- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] um: virtio_uml: Fix use-after-free after put_device in probe
by Zhang Yuwei 11 Nov '25

11 Nov '25

From: Miaoqian Lin <linmq006(a)gmail.com> mainline inclusion from mainline-v6.17-rc7 commit 7ebf70cf181651fe3f2e44e95e7e5073d594c9c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0U90 CVE: CVE-2025-39951 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When register_virtio_device() fails in virtio_uml_probe(), the code sets vu_dev->registered = 1 even though the device was not successfully registered. This can lead to use-after-free or other issues. Fixes: 04e5b1fb0183 ("um: virtio: Remove device on disconnect") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- arch/um/drivers/virtio_uml.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/um/drivers/virtio_uml.c b/arch/um/drivers/virtio_uml.c index 8adca2000e51..d790acfc2c67 100644 --- a/arch/um/drivers/virtio_uml.c +++ b/arch/um/drivers/virtio_uml.c @@ -1229,10 +1229,12 @@ static int virtio_uml_probe(struct platform_device *pdev) device_set_wakeup_capable(&vu_dev->vdev.dev, true); rc = register_virtio_device(&vu_dev->vdev); - if (rc) + if (rc) { put_device(&vu_dev->vdev.dev); + return rc; + } vu_dev->registered = 1; - return rc; + return 0; error_init: os_close_file(vu_dev->sock); -- 2.22.0

2 1

[PATCH OLK-6.6] KVM: x86: use array_index_nospec with indices that come from guest
by Zhang Yuwei 11 Nov '25

11 Nov '25

From: Thijs Raymakers <thijs(a)raymakers.nl> stable inclusion from stable-v6.6.104 commit f49161646e03d107ce81a99c6ca5da682fe5fb69 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICXO12 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c87bd4dd43a624109c3cc42d843138378a7f4548 upstream. min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels. Signed-off-by: Thijs Raymakers <thijs(a)raymakers.nl> Cc: stable(a)vger.kernel.org Cc: Sean Christopherson <seanjc(a)google.com> Cc: Paolo Bonzini <pbonzini(a)redhat.com> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Fixes: 715062970f37 ("KVM: X86: Implement PV sched yield hypercall") Fixes: bdf7ffc89922 ("KVM: LAPIC: Fix pv ipis out-of-bounds access") Fixes: 4180bf1b655a ("KVM: X86: Implement "send IPI" hypercall") Link: https://lore.kernel.org/r/20250804064405.4802-1-thijs@raymakers.nl Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- arch/x86/kvm/lapic.c | 2 ++ arch/x86/kvm/x86.c | 7 +++++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index 66c7f2367bb3..c67610ae5e0b 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -836,6 +836,8 @@ static int __pv_send_ipi(unsigned long *ipi_bitmap, struct kvm_apic_map *map, if (min > map->max_apic_id) return 0; + min = array_index_nospec(min, map->max_apic_id + 1); + for_each_set_bit(i, ipi_bitmap, min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) { if (map->phys_map[min + i]) { diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 7a98760a4c03..de851f3dff7b 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -9961,8 +9961,11 @@ static void kvm_sched_yield(struct kvm_vcpu *vcpu, unsigned long dest_id) rcu_read_lock(); map = rcu_dereference(vcpu->kvm->arch.apic_map); - if (likely(map) && dest_id <= map->max_apic_id && map->phys_map[dest_id]) - target = map->phys_map[dest_id]->vcpu; + if (likely(map) && dest_id <= map->max_apic_id) { + dest_id = array_index_nospec(dest_id, map->max_apic_id + 1); + if (map->phys_map[dest_id]) + target = map->phys_map[dest_id]->vcpu; + } rcu_read_unlock(); -- 2.22.0

2 1

[PATCH OLK-6.6] software node: Correct a OOB check in software_node_get_reference_args()
by Zhang Yuwei 11 Nov '25

