- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] md/raid1,raid10: fix bio accounting for split md cloned bios
by Zhou Minqiang 09 Sep '26

09 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit ba976e3501111d11c550848b3b7341a73035f582 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Use md_cloned_bio() to control bio accounting instead of relying on r1bio_existed in raid1 or the io_accounting flag in raid10. The previous logic does not reliably reflect whether a bio is an md cloned bio. When a failed bio is split and resubmitted via bio_submit_split_bioset() on the error path, this can lead to either double accounting for md cloned bios, or missing accounting for bios returned from bio_submit_split_bioset() Fix this by using md_cloned_bio() to detect md cloned bios and skip accounting accordingly. Fixes: bb2a9acefaf9 ("md/raid1: switch to use md_account_bio() for io accounting") Fixes: 820455238366 ("md/raid10: switch to use md_account_bio() for io accounting") Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> Reviewed-by: Xiao Ni <xiao(a)kernel.org> Link: https://patch.msgid.link/20260501114652.590037-4-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai <yukuai(a)fygo.io> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/raid1.c | 2 +- drivers/md/raid10.c | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index a4662d5077ba..e71ddd532455 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1333,7 +1333,7 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, */ gfp_t gfp = err_path ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; - if (r1bio_existed) { + if (likely(!md_cloned_bio(mddev, bio))) { /* Need to get the block device name carefully */ struct md_rdev *rdev = conf->mirrors[r1_bio->read_disk].rdev; diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 316b6c96d413..e8ce8cdd7fce 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1140,7 +1140,7 @@ static bool regular_request_wait(struct mddev *mddev, struct r10conf *conf, } static void raid10_read_request(struct mddev *mddev, struct bio *bio, - struct r10bio *r10_bio, bool io_accounting) + struct r10bio *r10_bio) { struct r10conf *conf = mddev->private; struct bio *read_bio; @@ -1218,7 +1218,7 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, } slot = r10_bio->read_slot; - if (io_accounting) { + if (likely(!md_cloned_bio(mddev, bio))) { md_account_bio(mddev, &bio); r10_bio->master_bio = bio; } @@ -1514,7 +1514,7 @@ static bool __make_request(struct mddev *mddev, struct bio *bio, int sectors) ret = true; if (bio_data_dir(bio) == READ) - raid10_read_request(mddev, bio, r10_bio, true); + raid10_read_request(mddev, bio, r10_bio); else ret = raid10_write_request(mddev, bio, r10_bio); @@ -2839,7 +2839,7 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio) rdev_dec_pending(rdev, mddev); r10_bio->state = 0; - raid10_read_request(mddev, r10_bio->master_bio, r10_bio, false); + raid10_read_request(mddev, r10_bio->master_bio, r10_bio); /* * allow_barrier after re-submit to ensure no sync io * can be issued while regular io pending. -- 2.52.0

2 1

[PATCH OLK-6.6] Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
by Xia Fukun 09 Sep '26

