- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] mm/ksm: fix possible UAF of stable_node
by Kaixiong Yu 14 Sep '24

14 Sep '24

From: Chengming Zhou <chengming.zhou(a)linux.dev> mainline inclusion from mainline-v6.10-rc1 commit 90e823498881fb8a91d83e9a8eed87c8c3ff2176 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARCIF CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The commit 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") introduced a possible failure case in the stable_tree_insert(), where we may free the new allocated stable_node_dup if we fail to prepare the missing chain node. Then that kfolio return and unlock with a freed stable_node set... And any MM activities can come in to access kfolio->mapping, so UAF. Fix it by moving folio_set_stable_node() to the end after stable_node is inserted successfully. Link: https://lkml.kernel.org/r/20240513-b4-ksm-stable-node-uaf-v1-1-f687de76f452… Fixes: 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") Signed-off-by: Chengming Zhou <chengming.zhou(a)linux.dev> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Stefan Roesch <shr(a)devkernel.io> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/ksm.c [OLK-5.10 merged commit 6584e73a2ca62cf3b0bed42204f79f082801c3f7 ("[Huawei] mm: transplant ksm hugepage feature for kernel 5.10")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/ksm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/ksm.c b/mm/ksm.c index 21bb3e7cf3bc..b2cdbe6caa71 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -1922,7 +1922,6 @@ static struct stable_node *stable_tree_insert(struct page *kpage) INIT_HLIST_HEAD(&stable_node_dup->hlist); stable_node_dup->kpfn = kpfn; - set_page_stable_node(kpage, stable_node_dup); stable_node_dup->rmap_hlist_len = 0; DO_NUMA(stable_node_dup->nid = nid); if (!need_chain) { @@ -1941,6 +1940,8 @@ static struct stable_node *stable_tree_insert(struct page *kpage) stable_node_chain_add_dup(stable_node_dup, stable_node); } + set_page_stable_node(kpage, stable_node_dup); + return stable_node_dup; } -- 2.34.1

2 1

[openeuler:OLK-6.6 1834/13938] mm/page_cache_limit.c:35:5: sparse: sparse: symbol 'cache_reclaim_enable_handler' was not declared. Should it be static?
by kernel test robot 14 Sep '24

14 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 292de9750592324fa903dc314670538f50b4c19a commit: 621647ce254f1d347ae9bc3d328c09cbb2732487 [1834/13938] mm: support periodical memory reclaim config: loongarch-randconfig-r133-20240913 (https://download.01.org/0day-ci/archive/20240914/202409141142.ffRDmgO2-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240914/202409141142.ffRDmgO2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409141142.ffRDmgO2-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/page_cache_limit.c:35:5: sparse: sparse: symbol 'cache_reclaim_enable_handler' was not declared. Should it be static? >> mm/page_cache_limit.c:51:5: sparse: sparse: symbol 'cache_reclaim_sysctl_handler' was not declared. Should it be static? vim +/cache_reclaim_enable_handler +35 mm/page_cache_limit.c 34 > 35 int cache_reclaim_enable_handler(struct ctl_table *table, int write, 36 void *buffer, size_t *length, loff_t *ppos) 37 { 38 int ret; 39 40 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 41 if (ret || !write) 42 return ret; 43 44 if (should_periodical_reclaim()) 45 schedule_delayed_work(&shepherd, round_jiffies_relative( 46 (unsigned long)vm_cache_reclaim_s * HZ)); 47 48 return 0; 49 } 50 > 51 int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, 52 void *buffer, size_t *length, loff_t *ppos) 53 { 54 int ret; 55 56 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 57 if (ret || !write) 58 return ret; 59 60 if (should_periodical_reclaim()) 61 mod_delayed_work(system_unbound_wq, &shepherd, 62 round_jiffies_relative( 63 (unsigned long)vm_cache_reclaim_s * HZ)); 64 65 return ret; 66 } 67 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
by Peng Zhang 14 Sep '24