11 Nov '25

From: Zijun Hu <quic_zijuhu(a)quicinc.com> stable inclusion from stable-v6.6.95 commit f9397cf7bfb680799fb8c7f717c8f756384c3280 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICOE0M Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 31e4e12e0e9609850cefd4b2e1adf782f56337d6 ] software_node_get_reference_args() wants to get @index-th element, so the property value requires at least '(index + 1) * sizeof(*ref)' bytes but that can not be guaranteed by current OOB check, and may cause OOB for malformed property. Fix by using as OOB check '((index + 1) * sizeof(*ref) > prop->length)'. Reviewed-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> Link: https://lore.kernel.org/r/20250414-fix_swnode-v2-1-9c9e6ae11eab@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/base/swnode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c index 079bd14bdedc..a7a3e3b66bb5 100644 --- a/drivers/base/swnode.c +++ b/drivers/base/swnode.c @@ -518,7 +518,7 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode, if (prop->is_inline) return -EINVAL; - if (index * sizeof(*ref) >= prop->length) + if ((index + 1) * sizeof(*ref) > prop->length) return -ENOENT; ref_array = prop->pointer; -- 2.22.0

2 1

[PATCH OLK-6.6 v2 00/14] Add MFS Support
by Huang Xiaojia 11 Nov '25

11 Nov '25

MFS is a stackable file system that utilizes a lower and a cache layer. It provides users with programmable caching capabilities. MFS only supports read-only operations for regular files, directories and symbolic links. When MFS is stacked on top of the lower and cache layers (which are themselves mounted on other file systems, such as ext4 or xfs), the underlying file systems must be also kept read-only to prevent the data inconsistency. MFS supports three running mode: none, local and remote. These modes are explained in running mode section. In short, MFS requires the `mtree` and `cachedir` mount options. The `mtree` option specifies the metadata source for MFS, while the `cachedir` option specifies the data source. In local or remote mode, `cachedir` points to a local cache (in memory or on disk) for backend file systems. v2: squash several patches together Hongbo Li (12): mfs: Initialize mfs module mfs: implement the mount procedure mfs: Add basic metadata operation for MFS mfs: Add basic data operation for MFS mfs: Add basic cache framework: check method and control structure mfs: Add basic events framework mfs: Add communication devie and event acquisition operations mfs: Add user command for handling events mfs: Add tracepoint for MFS mfs: Add MFS documentation MAINTAINERS: Add maintainer for mfs mfs: enable MFS Huang Xiaojia (2): mfs: Optimize mfs syncer process and metadata ops mfs: tool: Add mfs user space tool demo Documentation/filesystems/index.rst | 1 + Documentation/filesystems/mfs.rst | 223 +++++++++++ MAINTAINERS | 10 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/Kconfig | 1 + fs/Makefile | 1 + fs/mfs/Kconfig | 12 + fs/mfs/Makefile | 4 + fs/mfs/cache.c | 507 ++++++++++++++++++++++++ fs/mfs/data.c | 523 +++++++++++++++++++++++++ fs/mfs/dev.c | 242 ++++++++++++ fs/mfs/inode.c | 303 ++++++++++++++ fs/mfs/internal.h | 232 +++++++++++ fs/mfs/super.c | 499 +++++++++++++++++++++++ include/trace/events/mfs.h | 105 +++++ include/uapi/linux/magic.h | 1 + include/uapi/linux/mfs.h | 62 +++ tools/mfs/.gitignore | 2 + tools/mfs/Makefile | 13 + tools/mfs/mfsd.c | 186 +++++++++ 21 files changed, 2929 insertions(+) create mode 100644 Documentation/filesystems/mfs.rst create mode 100644 fs/mfs/Kconfig create mode 100644 fs/mfs/Makefile create mode 100644 fs/mfs/cache.c create mode 100644 fs/mfs/data.c create mode 100644 fs/mfs/dev.c create mode 100644 fs/mfs/inode.c create mode 100644 fs/mfs/internal.h create mode 100644 fs/mfs/super.c create mode 100644 include/trace/events/mfs.h create mode 100644 include/uapi/linux/mfs.h create mode 100644 tools/mfs/.gitignore create mode 100644 tools/mfs/Makefile create mode 100644 tools/mfs/mfsd.c -- 2.25.1

