- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] perf: Reject exited events as group leaders
by Luo Gengkun 29 Aug '26

29 Aug '26

From: Kyle Zeng <kylebot(a)openai.com> mainline inclusion from mainline-v7.2 commit fa091f46c3833fb22384f10eade2b4e1e1d0b278 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18336 CVE: CVE-2026-74753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- perf_event_remove_on_exec() sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perf_event_open() currently accepts that event as a group leader because its early validation rejects only REVOKED and DEAD events. A new sibling can consequently be linked to the detached leader. When the leader is closed, perf_group_detach() observes that its PERF_ATTACH_GROUP bit is already clear and skips the new sibling. The sibling then retains a group_leader pointer to the freed event. Reject group leaders in the EXIT state. Perform the check while holding the shared context mutex so that an exec in the target task cannot detach the leader between validation and group attachment. [peterz: make the earlier test fully consistent] Fixes: 037a3c43edfb ("perf/core: Detach event groups during remove_on_exec") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Kyle Zeng <kylebot(a)openai.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://patch.msgid.link/20260806205655.75722-1-kylebot@openai.com Conflicts: kernel/events/core.c [Upstream fa091f46c3833 ("perf: Reject exited events as group leaders") rejects EXIT-state group leaders in two spots: the early fd validation and a recheck under ctx::mutex. The downstream baseline predates the fd_file()/PERF_EVENT_STATE_REVOKED refactor present in the upstream base: there is no fd_file() helper and no REVOKED event-state in the downstream enum (only PERF_EVENT_STATE_EXIT). Keep the downstream perf_fget_light()/group.file->private_data accessor instead of the absent fd_file(group), and add the EXIT-state rejection with -ENODEV/goto err_fd right after retrieving the leader. This achieves the same early-validation safety as the upstream change. The second hunk (recheck under ctx::mutex with goto err_locked) applies verbatim.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/kernel/events/core.c b/kernel/events/core.c index 6916dc78b0e7..a388eb764659 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -12678,6 +12678,10 @@ SYSCALL_DEFINE5(perf_event_open, if (err) goto err_fd; group_leader = group.file->private_data; + if (group_leader->state <= PERF_EVENT_STATE_EXIT) { + err = -ENODEV; + goto err_group_fd; + } if (flags & PERF_FLAG_FD_OUTPUT) output_event = group_leader; if (flags & PERF_FLAG_FD_NO_GROUP) @@ -12805,6 +12809,12 @@ SYSCALL_DEFINE5(perf_event_open, if (group_leader->ctx != ctx) goto err_locked; + /* Recheck under ctx::mutex to serialize against remove-on-exec. */ + if (group_leader->state <= PERF_EVENT_STATE_EXIT) { + err = -ENODEV; + goto err_locked; + } + /* * Only a group leader can be exclusive or pinned */ -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] macvlan: inherit needed_headroom and needed_tailroom from lowerdev
by JiangJieHua 29 Aug '26

29 Aug '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.2 commit cef51860becd9700217c81732ca1eb1ea6ed6fe1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18331 CVE: CVE-2026-74743 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space. This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / macvlan_hard_header() prepends header data or when lower devices append tailroom. Fix this by: 1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached macvlans in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events. Fixes: b863ceb7ddce ("[NET]: Add macvlan driver") Reported-by: Tangxin Xie <xietangxin(a)h-partners.com> Closes: https://lore.kernel.org/netdev/CANn89i+1EW-sFNK8xoq98gMbPCeLS7e=+rs9gHfLg5W… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Hangbin Liu <liuhangbin(a)kylinos.cn> Link: https://patch.msgid.link/20260806141938.287660-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/macvlan.c [4.19 uses manual gso_max_size/gso_max_segs assignment instead of netif_inherit_tso_max() in macvlan_device_event() NETDEV_FEAT_CHANGE handler. The conflict is resolved by keeping 4.19's existing TSO inheritance and applying the new needed_headroom/needed_tailroom inheritance from the upstream patch.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- drivers/net/macvlan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index 0f2a2e6705142..38e0386659aca 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -883,7 +883,8 @@ static int macvlan_init(struct net_device *dev) dev->gso_max_size = lowerdev->gso_max_size; dev->gso_max_segs = lowerdev->gso_max_segs; dev->hard_header_len = lowerdev->hard_header_len; - + dev->needed_headroom = lowerdev->needed_headroom; + dev->needed_tailroom = lowerdev->needed_tailroom; macvlan_set_lockdep_class(dev); vlan->pcpu_stats = netdev_alloc_pcpu_stats(struct vlan_pcpu_stats); @@ -1682,6 +1683,8 @@ static int macvlan_device_event(struct notifier_block *unused, list_for_each_entry(vlan, &port->vlans, list) { vlan->dev->gso_max_size = dev->gso_max_size; vlan->dev->gso_max_segs = dev->gso_max_segs; + vlan->dev->needed_headroom = dev->needed_headroom; + vlan->dev->needed_tailroom = dev->needed_tailroom; netdev_update_features(vlan->dev); } break; -- 2.33.8

2 2

[PATCH openEuler-1.0-LTS] ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
by JiangJieHua 29 Aug '26

29 Aug '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.2 commit e16e960d55a40d36bd7c2494cc005e757dc9a1ef category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18377 CVE: CVE-2026-74744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space. This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header() prepends header data or when lower devices append tailroom. Fix this by: 1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events. Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Reported-by: syzbot+1f9fd0f4b601cf88d6e6(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a720a21.40259c87.584f4.04bb.GAE@google.com/… Reported-by: Tangxin Xie <xietangxin(a)h-partners.com> Closes: https://lore.kernel.org/netdev/CANn89i+1EW-sFNK8xoq98gMbPCeLS7e=+rs9gHfLg5W… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Hangbin Liu <liuhangbin(a)kylinos.cn> Link: https://patch.msgid.link/20260806103857.115541-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ipvlan/ipvlan_main.c [The upstream patch expects netif_inherit_tso_max() helper in the NETDEV_FEAT_CHANGE event handler, but 4.19 uses direct assignments to gso_max_size and gso_max_segs. Resolved by keeping the 4.19 TSO inheritance style (direct assignment) and applying the new headroom/ tailroom inheritance from the patch. This preserves the upstream fix semantics while maintaining compatibility with the 4.19 codebase.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- drivers/net/ipvlan/ipvlan_main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c index 9057cdf9b2162..ed1a5af42b072 100644 --- a/drivers/net/ipvlan/ipvlan_main.c +++ b/drivers/net/ipvlan/ipvlan_main.c @@ -258,6 +258,8 @@ static int ipvlan_init(struct net_device *dev) dev->gso_max_size = phy_dev->gso_max_size; dev->gso_max_segs = phy_dev->gso_max_segs; dev->hard_header_len = phy_dev->hard_header_len; + dev->needed_headroom = phy_dev->needed_headroom; + dev->needed_tailroom = phy_dev->needed_tailroom; netdev_lockdep_set_classes(dev); @@ -899,6 +901,8 @@ static int ipvlan_device_event(struct notifier_block *unused, list_for_each_entry(ipvlan, &port->ipvlans, pnode) { ipvlan->dev->gso_max_size = dev->gso_max_size; ipvlan->dev->gso_max_segs = dev->gso_max_segs; + ipvlan->dev->needed_headroom = dev->needed_headroom; + ipvlan->dev->needed_tailroom = dev->needed_tailroom; netdev_update_features(ipvlan->dev); } break; -- 2.33.8

2 2

[PATCH openEuler-1.0-LTS] ipv6: mcast: Fix potential UAF in MLD delayed work
by JiangJieHua 29 Aug '26

29 Aug '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.2-rc3 commit 9b26518b6896a16b809b1e42986f4ebac7bccc1e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17356 CVE: CVE-2026-72322 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary reference to inet6_dev is dropped, which can drop its refcount to 0. The actual freeing of inet6_dev memory is deferred via RCU. Concurrently, the packet receive path runs under RCU read lock and obtains the inet6_dev pointer. Because the memory is RCU-protected, CPU-0 can safely dereference inet6_dev even if its refcount has hit 0. However, if CPU-0 calls igmp6_event_query() and schedules delayed work, it attempts to acquire a reference using in6_dev_hold(). This increments the refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning. Since the inet6_dev memory is still scheduled to be freed after the RCU grace period, the device is freed while the work is still scheduled. When the work runs, it accesses the freed memory, causing a kernel panic. Fix this by using refcount_inc_not_zero() (via a new helper in6_dev_hold_safe()) to prevent acquiring a reference if the device is already being destroyed. If the refcount is 0, we do not schedule the work. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/20260705181756.963063-3-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: include/net/addrconf.h net/ipv6/mcast.c [addrconf.h: the upstream hunk context after in6_dev_hold() references ip6_ignore_linkdown(), which does not exist in 4.19, so only the new in6_dev_hold_safe() helper is added and the ip6_ignore_linkdown() context is dropped. mcast.c: 4.19 use timers (mld_gq_start_timer/mld_ifc_start_timer/ mld_dad_start_timer + mod_timer) instead of workqueue (mld_*_start_work + mod_delayed_work); igmp6_event_query/report have no workqueue queues, so those hunks are not applicable. The refcount fix is applied to the three _start_timer functions instead, preserving the upstream semantics.In 4.19, the `igmp6_event_query/report` hunks are dropped entirely (sync implementation, no workqueue queues); the target's existing refcount sites are already covered by the three `_start_timer` fixes.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- include/net/addrconf.h | 5 +++++ net/ipv6/mcast.c | 18 ++++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/include/net/addrconf.h b/include/net/addrconf.h index 10d270f004f0d..26f0a5bc234be 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -425,6 +425,11 @@ static inline void in6_dev_hold(struct inet6_dev *idev) refcount_inc(&idev->refcnt); } +static inline bool in6_dev_hold_safe(struct inet6_dev *idev) +{ + return refcount_inc_not_zero(&idev->refcnt); +} + void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp); static inline void in6_ifa_put(struct inet6_ifaddr *ifp) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index bb484fe27e137..787800af097a5 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1037,8 +1037,10 @@ static void mld_gq_start_timer(struct inet6_dev *idev) unsigned long tv = prandom_u32() % idev->mc_maxdelay; idev->mc_gq_running = 1; - if (!mod_timer(&idev->mc_gq_timer, jiffies+tv+2)) - in6_dev_hold(idev); + if (in6_dev_hold_safe(idev)) { + if (mod_timer(&idev->mc_gq_timer, jiffies+tv+2)) + in6_dev_put(idev); + } } static void mld_gq_stop_timer(struct inet6_dev *idev) @@ -1052,8 +1054,10 @@ static void mld_ifc_start_timer(struct inet6_dev *idev, unsigned long delay) { unsigned long tv = prandom_u32() % delay; - if (!mod_timer(&idev->mc_ifc_timer, jiffies+tv+2)) - in6_dev_hold(idev); + if (in6_dev_hold_safe(idev)) { + if (mod_timer(&idev->mc_ifc_timer, jiffies+tv+2)) + in6_dev_put(idev); + } } static void mld_ifc_stop_timer(struct inet6_dev *idev) @@ -1067,8 +1071,10 @@ static void mld_dad_start_timer(struct inet6_dev *idev, unsigned long delay) { unsigned long tv = prandom_u32() % delay; - if (!mod_timer(&idev->mc_dad_timer, jiffies+tv+2)) - in6_dev_hold(idev); + if (in6_dev_hold_safe(idev)) { + if (mod_timer(&idev->mc_dad_timer, jiffies+tv+2)) + in6_dev_put(idev); + } } static void mld_dad_stop_timer(struct inet6_dev *idev) -- 2.33.8

2 2

[PATCH openEuler-1.0-LTS] ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
by JiangJieHua 29 Aug '26

29 Aug '26

From: Linmao Li <lilinmao(a)kylinos.cn> mainline inclusion from mainline-v7.2-rc1 commit 627ac78f2741e2ebd2225e2e953b6964a8a9182f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18025 CVE: CVE-2026-74398 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD via addrconf_dad_end(), which drops ifp->lock on return. The lock is re-acquired after net_info_ratelimited(). A concurrent ipv6_del_addr() can take the lock in that window, set ifp->state to DEAD and run list_del_rcu(&ifp->if_list). addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad: and schedules a new dad_work. The work calls ipv6_del_addr() again, hitting the already-poisoned list entry: general protection fault: 0000 [#1] SMP NOPTI CPU: 4 PID: 217 Comm: kworker/4:1 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:ipv6_del_addr+0xe9/0x280 RAX: dead000000000122 Call Trace: addrconf_dad_stop+0x113/0x140 addrconf_dad_work+0x28c/0x430 process_one_work+0x1eb/0x3b0 worker_thread+0x4d/0x400 kthread+0x104/0x140 ret_from_fork+0x35/0x40 Fold the addrconf_dad_end() logic into addrconf_dad_failure() under a single ifp->lock critical section. The STABLE_PRIVACY branch temporarily drops ifp->lock around address regeneration, so at lock_errdad: verify the state is still POSTDAD before transitioning to ERRDAD; bail out otherwise to avoid overwriting a state set by another path while the lock was released. Fixes: c15b1ccadb32 ("ipv6: move DAD and addrconf_verify processing to workqueue") Signed-off-by: Linmao Li <lilinmao(a)kylinos.cn> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/20260513025509.3776405-1-lilinmao@kylinos.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/addrconf.c [Contextual differences between the branch and mainline required adaptation during patch application. The functional changes from the upstream commit are preserved.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv6/addrconf.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 98a24b5e6f036..7b8dda47d3855 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -2020,16 +2020,18 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp) struct inet6_dev *idev = ifp->idev; struct net *net = dev_net(ifp->idev->dev); - if (addrconf_dad_end(ifp)) { + spin_lock_bh(&ifp->lock); + + if (ifp->state != INET6_IFADDR_STATE_DAD) { + spin_unlock_bh(&ifp->lock); in6_ifa_put(ifp); return; } + ifp->state = INET6_IFADDR_STATE_POSTDAD; net_info_ratelimited("%s: IPv6 duplicate address %pI6c used by %pM detected!\n", ifp->idev->dev->name, &ifp->addr, eth_hdr(skb)->h_source); - spin_lock_bh(&ifp->lock); - if (ifp->flags & IFA_F_STABLE_PRIVACY) { struct in6_addr new_addr; struct inet6_ifaddr *ifp2; @@ -2077,6 +2079,11 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp) in6_ifa_put(ifp2); lock_errdad: spin_lock_bh(&ifp->lock); + if (ifp->state != INET6_IFADDR_STATE_POSTDAD) { + spin_unlock_bh(&ifp->lock); + in6_ifa_put(ifp); + return; + } } errdad: -- 2.33.8

2 3

[PATCH openEuler-1.0-LTS] ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
by JiangJieHua 29 Aug '26

29 Aug '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.2-rc3 commit 7b19c0f81ed1fdaec6bc522569be367199a9edf3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9704 CVE: CVE-2026-72323 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A race condition exists between device teardown (inetdev_destroy) and incoming IGMP query processing (igmp_rcv), leading to a Use-After-Free in the IGMP timer callback. During device destruction, inetdev_destroy() drops the primary reference to in_device, which can drop its refcount to 0. The actual freeing of in_device memory is deferred via RCU (using call_rcu()). Concurrently, igmp_rcv() runs under RCU read lock and obtains the in_device pointer. Because the memory is RCU-protected, CPU-0 can safely dereference in_device even if its refcount has hit 0. However, if CPU-0 calls igmp_gq_start_timer() and re-arms the timer, it attempts to acquire a reference using in_dev_hold(). This increments the refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning. Since the in_device memory is still scheduled to be freed after the RCU grace period (as the free callback does not check the refcount again), the device is freed while the timer is still armed. When the timer expires, it accesses the freed memory, causing a kernel panic. Fix this by using refcount_inc_not_zero() (via a new helper in_dev_hold_safe()) to prevent acquiring a reference if the device is already being destroyed. If the refcount is 0, we do not arm the timer. A similar issue in IPv6 MLD is fixed in a subsequent patch. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Zero Day Initiative <zdi-disclosures(a)trendmicro.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/20260705181756.963063-2-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/ipv4/igmp.c [For 4.19, get_random_u32_below() is not available, so igmp_ifc_start_timer() retains the original prandom_u32() % delay approach. The remaining refcount logic and the newly added in_dev_hold_safe() parts are consistent with upstream.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- include/linux/inetdevice.h | 5 +++++ net/ipv4/igmp.c | 14 +++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h index a64f21a97369a..002f1de9a30f4 100644 --- a/include/linux/inetdevice.h +++ b/include/linux/inetdevice.h @@ -255,6 +255,11 @@ static inline void in_dev_put(struct in_device *idev) #define __in_dev_put(idev) refcount_dec(&(idev)->refcnt) #define in_dev_hold(idev) refcount_inc(&(idev)->refcnt) +static inline bool in_dev_hold_safe(struct in_device *idev) +{ + return refcount_inc_not_zero(&idev->refcnt); +} + #endif /* __KERNEL__ */ static __inline__ __be32 inet_make_mask(int logmask) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index c4b396968acd6..ed9ef8430c14f 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -237,16 +237,20 @@ static void igmp_gq_start_timer(struct in_device *in_dev) return; in_dev->mr_gq_running = 1; - if (!mod_timer(&in_dev->mr_gq_timer, exp)) - in_dev_hold(in_dev); + if (in_dev_hold_safe(in_dev)) { + if (mod_timer(&in_dev->mr_gq_timer, exp)) + in_dev_put(in_dev); + } } static void igmp_ifc_start_timer(struct in_device *in_dev, int delay) { - int tv = prandom_u32() % delay; + if (in_dev_hold_safe(in_dev)) { + int tv = prandom_u32() % (delay); - if (!mod_timer(&in_dev->mr_ifc_timer, jiffies+tv+2)) - in_dev_hold(in_dev); + if (mod_timer(&in_dev->mr_ifc_timer, jiffies + tv + 2)) + in_dev_put(in_dev); + } } static void igmp_mod_timer(struct ip_mc_list *im, int max_delay) -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] inet: frags: publish queues before arming timer
by JiangJieHua 29 Aug '26

29 Aug '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> mainline inclusion from mainline-v7.2-rc7 commit 653d7ddf6cba867777a3d14c4f83ace008c5ad13 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18205 CVE: CVE-2026-74662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference. Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Signed-off-by: Ren Wei <enjou1224z(a)gmail.com> Link: https://patch.msgid.link/bf66785e7c0c139d7a1900e2f01faeeab344b960.178494884… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inet_fragment.c [4.19 use struct netns_frags *nf (not struct fqdir *fqdir) and have no inet_frag_putn(); inet_frag_kill() takes a single argument. The conflict error path keeps the target's inet_frag_kill(q) + inet_frag_destroy(q) cleanup instead of upstream's inet_frag_putn(q, 2). The fix semantics are preserved: the queue is published into the rhashtable before the timer is armed, both under q->lock.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/inet_fragment.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index 5d004c3f4e2b0..4f2118c7f3db6 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -270,16 +270,19 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, *prev = ERR_PTR(-ENOMEM); return NULL; } - mod_timer(&q->timer, jiffies + nf->timeout); + spin_lock_bh(&q->lock); *prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key, &q->node, f->rhash_params); if (*prev) { q->flags |= INET_FRAG_COMPLETE; + spin_unlock_bh(&q->lock); inet_frag_kill(q); inet_frag_destroy(q); return NULL; } + mod_timer(&q->timer, jiffies + nf->timeout); + spin_unlock_bh(&q->lock); return q; } -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] inet: frags: publish queues before arming timer
by JiangJieHua 29 Aug '26

29 Aug '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> mainline inclusion from mainline-v7.2-rc7 commit 653d7ddf6cba867777a3d14c4f83ace008c5ad13 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18205 CVE: CVE-2026-74662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference. Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Signed-off-by: Ren Wei <enjou1224z(a)gmail.com> Link: https://patch.msgid.link/bf66785e7c0c139d7a1900e2f01faeeab344b960.178494884… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inet_fragment.c [4.19 use struct netns_frags *nf (not struct fqdir *fqdir) and have no inet_frag_putn(); inet_frag_kill() takes a single argument. The conflict error path keeps the target's inet_frag_kill(q) + inet_frag_destroy(q) cleanup instead of upstream's inet_frag_putn(q, 2). The fix semantics are preserved: the queue is published into the rhashtable before the timer is armed, both under q->lock.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/inet_fragment.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index 5d004c3f4e2b0..4f2118c7f3db6 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -270,16 +270,19 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, *prev = ERR_PTR(-ENOMEM); return NULL; } - mod_timer(&q->timer, jiffies + nf->timeout); + spin_lock_bh(&q->lock); *prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key, &q->node, f->rhash_params); if (*prev) { q->flags |= INET_FRAG_COMPLETE; + spin_unlock_bh(&q->lock); inet_frag_kill(q); inet_frag_destroy(q); return NULL; } + mod_timer(&q->timer, jiffies + nf->timeout); + spin_unlock_bh(&q->lock); return q; } -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
by JiangJieHua 29 Aug '26

29 Aug '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> mainline inclusion from mainline-v7.2-rc7 commit f803c086399da277b5d0ff36a107d0f162751800 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18284 CVE: CVE-2026-74597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack. Fixes: e490d1d85cf5 ("[IPV6] IP6TUNNEL: Split out generic routine in ip6ip6_err().") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/fe1a5e765fbca88d69391887f0ed26a19e3e4d39.178573656… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 7cec56b336eee..021c62c5bdcf8 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -680,6 +680,9 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, if (!skb2) return 0; + /* Remove debris left by outer IPv6 stack. */ + memset(IP6CB(skb2), 0, sizeof(*IP6CB(skb2))); + skb_dst_drop(skb2); skb_pull(skb2, offset); skb_reset_network_header(skb2); -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
by JiangJieHua 29 Aug '26

29 Aug '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> mainline inclusion from mainline-v7.2-rc7 commit f803c086399da277b5d0ff36a107d0f162751800 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18284 CVE: CVE-2026-74597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack. Fixes: e490d1d85cf5 ("[IPV6] IP6TUNNEL: Split out generic routine in ip6ip6_err().") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/fe1a5e765fbca88d69391887f0ed26a19e3e4d39.178573656… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 7cec56b336eee..021c62c5bdcf8 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -680,6 +680,9 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, if (!skb2) return 0; + /* Remove debris left by outer IPv6 stack. */ + memset(IP6CB(skb2), 0, sizeof(*IP6CB(skb2))); + skb_dst_drop(skb2); skb_pull(skb2, offset); skb_reset_network_header(skb2); -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] inet: frags: publish queues before arming timer
by JiangJieHua 29 Aug '26

29 Aug '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> mainline inclusion from mainline-v7.2-rc7 commit 653d7ddf6cba867777a3d14c4f83ace008c5ad13 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18205 CVE: CVE-2026-74662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference. Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Signed-off-by: Ren Wei <enjou1224z(a)gmail.com> Link: https://patch.msgid.link/bf66785e7c0c139d7a1900e2f01faeeab344b960.178494884… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inet_fragment.c [4.19 use struct netns_frags *nf (not struct fqdir *fqdir) and have no inet_frag_putn(); inet_frag_kill() takes a single argument. The conflict error path keeps the target's inet_frag_kill(q) + inet_frag_destroy(q) cleanup instead of upstream's inet_frag_putn(q, 2). The fix semantics are preserved: the queue is published into the rhashtable before the timer is armed, both under q->lock.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/inet_fragment.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index 5d004c3f4e2b0..4f2118c7f3db6 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -270,16 +270,19 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, *prev = ERR_PTR(-ENOMEM); return NULL; } - mod_timer(&q->timer, jiffies + nf->timeout); + spin_lock_bh(&q->lock); *prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key, &q->node, f->rhash_params); if (*prev) { q->flags |= INET_FRAG_COMPLETE; + spin_unlock_bh(&q->lock); inet_frag_kill(q); inet_frag_destroy(q); return NULL; } + mod_timer(&q->timer, jiffies + nf->timeout); + spin_unlock_bh(&q->lock); return q; } -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] netfilter: require Ethernet MAC header before using eth_hdr()
by superdcc97＠163.com 28 Aug '26

28 Aug '26

From: Zhengchuan Liang <zcliangcn(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit 62443dc21114c0bbc476fa62973db89743f2f137 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15825 CVE: CVE-2026-53131 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`. Suggested-by: Florian Westphal <fw(a)strlen.de> Tested-by: Ren Wei <enjou1224z(a)gmail.com> Signed-off-by: Zhengchuan Liang <zcliangcn(a)gmail.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Signed-off-by: Florian Westphal <fw(a)strlen.de> Conflicts: net/netfilter/nf_log_syslog.c net/ipv4/netfilter/nf_log_arp.c net/ipv4/netfilter/nf_log_ipv4.c net/ipv6/netfilter/nf_log_ipv6.c [commit f11d61e7957d is not backport, which lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/netfilter/nf_log_arp.c | 5 ++++- net/ipv4/netfilter/nf_log_ipv4.c | 3 +++ net/ipv6/netfilter/ip6t_eui64.c | 7 +++++-- net/ipv6/netfilter/nf_log_ipv6.c | 3 +++ net/netfilter/ipset/ip_set_bitmap_ipmac.c | 5 +++-- net/netfilter/ipset/ip_set_hash_ipmac.c | 9 +++++---- net/netfilter/ipset/ip_set_hash_mac.c | 5 +++-- net/netfilter/xt_mac.c | 4 +--- 8 files changed, 27 insertions(+), 14 deletions(-) diff --git a/net/ipv4/netfilter/nf_log_arp.c b/net/ipv4/netfilter/nf_log_arp.c index 19fff2c589fa..fb10209c9a45 100644 --- a/net/ipv4/netfilter/nf_log_arp.c +++ b/net/ipv4/netfilter/nf_log_arp.c @@ -63,7 +63,10 @@ static void dump_arp_packet(struct nf_log_buf *m, else logflags = NF_LOG_DEFAULT_MASK; - if (logflags & NF_LOG_MACDECODE) { + if ((logflags & NF_LOG_MACDECODE) && + skb->dev && skb->dev->type == ARPHRD_ETHER && + skb_mac_header_was_set(skb) && + skb_mac_header_len(skb) >= ETH_HLEN) { nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); nf_log_dump_vlan(m, skb); diff --git a/net/ipv4/netfilter/nf_log_ipv4.c b/net/ipv4/netfilter/nf_log_ipv4.c index faa1ca357d0c..7cc8e5d7528c 100644 --- a/net/ipv4/netfilter/nf_log_ipv4.c +++ b/net/ipv4/netfilter/nf_log_ipv4.c @@ -287,6 +287,9 @@ static void dump_ipv4_mac_header(struct nf_log_buf *m, switch (dev->type) { case ARPHRD_ETHER: + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) + return; + nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); nf_log_dump_vlan(m, skb); diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c index cda3d43e527d..96273dcdc54c 100644 --- a/net/ipv6/netfilter/ip6t_eui64.c +++ b/net/ipv6/netfilter/ip6t_eui64.c @@ -10,6 +10,7 @@ #include <linux/module.h> #include <linux/skbuff.h> #include <linux/ipv6.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <linux/netfilter/x_tables.h> @@ -24,8 +25,10 @@ eui64_mt6(const struct sk_buff *skb, struct xt_action_param *par) { unsigned char eui64[8]; - if (!(skb_mac_header(skb) >= skb->head && - skb_mac_header(skb) + ETH_HLEN <= skb->data)) { + if (!skb->dev || skb->dev->type != ARPHRD_ETHER) + return false; + + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) { par->hotdrop = true; return false; } diff --git a/net/ipv6/netfilter/nf_log_ipv6.c b/net/ipv6/netfilter/nf_log_ipv6.c index 4edf73b5c8e5..7bd36cb23fa1 100644 --- a/net/ipv6/netfilter/nf_log_ipv6.c +++ b/net/ipv6/netfilter/nf_log_ipv6.c @@ -300,6 +300,9 @@ static void dump_ipv6_mac_header(struct nf_log_buf *m, switch (dev->type) { case ARPHRD_ETHER: + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) + return; + nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); nf_log_dump_vlan(m, skb); diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c index 9669cace4522..153f8dec9ca5 100644 --- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c +++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c @@ -15,6 +15,7 @@ #include <linux/etherdevice.h> #include <linux/skbuff.h> #include <linux/errno.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <linux/netlink.h> #include <linux/jiffies.h> @@ -224,8 +225,8 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, return -IPSET_ERR_BITMAP_RANGE; /* Backward compatibility: we don't check the second flag */ - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; e.id = ip_to_id(map, ip); diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c index f2c2f72e2fff..b7b98b129315 100644 --- a/net/netfilter/ipset/ip_set_hash_ipmac.c +++ b/net/netfilter/ipset/ip_set_hash_ipmac.c @@ -14,6 +14,7 @@ #include <linux/skbuff.h> #include <linux/errno.h> #include <linux/random.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <net/ip.h> #include <net/ipv6.h> @@ -92,8 +93,8 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb, struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } }; struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; if (opt->flags & IPSET_DIM_TWO_SRC) @@ -208,8 +209,8 @@ hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb, }; struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; if (opt->flags & IPSET_DIM_TWO_SRC) diff --git a/net/netfilter/ipset/ip_set_hash_mac.c b/net/netfilter/ipset/ip_set_hash_mac.c index 4fe5f243d0a3..ccb925f82fa7 100644 --- a/net/netfilter/ipset/ip_set_hash_mac.c +++ b/net/netfilter/ipset/ip_set_hash_mac.c @@ -12,6 +12,7 @@ #include <linux/etherdevice.h> #include <linux/skbuff.h> #include <linux/errno.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <net/netlink.h> @@ -81,8 +82,8 @@ hash_mac4_kadt(struct ip_set *set, const struct sk_buff *skb, struct hash_mac4_elem e = { { .foo[0] = 0, .foo[1] = 0 } }; struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; if (opt->flags & IPSET_DIM_ONE_SRC) diff --git a/net/netfilter/xt_mac.c b/net/netfilter/xt_mac.c index d5b4fd4f91ed..df42d0233d73 100644 --- a/net/netfilter/xt_mac.c +++ b/net/netfilter/xt_mac.c @@ -32,9 +32,7 @@ static bool mac_mt(const struct sk_buff *skb, struct xt_action_param *par) if (skb->dev == NULL || skb->dev->type != ARPHRD_ETHER) return false; - if (skb_mac_header(skb) < skb->head) - return false; - if (skb_mac_header(skb) + ETH_HLEN > skb->data) + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return false; ret = ether_addr_equal(eth_hdr(skb)->h_source, info->srcaddr); ret ^= info->invert; -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] net: LTS-6.6.90 backport
by Dong Chenchen 28 Aug '26

28 Aug '26

net: LTS-6.6.90 backport Abhishek Chauhan (1): net: Rename mono_delivery_time to tstamp_type for scalabilty Dong Chenchen (1): net: Fix kabi breakage of struct sk_buff and inet_frag_queue Pauli Virtanen (1): Bluetooth: L2CAP: copy RX timestamp to new fragments include/linux/skbuff.h | 54 +++++++++++++++++----- include/net/inet_frag.h | 4 +- net/bluetooth/l2cap_core.c | 3 ++ net/bridge/netfilter/nf_conntrack_bridge.c | 6 +-- net/core/dev.c | 2 +- net/core/filter.c | 10 ++-- net/ieee802154/6lowpan/reassembly.c | 2 +- net/ipv4/inet_fragment.c | 2 +- net/ipv4/ip_fragment.c | 2 +- net/ipv4/ip_output.c | 9 ++-- net/ipv4/tcp_output.c | 14 +++--- net/ipv6/ip6_output.c | 6 +-- net/ipv6/netfilter.c | 6 +-- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/ipv6/reassembly.c | 2 +- net/ipv6/tcp_ipv6.c | 2 +- net/sched/act_bpf.c | 4 +- net/sched/cls_bpf.c | 4 +- 18 files changed, 84 insertions(+), 50 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/6] CVE-2026-74314
by Pu Lehui 28 Aug '26

28 Aug '26

Benjamin Tissoires (1): bpf: Do not walk twice the hash map on free Hou Tao (1): bpf: Factor out htab_elem_value helper() Justin Suess (1): bpf: Cancel special fields on map value recycle Kumar Kartikeya Dwivedi (1): bpf: Register dtor for freeing special fields Mykyta Yatsenko (2): bpf: htab: extract helper for freeing special structs bpf: Extract internal structs validation logic into helpers include/linux/bpf.h | 8 + include/linux/bpf_mem_alloc.h | 6 + kernel/bpf/arraymap.c | 12 +- kernel/bpf/hashtab.c | 198 +++++++++++++----- kernel/bpf/helpers.c | 6 + kernel/bpf/memalloc.c | 58 ++++- kernel/bpf/syscall.c | 5 + .../selftests/bpf/prog_tests/linked_list.c | 33 +-- .../selftests/bpf/prog_tests/map_kptr.c | 10 +- .../testing/selftests/bpf/progs/linked_list.c | 51 +++++ 10 files changed, 292 insertions(+), 95 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6 0/7] mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier
by Jinjiang Tu 28 Aug '26

28 Aug '26

Ho-Ren (Jack) Chuang (3): memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types memory tier: create CPUless memory tiers after obtaining HMAT info memory tier: consolidate the initialization of memory tiers Jinjiang Tu (1): mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier Li Zhijian (2): acpi,mm: fix typo sibiling -> sibling mm/demotion: print demotion targets Yanfei Xu (1): memory tier: fix deadlock warning while onlining pages drivers/acpi/acpi_pad.c | 2 +- drivers/acpi/numa/hmat.c | 5 +- drivers/base/numa_remote.c | 23 +++++ drivers/dax/kmem.c | 30 +----- include/linux/memory-tiers.h | 17 +++- mm/memory-tiers.c | 180 ++++++++++++++++++++++++++--------- 6 files changed, 178 insertions(+), 79 deletions(-) -- 2.43.0

2 8

[PATCH OLK-6.6] tcp: challenge ACK for non-exact RST in SYN-RECEIVED
by JiangJieHua 28 Aug '26

28 Aug '26

From: Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> stable inclusion from stable-v6.6.153 commit 8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16927 CVE: CVE-2026-68118 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a28c4fcbf774e23b4779cae468e3497a5ad1f4a1 ] The SYN-RECEIVED request-socket path in tcp_check_req() accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request instead of eliciting a challenge ACK. RFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in SYN-RECEIVED: an exact RST resets the connection, while a non-exact in-window RST must trigger a challenge ACK and be dropped. Apply that check before the ACK-field validation, following the RFC sequence-number, RST, then ACK processing order. Factor the per-netns challenge ACK quota out of tcp_send_challenge_ack() so request sockets can share it. Use the request socket's send_ack() callback and its own out-of-window ACK timestamp to send and rate-limit the response. Reported-by: Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> Reported-by: Yizhou Zhao <zhaoyz24(a)mails.tsinghua.edu.cn> Reported-by: Ao Wang <wangao(a)seu.edu.cn> Reported-by: Xuewei Feng <fengxw06(a)126.com> Reported-by: Qi Li <qli01(a)tsinghua.edu.cn> Reported-by: Ke Xu <xuke(a)tsinghua.edu.cn> Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2") Cc: stable(a)vger.kernel.org Signed-off-by: Yuxiang Yang <yangyx22(a)mails.tsinghua.edu.cn> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260717081443.809393-2-yangyx22@mails.tsinghua.ed… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- include/net/tcp.h | 2 ++ net/ipv4/tcp_input.c | 56 ++++++++++++++++++++++++++++++---------- net/ipv4/tcp_minisocks.c | 12 ++++++++- 3 files changed, 56 insertions(+), 14 deletions(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index 8674996bd39c..a40864c5f280 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1685,6 +1685,8 @@ static inline bool tcp_paws_reject(const struct tcp_options_received *rx_opt, bool tcp_oow_rate_limited(struct net *net, const struct sk_buff *skb, int mib_idx, u32 *last_oow_ack_time); +void tcp_reqsk_send_challenge_ack(struct sock *sk, struct sk_buff *skb, + struct request_sock *req); static inline void tcp_mib_init(struct net *net) { diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index e6499904caf5..6af54c18f55c 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3744,24 +3744,17 @@ bool tcp_oow_rate_limited(struct net *net, const struct sk_buff *skb, return __tcp_oow_rate_limited(net, mib_idx, last_oow_ack_time); } -/* RFC 5961 7 [ACK Throttling] */ -static void tcp_send_challenge_ack(struct sock *sk) +/* Consume one slot from the per-netns RFC 5961 challenge ACK quota. + * Returns true if a challenge ACK may be sent. + */ +static bool tcp_challenge_ack_allowed(struct net *net) { - struct tcp_sock *tp = tcp_sk(sk); - struct net *net = sock_net(sk); u32 count, now, ack_limit; - /* First check our per-socket dupack rate limit. */ - if (__tcp_oow_rate_limited(net, - LINUX_MIB_TCPACKSKIPPEDCHALLENGE, - &tp->last_oow_ack_time)) - return; - ack_limit = READ_ONCE(net->ipv4.sysctl_tcp_challenge_ack_limit); if (ack_limit == INT_MAX) - goto send_ack; + return true; - /* Then check host-wide RFC 5961 rate limit. */ now = jiffies / HZ; if (now != READ_ONCE(net->ipv4.tcp_challenge_timestamp)) { u32 half = (ack_limit + 1) >> 1; @@ -3773,12 +3766,49 @@ static void tcp_send_challenge_ack(struct sock *sk) count = READ_ONCE(net->ipv4.tcp_challenge_count); if (count > 0) { WRITE_ONCE(net->ipv4.tcp_challenge_count, count - 1); -send_ack: + return true; + } + return false; +} + +/* RFC 5961 7 [ACK Throttling] */ +static void tcp_send_challenge_ack(struct sock *sk) +{ + struct tcp_sock *tp = tcp_sk(sk); + struct net *net = sock_net(sk); + + /* First check our per-socket dupack rate limit. */ + if (__tcp_oow_rate_limited(net, + LINUX_MIB_TCPACKSKIPPEDCHALLENGE, + &tp->last_oow_ack_time)) + return; + + /* Then check the per-netns RFC 5961 rate limit. */ + if (tcp_challenge_ack_allowed(net)) { NET_INC_STATS(net, LINUX_MIB_TCPCHALLENGEACK); tcp_send_ack(sk); } } +/* Send a challenge ACK from a SYN-RECEIVED request socket. Uses + * __tcp_oow_rate_limited() directly so that an RST carrying payload + * cannot bypass the per-request rate limit. + */ +void tcp_reqsk_send_challenge_ack(struct sock *sk, struct sk_buff *skb, + struct request_sock *req) +{ + struct net *net = sock_net(sk); + + if (__tcp_oow_rate_limited(net, LINUX_MIB_TCPACKSKIPPEDCHALLENGE, + &tcp_rsk(req)->last_oow_ack_time)) + return; + + if (tcp_challenge_ack_allowed(net)) { + NET_INC_STATS(net, LINUX_MIB_TCPCHALLENGEACK); + req->rsk_ops->send_ack(sk, skb, req); + } +} + static void tcp_store_ts_recent(struct tcp_sock *tp) { tp->rx_opt.ts_recent = tp->rx_opt.rcv_tsval; diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index 8099563937e3..6138f546e90d 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -763,7 +763,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, * elsewhere and is checked directly against the child socket rather * than req because user data may have been sent out. */ - if ((flg & TCP_FLAG_ACK) && !fastopen && + if ((flg & TCP_FLAG_ACK) && !(flg & TCP_FLAG_RST) && !fastopen && (TCP_SKB_CB(skb)->ack_seq != tcp_rsk(req)->snt_isn + 1)) return sk; @@ -802,6 +802,16 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, flg &= ~TCP_FLAG_SYN; } + /* RFC 5961 section 3.2, as clarified by RFC 9293 section + * 3.10.7.4, requires a challenge ACK for a non-exact + * in-window RST in SYN-RECEIVED. + */ + if ((flg & TCP_FLAG_RST) && + TCP_SKB_CB(skb)->seq != tcp_rsk(req)->rcv_nxt) { + tcp_reqsk_send_challenge_ack(sk, skb, req); + return NULL; + } + /* RFC793: "second check the RST bit" and * "fourth, check the SYN bit" */ -- 2.33.8

2 1

[PATCH OLK-6.6] nvmet-tcp: fix page fragment cache leak in error path
by Lai Zewei 28 Aug '26

28 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 4dae393956093c807212918fd91a8fc70df15338 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17264 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In nvmet_tcp_alloc_queue(), when a connection is closed during the allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN), the error handling jumps to out_destroy_sq and then to out_ida_remove without draining the page fragment cache. Although nvmet_tcp_free_cmd() is called in some error paths to release individual page fragments, the underlying page cache reference held by queue->pf_cache is never released. The first allocation using pf_cache is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens after ida_alloc() returns successfully. This results in a page leak each time a connection fails during allocation, which could lead to memory exhaustion over time if connections are repeatedly opened and closed. Fix this by calling page_frag_cache_drain() before freeing the queue structure in the out_ida_remove label. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Geliang Tang <tanggeliang(a)kylinos.cn> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/target/tcp.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- drivers/nvme/target/tcp.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 6c6197a53fa3..fb6af1be694f 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -1754,6 +1754,14 @@ static int nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port, nvmet_tcp_free_cmd(&queue->connect); out_ida_remove: ida_free(&nvmet_tcp_queue_ida, queue->idx); + /* + * Drain the page fragment cache if any allocations were done. + * The first allocation using pf_cache is nvmet_tcp_alloc_cmd() + * for queue->connect after ida_alloc(). + */ + if (queue->pf_cache.va) + __page_frag_cache_drain(virt_to_head_page(queue->pf_cache.va), + queue->pf_cache.pagecnt_bias); out_free_queue: kfree(queue); return ret; -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS] RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
by Chen Jinghuang 28 Aug '26

28 Aug '26

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v7.2-rc1 commit 449ae7927152e46acbe5f19f97eafdae6d3a96b1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18162 CVE: CVE-2026-74296 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Free the UAR index returned by the hardware. Fixes: 4ed131d0bb15 ("IB/mlx5: Expose dynamic mmap allocation") Link: https://patch.msgid.link/r/20260611-fix-uar-release-v1-1-f5464d845dbf@nvidi… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/hw/mlx5/main.c [ Context conflict ] Signed-off-by: Chen jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index 4f340d6db582..051de9f3ed82 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -2148,7 +2148,7 @@ static int uar_mmap(struct mlx5_ib_dev *dev, enum mlx5_ib_mmap_cmd cmd, if (!dyn_uar) return err; - mlx5_cmd_free_uar(dev->mdev, idx); + mlx5_cmd_free_uar(dev->mdev, uar_index); free_bfreg: mlx5_ib_free_bfreg(dev, bfregi, bfreg_dyn_idx); -- 2.34.1

2 1

[PATCH OLK-5.10] iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
by Zhang Yuwei 28 Aug '26

28 Aug '26

From: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> stable inclusion from stable-v6.6.148 commit ab7faf5a172ebfdc423ebb3eea4d472740de82f9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18421 CVE: CVE-2026-68329 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1e75a8255f11c81fb07e81e5029cfd75804350a0 ] need_sync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. It is set whenever a command is queued with sync == true and cleared when a completion-wait (CWAIT) command is queued. However, a cleared need_sync only means that a covering CWAIT has been queued, not that all previously queued commands have actually completed in hardware. iommu_completion_wait() read need_sync locklessly and returned early when it was false. This breaks the "block until all previously queued commands have completed" contract in a multi-CPU scenario: CPU2: queue inv-B => need_sync = true CPU1: queue CWAIT(N); need_sync = false; then wait_on_sem(N) CPU2: read need_sync == false => return 0 (no wait!) CPU2 returns without waiting for any sequence number even though its inv-B may not have completed yet (CWAIT(N), queued after inv-B, has not been signaled). CPU2 then proceeds to, for example, free page-table pages while the IOMMU can still walk stale translations, opening a use-after-free window. This is a logical race in the meaning of the flag, not a memory-visibility issue, so barriers alone do not help. Fix it without losing the optimization of avoiding redundant CWAIT commands: take iommu->lock before testing need_sync, and when it is false do not return early but wait for the last allocated sequence number (cmd_sem_val). Since need_sync == false implies no sync command was queued after the last CWAIT, that CWAIT is FIFO-ordered after every not-yet-completed command, so waiting for its sequence number guarantees all prior commands (possibly queued by another CPU) have completed. The common path with pending work is unchanged and no extra hardware command is issued. Signed-off-by: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> Fixes: 815b33fdc279 ("x86/amd-iommu: Cleanup completion-wait handling") Reviewed-by: Vasant Hegde <vasant.hegde(a)amd.com> Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Conflicts: drivers/iommu/amd/iommu.c [context conflict] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/amd/iommu.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index ba17dd2b8e6f..4a8dc1326006 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -1140,11 +1140,23 @@ static int iommu_completion_wait(struct amd_iommu *iommu) int ret; u64 data; - if (!iommu->need_sync) - return 0; - raw_spin_lock_irqsave(&iommu->lock, flags); + if (!iommu->need_sync) { + /* + * No command has been queued since the last completion-wait. + * A concurrent CPU may have already queued that CWAIT and + * cleared need_sync; need_sync == false only means a covering + * CWAIT is queued, not that all prior commands have completed. + * Wait for the last allocated sequence number so that any + * command queued before this call (possibly on another CPU) + * is guaranteed to have completed before returning. + */ + data = iommu->cmd_sem_val; + raw_spin_unlock_irqrestore(&iommu->lock, flags); + return wait_on_sem(iommu, data); + } + data = ++iommu->cmd_sem_val; build_completion_wait(&cmd, iommu, data); @@ -1154,9 +1166,7 @@ static int iommu_completion_wait(struct amd_iommu *iommu) if (ret) return ret; - ret = wait_on_sem(iommu, data); - - return ret; + return wait_on_sem(iommu, data); } static int iommu_flush_dte(struct amd_iommu *iommu, u16 devid) -- 2.22.0

2 1

[PATCH OLK-5.10] ceph: fix hanging __ceph_get_caps() with stale mds_wanted
by Tengda Wu 28 Aug '26

28 Aug '26

From: Max Kellermann <max.kellermann(a)ionos.com> stable inclusion from stable-v5.10.266 commit b5661524c5a45085a866864ca9b8ae2513dfd67a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18404 CVE: CVE-2026-80527 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 50958bb928bad3bdba9e5d1b7ff4bbadcf6951e6 ] A reader can hang forever in __ceph_get_caps() when the client no longer holds `FILE_RD`, but local cap state still says that the capability is already wanted (via `mds_wanted`). One way to trigger this is through MDS cap revocation. If another client performs a conflicting operation, the MDS can revoke `FILE_RD` from the reader; the next read then has to reacquire `FILE_RD`. If the cap update that should request `FILE_RD` never reaches the MDS after `cap->mds_wanted` was raised, the reader is left holding only non-file caps while local `mds_wanted` still includes the file read caps. In that state, try_get_cap_refs() sees `need <= mds_wanted` and returns 0, so __ceph_get_caps() just waits on `i_cap_wq`. If the cap update that was supposed to request `FILE_RD never reaches the MDS after `cap->mds_wanted was` raised, no further request is sent and the waiter can sleep indefinitely until unrelated cap traffic happens to wake it up. The ordering issue is that `cap->mds_wanted` is updated in __prep_cap() before the `CEPH_MSG_CLIENT_CAPS message` is actually queued for send. That makes one field serve two different meanings at once: what this client wants, and what the client believes the MDS already knows it wants. A proper fix would be to split those states and track whether a cap update is actually in flight or has been observed by the MDS. However, simply moving the `cap->mds_wanted assignment` later would not be sufficient: queueing the message in the messenger does not guarantee that the MDS processed that specific wanted set, and reconnect or message loss can still invalidate that assumption. Fixing that properly would require a larger rework of the cap state machine. To allow simpler backports to stable kernels, this patch implements a simpler workaround: - stop waiting forever in __ceph_get_caps(); after a bounded wait, fall back to the renew path - make ceph_renew_caps() issue a synchronous `OPEN` request whenever the inode still does not actually hold the wanted caps, instead of only calling ceph_check_caps() The extra issued-vs-wanted check in ceph_renew_caps() is necessary because the previous test only checked whether the inode still had any real caps at all. That is not enough after revocation: the client can still hold something like `pLs` and yet be missing `FILE_RD` completely. In that case, falling back to ceph_check_caps() is not sufficient, because it still trusts `cap->mds_wanted` and may resend nothing. By requiring `(issued & wanted) == wanted` before taking the asynchronous path, the code only uses ceph_check_caps() when the `wanted caps` are already actually issued. Otherwise, it sends the synchronous `OPEN` renew. This preserves the existing asynchronous fast path when the wanted caps are already issued, avoids changing cap-state semantics, and fixes the hang by guaranteeing that a stalled waiter eventually retries through a path that does not rely on the stale `mds_wanted` state. [ idryomov: move CEPH_GET_CAPS_WAIT_TIMEOUT from libceph.h to mds_client.h, formatting ] Cc: stable(a)vger.kernel.org Fixes: 0a454bdd501a ("ceph: reorganize __send_cap for less spinlock abuse") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Alex Markuze <amarkuze(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/ceph/caps.c | 17 +++++++++++++++-- fs/ceph/file.c | 9 +++++---- fs/ceph/mds_client.h | 2 ++ 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 31e5d87ec945..9bebdafd5ec9 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2995,7 +2995,19 @@ int ceph_get_caps(struct file *filp, int need, int want, ret = -ERESTARTSYS; break; } - wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); + + /* + * If a cap update is lost after + * mds_wanted was raised, waiting + * forever will never make progress. + * Retry the renew path periodically + * so we can resend synchronously. + */ + if (!wait_woken(&wait, TASK_INTERRUPTIBLE, + CEPH_GET_CAPS_WAIT_TIMEOUT)) { + ret = -ESTALE; + break; + } } remove_wait_queue(&ci->i_cap_wq, &wait); @@ -3027,7 +3039,8 @@ int ceph_get_caps(struct file *filp, int need, int want, continue; } if (ret == -ESTALE) { - /* session was killed, try renew caps */ + /* session was killed or a waited cap + * request needs a retry */ ret = ceph_renew_caps(inode, flags); if (ret == 0) continue; diff --git a/fs/ceph/file.c b/fs/ceph/file.c index 215bd9a3c535..f20d5f708009 100644 --- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -277,21 +277,22 @@ static int ceph_init_file(struct inode *inode, struct file *file, int fmode) } /* - * try renew caps after session gets killed. + * Retry cap acquisition after a stale session or a lost cap update. */ int ceph_renew_caps(struct inode *inode, int fmode) { struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(inode->i_sb); struct ceph_inode_info *ci = ceph_inode(inode); struct ceph_mds_request *req; - int err, flags, wanted; + int err, flags, wanted, issued; spin_lock(&ci->i_ceph_lock); __ceph_touch_fmode(ci, mdsc, fmode); wanted = __ceph_caps_file_wanted(ci); + issued = __ceph_caps_issued(ci, NULL); if (__ceph_is_any_real_caps(ci) && - (!(wanted & CEPH_CAP_ANY_WR) || ci->i_auth_cap)) { - int issued = __ceph_caps_issued(ci, NULL); + (!(wanted & CEPH_CAP_ANY_WR) || ci->i_auth_cap) && + (issued & wanted) == wanted) { spin_unlock(&ci->i_ceph_lock); dout("renew caps %p want %s issued %s updating mds_wanted\n", inode, ceph_cap_string(wanted), ceph_cap_string(issued)); diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h index 1c958510f00f..b1939f916228 100644 --- a/fs/ceph/mds_client.h +++ b/fs/ceph/mds_client.h @@ -61,6 +61,8 @@ enum ceph_feature_type { struct ceph_fs_client; struct ceph_cap; +#define CEPH_GET_CAPS_WAIT_TIMEOUT (5 * HZ) + /* * parsed info about a single inode. pointers are into the encoded * on-wire structures within the mds reply message payload. -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] CVE-2026-74314
by Pu Lehui 28 Aug '26

28 Aug '26

Benjamin Tissoires (1): bpf: Do not walk twice the hash map on free Hou Tao (1): bpf: Factor out htab_elem_value helper() Justin Suess (1): bpf: Cancel special fields on map value recycle Mykyta Yatsenko (2): bpf: htab: extract helper for freeing special structs bpf: Extract internal structs validation logic into helpers include/linux/bpf.h | 8 ++ kernel/bpf/arraymap.c | 12 +- kernel/bpf/hashtab.c | 111 +++++++++--------- kernel/bpf/helpers.c | 6 + kernel/bpf/syscall.c | 5 + .../selftests/bpf/prog_tests/linked_list.c | 33 +++--- .../selftests/bpf/prog_tests/map_kptr.c | 10 +- .../testing/selftests/bpf/progs/linked_list.c | 51 ++++++++ 8 files changed, 152 insertions(+), 84 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10] iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
by Zhang Yuwei 28 Aug '26

28 Aug '26

From: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> stable inclusion from stable-v6.6.148 commit ab7faf5a172ebfdc423ebb3eea4d472740de82f9 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1e75a8255f11c81fb07e81e5029cfd75804350a0 ] need_sync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. It is set whenever a command is queued with sync == true and cleared when a completion-wait (CWAIT) command is queued. However, a cleared need_sync only means that a covering CWAIT has been queued, not that all previously queued commands have actually completed in hardware. iommu_completion_wait() read need_sync locklessly and returned early when it was false. This breaks the "block until all previously queued commands have completed" contract in a multi-CPU scenario: CPU2: queue inv-B => need_sync = true CPU1: queue CWAIT(N); need_sync = false; then wait_on_sem(N) CPU2: read need_sync == false => return 0 (no wait!) CPU2 returns without waiting for any sequence number even though its inv-B may not have completed yet (CWAIT(N), queued after inv-B, has not been signaled). CPU2 then proceeds to, for example, free page-table pages while the IOMMU can still walk stale translations, opening a use-after-free window. This is a logical race in the meaning of the flag, not a memory-visibility issue, so barriers alone do not help. Fix it without losing the optimization of avoiding redundant CWAIT commands: take iommu->lock before testing need_sync, and when it is false do not return early but wait for the last allocated sequence number (cmd_sem_val). Since need_sync == false implies no sync command was queued after the last CWAIT, that CWAIT is FIFO-ordered after every not-yet-completed command, so waiting for its sequence number guarantees all prior commands (possibly queued by another CPU) have completed. The common path with pending work is unchanged and no extra hardware command is issued. Signed-off-by: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> Fixes: 815b33fdc279 ("x86/amd-iommu: Cleanup completion-wait handling") Reviewed-by: Vasant Hegde <vasant.hegde(a)amd.com> Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Conflicts: drivers/iommu/amd/iommu.c [context conflict] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/amd/iommu.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index ba17dd2b8e6f..4a8dc1326006 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -1140,11 +1140,23 @@ static int iommu_completion_wait(struct amd_iommu *iommu) int ret; u64 data; - if (!iommu->need_sync) - return 0; - raw_spin_lock_irqsave(&iommu->lock, flags); + if (!iommu->need_sync) { + /* + * No command has been queued since the last completion-wait. + * A concurrent CPU may have already queued that CWAIT and + * cleared need_sync; need_sync == false only means a covering + * CWAIT is queued, not that all prior commands have completed. + * Wait for the last allocated sequence number so that any + * command queued before this call (possibly on another CPU) + * is guaranteed to have completed before returning. + */ + data = iommu->cmd_sem_val; + raw_spin_unlock_irqrestore(&iommu->lock, flags); + return wait_on_sem(iommu, data); + } + data = ++iommu->cmd_sem_val; build_completion_wait(&cmd, iommu, data); @@ -1154,9 +1166,7 @@ static int iommu_completion_wait(struct amd_iommu *iommu) if (ret) return ret; - ret = wait_on_sem(iommu, data); - - return ret; + return wait_on_sem(iommu, data); } static int iommu_flush_dte(struct amd_iommu *iommu, u16 devid) -- 2.22.0

2 1

[PATCH OLK-5.10] watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
by Lin Ruifeng 28 Aug '26

28 Aug '26

From: Tzung-Bi Shih <tzungbi(a)kernel.org> stable inclusion from stable-v6.6.148 commit 2e47b91b9b4020fcc01def14d6b6556d66074cf4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17075 CVE: CVE-2026-68357 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7362ba0f9c96ac3ad6a2ca3995bd9fc9a28a8661 ] When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to `default_gov`. If the governor being unregistered is currently set as `default_gov`, the `default_gov` is never cleared. This leads to 2 use-after-free issues: 1. New watchdog devices registered after this point will inherit the dangling `default_gov`. 2. Existing watchdog devices using the unregistered governor will have their `wdd->gov` reassigned to the dangling `default_gov`. Fix the UAF by clearing `default_gov` if it matches the governor being unregistered. Fixes: da0d12ff2b82 ("watchdog: pretimeout: add panic pretimeout governor") Signed-off-by: Tzung-Bi Shih <tzungbi(a)kernel.org> Link: https://lore.kernel.org/r/20260707101803.3598173-1-tzungbi@kernel.org Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/watchdog/watchdog_pretimeout.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/watchdog/watchdog_pretimeout.c b/drivers/watchdog/watchdog_pretimeout.c index 01ca84be240f..fe4c8ace9a42 100644 --- a/drivers/watchdog/watchdog_pretimeout.c +++ b/drivers/watchdog/watchdog_pretimeout.c @@ -164,6 +164,8 @@ void watchdog_unregister_governor(struct watchdog_governor *gov) } spin_lock_irq(&pretimeout_lock); + if (default_gov == gov) + default_gov = NULL; list_for_each_entry(p, &pretimeout_list, entry) if (p->wdd->gov == gov) p->wdd->gov = default_gov; -- 2.34.1

2 1

[PATCH OLK-6.6] RDMA/nldev: Fix locking when accessing mr->pd
by Chen Jinghuang 27 Aug '26

27 Aug '26

From: Jason Gunthorpe <jgg(a)nvidia.com> mainline inclusion from mainline-v7.2-rc1 commit 50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17658 CVE: CVE-2026-74334 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Sashiko points out that, due to rereg_mr, the PD is actually variable and all the touches in nldev are racy. Use mr->device instead of mr->pd->device. Getting the PD restrack ID is more tricky. To avoid disturbing all the happy paths, add an rdma_restrack_sync() operation which is sort of like flush_workqueue() or synchronize_irq(): after it returns, all the old nldev touches to the mr are gone and everything sees the new PD. This makes it safe to reach into the PD pointer. Fixes: da5c85078215 ("RDMA/nldev: add driver-specific resource tracking") Link: https://patch.msgid.link/r/4-v1-29ebd2c229b5+fd5-ib_mr_pd_jgg@nvidia.com Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/core/restrack.c drivers/infiniband/core/uverbs_cmd.c include/rdma/ib_verbs.h [In restrack.c, rdma_restrack_count() in target tree lacks show_details parameter and RESTRACK_DD mark logic; only added xa_is_zero() check required by rdma_restrack_sync(). Removed RESTRACK_DD xa_get_mark() check in rdma_restrack_sync() as target tree does not have driver-specific resource tracking (RESTRACK_DD mark). In uverbs_cmd.c, kept downstream #include "uverbs_profile.h" alongside new #include "restrack.h".] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/core/nldev.c | 15 ++++---- drivers/infiniband/core/restrack.c | 52 +++++++++++++++++++++++++++- drivers/infiniband/core/restrack.h | 1 + drivers/infiniband/core/uverbs_cmd.c | 10 ++++-- include/rdma/ib_verbs.h | 5 +++ 5 files changed, 74 insertions(+), 9 deletions(-) diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c index 9d6627bde61a..6c4008a1e18f 100644 --- a/drivers/infiniband/core/nldev.c +++ b/drivers/infiniband/core/nldev.c @@ -644,7 +644,7 @@ static int fill_res_mr_entry(struct sk_buff *msg, bool has_cap_net_admin, struct rdma_restrack_entry *res, uint32_t port) { struct ib_mr *mr = container_of(res, struct ib_mr, res); - struct ib_device *dev = mr->pd->device; + struct ib_device *dev = mr->device; if (has_cap_net_admin) { if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_RKEY, mr->rkey)) @@ -660,9 +660,12 @@ static int fill_res_mr_entry(struct sk_buff *msg, bool has_cap_net_admin, if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_MRN, res->id)) return -EMSGSIZE; - if (!rdma_is_kernel_res(res) && - nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_PDN, mr->pd->res.id)) - return -EMSGSIZE; + if (!rdma_is_kernel_res(res)) { + struct ib_pd *pd = READ_ONCE(mr->pd); + + if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_PDN, pd->res.id)) + return -EMSGSIZE; + } if (fill_res_name_pid(msg, res)) return -EMSGSIZE; @@ -676,7 +679,7 @@ static int fill_res_mr_raw_entry(struct sk_buff *msg, bool has_cap_net_admin, struct rdma_restrack_entry *res, uint32_t port) { struct ib_mr *mr = container_of(res, struct ib_mr, res); - struct ib_device *dev = mr->pd->device; + struct ib_device *dev = mr->device; if (!dev->ops.fill_res_mr_entry_raw) return -EINVAL; @@ -966,7 +969,7 @@ static int fill_stat_mr_entry(struct sk_buff *msg, bool has_cap_net_admin, struct rdma_restrack_entry *res, uint32_t port) { struct ib_mr *mr = container_of(res, struct ib_mr, res); - struct ib_device *dev = mr->pd->device; + struct ib_device *dev = mr->device; if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_MRN, res->id)) goto err; diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c index 438ed3588175..19a813e75486 100644 --- a/drivers/infiniband/core/restrack.c +++ b/drivers/infiniband/core/restrack.c @@ -68,8 +68,11 @@ int rdma_restrack_count(struct ib_device *dev, enum rdma_restrack_type type) u32 cnt = 0; xa_lock(&rt->xa); - xas_for_each(&xas, e, U32_MAX) + xas_for_each(&xas, e, U32_MAX) { + if (xa_is_zero(e)) + continue; cnt++; + } xa_unlock(&rt->xa); return cnt; } @@ -266,6 +269,53 @@ int rdma_restrack_put(struct rdma_restrack_entry *res) } EXPORT_SYMBOL(rdma_restrack_put); +/** + * rdma_restrack_sync() - Fence concurrent netlink dumps on an entry + * @res: resource entry + * + * After this returns any concurrent netlink dump threads will see the current + * value of the object. This is useful if the object has to be changed and there + * is not locking to protect the nl side. Eg for mr->pd. This effectively + * destroys the object from a kref/xarray perspective and then immediately + * restores it. The kref is acting like a lock to barrier concurrent nl threads. + * Callers must ensure rdma_restrack_del() is not concurrently called. + */ +void rdma_restrack_sync(struct rdma_restrack_entry *res) +{ + struct rdma_restrack_entry *old; + struct rdma_restrack_root *rt; + struct task_struct *task; + struct ib_device *dev; + + if (!res->valid || res->no_track) + return; + + dev = res_to_dev(res); + if (WARN_ON(!dev)) + return; + + rt = &dev->res[res->type]; + if (WARN_ON(xa_get_mark(&rt->xa, res->id, RESTRACK_DD))) + return; + + old = xa_cmpxchg(&rt->xa, res->id, res, XA_ZERO_ENTRY, GFP_KERNEL); + if (WARN_ON(old != res)) + return; + + task = res->task; + if (task) + get_task_struct(task); + rdma_restrack_put(res); + wait_for_completion(&res->comp); + reinit_completion(&res->comp); + if (task) + res->task = task; + kref_init(&res->kref); + + xa_cmpxchg(&rt->xa, res->id, XA_ZERO_ENTRY, res, GFP_KERNEL); +} +EXPORT_SYMBOL(rdma_restrack_sync); + /** * rdma_restrack_del() - delete object from the reource tracking database * @res: resource entry diff --git a/drivers/infiniband/core/restrack.h b/drivers/infiniband/core/restrack.h index 6a04fc41f738..75b8d1005a98 100644 --- a/drivers/infiniband/core/restrack.h +++ b/drivers/infiniband/core/restrack.h @@ -27,6 +27,7 @@ int rdma_restrack_init(struct ib_device *dev); void rdma_restrack_clean(struct ib_device *dev); void rdma_restrack_add(struct rdma_restrack_entry *res); void rdma_restrack_del(struct rdma_restrack_entry *res); +void rdma_restrack_sync(struct rdma_restrack_entry *res); void rdma_restrack_new(struct rdma_restrack_entry *res, enum rdma_restrack_type type); void rdma_restrack_set_name(struct rdma_restrack_entry *res, diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c index 2e4265ba35b7..f442cca3c05c 100644 --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -46,6 +46,7 @@ #include "uverbs.h" #include "core_priv.h" +#include "restrack.h" /* * Copy a response to userspace. If the provided 'resp' is larger than the @@ -813,6 +814,10 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) ret = PTR_ERR(new_pd); goto put_uobjs; } + if (new_pd == orig_pd) { + uobj_put_obj_read(new_pd); + cmd.flags &= ~IB_MR_REREG_PD; + } } else { new_pd = mr->pd; } @@ -858,9 +863,10 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) mr = new_mr; } else { if (cmd.flags & IB_MR_REREG_PD) { - atomic_dec(&orig_pd->usecnt); - mr->pd = new_pd; atomic_inc(&new_pd->usecnt); + WRITE_ONCE(mr->pd, new_pd); + rdma_restrack_sync(&mr->res); + atomic_dec(&orig_pd->usecnt); } if (cmd.flags & IB_MR_REREG_TRANS) { mr->iova = cmd.hca_va; diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index 3eea95e51928..05b101693cd5 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -1833,6 +1833,11 @@ struct ib_dm { struct ib_mr { struct ib_device *device; + /* + * Due to IB_MR_REREG_PD pd is not a fixed pointer and can change. For a + * user MR, this value should only be read from a system call that holds + * the uobject lock, or the driver should disable in-place REREG_PD. + */ struct ib_pd *pd; u32 lkey; u32 rkey; -- 2.34.1

2 1

[PTACH openEuler-1.0-LTS] RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
by Chen Jinghuang 27 Aug '26

27 Aug '26

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v7.2-rc1 commit 449ae7927152e46acbe5f19f97eafdae6d3a96b1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18162 CVE: CVE-2026-74296 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Free the UAR index returned by the hardware. Fixes: 4ed131d0bb15 ("IB/mlx5: Expose dynamic mmap allocation") Link: https://patch.msgid.link/r/20260611-fix-uar-release-v1-1-f5464d845dbf@nvidi… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/hw/mlx5/main.c [ Context conflict ] Signed-off-by: Chen jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index 4f340d6db582..051de9f3ed82 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -2148,7 +2148,7 @@ static int uar_mmap(struct mlx5_ib_dev *dev, enum mlx5_ib_mmap_cmd cmd, if (!dyn_uar) return err; - mlx5_cmd_free_uar(dev->mdev, idx); + mlx5_cmd_free_uar(dev->mdev, uar_index); free_bfreg: mlx5_ib_free_bfreg(dev, bfregi, bfreg_dyn_idx); -- 2.34.1

1 0

[PATCH OLK-6.6] ceph: avoid fs reclaim while using current->journal_info
by Pu Lehui 27 Aug '26

27 Aug '26

From: Max Kellermann <max.kellermann(a)ionos.com> stable inclusion from stable-v6.6.153 commit c8a21660c3b90864c391164eea5622e7b5b2897c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18341 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5b602344a49e039e792ce5a8923bcc61412ee134 ] handle_reply() stores a `ceph_mds_request` pointer in `current->journal_info` while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. JBD2 interprets the Ceph request in `current->journal_info` as a journal handle and dereferences the request's `r_tid` as `h_transaction`, causing a kernel crash, e.g.: Unable to handle kernel paging request at virtual address 00000000077b4818 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G W 6.18.38-i3 #1113 NONE [...] Workqueue: ceph-msgr ceph_con_workfn pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : jbd2__journal_start+0x2c/0x208 lr : __ext4_journal_start_sb+0x100/0x178 [...] Call trace: jbd2__journal_start+0x2c/0x208 (P) __ext4_journal_start_sb+0x100/0x178 ext4_dirty_inode+0x3c/0x90 __mark_inode_dirty+0x58/0x400 iput.part.0+0x2b0/0x370 iput+0x18/0x30 dentry_unlink_inode+0xc0/0x158 __dentry_kill+0x80/0x250 shrink_dentry_list+0x90/0x130 prune_dcache_sb+0x60/0x98 super_cache_scan+0xe8/0x190 do_shrink_slab+0x174/0x388 shrink_slab+0xd8/0x4c0 shrink_node+0x31c/0x908 do_try_to_free_pages+0xd0/0x508 try_to_free_pages+0x11c/0x238 __alloc_frozen_pages_noprof+0x4d0/0xdd0 __folio_alloc_noprof+0x18/0x70 __filemap_get_folio+0x248/0x440 ceph_readdir_prepopulate+0x570/0x9e8 mds_dispatch+0x1424/0x1ba0 ceph_con_process_message+0x74/0xa0 ceph_con_v1_try_read+0x3a0/0x1510 ceph_con_workfn+0x260/0x460 Enter a scoped NOFS allocation context and leave it after clearing `journal_info`. This prevents filesystem reclaim from recursing into another filesystem while the field contains Ceph-private data. Cc: stable(a)vger.kernel.org Fixes: 315f24088048 ("ceph: fix security xattr deadlock") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Reviewed-by: Xiubo Li <xiubo.li(a)clyso.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/ceph/mds_client.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 47ddad3606da..00b9f9f3f4d7 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -6,6 +6,7 @@ #include <linux/slab.h> #include <linux/gfp.h> #include <linux/sched.h> +#include <linux/sched/mm.h> #include <linux/debugfs.h> #include <linux/seq_file.h> #include <linux/ratelimit.h> @@ -3676,6 +3677,7 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) struct ceph_mds_reply_head *head = msg->front.iov_base; struct ceph_mds_reply_info_parsed *rinfo; /* parsed reply info */ struct ceph_snap_realm *realm; + unsigned int nofs_flags; u64 tid; int err, result; int mds = session->s_mds; @@ -3817,6 +3819,14 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) /* insert trace into our cache */ mutex_lock(&req->r_fill_mutex); + + /* disable fs reclaim while we are using current->journal_info + * for our own purposes, or else shrinkers of other + * filesystems might dereference this pointer as a different + * type + */ + nofs_flags = memalloc_nofs_save(); + current->journal_info = req; err = ceph_fill_trace(mdsc->fsc->sb, req); if (err == 0) { @@ -3825,6 +3835,7 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) err = ceph_readdir_prepopulate(req, req->r_session); } current->journal_info = NULL; + memalloc_nofs_restore(nofs_flags); mutex_unlock(&req->r_fill_mutex); up_read(&mdsc->snap_rwsem); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] bpf: Preserve pointer state for commuted arithmetic
by Pu Lehui 27 Aug '26

27 Aug '26

From: Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> mainline inclusion from mainline-v7.2-rc7 commit a4c6f804b44c5c790269b25e0e61cf4e9f117c86 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17686 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent. Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)") Signed-off-by: Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> Tested-by: Daniel Wade <danjwade95(a)gmail.com> Acked-by: Shung-Hsi Yu <shung-hsi.yu(a)suse.com> Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-2-8ee297e2346b@ma… Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Conflicts: kernel/bpf/verifier.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index e00cb52fb480..71cc52cfaf31 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3124,11 +3124,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, return -EACCES; } - /* In case of 'scalar += pointer', dst_reg inherits pointer type and id. - * The id may be overwritten later if we create a new variable offset. + /* For 'scalar += pointer', dst_reg inherits the complete pointer + * register state. Individual fields may be adjusted later by pointer + * arithmetic. Callers guarantee that below does not overwrite off_reg. */ - dst_reg->type = ptr_reg->type; - dst_reg->id = ptr_reg->id; + if (dst_reg != ptr_reg) + *dst_reg = *ptr_reg; if (!check_reg_sane_offset(env, off_reg, ptr_reg->type) || !check_reg_sane_offset(env, ptr_reg, ptr_reg->type)) @@ -3193,7 +3194,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, } break; case BPF_SUB: - if (dst_reg == off_reg) { + if (dst_reg != ptr_reg) { /* scalar -= pointer. Creates an unknown scalar */ verbose(env, "R%d tried to subtract pointer from scalar\n", dst); @@ -3598,8 +3599,8 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env, * This is legal, but we have to reverse our * src/dest handling in computing the range */ - return adjust_ptr_min_max_vals(env, insn, - src_reg, dst_reg); + off_reg = *dst_reg; + return adjust_ptr_min_max_vals(env, insn, src_reg, &off_reg); } } else if (ptr_reg) { /* pointer += scalar */ -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Preserve pointer state for commuted arithmetic
by Pu Lehui 27 Aug '26

27 Aug '26

From: Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> stable inclusion from stable-v6.6.152 commit 86b203aadc2930e0a4f9c6277b5b80ff3664c472 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18233 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a4c6f804b44c5c790269b25e0e61cf4e9f117c86 ] When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent. Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)") Signed-off-by: Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> Tested-by: Daniel Wade <danjwade95(a)gmail.com> Acked-by: Shung-Hsi Yu <shung-hsi.yu(a)suse.com> Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-2-8ee297e2346b@ma… Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 3de3edcb0344..ee8c00981cea 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -12905,11 +12905,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, break; } - /* In case of 'scalar += pointer', dst_reg inherits pointer type and id. - * The id may be overwritten later if we create a new variable offset. + /* For 'scalar += pointer', dst_reg inherits the complete pointer + * register state. Individual fields may be adjusted later by pointer + * arithmetic. Callers guarantee that below does not overwrite off_reg. */ - dst_reg->type = ptr_reg->type; - dst_reg->id = ptr_reg->id; + if (dst_reg != ptr_reg) + *dst_reg = *ptr_reg; if (!check_reg_sane_offset(env, off_reg, ptr_reg->type) || !check_reg_sane_offset(env, ptr_reg, ptr_reg->type)) @@ -12989,7 +12990,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, } break; case BPF_SUB: - if (dst_reg == off_reg) { + if (dst_reg != ptr_reg) { /* scalar -= pointer. Creates an unknown scalar */ verbose(env, "R%d tried to subtract pointer from scalar\n", dst); @@ -13863,8 +13864,8 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env, err = mark_chain_precision(env, insn->dst_reg); if (err) return err; - return adjust_ptr_min_max_vals(env, insn, - src_reg, dst_reg); + off_reg = *dst_reg; + return adjust_ptr_min_max_vals(env, insn, src_reg, &off_reg); } } else if (ptr_reg) { /* pointer += scalar */ -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] crypto: authencesn - fix spawn leak in digestsize check error path
by Gaosheng Cui 27 Aug '26

27 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9817 CVE: CVE-2026-46033 -------------------------------- The commit 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") added a digestsize check in crypto_authenc_esn_create() but used "goto err_free_inst" as the error path, skipping "err_drop_auth". On 4.19/4.18 the error labels are structured as a progressive cleanup chain (err_drop_enc -> err_drop_auth -> err_free_inst), where each label only cleans up one resource and falls through to the next. Skipping err_drop_auth means crypto_drop_ahash() is not called, so the ahash spawn remains linked on the underlying algorithm's cra_users list after kfree(inst) frees the memory containing it. This creates a dangling list node that triggers a use-after-free when cra_users is later traversed (e.g. algorithm unregistration via CRYPTO_MSG_DELALG or rmmod). On 5.10+ the err_free_inst label calls crypto_authenc_esn_free() which performs full cleanup (drop_skcipher + drop_ahash + kfree), so the original goto is safe there. The backport did not account for the different label structure on 4.19/4.18. Fix this by changing the goto target from err_free_inst to err_drop_auth, which properly removes the ahash spawn via crypto_drop_ahash() before falling through to kfree(inst). Fixes: 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> --- crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index 318fc75d326b..cbff96942824 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -429,7 +429,7 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst)); if (auth->digestsize > 0 && auth->digestsize < 4) { err = -EINVAL; - goto err_free_inst; + goto err_drop_auth; } err = crypto_grab_skcipher(&ctx->enc, enc_name, 0, -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] crypto: authencesn - fix spawn leak in digestsize check error path
by Gaosheng Cui 27 Aug '26

27 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9817 CVE: CVE-2026-46033 -------------------------------- The commit 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") added a digestsize check in crypto_authenc_esn_create() but used "goto err_free_inst" as the error path, skipping "err_drop_auth". On 4.19/4.18 the error labels are structured as a progressive cleanup chain (err_drop_enc -> err_drop_auth -> err_free_inst), where each label only cleans up one resource and falls through to the next. Skipping err_drop_auth means crypto_drop_ahash() is not called, so the ahash spawn remains linked on the underlying algorithm's cra_users list after kfree(inst) frees the memory containing it. This creates a dangling list node that triggers a use-after-free when cra_users is later traversed (e.g. algorithm unregistration via CRYPTO_MSG_DELALG or rmmod). On 5.10+ the err_free_inst label calls crypto_authenc_esn_free() which performs full cleanup (drop_skcipher + drop_ahash + kfree), so the original goto is safe there. The backport did not account for the different label structure on 4.19/4.18. Fix this by changing the goto target from err_free_inst to err_drop_auth, which properly removes the ahash spawn via crypto_drop_ahash() before falling through to kfree(inst). Fixes: 567af76238c38 ("crypto: authencesn - reject short ahash digests during instance creation") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> --- crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index 318fc75d326b2..cbff969428243 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -429,7 +429,7 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst)); if (auth->digestsize > 0 && auth->digestsize < 4) { err = -EINVAL; - goto err_free_inst; + goto err_drop_auth; } err = crypto_grab_skcipher(&ctx->enc, enc_name, 0, -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS,v2] crypto: authencesn - fix spawn leak in digestsize check error path
by Gaosheng Cui 27 Aug '26

27 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9817 CVE: CVE-2026-46033 -------------------------------- The commit 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") added a digestsize check in crypto_authenc_esn_create() but used "goto err_free_inst" as the error path, skipping "err_drop_auth". On 4.19/4.18 the error labels are structured as a progressive cleanup chain (err_drop_enc -> err_drop_auth -> err_free_inst), where each label only cleans up one resource and falls through to the next. Skipping err_drop_auth means crypto_drop_ahash() is not called, so the ahash spawn remains linked on the underlying algorithm's cra_users list after kfree(inst) frees the memory containing it. This creates a dangling list node that triggers a use-after-free when cra_users is later traversed (e.g. algorithm unregistration via CRYPTO_MSG_DELALG or rmmod). On 5.10+ the err_free_inst label calls crypto_authenc_esn_free() which performs full cleanup (drop_skcipher + drop_ahash + kfree), so the original goto is safe there. The backport did not account for the different label structure on 4.19/4.18. Fix this by changing the goto target from err_free_inst to err_drop_auth, which properly removes the ahash spawn via crypto_drop_ahash() before falling through to kfree(inst). Fixes: 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> --- v2: Fix Signed-off-by: Cui Gaosheng -> Gaosheng Cui crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index 318fc75d326b..cbff96942824 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -429,7 +429,7 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst)); if (auth->digestsize > 0 && auth->digestsize < 4) { err = -EINVAL; - goto err_free_inst; + goto err_drop_auth; } err = crypto_grab_skcipher(&ctx->enc, enc_name, 0, -- 2.43.0

1 0

[PATCH openEuler-1.0-LTS] crypto: authencesn - fix spawn leak in digestsize check error path
by Gaosheng Cui 26 Aug '26

26 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9817 CVE: CVE-2026-46033 -------------------------------- The commit 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") added a digestsize check in crypto_authenc_esn_create() but used "goto err_free_inst" as the error path, skipping "err_drop_auth". On 4.19/4.18 the error labels are structured as a progressive cleanup chain (err_drop_enc -> err_drop_auth -> err_free_inst), where each label only cleans up one resource and falls through to the next. Skipping err_drop_auth means crypto_drop_ahash() is not called, so the ahash spawn remains linked on the underlying algorithm's cra_users list after kfree(inst) frees the memory containing it. This creates a dangling list node that triggers a use-after-free when cra_users is later traversed (e.g. algorithm unregistration via CRYPTO_MSG_DELALG or rmmod). On 5.10+ the err_free_inst label calls crypto_authenc_esn_free() which performs full cleanup (drop_skcipher + drop_ahash + kfree), so the original goto is safe there. The backport did not account for the different label structure on 4.19/4.18. Fix this by changing the goto target from err_free_inst to err_drop_auth, which properly removes the ahash spawn via crypto_drop_ahash() before falling through to kfree(inst). Fixes: 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index 318fc75d326b..cbff96942824 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -429,7 +429,7 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst)); if (auth->digestsize > 0 && auth->digestsize < 4) { err = -EINVAL; - goto err_free_inst; + goto err_drop_auth; } err = crypto_grab_skcipher(&ctx->enc, enc_name, 0, -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] netfilter: require Ethernet MAC header before using eth_hdr()
by superdcc97＠163.com 26 Aug '26

26 Aug '26

From: Zhengchuan Liang <zcliangcn(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit 62443dc21114c0bbc476fa62973db89743f2f137 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15825 CVE: CVE-2026-53131 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`. Suggested-by: Florian Westphal <fw(a)strlen.de> Tested-by: Ren Wei <enjou1224z(a)gmail.com> Signed-off-by: Zhengchuan Liang <zcliangcn(a)gmail.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Signed-off-by: Florian Westphal <fw(a)strlen.de> Conflicts: net/netfilter/nf_log_syslog.c net/ipv4/netfilter/nf_log_arp.c net/ipv4/netfilter/nf_log_ipv4.c net/ipv6/netfilter/ip6t_eui64.c net/ipv6/netfilter/nf_log_ipv6.c [commit fdce0b3590f7, f11d61e7957d are not backport, which lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/netfilter/nf_log_arp.c | 5 ++++- net/ipv4/netfilter/nf_log_ipv4.c | 3 +++ net/ipv6/netfilter/ip6t_eui64.c | 8 +++++--- net/ipv6/netfilter/nf_log_ipv6.c | 3 +++ net/netfilter/ipset/ip_set_bitmap_ipmac.c | 5 +++-- net/netfilter/ipset/ip_set_hash_ipmac.c | 9 +++++---- net/netfilter/ipset/ip_set_hash_mac.c | 5 +++-- net/netfilter/xt_mac.c | 4 +--- 8 files changed, 27 insertions(+), 15 deletions(-) diff --git a/net/ipv4/netfilter/nf_log_arp.c b/net/ipv4/netfilter/nf_log_arp.c index 19fff2c589fa..fb10209c9a45 100644 --- a/net/ipv4/netfilter/nf_log_arp.c +++ b/net/ipv4/netfilter/nf_log_arp.c @@ -63,7 +63,10 @@ static void dump_arp_packet(struct nf_log_buf *m, else logflags = NF_LOG_DEFAULT_MASK; - if (logflags & NF_LOG_MACDECODE) { + if ((logflags & NF_LOG_MACDECODE) && + skb->dev && skb->dev->type == ARPHRD_ETHER && + skb_mac_header_was_set(skb) && + skb_mac_header_len(skb) >= ETH_HLEN) { nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); nf_log_dump_vlan(m, skb); diff --git a/net/ipv4/netfilter/nf_log_ipv4.c b/net/ipv4/netfilter/nf_log_ipv4.c index faa1ca357d0c..7cc8e5d7528c 100644 --- a/net/ipv4/netfilter/nf_log_ipv4.c +++ b/net/ipv4/netfilter/nf_log_ipv4.c @@ -287,6 +287,9 @@ static void dump_ipv4_mac_header(struct nf_log_buf *m, switch (dev->type) { case ARPHRD_ETHER: + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) + return; + nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); nf_log_dump_vlan(m, skb); diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c index aab0706908c5..96273dcdc54c 100644 --- a/net/ipv6/netfilter/ip6t_eui64.c +++ b/net/ipv6/netfilter/ip6t_eui64.c @@ -10,6 +10,7 @@ #include <linux/module.h> #include <linux/skbuff.h> #include <linux/ipv6.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <linux/netfilter/x_tables.h> @@ -24,9 +25,10 @@ eui64_mt6(const struct sk_buff *skb, struct xt_action_param *par) { unsigned char eui64[8]; - if (!(skb_mac_header(skb) >= skb->head && - skb_mac_header(skb) + ETH_HLEN <= skb->data) && - par->fragoff != 0) { + if (!skb->dev || skb->dev->type != ARPHRD_ETHER) + return false; + + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) { par->hotdrop = true; return false; } diff --git a/net/ipv6/netfilter/nf_log_ipv6.c b/net/ipv6/netfilter/nf_log_ipv6.c index 4edf73b5c8e5..7bd36cb23fa1 100644 --- a/net/ipv6/netfilter/nf_log_ipv6.c +++ b/net/ipv6/netfilter/nf_log_ipv6.c @@ -300,6 +300,9 @@ static void dump_ipv6_mac_header(struct nf_log_buf *m, switch (dev->type) { case ARPHRD_ETHER: + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) + return; + nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); nf_log_dump_vlan(m, skb); diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c index 9669cace4522..153f8dec9ca5 100644 --- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c +++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c @@ -15,6 +15,7 @@ #include <linux/etherdevice.h> #include <linux/skbuff.h> #include <linux/errno.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <linux/netlink.h> #include <linux/jiffies.h> @@ -224,8 +225,8 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, return -IPSET_ERR_BITMAP_RANGE; /* Backward compatibility: we don't check the second flag */ - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; e.id = ip_to_id(map, ip); diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c index f2c2f72e2fff..b7b98b129315 100644 --- a/net/netfilter/ipset/ip_set_hash_ipmac.c +++ b/net/netfilter/ipset/ip_set_hash_ipmac.c @@ -14,6 +14,7 @@ #include <linux/skbuff.h> #include <linux/errno.h> #include <linux/random.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <net/ip.h> #include <net/ipv6.h> @@ -92,8 +93,8 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb, struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } }; struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; if (opt->flags & IPSET_DIM_TWO_SRC) @@ -208,8 +209,8 @@ hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb, }; struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; if (opt->flags & IPSET_DIM_TWO_SRC) diff --git a/net/netfilter/ipset/ip_set_hash_mac.c b/net/netfilter/ipset/ip_set_hash_mac.c index 4fe5f243d0a3..ccb925f82fa7 100644 --- a/net/netfilter/ipset/ip_set_hash_mac.c +++ b/net/netfilter/ipset/ip_set_hash_mac.c @@ -12,6 +12,7 @@ #include <linux/etherdevice.h> #include <linux/skbuff.h> #include <linux/errno.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <net/netlink.h> @@ -81,8 +82,8 @@ hash_mac4_kadt(struct ip_set *set, const struct sk_buff *skb, struct hash_mac4_elem e = { { .foo[0] = 0, .foo[1] = 0 } }; struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; if (opt->flags & IPSET_DIM_ONE_SRC) diff --git a/net/netfilter/xt_mac.c b/net/netfilter/xt_mac.c index d5b4fd4f91ed..df42d0233d73 100644 --- a/net/netfilter/xt_mac.c +++ b/net/netfilter/xt_mac.c @@ -32,9 +32,7 @@ static bool mac_mt(const struct sk_buff *skb, struct xt_action_param *par) if (skb->dev == NULL || skb->dev->type != ARPHRD_ETHER) return false; - if (skb_mac_header(skb) < skb->head) - return false; - if (skb_mac_header(skb) + ETH_HLEN > skb->data) + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return false; ret = ether_addr_equal(eth_hdr(skb)->h_source, info->srcaddr); ret ^= info->invert; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
by superdcc97＠163.com 26 Aug '26

26 Aug '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.2-rc1 commit a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15907 CVE: CVE-2026-53221 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address. Fixes: fbe68ee87522 ("vti6: Add a lookup method for tunnels with wildcard endpoints.") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Steffen Klassert <steffen.klassert(a)secunet.com> Reviewed-by: Nicolas Dichtel <nicolas.dichtel(a)6wind.com> Link: https://patch.msgid.link/20260608164613.933023-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/ip6_vti.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c index a64050e77588..a87b05b564a0 100644 --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -109,6 +109,7 @@ vti6_tnl_lookup(struct net *net, const struct in6_addr *remote, hash = HASH(&any, local); for_each_vti6_tunnel_rcu(ip6n->tnls_r_l[hash]) { if (ipv6_addr_equal(local, &t->parms.laddr) && + ipv6_addr_any(&t->parms.raddr) && (t->dev->flags & IFF_UP)) return t; } @@ -116,6 +117,7 @@ vti6_tnl_lookup(struct net *net, const struct in6_addr *remote, hash = HASH(remote, &any); for_each_vti6_tunnel_rcu(ip6n->tnls_r_l[hash]) { if (ipv6_addr_equal(remote, &t->parms.raddr) && + ipv6_addr_any(&t->parms.laddr) && (t->dev->flags & IFF_UP)) return t; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] ipv6: sit: reload inner IPv6 header after GSO offloads
by superdcc97＠163.com 26 Aug '26

26 Aug '26

From: Kyle Zeng <kylebot(a)openai.com> mainline inclusion from mainline-v7.2-rc1 commit f0e42f0c4337b1f220de1ddd63f47197c7dee4de category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15914 CVE: CVE-2026-53228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call. If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released. Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb. Fixes: 14909664e4e1 ("sit: Setup and TX path for sit/UDP foo-over-udp encapsulation") Signed-off-by: Kyle Zeng <kylebot(a)openai.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reported-by: syzbot+6eb9ca986d80f6f88cf9(a)syzkaller.appspotmail.com Link: https://patch.msgid.link/20260605073448.6524-1-kylebot@openai.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/sit.c [context differs: fe8570186f10 use dst4_mtu() in ipip6_tunnel_xmit(), which is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/sit.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c index 6799691f565c..0de46ad81f62 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c @@ -925,6 +925,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb, ip_rt_put(rt); goto tx_error; } + iph6 = ipv6_hdr(skb); if (df) { mtu = dst_mtu(&rt->dst) - t_hlen; -- 2.43.0

2 1

[PATCH OLK-5.10] vhost/net: complete zerocopy ubufs only once
by Fanhua Li 26 Aug '26

26 Aug '26

From: Qing Ming <a0yami(a)mailbox.org> mainline inclusion from mainline-v7.2-rc1 commit 8f6898fe80794f2d7c3d38c1158c806e4074a1c4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17657 CVE: CVE-2026-74310 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- vhost-net initializes one ubuf_info per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb references are released. For example, batman-adv fragmentation reaches skb_split(), which calls skb_zerocopy_clone() and increments the same ubuf_info refcount. vhost_zerocopy_complete() currently treats every ubuf callback as a completed vhost descriptor. It dereferences ubuf->ctx, writes the descriptor completion state, and drops the vhost_net_ubuf_ref even when the callback only releases a cloned skb reference. A backend reset can therefore wait for and free the vhost_net_ubuf_ref while another cloned skb still carries the same ubuf_info. A later completion then dereferences the freed ubufs pointer. KASAN reports the stale completion as: BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0 BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0 vhost_zerocopy_complete skb_copy_ubufs __dev_forward_skb2 veth_xmit The freed object was allocated from vhost_net_ioctl() while setting the backend and freed through kfree_rcu()/kvfree_rcu_bulk after backend removal, while delayed skb completion still reached vhost_zerocopy_complete(). Honor the generic ubuf_info refcount before touching vhost state, and run the vhost descriptor completion only for the final ubuf reference. This matches the msg_zerocopy_complete() ownership rule for cloned zerocopy skbs. Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support") Signed-off-by: Qing Ming <a0yami(a)mailbox.org> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Message-ID: <20260601104300.197210-1-a0yami(a)mailbox.org> Conflicts: drivers/vhost/net.c [Fanhua Li: context conflict] Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- drivers/vhost/net.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index f5503306457f3..8539281fb1ef1 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -383,12 +383,18 @@ static void vhost_zerocopy_signal_used(struct vhost_net *net, static void vhost_zerocopy_callback(struct ubuf_info *ubuf, bool success) { - struct vhost_net_ubuf_ref *ubufs = ubuf->ctx; - struct vhost_virtqueue *vq = ubufs->vq; + struct vhost_net_ubuf_ref *ubufs; + struct vhost_virtqueue *vq; int cnt; - rcu_read_lock_bh(); + /* Only the final cloned skb reference completes the vhost descriptor. */ + if (!refcount_dec_and_test(&ubuf->refcnt)) + return; + + ubufs = ubuf->ctx; + vq = ubufs->vq; + rcu_read_lock_bh(); /* set len to mark this desc buffers done DMA */ vq->heads[ubuf->desc].len = success ? VHOST_DMA_DONE_LEN : VHOST_DMA_FAILED_LEN; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] vhost/net: complete zerocopy ubufs only once
by Fanhua Li 26 Aug '26

26 Aug '26

From: Qing Ming <a0yami(a)mailbox.org> mianline inclusion from mianline-v7.2-rc1 commit 8f6898fe80794f2d7c3d38c1158c806e4074a1c4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17657 CVE: CVE-2026-74310 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- vhost-net initializes one ubuf_info per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb references are released. For example, batman-adv fragmentation reaches skb_split(), which calls skb_zerocopy_clone() and increments the same ubuf_info refcount. vhost_zerocopy_complete() currently treats every ubuf callback as a completed vhost descriptor. It dereferences ubuf->ctx, writes the descriptor completion state, and drops the vhost_net_ubuf_ref even when the callback only releases a cloned skb reference. A backend reset can therefore wait for and free the vhost_net_ubuf_ref while another cloned skb still carries the same ubuf_info. A later completion then dereferences the freed ubufs pointer. KASAN reports the stale completion as: BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0 BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x101/0x1f0 vhost_zerocopy_complete skb_copy_ubufs __dev_forward_skb2 veth_xmit The freed object was allocated from vhost_net_ioctl() while setting the backend and freed through kfree_rcu()/kvfree_rcu_bulk after backend removal, while delayed skb completion still reached vhost_zerocopy_complete(). Honor the generic ubuf_info refcount before touching vhost state, and run the vhost descriptor completion only for the final ubuf reference. This matches the msg_zerocopy_complete() ownership rule for cloned zerocopy skbs. Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support") Signed-off-by: Qing Ming <a0yami(a)mailbox.org> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Message-ID: <20260601104300.197210-1-a0yami(a)mailbox.org> Conflicts: drivers/vhost/net.c [Fanhua Li: context conflict] Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- drivers/vhost/net.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index 4b9151474a245..121e4f80c08b6 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -371,12 +371,18 @@ static void vhost_zerocopy_signal_used(struct vhost_net *net, static void vhost_zerocopy_callback(struct ubuf_info *ubuf, bool success) { - struct vhost_net_ubuf_ref *ubufs = ubuf->ctx; - struct vhost_virtqueue *vq = ubufs->vq; + struct vhost_net_ubuf_ref *ubufs; + struct vhost_virtqueue *vq; int cnt; - rcu_read_lock_bh(); + /* Only the final cloned skb reference completes the vhost descriptor. */ + if (!refcount_dec_and_test(&ubuf->refcnt)) + return; + + ubufs = ubuf->ctx; + vq = ubufs->vq; + rcu_read_lock_bh(); /* set len to mark this desc buffers done DMA */ vq->heads[ubuf->desc].len = success ? VHOST_DMA_DONE_LEN : VHOST_DMA_FAILED_LEN; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] netfilter: ip6t_eui64: reject invalid MAC header for all packets
by superdcc97＠163.com 26 Aug '26

26 Aug '26

From: Zhengchuan Liang <zcliangcn(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit fdce0b3590f724540795b874b4c8850c90e6b0a8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14432 CVE: CVE-2026-31685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 source address. The existing guard only rejects an invalid MAC header when `par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()` can still reach `eth_hdr(skb)` even when the MAC header is not valid. Fix this by removing the `par->fragoff != 0` condition so that packets with an invalid MAC header are rejected before accessing `eth_hdr(skb)`. Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") Reported-by: Yifan Wu <yifanwucs(a)gmail.com> Reported-by: Juefei Pu <tomapufckgml(a)gmail.com> Co-developed-by: Yuan Tan <yuantan098(a)gmail.com> Signed-off-by: Yuan Tan <yuantan098(a)gmail.com> Suggested-by: Xin Liu <bird(a)lzu.edu.cn> Tested-by: Ren Wei <enjou1224z(a)gmail.com> Signed-off-by: Zhengchuan Liang <zcliangcn(a)gmail.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/netfilter/ip6t_eui64.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c index aab0706908c5..cda3d43e527d 100644 --- a/net/ipv6/netfilter/ip6t_eui64.c +++ b/net/ipv6/netfilter/ip6t_eui64.c @@ -25,8 +25,7 @@ eui64_mt6(const struct sk_buff *skb, struct xt_action_param *par) unsigned char eui64[8]; if (!(skb_mac_header(skb) >= skb->head && - skb_mac_header(skb) + ETH_HLEN <= skb->data) && - par->fragoff != 0) { + skb_mac_header(skb) + ETH_HLEN <= skb->data)) { par->hotdrop = true; return false; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
by superdcc97＠163.com 26 Aug '26

26 Aug '26

From: Jenny Guanni Qu <qguanni(a)gmail.com> mainline inclusion from mainline-v7.0-rc5 commit f173d0f4c0f689173f8cdac79991043a4a89bf66 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14095 CVE: CVE-2026-23455 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read. Add a check to ensure len is positive after the decrement. Fixes: 5e35941d9901 ("[NETFILTER]: Add H.323 conntrack/NAT helper") Reported-by: Klaudia Kloc <klaudia(a)vidocsecurity.com> Reported-by: Dawid Moczadło <dawid(a)vidocsecurity.com> Tested-by: Jenny Guanni Qu <qguanni(a)gmail.com> Signed-off-by: Jenny Guanni Qu <qguanni(a)gmail.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_conntrack_h323_asn1.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c index dbdce5a59493..c46357538aa3 100644 --- a/net/netfilter/nf_conntrack_h323_asn1.c +++ b/net/netfilter/nf_conntrack_h323_asn1.c @@ -925,6 +925,8 @@ int DecodeQ931(unsigned char *buf, size_t sz, Q931 *q931) break; p++; len--; + if (len <= 0) + break; return DecodeH323_UserInformation(buf, p, len, &q931->UUIE); } -- 2.43.0

2 1

[PATCH OLK-6.6] tcp: clear sock_ops cb flags before force-closing a child socket
by JiangJieHua 26 Aug '26

26 Aug '26

From: Sechang Lim <rhkrqnwk98(a)gmail.com> mainline inclusion from mainline-v7.2-rc1 commit 990348e5bb457697c2f1f7f7b65154a3334d9d2b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17954 CVE: CVE-2026-74268 Reference:https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/… -------------------------------- A child socket inherits the listener's bpf_sock_ops_cb_flags via sk_clone_lock(). If its setup fails in tcp_v4_syn_recv_sock() / tcp_v6_syn_recv_sock(), the child is freed through put_and_exit, where inet_csk_prepare_forced_close() drops the socket lock and tcp_done() runs without it. If BPF_SOCK_OPS_STATE_CB_FLAG was inherited, tcp_done() -> tcp_set_state() calls tcp_call_bpf(), which expects the lock and trips sock_owned_by_me(): WARNING: include/net/sock.h:1799 at tcp_set_state+0x433/0x550 RIP: 0010:tcp_set_state+0x433/0x550 include/net/sock.h:1799 Call Trace: <IRQ> tcp_done+0xba/0x250 net/ipv4/tcp.c:5095 tcp_v4_syn_recv_sock+0x850/0xa50 net/ipv4/tcp_ipv4.c:1787 tcp_check_req+0xf30/0x1360 net/ipv4/tcp_minisocks.c:926 tcp_v4_rcv+0x1047/0x1b50 net/ipv4/tcp_ipv4.c:2164 </IRQ> The child is freed before it is ever established, so it should run no sock_ops callback. Clear its cb flags in inet_csk_prepare_for_destroy_sock(), the common point for the IPv4, IPv6 and chtls forced-close paths and for the MPTCP ->syn_recv_sock() failure path (dispose_child), which reaches tcp_done() on a child that was never established too. Suggested-by: Jiayuan Chen <jiayuan.chen(a)linux.dev> Fixes: d44874910a26 ("bpf: Add BPF_SOCK_OPS_STATE_CB") Signed-off-by: Sechang Lim <rhkrqnwk98(a)gmail.com> Reviewed-by: Jiayuan Chen <jiayuan.chen(a)linux.dev> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260611092923.1895982-1-rhkrqnwk98@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inet_connection_sock.c [In OLK-6.6, inet_csk_prepare_for_destroy_sock() remains a static inline function in include/net/inet_connection_sock.h, while upstream already moved it into inet_connection_sock.c via commit 7051b54fb5aa (due to header dependency). This backport cherry-picks the inline-to-non-inline conversion (changing the definition in inet_connection_sock.h to a declaration), retains OLK-6.6's this_cpu_inc(*sk->sk_prot->orphan_count) implementation without pulling in the orphan_count refactoring, and adds a sk->sk_protocol == IPPROTO_TCP guard to isolate the DCCP path. Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- include/net/inet_connection_sock.h | 8 +------- include/net/tcp.h | 9 +++++++++ net/ipv4/inet_connection_sock.c | 9 +++++++++ 3 files changed, 19 insertions(+), 7 deletions(-) diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h index 327ae14ca82b..c16f600e5c5c 100644 --- a/include/net/inet_connection_sock.h +++ b/include/net/inet_connection_sock.h @@ -303,14 +303,8 @@ reqsk_timeout(struct request_sock *req, unsigned long max_timeout) return (unsigned long)min_t(u64, timeout, max_timeout); } -static inline void inet_csk_prepare_for_destroy_sock(struct sock *sk) -{ - /* The below has to be done to allow calling inet_csk_destroy_sock */ - sock_set_flag(sk, SOCK_DEAD); - this_cpu_inc(*sk->sk_prot->orphan_count); -} - void inet_csk_destroy_sock(struct sock *sk); +void inet_csk_prepare_for_destroy_sock(struct sock *sk); void inet_csk_prepare_forced_close(struct sock *sk); /* diff --git a/include/net/tcp.h b/include/net/tcp.h index 8674996bd39c..e1a345d5a40b 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -2515,6 +2515,11 @@ static inline int tcp_call_bpf_3arg(struct sock *sk, int op, u32 arg1, u32 arg2, return tcp_call_bpf(sk, op, 3, args); } +static inline void tcp_clear_sock_ops_cb_flags(struct sock *sk) +{ + tcp_sk(sk)->bpf_sock_ops_cb_flags = 0; +} + #else static inline int tcp_call_bpf(struct sock *sk, int op, u32 nargs, u32 *args) { @@ -2532,6 +2537,10 @@ static inline int tcp_call_bpf_3arg(struct sock *sk, int op, u32 arg1, u32 arg2, return -EPERM; } +static inline void tcp_clear_sock_ops_cb_flags(struct sock *sk) +{ +} + #endif static inline u32 tcp_timeout_init(struct sock *sk) diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index 9f1d17cd5eeb..b0844b7fa7fc 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -1240,6 +1240,15 @@ void inet_csk_destroy_sock(struct sock *sk) } EXPORT_SYMBOL(inet_csk_destroy_sock); +void inet_csk_prepare_for_destroy_sock(struct sock *sk) +{ + /* The below has to be done to allow calling inet_csk_destroy_sock */ + if (sk->sk_protocol == IPPROTO_TCP) + tcp_clear_sock_ops_cb_flags(sk); + sock_set_flag(sk, SOCK_DEAD); + tcp_orphan_count_inc(); +} + /* This function allows to force a closure of a socket after the call to * tcp/dccp_create_openreq_child(). */ -- 2.33.8

2 1

[PATCH OLK-6.6] perf/core: Fix group leader use-after-free after sibling detach
by Luo Gengkun 26 Aug '26

26 Aug '26

From: Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> mainline inclusion from mainline-v7.2-rc6 commit 42c5ca1f0a288a52878bd72a5595b08261057438 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18309 CVE: CVE-2026-74637 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- perf_group_detach() handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their group_leader pointer is reset to themselves. When a sibling is detached, it is removed from the leader's sibling_list, but its group_leader pointer is left pointing at the old leader. That is harmless when the sibling is being closed and freed immediately, as in the DETACH_DEAD path. It is not safe when the sibling is detached but kept alive, such as during CPU hotplug with DETACH_GROUP. In that case the sibling is removed from the context, while its file descriptor can still keep it alive. A typical failing sequence is: - A group contains leader L and sibling S. - CPU hot-unplug detaches S with DETACH_GROUP, removing it from L->sibling_list but leaving S->group_leader == L. - L is later closed and freed. - A PERF_IOC_FLAG_GROUP ioctl on S follows S->group_leader and dereferences the freed leader. This was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT pc : perf_ioctl+0x34c/0xc68 x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908) Call trace: perf_ioctl+0x34c/0xc68 (P) __arm64_sys_ioctl+0xa0/0xf4 invoke_syscall+0x58/0xe4 el0_svc_common+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x40/0xc0 el0t_64_sync_handler+0x68/0xdc el0t_64_sync+0x1c4/0x1c8 The fault happened in perf_ioctl(), where perf_event_for_each() follows the stale group_leader pointer and perf_event_for_each_child() then dereferences the freed leader's context. Fix the use-after-free by promoting the detached sibling to a singleton. Also fix __event_disable() cgroup accounting and event state change. Fixes: 8a49542c0554 ("perf_events: Fix races in group composition") Assisted-by: PatchWise:gpt-5.5 Signed-off-by: Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi(a)linux.intel.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260807-fix-group-leader-uaf-v3-1-b0c2310c9a0d@os… Conflicts: kernel/events/core.c [Fix simple ctx diff.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 66 +++++++++++++++++++++++++------------------- 1 file changed, 37 insertions(+), 29 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 6916dc78b0e7..9a779ca76798 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -2163,6 +2163,34 @@ static inline struct list_head *get_event_list(struct perf_event *event) &event->pmu_ctx->flexible_active; } +/* @sibling must already be unlinked from its old leader's sibling_list. */ +static void perf_promote_sibling_to_leader(struct perf_event *sibling, + struct perf_event_context *ctx, + int group_caps) +{ + /* + * Events that have PERF_EV_CAP_SIBLING require being part of + * a group and cannot exist on their own, schedule them out + * and move them into the ERROR state. Also see + * _perf_event_enable(), it will not be able to recover this + * ERROR state. + */ + if (sibling->event_caps & PERF_EV_CAP_SIBLING) + __event_disable(sibling, ctx, PERF_EVENT_STATE_ERROR); + + sibling->group_leader = sibling; + sibling->group_caps = group_caps; + + if (sibling->attach_state & PERF_ATTACH_CONTEXT) { + add_event_to_groups(sibling, ctx); + + if (sibling->state == PERF_EVENT_STATE_ACTIVE) + list_add_tail(&sibling->active_list, get_event_list(sibling)); + } + + perf_event__header_size(sibling); +} + static void perf_group_detach(struct perf_event *event) { struct perf_event *leader = event->group_leader; @@ -2186,8 +2214,9 @@ static void perf_group_detach(struct perf_event *event) */ if (leader != event) { list_del_init(&event->sibling_list); - event->group_leader->nr_siblings--; - event->group_leader->group_generation++; + leader->nr_siblings--; + leader->group_generation++; + perf_promote_sibling_to_leader(event, ctx, event->event_caps); goto out; } @@ -2197,32 +2226,14 @@ static void perf_group_detach(struct perf_event *event) * to whatever list we are on. */ list_for_each_entry_safe(sibling, tmp, &event->sibling_list, sibling_list) { - - /* - * Events that have PERF_EV_CAP_SIBLING require being part of - * a group and cannot exist on their own, schedule them out - * and move them into the ERROR state. Also see - * _perf_event_enable(), it will not be able to recover this - * ERROR state. - */ - if (sibling->event_caps & PERF_EV_CAP_SIBLING) - __event_disable(sibling, ctx, PERF_EVENT_STATE_ERROR); - - sibling->group_leader = sibling; list_del_init(&sibling->sibling_list); /* Inherit group flags from the previous leader */ - sibling->group_caps = event->group_caps; - - if (sibling->attach_state & PERF_ATTACH_CONTEXT) { - add_event_to_groups(sibling, event->ctx); - - if (sibling->state == PERF_EVENT_STATE_ACTIVE) - list_add_tail(&sibling->active_list, get_event_list(sibling)); - } + perf_promote_sibling_to_leader(sibling, ctx, event->group_caps); WARN_ON_ONCE(sibling->ctx != event->ctx); } + event->nr_siblings = 0; out: for_each_sibling_event(tmp, leader) @@ -2389,12 +2400,8 @@ __perf_remove_from_context(struct perf_event *event, if (flags & DETACH_DEAD) state = PERF_EVENT_STATE_DEAD; - event_sched_out(event, ctx); + __event_disable(event, ctx, state); - if (event->state > PERF_EVENT_STATE_OFF) - perf_cgroup_event_disable(event, ctx); - - perf_event_set_state(event, min(event->state, state)); if (flags & DETACH_GROUP) perf_group_detach(event); if (flags & DETACH_CHILD) @@ -2463,8 +2470,9 @@ static void __event_disable(struct perf_event *event, enum perf_event_state state) { event_sched_out(event, ctx); - perf_cgroup_event_disable(event, ctx); - perf_event_set_state(event, state); + if (event->state > PERF_EVENT_STATE_OFF) + perf_cgroup_event_disable(event, ctx); + perf_event_set_state(event, min(event->state, state)); } /* -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Fix race between update_event_fields and, event_define_fields
by Tengda Wu 25 Aug '26

25 Aug '26

From: Michael Wu <michael(a)allwinnertech.com> stable inclusion from stable-v6.6.152 commit e5f1d301b4bdaa4206db251fdc691f623162b0a8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18289 CVE: CVE-2026-74636 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c3730b8373bb5059d735509b9e6a00d7eb337d7c upstream. The following sequence may leads race between event_define_fields() and update_event_fields(): CPU0 (loads module A) CPU1 (loads module B) =============================== =============================== load_module(A) load_module(B) notifier_call_chain notifier_call_chain trace_module_notify trace_module_notify mutex_lock(&event_mutex) trace_event_update_all() trace_module_add_events(A) down_write(&trace_event_sem) __register_event(call_A) __add_event_to_tracers(call_A) event_define_fields(call_A) for each f: list_for_each_entry(field, list_add(&f->link, &class->fields, link) &class->fields) field = class->fields->next; Where access to the class->fields is not protected by the event_mutex in trace_event_update_all(). This produces the following panic: Unable to handle kernel access ... at virtual address 0000000000000018 pc : update_event_fields+0xf8/0x368 Call trace: update_event_fields+0xf8/0x368 trace_event_update_all+0x7c/0x2b4 trace_module_notify+0x4c/0x1dc notifier_call_chain+0x84/0x168 blocking_notifier_call_chain_robust+0x64/0xd4 load_module+0x10c8/0x123c __arm64_sys_finit_module+0x230/0x31c Fix by taking event_mutex in trace_event_update_all() before trace_event_sem. Cc: stable(a)vger.kernel.org Fixes: b3bc8547d3be ("tracing: Have TRACE_DEFINE_ENUM affect trace event types as well") Link: https://patch.msgid.link/2e5730d2-c631-da41-3a3a-ae35bb4895f3@allwinnertech… Signed-off-by: Michael Wu <michael(a)allwinnertech.com> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: kernel/trace/trace_events.c [Context conflict] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index bea0ab4d8d73..7326cfafcc23 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -3035,6 +3035,7 @@ void trace_event_eval_update(struct trace_eval_map **map, int len) int last_i; int i; + mutex_lock(&event_mutex); down_write(&trace_event_sem); list_for_each_entry_safe(call, p, &ftrace_events, list) { /* events are usually grouped together with systems */ @@ -3068,6 +3069,7 @@ void trace_event_eval_update(struct trace_eval_map **map, int len) cond_resched(); } up_write(&trace_event_sem); + mutex_unlock(&event_mutex); } static struct trace_event_file * -- 2.34.1

2 1

[PATCH OLK-6.6] eventfs: Fix use-after-free in eventfs_remove_rec()
by Tengda Wu 25 Aug '26

25 Aug '26

From: Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> stable inclusion from stable-v6.6.152 commit b77581b25e213e83b79ce11eb30024e55ceeb3e9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18299 CVE: CVE-2026-74606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fd73b691702170d37d66f4b0278530cea8ed419a upstream. eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running. Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child. Cc: stable(a)vger.kernel.org Fixes: 43aa6f97c2d0 ("eventfs: Get rid of dentry pointers without refcounts") Link: https://patch.msgid.link/20260806022719.375354-1-shuangpeng.kernel@gmail.com Signed-off-by: Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/tracefs/event_inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 36257e1092d6..4ac459c7efc3 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -922,7 +922,7 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry */ static void eventfs_remove_rec(struct eventfs_inode *ei, int level) { - struct eventfs_inode *ei_child; + struct eventfs_inode *ei_child, *tmp; /* * Check recursion depth. It should never be greater than 3: @@ -935,7 +935,7 @@ static void eventfs_remove_rec(struct eventfs_inode *ei, int level) return; /* search for nested folders or files */ - list_for_each_entry(ei_child, &ei->children, list) + list_for_each_entry_safe(ei_child, tmp, &ei->children, list) eventfs_remove_rec(ei_child, level + 1); list_del_rcu(&ei->list); -- 2.34.1

2 1

[PATCH OLK-5.10] RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
by Chen Jinghuang 25 Aug '26

25 Aug '26

From: Tristan Madani <tristmd(a)gmail.com> mainline inclusion from mainline-v7.2-rc1 commit d6ab440240a04b8737ee4c7bb21af9182e451733 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17929 CVE: CVE-2026-74377 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like num_sge or sge entries while the kernel is processing the WQE, leading to out-of-bounds reads in rxe_resp_check_length() and copy_data(). Introduce get_recv_wqe() that validates num_sge and copies the WQE to a kernel-local buffer before processing, matching the approach already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is reused since SRQ and non-SRQ paths are mutually exclusive per QP. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://patch.msgid.link/r/20260518215040.1598586-3-tristan@talencesecurity… Signed-off-by: Tristan Madani <tristan(a)talencesecurity.com> Reviewed-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/sw/rxe/rxe_resp.c [The target tree has an older rxe_queue API without a queue type argument and lacks the rxe_dbg_qp() logging macro. Adapted rxe_get_recv_wqe() to call queue_head(q) with the single argument signature and to log via pr_debug()/qp_num() instead of rxe_dbg_qp().] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_resp.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c index 83c03212099a..8626cd280ebb 100644 --- a/drivers/infiniband/sw/rxe/rxe_resp.c +++ b/drivers/infiniband/sw/rxe/rxe_resp.c @@ -328,6 +328,29 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp) return RESPST_CHK_LENGTH; } +static enum resp_states rxe_get_recv_wqe(struct rxe_qp *qp) +{ + struct rxe_queue *q = qp->rq.queue; + struct rxe_recv_wqe *wqe; + unsigned int num_sge; + size_t size; + + wqe = queue_head(q); + if (!wqe) + return RESPST_ERR_RNR; + + num_sge = wqe->dma.num_sge; + if (unlikely(num_sge > qp->rq.max_sge)) { + pr_debug("qp#%d invalid num_sge in recv WQE\n", qp_num(qp)); + return RESPST_ERR_MALFORMED_WQE; + } + size = sizeof(*wqe) + num_sge * sizeof(struct rxe_sge); + memcpy(&qp->resp.srq_wqe, wqe, size); + + qp->resp.wqe = &qp->resp.srq_wqe.wqe; + return RESPST_CHK_LENGTH; +} + static enum resp_states check_resource(struct rxe_qp *qp, struct rxe_pkt_info *pkt) { @@ -365,8 +388,7 @@ static enum resp_states check_resource(struct rxe_qp *qp, if (srq) return get_srq_wqe(qp); - qp->resp.wqe = queue_head(qp->rq.queue); - return (qp->resp.wqe) ? RESPST_CHK_LENGTH : RESPST_ERR_RNR; + return rxe_get_recv_wqe(qp); } return RESPST_CHK_LENGTH; -- 2.34.1

2 1

[PTACH openEuler-1.0-LTS] RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
by Chen Jinghuang 25 Aug '26

25 Aug '26

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v7.2-rc1 commit 449ae7927152e46acbe5f19f97eafdae6d3a96b1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18162 CVE: CVE-2026-74296 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Free the UAR index returned by the hardware. Fixes: 4ed131d0bb15 ("IB/mlx5: Expose dynamic mmap allocation") Link: https://patch.msgid.link/r/20260611-fix-uar-release-v1-1-f5464d845dbf@nvidi… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/hw/mlx5/main.c [ Context conflict ] Signed-off-by: Chen jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index 4f340d6db582..051de9f3ed82 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -2148,7 +2148,7 @@ static int uar_mmap(struct mlx5_ib_dev *dev, enum mlx5_ib_mmap_cmd cmd, if (!dyn_uar) return err; - mlx5_cmd_free_uar(dev->mdev, idx); + mlx5_cmd_free_uar(dev->mdev, uar_index); free_bfreg: mlx5_ib_free_bfreg(dev, bfregi, bfreg_dyn_idx); -- 2.34.1

1 0

[PATCH OLK-6.6] bpf: Avoid lockup of bpf_lru_list in NMI by using trylock
by Chen Yuxi 25 Aug '26

25 Aug '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17962 CVE: CVE-2026-74337 -------------------------------- The upstream fix for this CVE relies on the rqspinlock feature, which hulk has not yet introduced, so it cannot be backported directly. Instead, use raw_spin_trylock instead of the blocking lock, returning immediately when the trylock fails to avoid a deadlock in NMI. Fixes: 3a08c2fd7634 ("bpf: LRU List") Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/bpf/bpf_lru_list.c | 160 ++++++++++++++++++++++++++------------ kernel/bpf/bpf_lru_list.h | 20 ++++- 2 files changed, 128 insertions(+), 52 deletions(-) diff --git a/kernel/bpf/bpf_lru_list.c b/kernel/bpf/bpf_lru_list.c index 2d6e1c98d8ad..0884b1b23b10 100644 --- a/kernel/bpf/bpf_lru_list.c +++ b/kernel/bpf/bpf_lru_list.c @@ -13,10 +13,6 @@ #define PERCPU_FREE_TARGET (4) #define PERCPU_NR_SCANS PERCPU_FREE_TARGET -/* Helpers to get the local list index */ -#define LOCAL_LIST_IDX(t) ((t) - BPF_LOCAL_LIST_T_OFFSET) -#define LOCAL_FREE_LIST_IDX LOCAL_LIST_IDX(BPF_LRU_LOCAL_LIST_T_FREE) -#define LOCAL_PENDING_LIST_IDX LOCAL_LIST_IDX(BPF_LRU_LOCAL_LIST_T_PENDING) #define IS_LOCAL_LIST_TYPE(t) ((t) >= BPF_LOCAL_LIST_T_OFFSET) static int get_next_cpu(int cpu) @@ -27,17 +23,6 @@ static int get_next_cpu(int cpu) return cpu; } -/* Local list helpers */ -static struct list_head *local_free_list(struct bpf_lru_locallist *loc_l) -{ - return &loc_l->lists[LOCAL_FREE_LIST_IDX]; -} - -static struct list_head *local_pending_list(struct bpf_lru_locallist *loc_l) -{ - return &loc_l->lists[LOCAL_PENDING_LIST_IDX]; -} - /* bpf_lru_node helpers */ static bool bpf_lru_node_is_ref(const struct bpf_lru_node *node) { @@ -80,6 +65,7 @@ static void __bpf_lru_node_move_to_free(struct bpf_lru_list *l, bpf_lru_list_count_dec(l, node->type); node->type = tgt_free_type; + WRITE_ONCE(node->pending_free, 0); list_move(&node->list, free_list); } @@ -95,6 +81,9 @@ static void __bpf_lru_node_move_in(struct bpf_lru_list *l, bpf_lru_list_count_inc(l, tgt_type); node->type = tgt_type; bpf_lru_node_clear_ref(node); + /* Reset pending_free only when moving to the free list */ + if (tgt_type == BPF_LRU_LIST_T_FREE) + WRITE_ONCE(node->pending_free, 0); list_move(&node->list, &l->lists[tgt_type]); } @@ -220,11 +209,13 @@ __bpf_lru_list_shrink_inactive(struct bpf_lru *lru, unsigned int i = 0; list_for_each_entry_safe_reverse(node, tmp_node, inactive, list) { - if (bpf_lru_node_is_ref(node)) { + if (bpf_lru_node_is_ref(node) && + !READ_ONCE(node->pending_free)) { __bpf_lru_node_move(l, node, BPF_LRU_LIST_T_ACTIVE); - } else if (lru->del_from_htab(lru->del_arg, node)) { + } else if (READ_ONCE(node->pending_free) || + lru->del_from_htab(lru->del_arg, node)) { __bpf_lru_node_move_to_free(l, node, free_list, - tgt_free_type); + tgt_free_type); if (++nshrinked == tgt_nshrink) break; } @@ -281,7 +272,8 @@ static unsigned int __bpf_lru_list_shrink(struct bpf_lru *lru, list_for_each_entry_safe_reverse(node, tmp_node, force_shrink_list, list) { - if (lru->del_from_htab(lru->del_arg, node)) { + if (READ_ONCE(node->pending_free) || + lru->del_from_htab(lru->del_arg, node)) { __bpf_lru_node_move_to_free(l, node, free_list, tgt_free_type); return 1; @@ -298,8 +290,10 @@ static void __local_list_flush(struct bpf_lru_list *l, struct bpf_lru_node *node, *tmp_node; list_for_each_entry_safe_reverse(node, tmp_node, - local_pending_list(loc_l), list) { - if (bpf_lru_node_is_ref(node)) + &loc_l->pending_list, list) { + if (READ_ONCE(node->pending_free)) + __bpf_lru_node_move_in(l, node, BPF_LRU_LIST_T_FREE); + else if (bpf_lru_node_is_ref(node)) __bpf_lru_node_move_in(l, node, BPF_LRU_LIST_T_ACTIVE); else __bpf_lru_node_move_in(l, node, @@ -315,7 +309,14 @@ static void bpf_lru_list_push_free(struct bpf_lru_list *l, if (WARN_ON_ONCE(IS_LOCAL_LIST_TYPE(node->type))) return; - raw_spin_lock_irqsave(&l->lock, flags); + if (in_nmi()) { + if (!raw_spin_trylock_irqsave(&l->lock, flags)) { + WRITE_ONCE(node->pending_free, 1); + return; + } + } else { + raw_spin_lock_irqsave(&l->lock, flags); + } __bpf_lru_node_move(l, node, BPF_LRU_LIST_T_FREE); raw_spin_unlock_irqrestore(&l->lock, flags); } @@ -326,8 +327,14 @@ static void bpf_lru_list_pop_free_to_local(struct bpf_lru *lru, struct bpf_lru_list *l = &lru->common_lru.lru_list; struct bpf_lru_node *node, *tmp_node; unsigned int nfree = 0; + LIST_HEAD(tmp_free); - raw_spin_lock(&l->lock); + if (in_nmi()) { + if (!raw_spin_trylock(&l->lock)) + return; + } else { + raw_spin_lock(&l->lock); + } __local_list_flush(l, loc_l); @@ -335,7 +342,7 @@ static void bpf_lru_list_pop_free_to_local(struct bpf_lru *lru, list_for_each_entry_safe(node, tmp_node, &l->lists[BPF_LRU_LIST_T_FREE], list) { - __bpf_lru_node_move_to_free(l, node, local_free_list(loc_l), + __bpf_lru_node_move_to_free(l, node, &tmp_free, BPF_LRU_LOCAL_LIST_T_FREE); if (++nfree == lru->target_free) break; @@ -343,10 +350,19 @@ static void bpf_lru_list_pop_free_to_local(struct bpf_lru *lru, if (nfree < lru->target_free) __bpf_lru_list_shrink(lru, l, lru->target_free - nfree, - local_free_list(loc_l), + &tmp_free, BPF_LRU_LOCAL_LIST_T_FREE); raw_spin_unlock(&l->lock); + + /* + * Transfer the harvested nodes from the temporary list_head into + * the lockless per-CPU free llist. + */ + list_for_each_entry_safe(node, tmp_node, &tmp_free, list) { + list_del(&node->list); + llist_add(&node->llist, &loc_l->free_llist); + } } static void __local_list_add_pending(struct bpf_lru *lru, @@ -358,22 +374,21 @@ static void __local_list_add_pending(struct bpf_lru *lru, *(u32 *)((void *)node + lru->hash_offset) = hash; node->cpu = cpu; node->type = BPF_LRU_LOCAL_LIST_T_PENDING; + WRITE_ONCE(node->pending_free, 0); bpf_lru_node_clear_ref(node); - list_add(&node->list, local_pending_list(loc_l)); + list_add(&node->list, &loc_l->pending_list); } static struct bpf_lru_node * __local_list_pop_free(struct bpf_lru_locallist *loc_l) { - struct bpf_lru_node *node; + struct llist_node *llnode; - node = list_first_entry_or_null(local_free_list(loc_l), - struct bpf_lru_node, - list); - if (node) - list_del(&node->list); + llnode = llist_del_first(&loc_l->free_llist); + if (!llnode) + return NULL; - return node; + return container_of(llnode, struct bpf_lru_node, llist); } static struct bpf_lru_node * @@ -384,10 +399,10 @@ __local_list_pop_pending(struct bpf_lru *lru, struct bpf_lru_locallist *loc_l) ignore_ref: /* Get from the tail (i.e. older element) of the pending list. */ - list_for_each_entry_reverse(node, local_pending_list(loc_l), - list) { + list_for_each_entry_reverse(node, &loc_l->pending_list, list) { if ((!bpf_lru_node_is_ref(node) || force) && - lru->del_from_htab(lru->del_arg, node)) { + (READ_ONCE(node->pending_free) || + lru->del_from_htab(lru->del_arg, node))) { list_del(&node->list); return node; } @@ -412,7 +427,12 @@ static struct bpf_lru_node *bpf_percpu_lru_pop_free(struct bpf_lru *lru, l = per_cpu_ptr(lru->percpu_lru, cpu); - raw_spin_lock_irqsave(&l->lock, flags); + if (in_nmi()) { + if (!raw_spin_trylock_irqsave(&l->lock, flags)) + return NULL; + } else { + raw_spin_lock_irqsave(&l->lock, flags); + } __bpf_lru_list_rotate(lru, l); @@ -445,7 +465,12 @@ static struct bpf_lru_node *bpf_common_lru_pop_free(struct bpf_lru *lru, loc_l = per_cpu_ptr(clru->local_list, cpu); - raw_spin_lock_irqsave(&loc_l->lock, flags); + if (in_nmi()) { + if (!raw_spin_trylock_irqsave(&loc_l->lock, flags)) + return NULL; + } else { + raw_spin_lock_irqsave(&loc_l->lock, flags); + } node = __local_list_pop_free(loc_l); if (!node) { @@ -474,7 +499,12 @@ static struct bpf_lru_node *bpf_common_lru_pop_free(struct bpf_lru *lru, do { steal_loc_l = per_cpu_ptr(clru->local_list, steal); - raw_spin_lock_irqsave(&steal_loc_l->lock, flags); + if (in_nmi()) { + if (!raw_spin_trylock_irqsave(&steal_loc_l->lock, flags)) + goto next_steal; + } else { + raw_spin_lock_irqsave(&steal_loc_l->lock, flags); + } node = __local_list_pop_free(steal_loc_l); if (!node) @@ -482,16 +512,33 @@ static struct bpf_lru_node *bpf_common_lru_pop_free(struct bpf_lru *lru, raw_spin_unlock_irqrestore(&steal_loc_l->lock, flags); +next_steal: steal = get_next_cpu(steal); } while (!node && steal != first_steal); loc_l->next_steal = steal; - if (node) { - raw_spin_lock_irqsave(&loc_l->lock, flags); - __local_list_add_pending(lru, loc_l, cpu, node, hash); + if (!node) + return NULL; + + if (in_nmi()) { + if (!raw_spin_trylock_irqsave(&loc_l->lock, flags)) { + /* + * Could not re-acquire the local lock; publish the + * stolen node to the lockless per-CPU free_llist + * instead of orphaning it. + */ + node->type = BPF_LRU_LOCAL_LIST_T_FREE; + bpf_lru_node_clear_ref(node); + WRITE_ONCE(node->pending_free, 0); + llist_add(&node->llist, &loc_l->free_llist); + return NULL; + } + } else { raw_spin_unlock_irqrestore(&loc_l->lock, flags); } + __local_list_add_pending(lru, loc_l, cpu, node, hash); + raw_spin_unlock_irqrestore(&loc_l->lock, flags); return node; } @@ -519,7 +566,14 @@ static void bpf_common_lru_push_free(struct bpf_lru *lru, loc_l = per_cpu_ptr(lru->common_lru.local_list, node->cpu); - raw_spin_lock_irqsave(&loc_l->lock, flags); + if (in_nmi()) { + if (!raw_spin_trylock_irqsave(&loc_l->lock, flags)) { + WRITE_ONCE(node->pending_free, 1); + return; + } + } else { + raw_spin_lock_irqsave(&loc_l->lock, flags); + } if (unlikely(node->type != BPF_LRU_LOCAL_LIST_T_PENDING)) { raw_spin_unlock_irqrestore(&loc_l->lock, flags); @@ -528,9 +582,10 @@ static void bpf_common_lru_push_free(struct bpf_lru *lru, node->type = BPF_LRU_LOCAL_LIST_T_FREE; bpf_lru_node_clear_ref(node); - list_move(&node->list, local_free_list(loc_l)); + list_del(&node->list); raw_spin_unlock_irqrestore(&loc_l->lock, flags); + llist_add(&node->llist, &loc_l->free_llist); return; } @@ -546,7 +601,14 @@ static void bpf_percpu_lru_push_free(struct bpf_lru *lru, l = per_cpu_ptr(lru->percpu_lru, node->cpu); - raw_spin_lock_irqsave(&l->lock, flags); + if (in_nmi()) { + if (!raw_spin_trylock_irqsave(&l->lock, flags)) { + WRITE_ONCE(node->pending_free, 1); + return; + } + } else { + raw_spin_lock_irqsave(&l->lock, flags); + } __bpf_lru_node_move(l, node, BPF_LRU_LIST_T_FREE); @@ -573,6 +635,7 @@ static void bpf_common_lru_populate(struct bpf_lru *lru, void *buf, node = (struct bpf_lru_node *)(buf + node_offset); node->type = BPF_LRU_LIST_T_FREE; + node->pending_free = 0; bpf_lru_node_clear_ref(node); list_add(&node->list, &l->lists[BPF_LRU_LIST_T_FREE]); buf += elem_size; @@ -602,6 +665,7 @@ static void bpf_percpu_lru_populate(struct bpf_lru *lru, void *buf, node = (struct bpf_lru_node *)(buf + node_offset); node->cpu = cpu; node->type = BPF_LRU_LIST_T_FREE; + node->pending_free = 0; bpf_lru_node_clear_ref(node); list_add(&node->list, &l->lists[BPF_LRU_LIST_T_FREE]); i++; @@ -626,10 +690,8 @@ void bpf_lru_populate(struct bpf_lru *lru, void *buf, u32 node_offset, static void bpf_lru_locallist_init(struct bpf_lru_locallist *loc_l, int cpu) { - int i; - - for (i = 0; i < NR_BPF_LRU_LOCAL_LIST_T; i++) - INIT_LIST_HEAD(&loc_l->lists[i]); + INIT_LIST_HEAD(&loc_l->pending_list); + init_llist_head(&loc_l->free_llist); loc_l->next_steal = cpu; diff --git a/kernel/bpf/bpf_lru_list.h b/kernel/bpf/bpf_lru_list.h index fe2661a58ea9..5ed8831528af 100644 --- a/kernel/bpf/bpf_lru_list.h +++ b/kernel/bpf/bpf_lru_list.h @@ -6,11 +6,11 @@ #include <linux/cache.h> #include <linux/list.h> +#include <linux/llist.h> #include <linux/spinlock_types.h> #define NR_BPF_LRU_LIST_T (3) #define NR_BPF_LRU_LIST_COUNT (2) -#define NR_BPF_LRU_LOCAL_LIST_T (2) #define BPF_LOCAL_LIST_T_OFFSET NR_BPF_LRU_LIST_T enum bpf_lru_list_type { @@ -22,10 +22,23 @@ enum bpf_lru_list_type { }; struct bpf_lru_node { - struct list_head list; + /* + * A node is in at most one list at a time. The free path on the + * per-CPU locallist uses an llist, so share storage via a union. + */ + union { + struct list_head list; + struct llist_node llist; + }; u16 cpu; u8 type; u8 ref; + /* + * Marks nodes whose *_push_free() lock acquisition failed; these + * are reclaimed by flush/shrink which honor the flag instead of + * calling del_from_htab(). + */ + u8 pending_free; }; struct bpf_lru_list { @@ -38,7 +51,8 @@ struct bpf_lru_list { }; struct bpf_lru_locallist { - struct list_head lists[NR_BPF_LRU_LOCAL_LIST_T]; + struct list_head pending_list; + struct llist_head free_llist; u16 next_steal; raw_spinlock_t lock; }; -- 2.34.1

