- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v1] cgroup/cpuset: Fix stale prefer_cpus on v2 attach fast path
by Yao Yiqi 13 Nov '26

13 Nov '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10338 -------------------------------- Commit 7fd4da9c1584 ("cgroup/cpuset: Optimize cpuset_attach() on v2") skips the whole task iteration in cpuset_attach() when the destination cpuset has the same effective cpus/mems as the source one. The fix for prefer_cpus ineffectiveness (5ce00cbd095c) extended that condition with prefer_cpus_updated(), which compares the *destination* cpuset's prefer_cpus with the *source* cpuset's. That is not a valid proxy for "the tasks do not need updating", because a task's prefer_cpus is not guaranteed to match the prefer_cpus of the cpuset it belongs to: - /proc/<pid>/preferred_cpuset sets the per-task mask directly, bypassing the cgroup; - update_tasks_prefer_cpumask() pushes cs->prefer_cpus only when the cgroup file is written, and the push is dropped silently when __set_prefer_cpus_ptr() rejects it, e.g. because the task is pinned to a narrower cpumask (new_mask not a subset of p->cpus_ptr), or because the task is not on fair_sched_class; - sched_setaffinity() only rewrites p->cpus_mask, it does not re-synchronize p->prefer_cpus. Consequently, when a task with a stale/empty per-task mask is moved between two cpusets that are configured with the same prefer_cpus, the fast path skips cpuset_attach_task() and the stale value survives forever. The dynamic affinity feature then keeps selecting p->cpus_ptr in set_task_select_cpus() because prefer_cpus_valid() fails, so the task never runs on the preferred CPUs even though the destination cgroup is configured correctly. Fix this by checking the per-task state instead: skip the attach only when applying cs->prefer_cpus to every task in the migration taskset is really a no-op. A task whose prefer_cpus is NULL does not support the feature and is ignored. The per-task masks are inert when neither dynamic affinity nor PARAL is in use, so keep the fast path in that case. This also makes migrating a task into a cpuset whose prefer_cpus is empty clear the stale per-task mask, as expected from the "empty prefer_cpus disables the feature" semantics documented in update_prefer_cpumask(). Note that the old prefer_cpus_updated() helper becomes unused and is removed. Fixes: 5ce00cbd095c ("cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus") Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- kernel/cgroup/cpuset.c | 56 +++++++++++++++++++++++++++++++++--------- 1 file changed, 45 insertions(+), 11 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index be932fb6cc79..55f695285a1f 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -1040,16 +1040,6 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, return 0; } - -static inline bool prefer_cpus_updated(struct cpuset *cs, struct cpuset *oldcs) -{ - return !cpumask_equal(cs->prefer_cpus, oldcs->prefer_cpus); -} -#else -static inline bool prefer_cpus_updated(struct cpuset *cs, struct cpuset *oldcs) -{ - return false; -} #endif #ifdef CONFIG_SMP @@ -3613,6 +3603,49 @@ static void cpuset_attach_task(struct cpuset *cs, struct task_struct *task) cpuset_update_task_spread_flags(cs, task); } +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +/* + * Check if pushing @cs->prefer_cpus to all the tasks of @tset is a no-op. + * + * The per-task value has to be used instead of comparing @cs against the old + * cpuset: a task's prefer_cpus may legitimately differ from the cpuset's + * configuration, e.g. it has been overridden via + * /proc/<pid>/preferred_cpuset, or a previous push was rejected because the + * task was pinned to a narrower cpumask. Comparing cpusets would skip the + * attach in that case and leave the task with a stale mask. + * + * A task with a NULL prefer_cpus does not support this feature and is + * ignored. + */ +static bool tasks_prefer_cpus_unchanged(struct cgroup_taskset *tset, + struct cpuset *cs) +{ + struct cgroup_subsys_state *css; + struct task_struct *task; + + /* + * The per-task masks are inert when both features are off, so there is + * nothing to synchronize. Keep this in sync with prefer_cpus_valid(). + */ + if (likely(!dynamic_affinity_enabled() && !sched_paral_used())) + return true; + + cgroup_taskset_for_each(task, css, tset) { + if (task->prefer_cpus && + !cpumask_equal(task->prefer_cpus, cs->prefer_cpus)) + return false; + } + + return true; +} +#else +static inline bool tasks_prefer_cpus_unchanged(struct cgroup_taskset *tset, + struct cpuset *cs) +{ + return true; +} +#endif + static void cpuset_attach(struct cgroup_taskset *tset) { struct task_struct *task; @@ -3638,7 +3671,8 @@ static void cpuset_attach(struct cgroup_taskset *tset) * by skipping the task iteration and update. */ if (cgroup_subsys_on_dfl(cpuset_cgrp_subsys) && - !cpus_updated && !mems_updated && !prefer_cpus_updated(cs, oldcs)) { + !cpus_updated && !mems_updated && + tasks_prefer_cpus_unchanged(tset, cs)) { cpuset_attach_nodemask_to = cs->effective_mems; goto out; } -- 2.34.1

