- Kernel - mailweb.openeuler.org

[PATCH] LoongArch: BPF: Fix off-by-one error in build_prologue()
by Huang Xiaojia 23 Apr '25

23 Apr '25

From: Hengqi Chen <hengqi.chen(a)gmail.com> stable inclusion from stable-v6.6.87 commit b3ffad2f02db4aace6799fe0049508b8925eae45 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC2CC7 CVE: CVE-2025-37893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7e2586991e36663c9bc48c828b83eab180ad30a9 upstream. Vincent reported that running BPF progs with tailcalls on LoongArch causes kernel hard lockup. Debugging the issues shows that the JITed image missing a jirl instruction at the end of the epilogue. There are two passes in JIT compiling, the first pass set the flags and the second pass generates JIT code based on those flags. With BPF progs mixing bpf2bpf and tailcalls, build_prologue() generates N insns in the first pass and then generates N+1 insns in the second pass. This makes epilogue_offset off by one and we will jump to some unexpected insn and cause lockup. Fix this by inserting a nop insn. Cc: stable(a)vger.kernel.org Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Fixes: bb035ef0cc91 ("LoongArch: BPF: Support mixing bpf2bpf and tailcalls") Reported-by: Vincent Li <vincent.mc.li(a)gmail.com> Tested-by: Vincent Li <vincent.mc.li(a)gmail.com> Closes: https://lore.kernel.org/loongarch/CAK3+h2w6WESdBN3UCr3WKHByD7D6Q_Ve1EDAjotV… Closes: https://lore.kernel.org/bpf/CAK3+h2woEjG_N=-XzqEGaAeCmgu2eTCUc7p6bP4u8Q+DFH… Signed-off-by: Hengqi Chen <hengqi.chen(a)gmail.com> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- arch/loongarch/net/bpf_jit.c | 2 ++ arch/loongarch/net/bpf_jit.h | 5 +++++ 2 files changed, 7 insertions(+) diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index 525fc03d7056..8312887eccaa 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -142,6 +142,8 @@ static void build_prologue(struct jit_ctx *ctx) */ if (seen_tail_call(ctx) && seen_call(ctx)) move_reg(ctx, TCC_SAVED, REG_TCC); + else + emit_insn(ctx, nop); ctx->stack_size = stack_adjust; } diff --git a/arch/loongarch/net/bpf_jit.h b/arch/loongarch/net/bpf_jit.h index 68586338ecf8..f9c569f53949 100644 --- a/arch/loongarch/net/bpf_jit.h +++ b/arch/loongarch/net/bpf_jit.h @@ -27,6 +27,11 @@ struct jit_data { struct jit_ctx ctx; }; +static inline void emit_nop(union loongarch_instruction *insn) +{ + insn->word = INSN_NOP; +} + #define emit_insn(ctx, func, ...) \ do { \ if (ctx->image != NULL) { \ -- 2.34.1

1 0

[PATCH OLK-6.6] Revert "perf/x86: Fix low freqency setting issue"
by Luo Gengkun 23 Apr '25

23 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC0AJF CVE: NA -------------------------------- This reverts commit 4fa4f2aef6549f05e766b8bf46978ed659875b5f. This patch makes perf stat failed, so revert it. Fixes: 88ec7eedbbd2 ("perf/x86: Fix low freqency setting issue") Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index c1a93fcd0b7a..ad0932f84094 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -623,7 +623,7 @@ int x86_pmu_hw_config(struct perf_event *event) if (event->attr.type == event->pmu->type) event->hw.config |= event->attr.config & X86_RAW_EVENT_MASK; - if (!event->attr.freq && x86_pmu.limit_period) { + if (event->attr.sample_period && x86_pmu.limit_period) { s64 left = event->attr.sample_period; x86_pmu.limit_period(event, &left); if (left > event->attr.sample_period) -- 2.34.1

2 1

[openeuler:OLK-6.6 2153/2153] arch/arm64/kvm/arm.c:1037:11: error: no member named 'irq_level' in 'struct kvm_pmu'
by kernel test robot 23 Apr '25