2 1

[PATCH] bpf: Reset register bounds before narrowing retval range in check_mem_access()
by Chen Yuxi 25 Aug '26

25 Aug '26

From: Tristan Madani <tristan(a)talencesecurity.com> When the BPF verifier processes a context load of an LSM hook return value, it calls __mark_reg_s32_range() to narrow the register to the hook's valid range. However, __mark_reg_s32_range() intersects the new range with the register's existing bounds using max_t()/min_t() rather than replacing them. If the destination register carries stale bounds from a prior instruction (e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than reality. The verifier then believes it knows the register's exact value, while at runtime the actual hook return value is loaded, creating a verifier/runtime mismatch that can be used to bypass BPF memory safety checks. The else branch already calls mark_reg_unknown() to reset register state before any narrowing. Apply the same reset in the is_retval path so stale bounds are cleared before __mark_reg_s32_range() intersects. Fixes: 5d99e198be27 ("bpf, lsm: Add check for BPF LSM return value") Cc: stable(a)vger.kernel.org Signed-off-by: Tristan Madani <tristan(a)talencesecurity.com> Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20260622230123.3695446-2-tristmd@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> --- kernel/bpf/verifier.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index a2b348f98080..21a365d436a5 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -6201,6 +6201,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b */ if (info.reg_type == SCALAR_VALUE) { if (info.is_retval && get_func_retval_range(env->prog, &range)) { + mark_reg_unknown(env, regs, value_regno); err = __mark_reg_s32_range(env, regs, value_regno, range.minval, range.maxval); if (err) -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] [openEuler-1.0-LTS] smb: client: validate DFS referral PathConsumed
by Lu Chentao 25 Aug '26

25 Aug '26

From: Yichong Chen <chenyichong(a)uniontech.com> mainline inclusion from mainline-v7.2-rc5 commit f6f5ee2aa33b350c671721b965251c42cebb962e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17157 CVE: CVE-2026-68343 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a PathConsumed value that is later used for DFS path parsing. If a malformed response provides a PathConsumed value larger than the search name, later DFS parsing can advance beyond the end of the path. Validate PathConsumed against the search name length before storing it in the parsed referral. Fixes: 4ecce920e13a ("CIFS: move DFS response parsing out of SMB1 code") Reviewed-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org> Signed-off-by: Yichong Chen <chenyichong(a)uniontech.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/misc.c [fs/cifs/misc.c: resolved via git 3-way merge of upstream f6f5ee2aa33b (clone base/theirs vs local); no overlap with local divergence] Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- fs/cifs/misc.c | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c index 17bd7901c4b7..ee24b080c41a 100644 --- a/fs/cifs/misc.c +++ b/fs/cifs/misc.c @@ -685,10 +685,12 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size, const char *searchName, bool is_unicode) { int i, rc = 0; char *data_end; struct dfs_referral_level_3 *ref; + unsigned int path_consumed; + size_t search_name_len; *num_of_nodes = le16_to_cpu(rsp->NumberOfReferrals); if (*num_of_nodes < 1) { cifs_dbg(VFS, "num_referrals: must be at least > 0, but we get num_referrals = %d\n", @@ -715,33 +717,47 @@ parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size, GFP_KERNEL); if (*target_nodes == NULL) { rc = -ENOMEM; goto parse_DFS_referrals_exit; } + search_name_len = strlen(searchName); /* collect necessary data from referrals */ for (i = 0; i < *num_of_nodes; i++) { char *temp; int max_len; struct dfs_info3_param *node = (*target_nodes)+i; node->flags = le32_to_cpu(rsp->DFSFlags); + path_consumed = le16_to_cpu(rsp->PathConsumed); if (is_unicode) { - __le16 *tmp = kmalloc(strlen(searchName)*2 + 2, - GFP_KERNEL); - if (tmp == NULL) { + size_t search_name_utf16_len = search_name_len * 2 + 2; + __le16 *tmp; + + if (path_consumed > search_name_utf16_len) { + rc = -EINVAL; + goto parse_DFS_referrals_exit; + } + + tmp = kmalloc(search_name_utf16_len, GFP_KERNEL); + if (!tmp) { rc = -ENOMEM; goto parse_DFS_referrals_exit; } - cifsConvertToUTF16((__le16 *) tmp, searchName, + cifsConvertToUTF16((__le16 *)tmp, searchName, PATH_MAX, nls_codepage, remap); - node->path_consumed = cifs_utf16_bytes(tmp, - le16_to_cpu(rsp->PathConsumed), - nls_codepage); + node->path_consumed = cifs_utf16_bytes(tmp, path_consumed, + nls_codepage); kfree(tmp); - } else - node->path_consumed = le16_to_cpu(rsp->PathConsumed); + } else { + if (path_consumed > search_name_len) { + rc = -EINVAL; + goto parse_DFS_referrals_exit; + } + + node->path_consumed = path_consumed; + } node->server_type = le16_to_cpu(ref->ServerType); node->ref_flag = le16_to_cpu(ref->ReferralEntryFlags); /* copy DfsPath */ -- 2.52.0

2 1

[PTACH openEuler-1.0-LTS] RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
by Chen Jinghuang 25 Aug '26

25 Aug '26

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v7.2-rc1 commit 449ae7927152e46acbe5f19f97eafdae6d3a96b1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18162 CVE: CVE-2026-74296 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Free the UAR index returned by the hardware. Fixes: 4ed131d0bb15 ("IB/mlx5: Expose dynamic mmap allocation") Link: https://patch.msgid.link/r/20260611-fix-uar-release-v1-1-f5464d845dbf@nvidi… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/hw/mlx5/main.c [ Context conflict ] Signed-off-by: Chen jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index 4f340d6db582..051de9f3ed82 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -2148,7 +2148,7 @@ static int uar_mmap(struct mlx5_ib_dev *dev, enum mlx5_ib_mmap_cmd cmd, if (!dyn_uar) return err; - mlx5_cmd_free_uar(dev->mdev, idx); + mlx5_cmd_free_uar(dev->mdev, uar_index); free_bfreg: mlx5_ib_free_bfreg(dev, bfregi, bfreg_dyn_idx); -- 2.34.1

1 0

[PATCH OLK-6.6] bpf: Reset register bounds before narrowing retval range in check_mem_access()
by Chen Yuxi 25 Aug '26

25 Aug '26

From: Tristan Madani <tristan(a)talencesecurity.com> mainline inclusion from mainline-v7.2-rc1 commit 5e0b273e0a62cc04ec338c7b502797c66c2ed42a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17522 CVE: CVE-2026-72111 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- When the BPF verifier processes a context load of an LSM hook return value, it calls __mark_reg_s32_range() to narrow the register to the hook's valid range. However, __mark_reg_s32_range() intersects the new range with the register's existing bounds using max_t()/min_t() rather than replacing them. If the destination register carries stale bounds from a prior instruction (e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than reality. The verifier then believes it knows the register's exact value, while at runtime the actual hook return value is loaded, creating a verifier/runtime mismatch that can be used to bypass BPF memory safety checks. The else branch already calls mark_reg_unknown() to reset register state before any narrowing. Apply the same reset in the is_retval path so stale bounds are cleared before __mark_reg_s32_range() intersects. Fixes: 5d99e198be27 ("bpf, lsm: Add check for BPF LSM return value") Cc: stable(a)vger.kernel.org Signed-off-by: Tristan Madani <tristan(a)talencesecurity.com> Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20260622230123.3695446-2-tristmd@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c [context conflicts] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/bpf/verifier.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 0f37807ed0c2..3de3edcb0344 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -6985,6 +6985,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn */ if (reg_type == SCALAR_VALUE) { if (is_retval && get_func_retval_range(env->prog, &range)) { + mark_reg_unknown(env, regs, value_regno); err = __mark_reg_s32_range(env, regs, value_regno, range.minval, range.maxval); if (err) -- 2.34.1

2 1

[PATCH OLK-5.10] [Backport] smb/client: handle overlapping allocated ranges in fallocate
by Lu Chentao 25 Aug '26

25 Aug '26

From: Huiwen He <hehuiwen(a)kylinos.cn> mainline inclusion from mainline-v7.2-rc4 commit b09ae45d85dc816987a71db9eebc54b0ae288e94 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17070 CVE: CVE-2026-68388 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled, but fallocate still returns success. A later write to that hole may therefore fail with ENOSPC. The function queries allocated ranges so that it can preserve existing contents and write zeroes only into holes. However, the server may return a range that starts before the current fallocate offset. For example, assume the fallocate request is [100, 400) and the only allocated range returned by the server is [0, 200): Request: [100, 400) Server range: [ 0, 200) allocated Correct: [100, 200) allocated data, skip [200, 400) hole, zero-fill Current: [100, 300) skipped [300, 400) zero-filled afterwards The current code adds the full server range length, 200, to the current offset 100 and moves to 300. As a result, the hole in [200, 300) is skipped without being zero-filled. Fix this by advancing only over the part of the allocated range that overlaps the current fallocate offset. Ignore ranges that end before the current offset and reject ranges whose end offset overflows. This also prevents a malformed range length from causing an out-of-bounds zero-buffer read. Fixes: 966a3cb7c7db ("cifs: improve fallocate emulation") Signed-off-by: Huiwen He <hehuiwen(a)kylinos.cn> Reviewed-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- fs/cifs/smb2ops.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index f46c99b61c04..dd72160a4bb4 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -3561,10 +3561,11 @@ static int smb3_simple_fallocate_range(unsigned int xid, loff_t off, loff_t len) { struct file_allocated_range_buffer in_data, *out_data = NULL, *tmp_data; u32 out_data_len; char *buf = NULL; + u64 range_start, range_len, range_end; loff_t l; int rc; in_data.file_offset = cpu_to_le64(off); in_data.length = cpu_to_le64(len); @@ -3597,17 +3598,25 @@ static int smb3_simple_fallocate_range(unsigned int xid, if (out_data_len < sizeof(struct file_allocated_range_buffer)) { rc = -EINVAL; goto out; } - if (off < le64_to_cpu(tmp_data->file_offset)) { + range_start = le64_to_cpu(tmp_data->file_offset); + range_len = le64_to_cpu(tmp_data->length); + if (check_add_overflow(range_start, range_len, &range_end) || + range_end > S64_MAX) { + rc = -EINVAL; + goto out; + } + + if (off < range_start) { /* * We are at a hole. Write until the end of the region * or until the next allocated data, * whichever comes next. */ - l = le64_to_cpu(tmp_data->file_offset) - off; + l = range_start - off; if (len < l) l = len; rc = smb3_simple_fallocate_write_range(xid, tcon, cfile, off, l, buf); if (rc) @@ -3620,15 +3629,17 @@ static int smb3_simple_fallocate_range(unsigned int xid, /* * We are at a section of allocated data, just skip forward * until the end of the data or the end of the region * we are supposed to fallocate, whichever comes first. */ - l = le64_to_cpu(tmp_data->length); - if (len < l) - l = len; - off += l; - len -= l; + if (off < range_end) { + l = range_end - off; + if (len < l) + l = len; + off += l; + len -= l; + } tmp_data = &tmp_data[1]; out_data_len -= sizeof(struct file_allocated_range_buffer); } -- 2.52.0

2 3

[PATCH OLK-5.10] RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
by Chen Jinghuang 25 Aug '26

25 Aug '26

From: Tristan Madani <tristmd(a)gmail.com> mainline inclusion from mainline-v7.2-rc1 commit d6ab440240a04b8737ee4c7bb21af9182e451733 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17929 CVE: CVE-2026-74377 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like num_sge or sge entries while the kernel is processing the WQE, leading to out-of-bounds reads in rxe_resp_check_length() and copy_data(). Introduce get_recv_wqe() that validates num_sge and copies the WQE to a kernel-local buffer before processing, matching the approach already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is reused since SRQ and non-SRQ paths are mutually exclusive per QP. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://patch.msgid.link/r/20260518215040.1598586-3-tristan@talencesecurity… Signed-off-by: Tristan Madani <tristan(a)talencesecurity.com> Reviewed-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/sw/rxe/rxe_resp.c [The target tree has an older rxe_queue API without a queue type argument and lacks the rxe_dbg_qp() logging macro. Adapted rxe_get_recv_wqe() to call queue_head(q) with the single argument signature and to log via pr_debug()/qp_num() instead of rxe_dbg_qp().] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_resp.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c index 83c03212099a..075001258f4e 100644 --- a/drivers/infiniband/sw/rxe/rxe_resp.c +++ b/drivers/infiniband/sw/rxe/rxe_resp.c @@ -328,6 +328,29 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp) return RESPST_CHK_LENGTH; } +static enum resp_states rxe_get_recv_wqe(struct rxe_qp *qp) +{ + struct rxe_queue *q = qp->rq.queue; + struct rxe_recv_wqe *wqe; + unsigned int num_sge; + size_t size; + + wqe = queue_head(q); + if (!wqe) + return RESPST_ERR_RNR; + + num_sge = wqe->dma.num_sge; + if (unlikely(num_sge > qp->rq.max_sge)) { + pr_debug("qp#%d invalid num_sge in recv WQE\n", qp_num(qp)); + return RESPST_ERR_MALFORMED_WQE; + } + size = sizeof(*wqe) + num_sge * sizeof(struct rxe_sge); + memcpy(&qp->resp.srq_wqe, wqe, size); + + qp->resp.wqe = &qp->resp.srq_wqe.wqe; + return RESPST_CHK_LENGTH; +} + static enum resp_states check_resource(struct rxe_qp *qp, struct rxe_pkt_info *pkt) { @@ -365,8 +388,7 @@ static enum resp_states check_resource(struct rxe_qp *qp, if (srq) return get_srq_wqe(qp); - qp->resp.wqe = queue_head(qp->rq.queue); - return (qp->resp.wqe) ? RESPST_CHK_LENGTH : RESPST_ERR_RNR; + return rxe_get_recv_wqe(qp); } return RESPST_CHK_LENGTH; -- 2.34.1

2 1

[PATCH OLK-6.6] perf/core: Fix group leader use-after-free after sibling detach
by Luo Gengkun 25 Aug '26

25 Aug '26

From: Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> stable inclusion from stable-v7.2 commit 42c5ca1f0a288a52878bd72a5595b08261057438 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18309 CVE: CVE-2026-74637 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- perf_group_detach() handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their group_leader pointer is reset to themselves. When a sibling is detached, it is removed from the leader's sibling_list, but its group_leader pointer is left pointing at the old leader. That is harmless when the sibling is being closed and freed immediately, as in the DETACH_DEAD path. It is not safe when the sibling is detached but kept alive, such as during CPU hotplug with DETACH_GROUP. In that case the sibling is removed from the context, while its file descriptor can still keep it alive. A typical failing sequence is: - A group contains leader L and sibling S. - CPU hot-unplug detaches S with DETACH_GROUP, removing it from L->sibling_list but leaving S->group_leader == L. - L is later closed and freed. - A PERF_IOC_FLAG_GROUP ioctl on S follows S->group_leader and dereferences the freed leader. This was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT pc : perf_ioctl+0x34c/0xc68 x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908) Call trace: perf_ioctl+0x34c/0xc68 (P) __arm64_sys_ioctl+0xa0/0xf4 invoke_syscall+0x58/0xe4 el0_svc_common+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x40/0xc0 el0t_64_sync_handler+0x68/0xdc el0t_64_sync+0x1c4/0x1c8 The fault happened in perf_ioctl(), where perf_event_for_each() follows the stale group_leader pointer and perf_event_for_each_child() then dereferences the freed leader's context. Fix the use-after-free by promoting the detached sibling to a singleton. Also fix __event_disable() cgroup accounting and event state change. Fixes: 8a49542c0554 ("perf_events: Fix races in group composition") Assisted-by: PatchWise:gpt-5.5 Signed-off-by: Aditya Chillara <aditya.chillara(a)oss.qualcomm.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi(a)linux.intel.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260807-fix-group-leader-uaf-v3-1-b0c2310c9a0d@os… Conflicts: kernel/events/core.c [Fix simple ctx diff.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 66 +++++++++++++++++++++++++------------------- 1 file changed, 37 insertions(+), 29 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 6916dc78b0e7..9a779ca76798 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -2163,6 +2163,34 @@ static inline struct list_head *get_event_list(struct perf_event *event) &event->pmu_ctx->flexible_active; } +/* @sibling must already be unlinked from its old leader's sibling_list. */ +static void perf_promote_sibling_to_leader(struct perf_event *sibling, + struct perf_event_context *ctx, + int group_caps) +{ + /* + * Events that have PERF_EV_CAP_SIBLING require being part of + * a group and cannot exist on their own, schedule them out + * and move them into the ERROR state. Also see + * _perf_event_enable(), it will not be able to recover this + * ERROR state. + */ + if (sibling->event_caps & PERF_EV_CAP_SIBLING) + __event_disable(sibling, ctx, PERF_EVENT_STATE_ERROR); + + sibling->group_leader = sibling; + sibling->group_caps = group_caps; + + if (sibling->attach_state & PERF_ATTACH_CONTEXT) { + add_event_to_groups(sibling, ctx); + + if (sibling->state == PERF_EVENT_STATE_ACTIVE) + list_add_tail(&sibling->active_list, get_event_list(sibling)); + } + + perf_event__header_size(sibling); +} + static void perf_group_detach(struct perf_event *event) { struct perf_event *leader = event->group_leader; @@ -2186,8 +2214,9 @@ static void perf_group_detach(struct perf_event *event) */ if (leader != event) { list_del_init(&event->sibling_list); - event->group_leader->nr_siblings--; - event->group_leader->group_generation++; + leader->nr_siblings--; + leader->group_generation++; + perf_promote_sibling_to_leader(event, ctx, event->event_caps); goto out; } @@ -2197,32 +2226,14 @@ static void perf_group_detach(struct perf_event *event) * to whatever list we are on. */ list_for_each_entry_safe(sibling, tmp, &event->sibling_list, sibling_list) { - - /* - * Events that have PERF_EV_CAP_SIBLING require being part of - * a group and cannot exist on their own, schedule them out - * and move them into the ERROR state. Also see - * _perf_event_enable(), it will not be able to recover this - * ERROR state. - */ - if (sibling->event_caps & PERF_EV_CAP_SIBLING) - __event_disable(sibling, ctx, PERF_EVENT_STATE_ERROR); - - sibling->group_leader = sibling; list_del_init(&sibling->sibling_list); /* Inherit group flags from the previous leader */ - sibling->group_caps = event->group_caps; - - if (sibling->attach_state & PERF_ATTACH_CONTEXT) { - add_event_to_groups(sibling, event->ctx); - - if (sibling->state == PERF_EVENT_STATE_ACTIVE) - list_add_tail(&sibling->active_list, get_event_list(sibling)); - } + perf_promote_sibling_to_leader(sibling, ctx, event->group_caps); WARN_ON_ONCE(sibling->ctx != event->ctx); } + event->nr_siblings = 0; out: for_each_sibling_event(tmp, leader) @@ -2389,12 +2400,8 @@ __perf_remove_from_context(struct perf_event *event, if (flags & DETACH_DEAD) state = PERF_EVENT_STATE_DEAD; - event_sched_out(event, ctx); + __event_disable(event, ctx, state); - if (event->state > PERF_EVENT_STATE_OFF) - perf_cgroup_event_disable(event, ctx); - - perf_event_set_state(event, min(event->state, state)); if (flags & DETACH_GROUP) perf_group_detach(event); if (flags & DETACH_CHILD) @@ -2463,8 +2470,9 @@ static void __event_disable(struct perf_event *event, enum perf_event_state state) { event_sched_out(event, ctx); - perf_cgroup_event_disable(event, ctx); - perf_event_set_state(event, state); + if (event->state > PERF_EVENT_STATE_OFF) + perf_cgroup_event_disable(event, ctx); + perf_event_set_state(event, min(event->state, state)); } /* -- 2.34.1

2 1

[PATCH OLK-5.10 V1] IB/mad: Drop unmatched RMPP responses before reassembly
by Yao Yiqi 24 Aug '26

24 Aug '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.148 commit dfa535c94406c03d3f0c869ef3ba5528e395737c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17033 CVE: CVE-2026-68425 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d2e52d610b9b09694261632340b801a421e0b0c5 ] Kernel-handled RMPP receive processing starts reassembly for active DATA responses before the response is matched to an outstanding send. The normal match happens later, after ib_process_rmpp_recv_wc() has either assembled a complete message or consumed the segment. That ordering lets an unsolicited response that routes to a kernel RMPP agent by the high TID bits allocate or extend RMPP receive state before the full TID and source address are checked against a real request. A reordered burst can therefore reach the receive-side insertion path even though the response would not match any send. For kernel-handled RMPP DATA responses, require the existing ib_find_send_mad() match before entering RMPP reassembly. The matcher already checks the full TID, management class and source address/GID against the agent wait, backlog and in-flight send lists. If there is no match, drop the response without creating RMPP state. This leaves the RMPP window behavior unchanged and only rejects responses that have no corresponding request. Fixes: fa619a77046b ("[PATCH] IB: Add RMPP implementation") Assisted-by: Codex:gpt-5-5-xhigh Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Link: https://patch.msgid.link/3170ff3bc389a930bb1641f2caa394a0b2241579.178077490… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- drivers/infiniband/core/mad.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c index 521c3d050be2..5c3bfed683d6 100644 --- a/drivers/infiniband/core/mad.c +++ b/drivers/infiniband/core/mad.c @@ -1788,6 +1788,24 @@ void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr) &mad_send_wr->mad_agent_priv->done_list); } +static bool is_kernel_rmpp_data_response(struct ib_mad_agent_private *agent, + struct ib_mad_recv_wc *mad_recv_wc) +{ + const struct ib_mad_hdr *mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr; + struct ib_rmpp_mad *rmpp_mad; + + if (!ib_mad_kernel_rmpp_agent(&agent->agent) || + !ib_response_mad(mad_hdr) || + !ib_is_mad_class_rmpp(mad_hdr->mgmt_class)) + return false; + + rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad; + + return (ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) & + IB_MGMT_RMPP_FLAG_ACTIVE) && + rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_DATA; +} + static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv, struct ib_mad_recv_wc *mad_recv_wc) { @@ -1806,6 +1824,18 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv, } list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list); + if (is_kernel_rmpp_data_response(mad_agent_priv, mad_recv_wc)) { + spin_lock_irqsave(&mad_agent_priv->lock, flags); + mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc); + spin_unlock_irqrestore(&mad_agent_priv->lock, flags); + + if (!mad_send_wr) { + ib_free_recv_mad(mad_recv_wc); + deref_mad_agent(mad_agent_priv); + return; + } + } + if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) { mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv, mad_recv_wc); -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS V1] IB/mad: Drop unmatched RMPP responses before reassembly
by Yao Yiqi 24 Aug '26

24 Aug '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.148 commit dfa535c94406c03d3f0c869ef3ba5528e395737c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17033 CVE: CVE-2026-68425 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d2e52d610b9b09694261632340b801a421e0b0c5 ] Kernel-handled RMPP receive processing starts reassembly for active DATA responses before the response is matched to an outstanding send. The normal match happens later, after ib_process_rmpp_recv_wc() has either assembled a complete message or consumed the segment. That ordering lets an unsolicited response that routes to a kernel RMPP agent by the high TID bits allocate or extend RMPP receive state before the full TID and source address are checked against a real request. A reordered burst can therefore reach the receive-side insertion path even though the response would not match any send. For kernel-handled RMPP DATA responses, require the existing ib_find_send_mad() match before entering RMPP reassembly. The matcher already checks the full TID, management class and source address/GID against the agent wait, backlog and in-flight send lists. If there is no match, drop the response without creating RMPP state. This leaves the RMPP window behavior unchanged and only rejects responses that have no corresponding request. Fixes: fa619a77046b ("[PATCH] IB: Add RMPP implementation") Assisted-by: Codex:gpt-5-5-xhigh Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Link: https://patch.msgid.link/3170ff3bc389a930bb1641f2caa394a0b2241579.178077490… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- drivers/infiniband/core/mad.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c index 218411282069..4b08915c60ae 100644 --- a/drivers/infiniband/core/mad.c +++ b/drivers/infiniband/core/mad.c @@ -1987,6 +1987,24 @@ void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr) &mad_send_wr->mad_agent_priv->done_list); } +static bool is_kernel_rmpp_data_response(struct ib_mad_agent_private *agent, + struct ib_mad_recv_wc *mad_recv_wc) +{ + const struct ib_mad_hdr *mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr; + struct ib_rmpp_mad *rmpp_mad; + + if (!ib_mad_kernel_rmpp_agent(&agent->agent) || + !ib_response_mad(mad_hdr) || + !ib_is_mad_class_rmpp(mad_hdr->mgmt_class)) + return false; + + rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad; + + return (ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) & + IB_MGMT_RMPP_FLAG_ACTIVE) && + rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_DATA; +} + static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv, struct ib_mad_recv_wc *mad_recv_wc) { @@ -2005,6 +2023,18 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv, } list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list); + if (is_kernel_rmpp_data_response(mad_agent_priv, mad_recv_wc)) { + spin_lock_irqsave(&mad_agent_priv->lock, flags); + mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc); + spin_unlock_irqrestore(&mad_agent_priv->lock, flags); + + if (!mad_send_wr) { + ib_free_recv_mad(mad_recv_wc); + deref_mad_agent(mad_agent_priv); + return; + } + } + if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) { mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv, mad_recv_wc); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/mlx5: Fix undefined shift of user RQ WQE size
by Chen Jinghuang 24 Aug '26

24 Aug '26

From: Maher Sanalla <msanalla(a)nvidia.com> mainline inclusion from mainline-v7.2-rc1 commit d881d60223aac8fdc12b227d89c76e131e92a9cd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18115 CVE: CVE-2026-74297 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior. Use check_shl_overflow() to compute the RQ WQE size and reject any invalid values. Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") Link: https://patch.msgid.link/r/20260611-maher-sec-fixes-v1-1-cd8eb2542869@nvidi… Signed-off-by: Maher Sanalla <msanalla(a)nvidia.com> Signed-off-by: Edward Srouji <edwards(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/hw/mlx5/qp.c [a trival context conflict] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/hw/mlx5/qp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c index ef0f710587ad..ec1b3d8e16ce 100644 --- a/drivers/infiniband/hw/mlx5/qp.c +++ b/drivers/infiniband/hw/mlx5/qp.c @@ -260,12 +260,12 @@ static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap, } else { if (ucmd) { qp->rq.wqe_cnt = ucmd->rq_wqe_count; - if (ucmd->rq_wqe_shift > BITS_PER_BYTE * sizeof(ucmd->rq_wqe_shift)) - return -EINVAL; qp->rq.wqe_shift = ucmd->rq_wqe_shift; - if ((1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) < qp->wq_sig) + if (check_shl_overflow(1, qp->rq.wqe_shift, &wqe_size)) return -EINVAL; - qp->rq.max_gs = (1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) - qp->wq_sig; + if (wqe_size / sizeof(struct mlx5_wqe_data_seg) < qp->wq_sig) + return -EINVAL; + qp->rq.max_gs = wqe_size / sizeof(struct mlx5_wqe_data_seg) - qp->wq_sig; qp->rq.max_post = qp->rq.wqe_cnt; } else { wqe_size = qp->wq_sig ? sizeof(struct mlx5_wqe_signature_seg) : 0; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/mlx5: Fix undefined shift of user RQ WQE size
by Chen Jinghuang 24 Aug '26

24 Aug '26

From: Maher Sanalla <msanalla(a)nvidia.com> mainline inclusion from mainline-v7.2-rc1 commit d881d60223aac8fdc12b227d89c76e131e92a9cd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18115 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shift of 31 also overflows a signed integer, leading to undefined behavior. Use check_shl_overflow() to compute the RQ WQE size and reject any invalid values. Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") Link: https://patch.msgid.link/r/20260611-maher-sec-fixes-v1-1-cd8eb2542869@nvidi… Signed-off-by: Maher Sanalla <msanalla(a)nvidia.com> Signed-off-by: Edward Srouji <edwards(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/hw/mlx5/qp.c [a trival context conflict] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/hw/mlx5/qp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c index ef0f710587ad..818dedb69b1f 100644 --- a/drivers/infiniband/hw/mlx5/qp.c +++ b/drivers/infiniband/hw/mlx5/qp.c @@ -260,12 +260,12 @@ static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap, } else { if (ucmd) { qp->rq.wqe_cnt = ucmd->rq_wqe_count; - if (ucmd->rq_wqe_shift > BITS_PER_BYTE * sizeof(ucmd->rq_wqe_shift)) - return -EINVAL; qp->rq.wqe_shift = ucmd->rq_wqe_shift; - if ((1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) < qp->wq_sig) + if (check_shl_overflow(1, qp->rq.wqe_shift, &wqe_size)) return -EINVAL; - qp->rq.max_gs = (1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) - qp->wq_sig; + if (wqe_size / sizeof(struct mlx5_wqe_data_seg) < wq_sig) + return -EINVAL; + qp->rq.max_gs = wqe_size / sizeof(struct mlx5_wqe_data_seg) - qp->wq_sig; qp->rq.max_post = qp->rq.wqe_cnt; } else { wqe_size = qp->wq_sig ? sizeof(struct mlx5_wqe_signature_seg) : 0; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
by Chen Jinghuang 24 Aug '26

24 Aug '26

From: Tristan Madani <tristmd(a)gmail.com> mainline inclusion from mainline-v7.2-rc3 commit d6ab440240a04b8737ee4c7bb21af9182e451733 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17929 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like num_sge or sge entries while the kernel is processing the WQE, leading to out-of-bounds reads in rxe_resp_check_length() and copy_data(). Introduce get_recv_wqe() that validates num_sge and copies the WQE to a kernel-local buffer before processing, matching the approach already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is reused since SRQ and non-SRQ paths are mutually exclusive per QP. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://patch.msgid.link/r/20260518215040.1598586-3-tristan@talencesecurity… Signed-off-by: Tristan Madani <tristan(a)talencesecurity.com> Reviewed-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/sw/rxe/rxe_resp.c [4.19 rxe_queue_head() takes a single argument (no QUEUE_TYPE_FROM_CLIENT) and the rxe_dbg_qp() debug macro does not exist in this tree; adapted to use queue_head(q) and pr_err().] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_resp.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c index 9078cfd3b8bd..ad889e0b860a 100644 --- a/drivers/infiniband/sw/rxe/rxe_resp.c +++ b/drivers/infiniband/sw/rxe/rxe_resp.c @@ -359,6 +359,29 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp) return RESPST_CHK_LENGTH; } +static enum resp_states rxe_get_recv_wqe(struct rxe_qp *qp) +{ + struct rxe_queue *q = qp->rq.queue; + struct rxe_recv_wqe *wqe; + unsigned int num_sge; + size_t size; + + wqe = queue_head(q); + if (!wqe) + return RESPST_ERR_RNR; + + num_sge = wqe->dma.num_sge; + if (unlikely(num_sge > qp->rq.max_sge)) { + pr_err("QP#%d invalid num_sge in recv WQE\n", qp_num(qp)); + return RESPST_ERR_MALFORMED_WQE; + } + size = sizeof(*wqe) + num_sge * sizeof(struct rxe_sge); + memcpy(&qp->resp.srq_wqe, wqe, size); + + qp->resp.wqe = &qp->resp.srq_wqe.wqe; + return RESPST_CHK_LENGTH; +} + static enum resp_states check_resource(struct rxe_qp *qp, struct rxe_pkt_info *pkt) { @@ -396,8 +419,7 @@ static enum resp_states check_resource(struct rxe_qp *qp, if (srq) return get_srq_wqe(qp); - qp->resp.wqe = queue_head(qp->rq.queue); - return (qp->resp.wqe) ? RESPST_CHK_LENGTH : RESPST_ERR_RNR; + return rxe_get_recv_wqe(qp); } return RESPST_CHK_LENGTH; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ipv4: validate IPV4_DEVCONF attributes properly
by JiangJieHua 24 Aug '26

24 Aug '26

mainline inclusion from mainline-v7.1-rc1 commit fa8fca88714c3a4a74f972ed37328e2f0bbef9fa category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The IPV4_DEVCONF_MC_FORWARDING counter is maintained by the kernel (vif_add/vif_delete), but inet_set_link_af() wrote it without any validation, allowing user space to set it to INT_MIN via RTM_NEWLINK + IFLA_INET_CONF. A following MRT_DEL_VIF then triggers a signed integer overflow in vif_delete(): UBSAN: Undefined behaviour in net/ipv4/ipmr.c:720 -2147483648 - 1 cannot be represented in type 'int' Backport of upstream commit fa8fca88714c ("ipv4: validate IPV4_DEVCONF attributes properly"), adapted for 4.19 which lacks NLA_REJECT and NLA_POLICY_RANGE. The upstream NLA_REJECT policy for MC_FORWARDING is equivalently implemented by an explicit check in inet_validate_link_af(). Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/devinet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 64f0fa0be370..70cbeacf8257 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -1796,6 +1796,9 @@ static int inet_validate_link_af(const struct net_device *dev, if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX) return -EINVAL; + + if (cfgid == IPV4_DEVCONF_MC_FORWARDING) + return -EINVAL; } } -- 2.33.8

2 1

[PATCH OLK-5.10] ipv4: validate IPV4_DEVCONF attributes properly
by JiangJieHua 24 Aug '26

24 Aug '26

From: Fernando Fernandez Mancera <fmancera(a)suse.de> mainline inclusion from mainline-v7.1-rc1 commit fa8fca88714c3a4a74f972ed37328e2f0bbef9fa category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As the IPV4_DEVCONF netlink attributes are not being validated, it is possible to use netlink to set read-only values like mc_forwarding. In addition, valid ranges are not being validated neither but that is less relevant as they aren't in sysctl. To avoid similar situations in the future, define a NLA policy for IPV4_DEVCONF attributes which are nested in IFLA_INET_CONF. Signed-off-by: Fernando Fernandez Mancera <fmancera(a)suse.de> Link: https://patch.msgid.link/20260312142637.5704-1-fmancera@suse.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/devinet.c | 54 ++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 44 insertions(+), 10 deletions(-) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 9ac7d47..6cacc8cc 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -1964,11 +1964,48 @@ static int inet_fill_link_af(struct sk_buff *skb, const struct net_device *dev, [IFLA_INET_CONF] = { .type = NLA_NESTED }, }; +static const struct nla_policy inet_devconf_policy[IPV4_DEVCONF_MAX + 1] = { + [IPV4_DEVCONF_FORWARDING] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_MC_FORWARDING] = { .type = NLA_REJECT }, + [IPV4_DEVCONF_PROXY_ARP] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_ACCEPT_REDIRECTS] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_SECURE_REDIRECTS] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_SEND_REDIRECTS] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_SHARED_MEDIA] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_RP_FILTER] = NLA_POLICY_RANGE(NLA_U32, 0, 2), + [IPV4_DEVCONF_ACCEPT_SOURCE_ROUTE] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_BOOTP_RELAY] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_LOG_MARTIANS] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_TAG] = { .type = NLA_U32 }, + [IPV4_DEVCONF_ARPFILTER] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_MEDIUM_ID] = NLA_POLICY_MIN(NLA_S32, -1), + [IPV4_DEVCONF_NOXFRM] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_NOPOLICY] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_FORCE_IGMP_VERSION] = NLA_POLICY_RANGE(NLA_U32, 0, 3), + [IPV4_DEVCONF_ARP_ANNOUNCE] = NLA_POLICY_RANGE(NLA_U32, 0, 2), + [IPV4_DEVCONF_ARP_IGNORE] = NLA_POLICY_RANGE(NLA_U32, 0, 8), + [IPV4_DEVCONF_PROMOTE_SECONDARIES] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_ARP_ACCEPT] = NLA_POLICY_RANGE(NLA_U32, 0, 2), + [IPV4_DEVCONF_ARP_NOTIFY] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_ACCEPT_LOCAL] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_SRC_VMARK] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_PROXY_ARP_PVLAN] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_ROUTE_LOCALNET] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_BC_FORWARDING] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_IGMPV2_UNSOLICITED_REPORT_INTERVAL] = { .type = NLA_U32 }, + [IPV4_DEVCONF_IGMPV3_UNSOLICITED_REPORT_INTERVAL] = { .type = NLA_U32 }, + [IPV4_DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN] = + NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_DROP_UNICAST_IN_L2_MULTICAST] = + NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_DROP_GRATUITOUS_ARP] = NLA_POLICY_RANGE(NLA_U32, 0, 1), +}; + static int inet_validate_link_af(const struct net_device *dev, const struct nlattr *nla) { - struct nlattr *a, *tb[IFLA_INET_MAX+1]; - int err, rem; + struct nlattr *tb[IFLA_INET_MAX + 1], *nested_tb[IPV4_DEVCONF_MAX + 1]; + int err; if (dev && !__in_dev_get_rcu(dev)) return -EAFNOSUPPORT; @@ -1979,15 +2016,12 @@ static int inet_validate_link_af(const struct net_device *dev, return err; if (tb[IFLA_INET_CONF]) { - nla_for_each_nested(a, tb[IFLA_INET_CONF], rem) { - int cfgid = nla_type(a); + err = nla_parse_nested(nested_tb, IPV4_DEVCONF_MAX, + tb[IFLA_INET_CONF], inet_devconf_policy, + NULL); - if (nla_len(a) < 4) - return -EINVAL; - - if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX) - return -EINVAL; - } + if (err < 0) + return err; } return 0; -- 1.8.3.1

2 1

[PATCH OLK-5.10] tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
by Jinjiang Tu 24 Aug '26

24 Aug '26

From: Doruk Tan Ozturk <doruk(a)0sec.ai> stable inclusion from stable-v5.10.260 commit 171d31245d11bf84836fad3b394cb465a4d008ec category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16132 CVE: CVE-2026-63801 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bda3348872a2ef0d19f2df6aa8cb5025adce2f20 upstream. tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a reference on the netns, unlike the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously (e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the per-netns tipc_crypto, and the completion then reads it: tipc_aead_decrypt_done() dereferences aead->crypto->stats and aead->crypto->net, and tipc_crypto_rcv_complete() dereferences aead->crypto->aead[] and the node table -- reading freed memory. Decoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO): BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999) Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51 Workqueue: events_unbound Call Trace: tipc_aead_decrypt_done (net/tipc/crypto.c:999) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Allocated by task 169: __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) tipc_crypto_start (net/tipc/crypto.c:1502) tipc_init_net (net/tipc/core.c:72) ops_init (net/core/net_namespace.c:137) setup_net (net/core/net_namespace.c:446) copy_net_ns (net/core/net_namespace.c:579) create_new_namespaces (kernel/nsproxy.c:132) __x64_sys_unshare (kernel/fork.c:3316) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Freed by task 8: kfree (mm/slub.c:6566) tipc_exit_net (net/tipc/core.c:119) cleanup_net (net/core/net_namespace.c:704) process_one_work (kernel/workqueue.c:3314) kthread (kernel/kthread.c:436) This is the same class of bug that commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") fixed for the encrypt side. The encrypt path takes maybe_get_net(aead->crypto->net) before crypto_aead_encrypt() and drops it with put_net() on the synchronous return paths and in tipc_aead_encrypt_done(); the -EINPROGRESS/-EBUSY return keeps the reference for the async callback to release. The decrypt path was left without the equivalent guard. Mirror the encrypt-side fix on the decrypt path: take a net reference before crypto_aead_decrypt() (failing with -ENODEV and the matching bearer put if it cannot be acquired), keep it across the -EINPROGRESS/-EBUSY async return, and drop it with put_net() on the synchronous success/error return and at the end of tipc_aead_decrypt_done(). Reproduced under KASAN on v7.1-rc7: a UDP bearer with a cluster key is flooded with crafted encrypted frames from an unknown peer (driving the cluster-key decrypt path) while the bearer's netns is repeatedly torn down. The completion must run asynchronously to outlive tipc_crypto_stop(); on x86 the stock aesni gcm(aes) now decrypts synchronously, so the async path was exercised via cryptd offload. The unguarded aead->crypto dereference in tipc_aead_decrypt_done() is the unpatched upstream path; tipc_aead_decrypt() still lacks maybe_get_net(aead->crypto->net), so the completion can outlive the free on any config where crypto_aead_decrypt() goes async. Found by 0sec automated security-research tooling (https://0sec.ai) Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") Cc: stable(a)vger.kernel.org Signed-off-by: Doruk Tan Ozturk <doruk(a)0sec.ai> Reviewed-by: Alexander Lobakin <aleksander.lobakin(a)intel.com> Reviewed-by: Tung Nguyen <tung.quang.nguyen(a)est.tech> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20260617075818.37431-1-doruk@0sec.ai Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/tipc/crypto.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c index 86dbc4ddc1dc..5e8dd0693b8b 100644 --- a/net/tipc/crypto.c +++ b/net/tipc/crypto.c @@ -954,12 +954,20 @@ static int tipc_aead_decrypt(struct net *net, struct tipc_aead *aead, goto exit; } + /* Get net to avoid freed tipc_crypto when delete namespace */ + if (!maybe_get_net(net)) { + tipc_bearer_put(b); + rc = -ENODEV; + goto exit; + } + /* Now, do decrypt */ rc = crypto_aead_decrypt(req); if (rc == -EINPROGRESS || rc == -EBUSY) return rc; tipc_bearer_put(b); + put_net(net); exit: kfree(ctx); @@ -997,6 +1005,7 @@ static void tipc_aead_decrypt_done(struct crypto_async_request *base, int err) } tipc_bearer_put(b); + put_net(net); } static inline int tipc_ehdr_size(struct tipc_ehdr *ehdr) -- 2.43.0

2 1

[PATCH OLK-5.10] tipc: fix out-of-bounds read in broadcast Gap ACK blocks
by Jinjiang Tu 24 Aug '26

24 Aug '26

From: Samuel Page <sam(a)bynar.io> stable inclusion from stable-v5.10.261 commit 055663d21dc4336f67933ab26bef3c5934be6324 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16741 CVE: CVE-2026-64450 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2b66974a1b6134a4bbc3bfed181f7418f688eb54 upstream. A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its data area. tipc_get_gap_ack_blks() only verifies that the record's len field is self-consistent with its ugack_cnt/bgack_cnt counts (sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check that the record actually fits in the message data area, msg_data_sz(). The unicast caller tipc_link_proto_rcv() bounds it ("if (glen > dlen) break;"), but the broadcast caller tipc_bcast_sync_rcv() discards the returned size, so tipc_link_advance_transmq() copies the record off the receive skb with an attacker-controlled count: this_ga = kmemdup(ga, struct_size(ga, gacks, ga->bgack_cnt), GFP_ATOMIC); A TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK triggers it with one ordinary broadcast STATE_MSG (msg_bc_ack_invalid() clear), sized so its data area is short, carrying a Gap ACK record with len = 0x400, bgack_cnt = 0xff and ugack_cnt = 0. len then equals struct_size(p, gacks, 255), so the consistency check passes and ga is non-NULL; kmemdup() reads struct_size(ga, gacks, 255) = 1024 bytes out of the much smaller skb: BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x48/0x60 Read of size 1024 at addr ffff0000c7030d38 by task poc864/69 Call trace: kmemdup_noprof+0x48/0x60 tipc_link_advance_transmq+0x86c/0xb80 tipc_link_bc_ack_rcv+0x19c/0x1e0 tipc_bcast_sync_rcv+0x1c4/0x2c4 tipc_rcv+0x85c/0x1340 tipc_l2_rcv_msg+0xac/0x104 The buggy address belongs to the object at ffff0000c7030d00 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 56 bytes inside of allocated 704-byte region [ffff0000c7030d00, ffff0000c7030fc0) The copied-out bytes are subsequently consumed as gap/ack values, but the read is already out of bounds at the kmemdup() regardless of how they are used. The unicast STATE path drops such a message: "if (glen > dlen) break;" skips the rest of STATE_MSG handling and the skb is freed. Make the broadcast path drop it too. tipc_bcast_sync_rcv() now bounds the record against msg_data_sz() and, when it does not fit, reports it back through tipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded rather than processed. ga is not cleared on this path: ga == NULL already means "legacy peer without Selective ACK", a distinct legitimate state. Fixes: d7626b5acff9 ("tipc: introduce Gap ACK blocks for broadcast link") Cc: stable(a)vger.kernel.org Signed-off-by: Samuel Page <sam(a)bynar.io> Reviewed-by: Tung Nguyen <tung.quang.nguyen(a)est.tech> Link: https://patch.msgid.link/20260625143815.1525412-1-sam@bynar.io Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/tipc/bcast.c | 22 ++++++++++++++-------- net/tipc/bcast.h | 2 +- net/tipc/node.c | 15 ++++++++++++--- 3 files changed, 27 insertions(+), 12 deletions(-) diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c index 593846d25214..631b98097dba 100644 --- a/net/tipc/bcast.c +++ b/net/tipc/bcast.c @@ -497,12 +497,13 @@ void tipc_bcast_ack_rcv(struct net *net, struct tipc_link *l, */ int tipc_bcast_sync_rcv(struct net *net, struct tipc_link *l, struct tipc_msg *hdr, - struct sk_buff_head *retrq) + struct sk_buff_head *retrq, bool *valid) { struct sk_buff_head *inputq = &tipc_bc_base(net)->inputq; struct tipc_gap_ack_blks *ga; struct sk_buff_head xmitq; int rc = 0; + u16 glen; __skb_queue_head_init(&xmitq); @@ -510,13 +511,18 @@ int tipc_bcast_sync_rcv(struct net *net, struct tipc_link *l, if (msg_type(hdr) != STATE_MSG) { tipc_link_bc_init_rcv(l, hdr); } else if (!msg_bc_ack_invalid(hdr)) { - tipc_get_gap_ack_blks(&ga, l, hdr, false); - if (!sysctl_tipc_bc_retruni) - retrq = &xmitq; - rc = tipc_link_bc_ack_rcv(l, msg_bcast_ack(hdr), - msg_bc_gap(hdr), ga, &xmitq, - retrq); - rc |= tipc_link_bc_sync_rcv(l, hdr, &xmitq); + glen = tipc_get_gap_ack_blks(&ga, l, hdr, false); + if (glen > msg_data_sz(hdr)) { + /* Malformed Gap ACK blocks; caller drops the msg */ + *valid = false; + } else { + if (!sysctl_tipc_bc_retruni) + retrq = &xmitq; + rc = tipc_link_bc_ack_rcv(l, msg_bcast_ack(hdr), + msg_bc_gap(hdr), ga, &xmitq, + retrq); + rc |= tipc_link_bc_sync_rcv(l, hdr, &xmitq); + } } tipc_bcast_unlock(net); diff --git a/net/tipc/bcast.h b/net/tipc/bcast.h index 2d9352dc7b0e..55d17b5413e1 100644 --- a/net/tipc/bcast.h +++ b/net/tipc/bcast.h @@ -97,7 +97,7 @@ void tipc_bcast_ack_rcv(struct net *net, struct tipc_link *l, struct tipc_msg *hdr); int tipc_bcast_sync_rcv(struct net *net, struct tipc_link *l, struct tipc_msg *hdr, - struct sk_buff_head *retrq); + struct sk_buff_head *retrq, bool *valid); int tipc_nl_add_bc_link(struct net *net, struct tipc_nl_msg *msg, struct tipc_link *bcl); int tipc_nl_bc_link_set(struct net *net, struct nlattr *attrs[]); diff --git a/net/tipc/node.c b/net/tipc/node.c index 5f6866407be5..8e52b2995817 100644 --- a/net/tipc/node.c +++ b/net/tipc/node.c @@ -1804,12 +1804,15 @@ static void tipc_node_mcast_rcv(struct tipc_node *n) } static void tipc_node_bc_sync_rcv(struct tipc_node *n, struct tipc_msg *hdr, - int bearer_id, struct sk_buff_head *xmitq) + int bearer_id, struct sk_buff_head *xmitq, + bool *valid) { struct tipc_link *ucl; int rc; - rc = tipc_bcast_sync_rcv(n->net, n->bc_entry.link, hdr, xmitq); + rc = tipc_bcast_sync_rcv(n->net, n->bc_entry.link, hdr, xmitq, valid); + if (!*valid) + return; if (rc & TIPC_LINK_DOWN_EVT) { tipc_node_reset_links(n); @@ -2111,12 +2114,18 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b) /* Ensure broadcast reception is in synch with peer's send state */ if (unlikely(usr == LINK_PROTOCOL)) { + bool valid = true; + if (unlikely(skb_linearize(skb))) { tipc_node_put(n); goto discard; } hdr = buf_msg(skb); - tipc_node_bc_sync_rcv(n, hdr, bearer_id, &xmitq); + tipc_node_bc_sync_rcv(n, hdr, bearer_id, &xmitq, &valid); + if (!valid) { + tipc_node_put(n); + goto discard; + } } else if (unlikely(tipc_link_acked(n->bc_entry.link) != bc_ack)) { tipc_bcast_ack_rcv(net, n->bc_entry.link, hdr); } -- 2.43.0

2 1

[PATCH OLK-5.10] sctp: fix race between sctp_wait_for_connect and peeloff
by Jinjiang Tu 24 Aug '26

24 Aug '26

From: Zhenghang Xiao <kipreyyy(a)gmail.com> stable inclusion from stable-v5.10.259 commit 0e0d5bc76fd4267a71334fcc8f1a5fbcf997845d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16296 CVE: CVE-2026-63971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f14fe6395a8b3d961a61e138ad7b36ba3626dd4e ] sctp_wait_for_connect() drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the association to a new socket via getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After re-acquiring the old socket lock, sctp_wait_for_connect() returns success without noticing the migration — the caller then accesses the association under the wrong lock in sctp_datamsg_from_user(). Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf() already has, returning an error if the association was migrated while we slept. Fixes: 668c9beb9020 ("sctp: implement assign_number for sctp_stream_interleave") Signed-off-by: Zhenghang Xiao <kipreyyy(a)gmail.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20260527032411.60959-1-kipreyyy@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/sctp/socket.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 8a18aa451e47..0ee6c5616321 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -9099,6 +9099,8 @@ static int sctp_wait_for_connect(struct sctp_association *asoc, long *timeo_p) release_sock(sk); current_timeo = schedule_timeout(current_timeo); lock_sock(sk); + if (sk != asoc->base.sk) + goto do_error; *timeo_p = current_timeo; } -- 2.43.0

2 1

[PATCH OLK-6.6] ipv4: validate IPV4_DEVCONF attributes properly
by JiangJieHua 21 Aug '26

21 Aug '26

From: Fernando Fernandez Mancera <fmancera(a)suse.de> mainline inclusion from mainline-v7.1-rc1 commit fa8fca88714c3a4a74f972ed37328e2f0bbef9fa category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- mainline inclusion from mainline-vundefined commit fa8fca88714c3a4a74f972ed37328e2f0bbef9fa category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As the IPV4_DEVCONF netlink attributes are not being validated, it is possible to use netlink to set read-only values like mc_forwarding. In addition, valid ranges are not being validated neither but that is less relevant as they aren't in sysctl. To avoid similar situations in the future, define a NLA policy for IPV4_DEVCONF attributes which are nested in IFLA_INET_CONF. Signed-off-by: Fernando Fernandez Mancera <fmancera(a)suse.de> Link: https://patch.msgid.link/20260312142637.5704-1-fmancera@suse.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/devinet.c | 55 ++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 45 insertions(+), 10 deletions(-) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 798497c..a5111e5 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -2004,12 +2004,50 @@ static int inet_fill_link_af(struct sk_buff *skb, const struct net_device *dev, [IFLA_INET_CONF] = { .type = NLA_NESTED }, }; +static const struct nla_policy inet_devconf_policy[IPV4_DEVCONF_MAX + 1] = { + [IPV4_DEVCONF_FORWARDING] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_MC_FORWARDING] = { .type = NLA_REJECT }, + [IPV4_DEVCONF_PROXY_ARP] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_ACCEPT_REDIRECTS] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_SECURE_REDIRECTS] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_SEND_REDIRECTS] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_SHARED_MEDIA] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_RP_FILTER] = NLA_POLICY_RANGE(NLA_U32, 0, 2), + [IPV4_DEVCONF_ACCEPT_SOURCE_ROUTE] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_BOOTP_RELAY] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_LOG_MARTIANS] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_TAG] = { .type = NLA_U32 }, + [IPV4_DEVCONF_ARPFILTER] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_MEDIUM_ID] = NLA_POLICY_MIN(NLA_S32, -1), + [IPV4_DEVCONF_NOXFRM] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_NOPOLICY] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_FORCE_IGMP_VERSION] = NLA_POLICY_RANGE(NLA_U32, 0, 3), + [IPV4_DEVCONF_ARP_ANNOUNCE] = NLA_POLICY_RANGE(NLA_U32, 0, 2), + [IPV4_DEVCONF_ARP_IGNORE] = NLA_POLICY_RANGE(NLA_U32, 0, 8), + [IPV4_DEVCONF_PROMOTE_SECONDARIES] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_ARP_ACCEPT] = NLA_POLICY_RANGE(NLA_U32, 0, 2), + [IPV4_DEVCONF_ARP_NOTIFY] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_ACCEPT_LOCAL] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_SRC_VMARK] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_PROXY_ARP_PVLAN] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_ROUTE_LOCALNET] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_BC_FORWARDING] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_IGMPV2_UNSOLICITED_REPORT_INTERVAL] = { .type = NLA_U32 }, + [IPV4_DEVCONF_IGMPV3_UNSOLICITED_REPORT_INTERVAL] = { .type = NLA_U32 }, + [IPV4_DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN] = + NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_DROP_UNICAST_IN_L2_MULTICAST] = + NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_DROP_GRATUITOUS_ARP] = NLA_POLICY_RANGE(NLA_U32, 0, 1), + [IPV4_DEVCONF_ARP_EVICT_NOCARRIER] = NLA_POLICY_RANGE(NLA_U32, 0, 1), +}; + static int inet_validate_link_af(const struct net_device *dev, const struct nlattr *nla, struct netlink_ext_ack *extack) { - struct nlattr *a, *tb[IFLA_INET_MAX+1]; - int err, rem; + struct nlattr *tb[IFLA_INET_MAX + 1], *nested_tb[IPV4_DEVCONF_MAX + 1]; + int err; if (dev && !__in_dev_get_rtnl(dev)) return -EAFNOSUPPORT; @@ -2020,15 +2058,12 @@ static int inet_validate_link_af(const struct net_device *dev, return err; if (tb[IFLA_INET_CONF]) { - nla_for_each_nested(a, tb[IFLA_INET_CONF], rem) { - int cfgid = nla_type(a); + err = nla_parse_nested(nested_tb, IPV4_DEVCONF_MAX, + tb[IFLA_INET_CONF], inet_devconf_policy, + extack); - if (nla_len(a) < 4) - return -EINVAL; - - if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX) - return -EINVAL; - } + if (err < 0) + return err; } return 0; -- 1.8.3.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
by Chen Jinghuang 21 Aug '26

21 Aug '26

From: Tristan Madani <tristmd(a)gmail.com> mainline inclusion from mainline-v7.2-rc3 commit d6ab440240a04b8737ee4c7bb21af9182e451733 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17929 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like num_sge or sge entries while the kernel is processing the WQE, leading to out-of-bounds reads in rxe_resp_check_length() and copy_data(). Introduce get_recv_wqe() that validates num_sge and copies the WQE to a kernel-local buffer before processing, matching the approach already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is reused since SRQ and non-SRQ paths are mutually exclusive per QP. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://patch.msgid.link/r/20260518215040.1598586-3-tristan@talencesecurity… Signed-off-by: Tristan Madani <tristan(a)talencesecurity.com> Reviewed-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/sw/rxe/rxe_resp.c [context conflict] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_resp.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c index 9078cfd3b8bd..be5510ac9159 100644 --- a/drivers/infiniband/sw/rxe/rxe_resp.c +++ b/drivers/infiniband/sw/rxe/rxe_resp.c @@ -359,6 +359,29 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp) return RESPST_CHK_LENGTH; } +static enum resp_states rxe_get_recv_wqe(struct rxe_qp *qp) +{ + struct rxe_queue *q = qp->rq.queue; + struct rxe_recv_wqe *wqe; + unsigned int num_sge; + size_t size; + + wqe = queue_head(q, QUEUE_TYPE_FROM_CLIENT); + if (!wqe) + return RESPST_ERR_RNR; + + num_sge = wqe->dma.num_sge; + if (unlikely(num_sge > qp->rq.max_sge)) { + rxe_dbg_qp(qp, "invalid num_sge in recv WQE\n"); + return RESPST_ERR_MALFORMED_WQE; + } + size = sizeof(*wqe) + num_sge * sizeof(struct rxe_sge); + memcpy(&qp->resp.srq_wqe, wqe, size); + + qp->resp.wqe = &qp->resp.srq_wqe.wqe; + return RESPST_CHK_LENGTH; +} + static enum resp_states check_resource(struct rxe_qp *qp, struct rxe_pkt_info *pkt) { @@ -396,8 +419,7 @@ static enum resp_states check_resource(struct rxe_qp *qp, if (srq) return get_srq_wqe(qp); - qp->resp.wqe = queue_head(qp->rq.queue); - return (qp->resp.wqe) ? RESPST_CHK_LENGTH : RESPST_ERR_RNR; + return rxe_get_recv_wqe(qp); } return RESPST_CHK_LENGTH; -- 2.34.1

2 1

[PATCH OLK-6.6] tracing/probes: Reject $arg0 in meta argument expansion
by Chen Yuxi 21 Aug '26

21 Aug '26

mainline inclusion from mainline-v7.2-rc6 commit 00a8ce2a2a9fa17674e1feec4d9105c1a5d6a419 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9801 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- traceprobe_expand_meta_args() parses $argN with simple_strtoul() and calls sprint_nth_btf_arg(n - 1, ...). For $arg0, n is 0 so the index is -1. Because ctx->nr_params is signed, the "idx >= nr_params" guard in sprint_nth_btf_arg() does not catch the negative index, and ctx->params[-1].name_off is read out of bounds. The normal per-argument path (parse_probe_vars()) already rejects $arg0 via its argument-number check, but meta-argument expansion runs before per-argument parsing and substitutes the value first, bypassing that check. Reject $arg0 explicitly during expansion. Link: https://lore.kernel.org/all/20260724054435.146279-1-raushan.jhon@gmail.com/ Fixes: 18b1e870a496 ("tracing/probes: Add $arg* meta argument for all function args") Cc: stable(a)vger.kernel.org Signed-off-by: Raushan Patel <raushan.jhon(a)gmail.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Conflicts: kernel/trace/trace_probe.c [commit 4af0532a0f4799d5944ea966c10890dcb4390d19 is not backport] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/trace/trace_probe.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 7a49f45d41a2..041ae2b454d3 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -1565,7 +1565,12 @@ const char **traceprobe_expand_meta_args(int argc, const char *argv[], ret = -ENOENT; goto error; } - /* Note: $argN starts from $arg1 */ + /* Note: $argN starts from $arg1, so $arg0 is invalid. */ + if (n == 0) { + trace_probe_log_err(0, BAD_ARG_NUM); + ret = -EINVAL; + goto error; + } ret = sprint_nth_btf_arg(n - 1, type, buf + used, bufsize - used, ctx); if (ret < 0) -- 2.34.1

2 1

[PATCH OLK-6.6] tracing/probes: Reject $arg0 in meta argument expansion
by Chen Yuxi 21 Aug '26

21 Aug '26

mainline inclusion from mainline-v7.2-rc6 commit 00a8ce2a2a9fa17674e1feec4d9105c1a5d6a419 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9801 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- traceprobe_expand_meta_args() parses $argN with simple_strtoul() and calls sprint_nth_btf_arg(n - 1, ...). For $arg0, n is 0 so the index is -1. Because ctx->nr_params is signed, the "idx >= nr_params" guard in sprint_nth_btf_arg() does not catch the negative index, and ctx->params[-1].name_off is read out of bounds. The normal per-argument path (parse_probe_vars()) already rejects $arg0 via its argument-number check, but meta-argument expansion runs before per-argument parsing and substitutes the value first, bypassing that check. Reject $arg0 explicitly during expansion. Link: https://lore.kernel.org/all/20260724054435.146279-1-raushan.jhon@gmail.com/ Fixes: 18b1e870a496 ("tracing/probes: Add $arg* meta argument for all function args") Cc: stable(a)vger.kernel.org Signed-off-by: Raushan Patel <raushan.jhon(a)gmail.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Conflicts: kernel/trace/trace_probe.c [commit 4af0532a0f4799d5944ea966c10890dcb4390d19 is not backport] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/trace/trace_probe.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 7a49f45d41a2..8980f4ecd020 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -1565,7 +1565,11 @@ const char **traceprobe_expand_meta_args(int argc, const char *argv[], ret = -ENOENT; goto error; } - /* Note: $argN starts from $arg1 */ + /* Note: $argN starts from $arg1, so $arg0 is invalid. */ + if (n == 0) { + trace_probe_log_err(0, BAD_ARG_NUM); + return ERR_PTR(-EINVAL); + } ret = sprint_nth_btf_arg(n - 1, type, buf + used, bufsize - used, ctx); if (ret < 0) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Lai Zewei 21 Aug '26

21 Aug '26

*** BLURB HERE *** Lai Zewei (2): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache nfsd: use dynamic allocation for oversized NFSv4.0 replay cache fs/nfsd/nfs4state.c | 16 ++++++++++++++++ fs/nfsd/nfs4xdr.c | 18 ++++++++++++++++-- fs/nfsd/state.h | 21 +++++++++++++++------ 3 files changed, 47 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] binfmt_misc: reject a flag character as the field delimiter
by Luo Gengkun 21 Aug '26

21 Aug '26

From: Christian Brauner <brauner(a)kernel.org> stable inclusion from stable-v6.6.151 commit 1819f82dee766c58295ecaacdac02cdf6837d7a4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17790 CVE: CVE-2026-74485 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 8e85d50ba1117fd446bf9a250bd8a97d48384bdc upstream. The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string create_entry() pads the buffer with that same delimiter: memset(buf + count, del, 8); Most fields are scanned for the delimiter with strchr()/scanarg() and happily stop on the padding. The flags field is different: instead of scanning for the delimiter check_special_flags() consumes the flag characters 'P', 'O', 'C' and 'F' and stops at the first byte that is none of them, relying on the trailing delimiter to end the scan. If the delimiter is itself a flag character the padding no longer acts as a terminator. The scan swallows all eight padding bytes and keeps reading past the end of the allocation until it hits a byte that is not a flag character. For example registering PaPEPPxPPiP with 'P' as the delimiter (name "a", type extension, magic "x", interpreter "i", empty flags) leaves the flag scan running off the end of the buffer. The registration is rejected in the end because the parser does not stop exactly at buf + count, but only after the out of bounds read has already happened. With an unlucky allocation layout the scan can walk into an unmapped page; under KASAN it is reported as a slab out of bounds read. binfmt_misc mounts are available to unprivileged users in a user namespace so the read is reachable without privileges. Reject a delimiter that is one of the flag characters up front. Such a registration was always rejected anyway, only after the out of bounds read, so no valid registration string changes meaning. Link: https://patch.msgid.link/20260710-work-binfmt_misc-locking-v3-3-a162f7cb58d… Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/binfmt_misc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c index bf954bac70a9..5f6e354cb565 100644 --- a/fs/binfmt_misc.c +++ b/fs/binfmt_misc.c @@ -349,6 +349,10 @@ static Node *create_entry(const char __user *buffer, size_t count) pr_debug("register: delim: %#x {%c}\n", del, del); + /* A flag-char delimiter runs the flag scan off the buffer. */ + if (del == 'P' || del == 'O' || del == 'C' || del == 'F') + goto einval; + /* Pad the buffer with the delim to simplify parsing below. */ memset(buf + count, del, 8); -- 2.34.1

2 1

[PATCH OLK-6.6] nvmet-tcp: fix page fragment cache leak in error path
by Lai Zewei 21 Aug '26

21 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 4dae393956093c807212918fd91a8fc70df15338 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17264 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In nvmet_tcp_alloc_queue(), when a connection is closed during the allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN), the error handling jumps to out_destroy_sq and then to out_ida_remove without draining the page fragment cache. Although nvmet_tcp_free_cmd() is called in some error paths to release individual page fragments, the underlying page cache reference held by queue->pf_cache is never released. The first allocation using pf_cache is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens after ida_alloc() returns successfully. This results in a page leak each time a connection fails during allocation, which could lead to memory exhaustion over time if connections are repeatedly opened and closed. Fix this by calling page_frag_cache_drain() before freeing the queue structure in the out_ida_remove label. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Geliang Tang <tanggeliang(a)kylinos.cn> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/target/tcp.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- drivers/nvme/target/tcp.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 6c6197a53fa3..fb6af1be694f 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -1754,6 +1754,14 @@ static int nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port, nvmet_tcp_free_cmd(&queue->connect); out_ida_remove: ida_free(&nvmet_tcp_queue_ida, queue->idx); + /* + * Drain the page fragment cache if any allocations were done. + * The first allocation using pf_cache is nvmet_tcp_alloc_cmd() + * for queue->connect after ida_alloc(). + */ + if (queue->pf_cache.va) + __page_frag_cache_drain(virt_to_head_page(queue->pf_cache.va), + queue->pf_cache.pagecnt_bias); out_free_queue: kfree(queue); return ret; -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Lai Zewei 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lai Zewei (2): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache nfsd: use dynamic allocation for oversized NFSv4.0 replay cache fs/nfsd/nfs4state.c | 16 ++++++++++++++++ fs/nfsd/nfs4xdr.c | 18 ++++++++++++++++-- fs/nfsd/state.h | 21 +++++++++++++++------ 3 files changed, 47 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Lai Zewei 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lai Zewei (2): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache nfsd: use dynamic allocation for oversized NFSv4.0 replay cache fs/nfsd/nfs4state.c | 16 ++++++++++++++++ fs/nfsd/nfs4xdr.c | 18 ++++++++++++++++-- fs/nfsd/state.h | 21 +++++++++++++++------ 3 files changed, 47 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 0/4] *** SUBJECT HERE ***
by Lu Chentao 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lu Chentao (4): [OLK-6.6] cifs: prevent readdir from changing file size due to stale directory metadata [OLK-6.6] cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths [OLK-6.6] cifs: consolidate time_last_write stamp into _cifsFileInfo_put() [OLK-6.6] cifs: fix time_last_write stamp placement in setattr/truncate paths fs/smb/client/cifsfs.c | 1 + fs/smb/client/cifsglob.h | 1 + fs/smb/client/file.c | 65 ++++++++++++++++++++++++++++++++++++---- fs/smb/client/inode.c | 25 +++++++++++++++- fs/smb/client/misc.c | 27 +++++++++++++---- 5 files changed, 106 insertions(+), 13 deletions(-) -- 2.52.0

2 5

[PATCH OLK-6.6 00/16] backport minios part3 patches from linux mainline
by Qinxin Xia 20 Aug '26

20 Aug '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- backport minios part3 patches from linux mainline Andre Przywara (1): kselftest/arm64: hwcap: fix f8dp2 cpuinfo name Mark Brown (14): kselftest/arm64: Handle FPMR context in generic signal frame parser kselftest/arm64: Add basic FPMR test kselftest/arm64: Add 2023 DPISA hwcap test coverage arm64/sve: Report FEAT_SVE_B16B16 to userspace arm64/sysreg: Update ID_AA64FPFR0_EL1 to DDI0601 2024-09 arm64/sysreg: Update ID_AA64ZFR0_EL1 to DDI0601 2024-09 arm64/sysreg: Update ID_AA64ISAR2_EL1 to DDI0601 2024-09 arm64/sysreg: Update ID_AA64SMFR0_EL1 to DDI0601 2024-12 arm64/hwcap: Describe 2024 dpISA extensions to userspace arm64/hwcap: Remove stray references to SF8MMx arm64: Add missing registrations of hwcaps kselftest/arm64: Verify HWCAP2_SVE_B16B16 kselftest/arm64: Fix encoding for SVE B16B16 test kselftest/arm64: Add 2024 dpISA extensions to hwcap test Yifan Wu (1): selftests/arm64: Implement cmpbr_sigill() to hwcap test .../arch/arm64/cpu-feature-registers.rst | 2 + Documentation/arch/arm64/elf_hwcaps.rst | 53 +++ arch/arm64/include/asm/hwcap.h | 16 + arch/arm64/include/uapi/asm/hwcap.h | 17 + arch/arm64/kernel/cpufeature.c | 35 ++ arch/arm64/kernel/hwcap_str.h | 16 + arch/arm64/tools/sysreg | 62 ++- tools/testing/selftests/arm64/abi/hwcap.c | 449 ++++++++++++++++++ .../testing/selftests/arm64/signal/.gitignore | 1 + .../arm64/signal/testcases/fpmr_siginfo.c | 82 ++++ .../arm64/signal/testcases/testcases.c | 8 + .../arm64/signal/testcases/testcases.h | 1 + 12 files changed, 735 insertions(+), 7 deletions(-) create mode 100644 tools/testing/selftests/arm64/signal/testcases/fpmr_siginfo.c -- 2.33.0

2 17

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Lai Zewei 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lai Zewei (2): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache nfsd: use dynamic allocation for oversized NFSv4.0 replay cache fs/nfsd/nfs4state.c | 16 ++++++++++++++++ fs/nfsd/nfs4xdr.c | 18 ++++++++++++++++-- fs/nfsd/state.h | 21 +++++++++++++++------ 3 files changed, 47 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] bpf: Mask pseudo pointer values in verifier logs
by Pu Lehui 20 Aug '26

20 Aug '26

From: Nuoqi Gui <gnq25(a)mails.tsinghua.edu.cn> mainline inclusion from mainline-v7.2-rc2 commit 72a85e9464a5332fb2cd7efd26d9295275ceda2d category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9793 CVE: CVE-2026-72402 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- print_bpf_insn() masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF_PSEUDO_MAP_FD and BPF_PSEUDO_MAP_VALUE. BPF_PSEUDO_MAP_IDX, BPF_PSEUDO_MAP_IDX_VALUE, and BPF_PSEUDO_BTF_ID can also be resolved to kernel pointer values before the verifier log prints the instruction. Include them in the existing pointer classification so the log prints 0x0 instead of the rewritten address. Fixes: 4976b718c355 ("bpf: Introduce pseudo_btf_id") Fixes: 387544bfa291 ("bpf: Introduce fd_idx") Signed-off-by: Nuoqi Gui <gnq25(a)mails.tsinghua.edu.cn> Link: https://lore.kernel.org/r/20260623-f01-13-pseudo-btf-id-cap-bpf-v2-1-a190eb… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/disasm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/disasm.c b/kernel/bpf/disasm.c index 49940c26a227..cc3c9792c4a6 100644 --- a/kernel/bpf/disasm.c +++ b/kernel/bpf/disasm.c @@ -287,7 +287,10 @@ void print_bpf_insn(const struct bpf_insn_cbs *cbs, */ u64 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm; bool is_ptr = insn->src_reg == BPF_PSEUDO_MAP_FD || - insn->src_reg == BPF_PSEUDO_MAP_VALUE; + insn->src_reg == BPF_PSEUDO_MAP_VALUE || + insn->src_reg == BPF_PSEUDO_MAP_IDX || + insn->src_reg == BPF_PSEUDO_MAP_IDX_VALUE || + insn->src_reg == BPF_PSEUDO_BTF_ID; char tmp[64]; if (is_ptr && !allow_ptr_leaks) -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] *** SUBJECT HERE ***
by Lu Chentao 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lu Chentao (4): [OLK-6.6] cifs: prevent readdir from changing file size due to stale directory metadata [OLK-6.6] cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths [OLK-6.6] cifs: consolidate time_last_write stamp into _cifsFileInfo_put() [OLK-6.6] cifs: fix time_last_write stamp placement in setattr/truncate paths fs/smb/client/cifsfs.c | 1 + fs/smb/client/cifsglob.h | 1 + fs/smb/client/file.c | 65 ++++++++++++++++++++++++++++++++++++---- fs/smb/client/inode.c | 25 +++++++++++++++- fs/smb/client/misc.c | 27 +++++++++++++---- 5 files changed, 106 insertions(+), 13 deletions(-) -- 2.52.0

2 5

[PATCH OLK-6.6 1/4] [OLK-6.6] cifs: prevent readdir from changing file size due to stale directory metadata
by Lu Chentao 20 Aug '26

20 Aug '26

mainline inclusion from mainline-v7.2-rc5 commit e8a8d54c2d508891c142a928fc7d298c4c8bd0dd category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Windows Server's directory enumeration metadata lags behind the actual file size after a write+close or rename. A concurrent readdir() in the window between close() returning to userspace and stat() being called overwrites the correct cached i_size with the stale server value, causing stat() to return the wrong size. Once _cifsFileInfo_put() removes the last writable handle from openFileList, is_size_safe_to_change() permits readdir to overwrite i_size. smb2_close_getattr() then stamps cifs_i->time = jiffies, making the corrupt cached value appear fresh to the next stat(). The existing check (see Fixes:) only blocked stale size updates while an active RW lease was held, not after the last writable handle closes. Add cifsInodeInfo->time_last_write, written via smp_store_release() at writable close and on setattr/truncate. is_size_safe_to_change() checks is_inode_writable() first (acquiring open_file_lock), then rejects a readdir size update if time_last_write falls within acregmax jiffies. The spinlock release in _cifsFileInfo_put() forms a store-release barrier that pairs with the spin_lock() (load-acquire) in is_inode_writable(), ensuring the subsequent smp_load_acquire() on time_last_write observes any update from a concurrent close(). When a size update is rejected and the server value differs from the cached one, cifs_i->time is cleared to force a fresh QUERY_INFO on the next stat(). readdir is also blocked from changing i_size while writable handles are open or an RW lease is held, even on direct-IO mounts. For deferred close (closetimeo > 0), time_last_write is refreshed at the actual server close in smb2_deferred_work_close() and in the cifs_close_deferred_file*() drain paths invoked by lease/oplock breaks and tcon teardown, anchoring the protection window to the real close time rather than the earlier userspace close. time_last_write == 0 skips the time_before() check to avoid false positives near boot on 32-bit systems where jiffies starts close to INITIAL_JIFFIES. Does not reproduce against Samba or with actimeo=0. Fixes: e4b61f3b1c67 ("cifs: prevent updating file size from server if we have a read/write lease") Signed-off-by: Frank Sorenson <sorenson(a)redhat.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/cifsfs.c fs/smb/client/cifsglob.h fs/smb/client/file.c fs/smb/client/inode.c fs/smb/client/misc.c [Conflicts due to context] Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- fs/smb/client/cifsfs.c | 1 + fs/smb/client/cifsglob.h | 1 + fs/smb/client/file.c | 70 ++++++++++++++++++++++++++++++++++++---- fs/smb/client/inode.c | 7 +++- fs/smb/client/misc.c | 27 ++++++++++++++-- 5 files changed, 96 insertions(+), 10 deletions(-) diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c index a2887b978dc8..35863213b46c 100644 --- a/fs/smb/client/cifsfs.c +++ b/fs/smb/client/cifsfs.c @@ -399,10 +399,11 @@ cifs_alloc_inode(struct super_block *sb) cifs_inode = alloc_inode_sb(sb, cifs_inode_cachep, GFP_KERNEL); if (!cifs_inode) return NULL; cifs_inode->cifsAttrs = 0x20; /* default */ cifs_inode->time = 0; + cifs_inode->time_last_write = 0; /* * Until the file is open and we have gotten oplock info back from the * server, can not assume caching of file data or metadata. */ cifs_set_oplock_level(cifs_inode, 0); diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h index fdafc6f1eb4f..cd1a60f63cbc 100644 --- a/fs/smb/client/cifsglob.h +++ b/fs/smb/client/cifsglob.h @@ -1599,10 +1599,11 @@ struct cifsInodeInfo { #define CIFS_INO_CLOSE_ON_LOCK (7) /* Not to defer the close when lock is set */ unsigned long flags; spinlock_t writers_lock; unsigned int writers; /* Number of writers on this inode */ unsigned long time; /* jiffies of last update of inode */ + unsigned long time_last_write; /* jiffies of last writable close or truncate */ u64 server_eof; /* current file size on server -- protected by i_lock */ u64 uniqueid; /* server inode number */ u64 createtime; /* creation time on server */ __u8 lease_key[SMB2_LEASE_KEY_SIZE]; /* lease key for this inode */ struct list_head deferred_closes; /* list of deferred closes */ diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c index 5eeadf94c279..b3f4c0584e02 100644 --- a/fs/smb/client/file.c +++ b/fs/smb/client/file.c @@ -1217,15 +1217,25 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) void smb2_deferred_work_close(struct work_struct *work) { struct cifsFileInfo *cfile = container_of(work, struct cifsFileInfo, deferred.work); + struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry)); - spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + spin_lock(&cinode->deferred_lock); cifs_del_deferred_close(cfile); cfile->deferred_close_scheduled = false; - spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + spin_unlock(&cinode->deferred_lock); + /* + * Refresh time_last_write immediately before the actual server close + * so the protection window is anchored to the real close time, not + * the earlier userspace close time stored by cifs_close(). + */ + if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&cinode->time_last_write, jiffies); + } _cifsFileInfo_put(cfile, true, false); } static bool smb2_can_defer_close(struct inode *inode, struct cifs_deferred_close *dclose) @@ -1250,10 +1260,14 @@ int cifs_close(struct inode *inode, struct file *file) cifs_fscache_unuse_inode_cookie(inode, file->f_mode & FMODE_WRITE); if (file->private_data != NULL) { cfile = file->private_data; file->private_data = NULL; + if (file->f_mode & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&cinode->time_last_write, jiffies); + } dclose = kmalloc(sizeof(struct cifs_deferred_close), GFP_KERNEL); if ((cfile->status_file_deleted == false) && (smb2_can_defer_close(inode, dclose))) { if (test_and_clear_bit(CIFS_INO_MODIFIED_ATTR, &cinode->flags)) { inode_set_mtime_to_ts(inode, @@ -5004,31 +5018,75 @@ static int is_inode_writable(struct cifsInodeInfo *cifs_inode) but this is tricky to do without racing with writebehind page caching in the current Linux kernel design */ bool is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 end_of_file, bool from_readdir) { + struct cifs_sb_info *cifs_sb; + unsigned long tlw; + if (!cifsInode) return true; + cifs_sb = CIFS_SB(cifsInode->netfs.inode.i_sb); + if (is_inode_writable(cifsInode) || ((cifsInode->oplock & CIFS_CACHE_RW_FLG) != 0 && from_readdir)) { /* This inode is open for write at least once */ - struct cifs_sb_info *cifs_sb; - cifs_sb = CIFS_SB(cifsInode->netfs.inode.i_sb); + /* + * Readdir data is unreliable when we have writable handles or + * an exclusive lease -- never allow it to change i_size, even + * on direct-IO mounts where the server's directory metadata + * can still lag behind the actual file state. + */ + if (from_readdir) + return false; + if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DIRECT_IO) { /* since no page cache to corrupt on directio we can change size safely */ return true; } if (i_size_read(&cifsInode->netfs.inode) < end_of_file) return true; return false; - } else - return true; + } + + /* + * No writable handles open. Check whether we are within the attribute + * cache validity window of a recent local modification. + * + * For the close() path: cifs_close() calls smp_store_release() on + * time_last_write before _cifsFileInfo_put() removes the handle under + * open_file_lock. That spin_unlock() is a store-release that pairs + * with the spin_lock() (load-acquire) in is_inode_writable() above, + * so if is_inode_writable() returned false the smp_load_acquire() + * below is guaranteed to observe any time_last_write update from a + * concurrent close(). + * + * For the setattr/truncate paths: those callers use smp_store_release() + * directly; the smp_load_acquire() below pairs with that store. There + * is no shared lock between setattr and readdir, so this relies on + * acquire-release semantics alone. The store propagation latency on + * weakly-ordered architectures (nanoseconds) is negligible relative to + * the acregmax window (seconds) and the readdir RPC round-trip + * (milliseconds), making this a sound design choice in practice. + * + * time_last_write == 0 means the inode has never been written locally; + * skip the window check to avoid false positives near boot time when + * jiffies is still close to INITIAL_JIFFIES on 32-bit systems. + */ + if (from_readdir) { + /* Pairs with smp_store_release() at close and truncate sites. */ + tlw = smp_load_acquire(&cifsInode->time_last_write); + if (tlw && time_before(jiffies, tlw + cifs_sb->ctx->acregmax)) + return false; + } + + return true; } static int cifs_write_begin(struct file *file, struct address_space *mapping, loff_t pos, unsigned len, struct page **pagep, void **fsdata) diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c index f5b50cb65360..94b8ceff3c60 100644 --- a/fs/smb/client/inode.c +++ b/fs/smb/client/inode.c @@ -225,10 +225,12 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr, * i_blocks is not related to (i_size / i_blksize), * but instead 512 byte (2**9) size is required for * calculating num blocks. */ inode->i_blocks = (512 - 1 + fattr->cf_bytes) >> 9; + } else if (from_readdir && i_size_read(inode) != fattr->cf_eof) { + cifs_i->time = 0; } if (S_ISLNK(fattr->cf_mode) && fattr->cf_symlink_target) { kfree(cifs_i->symlink_target); cifs_i->symlink_target = fattr->cf_symlink_target; @@ -324,11 +326,10 @@ cifs_unix_basic_to_fattr(struct cifs_fattr *fattr, FILE_UNIX_BASIC_INFO *info, kuid_t uid = make_kuid(&init_user_ns, id); if (uid_valid(uid)) fattr->cf_uid = uid; } } - fattr->cf_gid = cifs_sb->ctx->linux_gid; if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID)) { u64 id = le64_to_cpu(info->Gid); if (id < ((gid_t)-1)) { kgid_t gid = make_kgid(&init_user_ns, id); @@ -3129,10 +3130,12 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs) if (rc) goto out; if ((attrs->ia_valid & ATTR_SIZE) && attrs->ia_size != i_size_read(inode)) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&cifsInode->time_last_write, jiffies); truncate_setsize(inode, attrs->ia_size); fscache_resize_cookie(cifs_inode_cookie(inode), attrs->ia_size); } setattr_copy(&nop_mnt_idmap, inode, attrs); @@ -3330,10 +3333,12 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) if (rc) goto cifs_setattr_exit; if ((attrs->ia_valid & ATTR_SIZE) && attrs->ia_size != i_size_read(inode)) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&cifsInode->time_last_write, jiffies); truncate_setsize(inode, attrs->ia_size); fscache_resize_cookie(cifs_inode_cookie(inode), attrs->ia_size); } setattr_copy(&nop_mnt_idmap, inode, attrs); diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c index 8bfb04e36ad7..cee96842d653 100644 --- a/fs/smb/client/misc.c +++ b/fs/smb/client/misc.c @@ -798,11 +798,18 @@ cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode) } } spin_unlock(&cifs_inode->open_file_lock); list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { - _cifsFileInfo_put(tmp_list->cfile, false, false); + struct cifsFileInfo *cfile = tmp_list->cfile; + + if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&CIFS_I(d_inode(cfile->dentry))->time_last_write, + jiffies); + } + _cifsFileInfo_put(cfile, false, false); list_del(&tmp_list->list); kfree(tmp_list); } } @@ -831,11 +838,18 @@ cifs_close_all_deferred_files(struct cifs_tcon *tcon) } } spin_unlock(&tcon->open_file_lock); list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { - _cifsFileInfo_put(tmp_list->cfile, true, false); + struct cifsFileInfo *cfile = tmp_list->cfile; + + if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&CIFS_I(d_inode(cfile->dentry))->time_last_write, + jiffies); + } + _cifsFileInfo_put(cfile, true, false); list_del(&tmp_list->list); kfree(tmp_list); } } @@ -907,11 +921,18 @@ cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path) } } spin_unlock(&tcon->open_file_lock); list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { - _cifsFileInfo_put(tmp_list->cfile, true, false); + struct cifsFileInfo *cfile = tmp_list->cfile; + + if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&CIFS_I(d_inode(cfile->dentry))->time_last_write, + jiffies); + } + _cifsFileInfo_put(cfile, true, false); list_del(&tmp_list->list); kfree(tmp_list); } free_dentry_path(page); } -- 2.52.0

2 4

[PATCH OLK-6.6 1/4] [OLK-6.6] cifs: prevent readdir from changing file size due to stale directory metadata
by Lu Chentao 20 Aug '26

20 Aug '26

mainline inclusion from mainline-v7.2-rc5 commit e8a8d54c2d508891c142a928fc7d298c4c8bd0dd category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Windows Server's directory enumeration metadata lags behind the actual file size after a write+close or rename. A concurrent readdir() in the window between close() returning to userspace and stat() being called overwrites the correct cached i_size with the stale server value, causing stat() to return the wrong size. Once _cifsFileInfo_put() removes the last writable handle from openFileList, is_size_safe_to_change() permits readdir to overwrite i_size. smb2_close_getattr() then stamps cifs_i->time = jiffies, making the corrupt cached value appear fresh to the next stat(). The existing check (see Fixes:) only blocked stale size updates while an active RW lease was held, not after the last writable handle closes. Add cifsInodeInfo->time_last_write, written via smp_store_release() at writable close and on setattr/truncate. is_size_safe_to_change() checks is_inode_writable() first (acquiring open_file_lock), then rejects a readdir size update if time_last_write falls within acregmax jiffies. The spinlock release in _cifsFileInfo_put() forms a store-release barrier that pairs with the spin_lock() (load-acquire) in is_inode_writable(), ensuring the subsequent smp_load_acquire() on time_last_write observes any update from a concurrent close(). When a size update is rejected and the server value differs from the cached one, cifs_i->time is cleared to force a fresh QUERY_INFO on the next stat(). readdir is also blocked from changing i_size while writable handles are open or an RW lease is held, even on direct-IO mounts. For deferred close (closetimeo > 0), time_last_write is refreshed at the actual server close in smb2_deferred_work_close() and in the cifs_close_deferred_file*() drain paths invoked by lease/oplock breaks and tcon teardown, anchoring the protection window to the real close time rather than the earlier userspace close. time_last_write == 0 skips the time_before() check to avoid false positives near boot on 32-bit systems where jiffies starts close to INITIAL_JIFFIES. Does not reproduce against Samba or with actimeo=0. Fixes: e4b61f3b1c67 ("cifs: prevent updating file size from server if we have a read/write lease") Signed-off-by: Frank Sorenson <sorenson(a)redhat.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/cifsfs.c fs/smb/client/cifsglob.h fs/smb/client/file.c fs/smb/client/inode.c fs/smb/client/misc.c [Conflicts due to context] Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- fs/smb/client/cifsfs.c | 1 + fs/smb/client/cifsglob.h | 1 + fs/smb/client/file.c | 70 ++++++++++++++++++++++++++++++++++++---- fs/smb/client/inode.c | 7 +++- fs/smb/client/misc.c | 27 ++++++++++++++-- 5 files changed, 96 insertions(+), 10 deletions(-) diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c index a2887b978dc8..35863213b46c 100644 --- a/fs/smb/client/cifsfs.c +++ b/fs/smb/client/cifsfs.c @@ -399,10 +399,11 @@ cifs_alloc_inode(struct super_block *sb) cifs_inode = alloc_inode_sb(sb, cifs_inode_cachep, GFP_KERNEL); if (!cifs_inode) return NULL; cifs_inode->cifsAttrs = 0x20; /* default */ cifs_inode->time = 0; + cifs_inode->time_last_write = 0; /* * Until the file is open and we have gotten oplock info back from the * server, can not assume caching of file data or metadata. */ cifs_set_oplock_level(cifs_inode, 0); diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h index fdafc6f1eb4f..cd1a60f63cbc 100644 --- a/fs/smb/client/cifsglob.h +++ b/fs/smb/client/cifsglob.h @@ -1599,10 +1599,11 @@ struct cifsInodeInfo { #define CIFS_INO_CLOSE_ON_LOCK (7) /* Not to defer the close when lock is set */ unsigned long flags; spinlock_t writers_lock; unsigned int writers; /* Number of writers on this inode */ unsigned long time; /* jiffies of last update of inode */ + unsigned long time_last_write; /* jiffies of last writable close or truncate */ u64 server_eof; /* current file size on server -- protected by i_lock */ u64 uniqueid; /* server inode number */ u64 createtime; /* creation time on server */ __u8 lease_key[SMB2_LEASE_KEY_SIZE]; /* lease key for this inode */ struct list_head deferred_closes; /* list of deferred closes */ diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c index 5eeadf94c279..b3f4c0584e02 100644 --- a/fs/smb/client/file.c +++ b/fs/smb/client/file.c @@ -1217,15 +1217,25 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) void smb2_deferred_work_close(struct work_struct *work) { struct cifsFileInfo *cfile = container_of(work, struct cifsFileInfo, deferred.work); + struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry)); - spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + spin_lock(&cinode->deferred_lock); cifs_del_deferred_close(cfile); cfile->deferred_close_scheduled = false; - spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); + spin_unlock(&cinode->deferred_lock); + /* + * Refresh time_last_write immediately before the actual server close + * so the protection window is anchored to the real close time, not + * the earlier userspace close time stored by cifs_close(). + */ + if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&cinode->time_last_write, jiffies); + } _cifsFileInfo_put(cfile, true, false); } static bool smb2_can_defer_close(struct inode *inode, struct cifs_deferred_close *dclose) @@ -1250,10 +1260,14 @@ int cifs_close(struct inode *inode, struct file *file) cifs_fscache_unuse_inode_cookie(inode, file->f_mode & FMODE_WRITE); if (file->private_data != NULL) { cfile = file->private_data; file->private_data = NULL; + if (file->f_mode & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&cinode->time_last_write, jiffies); + } dclose = kmalloc(sizeof(struct cifs_deferred_close), GFP_KERNEL); if ((cfile->status_file_deleted == false) && (smb2_can_defer_close(inode, dclose))) { if (test_and_clear_bit(CIFS_INO_MODIFIED_ATTR, &cinode->flags)) { inode_set_mtime_to_ts(inode, @@ -5004,31 +5018,75 @@ static int is_inode_writable(struct cifsInodeInfo *cifs_inode) but this is tricky to do without racing with writebehind page caching in the current Linux kernel design */ bool is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 end_of_file, bool from_readdir) { + struct cifs_sb_info *cifs_sb; + unsigned long tlw; + if (!cifsInode) return true; + cifs_sb = CIFS_SB(cifsInode->netfs.inode.i_sb); + if (is_inode_writable(cifsInode) || ((cifsInode->oplock & CIFS_CACHE_RW_FLG) != 0 && from_readdir)) { /* This inode is open for write at least once */ - struct cifs_sb_info *cifs_sb; - cifs_sb = CIFS_SB(cifsInode->netfs.inode.i_sb); + /* + * Readdir data is unreliable when we have writable handles or + * an exclusive lease -- never allow it to change i_size, even + * on direct-IO mounts where the server's directory metadata + * can still lag behind the actual file state. + */ + if (from_readdir) + return false; + if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DIRECT_IO) { /* since no page cache to corrupt on directio we can change size safely */ return true; } if (i_size_read(&cifsInode->netfs.inode) < end_of_file) return true; return false; - } else - return true; + } + + /* + * No writable handles open. Check whether we are within the attribute + * cache validity window of a recent local modification. + * + * For the close() path: cifs_close() calls smp_store_release() on + * time_last_write before _cifsFileInfo_put() removes the handle under + * open_file_lock. That spin_unlock() is a store-release that pairs + * with the spin_lock() (load-acquire) in is_inode_writable() above, + * so if is_inode_writable() returned false the smp_load_acquire() + * below is guaranteed to observe any time_last_write update from a + * concurrent close(). + * + * For the setattr/truncate paths: those callers use smp_store_release() + * directly; the smp_load_acquire() below pairs with that store. There + * is no shared lock between setattr and readdir, so this relies on + * acquire-release semantics alone. The store propagation latency on + * weakly-ordered architectures (nanoseconds) is negligible relative to + * the acregmax window (seconds) and the readdir RPC round-trip + * (milliseconds), making this a sound design choice in practice. + * + * time_last_write == 0 means the inode has never been written locally; + * skip the window check to avoid false positives near boot time when + * jiffies is still close to INITIAL_JIFFIES on 32-bit systems. + */ + if (from_readdir) { + /* Pairs with smp_store_release() at close and truncate sites. */ + tlw = smp_load_acquire(&cifsInode->time_last_write); + if (tlw && time_before(jiffies, tlw + cifs_sb->ctx->acregmax)) + return false; + } + + return true; } static int cifs_write_begin(struct file *file, struct address_space *mapping, loff_t pos, unsigned len, struct page **pagep, void **fsdata) diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c index f5b50cb65360..94b8ceff3c60 100644 --- a/fs/smb/client/inode.c +++ b/fs/smb/client/inode.c @@ -225,10 +225,12 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr, * i_blocks is not related to (i_size / i_blksize), * but instead 512 byte (2**9) size is required for * calculating num blocks. */ inode->i_blocks = (512 - 1 + fattr->cf_bytes) >> 9; + } else if (from_readdir && i_size_read(inode) != fattr->cf_eof) { + cifs_i->time = 0; } if (S_ISLNK(fattr->cf_mode) && fattr->cf_symlink_target) { kfree(cifs_i->symlink_target); cifs_i->symlink_target = fattr->cf_symlink_target; @@ -324,11 +326,10 @@ cifs_unix_basic_to_fattr(struct cifs_fattr *fattr, FILE_UNIX_BASIC_INFO *info, kuid_t uid = make_kuid(&init_user_ns, id); if (uid_valid(uid)) fattr->cf_uid = uid; } } - fattr->cf_gid = cifs_sb->ctx->linux_gid; if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID)) { u64 id = le64_to_cpu(info->Gid); if (id < ((gid_t)-1)) { kgid_t gid = make_kgid(&init_user_ns, id); @@ -3129,10 +3130,12 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs) if (rc) goto out; if ((attrs->ia_valid & ATTR_SIZE) && attrs->ia_size != i_size_read(inode)) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&cifsInode->time_last_write, jiffies); truncate_setsize(inode, attrs->ia_size); fscache_resize_cookie(cifs_inode_cookie(inode), attrs->ia_size); } setattr_copy(&nop_mnt_idmap, inode, attrs); @@ -3330,10 +3333,12 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) if (rc) goto cifs_setattr_exit; if ((attrs->ia_valid & ATTR_SIZE) && attrs->ia_size != i_size_read(inode)) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&cifsInode->time_last_write, jiffies); truncate_setsize(inode, attrs->ia_size); fscache_resize_cookie(cifs_inode_cookie(inode), attrs->ia_size); } setattr_copy(&nop_mnt_idmap, inode, attrs); diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c index 8bfb04e36ad7..cee96842d653 100644 --- a/fs/smb/client/misc.c +++ b/fs/smb/client/misc.c @@ -798,11 +798,18 @@ cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode) } } spin_unlock(&cifs_inode->open_file_lock); list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { - _cifsFileInfo_put(tmp_list->cfile, false, false); + struct cifsFileInfo *cfile = tmp_list->cfile; + + if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&CIFS_I(d_inode(cfile->dentry))->time_last_write, + jiffies); + } + _cifsFileInfo_put(cfile, false, false); list_del(&tmp_list->list); kfree(tmp_list); } } @@ -831,11 +838,18 @@ cifs_close_all_deferred_files(struct cifs_tcon *tcon) } } spin_unlock(&tcon->open_file_lock); list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { - _cifsFileInfo_put(tmp_list->cfile, true, false); + struct cifsFileInfo *cfile = tmp_list->cfile; + + if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&CIFS_I(d_inode(cfile->dentry))->time_last_write, + jiffies); + } + _cifsFileInfo_put(cfile, true, false); list_del(&tmp_list->list); kfree(tmp_list); } } @@ -907,11 +921,18 @@ cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path) } } spin_unlock(&tcon->open_file_lock); list_for_each_entry_safe(tmp_list, tmp_next_list, &file_head, list) { - _cifsFileInfo_put(tmp_list->cfile, true, false); + struct cifsFileInfo *cfile = tmp_list->cfile; + + if (OPEN_FMODE(cfile->f_flags) & FMODE_WRITE) { + /* Pairs with smp_load_acquire() in is_size_safe_to_change(). */ + smp_store_release(&CIFS_I(d_inode(cfile->dentry))->time_last_write, + jiffies); + } + _cifsFileInfo_put(cfile, true, false); list_del(&tmp_list->list); kfree(tmp_list); } free_dentry_path(page); } -- 2.52.0

2 5

openEuler Kernel SIG双周例会
by openEuler conference 19 Aug '26

19 Aug '26

您好！ Kernel 邀请您参加 2026-08-21 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题请申报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/986322224 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-08-21 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题请申报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/986322224 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6 v4 0/8] irqbypass: Cleanups and a perf improvement
by Qiqi Li 19 Aug '26

19 Aug '26

From: Qiqi Li <liqiqi23(a)huawei.com> The two primary goals of this series are to make the irqbypass concept easier to understand, and to address the terrible performance that can result from using a list to track connections. Provides additional adaptation for the ub vfio device in openEuler. Sean Christopherson (8): irqbypass: Drop pointless and misleading THIS_MODULE get/put irqbypass: Drop superfluous might_sleep() annotations irqbypass: Take ownership of producer/consumer token tracking irqbypass: Explicitly track producer and consumer bindings irqbypass: Use paired consumer/producer to disconnect during unregister irqbypass: Use guard(mutex) in lieu of manual lock+unlock irqbypass: Use xarray to track producers and consumers irqbypass: Require producers to pass in Linux IRQ number during registration arch/x86/kvm/x86.c | 4 +- drivers/vfio/pci/vfio_pci_intrs.c | 10 +- drivers/vfio/ubus/vfio_ub_intrs.c | 12 +- drivers/vhost/vdpa.c | 10 +- include/linux/irqbypass.h | 46 +++---- virt/kvm/eventfd.c | 7 +- virt/lib/irqbypass.c | 192 +++++++++++------------------- 7 files changed, 112 insertions(+), 169 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6 v4 0/8] irqbypass: Cleanups and a perf improvement
by Qiqi Li 19 Aug '26

19 Aug '26

From: Qiqi Li <liqiqi23(a)huawei.com> The two primary goals of this series are to make the irqbypass concept easier to understand, and to address the terrible performance that can result from using a list to track connections. Provides additional adaptation for the ub vfio device in openEuler. Sean Christopherson (8): irqbypass: Drop pointless and misleading THIS_MODULE get/put irqbypass: Drop superfluous might_sleep() annotations irqbypass: Take ownership of producer/consumer token tracking irqbypass: Explicitly track producer and consumer bindings irqbypass: Use paired consumer/producer to disconnect during unregister irqbypass: Use guard(mutex) in lieu of manual lock+unlock irqbypass: Use xarray to track producers and consumers irqbypass: Require producers to pass in Linux IRQ number during registration arch/x86/kvm/x86.c | 4 +- drivers/vfio/pci/vfio_pci_intrs.c | 10 +- drivers/vfio/ubus/vfio_ub_intrs.c | 12 +- drivers/vhost/vdpa.c | 10 +- include/linux/irqbypass.h | 46 +++---- virt/kvm/eventfd.c | 7 +- virt/lib/irqbypass.c | 192 +++++++++++------------------- 7 files changed, 112 insertions(+), 169 deletions(-) -- 2.43.0

2 9

[PATCH OLK-5.10] ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
by Pan Taixi 19 Aug '26

19 Aug '26

From: Bryam Vargas <hexlabsecurity(a)proton.me> mainline inclusion from mainline-v7.2-rc5 commit 4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16967 CVE: CVE-2026-68160 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ceph_handle_caps() reads snap_trace_len from the wire-format ceph_mds_caps header and uses it unconditionally to build a fake end pointer (snaptrace + snaptrace_len) that is later handed to ceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case: snaptrace = h + 1; snaptrace_len = le32_to_cpu(h->snap_trace_len); p = snaptrace + snaptrace_len; ... case CEPH_CAP_OP_IMPORT: if (snaptrace_len) { ... if (ceph_update_snap_trace(mdsc, snaptrace, snaptrace + snaptrace_len, false, &realm)) { ... } ceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm from snaptrace using ceph_decode_need(&p, e, sizeof(*ri), bad) with the attacker-supplied fake end e == snaptrace + snaptrace_len. With snaptrace_len == 0xFFFFFFFF the bound check is trivially satisfied, ri = p reads sizeof(struct ceph_mds_snap_realm) past the legitimate msg->front buffer, and ri->num_snaps / ri->num_prior_parent_snaps then drive further out-of-bounds reads of the encoded snap arrays. The eleven msg_version >= 2 .. msg_version >= 12 decoder blocks above the op switch each catch this OOB through their ceph_decode_*_safe() / ceph_decode_need() helpers, but they sit behind a hdr.version-gated if, so a malicious or compromised MDS that sets msg->hdr.version = 1 reaches the IMPORT path with no version-gated decoder having validated snap_trace_len. The shape has been present since ceph_handle_caps() was introduced. Validate snap_trace_len against the message front buffer before consuming it, using the canonical ceph_decode_need() / ceph_has_room() helper. The helper bounds the length with subtraction (n <= end - p, guarded by end >= p) rather than pointer addition, so it is wrap-safe for the attacker-controlled u32 length on 32-bit builds where p + snap_trace_len could overflow the address space. This matches the rest of the ceph decode path (e.g. the pool_ns_len check a few lines below), and the existing goto bad cleanup already covers this exit path. Cc: stable(a)vger.kernel.org Fixes: a8599bd821d0 ("ceph: capability management") Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/caps.c [Context conflicts unmerged commit 8ea412e18131 ("ceph: improve caps debugging output")] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/caps.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 8c1dd9e80e7e..31e5d87ec945 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4124,10 +4124,11 @@ void ceph_handle_caps(struct ceph_mds_session *session, seq = le32_to_cpu(h->seq); mseq = le32_to_cpu(h->migrate_seq); snaptrace = h + 1; snaptrace_len = le32_to_cpu(h->snap_trace_len); + ceph_decode_need(&snaptrace, end, snaptrace_len, bad); p = snaptrace + snaptrace_len; if (msg_version >= 2) { u32 flock_len; ceph_decode_32_safe(&p, end, flock_len, bad); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
by Pan Taixi 19 Aug '26

19 Aug '26

From: Bryam Vargas <hexlabsecurity(a)proton.me> mainline inclusion from mainline-v7.2-rc5 commit 4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16967 CVE: CVE-2026-68160 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ceph_handle_caps() reads snap_trace_len from the wire-format ceph_mds_caps header and uses it unconditionally to build a fake end pointer (snaptrace + snaptrace_len) that is later handed to ceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case: snaptrace = h + 1; snaptrace_len = le32_to_cpu(h->snap_trace_len); p = snaptrace + snaptrace_len; ... case CEPH_CAP_OP_IMPORT: if (snaptrace_len) { ... if (ceph_update_snap_trace(mdsc, snaptrace, snaptrace + snaptrace_len, false, &realm)) { ... } ceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm from snaptrace using ceph_decode_need(&p, e, sizeof(*ri), bad) with the attacker-supplied fake end e == snaptrace + snaptrace_len. With snaptrace_len == 0xFFFFFFFF the bound check is trivially satisfied, ri = p reads sizeof(struct ceph_mds_snap_realm) past the legitimate msg->front buffer, and ri->num_snaps / ri->num_prior_parent_snaps then drive further out-of-bounds reads of the encoded snap arrays. The eleven msg_version >= 2 .. msg_version >= 12 decoder blocks above the op switch each catch this OOB through their ceph_decode_*_safe() / ceph_decode_need() helpers, but they sit behind a hdr.version-gated if, so a malicious or compromised MDS that sets msg->hdr.version = 1 reaches the IMPORT path with no version-gated decoder having validated snap_trace_len. The shape has been present since ceph_handle_caps() was introduced. Validate snap_trace_len against the message front buffer before consuming it, using the canonical ceph_decode_need() / ceph_has_room() helper. The helper bounds the length with subtraction (n <= end - p, guarded by end >= p) rather than pointer addition, so it is wrap-safe for the attacker-controlled u32 length on 32-bit builds where p + snap_trace_len could overflow the address space. This matches the rest of the ceph decode path (e.g. the pool_ns_len check a few lines below), and the existing goto bad cleanup already covers this exit path. Cc: stable(a)vger.kernel.org Fixes: a8599bd821d0 ("ceph: capability management") Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/caps.c [Context conflicts unmerged commit 8ea412e18131 ("ceph: improve caps debugging output")] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/caps.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index b631719941c2..80591f37dd77 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -3765,10 +3765,11 @@ void ceph_handle_caps(struct ceph_mds_session *session, seq = le32_to_cpu(h->seq); mseq = le32_to_cpu(h->migrate_seq); snaptrace = h + 1; snaptrace_len = le32_to_cpu(h->snap_trace_len); + ceph_decode_need(&snaptrace, end, snaptrace_len, bad); p = snaptrace + snaptrace_len; if (msg_version >= 2) { u32 flock_len; ceph_decode_32_safe(&p, end, flock_len, bad); -- 2.34.1

2 1

[PATCH OLK-6.6] nfs: use nfsi->rwsem to protect traversal of the file lock list
by Zizhi Wo 18 Aug '26

18 Aug '26

From: Yang Erkun <yangerkun(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9787 -------------------------------- Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flc_lock while iterating over the file lock list to avoid use-after-free (UAF) problems with file locks. However, functions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot adhere to this rule because recover_lock or nfs4_lock_delegation_recall may take a long time. To resolve this, NFS switches to using nfsi->rwsem for the same protection, and nfs_reclaim_locks follows this approach. Although nfs_delegation_claim_locks uses so_delegreturn_mutex instead, this is inadequate since a single inode can have multiple nfs4_state instances. Therefore, the fix is to also use nfsi->rwsem in this case. Furthermore, after commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), the functions nfs4_locku_done and nfs4_lock_done also break this rule because they call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding this protection could cause many deadlocks, so instead, the call to locks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug fixed by commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), it has been resolved after commit 0460253913e5 ("NFSv4: nfs4_do_open() is incorrectly triggering state recovery") because all slots are drained before calling nfs4_do_reclaim, which prevents concurrent stateid changes along this path. Also, nfs_delegation_claim_locks does not cause this concurrency either since when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is sent, so nfs4_lock_done is not called. Therefore, nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first time the stateid is set. Reported-by: Li Lingfeng <lilingfeng3(a)huawei.com> Closes: https://lore.kernel.org/all/20250419085709.1452492-1-lilingfeng3@huawei.com/ Closes: https://lore.kernel.org/all/20250715030559.2906634-1-lilingfeng3@huawei.com/ Fixes: c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfs/delegation.c | 9 ++++++++- fs/nfs/nfs4proc.c | 22 +++++++++++----------- include/linux/nfs_xdr.h | 1 - 3 files changed, 19 insertions(+), 13 deletions(-) diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c index bbd582d8a7dc..fb93b9edb39b 100644 --- a/fs/nfs/delegation.c +++ b/fs/nfs/delegation.c @@ -143,35 +143,42 @@ int nfs4_check_delegation(struct inode *inode, fmode_t flags) } static int nfs_delegation_claim_locks(struct nfs4_state *state, const nfs4_stateid *stateid) { struct inode *inode = state->inode; + struct nfs_inode *nfsi = NFS_I(inode); struct file_lock *fl; struct file_lock_context *flctx = locks_inode_context(inode); struct list_head *list; int status = 0; if (flctx == NULL) goto out; list = &flctx->flc_posix; + + /* Guard against delegation returns and new lock/unlock calls */ + down_write(&nfsi->rwsem); spin_lock(&flctx->flc_lock); restart: list_for_each_entry(fl, list, fl_list) { if (nfs_file_open_context(fl->fl_file)->state != state) continue; spin_unlock(&flctx->flc_lock); status = nfs4_lock_delegation_recall(fl, state, stateid); - if (status < 0) + if (status < 0) { + up_write(&nfsi->rwsem); goto out; + } spin_lock(&flctx->flc_lock); } if (list == &flctx->flc_posix) { list = &flctx->flc_flock; goto restart; } spin_unlock(&flctx->flc_lock); + up_write(&nfsi->rwsem); out: return status; } static int nfs_delegation_claim_opens(struct inode *inode, diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 58739de4e793..f7163d9de438 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -6953,11 +6953,10 @@ static void nfs4_locku_done(struct rpc_task *task, void *data) if (!nfs4_sequence_done(task, &calldata->res.seq_res)) return; switch (task->tk_status) { case 0: renew_lease(calldata->server, calldata->timestamp); - locks_lock_inode_wait(calldata->lsp->ls_state->inode, &calldata->fl); if (nfs4_update_lock_stateid(calldata->lsp, &calldata->res.stateid)) break; fallthrough; case -NFS4ERR_ADMIN_REVOKED: @@ -7217,15 +7216,10 @@ static void nfs4_lock_done(struct rpc_task *task, void *calldata) data->rpc_status = task->tk_status; switch (task->tk_status) { case 0: renew_lease(NFS_SERVER(d_inode(data->ctx->dentry)), data->timestamp); - if (data->arg.new_lock && !data->cancelled) { - data->fl.fl_flags &= ~(FL_SLEEP | FL_ACCESS); - if (locks_lock_inode_wait(lsp->ls_state->inode, &data->fl) < 0) - goto out_restart; - } if (data->arg.new_lock_owner != 0) { nfs_confirm_seqid(&lsp->ls_seqid, 0); nfs4_stateid_copy(&lsp->ls_stateid, &data->res.stateid); set_bit(NFS_LOCK_INITIALIZED, &lsp->ls_flags); } else if (!nfs4_update_lock_stateid(lsp, &data->res.stateid)) @@ -7330,15 +7324,14 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f nfs4_init_sequence(&data->arg.seq_args, &data->res.seq_res, 1, recovery_type > NFS_LOCK_NEW); msg.rpc_argp = &data->arg; msg.rpc_resp = &data->res; task_setup_data.callback_data = data; - if (recovery_type > NFS_LOCK_NEW) { - if (recovery_type == NFS_LOCK_RECLAIM) - data->arg.reclaim = NFS_LOCK_RECLAIM; - } else - data->arg.new_lock = 1; + + if (recovery_type == NFS_LOCK_RECLAIM) + data->arg.reclaim = NFS_LOCK_RECLAIM; + task = rpc_run_task(&task_setup_data); if (IS_ERR(task)) return PTR_ERR(task); ret = rpc_wait_for_completion_task(task); if (ret == 0) { @@ -7446,10 +7439,17 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock goto out; } up_read(&nfsi->rwsem); mutex_unlock(&sp->so_delegreturn_mutex); status = _nfs4_do_setlk(state, cmd, request, NFS_LOCK_NEW); + if (status) + goto out; + + down_read(&nfsi->rwsem); + request->fl_flags &= ~(FL_SLEEP | FL_ACCESS); + status = locks_lock_inode_wait(state->inode, request); + up_read(&nfsi->rwsem); out: request->fl_flags = fl_flags; return status; } diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h index 5d2ad7bd92c3..ed27379ff302 100644 --- a/include/linux/nfs_xdr.h +++ b/include/linux/nfs_xdr.h @@ -561,11 +561,10 @@ struct nfs_lock_args { struct nfs_seqid * open_seqid; nfs4_stateid open_stateid; struct nfs_lowner lock_owner; unsigned char block : 1; unsigned char reclaim : 1; - unsigned char new_lock : 1; unsigned char new_lock_owner : 1; }; struct nfs_lock_res { struct nfs4_sequence_res seq_res; -- 2.52.0

2 1

[PATCH OLK-6.6 V1] IB/mad: Drop unmatched RMPP responses before reassembly
by Yao Yiqi 18 Aug '26

18 Aug '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.148 commit dfa535c94406c03d3f0c869ef3ba5528e395737c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17033 CVE: CVE-2026-68425 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d2e52d610b9b09694261632340b801a421e0b0c5 ] Kernel-handled RMPP receive processing starts reassembly for active DATA responses before the response is matched to an outstanding send. The normal match happens later, after ib_process_rmpp_recv_wc() has either assembled a complete message or consumed the segment. That ordering lets an unsolicited response that routes to a kernel RMPP agent by the high TID bits allocate or extend RMPP receive state before the full TID and source address are checked against a real request. A reordered burst can therefore reach the receive-side insertion path even though the response would not match any send. For kernel-handled RMPP DATA responses, require the existing ib_find_send_mad() match before entering RMPP reassembly. The matcher already checks the full TID, management class and source address/GID against the agent wait, backlog and in-flight send lists. If there is no match, drop the response without creating RMPP state. This leaves the RMPP window behavior unchanged and only rejects responses that have no corresponding request. Fixes: fa619a77046b ("[PATCH] IB: Add RMPP implementation") Assisted-by: Codex:gpt-5-5-xhigh Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Link: https://patch.msgid.link/3170ff3bc389a930bb1641f2caa394a0b2241579.178077490… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/infiniband/core/mad.c [ context conflict ] Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- drivers/infiniband/core/mad.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c index 242434c09e8d..bddb1c607aff 100644 --- a/drivers/infiniband/core/mad.c +++ b/drivers/infiniband/core/mad.c @@ -1778,6 +1778,24 @@ void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr) &mad_send_wr->mad_agent_priv->done_list); } +static bool is_kernel_rmpp_data_response(struct ib_mad_agent_private *agent, + struct ib_mad_recv_wc *mad_recv_wc) +{ + const struct ib_mad_hdr *mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr; + struct ib_rmpp_mad *rmpp_mad; + + if (!ib_mad_kernel_rmpp_agent(&agent->agent) || + !ib_response_mad(mad_hdr) || + !ib_is_mad_class_rmpp(mad_hdr->mgmt_class)) + return false; + + rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad; + + return (ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) & + IB_MGMT_RMPP_FLAG_ACTIVE) && + rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_DATA; +} + static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv, struct ib_mad_recv_wc *mad_recv_wc) { @@ -1796,6 +1814,18 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv, } list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list); + if (is_kernel_rmpp_data_response(mad_agent_priv, mad_recv_wc)) { + spin_lock_irqsave(&mad_agent_priv->lock, flags); + mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc); + spin_unlock_irqrestore(&mad_agent_priv->lock, flags); + + if (!mad_send_wr) { + ib_free_recv_mad(mad_recv_wc); + deref_mad_agent(mad_agent_priv); + return; + } + } + if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) { mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv, mad_recv_wc); -- 2.34.1

2 1

[PATCH OLK-6.6] nfs: use nfsi->rwsem to protect traversal of the file lock list
by Zizhi Wo 18 Aug '26

18 Aug '26

From: Yang Erkun <yangerkun(a)huawei.com> hulk inclusion category: bugfix bugzilla: http://openeuler.huawei.com/bugzilla/show_bug.cgi?id=190626 -------------------------------- Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flc_lock while iterating over the file lock list to avoid use-after-free (UAF) problems with file locks. However, functions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot adhere to this rule because recover_lock or nfs4_lock_delegation_recall may take a long time. To resolve this, NFS switches to using nfsi->rwsem for the same protection, and nfs_reclaim_locks follows this approach. Although nfs_delegation_claim_locks uses so_delegreturn_mutex instead, this is inadequate since a single inode can have multiple nfs4_state instances. Therefore, the fix is to also use nfsi->rwsem in this case. Furthermore, after commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), the functions nfs4_locku_done and nfs4_lock_done also break this rule because they call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding this protection could cause many deadlocks, so instead, the call to locks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug fixed by commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), it has been resolved after commit 0460253913e5 ("NFSv4: nfs4_do_open() is incorrectly triggering state recovery") because all slots are drained before calling nfs4_do_reclaim, which prevents concurrent stateid changes along this path. Also, nfs_delegation_claim_locks does not cause this concurrency either since when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is sent, so nfs4_lock_done is not called. Therefore, nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first time the stateid is set. Reported-by: Li Lingfeng <lilingfeng3(a)huawei.com> Closes: https://lore.kernel.org/all/20250419085709.1452492-1-lilingfeng3@huawei.com/ Closes: https://lore.kernel.org/all/20250715030559.2906634-1-lilingfeng3@huawei.com/ Fixes: c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfs/delegation.c | 9 ++++++++- fs/nfs/nfs4proc.c | 22 +++++++++++----------- include/linux/nfs_xdr.h | 1 - 3 files changed, 19 insertions(+), 13 deletions(-) diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c index bbd582d8a7dc..fb93b9edb39b 100644 --- a/fs/nfs/delegation.c +++ b/fs/nfs/delegation.c @@ -143,35 +143,42 @@ int nfs4_check_delegation(struct inode *inode, fmode_t flags) } static int nfs_delegation_claim_locks(struct nfs4_state *state, const nfs4_stateid *stateid) { struct inode *inode = state->inode; + struct nfs_inode *nfsi = NFS_I(inode); struct file_lock *fl; struct file_lock_context *flctx = locks_inode_context(inode); struct list_head *list; int status = 0; if (flctx == NULL) goto out; list = &flctx->flc_posix; + + /* Guard against delegation returns and new lock/unlock calls */ + down_write(&nfsi->rwsem); spin_lock(&flctx->flc_lock); restart: list_for_each_entry(fl, list, fl_list) { if (nfs_file_open_context(fl->fl_file)->state != state) continue; spin_unlock(&flctx->flc_lock); status = nfs4_lock_delegation_recall(fl, state, stateid); - if (status < 0) + if (status < 0) { + up_write(&nfsi->rwsem); goto out; + } spin_lock(&flctx->flc_lock); } if (list == &flctx->flc_posix) { list = &flctx->flc_flock; goto restart; } spin_unlock(&flctx->flc_lock); + up_write(&nfsi->rwsem); out: return status; } static int nfs_delegation_claim_opens(struct inode *inode, diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 58739de4e793..f7163d9de438 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -6953,11 +6953,10 @@ static void nfs4_locku_done(struct rpc_task *task, void *data) if (!nfs4_sequence_done(task, &calldata->res.seq_res)) return; switch (task->tk_status) { case 0: renew_lease(calldata->server, calldata->timestamp); - locks_lock_inode_wait(calldata->lsp->ls_state->inode, &calldata->fl); if (nfs4_update_lock_stateid(calldata->lsp, &calldata->res.stateid)) break; fallthrough; case -NFS4ERR_ADMIN_REVOKED: @@ -7217,15 +7216,10 @@ static void nfs4_lock_done(struct rpc_task *task, void *calldata) data->rpc_status = task->tk_status; switch (task->tk_status) { case 0: renew_lease(NFS_SERVER(d_inode(data->ctx->dentry)), data->timestamp); - if (data->arg.new_lock && !data->cancelled) { - data->fl.fl_flags &= ~(FL_SLEEP | FL_ACCESS); - if (locks_lock_inode_wait(lsp->ls_state->inode, &data->fl) < 0) - goto out_restart; - } if (data->arg.new_lock_owner != 0) { nfs_confirm_seqid(&lsp->ls_seqid, 0); nfs4_stateid_copy(&lsp->ls_stateid, &data->res.stateid); set_bit(NFS_LOCK_INITIALIZED, &lsp->ls_flags); } else if (!nfs4_update_lock_stateid(lsp, &data->res.stateid)) @@ -7330,15 +7324,14 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f nfs4_init_sequence(&data->arg.seq_args, &data->res.seq_res, 1, recovery_type > NFS_LOCK_NEW); msg.rpc_argp = &data->arg; msg.rpc_resp = &data->res; task_setup_data.callback_data = data; - if (recovery_type > NFS_LOCK_NEW) { - if (recovery_type == NFS_LOCK_RECLAIM) - data->arg.reclaim = NFS_LOCK_RECLAIM; - } else - data->arg.new_lock = 1; + + if (recovery_type == NFS_LOCK_RECLAIM) + data->arg.reclaim = NFS_LOCK_RECLAIM; + task = rpc_run_task(&task_setup_data); if (IS_ERR(task)) return PTR_ERR(task); ret = rpc_wait_for_completion_task(task); if (ret == 0) { @@ -7446,10 +7439,17 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock goto out; } up_read(&nfsi->rwsem); mutex_unlock(&sp->so_delegreturn_mutex); status = _nfs4_do_setlk(state, cmd, request, NFS_LOCK_NEW); + if (status) + goto out; + + down_read(&nfsi->rwsem); + request->fl_flags &= ~(FL_SLEEP | FL_ACCESS); + status = locks_lock_inode_wait(state->inode, request); + up_read(&nfsi->rwsem); out: request->fl_flags = fl_flags; return status; } diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h index 5d2ad7bd92c3..ed27379ff302 100644 --- a/include/linux/nfs_xdr.h +++ b/include/linux/nfs_xdr.h @@ -561,11 +561,10 @@ struct nfs_lock_args { struct nfs_seqid * open_seqid; nfs4_stateid open_stateid; struct nfs_lowner lock_owner; unsigned char block : 1; unsigned char reclaim : 1; - unsigned char new_lock : 1; unsigned char new_lock_owner : 1; }; struct nfs_lock_res { struct nfs4_sequence_res seq_res; -- 2.52.0

