- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] eventfs: Free the eventfs_inode after an rcu grace period too
by Pu Lehui 29 Oct '26

29 Oct '26

From: Christian Brauner <brauner(a)kernel.org> mainline inclusion from mainline-v7.3 commit 2cd88c498ecff8e22bf4c397b8eb226db70ac343 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/21045 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its reference to the eventfs_inode when the dentry is killed, and release_ei() then frees it after a grace period of eventfs_srcu. An SRCU grace period doesn't wait for rcu_read_lock() sections, so the walker can read an eventfs_inode that is already gone. With a pathwalk held up in tracefs_d_revalidate() while the dentry goes away: BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace: <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1: __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 Before commit 8e556432477e ("eventfs: Use SRCU for freeing eventfs_inodes") release_ei() used call_rcu(), which covered the walker, while eventfs_iterate() needs the SRCU grace period. Wait for both and chain call_rcu() from the SRCU callback. Cc: stable(a)vger.kernel.org Fixes: 8e556432477e ("eventfs: Use SRCU for freeing eventfs_inodes") Link: https://patch.msgid.link/20261009-work-fixes-rcu-v1-4-7446d2d335e6@kernel.o… Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/tracefs/event_inode.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 8efb9c467b7d..ca55828e7446 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -92,6 +92,14 @@ static void free_ei_rcu(struct rcu_head *rcu) } } +/* read under eventfs_srcu and, by tracefs_d_revalidate(), in rcu pathwalk */ +static void free_ei_srcu(struct rcu_head *rcu) +{ + struct eventfs_inode *ei = container_of(rcu, struct eventfs_inode, rcu); + + call_rcu(&ei->rcu, free_ei_rcu); +} + /* * eventfs_inode reference count management. * @@ -113,7 +121,7 @@ static void release_ei(struct kref *ref) entry->release(entry->name, ei->data); } - call_srcu(&eventfs_srcu, &ei->rcu, free_ei_rcu); + call_srcu(&eventfs_srcu, &ei->rcu, free_ei_srcu); } static inline void put_ei(struct eventfs_inode *ei) -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-98799
by Chen Yuxi 29 Oct '26

29 Oct '26

Fix CVE-2026-98799 and the kabi breakage. Chen Yuxi (1): bpf: Fix kabi breakage in struct bpf_tramp_image and bpf_trampoline Florent Revest (Anthropic) (1): bpf: Skip detached progs in trampoline images that are still in use arch/arm64/net/bpf_jit_comp.c | 37 ++++++++------ arch/riscv/net/bpf_jit_comp64.c | 45 ++++++++++++----- arch/s390/net/bpf_jit_comp.c | 43 ++++++++++------ arch/x86/net/bpf_jit_comp.c | 27 ++++++---- include/linux/bpf.h | 52 +++++++++++++++++-- kernel/bpf/trampoline.c | 90 ++++++++++++++++++++++++++------- 6 files changed, 217 insertions(+), 77 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] bpf: Fix u32 overflow issue in map batch operations
by Pu Lehui 29 Oct '26

29 Oct '26

From: Masoud Aghasi <maghasi(a)disroot.org> mainline inclusion from mainline-v7.3-rc5 commit 953824e508b27d12837e32ef37ef6248e1f6fc7a category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Several map batch operation implementations such as generic_map_lookup_batch() use calculations in the form of "values + cp * map->value_size" to compute the desired userspace memory address for reading or writing. This can overflow the u32 type (the result of "cp * map->value_size") when the map size exceeds 4GB. generic_map_lookup_batch() may corrupt values for some keys in userspace memory, and in some cases it mismatches values for some keys while still reporting success. Other batch operations may fail to delete or update some keys, or the syscall may return unexpected errors. Add size_t casts to prevent the affected offset and size calculations from overflowing. Fixes: cb4d03ab499d ("bpf: Add generic support for lookup batch op") Fixes: aa2e93b8e58e ("bpf: Add generic support for update and delete batch ops") Fixes: 057996380a42 ("bpf: Add batch ops to all htab bpf map") Signed-off-by: Masoud Aghasi <maghasi(a)disroot.org> Link: https://lore.kernel.org/r/20260903082734.623904-1-maghasi@disroot.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/hashtab.c | 8 ++++---- kernel/bpf/syscall.c | 10 +++++----- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index 5e6953572ffc..f6d1549146ff 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -2020,10 +2020,10 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map, rcu_read_unlock(); bpf_enable_instrumentation(); - if (bucket_cnt && (copy_to_user(ukeys + total * key_size, keys, - key_size * bucket_cnt) || - copy_to_user(uvalues + total * value_size, values, - value_size * bucket_cnt))) { + if (bucket_cnt && (copy_to_user(ukeys + (size_t)total * key_size, keys, + (size_t)key_size * bucket_cnt) || + copy_to_user(uvalues + (size_t)total * value_size, values, + (size_t)value_size * bucket_cnt))) { ret = -EFAULT; goto after_loop; } diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 117f1628e9b7..b18ac538fd87 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1734,7 +1734,7 @@ int generic_map_delete_batch(struct bpf_map *map, for (cp = 0; cp < max_count; cp++) { err = -EFAULT; - if (copy_from_user(key, keys + cp * map->key_size, + if (copy_from_user(key, keys + (size_t)cp * map->key_size, map->key_size)) break; @@ -1800,9 +1800,9 @@ int generic_map_update_batch(struct bpf_map *map, struct file *map_file, for (cp = 0; cp < max_count; cp++) { err = -EFAULT; - if (copy_from_user(key, keys + cp * map->key_size, + if (copy_from_user(key, keys + (size_t)cp * map->key_size, map->key_size) || - copy_from_user(value, values + cp * value_size, value_size)) + copy_from_user(value, values + (size_t)cp * value_size, value_size)) break; err = bpf_map_update_value(map, map_file, key, value, @@ -1883,12 +1883,12 @@ int generic_map_lookup_batch(struct bpf_map *map, if (err) goto free_buf; - if (copy_to_user(keys + cp * map->key_size, key, + if (copy_to_user(keys + (size_t)cp * map->key_size, key, map->key_size)) { err = -EFAULT; goto free_buf; } - if (copy_to_user(values + cp * value_size, value, value_size)) { + if (copy_to_user(values + (size_t)cp * value_size, value, value_size)) { err = -EFAULT; goto free_buf; } -- 2.34.1