2 15

[PATCH OLK-6.6] scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
by Zhang Yuwei 11 Nov '25

11 Nov '25

From: Chenyuan Yang <chenyuan0y(a)gmail.com> stable inclusion from stable-v6.6.89 commit d6979fabe812a168d5053e5a41d5a2e9b8afd7bf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC8J7I Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4c324085062919d4e21c69e5e78456dcec0052fe ] A race can occur between the MCQ completion path and the abort handler: once a request completes, __blk_mq_free_request() sets rq->mq_hctx to NULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in ufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is dereferenced, the kernel will crash. Add a NULL check for the returned hwq pointer. If hwq is NULL, log an error and return FAILED, preventing a potential NULL-pointer dereference. As suggested by Bart, the ufshcd_cmd_inflight() check is removed. This is similar to the fix in commit 74736103fb41 ("scsi: ufs: core: Fix ufshcd_abort_one racing issue"). This is found by our static analysis tool KNighter. Signed-off-by: Chenyuan Yang <chenyuan0y(a)gmail.com> Link: https://lore.kernel.org/r/20250410001320.2219341-1-chenyuan0y@gmail.com Fixes: f1304d442077 ("scsi: ufs: mcq: Added ufshcd_mcq_abort()") Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Reviewed-by: Peter Wang <peter.wang(a)mediatek.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/ufs/core/ufs-mcq.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c index da8c1734d333..411109a5ebbf 100644 --- a/drivers/ufs/core/ufs-mcq.c +++ b/drivers/ufs/core/ufs-mcq.c @@ -632,13 +632,6 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd) unsigned long flags; int err; - if (!ufshcd_cmd_inflight(lrbp->cmd)) { - dev_err(hba->dev, - "%s: skip abort. cmd at tag %d already completed.\n", - __func__, tag); - return FAILED; - } - /* Skip task abort in case previous aborts failed and report failure */ if (lrbp->req_abort_skip) { dev_err(hba->dev, "%s: skip abort. tag %d failed earlier\n", @@ -647,6 +640,11 @@ int ufshcd_mcq_abort(struct scsi_cmnd *cmd) } hwq = ufshcd_mcq_req_to_hwq(hba, scsi_cmd_to_rq(cmd)); + if (!hwq) { + dev_err(hba->dev, "%s: skip abort. cmd at tag %d already completed.\n", + __func__, tag); + return FAILED; + } if (ufshcd_mcq_sqe_search(hba, hwq, tag)) { /* -- 2.22.0

2 1

[openeuler:OLK-6.6 3129/3129] drivers/ub/ubfi/irq.c:18:20: error: no member named 'domain' in 'struct dev_msi_info'
by kernel test robot 11 Nov '25

11 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: be4908c3dd5d15795275b738fbadd71ff8f0fbaa commit: 028a4161a77d2e15d331a13599a6f06cdd7490b6 [3129/3129] ub:ubfi: register ubc usi domain config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20251111/202511111409.5wQwlEc6-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251111/202511111409.5wQwlEc6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511111409.5wQwlEc6-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/ub/ubfi/irq.c:18:20: error: no member named 'domain' in 'struct dev_msi_info' 18 | domain = dev->msi.domain; | ~~~~~~~~ ^ 1 error generated. vim +18 drivers/ub/ubfi/irq.c 11 12 int ub_update_msi_domain(struct device *dev, 13 enum irq_domain_bus_token bus_token) 14 { 15 struct fwnode_handle *fwnode; 16 struct irq_domain *domain; 17 > 18 domain = dev->msi.domain; 19 if (!domain) { 20 dev_err(dev, "find base irq domain failed!\n"); 21 return -ENODEV; 22 } 23 24 fwnode = domain->fwnode; 25 if (!fwnode) { 26 dev_err(dev, "find fwnode failed!\n"); 27 return -ENODEV; 28 } 29 30 domain = irq_find_matching_fwnode(fwnode, bus_token); 31 if (!domain) { 32 dev_err(dev, "find irq domain failed!\n"); 33 return -ENODEV; 34 } 35 36 /* Update msi domain with new bus_token */ 37 dev_set_msi_domain(dev, domain); 38 39 return 0; 40 } 41 EXPORT_SYMBOL_GPL(ub_update_msi_domain); 42 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error
by Zhang Yuwei 11 Nov '25

