- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] dm-bufio: don't schedule in atomic context
by Li Lingfeng 25 Nov '25

25 Nov '25

From: LongPing Wei <weilongping(a)oppo.com> stable inclusion from stable-v6.6.90 commit c8c83052283bcf2fdd467a33d1d2bd5ba36e935a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC990W CVE: CVE-2025-37928 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a3d8f0a7f5e8b193db509c7191fefeed3533fc44 upstream. A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet are enabled. [ 129.444685][ T934] BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2421 [ 129.444723][ T934] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 934, name: kworker/1:4 [ 129.444740][ T934] preempt_count: 201, expected: 0 [ 129.444756][ T934] RCU nest depth: 0, expected: 0 [ 129.444781][ T934] Preemption disabled at: [ 129.444789][ T934] [<ffffffd816231900>] shrink_work+0x21c/0x248 [ 129.445167][ T934] kernel BUG at kernel/sched/walt/walt_debug.c:16! [ 129.445183][ T934] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [ 129.445204][ T934] Skip md ftrace buffer dump for: 0x1609e0 [ 129.447348][ T934] CPU: 1 PID: 934 Comm: kworker/1:4 Tainted: G W OE 6.6.56-android15-8-o-g6f82312b30b9-debug #1 1400000003000000474e5500b3187743670464e8 [ 129.447362][ T934] Hardware name: Qualcomm Technologies, Inc. Parrot QRD, Alpha-M (DT) [ 129.447373][ T934] Workqueue: dm_bufio_cache shrink_work [ 129.447394][ T934] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 129.447406][ T934] pc : android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug] [ 129.447435][ T934] lr : __traceiter_android_rvh_schedule_bug+0x44/0x6c [ 129.447451][ T934] sp : ffffffc0843dbc90 [ 129.447459][ T934] x29: ffffffc0843dbc90 x28: ffffffffffffffff x27: 0000000000000c8b [ 129.447479][ T934] x26: 0000000000000040 x25: ffffff804b3d6260 x24: ffffffd816232b68 [ 129.447497][ T934] x23: ffffff805171c5b4 x22: 0000000000000000 x21: ffffffd816231900 [ 129.447517][ T934] x20: ffffff80306ba898 x19: 0000000000000000 x18: ffffffc084159030 [ 129.447535][ T934] x17: 00000000d2b5dd1f x16: 00000000d2b5dd1f x15: ffffffd816720358 [ 129.447554][ T934] x14: 0000000000000004 x13: ffffff89ef978000 x12: 0000000000000003 [ 129.447572][ T934] x11: ffffffd817a823c4 x10: 0000000000000202 x9 : 7e779c5735de9400 [ 129.447591][ T934] x8 : ffffffd81560d004 x7 : 205b5d3938373434 x6 : ffffffd8167397c8 [ 129.447610][ T934] x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffffffc0843db9e0 [ 129.447629][ T934] x2 : 0000000000002f15 x1 : 0000000000000000 x0 : 0000000000000000 [ 129.447647][ T934] Call trace: [ 129.447655][ T934] android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug 1400000003000000474e550080cce8a8a78606b6] [ 129.447681][ T934] __might_resched+0x190/0x1a8 [ 129.447694][ T934] shrink_work+0x180/0x248 [ 129.447706][ T934] process_one_work+0x260/0x624 [ 129.447718][ T934] worker_thread+0x28c/0x454 [ 129.447729][ T934] kthread+0x118/0x158 [ 129.447742][ T934] ret_from_fork+0x10/0x20 [ 129.447761][ T934] Code: ???????? ???????? ???????? d2b5dd1f (d4210000) [ 129.447772][ T934] ---[ end trace 0000000000000000 ]--- dm_bufio_lock will call spin_lock_bh when try_verify_in_tasklet is enabled, and __scan will be called in atomic context. Fixes: 7cd326747f46 ("dm bufio: remove dm_bufio_cond_resched()") Signed-off-by: LongPing Wei <weilongping(a)oppo.com> Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-bufio.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c index b837a445bb7f..8ce77aec05d2 100644 --- a/drivers/md/dm-bufio.c +++ b/drivers/md/dm-bufio.c @@ -68,6 +68,8 @@ #define LIST_DIRTY 1 #define LIST_SIZE 2 +#define SCAN_RESCHED_CYCLE 16 + /*--------------------------------------------------------------*/ /* @@ -2387,7 +2389,12 @@ static void __scan(struct dm_bufio_client *c) atomic_long_dec(&c->need_shrink); freed++; - cond_resched(); + + if (unlikely(freed % SCAN_RESCHED_CYCLE == 0)) { + dm_bufio_unlock(c); + cond_resched(); + dm_bufio_lock(c); + } } } } -- 2.46.1

2 1

[PATCH OLK-6.6] dmaengine: ti: k3-udma: Add missing locking
by Li Lingfeng 25 Nov '25