2 1

[PATCH v5 OLK-6.6 0/4] arm64: Allow CPU0 to be nohz_full
by Xia Fukun 29 Oct '26

29 Oct '26

Identifying potential sources of KABI changes. Xiongfeng Wang (4): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether there exists a housekeeping CPU online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arm64: defconfig: Enable CONFIG_PM_SLEEP_SMP_NONZERO_CPU and CONFIG_ARCH_SUSPEND_NONZERO_CPU arch/arm64/Kconfig | 3 ++ arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/process.c | 19 ++++++++- include/linux/cpu.h | 5 ++- include/linux/sched/isolation.h | 2 + include/linux/tick.h | 2 + kernel/cpu.c | 6 +++ kernel/sched/isolation.c | 56 ++++++++++++++++++++++---- kernel/smp.c | 4 ++ kernel/time/tick-sched.c | 11 ++++- 10 files changed, 99 insertions(+), 11 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10] smb: client: bound dirent name against end of SMB response in cifs_filldir
by Ran Hongyun 29 Oct '26

29 Oct '26

mainline inclusion from mainline-v7.2-rc5 commit f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19918 CVE: CVE-2026-93787 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST / FIND_NEXT response using a length (de.namelen) supplied by the server. The kmalloc'd SMB response buffer is bounded, but nothing checks that de.name + de.namelen still lies inside that buffer before the eventual filldir64() -> verify_dirent_name() -> memchr() reads namelen bytes. A hostile SMB1 server that returns an oversized FileNameLength in a directory entry therefore causes memchr() to read past the end of the response slab buffer. Reachable from any user who can list a directory on a CIFS mount served by an attacker-controlled server (getdents64() on the mounted directory): BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80 Read of size 1 at addr ffff88800e0640cc by task poc/115 Call Trace: dump_stack_lvl+0x64/0x80 print_report+0xce/0x620 kasan_report+0xec/0x120 memchr+0x71/0x80 filldir64+0x4c/0x6a0 cifs_filldir.constprop.0+0x9bb/0x1e00 cifs_readdir+0x2101/0x3380 iterate_dir+0x19c/0x520 __x64_sys_getdents64+0x126/0x210 do_syscall_64+0x107/0x5a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Pass the end-of-response pointer down to cifs_filldir() and reject entries whose name would extend past that boundary. This bug was discovered by Artiphishell's vTriage pipeline, which generated a userspace reproducer (an emulated hostile SMB1 server plus a getdents64() client) that reliably triggers the KASAN report on an unpatched kernel. The fix below was drafted with the Claude coding assistant; a userspace reproducer is available on request. Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Jay Vadayath <jay(a)artiphishell.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/readdir.c [The target tree keeps the CIFS client under fs/cifs/ and cifs_filldir() has no struct cached_fid *cfid parameter yet, so only the new end_of_smb argument was added and passed from cifs_readdir().] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/cifs/readdir.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c index a7a9391214c1..3db39364ba55 100644 --- a/fs/cifs/readdir.c +++ b/fs/cifs/readdir.c @@ -835,7 +835,8 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos, static int cifs_filldir(char *find_entry, struct file *file, struct dir_context *ctx, - char *scratch_buf, unsigned int max_len) + char *scratch_buf, unsigned int max_len, + char *end_of_smb) { struct cifsFileInfo *file_info = file->private_data; struct super_block *sb = file_inode(file)->i_sb; @@ -857,6 +858,11 @@ static int cifs_filldir(char *find_entry, struct file *file, return -EINVAL; } + if (de.name + de.namelen > end_of_smb) { + cifs_dbg(VFS, "search entry name extends past end of SMB\n"); + return -EINVAL; + } + /* skip . and .. since we added them first */ if (cifs_entry_is_dot(&de, file_info->srch_inf.unicode)) return 0; @@ -1020,7 +1026,7 @@ int cifs_readdir(struct file *file, struct dir_context *ctx) */ *tmp_buf = 0; rc = cifs_filldir(current_entry, file, ctx, - tmp_buf, max_len); + tmp_buf, max_len, end_of_smb); if (rc) { if (rc > 0) rc = 0; -- 2.52.0

