- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] drm/amdkfd: fix SMI event cross-process information leak
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Yongqiang Sun <Yongqiang.Sun(a)amd.com> mainline inclusion from mainline-v7.2-rc1 commit 92a8dba246d371fe268280e5fd74b0955688e6df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19653 CVE: CVE-2026-97422 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers. Signed-off-by: Yongqiang Sun <Yongqiang.Sun(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c [Commit b8f67b9ddf4f changed vm->task_info to flat fields (task_info->pid/tgid/task_name), so pass task_info->tgid as the SMI client pid filter instead of task_info->task.tgid. The kfd_smi_event_process()/PROCESS_START|END path does not exist in this tree, so only the VMFAULT caller is adapted.] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c index 06ac835190f9..4e374c0e5a52 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c @@ -244,8 +244,9 @@ void kfd_smi_event_update_vmfault(struct kfd_node *dev, uint16_t pasid) if (task_info) { /* Report VM faults from user applications, not retry from kernel */ if (task_info->pid) - kfd_smi_event_add(0, dev, KFD_SMI_EVENT_VMFAULT, "%x:%s\n", - task_info->pid, task_info->task_name); + kfd_smi_event_add(task_info->tgid, dev, + KFD_SMI_EVENT_VMFAULT, "%x:%s\n", + task_info->pid, task_info->task_name); amdgpu_vm_put_task_info(task_info); } } -- 2.22.0

2 1

[PATCH OLK-6.6] drm/amdkfd: fix SMI event cross-process information leak
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Yongqiang Sun <Yongqiang.Sun(a)amd.com> mainline inclusion from mainline-v7.2-rc1 commit 92a8dba246d371fe268280e5fd74b0955688e6df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19653 CVE: CVE-2026-97422 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers. Signed-off-by: Yongqiang Sun <Yongqiang.Sun(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c [Commit b8f67b9ddf4f changed vm->task_info to flat fields (task_info->pid/tgid/task_name), so pass task_info->tgid as the SMI client pid filter instead of task_info->task.tgid. The kfd_smi_event_process()/PROCESS_START|END path does not exist in this tree, so only the VMFAULT caller is adapted.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c index 06ac835190f9..4e374c0e5a52 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c @@ -244,8 +244,9 @@ void kfd_smi_event_update_vmfault(struct kfd_node *dev, uint16_t pasid) if (task_info) { /* Report VM faults from user applications, not retry from kernel */ if (task_info->pid) - kfd_smi_event_add(0, dev, KFD_SMI_EVENT_VMFAULT, "%x:%s\n", - task_info->pid, task_info->task_name); + kfd_smi_event_add(task_info->tgid, dev, + KFD_SMI_EVENT_VMFAULT, "%x:%s\n", + task_info->pid, task_info->task_name); amdgpu_vm_put_task_info(task_info); } } -- 2.22.0

2 1

[PATCH OLK-5.10 0/2] CVE-2026-97563 and CVE-2026-97565
by Yifan Qiao 22 Oct '26

22 Oct '26

Diego Oliva (2): smb: client: reject short READ responses in CIFSSMBRead() smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() fs/cifs/cifssmb.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()
by Yifan Qiao 22 Oct '26