2 1

[PATCH OLK-6.6 v3 0/8] irqbypass: Cleanups and a perf improvement
by Qiqi Li 18 Aug '26

18 Aug '26

From: Qiqi Li <liqiqi23(a)huawei.com> The two primary goals of this series are to make the irqbypass concept easier to understand, and to address the terrible performance that can result from using a list to track connections. Provides additional adaptation for the ub vfio device in openEuler. Sean Christopherson (8): irqbypass: Drop pointless and misleading THIS_MODULE get/put irqbypass: Drop superfluous might_sleep() annotations irqbypass: Take ownership of producer/consumer token tracking irqbypass: Explicitly track producer and consumer bindings irqbypass: Use paired consumer/producer to disconnect during unregister irqbypass: Use guard(mutex) in lieu of manual lock+unlock irqbypass: Use xarray to track producers and consumers irqbypass: Require producers to pass in Linux IRQ number during registration arch/x86/kvm/x86.c | 4 +- drivers/vfio/pci/vfio_pci_intrs.c | 10 +- drivers/vfio/ubus/vfio_ub_intrs.c | 12 +- drivers/vhost/vdpa.c | 10 +- include/linux/irqbypass.h | 46 +++---- virt/kvm/eventfd.c | 7 +- virt/lib/irqbypass.c | 192 +++++++++++------------------- 7 files changed, 112 insertions(+), 169 deletions(-) -- 2.43.0

2 9

[PATCH OLK-5.10] tty: serial: kgdboc: Fix 8250_* kgdb over serial
by Yi Yang 18 Aug '26

18 Aug '26

From: Michael Trimarchi <michael(a)amarulasolutions.com> mainline inclusion from mainline-v6.8-rc1 commit 788aeef392d27545ae99af2875068a9dd0531d5f category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Check if port type is not PORT_UNKNOWN during poll_init. The kgdboc calls the tty_find_polling_driver that check if the serial is able to use poll_init. The poll_init calls the uart uart_poll_init that try to configure the uart with the selected boot parameters. The uart must be ready before setting parameters. Seems that PORT_UNKNOWN is already used by other functions in serial_core to detect uart status, so use the same to avoid to use it in invalid state. The crash happen for instance in am62x architecture where the 8250 register the platform driver after the 8250 core is initialized. Follow the report crash coming from KGDB Thread 2 received signal SIGSEGV, Segmentation fault. [Switching to Thread 1] _outb (addr=<optimized out>, value=<optimized out>) at ./include/asm-generic/io.h:584 584 __raw_writeb(value, PCI_IOBASE + addr); (gdb) bt This section of the code is too early because in this case the omap serial is not probed Thread 2 received signal SIGSEGV, Segmentation fault. [Switching to Thread 1] _outb (addr=<optimized out>, value=<optimized out>) at ./include/asm-generic/io.h:584 584 __raw_writeb(value, PCI_IOBASE + addr); (gdb) bt Thread 2 received signal SIGSEGV, Segmentation fault. [Switching to Thread 1] _outb (addr=<optimized out>, value=<optimized out>) at ./include/asm-generic/io.h:584 584 __raw_writeb(value, PCI_IOBASE + addr); (gdb) bt 0 _outb (addr=<optimized out>, value=<optimized out>) at ./include/asm-generic/io.h:584 1 logic_outb (value=0 '\000', addr=18446739675637874689) at lib/logic_pio.c:299 2 0xffff80008082dfcc in io_serial_out (p=0x0, offset=16760830, value=0) at drivers/tty/serial/8250/8250_port.c:416 3 0xffff80008082fe34 in serial_port_out (value=<optimized out>, offset=<optimized out>, up=<optimized out>) at ./include/linux/serial_core.h:677 4 serial8250_do_set_termios (port=0xffff8000828ee940 <serial8250_ports+1568>, termios=0xffff80008292b93c, old=0x0) at drivers/tty/serial/8250/8250_port.c:2860 5 0xffff800080830064 in serial8250_set_termios (port=0xfffffbfffe800000, termios=0xffbffe, old=0x0) at drivers/tty/serial/8250/8250_port.c:2912 6 0xffff80008082571c in uart_set_options (port=0xffff8000828ee940 <serial8250_ports+1568>, co=0x0, baud=115200, parity=110, bits=8, flow=110) at drivers/tty/serial/serial_core.c:2285 7 0xffff800080828434 in uart_poll_init (driver=0xfffffbfffe800000, line=16760830, options=0xffff8000828f7506 <config+6> "115200n8") at drivers/tty/serial/serial_core.c:2656 8 0xffff800080801690 in tty_find_polling_driver (name=0xffff8000828f7500 <config> "ttyS2,115200n8", line=0xffff80008292ba90) at drivers/tty/tty_io.c:410 9 0xffff80008086c0b0 in configure_kgdboc () at drivers/tty/serial/kgdboc.c:194 10 0xffff80008086c1ec in kgdboc_probe (pdev=0xfffffbfffe800000) at drivers/tty/serial/kgdboc.c:249 11 0xffff8000808b399c in platform_probe (_dev=0xffff000000ebb810) at drivers/base/platform.c:1404 12 0xffff8000808b0b44 in call_driver_probe (drv=<optimized out>, dev=<optimized out>) at drivers/base/dd.c:579 13 really_probe (dev=0xffff000000ebb810, drv=0xffff80008277f138 <kgdboc_platform_driver+48>) at drivers/base/dd.c:658 14 0xffff8000808b0d2c in __driver_probe_device (drv=0xffff80008277f138 <kgdboc_platform_driver+48>, dev=0xffff000000ebb810) at drivers/base/dd.c:800 15 0xffff8000808b0eb8 in driver_probe_device (drv=0xfffffbfffe800000, dev=0xffff000000ebb810) at drivers/base/dd.c:830 16 0xffff8000808b0ff4 in __device_attach_driver (drv=0xffff80008277f138 <kgdboc_platform_driver+48>, _data=0xffff80008292bc48) at drivers/base/dd.c:958 17 0xffff8000808ae970 in bus_for_each_drv (bus=0xfffffbfffe800000, start=0x0, data=0xffff80008292bc48, fn=0xffff8000808b0f3c <__device_attach_driver>) at drivers/base/bus.c:457 18 0xffff8000808b1408 in __device_attach (dev=0xffff000000ebb810, allow_async=true) at drivers/base/dd.c:1030 19 0xffff8000808b16d8 in device_initial_probe (dev=0xfffffbfffe800000) at drivers/base/dd.c:1079 20 0xffff8000808af9f4 in bus_probe_device (dev=0xffff000000ebb810) at drivers/base/bus.c:532 21 0xffff8000808ac77c in device_add (dev=0xfffffbfffe800000) at drivers/base/core.c:3625 22 0xffff8000808b3428 in platform_device_add (pdev=0xffff000000ebb800) at drivers/base/platform.c:716 23 0xffff800081b5dc0c in init_kgdboc () at drivers/tty/serial/kgdboc.c:292 24 0xffff800080014db0 in do_one_initcall (fn=0xffff800081b5dba4 <init_kgdboc>) at init/main.c:1236 25 0xffff800081b0114c in do_initcall_level (command_line=<optimized out>, level=<optimized out>) at init/main.c:1298 26 do_initcalls () at init/main.c:1314 27 do_basic_setup () at init/main.c:1333 28 kernel_init_freeable () at init/main.c:1551 29 0xffff8000810271ec in kernel_init (unused=0xfffffbfffe800000) at init/main.c:1441 30 0xffff800080015e80 in ret_from_fork () at arch/arm64/kernel/entry.S:857 Reviewed-by: Douglas Anderson <dianders(a)chromium.org> Signed-off-by: Michael Trimarchi <michael(a)amarulasolutions.com> Link: https://lore.kernel.org/r/20231224131200.266224-1-michael@amarulasolutions.… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/serial_core.c [Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/serial_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index 86e028023b66..8207e4dec81d 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -2512,7 +2512,8 @@ static int uart_poll_init(struct tty_driver *driver, int line, char *options) mutex_lock(&tport->mutex); port = uart_port_check(state); - if (!port || !(port->ops->poll_get_char && port->ops->poll_put_char)) { + if (!port || port->type == PORT_UNKNOWN || + !(port->ops->poll_get_char && port->ops->poll_put_char)) { ret = -1; goto out; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ext4: avoid infinite loops caused by residual data
by Lai Zewei 18 Aug '26

18 Aug '26

mainline inclusion from mainline-v7.0-rc6 commit 5422fe71d26d42af6c454ca9527faaad4e677d6c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously. The above causes ext4_xattr_block_set() to enter an infinite loop about "inserted" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1]. If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases: 1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case. 2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks. [1] INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline] Reported-by: syzbot+512459401510e2a9a39f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1659aaaaa8d9d11265d7 Tested-by: syzbot+1659aaaaa8d9d11265d7(a)syzkaller.appspotmail.com Reported-by: syzbot+1659aaaaa8d9d11265d7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=512459401510e2a9a39f Tested-by: syzbot+1659aaaaa8d9d11265d7(a)syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Tested-by: syzbot+512459401510e2a9a39f(a)syzkaller.appspotmail.com Link: https://patch.msgid.link/tencent_43696283A68450B761D76866C6F360E36705@qq.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Cc: stable(a)kernel.org Conflicts: fs/ext4/extents.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- fs/ext4/extents.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 5f2654bfe2f1..2db5289dc52f 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -4673,14 +4673,22 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode, &newex, flags); if (err && free_on_err) { - int fb_flags = flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE ? - EXT4_FREE_BLOCKS_NO_QUOT_UPDATE : 0; - /* free data blocks we just allocated */ - /* not a good idea to call discard here directly, - * but otherwise we'd need to call it every free() */ - ext4_discard_preallocations(inode); - ext4_free_blocks(handle, inode, NULL, newblock, - EXT4_C2B(sbi, allocated_clusters), fb_flags); + /* + * Gracefully handle out of space conditions. If the filesystem + * is inconsistent, we'll just leak allocated blocks to avoid + * causing even more damage. + */ + if (err == -EDQUOT || err == -ENOSPC) { + int fb_flags = flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE ? + EXT4_FREE_BLOCKS_NO_QUOT_UPDATE : 0; + /* free data blocks we just allocated. + * not a good idea to call discard here directly, + * but otherwise we'd need to call it every free(). + */ + ext4_discard_preallocations(inode); + ext4_free_blocks(handle, inode, NULL, newblock, + EXT4_C2B(sbi, allocated_clusters), fb_flags); + } goto out2; } -- 2.52.0

2 1

[PATCH OLK-6.6 v2 0/8] irqbypass: Cleanups and a perf improvement
by Qiqi Li 18 Aug '26

18 Aug '26

From: Qiqi Li <liqiqi23(a)huawei.com> The two primary goals of this series are to make the irqbypass concept easier to understand, and to address the terrible performance that can result from using a list to track connections. Provides additional adaptation for the ub vfio device in openEuler. Sean Christopherson (8): irqbypass: Drop pointless and misleading THIS_MODULE get/put irqbypass: Drop superfluous might_sleep() annotations irqbypass: Take ownership of producer/consumer token tracking irqbypass: Explicitly track producer and consumer bindings irqbypass: Use paired consumer/producer to disconnect during unregister irqbypass: Use guard(mutex) in lieu of manual lock+unlock irqbypass: Use xarray to track producers and consumers irqbypass: Require producers to pass in Linux IRQ number during registration arch/x86/kvm/x86.c | 4 +- drivers/vfio/pci/vfio_pci_intrs.c | 10 +- drivers/vfio/ubus/vfio_ub_intrs.c | 11 +- drivers/vhost/vdpa.c | 10 +- include/linux/irqbypass.h | 46 +++---- virt/kvm/eventfd.c | 7 +- virt/lib/irqbypass.c | 192 +++++++++++------------------- 7 files changed, 112 insertions(+), 168 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6] cifs: Fix busy dentry used during umounting
by Zizhi Wo 18 Aug '26

18 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9783 -------------------------------- Commit 3b11912af75f ("[Backport] cifs: Fix busy dentry used after unmounting") fixed the issue in cifs where deferred close of a file led to a dentry reference count not being released in umount, by flushing deferredclose_wq in cifs_kill_sb to solve it. However, the cifs DIO path suffers from the same busy-dentry problem caused by a delayed dentry reference-count release: process A[dio] process B[cifsd] process C[close] cifs_direct_writev ... smb2_writev_callback wait_for_completion_killable queue_work(cifsiod_wq, xx)[1] cifs_uncached_writev_complete complete(&ctx->done)[2] kref_put(&ctx->refcount, xxx) // write done! cifs_close _cifsFileInfo_put[3] --cfile->count // count = 1 kref_put(&wdata->refcount, xx) ... _cifsFileInfo_put --cfile->count // count = 0 queue_work(fileinfo_put_wq, xx)[4] cifsFileInfo_put_work cifsFileInfo_put_final dput At [1] the work is queued onto cifsiod_wq. At [2] the foreground thread waiting on the write is woken up; after the write path exits and closes the file, at [3] the cfile reference count has not yet dropped to 0, so the final dput is not called synchronously. The cifsiod worker then drops the cfile reference count to 0 and calls the final dput on fileinfo_put_wq at [4]. If the umount path is triggered before [4], it results in the following warning: BUG: Dentry 00000000eab1f070{i=9a917b66ae404fec,n=test} still in use (1) [unmount of cifs cifs] Therefore, cifsiod_wq/fileinfo_put_wq/serverclose_wq need to be flushed. Fixes: b28b211c8d8f ("cifs: open files should not hold ref on superblock") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/smb/client/cifsfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c index a2887b978dc8..f6d74e961414 100644 --- a/fs/smb/client/cifsfs.c +++ b/fs/smb/client/cifsfs.c @@ -298,10 +298,13 @@ static void cifs_kill_sb(struct super_block *sb) /* Wait for all pending oplock breaks to complete */ flush_workqueue(cifsoplockd_wq); /* Wait for all opened files to release */ flush_workqueue(deferredclose_wq); + flush_workqueue(cifsiod_wq); + flush_workqueue(serverclose_wq); + flush_workqueue(fileinfo_put_wq); /* finally release root dentry */ dput(cifs_sb->root); cifs_sb->root = NULL; } -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS] ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
by Pan Taixi 18 Aug '26

18 Aug '26

From: Bryam Vargas <hexlabsecurity(a)proton.me> mainline inclusion from mainline-v7.2-rc5 commit 4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/16967 CVE: CVE-2026-68160 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ceph_handle_caps() reads snap_trace_len from the wire-format ceph_mds_caps header and uses it unconditionally to build a fake end pointer (snaptrace + snaptrace_len) that is later handed to ceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case: snaptrace = h + 1; snaptrace_len = le32_to_cpu(h->snap_trace_len); p = snaptrace + snaptrace_len; ... case CEPH_CAP_OP_IMPORT: if (snaptrace_len) { ... if (ceph_update_snap_trace(mdsc, snaptrace, snaptrace + snaptrace_len, false, &realm)) { ... } ceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm from snaptrace using ceph_decode_need(&p, e, sizeof(*ri), bad) with the attacker-supplied fake end e == snaptrace + snaptrace_len. With snaptrace_len == 0xFFFFFFFF the bound check is trivially satisfied, ri = p reads sizeof(struct ceph_mds_snap_realm) past the legitimate msg->front buffer, and ri->num_snaps / ri->num_prior_parent_snaps then drive further out-of-bounds reads of the encoded snap arrays. The eleven msg_version >= 2 .. msg_version >= 12 decoder blocks above the op switch each catch this OOB through their ceph_decode_*_safe() / ceph_decode_need() helpers, but they sit behind a hdr.version-gated if, so a malicious or compromised MDS that sets msg->hdr.version = 1 reaches the IMPORT path with no version-gated decoder having validated snap_trace_len. The shape has been present since ceph_handle_caps() was introduced. Validate snap_trace_len against the message front buffer before consuming it, using the canonical ceph_decode_need() / ceph_has_room() helper. The helper bounds the length with subtraction (n <= end - p, guarded by end >= p) rather than pointer addition, so it is wrap-safe for the attacker-controlled u32 length on 32-bit builds where p + snap_trace_len could overflow the address space. This matches the rest of the ceph decode path (e.g. the pool_ns_len check a few lines below), and the existing goto bad cleanup already covers this exit path. Cc: stable(a)vger.kernel.org Fixes: a8599bd821d0 ("ceph: capability management") Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/caps.c [Context conflicts unmerged commit 8ea412e18131 ("ceph: improve caps debugging output")] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/caps.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index b631719941c2..80591f37dd77 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -3765,10 +3765,11 @@ void ceph_handle_caps(struct ceph_mds_session *session, seq = le32_to_cpu(h->seq); mseq = le32_to_cpu(h->migrate_seq); snaptrace = h + 1; snaptrace_len = le32_to_cpu(h->snap_trace_len); + ceph_decode_need(&snaptrace, end, snaptrace_len, bad); p = snaptrace + snaptrace_len; if (msg_version >= 2) { u32 flock_len; ceph_decode_32_safe(&p, end, flock_len, bad); -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
by Pan Taixi 18 Aug '26

18 Aug '26

From: Bryam Vargas <hexlabsecurity(a)proton.me> mainline inclusion from mainline-v7.2-rc5 commit 4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/16967 CVE: CVE-2026-68160 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ceph_handle_caps() reads snap_trace_len from the wire-format ceph_mds_caps header and uses it unconditionally to build a fake end pointer (snaptrace + snaptrace_len) that is later handed to ceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case: snaptrace = h + 1; snaptrace_len = le32_to_cpu(h->snap_trace_len); p = snaptrace + snaptrace_len; ... case CEPH_CAP_OP_IMPORT: if (snaptrace_len) { ... if (ceph_update_snap_trace(mdsc, snaptrace, snaptrace + snaptrace_len, false, &realm)) { ... } ceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm from snaptrace using ceph_decode_need(&p, e, sizeof(*ri), bad) with the attacker-supplied fake end e == snaptrace + snaptrace_len. With snaptrace_len == 0xFFFFFFFF the bound check is trivially satisfied, ri = p reads sizeof(struct ceph_mds_snap_realm) past the legitimate msg->front buffer, and ri->num_snaps / ri->num_prior_parent_snaps then drive further out-of-bounds reads of the encoded snap arrays. The eleven msg_version >= 2 .. msg_version >= 12 decoder blocks above the op switch each catch this OOB through their ceph_decode_*_safe() / ceph_decode_need() helpers, but they sit behind a hdr.version-gated if, so a malicious or compromised MDS that sets msg->hdr.version = 1 reaches the IMPORT path with no version-gated decoder having validated snap_trace_len. The shape has been present since ceph_handle_caps() was introduced. Validate snap_trace_len against the message front buffer before consuming it, using the canonical ceph_decode_need() / ceph_has_room() helper. The helper bounds the length with subtraction (n <= end - p, guarded by end >= p) rather than pointer addition, so it is wrap-safe for the attacker-controlled u32 length on 32-bit builds where p + snap_trace_len could overflow the address space. This matches the rest of the ceph decode path (e.g. the pool_ns_len check a few lines below), and the existing goto bad cleanup already covers this exit path. Cc: stable(a)vger.kernel.org Fixes: a8599bd821d0 ("ceph: capability management") Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/caps.c [Context conflicts unmerged commit 8ea412e18131 ("ceph: improve caps debugging output")] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/caps.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 8c1dd9e80e7e..31e5d87ec945 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4124,10 +4124,11 @@ void ceph_handle_caps(struct ceph_mds_session *session, seq = le32_to_cpu(h->seq); mseq = le32_to_cpu(h->migrate_seq); snaptrace = h + 1; snaptrace_len = le32_to_cpu(h->snap_trace_len); + ceph_decode_need(&snaptrace, end, snaptrace_len, bad); p = snaptrace + snaptrace_len; if (msg_version >= 2) { u32 flock_len; ceph_decode_32_safe(&p, end, flock_len, bad); -- 2.34.1

2 1

[PATCH OLK-6.6] cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
by Fanhua Li 18 Aug '26

18 Aug '26

From: Xu Rao <raoxu(a)uniontech.com> stable inclusion from stable-v6.6.148 commit 7344c84e32413e5c8832f74b8a612b0194e5c051 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17022 CVE: CVE-2026-68184 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b27e195d4db8dea263050bdbeb11881b2999c9c6 upstream. mmc_ioctl_cdrom_volume() first reads the audio control mode page into a 32-byte stack buffer with cgc->buflen set to 24. If the device reports a block descriptor, the function increases cgc->buflen to include that descriptor and reads the page again. For CDROMVOLCTRL, the function then builds a MODE SELECT parameter list by moving cgc->buffer forward by offset - 8 bytes. This drops the block descriptor from the outgoing payload and leaves a new 8-byte mode parameter header in front of the audio control page. However, cgc->buflen is left unchanged. With a standard 8-byte block descriptor, cgc->buffer points at buffer + 8 but cgc->buflen remains 32. cdrom_mode_select() therefore asks the low level packet path to write 32 bytes from that adjusted pointer, reading 8 bytes past the end of the 32-byte stack buffer. This is not hit by CDROMVOLREAD, and CDROMVOLCTRL only triggers it on drives that return a non-zero block descriptor length, which helps explain why it has gone unnoticed. The overread is also sent to the device as extra MODE SELECT payload, so it may not produce an obvious local failure. Reduce cgc->buflen by the same amount as the buffer pointer adjustment so the MODE SELECT transfer covers only the intended parameter list. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Xu Rao <raoxu(a)uniontech.com> Signed-off-by: Phillip Potter <phil(a)philpotter.co.uk> Link: https://patch.msgid.link/20260720194421.1497-2-phil@philpotter.co.uk Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- drivers/cdrom/cdrom.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c index 2283fd91ff5f8..c638f6a9bc7d6 100644 --- a/drivers/cdrom/cdrom.c +++ b/drivers/cdrom/cdrom.c @@ -3191,6 +3191,7 @@ static noinline int mmc_ioctl_cdrom_volume(struct cdrom_device_info *cdi, /* set volume */ cgc->buffer = buffer + offset - 8; + cgc->buflen -= offset - 8; memset(cgc->buffer, 0, 8); return cdrom_mode_select(cdi, cgc); } -- 2.43.0

2 1

[PATCH OLK-6.6] openeuler_defconfig: Enable Landlock (testing)
by GONG Ruiqi 18 Aug '26

18 Aug '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9681 -------------------------------- Test only. Do NOT merge. Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++-- arch/x86/configs/openeuler_defconfig | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 9c6d128276cd..1816509a5041 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7482,7 +7482,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set -# CONFIG_SECURITY_LANDLOCK is not set +CONFIG_SECURITY_LANDLOCK=y CONFIG_INTEGRITY=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y @@ -7539,7 +7539,7 @@ CONFIG_EVM_X509_PATH="/etc/keys/x509_evm.der" CONFIG_DEFAULT_SECURITY_SELINUX=y # CONFIG_DEFAULT_SECURITY_APPARMOR is not set # CONFIG_DEFAULT_SECURITY_DAC is not set -CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" # # Kernel hardening options diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 685c32d1e7af..ec621167398d 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -8667,7 +8667,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set -# CONFIG_SECURITY_LANDLOCK is not set +CONFIG_SECURITY_LANDLOCK=y CONFIG_INTEGRITY=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y @@ -8724,7 +8724,7 @@ CONFIG_EVM_X509_PATH="/etc/keys/x509_evm.der" CONFIG_DEFAULT_SECURITY_SELINUX=y # CONFIG_DEFAULT_SECURITY_APPARMOR is not set # CONFIG_DEFAULT_SECURITY_DAC is not set -CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" # # Kernel hardening options -- 2.43.0

2 1

[PATCH OLK-6.6 0/8] irqbypass: Cleanups and a perf improvement
by Qiqi Li 17 Aug '26

17 Aug '26

From: Qiqi Li <liqiqi23(a)huawei.com> The two primary goals of this series are to make the irqbypass concept easier to understand, and to address the terrible performance that can result from using a list to track connections. Provides additional adaptation for the ub vfio device in openEuler. Sean Christopherson (8): irqbypass: Drop pointless and misleading THIS_MODULE get/put irqbypass: Drop superfluous might_sleep() annotations irqbypass: Take ownership of producer/consumer token tracking irqbypass: Explicitly track producer and consumer bindings irqbypass: Use paired consumer/producer to disconnect during unregister irqbypass: Use guard(mutex) in lieu of manual lock+unlock irqbypass: Use xarray to track producers and consumers irqbypass: Require producers to pass in Linux IRQ number during registration arch/x86/kvm/x86.c | 4 +- drivers/vfio/pci/vfio_pci_intrs.c | 10 +- drivers/vfio/ubus/vfio_ub_intrs.c | 11 +- drivers/vhost/vdpa.c | 10 +- include/linux/irqbypass.h | 46 ++++---- virt/kvm/eventfd.c | 7 +- virt/lib/irqbypass.c | 190 +++++++++++------------------- 7 files changed, 111 insertions(+), 167 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6 0/8] irqbypass: Cleanups and a perf improvement
by Qiqi Li 17 Aug '26

17 Aug '26

From: Qiqi Li <liqiqi23(a)huawei.com> The two primary goals of this series are to make the irqbypass concept easier to understand, and to address the terrible performance that can result from using a list to track connections. Provides additional adaptation for the ub vfio device in openEuler. Sean Christopherson (8): irqbypass: Drop pointless and misleading THIS_MODULE get/put irqbypass: Drop superfluous might_sleep() annotations irqbypass: Take ownership of producer/consumer token tracking irqbypass: Explicitly track producer and consumer bindings irqbypass: Use paired consumer/producer to disconnect during unregister irqbypass: Use guard(mutex) in lieu of manual lock+unlock irqbypass: Use xarray to track producers and consumers irqbypass: Require producers to pass in Linux IRQ number during registration arch/x86/kvm/x86.c | 4 +- drivers/vfio/pci/vfio_pci_intrs.c | 10 +- drivers/vfio/ubus/vfio_ub_intrs.c | 11 +- drivers/vhost/vdpa.c | 10 +- include/linux/irqbypass.h | 46 ++++---- virt/kvm/eventfd.c | 7 +- virt/lib/irqbypass.c | 190 +++++++++++------------------- 7 files changed, 111 insertions(+), 167 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6] openeuler_defconfig: Enable Landlock (kABI testing)
by GONG Ruiqi 17 Aug '26

17 Aug '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9681 -------------------------------- KABI test only. Do NOT merge. Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++-- arch/x86/configs/openeuler_defconfig | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 9c6d128276cd..1816509a5041 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7482,7 +7482,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set -# CONFIG_SECURITY_LANDLOCK is not set +CONFIG_SECURITY_LANDLOCK=y CONFIG_INTEGRITY=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y @@ -7539,7 +7539,7 @@ CONFIG_EVM_X509_PATH="/etc/keys/x509_evm.der" CONFIG_DEFAULT_SECURITY_SELINUX=y # CONFIG_DEFAULT_SECURITY_APPARMOR is not set # CONFIG_DEFAULT_SECURITY_DAC is not set -CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" # # Kernel hardening options diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 685c32d1e7af..ec621167398d 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -8667,7 +8667,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set -# CONFIG_SECURITY_LANDLOCK is not set +CONFIG_SECURITY_LANDLOCK=y CONFIG_INTEGRITY=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y @@ -8724,7 +8724,7 @@ CONFIG_EVM_X509_PATH="/etc/keys/x509_evm.der" CONFIG_DEFAULT_SECURITY_SELINUX=y # CONFIG_DEFAULT_SECURITY_APPARMOR is not set # CONFIG_DEFAULT_SECURITY_DAC is not set -CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" # # Kernel hardening options -- 2.43.0

2 1

[PATCH OLK-6.6] tracing/user_events: Fix use-after-free in user_event_mm_dup()
by Tengda Wu 17 Aug '26

17 Aug '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.148 commit 25acb6711da6fa0382744fa92bd6d42a22c1ae68 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17268 CVE: CVE-2026-72071 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 50fd6dd755c6e48a38af2fa4621167eea56829c2 ] user_event_mm_dup() walks the parent mm's enabler list locklessly under rcu_read_lock() during fork() (from copy_process()); it does not take event_mutex: rcu_read_lock(); list_for_each_entry_rcu(enabler, &old_mm->enablers, mm_enablers_link) enabler->event = user_event_get(orig->event); user_event_enabler_destroy() removes an enabler from that list with list_del_rcu() and then, without waiting for a grace period, drops the enabler's user_event reference with user_event_put() and frees the enabler with kfree(). A reader that loaded the enabler before the list_del_rcu() can still be walking it, which leads to two use-after-frees: - kfree(enabler) frees the enabler while that reader dereferences enabler->event. - user_event_put() may drop the last reference to the user_event, which is then freed (via delayed_destroy_user_event() on a work queue), while the same reader does user_event_get(orig->event) on it. Both are reachable by an unprivileged task that can open user_events_data: one multithreaded process that registers an enabler and then concurrently unregisters it and calls fork() triggers the race. KASAN reports a slab-use-after-free in user_event_mm_dup() during clone(), with a "refcount_t: addition on 0" warning when the user_event is freed. The enabler use-after-free was found first; the user_event one was reported by XIAO WU, and the earlier enabler-only fix did not address it. Defer both the user_event_put() and the kfree(enabler) to a work item queued with queue_rcu_work(), so they run only after an RCU grace period, once all readers walking the enabler list have finished. The put must run in process context because user_event_put() takes event_mutex on the last reference, so a work queue is used rather than call_rcu(). The now-unlocked put lets the locked argument of user_event_enabler_destroy() be removed; all callers are updated. Fixes: 7235759084a4 ("tracing/user_events: Use remote writes for event enablement") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260707165912.2560537-2-michael.bommarito@gmail.c… Reported-by: XIAO WU <xiaowu.417(a)qq.com> Closes: https://lore.kernel.org/all/tencent_89647CE40DC452B891C65C94D1B271DE8E07@qq… Suggested-by: Beau Belgrave <beaub(a)linux.microsoft.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_user.c | 39 ++++++++++++++++++++++++++------ 1 file changed, 32 insertions(+), 7 deletions(-) diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c index 2461786b1e4d..9dabeb86acd1 100644 --- a/kernel/trace/trace_events_user.c +++ b/kernel/trace/trace_events_user.c @@ -104,6 +104,9 @@ struct user_event_enabler { /* Track enable bit, flags, etc. Aligned for bitops. */ unsigned long values; + + /* Defer the event put and enabler free past an RCU grace period. */ + struct rcu_work put_rwork; }; /* Bits 0-5 are for the bit to update upon enable/disable (0-63 allowed) */ @@ -378,17 +381,39 @@ static struct user_event_group *user_event_group_create(void) return NULL; }; -static void user_event_enabler_destroy(struct user_event_enabler *enabler, - bool locked) +static void delayed_user_event_enabler_put(struct work_struct *work) { - list_del_rcu(&enabler->mm_enablers_link); + struct user_event_enabler *enabler = container_of(to_rcu_work(work), + struct user_event_enabler, put_rwork); /* No longer tracking the event via the enabler */ - user_event_put(enabler->event, locked); + user_event_put(enabler->event, false); + /* Run from queue_rcu_work(), the RCU grace period has elapsed */ kfree(enabler); } +static void user_event_enabler_destroy(struct user_event_enabler *enabler) +{ + list_del_rcu(&enabler->mm_enablers_link); + + /* + * The enabler is removed from an RCU-traversed list + * (user_event_mm_dup() walks mm->enablers under rcu_read_lock() only), + * and readers there dereference enabler->event and take a new ref on + * it. Both the put of that event reference and the free of the enabler + * therefore have to wait for a grace period so no reader can be looking + * at the enabler or racing the last put of its event. + * + * The put itself must not run in RCU context: when it drops the last + * reference user_event_put() takes event_mutex, which cannot be taken + * from a softirq/RCU callback. Defer both to a work item scheduled + * after a grace period via queue_rcu_work(). + */ + INIT_RCU_WORK(&enabler->put_rwork, delayed_user_event_enabler_put); + queue_rcu_work(system_percpu_wq, &enabler->put_rwork); +} + static int user_event_mm_fault_in(struct user_event_mm *mm, unsigned long uaddr, int attempt) { @@ -446,7 +471,7 @@ static void user_event_enabler_fault_fixup(struct work_struct *work) /* User asked for enabler to be removed during fault */ if (test_bit(ENABLE_VAL_FREEING_BIT, ENABLE_BITOPS(enabler))) { - user_event_enabler_destroy(enabler, true); + user_event_enabler_destroy(enabler); goto out; } @@ -746,7 +771,7 @@ static void user_event_mm_destroy(struct user_event_mm *mm) struct user_event_enabler *enabler, *next; list_for_each_entry_safe(enabler, next, &mm->enablers, mm_enablers_link) - user_event_enabler_destroy(enabler, false); + user_event_enabler_destroy(enabler); mmdrop(mm->mm); kfree(mm); @@ -2579,7 +2604,7 @@ static long user_events_ioctl_unreg(unsigned long uarg) flags |= enabler->values & ENABLE_VAL_COMPAT_MASK; if (!test_bit(ENABLE_VAL_FAULTING_BIT, ENABLE_BITOPS(enabler))) - user_event_enabler_destroy(enabler, true); + user_event_enabler_destroy(enabler); /* Removed at least one */ ret = 0; -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Check return value of __register_event() in trace_module_add_events()
by Tengda Wu 17 Aug '26

17 Aug '26

From: "Masami Hiramatsu (Google)" <mhiramat(a)kernel.org> stable inclusion from stable-v6.6.151 commit d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17265 CVE: CVE-2026-74471 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ac8719969e6c3c54e939834df812bc41f25453cf upstream. trace_module_add_events() ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers() for each event. If __register_event() fails (for example, if event_init() fails), the trace_event_call is not added to ftrace_events list, but __add_event_to_tracers() still creates a trace_event_file pointing to it. If module loading subsequently fails and module memory is freed, tracing state retains a stale trace_event_call pointer in trace_event_file, leading to a use-after-free when tracefs or tracing subsystem operations are later executed. Fix this by checking the return value of __register_event() and only calling __add_event_to_tracers() if event registration succeeded. Fixes: ae63b31e4d0e ("tracing: Separate out trace events from global variables") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/178528487878.124250.14170824576025743236.stgit@dev… Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 55b5346cb3d5..bea0ab4d8d73 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -3314,8 +3314,8 @@ static void trace_module_add_events(struct module *mod) end = mod->trace_events + mod->num_trace_events; for_each_event(call, start, end) { - __register_event(*call, mod); - __add_event_to_tracers(*call); + if (!__register_event(*call, mod)) + __add_event_to_tracers(*call); } } -- 2.34.1

2 1

Unsubscribe
by 邵飞 17 Aug '26

17 Aug '26

1 0

[PATCH OLK-6.6] sctp: fix auth_hmacs array size in struct sctp_cookie
by Pu Lehui 17 Aug '26

17 Aug '26

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v6.6.148 commit 0b4414e43e0861d67276031cc21401d7e87de3da category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17108 CVE: CVE-2026-68376 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e0b5252a59383b77d1b8dbeda00b7184dd95f4d3 ] The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers. However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the auth_hmacs buffer in the cookie. As a result, sctp_association_init() copies beyond the end of auth_hmacs when initializing the association, corrupting the adjacent auth_chunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctp_auth_get_hmac(). Fix the array size calculation by including the full SCTP parameter header size. Fixes: 1f485649f529 ("[SCTP]: Implement SCTP-AUTH internals") Reported-by: Yuan Tan <yuantan098(a)gmail.com> Reported-by: Xin Liu <dstsmallbird(a)foxmail.com> Reported-by: Zihan Xi <xizh2024(a)lzu.edu.cn> Reported-by: Ren Wei <enjou1224z(a)gmail.com> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/634a0de0d5de29532915e6d47c92a0cbc206e03f.178370715… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/net/sctp/structs.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h index d943bb454b17..5baf98eac3db 100644 --- a/include/net/sctp/structs.h +++ b/include/net/sctp/structs.h @@ -322,7 +322,8 @@ struct sctp_cookie { __u8 auth_random[sizeof(struct sctp_paramhdr) + SCTP_AUTH_RANDOM_LENGTH]; - __u8 auth_hmacs[SCTP_AUTH_NUM_HMACS * sizeof(__u16) + 2]; + __u8 auth_hmacs[sizeof(struct sctp_paramhdr) + + SCTP_AUTH_NUM_HMACS * sizeof(__u16)]; __u8 auth_chunks[sizeof(struct sctp_paramhdr) + SCTP_AUTH_MAX_CHUNKS]; /* This is a shim for my peer's INIT packet, followed by -- 2.34.1

3 2

[PATCH OLK-6.6] exec: fix unsigned loop counter wrap in transfer_args_to_stack()
by Chen Jinghuang 14 Aug '26

14 Aug '26

From: Christian Brauner <brauner(a)kernel.org> stable inclusion from stable-v6.6.148 commit c62bb00caba66e01fb578d5f0302f247dc64930a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16979 CVE: CVE-2026-68187 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 16cc4f5c1c4b9e45eca7f7deefa5410a292db599 upstream. The stop value is derived from bprm->p >> PAGE_SHIFT. The index variable is an unsigned long. If bprm->p drops below PAGE_SIZE and stop becomes zero the loop condition index >= stop is always true. After the index == 0 iteration the decrement wraps to ULONG_MAX and bprm->page[ULONG_MAX] reads sizeof(void *) bytes in front of the array. The pointer has wrapped to -1. That garbage pointer is then passed to kmap_local_page() and PAGE_SIZE bytes are copied from wherever that lands into the stack of the process being created. And the loop doesn't terminate either... Getting there only requires bprm->p < PAGE_SIZE. On !MMU bprm_set_stack_limit() and bprm_hit_stack_limit() are empty. So the only constraint on how far bprm->p is pushed down is valid_arg_len(), i.e. that each individual string still fits in what is left. bprm->p starts at PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *) so a single argument or environment string of a little over 31 pages leaves it in the first page: Oops - load access fault [#1] CPU: 0 UID: 0 PID: 1 Comm: victim Not tainted 7.2.0-rc4 #1 epc : __memcpy+0xd4/0xf8 ra : transfer_args_to_stack+0xaa/0xae s4 : ffffffffffffffff s2 : 0000000000000000 a1 : ffffffdc98000000 a2 : 0000000000001000 status: 0000000a00001880 badaddr: ffffffdc98000000 cause: 0000000000000005 [<801a5324>] __memcpy+0xd4/0xf8 [<800d5f6a>] load_flat_binary+0x43a/0x65e [<800a2de4>] bprm_execve+0x1d4/0x316 [<800a351a>] do_execveat_common+0x12e/0x138 [<800a3d44>] __riscv_sys_execve+0x38/0x4e Kernel panic - not syncing: Fatal exception in interrupt This is an arcane bug but we should still fix it. Count down from MAX_ARG_PAGES so the loop ends when index reaches stop, stop == 0 included. The iterations performed are unchanged for every other value of stop. Only CONFIG_MMU=n builds are affected, transfer_args_to_stack() is used by binfmt_flat and binfmt_elf_fdpic on nommu only. The loop predates git history. commit 7e7ec6a93434 ("elf_fdpic_transfer_args_to_stack(): make it generic") only moved it from binfmt_elf_fdpic.c into fs/exec.c and narrowed the copy to the used part of the first page. The condition and the decrement are unchanged from 2.6.12-rc2. Link: https://patch.msgid.link/20260721-hochachtung-staumauer-pigmente-15d71f7d7d… Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Reviewed-by: David Hildenbrand (Arm) <david(a)kernel.org> Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- fs/exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/exec.c b/fs/exec.c index 162d0f3ccd64..051b00282310 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -884,7 +884,7 @@ int transfer_args_to_stack(struct linux_binprm *bprm, stop = bprm->p >> PAGE_SHIFT; sp = *sp_location; - for (index = MAX_ARG_PAGES - 1; index >= stop; index--) { + for (index = MAX_ARG_PAGES; index-- > stop; ) { unsigned int offset = index == stop ? bprm->p & ~PAGE_MASK : 0; char *src = kmap_local_page(bprm->page[index]) + offset; sp -= PAGE_SIZE - offset; -- 2.34.1

2 1

[PATCH OLK-6.6] Bluetooth: RFCOMM: Fix session UAF in set_termios
by Chen Jinghuang 14 Aug '26

14 Aug '26

From: Chengfeng Ye <nicoyip.dev(a)gmail.com> stable inclusion from stable-v6.6.148 commit 2894bd8c68e97accd758ca6e5fc375d7e9e8882c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16980 CVE: CVE-2026-68188 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c783399efc22d035443f1dfbf2a09bf9562aaa5e upstream. rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and later passes the pointer to rfcomm_send_rpn(). The latter dereferences both session->initiator and session->sock. Meanwhile, krfcommd can unlink the DLC and free the session while holding rfcomm_mutex. The race can proceed as follows: TTY ioctl task krfcommd -------------- -------- load dlc->session enter rfcomm_send_rpn() lock rfcomm_mutex clear dlc->session free session unlock rfcomm_mutex read session->initiator KASAN reported: BUG: KASAN: slab-use-after-free in rfcomm_send_rpn+0x297/0x2a0 Read of size 4 at addr ffff88810012a850 by task poc/92 Call Trace: rfcomm_send_rpn+0x297/0x2a0 rfcomm_tty_set_termios+0x50d/0x850 tty_set_termios+0x596/0x950 set_termios+0x46a/0x6e0 tty_mode_ioctl+0x152/0xbd0 tty_ioctl+0x915/0x1240 __x64_sys_ioctl+0x134/0x1c0 Allocated by task 92: rfcomm_session_add+0x9e/0x2e0 rfcomm_dlc_open+0x8b1/0xe00 rfcomm_dev_activate+0x85/0x1a0 rfcomm_tty_open+0x90/0x280 Freed by task 68: kfree+0x131/0x3c0 rfcomm_session_del+0x119/0x180 rfcomm_run+0x737/0x4710 Add rfcomm_dlc_send_rpn(), which holds rfcomm_mutex while it verifies that the DLC is still attached and sends the RPN frame. Have the TTY path use the helper and drop its unlocked session check. This keeps the session valid through both the frame construction and socket send. Fixes: 3a5e903c09ae ("[Bluetooth]: Implement RFCOMM remote port negotiation") Cc: stable(a)vger.kernel.org Signed-off-by: Chengfeng Ye <nicoyip.dev(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- include/net/bluetooth/rfcomm.h | 3 +++ net/bluetooth/rfcomm/core.c | 17 +++++++++++++++++ net/bluetooth/rfcomm/tty.c | 7 +++---- 3 files changed, 23 insertions(+), 4 deletions(-) diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h index 99d26879b02a..ba8d3702853d 100644 --- a/include/net/bluetooth/rfcomm.h +++ b/include/net/bluetooth/rfcomm.h @@ -229,6 +229,9 @@ int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci, u8 bit_rate, u8 data_bits, u8 stop_bits, u8 parity, u8 flow_ctrl_settings, u8 xon_char, u8 xoff_char, u16 param_mask); +int rfcomm_dlc_send_rpn(struct rfcomm_dlc *d, u8 bit_rate, u8 data_bits, + u8 stop_bits, u8 parity, u8 flow_ctrl_settings, + u8 xon_char, u8 xoff_char, u16 param_mask); /* ---- RFCOMM DLCs (channels) ---- */ struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio); diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c index 07971e918e5b..41a6eda1a149 100644 --- a/net/bluetooth/rfcomm/core.c +++ b/net/bluetooth/rfcomm/core.c @@ -1031,6 +1031,23 @@ int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci, return rfcomm_send_frame(s, buf, ptr - buf); } +int rfcomm_dlc_send_rpn(struct rfcomm_dlc *d, u8 bit_rate, u8 data_bits, + u8 stop_bits, u8 parity, u8 flow_ctrl_settings, + u8 xon_char, u8 xoff_char, u16 param_mask) +{ + int err = -ENOTCONN; + + rfcomm_lock(); + if (d->session) + err = rfcomm_send_rpn(d->session, 1, d->dlci, bit_rate, + data_bits, stop_bits, parity, + flow_ctrl_settings, xon_char, xoff_char, + param_mask); + rfcomm_unlock(); + + return err; +} + static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status) { struct rfcomm_hdr *hdr; diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c index 912e37cb8310..0f0bfe966c2f 100644 --- a/net/bluetooth/rfcomm/tty.c +++ b/net/bluetooth/rfcomm/tty.c @@ -864,7 +864,7 @@ static void rfcomm_tty_set_termios(struct tty_struct *tty, BT_DBG("tty %p termios %p", tty, old); - if (!dev || !dev->dlc || !dev->dlc->session) + if (!dev || !dev->dlc) return; /* Handle turning off CRTSCTS */ @@ -985,9 +985,8 @@ static void rfcomm_tty_set_termios(struct tty_struct *tty, } if (changes) - rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud, - data_bits, stop_bits, parity, - RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes); + rfcomm_dlc_send_rpn(dev->dlc, baud, data_bits, stop_bits, parity, + RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes); } static void rfcomm_tty_throttle(struct tty_struct *tty) -- 2.34.1

2 1

[PATCH OLK-5.10] NFSv4/flexfiles: reject zero filehandle version count
by Zhou Minqiang 14 Aug '26

14 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16112 CVE: CVE-2026-53392 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists. Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser. A QEMU/KASAN run with a malformed flexfiles layout hit: KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly. Cc: stable(a)vger.kernel.org Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)hammerspace.com> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/nfs/flexfilelayout/flexfilelayout.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c index e4f2820ba5a5..2a9226fe7f36 100644 --- a/fs/nfs/flexfilelayout/flexfilelayout.c +++ b/fs/nfs/flexfilelayout/flexfilelayout.c @@ -454,6 +454,10 @@ ff_layout_alloc_lseg(struct pnfs_layout_hdr *lh, if (!p) goto out_err_free; fh_count = be32_to_cpup(p); + if (fh_count == 0) { + rc = -EINVAL; + goto out_err_free; + } fls->mirror_array[i]->fh_versions = kcalloc(fh_count, sizeof(struct nfs_fh), -- 2.52.0

2 1

[PATCH OLK-5.10] pNFS: Fix use-after-free in pnfs_update_layout()
by Zhou Minqiang 14 Aug '26

14 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 13e198a90ca4050f4bee8a3f23680389a6563ccc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16131 CVE: CVE-2026-63800 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracepoint accesses lo's fields. Fix this by moving the tracepoint call before pnfs_put_layout_hdr(lo). Fixes: 2c8d5fc37fe2 ("pNFS: Stricter ordering of layoutget and layoutreturn") Cc: stable(a)vger.kernel.org Signed-off-by: Wentao Liang <vulab(a)iscas.ac.cn> Signed-off-by: Anna Schumaker <anna.schumaker(a)hammerspace.com> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/nfs/pnfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c index de00ef7484d8..e1fb295b4f22 100644 --- a/fs/nfs/pnfs.c +++ b/fs/nfs/pnfs.c @@ -2078,11 +2078,11 @@ pnfs_update_layout(struct inode *ino, dprintk("%s wait for layoutreturn\n", __func__); lseg = ERR_PTR(pnfs_prepare_to_retry_layoutget(lo)); if (!IS_ERR(lseg)) { - pnfs_put_layout_hdr(lo); dprintk("%s retrying\n", __func__); trace_pnfs_update_layout(ino, pos, count, iomode, lo, lseg, PNFS_UPDATE_LAYOUT_RETRY); + pnfs_put_layout_hdr(lo); goto lookup_again; } trace_pnfs_update_layout(ino, pos, count, iomode, lo, lseg, -- 2.52.0

2 1

[PATCH OLK-5.10] smb/client: fix chown/chgrp with SMB3 POSIX Extensions
by Zhou Minqiang 14 Aug '26

14 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 760ef2c579c2609cf17fb1cd5392f64d42d43d33 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16820 CVE: CVE-2026-64388 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set. Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map and set the ownership/group information on the server. Cc: stable(a)vger.kernel.org Signed-off-by: Ralph Boehme <slow(a)samba.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/inode.c fs/cifs/inode.c [cxt conflicts] Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/cifs/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index 3f33cdd14b1a..045d77a929df 100644 --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -2835,8 +2835,8 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) if (attrs->ia_valid & ATTR_GID) gid = attrs->ia_gid; - if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) || - (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID)) { + if ((cifs_sb->mnt_cifs_flags & (CIFS_MOUNT_CIFS_ACL | CIFS_MOUNT_MODE_FROM_SID)) || + cifs_sb_master_tcon(cifs_sb)->posix_extensions) { if (uid_valid(uid) || gid_valid(gid)) { rc = id_mode_to_cifs_acl(inode, full_path, NO_CHANGE_64, uid, gid); -- 2.52.0

2 1

[PATCH OLK-6.6] smb/client: fix chown/chgrp with SMB3 POSIX Extensions
by Zhou Minqiang 14 Aug '26

14 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 760ef2c579c2609cf17fb1cd5392f64d42d43d33 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16820 CVE: CVE-2026-64388 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set. Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map and set the ownership/group information on the server. Cc: stable(a)vger.kernel.org Signed-off-by: Ralph Boehme <slow(a)samba.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/inode.c [cxt conflicts] Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/smb/client/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c index cca480ab7e64..f5b50cb65360 100644 --- a/fs/smb/client/inode.c +++ b/fs/smb/client/inode.c @@ -3237,8 +3237,8 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) if (attrs->ia_valid & ATTR_GID) gid = attrs->ia_gid; - if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) || - (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID)) { + if ((cifs_sb->mnt_cifs_flags & (CIFS_MOUNT_CIFS_ACL | CIFS_MOUNT_MODE_FROM_SID)) || + cifs_sb_master_tcon(cifs_sb)->posix_extensions) { if (uid_valid(uid) || gid_valid(gid)) { mode = NO_CHANGE_64; rc = id_mode_to_cifs_acl(inode, full_path, &mode, -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] CVE-2026-64137
by Yifan Qiao 13 Aug '26

13 Aug '26

Ido Schimmel (1): genetlink: Use internal flags for multicast groups Michael Bommarito (1): smb: client: require net admin for CIFS SWN netlink include/net/genetlink.h | 7 ++++++- fs/smb/client/netlink.c | 6 +++++- net/core/drop_monitor.c | 2 +- net/mptcp/pm_netlink.c | 2 +- net/netlink/genetlink.c | 4 ++-- net/psample/psample.c | 2 +- 6 files changed, 16 insertions(+), 7 deletions(-) -- 2.52.0

2 3

[PATCH OLK-5.10 0/2] fix CVE-2026-45893
by Gu Bowen 13 Aug '26

13 Aug '26

CVE-2026-45893 Helge Deller (2): AppArmor: Allow apparmor to handle unaligned dfa tables apparmor: Fix & Optimize table creation from possibly unaligned memory security/apparmor/include/match.h | 12 +++++++----- security/apparmor/match.c | 22 +++++++++++----------- 2 files changed, 18 insertions(+), 16 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6 0/2] CVE-2026-64137
by Yifan Qiao 13 Aug '26

13 Aug '26

Ido Schimmel (1): genetlink: Use internal flags for multicast groups Michael Bommarito (1): smb: client: require net admin for CIFS SWN netlink include/net/genetlink.h | 9 ++++++--- fs/smb/client/netlink.c | 6 +++++- net/core/drop_monitor.c | 2 +- net/mptcp/pm_netlink.c | 2 +- net/netlink/genetlink.c | 4 ++-- net/psample/psample.c | 2 +- 6 files changed, 16 insertions(+), 9 deletions(-) -- 2.52.0

2 3

[PATCH OLK-5.10] ksmbd: defer destroy_previous_session() until after NTLM authentication
by Lai Zewei 12 Aug '26

12 Aug '26

mainline inclusion from mainline-v7.2-rc5 commit c74801ee524f477c174a1899782b6c3b6918d407 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16939 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In ntlm_authenticate(), destroy_previous_session() is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session ID; destroy_previous_session() destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob() subsequently rejects the request with -EPERM. Move destroy_previous_session() and the prev_id assignment to after ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user rather than the pre-authentication lookup result. This matches the ordering already used by krb5_authenticate(), where destroy_previous_session() is called only after ksmbd_krb5_authenticate() returns success. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/linux-cifs/20260702155449.3639773-1-james_montgomer… Signed-off-by: James Montgomery <james_montgomery(a)disroot.org> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/ksmbd/smb2pdu.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index ff3bcd2f7c46..d8262429e31b 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1487,11 +1487,6 @@ static int ntlm_authenticate(struct ksmbd_work *work, return -EPERM; } - /* Check for previous session */ - prev_id = le64_to_cpu(req->PreviousSessionId); - if (prev_id && prev_id != sess->id) - destroy_previous_session(conn, user, prev_id); - if (sess->state == SMB2_SESSION_VALID) { /* * Reuse session if anonymous try to connect @@ -1526,6 +1521,10 @@ static int ntlm_authenticate(struct ksmbd_work *work, } } + prev_id = le64_to_cpu(req->PreviousSessionId); + if (prev_id && prev_id != sess->id) + destroy_previous_session(conn, sess->user, prev_id); + /* * If session state is SMB2_SESSION_VALID, We can assume * that it is reauthentication. And the user/password -- 2.52.0

2 3

[PATCH OLK-5.10] drm/edid: fix OOB read in drm_parse_tiled_block()
by Hongtao Zhang 12 Aug '26

12 Aug '26

From: Xiang Mei <xmei5(a)asu.edu> stable inclusion from stable-v5.10.261 commit c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit faaa1e1155833e7d4ce7e3cfaf64c0d636b190db ] drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) Fixes: 40d9b043a89e ("drm/connector: store tile information from displayid (v3)") Reported-by: Weiming Shi <bestswngs(a)gmail.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5(a)asu.edu> Reviewed-by: Jani Nikula <jani.nikula(a)intel.com> Link: https://patch.msgid.link/20260615184737.899892-1-xmei5@asu.edu Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_edid.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index 39eb39e78d7a2..cbe7f79fd0e1e 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -5895,6 +5895,14 @@ static void drm_parse_tiled_block(struct drm_connector *connector, u8 num_v_tile, num_h_tile; struct drm_tile_group *tg; + /* tiled block payload per spec: cap 1 + topo 3 + size 4 + bezel 5 + id 9 = 22 */ + if (block->num_bytes < 22) { + drm_dbg_kms(connector->dev, + "[CONNECTOR:%d:%s] Unexpected tiled block size %u\n", + connector->base.id, connector->name, block->num_bytes); + return; + } + w = tile->tile_size[0] | tile->tile_size[1] << 8; h = tile->tile_size[2] | tile->tile_size[3] << 8; -- 2.43.0

2 1

[PATCH OLK-5.10] drm/edid: fix OOB read in drm_parse_tiled_block()
by Hongtao Zhang 12 Aug '26

12 Aug '26

From: Xiang Mei <xmei5(a)asu.edu> stable inclusion from stable-v5.10.261 commit c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0 category: bugfix bugzilla: 16848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit faaa1e1155833e7d4ce7e3cfaf64c0d636b190db ] drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) Fixes: 40d9b043a89e ("drm/connector: store tile information from displayid (v3)") Reported-by: Weiming Shi <bestswngs(a)gmail.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5(a)asu.edu> Reviewed-by: Jani Nikula <jani.nikula(a)intel.com> Link: https://patch.msgid.link/20260615184737.899892-1-xmei5@asu.edu Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_edid.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index 39eb39e78d7a2..cbe7f79fd0e1e 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -5895,6 +5895,14 @@ static void drm_parse_tiled_block(struct drm_connector *connector, u8 num_v_tile, num_h_tile; struct drm_tile_group *tg; + /* tiled block payload per spec: cap 1 + topo 3 + size 4 + bezel 5 + id 9 = 22 */ + if (block->num_bytes < 22) { + drm_dbg_kms(connector->dev, + "[CONNECTOR:%d:%s] Unexpected tiled block size %u\n", + connector->base.id, connector->name, block->num_bytes); + return; + } + w = tile->tile_size[0] | tile->tile_size[1] << 8; h = tile->tile_size[2] | tile->tile_size[3] << 8; -- 2.43.0

2 1

[PATCH OLK-6.6] sctp: validate embedded INIT chunk and address list lengths in cookie
by Zhang Qilong 12 Aug '26

12 Aug '26

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v6.18.36 commit 7560afb8cddafd829e709d7ea09230e45a825557 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15910 CVE: CVE-2026-53224 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6f4c80a2a7e6d06753b89a578b710a2499a5e62b ] sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Sashiko <sashiko-bot(a)kernel.org> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/75af23a89adf881a0895d511775e4770da367cbf.178087342… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/sctp/sm_make_chunk.c [Just context conflicts.] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/sctp/bind_addr.c | 11 ++++++++++- net/sctp/sm_make_chunk.c | 9 +++++++-- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c index 6b95d3ba8fe1..0947b276d1e0 100644 --- a/net/sctp/bind_addr.c +++ b/net/sctp/bind_addr.c @@ -273,10 +273,20 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, /* Convert the raw address to standard address format */ while (addrs_len) { param = (struct sctp_paramhdr *)raw_addr_list; rawaddr = (union sctp_addr_param *)raw_addr_list; + if (addrs_len < sizeof(*param)) { + retval = -EINVAL; + goto out_err; + } + len = ntohs(param->length); + if (addrs_len < len) { + retval = -EINVAL; + goto out_err; + } + af = sctp_get_af_specific(param_type2af(param->type)); if (unlikely(!af) || !af->from_addr_param(&addr, rawaddr, htons(port), 0)) { retval = -EINVAL; goto out_err; @@ -289,11 +299,10 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, if (retval) /* Can't finish building the list, clean up. */ goto out_err; next: - len = ntohs(param->length); addrs_len -= len; raw_addr_list += len; } return retval; diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index 2f910e6b00d4..7269a8e8e54b 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -1748,13 +1748,13 @@ struct sctp_association *sctp_unpack_cookie( int headersize, bodysize, fixed_size; struct sctp_signed_cookie *cookie; struct sk_buff *skb = chunk->skb; struct sctp_cookie *bear_cookie; struct sctp_chunkhdr *ch; + unsigned int len, chlen; __u8 *digest = ep->digest; enum sctp_scope scope; - unsigned int len; ktime_t kt; /* Header size is static data prior to the actual cookie, including * any padding. */ @@ -1779,11 +1779,16 @@ struct sctp_association *sctp_unpack_cookie( /* Process the cookie. */ cookie = chunk->subh.cookie_hdr; bear_cookie = &cookie->c; ch = (struct sctp_chunkhdr *)(bear_cookie + 1); - if (ntohs(ch->length) > len - fixed_size) + chlen = ntohs(ch->length); + if (chlen < sizeof(struct sctp_init_chunk)) + goto malformed; + if (chlen > len - fixed_size) + goto malformed; + if (bear_cookie->raw_addr_list_len > len - fixed_size - chlen) goto malformed; if (!sctp_sk(ep->base.sk)->hmac) goto no_hmac; -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] *** proc: fix ptrace access locking and error paths ***
by Zhang Yuwei 12 Aug '26

12 Aug '26

*** BLURB HERE *** Jann Horn (2): proc: protect ptrace_may_access() with exec_update_lock (part 1) proc: Fix broken error paths for namespace links fs/proc/array.c | 6 ++++++ fs/proc/base.c | 41 ++++++++++++++++++++++++----------------- fs/proc/namespaces.c | 16 +++++++++++++++- 3 files changed, 45 insertions(+), 18 deletions(-) -- 2.22.0

2 3

[PATCH OLK-6.6 0/2] CVE-2026-64137
by Yifan Qiao 12 Aug '26

12 Aug '26

Ido Schimmel (1): genetlink: Use internal flags for multicast groups Michael Bommarito (1): smb: client: require net admin for CIFS SWN netlink include/net/genetlink.h | 8 ++++++-- fs/smb/client/netlink.c | 6 +++++- net/core/drop_monitor.c | 2 +- net/mptcp/pm_netlink.c | 2 +- net/netlink/genetlink.c | 4 ++-- net/psample/psample.c | 2 +- 6 files changed, 16 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH OLK-5.10] i2c: core: fix adapter deregistration race
by Zhang Yuwei 12 Aug '26

12 Aug '26

From: Johan Hovold <johan(a)kernel.org> mainline inclusion from mainline-v7.2-rc1 commit b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16577 CVE: CVE-2026-64279 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Adapters can be looked up by their id using i2c_get_adapter() which takes a reference to the embedded struct device. Remove the adapter from the IDR before tearing it down during deregistration (and on registration failure) to make sure its resources are not accessed after having been freed (e.g. the device name). Fixes: 35fc37f81881 ("i2c: Limit core locking to the necessary sections") Cc: stable(a)vger.kernel.org # 2.6.31 Cc: Jean Delvare <khali(a)linux-fr.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> Conflicts: drivers/i2c/i2c-core-base.c [contxt conflict] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/i2c/i2c-core-base.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index ae9682826156..45cde9cd9417 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1496,6 +1496,9 @@ static int i2c_register_adapter(struct i2c_adapter *adap) res = device_register(&adap->dev); if (res) { pr_err("adapter '%s': can't register device (%d)\n", adap->name, res); + mutex_lock(&core_lock); + idr_replace(&i2c_adapter_idr, NULL, adap->nr); + mutex_unlock(&core_lock); goto out_list; } @@ -1537,6 +1540,9 @@ static int i2c_register_adapter(struct i2c_adapter *adap) return 0; out_reg: + mutex_lock(&core_lock); + idr_replace(&i2c_adapter_idr, NULL, adap->nr); + mutex_unlock(&core_lock); init_completion(&adap->dev_released); device_unregister(&adap->dev); wait_for_completion(&adap->dev_released); @@ -1693,6 +1699,8 @@ void i2c_del_adapter(struct i2c_adapter *adap) /* First make sure that this adapter was ever added */ mutex_lock(&core_lock); found = idr_find(&i2c_adapter_idr, adap->nr); + if (found == adap) + idr_replace(&i2c_adapter_idr, NULL, adap->nr); mutex_unlock(&core_lock); if (found != adap) { pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name); -- 2.22.0

2 1

[PATCH OLK-6.6] i2c: core: fix adapter deregistration race
by Zhang Yuwei 12 Aug '26

12 Aug '26

From: Johan Hovold <johan(a)kernel.org> mainline inclusion from mainline-v7.2-rc1 commit b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16577 CVE: CVE-2026-64279 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Adapters can be looked up by their id using i2c_get_adapter() which takes a reference to the embedded struct device. Remove the adapter from the IDR before tearing it down during deregistration (and on registration failure) to make sure its resources are not accessed after having been freed (e.g. the device name). Fixes: 35fc37f81881 ("i2c: Limit core locking to the necessary sections") Cc: stable(a)vger.kernel.org # 2.6.31 Cc: Jean Delvare <khali(a)linux-fr.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> Conflicts: drivers/i2c/i2c-core-base.c [contxt conflict] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/i2c/i2c-core-base.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index d87e99c0448c..4127cf8b7e49 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1525,6 +1525,9 @@ static int i2c_register_adapter(struct i2c_adapter *adap) res = device_register(&adap->dev); if (res) { pr_err("adapter '%s': can't register device (%d)\n", adap->name, res); + mutex_lock(&core_lock); + idr_replace(&i2c_adapter_idr, NULL, adap->nr); + mutex_unlock(&core_lock); goto err_remove_irq_domain; } @@ -1567,6 +1570,9 @@ static int i2c_register_adapter(struct i2c_adapter *adap) return 0; out_reg: + mutex_lock(&core_lock); + idr_replace(&i2c_adapter_idr, NULL, adap->nr); + mutex_unlock(&core_lock); init_completion(&adap->dev_released); device_unregister(&adap->dev); wait_for_completion(&adap->dev_released); @@ -1725,6 +1731,8 @@ void i2c_del_adapter(struct i2c_adapter *adap) /* First make sure that this adapter was ever added */ mutex_lock(&core_lock); found = idr_find(&i2c_adapter_idr, adap->nr); + if (found == adap) + idr_replace(&i2c_adapter_idr, NULL, adap->nr); mutex_unlock(&core_lock); if (found != adap) { pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name); -- 2.22.0

2 1

[PATCH OLK-5.10 0/2] *** proc: fix ptrace access locking and error paths ***
by Zhang Yuwei 12 Aug '26

12 Aug '26

*** BLURB HERE *** Jann Horn (2): proc: protect ptrace_may_access() with exec_update_lock (part 1) proc: Fix broken error paths for namespace links fs/proc/array.c | 6 ++++++ fs/proc/base.c | 41 ++++++++++++++++++++++++----------------- fs/proc/namespaces.c | 16 +++++++++++++++- 3 files changed, 45 insertions(+), 18 deletions(-) -- 2.22.0

2 3

[PATCH openEuler-1.0-LTS] RDMA/core: Prefer NLA_NUL_STRING
by Xia Fukun 11 Aug '26

11 Aug '26

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v7.1-rc1 commit 6ed3d14fc45d3da6025e7fe4a6a09066856698e2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16189 CVE: CVE-2026-63860 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- These attributes are evaluated as c-string (passed to strcmp), but NLA_STRING doesn't check for the presence of a \0 terminator. Either this needs to switch to nla_strcmp() and needs to adjust printf fmt specifier to not use plain %s, or this needs to use NLA_NUL_STRING. As the code has been this way for long time, it seems to me that userspace does include the terminating nul, even tough its not enforced so far, and thus NLA_NUL_STRING use is the simpler solution. Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service") Link: https://patch.msgid.link/r/20260330122742.13315-1-fw@strlen.de Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/core/iwpm_msg.c [Context differences, unrelated to the fix patch.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/infiniband/core/iwpm_msg.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c index 8861c052155a..37abfd24073e 100644 --- a/drivers/infiniband/core/iwpm_msg.c +++ b/drivers/infiniband/core/iwpm_msg.c @@ -336,9 +336,9 @@ int iwpm_remove_mapping(struct sockaddr_storage *local_addr, u8 nl_client) /* netlink attribute policy for the received response to register pid request */ static const struct nla_policy resp_reg_policy[IWPM_NLA_RREG_PID_MAX] = { [IWPM_NLA_RREG_PID_SEQ] = { .type = NLA_U32 }, - [IWPM_NLA_RREG_IBDEV_NAME] = { .type = NLA_STRING, + [IWPM_NLA_RREG_IBDEV_NAME] = { .type = NLA_NUL_STRING, .len = IWPM_DEVNAME_SIZE - 1 }, - [IWPM_NLA_RREG_ULIB_NAME] = { .type = NLA_STRING, + [IWPM_NLA_RREG_ULIB_NAME] = { .type = NLA_NUL_STRING, .len = IWPM_ULIBNAME_SIZE - 1 }, [IWPM_NLA_RREG_ULIB_VER] = { .type = NLA_U16 }, [IWPM_NLA_RREG_PID_ERR] = { .type = NLA_U16 } @@ -630,7 +630,7 @@ int iwpm_remote_info_cb(struct sk_buff *skb, struct netlink_callback *cb) /* netlink attribute policy for the received request for mapping info */ static const struct nla_policy resp_mapinfo_policy[IWPM_NLA_MAPINFO_REQ_MAX] = { - [IWPM_NLA_MAPINFO_ULIB_NAME] = { .type = NLA_STRING, + [IWPM_NLA_MAPINFO_ULIB_NAME] = { .type = NLA_NUL_STRING, .len = IWPM_ULIBNAME_SIZE - 1 }, [IWPM_NLA_MAPINFO_ULIB_VER] = { .type = NLA_U16 } }; -- 2.34.1

2 1

[PATCH v2 OLK-6.6] mm/memory: fix spurious warning when unmapping device-private/exclusive pages
by Ze Zuo 11 Aug '26

11 Aug '26

From: Alistair Popple <apopple(a)nvidia.com> stable inclusion from stable-v6.6.143 commit e7af1b15c884ed12bb69da11aec095045d861ee8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16387 CVE: CVE-2026-64131 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit be3f38d05cc5a7c3f13e51994c5dd043ab604d28 ] Device private and exclusive entries are only supported for anonymous folios. This condition is tested in __migrate_device_pages() and make_device_exclusive() using folio_test_anon(). However the unmap path tests this assumption using vma_is_anonymous(). This is wrong because whilst anonymous VMAs can only contain folios where folio_test_anon() is true the opposite relation does not hold. A folio for which folio_test_anon() is true does not imply vma_is_anonymous() is true. Such a condition can occur if for example a folio is part of a private filebacked mapping. In this case vma_is_anonymous() is false as the mapping is filebacked, but folio_test_anon() may be true, thus permitting devices to migrate the folio to device private memory. This can lead to the following spurious warnings during process teardown: [ 772.737706] ------------[ cut here ]------------ [ 772.739201] WARNING: mm/memory.c:1754 at unmap_page_range.cold+0x26/0x18a, CPU#17: hmm-tests/2041 [ 772.742050] Modules linked in: test_hmm nvidia_uvm(O) nvidia(O) [ 772.743959] CPU: 17 UID: 0 PID: 2041 Comm: hmm-tests Tainted: G W O 7.0.0+ #387 PREEMPT(full) [ 772.747104] Tainted: [W]=WARN, [O]=OOT_MODULE [ 772.748509] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 772.752117] RIP: 0010:unmap_page_range.cold+0x26/0x18a [ 772.753780] Code: 7e fe ff ff 48 89 4c 24 78 4c 89 44 24 38 e8 f2 ff b1 00 48 8b 4c 24 78 4c 8b 44 24 38 48 8b 44 24 18 48 83 78 48 00 74 04 90 <0f> 0b 90 48 89 ca b8 ff ff 37 00 48 c1 ea 03 48 c1 e0 2a 80 3c 02 [ 772.759602] RSP: 0018:ffff888112607550 EFLAGS: 00010286 [ 772.761310] RAX: ffff88811bbf4dc0 RBX: dffffc0000000000 RCX: ffffea03e9bfffd8 [ 772.763583] RDX: 1ffff1102377e9c1 RSI: 0000000000000008 RDI: ffff88811bbf4e08 [ 772.765914] RBP: 0000000000000006 R08: ffff8881059f7448 R09: ffffed10224c0e68 [ 772.768184] R10: ffff888112607347 R11: 0000000000000001 R12: 0000000000000001 [ 772.770461] R13: ffffea03e9bfffc0 R14: ffff888112607908 R15: ffffea03e9bfffc0 [ 772.772782] FS: 00007f327caa2780(0000) GS:ffff888427b7d000(0000) knlGS:0000000000000000 [ 772.775328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 772.777187] CR2: 00007f327ca89000 CR3: 00000001994d5000 CR4: 00000000000006f0 [ 772.779135] Call Trace: [ 772.779792] <TASK> [ 772.780317] ? dmirror_interval_invalidate+0x1a3/0x290 [test_hmm] [ 772.781873] ? vm_normal_page_pud+0x2b0/0x2b0 [ 772.782992] ? __rwlock_init+0x150/0x150 [ 772.784006] ? lock_release+0x216/0x2b0 [ 772.785008] ? __mmu_notifier_invalidate_range_start+0x505/0x6e0 [ 772.786522] ? lock_release+0x216/0x2b0 [ 772.787498] ? unmap_single_vma+0xb6/0x210 [ 772.788573] unmap_vmas+0x27d/0x520 [ 772.789506] ? unmap_single_vma+0x210/0x210 [ 772.790607] ? mas_update_gap.part.0+0x620/0x620 [ 772.791834] unmap_region+0x19e/0x350 [ 772.792769] ? remove_vma+0x130/0x130 [ 772.793684] ? mas_alloc_nodes+0x1f2/0x300 [ 772.794730] vms_complete_munmap_vmas+0x8c1/0xe20 [ 772.795926] ? unmap_region+0x350/0x350 [ 772.796917] do_vmi_align_munmap+0x36a/0x4e0 [ 772.798018] ? lock_release+0x216/0x2b0 [ 772.799024] ? vma_shrink+0x620/0x620 [ 772.799983] do_vmi_munmap+0x150/0x2c0 [ 772.800939] __vm_munmap+0x161/0x2c0 [ 772.801872] ? expand_downwards+0xd60/0xd60 [ 772.802948] ? clockevents_program_event+0x1ef/0x540 [ 772.804217] ? lock_release+0x216/0x2b0 [ 772.805158] __x64_sys_munmap+0x59/0x80 [ 772.805776] do_syscall_64+0xfc/0x670 [ 772.806336] ? irqentry_exit+0xda/0x580 [ 772.806976] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 772.807772] RIP: 0033:0x7f327cbb2717 [ 772.808323] Code: 73 01 c3 48 8b 0d f9 76 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c9 76 0d 00 f7 d8 64 89 01 48 [ 772.811337] RSP: 002b:00007ffde7f57d38 EFLAGS: 00000202 ORIG_RAX: 000000000000000b [ 772.812564] RAX: ffffffffffffffda RBX: 00007f327cc9c000 RCX: 00007f327cbb2717 [ 772.813733] RDX: 0000000000000000 RSI: 0000000000400000 RDI: 00007f327c289000 [ 772.814867] RBP: 0000000000421360 R08: 000000000000001a R09: 0000000000000000 [ 772.815991] R10: 0000000000000003 R11: 0000000000000202 R12: 00007ffde7f57d74 [ 772.817121] R13: 00007f327c689010 R14: 0000000000100000 R15: 00007f327c289000 [ 772.818272] </TASK> [ 772.818614] irq event stamp: 0 [ 772.819159] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 772.820174] hardirqs last disabled at (0): [<ffffffff82a57ab3>] copy_process+0x19f3/0x6440 [ 772.821511] softirqs last enabled at (0): [<ffffffff82a57b00>] copy_process+0x1a40/0x6440 [ 772.822869] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 772.823871] ---[ end trace 0000000000000000 ]--- Fix this by using the same check for folio_test_anon() in zap_nonpresent_ptes(). Also add a hmm-test case for this. Link: https://lore.kernel.org/20260501065116.2057242-1-apopple@nvidia.com Fixes: 999dad824c39 ("mm/shmem: persist uffd-wp bit across zapping for file-backed") Signed-off-by: Alistair Popple <apopple(a)nvidia.com> Reported-by: Arsen Arsenović <aarsenovic(a)baylibre.com> Reviewed-by: Balbir Singh <balbirs(a)nvidia.com> Cc: David Hildenbrand <david(a)kernel.org> Cc: Jason Gunthorpe <jgg(a)ziepe.ca> Cc: John Hubbard <jhubbard(a)nvidia.com> Cc: Leon Romanovsky <leon(a)kernel.org> Cc: Liam R. Howlett <liam(a)infradead.org> Cc: Lorenzo Stoakes <ljs(a)kernel.org> Cc: Peter Xu <peterx(a)redhat.com> Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [ adapted `folio_test_anon(folio)` to `PageAnon(page)` ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/memory.c [Conflict due to merge commit a23f517b0e15 ("mm: convert mm_counter() to take a folio"), context conflict.] Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/memory.c | 2 +- tools/testing/selftests/mm/hmm-tests.c | 50 ++++++++++++++++++++++++++ 2 files changed, 51 insertions(+), 1 deletion(-) diff --git a/mm/memory.c b/mm/memory.c index 0b56a022c3f8..789b4b301415 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1635,7 +1635,7 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb, * consider uffd-wp bit when zap. For more information, * see zap_install_uffd_wp_if_needed(). */ - WARN_ON_ONCE(!vma_is_anonymous(vma)); + WARN_ON_ONCE(!folio_test_anon(folio)); rss[mm_counter(folio)]--; if (is_device_private_entry(entry)) folio_remove_rmap_pte(folio, page, vma); diff --git a/tools/testing/selftests/mm/hmm-tests.c b/tools/testing/selftests/mm/hmm-tests.c index 0cc1056c8fd7..5286e400ce8b 100644 --- a/tools/testing/selftests/mm/hmm-tests.c +++ b/tools/testing/selftests/mm/hmm-tests.c @@ -998,6 +998,56 @@ TEST_F(hmm, migrate) hmm_buffer_free(buffer); } +/* + * Migrate private file memory to device private memory. + */ +TEST_F(hmm, migrate_file_private) +{ + struct hmm_buffer *buffer; + unsigned long npages; + unsigned long size; + unsigned long i; + int *ptr; + int ret; + int fd; + + npages = ALIGN(HMM_BUFFER_SIZE, self->page_size) >> self->page_shift; + ASSERT_NE(npages, 0); + size = npages << self->page_shift; + + fd = hmm_create_file(size); + ASSERT_GE(fd, 0); + + buffer = malloc(sizeof(*buffer)); + ASSERT_NE(buffer, NULL); + + buffer->fd = fd; + buffer->size = size; + buffer->mirror = malloc(size); + ASSERT_NE(buffer->mirror, NULL); + + buffer->ptr = mmap(NULL, size, + PROT_READ | PROT_WRITE, + MAP_PRIVATE, + buffer->fd, 0); + ASSERT_NE(buffer->ptr, MAP_FAILED); + + /* Initialize buffer in system memory. */ + for (i = 0, ptr = buffer->ptr; i < size / sizeof(*ptr); ++i) + ptr[i] = i; + + /* Migrate memory to device. */ + ret = hmm_migrate_sys_to_dev(self->fd, buffer, npages); + ASSERT_EQ(ret, 0); + ASSERT_EQ(buffer->cpages, npages); + + /* Check what the device read. */ + for (i = 0, ptr = buffer->mirror; i < size / sizeof(*ptr); ++i) + ASSERT_EQ(ptr[i], i); + + hmm_buffer_free(buffer); +} + /* * Migrate anonymous memory to device private memory and fault some of it back * to system memory, then try migrating the resulting mix of system and device -- 2.25.1

2 1

[PATCH OLK-5.10] USB: serial: mxuport: fix memory corruption with small endpoint
by Liu Mingrui 11 Aug '26

11 Aug '26

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v5.10.259 commit 086b858b5f5125bc9d967ea2bd825f83d9f8f29d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4085f0dbb1ce2251c9a5938d693de6593f0ab2bd upstream. Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size. Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver") Cc: stable(a)vger.kernel.org # 3.14 Cc: Andrew Lunn <andrew(a)lunn.ch> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/usb/serial/mxuport.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c index 5d38c2a0f590..217b114db6bf 100644 --- a/drivers/usb/serial/mxuport.c +++ b/drivers/usb/serial/mxuport.c @@ -969,6 +969,14 @@ static int mxuport_calc_num_ports(struct usb_serial *serial, */ BUILD_BUG_ON(ARRAY_SIZE(epds->bulk_out) < 16); + /* + * The bulk-out buffers must be large enough for the four-byte header + * (and following data), but assume anything smaller than eight bytes + * is broken. + */ + if (usb_endpoint_maxp(epds->bulk_out[0]) < 8) + return -EINVAL; + for (i = 1; i < num_ports; ++i) epds->bulk_out[i] = epds->bulk_out[0]; -- 2.34.1

2 1

[PATCH OLK-6.6] erofs: fix stack-out-of-bounds in erofs_put_metabuf
by Liu Mingrui 11 Aug '26

11 Aug '26

From: Mingrui Liu <liumingrui(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16872 -------------------------------- Commit 1d4b040dd8ee moved erofs_put_metabuf() to out_unlock, but some error paths jump there before buf is initialized, unlike mainline where buf is always set. This triggers : BUG: KASAN: stack-out-of-bounds in erofs_put_metabuf+0x54/0x158 [erofs] Call Trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x78/0xc8 print_address_description.constprop.0+0x84/0x3c8 print_report+0xb0/0x280 kasan_report+0x84/0xd0 __asan_load8+0x9c/0xc0 erofs_put_metabuf+0x54/0x158 [erofs] erofs_init_inode_xattrs+0x194/0x560 [erofs] erofs_getxattr+0xc8/0x238 [erofs] erofs_get_acl+0x6c/0x150 [erofs] __get_acl.part.0+0x218/0x390 vfs_get_acl+0xd0/0x150 do_get_acl+0x38/0x2a0 do_getxattr+0x9c/0x250 getxattr+0xe0/0x148 path_getxattr+0xdc/0x150 __arm64_sys_getxattr+0x60/0x80 invoke_syscall+0x64/0x178 el0_svc_common.constprop.0+0x11c/0x150 do_el0_svc+0x38/0x50 el0_svc+0x44/0x228 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0 Fix by zero-initializing buf at declaration so erofs_put_metabuf() can safely handle it. Fixes: 6a89c63750cb ("erofs: fix metabuf leak in inode xattr initialization") Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- fs/erofs/xattr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c index b270226be379..abd23e990a3a 100644 --- a/fs/erofs/xattr.c +++ b/fs/erofs/xattr.c @@ -34,6 +34,8 @@ static int erofs_init_inode_xattrs(struct inode *inode) struct super_block *sb = inode->i_sb; int ret = 0; + it.buf = __EROFS_BUF_INITIALIZER; + /* the most case is that xattrs of this inode are initialized. */ if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags)) { /* @@ -76,7 +78,6 @@ static int erofs_init_inode_xattrs(struct inode *inode) goto out_unlock; } - it.buf = __EROFS_BUF_INITIALIZER; erofs_init_metabuf(&it.buf, sb); it.pos = erofs_iloc(inode) + vi->inode_isize; -- 2.34.1

2 1

[PATCH OLK-5.10] md/raid5: validate payload size before accessing journal metadata
by Yi Yang 11 Aug '26

11 Aug '26

From: Junrui Luo <moonafterrain(a)outlook.com> stable inclusion from stable-v5.10.258 commit c96c6f01d84b5c67db1bf1cc8591c0b7146826fc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15314 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b0cc3ae97e893bf54bbce447f4e9fd2e0b88bff9 upstream. r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a journal metadata block using on-disk payload size fields without validating them against the remaining space in the metadata block. A corrupted journal contains payload sizes extending beyond the PAGE_SIZE boundary can cause out-of-bounds reads when accessing payload fields or computing offsets. Add bounds validation for each payload type to ensure the full payload fits within meta_size before processing. Fixes: b4c625c67362 ("md/r5cache: r5cache recovery: part 1") Cc: stable(a)vger.kernel.org Signed-off-by: Junrui Luo <moonafterrain(a)outlook.com> Link: https://lore.kernel.org/linux-raid/SYBPR01MB78815E78D829BB86CD7C8015AF5FA@S… Signed-off-by: Yu Kuai <yukuai(a)fnnas.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/md/raid5-cache.c | 48 +++++++++++++++++++++++++++------------- 1 file changed, 33 insertions(+), 15 deletions(-) diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c index d879fc525f50..75b508c1b841 100644 --- a/drivers/md/raid5-cache.c +++ b/drivers/md/raid5-cache.c @@ -2018,15 +2018,27 @@ r5l_recovery_verify_data_checksum_for_mb(struct r5l_log *log, return -ENOMEM; while (mb_offset < le32_to_cpu(mb->meta_size)) { + sector_t payload_len; + payload = (void *)mb + mb_offset; payload_flush = (void *)mb + mb_offset; if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_DATA) { + payload_len = sizeof(struct r5l_payload_data_parity) + + (sector_t)sizeof(__le32) * + (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9)); + if (mb_offset + payload_len > le32_to_cpu(mb->meta_size)) + goto mismatch; if (r5l_recovery_verify_data_checksum( log, ctx, page, log_offset, payload->checksum[0]) < 0) goto mismatch; } else if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_PARITY) { + payload_len = sizeof(struct r5l_payload_data_parity) + + (sector_t)sizeof(__le32) * + (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9)); + if (mb_offset + payload_len > le32_to_cpu(mb->meta_size)) + goto mismatch; if (r5l_recovery_verify_data_checksum( log, ctx, page, log_offset, payload->checksum[0]) < 0) @@ -2039,22 +2051,18 @@ r5l_recovery_verify_data_checksum_for_mb(struct r5l_log *log, payload->checksum[1]) < 0) goto mismatch; } else if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) { - /* nothing to do for R5LOG_PAYLOAD_FLUSH here */ + payload_len = sizeof(struct r5l_payload_flush) + + (sector_t)le32_to_cpu(payload_flush->size); + if (mb_offset + payload_len > le32_to_cpu(mb->meta_size)) + goto mismatch; } else /* not R5LOG_PAYLOAD_DATA/PARITY/FLUSH */ goto mismatch; - if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) { - mb_offset += sizeof(struct r5l_payload_flush) + - le32_to_cpu(payload_flush->size); - } else { - /* DATA or PARITY payload */ + if (le16_to_cpu(payload->header.type) != R5LOG_PAYLOAD_FLUSH) { log_offset = r5l_ring_add(log, log_offset, le32_to_cpu(payload->size)); - mb_offset += sizeof(struct r5l_payload_data_parity) + - sizeof(__le32) * - (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9)); } - + mb_offset += payload_len; } put_page(page); @@ -2105,6 +2113,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log, log_offset = r5l_ring_add(log, ctx->pos, BLOCK_SECTORS); while (mb_offset < le32_to_cpu(mb->meta_size)) { + sector_t payload_len; int dd; payload = (void *)mb + mb_offset; @@ -2113,6 +2122,12 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log, if (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_FLUSH) { int i, count; + payload_len = sizeof(struct r5l_payload_flush) + + (sector_t)le32_to_cpu(payload_flush->size); + if (mb_offset + payload_len > + le32_to_cpu(mb->meta_size)) + return -EINVAL; + count = le32_to_cpu(payload_flush->size) / sizeof(__le64); for (i = 0; i < count; ++i) { stripe_sect = le64_to_cpu(payload_flush->flush_stripes[i]); @@ -2126,12 +2141,17 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log, } } - mb_offset += sizeof(struct r5l_payload_flush) + - le32_to_cpu(payload_flush->size); + mb_offset += payload_len; continue; } /* DATA or PARITY payload */ + payload_len = sizeof(struct r5l_payload_data_parity) + + (sector_t)sizeof(__le32) * + (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9)); + if (mb_offset + payload_len > le32_to_cpu(mb->meta_size)) + return -EINVAL; + stripe_sect = (le16_to_cpu(payload->header.type) == R5LOG_PAYLOAD_DATA) ? raid5_compute_sector( conf, le64_to_cpu(payload->location), 0, &dd, @@ -2196,9 +2216,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log, log_offset = r5l_ring_add(log, log_offset, le32_to_cpu(payload->size)); - mb_offset += sizeof(struct r5l_payload_data_parity) + - sizeof(__le32) * - (le32_to_cpu(payload->size) >> (PAGE_SHIFT - 9)); + mb_offset += payload_len; } return 0; -- 2.25.1

2 1

[PATCH OLK-6.6] mm/memory: fix spurious warning when unmapping device-private/exclusive pages
by Ze Zuo 11 Aug '26

11 Aug '26

From: Alistair Popple <apopple(a)nvidia.com> stable inclusion from stable-v6.6.143 commit e7af1b15c884ed12bb69da11aec095045d861ee8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16387 CVE : CVE-2026-64131 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit be3f38d05cc5a7c3f13e51994c5dd043ab604d28 ] Device private and exclusive entries are only supported for anonymous folios. This condition is tested in __migrate_device_pages() and make_device_exclusive() using folio_test_anon(). However the unmap path tests this assumption using vma_is_anonymous(). This is wrong because whilst anonymous VMAs can only contain folios where folio_test_anon() is true the opposite relation does not hold. A folio for which folio_test_anon() is true does not imply vma_is_anonymous() is true. Such a condition can occur if for example a folio is part of a private filebacked mapping. In this case vma_is_anonymous() is false as the mapping is filebacked, but folio_test_anon() may be true, thus permitting devices to migrate the folio to device private memory. This can lead to the following spurious warnings during process teardown: [ 772.737706] ------------[ cut here ]------------ [ 772.739201] WARNING: mm/memory.c:1754 at unmap_page_range.cold+0x26/0x18a, CPU#17: hmm-tests/2041 [ 772.742050] Modules linked in: test_hmm nvidia_uvm(O) nvidia(O) [ 772.743959] CPU: 17 UID: 0 PID: 2041 Comm: hmm-tests Tainted: G W O 7.0.0+ #387 PREEMPT(full) [ 772.747104] Tainted: [W]=WARN, [O]=OOT_MODULE [ 772.748509] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 772.752117] RIP: 0010:unmap_page_range.cold+0x26/0x18a [ 772.753780] Code: 7e fe ff ff 48 89 4c 24 78 4c 89 44 24 38 e8 f2 ff b1 00 48 8b 4c 24 78 4c 8b 44 24 38 48 8b 44 24 18 48 83 78 48 00 74 04 90 <0f> 0b 90 48 89 ca b8 ff ff 37 00 48 c1 ea 03 48 c1 e0 2a 80 3c 02 [ 772.759602] RSP: 0018:ffff888112607550 EFLAGS: 00010286 [ 772.761310] RAX: ffff88811bbf4dc0 RBX: dffffc0000000000 RCX: ffffea03e9bfffd8 [ 772.763583] RDX: 1ffff1102377e9c1 RSI: 0000000000000008 RDI: ffff88811bbf4e08 [ 772.765914] RBP: 0000000000000006 R08: ffff8881059f7448 R09: ffffed10224c0e68 [ 772.768184] R10: ffff888112607347 R11: 0000000000000001 R12: 0000000000000001 [ 772.770461] R13: ffffea03e9bfffc0 R14: ffff888112607908 R15: ffffea03e9bfffc0 [ 772.772782] FS: 00007f327caa2780(0000) GS:ffff888427b7d000(0000) knlGS:0000000000000000 [ 772.775328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 772.777187] CR2: 00007f327ca89000 CR3: 00000001994d5000 CR4: 00000000000006f0 [ 772.779135] Call Trace: [ 772.779792] <TASK> [ 772.780317] ? dmirror_interval_invalidate+0x1a3/0x290 [test_hmm] [ 772.781873] ? vm_normal_page_pud+0x2b0/0x2b0 [ 772.782992] ? __rwlock_init+0x150/0x150 [ 772.784006] ? lock_release+0x216/0x2b0 [ 772.785008] ? __mmu_notifier_invalidate_range_start+0x505/0x6e0 [ 772.786522] ? lock_release+0x216/0x2b0 [ 772.787498] ? unmap_single_vma+0xb6/0x210 [ 772.788573] unmap_vmas+0x27d/0x520 [ 772.789506] ? unmap_single_vma+0x210/0x210 [ 772.790607] ? mas_update_gap.part.0+0x620/0x620 [ 772.791834] unmap_region+0x19e/0x350 [ 772.792769] ? remove_vma+0x130/0x130 [ 772.793684] ? mas_alloc_nodes+0x1f2/0x300 [ 772.794730] vms_complete_munmap_vmas+0x8c1/0xe20 [ 772.795926] ? unmap_region+0x350/0x350 [ 772.796917] do_vmi_align_munmap+0x36a/0x4e0 [ 772.798018] ? lock_release+0x216/0x2b0 [ 772.799024] ? vma_shrink+0x620/0x620 [ 772.799983] do_vmi_munmap+0x150/0x2c0 [ 772.800939] __vm_munmap+0x161/0x2c0 [ 772.801872] ? expand_downwards+0xd60/0xd60 [ 772.802948] ? clockevents_program_event+0x1ef/0x540 [ 772.804217] ? lock_release+0x216/0x2b0 [ 772.805158] __x64_sys_munmap+0x59/0x80 [ 772.805776] do_syscall_64+0xfc/0x670 [ 772.806336] ? irqentry_exit+0xda/0x580 [ 772.806976] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 772.807772] RIP: 0033:0x7f327cbb2717 [ 772.808323] Code: 73 01 c3 48 8b 0d f9 76 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c9 76 0d 00 f7 d8 64 89 01 48 [ 772.811337] RSP: 002b:00007ffde7f57d38 EFLAGS: 00000202 ORIG_RAX: 000000000000000b [ 772.812564] RAX: ffffffffffffffda RBX: 00007f327cc9c000 RCX: 00007f327cbb2717 [ 772.813733] RDX: 0000000000000000 RSI: 0000000000400000 RDI: 00007f327c289000 [ 772.814867] RBP: 0000000000421360 R08: 000000000000001a R09: 0000000000000000 [ 772.815991] R10: 0000000000000003 R11: 0000000000000202 R12: 00007ffde7f57d74 [ 772.817121] R13: 00007f327c689010 R14: 0000000000100000 R15: 00007f327c289000 [ 772.818272] </TASK> [ 772.818614] irq event stamp: 0 [ 772.819159] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 772.820174] hardirqs last disabled at (0): [<ffffffff82a57ab3>] copy_process+0x19f3/0x6440 [ 772.821511] softirqs last enabled at (0): [<ffffffff82a57b00>] copy_process+0x1a40/0x6440 [ 772.822869] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 772.823871] ---[ end trace 0000000000000000 ]--- Fix this by using the same check for folio_test_anon() in zap_nonpresent_ptes(). Also add a hmm-test case for this. Link: https://lore.kernel.org/20260501065116.2057242-1-apopple@nvidia.com Fixes: 999dad824c39 ("mm/shmem: persist uffd-wp bit across zapping for file-backed") Signed-off-by: Alistair Popple <apopple(a)nvidia.com> Reported-by: Arsen Arsenović <aarsenovic(a)baylibre.com> Reviewed-by: Balbir Singh <balbirs(a)nvidia.com> Cc: David Hildenbrand <david(a)kernel.org> Cc: Jason Gunthorpe <jgg(a)ziepe.ca> Cc: John Hubbard <jhubbard(a)nvidia.com> Cc: Leon Romanovsky <leon(a)kernel.org> Cc: Liam R. Howlett <liam(a)infradead.org> Cc: Lorenzo Stoakes <ljs(a)kernel.org> Cc: Peter Xu <peterx(a)redhat.com> Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [ adapted `folio_test_anon(folio)` to `PageAnon(page)` ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/memory.c [Conflict due to merge commit a23f517b0e15 ("mm: convert mm_counter() to take a folio"), context conflict.] Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/memory.c | 2 +- tools/testing/selftests/mm/hmm-tests.c | 50 ++++++++++++++++++++++++++ 2 files changed, 51 insertions(+), 1 deletion(-) diff --git a/mm/memory.c b/mm/memory.c index 0b56a022c3f8..789b4b301415 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1635,7 +1635,7 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb, * consider uffd-wp bit when zap. For more information, * see zap_install_uffd_wp_if_needed(). */ - WARN_ON_ONCE(!vma_is_anonymous(vma)); + WARN_ON_ONCE(!folio_test_anon(folio)); rss[mm_counter(folio)]--; if (is_device_private_entry(entry)) folio_remove_rmap_pte(folio, page, vma); diff --git a/tools/testing/selftests/mm/hmm-tests.c b/tools/testing/selftests/mm/hmm-tests.c index 0cc1056c8fd7..5286e400ce8b 100644 --- a/tools/testing/selftests/mm/hmm-tests.c +++ b/tools/testing/selftests/mm/hmm-tests.c @@ -998,6 +998,56 @@ TEST_F(hmm, migrate) hmm_buffer_free(buffer); } +/* + * Migrate private file memory to device private memory. + */ +TEST_F(hmm, migrate_file_private) +{ + struct hmm_buffer *buffer; + unsigned long npages; + unsigned long size; + unsigned long i; + int *ptr; + int ret; + int fd; + + npages = ALIGN(HMM_BUFFER_SIZE, self->page_size) >> self->page_shift; + ASSERT_NE(npages, 0); + size = npages << self->page_shift; + + fd = hmm_create_file(size); + ASSERT_GE(fd, 0); + + buffer = malloc(sizeof(*buffer)); + ASSERT_NE(buffer, NULL); + + buffer->fd = fd; + buffer->size = size; + buffer->mirror = malloc(size); + ASSERT_NE(buffer->mirror, NULL); + + buffer->ptr = mmap(NULL, size, + PROT_READ | PROT_WRITE, + MAP_PRIVATE, + buffer->fd, 0); + ASSERT_NE(buffer->ptr, MAP_FAILED); + + /* Initialize buffer in system memory. */ + for (i = 0, ptr = buffer->ptr; i < size / sizeof(*ptr); ++i) + ptr[i] = i; + + /* Migrate memory to device. */ + ret = hmm_migrate_sys_to_dev(self->fd, buffer, npages); + ASSERT_EQ(ret, 0); + ASSERT_EQ(buffer->cpages, npages); + + /* Check what the device read. */ + for (i = 0, ptr = buffer->mirror; i < size / sizeof(*ptr); ++i) + ASSERT_EQ(ptr[i], i); + + hmm_buffer_free(buffer); +} + /* * Migrate anonymous memory to device private memory and fault some of it back * to system memory, then try migrating the resulting mix of system and device -- 2.25.1

2 3

[PATCH OLK-6.6 V1] RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
by Cheng Yu 11 Aug '26

11 Aug '26

From: Li Zhijian <lizhijian(a)fujitsu.com> mainline inclusion from mainline-v7.0 commit 12985e5915a0b8354796efadaaeb201eed115377 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15591 CVE: CVE-2026-46325 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOc… Fixes: 592627ccbdff ("RDMA/rxe: Replace rxe_map and rxe_phys_buf by xarray") Signed-off-by: Li Zhijian <lizhijian(a)fujitsu.com> Link: https://patch.msgid.link/20260116032753.2574363-1-lizhijian@fujitsu.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/sw/rxe/rxe_mr.c [Applied cleanly to: drivers/infiniband/sw/rxe/rxe_verbs.h. drivers/infiniband/sw/rxe/rxe_mr.c: The rxe_mr_copy_xarray function is renamed to rxe_mr_copy_page_info to match the new array-based access pattern; all xarray references are replaced with direct page_info array indexing. The upstream __alloc_mr_page_info and alloc_mr_page_info helpers are added with identical semantics. The rxe_mr_alloc function is removed as it's replaced by alloc_mr_page_info.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_mr.c | 280 +++++++++++++++++--------- drivers/infiniband/sw/rxe/rxe_verbs.h | 10 +- 2 files changed, 193 insertions(+), 97 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c index bc81fde696ee..9b553028a55b 100644 --- a/drivers/infiniband/sw/rxe/rxe_mr.c +++ b/drivers/infiniband/sw/rxe/rxe_mr.c @@ -72,14 +72,46 @@ void rxe_mr_init_dma(int access, struct rxe_mr *mr) mr->ibmr.type = IB_MR_TYPE_DMA; } +/* + * Convert iova to page_info index. The page_info stores pages of size + * PAGE_SIZE, but MRs can have different page sizes. This function + * handles the conversion for all cases: + * + * 1. mr->page_size > PAGE_SIZE: + * The MR's iova may not be aligned to mr->page_size. We use the + * aligned base (iova & page_mask) as reference, then calculate + * which PAGE_SIZE sub-page the iova falls into. + * + * 2. mr->page_size <= PAGE_SIZE: + * Use simple shift arithmetic since each page_info entry corresponds + * to one or more MR pages. + */ static unsigned long rxe_mr_iova_to_index(struct rxe_mr *mr, u64 iova) { - return (iova >> mr->page_shift) - (mr->ibmr.iova >> mr->page_shift); + int idx; + + if (mr_page_size(mr) > PAGE_SIZE) + idx = (iova - (mr->ibmr.iova & mr->page_mask)) >> PAGE_SHIFT; + else + idx = (iova >> mr->page_shift) - + (mr->ibmr.iova >> mr->page_shift); + + WARN_ON(idx >= mr->nbuf); + return idx; } +/* + * Convert iova to offset within the page_info entry. + * + * For mr_page_size > PAGE_SIZE, the offset is within the system page. + * For mr_page_size <= PAGE_SIZE, the offset is within the MR page size. + */ static unsigned long rxe_mr_iova_to_page_offset(struct rxe_mr *mr, u64 iova) { - return iova & (mr_page_size(mr) - 1); + if (mr_page_size(mr) > PAGE_SIZE) + return iova & (PAGE_SIZE - 1); + else + return iova & (mr_page_size(mr) - 1); } static bool is_pmem_page(struct page *pg) @@ -93,37 +125,69 @@ static bool is_pmem_page(struct page *pg) static int rxe_mr_fill_pages_from_sgt(struct rxe_mr *mr, struct sg_table *sgt) { - XA_STATE(xas, &mr->page_list, 0); struct sg_page_iter sg_iter; struct page *page; bool persistent = !!(mr->access & IB_ACCESS_FLUSH_PERSISTENT); + WARN_ON(mr_page_size(mr) != PAGE_SIZE); + __sg_page_iter_start(&sg_iter, sgt->sgl, sgt->orig_nents, 0); if (!__sg_page_iter_next(&sg_iter)) return 0; - do { - xas_lock(&xas); - while (true) { - page = sg_page_iter_page(&sg_iter); - - if (persistent && !is_pmem_page(page)) { - rxe_dbg_mr(mr, "Page can't be persistent\n"); - xas_set_err(&xas, -EINVAL); - break; - } + while (true) { + page = sg_page_iter_page(&sg_iter); - xas_store(&xas, page); - if (xas_error(&xas)) - break; - xas_next(&xas); - if (!__sg_page_iter_next(&sg_iter)) - break; + if (persistent && !is_pmem_page(page)) { + rxe_dbg_mr(mr, "Page can't be persistent\n"); + return -EINVAL; } - xas_unlock(&xas); - } while (xas_nomem(&xas, GFP_KERNEL)); - return xas_error(&xas); + mr->page_info[mr->nbuf].page = page; + mr->page_info[mr->nbuf].offset = 0; + mr->nbuf++; + + if (!__sg_page_iter_next(&sg_iter)) + break; + } + + return 0; +} + +static int __alloc_mr_page_info(struct rxe_mr *mr, int num_pages) +{ + mr->page_info = kcalloc(num_pages, sizeof(struct rxe_mr_page), + GFP_KERNEL); + if (!mr->page_info) + return -ENOMEM; + + mr->max_allowed_buf = num_pages; + mr->nbuf = 0; + + return 0; +} + +static int alloc_mr_page_info(struct rxe_mr *mr, int num_pages) +{ + int ret; + + WARN_ON(mr->num_buf); + ret = __alloc_mr_page_info(mr, num_pages); + if (ret) + return ret; + + mr->num_buf = num_pages; + + return 0; +} + +static void free_mr_page_info(struct rxe_mr *mr) +{ + if (!mr->page_info) + return; + + kfree(mr->page_info); + mr->page_info = NULL; } int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova, @@ -134,8 +198,6 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova, rxe_mr_init(access, mr); - xa_init(&mr->page_list); - umem = ib_umem_get(&rxe->ib_dev, start, length, access); if (IS_ERR(umem)) { rxe_dbg_mr(mr, "Unable to pin memory region err = %d\n", @@ -143,46 +205,24 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova, return PTR_ERR(umem); } + err = alloc_mr_page_info(mr, ib_umem_num_pages(umem)); + if (err) + goto err2; + err = rxe_mr_fill_pages_from_sgt(mr, &umem->sgt_append.sgt); - if (err) { - ib_umem_release(umem); - return err; - } + if (err) + goto err1; mr->umem = umem; mr->ibmr.type = IB_MR_TYPE_USER; mr->state = RXE_MR_STATE_VALID; return 0; -} - -static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf) -{ - XA_STATE(xas, &mr->page_list, 0); - int i = 0; - int err; - - xa_init(&mr->page_list); - - do { - xas_lock(&xas); - while (i != num_buf) { - xas_store(&xas, XA_ZERO_ENTRY); - if (xas_error(&xas)) - break; - xas_next(&xas); - i++; - } - xas_unlock(&xas); - } while (xas_nomem(&xas, GFP_KERNEL)); - - err = xas_error(&xas); - if (err) - return err; - - mr->num_buf = num_buf; - - return 0; +err1: + free_mr_page_info(mr); +err2: + ib_umem_release(umem); + return err; } int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr) @@ -192,7 +232,7 @@ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr) /* always allow remote access for FMRs */ rxe_mr_init(RXE_ACCESS_REMOTE, mr); - err = rxe_mr_alloc(mr, max_pages); + err = alloc_mr_page_info(mr, max_pages); if (err) goto err1; @@ -205,26 +245,43 @@ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr) return err; } +/* + * I) MRs with page_size >= PAGE_SIZE, + * Split a large MR page (mr->page_size) into multiple PAGE_SIZE + * sub-pages and store them in page_info, offset is always 0. + * + * Called when mr->page_size > PAGE_SIZE. Each call to rxe_set_page() + * represents one mr->page_size region, which we must split into + * (mr->page_size >> PAGE_SHIFT) individual pages. + * + * II) MRs with page_size < PAGE_SIZE, + * Save each PAGE_SIZE page and its offset within the system page in page_info. + */ static int rxe_set_page(struct ib_mr *ibmr, u64 dma_addr) { struct rxe_mr *mr = to_rmr(ibmr); - struct page *page = ib_virt_dma_to_page(dma_addr); bool persistent = !!(mr->access & IB_ACCESS_FLUSH_PERSISTENT); - int err; + u32 i, pages_per_mr = mr_page_size(mr) >> PAGE_SHIFT; - if (persistent && !is_pmem_page(page)) { - rxe_dbg_mr(mr, "Page cannot be persistent\n"); - return -EINVAL; - } + pages_per_mr = MAX(1, pages_per_mr); - if (unlikely(mr->nbuf == mr->num_buf)) - return -ENOMEM; + for (i = 0; i < pages_per_mr; i++) { + u64 addr = dma_addr + i * PAGE_SIZE; + struct page *sub_page = ib_virt_dma_to_page(addr); - err = xa_err(xa_store(&mr->page_list, mr->nbuf, page, GFP_KERNEL)); - if (err) - return err; + if (unlikely(mr->nbuf >= mr->max_allowed_buf)) + return -ENOMEM; + + if (persistent && !is_pmem_page(sub_page)) { + rxe_dbg_mr(mr, "Page cannot be persistent\n"); + return -EINVAL; + } + + mr->page_info[mr->nbuf].page = sub_page; + mr->page_info[mr->nbuf].offset = addr & (PAGE_SIZE - 1); + mr->nbuf++; + } - mr->nbuf++; return 0; } @@ -234,6 +291,31 @@ int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sgl, struct rxe_mr *mr = to_rmr(ibmr); unsigned int page_size = mr_page_size(mr); + /* + * Ensure page_size and PAGE_SIZE are compatible for mapping. + * We require one to be a multiple of the other for correct + * iova-to-page conversion. + */ + if (!IS_ALIGNED(page_size, PAGE_SIZE) && + !IS_ALIGNED(PAGE_SIZE, page_size)) { + rxe_dbg_mr(mr, "MR page size %u must be compatible with PAGE_SIZE %lu\n", + page_size, PAGE_SIZE); + return -EINVAL; + } + + if (mr_page_size(mr) > PAGE_SIZE) { + /* resize page_info if needed */ + u32 map_mr_pages = (page_size >> PAGE_SHIFT) * mr->num_buf; + + if (map_mr_pages > mr->max_allowed_buf) { + rxe_dbg_mr(mr, "requested pages %u exceed max %u\n", + map_mr_pages, mr->max_allowed_buf); + free_mr_page_info(mr); + if (__alloc_mr_page_info(mr, map_mr_pages)) + return -ENOMEM; + } + } + mr->nbuf = 0; mr->page_shift = ilog2(page_size); mr->page_mask = ~((u64)page_size - 1); @@ -245,30 +327,30 @@ int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sgl, static int rxe_mr_copy_xarray(struct rxe_mr *mr, u64 iova, void *addr, unsigned int length, enum rxe_mr_copy_dir dir) { - unsigned int page_offset = rxe_mr_iova_to_page_offset(mr, iova); - unsigned long index = rxe_mr_iova_to_index(mr, iova); unsigned int bytes; - struct page *page; - void *va; + u8 *va; while (length) { - page = xa_load(&mr->page_list, index); - if (!page) + unsigned long index = rxe_mr_iova_to_index(mr, iova); + struct rxe_mr_page *info = &mr->page_info[index]; + unsigned int page_offset = rxe_mr_iova_to_page_offset(mr, iova); + + if (!info->page) return -EFAULT; - bytes = min_t(unsigned int, length, - mr_page_size(mr) - page_offset); - va = kmap_local_page(page); + page_offset += info->offset; + bytes = min_t(unsigned int, length, PAGE_SIZE - page_offset); + va = kmap_local_page(info->page); + if (dir == RXE_FROM_MR_OBJ) memcpy(addr, va + page_offset, bytes); else memcpy(va + page_offset, addr, bytes); kunmap_local(va); - page_offset = 0; addr += bytes; + iova += bytes; length -= bytes; - index++; } return 0; @@ -423,9 +505,6 @@ int copy_data( int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, unsigned int length) { - unsigned int page_offset; - unsigned long index; - struct page *page; unsigned int bytes; int err; u8 *va; @@ -445,15 +524,16 @@ int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, unsigned int length) return err; while (length > 0) { - index = rxe_mr_iova_to_index(mr, iova); - page = xa_load(&mr->page_list, index); - page_offset = rxe_mr_iova_to_page_offset(mr, iova); - if (!page) + unsigned long index = rxe_mr_iova_to_index(mr, iova); + struct rxe_mr_page *info = &mr->page_info[index]; + unsigned int page_offset = rxe_mr_iova_to_page_offset(mr, iova); + + if (!info->page) return -EFAULT; - bytes = min_t(unsigned int, length, - mr_page_size(mr) - page_offset); + page_offset += info->offset; + bytes = min_t(unsigned int, length, PAGE_SIZE - page_offset); - va = kmap_local_page(page); + va = kmap_local_page(info->page); arch_wb_cache_pmem(va + page_offset, bytes); kunmap_local(va); @@ -487,6 +567,7 @@ int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, } else { unsigned long index; int err; + struct rxe_mr_page *info; err = mr_check_range(mr, iova, sizeof(value)); if (err) { @@ -495,9 +576,12 @@ int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, } page_offset = rxe_mr_iova_to_page_offset(mr, iova); index = rxe_mr_iova_to_index(mr, iova); - page = xa_load(&mr->page_list, index); - if (!page) + info = &mr->page_info[index]; + if (!info->page) return RESPST_ERR_RKEY_VIOLATION; + + page_offset += info->offset; + page = info->page; } if (unlikely(page_offset & 0x7)) { @@ -544,6 +628,7 @@ int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) } else { unsigned long index; int err; + struct rxe_mr_page *info; /* See IBA oA19-28 */ err = mr_check_range(mr, iova, sizeof(value)); @@ -553,9 +638,12 @@ int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) } page_offset = rxe_mr_iova_to_page_offset(mr, iova); index = rxe_mr_iova_to_index(mr, iova); - page = xa_load(&mr->page_list, index); - if (!page) + info = &mr->page_info[index]; + if (!info->page) return RESPST_ERR_RKEY_VIOLATION; + + page_offset += info->offset; + page = info->page; } /* See IBA A19.4.2 */ @@ -727,5 +815,5 @@ void rxe_mr_cleanup(struct rxe_pool_elem *elem) ib_umem_release(mr->umem); if (mr->ibmr.type != IB_MR_TYPE_DMA) - xa_destroy(&mr->page_list); + free_mr_page_info(mr); } diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h index 4242b24a47da..3b26ae016abe 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.h +++ b/drivers/infiniband/sw/rxe/rxe_verbs.h @@ -297,6 +297,11 @@ static inline int rkey_is_mw(u32 rkey) return (index >= RXE_MIN_MW_INDEX) && (index <= RXE_MAX_MW_INDEX); } +struct rxe_mr_page { + struct page *page; + unsigned int offset; /* offset in system page */ +}; + struct rxe_mr { struct rxe_pool_elem elem; struct ib_mr ibmr; @@ -313,10 +318,13 @@ struct rxe_mr { unsigned int page_shift; u64 page_mask; + /* size of page_info when mr allocated */ u32 num_buf; + /* real size of page_info */ + u32 max_allowed_buf; u32 nbuf; - struct xarray page_list; + struct rxe_mr_page *page_info; }; static inline unsigned int mr_page_size(struct rxe_mr *mr) -- 2.25.1

2 1

[PATCH OLK-6.6] mm/memory: fix spurious warning when unmapping device-private/exclusive pages
by Ze Zuo 11 Aug '26

11 Aug '26

From: Alistair Popple <apopple(a)nvidia.com> stable inclusion from stable-v6.6.143 commit e7af1b15c884ed12bb69da11aec095045d861ee8 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9337 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit be3f38d05cc5a7c3f13e51994c5dd043ab604d28 ] Device private and exclusive entries are only supported for anonymous folios. This condition is tested in __migrate_device_pages() and make_device_exclusive() using folio_test_anon(). However the unmap path tests this assumption using vma_is_anonymous(). This is wrong because whilst anonymous VMAs can only contain folios where folio_test_anon() is true the opposite relation does not hold. A folio for which folio_test_anon() is true does not imply vma_is_anonymous() is true. Such a condition can occur if for example a folio is part of a private filebacked mapping. In this case vma_is_anonymous() is false as the mapping is filebacked, but folio_test_anon() may be true, thus permitting devices to migrate the folio to device private memory. This can lead to the following spurious warnings during process teardown: [ 772.737706] ------------[ cut here ]------------ [ 772.739201] WARNING: mm/memory.c:1754 at unmap_page_range.cold+0x26/0x18a, CPU#17: hmm-tests/2041 [ 772.742050] Modules linked in: test_hmm nvidia_uvm(O) nvidia(O) [ 772.743959] CPU: 17 UID: 0 PID: 2041 Comm: hmm-tests Tainted: G W O 7.0.0+ #387 PREEMPT(full) [ 772.747104] Tainted: [W]=WARN, [O]=OOT_MODULE [ 772.748509] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 772.752117] RIP: 0010:unmap_page_range.cold+0x26/0x18a [ 772.753780] Code: 7e fe ff ff 48 89 4c 24 78 4c 89 44 24 38 e8 f2 ff b1 00 48 8b 4c 24 78 4c 8b 44 24 38 48 8b 44 24 18 48 83 78 48 00 74 04 90 <0f> 0b 90 48 89 ca b8 ff ff 37 00 48 c1 ea 03 48 c1 e0 2a 80 3c 02 [ 772.759602] RSP: 0018:ffff888112607550 EFLAGS: 00010286 [ 772.761310] RAX: ffff88811bbf4dc0 RBX: dffffc0000000000 RCX: ffffea03e9bfffd8 [ 772.763583] RDX: 1ffff1102377e9c1 RSI: 0000000000000008 RDI: ffff88811bbf4e08 [ 772.765914] RBP: 0000000000000006 R08: ffff8881059f7448 R09: ffffed10224c0e68 [ 772.768184] R10: ffff888112607347 R11: 0000000000000001 R12: 0000000000000001 [ 772.770461] R13: ffffea03e9bfffc0 R14: ffff888112607908 R15: ffffea03e9bfffc0 [ 772.772782] FS: 00007f327caa2780(0000) GS:ffff888427b7d000(0000) knlGS:0000000000000000 [ 772.775328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 772.777187] CR2: 00007f327ca89000 CR3: 00000001994d5000 CR4: 00000000000006f0 [ 772.779135] Call Trace: [ 772.779792] <TASK> [ 772.780317] ? dmirror_interval_invalidate+0x1a3/0x290 [test_hmm] [ 772.781873] ? vm_normal_page_pud+0x2b0/0x2b0 [ 772.782992] ? __rwlock_init+0x150/0x150 [ 772.784006] ? lock_release+0x216/0x2b0 [ 772.785008] ? __mmu_notifier_invalidate_range_start+0x505/0x6e0 [ 772.786522] ? lock_release+0x216/0x2b0 [ 772.787498] ? unmap_single_vma+0xb6/0x210 [ 772.788573] unmap_vmas+0x27d/0x520 [ 772.789506] ? unmap_single_vma+0x210/0x210 [ 772.790607] ? mas_update_gap.part.0+0x620/0x620 [ 772.791834] unmap_region+0x19e/0x350 [ 772.792769] ? remove_vma+0x130/0x130 [ 772.793684] ? mas_alloc_nodes+0x1f2/0x300 [ 772.794730] vms_complete_munmap_vmas+0x8c1/0xe20 [ 772.795926] ? unmap_region+0x350/0x350 [ 772.796917] do_vmi_align_munmap+0x36a/0x4e0 [ 772.798018] ? lock_release+0x216/0x2b0 [ 772.799024] ? vma_shrink+0x620/0x620 [ 772.799983] do_vmi_munmap+0x150/0x2c0 [ 772.800939] __vm_munmap+0x161/0x2c0 [ 772.801872] ? expand_downwards+0xd60/0xd60 [ 772.802948] ? clockevents_program_event+0x1ef/0x540 [ 772.804217] ? lock_release+0x216/0x2b0 [ 772.805158] __x64_sys_munmap+0x59/0x80 [ 772.805776] do_syscall_64+0xfc/0x670 [ 772.806336] ? irqentry_exit+0xda/0x580 [ 772.806976] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 772.807772] RIP: 0033:0x7f327cbb2717 [ 772.808323] Code: 73 01 c3 48 8b 0d f9 76 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c9 76 0d 00 f7 d8 64 89 01 48 [ 772.811337] RSP: 002b:00007ffde7f57d38 EFLAGS: 00000202 ORIG_RAX: 000000000000000b [ 772.812564] RAX: ffffffffffffffda RBX: 00007f327cc9c000 RCX: 00007f327cbb2717 [ 772.813733] RDX: 0000000000000000 RSI: 0000000000400000 RDI: 00007f327c289000 [ 772.814867] RBP: 0000000000421360 R08: 000000000000001a R09: 0000000000000000 [ 772.815991] R10: 0000000000000003 R11: 0000000000000202 R12: 00007ffde7f57d74 [ 772.817121] R13: 00007f327c689010 R14: 0000000000100000 R15: 00007f327c289000 [ 772.818272] </TASK> [ 772.818614] irq event stamp: 0 [ 772.819159] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 772.820174] hardirqs last disabled at (0): [<ffffffff82a57ab3>] copy_process+0x19f3/0x6440 [ 772.821511] softirqs last enabled at (0): [<ffffffff82a57b00>] copy_process+0x1a40/0x6440 [ 772.822869] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 772.823871] ---[ end trace 0000000000000000 ]--- Fix this by using the same check for folio_test_anon() in zap_nonpresent_ptes(). Also add a hmm-test case for this. Link: https://lore.kernel.org/20260501065116.2057242-1-apopple@nvidia.com Fixes: 999dad824c39 ("mm/shmem: persist uffd-wp bit across zapping for file-backed") Signed-off-by: Alistair Popple <apopple(a)nvidia.com> Reported-by: Arsen Arsenović <aarsenovic(a)baylibre.com> Reviewed-by: Balbir Singh <balbirs(a)nvidia.com> Cc: David Hildenbrand <david(a)kernel.org> Cc: Jason Gunthorpe <jgg(a)ziepe.ca> Cc: John Hubbard <jhubbard(a)nvidia.com> Cc: Leon Romanovsky <leon(a)kernel.org> Cc: Liam R. Howlett <liam(a)infradead.org> Cc: Lorenzo Stoakes <ljs(a)kernel.org> Cc: Peter Xu <peterx(a)redhat.com> Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [ adapted `folio_test_anon(folio)` to `PageAnon(page)` ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/memory.c [Conflict due to merge commit a23f517b0e15 ("mm: convert mm_counter() to take a folio"), context conflict.] Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/memory.c | 2 +- tools/testing/selftests/mm/hmm-tests.c | 50 ++++++++++++++++++++++++++ 2 files changed, 51 insertions(+), 1 deletion(-) diff --git a/mm/memory.c b/mm/memory.c index 0b56a022c3f8..789b4b301415 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1635,7 +1635,7 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb, * consider uffd-wp bit when zap. For more information, * see zap_install_uffd_wp_if_needed(). */ - WARN_ON_ONCE(!vma_is_anonymous(vma)); + WARN_ON_ONCE(!folio_test_anon(folio)); rss[mm_counter(folio)]--; if (is_device_private_entry(entry)) folio_remove_rmap_pte(folio, page, vma); diff --git a/tools/testing/selftests/mm/hmm-tests.c b/tools/testing/selftests/mm/hmm-tests.c index 0cc1056c8fd7..5286e400ce8b 100644 --- a/tools/testing/selftests/mm/hmm-tests.c +++ b/tools/testing/selftests/mm/hmm-tests.c @@ -998,6 +998,56 @@ TEST_F(hmm, migrate) hmm_buffer_free(buffer); } +/* + * Migrate private file memory to device private memory. + */ +TEST_F(hmm, migrate_file_private) +{ + struct hmm_buffer *buffer; + unsigned long npages; + unsigned long size; + unsigned long i; + int *ptr; + int ret; + int fd; + + npages = ALIGN(HMM_BUFFER_SIZE, self->page_size) >> self->page_shift; + ASSERT_NE(npages, 0); + size = npages << self->page_shift; + + fd = hmm_create_file(size); + ASSERT_GE(fd, 0); + + buffer = malloc(sizeof(*buffer)); + ASSERT_NE(buffer, NULL); + + buffer->fd = fd; + buffer->size = size; + buffer->mirror = malloc(size); + ASSERT_NE(buffer->mirror, NULL); + + buffer->ptr = mmap(NULL, size, + PROT_READ | PROT_WRITE, + MAP_PRIVATE, + buffer->fd, 0); + ASSERT_NE(buffer->ptr, MAP_FAILED); + + /* Initialize buffer in system memory. */ + for (i = 0, ptr = buffer->ptr; i < size / sizeof(*ptr); ++i) + ptr[i] = i; + + /* Migrate memory to device. */ + ret = hmm_migrate_sys_to_dev(self->fd, buffer, npages); + ASSERT_EQ(ret, 0); + ASSERT_EQ(buffer->cpages, npages); + + /* Check what the device read. */ + for (i = 0, ptr = buffer->mirror; i < size / sizeof(*ptr); ++i) + ASSERT_EQ(ptr[i], i); + + hmm_buffer_free(buffer); +} + /* * Migrate anonymous memory to device private memory and fault some of it back * to system memory, then try migrating the resulting mix of system and device -- 2.25.1