2 1

[PATCH OLK-6.6 v2 00/18] MOC bypass cache
by Jiacheng Yu 29 Oct '26

29 Oct '26

MOC bypass cache by page based attribute Fanhua Li (2): arm64: mm: Set PBHA0 bit for VM_PBHA_BIT0 arm64: mm: Introduce procfs interface to update PBHA0 bit James Morse (7): KVM: arm64: Detect and enable PBHA for stage2 dt-bindings: Rename the description of cpu nodes cpu.yaml dt-bindings: arm: Add binding for Page Based Hardware Attributes arm64: cpufeature: Enable PBHA bits for stage1 arm64: mm: Add pgprot_pbha() to allow drivers to request PBHA values KVM: arm64: Configure PBHA bits for stage2 Documentation: arm64: Describe the support and expectations for PBHA Ma Wupeng (9): arm64: cpufeature: Enable PBHA for stage1 early via FDT arm64: mm: Detect and enable PBHA bit0 at early startup arm64: mm: Update kernel pte entries if pbha bit0 enabled arm64: mm: Show PBHA bit 59 as PBHA0 in ptdump arm64: mm: Introduce VM_PBHA_BIT0 to enable pbha bit0 for single vma arm64: mm: Set flag VM_PBHA_BIT0 for global init task arm64: mm: Introduce prctl to control pbha behavior arm64: mm: Introduce kernel param pbha openeuler: configs: arm64: Enable PBHA by default .../admin-guide/kernel-parameters.txt | 7 + Documentation/admin-guide/mm/pagemap.rst | 4 +- Documentation/arch/arm64/index.rst | 1 + Documentation/arm64/pbha.rst | 87 +++ .../devicetree/bindings/arm/cpu.yaml | 578 ++++++++++++++++ .../devicetree/bindings/arm/cpus.yaml | 623 ++---------------- arch/arm64/Kconfig | 19 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 15 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_pgtable.h | 9 + arch/arm64/include/asm/mman.h | 7 + arch/arm64/include/asm/pgtable-hwdef.h | 6 + arch/arm64/include/asm/pgtable.h | 26 + arch/arm64/include/asm/setup.h | 1 + arch/arm64/include/uapi/asm/mman.h | 1 + arch/arm64/kernel/cpufeature.c | 258 ++++++++ arch/arm64/kernel/head.S | 3 + arch/arm64/kernel/image-vars.h | 2 + arch/arm64/kvm/hyp/pgtable.c | 16 +- arch/arm64/mm/fixmap.c | 2 + arch/arm64/mm/hugetlbpage.c | 3 + arch/arm64/mm/mmap.c | 4 + arch/arm64/mm/mmu.c | 13 +- arch/arm64/mm/ptdump.c | 5 + arch/arm64/tools/cpucaps | 6 +- .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/fdt.c | 52 ++ drivers/soc/hisilicon/Makefile | 1 + drivers/soc/hisilicon/pbha.c | 211 ++++++ fs/proc/base.c | 116 ++++ fs/proc/task_mmu.c | 18 + include/linux/mm.h | 10 +- include/linux/pbha.h | 93 +++ include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/prctl.h | 1 + kernel/sys.c | 10 + mm/memory.c | 4 + mm/vmalloc.c | 4 + tools/include/uapi/asm-generic/mman-common.h | 1 + 40 files changed, 1661 insertions(+), 562 deletions(-) create mode 100644 Documentation/arm64/pbha.rst create mode 100644 Documentation/devicetree/bindings/arm/cpu.yaml create mode 100644 drivers/soc/hisilicon/pbha.c create mode 100644 include/linux/pbha.h -- 2.43.0

2 19

[PATCH OLK-5.10 v2] filescgroup: migrate files resources of every task, not just the first
by Cai Xinchen 29 Oct '26

