- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] smb: client: use i_size_read instead of old i_size
by Yifan Qiao 28 Oct '26

28 Oct '26

hulk inclusion category: other bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20573 -------------------------------- Fix the conflicts of commits bebef902d8e77fadccdbfa89634ab09c93c226a6 and 8e3ef1f6422041ba66580a6fc48b0719e00860fd. Use i_size_read instead of using old i_size. Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/smb2ops.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 7013b6c3abe4..924250cd8476 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -3291,7 +3291,8 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon, * Start at the old EOF when extending so the folio straddling it, which * may hold data written past EOF through an mmap, is dropped too. */ - truncate_pagecache_range(inode, min(offset, i_size), offset + len - 1); + truncate_pagecache_range(inode, min_t(unsigned long long, offset, + i_size_read(inode)), offset + len - 1); /* if file not oplocked can't be sure whether asking to extend size */ rc = -EOPNOTSUPP; -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-98044
by Chen Yuxi 28 Oct '26

28 Oct '26

Fix CVE-2026-98044 and the kabi breakage. Chen Yuxi (1): bpf: Fix kabi breakage in struct bpf_subprog_info Kumar Kartikeya Dwivedi (1): bpf: Reject legacy packet loads from callbacks include/linux/bpf_verifier.h | 1 + kernel/bpf/verifier.c | 22 ++++++++++++++++++++++ 2 files changed, 23 insertions(+) -- 2.34.1

1 2

[PATCH OLK-6.6] smb: client: discard post-EOF pagecache when extending a file via zero range
by Yifan Qiao 28 Oct '26

28 Oct '26

From: Paulo Alcantara <pc(a)manguebit.org> stable inclusion from stable-v6.6.160 commit 3df27277f8f95345d4a6c57367824bf1aefdbf66 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20573 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit da4fe97fb6c730d9c94a115c7bfa6f98e0d578d0 ] smb3_zero_range() removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold data dirtied past EOF through an mmap - was never dropped and became visible as file content once the file was extended. Lower the discard boundary to the smaller of the zero-range offset and the old EOF. Fixes: 72c419d9b073 ("cifs: fix smb3_zero_range so it can expand the file-size when required") Reviewed-by: David Howells <dhowells(a)redhat.com> Reviewed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Cc: Christian Brauner <brauner(a)kernel.org> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Ronnie Sahlberg <ronniesahlberg(a)gmail.com> Cc: Shyam Prasad N <sprasad(a)microsoft.com> Cc: Tom Talpey <tom(a)talpey.com> Cc: Bharath SM <bharathsm(a)microsoft.com> Cc: stable(a)vger.kernel.org [ sashal: Adjusted context due to the missing netfs_wait_for_outstanding_io() call. ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/smb2ops.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 055fd4cbb215..a8636bda1c68 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -3287,8 +3287,13 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon, /* * We zero the range through ioctl, so we need remove the page caches * first, otherwise the data may be inconsistent with the server. + * + * Start at the old EOF when extending so the folio straddling it, which + * may hold data written past EOF through an mmap, is dropped too. */ - truncate_pagecache_range(inode, offset, offset + len - 1); + truncate_pagecache_range(inode, min(offset, + (unsigned long long)i_size_read(inode)), + offset + len - 1); /* if file not oplocked can't be sure whether asking to extend size */ rc = -EOPNOTSUPP; -- 2.52.0

2 1

[PATCH OLK-6.6] smb: client: drain and invalidate before server-side copy/clone
by Yifan Qiao 28 Oct '26