09 Sep '26

From: Pauli Virtanen <pav(a)iki.fi> mainline inclusion from mainline-v7.2-rc6 commit af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17795 CVE: CVE-2026-74533 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */ and also to races in iso_conn_add() vs. iso_conn_free(). Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data. Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn") Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/iso.c [Downstream 6.6 baseline lacks the __guarded_by sparse annotation (dropped it from iso_data). iso_listen_bis() does not use iso_conn_add(), so that hunk was skipped.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- include/net/bluetooth/hci_core.h | 2 ++ net/bluetooth/hci_conn.c | 2 ++ net/bluetooth/iso.c | 62 ++++++++++++++++++++++++++------ 3 files changed, 55 insertions(+), 11 deletions(-) diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 8da493385bd4..7ef7a8b4dd23 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -744,6 +744,8 @@ struct hci_conn { struct dentry *debugfs; struct hci_dev *hdev; + + spinlock_t proto_lock; /* lock guarding protocol data */ void *l2cap_data; void *sco_data; void *iso_data; diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 53abbea42845..c3329000da80 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -1001,6 +1001,8 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle); INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout); + spin_lock_init(&conn->proto_lock); + atomic_set(&conn->refcnt, 0); hci_dev_hold(hdev); diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 61a1c8bddf16..5e84b6c8a194 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -106,9 +106,16 @@ static void iso_conn_free(struct kref *ref) BT_DBG("conn %p", conn); if (conn->hcon) { - conn->hcon->iso_data = NULL; - if (!test_and_set_bit(ISO_CONN_DROPPED, conn->flags)) - hci_conn_drop(conn->hcon); + spin_lock(&conn->hcon->proto_lock); + + /* Check we are not racing with iso_conn_add */ + if (conn->hcon->iso_data == conn) { + conn->hcon->iso_data = NULL; + if (!test_and_set_bit(ISO_CONN_DROPPED, conn->flags)) + hci_conn_drop(conn->hcon); + } + + spin_unlock(&conn->hcon->proto_lock); } kfree_skb(conn->rx_skb); @@ -123,7 +130,21 @@ static void iso_conn_put(struct iso_conn *conn) BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref)); + /* The following race vs. iso_conn_del() is possible: + * + * 1. conn->hcon != NULL here + * 2. kref_put puts the last reference + * 3. concurrent iso_conn_del() gets iso_conn_hold_unless_zero() -> NULL + * and returns immediately, so conn->hcon is not cleared + * 4. iso_conn_free() dereferences conn->hcon + * + * To avoid UAF in step 4, take RCU before decrementing the refcount. + */ + rcu_read_lock(); + kref_put(&conn->ref, iso_conn_free); + + rcu_read_unlock(); } static struct iso_conn *iso_conn_hold_unless_zero(struct iso_conn *conn) @@ -202,22 +223,28 @@ static void iso_sock_disable_timer(struct sock *sk) /* ---- ISO connections ---- */ static struct iso_conn *iso_conn_add(struct hci_conn *hcon) + __must_hold(&hcon->hdev->lock) { - struct iso_conn *conn = hcon->iso_data; + struct iso_conn *conn; + + spin_lock(&hcon->proto_lock); - conn = iso_conn_hold_unless_zero(conn); + conn = iso_conn_hold_unless_zero(hcon->iso_data); if (conn) { if (!conn->hcon) { iso_conn_lock(conn); conn->hcon = hcon; iso_conn_unlock(conn); } + spin_unlock(&hcon->proto_lock); return conn; } - conn = kzalloc(sizeof(*conn), GFP_KERNEL); - if (!conn) + conn = kzalloc(sizeof(*conn), GFP_ATOMIC); + if (!conn) { + spin_unlock(&hcon->proto_lock); return NULL; + } kref_init(&conn->ref); spin_lock_init(&conn->lock); @@ -226,6 +253,8 @@ static struct iso_conn *iso_conn_add(struct hci_conn *hcon) conn->hcon = hcon; conn->tx_sn = 0; + spin_unlock(&hcon->proto_lock); + BT_DBG("hcon %p conn %p", hcon, conn); return conn; @@ -276,11 +305,13 @@ static bool iso_match_conn_sync_handle(struct sock *sk, void *data) static void iso_conn_del(struct hci_conn *hcon, int err) __must_hold(&hcon->hdev->lock) { - struct iso_conn *conn = hcon->iso_data; + struct iso_conn *conn; struct sock *sk; struct sock *parent; - conn = iso_conn_hold_unless_zero(conn); + spin_lock(&hcon->proto_lock); + conn = iso_conn_hold_unless_zero(hcon->iso_data); + spin_unlock(&hcon->proto_lock); if (!conn) return; @@ -322,10 +353,12 @@ static void iso_conn_del(struct hci_conn *hcon, int err) done: /* No sk access to conn->hcon any more (lock_sock + hdev->lock) */ + spin_lock(&hcon->proto_lock); iso_conn_lock(conn); conn->hcon = NULL; hcon->iso_data = NULL; iso_conn_unlock(conn); + spin_unlock(&hcon->proto_lock); iso_conn_put(conn); } @@ -439,6 +472,8 @@ static int iso_connect_bis(struct sock *sk) } } + lockdep_assert_held(&hcon->hdev->lock); + conn = iso_conn_add(hcon); if (!conn) { hci_conn_drop(hcon); @@ -537,6 +572,8 @@ static int iso_connect_cis(struct sock *sk) } } + lockdep_assert_held(&hcon->hdev->lock); + conn = iso_conn_add(hcon); if (!conn) { hci_conn_drop(hcon); @@ -854,8 +891,8 @@ static void iso_sock_disconn(struct sock *sk) */ if (bis_sk) { hcon->state = BT_OPEN; - hcon->iso_data = NULL; - iso_pi(sk)->conn->hcon = NULL; + set_bit(ISO_CONN_DROPPED, iso_pi(sk)->conn->flags); + iso_sock_clear_timer(sk); iso_chan_del(sk, bt_to_errno(hcon->abort_reason)); sock_put(bis_sk); @@ -2161,7 +2198,10 @@ int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb, u16 flags) return -ENOENT; } + spin_lock(&hcon->proto_lock); conn = iso_conn_hold_unless_zero(hcon->iso_data); + spin_unlock(&hcon->proto_lock); + hcon = NULL; hci_dev_unlock(hdev); -- 2.34.1

