- Kernel - mailweb.openeuler.org

[PATCH v3 OLK-6.6 0/4] arm64: Allow CPU0 to be nohz_full
by Xia Fukun 29 Oct '26

29 Oct '26

This series is the OLK-6.6 adaptation of the same feature merged in OLK-5.10. Xiongfeng Wang (4): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether there exists a housekeeping CPU online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arm64: defconfig: Enable CONFIG_PM_SLEEP_SMP_NONZERO_CPU and CONFIG_ARCH_SUSPEND_NONZERO_CPU arch/arm64/Kconfig | 3 ++ arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/process.c | 19 ++++++++- include/linux/cpu.h | 4 +- include/linux/sched/isolation.h | 2 + include/linux/tick.h | 2 + kernel/cpu.c | 6 +++ kernel/sched/isolation.c | 56 ++++++++++++++++++++++---- kernel/smp.c | 4 ++ kernel/time/tick-sched.c | 11 ++++- 10 files changed, 98 insertions(+), 11 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10] filescgroup: migrate files resources of every task, not just the first
by Cai Xinchen 29 Oct '26

29 Oct '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10137 -------------------------------- files_cgroup_can_attach() used cgroup_taskset_first() and only migrated the files resources of the first task of the taskset. A thread group may contain tasks that own private files_struct instances (created through unshare(CLONE_FILES) or clone() without CLONE_FILES); on a thread-group migration those structs kept pointing at the source cgroup, so FDs opened afterwards were charged to the source cgroup and bypassed the target cgroup's files.limit. Walk the whole taskset with cgroup_taskset_for_each(), de-duplicating tasks that share a files_struct (they already point at the target css after being handled by an earlier task). A partial migration is rolled back inside ->can_attach() from a list of records that stores the source css of every files_struct actually moved; the source cannot be recomputed from task_css() because a shared files_struct may be charged to a css that differs from its task's. ->cancel_attach() is registered as well, but in this tree files is the last subsystem implementing ->can_attach() and the core only cancels subsystems with a lower ssid than the failing one, so the core never invokes it today; it is kept for forward compatibility. Fixes: be6df5f1e6b8 ("cgroups: Resource controller for open files") Assisted-by: opencode:deepseek-v4.1-flash Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/filescontrol.c | 236 +++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 211 insertions(+), 25 deletions(-) diff --git a/fs/filescontrol.c b/fs/filescontrol.c index fdd557a246be..674d6205a194 100644 --- a/fs/filescontrol.c +++ b/fs/filescontrol.c @@ -103,32 +103,147 @@ u64 files_cgroup_count_fds(struct files_struct *files) } /* - * If attaching this cgroup would overcommit the resource then deny - * the attach. If not, attach the file resource into new cgroup. + * A files migration performed by ->can_attach(), recording the migrated + * files_struct, the css it is moved from/to and the fd count that was + * moved so that the move can be rolled back later. */ -static int files_cgroup_can_attach(struct cgroup_taskset *tset) +struct files_migrate_entry { + struct files_struct *files; + struct cgroup_subsys_state *from_css; + struct cgroup_subsys_state *to_css; + u64 num_files; + struct list_head node; +}; + +/* + * Serializes enabling no_acct against the whole can_attach() -> attach() + * transaction. no_acct is a global switch, so a dedicated lock is used + * instead of cgroup_mutex, which must not be taken under a kernfs active + * reference from a cgroup file write callback. + */ +static DEFINE_MUTEX(files_no_acct_lock); +static LIST_HEAD(files_migrate_entries); + +/* Undo exactly the files_structs ->can_attach() actually migrated. */ +static void files_migrate_rollback(void) { + struct files_migrate_entry *mig_entry, *next_entry; + struct cgroup_subsys_state *from_css, *to_css; + struct page_counter *from_res, *to_res; + struct files_struct *files; u64 num_files; - bool can_attach; - struct cgroup_subsys_state *to_css; - struct cgroup_subsys_state *from_css; - struct page_counter *from_res; - struct page_counter *to_res; - struct page_counter *fail_res; + LIST_HEAD(list); + + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + from_css = mig_entry->from_css; + to_css = mig_entry->to_css; + files = mig_entry->files; + + list_del(&mig_entry->node); + + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); + + spin_lock(&files->file_lock); + /* + * With no_acct enabled, fd changes after the migration are + * not charged to @to_css, so only the count that was moved + * by ->can_attach() may be moved back. Otherwise every + * change was accounted to @to_css and the current count is + * the amount to transfer. + */ + if (READ_ONCE(no_acct)) + num_files = mig_entry->num_files; + else + num_files = files_cgroup_count_fds(files); + page_counter_uncharge(to_res, num_files); + page_counter_charge(from_res, num_files); + css_put(to_css); + files->files_cgroup = css_fcg(from_css); + spin_unlock(&files->file_lock); + + /* + * Drop the references taken when the move was recorded: + * the pin on @files (this may free it, which uncharges + * the just-restored css). + */ + put_files_struct(files); + kfree(mig_entry); + } +} + +/* Migration committed: the moves are final, just drop the records. */ +static void files_migrate_commit(void) +{ + struct files_migrate_entry *mig_entry, *next_entry; + LIST_HEAD(list); + + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + list_del(&mig_entry->node); + /* + * The moves are final: the files_struct keeps