28 Oct '26

From: Paulo Alcantara <pc(a)manguebit.org> mainline inclusion from mainline-v7.3-rc6 commit c9b1194e8ec99d95db25db45edd2fbf690f043ab category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20580 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- cifs_file_copychunk_range() and the clone (FICLONE) path of cifs_remap_file_range() do not serialise the destination page cache against the server-side copy the way the other server-side range operations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range() and smb3_insert_range()) do. cifs_file_copychunk_range() invalidates the destination range with filemap_invalidate_inode(), which takes and drops the mapping's invalidate_lock internally, so the lock is no longer held when the copychunk ioctl is issued. It also never drains in-flight netfs I/O on the target. The clone path never takes the invalidate_lock at all (only i_rwsem), uses a bare truncate_inode_pages_range() and likewise does not drain outstanding I/O. As a result an asynchronous destination writeback can complete after the server-side copy/clone has run and reinstate stale data over the region just written by the server, corrupting the file. This is the same class of corruption as commit d7d2adcd022b ("smb/client: flush dirty data before punching a hole") and has been seen randomly in generic/363 against Windows Server. Fix both paths to follow the established ordering: hold the target mapping's invalidate_lock across the flush and invalidation of the destination and the server ioctl, and call netfs_wait_for_outstanding_io() on the target to drain in-flight writes before the ioctl is issued. Only the target inode's invalidate_lock is required, as the source is merely flushed and not invalidated; i_rwsem (already held via lock_two_nondirectories()) is acquired before the invalidate_lock, matching the VFS lock ordering. Since filemap_invalidate_inode() takes that same lock internally, replace it with its own unmap/flush/invalidate steps instead of calling it, and return early on a zero-length copy to avoid a range underflow. Fixes: 8101d6e112e2 ("cifs: Fix copy offload to flush destination region") Fixes: c54fc3a4f375 ("cifs: Fix flushing, invalidation and file size with FICLONE") Reviewed-by: David Howells <dhowells(a)redhat.com> Reviewed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Cc: Christian Brauner <brauner(a)kernel.org> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Ronnie Sahlberg <ronniesahlberg(a)gmail.com> Cc: Shyam Prasad N <sprasad(a)microsoft.com> Cc: Tom Talpey <tom(a)talpey.com> Cc: Bharath SM <bharathsm(a)microsoft.com> Cc: stable(a)vger.kernel.org Conflicts: fs/smb/client/cifsfs.c [This tree has no netfs_wait_for_outstanding_io() and 8101d6e112e2 is not merged yet. So no need to change cifs_file_copychunk_range] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/cifsfs.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c index fb2692789cd6..334efdd8d8d9 100644 --- a/fs/smb/client/cifsfs.c +++ b/fs/smb/client/cifsfs.c @@ -1338,6 +1338,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, * server could even support copy of range where source = target */ lock_two_nondirectories(target_inode, src_inode); + filemap_invalidate_lock(target_inode->i_mapping); if (len == 0) { loff_t src_size = i_size_read(src_inode); @@ -1387,8 +1388,19 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, if (rc) goto unlock; - /* Discard all the folios that overlap the destination region. */ + /* Discard all the folios that overlap the destination region. Start at + * the old EOF when extending so the folio straddling it, which may hold + * data written past EOF through an mmap, is dropped too. + */ cifs_dbg(FYI, "about to discard pages %llx-%llx\n", fstart, fend); + fstart = min_t(unsigned long long, fstart, + i_size_read(target_inode)); + /* Drain any in-flight writeback on the destination before the server + * side clone rewrites the range. + */ + rc = filemap_write_and_wait_range(target_inode->i_mapping, fstart, fend); + if (rc) + goto unlock; truncate_inode_pages_range(&target_inode->i_data, fstart, fend); fscache_invalidate(cifs_inode_cookie(target_inode), NULL, @@ -1424,6 +1436,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, that target is updated on the server */ CIFS_I(target_inode)->time = 0; unlock: + filemap_invalidate_unlock(target_inode->i_mapping); /* although unlocking in the reverse order from locking is not strictly necessary here it is a little cleaner to be consistent */ unlock_two_nondirectories(src_inode, target_inode); -- 2.52.0

2 1

[PATCH OLK-6.6] filescgroup: migrate files resources of every task, not just the first
by Cai Xinchen 28 Oct '26