11 Nov '25

From: Kunihiko Hayashi <hayashi.kunihiko(a)socionext.com> stable inclusion from stable-v6.6.88 commit 5a4b7181213268c9b07bef8800905528435db44a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC8J7I Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f6cb7828c8e17520d4f5afb416515d3fae1af9a9 upstream. After devm_request_irq() fails with error in pci_endpoint_test_request_irq(), the pci_endpoint_test_free_irq_vectors() is called assuming that all IRQs have been released. However, some requested IRQs remain unreleased, so there are still /proc/irq/* entries remaining, and this results in WARN() with the following message: remove_proc_entry: removing non-empty directory 'irq/30', leaking at least 'pci-endpoint-test.0' WARNING: CPU: 0 PID: 202 at fs/proc/generic.c:719 remove_proc_entry +0x190/0x19c To solve this issue, set the number of remaining IRQs to test->num_irqs, and release IRQs in advance by calling pci_endpoint_test_release_irq(). Cc: stable(a)vger.kernel.org Fixes: e03327122e2c ("pci_endpoint_test: Add 2 ioctl commands") Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko(a)socionext.com> Link: https://lore.kernel.org/r/20250225110252.28866-3-hayashi.kunihiko@socionext… [kwilczynski: commit log] Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko(a)socionext.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/misc/pci_endpoint_test.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c index af519088732d..cd5af3e55f28 100644 --- a/drivers/misc/pci_endpoint_test.c +++ b/drivers/misc/pci_endpoint_test.c @@ -260,6 +260,9 @@ static bool pci_endpoint_test_request_irq(struct pci_endpoint_test *test) break; } + test->num_irqs = i; + pci_endpoint_test_release_irq(test); + return false; } -- 2.22.0

2 1

[PATCH OLK-6.6 00/14] mm: add huge pfnmap support for remap_pfn_range()
by Yin Tirui 11 Nov '25