its + * reference on @to_css, only the pin and the reference + * transferred from the pre-migration state are dropped. + */ + put_files_struct(mig_entry->files); + css_put(mig_entry->from_css); + kfree(mig_entry); + } +} + +static void files_cgroup_cancel_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_rollback(); + mutex_unlock(&files_no_acct_lock); +} + +static void files_cgroup_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_commit(); + mutex_unlock(&files_no_acct_lock); +} + +/* + * files_cgroup_can_attach_one_task - try to migrate one task's files_struct + * @task: task to migrate + * @mig_entry: migration record filled in on success + * @to_css: target css + * @skip: set to true if @task has no chargeable files_struct or its + * files_struct already points at @to_css + */ +static int files_cgroup_can_attach_one_task(struct task_struct *task, + struct files_migrate_entry *mig_entry, + struct cgroup_subsys_state *to_css, + bool *skip) +{ + int ret = 0; + u64 num_files; + struct page_counter *from_res, *to_res, *fail_res; struct files_struct *files; - struct task_struct *task = cgroup_taskset_first(tset, &to_css); + struct cgroup_subsys_state *from_css; - to_res = css_res_open_handles(to_css); + *skip = false; task_lock(task); files = task->files; - if (!files || files == &init_files) { - task_unlock(task); - return 0; + if (!files || !files->files_cgroup || files == &init_files) { + *skip = true; + goto skip; } from_css = &files_cgroup_from_files(files)->css; + /* Already on the target css, or handled via a shared files_struct. */ + if (from_css == to_css) { + *skip = true; + goto skip; + } + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); spin_lock(&files->file_lock); num_files = files_cgroup_count_fds(files); @@ -137,16 +252,77 @@ static int files_cgroup_can_attach(struct cgroup_taskset *tset) if (!page_counter_try_charge(to_res, num_files, &fail_res)) { page_counter_charge(from_res, num_files); pr_err("Open files limit overcommited\n"); - can_attach = false; - } else { - css_put(from_css); - css_get(to_css); - task->files->files_cgroup = css_fcg(to_css); - can_attach = true; + ret = -ENOSPC; + goto unlock; } + + /* + * The files_struct's reference on @from_css is transferred to + * the rollback record; @to_css is referenced by the + * files_struct from now on. + */ + css_get(to_css); + files->files_cgroup = css_fcg(to_css); + + atomic_inc(&files->count); + mig_entry->files = files; + mig_entry->from_css = from_css; + mig_entry->to_css = to_css; + mig_entry->num_files = num_files; + +unlock: spin_unlock(&files->file_lock); +skip: task_unlock(task); - return can_attach ? 0 : -ENOSPC; + return ret; +} + +/* + * If attaching this cgroup would overcommit the resource then deny + * the attach. If not, attach the file resource into new cgroup. + */ +static int files_cgroup_can_attach(struct cgroup_taskset *tset) +{ + struct task_struct *task; + struct cgroup_subsys_state *to_css; + struct files_migrate_entry *mig_entry; + int ret = 0; + bool skip = false; + + /* + * Keep no_acct stable until ->attach() or ->cancel_attach() runs. + * A successful can_attach() leaves the lock held for the matching + * callback; a failure rolls back and releases it here. + */ + mutex_lock(&files_no_acct_lock); + + cgroup_taskset_for_each(task, to_css, tset) { + mig_entry = kzalloc(sizeof(*mig_entry), GFP_KERNEL); + if (!mig_entry) { + ret = -ENOMEM; + break; + } + + ret = files_cgroup_can_attach_one_task(task, mig_entry, to_css, &skip); + if (ret) { + kfree(mig_entry); + break; + } + + if (skip) { + kfree(mig_entry); + continue; + } + + list_add_tail(&mig_entry->node, &files_migrate_entries); + } + + if (ret) { + files_migrate_rollback(); + mutex_unlock(&files_no_acct_lock); + } + + return ret; } int files_cgroup_alloc_fd(struct files_struct *files, u64 n) @@ -161,7 +337,7 @@ int files_cgroup_alloc_fd(struct files_struct *files, u64 n) * we don't charge their fds, only issue is that files.usage * won't be accurate in root files cgroup. */ - if (!no_acct && files != &init_files) { + if (!READ_ONCE(no_acct) && files != &init_files) { struct page_counter *fail_res; struct files_cgroup *files_cgroup = files_cgroup_from_files(files); @@ -179,7 +355,7 @@ void files_cgroup_unalloc_fd(struct files_struct *files, u64 n) * It's not charged so no need to uncharge, see comments in * files_cgroup_alloc_fd. */ - if (!no_acct && files != &init_files) { + if (!READ_ONCE(no_acct) && files != &init_files) { struct files_cgroup *files_cgroup = files_cgroup_from_files(files); page_counter_uncharge(&files_cgroup->open_handles, n); @@ -190,7 +366,7 @@ EXPORT_SYMBOL(files_cgroup_unalloc_fd); static u64 files_disabled_read(struct cgroup_subsys_state *css, struct cftype *cft) { - return no_acct; + return READ_ONCE(no_acct); } static int files_disabled_write(struct cgroup_subsys_state *css, @@ -198,7 +374,10 @@ static int files_disabled_write(struct cgroup_subsys_state *css, { if (!val) return -EINVAL; - no_acct = true; + + mutex_lock(&files_no_acct_lock); + WRITE_ONCE(no_acct, true); + mutex_unlock(&files_no_acct_lock); return 0; } @@ -276,6 +455,13 @@ struct cgroup_subsys files_cgrp_subsys = { .css_alloc = files_cgroup_css_alloc, .css_free = files_cgroup_css_free, .can_attach = files_cgroup_can_attach, + /* + * Not reachable today because files has the highest ssid among the + * subsystems implementing ->can_attach(); kept for forward + * compatibility. See the comment above struct files_migrate_entry. + */ + .cancel_attach = files_cgroup_cancel_attach, + .attach = files_cgroup_attach, .legacy_cftypes = files, .dfl_cftypes = files, }; -- 2.34.1