14 Sep '24

From: Mathias Nyman <mathias.nyman(a)linux.intel.com> stable inclusion from stable-v4.19.321 commit ef0a0e616b2789bb804a0ce5e161db03170a85b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZE CVE: CVE-2024-45006 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit af8e119f52e9c13e556be9e03f27957554a84656 upstream. re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference. Full-speed devices may need to reconfigure the endpoint 0 Max Packet Size value during enumeration. Usb core calls usb_ep0_reinit() in this case, which ends up calling xhci_configure_endpoint(). On Panther point xHC the xhci_configure_endpoint() function will additionally check and reserve bandwidth in software. Other hosts do this in hardware If xHC address device command fails then a new xhci_virt_device structure is allocated as part of re-enabling the slot, but the bandwidth table pointers are not set up properly here. This triggers the NULL pointer dereference the next time usb_ep0_reinit() is called and xhci_configure_endpoint() tries to check and reserve bandwidth [46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd [46710.713699] usb 3-1: Device not responding to setup address. [46710.917684] usb 3-1: Device not responding to setup address. [46711.125536] usb 3-1: device not accepting address 5, error -71 [46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008 [46711.125600] #PF: supervisor read access in kernel mode [46711.125603] #PF: error_code(0x0000) - not-present page [46711.125606] PGD 0 P4D 0 [46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI [46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1 [46711.125620] Hardware name: Gigabyte Technology Co., Ltd. [46711.125623] Workqueue: usb_hub_wq hub_event [usbcore] [46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c Fix this by making sure bandwidth table pointers are set up correctly after a failed address device command, and additionally by avoiding checking for bandwidth in cases like this where no actual endpoints are added or removed, i.e. only context for default control endpoint 0 is evaluated. Reported-by: Karel Balej <balejk(a)matfyz.cz> Closes: https://lore.kernel.org/linux-usb/D3CKQQAETH47.1MUO22RTCH2O3@matfyz.cz/ Cc: stable(a)vger.kernel.org Fixes: 651aaf36a7d7 ("usb: xhci: Handle USB transaction error on address command") Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://lore.kernel.org/r/20240815141117.2702314-2-mathias.nyman@linux.inte… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/usb/host/xhci.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 1cb66cbe6487..22e47392f16c 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -2748,7 +2748,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci, xhci->num_active_eps); return -ENOMEM; } - if ((xhci->quirks & XHCI_SW_BW_CHECKING) && + if ((xhci->quirks & XHCI_SW_BW_CHECKING) && !ctx_change && xhci_reserve_bandwidth(xhci, virt_dev, command->in_ctx)) { if ((xhci->quirks & XHCI_EP_LIMIT_QUIRK)) xhci_free_host_resources(xhci, ctrl_ctx); @@ -4094,8 +4094,10 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, mutex_unlock(&xhci->mutex); ret = xhci_disable_slot(xhci, udev->slot_id); xhci_free_virt_device(xhci, udev->slot_id); - if (!ret) - xhci_alloc_dev(hcd, udev); + if (!ret) { + if (xhci_alloc_dev(hcd, udev) == 1) + xhci_setup_addressable_virt_dev(xhci, udev); + } kfree(command->completion); kfree(command); return -EPROTO; -- 2.25.1

2 1

[openeuler:OLK-5.10 2820/30000] drivers/tty/tty_buffer.c:175:2: error: implicit declaration of function 'printk_safe_enter'
by kernel test robot 14 Sep '24

