- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] eventpoll: Fix soft lockup in xcall_read()
by Jinjie Ruan 24 Jun '25

24 Jun '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/release-management/issues/IC9Q31 -------------------------------- When the prefetch state is not XCALL_CACHE_NONE or XCALL_CACHE_READY for a long time, such as XCALL_CACHE_CANCEL or XCALL_CACHE_PREFETCH, the following soft lockup occurs. Fix it by voluntarily yield the CPU when a timeout occurs in the xcall read while loop. watchdog: BUG: soft lockup - CPU#2 stuck for 111s! [syz-fuzzer:467] Modules linked in: CPU: 2 PID: 467 Comm: syz-fuzzer Not tainted 5.10.0-00019-ga473cf168de7 #10 Hardware name: linux,dummy-virt (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : check_kcov_mode kernel/kcov.c:165 [inline] pc : __sanitizer_cov_trace_pc+0x64/0x114 kernel/kcov.c:197 lr : __ll_sc__cmpxchg_case_mb_32 arch/arm64/include/asm/atomic_ll_sc.h:292 [inline] lr : __cmpxchg_case_mb_32 arch/arm64/include/asm/cmpxchg.h:129 [inline] lr : __cmpxchg_mb arch/arm64/include/asm/cmpxchg.h:175 [inline] lr : atomic_cmpxchg include/asm-generic/atomic-instrumented.h:655 [inline] lr : transition_state fs/eventpoll.c:907 [inline] lr : xcall_read+0x360/0x960 fs/eventpoll.c:1051 sp : ffffa00017a17c00 x29: ffffa00017a17c00 x28: ffff0000cbbd9600 x27: 0000000000000000 x26: 0000000000000000 x25: 000000400097e000 x24: 0000000000001000 x23: ffff0000cbd11000 x22: 0000000000000000 x21: 0000000000000003 x20: 0000000000000030 x19: ffffa000108e1f24 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: ffff8000197a224e x11: 1fffe000197a224d x10: ffff8000197a224d x9 : dfffa00000000000 x8 : ffff0000cbd1126b x7 : 0000000000000001 x6 : 00007fffe685ddb3 x5 : ffff0000cbd11268 x4 : ffff8000197a224e x3 : ffffa000108e1c18 x2 : 0000000000000001 x1 : ffff0000cbbd9600 x0 : 0000000000000000 Call trace: check_kcov_mode kernel/kcov.c:163 [inline] __sanitizer_cov_trace_pc+0x64/0x114 kernel/kcov.c:197 __ll_sc__cmpxchg_case_mb_32 arch/arm64/include/asm/atomic_ll_sc.h:292 [inline] __cmpxchg_case_mb_32 arch/arm64/include/asm/cmpxchg.h:129 [inline] __cmpxchg_mb arch/arm64/include/asm/cmpxchg.h:175 [inline] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:655 [inline] transition_state fs/eventpoll.c:907 [inline] xcall_read+0x360/0x960 fs/eventpoll.c:1051 xcall_read_begin+0x68/0xa4 fs/eventpoll.c:1100 ksys_read+0xc0/0x240 fs/read_write.c:628 __do_sys_read fs/read_write.c:649 [inline] __se_sys_read fs/read_write.c:647 [inline] __arm64_sys_read+0x54/0x7c fs/read_write.c:647 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x84/0x230 arch/arm64/kernel/syscall.c:51 el0_svc_common.constprop.0+0x1f4/0x210 arch/arm64/kernel/syscall.c:211 do_el0_svc+0xa0/0x190 arch/arm64/kernel/syscall.c:309 el0_svc+0x24/0x34 arch/arm64/kernel/entry-common.c:381 el0_sync_handler+0x194/0x1a0 arch/arm64/kernel/entry-common.c:419 fast_work_pending464+0x178/0x19 Fixes: 7e1291339cb5 ("eventpoll: Support xcall async prefetch") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/eventpoll.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/fs/eventpoll.c b/fs/eventpoll.c index dc6bd16490bc..dd11e92994c9 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -1030,8 +1030,10 @@ void free_prefetch_item(struct file *file) kfree(pfi); } +#define MAX_READY_WAIT_TIME msecs_to_jiffies(2) static int xcall_read(struct prefetch_item *pfi, char __user *buf, size_t count) { + unsigned long end = jiffies + MAX_READY_WAIT_TIME; ssize_t copy_len = 0; /* @@ -1050,6 +1052,13 @@ static int xcall_read(struct prefetch_item *pfi, char __user *buf, size_t count) */ if (transition_state(pfi, XCALL_CACHE_NONE, XCALL_CACHE_CANCEL)) goto slow_read; + + if (time_after(jiffies, end)) { + pr_warn("xcall read wait prefetch state %d more than 2ms\n", + atomic_read(&pfi->state)); + cond_resched(); + end = jiffies + MAX_READY_WAIT_TIME; + } } copy_len = pfi->len; @@ -1128,7 +1137,7 @@ static int get_async_prefetch_cpu(struct prefetch_item *pfi) return pfi->cpu; } -static void ep_prefetch_item_enqueue(struct eventpoll *ep, struct epitem *epi) +static void ep_prefetch_item_enqueue(struct epitem *epi) { struct prefetch_item *pfi; int cpu, err; @@ -2156,7 +2165,7 @@ static __poll_t ep_send_events_proc(struct eventpoll *ep, struct list_head *head continue; #ifdef CONFIG_XCALL_PREFETCH - ep_prefetch_item_enqueue(ep, epi); + ep_prefetch_item_enqueue(epi); #endif if (__put_user(revents, &uevent->events) || -- 2.34.1

2 1

[PATCH OLK-5.10 V3] sched: More flexible use of CPU quota when CPU is idle
by Cheng Yu 24 Jun '25