23 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: dabd2f7c9c1d6b9dad214ea61407781e0439d85d commit: 1182be89002c268a781bd90b25f18da76cfea732 [2153/2153] pmu: enable pmu phys irq inject for cvm config: arm64-randconfig-r062-20250423 (https://download.01.org/0day-ci/archive/20250423/202504230942.5dFQC7IQ-lkp@…) compiler: clang version 21.0.0git (https://github.com/llvm/llvm-project f819f46284f2a79790038e1f6649172789734ae8) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250423/202504230942.5dFQC7IQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504230942.5dFQC7IQ-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/arm64/kvm/arm.c:9: In file included from include/linux/entry-kvm.h:6: In file included from include/linux/resume_user_mode.h:8: In file included from include/linux/memcontrol.h:20: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ arch/arm64/kvm/arm.c:139:7: warning: variable 'r' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 139 | if (static_branch_unlikely(&virtcca_cvm_is_available)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/jump_label.h:504:40: note: expanded from macro 'static_branch_unlikely' 504 | #define static_branch_unlikely(x) \ | ^ 505 | ({ \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 506 | bool branch; \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 507 | if (__builtin_types_compatible_p(typeof(*x), struct static_key_true)) \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 508 | branch = arch_static_branch_jump(&(x)->key, false); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 509 | else if (__builtin_types_compatible_p(typeof(*x), struct static_key_false)) \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 510 | branch = arch_static_branch(&(x)->key, false); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 511 | else \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 512 | branch = ____wrong_branch_error(); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 513 | unlikely_notrace(branch); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 514 | }) | ~~ arch/arm64/kvm/arm.c:148:9: note: uninitialized use occurs here 148 | return r; | ^ arch/arm64/kvm/arm.c:139:3: note: remove the 'if' if its condition is always true 139 | if (static_branch_unlikely(&virtcca_cvm_is_available)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 140 | r = kvm_cvm_enable_cap(kvm, cap); arch/arm64/kvm/arm.c:93:7: note: initialize the variable 'r' to silence this warning 93 | int r; | ^ | = 0 >> arch/arm64/kvm/arm.c:1037:11: error: no member named 'irq_level' in 'struct kvm_pmu' 1037 | if (pmu->irq_level) { | ~~~ ^ arch/arm64/kvm/arm.c:1039:3: error: call to undeclared function 'arm_pmu_set_phys_irq'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1039 | arm_pmu_set_phys_irq(false); | ^ arch/arm64/kvm/arm.c:1242:4: error: call to undeclared function 'arm_pmu_set_phys_irq'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1242 | arm_pmu_set_phys_irq(true); | ^ 2 warnings and 3 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for RESCTRL_FS Depends on [n]: MISC_FILESYSTEMS [=n] && ARCH_HAS_CPU_RESCTRL [=y] Selected by [y]: - ARM64_MPAM [=y] vim +1037 arch/arm64/kvm/arm.c 1031 1032 #ifdef CONFIG_HISI_VIRTCCA_HOST 1033 static inline void update_pmu_phys_irq(struct kvm_vcpu *vcpu, bool *pmu_stopped) 1034 { 1035 struct kvm_pmu *pmu = &vcpu->arch.pmu; 1036 > 1037 if (pmu->irq_level) { 1038 *pmu_stopped = true; 1039 arm_pmu_set_phys_irq(false); 1040 } 1041 } 1042 #endif 1043 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] perf/x86: Fix open counting event error
by Luo Gengkun 23 Apr '25

23 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC0AJF CVE: NA -------------------------------- Perf doesn't work at perf stat for hardware events: $perf stat -- sleep 1 Performance counter stats for 'sleep 1': 16.44 msec task-clock # 0.016 CPUs utilized 2 context-switches # 121.691 /sec 0 cpu-migrations # 0.000 /sec 54 page-faults # 3.286 K/sec <not supported> cycles <not supported> instructions <not supported> branches <not supported> branch-misses The reason is that the check in x86_pmu_hw_config for sampling event is unexpectedly applied to the counting event. Fixes: 88ec7eedbbd2 ("perf/x86: Fix low freqency setting issue") Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index c1a93fcd0b7a..0b24fc9d2735 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -623,7 +623,7 @@ int x86_pmu_hw_config(struct perf_event *event) if (event->attr.type == event->pmu->type) event->hw.config |= event->attr.config & X86_RAW_EVENT_MASK; - if (!event->attr.freq && x86_pmu.limit_period) { + if (is_sampling_event(event) && !event->attr.freq && x86_pmu.limit_period) { s64 left = event->attr.sample_period; x86_pmu.limit_period(event, &left); if (left > event->attr.sample_period) -- 2.34.1

2 1

[PATCH OLK-6.6] RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers
by Zhang Changzhong 22 Apr '25