22 Oct '26

From: Diego Oliva <diego(a)bynar.io> mainline inclusion from mainline-v7.3-rc3 commit 5be5bdda5863eacc964b609ba927764f253431b3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20155 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The SMB1 synchronous read helper CIFSSMBRead() validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy source is formed as &pSMBr->hdr.Protocol + le16_to_cpu(pSMBr->DataOffset) and memcpy()'d for DataLength bytes with no check that the [DataOffset, DataOffset + DataLength) range lies within the response actually received from the server. A malicious or compromised SMB1 server can return a response carrying an in-range DataLength and a large DataOffset, driving the source pointer past the end of the response buffer. The memcpy() then copies adjacent kernel heap into the caller's read buffer (information disclosure), or reads unmapped memory and oopses (denial of service). SMB1 is not negotiated by default; reaching this code requires an explicit vers=1.0 mount. Both DataOffset and the received response length recorded in rsp_iov.iov_len are relative to the start of the SMB header, so reject the response unless DataOffset + DataLength fits within that length, using overflow-safe arithmetic, before forming the source pointer. The response length has been validated by the previous patch, so the DataOffset and DataLength fields can be read safely here. While here, make data_length unsigned. It holds a length derived from unsigned on-the-wire fields and is only ever compared against unsigned quantities; print it with %u accordingly, and add __func__ to the cifs_dbg() calls in this function. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org # 6.19.x Assisted-by: Bynario AI Signed-off-by: Diego Oliva <diego(a)bynar.io> Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Conflicts: fs/smb/client/cifssmb.c fs/smb/client/trace.h [Context differences.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/cifssmb.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c index 60f333f6fa02..4c0a2d410f9a 100644 --- a/fs/smb/client/cifssmb.c +++ b/fs/smb/client/cifssmb.c @@ -1456,7 +1456,8 @@ CIFSSMBRead(const unsigned int xid, struct cifs_io_parms *io_parms, rc = -EIO; *nbytes = 0; } else { - int data_length = le16_to_cpu(pSMBr->DataLengthHigh); + unsigned int data_length = le16_to_cpu(pSMBr->DataLengthHigh); + __u16 data_offset = le16_to_cpu(pSMBr->DataOffset); data_length = data_length << 16; data_length += le16_to_cpu(pSMBr->DataLength); *nbytes = data_length; @@ -1464,13 +1465,19 @@ CIFSSMBRead(const unsigned int xid, struct cifs_io_parms *io_parms, /*check that DataLength would not go beyond end of SMB */ if ((data_length > CIFSMaxBufSize) || (data_length > count)) { - cifs_dbg(FYI, "bad length %d for count %d\n", - data_length, count); + cifs_dbg(FYI, "%s: bad length %u for count %u\n", + __func__, data_length, count); + rc = -EIO; + *nbytes = 0; + } else if (4 + data_offset < sizeof(*pSMBr) || + 4 + (size_t)data_offset + data_length > rsp_iov.iov_len) { + /* check that the data lies within the received response */ + cifs_dbg(FYI, "%s: bad data offset %u length %u for response of %zu\n", + __func__, data_offset, data_length, rsp_iov.iov_len); rc = -EIO; *nbytes = 0; } else { - pReadData = (char *) (&pSMBr->hdr.Protocol) + - le16_to_cpu(pSMBr->DataOffset); + pReadData = (char *) (&pSMBr->hdr.Protocol) + data_offset; /* if (rc = copy_to_user(buf, pReadData, data_length)) { cifs_dbg(VFS, "Faulting on read rc = %d\n",rc); rc = -EFAULT; -- 2.52.0

2 1

[PATCH OLK-6.6] io_uring/rw: end write accounting from ->ki_complete
by Yifan Qiao 22 Oct '26

