- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] nfsd: split nfsd4_copy into transient and durable async copy objects
by Lu Jialin 04 Nov '26

04 Nov '26

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v7.3-rc1 commit f307b4f7ed174a3252d2f292904fd276c78c77de category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18939 CVE: CVE-2026-89676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- struct nfsd4_copy served two roles: as &u->copy it is a transient per-COMPOUND argument in the request buffer; as the heap async_copy it is a durable object (worker kthread, reaper linkage, CB_OFFLOAD callback, IDR stateid) that outlives the COMPOUND, with dup_copy_fields() shuttling state between them. That dual identity was the root of the recent lifetime bugs. Introduce struct nfsd4_async_copy for the durable object. It embeds a struct nfsd4_copy (cp_copy) for the operation parameters/result and adds the durable-only fields: async_copies linkage, task_struct, refcount, reaper TTL, copy stateid, and CB_OFFLOAD callback. The durable object therefore never points into the request buffer. cp_clp stays in nfsd4_copy -- it is a request property read by the sync-copy tracepoints on the transient object. Mechanical split, no intended behavioral change; a step toward folding the copy stateids into the common nfs4_stid infrastructure. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260710-nfsd-testing-v3-8-a0ff7db6aa3e@kernel.org Signed-off-by: Chuck Lever <cel(a)kernel.org> Conflicts: fs/nfsd/nfs4proc.c fs/nfsd/nfs4state.c fs/nfsd/state.h fs/nfsd/xdr4.h [1)OLK-5.10 uses the older 5.10 async-copy model: cp_src is an embedded struct, stop state is a bool, and a standalone nfsd4_copy (cb_copy) is still allocated for CB_OFFLOAD; the durable worker fields were split out while refcount stayed in nfsd4_copy for cb_copy, a new nfs4_put_cb_copy() releases it, and the reaper/has_active/cancel_by_sb helper hunks do not exist in this baseline; 2)nfs4_free_copy_state() now takes nfsd4_async_copy and reaches cp_clp through cp_copy.cp_clp; 3)Prototypes for nfs4_init_copy_state()/nfs4_free_copy_state(), nfs4_put_copy() and find_async_copy() repointed to struct nfsd4_async_copy; 4)Only copies/copy_task/stopped/cp_stateid moved; refcount stays in nfsd4_copy for the standalone CB_OFFLOAD object; cp_nn, ss_mnt, cp_cb, cp_intra and cp_synchronous remain in nfsd4_copy] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs4proc.c | 81 +++++++++++++++++++++++++++------------------ fs/nfsd/nfs4state.c | 6 ++-- fs/nfsd/state.h | 9 ++--- fs/nfsd/xdr4.h | 31 ++++++++++++++--- 4 files changed, 82 insertions(+), 45 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index d9a2941086e3..67c9d0dec1ba 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1110,31 +1110,42 @@ nfsd4_clone(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return status; } -void nfs4_put_copy(struct nfsd4_copy *copy) +void nfs4_put_copy(struct nfsd4_async_copy *copy) { if (!refcount_dec_and_test(&copy->refcount)) return; /* Drop the task_struct pinned in nfsd4_copy(); NULL on error paths. */ if (copy->copy_task) put_task_struct(copy->copy_task); - atomic_dec(&copy->cp_nn->pending_async_copies); + atomic_dec(&copy->cp_copy.cp_nn->pending_async_copies); + kfree(copy); +} + +/* + * OLK-5.10 still allocates a standalone nfsd4_copy for the CB_OFFLOAD + * callback; it has no kthread or pending-copy accounting of its own. + */ +static void nfs4_put_cb_copy(struct nfsd4_copy *copy) +{ + if (!refcount_dec_and_test(&copy->refcount)) + return; kfree(copy); } static bool -check_and_set_stop_copy(struct nfsd4_copy *copy) +check_and_set_stop_copy(struct nfsd4_async_copy *copy) { bool value; - spin_lock(&copy->cp_clp->async_lock); + spin_lock(&copy->cp_copy.cp_clp->async_lock); value = copy->stopped; if (!copy->stopped) copy->stopped = true; - spin_unlock(&copy->cp_clp->async_lock); + spin_unlock(&copy->cp_copy.cp_clp->async_lock); return value; } -static void nfsd4_stop_copy(struct nfsd4_copy *copy) +static void nfsd4_stop_copy(struct nfsd4_async_copy *copy) { /* only 1 thread should stop the copy */ if (!check_and_set_stop_copy(copy)) @@ -1142,14 +1153,14 @@ static void nfsd4_stop_copy(struct nfsd4_copy *copy) nfs4_put_copy(copy); } -static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp) +static struct nfsd4_async_copy *nfsd4_get_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy = NULL; + struct nfsd4_async_copy *copy = NULL; spin_lock(&clp->async_lock); if (!list_empty(&clp->async_copies)) { - copy = list_first_entry(&clp->async_copies, struct nfsd4_copy, - copies); + copy = list_first_entry(&clp->async_copies, + struct nfsd4_async_copy, copies); refcount_inc(&copy->refcount); } spin_unlock(&clp->async_lock); @@ -1158,7 +1169,7 @@ static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp) void nfsd4_shutdown_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; while ((copy = nfsd4_get_copy(clp)) != NULL) nfsd4_stop_copy(copy); @@ -1356,7 +1367,7 @@ static void nfsd4_cb_offload_release(struct nfsd4_callback *cb) { struct nfsd4_copy *copy = container_of(cb, struct nfsd4_copy, cp_cb); - nfs4_put_copy(copy); + nfs4_put_cb_copy(copy); } static int nfsd4_cb_offload_done(struct nfsd4_callback *cb, @@ -1440,28 +1451,28 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) if (src->cp_intra) /* for inter, file_src doesn't exist yet */ dst->nf_src = nfsd_file_get(src->nf_src); - memcpy(&dst->cp_stateid, &src->cp_stateid, sizeof(src->cp_stateid)); memcpy(&dst->cp_src, &src->cp_src, sizeof(struct nl4_server)); memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid)); memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh)); dst->ss_mnt = src->ss_mnt; } -static void cleanup_async_copy(struct nfsd4_copy *copy) +static void cleanup_async_copy(struct nfsd4_async_copy *copy) { nfs4_free_copy_state(copy); - nfsd_file_put(copy->nf_dst); - if (copy->cp_intra) - nfsd_file_put(copy->nf_src); - spin_lock(&copy->cp_clp->async_lock); + nfsd_file_put(copy->cp_copy.nf_dst); + if (copy->cp_copy.cp_intra) + nfsd_file_put(copy->cp_copy.nf_src); + spin_lock(&copy->cp_copy.cp_clp->async_lock); list_del(&copy->copies); - spin_unlock(&copy->cp_clp->async_lock); + spin_unlock(&copy->cp_copy.cp_clp->async_lock); nfs4_put_copy(copy); } static int nfsd4_do_async_copy(void *data) { - struct nfsd4_copy *copy = (struct nfsd4_copy *)data; + struct nfsd4_async_copy *async = data; + struct nfsd4_copy *copy = &async->cp_copy; struct nfsd4_copy *cb_copy; if (!copy->cp_intra) { /* Inter server SSC */ @@ -1496,7 +1507,7 @@ static int nfsd4_do_async_copy(void *data) out: if (!copy->cp_intra) kfree(copy->nf_src); - cleanup_async_copy(copy); + cleanup_async_copy(async); return 0; } @@ -1506,7 +1517,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, { struct nfsd4_copy *copy = &u->copy; __be32 status; - struct nfsd4_copy *async_copy = NULL; + struct nfsd4_async_copy *async_copy = NULL; if (!copy->cp_intra) { /* Inter server SSC */ if (!inter_copy_offload_enable || copy->cp_synchronous) { @@ -1536,21 +1547,25 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); struct task_struct *task; - async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); + async_copy = kzalloc(sizeof(struct nfsd4_async_copy), GFP_KERNEL); if (!async_copy) goto out_err; - async_copy->cp_nn = nn; + async_copy->cp_copy.cp_nn = nn; refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > (int)rqstp->rq_pool->sp_nrthreads) goto out_err; - dup_copy_fields(copy, async_copy); if (!nfs4_init_copy_state(nn, async_copy)) goto out_err; memcpy(&copy->cp_res.cb_stateid, &async_copy->cp_stateid.stid, sizeof(copy->cp_res.cb_stateid)); + /* + * dup after writing cb_stateid; duplicating first would leave + * the callback stateid zeroed. + */ + dup_copy_fields(copy, &async_copy->cp_copy); task = kthread_create(nfsd4_do_async_copy, async_copy, "%s", "copy thread"); if (IS_ERR(task)) @@ -1561,10 +1576,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, */ get_task_struct(task); async_copy->copy_task = task; - spin_lock(&async_copy->cp_clp->async_lock); + spin_lock(&async_copy->cp_copy.cp_clp->async_lock); list_add(&async_copy->copies, - &async_copy->cp_clp->async_copies); - spin_unlock(&async_copy->cp_clp->async_lock); + &async_copy->cp_copy.cp_clp->async_copies); + spin_unlock(&async_copy->cp_copy.cp_clp->async_lock); wake_up_process(async_copy->copy_task); status = nfs_ok; } else { @@ -1583,10 +1598,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, goto out; } -struct nfsd4_copy * +struct nfsd4_async_copy * find_async_copy(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; spin_lock(&clp->async_lock); list_for_each_entry(copy, &clp->async_copies, copies) { @@ -1606,7 +1621,7 @@ nfsd4_offload_cancel(struct svc_rqst *rqstp, union nfsd4_op_u *u) { struct nfsd4_offload_status *os = &u->offload_status; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; copy = find_async_copy(clp, &os->stateid); @@ -1695,12 +1710,12 @@ nfsd4_offload_status(struct svc_rqst *rqstp, { struct nfsd4_offload_status *os = &u->offload_status; __be32 status = 0; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; copy = find_async_copy(clp, &os->stateid); if (copy) { - os->count = copy->cp_res.wr_bytes_written; + os->count = copy->cp_copy.cp_res.wr_bytes_written; nfs4_put_copy(copy); } else status = nfserr_bad_stateid; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 3e1aeb08ea6b..f97dbb2c093b 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -820,7 +820,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, return 1; } -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy) +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy) { return nfs4_init_cp_state(nn, &copy->cp_stateid, NFS4_COPY_STID); } @@ -854,12 +854,12 @@ struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, return NULL; } -void nfs4_free_copy_state(struct nfsd4_copy *copy) +void nfs4_free_copy_state(struct nfsd4_async_copy *copy) { struct nfsd_net *nn; WARN_ON_ONCE(copy->cp_stateid.sc_type != NFS4_COPY_STID); - nn = net_generic(copy->cp_clp->net, nfsd_net_id); + nn = net_generic(copy->cp_copy.cp_clp->net, nfsd_net_id); spin_lock(&nn->s2s_cp_lock); idr_remove(&nn->s2s_cp_stateids, copy->cp_stateid.stid.si_opaque.so_id); diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index a16e3d6fcbc0..6c080c63e880 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -636,6 +636,7 @@ struct nfsd4_blocked_lock { struct nfsd4_compound_state; struct nfsd_net; struct nfsd4_copy; +struct nfsd4_async_copy; extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct svc_fh *fhp, @@ -646,8 +647,8 @@ __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, struct nfs4_stid **s, struct nfsd_net *nn); struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, void (*sc_free)(struct nfs4_stid *)); -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy); -void nfs4_free_copy_state(struct nfsd4_copy *copy); +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy); +void nfs4_free_copy_state(struct nfsd4_async_copy *copy); struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, struct nfs4_stid *p_stid); void nfs4_unhash_stid(struct nfs4_stid *s); @@ -676,8 +677,8 @@ extern bool nfs4_has_reclaimed_state(struct xdr_netobj name, struct nfsd_net *nn struct nfs4_file *find_file(struct knfsd_fh *fh); void put_nfs4_file(struct nfs4_file *fi); -extern void nfs4_put_copy(struct nfsd4_copy *copy); -extern struct nfsd4_copy * +extern void nfs4_put_copy(struct nfsd4_async_copy *copy); +extern struct nfsd4_async_copy * find_async_copy(struct nfs4_client *clp, stateid_t *staetid); extern void nfs4_put_cpntf_state(struct nfsd_net *nn, struct nfs4_cpntf_state *cps); diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h index 1ced060704a3..03607083945a 100644 --- a/fs/nfsd/xdr4.h +++ b/fs/nfsd/xdr4.h @@ -569,18 +569,39 @@ struct nfsd4_copy { struct nfsd_file *nf_src; struct nfsd_file *nf_dst; - copy_stateid_t cp_stateid; - - struct list_head copies; - struct task_struct *copy_task; + /* + * Kept in nfsd4_copy because OLK-5.10 still allocates a separate + * nfsd4_copy for the CB_OFFLOAD callback (cb_copy in + * nfsd4_do_async_copy()) and that object is released through this + * refcount. + */ refcount_t refcount; - bool stopped; struct vfsmount *ss_mnt; struct nfs_fh c_fh; nfs4_stateid stateid; struct nfsd_net *cp_nn; }; + +/* + * Durable state for an async (background) server-side COPY. + * + * struct nfsd4_copy is transient: it lives in the COMPOUND argument buffer + * and is reused once the op returns. An async COPY outlives the COMPOUND + * (worker kthread, async_copies linkage), so its params and result are + * snapshotted into the embedded cp_copy and it never points into the request + * buffer. + */ +struct nfsd4_async_copy { + struct nfsd4_copy cp_copy; /* operation params + result */ + + struct list_head copies; /* nfs4_client.async_copies */ + struct task_struct *copy_task; + refcount_t refcount; + bool stopped; + copy_stateid_t cp_stateid; /* s2s_cp_stateids IDR entry */ +}; + extern bool inter_copy_offload_enable; struct nfsd4_seek { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 00/19] add ksm_only_merge_zero_pages mode and some fixes
by Jinjiang Tu 04 Nov '26