24 Jun '25

From: Zheng Zucheng <zhengzucheng(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICE7WC -------------------------------- This feature allows users to use CPU quota more flexibly when CPU is idle and it will cause the CPU quota to be exceeded. So, it cannot be used in scenarios where there are strict restrictions on the use of the CPU quota, such as some commercial scenarios that charge based on the use of CPU quota. Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Signed-off-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- arch/arm64/Kconfig | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/kernel/topology.c | 30 +++++ include/linux/sched/sysctl.h | 4 + init/Kconfig | 18 +++ kernel/sched/core.c | 32 ++++++ kernel/sched/fair.c | 152 ++++++++++++++++++++++++- kernel/sched/features.h | 4 + kernel/sched/idle.c | 7 ++ kernel/sched/sched.h | 12 ++ kernel/sysctl.c | 11 ++ 11 files changed, 268 insertions(+), 4 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index eb30ef59aca2..4ba485650d0a 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -80,6 +80,7 @@ config ARM64 select ARCH_SUPPORTS_NUMA_BALANCING select ARCH_SUPPORTS_SCHED_KEEP_ON_CORE select ARCH_SUPPORTS_SCHED_PARAL + select ARCH_SUPPORTS_SCHED_SOFT_QUOTA select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH select ARCH_WANT_COMPAT_IPC_PARSE_VERSION if COMPAT select ARCH_WANT_DEFAULT_BPF_JIT diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index be1faf2da008..1e1e70a6736d 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -191,6 +191,7 @@ CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y CONFIG_SCHED_KEEP_ON_CORE=y CONFIG_SCHED_PARAL=y +CONFIG_SCHED_SOFT_QUOTA=y CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c index 785de5b9696d..4c7f3687356d 100644 --- a/arch/arm64/kernel/topology.c +++ b/arch/arm64/kernel/topology.c @@ -363,6 +363,36 @@ void topology_scale_freq_tick(void) this_cpu_write(arch_const_cycles_prev, const_cnt); } +#ifdef CONFIG_SCHED_SOFT_QUOTA +static DEFINE_PER_CPU(int, sibling_idle) = 1; + +int is_sibling_idle(void) +{ + return this_cpu_read(sibling_idle); +} + +static void smt_measurement_begin(void) +{ +} + +static void smt_measurement_done(void) +{ +} +#else +static inline void smt_measurement_begin(void) { } +static inline void smt_measurement_done(void) { } +#endif + +void arch_cpu_idle_enter(void) +{ + smt_measurement_begin(); +} + +void arch_cpu_idle_exit(void) +{ + smt_measurement_done(); +} + #ifdef CONFIG_ACPI_CPPC_LIB #include <acpi/cppc_acpi.h> diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index 9f998be56bdd..90021477ea4c 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -48,6 +48,10 @@ extern unsigned int sysctl_smart_grid_strategy_ctrl; extern int sysctl_affinity_adjust_delay_ms; #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +extern unsigned int sysctl_soft_runtime_ratio; +#endif + enum sched_tunable_scaling { SCHED_TUNABLESCALING_NONE, SCHED_TUNABLESCALING_LOG, diff --git a/init/Kconfig b/init/Kconfig index 5f88cce193e8..2ee50c638ca3 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1411,6 +1411,24 @@ config SCHED_PARAL 3. The existing "qos dynamic affinity" and "qos smart grid" features must not be used simultaneously. +# +# For architectures that want to enable the support for SCHED_SOFT_QUOTA +# +config ARCH_SUPPORTS_SCHED_SOFT_QUOTA + bool + +config SCHED_SOFT_QUOTA + bool "More flexible use of CPU quota" + depends on ARCH_SUPPORTS_SCHED_SOFT_QUOTA + depends on CFS_BANDWIDTH + default n + help + This option allows users to use CPU quota more flexibly when CPU + is idle. It is better for users to have some understanding of + CFS_BANDWIDTH. It cannot be used in scenarios where there are strict + restrictions on the use of the CPU quota, such as some commercial + scenarios that charge based on the use of CPU quota. + config CHECKPOINT_RESTORE bool "Checkpoint/restore support" select PROC_CHILDREN diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 457eeebc7b62..72cb2c1adb7b 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -9902,6 +9902,30 @@ static int cpu_steal_task_write(struct cgroup_subsys_state *css, } #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +static int cpu_soft_quota_write(struct cgroup_subsys_state *css, + struct cftype *cftype, s64 soft_quota) +{ + struct task_group *tg = css_tg(css); + + if (soft_quota != 1 && soft_quota != 0) + return -EINVAL; + + if (tg->soft_quota == soft_quota) + return 0; + + tg->soft_quota = soft_quota; + + return 0; +} + +static inline s64 cpu_soft_quota_read(struct cgroup_subsys_state *css, + struct cftype *cft) +{ + return css_tg(css)->soft_quota; +} +#endif + #ifdef CONFIG_BPF_SCHED void sched_settag(struct task_struct *tsk, s64 tag) { @@ -10064,6 +10088,14 @@ static struct cftype cpu_legacy_files[] = { .write_s64 = cpu_qos_write, }, #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + { + .name = "soft_quota", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_soft_quota_read, + .write_s64 = cpu_soft_quota_write, + }, +#endif #ifdef CONFIG_QOS_SCHED_SMT_EXPELLER { .name = "smt_expell", diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index b7544a14225c..4731711fbec4 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -140,6 +140,10 @@ static int unthrottle_qos_cfs_rqs(int cpu); static bool qos_smt_expelled(int this_cpu); #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +static DEFINE_PER_CPU_SHARED_ALIGNED(struct list_head, soft_quota_throttled_cfs_rq); +#endif + #ifdef CONFIG_QOS_SCHED_MULTILEVEL #define QOS_LEVEL_WEIGHT_OFFLINE_EX 1 #define QOS_LEVEL_WEIGHT_OFFLINE 10 @@ -439,10 +443,11 @@ static inline struct sched_entity *parent_entity(struct sched_entity *se) return se->parent; } -static void +static bool find_matching_se(struct sched_entity **se, struct sched_entity **pse) { int se_depth, pse_depth; + bool ret = false; /* * preemption test can be made between sibling entities who are in the @@ -456,6 +461,10 @@ find_matching_se(struct sched_entity **se, struct sched_entity **pse) pse_depth = (*pse)->depth; while (se_depth > pse_depth) { +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (!ret && cfs_rq_of(*se)->soft_quota_enable == 1) + ret = true; +#endif se_depth--; *se = parent_entity(*se); } @@ -466,9 +475,15 @@ find_matching_se(struct sched_entity **se, struct sched_entity **pse) } while (!is_same_group(*se, *pse)) { +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (!ret && cfs_rq_of(*se)->soft_quota_enable == 1) + ret = true; +#endif *se = parent_entity(*se); *pse = parent_entity(*pse); } + + return ret; } #else /* !CONFIG_FAIR_GROUP_SCHED */ @@ -503,9 +518,10 @@ static inline struct sched_entity *parent_entity(struct sched_entity *se) return NULL; } -static inline void +static inline bool find_matching_se(struct sched_entity **se, struct sched_entity **pse) { + return false; } #endif /* CONFIG_FAIR_GROUP_SCHED */ @@ -5396,6 +5412,14 @@ static bool throttle_cfs_rq(struct cfs_rq *cfs_rq) */ cfs_rq->throttled = 1; cfs_rq->throttled_clock = rq_clock(rq); + +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (cfs_rq->tg->soft_quota == 1) { + list_add(&cfs_rq->soft_quota_throttled_list, + &per_cpu(soft_quota_throttled_cfs_rq, cpu_of(rq))); + } +#endif + return true; } @@ -5414,6 +5438,10 @@ void unthrottle_cfs_rq(struct cfs_rq *cfs_rq) se = cfs_rq->tg->se[cpu_of(rq)]; +#ifdef CONFIG_SCHED_SOFT_QUOTA + list_del_init(&cfs_rq->soft_quota_throttled_list); +#endif + #ifdef CONFIG_QOS_SCHED /* * if this cfs_rq throttled by qos, not need unthrottle it. @@ -5531,6 +5559,16 @@ static void distribute_cfs_runtime(struct cfs_bandwidth *cfs_b) struct rq_flags rf; rq_lock_irqsave(rq, &rf); + +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (cfs_rq->soft_quota_enable == 1) { + if (cfs_rq->runtime_remaining > 0) + cfs_rq->runtime_remaining = 0; + + cfs_rq->soft_quota_enable = 0; + } +#endif + if (!cfs_rq_throttled(cfs_rq)) goto next; @@ -5573,6 +5611,17 @@ static void distribute_cfs_runtime(struct cfs_bandwidth *cfs_b) rcu_read_unlock(); } +#ifdef CONFIG_SCHED_SOFT_QUOTA +static inline void init_tg_sum_soft_runtime(struct cfs_bandwidth *cfs_b) +{ + unsigned int cpu; + struct task_group *tg = container_of(cfs_b, struct task_group, cfs_bandwidth); + + for_each_possible_cpu(cpu) + tg->cfs_rq[cpu]->sum_soft_runtime = 0; +} +#endif + /* * Responsible for refilling a task_group's bandwidth and unthrottling its * cfs_rqs as appropriate. If there has been no activity within the last @@ -5590,6 +5639,10 @@ static int do_sched_cfs_period_timer(struct cfs_bandwidth *cfs_b, int overrun, u throttled = !list_empty(&cfs_b->throttled_cfs_rq); cfs_b->nr_periods += overrun; +#ifdef CONFIG_SCHED_SOFT_QUOTA + init_tg_sum_soft_runtime(cfs_b); +#endif + /* Refill extra burst quota even if cfs_b->idle */ __refill_cfs_bandwidth_runtime(cfs_b); @@ -5898,6 +5951,9 @@ static void init_cfs_rq_runtime(struct cfs_rq *cfs_rq) #ifdef CONFIG_QOS_SCHED INIT_LIST_HEAD(&cfs_rq->qos_throttled_list); #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + INIT_LIST_HEAD(&cfs_rq->soft_quota_throttled_list); +#endif } void start_cfs_bandwidth(struct cfs_bandwidth *cfs_b) @@ -8536,6 +8592,7 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ struct cfs_rq *cfs_rq = task_cfs_rq(curr); int scale = cfs_rq->nr_running >= sched_nr_latency; int next_buddy_marked = 0; + bool ret = 0; if (unlikely(se == pse)) return; @@ -8590,7 +8647,13 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ if (unlikely(p->policy != SCHED_NORMAL) || !sched_feat(WAKEUP_PREEMPTION)) return; - find_matching_se(&se, &pse); + ret = find_matching_se(&se, &pse); + +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (ret) + goto preempt; +#endif + update_curr(cfs_rq_of(se)); BUG_ON(!pse); if (wakeup_preempt_entity(se, pse) == 1) { @@ -13823,6 +13886,9 @@ static void task_change_group_fair(struct task_struct *p, int type) void free_fair_sched_group(struct task_group *tg) { int i; +#ifdef CONFIG_SCHED_SOFT_QUOTA + struct cfs_rq *cfs_rq; +#endif destroy_cfs_bandwidth(tg_cfs_bandwidth(tg)); destroy_auto_affinity(tg); @@ -13831,6 +13897,12 @@ void free_fair_sched_group(struct task_group *tg) #ifdef CONFIG_QOS_SCHED if (tg->cfs_rq && tg->cfs_rq[i]) unthrottle_qos_sched_group(tg->cfs_rq[i]); +#endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (tg->cfs_rq && tg->cfs_rq[i]) { + cfs_rq = tg->cfs_rq[i]; + list_del_init(&cfs_rq->soft_quota_throttled_list); + } #endif if (tg->cfs_rq) kfree(tg->cfs_rq[i]); @@ -14209,13 +14281,20 @@ void task_tick_relationship(struct rq *rq, struct task_struct *curr) __init void init_sched_fair_class(void) { -#ifdef CONFIG_QOS_SCHED +#if defined(CONFIG_QOS_SCHED) || defined(CONFIG_SCHED_SOFT_QUOTA) int i; +#endif +#ifdef CONFIG_QOS_SCHED for_each_possible_cpu(i) INIT_LIST_HEAD(&per_cpu(qos_throttled_cfs_rq, i)); #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + for_each_possible_cpu(i) + INIT_LIST_HEAD(&per_cpu(soft_quota_throttled_cfs_rq, i)); +#endif + init_sched_numa_icon(); #ifdef CONFIG_SMP @@ -14327,3 +14406,68 @@ int sched_trace_rq_nr_running(struct rq *rq) return rq ? rq->nr_running : -1; } EXPORT_SYMBOL_GPL(sched_trace_rq_nr_running); + +#ifdef CONFIG_SCHED_SOFT_QUOTA +unsigned int sysctl_soft_runtime_ratio = 20; + +static bool check_soft_runtime(struct task_group *tg, int slice) +{ + int cpu; + u64 sum_soft_runtime = slice; + struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth; + + if (cfs_b->quota == RUNTIME_INF) + return true; + + for_each_possible_cpu(cpu) + sum_soft_runtime += tg->cfs_rq[cpu]->sum_soft_runtime; + + return sum_soft_runtime < sysctl_soft_runtime_ratio * cfs_b->quota / 100; +} + +int __weak is_sibling_idle(void) +{ + return 0; +} + +bool unthrottle_cfs_rq_soft_quota(struct rq *rq) +{ + int max_cnt = 0; + bool ret = false; + struct cfs_rq *cfs_rq, *tmp_rq; + struct cfs_bandwidth *cfs_b; + int slice = sched_cfs_bandwidth_slice(); + + if (!is_sibling_idle()) + return ret; + + list_for_each_entry_safe(cfs_rq, tmp_rq, &per_cpu(soft_quota_throttled_cfs_rq, cpu_of(rq)), + soft_quota_throttled_list) { + if (max_cnt++ > 20) + break; + + if (cfs_rq->throttled) { + cfs_b = tg_cfs_bandwidth(cfs_rq->tg); + raw_spin_lock(&cfs_b->lock); + + if (!check_soft_runtime(cfs_rq->tg, slice)) { + raw_spin_unlock(&cfs_b->lock); + continue; + } + + raw_spin_unlock(&cfs_b->lock); + + if (cfs_rq->runtime_remaining + slice > 0) { + cfs_rq->runtime_remaining += slice; + cfs_rq->sum_soft_runtime += slice; + cfs_rq->soft_quota_enable = 1; + unthrottle_cfs_rq(cfs_rq); + ret = true; + break; + } + } + } + + return ret; +} +#endif diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 1fd89af55681..c887b0d384ae 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -78,6 +78,10 @@ SCHED_FEAT(KEEP_ON_CORE, false) SCHED_FEAT(PARAL, false) #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +SCHED_FEAT(SOFT_QUOTA, false) +#endif + /* * Issue a WARN when we do multiple update_rq_clock() calls * in a single rq->lock section. Default disabled because the diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c index 3c6396d61a04..b6537524c035 100644 --- a/kernel/sched/idle.c +++ b/kernel/sched/idle.c @@ -443,6 +443,13 @@ struct task_struct *pick_next_task_idle(struct rq *rq) { struct task_struct *next = rq->idle; +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (sched_feat(SOFT_QUOTA)) { + if (unthrottle_cfs_rq_soft_quota(rq) && rq->cfs.nr_running) + return pick_next_task_fair(rq, NULL, NULL); + } +#endif + set_next_task_idle(rq, next, true); return next; diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index fe6342305b0f..9b2779e8fc91 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -508,6 +508,9 @@ struct task_group { #else KABI_RESERVE(4) #endif +#if defined(CONFIG_SCHED_SOFT_QUOTA) + KABI_EXTEND(u64 soft_quota) +#endif }; #ifdef CONFIG_SCHED_STEAL @@ -606,6 +609,10 @@ static inline int init_auto_affinity(struct task_group *tg) static inline void tg_update_affinity_domains(int cpu, int online) {} #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +extern bool unthrottle_cfs_rq_soft_quota(struct rq *rq); +#endif + #ifdef CONFIG_FAIR_GROUP_SCHED extern int sched_group_set_shares(struct task_group *tg, unsigned long shares); @@ -734,6 +741,11 @@ struct cfs_rq { KABI_RESERVE(3) KABI_RESERVE(4) #endif +#if defined(CONFIG_SCHED_SOFT_QUOTA) + KABI_EXTEND(u64 soft_quota_enable) + KABI_EXTEND(u64 sum_soft_runtime) + KABI_EXTEND(struct list_head soft_quota_throttled_list) +#endif }; static inline int rt_bandwidth_enabled(void) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 0b1c13a05332..738d9a4455c1 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2831,6 +2831,17 @@ static struct ctl_table kern_table[] = { .extra2 = &one_hundred, }, #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + { + .procname = "sched_soft_runtime_ratio", + .data = &sysctl_soft_runtime_ratio, + .maxlen = sizeof(sysctl_soft_runtime_ratio), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ONE, + .extra2 = &one_hundred, + }, +#endif #ifdef CONFIG_SCHED_STEAL { .procname = "sched_max_steal_count", -- 2.25.1