25 Nov '25

From: Ronald Wahl <ronald.wahl(a)legrand.com> stable inclusion from stable-v6.6.92 commit d87f1cddc592387359fde157cc4296556f6403c2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGALS CVE: CVE-2025-38005 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fca280992af8c2fbd511bc43f65abb4a17363f2f upstream. Recent kernels complain about a missing lock in k3-udma.c when the lock validator is enabled: [ 4.128073] WARNING: CPU: 0 PID: 746 at drivers/dma/ti/../virt-dma.h:169 udma_start.isra.0+0x34/0x238 [ 4.137352] CPU: 0 UID: 0 PID: 746 Comm: kworker/0:3 Not tainted 6.12.9-arm64 #28 [ 4.144867] Hardware name: pp-v12 (DT) [ 4.148648] Workqueue: events udma_check_tx_completion [ 4.153841] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 4.160834] pc : udma_start.isra.0+0x34/0x238 [ 4.165227] lr : udma_start.isra.0+0x30/0x238 [ 4.169618] sp : ffffffc083cabcf0 [ 4.172963] x29: ffffffc083cabcf0 x28: 0000000000000000 x27: ffffff800001b005 [ 4.180167] x26: ffffffc0812f0000 x25: 0000000000000000 x24: 0000000000000000 [ 4.187370] x23: 0000000000000001 x22: 00000000e21eabe9 x21: ffffff8000fa0670 [ 4.194571] x20: ffffff8001b6bf00 x19: ffffff8000fa0430 x18: ffffffc083b95030 [ 4.201773] x17: 0000000000000000 x16: 00000000f0000000 x15: 0000000000000048 [ 4.208976] x14: 0000000000000048 x13: 0000000000000000 x12: 0000000000000001 [ 4.216179] x11: ffffffc08151a240 x10: 0000000000003ea1 x9 : ffffffc08046ab68 [ 4.223381] x8 : ffffffc083cabac0 x7 : ffffffc081df3718 x6 : 0000000000029fc8 [ 4.230583] x5 : ffffffc0817ee6d8 x4 : 0000000000000bc0 x3 : 0000000000000000 [ 4.237784] x2 : 0000000000000000 x1 : 00000000001fffff x0 : 0000000000000000 [ 4.244986] Call trace: [ 4.247463] udma_start.isra.0+0x34/0x238 [ 4.251509] udma_check_tx_completion+0xd0/0xdc [ 4.256076] process_one_work+0x244/0x3fc [ 4.260129] process_scheduled_works+0x6c/0x74 [ 4.264610] worker_thread+0x150/0x1dc [ 4.268398] kthread+0xd8/0xe8 [ 4.271492] ret_from_fork+0x10/0x20 [ 4.275107] irq event stamp: 220 [ 4.278363] hardirqs last enabled at (219): [<ffffffc080a27c7c>] _raw_spin_unlock_irq+0x38/0x50 [ 4.287183] hardirqs last disabled at (220): [<ffffffc080a1c154>] el1_dbg+0x24/0x50 [ 4.294879] softirqs last enabled at (182): [<ffffffc080037e68>] handle_softirqs+0x1c0/0x3cc [ 4.303437] softirqs last disabled at (177): [<ffffffc080010170>] __do_softirq+0x1c/0x28 [ 4.311559] ---[ end trace 0000000000000000 ]--- This commit adds the missing locking. Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA") Cc: Peter Ujfalusi <peter.ujfalusi(a)gmail.com> Cc: Vignesh Raghavendra <vigneshr(a)ti.com> Cc: Vinod Koul <vkoul(a)kernel.org> Cc: dmaengine(a)vger.kernel.org Cc: stable(a)vger.kernel.org Signed-off-by: Ronald Wahl <ronald.wahl(a)legrand.com> Acked-by: Peter Ujfalusi <peter.ujfalusi(a)gmail.com> Link: https://lore.kernel.org/r/20250414173113.80677-1-rwahl@gmx.de Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/dma/ti/k3-udma.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c index ee4e75f2ad98..5a2a23cf101b 100644 --- a/drivers/dma/ti/k3-udma.c +++ b/drivers/dma/ti/k3-udma.c @@ -1091,8 +1091,11 @@ static void udma_check_tx_completion(struct work_struct *work) u32 residue_diff; ktime_t time_diff; unsigned long delay; + unsigned long flags; while (1) { + spin_lock_irqsave(&uc->vc.lock, flags); + if (uc->desc) { /* Get previous residue and time stamp */ residue_diff = uc->tx_drain.residue; @@ -1127,6 +1130,8 @@ static void udma_check_tx_completion(struct work_struct *work) break; } + spin_unlock_irqrestore(&uc->vc.lock, flags); + usleep_range(ktime_to_us(delay), ktime_to_us(delay) + 10); continue; @@ -1143,6 +1148,8 @@ static void udma_check_tx_completion(struct work_struct *work) break; } + + spin_unlock_irqrestore(&uc->vc.lock, flags); } static irqreturn_t udma_ring_irq_handler(int irq, void *data) -- 2.46.1

2 1

[PATCH OLK-5.10] dmaengine: ti: k3-udma: Add missing locking
by Li Lingfeng 25 Nov '25

25 Nov '25

From: Ronald Wahl <ronald.wahl(a)legrand.com> stable inclusion from stable-v5.10.238 commit 27e71fa08711e09d81e06a54007b362a5426fd22 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGALS CVE: CVE-2025-38005 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fca280992af8c2fbd511bc43f65abb4a17363f2f upstream. Recent kernels complain about a missing lock in k3-udma.c when the lock validator is enabled: [ 4.128073] WARNING: CPU: 0 PID: 746 at drivers/dma/ti/../virt-dma.h:169 udma_start.isra.0+0x34/0x238 [ 4.137352] CPU: 0 UID: 0 PID: 746 Comm: kworker/0:3 Not tainted 6.12.9-arm64 #28 [ 4.144867] Hardware name: pp-v12 (DT) [ 4.148648] Workqueue: events udma_check_tx_completion [ 4.153841] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 4.160834] pc : udma_start.isra.0+0x34/0x238 [ 4.165227] lr : udma_start.isra.0+0x30/0x238 [ 4.169618] sp : ffffffc083cabcf0 [ 4.172963] x29: ffffffc083cabcf0 x28: 0000000000000000 x27: ffffff800001b005 [ 4.180167] x26: ffffffc0812f0000 x25: 0000000000000000 x24: 0000000000000000 [ 4.187370] x23: 0000000000000001 x22: 00000000e21eabe9 x21: ffffff8000fa0670 [ 4.194571] x20: ffffff8001b6bf00 x19: ffffff8000fa0430 x18: ffffffc083b95030 [ 4.201773] x17: 0000000000000000 x16: 00000000f0000000 x15: 0000000000000048 [ 4.208976] x14: 0000000000000048 x13: 0000000000000000 x12: 0000000000000001 [ 4.216179] x11: ffffffc08151a240 x10: 0000000000003ea1 x9 : ffffffc08046ab68 [ 4.223381] x8 : ffffffc083cabac0 x7 : ffffffc081df3718 x6 : 0000000000029fc8 [ 4.230583] x5 : ffffffc0817ee6d8 x4 : 0000000000000bc0 x3 : 0000000000000000 [ 4.237784] x2 : 0000000000000000 x1 : 00000000001fffff x0 : 0000000000000000 [ 4.244986] Call trace: [ 4.247463] udma_start.isra.0+0x34/0x238 [ 4.251509] udma_check_tx_completion+0xd0/0xdc [ 4.256076] process_one_work+0x244/0x3fc [ 4.260129] process_scheduled_works+0x6c/0x74 [ 4.264610] worker_thread+0x150/0x1dc [ 4.268398] kthread+0xd8/0xe8 [ 4.271492] ret_from_fork+0x10/0x20 [ 4.275107] irq event stamp: 220 [ 4.278363] hardirqs last enabled at (219): [<ffffffc080a27c7c>] _raw_spin_unlock_irq+0x38/0x50 [ 4.287183] hardirqs last disabled at (220): [<ffffffc080a1c154>] el1_dbg+0x24/0x50 [ 4.294879] softirqs last enabled at (182): [<ffffffc080037e68>] handle_softirqs+0x1c0/0x3cc [ 4.303437] softirqs last disabled at (177): [<ffffffc080010170>] __do_softirq+0x1c/0x28 [ 4.311559] ---[ end trace 0000000000000000 ]--- This commit adds the missing locking. Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA") Cc: Peter Ujfalusi <peter.ujfalusi(a)gmail.com> Cc: Vignesh Raghavendra <vigneshr(a)ti.com> Cc: Vinod Koul <vkoul(a)kernel.org> Cc: dmaengine(a)vger.kernel.org Cc: stable(a)vger.kernel.org Signed-off-by: Ronald Wahl <ronald.wahl(a)legrand.com> Acked-by: Peter Ujfalusi <peter.ujfalusi(a)gmail.com> Link: https://lore.kernel.org/r/20250414173113.80677-1-rwahl@gmx.de Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/dma/ti/k3-udma.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c index 15eecb757619..466694a74034 100644 --- a/drivers/dma/ti/k3-udma.c +++ b/drivers/dma/ti/k3-udma.c @@ -962,8 +962,11 @@ static void udma_check_tx_completion(struct work_struct *work) u32 residue_diff; ktime_t time_diff; unsigned long delay; + unsigned long flags; while (1) { + spin_lock_irqsave(&uc->vc.lock, flags); + if (uc->desc) { /* Get previous residue and time stamp */ residue_diff = uc->tx_drain.residue; @@ -998,6 +1001,8 @@ static void udma_check_tx_completion(struct work_struct *work) break; } + spin_unlock_irqrestore(&uc->vc.lock, flags); + usleep_range(ktime_to_us(delay), ktime_to_us(delay) + 10); continue; @@ -1014,6 +1019,8 @@ static void udma_check_tx_completion(struct work_struct *work) break; } + + spin_unlock_irqrestore(&uc->vc.lock, flags); } static irqreturn_t udma_ring_irq_handler(int irq, void *data) -- 2.46.1