29 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10137 -------------------------------- files_cgroup_can_attach() used cgroup_taskset_first() and only migrated the files resources of the first task of the taskset. A thread group may contain tasks that own private files_struct instances (created through unshare(CLONE_FILES) or clone() without CLONE_FILES); on a thread-group migration those structs kept pointing at the source cgroup, so FDs opened afterwards were charged to the source cgroup and bypassed the target cgroup's files.limit. Walk the whole taskset with cgroup_taskset_for_each(), de-duplicating tasks that share a files_struct (they already point at the target css after being handled by an earlier task). A partial migration is rolled back inside ->can_attach() from a list of records that stores the source css of every files_struct actually moved; the source cannot be recomputed from task_css() because a shared files_struct may be charged to a css that differs from its task's. ->cancel_attach() is registered as well, but in this tree files is the last subsystem implementing ->can_attach() and the core only cancels subsystems with a lower ssid than the failing one, so the core never invokes it today; it is kept for forward compatibility. Fixes: be6df5f1e6b8 ("cgroups: Resource controller for open files") Assisted-by: opencode:deepseek-v4.1-flash Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/filescontrol.c | 236 +++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 211 insertions(+), 25 deletions(-) diff --git a/fs/filescontrol.c b/fs/filescontrol.c index fdd557a246be..674d6205a194 100644 --- a/fs/filescontrol.c +++ b/fs/filescontrol.c @@ -103,32 +103,147 @@ u64 files_cgroup_count_fds(struct files_struct *files) } /* - * If attaching this cgroup would overcommit the resource then deny - * the attach. If not, attach the file resource into new cgroup. + * A files migration performed by ->can_attach(), recording the migrated + * files_struct, the css it is moved from/to and the fd count that was + * moved so that the move can be rolled back later. */ -static int files_cgroup_can_attach(struct cgroup_taskset *tset) +struct files_migrate_entry { + struct files_struct *files; + struct cgroup_subsys_state *from_css; + struct cgroup_subsys_state *to_css; + u64 num_files; + struct list_head node; +}; + +/* + * Serializes enabling no_acct against the whole can_attach() -> attach() + * transaction. no_acct is a global switch, so a dedicated lock is used + * instead of cgroup_mutex, which must not be taken under a kernfs active + * reference from a cgroup file write callback. + */ +static DEFINE_MUTEX(files_no_acct_lock); +static LIST_HEAD(files_migrate_entries); + +/* Undo exactly the files_structs ->can_attach() actually migrated. */ +static void files_migrate_rollback(void) { + struct files_migrate_entry *mig_entry, *next_entry; + struct cgroup_subsys_state *from_css, *to_css; + struct page_counter *from_res, *to_res; + struct files_struct *files; u64 num_files; - bool can_attach; - struct cgroup_subsys_state *to_css; - struct cgroup_subsys_state *from_css; - struct page_counter *from_res; - struct page_counter *to_res; - struct page_counter *fail_res; + LIST_HEAD(list); + + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + from_css = mig_entry->from_css; + to_css = mig_entry->to_css; + files = mig_entry->files; + + list_del(&mig_entry->node); + + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); + + spin_lock(&files->file_lock); + /* + * With no_acct enabled, fd changes after the migration are + * not charged to @to_css, so only the count that was moved + * by ->can_attach() may be moved back. Otherwise every + * change was accounted to @to_css and the current count is + * the amount to transfer. + */ + if (READ_ONCE(no_acct)) + num_files = mig_entry->num_files; + else + num_files = files_cgroup_count_fds(files); + page_counter_uncharge(to_res, num_files); + page_counter_charge(from_res, num_files); + css_put(to_css); + files->files_cgroup = css_fcg(from_css); + spin_unlock(&files->file_lock); + + /* + * Drop the references taken when the move was recorded: + * the pin on @files (this may free it, which uncharges + * the just-restored css). + */ + put_files_struct(files); + kfree(mig_entry); + } +} + +/* Migration committed: the moves are final, just drop the records. */ +static void files_migrate_commit(void) +{ + struct files_migrate_entry *mig_entry, *next_entry; + LIST_HEAD(list); + + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + list_del(&mig_entry->node); + /* + * The moves are final: the files_struct keeps its + * reference on @to_css, only the pin and the reference + * transferred from the pre-migration state are dropped. + */ + put_files_struct(mig_entry->files); + css_put(mig_entry->from_css); + kfree(mig_entry); + } +} + +static void files_cgroup_cancel_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_rollback(); + mutex_unlock(&files_no_acct_lock); +} + +static void files_cgroup_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_commit(); + mutex_unlock(&files_no_acct_lock); +} + +/* + * files_cgroup_can_attach_one_task - try to migrate one task's files_struct + * @task: task to migrate + * @mig_entry: migration record filled in on success + * @to_css: target css + * @skip: set to true if @task has no chargeable files_struct or its + * files_struct already points at @to_css + */ +static int files_cgroup_can_attach_one_task(struct task_struct *task, + struct files_migrate_entry *mig_entry, + struct cgroup_subsys_state *to_css, + bool *skip) +{ + int ret = 0; + u64 num_files; + struct page_counter *from_res, *to_res, *fail_res; struct files_struct *files; - struct task_struct *task = cgroup_taskset_first(tset, &to_css); + struct cgroup_subsys_state *from_css; - to_res = css_res_open_handles(to_css); + *skip = false; task_lock(task); files = task->files; - if (!files || files == &init_files) { - task_unlock(task); - return 0; + if (!files || !files->files_cgroup || files == &init_files) { + *skip = true; + goto skip; } from_css = &files_cgroup_from_files(files)->css; + /* Already on the target css, or handled via a shared files_struct. */ + if (from_css == to_css) { + *skip = true; + goto skip; + } + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); spin_lock(&files->file_lock); num_files = files_cgroup_count_fds(files); @@ -137,16 +252,77 @@ static int files_cgroup_can_attach(struct cgroup_taskset *tset) if (!page_counter_try_charge(to_res, num_files, &fail_res)) { page_counter_charge(from_res, num_files); pr_err("Open files limit overcommited\n"); - can_attach = false; - } else { - css_put(from_css); - css_get(to_css); - task->files->files_cgroup = css_fcg(to_css); - can_attach = true; + ret = -ENOSPC; + goto unlock; } + + /* + * The files_struct's reference on @from_css is transferred to + * the rollback record; @to_css is referenced by the + * files_struct from now on. + */ + css_get(to_css); + files->files_cgroup = css_fcg(to_css); + + atomic_inc(&files->count); + mig_entry->files = files; + mig_entry->from_css = from_css; + mig_entry->to_css = to_css; + mig_entry->num_files = num_files; + +unlock: spin_unlock(&files->file_lock); +skip: task_unlock(task); - return can_attach ? 0 : -ENOSPC; + return ret; +} + +/* + * If attaching this cgroup would overcommit the resource then deny + * the attach. If not, attach the file resource into new cgroup. + */ +static int files_cgroup_can_attach(struct cgroup_taskset *tset) +{ + struct task_struct *task; + struct cgroup_subsys_state *to_css; + struct files_migrate_entry *mig_entry; + int ret = 0; + bool skip = false; + + /* + * Keep no_acct stable until ->attach() or ->cancel_attach() runs. + * A successful can_attach() leaves the lock held for the matching + * callback; a failure rolls back and releases it here. + */ + mutex_lock(&files_no_acct_lock); + + cgroup_taskset_for_each(task, to_css, tset) { + mig_entry = kzalloc(sizeof(*mig_entry), GFP_KERNEL); + if (!mig_entry) { + ret = -ENOMEM; + break; + } + + ret = files_cgroup_can_attach_one_task(task, mig_entry, to_css, &skip); + if (ret) { + kfree(mig_entry); + break; + } + + if (skip) { + kfree(mig_entry); + continue; + } + + list_add_tail(&mig_entry->node, &files_migrate_entries); + } + + if (ret) { + files_migrate_rollback(); + mutex_unlock(&files_no_acct_lock); + } + + return ret; } int files_cgroup_alloc_fd(struct files_struct *files, u64 n) @@ -161,7 +337,7 @@ int files_cgroup_alloc_fd(struct files_struct *files, u64 n) * we don't charge their fds, only issue is that files.usage * won't be accurate in root files cgroup. */ - if (!no_acct && files != &init_files) { + if (!READ_ONCE(no_acct) && files != &init_files) { struct page_counter *fail_res; struct files_cgroup *files_cgroup = files_cgroup_from_files(files); @@ -179,7 +355,7 @@ void files_cgroup_unalloc_fd(struct files_struct *files, u64 n) * It's not charged so no need to uncharge, see comments in * files_cgroup_alloc_fd. */ - if (!no_acct && files != &init_files) { + if (!READ_ONCE(no_acct) && files != &init_files) { struct files_cgroup *files_cgroup = files_cgroup_from_files(files); page_counter_uncharge(&files_cgroup->open_handles, n); @@ -190,7 +366,7 @@ EXPORT_SYMBOL(files_cgroup_unalloc_fd); static u64 files_disabled_read(struct cgroup_subsys_state *css, struct cftype *cft) { - return no_acct; + return READ_ONCE(no_acct); } static int files_disabled_write(struct cgroup_subsys_state *css, @@ -198,7 +374,10 @@ static int files_disabled_write(struct cgroup_subsys_state *css, { if (!val) return -EINVAL; - no_acct = true; + + mutex_lock(&files_no_acct_lock); + WRITE_ONCE(no_acct, true); + mutex_unlock(&files_no_acct_lock); return 0; } @@ -276,6 +455,13 @@ struct cgroup_subsys files_cgrp_subsys = { .css_alloc = files_cgroup_css_alloc, .css_free = files_cgroup_css_free, .can_attach = files_cgroup_can_attach, + /* + * Not reachable today because files has the highest ssid among the + * subsystems implementing ->can_attach(); kept for forward + * compatibility. See the comment above struct files_migrate_entry. + */ + .cancel_attach = files_cgroup_cancel_attach, + .attach = files_cgroup_attach, .legacy_cftypes = files, .dfl_cftypes = files, }; -- 2.34.1