2 1

[PATCH OLK-6.6] fault-inject: fix dentry leak
by Chen Yuxi 13 Nov '26

13 Nov '26

From: Michael Liang <mliang(a)purestorage.com> mainline inclusion from mainline-v7.4-rc1 commit ceb43516a9aae0d969a4ec5ab40d45bd09e64229 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/21190 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- fault_create_debugfs_attr() has always taken an extra dentry reference on the created directory (attr->dname = dget(dir)) so that fail_dump() could print the name via %pd from any context. Nothing anywhere in the tree ever calls dput() on attr->dname. For callers with a matching teardown, that unmatched reference causes one dentry plus its attached inode to leak per fault_create_debugfs_attr / debugfs_remove_recursive cycle. simple_recursive_removal() drops debugfs's own +1 ref on the child dentry, but the dget()'d ref keeps its refcount at 1: the dentry ends up unhashed but pinned, and its inode is never freed. Boot-once callers (mm/failslab, block/blk-core, etc.) leak exactly once at init and never destroy the tree, so the impact there is bounded. But per-lifecycle callers (drivers/nvme, drivers/infiniband/hw/hfi1, drivers/mmc, drivers/iommu/iommufd, drivers/media, drivers/misc, drivers/gpu/drm/msm, drivers/crypto, net/sunrpc) leak on every create/destroy cycle. We observed this in production: an NVme/RDMA host repeatedly reconnecting to a target that rejected the CRTO Property Get went through ~50 nvme controller create/destroy cycles per second, and dentry and inode_cache grew by ~13k pinned objects per 240 s -- unrecoverable through drop_caches. Byte math matched a per-cycle 1-dentry / 1-inode leak from the "fault_inject" directory dentry. Fix this by not holding any external reference in fault_attr. Embed the directory name as a fixed-size char array (FAULT_ATTR_DNAME_LEN, 64 bytes) inside struct fault_attr, copied by strscpy() at fault_create_debugfs_attr() time. fail_dump() prints it via %s. Advantages of an embedded array over kstrdup() + kfree() paired with a new destroy API: - Zero API footprint. No new export and no caller changes required: callers already own their fault_attr's memory and free it when they are done, and now that suffices. - No allocation on the create path. - fault_create_debugfs_attr() cannot fail from the name-copy step. - No lifetime coupling between attr->dname and debugfs; the string is valid for exactly as long as the containing struct. The 64-byte length accommodates every in-tree caller with generous headroom (the longest current name is "fail_dma_array_full", 19 chars). The user-visible fail_dump() format changes from "name %pd" to "name %s", but the printed content is identical -- %pd on the created directory renders the same string that was passed in as @name. drivers/infiniband/hw/hfi1/fault.c drops a now-invalid "attr.dname = NULL" statement; the surrounding kzalloc() already zero-initialises the array. Link: https://lore.kernel.org/20260821181527.3271414-1-mliang@purestorage.com Fixes: 6adc4a22f20b ("fault-inject: add ratelimit option") Signed-off-by: Michael Liang <mliang(a)purestorage.