2 1

[PATCH OLK-6.6] ACPI/HMAT: Fix compile error when CONFIG_ACPI_HMAT is not enabled
by Ziming Du 29 Oct '26

29 Oct '26

From: Zhang Zekun <zhangzekun11(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kata-containers/issues/167 ------------------------------------------------ Fix compile error when CONFIG_ACPI_HMAT is not enabled: j ../drivers/acpi/acpi_memhotplug.c: In function ‘acpi_memory_enable_device’: ../drivers/acpi/acpi_memhotplug.c:236:5: error: implicit declaration of function ‘hmat_restore_target’; did you mean ‘mte_restore_tags’? [-Werror=implicit-function-declaration] hmat_restore_target(node); ^~~~~~~~~~~~~~~~~~~ mte_restore_tags Fixes: 2e1b00fcf1e3 ("ACPI/HMAT: Add missing locality information for hot-added device") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/acpi/internal.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h index 10f64907f3c37..adf683c90eadc 100644 --- a/drivers/acpi/internal.h +++ b/drivers/acpi/internal.h @@ -273,6 +273,10 @@ void acpi_init_lpit(void); #else static inline void acpi_init_lpit(void) { } #endif +#ifdef CONFIG_ACPI_HMAT void hmat_restore_target(int nid); +#else +static inline void hmat_restore_target(int nid) {} +#endif #endif /* _ACPI_INTERNAL_H_ */ -- 2.43.0

2 1

[PATCH OLK-6.6] ACPI/HMAT: Fix compile error when CONFIG_ACPI_HMAT is not enabled
by Ziming Du 29 Oct '26

29 Oct '26

From: Zhang Zekun <zhangzekun11(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAPHFQ ------------------------------------------------ Fix compile error when CONFIG_ACPI_HMAT is not enabled: j ../drivers/acpi/acpi_memhotplug.c: In function ‘acpi_memory_enable_device’: ../drivers/acpi/acpi_memhotplug.c:236:5: error: implicit declaration of function ‘hmat_restore_target’; did you mean ‘mte_restore_tags’? [-Werror=implicit-function-declaration] hmat_restore_target(node); ^~~~~~~~~~~~~~~~~~~ mte_restore_tags Fixes: 2e1b00fcf1e3 ("ACPI/HMAT: Add missing locality information for hot-added device") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/acpi/internal.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h index 10f64907f3c37..adf683c90eadc 100644 --- a/drivers/acpi/internal.h +++ b/drivers/acpi/internal.h @@ -273,6 +273,10 @@ void acpi_init_lpit(void); #else static inline void acpi_init_lpit(void) { } #endif +#ifdef CONFIG_ACPI_HMAT void hmat_restore_target(int nid); +#else +static inline void hmat_restore_target(int nid) {} +#endif #endif /* _ACPI_INTERNAL_H_ */ -- 2.43.0

2 1

[PATCH OLK-6.6 v2 00/18] moc bypass cache
by Jiacheng Yu 29 Oct '26

29 Oct '26

moc bypass cache by page based attribute Fanhua Li (2): arm64: mm: Set PBHA0 bit for VM_PBHA_BIT0 arm64: mm: Introduce procfs interface to update PBHA0 bit James Morse (7): KVM: arm64: Detect and enable PBHA for stage2 dt-bindings: Rename the description of cpu nodes cpu.yaml dt-bindings: arm: Add binding for Page Based Hardware Attributes arm64: cpufeature: Enable PBHA bits for stage1 arm64: mm: Add pgprot_pbha() to allow drivers to request PBHA values KVM: arm64: Configure PBHA bits for stage2 Documentation: arm64: Describe the support and expectations for PBHA Ma Wupeng (9): arm64: cpufeature: Enable PBHA for stage1 early via FDT arm64: mm: Detect and enable PBHA bit0 at early startup arm64: mm: Update kernel pte entries if pbha bit0 enabled arm64: mm: Show PBHA bit 59 as PBHA0 in ptdump arm64: mm: Introduce VM_PBHA_BIT0 to enable pbha bit0 for single vma arm64: mm: Set flag VM_PBHA_BIT0 for global init task arm64: mm: Introduce prctl to control pbha behavior arm64: mm: Introduce kernel param pbha openeuler: configs: arm64: Enable PBHA by default .../admin-guide/kernel-parameters.txt | 7 + Documentation/admin-guide/mm/pagemap.rst | 4 +- Documentation/arch/arm64/index.rst | 1 + Documentation/arm64/pbha.rst | 87 +++ .../devicetree/bindings/arm/cpu.yaml | 578 ++++++++++++++++ .../devicetree/bindings/arm/cpus.yaml | 623 ++---------------- arch/arm64/Kconfig | 19 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 15 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_pgtable.h | 9 + arch/arm64/include/asm/mman.h | 7 + arch/arm64/include/asm/pgtable-hwdef.h | 6 + arch/arm64/include/asm/pgtable.h | 26 + arch/arm64/include/asm/setup.h | 1 + arch/arm64/include/uapi/asm/mman.h | 1 + arch/arm64/kernel/cpufeature.c | 258 ++++++++ arch/arm64/kernel/head.S | 3 + arch/arm64/kernel/image-vars.h | 2 + arch/arm64/kvm/hyp/pgtable.c | 16 +- arch/arm64/mm/fixmap.c | 2 + arch/arm64/mm/hugetlbpage.c | 3 + arch/arm64/mm/mmap.c | 4 + arch/arm64/mm/mmu.c | 13 +- arch/arm64/mm/ptdump.c | 5 + arch/arm64/tools/cpucaps | 6 +- .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/fdt.c | 52 ++ drivers/soc/hisilicon/Makefile | 1 + drivers/soc/hisilicon/pbha.c | 211 ++++++ fs/proc/base.c | 116 ++++ fs/proc/task_mmu.c | 18 + include/linux/mm.h | 10 +- include/linux/pbha.h | 93 +++ include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/prctl.h | 1 + kernel/sys.c | 10 + mm/memory.c | 4 + mm/vmalloc.c | 4 + tools/include/uapi/asm-generic/mman-common.h | 1 + 40 files changed, 1661 insertions(+), 562 deletions(-) create mode 100644 Documentation/arm64/pbha.rst create mode 100644 Documentation/devicetree/bindings/arm/cpu.yaml create mode 100644 drivers/soc/hisilicon/pbha.c create mode 100644 include/linux/pbha.h -- 2.43.0

