- Kernel - mailweb.openeuler.org

[PATCH v3 00/18] MOC bypass cache
by Jiacheng Yu 02 Nov '26

02 Nov '26

The MOC (MemoryOnChip) bypass cache feature uses the Arm Page Based Hardware Attributes (PBHA, FEAT_HPDS2) to describe per-mapping performance hints. MOC memory is not cached in the system cache, so the OS has to be told which pages may be mapped with the MOC attribute. This series adds: - stage1 PBHA support, discovered from the device tree or from the EFI stub - KVM stage2 support, including the VTCR_EL2.PBHA override mask - page based control: PROT_PBHA_BIT0, VM_PBHA_BIT0, prctl and /proc/<pid>/pbha_bit0 - the pbha= boot parameter and the MOC mode plumbing in the EFI stub Based on OLK-6.6. Changes in v3: - dt-bindings: update the six stale references to arm/cpu.yaml, add the maintainers entry and fix the description - fix the for-loop style in the PBHA parsing code - move pbha.rst to Documentation/arch/arm64/ - use a free vm_flags bit for VM_PBHA_BIT0 and document the p0 mnemonic - drop the set_huge_pte_at() find_vma() lookup; the hint is carried by vm_page_prot - rewrite a live THP pmd through pmdp_invalidate_ad() - take an mm reference in pbha_bit0_read() - add a .hugetlb_entry callback so /proc/<pid>/pbha_bit0 and prctl update hugetlb mappings as well - limit the global-init flagging to current->mm and refresh vm_page_prot - base the "nothing to do" decision on the actual VMA state instead of mm->def_flags - reject a NULL or unrecognized pbha= value Fanhua Li (2): arm64: mm: Set PBHA0 bit for VM_PBHA_BIT0 arm64: mm: Introduce procfs interface to update PBHA0 bit James Morse (7): KVM: arm64: Detect and enable PBHA for stage2 dt-bindings: Rename the description of cpu nodes cpu.yaml dt-bindings: arm: Add binding for Page Based Hardware Attributes arm64: cpufeature: Enable PBHA bits for stage1 arm64: mm: Add pgprot_pbha() to allow drivers to request PBHA values KVM: arm64: Configure PBHA bits for stage2 Documentation: arm64: Describe the support and expectations for PBHA Ma Wupeng (9): arm64: cpufeature: Enable PBHA for stage1 early via FDT arm64: mm: Detect and enable PBHA bit0 at early startup arm64: mm: Update kernel pte entries if pbha bit0 enabled arm64: mm: Show PBHA bit 59 as PBHA0 in ptdump arm64: mm: Introduce VM_PBHA_BIT0 to enable pbha bit0 for single vma arm64: mm: Set flag VM_PBHA_BIT0 for global init task arm64: mm: Introduce prctl to control pbha behavior arm64: mm: Introduce kernel param pbha openeuler: configs: arm64: Enable PBHA by default .../admin-guide/kernel-parameters.txt | 7 + Documentation/admin-guide/mm/pagemap.rst | 4 +- Documentation/arch/arm64/index.rst | 1 + Documentation/arch/arm64/pbha.rst | 87 +++ .../devicetree/bindings/arm/cpu.yaml | 578 ++++++++++++++++ .../devicetree/bindings/arm/cpus.yaml | 622 ++---------------- .../devicetree/bindings/cpu/cpu-capacity.txt | 2 +- .../devicetree/bindings/cpu/cpu-topology.txt | 2 +- .../devicetree/bindings/cpu/idle-states.yaml | 2 +- .../interrupt-controller/apple,aic.yaml | 2 +- .../interrupt-controller/apple,aic2.yaml | 2 +- .../interrupt-controller/arm,gic-v3.yaml | 2 +- Documentation/filesystems/proc.rst | 1 + arch/arm64/Kconfig | 19 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 15 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_pgtable.h | 9 + arch/arm64/include/asm/mman.h | 7 + arch/arm64/include/asm/pgtable-hwdef.h | 6 + arch/arm64/include/asm/pgtable.h | 26 + arch/arm64/include/asm/setup.h | 1 + arch/arm64/include/uapi/asm/mman.h | 1 + arch/arm64/kernel/cpufeature.c | 258 ++++++++ arch/arm64/kernel/head.S | 3 + arch/arm64/kernel/image-vars.h | 2 + arch/arm64/kvm/hyp/pgtable.c | 16 +- arch/arm64/mm/fixmap.c | 2 + arch/arm64/mm/mmap.c | 3 + arch/arm64/mm/mmu.c | 13 +- arch/arm64/mm/ptdump.c | 5 + arch/arm64/tools/cpucaps | 6 +- .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/fdt.c | 52 ++ drivers/soc/hisilicon/Makefile | 1 + drivers/soc/hisilicon/pbha.c | 265 ++++++++ fs/proc/base.c | 124 ++++ fs/proc/task_mmu.c | 18 + include/linux/mm.h | 8 +- include/linux/pbha.h | 95 +++ include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/prctl.h | 1 + kernel/sys.c | 10 + mm/memory.c | 4 + mm/vmalloc.c | 4 + tools/include/uapi/asm-generic/mman-common.h | 1 + 46 files changed, 1727 insertions(+), 566 deletions(-) create mode 100644 Documentation/arch/arm64/pbha.rst create mode 100644 Documentation/devicetree/bindings/arm/cpu.yaml create mode 100644 drivers/soc/hisilicon/pbha.c create mode 100644 include/linux/pbha.h

1 18

[PATCH v7 OLK-6.6 0/4] arm64: Allow CPU0 to be nohz_full
by Xia Fukun 02 Nov '26

02 Nov '26

v7 Xiongfeng Wang (4): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether there exists a housekeeping CPU online arm64: Allow boot CPU nohz_full to coexist with suspend and kexec arm64: defconfig: Enable CONFIG_PM_SLEEP_SMP_NONZERO_CPU and CONFIG_ARCH_SUSPEND_NONZERO_CPU arch/arm64/Kconfig | 3 ++ arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/process.c | 27 ++++++++++++- include/linux/cpu.h | 5 ++- include/linux/sched/isolation.h | 2 + include/linux/tick.h | 4 ++ kernel/cpu.c | 14 +++++++ kernel/sched/isolation.c | 56 ++++++++++++++++++++++---- kernel/smp.c | 4 ++ kernel/time/tick-common.c | 9 +++++ kernel/time/tick-sched.c | 11 ++++- 11 files changed, 126 insertions(+), 11 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10] nfsd: split nfsd4_copy into transient and durable async copy objects
by Lu Jialin 02 Nov '26