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Reviewed-by: Andrew Morton <akpm(a)linux-foundation.org> Cc: Akinbou Mita <akinobu.mita(a)gmail.com> Cc: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Cc: Jason Gunthorpe <jgg(a)ziepe.ca> Cc: Leon Romanovsky <leon(a)kernel.org> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: <stable(a)vger.kernel.org> Conflicts: include/linux/fault-inject.h lib/fault-inject.c [OLK-6.6 struct layout differs from mainline v7.4; place FAULT_ATTR_DNAME_LEN and the dname array per the OLK tree, and add <linux/string.h> for strscpy()] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- drivers/infiniband/hw/hfi1/fault.c | 1 - include/linux/fault-inject.h | 10 ++++++++-- lib/fault-inject.c | 7 +++++-- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/fault.c b/drivers/infiniband/hw/hfi1/fault.c index 3af77a0840ab..73b0e767d24d 100644 --- a/drivers/infiniband/hw/hfi1/fault.c +++ b/drivers/infiniband/hw/hfi1/fault.c @@ -226,7 +226,6 @@ int hfi1_fault_init_debugfs(struct hfi1_ibdev *ibd) ibd->fault->attr.interval = 1; ibd->fault->attr.require_end = ULONG_MAX; ibd->fault->attr.stacktrace_depth = 32; - ibd->fault->attr.dname = NULL; ibd->fault->attr.verbose = 0; ibd->fault->enable = false; ibd->fault->opcode = false; diff --git a/include/linux/fault-inject.h b/include/linux/fault-inject.h index 354413950d34..54ee3e9ef220 100644 --- a/include/linux/fault-inject.h +++ b/include/linux/fault-inject.h @@ -10,6 +10,13 @@ #include <linux/ratelimit.h> #include <linux/atomic.h> +/* + * Length of the debugfs directory name embedded in struct fault_attr. + * Chosen to accommodate every in-tree caller of fault_create_debugfs_attr() + * (the longest is "fail_dma_array_full", 19 chars) with generous headroom. + */ +#define FAULT_ATTR_DNAME_LEN 64 + /* * For explanation of the elements of this struct, see * Documentation/fault-injection/fault-injection.rst @@ -29,7 +36,7 @@ struct fault_attr { unsigned long count; struct ratelimit_state ratelimit_state; - struct dentry *dname; + char dname[FAULT_ATTR_DNAME_LEN]; }; enum fault_flags { @@ -43,7 +50,6 @@ enum fault_flags { .stacktrace_depth = 32, \ .ratelimit_state = RATELIMIT_STATE_INIT_DISABLED, \ .verbose = 2, \ - .dname = NULL, \ } #define DECLARE_FAULT_ATTR(name) struct fault_attr name = FAULT_ATTR_INITIALIZER diff --git a/lib/fault-inject.c b/lib/fault-inject.c index d608f9b48c10..71f1a722fe17 100644 --- a/lib/fault-inject.c +++ b/lib/fault-inject.c @@ -4,6 +4,7 @@ #include <linux/random.h> #include <linux/sched.h> #include <linux/stat.h> +#include <linux/string.h> #include <linux/types.h> #include <linux/fs.h> #include <linux/export.h> @@ -43,7 +44,7 @@ static void fail_dump(struct fault_attr *attr) { if (attr->verbose > 0 && __ratelimit(&attr->ratelimit_state)) { printk(KERN_NOTICE "FAULT_INJECTION: forcing a failure.\n" - "name %pd, interval %lu, probability %lu, " + "name %s, interval %lu, probability %lu, " "space %d, times %d\n", attr->dname, attr->interval, attr->probability, atomic_read(&attr->space), @@ -238,7 +239,9 @@ struct dentry *fault_create_debugfs_attr(const char *name, debugfs_create_xul("reject-end", mode, dir, &attr->reject_end); #endif /* CONFIG_FAULT_INJECTION_STACKTRACE_FILTER */ - attr->dname = dget(dir); + if (strscpy(attr->dname, name, sizeof(attr->dname)) == -E2BIG) + pr_warn("FAULT_INJECTION: name '%s' truncated to '%s'\n", + name, attr->dname); return dir; } EXPORT_SYMBOL_GPL(fault_create_debugfs_attr); -- 2.34.1