2 19

[PATCH OLK-6.6] configfs: unhash the dentry before dropping the item in rmdir
by Ran Hongyun 29 Oct '26

29 Oct '26

mainline inclusion from mainline-v7.3-rc3 commit f06c2d26d1999d37e93299db0ecead04ca7d0b9f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19854 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- configfs_get_config_item() treats a hashed dentry as proof that sd->s_element is a live config_item. configfs_rmdir() breaks that: simple_rmdir() leaves the dentry hashed, the last reference to the item is dropped right after, and the dentry is only unhashed by d_delete() once ->rmdir() has returned. configfs_symlink() resolves its target holding no lock on it, so get_target() can land in that window: BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90 get_target fs/configfs/symlink.c:128 [inline] configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185 Unhash in configfs_remove_dir(), while the item is still guaranteed to be there. A reference obtained just before that stays harmless, as create_link() rechecks CONFIGFS_USET_DROPPING, already set by configfs_detach_prep(). Both configfs_unregister_subsystem() paths d_drop() after detaching, so this only makes rmdir match them. Reported-by: syzbot+6b16e3d085833cbf3e25(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6b16e3d085833cbf3e25 Fixes: 7063fbf22611 ("[PATCH] configfs: User-driven configuration filesystem") Cc: stable(a)vger.kernel.org Signed-off-by: Vasileios Almpanis <vasilisalmpanis(a)gmail.com> Tested-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Breno Leitao <leitao(a)debian.org> Link: https://patch.msgid.link/20260730093435.195441-3-vasilisalmpanis@gmail.com Signed-off-by: Breno Leitao <leitao(a)debian.org> Conflicts: fs/configfs/dir.c [1387aedb391a ("configfs: mark pinned dentries persistent") not merged.] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/configfs/dir.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index 46540846d815..e7ca50f11996 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -395,8 +395,17 @@ static void remove_dir(struct dentry * d) configfs_remove_dirent(d); - if (d_really_is_positive(d)) - simple_rmdir(d_inode(parent),d); + if (d_really_is_positive(d)) { + if (!simple_rmdir(d_inode(parent), d)) + /* + * configfs_get_config_item() takes a hashed dentry as + * proof that ->s_element is still alive. Our caller + * is about to drop the last reference to the item and + * the VFS will not unhash until after we return, so + * unhash it here. + */ + d_drop(d); + } pr_debug(" o %pd removing done (%d)\n", d, d_count(d)); -- 2.52.0

2 1

[PATCH] irqbypass: Use xarray to track producers and consumers
by Jinqian Yang 29 Oct '26