2 1

[PATCH v3 OLK-6.6 00/31] Support CCA Guest
by Cai Xinchen 24 Jun '25

24 Jun '25

This series adds support for running Linux in a protected VM under the Arm Confidential Compute Architecture (CCA). To support CCA guest, we do things as follow: 1. Revert virtcca patches Revert "virtcca feature : disable swiotlb for passthrough device" Revert "gicv3: add lpi support for cvm guest" 2. Support CCA encrypt part arm64: mm: Add top-level dispatcher for internal mem_encrypt API arm64: mm: Add confidential computing hook to ioremap_prot() arm64: rsi: Add RSI definitions arm64: Detect if in a realm and set RIPAS RAM arm64: realm: Query IPA size from the RMM arm64: rsi: Add support for checking whether an MMIO is protected arm64: rsi: Map unprotected MMIO as decrypted efi: arm64: Map Device with Prot Shared arm64: Enforce bounce buffers for realm DMA arm64: mm: Avoid TLBI when marking pages as valid arm64: Enable memory encrypt for Realms irqchip/gic-v3-its: Share ITS tables with a non-trusted hypervisor irqchip/gic-v3-its: Fix over allocation in itt_alloc_pool() irqchip/gic-v3-its: Rely on genpool alignment jump_label,module: Don't alloc static_key_mod for __ro_after_init keys parisc: Delay write-protection until mark_rodata_ro() call arm64: realm: ioremap: Allow mapping memory as encrypted rme: make sure realm guest map memory in page granularity dma: Fix encryption bit clearing for dma_to_phys dma: Introduce generic dma_addr_*crypted helpers arm64: realm: Use aliased addresses for device DMA to shared buffers 3. Support tsm report for arm-cca-guest virt: coco: Add a coco/Makefile and coco/Kconfig configfs-tsm: Introduce a shared ABI for attestation reports mm/slab: Add __free() support for kvfree virt: arm-cca-guest: TSM_REPORT support for realms arm64: Document Arm Confidential Compute configfs-tsm-report: Fix NULL dereference of tsm_ops MAINTAINERS: Add CCA and pKVM CoCO guest support to the ARM64 entry 4. Recover virtcca gicv3: add lpi support for virtcca cvm guest V3: Fix arm64: Document Arm Confidential Compute commit V2: Add 5 bugfix patch commit fba4ceaa242d ("configfs-tsm-report: Fix NULL dereference of tsm_ops") commit 92230596252a ("MAINTAINERS: Add CCA and pKVM CoCO guest support to the ARM64 entry") commit 7d953a062416 ("arm64: realm: Use aliased addresses for device DMA to shared buffers") commit b66e2ee7b6c8 ("dma: Introduce generic dma_addr_*crypted helpers") commit c380931712d1 ("dma: Fix encryption bit clearing for dma_to_phys") Cai Xinchen (2): Revert "virtcca feature : disable swiotlb for passthrough device" Revert "gicv3: add lpi support for cvm guest" Dan Williams (4): virt: coco: Add a coco/Makefile and coco/Kconfig configfs-tsm: Introduce a shared ABI for attestation reports mm/slab: Add __free() support for kvfree configfs-tsm-report: Fix NULL dereference of tsm_ops Helge Deller (1): parisc: Delay write-protection until mark_rodata_ro() call Peter Zijlstra (1): jump_label,module: Don't alloc static_key_mod for __ro_after_init keys Sami Mujawar (1): virt: arm-cca-guest: TSM_REPORT support for realms Steven Price (7): arm64: realm: Query IPA size from the RMM arm64: Enforce bounce buffers for realm DMA arm64: mm: Avoid TLBI when marking pages as valid irqchip/gic-v3-its: Share ITS tables with a non-trusted hypervisor irqchip/gic-v3-its: Fix over allocation in itt_alloc_pool() irqchip/gic-v3-its: Rely on genpool alignment arm64: Document Arm Confidential Compute Suzuki K Poulose (10): arm64: rsi: Add RSI definitions arm64: Detect if in a realm and set RIPAS RAM arm64: rsi: Add support for checking whether an MMIO is protected arm64: rsi: Map unprotected MMIO as decrypted efi: arm64: Map Device with Prot Shared arm64: Enable memory encrypt for Realms arm64: realm: ioremap: Allow mapping memory as encrypted dma: Fix encryption bit clearing for dma_to_phys dma: Introduce generic dma_addr_*crypted helpers arm64: realm: Use aliased addresses for device DMA to shared buffers Will Deacon (3): arm64: mm: Add top-level dispatcher for internal mem_encrypt API arm64: mm: Add confidential computing hook to ioremap_prot() MAINTAINERS: Add CCA and pKVM CoCO guest support to the ARM64 entry Yiwei Zhuang (1): rme: make sure realm guest map memory in page granularity yxk (1): gicv3: add lpi support for virtcca cvm guest Documentation/ABI/testing/configfs-tsm | 82 ++++ Documentation/arch/arm64/arm-cca.rst | 69 +++ Documentation/arch/arm64/booting.rst | 3 + Documentation/arch/arm64/index.rst | 1 + MAINTAINERS | 10 + arch/arm64/Kconfig | 4 + arch/arm64/include/asm/io.h | 12 + arch/arm64/include/asm/mem_encrypt.h | 35 ++ arch/arm64/include/asm/pgtable-prot.h | 4 + arch/arm64/include/asm/pgtable.h | 5 + arch/arm64/include/asm/rsi.h | 68 +++ arch/arm64/include/asm/rsi_cmds.h | 160 +++++++ arch/arm64/include/asm/rsi_smc.h | 193 ++++++++ arch/arm64/include/asm/set_memory.h | 4 + arch/arm64/include/asm/virtcca_cvm_guest.h | 8 + arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/efi.c | 12 +- arch/arm64/kernel/rsi.c | 165 +++++++ arch/arm64/kernel/setup.c | 3 + arch/arm64/kernel/virtcca_cvm_guest.c | 24 + arch/arm64/mm/Makefile | 2 +- arch/arm64/mm/init.c | 10 +- arch/arm64/mm/ioremap.c | 23 +- arch/arm64/mm/mem_encrypt.c | 50 ++ arch/arm64/mm/pageattr.c | 98 +++- arch/parisc/mm/init.c | 16 +- drivers/irqchip/irq-gic-v3-its.c | 329 +++++-------- drivers/virt/Kconfig | 8 +- drivers/virt/Makefile | 5 +- drivers/virt/coco/Kconfig | 18 + drivers/virt/coco/Makefile | 10 + drivers/virt/coco/arm-cca-guest/Kconfig | 11 + drivers/virt/coco/arm-cca-guest/Makefile | 2 + .../virt/coco/arm-cca-guest/arm-cca-guest.c | 224 +++++++++ drivers/virt/coco/tsm.c | 452 ++++++++++++++++++ include/asm-generic/sections.h | 5 + include/linux/dma-direct.h | 13 +- include/linux/jump_label.h | 3 + include/linux/mem_encrypt.h | 23 + include/linux/slab.h | 2 + include/linux/tsm.h | 69 +++ include/linux/virtcca_cvm_domain.h | 10 + init/main.c | 1 + kernel/jump_label.c | 53 ++ 44 files changed, 2062 insertions(+), 239 deletions(-) create mode 100644 Documentation/ABI/testing/configfs-tsm create mode 100644 Documentation/arch/arm64/arm-cca.rst create mode 100644 arch/arm64/include/asm/mem_encrypt.h create mode 100644 arch/arm64/include/asm/rsi.h create mode 100644 arch/arm64/include/asm/rsi_cmds.h create mode 100644 arch/arm64/include/asm/rsi_smc.h create mode 100644 arch/arm64/kernel/rsi.c create mode 100644 arch/arm64/mm/mem_encrypt.c create mode 100644 drivers/virt/coco/Kconfig create mode 100644 drivers/virt/coco/Makefile create mode 100644 drivers/virt/coco/arm-cca-guest/Kconfig create mode 100644 drivers/virt/coco/arm-cca-guest/Makefile create mode 100644 drivers/virt/coco/arm-cca-guest/arm-cca-guest.c create mode 100644 drivers/virt/coco/tsm.c create mode 100644 include/linux/tsm.h -- 2.18.0.huawei.25

2 32

[PATCH OLK-6.6] ALSA: pcm: Fix race of buffer access at PCM OSS layer
by Luo Gengkun 24 Jun '25

24 Jun '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.93 commit 74d90875f3d43f3eff0e9861c4701418795d3455 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGACK CVE: CVE-2025-38078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 93a81ca0657758b607c3f4ba889ae806be9beb73 upstream. The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed runtime->dma_area might be freed concurrently, as it's performed outside the PCM ops. For avoiding it, move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed during the operation. Reported-by: syzbot+32d4647f551007595173(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- include/sound/pcm.h | 2 ++ sound/core/oss/pcm_oss.c | 3 +-- sound/core/pcm_native.c | 11 +++++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/include/sound/pcm.h b/include/sound/pcm.h index 2a815373dac1..ed4449cbdf80 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -1427,6 +1427,8 @@ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_s #define snd_pcm_lib_mmap_iomem NULL #endif +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime); + /** * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer * @dma: DMA number diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 728c211142d1..471de2d1b37a 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1085,8 +1085,7 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) runtime->oss.params = 0; runtime->oss.prepare = 1; runtime->oss.buffer_used = 0; - if (runtime->dma_area) - snd_pcm_format_set_silence(runtime->format, runtime->dma_area, bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_runtime_buffer_set_silence(runtime); runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size); diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index e40de64ec85c..31fc20350fd9 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -703,6 +703,17 @@ static void snd_pcm_buffer_access_unlock(struct snd_pcm_runtime *runtime) atomic_inc(&runtime->buffer_accessing); } +/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime) +{ + snd_pcm_buffer_access_lock(runtime); + if (runtime->dma_area) + snd_pcm_format_set_silence(runtime->format, runtime->dma_area, + bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_buffer_access_unlock(runtime); +} +EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence); + #if IS_ENABLED(CONFIG_SND_PCM_OSS) #define is_oss_stream(substream) ((substream)->oss.oss) #else -- 2.34.1