2 1

[PATCH OLK-6.6] init/Kconfig: Move ARCH_SUPPORTS_SCHED_SOFT_QUOTA to drop CGROUPS dependency
by Chen Jinghuang 25 Nov '25

25 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID8CIH ---------------------------------------- ARCH_SUPPORTS_SCHED_SOFT_QUOTA was previously in a CGROUPS-dependent block, causing build warning when ARCH_SUPPORTS_SCHED_SOFT_QUOTA=y and CGROUPS=n. Move it to a generic, CGROUPS-independent section in init/Kconfig to fix the errors, while preserving its original role as an arch capability flag. Fixes: a91091aed1fa ("sched: More flexible use of CPU quota when CPU is idle") Signed-off-by: Chen Jinghuang<chenjinghuang2(a)huawei.com> --- init/Kconfig | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/init/Kconfig b/init/Kconfig index 485583e8ecbe..874daa00304c 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -950,6 +950,9 @@ config NUMA_BALANCING_DEFAULT_ENABLED If set, automatic NUMA balancing will be enabled if running on a NUMA machine. +config ARCH_SUPPORTS_SCHED_SOFT_QUOTA + bool + menuconfig CGROUPS bool "Control Group support" select KERNFS @@ -1178,9 +1181,6 @@ config SCHED_SOFT_DOMAIN # # For architectures that want to enable the support for SCHED_SOFT_QUOTA # -config ARCH_SUPPORTS_SCHED_SOFT_QUOTA - bool - config SCHED_SOFT_QUOTA bool "More flexible use of CPU quota" depends on ARCH_SUPPORTS_SCHED_SOFT_QUOTA -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2025-40168
by Wang Liang 25 Nov '25

25 Nov '25

Kuniyuki Iwashima (1): smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). Sharath Chandra Vurukala (1): net: Add locking to protect skb->dev access in ip_output include/net/dst.h | 12 ++++++++++++ net/ipv4/ip_output.c | 15 ++++++++++----- net/smc/smc_clc.c | 26 +++++++++++++------------- 3 files changed, 35 insertions(+), 18 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] nfsd: provide locking for v4_end_grace
by Li Lingfeng 25 Nov '25