22 Apr '25

From: Kashyap Desai <kashyap.desai(a)broadcom.com> mainline inclusion from mainline-v6.14-rc5 commit b66535356a4834a234f99e16a97eb51f2c6c5a7d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVSU CVE: CVE-2025-21885 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- While using nvme target with use_srq on, below kernel panic is noticed. [ 549.698111] bnxt_en 0000:41:00.0 enp65s0np0: FEC autoneg off encoding: Clause 91 RS(544,514) [ 566.393619] Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI .. [ 566.393799] <TASK> [ 566.393807] ? __die_body+0x1a/0x60 [ 566.393823] ? die+0x38/0x60 [ 566.393835] ? do_trap+0xe4/0x110 [ 566.393847] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393867] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393881] ? do_error_trap+0x7c/0x120 [ 566.393890] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393911] ? exc_divide_error+0x34/0x50 [ 566.393923] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393939] ? asm_exc_divide_error+0x16/0x20 [ 566.393966] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393997] bnxt_qplib_create_srq+0xc9/0x340 [bnxt_re] [ 566.394040] bnxt_re_create_srq+0x335/0x3b0 [bnxt_re] [ 566.394057] ? srso_return_thunk+0x5/0x5f [ 566.394068] ? __init_swait_queue_head+0x4a/0x60 [ 566.394090] ib_create_srq_user+0xa7/0x150 [ib_core] [ 566.394147] nvmet_rdma_queue_connect+0x7d0/0xbe0 [nvmet_rdma] [ 566.394174] ? lock_release+0x22c/0x3f0 [ 566.394187] ? srso_return_thunk+0x5/0x5f Page size and shift info is set only for the user space SRQs. Set page size and page shift for kernel space SRQs also. Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation") Signed-off-by: Kashyap Desai <kashyap.desai(a)broadcom.com> Signed-off-by: Selvin Xavier <selvin.xavier(a)broadcom.com> Link: https://patch.msgid.link/1740237621-29291-1-git-send-email-selvin.xavier@br… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/bnxt_re/ib_verbs.c [commit 30b871338c3e ("RDMA/bnxt_re: Refactor NQ allocation") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c index f7345e4..98ddc06 100644 --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c @@ -1775,6 +1775,8 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, srq->qplib_srq.threshold = srq_init_attr->attr.srq_limit; srq->srq_limit = srq_init_attr->attr.srq_limit; srq->qplib_srq.eventq_hw_ring_id = rdev->nq[0].ring_id; + srq->qplib_srq.sg_info.pgsize = PAGE_SIZE; + srq->qplib_srq.sg_info.pgshft = PAGE_SHIFT; nq = &rdev->nq[0]; if (udata) { -- 2.9.5

2 1

[PATCH OLK-6.6] Revert "perf/x86: Fix low freqency setting issue"
by Luo Gengkun 22 Apr '25

22 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC0AJF CVE: NA -------------------------------- This reverts commit 4fa4f2aef6549f05e766b8bf46978ed659875b5f. This patch makes perf stat failed, so revert it. Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index c1a93fcd0b7a..ad0932f84094 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -623,7 +623,7 @@ int x86_pmu_hw_config(struct perf_event *event) if (event->attr.type == event->pmu->type) event->hw.config |= event->attr.config & X86_RAW_EVENT_MASK; - if (!event->attr.freq && x86_pmu.limit_period) { + if (event->attr.sample_period && x86_pmu.limit_period) { s64 left = event->attr.sample_period; x86_pmu.limit_period(event, &left); if (left > event->attr.sample_period) -- 2.34.1

2 1

[PATCH v4 OLK-6.6 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 22 Apr '25

22 Apr '25

Compare to v3: Patch 09: Add comments for the enum resctrl_feat_type and make modifications based on community feedback. Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Zeng Heng (18): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value fs/resctrl: Support arch specific struct resctrl_arch_staged_config arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 23 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 138 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 146 ++++++--- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 36 ++- include/linux/resctrl_types.h | 30 ++ 11 files changed, 716 insertions(+), 188 deletions(-) -- 2.25.1

2 19

[PATCH v4 OLK-6.6 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 22 Apr '25

22 Apr '25

Compare to v3: Patch 09: Add comments for the enum resctrl_feat_type and make modifications based on community feedback. Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Zeng Heng (18): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value fs/resctrl: Support arch specific struct resctrl_arch_staged_config arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 23 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 138 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 146 ++++++--- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 36 ++- include/linux/resctrl_types.h | 30 ++ 11 files changed, 716 insertions(+), 188 deletions(-) -- 2.25.1

2 19

[PATCH OLK-6.6] erofs/cachefiles: Change the unmark inuse sequence in erofs ondemand mode
by Zizhi Wo 22 Apr '25