2 1

[PATCH OLK-5.10 v2] md/raid1,raid10: fix error-path detection with md_cloned_bio()
by Zhou Minqiang 09 Sep '26

09 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit 811545e0926d02a6a0b1a1258bb5544777c164d4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Detect the error path using md_cloned_bio() instead of relying on r1_bio in raid1 or r10_bio->read_slot in raid10, which may be NULL or -1 after splitting and resubmitting a failed bio. As a result, the error path may not be recognized and memory allocations can incorrectly use GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), which can lead to a deadlock under memory pressure. Fixes: 689389a06ce7 ("md/raid1: simplify handle_read_error().") Fixes: 545250f24809 ("md/raid10: simplify handle_read_error()") Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> Reviewed-by: Xiao Ni <xiao(a)kernel.org> Link: https://patch.msgid.link/20260501114652.590037-3-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai <yukuai(a)fygo.io> Conflicts: drivers/md/raid1.c drivers/md/raid10.c [Backport to hulk-5.10: upstream uses md_cloned_bio() which depends on io_clone_set infrastructure absent in hulk-5.10. Use current == mddev->thread->tsk to detect error path instead] Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/raid1.c | 9 ++++++--- drivers/md/raid10.c | 14 +++++++++----- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index acd008f97847..5f929347d77d 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1198,13 +1198,16 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, int rdisk; bool r1bio_existed = !!r1_bio; char b[BDEVNAME_SIZE]; + struct md_thread *thread = rcu_dereference_protected(mddev->thread, true); + gfp_t gfp = GFP_NOIO; /* - * If r1_bio is set, we are blocking the raid1d thread - * so there is a tiny risk of deadlock. So ask for + * If we are in the error path, we are blocking the raid1d + * thread so there is a tiny risk of deadlock. So ask for * emergency memory if needed. */ - gfp_t gfp = r1_bio ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; + if (thread && current == thread->tsk) + gfp = GFP_NOIO | __GFP_HIGH; if (r1bio_existed) { /* Need to get the block device name carefully */ diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index f272021d4e8b..dc5401ae3b84 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1127,8 +1127,17 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, char b[BDEVNAME_SIZE]; int slot = r10_bio->read_slot; struct md_rdev *err_rdev = NULL; + struct md_thread *thread = rcu_dereference_protected(mddev->thread, true); gfp_t gfp = GFP_NOIO; + /* + * If we are in the error path, we are blocking the raid10d + * thread so there is a tiny risk of deadlock. So ask for + * emergency memory if needed. + */ + if (thread && current == thread->tsk) + gfp = GFP_NOIO | __GFP_HIGH; + if (slot >= 0 && r10_bio->devs[slot].rdev) { /* * This is an error retry, but we cannot @@ -1138,11 +1147,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, * we lose the device name in error messages. */ int disk; - /* - * As we are blocking raid10, it is a little safer to - * use __GFP_HIGH. - */ - gfp = GFP_NOIO | __GFP_HIGH; rcu_read_lock(); disk = r10_bio->devs[slot].devnum; -- 2.52.0