04 Nov '26

Chengming Zhou (1): mm/ksm: fix ksm_zero_pages accounting David Hildenbrand (1): mm/ksm: unmerge and clear VM_MERGEABLE when setting PR_SET_MEMORY_MERGE=0 Donet Tom (1): mm/ksm: fix incorrect KSM counter handling in mm_struct during fork Jinjiang Tu (5): mm/ksm: fix ksm exec support for prctl mm/ksm: remove redundant code in ksm_fork mm/memcontrol: add ksm state for memcg mm/memcontrol: enable KSM for tasks moving to new memcg mm/ksm: add ksm_only_merge_zero_pages mode Liangcai Fan (1): mm: khugepaged: recalculate min_free_kbytes after stopping khugepaged Nanyong Sun (1): memcg: support ksm merge any mode per cgroup Stefan Roesch (3): mm: add new api to enable ksm per process mm: add new KSM process and sysfs knobs mm/ksm: support fork/exec for prctl xu xin (6): ksm: count ksm merging pages for each process ksm: count allocated ksm rmap_items for each process ksm: support unsharing KSM-placed zero pages ksm: count all zero pages placed by KSM ksm: add ksm zero pages for each process ksm: consider KSM-placed zeropages when calculating KSM profit Documentation/ABI/testing/sysfs-kernel-mm-ksm | 8 + Documentation/admin-guide/mm/ksm.rst | 9 + fs/exec.c | 13 + fs/proc/base.c | 41 +++ include/linux/ksm.h | 65 +++- include/linux/memcontrol.h | 2 + include/linux/mm.h | 1 + include/linux/mm_types.h | 26 ++ include/linux/sched/coredump.h | 7 +- include/uapi/linux/prctl.h | 2 + kernel/sys.c | 21 ++ mm/khugepaged.c | 12 +- mm/ksm.c | 310 ++++++++++++++++-- mm/memcontrol.c | 178 ++++++++++ mm/memory.c | 5 +- mm/mmap.c | 3 + mm/page_alloc.c | 7 +- 17 files changed, 680 insertions(+), 30 deletions(-) -- 2.43.0