02 Nov '26

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v7.3-rc1 commit f307b4f7ed174a3252d2f292904fd276c78c77de category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18939 CVE: CVE-2026-89676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- struct nfsd4_copy served two roles: as &u->copy it is a transient per-COMPOUND argument in the request buffer; as the heap async_copy it is a durable object (worker kthread, reaper linkage, CB_OFFLOAD callback, IDR stateid) that outlives the COMPOUND, with dup_copy_fields() shuttling state between them. That dual identity was the root of the recent lifetime bugs. Introduce struct nfsd4_async_copy for the durable object. It embeds a struct nfsd4_copy (cp_copy) for the operation parameters/result and adds the durable-only fields: async_copies linkage, task_struct, refcount, reaper TTL, copy stateid, and CB_OFFLOAD callback. The durable object therefore never points into the request buffer. cp_clp stays in nfsd4_copy -- it is a request property read by the sync-copy tracepoints on the transient object. Mechanical split, no intended behavioral change; a step toward folding the copy stateids into the common nfs4_stid infrastructure. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260710-nfsd-testing-v3-8-a0ff7db6aa3e@kernel.org Signed-off-by: Chuck Lever <cel(a)kernel.org> Conflicts: fs/nfsd/nfs4proc.c [OLK-5.10 uses the older 5.10 async-copy model: cp_src is an embedded struct, stop state is a bool, and a standalone nfsd4_copy (cb_copy) is still allocated for CB_OFFLOAD; the durable worker fields were split out while refcount stayed in nfsd4_copy for cb_copy, a new nfs4_put_cb_copy() releases it, and the reaper/has_active/cancel_by_sb helper hunks do not exist in this baseline] fs/nfsd/nfs4state.c [nfs4_free_copy_state() now takes nfsd4_async_copy and reaches cp_clp through cp_copy.cp_clp] fs/nfsd/state.h [Prototypes for nfs4_init_copy_state()/nfs4_free_copy_state(), nfs4_put_copy() and find_async_copy() repointed to struct nfsd4_async_copy] fs/nfsd/xdr4.h [Only copies/copy_task/stopped/cp_stateid moved; refcount stays in nfsd4_copy for the standalone CB_OFFLOAD object; cp_nn, ss_mnt, cp_cb, cp_intra and cp_synchronous remain in nfsd4_copy] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs4proc.c | 77 ++++++++++++++++++++++++++------------------- fs/nfsd/nfs4state.c | 6 ++-- fs/nfsd/state.h | 9 +++--- fs/nfsd/xdr4.h | 31 +++++++++++++++--- 4 files changed, 78 insertions(+), 45 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index d9a2941086e3..9b512f8d704c 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1110,31 +1110,42 @@ nfsd4_clone(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return status; } -void nfs4_put_copy(struct nfsd4_copy *copy) +void nfs4_put_copy(struct nfsd4_async_copy *copy) { if (!refcount_dec_and_test(&copy->refcount)) return; /* Drop the task_struct pinned in nfsd4_copy(); NULL on error paths. */ if (copy->copy_task) put_task_struct(copy->copy_task); - atomic_dec(&copy->cp_nn->pending_async_copies); + atomic_dec(&copy->cp_copy.cp_nn->pending_async_copies); + kfree(copy); +} + +/* + * OLK-5.10 still allocates a standalone nfsd4_copy for the CB_OFFLOAD + * callback; it has no kthread or pending-copy accounting of its own. + */ +static void nfs4_put_cb_copy(struct nfsd4_copy *copy) +{ + if (!refcount_dec_and_test(&copy->refcount)) + return; kfree(copy); } static bool -check_and_set_stop_copy(struct nfsd4_copy *copy) +check_and_set_stop_copy(struct nfsd4_async_copy *copy) { bool value; - spin_lock(&copy->cp_clp->async_lock); + spin_lock(&copy->cp_copy.cp_clp->async_lock); value = copy->stopped; if (!copy->stopped) copy->stopped = true; - spin_unlock(&copy->cp_clp->async_lock); + spin_unlock(&copy->cp_copy.cp_clp->async_lock); return value; } -static void nfsd4_stop_copy(struct nfsd4_copy *copy) +static void nfsd4_stop_copy(struct nfsd4_async_copy *copy) { /* only 1 thread should stop the copy */ if (!check_and_set_stop_copy(copy)) @@ -1142,14 +1153,14 @@ static void nfsd4_stop_copy(struct nfsd4_copy *copy) nfs4_put_copy(copy); } -static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp) +static struct nfsd4_async_copy *nfsd4_get_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy = NULL; + struct nfsd4_async_copy *copy = NULL; spin_lock(&clp->async_lock); if (!list_empty(&clp->async_copies)) { - copy = list_first_entry(&clp->async_copies, struct nfsd4_copy, - copies); + copy = list_first_entry(&clp->async_copies, + struct nfsd4_async_copy, copies); refcount_inc(&copy->refcount); } spin_unlock(&clp->async_lock); @@ -1158,7 +1169,7 @@ static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp) void nfsd4_shutdown_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; while ((copy = nfsd4_get_copy(clp)) != NULL) nfsd4_stop_copy(copy); @@ -1356,7 +1367,7 @@ static void nfsd4_cb_offload_release(struct nfsd4_callback *cb) { struct nfsd4_copy *copy = container_of(cb, struct nfsd4_copy, cp_cb); - nfs4_put_copy(copy); + nfs4_put_cb_copy(copy); } static int nfsd4_cb_offload_done(struct nfsd4_callback *cb, @@ -1440,28 +1451,28 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) if (src->cp_intra) /* for inter, file_src doesn't exist yet */ dst->nf_src = nfsd_file_get(src->nf_src); - memcpy(&dst->cp_stateid, &src->cp_stateid, sizeof(src->cp_stateid)); memcpy(&dst->cp_src, &src->cp_src, sizeof(struct nl4_server)); memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid)); memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh)); dst->ss_mnt = src->ss_mnt; } -static void cleanup_async_copy(struct nfsd4_copy *copy) +static void cleanup_async_copy(struct nfsd4_async_copy *copy) { nfs4_free_copy_state(copy); - nfsd_file_put(copy->nf_dst); - if (copy->cp_intra) - nfsd_file_put(copy->nf_src); - spin_lock(&copy->cp_clp->async_lock); + nfsd_file_put(copy->cp_copy.nf_dst); + if (copy->cp_copy.cp_intra) + nfsd_file_put(copy->cp_copy.nf_src); + spin_lock(&copy->cp_copy.cp_clp->async_lock); list_del(&copy->copies); - spin_unlock(&copy->cp_clp->async_lock); + spin_unlock(&copy->cp_copy.cp_clp->async_lock); nfs4_put_copy(copy); } static int nfsd4_do_async_copy(void *data) { - struct nfsd4_copy *copy = (struct nfsd4_copy *)data; + struct nfsd4_async_copy *async = data; + struct nfsd4_copy *copy = &async->cp_copy; struct nfsd4_copy *cb_copy; if (!copy->cp_intra) { /* Inter server SSC */ @@ -1496,7 +1507,7 @@ static int nfsd4_do_async_copy(void *data) out: if (!copy->cp_intra) kfree(copy->nf_src); - cleanup_async_copy(copy); + cleanup_async_copy(async); return 0; } @@ -1506,7 +1517,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, { struct nfsd4_copy *copy = &u->copy; __be32 status; - struct nfsd4_copy *async_copy = NULL; + struct nfsd4_async_copy *async_copy = NULL; if (!copy->cp_intra) { /* Inter server SSC */ if (!inter_copy_offload_enable || copy->cp_synchronous) { @@ -1536,16 +1547,16 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); struct task_struct *task; - async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); + async_copy = kzalloc(sizeof(struct nfsd4_async_copy), GFP_KERNEL); if (!async_copy) goto out_err; - async_copy->cp_nn = nn; + async_copy->cp_copy.cp_nn = nn; refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > (int)rqstp->rq_pool->sp_nrthreads) goto out_err; - dup_copy_fields(copy, async_copy); + dup_copy_fields(copy, &async_copy->cp_copy); if (!nfs4_init_copy_state(nn, async_copy)) goto out_err; @@ -1561,10 +1572,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, */ get_task_struct(task); async_copy->copy_task = task; - spin_lock(&async_copy->cp_clp->async_lock); + spin_lock(&async_copy->cp_copy.cp_clp->async_lock); list_add(&async_copy->copies, - &async_copy->cp_clp->async_copies); - spin_unlock(&async_copy->cp_clp->async_lock); + &async_copy->cp_copy.cp_clp->async_copies); + spin_unlock(&async_copy->cp_copy.cp_clp->async_lock); wake_up_process(async_copy->copy_task); status = nfs_ok; } else { @@ -1583,10 +1594,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, goto out; } -struct nfsd4_copy * +struct nfsd4_async_copy * find_async_copy(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; spin_lock(&clp->async_lock); list_for_each_entry(copy, &clp->async_copies, copies) { @@ -1606,7 +1617,7 @@ nfsd4_offload_cancel(struct svc_rqst *rqstp, union nfsd4_op_u *u) { struct nfsd4_offload_status *os = &u->offload_status; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; copy = find_async_copy(clp, &os->stateid); @@ -1695,12 +1706,12 @@ nfsd4_offload_status(struct svc_rqst *rqstp, { struct nfsd4_offload_status *os = &u->offload_status; __be32 status = 0; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; copy = find_async_copy(clp, &os->stateid); if (copy) { - os->count = copy->cp_res.wr_bytes_written; + os->count = copy->cp_copy.cp_res.wr_bytes_written; nfs4_put_copy(copy); } else status = nfserr_bad_stateid; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 3e1aeb08ea6b..f97dbb2c093b 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -820,7 +820,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, return 1; } -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy) +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy) { return nfs4_init_cp_state(nn, &copy->cp_stateid, NFS4_COPY_STID); } @@ -854,12 +854,12 @@ struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, return NULL; } -void nfs4_free_copy_state(struct nfsd4_copy *copy) +void nfs4_free_copy_state(struct nfsd4_async_copy *copy) { struct nfsd_net *nn; WARN_ON_ONCE(copy->cp_stateid.sc_type != NFS4_COPY_STID); - nn = net_generic(copy->cp_clp->net, nfsd_net_id); + nn = net_generic(copy->cp_copy.cp_clp->net, nfsd_net_id); spin_lock(&nn->s2s_cp_lock); idr_remove(&nn->s2s_cp_stateids, copy->cp_stateid.stid.si_opaque.so_id); diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index a16e3d6fcbc0..6c080c63e880 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -636,6 +636,7 @@ struct nfsd4_blocked_lock { struct nfsd4_compound_state; struct nfsd_net; struct nfsd4_copy; +struct nfsd4_async_copy; extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct svc_fh *fhp, @@ -646,8 +647,8 @@ __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, struct nfs4_stid **s, struct nfsd_net *nn); struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, void (*sc_free)(struct nfs4_stid *)); -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy); -void nfs4_free_copy_state(struct nfsd4_copy *copy); +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy); +void nfs4_free_copy_state(struct nfsd4_async_copy *copy); struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, struct nfs4_stid *p_stid); void nfs4_unhash_stid(struct nfs4_stid *s); @@ -676,8 +677,8 @@ extern bool nfs4_has_reclaimed_state(struct xdr_netobj name, struct nfsd_net *nn struct nfs4_file *find_file(struct knfsd_fh *fh); void put_nfs4_file(struct nfs4_file *fi); -extern void nfs4_put_copy(struct nfsd4_copy *copy); -extern struct nfsd4_copy * +extern void nfs4_put_copy(struct nfsd4_async_copy *copy); +extern struct nfsd4_async_copy * find_async_copy(struct nfs4_client *clp, stateid_t *staetid); extern void nfs4_put_cpntf_state(struct nfsd_net *nn, struct nfs4_cpntf_state *cps); diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h index 1ced060704a3..03607083945a 100644 --- a/fs/nfsd/xdr4.h +++ b/fs/nfsd/xdr4.h @@ -569,18 +569,39 @@ struct nfsd4_copy { struct nfsd_file *nf_src; struct nfsd_file *nf_dst; - copy_stateid_t cp_stateid; - - struct list_head copies; - struct task_struct *copy_task; + /* + * Kept in nfsd4_copy because OLK-5.10 still allocates a separate + * nfsd4_copy for the CB_OFFLOAD callback (cb_copy in + * nfsd4_do_async_copy()) and that object is released through this + * refcount. + */ refcount_t refcount; - bool stopped; struct vfsmount *ss_mnt; struct nfs_fh c_fh; nfs4_stateid stateid; struct nfsd_net *cp_nn; }; + +/* + * Durable state for an async (background) server-side COPY. + * + * struct nfsd4_copy is transient: it lives in the COMPOUND argument buffer + * and is reused once the op returns. An async COPY outlives the COMPOUND + * (worker kthread, async_copies linkage), so its params and result are + * snapshotted into the embedded cp_copy and it never points into the request + * buffer. + */ +struct nfsd4_async_copy { + struct nfsd4_copy cp_copy; /* operation params + result */ + + struct list_head copies; /* nfs4_client.async_copies */ + struct task_struct *copy_task; + refcount_t refcount; + bool stopped; + copy_stateid_t cp_stateid; /* s2s_cp_stateids IDR entry */ +}; + extern bool inter_copy_offload_enable; struct nfsd4_seek { -- 2.34.1