11 Nov '25

mm: add huge pfnmap support for remap_pfn_range() Overview ======== This patch series adds huge page support for remap_pfn_range(), automatically creating huge mappings when prerequisites are satisfied (size, alignment, architecture support, etc.) and falling back to normal page mappings otherwise. This work builds on Peter Xu's previous efforts on huge pfnmap support [0]. TODO ==== - Add PUD-level huge page support. Currently, only PMD-level huge pages are supported. - Consider the logic related to vmap_page_range and extract reusable common code. Tests Done ========== - Cross-build tests. - Performance tests with custom device driver implementing mmap() with remap_pfn_range(): - lat_mem_rd benchmark modified to use mmap(device_fd) instead of malloc() shows around 40% improvement in memory access latency with huge page support compared to normal page mappings. numactl -C 0 lat_mem_rd -t 4096M (stride=64) Memory Size (MB) Without Huge Mapping With Huge Mapping Improvement ---------------- ----------------- -------------- ----------- 64.00 148.858 ns 100.780 ns 32.3% 128.00 164.745 ns 103.537 ns 37.2% 256.00 169.907 ns 103.179 ns 39.3% 512.00 171.285 ns 103.072 ns 39.8% 1024.00 173.054 ns 103.055 ns 40.4% 2048.00 172.820 ns 103.091 ns 40.3% 4096.00 172.877 ns 103.115 ns 40.4% - Custom memory copy operations on mmap(device_fd) show around 18% performance improvement with huge page support compared to normal page mappings. numactl -C 0 memcpy_test (memory copy performance test) Memory Size (MB) Without Huge Mapping With Huge Mapping Improvement ---------------- ----------------- -------------- ----------- 1024.00 95.76 ms 77.91 ms 18.6% 2048.00 190.87 ms 155.64 ms 18.5% 4096.00 380.84 ms 311.45 ms 18.2% [0] https://lore.kernel.org/all/20240826204353.2228736-2-peterx@redhat.com/T/#u David Hildenbrand (1): mm/huge_memory: check pmd_special() only after pmd_present() Peter Xu (11): mm: introduce ARCH_SUPPORTS_HUGE_PFNMAP and special bits to pmd/pud mm: drop is_huge_zero_pud() mm: mark special bits for huge pfn mappings when inject mm: allow THP orders for PFNMAPs mm/gup: detect huge pfnmap entries in gup-fast mm/pagewalk: check pfnmap for folio_walk_start() mm/fork: accept huge pfnmap entries mm: always define pxx_pgprot() mm/x86: support large pfn mappings mm/arm64: support large pfn mappings arm64: mm: Drop dead code for pud special bit handling Yin Tirui (2): pgtable: add pte_clrhuge() implementation mm: introduce remap_pfn_range_try_pmd() for PMD-level hugepage mapping arch/arm/include/asm/pgtable-3level.h | 1 + arch/arm64/Kconfig | 1 + arch/arm64/include/asm/pgtable.h | 38 ++++++ arch/loongarch/include/asm/pgtable.h | 6 + arch/mips/include/asm/pgtable.h | 6 + arch/powerpc/include/asm/book3s/32/pgtable.h | 5 + arch/powerpc/include/asm/book3s/64/pgtable.h | 7 +- arch/powerpc/include/asm/nohash/32/pte-8xx.h | 7 ++ arch/powerpc/include/asm/nohash/pgtable.h | 7 ++ arch/powerpc/include/asm/pgtable.h | 1 + arch/riscv/include/asm/pgtable.h | 5 + arch/s390/include/asm/pgtable.h | 6 + arch/sparc/include/asm/pgtable_64.h | 6 + arch/sw_64/include/asm/pgtable.h | 6 + arch/x86/Kconfig | 1 + arch/x86/include/asm/pgtable.h | 80 +++++++----- fs/dax.c | 2 +- include/linux/huge_mm.h | 16 +-- include/linux/mm.h | 26 ++++ include/linux/pgtable.h | 14 ++- mm/Kconfig | 13 ++ mm/gup.c | 6 + mm/huge_memory.c | 93 ++++++++++---- mm/memory.c | 126 +++++++++++++++---- 24 files changed, 383 insertions(+), 96 deletions(-) -- 2.43.0

2 15

[PATCH OLK-6.6] i2c: cros-ec-tunnel: defer probe if parent EC is not present
by Zhang Yuwei 11 Nov '25

11 Nov '25

mainline inclusion from mainline-v6.15-rc3 commit 424eafe65647a8d6c690284536e711977153195a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BNL CVE: CVE-2025-37781 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When i2c-cros-ec-tunnel and the EC driver are built-in, the EC parent device will not be found, leading to NULL pointer dereference. That can also be reproduced by unbinding the controller driver and then loading i2c-cros-ec-tunnel module (or binding the device). Returning -EPROBE_DEFER will allow the device to be bound once the controller is bound, in the case of built-in drivers. Fixes: 9d230c9e4f4e ("i2c: ChromeOS EC tunnel driver") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)igalia.com> Cc: <stable(a)vger.kernel.org> # v3.16+ Signed-off-by: Andi Shyti <andi.shyti(a)kernel.org> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/i2c/busses/i2c-cros-ec-tunnel.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/i2c/busses/i2c-cros-ec-tunnel.c b/drivers/i2c/busses/i2c-cros-ec-tunnel.c index 2737fd8abd32..0cad18ae959e 100644 --- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c +++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c @@ -247,6 +247,9 @@ static int ec_i2c_probe(struct platform_device *pdev) u32 remote_bus; int err; + if (!ec) + return dev_err_probe(dev, -EPROBE_DEFER, "couldn't find parent EC device\n"); + if (!ec->cmd_xfer) { dev_err(dev, "Missing sendrecv\n"); return -EINVAL; -- 2.22.0