2 1

[PATCH OLK-5.10] vhost_iotlb: bound map allocation in add_range
by Jiacheng Yu 13 Nov '26

13 Nov '26

From: Linfeng Sun <linfeng.sun.dev(a)gamil.com> mainline inclusion from mainline-v7.2-rc7 commit 1ed35ac7f3fe2b4396bdd29ac3a7f0ebc0829e94 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18250 CVE: CVE-2026-74713 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- vhost_iotlb_add_range_ctx() only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating entries after reaching their configured limit. Existing vhost devices allocate their IOTLB with max_iotlb_entries from vhost.c, which defaults to 2048 and is tunable by module parameter. Use the caller-provided limit at the allocation point instead of adding a separate default in the common IOTLB helper, and reject non-positive values in vhost paths that can report an error. Other vhost IOTLB users should not create zero-limit tables when entries can be populated from userspace or guest-controlled requests. Add caller-side max_iotlb_entries parameters for mlx5 vDPA, VDUSE and vhost-vDPA. Reject non-positive VDUSE and vhost-vDPA values, and require at least two entries for vdpa_sim and mlx5 vDPA paths that install full-range mappings, since those mappings are split into two IOTLB entries. Handle full-range mappings in the common helper by checking that the IOTLB can hold both split entries before inserting the first half. This avoids returning an error after leaving a half mapping behind. When the table is full, keep the existing retire behavior for retiring tables and return -ENOSPC for non-retiring tables. Reuse the retired map node instead of freeing it and allocating a replacement, so a stream of IOTLB updates cannot keep forcing GFP_ATOMIC allocations after the table has reached its limit. If a zero-limit IOTLB still reaches the common helper, treat it as a configuration error and return -EINVAL. I found this bug myself, though the patch was written with AI assistance. Fixes: 0bbe30668d89 ("vhost: factor out IOTLB") Assisted-by: OpenAI-Codex:GPT-5 Signed-off-by: Linfeng Sun <linfeng.sun.dev(a)gamil.com> Message-ID: <AMYAtgAiKmgYcSQT5ukl-4qq.3.1781960405943.Hmail.241270009(a)hdu.edu.cn> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Conflicts: drivers/vhost/iotlb.c drivers/vhost/vdpa.c drivers/vhost/vhost.c drivers/vdpa/mlx5/core/mlx5_vdpa.h drivers/vdpa/mlx5/core/mr.c drivers/vdpa/mlx5/core/resources.c drivers/vdpa/vdpa_sim/vdpa_sim.c drivers/vdpa/vdpa_user/iova_domain.c [1. Context conflicts: kmalloc(sizeof(*map), GFP_ATOMIC) is kept instead of kmalloc_obj(), and kvzalloc(struct_size(...)) is kept instead of kvzalloc_flex(). 2. mlx5 vDPA has no mr resources infrastructure and no init_ctrl_vq() in this tree, so the mlx5_vdpa.h, mr.c and resources.c hunks are dropped. 3. vdpa_sim already creates its IOTLB with a fixed limit of 2048 and has no use_va knob, so only the parameter description change would apply and it is dropped together with the allocate-side hunk. 4. VDUSE (vdpa_user/) does not exist in this tree, so the iova_domain.c hunk is dropped. 5. vhost-vdpa additionally bounds v->resv_iotlb, which is a per-device table in this tree rather than being created in vhost_vdpa_probe().] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/vhost/iotlb.c | 47 ++++++++++++++++++++++++++++++------------- drivers/vhost/vdpa.c | 11 ++++++++-- drivers/vhost/vhost.c | 8 ++++++++ 3 files changed, 50 insertions(+), 16 deletions(-) diff --git a/drivers/vhost/iotlb.c b/drivers/vhost/iotlb.c index dc936bb65627..dd568dacf9eb 100644 --- a/drivers/vhost/iotlb.c +++ b/drivers/vhost/iotlb.c @@ -20,6 +20,14 @@ INTERVAL_TREE_DEFINE(struct vhost_iotlb_map, rb, __u64, __subtree_last, START, LAST, static inline, vhost_iotlb_itree); +static void vhost_iotlb_map_unlink(struct vhost_iotlb *iotlb, + struct vhost_iotlb_map *map) +{ + vhost_iotlb_itree_remove(map, &iotlb->root); + list_del(&map->link); + iotlb->nmaps--; +} + /** * vhost_iotlb_map_free - remove a map node and free it * @iotlb: the IOTLB @@ -28,10 +36,8 @@ INTERVAL_TREE_DEFINE(struct vhost_iotlb_map, void vhost_iotlb_map_free(struct vhost_iotlb *iotlb, struct vhost_iotlb_map *map) { - vhost_iotlb_itree_remove(map, &iotlb->root); - list_del(&map->link); + vhost_iotlb_map_unlink(iotlb, map); kfree(map); - iotlb->nmaps--; } EXPORT_SYMBOL_GPL(vhost_iotlb_map_free); @@ -57,14 +63,25 @@ int vhost_iotlb_add_range_ctx(struct vhost_iotlb *iotlb, if (last < start) return -EFAULT; + if (!iotlb->limit) + return -EINVAL; + /* If the range being mapped is [0, ULONG_MAX], split it into two entries * otherwise its size would overflow u64. */ if (start == 0 && last == ULONG_MAX) { u64 mid = last / 2; - int err = vhost_iotlb_add_range_ctx(iotlb, start, mid, addr, - perm, opaque); + int err; + + if (iotlb->limit < 2) + return -ENOSPC; + if (!(iotlb->flags & VHOST_IOTLB_FLAG_RETIRE) && + iotlb->nmaps > iotlb->limit - 2) + return -ENOSPC; + + err = vhost_iotlb_add_range_ctx(iotlb, start, mid, addr, + perm, opaque); if (err) return err; @@ -72,17 +89,19 @@ int vhost_iotlb_add_range_ctx(struct vhost_iotlb *iotlb, start = mid + 1; } - if (iotlb->limit && - iotlb->nmaps == iotlb->limit && - iotlb->flags & VHOST_IOTLB_FLAG_RETIRE) { - map = list_first_entry(&iotlb->list, typeof(*map), link); - vhost_iotlb_map_free(iotlb, map); + if (iotlb->nmaps >= iotlb->limit) { + if (iotlb->flags & VHOST_IOTLB_FLAG_RETIRE) { + map = list_first_entry(&iotlb->list, typeof(*map), link); + vhost_iotlb_map_unlink(iotlb, map); + } else { + return -ENOSPC; + } + } else { + map = kmalloc(sizeof(*map), GFP_ATOMIC); + if (!map) + return -ENOMEM; } - map = kmalloc(sizeof(*map), GFP_ATOMIC); - if (!map) - return -ENOMEM; - map->start = start; map->size = last - start + 1; map->last = last; diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index 56d99c3d0a38..19350cb0ab0a 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -35,6 +35,11 @@ enum { #define VHOST_VDPA_DEV_MAX (1U << MINORBITS) +static int max_iotlb_entries = 2048; +module_param(max_iotlb_entries, int, 0444); +MODULE_PARM_DESC(max_iotlb_entries, + "Maximum number of iotlb entries. (default: 2048)"); + #define VHOST_VDPA_IOTLB_BUCKETS 16 struct vhost_vdpa_as { @@ -110,12 +115,14 @@ static struct vhost_vdpa_as *vhost_vdpa_alloc_as(struct vhost_vdpa *v, u32 asid) if (asid >= v->vdpa->nas) return NULL; + if (max_iotlb_entries <= 0) + return NULL; as = kmalloc(sizeof(*as), GFP_KERNEL); if (!as) return NULL; - vhost_iotlb_init(&as->iotlb, 0, 0); + vhost_iotlb_init(&as->iotlb, max_iotlb_entries, 0); as->id = asid; hlist_add_head(&as->hash_link, head); @@ -1705,7 +1712,7 @@ static int vhost_vdpa_probe(struct vdpa_device *vdpa) goto err; } - vhost_iotlb_init(&v->resv_iotlb, 0, 0); + vhost_iotlb_init(&v->resv_iotlb, max_iotlb_entries, 0); r = dev_set_name(&v->dev, "vhost-vdpa-%u", minor); if (r) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 507ad80ee673..f49842a1a97a 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -630,6 +630,9 @@ EXPORT_SYMBOL_GPL(vhost_dev_set_owner); static struct vhost_iotlb *iotlb_alloc(void) { + if (max_iotlb_entries <= 0) + return NULL; + return vhost_iotlb_alloc(max_iotlb_entries, VHOST_IOTLB_FLAG_RETIRE); } @@ -1477,6 +1480,8 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m) return -EOPNOTSUPP; if (mem.nregions > max_mem_regions) return -E2BIG; + if (max_iotlb_entries <= 0) + return -EINVAL; newmem = kvzalloc(struct_size(newmem, regions, mem.nregions), GFP_KERNEL); if (!newmem) @@ -1785,6 +1790,9 @@ int vhost_init_device_iotlb(struct vhost_dev *d, bool enabled) struct vhost_iotlb *niotlb, *oiotlb; int i; + if (max_iotlb_entries <= 0) + return -EINVAL; + niotlb = iotlb_alloc(); if (!niotlb) return -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-6.6 V6 00/11] P2PDMA PATCHSET PART 1
by Zizhi Wo 13 Nov '26