25 Nov '25

From: NeilBrown <neil(a)brown.name> maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID8DQ8 Reference: https://lore.kernel.org/all/175144911127.565058.5990359597048022103@noble.n… ------------------ Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a deadlock. nfsd4_end_grace() is also called by the landromat work queue and this doesn't require locking as server shutdown will stop the work and wait for it before freeing anything that nfsd4_end_grace() might access. However, we must be sure that writing to v4_end_grace doesn't restart the work item after shutdown has already waited for it. For this we add a new flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and v4_end_grace only schedules work while the flag is set with the spinlock held. So this patch adds a nfsd_net field "client_tracking_active" which is set as described. Another field "grace_end_forced", is set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the laundromat is scheduled. This "grace_end_forced" field bypasses other checks for whether the grace period has finished. This resolves a race which can result in use-after-free. Reported-by: Li Lingfeng <lilingfeng3(a)huawei.com> Cc: stable(a)vger.kernel.org Signed-off-by: NeilBrown <neil(a)brown.name> Conflicts: fs/nfsd/nfs4state.c fs/nfsd/nfsctl.c fs/nfsd/state.h [Commit bad4c585ccaa ("NFSD: send OP_CB_RECALL_ANY to clients when number of delegations reaches its limit") added the declaration of deleg_reaper; commit d17452aa33a6 ("nfsd: dynamically allocate the nfsd-client shrinker") replace unregister_shrinker with shrinker_free; commit 39d432fc7630 ("NFSD: trace nfsctl operations") replace nfsd4_end_grace with trace_nfsd_end_grace; commit 1ac3629bf012 ("nfsd: prepare for supporting admin-revocation of state") added the declaration of nfsd4_revoke_states;] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/netns.h | 2 ++ fs/nfsd/nfs4state.c | 29 +++++++++++++++++++++++++++-- fs/nfsd/nfsctl.c | 3 +-- fs/nfsd/state.h | 2 +- 4 files changed, 31 insertions(+), 5 deletions(-) diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h index 72770fe0fdfe..e80691241aef 100644 --- a/fs/nfsd/netns.h +++ b/fs/nfsd/netns.h @@ -65,6 +65,8 @@ struct nfsd_net { struct lock_manager nfsd4_manager; bool grace_ended; + bool grace_end_forced; + bool client_tracking_active; time64_t boot_time; struct dentry *nfsd_client_dir; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 435e7dc60903..a813c1123b37 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -84,7 +84,7 @@ static u64 current_sessionid = 1; /* forward declarations */ static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner); static void nfs4_free_ol_stateid(struct nfs4_stid *stid); -void nfsd4_end_grace(struct nfsd_net *nn); +static void nfsd4_end_grace(struct nfsd_net *nn); static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps); static void nfsd4_file_hash_remove(struct nfs4_file *fi); @@ -5902,7 +5902,7 @@ nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return nfs_ok; } -void +static void nfsd4_end_grace(struct nfsd_net *nn) { /* do nothing if grace period already ended */ @@ -5935,6 +5935,20 @@ nfsd4_end_grace(struct nfsd_net *nn) */ } +bool +nfsd4_force_end_grace(struct nfsd_net *nn) +{ + if (!nn->client_tracking_ops) + return false; + spin_lock(&nn->client_lock); + if (nn->client_tracking_active) { + nn->grace_end_forced = true; + mod_delayed_work(laundry_wq, &nn->laundromat_work, 0); + } + spin_unlock(&nn->client_lock); + return true; +} + /* * If we've waited a lease period but there are still clients trying to * reclaim, wait a little longer to give them a chance to finish. @@ -5944,6 +5958,8 @@ static bool clients_still_reclaiming(struct nfsd_net *nn) time64_t double_grace_period_end = nn->boot_time + 2 * nn->nfsd4_lease; + if (nn->grace_end_forced) + return false; if (nn->track_reclaim_completes && atomic_read(&nn->nr_reclaim_complete) == nn->reclaim_str_hashtbl_size) @@ -8175,6 +8191,8 @@ static int nfs4_state_create_net(struct net *net) nn->unconf_name_tree = RB_ROOT; nn->boot_time = ktime_get_real_seconds(); nn->grace_ended = false; + nn->grace_end_forced = false; + nn->client_tracking_active = false; nn->nfsd4_manager.block_opens = true; INIT_LIST_HEAD(&nn->nfsd4_manager.list); INIT_LIST_HEAD(&nn->client_lru); @@ -8255,6 +8273,10 @@ nfs4_state_start_net(struct net *net) return ret; locks_start_grace(net, &nn->nfsd4_manager); nfsd4_client_tracking_init(net); + /* safe for laundromat to run now */ + spin_lock(&nn->client_lock); + nn->client_tracking_active = true; + spin_unlock(&nn->client_lock); if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0) goto skip_grace; printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n", @@ -8301,6 +8323,9 @@ nfs4_state_shutdown_net(struct net *net) shrinker_free(nn->nfsd_client_shrinker); cancel_work_sync(&nn->nfsd_shrinker_work); + spin_lock(&nn->client_lock); + nn->client_tracking_active = false; + spin_unlock(&nn->client_lock); cancel_delayed_work_sync(&nn->laundromat_work); locks_end_grace(&nn->nfsd4_manager); diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 887035b74467..ba8d653de273 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -1110,10 +1110,9 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size) case 'Y': case 'y': case '1': - if (!nn->nfsd_serv) + if (!nfsd4_force_end_grace(nn)) return -EBUSY; trace_nfsd_end_grace(netns(file)); - nfsd4_end_grace(nn); break; default: return -EINVAL; diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index cbddcf484dba..5da7785609b0 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -717,7 +717,7 @@ static inline void get_nfs4_file(struct nfs4_file *fi) struct nfsd_file *find_any_file(struct nfs4_file *f); /* grace period management */ -void nfsd4_end_grace(struct nfsd_net *nn); +bool nfsd4_force_end_grace(struct nfsd_net *nn); /* nfs4recover operations */ extern int nfsd4_client_tracking_init(struct net *net); -- 2.46.1

2 1

[PATCH OLK-5.10] drm/vmwgfx: Fix Use-after-free in validation
by Lin Ruifeng 25 Nov '25

25 Nov '25

From: Ian Forbes <ian.forbes(a)broadcom.com> stable inclusion from stable-v5.10.246 commit fb7165e5f3b3b10721ff70553583ad12e90e447a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6794 CVE: CVE-2025-40111 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely. Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") Reported-by: Kuzey Arda Bulut <kuzeyardabulut(a)gmail.com> Signed-off-by: Ian Forbes <ian.forbes(a)broadcom.com> Reviewed-by: Zack Rusin <zack.rusin(a)broadcom.com> Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c index e69bc373ae2e..535d1ab1a52f 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c @@ -342,8 +342,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, } } node->res = vmw_resource_reference_unless_doomed(res); - if (!node->res) + if (!node->res) { + hash_del_rcu(&node->hash.head); return -ESRCH; + } node->first_usage = 1; if (!res->dev_priv->has_mob) { -- 2.43.0

2 1

[PATCH OLK-6.6] drm/vmwgfx: Fix Use-after-free in validation
by Lin Ruifeng 25 Nov '25

25 Nov '25

From: Ian Forbes <ian.forbes(a)broadcom.com> stable inclusion from stable-v6.6.113 commit 867bda5d95d36f10da398fd4409e21c7002b2332 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6794 CVE: CVE-2025-40111 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely. Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") Reported-by: Kuzey Arda Bulut <kuzeyardabulut(a)gmail.com> Signed-off-by: Ian Forbes <ian.forbes(a)broadcom.com> Reviewed-by: Zack Rusin <zack.rusin(a)broadcom.com> Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c index aaacbdcbd742..a4a11e725d18 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c @@ -326,8 +326,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key); } node->res = vmw_resource_reference_unless_doomed(res); - if (!node->res) + if (!node->res) { + hash_del_rcu(&node->hash.head); return -ESRCH; + } node->first_usage = 1; if (!res->dev_priv->has_mob) { -- 2.43.0

2 1

[openeuler:OLK-6.6 3316/3316] crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'data' not described in 'pgp_parse_packets'
by kernel test robot 25 Nov '25

