a)vger.kernel.org Fixes: 524272607e88 ("btrfs: Handle delalloc error correctly to avoid ordered extent hang") Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/inode.c [Some context conflicts are encountered when adapting: 1. ram_size -> cur_size: 5599f39356c6 ("btrfs: simplify range tracking in cow_file_range()"), just simplify the process and do not affect the logic. 2. There is no lock_extent related code: 0ab540995ae0 ("btrfs: push lock_extent into cow_file_range_inline")\a0766d8f35d8 ("btrfs: push extent lock into cow_file_range"), this is to narrow the scope of lock, but does not affect this patch. 3. extent_clear_unlock_delalloc() missed a parameter named "cached": 6b0a63a4fa31 ("btrfs: add a cached state to extent_clear_unlock_delalloc"), does not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/inode.c | 54 ++++++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 71902110c2fe..862cc8703bf0 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1356,6 +1356,17 @@ static noinline int cow_file_range(struct btrfs_inode *inode, alloc_hint = get_extent_allocation_hint(inode, start, num_bytes); + /* + * We're not doing compressed IO, don't unlock the first page (which + * the caller expects to stay locked), don't clear any dirty bits and + * don't set any writeback bits. + * + * Do set the Ordered (Private2) bit so we know this page was properly + * setup for writepage. + */ + page_ops = (keep_locked ? 0 : PAGE_UNLOCK); + page_ops |= PAGE_SET_ORDERED; + /* * Relocation relies on the relocated extents to have exactly the same * size as the original extents. Normally writeback for relocation data @@ -1456,21 +1467,6 @@ static noinline int cow_file_range(struct btrfs_inode *inode, btrfs_dec_block_group_reservations(fs_info, ins.objectid); - /* - * We're not doing compressed IO, don't unlock the first page - * (which the caller expects to stay locked), don't clear any - * dirty bits and don't set any writeback bits - * - * Do set the Ordered (Private2) bit so we know this page was - * properly setup for writepage. - */ - page_ops = (keep_locked ? 0 : PAGE_UNLOCK); - page_ops |= PAGE_SET_ORDERED; - - extent_clear_unlock_delalloc(inode, start, start + ram_size - 1, - locked_page, - EXTENT_LOCKED | EXTENT_DELALLOC, - page_ops); if (num_bytes < cur_alloc_size) num_bytes = 0; else @@ -1487,6 +1483,8 @@ static noinline int cow_file_range(struct btrfs_inode *inode, if (ret) goto out_unlock; } + extent_clear_unlock_delalloc(inode, orig_start, end, locked_page, + EXTENT_LOCKED | EXTENT_DELALLOC, page_ops); done: if (done_offset) *done_offset = end; @@ -1507,29 +1505,31 @@ static noinline int cow_file_range(struct btrfs_inode *inode, * We process each region below. */ - clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | - EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; - page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; - /* * For the range (1). We have already instantiated the ordered extents * for this region. They are cleaned up by * btrfs_cleanup_ordered_extents() in e.g, - * btrfs_run_delalloc_range(). EXTENT_LOCKED | EXTENT_DELALLOC are - * already cleared in the above loop. And, EXTENT_DELALLOC_NEW | - * EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV are handled by the cleanup - * function. + * btrfs_run_delalloc_range(). + * EXTENT_DELALLOC_NEW | EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV + * are also handled by the cleanup function. * - * However, in case of @keep_locked, we still need to unlock the pages - * (except @locked_page) to ensure all the pages are unlocked. + * So here we only clear EXTENT_LOCKED and EXTENT_DELALLOC flag, and + * finish the writeback of the involved folios, which will be never submitted. */ - if (keep_locked && orig_start < start) { + if (orig_start < start) { + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + if (!locked_page) mapping_set_error(inode->vfs_inode.i_mapping, ret); extent_clear_unlock_delalloc(inode, orig_start, start - 1, - locked_page, 0, page_ops); + locked_page, clear_bits, page_ops); } + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | + EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + /* * For the range (2). If we reserved an extent for our delalloc range * (or a subrange) and failed to create the respective ordered extent, -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2022-49553
by Zizhi Wo 25 Mar '25