22 Apr '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC349R -------------------------------- In the current erofs ondemand loading mode, the close request is sent to userspace before calling the unmark inuse interface. This means userspace cannot reliably perform culling immediately upon receiving the close req. To address this, a new cookie flag is introduced to allow calling cachefiles_unmark_inode_in_use() before sending the close request. This enables userspace to safely perform culling after the notification. Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cachefiles/interface.c | 15 ++++++++++----- fs/erofs/fscache.c | 2 ++ include/linux/fscache-cache.h | 24 ++++++++++++++++++++++++ 3 files changed, 36 insertions(+), 5 deletions(-) diff --git a/fs/cachefiles/interface.c b/fs/cachefiles/interface.c index 4d44e74c22fd..c384b6939a3e 100644 --- a/fs/cachefiles/interface.c +++ b/fs/cachefiles/interface.c @@ -338,6 +338,9 @@ static void cachefiles_clean_up_object(struct cachefiles_object *object, struct cachefiles_cache *cache) { struct file *file; + const struct cred *saved_cred; + + cachefiles_begin_secure(cache, &saved_cred); if (test_bit(FSCACHE_COOKIE_RETIRED, &object->cookie->flags)) { if (!test_bit(CACHEFILES_OBJECT_USING_TMPFILE, &object->flags)) { @@ -362,6 +365,8 @@ static void cachefiles_clean_up_object(struct cachefiles_object *object, if (file) fput(file); + + cachefiles_end_secure(cache, saved_cred); } /* @@ -371,7 +376,7 @@ static void cachefiles_withdraw_cookie(struct fscache_cookie *cookie) { struct cachefiles_object *object = cookie->cache_priv; struct cachefiles_cache *cache = object->volume->cache; - const struct cred *saved_cred; + bool unmark_early = fscache_test_inode_unmark_early(cache->cache); _enter("o=%x", object->debug_id); cachefiles_see_object(object, cachefiles_obj_see_withdraw_cookie); @@ -383,13 +388,13 @@ static void cachefiles_withdraw_cookie(struct fscache_cookie *cookie) spin_unlock(&cache->object_list_lock); } + if (unmark_early && object->file) + cachefiles_clean_up_object(object, cache); + cachefiles_ondemand_clean_object(object); - if (object->file) { - cachefiles_begin_secure(cache, &saved_cred); + if (!unmark_early && object->file) cachefiles_clean_up_object(object, cache); - cachefiles_end_secure(cache, saved_cred); - } cookie->cache_priv = NULL; cachefiles_put_object(object, cachefiles_obj_put_detach); diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c index 7bcd1d261e7d..37289680888a 100644 --- a/fs/erofs/fscache.c +++ b/fs/erofs/fscache.c @@ -370,6 +370,8 @@ static int erofs_fscache_register_volume(struct super_block *sb) } else { /* enable synchronous unhashing for the associated volumes */ fscache_set_sync_volume_unhash(volume->cache); + /* enable to set inode unmark inuse early before send close req */ + fscache_set_inode_unmark_early(volume->cache); } sbi->volume = volume; diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h index 642fc1276c63..a1c5fa1a5214 100644 --- a/include/linux/fscache-cache.h +++ b/include/linux/fscache-cache.h @@ -46,6 +46,7 @@ struct fscache_cache { char *name; KABI_USE(1, unsigned long flags) #define FSCACHE_CACHE_SYNC_VOLUME_UNHASH 0 /* Mark to enable volume sync unhash */ +#define FSCACHE_CACHE_EARLY_UNMARK_INUSE 1 /* Need to unmark earlier */ KABI_RESERVE(2) KABI_RESERVE(3) @@ -225,6 +226,29 @@ static inline bool fscache_test_sync_volume_unhash(struct fscache_cache *cache) return test_bit(FSCACHE_CACHE_SYNC_VOLUME_UNHASH, &cache->flags); } +/** + * fscache_set_inode_unmark_early - Early unmark the inode inuse + * @cache: The cache to set + * + * Unmark the inode inuse before send close req. + */ +static inline void fscache_set_inode_unmark_early(struct fscache_cache *cache) +{ + set_bit(FSCACHE_CACHE_EARLY_UNMARK_INUSE, &cache->flags); +} + +/** + * fscache_test_inode_unmark_early - Check whether the inode need to + * unmark early + * @cache: The cache to query + * + * Indicates whether we need to unmark the inode inuse early. + */ +static inline bool fscache_test_inode_unmark_early(struct fscache_cache *cache) +{ + return test_bit(FSCACHE_CACHE_EARLY_UNMARK_INUSE, &cache->flags); +} + #ifdef CONFIG_FSCACHE_STATS extern atomic_t fscache_n_read; extern atomic_t fscache_n_write; -- 2.39.2

2 1

[PATCH OLK-6.6] efi: Don't map the entire mokvar table to determine its size
by Kaixiong Yu 22 Apr '25