2 1

[PATCH OLK-6.6] fs/dirty_pages: Fix fix UAF caused by unbalanced lock release in proc_buffer_open()
by Zizhi Wo 02 Nov '26

02 Nov '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10228 -------------------------------- proc_buffer_open() unconditionally releases the lock on its error path, even when it did not acquire the lock itself. This leads to a UAF issue. Consider the following sequence: 1. proc_dpages_open() acquires the lock and sets m->buf = buf_dirty. 2. proc_buffer_open() fails and, on its error path, releases the lock that was actually taken by proc_dpages_open(). 3. With the lock now wrongly released, userspace calls proc_buffer_open() and proc_buffer_write() again, re-acquires the lock and frees "buf_dirty" via free_buf_dirty(). 4. At this point m->buf still points to the already-freed buf_dirty. Any subsequent read path then dereferences m->buf and triggers a UAF. Fix this by pairing lock acquisition and release so that a function only releases the lock it has actually acquired. Fixes: 869921da6eaa ("fs/dirty_pages: dump the number of dirty pages for each inode") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/dirty_pages.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/dirty_pages.c b/fs/dirty_pages.c index 712992cba9e6..1a50420fd0f1 100644 --- a/fs/dirty_pages.c +++ b/fs/dirty_pages.c @@ -223,16 +223,17 @@ static int proc_buffer_show(struct seq_file *m, void *v) } static int proc_buffer_open(struct inode *inode, struct file *filp) { int ret; + bool need_lock = (filp->f_flags & O_ACCMODE) != O_RDONLY; - if (((filp->f_flags & O_ACCMODE) != O_RDONLY) && !dirty_pages_lock()) + if (need_lock && !dirty_pages_lock()) return -EBUSY; ret = single_open(filp, proc_buffer_show, NULL); - if (ret) + if (ret && need_lock) dirty_pages_unlock(); return ret; } -- 2.52.0

2 1

[PATCH OLK-6.6] tty: port: fix tty_port_tty_vhangup() race
by Gu Bowen 02 Nov '26