22 Oct '26

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v7.3-rc3 commit 796aa0547557e63338657ed1c487906f9fac4c73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20166 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the io_req_rw_complete() task_work. However, only the fsnotify part actually needed to move as it may sleep. Ending the write accounting is just a percpu_up_read() on the superblock writers sem. Deferring it is a problem, because it makes dropping SB_FREEZE_WRITE protection depend on the ring owner getting to running task_work. But the task may be blocked in freeze_super(), causing it to never get to that: task io-wq worker -------------------------------------------------------------- io_write() io_kiocb_start_write() (takes sb_writers, hidden from lockdep by __sb_writers_release) write_iter() -> -EIOCBQUEUED ioctl(FS_IOC_SHUTDOWN) bdev_freeze() freeze_super() percpu_down_write() <- waits for the reader above io_write() kiocb_start_write() percpu_down_read() <- queued behind the writer <bio completes> io_complete_rw() queues io_req_rw_complete() <- never runs, task is in D state End the write from io_complete_rw() instead, and leave only the fsnotify calls in task_work. Reported-by: syzbot+2eb3d983669d3e49d4fa(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Fixes: b000145e9907 ("io_uring/rw: defer fsnotify calls to task context") Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/rw.c [This tree still has io_req_io_end() (which ends write accounting) on the reissue branch of __io_complete_rw_common(), so the hoisted io_req_end_write() is placed after that branch instead of at the top of io_complete_rw(), avoiding a double sb_end_write() while still ending writes from ->ki_complete.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/rw.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/io_uring/rw.c b/io_uring/rw.c index e550f0618fd2..15dfb9c24613 100644 --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -244,20 +244,25 @@ static void io_req_end_write(struct io_kiocb *req) } } -/* - * Trigger the notifications after having done some IO, and finish the write - * accounting, if any. - */ -static void io_req_io_end(struct io_kiocb *req) +/* Trigger the notifications after having done some IO. */ +static void io_req_io_notify(struct io_kiocb *req) { struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw); - if (rw->kiocb.ki_flags & IOCB_WRITE) { - io_req_end_write(req); + if (rw->kiocb.ki_flags & IOCB_WRITE) fsnotify_modify(req->file); - } else { + else fsnotify_access(req->file); - } +} + +/* Finish write accounting and notify, for inline completions only. */ +static void io_req_io_end(struct io_kiocb *req) +{ + struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw); + + if (rw->kiocb.ki_flags & IOCB_WRITE) + io_req_end_write(req); + io_req_io_notify(req); } static bool __io_complete_rw_common(struct io_kiocb *req, long res) @@ -304,7 +309,7 @@ void io_req_rw_complete(struct io_kiocb *req, struct io_tw_state *ts) io_req_set_res(req, io_fixup_rw_res(req, res), 0); } - io_req_io_end(req); + io_req_io_notify(req); if (req->flags & (REQ_F_BUFFER_SELECTED|REQ_F_BUFFER_RING)) req->cqe.flags |= io_put_kbuf(req, 0); @@ -322,6 +327,12 @@ static void io_complete_rw(struct kiocb *kiocb, long res) return; io_req_set_res(req, io_fixup_rw_res(req, res), 0); } + /* + * End write accounting here rather than in task_work, as the ring + * owner may block in freeze_super() before that runs. + */ + if (kiocb->ki_flags & IOCB_WRITE) + io_req_end_write(req); req->io_task_work.func = io_req_rw_complete; __io_req_task_work_add(req, IOU_F_TWQ_LAZY_WAKE); } -- 2.52.0

2 1

[PATCH OLK-6.6] iommu/amd: Do not reallocate GA log buffers on resume
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Karl Mehltretter <kmehltretter(a)gmail.com> mainline inclusion from mainline-v7.3-rc3 commit 00a7dd64888d6dd72110b40e2824a088cf7b7386 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19847 CVE: CVE-2026-98003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Commit c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement") moved the GA log allocation from iommu_init_pci() to enable_iommus_vapic(), which is called on every resume. iommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail unconditionally. Each resume therefore replaces the boot-time pointers and leaks both old allocations. The function also uses GFP_KERNEL from a syscore resume callback, where interrupts are disabled and the non-boot CPUs are offline. Return early if both buffers are already allocated. Clear the pointers in free_ga_log() so a partial allocation failure cannot leave ga_log dangling. Fixes: c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement") Assisted-by: Claude:claude-opus-5 Signed-off-by: Karl Mehltretter <kmehltretter(a)gmail.com> Reviewed-by: Vasant Hegde <vasant.hegde(a)amd.com> Reviewed-by: Ankit Soni <Ankit.Soni(a)amd.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/amd/init.c [Upstream now uses iommu_alloc_pages_node_sz()/iommu_free_pages() (commit 1e0c8d6b69521 and follow-ups) and WARN_ON_ONCE() for the VAPIC check; this tree predates them, so keep the local __get_free_pages()/free_pages() helpers and the legacy silent !AMD_IOMMU_GUEST_IR_VAPIC() check. Only the early-return guard and the pointer NULLing after free are applied.] Co-authored-by: BackportAgent(a)GLM-5.3 Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/amd/init.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index f57e2a784da4..ff36f3c456fa 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -890,7 +890,9 @@ static void free_ga_log(struct amd_iommu *iommu) { #ifdef CONFIG_IRQ_REMAP iommu_free_pages(iommu->ga_log, get_order(GA_LOG_SIZE)); + iommu->ga_log = NULL; iommu_free_pages(iommu->ga_log_tail, get_order(8)); + iommu->ga_log_tail = NULL; #endif } @@ -935,6 +937,9 @@ static int iommu_init_ga_log(struct amd_iommu *iommu) if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir)) return 0; + if (iommu->ga_log && iommu->ga_log_tail) + return 0; + iommu->ga_log = iommu_alloc_pages(GFP_KERNEL, get_order(GA_LOG_SIZE)); if (!iommu->ga_log) goto err_out; -- 2.22.0