2 1

[PATCH OLK-6.6 v8] Add XMFS Support
by Yifan Qiao 11 Aug '26

11 Aug '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9732 ---------------------------------------- Memory-semantic interconnects such as CXL 3.0 and Huawei United Bus make remote memory directly addressable. This raises a question for Linux: should cross-node memory become another storage tier that can be exposed through existing POSIX filesystem interfaces? To explore this question, we built XMFS, an in-kernel prototype that exports cross-node shared memory through a standard POSIX filesystem interface. Initial experiments with metadata-intensive workloads and container image sharing suggest the approach is practical. Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/xmfs/xmfs_i.h | 1098 ++++++++++++++++++++ fs/xmfs/dir.c | 160 +++ fs/xmfs/file.c | 2261 +++++++++++++++++++++++++++++++++++++++++ fs/xmfs/gc.c | 953 +++++++++++++++++ fs/xmfs/inode.c | 344 +++++++ fs/xmfs/namei.c | 1794 ++++++++++++++++++++++++++++++++ fs/xmfs/replay.c | 907 +++++++++++++++++ fs/xmfs/super.c | 1677 ++++++++++++++++++++++++++++++ fs/xmfs/symlink.c | 87 ++ fs/xmfs/urma.c | 2482 +++++++++++++++++++++++++++++++++++++++++++++ fs/xmfs/xattr.c | 591 +++++++++++ fs/Kconfig | 1 + fs/Makefile | 1 + fs/xmfs/Kconfig | 21 + fs/xmfs/Makefile | 16 + 15 files changed, 12393 insertions(+) create mode 100644 fs/xmfs/xmfs_i.h create mode 100644 fs/xmfs/dir.c create mode 100644 fs/xmfs/file.c create mode 100644 fs/xmfs/gc.c create mode 100644 fs/xmfs/inode.c create mode 100644 fs/xmfs/namei.c create mode 100644 fs/xmfs/replay.c create mode 100644 fs/xmfs/super.c create mode 100644 fs/xmfs/symlink.c create mode 100644 fs/xmfs/urma.c create mode 100644 fs/xmfs/xattr.c create mode 100644 fs/xmfs/Kconfig create mode 100644 fs/xmfs/Makefile diff --git a/fs/xmfs/xmfs_i.h b/fs/xmfs/xmfs_i.h new file mode 100644 index 000000000000..7f58b2f64f7b --- /dev/null +++ b/fs/xmfs/xmfs_i.h @@ -0,0 +1,1098 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * XMFS: Log Structured Filesystem for UB + * Copyright (C) 2024. Huawei Technologies Co., Ltd + * + * This program can be distributed under the terms of the GNU GPL. + * See the file COPYING. + */ +#ifndef _XMFS_H +#define _XMFS_H + +#include <linux/atomic.h> +#include <linux/fs.h> +#include <linux/xarray.h> +#include <linux/spinlock.h> +#include <linux/mm.h> +#include <linux/ratelimit.h> +#include <linux/xattr.h> +#include <linux/vmalloc.h> +#include <linux/workqueue.h> + +#include <linux/pgtable.h> +#include <linux/atomic.h> +#include <linux/libnvdimm.h> + +#ifdef CONFIG_XMFS_FS_URMA +#include <ub/urma/ubcore_types.h> +#include <ub/urma/ubcore_uapi.h> +#include <ub/urma/ubcore_api.h> +#endif + +/* #define PER_FS 1 */ + +#define XMFS_MAGIC 0x53464D58 + +#define TOTAL_SIZE (8UL << 30) +#define DATA_ALIGN_KB 4UL + +#ifdef PER_FS +#define MAX_LOG_PER_TRUNK 18724 +#else +#define MAX_LOG_PER_TRUNK 6096 +#endif + +#define ALIGN_TO_MB(size) \ + (((size) + (2 * 1024 * 1024 - 1)) & ~(2 * 1024 * 1024 - 1)) + +#define ALIGN_TO_2MB_LOWER(size) ((size) & ~(2 * 1024 * 1024 - 1)) + +/* sb is 4MB, supports up to ~8TB */ +#define SB_OFFSET 0 +#define SB_SIZE (4UL << 20) + +/* mount msg is 2MB */ +#define MOUNT_MSG_OFFSET (SB_OFFSET + SB_SIZE) +#define MOUNT_MSG_SIZE (1UL << 21) + +/* msg ring is 2MB */ +#define MSG_RING_OFFSET (MOUNT_MSG_OFFSET + MOUNT_MSG_SIZE) +#define MSG_RING_SIZE (1 << 21) + +#define INODE_TABLE_OFFSET (MSG_RING_OFFSET + MSG_RING_SIZE) +#define INODE_TABLE_SIZE (2UL << 21) +#define XMFS_INODE_TABLE_MAGIC 0x494E4F44UL + +#define DATA_AREA_OFFSET (INODE_TABLE_OFFSET + INODE_TABLE_SIZE) + +/* XMFS trunk is 2MB */ +#define XMFS_DEFAULT_CHUNK_SIZE (1UL << 21) + +/* XMFS data align is 64KB */ +#define XMFS_DATA_SHIFT 16 + +/* XMFS log ops */ +#define XMFS_CREATE (1 << 0) +#define XMFS_DELETE (1 << 1) +#define XMFS_UPDATE (1 << 2) +#define XMFS_LINK (1 << 3) +#define XMFS_MKDIR (1 << 4) +#define XMFS_RENAME (1 << 5) +#define XMFS_SETATTR (1 << 6) +#define XMFS_SYMLINK (1 << 7) +#define XMFS_XATTR (1 << 8) +#define XMFS_ROOT (1 << 9) +#define XMFS_GC (1 << 10) + +#define RENAME_HOLD (1 << 4) + +#define XMFS_DATA_TRUNK_MAGIC 0x44415441UL +#define XMFS_GC_INTERVAL_DEFAULT 5 +#define XMFS_GC_BATCH 51200 +#define XMFS_BITMAP_CAPACITY (SB_SIZE - offsetof(struct xmfs_sb_index, bitmap)) + +enum xmfs_rw_msg_type { + MSG_RW_REQUEST = 1, + MSG_RW_GRANT, + MSG_RW_COMPLETE, + MSG_RW_ERROR, +}; + +struct xmfs_data_trunk_header { + unsigned long magic; + unsigned long live_page_count; + unsigned int total_page_count; + unsigned long last_modify_version; +}; + +struct xmfs_gc_ctl { + spinlock_t gc_lock; + wait_queue_head_t wait; + unsigned long gc_cursor; + unsigned long gc_batch; + bool gc_running; + bool need_replay; +}; + +struct xmfs_rw_msg { + enum xmfs_rw_msg_type type; + int magic; + int slave_id; + unsigned long request_id; + unsigned int ops; + unsigned long data_pages; + unsigned long log_entries; + umode_t mode; + unsigned long p_ino; + unsigned long i_ino; + char name[256]; + loff_t size; + unsigned long log_trunk_addr; + int log_slot_start; + int log_slot_count; + unsigned long data_addr; + unsigned long data_page_count; + unsigned long second_data_addr; + unsigned long second_data_pages; + unsigned long assigned_ino; + int status; + unsigned long version; +}; + +struct xmfs_notify_msg { + int slave_id; + unsigned long request_id; + int msg_type; + int _pad[5]; +}; + +extern const struct xattr_handler *xmfs_host_xattr_handlers[]; +extern const struct xattr_handler *xmfs_slave_xattr_handlers[]; + +enum xmfs_msg_type { + MSG_STOP_READ = 1, + MSG_READ, +}; + +enum xmfs_mode { + XMFS_SHARED_MEM_MODE, + XMFS_URMA_MODE, + XMFS_HYBRID_MODE, +}; + +enum xmfs_param { + Opt_host, + Opt_replay, + Opt_addr, + Opt_size, + Opt_freq, + Opt_log, + Opt_debug, + Opt_always_hot, + Opt_fallocate, + Opt_mode, +#ifdef CONFIG_XMFS_FS_URMA + Opt_urma_va, + Opt_urma_eid_subnet_prefix, + Opt_urma_eid_interface_id, + Opt_urma_jetty_id, + Opt_urma_token_id, + Opt_urma_dev, +#endif +}; + +/* 4KB */ +struct xmfs_msg_queue { + unsigned short len; + unsigned short type; + unsigned long addr; + char pad[4072]; +}; + +struct xmfs_fs_context { + bool host; + bool replay; + unsigned long addr; + unsigned long size; + unsigned long fallocate_size; + int freq; + int log_size; + int mode; + bool debug; + bool always_hot; +#ifdef CONFIG_XMFS_FS_URMA + uint64_t urma_va; + uint64_t urma_eid_subnet_prefix; + uint64_t urma_eid_interface_id; + uint32_t urma_jetty_id; + uint32_t urma_token_id; + char dev_name[100]; +#endif +}; + +#ifdef PER_FS +struct xmfs_sb_index { + unsigned long count; + unsigned long log_start; + unsigned long log_current; + unsigned long data_current; + unsigned long data_count; + unsigned long last_update; + char pad[4048]; +}; + +struct xmfs_log { + unsigned long index; + unsigned long end_index; + unsigned long data_offset; + loff_t size; + unsigned int ops; + umode_t mode; + char name[256]; + unsigned long p_ino; + unsigned long i_ino; + unsigned long offset; + unsigned long version; + unsigned long writer_id; +}; + +struct xmfs_log_trunk { + unsigned long used; + unsigned long next_trunk; + unsigned long version_base; + unsigned long version_max; + char pad[1192]; + struct xmfs_log log[MAX_LOG_PER_TRUNK]; +}; + +#else +struct xmfs_sb_index { + unsigned long magic; + /* High-water mark: next slot index to allocate. */ + unsigned long count; + /* Actual number of used trunks (bitmap != 'u'). */ + unsigned long used_trunk_count; + /* Log of start inode. */ + unsigned long log_start; + /* Log of last inode. */ + unsigned long log_current; + /* Current address of data. */ + unsigned long data_current; + /* Number of 4 KiB data blocks in the current trunk. */ + unsigned long data_count; + /* Timestamp. */ + unsigned long last_update; + /* Filesystem ID. */ + __kernel_fsid_t fsid; + int log_size; + unsigned long len; + int bitmap_size; + char bitmap[]; +}; + +struct xmfs_log { + unsigned long index; + unsigned long end_index; + unsigned long data_offset; + loff_t size; + unsigned int ops; + umode_t mode; + char name[256]; + unsigned long p_ino; + unsigned long i_ino; + unsigned long offset; + unsigned long version; + unsigned long writer_id; +}; /* 336 */ + +struct xmfs_xattr { + unsigned long size; + unsigned long name_size; + char *name; + char value[]; +}; + +#define MAX_LOG (4096 / (sizeof(struct xmfs_log))) + +struct xmfs_log_trunk { + unsigned long used; + unsigned long next_trunk; + unsigned long version_base; + unsigned long version_max; + struct xmfs_log log[]; +}; +#endif + +#define XMLT_INDEX_SIZE (offsetof(struct xmfs_log_trunk, log[0])) + +enum xmfs_urma_ops { + XMFS_URMA_READ, + XMFS_URMA_WRITE, + XMFS_URMA_CAS, + XMFS_URMA_SEND, +}; + +struct xmfs_urma_msg { + enum xmfs_urma_ops ops; + uint64_t offset; + uint64_t len; + void *local_addr; + void *write_buffer; + int wr_cnt; + int slot; + uint64_t cas_cmp_data; + uint64_t cas_swap_data; +}; + +struct xmfs_urma_pool { + void *base; + size_t total_size; + size_t slot_size; + u32 nr_slots; + u32 free_slots; + unsigned long *bitmap; + spinlock_t lock; + wait_queue_head_t waitq; +}; + +struct urma_info { + uint64_t urma_remote_va; + uint64_t urma_send_va; + uint64_t urma_recv_va; + uint64_t urma_eid_subnet_prefix; + uint64_t urma_eid_interface_id; + uint32_t urma_jetty_id; + uint32_t urma_token_id; + uint32_t urma_send_token_id; + uint32_t urma_recv_token_id; +}; + +struct xmfs_grant_wait { + struct completion done; + struct xmfs_rw_msg grant; +}; + +#ifdef CONFIG_XMFS_FS_URMA + +struct xmfs_urma_ctl { + struct ubcore_client ubc_client; + int ubc_index; + struct ubcore_device *ubc_dev; + struct ubcore_jetty *jetty[5]; + struct ubcore_jetty *send_jetty; + struct ubcore_jfc *jfc; + struct ubcore_jfc *send_jfc; + struct ubcore_jfc *recv_jfc; + struct ubcore_jfr *jfr; + struct ubcore_jfr *send_jfr; + struct ubcore_target_seg *local_seg; + struct ubcore_target_seg *send_seg; + struct ubcore_target_seg *recv_seg; + struct ubcore_tjetty *tjetty; + struct ubcore_tjetty *send_tjettys[64]; + struct ubcore_tjetty *tjettys[64]; + struct ubcore_target_seg *remote_seg; + struct xmfs_urma_pool pool; + struct xmfs_urma_pool send_pool; + struct xarray grant_waits; + struct urma_info own_info; + struct urma_info send_info; + void *urma_local_va; + void *recv_buf; + void *send_buf; + uint64_t urma_remote_va; + uint64_t urma_eid_subnet_prefix; + uint64_t urma_eid_interface_id; + uint32_t urma_jetty_id; + uint32_t urma_token_id; + uint64_t last_log_start; + uint64_t last_data_start; +}; + +#define XMFS_URMA_DEFAULT_WR_SIZE 104857600 /* 100 MiB */ +#else +struct xmfs_urma_ctl { + struct xmfs_urma_pool pool; + struct xmfs_urma_pool send_pool; + struct xarray grant_waits; + struct urma_info own_info; + struct urma_info send_info; + int ubc_index; + void *urma_local_va; + uint64_t urma_remote_va; + uint64_t urma_eid_subnet_prefix; + uint64_t urma_eid_interface_id; + uint32_t urma_jetty_id; + uint32_t urma_token_id; + uint64_t last_log_start; + uint64_t last_data_start; +}; +#endif + +struct xmfs_inode_entry { + unsigned long i_ino; + unsigned long p_ino; + umode_t mode; + unsigned int nlink; + loff_t size; + struct timespec64 ctime; + struct timespec64 mtime; + struct timespec64 atime; + char name[256]; +}; + +struct xmfs_inode_table { + unsigned long magic; + unsigned long count; + struct xmfs_inode_entry entries[]; +}; + +struct xmfs_sb_info { + int magic; + int id; + struct super_block *sb; + void *kaddr; + phys_addr_t start; + unsigned long len; + struct task_struct *thread; + struct file *dax_filp; + struct dax_device *dax_dev; + struct bdev_handle *handlep; + unsigned long used_ino; + unsigned long max_chunk; + dev_t dev; + int freq; + int log_size; + bool debug; + bool always_hot; + unsigned long trunk_size; + int mode; + struct xarray pinned_inodes; + char dev_name[100]; + + /* Ratelimit XMFS diagnostics. */ + struct ratelimit_state s_error_ratelimit_state; + struct ratelimit_state s_warning_ratelimit_state; + struct ratelimit_state s_msg_ratelimit_state; + atomic_t s_error_count; + atomic_t s_warning_count; + atomic_t s_msg_count; + + /* host uses */ + spinlock_t space_lock; + struct rw_semaphore chain_rwsem; + spinlock_t version_lock; + struct mutex replay_lock; + bool full; + unsigned long log_current; + unsigned long fallocate_size; + bool during_replay; + struct xmfs_gc_ctl gc_ctl; + struct task_struct *host_worker; + int max_slave_id; + struct task_struct *gc_thread; + unsigned long gc_interval; + int mount_slave; + + /* slave uses */ + int stop_cnt; + unsigned long addr; + unsigned long last_update; + unsigned long log_start; + unsigned long last_replayed_slot; + unsigned long skip_no_ops; + spinlock_t local_ring_lock; + unsigned long rw_request_id; + + /* urma related */ + struct xmfs_urma_ctl urma_cfg; + + struct workqueue_struct *prefetch_wq; + struct workqueue_struct *send_wq; +}; + +static inline struct xmfs_sb_info *XMFS_SB(struct super_block *sb) +{ + return sb->s_fs_info; +} + +void xmfs_init_log_ratelimits(struct xmfs_sb_info *sbi); + +__printf(5, 6) void __xmfs_error(struct super_block *sb, const char *function, + unsigned int line, int error, const char *fmt, + ...); +__printf(5, 6) void __xmfs_error_inode(struct inode *inode, + const char *function, unsigned int line, + int error, const char *fmt, ...); +__printf(5, 6) void __xmfs_error_file(struct file *file, const char *function, + unsigned int line, int error, + const char *fmt, ...); +__printf(4, 5) void __xmfs_warning(struct super_block *sb, const char *function, + unsigned int line, const char *fmt, ...); +__printf(4, 5) void __xmfs_warning_inode(const struct inode *inode, + const char *function, + unsigned int line, const char *fmt, + ...); +__printf(2, 3) void __xmfs_msg(struct super_block *sb, const char *fmt, ...); + +#ifdef CONFIG_PRINTK +#define xmfs_error(sb, fmt, ...) \ + __xmfs_error((sb), __func__, __LINE__, 0, (fmt), ##__VA_ARGS__) +#define xmfs_error_err(sb, err, fmt, ...) \ + __xmfs_error((sb), __func__, __LINE__, (err), (fmt), ##__VA_ARGS__) +#define xmfs_error_inode(inode, fmt, ...) \ + __xmfs_error_inode((inode), __func__, __LINE__, 0, (fmt), ##__VA_ARGS__) +#define xmfs_error_inode_err(inode, err, fmt, ...) \ + __xmfs_error_inode((inode), __func__, __LINE__, (err), (fmt), \ + ##__VA_ARGS__) +#define xmfs_error_file(file, fmt, ...) \ + __xmfs_error_file((file), __func__, __LINE__, 0, (fmt), ##__VA_ARGS__) +#define xmfs_warning(sb, fmt, ...) \ + __xmfs_warning((sb), __func__, __LINE__, (fmt), ##__VA_ARGS__) +#define xmfs_warning_inode(inode, fmt, ...) \ + __xmfs_warning_inode((inode), __func__, __LINE__, (fmt), ##__VA_ARGS__) +#define xmfs_msg(sb, fmt, ...) \ + __xmfs_msg((sb), (fmt), ##__VA_ARGS__) +#else +#define xmfs_error(sb, fmt, ...) no_printk((fmt), ##__VA_ARGS__) +#define xmfs_error_err(sb, err, fmt, ...) no_printk((fmt), ##__VA_ARGS__) +#define xmfs_error_inode(inode, fmt, ...) no_printk((fmt), ##__VA_ARGS__) +#define xmfs_error_inode_err(inode, err, fmt, ...) \ + no_printk((fmt), ##__VA_ARGS__) +#define xmfs_error_file(file, fmt, ...) no_printk((fmt), ##__VA_ARGS__) +#define xmfs_warning(sb, fmt, ...) no_printk((fmt), ##__VA_ARGS__) +#define xmfs_warning_inode(inode, fmt, ...) no_printk((fmt), ##__VA_ARGS__) +#define xmfs_msg(sb, fmt, ...) no_printk((fmt), ##__VA_ARGS__) +#endif + +#define xmfs_info(sb, fmt, ...) xmfs_msg((sb), KERN_INFO fmt, ##__VA_ARGS__) + +struct mount_msg_info { + atomic_t id; + atomic_t host_mount; + /* 'D' for done, 'C' for unmount, 'T' for during mount. */ + char msg[256]; + /* Each slave writes its last_update here. */ + unsigned long slave_versions[64]; + struct urma_info urma_infos[64]; + struct urma_info send_infos[64]; +}; + +struct page_freq { + atomic_t read_count; + bool in_cache; + bool never_in_cache; + bool already_in_cache; +}; + +struct xmfs_cache_work { + struct work_struct work; + struct inode *inode; + pgoff_t index; + pgoff_t end_index; +}; + +struct xmfs_write_work { + struct work_struct work; + struct inode *inode; + pgoff_t index; + pgoff_t end_index; + size_t size; +}; + +struct xmfs_send_work { + struct work_struct work; + struct xmfs_rw_msg grant; + struct xmfs_sb_info *sbi; +}; + +struct xmfs_inode_info { + unsigned long i_ino; + struct inode vfs_inode; + /* Inode log start address. */ + unsigned long log_start; + /* Log trunk where the last replay ends. */ + unsigned long log_replay; + /* Symlink name address. */ + unsigned long symname; + struct xarray shared_pages; + struct simple_xattrs xattrs; + struct timespec64 btime; +#ifdef CONFIG_XMFS_FS_URMA + struct ubcore_jfs_wr *wr; + void *write_buffer; + int wr_cnt; + int *slots; +#endif + struct xarray page_freq; + unsigned long start_write; + unsigned long second_write; + unsigned long second_write_count; + unsigned long count; + unsigned long data_start; + unsigned long data_size; + bool leaf; + bool tmp; + bool die; + bool fallocate; + bool pinned; + unsigned long inode_table_slot; + struct workqueue_struct *write_wq; +}; + +struct xmfs_read_extent { + pgoff_t start_index; + unsigned long start_offset; + unsigned int nr_pages; +}; + +struct host_mount_args { + struct xmfs_sb_info *sbi; + int id; +}; + +void xmfs_init_file_inode(struct inode *inode); +void xmfs_init_file_mapping(struct inode *inode); +void xmfs_init_dir_inode(struct inode *inode, bool host); +void xmfs_init_dir_file(struct inode *inode); +void xmfs_init_dentry_operations(struct super_block *sb); +void xmfs_init_symlink_mapping(struct inode *inode); +void xmfs_init_symlink_operations(struct inode *inode); +void xmfs_init_special_inode_operations(struct inode *inode); +int xmfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + struct iattr *attr); +int xmfs_getattr(struct mnt_idmap *idmap, const struct path *path, + struct kstat *stat, u32 request_mask, unsigned int flags); +int xmfs_slave_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + struct iattr *attr); +int xmfs_slave_getattr(struct mnt_idmap *idmap, const struct path *path, + struct kstat *stat, u32 request_mask, + unsigned int flags); +int xmfs_update_time(struct inode *inode, int flags); +struct inode *xmfs_get_root(struct super_block *sb, int host_id); +int xmfs_send_req_wait_reply(struct xmfs_sb_info *sbi, int type); +void arch_invalidate_pmem(void *addr, size_t size); +void xmfs_mark_page_dead(struct xmfs_sb_info *sbi, unsigned long data_offset); +void xmfs_mark_page_live(struct xmfs_sb_info *sbi, unsigned long data_offset); + +struct xmfs_data_reserve_result { + unsigned long data_addr; + unsigned long data_page_count; + unsigned long second_data_addr; + unsigned long second_data_pages; + unsigned long trunk_addrs[4]; + int trunk_count; +}; + +unsigned long xmfs_add_log_v3(struct xmfs_log *xm_log, struct xmfs_sb_info *sbi, + size_t namelen, unsigned long ino, + bool update_version); +long xmfs_find_free_slot(struct xmfs_sb_index *xmsi, struct xmfs_sb_info *sbi); +long xmfs_alloc_and_mark_slot(struct xmfs_sb_index *xmsi, + struct xmfs_sb_info *sbi, char type); +int xmfs_gc_thread_fn(void *data); +int xmfs_gc_thread_slave_fn(void *data); +int xmfs_quiesce_wait(struct xmfs_sb_info *sbi); +int xmfs_host_worker_fn(void *data); +void xmfs_host_process_ring(struct xmfs_sb_info *sbi); +int xmfs_slave_request_write(struct xmfs_sb_info *sbi, struct xmfs_rw_msg *req); +int xmfs_slave_wait_grant(struct xmfs_sb_info *sbi, struct xmfs_rw_msg *grant, + unsigned long grant_slot, unsigned long request_id); +void xmfs_slave_send_complete(struct xmfs_sb_info *sbi, + unsigned long request_id, loff_t comp_size, + struct xmfs_rw_msg *orig_req, + struct xmfs_rw_msg *grant); +int xmfs_pmem_write(struct xmfs_sb_info *sbi, unsigned long offset, + const void *buf, unsigned long size); +int xmfs_pmem_write_multi_pages(struct xmfs_sb_info *sbi, unsigned long offset, + struct page **pages, unsigned long page_num); +int xmfs_pmem_read_multi_pages(struct xmfs_sb_info *sbi, unsigned long *offsets, + struct page **pages, unsigned long page_num); +int xmfs_pmem_read(struct xmfs_sb_info *sbi, unsigned long offset, void *buf, + unsigned long size); +int xmfs_pmem_cas(struct xmfs_sb_info *sbi, unsigned long offset, + uint64_t old_val, uint64_t new_val); +int xmfs_import_jetty(struct xmfs_sb_info *sbi, struct urma_info info, + int index, bool is_send); +int xmfs_send_request(struct xmfs_sb_info *sbi, struct xmfs_rw_msg *req, + struct xmfs_grant_wait *gw, int id); +#ifdef CONFIG_XMFS_FS_URMA +int xmfs_urma_send_write_pages(struct xmfs_sb_info *sbi, + struct ubcore_jfs_wr *wr); +#endif +void *urma_pool_acquire_nslots(struct xmfs_urma_pool *pool, int nr, u32 *slots); +void urma_pool_release_nslots(struct xmfs_urma_pool *pool, int nr, + const u32 *slots); +int xmfs_urma_read_ubuf(struct xmfs_sb_info *sbi, void __user *buf, + struct xmfs_read_extent *exts, int ext_cnt, + size_t size); +void xmfs_prefetch_worker(struct work_struct *work); + +static inline int xmfs_data_write(struct xmfs_sb_info *sbi, + unsigned long offset, const void *buf, + unsigned long size) +{ + if (sbi->mode != XMFS_URMA_MODE) { + memcpy(sbi->kaddr + offset, buf, size); + return 0; + } + return xmfs_pmem_write(sbi, offset, buf, size); +} + +static inline int xmfs_data_read(struct xmfs_sb_info *sbi, unsigned long offset, + void *buf, unsigned long size) +{ + if (sbi->mode != XMFS_URMA_MODE) { + memcpy(buf, sbi->kaddr + offset, size); + return 0; + } + return xmfs_pmem_read(sbi, offset, buf, size); +} + +int xmfs_gc_main(struct xmfs_sb_info *sbi); +int xmfs_inode_eq(struct inode *inode, void *_ino); +int xmfs_inode_set(struct inode *inode, void *_ino); +unsigned int xmfs_inode_table_sync_nlink(struct xmfs_inode_table *tbl, + unsigned long ino); +bool xmfs_inode_table_remove(struct xmfs_inode_table *tbl, unsigned long ino, + unsigned long p_ino, const char *name); +void xmfs_replay_plays_gc(struct xmfs_sb_info *sbi); +void xmfs_clear_inode_bits(struct xmfs_sb_info *sbi, unsigned long ino); +ssize_t xmfs_listxattr(struct dentry *dentry, char *buffer, size_t size); +int xmfs_initxattrs(struct inode *inode, const struct xattr *xattr_array, + void *fs_info); +int xmfs_replay_new_entries(struct xmfs_sb_info *sbi, struct dentry *dentry, + unsigned long last_update); +void xmfs_populate_from_inode_table(struct xmfs_sb_info *sbi); +ssize_t xmfs_simple_xattr_list(struct inode *inode, + struct simple_xattrs *xattrs, char *buffer, + size_t size); +int xmfs_xattr_list_one(char **buffer, ssize_t *remaining_size, + const char *name); +int xmfs_simple_xattr_get(struct simple_xattrs *xattrs, const char *name, + void *buffer, size_t size); +struct simple_xattr *xmfs_simple_xattr_set(struct simple_xattrs *xattrs, + const char *name, const void *value, + size_t size, int flags); +struct simple_xattr *xmfs_simple_xattr_alloc(const void *value, size_t size); +void xmfs_simple_xattrs_init(struct simple_xattrs *xattrs); +void xmfs_simple_xattrs_free(struct simple_xattrs *xattrs, size_t *freed_space); +size_t xmfs_simple_xattr_space(const char *name, size_t size); +void xmfs_simple_xattr_free(struct simple_xattr *xattr); +long xmfs_common_fallocate(struct inode *inode, int mode, loff_t offset, + loff_t len); +int xmfs_urma_register(struct xmfs_sb_info *sbi, struct xmfs_fs_context *ctx); +void xmfs_urma_unregister(struct xmfs_sb_info *sbi); +int xmfs_urma_import(struct xmfs_sb_info *sbi); +void xmfs_urma_unimport(struct xmfs_sb_info *sbi); +int xmfs_urma_send(struct xmfs_sb_info *sbi, struct xmfs_urma_msg *msg); +void xmfs_host_handle_urma_request(struct xmfs_sb_info *sbi, int slave_i, + struct xmfs_rw_msg *req, + struct xmfs_rw_msg *grant); +#ifdef CONFIG_XMFS_FS_URMA +int xmfs_urma_fill_write_page(struct xmfs_sb_info *sbi, + struct ubcore_jfs_wr *wr, + struct xmfs_urma_msg *msg, int slot); +#endif +int xmfs_urma_write_ubuf(struct xmfs_sb_info *sbi, void __user *buf, + size_t size, unsigned long offset); + +static inline struct xmfs_inode_info *XMFS_I(struct inode *inode) +{ + return container_of(inode, struct xmfs_inode_info, vfs_inode); +} + +static inline int local_update_log_and_data(struct xmfs_sb_info *sbi, + unsigned long offset, + unsigned long size) +{ + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: + return 0; + case XMFS_URMA_MODE: + return xmfs_pmem_read(sbi, offset, sbi->urma_cfg.urma_local_va, + size); + default: + return -EINVAL; + } +} + +static inline int get_meta_and_copy(struct xmfs_sb_info *sbi, + unsigned long offset, void *addr, + unsigned long size, void *local_addr, + unsigned long local_offset) +{ + int err; + struct xmfs_urma_msg msg; + + if (addr == NULL) + return -EINVAL; + if (offset > sbi->len - 2097152) + return -EINVAL; + + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: + return copy_mc_to_kernel(addr, sbi->kaddr + offset, size); + case XMFS_URMA_MODE: + if (!local_addr) { + msg.ops = XMFS_URMA_READ; + msg.offset = offset; + msg.len = size; + msg.local_addr = addr; + err = xmfs_urma_send(sbi, &msg); + return err; + } else { + return copy_mc_to_kernel(addr, + local_addr + offset - + local_offset, + size); + } + default: + return -EINVAL; + } +} + +static inline int get_data_and_copy(struct xmfs_sb_info *sbi, + unsigned long offset, void *addr, + unsigned long size, void *local_addr, + unsigned long local_offset) +{ + int err; + struct xmfs_urma_msg msg; + + if (addr == NULL) + return -EINVAL; + if (offset > sbi->len - 2097152) + return -EINVAL; + + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + return copy_mc_to_kernel(addr, sbi->kaddr + offset, size); + case XMFS_URMA_MODE: + case XMFS_HYBRID_MODE: + if (!local_addr) { + msg.ops = XMFS_URMA_READ; + msg.offset = offset; + msg.len = size; + msg.local_addr = addr; + err = xmfs_urma_send(sbi, &msg); + return err; + } else { + return copy_mc_to_kernel(addr, + local_addr + offset - + local_offset, + size); + } + default: + return -EINVAL; + } +} + +static inline void *get_meta(struct xmfs_sb_info *sbi, unsigned long offset, + unsigned long size) +{ + struct xmfs_urma_msg msg; + int err = 0; + void *local_addr; + + if (offset > sbi->len - 2097152) + return NULL; + + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: + return sbi->kaddr + offset; + case XMFS_URMA_MODE: + local_addr = vmalloc(size); + if (!local_addr) + return local_addr; + msg.ops = XMFS_URMA_READ; + msg.offset = offset; + msg.len = size; + msg.local_addr = local_addr; + err = xmfs_urma_send(sbi, &msg); + if (err) { + xmfs_info(sbi->sb, "get meta err out %d", err); + vfree(local_addr); + local_addr = NULL; + } + return local_addr; + default: + return NULL; + } +} + +static inline void put_meta(struct xmfs_sb_info *sbi, void *local_addr) +{ + if (sbi->mode == XMFS_URMA_MODE) + vfree(local_addr); +} + +static inline void *get_data(struct xmfs_sb_info *sbi, unsigned long offset, + unsigned long size) +{ + struct xmfs_urma_msg msg; + int err = 0; + void *local_addr; + + if (offset > sbi->len - 2097152) + return NULL; + + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + return sbi->kaddr + offset; + case XMFS_URMA_MODE: + case XMFS_HYBRID_MODE: + local_addr = vmalloc(size); + if (!local_addr) + return local_addr; + msg.ops = XMFS_URMA_READ; + msg.offset = offset; + msg.len = size; + msg.local_addr = local_addr; + err = xmfs_urma_send(sbi, &msg); + if (err) { + vfree(local_addr); + local_addr = NULL; + } + return local_addr; + default: + return NULL; + } +} + +static inline void put_data(struct xmfs_sb_info *sbi, void *local_addr) +{ + if (sbi->mode == XMFS_URMA_MODE || sbi->mode == XMFS_HYBRID_MODE) + vfree(local_addr); +} + +static inline struct xmfs_sb_index *get_xmsi(struct xmfs_sb_info *sbi) +{ + return (struct xmfs_sb_index *)get_meta(sbi, SB_OFFSET, + sizeof(struct xmfs_sb_index)); +} + +static inline void put_xmsi(struct xmfs_sb_info *sbi, void *local_buf) +{ + put_meta(sbi, local_buf); +} + +static inline int get_xmsi_and_copy(struct xmfs_sb_info *sbi, + struct xmfs_sb_index *xmsi) +{ + return get_meta_and_copy(sbi, SB_OFFSET, xmsi, + sizeof(struct xmfs_sb_index), NULL, 0); +} + +static inline struct xmfs_log *get_log(struct xmfs_sb_info *sbi, + unsigned long offset) +{ + return (struct xmfs_log *)get_meta(sbi, offset, + sizeof(struct xmfs_log)); +} + +static inline void put_log(struct xmfs_sb_info *sbi, void *local_buf) +{ + put_meta(sbi, local_buf); +} + +static inline int get_log_and_copy(struct xmfs_sb_info *sbi, + unsigned long offset, struct xmfs_log *log) +{ + return get_meta_and_copy(sbi, offset, log, sizeof(struct xmfs_log), + NULL, 0); +} + +static inline struct xmfs_log_trunk *get_log_trunk(struct xmfs_sb_info *sbi, + unsigned long offset) +{ + return (struct xmfs_log_trunk *)get_meta(sbi, offset, 2097152); +} + +static inline struct xmfs_log_trunk * +get_log_trunk_meta(struct xmfs_sb_info *sbi, unsigned long offset) +{ + return (struct xmfs_log_trunk *)get_meta(sbi, offset, + sizeof(struct xmfs_log_trunk)); +} + +static inline struct xmfs_log_trunk * +get_log_trunk_data(struct xmfs_sb_info *sbi, unsigned long offset, + unsigned long idx) +{ + return (struct xmfs_log_trunk *)get_meta(sbi, offset, + sizeof(struct xmfs_log_trunk) + + idx * sizeof(struct xmfs_log)); +} + +static inline void put_log_trunk(struct xmfs_sb_info *sbi, void *local_buf) +{ + put_meta(sbi, local_buf); +} + +static inline int get_log_trunk_and_copy(struct xmfs_sb_info *sbi, + unsigned long offset, + struct xmfs_log_trunk *xmlt, + bool get_full_trunk) +{ + if (get_full_trunk) + return get_meta_and_copy(sbi, offset, xmlt, sbi->trunk_size, + NULL, 0); + return get_meta_and_copy(sbi, offset, xmlt, + sizeof(struct xmfs_log_trunk), NULL, 0); +} + +static inline struct mount_msg_info *get_mnt_msg(struct xmfs_sb_info *sbi) +{ + return (struct mount_msg_info *)get_meta(sbi, MOUNT_MSG_OFFSET, + sizeof(struct mount_msg_info)); +} + +static inline void put_mnt_msg(struct xmfs_sb_info *sbi, void *local_buf) +{ + put_meta(sbi, local_buf); +} + +static inline int get_mnt_msg_and_copy(struct xmfs_sb_info *sbi, + struct mount_msg_info *mm_info) +{ + return get_meta_and_copy(sbi, MOUNT_MSG_OFFSET, mm_info, + sizeof(struct mount_msg_info), NULL, 0); +} + +static inline int mnt_msg_write(struct xmfs_sb_info *sbi, int id, char c) +{ + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: { + struct mount_msg_info *mm_info = sbi->kaddr + MOUNT_MSG_OFFSET; + + return mm_info->msg[id] = c; + } + case XMFS_URMA_MODE: + return xmfs_pmem_write(sbi, + MOUNT_MSG_OFFSET + + offsetof(struct mount_msg_info, + msg) + + id, + &c, 1) ? + -1 : + c; + default: + return -1; + } +} + +static inline int xmfs_cas(struct xmfs_sb_info *sbi, int old, int new) +{ + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: { + struct mount_msg_info *mm_info = sbi->kaddr + MOUNT_MSG_OFFSET; + + return atomic_cmpxchg(&mm_info->id, old, new); + } + case XMFS_URMA_MODE: { + int ret = xmfs_pmem_cas(sbi, + MOUNT_MSG_OFFSET + + offsetof(struct mount_msg_info, + id), + (uint64_t)old, (uint64_t)new); + + return (ret == 0) ? old : 0; + } + default: + return 0; + } +} + +static inline int xmfs_atomic_read(struct xmfs_sb_info *sbi, + struct mount_msg_info *mm_info) +{ + return atomic_read(&mm_info->id); +} + +#endif diff --git a/fs/xmfs/dir.c b/fs/xmfs/dir.c new file mode 100644 index 000000000000..eb6f23d48e67 --- /dev/null +++ b/fs/xmfs/dir.c @@ -0,0 +1,160 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * XMFS: Log Structured Filesystem for UB + * Copyright (C) 2024. Huawei Technologies Co., Ltd + * + * This program can be distributed under the terms of the GNU GPL. + * See the file COPYING. + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include "xmfs_i.h" + +#include <linux/file.h> +#include <linux/kernel.h> +#include <linux/slab.h> + +static int xmfs_revalidate(struct dentry *dentry, unsigned int flags) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dentry->d_sb); + struct xmfs_sb_index *xmsi = kmalloc(sizeof(*xmsi), GFP_ATOMIC); + int err = get_xmsi_and_copy(sbi, xmsi); + + if (unlikely(err)) { + xmfs_error(sbi->sb, + "hardware memory error when reading superblock during revalidate"); + kfree(xmsi); + return err; + } + /* + * xmfs_info(sbi->sb, "qyf revalidate %ld %ld", + * xmsi->last_update, sbi->last_update); + */ + if (xmsi->last_update != sbi->last_update) { + kfree(xmsi); + return 0; + } + kfree(xmsi); + return 1; +} + +static const struct dentry_operations xmfs_dentry_operations = { + .d_delete = always_delete_dentry, + .d_revalidate = xmfs_revalidate, +}; + +static int xmfs_iterate(struct file *file, struct dir_context *ctx) +{ + struct xmfs_sb_info *sbi = XMFS_SB(file->f_inode->i_sb); + struct inode *dir = file->f_inode; + struct xmfs_inode_table *tbl; + unsigned long max_entries, i __maybe_unused; + + if (!dir_emit_dots(file, ctx)) + return 0; + + { + struct xmfs_sb_index *xmsi = kmalloc(sizeof(*xmsi), GFP_KERNEL); + + if (xmsi) { + int err = get_xmsi_and_copy(sbi, xmsi); + + if (!err && xmsi->last_update != sbi->last_update) + xmfs_replay_new_entries(sbi, NULL, + xmsi->last_update); + kfree(xmsi); + } + } + + if (sbi->mode == XMFS_SHARED_MEM_MODE || sbi->mode == XMFS_HYBRID_MODE) + tbl = (struct xmfs_inode_table *)(sbi->kaddr + + INODE_TABLE_OFFSET); + else { + tbl = (struct xmfs_inode_table *)get_meta(sbi, + INODE_TABLE_OFFSET, + INODE_TABLE_SIZE); + /* + * tbl = (struct xmfs_inode_table *)get_meta( + * sbi, INODE_TABLE_OFFSET, + * max(sizeof(struct xmfs_inode_table) + + * tbl->count * sizeof(struct xmfs_inode_entry), + * INODE_TABLE_SIZE)); + */ + } + + if (!tbl || tbl->magic != XMFS_INODE_TABLE_MAGIC) { + if (tbl && sbi->mode == XMFS_URMA_MODE) + put_meta(sbi, tbl); + return 0; + } + /* xmfs_info(sbi->sb, "qyf iterate %d %d", tbl->count, ctx->pos); */ + /* + * for (i = 0; i < tbl->count; i++) { + * struct xmfs_inode_entry *e = &tbl->entries[i]; + * + * xmfs_info(sbi->sb, + * "tbl id %d ino %d pino %d name %s size %d", + * i, e->i_ino, e->p_ino, e->name, e->size); + * } + */ + if (ctx->pos - 2 >= tbl->count) + return 0; + max_entries = + (INODE_TABLE_SIZE - 4096) / sizeof(struct xmfs_inode_entry); + for (; ctx->pos - 2 < tbl->count && ctx->pos - 2 < max_entries; + ctx->pos++) { + struct xmfs_inode_entry *e = &tbl->entries[ctx->pos - 2]; + unsigned char d_type; + /* + * xmfs_info(sbi->sb, + * "qyf iterate iter %d %d name: %s size %ld", + * e->i_ino, e->p_ino, e->name, e->size); + */ + if (e->i_ino == 0 || e->p_ino != dir->i_ino) + continue; + + if (S_ISREG(e->mode)) + d_type = DT_REG; + else if (S_ISDIR(e->mode)) + d_type = DT_DIR; + else if (S_ISLNK(e->mode)) + d_type = DT_LNK; + else if (S_ISCHR(e->mode)) + d_type = DT_CHR; + else if (S_ISBLK(e->mode)) + d_type = DT_BLK; + else if (S_ISFIFO(e->mode)) + d_type = DT_FIFO; + else if (S_ISSOCK(e->mode)) + d_type = DT_SOCK; + else + d_type = DT_UNKNOWN; + + if (!dir_emit(ctx, e->name, strlen(e->name), e->i_ino, d_type)) + break; + } + + if (sbi->mode == XMFS_URMA_MODE) + put_meta(sbi, tbl); + return 0; +} + +static const struct file_operations xmfs_dir_operations = { + .iterate_shared = xmfs_iterate, + .open = dcache_dir_open, + .release = dcache_dir_close, + .llseek = dcache_dir_lseek, + .read = generic_read_dir, + .fsync = noop_fsync, +}; + +void xmfs_init_dir_file(struct inode *inode) +{ + inode->i_fop = &xmfs_dir_operations; +} + +void xmfs_init_dentry_operations(struct super_block *sb) +{ + sb->s_d_op = &xmfs_dentry_operations; +} diff --git a/fs/xmfs/file.c b/fs/xmfs/file.c new file mode 100644 index 000000000000..ef45c2b31f47 --- /dev/null +++ b/fs/xmfs/file.c @@ -0,0 +1,2261 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * XMFS: Log Structured Filesystem for UB + * Copyright (C) 2024. Huawei Technologies Co., Ltd + * + * This program can be distributed under the terms of the GNU GPL. + * See the file COPYING. + */ + +#include "xmfs_i.h" + +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/swap.h> +#include <linux/uio.h> +#include <linux/file.h> +#include <linux/seq_file.h> +#include <linux/pagemap.h> +#include <linux/fadvise.h> +#include <linux/splice.h> +#include <linux/falloc.h> + +#ifdef CONFIG_XMFS_FS_URMA +static ssize_t xmfs_file_write_iter_slave(struct kiocb *iocb, + struct iov_iter *from); +static ssize_t xmfs_file_write_ubuf_slave(struct kiocb *iocb, + struct iov_iter *from); +#else +static ssize_t xmfs_file_write_iter_slave(struct kiocb *iocb, + struct iov_iter *from) +{ + return -EOPNOTSUPP; +} +#endif +static ssize_t xmfs_file_read_ubuf_slave(struct kiocb *iocb, + struct iov_iter *to); +static int xmfs_read_page(struct file *file, struct page *page) +{ + struct inode *inode = page->mapping->host; + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + unsigned long mapped_offset = + (unsigned long)xa_load(&xmfs_inode->shared_pages, page->index); + void *kaddr = kmap_local_page(page); + + if (mapped_offset) { + memcpy(kaddr, get_data(sbi, mapped_offset, PAGE_SIZE), + PAGE_SIZE); + } + kunmap_local(kaddr); + + return 0; +} + +#ifdef CONFIG_XMFS_FS_URMA +static void xmfs_write_worker(struct work_struct *work) +{ + struct xmfs_write_work *ww = + container_of(work, struct xmfs_write_work, work); + struct inode *inode = ww->inode; + struct address_space *mapping = inode->i_mapping; + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct page *page; + struct folio *folio; + struct xmfs_rw_msg grant = {}; + struct xmfs_rw_msg req = {}; + unsigned long end_index = ww->end_index; + unsigned long start_index = ww->index; + unsigned long page_num = end_index - start_index; + struct ubcore_jfs_wr *wrs; + int *slots; + void *write_buffer; + int wr_cnt = 0; + unsigned long mapped_offset; + struct xmfs_urma_msg msg = {}; + char *addr; + struct ubcore_jfs_wr *wr; + int err; + unsigned long log_base; + /* + * xmfs_info(sbi->sb, "qyf write work %d %d %d", start_index, + * end_index, ww->size); + */ + + req.ops = XMFS_UPDATE; + req.i_ino = inode->i_ino; + req.data_pages = page_num; + req.log_entries = 1; + req.size = ww->size; + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + + struct xmfs_grant_wait gw; + + init_completion(&gw.done); + xa_store(&sbi->urma_cfg.grant_waits, req.request_id, &gw, GFP_KERNEL); + if (xmfs_quiesce_wait(sbi)) + return; + err = xmfs_send_request(sbi, &req, &gw, 0); + if (err) { + iput(inode); + return; + } + grant = gw.grant; + log_base = + grant.log_trunk_addr + offsetof(struct xmfs_log_trunk, log[0]); + /* + * xmfs_info(sbi->sb, "grant %d %d %d %d %d", + * grant.log_slot_count, grant.data_addr, + * grant.data_page_count, grant.second_data_addr, + * grant.log_slot_start); + */ + wrs = vzalloc(page_num * sizeof(struct ubcore_jfs_wr)); + if (!wrs) { + iput(inode); + return; + } + slots = vzalloc(sizeof(int) * page_num); + if (!slots) { + vfree(wrs); + iput(inode); + return; + } + + write_buffer = + urma_pool_acquire_nslots(&sbi->urma_cfg.pool, page_num, slots); + if (!write_buffer) { + vfree(wrs); + vfree(slots); + iput(inode); + return; + } + + unsigned long start_write = grant.data_addr; + unsigned long count = grant.data_page_count; + unsigned long second_write = grant.second_data_addr; + + for (int i = start_index; i < end_index; i++) { + if (count > 0) { + mapped_offset = start_write; + count--; + start_write += PAGE_SIZE; + if (start_write % XMFS_DEFAULT_CHUNK_SIZE == 0) + start_write += PAGE_SIZE; + } else if (second_write != 0) { + mapped_offset = second_write; + second_write += PAGE_SIZE; + if (second_write % XMFS_DEFAULT_CHUNK_SIZE == 0) + second_write += PAGE_SIZE; + } + + folio = filemap_get_folio(mapping, i); + if (IS_ERR(folio)) { + xmfs_warning(sbi->sb, "write work cannot get folio %d", + i); + continue; + } + xa_store(&(XMFS_I(inode)->shared_pages), i, + (void *)mapped_offset, GFP_KERNEL); + page = folio_page(folio, 0); + addr = kmap_local_page(page); + msg.ops = XMFS_URMA_WRITE; + msg.offset = mapped_offset; + msg.len = PAGE_SIZE; + msg.write_buffer = write_buffer + wr_cnt * PAGE_SIZE; + msg.local_addr = addr; + wr = &wrs[wr_cnt]; + err = xmfs_urma_fill_write_page(sbi, wr, &msg, slots[wr_cnt]); + if (err) { + xmfs_info(sbi->sb, + "write work fill write page failed %d folio", + i); + kunmap_local(addr); + folio_put(folio); + continue; + } + if (wr_cnt > 0) + wrs[wr_cnt - 1].next = wr; + wr_cnt++; + kunmap_local(addr); + folio_put(folio); + } + + if (wr_cnt > 0) { + wrs[wr_cnt - 1].next = NULL; + xmfs_urma_send_write_pages(sbi, wrs); + } + + urma_pool_release_nslots(&sbi->urma_cfg.pool, page_num, slots); + vfree(slots); + + for (int s = 0; s < grant.log_slot_count; s++) { + struct xmfs_log xm_log = {}; + + xm_log.ops = XMFS_UPDATE; + xm_log.i_ino = inode->i_ino; + xm_log.version = grant.version + s; + xm_log.writer_id = sbi->id; + if (s == 0) { + xm_log.index = start_index; + xm_log.end_index = start_index + grant.data_page_count; + xm_log.data_offset = grant.data_addr; + xm_log.size = grant.size; + } else { + xm_log.index = start_index + grant.data_page_count; + xm_log.end_index = end_index; + xm_log.data_offset = grant.second_data_addr; + xm_log.size = grant.size; + } + + xmfs_data_write(sbi, + log_base + (grant.log_slot_start + s) * + sizeof(struct xmfs_log), + &xm_log, sizeof(xm_log)); + /* + * xmfs_info(sbi->sb, "write work log %ld %ld %ld", + * log_base + (grant.log_slot_start + s) * + * sizeof(struct xmfs_log), + * xm_log.index, xm_log.end_index); + */ + } + iput(inode); + kfree(ww); +} +#endif + +void xmfs_prefetch_worker(struct work_struct *work) +{ + struct xmfs_cache_work *cw = + container_of(work, struct xmfs_cache_work, work); + struct inode *inode = cw->inode; + struct address_space *mapping = inode->i_mapping; + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct folio *folio; + unsigned long *offsets; + struct page **pages; + unsigned long mapped_offset; + int i; + int count = 0; + + offsets = + kzalloc((cw->end_index - cw->index + 1) * sizeof(unsigned long), + GFP_KERNEL); + if (!offsets) + return; + + pages = kzalloc((cw->end_index - cw->index + 1) * sizeof(struct page *), + GFP_KERNEL); + if (!pages) { + kfree(offsets); + return; + } + + for (i = cw->index; i < cw->end_index; i++) { + mapped_offset = + (unsigned long)xa_load(&XMFS_I(inode)->shared_pages, i); + if (!mapped_offset) + continue; + + folio = filemap_grab_folio(mapping, i); + + if (IS_ERR(folio)) + break; + + offsets[count] = mapped_offset; + pages[count] = &folio->page; + count++; + } + + if (count > 0) { + /* + * xmfs_info(sbi->sb, "qyf backgrount cp page %ld to %ld", + * cw->index, cw->end_index); + */ + xmfs_pmem_read_multi_pages(sbi, offsets, pages, count); + for (i = 0; i < count; i++) { + folio = page_folio(pages[i]); + + folio_mark_uptodate(folio); + folio_mark_dirty(folio); + folio_unlock(folio); + folio_put(folio); + } + } + kfree(offsets); + kfree(pages); + + kfree(cw); +} + +static int xmfs_write_begin(struct file *filp, struct address_space *mapping, + loff_t pos, unsigned int len, struct page **pagep, + void **fsdata) +{ + struct inode *inode = mapping->host; + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + int err = simple_write_begin(filp, mapping, pos, len, pagep, fsdata); + + if (err || sbi->id != 0 || sbi->during_replay || PageUptodate(*pagep) || + len == PAGE_SIZE) + return err; + return xmfs_read_page(filp, *pagep); +} + +unsigned long xmfs_get_data_offset_nolock(struct inode *inode, + struct xmfs_sb_info *sbi, + struct page *page) +{ + char *kaddr; + + if (XMFS_I(inode)->count > 0) { + unsigned long ret_addr; + + if (sbi->id == 0) { + kaddr = kmap_local_page(page); + xmfs_data_write(sbi, XMFS_I(inode)->start_write, kaddr, + PAGE_SIZE); + kunmap_local(kaddr); + } + ret_addr = XMFS_I(inode)->start_write; + XMFS_I(inode)->count--; + XMFS_I(inode)->start_write += PAGE_SIZE; + if (XMFS_I(inode)->start_write % XMFS_DEFAULT_CHUNK_SIZE == 0) + XMFS_I(inode)->start_write += PAGE_SIZE; + return ret_addr; + } else if (XMFS_I(inode)->second_write != 0) { + unsigned long ret_addr; + + if (sbi->id == 0) { + kaddr = kmap_local_page(page); + xmfs_data_write(sbi, XMFS_I(inode)->second_write, kaddr, + PAGE_SIZE); + kunmap_local(kaddr); + } + ret_addr = XMFS_I(inode)->second_write; + XMFS_I(inode)->second_write += PAGE_SIZE; + if (XMFS_I(inode)->second_write % XMFS_DEFAULT_CHUNK_SIZE == 0) + XMFS_I(inode)->second_write += PAGE_SIZE; + return ret_addr; + } + /* + * xmfs_error(inode->i_sb, + * "no reserved space for inode %ld", inode->i_ino); + */ + return 0; +} + +unsigned long xmfs_get_data_offset_fallocate(struct inode *inode, + struct xmfs_sb_info *sbi, + struct page *page) +{ + unsigned long index = page->index; + unsigned long data_start = XMFS_I(inode)->data_start; + unsigned long len = XMFS_I(inode)->data_size; + + if (index * PAGE_SIZE >= len) { + xmfs_error(sbi->sb, + "Not support write more than fallocate size now"); + return -1; + } + + char *kaddr = kmap_local_page(page); + + xmfs_data_write(sbi, data_start + index * PAGE_SIZE, kaddr, PAGE_SIZE); + kunmap_local(kaddr); + + return data_start + index * PAGE_SIZE; +} + +static int xmfs_write_end(struct file *file, struct address_space *mapping, + loff_t pos, unsigned int len, unsigned int copied, + struct page *page, void *fsdata) +{ + struct folio *folio = page_folio(page); + struct inode *inode = folio->mapping->host; + loff_t last_pos = pos + copied; + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + if (!folio_test_uptodate(folio)) { + /* zero the stale part of the folio if we did a short copy */ + if (copied < len) { + size_t from = offset_in_folio(folio, pos); + + folio_zero_range(folio, from + copied, len - copied); + } + folio_mark_uptodate(folio); + } + folio_mark_dirty(folio); + + if (i_size_read(inode) < last_pos) + i_size_write(inode, last_pos); + + unsigned long offset; + + if (XMFS_I(inode)->fallocate) + offset = xmfs_get_data_offset_fallocate(inode, sbi, page); + else + offset = xmfs_get_data_offset_nolock(inode, sbi, page); + if (offset == 0) { + folio_unlock(folio); + folio_put(folio); + return copied; + } else if (offset < 0) { + folio_unlock(folio); + folio_put(folio); + return offset; + } + /* + * xmfs_info(sbi->sb, "write end index %d offset %ld", + * page->index, offset); + */ + /* + * if (sbi->id != 0) { + * folio_mark_dirty(folio); + * struct xmfs_urma_msg msg = {}; + * char *addr = kmap_local_page(page); + * struct ubcore_jfs_wr *wr; + * + * msg.ops = XMFS_URMA_WRITE; + * msg.offset = offset; + * msg.len = PAGE_SIZE; + * msg.write_buffer = XMFS_I(inode)->write_buffer + + * XMFS_I(inode)->wr_cnt * PAGE_SIZE; + * msg.local_addr = addr; + * wr = &XMFS_I(inode)->wr[XMFS_I(inode)->wr_cnt]; + * xmfs_urma_fill_write_page( + * sbi, wr, &msg, + * XMFS_I(inode)->slots[XMFS_I(inode)->wr_cnt]); + * if (XMFS_I(inode)->wr_cnt > 0) + * XMFS_I(inode)->wr[XMFS_I(inode)->wr_cnt - 1].next = wr; + * XMFS_I(inode)->wr_cnt++; + * kunmap_local(addr); + * } + */ + + void *old_ret = xa_store(&(XMFS_I(inode)->shared_pages), folio->index, + (void *)offset, GFP_KERNEL); + if (xa_err(old_ret)) { + xmfs_error(sbi->sb, "cannot store shared pages for page %ld", + folio->index); + } + if (sbi->id == 0) { + xmfs_mark_page_dead(sbi, (unsigned long)old_ret); + xmfs_mark_page_live(sbi, offset); + } + + folio_unlock(folio); + folio_put(folio); + + return copied; +} + +static ssize_t xmfs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) +{ + ssize_t ret; + struct file *file = iocb->ki_filp; + struct inode *inode = file_inode(file); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + if (sbi->id != 0) { +#ifdef CONFIG_XMFS_FS_URMA + if (iter_is_ubuf(from)) + return xmfs_file_write_ubuf_slave(iocb, from); +#endif + return xmfs_file_write_iter_slave(iocb, from); + } + inode_lock(inode); + + if (xmfs_quiesce_wait(sbi)) + return -EINTR; + if (XMFS_I(inode)->die) { + xmfs_info(sbi->sb, + "inode logs have been interrupted before write iter"); + inode_unlock(inode); + return -EINVAL; + } + + struct xmfs_log xm_log = {}; + + unsigned long start_index = iocb->ki_pos / PAGE_SIZE; + unsigned long end_index = + (iov_iter_count(from) + iocb->ki_pos + PAGE_SIZE - 1) / + PAGE_SIZE; + unsigned long start_offset = iocb->ki_pos; + unsigned long xmlt_addr; + struct xmfs_rw_msg req = {}, grant = {}; + + ret = generic_write_checks(iocb, from); + if (ret > 0) { + start_index = iocb->ki_pos / PAGE_SIZE; + end_index = + (iov_iter_count(from) + iocb->ki_pos + PAGE_SIZE - 1) / + PAGE_SIZE; + start_offset = iocb->ki_pos; + if (XMFS_I(inode)->fallocate && + end_index > XMFS_I(inode)->data_size / PAGE_SIZE) { + xmfs_error(sbi->sb, + "write iter do not support write more than fallocate size"); + inode_unlock(inode); + return -EOPNOTSUPP; + } + + ret = file_remove_privs(file); + if (ret) { + xmfs_error(sbi->sb, + "write iter remove privs failed %ld", ret); + inode_unlock(inode); + return ret; + } + + ret = file_update_time(file); + if (ret) { + xmfs_error(sbi->sb, "write iter update time failed %ld", + ret); + inode_unlock(inode); + return ret; + } + + if (XMFS_I(inode)->fallocate) + goto start_write; + + req.ops = XMFS_UPDATE; + req.i_ino = inode->i_ino; + req.data_pages = end_index - start_index; + req.log_entries = 1; + req.size = iocb->ki_pos + iov_iter_count(from); + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + xmfs_host_handle_urma_request(sbi, sbi->id, &req, &grant); + XMFS_I(inode)->start_write = grant.data_addr; + XMFS_I(inode)->count = grant.data_page_count; + XMFS_I(inode)->second_write = grant.second_data_addr; + XMFS_I(inode)->second_write_count = 0; + +start_write: + /* + * xmfs_info(sbi->sb, "write start %ld %ld %d %ld", + * XMFS_I(inode)->start_write, + * XMFS_I(inode)->second_write, XMFS_I(inode)->count, + * XMFS_I(inode)->second_write_count); + */ + ret = generic_perform_write(iocb, from); + } else { + inode_unlock(inode); + return ret; + } + /* + * xmfs_info(sbi->sb, + * "start offset %ld index %ld end index %ld pos %ld %ld", + * start_offset, start_index, end_index, iocb->ki_pos, + * (iocb->ki_pos + PAGE_SIZE - 1) / PAGE_SIZE); + */ + XMFS_I(inode)->start_write = 0; + XMFS_I(inode)->second_write = 0; + XMFS_I(inode)->count = 0; + XMFS_I(inode)->second_write_count = 0; + if (ret <= 0) { + inode_unlock(inode); + return ret; + } + + for (int s = 0; s < grant.log_slot_count; s++) { + xm_log.ops = XMFS_UPDATE; + xm_log.i_ino = inode->i_ino; + xm_log.version = grant.version + s; + xm_log.writer_id = sbi->id; + if (s == 0) { + xm_log.index = start_index; + xm_log.end_index = start_index + grant.data_page_count; + xm_log.data_offset = grant.data_addr; + xm_log.size = req.size; + } else { + xm_log.index = start_index + grant.data_page_count; + xm_log.end_index = end_index; + xm_log.data_offset = grant.second_data_addr; + xm_log.size = req.size; + } + xmlt_addr = + xmfs_add_log_v3(&xm_log, sbi, 0, inode->i_ino, true); + } + + inode_unlock(inode); + return ret; +} + +const struct pipe_buf_operations xmfs_pipe_buf_ops = { + .release = generic_pipe_buf_release, + .try_steal = generic_pipe_buf_try_steal, + .get = generic_pipe_buf_get, +}; + +static size_t splice_folio_into_pipe(struct pipe_inode_info *pipe, + struct folio *folio, loff_t fpos, + size_t size) +{ + struct page *page; + size_t spliced = 0, offset = offset_in_folio(folio, fpos); + + page = folio_page(folio, offset / PAGE_SIZE); + size = min(size, folio_size(folio) - offset); + offset %= PAGE_SIZE; + + while (spliced < size && + !pipe_full(pipe->head, pipe->tail, pipe->max_usage)) { + struct pipe_buffer *buf = pipe_head_buf(pipe); + size_t part = min_t(size_t, PAGE_SIZE - offset, size - spliced); + + *buf = (struct pipe_buffer) { + .ops = &xmfs_pipe_buf_ops, + .page = page, + .offset = offset, + .len = part, + }; + folio_get(folio); + pipe->head++; + page++; + spliced += part; + offset = 0; + } + + return spliced; +} + +static bool zero_pipe_buf_get(struct pipe_inode_info *pipe, + struct pipe_buffer *buf) +{ + return true; +} + +static void zero_pipe_buf_release(struct pipe_inode_info *pipe, + struct pipe_buffer *buf) +{ +} + +static bool zero_pipe_buf_try_steal(struct pipe_inode_info *pipe, + struct pipe_buffer *buf) +{ + return false; +} + +static const struct pipe_buf_operations zero_pipe_buf_ops = { + .release = zero_pipe_buf_release, + .try_steal = zero_pipe_buf_try_steal, + .get = zero_pipe_buf_get, +}; + +static size_t splice_zeropage_into_pipe(struct pipe_inode_info *pipe, + loff_t fpos, size_t size) +{ + size_t offset = fpos & ~PAGE_MASK; + + size = min_t(size_t, size, PAGE_SIZE - offset); + + if (!pipe_full(pipe->head, pipe->tail, pipe->max_usage)) { + struct pipe_buffer *buf = pipe_head_buf(pipe); + + *buf = (struct pipe_buffer) { + .ops = &zero_pipe_buf_ops, + .page = ZERO_PAGE(0), + .offset = offset, + .len = size, + }; + pipe->head++; + } + + return size; +} + +static ssize_t xmfs_file_read_iter_slave(struct kiocb *iocb, + struct iov_iter *to) +{ + struct file *file = iocb->ki_filp; + struct inode *inode = file_inode(file); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + pgoff_t index; + pgoff_t end_index; + unsigned long offset; + unsigned long *offsets; + int error = 0; + int count = 0; + ssize_t retval = 0; + loff_t *ppos = &iocb->ki_pos; + loff_t i_size = iov_iter_count(to); + struct page **pages; + /* xmfs_info(sbi->sb, "read iter slave"); */ + + /* + * struct xmfs_sb_index *xmsi = + * kmalloc(sizeof(struct xmfs_sb_index), GFP_KERNEL); + * int err = get_xmsi_and_copy(sbi, xmsi); + * + * if (unlikely(err)) { + * xmfs_error(sbi->sb, + * "hardware memory error when reading superblock during slave lookup"); + * kfree(xmsi); + * return err; + * } + * + * if (xmsi->last_update != sbi->last_update) { + * if (!sbi->debug) + * xmfs_replay_new_entries(sbi, NULL, xmsi->last_update); + * else + * xmfs_replay_new_entries(sbi, NULL, xmsi->last_update); + * } + * + * kfree(xmsi); + */ + + index = *ppos >> PAGE_SHIFT; + offset = *ppos & ~PAGE_MASK; + end_index = (i_size + *ppos) / PAGE_SIZE; + offsets = kzalloc((end_index - index + 1) * sizeof(unsigned long), + GFP_KERNEL); + if (!offsets) + return -ENOMEM; + + pages = kzalloc((end_index - index + 1) * sizeof(struct page *), + GFP_KERNEL); + if (!pages) { + kfree(offsets); + return -ENOMEM; + } + for (;;) { + struct folio *folio = NULL; + unsigned long nr, ret; + + if (index > end_index) + break; + if (index == end_index) { + nr = (i_size + *ppos) & ~PAGE_MASK; + if (nr <= offset) + break; + } else { + nr = PAGE_SIZE; + } + nr -= offset; + + folio = filemap_get_folio(inode->i_mapping, index); + if (IS_ERR(folio)) + folio = NULL; + + if (folio) { + folio_put(folio); + } else { + /* + * Copy to user tends to be so well optimized, but + * clear_user() not so much, that it is noticeably + * faster to copy the zero page instead of clearing. + */ + /* xmfs_error(sbi->sb, "qyf bad things happened"); */ + unsigned long mapped_offset = + (unsigned long)xa_load(&xmfs_inode->shared_pages, + index); + if (mapped_offset) { + folio = __filemap_get_folio(inode->i_mapping, index, + FGP_LOCK | FGP_WRITE | + FGP_CREAT, + inode->i_mapping->gfp_mask); + if (IS_ERR(folio)) { + xmfs_info(sbi->sb, + "splice cannot get the folio"); + error = PTR_ERR(folio); + folio = NULL; + break; + } + offsets[count] = mapped_offset; + pages[count] = &folio->page; + count++; + } else { + xmfs_info(sbi->sb, "no offset for %ld", index); + } + } + ret = nr; + offset += ret; + index += offset >> PAGE_SHIFT; + offset &= ~PAGE_MASK; + } + + if (count > 0) { + int idx = 0; + + while (count > 0) { + int num = min(512, count); + + count -= num; + xmfs_pmem_read_multi_pages(sbi, offsets + idx, + pages + idx, num); + idx += num; + } + for (int i = 0; i < idx; i++) { + struct folio *folio = page_folio(pages[i]); + + folio_mark_uptodate(folio); + folio_unlock(folio); + folio_put(folio); + } + } + kfree(offsets); + kfree(pages); + index = *ppos >> PAGE_SHIFT; + offset = *ppos & ~PAGE_MASK; + i_size = i_size_read(inode); + end_index = i_size >> PAGE_SHIFT; + + for (;;) { + struct folio *folio = NULL; + struct page *page = NULL; + unsigned long nr, ret; + + if (index > end_index) + break; + if (index == end_index) { + nr = i_size & ~PAGE_MASK; + if (nr <= offset) + break; + } else { + nr = PAGE_SIZE; + } + nr -= offset; + + folio = filemap_get_folio(inode->i_mapping, index); + if (!IS_ERR(folio)) { + bool uptodate; + + folio_lock(folio); + uptodate = folio_test_uptodate(folio); + folio_unlock(folio); + if (!uptodate) { + folio_put(folio); + folio = NULL; + } + } else { + folio = NULL; + } + if (IS_ERR(folio)) + folio = NULL; + + if (folio) { + page = folio_page(folio, 0); + ret = copy_page_to_iter(page, offset, nr, to); + folio_put(folio); + } else { + ret = copy_page_to_iter(ZERO_PAGE(0), offset, nr, to); + } + + retval += ret; + offset += ret; + index += offset >> PAGE_SHIFT; + offset &= ~PAGE_MASK; + + if (!iov_iter_count(to)) + break; + if (ret < nr) { + error = -EFAULT; + break; + } + } + + *ppos = ((loff_t)index << PAGE_SHIFT) + offset; + file_accessed(file); + return retval ? retval : error; +} + +int xmfs_collect_read_extents(struct xmfs_inode_info *inode, pgoff_t start, + pgoff_t end, struct xmfs_read_extent *exts, + unsigned int max_exts) +{ + XA_STATE(xas, &inode->shared_pages, start); + + void *entry; + unsigned long offset; + pgoff_t index; + unsigned int nr_exts = 0; + bool in_extent = false; + + pgoff_t cur_index = 0; + unsigned long cur_offset = 0; + unsigned int cur_pages = 0; + + xas_lock(&xas); + + xas_for_each(&xas, entry, end - 1) { + offset = (unsigned long)entry; + + index = xas.xa_index; + + /* + * xa_load() 返回 NULL 时不会进入这里， + * xas_for_each() 已经跳过空洞。 + */ + + if (!in_extent) { + cur_index = index; + cur_offset = offset; + cur_pages = 1; + in_extent = true; + continue; + } + + /* + * 是否仍然连续。 + */ + if (index == cur_index + cur_pages && + offset == cur_offset + ((unsigned long)cur_pages + << PAGE_SHIFT)) { + cur_pages++; + continue; + } + + /* + * 保存上一段 extent。 + */ + if (nr_exts >= max_exts) { + xas_unlock(&xas); + return -ENOSPC; + } + exts[nr_exts].start_index = cur_index; + exts[nr_exts].start_offset = cur_offset; + exts[nr_exts].nr_pages = cur_pages; + nr_exts++; + /* + * 新 extent。 + */ + cur_index = index; + cur_offset = offset; + cur_pages = 1; + } + + xas_unlock(&xas); + + /* + * Flush 最后一个 extent。 + */ + if (in_extent) { + if (nr_exts >= max_exts) + return -ENOSPC; + exts[nr_exts].start_index = cur_index; + exts[nr_exts].start_offset = cur_offset; + exts[nr_exts].nr_pages = cur_pages; + nr_exts++; + } + + return nr_exts; +} + +static ssize_t xmfs_file_read_ubuf_slave(struct kiocb *iocb, + struct iov_iter *to) +{ + struct file *file = iocb->ki_filp; + struct inode *inode = file_inode(file); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + pgoff_t index; + pgoff_t end_index; + unsigned long offset; + int err = 0; + int count = 0; + ssize_t retval = 0; + loff_t *ppos = &iocb->ki_pos; + loff_t i_size = iov_iter_count(to); + loff_t end_pos = min(i_size + iocb->ki_pos, inode->i_size); + struct xmfs_read_extent *exts; + + index = *ppos >> PAGE_SHIFT; + offset = *ppos & ~PAGE_MASK; + end_index = (end_pos + PAGE_SIZE - 1) / PAGE_SIZE; + + count = end_index - index + 1; + + exts = vzalloc(count * sizeof(struct xmfs_read_extent)); + /* + * xmfs_info(sbi->sb, "qyf before count is %d end is %ld %ld %ld", + * count, inode->i_size, *ppos, i_size); + */ + count = xmfs_collect_read_extents(xmfs_inode, index, end_index, exts, + count); + /* xmfs_info(sbi->sb, "qyf count is %d %ld", count, i_size); */ + for (int i = 0; i < count; i++) + retval += exts[i].nr_pages * PAGE_SIZE; + + retval = min(retval, end_pos - *ppos); + if (count != 0 && retval != 0) { + exts[0].start_offset += offset; + err = xmfs_urma_read_ubuf(sbi, to->ubuf, exts, count, retval); + } + vfree(exts); + iocb->ki_pos += retval; + file_accessed(file); + /* xmfs_info(sbi->sb, "qyf read return %ld %ld", err, retval); */ + return err ? err : retval; +} + +static ssize_t xmfs_file_splice_read(struct file *in, loff_t *ppos, + struct pipe_inode_info *pipe, size_t len, + unsigned int flags) +{ + struct inode *inode = file_inode(in); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + struct address_space *mapping = inode->i_mapping; + struct folio *folio = NULL; + size_t total_spliced = 0, used, npages, n, part; + loff_t isize; + int error = 0; + + struct xmfs_sb_index *xmsi = + kmalloc(sizeof(struct xmfs_sb_index), GFP_KERNEL); + int err = get_xmsi_and_copy(sbi, xmsi); + + if (unlikely(err)) { + xmfs_error(sbi->sb, + "hardware memory error when reading superblock during splice read"); + kfree(xmsi); + return err; + } + + if (xmsi->last_update != sbi->last_update) { + if (!sbi->debug) + xmfs_replay_new_entries(sbi, NULL, xmsi->last_update); + else + xmfs_replay_new_entries(sbi, NULL, xmsi->last_update); + } + kfree(xmsi); + + used = pipe_occupancy(pipe->head, pipe->tail); + npages = max_t(ssize_t, pipe->max_usage - used, 0); + len = min_t(size_t, len, (npages * PAGE_SIZE)); + + do { + if (*ppos >= i_size_read(inode)) + break; + + folio = filemap_get_folio(inode->i_mapping, *ppos / PAGE_SIZE); + if (!IS_ERR(folio)) { + bool uptodate; + + folio_lock(folio); + uptodate = folio_test_uptodate(folio); + folio_unlock(folio); + if (!uptodate) { + folio_put(folio); + folio = NULL; + } + } else { + folio = NULL; + } + + /* + * i_size must be checked after we know the pages are Uptodate. + * + * Checking i_size after the check allows us to calculate + * the correct value for "nr", which means the zero-filled + * part of the page is not copied back to userspace (unless + * another truncate extends the file - this is desired though). + */ + isize = i_size_read(inode); + if (unlikely(*ppos >= isize)) + break; + part = min_t(loff_t, isize - *ppos, len); + + if (folio) { + /* + * If users can be writing to this page using arbitrary + * virtual addresses, take care about potential aliasing + * before reading the page on the kernel side. + */ + if (mapping_writably_mapped(mapping)) + flush_dcache_folio(folio); + folio_mark_accessed(folio); + /* + * Ok, we have the page, and it's up-to-date, so we can + * now splice it into the pipe. + */ + n = splice_folio_into_pipe(pipe, folio, *ppos, part); + folio_put(folio); + folio = NULL; + } else { + unsigned long mapped_offset = + (unsigned long)xa_load(&xmfs_inode->shared_pages, + *ppos / PAGE_SIZE); + if (!mapped_offset) { + n = splice_zeropage_into_pipe(pipe, *ppos, + part); + } else { + folio = __filemap_get_folio(inode->i_mapping, + *ppos / PAGE_SIZE, + FGP_LOCK | FGP_WRITE | + FGP_CREAT, + inode->i_mapping->gfp_mask); + if (IS_ERR(folio)) { + xmfs_info(sbi->sb, + "splice cannot get the folio"); + error = PTR_ERR(folio); + folio = NULL; + break; + } + void *kaddr = + kmap_local_page(folio_file_page(folio, + *ppos / PAGE_SIZE)); + error = get_data_and_copy(sbi, mapped_offset, + kaddr, PAGE_SIZE, + NULL, 0); + if (unlikely(error)) { + xmfs_error(sbi->sb, + "hardware memory error when reading data during splice read"); + folio_unlock(folio); + folio_put(folio); + folio = NULL; + break; + } + kunmap_local(kaddr); + folio_mark_uptodate(folio); + n = splice_folio_into_pipe(pipe, folio, *ppos, + part); + folio_unlock(folio); + folio_put(folio); + folio = NULL; + } + } + + if (!n) + break; + len -= n; + total_spliced += n; + *ppos += n; + in->f_ra.prev_pos = *ppos; + if (pipe_full(pipe->head, pipe->tail, pipe->max_usage)) + break; + + } while (len); + + if (folio) + folio_put(folio); + + file_accessed(in); + return total_spliced ? total_spliced : error; +} + +static ssize_t xmfs_file_read_iter(struct kiocb *iocb, struct iov_iter *to) +{ + struct file *file = iocb->ki_filp; + struct inode *inode = file_inode(file); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + if (sbi->id != 0) { + if (iter_is_ubuf(to)) + return xmfs_file_read_ubuf_slave(iocb, to); + return xmfs_file_read_iter_slave(iocb, to); + } + + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + pgoff_t index; + unsigned long offset; + int error = 0; + ssize_t retval = 0; + loff_t *ppos = &iocb->ki_pos; + + struct xmfs_sb_index *xmsi = + kmalloc(sizeof(struct xmfs_sb_index), GFP_KERNEL); + int err = get_xmsi_and_copy(sbi, xmsi); + + if (unlikely(err)) { + xmfs_error(sbi->sb, + "hardware memory error when reading superblock during read iter"); + kfree(xmsi); + return err; + } + + /* + * if (xmsi->last_update != sbi->last_update) { + * if (!sbi->debug) + * xmfs_replay_new_entries(sbi, NULL, xmsi->last_update); + * else + * xmfs_replay_new_entries(sbi, NULL, xmsi->last_update); + * } + */ + + kfree(xmsi); + + index = *ppos >> PAGE_SHIFT; + offset = *ppos & ~PAGE_MASK; + + for (;;) { + struct folio *folio = NULL; + struct page *page = NULL; + pgoff_t end_index; + unsigned long nr, ret; + loff_t i_size = i_size_read(inode); + + end_index = i_size >> PAGE_SHIFT; + if (index > end_index) + break; + if (index == end_index) { + nr = i_size & ~PAGE_MASK; + if (nr <= offset) + break; + } else { + nr = PAGE_SIZE; + } + nr -= offset; + + folio = filemap_get_folio(inode->i_mapping, index); + if (!IS_ERR(folio)) { + bool uptodate; + + folio_lock(folio); + uptodate = folio_test_uptodate(folio); + folio_unlock(folio); + if (!uptodate) { + folio_put(folio); + folio = NULL; + } + } else { + folio = NULL; + } + if (IS_ERR(folio)) + folio = NULL; + + if (folio) { + page = folio_page(folio, 0); + ret = copy_page_to_iter(page, offset, nr, to); + folio_put(folio); + } else { + /* + * Copy to user tends to be so well optimized, but + * clear_user() not so much, that it is noticeably + * faster to copy the zero page instead of clearing. + */ + /* xmfs_error(sbi->sb, "qyf bad things happened"); */ + unsigned long mapped_offset = + (unsigned long)xa_load(&xmfs_inode->shared_pages, + index); + if (!mapped_offset) { + ret = copy_page_to_iter(ZERO_PAGE(0), offset, + nr, to); + } else { + void *data; + + data = get_data(sbi, mapped_offset + offset, + nr); + if (IS_ERR(data)) { + error = PTR_ERR(data); + break; + } + ret = _copy_to_iter(data, nr, to); + put_data(sbi, data); + } + } + + retval += ret; + offset += ret; + index += offset >> PAGE_SHIFT; + offset &= ~PAGE_MASK; + + if (!iov_iter_count(to)) + break; + if (ret < nr) { + error = -EFAULT; + break; + } + } + + *ppos = ((loff_t)index << PAGE_SHIFT) + offset; + file_accessed(file); + return retval ? retval : error; +} + +#ifdef CONFIG_XMFS_FS_URMA +static ssize_t xmfs_file_write_iter_slave(struct kiocb *iocb, + struct iov_iter *from) +{ + struct inode *inode = file_inode(iocb->ki_filp); + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + unsigned long start_index = iocb->ki_pos / PAGE_SIZE; + unsigned long end_index; + unsigned long page_num; + ssize_t ret; + + ret = generic_write_checks(iocb, from); + if (ret <= 0) + return ret; + + end_index = (iov_iter_count(from) + iocb->ki_pos + PAGE_SIZE - 1) / + PAGE_SIZE; + page_num = end_index - start_index; + + /* + * req.ops = XMFS_UPDATE; + * req.i_ino = inode->i_ino; + * req.data_pages = page_num; + * req.log_entries = 1; + * req.size = iocb->ki_pos + iov_iter_count(from); + * req.type = MSG_RW_REQUEST; + * req.slave_id = sbi->id; + * spin_lock(&sbi->local_ring_lock); + * req.request_id = ++sbi->rw_request_id; + * spin_unlock(&sbi->local_ring_lock); + * + * struct xmfs_grant_wait gw; + * init_completion(&gw.done); + * xa_store(&sbi->urma_cfg.grant_waits, req.request_id, &gw, + * GFP_KERNEL); + * err = xmfs_send_request(sbi, &req, &gw, 0); + * if (err) + * return err; + * grant = gw.grant; + * log_base = grant.log_trunk_addr + + * offsetof(struct xmfs_log_trunk, log[0]); + */ + + inode_lock(inode); + /* + * xmfs_inode->start_write = grant.data_addr; + * xmfs_inode->count = grant.data_page_count; + * xmfs_inode->second_write = grant.second_data_addr; + * xmfs_inode->second_write_count = 0; + */ + + /* + * xmfs_inode->wr = vzalloc(page_num * sizeof(struct ubcore_jfs_wr)); + * xmfs_inode->slots = vzalloc(sizeof(int) * page_num); + * xmfs_inode->write_buffer = urma_pool_acquire_nslots( + * &sbi->urma_cfg.pool, page_num, xmfs_inode->slots); + * xmfs_inode->wr_cnt = 0; + */ + + ret = generic_perform_write(iocb, from); + + struct xmfs_write_work *ww; + + ww = kmalloc(sizeof(*ww), GFP_KERNEL); + if (!ww) { + inode_unlock(inode); + return ret; + } + + ww->inode = inode; + ww->index = start_index; + ww->end_index = end_index; + ww->size = inode->i_size; + ihold(inode); + INIT_WORK(&ww->work, xmfs_write_worker); + if (xmfs_inode->write_wq) + queue_work(xmfs_inode->write_wq, &ww->work); + else + queue_work(sbi->prefetch_wq, &ww->work); + + /* + * for (s = 0; s < grant.log_slot_count; s++) { + * struct xmfs_log xm_log = {}; + * + * xm_log.ops = XMFS_UPDATE; + * xm_log.i_ino = inode->i_ino; + * xm_log.version = grant.version + s; + * xm_log.writer_id = sbi->id; + * if (s == 0) { + * xm_log.index = start_index; + * xm_log.end_index = + * start_index + grant.data_page_count; + * xm_log.data_offset = grant.data_addr; + * xm_log.size = req.size; + * } else { + * xm_log.index = start_index + grant.data_page_count; + * xm_log.end_index = end_index; + * xm_log.data_offset = grant.second_data_addr; + * xm_log.size = req.size; + * } + * xmfs_data_write( + * sbi, log_base + (grant.log_slot_start + s) * + * sizeof(struct xmfs_log), + * &xm_log, sizeof(xm_log)); + * + * pages = kzalloc((xm_log.end_index - xm_log.index) * + * sizeof(struct page *), GFP_KERNEL); + * for (int i = xm_log.index; i < xm_log.end_index; i++) { + * struct folio *folio = + * filemap_get_folio(inode->i_mapping, i); + * + * if (IS_ERR(folio)) { + * xm_log.end_index = i; + * break; + * } + * pages[i - xm_log.index] = &folio->page; + * } + * xmfs_pmem_write_multi_pages( + * sbi, xm_log.data_offset, pages, + * xm_log.end_index - xm_log.index); + * for (int i = xm_log.index; i < xm_log.end_index; i++) { + * struct folio *folio = + * page_folio(pages[i - xm_log.index]); + * + * folio_unlock(folio); + * folio_put(folio); + * } + * kfree(pages); + * } + */ + /* + * xmfs_urma_send_write_pages(sbi, xmfs_inode->wr); + * + * urma_pool_release_nslots(&sbi->urma_cfg.pool, page_num, + * xmfs_inode->slots); + * vfree(xmfs_inode->slots); + * xmfs_inode->start_write = 0; + * xmfs_inode->second_write = 0; + * xmfs_inode->count = 0; + * xmfs_inode->second_write_count = 0; + */ + inode_unlock(inode); + + return ret; +} + +static ssize_t xmfs_file_write_ubuf_slave(struct kiocb *iocb, + struct iov_iter *from) +{ + /* xmfs_info(sbi->sb, "qyf start write ubuf"); */ + struct inode *inode = file_inode(iocb->ki_filp); + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct xmfs_rw_msg req = {}, grant = {}; + unsigned long start_index = iocb->ki_pos / PAGE_SIZE; + unsigned long end_index; + unsigned long page_num; + unsigned long log_base; + int err, s; + ssize_t ret; + + ret = generic_write_checks(iocb, from); + if (ret <= 0) + return ret; + + end_index = (iov_iter_count(from) + iocb->ki_pos + PAGE_SIZE - 1) / + PAGE_SIZE; + page_num = end_index - start_index; + + req.ops = XMFS_UPDATE; + req.i_ino = inode->i_ino; + req.data_pages = page_num; + req.log_entries = 1; + req.size = iocb->ki_pos + iov_iter_count(from); + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + + struct xmfs_grant_wait gw; + + init_completion(&gw.done); + xa_store(&sbi->urma_cfg.grant_waits, req.request_id, &gw, GFP_KERNEL); + err = xmfs_send_request(sbi, &req, &gw, 0); + if (err) + return err; + grant = gw.grant; + log_base = + grant.log_trunk_addr + offsetof(struct xmfs_log_trunk, log[0]); + + inode_lock(inode); + xmfs_inode->start_write = grant.data_addr; + xmfs_inode->count = grant.data_page_count; + xmfs_inode->second_write = grant.second_data_addr; + xmfs_inode->second_write_count = 0; + /* xmfs_info(sbi->sb, "qyf start write ubuf data"); */ + xmfs_urma_write_ubuf(sbi, from->ubuf, grant.data_page_count * PAGE_SIZE, + grant.data_addr); + if (grant.log_slot_count > 1 && grant.second_data_addr != 0 && + grant.second_data_pages != 0) { + xmfs_urma_write_ubuf(sbi, + from->ubuf + + grant.data_page_count * PAGE_SIZE, + iov_iter_count(from) - + grant.data_page_count * PAGE_SIZE, + grant.second_data_addr); + } + /* xmfs_info(sbi->sb, "qyf start end ubuf data"); */ + for (s = 0; s < grant.log_slot_count; s++) { + struct xmfs_log xm_log = {}; + + xm_log.ops = XMFS_UPDATE; + xm_log.i_ino = inode->i_ino; + xm_log.version = grant.version + s; + xm_log.writer_id = sbi->id; + if (s == 0) { + xm_log.index = start_index; + xm_log.end_index = start_index + grant.data_page_count; + xm_log.data_offset = grant.data_addr; + xm_log.size = req.size; + int chunk_header_cnt = 0; + + for (int i = 0; i < grant.data_page_count; i++) { + unsigned long offset = + grant.data_addr + i * PAGE_SIZE + + chunk_header_cnt * PAGE_SIZE; + if (offset % XMFS_DEFAULT_CHUNK_SIZE == 0) { + chunk_header_cnt++; + offset = grant.data_addr + + i * PAGE_SIZE + + chunk_header_cnt * PAGE_SIZE; + } + xa_store(&(XMFS_I(inode)->shared_pages), + i + start_index, (void *)offset, + GFP_KERNEL); + } + } else { + xm_log.index = start_index + grant.data_page_count; + xm_log.end_index = end_index; + xm_log.data_offset = grant.second_data_addr; + xm_log.size = req.size; + int chunk_header_cnt = 0; + + for (int i = 0; i < grant.second_data_pages; i++) { + unsigned long offset = + grant.second_data_addr + i * PAGE_SIZE + + chunk_header_cnt * PAGE_SIZE; + if (offset % XMFS_DEFAULT_CHUNK_SIZE == 0) { + chunk_header_cnt++; + offset = grant.second_data_addr + + i * PAGE_SIZE + + chunk_header_cnt * PAGE_SIZE; + } + xa_store(&(XMFS_I(inode)->shared_pages), + i + start_index + + grant.data_page_count, + (void *)offset, GFP_KERNEL); + } + } + xmfs_data_write(sbi, + log_base + (grant.log_slot_start + s) * + sizeof(struct xmfs_log), + &xm_log, sizeof(xm_log)); + } + /* xmfs_info(sbi->sb, "qyf start write ubuf log"); */ + iocb->ki_pos += iov_iter_count(from); + if (i_size_read(inode) < iocb->ki_pos) + i_size_write(inode, iocb->ki_pos); + inode_unlock(inode); + + /* + * struct xmfs_cache_work *cw; + * + * cw = kmalloc(sizeof(*cw), GFP_KERNEL); + * if (!cw) + * return ret; + * + * cw->inode = inode; + * cw->index = start_index; + * cw->end_index = end_index; + * INIT_WORK(&cw->work, xmfs_prefetch_worker); + * queue_work(sbi->prefetch_wq, &cw->work); + */ + /* xmfs_info(sbi->sb, "qyf end write ubuf"); */ + return ret; +} +#endif + +static loff_t xmfs_seek_block(struct file *file, loff_t offset, int whence) +{ + struct inode *inode = file->f_mapping->host; + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + loff_t maxbytes = inode->i_sb->s_maxbytes; + pgoff_t pgofs, preofs; + loff_t data_ofs = offset; + loff_t isize; + + inode_lock_shared(inode); + + isize = i_size_read(inode); + + if (offset >= isize) { + inode_unlock_shared(inode); + return -ENXIO; + } + + pgofs = (pgoff_t)(offset >> PAGE_SHIFT); + preofs = pgofs; + unsigned long i; + void *ptr; + + if (whence == SEEK_DATA) { + bool found = false; + + xa_for_each_start(&xmfs_inode->shared_pages, i, ptr, pgofs) { + if (i == pgofs) { + /* + * 场景 A：offset 刚好落在一个包含数据的页内， + * 直接返回原 offset。 + */ + data_ofs = offset; + } else { + /* + * 场景 B：offset 落在空洞内，下一个数据页在 i， + * 返回新数据页的起始地址。 + */ + data_ofs = (loff_t)i << PAGE_SHIFT; + } + found = true; + /* 找到第一个数据块即可，退出循环。 */ + break; + } + if (!found) { + /* 之后没有数据了。 */ + inode_unlock_shared(inode); + return -ENXIO; + } + } else if (whence == SEEK_HOLE) { + unsigned long expected = pgofs; + bool in_hole = true; + + xa_for_each_start(&xmfs_inode->shared_pages, i, ptr, pgofs) { + if (i > expected) { + /* + * 发现断层：本来期望页号是 expected，但拿到的 i + * 却比它大，说明 expected 处存在一个洞， + * 跳出循环。 + */ + break; + } + /* + * 如果走到这里，说明 i == expected，该页有数据。 + * 既然第一页有数据，说明 offset 不在洞里。 + */ + in_hole = false; + /* 期望下一页。 */ + expected++; + } + if (in_hole) { + /* + * 场景 A：offset 所在的起始页没有数据（或者没有后续 + * 数据），所以 offset 本身就在空洞里， + * 直接返回原 offset。 + */ + data_ofs = offset; + } else { + /* + * 场景 B：遇到连续的数据页， + * 在期望页 expected 发生断层， + * 返回断层起始地址。 + */ + data_ofs = (loff_t)expected << PAGE_SHIFT; + } + /* + * 场景 C：隐式文件尾空洞。如果算出的洞偏移超过文件大小， + * 则取文件大小。 + */ + if (data_ofs > isize) + data_ofs = isize; + } else { + inode_unlock_shared(inode); + return -EINVAL; + } + inode_unlock_shared(inode); + return vfs_setpos(file, data_ofs, maxbytes); +} + +static loff_t xmfs_file_llseek(struct file *file, loff_t offset, int whence) +{ + loff_t size = i_size_read(file->f_mapping->host); + + switch (whence) { + case SEEK_END: + case SEEK_CUR: + case SEEK_SET: + return generic_file_llseek(file, offset, whence); + case SEEK_DATA: + case SEEK_HOLE: + if (offset < 0 || offset >= size) + return -ENXIO; + return xmfs_seek_block(file, offset, whence); + } + + return -EINVAL; +} + +static vm_fault_t xmfs_fault(struct vm_fault *vmf) +{ + struct inode *inode = file_inode(vmf->vma->vm_file); + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + vm_fault_t ret = 0; + unsigned long offset = vmf->pgoff << PAGE_SHIFT; + pgoff_t index = vmf->pgoff; + unsigned long mapped_offset; + int err; + + if (offset >= i_size_read(inode)) + return VM_FAULT_SIGBUS; + + filemap_invalidate_lock_shared(inode->i_mapping); + + struct folio *folio = __filemap_get_folio(inode->i_mapping, index, + FGP_CREAT | FGP_FOR_MMAP, + vmf->gfp_mask); + if (IS_ERR(folio)) { + filemap_invalidate_unlock_shared(inode->i_mapping); + return vmf_error(PTR_ERR(folio)); + } + + folio_lock(folio); + + void *kaddr = kmap_local_page(folio_file_page(folio, index)); + + mapped_offset = + (unsigned long)xa_load(&xmfs_inode->shared_pages, index); + if (mapped_offset) { + err = get_data_and_copy(sbi, mapped_offset, kaddr, PAGE_SIZE, NULL, + 0); + if (unlikely(err)) { + kunmap_local(kaddr); + folio_unlock(folio); + folio_put(folio); + filemap_invalidate_unlock_shared(inode->i_mapping); + return VM_FAULT_SIGBUS; + } + } else { + memset(kaddr, 0, PAGE_SIZE); + } + kunmap_local(kaddr); + folio_mark_uptodate(folio); + + vmf->page = folio_file_page(folio, index); + filemap_invalidate_unlock_shared(inode->i_mapping); + ret |= VM_FAULT_LOCKED; + return ret; +} + +static vm_fault_t xmfs_slave_fault(struct vm_fault *vmf) +{ + struct inode *inode = file_inode(vmf->vma->vm_file); + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + vm_fault_t ret = 0; + unsigned long offset = vmf->pgoff << PAGE_SHIFT; + pgoff_t index = vmf->pgoff; + struct page_freq *page_freq; + + if (offset >= i_size_read(inode)) { + xmfs_info(sbi->sb, "offset is larger than size"); + return VM_FAULT_SIGBUS; + } + if (!sbi->always_hot) { + page_freq = (struct page_freq *)xa_load(&xmfs_inode->page_freq, + index); + if (!page_freq) { + page_freq = + kzalloc(sizeof(struct page_freq), GFP_KERNEL); + if (!page_freq) { + xmfs_info(sbi->sb, "fault page freq no"); + return VM_FAULT_SIGBUS; + } + void *store_ret = xa_store(&xmfs_inode->page_freq, + index, (void *)page_freq, + GFP_KERNEL); + if (xa_err(store_ret)) { + xmfs_error(sbi->sb, + "cannot store shared pages for page %lu", + index); + } + } + page_freq->in_cache = true; + page_freq->never_in_cache = false; + } + filemap_invalidate_lock_shared(inode->i_mapping); + struct folio *folio = __filemap_get_folio(inode->i_mapping, index, + FGP_CREAT | FGP_FOR_MMAP, + vmf->gfp_mask); + if (IS_ERR(folio)) { + filemap_invalidate_unlock_shared(inode->i_mapping); + xmfs_info(sbi->sb, "fault oom %ld %d", PTR_ERR(folio), + vmf_error(PTR_ERR(folio))); + return vmf_error(PTR_ERR(folio)); + } + folio_lock(folio); + + void *kaddr = kmap_local_page(folio_file_page(folio, index)); + unsigned long mapped_offset = + (unsigned long)xa_load(&xmfs_inode->shared_pages, index); + int err = get_data_and_copy(sbi, mapped_offset, kaddr, PAGE_SIZE, NULL, + 0); + if (unlikely(err)) + xmfs_error(sbi->sb, + "hardware memory error when reading data during slave page fault"); + kunmap_local(kaddr); + folio_mark_uptodate(folio); + + vmf->page = folio_file_page(folio, index); + filemap_invalidate_unlock_shared(inode->i_mapping); + if (!sbi->always_hot) + page_freq->already_in_cache = true; + + ret |= VM_FAULT_LOCKED; + return ret; +} + +static vm_fault_t xmfs_map_pages(struct vm_fault *vmf, pgoff_t start_pgoff, + pgoff_t end_pgoff) +{ + vm_fault_t ret = filemap_map_pages(vmf, start_pgoff, end_pgoff); + return ret; +} + +static vm_fault_t xmfs_mkwrite(struct vm_fault *vmf) +{ + vm_fault_t ret = filemap_page_mkwrite(vmf); + return ret; +} + +static const struct vm_operations_struct xmfs_file_vm_ops = { + .fault = xmfs_fault, + .map_pages = xmfs_map_pages, + .page_mkwrite = xmfs_mkwrite, +}; + +static const struct vm_operations_struct xmfs_slave_file_vm_ops = { + .fault = xmfs_slave_fault, + .map_pages = xmfs_map_pages, + .page_mkwrite = xmfs_mkwrite, +}; + +static int xmfs_file_mmap(struct file *file, struct vm_area_struct *vma) +{ + struct xmfs_sb_info *sbi = XMFS_SB(file_inode(file)->i_sb); + + file_accessed(file); + if (sbi->id) + vma->vm_ops = &xmfs_slave_file_vm_ops; + else + vma->vm_ops = &xmfs_file_vm_ops; + return 0; +} + +static int xmfs_slave_writepage(struct page *page, + struct writeback_control *wbc) +{ + struct address_space *mapping = page->mapping; + struct inode *inode = mapping->host; + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + unsigned long mapped_offset; + + if (!(inode->i_sb->s_flags & SB_ACTIVE)) { + unlock_page(page); + return 0; + } + + mapped_offset = + (unsigned long)xa_load(&xmfs_inode->shared_pages, page->index); + if (mapped_offset) { + unlock_page(page); + return 0; + } + { + struct xmfs_rw_msg req = {}, grant = {}; + unsigned long log_off; + int err; + + req.ops = XMFS_UPDATE; + req.i_ino = inode->i_ino; + req.data_pages = 1; + req.log_entries = 1; + req.size = i_size_read(inode); + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + struct xmfs_grant_wait gw; + + init_completion(&gw.done); + xa_store(&sbi->urma_cfg.grant_waits, req.request_id, &gw, + GFP_KERNEL); + err = xmfs_send_request(sbi, &req, &gw, 0); + if (err) { + if (!(inode->i_sb->s_flags & SB_ACTIVE)) { + unlock_page(page); + return 0; + } + redirty_page_for_writepage(wbc, page); + unlock_page(page); + return err; + } + grant = gw.grant; + if (grant.type == MSG_RW_ERROR) { + if (!(inode->i_sb->s_flags & SB_ACTIVE)) { + unlock_page(page); + return 0; + } + redirty_page_for_writepage(wbc, page); + unlock_page(page); + return -ENOSPC; + } + { + char *kaddr = kmap_local_page(page); + + xmfs_data_write(sbi, grant.data_addr, kaddr, PAGE_SIZE); + kunmap_local(kaddr); + } + log_off = grant.log_trunk_addr + + offsetof(struct xmfs_log_trunk, log[0]) + + grant.log_slot_start * sizeof(struct xmfs_log); + { + struct xmfs_log xm_log = {}; + + xm_log.index = page->index; + xm_log.end_index = page->index + 1; + xm_log.ops = XMFS_UPDATE; + xm_log.size = i_size_read(inode); + xm_log.data_offset = grant.data_addr; + xm_log.version = grant.version; + xm_log.writer_id = sbi->id; + xmfs_data_write(sbi, log_off, &xm_log, sizeof(xm_log)); + } + /* xmfs_mark_page_live(sbi, grant.data_addr); */ + { + void *old_ret = + xa_store(&xmfs_inode->shared_pages, page->index, + (void *)grant.data_addr, GFP_KERNEL); + /* xmfs_mark_page_dead(sbi, (unsigned long)old_ret); */ + if (xa_err(old_ret)) + xmfs_error(sbi->sb, + "slave writepage cannot store shared pages for page %ld", + page->index); + } + unlock_page(page); + return 0; + } +} + +static int xmfs_writepage(struct page *page, struct writeback_control *wbc) +{ + struct address_space *mapping = page->mapping; + struct inode *inode = mapping->host; + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + if (sbi->id != 0) + return xmfs_slave_writepage(page, wbc); + + if (sbi->mode == XMFS_URMA_MODE) { + redirty_page_for_writepage(wbc, page); + unlock_page(page); + return 0; + } + + if (inode_is_locked(inode)) { + redirty_page_for_writepage(wbc, page); + unlock_page(page); + return 0; + } + if (!inode || !XMFS_I(inode)) { + xmfs_info(sbi->sb, "no inode now for write page"); + unlock_page(page); + return -EINVAL; + } + struct xmfs_log xm_log; + + if (sbi == NULL || sbi->kaddr == NULL) { + unlock_page(page); + return 0; + } + unsigned long xmlt_addr; + + if (!spin_trylock(&sbi->space_lock)) { + redirty_page_for_writepage(wbc, page); + unlock_page(page); + return -EAGAIN; + } + if (XMFS_I(inode)->die) { + xmfs_info(sbi->sb, + "inode logs have been interrupted before writepage"); + spin_unlock(&sbi->space_lock); + unlock_page(page); + return -EINVAL; + } + + if (XMFS_I(inode)->fallocate && + page->index > XMFS_I(inode)->data_size / PAGE_SIZE) { + xmfs_error(sbi->sb, + "writepage do not support write more than fallocate size"); + spin_unlock(&sbi->space_lock); + unlock_page(page); + return -EOPNOTSUPP; + } + + struct xmfs_sb_index *xmsi = get_xmsi(sbi); + + if (!xmsi) { + spin_unlock(&sbi->space_lock); + unlock_page(page); + return -EINVAL; + } + unsigned long data_current = xmsi->data_current; + unsigned long data_count = xmsi->data_count; + unsigned long data_offset; + + int logcount = 1; + int need_data_trunk = (data_count == 511 || data_current == 0) ? 1 : 0; + + if (logcount + xmsi->used_trunk_count + need_data_trunk > + sbi->max_chunk) { + sbi->full = true; + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + unlock_page(page); + return -ENOSPC; + } + if (data_current == 0 || data_count == 511) { + long slot = xmfs_alloc_and_mark_slot(xmsi, sbi, 'd'); + + if (slot < 0) { + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + unlock_page(page); + return -ENOSPC; + } + data_offset = + DATA_AREA_OFFSET + slot * sbi->trunk_size + PAGE_SIZE; + xmsi->data_current = data_offset; + xmsi->data_count = 0; + } else { + data_offset = data_current + PAGE_SIZE; + xmsi->data_current = data_offset; + xmsi->data_count = data_count + 1; + } + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + + loff_t pos = (xm_log.index + 1) * PAGE_SIZE; + + xm_log.index = page->index; + xm_log.end_index = xm_log.index + 1; + xm_log.ops = XMFS_UPDATE; + xm_log.p_ino = 0; + xm_log.size = min(i_size_read(inode), pos); + xm_log.offset = xm_log.index * PAGE_SIZE; + xm_log.writer_id = sbi->id; + if (XMFS_I(inode)->fallocate) { + xm_log.data_offset = + xmfs_get_data_offset_fallocate(inode, sbi, page); + } else { + char *kaddr = kmap_local_page(page); + + xmfs_data_write(sbi, data_offset, kaddr, PAGE_SIZE); + arch_invalidate_pmem(sbi->kaddr + data_offset, PAGE_SIZE); + kunmap_local(kaddr); + xm_log.data_offset = data_offset; + } + + void *old_ret = xa_store(&(XMFS_I(inode)->shared_pages), page->index, + (void *)xm_log.data_offset, GFP_KERNEL); + if (xa_err(old_ret)) { + xmfs_error(sbi->sb, "wb cannot store shared pages for page %ld", + page->index); + } + xmfs_mark_page_dead(sbi, (unsigned long)old_ret); + xmfs_mark_page_live(sbi, xm_log.data_offset); + + xmlt_addr = xmfs_add_log_v3(&xm_log, sbi, 0, inode->i_ino, true); + if (xmlt_addr < 0) { + xmfs_info(sbi->sb, "writepage wrong"); + XMFS_I(inode)->die = true; + unlock_page(page); + return -EINVAL; + } + unlock_page(page); + + return 0; +} + +static int xmfs_fsync(struct file *file, loff_t start, loff_t end, int datasync) +{ + return write_inode_now(file->f_mapping->host, 1); +} + +static int xmfs_release(struct inode *inode, struct file *file) +{ + if (XMFS_I(inode)->tmp) { + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + struct xmfs_log xm_log = { 0 }; + unsigned long xmlt_addr; + + if (inode->__i_nlink > 1) + xm_log.index = -1; + else + xm_log.index = 0; + xm_log.end_index = -1; + xm_log.ops = XMFS_DELETE; + xm_log.data_offset = 0; + memcpy(xm_log.name, file->f_path.dentry->d_name.name, + min(strlen(file->f_path.dentry->d_name.name), + 255UL)); + xm_log.p_ino = parent_ino(file->f_path.dentry); + + struct xmfs_sb_index *xmsi; + + spin_lock(&sbi->space_lock); + xmsi = get_xmsi(sbi); + if (!xmsi) { + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + int logcount = 1; + + if (logcount + xmsi->used_trunk_count > sbi->max_chunk) { + sbi->full = true; + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + if (XMFS_I(inode)->die) { + xmfs_info(sbi->sb, + "inode logs have been interrupted before close tmpfile"); + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -EINVAL; + } + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + xmlt_addr = xmfs_add_log_v3(&xm_log, sbi, + min(strlen(file->f_path.dentry->d_name.name), + 255UL), + inode->i_ino, true); + if (xmlt_addr < 0) { + XMFS_I(inode)->die = true; + return -EINVAL; + } + } + return 0; +} + +long xmfs_common_fallocate(struct inode *inode, int mode, loff_t offset, + loff_t len) +{ + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + if (xmfs_quiesce_wait(sbi)) + return -EINTR; + /* per-FS log: data_size/data_start now in inode_info */ + while (XMFS_I(inode)->fallocate && XMFS_I(inode)->data_size != 0) { + struct xmfs_log_trunk *xmlt_local = + kmalloc(sizeof(struct xmfs_log_trunk), GFP_KERNEL); + int err = get_log_trunk_and_copy(sbi, XMFS_I(inode)->log_start, + xmlt_local, false); + if (unlikely(err)) { + xmfs_error(sbi->sb, + "hardware memory error when reading xm log trunk during fallocate."); + kfree(xmlt_local); + break; + } + XMFS_I(inode)->fallocate = true; + /* data_start from inode_info */ + /* data_size from inode_info */ + kfree(xmlt_local); + return 0; + } + struct xmfs_sb_index *xmsi = get_xmsi(sbi); + + if (!xmsi) + return 0; + long first_slot = -1, slot; + int ti; + unsigned long num_trunks = + (len + sbi->trunk_size - 1) / sbi->trunk_size; + if (xmsi->used_trunk_count + num_trunks > sbi->max_chunk) { + xmfs_info(sbi->sb, "fallocate more space %lu %lu than total", + (unsigned long)len, num_trunks); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + XMFS_I(inode)->fallocate = true; + for (ti = 0; ti < (int)num_trunks; ti++) { + slot = xmfs_alloc_and_mark_slot(xmsi, sbi, 'd'); + if (slot < 0) { + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + if (first_slot < 0) + first_slot = slot; + } + XMFS_I(inode)->data_start = + DATA_AREA_OFFSET + first_slot * sbi->trunk_size; + XMFS_I(inode)->data_size = len; + XMFS_I(inode)->data_start = XMFS_I(inode)->data_start; + XMFS_I(inode)->data_size = XMFS_I(inode)->data_size; + xmsi->data_current = DATA_AREA_OFFSET + first_slot * sbi->trunk_size + + num_trunks * sbi->trunk_size; + xmsi->data_count = 0; + + put_xmsi(sbi, xmsi); + + return 0; +} + +static long xmfs_file_fallocate(struct file *file, int mode, loff_t offset, + loff_t len) +{ + if ((mode & FALLOC_FL_KEEP_SIZE) == 0 || offset != 0) + return -EOPNOTSUPP; + + struct inode *inode = file_inode(file); + + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + if (xmfs_quiesce_wait(sbi)) + return -EINTR; + if (!sbi->debug) + return -EOPNOTSUPP; + + spin_lock(&sbi->space_lock); + long err = xmfs_common_fallocate(inode, mode, offset, len); + + spin_unlock(&sbi->space_lock); + return err; +} + +static const struct address_space_operations xmfs_aops = { + .writepage = xmfs_writepage, + .write_begin = xmfs_write_begin, + .write_end = xmfs_write_end, + .dirty_folio = filemap_dirty_folio, + /* .free_folio = xmfs_free_folio, */ +}; + +static const struct file_operations xmfs_file_operations = { + .release = xmfs_release, + .read_iter = xmfs_file_read_iter, + .write_iter = xmfs_file_write_iter, + .splice_read = xmfs_file_splice_read, + .splice_write = iter_file_splice_write, + .mmap = xmfs_file_mmap, + .fsync = xmfs_fsync, + .llseek = xmfs_file_llseek, + .fallocate = xmfs_file_fallocate, +}; + +static const struct inode_operations xmfs_file_inode_operations = { + .getattr = xmfs_getattr, + .setattr = xmfs_setattr, + .listxattr = xmfs_listxattr, + .update_time = xmfs_update_time, +}; + +void xmfs_init_file_mapping(struct inode *inode) +{ + inode->i_mapping->a_ops = &xmfs_aops; +} + +void xmfs_init_file_inode(struct inode *inode) +{ + inode->i_op = &xmfs_file_inode_operations; + xmfs_init_file_mapping(inode); + inode->i_fop = &xmfs_file_operations; +} diff --git a/fs/xmfs/gc.c b/fs/xmfs/gc.c new file mode 100644 index 000000000000..7df7d8a1c6fe --- /dev/null +++ b/fs/xmfs/gc.c @@ -0,0 +1,953 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include "xmfs_i.h" +#include <linux/dcache.h> +#include <linux/kthread.h> +#include <linux/delay.h> +#include <linux/ktime.h> +#include <linux/cacheflush.h> + +void xmfs_mark_page_dead(struct xmfs_sb_info *sbi, unsigned long data_offset) +{ + unsigned long trunk_offset; + + if (data_offset == 0 || data_offset < DATA_AREA_OFFSET) + return; + + trunk_offset = data_offset & ~(sbi->trunk_size - 1); + if (trunk_offset < DATA_AREA_OFFSET) + return; + + if (sbi->mode != XMFS_URMA_MODE) { + struct xmfs_data_trunk_header *header; + + header = (struct xmfs_data_trunk_header *)(sbi->kaddr + + trunk_offset); + if (header->magic != XMFS_DATA_TRUNK_MAGIC) + return; + if (header->live_page_count == 0) + return; + header->live_page_count--; + } else { + unsigned long magic_off = trunk_offset; + unsigned long magic_val; + unsigned long count_off = + trunk_offset + offsetof(struct xmfs_data_trunk_header, + live_page_count); + uint64_t old_count, new_count; + + xmfs_pmem_read(sbi, magic_off, &magic_val, sizeof(magic_val)); + if (magic_val != XMFS_DATA_TRUNK_MAGIC) + return; + + do { + xmfs_pmem_read(sbi, count_off, &old_count, + sizeof(old_count)); + new_count = old_count - 1; + } while (xmfs_pmem_cas(sbi, count_off, old_count, new_count) != + 0); + } +} +EXPORT_SYMBOL(xmfs_mark_page_dead); + +void xmfs_mark_page_live(struct xmfs_sb_info *sbi, unsigned long data_offset) +{ + unsigned long trunk_offset; + + if (data_offset == 0 || data_offset < DATA_AREA_OFFSET) + return; + + trunk_offset = data_offset & ~(sbi->trunk_size - 1); + if (trunk_offset < DATA_AREA_OFFSET) + return; + + if (sbi->mode != XMFS_URMA_MODE) { + struct xmfs_data_trunk_header *header; + + header = (void *)(sbi->kaddr + trunk_offset); + if (header->magic != XMFS_DATA_TRUNK_MAGIC) + return; + header->live_page_count++; + /* cmpxchg(&header->last_modify_version, (unsigned long)-1, 0); */ + } else { + unsigned long magic_off = trunk_offset; + unsigned long magic_val; + /* + * unsigned long lmv_off = trunk_offset + + * offsetof(struct xmfs_data_trunk_header, + * last_modify_version); + */ + unsigned long count_off = + trunk_offset + offsetof(struct xmfs_data_trunk_header, + live_page_count); + uint64_t old_count, new_count; + + xmfs_pmem_read(sbi, magic_off, &magic_val, sizeof(magic_val)); + if (magic_val != XMFS_DATA_TRUNK_MAGIC) + return; + + do { + xmfs_pmem_read(sbi, count_off, &old_count, + sizeof(old_count)); + new_count = old_count + 1; + } while (xmfs_pmem_cas(sbi, count_off, old_count, new_count) != + 0); + + /* xmfs_pmem_cas(sbi, lmv_off, (uint64_t)-1, 0); */ + } +} +EXPORT_SYMBOL(xmfs_mark_page_live); + +int xmfs_quiesce_wait(struct xmfs_sb_info *sbi) +{ + int ret; + + ret = wait_event_interruptible(sbi->gc_ctl.wait, + !READ_ONCE(sbi->gc_ctl.gc_running)); + + if (ret) + return ret; + + return 0; +} +EXPORT_SYMBOL(xmfs_quiesce_wait); + +long xmfs_find_free_slot(struct xmfs_sb_index *xmsi, struct xmfs_sb_info *sbi) +{ + unsigned long i; + + if (xmsi->count < sbi->max_chunk) + return xmsi->count; + + for (i = 0; i < xmsi->count && i < XMFS_BITMAP_CAPACITY; i++) { + if (xmsi->bitmap[i] == 'u') + return i; + } + + return -1; +} + +long xmfs_alloc_and_mark_slot(struct xmfs_sb_index *xmsi, + struct xmfs_sb_info *sbi, char type) +{ + long slot = xmfs_find_free_slot(xmsi, sbi); + + if (slot < 0) + return -1; + if (slot < (long)xmsi->count) + memset(sbi->kaddr + DATA_AREA_OFFSET + slot * sbi->trunk_size, + 0, sbi->trunk_size); + xmsi->bitmap[slot] = type; + if (type == 'd') { + struct xmfs_data_trunk_header *hdr; + + hdr = (void *)(sbi->kaddr + DATA_AREA_OFFSET + + slot * sbi->trunk_size); + hdr->magic = XMFS_DATA_TRUNK_MAGIC; + hdr->last_modify_version = 0; + hdr->live_page_count = 0; + } + if (slot == (long)xmsi->count) + xmsi->count = slot + 1; + xmsi->used_trunk_count++; + return slot; +} + +static void write_log_entry_fields(struct xmfs_log_trunk *xmlt, + struct xmfs_log *xm_log, unsigned long ino, + unsigned long version, int slot, + size_t namelen) +{ + xmlt->log[slot].index = xm_log->index; + xmlt->log[slot].end_index = xm_log->end_index; + xmlt->log[slot].ops = xm_log->ops; + xmlt->log[slot].data_offset = xm_log->data_offset; + xmlt->log[slot].mode = xm_log->mode; + xmlt->log[slot].size = xm_log->size; + xmlt->log[slot].i_ino = ino; + xmlt->log[slot].offset = xm_log->offset; + xmlt->log[slot].version = version; + xmlt->log[slot].writer_id = xm_log->writer_id; + + if (xm_log->ops != XMFS_UPDATE) { + memcpy(xmlt->log[slot].name, xm_log->name, namelen); + xmlt->log[slot].name[namelen] = '\0'; + xmlt->log[slot].p_ino = xm_log->p_ino; + } +} + +unsigned long xmfs_add_log_v3(struct xmfs_log *xm_log, struct xmfs_sb_info *sbi, + size_t namelen, unsigned long ino, + bool update_version) +{ + unsigned long version; + struct xmfs_sb_index *xmsi; + struct xmfs_log_trunk *xmlt; + unsigned long addr; + long slot; + + down_read(&sbi->chain_rwsem); + + spin_lock(&sbi->version_lock); + sbi->last_update++; + version = sbi->last_update; + spin_unlock(&sbi->version_lock); + + spin_lock(&sbi->space_lock); + + xmsi = get_xmsi(sbi); + if (!xmsi) { + spin_unlock(&sbi->space_lock); + up_read(&sbi->chain_rwsem); + return (unsigned long)-1; + } + + xm_log->writer_id = 0; + + if (xmsi->log_current == 0 || xmsi->count == 0) { + slot = xmfs_alloc_and_mark_slot(xmsi, sbi, 'l'); + if (slot < 0) { + put_xmsi(sbi, xmsi); + spin_unlock(&sbi->space_lock); + up_read(&sbi->chain_rwsem); + return (unsigned long)-1; + } + addr = DATA_AREA_OFFSET + slot * sbi->trunk_size; + xmlt = get_log_trunk(sbi, addr); + xmlt->used = 0; + xmlt->next_trunk = 0; + xmlt->version_base = version; + xmlt->version_max = 0; + + xmsi->log_start = addr; + xmsi->log_current = addr; + } else { + xmlt = get_log_trunk(sbi, xmsi->log_current); + } + + if (xmlt->used >= MAX_LOG_PER_TRUNK) { + xmlt->version_max = version - 1; + + slot = xmfs_alloc_and_mark_slot(xmsi, sbi, 'l'); + if (slot < 0) { + put_xmsi(sbi, xmsi); + spin_unlock(&sbi->space_lock); + up_read(&sbi->chain_rwsem); + return (unsigned long)-1; + } + addr = DATA_AREA_OFFSET + slot * sbi->trunk_size; + xmlt->next_trunk = addr; + put_log_trunk(sbi, xmlt); + xmlt = get_log_trunk(sbi, addr); + xmlt->used = 0; + xmlt->next_trunk = 0; + xmlt->version_base = version; + xmlt->version_max = 0; + xmsi->log_current = addr; + } + + write_log_entry_fields(xmlt, xm_log, ino, version, xmlt->used, namelen); + xmlt->used++; + + addr = xmsi->log_current; + + if (xm_log->ops == XMFS_UPDATE) { + unsigned long trunk_off = xm_log->data_offset & + ~(sbi->trunk_size - 1); + struct xmfs_data_trunk_header *hdr = + (void *)(sbi->kaddr + trunk_off); + if (hdr->magic == XMFS_DATA_TRUNK_MAGIC && + version > hdr->last_modify_version) + hdr->last_modify_version = version; + } else if (xm_log->ops == XMFS_XATTR && + xm_log->data_offset >= DATA_AREA_OFFSET) { + unsigned long trunk_off = xm_log->data_offset & + ~(sbi->trunk_size - 1); + struct xmfs_data_trunk_header *hdr = + (void *)(sbi->kaddr + trunk_off); + if (hdr->magic == XMFS_DATA_TRUNK_MAGIC && + version > hdr->last_modify_version) + hdr->last_modify_version = version; + } else if (xm_log->ops == XMFS_SYMLINK && + xm_log->end_index >= DATA_AREA_OFFSET) { + unsigned long trunk_off = xm_log->end_index & + ~(sbi->trunk_size - 1); + struct xmfs_data_trunk_header *hdr = + (void *)(sbi->kaddr + trunk_off); + if (hdr->magic == XMFS_DATA_TRUNK_MAGIC && + version > hdr->last_modify_version) + hdr->last_modify_version = version; + } + + if (update_version) { + spin_lock(&sbi->version_lock); + if (version > xmsi->last_update) + xmsi->last_update = version; + spin_unlock(&sbi->version_lock); + } + + put_log_trunk(sbi, xmlt); + put_xmsi(sbi, xmsi); + spin_unlock(&sbi->space_lock); + up_read(&sbi->chain_rwsem); + + return addr + offsetof(struct xmfs_log_trunk, log[0]) + + (xmlt->used - 1) * sizeof(struct xmfs_log); +} + +static void gc_tail_compact(struct xmfs_sb_index *xmsi) +{ + while (xmsi->count > 0 && xmsi->count <= XMFS_BITMAP_CAPACITY && + xmsi->bitmap[xmsi->count - 1] == 'u') + xmsi->count--; +} + +static unsigned long gc_reclaim_log_trunks(struct xmfs_sb_info *sbi, + unsigned long safe_version) +{ + struct xmfs_sb_index *xmsi; + struct xmfs_log_trunk *xmlt; + unsigned long trunk_offset; + unsigned long next_trunk_offset; + unsigned long max_ver_reclaimed = 0; + unsigned long reclaimed = 0; + unsigned long first_surviving_trunk = 0; + + xmsi = get_xmsi(sbi); + if (!xmsi) + return 0; + if (safe_version == 0) { + put_xmsi(sbi, xmsi); + return 0; + } + + trunk_offset = xmsi->log_start; + + while (trunk_offset != 0) { + xmlt = get_log_trunk(sbi, trunk_offset); + if (!xmlt) + break; + + if (xmlt->version_max == 0) { + if (first_surviving_trunk == 0) + first_surviving_trunk = trunk_offset; + put_log_trunk(sbi, xmlt); + break; + } + + if (xmlt->version_max > safe_version) { + if (first_surviving_trunk == 0) + first_surviving_trunk = trunk_offset; + put_log_trunk(sbi, xmlt); + break; + } + + if (xmlt->version_max > max_ver_reclaimed) + max_ver_reclaimed = xmlt->version_max; + + next_trunk_offset = xmlt->next_trunk; + put_log_trunk(sbi, xmlt); + + spin_lock(&sbi->space_lock); + { + unsigned long idx = (trunk_offset - DATA_AREA_OFFSET) / + sbi->trunk_size; + memset(sbi->kaddr + trunk_offset, 0, sbi->trunk_size); + if (idx < XMFS_BITMAP_CAPACITY) + xmsi->bitmap[idx] = 'u'; + if (xmsi->used_trunk_count > 0) + xmsi->used_trunk_count--; + sbi->full = false; + } + spin_unlock(&sbi->space_lock); + reclaimed++; + + trunk_offset = next_trunk_offset; + } + + if (first_surviving_trunk != 0) + xmsi->log_start = first_surviving_trunk; + xmfs_info(sbi->sb, "gc log ends, gc to %ld, release %ld", + first_surviving_trunk, reclaimed); + spin_lock(&sbi->space_lock); + while (xmsi->count > 0 && xmsi->count <= XMFS_BITMAP_CAPACITY && + xmsi->bitmap[xmsi->count - 1] == 'u') + xmsi->count--; + spin_unlock(&sbi->space_lock); + + put_xmsi(sbi, xmsi); + return max_ver_reclaimed; +} + +static void gc_scan_data_trunks(struct xmfs_sb_info *sbi, + unsigned long safe_version) +{ + struct xmfs_sb_index *xmsi; + struct xmfs_data_trunk_header *header; + unsigned long trunk_offset; + unsigned long trunk_index; + unsigned long batch_count = 0; + + xmsi = get_xmsi(sbi); + if (!xmsi) + return; + + for (trunk_index = sbi->gc_ctl.gc_cursor; + trunk_index < + sbi->max_chunk /*&& batch_count < sbi->gc_ctl.gc_batch*/; + trunk_index++) { + if (trunk_index < XMFS_BITMAP_CAPACITY && + xmsi->bitmap[trunk_index] != 'd') + continue; + + trunk_offset = DATA_AREA_OFFSET + trunk_index * sbi->trunk_size; + header = (struct xmfs_data_trunk_header *)(sbi->kaddr + + trunk_offset); + if (header->magic != XMFS_DATA_TRUNK_MAGIC) + continue; + + if (header->live_page_count > 0) + continue; + + if (header->last_modify_version > safe_version) + continue; + + xmfs_info(sbi->sb, + "gc: reclaiming data trunk[%lu] live_pages=%lu ver=%lu", + trunk_index, header->live_page_count, + header->last_modify_version); + spin_lock(&sbi->space_lock); + memset(sbi->kaddr + trunk_offset, 0, sbi->trunk_size); + if (trunk_index < XMFS_BITMAP_CAPACITY) + xmsi->bitmap[trunk_index] = 'u'; + if (xmsi->used_trunk_count > 0) + xmsi->used_trunk_count--; + sbi->full = false; + batch_count++; + spin_unlock(&sbi->space_lock); + } + + spin_lock(&sbi->space_lock); + sbi->gc_ctl.gc_cursor = trunk_index; + if (sbi->gc_ctl.gc_cursor >= sbi->max_chunk) + sbi->gc_ctl.gc_cursor = 0; + gc_tail_compact(xmsi); + spin_unlock(&sbi->space_lock); + + put_xmsi(sbi, xmsi); +} + +static unsigned long gc_compute_safe_version(struct xmfs_sb_info *sbi) +{ + struct mount_msg_info *mm_info; + unsigned long safe_version; + int i; + + safe_version = sbi->last_update; + + if (sbi->mode == XMFS_SHARED_MEM_MODE || + sbi->mode == XMFS_HYBRID_MODE) { + mm_info = sbi->kaddr + MOUNT_MSG_OFFSET; + } else { + mm_info = get_mnt_msg(sbi); + if (!mm_info) + return safe_version; + } + + for (i = 1; i <= sbi->max_slave_id && i < 64; i++) { + if (mm_info->msg[i] == 'D') { + unsigned long sv = mm_info->slave_versions[i]; + + if (sv < safe_version) + safe_version = sv; + } + } + + if (sbi->mode == XMFS_URMA_MODE) + put_mnt_msg(sbi, mm_info); + + xmfs_info(sbi->sb, + "gc: safe_version=%lu (last_update=%lu, max_slave=%d)", + safe_version, sbi->last_update, sbi->max_slave_id); + return safe_version; +} + +static void xmfs_gc_run(struct xmfs_sb_info *sbi) +{ + unsigned long safe_version; + struct mount_msg_info *mm_info; +#ifdef CONFIG_XMFS_FS_URMA + struct xmfs_rw_msg req; +#endif + bool all_caught_up; + int i; + + if (sbi->id != 0) + return; + + xmfs_replay_new_entries(sbi, NULL, -1); + + spin_lock(&sbi->gc_ctl.gc_lock); + if (sbi->gc_ctl.gc_running) { + spin_unlock(&sbi->gc_ctl.gc_lock); + return; + } + WRITE_ONCE(sbi->gc_ctl.gc_running, true); + spin_unlock(&sbi->gc_ctl.gc_lock); + + safe_version = gc_compute_safe_version(sbi); + + mm_info = get_mnt_msg(sbi); + + if (mm_info) { +#ifdef CONFIG_XMFS_FS_URMA + for (i = 1; i < 16; i++) { + if (sbi->urma_cfg.send_tjettys[i] == NULL) + continue; + req.ops = XMFS_GC; + req.status = 2; + xmfs_send_request(sbi, &req, NULL, i); + } +#endif + all_caught_up = true; + for (i = 1; i <= sbi->max_slave_id && i < 64; i++) { + if (mm_info->msg[i] == 'D' && + mm_info->slave_versions[i] < safe_version) { + all_caught_up = false; + break; + } + } + + if (!all_caught_up) { + xmfs_info(sbi->sb, + "gc: waiting for slaves to catch up to version %lu", + safe_version); + schedule_timeout_interruptible(10 * HZ); + mm_info = get_mnt_msg(sbi); + if (mm_info) { + all_caught_up = true; + for (i = 1; i <= sbi->max_slave_id && i < 64; + i++) { + if (mm_info->msg[i] == 'D' && + mm_info->slave_versions[i] < + safe_version) { + all_caught_up = false; + break; + } + } + put_mnt_msg(sbi, mm_info); + } + } + } + + down_write(&sbi->chain_rwsem); + if (all_caught_up) { +#ifdef CONFIG_XMFS_FS_URMA + for (i = 1; i < 16; i++) { + if (sbi->urma_cfg.send_tjettys[i] == NULL) + continue; + req.ops = XMFS_GC; + req.status = 1; + xmfs_send_request(sbi, &req, NULL, i); + } +#endif + gc_reclaim_log_trunks(sbi, safe_version); +#ifdef CONFIG_XMFS_FS_URMA + for (i = 1; i < 16; i++) { + if (sbi->urma_cfg.send_tjettys[i] == NULL) + continue; + req.ops = XMFS_GC; + req.status = 0; + xmfs_send_request(sbi, &req, NULL, i); + } +#endif + } + gc_scan_data_trunks(sbi, safe_version); + up_write(&sbi->chain_rwsem); + + spin_lock(&sbi->gc_ctl.gc_lock); + WRITE_ONCE(sbi->gc_ctl.gc_running, false); + wake_up_all(&sbi->gc_ctl.wait); + spin_unlock(&sbi->gc_ctl.gc_lock); +} + +int xmfs_gc_main(struct xmfs_sb_info *sbi) +{ + xmfs_gc_run(sbi); + return 0; +} + +int xmfs_gc_thread_fn(void *data) +{ + struct xmfs_sb_info *sbi = data; + struct xmfs_sb_index *xmsi; + unsigned long interval; + + interval = sbi->gc_interval ? sbi->gc_interval : + XMFS_GC_INTERVAL_DEFAULT; + + while (!kthread_should_stop()) { + xmsi = get_xmsi(sbi); + /* + * xmfs_info(sbi->sb, "gc %d %d %d", + * xmsi->used_trunk_count, + * sbi->max_chunk * 80 / 100, sbi->max_chunk); + */ + if (xmsi && + (xmsi->used_trunk_count >= sbi->max_chunk * 80 / 100 || + sbi->full)) + xmfs_gc_run(sbi); + if (xmsi) + put_xmsi(sbi, xmsi); + schedule_timeout_interruptible(interval * HZ); + } + + return 0; +} + +int xmfs_gc_thread_slave_fn(void *data) +{ + struct xmfs_sb_info *sbi = data; + unsigned long interval; + + interval = sbi->gc_interval ? sbi->gc_interval : + XMFS_GC_INTERVAL_DEFAULT; + + while (!kthread_should_stop()) { + if (sbi->gc_ctl.need_replay) { + xmfs_info(sbi->sb, "gc need to replay"); + xmfs_replay_new_entries(sbi, NULL, -1); + xmfs_info(sbi->sb, "gc need to replay done"); + sbi->gc_ctl.need_replay = false; + } + schedule_timeout_interruptible(interval * HZ); + } + + return 0; +} + +static int xmfs_host_reserve_data_space(struct xmfs_sb_info *sbi, + unsigned long page_count, + struct xmfs_data_reserve_result *result) +{ + struct xmfs_sb_index *xmsi = get_xmsi(sbi); + unsigned long data_current, data_count; + long slot; + struct xmfs_data_trunk_header *hdr; + unsigned long remaining; + int trunk_idx; + bool first_partial = false; + + if (!xmsi) + return -ENOSPC; + + memset(result, 0, sizeof(*result)); + trunk_idx = 0; + + data_current = xmsi->data_current; + data_count = xmsi->data_count; + remaining = 511 - data_count; + if (remaining + 511 * (sbi->max_chunk - xmsi->count) < page_count) { + xmfs_info(sbi->sb, + "try to allocate more than usable space %lu > %lu", + page_count, + remaining + 511 * (sbi->max_chunk - xmsi->count)); + return -ENOSPC; + } + + if (data_current != 0 && remaining > 0) { + unsigned long use = min(page_count, remaining); + + hdr = (struct xmfs_data_trunk_header *)(sbi->kaddr + + (data_current & + ~(sbi->trunk_size - + 1))); + result->data_addr = data_current; + result->data_page_count = use; + result->trunk_addrs[trunk_idx] = data_current & + ~(sbi->trunk_size - 1); + trunk_idx++; + + xmsi->data_current = data_current + use * PAGE_SIZE; + xmsi->data_count = data_count + use; + hdr->total_page_count = data_count + use; + /* hdr->live_page_count += use; */ + + page_count -= use; + if (page_count == 0) { + put_xmsi(sbi, xmsi); + result->trunk_count = trunk_idx; + return 0; + } + first_partial = true; + } + + while (page_count > 0) { + unsigned long use; + + slot = xmfs_alloc_and_mark_slot(xmsi, sbi, 'd'); + if (slot < 0) { + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + data_current = DATA_AREA_OFFSET + slot * sbi->trunk_size; + hdr = (struct xmfs_data_trunk_header *)(sbi->kaddr + + data_current); + memset(hdr, 0, PAGE_SIZE); + hdr->magic = XMFS_DATA_TRUNK_MAGIC; + hdr->last_modify_version = 0; + + use = min_t(unsigned long, page_count, 511); + + if (!first_partial && trunk_idx == 0) { + result->data_addr = data_current + PAGE_SIZE; + result->data_page_count = use; + } else if (result->second_data_addr == 0) { + result->second_data_addr = data_current + PAGE_SIZE; + result->second_data_pages = use; + } else { + result->second_data_pages += use; + } + result->trunk_addrs[trunk_idx] = data_current; + trunk_idx++; + + hdr->total_page_count = use; + /* hdr->live_page_count = use; */ + + if (use < 511) { + xmsi->data_current = + data_current + PAGE_SIZE + use * PAGE_SIZE; + xmsi->data_count = use; + } else { + xmsi->data_current = 0; + xmsi->data_count = 511; + } + + page_count -= use; + } + + result->trunk_count = trunk_idx; + put_xmsi(sbi, xmsi); + return 0; +} + +static unsigned long xmfs_host_reserve_log_space(struct xmfs_sb_info *sbi, + unsigned long ino, + int entry_count) +{ + struct xmfs_sb_index *xmsi = get_xmsi(sbi); + struct xmfs_log_trunk *xmlt; + unsigned long addr; + long slot; + + if (!xmsi) + return 0; + + xmlt = get_log_trunk(sbi, xmsi->log_current); + if (!xmlt || xmlt->used + entry_count > MAX_LOG_PER_TRUNK) { + if (xmlt) { + xmlt->version_max = sbi->last_update; + put_log_trunk(sbi, xmlt); + } + slot = xmfs_alloc_and_mark_slot(xmsi, sbi, 'l'); + if (slot < 0 || slot >= sbi->max_chunk) { + xmfs_info(sbi->sb, + "cannot get a correct slot %ld, maybe space is full", + slot); + put_xmsi(sbi, xmsi); + return 0; + } + addr = DATA_AREA_OFFSET + slot * sbi->trunk_size; + xmlt = get_log_trunk(sbi, addr); + xmlt->used = 0; + xmlt->next_trunk = 0; + xmlt->version_base = sbi->last_update + 1; + xmlt->version_max = 0; + put_log_trunk(sbi, xmlt); + { + struct xmfs_log_trunk *old = + get_log_trunk(sbi, xmsi->log_current); + if (old) { + old->next_trunk = addr; + put_log_trunk(sbi, old); + } + } + xmsi->log_current = addr; + sbi->log_current = + addr + offsetof(struct xmfs_log_trunk, log[0]); + xmlt = get_log_trunk(sbi, addr); + } + + addr = xmsi->log_current; + put_log_trunk(sbi, xmlt); + put_xmsi(sbi, xmsi); + return addr; +} + +void xmfs_host_handle_urma_request(struct xmfs_sb_info *sbi, int slave_i, + struct xmfs_rw_msg *req, + struct xmfs_rw_msg *grant) +{ + struct xmfs_log_trunk *xmlt; + struct xmfs_data_reserve_result dr; + unsigned long log_addr; + int log_needed; + int data_err; + + if (xmfs_quiesce_wait(sbi)) + return; + + if (req->ops == XMFS_SETATTR) { + spin_lock(&sbi->space_lock); + struct xmfs_inode_table *tbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + unsigned long ci; + struct iattr *attr = (struct iattr *)req->name; + time64_t ts_sec = ktime_get_real_seconds(); + + for (ci = 0; ci < tbl->count; ci++) { + if (tbl->entries[ci].i_ino == req->i_ino) { + if (attr->ia_valid & ATTR_SIZE) + tbl->entries[ci].size = attr->ia_size; + tbl->entries[ci].ctime.tv_sec = ts_sec; + tbl->entries[ci].mtime.tv_sec = ts_sec; + tbl->entries[ci].atime.tv_sec = ts_sec; + break; + } + } + spin_unlock(&sbi->space_lock); + return; + } + + grant->type = MSG_RW_GRANT; + grant->request_id = req->request_id; + grant->slave_id = req->slave_id; + grant->ops = req->ops; + spin_lock(&sbi->space_lock); + if (req->data_pages > 0) { + data_err = + xmfs_host_reserve_data_space(sbi, req->data_pages, &dr); + if (data_err) { + spin_unlock(&sbi->space_lock); + grant->type = MSG_RW_ERROR; + return; + } + grant->data_addr = dr.data_addr; + grant->data_page_count = dr.data_page_count; + grant->second_data_addr = dr.second_data_addr; + grant->second_data_pages = dr.second_data_pages; + } else { + data_err = 0; + grant->data_addr = 0; + grant->data_page_count = 0; + } + + log_needed = req->log_entries; + if (req->ops == XMFS_UPDATE && grant->second_data_addr != 0) + log_needed = max(log_needed, 2); + if (req->ops == XMFS_RENAME) + log_needed = max(log_needed, 2); + if (req->ops == XMFS_SYMLINK) + log_needed = max(log_needed, 2); + + if (log_needed > 0 && slave_i != 0) { + log_addr = xmfs_host_reserve_log_space(sbi, req->i_ino, + log_needed); + if (log_addr == 0) { + spin_unlock(&sbi->space_lock); + grant->type = MSG_RW_ERROR; + return; + } + + xmlt = get_log_trunk(sbi, log_addr); + if (xmlt) { + grant->log_trunk_addr = log_addr; + grant->log_slot_start = xmlt->used; + grant->log_slot_count = log_needed; + xmlt->used += log_needed; + put_log_trunk(sbi, xmlt); + } + } else { + grant->log_trunk_addr = 0; + grant->log_slot_start = 0; + grant->log_slot_count = log_needed; + } + + if (req->i_ino == 0) + grant->assigned_ino = get_next_ino(); + else + grant->assigned_ino = req->i_ino; + + { + struct xmfs_sb_index *xmsi = get_xmsi(sbi); + + if (xmsi) { + grant->version = xmsi->last_update + 1; + xmsi->last_update += max(log_needed, 1); + put_xmsi(sbi, xmsi); + } else { + grant->version = 1; + } + } + + if (req->ops == XMFS_CREATE || req->ops == XMFS_MKDIR || + req->ops == XMFS_SYMLINK || req->ops == XMFS_LINK) { + struct xmfs_inode_table *tbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + struct timespec64 ts; + unsigned int nlink; + { + struct xmfs_inode_entry *e = &tbl->entries[tbl->count]; + + memset(e, 0, sizeof(*e)); + e->i_ino = grant->assigned_ino; + e->p_ino = req->p_ino; + e->mode = req->mode; + if (req->ops != XMFS_LINK) + e->nlink = 1; + memcpy(e->name, req->name, strnlen(req->name, 255)); + e->name[strnlen(req->name, 255)] = '\0'; + e->size = req->size; + ktime_get_real_ts64(&ts); + e->ctime = ts; + e->mtime = ts; + e->atime = ts; + } + tbl->count++; + if (req->ops == XMFS_LINK) { + nlink = xmfs_inode_table_sync_nlink(tbl, req->i_ino); + if (nlink == 1) + xmfs_warning(sbi->sb, + "LINK inode %lu not found in table", + req->i_ino); + } + } + + if (req->ops == XMFS_DELETE) { + struct xmfs_inode_table *tbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + + xmfs_inode_table_remove(tbl, req->i_ino, req->p_ino, + req->name); + xmfs_inode_table_sync_nlink(tbl, req->i_ino); + } + + if (req->ops == XMFS_UPDATE) { + struct xmfs_inode_table *ctbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + unsigned long ci; + /* xmfs_info(sbi->sb, "write update size %ld", req->size); */ + for (ci = 0; ci < ctbl->count; ci++) { + if (ctbl->entries[ci].i_ino == req->i_ino) { + /* + * xmfs_info(sbi->sb, + * "write find inode to update size %ld", + * req->size); + */ + ctbl->entries[ci].size = req->size; + break; + } + } + } + + spin_unlock(&sbi->space_lock); +} diff --git a/fs/xmfs/inode.c b/fs/xmfs/inode.c new file mode 100644 index 000000000000..9f066782545a --- /dev/null +++ b/fs/xmfs/inode.c @@ -0,0 +1,344 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * XMFS: Log Structured Filesystem for UB + * Copyright (C) 2024. Huawei Technologies Co., Ltd + * + * This program can be distributed under the terms of the GNU GPL. + * See the file COPYING. + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include "xmfs_i.h" + +#include <linux/kernel.h> +#include <linux/namei.h> +#include <linux/pagemap.h> +#include <linux/slab.h> + +int xmfs_inode_eq(struct inode *inode, void *_ino) +{ + u64 ino = *(u64 *)_ino; + + if (XMFS_I(inode)->i_ino == ino && XMFS_I(inode)->pinned && + !XMFS_I(inode)->die) + return 1; + else + return 0; +} + +int xmfs_inode_set(struct inode *inode, void *_ino) +{ + u64 ino = *(u64 *)_ino; + + XMFS_I(inode)->i_ino = ino; + inode->i_ino = ino; + XMFS_I(inode)->leaf = true; + XMFS_I(inode)->tmp = false; + XMFS_I(inode)->die = false; + XMFS_I(inode)->fallocate = false; + XMFS_I(inode)->pinned = false; + XMFS_I(inode)->start_write = 0; + XMFS_I(inode)->second_write = 0; + XMFS_I(inode)->count = 0; + xa_init(&XMFS_I(inode)->shared_pages); + xmfs_simple_xattrs_init(&XMFS_I(inode)->xattrs); + XMFS_I(inode)->write_wq = NULL; + + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + if (!sbi->always_hot) + xa_init(&XMFS_I(inode)->page_freq); + + sbi->used_ino++; + return 0; +} + +unsigned int xmfs_inode_table_sync_nlink(struct xmfs_inode_table *tbl, + unsigned long ino) +{ + unsigned long i; + unsigned int nlink = 0; + + for (i = 0; i < tbl->count; i++) { + if (tbl->entries[i].i_ino == ino) + nlink++; + } + for (i = 0; i < tbl->count; i++) { + if (tbl->entries[i].i_ino == ino) + tbl->entries[i].nlink = nlink; + } + + return nlink; +} + +bool xmfs_inode_table_remove(struct xmfs_inode_table *tbl, unsigned long ino, + unsigned long p_ino, const char *name) +{ + unsigned long i; + + for (i = 0; i < tbl->count; i++) { + struct xmfs_inode_entry *entry = &tbl->entries[i]; + + if (entry->i_ino != ino || entry->p_ino != p_ino || + strcmp(entry->name, name)) + continue; + + tbl->count--; + if (i < tbl->count) + tbl->entries[i] = tbl->entries[tbl->count]; + memset(&tbl->entries[tbl->count], 0, + sizeof(struct xmfs_inode_entry)); + return true; + } + + return false; +} + +int xmfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + struct iattr *attr) +{ + void *ret; + struct inode *inode = dentry->d_inode; + int err; + + if (inode->i_ino == 0) + return simple_setattr(idmap, dentry, attr); + + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + if (sbi->id != 0) + return xmfs_slave_setattr(idmap, dentry, attr); + + err = setattr_prepare(idmap, dentry, attr); + if (err) { + xmfs_info(inode->i_sb, "set attr wrong %d %d %d", err, + attr->ia_mode, attr->ia_valid); + return err; + } + setattr_copy(idmap, d_inode(dentry), attr); + mark_inode_dirty(inode); + unsigned int ia_valid = attr->ia_valid; + + if (ia_valid & ATTR_SIZE) { + loff_t new_size = attr->ia_size; + + if (new_size > sbi->len) + return -EFBIG; + + if (i_size_read(inode) > new_size) { + for (unsigned long i = + (new_size + PAGE_SIZE - 1) >> PAGE_SHIFT; + i <= (i_size_read(inode) >> PAGE_SHIFT); i++) { + ret = xa_erase(&xmfs_inode->shared_pages, i); + if (ret) + inode->i_blocks--; + + } + i_size_write(inode, new_size); + truncate_pagecache(inode, new_size); + + } else { + i_size_write(inode, new_size); + } + { + struct xmfs_inode_table *tbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + unsigned long ci; + + for (ci = 0; ci < tbl->count; ci++) { + if (tbl->entries[ci].i_ino == inode->i_ino) { + tbl->entries[ci].size = + i_size_read(inode); + tbl->entries[ci].ctime = + inode_get_ctime(inode); + tbl->entries[ci].mtime = inode->i_mtime; + break; + } + } + } + } + + return err; +} + +int xmfs_getattr(struct mnt_idmap *idmap, const struct path *path, + struct kstat *stat, u32 request_mask, unsigned int query_flags) +{ + struct inode *inode = d_inode(path->dentry); + + generic_fillattr(idmap, request_mask, inode, stat); + if (request_mask & STATX_BTIME) { + stat->result_mask |= STATX_BTIME; + stat->btime = XMFS_I(inode)->btime; + } + return 0; +} + +int xmfs_slave_getattr(struct mnt_idmap *idmap, const struct path *path, + struct kstat *stat, u32 request_mask, + unsigned int query_flags) +{ + struct inode *inode = d_inode(path->dentry); + + generic_fillattr(idmap, request_mask, inode, stat); + if (request_mask & STATX_BTIME) { + stat->result_mask |= STATX_BTIME; + stat->btime = XMFS_I(inode)->btime; + } + return 0; +} + +int xmfs_update_time(struct inode *inode, int flags) +{ + struct iattr attr = {}; + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct xmfs_log xm_log; + + if (inode->i_ino == 0) + return 0; + + if (flags == S_ATIME) + return 0; + + if ((flags & (S_MTIME | S_CTIME | S_ATIME)) == 0) + return 0; + + generic_update_time(inode, flags); + return 0; + if (inode->i_ino == 0) + return 0; + + if (flags == S_ATIME) + return 0; + + int err; + + if ((flags & (S_MTIME | S_CTIME | S_ATIME)) == 0) + return err; + + if (flags & S_MTIME) { + attr.ia_mtime.tv_sec = inode->i_mtime.tv_sec; + attr.ia_mtime.tv_nsec = inode->i_mtime.tv_nsec; + attr.ia_valid |= ATTR_MTIME; + } + if (flags & S_CTIME) { + attr.ia_ctime.tv_sec = inode->__i_ctime.tv_sec; + attr.ia_ctime.tv_nsec = inode->__i_ctime.tv_nsec; + attr.ia_valid |= ATTR_CTIME; + } + if (flags & S_ATIME) { + attr.ia_atime.tv_sec = inode->i_atime.tv_sec; + attr.ia_atime.tv_nsec = inode->i_atime.tv_nsec; + attr.ia_valid |= ATTR_ATIME; + } + + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + + if (xmfs_inode->die) { + xmfs_info(inode->i_sb, + "inode logs have been interrupted before update time"); + return -EINVAL; + } + + struct xmfs_sb_index *xmsi; + + spin_lock(&sbi->space_lock); + xmsi = get_xmsi(sbi); + if (!xmsi) { + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + err = 0; + int logcount = 1; + + if (logcount + xmsi->used_trunk_count > sbi->max_chunk) { + sbi->full = true; + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + + xm_log.ops = XMFS_SETATTR; + memcpy(xm_log.name, &attr, sizeof(struct iattr)); + + unsigned long xmlt_addr = xmfs_add_log_v3(&xm_log, sbi, + sizeof(struct iattr), + inode->i_ino, true); + if (xmlt_addr < 0) { + xmfs_inode->die = true; + return -EINVAL; + } + + return 0; +} + +static const struct inode_operations xmfs_special_inode_operations = { + .getattr = xmfs_getattr, + .setattr = xmfs_setattr, + .listxattr = xmfs_listxattr, + .update_time = xmfs_update_time, +}; + +void xmfs_init_special_inode_operations(struct inode *inode) +{ + inode->i_op = &xmfs_special_inode_operations; +} + +int xmfs_slave_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + struct iattr *attr) +{ + struct inode *inode = d_inode(dentry); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct xmfs_rw_msg req = {}; + int err; + + err = setattr_prepare(idmap, dentry, attr); + if (err) + return err; + + req.ops = XMFS_SETATTR; + req.i_ino = inode->i_ino; + req.p_ino = 0; + req.data_pages = 0; + req.log_entries = 0; + memcpy(req.name, attr, sizeof(struct iattr)); + + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + err = xmfs_send_request(sbi, &req, NULL, 0); + if (err) + return err; + + setattr_copy(idmap, inode, attr); + + unsigned int ia_valid = attr->ia_valid; + + if (ia_valid & ATTR_SIZE) { + xmfs_info(inode->i_sb, "slave setattr size %lld", + (long long)attr->ia_size); + loff_t new_size = attr->ia_size; + + if (new_size > sbi->len) + return -EFBIG; + + if (i_size_read(inode) > new_size) { + for (unsigned long i = + (new_size + PAGE_SIZE - 1) >> PAGE_SHIFT; + i <= (i_size_read(inode) >> PAGE_SHIFT); i++) { + xa_erase(&XMFS_I(inode)->shared_pages, i); + } + i_size_write(inode, new_size); + truncate_pagecache(inode, new_size); + } else { + i_size_write(inode, new_size); + } + } + return 0; +} diff --git a/fs/xmfs/namei.c b/fs/xmfs/namei.c new file mode 100644 index 000000000000..7c725bc9b654 --- /dev/null +++ b/fs/xmfs/namei.c @@ -0,0 +1,1794 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * XMFS: Log Structured Filesystem for UB + * Copyright (C) 2024. Huawei Technologies Co., Ltd + * + * This program can be distributed under the terms of the GNU GPL. + * See the file COPYING. + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include "xmfs_i.h" + +#include <linux/file.h> +#include <linux/kernel.h> +#include <linux/namei.h> +#include <linux/pagemap.h> +#include <linux/security.h> +#include <linux/slab.h> + +static const struct inode_operations xmfs_host_dir_inode_operations; +static const struct inode_operations xmfs_dir_inode_operations; + +static int xmfs_do_create_slave(struct xmfs_sb_info *sbi, struct inode *dir, + struct dentry *dentry, umode_t mode); +static int xmfs_do_mkdir_slave(struct xmfs_sb_info *sbi, struct inode *dir, + struct dentry *dentry, umode_t mode); +static int xmfs_do_rename_slave(struct xmfs_sb_info *sbi, struct inode *old_dir, + struct dentry *old_dentry, + struct inode *new_dir, + struct dentry *new_dentry, unsigned int flags); +static int xmfs_do_mknod_slave(struct xmfs_sb_info *sbi, struct inode *dir, + struct dentry *dentry, umode_t mode, dev_t dev); +static int xmfs_do_unlink_slave(struct xmfs_sb_info *sbi, struct inode *dir, + struct dentry *dentry); +static int xmfs_do_symlink_slave(struct xmfs_sb_info *sbi, struct inode *dir, + struct dentry *dentry, const char *symname); +static int xmfs_do_link_slave(struct xmfs_sb_info *sbi, + struct dentry *old_dentry, struct inode *dir, + struct dentry *dentry); + +static void xmfs_unpin_inode(struct xmfs_sb_info *sbi, struct inode *inode) +{ + if (!XMFS_I(inode)->pinned) + return; + + XMFS_I(inode)->pinned = false; + xa_erase(&sbi->pinned_inodes, inode->i_ino); + iput(inode); +} + +static unsigned long xmfs_symlink_write_symname(struct inode *inode, + const char *name, + struct xmfs_log *xm_log) +{ + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct xmfs_sb_index *xmsi; + unsigned long data_current, data_count; + long slot; + int err = 0; + + spin_lock(&sbi->space_lock); + xmsi = get_xmsi(sbi); + if (!xmsi) { + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + + data_current = xmsi->data_current; + data_count = xmsi->data_count; + + WARN_ON(xmsi->count == 0); + + if (data_current == 0 || data_count == 511) { + slot = xmfs_alloc_and_mark_slot(xmsi, sbi, 'd'); + if (slot < 0) { + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + xmsi->data_current = + DATA_AREA_OFFSET + slot * sbi->trunk_size + PAGE_SIZE; + xmsi->data_count = 0; + } else { + xmsi->data_current = data_current + PAGE_SIZE; + } + + xmfs_data_write(sbi, xmsi->data_current, name, + min(strlen(name) + 1, PATH_MAX)); + xmfs_mark_page_live(sbi, xmsi->data_current); + + xmsi->data_count = xmsi->data_count + 1; + xm_log->end_index = xmsi->data_current; + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return err; +} + +static int xmfs_symlink(struct mnt_idmap *idmap, struct inode *dir, + struct dentry *dentry, const char *symname) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + if (xmfs_quiesce_wait(sbi)) + return -EINTR; + if (sbi->id != 0) + return xmfs_do_symlink_slave(sbi, dir, dentry, symname); + struct xmfs_inode_info *xmfs_inode; + unsigned int len = strlen(symname) + 1; + + if (len > PAGE_SIZE) + return -ENAMETOOLONG; + + const char *name = dentry->d_name.name; + struct inode *inode; + struct xmfs_log xm_log; + unsigned long xmlt_addr; + + spin_lock(&sbi->space_lock); + if (sbi->full) { + spin_unlock(&sbi->space_lock); + return -ENOSPC; + } + + struct xmfs_sb_index *xmsi = get_xmsi(sbi); + + if (!xmsi) { + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + int err = 0; + + int logcount = 1; + int need_data_trunk = + (xmsi->data_count == 511 || xmsi->data_current == 0) ? 1 : 0; + if (len >= 256 && xmsi->used_trunk_count + logcount + need_data_trunk > + sbi->max_chunk) { + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } else if (len < 256 && + xmsi->used_trunk_count + logcount > sbi->max_chunk) { + sbi->full = true; + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + + unsigned long ino = get_next_ino(); + + inode = iget5_locked(dir->i_sb, ino, xmfs_inode_eq, xmfs_inode_set, + &ino); + if (!inode) + return -ENOMEM; + + xmfs_inode = XMFS_I(inode); + inode->i_ino = ino; + + i_size_write(inode, 0); + inode_init_owner(idmap, inode, dir, S_IFLNK | 0777); + + xmfs_init_symlink_operations(inode); + err = security_inode_init_security(inode, dir, &dentry->d_name, + xmfs_initxattrs, NULL); + if (err) { + unlock_new_inode(inode); + iput(inode); + return err; + } + inode_nohighmem(inode); + xmfs_init_symlink_mapping(inode); + + xmfs_inode->btime = inode->i_atime = inode->i_mtime = + inode_set_ctime_current(inode); + dir->i_mtime = inode_set_ctime_current(dir); + unlock_new_inode(inode); + ihold(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, GFP_KERNEL); + XMFS_I(inode)->pinned = true; + + xm_log.index = 0; + xm_log.end_index = 0; + xm_log.ops = XMFS_SYMLINK; + xm_log.data_offset = xmfs_inode->btime.tv_sec; + xm_log.mode = S_IFLNK | 0777; + memcpy(xm_log.name, name, min(strlen(name), 255)); + xm_log.p_ino = parent_ino(dentry); + + struct xmfs_log xm_log1; + + xm_log1.index = 1; + xm_log1.ops = XMFS_SYMLINK; + xm_log1.data_offset = xmfs_inode->btime.tv_nsec; + xm_log1.mode = S_IFLNK | 0777; + xm_log1.p_ino = parent_ino(dentry); + + xmlt_addr = xmfs_add_log_v3(&xm_log, sbi, min(strlen(name), 255), + inode->i_ino, false); + if (xmlt_addr < 0) { + xmfs_inode->die = true; + clear_nlink(inode); + iput(inode); + return -EINVAL; + } + + if (len <= 255) { + memcpy(xm_log1.name, symname, min(strlen(symname), 255)); + xm_log1.name[min(strlen(symname), 255)] = '\0'; + xm_log1.end_index = 0; + xmlt_addr = xmfs_add_log_v3(&xm_log1, sbi, + min(strlen(symname), 255), + inode->i_ino, true); + } else { + err = xmfs_symlink_write_symname(inode, symname, &xm_log1); + xm_log1.index = len; + if (err) { + xmfs_inode->die = true; + clear_nlink(inode); + iput(inode); + return err; + } + xmlt_addr = + xmfs_add_log_v3(&xm_log1, sbi, 0, inode->i_ino, true); + } + if (xmlt_addr < 0) { + xmfs_inode->die = true; + clear_nlink(inode); + iput(inode); + return -EINVAL; + } + xmfs_inode->symname = xmlt_addr; + + err = page_symlink(inode, symname, len); + if (err) { + clear_nlink(inode); + iput(inode); + return err; + } + + d_instantiate(dentry, inode); + { + struct xmfs_inode_table *tbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + unsigned long slot = tbl->count; + + tbl->count++; + { + struct xmfs_inode_entry *e = &tbl->entries[slot]; + + memset(e, 0, sizeof(*e)); + e->i_ino = inode->i_ino; + e->p_ino = dir->i_ino; + e->mode = S_IFLNK | 0777; + e->nlink = 1; + e->size = 0; + e->ctime = inode_get_ctime(inode); + e->mtime = inode->i_mtime; + e->atime = inode->i_atime; + memcpy(e->name, dentry->d_name.name, + dentry->d_name.len); + if (dentry->d_name.len < 256) + e->name[dentry->d_name.len] = '\0'; + } + } + + return 0; +} + +static int xmfs_link(struct dentry *old_dentry, struct inode *dir, + struct dentry *dentry) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + if (xmfs_quiesce_wait(sbi)) + return -EINTR; + if (sbi->id != 0) + return xmfs_do_link_slave(sbi, old_dentry, dir, dentry); + const char *name = dentry->d_name.name; + struct inode *inode = d_inode(old_dentry); + struct xmfs_log xm_log; + unsigned long xmlt_addr; + + if (XMFS_I(inode)->die) { + xmfs_info(sbi->sb, + "inode logs have been interrupted before link"); + return -EINVAL; + } + struct xmfs_sb_index *xmsi; + + spin_lock(&sbi->space_lock); + xmsi = get_xmsi(sbi); + if (!xmsi) { + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + int logcount = 1; + + if (logcount + xmsi->used_trunk_count > sbi->max_chunk) { + sbi->full = true; + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + + dir->i_mtime = + inode_set_ctime_to_ts(dir, inode_set_ctime_current(inode)); + inc_nlink(inode); + ihold(inode); + + d_instantiate(dentry, inode); + + { + struct xmfs_inode_table *tbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + unsigned long slot; + + spin_lock(&sbi->space_lock); + slot = tbl->count; + tbl->count++; + { + struct xmfs_inode_entry *e = &tbl->entries[slot]; + + memset(e, 0, sizeof(*e)); + e->i_ino = inode->i_ino; + e->p_ino = dir->i_ino; + e->mode = inode->i_mode; + e->nlink = inode->i_nlink; + e->size = i_size_read(inode); + e->ctime = inode_get_ctime(inode); + e->mtime = inode->i_mtime; + e->atime = inode->i_atime; + memcpy(e->name, dentry->d_name.name, + dentry->d_name.len); + if (dentry->d_name.len < 256) + e->name[dentry->d_name.len] = '\0'; + } + xmfs_inode_table_sync_nlink(tbl, inode->i_ino); + spin_unlock(&sbi->space_lock); + } + + xm_log.index = 0; + xm_log.end_index = inode->i_ino; + xm_log.ops = XMFS_LINK; + xm_log.data_offset = dir->i_mtime.tv_sec; + xm_log.mode = inode->i_mode; + xm_log.offset = dir->i_mtime.tv_nsec; + memcpy(xm_log.name, name, min(strlen(name), 255UL)); + xm_log.p_ino = parent_ino(dentry); + + xmlt_addr = xmfs_add_log_v3(&xm_log, sbi, + min(strlen(name), 255UL), + inode->i_ino, true); + if (xmlt_addr < 0) { + struct xmfs_inode_table *tbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + + spin_lock(&sbi->space_lock); + xmfs_inode_table_remove(tbl, inode->i_ino, dir->i_ino, name); + xmfs_inode_table_sync_nlink(tbl, inode->i_ino); + spin_unlock(&sbi->space_lock); + XMFS_I(inode)->die = true; + drop_nlink(inode); + iput(inode); + dput(dentry); + return -EINVAL; + } + + return 0; +} + +static int xmfs_do_create_slave(struct xmfs_sb_info *sbi, struct inode *dir, + struct dentry *dentry, umode_t mode) +{ + struct xmfs_rw_msg req = {}, grant = {}; + struct inode *inode; + struct xmfs_inode_info *xmfs_inode; + int err; + struct xmfs_log xm_log; + unsigned long log_off; + + req.ops = XMFS_CREATE; + req.mode = mode | S_IFREG; + req.p_ino = dir->i_ino; + req.i_ino = 0; + req.data_pages = 0; + req.log_entries = 1; + memcpy(req.name, dentry->d_name.name, dentry->d_name.len + 1); + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + struct xmfs_grant_wait gw; + + init_completion(&gw.done); + xa_store(&sbi->urma_cfg.grant_waits, req.request_id, &gw, GFP_KERNEL); + err = xmfs_send_request(sbi, &req, &gw, 0); + if (err) + return err; + grant = gw.grant; + + log_off = grant.log_trunk_addr + + offsetof(struct xmfs_log_trunk, log[0]) + + grant.log_slot_start * sizeof(struct xmfs_log); + xm_log.index = 0; + xm_log.end_index = 0; + xm_log.ops = XMFS_CREATE; + xm_log.data_offset = ktime_get_real_seconds(); + xm_log.mode = mode | S_IFREG; + xm_log.offset = ktime_get_real_ns() % NSEC_PER_SEC; + xm_log.version = grant.version; + memcpy(xm_log.name, dentry->d_name.name, + min(dentry->d_name.len, 255UL)); + if (dentry->d_name.len < 256) + xm_log.name[dentry->d_name.len] = '\0'; + xm_log.p_ino = dir->i_ino; + xm_log.i_ino = grant.assigned_ino; + xm_log.writer_id = sbi->id; + xm_log.size = 0; + xmfs_data_write(sbi, log_off, &xm_log, sizeof(xm_log)); + + inode = iget5_locked(dir->i_sb, grant.assigned_ino, xmfs_inode_eq, + xmfs_inode_set, &grant.assigned_ino); + if (!inode) + return -ENOMEM; + + if (!(inode->i_state & I_NEW)) + return 0; + + xmfs_inode = XMFS_I(inode); + i_size_write(inode, 0); + inode->i_ino = grant.assigned_ino; + inode_init_owner(&nop_mnt_idmap, inode, dir, mode | S_IFREG); + xmfs_init_file_inode(inode); + /* + * xmfs_inode->write_wq = alloc_workqueue("xmfs-prefetch-inode", + * WQ_UNBOUND | WQ_MEM_RECLAIM, + * 8); + */ + security_inode_init_security(inode, dir, &dentry->d_name, + xmfs_initxattrs, NULL); + xmfs_inode->btime = inode->i_mtime = inode->i_atime = + inode_set_ctime_current(inode); + dir->i_mtime = inode_set_ctime_current(dir); + unlock_new_inode(inode); + d_instantiate(dentry, inode); + ihold(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, GFP_KERNEL); + XMFS_I(inode)->pinned = true; + + return 0; +} + +static int xmfs_do_mkdir_slave(struct xmfs_sb_info *sbi, struct inode *dir, + struct dentry *dentry, umode_t mode) +{ + struct xmfs_rw_msg req = {}, grant = {}; + struct inode *inode; + struct xmfs_inode_info *xmfs_inode; + int err; + struct xmfs_log xm_log; + unsigned long log_off; + + req.ops = XMFS_MKDIR; + req.mode = mode | S_IFDIR; + req.p_ino = dir->i_ino; + req.i_ino = 0; + req.data_pages = 0; + req.log_entries = 1; + req.size = 4096; + memcpy(req.name, dentry->d_name.name, dentry->d_name.len + 1); + + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + struct xmfs_grant_wait gw; + + init_completion(&gw.done); + xa_store(&sbi->urma_cfg.grant_waits, req.request_id, &gw, GFP_KERNEL); + err = xmfs_send_request(sbi, &req, &gw, 0); + if (err) + return err; + grant = gw.grant; + + log_off = grant.log_trunk_addr + + offsetof(struct xmfs_log_trunk, log[0]) + + grant.log_slot_start * sizeof(struct xmfs_log); + xm_log.index = 0; + xm_log.end_index = 0; + xm_log.ops = XMFS_MKDIR; + xm_log.data_offset = ktime_get_real_seconds(); + xm_log.mode = mode | S_IFDIR; + xm_log.offset = ktime_get_real_ns() % NSEC_PER_SEC; + xm_log.version = grant.version; + memcpy(xm_log.name, dentry->d_name.name, + min(dentry->d_name.len, 255UL)); + if (dentry->d_name.len < 256) + xm_log.name[dentry->d_name.len] = '\0'; + xm_log.p_ino = dir->i_ino; + xm_log.i_ino = grant.assigned_ino; + xm_log.writer_id = sbi->id; + xm_log.size = 4096; + xmfs_data_write(sbi, log_off, &xm_log, sizeof(xm_log)); + + inode = iget5_locked(dir->i_sb, grant.assigned_ino, xmfs_inode_eq, + xmfs_inode_set, &grant.assigned_ino); + if (!inode) + return -ENOMEM; + + if (!(inode->i_state & I_NEW)) + return 0; + + xmfs_inode = XMFS_I(inode); + i_size_write(inode, 4096); + inode->i_ino = grant.assigned_ino; + inode_init_owner(&nop_mnt_idmap, inode, dir, S_IFDIR | mode); + xmfs_init_dir_inode(inode, false); + xmfs_inode->btime = inode->i_mtime = inode->i_atime = + inode_set_ctime_current(inode); + dir->i_mtime = inode_set_ctime_current(dir); + inc_nlink(dir); + inc_nlink(inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); + ihold(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, GFP_KERNEL); + XMFS_I(inode)->pinned = true; + + return 0; +} + +static int xmfs_do_unlink_slave(struct xmfs_sb_info *sbi, struct inode *dir, + struct dentry *dentry) +{ + struct xmfs_rw_msg req = {}, grant = {}; + int err; + struct xmfs_log xm_log; + unsigned long log_off; + + req.ops = XMFS_DELETE; + req.p_ino = dir->i_ino; + req.i_ino = dentry->d_inode->i_ino; + req.data_pages = 0; + req.log_entries = 1; + memcpy(req.name, dentry->d_name.name, dentry->d_name.len + 1); + + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + struct xmfs_grant_wait gw; + + init_completion(&gw.done); + xa_store(&sbi->urma_cfg.grant_waits, req.request_id, &gw, GFP_KERNEL); + err = xmfs_send_request(sbi, &req, &gw, 0); + if (err) + return err; + grant = gw.grant; + + log_off = grant.log_trunk_addr + + offsetof(struct xmfs_log_trunk, log[0]) + + grant.log_slot_start * sizeof(struct xmfs_log); + xm_log.ops = XMFS_DELETE; + xm_log.i_ino = dentry->d_inode->i_ino; + xm_log.p_ino = dir->i_ino; + xm_log.version = grant.version; + memcpy(xm_log.name, dentry->d_name.name, + min(dentry->d_name.len, 255UL)); + if (dentry->d_name.len < 256) + xm_log.name[dentry->d_name.len] = '\0'; + xm_log.writer_id = sbi->id; + xmfs_data_write(sbi, log_off, &xm_log, sizeof(xm_log)); + + if (d_inode(dentry)->i_nlink > 0) + drop_nlink(d_inode(dentry)); + if (!d_inode(dentry)->i_nlink) + xmfs_unpin_inode(sbi, d_inode(dentry)); + return 0; +} + +static int xmfs_do_symlink_slave(struct xmfs_sb_info *sbi, struct inode *dir, + struct dentry *dentry, const char *symname) +{ + struct xmfs_rw_msg req = {}; + struct inode *inode; + struct xmfs_inode_info *xmfs_inode; + unsigned int len = strlen(symname) + 1; + struct xmfs_log xm_log; + unsigned long log_off; + int err; + + if (len > PAGE_SIZE) + return -ENAMETOOLONG; + + req.ops = XMFS_SYMLINK; + req.mode = S_IFLNK | 0777; + req.p_ino = dir->i_ino; + req.i_ino = 0; + req.data_pages = (len > 255) ? 1 : 0; + req.log_entries = 2; + memcpy(req.name, dentry->d_name.name, dentry->d_name.len + 1); + + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + struct xmfs_grant_wait gw; + + init_completion(&gw.done); + xa_store(&sbi->urma_cfg.grant_waits, req.request_id, &gw, GFP_KERNEL); + err = xmfs_send_request(sbi, &req, &gw, 0); + if (err) + return err; + + inode = iget5_locked(dir->i_sb, gw.grant.assigned_ino, xmfs_inode_eq, + xmfs_inode_set, &gw.grant.assigned_ino); + if (!inode) + return -ENOMEM; + + if (!(inode->i_state & I_NEW)) + return 0; + + xmfs_inode = XMFS_I(inode); + inode->i_ino = gw.grant.assigned_ino; + i_size_write(inode, 0); + inode_init_owner(&nop_mnt_idmap, inode, dir, S_IFLNK | 0777); + xmfs_init_symlink_operations(inode); + inode_nohighmem(inode); + xmfs_init_symlink_mapping(inode); + xmfs_inode->btime = inode->i_atime = inode->i_mtime = + inode_set_ctime_current(inode); + dir->i_mtime = inode_set_ctime_current(dir); + unlock_new_inode(inode); + ihold(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, GFP_KERNEL); + XMFS_I(inode)->pinned = true; + + log_off = gw.grant.log_trunk_addr + + offsetof(struct xmfs_log_trunk, log[0]) + + gw.grant.log_slot_start * sizeof(struct xmfs_log); + xm_log.index = 0; + xm_log.end_index = 0; + xm_log.ops = XMFS_SYMLINK; + xm_log.data_offset = ktime_get_real_seconds(); + xm_log.mode = S_IFLNK | 0777; + xm_log.version = gw.grant.version; + memcpy(xm_log.name, dentry->d_name.name, + min(dentry->d_name.len, 255UL)); + if (dentry->d_name.len < 256) + xm_log.name[dentry->d_name.len] = '\0'; + xm_log.p_ino = dir->i_ino; + xm_log.i_ino = gw.grant.assigned_ino; + xm_log.writer_id = sbi->id; + xmfs_data_write(sbi, log_off, &xm_log, sizeof(xm_log)); + + if (gw.grant.log_slot_count >= 2) { + struct xmfs_log xm_log1 = {}; + + xm_log1.index = 1; + xm_log1.ops = XMFS_SYMLINK; + xm_log1.version = gw.grant.version + 1; + xm_log1.i_ino = gw.grant.assigned_ino; + xm_log1.p_ino = dir->i_ino; + xm_log1.writer_id = sbi->id; + if (len <= 255) { + memcpy(xm_log1.name, symname, + min(len, 255UL)); + xm_log1.name[min(len - 1, 254UL)] = '\0'; + xm_log1.end_index = 0; + } else { + xm_log1.end_index = gw.grant.data_addr; + xm_log1.index = len; + XMFS_I(inode)->start_write = gw.grant.data_addr; + XMFS_I(inode)->count = gw.grant.data_page_count; + } + log_off = gw.grant.log_trunk_addr + + offsetof(struct xmfs_log_trunk, log[0]) + + (gw.grant.log_slot_start + 1) * sizeof(struct xmfs_log); + xmfs_inode->symname = log_off; + xmfs_data_write(sbi, log_off, &xm_log1, sizeof(xm_log1)); + } + + if (len > 255 && gw.grant.data_addr != 0) { + xmfs_data_write(sbi, gw.grant.data_addr, symname, + min(len, (unsigned long)PAGE_SIZE)); + } + + err = page_symlink(inode, symname, len); + if (err) { + clear_nlink(inode); + iput(inode); + return err; + } + + d_instantiate(dentry, inode); + + return 0; +} + +static int xmfs_do_link_slave(struct xmfs_sb_info *sbi, + struct dentry *old_dentry, struct inode *dir, + struct dentry *dentry) +{ + struct xmfs_rw_msg req = {}, grant = {}; + struct inode *inode = d_inode(old_dentry); + int err; + struct xmfs_log xm_log; + unsigned long log_off; + + req.ops = XMFS_LINK; + req.p_ino = dir->i_ino; + req.i_ino = inode->i_ino; + req.mode = inode->i_mode; + req.data_pages = 0; + req.log_entries = 1; + memcpy(req.name, dentry->d_name.name, dentry->d_name.len + 1); + + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + struct xmfs_grant_wait gw; + + init_completion(&gw.done); + xa_store(&sbi->urma_cfg.grant_waits, req.request_id, &gw, GFP_KERNEL); + err = xmfs_send_request(sbi, &req, &gw, 0); + if (err) + return err; + grant = gw.grant; + + log_off = grant.log_trunk_addr + + offsetof(struct xmfs_log_trunk, log[0]) + + grant.log_slot_start * sizeof(struct xmfs_log); + xm_log.index = 0; + xm_log.end_index = inode->i_ino; + xm_log.ops = XMFS_LINK; + xm_log.data_offset = ktime_get_real_seconds(); + xm_log.mode = inode->i_mode; + xm_log.offset = ktime_get_real_ns() % NSEC_PER_SEC; + xm_log.version = grant.version; + memcpy(xm_log.name, dentry->d_name.name, + min(dentry->d_name.len, 255UL)); + if (dentry->d_name.len < 256) + xm_log.name[dentry->d_name.len] = '\0'; + xm_log.p_ino = dir->i_ino; + xm_log.i_ino = inode->i_ino; + xm_log.writer_id = sbi->id; + xmfs_data_write(sbi, log_off, &xm_log, sizeof(xm_log)); + + inc_nlink(inode); + ihold(inode); + + d_instantiate(dentry, inode); + + return 0; +} + +static int xmfs_create(struct mnt_idmap *idmap, struct inode *dir, + struct dentry *dentry, umode_t mode, bool excl) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + if (xmfs_quiesce_wait(sbi)) + return -EINTR; + if (sbi->id != 0) + return xmfs_do_create_slave(sbi, dir, dentry, mode); + struct xmfs_log xm_log; + unsigned long xmlt_addr; + struct xmfs_sb_index *xmsi; + int err = 0; + struct xmfs_inode_info *xmfs_inode; + const char *name = dentry->d_name.name; + struct inode *inode; + + spin_lock(&sbi->space_lock); + if (sbi->full) { + spin_unlock(&sbi->space_lock); + return -ENOSPC; + } + + xmsi = get_xmsi(sbi); + if (!xmsi) { + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + + int logcount = 1; + + if (logcount + xmsi->used_trunk_count > sbi->max_chunk) { + sbi->full = true; + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + unsigned long ino = get_next_ino(); + + inode = iget5_locked(dir->i_sb, ino, xmfs_inode_eq, xmfs_inode_set, + &ino); + if (!inode) + return -ENOMEM; + + xmfs_inode = XMFS_I(inode); + i_size_write(inode, 0); + + inode->i_ino = ino; + inode_init_owner(idmap, inode, dir, mode | S_IFREG); + + xmfs_init_file_inode(inode); + /* + * xmfs_inode->write_wq = alloc_workqueue("xmfs-prefetch-inode", + * WQ_UNBOUND | WQ_MEM_RECLAIM, + * 8); + */ + err = security_inode_init_security(inode, dir, &dentry->d_name, + xmfs_initxattrs, NULL); + if (err) { + unlock_new_inode(inode); + iput(inode); + return err; + } + xmfs_inode->btime = inode->i_mtime = inode->i_atime = + inode_set_ctime_current(inode); + + dir->i_mtime = inode_set_ctime_current(dir); + unlock_new_inode(inode); + d_instantiate(dentry, inode); + ihold(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, GFP_KERNEL); + XMFS_I(inode)->pinned = true; + + { + struct xmfs_inode_table *tbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + unsigned long slot = tbl->count; + + tbl->count++; + { + struct xmfs_inode_entry *e = &tbl->entries[slot]; + + memset(e, 0, sizeof(*e)); + e->i_ino = inode->i_ino; + e->p_ino = dir->i_ino; + e->mode = mode | S_IFREG; + e->nlink = 1; + e->size = 0; + e->ctime = inode_get_ctime(inode); + e->mtime = inode->i_mtime; + e->atime = inode->i_atime; + memcpy(e->name, dentry->d_name.name, + dentry->d_name.len); + if (dentry->d_name.len < 256) + e->name[dentry->d_name.len] = '\0'; + } + } + + xm_log.index = 0; + xm_log.end_index = 0; + xm_log.ops = XMFS_CREATE; + xm_log.data_offset = inode->i_mtime.tv_sec; + xm_log.mode = mode | S_IFREG; + xm_log.offset = inode->i_mtime.tv_nsec; + memcpy(xm_log.name, name, min(strlen(name), 255UL)); + xm_log.p_ino = parent_ino(dentry); + xm_log.writer_id = sbi->id; + xm_log.size = 0; + + xmlt_addr = xmfs_add_log_v3(&xm_log, sbi, + min(strlen(name), 255UL), + inode->i_ino, true); + if (xmlt_addr < 0) { + xmfs_inode->die = true; + iput(inode); + dput(dentry); + return -EINVAL; + } + + if (sbi->fallocate_size) + xmfs_common_fallocate(inode, 0x01, 0, sbi->fallocate_size); + + return 0; +} + +static int xmfs_do_mknod_slave(struct xmfs_sb_info *sbi, struct inode *dir, + struct dentry *dentry, umode_t mode, dev_t dev) +{ + struct xmfs_rw_msg req = {}, grant = {}; + struct inode *inode; + struct xmfs_inode_info *xmfs_inode; + int err; + struct xmfs_log xm_log; + unsigned long log_off; + + req.ops = XMFS_CREATE; + req.mode = mode; + req.p_ino = dir->i_ino; + req.i_ino = 0; + req.data_pages = 0; + req.log_entries = 1; + memcpy(req.name, dentry->d_name.name, dentry->d_name.len + 1); + + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + struct xmfs_grant_wait gw; + + init_completion(&gw.done); + xa_store(&sbi->urma_cfg.grant_waits, req.request_id, &gw, GFP_KERNEL); + err = xmfs_send_request(sbi, &req, &gw, 0); + if (err) + return err; + grant = gw.grant; + + log_off = grant.log_trunk_addr + + offsetof(struct xmfs_log_trunk, log[0]) + + grant.log_slot_start * sizeof(struct xmfs_log); + memset(&xm_log, 0, sizeof(xm_log)); + xm_log.ops = XMFS_CREATE; + xm_log.mode = mode; + xm_log.p_ino = dir->i_ino; + xm_log.i_ino = grant.assigned_ino; + xm_log.index = 1; + xm_log.end_index = dev; + xm_log.data_offset = ktime_get_real_seconds(); + xm_log.offset = ktime_get_real_ns() % NSEC_PER_SEC; + xm_log.version = grant.version; + memcpy(xm_log.name, dentry->d_name.name, + min(dentry->d_name.len, 255UL)); + if (dentry->d_name.len < 256) + xm_log.name[dentry->d_name.len] = '\0'; + xm_log.writer_id = sbi->id; + xmfs_data_write(sbi, log_off, &xm_log, sizeof(xm_log)); + + inode = iget5_locked(dir->i_sb, grant.assigned_ino, xmfs_inode_eq, + xmfs_inode_set, &grant.assigned_ino); + if (!inode) + return -ENOMEM; + + if (!(inode->i_state & I_NEW)) + return 0; + + xmfs_inode = XMFS_I(inode); + i_size_write(inode, 0); + inode->i_ino = grant.assigned_ino; + inode_init_owner(&nop_mnt_idmap, inode, dir, mode); + init_special_inode(inode, mode, dev); + xmfs_init_special_inode_operations(inode); + xmfs_inode->btime = inode->i_mtime = inode->i_atime = + inode_set_ctime_current(inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); + ihold(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, GFP_KERNEL); + XMFS_I(inode)->pinned = true; + + return 0; +} + +static int xmfs_mknod(struct mnt_idmap *idmap, struct inode *dir, + struct dentry *dentry, umode_t mode, dev_t dev) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + if (xmfs_quiesce_wait(sbi)) + return -EINTR; + if (sbi->id != 0) + return xmfs_do_mknod_slave(sbi, dir, dentry, mode, dev); + struct xmfs_log xm_log; + unsigned long xmlt_addr; + struct xmfs_sb_index *xmsi; + int err = 0; + struct xmfs_inode_info *xmfs_inode; + const char *name = dentry->d_name.name; + struct inode *inode; + + spin_lock(&sbi->space_lock); + if (sbi->full) { + spin_unlock(&sbi->space_lock); + return -ENOSPC; + } + + xmsi = get_xmsi(sbi); + if (!xmsi) { + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + int logcount = 1; + + if (logcount + xmsi->used_trunk_count > sbi->max_chunk) { + sbi->full = true; + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + unsigned long ino = get_next_ino(); + + inode = iget5_locked(dir->i_sb, ino, xmfs_inode_eq, xmfs_inode_set, + &ino); + if (!inode) + return -ENOMEM; + + xmfs_inode = XMFS_I(inode); + i_size_write(inode, 0); + + inode->i_ino = ino; + inode_init_owner(idmap, inode, dir, mode); + init_special_inode(inode, mode, dev); + xmfs_init_special_inode_operations(inode); + err = security_inode_init_security(inode, dir, &dentry->d_name, + xmfs_initxattrs, NULL); + if (err) { + unlock_new_inode(inode); + iput(inode); + return err; + } + xmfs_inode->btime = inode->i_mtime = inode->i_atime = + inode_set_ctime_current(inode); + + dir->i_mtime = inode_set_ctime_current(dir); + unlock_new_inode(inode); + d_instantiate(dentry, inode); + ihold(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, GFP_KERNEL); + XMFS_I(inode)->pinned = true; + + { + struct xmfs_inode_table *tbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + unsigned long slot = tbl->count; + + tbl->count++; + { + struct xmfs_inode_entry *e = &tbl->entries[slot]; + + memset(e, 0, sizeof(*e)); + e->i_ino = inode->i_ino; + e->p_ino = dir->i_ino; + e->mode = mode; + e->nlink = 1; + e->size = 0; + e->ctime = inode_get_ctime(inode); + e->mtime = inode->i_mtime; + e->atime = inode->i_atime; + memcpy(e->name, dentry->d_name.name, + dentry->d_name.len); + if (dentry->d_name.len < 256) + e->name[dentry->d_name.len] = '\0'; + } + } + + xm_log.index = 1; + xm_log.end_index = dev; + xm_log.ops = XMFS_CREATE; + xm_log.data_offset = inode->i_mtime.tv_sec; + xm_log.mode = mode; + xm_log.offset = inode->i_mtime.tv_nsec; + memcpy(xm_log.name, name, min(strlen(name), 255UL)); + xm_log.p_ino = parent_ino(dentry); + + xmlt_addr = xmfs_add_log_v3(&xm_log, sbi, + min(strlen(name), 255UL), + inode->i_ino, true); + if (xmlt_addr < 0) { + xmfs_inode->die = true; + iput(inode); + dput(dentry); + return -EINVAL; + } + + return 0; +} + +static int xmfs_mkdir(struct mnt_idmap *idmap, struct inode *dir, + struct dentry *dentry, umode_t mode) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + if (xmfs_quiesce_wait(sbi)) + return -EINTR; + if (sbi->id != 0) + return xmfs_do_mkdir_slave(sbi, dir, dentry, mode); + struct xmfs_log xm_log; + struct xmfs_sb_index *xmsi; + int err = 0; + struct xmfs_inode_info *xmfs_inode; + const char *name = dentry->d_name.name; + struct inode *inode; + unsigned long xmlt_addr; + + spin_lock(&sbi->space_lock); + if (sbi->full) { + spin_unlock(&sbi->space_lock); + return -ENOSPC; + } + + xmsi = get_xmsi(sbi); + if (!xmsi) { + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + int logcount = 1; + + if (logcount + xmsi->used_trunk_count > sbi->max_chunk) { + sbi->full = true; + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + + unsigned long ino = get_next_ino(); + + inode = iget5_locked(dir->i_sb, ino, xmfs_inode_eq, xmfs_inode_set, + &ino); + if (!inode) + return -ENOMEM; + + xmfs_inode = XMFS_I(inode); + i_size_write(inode, 4096); + + inode->i_ino = ino; + inode_init_owner(idmap, inode, dir, S_IFDIR | mode); + xmfs_init_dir_inode(inode, true); + + xmfs_inode->btime = inode->i_mtime = inode->i_atime = + inode_set_ctime_current(inode); + + dir->i_mtime = inode_set_ctime_current(dir); + + err = security_inode_init_security(inode, dir, &dentry->d_name, + xmfs_initxattrs, NULL); + if (err) { + unlock_new_inode(inode); + iput(inode); + return err; + } + inc_nlink(dir); + inc_nlink(inode); + unlock_new_inode(inode); + d_instantiate(dentry, inode); + ihold(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, GFP_KERNEL); + XMFS_I(inode)->pinned = true; + + { + struct xmfs_inode_table *tbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + unsigned long slot = tbl->count; + + tbl->count++; + { + struct xmfs_inode_entry *e = &tbl->entries[slot]; + + memset(e, 0, sizeof(*e)); + e->i_ino = inode->i_ino; + e->p_ino = dir->i_ino; + e->mode = mode | S_IFDIR; + e->nlink = 1; + e->size = 4096; + e->ctime = inode_get_ctime(inode); + e->mtime = inode->i_mtime; + e->atime = inode->i_atime; + memcpy(e->name, dentry->d_name.name, + dentry->d_name.len); + if (dentry->d_name.len < 256) + e->name[dentry->d_name.len] = '\0'; + } + } + + xm_log.index = 0; + xm_log.end_index = 0; + xm_log.ops = XMFS_MKDIR; + xm_log.data_offset = dir->i_mtime.tv_sec; + xm_log.mode = mode | S_IFDIR; + xm_log.offset = dir->i_mtime.tv_nsec; + memcpy(xm_log.name, name, min(strlen(name), 255UL)); + xm_log.p_ino = parent_ino(dentry); + xm_log.size = 4096; + + xmlt_addr = xmfs_add_log_v3(&xm_log, sbi, + min(strlen(name), 255UL), + inode->i_ino, true); + if (xmlt_addr < 0) { + xmfs_inode->die = true; + drop_nlink(dir); + drop_nlink(inode); + iput(inode); + dput(dentry); + return 0; + } + + return 0; +} + +static int xmfs_do_rename_slave(struct xmfs_sb_info *sbi, struct inode *old_dir, + struct dentry *old_dentry, + struct inode *new_dir, + struct dentry *new_dentry, unsigned int flags) +{ + struct xmfs_rw_msg req = {}, grant = {}; + const char *old_name = old_dentry->d_name.name; + const char *new_name = new_dentry->d_name.name; + unsigned long old_len = old_dentry->d_name.len; + unsigned long new_len = new_dentry->d_name.len; + int err; + struct xmfs_log xm_log; + unsigned long log_off; + + if (old_len + 1 + new_len + 1 > 256) + return -ENAMETOOLONG; + if (flags & ~(RENAME_NOREPLACE)) + return -EINVAL; + + req.ops = XMFS_RENAME; + req.p_ino = old_dir->i_ino; + req.i_ino = old_dentry->d_inode->i_ino; + req.data_pages = 0; + req.log_entries = 2; + memcpy(req.name, old_name, old_len + 1); + memcpy(req.name + old_len + 1, new_name, new_len + 1); + + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + struct xmfs_grant_wait gw; + + init_completion(&gw.done); + xa_store(&sbi->urma_cfg.grant_waits, req.request_id, &gw, GFP_KERNEL); + err = xmfs_send_request(sbi, &req, &gw, 0); + if (err) + return err; + grant = gw.grant; + + log_off = grant.log_trunk_addr + + offsetof(struct xmfs_log_trunk, log[0]) + + grant.log_slot_start * sizeof(struct xmfs_log); + memset(&xm_log, 0, sizeof(xm_log)); + xm_log.ops = XMFS_RENAME; + xm_log.p_ino = old_dir->i_ino; + xm_log.i_ino = old_dentry->d_inode->i_ino; + xm_log.end_index = -1; + xm_log.version = grant.version; + memcpy(xm_log.name, old_name, min(old_len, 255UL)); + if (old_len < 256) + xm_log.name[old_len] = '\0'; + xm_log.writer_id = sbi->id; + xmfs_data_write(sbi, log_off, &xm_log, sizeof(xm_log)); + + log_off = grant.log_trunk_addr + + offsetof(struct xmfs_log_trunk, log[0]) + + (grant.log_slot_start + 1) * sizeof(struct xmfs_log); + memset(&xm_log, 0, sizeof(xm_log)); + xm_log.ops = XMFS_RENAME; + xm_log.p_ino = new_dir->i_ino; + xm_log.i_ino = old_dentry->d_inode->i_ino; + xm_log.version = grant.version + 1; + memcpy(xm_log.name, new_name, min(new_len, 255UL)); + if (new_len < 256) + xm_log.name[new_len] = '\0'; + xm_log.writer_id = sbi->id; + xmfs_data_write(sbi, log_off, &xm_log, sizeof(xm_log)); + + err = simple_rename(&nop_mnt_idmap, old_dir, old_dentry, new_dir, + new_dentry, flags); + if (err) + return err; + + return 0; +} + +static int xmfs_rename(struct mnt_idmap *idmap, struct inode *old_dir, + struct dentry *old_dentry, struct inode *new_dir, + struct dentry *new_dentry, unsigned int flags) +{ + /* RENAME_EXCHANGE is disabled because d_exchange() is not exported. */ + if (flags & ~(RENAME_NOREPLACE)) + return -EINVAL; + struct xmfs_sb_info *sbi = XMFS_SB(old_dir->i_sb); + + if (xmfs_quiesce_wait(sbi)) + return -EINTR; + if (sbi->id != 0) + return xmfs_do_rename_slave(sbi, old_dir, old_dentry, new_dir, + new_dentry, flags); + if (XMFS_I(old_dentry->d_inode)->die) { + xmfs_info(sbi->sb, + "inode logs have been interrupted before rename"); + return -EINVAL; + } + struct xmfs_sb_index *xmsi; + int err = 0; + + spin_lock(&sbi->space_lock); + xmsi = get_xmsi(sbi); + if (!xmsi) { + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + int logcount = 1; + + if (logcount + xmsi->used_trunk_count > sbi->max_chunk) { + sbi->full = true; + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + + err = simple_rename(idmap, old_dir, old_dentry, new_dir, new_dentry, + flags); + { + struct xmfs_inode_table *tbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + unsigned long j; + + for (j = 0; j < tbl->count; j++) { + if (tbl->entries[j].i_ino == + old_dentry->d_inode->i_ino && + tbl->entries[j].p_ino == old_dir->i_ino && + strcmp(tbl->entries[j].name, + old_dentry->d_name.name) == 0) { + tbl->entries[j].p_ino = new_dir->i_ino; + memset(tbl->entries[j].name, 0, 256); + memcpy(tbl->entries[j].name, + new_dentry->d_name.name, + min(new_dentry->d_name.len, + 255UL)); + if (new_dentry->d_name.len < 256) + tbl->entries[j] + .name[new_dentry->d_name.len] = + '\0'; + break; + } + } + } + if (err < 0) + return err; + + struct xmfs_log xm_log_old; + + xm_log_old.index = flags; + xm_log_old.ops = XMFS_RENAME; + xm_log_old.data_offset = old_dir->i_mtime.tv_sec; + xm_log_old.end_index = -1; + + const char *name = old_dentry->d_name.name; + + memcpy(xm_log_old.name, name, min(strlen(name), 255UL)); + xm_log_old.p_ino = old_dir->i_ino; + + struct xmfs_log xm_log_new; + + xm_log_new.ops = XMFS_RENAME; + xm_log_new.data_offset = old_dir->i_mtime.tv_nsec; + xm_log_new.p_ino = new_dir->i_ino; + xm_log_new.end_index = old_dentry->d_inode->i_ino; + + const char *new_name = new_dentry->d_name.name; + + memcpy(xm_log_new.name, new_name, + min(strlen(new_name), 255UL)); + + unsigned long addr; + + addr = xmfs_add_log_v3(&xm_log_old, sbi, + min(strlen(name), 255UL), + old_dentry->d_inode->i_ino, false); + if (addr < 0) { + XMFS_I(old_dentry->d_inode)->die = true; + return 0; + } + addr = xmfs_add_log_v3(&xm_log_new, sbi, + min(strlen(new_name), 255UL), + old_dentry->d_inode->i_ino, true); + if (addr < 0) { + XMFS_I(old_dentry->d_inode)->die = true; + return 0; + } + + return 0; +} + +static int xmfs_unlink(struct inode *dir, struct dentry *dentry) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + if (xmfs_quiesce_wait(sbi)) + return -EINTR; + if (sbi->id != 0) + return xmfs_do_unlink_slave(sbi, dir, dentry); + if (XMFS_I(dentry->d_inode)->die) { + xmfs_info(sbi->sb, + "inode logs have been interrupted before unlink"); + return -EINVAL; + } + struct xmfs_sb_index *xmsi; + + struct xmfs_log xm_log = { 0 }; + const char *name = dentry->d_name.name; + unsigned long ino = d_inode(dentry)->i_ino; + + spin_lock(&sbi->space_lock); + xmsi = get_xmsi(sbi); + if (!xmsi) { + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + /* + * int logcount = 0; + * + * if (logcount + xmsi->used_trunk_count > sbi->max_chunk) { + * sbi->full = true; + * spin_unlock(&sbi->space_lock); + * put_xmsi(sbi, xmsi); + * return -ENOSPC; + * } + */ + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + + if (d_inode(dentry)->__i_nlink > 1) + xm_log.index = -1; + else + xm_log.index = 0; + xm_log.end_index = -1; + xm_log.ops = XMFS_DELETE; + xm_log.data_offset = dir->i_mtime.tv_sec; + xm_log.offset = dir->i_mtime.tv_nsec; + memcpy(xm_log.name, name, min(strlen(name), 255UL)); + xm_log.p_ino = parent_ino(dentry); + + unsigned long addr = + xmfs_add_log_v3(&xm_log, sbi, + min(strlen(name), 255UL), ino, + true); + if (addr < 0) { + XMFS_I(d_inode(dentry))->die = true; + return 0; + } + + spin_lock(&sbi->space_lock); + xmsi = get_xmsi(sbi); + if (xmsi) + put_xmsi(sbi, xmsi); + + spin_unlock(&sbi->space_lock); + + if (d_inode(dentry)->i_nlink > 0) + drop_nlink(d_inode(dentry)); + { + struct xmfs_inode_table *tbl = + (void *)(sbi->kaddr + INODE_TABLE_OFFSET); + bool removed; + + spin_lock(&sbi->space_lock); + removed = xmfs_inode_table_remove(tbl, ino, dir->i_ino, name); + xmfs_inode_table_sync_nlink(tbl, ino); + spin_unlock(&sbi->space_lock); + if (!removed) + xmfs_warning(sbi->sb, "inode %lu entry %s not found", ino, + name); + } + if (!d_inode(dentry)->i_nlink) + xmfs_unpin_inode(sbi, d_inode(dentry)); + + return 0; +} + +static int xmfs_rmdir(struct inode *dir, struct dentry *dentry) +{ + if (!simple_empty(dentry)) + return -ENOTEMPTY; + + drop_nlink(d_inode(dentry)); + int err = xmfs_unlink(dir, dentry); + + if (!err) + drop_nlink(dir); + + return err; +} + +static struct dentry *xmfs_lookup(struct inode *dir, struct dentry *dentry, + unsigned int flags) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + struct xmfs_sb_index *xmsi; + struct dentry *p_dentry, *res = NULL; + struct xmfs_inode_table *tbl; + unsigned long max_entries, i; + struct inode *inode; + + if (dentry->d_name.len > NAME_MAX) + return ERR_PTR(-ENAMETOOLONG); + + xmsi = kmalloc(sizeof(struct xmfs_sb_index), GFP_KERNEL); + if (get_xmsi_and_copy(sbi, xmsi)) { + kfree(xmsi); + return ERR_PTR(-EIO); + } + /* + * xmfs_info(sbi->sb, "qyf id %ld lookup %ld %ld", sbi->id, + * xmsi->last_update, sbi->last_update); + */ + sbi->stop_cnt++; + if (xmsi->last_update != sbi->last_update) + xmfs_replay_new_entries(sbi, NULL, xmsi->last_update); + kfree(xmsi); + + struct qstr qname = QSTR_INIT(dentry->d_name.name, dentry->d_name.len); + + hlist_for_each_entry(p_dentry, &dir->i_dentry, d_u.d_alias) { + res = d_hash_and_lookup(p_dentry, &qname); + if (res) { + sbi->stop_cnt--; + return res; + } + } + + if (sbi->mode == XMFS_SHARED_MEM_MODE || sbi->mode == XMFS_HYBRID_MODE) + tbl = (struct xmfs_inode_table *)(sbi->kaddr + + INODE_TABLE_OFFSET); + else { + tbl = (struct xmfs_inode_table *)get_meta(sbi, + INODE_TABLE_OFFSET, + INODE_TABLE_SIZE); + /* + * tbl = (struct xmfs_inode_table *)get_meta( + * sbi, INODE_TABLE_OFFSET, + * max(sizeof(struct xmfs_inode_table) + + * tbl->count * sizeof(struct xmfs_inode_entry), + * INODE_TABLE_SIZE)); + */ + } + /* + * xmfs_info(sbi->sb, "qyf slave lookup find inode table %d", + * tbl->count); + */ + if (tbl && tbl->magic == XMFS_INODE_TABLE_MAGIC) { + max_entries = (INODE_TABLE_SIZE - 4096) / + sizeof(struct xmfs_inode_entry); + for (i = 0; i < tbl->count && i < max_entries; i++) { + struct xmfs_inode_entry *e = &tbl->entries[i]; + /* + * xmfs_info(sbi->sb, + * "qyf slave lookup iter inode table %d %ld %ld %s %s", + * i, e->p_ino, dir->i_ino, e->name, + * dentry->d_name.name); + */ + if (e->p_ino != dir->i_ino || + strcmp(e->name, dentry->d_name.name) != 0) + continue; + inode = ilookup5(sbi->sb, e->i_ino, xmfs_inode_eq, + &e->i_ino); + /* xmfs_info(sbi->sb, "qyf find inode? %p", inode); */ + if (!inode) + inode = iget5_locked(sbi->sb, e->i_ino, + xmfs_inode_eq, + xmfs_inode_set, &e->i_ino); + if (inode && (inode->i_state & I_NEW)) { + struct xmfs_inode_info *xmfs_inode = + XMFS_I(inode); + xmfs_inode->leaf = (e->i_ino != 0); + inode->i_ino = e->i_ino; + inode->i_mode = e->mode; + if (S_ISREG(e->mode)) { + /* + * xmfs_inode->write_wq = alloc_workqueue( + * "xmfs-prefetch-inode", + * WQ_UNBOUND | WQ_MEM_RECLAIM, 8); + */ + xmfs_init_file_inode(inode); + } else if (S_ISDIR(e->mode)) { + xmfs_init_dir_inode(inode, + sbi->id == 0); + } else if (S_ISLNK(e->mode)) { + xmfs_init_symlink_operations(inode); + } else { + init_special_inode(inode, e->mode, 0); + } + unlock_new_inode(inode); + ihold(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, + inode, GFP_KERNEL); + XMFS_I(inode)->pinned = true; + } + + if (inode) { + inode_lock(inode); + set_nlink(inode, e->nlink); + i_size_write(inode, e->size); + inode->__i_ctime.tv_sec = e->ctime.tv_sec; + inode->__i_ctime.tv_nsec = e->ctime.tv_nsec; + inode->i_mtime.tv_sec = e->mtime.tv_sec; + inode->i_mtime.tv_nsec = e->mtime.tv_nsec; + inode->i_atime.tv_sec = e->atime.tv_sec; + inode->i_atime.tv_nsec = e->atime.tv_nsec; + inode_unlock(inode); + res = d_splice_alias(inode, dentry); + } + break; + } + } + if (tbl && sbi->mode == XMFS_URMA_MODE) + put_meta(sbi, tbl); + + sbi->stop_cnt--; + return res; +} + +static const struct inode_operations xmfs_dir_inode_operations = { + .create = xmfs_create, + .lookup = xmfs_lookup, + .link = xmfs_link, + .unlink = xmfs_unlink, + .symlink = xmfs_symlink, + .mkdir = xmfs_mkdir, + .rmdir = xmfs_rmdir, + .mknod = xmfs_mknod, + .rename = xmfs_rename, + .setattr = xmfs_slave_setattr, + .getattr = xmfs_slave_getattr, + .update_time = xmfs_update_time, + .listxattr = xmfs_listxattr, +}; + +static int xmfs_tmpfile(struct mnt_idmap *idmap, struct inode *dir, + struct file *file, umode_t mode) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + struct xmfs_sb_index *xmsi; + int err = 0; + struct xmfs_inode_info *xmfs_inode; + struct dentry *dentry = file->f_path.dentry; + const char *name = dentry->d_name.name; + struct xmfs_log xm_log; + struct inode *inode; + + spin_lock(&sbi->space_lock); + if (sbi->full) { + spin_unlock(&sbi->space_lock); + return -ENOSPC; + } + + xmsi = get_xmsi(sbi); + if (!xmsi) { + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + int logcount = 1; + + if (logcount + xmsi->used_trunk_count > sbi->max_chunk) { + sbi->full = true; + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + unsigned long ino = get_next_ino(); + + inode = iget5_locked(dir->i_sb, ino, xmfs_inode_eq, xmfs_inode_set, + &ino); + if (!inode) + return -ENOMEM; + + xmfs_inode = XMFS_I(inode); + xmfs_inode->tmp = true; + + i_size_write(inode, 0); + + inode->i_ino = ino; + inode_init_owner(idmap, inode, dir, mode); + xmfs_init_file_inode(inode); + /* + * xmfs_inode->write_wq = alloc_workqueue("xmfs-prefetch-inode", + * WQ_UNBOUND | WQ_MEM_RECLAIM, + * 8); + */ + err = security_inode_init_security(inode, dir, &dentry->d_name, + xmfs_initxattrs, NULL); + if (err) { + unlock_new_inode(inode); + iput(inode); + return err; + } + xmfs_inode->btime = inode->i_mtime = inode->i_atime = + inode_set_ctime_current(inode); + dir->i_mtime = inode_set_ctime_current(dir); + unlock_new_inode(inode); + d_tmpfile(file, inode); + ihold(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, GFP_KERNEL); + XMFS_I(inode)->pinned = true; + + err = finish_open_simple(file, 0); + + xm_log.index = 0; + xm_log.end_index = 0; + xm_log.ops = XMFS_CREATE; + xm_log.data_offset = dir->i_mtime.tv_sec; + xm_log.mode = mode; + xm_log.offset = dir->i_mtime.tv_nsec; + memcpy(xm_log.name, name, min(strlen(name), 255UL)); + xm_log.p_ino = parent_ino(dentry); + + unsigned long xmlt_addr = + xmfs_add_log_v3(&xm_log, sbi, + min(strlen(name), 255UL), + inode->i_ino, true); + if (xmlt_addr < 0) { + xmfs_inode->die = true; + iput(inode); + return -EINVAL; + } + + return err; +} + +static const struct inode_operations xmfs_host_dir_inode_operations = { + .create = xmfs_create, + .lookup = xmfs_lookup, + .link = xmfs_link, + .unlink = xmfs_unlink, + .symlink = xmfs_symlink, + .mkdir = xmfs_mkdir, + .rmdir = xmfs_rmdir, + .mknod = xmfs_mknod, + .rename = xmfs_rename, + .setattr = xmfs_setattr, + .tmpfile = xmfs_tmpfile, + .listxattr = xmfs_listxattr, + .getattr = xmfs_getattr, + .update_time = xmfs_update_time, +}; + +struct inode *xmfs_get_root(struct super_block *sb, int host_id) +{ + struct inode *inode; + + inode = new_inode(sb); + if (inode) { + inode->i_ino = 0; + inode->i_mode = S_IFDIR | 0755; + inode->i_uid = make_kuid(current_user_ns(), 0); + inode->i_gid = make_kgid(current_user_ns(), 0); + XMFS_I(inode)->btime = inode->i_atime = inode->i_mtime = + inode_set_ctime_current(inode); + if (host_id == 0) + xmfs_init_dir_inode(inode, true); + else + xmfs_init_dir_inode(inode, false); + + /* directory inodes start off with i_nlink == 2 (for "." entry) */ + inc_nlink(inode); + lockdep_annotate_inode_mutex_key(inode); + XMFS_I(inode)->leaf = false; + XMFS_I(inode)->i_ino = 0; + XMFS_I(inode)->tmp = false; + XMFS_I(inode)->die = false; + XMFS_I(inode)->log_start = 0; + + xmfs_simple_xattrs_init(&XMFS_I(inode)->xattrs); + + i_size_write(inode, 4096); + } + return inode; +} + +void xmfs_init_dir_inode(struct inode *inode, bool host) +{ + inode->i_op = host ? &xmfs_host_dir_inode_operations : + &xmfs_dir_inode_operations; + xmfs_init_dir_file(inode); +} diff --git a/fs/xmfs/replay.c b/fs/xmfs/replay.c new file mode 100644 index 000000000000..1d75c9780632 --- /dev/null +++ b/fs/xmfs/replay.c @@ -0,0 +1,907 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * XMFS: Log Structured Filesystem for UB + * Copyright (C) 2024. Huawei Technologies Co., Ltd + * + * This program can be distributed under the terms of the GNU GPL. + * See the file COPYING. + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include "xmfs_i.h" + +#include <linux/kernel.h> +#include <linux/namei.h> +#include <linux/pagemap.h> +#include <linux/slab.h> + +static struct inode *xmfs_get_inode_from_table(struct xmfs_sb_info *sbi, + unsigned long ino) +{ + struct xmfs_inode_table *tbl; + struct xmfs_inode_entry *e; + struct inode *inode; + unsigned long max_entries, i; + + inode = ilookup5(sbi->sb, ino, xmfs_inode_eq, &ino); + if (inode) + return inode; + + if (sbi->mode == XMFS_SHARED_MEM_MODE || sbi->mode == XMFS_HYBRID_MODE) + tbl = (struct xmfs_inode_table *)(sbi->kaddr + + INODE_TABLE_OFFSET); + else { + tbl = (struct xmfs_inode_table *)get_meta(sbi, + INODE_TABLE_OFFSET, + INODE_TABLE_SIZE); + /* + * tbl = (struct xmfs_inode_table *)get_meta( + * sbi, INODE_TABLE_OFFSET, + * max(sizeof(struct xmfs_inode_table) + + * tbl->count * sizeof(struct xmfs_inode_entry), + * INODE_TABLE_SIZE)); + */ + } + + if (!tbl || tbl->magic != XMFS_INODE_TABLE_MAGIC) { + if (tbl && sbi->mode == XMFS_URMA_MODE) + put_meta(sbi, tbl); + return NULL; + } + + max_entries = + (INODE_TABLE_SIZE - 4096) / sizeof(struct xmfs_inode_entry); + e = NULL; + for (i = 0; i < tbl->count && i < max_entries; i++) { + if (tbl->entries[i].i_ino == ino) { + e = &tbl->entries[i]; + break; + } + } + + if (!e) { + if (sbi->mode == XMFS_URMA_MODE) + put_meta(sbi, tbl); + return NULL; + } + + inode = iget5_locked(sbi->sb, ino, xmfs_inode_eq, xmfs_inode_set, &ino); + if (!inode) { + if (sbi->mode == XMFS_URMA_MODE) + put_meta(sbi, tbl); + return NULL; + } + + if (inode->i_state & I_NEW) { + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + + xmfs_inode->leaf = (e->i_ino != 0); + inode->i_ino = e->i_ino; + inode->i_mode = e->mode; + set_nlink(inode, e->nlink); + i_size_write(inode, e->size); + inode->__i_ctime.tv_sec = e->ctime.tv_sec; + inode->__i_ctime.tv_nsec = e->ctime.tv_nsec; + inode->i_mtime.tv_sec = e->mtime.tv_sec; + inode->i_mtime.tv_nsec = e->mtime.tv_nsec; + inode->i_atime.tv_sec = e->atime.tv_sec; + inode->i_atime.tv_nsec = e->atime.tv_nsec; + if (S_ISREG(e->mode)) { + /* + * xmfs_inode->write_wq = alloc_workqueue( + * "xmfs-prefetch-inode", + * WQ_UNBOUND | WQ_MEM_RECLAIM, 8); + */ + xmfs_init_file_inode(inode); + } else if (S_ISDIR(e->mode)) { + xmfs_init_dir_inode(inode, sbi->id == 0); + } else if (S_ISLNK(e->mode)) { + xmfs_init_symlink_operations(inode); + } else { + init_special_inode(inode, e->mode, 0); + } + unlock_new_inode(inode); + /* iput(inode); */ + ihold(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, GFP_KERNEL); + XMFS_I(inode)->pinned = true; + } + + if (sbi->mode == XMFS_URMA_MODE) + put_meta(sbi, tbl); + return inode; +} + +static int xmfs_replay_link(struct inode *dir, struct dentry *pdentry, + struct xmfs_log log, unsigned long ino) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + struct inode *inode; + + if (log.writer_id == sbi->id) + return 0; + + inode = ilookup5(dir->i_sb, ino, xmfs_inode_eq, &ino); + if (inode) { + inc_nlink(inode); + iput(inode); + } + + return 0; +} + +static int xmfs_replay_mkdir(struct inode *dir, struct dentry *pdentry, + struct xmfs_log log, unsigned long replay, + unsigned long ino) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + struct inode *inode; + + if (log.writer_id == sbi->id) + return 0; + + inode = ilookup5(dir->i_sb, ino, xmfs_inode_eq, &ino); + if (!inode) { + inode = iget5_locked(dir->i_sb, ino, xmfs_inode_eq, + xmfs_inode_set, &ino); + if (inode && (inode->i_state & I_NEW)) { + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + + inode->i_ino = ino; + inode_init_owner(&nop_mnt_idmap, inode, dir, log.mode); + xmfs_init_dir_inode(inode, false); + i_size_write(inode, log.size); + inode->__i_ctime.tv_sec = log.data_offset; + inode->__i_ctime.tv_nsec = log.offset; + xmfs_inode->btime = inode->i_mtime = inode->i_atime = + inode->__i_ctime; + unlock_new_inode(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, + GFP_KERNEL); + XMFS_I(inode)->pinned = true; + } + } else { + iput(inode); + } + + return 0; +} + +static int xmfs_replay_symlink(struct inode *dir, struct dentry *pdentry, + struct xmfs_log o_log, struct xmfs_log n_log, + unsigned long symname_addr) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + struct inode *inode; + + if (o_log.writer_id == sbi->id) + return 0; + + inode = ilookup5(dir->i_sb, o_log.i_ino, xmfs_inode_eq, &o_log.i_ino); + if (!inode) { + inode = iget5_locked(dir->i_sb, o_log.i_ino, xmfs_inode_eq, + xmfs_inode_set, &o_log.i_ino); + if (inode && (inode->i_state & I_NEW)) { + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + + xmfs_inode->symname = symname_addr; + inode->i_ino = o_log.i_ino; + inode_init_owner(&nop_mnt_idmap, inode, dir, + S_IFLNK | 0777); + xmfs_init_symlink_mapping(inode); + i_size_write(inode, o_log.size); + inode->__i_ctime.tv_sec = o_log.data_offset; + inode->__i_ctime.tv_nsec = o_log.offset; + xmfs_inode->btime = inode->i_mtime = inode->i_atime = + inode->__i_ctime; + unlock_new_inode(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, + GFP_KERNEL); + XMFS_I(inode)->pinned = true; + } + } else { + iput(inode); + } + + return 0; +} + +static int xmfs_replay_rename(struct inode *dir, struct dentry *pdentry, + struct xmfs_log o_log, struct xmfs_log n_log) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + if (o_log.writer_id == sbi->id) + return 0; + + { + struct inode *old_parent = ilookup5(sbi->sb, o_log.p_ino, + xmfs_inode_eq, + &o_log.p_ino); + if (old_parent) { + struct dentry *pd = d_find_alias(old_parent); + + if (pd) { + struct qstr qname = + QSTR_INIT(o_log.name, + strlen(o_log.name)); + struct dentry *d = d_lookup(pd, &qname); + + if (d) { + d_drop(d); + dput(d); + } + dput(pd); + } + iput(old_parent); + } + } + return 0; +} + +static int xmfs_replay_create(struct inode *dir, struct dentry *pdentry, + struct xmfs_log log, unsigned long replay, + unsigned long ino) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + struct inode *inode; + /* + * xmfs_info(sbi->sb, "qyf replay create before check %ld %d %s", + * log.writer_id, sbi->id, log.name); + */ + if (log.writer_id == sbi->id) + return 0; + /* + * xmfs_info(sbi->sb, "qyf replay create %ld %s size %lld", + * log.i_ino, log.name, log.size); + */ + inode = ilookup5(dir->i_sb, ino, xmfs_inode_eq, &ino); + if (!inode) { + inode = iget5_locked(dir->i_sb, ino, xmfs_inode_eq, + xmfs_inode_set, &ino); + if (inode && (inode->i_state & I_NEW)) { + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + + inode->i_ino = ino; + inode_init_owner(&nop_mnt_idmap, inode, dir, log.mode); + if (log.index == 1) + init_special_inode(inode, log.mode, + log.end_index); + else if (S_ISREG(log.mode)) { + /* + * xmfs_inode->write_wq = alloc_workqueue( + * "xmfs-prefetch-inode", + * WQ_UNBOUND | WQ_MEM_RECLAIM, 8); + */ + xmfs_init_file_inode(inode); + } else if (S_ISDIR(log.mode)) { + xmfs_init_dir_inode(inode, false); + } + i_size_write(inode, log.size); + inode->__i_ctime.tv_sec = log.data_offset; + inode->__i_ctime.tv_nsec = log.offset; + xmfs_inode->btime = inode->i_mtime = inode->i_atime = + inode->__i_ctime; + unlock_new_inode(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, + GFP_KERNEL); + XMFS_I(inode)->pinned = true; + } + } else { + iput(inode); + } + + return 0; +} + +static int xmfs_replay_delete(struct inode *dir, struct dentry *pdentry, + struct xmfs_log log) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + if (log.writer_id == sbi->id) + return 0; + + { + struct inode *parent = + ilookup5(sbi->sb, log.p_ino, xmfs_inode_eq, &log.p_ino); + if (parent) { + struct dentry *pd = d_find_alias(parent); + + if (pd) { + struct qstr qname = + QSTR_INIT(log.name, strlen(log.name)); + struct dentry *d = d_lookup(pd, &qname); + + if (d) { + d_drop(d); + dput(d); + } + dput(pd); + } + iput(parent); + } + } + struct inode *inode; + + inode = ilookup5(sbi->sb, log.i_ino, xmfs_inode_eq, &log.i_ino); + if (!inode) + return 0; + if (inode->i_nlink > 0) + drop_nlink(inode); + if (!inode->i_nlink && XMFS_I(inode)->pinned) { + XMFS_I(inode)->pinned = false; + unsigned long _idx; + void *_entry; + + xa_for_each(&XMFS_I(inode)->shared_pages, _idx, _entry) { + xmfs_mark_page_dead(sbi, (unsigned long)_entry); + } + xa_erase(&sbi->pinned_inodes, inode->i_ino); + inode->i_state &= ~I_DIRTY_TIME; + /* Release pin reference. */ + iput(inode); + } + iput(inode); + return 0; +} + +static int xmfs_replay_update(struct inode *dir, struct dentry *pdentry, + struct xmfs_log log, unsigned long *data_addr, + unsigned long ino) +{ + void *ret; + unsigned long index = log.index; + unsigned long end_index = log.end_index; + unsigned long offset = log.data_offset; + + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + if (log.writer_id == sbi->id) + return 0; + + struct inode *inode = xmfs_get_inode_from_table(sbi, ino); + + if (!inode) { + xmfs_info(sbi->sb, + "cannot find inode in icache and inode table %ld", + ino); + return -ENOENT; + } + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + + int err = 0; + int chunk_header_cnt = 0; + unsigned long i = 0; + unsigned long page_off; + /* + * if (!sbi->always_hot) { + * invalidate_inode_pages2_range(inode->i_mapping, index, + * end_index - 1); + * truncate_pagecache_range(inode, index << PAGE_SHIFT, + * (end_index - 1) << PAGE_SHIFT); + * } + */ + /* + * if (sbi->mode == 0) + * arch_invalidate_pmem(sbi->kaddr + offset, + * (end_index - index + 1) * PAGE_SIZE); + */ + /* + * xmfs_info(sbi->sb, "replay update index %ld to %ld", + * index, end_index); + */ + for (i = index; i < end_index; i++) { + page_off = offset + (i - index) * PAGE_SIZE + + chunk_header_cnt * PAGE_SIZE; + if (page_off % XMFS_DEFAULT_CHUNK_SIZE == 0) { + chunk_header_cnt++; + page_off = offset + (i - index) * PAGE_SIZE + + chunk_header_cnt * PAGE_SIZE; + } + /* + * xmfs_info(sbi->sb, "replay update index %ld offset %ld", + * i, page_off); + */ + ret = xa_store(&xmfs_inode->shared_pages, i, (void *)page_off, + GFP_KERNEL); + if (!xa_err(ret)) { + inode->i_blocks++; + if (sbi->id == 0) { + xmfs_mark_page_dead(sbi, (unsigned long)ret); + xmfs_mark_page_live(sbi, page_off); + unsigned long trunk_off = + log.data_offset & + ~(sbi->trunk_size - 1); + struct xmfs_data_trunk_header *hdr = + (void *)(sbi->kaddr + trunk_off); + if (hdr->magic == XMFS_DATA_TRUNK_MAGIC && + log.version > hdr->last_modify_version) + hdr->last_modify_version = log.version; + } + } else { + xmfs_info(sbi->sb, "replay cannot store %lu %lu", i, + page_off); + } + if (sbi->always_hot) { + struct folio *folio = + filemap_grab_folio(inode->i_mapping, i); + if (IS_ERR(folio)) { + err = -ENOMEM; + goto done; + } + char *kaddr = kmap_local_page(folio_page(folio, 0)); + + get_data_and_copy(sbi, offset + (i - index) * PAGE_SIZE, + kaddr, PAGE_SIZE, NULL, 0); + kunmap_local(kaddr); + folio_mark_uptodate(folio); + folio_unlock(folio); + folio_put(folio); + } + } + +done: + + if (log.size > i_size_read(inode)) + i_size_write(inode, log.size); + + /* return start of data trunk */ + *data_addr = (offset + (end_index - index) * PAGE_SIZE + + (sbi->trunk_size - 1)) & + ~(sbi->trunk_size - 1); + + iput(inode); + + return err; +} + +static int xmfs_replay_xattr(struct inode *dir, struct dentry *pdentry, + struct xmfs_log xm_log, unsigned long ino) +{ + struct inode *inode; + struct xmfs_sb_info *sbi = XMFS_SB(dir->i_sb); + + if (xm_log.writer_id == sbi->id) + return 0; + + if (ino != 0) + inode = xmfs_get_inode_from_table(XMFS_SB(dir->i_sb), ino); + else + inode = dir; + if (!inode) { + xmfs_info(sbi->sb, "xattr cannot find inode xattr %ld", ino); + return -ENOENT; + } + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + + size_t size = xm_log.index; + size_t len = xm_log.end_index; + int flags = xm_log.size; + unsigned long offset1 = xm_log.data_offset; + + char *name = kmalloc(len + 1, GFP_KERNEL); + + int err = copy_mc_to_kernel(name, xm_log.name, len); + + if (unlikely(err)) { + xmfs_error(sbi->sb, + "hardware memory error when reading superblock during slave xattr copy name."); + kfree(name); + if (ino != 0) + iput(inode); + goto set_replay; + } + name[len] = '\0'; + if (flags != 0) { + struct simple_xattr *old_xattr = + xmfs_simple_xattr_set(&xmfs_inode->xattrs, name, NULL, + size, flags); + if (!IS_ERR(old_xattr)) { + xmfs_simple_xattr_free(old_xattr); + old_xattr = NULL; + inode->__i_ctime.tv_sec = xm_log.p_ino; + inode->__i_ctime.tv_nsec = xm_log.offset; + } + kfree(name); + if (ino != 0) + iput(inode); + goto set_replay; + } + + char *value = kmalloc(size, GFP_KERNEL); + + err = get_data_and_copy(sbi, offset1, value, size, NULL, 0); + if (unlikely(err)) { + xmfs_error(sbi->sb, + "hardware memory error when reading superblock during slave xattr copy value."); + kfree(name); + kfree(value); + if (ino != 0) + iput(inode); + goto set_replay; + } + + struct simple_xattr *old_xattr = + xmfs_simple_xattr_set(&xmfs_inode->xattrs, name, (void *)value, + size, flags); + if (!IS_ERR(old_xattr)) { + xmfs_simple_xattr_free(old_xattr); + old_xattr = NULL; + inode->__i_ctime.tv_sec = xm_log.data_offset; + inode->__i_ctime.tv_nsec = xm_log.offset; + } + kfree(name); + kfree(value); + if (ino != 0) + iput(inode); + +set_replay: + if (sbi->id == 0) { + xmfs_inode->log_start = sbi->log_start & ~(sbi->log_size - 1); + sbi->log_current = sbi->log_start; + } + return 0; +} + +static int xmfs_replay_root(struct inode *dir, struct dentry *pdentry, + struct xmfs_log xm_log, unsigned long ino) +{ + return 0; +} + +int xmfs_replay_new_entries(struct xmfs_sb_info *sbi, struct dentry *dentry, + unsigned long last_update) +{ + struct super_block *sb = sbi->sb; + struct xmfs_sb_index *xmsi; + struct xmfs_log_trunk *xmlt; + struct inode *dir; + unsigned long data_addr; + unsigned long trunk_offset; + unsigned long start_slot; + unsigned long target; + int err = 0; + struct xmfs_log *tmp_log; + + if (!mutex_trylock(&sbi->replay_lock)) + return 0; + + xmsi = kmalloc(sizeof(*xmsi), GFP_KERNEL); + err = get_xmsi_and_copy(sbi, xmsi); + if (unlikely(err)) { + kfree(xmsi); + mutex_unlock(&sbi->replay_lock); + return err; + } + + if (!dentry) + dentry = sb->s_root; + dir = dentry->d_inode; + data_addr = sbi->addr; + tmp_log = kmalloc(sizeof(struct xmfs_log), GFP_KERNEL); + + if (sbi->last_update >= xmsi->last_update) { + kfree(xmsi); + kfree(tmp_log); + mutex_unlock(&sbi->replay_lock); + return 0; + } + + target = (last_update != -1) ? last_update : xmsi->last_update; + if (target > xmsi->last_update) + target = xmsi->last_update; + if (target < sbi->last_update) { + sbi->last_update = target; + kfree(tmp_log); + mutex_unlock(&sbi->replay_lock); + return 0; + } + + if (sbi->last_replayed_slot == (unsigned long)-1) { + trunk_offset = xmsi->log_start; + start_slot = 0; + sbi->log_start = xmsi->log_start; + } else if (sbi->last_replayed_slot < MAX_LOG_PER_TRUNK) { + trunk_offset = sbi->log_start; + start_slot = sbi->last_replayed_slot + 1; + } else { + struct xmfs_log_trunk *cur = + get_log_trunk_meta(sbi, sbi->log_start); + trunk_offset = (cur && cur->next_trunk) ? cur->next_trunk : 0; + if (cur) + put_log_trunk(sbi, cur); + sbi->log_start = trunk_offset; + start_slot = 0; + sbi->last_replayed_slot = (unsigned long)-1; + } + kfree(xmsi); + + down_read(&sbi->chain_rwsem); + + while (trunk_offset != 0) { + unsigned long next_trunk; + unsigned long i; + int no_ops = 0; + + xmlt = get_log_trunk(sbi, trunk_offset); + if (!xmlt) + break; + + next_trunk = xmlt->next_trunk; + if (xmlt->version_base > target) { + put_log_trunk(sbi, xmlt); + break; + } + /* put_log_trunk(sbi, xmlt); */ + /* xmlt = get_log_trunk_data(sbi, trunk_offset, xmlt->used); */ + + for (i = start_slot; i < xmlt->used; i++) { + struct xmfs_log *replay_log = &xmlt->log[i]; + + switch (replay_log->ops) { + case XMFS_CREATE: + err = xmfs_replay_create(dir, dentry, + *replay_log, 0, + replay_log->i_ino); + break; + case XMFS_DELETE: + err = xmfs_replay_delete(dir, dentry, + *replay_log); + break; + case XMFS_UPDATE: + err = xmfs_replay_update(dir, dentry, + *replay_log, + &data_addr, + replay_log->i_ino); + break; + case XMFS_LINK: + err = xmfs_replay_link(dir, dentry, *replay_log, + replay_log->i_ino); + break; + case XMFS_MKDIR: + err = xmfs_replay_mkdir(dir, dentry, + *replay_log, 0, + replay_log->i_ino); + break; + case XMFS_RENAME: { + if (i + 1 < xmlt->used) { + *tmp_log = xmlt->log[i + 1]; + } else if (xmlt->next_trunk != 0) { + struct xmfs_log_trunk *next_xmlt = + get_log_trunk_meta(sbi, + xmlt->next_trunk); + if (next_xmlt && next_xmlt->used > 0) { + *tmp_log = next_xmlt->log[0]; + put_log_trunk(sbi, next_xmlt); + } else if (next_xmlt) { + put_log_trunk(sbi, next_xmlt); + break; + } else { + break; + } + } else { + break; + } + err = xmfs_replay_rename(dir, dentry, + *replay_log, *tmp_log); + i++; + break; + } + case XMFS_SYMLINK: { + if (i + 1 < xmlt->used) { + *tmp_log = xmlt->log[i + 1]; + } else if (xmlt->next_trunk != 0) { + struct xmfs_log_trunk *next_xmlt = + get_log_trunk_meta(sbi, + xmlt->next_trunk); + if (next_xmlt && next_xmlt->used > 0) { + *tmp_log = next_xmlt->log[0]; + put_log_trunk(sbi, next_xmlt); + } else if (next_xmlt) { + put_log_trunk(sbi, next_xmlt); + break; + } else { + break; + } + } else { + break; + } + { + unsigned long symname_addr; + + if (i + 1 < xmlt->used) + symname_addr = + trunk_offset + + offsetof(struct xmfs_log_trunk, + log[0]) + + (i + + 1) * sizeof(struct xmfs_log); + else + symname_addr = + xmlt->next_trunk + + offsetof(struct xmfs_log_trunk, + log[0]); + err = xmfs_replay_symlink(dir, dentry, + *replay_log, + *tmp_log, + symname_addr); + } + i++; + break; + } + case XMFS_SETATTR: + break; + case XMFS_XATTR: + err = xmfs_replay_xattr(dir, dentry, + *replay_log, + replay_log->i_ino); + break; + case XMFS_ROOT: + err = xmfs_replay_root(dir, dentry, *replay_log, + replay_log->i_ino); + break; + default: + no_ops = 1; + sbi->skip_no_ops++; + /* + * xmfs_error(sbi->sb, + * "qyf xmfs v2: unknown ops %d index %d %d", + * replay_log->ops, i, + * sbi->last_replayed_slot); + */ + if (sbi->skip_no_ops >= 50) { + sbi->skip_no_ops = 0; + xmfs_error(sbi->sb, + "replay fault: unknown ops %d, tried 50 times. This may happened when writing logs is too slow", + replay_log->ops); + } else { + target = replay_log->version; + goto done; + } + } + + if (err != 0) { + xmfs_error(sbi->sb, + "slave %d v2 play log ops %d err %d", + sbi->id, replay_log->ops, -err); + target = replay_log->version; + goto done; + } + err = 0; + sbi->last_replayed_slot = i; + if (replay_log->version > target) { + put_log_trunk(sbi, xmlt); + goto done; + } + /* + * xmfs_info(sbi->sb, + * "qyf replay sbi %d trunk %d replay ops %d " + * "name %s slot %d version %d owner %d " + * "total used %d ino %d index %d " + * "endindex %d size %d", + * sbi->id, xmlt->version_base, replay_log->ops, + * replay_log->name, sbi->last_replayed_slot, + * replay_log->version, replay_log->writer_id, + * xmlt->used, replay_log->i_ino, + * replay_log->index, replay_log->end_index, + * replay_log->size); + */ + } + + /* xmfs_info(sbi->sb, "qyf need to go to next trunk"); */ + start_slot = 0; + if (next_trunk != 0) { + sbi->log_start = next_trunk; + sbi->last_replayed_slot = (unsigned long)-1; + } + put_log_trunk(sbi, xmlt); + trunk_offset = next_trunk; + } + +done: + up_read(&sbi->chain_rwsem); + sbi->last_update = target; + if (sbi->id != 0) { + if (sbi->mode != XMFS_URMA_MODE) { + struct mount_msg_info *mm_info = + sbi->kaddr + MOUNT_MSG_OFFSET; + mm_info->slave_versions[sbi->id] = sbi->last_update; + } else { + unsigned long ver = sbi->last_update; + + xmfs_pmem_write(sbi, + MOUNT_MSG_OFFSET + + offsetof(struct mount_msg_info, + slave_versions) + + sbi->id * sizeof(unsigned long), + &ver, sizeof(ver)); + } + } + + kfree(tmp_log); + mutex_unlock(&sbi->replay_lock); + return 0; +} + +void xmfs_populate_from_inode_table(struct xmfs_sb_info *sbi) +{ + struct xmfs_inode_table *tbl; + struct inode *inode; + unsigned long i; + unsigned long max_entries; + + xmfs_info(sbi->sb, "xmfs_populate_from_inode_table"); + if (sbi->mode == XMFS_SHARED_MEM_MODE || sbi->mode == XMFS_HYBRID_MODE) + tbl = (struct xmfs_inode_table *)(sbi->kaddr + + INODE_TABLE_OFFSET); + else + tbl = (struct xmfs_inode_table *)get_meta(sbi, + INODE_TABLE_OFFSET, + INODE_TABLE_SIZE); + + if (!tbl || tbl->magic != XMFS_INODE_TABLE_MAGIC) { + xmfs_info(sbi->sb, "no valid inode table, skipping populate"); + if (tbl && sbi->mode == XMFS_URMA_MODE) + put_meta(sbi, tbl); + return; + } + + max_entries = + (INODE_TABLE_SIZE - 4096) / sizeof(struct xmfs_inode_entry); + xmfs_info(sbi->sb, "populating from inode table, %lu entries", + tbl->count); + + for (i = 0; i < tbl->count && i < max_entries; i++) { + struct xmfs_inode_entry *e = &tbl->entries[i]; + + if (e->i_ino == 0) + continue; + + inode = ilookup5(sbi->sb, e->i_ino, xmfs_inode_eq, &e->i_ino); + if (inode) { + iput(inode); + continue; + } + + inode = iget5_locked(sbi->sb, e->i_ino, xmfs_inode_eq, + xmfs_inode_set, &e->i_ino); + if (!inode) + continue; + + if (inode->i_state & I_NEW) { + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + + xmfs_inode->leaf = (e->i_ino != 0); + inode->i_ino = e->i_ino; + inode->i_mode = e->mode; + set_nlink(inode, e->nlink); + i_size_write(inode, e->size); + if (S_ISREG(e->mode)) { + /* + * xmfs_inode->write_wq = alloc_workqueue( + * "xmfs-prefetch-inode", + * WQ_UNBOUND | WQ_MEM_RECLAIM, 8); + */ + xmfs_init_file_inode(inode); + } else if (S_ISDIR(e->mode)) { + xmfs_init_dir_inode(inode, sbi->id == 0); + } else if (S_ISLNK(e->mode)) { + xmfs_init_symlink_operations(inode); + } else { + init_special_inode(inode, e->mode, 0); + } + unlock_new_inode(inode); + xa_store(&sbi->pinned_inodes, inode->i_ino, inode, + GFP_KERNEL); + XMFS_I(inode)->pinned = true; + } + } + + if (sbi->mode == XMFS_URMA_MODE) + put_meta(sbi, tbl); +} diff --git a/fs/xmfs/super.c b/fs/xmfs/super.c new file mode 100644 index 000000000000..f048fa8844ab --- /dev/null +++ b/fs/xmfs/super.c @@ -0,0 +1,1677 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * XMFS: Log Structured Filesystem for UB + * Copyright (C) 2026. Huawei Technologies Co., Ltd + * + * This program can be distributed under the terms of the GNU GPL. + * See the file COPYING. + */ + +#include "xmfs_i.h" + +#include <linux/blkdev.h> +#include <linux/dax.h> +#include <linux/file.h> +#include <linux/fs_context.h> +#include <linux/fs_parser.h> +#include <linux/io.h> +#include <linux/kernel.h> +#include <linux/kthread.h> +/* open CONFIG_ZONE_DEVICE */ +#include <linux/memremap.h> +#include <linux/mm.h> +#include <linux/module.h> +#include <linux/mount.h> +#include <linux/namei.h> +#include <linux/pagemap.h> +#include <linux/ratelimit.h> +#include <linux/sched.h> +#include <linux/seq_file.h> +#include <linux/slab.h> +#include <linux/statfs.h> +#include <linux/swap.h> +#include <linux/uio.h> + +#include "../../drivers/dax/dax-private.h" +#include "../../drivers/nvdimm/pmem.h" + +#include <linux/cacheflush.h> +#include <asm/set_memory.h> +#include <asm/tlbflush.h> + +static struct kmem_cache *xmfs_inode_cachep; + +#define XMFS_RATELIMIT_INTERVAL (5 * HZ) +#define XMFS_RATELIMIT_BURST 10 + +void xmfs_init_log_ratelimits(struct xmfs_sb_info *sbi) +{ + ratelimit_state_init(&sbi->s_error_ratelimit_state, + XMFS_RATELIMIT_INTERVAL, XMFS_RATELIMIT_BURST); + ratelimit_state_init(&sbi->s_warning_ratelimit_state, + XMFS_RATELIMIT_INTERVAL, XMFS_RATELIMIT_BURST); + ratelimit_state_init(&sbi->s_msg_ratelimit_state, + XMFS_RATELIMIT_INTERVAL, XMFS_RATELIMIT_BURST); + atomic_set(&sbi->s_error_count, 0); + atomic_set(&sbi->s_warning_count, 0); + atomic_set(&sbi->s_msg_count, 0); +} + +static bool xmfs_ratelimit(struct super_block *sb, + struct ratelimit_state *state, atomic_t *count, + const char *name) +{ + if (!sb || !XMFS_SB(sb)) + return true; + + atomic_inc(count); + return ___ratelimit(state, name); +} + +void __xmfs_msg(struct super_block *sb, const char *fmt, ...) +{ + struct va_format vaf; + va_list args; + int level; + + if (sb && XMFS_SB(sb) && + !xmfs_ratelimit(sb, &XMFS_SB(sb)->s_msg_ratelimit_state, + &XMFS_SB(sb)->s_msg_count, "XMFS-fs")) + return; + + level = printk_get_level(fmt); + + va_start(args, fmt); + vaf.fmt = printk_skip_level(fmt); + vaf.va = &args; + if (sb) + printk("%c%cXMFS-fs (%s): %pV\n", KERN_SOH_ASCII, level, sb->s_id, &vaf); + else + printk("%c%cXMFS-fs: %pV\n", KERN_SOH_ASCII, level, &vaf); + va_end(args); +} + +void __xmfs_error(struct super_block *sb, const char *function, + unsigned int line, int error, const char *fmt, ...) +{ + struct va_format vaf; + va_list args; + + if (sb && XMFS_SB(sb) && + !xmfs_ratelimit(sb, &XMFS_SB(sb)->s_error_ratelimit_state, + &XMFS_SB(sb)->s_error_count, "XMFS-fs error")) + return; + + va_start(args, fmt); + vaf.fmt = fmt; + vaf.va = &args; + if (sb) { + if (error) + printk(KERN_ERR "XMFS-fs error (%s): %s:%u: comm %s: error %d: %pV\n", + sb->s_id, function, line, current->comm, error, &vaf); + else + printk(KERN_ERR "XMFS-fs error (%s): %s:%u: comm %s: %pV\n", + sb->s_id, function, line, current->comm, &vaf); + } else if (error) { + printk(KERN_ERR "XMFS-fs error: %s:%u: comm %s: error %d: %pV\n", + function, line, current->comm, error, &vaf); + } else { + printk(KERN_ERR "XMFS-fs error: %s:%u: comm %s: %pV\n", + function, line, current->comm, &vaf); + } + va_end(args); +} + +void __xmfs_error_inode(struct inode *inode, const char *function, + unsigned int line, int error, const char *fmt, ...) +{ + struct super_block *sb = inode->i_sb; + struct va_format vaf; + va_list args; + + if (XMFS_SB(sb) && + !xmfs_ratelimit(sb, &XMFS_SB(sb)->s_error_ratelimit_state, + &XMFS_SB(sb)->s_error_count, "XMFS-fs error")) + return; + + va_start(args, fmt); + vaf.fmt = fmt; + vaf.va = &args; + if (error) + printk(KERN_ERR "XMFS-fs error (%s): %s:%u: inode #%lu: comm %s: error %d: %pV\n", + sb->s_id, function, line, inode->i_ino, current->comm, error, &vaf); + else + printk(KERN_ERR "XMFS-fs error (%s): %s:%u: inode #%lu: comm %s: %pV\n", + sb->s_id, function, line, inode->i_ino, current->comm, &vaf); + va_end(args); +} + +void __xmfs_error_file(struct file *file, const char *function, + unsigned int line, int error, const char *fmt, ...) +{ + struct inode *inode = file_inode(file); + struct super_block *sb = inode->i_sb; + char pathname[80]; + struct va_format vaf; + const char *path; + va_list args; + + if (XMFS_SB(sb) && + !xmfs_ratelimit(sb, &XMFS_SB(sb)->s_error_ratelimit_state, + &XMFS_SB(sb)->s_error_count, "XMFS-fs error")) + return; + + path = file_path(file, pathname, sizeof(pathname)); + if (IS_ERR(path)) + path = "(unknown)"; + + va_start(args, fmt); + vaf.fmt = fmt; + vaf.va = &args; + if (error) + printk(KERN_ERR "XMFS-fs error (%s): %s:%u: inode #%lu: comm %s: path %s: error %d: %pV\n", + sb->s_id, function, line, inode->i_ino, current->comm, path, + error, &vaf); + else + printk(KERN_ERR "XMFS-fs error (%s): %s:%u: inode #%lu: comm %s: path %s: %pV\n", + sb->s_id, function, line, inode->i_ino, current->comm, path, &vaf); + va_end(args); +} + +void __xmfs_warning(struct super_block *sb, const char *function, + unsigned int line, const char *fmt, ...) +{ + struct va_format vaf; + va_list args; + + if (sb && XMFS_SB(sb) && + !xmfs_ratelimit(sb, &XMFS_SB(sb)->s_warning_ratelimit_state, + &XMFS_SB(sb)->s_warning_count, "XMFS-fs warning")) + return; + + va_start(args, fmt); + vaf.fmt = fmt; + vaf.va = &args; + if (sb) + printk(KERN_WARNING "XMFS-fs warning (%s): %s:%u: %pV\n", + sb->s_id, function, line, &vaf); + else + printk(KERN_WARNING "XMFS-fs warning: %s:%u: %pV\n", + function, line, &vaf); + va_end(args); +} + +void __xmfs_warning_inode(const struct inode *inode, const char *function, + unsigned int line, const char *fmt, ...) +{ + struct super_block *sb = inode->i_sb; + struct va_format vaf; + va_list args; + + if (XMFS_SB(sb) && + !xmfs_ratelimit(sb, &XMFS_SB(sb)->s_warning_ratelimit_state, + &XMFS_SB(sb)->s_warning_count, "XMFS-fs warning")) + return; + + va_start(args, fmt); + vaf.fmt = fmt; + vaf.va = &args; + printk(KERN_WARNING "XMFS-fs warning (%s): %s:%u: inode #%lu: comm %s: %pV\n", + sb->s_id, function, line, inode->i_ino, current->comm, &vaf); + va_end(args); +} + +#if defined(__arm__) || defined(__aarch64__) +static int change_memory_cache(pte_t *ptep, unsigned long addr, void *data) +{ + pte_t pte = READ_ONCE(*ptep); + pte_t newpte; + bool cacheable = *(bool *)data; + + if (cacheable) + pte_val(newpte) = (pte_val(pte) & ~PTE_ATTRINDX_MASK) | + PTE_ATTRINDX(MT_NORMAL); + else + pte_val(newpte) = (pte_val(pte) & ~PTE_ATTRINDX_MASK) | + PTE_ATTRINDX(MT_NORMAL_NC); + + if (pte_val(pte) == pte_val(newpte)) + return 0; + + pte_clear(current->mm, addr, ptep); + flush_tlb_kernel_range(addr, addr + 4096); + set_pte(ptep, newpte); + + return 0; +} + +static void set_memory_noncacheable(unsigned long addr, size_t size) +{ + bool cache = false; + int ret = apply_to_page_range(current->mm, addr, size, + change_memory_cache, &cache); + if (ret) + xmfs_error(NULL, "apply noncache for write err %d", ret); +} +#endif + +static struct inode *xmfs_alloc_inode(struct super_block *sb) +{ + struct xmfs_inode_info *p; + + p = alloc_inode_sb(sb, xmfs_inode_cachep, GFP_KERNEL); + if (unlikely(!p)) + return NULL; + return &p->vfs_inode; +} + +static void xmfs_destroy_inode(struct inode *inode) +{ + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + if (xmfs_inode == NULL) + return; + + xmfs_simple_xattrs_free(&xmfs_inode->xattrs, NULL); + + if (!(xmfs_inode->leaf)) + return; + + sbi->used_ino--; + if (xmfs_inode->write_wq) { + flush_workqueue(xmfs_inode->write_wq); + destroy_workqueue(xmfs_inode->write_wq); + xmfs_inode->write_wq = NULL; + } + /* + * if (sbi->id == 0) { + * unsigned long _idx; + * void *_entry; + * + * xa_for_each(&xmfs_inode->shared_pages, _idx, _entry) { + * xmfs_info(sbi->sb, "destroy inode mark dead %d", _idx); + * xmfs_mark_page_dead(sbi, (unsigned long)_entry); + * } + * } + */ + xa_destroy(&xmfs_inode->shared_pages); + + if (sbi->always_hot || sbi->freq == 0) + return; + + unsigned long i; + void *ptr; + struct page_freq *page_freq; + + xa_for_each(&xmfs_inode->page_freq, i, ptr) { + page_freq = (struct page_freq *)ptr; + xa_erase(&xmfs_inode->page_freq, i); + kfree(page_freq); + } + xa_destroy(&xmfs_inode->page_freq); +} + +static void xmfs_free_inode(struct inode *inode) +{ + kmem_cache_free(xmfs_inode_cachep, XMFS_I(inode)); +} + +static int xmfs_statfs(struct dentry *dentry, struct kstatfs *buf) +{ + struct xmfs_sb_info *sbi = XMFS_SB(dentry->d_sb); + struct xmfs_sb_index *xmsi = get_xmsi(sbi); + + if (!xmsi) { + xmfs_error(NULL, + "hardware memory error when reading superblock during statfs."); + return 0; + } + sbi->stop_cnt++; + if (xmsi->last_update != sbi->last_update) { + if (!sbi->debug) + xmfs_replay_new_entries(sbi, NULL, xmsi->last_update); + else + xmfs_replay_new_entries(sbi, NULL, xmsi->last_update); + } + sbi->stop_cnt--; + + buf->f_type = XMFS_MAGIC; + buf->f_bsize = sbi->trunk_size; + buf->f_namelen = NAME_MAX; + buf->f_blocks = sbi->max_chunk + DATA_AREA_OFFSET / sbi->trunk_size + 1; + buf->f_bfree = sbi->max_chunk - xmsi->used_trunk_count; + buf->f_bavail = sbi->max_chunk - xmsi->used_trunk_count; + if (xmsi->used_trunk_count > sbi->max_chunk) { + buf->f_bfree = 0; + buf->f_bavail = 0; + } + buf->f_files = sbi->max_chunk * (sbi->trunk_size / sbi->log_size); + buf->f_ffree = sbi->max_chunk * (sbi->trunk_size / sbi->log_size) - + sbi->used_ino; + if (sbi->id == 0) + buf->f_fsid = uuid_to_fsid(dentry->d_sb->s_uuid.b); + else + buf->f_fsid = xmsi->fsid; + put_xmsi(sbi, xmsi); + return 0; +} + +static int xmfs_show_options(struct seq_file *seq, struct dentry *root) +{ + struct xmfs_sb_info *sbi = XMFS_SB(root->d_sb); + +#ifdef CONFIG_XMFS_FS_URMA + if (!sbi->id) + seq_printf(seq, + ",id=%d,log_size=%d,size=%ld,addr=%lld,mode=%d,urma_dev_name=%s,urma_va=%llu,urma_eid_subnet_prefix=%llu, urma_eid_interface_id=%llu,urma_token_id=%u,urma_jetty_id=%u", + sbi->id, sbi->log_size, sbi->len, sbi->start, + sbi->mode, sbi->dev_name, + sbi->urma_cfg.urma_remote_va, + sbi->urma_cfg.urma_eid_subnet_prefix, + sbi->urma_cfg.urma_eid_interface_id, + sbi->urma_cfg.urma_token_id, + sbi->urma_cfg.urma_jetty_id); + else + seq_printf(seq, + ",id=%d,log_size=%d,size=%ld,addr=%lld,mode=%d,urma_dev_name=%s,urma_va=%llu,urma_eid_subnet_prefix=%llu, urma_eid_interface_id=%llu,urma_token_id=%u,urma_jetty_id=%u", + sbi->id, sbi->log_size, sbi->len, sbi->start, + sbi->mode, sbi->dev_name, + sbi->urma_cfg.own_info.urma_remote_va, + sbi->urma_cfg.own_info.urma_eid_subnet_prefix, + sbi->urma_cfg.own_info.urma_eid_interface_id, + sbi->urma_cfg.own_info.urma_token_id, + sbi->urma_cfg.own_info.urma_jetty_id); +#else + if (!sbi->id) + seq_printf(seq, ",id=%d,log_size=%d,size=%ld,addr=%lld,mode=%d", + sbi->id, sbi->log_size, sbi->len, sbi->start, + sbi->mode); + else + seq_printf(seq, ",id=%d,size=%ld,addr=%lld,mode=%d", sbi->id, + sbi->len, sbi->start, sbi->mode); +#endif + return 0; +} + +static int xmfs_syncfs(struct super_block *sb, int wait) +{ + return 0; +} + +static int xmfs_write_inode(struct inode *inode, struct writeback_control *wbc) +{ + return 0; +} + +static void xmfs_evict_inode(struct inode *inode) +{ + truncate_inode_pages_final(&inode->i_data); + clear_inode(inode); +} + +static const struct super_operations xmfs_ops = { + .alloc_inode = xmfs_alloc_inode, + .free_inode = xmfs_free_inode, + .destroy_inode = xmfs_destroy_inode, + .statfs = xmfs_statfs, + .show_options = xmfs_show_options, + .sync_fs = xmfs_syncfs, + .write_inode = xmfs_write_inode, + .drop_inode = generic_drop_inode, + .evict_inode = xmfs_evict_inode, +}; + +static int xmfs_find_index(struct xmfs_sb_info *sbi, + struct mount_msg_info *mm_info, bool mount_fn) +{ + int i; + + for (i = 1; i < 256; i++) { + if (mount_fn && mm_info->msg[i] == 'T') { + return i; + } else if (!mount_fn && mm_info->msg[i] != 'D' && + mm_info->msg[i] != 'T') { + /* mm_info_real->msg[i] = 'T'; */ + xmfs_info(NULL, + "------> %s write index %d", __func__, i); + mnt_msg_write(sbi, i, 'T'); + return i; + } + } + /* + * if (mount_fn && mm_info->msg[i - 1] != 'D') + * return -2; + */ + return -1; +} + +static int xmfs_host_mount_fn(void *data) +{ + struct xmfs_sb_info *sbi = data; + struct mount_msg_info *mm_info = + kmalloc(sizeof(struct mount_msg_info), GFP_KERNEL); + struct mount_msg_info *mm_info_real = get_mnt_msg(sbi); + + int id = 0; + int new, i, index; + int err; + + atomic_set(&mm_info_real->id, 0); + while (!kthread_should_stop()) { + err = copy_mc_to_kernel(mm_info, get_mnt_msg(sbi), + sizeof(struct mount_msg_info)); + if (unlikely(err)) { + xmfs_error(NULL, + "hardware memory error when host checking mount msgs"); + kfree(mm_info); + return err; + } + if (mm_info_real->msg[0] == 'T') + mm_info_real->msg[0] = 'D'; + + new = atomic_read(&mm_info->id); + if (new == id) { + schedule_timeout_interruptible(msecs_to_jiffies(100)); + continue; + } + xmfs_info(NULL, + "-------------------->got work to do %c %c %c %d %d", + mm_info_real->msg[1], mm_info_real->msg[2], + mm_info_real->msg[3], id, new); + /* + * print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_ADDRESS, 16, 1, + * mm_info_real, sizeof(struct mount_msg_info), true); + */ + for (i = id + 1; i <= new; i++) { + index = xmfs_find_index(sbi, mm_info, true); + xmfs_info(NULL, "-------------------->index :%d", + index); + if (index == -1) { + xmfs_info(NULL, + "There is a race, which means there alreayd have 255 read nodes or there are more than one write nodes mounted parallely."); + break; + } else if (index == -2) { + id++; + break; + } + mm_info_real->msg[index] = 'D'; + id++; + break; + } + + while (index > 0 && + (mm_info_real->urma_infos[index].urma_jetty_id == 0 || + mm_info_real->urma_infos[index].urma_remote_va == 0 || + mm_info_real->urma_infos[index].urma_token_id == 0 || + mm_info_real->send_infos[index].urma_jetty_id == 0 || + mm_info_real->send_infos[index].urma_send_token_id == + 0 || + mm_info_real->send_infos[index].urma_recv_token_id == + 0)) { + schedule_timeout_interruptible(msecs_to_jiffies(10)); + } + if (index > 0) { + sbi->mount_slave++; + xmfs_import_jetty(sbi, mm_info_real->urma_infos[index], + index, false); + xmfs_import_jetty(sbi, mm_info_real->send_infos[index], + index, true); + } + } + kfree(mm_info); + + return 0; +} + +static int xmfs_slave_monitor_fn(void *data) +{ + struct xmfs_sb_info *sbi = data; + int threshold = sbi->freq; + + xmfs_info(NULL, "threshold is %d", threshold); + struct inode *inode; + unsigned long index; + struct page_freq *page_freq; + int cnt; + + while (!kthread_should_stop()) { + spin_lock(&sbi->sb->s_inode_list_lock); + list_for_each_entry(inode, &sbi->sb->s_inodes, i_sb_list) { + if (S_ISDIR(inode->i_mode)) + continue; + + xa_for_each(&(XMFS_I(inode)->page_freq), index, + page_freq) { + if (page_freq->in_cache || + page_freq->never_in_cache || + page_freq->already_in_cache) { + continue; + } + cnt = atomic_read(&page_freq->read_count); + if (cnt >= threshold) + page_freq->in_cache = true; + } + } + spin_unlock(&sbi->sb->s_inode_list_lock); + + schedule_timeout_interruptible(msecs_to_jiffies(10000)); + } + + return 0; +} + +static int xmfs_init_msg_queue(struct xmfs_sb_info *sbi) +{ + struct task_struct *thread; + + if (sbi->id == 0) + thread = kthread_run(xmfs_host_mount_fn, sbi, "msg"); + else if (!sbi->always_hot && sbi->freq) + thread = kthread_run(xmfs_slave_monitor_fn, sbi, + "slave_monitor"); + else + return 0; + + if (IS_ERR(thread)) + return PTR_ERR(thread); + sbi->thread = thread; + + return 0; +} + +static int xmfs_blk_dax_notify_failure(struct dax_device *dax_devp, u64 offset, + u64 len, int mf_flags) +{ + xmfs_error(NULL, "%s: dax_devp %llx offset %llx len %lld mf_flags %x", + __func__, (u64)dax_devp, (u64)offset, (u64)len, mf_flags); + return -EOPNOTSUPP; +} + +static const struct dax_holder_operations xmfs_blk_dax_holder_ops = { + .notify_failure = xmfs_blk_dax_notify_failure, +}; + +static void xmfs_stop_threads(struct xmfs_sb_info *sbi) +{ + if (sbi->thread) { + kthread_stop(sbi->thread); + sbi->thread = NULL; + } + if (sbi->host_worker) { + kthread_stop(sbi->host_worker); + sbi->host_worker = NULL; + } + if (sbi->gc_thread) { + kthread_stop(sbi->gc_thread); + sbi->gc_thread = NULL; + } +} + +static void xmfs_destroy_workqueue(struct workqueue_struct **workqueue) +{ + if (!