13 Nov '26

To support iostat statistics of passthrough and support dm/md/nvme-multipath p2pdma. Changes since V1-5: 1. block: enable passthrough command statistics Move the stats check from blk_do_io_stat() to blk_account_io_start(), so that paths like blk_complete_request() where the request carries no bio are no longer missed in accounting. 2. md: propagate BLK_FEAT_PCI_P2PDMA from member devices to RAID device Clear the P2PDMA flag for raid5 to handle the case where a raid0/1/10 array is taken over as raid5. 3. nvme: strip P2PDMA for integrity-bearing I/O Add logic in the nvme path to withhold P2PDMA when integrity is present. 4. nvme: fix multipath batched completion accounting Pick up this fix to prevent iostat from missing batched completions. 5. Updated author from "hotforest" to "Hou Tao". Bart Van Assche (1): block: Fix queue_iostats_passthrough_show() Chaitanya Kulkarni (1): block: clear BLK_FEAT_PCI_P2PDMA in blk_stack_limits() for non-supporting devices Hou Tao (1): dm: pass PCI P2PDMA through linear and striped targets Keith Busch (4): block: enable passthrough command statistics block: export passthrough stats enabled nvme: fix multipath batched completion accounting nvme: add support multipath passthrough iostats Kiran Kumar Modukuri (2): md: propagate BLK_FEAT_PCI_P2PDMA from member devices to RAID device nvme-multipath: enable PCI P2PDMA for multipath devices Zizhi Wo (2): block: withhold P2PDMA from integrity-bearing stacks nvme: keep PCI P2PDMA in sync with namespace integrity Documentation/ABI/stable/sysfs-block | 8 ++++++ block/blk-mq-debugfs.c | 1 + block/blk-mq.c | 7 +++++ block/blk-settings.c | 5 ++++ block/blk-sysfs.c | 26 ++++++++++++++++++ block/blk.h | 2 +- drivers/md/dm-linear.c | 3 ++- drivers/md/dm-stripe.c | 3 ++- drivers/md/dm-table.c | 27 +++++++++++++++++++ drivers/md/raid0.c | 2 ++ drivers/md/raid1.c | 1 + drivers/md/raid10.c | 1 + drivers/md/raid5.c | 6 +++++ drivers/nvme/host/core.c | 27 +++++++++++++++---- drivers/nvme/host/ioctl.c | 9 +++++++ drivers/nvme/host/multipath.c | 6 ++++- include/linux/blk-mq.h | 40 ++++++++++++++++++++++++++++ include/linux/blkdev.h | 3 +++ include/linux/device-mapper.h | 5 ++++ 19 files changed, 173 insertions(+), 9 deletions(-) -- 2.52.0