28 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10137 -------------------------------- files_cgroup_can_attach() used cgroup_taskset_first() and only migrated the files resources of the first task of the taskset. A thread group may contain tasks that own private files_struct instances (created through unshare(CLONE_FILES) or clone() without CLONE_FILES); on a thread-group migration those structs kept pointing at the source cgroup, so FDs opened afterwards were charged to the source cgroup and bypassed the target cgroup's files.limit. Walk the whole taskset with cgroup_taskset_for_each(), de-duplicating tasks that share a files_struct (they already point at the target css after being handled by an earlier task). A partial migration is rolled back inside ->can_attach() from a list of records that stores the source css of every files_struct actually moved; the source cannot be recomputed from task_css() because a shared files_struct may be charged to a css that differs from its task's. ->cancel_attach() is registered as well, but in this tree files is the last subsystem implementing ->can_attach() and the core only cancels subsystems with a lower ssid than the failing one, so the core never invokes it today; it is kept for forward compatibility. Fixes: be6df5f1e6b8 ("cgroups: Resource controller for open files") Assisted-by: opencode:deepseek-v4.1-flash Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/legacy-filescontrol.c | 194 ++++++++++++++++++++++++++++++++++----- 1 file changed, 173 insertions(+), 21 deletions(-) diff --git a/fs/legacy-filescontrol.c b/fs/legacy-filescontrol.c index 8ef732bf9020..c05b5d0211c5 100644 --- a/fs/legacy-filescontrol.c +++ b/fs/legacy-filescontrol.c @@ -96,32 +96,126 @@ static void files_cgroup_css_free(struct cgroup_subsys_state *css) } /* - * If attaching this cgroup would overcommit the resource then deny - * the attach. If not, attach the file resource into new cgroup. + * A files migration performed by ->can_attach(), recording the migrated + * files_struct and the css it is moved from/to so that the move can be + * rolled back later. */ -static int files_cgroup_can_attach(struct cgroup_taskset *tset) -{ - u64 num_files; - bool can_attach; - struct cgroup_subsys_state *to_css; +struct files_migrate_entry { + struct files_struct *files; struct cgroup_subsys_state *from_css; - struct page_counter *from_res; - struct page_counter *to_res; - struct page_counter *fail_res; + struct cgroup_subsys_state *to_css; + struct list_head node; +}; + +static LIST_HEAD(files_migrate_entries); + +/* Undo exactly the files_structs ->can_attach() actually migrated. */ +static void files_migrate_rollback(void) +{ + struct files_migrate_entry *mig_entry, *next_entry; + struct cgroup_subsys_state *from_css, *to_css; + struct page_counter *from_res, *to_res; struct files_struct *files; - struct task_struct *task = cgroup_taskset_first(tset, &to_css); + u64 num_files; + LIST_HEAD(list); - to_res = css_res_open_handles(to_css); + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + from_css = mig_entry->from_css; + to_css = mig_entry->to_css; + files = mig_entry->files; + + list_del(&mig_entry->node); + + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); + + spin_lock(&files->file_lock); + num_files = file_cg_count_fds(files); + page_counter_uncharge(to_res, num_files); + page_counter_charge(from_res, num_files); + css_put(to_css); + files->files_cgroup = css_fcg(from_css); + spin_unlock(&files->file_lock); + + /* + * Drop the references taken when the move was recorded: + * the pin on @files (this may free it, which uncharges + * the just-restored css). + */ + put_files_struct(files); + kfree(mig_entry); + } +} + +/* Migration committed: the moves are final, just drop the records. */ +static void files_migrate_commit(void) +{ + struct files_migrate_entry *mig_entry, *next_entry; + LIST_HEAD(list); + + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + list_del(&mig_entry->node); + /* + * The moves are final: the files_struct keeps its + * reference on @to_css, only the pin and the reference + * transferred from the pre-migration state are dropped. + */ + put_files_struct(mig_entry->files); + css_put(mig_entry->from_css); + kfree(mig_entry); + } +} + +static void files_cgroup_cancel_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_rollback(); +} + +static void files_cgroup_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_commit(); +} + +/* + * files_cgroup_can_attach_one_task - judge one task can attach to files cgroup + * @task: the task is judged whether can attach + * @mig_entry: files_migrate_entry record + * @to_css: the css migrate to + * @skip: if task files is NULL or files->files_cgroup is NULL or files == init_files + * or already on target css, skip attach is true + */ +static int files_cgroup_can_attach_one_task(struct task_struct *task, + struct files_migrate_entry *mig_entry, + struct cgroup_subsys_state *to_css, + bool *skip) +{ + int ret = 0; + u64 num_files; + struct page_counter *from_res, *to_res, *fail_res; + struct files_struct *files; + struct cgroup_subsys_state *from_css; + *skip = false; task_lock(task); files = task->files; if (!files || !files->files_cgroup || files == &init_files) { - task_unlock(task); - return 0; + *skip = true; + goto skip; } from_css = &files_cgroup_from_files(files)->css; + /* Already on the target css, or handled via a shared files_struct. */ + if (from_css == to_css) { + *skip = true; + goto skip; + } + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); spin_lock(&files->file_lock); num_files = file_cg_count_fds(files); @@ -130,16 +224,67 @@ static int files_cgroup_can_attach(struct cgroup_taskset *tset) if (!page_counter_try_charge(to_res, num_files, &fail_res)) { page_counter_charge(from_res, num_files); pr_err("Open files limit overcommited\n"); - can_attach = false; - } else { - css_put(from_css); - css_get(to_css); - task->files->files_cgroup = css_fcg(to_css); - can_attach = true; + ret = -ENOSPC; + goto overcommited; } + + /* + * The files_struct's reference on @from_css is transferred to + * the rollback record; @to_css is referenced by the + * files_struct from now on. + */ + css_get(to_css); + files->files_cgroup = css_fcg(to_css); + + atomic_inc(&files->count); + mig_entry->files = files; + mig_entry->from_css = from_css; + mig_entry->to_css = to_css; + +overcommited: spin_unlock(&files->file_lock); +skip: task_unlock(task); - return can_attach ? 0 : -ENOSPC; + return ret; +} + +/* + * If attaching this cgroup would overcommit the resource then deny + * the attach. If not, attach the file resource into new cgroup. + */ +static int files_cgroup_can_attach(struct cgroup_taskset *tset) +{ + struct task_struct *task; + struct cgroup_subsys_state *to_css; + struct files_migrate_entry *mig_entry; + int ret = 0; + bool skip = false; + + cgroup_taskset_for_each(task, to_css, tset) { + mig_entry = kzalloc(sizeof(*mig_entry), GFP_KERNEL); + if (!mig_entry) { + ret = -ENOMEM; + break; + } + + ret = files_cgroup_can_attach_one_task(task, mig_entry, to_css, &skip); + if (ret) { + kfree(mig_entry); + break; + } + + if (skip) { + kfree(mig_entry); + continue; + } + + list_add_tail(&mig_entry->node, &files_migrate_entries); + } + + if (ret) + files_migrate_rollback(); + + return ret; } int files_cgroup_alloc_fd(struct files_struct *files, u64 n) @@ -294,6 +439,13 @@ struct cgroup_subsys files_cgrp_subsys = { .css_alloc = files_cgroup_css_alloc, .css_free = files_cgroup_css_free, .can_attach = files_cgroup_can_attach, + /* + * Not reachable today because files has the highest ssid among the + * subsystems implementing ->can_attach(); kept for forward + * compatibility. See the comment above struct files_migrate_entry. + */ + .cancel_attach = files_cgroup_cancel_attach, + .attach = files_cgroup_attach, .legacy_cftypes = files, }; -- 2.34.1