*workqueue) + return; + + flush_workqueue(*workqueue); + destroy_workqueue(*workqueue); + *workqueue = NULL; +} + +static void xmfs_release_backing_resources(struct xmfs_sb_info *sbi) +{ + if (sbi->dax_filp) { + filp_close(sbi->dax_filp, NULL); + sbi->dax_filp = NULL; + } + if (sbi->dax_dev) { + fs_put_dax(sbi->dax_dev, sbi); + sbi->dax_dev = NULL; + } + if (sbi->handlep) { + bdev_release(sbi->handlep); + sbi->handlep = NULL; + } +} + +static void xmfs_restore_anon_dev(struct super_block *sb, + struct xmfs_sb_info *sbi) +{ + if (sbi->dev) + sb->s_dev = sbi->dev; +} + +static int xmfs_ctx_validate(struct fs_context *fc) +{ + struct xmfs_fs_context *ctx = fc->fs_private; + const char *source = fc->source; + + if (!source) + return invalf(fc, "xmfs: source is required"); + if (!strstr(source, "/dev/pmem") && + !strstr(source, "/dev/obmm") && + !strstr(source, "/dev/loop")) + return invalf(fc, "xmfs: unsupported source %s", source); + + if (ctx->mode < XMFS_SHARED_MEM_MODE || + ctx->mode > XMFS_HYBRID_MODE) + return invalf(fc, "xmfs: invalid mode %d", ctx->mode); + if (ctx->host && ctx->mode != XMFS_SHARED_MEM_MODE) { + errorf(fc, "xmfs: host requires shared-memory mode"); + return -EOPNOTSUPP; + } + if (!IS_ENABLED(CONFIG_XMFS_FS_URMA) && + ctx->mode != XMFS_SHARED_MEM_MODE) { + errorf(fc, "xmfs: mode %d requires URMA support", ctx->mode); + return -EOPNOTSUPP; + } + return 0; +} + +static int xmfs_prepare_slave_transport(struct xmfs_sb_info *sbi, + struct xmfs_fs_context *ctx) +{ + int err; + + if (ctx->host || ctx->mode == XMFS_SHARED_MEM_MODE) + return 0; + + err = xmfs_urma_register(sbi, ctx); + if (err) + goto unregister; + + err = xmfs_urma_import(sbi); + if (!err) + return 0; + + sbi->magic = 0; + xmfs_urma_unimport(sbi); +unregister: + xmfs_urma_unregister(sbi); + return err; +} + +static int xmfs_prepare_host_transport(struct xmfs_sb_info *sbi, + struct xmfs_fs_context *ctx) +{ + if (!ctx->host) + return 0; + +#ifdef CONFIG_XMFS_FS_URMA + return xmfs_urma_register(sbi, ctx); +#else + return 0; +#endif +} + +static int xmfs_map_pmem_device(struct super_block *sb, struct fs_context *fc) +{ + struct xmfs_fs_context *ctx = fc->fs_private; + struct xmfs_sb_info *sbi = XMFS_SB(sb); + struct bdev_handle *handlep; + struct dax_device *dax_dev; + struct pmem_device *pmem; + u64 start_off = 0; + int err; + + handlep = bdev_open_by_path(fc->source, FMODE_READ | FMODE_WRITE, + sbi, NULL); + if (!handlep || IS_ERR(handlep)) + return handlep ? PTR_ERR(handlep) : -ENODEV; + if (!handlep->bdev || IS_ERR(handlep->bdev)) { + xmfs_error(NULL, "%s: failed blkdev_get_by_path(%s)", + __func__, fc->source); + err = handlep->bdev ? PTR_ERR(handlep->bdev) : -EINVAL; + bdev_release(handlep); + return err; + } + + sbi->dev = sb->s_dev; + sb->s_dev = handlep->bdev->bd_dev; + dax_dev = fs_dax_get_by_bdev(handlep->bdev, &start_off, + sbi /* holder */, + &xmfs_blk_dax_holder_ops); + if (IS_ERR(dax_dev) || !dax_dev) { + xmfs_error(NULL, + "%s: unable to get pmem dax dev from handlep->bdev", + __func__); + bdev_release(handlep); + return -ENODEV; + } + + pmem = dax_get_private(dax_dev); + if (IS_ERR(pmem) || !pmem) { + xmfs_error(NULL, + "%s: unable to get pmem dev from handlep->bdev", + __func__); + fs_put_dax(dax_dev, sbi); + bdev_release(handlep); + return -ENODEV; + } + + xmfs_info(NULL, "pmem %ld %lld", pmem->size, pmem->data_offset); + if (!ctx->size || ctx->size > pmem->size - pmem->data_offset) + ctx->size = pmem->size - pmem->data_offset; + + sbi->start = pmem->phys_addr + pmem->data_offset; + sbi->len = ctx->size; + sbi->kaddr = (void *)ioremap_cache(sbi->start, ctx->size); + xmfs_info(NULL, "pmem %p", sbi->kaddr); + /* sbi->dax_dev = dax_dev; */ + sbi->handlep = handlep; + fs_put_dax(dax_dev, sbi); + /* bdev_release(handlep); */ + + return 0; +} + +static int xmfs_probe_slave_backing(struct xmfs_sb_info *sbi, + struct xmfs_fs_context *ctx, + struct xmfs_sb_index *xmsi) +{ + int err; + + err = get_xmsi_and_copy(sbi, xmsi); + if (unlikely(err)) + return err; + if (xmsi->magic != XMFS_MAGIC) { + xmfs_info(NULL, "no host mount yet"); + return -EINVAL; + } + if (xmsi->len != ctx->size) { + xmfs_info(NULL, + "slave mount uses size %ld should use same size %ld as host", + ctx->size, xmsi->len); + ctx->size = xmsi->len; + } + + return 0; +} + +static int xmfs_map_pmem_address(struct xmfs_sb_info *sbi, + struct xmfs_fs_context *ctx, + struct xmfs_sb_index *xmsi) +{ + int err; + + if (!ctx->host) { + sbi->kaddr = (void *)ioremap_cache(ctx->addr, SB_SIZE); + err = xmfs_probe_slave_backing(sbi, ctx, xmsi); + if (err) { + xmfs_error(NULL, + "hardware memory error when reading xmsi during slave mount 1."); + return err; + } + iounmap(sbi->kaddr); + sbi->kaddr = NULL; + } + + sbi->kaddr = (void *)ioremap_cache(ctx->addr, ctx->size); + sbi->start = ctx->addr; + sbi->len = ctx->size; + xmfs_info(NULL, "pmem addr %p", sbi->kaddr); + + return 0; +} + +static int xmfs_map_obmm(struct xmfs_sb_info *sbi, + struct xmfs_fs_context *ctx, + struct xmfs_sb_index *xmsi) +{ + int err; + + if (!ctx->host) { + sbi->kaddr = (void *)memremap(ctx->addr, SB_SIZE, MEMREMAP_WB); + sbi->debug = ctx->debug; + err = xmfs_probe_slave_backing(sbi, ctx, xmsi); + if (err) { + xmfs_error(NULL, + "hardware memory error when reading xmsi during slave mount 2."); + return err; + } + iounmap(sbi->kaddr); + sbi->kaddr = NULL; + } + + sbi->kaddr = memremap(ctx->addr, ctx->size, MEMREMAP_WB); + sbi->start = ctx->addr; + sbi->len = ctx->size; + xmfs_info(NULL, "obmm addr %p", sbi->kaddr); + + return 0; +} + +static int xmfs_map_loop(struct xmfs_sb_info *sbi, + struct xmfs_fs_context *ctx, + struct xmfs_sb_index *xmsi) +{ + int err; + + if (ctx->host) { + sbi->kaddr = vzalloc(ctx->size); + xmfs_info(NULL, "mem addr %p", sbi->kaddr); + sbi->len = ctx->size; + return 0; + } + + sbi->debug = ctx->debug; + err = get_xmsi_and_copy(sbi, xmsi); + print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_ADDRESS, 16, 1, + xmsi, sizeof(struct xmfs_sb_index), true); + if (unlikely(err)) { + xmfs_error(NULL, + "hardware memory error when reading xmsi during slave mount 1."); + return err; + } + if (xmsi->magic != XMFS_MAGIC) { + xmfs_info(NULL, "no host mount yet"); + return -EINVAL; + } + if (xmsi->len != ctx->size) + ctx->size = xmsi->len; + + sbi->kaddr = sbi; + return 0; +} + +static int xmfs_map_backing(struct super_block *sb, struct fs_context *fc, + struct xmfs_sb_index *xmsi) +{ + struct xmfs_fs_context *ctx = fc->fs_private; + struct xmfs_sb_info *sbi = XMFS_SB(sb); + const char *source = fc->source; + int err; + + if (!source) + return -EINVAL; + + if (strstr(source, "/dev/pmem")) { + if (ctx->addr) + err = xmfs_map_pmem_address(sbi, ctx, xmsi); + else + err = xmfs_map_pmem_device(sb, fc); + } else if (strstr(source, "/dev/obmm")) { + err = xmfs_map_obmm(sbi, ctx, xmsi); + } else if (strstr(source, "/dev/loop")) { + err = xmfs_map_loop(sbi, ctx, xmsi); + } else { + xmfs_info(NULL, "other"); + return -EINVAL; + } + if (err) + return err; + + if (IS_ERR_OR_NULL(sbi->kaddr)) { + xmfs_error(NULL, "map error %ld", PTR_ERR(sbi->kaddr)); + return sbi->kaddr ? PTR_ERR(sbi->kaddr) : -EINVAL; + } + + if (ctx->host) + print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_ADDRESS, 16, 1, + sbi->kaddr, 512, true); + + return 0; +} + +static int xmfs_prepare_host_mount(struct xmfs_sb_info *sbi, + struct xmfs_fs_context *ctx) +{ + struct mount_msg_info *mm_info_real = get_mnt_msg(sbi); + struct mount_msg_info *mm_info = kmalloc(sizeof(*mm_info), GFP_KERNEL); + int loop_count = 0; + int old, tmp; + int err; + +host_get_id: + err = copy_mc_to_kernel(mm_info, get_mnt_msg(sbi), sizeof(*mm_info)); + if (unlikely(err)) { + xmfs_error(NULL, + "hardware memory error when reading superblock at beginning of mounting host and getting id"); + goto free_msg; + } + + old = atomic_read(&mm_info->host_mount); + if (old < 0 || old > 1) { + kfree(mm_info); + goto host_continue; + } else if (old == 1) { + schedule_timeout_interruptible(msecs_to_jiffies(10)); + goto host_get_id; + } + + tmp = atomic_cmpxchg(&mm_info_real->host_mount, old, 1); + if (tmp == old) { + mm_info_real->msg[0] = 'T'; + } else { + xmfs_info(NULL, + "exchange failed, someone else mounting parallel, skip this mount"); + err = -EINVAL; + goto free_msg; + } + + do { + err = copy_mc_to_kernel(mm_info, get_mnt_msg(sbi), + sizeof(*mm_info)); + if (unlikely(err)) { + xmfs_error(NULL, + "hardware memory error when reading superblock at beginning of mounting"); + goto free_msg; + } + loop_count++; + schedule_timeout_interruptible(msecs_to_jiffies(10)); + } while (mm_info->msg[0] != 'D' && loop_count <= 10); + + if (mm_info->msg[0] == 'D') { + mm_info_real->msg[0] = 'C'; + tmp = atomic_cmpxchg(&mm_info_real->host_mount, 1, old); + xmfs_info(NULL, + "host msg returns meaning host already mounted %d %d", + tmp, old); + err = -EINVAL; + goto free_msg; + } + + tmp = atomic_cmpxchg(&mm_info_real->host_mount, 1, old); + if (tmp != 1) + xmfs_info(NULL, + "when checking mounting host done, there is a bug when exchange host mount value to %d", + old); + kfree(mm_info); + + if (ctx->replay) { + sbi->id = 0; + /* + * memset(get_mnt_msg(sbi), 0, + * sizeof(struct mount_msg_info)); + */ + return 0; + } + +host_continue: + memset(sbi->kaddr, 0, DATA_AREA_OFFSET); + sbi->id = 0; + memcpy(sbi->kaddr + MOUNT_MSG_OFFSET + + offsetof(struct mount_msg_info, send_infos[0]), + &sbi->urma_cfg.send_info, sizeof(struct urma_info)); +#ifdef CONFIG_X86 + xmfs_info(NULL, "x86 mount"); + /* + * err = set_memory_uc((unsigned long)sbi->kaddr, + * DATA_AREA_OFFSET >> PAGE_SHIFT); + */ + /* xmfs_info(sbi->sb, "qyf set memory return err %d", err); */ +#elif defined(CONFIG_ARM) || defined(CONFIG_ARM64) + xmfs_info(NULL, "arm mount host"); + /* + * set_memory_noncacheable((unsigned long)sbi->kaddr, + * DATA_AREA_OFFSET); + */ +#endif + return 0; + +free_msg: + kfree(mm_info); + return err; +} + +static int xmfs_prepare_slave_mount(struct xmfs_sb_info *sbi, + struct xmfs_fs_context *ctx, + struct xmfs_sb_index *xmsi) +{ + struct mount_msg_info *mm_info = kmalloc(sizeof(*mm_info), GFP_KERNEL); + int loop_count = 0; + int old, new; + int index; + int err; + + err = get_mnt_msg_and_copy(sbi, mm_info); + if (unlikely(err)) { + xmfs_error(NULL, + "hardware memory error when reading superblock at beginning of mounting slave"); + goto free_msg; + } + +slave_get_id: + old = xmfs_atomic_read(sbi, mm_info); + new = old + 1; + xmfs_info(NULL, "------> cas target %d", new); + if (xmfs_cas(sbi, old, new) == old) { + index = xmfs_find_index(sbi, mm_info, false); + xmfs_info(NULL, "------> slave index %d", index); + if (index == -1) { + xmfs_info(NULL, + "Already have 255 mount nodes, cannot mount more"); + err = -EINVAL; + goto free_msg; + } + sbi->id = index; + xmfs_info(NULL, "------> slave id is %d", index); + } else { + err = get_mnt_msg_and_copy(sbi, mm_info); + if (unlikely(err)) { + xmfs_error(NULL, + "hardware memory error when reading superblock during mount slave"); + goto free_msg; + } + goto slave_get_id; + } + + while (mm_info->msg[sbi->id] != 'D' && loop_count < 10) { + loop_count++; + schedule_timeout_interruptible(msecs_to_jiffies(1000)); + err = get_mnt_msg_and_copy(sbi, mm_info); + if (unlikely(err)) { + xmfs_error(NULL, + "hardware memory error when reading superblock during mount slave %d", + index); + goto free_msg; + } + } + if (loop_count == 10) { + xmfs_info(NULL, "try 10 times to check msg mount but failed"); + err = -EINVAL; + goto free_msg; + } + + err = get_xmsi_and_copy(sbi, xmsi); + if (unlikely(err)) { + xmfs_error(NULL, + "hardware memory error when reading xmsi during slave mount."); + goto free_msg; + } + if (xmsi->magic != XMFS_MAGIC || xmsi->len != ctx->size) { + xmfs_info(NULL, + "using the wrong size %ld to mount slave, should use %ld", + ctx->size, xmsi->len); + err = -EINVAL; + goto free_msg; + } + + xmfs_info(NULL, "mount slave id %d", sbi->id); + sbi->log_start = xmsi->log_start; + sbi->last_replayed_slot = (unsigned long)-1; + get_mnt_msg_and_copy(sbi, mm_info); + xmfs_info(NULL, "host send info %lld %lld %lld %lld %d %d %d", + mm_info->send_infos[0].urma_send_va, + mm_info->send_infos[0].urma_recv_va, + mm_info->send_infos[0].urma_eid_subnet_prefix, + mm_info->send_infos[0].urma_eid_interface_id, + mm_info->send_infos[0].urma_jetty_id, + mm_info->send_infos[0].urma_send_token_id, + mm_info->send_infos[0].urma_recv_token_id); + xmfs_import_jetty(sbi, mm_info->send_infos[0], 0, true); + xmfs_pmem_write(sbi, + MOUNT_MSG_OFFSET + + offsetof(struct mount_msg_info, urma_infos[index]), + &sbi->urma_cfg.own_info, sizeof(struct urma_info)); + xmfs_pmem_write(sbi, + MOUNT_MSG_OFFSET + + offsetof(struct mount_msg_info, send_infos[index]), + &sbi->urma_cfg.send_info, sizeof(struct urma_info)); + +free_msg: + kfree(mm_info); + return err; +} + +static void xmfs_init_runtime_state(struct xmfs_sb_info *sbi, + const struct xmfs_fs_context *ctx) +{ + sbi->last_update = 0; + sbi->last_replayed_slot = (unsigned long)-1; + sbi->debug = ctx->debug; + sbi->fallocate_size = ctx->fallocate_size; + spin_lock_init(&sbi->space_lock); + init_rwsem(&sbi->chain_rwsem); + spin_lock_init(&sbi->version_lock); + mutex_init(&sbi->replay_lock); + spin_lock_init(&sbi->local_ring_lock); + xa_init(&sbi->pinned_inodes); +#ifdef CONFIG_XMFS_FS_URMA + memcpy(sbi->dev_name, ctx->dev_name, sizeof(ctx->dev_name)); +#endif + sbi->host_worker = NULL; + sbi->max_slave_id = 0; + + spin_lock_init(&sbi->gc_ctl.gc_lock); + init_waitqueue_head(&sbi->gc_ctl.wait); + sbi->gc_ctl.gc_running = false; + sbi->gc_ctl.gc_batch = XMFS_GC_BATCH; + sbi->gc_ctl.gc_cursor = 0; + sbi->gc_interval = XMFS_GC_INTERVAL_DEFAULT; + sbi->mount_slave = 0; +} + +static void xmfs_init_log_geometry(struct xmfs_sb_info *sbi, int log_size) +{ + if (!log_size) { + sbi->log_size = XMFS_DEFAULT_CHUNK_SIZE; + sbi->trunk_size = XMFS_DEFAULT_CHUNK_SIZE; + } else if (log_size > XMFS_DEFAULT_CHUNK_SIZE) { + sbi->trunk_size = log_size; + sbi->log_size = log_size; + } else { + sbi->trunk_size = XMFS_DEFAULT_CHUNK_SIZE; + sbi->log_size = log_size; + } +} + +static int xmfs_configure_super(struct super_block *sb, + struct xmfs_fs_context *ctx, + struct xmfs_sb_index *xmsi) +{ + struct xmfs_sb_info *sbi = XMFS_SB(sb); + int err; + + xmfs_init_runtime_state(sbi, ctx); + if (ctx->host) + xmfs_init_log_geometry(sbi, ctx->log_size); + + err = get_xmsi_and_copy(sbi, xmsi); + if (unlikely(err)) { + xmfs_error(NULL, + "hardware memory error when reading xmsi during host mount 2."); + return err; + } + + if (ctx->host && ctx->replay && xmsi->magic == XMFS_MAGIC) { + xmfs_info(NULL, "replay"); + if (sbi->log_size != xmsi->log_size || ctx->size != xmsi->len) { + memset(sbi->kaddr, 0, DATA_AREA_OFFSET); + sbi->id = 0; + ctx->replay = false; + } + } + if (ctx->host && ctx->replay && xmsi->magic != XMFS_MAGIC) { + memset(sbi->kaddr, 0, DATA_AREA_OFFSET); + sbi->id = 0; + ctx->replay = false; + } + + sb->s_maxbytes = MAX_LFS_FILESIZE; + sb->s_blocksize = PAGE_SIZE; + sb->s_blocksize_bits = PAGE_SHIFT; + sb->s_magic = XMFS_MAGIC; + sb->s_op = &xmfs_ops; + xmfs_init_dentry_operations(sb); + sb->s_time_gran = 1; + if (sbi->id == 0) + uuid_gen(&sb->s_uuid); + if (ctx->host) { + sb->s_xattr = xmfs_host_xattr_handlers; + } else { + sb->s_xattr = xmfs_slave_xattr_handlers; + sbi->log_size = xmsi->log_size; + ctx->log_size = sbi->log_size; + xmfs_init_log_geometry(sbi, ctx->log_size); + } + + sbi->max_chunk = + (ctx->size - DATA_AREA_OFFSET) / sbi->trunk_size - 1; + xmfs_info(NULL, "max chunk %ld %ld %ld %ld", sbi->max_chunk, + sizeof(struct xmfs_log_trunk), sizeof(struct mount_msg_info), + DATA_AREA_OFFSET); + + return 0; +} + +static int xmfs_create_root(struct super_block *sb) +{ + struct xmfs_sb_info *sbi = XMFS_SB(sb); + + sb->s_root = d_make_root(xmfs_get_root(sb, sbi->id)); + if (!sb->s_root) + return -ENOMEM; + + return 0; +} + +static int xmfs_alloc_workqueues(struct xmfs_sb_info *sbi) +{ + sbi->prefetch_wq = alloc_workqueue("xmfs-prefetch", + WQ_UNBOUND | WQ_MEM_RECLAIM, 16); + if (!sbi->prefetch_wq) + return -ENOMEM; + + sbi->send_wq = alloc_workqueue("xmfs-send-req", + WQ_UNBOUND | WQ_MEM_RECLAIM, 128); + if (!sbi->send_wq) + return -ENOMEM; + + return 0; +} + +static int xmfs_start_workers(struct xmfs_sb_info *sbi) +{ + struct xmfs_inode_table *tbl; + int err; + + err = xmfs_init_msg_queue(sbi); + if (sbi->id == 0) { + sbi->gc_thread = kthread_run(xmfs_gc_thread_fn, sbi, "xmfs_gc"); + if (IS_ERR(sbi->gc_thread)) + sbi->gc_thread = NULL; + sbi->max_slave_id = 63; + + tbl = (struct xmfs_inode_table *)get_meta(sbi, + INODE_TABLE_OFFSET, + INODE_TABLE_SIZE); + tbl->magic = XMFS_INODE_TABLE_MAGIC; + } else { + sbi->gc_thread = kthread_run(xmfs_gc_thread_slave_fn, sbi, + "xmfs_slave_gc"); + if (IS_ERR(sbi->gc_thread)) + sbi->gc_thread = NULL; + } + + return err; +} + +static int xmfs_finalize_host_mount(struct super_block *sb, + struct xmfs_fs_context *ctx, + struct xmfs_sb_index *xmsi) +{ + struct xmfs_sb_info *sbi = XMFS_SB(sb); + struct xmfs_sb_index *xmsi_real; + + if (ctx->replay && xmsi->magic == XMFS_MAGIC) { + xmfs_info(NULL, "replay"); + if (sbi->log_size != xmsi->log_size) { + xmfs_info(NULL, + "mount host again with wrong log size %d should be %d", + sbi->log_size, xmsi->log_size); + return -EINVAL; + } + if (ctx->size != xmsi->len) { + xmfs_info(NULL, + "mount host again with wrong size %ld should be %ld", + ctx->size, xmsi->len); + return -EINVAL; + } + sbi->during_replay = true; + xmfs_replay_new_entries(sbi, NULL, -1); + sbi->during_replay = false; + } + + if (ctx->replay) { + struct xmfs_sb_index *xmsi_r = get_xmsi(sbi); + + if (xmsi_r) { + unsigned long used_trunks = 0; + unsigned long i; + + for (i = 0; + i < xmsi_r->count && i < XMFS_BITMAP_CAPACITY; + i++) { + if (xmsi_r->bitmap[i] != 'u') + used_trunks++; + } + xmsi_r->used_trunk_count = used_trunks; + put_xmsi(sbi, xmsi_r); + } + } + + xmsi_real = get_xmsi(sbi); + xmsi_real->magic = XMFS_MAGIC; + xmsi_real->log_size = sbi->log_size; + xmsi_real->len = ctx->size; + xmsi_real->fsid = uuid_to_fsid(sb->s_uuid.b); + if (!ctx->replay) { + memset(xmsi_real->bitmap, 'u', XMFS_BITMAP_CAPACITY); + xmsi_real->bitmap_size = 0; + xmsi_real->used_trunk_count = 0; + } + + /* xmfs_populate_from_inode_table(sbi); */ + if (!ctx->replay && XMFS_I(sb->s_root->d_inode)->log_start == 0) { + struct xmfs_log xm_log; + unsigned long xmlt_addr; + + xm_log.ops = XMFS_ROOT; + xmfs_info(NULL, "root 1 %p", XMFS_I(sb->s_root->d_inode)); + xmlt_addr = xmfs_add_log_v3(&xm_log, sbi, 0, + sb->s_root->d_inode->i_ino, true); + if (xmlt_addr < 0) + return -EINVAL; + sbi->last_update = 0; + xmfs_info(NULL, "log start %ld", + XMFS_I(sb->s_root->d_inode)->log_start); + } + /* + * sbi->xmfs_log_wq = alloc_ordered_workqueue("xmfs_log_wq", + * WQ_MEM_RECLAIM); + */ + + return 0; +} + +static int xmfs_fill_super(struct super_block *sb, struct fs_context *fc) +{ + struct xmfs_fs_context *ctx = fc->fs_private; + struct xmfs_sb_index *xmsi; + struct xmfs_sb_info *sbi; + int err; + + sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); + if (!sbi) + return -ENOMEM; + sb->s_fs_info = sbi; + xmfs_init_log_ratelimits(sbi); + sbi->mode = ctx->mode; + sbi->magic = XMFS_MAGIC; + xmsi = kmalloc(sizeof(*xmsi), GFP_KERNEL); + + err = xmfs_prepare_slave_transport(sbi, ctx); + if (err) + goto free_sbi; + + err = xmfs_map_backing(sb, fc, xmsi); + if (err) + goto free_kaddr; + + err = xmfs_prepare_host_transport(sbi, ctx); + if (err) + goto release_dev; + + if (ctx->host) + err = xmfs_prepare_host_mount(sbi, ctx); + else + err = xmfs_prepare_slave_mount(sbi, ctx, xmsi); + if (err) + goto release_dev; + + err = xmfs_configure_super(sb, ctx, xmsi); + if (err) + goto stop_thread; + + err = xmfs_create_root(sb); + if (err) + goto release_dev; + + err = xmfs_alloc_workqueues(sbi); + if (err) + goto release_root; + + err = security_inode_init_security(sb->s_root->d_inode, + sb->s_root->d_parent->d_inode, + &sb->s_root->d_name, xmfs_initxattrs, + NULL); + if (err) + goto release_root; + + sbi->sb = sb; + sbi->used_ino = 0; + sbi->freq = ctx->freq; + sbi->always_hot = ctx->always_hot; + err = xmfs_start_workers(sbi); + if (err) + goto stop_thread; + + if (ctx->host) { + err = super_setup_bdi(sb); + if (err) { + xmfs_info(NULL, "setup bdi failed"); + goto stop_thread; + } + + err = xmfs_finalize_host_mount(sb, ctx, xmsi); + if (err) + goto stop_thread; + } + + kfree(xmsi); + if (ctx->host) + print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_ADDRESS, 16, 1, + sbi->kaddr, 400, true); + return 0; + +stop_thread: + xmfs_stop_threads(sbi); +release_root: + dput(sb->s_root); + sb->s_root = NULL; + xmfs_destroy_workqueue(&sbi->prefetch_wq); + xmfs_destroy_workqueue(&sbi->send_wq); +release_dev: + xmfs_release_backing_resources(sbi); +free_kaddr: + if (ctx->host) + vfree(sbi->kaddr); + sbi->magic = 0; + xmfs_urma_unimport(sbi); + xmfs_urma_unregister(sbi); +free_sbi: + xmfs_restore_anon_dev(sb, sbi); + if (sb->s_fs_info == sbi) + sb->s_fs_info = NULL; + kfree(sbi); + kfree(xmsi); + return err; +} + +static int xmfs_get_tree(struct fs_context *fc) +{ + int err; + + err = xmfs_ctx_validate(fc); + if (err) + return err; + + return get_tree_nodev(fc, xmfs_fill_super); +} + +static const struct fs_parameter_spec xmfs_param_specs[] = { + fsparam_bool("host", Opt_host), + fsparam_bool("replay", Opt_replay), + fsparam_bool("debug", Opt_debug), + fsparam_bool("hot", Opt_always_hot), + fsparam_u64("addr", Opt_addr), + fsparam_u64("size", Opt_size), + fsparam_u64("fallocate", Opt_fallocate), + fsparam_s32("freq", Opt_freq), + fsparam_s32("log", Opt_log), + fsparam_s32("mode", Opt_mode), +#ifdef CONFIG_XMFS_FS_URMA + fsparam_string("urma_dev_name", Opt_urma_dev), + fsparam_u64("urma_va", Opt_urma_va), + fsparam_u64("urma_eid_subnet_prefix", Opt_urma_eid_subnet_prefix), + fsparam_u64("urma_eid_interface_id", Opt_urma_eid_interface_id), + fsparam_u32("urma_jetty_id", Opt_urma_jetty_id), + fsparam_u32("urma_token_id", Opt_urma_token_id), +#endif + {} +}; + +static int xmfs_parse_param(struct fs_context *fc, struct fs_parameter *param) +{ + struct xmfs_fs_context *ctx = fc->fs_private; + struct fs_parse_result result; + int opt; + + opt = fs_parse(fc, xmfs_param_specs, param, &result); + if (opt < 0) + return opt; + + switch (opt) { + case Opt_host: + ctx->host = result.boolean; + break; + case Opt_replay: + ctx->replay = result.boolean; + break; + case Opt_addr: + ctx->addr = result.uint_64; + break; + case Opt_size: + ctx->size = result.uint_64; + break; + case Opt_freq: + ctx->freq = result.int_32; + break; + case Opt_log: + ctx->log_size = result.int_32; + break; + case Opt_debug: + ctx->debug = result.boolean; + break; + case Opt_always_hot: + ctx->always_hot = result.boolean; + break; + case Opt_fallocate: + ctx->fallocate_size = result.uint_64; + break; + case Opt_mode: + ctx->mode = result.int_32; + break; +#ifdef CONFIG_XMFS_FS_URMA + case Opt_urma_va: + ctx->urma_va = result.uint_64; + break; + case Opt_urma_eid_subnet_prefix: + ctx->urma_eid_subnet_prefix = result.uint_64; + break; + case Opt_urma_eid_interface_id: + ctx->urma_eid_interface_id = result.uint_64; + break; + case Opt_urma_jetty_id: + ctx->urma_jetty_id = result.uint_32; + break; + case Opt_urma_token_id: + ctx->urma_token_id = result.uint_32; + break; + case Opt_urma_dev: + memcpy(ctx->dev_name, param->string, strlen(param->string)); + break; +#endif + default: + return -ENOPARAM; + } + + return 0; +} + +static void xmfs_fs_context_free(struct fs_context *fc) +{ + kfree(fc->fs_private); +} + +static const struct fs_context_operations xmfs_fs_context_ops = { + .get_tree = xmfs_get_tree, + .parse_param = xmfs_parse_param, + .free = xmfs_fs_context_free, +}; + +static int xmfs_init_fs_context(struct fs_context *fc) +{ + struct xmfs_fs_context *ctx; + + ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); + if (!ctx) + return -ENOMEM; + + fc->fs_private = ctx; + fc->ops = &xmfs_fs_context_ops; + + return 0; +} + +static void xmfs_unpin_all_inodes(struct xmfs_sb_info *sbi) +{ + struct inode *inode; + unsigned long index; + + /* Each xarray entry retains one inode reference until it is erased here. */ + xa_for_each(&sbi->pinned_inodes, index, inode) { + inode = xa_erase(&sbi->pinned_inodes, index); + if (!inode) + continue; + + iput(inode); + cond_resched(); + } + + xa_destroy(&sbi->pinned_inodes); +} + +static void xmfs_shutdown_sb(struct super_block *sb, + struct xmfs_sb_info *sbi) +{ + mnt_msg_write(sbi, sbi->id, 'C'); + sbi->magic = 0; + + xmfs_stop_threads(sbi); + xmfs_destroy_workqueue(&sbi->prefetch_wq); + xmfs_destroy_workqueue(&sbi->send_wq); + + xmfs_restore_anon_dev(sb, sbi); + xmfs_unpin_all_inodes(sbi); +} + +static void xmfs_release_sb_info(struct xmfs_sb_info *sbi) +{ + xmfs_release_backing_resources(sbi); + if (sbi->kaddr != sbi) + vfree(sbi->kaddr); + sbi->kaddr = NULL; + xmfs_urma_unimport(sbi); + xmfs_urma_unregister(sbi); + kfree(sbi); +} + +static void xmfs_kill_sb(struct super_block *sb) +{ + struct xmfs_sb_info *sbi = XMFS_SB(sb); + + if (sbi) + xmfs_shutdown_sb(sb, sbi); + + kill_litter_super(sb); + + if (sbi) + xmfs_release_sb_info(sbi); +} + +static struct file_system_type xmfs_fs_type = { + .name = "xmfs", + .owner = THIS_MODULE, + .init_fs_context = xmfs_init_fs_context, + .parameters = xmfs_param_specs, + .kill_sb = xmfs_kill_sb, +}; + +static void xmfs_init_once(void *data) +{ + struct xmfs_inode_info *xmfs_inode = data; + + inode_init_once(&xmfs_inode->vfs_inode); +} + +static int __init init_xmfs(void) +{ + int err; + + xmfs_inode_cachep = kmem_cache_create("xmfs_inode_cache", + sizeof(struct xmfs_inode_info), 0, + SLAB_ACCOUNT, xmfs_init_once); + if (!xmfs_inode_cachep) + return -ENOMEM; + + err = register_filesystem(&xmfs_fs_type); + if (err) + kmem_cache_destroy(xmfs_inode_cachep); + + return err; +} + +static void __exit exit_xmfs(void) +{ + unregister_filesystem(&xmfs_fs_type); + kmem_cache_destroy(xmfs_inode_cachep); +} + +module_init(init_xmfs); +module_exit(exit_xmfs); + +MODULE_AUTHOR("Yifan Qiao <qiaoyifan4(a)huawei.com>"); +MODULE_DESCRIPTION("Log Structured Filesystem for UB"); +MODULE_LICENSE("GPL"); diff --git a/fs/xmfs/symlink.c b/fs/xmfs/symlink.c new file mode 100644 index 000000000000..20870b18f325 --- /dev/null +++ b/fs/xmfs/symlink.c @@ -0,0 +1,87 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * XMFS: Log Structured Filesystem for UB + * Copyright (C) 2024. Huawei Technologies Co., Ltd + * + * This program can be distributed under the terms of the GNU GPL. + * See the file COPYING. + */ + +#include "xmfs_i.h" + +#include <linux/pagemap.h> + +static void xmfs_put_link(void *arg) +{ + /* xmfs_info(NULL, "qyf put folio %p", arg); */ + folio_put(arg); +} + +static void xmfs_put_page(void *arg) +{ + /* xmfs_info(NULL, "qyf put page %p", page_address(arg)); */ + put_page(arg); +} + +static const char *xmfs_get_link(struct dentry *dentry, struct inode *inode, + struct delayed_call *done) +{ + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + if (!dentry) { + struct folio *folio = filemap_get_folio(inode->i_mapping, 0); + + if (IS_ERR(folio)) + return ERR_PTR(-ECHILD); + set_delayed_call(done, xmfs_put_link, folio); + return folio_address(folio); + } + struct folio *folio = filemap_get_folio(inode->i_mapping, 0); + + if (IS_ERR(folio)) { + struct xmfs_log *ulog = get_log(sbi, XMFS_I(inode)->symname); + struct page *page = alloc_page(GFP_KERNEL); + char *ret = kmap_local_page(page); + + if (ulog->end_index > sbi->len) { + xmfs_info(inode->i_sb, "get link wrong %ld %ld", + inode->i_ino, XMFS_I(inode)->symname); + } + if (!ulog->end_index) { + memcpy(ret, ulog->name, strlen(ulog->name) + 1); + } else { + memcpy(ret, get_data(sbi, ulog->end_index, ulog->index), + ulog->index); + } + kunmap_local(ret); + set_page_dirty(page); + + set_delayed_call(done, xmfs_put_page, page); + if (!ret || !page_address(page)) { + xmfs_info(inode->i_sb, "get link 1 return null %s", + dentry->d_name.name); + } + return page_address(page); + } + + set_delayed_call(done, xmfs_put_link, folio); + return folio_address(folio); +} + +static const struct inode_operations xmfs_symlink_inode_operations = { + .setattr = xmfs_setattr, + .getattr = xmfs_getattr, + .get_link = xmfs_get_link, + .listxattr = xmfs_listxattr, + .update_time = xmfs_update_time, +}; + +void xmfs_init_symlink_mapping(struct inode *inode) +{ + xmfs_init_file_mapping(inode); +} + +void xmfs_init_symlink_operations(struct inode *inode) +{ + inode->i_op = &xmfs_symlink_inode_operations; +} diff --git a/fs/xmfs/urma.c b/fs/xmfs/urma.c new file mode 100644 index 000000000000..d73b825bdbfe --- /dev/null +++ b/fs/xmfs/urma.c @@ -0,0 +1,2482 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include "xmfs_i.h" + +#ifdef CONFIG_XMFS_FS_URMA + +#include <ub/urma/ubcore_types.h> +#include <ub/urma/ubcore_uapi.h> +#include <ub/urma/ubcore_api.h> +#include <linux/hashtable.h> +#include <linux/list.h> +#include <linux/spinlock.h> +#include <linux/completion.h> +#include <linux/atomic.h> +#include <linux/kthread.h> +#include <linux/delay.h> +#include <linux/jiffies.h> +#include <linux/interrupt.h> +#include <linux/cacheflush.h> + +static struct ubcore_device *g_urma_dev[10]; +static char g_dev_name[100]; + +enum xmfs_urma_status { + URMA_ISSUING = 1, + URMA_COMPLETE, + URMA_ERROR, +}; + +struct wr_status { + int magic; + refcount_t refs; + int ret; + int ops; + int slot; + enum xmfs_urma_status status; + struct completion done; +}; + +#define XMFS_ACCESS_LOCAL_ONLY 0x1 +#define XMFS_ACCESS_READ (0x1 << 1) +#define XMFS_ACCESS_WRITE (0x1 << 2) +#define XMFS_ACCESS_ATOMIC (0x1 << 3) + +#define XMFS_DEPTH 1024 +#define XMFS_POST_RETRY_CNT 100 + +static void xmfs_wrs_get(struct wr_status *wrs) +{ + refcount_inc(&wrs->refs); +} + +static void xmfs_wrs_put(struct wr_status **wrs) +{ + if (refcount_dec_and_test(&(*wrs)->refs)) { + /* xmfs_info(NULL, "qyf FREE 1 wrs=%px", *wrs); */ + kfree(*wrs); + *wrs = NULL; + } +} + +static int xmfs_add_udma_device(struct ubcore_device *ubc_dev) +{ + xmfs_info(NULL, "add device %p %s %p %p %d", ubc_dev, ubc_dev->dev_name, + ubc_dev->ops->register_seg, ubc_dev->ops->unregister_seg, + IS_ERR_OR_NULL(ubc_dev->eid_table.eid_entries)); + xmfs_info(NULL, "hooks check %p %p %p", ubc_dev->ops->import_jetty, + ubc_dev->ops->import_jetty_ex, ubc_dev->ops->import_seg); + if (ubc_dev == NULL) { + xmfs_error(NULL, + "Param ubc_dev is null, add udma device fail."); + return -EINVAL; + } + + if (strcmp(ubc_dev->dev_name, g_dev_name) == 0) { + xmfs_info(NULL, "find udma dev %s", ubc_dev->dev_name); + g_urma_dev[0] = ubc_dev; + xmfs_error(NULL, "--------->g_urma_dev set"); + } + return 0; +} + +static void xmfs_remove_udma_device(struct ubcore_device *ubc_dev, + void *client_ctx) +{ + xmfs_error(NULL, "ubma device removed %s, all in-flight ops will fail", + ubc_dev->dev_name); +} + +static int xmfs_urma_pool_init(struct xmfs_urma_pool *pool, void *base, + size_t total_size, size_t slot_size) +{ + pool->base = base; + pool->total_size = total_size; + pool->slot_size = slot_size; + + if (slot_size == PAGE_SIZE) + pool->nr_slots = total_size / slot_size; + else + pool->nr_slots = XMFS_DEPTH; + pool->free_slots = pool->nr_slots; + pool->bitmap = bitmap_zalloc(pool->nr_slots, GFP_KERNEL); + if (!pool->bitmap) + return -ENOMEM; + xmfs_info(NULL, "pool init nr %d slot_size %ld total %ld", + pool->nr_slots, pool->slot_size, pool->total_size); + spin_lock_init(&pool->lock); + init_waitqueue_head(&pool->waitq); + + return 0; +} + +static void xmfs_urma_pool_destroy(struct xmfs_urma_pool *pool) +{ + bitmap_free(pool->bitmap); +} + +void xmfs_urma_unregister(struct xmfs_sb_info *sbi) +{ + if (!sbi) + return; + for (int i = 0; i < 5; i++) + if (sbi->urma_cfg.jetty[i]) + ubcore_delete_jetty(sbi->urma_cfg.jetty[i]); + if (sbi->urma_cfg.jfr) + ubcore_delete_jfr(sbi->urma_cfg.jfr); + if (sbi->urma_cfg.jfc) + ubcore_delete_jfc(sbi->urma_cfg.jfc); + if (sbi->urma_cfg.local_seg) + ubcore_unregister_seg(sbi->urma_cfg.local_seg); + if (sbi->urma_cfg.urma_local_va) + vfree(sbi->urma_cfg.urma_local_va); + if (sbi->urma_cfg.ubc_dev) + ubcore_unregister_client(&sbi->urma_cfg.ubc_client); + xmfs_urma_pool_destroy(&sbi->urma_cfg.pool); + xmfs_urma_pool_destroy(&sbi->urma_cfg.send_pool); + if (sbi->urma_cfg.send_jetty) + ubcore_delete_jetty(sbi->urma_cfg.send_jetty); + if (sbi->urma_cfg.send_jfr) + ubcore_delete_jfr(sbi->urma_cfg.send_jfr); + if (sbi->urma_cfg.send_jfc) + ubcore_delete_jfc(sbi->urma_cfg.send_jfc); + if (sbi->urma_cfg.recv_jfc) + ubcore_delete_jfc(sbi->urma_cfg.recv_jfc); + if (sbi->urma_cfg.send_seg) + ubcore_unregister_seg(sbi->urma_cfg.send_seg); + if (sbi->urma_cfg.recv_seg) + ubcore_unregister_seg(sbi->urma_cfg.recv_seg); + if (sbi->urma_cfg.recv_buf) + vfree(sbi->urma_cfg.recv_buf); + if (sbi->urma_cfg.send_buf) + vfree(sbi->urma_cfg.send_buf); + xa_destroy(&sbi->urma_cfg.grant_waits); + /* g_urma_client = NULL; */ +} + +static void *urma_pool_acquire(struct xmfs_urma_pool *pool, u32 *slot) +{ + unsigned long flags; + u32 idx; + int ret; + + for (;;) { + spin_lock_irqsave(&pool->lock, flags); + + idx = find_first_zero_bit(pool->bitmap, pool->nr_slots); + + if (idx < pool->nr_slots) { + __set_bit(idx, pool->bitmap); + pool->free_slots--; + spin_unlock_irqrestore(&pool->lock, flags); + + if (slot) + *slot = idx; + return pool->base + idx * pool->slot_size; + } + + spin_unlock_irqrestore(&pool->lock, flags); + + ret = wait_event_interruptible_timeout(pool->waitq, + READ_ONCE(pool->free_slots) >= + 1, + msecs_to_jiffies(25000)); + if (ret <= 0) + return NULL; + } + + return NULL; +} + +void *urma_pool_acquire_nslots(struct xmfs_urma_pool *pool, int nr, u32 *slots) +{ + unsigned long flags; + u32 idx, pos; + int found; + int ret; + + if (unlikely(nr <= 0 || nr > pool->nr_slots)) + return NULL; + + for (;;) { + found = 0; + pos = 0; + + spin_lock_irqsave(&pool->lock, flags); + + /* 空闲slot数量都不够，直接等待 */ + if (pool->free_slots < nr) + goto retry; + + /* 找到 nr 个空闲slot */ + while (found < nr) { + idx = find_next_zero_bit(pool->bitmap, pool->nr_slots, + pos); + + if (idx >= pool->nr_slots) + break; + + __set_bit(idx, pool->bitmap); + slots[found++] = idx; + pos = idx + 1; + } + + /* 成功拿到全部slot */ + if (likely(found == nr)) { + void *addr; + + pool->free_slots -= nr; + + addr = pool->base + slots[0] * pool->slot_size; + + spin_unlock_irqrestore(&pool->lock, flags); + return addr; + } + + /* + * 理论上不会进入这里： + * free_slots >= nr，但扫描过程中没找到足够slot。 + * 为了健壮性仍然回滚。 + */ + while (found > 0) + __clear_bit(slots[--found], pool->bitmap); + +retry: + spin_unlock_irqrestore(&pool->lock, flags); + + ret = wait_event_interruptible_timeout(pool->waitq, + READ_ONCE(pool->free_slots) >= + nr, + msecs_to_jiffies(25000)); + if (ret <= 0) + return NULL; + } +} + +void urma_pool_release_nslots(struct xmfs_urma_pool *pool, int nr, + const u32 *slots) +{ + unsigned long flags; + int i; + + spin_lock_irqsave(&pool->lock, flags); + + for (i = 0; i < nr; i++) { + WARN_ON(!test_bit(slots[i], pool->bitmap)); + __clear_bit(slots[i], pool->bitmap); + } + + pool->free_slots += nr; + + spin_unlock_irqrestore(&pool->lock, flags); + + wake_up_all(&pool->waitq); +} + +void urma_pool_release(struct xmfs_urma_pool *pool, u32 slot) +{ + unsigned long flags; + + if (WARN_ON(slot >= pool->nr_slots || slot < 0)) + return; + + spin_lock_irqsave(&pool->lock, flags); + + if (!test_bit(slot, pool->bitmap)) + xmfs_info(NULL, "err release find bit %d empty", slot); + + __clear_bit(slot, pool->bitmap); + pool->free_slots++; + spin_unlock_irqrestore(&pool->lock, flags); + + wake_up(&pool->waitq); +} + +static void *xmfs_get_recv_buf(struct xmfs_sb_info *sbi, int idx) +{ + return (char *)sbi->urma_cfg.recv_buf + + idx * sizeof(struct xmfs_rw_msg); +} + +static int xmfs_post_recv(struct xmfs_sb_info *sbi, int idx) +{ + struct ubcore_jfr_wr *bad_wr = NULL; + struct ubcore_jfr_wr wr = {}; + struct ubcore_sge sge = {}; + int ret; + + sge.addr = (uint64_t)xmfs_get_recv_buf(sbi, idx); + sge.len = sizeof(struct xmfs_rw_msg); + sge.tseg = sbi->urma_cfg.recv_seg; + + wr.src.sge = &sge; + wr.src.num_sge = 1; + wr.user_ctx = idx; + wr.next = NULL; + + ret = ubcore_post_jetty_recv_wr(sbi->urma_cfg.send_jetty, &wr, &bad_wr); + if (ret) + xmfs_info(NULL, "err xmfs post recv buffer failed ret %d", ret); + + return ret; +} + +static void xmfs_process_recv(struct xmfs_sb_info *sbi, struct ubcore_cr *cr) +{ + struct wr_status *wrs; + + if (cr->status != UBCORE_CR_SUCCESS) { + xmfs_warning(sbi->sb, + "JFC receive completion failed: status %d opcode %d", + cr->status, cr->opcode); + if (cr->status == UBCORE_CR_WR_FLUSH_ERR_DONE) + return; + } + wrs = (struct wr_status *)(uintptr_t)cr->user_ctx; + if (!virt_addr_valid(wrs)) { + xmfs_info(NULL, "jfc callback got an invalid wrs %p", wrs); + return; + } + /* xmfs_info(sbi->sb, "qyf COMP user_ctx=%llx", cr->user_ctx); */ + if (!wrs || wrs->magic != XMFS_MAGIC) { + xmfs_info(NULL, + "err cannot get a correct wrs during process recv %p", + wrs); + return; + } + if (cr->status == UBCORE_CR_SUCCESS) + wrs->status = URMA_COMPLETE; + else { + wrs->status = URMA_ERROR; + wrs->ret = cr->status; + } + if (wrs->ops == XMFS_URMA_SEND) + xmfs_info(NULL, "err slave send jfc callback"); + + if (wrs->ops == XMFS_URMA_WRITE && wrs->slot != -1) { + if (wrs->slot >= sbi->urma_cfg.pool.nr_slots || wrs->slot < 0) + xmfs_info(NULL, + "err jfc process write got wrong slot %d %d", + wrs->slot, sbi->urma_cfg.pool.nr_slots); + else + urma_pool_release(&sbi->urma_cfg.pool, wrs->slot); + } + complete(&wrs->done); + xmfs_wrs_put(&wrs); +} + +static void xmfs_jfc_callback(struct ubcore_jfc *jfc) +{ + struct ubcore_cr cr[8]; + + if (!jfc) + return; + struct xmfs_sb_info *sbi = jfc->jfc_cfg.jfc_context; + int ret, i; + + if (!jfc || !sbi || sbi->magic != XMFS_MAGIC) + return; + + if (jfc != sbi->urma_cfg.jfc) { + xmfs_error(NULL, "err foreign jfc cr, drop it"); + ubcore_rearm_jfc(jfc, false); + return; + } + + /* xmfs_info(sbi->sb, "qyf jfc callback"); */ + + do { + ret = ubcore_poll_jfc(jfc, 1, cr); + if (ret < 0) { + xmfs_info(NULL, "err jfc poll failed %d", ret); + break; + } + + for (i = 0; i < ret; i++) + xmfs_process_recv(sbi, &cr[i]); + } while (ret > 0 && jfc && sbi && sbi->magic == XMFS_MAGIC); + + ret = ubcore_rearm_jfc(jfc, false); + if (ret < 0) + xmfs_info(NULL, "err jfc rearm failed %d", ret); +} + +static int xmfs_host_send(struct xmfs_sb_info *sbi, struct ubcore_cr *cr) +{ + u32 idx; + + idx = (u32)cr->user_ctx; + if (cr->status != UBCORE_CR_SUCCESS) + /* if (cr->status != 9 && cr->status != 10) */ + xmfs_warning(sbi->sb, + "send completion failed: node %d status %d index %d", + sbi->id, cr->status, idx); + if (cr->status == UBCORE_CR_WR_FLUSH_ERR_DONE) + return 0; + /* + * if (sbi->id != 0) + * xmfs_info(sbi->sb, + * "qyf send request callback send pool slot %d release", + * idx); + */ + urma_pool_release(&sbi->urma_cfg.send_pool, idx); + return 0; +} + +static void xmfs_host_reply_worker(struct work_struct *work) +{ + struct xmfs_send_work *sw = + container_of(work, struct xmfs_send_work, work); + struct xmfs_rw_msg grant = sw->grant; + struct xmfs_rw_msg *buf; + struct xmfs_sb_info *sbi = sw->sbi; + struct ubcore_jfs_wr *bad_send_wr = NULL; + struct ubcore_jfs_wr send_wr = {}; + struct ubcore_sge sge = {}; + int slot, ret; + + buf = (struct xmfs_rw_msg *)urma_pool_acquire(&sbi->urma_cfg.send_pool, + &slot); + if (!buf) { + xmfs_info(NULL, "cannot get the buf during host process recv"); + kfree(sw); + return; + } + memcpy(buf, &grant, sizeof(struct xmfs_rw_msg)); + + sge.addr = (uint64_t)buf; + sge.len = sizeof(grant); + sge.tseg = sbi->urma_cfg.send_seg; + + send_wr.opcode = UBCORE_OPC_SEND; + send_wr.tjetty = sbi->urma_cfg.send_tjettys[grant.slave_id]; + send_wr.send.src.sge = &sge; + send_wr.send.src.num_sge = 1; + send_wr.user_ctx = slot; + send_wr.flag.value = 0; + send_wr.flag.bs.complete_enable = 1; + send_wr.next = NULL; + + ret = ubcore_post_jetty_send_wr(sbi->urma_cfg.send_jetty, &send_wr, + &bad_send_wr); + if (ret) { + urma_pool_release(&sbi->urma_cfg.send_pool, slot); + xmfs_info(NULL, "err host send post err %d", ret); + } + kfree(sw); +} + +static int xmfs_host_recv(struct xmfs_sb_info *sbi, struct ubcore_cr *cr) +{ + struct xmfs_rw_msg *req; + struct xmfs_rw_msg grant; + u32 idx; + + if (cr->status != UBCORE_CR_SUCCESS) { + idx = (u32)cr->user_ctx; + /* if (cr->status != 9 && cr->status != 10) */ + xmfs_warning(sbi->sb, + "receive completion failed: node %d status %d opcode %d index %d", + sbi->id, cr->status, cr->opcode, idx); + xmfs_post_recv(sbi, idx); + return -EINVAL; + } + + idx = (u32)cr->user_ctx; + + if (sbi->id == 0) { + if (idx >= XMFS_DEPTH || idx < 0) { + xmfs_info(NULL, "err host recv idx %d is not correct", + idx); + return -EINVAL; + } + req = (struct xmfs_rw_msg *)xmfs_get_recv_buf(sbi, idx); + int slave_id = req->slave_id; + struct xmfs_send_work *sw = kmalloc(sizeof(*sw), GFP_ATOMIC); + + if (!sw) { + xmfs_post_recv(sbi, idx); + return 0; + } + /* + * xmfs_info(sbi->sb, + * "qyf host recv callback recv pool slot %d req id %d req ops %d", + * idx, req->request_id, req->ops); + */ + xmfs_host_handle_urma_request(sbi, slave_id, req, &sw->grant); + sw->sbi = sbi; + xmfs_post_recv(sbi, idx); + /* + * xmfs_info(sbi->sb, "host process req %d %d %d", + * req->request_id, req->ops, grant.log_slot_start); + */ + if (req->ops == XMFS_SETATTR) { + kfree(sw); + return 0; + } + + INIT_WORK(&sw->work, xmfs_host_reply_worker); + queue_work(sbi->send_wq, &sw->work); + /* + * buf = (struct xmfs_rw_msg *)urma_pool_acquire( + * &sbi->urma_cfg.send_pool, &slot); + * if (!buf) { + * xmfs_info(sbi->sb, + * "cannot get the buf during host process recv"); + * xmfs_post_recv(sbi, idx); + * return 0; + * } + * memcpy(buf, &grant, sizeof(struct xmfs_rw_msg)); + * xmfs_info(sbi->sb, + * "qyf host recv callback recv pool slot %d " + * "req id %d req ops %d send pool slot %d", + * idx, req->request_id, req->ops, slot); + * xmfs_post_recv(sbi, idx); + * + * sge.addr = (uint64_t)buf; + * sge.len = sizeof(grant); + * sge.tseg = sbi->urma_cfg.send_seg; + * + * send_wr.opcode = UBCORE_OPC_SEND; + * send_wr.tjetty = sbi->urma_cfg.send_tjettys[slave_id]; + * send_wr.send.src.sge = &sge; + * send_wr.send.src.num_sge = 1; + * send_wr.user_ctx = slot; + * send_wr.flag.value = 0; + * send_wr.flag.bs.complete_enable = 1; + * send_wr.next = NULL; + * + * ret = ubcore_post_jetty_send_wr(sbi->urma_cfg.send_jetty, + * &send_wr, &bad_send_wr); + * if (ret) { + * urma_pool_release(&sbi->urma_cfg.send_pool, slot); + * xmfs_info(sbi->sb, "err host send post err %d", ret); + * } + */ + } else { + if (idx >= XMFS_DEPTH || idx < 0) { + xmfs_info(NULL, "err slave recv idx %d is not correct", + idx); + return -EINVAL; + } + req = (struct xmfs_rw_msg *)xmfs_get_recv_buf(sbi, idx); + /* + * xmfs_info(sbi->sb, + * "qyf slave recv callback recv pool slot %d " + * "req id %d req ops %d type %d log addr %ld " + * "data addr %ld %ld data num %d %d version %ld", + * idx, req->request_id, req->ops, req->type, + * req->log_trunk_addr, req->data_addr, + * req->second_data_addr, req->data_page_count, + * req->second_data_pages, req->version); + */ + if (req->ops == XMFS_GC) { + xmfs_info(NULL, "slave receive gc req %d", req->status); + if (req->status == 1) + sbi->gc_ctl.gc_running = true; + else if (req->status == 0) { + sbi->gc_ctl.gc_running = false; + wake_up_all(&sbi->gc_ctl.wait); + } else if (req->status == 2) + sbi->gc_ctl.need_replay = true; + xmfs_post_recv(sbi, idx); + return 0; + } + + memcpy(&grant, req, sizeof(struct xmfs_rw_msg)); + xmfs_post_recv(sbi, idx); + /* xmfs_info(sbi->sb, "qyf slave post recv %d", idx); */ + struct xmfs_grant_wait *gw = + xa_load(&sbi->urma_cfg.grant_waits, grant.request_id); + if (gw) { + memcpy(&gw->grant, &grant, sizeof(struct xmfs_rw_msg)); + complete(&gw->done); + } else { + xmfs_error(NULL, "err cannot get the grant wait %ld", + grant.request_id); + } + } + + return 0; +} + +static void xmfs_send_jfc_callback(struct ubcore_jfc *jfc) +{ + struct ubcore_cr cr[8]; + + if (!jfc) + return; + struct xmfs_sb_info *sbi = jfc->jfc_cfg.jfc_context; + int ret, i; + + if (!jfc || !sbi || sbi->magic != XMFS_MAGIC) + return; + + if (jfc != sbi->urma_cfg.recv_jfc && jfc != sbi->urma_cfg.send_jfc) { + xmfs_error(NULL, "err foreign send jfc cr, drop it"); + ubcore_rearm_jfc(jfc, false); + return; + } + + /* xmfs_info(sbi->sb, "send callback %d", sbi->id); */ + do { + ret = ubcore_poll_jfc(jfc, 1, cr); + if (ret < 0) { + xmfs_info(NULL, "err jfc send poll failed %d", ret); + break; + } + + for (i = 0; i < ret; i++) + xmfs_host_send(sbi, &cr[i]); + } while (ret > 0 && jfc && sbi && sbi->magic == XMFS_MAGIC); + + ret = ubcore_rearm_jfc(jfc, false); + if (ret < 0) + xmfs_info(NULL, "err jfc recv rearm failed %d", ret); +} + +static void xmfs_recv_jfc_callback(struct ubcore_jfc *jfc) +{ + struct ubcore_cr cr[8]; + + if (!jfc) + return; + struct xmfs_sb_info *sbi = jfc->jfc_cfg.jfc_context; + int ret, i; + + if (!jfc || !sbi || sbi->magic != XMFS_MAGIC) + return; + + if (jfc != sbi->urma_cfg.recv_jfc && jfc != sbi->urma_cfg.send_jfc) { + xmfs_error(NULL, "err foreign recv jfc cr, drop it"); + ubcore_rearm_jfc(jfc, false); + return; + } + /* xmfs_info(sbi->sb, "recv callback %d", sbi->id); */ + do { + ret = ubcore_poll_jfc(jfc, 1, cr); + if (ret < 0) { + xmfs_info(NULL, "err jfc recv poll failed %d", ret); + break; + } + + for (i = 0; i < ret; i++) + xmfs_host_recv(sbi, &cr[i]); + } while (ret > 0 && jfc && sbi && sbi->magic == XMFS_MAGIC); + + ret = ubcore_rearm_jfc(jfc, false); + if (ret < 0) + xmfs_info(NULL, "err jfc recv rearm failed %d", ret); +} + +static int xmfs_register_send_recv(struct xmfs_sb_info *sbi, + struct xmfs_fs_context *ctx) +{ + struct ubcore_seg_cfg seg_cfg = { 0 }; + union ubcore_reg_seg_flag seg_flag = { 0 }; + struct ubcore_target_seg *seg; + struct ubcore_jfc_cfg jfc_cfg = { 0 }; + struct ubcore_jfc *jfc; + struct ubcore_jfr_cfg jfr_cfg = { 0 }; + struct ubcore_jfr *jfr; + struct ubcore_jetty *jetty; + struct ubcore_jetty_cfg jetty_cfg = { 0 }; + struct ubcore_eid_info *eid_info; + int err, cnt = 0; + + seg_flag.bs.token_policy = 0; + if (ctx->debug) + seg_flag.bs.access = XMFS_ACCESS_READ | XMFS_ACCESS_WRITE | + XMFS_ACCESS_ATOMIC | + XMFS_ACCESS_LOCAL_ONLY; + else + seg_flag.bs.access = XMFS_ACCESS_READ | XMFS_ACCESS_WRITE | + XMFS_ACCESS_ATOMIC; + seg_flag.bs.cacheable = UBCORE_NON_CACHEABLE; + + sbi->urma_cfg.recv_buf = + vzalloc(PAGE_ALIGN(XMFS_DEPTH * sizeof(struct xmfs_rw_msg))); + if (!sbi->urma_cfg.recv_buf) + return -ENOMEM; + + seg_cfg.va = (uint64_t)sbi->urma_cfg.recv_buf; + seg_cfg.len = PAGE_ALIGN(XMFS_DEPTH * sizeof(struct xmfs_rw_msg)); + seg_cfg.flag = seg_flag; + + seg = ubcore_register_seg(sbi->urma_cfg.ubc_dev, &seg_cfg, NULL); + if (IS_ERR_OR_NULL(seg)) { + xmfs_error(NULL, + "ubcore_register_seg failed during register recv"); + return -EOPNOTSUPP; + } + sbi->urma_cfg.recv_seg = seg; + + seg_flag.bs.token_policy = 0; + seg_flag.bs.access = XMFS_ACCESS_LOCAL_ONLY; + seg_flag.bs.cacheable = UBCORE_NON_CACHEABLE; + + sbi->urma_cfg.send_buf = + vzalloc(PAGE_ALIGN(XMFS_DEPTH * sizeof(struct xmfs_rw_msg))); + if (!sbi->urma_cfg.send_buf) + return -ENOMEM; + + seg_cfg.va = (uint64_t)sbi->urma_cfg.send_buf; + seg_cfg.len = PAGE_ALIGN(XMFS_DEPTH * sizeof(struct xmfs_rw_msg)); + seg_cfg.flag = seg_flag; + xmfs_urma_pool_init(&sbi->urma_cfg.send_pool, (void *)seg_cfg.va, + seg_cfg.len, sizeof(struct xmfs_rw_msg)); + + seg = ubcore_register_seg(sbi->urma_cfg.ubc_dev, &seg_cfg, NULL); + if (IS_ERR_OR_NULL(seg)) { + xmfs_error(NULL, + "ubcore_register_seg failed during register send"); + return -EOPNOTSUPP; + } + sbi->urma_cfg.send_seg = seg; + + jfc_cfg.depth = XMFS_DEPTH; + jfc_cfg.jfc_context = sbi; + jfc = ubcore_create_jfc(sbi->urma_cfg.ubc_dev, &jfc_cfg, + xmfs_recv_jfc_callback, NULL, NULL); + if (IS_ERR_OR_NULL(jfc)) { + xmfs_error(NULL, + "ubcore_create_jfc failed during register recv"); + return -EOPNOTSUPP; + } + sbi->urma_cfg.recv_jfc = jfc; + + jfc = ubcore_create_jfc(sbi->urma_cfg.ubc_dev, &jfc_cfg, + xmfs_send_jfc_callback, NULL, NULL); + if (IS_ERR_OR_NULL(jfc)) { + xmfs_error(NULL, + "ubcore_create_jfc failed during register send"); + return -EOPNOTSUPP; + } + sbi->urma_cfg.send_jfc = jfc; + + err = ubcore_rearm_jfc(sbi->urma_cfg.send_jfc, false); + if (err) + return -EOPNOTSUPP; + err = ubcore_rearm_jfc(sbi->urma_cfg.recv_jfc, false); + if (err) + return -EOPNOTSUPP; + + jfr_cfg.depth = XMFS_DEPTH; + jfr_cfg.trans_mode = UBCORE_TP_RM; + jfr_cfg.min_rnr_timer = (u8)19U; + jfr_cfg.max_sge = 1; + jfr_cfg.jfc = sbi->urma_cfg.recv_jfc; + jfr = ubcore_create_jfr(sbi->urma_cfg.ubc_dev, &jfr_cfg, NULL, NULL); + if (IS_ERR_OR_NULL(jfr)) { + xmfs_error(NULL, + "ubcore_create_jfr failed during register send"); + return -EOPNOTSUPP; + } + sbi->urma_cfg.send_jfr = jfr; + + jetty_cfg.trans_mode = UBCORE_TP_RM; + jetty_cfg.eid_index = ctx->host ? 0 : 1; + jetty_cfg.max_send_sge = 1; + jetty_cfg.max_recv_sge = 1; + jetty_cfg.rnr_retry = 7; + jetty_cfg.min_rnr_timer = 20U; + jetty_cfg.err_timeout = 20; + jetty_cfg.jfs_depth = XMFS_DEPTH; + jetty_cfg.jfr_depth = XMFS_DEPTH; + jetty_cfg.send_jfc = sbi->urma_cfg.send_jfc; + jetty_cfg.recv_jfc = sbi->urma_cfg.recv_jfc; + jetty_cfg.jfr = jfr; + jetty_cfg.flag.bs.share_jfr = 1; + jetty = ubcore_create_jetty(sbi->urma_cfg.ubc_dev, &jetty_cfg, NULL, + NULL); + if (IS_ERR_OR_NULL(jetty)) { + xmfs_error(NULL, + "ubcore_create_jetty failed during register send"); + return -EOPNOTSUPP; + } + sbi->urma_cfg.send_jetty = jetty; + + eid_info = ubcore_get_eid_list(sbi->urma_cfg.ubc_dev, &cnt); + if (!eid_info) { + xmfs_error(NULL, + "ubcore_get_eid_list failed during register send"); + return -EOPNOTSUPP; + } + + sbi->urma_cfg.send_info.urma_send_va = + (u64)(uintptr_t)sbi->urma_cfg.send_buf; + sbi->urma_cfg.send_info.urma_recv_va = + (u64)(uintptr_t)sbi->urma_cfg.recv_buf; + sbi->urma_cfg.send_info.urma_eid_subnet_prefix = + eid_info->eid.in6.subnet_prefix; + sbi->urma_cfg.send_info.urma_eid_interface_id = + eid_info->eid.in6.interface_id; + sbi->urma_cfg.send_info.urma_jetty_id = jetty->jetty_id.id; + sbi->urma_cfg.send_info.urma_send_token_id = + sbi->urma_cfg.send_seg->seg.token_id; + sbi->urma_cfg.send_info.urma_recv_token_id = + sbi->urma_cfg.recv_seg->seg.token_id; + xmfs_info(NULL, "send info %lld %lld %lld %lld %d %d %d", + sbi->urma_cfg.send_info.urma_send_va, + sbi->urma_cfg.send_info.urma_recv_va, + sbi->urma_cfg.send_info.urma_eid_subnet_prefix, + sbi->urma_cfg.send_info.urma_eid_interface_id, + sbi->urma_cfg.send_info.urma_jetty_id, + sbi->urma_cfg.send_info.urma_send_token_id, + sbi->urma_cfg.send_info.urma_recv_token_id); + + ubcore_free_eid_list(eid_info); + + for (int i = 0; i < XMFS_DEPTH; i++) + xmfs_post_recv(sbi, i); + + return 0; +} + +int xmfs_urma_register(struct xmfs_sb_info *sbi, struct xmfs_fs_context *ctx) +{ + struct ubcore_seg_cfg seg_cfg = { 0 }; + union ubcore_reg_seg_flag seg_flag = { 0 }; + struct ubcore_target_seg *seg; + struct ubcore_jfc_cfg jfc_cfg = { 0 }; + struct ubcore_jfc *jfc; + struct ubcore_jfr_cfg jfr_cfg = { 0 }; + struct ubcore_jfr *jfr; + struct ubcore_jetty *jetty; + struct ubcore_jetty_cfg jetty_cfg = { 0 }; + struct ubcore_eid_info *eid_info; + int err, cnt = 0; + + if (!ctx->host) { + sbi->urma_cfg.urma_remote_va = ctx->urma_va; + sbi->urma_cfg.urma_eid_subnet_prefix = + ctx->urma_eid_subnet_prefix; + sbi->urma_cfg.urma_eid_interface_id = + ctx->urma_eid_interface_id; + sbi->urma_cfg.urma_jetty_id = ctx->urma_jetty_id; + sbi->urma_cfg.urma_token_id = ctx->urma_token_id; + sbi->urma_cfg.last_log_start = XMFS_DEFAULT_CHUNK_SIZE * 3; + sbi->urma_cfg.last_data_start = XMFS_DEFAULT_CHUNK_SIZE * 3; + } + + xmfs_info(NULL, "ctx name %ld %s", strlen(ctx->dev_name), + ctx->dev_name); + memcpy(g_dev_name, ctx->dev_name, strlen(ctx->dev_name)); + xmfs_info(NULL, "g dev name %s", g_dev_name); + + INIT_LIST_HEAD(&sbi->urma_cfg.ubc_client.list_node); + sbi->urma_cfg.ubc_client.client_name = "xmfs_urma_client"; + sbi->urma_cfg.ubc_client.add = xmfs_add_udma_device; + sbi->urma_cfg.ubc_client.remove = xmfs_remove_udma_device; + xa_init(&sbi->urma_cfg.grant_waits); + + err = ubcore_register_client(&sbi->urma_cfg.ubc_client); + if (err) { + xmfs_error(NULL, "ubcore_register_client failed"); + return -EOPNOTSUPP; + } + xmfs_info(NULL, "register client done %d %d %d %d", XMFS_ACCESS_READ, + XMFS_ACCESS_WRITE, XMFS_ACCESS_ATOMIC, + XMFS_ACCESS_LOCAL_ONLY); + + seg_flag.bs.token_policy = 0; + if (ctx->debug) + seg_flag.bs.access = XMFS_ACCESS_READ | XMFS_ACCESS_WRITE | + XMFS_ACCESS_ATOMIC | + XMFS_ACCESS_LOCAL_ONLY; + else + seg_flag.bs.access = XMFS_ACCESS_READ | XMFS_ACCESS_WRITE | + XMFS_ACCESS_ATOMIC; + seg_flag.bs.non_pin = 1; + + if (ctx->host) { + seg_cfg.va = (u64)(uintptr_t)sbi->kaddr; + seg_cfg.len = sbi->len; + } else { + sbi->urma_cfg.urma_local_va = vzalloc(21474836480); + if (!sbi->urma_cfg.urma_local_va) { + xmfs_error(NULL, "vzalloc local va failed"); + return -ENOMEM; + } + seg_cfg.va = (u64)(uintptr_t)sbi->urma_cfg.urma_local_va; + seg_cfg.len = 21474836480; + } + xmfs_urma_pool_init(&sbi->urma_cfg.pool, (void *)seg_cfg.va, + seg_cfg.len, PAGE_SIZE); + seg_cfg.flag = seg_flag; + sbi->urma_cfg.ubc_dev = g_urma_dev[0]; + seg = ubcore_register_seg(sbi->urma_cfg.ubc_dev, &seg_cfg, NULL); + if (IS_ERR_OR_NULL(seg)) { + xmfs_error(NULL, "ubcore_register_seg failed"); + return -EOPNOTSUPP; + } + sbi->urma_cfg.local_seg = seg; + + if (ctx->debug) + jfc_cfg.depth = 2048; + else + jfc_cfg.depth = 524288; + jfc_cfg.jfc_context = sbi; + jfc = ubcore_create_jfc(sbi->urma_cfg.ubc_dev, &jfc_cfg, + xmfs_jfc_callback, NULL, NULL); + if (IS_ERR_OR_NULL(jfc)) { + xmfs_error(NULL, "ubcore_create_jfc failed"); + return -EOPNOTSUPP; + } + sbi->urma_cfg.jfc = jfc; + + err = ubcore_rearm_jfc(jfc, false); + if (err) { + xmfs_error(NULL, "ubcore_rearm_jfc failed"); + return -EOPNOTSUPP; + } + + if (ctx->debug) + jfr_cfg.depth = 2048; + else + jfr_cfg.depth = 16384; + jfr_cfg.trans_mode = UBCORE_TP_RM; + jfr_cfg.min_rnr_timer = (u8)19U; + jfr_cfg.max_sge = 1; + jfr_cfg.jfc = jfc; + jfr = ubcore_create_jfr(sbi->urma_cfg.ubc_dev, &jfr_cfg, NULL, NULL); + if (IS_ERR_OR_NULL(jfr)) { + xmfs_error(NULL, "ubcore_create_jfr failed"); + return -EOPNOTSUPP; + } + sbi->urma_cfg.jfr = jfr; + + jetty_cfg.trans_mode = UBCORE_TP_RM; + jetty_cfg.eid_index = ctx->host ? 0 : 1; + jetty_cfg.max_send_sge = 1; + jetty_cfg.max_recv_sge = 1; + jetty_cfg.rnr_retry = 7; + jetty_cfg.min_rnr_timer = 20U; + jetty_cfg.err_timeout = 20; + if (ctx->debug) + jetty_cfg.jfs_depth = 8192; + else + jetty_cfg.jfs_depth = 2048; + jetty_cfg.jfr_depth = jfr_cfg.depth; + jetty_cfg.send_jfc = jfc; + jetty_cfg.recv_jfc = jfc; + jetty_cfg.jfr = jfr; + jetty_cfg.flag.bs.share_jfr = 1; + for (int i = 0; i < 5; i++) { + jetty = ubcore_create_jetty(sbi->urma_cfg.ubc_dev, &jetty_cfg, + NULL, NULL); + if (IS_ERR_OR_NULL(jetty)) { + xmfs_error(NULL, "ubcore_create_jetty failed"); + return -EOPNOTSUPP; + } + sbi->urma_cfg.jetty[i] = jetty; + } + + eid_info = ubcore_get_eid_list(sbi->urma_cfg.ubc_dev, &cnt); + if (!eid_info) { + xmfs_error(NULL, "ubcore_get_eid_list failed"); + return -EOPNOTSUPP; + } + if (ctx->host) { + sbi->urma_cfg.urma_remote_va = (u64)(uintptr_t)sbi->kaddr; + sbi->urma_cfg.urma_eid_subnet_prefix = + eid_info->eid.in6.subnet_prefix; + sbi->urma_cfg.urma_eid_interface_id = + eid_info->eid.in6.interface_id; + sbi->urma_cfg.urma_jetty_id = jetty->jetty_id.id; + sbi->urma_cfg.urma_token_id = seg->seg.token_id; + } else { + sbi->urma_cfg.own_info.urma_remote_va = + (u64)(uintptr_t)sbi->urma_cfg.urma_local_va; + sbi->urma_cfg.own_info.urma_eid_subnet_prefix = + eid_info->eid.in6.subnet_prefix; + sbi->urma_cfg.own_info.urma_eid_interface_id = + eid_info->eid.in6.interface_id; + sbi->urma_cfg.own_info.urma_jetty_id = jetty->jetty_id.id; + sbi->urma_cfg.own_info.urma_token_id = seg->seg.token_id; + } + + ubcore_free_eid_list(eid_info); + + xmfs_info(NULL, "register done"); + return xmfs_register_send_recv(sbi, ctx); +} + +void xmfs_urma_unimport(struct xmfs_sb_info *sbi) +{ + if (!sbi) + return; + if (sbi->urma_cfg.remote_seg) + ubcore_unimport_seg(sbi->urma_cfg.remote_seg); + if (sbi->urma_cfg.tjetty) { + /* ubcore_unbind_jetty(sbi->urma_cfg.jetty); */ + ubcore_unimport_jetty(sbi->urma_cfg.tjetty); + } + for (int i = 0; i < 64; i++) { + if (sbi->urma_cfg.tjettys[i]) + ubcore_unimport_jetty(sbi->urma_cfg.tjettys[i]); + if (sbi->urma_cfg.send_tjettys[i]) + ubcore_unimport_jetty(sbi->urma_cfg.send_tjettys[i]); + } +} + +int xmfs_import_jetty(struct xmfs_sb_info *sbi, struct urma_info info, + int index, bool is_send) +{ + struct ubcore_tjetty_cfg cfg = { 0 }; + struct ubcore_get_tp_cfg tp_flag = { 0 }; + struct ubcore_active_tp_cfg active_tp_cfg = { 0 }; + struct ubcore_tp_info tpid_info = { 0 }; + struct ubcore_tjetty *tjetty; + struct ubcore_eid_info *eid_info; + uint32_t tp_cnt = 1; + int err, cnt = 0; + + eid_info = ubcore_get_eid_list(sbi->urma_cfg.ubc_dev, &cnt); + if (!eid_info) { + xmfs_error(NULL, "ubcore_get_eid_list failed"); + return -EOPNOTSUPP; + } + xmfs_info(NULL, "get eid list done"); + for (int i = 0; i < cnt; i++) { + xmfs_info(NULL, "eid get during import %lld %lld", + eid_info->eid.in6.subnet_prefix, + eid_info->eid.in6.interface_id); + } + memcpy(&cfg.id.eid, &eid_info->eid, sizeof(union ubcore_eid)); + cfg.id.eid.in6.subnet_prefix = info.urma_eid_subnet_prefix; + cfg.id.eid.in6.interface_id = info.urma_eid_interface_id; + cfg.id.id = info.urma_jetty_id; + cfg.trans_mode = UBCORE_TP_RM; + cfg.type = UBCORE_JETTY; + cfg.eid_index = 1; + + tp_flag.flag.bs.ctp = 1; + tp_flag.trans_mode = UBCORE_TP_RM; + memcpy(&tp_flag.peer_eid, &eid_info->eid, sizeof(union ubcore_eid)); + tp_flag.peer_eid.in6.subnet_prefix = info.urma_eid_subnet_prefix; + tp_flag.peer_eid.in6.interface_id = info.urma_eid_interface_id; + memcpy(&tp_flag.local_eid, &eid_info->eid, sizeof(union ubcore_eid)); + xmfs_info(NULL, "node %d import jetty %lld %lld %d", sbi->id, + info.urma_eid_interface_id, info.urma_eid_subnet_prefix, + info.urma_jetty_id); + err = ubcore_get_tp_list(sbi->urma_cfg.ubc_dev, &tp_flag, &tp_cnt, + &tpid_info, NULL); + if (err) { + xmfs_error(NULL, "ubcore_get_tp_list failed."); + return -EOPNOTSUPP; + } + xmfs_info(NULL, "get tp list done"); + active_tp_cfg.tp_handle = tpid_info.tp_handle; + if (sbi->urma_cfg.ubc_dev->ops->import_jetty) + tjetty = ubcore_import_jetty(sbi->urma_cfg.ubc_dev, &cfg, NULL); + else + tjetty = ubcore_import_jetty_ex(sbi->urma_cfg.ubc_dev, &cfg, + &active_tp_cfg, NULL); + if (IS_ERR_OR_NULL(tjetty)) { + xmfs_error(NULL, "ubcore_import_jetty_ex failed."); + return -EOPNOTSUPP; + } + if (!is_send) { + if (sbi->urma_cfg.tjettys[index]) { + xmfs_info(NULL, "unimport tjetty %d", index); + err = ubcore_unimport_jetty(sbi->urma_cfg.tjettys[index]); + xmfs_info(NULL, "unimport tjetty %d ret %d", index, + err); + } + sbi->urma_cfg.tjettys[index] = tjetty; + } else { + if (sbi->urma_cfg.send_tjettys[index]) { + xmfs_info(NULL, "unimport send tjetty %d", index); + err = ubcore_unimport_jetty(sbi->urma_cfg.send_tjettys[index]); + xmfs_info(NULL, "unimport send tjetty %d ret %d", index, + err); + } + sbi->urma_cfg.send_tjettys[index] = tjetty; + } + + ubcore_free_eid_list(eid_info); + xmfs_info(NULL, "import jetty done"); + + return 0; +} + +int xmfs_urma_import(struct xmfs_sb_info *sbi) +{ + struct ubcore_tjetty_cfg cfg = { 0 }; + struct ubcore_get_tp_cfg tp_flag = { 0 }; + struct ubcore_active_tp_cfg active_tp_cfg = { 0 }; + struct ubcore_tp_info tpid_info = { 0 }; + struct ubcore_target_seg_cfg seg_cfg = { 0 }; + struct ubcore_tjetty *tjetty; + struct ubcore_target_seg *tseg; + struct ubcore_eid_info *eid_info; + uint32_t tp_cnt = 1; + int err, cnt = 0; + + xmfs_info(NULL, "start import"); + eid_info = ubcore_get_eid_list(sbi->urma_cfg.ubc_dev, &cnt); + if (!eid_info) { + xmfs_error(NULL, "ubcore_get_eid_list failed"); + return -EOPNOTSUPP; + } + for (int i = 0; i < cnt; i++) { + xmfs_info(NULL, "eid get during import %lld %lld", + eid_info->eid.in6.subnet_prefix, + eid_info->eid.in6.interface_id); + } + xmfs_info(NULL, "get eid list done %lld %lld", + sbi->urma_cfg.urma_eid_subnet_prefix, + sbi->urma_cfg.urma_eid_interface_id); + memcpy(&cfg.id.eid, &eid_info->eid, sizeof(union ubcore_eid)); + cfg.id.eid.in6.subnet_prefix = sbi->urma_cfg.urma_eid_subnet_prefix; + cfg.id.eid.in6.interface_id = sbi->urma_cfg.urma_eid_interface_id; + cfg.id.id = sbi->urma_cfg.urma_jetty_id; + cfg.trans_mode = UBCORE_TP_RM; + cfg.type = UBCORE_JETTY; + cfg.eid_index = 1; + + tp_flag.flag.bs.ctp = 1; + tp_flag.trans_mode = UBCORE_TP_RM; + memcpy(&tp_flag.peer_eid, &eid_info->eid, sizeof(union ubcore_eid)); + tp_flag.peer_eid.in6.subnet_prefix = + sbi->urma_cfg.urma_eid_subnet_prefix; + tp_flag.peer_eid.in6.interface_id = sbi->urma_cfg.urma_eid_interface_id; + memcpy(&tp_flag.local_eid, &eid_info->eid, sizeof(union ubcore_eid)); + + err = ubcore_get_tp_list(sbi->urma_cfg.ubc_dev, &tp_flag, &tp_cnt, + &tpid_info, NULL); + if (err) { + xmfs_error(NULL, "ubcore_get_tp_list failed."); + return -EOPNOTSUPP; + } + xmfs_info(NULL, "get tp list done"); + active_tp_cfg.tp_handle = tpid_info.tp_handle; + if (sbi->urma_cfg.ubc_dev->ops->import_jetty) + tjetty = ubcore_import_jetty(sbi->urma_cfg.ubc_dev, &cfg, NULL); + else + tjetty = ubcore_import_jetty_ex(sbi->urma_cfg.ubc_dev, &cfg, + &active_tp_cfg, NULL); + if (IS_ERR_OR_NULL(tjetty)) { + xmfs_error(NULL, "ubcore_import_jetty_ex failed."); + return -EOPNOTSUPP; + } + sbi->urma_cfg.tjetty = tjetty; + xmfs_info(NULL, "import jetty done"); + /* + * err = ubcore_bind_jetty_ex(sbi->urma_cfg.jetty, tjetty, + * &active_tp_cfg, NULL); + * if (err) { + * xmfs_error(sbi->sb, "ubcore_bind_jetty_ex failed."); + * return -EOPNOTSUPP; + * } + */ + + memcpy(&seg_cfg.seg.ubva.eid, &eid_info->eid, sizeof(union ubcore_eid)); + seg_cfg.seg.ubva.eid.in6.subnet_prefix = + sbi->urma_cfg.urma_eid_subnet_prefix; + seg_cfg.seg.ubva.eid.in6.interface_id = + sbi->urma_cfg.urma_eid_interface_id; + ubcore_free_eid_list(eid_info); + seg_cfg.seg.ubva.va = sbi->urma_cfg.urma_remote_va; + seg_cfg.seg.len = sbi->len; + seg_cfg.seg.token_id = sbi->urma_cfg.urma_token_id; + tseg = ubcore_import_seg(sbi->urma_cfg.ubc_dev, &seg_cfg, NULL); + if (IS_ERR_OR_NULL(tseg)) { + xmfs_error(NULL, "ubcore_import_seg failed."); + return -EOPNOTSUPP; + } + xmfs_info(NULL, "import seg done"); + sbi->urma_cfg.remote_seg = tseg; + + return 0; +} + +static int xmfs_urma_send_and_wait(struct xmfs_sb_info *sbi, + struct ubcore_jfs_wr *wr, + struct xmfs_urma_msg *msg) +{ + int err = 0; + struct ubcore_jfs_wr *bad_wr = NULL; + struct ubcore_jfs_wr *tmp; + struct ubcore_jfs_wr *retry_wr; + struct ubcore_jfs_wr *failed_head = NULL; + int ret = 0; + int retry; + int timeout; + unsigned int delay = 50; + unsigned int multi = 1; + + if (sbi->debug) + multi = 1000; + + if (sbi->debug) + timeout = msecs_to_jiffies(20000); + else + timeout = msecs_to_jiffies(20000); + + retry_wr = wr; + for (retry = 0; retry < XMFS_POST_RETRY_CNT && retry_wr; retry++) { + bad_wr = NULL; + err = ubcore_post_jetty_send_wr(sbi->urma_cfg.jetty[jiffies % 5], + retry_wr, &bad_wr); + if (!err) { + retry_wr = NULL; + break; + } + + /* + * xmfs_error(sbi->sb, + * "qyf post wr failed ret=%d retry=%d bad_wr=%px", + * err, retry, bad_wr); + */ + + if (bad_wr) + retry_wr = bad_wr; + usleep_range(delay * multi, delay * multi + 50 * multi); + delay = min(delay * 2, 5000U); + } + failed_head = retry_wr; + if (failed_head) { + xmfs_error(NULL, "still have unposted wr after retry=%d", + XMFS_POST_RETRY_CNT); + + for (tmp = failed_head; tmp; tmp = tmp->next) { + struct wr_status *wrs = + (struct wr_status *)(uintptr_t)tmp->user_ctx; + + kfree(wrs); + wrs = NULL; + } + + ret = -EAGAIN; + } + + for (tmp = wr; tmp != NULL && tmp != failed_head; tmp = tmp->next) { + struct wr_status *wrs = + (struct wr_status *)(uintptr_t)tmp->user_ctx; + err = wait_for_completion_interruptible_timeout(&wrs->done, + timeout); + if (err <= 0) { + xmfs_warning(sbi->sb, + "request wait failed: %d, op %d, status %d, offset %lld, length %lld", + err, wrs->ops, wrs->ret, msg->offset, + msg->len); + ret = -EAGAIN; + } + + if (wrs->status == URMA_ERROR) { + xmfs_error(NULL, + "urma send get err %d ret %d ops %d len %d %d", + wrs->status, wrs->ret, wrs->ops, + wr->rw.src.sge->len, wr->rw.dst.sge->len); + ret = -EAGAIN; + } + xmfs_wrs_put(&wrs); + } + + return ret; +} + +static int xmfs_urma_get_read_wr(struct xmfs_sb_info *sbi, + struct ubcore_jfs_wr **wr, + struct xmfs_urma_msg *msg) +{ + int trunk_size; + + if (sbi->debug) + trunk_size = 4096; + else + trunk_size = XMFS_URMA_DEFAULT_WR_SIZE; + + uint64_t wr_count = DIV_ROUND_UP(msg->len, trunk_size); + struct ubcore_jfs_wr *wr_ptr, *wr_pre = NULL; + *wr = vzalloc(wr_count * sizeof(struct ubcore_jfs_wr)); + if (!*wr) + return -ENOMEM; + + wr_ptr = *wr; + for (uint64_t read_count = 0; read_count < msg->len; + read_count += trunk_size) { + struct wr_status *wrs = + kzalloc(sizeof(struct wr_status), GFP_KERNEL); + if (!wrs) + return -ENOMEM; + + wr_ptr->rw.src.sge = vzalloc(sizeof(struct ubcore_sge)); + wr_ptr->rw.dst.sge = vzalloc(sizeof(struct ubcore_sge)); + if (!wr_ptr->rw.src.sge || !wr_ptr->rw.dst.sge) + return -ENOMEM; + + wrs->status = URMA_ISSUING; + init_completion(&wrs->done); + wrs->ret = 1; + wrs->ops = XMFS_URMA_READ; + wrs->magic = XMFS_MAGIC; + refcount_set(&wrs->refs, 1); + xmfs_wrs_get(wrs); + uint64_t read_len = read_count + trunk_size < msg->len ? + trunk_size : + msg->len - read_count; + if (wr_pre) + wr_pre->next = wr_ptr; + wr_ptr->opcode = UBCORE_OPC_READ; + wr_ptr->flag.bs.complete_enable = 1; + wr_ptr->tjetty = sbi->urma_cfg.tjetty; + wr_ptr->rw.src.sge->addr = + sbi->urma_cfg.urma_remote_va + msg->offset + read_count; + wr_ptr->rw.src.sge->len = read_len; + wr_ptr->rw.src.sge->tseg = sbi->urma_cfg.remote_seg; + wr_ptr->rw.src.num_sge = 1; + wr_ptr->rw.dst.sge->addr = + (uint64_t)msg->local_addr + read_count; + wr_ptr->rw.dst.sge->len = read_len; + wr_ptr->rw.dst.sge->tseg = sbi->urma_cfg.local_seg; + wr_ptr->rw.dst.num_sge = 1; + wr_ptr->user_ctx = (uint64_t)(uintptr_t)wrs; + wr_ptr->next = NULL; + wr_pre = wr_ptr++; + } + msg->wr_cnt = wr_count; + return 0; +} + +static int xmfs_urma_get_write_wr(struct xmfs_sb_info *sbi, + struct ubcore_jfs_wr **wr, + struct xmfs_urma_msg *msg) +{ + *wr = vzalloc(sizeof(struct ubcore_jfs_wr)); + if (!*wr) + return -ENOMEM; + + struct wr_status *wrs = kzalloc(sizeof(struct wr_status), GFP_KERNEL); + + if (!wrs) + return -ENOMEM; + + (*wr)->rw.src.sge = vzalloc(sizeof(struct ubcore_sge)); + (*wr)->rw.dst.sge = vzalloc(sizeof(struct ubcore_sge)); + if (!(*wr)->rw.src.sge || !(*wr)->rw.dst.sge) + return -ENOMEM; + + wrs->status = URMA_ISSUING; + init_completion(&wrs->done); + wrs->ret = 2; + wrs->ops = XMFS_URMA_WRITE; + wrs->magic = XMFS_MAGIC; + wrs->slot = -1; /* msg.slot */ + refcount_set(&wrs->refs, 1); + xmfs_wrs_get(wrs); + memcpy(msg->write_buffer, msg->local_addr, msg->len); + (*wr)->opcode = UBCORE_OPC_WRITE; + (*wr)->flag.bs.complete_enable = 1; + (*wr)->tjetty = sbi->urma_cfg.tjetty; + (*wr)->rw.src.sge->addr = (uint64_t)msg->write_buffer; + (*wr)->rw.src.sge->len = msg->len; + (*wr)->rw.src.sge->tseg = sbi->urma_cfg.local_seg; + (*wr)->rw.src.num_sge = 1; + (*wr)->rw.dst.sge->addr = sbi->urma_cfg.urma_remote_va + msg->offset; + (*wr)->rw.dst.sge->len = msg->len; + (*wr)->rw.dst.sge->tseg = sbi->urma_cfg.remote_seg; + (*wr)->rw.dst.num_sge = 1; + (*wr)->user_ctx = (uint64_t)(uintptr_t)wrs; + (*wr)->next = NULL; + msg->wr_cnt = 1; + return 0; +} + +static int xmfs_urma_get_cas_wr(struct xmfs_sb_info *sbi, + struct ubcore_jfs_wr **wr, + struct xmfs_urma_msg *msg) +{ + *wr = vzalloc(sizeof(struct ubcore_jfs_wr)); + if (!*wr) + return -ENOMEM; + + struct wr_status *wrs = kzalloc(sizeof(struct wr_status), GFP_KERNEL); + + if (!wrs) + return -ENOMEM; + + (*wr)->cas.src = vzalloc(sizeof(struct ubcore_sge)); + (*wr)->cas.dst = vzalloc(sizeof(struct ubcore_sge)); + if (!(*wr)->cas.src || !(*wr)->cas.dst) + return -ENOMEM; + + wrs->status = URMA_ISSUING; + init_completion(&wrs->done); + wrs->ret = 3; + wrs->ops = XMFS_URMA_CAS; + wrs->magic = XMFS_MAGIC; + refcount_set(&wrs->refs, 1); + xmfs_wrs_get(wrs); + /* msg->local_addr = sbi->urma_cfg.urma_local_va; */ + (*wr)->opcode = UBCORE_OPC_CAS; + (*wr)->flag.bs.complete_enable = 1; + (*wr)->tjetty = sbi->urma_cfg.tjetty; + (*wr)->cas.src->addr = (uint64_t)msg->local_addr; + (*wr)->cas.src->len = msg->len; + (*wr)->cas.src->tseg = sbi->urma_cfg.local_seg; + (*wr)->cas.dst->addr = sbi->urma_cfg.urma_remote_va + msg->offset; + (*wr)->cas.dst->len = msg->len; + (*wr)->cas.dst->tseg = sbi->urma_cfg.remote_seg; + (*wr)->cas.cmp_data = msg->cas_cmp_data; + (*wr)->cas.swap_data = msg->cas_swap_data; + (*wr)->user_ctx = (uint64_t)(uintptr_t)wrs; + (*wr)->next = NULL; + msg->wr_cnt = 1; + return 0; +} + +static void xmfs_urma_free_wr(struct xmfs_urma_msg *msg, + struct ubcore_jfs_wr *wr, int err) +{ + struct ubcore_jfs_wr *first_wr = wr; + struct wr_status *wrs; + + if (!wr) + return; + while (wr) { + switch (msg->ops) { + case XMFS_URMA_READ: + case XMFS_URMA_WRITE: + vfree(wr->rw.src.sge); + vfree(wr->rw.dst.sge); + break; + case XMFS_URMA_CAS: + vfree(wr->cas.src); + vfree(wr->cas.dst); + break; + default: + break; + } + wrs = (struct wr_status *)wr->user_ctx; + if (wrs != NULL && err != -EAGAIN && err != 0) + kfree(wrs); + + wr = wr->next; + } + vfree(first_wr); +} + +int xmfs_pmem_write(struct xmfs_sb_info *sbi, unsigned long offset, + const void *buf, unsigned long size) +{ + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: + memcpy(sbi->kaddr + offset, buf, size); + return 0; +#ifdef CONFIG_XMFS_FS_URMA + case XMFS_URMA_MODE: { + unsigned long written = 0; + u32 slot; + + while (written < size) { + unsigned long chunk = size - written; + struct xmfs_urma_msg msg; + int err; + + if (chunk > PAGE_SIZE) + chunk = PAGE_SIZE; + memset(&msg, 0, sizeof(msg)); + msg.ops = XMFS_URMA_WRITE; + msg.offset = offset + written; + msg.len = chunk; + msg.local_addr = (void *)(buf + written); + msg.write_buffer = + urma_pool_acquire(&sbi->urma_cfg.pool, &slot); + if (!msg.write_buffer) { + xmfs_info(NULL, + "pmem write cannot get a buffer to write"); + return -EINVAL; + } + msg.slot = slot; + err = xmfs_urma_send(sbi, &msg); + urma_pool_release(&sbi->urma_cfg.pool, slot); + if (err) + return err; + + written += chunk; + } + return 0; + } +#endif + default: + return -ENODEV; + } +} +EXPORT_SYMBOL(xmfs_pmem_write); + +static int +xmfs_urma_get_read_wr_pages(struct xmfs_sb_info *sbi, struct ubcore_jfs_wr **wr, + struct xmfs_urma_msg *msg, unsigned long *offsets, + struct page **pages, unsigned long page_num, + void **kaddrs, int *cnt) +{ + uint64_t wr_count = DIV_ROUND_UP(msg->len, PAGE_SIZE); + struct ubcore_jfs_wr *wr_ptr, *wr_pre = NULL; + *wr = vzalloc(wr_count * sizeof(struct ubcore_jfs_wr)); + if (!*wr) + return -ENOMEM; + + wr_ptr = *wr; + for (uint64_t read_count = 0; read_count < page_num; read_count++) { + struct wr_status *wrs = + kzalloc(sizeof(struct wr_status), GFP_KERNEL); + if (!wrs) + return -ENOMEM; + + wr_ptr->rw.src.sge = vzalloc(sizeof(struct ubcore_sge)); + wr_ptr->rw.dst.sge = vzalloc(sizeof(struct ubcore_sge)); + if (!wr_ptr->rw.src.sge || !wr_ptr->rw.dst.sge) + return -ENOMEM; + + wrs->status = URMA_ISSUING; + init_completion(&wrs->done); + wrs->ret = 4; + wrs->ops = XMFS_URMA_READ; + wrs->magic = XMFS_MAGIC; + refcount_set(&wrs->refs, 1); + xmfs_wrs_get(wrs); + uint64_t read_len = PAGE_SIZE; + + if (wr_pre) + wr_pre->next = wr_ptr; + + kaddrs[read_count] = kmap_local_page(pages[read_count]); + *cnt = read_count + 1; + wr_ptr->opcode = UBCORE_OPC_READ; + wr_ptr->flag.bs.complete_enable = 1; + wr_ptr->tjetty = sbi->urma_cfg.tjetty; + wr_ptr->rw.src.sge->addr = + sbi->urma_cfg.urma_remote_va + offsets[read_count]; + wr_ptr->rw.src.sge->len = read_len; + wr_ptr->rw.src.sge->tseg = sbi->urma_cfg.remote_seg; + wr_ptr->rw.src.num_sge = 1; + wr_ptr->rw.dst.sge->addr = (uint64_t)kaddrs[read_count]; + wr_ptr->rw.dst.sge->len = read_len; + wr_ptr->rw.dst.sge->tseg = sbi->urma_cfg.local_seg; + wr_ptr->rw.dst.num_sge = 1; + wr_ptr->user_ctx = (uint64_t)(uintptr_t)wrs; + wr_ptr->next = NULL; + wr_pre = wr_ptr++; + } + return 0; +} + +static int xmfs_urma_get_write_wr_pages(struct xmfs_sb_info *sbi, + struct ubcore_jfs_wr **wr, + struct xmfs_urma_msg *msg, int *slots, + struct page **pages, + unsigned long page_num) +{ + uint64_t wr_count = DIV_ROUND_UP(msg->len, PAGE_SIZE); + struct ubcore_jfs_wr *wr_ptr, *wr_pre = NULL; + *wr = vzalloc(wr_count * sizeof(struct ubcore_jfs_wr)); + if (!*wr) + return -ENOMEM; + + wr_ptr = *wr; + void *write_buffer = + urma_pool_acquire_nslots(&sbi->urma_cfg.pool, page_num, slots); + if (!write_buffer) { + xmfs_info(NULL, "%s get write buffer failed", __func__); + return -EAGAIN; + } + for (uint64_t read_count = 0; read_count < page_num; read_count++) { + struct wr_status *wrs = + kzalloc(sizeof(struct wr_status), GFP_KERNEL); + if (!wrs) + return -ENOMEM; + + wr_ptr->rw.src.sge = vzalloc(sizeof(struct ubcore_sge)); + wr_ptr->rw.dst.sge = vzalloc(sizeof(struct ubcore_sge)); + if (!wr_ptr->rw.src.sge || !wr_ptr->rw.dst.sge) + return -ENOMEM; + + wrs->status = URMA_ISSUING; + init_completion(&wrs->done); + wrs->ret = 5; + wrs->ops = XMFS_URMA_WRITE; + wrs->magic = XMFS_MAGIC; + refcount_set(&wrs->refs, 1); + xmfs_wrs_get(wrs); + wrs->slot = slots[read_count]; + uint64_t read_len = PAGE_SIZE; + + if (wr_pre) + wr_pre->next = wr_ptr; + + void *kaddr = kmap_local_page(pages[read_count]); + + memcpy(write_buffer + read_count * PAGE_SIZE, kaddr, PAGE_SIZE); + kunmap_local(kaddr); + + wr_ptr->opcode = UBCORE_OPC_WRITE; + wr_ptr->flag.bs.complete_enable = 1; + wr_ptr->tjetty = sbi->urma_cfg.tjetty; + wr_ptr->rw.dst.sge->addr = sbi->urma_cfg.urma_remote_va + + msg->offset + read_count * PAGE_SIZE; + wr_ptr->rw.dst.sge->len = read_len; + wr_ptr->rw.dst.sge->tseg = sbi->urma_cfg.remote_seg; + wr_ptr->rw.dst.num_sge = 1; + wr_ptr->rw.src.sge->addr = + (uint64_t)(write_buffer + read_count * PAGE_SIZE); + wr_ptr->rw.src.sge->len = read_len; + wr_ptr->rw.src.sge->tseg = sbi->urma_cfg.local_seg; + wr_ptr->rw.src.num_sge = 1; + wr_ptr->user_ctx = (uint64_t)(uintptr_t)wrs; + wr_ptr->next = NULL; + wr_pre = wr_ptr++; + } + return 0; +} + +int xmfs_urma_send_pages(struct xmfs_sb_info *sbi, struct xmfs_urma_msg *msg, + unsigned long *offsets, struct page **pages, + unsigned long page_num) +{ + struct ubcore_jfs_wr *wr = NULL; + int *slots = vzalloc(sizeof(int) * page_num); + + if (!slots) + return -ENOMEM; + void **kaddrs = vzalloc(sizeof(void *) * page_num); + + if (!kaddrs) { + vfree(slots); + return -ENOMEM; + } + int err = 0; + int cnt = 0; + + switch (msg->ops) { + case XMFS_URMA_READ: + err = xmfs_urma_get_read_wr_pages(sbi, &wr, msg, offsets, pages, + page_num, kaddrs, &cnt); + break; + case XMFS_URMA_WRITE: + err = xmfs_urma_get_write_wr_pages(sbi, &wr, msg, slots, pages, + page_num); + break; + default: + xmfs_error(NULL, "What exactly are you going to do?"); + err = -EOPNOTSUPP; + } + + if (err) { + xmfs_error(NULL, "failed to alloc wr or local buffer %ld %d", + page_num, err); + goto free_ret; + } + + err = xmfs_urma_send_and_wait(sbi, wr, msg); + +free_ret: + if (msg->ops == XMFS_URMA_READ) { + for (int i = 0; i < cnt; i++) + kunmap_local(kaddrs[i]); + } + vfree(kaddrs); + xmfs_urma_free_wr(msg, wr, err); + vfree(slots); + return err; +} + +int xmfs_pmem_write_multi_pages(struct xmfs_sb_info *sbi, unsigned long offset, + struct page **pages, unsigned long page_num) +{ + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: + /* memcpy(sbi->kaddr + offset, buf, size); */ + return 0; +#ifdef CONFIG_XMFS_FS_URMA + case XMFS_URMA_MODE: { + if (page_num == 0) + return 0; + unsigned long chunk = PAGE_SIZE * page_num; + struct xmfs_urma_msg msg; + int err; + + memset(&msg, 0, sizeof(msg)); + msg.ops = XMFS_URMA_WRITE; + msg.offset = offset; + msg.len = chunk; + err = xmfs_urma_send_pages(sbi, &msg, &offset, pages, page_num); + if (err) + return err; + + return 0; + } +#endif + default: + return -ENODEV; + } +} +EXPORT_SYMBOL(xmfs_pmem_write_multi_pages); + +int xmfs_pmem_read_multi_pages(struct xmfs_sb_info *sbi, unsigned long *offsets, + struct page **pages, unsigned long page_num) +{ + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: + /* memcpy(sbi->kaddr + offset, buf, size); */ + return 0; +#ifdef CONFIG_XMFS_FS_URMA + case XMFS_URMA_MODE: { + if (page_num == 0) + return 0; + unsigned long chunk = PAGE_SIZE * page_num; + struct xmfs_urma_msg msg; + int err; + + memset(&msg, 0, sizeof(msg)); + msg.ops = XMFS_URMA_READ; + msg.len = chunk; + err = xmfs_urma_send_pages(sbi, &msg, offsets, pages, page_num); + if (err) + return err; + + return 0; + } +#endif + default: + return -ENODEV; + } +} +EXPORT_SYMBOL(xmfs_pmem_read_multi_pages); + +int xmfs_send_request(struct xmfs_sb_info *sbi, struct xmfs_rw_msg *req, + struct xmfs_grant_wait *gw, int id) +{ + struct ubcore_jfs_wr *bad_send_wr = NULL; + struct ubcore_jfs_wr send_wr = {}; + struct ubcore_sge sge = {}; + int ret, slot; + struct xmfs_rw_msg *buf; + + int timeout; + + if (sbi->debug) + timeout = msecs_to_jiffies(20000); + else + timeout = msecs_to_jiffies(20000); + + buf = urma_pool_acquire(&sbi->urma_cfg.send_pool, &slot); + if (!buf) { + xmfs_info(NULL, "cannot get buf to send request"); + return -ENOMEM; + } + /* xmfs_info(sbi->sb, "qyf acquire slot %d", slot); */ + memcpy(buf, req, sizeof(struct xmfs_rw_msg)); + sge.addr = (uint64_t)buf; + sge.len = sizeof(*req); + sge.tseg = sbi->urma_cfg.send_seg; + + send_wr.opcode = UBCORE_OPC_SEND; + send_wr.tjetty = sbi->urma_cfg.send_tjettys[id]; + send_wr.send.src.sge = &sge; + send_wr.send.src.num_sge = 1; + send_wr.flag.value = 0; + send_wr.flag.bs.complete_enable = 1; + send_wr.user_ctx = slot; + send_wr.next = NULL; + /* + * xmfs_info(sbi->sb, "qyf send request send pool slot %d id %d", + * slot, req->request_id); + */ + if (req->ops == XMFS_GC) + xmfs_info(NULL, "gc req send %d", req->status); + ret = ubcore_post_jetty_send_wr(sbi->urma_cfg.send_jetty, &send_wr, + &bad_send_wr); + if (ret) { + xmfs_info(NULL, "err send request failed %d, release %d", ret, + slot); + urma_pool_release(&sbi->urma_cfg.send_pool, slot); + if (req->ops != XMFS_SETATTR && req->ops != XMFS_GC) + xa_erase(&sbi->urma_cfg.grant_waits, req->request_id); + return ret; + } + + if (req->ops == XMFS_SETATTR || req->ops == XMFS_GC) + return 0; + + ret = wait_for_completion_interruptible_timeout(&gw->done, timeout); + xa_erase(&sbi->urma_cfg.grant_waits, req->request_id); + /* + * xmfs_info(sbi->sb, "qyf send request done send pool slot %d id %d", + * slot, req->request_id); + */ + if (ret <= 0) { + if (ret == 0) + ret = -ETIMEDOUT; + xmfs_warning(sbi->sb, + "slave request wait failed: %d, request ID %ld", + ret, req->request_id); + return ret; + } + if (gw->grant.type != MSG_RW_GRANT) { + xmfs_warning(sbi->sb, + "unexpected grant: type %d, request ID %ld, op %d", + gw->grant.type, gw->grant.request_id, + gw->grant.ops); + return -EINVAL; + } + + return 0; +} + +/* + * static int xmfs_urma_post_wr(struct xmfs_sb_info *sbi, + * struct ubcore_jfs_wr *wr) + * { + * struct ubcore_jfs_wr *bad_wr = NULL; + * int err = ubcore_post_jetty_send_wr(sbi->urma_cfg.jetty, wr, + * &bad_wr); + * + * if (err) + * xmfs_error(sbi->sb, + * "ubcore_post_jetty_send_wr failed %d", err); + * return err; + * } + * + * static int xmfs_urma_wait_chain(struct ubcore_jfs_wr *wr) + * { + * struct ubcore_jfs_wr *tmp; + * int ret = 0; + * + * for (tmp = wr; tmp != NULL; tmp = tmp->next) { + * struct wr_status *wrs = + * (struct wr_status *)(uintptr_t)tmp->user_ctx; + * int err; + * + * if (wrs->status != URMA_ISSUING) + * goto skip_wait; + * err = wait_for_completion_interruptible_timeout( + * &wrs->done, msecs_to_jiffies(20000)); + * if (err <= 0) { + * xmfs_info(NULL, + * "wait for wr timeout or interrupted %d ops %d wrs->ret %d", + * err, wrs->ops, wrs->ret); + * ret = -EAGAIN; + * } + * skip_wait: + * if (wrs->status == URMA_ERROR) { + * xmfs_error(NULL, + * "urma send get err status=%d ret=%d ops=%d len src=%d dst=%d", + * wrs->status, wrs->ret, wrs->ops, + * tmp->rw.src.sge->len, + * tmp->rw.dst.sge->len); + * ret = -EAGAIN; + * } + * xmfs_wrs_put(&wrs); + * } + * return ret; + * } + * + * static int xmfs_urma_send_and_wait_new(struct xmfs_sb_info *sbi, + * struct ubcore_jfs_wr *wr, + * struct xmfs_urma_msg *msg) + * { + * int err = xmfs_urma_post_wr(sbi, wr); + * + * if (err) + * return err; + * return xmfs_urma_wait_chain(wr); + * } + * + * struct xmfs_urma_pending { + * struct ubcore_jfs_wr *wr; + * void *write_buffer; + * int *slots; + * int nr_slots; + * struct xmfs_urma_msg msg; + * }; + * + * static void wr_chain_append(struct ubcore_jfs_wr **chain_head, + * struct ubcore_jfs_wr **tail, + * struct ubcore_jfs_wr *wr) + * { + * wr->next = NULL; + * if (*chain_head == NULL) { + * *chain_head = wr; + * *tail = wr; + * } else { + * (*tail)->next = wr; + * *tail = wr; + * } + * } + */ + +static int xmfs_urma_get_write_wr_ubuf(struct xmfs_sb_info *sbi, + struct ubcore_jfs_wr **wr, + struct xmfs_urma_msg *msg) +{ + *wr = vzalloc(sizeof(struct ubcore_jfs_wr)); + if (!*wr) + return -ENOMEM; + + struct wr_status *wrs = kzalloc(sizeof(struct wr_status), GFP_KERNEL); + + if (!wrs) + return -ENOMEM; + + (*wr)->rw.src.sge = vzalloc(sizeof(struct ubcore_sge)); + (*wr)->rw.dst.sge = vzalloc(sizeof(struct ubcore_sge)); + if (!(*wr)->rw.src.sge || !(*wr)->rw.dst.sge) + return -ENOMEM; + + wrs->status = URMA_ISSUING; + init_completion(&wrs->done); + wrs->ret = 7; + wrs->ops = XMFS_URMA_WRITE; + wrs->magic = XMFS_MAGIC; + wrs->slot = -1; /* msg.slot */ + refcount_set(&wrs->refs, 1); + xmfs_wrs_get(wrs); + (*wr)->opcode = UBCORE_OPC_WRITE; + (*wr)->flag.bs.complete_enable = 1; + (*wr)->tjetty = sbi->urma_cfg.tjetty; + (*wr)->rw.src.sge->addr = (uint64_t)msg->write_buffer; + (*wr)->rw.src.sge->len = msg->len; + (*wr)->rw.src.sge->tseg = sbi->urma_cfg.local_seg; + (*wr)->rw.src.num_sge = 1; + (*wr)->rw.dst.sge->addr = sbi->urma_cfg.urma_remote_va + msg->offset; + (*wr)->rw.dst.sge->len = msg->len; + (*wr)->rw.dst.sge->tseg = sbi->urma_cfg.remote_seg; + (*wr)->rw.dst.num_sge = 1; + (*wr)->user_ctx = (uint64_t)(uintptr_t)wrs; + (*wr)->next = NULL; + msg->wr_cnt = 1; + return 0; +} + +static int xmfs_urma_get_read_wr_ubuf(struct xmfs_sb_info *sbi, + struct ubcore_jfs_wr **wr, + struct xmfs_urma_msg *msg) +{ + int trunk_size; + + if (sbi->debug) + trunk_size = 4096; + else + trunk_size = msg->len; + + uint64_t wr_count = DIV_ROUND_UP(msg->len, trunk_size); + struct ubcore_jfs_wr *wr_ptr, *wr_pre = NULL; + *wr = vzalloc(wr_count * sizeof(struct ubcore_jfs_wr)); + if (!*wr) + return -ENOMEM; + + wr_ptr = *wr; + for (uint64_t read_count = 0; read_count < msg->len; + read_count += trunk_size) { + struct wr_status *wrs = + kzalloc(sizeof(struct wr_status), GFP_KERNEL); + if (!wrs) + return -ENOMEM; + + wr_ptr->rw.src.sge = vzalloc(sizeof(struct ubcore_sge)); + wr_ptr->rw.dst.sge = vzalloc(sizeof(struct ubcore_sge)); + if (!wr_ptr->rw.src.sge || !wr_ptr->rw.dst.sge) + return -ENOMEM; + + wrs->status = URMA_ISSUING; + init_completion(&wrs->done); + wrs->ret = 1; + wrs->ops = XMFS_URMA_READ; + wrs->magic = XMFS_MAGIC; + refcount_set(&wrs->refs, 1); + xmfs_wrs_get(wrs); + uint64_t read_len = read_count + trunk_size < msg->len ? + trunk_size : + msg->len - read_count; + if (wr_pre) + wr_pre->next = wr_ptr; + wr_ptr->opcode = UBCORE_OPC_READ; + wr_ptr->flag.bs.complete_enable = 1; + wr_ptr->tjetty = sbi->urma_cfg.tjetty; + wr_ptr->rw.src.sge->addr = + sbi->urma_cfg.urma_remote_va + msg->offset + read_count; + wr_ptr->rw.src.sge->len = read_len; + wr_ptr->rw.src.sge->tseg = sbi->urma_cfg.remote_seg; + wr_ptr->rw.src.num_sge = 1; + wr_ptr->rw.dst.sge->addr = + (uint64_t)msg->local_addr + read_count; + wr_ptr->rw.dst.sge->len = read_len; + wr_ptr->rw.dst.sge->tseg = sbi->urma_cfg.local_seg; + wr_ptr->rw.dst.num_sge = 1; + wr_ptr->user_ctx = (uint64_t)(uintptr_t)wrs; + wr_ptr->next = NULL; + wr_pre = wr_ptr++; + } + msg->wr_cnt = wr_count; + + /* + * *wr = (struct ubcore_jfs_wr *)vzalloc( + * sizeof(struct ubcore_jfs_wr)); + * if (!*wr) + * return -ENOMEM; + * struct wr_status *wrs = vzalloc(sizeof(struct wr_status)); + * if (!wrs) + * return -ENOMEM; + * (*wr)->rw.src.sge = vzalloc(sizeof(struct ubcore_sge)); + * (*wr)->rw.dst.sge = vzalloc(sizeof(struct ubcore_sge)); + * if (!(*wr)->rw.src.sge || !(*wr)->rw.dst.sge) + * return -ENOMEM; + * wrs->status = URMA_ISSUING; + * init_completion(&wrs->done); + * wrs->ret = 8; + * wrs->ops = XMFS_URMA_READ; + * wrs->magic = XMFS_MAGIC; + * wrs->slot = -1; + * refcount_set(&wrs->refs, 1); + * xmfs_wrs_get(wrs); + * (*wr)->opcode = UBCORE_OPC_READ; + * (*wr)->flag.bs.complete_enable = 1; + * (*wr)->tjetty = sbi->urma_cfg.tjetty; + * (*wr)->rw.dst.sge->addr = (uint64_t)msg->local_addr; + * (*wr)->rw.dst.sge->len = msg->len; + * (*wr)->rw.dst.sge->tseg = sbi->urma_cfg.local_seg; + * (*wr)->rw.dst.num_sge = 1; + * (*wr)->rw.src.sge->addr = + * sbi->urma_cfg.urma_remote_va + msg->offset; + * (*wr)->rw.src.sge->len = msg->len; + * (*wr)->rw.src.sge->tseg = sbi->urma_cfg.remote_seg; + * (*wr)->rw.src.num_sge = 1; + * (*wr)->user_ctx = (uint64_t)(uintptr_t)wrs; + * (*wr)->next = NULL; + * msg->wr_cnt = 1; + */ + return 0; +} + +static int xmfs_urma_send_ubuf(struct xmfs_sb_info *sbi, + struct xmfs_urma_msg *msg) +{ + struct ubcore_jfs_wr *wr = NULL; + int err = 0; + + switch (msg->ops) { + case XMFS_URMA_READ: + err = xmfs_urma_get_read_wr_ubuf(sbi, &wr, msg); + break; + case XMFS_URMA_WRITE: + err = xmfs_urma_get_write_wr_ubuf(sbi, &wr, msg); + break; + default: + xmfs_error(NULL, "What exactly are you going to do?"); + return -EOPNOTSUPP; + } + + if (err) { + xmfs_error(NULL, "failed to alloc wr or local buffer"); + goto free_ret; + } + + err = xmfs_urma_send_and_wait(sbi, wr, msg); + +free_ret: + xmfs_urma_free_wr(msg, wr, err); + return err; +} + +int xmfs_urma_write_ubuf(struct xmfs_sb_info *sbi, void __user *buf, + size_t size, unsigned long offset) +{ + int chunk_size; + + if (sbi->debug) + chunk_size = PAGE_SIZE; + else + chunk_size = XMFS_DEFAULT_CHUNK_SIZE - PAGE_SIZE; + int *slots = vzalloc(sizeof(int) * (size + PAGE_SIZE - 1) / PAGE_SIZE); + + if (!slots) + return -ENOMEM; + int loop_cnt = 0; + int chunk_header_cnt = 0; + size_t written = 0; + int err; + /* + * xmfs_info(sbi->sb, "qyf before acquire nslots %d", + * (size + PAGE_SIZE * 16 - 1) / (PAGE_SIZE * 16)); + */ + void *write_buffer = + urma_pool_acquire_nslots(&sbi->urma_cfg.pool, + (size + PAGE_SIZE - 1) / PAGE_SIZE, + slots); + if (!write_buffer) { + vfree(slots); + xmfs_info(NULL, "write ubuf cannot get a buffer to write"); + return -EINVAL; + } + /* xmfs_info(sbi->sb, "qyf before copy from user"); */ + err = copy_from_user(write_buffer, buf, size); + if (err) { + xmfs_error(NULL, "write ubuf cannot copy from, size is %ld", size); + urma_pool_release_nslots(&sbi->urma_cfg.pool, + (size + PAGE_SIZE - 1) / PAGE_SIZE, slots); + vfree(slots); + return err; + } + /* xmfs_info(sbi->sb, "qyf end copy from user"); */ + while (written < size) { + unsigned long chunk = size - written; + struct xmfs_urma_msg msg; + + if (chunk > chunk_size) + chunk = chunk_size; + msg.ops = XMFS_URMA_WRITE; + msg.len = chunk_size; + msg.offset = offset + loop_cnt * chunk_size + + chunk_header_cnt * PAGE_SIZE; + if (msg.offset % XMFS_DEFAULT_CHUNK_SIZE == 0) { + chunk_header_cnt++; + msg.offset = offset + loop_cnt * chunk_size + + chunk_header_cnt * PAGE_SIZE; + } + /* + * xmfs_info(sbi->sb, + * "write ubuf msg len %d loopcnt %d offset %ld header cnt %d", + * chunk_size, loop_cnt, msg.offset, chunk_header_cnt); + */ + msg.write_buffer = write_buffer + written; + /* TODO */ + err = xmfs_urma_send_ubuf(sbi, &msg); + if (err) + break; + + written += chunk; + loop_cnt++; + /* xmfs_info(sbi->sb, "qyf end send and wait"); */ + } + urma_pool_release_nslots(&sbi->urma_cfg.pool, + (size + PAGE_SIZE - 1) / PAGE_SIZE, slots); + /* xmfs_info(sbi->sb, "qyf end release"); */ + vfree(slots); + return err; +} + +int xmfs_urma_read_ubuf(struct xmfs_sb_info *sbi, void __user *buf, + struct xmfs_read_extent *exts, int ext_cnt, size_t size) +{ + pgoff_t start_index; + unsigned long start_offset; + unsigned int nr_pages; + unsigned long offset = 0; + struct xmfs_urma_msg msg; + void *local_buf = vzalloc(size); + int err; + + msg.ops = XMFS_URMA_READ; + + for (int i = 0; i < ext_cnt; i++) { + start_index = exts[i].start_index; + start_offset = exts[i].start_offset; + nr_pages = exts[i].nr_pages; + msg.local_addr = local_buf + offset; + msg.len = min(nr_pages * PAGE_SIZE, size - offset); + msg.offset = start_offset; + /* + * xmfs_info(sbi->sb, + * "qyf urma read ubuf from %ld read %ld " + * "real len %ld offset %ld size %ld", + * start_offset, nr_pages * PAGE_SIZE, msg.len, offset, + * size); + */ + err = xmfs_urma_send_ubuf(sbi, &msg); + /* xmfs_info(sbi->sb, "qyf urma send ubuf done %d", err); */ + offset += msg.len; + } + err = copy_to_user(buf, local_buf, size); + if (err) + xmfs_error(NULL, "read ubuf cannot copy to, size is %ld", size); + + vfree(local_buf); + return err; +} + +int xmfs_urma_fill_write_page(struct xmfs_sb_info *sbi, + struct ubcore_jfs_wr *wr, + struct xmfs_urma_msg *msg, int slot) +{ + struct wr_status *wrs = kzalloc(sizeof(struct wr_status), GFP_KERNEL); + + if (!wrs) + return -ENOMEM; + wr->rw.src.sge = vzalloc(sizeof(struct ubcore_sge)); + wr->rw.dst.sge = vzalloc(sizeof(struct ubcore_sge)); + if (!wr->rw.src.sge || !wr->rw.dst.sge) { + kfree(wrs); + if (wr->rw.src.sge) + vfree(wr->rw.src.sge); + if (wr->rw.dst.sge) + vfree(wr->rw.dst.sge); + return -ENOMEM; + } + + wrs->status = URMA_ISSUING; + init_completion(&wrs->done); + wrs->ret = 6; + wrs->ops = XMFS_URMA_WRITE; + wrs->magic = XMFS_MAGIC; + wrs->slot = -1; /* slot */ + refcount_set(&wrs->refs, 1); + xmfs_wrs_get(wrs); + memcpy(msg->write_buffer, msg->local_addr, msg->len); + + wr->opcode = UBCORE_OPC_WRITE; + wr->flag.bs.complete_enable = 1; + wr->tjetty = sbi->urma_cfg.tjetty; + wr->rw.src.sge->addr = (uint64_t)msg->write_buffer; + wr->rw.src.sge->len = msg->len; + wr->rw.src.sge->tseg = sbi->urma_cfg.local_seg; + wr->rw.src.num_sge = 1; + wr->rw.dst.sge->addr = sbi->urma_cfg.urma_remote_va + msg->offset; + wr->rw.dst.sge->len = msg->len; + wr->rw.dst.sge->tseg = sbi->urma_cfg.remote_seg; + wr->rw.dst.num_sge = 1; + wr->user_ctx = (uint64_t)(uintptr_t)wrs; + wr->next = NULL; + msg->wr_cnt = 1; + return 0; +} + +int xmfs_urma_send_write_pages(struct xmfs_sb_info *sbi, + struct ubcore_jfs_wr *wr) +{ + struct ubcore_jfs_wr *cur; + struct wr_status *wrs; + int err; + + if (!wr) + return -EINVAL; + struct xmfs_urma_msg msg; + + msg.offset = 0; + msg.len = 0; + err = xmfs_urma_send_and_wait(sbi, &wr[0], &msg); + + cur = &wr[0]; + while (cur) { + vfree(cur->rw.src.sge); + vfree(cur->rw.dst.sge); + wrs = (struct wr_status *)cur->user_ctx; + if (wrs != NULL && err != -EAGAIN && err != 0) { + /* xmfs_info(sbi->sb, "qyf FREE 4 wrs=%px", wrs); */ + kfree(wrs); + } + cur = cur->next; + } + + vfree(wr); + + return err; +} + +int xmfs_pmem_read(struct xmfs_sb_info *sbi, unsigned long offset, void *buf, + unsigned long size) +{ + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: + memcpy(buf, sbi->kaddr + offset, size); + return 0; +#ifdef CONFIG_XMFS_FS_URMA + case XMFS_URMA_MODE: + return get_meta_and_copy(sbi, offset, buf, size, NULL, 0); +#endif + default: + return -ENODEV; + } +} +EXPORT_SYMBOL(xmfs_pmem_read); + +int xmfs_pmem_cas(struct xmfs_sb_info *sbi, unsigned long offset, + uint64_t old_val, uint64_t new_val) +{ + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: { + uint64_t *p = (uint64_t *)(sbi->kaddr + offset); + + return atomic64_cmpxchg((atomic64_t *)p, old_val, new_val) == + old_val ? + 0 : + -EAGAIN; + } +#ifdef CONFIG_XMFS_FS_URMA + case XMFS_URMA_MODE: { + struct xmfs_urma_msg msg; + uint64_t result; + int err; + + memset(&msg, 0, sizeof(msg)); + msg.ops = XMFS_URMA_CAS; + msg.offset = offset; + msg.len = 8; + msg.local_addr = &result; + msg.cas_cmp_data = old_val; + msg.cas_swap_data = new_val; + err = xmfs_urma_send(sbi, &msg); + if (err) + return err; + return result == old_val ? 0 : -EAGAIN; + } +#endif + default: + return -ENODEV; + } +} +EXPORT_SYMBOL(xmfs_pmem_cas); + +int xmfs_urma_send(struct xmfs_sb_info *sbi, struct xmfs_urma_msg *msg) +{ + struct ubcore_jfs_wr *wr = NULL; + int err = 0; + + if (msg->ops == XMFS_URMA_WRITE && msg->len > PAGE_SIZE) { + xmfs_error(NULL, + "write more than PAGE_SIZE is now unsupported"); + return -EOPNOTSUPP; + } + + switch (msg->ops) { + case XMFS_URMA_READ: + err = xmfs_urma_get_read_wr(sbi, &wr, msg); + break; + case XMFS_URMA_WRITE: + err = xmfs_urma_get_write_wr(sbi, &wr, msg); + break; + case XMFS_URMA_CAS: + err = xmfs_urma_get_cas_wr(sbi, &wr, msg); + break; + default: + xmfs_error(NULL, "What exactly are you going to do?"); + return -EOPNOTSUPP; + } + + if (err) { + xmfs_error(NULL, "failed to alloc wr or local buffer"); + goto free_ret; + } + + err = xmfs_urma_send_and_wait(sbi, wr, msg); + +free_ret: + xmfs_urma_free_wr(msg, wr, err); + return err; +} + +#else + +void xmfs_urma_unregister(struct xmfs_sb_info *sbi) +{ +} + +int xmfs_urma_register(struct xmfs_sb_info *sbi, struct xmfs_fs_context *ctx) +{ + return -EOPNOTSUPP; +} + +void xmfs_urma_unimport(struct xmfs_sb_info *sbi) +{ +} + +int xmfs_urma_import(struct xmfs_sb_info *sbi) +{ + return -EOPNOTSUPP; +} + +int xmfs_import_jetty(struct xmfs_sb_info *sbi, struct urma_info info, + int index, bool is_send) +{ + return -EOPNOTSUPP; +} + +int xmfs_send_request(struct xmfs_sb_info *sbi, struct xmfs_rw_msg *req, + struct xmfs_grant_wait *gw, int id) +{ + return -EOPNOTSUPP; +} + +int xmfs_urma_send(struct xmfs_sb_info *sbi, struct xmfs_urma_msg *msg) +{ + return -EOPNOTSUPP; +} + +int xmfs_pmem_write_multi_pages(struct xmfs_sb_info *sbi, unsigned long offset, + struct page **pages, unsigned long page_num) +{ + return -EOPNOTSUPP; +} + +int xmfs_pmem_read_multi_pages(struct xmfs_sb_info *sbi, unsigned long *offsets, + struct page **pages, unsigned long page_num) +{ + return -EOPNOTSUPP; +} + +int xmfs_urma_write_ubuf(struct xmfs_sb_info *sbi, void __user *buf, + size_t size, unsigned long offset) +{ + return -EOPNOTSUPP; +} + +int xmfs_urma_read_ubuf(struct xmfs_sb_info *sbi, void __user *buf, + struct xmfs_read_extent *exts, int ext_cnt, size_t size) +{ + return -EOPNOTSUPP; +} + +int xmfs_pmem_write(struct xmfs_sb_info *sbi, unsigned long offset, + const void *buf, unsigned long size) +{ + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: + memcpy(sbi->kaddr + offset, buf, size); + return 0; + default: + return -EOPNOTSUPP; + } +} +EXPORT_SYMBOL(xmfs_pmem_write); + +int xmfs_pmem_read(struct xmfs_sb_info *sbi, unsigned long offset, void *buf, + unsigned long size) +{ + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: + memcpy(buf, sbi->kaddr + offset, size); + return 0; + default: + return -EOPNOTSUPP; + } +} +EXPORT_SYMBOL(xmfs_pmem_read); + +int xmfs_pmem_cas(struct xmfs_sb_info *sbi, unsigned long offset, + uint64_t old_val, uint64_t new_val) +{ + switch (sbi->mode) { + case XMFS_SHARED_MEM_MODE: + case XMFS_HYBRID_MODE: { + uint64_t *p = (uint64_t *)(sbi->kaddr + offset); + + return atomic64_cmpxchg((atomic64_t *)p, old_val, new_val) == + old_val ? + 0 : + -EAGAIN; + } + default: + return -EOPNOTSUPP; + } +} +EXPORT_SYMBOL(xmfs_pmem_cas); + +#endif diff --git a/fs/xmfs/xattr.c b/fs/xmfs/xattr.c new file mode 100644 index 000000000000..96e1325f63f0 --- /dev/null +++ b/fs/xmfs/xattr.c @@ -0,0 +1,591 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * XMFS: Log Structured Filesystem for UB + * Copyright (C) 2024. Huawei Technologies Co., Ltd + * + * This program can be distributed under the terms of the GNU GPL. + * See the file COPYING. + */ + +#include "xmfs_i.h" + +void xmfs_simple_xattr_free(struct simple_xattr *xattr) +{ + if (xattr) + kfree(xattr->name); + kvfree(xattr); +} + +size_t xmfs_simple_xattr_space(const char *name, size_t size) +{ + /* + * Use "40" instead of sizeof(struct simple_xattr), to return the + * same result on 32-bit and 64-bit, and even if simple_xattr grows. + */ + return 40 + size + strlen(name); +} + +void xmfs_simple_xattrs_free(struct simple_xattrs *xattrs, size_t *freed_space) +{ + struct rb_node *rbp; + + if (freed_space) + *freed_space = 0; + rbp = rb_first(&xattrs->rb_root); + while (rbp) { + struct simple_xattr *xattr; + struct rb_node *rbp_next; + + rbp_next = rb_next(rbp); + xattr = rb_entry(rbp, struct simple_xattr, rb_node); + rb_erase(&xattr->rb_node, &xattrs->rb_root); + if (freed_space) + *freed_space += xmfs_simple_xattr_space(xattr->name, + xattr->size); + xmfs_simple_xattr_free(xattr); + rbp = rbp_next; + } +} + +void xmfs_simple_xattrs_init(struct simple_xattrs *xattrs) +{ + xattrs->rb_root = RB_ROOT; + rwlock_init(&xattrs->lock); +} + +struct simple_xattr *xmfs_simple_xattr_alloc(const void *value, size_t size) +{ + struct simple_xattr *new_xattr; + size_t len; + + /* wrap around? */ + len = sizeof(*new_xattr) + size; + if (len < sizeof(*new_xattr)) + return NULL; + + new_xattr = kvmalloc(len, GFP_KERNEL_ACCOUNT); + if (!new_xattr) + return NULL; + + new_xattr->size = size; + memcpy(new_xattr->value, value, size); + return new_xattr; +} + +static int rbtree_simple_xattr_cmp(const void *key, const struct rb_node *node) +{ + const char *xattr_name = key; + const struct simple_xattr *xattr; + + xattr = rb_entry(node, struct simple_xattr, rb_node); + return strcmp(xattr->name, xattr_name); +} + +struct simple_xattr *xmfs_simple_xattr_set(struct simple_xattrs *xattrs, + const char *name, const void *value, + size_t size, int flags) +{ + struct simple_xattr *old_xattr = NULL, *new_xattr = NULL; + struct rb_node *parent = NULL, **rbp; + int err = 0, ret; + + /* value == NULL means remove */ + if (value) { + new_xattr = xmfs_simple_xattr_alloc(value, size); + if (!new_xattr) + return ERR_PTR(-ENOMEM); + + new_xattr->name = kstrdup(name, GFP_KERNEL_ACCOUNT); + if (!new_xattr->name) { + xmfs_simple_xattr_free(new_xattr); + return ERR_PTR(-ENOMEM); + } + } + + write_lock(&xattrs->lock); + rbp = &xattrs->rb_root.rb_node; + while (*rbp) { + parent = *rbp; + ret = rbtree_simple_xattr_cmp(name, *rbp); + if (ret < 0) + rbp = &(*rbp)->rb_left; + else if (ret > 0) + rbp = &(*rbp)->rb_right; + else + old_xattr = + rb_entry(*rbp, struct simple_xattr, rb_node); + if (old_xattr) + break; + } + + if (old_xattr) { + /* Fail if XATTR_CREATE is requested and the xattr exists. */ + if (flags & XATTR_CREATE) { + err = -EEXIST; + goto out_unlock; + } + + if (new_xattr) + rb_replace_node(&old_xattr->rb_node, + &new_xattr->rb_node, &xattrs->rb_root); + else + rb_erase(&old_xattr->rb_node, &xattrs->rb_root); + } else { + /* Fail if XATTR_REPLACE is requested but no xattr is found. */ + if (flags & XATTR_REPLACE) { + err = -ENODATA; + goto out_unlock; + } + + /* + * If XATTR_CREATE or no flags are specified together with a + * new value simply insert it. + */ + if (new_xattr) { + rb_link_node(&new_xattr->rb_node, parent, rbp); + rb_insert_color(&new_xattr->rb_node, &xattrs->rb_root); + } + + /* + * If XATTR_CREATE or no flags are specified and neither an + * old or new xattr exist then we don't need to do anything. + */ + } + +out_unlock: + write_unlock(&xattrs->lock); + if (!err) + return old_xattr; + xmfs_simple_xattr_free(new_xattr); + return ERR_PTR(err); +} + +int xmfs_simple_xattr_get(struct simple_xattrs *xattrs, const char *name, + void *buffer, size_t size) +{ + struct simple_xattr *xattr = NULL; + struct rb_node *rbp; + int ret = -ENODATA; + + read_lock(&xattrs->lock); + rbp = rb_find(name, &xattrs->rb_root, rbtree_simple_xattr_cmp); + if (rbp) { + xattr = rb_entry(rbp, struct simple_xattr, rb_node); + ret = xattr->size; + if (buffer) { + if (size < xattr->size) + ret = -ERANGE; + else + memcpy(buffer, xattr->value, xattr->size); + } + } + read_unlock(&xattrs->lock); + return ret; +} + +static bool xattr_is_trusted(const char *name) +{ + return !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN); +} + +int xmfs_xattr_list_one(char **buffer, ssize_t *remaining_size, + const char *name) +{ + size_t len; + + len = strlen(name) + 1; + if (*buffer) { + if (*remaining_size < len) + return -ERANGE; + memcpy(*buffer, name, len); + *buffer += len; + } + *remaining_size -= len; + return 0; +} + +ssize_t xmfs_simple_xattr_list(struct inode *inode, + struct simple_xattrs *xattrs, char *buffer, + size_t size) +{ + bool trusted = ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN); + struct simple_xattr *xattr; + struct rb_node *rbp; + ssize_t remaining_size = size; + int err = 0; + + read_lock(&xattrs->lock); + for (rbp = rb_first(&xattrs->rb_root); rbp; rbp = rb_next(rbp)) { + xattr = rb_entry(rbp, struct simple_xattr, rb_node); + + /* skip "trusted." attributes for unprivileged callers */ + if (!trusted && xattr_is_trusted(xattr->name)) + continue; + + err = xmfs_xattr_list_one(&buffer, &remaining_size, + xattr->name); + if (err) + break; + } + read_unlock(&xattrs->lock); + + return err ? err : size - remaining_size; +} + +static unsigned long xmfs_xattr_write_value(struct inode *inode, + const char *name, const void *value, + size_t size, + struct xmfs_log *xm_log, + struct xmfs_sb_index *xmsi) +{ + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + if (xmfs_quiesce_wait(sbi)) + return 0; + unsigned long data_current = xmsi->data_current; + unsigned long data_count = xmsi->data_count; + long slot; + + WARN_ON(xmsi->count == 0); + + if (data_current == 0 || data_count == 511) { + slot = xmfs_alloc_and_mark_slot(xmsi, sbi, 'd'); + if (slot < 0) + return -ENOSPC; + xmsi->data_current = + DATA_AREA_OFFSET + slot * sbi->trunk_size + PAGE_SIZE; + xmsi->data_count = 0; + } else { + xmsi->data_current = data_current + PAGE_SIZE; + } + xm_log->data_offset = xmsi->data_current; + xmsi->data_count = xmsi->data_count + 1; + + xmfs_data_write(sbi, xmsi->data_current, value, size); + xmfs_mark_page_live(sbi, xmsi->data_current); + + return 0; +} + +static int xmfs_xattr_set_log(struct inode *inode, const char *name, + const void *value, size_t size, int flags) +{ + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + + if (xmfs_quiesce_wait(sbi)) + return -EINTR; + struct xmfs_inode_info *xmfs_inode = XMFS_I(inode); + struct xmfs_log xm_log = { 0 }; + + xm_log.index = size; + xm_log.end_index = strlen(name); + xm_log.ops = XMFS_XATTR; + xm_log.size = flags; + xm_log.p_ino = inode->__i_ctime.tv_sec; + xm_log.offset = inode->__i_ctime.tv_nsec; + memcpy(xm_log.name, name, strlen(name)); + + spin_lock(&sbi->space_lock); + if (xmfs_inode->die) { + xmfs_info(inode->i_sb, + "inode logs have been interrupted before set xattr"); + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + + struct xmfs_sb_index *xmsi = get_xmsi(sbi); + + if (!xmsi) { + spin_unlock(&sbi->space_lock); + return -EINVAL; + } + int logcount = 1; + int need_data_trunk = + (xmsi->data_count == 511 || xmsi->data_current == 0) ? 1 : 0; + if (xmsi->used_trunk_count + logcount + need_data_trunk > + sbi->max_chunk) { + sbi->full = true; + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + return -ENOSPC; + } + + xmfs_xattr_write_value(inode, name, value, size, &xm_log, xmsi); + spin_unlock(&sbi->space_lock); + put_xmsi(sbi, xmsi); + unsigned long xmlt_addr = + xmfs_add_log_v3(&xm_log, sbi, strlen(name), inode->i_ino, true); + if (xmlt_addr < 0) { + xmfs_inode->die = true; + return -EINVAL; + } + + return 0; +} + +int xmfs_initxattrs(struct inode *inode, const struct xattr *xattr_array, + void *fs_info) +{ + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + const struct xattr *xattr; + struct simple_xattr *new_xattr; + struct xmfs_inode_info *info = XMFS_I(inode); + size_t len; + int err = 0; + + for (xattr = xattr_array; xattr->name != NULL; xattr++) { + new_xattr = + xmfs_simple_xattr_alloc(xattr->value, xattr->value_len); + if (!new_xattr) + break; + + len = strlen(xattr->name) + 1; + if ((len + XATTR_SECURITY_PREFIX_LEN) > 255 || + new_xattr->size > PAGE_SIZE) { + continue; + } + new_xattr->name = kmalloc(XATTR_SECURITY_PREFIX_LEN + len, + GFP_KERNEL_ACCOUNT); + if (!new_xattr->name) { + kvfree(new_xattr); + break; + } + + memcpy(new_xattr->name, XATTR_SECURITY_PREFIX, + XATTR_SECURITY_PREFIX_LEN); + memcpy(new_xattr->name + XATTR_SECURITY_PREFIX_LEN, xattr->name, + len); + + new_xattr = xmfs_simple_xattr_set(&info->xattrs, + new_xattr->name, + new_xattr->value, + new_xattr->size, 0); + if (!IS_ERR(new_xattr)) { + inode_set_ctime_current(inode); + if (sbi->id == 0) { + err = xmfs_xattr_set_log(inode, new_xattr->name, + new_xattr->value, + new_xattr->size, 0); + if (err < 0) { + xmfs_simple_xattr_free(new_xattr); + break; + } + } + xmfs_simple_xattr_free(new_xattr); + } else { + break; + } + } + + if (xattr->name != NULL) { + xmfs_simple_xattrs_free(&info->xattrs, NULL); + return -ENOMEM; + } + + return err; +} + +static int xmfs_xattr_slave_get(const struct xattr_handler *handler, + struct dentry *unused, struct inode *inode, + const char *name, void *buffer, size_t size) +{ + struct xmfs_inode_info *info = XMFS_I(inode); + + if (inode->i_ino == 0) { + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct xmfs_sb_index *xmsi = + kmalloc(sizeof(struct xmfs_sb_index), GFP_KERNEL); + int err = get_xmsi_and_copy(sbi, xmsi); + + if (unlikely(err)) { + xmfs_error(inode->i_sb, + "hardware memory error when reading superblock during slave dir iterate"); + kfree(xmsi); + return err; + } + + sbi->stop_cnt++; + if (xmsi->last_update != sbi->last_update) { + if (!sbi->debug) + xmfs_replay_new_entries(sbi, NULL, + xmsi->last_update); + else + xmfs_replay_new_entries(sbi, NULL, + xmsi->last_update); + } + kfree(xmsi); + } + name = xattr_full_name(handler, name); + return xmfs_simple_xattr_get(&info->xattrs, name, buffer, size); +} + +static int xmfs_xattr_get(const struct xattr_handler *handler, + struct dentry *unused, struct inode *inode, + const char *name, void *buffer, size_t size) +{ + struct xmfs_inode_info *info = XMFS_I(inode); + + name = xattr_full_name(handler, name); + return xmfs_simple_xattr_get(&info->xattrs, name, buffer, size); +} + +static int xmfs_xattr_set(const struct xattr_handler *handler, + struct mnt_idmap *idmap, struct dentry *unused, + struct inode *inode, const char *name, + const void *value, size_t size, int flags) +{ + struct simple_xattr *old_xattr; + struct xmfs_inode_info *info = XMFS_I(inode); + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + int err = 0; + + name = xattr_full_name(handler, name); + if (strlen(name) > 255 || size > PAGE_SIZE) + return -EINVAL; + + old_xattr = + xmfs_simple_xattr_set(&info->xattrs, name, value, size, flags); + if (!IS_ERR(old_xattr)) { + inode_set_ctime_current(inode); + if (sbi->id == 0) + err = xmfs_xattr_set_log(inode, name, value, size, + flags); + xmfs_simple_xattr_free(old_xattr); + old_xattr = NULL; + } + + return err == 0 ? PTR_ERR(old_xattr) : err; +} + +ssize_t xmfs_listxattr(struct dentry *dentry, char *buffer, size_t size) +{ + struct xmfs_inode_info *info = XMFS_I(d_inode(dentry)); + + return xmfs_simple_xattr_list(d_inode(dentry), &info->xattrs, buffer, + size); +} + +static const struct xattr_handler xmfs_security_xattr_handler = { + .prefix = XATTR_SECURITY_PREFIX, + .get = xmfs_xattr_get, + .set = xmfs_xattr_set, +}; + +static const struct xattr_handler xmfs_trusted_xattr_handler = { + .prefix = XATTR_TRUSTED_PREFIX, + .get = xmfs_xattr_get, + .set = xmfs_xattr_set, +}; + +static const struct xattr_handler xmfs_user_xattr_handler = { + .prefix = XATTR_USER_PREFIX, + .get = xmfs_xattr_get, + .set = xmfs_xattr_set, +}; + +static int xmfs_xattr_set_slave(const struct xattr_handler *handler, + struct mnt_idmap *idmap, struct dentry *dentry, + struct inode *inode, const char *name, + const void *value, size_t size, int flags) +{ + struct xmfs_sb_info *sbi = XMFS_SB(inode->i_sb); + struct xmfs_rw_msg req = {}, grant = {}; + struct xmfs_log xm_log; + unsigned long log_off; + unsigned long pages; + int err; + + if (!sbi || sbi->id == 0) + return -EINVAL; + + if (value && size > 0) + pages = (size + PAGE_SIZE - 1) / PAGE_SIZE; + else + pages = 0; + + req.ops = XMFS_XATTR; + req.i_ino = inode->i_ino; + req.data_pages = pages; + req.log_entries = 1; + req.size = size; + req.mode = flags; + snprintf(req.name, 256, "%s%s", handler->prefix, name); + + req.type = MSG_RW_REQUEST; + req.slave_id = sbi->id; + spin_lock(&sbi->local_ring_lock); + req.request_id = ++sbi->rw_request_id; + spin_unlock(&sbi->local_ring_lock); + struct xmfs_grant_wait gw; + + init_completion(&gw.done); + xa_store(&sbi->urma_cfg.grant_waits, req.request_id, &gw, GFP_KERNEL); + err = xmfs_send_request(sbi, &req, &gw, 0); + if (err) + return err; + grant = gw.grant; + + if (value && size > 0 && grant.data_addr != 0) + xmfs_data_write(sbi, grant.data_addr, (void *)value, size); + + log_off = grant.log_trunk_addr + + offsetof(struct xmfs_log_trunk, log[0]) + + grant.log_slot_start * sizeof(struct xmfs_log); + memset(&xm_log, 0, sizeof(xm_log)); + xm_log.ops = XMFS_XATTR; + xm_log.i_ino = inode->i_ino; + xm_log.version = grant.version; + xm_log.data_offset = grant.data_addr; + xm_log.size = size; + xm_log.mode = flags; + xm_log.writer_id = sbi->id; + snprintf(xm_log.name, 256, "%s%s", handler->prefix, name); + xmfs_data_write(sbi, log_off, &xm_log, sizeof(xm_log)); + + { + const char *full_name = xattr_full_name(handler, name); + struct simple_xattr *old_xattr; + + old_xattr = xmfs_simple_xattr_set(&XMFS_I(inode)->xattrs, + full_name, value, size, + flags); + if (IS_ERR(old_xattr)) + err = PTR_ERR(old_xattr); + else + xmfs_simple_xattr_free(old_xattr); + } + + return err; +} + +static const struct xattr_handler xmfs_slave_security_xattr_handler = { + .prefix = XATTR_SECURITY_PREFIX, + .get = xmfs_xattr_slave_get, + .set = xmfs_xattr_set_slave, +}; + +static const struct xattr_handler xmfs_slave_trusted_xattr_handler = { + .prefix = XATTR_TRUSTED_PREFIX, + .get = xmfs_xattr_slave_get, + .set = xmfs_xattr_set_slave, +}; + +static const struct xattr_handler xmfs_slave_user_xattr_handler = { + .prefix = XATTR_USER_PREFIX, + .get = xmfs_xattr_slave_get, + .set = xmfs_xattr_set_slave, +}; + +const struct xattr_handler *xmfs_host_xattr_handlers[] = { + &xmfs_security_xattr_handler, + &xmfs_trusted_xattr_handler, + &xmfs_user_xattr_handler, + NULL +}; + +const struct xattr_handler *xmfs_slave_xattr_handlers[] = { + &xmfs_slave_security_xattr_handler, + &xmfs_slave_trusted_xattr_handler, + &xmfs_slave_user_xattr_handler, + NULL +}; diff --git a/fs/Kconfig b/fs/Kconfig index d80f39d6632f..9a6fd57368a6 100644 --- a/fs/Kconfig +++ b/fs/Kconfig @@ -139,6 +139,7 @@ source "fs/quota/Kconfig" source "fs/autofs/Kconfig" source "fs/fuse/Kconfig" source "fs/overlayfs/Kconfig" +source "fs/xmfs/Kconfig" menu "Caches" diff --git a/fs/Makefile b/fs/Makefile index 49a03a43d7db..c908f403d73e 100644 --- a/fs/Makefile +++ b/fs/Makefile @@ -111,6 +111,7 @@ obj-$(CONFIG_AUTOFS_FS) += autofs/ obj-$(CONFIG_ADFS_FS) += adfs/ obj-$(CONFIG_FUSE_FS) += fuse/ obj-$(CONFIG_OVERLAY_FS) += overlayfs/ +obj-$(CONFIG_XMFS_FS) += xmfs/ obj-$(CONFIG_ORANGEFS_FS) += orangefs/ obj-$(CONFIG_UDF_FS) += udf/ obj-$(CONFIG_SUN_OPENPROMFS) += openpromfs/ diff --git a/fs/xmfs/Kconfig b/fs/xmfs/Kconfig new file mode 100644 index 000000000000..2fb10c42b9c5 --- /dev/null +++ b/fs/xmfs/Kconfig @@ -0,0 +1,21 @@ +config XMFS_FS + tristate "XMFS (Log Structured Filesystem for UB) support" + help + XMFS is a high-performance log-structured filesystem specifically + designed for distributed storage environments. It leverages advanced + hardware and transport technologies such as UB, URMA, CXL, PMEM, + and HCCS to achieve ultra-low latency and high throughput. + + It provides robust crash consistency, efficient log management, and + optimized data placement strategies for modern storage architectures. + + If unsure, say N. + +config XMFS_FS_URMA + bool "XMFS URMA support" + depends on XMFS_FS && CONFIG_UB_URMA && CONFIG_UB_UBASE + help + Say Y here if you want to enable URMA (Unified Remote Memory Access) + transport support for XMFS, allowing high-speed network communication + and remote memory operations. + default n diff --git a/fs/xmfs/Makefile b/fs/xmfs/Makefile new file mode 100644 index 000000000000..09544186e5c4 --- /dev/null +++ b/fs/xmfs/Makefile @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: GPL-2.0-only +# +# Makefile for the linux xmfs-filesystem routines. +# + +obj-$(CONFIG_XMFS_FS) += xmfs.o +xmfs-y += super.o +xmfs-y += inode.o +xmfs-y += replay.o +xmfs-y += file.o +xmfs-y += dir.o +xmfs-y += namei.o +xmfs-y += symlink.o +xmfs-y += xattr.o +xmfs-y += urma.o +xmfs-y += gc.o -- 2.52.0