2 12

[PATCH OLK-6.6 V3 0/7] P2PDMA PATCHSET PART 2
by Zizhi Wo 12 Nov '26

12 Nov '26

Add some p2pdma api and dedup of vmemmap. Alistair Popple (1): mm: allow compound zone device pages Zizhi Wo (6): PCI/P2PDMA: whitelist HiSilicon root ports PCI/P2PDMA: disable CPU access through bvec iterators mm: add P2PDMA vmemmap optimization capability PCI/P2PDMA: add aligned resource registration x86: enable P2PDMA vmemmap optimization arm64: enable P2PDMA vmemmap optimization arch/arm64/Kconfig | 1 + arch/x86/Kconfig | 1 + drivers/pci/p2pdma.c | 119 +++++++++++++++++++++++++++++++------ include/linux/memremap.h | 6 +- include/linux/mm.h | 19 +++++- include/linux/mmzone.h | 13 +++- include/linux/pci-p2pdma.h | 21 ++++++- lib/iov_iter.c | 36 +++++++++-- mm/Kconfig | 7 ++- mm/memremap.c | 2 +- 10 files changed, 192 insertions(+), 33 deletions(-) -- 2.52.0

2 8

[PATCH OLK-6.6 V3 0/7] P2PDMA PATCHSET PART 2
by Zizhi Wo 12 Nov '26

12 Nov '26

Add some p2pdma api and dedup of vmemmap. Alistair Popple (1): mm: allow compound zone device pages Zizhi Wo (6): PCI/P2PDMA: whitelist HiSilicon root ports PCI/P2PDMA: disable CPU access through bvec iterators mm: add P2PDMA vmemmap optimization capability PCI/P2PDMA: add aligned resource registration x86: enable P2PDMA vmemmap optimization arm64: enable P2PDMA vmemmap optimization arch/arm64/Kconfig | 1 + arch/x86/Kconfig | 1 + drivers/pci/p2pdma.c | 119 +++++++++++++++++++++++++++++++------ include/linux/memremap.h | 6 +- include/linux/mm.h | 19 +++++- include/linux/mmzone.h | 13 +++- include/linux/pci-p2pdma.h | 21 ++++++- lib/iov_iter.c | 36 +++++++++-- mm/Kconfig | 7 ++- mm/memremap.c | 2 +- 10 files changed, 192 insertions(+), 33 deletions(-) -- 2.52.0