2 1

[PATCH OLK-6.6] drm/amdkfd: Add bounds check for CRAT subtype length
by Jiacheng Yu 09 Sep '26

09 Sep '26

From: William Palacek <William.Palacek(a)amd.com> mainline inclusion from mainline-v7.2-rc6 commit 6e7566ba4739dd573c331adde1c96690f7a567bd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18596 CVE: CVE-2026-80747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures. Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents. Signed-off-by: William Palacek <William.Palacek(a)amd.com> Reviewed-by: Alysa Liu <Alysa.Liu(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d) Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_crat.c [Context conflicts] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c index 29a02c175228..58edf03e4e1d 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c @@ -1314,6 +1314,15 @@ int kfd_parse_crat_table(void *crat_image, struct list_head *device_list, sub_type_hdr = (struct crat_subtype_generic *)(crat_table+1); while ((char *)sub_type_hdr + sizeof(struct crat_subtype_generic) < ((char *)crat_image) + image_len) { + /* Validate subtype fits within remaining image */ + if ((char *)sub_type_hdr + sub_type_hdr->length > + (char *)crat_image + image_len) { + pr_warn("CRAT subtype length %u exceeds image bounds\n", + sub_type_hdr->length); + ret = -EINVAL; + break; + } + if (sub_type_hdr->flags & CRAT_SUBTYPE_FLAGS_ENABLED) { ret = kfd_parse_subtype(sub_type_hdr, device_list); if (ret) -- 2.34.1

2 1

[PATCH OLK-6.6] Bluetooth: ISO: hold sk properly in iso_conn_ready
by Xia Fukun 09 Sep '26

09 Sep '26

From: Pauli Virtanen <pav(a)iki.fi> mainline inclusion from mainline-v7.2-rc6 commit 0d255e63fcf3f13a570d7ac11678fa1164ac015c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17977 CVE: CVE-2026-74537 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either: [Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock. Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO") Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/iso.c [In openEuler 6.6 iso_sock_kill() already takes lock_sock() at function entry, so the upstream-added lock_sock()/release_sock() around the conn->sk = NULL clearing were dropped to avoid a double-lock deadlock. The BIS sender source-address context is absent in this tree's iso_conn_ready() and was not introduced.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- net/bluetooth/iso.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index eda45006fddd..45e462478225 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -1781,23 +1781,17 @@ static void iso_sock_ready(struct sock *sk) { BT_DBG("sk %p", sk); - if (!sk) - return; - - lock_sock(sk); + lockdep_assert(lockdep_sock_is_held(sk)); switch (sk->sk_state) { case BT_DISCONN: case BT_CLOSED: - release_sock(sk); return; } iso_sock_clear_timer(sk); sk->sk_state = BT_CONNECTED; sk->sk_state_change(sk); - - release_sock(sk); } struct iso_list_data { @@ -1820,7 +1814,7 @@ static bool iso_match_pa_sync_flag(struct sock *sk, void *data) static void iso_conn_ready(struct iso_conn *conn) { struct sock *parent = NULL; - struct sock *sk = conn->sk; + struct sock *sk; struct hci_ev_le_big_sync_estabilished *ev = NULL; struct hci_ev_le_pa_sync_established *ev2 = NULL; struct hci_evt_le_big_info_adv_report *ev3 = NULL; @@ -1828,8 +1822,26 @@ static void iso_conn_ready(struct iso_conn *conn) BT_DBG("conn %p", conn); + iso_conn_lock(conn); + sk = iso_sock_hold(conn); + iso_conn_unlock(conn); + if (sk) { - iso_sock_ready(conn->sk); + lock_sock(sk); + + /* conn->sk may have become NULL if racing with sk close, but + * due to held hdev->lock, it can't become different sk. + */ + if (!conn->sk) { + release_sock(sk); + sock_put(sk); + return; + } + + iso_sock_ready(sk); + + release_sock(sk); + sock_put(sk); } else { hcon = conn->hcon; if (!hcon) -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] net: Fix CVE-2026-53091
by Dong Chenchen 09 Sep '26