29 Oct '26

From: Sean Christopherson <seanjc(a)google.com> Track IRQ bypass producers and consumers using an xarray to avoid the O(2n) insertion time associated with walking a list to check for duplicate entries, and to search for an partner. At low (tens or few hundreds) total producer/consumer counts, using a list is faster due to the need to allocate backing storage for xarray. But as count creeps into the thousands, xarray wins easily, and can provide several orders of magnitude better latency at high counts. E.g. hundreds of nanoseconds vs. hundreds of milliseconds. Cc: Oliver Upton <oliver.upton(a)linux.dev> Cc: David Matlack <dmatlack(a)google.com> Cc: Like Xu <like.xu.linux(a)gmail.com> Cc: Binbin Wu <binbin.wu(a)linux.intel.com> Reported-by: Yong He <alexyonghe(a)tencent.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217379 Link: https://lore.kernel.org/all/20230801115646.33990-1-likexu@tencent.com Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Alex Williamson <alex.williamson(a)redhat.com> Link: https://lore.kernel.org/r/20250516230734.2564775-8-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> --- include/linux/irqbypass.h | 4 --- virt/lib/irqbypass.c | 74 ++++++++++++++++++++------------------- 2 files changed, 38 insertions(+), 40 deletions(-) diff --git a/include/linux/irqbypass.h b/include/linux/irqbypass.h index b28197c87483..cd64fcaa88fe 100644 --- a/include/linux/irqbypass.h +++ b/include/linux/irqbypass.h @@ -33,7 +33,6 @@ struct irq_bypass_consumer; /** * struct irq_bypass_producer - IRQ bypass producer definition - * @node: IRQ bypass manager private list management * @eventfd: eventfd context used to match producers and consumers * @consumer: The connected consumer (NULL if no connection) * @irq: Linux IRQ number for the producer device @@ -47,7 +46,6 @@ struct irq_bypass_consumer; * for a physical device assigned to a VM. */ struct irq_bypass_producer { - struct list_head node; struct eventfd_ctx *eventfd; struct irq_bypass_consumer *consumer; int irq; @@ -61,7 +59,6 @@ struct irq_bypass_producer { /** * struct irq_bypass_consumer - IRQ bypass consumer definition - * @node: IRQ bypass manager private list management * @eventfd: eventfd context used to match producers and consumers * @producer: The connected producer (NULL if no connection) * @add_producer: Connect the IRQ consumer to an IRQ producer @@ -75,7 +72,6 @@ struct irq_bypass_producer { * portions of the interrupt handling to the VM. */ struct irq_bypass_consumer { - struct list_head node; struct eventfd_ctx *eventfd; struct irq_bypass_producer *producer; diff --git a/virt/lib/irqbypass.c b/virt/lib/irqbypass.c index 828556c081f5..ea888b9203d2 100644 --- a/virt/lib/irqbypass.c +++ b/virt/lib/irqbypass.c @@ -22,8 +22,8 @@ MODULE_LICENSE("GPL v2"); MODULE_DESCRIPTION("IRQ bypass manager utility module"); -static LIST_HEAD(producers); -static LIST_HEAD(consumers); +static DEFINE_XARRAY(producers); +static DEFINE_XARRAY(consumers); static DEFINE_MUTEX(lock); /* @lock must be held when calling connect */ @@ -86,13 +86,13 @@ static void __disconnect(struct irq_bypass_producer *prod, * @producer: pointer to producer structure * @eventfd: pointer to the eventfd context associated with the producer * - * Add the provided IRQ producer to the list of producers and connect - * with any matching eventfd found on the IRQ consumers list. + * Add the provided IRQ producer to the set of producers and connect with the + * consumer with a matching eventfd, if one exists. */ int irq_bypass_register_producer(struct irq_bypass_producer *producer, struct eventfd_ctx *eventfd) { - struct irq_bypass_producer *tmp; + unsigned long index = (unsigned long)eventfd; struct irq_bypass_consumer *consumer; int ret; @@ -101,22 +101,20 @@ int irq_bypass_register_producer(struct irq_bypass_producer *producer, guard(mutex)(&lock); - list_for_each_entry(tmp, &producers, node) { - if (tmp->eventfd == eventfd) - return -EBUSY; - } + ret = xa_insert(&producers, index, producer, GFP_KERNEL); + if (ret) + return ret; - list_for_each_entry(consumer, &consumers, node) { - if (consumer->eventfd == eventfd) { - ret = __connect(producer, consumer); - if (ret) - return ret; - break; + consumer = xa_load(&consumers, index); + if (consumer) { + ret = __connect(producer, consumer); + if (ret) { + WARN_ON_ONCE(xa_erase(&producers, index) != producer); + return ret; } } producer->eventfd = eventfd; - list_add(&producer->node, &producers); return 0; } EXPORT_SYMBOL_GPL(irq_bypass_register_producer); @@ -125,11 +123,14 @@ EXPORT_SYMBOL_GPL(irq_bypass_register_producer); * irq_bypass_unregister_producer - unregister IRQ bypass producer * @producer: pointer to producer structure * - * Remove a previously registered IRQ producer from the list of producers - * and disconnect it from any connected IRQ consumer. + * Remove a previously registered IRQ producer (note, it's safe to call this + * even if registration was unsuccessful). Disconnect from the associated + * consumer, if one exists. */ void irq_bypass_unregister_producer(struct irq_bypass_producer *producer) { + unsigned long index = (unsigned long)producer->eventfd; + if (!producer->eventfd) return; @@ -138,8 +139,8 @@ void irq_bypass_unregister_producer(struct irq_bypass_producer *producer) if (producer->consumer) __disconnect(producer, producer->consumer); + WARN_ON_ONCE(xa_erase(&producers, index) != producer); producer->eventfd = NULL; - list_del(&producer->node); } EXPORT_SYMBOL_GPL(irq_bypass_unregister_producer); @@ -148,13 +149,13 @@ EXPORT_SYMBOL_GPL(irq_bypass_unregister_producer); * @consumer: pointer to consumer structure * @eventfd: pointer to the eventfd context associated with the consumer * - * Add the provided IRQ consumer to the list of consumers and connect - * with any matching eventfd found on the IRQ producer list. + * Add the provided IRQ consumer to the set of consumers and connect with the + * producer with a matching eventfd, if one exists. */ int irq_bypass_register_consumer(struct irq_bypass_consumer *consumer, struct eventfd_ctx *eventfd) { - struct irq_bypass_consumer *tmp; + unsigned long index = (unsigned long)eventfd; struct irq_bypass_producer *producer; int ret; @@ -166,22 +167,20 @@ int irq_bypass_register_consumer(struct irq_bypass_consumer *consumer, guard(mutex)(&lock); - list_for_each_entry(tmp, &consumers, node) { - if (tmp->eventfd == eventfd) - return -EBUSY; - } + ret = xa_insert(&consumers, index, consumer, GFP_KERNEL); + if (ret) + return ret; - list_for_each_entry(producer, &producers, node) { - if (producer->eventfd == eventfd) { - ret = __connect(producer, consumer); - if (ret) - return ret; - break; + producer = xa_load(&producers, index); + if (producer) { + ret = __connect(producer, consumer); + if (ret) { + WARN_ON_ONCE(xa_erase(&consumers, index) != consumer); + return ret; } } consumer->eventfd = eventfd; - list_add(&consumer->node, &consumers); return 0; } EXPORT_SYMBOL_GPL(irq_bypass_register_consumer); @@ -190,11 +189,14 @@ EXPORT_SYMBOL_GPL(irq_bypass_register_consumer); * irq_bypass_unregister_consumer - unregister IRQ bypass consumer * @consumer: pointer to consumer structure * - * Remove a previously registered IRQ consumer from the list of consumers - * and disconnect it from any connected IRQ producer. + * Remove a previously registered IRQ consumer (note, it's safe to call this + * even if registration was unsuccessful). Disconnect from the associated + * producer, if one exists. */ void irq_bypass_unregister_consumer(struct irq_bypass_consumer *consumer) { + unsigned long index = (unsigned long)consumer->eventfd; + if (!consumer->eventfd) return; @@ -203,7 +205,7 @@ void irq_bypass_unregister_consumer(struct irq_bypass_consumer *consumer) if (consumer->producer) __disconnect(consumer->producer, consumer); + WARN_ON_ONCE(xa_erase(&consumers, index) != consumer); consumer->eventfd = NULL; - list_del(&consumer->node); } EXPORT_SYMBOL_GPL(irq_bypass_unregister_consumer); -- 2.33.0