14 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 5a1d9701155c6908c76c68951170f10279685143 commit: 923efc4dc37c1a7cc91f0dd5dbdc87e0943ad1ae [2820/30000] tty: fix possible deadlock in console_unlock config: x86_64-buildonly-randconfig-003-20240914 (https://download.01.org/0day-ci/archive/20240914/202409141036.Dno2bUGL-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240914/202409141036.Dno2bUGL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409141036.Dno2bUGL-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/tty/tty_buffer.c:175:2: error: implicit declaration of function 'printk_safe_enter' [-Werror,-Wimplicit-function-declaration] 175 | printk_safe_enter(); | ^ drivers/tty/tty_buffer.c:175:2: note: did you mean 'printk_nmi_enter'? include/linux/printk.h:158:20: note: 'printk_nmi_enter' declared here 158 | static inline void printk_nmi_enter(void) { } | ^ >> drivers/tty/tty_buffer.c:177:2: error: implicit declaration of function 'printk_safe_exit' [-Werror,-Wimplicit-function-declaration] 177 | printk_safe_exit(); | ^ 2 errors generated. vim +/printk_safe_enter +175 drivers/tty/tty_buffer.c 142 143 /** 144 * tty_buffer_alloc - allocate a tty buffer 145 * @port: tty port 146 * @size: desired size (characters) 147 * 148 * Allocate a new tty buffer to hold the desired number of characters. 149 * We round our buffers off in 256 character chunks to get better 150 * allocation behaviour. 151 * Return NULL if out of memory or the allocation would exceed the 152 * per device queue 153 */ 154 155 static struct tty_buffer *tty_buffer_alloc(struct tty_port *port, size_t size) 156 { 157 struct llist_node *free; 158 struct tty_buffer *p; 159 160 /* Round the buffer size out */ 161 size = __ALIGN_MASK(size, TTYB_ALIGN_MASK); 162 163 if (size <= MIN_TTYB_SIZE) { 164 free = llist_del_first(&port->buf.free); 165 if (free) { 166 p = llist_entry(free, struct tty_buffer, free); 167 goto found; 168 } 169 } 170 171 /* Should possibly check if this fails for the largest buffer we 172 have queued and recycle that ? */ 173 if (atomic_read(&port->buf.mem_used) > port->buf.mem_limit) 174 return NULL; > 175 printk_safe_enter(); 176 p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC); > 177 printk_safe_exit(); 178 if (p == NULL) 179 return NULL; 180 181 found: 182 tty_buffer_reset(p, size); 183 atomic_add(size, &port->buf.mem_used); 184 return p; 185 } 186 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] bpf: Fix a kernel verifier crash in stacksafe()
by Pu Lehui 14 Sep '24

14 Sep '24

From: Yonghong Song <yonghong.song(a)linux.dev> stable inclusion from stable-v6.6.48 commit 7cad3174cc79519bf5f6c4441780264416822c08 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJD CVE: CVE-2024-45020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bed2eb964c70b780fb55925892a74f26cb590b25 upstream. Daniel Hodges reported a kernel verifier crash when playing with sched-ext. Further investigation shows that the crash is due to invalid memory access in stacksafe(). More specifically, it is the following code: if (exact != NOT_EXACT && old->stack[spi].slot_type[i % BPF_REG_SIZE] != cur->stack[spi].slot_type[i % BPF_REG_SIZE]) return false; The 'i' iterates old->allocated_stack. If cur->allocated_stack < old->allocated_stack the out-of-bound access will happen. To fix the issue add 'i >= cur->allocated_stack' check such that if the condition is true, stacksafe() should fail. Otherwise, cur->stack[spi].slot_type[i % BPF_REG_SIZE] memory access is legal. Fixes: 2793a8b015f7 ("bpf: exact states comparison for iterator convergence checks") Cc: Eduard Zingerman <eddyz87(a)gmail.com> Reported-by: Daniel Hodges <hodgesd(a)meta.com> Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20240812214847.213612-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> [ shung-hsi.yu: "exact" variable is bool instead enum because commit 4f81c16f50ba ("bpf: Recognize that two registers are safe when their ranges match") is not present. ] Signed-off-by: Shung-Hsi Yu <shung-hsi.yu(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index e02ed203e90b..6a94f341587a 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -16128,8 +16128,9 @@ static bool stacksafe(struct bpf_verifier_env *env, struct bpf_func_state *old, spi = i / BPF_REG_SIZE; if (exact && - old->stack[spi].slot_type[i % BPF_REG_SIZE] != - cur->stack[spi].slot_type[i % BPF_REG_SIZE]) + (i >= cur->allocated_stack || + old->stack[spi].slot_type[i % BPF_REG_SIZE] != + cur->stack[spi].slot_type[i % BPF_REG_SIZE])) return false; if (!(old->stack[spi].spilled_ptr.live & REG_LIVE_READ) && !exact) { -- 2.34.1