2 20

[PATCH OLK-6.6] nfsd: split nfsd4_copy into transient and durable async copy objects
by Lu Jialin 04 Nov '26

04 Nov '26

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v7.3-rc1 commit f307b4f7ed174a3252d2f292904fd276c78c77de category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18939 CVE: CVE-2026-89676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- struct nfsd4_copy served two roles: as &u->copy it is a transient per-COMPOUND argument in the request buffer; as the heap async_copy it is a durable object (worker kthread, reaper linkage, CB_OFFLOAD callback, IDR stateid) that outlives the COMPOUND, with dup_copy_fields() shuttling state between them. That dual identity was the root of the recent lifetime bugs. Introduce struct nfsd4_async_copy for the durable object. It embeds a struct nfsd4_copy (cp_copy) for the operation parameters/result and adds the durable-only fields: async_copies linkage, task_struct, refcount, reaper TTL, copy stateid, and CB_OFFLOAD callback. The durable object therefore never points into the request buffer. cp_clp stays in nfsd4_copy -- it is a request property read by the sync-copy tracepoints on the transient object. Mechanical split, no intended behavioral change; a step toward folding the copy stateids into the common nfs4_stid infrastructure. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260710-nfsd-testing-v3-8-a0ff7db6aa3e@kernel.org Signed-off-by: Chuck Lever <cel(a)kernel.org> Conflicts: fs/nfsd/nfs4proc.c fs/nfsd/nfs4state.c fs/nfsd/state.h fs/nfsd/xdr4.h [1) OLK-6.6 lacks the async-copy reaper, DESTROY_CLIENTID gating and admin-revoke cancel work, and still allocates a separate CB_OFFLOAD object; the split was adapted to that older model, so the hunks for nfsd4_async_copy_reaper(), nfsd4_has_active_async_copies() and nfsd4_cancel_copy_by_sb() were dropped; 2)nfs4_free_copy_state() now reaches cp_clp through cp_copy.cp_clp after the split; 3)Prototypes for nfs4_init_copy_state()/nfs4_free_copy_state() changed to struct nfsd4_async_copy; 4)Only copies/copy_task/refcount/cp_stateid moved to the new struct; cp_nn and ss_nsui stay in nfsd4_copy because OLK-6.6 has no cp_ttl/cp_cb_offload/attr_update fields] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs4proc.c | 90 ++++++++++++++++++++++++--------------------- fs/nfsd/nfs4state.c | 6 +-- fs/nfsd/state.h | 5 ++- fs/nfsd/xdr4.h | 24 +++++++++--- 4 files changed, 72 insertions(+), 53 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index c94d15fa4330..e03e10276647 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1274,35 +1274,35 @@ nfsd4_clone(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return status; } -static void nfs4_put_copy(struct nfsd4_copy *copy) +static void nfs4_put_copy(struct nfsd4_async_copy *copy) { if (!refcount_dec_and_test(&copy->refcount)) return; - atomic_dec(&copy->cp_nn->pending_async_copies); + atomic_dec(&copy->cp_copy.cp_nn->pending_async_copies); /* Drop the task_struct pinned in nfsd4_copy(); NULL on error paths. */ if (copy->copy_task) put_task_struct(copy->copy_task); - kfree(copy->cp_src); + kfree(copy->cp_copy.cp_src); kfree(copy); } -static void nfsd4_stop_copy(struct nfsd4_copy *copy) +static void nfsd4_stop_copy(struct nfsd4_async_copy *copy) { - if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, &copy->cp_flags)) + if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, &copy->cp_copy.cp_flags)) kthread_stop(copy->copy_task); nfs4_put_copy(copy); } -static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) +static struct nfsd4_async_copy *nfsd4_unhash_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy = NULL; + struct nfsd4_async_copy *copy = NULL; spin_lock(&clp->async_lock); if (!list_empty(&clp->async_copies)) { - copy = list_first_entry(&clp->async_copies, struct nfsd4_copy, - copies); + copy = list_first_entry(&clp->async_copies, + struct nfsd4_async_copy, copies); refcount_inc(&copy->refcount); - copy->cp_clp = NULL; + copy->cp_copy.cp_clp = NULL; if (!list_empty(&copy->copies)) list_del_init(&copy->copies); } @@ -1312,7 +1312,7 @@ static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) void nfsd4_shutdown_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; while ((copy = nfsd4_unhash_copy(clp)) != NULL) nfsd4_stop_copy(copy); @@ -1705,7 +1705,6 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) if (!nfsd4_ssc_is_inter(src)) dst->nf_src = nfsd_file_get(src->nf_src); - memcpy(&dst->cp_stateid, &src->cp_stateid, sizeof(src->cp_stateid)); memcpy(dst->cp_src, src->cp_src, sizeof(struct nl4_server)); memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid)); memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh)); @@ -1720,20 +1719,20 @@ static void release_copy_files(struct nfsd4_copy *copy) nfsd_file_put(copy->nf_dst); } -static void cleanup_async_copy(struct nfsd4_copy *copy) +static void cleanup_async_copy(struct nfsd4_async_copy *copy) { nfs4_free_copy_state(copy); - release_copy_files(copy); - if (copy->cp_clp) { - spin_lock(&copy->cp_clp->async_lock); + release_copy_files(&copy->cp_copy); + if (copy->cp_copy.cp_clp) { + spin_lock(&copy->cp_copy.cp_clp->async_lock); if (!list_empty(&copy->copies)) list_del_init(&copy->copies); - spin_unlock(&copy->cp_clp->async_lock); + spin_unlock(&copy->cp_copy.cp_clp->async_lock); } nfs4_put_copy(copy); } -static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) +static void nfsd4_send_cb_offload(struct nfsd4_async_copy *copy, __be32 nfserr) { struct nfsd4_cb_offload *cbo; @@ -1741,14 +1740,15 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) if (!cbo) return; - memcpy(&cbo->co_res, &copy->cp_res, sizeof(copy->cp_res)); - memcpy(&cbo->co_fh, &copy->fh, sizeof(copy->fh)); + memcpy(&cbo->co_res, &copy->cp_copy.cp_res, + sizeof(copy->cp_copy.cp_res)); + memcpy(&cbo->co_fh, &copy->cp_copy.fh, sizeof(copy->cp_copy.fh)); cbo->co_nfserr = nfserr; - nfsd4_init_cb(&cbo->co_cb, copy->cp_clp, &nfsd4_cb_offload_ops, + nfsd4_init_cb(&cbo->co_cb, copy->cp_copy.cp_clp, &nfsd4_cb_offload_ops, NFSPROC4_CLNT_CB_OFFLOAD); - trace_nfsd_cb_offload(copy->cp_clp, &cbo->co_res.cb_stateid, - &cbo->co_fh, copy->cp_count, nfserr); + trace_nfsd_cb_offload(copy->cp_copy.cp_clp, &cbo->co_res.cb_stateid, + &cbo->co_fh, copy->cp_copy.cp_count, nfserr); nfsd4_run_cb(&cbo->co_cb); } @@ -1761,7 +1761,8 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) */ static int nfsd4_do_async_copy(void *data) { - struct nfsd4_copy *copy = (struct nfsd4_copy *)data; + struct nfsd4_async_copy *async = data; + struct nfsd4_copy *copy = &async->cp_copy; __be32 nfserr; if (nfsd4_ssc_is_inter(copy)) { @@ -1789,8 +1790,8 @@ static int nfsd4_do_async_copy(void *data) } do_callback: - nfsd4_send_cb_offload(copy, nfserr); - cleanup_async_copy(copy); + nfsd4_send_cb_offload(async, nfserr); + cleanup_async_copy(async); return 0; } @@ -1799,7 +1800,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, union nfsd4_op_u *u) { struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); - struct nfsd4_copy *async_copy = NULL; + struct nfsd4_async_copy *async_copy = NULL; struct nfsd4_copy *copy = &u->copy; struct nfsd42_write_res *result; __be32 status; @@ -1829,25 +1830,30 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, if (nfsd4_copy_is_async(copy)) { struct task_struct *task; - async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); + async_copy = kzalloc(sizeof(struct nfsd4_async_copy), GFP_KERNEL); if (!async_copy) goto out_err; - async_copy->cp_nn = nn; + async_copy->cp_copy.cp_nn = nn; INIT_LIST_HEAD(&async_copy->copies); refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > (int)rqstp->rq_pool->sp_nrthreads) goto out_err; - async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL); - if (!async_copy->cp_src) + async_copy->cp_copy.cp_src = + kmalloc(sizeof(*async_copy->cp_copy.cp_src), GFP_KERNEL); + if (!async_copy->cp_copy.cp_src) goto out_err; - dup_copy_fields(copy, async_copy); if (!nfs4_init_copy_state(nn, async_copy)) goto out_err; memcpy(&result->cb_stateid, &async_copy->cp_stateid.cs_stid, sizeof(result->cb_stateid)); + /* + * dup after writing cb_stateid; duplicating first would leave + * the callback stateid zeroed. + */ + dup_copy_fields(copy, &async_copy->cp_copy); task = kthread_create(nfsd4_do_async_copy, async_copy, "%s", "copy thread"); if (IS_ERR(task)) @@ -1858,10 +1864,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, */ get_task_struct(task); async_copy->copy_task = task; - spin_lock(&async_copy->cp_clp->async_lock); + spin_lock(&async_copy->cp_copy.cp_clp->async_lock); list_add(&async_copy->copies, - &async_copy->cp_clp->async_copies); - spin_unlock(&async_copy->cp_clp->async_lock); + &async_copy->cp_copy.cp_clp->async_copies); + spin_unlock(&async_copy->cp_copy.cp_clp->async_lock); wake_up_process(async_copy->copy_task); status = nfs_ok; } else { @@ -1886,10 +1892,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, goto out; } -static struct nfsd4_copy * +static struct nfsd4_async_copy * find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; lockdep_assert_held(&clp->async_lock); @@ -1901,10 +1907,10 @@ find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid) return NULL; } -static struct nfsd4_copy * +static struct nfsd4_async_copy * find_async_copy(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; spin_lock(&clp->async_lock); copy = find_async_copy_locked(clp, stateid); @@ -1920,7 +1926,7 @@ nfsd4_offload_cancel(struct svc_rqst *rqstp, union nfsd4_op_u *u) { struct nfsd4_offload_status *os = &u->offload_status; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; copy = find_async_copy(clp, &os->stateid); @@ -2008,13 +2014,13 @@ nfsd4_offload_status(struct svc_rqst *rqstp, { struct nfsd4_offload_status *os = &u->offload_status; __be32 status = nfs_ok; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; spin_lock(&clp->async_lock); copy = find_async_copy_locked(clp, &os->stateid); if (copy) - os->count = copy->cp_res.wr_bytes_written; + os->count = copy->cp_copy.cp_res.wr_bytes_written; else status = nfserr_bad_stateid; spin_unlock(&clp->async_lock); diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 4e5af5a79ed5..054a24e0e84a 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1034,7 +1034,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, return 1; } -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy) +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy) { return nfs4_init_cp_state(nn, &copy->cp_stateid, NFS4_COPY_STID); } @@ -1068,13 +1068,13 @@ struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, return NULL; } -void nfs4_free_copy_state(struct nfsd4_copy *copy) +void nfs4_free_copy_state(struct nfsd4_async_copy *copy) { struct nfsd_net *nn; if (copy->cp_stateid.cs_type != NFS4_COPY_STID) return; - nn = net_generic(copy->cp_clp->net, nfsd_net_id); + nn = net_generic(copy->cp_copy.cp_clp->net, nfsd_net_id); spin_lock(&nn->s2s_cp_lock); idr_remove(&nn->s2s_cp_stateids, copy->cp_stateid.cs_stid.si_opaque.so_id); diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index 4dd8ade17446..d62faf4f183a 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -676,6 +676,7 @@ struct nfsd4_blocked_lock { struct nfsd4_compound_state; struct nfsd_net; struct nfsd4_copy; +struct nfsd4_async_copy; extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct svc_fh *fhp, @@ -686,8 +687,8 @@ __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, struct nfs4_stid **s, struct nfsd_net *nn); struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, void (*sc_free)(struct nfs4_stid *)); -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy); -void nfs4_free_copy_state(struct nfsd4_copy *copy); +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy); +void nfs4_free_copy_state(struct nfsd4_async_copy *copy); struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, struct nfs4_stid *p_stid); void nfs4_unhash_stid(struct nfs4_stid *s); diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h index a83a52b0f518..37597f8dec46 100644 --- a/fs/nfsd/xdr4.h +++ b/fs/nfsd/xdr4.h @@ -599,18 +599,30 @@ struct nfsd4_copy { struct nfsd_file *nf_src; struct nfsd_file *nf_dst; - copy_stateid_t cp_stateid; - - struct list_head copies; - struct task_struct *copy_task; - refcount_t refcount; - struct nfsd4_ssc_umount_item *ss_nsui; struct nfs_fh c_fh; nfs4_stateid stateid; struct nfsd_net *cp_nn; }; +/* + * Durable state for an async (background) server-side COPY. + * + * struct nfsd4_copy is transient: it lives in the COMPOUND argument buffer + * and is reused once the op returns. An async COPY outlives the COMPOUND + * (worker kthread, async_copies linkage), so its params and result are + * snapshotted into the embedded cp_copy and it never points into the request + * buffer. + */ +struct nfsd4_async_copy { + struct nfsd4_copy cp_copy; /* operation params + result */ + + struct list_head copies; /* nfs4_client.async_copies */ + struct task_struct *copy_task; + refcount_t refcount; + copy_stateid_t cp_stateid; /* s2s_cp_stateids IDR entry */ +}; + static inline void nfsd4_copy_set_sync(struct nfsd4_copy *copy, bool sync) { if (sync) -- 2.34.1