02 Nov '26

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v6.6.160 commit ce220b4cdf62f73db0c1940f968eb33b9899fdd0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20443 CVE: CVE-2026-98752 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b48820de8c1a596c5b99775524dfce73c6576c5d ] Drivers rely on tty_port_tty_vhangup() to synchronously hang up their ports before tearing down resources as part of deregistration (e.g. on physical disconnect). If tty_port_tty_vhangup() races with another hangup it may however return before the port has been shut down. This is in turn can lead to use-after-free and NULL-pointer dereferences in racing ioctls (including a synchronous hangup) and in processing of racing asynchronous hangups (carrier loss). Add the missing serialisation to tty_port_tty_vhangup() and tty_port_hangup() so that the former does not return until the port has been shut down also when there is a racing hangup. Note that serial core does not use tty_port_hangup(), but it already holds the port mutex when clearing port->tty and shutting down the port in uart_hangup(). Fixes: 7ca0ff9ab321 ("tty: Add a full port_close function") Cc: stable(a)kernel.org # 2.6.32: 2b5eac0f8c6e: tty: introduce and use tty_port_tty_vhangup() helper Cc: stable(a)kernel.org # 2.6.32 Reported-by: syzbot+5fabc1ae99ff40690d84(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/6a944641.4d659fcc.734b4.003c.GAE@google.com Signed-off-by: Johan Hovold <johan(a)kernel.org> Link: https://patch.msgid.link/20260910125114.640880-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ Ting-Han: use mutex_lock()/spin_lock_irqsave() instead of guard(), scoped_guard() and the tty_port_tty class, matching the existing code in this version of tty_port.c ] Assisted-by: LLM Signed-off-by: Ting-Han Hou <ue081723(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/tty_port.c | 74 +++++++++++++++++++++++++++------------- include/linux/tty_port.h | 22 ++---------- 2 files changed, 53 insertions(+), 43 deletions(-) diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c index 21430e64b412..2ffe11ac184f 100644 --- a/drivers/tty/tty_port.c +++ b/drivers/tty/tty_port.c @@ -348,21 +348,12 @@ void tty_port_tty_set(struct tty_port *port, struct tty_struct *tty) } EXPORT_SYMBOL(tty_port_tty_set); -/** - * tty_port_shutdown - internal helper to shutdown the device - * @port: tty port to be shut down - * @tty: the associated tty - * - * It is used by tty_port_hangup() and tty_port_close(). Its task is to - * shutdown the device if it was initialized (note consoles remain - * functioning). It lowers DTR/RTS (if @tty has HUPCL set) and invokes - * @port->ops->shutdown(). - */ -static void tty_port_shutdown(struct tty_port *port, struct tty_struct *tty) +static void tty_port_shutdown_locked(struct tty_port *port, struct tty_struct *tty) { - mutex_lock(&port->mutex); + lockdep_assert_held(&port->mutex); + if (port->console) - goto out; + return; if (tty_port_initialized(port)) { tty_port_set_initialized(port, false); @@ -376,7 +367,22 @@ static void tty_port_shutdown(struct tty_port *port, struct tty_struct *tty) if (port->ops->shutdown) port->ops->shutdown(port); } -out: +} + +/** + * tty_port_shutdown - internal helper to shutdown the device + * @port: tty port to be shut down + * @tty: the associated tty + * + * It is used by tty_port_hangup() and tty_port_close(). Its task is to + * shutdown the device if it was initialized (note consoles remain + * functioning). It lowers DTR/RTS (if @tty has HUPCL set) and invokes + * @port->ops->shutdown(). + */ +static void tty_port_shutdown(struct tty_port *port, struct tty_struct *tty) +{ + mutex_lock(&port->mutex); + tty_port_shutdown_locked(port, tty); mutex_unlock(&port->mutex); } @@ -394,6 +400,7 @@ void tty_port_hangup(struct tty_port *port) struct tty_struct *tty; unsigned long flags; + mutex_lock(&port->mutex); spin_lock_irqsave(&port->lock, flags); port->count = 0; tty = port->tty; @@ -402,26 +409,47 @@ void tty_port_hangup(struct tty_port *port) port->tty = NULL; spin_unlock_irqrestore(&port->lock, flags); tty_port_set_active(port, false); - tty_port_shutdown(port, tty); + tty_port_shutdown_locked(port, tty); + mutex_unlock(&port->mutex); tty_kref_put(tty); wake_up_interruptible(&port->open_wait); wake_up_interruptible(&port->delta_msr_wait); } EXPORT_SYMBOL(tty_port_hangup); -void __tty_port_tty_hangup(struct tty_port *port, bool check_clocal, bool async) +/** + * tty_port_tty_hangup - helper to hang up a tty asynchronously + * @port: tty port + * @check_clocal: hang only ttys with %CLOCAL unset? + */ +void tty_port_tty_hangup(struct tty_port *port, bool check_clocal) { struct tty_struct *tty = tty_port_tty_get(port); - if (tty && (!check_clocal || !C_CLOCAL(tty))) { - if (async) - tty_hangup(tty); - else - tty_vhangup(tty); - } + if (tty && (!check_clocal || !C_CLOCAL(tty))) + tty_hangup(tty); tty_kref_put(tty); } -EXPORT_SYMBOL_GPL(__tty_port_tty_hangup); +EXPORT_SYMBOL_GPL(tty_port_tty_hangup); + +/** + * tty_port_tty_vhangup - helper to hang up a tty synchronously + * @port: tty port + */ +void tty_port_tty_vhangup(struct tty_port *port) +{ + struct tty_struct *tty; + + mutex_lock(&port->mutex); + tty = tty_port_tty_get(port); + mutex_unlock(&port->mutex); + + if (tty) { + tty_vhangup(tty); + tty_kref_put(tty); + } +} +EXPORT_SYMBOL_GPL(tty_port_tty_vhangup); /** * tty_port_tty_wakeup - helper to wake up a tty diff --git a/include/linux/tty_port.h b/include/linux/tty_port.h index 11c36379cc7d..d9812604fe90 100644 --- a/include/linux/tty_port.h +++ b/include/linux/tty_port.h @@ -238,7 +238,8 @@ bool tty_port_carrier_raised(struct tty_port *port); void tty_port_raise_dtr_rts(struct tty_port *port); void tty_port_lower_dtr_rts(struct tty_port *port); void tty_port_hangup(struct tty_port *port); -void __tty_port_tty_hangup(struct tty_port *port, bool check_clocal, bool async); +void tty_port_tty_hangup(struct tty_port *port, bool check_clocal); +void tty_port_tty_vhangup(struct tty_port *port); void tty_port_tty_wakeup(struct tty_port *port); int tty_port_block_til_ready(struct tty_port *port, struct tty_struct *tty, struct file *filp); @@ -257,23 +258,4 @@ static inline int tty_port_users(struct tty_port *port) return port->count + port->blocked_open; } -/** - * tty_port_tty_hangup - helper to hang up a tty asynchronously - * @port: tty port - * @check_clocal: hang only ttys with %CLOCAL unset? - */ -static inline void tty_port_tty_hangup(struct tty_port *port, bool check_clocal) -{ - __tty_port_tty_hangup(port, check_clocal, true); -} - -/** - * tty_port_tty_vhangup - helper to hang up a tty synchronously - * @port: tty port - */ -static inline void tty_port_tty_vhangup(struct tty_port *port) -{ - __tty_port_tty_hangup(port, false, false); -} - #endif -- 2.43.0

2 1

[PATCH OLK-6.6] tty: tty_port: restore TTY_IO_ERROR on activation failure
by Gu Bowen 02 Nov '26

02 Nov '26

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v6.6.160 commit 16032c980d8f71642fcdc99309c571df3fcf3328 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20424 CVE: CVE-2026-98753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56964f6a31238fb41d5830bb42520c5b10ff7d8f ] Make sure to restore the TTY_IO_ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic due to unclocked accesses or NULL-pointer dereferences when accessing powered down or deregistered ports when a TTY ioctl races with hangup and open. Note that the flag is set again in tty_port_close() but not restoring it on activation failure leaves a window where drivers fail to handle the ioctl-hangup race. Fixes: a9a37ec33a1b ("tty: tty_port: Move the IO_ERROR clear") Cc: stable <stable(a)kernel.org> # 2.6.33 Signed-off-by: Johan Hovold <johan(a)kernel.org> Link: https://patch.msgid.link/20260908084000.218528-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ sashal: Adapted to existing explicit mutex unlocking instead of automatic cleanup. ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/tty_port.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c index 21430e64b412..7ee96882e0e4 100644 --- a/drivers/tty/tty_port.c +++ b/drivers/tty/tty_port.c @@ -781,6 +781,7 @@ int tty_port_open(struct tty_port *port, struct tty_struct *tty, int retval = port->ops->activate(port, tty); if (retval) { + set_bit(TTY_IO_ERROR, &tty->flags); mutex_unlock(&port->mutex); return retval; } -- 2.43.0

2 1

[PATCH OLK-6.6] fs/dirty_pages: Fix fix UAF caused by unbalanced lock release in proc_buffer_open()
by Zizhi Wo 02 Nov '26