2 1

[PATCH OLK-6.6 00/17] hisilicon: HBM dev/cache fixes and sysfs cleanup
by Ziming Du 22 Oct '26

22 Oct '26

This series fixes several issues in the HiSilicon HBM device/cache drivers and cleans up the hisi_hbmdev sysfs interface. Highlights: - Serialize the ACPI device online/offline path to avoid races. - Protect the PCC operation region with locks in hbmdev/hbmcache. - Prevent hung task via mutex_trylock in hbmcache. - Don't poweroff when memory blocks failed to offline; fix NULL pointer dereference on the offline path. - Add missing locality information for hot-added ACPI/HMAT devices. - Revert the extra memory-topology and ACLS repair/query features and drop the now-unused memdev kobj / state-show sysfs. Bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20607 Dengdui Huang (1): arm64: openeuler_defconfig: add Kunpeng HCCS config Zhang Zekun (13): soc:hisilicon: Use _ON and _OFF in hbmcache hisilicon/hisi_hbmcache: Add a lock to protect pcc operation region hisilicon/hisi_hbmdev: Add lock to protect pcc operation region ACPI/HMAT: Add missing locality information for hot-added device hisilicon/hisi_hbmcache: Use mutex_trylock to prevent hung task soc: hisilicon: Don't poweroff if memblocks don't offlined soc: hisilicon: hisi_hbmdev: Notify the device in the ACPI soc: hisilicon: Setting the demand_offline in sysfs interface hisilicon/hisi_hbmdev: prevent NULL pointer dereference when corrently arm64: config: Open the hbmdev related config soc: hisilicon: hbmdev: Only support built-in soc/hisilicon: Clean the hbmcache state show sysfs soc/hisilicon: Remove the memdev kobj Ziming Du (3): soc: hisilicon: Serialize the online and onfline the acpi devices Revert "soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods" Revert "soc: hisilicon: hisi_hbmdev: Provide extra memory topology information" arch/arm64/configs/openeuler_defconfig | 8 + drivers/acpi/acpi_memhotplug.c | 13 + drivers/acpi/device_sysfs.c | 8 + drivers/acpi/internal.h | 1 + drivers/acpi/numa/hmat.c | 17 ++ drivers/acpi/osl.c | 6 +- drivers/soc/hisilicon/Kconfig | 21 +- drivers/soc/hisilicon/hisi_hbmcache.c | 42 ++- drivers/soc/hisilicon/hisi_hbmdev.c | 346 ++++++------------------- include/linux/acpi.h | 2 + 10 files changed, 160 insertions(+), 304 deletions(-) -- 2.43.0

2 18

[PATCH OLK-6.6] smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
by Zizhi Wo 22 Oct '26