09 Sep '26

Fix CVE-2026-53091 Cosmin Ratiu (1): xfrm: Don't clobber inner headers when already set Dong Chenchen (1): net: iptunnel: fix stale transport header during tunnel decapsulation Eric Dumazet (2): net: qdisc_pkt_len_segs_init() cleanup net: pull headers in qdisc_pkt_len_segs_init() Fengyuan Gong (1): net: account for encap headers in qdisc pkt len drivers/net/gtp.c | 5 +++ include/linux/skbuff.h | 5 +++ net/core/dev.c | 79 ++++++++++++++++++++++++++---------------- net/core/gro_cells.c | 2 ++ net/sched/sch_cake.c | 5 ++- net/xfrm/xfrm_output.c | 20 +++++++---- 6 files changed, 79 insertions(+), 37 deletions(-) -- 2.25.1

2 6

[PATCH OLK-6.6 0/7] net: sched: Fix CVE-2026-74700
by Dong Chenchen 09 Sep '26

09 Sep '26

Fix CVE-2026-74700 Asbjørn Sloth Tønnesen (3): net: sched: cls_api: add skip_sw counter net: sched: cls_api: add filter counter net: sched: make skip_sw actually skip software Jamal Hadi Salim (1): net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers Jianbo Liu (1): net: sched: cls_api: fix slab-use-after-free in fl_dump_key Li Xiasong (1): net/sched: preserve kABI for tcf_proto and tcf_block Xin Long (1): net: sched: refine software bypass handling in tc_run include/net/pkt_cls.h | 18 +++++++++++++++ include/net/sch_generic.h | 3 +++ net/core/dev.c | 13 +++++++++++ net/sched/cls_api.c | 47 ++++++++++++++++++++++++++++++++++++++- net/sched/cls_bpf.c | 2 ++ net/sched/cls_flower.c | 2 ++ net/sched/cls_matchall.c | 2 ++ net/sched/cls_u32.c | 4 ++++ 8 files changed, 90 insertions(+), 1 deletion(-) -- 2.25.1

2 8

[PATCH OLK-6.6] md/raid1,raid10: fix bio accounting for split md cloned bios
by Zhou Minqiang 09 Sep '26