2 1

[PATCH OLK-5.10] filescgroup: migrate files resources of every task, not just the first
by Cai Xinchen 28 Oct '26

28 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10137 -------------------------------- files_cgroup_can_attach() used cgroup_taskset_first() and only migrated the files resources of the first task of the taskset. A thread group may contain tasks that own private files_struct instances (created through unshare(CLONE_FILES) or clone() without CLONE_FILES); on a thread-group migration those structs kept pointing at the source cgroup, so FDs opened afterwards were charged to the source cgroup and bypassed the target cgroup's files.limit. Walk the whole taskset with cgroup_taskset_for_each(), de-duplicating tasks that share a files_struct (they already point at the target css after being handled by an earlier task). A partial migration is rolled back inside ->can_attach() from a list of records that stores the source css of every files_struct actually moved; the source cannot be recomputed from task_css() because a shared files_struct may be charged to a css that differs from its task's. ->cancel_attach() is registered as well, but in this tree files is the last subsystem implementing ->can_attach() and the core only cancels subsystems with a lower ssid than the failing one, so the core never invokes it today; it is kept for forward compatibility. Fixes: be6df5f1e6b8 ("cgroups: Resource controller for open files") Assisted-by: opencode:deepseek-v4.1-flash Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/filescontrol.c | 195 +++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 174 insertions(+), 21 deletions(-) diff --git a/fs/filescontrol.c b/fs/filescontrol.c index fdd557a246be..753e6786db79 100644 --- a/fs/filescontrol.c +++ b/fs/filescontrol.c @@ -103,32 +103,127 @@ u64 files_cgroup_count_fds(struct files_struct *files) } /* - * If attaching this cgroup would overcommit the resource then deny - * the attach. If not, attach the file resource into new cgroup. + * A files migration performed by ->can_attach(), recording the migrated + * files_struct and the css it is moved from/to so that the move can be + * rolled back later. */ -static int files_cgroup_can_attach(struct cgroup_taskset *tset) +struct files_migrate_entry { + struct files_struct *files; + struct cgroup_subsys_state *from_css; + struct cgroup_subsys_state *to_css; + struct list_head node; +}; + +static LIST_HEAD(files_migrate_entries); + +/* Undo exactly the files_structs ->can_attach() actually migrated. */ +static void files_migrate_rollback(void) { + struct files_migrate_entry *mig_entry, *next_entry; + struct cgroup_subsys_state *from_css, *to_css; + struct page_counter *from_res, *to_res; + struct files_struct *files; u64 num_files; - bool can_attach; - struct cgroup_subsys_state *to_css; - struct cgroup_subsys_state *from_css; - struct page_counter *from_res; - struct page_counter *to_res; - struct page_counter *fail_res; + LIST_HEAD(list); + + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + from_css = mig_entry->from_css; + to_css = mig_entry->to_css; + files = mig_entry->files; + + list_del(&mig_entry->node); + + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); + + spin_lock(&files->file_lock); + num_files = files_cgroup_count_fds(files); + page_counter_uncharge(to_res, num_files); + page_counter_charge(from_res, num_files); + css_put(to_css); + files->files_cgroup = css_fcg(from_css); + spin_unlock(&files->file_lock); + + /* + * Drop the references taken when the move was recorded: + * the pin on @files (this may free it, which uncharges + * the just-restored css). + */ + put_files_struct(files); + kfree(mig_entry); + } +} + +/* Migration committed: the moves are final, just drop the records. */ +static void files_migrate_commit(void) +{ + struct files_migrate_entry *mig_entry, *next_entry; + LIST_HEAD(list); + + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + list_del(&mig_entry->node); + /* + * The moves are final: the files_struct keeps its + * reference on @to_css, only the pin and the reference + * transferred from the pre-migration state are dropped. + */ + put_files_struct(mig_entry->files); + css_put(mig_entry->from_css); + kfree(mig_entry); + } +} + +static void files_cgroup_cancel_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_rollback(); +} + +static void files_cgroup_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_commit(); +} + +/* + * files_cgroup_can_attach_one_task - try to migrate one task's files_struct + * @task: task to migrate + * @mig_entry: migration record filled in on success + * @to_css: target css + * @skip: set to true if @task has no chargeable files_struct or its + * files_struct already points at @to_css + */ +static int files_cgroup_can_attach_one_task(struct task_struct *task, + struct files_migrate_entry *mig_entry, + struct cgroup_subsys_state *to_css, + bool *skip) +{ + int ret = 0; + u64 num_files; + struct page_counter *from_res, *to_res, *fail_res; struct files_struct *files; - struct task_struct *task = cgroup_taskset_first(tset, &to_css); + struct cgroup_subsys_state *from_css; - to_res = css_res_open_handles(to_css); + *skip = false; task_lock(task); files = task->files; - if (!files || files == &init_files) { - task_unlock(task); - return 0; + if (!files || !files->files_cgroup || files == &init_files) { + *skip = true; + goto skip; } from_css = &files_cgroup_from_files(files)->css; + /* Already on the target css, or handled via a shared files_struct. */ + if (from_css == to_css) { + *skip = true; + goto skip; + } + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); spin_lock(&files->file_lock); num_files = files_cgroup_count_fds(files); @@ -137,16 +232,67 @@ static int files_cgroup_can_attach(struct cgroup_taskset *tset) if (!page_counter_try_charge(to_res, num_files, &fail_res)) { page_counter_charge(from_res, num_files); pr_err("Open files limit overcommited\n"); - can_attach = false; - } else { - css_put(from_css); - css_get(to_css); - task->files->files_cgroup = css_fcg(to_css); - can_attach = true; + ret = -ENOSPC; + goto unlock; } + + /* + * The files_struct's reference on @from_css is transferred to + * the rollback record; @to_css is referenced by the + * files_struct from now on. + */ + css_get(to_css); + files->files_cgroup = css_fcg(to_css); + + atomic_inc(&files->count); + mig_entry->files = files; + mig_entry->from_css = from_css; + mig_entry->to_css = to_css; + +unlock: spin_unlock(&files->file_lock); +skip: task_unlock(task); - return can_attach ? 0 : -ENOSPC; + return ret; +} + +/* + * If attaching this cgroup would overcommit the resource then deny + * the attach. If not, attach the file resource into new cgroup. + */ +static int files_cgroup_can_attach(struct cgroup_taskset *tset) +{ + struct task_struct *task; + struct cgroup_subsys_state *to_css; + struct files_migrate_entry *mig_entry; + int ret = 0; + bool skip = false; + + cgroup_taskset_for_each(task, to_css, tset) { + mig_entry = kzalloc(sizeof(*mig_entry), GFP_KERNEL); + if (!mig_entry) { + ret = -ENOMEM; + break; + } + + ret = files_cgroup_can_attach_one_task(task, mig_entry, to_css, &skip); + if (ret) { + kfree(mig_entry); + break; + } + + if (skip) { + kfree(mig_entry); + continue; + } + + list_add_tail(&mig_entry->node, &files_migrate_entries); + } + + if (ret) + files_migrate_rollback(); + + return ret; } int files_cgroup_alloc_fd(struct files_struct *files, u64 n) @@ -276,6 +422,13 @@ struct cgroup_subsys files_cgrp_subsys = { .css_alloc = files_cgroup_css_alloc, .css_free = files_cgroup_css_free, .can_attach = files_cgroup_can_attach, + /* + * Not reachable today because files has the highest ssid among the + * subsystems implementing ->can_attach(); kept for forward + * compatibility. See the comment above struct files_migrate_entry. + */ + .cancel_attach = files_cgroup_cancel_attach, + .attach = files_cgroup_attach, .legacy_cftypes = files, .dfl_cftypes = files, }; -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Make post-verification instruction rewrites killable
by Pu Lehui 28 Oct '26