25 Mar '25

Randy Dunlap (1): fs/ntfs3: validate BOOT sectors_per_clusters Shigeru Yoshida (1): fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst() fs/ntfs3/super.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
by Zizhi Wo 25 Mar '25

25 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.247 commit 8d8ad067b90f231b8fdb14acee673ca4012f6045 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBXX CVE: CVE-2022-49354 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 10d6bdf532902be1d8aa5900b3c03c5671612aa2 ] of_find_device_by_node() takes reference, we should use put_device() to release it when not need anymore. Add missing put_device() to avoid refcount leak. Fixes: 43f01da0f279 ("MIPS/OCTEON/ata: Convert pata_octeon_cf.c to use device tree.") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Reviewed-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Signed-off-by: Damien Le Moal <damien.lemoal(a)opensource.wdc.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/ata/pata_octeon_cf.c.rej [Simple context conflict, no practical impact.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/ata/pata_octeon_cf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c index d3d851b014a3..ed7473aa0ba2 100644 --- a/drivers/ata/pata_octeon_cf.c +++ b/drivers/ata/pata_octeon_cf.c @@ -888,12 +888,14 @@ static int octeon_cf_probe(struct platform_device *pdev) int i; res_dma = platform_get_resource(dma_dev, IORESOURCE_MEM, 0); if (!res_dma) { + put_device(&dma_dev->dev); of_node_put(dma_node); return -EINVAL; } cf_port->dma_base = (u64)devm_ioremap_nocache(&pdev->dev, res_dma->start, resource_size(res_dma)); if (!cf_port->dma_base) { + put_device(&dma_dev->dev); of_node_put(dma_node); return -EINVAL; } @@ -902,6 +904,7 @@ static int octeon_cf_probe(struct platform_device *pdev) i = platform_get_irq(dma_dev, 0); if (i > 0) irq = i; + put_device(&dma_dev->dev); } of_node_put(dma_node); } -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
by Zizhi Wo 25 Mar '25

25 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.247 commit 30d110ca703ce60162ec337aa564a3e4da30715f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP75W CVE: CVE-2022-49482 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2be84f73785fa9ed6443e3c5b158730266f1c2ee ] of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Fixes: 08641c7c74dd ("ASoC: mxs: add device tree support for mxs-saif") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Link: https://lore.kernel.org/r/20220511133725.39039-1-linmq006@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- sound/soc/mxs/mxs-saif.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c index 156aa7c00787..f5f7f49ab3f1 100644 --- a/sound/soc/mxs/mxs-saif.c +++ b/sound/soc/mxs/mxs-saif.c @@ -777,6 +777,7 @@ static int mxs_saif_probe(struct platform_device *pdev) saif->master_id = saif->id; } else { ret = of_alias_get_id(master, "saif"); + of_node_put(master); if (ret < 0) return ret; else -- 2.39.2

2 1

[PATCH OLK-5.10] fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()'
by Zizhi Wo 25 Mar '25

25 Mar '25

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> stable inclusion from stable-v5.15.46 commit d8be98ab88250dc12a98efdb703792a537b0eac3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6NP CVE: CVE-2021-47660 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e589f9b7078e1c0191613cd736f598e81d2390de upstream. All error handling paths lead to 'out' where many resources are freed. Do it as well here instead of a direct return, otherwise 'log', 'ra' and 'log->one_page_buf' (at least) will leak. Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal") Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ntfs3/fslog.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index fb56c4c33987..d1f48ffe846e 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -4096,8 +4096,10 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) if (client == LFS_NO_CLIENT_LE) { /* Insert "NTFS" client LogFile. */ client = ra->client_idx[0]; - if (client == LFS_NO_CLIENT_LE) - return -EINVAL; + if (client == LFS_NO_CLIENT_LE) { + err = -EINVAL; + goto out; + } t16 = le16_to_cpu(client); cr = ca + t16; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] proc: fix use-after-free in proc_get_inode()
by Wang Zhaolong 25 Mar '25