2 1

[PATCH OLK-6.6] iommu/io-pgtable-arm: Add support for contiguous hint
by Zhang Yuwei 04 Nov '26

04 Nov '26

maillist inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8788 ------------------------------------------------------------- Add support for the contiguous hint (CONT) bit in ARM LPAE page tables, following the community v5 mapping and unmapping approach. Keep CONT disabled by default. Drivers opt in with IO_PGTABLE_QUIRK_ARM_CONT_HINT (BIT(12)) before allocating page tables. Derive supported CONT sizes from the architecture-valid page-size bitmap, check size expansion for overflow, and constrain the result by IAS/OAS. The returned bitmap then includes CONT sizes, so document that callers must build each allocation from native page sizes rather than reuse it. Only set CONT when callers select an advertised CONT group size. Do not promote ordinary page mappings into CONT groups. Bound map and unmap batches to the current table and reject incomplete CONT groups before modifying that batch. Earlier batches in a request may already have completed. Reject CONT blocks before splitting them on unmap; ordinary blocks can still be split. Dirty tracking cannot update CONT permissions as a group, so CONT and ARM_HD are mutually exclusive. Reject page-table allocation when both are requested. Do not install split_block, merge_page, sync_dirty_log or clear_dirty_log on CONT page tables; their SMMUv3 callers already treat a missing op as unsupported. Keep read_and_clear_dirty installed, because SMMUv3 calls it without a NULL check, and make it return -EOPNOTSUPP on CONT page tables. The table walkers themselves are unchanged. Add each complete CONT group to the IOTLB gather at the group size after clearing its last descriptor, preserving the group boundary for range invalidation. SMMUv3 integration must separately ensure compatible range invalidation support and hardware errata handling; this patch does not change SMMUv3 policy or enable CONT in a driver. The patch has not been validated on real SMMU hardware for DMA or TLB invalidation behavior. Suggested-by: Robin Murphy <robin.murphy(a)arm.com> Co-developed-by: Vijayanand Jitta <vijayanand.jitta(a)oss.qualcomm.com> Signed-off-by: Vijayanand Jitta <vijayanand.jitta(a)oss.qualcomm.com> Signed-off-by: Prakash Gupta <prakash.gupta(a)oss.qualcomm.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/Kconfig | 9 ++ drivers/iommu/io-pgtable-arm.c | 150 +++++++++++++++++++++++++++++---- include/linux/io-pgtable.h | 8 ++ 3 files changed, 150 insertions(+), 17 deletions(-) diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig index f91ab5cba204..f64bb6e43c98 100644 --- a/drivers/iommu/Kconfig +++ b/drivers/iommu/Kconfig @@ -23,6 +23,15 @@ menuconfig IOMMU_SUPPORT if IOMMU_SUPPORT +config IOMMU_CONT_HINT_SUPPORT + def_bool y + help + Marker for kernels whose ARM LPAE page-table code supports the + contiguous hint (CONT) bit, i.e. IO_PGTABLE_QUIRK_ARM_CONT_HINT. + This is always enabled in this kernel so that downstream drivers + can select their compilation based on whether the capability is + available. + menu "Generic IOMMU Pagetable Support" # Selected by the actual pagetable implementations diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index aecd5939e7b2..94713ee22748 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -93,6 +93,16 @@ /* Software bit for solving coherency races */ #define ARM_LPAE_PTE_SW_SYNC (((arm_lpae_iopte)1) << 55) +/* PTE Contiguous Bit */ +#define ARM_LPAE_PTE_CONT (((arm_lpae_iopte)1) << 52) + +/* + * Granule CONT page Block CONT block L1 block CONT L1 + * 4K 64K 2M 32M 1G 16G + * 16K 2M 32M 1G + * 64K 2M 512M 16G + */ + /* Stage-1 PTE */ #define ARM_LPAE_PTE_AP_UNPRIV (((arm_lpae_iopte)1) << 6) #define ARM_LPAE_PTE_AP_RDONLY_BIT 7 @@ -408,6 +418,24 @@ static arm_lpae_iopte arm_lpae_install_table(arm_lpae_iopte *table, return old; } +static int arm_lpae_num_cont(size_t size) +{ + switch (size) { + case SZ_4K: + case SZ_2M: + case SZ_1G: + return 16; + case SZ_64K: + case SZ_32M: + case SZ_512M: + return 32; + case SZ_16K: + return 128; + default: + return 1; + } +} + static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, phys_addr_t paddr, size_t size, size_t pgcount, arm_lpae_iopte prot, int lvl, arm_lpae_iopte *ptep, @@ -417,19 +445,40 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, size_t block_size = ARM_LPAE_BLOCK_SIZE(lvl, data); size_t tblsz = ARM_LPAE_GRANULE(data); struct io_pgtable_cfg *cfg = &data->iop.cfg; - int ret = 0, num_entries, max_entries, map_idx_start; + int num_cont = arm_lpae_num_cont(block_size); + size_t cont_size = 0, entries_per_map; + int num_entries, max_entries, map_idx_start; + + if (num_cont > 1 && block_size <= SIZE_MAX / num_cont) + cont_size = num_cont * block_size; /* Find our entry at the current level */ map_idx_start = ARM_LPAE_LVL_IDX(iova, lvl, data); ptep += map_idx_start; /* If we can install a leaf entry at this level, then do so */ - if (size == block_size) { + if (size == block_size || + ((cfg->quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT) && + size == cont_size)) { + bool cont = size == cont_size; + int ret; + + if (cont && (!IS_ALIGNED(iova, size) || !IS_ALIGNED(paddr, size))) + return -EINVAL; + + entries_per_map = size / block_size; max_entries = arm_lpae_max_entries(map_idx_start, data); - num_entries = min_t(int, pgcount, max_entries); - ret = arm_lpae_init_pte(data, iova, paddr, prot, lvl, num_entries, ptep); + num_entries = min_t(size_t, pgcount, + max_entries / entries_per_map) * entries_per_map; + if (!num_entries) + return -EINVAL; + if (cont) + prot |= ARM_LPAE_PTE_CONT; + + ret = arm_lpae_init_pte(data, iova, paddr, prot, lvl, num_entries, + ptep); if (!ret) - *mapped += num_entries * size; + *mapped += num_entries * block_size; return ret; } @@ -683,12 +732,19 @@ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data, { arm_lpae_iopte pte; struct io_pgtable *iop = &data->iop; + size_t block_size, cont_size = 0, entries_per_map; + int num_cont; int i = 0, num_entries, max_entries, unmap_idx_start; /* Something went horribly wrong and we ran out of page table */ if (WARN_ON(lvl == ARM_LPAE_MAX_LEVELS)) return 0; + block_size = ARM_LPAE_BLOCK_SIZE(lvl, data); + num_cont = arm_lpae_num_cont(block_size); + if (num_cont > 1 && block_size <= SIZE_MAX / num_cont) + cont_size = num_cont * block_size; + unmap_idx_start = ARM_LPAE_LVL_IDX(iova, lvl, data); ptep += unmap_idx_start; pte = READ_ONCE(*ptep); @@ -696,9 +752,24 @@ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data, return 0; /* If the size matches this level, we're in the right place */ - if (size == ARM_LPAE_BLOCK_SIZE(lvl, data)) { + if (size == block_size || + ((iop->cfg.quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT) && + size == cont_size)) { + entries_per_map = size / block_size; max_entries = arm_lpae_max_entries(unmap_idx_start, data); - num_entries = min_t(int, pgcount, max_entries); + num_entries = min_t(size_t, pgcount, + max_entries / entries_per_map) * entries_per_map; + if (!num_entries) + return 0; + + /* Check this batch before clearing PTEs or freeing sub-tables. */ + if (((pte & ARM_LPAE_PTE_CONT) && + !IS_ALIGNED(iova, cont_size)) || + ((READ_ONCE(ptep[num_entries - 1]) & ARM_LPAE_PTE_CONT) && + !IS_ALIGNED(iova + num_entries * block_size, cont_size))) { + WARN_ON_ONCE(1); + return 0; + } while (i < num_entries) { pte = READ_ONCE(*ptep); @@ -709,19 +780,33 @@ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data, if (!iopte_leaf(pte, lvl, iop->fmt)) { /* Also flush any partial walks */ - io_pgtable_tlb_flush_walk(iop, iova + i * size, size, - ARM_LPAE_GRANULE(data)); + io_pgtable_tlb_flush_walk(iop, iova + i * block_size, + block_size, ARM_LPAE_GRANULE(data)); __arm_lpae_free_pgtable(data, lvl + 1, iopte_deref(pte, data)); } else if (!iommu_iotlb_gather_queued(gather)) { - io_pgtable_tlb_add_page(iop, gather, iova + i * size, size); + unsigned long end = iova + (i + 1) * block_size; + + if (pte & ARM_LPAE_PTE_CONT) { + /* Add a complete group after its last PTE is cleared. */ + if (IS_ALIGNED(end, cont_size)) + io_pgtable_tlb_add_page(iop, gather, + end - cont_size, cont_size); + } else { + io_pgtable_tlb_add_page(iop, gather, + end - block_size, + block_size); + } } ptep++; i++; } - return i * size; + return i * block_size; } else if (iopte_leaf(pte, lvl, iop->fmt)) { + /* Never split a block that belongs to a CONT group. */ + if (WARN_ON_ONCE(pte & ARM_LPAE_PTE_CONT)) + return 0; /* * Insert a table at the next level to map the old region, * minus the part we want to unmap @@ -1246,6 +1331,10 @@ static int arm_lpae_read_and_clear_dirty(struct io_pgtable_ops *ops, arm_lpae_iopte *ptep = data->pgd; int lvl = data->start_level; + /* CONT page tables do not support dirty tracking. */ + if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT) + return -EOPNOTSUPP; + if (WARN_ON(!size)) return -EINVAL; if (WARN_ON((iova + size - 1) & ~(BIT(cfg->ias) - 1))) @@ -1295,8 +1384,23 @@ static void arm_lpae_restrict_pgsizes(struct io_pgtable_cfg *cfg) } cfg->pgsize_bitmap &= page_sizes; + if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT) { + unsigned long sizes = cfg->pgsize_bitmap; + + while (sizes) { + unsigned long size = BIT(__ffs(sizes)); + int num_cont = arm_lpae_num_cont(size); + + if (size <= ULONG_MAX / num_cont) + cfg->pgsize_bitmap |= num_cont * size; + sizes &= ~size; + } + } + cfg->ias = min(cfg->ias, max_addr_bits); cfg->oas = min(cfg->oas, max_addr_bits); + cfg->pgsize_bitmap &= GENMASK_ULL(cfg->ias, 0); + cfg->pgsize_bitmap &= GENMASK_ULL(cfg->oas, 0); } static struct arm_lpae_io_pgtable * @@ -1305,6 +1409,12 @@ arm_lpae_alloc_pgtable(struct io_pgtable_cfg *cfg) struct arm_lpae_io_pgtable *data; int levels, va_bits, pg_shift; + /* Dirty tracking and CONT permissions cannot be updated as a group yet. */ + if ((cfg->quirks & (IO_PGTABLE_QUIRK_ARM_HD | + IO_PGTABLE_QUIRK_ARM_CONT_HINT)) == + (IO_PGTABLE_QUIRK_ARM_HD | IO_PGTABLE_QUIRK_ARM_CONT_HINT)) + return NULL; + arm_lpae_restrict_pgsizes(cfg); if (!(cfg->pgsize_bitmap & (SZ_4K | SZ_16K | SZ_64K))) @@ -1334,13 +1444,17 @@ arm_lpae_alloc_pgtable(struct io_pgtable_cfg *cfg) .map_pages = arm_lpae_map_pages, .unmap_pages = arm_lpae_unmap_pages, .iova_to_phys = arm_lpae_iova_to_phys, - .split_block = arm_lpae_split_block, - .merge_page = arm_lpae_merge_page, - .sync_dirty_log = arm_lpae_sync_dirty_log, - .clear_dirty_log = arm_lpae_clear_dirty_log, .read_and_clear_dirty = arm_lpae_read_and_clear_dirty, }; + /* CONT page tables do not support dirty tracking . */ + if (!(cfg->quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT)) { + data->iop.ops.split_block = arm_lpae_split_block; + data->iop.ops.merge_page = arm_lpae_merge_page; + data->iop.ops.sync_dirty_log = arm_lpae_sync_dirty_log; + data->iop.ops.clear_dirty_log = arm_lpae_clear_dirty_log; + } + return data; } @@ -1358,7 +1472,8 @@ arm_64_lpae_alloc_pgtable_s1(struct io_pgtable_cfg *cfg, void *cookie) IO_PGTABLE_QUIRK_ARM_HD | IO_PGTABLE_QUIRK_ARM_BBML1 | IO_PGTABLE_QUIRK_ARM_BBML2 | - IO_PGTABLE_QUIRK_HISI_ERRATA)) + IO_PGTABLE_QUIRK_HISI_ERRATA | + IO_PGTABLE_QUIRK_ARM_CONT_HINT)) return NULL; data = arm_lpae_alloc_pgtable(cfg); @@ -1464,7 +1579,8 @@ arm_64_lpae_alloc_pgtable_s2(struct io_pgtable_cfg *cfg, void *cookie) IO_PGTABLE_QUIRK_ARM_BBML1 | IO_PGTABLE_QUIRK_ARM_BBML2 | IO_PGTABLE_QUIRK_ARM_S2FWB | - IO_PGTABLE_QUIRK_HISI_ERRATA)) + IO_PGTABLE_QUIRK_HISI_ERRATA | + IO_PGTABLE_QUIRK_ARM_CONT_HINT)) return NULL; data = arm_lpae_alloc_pgtable(cfg); diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h index 62a0c5b0f55f..076cfb85f167 100644 --- a/include/linux/io-pgtable.h +++ b/include/linux/io-pgtable.h @@ -98,6 +98,13 @@ struct io_pgtable_cfg { * IO_PGTABLE_QUIRK_ARM_BBML2: ARM SMMU supports BBM Level 2 behavior * when changing block size. * IO_PGTABLE_QUIRK_ARM_S2FWB: Use the FWB format for the MemAttrs bits + * IO_PGTABLE_QUIRK_ARM_CONT_HINT: Enable contiguous hints for ARM LPAE. + * Disabled by default; drivers opt in before alloc_io_pgtable_ops(). + * Only mappings using an advertised CONT group size are tagged. + * The pgsize_bitmap returned in cfg then also includes CONT + * group sizes, which may be mistaken for a native granule (e.g. + * 64K). Do not pass it back as the input of another allocation; + * build each cfg from the native hardware page sizes. */ #define IO_PGTABLE_QUIRK_ARM_NS BIT(0) #define IO_PGTABLE_QUIRK_NO_PERMS BIT(1) @@ -110,6 +117,7 @@ struct io_pgtable_cfg { #define IO_PGTABLE_QUIRK_ARM_BBML2 BIT(9) #define IO_PGTABLE_QUIRK_ARM_S2FWB BIT(10) #define IO_PGTABLE_QUIRK_HISI_ERRATA BIT(11) + #define IO_PGTABLE_QUIRK_ARM_CONT_HINT BIT(12) unsigned long quirks; unsigned long pgsize_bitmap; unsigned int ias; -- 2.22.0