09 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit ba976e3501111d11c550848b3b7341a73035f582 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Use md_cloned_bio() to control bio accounting instead of relying on r1bio_existed in raid1 or the io_accounting flag in raid10. The previous logic does not reliably reflect whether a bio is an md cloned bio. When a failed bio is split and resubmitted via bio_submit_split_bioset() on the error path, this can lead to either double accounting for md cloned bios, or missing accounting for bios returned from bio_submit_split_bioset() Fix this by using md_cloned_bio() to detect md cloned bios and skip accounting accordingly. Fixes: bb2a9acefaf9 ("md/raid1: switch to use md_account_bio() for io accounting") Fixes: 820455238366 ("md/raid10: switch to use md_account_bio() for io accounting") Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> Reviewed-by: Xiao Ni <xiao(a)kernel.org> Link: https://patch.msgid.link/20260501114652.590037-4-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai <yukuai(a)fygo.io> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/raid1.c | 2 +- drivers/md/raid10.c | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index a4662d5077ba..e71ddd532455 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1333,7 +1333,7 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, */ gfp_t gfp = err_path ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; - if (r1bio_existed) { + if (likely(!md_cloned_bio(mddev, bio))) { /* Need to get the block device name carefully */ struct md_rdev *rdev = conf->mirrors[r1_bio->read_disk].rdev; diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 316b6c96d413..e8ce8cdd7fce 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1140,7 +1140,7 @@ static bool regular_request_wait(struct mddev *mddev, struct r10conf *conf, } static void raid10_read_request(struct mddev *mddev, struct bio *bio, - struct r10bio *r10_bio, bool io_accounting) + struct r10bio *r10_bio) { struct r10conf *conf = mddev->private; struct bio *read_bio; @@ -1218,7 +1218,7 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, } slot = r10_bio->read_slot; - if (io_accounting) { + if (likely(!md_cloned_bio(mddev, bio))) { md_account_bio(mddev, &bio); r10_bio->master_bio = bio; } @@ -1514,7 +1514,7 @@ static bool __make_request(struct mddev *mddev, struct bio *bio, int sectors) ret = true; if (bio_data_dir(bio) == READ) - raid10_read_request(mddev, bio, r10_bio, true); + raid10_read_request(mddev, bio, r10_bio); else ret = raid10_write_request(mddev, bio, r10_bio); @@ -2839,7 +2839,7 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio) rdev_dec_pending(rdev, mddev); r10_bio->state = 0; - raid10_read_request(mddev, r10_bio->master_bio, r10_bio, false); + raid10_read_request(mddev, r10_bio->master_bio, r10_bio); /* * allow_barrier after re-submit to ensure no sync io * can be issued while regular io pending. -- 2.52.0

2 1

[PATCH OLK-6.6] md/raid1,raid10: fix error-path detection with md_cloned_bio()
by Zhou Minqiang 09 Sep '26

09 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit 811545e0926d02a6a0b1a1258bb5544777c164d4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Detect the error path using md_cloned_bio() instead of relying on r1_bio in raid1 or r10_bio->read_slot in raid10, which may be NULL or -1 after splitting and resubmitting a failed bio. As a result, the error path may not be recognized and memory allocations can incorrectly use GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), which can lead to a deadlock under memory pressure. Fixes: 689389a06ce7 ("md/raid1: simplify handle_read_error().") Fixes: 545250f24809 ("md/raid10: simplify handle_read_error()") Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> Reviewed-by: Xiao Ni <xiao(a)kernel.org> Link: https://patch.msgid.link/20260501114652.590037-3-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai <yukuai(a)fygo.io> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/raid1.c | 13 ++++++++++--- drivers/md/raid10.c | 20 ++++++++++++++------ 2 files changed, 24 insertions(+), 9 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index a804593e178b..a4662d5077ba 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1320,11 +1320,18 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, char b[BDEVNAME_SIZE]; /* - * If r1_bio is set, we are blocking the raid1d thread - * so there is a tiny risk of deadlock. So ask for + * An md cloned bio indicates we are in the error path. + * This is more reliable than checking r1_bio, which might + * be NULL even in the error path if a failed bio was split. + */ + bool err_path = md_cloned_bio(mddev, bio); + + /* + * If we are in the error path, we are blocking the raid1d + * thread so there is a tiny risk of deadlock. So ask for * emergency memory if needed. */ - gfp_t gfp = r1_bio ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; + gfp_t gfp = err_path ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; if (r1bio_existed) { /* Need to get the block device name carefully */ diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index ae423f3952b6..316b6c96d413 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1149,7 +1149,20 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, char b[BDEVNAME_SIZE]; int slot = r10_bio->read_slot; struct md_rdev *err_rdev = NULL; - gfp_t gfp = GFP_NOIO; + + /* + * An md cloned bio indicates we are in the error path. + * This is more reliable than checking slot, which might + * be -1 even in the error path if a failed bio was split. + */ + bool err_path = md_cloned_bio(mddev, bio); + + /* + * If we are in the error path, we are blocking the raid10d + * thread so there is a tiny risk of deadlock. So ask for + * emergency memory if needed. + */ + gfp_t gfp = err_path ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; if (slot >= 0 && r10_bio->devs[slot].rdev) { /* @@ -1160,11 +1173,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, * we lose the device name in error messages. */ int disk; - /* - * As we are blocking raid10, it is a little safer to - * use __GFP_HIGH. - */ - gfp = GFP_NOIO | __GFP_HIGH; disk = r10_bio->devs[slot].devnum; err_rdev = conf->mirrors[disk].rdev; -- 2.52.0