25 Nov '25

Hi David, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 041fb9446ce5643d6c19a4b5bcbb3068054a42fd commit: b78af6579e15dcdff86504da90af77f3e890270e [3316/3316] PGPLIB: Basic packet parser config: x86_64-buildonly-randconfig-002-20251125 (https://download.01.org/0day-ci/archive/20251125/202511250630.aTlUN4lt-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250630.aTlUN4lt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250630.aTlUN4lt-lkp@intel.com/ All warnings (new ones prefixed by >>): >> crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'data' not described in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'datalen' not described in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Excess function parameter '_data' description in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Excess function parameter '_datalen' description in 'pgp_parse_packets' vim +189 crypto/asymmetric_keys/pgp_library.c 178 179 /** 180 * pgp_parse_packets - Parse a set of PGP packets 181 * @_data: Data to be parsed (updated) 182 * @_datalen: Amount of data (updated) 183 * @ctx: Parsing context 184 * 185 * Parse a set of PGP packets [RFC 4880: 4]. 186 */ 187 int pgp_parse_packets(const u8 *data, size_t datalen, 188 struct pgp_parse_context *ctx) > 189 { 190 enum pgp_packet_tag type; 191 ssize_t pktlen; 192 u8 headerlen; 193 int ret; 194 195 while (datalen > 2) { 196 pktlen = pgp_parse_packet_header(&data, &datalen, &type, 197 &headerlen); 198 if (pktlen < 0) 199 return pktlen; 200 201 if ((ctx->types_of_interest >> type) & 1) { 202 ret = ctx->process_packet(ctx, type, headerlen, 203 data, pktlen); 204 if (ret < 0) 205 return ret; 206 } 207 data += pktlen; 208 datalen -= pktlen; 209 } 210 211 if (datalen != 0) { 212 pr_debug("Excess octets in packet stream\n"); 213 return -EBADMSG; 214 } 215 216 return 0; 217 } 218 EXPORT_SYMBOL_GPL(pgp_parse_packets); 219 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3316/3316] kernel/xsched/cgroup.c:327:34: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration
by kernel test robot 25 Nov '25