22 Oct '26

From: Paulo Alcantara <pc(a)manguebit.org> stable inclusion from stable-v6.6.160 commit 604feb3e8141bf11f5afd48d36d401fee5af9536 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20147 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit da6e25842431982d5a53cf00d925b98c690f4467 ] cifs_posix_to_fattr() ignores the return value of posix_info_parse(). When a malformed POSIX directory entry is encountered (e.g. invalid SID lengths from an untrusted server), posix_info_parse() returns -1 without populating the 'parsed' struct. The uninitialized stack memory in parsed.owner and parsed.group is then passed to sid_to_id(), which processes the garbage bytes and passes them to request_key() to construct a SID string, potentially leaking kernel stack contents to the userspace idmap daemon. Fix this by checking the return value and skipping the SID-to-id mapping when parsing fails. The remaining fattr fields (timestamps, mode, etc.) are populated directly from the 'info' pointer so they are unaffected. Closes: https://sashiko.dev/#/patchset/20260906172005.627163-1-pc%40manguebit.org Closes: https://sashiko.dev/#/patchset/20260906181540.647469-1-pc%40manguebit.org Reviewed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Cc: Ronnie Sahlberg <ronniesahlberg(a)gmail.com> Cc: Shyam Prasad N <sprasad(a)microsoft.com> Cc: Tom Talpey <tom(a)talpey.com> Cc: Bharath SM <bharathsm(a)microsoft.com> Cc: stable(a)vger.kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/smb/client/readdir.c [Due to commit d49df6ed234c ("smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid") has merged.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/smb/client/readdir.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c index 8e51a525ec81..7b7942f0f53e 100644 --- a/fs/smb/client/readdir.c +++ b/fs/smb/client/readdir.c @@ -241,12 +241,13 @@ static void cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, struct cifs_sb_info *cifs_sb) { unsigned int sbflags = cifs_sb->mnt_cifs_flags; struct smb2_posix_info_parsed parsed; + int rc; - posix_info_parse(info, NULL, &parsed); + rc = posix_info_parse(info, NULL, &parsed); memset(fattr, 0, sizeof(*fattr)); fattr->cf_uniqueid = le64_to_cpu(info->Inode); fattr->cf_bytes = le64_to_cpu(info->AllocationSize); fattr->cf_eof = le64_to_cpu(info->EndOfFile); @@ -281,10 +282,15 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, le32_to_cpu(info->ReparseTag), le32_to_cpu(info->Mode)); fattr->cf_uid = cifs_sb->ctx->linux_uid; fattr->cf_gid = cifs_sb->ctx->linux_gid; + if (rc < 0) { + cifs_dbg(VFS, "%s: failed to parse SIDs: %d\n", + __func__, rc); + return; + } if (!(sbflags & CIFS_MOUNT_OVERR_UID)) sid_to_id(cifs_sb, &parsed.owner, fattr, SIDOWNER); if (!(sbflags & CIFS_MOUNT_OVERR_GID)) sid_to_id(cifs_sb, &parsed.group, fattr, SIDGROUP); } -- 2.52.0

2 1

[PATCH OLK-6.6 v3 00/12] net: dynthread: dynamic threaded NAPI scheduler
by Cai Xinchen 22 Oct '26