2 1

[openeuler:OLK-5.10 29981/30000] drivers/misc/sdma-dae/sdma_dbg.c:84:13: warning: variable 'exclusive_chn_num' set but not used
by kernel test robot 14 Sep '24

14 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 5a1d9701155c6908c76c68951170f10279685143 commit: bacc47789eb5be49559f82859f5e4f0f25122af6 [29981/30000] driver:misc:sdma-dae: add debugfs of sdma-dae config: arm64-randconfig-002-20240914 (https://download.01.org/0day-ci/archive/20240914/202409140941.IxieoOe3-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240914/202409140941.IxieoOe3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409140941.IxieoOe3-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/misc/sdma-dae/sdma_dbg.c:6: drivers/misc/sdma-dae/sdma_hal.h: In function 'sdma_channel_clear_ioe_status': drivers/misc/sdma-dae/sdma_hal.h:227:32: warning: variable 'reg_val' set but not used [-Wunused-but-set-variable] 227 | union sdmam_irq_status reg_val = {0}; | ^~~~~~~ drivers/misc/sdma-dae/sdma_dbg.c: In function 'sdma_debugfs_stats_show': >> drivers/misc/sdma-dae/sdma_dbg.c:84:13: warning: variable 'exclusive_chn_num' set but not used [-Wunused-but-set-variable] 84 | u32 exclusive_chn_num; | ^~~~~~~~~~~~~~~~~ vim +/exclusive_chn_num +84 drivers/misc/sdma-dae/sdma_dbg.c 75 76 static int sdma_debugfs_stats_show(struct seq_file *f, void *data SDMA_UNUSED) 77 { 78 u32 num = dbg_g_info.core_dev->sdma_device_num; 79 struct hisi_sdma_chn_num chn_num; 80 struct hisi_sdma_channel *pchan; 81 struct hisi_sdma_device *dev; 82 u32 exclusive_chn_used_nr; 83 u32 share_chn_used_nr; > 84 u32 exclusive_chn_num; 85 u32 chn_idx; 86 u32 i; 87 88 split_line(f); 89 seq_printf(f, "SDMA Devices Num = %u\n", num); 90 if (num == 0) 91 return 0; 92 93 for (i = 0; i < num; i++) { 94 spin_lock(&dbg_g_info.core_dev->device_lock); 95 dev = dbg_g_info.core_dev->sdma_devices[i]; 96 if (!dev) { 97 seq_puts(f, "sdma_devices already released!\n"); 98 spin_unlock(&dbg_g_info.core_dev->device_lock); 99 return -ENXIO; 100 } 101 chn_num = sdma_chn_info(f, dev); 102 exclusive_chn_num = chn_num.total_chn_num - chn_num.share_chn_num; 103 exclusive_chn_used_nr = dev->nr_channel_used; 104 seq_printf(f, "Used exclusive chn total num = %u\n", exclusive_chn_used_nr); 105 seq_puts(f, "\n"); 106 split_line(f); 107 share_chn_used_nr = 0; 108 chn_idx = 0; 109 seq_printf(f, "SDMA[%u] Used share chn id:\n", i); 110 while (chn_idx < chn_num.share_chn_num) { 111 pchan = dev->channels + chn_idx; 112 if (pchan->cnt_used != 0) { 113 share_chn_used_nr++; 114 seq_printf(f, "%u\t", chn_idx); 115 } 116 ++chn_idx; 117 } 118 seq_printf(f, "\nSDMA[%u] Used share chn total num = %u\n", i, share_chn_used_nr); 119 split_line(f); 120 sdma_scan_channel_status(f, dev, chn_num.share_chn_num); 121 spin_unlock(&dbg_g_info.core_dev->device_lock); 122 } 123 124 return 0; 125 } 126 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v2 0/4] Fix CVE-2024-45025
by Long Li 14 Sep '24