2 1

[PATCH OLK-5.10 V3] sched: More flexible use of CPU quota when CPU is idle
by Cheng Yu 24 Jun '25

24 Jun '25

From: Zheng Zucheng <zhengzucheng(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICE7WC -------------------------------- This feature allows users to use CPU quota more flexibly when CPU is idle and it will cause the CPU quota to be exceeded. So, it cannot be used in scenarios where there are strict restrictions on the use of the CPU quota, such as some commercial scenarios that charge based on the use of CPU quota. Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Signed-off-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- arch/arm64/Kconfig | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/kernel/topology.c | 32 ++++++ include/linux/sched/sysctl.h | 4 + init/Kconfig | 18 +++ kernel/sched/core.c | 32 ++++++ kernel/sched/fair.c | 151 ++++++++++++++++++++++++- kernel/sched/features.h | 4 + kernel/sched/idle.c | 7 ++ kernel/sched/sched.h | 12 ++ kernel/sysctl.c | 11 ++ 11 files changed, 269 insertions(+), 4 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index eb30ef59aca2..4ba485650d0a 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -80,6 +80,7 @@ config ARM64 select ARCH_SUPPORTS_NUMA_BALANCING select ARCH_SUPPORTS_SCHED_KEEP_ON_CORE select ARCH_SUPPORTS_SCHED_PARAL + select ARCH_SUPPORTS_SCHED_SOFT_QUOTA select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH select ARCH_WANT_COMPAT_IPC_PARSE_VERSION if COMPAT select ARCH_WANT_DEFAULT_BPF_JIT diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index be1faf2da008..1e1e70a6736d 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -191,6 +191,7 @@ CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y CONFIG_SCHED_KEEP_ON_CORE=y CONFIG_SCHED_PARAL=y +CONFIG_SCHED_SOFT_QUOTA=y CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c index 785de5b9696d..b3ae5c6de81e 100644 --- a/arch/arm64/kernel/topology.c +++ b/arch/arm64/kernel/topology.c @@ -363,6 +363,38 @@ void topology_scale_freq_tick(void) this_cpu_write(arch_const_cycles_prev, const_cnt); } +#ifdef CONFIG_SCHED_SOFT_QUOTA +static DEFINE_PER_CPU(int, sibling_idle) = 1; + +int is_sibling_idle(void) +{ + return this_cpu_read(sibling_idle); +} + +static void smt_measurement_begin(void) +{ + // TODO +} + +static void smt_measurement_done(void) +{ + // TODO +} +#else +static inline void smt_measurement_begin(void) { } +static inline void smt_measurement_done(void) { } +#endif + +void arch_cpu_idle_enter(void) +{ + smt_measurement_begin(); +} + +void arch_cpu_idle_exit(void) +{ + smt_measurement_done(); +} + #ifdef CONFIG_ACPI_CPPC_LIB #include <acpi/cppc_acpi.h> diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index 9f998be56bdd..90021477ea4c 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -48,6 +48,10 @@ extern unsigned int sysctl_smart_grid_strategy_ctrl; extern int sysctl_affinity_adjust_delay_ms; #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +extern unsigned int sysctl_soft_runtime_ratio; +#endif + enum sched_tunable_scaling { SCHED_TUNABLESCALING_NONE, SCHED_TUNABLESCALING_LOG, diff --git a/init/Kconfig b/init/Kconfig index 5f88cce193e8..2ee50c638ca3 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1411,6 +1411,24 @@ config SCHED_PARAL 3. The existing "qos dynamic affinity" and "qos smart grid" features must not be used simultaneously. +# +# For architectures that want to enable the support for SCHED_SOFT_QUOTA +# +config ARCH_SUPPORTS_SCHED_SOFT_QUOTA + bool + +config SCHED_SOFT_QUOTA + bool "More flexible use of CPU quota" + depends on ARCH_SUPPORTS_SCHED_SOFT_QUOTA + depends on CFS_BANDWIDTH + default n + help + This option allows users to use CPU quota more flexibly when CPU + is idle. It is better for users to have some understanding of + CFS_BANDWIDTH. It cannot be used in scenarios where there are strict + restrictions on the use of the CPU quota, such as some commercial + scenarios that charge based on the use of CPU quota. + config CHECKPOINT_RESTORE bool "Checkpoint/restore support" select PROC_CHILDREN diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 457eeebc7b62..72cb2c1adb7b 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -9902,6 +9902,30 @@ static int cpu_steal_task_write(struct cgroup_subsys_state *css, } #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +static int cpu_soft_quota_write(struct cgroup_subsys_state *css, + struct cftype *cftype, s64 soft_quota) +{ + struct task_group *tg = css_tg(css); + + if (soft_quota != 1 && soft_quota != 0) + return -EINVAL; + + if (tg->soft_quota == soft_quota) + return 0; + + tg->soft_quota = soft_quota; + + return 0; +} + +static inline s64 cpu_soft_quota_read(struct cgroup_subsys_state *css, + struct cftype *cft) +{ + return css_tg(css)->soft_quota; +} +#endif + #ifdef CONFIG_BPF_SCHED void sched_settag(struct task_struct *tsk, s64 tag) { @@ -10064,6 +10088,14 @@ static struct cftype cpu_legacy_files[] = { .write_s64 = cpu_qos_write, }, #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + { + .name = "soft_quota", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_soft_quota_read, + .write_s64 = cpu_soft_quota_write, + }, +#endif #ifdef CONFIG_QOS_SCHED_SMT_EXPELLER { .name = "smt_expell", diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index b7544a14225c..d98912a8a971 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -140,6 +140,10 @@ static int unthrottle_qos_cfs_rqs(int cpu); static bool qos_smt_expelled(int this_cpu); #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +static DEFINE_PER_CPU_SHARED_ALIGNED(struct list_head, soft_quota_throttled_cfs_rq); +#endif + #ifdef CONFIG_QOS_SCHED_MULTILEVEL #define QOS_LEVEL_WEIGHT_OFFLINE_EX 1 #define QOS_LEVEL_WEIGHT_OFFLINE 10 @@ -439,10 +443,11 @@ static inline struct sched_entity *parent_entity(struct sched_entity *se) return se->parent; } -static void +static bool find_matching_se(struct sched_entity **se, struct sched_entity **pse) { int se_depth, pse_depth; + bool ret = false; /* * preemption test can be made between sibling entities who are in the @@ -456,6 +461,10 @@ find_matching_se(struct sched_entity **se, struct sched_entity **pse) pse_depth = (*pse)->depth; while (se_depth > pse_depth) { +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (!ret && cfs_rq_of(*se)->soft_quota_enable == 1) + ret = true; +#endif se_depth--; *se = parent_entity(*se); } @@ -466,9 +475,15 @@ find_matching_se(struct sched_entity **se, struct sched_entity **pse) } while (!is_same_group(*se, *pse)) { +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (!ret && cfs_rq_of(*se)->soft_quota_enable == 1) + ret = true; +#endif *se = parent_entity(*se); *pse = parent_entity(*pse); } + + return ret; } #else /* !CONFIG_FAIR_GROUP_SCHED */ @@ -503,9 +518,10 @@ static inline struct sched_entity *parent_entity(struct sched_entity *se) return NULL; } -static inline void +static inline bool find_matching_se(struct sched_entity **se, struct sched_entity **pse) { + return false; } #endif /* CONFIG_FAIR_GROUP_SCHED */ @@ -5396,6 +5412,14 @@ static bool throttle_cfs_rq(struct cfs_rq *cfs_rq) */ cfs_rq->throttled = 1; cfs_rq->throttled_clock = rq_clock(rq); + +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (cfs_rq->tg->soft_quota == 1) { + list_add(&cfs_rq->soft_quota_throttled_list, + &per_cpu(soft_quota_throttled_cfs_rq, cpu_of(rq))); + } +#endif + return true; } @@ -5414,6 +5438,10 @@ void unthrottle_cfs_rq(struct cfs_rq *cfs_rq) se = cfs_rq->tg->se[cpu_of(rq)]; +#ifdef CONFIG_SCHED_SOFT_QUOTA + list_del_init(&cfs_rq->soft_quota_throttled_list); +#endif + #ifdef