1 4

[PATCH OLK-6.6] namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
by Zizhi Wo 29 Oct '26

29 Oct '26

stable inclusion from stable-v7.2.11 commit b8a94a405ddcf45e9470789e0a821d8f2aa4ca10 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20843 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0febe278ec45b1ccdbe9bd5ff1ba365d8fd55e2a ] open_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace because the new mount namespace will be owned by it. It doesn't need to be privileged over the mount namespace the tree is copied from. An unprivileged user just needs to create a user namespace first. The copy follows the rules of a detached bind mount. Without AT_RECURSIVE only the mount itself is cloned and its children are left out. With AT_RECURSIVE unbindable mounts are skipped. Both is fine when the caller has privileges over the source mount namespace because it could unmount those mounts anyway. Not so for an unprivileged user in that mount namespace. For them a mount namespace copy is what unshare() does. copy_mnt_ns() copies everything including unbindable mounts and lock_mnt_tree() makes sure nothing can be unmounted in the copy. Nothing that was covered gets revealed. create_new_namespace() only does the locking and so the covered content is right there in the new mount namespace: # mount -t tmpfs none /tmp/otn; mkdir /tmp/otn/covered # echo hidden > /tmp/otn/covered/under.txt # mount -t tmpfs none /tmp/otn/covered uid 1000, after unshare(CLONE_NEWUSER): fd = open_tree(AT_FDCWD, "/tmp/otn", OPEN_TREE_NAMESPACE); setns(fd, CLONE_NEWNS); open("/covered/under.txt", O_RDONLY) -> "hidden" Covering paths with mounts is how container runtimes mask parts of /proc and /sys and how admins hide things. When the caller's user namespace doesn't own the source mount namespace copy the way unshare() does and refuse a non-recursive copy of a mount that has anything mounted below the requested directory and copy unbindable mounts in a recursive copy. A caller that is privileged over the source mount namespace sees no change. Fixes: 9b8a0ba68246 ("mount: add OPEN_TREE_NAMESPACE") Cc: stable(a)vger.kernel.org # v7.0+ Link: https://patch.msgid.link/20260930-work-mount-fixes-3-v1-6-be34c83956ae@kern… Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/namespace.c | 36 +++++++++++++++++++++++++++++++----- 1 file changed, 31 insertions(+), 5 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index f44f0870a3fd..c1c69aedad2e 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2098,10 +2098,22 @@ static bool has_locked_children(struct mount *mnt, struct dentry *dentry) return true; } return false; } +/* locks: namespace_shared && pinned(mnt) || mount_locked_reader */ +static bool __has_children(struct mount *mnt, struct dentry *dentry) +{ + struct mount *child; + + list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { + if (is_subdir(child->mnt_mountpoint, dentry)) + return true; + } + return false; +} + /** * clone_private_mount - create a private clone of a path * @path: path to clone * * This creates a new vfsmount, which will be the clone of @path. The new mount @@ -2746,13 +2758,21 @@ static struct mnt_namespace *create_new_namespace(struct path *path, unsigned in struct path to_path; struct mountpoint *mp; struct mount *mnt; unsigned int copy_flags = 0; int err; + bool recurse = flags & AT_RECURSIVE; + bool foreign = user_ns != ns->user_ns; - if (user_ns != ns->user_ns) - copy_flags |= CL_SLAVE; + /* + * Without privileges over the mount namespace the copy is made + * from nothing mounted below @path may be left out. It would + * reveal what it covers. That's what unshare() gives such a + * caller as well. + */ + if (foreign) + copy_flags |= CL_SLAVE | CL_COPY_UNBINDABLE; new_ns = alloc_mnt_ns(user_ns, false); if (IS_ERR(new_ns)) return new_ns; @@ -2773,13 +2793,19 @@ static struct mnt_namespace *create_new_namespace(struct path *path, unsigned in } /* * We don't emulate unshare()ing a mount namespace. We stick * to the restrictions of creating detached bind-mounts. It - * has a lot saner and simpler semantics. + * has a lot saner and simpler semantics. A caller without + * privileges over the mount namespace can't leave out any + * child though. */ - mnt = __do_loopback(path, flags, copy_flags); + if (foreign && !recurse && + __has_children(real_mount(path->mnt), path->dentry)) + mnt = ERR_PTR(-EINVAL); + else + mnt = __do_loopback(path, flags, copy_flags); lock_mount_hash(); if (IS_ERR(mnt)) { err = PTR_ERR(mnt); umount_tree(new_ns_root, 0); @@ -2790,11 +2816,11 @@ static struct mnt_namespace *create_new_namespace(struct path *path, unsigned in /* * now mount the detached tree on top of the copy * of the real rootfs we created. */ attach_mnt(mnt, new_ns_root, mp, false); - if (user_ns != ns->user_ns) + if (foreign) lock_mnt_tree(new_ns_root); unlock_mount_hash(); mnt_add_tree_to_ns(new_ns, new_ns_root); -- 2.52.0