2 1

[PATCH v4 OLK-6.6 0/4] arm64: Allow CPU0 to be nohz_full
by Xia Fukun 29 Oct '26

29 Oct '26

test ignore kabi Xiongfeng Wang (4): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether there exists a housekeeping CPU online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arm64: defconfig: Enable CONFIG_PM_SLEEP_SMP_NONZERO_CPU and CONFIG_ARCH_SUSPEND_NONZERO_CPU arch/arm64/Kconfig | 3 ++ arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/process.c | 19 ++++++++- include/linux/cpu.h | 3 +- include/linux/sched/isolation.h | 2 + include/linux/tick.h | 2 + kernel/cpu.c | 6 +++ kernel/sched/isolation.c | 56 ++++++++++++++++++++++---- kernel/smp.c | 4 ++ kernel/time/tick-sched.c | 11 ++++- 10 files changed, 97 insertions(+), 11 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 v2 00/18] MOC bypass cache
by Jiacheng Yu 29 Oct '26

29 Oct '26

MOC bypass cache by page based attribute Fanhua Li (2): arm64: mm: Set PBHA0 bit for VM_PBHA_BIT0 arm64: mm: Introduce procfs interface to update PBHA0 bit James Morse (7): KVM: arm64: Detect and enable PBHA for stage2 dt-bindings: Rename the description of cpu nodes cpu.yaml dt-bindings: arm: Add binding for Page Based Hardware Attributes arm64: cpufeature: Enable PBHA bits for stage1 arm64: mm: Add pgprot_pbha() to allow drivers to request PBHA values KVM: arm64: Configure PBHA bits for stage2 Documentation: arm64: Describe the support and expectations for PBHA Ma Wupeng (9): arm64: cpufeature: Enable PBHA for stage1 early via FDT arm64: mm: Detect and enable PBHA bit0 at early startup arm64: mm: Update kernel pte entries if pbha bit0 enabled arm64: mm: Show PBHA bit 59 as PBHA0 in ptdump arm64: mm: Introduce VM_PBHA_BIT0 to enable pbha bit0 for single vma arm64: mm: Set flag VM_PBHA_BIT0 for global init task arm64: mm: Introduce prctl to control pbha behavior arm64: mm: Introduce kernel param pbha openeuler: configs: arm64: Enable PBHA by default .../admin-guide/kernel-parameters.txt | 7 + Documentation/admin-guide/mm/pagemap.rst | 4 +- Documentation/arch/arm64/index.rst | 1 + Documentation/arm64/pbha.rst | 87 +++ .../devicetree/bindings/arm/cpu.yaml | 578 ++++++++++++++++ .../devicetree/bindings/arm/cpus.yaml | 623 ++---------------- arch/arm64/Kconfig | 19 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 15 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_pgtable.h | 9 + arch/arm64/include/asm/mman.h | 7 + arch/arm64/include/asm/pgtable-hwdef.h | 6 + arch/arm64/include/asm/pgtable.h | 26 + arch/arm64/include/asm/setup.h | 1 + arch/arm64/include/uapi/asm/mman.h | 1 + arch/arm64/kernel/cpufeature.c | 258 ++++++++ arch/arm64/kernel/head.S | 3 + arch/arm64/kernel/image-vars.h | 2 + arch/arm64/kvm/hyp/pgtable.c | 16 +- arch/arm64/mm/fixmap.c | 2 + arch/arm64/mm/hugetlbpage.c | 3 + arch/arm64/mm/mmap.c | 4 + arch/arm64/mm/mmu.c | 13 +- arch/arm64/mm/ptdump.c | 5 + arch/arm64/tools/cpucaps | 6 +- .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/fdt.c | 52 ++ drivers/soc/hisilicon/Makefile | 1 + drivers/soc/hisilicon/pbha.c | 211 ++++++ fs/proc/base.c | 116 ++++ fs/proc/task_mmu.c | 18 + include/linux/mm.h | 10 +- include/linux/pbha.h | 93 +++ include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/prctl.h | 1 + kernel/sys.c | 10 + mm/memory.c | 4 + mm/vmalloc.c | 4 + tools/include/uapi/asm-generic/mman-common.h | 1 + 40 files changed, 1661 insertions(+), 562 deletions(-) create mode 100644 Documentation/arm64/pbha.rst create mode 100644 Documentation/devicetree/bindings/arm/cpu.yaml create mode 100644 drivers/soc/hisilicon/pbha.c create mode 100644 include/linux/pbha.h -- 2.43.0

2 19

[PATCH OLK-6.6] filescgroup: migrate files resources of every task, not just the first
by Cai Xinchen 29 Oct '26