2 1

[PATCH OLK-6.6 00/22] Add MFS Support
by Huang Xiaojia 11 Nov '25

11 Nov '25

MFS is a stackable file system that utilizes a lower and a cache layer. It provides users with programmable caching capabilities. MFS only supports read-only operations for regular files, directories and symbolic links. When MFS is stacked on top of the lower and cache layers (which are themselves mounted on other file systems, such as ext4 or xfs), the underlying file systems must be also kept read-only to prevent the data inconsistency. MFS supports three running mode: none, local and remote. These modes are explained in running mode section. In short, MFS requires the `mtree` and `cachedir` mount options. The `mtree` option specifies the metadata source for MFS, while the `cachedir` option specifies the data source. In local or remote mode, `cachedir` points to a local cache (in memory or on disk) for backend file systems. Hongbo Li (19): mfs: Initialize mfs module mfs: implement the mount procedure mfs: Add basic metadata operation for MFS mfs: Add basic data operation for MFS mfs: Add basic cache framework: check method and control structure mfs: Add basic events framework mfs: Add communication devie and event acquisition operations mfs: Add user command for handling events mfs: Add tracepoint for MFS mfs: Add MFS documentation MAINTAINERS: Add maintainer for mfs mfs: enable MFS mfs: Fix the UAF problems on syncer object mfs: Make mfs_filemap_map_pages static mfs: Make mfs_dops, mfs_sops and _acquire_set_path static mfs: Make mfs_lookup, mfs_dir_iops, mfs_symlink_iops and mfs_symlink_iops static mfs: Make sure all delayed rcu inodes are safe to be destroyed mfs: Pending when umount with the device opening mfs: allow resched when too many events need to be destroyed Huang Xiaojia (2): mfs: tool: Add mfs user space tool demo mfs: Use min_t in mfs_read_iter, mfs_filemap_fault and mfs_filemap_map_pages HuangXiaojia (1): mfs: Fix null pointer access in mfs_open or mfs_lookup Documentation/filesystems/index.rst | 1 + Documentation/filesystems/mfs.rst | 223 +++++++++++ MAINTAINERS | 10 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/Kconfig | 1 + fs/Makefile | 1 + fs/mfs/Kconfig | 12 + fs/mfs/Makefile | 4 + fs/mfs/cache.c | 507 ++++++++++++++++++++++++ fs/mfs/data.c | 523 +++++++++++++++++++++++++ fs/mfs/dev.c | 242 ++++++++++++ fs/mfs/inode.c | 303 ++++++++++++++ fs/mfs/internal.h | 232 +++++++++++ fs/mfs/super.c | 499 +++++++++++++++++++++++ include/trace/events/mfs.h | 105 +++++ include/uapi/linux/magic.h | 1 + include/uapi/linux/mfs.h | 62 +++ tools/mfs/.gitignore | 2 + tools/mfs/Makefile | 13 + tools/mfs/mfsd.c | 186 +++++++++ 21 files changed, 2929 insertions(+) create mode 100644 Documentation/filesystems/mfs.rst create mode 100644 fs/mfs/Kconfig create mode 100644 fs/mfs/Makefile create mode 100644 fs/mfs/cache.c create mode 100644 fs/mfs/data.c create mode 100644 fs/mfs/dev.c create mode 100644 fs/mfs/inode.c create mode 100644 fs/mfs/internal.h create mode 100644 fs/mfs/super.c create mode 100644 include/trace/events/mfs.h create mode 100644 include/uapi/linux/mfs.h create mode 100644 tools/mfs/.gitignore create mode 100644 tools/mfs/Makefile create mode 100644 tools/mfs/mfsd.c -- 2.25.1

2 23