2 1

[PATCH OLK-5.10 0/2] *** CVE-2026-98343 ***
by Hongtao Zhang 04 Nov '26

04 Nov '26

*** BLURB HERE *** Shivank Garg (2): dmaengine: Fix device kref underflow in dma_chan_put() dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() drivers/dma/dmaengine.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] arm64: tlb: Enable local TLBI on systems without FEAT_TLBID
by Jinqian Yang 03 Nov '26

03 Nov '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/10207 ---------------------------------------- Enable mm_cpumask tracking unconditionally, so the mask is always valid even without FEAT_TLBID. Then in flush_tlb_begin(), use it to decide the flush scope: with IRQs disabled and a DSB ISHST ordering the page-table updates, if no other CPU is in the mask, do a local TLBI instead of broadcasting a DVM to the inner-shareable domain. UnixBench(3-round average): Process Creation +8.0%, Execl +7.7%, Shell Scripts +5.7%. Reported-by: Nianyao Tang <tangnianyao(a)huawei.com> Signed-off-by: Jinqian Yang <yangjinqian1(a)huawei.com> --- arch/arm64/include/asm/tlbflush.h | 23 +++++++++++------------ arch/arm64/kernel/smp.c | 3 +-- arch/arm64/mm/context.c | 6 ++---- 3 files changed, 14 insertions(+), 18 deletions(-) diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h index 5ccc0982f834..290ace254be7 100644 --- a/arch/arm64/include/asm/tlbflush.h +++ b/arch/arm64/include/asm/tlbflush.h @@ -188,20 +188,17 @@ enum tlb_flush_scope { static inline enum tlb_flush_scope flush_tlb_begin(struct mm_struct *mm, unsigned long *flags) { - if (!system_supports_tlbid()) { - dsb(ishst); - return TLB_FLUSH_SCOPE_BROADCAST; - } - local_irq_save(*flags); + dsb(ishst); - if (cpumask_any_but(mm_cpumask(mm), smp_processor_id()) >= nr_cpu_ids) { - dsb(nshst); + if (cpumask_any_but(mm_cpumask(mm), smp_processor_id()) >= nr_cpu_ids) return TLB_FLUSH_SCOPE_LOCAL; - } else { - dsb(ishst); + + if (system_supports_tlbid()) return TLB_FLUSH_SCOPE_DOMAIN; - } + + local_irq_restore(*flags); + return TLB_FLUSH_SCOPE_BROADCAST; } static inline void flush_tlb_end(enum tlb_flush_scope scope, unsigned long flags) @@ -632,7 +629,8 @@ static inline void __flush_tlb_range_nosync(struct mm_struct *mm, asid = ASID(mm); scope = flush_tlb_begin(mm, &flags); - if (scope == TLB_FLUSH_SCOPE_DOMAIN) { + if (IS_ENABLED(CONFIG_ARM64_TLBID) && + scope == TLB_FLUSH_SCOPE_DOMAIN) { domain = pick_best_domain(mm_cpumask(mm)); if (last_level) @@ -694,7 +692,8 @@ static inline void __flush_tlb_page_nosync(struct mm_struct *mm, dsb(ishst); scope = flush_tlb_begin(mm, &flags); - if (scope == TLB_FLUSH_SCOPE_DOMAIN) { + if (IS_ENABLED(CONFIG_ARM64_TLBID) && + scope == TLB_FLUSH_SCOPE_DOMAIN) { domain = pick_best_domain(mm_cpumask(mm)); lo = __tlbip_va_lo(asid, domain, 0); diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c index 4290231e02e0..1ed686b3c0f4 100644 --- a/arch/arm64/kernel/smp.c +++ b/arch/arm64/kernel/smp.c @@ -351,8 +351,7 @@ void arch_cpuhp_cleanup_dead_cpu(unsigned int cpu) pr_debug("CPU%u: shutdown\n", cpu); - if (system_supports_tlbid()) - clear_tasks_mm_cpumask(cpu); + clear_tasks_mm_cpumask(cpu); /* * Now that the dying CPU is beyond the point of no return w.r.t. diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c index ce314cb9fd09..294aa0da7726 100644 --- a/arch/arm64/mm/context.c +++ b/arch/arm64/mm/context.c @@ -206,8 +206,7 @@ static u64 new_context(struct mm_struct *mm) /* We have more ASIDs than CPUs, so this will always succeed */ asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1); - if (system_supports_tlbid()) - cpumask_clear(mm_cpumask(mm)); + cpumask_clear(mm_cpumask(mm)); set_asid: __set_bit(asid, asid_map); @@ -264,8 +263,7 @@ void check_and_switch_context(struct mm_struct *mm) arm64_apply_bp_hardening(); - if (system_supports_tlbid()) - cpumask_set_cpu(cpu, mm_cpumask(mm)); + cpumask_set_cpu(cpu, mm_cpumask(mm)); /* * Defer TTBR0_EL1 setting for user threads to uaccess_enable() when -- 2.33.0

2 1

[PATCH OLK-6.6] md: fix out-of-bound by adding checks at store
by Zhou Minqiang 03 Nov '26

03 Nov '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10161 Reference: https://lore.kernel.org/all/e743762c-2ed0-465b-bfa1-57e75aabf034@fygo.io/ -------------------------------- syzbot reported array-index-out-of-bounds in super_90_sync() UBSAN: array-index-out-of-bounds in drivers/md/md.c:1697:17 index 124 is out of range for type 'mdp_disk_t [27]' CPU: 1 UID: 0 PID: 10197 Comm: syz.3.1362 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455 super_90_sync+0x1eed/0x1ff0 drivers/md/md.c:1697 ... super_90_sync() exists for older version 0.90, which supports up to 27 maximum disks (MD_SB_DISKS). This function doesn't contain any bound checks for raid disks. The repro wrote higher value (124) in raid_disks sysfs attribute to trigger this bug. Add bound checks in three entry points that can set raid_disks or major_version without validating against the v0.90 superblock limit: - raid_disks_store(): add max_disks check in the reshape branch and the else branch, mirroring the existing check in update_raid_disks(). - metadata_store(): reject major_version=0 when the existing raid_disks already exceeds MD_SB_DISKS. - md_set_array_info(): reject the creation path when persistent and raid_disks >= MD_SB_DISKS. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 80d2bddb9e46..b8ddc1959871 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -4357,11 +4357,20 @@ raid_disks_store(struct mddev *mddev, const char *buf, size_t len) goto out_unlock; } err = 0; + if (mddev->max_disks && n >= mddev->max_disks) { + err = -EINVAL; + goto out_unlock; + } mddev->delta_disks = n - olddisks; mddev->raid_disks = n; mddev->reshape_backwards = (mddev->delta_disks < 0); - } else + } else { + if (mddev->max_disks && n >= mddev->max_disks) { + err = -EINVAL; + goto out_unlock; + } mddev->raid_disks = n; + } out_unlock: mddev_unlock_and_resume(mddev); return err ? err : len; @@ -4912,6 +4921,7 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len) mddev->external = 0; mddev->major_version = 0; mddev->minor_version = 90; + mddev->max_disks = 0; goto out_unlock; } if (strncmp(buf, "external:", 9) == 0) { @@ -4926,6 +4936,7 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len) mddev->external = 1; mddev->major_version = 0; mddev->minor_version = 90; + mddev->max_disks = 0; goto out_unlock; } major = simple_strtoul(buf, &e, 10); @@ -4936,12 +4947,18 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len) minor = simple_strtoul(buf, &e, 10); if (e==buf || (*e && *e != '\n') ) goto out_unlock; + if (major == 0 && mddev->raid_disks >= MD_SB_DISKS) + goto out_unlock; err = -ENOENT; if (major >= ARRAY_SIZE(super_types) || super_types[major].name == NULL) goto out_unlock; mddev->major_version = major; mddev->minor_version = minor; mddev->persistent = 1; + if (major == 0) + mddev->max_disks = MD_SB_DISKS; + else if (major == 1) + mddev->max_disks = (4096 - 256) / 2; mddev->external = 0; err = 0; out_unlock: @@ -7421,12 +7438,23 @@ int md_set_array_info(struct mddev *mddev, struct mdu_array_info_s *info) mddev->minor_version = info->minor_version; mddev->patch_version = info->patch_version; mddev->persistent = !info->not_persistent; + if (mddev->persistent == 1) { + if (mddev->major_version == 0) + mddev->max_disks = MD_SB_DISKS; + else if (mddev->major_version == 1) + mddev->max_disks = (4096 - 256) / 2; + } /* ensure mddev_put doesn't delete this now that there * is some minimal configuration. */ mddev->ctime = ktime_get_real_seconds(); return 0; } + if (!info->not_persistent && info->raid_disks >= MD_SB_DISKS) { + pr_warn("md: raid disks (%d) exceeds max disks (%d) for metadata version 0.90\n", + info->raid_disks, MD_SB_DISKS); + return -EINVAL; + } mddev->major_version = MD_MAJOR_VERSION; mddev->minor_version = MD_MINOR_VERSION; mddev->patch_version = MD_PATCHLEVEL_VERSION; -- 2.52.0

2 1

[PATCH OLK-5.10] md: fix out-of-bound by adding checks at store
by Zhou Minqiang 03 Nov '26