29 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10137 -------------------------------- files_cgroup_can_attach() used cgroup_taskset_first() and only migrated the files resources of the first task of the taskset. A thread group may contain tasks that own private files_struct instances (created through unshare(CLONE_FILES) or clone() without CLONE_FILES); on a thread-group migration those structs kept pointing at the source cgroup, so FDs opened afterwards were charged to the source cgroup and bypassed the target cgroup's files.limit. Walk the whole taskset with cgroup_taskset_for_each(), de-duplicating tasks that share a files_struct (they already point at the target css after being handled by an earlier task). A partial migration is rolled back inside ->can_attach() from a list of records that stores the source css of every files_struct actually moved; the source cannot be recomputed from task_css() because a shared files_struct may be charged to a css that differs from its task's. ->cancel_attach() is registered as well, but in this tree files is the last subsystem implementing ->can_attach() and the core only cancels subsystems with a lower ssid than the failing one, so the core never invokes it today; it is kept for forward compatibility. Fixes: be6df5f1e6b8 ("cgroups: Resource controller for open files") Assisted-by: opencode:deepseek-v4.1-flash Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/legacy-filescontrol.c | 235 ++++++++++++++++++++++++++++++++++----- 1 file changed, 210 insertions(+), 25 deletions(-) diff --git a/fs/legacy-filescontrol.c b/fs/legacy-filescontrol.c index 8ef732bf9020..eede8ba64332 100644 --- a/fs/legacy-filescontrol.c +++ b/fs/legacy-filescontrol.c @@ -96,32 +96,146 @@ static void files_cgroup_css_free(struct cgroup_subsys_state *css) } /* - * If attaching this cgroup would overcommit the resource then deny - * the attach. If not, attach the file resource into new cgroup. + * A files migration performed by ->can_attach(), recording the migrated + * files_struct, the css it is moved from/to and the fd count that was + * moved so that the move can be rolled back later. */ -static int files_cgroup_can_attach(struct cgroup_taskset *tset) -{ - u64 num_files; - bool can_attach; - struct cgroup_subsys_state *to_css; +struct files_migrate_entry { + struct files_struct *files; struct cgroup_subsys_state *from_css; - struct page_counter *from_res; - struct page_counter *to_res; - struct page_counter *fail_res; + struct cgroup_subsys_state *to_css; + u64 num_files; + struct list_head node; +}; + +/* + * Serializes enabling no_acct against the whole can_attach() -> attach() + * transaction. no_acct is a global switch, so a dedicated lock is used + * instead of cgroup_mutex, which must not be taken under a kernfs active + * reference from a cgroup file write callback. + */ +static DEFINE_MUTEX(files_no_acct_lock); +static LIST_HEAD(files_migrate_entries); + +/* Undo exactly the files_structs ->can_attach() actually migrated. */ +static void files_migrate_rollback(void) +{ + struct files_migrate_entry *mig_entry, *next_entry; + struct cgroup_subsys_state *from_css, *to_css; + struct page_counter *from_res, *to_res; struct files_struct *files; - struct task_struct *task = cgroup_taskset_first(tset, &to_css); + u64 num_files; + LIST_HEAD(list); + + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + from_css = mig_entry->from_css; + to_css = mig_entry->to_css; + files = mig_entry->files; + + list_del(&mig_entry->node); + + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); + + spin_lock(&files->file_lock); + /* + * With no_acct enabled, fd changes after the migration are + * not charged to @to_css, so only the count that was moved + * by ->can_attach() may be moved back. Otherwise every + * change was accounted to @to_css and the current count is + * the amount to transfer. + */ + if (READ_ONCE(no_acct)) + num_files = mig_entry->num_files; + else + num_files = file_cg_count_fds(files); + page_counter_uncharge(to_res, num_files); + page_counter_charge(from_res, num_files); + css_put(to_css); + files->files_cgroup = css_fcg(from_css); + spin_unlock(&files->file_lock); + + /* + * Drop the references taken when the move was recorded: + * the pin on @files (this may free it, which uncharges + * the just-restored css). + */ + put_files_struct(files); + kfree(mig_entry); + } +} - to_res = css_res_open_handles(to_css); +/* Migration committed: the moves are final, just drop the records. */ +static void files_migrate_commit(void) +{ + struct files_migrate_entry *mig_entry, *next_entry; + LIST_HEAD(list); + + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + list_del(&mig_entry->node); + /* + * The moves are final: the files_struct keeps its + * reference on @to_css, only the pin and the reference + * transferred from the pre-migration state are dropped. + */ + put_files_struct(mig_entry->files); + css_put(mig_entry->from_css); + kfree(mig_entry); + } +} + +static void files_cgroup_cancel_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_rollback(); + mutex_unlock(&files_no_acct_lock); +} + +static void