22 Oct '26

This series makes the NAPI/queue/IRQ relationship visible to the network stack and then builds net/dynthread on top of it, a loadable module that adapts the NAPI processing and the RX queue IRQ placement of a set of net devices to the scheduling behaviour of a target application at runtime. Motivation ---------- Interrupt and softirq processing of network RX competes with latency sensitive applications (e.g. mysqld) for CPU time. When such an application runs for a long time on a CPU without blocking, the softirq work of the NIC completion queues can preempt it on the same CPU and inflate its tail latency. The usual remedies are to steer the RX queue IRQs to other CPUs and/or to move NAPI processing into kernel threads bound to spare CPUs, but a static configuration cannot follow the application: once the target goes idle, is scheduled in short bursts, or is displaced, the reserved CPUs are simply wasted. To do this from a module, the queue a NAPI instance serves, the NAPI instance of a queue and the interrupt vector of that NAPI must be discoverable. Mainline added that association in v6.8/v6.9 (queue/NAPI pointer, netif_napi_set_irq(), mlx5e conversion and the RTNL fixes that come with it). Patches 1-6 of this series backport that infrastructure and the necessary mlx5e corrections; patches 7-12 add the scheduler. Approach -------- The module periodically samples the scheduling statistics of all threads matching the appname module parameter and classifies them into one of five statuses (DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION, LONG_RUNNING_WITH_INTERRUPTS). Acting on that status it: - restores the RX queue IRQs to their original affinity when the target is gone or barely running; - spreads the IRQs over the NUMA node of their queues when processing in softirq context is acceptable again; - switches the NAPI processing of the configured net devices to kernel threads and binds the NAPI threads (and, optionally, the queue IRQs) to the CPUs of their NUMA node that the target tasks are not allowed to use; - scales the number of CPUs used by those threads with their measured load while the target stays in the long-running status. An unusable sample (counters moved backwards: DATA_LOSS) keeps the previous status, so a single bad sample cannot toggle the mode. Everything is controlled through module parameters, and the original IRQ affinity and NAPI mode are restored when the target disappears, the scheduler is disabled or the module is unloaded. The module is buildable only as a loadable module; the Kconfig entry currently allows ARM64. Patch breakdown --------------- 1/12 net: Add queue and napi association Backport the queue <-> NAPI mapping: add enum netdev_queue_type, a napi pointer to struct netdev_queue and struct netdev_rx_queue, and netif_queue_set_napi() to set or clear it for RX and TX queues. The netdev_queue field is added through the KABI helpers so the layout of the structure is preserved. 2/12 net: Add NAPI IRQ support Add napi->irq and netif_napi_set_irq(), so a driver can publish the interrupt vector that serves a NAPI instance. It is initialized to -1 by netif_napi_add_weight() and stays unknown for drivers that do not call the setter. 3/12 net/mlx5e: link NAPI instances to queues and IRQs Make mlx5e call netif_napi_set_irq() when a channel is opened and register/clear the queue/NAPI association for its RX and TX queues (including the PTP queues) when they are activated/deactivated. This is also what users of the queue GET netlink API expect. 4/12 net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation netif_queue_set_napi() asserts RTNL for a registered netdev, so take the lock in the mlx5e TX reporter recovery paths that activate or deactivate queues without it. 5/12 net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover The RTNL has to be acquired before priv->state_lock in the PTP SQ recovery. Move the lock acquisition up so the order matches the probe and channel switch paths. 6/12 net/mlx5e: Do not block on RTNL while recovering an SQ The recovery callbacks run synchronously from devlink_health_report() under the devlink lock, from SQ work items, while channel teardown holds the RTNL and waits for those work items with cancel_work_sync(). Replace the blocking rtnl_lock() with rtnl_trylock() and abandon the recovery when the SQ has been disabled by the teardown, following the existing mlx5e_tx_timeout_work() pattern. This avoids a deadlock that also stalled all devlink operations on the device. 