02 Nov '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10228 -------------------------------- proc_buffer_open() unconditionally releases the lock on its error path, even when it did not acquire the lock itself. This leads to a UAF issue. Consider the following sequence: 1. proc_dpages_open() acquires the lock and sets m->buf = buf_dirty. 2. proc_buffer_open() fails and, on its error path, releases the lock that was actually taken by proc_dpages_open(). 3. With the lock now wrongly released, userspace calls proc_buffer_open() and proc_buffer_write() again, re-acquires the lock and frees "buf_dirty" via free_buf_dirty(). 4. At this point m->buf still points to the already-freed buf_dirty. Any subsequent read path then dereferences m->buf and triggers a UAF. Fix this by pairing lock acquisition and release so that a function only releases the lock it has actually acquired. Fixes: a98f9d744a60 ("fs/dirty_pages: dump the number of dirty pages for each inode") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/dirty_pages.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/dirty_pages.c b/fs/dirty_pages.c index 712992cba9e6..1a50420fd0f1 100644 --- a/fs/dirty_pages.c +++ b/fs/dirty_pages.c @@ -223,16 +223,17 @@ static int proc_buffer_show(struct seq_file *m, void *v) } static int proc_buffer_open(struct inode *inode, struct file *filp) { int ret; + bool need_lock = (filp->f_flags & O_ACCMODE) != O_RDONLY; - if (((filp->f_flags & O_ACCMODE) != O_RDONLY) && !dirty_pages_lock()) + if (need_lock && !dirty_pages_lock()) return -EBUSY; ret = single_open(filp, proc_buffer_show, NULL); - if (ret) + if (ret && need_lock) dirty_pages_unlock(); return ret; } -- 2.52.0

2 1

[PATCH OLK-6.6] nfsd: split nfsd4_copy into transient and durable async copy objects
by Lu Jialin 02 Nov '26