25 Mar '25

From: Ye Bin <yebin10(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBRR1N CVE: NA Reference: https://lore.kernel.org/linux-fsdevel/20250301034024.277290-1-yebin@huaweic… -------------------------------- There's a issue as follows: BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Above issue may happen as follows: rmmod lookup sys_delete_module proc_lookup_de read_lock(&proc_subdir_lock); pde_get(de); read_unlock(&proc_subdir_lock); proc_get_inode(dir->i_sb, de); mod->exit() proc_remove remove_proc_subtree write_lock(&proc_subdir_lock); write_unlock(&proc_subdir_lock); proc_entry_rundown(de); free_module(mod); if (S_ISREG(inode->i_mode)) if (de->proc_ops->proc_read_iter) --> As module is already freed, will trigger UAF To solve above issue there's need to get 'in_use' before use proc_dir_entry in proc_get_inode(). Fixes: 778f3dd5a13c ("Fix procfs compat_ioctl regression") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Conflicts: fs/proc/inode.c [The pre-patch d919b33dafb3 ("proc: faster open/read/close with "permanent" files") is not imported.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/proc/inode.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 31bf3bb8ddae..7d225a2b8b2a 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -460,10 +460,18 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) if (is_empty_pde(de)) { make_empty_dir_inode(inode); return inode; } + + if (!use_pde(de)) { + PROC_I(inode)->pde = NULL; + pde_put(de); + iput(inode); + return NULL; + } + if (de->mode) { inode->i_mode = de->mode; inode->i_uid = de->uid; inode->i_gid = de->gid; } @@ -484,10 +492,11 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) inode->i_fop = &proc_reg_file_ops; } else { inode->i_fop = de->proc_fops; } } + unuse_pde(de); } else pde_put(de); return inode; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] proc: fix use-after-free in proc_get_inode()
by Wang Zhaolong 25 Mar '25

25 Mar '25

From: Ye Bin <yebin10(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBRR1N CVE: NA Reference: https://lore.kernel.org/linux-fsdevel/20250301034024.277290-1-yebin@huaweic… -------------------------------- There's a issue as follows: BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Above issue may happen as follows: rmmod lookup sys_delete_module proc_lookup_de read_lock(&proc_subdir_lock); pde_get(de); read_unlock(&proc_subdir_lock); proc_get_inode(dir->i_sb, de); mod->exit() proc_remove remove_proc_subtree write_lock(&proc_subdir_lock); write_unlock(&proc_subdir_lock); proc_entry_rundown(de); free_module(mod); if (S_ISREG(inode->i_mode)) if (de->proc_ops->proc_read_iter) --> As module is already freed, will trigger UAF To solve above issue there's need to get 'in_use' before use proc_dir_entry in proc_get_inode(). Fixes: 9c7af565c58e ("centos 8.1: import linux-4.18.0-147.5.1.el8_1") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Conflicts: fs/proc/inode.c [The pre-patch d919b33dafb3 ("proc: faster open/read/close with "permanent" files") is not imported.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/proc/inode.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 31bf3bb8ddae..7d225a2b8b2a 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -460,10 +460,18 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) if (is_empty_pde(de)) { make_empty_dir_inode(inode); return inode; } + + if (!use_pde(de)) { + PROC_I(inode)->pde = NULL; + pde_put(de); + iput(inode); + return NULL; + } + if (de->mode) { inode->i_mode = de->mode; inode->i_uid = de->uid; inode->i_gid = de->gid; } @@ -484,10 +492,11 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) inode->i_fop = &proc_reg_file_ops; } else { inode->i_fop = de->proc_fops; } } + unuse_pde(de); } else pde_put(de); return inode; } -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] Fix UAF in acct(2)
by Liu Kai 25 Mar '25

25 Mar '25

Fix UAF in acct(2) Christian Brauner (2): acct: perform last write from workqueue acct: block access to kernel internal filesystems kernel/acct.c | 134 +++++++++++++++++++++++++++++++------------------- 1 file changed, 84 insertions(+), 50 deletions(-) -- 2.34.1

2 3