28 Oct '26

From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> mainline inclusion from mainline-v7.3-rc5 commit 261b61d3735b042ae25634f795c4540be0fc140c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20695 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- After do_check() returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining instruction and auxiliary-data arrays and adjusts all branch offsets, making the overall work quadratic in the program length. A privileged loader can submit 131072 unconditional jumps by zero followed by a valid return. Verification finishes quickly, but bpf_opt_remove_nops() then spends a long time removing each jump separately. Since this post-verification work neither checks for signals nor reschedules, a pending SIGKILL cannot terminate the task until the rewrite finishes. Make bpf_patch_insn_data() and verifier_remove_insns() common cancellation and rescheduling points. These helpers run from BPF_PROG_LOAD process context, and bpf_patch_insn_data() can already sleep while reallocating auxiliary data. Report interrupted constant blinding as -EINTR and propagate it through both JIT paths, including kernels that permit interpreter fallback. Other blinding failures retain the existing fallback behavior. This does not reduce the quadratic cost of the rewrite passes, but it makes the work preemptible and allows a killed loader to be torn down promptly. Fixes: 52875a04f4b2 ("bpf: verifier: remove dead code") Reported-by: Nicholas Carlini <npc(a)anthropic.com> Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://patch.msgid.link/20260917233222.2542500-2-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Conflicts: arch/arm/net/bpf_jit_32.c arch/arm64/net/bpf_jit_comp.c arch/loongarch/net/bpf_jit.c arch/mips/net/bpf_jit_comp.c arch/parisc/net/bpf_jit_core.c arch/powerpc/net/bpf_jit_comp.c arch/riscv/net/bpf_jit_core.c arch/s390/net/bpf_jit_comp.c arch/sparc/net/bpf_jit_comp_64.c arch/sw_64/net/bpf_jit_comp.c arch/x86/net/bpf_jit_comp.c arch/x86/net/bpf_jit_comp32.c kernel/bpf/core.c kernel/bpf/verifier.c kernel/bpf/fixups.c [generic bpf_jit_blind_constants not merged] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/arm/net/bpf_jit_32.c | 14 ++++++++------ arch/arm64/net/bpf_jit_comp.c | 10 +++++++--- arch/loongarch/net/bpf_jit.c | 10 ++++++---- arch/mips/net/bpf_jit_comp.c | 12 +++++++----- arch/parisc/net/bpf_jit_core.c | 9 ++++++++- arch/powerpc/net/bpf_jit_comp.c | 9 ++++++++- arch/riscv/net/bpf_jit_core.c | 9 ++++++++- arch/s390/net/bpf_jit_comp.c | 9 ++++++--- arch/sparc/net/bpf_jit_comp_64.c | 10 +++++++--- arch/sw_64/net/bpf_jit_comp.c | 10 +++++++--- arch/x86/net/bpf_jit_comp.c | 9 ++++++--- arch/x86/net/bpf_jit_comp32.c | 9 ++++++--- kernel/bpf/core.c | 12 +++++++++++- kernel/bpf/verifier.c | 20 ++++++++++++++++++++ 14 files changed, 115 insertions(+), 37 deletions(-) diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c index 8adc45ad1b2a..0ff2a70d8c06 100644 --- a/arch/arm/net/bpf_jit_32.c +++ b/arch/arm/net/bpf_jit_32.c @@ -1894,14 +1894,16 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) if (!prog->jit_requested) return orig_prog; - /* If constant blinding was enabled and we failed during blinding - * then we must fall back to the interpreter. Otherwise, we save - * the new JITed code. - */ tmp = bpf_jit_blind_constants(prog); - - if (IS_ERR(tmp)) + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. + */ + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 971b75b8059f..87ec8dbb43af 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1580,11 +1580,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - /* If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index 123df6a771d7..f44803e66ff4 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -1125,12 +1125,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp = bpf_jit_blind_constants(prog); /* - * If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. Otherwise, we save - * the new JITed code. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; diff --git a/arch/mips/net/bpf_jit_comp.c b/arch/mips/net/bpf_jit_comp.c index e355dfca4400..6e5ede70b306 100644 --- a/arch/mips/net/bpf_jit_comp.c +++ b/arch/mips/net/bpf_jit_comp.c @@ -926,14 +926,16 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) */ if (!prog->jit_requested) return orig_prog; + tmp = bpf_jit_blind_constants(prog); /* - * If constant blinding was enabled and we failed during blinding - * then we must fall back to the interpreter. Otherwise, we save - * the new JITed code. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - tmp = bpf_jit_blind_constants(prog); - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/parisc/net/bpf_jit_core.c b/arch/parisc/net/bpf_jit_core.c index 06cbcd6fe87b..80ec6a6c2d49 100644 --- a/arch/parisc/net/bpf_jit_core.c +++ b/arch/parisc/net/bpf_jit_core.c @@ -54,8 +54,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - if (IS_ERR(tmp)) + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. + */ + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c index 57de9d6b0089..ab316a492075 100644 --- a/arch/powerpc/net/bpf_jit_comp.c +++ b/arch/powerpc/net/bpf_jit_comp.c @@ -75,8 +75,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) return org_fp; tmp_fp = bpf_jit_blind_constants(org_fp); - if (IS_ERR(tmp_fp)) + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. + */ + if (IS_ERR(tmp_fp)) { + if (PTR_ERR(tmp_fp) == -EINTR) + return tmp_fp; return org_fp; + } if (tmp_fp != org_fp) { bpf_blinded = true; diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c index 7b70ccb7fec3..bbfaaa880d4f 100644 --- a/arch/riscv/net/bpf_jit_core.c +++ b/arch/riscv/net/bpf_jit_core.c @@ -54,8 +54,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - if (IS_ERR(tmp)) + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. + */ + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c index 99eae9cf7972..3c171c1c56e7 100644 --- a/arch/s390/net/bpf_jit_comp.c +++ b/arch/s390/net/bpf_jit_comp.c @@ -1952,11 +1952,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) tmp = bpf_jit_blind_constants(fp); /* - * If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_fp; + } if (tmp != fp) { tmp_blinded = true; fp = tmp; diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c index 73bf0aea8baf..0fe2df433082 100644 --- a/arch/sparc/net/bpf_jit_comp_64.c +++ b/arch/sparc/net/bpf_jit_comp_64.c @@ -1493,11 +1493,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - /* If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/sw_64/net/bpf_jit_comp.c b/arch/sw_64/net/bpf_jit_comp.c index 057461689832..e154adc33073 100644 --- a/arch/sw_64/net/bpf_jit_comp.c +++ b/arch/sw_64/net/bpf_jit_comp.c @@ -1969,11 +1969,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - /* If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index ad50d9a270fc..46fb1c77b370 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2986,11 +2986,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp = bpf_jit_blind_constants(prog); /* - * If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c index f2fc8c38629b..d45644254cba 100644 --- a/arch/x86/net/bpf_jit_comp32.c +++ b/arch/x86/net/bpf_jit_comp32.c @@ -2535,11 +2535,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp = bpf_jit_blind_constants(prog); /* - * If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index bf493b8ae8fd..06748b956b5c 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -19,6 +19,7 @@ #include <uapi/linux/btf.h> #include <linux/filter.h> +#include <linux/sched/signal.h> #include <linux/skbuff.h> #include <linux/vmalloc.h> #include <linux/random.h> @@ -1534,6 +1535,8 @@ struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *prog) * fix it up here on error. */ bpf_jit_prog_release_other(prog, clone); + if (fatal_signal_pending(current)) + return ERR_PTR(-EINTR); return tmp; } @@ -2466,6 +2469,8 @@ static void bpf_prog_select_func(struct bpf_prog *fp) */ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err) { + struct bpf_prog *jit_prog; + /* In case of BPF to BPF calls, verifier did all the prep * work with regards to JITing, etc. */ @@ -2491,7 +2496,12 @@ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err) if (*err) return fp; - fp = bpf_int_jit_compile(fp); + jit_prog = bpf_int_jit_compile(fp); + if (IS_ERR(jit_prog)) { + *err = PTR_ERR(jit_prog); + return fp; + } + fp = jit_prog; bpf_prog_jit_attempt_done(fp); if (!fp->jited && jit_needed) { *err = -ENOTSUPP; diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 7f3bb5bf8a57..66cfb1d955c1 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -19,6 +19,7 @@ #include <linux/bsearch.h> #include <linux/sort.h> #include <linux/perf_event.h> +#include <linux/sched/signal.h> #include <linux/ctype.h> #include <linux/error-injection.h> #include <linux/bpf_lsm.h> @@ -18452,12 +18453,28 @@ static void adjust_poke_descs(struct bpf_prog *prog, u32 off, u32 len) } } +/* + * Some post-verification instruction rewriting passes require an + * O(prog->len) operation per instruction. Keep their shared primitives + * killable and preemptible. + */ +static bool bpf_rewrite_must_abort(void) +{ + if (fatal_signal_pending(current)) + return true; + cond_resched(); + return false; +} + static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 off, const struct bpf_insn *patch, u32 len) { struct bpf_prog *new_prog; struct bpf_insn_aux_data *new_data = NULL; + if (bpf_rewrite_must_abort()) + return NULL; + if (len > 1) { new_data = vzalloc(array_size(env->prog->len + len - 1, sizeof(struct bpf_insn_aux_data))); @@ -18606,6 +18623,9 @@ static int verifier_remove_insns(struct bpf_verifier_env *env, u32 off, u32 cnt) unsigned int orig_prog_len = env->prog->len; int err; + if (bpf_rewrite_must_abort()) + return -EINTR; + if (bpf_prog_is_offloaded(env->prog->aux)) bpf_prog_offload_remove_insns(env, off, cnt); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-98044
by Chen Yuxi 28 Oct '26