02 Nov '26

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v7.3-rc1 commit f307b4f7ed174a3252d2f292904fd276c78c77de category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18939 CVE: CVE-2026-89676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- struct nfsd4_copy served two roles: as &u->copy it is a transient per-COMPOUND argument in the request buffer; as the heap async_copy it is a durable object (worker kthread, reaper linkage, CB_OFFLOAD callback, IDR stateid) that outlives the COMPOUND, with dup_copy_fields() shuttling state between them. That dual identity was the root of the recent lifetime bugs. Introduce struct nfsd4_async_copy for the durable object. It embeds a struct nfsd4_copy (cp_copy) for the operation parameters/result and adds the durable-only fields: async_copies linkage, task_struct, refcount, reaper TTL, copy stateid, and CB_OFFLOAD callback. The durable object therefore never points into the request buffer. cp_clp stays in nfsd4_copy -- it is a request property read by the sync-copy tracepoints on the transient object. Mechanical split, no intended behavioral change; a step toward folding the copy stateids into the common nfs4_stid infrastructure. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260710-nfsd-testing-v3-8-a0ff7db6aa3e@kernel.org Signed-off-by: Chuck Lever <cel(a)kernel.org> Conflicts: fs/nfsd/nfs4proc.c [OLK-6.6 lacks the async-copy reaper, DESTROY_CLIENTID gating and admin-revoke cancel work, and still allocates a separate CB_OFFLOAD object; the split was adapted to that older model, so the hunks for nfsd4_async_copy_reaper(), nfsd4_has_active_async_copies() and nfsd4_cancel_copy_by_sb() were dropped] fs/nfsd/nfs4state.c [nfs4_free_copy_state() now reaches cp_clp through cp_copy.cp_clp after the split] fs/nfsd/state.h [Prototypes for nfs4_init_copy_state()/nfs4_free_copy_state() changed to struct nfsd4_async_copy] fs/nfsd/xdr4.h [Only copies/copy_task/refcount/cp_stateid moved to the new struct; cp_nn and ss_nsui stay in nfsd4_copy because OLK-6.6 has no cp_ttl/cp_cb_offload/attr_update fields] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs4proc.c | 86 +++++++++++++++++++++++---------------------- fs/nfsd/nfs4state.c | 6 ++-- fs/nfsd/state.h | 5 +-- fs/nfsd/xdr4.h | 24 +++++++++---- 4 files changed, 68 insertions(+), 53 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index c94d15fa4330..c26be4ba2996 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1274,35 +1274,35 @@ nfsd4_clone(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return status; } -static void nfs4_put_copy(struct nfsd4_copy *copy) +static void nfs4_put_copy(struct nfsd4_async_copy *copy) { if (!refcount_dec_and_test(&copy->refcount)) return; - atomic_dec(&copy->cp_nn->pending_async_copies); + atomic_dec(&copy->cp_copy.cp_nn->pending_async_copies); /* Drop the task_struct pinned in nfsd4_copy(); NULL on error paths. */ if (copy->copy_task) put_task_struct(copy->copy_task); - kfree(copy->cp_src); + kfree(copy->cp_copy.cp_src); kfree(copy); } -static void nfsd4_stop_copy(struct nfsd4_copy *copy) +static void nfsd4_stop_copy(struct nfsd4_async_copy *copy) { - if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, &copy->cp_flags)) + if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, &copy->cp_copy.cp_flags)) kthread_stop(copy->copy_task); nfs4_put_copy(copy); } -static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) +static struct nfsd4_async_copy *nfsd4_unhash_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy = NULL; + struct nfsd4_async_copy *copy = NULL; spin_lock(&clp->async_lock); if (!list_empty(&clp->async_copies)) { - copy = list_first_entry(&clp->async_copies, struct nfsd4_copy, - copies); + copy = list_first_entry(&clp->async_copies, + struct nfsd4_async_copy, copies); refcount_inc(&copy->refcount); - copy->cp_clp = NULL; + copy->cp_copy.cp_clp = NULL; if (!list_empty(&copy->copies)) list_del_init(&copy->copies); } @@ -1312,7 +1312,7 @@ static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) void nfsd4_shutdown_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; while ((copy = nfsd4_unhash_copy(clp)) != NULL) nfsd4_stop_copy(copy); @@ -1705,7 +1705,6 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) if (!nfsd4_ssc_is_inter(src)) dst->nf_src = nfsd_file_get(src->nf_src); - memcpy(&dst->cp_stateid, &src->cp_stateid, sizeof(src->cp_stateid)); memcpy(dst->cp_src, src->cp_src, sizeof(struct nl4_server)); memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid)); memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh)); @@ -1720,20 +1719,20 @@ static void release_copy_files(struct nfsd4_copy *copy) nfsd_file_put(copy->nf_dst); } -static void cleanup_async_copy(struct nfsd4_copy *copy) +static void cleanup_async_copy(struct nfsd4_async_copy *copy) { nfs4_free_copy_state(copy); - release_copy_files(copy); - if (copy->cp_clp) { - spin_lock(&copy->cp_clp->async_lock); + release_copy_files(&copy->cp_copy); + if (copy->cp_copy.cp_clp) { + spin_lock(&copy->cp_copy.cp_clp->async_lock); if (!list_empty(&copy->copies)) list_del_init(&copy->copies); - spin_unlock(&copy->cp_clp->async_lock); + spin_unlock(&copy->cp_copy.cp_clp->async_lock); } nfs4_put_copy(copy); } -static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) +static void nfsd4_send_cb_offload(struct nfsd4_async_copy *copy, __be32 nfserr) { struct nfsd4_cb_offload *cbo; @@ -1741,14 +1740,15 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) if (!cbo) return; - memcpy(&cbo->co_res, &copy->cp_res, sizeof(copy->cp_res)); - memcpy(&cbo->co_fh, &copy->fh, sizeof(copy->fh)); + memcpy(&cbo->co_res, &copy->cp_copy.cp_res, + sizeof(copy->cp_copy.cp_res)); + memcpy(&cbo->co_fh, &copy->cp_copy.fh, sizeof(copy->cp_copy.fh)); cbo->co_nfserr = nfserr; - nfsd4_init_cb(&cbo->co_cb, copy->cp_clp, &nfsd4_cb_offload_ops, + nfsd4_init_cb(&cbo->co_cb, copy->cp_copy.cp_clp, &nfsd4_cb_offload_ops, NFSPROC4_CLNT_CB_OFFLOAD); - trace_nfsd_cb_offload(copy->cp_clp, &cbo->co_res.cb_stateid, - &cbo->co_fh, copy->cp_count, nfserr); + trace_nfsd_cb_offload(copy->cp_copy.cp_clp, &cbo->co_res.cb_stateid, + &cbo->co_fh, copy->cp_copy.cp_count, nfserr); nfsd4_run_cb(&cbo->co_cb); } @@ -1761,7 +1761,8 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) */ static int nfsd4_do_async_copy(void *data) { - struct nfsd4_copy *copy = (struct nfsd4_copy *)data; + struct nfsd4_async_copy *async = data; + struct nfsd4_copy *copy = &async->cp_copy; __be32 nfserr; if (nfsd4_ssc_is_inter(copy)) { @@ -1789,8 +1790,8 @@ static int nfsd4_do_async_copy(void *data) } do_callback: - nfsd4_send_cb_offload(copy, nfserr); - cleanup_async_copy(copy); + nfsd4_send_cb_offload(async, nfserr); + cleanup_async_copy(async); return 0; } @@ -1799,7 +1800,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, union nfsd4_op_u *u) { struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); - struct nfsd4_copy *async_copy = NULL; + struct nfsd4_async_copy *async_copy = NULL; struct nfsd4_copy *copy = &u->copy; struct nfsd42_write_res *result; __be32 status; @@ -1829,20 +1830,21 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, if (nfsd4_copy_is_async(copy)) { struct task_struct *task; - async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); + async_copy = kzalloc(sizeof(struct nfsd4_async_copy), GFP_KERNEL); if (!async_copy) goto out_err; - async_copy->cp_nn = nn; + async_copy->cp_copy.cp_nn = nn; INIT_LIST_HEAD(&async_copy->copies); refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > (int)rqstp->rq_pool->sp_nrthreads) goto out_err; - async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL); - if (!async_copy->cp_src) + async_copy->cp_copy.cp_src = + kmalloc(sizeof(*async_copy->cp_copy.cp_src), GFP_KERNEL); + if (!async_copy->cp_copy.cp_src) goto out_err; - dup_copy_fields(copy, async_copy); + dup_copy_fields(copy, &async_copy->cp_copy); if (!nfs4_init_copy_state(nn, async_copy)) goto out_err; @@ -1858,10 +1860,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, */ get_task_struct(task); async_copy->copy_task = task; - spin_lock(&async_copy->cp_clp->async_lock); + spin_lock(&async_copy->cp_copy.cp_clp->async_lock); list_add(&async_copy->copies, - &async_copy->cp_clp->async_copies); - spin_unlock(&async_copy->cp_clp->async_lock); + &async_copy->cp_copy.cp_clp->async_copies); + spin_unlock(&async_copy->cp_copy.cp_clp->async_lock); wake_up_process(async_copy->copy_task); status = nfs_ok; } else { @@ -1886,10 +1888,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, goto out; } -static struct nfsd4_copy * +static struct nfsd4_async_copy * find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; lockdep_assert_held(&clp->async_lock); @@ -1901,10 +1903,10 @@ find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid) return NULL; } -static struct nfsd4_copy * +static struct nfsd4_async_copy * find_async_copy(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; spin_lock(&clp->async_lock); copy = find_async_copy_locked(clp, stateid); @@ -1920,7 +1922,7 @@ nfsd4_offload_cancel(struct svc_rqst *rqstp, union nfsd4_op_u *u) { struct nfsd4_offload_status *os = &u->offload_status; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; copy = find_async_copy(clp, &os->stateid); @@ -2008,13 +2010,13 @@ nfsd4_offload_status(struct svc_rqst *rqstp, { struct nfsd4_offload_status *os = &u->offload_status; __be32 status = nfs_ok; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; spin_lock(&clp->async_lock); copy = find_async_copy_locked(clp, &os->stateid); if (copy) - os->count = copy->cp_res.wr_bytes_written; + os->count = copy->cp_copy.cp_res.wr_bytes_written; else status = nfserr_bad_stateid; spin_unlock(&clp->async_lock); diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 4e5af5a79ed5..054a24e0e84a 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1034,7 +1034,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, return 1; } -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy) +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy) { return nfs4_init_cp_state(nn, &copy->cp_stateid, NFS4_COPY_STID); } @@ -1068,13 +1068,13 @@ struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, return NULL; } -void nfs4_free_copy_state(struct nfsd4_copy *copy) +void nfs4_free_copy_state(struct nfsd4_async_copy *copy) { struct nfsd_net *nn; if (copy->cp_stateid.cs_type != NFS4_COPY_STID) return; - nn = net_generic(copy->cp_clp->net, nfsd_net_id); + nn = net_generic(copy->cp_copy.cp_clp->net, nfsd_net_id); spin_lock(&nn->s2s_cp_lock); idr_remove(&nn->s2s_cp_stateids, copy->cp_stateid.cs_stid.si_opaque.so_id); diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index 4dd8ade17446..d62faf4f183a 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -676,6 +676,7 @@ struct nfsd4_blocked_lock { struct nfsd4_compound_state; struct nfsd_net; struct nfsd4_copy; +struct nfsd4_async_copy; extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct svc_fh *fhp, @@ -686,8 +687,8 @@ __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, struct nfs4_stid **s, struct nfsd_net *nn); struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, void (*sc_free)(struct nfs4_stid *)); -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy); -void nfs4_free_copy_state(struct nfsd4_copy *copy); +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy); +void nfs4_free_copy_state(struct nfsd4_async_copy *copy); struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, struct nfs4_stid *p_stid); void nfs4_unhash_stid(struct nfs4_stid *s); diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h index a83a52b0f518..37597f8dec46 100644 --- a/fs/nfsd/xdr4.h +++ b/fs/nfsd/xdr4.h @@ -599,18 +599,30 @@ struct nfsd4_copy { struct nfsd_file *nf_src; struct nfsd_file *nf_dst; - copy_stateid_t cp_stateid; - - struct list_head copies; - struct task_struct *copy_task; - refcount_t refcount; - struct nfsd4_ssc_umount_item *ss_nsui; struct nfs_fh c_fh; nfs4_stateid stateid; struct nfsd_net *cp_nn; }; +/* + * Durable state for an async (background) server-side COPY. + * + * struct nfsd4_copy is transient: it lives in the COMPOUND argument buffer + * and is reused once the op returns. An async COPY outlives the COMPOUND + * (worker kthread, async_copies linkage), so its params and result are + * snapshotted into the embedded cp_copy and it never points into the request + * buffer. + */ +struct nfsd4_async_copy { + struct nfsd4_copy cp_copy; /* operation params + result */ + + struct list_head copies; /* nfs4_client.async_copies */ + struct task_struct *copy_task; + refcount_t refcount; + copy_stateid_t cp_stateid; /* s2s_cp_stateids IDR entry */ +}; + static inline void nfsd4_copy_set_sync(struct nfsd4_copy *copy, bool sync) { if (sync) -- 2.34.1