CONFIG_QOS_SCHED /* * if this cfs_rq throttled by qos, not need unthrottle it. @@ -5531,6 +5559,16 @@ static void distribute_cfs_runtime(struct cfs_bandwidth *cfs_b) struct rq_flags rf; rq_lock_irqsave(rq, &rf); + +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (cfs_rq->soft_quota_enable == 1) { + if (cfs_rq->runtime_remaining > 0) + cfs_rq->runtime_remaining = 0; + + cfs_rq->soft_quota_enable = 0; + } +#endif + if (!cfs_rq_throttled(cfs_rq)) goto next; @@ -5573,6 +5611,17 @@ static void distribute_cfs_runtime(struct cfs_bandwidth *cfs_b) rcu_read_unlock(); } +#ifdef CONFIG_SCHED_SOFT_QUOTA +static inline void init_tg_sum_soft_runtime(struct cfs_bandwidth *cfs_b) +{ + unsigned int cpu; + struct task_group *tg = container_of(cfs_b, struct task_group, cfs_bandwidth); + + for_each_possible_cpu(cpu) + tg->cfs_rq[cpu]->sum_soft_runtime = 0; +} +#endif + /* * Responsible for refilling a task_group's bandwidth and unthrottling its * cfs_rqs as appropriate. If there has been no activity within the last @@ -5590,6 +5639,10 @@ static int do_sched_cfs_period_timer(struct cfs_bandwidth *cfs_b, int overrun, u throttled = !list_empty(&cfs_b->throttled_cfs_rq); cfs_b->nr_periods += overrun; +#ifdef CONFIG_SCHED_SOFT_QUOTA + init_tg_sum_soft_runtime(cfs_b); +#endif + /* Refill extra burst quota even if cfs_b->idle */ __refill_cfs_bandwidth_runtime(cfs_b); @@ -5898,6 +5951,9 @@ static void init_cfs_rq_runtime(struct cfs_rq *cfs_rq) #ifdef CONFIG_QOS_SCHED INIT_LIST_HEAD(&cfs_rq->qos_throttled_list); #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + INIT_LIST_HEAD(&cfs_rq->soft_quota_throttled_list); +#endif } void start_cfs_bandwidth(struct cfs_bandwidth *cfs_b) @@ -8536,6 +8592,7 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ struct cfs_rq *cfs_rq = task_cfs_rq(curr); int scale = cfs_rq->nr_running >= sched_nr_latency; int next_buddy_marked = 0; + bool ret = 0; if (unlikely(se == pse)) return; @@ -8590,7 +8647,13 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ if (unlikely(p->policy != SCHED_NORMAL) || !sched_feat(WAKEUP_PREEMPTION)) return; - find_matching_se(&se, &pse); + ret = find_matching_se(&se, &pse); + +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (ret) + goto preempt; +#endif + update_curr(cfs_rq_of(se)); BUG_ON(!pse); if (wakeup_preempt_entity(se, pse) == 1) { @@ -13823,6 +13886,9 @@ static void task_change_group_fair(struct task_struct *p, int type) void free_fair_sched_group(struct task_group *tg) { int i; +#ifdef CONFIG_SCHED_SOFT_QUOTA + struct cfs_rq *cfs_rq; +#endif destroy_cfs_bandwidth(tg_cfs_bandwidth(tg)); destroy_auto_affinity(tg); @@ -13831,6 +13897,12 @@ void free_fair_sched_group(struct task_group *tg) #ifdef CONFIG_QOS_SCHED if (tg->cfs_rq && tg->cfs_rq[i]) unthrottle_qos_sched_group(tg->cfs_rq[i]); +#endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (tg->cfs_rq && tg->cfs_rq[i]) { + cfs_rq = tg->cfs_rq[i]; + list_del_init(&cfs_rq->soft_quota_throttled_list); + } #endif if (tg->cfs_rq) kfree(tg->cfs_rq[i]); @@ -14209,13 +14281,20 @@ void task_tick_relationship(struct rq *rq, struct task_struct *curr) __init void init_sched_fair_class(void) { -#ifdef CONFIG_QOS_SCHED +#if defined(CONFIG_QOS_SCHED) || defined(CONFIG_SCHED_SOFT_QUOTA) int i; +#endif +#ifdef CONFIG_QOS_SCHED for_each_possible_cpu(i) INIT_LIST_HEAD(&per_cpu(qos_throttled_cfs_rq, i)); #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + for_each_possible_cpu(i) + INIT_LIST_HEAD(&per_cpu(soft_quota_throttled_cfs_rq, i)); +#endif + init_sched_numa_icon(); #ifdef CONFIG_SMP @@ -14327,3 +14406,67 @@ int sched_trace_rq_nr_running(struct rq *rq) return rq ? rq->nr_running : -1; } EXPORT_SYMBOL_GPL(sched_trace_rq_nr_running); + +#ifdef CONFIG_SCHED_SOFT_QUOTA +unsigned int sysctl_soft_runtime_ratio = 20; +static bool check_soft_runtime(struct task_group *tg, int slice) +{ + int cpu; + u64 sum_soft_runtime = slice; + struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth; + + if (cfs_b->quota == RUNTIME_INF) + return true; + + for_each_possible_cpu(cpu) + sum_soft_runtime += tg->cfs_rq[cpu]->sum_soft_runtime; + + return sum_soft_runtime < sysctl_soft_runtime_ratio * cfs_b->quota / 100; +} + +int __weak is_sibling_idle(void) +{ + return 0; +} + +bool unthrottle_cfs_rq_soft_quota(struct rq *rq) +{ + int max_cnt = 0; + bool ret = false; + struct cfs_rq *cfs_rq, *tmp_rq; + struct cfs_bandwidth *cfs_b; + int slice = sched_cfs_bandwidth_slice(); + + if (!is_sibling_idle()) + return ret; + + list_for_each_entry_safe(cfs_rq, tmp_rq, &per_cpu(soft_quota_throttled_cfs_rq, cpu_of(rq)), + soft_quota_throttled_list) { + if (max_cnt++ > 20) + break; + + if (cfs_rq->throttled) { + cfs_b = tg_cfs_bandwidth(cfs_rq->tg); + raw_spin_lock(&cfs_b->lock); + + if (!check_soft_runtime(cfs_rq->tg, slice)) { + raw_spin_unlock(&cfs_b->lock); + continue; + } + + raw_spin_unlock(&cfs_b->lock); + + if (cfs_rq->runtime_remaining + slice > 0) { + cfs_rq->runtime_remaining += slice; + cfs_rq->sum_soft_runtime += slice; + cfs_rq->soft_quota_enable = 1; + unthrottle_cfs_rq(cfs_rq); + ret = true; + break; + } + } + } + + return ret; +} +#endif diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 1fd89af55681..c887b0d384ae 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -78,6 +78,10 @@ SCHED_FEAT(KEEP_ON_CORE, false) SCHED_FEAT(PARAL, false) #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +SCHED_FEAT(SOFT_QUOTA, false) +#endif + /* * Issue a WARN when we do multiple update_rq_clock() calls * in a single rq->lock section. Default disabled because the diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c index 3c6396d61a04..b6537524c035 100644 --- a/kernel/sched/idle.c +++ b/kernel/sched/idle.c @@ -443,6 +443,13 @@ struct task_struct *pick_next_task_idle(struct rq *rq) { struct task_struct *next = rq->idle; +#ifdef CONFIG_SCHED_SOFT_QUOTA + if (sched_feat(SOFT_QUOTA)) { + if (unthrottle_cfs_rq_soft_quota(rq) && rq->cfs.nr_running) + return pick_next_task_fair(rq, NULL, NULL); + } +#endif + set_next_task_idle(rq, next, true); return next; diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index fe6342305b0f..9b2779e8fc91 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -508,6 +508,9 @@ struct task_group { #else KABI_RESERVE(4) #endif +#if defined(CONFIG_SCHED_SOFT_QUOTA) + KABI_EXTEND(u64 soft_quota) +#endif }; #ifdef CONFIG_SCHED_STEAL @@ -606,6 +609,10 @@ static inline int init_auto_affinity(struct task_group *tg) static inline void tg_update_affinity_domains(int cpu, int online) {} #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA +extern bool unthrottle_cfs_rq_soft_quota(struct rq *rq); +#endif + #ifdef CONFIG_FAIR_GROUP_SCHED extern int sched_group_set_shares(struct task_group *tg, unsigned long shares); @@ -734,6 +741,11 @@ struct cfs_rq { KABI_RESERVE(3) KABI_RESERVE(4) #endif +#if defined(CONFIG_SCHED_SOFT_QUOTA) + KABI_EXTEND(u64 soft_quota_enable) + KABI_EXTEND(u64 sum_soft_runtime) + KABI_EXTEND(struct list_head soft_quota_throttled_list) +#endif }; static inline int rt_bandwidth_enabled(void) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 0b1c13a05332..738d9a4455c1 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2831,6 +2831,17 @@ static struct ctl_table kern_table[] = { .extra2 = &one_hundred, }, #endif +#ifdef CONFIG_SCHED_SOFT_QUOTA + { + .procname = "sched_soft_runtime_ratio", + .data = &sysctl_soft_runtime_ratio, + .maxlen = sizeof(sysctl_soft_runtime_ratio), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ONE, + .extra2 = &one_hundred, + }, +#endif #ifdef CONFIG_SCHED_STEAL { .procname = "sched_max_steal_count", -- 2.25.1