25 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 041fb9446ce5643d6c19a4b5bcbb3068054a42fd commit: 43bbefc53356009d3603faa2c6e6a2858f724e4d [3316/3316] xsched: Add XCU control group implementation and its backend in xsched CFS config: x86_64-buildonly-randconfig-003-20251125 (https://download.01.org/0day-ci/archive/20251125/202511250338.G8XPRtIi-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250338.G8XPRtIi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250338.G8XPRtIi-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/xsched/cgroup.c:21: include/linux/xsched.h:265:36: error: field 'css' has incomplete type 265 | struct cgroup_subsys_state css; | ^~~ In file included from include/linux/container_of.h:5, from include/linux/kernel.h:22, from arch/x86/include/asm/percpu.h:27, from arch/x86/include/asm/current.h:10, from include/linux/sched.h:12, from include/linux/cgroup.h:12, from kernel/xsched/cgroup.c:18: kernel/xsched/cgroup.c: In function 'xcu_cg_from_css': include/linux/compiler_types.h:411:27: error: expression in static assertion is not an integer 411 | #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:78:56: note: in definition of macro '__static_assert' 78 | #define __static_assert(expr, msg, ...) _Static_assert(expr, msg) | ^~~~ include/linux/container_of.h:20:9: note: in expansion of macro 'static_assert' 20 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \ | ^~~~~~~~~~~~~ include/linux/container_of.h:20:23: note: in expansion of macro '__same_type' 20 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \ | ^~~~~~~~~~~ kernel/xsched/cgroup.c:184:22: note: in expansion of macro 'container_of' 184 | return css ? container_of(css, struct xsched_group, css) : NULL; | ^~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_css_online': kernel/xsched/cgroup.c:254:53: error: invalid use of undefined type 'struct cgroup_subsys_state' 254 | struct cgroup_subsys_state *parent_css = css->parent; | ^~ kernel/xsched/cgroup.c: At top level: >> kernel/xsched/cgroup.c:327:34: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration 327 | static int xcu_can_attach(struct cgroup_taskset *tset) | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_can_attach': kernel/xsched/cgroup.c:335:9: error: implicit declaration of function 'cgroup_taskset_for_each'; did you mean 'cgroup_task_frozen'? [-Wimplicit-function-declaration] 335 | cgroup_taskset_for_each(task, dst_css, tset) { | ^~~~~~~~~~~~~~~~~~~~~~~ | cgroup_task_frozen kernel/xsched/cgroup.c:335:53: error: expected ';' before '{' token 335 | cgroup_taskset_for_each(task, dst_css, tset) { | ^~ | ; >> kernel/xsched/cgroup.c:333:13: warning: unused variable 'ret' [-Wunused-variable] 333 | int ret = 0; | ^~~ >> kernel/xsched/cgroup.c:332:34: warning: unused variable 'entry' [-Wunused-variable] 332 | struct xcg_attach_entry *entry; | ^~~~~ >> kernel/xsched/cgroup.c:331:40: warning: unused variable 'dst_xcg' [-Wunused-variable] 331 | struct xsched_group *old_xcg, *dst_xcg; | ^~~~~~~ >> kernel/xsched/cgroup.c:331:30: warning: unused variable 'old_xcg' [-Wunused-variable] 331 | struct xsched_group *old_xcg, *dst_xcg; | ^~~~~~~ >> kernel/xsched/cgroup.c:330:47: warning: unused variable 'old_css' [-Wunused-variable] 330 | struct cgroup_subsys_state *dst_css, *old_css; | ^~~~~~~ >> kernel/xsched/cgroup.c:355:1: warning: no return statement in function returning non-void [-Wreturn-type] 355 | } | ^ kernel/xsched/cgroup.c: At top level: kernel/xsched/cgroup.c:357:38: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration 357 | static void xcu_cancel_attach(struct cgroup_taskset *tset) | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:368:6: warning: no previous prototype for 'xcu_move_task' [-Wmissing-prototypes] 368 | void xcu_move_task(struct task_struct *task, struct xsched_group *old_xcg, | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:401:31: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration 401 | static void xcu_attach(struct cgroup_taskset *tset) | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xsched_group_inherit': kernel/xsched/cgroup.c:432:15: error: implicit declaration of function 'task_get_css' [-Wimplicit-function-declaration] 432 | css = task_get_css(task, xcu_cgrp_id); | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:432:34: error: 'xcu_cgrp_id' undeclared (first use in this function) 432 | css = task_get_css(task, xcu_cgrp_id); | ^~~~~~~~~~~ kernel/xsched/cgroup.c:432:34: note: each undeclared identifier is reported only once for each function it appears in kernel/xsched/cgroup.c: In function 'xcu_sched_class_show': kernel/xsched/cgroup.c:440:43: error: implicit declaration of function 'seq_css' [-Wimplicit-function-declaration] 440 | struct cgroup_subsys_state *css = seq_css(sf); | ^~~~~~~ kernel/xsched/cgroup.c:440:43: error: initialization of 'struct cgroup_subsys_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] kernel/xsched/cgroup.c: In function 'xcu_sched_class_write': kernel/xsched/cgroup.c:490:43: error: implicit declaration of function 'of_css' [-Wimplicit-function-declaration] 490 | struct cgroup_subsys_state *css = of_css(of); | ^~~~~~ kernel/xsched/cgroup.c:490:43: error: initialization of 'struct cgroup_subsys_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] kernel/xsched/cgroup.c:508:29: error: invalid use of undefined type 'struct cgroup_subsys_state' 508 | if (!list_empty(&css->children)) | ^~ kernel/xsched/cgroup.c: At top level: >> kernel/xsched/cgroup.c:520:65: warning: 'struct cftype' declared inside parameter list will not be visible outside of this definition or declaration 520 | static s64 xcu_read_s64(struct cgroup_subsys_state *css, struct cftype *cft) | ^~~~~~ kernel/xsched/cgroup.c: In function 'xcu_read_s64': kernel/xsched/cgroup.c:525:20: error: invalid use of undefined type 'struct cftype' 525 | switch (cft->private) { | ^~ In file included from include/linux/kernel.h:31: kernel/xsched/cgroup.c:530:63: error: invalid use of undefined type 'struct cftype' 530 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~ include/linux/printk.h:427:33: note: in definition of macro 'printk_index_wrap' 427 | _p_func(_fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ include/linux/printk.h:498:9: note: in expansion of macro 'printk' 498 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~ include/linux/xsched.h:20:9: note: in expansion of macro 'pr_err' 20 | pr_err(pr_fmt(XSCHED_ERR_PREFIX fmt), ##__VA_ARGS__) | ^~~~~~ kernel/xsched/cgroup.c:530:17: note: in expansion of macro 'XSCHED_ERR' 530 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~~~~~~~~~ kernel/xsched/cgroup.c: At top level: kernel/xsched/cgroup.c:581:66: warning: 'struct cftype' declared inside parameter list will not be visible outside of this definition or declaration 581 | static int xcu_write_s64(struct cgroup_subsys_state *css, struct cftype *cft, | ^~~~~~ kernel/xsched/cgroup.c: In function 'xcu_write_s64': kernel/xsched/cgroup.c:587:20: error: invalid use of undefined type 'struct cftype' 587 | switch (cft->private) { | ^~ kernel/xsched/cgroup.c:597:63: error: invalid use of undefined type 'struct cftype' 597 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~ include/linux/printk.h:427:33: note: in definition of macro 'printk_index_wrap' 427 | _p_func(_fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ include/linux/printk.h:498:9: note: in expansion of macro 