2 1

[PATCH OLK-6.6 0/9] arm64/mpam: Fix Narrow-PARTID and monitor handling
by Jinjie Ruan 02 Nov '26

02 Nov '26

Fix several bugs in arm_mpam driver and the resctrl filesystem it shares with x86. Two of them leave MPAM monitoring completely unusable; the rest fix Narrow-PARTID label loss, an overwritten intPARTID limit, a use-after-free, a leftover debugfs subtree, a counter unit mismatch, a lost MSC write error and a missing debugfs_file_put(). Jinjie Ruan (9): arm64/mpam: Keep the monitor tag of tasks in root monitor groups arm64/mpam: Take the minimum intPARTID limit across RIS arm64/mpam: Remove class and component debugfs before freeing them arm64/mpam: Protect the reqPARTID map with RCU arm64/mpam: Store MBWU state saved across reset in counter units arm64/mpam: Propagate MSC write failures from mpam_apply_config() debugfs: Fix missing debugfs_file_put() on cpumask read failure fs/resctrl: Expand the width of domid by replacing mon_data_bits fs/resctrl: Set up the monitor state of a mon_capable MBA domain arch/arm64/include/asm/mpam.h | 34 ++++++-- drivers/platform/mpam/mpam_devices.c | 76 ++++++++++++++-- drivers/platform/mpam/mpam_resctrl.c | 125 ++++++++++++++++++++++----- fs/debugfs/file.c | 3 +- fs/resctrl/ctrlmondata.c | 10 +-- fs/resctrl/internal.h | 23 ++--- fs/resctrl/rdtgroup.c | 72 +++++++++++++-- 7 files changed, 287 insertions(+), 56 deletions(-) -- 2.34.1

2 11

[PATCH OLK-5.10] mmc: core: Cancel SDIO IRQ work before freeing host
by Lu Jialin 02 Nov '26

02 Nov '26

From: Fan Wu <fanwu01(a)zju.edu.cn> stable inclusion from stable-v6.6.158 commit 0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19959 CVE: CVE-2026-98213 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6feadbecdae60a6324c967f3b1493741083793a3 upstream. A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work from its interrupt handler. That work is only cancelled on the suspend path (mmc_sdio_suspend()), not on the remove/free path, so a worker armed just before the controller freed its IRQ can run after mmc_host_classdev_release() has freed the host and dereference it through container_of(). Cancel host->sdio_irq_work in mmc_free_host(), like the existing host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel delayed work before releasing host"). This issue was found by an in-house static analysis tool. Fixes: 682696605c70 ("mmc: sdio: Add API to manage SDIO IRQs from a workqueue") Cc: stable(a)vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Signed-off-by: Ulf Hansson <ulfh(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/mmc/core/host.c [In OLK-5.10 host->sdio_irq_work is still a struct delayed_work as in linux-5.10.y, while the 6.6.y patch targets struct work_struct; adapted cancel_work_sync() to cancel_delayed_work_sync(), matching the type and the existing suspend-path call in sdio.c] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- drivers/mmc/core/host.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c index b949a4468bf5..040e9c417a5e 100644 --- a/drivers/mmc/core/host.c +++ b/drivers/mmc/core/host.c @@ -613,6 +613,7 @@ EXPORT_SYMBOL(mmc_remove_host); void mmc_free_host(struct mmc_host *host) { cancel_delayed_work_sync(&host->detect); + cancel_delayed_work_sync(&host->sdio_irq_work); mmc_pwrseq_free(host); put_device(&host->class_dev); } -- 2.34.1

2 1