7/12 net: dynthread: Add dynamic threaded NAPI scheduler framework Wire the new directory into net/Kconfig and net/Makefile, add the NET_DYNTHREAD Kconfig entry and the module skeleton. On load the module takes a reference on each device given with the '#' separated ifname parameter, walks the IRQ descriptor table through the exported irq_get_irq_data(), snapshots desc->action and the effective affinity under desc->lock, and records the IRQ number and the original affinity CPU of every RX queue. IRQs are matched against the device name, its parent device name and the irqname pattern. Also count the NUMA nodes the recorded queues span, drop the device references on unload, and unwind a partially failed init. 8/12 net: dynthread: Monitor the load of the target tasks Add the sampling loop and the status judgement. Every monitored thread whose name matches appname contributes its runtime, voluntary/involuntary context switches and its allowed CPU mask; the masks are unioned to know where the target may run. The sample is compared with the previous one to derive the average runtime per switch, the nvcsw percentage and the CPU load, and to classify it as DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION or LONG_RUNNING_WITH_INTERRUPTS. Add the periodic hrtimer/work worker, the dynthreaded enable/disable parameter, a mutex serializing the worker control, a zeroed baseline on every enable, and the last_status tracking used to carry the transition sample. 9/12 net: dynthread: Steer the RX queue IRQs away from the target tasks Manage the affinity of the recorded RX queue IRQs. When the target tasks sit in a single NUMA node and enough CPUs of that node are free, move all queue IRQs there round-robin; when the target is gone or barely running, restore the affinity recorded at load time; when the target is fragmented, spread the IRQs over a subset of their own NUMA node sized from dyn_threaded_irq_cpucore_per. Track the "bound to one node" state so spreading is suppressed while it is active, and clear it on every recovery. All of this is skipped when dyn_threaded_bindirq is off, and the IRQ affinity is restored when the worker is stopped. 10/12 net: dynthread: Switch NAPI to threads on spare CPUs Enable threaded NAPI (dev_set_threaded) on the monitored devices in LONG_RUNNING_WITH_INTERRUPTS and bind each NAPI thread from the NUMA node of its queue IRQ: use the whole node if the target is not there, the target-free CPUs of the node if any, otherwise the first dyn_threaded_corenum CPUs of the node. Use napi->irq when the driver published it and fall back to the RX queue IRQ recorded by the module (e.g. hns3) otherwise. Optionally bind the queue IRQ to the same mask. Record the CPUs used by the NAPI threads in napi_cpumask for the load evaluation of the next patch. Switch the devices back to softirq mode in NO_TASK, NOT_RUNNING and FRAGMENTATION, when the scheduler is disabled and on module unload; the NAPI and IRQ operations run under the rtnetlink lock. 11/12 net: dynthread: Scale the number of NAPI thread CPUs Sample the kernel_cpustat of the CPUs used by the NAPI threads and compare consecutive periods. Grow dyn_threaded_corenum when the irq/softirq share or the total load of those CPUs is too high, and shrink it when the user share is high or the total load is low, within the lower/upper limit parameters. Damping and anti-fight rules avoid oscillating right after a change or undoing a change made for the opposite reason; the two total-load driven directions check each other, and the cpustat baseline is taken over the mask that was actually just bound. The default core count is computed at init from the busiest device's RX queue count divided by the online NUMA nodes and clamped to the limits. Reset the damping state and the baseline when leaving the long-running status or when the scheduler is stopped, and serialize the core-count updates with the module parameter setter. 12/12 net: dynthread: Add debug switch and instrumentation Add the dyn_threaded_debug module parameter and instrument the periodic sampling, the status transitions, the IRQ affinity decisions, the NAPI thread masks and the CPU-count resizes. The messages are recorded with trace_printk() so they can be read from tracefs without flooding the console; without tracing support they fall back to dynamic debug. The switch is off by default. Amritha Nambiar (2): net: Add queue and napi association net: Add NAPI IRQ support Cai Xinchen (7): net/mlx5e: Do not block on RTNL while recovering an SQ net: dynthread: Add dynamic threaded NAPI scheduler framework net: dynthread: Monitor the load of the target tasks net: dynthread: Steer the RX queue IRQs away from the target tasks net: dynthread: Switch NAPI to threads on spare CPUs net: dynthread: Scale the number of NAPI thread CPUs net: dynthread: Add debug switch and instrumentation Carolina Jubran (1): net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation Cosmin Ratiu (1): net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover Joe Damato (1): net/mlx5e: link NAPI instances to queues and IRQs arch/arm64/configs/openeuler_defconfig | 1 + .../net/ethernet/mellanox/mlx5/core/en/ptp.c | 5 +- .../mellanox/mlx5/core/en/reporter_tx.c | 25 + .../net/ethernet/mellanox/mlx5/core/en_main.c | 7 + include/linux/netdevice.h | 21 +- include/net/netdev_rx_queue.h | 2 +- net/Kconfig | 1 + net/Makefile | 1 + net/core/dev.c | 38 + net/dynthread/Kconfig | 13 + net/dynthread/Makefile | 2 + net/dynthread/net_dynthread.c | 1375 +++++++++++++++++ 12 files changed, 1487 insertions(+), 4 deletions(-) create mode 100644 net/dynthread/Kconfig create mode 100644 net/dynthread/Makefile create mode 100644 net/dynthread/net_dynthread.c -- 2.18.0.huawei.25