'printk' 498 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~ include/linux/xsched.h:20:9: note: in expansion of macro 'pr_err' 20 | pr_err(pr_fmt(XSCHED_ERR_PREFIX fmt), ##__VA_ARGS__) | ^~~~~~ kernel/xsched/cgroup.c:597:17: note: in expansion of macro 'XSCHED_ERR' 597 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_stat': kernel/xsched/cgroup.c:607:43: error: initialization of 'struct cgroup_subsys_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 607 | struct cgroup_subsys_state *css = seq_css(sf); | ^~~~~~~ kernel/xsched/cgroup.c: At top level: kernel/xsched/cgroup.c:630:22: error: array type has incomplete element type 'struct cftype' 630 | static struct cftype xcu_cg_files[] = { | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:633:26: error: 'CFTYPE_NOT_ON_ROOT' undeclared here (not in a function) 633 | .flags = CFTYPE_NOT_ON_ROOT, | ^~~~~~~~~~~~~~~~~~ kernel/xsched/cgroup.c:651:8: error: variable 'xcu_cgrp_subsys' has initializer but incomplete type 651 | struct cgroup_subsys xcu_cgrp_subsys = { | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:652:10: error: 'struct cgroup_subsys' has no member named 'css_alloc' 652 | .css_alloc = xcu_css_alloc, | ^~~~~~~~~ >> kernel/xsched/cgroup.c:652:22: warning: excess elements in struct initializer 652 | .css_alloc = xcu_css_alloc, | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:652:22: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:653:10: error: 'struct cgroup_subsys' has no member named 'css_online' 653 | .css_online = xcu_css_online, | ^~~~~~~~~~ kernel/xsched/cgroup.c:653:23: warning: excess elements in struct initializer 653 | .css_online = xcu_css_online, | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:653:23: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:654:10: error: 'struct cgroup_subsys' has no member named 'css_offline' 654 | .css_offline = xcu_css_offline, | ^~~~~~~~~~~ kernel/xsched/cgroup.c:654:24: warning: excess elements in struct initializer 654 | .css_offline = xcu_css_offline, | ^~~~~~~~~~~~~~~ kernel/xsched/cgroup.c:654:24: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:655:10: error: 'struct cgroup_subsys' has no member named 'css_free' 655 | .css_free = xcu_css_free, | ^~~~~~~~ kernel/xsched/cgroup.c:655:21: warning: excess elements in struct initializer 655 | .css_free = xcu_css_free, | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:655:21: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:656:10: error: 'struct cgroup_subsys' has no member named 'can_attach' 656 | .can_attach = xcu_can_attach, | ^~~~~~~~~~ kernel/xsched/cgroup.c:656:23: warning: excess elements in struct initializer 656 | .can_attach = xcu_can_attach, | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:656:23: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:657:10: error: 'struct cgroup_subsys' has no member named 'cancel_attach' 657 | .cancel_attach = xcu_cancel_attach, | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:657:26: warning: excess elements in struct initializer 657 | .cancel_attach = xcu_cancel_attach, | ^~~~~~~~~~~~~~~~~ kernel/xsched/cgroup.c:657:26: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:658:10: error: 'struct cgroup_subsys' has no member named 'attach' 658 | .attach = xcu_attach, | ^~~~~~ kernel/xsched/cgroup.c:658:19: warning: excess elements in struct initializer 658 | .attach = xcu_attach, | ^~~~~~~~~~ kernel/xsched/cgroup.c:658:19: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:659:10: error: 'struct cgroup_subsys' has no member named 'dfl_cftypes' 659 | .dfl_cftypes = xcu_cg_files, | ^~~~~~~~~~~ kernel/xsched/cgroup.c:659:24: warning: excess elements in struct initializer 659 | .dfl_cftypes = xcu_cg_files, | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:659:24: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:660:10: error: 'struct cgroup_subsys' has no member named 'legacy_cftypes' 660 | .legacy_cftypes = xcu_cg_files, | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:660:27: warning: excess elements in struct initializer 660 | .legacy_cftypes = xcu_cg_files, | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:660:27: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:661:10: error: 'struct cgroup_subsys' has no member named 'early_init' 661 | .early_init = false, | ^~~~~~~~~~ kernel/xsched/cgroup.c:661:23: warning: excess elements in struct initializer 661 | .early_init = false, | ^~~~~ kernel/xsched/cgroup.c:661:23: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:651:22: error: storage size of 'xcu_cgrp_subsys' isn't known 651 | struct cgroup_subsys xcu_cgrp_subsys = { | ^~~~~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_cg_from_css': >> kernel/xsched/cgroup.c:185:1: warning: control reaches end of non-void function [-Wreturn-type] 185 | } | ^ kernel/xsched/cgroup.c: At top level: >> kernel/xsched/cgroup.c:630:22: warning: 'xcu_cg_files' defined but not used [-Wunused-variable] 630 | static struct cftype xcu_cg_files[] = { | ^~~~~~~~~~~~ >> kernel/xsched/cgroup.c:309:12: warning: 'xcu_task_can_attach' defined but not used [-Wunused-function] 309 | static int xcu_task_can_attach(struct task_struct *task, | ^~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] vim +327 kernel/xsched/cgroup.c 181 182 inline struct xsched_group *xcu_cg_from_css(struct cgroup_subsys_state *css) 183 { 184 return css ? container_of(css, struct xsched_group, css) : NULL; > 185 } 186 187 /* 188 * Determine whether the given css corresponds to root_xsched_group.css. 189 * 190 * Parameter only_css_self: 191 * - true : Only check whether the css pointer itself is NULL 192 * (i.e., the subsystem root). Do not dereference xg->parent. 193 * Used in the allocation path (css_alloc). 194 * - false : Further check whether the associated xsched_group 195 * has no parent (i.e., a normal root check). 196 */ 197 static inline bool xsched_group_css_is_root(struct cgroup_subsys_state *css, bool only_css_self) 198 { 199 struct xsched_group *xg; 200 201 /* NULL indicates the subsystem root */ 202 if (!css) 203 return true; 204 205 /* 206 * During the allocation phase, 207 * cannot find its parent xsched_group via xg->parent, 208 * so can only determine on the css itself. 209 */ 210 if (only_css_self) 211 return false; 212 213 xg = xcu_cg_from_css(css); 214 215 return xg && !xg->parent; 216 } 217 218 /** 219 * xcu_css_alloc() - Allocate and init xcu cgroup. 220 * @parent_css: css of parent xcu cgroup 221 * 222 * Called from kernel/cgroup.c with cgroup_lock() held. 223 * First called in subsys initialization to create root xcu cgroup, when 224 * XCUs haven't been initialized yet. Func used on every new cgroup creation, 225 * on second call to set root xsched_group runqueue. 226 * 227 * Return: pointer of new xcu cgroup css on success, -ENOMEM otherwise. 228 */ 229 static struct cgroup_subsys_state * 230 xcu_css_alloc(struct cgroup_subsys_state *parent_css) 231 { 232 struct xsched_group *xg; 233 234 if (xsched_group_css_is_root(parent_css, true)) 235 return &root_xsched_group.css; 236 237 xg = kmem_cache_alloc(xsched_group_cache, GFP_KERNEL | __GFP_ZERO); 238 if (!xg) 239 return ERR_PTR(-ENOMEM); 240 241 return &xg->css; 242 } 243 244 static void xcu_css_free(struct cgroup_subsys_state *css) 245 { 246 struct xsched_group *xcg = xcu_cg_from_css(css); 247 248 kmem_cache_free(xsched_group_cache, xcg); 249 } 250 251 static int xcu_css_online(struct cgroup_subsys_state *css) 252 { 253 struct xsched_group *xg = xcu_cg_from_css(css); 254 struct cgroup_subsys_state *parent_css = css->parent; 255 struct xsched_group *parent_xg; 256 int err; 257 258 if (!parent_css) 259 return 0; 260 261 parent_xg = xcu_cg_from_css(parent_css); 262 err = xcu_cg_init(xg, parent_xg); 263 if (err) { 264 kmem_cache_free(xsched_group_cache, xg); 265 XSCHED_ERR("Failed to initialize new xsched_group @ %s.