2 1

[PATCH OLK-6.6] bpf: Reject pkt arguments in mutating subprogs
by Chen Yuxi 29 Oct '26

29 Oct '26

From: Emil Tsalapatis <emil(a)etsalapatis.com> mainline inclusion from mainline-v7.3-rc2 commit a6c1edfbe240e4377038a0e1d233ad81fde9a21b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20656 CVE: CVE-2026-98589 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The verifier tracks changes in how PTR_TO_PACKET registers' bounds are modified across subprog boundaries. PTR_TO_PACKET registers are actually passed as PTR_TO_MEM, which is assumed valid for the entire call. This is not the case with packet memory, where a pskb_* call may invalidate its memory region. Reject BPF code that passes PTR_TO_PACKET pointers to subprogs that may mutate a packet. We cannot pass the pointer as a true PTR_TO_PACKET because we would also need to somehow pass the PTR_TO_PACKET_META or PTR_TO_PACKET_END to the subprog. Since we cannot avoid representing the pointer in the subprog as PTR_TO_MEM, only permit it if the subprog is guaranteed not to mutate the packet. Fixes: 80f281664f5a ("bpf: Support pointers in global func args") Reported-by: Nicholas Carlini <nicholas(a)carlini.com> Suggested-by: Nicholas Carlini <nicholas(a)carlini.com> Signed-off-by: Emil Tsalapatis <emil(a)etsalapatis.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Link: https://patch.msgid.link/20260922172028.6269-6-emil@etsalapatis.com Conflicts: kernel/bpf/verifier.c kernel/bpf/btf.c [commit 9b9f0b42703ceb88332bcb19453c4288c2683e34 not backport] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/bpf/btf.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 3e3bfbbdbb5f..aad12310adb3 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -7159,11 +7159,25 @@ int btf_check_type_match(struct bpf_verifier_log *log, const struct bpf_prog *pr return btf_check_func_type_match(log, btf1, t1, btf2, t2); } +static bool reg_is_pkt_pointer_any(const struct bpf_reg_state *reg) +{ + return base_type(reg->type) == PTR_TO_PACKET || + base_type(reg->type) == PTR_TO_PACKET_META || + reg->type == PTR_TO_PACKET_END; +} + +static bool reg_is_dynptr_slice_pkt(const struct bpf_reg_state *reg) +{ + return base_type(reg->type) == PTR_TO_MEM && + (reg->type & DYNPTR_TYPE_SKB || reg->type & DYNPTR_TYPE_XDP); +} + static int btf_check_func_arg_match(struct bpf_verifier_env *env, const struct btf *btf, u32 func_id, struct bpf_reg_state *regs, bool ptr_to_mem_ok, - bool processing_call) + bool processing_call, + int subprog) { enum bpf_prog_type prog_type = resolve_prog_type(env->prog); struct bpf_verifier_log *log = &env->log; @@ -7251,6 +7265,16 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, if (check_mem_reg(env, reg, regno, type_size)) return -EINVAL; + /* + * PTR_TO_PACKET get passed as PTR_TO_MEM, preventing + * us from adjusting bounds tracking info. + */ + if ((reg_is_pkt_pointer_any(reg) || reg_is_dynptr_slice_pkt(reg)) && + env->subprog_info[subprog].changes_pkt_data) { + bpf_log(log, "R%d is a packet pointer, but func#%d may change packet data\n", + regno, subprog); + return -EINVAL; + } } else { bpf_log(log, "reg type unsupported for arg#%d function %s#%d\n", i, func_name, func_id); @@ -7288,7 +7312,7 @@ int btf_check_subprog_arg_match(struct bpf_verifier_env *env, int subprog, return -EINVAL; is_global = prog->aux->func_info_aux[subprog].linkage == BTF_FUNC_GLOBAL; - err = btf_check_func_arg_match(env, btf, btf_id, regs, is_global, false); + err = btf_check_func_arg_match(env, btf, btf_id, regs, is_global, false, subprog); /* Compiler optimizations can remove arguments from static functions * or mismatched type can be passed into a global function. @@ -7331,7 +7355,7 @@ int btf_check_subprog_call(struct bpf_verifier_env *env, int subprog, return -EINVAL; is_global = prog->aux->func_info_aux[subprog].linkage == BTF_FUNC_GLOBAL; - err = btf_check_func_arg_match(env, btf, btf_id, regs, is_global, true); + err = btf_check_func_arg_match(env, btf, btf_id, regs, is_global, true, subprog); /* Compiler optimizations can remove arguments from static functions * or mismatched type can be passed into a global function. -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Reject pkt arguments in mutating subprogs
by Chen Yuxi 29 Oct '26