28 Oct '26

Fix CVE-2026-98044 and the kabi breakage. Chen Yuxi (1): bpf: Fix kabi breakage in struct bpf_subprog_info Kumar Kartikeya Dwivedi (1): bpf: Reject legacy packet loads from callbacks include/linux/bpf_verifier.h | 1 + kernel/bpf/verifier.c | 22 ++++++++++++++++++++++ 2 files changed, 23 insertions(+) -- 2.34.1

2 3

openEuler Kernel SIG双周例会
by openEuler conference 28 Oct '26

28 Oct '26

您好！ Kernel 邀请您参加 2026-10-30 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题可直接申报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/968711190 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-10-30 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题可直接申报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/968711190 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-5.10 v2] md: fix null-ptr-deref in md_check_no_bitmap()
by Zhou Minqiang 28 Oct '26

28 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10134 -------------------------------- md_check_no_bitmap() dereferences mddev->pers->name to print the personality name when an array has a bitmap configured but the personality does not support bitmaps. Commit 36d091f4759d ("md: protect ->pers changes with mddev->lock") moved the assignment mddev->pers = pers to after pers->run(), so mddev->pers is still NULL when md_check_no_bitmap() is called from the ->run method of raid0 and linear: do_md_run md_run pers->run(mddev) <- mddev->pers still NULL raid0_run / linear_run md_check_no_bitmap mddev->pers->head.name <- NULL pointer dereference The early-return check in md_check_no_bitmap() can be bypassed because the bitmap can be configured while pers is NULL: set_bitmap_file() (via SET_BITMAP_FILE ioctl) sets bitmap_info.file directly, and location_store() (via sysfs bitmap/location) sets bitmap_info.offset. Both md_run() and the level_store() takeover path set mddev->clevel via strscpy(mddev->clevel, pers->name, ...) before calling pers->run(), making mddev->clevel a safe substitute for printing the personality name. Fixes: 36d091f4759d ("md: protect ->pers changes with mddev->lock") Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 4ddb56d7408a..2952b178f016 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -1170,7 +1170,7 @@ int md_check_no_bitmap(struct mddev *mddev) if (!mddev->bitmap_info.file && !mddev->bitmap_info.offset) return 0; pr_warn("%s: bitmaps are not supported for %s\n", - mdname(mddev), mddev->pers->name); + mdname(mddev), mddev->clevel); return 1; } EXPORT_SYMBOL(md_check_no_bitmap); -- 2.52.0

2 1