2 1

[PATCH OLK-5.10] eventpoll: Fix soft lockup in xcall_read()
by Jinjie Ruan 24 Jun '25

24 Jun '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/release-management/issues/IC9Q31 -------------------------------- When the prefetch state is not XCALL_CACHE_NONE or XCALL_CACHE_READY for a long time, such as XCALL_CACHE_CANCEL or XCALL_CACHE_PREFETCH, the following soft lockup occurs. Fix it by voluntarily yield the CPU when a timeout occurs in the xcall read while loop. watchdog: BUG: soft lockup - CPU#2 stuck for 111s! [syz-fuzzer:467] Modules linked in: CPU: 2 PID: 467 Comm: syz-fuzzer Not tainted 5.10.0-00019-ga473cf168de7 #10 Hardware name: linux,dummy-virt (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : check_kcov_mode kernel/kcov.c:165 [inline] pc : __sanitizer_cov_trace_pc+0x64/0x114 kernel/kcov.c:197 lr : __ll_sc__cmpxchg_case_mb_32 arch/arm64/include/asm/atomic_ll_sc.h:292 [inline] lr : __cmpxchg_case_mb_32 arch/arm64/include/asm/cmpxchg.h:129 [inline] lr : __cmpxchg_mb arch/arm64/include/asm/cmpxchg.h:175 [inline] lr : atomic_cmpxchg include/asm-generic/atomic-instrumented.h:655 [inline] lr : transition_state fs/eventpoll.c:907 [inline] lr : xcall_read+0x360/0x960 fs/eventpoll.c:1051 sp : ffffa00017a17c00 x29: ffffa00017a17c00 x28: ffff0000cbbd9600 x27: 0000000000000000 x26: 0000000000000000 x25: 000000400097e000 x24: 0000000000001000 x23: ffff0000cbd11000 x22: 0000000000000000 x21: 0000000000000003 x20: 0000000000000030 x19: ffffa000108e1f24 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: ffff8000197a224e x11: 1fffe000197a224d x10: ffff8000197a224d x9 : dfffa00000000000 x8 : ffff0000cbd1126b x7 : 0000000000000001 x6 : 00007fffe685ddb3 x5 : ffff0000cbd11268 x4 : ffff8000197a224e x3 : ffffa000108e1c18 x2 : 0000000000000001 x1 : ffff0000cbbd9600 x0 : 0000000000000000 Call trace: check_kcov_mode kernel/kcov.c:163 [inline] __sanitizer_cov_trace_pc+0x64/0x114 kernel/kcov.c:197 __ll_sc__cmpxchg_case_mb_32 arch/arm64/include/asm/atomic_ll_sc.h:292 [inline] __cmpxchg_case_mb_32 arch/arm64/include/asm/cmpxchg.h:129 [inline] __cmpxchg_mb arch/arm64/include/asm/cmpxchg.h:175 [inline] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:655 [inline] transition_state fs/eventpoll.c:907 [inline] xcall_read+0x360/0x960 fs/eventpoll.c:1051 xcall_read_begin+0x68/0xa4 fs/eventpoll.c:1100 ksys_read+0xc0/0x240 fs/read_write.c:628 __do_sys_read fs/read_write.c:649 [inline] __se_sys_read fs/read_write.c:647 [inline] __arm64_sys_read+0x54/0x7c fs/read_write.c:647 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x84/0x230 arch/arm64/kernel/syscall.c:51 el0_svc_common.constprop.0+0x1f4/0x210 arch/arm64/kernel/syscall.c:211 do_el0_svc+0xa0/0x190 arch/arm64/kernel/syscall.c:309 el0_svc+0x24/0x34 arch/arm64/kernel/entry-common.c:381 el0_sync_handler+0x194/0x1a0 arch/arm64/kernel/entry-common.c:419 fast_work_pending464+0x178/0x19 Fixes: 7e1291339cb5 ("eventpoll: Support xcall async prefetch") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/eventpoll.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/eventpoll.c b/fs/eventpoll.c index dc6bd16490bc..76309a548044 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -1030,8 +1030,10 @@ void free_prefetch_item(struct file *file) kfree(pfi); } +#define MAX_READY_WAIT_TIME msecs_to_jiffies(2) static int xcall_read(struct prefetch_item *pfi, char __user *buf, size_t count) { + unsigned long end = jiffies + MAX_READY_WAIT_TIME; ssize_t copy_len = 0; /* @@ -1050,6 +1052,12 @@ static int xcall_read(struct prefetch_item *pfi, char __user *buf, size_t count) */ if (transition_state(pfi, XCALL_CACHE_NONE, XCALL_CACHE_CANCEL)) goto slow_read; + + if (time_after(jiffies, end)) { + pr_warn("xcall read wait prefetch state %d more than 2ms\n", + atomic_read(&pfi->state)); + cond_resched(); + } } copy_len = pfi->len; @@ -1128,7 +1136,7 @@ static int get_async_prefetch_cpu(struct prefetch_item *pfi) return pfi->cpu; } -static void ep_prefetch_item_enqueue(struct eventpoll *ep, struct epitem *epi) +static void ep_prefetch_item_enqueue(struct epitem *epi) { struct prefetch_item *pfi; int cpu, err; @@ -2156,7 +2164,7 @@ static __poll_t ep_send_events_proc(struct eventpoll *ep, struct list_head *head continue; #ifdef CONFIG_XCALL_PREFETCH - ep_prefetch_item_enqueue(ep, epi); + ep_prefetch_item_enqueue(epi); #endif if (__put_user(revents, &uevent->events) || -- 2.34.1

2 1

[PATCH OLK-5.10] eventpoll: Fix soft lockup in xcall_read()
by Jinjie Ruan 24 Jun '25