14 Sep '24

This patch set fix Fix-2024-45025 Al Viro (1): fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE Alexander Lobakin (3): fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64() bitmap: introduce generic optimized bitmap_size() s390/cio: rename bitmap_size() -> idset_bitmap_size() drivers/md/dm-clone-metadata.c | 5 --- drivers/s390/cio/idset.c | 12 ++++--- fs/file.c | 30 +++++++--------- fs/ntfs3/bitmap.c | 4 +-- fs/ntfs3/fsntfs.c | 2 +- fs/ntfs3/index.c | 11 +++--- fs/ntfs3/ntfs_fs.h | 4 +-- fs/ntfs3/super.c | 2 +- include/linux/bitmap.h | 20 +++++++++-- include/linux/cpumask.h | 2 +- lib/math/prime_numbers.c | 2 -- tools/include/linux/bitmap.h | 7 ++-- .../testing/selftests/core/close_range_test.c | 35 +++++++++++++++++++ 13 files changed, 89 insertions(+), 47 deletions(-) -- 2.39.2

2 5

[PATCH OLK-5.10] mm: fix failure to unmap pte on highmem systems
by Wupeng Ma 14 Sep '24

14 Sep '24

From: Ryan Roberts <ryan.roberts(a)arm.com> mainline inclusion from mainline-v6.5-rc1 commit 3b65f437d9e8dd696a2b88e7afcd51385532ab35 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQT9Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The loser of a race to service a pte for a device private entry in the swap path previously unlocked the ptl, but failed to unmap the pte. This only affects highmem systems since unmapping a pte is a noop on non-highmem systems. Link: https://lkml.kernel.org/r/20230602092949.545577-5-ryan.roberts@arm.com Fixes: 16ce101db85d ("mm/memory.c: fix race when faulting a device private page") Signed-off-by: Ryan Roberts <ryan.roberts(a)arm.com> Reviewed-by: Zi Yan <ziy(a)nvidia.com> Reviewed-by: Mike Rapoport (IBM) <rppt(a)kernel.org> Cc: Christoph Hellwig <hch(a)lst.de> Cc: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Cc: Lorenzo Stoakes <lstoakes(a)gmail.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: SeongJae Park <sj(a)kernel.org> Cc: Uladzislau Rezki (Sony) <urezki(a)gmail.com> Cc: Yu Zhao <yuzhao(a)google.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- mm/memory.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/mm/memory.c b/mm/memory.c index 0c4da925e8ad..af9cb48630bd 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -3424,10 +3424,8 @@ vm_fault_t do_swap_page(struct vm_fault *vmf) vmf->page = device_private_entry_to_page(entry); vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, vmf->address, &vmf->ptl); - if (unlikely(!pte_same(*vmf->pte, vmf->orig_pte))) { - spin_unlock(vmf->ptl); - goto out; - } + if (unlikely(!pte_same(*vmf->pte, vmf->orig_pte))) + goto unlock; /* * Get a page reference while we know the page can't be -- 2.25.1

2 1

[PATCH OLK-5.10] mm/hugetlb: fix pgtable lock on pmd sharing
by Wupeng Ma 14 Sep '24