03 Nov '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10161 Reference: https://lore.kernel.org/all/e743762c-2ed0-465b-bfa1-57e75aabf034@fygo.io/ -------------------------------- syzbot reported array-index-out-of-bounds in super_90_sync() UBSAN: array-index-out-of-bounds in drivers/md/md.c:1697:17 index 124 is out of range for type 'mdp_disk_t [27]' CPU: 1 UID: 0 PID: 10197 Comm: syz.3.1362 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455 super_90_sync+0x1eed/0x1ff0 drivers/md/md.c:1697 ... super_90_sync() exists for older version 0.90, which supports up to 27 maximum disks (MD_SB_DISKS). This function doesn't contain any bound checks for raid disks. The repro wrote higher value (124) in raid_disks sysfs attribute to trigger this bug. Add bound checks in three entry points that can set raid_disks or major_version without validating against the v0.90 superblock limit: - raid_disks_store(): add max_disks check in the reshape branch and the else branch, mirroring the existing check in update_raid_disks(). - metadata_store(): reject major_version=0 when the existing raid_disks already exceeds MD_SB_DISKS. - md_set_array_info(): reject the creation path when persistent and raid_disks >= MD_SB_DISKS. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 2952b178f016..c5f98bc89e0c 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -4278,11 +4278,20 @@ raid_disks_store(struct mddev *mddev, const char *buf, size_t len) goto out_unlock; } err = 0; + if (mddev->max_disks && n >= mddev->max_disks) { + err = -EINVAL; + goto out_unlock; + } mddev->delta_disks = n - olddisks; mddev->raid_disks = n; mddev->reshape_backwards = (mddev->delta_disks < 0); - } else + } else { + if (mddev->max_disks && n >= mddev->max_disks) { + err = -EINVAL; + goto out_unlock; + } mddev->raid_disks = n; + } out_unlock: mddev_unlock(mddev); return err ? err : len; @@ -4825,6 +4834,7 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len) mddev->external = 0; mddev->major_version = 0; mddev->minor_version = 90; + mddev->max_disks = 0; goto out_unlock; } if (strncmp(buf, "external:", 9) == 0) { @@ -4839,6 +4849,7 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len) mddev->external = 1; mddev->major_version = 0; mddev->minor_version = 90; + mddev->max_disks = 0; goto out_unlock; } major = simple_strtoul(buf, &e, 10); @@ -4849,12 +4860,18 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len) minor = simple_strtoul(buf, &e, 10); if (e==buf || (*e && *e != '\n') ) goto out_unlock; + if (major == 0 && mddev->raid_disks >= MD_SB_DISKS) + goto out_unlock; err = -ENOENT; if (major >= ARRAY_SIZE(super_types) || super_types[major].name == NULL) goto out_unlock; mddev->major_version = major; mddev->minor_version = minor; mddev->persistent = 1; + if (major == 0) + mddev->max_disks = MD_SB_DISKS; + else if (major == 1) + mddev->max_disks = (4096 - 256) / 2; mddev->external = 0; err = 0; out_unlock: @@ -7288,12 +7305,23 @@ int md_set_array_info(struct mddev *mddev, struct mdu_array_info_s *info) mddev->minor_version = info->minor_version; mddev->patch_version = info->patch_version; mddev->persistent = !info->not_persistent; + if (mddev->persistent == 1) { + if (mddev->major_version == 0) + mddev->max_disks = MD_SB_DISKS; + else if (mddev->major_version == 1) + mddev->max_disks = (4096 - 256) / 2; + } /* ensure mddev_put doesn't delete this now that there * is some minimal configuration. */ mddev->ctime = ktime_get_real_seconds(); return 0; } + if (!info->not_persistent && info->raid_disks >= MD_SB_DISKS) { + pr_warn("md: raid disks (%d) exceeds max disks (%d) for metadata version 0.90\n", + info->raid_disks, MD_SB_DISKS); + return -EINVAL; + } mddev->major_version = MD_MAJOR_VERSION; mddev->minor_version = MD_MINOR_VERSION; mddev->patch_version = MD_PATCHLEVEL_VERSION; -- 2.52.0

2 1

[PATCH OLK-6.6] wifi: mac80211: minstrel_ht: validate fixed rate index
by Yi Yang 03 Nov '26

03 Nov '26

From: Yuqi Xu <xuyuqiabc(a)gmail.com> stable inclusion from stable-v6.6.160 commit eebc70f132041b35da9ec74d5d395083125289b2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20518 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 15fb9e3cea55fbc378261ce35a32b0f8828f0000 upstream. The fixed_rate_idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel_ht_update_stats() then copies the value into mi->max_tp_rate[] and mi->max_prob_rate, and minstrel_ht_set_rate() uses MI_RATE_GROUP()/MI_RATE_IDX() to index minstrel_mcs_groups[] (42 entries) and mi->groups[].rates[] (10 entries) with it. Writing e.g. 65535 selects group 4095 and rate index 15, far outside both arrays. The out-of-bounds entries are dereferenced and updated as struct minstrel_rate_stats (retry counts, etc.), so the invalid index corrupts adjacent kernel memory. With CONFIG_UBSAN_BOUNDS the access is reported as an array-index-out-of-bounds in minstrel_ht_set_rate(). Only a valid group/rate pair, or U32_MAX to disable fixed rate processing, can be used safely, so reject any other value when the debugfs file is written. The file is only reachable through a root-only debugfs mount, so this is not a privilege boundary. The out-of-bounds access is still a bug that must not be reachable through a writable debugfs attribute. Fixes: 24f7580e852b ("minstrel_ht: fixed rate mode through debugfs") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Assisted-by: LLM Signed-off-by: Yuqi Xu <xuyuqiabc(a)gmail.com> Reviewed-by: Ren Wei <weir(a)nebusec.ai> Link: https://patch.msgid.link/288e6f6d30dc82ff40da502755e6666982f6b735.178979800… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- net/mac80211/rc80211_minstrel_ht.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c index 34eee00dac4f..737b1ad04366 100644 --- a/net/mac80211/rc80211_minstrel_ht.c +++ b/net/mac80211/rc80211_minstrel_ht.c @@ -7,6 +7,7 @@ #include <linux/types.h> #include <linux/skbuff.h> #include <linux/debugfs.h> +#include <linux/limits.h> #include <linux/random.h> #include <linux/moduleparam.h> #include <linux/ieee80211.h> @@ -2015,14 +2016,39 @@ minstrel_ht_alloc(struct ieee80211_hw *hw) } #ifdef CONFIG_MAC80211_DEBUGFS +static int minstrel_ht_fixed_rate_idx_get(void *data, u64 *val) +{ + *val = *(u32 *)data; + return 0; +} + +static int minstrel_ht_fixed_rate_idx_set(void *data, u64 val) +{ + u32 idx = val; + + /* U32_MAX is the default and keeps fixed rate processing disabled */ + if (val != U32_MAX && + (val > U16_MAX || + MI_RATE_GROUP(idx) >= ARRAY_SIZE(minstrel_mcs_groups) || + MI_RATE_IDX(idx) >= MCS_GROUP_RATES)) + return -EINVAL; + + *(u32 *)data = idx; + return 0; +} + +DEFINE_DEBUGFS_ATTRIBUTE(minstrel_ht_fixed_rate_idx_fops, + minstrel_ht_fixed_rate_idx_get, + minstrel_ht_fixed_rate_idx_set, "%llu\n"); + static void minstrel_ht_add_debugfs(struct ieee80211_hw *hw, void *priv, struct dentry *debugfsdir) { struct minstrel_priv *mp = priv; mp->fixed_rate_idx = (u32) -1; - debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir, - &mp->fixed_rate_idx); + debugfs_create_file("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir, + &mp->fixed_rate_idx, &minstrel_ht_fixed_rate_idx_fops); } #endif -- 2.25.1

2 1

[PATCH OLK-6.6] net: ena: fix MMIO read buffer leak on probe failure
by Yi Yang 03 Nov '26

03 Nov '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.160 commit a0f5fd7a285f44fa402242f26feddfe1d4a0fc6c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20691 CVE: CVE-2026-98486 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9476b4468862927297c94c440863cd8ed1e7cc83 ] ena_device_init() initializes the MMIO read mechanism with ena_com_mmio_reg_read_request_init(), which allocates a coherent DMA buffer for MMIO read responses. The normal removal path releases this buffer through ena_com_mmio_reg_read_request_destroy(). However, if ena_probe() fails after ena_device_init() succeeds, the error path destroys the admin resources and eventually frees ena_dev without destroying the MMIO read request, leaving the coherent DMA buffer allocated. Call ena_com_mmio_reg_read_request_destroy() in the probe error path before releasing the remaining device resources. This issue was found by manual code inspection. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Cc: stable(a)vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Link: https://patch.msgid.link/20260921154202.471662-3-lgs201920130244@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> [ Adjusted cleanup context due to missing PHC, devlink, and customer-metrics code. ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c index 60d8d2d99af1..2242fb1f3e0d 100644 --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c @@ -3990,6 +3990,7 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err_device_destroy: ena_com_delete_host_info(ena_dev); ena_com_admin_destroy(ena_dev); + ena_com_mmio_reg_read_request_destroy(ena_dev); err_netdev_destroy: free_netdev(netdev); err_free_region: -- 2.25.1

2 1