2 1

[PATCH OLK-6.6 v2 0/6] bonding: Fix CVE-2026-52975
by superdcc97＠163.com 11 Aug '26

11 Aug '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> Fix CVE-2026-52975 Eric Dumazet (2): bonding: 3ad: implement proper RCU rules for port->aggregator bonding: annotate data-races arcound churn variables Hangbin Liu (3): bonding: add support for per-port LACP actor priority bonding: print churn state via netlink bonding: fix NULL pointer dereference in actor_port_prio setting Tonghao Zhang (1): net: bonding: add broadcast_neighbor option for 802.3ad Documentation/networking/bonding.rst | 15 +++ drivers/net/bonding/bond_3ad.c | 131 ++++++++++++++----------- drivers/net/bonding/bond_main.c | 72 ++++++++++++-- drivers/net/bonding/bond_netlink.c | 37 ++++++- drivers/net/bonding/bond_options.c | 71 ++++++++++++++ drivers/net/bonding/bond_procfs.c | 11 ++- drivers/net/bonding/bond_sysfs_slave.c | 17 ++-- include/net/bond_3ad.h | 3 +- include/net/bond_options.h | 2 + include/net/bonding.h | 3 + include/uapi/linux/if_link.h | 3 + 11 files changed, 283 insertions(+), 82 deletions(-) -- 2.43.0

2 7

[PATCH OLK-6.6 0/7] backport minios part2 patches from linux mainline
by Qinxin Xia 11 Aug '26

11 Aug '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- backport minios part2 patches from linux mainline Marc Zyngier (1): arm64: sysreg: Add missing ID_AA64ISAR[13]_EL1 fields and variants Mark Brown (1): arm64/sysreg: Update ID_AA64ISAR3_EL1 to DDI0601 2024-09 Yeoreum Yun (5): arm64: cpufeature: Add FEAT_LSUI arm64: futex: Refactor futex atomic operation arm64: futex: Support futex with FEAT_LSUI arm64: armv8_deprecated: Disable swp emulation when FEAT_LSUI present arm64: Kconfig: Add support for LSUI arch/arm64/Kconfig | 20 ++ arch/arm64/include/asm/futex.h | 311 ++++++++++++++++++++++----- arch/arm64/include/asm/lsui.h | 27 +++ arch/arm64/kernel/armv8_deprecated.c | 14 ++ arch/arm64/kernel/cpufeature.c | 10 + arch/arm64/tools/cpucaps | 1 + arch/arm64/tools/sysreg | 24 ++- 7 files changed, 348 insertions(+), 59 deletions(-) create mode 100644 arch/arm64/include/asm/lsui.h -- 2.33.0

2 8

[PATCH OLK-6.6] netfilter: nf_tables: add hook transactions for device deletions
by Dong Chenchen 11 Aug '26

11 Aug '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.1-rc2 commit 10f79dbd7719d1da9f5884d13060322d8729f091 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16187 CVE: CVE-2026-63858 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Restore the flag that indicates that the hook is going away, ie. NFT_HOOK_REMOVE, but add a new transaction object to track deletion of hooks without altering the basechain/flowtable hook_list during the preparation phase. The existing approach that moves the hook from the basechain/flowtable hook_list to transaction hook_list breaks netlink dump path readers of this RCU-protected list. It should be possible use an array for nft_trans_hook to store the deleted hooks to compact the representation but I am not expecting many hook object, specially now that wildcard support for devices is in place. Note that the nft_trans_chain_hooks() list contains a list of struct nft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while this list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE. Note that new commands can be updated to use nft_trans_hook for consistency. This patch also adapts the event notification path to deal with the list of hook transactions. Fixes: 7d937b107108 ("netfilter: nf_tables: support for deleting devices in an existing netdev chain") Fixes: b6d9014a3335 ("netfilter: nf_tables: delete flowtable hooks via transaction list") Reported-by: Xiang Mei <xmei5(a)asu.edu> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: include/net/netfilter/nf_tables.h net/netfilter/nf_tables_api.c [-commit b7c2d793c28cd, 880ccec0d02e and 4039ce7ef404 that introduce nft_nla_put_hook_dev() are not backport. use nla_put_string to adapt. -commit 3567146b94af add net param and lockdep to nft_dump_basechain_hook. -commit a1050dd07168 add event check in nf_tables_fill_chain_info. Its no need to add redundant hook list check for nft_dump_basechain_hook. -commit 2932ba8d9c99 that introduce kmalloc_obj is not backport. we still use kmalloc for hook -73319a8ee18b9 introduce ops_list to nft_hook, which is not backport -91a089d0569d Pass nf_hook_ops to nft_unregister_flowtable_hook(), which is not backport. -e169285f8c56b that move net,seq from nft_ctx to trans is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_tables.h | 13 ++ net/netfilter/nf_tables_api.c | 252 +++++++++++++++++++++++------- 2 files changed, 209 insertions(+), 56 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index df8af10136da..6de207b6d6e6 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -1207,10 +1207,13 @@ struct nft_stats { struct u64_stats_sync syncp; }; +#define NFT_HOOK_REMOVE (1 << 0) + struct nft_hook { struct list_head list; struct nf_hook_ops ops; struct rcu_head rcu; + u8 flags; }; /** @@ -1645,6 +1648,16 @@ struct nft_trans { char data[]; }; +/** + * struct nft_trans_hook - nf_tables hook update in transaction + * @list: used internally + * @hook: struct nft_hook with the device hook + */ +struct nft_trans_hook { + struct list_head list; + struct nft_hook *hook; +}; + struct nft_trans_rule { struct nft_rule *rule; struct nft_flow_rule *flow; diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 3c98d088857a..696b053522f0 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -339,6 +339,30 @@ static void nft_netdev_hook_unlink_free_rcu(struct nft_hook *hook) nft_netdev_hook_free_rcu(hook); } +static void nft_trans_hook_destroy(struct nft_trans_hook *trans_hook) +{ + list_del(&trans_hook->list); + kfree(trans_hook); +} + +static void nft_netdev_unregister_trans_hook(struct net *net, + const struct nft_table *table, + struct list_head *hook_list) +{ + struct nft_trans_hook *trans_hook, *next; + struct nft_hook *hook; + + list_for_each_entry_safe(trans_hook, next, hook_list, list) { + hook = trans_hook->hook; + + if (!(table->flags & NFT_TABLE_F_DORMANT)) + nf_unregister_net_hook(net, &hook->ops); + + nft_netdev_hook_unlink_free_rcu(hook); + nft_trans_hook_destroy(trans_hook); + } +} + static void nft_netdev_unregister_hooks(struct net *net, struct list_head *hook_list, bool release_netdev) @@ -1791,14 +1815,66 @@ static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats) return -ENOSPC; } +struct nft_hook_dump_ctx { + struct nft_hook *first; + int n; +}; + +static int nft_dump_basechain_hook_one(struct sk_buff *skb, + struct nft_hook *hook, + struct nft_hook_dump_ctx *dump_ctx) +{ + if (!dump_ctx->first) + dump_ctx->first = hook; + + if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name)) + return -1; + + dump_ctx->n++; + + return 0; +} + +static int nft_dump_basechain_hook_list(struct sk_buff *skb, + const struct list_head *hook_list, + struct nft_hook_dump_ctx *dump_ctx) +{ + struct nft_hook *hook; + int err; + + list_for_each_entry_rcu(hook, hook_list, list) { + err = nft_dump_basechain_hook_one(skb, hook, dump_ctx); + if (err < 0) + return err; + } + + return 0; +} + +static int nft_dump_basechain_trans_hook_list(struct sk_buff *skb, + const struct list_head *trans_hook_list, + struct nft_hook_dump_ctx *dump_ctx) +{ + struct nft_trans_hook *trans_hook; + int err; + + list_for_each_entry(trans_hook, trans_hook_list, list) { + err = nft_dump_basechain_hook_one(skb, trans_hook->hook, dump_ctx); + if (err < 0) + return err; + } + + return 0; +} + static int nft_dump_basechain_hook(struct sk_buff *skb, int family, const struct nft_base_chain *basechain, - const struct list_head *hook_list) + const struct list_head *hook_list, + const struct list_head *trans_hook_list) { const struct nf_hook_ops *ops = &basechain->ops; - struct nft_hook *hook, *first = NULL; + struct nft_hook_dump_ctx dump_hook_ctx = {}; struct nlattr *nest, *nest_devs; - int n = 0; nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK); if (nest == NULL) @@ -1813,22 +1889,22 @@ static int nft_dump_basechain_hook(struct sk_buff *skb, int family, if (!nest_devs) goto nla_put_failure; - if (!hook_list) + if (!hook_list && !trans_hook_list) hook_list = &basechain->hook_list; - list_for_each_entry_rcu(hook, hook_list, list) { - if (!first) - first = hook; - - if (nla_put_string(skb, NFTA_DEVICE_NAME, - hook->ops.dev->name)) - goto nla_put_failure; - n++; + if (hook_list && + nft_dump_basechain_hook_list(skb, hook_list, &dump_hook_ctx)) { + goto nla_put_failure; + } else if (trans_hook_list && + nft_dump_basechain_trans_hook_list(skb, trans_hook_list, + &dump_hook_ctx)) { + goto nla_put_failure; } + nla_nest_end(skb, nest_devs); - if (n == 1 && - nla_put_string(skb, NFTA_HOOK_DEV, first->ops.dev->name)) + if (dump_hook_ctx.n == 1 && + nla_put_string(skb, NFTA_HOOK_DEV, dump_hook_ctx.first->ops.dev->name)) goto nla_put_failure; } nla_nest_end(skb, nest); @@ -1842,7 +1918,8 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, u32 portid, u32 seq, int event, u32 flags, int family, const struct nft_table *table, const struct nft_chain *chain, - const struct list_head *hook_list) + const struct list_head *hook_list, + const struct list_head *trans_hook_list) { struct nlmsghdr *nlh; @@ -1862,7 +1939,8 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, const struct nft_base_chain *basechain = nft_base_chain(chain); struct nft_stats __percpu *stats; - if (nft_dump_basechain_hook(skb, family, basechain, hook_list)) + if (nft_dump_basechain_hook(skb, family, basechain, + hook_list, trans_hook_list)) goto nla_put_failure; if (nla_put_be32(skb, NFTA_CHAIN_POLICY, @@ -1898,7 +1976,8 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, } static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event, - const struct list_head *hook_list) + const struct list_head *hook_list, + const struct list_head *trans_hook_list) { struct nftables_pernet *nft_net; struct sk_buff *skb; @@ -1918,7 +1997,7 @@ static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event, err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq, event, flags, ctx->family, ctx->table, - ctx->chain, hook_list); + ctx->chain, hook_list, trans_hook_list); if (err < 0) { kfree_skb(skb); goto err; @@ -1964,7 +2043,7 @@ static int nf_tables_dump_chains(struct sk_buff *skb, NFT_MSG_NEWCHAIN, NLM_F_MULTI, table->family, table, - chain, NULL) < 0) + chain, NULL, NULL) < 0) goto done; nl_dump_check_consistent(cb, nlmsg_hdr(skb)); @@ -2018,7 +2097,7 @@ static int nf_tables_getchain(struct sk_buff *skb, const struct nfnl_info *info, err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid, info->nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, - 0, family, table, chain, NULL); + 0, family, table, chain, NULL, NULL); if (err < 0) goto err_fill_chain_info; @@ -2168,8 +2247,12 @@ static struct nft_hook *nft_hook_list_find(struct list_head *hook_list, struct nft_hook *hook; list_for_each_entry(hook, hook_list, list) { - if (this->ops.dev == hook->ops.dev) + if (this->ops.dev == hook->ops.dev) { + if (hook->flags & NFT_HOOK_REMOVE) + continue; + return hook; + } } return NULL; @@ -2917,6 +3000,32 @@ static int nf_tables_newchain(struct sk_buff *skb, const struct nfnl_info *info, return nf_tables_addchain(&ctx, family, genmask, policy, flags, extack); } +static int nft_trans_delhook(struct nft_hook *hook, + struct list_head *del_list) +{ + struct nft_trans_hook *trans_hook; + + trans_hook = kmalloc(sizeof(*trans_hook), GFP_KERNEL); + if (!trans_hook) + return -ENOMEM; + + trans_hook->hook = hook; + list_add_tail(&trans_hook->list, del_list); + hook->flags |= NFT_HOOK_REMOVE; + + return 0; +} + +static void nft_trans_delhook_abort(struct list_head *del_list) +{ + struct nft_trans_hook *trans_hook, *next; + + list_for_each_entry_safe(trans_hook, next, del_list, list) { + trans_hook->hook->flags &= ~NFT_HOOK_REMOVE; + nft_trans_hook_destroy(trans_hook); + } +} + static int nft_delchain_hook(struct nft_ctx *ctx, struct nft_base_chain *basechain, struct netlink_ext_ack *extack) @@ -2943,7 +3052,10 @@ static int nft_delchain_hook(struct nft_ctx *ctx, err = -ENOENT; goto err_chain_del_hook; } - list_move(&hook->list, &chain_del_list); + if (nft_trans_delhook(hook, &chain_del_list) < 0) { + err = -ENOMEM; + goto err_chain_del_hook; + } } trans = nft_trans_alloc(ctx, NFT_MSG_DELCHAIN, @@ -2964,7 +3076,7 @@ static int nft_delchain_hook(struct nft_ctx *ctx, return 0; err_chain_del_hook: - list_splice(&chain_del_list, &basechain->hook_list); + nft_trans_delhook_abort(&chain_del_list); nft_chain_release_hook(&chain_hook); return err; @@ -8572,6 +8684,22 @@ static void nft_hooks_destroy(struct list_head *hook_list) nft_netdev_hook_unlink_free_rcu(hook); } +static void nft_flowtable_unregister_trans_hook(struct net *net, + struct nft_flowtable *flowtable, + struct list_head *hook_list) +{ + struct nft_trans_hook *trans_hook, *next; + struct nft_hook *hook; + + list_for_each_entry_safe(trans_hook, next, hook_list, list) { + hook = trans_hook->hook; + + nft_unregister_flowtable_hook(net, flowtable, hook); + nft_netdev_hook_unlink_free_rcu(hook); + nft_trans_hook_destroy(trans_hook); + } +} + static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, struct nft_flowtable *flowtable, struct netlink_ext_ack *extack) @@ -8826,7 +8954,10 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx, err = -ENOENT; goto err_flowtable_del_hook; } - list_move(&hook->list, &flowtable_del_list); + if (nft_trans_delhook(hook, &flowtable_del_list) < 0) { + err = -ENOMEM; + goto err_flowtable_del_hook; + } } trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE, @@ -8847,7 +8978,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx, return 0; err_flowtable_del_hook: - list_splice(&flowtable_del_list, &flowtable->hook_list); + nft_trans_delhook_abort(&flowtable_del_list); nft_flowtable_hook_release(&flowtable_hook); return err; @@ -8912,8 +9043,10 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, u32 portid, u32 seq, int event, u32 flags, int family, struct nft_flowtable *flowtable, - struct list_head *hook_list) + struct list_head *hook_list, + struct list_head *trans_hook_list) { + struct nft_trans_hook *trans_hook; struct nlattr *nest, *nest_devs; struct nft_hook *hook; struct nlmsghdr *nlh; @@ -8945,12 +9078,21 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, if (!nest_devs) goto nla_put_failure; - if (!hook_list) + if (!hook_list && !trans_hook_list) hook_list = &flowtable->hook_list; - list_for_each_entry_rcu(hook, hook_list, list) { - if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name)) - goto nla_put_failure; + if (hook_list) { + list_for_each_entry_rcu(hook, hook_list, list) { + if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name)) + goto nla_put_failure; + } + } else if (trans_hook_list) { + list_for_each_entry(trans_hook, trans_hook_list, list) { + if (nla_put_string(skb, NFTA_DEVICE_NAME, + trans_hook->hook->ops.dev->name)) + goto nla_put_failure; + } + } nla_nest_end(skb, nest_devs); nla_nest_end(skb, nest); @@ -9004,7 +9146,7 @@ static int nf_tables_dump_flowtable(struct sk_buff *skb, NFT_MSG_NEWFLOWTABLE, NLM_F_MULTI | NLM_F_APPEND, table->family, - flowtable, NULL) < 0) + flowtable, NULL, NULL) < 0) goto done; nl_dump_check_consistent(cb, nlmsg_hdr(skb)); @@ -9099,7 +9241,7 @@ static int nf_tables_getflowtable(struct sk_buff *skb, err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid, info->nlh->nlmsg_seq, NFT_MSG_NEWFLOWTABLE, 0, family, - flowtable, NULL); + flowtable, NULL, NULL); if (err < 0) goto err_fill_flowtable_info; @@ -9112,7 +9254,9 @@ static int nf_tables_getflowtable(struct sk_buff *skb, static void nf_tables_flowtable_notify(struct nft_ctx *ctx, struct nft_flowtable *flowtable, - struct list_head *hook_list, int event) + struct list_head *hook_list, + struct list_head *trans_hook_list, + int event) { struct nftables_pernet *nft_net = nft_pernet(ctx->net); struct sk_buff *skb; @@ -9132,7 +9276,8 @@ static void nf_tables_flowtable_notify(struct nft_ctx *ctx, err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid, ctx->seq, event, flags, - ctx->family, flowtable, hook_list); + ctx->family, flowtable, + hook_list, trans_hook_list); if (err < 0) { kfree_skb(skb); goto err; @@ -9573,9 +9718,7 @@ static void nft_commit_release(struct nft_trans *trans) break; case NFT_MSG_DELCHAIN: case NFT_MSG_DESTROYCHAIN: - if (nft_trans_chain_update(trans)) - nft_hooks_destroy(&nft_trans_chain_hooks(trans)); - else + if (!nft_trans_chain_update(trans)) nf_tables_chain_destroy(nft_trans_chain(trans)); break; case NFT_MSG_DELRULE: @@ -9598,9 +9741,7 @@ static void nft_commit_release(struct nft_trans *trans) break; case NFT_MSG_DELFLOWTABLE: case NFT_MSG_DESTROYFLOWTABLE: - if (nft_trans_flowtable_update(trans)) - nft_hooks_destroy(&nft_trans_flowtable_hooks(trans)); - else + if (!nft_trans_flowtable_update(trans)) nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); break; } @@ -10349,31 +10490,28 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) if (nft_trans_chain_update(trans)) { nft_chain_commit_update(trans); nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN, - &nft_trans_chain_hooks(trans)); + &nft_trans_chain_hooks(trans), NULL); list_splice_rcu(&nft_trans_chain_hooks(trans), &nft_trans_basechain(trans)->hook_list); /* trans destroyed after rcu grace period */ } else { nft_chain_commit_drop_policy(trans); nft_clear(net, trans->ctx.chain); - nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN, NULL); + nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN, NULL, NULL); nft_trans_destroy(trans); } break; case NFT_MSG_DELCHAIN: case NFT_MSG_DESTROYCHAIN: if (nft_trans_chain_update(trans)) { - nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, + nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, NULL, &nft_trans_chain_hooks(trans)); - if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT)) { - nft_netdev_unregister_hooks(net, - &nft_trans_chain_hooks(trans), - true); - } + nft_netdev_unregister_trans_hook(net, trans->ctx.table, + &nft_trans_chain_hooks(trans)); } else { nft_chain_del(trans->ctx.chain); nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN, - NULL); + NULL, NULL); nf_tables_unregister_hook(trans->ctx.net, trans->ctx.table, trans->ctx.chain); @@ -10490,6 +10628,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) nf_tables_flowtable_notify(&trans->ctx, nft_trans_flowtable(trans), &nft_trans_flowtable_hooks(trans), + NULL, NFT_MSG_NEWFLOWTABLE); list_splice_rcu(&nft_trans_flowtable_hooks(trans), &nft_trans_flowtable(trans)->hook_list); @@ -10498,6 +10637,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) nf_tables_flowtable_notify(&trans->ctx, nft_trans_flowtable(trans), NULL, + NULL, NFT_MSG_NEWFLOWTABLE); } nft_trans_destroy(trans); @@ -10507,16 +10647,18 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) if (nft_trans_flowtable_update(trans)) { nf_tables_flowtable_notify(&trans->ctx, nft_trans_flowtable(trans), + NULL, &nft_trans_flowtable_hooks(trans), trans->msg_type); - nft_unregister_flowtable_net_hooks(net, - nft_trans_flowtable(trans), - &nft_trans_flowtable_hooks(trans)); + nft_flowtable_unregister_trans_hook(net, + nft_trans_flowtable(trans), + &nft_trans_flowtable_hooks(trans)); } else { list_del_rcu(&nft_trans_flowtable(trans)->list); nf_tables_flowtable_notify(&trans->ctx, nft_trans_flowtable(trans), NULL, + NULL, trans->msg_type); nft_unregister_flowtable_net_hooks(net, nft_trans_flowtable(trans), @@ -10667,8 +10809,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) case NFT_MSG_DELCHAIN: case NFT_MSG_DESTROYCHAIN: if (nft_trans_chain_update(trans)) { - list_splice(&nft_trans_chain_hooks(trans), - &nft_trans_basechain(trans)->hook_list); + nft_trans_delhook_abort(&nft_trans_chain_hooks(trans)); } else { nft_use_inc_restore(&trans->ctx.table->use); nft_clear(trans->ctx.net, trans->ctx.chain); @@ -10785,8 +10926,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) case NFT_MSG_DELFLOWTABLE: case NFT_MSG_DESTROYFLOWTABLE: if (nft_trans_flowtable_update(trans)) { - list_splice(&nft_trans_flowtable_hooks(trans), - &nft_trans_flowtable(trans)->hook_list); + nft_trans_delhook_abort(&nft_trans_flowtable_hooks(trans)); } else { nft_use_inc_restore(&trans->ctx.table->use); nft_clear(trans->ctx.net, nft_trans_flowtable(trans)); -- 2.25.1

2 1

[PATCH OLK-6.6 0/4] netfilter: Fix CVE-2026-64078
by Dong Chenchen 11 Aug '26

11 Aug '26

Fix CVE-2026-64078 Florian Westphal (4): netfilter: x_tables: allow initial table replace without emitting audit log message netfilter: x_tables: allocate hook ops while under mutex netfilter: x_tables: add and use xt_unregister_table_pre_exit netfilter: x_tables: add and use xtables_unregister_table_exit include/linux/netfilter/x_tables.h | 4 +- include/linux/netfilter_arp/arp_tables.h | 1 - include/linux/netfilter_ipv4/ip_tables.h | 1 - include/linux/netfilter_ipv6/ip6_tables.h | 1 - net/ipv4/netfilter/arp_tables.c | 53 +------ net/ipv4/netfilter/arptable_filter.c | 2 +- net/ipv4/netfilter/ip_tables.c | 59 +------- net/ipv4/netfilter/iptable_filter.c | 2 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/iptable_nat.c | 6 +- net/ipv4/netfilter/iptable_raw.c | 2 +- net/ipv4/netfilter/iptable_security.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 56 +------ net/ipv6/netfilter/ip6table_filter.c | 2 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/netfilter/ip6table_nat.c | 6 +- net/ipv6/netfilter/ip6table_raw.c | 2 +- net/ipv6/netfilter/ip6table_security.c | 2 +- net/netfilter/x_tables.c | 177 ++++++++++++++++++---- 19 files changed, 193 insertions(+), 189 deletions(-) -- 2.25.1

2 5

[PATCH OLK-6.6] x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
by Zeng Heng 11 Aug '26

11 Aug '26

From: Reinette Chatre <reinette.chatre(a)intel.com> mainline inclusion from mainline-v7.2-rc2 commit fc16126cc11d9f507130bf84ab137ee0938c900e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16766 CVE: CVE-2026-64477 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The architecture updates the cpu_mask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty the architecture initiates offline of the domain that includes calling on resctrl fs to offline the domain. If it is a monitoring domain in which LLC occupancy is tracked resctrl fs forces the limbo handler to clear all busy RMID state associated with the domain. The limbo handler always reads the current event value associated with a busy RMID irrespective of it being checked as part of regular "is it still busy" check or whether it will be forced released anyway. When reading an RMID on a system with SNC enabled the "logical RMID" is converted to the "physical RMID" and this conversion requires the NUMA node ID of the resctrl monitoring domain that is in turn determined by querying the NUMA node ID of any CPU belonging to the monitoring domain. When the monitoring domain is going offline its cpu_mask is empty causing the NUMA node ID query via cpu_to_node() to be done with "nr_cpu_ids" as argument resulting in an out-of-bounds access. Refactor the limbo handler to skip reading the RMID when the RMID will just be forced to no longer be dirty in the domain anyway. Add a safety check to the architecture's RMID reader to protect against this scenario. Fixes: e13db55b5a0d ("x86/resctrl: Introduce snc_nodes_per_l3_cache") Closes: https://sashiko.dev/#/patchset/cover.1780456704.git.reinette.chatre%40intel… Reported-by: Sashiko <sashiko-bot(a)kernel.org> Signed-off-by: Reinette Chatre <reinette.chatre(a)intel.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Cc: <stable(a)kernel.org> Link: https://patch.msgid.link/16137433df42f85013b2f7a53626795cbd6637b9.178102912… Conflicts: fs/resctrl/monitor.c fs/resctrl_x86/monitor.c [Redirect file paths without conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/x86/kernel/cpu/resctrl/monitor.c | 5 ++++ fs/resctrl_x86/monitor.c | 39 +++++++++++++++------------ 2 files changed, 27 insertions(+), 17 deletions(-) diff --git a/arch/x86/kernel/cpu/resctrl/monitor.c b/arch/x86/kernel/cpu/resctrl/monitor.c index 53d6f642f486..6ad14c9b39a5 100644 --- a/arch/x86/kernel/cpu/resctrl/monitor.c +++ b/arch/x86/kernel/cpu/resctrl/monitor.c @@ -257,6 +257,11 @@ int resctrl_arch_rmid_read(struct rdt_resource *r, struct rdt_domain_hdr *hdr, if (!domain_header_is_valid(hdr, RESCTRL_MON_DOMAIN, RDT_RESOURCE_L3)) return -EINVAL; + if (cpumask_empty(&hdr->cpu_mask)) { + pr_warn_once("Domain %d has no CPUs\n", hdr->id); + return -EINVAL; + } + d = container_of(hdr, struct rdt_l3_mon_domain, hdr); hw_dom = resctrl_to_arch_mon_dom(d); cpu = cpumask_any(&hdr->cpu_mask); diff --git a/fs/resctrl_x86/monitor.c b/fs/resctrl_x86/monitor.c index 0cd5476a483a..0b52db0d0f19 100644 --- a/fs/resctrl_x86/monitor.c +++ b/fs/resctrl_x86/monitor.c @@ -135,10 +135,10 @@ void __check_limbo(struct rdt_l3_mon_domain *d, bool force_free) struct rdt_resource *r = resctrl_arch_get_resource(RDT_RESOURCE_L3); u32 idx_limit = resctrl_arch_system_num_rmid_idx(); struct rmid_entry *entry; + bool rmid_dirty = true; u32 idx, cur_idx = 1; void *arch_mon_ctx; void *arch_priv; - bool rmid_dirty; u64 val = 0; arch_priv = mon_event_all[QOS_L3_OCCUP_EVENT_ID].arch_priv; @@ -161,22 +161,27 @@ void __check_limbo(struct rdt_l3_mon_domain *d, bool force_free) break; entry = __rmid_entry(idx); - if (resctrl_arch_rmid_read(r, &d->hdr, entry->closid, entry->rmid, - QOS_L3_OCCUP_EVENT_ID, arch_priv, &val, - arch_mon_ctx)) { - rmid_dirty = true; - } else { - rmid_dirty = (val >= resctrl_rmid_realloc_threshold); - - /* - * x86's CLOSID and RMID are independent numbers, so the entry's - * CLOSID is an empty CLOSID (X86_RESCTRL_EMPTY_CLOSID). On Arm the - * RMID (PMG) extends the CLOSID (PARTID) space with bits that aren't - * used to select the configuration. It is thus necessary to track both - * CLOSID and RMID because there may be dependencies between them - * on some architectures. - */ - trace_mon_llc_occupancy_limbo(entry->closid, entry->rmid, d->hdr.id, val); + if (!force_free) { + if (resctrl_arch_rmid_read(r, &d->hdr, entry->closid, + entry->rmid, QOS_L3_OCCUP_EVENT_ID, + arch_priv, &val, arch_mon_ctx)) { + rmid_dirty = true; + } else { + rmid_dirty = (val >= resctrl_rmid_realloc_threshold); + + /* + * x86's CLOSID and RMID are independent numbers, + * so the entry's CLOSID is an empty CLOSID + * (X86_RESCTRL_EMPTY_CLOSID). On Arm the RMID + * (PMG) extends the CLOSID (PARTID) space with + * bits that aren't used to select the configuration. + * It is thus necessary to track both CLOSID and + * RMID because there may be dependencies between + * them on some architectures. + */ + trace_mon_llc_occupancy_limbo(entry->closid, entry->rmid, + d->hdr.id, val); + } } if (force_free || !rmid_dirty) { -- 2.43.0

2 1

[PATCH] erofs: fix stack-out-of-bounds in erofs_put_metabuf
by Liu Mingrui 10 Aug '26

10 Aug '26

From: Mingrui Liu <liumingrui(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16872 -------------------------------- Commit 1d4b040dd8ee moved erofs_put_metabuf() to out_unlock, but some error paths jump there before buf is initialized, unlike mainline where buf is always set. This triggers : BUG: KASAN: stack-out-of-bounds in erofs_put_metabuf+0x54/0x158 [erofs] Call Trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x78/0xc8 print_address_description.constprop.0+0x84/0x3c8 print_report+0xb0/0x280 kasan_report+0x84/0xd0 __asan_load8+0x9c/0xc0 erofs_put_metabuf+0x54/0x158 [erofs] erofs_init_inode_xattrs+0x194/0x560 [erofs] erofs_getxattr+0xc8/0x238 [erofs] erofs_get_acl+0x6c/0x150 [erofs] __get_acl.part.0+0x218/0x390 vfs_get_acl+0xd0/0x150 do_get_acl+0x38/0x2a0 do_getxattr+0x9c/0x250 getxattr+0xe0/0x148 path_getxattr+0xdc/0x150 __arm64_sys_getxattr+0x60/0x80 invoke_syscall+0x64/0x178 el0_svc_common.constprop.0+0x11c/0x150 do_el0_svc+0x38/0x50 el0_svc+0x44/0x228 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0 Fix by zero-initializing buf at declaration so erofs_put_metabuf() can safely handle it. Fixes: 6a89c63750cb ("erofs: fix metabuf leak in inode xattr initialization") Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- fs/erofs/xattr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c index b270226be379..abd23e990a3a 100644 --- a/fs/erofs/xattr.c +++ b/fs/erofs/xattr.c @@ -34,6 +34,8 @@ static int erofs_init_inode_xattrs(struct inode *inode) struct super_block *sb = inode->i_sb; int ret = 0; + it.buf = __EROFS_BUF_INITIALIZER; + /* the most case is that xattrs of this inode are initialized. */ if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags)) { /* @@ -76,7 +78,6 @@ static int erofs_init_inode_xattrs(struct inode *inode) goto out_unlock; } - it.buf = __EROFS_BUF_INITIALIZER; erofs_init_metabuf(&it.buf, sb); it.pos = erofs_iloc(inode) + vi->inode_isize; -- 2.34.1

1 0

[PATCH OLK-6.6 0/6] bonding: Fix CVE-2026-52975
by superdcc97＠163.com 10 Aug '26

10 Aug '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> Fix CVE-2026-52975 Eric Dumazet (2): bonding: 3ad: implement proper RCU rules for port->aggregator bonding: annotate data-races arcound churn variables Hangbin Liu (3): bonding: add support for per-port LACP actor priority bonding: print churn state via netlink bonding: fix NULL pointer dereference in actor_port_prio setting Tonghao Zhang (1): net: bonding: add broadcast_neighbor option for 802.3ad Documentation/networking/bonding.rst | 15 +++ drivers/net/bonding/bond_3ad.c | 131 ++++++++++++++----------- drivers/net/bonding/bond_main.c | 67 +++++++++++-- drivers/net/bonding/bond_netlink.c | 37 ++++++- drivers/net/bonding/bond_options.c | 71 ++++++++++++++ drivers/net/bonding/bond_procfs.c | 11 ++- drivers/net/bonding/bond_sysfs_slave.c | 17 ++-- include/net/bond_3ad.h | 3 +- include/net/bond_options.h | 2 + include/net/bonding.h | 3 + include/uapi/linux/if_link.h | 3 + 11 files changed, 280 insertions(+), 80 deletions(-) -- 2.43.0

2 7

[PATCH OLK-6.6 0/8] net Fix CVE-2026-45905
by superdcc97＠163.com 10 Aug '26

10 Aug '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> fix CVE-2026-45905 Dong Chenchen (1): net: Use __GENKSYMS__ to fix kabi breakage of icmp Guillaume Nault (2): ipv4: Convert icmp_route_lookup() to dscp_t. ipv4: Convert ip_route_input() to dscp_t. Ido Schimmel (2): ipv4: icmp: Pass full DS field to ip_route_input() ipv4: icmp: Unmask upper DSCP bits in icmp_route_lookup() Jiayuan Chen (1): xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path Peilin He (1): net/ipv4: add tracepoint for icmp_send Stanislav Fomichev (1): net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers include/net/ip.h | 5 +++ include/net/route.h | 5 ++- include/trace/events/icmp.h | 67 +++++++++++++++++++++++++++++++++ net/bridge/br_netfilter_hooks.c | 8 ++-- net/ipv4/icmp.c | 50 +++++++++++++++++------- net/ipv4/ip_options.c | 8 ++-- net/ipv6/ip6_tunnel.c | 4 +- 7 files changed, 123 insertions(+), 24 deletions(-) create mode 100644 include/trace/events/icmp.h -- 2.43.0

2 9

[PATCH OLK-6.6 0/2] net: core: synchronize link-watch when carrier is queried
by superdcc97＠163.com 10 Aug '26

10 Aug '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> synchronize link-watch when carrier is queried Johannes Berg (2): net: core: synchronize link-watch when carrier is queried net: sysfs: fix locking in carrier read include/linux/netdevice.h | 9 +++++++++ net/core/dev.c | 2 +- net/core/dev.h | 1 - net/core/link_watch.c | 2 +- net/core/net-sysfs.c | 17 ++++++++++++++--- net/core/rtnetlink.c | 8 ++++++++ net/ethtool/ioctl.c | 3 +++ 7 files changed, 36 insertions(+), 6 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] net: core: synchronize link-watch when carrier is queried
by superdcc97＠163.com 10 Aug '26

10 Aug '26

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.7-rc3 commit facd15dfd69122042502d99ab8c9f888b48ee994 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9743 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There are multiple ways to query for the carrier state: through rtnetlink, sysfs, and (possibly) ethtool. Synchronize linkwatch work before these operations so that we don't have a situation where userspace queries the carrier state between the driver's carrier off->on transition and linkwatch running and expects it to work, when really (at least) TX cannot work until linkwatch has run. I previously posted a longer explanation of how this applies to wireless [1] but with this wireless can simply query the state before sending data, to ensure the kernel is ready for it. [1] https://lore.kernel.org/all/346b21d87c69f817ea3c37caceb34f1f56255884.camel@… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Link: https://lore.kernel.org/r/20231204214706.303c62768415.I1caedccae72ee5a45c90… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/linux/netdevice.h | 9 +++++++++ net/core/dev.c | 2 +- net/core/dev.h | 1 - net/core/link_watch.c | 2 +- net/core/net-sysfs.c | 8 +++++++- net/core/rtnetlink.c | 8 ++++++++ net/ethtool/ioctl.c | 3 +++ 7 files changed, 29 insertions(+), 4 deletions(-) diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 2bdce0b48965..2cda65c6006f 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -4245,18 +4245,27 @@ static inline void netdev_ref_replace(struct net_device *odev, * and _off may be called from IRQ context, but it is caller * who is responsible for serialization of these calls. * * The name carrier is inappropriate, these functions should really be * called netif_lowerlayer_*() because they represent the state of any * kind of lower layer not just hardware media. */ void linkwatch_fire_event(struct net_device *dev); +/** + * linkwatch_sync_dev - sync linkwatch for the given device + * @dev: network device to sync linkwatch for + * + * Sync linkwatch for the given device, removing it from the + * pending work list (if queued). + */ +void linkwatch_sync_dev(struct net_device *dev); + /** * netif_carrier_ok - test if carrier present * @dev: network device * * Check if carrier is present on device */ static inline bool netif_carrier_ok(const struct net_device *dev) { return !test_bit(__LINK_STATE_NOCARRIER, &dev->state); diff --git a/net/core/dev.c b/net/core/dev.c index a54d8761b86f..d21b3bf2700b 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -10751,19 +10751,19 @@ void netdev_run_todo(void) if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) { netdev_WARN(dev, "run_todo but not unregistering\n"); list_del(&dev->todo_list); continue; } write_lock(&dev_base_lock); dev->reg_state = NETREG_UNREGISTERED; write_unlock(&dev_base_lock); - linkwatch_forget_dev(dev); + linkwatch_sync_dev(dev); } while (!list_empty(&list)) { dev = netdev_wait_allrefs_any(&list); list_del(&dev->todo_list); /* paranoia */ BUG_ON(netdev_refcnt_read(dev) != 1); BUG_ON(!list_empty(&dev->ptype_all)); diff --git a/net/core/dev.h b/net/core/dev.h index f2037d402144..8cb96532a7c7 100644 --- a/net/core/dev.h +++ b/net/core/dev.h @@ -24,19 +24,18 @@ struct sd_flow_limit { extern int netdev_flow_limit_table_len; #ifdef CONFIG_PROC_FS int __init dev_proc_init(void); #else #define dev_proc_init() 0 #endif void linkwatch_init_dev(struct net_device *dev); -void linkwatch_forget_dev(struct net_device *dev); void linkwatch_run_queue(void); void dev_addr_flush(struct net_device *dev); int dev_addr_init(struct net_device *dev); void dev_addr_check(struct net_device *dev); /* sysctls not referred to from outside net/core/ */ extern int netdev_budget; extern unsigned int netdev_budget_usecs; diff --git a/net/core/link_watch.c b/net/core/link_watch.c index e2e8a341318b..423f8583ebdd 100644 --- a/net/core/link_watch.c +++ b/net/core/link_watch.c @@ -248,19 +248,19 @@ static void __linkwatch_run_queue(int urgent_only) /* Add the remaining work back to lweventlist */ list_splice_init(&wrk, &lweventlist); if (!list_empty(&lweventlist)) linkwatch_schedule_work(0); spin_unlock_irq(&lweventlist_lock); } -void linkwatch_forget_dev(struct net_device *dev) +void linkwatch_sync_dev(struct net_device *dev) { unsigned long flags; int clean = 0; spin_lock_irqsave(&lweventlist_lock, flags); if (!list_empty(&dev->link_watch_list)) { list_del_init(&dev->link_watch_list); clean = 1; /* We must release netdev tracker under diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index f7404bc67974..97582c1d01c2 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -188,20 +188,26 @@ static ssize_t carrier_store(struct device *dev, struct device_attribute *attr, return netdev_store(dev, attr, buf, len, change_carrier); } static ssize_t carrier_show(struct device *dev, struct device_attribute *attr, char *buf) { struct net_device *netdev = to_net_dev(dev); - if (netif_running(netdev)) + if (netif_running(netdev)) { + /* Synchronize carrier state with link watch, + * see also rtnl_getlink(). + */ + linkwatch_sync_dev(netdev); + return sysfs_emit(buf, fmt_dec, !!netif_carrier_ok(netdev)); + } return -EINVAL; } static DEVICE_ATTR_RW(carrier); static ssize_t speed_show(struct device *dev, struct device_attribute *attr, char *buf) { struct net_device *netdev = to_net_dev(dev); diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index dc82b95bb245..2296b3052732 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -3863,18 +3863,26 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr *nlh, err = -ENODEV; if (dev == NULL) goto out; err = -ENOBUFS; nskb = nlmsg_new(if_nlmsg_size(dev, ext_filter_mask), GFP_KERNEL); if (nskb == NULL) goto out; + /* Synchronize the carrier state so we don't report a state + * that we're not actually going to honour immediately; if + * the driver just did a carrier off->on transition, we can + * only TX if link watch work has run, but without this we'd + * already report carrier on, even if it doesn't work yet. + */ + linkwatch_sync_dev(dev); + err = rtnl_fill_ifinfo(nskb, dev, net, RTM_NEWLINK, NETLINK_CB(skb).portid, nlh->nlmsg_seq, 0, 0, ext_filter_mask, 0, NULL, 0, netnsid, GFP_KERNEL); if (err < 0) { /* -EMSGSIZE implies BUG in if_nlmsg_size */ WARN_ON(err == -EMSGSIZE); kfree_skb(nskb); } else diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 6258b4f1bc0d..22be4dd167bb 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -52,18 +52,21 @@ static struct devlink *netdev_to_devlink_get(struct net_device *dev) /* * Some useful ethtool_ops methods that're device independent. * If we find that all drivers want to do the same thing here, * we can turn these into dev_() function calls. */ u32 ethtool_op_get_link(struct net_device *dev) { + /* Synchronize carrier state with link watch, see also rtnl_getlink() */ + linkwatch_sync_dev(dev); + return netif_carrier_ok(dev) ? 1 : 0; } EXPORT_SYMBOL(ethtool_op_get_link); int ethtool_op_get_ts_info(struct net_device *dev, struct ethtool_ts_info *info) { info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE | SOF_TIMESTAMPING_RX_SOFTWARE | -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] drm/edid: fix OOB read in drm_parse_tiled_block()
by Hongtao Zhang 10 Aug '26

10 Aug '26

From: Xiang Mei <xmei5(a)asu.edu> stable inclusion from stable-v5.10.261 commit c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit faaa1e1155833e7d4ce7e3cfaf64c0d636b190db ] drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) Fixes: 40d9b043a89e ("drm/connector: store tile information from displayid (v3)") Reported-by: Weiming Shi <bestswngs(a)gmail.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5(a)asu.edu> Reviewed-by: Jani Nikula <jani.nikula(a)intel.com> Link: https://patch.msgid.link/20260615184737.899892-1-xmei5@asu.edu Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_edid.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index f5926bf5dabd9..ad7e524d03037 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -5198,6 +5198,13 @@ static int drm_parse_tiled_block(struct drm_connector *connector, u8 num_v_tile, num_h_tile; struct drm_tile_group *tg; + /* tiled block payload per spec: cap 1 + topo 3 + size 4 + bezel 5 + id 9 = 22 */ + if (block->num_bytes < 22) { + DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Unexpected tiled block size %u\n", + connector->base.id, connector->name, block->num_bytes); + return 0; + } + w = tile->tile_size[0] | tile->tile_size[1] << 8; h = tile->tile_size[2] | tile->tile_size[3] << 8; -- 2.43.0

2 1

[PATCH OLK-6.6] net: core: synchronize link-watch when carrier is queried
by superdcc97＠163.com 10 Aug '26

10 Aug '26

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.7-rc3 commit facd15dfd69122042502d99ab8c9f888b48ee994 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9730 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There are multiple ways to query for the carrier state: through rtnetlink, sysfs, and (possibly) ethtool. Synchronize linkwatch work before these operations so that we don't have a situation where userspace queries the carrier state between the driver's carrier off->on transition and linkwatch running and expects it to work, when really (at least) TX cannot work until linkwatch has run. I previously posted a longer explanation of how this applies to wireless [1] but with this wireless can simply query the state before sending data, to ensure the kernel is ready for it. [1] https://lore.kernel.org/all/346b21d87c69f817ea3c37caceb34f1f56255884.camel@… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Link: https://lore.kernel.org/r/20231204214706.303c62768415.I1caedccae72ee5a45c90… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/linux/netdevice.h | 9 +++++++++ net/core/dev.c | 2 +- net/core/dev.h | 1 - net/core/link_watch.c | 2 +- net/core/net-sysfs.c | 8 +++++++- net/core/rtnetlink.c | 8 ++++++++ net/ethtool/ioctl.c | 3 +++ 7 files changed, 29 insertions(+), 4 deletions(-) diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 2bdce0b48965..2cda65c6006f 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -4245,18 +4245,27 @@ static inline void netdev_ref_replace(struct net_device *odev, * and _off may be called from IRQ context, but it is caller * who is responsible for serialization of these calls. * * The name carrier is inappropriate, these functions should really be * called netif_lowerlayer_*() because they represent the state of any * kind of lower layer not just hardware media. */ void linkwatch_fire_event(struct net_device *dev); +/** + * linkwatch_sync_dev - sync linkwatch for the given device + * @dev: network device to sync linkwatch for + * + * Sync linkwatch for the given device, removing it from the + * pending work list (if queued). + */ +void linkwatch_sync_dev(struct net_device *dev); + /** * netif_carrier_ok - test if carrier present * @dev: network device * * Check if carrier is present on device */ static inline bool netif_carrier_ok(const struct net_device *dev) { return !test_bit(__LINK_STATE_NOCARRIER, &dev->state); diff --git a/net/core/dev.c b/net/core/dev.c index a54d8761b86f..d21b3bf2700b 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -10751,19 +10751,19 @@ void netdev_run_todo(void) if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) { netdev_WARN(dev, "run_todo but not unregistering\n"); list_del(&dev->todo_list); continue; } write_lock(&dev_base_lock); dev->reg_state = NETREG_UNREGISTERED; write_unlock(&dev_base_lock); - linkwatch_forget_dev(dev); + linkwatch_sync_dev(dev); } while (!list_empty(&list)) { dev = netdev_wait_allrefs_any(&list); list_del(&dev->todo_list); /* paranoia */ BUG_ON(netdev_refcnt_read(dev) != 1); BUG_ON(!list_empty(&dev->ptype_all)); diff --git a/net/core/dev.h b/net/core/dev.h index f2037d402144..8cb96532a7c7 100644 --- a/net/core/dev.h +++ b/net/core/dev.h @@ -24,19 +24,18 @@ struct sd_flow_limit { extern int netdev_flow_limit_table_len; #ifdef CONFIG_PROC_FS int __init dev_proc_init(void); #else #define dev_proc_init() 0 #endif void linkwatch_init_dev(struct net_device *dev); -void linkwatch_forget_dev(struct net_device *dev); void linkwatch_run_queue(void); void dev_addr_flush(struct net_device *dev); int dev_addr_init(struct net_device *dev); void dev_addr_check(struct net_device *dev); /* sysctls not referred to from outside net/core/ */ extern int netdev_budget; extern unsigned int netdev_budget_usecs; diff --git a/net/core/link_watch.c b/net/core/link_watch.c index e2e8a341318b..423f8583ebdd 100644 --- a/net/core/link_watch.c +++ b/net/core/link_watch.c @@ -248,19 +248,19 @@ static void __linkwatch_run_queue(int urgent_only) /* Add the remaining work back to lweventlist */ list_splice_init(&wrk, &lweventlist); if (!list_empty(&lweventlist)) linkwatch_schedule_work(0); spin_unlock_irq(&lweventlist_lock); } -void linkwatch_forget_dev(struct net_device *dev) +void linkwatch_sync_dev(struct net_device *dev) { unsigned long flags; int clean = 0; spin_lock_irqsave(&lweventlist_lock, flags); if (!list_empty(&dev->link_watch_list)) { list_del_init(&dev->link_watch_list); clean = 1; /* We must release netdev tracker under diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index f7404bc67974..97582c1d01c2 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -188,20 +188,26 @@ static ssize_t carrier_store(struct device *dev, struct device_attribute *attr, return netdev_store(dev, attr, buf, len, change_carrier); } static ssize_t carrier_show(struct device *dev, struct device_attribute *attr, char *buf) { struct net_device *netdev = to_net_dev(dev); - if (netif_running(netdev)) + if (netif_running(netdev)) { + /* Synchronize carrier state with link watch, + * see also rtnl_getlink(). + */ + linkwatch_sync_dev(netdev); + return sysfs_emit(buf, fmt_dec, !!netif_carrier_ok(netdev)); + } return -EINVAL; } static DEVICE_ATTR_RW(carrier); static ssize_t speed_show(struct device *dev, struct device_attribute *attr, char *buf) { struct net_device *netdev = to_net_dev(dev); diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index dc82b95bb245..2296b3052732 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -3863,18 +3863,26 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr *nlh, err = -ENODEV; if (dev == NULL) goto out; err = -ENOBUFS; nskb = nlmsg_new(if_nlmsg_size(dev, ext_filter_mask), GFP_KERNEL); if (nskb == NULL) goto out; + /* Synchronize the carrier state so we don't report a state + * that we're not actually going to honour immediately; if + * the driver just did a carrier off->on transition, we can + * only TX if link watch work has run, but without this we'd + * already report carrier on, even if it doesn't work yet. + */ + linkwatch_sync_dev(dev); + err = rtnl_fill_ifinfo(nskb, dev, net, RTM_NEWLINK, NETLINK_CB(skb).portid, nlh->nlmsg_seq, 0, 0, ext_filter_mask, 0, NULL, 0, netnsid, GFP_KERNEL); if (err < 0) { /* -EMSGSIZE implies BUG in if_nlmsg_size */ WARN_ON(err == -EMSGSIZE); kfree_skb(nskb); } else diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 6258b4f1bc0d..22be4dd167bb 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -52,18 +52,21 @@ static struct devlink *netdev_to_devlink_get(struct net_device *dev) /* * Some useful ethtool_ops methods that're device independent. * If we find that all drivers want to do the same thing here, * we can turn these into dev_() function calls. */ u32 ethtool_op_get_link(struct net_device *dev) { + /* Synchronize carrier state with link watch, see also rtnl_getlink() */ + linkwatch_sync_dev(dev); + return netif_carrier_ok(dev) ? 1 : 0; } EXPORT_SYMBOL(ethtool_op_get_link); int ethtool_op_get_ts_info(struct net_device *dev, struct ethtool_ts_info *info) { info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE | SOF_TIMESTAMPING_RX_SOFTWARE | -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] drm/edid: fix OOB read in drm_parse_tiled_block()
by Hongtao Zhang 10 Aug '26

10 Aug '26

From: Xiang Mei <xmei5(a)asu.edu> stable inclusion from stable-v5.10.261 commit c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0 category: bugfix bugzilla: 16848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit faaa1e1155833e7d4ce7e3cfaf64c0d636b190db ] drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) Fixes: 40d9b043a89e ("drm/connector: store tile information from displayid (v3)") Reported-by: Weiming Shi <bestswngs(a)gmail.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5(a)asu.edu> Reviewed-by: Jani Nikula <jani.nikula(a)intel.com> Link: https://patch.msgid.link/20260615184737.899892-1-xmei5@asu.edu Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_edid.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index f5926bf5dabd9..ad7e524d03037 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -5198,6 +5198,13 @@ static int drm_parse_tiled_block(struct drm_connector *connector, u8 num_v_tile, num_h_tile; struct drm_tile_group *tg; + /* tiled block payload per spec: cap 1 + topo 3 + size 4 + bezel 5 + id 9 = 22 */ + if (block->num_bytes < 22) { + DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Unexpected tiled block size %u\n", + connector->base.id, connector->name, block->num_bytes); + return 0; + } + w = tile->tile_size[0] | tile->tile_size[1] << 8; h = tile->tile_size[2] | tile->tile_size[3] << 8; -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] Fix 2 CVE
by Xia Fukun 10 Aug '26

10 Aug '26

CVE-2026-63860 CVE-2026-64406 Florian Westphal (1): RDMA/core: Prefer NLA_NUL_STRING Yousef Alhouseen (1): Bluetooth: fix UAF in bt_accept_dequeue() drivers/infiniband/core/iwpm_msg.c | 6 +++--- net/bluetooth/af_bluetooth.c | 17 +++-------------- net/bluetooth/l2cap_sock.c | 4 ++-- 3 files changed, 8 insertions(+), 19 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] sched: Add the qos schduler's cgroup v2 interface
by Chen Jinghuang 10 Aug '26

10 Aug '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9738 -------------------------------- Add the qos schduler's cgroup v2 interface. Cgroup v2 use the qos scheduler, as follows: offline group: echo -1 > /sys/fs/cgroup/xxxx/offline/cpu.qos_level online group: /sys/fs/cgroup/xxxx/online/cpu.qos_level Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 98bd31a685a9..f1cc87792b1e 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -10661,6 +10661,14 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#ifdef CONFIG_QOS_SCHED + { + .name = "qos_level", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_qos_read, + .write_s64 = cpu_qos_write, + }, +#endif #ifdef CONFIG_SCHED_SOFT_DOMAIN { .name = "soft_domain", -- 2.34.1

2 1

[PATCH OLK-6.6] sched: Add the qos schduler's cgroup v2 interface
by Chen Jinghuang 10 Aug '26

10 Aug '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9738 -------------------------------- Add the qos schduler's cgroup v2 interface. Cgroup v2 use the qos scheduler, as follows: offline group: echo -1 > /sys/fs/cgroup/xxxx/offline/cpu.qos_level online group: /sys/fs/cgroup/xxxx/online/cpu.qos_level Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 98bd31a685a9..03fbea3c1bbe 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -10661,6 +10661,14 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#endif +#ifdef CONFIG_QOS_SCHED + { + .name = "qos_level", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_qos_read, + .write_s64 = cpu_qos_write, + }, #ifdef CONFIG_SCHED_SOFT_DOMAIN { .name = "soft_domain", -- 2.34.1

2 1

[PATCH OLK-5.10] exfat: bound uniname advance in exfat_find_dir_entry()
by Lai Zewei 10 Aug '26

10 Aug '26

stable inclusion from stable-v5.10.261 commit 72a2589d82eb001c94b74bcfe6f9a599bd9bef60 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16838 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if (++order == 2) uniname = p_uniname->name; else uniname += EXFAT_FILE_NAME_LEN; len = exfat_extract_uni_name(ep, entry_uniname); name_len += len; unichar = *(uniname+len); *(uniname+len) = 0x0; uniname grows by EXFAT_FILE_NAME_LEN (15) per name entry, but name_len grows only by the actual extracted length, which is shorter when a name fragment contains an early NUL. The only guard is `name_len >= MAX_NAME_LENGTH`, so a crafted directory with many short name fragments lets uniname run far past the p_uniname->name[MAX_NAME_LENGTH + 3] buffer while name_len stays small, causing an out-of-bounds read and write at *(uniname+len). The sibling extractor exfat_get_uniname_from_ext_entry() already stops on a short fragment (the lockstep `len != EXFAT_FILE_NAME_LEN` guard added in commit d42334578eba ("exfat: check if filename entries exceeds max filename length")); exfat_find_dir_entry() never got the equivalent. Track the per-entry write offset as a count and reject a fragment once the offset, or the offset plus the extracted length, would exceed MAX_NAME_LENGTH, before forming the output pointer. Fixes: ca06197382bd ("exfat: add directory operations") Cc: stable(a)vger.kernel.org Suggested-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Conflicts: fs/exfat/dir.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- fs/exfat/dir.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c index 4543013ac048..3c88edfcb03a 100644 --- a/fs/exfat/dir.c +++ b/fs/exfat/dir.c @@ -1045,6 +1045,7 @@ int exfat_find_dir_entry(struct super_block *sb, struct exfat_inode_info *ei, brelse(bh); if (entry_type == TYPE_EXTEND) { unsigned short entry_uniname[16], unichar; + unsigned int offset; if (step != DIRENT_STEP_NAME || name_len >= MAX_NAME_LENGTH) { @@ -1052,12 +1053,14 @@ int exfat_find_dir_entry(struct super_block *sb, struct exfat_inode_info *ei, continue; } - if (++order == 2) - uniname = p_uniname->name; - else - uniname += EXFAT_FILE_NAME_LEN; - + offset = (++order - 2) * EXFAT_FILE_NAME_LEN; len = exfat_extract_uni_name(ep, entry_uniname); + if (offset > MAX_NAME_LENGTH || + len > MAX_NAME_LENGTH - offset) { + step = DIRENT_STEP_FILE; + continue; + } + uniname = p_uniname->name + offset; name_len += len; unichar = *(uniname+len); -- 2.52.0

2 3

[PATCH OLK-6.6 0/2] Fix ringbuffer swap cpu buffer issue
by Tengda Wu 10 Aug '26

10 Aug '26

This series backports two mainline patches to resolve an issue with swapping CPU buffers in the ring buffer. Steven Rostedt (1): ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() Tengda Wu (1): ring-buffer: Use current_context for safe per-CPU buffer swap kernel/trace/ring_buffer.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] USB: serial: mxuport: fix memory corruption with small endpoint
by Liu Mingrui 10 Aug '26

10 Aug '26

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v5.10.259 commit 086b858b5f5125bc9d967ea2bd825f83d9f8f29d category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4085f0dbb1ce2251c9a5938d693de6593f0ab2bd upstream. Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size. Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver") Cc: stable(a)vger.kernel.org # 3.14 Cc: Andrew Lunn <andrew(a)lunn.ch> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/usb/serial/mxuport.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c index 5d38c2a0f590..217b114db6bf 100644 --- a/drivers/usb/serial/mxuport.c +++ b/drivers/usb/serial/mxuport.c @@ -969,6 +969,14 @@ static int mxuport_calc_num_ports(struct usb_serial *serial, */ BUILD_BUG_ON(ARRAY_SIZE(epds->bulk_out) < 16); + /* + * The bulk-out buffers must be large enough for the four-byte header + * (and following data), but assume anything smaller than eight bytes + * is broken. + */ + if (usb_endpoint_maxp(epds->bulk_out[0]) < 8) + return -EINVAL; + for (i = 1; i < num_ports; ++i) epds->bulk_out[i] = epds->bulk_out[0]; -- 2.34.1

2 1

[PTACH OLK-6.6] sched: Add the qos schduler's cgroup v2 interface
by Chen Jinghuang 10 Aug '26

10 Aug '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9738 -------------------------------- Add the qos schduler's cgroup v2 interface. Cgroup v2 use the qos scheduler, as follows: offline group: echo -1 > /sys/fs/cgroup/xxxx/offline/cpu.qos_level online group: /sys/fs/cgroup/xxxx/online/cpu.qos_level Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index cdc931c14930..fd8fdaaf7cbb 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -10660,6 +10660,14 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#endif +#ifdef CONFIG_QOS_SCHED + { + .name = "qos_level", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_qos_read, + .write_s64 = cpu_qos_write, + }, #ifdef CONFIG_SCHED_SOFT_DOMAIN { .name = "soft_domain", -- 2.34.1

1 0

[PATCH OLK-6.6] ring-buffer: Use current_context for safe per-CPU buffer swap
by Tengda Wu 10 Aug '26

10 Aug '26

From: Tengda Wu <wutengda(a)huaweicloud.com> mainline inclusion from mainline-v7.2-rc7 commit f27bdc43077e4fcb5557dfc315ee8d91e741f483 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9717 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The ring_buffer_swap_cpu() function currently checks the per-CPU committing counter to determine if a buffer is actively being written to before performing the swap. However, there exists a race window where this check can be bypassed: ring_buffer_lock_reserve cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a rb_reserve_next_event rb_start_commit // inc committing if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...} __rb_reserve_next rb_move_tail rb_end_commit(cpu_buffer); // dec committing => 0 /* interrupt hits here, successfully swaps! */ local_inc(&cpu_buffer->committing); ring_buffer_unlock_commit cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_b rb_commit rb_end_commit RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing)) // triggers warning The committing counter can temporarily drop to 0 during a single write operation (within rb_move_tail), creating a window where swap can succeed even though the write is still in progress. This leads to inconsistent buffer state and triggers the RB_WARN_ON in rb_commit(). Replace the committing counter check with current_context checks, which are set at the entry of ring_buffer_lock_reserve() and remain valid throughout the entire write operation, providing a reliable indicator of buffer busy state during swap. Cc: stable(a)vger.kernel.org Fixes: 4239c38fe0b3 ("ring-buffer: Process commits whenever moving to a new page.") Link: https://patch.msgid.link/20260803005640.2445666-2-wutengda@huaweicloud.com Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/ring_buffer.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 3b42f1632cda..52e6ccb68067 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -5476,7 +5476,7 @@ int ring_buffer_swap_cpu(struct trace_buffer *buffer_a, { struct ring_buffer_per_cpu *cpu_buffer_a; struct ring_buffer_per_cpu *cpu_buffer_b; - int ret = -EINVAL; + int ret = -EBUSY; if (!cpumask_test_cpu(cpu, buffer_a->cpumask) || !cpumask_test_cpu(cpu, buffer_b->cpumask)) @@ -5512,10 +5512,10 @@ int ring_buffer_swap_cpu(struct trace_buffer *buffer_a, atomic_inc(&cpu_buffer_a->record_disabled); atomic_inc(&cpu_buffer_b->record_disabled); - ret = -EBUSY; - if (local_read(&cpu_buffer_a->committing)) + /* Do not swap if either buffer is in the process of writing */ + if (cpu_buffer_a->current_context) goto out_dec; - if (local_read(&cpu_buffer_b->committing)) + if (cpu_buffer_b->current_context) goto out_dec; /* -- 2.34.1

2 1

[PTACH OLK-6.6] sched: Add the qos schduler's cgroup v2 interface
by Chen Jinghuang 10 Aug '26

10 Aug '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9738 -------------------------------- Add the qos schduler's cgroup v2 interface. Cgroup v2 use the qos scheduler, as follows: offline group: echo -1 > /sys/fs/cgroup/xxxx/offline/cpu.qos_level online group: /sys/fs/cgroup/xxxx/online/cpu.qos_level Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index cdc931c14930..fd8fdaaf7cbb 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -10660,6 +10660,14 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#endif +#ifdef CONFIG_QOS_SCHED + { + .name = "qos_level", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_qos_read, + .write_s64 = cpu_qos_write, + }, #ifdef CONFIG_SCHED_SOFT_DOMAIN { .name = "soft_domain", -- 2.34.1

1 0

[PATCH OLK-5.10] bpf, cgroup: Fix storage null-ptr-deref after replacing prog
by Pu Lehui 10 Aug '26

10 Aug '26

maillist inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9715 Reference: https://git.kernel.org/bpf/bpf-next/c/3f562c537e9e -------------------------------- Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog B uses BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE and calls the bpf_get_local_storage helper. 3. link_update is called to replace prog A with prog B. The reason is that __cgroup_bpf_replace fails to alloc and assign the required cgrp storage for the incoming replacement prog. Consequently, the new prog inherits an uninit storage, leading to null-ptr-deref panic when kick the new prog. Fix this by rejecting a link update if new_prog's cgroup storage is incompatible with link->prog. Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Reviewed-by: Amery Hung <ameryhung(a)gmail.com> Acked-by: Leon Hwang <leon.hwang(a)linux.dev> Link: https://lore.kernel.org/bpf/20260728132336.2857800-1-pulehui@huaweicloud.com [0] Link: https://lore.kernel.org/bpf/f87b53c0-8f00-45a6-82db-8242fa9b143f@huaweiclou… [1] Link: https://lore.kernel.org/bpf/20260807104403.1013064-1-pulehui@huaweicloud.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/cgroup.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 41bd6032c6b4..c044c25eadbd 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -591,6 +591,20 @@ static void replace_effective_prog(struct cgroup *cgrp, } } +static bool cgroup_bpf_storages_compatible(struct bpf_prog *old_prog, + struct bpf_prog *new_prog) +{ + enum bpf_cgroup_storage_type stype; + + for_each_cgroup_storage_type(stype) { + if (old_prog->aux->cgroup_storage[stype] != + new_prog->aux->cgroup_storage[stype]) + return false; + } + + return true; +} + /** * __cgroup_bpf_replace() - Replace link's program and propagate the change * to descendants @@ -628,6 +642,9 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp, if (!found) return -ENOENT; + if (!cgroup_bpf_storages_compatible(link->link.prog, new_prog)) + return -EINVAL; + old_prog = xchg(&link->link.prog, new_prog); replace_effective_prog(cgrp, atype, link); bpf_prog_put(old_prog); -- 2.34.1

2 1

[PATCH OLK-6.6] bpf, cgroup: Fix storage null-ptr-deref after replacing prog
by Pu Lehui 10 Aug '26

10 Aug '26

maillist inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9715 Reference: https://git.kernel.org/bpf/bpf-next/c/3f562c537e9e -------------------------------- Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog B uses BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE and calls the bpf_get_local_storage helper. 3. link_update is called to replace prog A with prog B. The reason is that __cgroup_bpf_replace fails to alloc and assign the required cgrp storage for the incoming replacement prog. Consequently, the new prog inherits an uninit storage, leading to null-ptr-deref panic when kick the new prog. Fix this by rejecting link update with -EINVAL if new_prog's cgroup storage is incompatible with link->prog. Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Reviewed-by: Amery Hung <ameryhung(a)gmail.com> Acked-by: Leon Hwang <leon.hwang(a)linux.dev> Link: https://lore.kernel.org/bpf/20260728132336.2857800-1-pulehui@huaweicloud.com [0] Link: https://lore.kernel.org/bpf/f87b53c0-8f00-45a6-82db-8242fa9b143f@huaweiclou… [1] Link: https://lore.kernel.org/bpf/20260807104403.1013064-1-pulehui@huaweicloud.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/cgroup.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 10bd2335631b..1c8513521951 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -824,6 +824,20 @@ static void replace_effective_prog(struct cgroup *cgrp, } } +static bool cgroup_bpf_storages_compatible(struct bpf_prog *old_prog, + struct bpf_prog *new_prog) +{ + enum bpf_cgroup_storage_type stype; + + for_each_cgroup_storage_type(stype) { + if (old_prog->aux->cgroup_storage[stype] != + new_prog->aux->cgroup_storage[stype]) + return false; + } + + return true; +} + /** * __cgroup_bpf_replace() - Replace link's program and propagate the change * to descendants @@ -862,6 +876,9 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp, if (!found) return -ENOENT; + if (!cgroup_bpf_storages_compatible(link->link.prog, new_prog)) + return -EINVAL; + old_prog = xchg(&link->link.prog, new_prog); replace_effective_prog(cgrp, atype, link); bpf_prog_put(old_prog); -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: add kfree in hci_cleanup_dev()
by Chen Jinghuang 09 Aug '26

09 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/1593 CVE: CVE-2026-53252 -------------------------------- When adapting commit fbdc919a77f7("[Backport] Bluetooth: fix memory leak in error path of hci_alloc_dev()"), the mainline hci_release_dev() was found to include kfree(), but the current version of hci_cleanup_dev() missed this deallocation. This commit adds the missing kfree() to prevent memory leaks and ensure resource cleanup is consistent with the mainline implementation. Fixes: fbdc919a77f7 ("[Backport] Bluetooth: fix memory leak in error path of hci_alloc_dev()") Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/hci_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index e3b98fd6e1f3..89f55b2833e8 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3938,6 +3938,7 @@ void hci_cleanup_dev(struct hci_dev *hdev) ida_simple_remove(&hci_index_ida, hdev->id); kfree_skb(hdev->sent_cmd); + kfree(hdev); } /* Suspend HCI device */ -- 2.34.1

2 1

[PATCH] erofs: fix stack-out-of-bounds in erofs_put_metabuf
by Liu Mingrui 08 Aug '26

08 Aug '26

From: Mingrui Liu <liumingrui(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16872 -------------------------------- Commit 1d4b040dd8ee moved erofs_put_metabuf() to out_unlock, but some error paths jump there before buf is initialized, unlike mainline where buf is always set. This triggers : BUG: KASAN: stack-out-of-bounds in erofs_put_metabuf+0x54/0x158 [erofs] Call Trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x78/0xc8 print_address_description.constprop.0+0x84/0x3c8 print_report+0xb0/0x280 kasan_report+0x84/0xd0 __asan_load8+0x9c/0xc0 erofs_put_metabuf+0x54/0x158 [erofs] erofs_init_inode_xattrs+0x194/0x560 [erofs] erofs_getxattr+0xc8/0x238 [erofs] erofs_get_acl+0x6c/0x150 [erofs] __get_acl.part.0+0x218/0x390 vfs_get_acl+0xd0/0x150 do_get_acl+0x38/0x2a0 do_getxattr+0x9c/0x250 getxattr+0xe0/0x148 path_getxattr+0xdc/0x150 __arm64_sys_getxattr+0x60/0x80 invoke_syscall+0x64/0x178 el0_svc_common.constprop.0+0x11c/0x150 do_el0_svc+0x38/0x50 el0_svc+0x44/0x228 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0 Fix by zero-initializing buf at declaration so erofs_put_metabuf() can safely handle it. Fixes: 6a89c63750cb ("erofs: fix metabuf leak in inode xattr initialization") Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- fs/erofs/xattr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c index b270226be379..abd23e990a3a 100644 --- a/fs/erofs/xattr.c +++ b/fs/erofs/xattr.c @@ -34,6 +34,8 @@ static int erofs_init_inode_xattrs(struct inode *inode) struct super_block *sb = inode->i_sb; int ret = 0; + it.buf = __EROFS_BUF_INITIALIZER; + /* the most case is that xattrs of this inode are initialized. */ if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags)) { /* @@ -76,7 +78,6 @@ static int erofs_init_inode_xattrs(struct inode *inode) goto out_unlock; } - it.buf = __EROFS_BUF_INITIALIZER; erofs_init_metabuf(&it.buf, sb); it.pos = erofs_iloc(inode) + vi->inode_isize; -- 2.34.1

1 0

[PATCH OLK-6.6] [Backport] mm: refactor mm_access() to not return NULL
by Tang Hui 08 Aug '26

08 Aug '26

From: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> stable inclusion from stable-v6.6.146 commit d8a1f7420d2d58fcbde479bd72d0900fb512cb2d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16888 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cd3f8467afd470ccab0de2fbc7c76664af4a0bac ] mm_access() can return NULL if the mm is not found, but this is handled the same as an error in all callers, with some translating this into an -ESRCH error. Only proc_mem_open() returns NULL if no mm is found, however in this case it is clearer and makes more sense to explicitly handle the error. Additionally we take the opportunity to refactor the function to eliminate unnecessary nesting. d8a1f7420d2d58fcbde479bd72d0900fb512cb2d Simplify things by simply returning -ESRCH if no mm is found - this both eliminates confusing use of the IS_ERR_OR_NULL() macro, and simplifies callers which would return -ESRCH by returning this error directly. [lorenzo.stoakes(a)oracle.com: prefer neater pointer error comparison] Link: https://lkml.kernel.org/r/2fae1834-749a-45e1-8594-5e5979cf7103@lucifer.local Link: https://lkml.kernel.org/r/20240924201023.193135-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Suggested-by: Arnd Bergmann <arnd(a)arndb.de> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: mm/madvise.c [Context conflicts due to backport] Signed-off-by: Tang Hui <tanghui20(a)huawei.com> --- fs/proc/base.c | 26 ++++++++++++++------------ kernel/fork.c | 5 +++-- mm/madvise.c | 4 ++-- mm/process_vm_access.c | 4 ++-- 4 files changed, 21 insertions(+), 18 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index cac883cf29fa..7ee2285910bb 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -815,19 +815,21 @@ static const struct file_operations proc_single_file_operations = { struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) { struct task_struct *task = get_proc_task(inode); - struct mm_struct *mm = ERR_PTR(-ESRCH); + struct mm_struct *mm; - if (task) { - mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); - put_task_struct(task); + if (!task) + return ERR_PTR(-ESRCH); - if (!IS_ERR_OR_NULL(mm)) { - /* ensure this mm_struct can't be freed */ - mmgrab(mm); - /* but do not pin its memory */ - mmput(mm); - } - } + mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); + put_task_struct(task); + + if (IS_ERR(mm)) + return mm == ERR_PTR(-ESRCH) ? NULL : mm; + + /* ensure this mm_struct can't be freed */ + mmgrab(mm); + /* but do not pin its memory */ + mmput(mm); return mm; } @@ -2205,7 +2207,7 @@ static int map_files_d_revalidate(struct dentry *dentry, unsigned int flags) goto out_notask; mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); - if (IS_ERR_OR_NULL(mm)) + if (IS_ERR(mm)) goto out; if (!dname_to_vma_addr(dentry, &vm_start, &vm_end)) { diff --git a/kernel/fork.c b/kernel/fork.c index e92ddc0a0c66..7f188d166f35 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1676,8 +1676,9 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) return ERR_PTR(err); mm = get_task_mm(task); - if (mm && mm != current->mm && - !ptrace_may_access(task, mode)) { + if (!mm) { + mm = ERR_PTR(-ESRCH); + } else if (mm != current->mm && !ptrace_may_access(task, mode)) { mmput(mm); mm = ERR_PTR(-EACCES); } diff --git a/mm/madvise.c b/mm/madvise.c index 4b7956dd6357..7fb856fc7eec 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -1846,8 +1846,8 @@ SYSCALL_DEFINE5(process_madvise, int, pidfd, const struct iovec __user *, vec, /* Require PTRACE_MODE_READ to avoid leaking ASLR metadata. */ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); - if (IS_ERR_OR_NULL(mm)) { - ret = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; + if (IS_ERR(mm)) { + ret = PTR_ERR(mm); goto release_task; } diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c index 0523edab03a6..5be8e91aa872 100644 --- a/mm/process_vm_access.c +++ b/mm/process_vm_access.c @@ -200,8 +200,8 @@ static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter, } mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS); - if (!mm || IS_ERR(mm)) { - rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; + if (IS_ERR(mm)) { + rc = PTR_ERR(mm); /* * Explicitly map EACCES to EPERM as EPERM is a more * appropriate error code for process_vw_readv/writev -- 2.34.1

1 0

[PATCH OLK-6.6] erofs: fix stack-out-of-bounds in erofs_put_metabuf
by Liu Mingrui 08 Aug '26

08 Aug '26

From: Mingrui Liu <liumingrui(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16872 -------------------------------- Commit 1d4b040dd8ee moved erofs_put_metabuf() to out_unlock, but some error paths jump there before buf is initialized, unlike mainline where buf is always set. This triggers : BUG: KASAN: stack-out-of-bounds in erofs_put_metabuf+0x54/0x158 [erofs] Call Trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x78/0xc8 print_address_description.constprop.0+0x84/0x3c8 print_report+0xb0/0x280 kasan_report+0x84/0xd0 __asan_load8+0x9c/0xc0 erofs_put_metabuf+0x54/0x158 [erofs] erofs_init_inode_xattrs+0x194/0x560 [erofs] erofs_getxattr+0xc8/0x238 [erofs] erofs_get_acl+0x6c/0x150 [erofs] __get_acl.part.0+0x218/0x390 vfs_get_acl+0xd0/0x150 do_get_acl+0x38/0x2a0 do_getxattr+0x9c/0x250 getxattr+0xe0/0x148 path_getxattr+0xdc/0x150 __arm64_sys_getxattr+0x60/0x80 invoke_syscall+0x64/0x178 el0_svc_common.constprop.0+0x11c/0x150 do_el0_svc+0x38/0x50 el0_svc+0x44/0x228 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0 Fix by zero-initializing buf at declaration so erofs_put_metabuf() can safely handle it. Fixes: 6a89c63750cb ("erofs: fix metabuf leak in inode xattr initialization") Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- fs/erofs/xattr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c index b270226be379..abd23e990a3a 100644 --- a/fs/erofs/xattr.c +++ b/fs/erofs/xattr.c @@ -34,6 +34,8 @@ static int erofs_init_inode_xattrs(struct inode *inode) struct super_block *sb = inode->i_sb; int ret = 0; + it.buf = __EROFS_BUF_INITIALIZER; + /* the most case is that xattrs of this inode are initialized. */ if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags)) { /* @@ -76,7 +78,6 @@ static int erofs_init_inode_xattrs(struct inode *inode) goto out_unlock; } - it.buf = __EROFS_BUF_INITIALIZER; erofs_init_metabuf(&it.buf, sb); it.pos = erofs_iloc(inode) + vi->inode_isize; -- 2.34.1

2 1

[PATCH OLK-6.6] x86/bugs: Enable IBPB flush on BPF JIT allocation
by Zhang Kunbo 08 Aug '26

08 Aug '26

From: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> stable inclusion from stable-v6.6.145 commit cb27f3bf915cc0f20fc0c48da9059304e39ebd35 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16808 CVE: CVE-2026-64507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a3af84b0fa00ead01fcd0e28b5d773ff25990a0d upstream. Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence. This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n. [ pawan: Use entry_ibpb() instead of write_ibpb(). JIT hardening enable moved to spectre_v2_select_mitigation() because there is no spectre_v2_apply_mitigation()] Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Dave Hansen <dave.hansen(a)linux.intel.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/x86/kernel/cpu/bugs.c arch/x86/include/asm/nospec-branch.h [context conflicts and use `write_ibpb` instead of `entry_ibpb` due to 13235d6d50bb ("x86/bugs: Rename entry_ibpb() to write_ibpb()") ] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/include/asm/nospec-branch.h | 4 +++ arch/x86/kernel/cpu/bugs.c | 50 +++++++++++++++++++++++++--- 2 files changed, 49 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h index 58dda23aee1b..d4eae71b2ab7 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -408,6 +408,10 @@ extern void srso_alias_untrain_ret(void); extern void entry_untrain_ret(void); extern void write_ibpb(void); +#ifdef CONFIG_BPF_JIT +extern void bpf_arch_ibpb(void); +#endif + #ifdef CONFIG_X86_64 extern void clear_bhb_loop(void); #endif diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 212408f6de11..d5dd360ee330 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -16,6 +16,7 @@ #include <linux/sched/smt.h> #include <linux/pgtable.h> #include <linux/bpf.h> +#include <linux/filter.h> #include <asm/spec-ctrl.h> #include <asm/cmdline.h> @@ -1312,8 +1313,21 @@ static inline const char *spectre_v2_module_string(void) { return spectre_v2_bad_module ? " - vulnerable module loaded" : ""; } + +/* + * The "retpoline sequence" is the "call;mov;ret" sequence that + * replaces normal indirect branch instructions. Differentiate + * *the* retpoline sequence from the LFENCE-prefixed indirect + * branches that simply use the retpoline infrastructure. + */ +static inline bool retpoline_seq_enabled(void) +{ + return boot_cpu_has(X86_FEATURE_RETPOLINE) && !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE); +} + #else static inline const char *spectre_v2_module_string(void) { return ""; } +static inline bool retpoline_seq_enabled(void) { return false; } #endif #define SPECTRE_V2_LFENCE_MSG "WARNING: LFENCE mitigation is not recommended for this CPU, data leaks possible!\n" @@ -1787,8 +1801,7 @@ static void __init bhi_select_mitigation(void) return; /* Retpoline mitigates against BHI unless the CPU has RRSBA behavior */ - if (boot_cpu_has(X86_FEATURE_RETPOLINE) && - !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE)) { + if (retpoline_seq_enabled()) { spec_ctrl_disable_kernel_rrsba(); if (rrsba_disabled) return; @@ -1810,6 +1823,27 @@ static void __init bhi_select_mitigation(void) pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n"); } +#ifdef CONFIG_BPF_JIT +static void __bpf_arch_ibpb(void *unused) +{ + write_ibpb(); +} + +void bpf_arch_ibpb(void) +{ + on_each_cpu(__bpf_arch_ibpb, NULL, 1); +} + +static bool __init cpu_wants_ibpb_bpf(void) +{ + /* A genuine retpoline already neutralizes ring0 indirect predictions */ + if (retpoline_seq_enabled()) + return false; + + return boot_cpu_has(X86_FEATURE_IBPB); +} +#endif + static void __init spectre_v2_select_mitigation(void) { enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); @@ -1955,6 +1989,14 @@ static void __init spectre_v2_select_mitigation(void) pr_info("Enabling Restricted Speculation for firmware calls\n"); } +#ifdef CONFIG_BPF_JIT + if (cpu_wants_ibpb_bpf()) { + static_call_update(bpf_arch_pred_flush, bpf_arch_ibpb); + static_branch_enable(&bpf_pred_flush_enabled); + pr_info("Enabling IBPB for BPF\n"); + } +#endif + /* Set up IBPB and STIBP depending on the general spectre V2 command */ spectre_v2_cmd = cmd; } @@ -3113,9 +3155,7 @@ static const char *spectre_bhi_state(void) return "; BHI: BHI_DIS_S"; else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP)) return "; BHI: SW loop, KVM: SW loop"; - else if (boot_cpu_has(X86_FEATURE_RETPOLINE) && - !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE) && - rrsba_disabled) + else if (retpoline_seq_enabled() && rrsba_disabled) return "; BHI: Retpoline"; else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT)) return "; BHI: Vulnerable, KVM: SW loop"; -- 2.34.1

2 1

[PATCH OLK-5.10] USB: serial: mct_u232: fix memory corruption with small endpoint
by Zhang Kunbo 08 Aug '26

08 Aug '26

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v5.10.259 commit 94edbbc5fe00d03cfe1d4e690d7d2cd36317a935 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16226 CVE: CVE-2026-63898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 915b36d701950503c4ea0f6e314b10868e59fce3 upstream. The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increase the maximum transfer size to prevent slab corruption should a malicious device report a smaller endpoint max packet size than expected. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/usb/serial/mct_u232.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c index 04f16d4a0a68..8842a1db72b3 100644 --- a/drivers/usb/serial/mct_u232.c +++ b/drivers/usb/serial/mct_u232.c @@ -378,6 +378,7 @@ static int mct_u232_port_probe(struct usb_serial_port *port) { struct usb_serial *serial = port->serial; struct mct_u232_private *priv; + u16 pid; /* check first to simplify error handling */ if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) { @@ -385,6 +386,16 @@ static int mct_u232_port_probe(struct usb_serial_port *port) return -ENODEV; } + /* + * Compensate for a hardware bug: although the Sitecom U232-P25 + * device reports a maximum output packet size of 32 bytes, + * it seems to be able to accept only 16 bytes (and that's what + * SniffUSB says too...) + */ + pid = le16_to_cpu(serial->dev->descriptor.idProduct); + if (pid == MCT_U232_SITECOM_PID) + port->bulk_out_size = min(16, port->bulk_out_size); + priv = kzalloc(sizeof(*priv), GFP_KERNEL); if (!priv) return -ENOMEM; @@ -412,7 +423,6 @@ static int mct_u232_port_remove(struct usb_serial_port *port) static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port) { - struct usb_serial *serial = port->serial; struct mct_u232_private *priv = usb_get_serial_port_data(port); int retval = 0; unsigned int control_state; @@ -420,15 +430,6 @@ static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port) unsigned char last_lcr; unsigned char last_msr; - /* Compensate for a hardware bug: although the Sitecom U232-P25 - * device reports a maximum output packet size of 32 bytes, - * it seems to be able to accept only 16 bytes (and that's what - * SniffUSB says too...) - */ - if (le16_to_cpu(serial->dev->descriptor.idProduct) - == MCT_U232_SITECOM_PID) - port->bulk_out_size = 16; - /* Do a defined restart: the normal serial device seems to * always turn on DTR and RTS here, so do the same. I'm not * sure if this is really necessary. But it should not harm -- 2.34.1

2 1

[PATCH OLK-5.10] USB: serial: mct_u232: fix memory corruption with small endpoint
by Zhang Kunbo 08 Aug '26

08 Aug '26

From: Johan Hovold <johan(a)kernel.org> commit 915b36d701950503c4ea0f6e314b10868e59fce3 upstream. The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increase the maximum transfer size to prevent slab corruption should a malicious device report a smaller endpoint max packet size than expected. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/usb/serial/mct_u232.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c index 04f16d4a0a68..8842a1db72b3 100644 --- a/drivers/usb/serial/mct_u232.c +++ b/drivers/usb/serial/mct_u232.c @@ -378,6 +378,7 @@ static int mct_u232_port_probe(struct usb_serial_port *port) { struct usb_serial *serial = port->serial; struct mct_u232_private *priv; + u16 pid; /* check first to simplify error handling */ if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) { @@ -385,6 +386,16 @@ static int mct_u232_port_probe(struct usb_serial_port *port) return -ENODEV; } + /* + * Compensate for a hardware bug: although the Sitecom U232-P25 + * device reports a maximum output packet size of 32 bytes, + * it seems to be able to accept only 16 bytes (and that's what + * SniffUSB says too...) + */ + pid = le16_to_cpu(serial->dev->descriptor.idProduct); + if (pid == MCT_U232_SITECOM_PID) + port->bulk_out_size = min(16, port->bulk_out_size); + priv = kzalloc(sizeof(*priv), GFP_KERNEL); if (!priv) return -ENOMEM; @@ -412,7 +423,6 @@ static int mct_u232_port_remove(struct usb_serial_port *port) static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port) { - struct usb_serial *serial = port->serial; struct mct_u232_private *priv = usb_get_serial_port_data(port); int retval = 0; unsigned int control_state; @@ -420,15 +430,6 @@ static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port) unsigned char last_lcr; unsigned char last_msr; - /* Compensate for a hardware bug: although the Sitecom U232-P25 - * device reports a maximum output packet size of 32 bytes, - * it seems to be able to accept only 16 bytes (and that's what - * SniffUSB says too...) - */ - if (le16_to_cpu(serial->dev->descriptor.idProduct) - == MCT_U232_SITECOM_PID) - port->bulk_out_size = 16; - /* Do a defined restart: the normal serial device seems to * always turn on DTR and RTS here, so do the same. I'm not * sure if this is really necessary. But it should not harm -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
by Zhang Kunbo 08 Aug '26

08 Aug '26

From: Ashutosh Desai <ashutoshdesai993(a)gmail.com> stable inclusion from stable-v5.10.260 commit f701ae476cb92a3a3d8844bb39bb63b4512684c8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16125 CVE: CVE-2026-63794 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78ee2d50185a037b3d2452a97f3dad69c3f7f389 upstream. In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the destination page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt path (__sev_dbg_encrypt_user) performs a read-modify-write using a single-page intermediate buffer (dst_tpage): 1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16) before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE, the PSP writes beyond the end of the 4096-byte dst_tpage allocation. 2. The subsequent memcpy()/copy_from_user() into page_address(dst_tpage) + (d_off & 15) of 'len' bytes overflows by up to 15 bytes under the same condition. Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE - the PSP is instructed to write round_up(4097, 16) = 4112 bytes to a 4096-byte buffer. Fix by also bounding len by (PAGE_SIZE - d_off), the same check that sev_send_update_data() already performs for its single-page guest region. ================================================================== BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd] Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214 CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY Tainted: [U]=USER, [W]=WARN Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025 Call Trace: <TASK> dump_stack_lvl+0x54/0x70 print_report+0xbc/0x260 kasan_report+0xa2/0xd0 kasan_check_range+0x25f/0x2c0 __asan_memcpy+0x40/0x70 sev_dbg_crypt+0x993/0xd10 [kvm_amd] sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd] kvm_vm_ioctl+0x65d/0x6d0 [kvm] __se_sys_ioctl+0xb2/0x100 do_syscall_64+0xe8/0x870 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb memcg:ff11000112827d82 flags: 0x1400000000000000(node=1|zone=1) raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82 page dumped because: kasan: bad access detected Memory state around the buggy address: ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ================================================================== Disabling lock debugging due to kernel taint Fixes: 24f41fb23a39 ("KVM: SVM: Add support for SEV DEBUG_DECRYPT command") Fixes: 7d1594f5d94b ("KVM: SVM: Add support for SEV DEBUG_ENCRYPT command") Cc: stable(a)vger.kernel.org Signed-off-by: Ashutosh Desai <ashutoshdesai993(a)gmail.com> [sean: add sample KASAN splat, Fixes, and stable@] Link: https://patch.msgid.link/20260501203537.2120074-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/svm/sev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 79ebbe8cf0b4..a3a68ec8ab63 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -975,6 +975,7 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec) s_off = vaddr & ~PAGE_MASK; d_off = dst_vaddr & ~PAGE_MASK; len = min_t(size_t, (PAGE_SIZE - s_off), size); + len = min_t(size_t, len, PAGE_SIZE - d_off); if (dec) ret = __sev_dbg_decrypt_user(kvm, -- 2.34.1

2 1

[PATCH OLK-5.10] arm64: Add runtime PAN control for user copy optimization
by Qi Xi 07 Aug '26

07 Aug '26

Signed-off-by: Qi Xi <xiqi2(a)huawei.com> arm64: Optimize copy_from/to_user with batched LDP/STP Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/arm64/include/asm/asm-uaccess.h | 16 +++ arch/arm64/include/asm/uaccess.h | 25 +++- arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/copy_opt.c | 100 ++++++++++++++ arch/arm64/lib/Makefile | 1 + arch/arm64/lib/copy_from_user_opt.S | 75 ++++++++++ arch/arm64/lib/copy_to_user_opt.S | 75 ++++++++++ arch/arm64/lib/copy_user_template.S | 196 +++++++++++++++++++++++++++ 8 files changed, 485 insertions(+), 5 deletions(-) create mode 100644 arch/arm64/kernel/copy_opt.c create mode 100644 arch/arm64/lib/copy_from_user_opt.S create mode 100644 arch/arm64/lib/copy_to_user_opt.S create mode 100644 arch/arm64/lib/copy_user_template.S diff --git a/arch/arm64/include/asm/asm-uaccess.h b/arch/arm64/include/asm/asm-uaccess.h index 46b8d2585980..f51f0d0aadc4 100644 --- a/arch/arm64/include/asm/asm-uaccess.h +++ b/arch/arm64/include/asm/asm-uaccess.h @@ -92,4 +92,20 @@ alternative_else_nop_endif _asm_mc_extable 8888b,\l; .endm + + .macro user_ldst_index l, inst, reg, addr, val +8888: \inst \reg, [\addr, \val]; + + _asm_extable 8888b,\l; + + _asm_mc_extable 8888b,\l; + .endm + + .macro user_ldst_pair_index l, inst, reg1, reg2, addr, val +8888: \inst \reg1, \reg2, [\addr, \val]; + + _asm_extable 8888b,\l; + + _asm_mc_extable 8888b,\l; + .endm #endif diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h index 03c2db710f92..d6d21d6bc6d6 100644 --- a/arch/arm64/include/asm/uaccess.h +++ b/arch/arm64/include/asm/uaccess.h @@ -386,24 +386,41 @@ do { \ goto err_label; \ } while(0) +#define COPY_OPT_THRESHOLD 4096 +extern bool kernel_copy_opt_enabled(void); extern unsigned long __must_check __arch_copy_from_user(void *to, const void __user *from, unsigned long n); +extern unsigned long __must_check __arch_copy_from_user_opt(void *to, const void __user *from, unsigned long n); #define raw_copy_from_user(to, from, n) \ ({ \ unsigned long __acfu_ret; \ - uaccess_ttbr0_enable(); \ - __acfu_ret = __arch_copy_from_user((to), \ - __uaccess_mask_ptr(from), (n)); \ + if ((n) >= COPY_OPT_THRESHOLD && kernel_copy_opt_enabled()) { \ + uaccess_enable_privileged(); \ + __acfu_ret = __arch_copy_from_user_opt((to), \ + __uaccess_mask_ptr(from), (n)); \ + uaccess_disable_privileged(); \ + } else { \ + __acfu_ret = __arch_copy_from_user((to), \ + __uaccess_mask_ptr(from), n); \ + } \ uaccess_ttbr0_disable(); \ __acfu_ret; \ }) extern unsigned long __must_check __arch_copy_to_user(void __user *to, const void *from, unsigned long n); +extern unsigned long __must_check __arch_copy_to_user_opt(void __user *to, const void *from, unsigned long n); #define raw_copy_to_user(to, from, n) \ ({ \ unsigned long __actu_ret; \ uaccess_ttbr0_enable(); \ - __actu_ret = __arch_copy_to_user(__uaccess_mask_ptr(to), \ + if ((n) >= COPY_OPT_THRESHOLD && kernel_copy_opt_enabled()) { \ + uaccess_enable_privileged(); \ + __actu_ret = __arch_copy_to_user_opt(__uaccess_mask_ptr(to),\ + (from), (n)); \ + uaccess_disable_privileged(); \ + } else { \ + __actu_ret = __arch_copy_to_user(__uaccess_mask_ptr(to),\ (from), (n)); \ + } \ uaccess_ttbr0_disable(); \ __actu_ret; \ }) diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index a5fb42a6c8d7..04e84437d3e5 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -22,7 +22,7 @@ obj-y := debug-monitors.o entry.o irq.o fpsimd.o \ return_address.o cpuinfo.o cpu_errata.o \ cpufeature.o alternative.o cacheinfo.o \ smp.o smp_spin_table.o topology.o smccc-call.o \ - syscall.o proton-pack.o ipi_nmi.o + syscall.o proton-pack.o ipi_nmi.o copy_opt.o targets += efi-entry.o diff --git a/arch/arm64/kernel/copy_opt.c b/arch/arm64/kernel/copy_opt.c new file mode 100644 index 000000000000..3eeae607956d --- /dev/null +++ b/arch/arm64/kernel/copy_opt.c @@ -0,0 +1,100 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copy to/from user optimization. + * + * Copyright (C) 2026 Huawei Ltd. + */ + +#include <linux/bitmap.h> +#include <linux/bitops.h> +#include <linux/bottom_half.h> +#include <linux/bug.h> +#include <linux/cache.h> +#include <linux/compat.h> +#include <linux/compiler.h> +#include <linux/cpu.h> +#include <linux/cpu_pm.h> +#include <linux/ctype.h> +#include <linux/kernel.h> +#include <linux/linkage.h> +#include <linux/irqflags.h> +#include <linux/init.h> +#include <linux/percpu.h> +#include <linux/prctl.h> +#include <linux/preempt.h> +#include <linux/ptrace.h> +#include <linux/sched/signal.h> +#include <linux/sched/task_stack.h> +#include <linux/signal.h> +#include <linux/slab.h> +#include <linux/stddef.h> +#include <linux/sysctl.h> +#include <linux/swab.h> + +#include <asm/esr.h> +#include <asm/exception.h> +#include <asm/fpsimd.h> +#include <asm/cpufeature.h> +#include <asm/cputype.h> +#include <asm/neon.h> +#include <asm/processor.h> +#include <asm/simd.h> +#include <asm/sigcontext.h> +#include <asm/sysreg.h> +#include <asm/traps.h> +#include <asm/virt.h> + +DEFINE_STATIC_KEY_FALSE(use_copy_opt); +bool kernel_copy_opt_enabled(void) +{ + return static_key_enabled(&use_copy_opt); +} +EXPORT_SYMBOL_GPL(kernel_copy_opt_enabled); + +static int copy_opt_sysctl_handler(struct ctl_table *table, int write, + void *buffer, size_t *lenp, loff_t *ppos) +{ + int ret, val; + struct ctl_table tmp = { + .data = &val, + .maxlen = sizeof(val), + .mode = table->mode, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_ONE, + }; + + if (write && !capable(CAP_SYS_ADMIN)) + return -EPERM; + + if (!write) { + if (static_key_enabled(&use_copy_opt)) + val = 1; + else + val = 0; + } + ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); + if (write && !ret) { + if (val) + static_branch_enable(&use_copy_opt); + else + static_branch_disable(&use_copy_opt); + } + return 0; +} + +static struct ctl_table copy_opt_sysctl_table[] = { + { + .procname = "copy_opt_user", + .mode = 0644, + .proc_handler = copy_opt_sysctl_handler, + }, + { } +}; + +static int __init copy_opt_sysctl_init(void) +{ + if (!register_sysctl("kernel", copy_opt_sysctl_table)) + return -EINVAL; + return 0; +} +core_initcall(copy_opt_sysctl_init); diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile index e2dbef587c9b..c69993a77e78 100644 --- a/arch/arm64/lib/Makefile +++ b/arch/arm64/lib/Makefile @@ -1,6 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 lib-y := clear_user.o delay.o copy_from_user.o \ copy_to_user.o copy_in_user.o copy_page.o \ + copy_to_user_opt.o copy_from_user_opt.o \ clear_page.o csum.o memchr.o memcpy.o memcpy_mc.o memmove.o \ memset.o memcmp.o strcmp.o strncmp.o strlen.o \ strnlen.o strchr.o strrchr.o tishift.o diff --git a/arch/arm64/lib/copy_from_user_opt.S b/arch/arm64/lib/copy_from_user_opt.S new file mode 100644 index 000000000000..94cfc09b89d7 --- /dev/null +++ b/arch/arm64/lib/copy_from_user_opt.S @@ -0,0 +1,75 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Copyright (C) 2012 ARM Ltd. + */ + +#include <linux/linkage.h> + +#include <asm/asm-uaccess.h> +#include <asm/assembler.h> +#include <asm/cache.h> + +/* + * Copy from user space to a kernel buffer (alignment handled by the hardware) + * + * Parameters: + * x0 - to + * x1 - from + * x2 - n + * Returns: + * x0 - bytes not copied + */ + + .macro ldrb1 reg, ptr, val + user_ldst 9998f, ldtrb, \reg, \ptr, \val + .endm + + .macro strb1 reg, ptr, val + USER_MC(9998f, strb \reg, [\ptr], \val) + .endm + + .macro ldrh1 reg, ptr, val + user_ldst 9997f, ldtrh, \reg, \ptr, \val + .endm + + .macro strh1 reg, ptr, val + USER_MC(9998f, strh \reg, [\ptr], \val) + .endm + + .macro ldr1 reg, ptr, val + user_ldst 9997f, ldtr, \reg, \ptr, \val + .endm + + .macro str1 reg, ptr, val + USER_MC(9998f, str \reg, [\ptr], \val) + .endm + + .macro ldp2 reg1, reg2, ptr, val + user_ldst_pair_index 9997f, ldp, \reg1, \reg2, \ptr, \val + .endm + + .macro stp2 reg1, reg2, ptr, val + USER_MC(9998f, stp \reg1, \reg2, [\ptr, \val]) + .endm + +end .req x5 +srcin .req x15 +SYM_FUNC_START(__arch_copy_from_user_opt) + add end, x0, x2 + mov srcin, x1 +#include "copy_user_template.S" + mov x0, #0 // Nothing to copy + ret +SYM_FUNC_END(__arch_copy_from_user_opt) +EXPORT_SYMBOL(__arch_copy_from_user_opt) + + .section .fixup,"ax" + .align 2 +9997: cmp dst, dstin + b.ne 9998f + // Before being absolutely sure we couldn't copy anything, try harder +USER(9998f, ldtrb tmp1w, [srcin]) + strb tmp1w, [dst], #1 +9998: sub x0, end, dst // bytes not copied + ret + .previous diff --git a/arch/arm64/lib/copy_to_user_opt.S b/arch/arm64/lib/copy_to_user_opt.S new file mode 100644 index 000000000000..57a47383df20 --- /dev/null +++ b/arch/arm64/lib/copy_to_user_opt.S @@ -0,0 +1,75 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Copyright (C) 2012 ARM Ltd. + */ + +#include <linux/linkage.h> + +#include <asm/asm-uaccess.h> +#include <asm/assembler.h> +#include <asm/cache.h> + +/* + * Copy to user space from a kernel buffer (alignment handled by the hardware) + * + * Parameters: + * x0 - to + * x1 - from + * x2 - n + * Returns: + * x0 - bytes not copied + */ + .macro ldrb1 reg, ptr, val + USER_MC(9998f, ldrb \reg, [\ptr], \val) + .endm + + .macro strb1 reg, ptr, val + user_ldst 9998f, sttrb, \reg, \ptr, \val + .endm + + .macro ldrh1 reg, ptr, val + USER_MC(9998f, ldrh \reg, [\ptr], \val) + .endm + + .macro strh1 reg, ptr, val + user_ldst 9997f, sttrh, \reg, \ptr, \val + .endm + + .macro ldr1 reg, ptr, val + USER_MC(9998f, ldr \reg, [\ptr], \val) + .endm + + .macro str1 reg, ptr, val + user_ldst 9997f, sttr, \reg, \ptr, \val + .endm + + .macro ldp2 reg1, reg2, ptr, val + USER_MC(9998f, ldp \reg1, \reg2, [\ptr, \val]) + .endm + + .macro stp2 reg1, reg2, ptr, val + user_ldst_pair_index 9997f, stp, \reg1, \reg2, \ptr, \val + .endm + +end .req x5 +srcin .req x15 +SYM_FUNC_START(__arch_copy_to_user_opt) + add end, x0, x2 + mov srcin, x1 +#include "copy_user_template.S" + mov x0, #0 + ret +SYM_FUNC_END(__arch_copy_to_user_opt) +EXPORT_SYMBOL(__arch_copy_to_user_opt) + + .section .fixup,"ax" + .align 2 +9997: cmp dst, dstin + b.ne 9998f + // Before being absolutely sure we couldn't copy anything, try harder +USER_MC(9998f, ldrb tmp1w, [srcin]) +USER(9998f, sttrb tmp1w, [dst]) + add dst, dst, #1 +9998: sub x0, end, dst // bytes not copied + ret + .previous diff --git a/arch/arm64/lib/copy_user_template.S b/arch/arm64/lib/copy_user_template.S new file mode 100644 index 000000000000..72983eb658b3 --- /dev/null +++ b/arch/arm64/lib/copy_user_template.S @@ -0,0 +1,196 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Copyright (C) 2013 ARM Ltd. + * Copyright (C) 2013 Linaro. + * + * This code is based on glibc cortex strings work originally authored by Linaro + * be found @ + * + * http://bazaar.launchpad.net/~linaro-toolchain-dev/cortex-strings/trunk/ + * files/head:/src/aarch64/ + */ + +/* + * Copy a buffer from src to dest (alignment handled by the hardware) + * + * Parameters: + * x0 - dest + * x1 - src + * x2 - n + * Returns: + * x0 - dest + */ +dstin .req x0 +src .req x1 +count .req x2 +tmp1 .req x3 +tmp1w .req w3 +tmp2 .req x4 +tmp2w .req w4 +dst .req x6 + +A_l .req x7 +A_h .req x8 +B_l .req x9 +B_h .req x10 +C_l .req x11 +C_h .req x12 +D_l .req x13 +D_h .req x14 + + mov dst, dstin + cmp count, #16 + /*When memory length is less than 16, the accessed are not aligned.*/ + b.lo .Ltiny15 + + neg tmp2, src + ands tmp2, tmp2, #15/* Bytes to reach alignment. */ + b.eq .LSrcAligned + sub count, count, tmp2 + /* + * Copy the leading memory data from src to dst in an increasing + * address order.By this way,the risk of overwriting the source + * memory data is eliminated when the distance between src and + * dst is less than 16. The memory accesses here are alignment. + */ + tbz tmp2, #0, 1f + ldrb1 tmp1w, src, #1 + strb1 tmp1w, dst, #1 +1: + tbz tmp2, #1, 2f + ldrh1 tmp1w, src, #2 + strh1 tmp1w, dst, #2 +2: + tbz tmp2, #2, 3f + ldr1 tmp1w, src, #4 + str1 tmp1w, dst, #4 +3: + tbz tmp2, #3, .LSrcAligned + ldr1 tmp1, src, #8 + str1 tmp1, dst, #8 + +.LSrcAligned: + cmp count, #64 + b.ge .Lcpy_over64 + /* + * Deal with small copies quickly by dropping straight into the + * exit block. + */ +.Ltail63: + /* + * Copy up to 48 bytes of data. At this point we only need the + * bottom 6 bits of count to be accurate. + */ + ands tmp1, count, #0x30 + b.eq .Ltiny15 + cmp tmp1w, #0x20 + b.eq 1f + b.lt 2f + ldp2 A_l, A_h, src, #0 + stp2 A_l, A_h, dst, #0 + add src, src, #16 + add dst, dst, #16 +1: + ldp2 A_l, A_h, src, #0 + stp2 A_l, A_h, dst, #0 + add src, src, #16 + add dst, dst, #16 +2: + ldp2 A_l, A_h, src, #0 + stp2 A_l, A_h, dst, #0 + add src, src, #16 + add dst, dst, #16 +.Ltiny15: + /* + * Prefer to break one ldp/stp into several load/store to access + * memory in an increasing address order,rather than to load/store 16 + * bytes from (src-16) to (dst-16) and to backward the src to aligned + * address,which way is used in original cortex memcpy. If keeping + * the original memcpy process here, memmove need to satisfy the + * precondition that src address is at least 16 bytes bigger than dst + * address,otherwise some source data will be overwritten when memove + * call memcpy directly. To make memmove simpler and decouple the + * memcpy's dependency on memmove, withdrew the original process. + */ + tbz count, #3, 1f + ldr1 tmp1, src, #8 + str1 tmp1, dst, #8 +1: + tbz count, #2, 2f + ldr1 tmp1w, src, #4 + str1 tmp1w, dst, #4 +2: + tbz count, #1, 3f + ldrh1 tmp1w, src, #2 + strh1 tmp1w, dst, #2 +3: + tbz count, #0, .Lexitfunc + ldrb1 tmp1w, src, #1 + strb1 tmp1w, dst, #1 + + b .Lexitfunc + +.Lcpy_over64: + subs count, count, #128 + b.ge .Lcpy_body_large + /* + * Less than 128 bytes to copy, so handle 64 here and then jump + * to the tail. + */ + ldp2 A_l, A_h, src, #0 + stp2 A_l, A_h, dst, #0 + ldp2 B_l, B_h, src, #16 + ldp2 C_l, C_h, src, #32 + stp2 B_l, B_h, dst, #16 + stp2 C_l, C_h, dst, #32 + ldp2 D_l, D_h, src, #48 + stp2 D_l, D_h, dst, #48 + add src, src, #64 + add dst, dst, #64 + + tst count, #0x3f + b.ne .Ltail63 + b .Lexitfunc + + /* + * Critical loop. Start at a new cache line boundary. Assuming + * 64 bytes per line this ensures the entire loop is in one line. + */ + .p2align L1_CACHE_SHIFT +.Lcpy_body_large: + + /* pre-get 64 bytes data. */ + ldp2 A_l, A_h, src, #0 + ldp2 B_l, B_h, src, #16 + ldp2 C_l, C_h, src, #32 + ldp2 D_l, D_h, src, #48 + add src, src, #64 +1: + /* + * interlace the load of next 64 bytes data block with store of the last + * loaded 64 bytes data. + */ + stp2 A_l, A_h, dst, #0 + ldp2 A_l, A_h, src, #0 + stp2 B_l, B_h, dst, #16 + ldp2 B_l, B_h, src, #16 + stp2 C_l, C_h, dst, #32 + ldp2 C_l, C_h, src, #32 + stp2 D_l, D_h, dst, #48 + ldp2 D_l, D_h, src, #48 + add dst, dst, #64 + add src, src, #64 + subs count, count, #64 + b.ge 1b + + /* Post-loop: store the last block of data using stp2 */ + /* (without post-increment) */ + stp2 A_l, A_h, dst, #0 + stp2 B_l, B_h, dst, #16 + stp2 C_l, C_h, dst, #32 + stp2 D_l, D_h, dst, #48 + add dst, dst, #64 + + tst count, #0x3f + b.ne .Ltail63 +.Lexitfunc: -- 2.43.0