24 Jun '25

When the prefetch state is not XCALL_CACHE_NONE or XCALL_CACHE_READY for a long time, such as XCALL_CACHE_CANCEL or XCALL_CACHE_PREFETCH, the following soft lockup occurs. Fix it by voluntarily yield the CPU when a timeout occurs in the xcall read while loop. watchdog: BUG: soft lockup - CPU#2 stuck for 111s! [syz-fuzzer:467] Modules linked in: CPU: 2 PID: 467 Comm: syz-fuzzer Not tainted 5.10.0-00019-ga473cf168de7 #10 Hardware name: linux,dummy-virt (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : check_kcov_mode kernel/kcov.c:165 [inline] pc : __sanitizer_cov_trace_pc+0x64/0x114 kernel/kcov.c:197 lr : __ll_sc__cmpxchg_case_mb_32 arch/arm64/include/asm/atomic_ll_sc.h:292 [inline] lr : __cmpxchg_case_mb_32 arch/arm64/include/asm/cmpxchg.h:129 [inline] lr : __cmpxchg_mb arch/arm64/include/asm/cmpxchg.h:175 [inline] lr : atomic_cmpxchg include/asm-generic/atomic-instrumented.h:655 [inline] lr : transition_state fs/eventpoll.c:907 [inline] lr : xcall_read+0x360/0x960 fs/eventpoll.c:1051 sp : ffffa00017a17c00 x29: ffffa00017a17c00 x28: ffff0000cbbd9600 x27: 0000000000000000 x26: 0000000000000000 x25: 000000400097e000 x24: 0000000000001000 x23: ffff0000cbd11000 x22: 0000000000000000 x21: 0000000000000003 x20: 0000000000000030 x19: ffffa000108e1f24 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: ffff8000197a224e x11: 1fffe000197a224d x10: ffff8000197a224d x9 : dfffa00000000000 x8 : ffff0000cbd1126b x7 : 0000000000000001 x6 : 00007fffe685ddb3 x5 : ffff0000cbd11268 x4 : ffff8000197a224e x3 : ffffa000108e1c18 x2 : 0000000000000001 x1 : ffff0000cbbd9600 x0 : 0000000000000000 Call trace: check_kcov_mode kernel/kcov.c:163 [inline] __sanitizer_cov_trace_pc+0x64/0x114 kernel/kcov.c:197 __ll_sc__cmpxchg_case_mb_32 arch/arm64/include/asm/atomic_ll_sc.h:292 [inline] __cmpxchg_case_mb_32 arch/arm64/include/asm/cmpxchg.h:129 [inline] __cmpxchg_mb arch/arm64/include/asm/cmpxchg.h:175 [inline] atomic_cmpxchg include/asm-generic/atomic-instrumented.h:655 [inline] transition_state fs/eventpoll.c:907 [inline] xcall_read+0x360/0x960 fs/eventpoll.c:1051 xcall_read_begin+0x68/0xa4 fs/eventpoll.c:1100 ksys_read+0xc0/0x240 fs/read_write.c:628 __do_sys_read fs/read_write.c:649 [inline] __se_sys_read fs/read_write.c:647 [inline] __arm64_sys_read+0x54/0x7c fs/read_write.c:647 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x84/0x230 arch/arm64/kernel/syscall.c:51 el0_svc_common.constprop.0+0x1f4/0x210 arch/arm64/kernel/syscall.c:211 do_el0_svc+0xa0/0x190 arch/arm64/kernel/syscall.c:309 el0_svc+0x24/0x34 arch/arm64/kernel/entry-common.c:381 el0_sync_handler+0x194/0x1a0 arch/arm64/kernel/entry-common.c:419 fast_work_pending464+0x178/0x19 Fixes: 7e1291339cb5 ("eventpoll: Support xcall async prefetch") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/eventpoll.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/eventpoll.c b/fs/eventpoll.c index dc6bd16490bc..76309a548044 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -1030,8 +1030,10 @@ void free_prefetch_item(struct file *file) kfree(pfi); } +#define MAX_READY_WAIT_TIME msecs_to_jiffies(2) static int xcall_read(struct prefetch_item *pfi, char __user *buf, size_t count) { + unsigned long end = jiffies + MAX_READY_WAIT_TIME; ssize_t copy_len = 0; /* @@ -1050,6 +1052,12 @@ static int xcall_read(struct prefetch_item *pfi, char __user *buf, size_t count) */ if (transition_state(pfi, XCALL_CACHE_NONE, XCALL_CACHE_CANCEL)) goto slow_read; + + if (time_after(jiffies, end)) { + pr_warn("xcall read wait prefetch state %d more than 2ms\n", + atomic_read(&pfi->state)); + cond_resched(); + } } copy_len = pfi->len; @@ -1128,7 +1136,7 @@ static int get_async_prefetch_cpu(struct prefetch_item *pfi) return pfi->cpu; } -static void ep_prefetch_item_enqueue(struct eventpoll *ep, struct epitem *epi) +static void ep_prefetch_item_enqueue(struct epitem *epi) { struct prefetch_item *pfi; int cpu, err; @@ -2156,7 +2164,7 @@ static __poll_t ep_send_events_proc(struct eventpoll *ep, struct list_head *head continue; #ifdef CONFIG_XCALL_PREFETCH - ep_prefetch_item_enqueue(ep, epi); + ep_prefetch_item_enqueue(epi); #endif if (__put_user(revents, &uevent->events) || -- 2.34.1

2 1

[PATCH OLK-5.10 0/1] Fix CVE-2022-50230
by Hongbo Li 24 Jun '25

24 Jun '25

Fix CVE-2022-50230. Peter Collingbourne (1): arm64: set UXN on swapper page tables arch/arm64/include/asm/kernel-pgtable.h | 4 ++-- arch/arm64/kernel/head.S | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.10] ALSA: pcm: Fix race of buffer access at PCM OSS layer
by Luo Gengkun 24 Jun '25

24 Jun '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.93 commit 74d90875f3d43f3eff0e9861c4701418795d3455 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGACK CVE: CVE-2025-38078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 93a81ca0657758b607c3f4ba889ae806be9beb73 upstream. The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed runtime->dma_area might be freed concurrently, as it's performed outside the PCM ops. For avoiding it, move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed during the operation. Reported-by: syzbot+32d4647f551007595173(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- include/sound/pcm.h | 2 ++ sound/core/oss/pcm_oss.c | 3 +-- sound/core/pcm_native.c | 11 +++++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/include/sound/pcm.h b/include/sound/pcm.h index 2a815373dac1..ed4449cbdf80 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -1427,6 +1427,8 @@ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_s #define snd_pcm_lib_mmap_iomem NULL #endif +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime); + /** * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer * @dma: DMA number diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 728c211142d1..471de2d1b37a 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1085,8 +1085,7 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) runtime->oss.params = 0; runtime->oss.prepare = 1; runtime->oss.buffer_used = 0; - if (runtime->dma_area) - snd_pcm_format_set_silence(runtime->format, runtime->dma_area, bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_runtime_buffer_set_silence(runtime); runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size); diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index e40de64ec85c..31fc20350fd9 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -703,6 +703,17 @@ static void snd_pcm_buffer_access_unlock(struct snd_pcm_runtime *runtime) atomic_inc(&runtime->buffer_accessing); } +/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime) +{ + snd_pcm_buffer_access_lock(runtime); + if (runtime->dma_area) + snd_pcm_format_set_silence(runtime->format, runtime->dma_area, + bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_buffer_access_unlock(runtime); +} +EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence); + #if IS_ENABLED(CONFIG_SND_PCM_OSS) #define is_oss_stream(substream) ((substream)->oss.oss) #else -- 2.34.1

1 0

[PATCH OLK-5.10] ALSA: pcm: Fix race of buffer access at PCM OSS layer
by Luo Gengkun 24 Jun '25

24 Jun '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.238 commit 8170d8ec4efd0be352c14cb61f374e30fb0c2a25 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGACK CVE: CVE-2025-38078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 93a81ca0657758b607c3f4ba889ae806be9beb73 upstream. The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed runtime->dma_area might be freed concurrently, as it's performed outside the PCM ops. For avoiding it, move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed during the operation. Reported-by: syzbot+32d4647f551007595173(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- include/sound/pcm.h | 2 ++ sound/core/oss/pcm_oss.c | 3 +-- sound/core/pcm_native.c | 11 +++++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/include/sound/pcm.h b/include/sound/pcm.h index 6554a9f71c62..c573c6a7da12 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -1334,6 +1334,8 @@ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_s #define snd_pcm_lib_mmap_iomem NULL #endif +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime); + /** * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer * @dma: DMA number diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index de6f94bee50b..8eb5fef41dbe 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1078,8 +1078,7 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) runtime->oss.params = 0; runtime->oss.prepare = 1; runtime->oss.buffer_used = 0; - if (runtime->dma_area) - snd_pcm_format_set_silence(runtime->format, runtime->dma_area, bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_runtime_buffer_set_silence(runtime); runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size); diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index 9425fcd30c4c..98bd6fe850d3 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -685,6 +685,17 @@ static void snd_pcm_buffer_access_unlock(struct snd_pcm_runtime *runtime) atomic_inc(&runtime->buffer_accessing); } +/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ +void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime) +{ + snd_pcm_buffer_access_lock(runtime); + if (runtime->dma_area) + snd_pcm_format_set_silence(runtime->format, runtime->dma_area, + bytes_to_samples(runtime, runtime->dma_bytes)); + snd_pcm_buffer_access_unlock(runtime); +} +EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence); + #if IS_ENABLED(CONFIG_SND_PCM_OSS) #define is_oss_stream(substream) ((substream)->oss.oss) #else -- 2.34.1

2 1