14 Sep '24

From: Peter Xu <peterx(a)redhat.com> mainline inclusion from mainline-v6.5-rc1 commit 349d1670008d3dab99a11b015bef51ad3f26fb4f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQT9Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Huge pmd sharing operates on PUD not PMD, huge_pte_lock() is not suitable in this case because it should only work for last level pte changes, while pmd sharing is always one level higher. Meanwhile, here we're locking over the spte pgtable lock which is even not a lock for current mm but someone else's. It seems even racy on operating on the lock, as after put_page() of the spte pgtable page logically the page can be released, so at least the spin_unlock() needs to be done after the put_page(). No report I am aware, I'm not even sure whether it'll just work on taking the spte pmd lock, because while we're holding i_mmap read lock it probably means the vma interval tree is frozen, all pte allocators over this pud entry could always find the specific svma and spte page, so maybe they'll serialize on this spte page lock? Even so, doesn't seem to be expected. It just seems to be an accident of cb900f412154. Fix it with the proper pud lock (which is the mm's page_table_lock). Link: https://lkml.kernel.org/r/20230612160420.809818-1-peterx@redhat.com Fixes: cb900f412154 ("mm, hugetlb: convert hugetlbfs to use split pmd lock") Signed-off-by: Peter Xu <peterx(a)redhat.com> Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com> Cc: Naoya Horiguchi <naoya.horiguchi(a)nec.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- mm/hugetlb.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index e3746bcfc827..54e2eefdf0b4 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5907,7 +5907,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) unsigned long saddr; pte_t *spte = NULL; pte_t *pte; - spinlock_t *ptl; if (!vma_shareable(vma, addr)) return (pte_t *)pmd_alloc(mm, pud, addr); @@ -5931,7 +5930,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) if (!spte) goto out; - ptl = huge_pte_lock(hstate_vma(vma), mm, spte); + spin_lock(&mm->page_table_lock); if (pud_none(*pud)) { pud_populate(mm, pud, (pmd_t *)((unsigned long)spte & PAGE_MASK)); @@ -5939,7 +5938,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) } else { put_page(virt_to_page(spte)); } - spin_unlock(ptl); + spin_unlock(&mm->page_table_lock); out: pte = (pte_t *)pmd_alloc(mm, pud, addr); return pte; -- 2.25.1

2 1

[PATCH OLK-6.6] mm/memory_hotplug: prevent accessing by index=-1
by Wupeng Ma 14 Sep '24

14 Sep '24

From: Anastasia Belova <abelova(a)astralinux.ru> mainline inclusion from mainline-v6.11-rc1 commit 5958d35917e1296f46dfc8b8c959732efd6d8d5d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQT9Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nid may be equal to NUMA_NO_NODE=-1. Prevent accessing node_data array by invalid index with check for nid. Found by Linux Verification Center (linuxtesting.org) with SVACE. Link: https://lkml.kernel.org/r/20240606080659.18525-1-abelova@astralinux.ru Fixes: e83a437faa62 ("mm/memory_hotplug: introduce "auto-movable" online policy") Signed-off-by: Anastasia Belova <abelova(a)astralinux.ru> Acked-by: David Hildenbrand <david(a)redhat.com> Acked-by: Oscar Salvador <osalvador(a)suse.de> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- mm/memory_hotplug.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c index b6097e80d2b6..65218eb648d6 100644 --- a/mm/memory_hotplug.c +++ b/mm/memory_hotplug.c @@ -845,7 +845,6 @@ static bool auto_movable_can_online_movable(int nid, struct memory_group *group, unsigned long kernel_early_pages, movable_pages; struct auto_movable_group_stats group_stats = {}; struct auto_movable_stats stats = {}; - pg_data_t *pgdat = NODE_DATA(nid); struct zone *zone; int i; @@ -856,6 +855,8 @@ static bool auto_movable_can_online_movable(int nid, struct memory_group *group, auto_movable_stats_account_zone(&stats, zone); } else { for (i = 0; i < MAX_NR_ZONES; i++) { + pg_data_t *pgdat = NODE_DATA(nid); + zone = pgdat->node_zones + i; if (populated_zone(zone)) auto_movable_stats_account_zone(&stats, zone); -- 2.25.1

2 1