2 1

[PATCH OLK-6.6] [Backport] mm: refactor mm_access() to not return NULL
by Tang Hui 07 Aug '26

07 Aug '26

From: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> stable inclusion from stable-v6.6.146 commit d8a1f7420d2d58fcbde479bd72d0900fb512cb2d category: bugfix bugzilla: NA CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cd3f8467afd470ccab0de2fbc7c76664af4a0bac ] mm_access() can return NULL if the mm is not found, but this is handled the same as an error in all callers, with some translating this into an -ESRCH error. Only proc_mem_open() returns NULL if no mm is found, however in this case it is clearer and makes more sense to explicitly handle the error. Additionally we take the opportunity to refactor the function to eliminate unnecessary nesting. d8a1f7420d2d58fcbde479bd72d0900fb512cb2d Simplify things by simply returning -ESRCH if no mm is found - this both eliminates confusing use of the IS_ERR_OR_NULL() macro, and simplifies callers which would return -ESRCH by returning this error directly. [lorenzo.stoakes(a)oracle.com: prefer neater pointer error comparison] Link: https://lkml.kernel.org/r/2fae1834-749a-45e1-8594-5e5979cf7103@lucifer.local Link: https://lkml.kernel.org/r/20240924201023.193135-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Suggested-by: Arnd Bergmann <arnd(a)arndb.de> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tang Hui <tanghui20(a)huawei.com> --- fs/proc/base.c | 26 ++++++++++++++------------ kernel/fork.c | 5 +++-- mm/madvise.c | 4 ++-- mm/process_vm_access.c | 4 ++-- 4 files changed, 21 insertions(+), 18 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index cac883cf29fa..7ee2285910bb 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -815,19 +815,21 @@ static const struct file_operations proc_single_file_operations = { struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) { struct task_struct *task = get_proc_task(inode); - struct mm_struct *mm = ERR_PTR(-ESRCH); + struct mm_struct *mm; - if (task) { - mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); - put_task_struct(task); + if (!task) + return ERR_PTR(-ESRCH); - if (!IS_ERR_OR_NULL(mm)) { - /* ensure this mm_struct can't be freed */ - mmgrab(mm); - /* but do not pin its memory */ - mmput(mm); - } - } + mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); + put_task_struct(task); + + if (IS_ERR(mm)) + return mm == ERR_PTR(-ESRCH) ? NULL : mm; + + /* ensure this mm_struct can't be freed */ + mmgrab(mm); + /* but do not pin its memory */ + mmput(mm); return mm; } @@ -2205,7 +2207,7 @@ static int map_files_d_revalidate(struct dentry *dentry, unsigned int flags) goto out_notask; mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); - if (IS_ERR_OR_NULL(mm)) + if (IS_ERR(mm)) goto out; if (!dname_to_vma_addr(dentry, &vm_start, &vm_end)) { diff --git a/kernel/fork.c b/kernel/fork.c index e92ddc0a0c66..7f188d166f35 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1676,8 +1676,9 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) return ERR_PTR(err); mm = get_task_mm(task); - if (mm && mm != current->mm && - !ptrace_may_access(task, mode)) { + if (!mm) { + mm = ERR_PTR(-ESRCH); + } else if (mm != current->mm && !ptrace_may_access(task, mode)) { mmput(mm); mm = ERR_PTR(-EACCES); } diff --git a/mm/madvise.c b/mm/madvise.c index 4b7956dd6357..7fb856fc7eec 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -1846,8 +1846,8 @@ SYSCALL_DEFINE5(process_madvise, int, pidfd, const struct iovec __user *, vec, /* Require PTRACE_MODE_READ to avoid leaking ASLR metadata. */ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); - if (IS_ERR_OR_NULL(mm)) { - ret = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; + if (IS_ERR(mm)) { + ret = PTR_ERR(mm); goto release_task; } diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c index 0523edab03a6..5be8e91aa872 100644 --- a/mm/process_vm_access.c +++ b/mm/process_vm_access.c @@ -200,8 +200,8 @@ static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter, } mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS); - if (!mm || IS_ERR(mm)) { - rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; + if (IS_ERR(mm)) { + rc = PTR_ERR(mm); /* * Explicitly map EACCES to EPERM as EPERM is a more * appropriate error code for process_vw_readv/writev -- 2.34.1

1 0

[PATCH OLK-6.6] erofs: fix stack-out-of-bounds in erofs_put_metabuf
by Liu Mingrui 07 Aug '26

07 Aug '26

From: Mingrui Liu <liumingrui(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16872 -------------------------------- Commit 1d4b040dd8ee moved erofs_put_metabuf() to out_unlock, but some error paths jump there before buf is initialized, unlike mainline where buf is always set. This triggers : BUG: KASAN: stack-out-of-bounds in erofs_put_metabuf+0x54/0x158 [erofs] Call Trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x78/0xc8 print_address_description.constprop.0+0x84/0x3c8 print_report+0xb0/0x280 kasan_report+0x84/0xd0 __asan_load8+0x9c/0xc0 erofs_put_metabuf+0x54/0x158 [erofs] erofs_init_inode_xattrs+0x194/0x560 [erofs] erofs_getxattr+0xc8/0x238 [erofs] erofs_get_acl+0x6c/0x150 [erofs] __get_acl.part.0+0x218/0x390 vfs_get_acl+0xd0/0x150 do_get_acl+0x38/0x2a0 do_getxattr+0x9c/0x250 getxattr+0xe0/0x148 path_getxattr+0xdc/0x150 __arm64_sys_getxattr+0x60/0x80 invoke_syscall+0x64/0x178 el0_svc_common.constprop.0+0x11c/0x150 do_el0_svc+0x38/0x50 el0_svc+0x44/0x228 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0 Fix by zero-initializing buf at declaration so erofs_put_metabuf() can safely handle it. Fixes: 1d4b040dd8ee ("[Backport] erofs: fix metabuf leak in inode xattr initialization") Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- fs/erofs/xattr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c index b270226be379..abd23e990a3a 100644 --- a/fs/erofs/xattr.c +++ b/fs/erofs/xattr.c @@ -34,6 +34,8 @@ static int erofs_init_inode_xattrs(struct inode *inode) struct super_block *sb = inode->i_sb; int ret = 0; + it.buf = __EROFS_BUF_INITIALIZER; + /* the most case is that xattrs of this inode are initialized. */ if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags)) { /* @@ -76,7 +78,6 @@ static int erofs_init_inode_xattrs(struct inode *inode) goto out_unlock; } - it.buf = __EROFS_BUF_INITIALIZER; erofs_init_metabuf(&it.buf, sb); it.pos = erofs_iloc(inode) + vi->inode_isize; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Backport CVE-2026-64361 fixes from 6.6 LTS
by Pan Taixi 07 Aug '26

07 Aug '26

Bacport "hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length" and its antecedent patch "hfs/hfsplus: prevent getting negative values of offset/length" Tristan Madani (1): hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length Viacheslav Dubeyko (1): hfs/hfsplus: prevent getting negative values of offset/length fs/hfs/bfind.c | 2 +- fs/hfs/bnode.c | 54 ++++++++++++------------- fs/hfs/brec.c | 2 +- fs/hfs/btree.c | 2 +- fs/hfs/btree.h | 71 +++++++++++++++++---------------- fs/hfs/hfs_fs.h | 88 ++++++++++++++++++++++++----------------- fs/hfs/inode.c | 3 +- fs/hfsplus/bfind.c | 2 +- fs/hfsplus/bnode.c | 60 ++++++++++++++-------------- fs/hfsplus/brec.c | 2 +- fs/hfsplus/btree.c | 2 +- fs/hfsplus/hfsplus_fs.h | 40 +++++++++---------- 12 files changed, 173 insertions(+), 155 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] sched: Add the qos schduler's cgroup v2 interface
by Chen Jinghuang 07 Aug '26

07 Aug '26

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8MF4R -------------------------------- Add the qos schduler's cgroup v2 interface. Cgroup v2 use the qos scheduler, as follows: offline group: echo -1 > /sys/fs/cgroup/xxxx/offline/cpu.qos_level online group: /sys/fs/cgroup/xxxx/online/cpu.qos_level Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index cdc931c14930..fd8fdaaf7cbb 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -10660,6 +10660,14 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#endif +#ifdef CONFIG_QOS_SCHED + { + .name = "qos_level", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_qos_read, + .write_s64 = cpu_qos_write, + }, #ifdef CONFIG_SCHED_SOFT_DOMAIN { .name = "soft_domain", -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Backport CVE-2026-64361 fixes from 6.6 LTS
by Pan Taixi 07 Aug '26

07 Aug '26

Bacport "hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length" and its antecedent patch "hfs/hfsplus: prevent getting negative values of offset/length" Tristan Madani (1): hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length Viacheslav Dubeyko (1): hfs/hfsplus: prevent getting negative values of offset/length fs/hfs/bfind.c | 2 +- fs/hfs/bnode.c | 54 ++++++++++++------------- fs/hfs/brec.c | 2 +- fs/hfs/btree.c | 2 +- fs/hfs/btree.h | 71 +++++++++++++++++---------------- fs/hfs/hfs_fs.h | 88 ++++++++++++++++++++++++----------------- fs/hfs/inode.c | 3 +- fs/hfsplus/bfind.c | 2 +- fs/hfsplus/bnode.c | 60 ++++++++++++++-------------- fs/hfsplus/brec.c | 2 +- fs/hfsplus/btree.c | 2 +- fs/hfsplus/hfsplus_fs.h | 40 +++++++++---------- 12 files changed, 173 insertions(+), 155 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] NFSv4/flexfiles: reject zero filehandle version count
by Zhou Minqiang 07 Aug '26

07 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16112 CVE: CVE-2026-53392 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists. Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser. A QEMU/KASAN run with a malformed flexfiles layout hit: KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly. Cc: stable(a)vger.kernel.org Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)hammerspace.com> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/nfs/flexfilelayout/flexfilelayout.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c index 81843dd8b0ee..73ef9a88208f 100644 --- a/fs/nfs/flexfilelayout/flexfilelayout.c +++ b/fs/nfs/flexfilelayout/flexfilelayout.c @@ -459,6 +459,10 @@ ff_layout_alloc_lseg(struct pnfs_layout_hdr *lh, if (!p) goto out_err_free; fh_count = be32_to_cpup(p); + if (fh_count == 0) { + rc = -EINVAL; + goto out_err_free; + } fls->mirror_array[i]->fh_versions = kcalloc(fh_count, sizeof(struct nfs_fh), -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS] smb/client: fix chown/chgrp with SMB3 POSIX Extensions
by Zhou Minqiang 07 Aug '26

07 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 760ef2c579c2609cf17fb1cd5392f64d42d43d33 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16820 CVE: CVE-2026-64388 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set. Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map and set the ownership/group information on the server. Cc: stable(a)vger.kernel.org Signed-off-by: Ralph Boehme <slow(a)samba.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/inode.c fs/smb/client/inode.c [cxt conflicts] Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/cifs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index d30eb4350656..e5d0066f6125 100644 --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -2447,7 +2447,8 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) gid = attrs->ia_gid; #ifdef CONFIG_CIFS_ACL - if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) { + if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) || + cifs_sb_master_tcon(cifs_sb)->posix_extensions) { if (uid_valid(uid) || gid_valid(gid)) { rc = id_mode_to_cifs_acl(inode, full_path, NO_CHANGE_64, uid, gid); -- 2.52.0

2 1

[PATCH OLK-5.10 0/5] CVE-2026-53120
by Ziming Du 07 Aug '26

07 Aug '26

patches for CVE-2026-53120 Danilo Krummrich (1): PCI: use generic driver_override infrastructure Samiullah Khawaja (1): PCI: Initialize temporary device in new_id_store() Zhenzhong Duan (2): PCI: Move pci_match_device() ahead of new_id_store() PCI: Avoid duplicate IDs in driver dynamic IDs list Ziming Du (1): [Huawei] PCI: fix kabi breakage due to driver_override removal drivers/pci/pci-driver.c | 161 +++++++++++++++-------------- drivers/pci/pci-sysfs.c | 48 --------- drivers/pci/probe.c | 1 - drivers/vfio/pci/vfio_pci.c | 4 +- drivers/xen/xen-pciback/pci_stub.c | 6 +- include/linux/pci.h | 2 +- 6 files changed, 93 insertions(+), 129 deletions(-) -- 2.43.0

2 6

[PATCH OLK-6.6 0/3] CVE-2026-53120
by Ziming Du 07 Aug '26

07 Aug '26

CVE-2026-53120 Danilo Krummrich (1): PCI: use generic driver_override infrastructure Samiullah Khawaja (1): PCI: Initialize temporary device in new_id_store() Ziming Du (1): PCI: fix kabi breakage due to driver_override removal drivers/pci/pci-driver.c | 20 +++++++++++++++----- drivers/pci/pci-sysfs.c | 28 ---------------------------- drivers/pci/probe.c | 1 - drivers/vfio/pci/vfio_pci_core.c | 4 ++-- drivers/xen/xen-pciback/pci_stub.c | 6 ++++-- include/linux/pci.h | 7 +------ 6 files changed, 22 insertions(+), 44 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/4] CVE-2026-64405 fixes
by Tang Hui 06 Aug '26

06 Aug '26

CVE-2026-64405 fixes. Luiz Augusto von Dentz (2): [Backport] Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state [Backport] Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle Pauli Virtanen (1): [Backport] Bluetooth: separate CIS_LINK and BIS_LINK link types Siwei Zhang (1): [Backport] Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() include/net/bluetooth/hci.h | 3 +- include/net/bluetooth/hci_core.h | 38 ++++---- net/bluetooth/hci_conn.c | 56 +++++------- net/bluetooth/hci_core.c | 21 +++-- net/bluetooth/hci_event.c | 25 +++--- net/bluetooth/hci_sync.c | 149 ++++++++++++++++++++++++++----- net/bluetooth/iso.c | 4 +- net/bluetooth/mgmt.c | 3 +- 8 files changed, 206 insertions(+), 93 deletions(-) -- 2.34.1

1 4

[PATCH OLK-5.10] KVM: SEV: Ignore Port I/O requests of length '0'
by Zhang Kunbo 06 Aug '26

06 Aug '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.12.95 commit 3b6035bc6bff20e89752ce4358bc4c9a9d5883f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16267 CVE: CVE-2026-63940 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3988bd2723de407ae90fa7a6f6029b4e60238c58 upstream. Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0. Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT") Cc: stable(a)vger.kernel.org Reviewed-by: Tom Lendacky <thomas.lendacky(a)amd.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-ID: <20260501202250.2115252-5-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Jack Wang <jinpu.wang(a)ionos.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/svm/sev.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index c711a6369c13..79ebbe8cf0b4 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -2791,6 +2791,11 @@ int sev_handle_vmgexit(struct vcpu_svm *svm) "vmgexit: unsupported event - exit_info_1=%#llx, exit_info_2=%#llx\n", control->exit_info_1, control->exit_info_2); break; + case SVM_EXIT_IOIO: + if (!((control->exit_info_1 & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT)) + return 1; + + fallthrough; default: ret = svm_invoke_exit_handler(svm, exit_code); } @@ -2810,6 +2815,9 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in) if (unlikely(check_mul_overflow(count, size, &bytes))) return -EINVAL; + if (!bytes) + return 1; + if (!setup_vmgexit_scratch(svm, in, bytes)) return -EINVAL; -- 2.34.1

2 1

[PATCH OLK-6.6] x86/bugs: Enable IBPB flush on BPF JIT allocation
by Zhang Kunbo 06 Aug '26

06 Aug '26

From: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> stable inclusion from stable-v6.6.145 commit cb27f3bf915cc0f20fc0c48da9059304e39ebd35 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16808 CVE: CVE-2026-64507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a3af84b0fa00ead01fcd0e28b5d773ff25990a0d upstream. Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence. This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n. [ pawan: Use entry_ibpb() instead of write_ibpb(). JIT hardening enable moved to spectre_v2_select_mitigation() because there is no spectre_v2_apply_mitigation()] Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Dave Hansen <dave.hansen(a)linux.intel.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/x86/include/asm/nospec-branch.h [context conflicts] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/include/asm/nospec-branch.h | 4 +++ arch/x86/kernel/cpu/bugs.c | 50 +++++++++++++++++++++++++--- 2 files changed, 49 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h index 58dda23aee1b..d4eae71b2ab7 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -408,6 +408,10 @@ extern void srso_alias_untrain_ret(void); extern void entry_untrain_ret(void); extern void write_ibpb(void); +#ifdef CONFIG_BPF_JIT +extern void bpf_arch_ibpb(void); +#endif + #ifdef CONFIG_X86_64 extern void clear_bhb_loop(void); #endif diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 212408f6de11..e53ea50132e7 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -16,6 +16,7 @@ #include <linux/sched/smt.h> #include <linux/pgtable.h> #include <linux/bpf.h> +#include <linux/filter.h> #include <asm/spec-ctrl.h> #include <asm/cmdline.h> @@ -1312,8 +1313,21 @@ static inline const char *spectre_v2_module_string(void) { return spectre_v2_bad_module ? " - vulnerable module loaded" : ""; } + +/* + * The "retpoline sequence" is the "call;mov;ret" sequence that + * replaces normal indirect branch instructions. Differentiate + * *the* retpoline sequence from the LFENCE-prefixed indirect + * branches that simply use the retpoline infrastructure. + */ +static inline bool retpoline_seq_enabled(void) +{ + return boot_cpu_has(X86_FEATURE_RETPOLINE) && !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE); +} + #else static inline const char *spectre_v2_module_string(void) { return ""; } +static inline bool retpoline_seq_enabled(void) { return false; } #endif #define SPECTRE_V2_LFENCE_MSG "WARNING: LFENCE mitigation is not recommended for this CPU, data leaks possible!\n" @@ -1787,8 +1801,7 @@ static void __init bhi_select_mitigation(void) return; /* Retpoline mitigates against BHI unless the CPU has RRSBA behavior */ - if (boot_cpu_has(X86_FEATURE_RETPOLINE) && - !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE)) { + if (retpoline_seq_enabled()) { spec_ctrl_disable_kernel_rrsba(); if (rrsba_disabled) return; @@ -1810,6 +1823,27 @@ static void __init bhi_select_mitigation(void) pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n"); } +#ifdef CONFIG_BPF_JIT +static void __bpf_arch_ibpb(void *unused) +{ + entry_ibpb(); +} + +void bpf_arch_ibpb(void) +{ + on_each_cpu(__bpf_arch_ibpb, NULL, 1); +} + +static bool __init cpu_wants_ibpb_bpf(void) +{ + /* A genuine retpoline already neutralizes ring0 indirect predictions */ + if (retpoline_seq_enabled()) + return false; + + return boot_cpu_has(X86_FEATURE_IBPB); +} +#endif + static void __init spectre_v2_select_mitigation(void) { enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); @@ -1955,6 +1989,14 @@ static void __init spectre_v2_select_mitigation(void) pr_info("Enabling Restricted Speculation for firmware calls\n"); } +#ifdef CONFIG_BPF_JIT + if (cpu_wants_ibpb_bpf()) { + static_call_update(bpf_arch_pred_flush, bpf_arch_ibpb); + static_branch_enable(&bpf_pred_flush_enabled); + pr_info("Enabling IBPB for BPF\n"); + } +#endif + /* Set up IBPB and STIBP depending on the general spectre V2 command */ spectre_v2_cmd = cmd; } @@ -3113,9 +3155,7 @@ static const char *spectre_bhi_state(void) return "; BHI: BHI_DIS_S"; else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP)) return "; BHI: SW loop, KVM: SW loop"; - else if (boot_cpu_has(X86_FEATURE_RETPOLINE) && - !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE) && - rrsba_disabled) + else if (retpoline_seq_enabled() && rrsba_disabled) return "; BHI: Retpoline"; else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT)) return "; BHI: Vulnerable, KVM: SW loop"; -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] CVE-2026-53120
by Ziming Du 06 Aug '26

06 Aug '26

CVE-2026-53120 Danilo Krummrich (1): PCI: use generic driver_override infrastructure Samiullah Khawaja (1): PCI: Initialize temporary device in new_id_store() Ziming Du (1): PCI: fix kabi breakage due to driver_override removal drivers/pci/pci-driver.c | 20 +++++++++++++++----- drivers/pci/pci-sysfs.c | 28 ---------------------------- drivers/pci/probe.c | 1 - drivers/vfio/pci/vfio_pci_core.c | 4 ++-- drivers/xen/xen-pciback/pci_stub.c | 6 ++++-- include/linux/pci.h | 7 +------ 6 files changed, 22 insertions(+), 44 deletions(-) -- 2.43.0

2 4

[PATCH OLK-5.10] PCI: Fix pci_slot_trylock() error handling
by Ziming Du 06 Aug '26

06 Aug '26

From: Jinhui Guo <guojinhui.liam(a)bytedance.com> stable inclusion from stable-v5.10.252 commit ebb27b7399ab8b9eb1f792b329aa5f6250c590d4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14757 CVE: CVE-2026-43211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9368d1ee62829b08aa31836b3ca003803caf0b72 ] Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_slot_trylock(), but it forgets to remove the corresponding pci_dev_unlock() when pci_bus_trylock() fails. Before a4e772898f8b, the code did: if (!pci_dev_trylock(dev)) /* <- lock bridge device */ goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); /* <- unlock bridge device */ goto unlock; } } After a4e772898f8b the bridge-device lock is no longer taken, but the pci_dev_unlock(dev) on the failure path was left in place, leading to the bug. This yields one of two errors: 1. A warning that the lock is being unlocked when no one holds it. 2. An incorrect unlock of a lock that belongs to another thread. Fix it by removing the now-redundant pci_dev_unlock(dev) on the failure path. [Same patch later posted by Keith at https://patch.msgid.link/20260116184150.3013258-1-kbusch@meta.com] Fixes: a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") Signed-off-by: Jinhui Guo <guojinhui.liam(a)bytedance.com> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20251212145528.2555-1-guojinhui.liam@bytedance.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/pci/pci.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 450228913544c..109b245210222 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5391,10 +5391,8 @@ static int pci_slot_trylock(struct pci_slot *slot) if (!dev->slot || dev->slot != slot) continue; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } } else if (!pci_dev_trylock(dev)) goto unlock; } -- 2.43.0

2 1

[PATCH OLK-5.10 0/5] CVE-2026-53120
by Ziming Du 06 Aug '26

06 Aug '26

patches for CVE-2026-53120 Danilo Krummrich (1): PCI: use generic driver_override infrastructure Samiullah Khawaja (1): PCI: Initialize temporary device in new_id_store() Zhenzhong Duan (2): PCI: Move pci_match_device() ahead of new_id_store() PCI: Avoid duplicate IDs in driver dynamic IDs list Ziming Du (1): [Huawei] PCI: fix kabi breakage due to driver_override removal drivers/pci/pci-driver.c | 161 +++++++++++++++-------------- drivers/pci/pci-sysfs.c | 48 --------- drivers/pci/probe.c | 1 - drivers/vfio/pci/vfio_pci.c | 4 +- drivers/xen/xen-pciback/pci_stub.c | 6 +- include/linux/pci.h | 2 +- 6 files changed, 93 insertions(+), 129 deletions(-) -- 2.43.0

2 6

[PATCH OLK-6.6 0/4] CVE-2026-64405 fixes
by Hui Tang 06 Aug '26

06 Aug '26

CVE-2026-64405 fixes Luiz Augusto von Dentz (2): [Backport] Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state [Backport] Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle Pauli Virtanen (1): [Backport] Bluetooth: separate CIS_LINK and BIS_LINK link types Siwei Zhang (1): [Backport] Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() include/net/bluetooth/hci.h | 3 +- include/net/bluetooth/hci_core.h | 38 ++++---- net/bluetooth/hci_conn.c | 56 +++++------- net/bluetooth/hci_core.c | 21 +++-- net/bluetooth/hci_event.c | 25 +++--- net/bluetooth/hci_sync.c | 149 ++++++++++++++++++++++++++----- net/bluetooth/iso.c | 4 +- net/bluetooth/mgmt.c | 3 +- 8 files changed, 206 insertions(+), 93 deletions(-) -- 2.34.1

1 4

[PATCH OLK-6.6 1/4] [Backport] Bluetooth: separate CIS_LINK and BIS_LINK link types
by Hui Tang 06 Aug '26

06 Aug '26

From: Pauli Virtanen <pav(a)iki.fi> stable inclusion from stable-v6.6.145 commit 436b54dfa0fb7c3e4e194beea5d635da88c4a311 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 23205562ffc8de20f57afdd984858cab29e77968 ] Use separate link type id for unicast and broadcast ISO connections. These connection types are handled with separate HCI commands, socket API is different, and hci_conn has union fields that are different in the two cases, so they shall not be mixed up. Currently in most places it is attempted to distinguish ucast by bacmp(&c->dst, BDADDR_ANY) but it is wrong as dst is set for bcast sink hci_conn in iso_conn_ready(). Additionally checking sync_handle might be OK, but depends on details of bcast conn configuration flow. To avoid complicating it, use separate link types. Fixes: f764a6c2c1e4 ("Bluetooth: ISO: Add broadcast support") Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Stable-dep-of: 12917f591cea ("Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/bluetooth/hci_event.c net/bluetooth/hci_conn.c [Context differences.] Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- include/net/bluetooth/hci.h | 3 ++- include/net/bluetooth/hci_core.h | 38 ++++++++++++++++++-------------- net/bluetooth/hci_conn.c | 35 +++++++++++++++++------------ net/bluetooth/hci_core.c | 21 +++++++++++------- net/bluetooth/hci_event.c | 25 +++++++++++---------- net/bluetooth/hci_sync.c | 14 +++++++----- net/bluetooth/iso.c | 4 ++-- net/bluetooth/mgmt.c | 3 ++- 8 files changed, 83 insertions(+), 60 deletions(-) diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index 0439600a04da..649ed9632880 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -543,7 +543,8 @@ enum { #define ESCO_LINK 0x02 /* Low Energy links do not have defined link type. Use invented one */ #define LE_LINK 0x80 -#define ISO_LINK 0x82 +#define CIS_LINK 0x82 +#define BIS_LINK 0x83 #define INVALID_LINK 0xff /* LMP features */ diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 4726fb144ee9..1d678fb8cc42 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -1003,7 +1003,8 @@ static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c) case ESCO_LINK: h->sco_num++; break; - case ISO_LINK: + case CIS_LINK: + case BIS_LINK: h->iso_num++; break; } @@ -1029,7 +1030,8 @@ static inline void hci_conn_hash_del(struct hci_dev *hdev, struct hci_conn *c) case ESCO_LINK: h->sco_num--; break; - case ISO_LINK: + case CIS_LINK: + case BIS_LINK: h->iso_num--; break; } @@ -1046,7 +1048,8 @@ static inline unsigned int hci_conn_num(struct hci_dev *hdev, __u8 type) case SCO_LINK: case ESCO_LINK: return h->sco_num; - case ISO_LINK: + case CIS_LINK: + case BIS_LINK: return h->iso_num; default: return 0; @@ -1107,7 +1110,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_bis(struct hci_dev *hdev, rcu_read_lock(); list_for_each_entry_rcu(c, &h->list, list) { - if (bacmp(&c->dst, ba) || c->type != ISO_LINK) + if (bacmp(&c->dst, ba) || c->type != BIS_LINK) continue; if (c->iso_qos.bcast.bis == bis) { @@ -1131,8 +1134,8 @@ hci_conn_hash_lookup_per_adv_bis(struct hci_dev *hdev, rcu_read_lock(); list_for_each_entry_rcu(c, &h->list, list) { - if (bacmp(&c->dst, ba) || c->type != ISO_LINK || - !test_bit(HCI_CONN_PER_ADV, &c->flags)) + if (bacmp(&c->dst, ba) || c->type != BIS_LINK || + !test_bit(HCI_CONN_PER_ADV, &c->flags)) continue; if (c->iso_qos.bcast.big == big && @@ -1242,7 +1245,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_cis(struct hci_dev *hdev, rcu_read_lock(); list_for_each_entry_rcu(c, &h->list, list) { - if (c->type != ISO_LINK || !bacmp(&c->dst, BDADDR_ANY)) + if (c->type != CIS_LINK) continue; /* Match CIG ID if set */ @@ -1274,7 +1277,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_cig(struct hci_dev *hdev, rcu_read_lock(); list_for_each_entry_rcu(c, &h->list, list) { - if (c->type != ISO_LINK || !bacmp(&c->dst, BDADDR_ANY)) + if (c->type != CIS_LINK) continue; if (handle == c->iso_qos.ucast.cig) { @@ -1297,7 +1300,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_big(struct hci_dev *hdev, rcu_read_lock(); list_for_each_entry_rcu(c, &h->list, list) { - if (bacmp(&c->dst, BDADDR_ANY) || c->type != ISO_LINK) + if (bacmp(&c->dst, BDADDR_ANY) || c->type != BIS_LINK) continue; if (handle == c->iso_qos.bcast.big) { @@ -1320,7 +1323,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_big_any_dst(struct hci_dev * rcu_read_lock(); list_for_each_entry_rcu(c, &h->list, list) { - if (c->type != ISO_LINK) + if (c->type != BIS_LINK) continue; if (handle != BT_ISO_QOS_BIG_UNSET && handle == c->iso_qos.bcast.big) { @@ -1343,8 +1346,8 @@ hci_conn_hash_lookup_big_state(struct hci_dev *hdev, __u8 handle, __u16 state) rcu_read_lock(); list_for_each_entry_rcu(c, &h->list, list) { - if (bacmp(&c->dst, BDADDR_ANY) || c->type != ISO_LINK || - c->state != state) + if (c->type != BIS_LINK || bacmp(&c->dst, BDADDR_ANY) || + c->state != state) continue; if (handle == c->iso_qos.bcast.big) { @@ -1367,8 +1370,8 @@ hci_conn_hash_lookup_pa_sync_big_handle(struct hci_dev *hdev, __u8 big) rcu_read_lock(); list_for_each_entry_rcu(c, &h->list, list) { - if (c->type != ISO_LINK || - !test_bit(HCI_CONN_PA_SYNC, &c->flags)) + if (c->type != BIS_LINK || + !test_bit(HCI_CONN_PA_SYNC, &c->flags)) continue; if (c->iso_qos.bcast.big == big) { @@ -1390,8 +1393,8 @@ hci_conn_hash_lookup_pa_sync_handle(struct hci_dev *hdev, __u16 sync_handle) rcu_read_lock(); list_for_each_entry_rcu(c, &h->list, list) { - if (c->type != ISO_LINK || - !test_bit(HCI_CONN_PA_SYNC, &c->flags)) + if (c->type != BIS_LINK || + !test_bit(HCI_CONN_PA_SYNC, &c->flags)) continue; if (c->sync_handle == sync_handle) { @@ -1972,7 +1975,8 @@ static inline int hci_proto_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, case ESCO_LINK: return sco_connect_ind(hdev, bdaddr, flags); - case ISO_LINK: + case CIS_LINK: + case BIS_LINK: return iso_connect_ind(hdev, bdaddr, flags); default: diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index ee3e842404d1..09b03686f913 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -870,9 +870,11 @@ static void cis_cleanup(struct hci_conn *conn) /* Check if ISO connection is a CIS and remove CIG if there are * no other connections using it. */ - hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_BOUND, &d); - hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_CONNECT, &d); - hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, BT_CONNECTED, &d); + hci_conn_hash_list_state(hdev, find_cis, CIS_LINK, BT_BOUND, &d); + hci_conn_hash_list_state(hdev, find_cis, CIS_LINK, BT_CONNECT, + &d); + hci_conn_hash_list_state(hdev, find_cis, CIS_LINK, BT_CONNECTED, + &d); if (d.count) return; @@ -895,7 +897,8 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t if (!hdev->acl_mtu) return ERR_PTR(-ECONNREFUSED); break; - case ISO_LINK: + case CIS_LINK: + case BIS_LINK: if (hdev->iso_mtu) /* Dedicated ISO Buffer exists */ break; @@ -959,7 +962,8 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t hci_copy_identity_address(hdev, &conn->src, &conn->src_type); conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; break; - case ISO_LINK: + case CIS_LINK: + case BIS_LINK: /* conn->src should reflect the local identity address */ hci_copy_identity_address(hdev, &conn->src, &conn->src_type); @@ -1079,7 +1083,8 @@ static void hci_conn_cleanup_child(struct hci_conn *conn, u8 reason) if (HCI_CONN_HANDLE_UNSET(conn->handle)) hci_conn_failed(conn, reason); break; - case ISO_LINK: + case CIS_LINK: + case BIS_LINK: if ((conn->state != BT_CONNECTED && !test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) || test_bit(HCI_CONN_BIG_CREATED, &conn->flags)) @@ -1154,7 +1159,8 @@ void hci_conn_del(struct hci_conn *conn) hdev->acl_cnt += conn->sent; } else { /* Unacked ISO frames */ - if (conn->type == ISO_LINK) { + if (conn->type == CIS_LINK || + conn->type == BIS_LINK) { if (hdev->iso_pkts) hdev->iso_cnt += conn->sent; else if (hdev->le_pkts) @@ -1525,7 +1531,7 @@ static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst, memcmp(conn->le_per_adv_data, base, base_len))) return ERR_PTR(-EADDRINUSE); - conn = hci_conn_add_unset(hdev, ISO_LINK, dst, HCI_ROLE_MASTER); + conn = hci_conn_add_unset(hdev, BIS_LINK, dst, HCI_ROLE_MASTER); if (IS_ERR(conn)) return conn; @@ -1731,7 +1737,7 @@ static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos) data.count = 0; /* Create a BIS for each bound connection */ - hci_conn_hash_list_state(hdev, bis_list, ISO_LINK, + hci_conn_hash_list_state(hdev, bis_list, BIS_LINK, BT_BOUND, &data); cp.handle = qos->bcast.big; @@ -1827,12 +1833,12 @@ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos) for (data.cig = 0x00; data.cig < 0xf0; data.cig++) { data.count = 0; - hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, + hci_conn_hash_list_state(hdev, find_cis, CIS_LINK, BT_CONNECT, &data); if (data.count) continue; - hci_conn_hash_list_state(hdev, find_cis, ISO_LINK, + hci_conn_hash_list_state(hdev, find_cis, CIS_LINK, BT_CONNECTED, &data); if (!data.count) break; @@ -1882,7 +1888,8 @@ struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst, cis = hci_conn_hash_lookup_cis(hdev, dst, dst_type, qos->ucast.cig, qos->ucast.cis); if (!cis) { - cis = hci_conn_add_unset(hdev, ISO_LINK, dst, HCI_ROLE_MASTER); + cis = hci_conn_add_unset(hdev, CIS_LINK, dst, + HCI_ROLE_MASTER); if (IS_ERR(cis)) return cis; cis->cleanup = cis_cleanup; @@ -1974,7 +1981,7 @@ bool hci_iso_setup_path(struct hci_conn *conn) int hci_conn_check_create_cis(struct hci_conn *conn) { - if (conn->type != ISO_LINK || !bacmp(&conn->dst, BDADDR_ANY)) + if (conn->type != CIS_LINK) return -EINVAL; if (!conn->parent || conn->parent->state != BT_CONNECTED || @@ -2272,7 +2279,7 @@ struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst, * the start periodic advertising and create BIG commands have * been queued */ - hci_conn_hash_list_state(hdev, bis_mark_per_adv, ISO_LINK, + hci_conn_hash_list_state(hdev, bis_mark_per_adv, BIS_LINK, BT_BOUND, &data); /* Queue start periodic advertising and create BIG */ diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index eb9a37ec587b..ae0c4bd4fa5d 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -2913,12 +2913,13 @@ int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb) break; case HCI_ACLDATA_PKT: /* Detect if ISO packet has been sent as ACL */ - if (hci_conn_num(hdev, ISO_LINK)) { + if (hci_conn_num(hdev, CIS_LINK) || + hci_conn_num(hdev, BIS_LINK)) { __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); __u8 type; type = hci_conn_lookup_type(hdev, hci_handle(handle)); - if (type == ISO_LINK) + if (type == CIS_LINK || type == BIS_LINK) hci_skb_pkt_type(skb) = HCI_ISODATA_PKT; } break; @@ -3353,7 +3354,8 @@ static inline void hci_quote_sent(struct hci_conn *conn, int num, int *quote) case LE_LINK: cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt; break; - case ISO_LINK: + case CIS_LINK: + case BIS_LINK: cnt = hdev->iso_mtu ? hdev->iso_cnt : hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt; break; @@ -3367,7 +3369,7 @@ static inline void hci_quote_sent(struct hci_conn *conn, int num, int *quote) } static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, - int *quote) + __u8 type2, int *quote) { struct hci_conn_hash *h = &hdev->conn_hash; struct hci_conn *conn = NULL, *c; @@ -3379,7 +3381,8 @@ static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, rcu_read_lock(); list_for_each_entry_rcu(c, &h->list, list) { - if (c->type != type || skb_queue_empty(&c->data_q)) + if ((c->type != type && c->type != type2) || + skb_queue_empty(&c->data_q)) continue; if (c->state != BT_CONNECTED && c->state != BT_CONFIG) @@ -3582,7 +3585,7 @@ static void hci_sched_sco(struct hci_dev *hdev, __u8 type) else cnt = &hdev->sco_cnt; - while (*cnt && (conn = hci_low_sent(hdev, type, &quote))) { + while (*cnt && (conn = hci_low_sent(hdev, type, type, &quote))) { while (quote-- && (skb = skb_dequeue(&conn->data_q))) { BT_DBG("skb %p len %d", skb, skb->len); hci_send_frame(hdev, skb); @@ -3710,12 +3713,14 @@ static void hci_sched_iso(struct hci_dev *hdev) BT_DBG("%s", hdev->name); - if (!hci_conn_num(hdev, ISO_LINK)) + if (!hci_conn_num(hdev, CIS_LINK) && + !hci_conn_num(hdev, BIS_LINK)) return; cnt = hdev->iso_pkts ? &hdev->iso_cnt : hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt; - while (*cnt && (conn = hci_low_sent(hdev, ISO_LINK, &quote))) { + while (*cnt && (conn = hci_low_sent(hdev, CIS_LINK, BIS_LINK, + &quote))) { while (quote-- && (skb = skb_dequeue(&conn->data_q))) { BT_DBG("skb %p len %d", skb, skb->len); hci_send_frame(hdev, skb); diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 190b5debc0da..b14cf8d6b1f2 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -3797,7 +3797,7 @@ static void hci_unbound_cis_failed(struct hci_dev *hdev, u8 cig, u8 status) lockdep_assert_held(&hdev->lock); list_for_each_entry_safe(conn, tmp, &hdev->conn_hash.list, list) { - if (conn->type != ISO_LINK || !bacmp(&conn->dst, BDADDR_ANY) || + if (conn->type != CIS_LINK || conn->state == BT_OPEN || conn->iso_qos.ucast.cig != cig) continue; @@ -4473,7 +4473,8 @@ static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data, break; - case ISO_LINK: + case CIS_LINK: + case BIS_LINK: if (hdev->iso_pkts) { hdev->iso_cnt += count; if (hdev->iso_cnt > hdev->iso_pkts) @@ -6412,7 +6413,7 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data, hci_dev_clear_flag(hdev, HCI_PA_SYNC); - mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ISO_LINK, &flags); + mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, BIS_LINK, &flags); if (!(mask & HCI_LM_ACCEPT)) { hci_le_pa_term_sync(hdev, ev->handle); goto unlock; @@ -6423,7 +6424,7 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data, if (ev->status) { /* Add connection to indicate the failed PA sync event */ - pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY, + pa_sync = hci_conn_add_unset(hdev, BIS_LINK, BDADDR_ANY, HCI_ROLE_SLAVE); if (!pa_sync) @@ -6450,7 +6451,7 @@ static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data, hci_dev_lock(hdev); - mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags); + mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, BIS_LINK, &flags); if (!(mask & HCI_LM_ACCEPT)) hci_le_pa_term_sync(hdev, ev->sync_handle); @@ -6723,7 +6724,7 @@ static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data, goto unlock; } - if (conn->type != ISO_LINK) { + if (conn->type != CIS_LINK) { bt_dev_err(hdev, "Invalid connection link type handle 0x%4.4x", handle); @@ -6841,7 +6842,7 @@ static void hci_le_cis_req_evt(struct hci_dev *hdev, void *data, if (!acl) goto unlock; - mask = hci_proto_connect_ind(hdev, &acl->dst, ISO_LINK, &flags); + mask = hci_proto_connect_ind(hdev, &acl->dst, CIS_LINK, &flags); if (!(mask & HCI_LM_ACCEPT)) { hci_le_reject_cis(hdev, ev->cis_handle); goto unlock; @@ -6849,8 +6850,8 @@ static void hci_le_cis_req_evt(struct hci_dev *hdev, void *data, cis = hci_conn_hash_lookup_handle(hdev, cis_handle); if (!cis) { - cis = hci_conn_add(hdev, ISO_LINK, &acl->dst, HCI_ROLE_SLAVE, - cis_handle); + cis = hci_conn_add(hdev, CIS_LINK, &acl->dst, + HCI_ROLE_SLAVE, cis_handle); if (IS_ERR(cis)) { hci_le_reject_cis(hdev, ev->cis_handle); goto unlock; @@ -6984,7 +6985,7 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data, bt_dev_dbg(hdev, "ignore too large handle %u", handle); continue; } - bis = hci_conn_add(hdev, ISO_LINK, BDADDR_ANY, + bis = hci_conn_add(hdev, BIS_LINK, BDADDR_ANY, HCI_ROLE_SLAVE, handle); if (IS_ERR(bis)) continue; @@ -7041,7 +7042,7 @@ static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data, hci_dev_lock(hdev); - mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags); + mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, BIS_LINK, &flags); if (!(mask & HCI_LM_ACCEPT)) { hci_le_pa_term_sync(hdev, ev->sync_handle); goto unlock; @@ -7058,7 +7059,7 @@ static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data, goto unlock; /* Add connection to indicate the PA sync event */ - pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY, + pa_sync = hci_conn_add_unset(hdev, BIS_LINK, BDADDR_ANY, HCI_ROLE_SLAVE); if (IS_ERR(pa_sync)) diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 0fdadf4c4d21..2a5555978110 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -2972,7 +2972,7 @@ static int hci_le_set_ext_scan_param_sync(struct hci_dev *hdev, u8 type, if (sent) { struct hci_conn *conn; - conn = hci_conn_hash_lookup_ba(hdev, ISO_LINK, + conn = hci_conn_hash_lookup_ba(hdev, BIS_LINK, &sent->bdaddr); if (conn) { struct bt_iso_qos *qos = &conn->iso_qos; @@ -5605,7 +5605,7 @@ static int hci_connect_cancel_sync(struct hci_dev *hdev, struct hci_conn *conn, if (conn->type == LE_LINK) return hci_le_connect_cancel_sync(hdev, conn, reason); - if (conn->type == ISO_LINK) { + if (conn->type == CIS_LINK) { /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E * page 1857: * @@ -5618,9 +5618,10 @@ static int hci_connect_cancel_sync(struct hci_dev *hdev, struct hci_conn *conn, return hci_disconnect_sync(hdev, conn, reason); /* CIS with no Create CIS sent have nothing to cancel */ - if (bacmp(&conn->dst, BDADDR_ANY)) - return HCI_ERROR_LOCAL_HOST_TERM; + return HCI_ERROR_LOCAL_HOST_TERM; + } + if (conn->type == BIS_LINK) { /* There is no way to cancel a BIS without terminating the BIG * which is done later on connection cleanup. */ @@ -5682,9 +5683,12 @@ static int hci_reject_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, { struct hci_cp_reject_conn_req cp; - if (conn->type == ISO_LINK) + if (conn->type == CIS_LINK) return hci_le_reject_cis_sync(hdev, conn, reason); + if (conn->type == BIS_LINK) + return -EINVAL; + if (conn->type == SCO_LINK || conn->type == ESCO_LINK) return hci_reject_sco_sync(hdev, conn, reason); diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 22b0bc30219f..860b2aacd9af 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -2019,7 +2019,7 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags) static void iso_connect_cfm(struct hci_conn *hcon, __u8 status) { - if (hcon->type != ISO_LINK) { + if (hcon->type != CIS_LINK && hcon->type != BIS_LINK) { if (hcon->type != LE_LINK) return; @@ -2060,7 +2060,7 @@ static void iso_connect_cfm(struct hci_conn *hcon, __u8 status) static void iso_disconn_cfm(struct hci_conn *hcon, __u8 reason) { - if (hcon->type != ISO_LINK) + if (hcon->type != CIS_LINK && hcon->type != BIS_LINK) return; BT_DBG("hcon %p reason %d", hcon, reason); diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 43d027dd11bf..772dfb0c0850 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -3233,7 +3233,8 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, static u8 link_to_bdaddr(u8 link_type, u8 addr_type) { switch (link_type) { - case ISO_LINK: + case CIS_LINK: + case BIS_LINK: case LE_LINK: switch (addr_type) { case ADDR_LE_DEV_PUBLIC: -- 2.34.1

1 3

[PATCH OLK-6.6] crypto: qat - remove unused character device and IOCTLs
by Lu Jialin 06 Aug '26

06 Aug '26

From: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> mainline inclusion from mainline-v7.2-rc1 commit d237230728c567297f2f98b425d63156ab2ed17f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16795 CVE: CVE-2026-64529 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public uAPI header and have no known in-tree or out-of-tree users. Device lifecycle is already managed via sysfs. The ioctl interface also increases the attack surface and is the subject of a number of bug reports. Remove the character device, the IOCTL definitions, and the related data structures (adf_dev_status_info, adf_user_cfg_key_val, adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal module_init/module_exit hooks for workqueue, AER, and crypto/compression algorithm registration. Clean up leftover dead code that was only reachable from the removed IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(), adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(), adf_get_vf_real_id() and the unused ADF_CFG macros. Additionally, drop the entry associated to QAT IOCTLs in ioctl-number.rst. Cc: stable(a)vger.kernel.org Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework") Reported-by: Zhi Wang <wangzhi(a)stu.xidian.edu.cn> Reported-by: Bin Yu <byu(a)xidian.edu.cn> Reported-by: MingYu Wang <w15303746062(a)163.com> Closes: https://lore.kernel.org/all/61d6d499.ab89.19b9b7f3186.Coremail.wangzhi_xd@s… Link: https://lore.kernel.org/all/20260508034841.256794-1-w15303746062@163.com/ Link: https://lore.kernel.org/all/20260508023542.256299-1-w15303746062@163.com/ Link: https://lore.kernel.org/all/20260504025120.98242-1-w15303746062@163.com/ Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Reviewed-by: Ahsan Atta <ahsan.atta(a)intel.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: Documentation/userspace-api/ioctl/ioctl-number.rst drivers/crypto/intel/qat/qat_common/adf_cfg_common.h [Context conflicts] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- .../userspace-api/ioctl/ioctl-number.rst | 1 - drivers/crypto/intel/qat/qat_common/adf_cfg.c | 10 - drivers/crypto/intel/qat/qat_common/adf_cfg.h | 1 - .../intel/qat/qat_common/adf_cfg_common.h | 32 -- .../intel/qat/qat_common/adf_cfg_user.h | 38 -- .../intel/qat/qat_common/adf_common_drv.h | 3 - .../crypto/intel/qat/qat_common/adf_ctl_drv.c | 404 +----------------- .../crypto/intel/qat/qat_common/adf_dev_mgr.c | 70 --- 8 files changed, 1 insertion(+), 558 deletions(-) delete mode 100644 drivers/crypto/intel/qat/qat_common/adf_cfg_user.h diff --git a/Documentation/userspace-api/ioctl/ioctl-number.rst b/Documentation/userspace-api/ioctl/ioctl-number.rst index 66ad52639a28..75d4cd911fb0 100644 --- a/Documentation/userspace-api/ioctl/ioctl-number.rst +++ b/Documentation/userspace-api/ioctl/ioctl-number.rst @@ -219,7 +219,6 @@ Code Seq# Include File Comments <mailto:gregkh@linuxfoundation.org> 'a' all linux/atm*.h, linux/sonet.h ATM on linux <http://lrcwww.epfl.ch/> -'a' 00-0F drivers/crypto/qat/qat_common/adf_cfg_common.h conflict! qat driver 'b' 00-FF conflict! bit3 vme host bridge <mailto:natalia@nikhefk.nikhef.nl> 'b' 00-0F linux/dma-buf.h conflict! diff --git a/drivers/crypto/intel/qat/qat_common/adf_cfg.c b/drivers/crypto/intel/qat/qat_common/adf_cfg.c index b0fc453fa3fb..97273da40b43 100644 --- a/drivers/crypto/intel/qat/qat_common/adf_cfg.c +++ b/drivers/crypto/intel/qat/qat_common/adf_cfg.c @@ -103,16 +103,6 @@ static void adf_cfg_section_del_all(struct list_head *head); static void adf_cfg_section_del_all_except(struct list_head *head, const char *section_name); -void adf_cfg_del_all(struct adf_accel_dev *accel_dev) -{ - struct adf_cfg_device_data *dev_cfg_data = accel_dev->cfg; - - down_write(&dev_cfg_data->lock); - adf_cfg_section_del_all(&dev_cfg_data->sec_list); - up_write(&dev_cfg_data->lock); - clear_bit(ADF_STATUS_CONFIGURED, &accel_dev->status); -} - void adf_cfg_del_all_except(struct adf_accel_dev *accel_dev, const char *section_name) { diff --git a/drivers/crypto/intel/qat/qat_common/adf_cfg.h b/drivers/crypto/intel/qat/qat_common/adf_cfg.h index 2afa6f0d15c5..108032b39242 100644 --- a/drivers/crypto/intel/qat/qat_common/adf_cfg.h +++ b/drivers/crypto/intel/qat/qat_common/adf_cfg.h @@ -34,7 +34,6 @@ void adf_cfg_dev_remove(struct adf_accel_dev *accel_dev); void adf_cfg_dev_dbgfs_add(struct adf_accel_dev *accel_dev); void adf_cfg_dev_dbgfs_rm(struct adf_accel_dev *accel_dev); int adf_cfg_section_add(struct adf_accel_dev *accel_dev, const char *name); -void adf_cfg_del_all(struct adf_accel_dev *accel_dev); void adf_cfg_del_all_except(struct adf_accel_dev *accel_dev, const char *section_name); int adf_cfg_add_key_value_param(struct adf_accel_dev *accel_dev, diff --git a/drivers/crypto/intel/qat/qat_common/adf_cfg_common.h b/drivers/crypto/intel/qat/qat_common/adf_cfg_common.h index 89df3888d7ea..e642438b381d 100644 --- a/drivers/crypto/intel/qat/qat_common/adf_cfg_common.h +++ b/drivers/crypto/intel/qat/qat_common/adf_cfg_common.h @@ -4,18 +4,11 @@ #define ADF_CFG_COMMON_H_ #include <linux/types.h> -#include <linux/ioctl.h> #define ADF_CFG_MAX_STR_LEN 64 #define ADF_CFG_MAX_KEY_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN #define ADF_CFG_MAX_VAL_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN #define ADF_CFG_MAX_SECTION_LEN_IN_BYTES ADF_CFG_MAX_STR_LEN -#define ADF_CFG_BASE_DEC 10 -#define ADF_CFG_BASE_HEX 16 -#define ADF_CFG_ALL_DEVICES 0xFE -#define ADF_CFG_NO_DEVICE 0xFF -#define ADF_CFG_AFFINITY_WHATEVER 0xFF -#define MAX_DEVICE_NAME_SIZE 32 #define ADF_MAX_DEVICES (32 * 32) #define ADF_DEVS_ARRAY_SIZE BITS_TO_LONGS(ADF_MAX_DEVICES) @@ -49,29 +42,4 @@ enum adf_device_type { DEV_4XXX, DEV_420XX, }; - -struct adf_dev_status_info { - enum adf_device_type type; - __u32 accel_id; - __u32 instance_id; - __u8 num_ae; - __u8 num_accel; - __u8 num_logical_accel; - __u8 banks_per_accel; - __u8 state; - __u8 bus; - __u8 dev; - __u8 fun; - char name[MAX_DEVICE_NAME_SIZE]; -}; - -#define ADF_CTL_IOC_MAGIC 'a' -#define IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS _IOW(ADF_CTL_IOC_MAGIC, 0, \ - struct adf_user_cfg_ctl_data) -#define IOCTL_STOP_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 1, \ - struct adf_user_cfg_ctl_data) -#define IOCTL_START_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 2, \ - struct adf_user_cfg_ctl_data) -#define IOCTL_STATUS_ACCEL_DEV _IOW(ADF_CTL_IOC_MAGIC, 3, __u32) -#define IOCTL_GET_NUM_DEVICES _IOW(ADF_CTL_IOC_MAGIC, 4, __s32) #endif diff --git a/drivers/crypto/intel/qat/qat_common/adf_cfg_user.h b/drivers/crypto/intel/qat/qat_common/adf_cfg_user.h deleted file mode 100644 index 421f4fb8b4dd..000000000000 --- a/drivers/crypto/intel/qat/qat_common/adf_cfg_user.h +++ /dev/null @@ -1,38 +0,0 @@ -/* SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0-only) */ -/* Copyright(c) 2014 - 2020 Intel Corporation */ -#ifndef ADF_CFG_USER_H_ -#define ADF_CFG_USER_H_ - -#include "adf_cfg_common.h" -#include "adf_cfg_strings.h" - -struct adf_user_cfg_key_val { - char key[ADF_CFG_MAX_KEY_LEN_IN_BYTES]; - char val[ADF_CFG_MAX_VAL_LEN_IN_BYTES]; - union { - struct adf_user_cfg_key_val *next; - __u64 padding3; - }; - enum adf_cfg_val_type type; -} __packed; - -struct adf_user_cfg_section { - char name[ADF_CFG_MAX_SECTION_LEN_IN_BYTES]; - union { - struct adf_user_cfg_key_val *params; - __u64 padding1; - }; - union { - struct adf_user_cfg_section *next; - __u64 padding3; - }; -} __packed; - -struct adf_user_cfg_ctl_data { - union { - struct adf_user_cfg_section *config_section; - __u64 padding; - }; - __u8 device_id; -} __packed; -#endif diff --git a/drivers/crypto/intel/qat/qat_common/adf_common_drv.h b/drivers/crypto/intel/qat/qat_common/adf_common_drv.h index 8f725950727b..69026143a8d2 100644 --- a/drivers/crypto/intel/qat/qat_common/adf_common_drv.h +++ b/drivers/crypto/intel/qat/qat_common/adf_common_drv.h @@ -68,10 +68,7 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev, void adf_devmgr_rm_dev(struct adf_accel_dev *accel_dev, struct adf_accel_dev *pf); struct list_head *adf_devmgr_get_head(void); -struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id); struct adf_accel_dev *adf_devmgr_pci_to_accel_dev(struct pci_dev *pci_dev); -int adf_devmgr_verify_id(u32 id); -void adf_devmgr_get_num_dev(u32 *num); int adf_devmgr_in_reset(struct adf_accel_dev *accel_dev); int adf_dev_started(struct adf_accel_dev *accel_dev); int adf_dev_restarting_notify(struct adf_accel_dev *accel_dev); diff --git a/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c b/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c index 36bbf808db3e..36d5ebb3efab 100644 --- a/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c +++ b/drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c @@ -2,410 +2,13 @@ /* Copyright(c) 2014 - 2020 Intel Corporation */ #include <crypto/algapi.h> +#include <linux/errno.h> #include <linux/module.h> -#include <linux/mutex.h> -#include <linux/slab.h> -#include <linux/fs.h> -#include <linux/bitops.h> -#include <linux/pci.h> -#include <linux/cdev.h> -#include <linux/uaccess.h> -#include "adf_accel_devices.h" #include "adf_common_drv.h" -#include "adf_cfg.h" -#include "adf_cfg_common.h" -#include "adf_cfg_user.h" - -#define ADF_CFG_MAX_SECTION 512 -#define ADF_CFG_MAX_KEY_VAL 256 - -#define DEVICE_NAME "qat_adf_ctl" - -static DEFINE_MUTEX(adf_ctl_lock); -static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg); - -static const struct file_operations adf_ctl_ops = { - .owner = THIS_MODULE, - .unlocked_ioctl = adf_ctl_ioctl, - .compat_ioctl = compat_ptr_ioctl, -}; - -static const struct class adf_ctl_class = { - .name = DEVICE_NAME, -}; - -struct adf_ctl_drv_info { - unsigned int major; - struct cdev drv_cdev; -}; - -static struct adf_ctl_drv_info adf_ctl_drv; - -static void adf_chr_drv_destroy(void) -{ - device_destroy(&adf_ctl_class, MKDEV(adf_ctl_drv.major, 0)); - cdev_del(&adf_ctl_drv.drv_cdev); - class_unregister(&adf_ctl_class); - unregister_chrdev_region(MKDEV(adf_ctl_drv.major, 0), 1); -} - -static int adf_chr_drv_create(void) -{ - dev_t dev_id; - struct device *drv_device; - int ret; - - if (alloc_chrdev_region(&dev_id, 0, 1, DEVICE_NAME)) { - pr_err("QAT: unable to allocate chrdev region\n"); - return -EFAULT; - } - - ret = class_register(&adf_ctl_class); - if (ret) - goto err_chrdev_unreg; - - adf_ctl_drv.major = MAJOR(dev_id); - cdev_init(&adf_ctl_drv.drv_cdev, &adf_ctl_ops); - if (cdev_add(&adf_ctl_drv.drv_cdev, dev_id, 1)) { - pr_err("QAT: cdev add failed\n"); - goto err_class_destr; - } - - drv_device = device_create(&adf_ctl_class, NULL, - MKDEV(adf_ctl_drv.major, 0), - NULL, DEVICE_NAME); - if (IS_ERR(drv_device)) { - pr_err("QAT: failed to create device\n"); - goto err_cdev_del; - } - return 0; -err_cdev_del: - cdev_del(&adf_ctl_drv.drv_cdev); -err_class_destr: - class_unregister(&adf_ctl_class); -err_chrdev_unreg: - unregister_chrdev_region(dev_id, 1); - return -EFAULT; -} - -static struct adf_user_cfg_ctl_data *adf_ctl_alloc_resources(unsigned long arg) -{ - struct adf_user_cfg_ctl_data *cfg_data; - - cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data)); - if (IS_ERR(cfg_data)) - pr_err("QAT: failed to copy from user cfg_data.\n"); - return cfg_data; -} - -static int adf_add_key_value_data(struct adf_accel_dev *accel_dev, - const char *section, - const struct adf_user_cfg_key_val *key_val) -{ - if (key_val->type == ADF_HEX) { - long *ptr = (long *)key_val->val; - long val = *ptr; - - if (adf_cfg_add_key_value_param(accel_dev, section, - key_val->key, (void *)val, - key_val->type)) { - dev_err(&GET_DEV(accel_dev), - "failed to add hex keyvalue.\n"); - return -EFAULT; - } - } else { - if (adf_cfg_add_key_value_param(accel_dev, section, - key_val->key, key_val->val, - key_val->type)) { - dev_err(&GET_DEV(accel_dev), - "failed to add keyvalue.\n"); - return -EFAULT; - } - } - return 0; -} - -static int adf_copy_key_value_data(struct adf_accel_dev *accel_dev, - struct adf_user_cfg_ctl_data *ctl_data) -{ - struct adf_user_cfg_key_val key_val; - struct adf_user_cfg_key_val *params_head; - struct adf_user_cfg_section section, *section_head; - int i, j; - - section_head = ctl_data->config_section; - - for (i = 0; section_head && i < ADF_CFG_MAX_SECTION; i++) { - if (copy_from_user(&section, (void __user *)section_head, - sizeof(*section_head))) { - dev_err(&GET_DEV(accel_dev), - "failed to copy section info\n"); - goto out_err; - } - - if (adf_cfg_section_add(accel_dev, section.name)) { - dev_err(&GET_DEV(accel_dev), - "failed to add section.\n"); - goto out_err; - } - - params_head = section.params; - - for (j = 0; params_head && j < ADF_CFG_MAX_KEY_VAL; j++) { - if (copy_from_user(&key_val, (void __user *)params_head, - sizeof(key_val))) { - dev_err(&GET_DEV(accel_dev), - "Failed to copy keyvalue.\n"); - goto out_err; - } - if (adf_add_key_value_data(accel_dev, section.name, - &key_val)) { - goto out_err; - } - params_head = key_val.next; - } - section_head = section.next; - } - return 0; -out_err: - adf_cfg_del_all(accel_dev); - return -EFAULT; -} - -static int adf_ctl_ioctl_dev_config(struct file *fp, unsigned int cmd, - unsigned long arg) -{ - struct adf_user_cfg_ctl_data *ctl_data; - struct adf_accel_dev *accel_dev; - int ret = 0; - - ctl_data = adf_ctl_alloc_resources(arg); - if (IS_ERR(ctl_data)) - return PTR_ERR(ctl_data); - - accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); - if (!accel_dev) { - ret = -EFAULT; - goto out; - } - - if (adf_dev_started(accel_dev)) { - ret = -EFAULT; - goto out; - } - - if (adf_copy_key_value_data(accel_dev, ctl_data)) { - ret = -EFAULT; - goto out; - } - set_bit(ADF_STATUS_CONFIGURED, &accel_dev->status); -out: - kfree(ctl_data); - return ret; -} - -static int adf_ctl_is_device_in_use(int id) -{ - struct adf_accel_dev *dev; - - list_for_each_entry(dev, adf_devmgr_get_head(), list) { - if (id == dev->accel_id || id == ADF_CFG_ALL_DEVICES) { - if (adf_devmgr_in_reset(dev) || adf_dev_in_use(dev)) { - dev_info(&GET_DEV(dev), - "device qat_dev%d is busy\n", - dev->accel_id); - return -EBUSY; - } - } - } - return 0; -} - -static void adf_ctl_stop_devices(u32 id) -{ - struct adf_accel_dev *accel_dev; - - list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) { - if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) { - if (!adf_dev_started(accel_dev)) - continue; - - /* First stop all VFs */ - if (!accel_dev->is_vf) - continue; - - adf_dev_down(accel_dev); - } - } - - list_for_each_entry(accel_dev, adf_devmgr_get_head(), list) { - if (id == accel_dev->accel_id || id == ADF_CFG_ALL_DEVICES) { - if (!adf_dev_started(accel_dev)) - continue; - - adf_dev_down(accel_dev); - } - } -} - -static int adf_ctl_ioctl_dev_stop(struct file *fp, unsigned int cmd, - unsigned long arg) -{ - int ret; - struct adf_user_cfg_ctl_data *ctl_data; - - ctl_data = adf_ctl_alloc_resources(arg); - if (IS_ERR(ctl_data)) - return PTR_ERR(ctl_data); - - if (adf_devmgr_verify_id(ctl_data->device_id)) { - pr_err("QAT: Device %d not found\n", ctl_data->device_id); - ret = -ENODEV; - goto out; - } - - ret = adf_ctl_is_device_in_use(ctl_data->device_id); - if (ret) - goto out; - - if (ctl_data->device_id == ADF_CFG_ALL_DEVICES) - pr_info("QAT: Stopping all acceleration devices.\n"); - else - pr_info("QAT: Stopping acceleration device qat_dev%d.\n", - ctl_data->device_id); - - adf_ctl_stop_devices(ctl_data->device_id); - -out: - kfree(ctl_data); - return ret; -} - -static int adf_ctl_ioctl_dev_start(struct file *fp, unsigned int cmd, - unsigned long arg) -{ - int ret; - struct adf_user_cfg_ctl_data *ctl_data; - struct adf_accel_dev *accel_dev; - - ctl_data = adf_ctl_alloc_resources(arg); - if (IS_ERR(ctl_data)) - return PTR_ERR(ctl_data); - - ret = -ENODEV; - accel_dev = adf_devmgr_get_dev_by_id(ctl_data->device_id); - if (!accel_dev) - goto out; - - dev_info(&GET_DEV(accel_dev), - "Starting acceleration device qat_dev%d.\n", - ctl_data->device_id); - - ret = adf_dev_up(accel_dev, false); - - if (ret) { - dev_err(&GET_DEV(accel_dev), "Failed to start qat_dev%d\n", - ctl_data->device_id); - adf_dev_down(accel_dev); - } -out: - kfree(ctl_data); - return ret; -} - -static int adf_ctl_ioctl_get_num_devices(struct file *fp, unsigned int cmd, - unsigned long arg) -{ - u32 num_devices = 0; - - adf_devmgr_get_num_dev(&num_devices); - if (copy_to_user((void __user *)arg, &num_devices, sizeof(num_devices))) - return -EFAULT; - - return 0; -} - -static int adf_ctl_ioctl_get_status(struct file *fp, unsigned int cmd, - unsigned long arg) -{ - struct adf_hw_device_data *hw_data; - struct adf_dev_status_info dev_info; - struct adf_accel_dev *accel_dev; - - if (copy_from_user(&dev_info, (void __user *)arg, - sizeof(struct adf_dev_status_info))) { - pr_err("QAT: failed to copy from user.\n"); - return -EFAULT; - } - - accel_dev = adf_devmgr_get_dev_by_id(dev_info.accel_id); - if (!accel_dev) - return -ENODEV; - - hw_data = accel_dev->hw_device; - dev_info.state = adf_dev_started(accel_dev) ? DEV_UP : DEV_DOWN; - dev_info.num_ae = hw_data->get_num_aes(hw_data); - dev_info.num_accel = hw_data->get_num_accels(hw_data); - dev_info.num_logical_accel = hw_data->num_logical_accel; - dev_info.banks_per_accel = hw_data->num_banks - / hw_data->num_logical_accel; - strscpy(dev_info.name, hw_data->dev_class->name, sizeof(dev_info.name)); - dev_info.instance_id = hw_data->instance_id; - dev_info.type = hw_data->dev_class->type; - dev_info.bus = accel_to_pci_dev(accel_dev)->bus->number; - dev_info.dev = PCI_SLOT(accel_to_pci_dev(accel_dev)->devfn); - dev_info.fun = PCI_FUNC(accel_to_pci_dev(accel_dev)->devfn); - - if (copy_to_user((void __user *)arg, &dev_info, - sizeof(struct adf_dev_status_info))) { - dev_err(&GET_DEV(accel_dev), "failed to copy status.\n"); - return -EFAULT; - } - return 0; -} - -static long adf_ctl_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) -{ - int ret; - - if (mutex_lock_interruptible(&adf_ctl_lock)) - return -EFAULT; - - switch (cmd) { - case IOCTL_CONFIG_SYS_RESOURCE_PARAMETERS: - ret = adf_ctl_ioctl_dev_config(fp, cmd, arg); - break; - - case IOCTL_STOP_ACCEL_DEV: - ret = adf_ctl_ioctl_dev_stop(fp, cmd, arg); - break; - - case IOCTL_START_ACCEL_DEV: - ret = adf_ctl_ioctl_dev_start(fp, cmd, arg); - break; - - case IOCTL_GET_NUM_DEVICES: - ret = adf_ctl_ioctl_get_num_devices(fp, cmd, arg); - break; - - case IOCTL_STATUS_ACCEL_DEV: - ret = adf_ctl_ioctl_get_status(fp, cmd, arg); - break; - default: - pr_err_ratelimited("QAT: Invalid ioctl %d\n", cmd); - ret = -EFAULT; - break; - } - mutex_unlock(&adf_ctl_lock); - return ret; -} static int __init adf_register_ctl_device_driver(void) { - if (adf_chr_drv_create()) - goto err_chr_dev; - if (adf_init_misc_wq()) goto err_misc_wq; @@ -437,15 +40,11 @@ static int __init adf_register_ctl_device_driver(void) err_aer: adf_exit_misc_wq(); err_misc_wq: - adf_chr_drv_destroy(); -err_chr_dev: - mutex_destroy(&adf_ctl_lock); return -EFAULT; } static void __exit adf_unregister_ctl_device_driver(void) { - adf_chr_drv_destroy(); adf_exit_misc_wq(); adf_exit_aer(); adf_exit_vf_wq(); @@ -453,7 +52,6 @@ static void __exit adf_unregister_ctl_device_driver(void) qat_crypto_unregister(); qat_compression_unregister(); adf_clean_vf_map(false); - mutex_destroy(&adf_ctl_lock); } module_init(adf_register_ctl_device_driver); diff --git a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c index 34b9f7731c78..81dd22d2083f 100644 --- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c +++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c @@ -45,19 +45,6 @@ static struct vf_id_map *adf_find_vf(u32 bdf) return NULL; } -static int adf_get_vf_real_id(u32 fake) -{ - struct list_head *itr; - - list_for_each(itr, &vfs_table) { - struct vf_id_map *ptr = - list_entry(itr, struct vf_id_map, list); - if (ptr->fake_id == fake) - return ptr->id; - } - return -1; -} - /** * adf_clean_vf_map() - Cleans VF id mappings * @vf: flag indicating whether mappings is cleaned @@ -304,63 +291,6 @@ struct adf_accel_dev *adf_devmgr_pci_to_accel_dev(struct pci_dev *pci_dev) } EXPORT_SYMBOL_GPL(adf_devmgr_pci_to_accel_dev); -struct adf_accel_dev *adf_devmgr_get_dev_by_id(u32 id) -{ - struct list_head *itr; - int real_id; - - mutex_lock(&table_lock); - real_id = adf_get_vf_real_id(id); - if (real_id < 0) - goto unlock; - - id = real_id; - - list_for_each(itr, &accel_table) { - struct adf_accel_dev *ptr = - list_entry(itr, struct adf_accel_dev, list); - if (ptr->accel_id == id) { - mutex_unlock(&table_lock); - return ptr; - } - } -unlock: - mutex_unlock(&table_lock); - return NULL; -} - -int adf_devmgr_verify_id(u32 id) -{ - if (id == ADF_CFG_ALL_DEVICES) - return 0; - - if (adf_devmgr_get_dev_by_id(id)) - return 0; - - return -ENODEV; -} - -static int adf_get_num_dettached_vfs(void) -{ - struct list_head *itr; - int vfs = 0; - - mutex_lock(&table_lock); - list_for_each(itr, &vfs_table) { - struct vf_id_map *ptr = - list_entry(itr, struct vf_id_map, list); - if (ptr->bdf != ~0 && !ptr->attached) - vfs++; - } - mutex_unlock(&table_lock); - return vfs; -} - -void adf_devmgr_get_num_dev(u32 *num) -{ - *num = num_devices - adf_get_num_dettached_vfs(); -} - /** * adf_dev_in_use() - Check whether accel_dev is currently in use * @accel_dev: Pointer to acceleration device. -- 2.34.1

2 1

[PATCH OLK-5.10] fuse: re-lock request before returning from fuse_ref_folio()
by Ran Hongyun 06 Aug '26

06 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit b5befa80fdbe287a98480effed9564712924add5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16564 CVE: CVE-2026-64266 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, leading to use-after-free issues. Fix this by locking the request in fuse_ref_folio() before returning. Fixes: c3021629a0d8 ("fuse: support splice() reading from fuse device") Cc: stable(a)vger.kernel.org Signed-off-by: Joanne Koong <joannelkoong(a)gmail.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Conflicts: fs/fuse/dev.c [394244b24fdd ("fuse: support copying large folios") not merged.] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/fuse/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 1a12515fd8ea..2a7e48b3ba8a 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -1261,7 +1261,7 @@ static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page, cs->nr_segs++; cs->len = 0; - return 0; + return lock_request(cs->req); } /* -- 2.52.0

2 1

[PATCH OLK-6.6] sched: Add the qos schduler's cgroup v2 interface
by Chen Jinghuang 06 Aug '26

06 Aug '26

Offering: HULK hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8MF4R -------------------------------- Add the qos schduler's cgroup v2 interface. Cgroup v2 use the qos scheduler, as follows: offline group: echo -1 > /sys/fs/cgroup/xxxx/offline/cpu.qos_level online group: /sys/fs/cgroup/xxxx/online/cpu.qos_level Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index cdc931c14930..fd8fdaaf7cbb 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -10660,6 +10660,14 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#endif +#ifdef CONFIG_QOS_SCHED + { + .name = "qos_level", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_qos_read, + .write_s64 = cpu_qos_write, + }, #ifdef CONFIG_SCHED_SOFT_DOMAIN { .name = "soft_domain", -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: SEV: Ignore Port I/O requests of length '0'
by Zhang Kunbo 06 Aug '26

06 Aug '26

From: Sean Christopherson <seanjc(a)google.com> commit 3988bd2723de407ae90fa7a6f6029b4e60238c58 upstream. Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0. Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT") Cc: stable(a)vger.kernel.org Reviewed-by: Tom Lendacky <thomas.lendacky(a)amd.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-ID: <20260501202250.2115252-5-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Jack Wang <jinpu.wang(a)ionos.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- arch/x86/kvm/svm/sev.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index c711a6369c13..79ebbe8cf0b4 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -2791,6 +2791,11 @@ int sev_handle_vmgexit(struct vcpu_svm *svm) "vmgexit: unsupported event - exit_info_1=%#llx, exit_info_2=%#llx\n", control->exit_info_1, control->exit_info_2); break; + case SVM_EXIT_IOIO: + if (!((control->exit_info_1 & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT)) + return 1; + + fallthrough; default: ret = svm_invoke_exit_handler(svm, exit_code); } @@ -2810,6 +2815,9 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in) if (unlikely(check_mul_overflow(count, size, &bytes))) return -EINVAL; + if (!bytes) + return 1; + if (!setup_vmgexit_scratch(svm, in, bytes)) return -EINVAL; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] fix amdgpu_hmm_range_get_pages
by Jiacheng Yu 06 Aug '26

06 Aug '26

fix amdgpu_hmm_range_get_pages Christian König (1): drm/amdgpu: fix amdgpu_hmm_range_get_pages Honglei Huang (1): drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 30 +++++++------------------ 1 file changed, 8 insertions(+), 22 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] KVM: SEV: Ignore Port I/O requests of length '0'
by Zhang Kunbo 06 Aug '26

06 Aug '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.12.95 commit 3b6035bc6bff20e89752ce4358bc4c9a9d5883f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16267 CVE: CVE-2026-63940 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3988bd2723de407ae90fa7a6f6029b4e60238c58 upstream. Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0. Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT") Cc: stable(a)vger.kernel.org Reviewed-by: Tom Lendacky <thomas.lendacky(a)amd.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-ID: <20260501202250.2115252-5-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Jack Wang <jinpu.wang(a)ionos.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/svm/sev.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 8b6c12d6e48d..6fb67a3b7cbe 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -4606,6 +4606,11 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) control->exit_info_1, control->exit_info_2); ret = -EINVAL; break; + case SVM_EXIT_IOIO: + if (!((control->exit_info_1 & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT)) + return 1; + + fallthrough; default: ret = svm_invoke_exit_handler(vcpu, exit_code); } @@ -4626,6 +4631,9 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in) if (unlikely(check_mul_overflow(count, size, &bytes))) return -EINVAL; + if (!bytes) + return 1; + r = setup_vmgexit_scratch(svm, in, bytes); if (r) return r; -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
by Chen Jinghuang 06 Aug '26

06 Aug '26

From: Siwei Zhang <oss(a)fourdim.xyz> mainline inclusion from mainline-v7.2-rc3 commit 6fef032af0092ed5ccb767239a9ac1bc38c08a40 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16859 CVE: CVE-2026-64557 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereferences sk, resulting in a use-after-free. Rework the ->new_connection() op so the core, rather than the callback, owns the child channel's lifetime. The op now receives a pre-allocated new_chan and returns an errno instead of allocating and returning a channel. l2cap_new_connection() allocates the child channel and links it into the conn list via __l2cap_chan_add() before invoking the callback, so the conn-list reference keeps the channel alive once release_sock(parent) exposes the socket to other tasks. Channel configuration that was duplicated in l2cap_sock_init() and the various new_connection callbacks is consolidated into l2cap_chan_set_defaults(), which now inherits from the parent channel when one is supplied. Fixes: 8ffb929098a5 ("Bluetooth: Remove parent socket usage from l2cap_core.c") Cc: stable(a)kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Siwei Zhang <oss(a)fourdim.xyz> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/l2cap.h net/bluetooth/6lowpan.c net/bluetooth/l2cap_sock.c net/bluetooth/l2cap_core.c [context conflicts, not merged 0a120d961663("Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()")] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- include/net/bluetooth/l2cap.h | 10 ++-- net/bluetooth/6lowpan.c | 18 +----- net/bluetooth/a2mp.c | 2 +- net/bluetooth/l2cap_core.c | 78 ++++++++++++++++++++----- net/bluetooth/l2cap_sock.c | 103 ++++++++++++++++------------------ net/bluetooth/smp.c | 27 ++------- 6 files changed, 127 insertions(+), 111 deletions(-) diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h index 678394d95321..541c3c5c6079 100644 --- a/include/net/bluetooth/l2cap.h +++ b/include/net/bluetooth/l2cap.h @@ -650,7 +650,8 @@ struct l2cap_chan { struct l2cap_ops { char *name; - struct l2cap_chan *(*new_connection) (struct l2cap_chan *chan); + int (*new_connection)(struct l2cap_chan *chan, + struct l2cap_chan *new_chan); int (*recv) (struct l2cap_chan * chan, struct sk_buff *skb); void (*teardown) (struct l2cap_chan *chan, int err); @@ -909,9 +910,10 @@ static inline __u16 __next_seq(struct l2cap_chan *chan, __u16 seq) return (seq + 1) % (chan->tx_win_max + 1); } -static inline struct l2cap_chan *l2cap_chan_no_new_connection(struct l2cap_chan *chan) +static inline int l2cap_chan_no_new_connection(struct l2cap_chan *chan, + struct l2cap_chan *new_chan) { - return NULL; + return -EOPNOTSUPP; } static inline int l2cap_chan_no_recv(struct l2cap_chan *chan, struct sk_buff *skb) @@ -986,7 +988,7 @@ int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu); int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len); void l2cap_chan_busy(struct l2cap_chan *chan, int busy); int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator); -void l2cap_chan_set_defaults(struct l2cap_chan *chan); +void l2cap_chan_set_defaults(struct l2cap_chan *chan, struct l2cap_chan *pchan); int l2cap_ertm_init(struct l2cap_chan *chan); void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan); void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan); diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c index 7601ce9143c1..6ee874654794 100644 --- a/net/bluetooth/6lowpan.c +++ b/net/bluetooth/6lowpan.c @@ -650,7 +650,7 @@ static struct l2cap_chan *chan_create(void) if (!chan) return NULL; - l2cap_chan_set_defaults(chan); + l2cap_chan_set_defaults(chan, NULL); chan->chan_type = L2CAP_CHAN_CONN_ORIENTED; chan->mode = L2CAP_MODE_LE_FLOWCTL; @@ -762,21 +762,6 @@ static inline void chan_ready_cb(struct l2cap_chan *chan) ifup(dev->netdev); } -static inline struct l2cap_chan *chan_new_conn_cb(struct l2cap_chan *pchan) -{ - struct l2cap_chan *chan; - - chan = chan_create(); - if (!chan) - return NULL; - - chan->ops = pchan->ops; - - BT_DBG("chan %p pchan %p", chan, pchan); - - return chan; -} - static void delete_netdev(struct work_struct *work) { struct lowpan_btle_dev *entry = container_of(work, @@ -895,7 +880,6 @@ static long chan_get_sndtimeo_cb(struct l2cap_chan *chan) static const struct l2cap_ops bt_6lowpan_chan_ops = { .name = "L2CAP 6LoWPAN channel", - .new_connection = chan_new_conn_cb, .recv = chan_recv_cb, .close = chan_close_cb, .state_change = chan_state_change_cb, diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c index 463bad58478b..28445a3f1636 100644 --- a/net/bluetooth/a2mp.c +++ b/net/bluetooth/a2mp.c @@ -783,7 +783,7 @@ static struct l2cap_chan *a2mp_chan_open(struct l2cap_conn *conn, bool locked) chan->ops = &a2mp_chan_ops; - l2cap_chan_set_defaults(chan); + l2cap_chan_set_defaults(chan, NULL); chan->remote_max_tx = chan->max_tx; chan->remote_tx_win = chan->tx_win; diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 3b6e354551c1..b7b4e24f78e1 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -537,7 +537,10 @@ void l2cap_chan_put(struct l2cap_chan *c) } EXPORT_SYMBOL_GPL(l2cap_chan_put); -void l2cap_chan_set_defaults(struct l2cap_chan *chan) +/* Initialise @chan with default values, inheriting from the parent channel + * @pchan when it is given. + */ +void l2cap_chan_set_defaults(struct l2cap_chan *chan, struct l2cap_chan *pchan) { chan->fcs = L2CAP_FCS_CRC16; chan->max_tx = L2CAP_DEFAULT_MAX_TX; @@ -551,6 +554,31 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan) chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO; chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO; + if (pchan) { + BT_DBG("chan %p pchan %p", chan, pchan); + + chan->chan_type = pchan->chan_type; + chan->imtu = pchan->imtu; + chan->omtu = pchan->omtu; + chan->mode = pchan->mode; + chan->fcs = pchan->fcs; + chan->max_tx = pchan->max_tx; + chan->tx_win = pchan->tx_win; + chan->tx_win_max = pchan->tx_win_max; + chan->sec_level = pchan->sec_level; + chan->conf_state = pchan->conf_state; + chan->flags = pchan->flags; + chan->tx_credits = pchan->tx_credits; + chan->rx_credits = pchan->rx_credits; + + if (chan->chan_type == L2CAP_CHAN_FIXED) { + chan->scid = pchan->scid; + chan->dcid = pchan->scid; + } + + return; + } + chan->conf_state = 0; set_bit(CONF_NOT_COMPLETE, &chan->conf_state); @@ -4126,6 +4154,38 @@ static inline int l2cap_command_rej(struct l2cap_conn *conn, return 0; } +/* Allocate and initialise a channel for an incoming connection. + * + * The channel inherits its configuration from @pchan and is linked into @conn + * before ->new_connection() runs, so the conn list reference keeps it alive if + * the callback exposes it (e.g. via the socket accept queue) before this + * returns. The l2cap_chan_create() reference is taken over by the subsystem on + * success and dropped here on failure. + */ +static struct l2cap_chan *l2cap_new_connection(struct l2cap_conn *conn, + struct l2cap_chan *pchan) +{ + struct l2cap_chan *chan; + + chan = l2cap_chan_create(); + if (!chan) + return NULL; + + l2cap_chan_set_defaults(chan, pchan); + chan->ops = pchan->ops; + + __l2cap_chan_add(conn, chan); + + if (pchan->ops->new_connection && + pchan->ops->new_connection(pchan, chan) < 0) { + l2cap_chan_del(chan, 0); + l2cap_chan_put(chan); + return NULL; + } + + return chan; +} + static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data, u8 rsp_code, u8 amp_id) @@ -4173,7 +4233,7 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, goto response; } - chan = pchan->ops->new_connection(pchan); + chan = l2cap_new_connection(conn, pchan); if (!chan) goto response; @@ -4192,8 +4252,6 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, chan->dcid = scid; chan->local_amp_id = amp_id; - __l2cap_chan_add(conn, chan); - dcid = chan->scid; __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); @@ -5881,7 +5939,7 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, goto response_unlock; } - chan = pchan->ops->new_connection(pchan); + chan = l2cap_new_connection(conn, pchan); if (!chan) { result = L2CAP_CR_LE_NO_MEM; goto response_unlock; @@ -5896,8 +5954,6 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, chan->omtu = mtu; chan->remote_mps = mps; - __l2cap_chan_add(conn, chan); - l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits)); dcid = chan->scid; @@ -6099,7 +6155,7 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, continue; } - chan = pchan->ops->new_connection(pchan); + chan = l2cap_new_connection(conn, pchan); if (!chan) { result = L2CAP_CR_LE_NO_MEM; continue; @@ -6114,8 +6170,6 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, chan->omtu = mtu; chan->remote_mps = mps; - __l2cap_chan_add(conn, chan); - l2cap_ecred_init(chan, __le16_to_cpu(req->credits)); /* Init response */ @@ -8352,14 +8406,12 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) goto next; l2cap_chan_lock(pchan); - chan = pchan->ops->new_connection(pchan); + chan = l2cap_new_connection(conn, pchan); if (chan) { bacpy(&chan->src, &hcon->src); bacpy(&chan->dst, &hcon->dst); chan->src_type = bdaddr_src_type(hcon); chan->dst_type = dst_type; - - __l2cap_chan_add(conn, chan); } l2cap_chan_unlock(pchan); diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 644ec4bf06f0..cc06be98f3c0 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -44,7 +44,8 @@ static struct bt_sock_list l2cap_sk_list = { static const struct proto_ops l2cap_sock_ops; static void l2cap_sock_init(struct sock *sk, struct sock *parent); static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, - int proto, gfp_t prio, int kern); + int proto, gfp_t prio, int kern, + struct l2cap_chan *chan); static void l2cap_sock_cleanup_listen(struct sock *parent); bool l2cap_is_socket(struct socket *sock) @@ -1215,6 +1216,23 @@ static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg, return err; } +/* Release the sock's ref on chan and clear the pointer so that the ref is + * dropped exactly once even if both l2cap_sock_kill() and + * l2cap_sock_destruct() run. Setting chan->data to NULL first stops any other + * task from dereferencing the now-dead sock pointer. + */ +static void l2cap_sock_put_chan(struct sock *sk) +{ + struct l2cap_chan *chan = l2cap_pi(sk)->chan; + + if (!chan) + return; + + chan->data = NULL; + l2cap_pi(sk)->chan = NULL; + l2cap_chan_put(chan); +} + /* Kill socket (only if zapped and orphan) * Must be called on unlocked socket, with l2cap channel lock. */ @@ -1225,13 +1243,9 @@ static void l2cap_sock_kill(struct sock *sk) BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state)); - /* Sock is dead, so set chan data to NULL, avoid other task use invalid - * sock pointer. - */ - l2cap_pi(sk)->chan->data = NULL; - /* Kill poor orphan */ + l2cap_sock_put_chan(sk); - l2cap_chan_put(l2cap_pi(sk)->chan); + /* Kill poor orphan */ sock_set_flag(sk, SOCK_DEAD); sock_put(sk); } @@ -1473,7 +1487,8 @@ static void l2cap_sock_cleanup_listen(struct sock *parent) } } -static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan) +static int l2cap_sock_new_connection_cb(struct l2cap_chan *chan, + struct l2cap_chan *new_chan) { struct sock *sk, *parent = chan->data; @@ -1483,25 +1498,28 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan) if (sk_acceptq_is_full(parent)) { BT_DBG("backlog full %d", parent->sk_ack_backlog); release_sock(parent); - return NULL; + return -ENOBUFS; } sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, - GFP_ATOMIC, 0); + GFP_ATOMIC, 0, new_chan); if (!sk) { release_sock(parent); - return NULL; - } + return -ENOMEM; + } bt_sock_reclassify_lock(sk, BTPROTO_L2CAP); l2cap_sock_init(sk, parent); + /* The conn list reference taken by l2cap_new_connection() keeps new_chan + * alive once release_sock() lets another task free this socket. + */ bt_accept_enqueue(parent, sk, false); release_sock(parent); - return l2cap_pi(sk)->chan; + return 0; } static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) @@ -1770,10 +1788,7 @@ static void l2cap_sock_destruct(struct sock *sk) { BT_DBG("sk %p", sk); - if (l2cap_pi(sk)->chan) { - l2cap_pi(sk)->chan->data = NULL; - l2cap_chan_put(l2cap_pi(sk)->chan); - } + l2cap_sock_put_chan(sk); if (l2cap_pi(sk)->rx_busy_skb) { kfree_skb(l2cap_pi(sk)->rx_busy_skb); @@ -1804,30 +1819,12 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent) BT_DBG("sk %p", sk); if (parent) { - struct l2cap_chan *pchan = l2cap_pi(parent)->chan; - sk->sk_type = parent->sk_type; bt_sk(sk)->flags = bt_sk(parent)->flags; - chan->chan_type = pchan->chan_type; - chan->imtu = pchan->imtu; - chan->omtu = pchan->omtu; - chan->conf_state = pchan->conf_state; - chan->mode = pchan->mode; - chan->fcs = pchan->fcs; - chan->max_tx = pchan->max_tx; - chan->tx_win = pchan->tx_win; - chan->tx_win_max = pchan->tx_win_max; - chan->sec_level = pchan->sec_level; - chan->flags = pchan->flags; - chan->tx_credits = pchan->tx_credits; - chan->rx_credits = pchan->rx_credits; - - if (chan->chan_type == L2CAP_CHAN_FIXED) { - chan->scid = pchan->scid; - chan->dcid = pchan->scid; - } - + /* Channel configuration is inherited from the parent by + * l2cap_new_connection(). + */ security_sk_clone(parent, sk); } else { switch (sk->sk_type) { @@ -1853,7 +1850,7 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent) chan->mode = L2CAP_MODE_BASIC; } - l2cap_chan_set_defaults(chan); + l2cap_chan_set_defaults(chan, NULL); } /* Default config options */ @@ -1870,10 +1867,10 @@ static struct proto l2cap_proto = { }; static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, - int proto, gfp_t prio, int kern) + int proto, gfp_t prio, int kern, + struct l2cap_chan *chan) { struct sock *sk; - struct l2cap_chan *chan; sk = bt_sock_alloc(net, sock, &l2cap_proto, proto, prio, kern); if (!sk) @@ -1882,18 +1879,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, sk->sk_destruct = l2cap_sock_destruct; sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT; - chan = l2cap_chan_create(); - if (!chan) { - sk_free(sk); - if (sock) - sock->sk = NULL; - return NULL; - } - - l2cap_chan_hold(chan); - - l2cap_pi(sk)->chan = chan; - + /* The sock takes ownership of the caller's reference on chan. */ return sk; } @@ -1901,6 +1887,7 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol, int kern) { struct sock *sk; + struct l2cap_chan *chan; BT_DBG("sock %p", sock); @@ -1915,10 +1902,16 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol, sock->ops = &l2cap_sock_ops; - sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern); - if (!sk) + chan = l2cap_chan_create(); + if (!chan) return -ENOMEM; + sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern, chan); + if (!sk) { + l2cap_chan_put(chan); + return -ENOMEM; + } + l2cap_sock_init(sk, NULL); bt_sock_link(&l2cap_sk_list, sk); return 0; diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index 081b08c3a6bc..e556550eb139 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -3236,34 +3236,19 @@ static const struct l2cap_ops smp_chan_ops = { .get_sndtimeo = l2cap_chan_no_get_sndtimeo, }; -static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan) +static inline int smp_new_conn_cb(struct l2cap_chan *chan, + struct l2cap_chan *new_chan) { - struct l2cap_chan *chan; - - BT_DBG("pchan %p", pchan); - - chan = l2cap_chan_create(); - if (!chan) - return NULL; - - chan->chan_type = pchan->chan_type; - chan->ops = &smp_chan_ops; - chan->scid = pchan->scid; - chan->dcid = chan->scid; - chan->imtu = pchan->imtu; - chan->omtu = pchan->omtu; - chan->mode = pchan->mode; + new_chan->ops = &smp_chan_ops; /* Other L2CAP channels may request SMP routines in order to * change the security level. This means that the SMP channel * lock must be considered in its own category to avoid lockdep * warnings. */ - atomic_set(&chan->nesting, L2CAP_NESTING_SMP); - - BT_DBG("created chan %p", chan); + atomic_set(&new_chan->nesting, L2CAP_NESTING_SMP); - return chan; + return 0; } static const struct l2cap_ops smp_root_chan_ops = { @@ -3334,7 +3319,7 @@ static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid) l2cap_add_scid(chan, cid); - l2cap_chan_set_defaults(chan); + l2cap_chan_set_defaults(chan, NULL); if (cid == L2CAP_CID_SMP) { u8 bdaddr_type; -- 2.34.1

2 1

[PATCH OLK-5.10] thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
by Ze Zuo 06 Aug '26

06 Aug '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.259 commit 2b5f47a710172c962ef42d1b732b04d2ad0dce21 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16219 CVE: CVE-2026-63891 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 928abe19fbf0127003abcb1ea69cabc1c897d0ab ] A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication. Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout. Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/thunderbolt/property.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/drivers/thunderbolt/property.c b/drivers/thunderbolt/property.c index d5b0cdb8f0b1..2e50468a3b76 100644 --- a/drivers/thunderbolt/property.c +++ b/drivers/thunderbolt/property.c @@ -34,10 +34,11 @@ struct tb_property_dir_entry { }; #define TB_PROPERTY_ROOTDIR_MAGIC 0x55584401 +#define TB_PROPERTY_MAX_DEPTH 8 static struct tb_property_dir *__tb_property_parse_dir(const u32 *block, size_t block_len, unsigned int dir_offset, size_t dir_len, - bool is_root); + bool is_root, unsigned int depth); static inline void parse_dwdata(void *dst, const void *src, size_t dwords) { @@ -93,7 +94,8 @@ tb_property_alloc(const char *key, enum tb_property_type type) } static struct tb_property *tb_property_parse(const u32 *block, size_t block_len, - const struct tb_property_entry *entry) + const struct tb_property_entry *entry, + unsigned int depth) { char key[TB_PROPERTY_KEY_SIZE + 1]; struct tb_property *property; @@ -114,7 +116,7 @@ static struct tb_property *tb_property_parse(const u32 *block, size_t block_len, switch (property->type) { case TB_PROPERTY_TYPE_DIRECTORY: dir = __tb_property_parse_dir(block, block_len, entry->value, - entry->length, false); + entry->length, false, depth + 1); if (!dir) { kfree(property); return NULL; @@ -159,13 +161,17 @@ static struct tb_property *tb_property_parse(const u32 *block, size_t block_len, } static struct tb_property_dir *__tb_property_parse_dir(const u32 *block, - size_t block_len, unsigned int dir_offset, size_t dir_len, bool is_root) + size_t block_len, unsigned int dir_offset, size_t dir_len, bool is_root, + unsigned int depth) { const struct tb_property_entry *entries; size_t i, content_len, nentries; unsigned int content_offset; struct tb_property_dir *dir; + if (depth > TB_PROPERTY_MAX_DEPTH) + return NULL; + dir = kzalloc(sizeof(*dir), GFP_KERNEL); if (!dir) return NULL; @@ -192,7 +198,7 @@ static struct tb_property_dir *__tb_property_parse_dir(const u32 *block, for (i = 0; i < nentries; i++) { struct tb_property *property; - property = tb_property_parse(block, block_len, &entries[i]); + property = tb_property_parse(block, block_len, &entries[i], depth); if (!property) { tb_property_free_dir(dir); return NULL; @@ -229,7 +235,7 @@ struct tb_property_dir *tb_property_parse_dir(const u32 *block, return NULL; return __tb_property_parse_dir(block, block_len, 0, rootdir->length, - true); + true, 0); } /** -- 2.25.1

2 1

[PATCH OLK-5.10] batman-adv: tt: fix negative last_changeset_len
by Ze Zuo 06 Aug '26

06 Aug '26

From: Sven Eckelmann <sven(a)narfation.org> stable inclusion from stable-v5.10.258 commit 6314089acf0ddf64376fdc0b1420695504c73f52 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16427 CVE: CVE-2026-64089 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fc92cdfcb295cefa4344d71a527d61b638b7bfc4 upstream. batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s32. The incorrectly negative s16 value propagates into the s32, causing batadv_tt_prepare_tvlv_local_data() to allocate a full sized buffer but populates only a small portion of it with the collected changeset. All remaining bits are kept uninitialized. Using an u16 avoids this type confusion and ensures that no (negative) sign extension is performed in batadv_send_my_tt_response(). Cc: stable(a)kernel.org Fixes: a73105b8d4c7 ("batman-adv: improved client announcement mechanism") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/batman-adv/types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h index cc3334afbdd0..bf9b1ee568b9 100644 --- a/net/batman-adv/types.h +++ b/net/batman-adv/types.h @@ -1003,7 +1003,7 @@ struct batadv_priv_tt { * @last_changeset_len: length of last tt changeset this host has * generated */ - s16 last_changeset_len; + u16 last_changeset_len; /** * @last_changeset_lock: lock protecting last_changeset & -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2026-64095
by Ze Zuo 06 Aug '26

06 Aug '26

Fix CVE-2026-64095. Sven Eckelmann (2): batman-adv: bla: fix report_work leak on backbone_gw purge batman-adv: bla: avoid double decrement of bla.num_requests net/batman-adv/bridge_loop_avoidance.c | 103 +++++++++++++++++-------- net/batman-adv/soft-interface.c | 1 + net/batman-adv/types.h | 39 ++++++++-- 3 files changed, 101 insertions(+), 42 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
by Ze Zuo 06 Aug '26

06 Aug '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.259 commit 446e0ecd845abc394b24ae2030a883572bec9d16 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15911 CVE: CVE-2026-53225 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8373d7090b745728de66308deeecc67e8d319ce ] __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 ("net: sctp: fix KMSAN uninit-value in sctp_inq_pop"). Fixes: df2185771439 ("[SCTP]: Update association lookup to look at ASCONF chunks as well") Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20260608122234.459098-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/sctp/input.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/sctp/input.c b/net/sctp/input.c index 079b1bfc7d31..3c7761199f20 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -1172,6 +1172,14 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( /* Skip over the ADDIP header and find the Address parameter */ param = (union sctp_addr_param *)(asconf + 1); + /* The whole address parameter must lie within the chunk before + * af->from_addr_param() reads the variable-length address; otherwise a + * truncated trailing ASCONF chunk lets it read uninitialized bytes past + * the parameter. + */ + if (sizeof(*asconf) + ntohs(param->p.length) > ntohs(ch->length)) + return NULL; + af = sctp_get_af_specific(param_type2af(param->p.type)); if (unlikely(!af)) return NULL; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
by Ze Zuo 06 Aug '26

06 Aug '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.259 commit 446e0ecd845abc394b24ae2030a883572bec9d16 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15911 CVE: CVE-2026-53225 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8373d7090b745728de66308deeecc67e8d319ce ] __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 ("net: sctp: fix KMSAN uninit-value in sctp_inq_pop"). Fixes: df2185771439 ("[SCTP]: Update association lookup to look at ASCONF chunks as well") Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20260608122234.459098-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/sctp/input.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/sctp/input.c b/net/sctp/input.c index 354a2eb84e14..269b8f0aec60 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -1131,6 +1131,14 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( /* Skip over the ADDIP header and find the Address parameter */ param = (union sctp_addr_param *)(asconf + 1); + /* The whole address parameter must lie within the chunk before + * af->from_addr_param() reads the variable-length address; otherwise a + * truncated trailing ASCONF chunk lets it read uninitialized bytes past + * the parameter. + */ + if (sizeof(*asconf) + ntohs(param->p.length) > ntohs(ch->length)) + return NULL; + af = sctp_get_af_specific(param_type2af(param->p.type)); if (unlikely(!af)) return NULL; -- 2.25.1

2 1

[PATCH OLK-5.10] hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
by Ze Zuo 06 Aug '26

06 Aug '26

From: Anton Leontev <leontyevantony(a)gmail.com> stable inclusion from stable-v5.10.259 commit 16514afeb7d3d121072ba9a0b640d6c1c5507db0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15885 CVE: CVE-2026-53199 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 004e9ecfe6c5384f9e0b2f6f6389d42ec22789af ] netvsc_copy_to_send_buf() copies page buffer entries into the VMBus send buffer using phys_to_virt() on the entry PFN. Entries for the RNDIS header and the skb linear data come from kmalloc'd memory and are always in the kernel direct map, but entries for skb fragments reference page cache or user pages, which on 32-bit x86 with CONFIG_HIGHMEM=y can live above the LOWMEM boundary. For such a page phys_to_virt() returns an address outside the direct map and the subsequent memcpy() faults on the transmit softirq path, which is fatal. Map the pages with kmap_local_page() instead, handling two properties of the page buffer entries: - pb[i].pfn is a Hyper-V PFN at HV_HYP_PAGE_SIZE (4K) granularity, not a native PFN. Reconstruct the physical address first and derive the native page from it, so the mapping stays correct where PAGE_SIZE > HV_HYP_PAGE_SIZE (e.g. arm64 with 64K pages). - Since commit 41a6328b2c55 ("hv_netvsc: Preserve contiguous PFN grouping in the page buffer array"), an entry describes a full physically contiguous fragment and pb[i].len can exceed PAGE_SIZE, while kmap_local_page() maps a single page. Copy page by page, splitting at native page boundaries. The copy path only handles packets smaller than the send section size (6144 bytes by default); larger packets take the cp_partial path where only the RNDIS header is copied. So entries here are bounded by the section size and a copy is split at most once on 4K-page systems. On !CONFIG_HIGHMEM configs kmap_local_page() folds to page_address() and no mapping work is added. Fixes: c25aaf814a63 ("hyperv: Enable sendbuf mechanism on the send path") Cc: stable(a)vger.kernel.org Signed-off-by: Anton Leontev <leontyevantony(a)gmail.com> Link: https://patch.msgid.link/20260604165938.32033-1-leontyevantony@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/net/hyperv/netvsc.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c index 03333a4136bf..6972601820e4 100644 --- a/drivers/net/hyperv/netvsc.c +++ b/drivers/net/hyperv/netvsc.c @@ -12,6 +12,7 @@ #include <linux/sched.h> #include <linux/wait.h> #include <linux/mm.h> +#include <linux/highmem.h> #include <linux/delay.h> #include <linux/io.h> #include <linux/slab.h> @@ -889,12 +890,22 @@ static void netvsc_copy_to_send_buf(struct netvsc_device *net_device, } for (i = 0; i < page_count; i++) { - char *src = phys_to_virt(pb[i].pfn << HV_HYP_PAGE_SHIFT); - u32 offset = pb[i].offset; + phys_addr_t paddr = (pb[i].pfn << HV_HYP_PAGE_SHIFT) + + pb[i].offset; u32 len = pb[i].len; - memcpy(dest, (src + offset), len); - dest += len; + while (len) { + struct page *page = pfn_to_page(PHYS_PFN(paddr)); + u32 off = offset_in_page(paddr); + u32 chunk = min_t(u32, len, PAGE_SIZE - off); + char *src = kmap_atomic(page); + + memcpy(dest, src + off, chunk); + kunmap_atomic(src); + dest += chunk; + paddr += chunk; + len -= chunk; + } } if (padding) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] libceph: Fix potential out-of-bounds access in crush_decode()
by Ze Zuo 06 Aug '26

06 Aug '26

From: Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> stable inclusion from stable-v5.10.258 commit 6e70ef53e818c53eab28d7b0026b7fd03dddaba5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15657 CVE: CVE-2026-52955 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing. This patch fixes the issue by adding a check that compares alg and b->alg and aborts the processing in case they differ. Furthermore, b->alg is set to 0 in this case, because the destruction of the crush map also uses this field to determine the bucket type, which can again result in an out-of-bounds access when trying to free the memory pointed to by the fields of the bucket. To correctly free the memory allocated for the bucket in such a case, the corresponding call to kfree is moved from the algorithm-specific crush_destroy_bucket functions to the generic crush_destroy_bucket(). Cc: stable(a)vger.kernel.org Signed-off-by: Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> Reviewed-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/ceph/crush/crush.c | 6 +----- net/ceph/osdmap.c | 4 ++++ 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/net/ceph/crush/crush.c b/net/ceph/crush/crush.c index 3d70244bc1b6..2673fae9c339 100644 --- a/net/ceph/crush/crush.c +++ b/net/ceph/crush/crush.c @@ -48,7 +48,6 @@ int crush_get_bucket_item_weight(const struct crush_bucket *b, int p) void crush_destroy_bucket_uniform(struct crush_bucket_uniform *b) { kfree(b->h.items); - kfree(b); } void crush_destroy_bucket_list(struct crush_bucket_list *b) @@ -56,14 +55,12 @@ void crush_destroy_bucket_list(struct crush_bucket_list *b) kfree(b->item_weights); kfree(b->sum_weights); kfree(b->h.items); - kfree(b); } void crush_destroy_bucket_tree(struct crush_bucket_tree *b) { kfree(b->h.items); kfree(b->node_weights); - kfree(b); } void crush_destroy_bucket_straw(struct crush_bucket_straw *b) @@ -71,14 +68,12 @@ void crush_destroy_bucket_straw(struct crush_bucket_straw *b) kfree(b->straws); kfree(b->item_weights); kfree(b->h.items); - kfree(b); } void crush_destroy_bucket_straw2(struct crush_bucket_straw2 *b) { kfree(b->item_weights); kfree(b->h.items); - kfree(b); } void crush_destroy_bucket(struct crush_bucket *b) @@ -100,6 +95,7 @@ void crush_destroy_bucket(struct crush_bucket *b) crush_destroy_bucket_straw2((struct crush_bucket_straw2 *)b); break; } + kfree(b); } /** diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c index 7cb6025fe092..9a4a9aa187f7 100644 --- a/net/ceph/osdmap.c +++ b/net/ceph/osdmap.c @@ -422,6 +422,10 @@ static struct crush_map *crush_decode(void *pbyval, void *end) b->id = ceph_decode_32(p); b->type = ceph_decode_16(p); b->alg = ceph_decode_8(p); + if (b->alg != alg) { + b->alg = 0; + goto bad; + } b->hash = ceph_decode_8(p); b->weight = ceph_decode_32(p); b->size = ceph_decode_32(p); -- 2.25.1

2 1

[PATCH OLK-5.10] libceph: Fix potential out-of-bounds access in crush_decode()
by Ze Zuo 06 Aug '26

06 Aug '26

From: Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> stable inclusion from stable-v5.10.258 commit 6e70ef53e818c53eab28d7b0026b7fd03dddaba5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15657 CVE: CVE-2026-52955 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4c79fc2d598694bda845b46229c9d48b65042970 upstream. A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing. This patch fixes the issue by adding a check that compares alg and b->alg and aborts the processing in case they differ. Furthermore, b->alg is set to 0 in this case, because the destruction of the crush map also uses this field to determine the bucket type, which can again result in an out-of-bounds access when trying to free the memory pointed to by the fields of the bucket. To correctly free the memory allocated for the bucket in such a case, the corresponding call to kfree is moved from the algorithm-specific crush_destroy_bucket functions to the generic crush_destroy_bucket(). Cc: stable(a)vger.kernel.org Signed-off-by: Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> Reviewed-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/ceph/crush/crush.c | 6 +----- net/ceph/osdmap.c | 4 ++++ 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/net/ceph/crush/crush.c b/net/ceph/crush/crush.c index 254ded0b05f6..521aec1d5fc0 100644 --- a/net/ceph/crush/crush.c +++ b/net/ceph/crush/crush.c @@ -47,7 +47,6 @@ int crush_get_bucket_item_weight(const struct crush_bucket *b, int p) void crush_destroy_bucket_uniform(struct crush_bucket_uniform *b) { kfree(b->h.items); - kfree(b); } void crush_destroy_bucket_list(struct crush_bucket_list *b) @@ -55,14 +54,12 @@ void crush_destroy_bucket_list(struct crush_bucket_list *b) kfree(b->item_weights); kfree(b->sum_weights); kfree(b->h.items); - kfree(b); } void crush_destroy_bucket_tree(struct crush_bucket_tree *b) { kfree(b->h.items); kfree(b->node_weights); - kfree(b); } void crush_destroy_bucket_straw(struct crush_bucket_straw *b) @@ -70,14 +67,12 @@ void crush_destroy_bucket_straw(struct crush_bucket_straw *b) kfree(b->straws); kfree(b->item_weights); kfree(b->h.items); - kfree(b); } void crush_destroy_bucket_straw2(struct crush_bucket_straw2 *b) { kfree(b->item_weights); kfree(b->h.items); - kfree(b); } void crush_destroy_bucket(struct crush_bucket *b) @@ -99,6 +94,7 @@ void crush_destroy_bucket(struct crush_bucket *b) crush_destroy_bucket_straw2((struct crush_bucket_straw2 *)b); break; } + kfree(b); } /** diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c index fe796775e3e9..62cfeb337b8a 100644 --- a/net/ceph/osdmap.c +++ b/net/ceph/osdmap.c @@ -497,6 +497,10 @@ static struct crush_map *crush_decode(void *pbyval, void *end) b->id = ceph_decode_32(p); b->type = ceph_decode_16(p); b->alg = ceph_decode_8(p); + if (b->alg != alg) { + b->alg = 0; + goto bad; + } b->hash = ceph_decode_8(p); b->weight = ceph_decode_32(p); b->size = ceph_decode_32(p); -- 2.25.1

2 1

[PATCH OLK-5.10 0/4] Fix CVE-2026-52917
by Ze Zuo 06 Aug '26

06 Aug '26

Fix CVE-2026-52917. Stefan Wiehler (1): sctp: Hold sock lock while iterating over address list Xin Long (1): sctp: hold endpoint before calling cb in sctp_transport_lookup_process Yajun Deng (1): net: Use nlmsg_unicast() instead of netlink_unicast() Zhao Zhang (1): sctp: diag: reject stale associations in dump_one path include/net/sctp/sctp.h | 3 +- net/ipv4/fib_frontend.c | 2 +- net/ipv4/inet_diag.c | 5 +--- net/ipv4/raw_diag.c | 7 ++--- net/ipv4/udp_diag.c | 6 ++-- net/mptcp/mptcp_diag.c | 6 ++-- net/netlink/af_netlink.c | 2 +- net/sctp/diag.c | 65 ++++++++++++++++++++-------------------- net/sctp/socket.c | 22 +++++++++----- net/unix/diag.c | 6 ++-- 10 files changed, 59 insertions(+), 65 deletions(-) -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS] i2c: core: fix adapter registration race
by Zhang Yuwei 06 Aug '26

06 Aug '26

From: Johan Hovold <johan(a)kernel.org> mainline inclusion from mainline-v7.2-rc1 commit ba14d7cf2fe7284610a29854bdff22b2537d3ce6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16120 CVE: CVE-2026-64279 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Adapters can be looked up by their id using i2c_get_adapter() which takes a reference to the embedded struct device. Remove the adapter from the IDR before tearing it down during deregistration (and on registration failure) to make sure its resources are not accessed after having been freed (e.g. the device name). Fixes: 35fc37f81881 ("i2c: Limit core locking to the necessary sections") Cc: stable(a)vger.kernel.org # 2.6.31 Cc: Jean Delvare <khali(a)linux-fr.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> Conflicts: drivers/i2c/i2c-core-base.c [contxt conflict] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/i2c/i2c-core-base.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 366bd86285d6..88c925c449f7 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1281,6 +1281,11 @@ static int i2c_register_adapter(struct i2c_adapter *adap) dev_set_name(&adap->dev, "i2c-%d", adap->nr); adap->dev.bus = &i2c_bus_type; adap->dev.type = &i2c_adapter_type; + + mutex_lock(&core_lock); + idr_replace(&i2c_adapter_idr, adap, adap->nr); + mutex_unlock(&core_lock); + res = device_register(&adap->dev); if (res) { pr_err("adapter '%s': can't register device (%d)\n", adap->name, res); @@ -1345,7 +1350,7 @@ static int __i2c_add_numbered_adapter(struct i2c_adapter *adap) int id; mutex_lock(&core_lock); - id = idr_alloc(&i2c_adapter_idr, adap, adap->nr, adap->nr + 1, GFP_KERNEL); + id = idr_alloc(&i2c_adapter_idr, NULL, adap->nr, adap->nr + 1, GFP_KERNEL); mutex_unlock(&core_lock); if (WARN(id < 0, "couldn't get idr")) return id == -ENOSPC ? -EBUSY : id; @@ -1381,7 +1386,7 @@ int i2c_add_adapter(struct i2c_adapter *adapter) } mutex_lock(&core_lock); - id = idr_alloc(&i2c_adapter_idr, adapter, + id = idr_alloc(&i2c_adapter_idr, NULL, __i2c_first_dynamic_bus_num, 0, GFP_KERNEL); mutex_unlock(&core_lock); if (WARN(id < 0, "couldn't get idr")) -- 2.22.0

2 1

[PATCH OLK-6.6] Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
by Hui Tang 05 Aug '26

05 Aug '26

From: Siwei Zhang <oss(a)fourdim.xyz> mainline inclusion from mainline-v7.2-rc3 commit 12917f591cea1af36087dba5b9ec888652f0b42a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16696 CVE: CVE-2026-64405 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hci_abort_conn() read hci_skb_event(hdev->sent_cmd) when a connection was pending, but hdev->sent_cmd can be NULL while req_status is still HCI_REQ_PEND, leading to a NULL pointer dereference and a general protection fault from the hci_rx_work() receive path. Instead of inspecting hdev->sent_cmd, track the in-flight create connection command with a new per-connection HCI_CONN_CREATE flag and route all cancellation through hci_cancel_connect_sync(), which dispatches to a dedicated per-type cancel function. The create command is in exactly one of two states: still queued, or in flight. The cancel function holds cmd_sync_work_lock across the whole decision: the worker takes this lock to dequeue every entry, so while it is held a queued command cannot start running and an in-flight command cannot complete and let the next command become pending. This keeps the flag test and hci_cmd_sync_cancel() atomic with respect to the worker, so a queued command is simply dequeued, and an in-flight command owned by this connection is cancelled without the risk of cancelling an unrelated command that became pending in the meantime. CIS uses the same flag mechanism via HCI_CONN_CREATE_CIS but cannot be dequeued per-connection. hci_acl_create_conn_sync() and hci_le_create_conn_sync() clear HCI_CONN_CREATE after the create command completes, but the command status handler can free conn via hci_conn_del() (for example when the controller rejects the connection) while the worker is still blocked on the connection complete event. Hold a reference on conn across the create command so the flag can be cleared without a use-after-free. Fixes: a13f316e90fd ("Bluetooth: hci_conn: Consolidate code for aborting connections") Cc: stable(a)vger.kernel.org Suggested-by: XIAO WU <xiaowu.417(a)qq.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Siwei Zhang <oss(a)fourdim.xyz> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_conn.c | 21 +---- net/bluetooth/hci_sync.c | 133 +++++++++++++++++++++++++++---- 3 files changed, 123 insertions(+), 32 deletions(-) diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 4726fb144ee9..26b5af2e670d 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -965,6 +965,7 @@ enum { HCI_CONN_AUTH_FAILURE, HCI_CONN_PER_ADV, HCI_CONN_BIG_CREATED, + HCI_CONN_CREATE, HCI_CONN_CREATE_CIS, HCI_CONN_BIG_SYNC, HCI_CONN_BIG_SYNC_FAILED, diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index ee3e842404d1..4ead957d7c4c 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -2927,26 +2927,11 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason) conn->abort_reason = reason; - /* If the connection is pending check the command opcode since that - * might be blocking on hci_cmd_sync_work while waiting its respective - * event so we need to hci_cmd_sync_cancel to cancel it. - * - * hci_connect_le serializes the connection attempts so only one - * connection can be in BT_CONNECT at time. + /* Cancel the connect attempt. A return of 0 means the create command + * was still queued and got dequeued, so there is nothing to disconnect. */ - if (conn->state == BT_CONNECT && READ_ONCE(hdev->req_status) == HCI_REQ_PEND) { - switch (hci_skb_event(hdev->sent_cmd)) { - case HCI_EV_CONN_COMPLETE: - case HCI_EV_LE_CONN_COMPLETE: - case HCI_EV_LE_ENHANCED_CONN_COMPLETE: - case HCI_EVT_LE_CIS_ESTABLISHED: - hci_cmd_sync_cancel(hdev, ECANCELED); - break; - } - /* Cancel connect attempt if still queued/pending */ - } else if (!hci_cancel_connect_sync(hdev, conn)) { + if (!hci_cancel_connect_sync(hdev, conn)) return 0; - } /* Run immediately if on cmd_sync_work since this may be called * as a result to MGMT_OP_DISCONNECT/MGMT_OP_UNPAIR which does diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 0fdadf4c4d21..9da7d17dda88 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -6576,6 +6576,11 @@ static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data) bt_dev_dbg(hdev, "conn %p", conn); + /* Hold a reference so conn stays valid for the HCI_CONN_CREATE + * clear_bit() at done. + */ + hci_conn_get(conn); + clear_bit(HCI_CONN_SCANNING, &conn->flags); conn->state = BT_CONNECT; @@ -6588,6 +6593,7 @@ static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data) hdev->le_scan_type == LE_SCAN_ACTIVE && !hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) { hci_conn_del(conn); + hci_conn_put(conn); return -EBUSY; } @@ -6633,6 +6639,12 @@ static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data) &own_addr_type); if (err) goto done; + + /* Mark create connection in flight so hci_cancel_connect_sync() can + * cancel it while blocking on the connection complete event. + */ + set_bit(HCI_CONN_CREATE, &conn->flags); + /* Send command LE Extended Create Connection if supported */ if (use_ext_conn(hdev)) { err = hci_le_ext_create_conn_sync(hdev, conn, own_addr_type); @@ -6668,11 +6680,14 @@ static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data) conn->conn_timeout, NULL); done: + clear_bit(HCI_CONN_CREATE, &conn->flags); + if (err == -ETIMEDOUT) hci_le_connect_cancel_sync(hdev, conn, 0x00); /* Re-enable advertising after the connection attempt is finished. */ hci_resume_advertising_sync(hdev); + hci_conn_put(conn); return err; } @@ -6951,10 +6966,25 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) else cp.role_switch = 0x00; - return __hci_cmd_sync_status_sk(hdev, HCI_OP_CREATE_CONN, - sizeof(cp), &cp, - HCI_EV_CONN_COMPLETE, - conn->conn_timeout, NULL); + /* Hold a reference so conn stays valid for the HCI_CONN_CREATE + * clear_bit() below. + */ + hci_conn_get(conn); + + /* Mark create connection in flight so hci_cancel_connect_sync() can + * cancel it while blocking on the connection complete event. + */ + set_bit(HCI_CONN_CREATE, &conn->flags); + + err = __hci_cmd_sync_status_sk(hdev, HCI_OP_CREATE_CONN, + sizeof(cp), &cp, + HCI_EV_CONN_COMPLETE, + conn->conn_timeout, NULL); + + clear_bit(HCI_CONN_CREATE, &conn->flags); + hci_conn_put(conn); + + return err; } int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn) @@ -7006,20 +7036,95 @@ int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn) return (err == -EEXIST) ? 0 : err; } -int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn) +static int hci_acl_cancel_create_conn_sync(struct hci_dev *hdev, + struct hci_conn *conn) { - if (conn->state != BT_OPEN) - return -EINVAL; + struct hci_cmd_sync_work_entry *entry; + int err = -EBUSY; + + /* cmd_sync_work_lock makes the HCI_CONN_CREATE test and the cancel + * atomic against the worker, which takes this lock to dequeue every + * entry: while it is held no other command can become pending, so + * hci_cmd_sync_cancel() cannot cancel an unrelated command. + */ + mutex_lock(&hdev->cmd_sync_work_lock); + + /* In flight: this connection owns the pending request, cancel it. */ + if (test_bit(HCI_CONN_CREATE, &conn->flags)) { + hci_cmd_sync_cancel(hdev, ECANCELED); + goto unlock; + } + + /* Still queued: a successful dequeue means it never started, so there + * is nothing to disconnect. + */ + entry = _hci_cmd_sync_lookup_entry(hdev, hci_acl_create_conn_sync, conn, + NULL); + if (entry) { + _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); + err = 0; + } + +unlock: + mutex_unlock(&hdev->cmd_sync_work_lock); + return err; +} + +static int hci_le_cancel_create_conn_sync(struct hci_dev *hdev, + struct hci_conn *conn) +{ + struct hci_cmd_sync_work_entry *entry; + int err = -EBUSY; + /* cmd_sync_work_lock keeps the HCI_CONN_CREATE test and the cancel + * atomic against the cmd_sync worker. + */ + mutex_lock(&hdev->cmd_sync_work_lock); + + if (test_bit(HCI_CONN_CREATE, &conn->flags)) { + hci_cmd_sync_cancel(hdev, ECANCELED); + goto unlock; + } + + entry = _hci_cmd_sync_lookup_entry(hdev, hci_le_create_conn_sync, conn, + create_le_conn_complete); + if (entry) { + _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); + err = 0; + } + +unlock: + mutex_unlock(&hdev->cmd_sync_work_lock); + return err; +} + +static int hci_cis_cancel_create_conn_sync(struct hci_dev *hdev, + struct hci_conn *conn) +{ + /* LE Create CIS is shared by the whole CIG and cannot be dequeued + * per-connection, so only an in-flight command can be cancelled. + * cmd_sync_work_lock keeps the test and the cancel atomic against the + * cmd_sync worker. + */ + mutex_lock(&hdev->cmd_sync_work_lock); + + if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) + hci_cmd_sync_cancel(hdev, ECANCELED); + + mutex_unlock(&hdev->cmd_sync_work_lock); + return -EBUSY; +} + +int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn) +{ switch (conn->type) { case ACL_LINK: - return !hci_cmd_sync_dequeue_once(hdev, - hci_acl_create_conn_sync, - conn, NULL); + return hci_acl_cancel_create_conn_sync(hdev, conn); case LE_LINK: - return !hci_cmd_sync_dequeue_once(hdev, hci_le_create_conn_sync, - conn, create_le_conn_complete); + return hci_le_cancel_create_conn_sync(hdev, conn); + case CIS_LINK: + return hci_cis_cancel_create_conn_sync(hdev, conn); + default: + return -ENOENT; } - - return -ENOENT; } -- 2.34.1

1 0

[PATCH OLK-6.6] Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
by Hui Tang 05 Aug '26

05 Aug '26

From: SeungJu Cheon <suunj1331(a)gmail.com> mainline inclusion from mainline-v7.1-rc2 commit 9ca7053d6215d89c33f28893bfd1625a32919d3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16200 CVE: CVE-2026-63871 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and iso_conn_big_sync() call hci_get_route() using iso_pi(sk)->dst, iso_pi(sk)->src, and iso_pi(sk)->src_type without holding lock_sock(). These fields may be modified concurrently by connect() or setsockopt() on the same socket, resulting in data-races reported by KCSAN. Fix this by snapshotting the required fields under lock_sock() before calling hci_get_route(). BUG: KCSAN: data-race in memcmp+0x45/0xb0 race at unknown origin, with read to 0xffff8880122135cf of 1 bytes by task 333 on cpu 1: memcmp+0x45/0xb0 hci_get_route+0x27e/0x490 iso_connect_cis+0x4c/0xa10 iso_sock_connect+0x60e/0xb30 __sys_connect_file+0xbd/0xe0 __sys_connect+0xe0/0x110 __x64_sys_connect+0x40/0x50 x64_sys_call+0xcad/0x1c60 do_syscall_64+0x133/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 241f51931c35 ("Bluetooth: ISO: Avoid circular locking dependency") Signed-off-by: SeungJu Cheon <suunj1331(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/iso.c [Context conflicts due to backport] Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- net/bluetooth/iso.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 22b0bc30219f..5425ab7f5801 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -365,12 +365,19 @@ static int iso_connect_bis(struct sock *sk) struct iso_conn *conn; struct hci_conn *hcon; struct hci_dev *hdev; + bdaddr_t src, dst; + u8 src_type; int err; - BT_DBG("%pMR", &iso_pi(sk)->src); + lock_sock(sk); + bacpy(&src, &iso_pi(sk)->src); + bacpy(&dst, &iso_pi(sk)->dst); + src_type = iso_pi(sk)->src_type; + release_sock(sk); - hdev = hci_get_route(&iso_pi(sk)->dst, &iso_pi(sk)->src, - iso_pi(sk)->src_type); + BT_DBG("%pMR", &src); + + hdev = hci_get_route(&dst, &src, src_type); if (!hdev) return -EHOSTUNREACH; @@ -456,12 +463,19 @@ static int iso_connect_cis(struct sock *sk) struct iso_conn *conn; struct hci_conn *hcon; struct hci_dev *hdev; + bdaddr_t src, dst; + u8 src_type; int err; - BT_DBG("%pMR -> %pMR", &iso_pi(sk)->src, &iso_pi(sk)->dst); + lock_sock(sk); + bacpy(&src, &iso_pi(sk)->src); + bacpy(&dst, &iso_pi(sk)->dst); + src_type = iso_pi(sk)->src_type; + release_sock(sk); - hdev = hci_get_route(&iso_pi(sk)->dst, &iso_pi(sk)->src, - iso_pi(sk)->src_type); + BT_DBG("%pMR -> %pMR", &src, &dst); + + hdev = hci_get_route(&dst, &src, src_type); if (!hdev) return -EHOSTUNREACH; -- 2.34.1

1 0

[PATCH OLK-6.6] bpf: Copy per-CPU map value padding in copy_map_value_long()
by Pu Lehui 05 Aug '26

05 Aug '26

From: Leon Hwang <leon.hwang(a)linux.dev> maillist inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9693 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id… -------------------------------- In kernel, per-CPU map elements are stored with round_up(map->value_size, 8) bytes. On UAPI lookup paths, it copies the rounded size for each CPU into a temporary buffer. However, copy_map_value_long() passes 'map->value_size' to bpf_obj_memcpy(). When the map has special fields, bpf_obj_memcpy() copies around those fields with memcpy(), and does not copy the tail padding between 'map->value_size' and round_up(map->value_size, 8). The temporary UAPI lookup buffers are allocated without __GFP_ZERO. As a result, when the per-CPU map's value size is not equal to round_up(map->value_size, 8), UAPI LOOKUP_ELEM and its variants can return stale heap contents from that padding to user space. The same issue applies to bpf_iter for per-CPU maps. Pass round_up(map->value_size, 8) to bpf_obj_memcpy() from copy_map_value_long(), so per-CPU maps both with and without special fields copy the entire per-CPU slot. Remove the now redundant round_up() from bpf_obj_memcpy()'s long_memcpy path. Fixes: 448325199f57 ("bpf: Add copy_map_value_long to copy to remote percpu memory") Signed-off-by: Leon Hwang <leon.hwang(a)linux.dev> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20260624155115.85196-2-leon.hwang@linux.dev Conflicts: include/linux/bpf.h [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/linux/bpf.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index c337836a6c89..cc2a0cc4b411 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -500,7 +500,7 @@ static inline void bpf_obj_memcpy(struct btf_record *rec, if (IS_ERR_OR_NULL(rec)) { if (long_memcpy) - bpf_long_memcpy(dst, src, round_up(size, 8)); + bpf_long_memcpy(dst, src, size); else memcpy(dst, src, size); return; @@ -523,7 +523,7 @@ static inline void copy_map_value(struct bpf_map *map, void *dst, void *src) static inline void copy_map_value_long(struct bpf_map *map, void *dst, void *src) { - bpf_obj_memcpy(map->record, dst, src, map->value_size, true); + bpf_obj_memcpy(map->record, dst, src, round_up(map->value_size, 8), true); } static inline void bpf_obj_memzero(struct btf_record *rec, void *dst, u32 size) -- 2.34.1

2 1