2 1

[PATCH OLK-5.10] md/raid1,raid10: fix error-path detection with md_cloned_bio()
by Zhou Minqiang 09 Sep '26

09 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit 811545e0926d02a6a0b1a1258bb5544777c164d4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Detect the error path using md_cloned_bio() instead of relying on r1_bio in raid1 or r10_bio->read_slot in raid10, which may be NULL or -1 after splitting and resubmitting a failed bio. As a result, the error path may not be recognized and memory allocations can incorrectly use GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), which can lead to a deadlock under memory pressure. Fixes: 689389a06ce7 ("md/raid1: simplify handle_read_error().") Fixes: 545250f24809 ("md/raid10: simplify handle_read_error()") Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> Reviewed-by: Xiao Ni <xiao(a)kernel.org> Link: https://patch.msgid.link/20260501114652.590037-3-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai <yukuai(a)fygo.io> Conflicts: drivers/md/raid1.c drivers/md/raid10.c [Backport to hulk-5.10: upstream uses md_cloned_bio() which depends on io_clone_set infrastructure absent in hulk-5.10. Use current == mddev->thread->tsk to detect error path instead] Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/raid1.c | 9 ++++++--- drivers/md/raid10.c | 14 +++++++++----- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index acd008f97847..b6ae83158a7b 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1198,13 +1198,16 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, int rdisk; bool r1bio_existed = !!r1_bio; char b[BDEVNAME_SIZE]; + struct md_thread *thread = rcu_dereference(mddev->thread); + gfp_t gfp = GFP_NOIO; /* - * If r1_bio is set, we are blocking the raid1d thread - * so there is a tiny risk of deadlock. So ask for + * If we are in the error path, we are blocking the raid1d + * thread so there is a tiny risk of deadlock. So ask for * emergency memory if needed. */ - gfp_t gfp = r1_bio ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; + if (thread && current == thread->tsk) + gfp = GFP_NOIO | __GFP_HIGH; if (r1bio_existed) { /* Need to get the block device name carefully */ diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index f272021d4e8b..4c97325905eb 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1127,8 +1127,17 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, char b[BDEVNAME_SIZE]; int slot = r10_bio->read_slot; struct md_rdev *err_rdev = NULL; + struct md_thread *thread = rcu_dereference(mddev->thread); gfp_t gfp = GFP_NOIO; + /* + * If we are in the error path, we are blocking the raid10d + * thread so there is a tiny risk of deadlock. So ask for + * emergency memory if needed. + */ + if (thread && current == thread->tsk) + gfp = GFP_NOIO | __GFP_HIGH; + if (slot >= 0 && r10_bio->devs[slot].rdev) { /* * This is an error retry, but we cannot @@ -1138,11 +1147,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, * we lose the device name in error messages. */ int disk; - /* - * As we are blocking raid10, it is a little safer to - * use __GFP_HIGH. - */ - gfp = GFP_NOIO | __GFP_HIGH; rcu_read_lock(); disk = r10_bio->devs[slot].devnum; -- 2.52.0

2 1