files_cgroup_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_commit(); + mutex_unlock(&files_no_acct_lock); +} + +/* + * files_cgroup_can_attach_one_task - judge one task can attach to files cgroup + * @task: the task is judged whether can attach + * @mig_entry: files_migrate_entry record + * @to_css: the css migrate to + * @skip: if task files is NULL or files->files_cgroup is NULL or files == init_files + * or already on target css, skip attach is true + */ +static int files_cgroup_can_attach_one_task(struct task_struct *task, + struct files_migrate_entry *mig_entry, + struct cgroup_subsys_state *to_css, + bool *skip) +{ + int ret = 0; + u64 num_files; + struct page_counter *from_res, *to_res, *fail_res; + struct files_struct *files; + struct cgroup_subsys_state *from_css; + *skip = false; task_lock(task); files = task->files; if (!files || !files->files_cgroup || files == &init_files) { - task_unlock(task); - return 0; + *skip = true; + goto skip; } from_css = &files_cgroup_from_files(files)->css; + /* Already on the target css, or handled via a shared files_struct. */ + if (from_css == to_css) { + *skip = true; + goto skip; + } + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); spin_lock(&files->file_lock); num_files = file_cg_count_fds(files); @@ -130,16 +244,77 @@ static int files_cgroup_can_attach(struct cgroup_taskset *tset) if (!page_counter_try_charge(to_res, num_files, &fail_res)) { page_counter_charge(from_res, num_files); pr_err("Open files limit overcommited\n"); - can_attach = false; - } else { - css_put(from_css); - css_get(to_css); - task->files->files_cgroup = css_fcg(to_css); - can_attach = true; + ret = -ENOSPC; + goto overcommited; } + + /* + * The files_struct's reference on @from_css is transferred to + * the rollback record; @to_css is referenced by the + * files_struct from now on. + */ + css_get(to_css); + files->files_cgroup = css_fcg(to_css); + + atomic_inc(&files->count); + mig_entry->files = files; + mig_entry->from_css = from_css; + mig_entry->to_css = to_css; + mig_entry->num_files = num_files; + +overcommited: spin_unlock(&files->file_lock); +skip: task_unlock(task); - return can_attach ? 0 : -ENOSPC; + return ret; +} + +/* + * If attaching this cgroup would overcommit the resource then deny + * the attach. If not, attach the file resource into new cgroup. + */ +static int files_cgroup_can_attach(struct cgroup_taskset *tset) +{ + struct task_struct *task; + struct cgroup_subsys_state *to_css; + struct files_migrate_entry *mig_entry; + int ret = 0; + bool skip = false; + + /* + * Keep no_acct stable until ->attach() or ->cancel_attach() runs. + * A successful can_attach() leaves the lock held for the matching + * callback; a failure rolls back and releases it here. + */ + mutex_lock(&files_no_acct_lock); + + cgroup_taskset_for_each(task, to_css, tset) { + mig_entry = kzalloc(sizeof(*mig_entry), GFP_KERNEL); + if (!mig_entry) { + ret = -ENOMEM; + break; + } + + ret = files_cgroup_can_attach_one_task(task, mig_entry, to_css, &skip); + if (ret) { + kfree(mig_entry); + break; + } + + if (skip) { + kfree(mig_entry); + continue; + } + + list_add_tail(&mig_entry->node, &files_migrate_entries); + } + + if (ret) { + files_migrate_rollback(); + mutex_unlock(&files_no_acct_lock); + } + + return ret; } int files_cgroup_alloc_fd(struct files_struct *files, u64 n) @@ -156,7 +331,7 @@ int files_cgroup_alloc_fd(struct files_struct *files, u64 n) * we don't charge their fds, only issue is that files.usage * won't be accurate in root files cgroup. */ - if (!no_acct && files != &init_files) { + if (!READ_ONCE(no_acct) && files != &init_files) { struct page_counter *fail_res; struct files_cgroup *files_cgroup = files_cgroup_from_files(files); @@ -175,7 +350,7 @@ void files_cgroup_unalloc_fd(struct files_struct *files, u64 n) * It's not charged so no need to uncharge, see comments in * files_cgroup_alloc_fd. */ - if (!no_acct && files != &init_files) { + if (!READ_ONCE(no_acct) && files != &init_files) { struct files_cgroup *files_cgroup = files_cgroup_from_files(files); page_counter_uncharge(&files_cgroup->open_handles, n); @@ -208,7 +383,7 @@ int files_cgroup_dup_fds(struct files_struct *newf) static u64 files_disabled_read(struct cgroup_subsys_state *css, struct cftype *cft) { - return no_acct; + return READ_ONCE(no_acct); } static int files_disabled_write(struct cgroup_subsys_state *css, @@ -216,7 +391,10 @@ static int files_disabled_write(struct cgroup_subsys_state *css, { if (!val) return -EINVAL; - no_acct = true; + + mutex_lock(&files_no_acct_lock); + WRITE_ONCE(no_acct, true); + mutex_unlock(&files_no_acct_lock); return 0; } @@ -294,6 +472,13 @@ struct cgroup_subsys files_cgrp_subsys = { .css_alloc = files_cgroup_css_alloc, .css_free = files_cgroup_css_free, .can_attach = files_cgroup_can_attach, + /* + * Not reachable today because files has the highest ssid among the + * subsystems implementing ->can_attach(); kept for forward + * compatibility. See the comment above struct files_migrate_entry. + */ + .cancel_attach = files_cgroup_cancel_attach, + .attach = files_cgroup_attach, .legacy_cftypes = files, }; -- 2.34.1

2 1