29 Oct '26

mainline inclusion from mainline-v7.3-rc2 commit a6c1edfbe240e4377038a0e1d233ad81fde9a21b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20656 CVE: CVE-2026-98589 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The verifier tracks changes in how PTR_TO_PACKET registers' bounds are modified across subprog boundaries. PTR_TO_PACKET registers are actually passed as PTR_TO_MEM, which is assumed valid for the entire call. This is not the case with packet memory, where a pskb_* call may invalidate its memory region. Reject BPF code that passes PTR_TO_PACKET pointers to subprogs that may mutate a packet. We cannot pass the pointer as a true PTR_TO_PACKET because we would also need to somehow pass the PTR_TO_PACKET_META or PTR_TO_PACKET_END to the subprog. Since we cannot avoid representing the pointer in the subprog as PTR_TO_MEM, only permit it if the subprog is guaranteed not to mutate the packet. Fixes: 80f281664f5a ("bpf: Support pointers in global func args") Reported-by: Nicholas Carlini <nicholas(a)carlini.com> Suggested-by: Nicholas Carlini <nicholas(a)carlini.com> Signed-off-by: Emil Tsalapatis <emil(a)etsalapatis.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Link: https://patch.msgid.link/20260922172028.6269-6-emil@etsalapatis.com Conflicts: kernel/bpf/verifier.c kernel/bpf/btf.c [commit 9b9f0b42703ceb88332bcb19453c4288c2683e34 not backport] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/bpf/btf.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 3e3bfbbdbb5f..aad12310adb3 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -7159,11 +7159,25 @@ int btf_check_type_match(struct bpf_verifier_log *log, const struct bpf_prog *pr return btf_check_func_type_match(log, btf1, t1, btf2, t2); } +static bool reg_is_pkt_pointer_any(const struct bpf_reg_state *reg) +{ + return base_type(reg->type) == PTR_TO_PACKET || + base_type(reg->type) == PTR_TO_PACKET_META || + reg->type == PTR_TO_PACKET_END; +} + +static bool reg_is_dynptr_slice_pkt(const struct bpf_reg_state *reg) +{ + return base_type(reg->type) == PTR_TO_MEM && + (reg->type & DYNPTR_TYPE_SKB || reg->type & DYNPTR_TYPE_XDP); +} + static int btf_check_func_arg_match(struct bpf_verifier_env *env, const struct btf *btf, u32 func_id, struct bpf_reg_state *regs, bool ptr_to_mem_ok, - bool processing_call) + bool processing_call, + int subprog) { enum bpf_prog_type prog_type = resolve_prog_type(env->prog); struct bpf_verifier_log *log = &env->log; @@ -7251,6 +7265,16 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, if (check_mem_reg(env, reg, regno, type_size)) return -EINVAL; + /* + * PTR_TO_PACKET get passed as PTR_TO_MEM, preventing + * us from adjusting bounds tracking info. + */ + if ((reg_is_pkt_pointer_any(reg) || reg_is_dynptr_slice_pkt(reg)) && + env->subprog_info[subprog].changes_pkt_data) { + bpf_log(log, "R%d is a packet pointer, but func#%d may change packet data\n", + regno, subprog); + return -EINVAL; + } } else { bpf_log(log, "reg type unsupported for arg#%d function %s#%d\n", i, func_name, func_id); @@ -7288,7 +7312,7 @@ int btf_check_subprog_arg_match(struct bpf_verifier_env *env, int subprog, return -EINVAL; is_global = prog->aux->func_info_aux[subprog].linkage == BTF_FUNC_GLOBAL; - err = btf_check_func_arg_match(env, btf, btf_id, regs, is_global, false); + err = btf_check_func_arg_match(env, btf, btf_id, regs, is_global, false, subprog); /* Compiler optimizations can remove arguments from static functions * or mismatched type can be passed into a global function. @@ -7331,7 +7355,7 @@ int btf_check_subprog_call(struct bpf_verifier_env *env, int subprog, return -EINVAL; is_global = prog->aux->func_info_aux[subprog].linkage == BTF_FUNC_GLOBAL; - err = btf_check_func_arg_match(env, btf, btf_id, regs, is_global, true); + err = btf_check_func_arg_match(env, btf, btf_id, regs, is_global, true, subprog); /* Compiler optimizations can remove arguments from static functions * or mismatched type can be passed into a global function. -- 2.34.1

2 1