\n", __func__); 266 return err; 267 } 268 269 return 0; 270 } 271 272 static void xcu_css_offline(struct cgroup_subsys_state *css) 273 { 274 struct xsched_group *xcg; 275 276 xcg = xcu_cg_from_css(css); 277 if (!xsched_group_css_is_root(css, false)) { 278 switch (xcg->sched_class) { 279 case XSCHED_TYPE_CFS: 280 xcu_cfs_cg_deinit(xcg); 281 break; 282 default: 283 XSCHED_INFO("xcu_cgroup: deinit RT group css=0x%lx\n", 284 (uintptr_t)&xcg->css); 285 break; 286 } 287 } 288 list_del(&xcg->group_node); 289 } 290 291 static void xsched_group_xse_attach(struct xsched_group *xg, 292 struct xsched_entity *xse) 293 { 294 spin_lock(&xg->lock); 295 list_add_tail(&xse->group_node, &xg->members); 296 spin_unlock(&xg->lock); 297 xse->parent_grp = xg; 298 } 299 300 void xsched_group_xse_detach(struct xsched_entity *xse) 301 { 302 struct xsched_group *xcg = xse->parent_grp; 303 304 spin_lock(&xcg->lock); 305 list_del(&xse->group_node); 306 spin_unlock(&xcg->lock); 307 } 308 > 309 static int xcu_task_can_attach(struct task_struct *task, 310 struct xsched_group *old) 311 { 312 struct xsched_entity *xse; 313 bool has_xse = false; 314 315 spin_lock(&old->lock); 316 list_for_each_entry(xse, &old->members, group_node) { 317 if (xse->owner_pid == task_pid_nr(task)) { 318 has_xse = true; 319 break; 320 } 321 } 322 spin_unlock(&old->lock); 323 324 return has_xse ? -EINVAL : 0; 325 } 326 > 327 static int xcu_can_attach(struct cgroup_taskset *tset) 328 { 329 struct task_struct *task; > 330 struct cgroup_subsys_state *dst_css, *old_css; > 331 struct xsched_group *old_xcg, *dst_xcg; > 332 struct xcg_attach_entry *entry; > 333 int ret = 0; 334 335 cgroup_taskset_for_each(task, dst_css, tset) { 336 rcu_read_lock(); 337 old_css = task_css(task, xcu_cgrp_id); 338 rcu_read_unlock(); 339 dst_xcg = xcu_cg_from_css(dst_css); 340 old_xcg = xcu_cg_from_css(old_css); 341 342 ret = xcu_task_can_attach(task, old_xcg); 343 if (ret) 344 break; 345 346 /* record entry for this task */ 347 entry = kmem_cache_alloc(xcg_attach_entry_cache, GFP_KERNEL | __GFP_ZERO); 348 entry->task = task; 349 entry->old_xcg = old_xcg; 350 entry->new_xcg = dst_xcg; 351 list_add_tail(&entry->node, &xcg_attach_list); 352 } 353 354 return ret; > 355 } 356 357 static void xcu_cancel_attach(struct cgroup_taskset *tset) 358 { 359 struct xcg_attach_entry *entry, *tmp; 360 361 /* error: clear all entries */ 362 list_for_each_entry_safe(entry, tmp, &xcg_attach_list, node) { 363 list_del(&entry->node); 364 kmem_cache_free(xcg_attach_entry_cache, entry); 365 } 366 } 367 368 void xcu_move_task(struct task_struct *task, struct xsched_group *old_xcg, 369 struct xsched_group *new_xcg) 370 { 371 struct xsched_entity *xse, *tmp; 372 struct xsched_cu *xcu; 373 374 spin_lock(&old_xcg->lock); 375 list_for_each_entry_safe(xse, tmp, &old_xcg->members, group_node) { 376 if (xse->owner_pid != task_pid_nr(task)) 377 continue; 378 379 xcu = xse->xcu; 380 381 if (old_xcg != xse->parent_grp) { 382 WARN_ON(old_xcg != xse->parent_grp); 383 return; 384 } 385 386 /* delete from the old_xcg */ 387 list_del(&xse->group_node); 388 389 mutex_lock(&xcu->xcu_lock); 390 /* dequeue from the current runqueue */ 391 dequeue_ctx(xse, xcu); 392 /* attach to the new_xcg */ 393 xsched_group_xse_attach(new_xcg, xse); 394 /* enqueue to the runqueue in new_xcg */ 395 enqueue_ctx(xse, xcu); 396 mutex_unlock(&xcu->xcu_lock); 397 } 398 spin_unlock(&old_xcg->lock); 399 } 400 401 static void xcu_attach(struct cgroup_taskset *tset) 402 { 403 struct xcg_attach_entry *entry, *tmp; 404 405 list_for_each_entry(entry, &xcg_attach_list, node) { 406 xcu_move_task(entry->task, entry->old_xcg, entry->new_xcg); 407 } 408 409 /* cleanup */ 410 list_for_each_entry_safe(entry, tmp, &xcg_attach_list, node) { 411 list_del(&entry->node); 412 kmem_cache_free(xcg_attach_entry_cache, entry); 413 } 414 } 415 416 /** 417 * xsched_group_inherit() - Attach new entity to task's xsched_group. 418 * @task: task_struct 419 * @xse: xsched entity 420 * 421 * Called in xsched context initialization to attach xse to task's group 422 * and inherit its xse scheduling class and bandwidth control policy. 423 * 424 * Return: Zero on success. 425 */ 426 void xsched_group_inherit(struct task_struct *task, struct xsched_entity *xse) 427 { 428 struct cgroup_subsys_state *css; 429 struct xsched_group *xg; 430 431 xse->owner_pid = task_pid_nr(task); 432 css = task_get_css(task, xcu_cgrp_id); 433 xg = xcu_cg_from_css(css); 434 xsched_group_xse_attach(xg, xse); 435 css_put(css); 436 } 437 438 static int xcu_sched_class_show(struct seq_file *sf, void *v) 439 { 440 struct cgroup_subsys_state *css = seq_css(sf); 441 struct xsched_group *xg = xcu_cg_from_css(css); 442 443 seq_printf(sf, "%s\n", xcu_sched_name[xg->sched_class]); 444 return 0; 445 } 446 447 /** 448 * xcu_cg_set_sched_class() - Set scheduling type for group. 449 * @xg: xsched group 450 * @type: scheduler type 451 * 452 * Scheduler type can be changed if task is child of root group 453 * and haven't got scheduling entities. 454 * 455 * Return: Zero on success or -EINVAL 456 */ 457 static int xcu_cg_set_sched_class(struct xsched_group *xg, int type) 458 { 459 if (type == xg->sched_class) 460 return 0; 461 462 /* can't change scheduler when there are running members */ 463 if (!list_empty(&xg->members)) 464 return -EBUSY; 465 466 /* deinit old type if necessary */ 467 switch (xg->sched_class) { 468 case XSCHED_TYPE_CFS: 469 xcu_cfs_cg_deinit(xg); 470 break; 471 default: 472 break; 473 } 474 475 /* update type */ 476 xg->sched_class = type; 477 478 /* init new type if necessary */ 479 switch (type) { 480 case XSCHED_TYPE_CFS: 481 return xcu_cfs_cg_init(xg, xg->parent); 482 default: 483 return 0; 484 } 485 } 486 487 static ssize_t xcu_sched_class_write(struct kernfs_open_file *of, char *buf, 488 size_t nbytes, loff_t off) 489 { 490 struct cgroup_subsys_state *css = of_css(of); 491 struct xsched_group *xg = xcu_cg_from_css(css); 492 char type_name[4]; 493 int type = -1; 494 495 ssize_t ret = sscanf(buf, "%3s", type_name); 496 497 if (ret < 1) 498 return -EINVAL; 499 500 for (type = 0; type < XSCHED_TYPE_NUM; type++) { 501 if (!strcmp(type_name, xcu_sched_name[type])) 502 break; 503 } 504 505 if (type == XSCHED_TYPE_NUM) 506 return -EINVAL; 507 508 if (!list_empty(&css->children)) 509 return -EBUSY; 510 511 /* only root child can switch scheduler type */ 512 if (!xg->parent || !xsched_group_css_is_root(&xg->parent->css, false)) 513 return -EINVAL; 514 515 ret = xcu_cg_set_sched_class(xg, type); 516 517 return (ret) ? ret : nbytes; 518 } 519 > 520 static s64 xcu_read_s64(struct cgroup_subsys_state *css, struct cftype *cft) 521 { 522 s64 ret = 0; 523 struct xsched_group *xcucg = xcu_cg_from_css(css); 524 525 switch (cft->private) { 526 case XCU_FILE_SHARES: 527 ret = xcucg->shares_cfg; 528 break; 529 default: 530 XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); 531 break; 532 } 533 534 return ret; 535 } 536 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0