22 Apr '25

From: Peter Jones <pjones(a)redhat.com> stable inclusion from stable-v6.6.83 commit ea3f0b362dfe4ef885ef812bfaf4088176422c91 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVU7 CVE: CVE-2025-21872 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2b90e7ace79774a3540ce569e000388f8d22c9e0 upstream. Currently, when validating the mokvar table, we (re)map the entire table on each iteration of the loop, adding space as we discover new entries. If the table grows over a certain size, this fails due to limitations of early_memmap(), and we get a failure and traceback: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:139 __early_ioremap+0xef/0x220 ... Call Trace: <TASK> ? __early_ioremap+0xef/0x220 ? __warn.cold+0x93/0xfa ? __early_ioremap+0xef/0x220 ? report_bug+0xff/0x140 ? early_fixup_exception+0x5d/0xb0 ? early_idt_handler_common+0x2f/0x3a ? __early_ioremap+0xef/0x220 ? efi_mokvar_table_init+0xce/0x1d0 ? setup_arch+0x864/0xc10 ? start_kernel+0x6b/0xa10 ? x86_64_start_reservations+0x24/0x30 ? x86_64_start_kernel+0xed/0xf0 ? common_startup_64+0x13e/0x141 </TASK> ---[ end trace 0000000000000000 ]--- mokvar: Failed to map EFI MOKvar config table pa=0x7c4c3000, size=265187. Mapping the entire structure isn't actually necessary, as we don't ever need more than one entry header mapped at once. Changes efi_mokvar_table_init() to only map each entry header, not the entire table, when determining the table size. Since we're not mapping any data past the variable name, it also changes the code to enforce that each variable name is NUL terminated, rather than attempting to verify it in place. Cc: <stable(a)vger.kernel.org> Signed-off-by: Peter Jones <pjones(a)redhat.com> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/firmware/efi/mokvar-table.c | 42 +++++++++-------------------- 1 file changed, 13 insertions(+), 29 deletions(-) diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c index 5ed0602c2f75..4eb0dff4dfaf 100644 --- a/drivers/firmware/efi/mokvar-table.c +++ b/drivers/firmware/efi/mokvar-table.c @@ -103,9 +103,7 @@ void __init efi_mokvar_table_init(void) void *va = NULL; unsigned long cur_offset = 0; unsigned long offset_limit; - unsigned long map_size = 0; unsigned long map_size_needed = 0; - unsigned long size; struct efi_mokvar_table_entry *mokvar_entry; int err; @@ -134,48 +132,34 @@ void __init efi_mokvar_table_init(void) */ err = -EINVAL; while (cur_offset + sizeof(*mokvar_entry) <= offset_limit) { - mokvar_entry = va + cur_offset; - map_size_needed = cur_offset + sizeof(*mokvar_entry); - if (map_size_needed > map_size) { - if (va) - early_memunmap(va, map_size); - /* - * Map a little more than the fixed size entry - * header, anticipating some data. It's safe to - * do so as long as we stay within current memory - * descriptor. - */ - map_size = min(map_size_needed + 2*EFI_PAGE_SIZE, - offset_limit); - va = early_memremap(efi.mokvar_table, map_size); - if (!va) { - pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%lu.\n", - efi.mokvar_table, map_size); - return; - } - mokvar_entry = va + cur_offset; + if (va) + early_memunmap(va, sizeof(*mokvar_entry)); + va = early_memremap(efi.mokvar_table + cur_offset, sizeof(*mokvar_entry)); + if (!va) { + pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%zu.\n", + efi.mokvar_table + cur_offset, sizeof(*mokvar_entry)); + return; } + mokvar_entry = va; /* Check for last sentinel entry */ if (mokvar_entry->name[0] == '\0') { if (mokvar_entry->data_size != 0) break; err = 0; + map_size_needed = cur_offset + sizeof(*mokvar_entry); break; } - /* Sanity check that the name is null terminated */ - size = strnlen(mokvar_entry->name, - sizeof(mokvar_entry->name)); - if (size >= sizeof(mokvar_entry->name)) - break; + /* Enforce that the name is NUL terminated */ + mokvar_entry->name[sizeof(mokvar_entry->name) - 1] = '\0'; /* Advance to the next entry */ - cur_offset = map_size_needed + mokvar_entry->data_size; + cur_offset += sizeof(*mokvar_entry) + mokvar_entry->data_size; } if (va) - early_memunmap(va, map_size); + early_memunmap(va, sizeof(*mokvar_entry)); if (err) { pr_err("EFI MOKvar config table is not valid\n"); return; -- 2.34.1

2 1