2 13

[PATCH OLK-6.6] smb: client: zero the post-EOF pagecache on writeback
by Zizhi Wo 22 Oct '26

22 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18925 -------------------------------- The backport of commit 62584fd709e0 ("smb: client: clear post-EOF pagecache when extending a file via truncate") replaced the upstream dirty-state test in cifs_clear_stale_post_isize() with an unconditional PageUptodate() test, because this tree's cifs writeback only clamps a write to i_size and never zeroes the post-EOF tail. That keeps the original mmap-past-EOF bug fixed, but it also zeroes a clean folio whose post-EOF tail holds valid data cached from the server by a read: cifs_readpage_worker() asks the server for a full PAGE_SIZE and only zeroes the short-read part, so a read of the last local page can cache server data beyond a stale local i_size. If the file is then resized to a size inside that region, the zeroing discards valid data from the pagecache; for a writable mapping the zeros can later be written back to the server. Restore the upstream invariant instead: zero the tail of a dirty folio that straddles i_size when it is written back, as netfs_write_folio() does upstream, and then restore the dirty-state test. Fixes: 62584fd709e0 ("smb: client: clear post-EOF pagecache when extending a file via truncate") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/smb/client/file.c | 23 ++++++++++++++++++++++- fs/smb/client/inode.c | 16 ++++++---------- 2 files changed, 28 insertions(+), 11 deletions(-) diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c index c5ed161f17a9..99364442a887 100644 --- a/fs/smb/client/file.c +++ b/fs/smb/client/file.c @@ -2795,12 +2795,18 @@ static int cifs_partialpagewrite(struct page *page, unsigned from, unsigned to) kunmap(page); return 0; /* don't care */ } /* check to make sure that we are not extending the file */ - if (mapping->host->i_size - offset < (loff_t)to) + if (mapping->host->i_size - offset < (loff_t)to) { to = (unsigned)(mapping->host->i_size - offset); + /* + * Zero the post-EOF tail to avoid later extension expose + * the stale bytes. + */ + zero_user_segment(page, to, PAGE_SIZE); + } rc = cifs_get_writable_file(CIFS_I(mapping->host), FIND_WR_ANY, &open_file); if (!rc) { bytes_written = cifs_write(open_file, open_file->pid, @@ -2843,10 +2849,11 @@ static void cifs_extend_writeback(struct address_space *mapping, unsigned int nr_pages; pgoff_t index = (start + *_len) / PAGE_SIZE; size_t len; bool stop = true; unsigned int i; + unsigned long long fpos; folio_batch_init(&batch); do { /* Firstly, we gather up a batch of contiguous dirty pages @@ -2930,10 +2937,17 @@ static void cifs_extend_writeback(struct address_space *mapping, if (!folio_batch_count(&batch)) break; for (i = 0; i < folio_batch_count(&batch); i++) { folio = batch.folios[i]; + fpos = folio_pos(folio); + + /* This folio straddles i_size: zero its tail. */ + if (fpos < i_size && i_size - fpos < folio_size(folio)) + folio_zero_segment(folio, i_size - fpos, + folio_size(folio)); + /* The folio should be locked, dirty and not undergoing * writeback from the loop above. */ if (!folio_clear_dirty_for_io(folio)) WARN_ON(1); @@ -3036,10 +3050,17 @@ static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping, i_size); } } len = min_t(unsigned long long, len, i_size - start); + /* + * If this folio straddles i_size, zero its post-EOF + * tail to avoid later extension expose the stale bytes. + */ + if (start < i_size && len < folio_size(folio)) + folio_zero_segment(folio, len, folio_size(folio)); + /* We now have a contiguous set of dirty pages, each with writeback * set; the first page is still locked at this point, but all the rest * have been unlocked. */ folio_unlock(folio); diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c index 32b527cc7b2d..99c246420837 100644 --- a/fs/smb/client/inode.c +++ b/fs/smb/client/inode.c @@ -2917,19 +2917,15 @@ int cifs_truncate_page(struct address_space *mapping, loff_t from) * data as pages wholly beyond the EOF can't be faulted in, so the zeroing * is limited to that folio. The folio is zeroed rather than dropped so * that a concurrent extending write can't lose data. * * For callers that hold i_rwsem exclusively across the whole resize and - * have already updated i_size to @to, no genuine concurrent buffered writer - * can be racing, a lockless stat() adopting a server-confirmed size mid-resize - * has no data behind it and never dirties the folio, so it can't fool this - * check into skipping the zeroing. - * - * Do not use the folio's dirty state as the staleness criterion here: unlike - * netfs writeback, this tree's cifs writeback does not zero the part of a - * folio beyond i_size, so a folio cleaned by the setattr-side - * filemap_write_and_wait() can still hold stale bytes. + * have already updated i_size to @to, staleness is decided from the folio's + * dirty state instead: since no genuine concurrent buffered writer can be + * racing, a lockless stat() adopting a server-confirmed size mid-resize has + * no data behind it and never dirties the folio, so it can't fool this check + * into skipping the zeroing. * * pagecache_isize_extended() can't be reused here: it is keyed on a * sub-page block size (a no-op when the block size is >= PAGE_SIZE, as on * network filesystems), runs after i_size is updated, and doesn't wait for * writeback. Keep the two in sync if either is changed. @@ -2952,11 +2948,11 @@ static void cifs_clear_stale_post_isize(struct inode *inode, folio_wait_writeback(folio); if (folio_mkclean(folio)) folio_mark_dirty(folio); - if (folio_test_uptodate(folio)) { + if (folio_test_uptodate(folio) && folio_test_dirty(folio)) { unsigned long long fpos = folio_pos(folio); if (from < to && from < fpos + folio_size(folio)) { size_t end = umin(to - fpos, folio_size(folio)); size_t offset = from - fpos; -- 2.52.0

2 1