2 8

[PATCH v3 openEuler-26.09 0/3] cache_ext framework
by Nikita Panov 12 Nov '26

12 Nov '26

From: Nikita Panov <panov.nikita(a)huawei.com> Cache_ext framework project integration. Heavily inspired by "cache_ext: Customizing the Page Cache with eBPF" by Tal Zussman, Ioannis Zarkadas and others. This patchset allows users to load custom bpf policies to adjust page cache reclaim algorithm. Policy might be designed to reclaim specific files (filter by name) or an algorithm differ from LRU/MGLRU might be implemented. Additionaly, a refill mechanism was implemented. If the page was reclaimed through the cache_ext, the system has a lot of free mem, and the disk is not busy with IO at the moment, page might be refilled to the page cache. Nikita Panov (3): mm: Cache_ext framework krefilld: initial design and implementation cache_ext: Add examples to tools/cache_ext .../admin-guide/kernel-parameters.txt | 21 + Documentation/admin-guide/sysctl/vm.rst | 41 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/drop_caches.c | 6 + fs/inode.c | 13 + fs/super.c | 20 +- include/linux/cache_ext.h | 259 ++++ include/linux/fs.h | 4 + include/linux/memcontrol.h | 26 + include/linux/mempolicy.h | 6 + include/linux/mm_types.h | 33 + include/linux/mmzone.h | 7 + include/linux/page_ext.h | 4 + include/linux/pagemap.h | 3 + include/linux/sched.h | 7 + include/linux/swap.h | 20 + include/linux/sysctl.h | 8 +- kernel/bpf/verifier.c | 129 +- kernel/sysctl.c | 38 +- mm/Kconfig | 11 + mm/Makefile | 1 + mm/cache_ext.c | 1335 +++++++++++++++++ mm/cache_ext_ds.c | 1050 +++++++++++++ mm/filemap.c | 12 +- mm/memcontrol.c | 48 + mm/mempolicy.c | 5 + mm/migrate.c | 16 +- mm/page_ext.c | 7 + mm/swap.c | 1 + mm/truncate.c | 12 +- mm/vmscan.c | 267 +++- mm/vmstat.c | 8 +- mm/workingset.c | 110 +- tools/cache_ext/.gitignore | 2 + tools/cache_ext/Makefile | 229 +++ tools/cache_ext/cache_ext_simple_fifo.bpf.c | 109 ++ tools/cache_ext/cache_ext_simple_fifo.c | 52 + .../cache_ext/include/cache_ext_common.bpf.h | 178 +++ 39 files changed, 4074 insertions(+), 26 deletions(-) create mode 100644 include/linux/cache_ext.h create mode 100644 mm/cache_ext.c create mode 100644 mm/cache_ext_ds.c create mode 100644 tools/cache_ext/.gitignore create mode 100644 tools/cache_ext/Makefile create mode 100644 tools/cache_ext/cache_ext_simple_fifo.bpf.c create mode 100644 tools/cache_ext/cache_ext_simple_fifo.c create mode 100644 tools/cache_ext/include/cache_ext_common.bpf.h -- 2.34.1

2 4

[PATCH OLK-5.10] drm/virtio: use the DMA API for resource backing on Xen
by Jiacheng Yu 12 Nov '26

12 Nov '26

From: Benjamin Leggett <benjamin(a)edera.io> mainline inclusion from mainline-v7.3-rc2 commit 6a736d2f9d0c6e6217fe7532bc4c50ceca71db78 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19675 CVE: CVE-2026-98156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtio_ring.c handles this correctly, vring_use_map_api() returns true for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM. virtio-gpu makes the same decision independently, but its copy looks only at the feature bit: bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); QEMU does not set iommu_platform on virtio-vga by default, so VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and virtio_gpu_object_shmem_init() describes the framebuffer's backing pages to the host with sg_phys(). Those are guest-physical addresses. In a PV domain they resolve, on the host side, to pages belonging to some other domain, so the host scans out unrelated memory. Move the decision into virtio_gpu_use_dma_api() and give it the xen_domain() check, like vring_use_map_api() has. This additionally enables the dma_sync_sgtable_for_device() calls in virtgpu_vq.c, which are required for correctness whenever swiotlb is in play. Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0 works fine and doesn't need this fix because it is identity-mapped, only PV dom0s are affected. Fixes: a3b815f09bb8 ("drm/virtio: add iommu support.") Signed-off-by: Ben Leggett <benjamin(a)edera.io> Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Link: https://patch.msgid.link/20260806-virtgpu-xen-dma-v1-1-e499b345bbad@edera.io Conflicts: drivers/gpu/drm/virtio/virtgpu_drv.h drivers/gpu/drm/virtio/virtgpu_object.c drivers/gpu/drm/virtio/virtgpu_vq.c [1. virtgpu_vq.c: the upstream virtio_gpu_panic_cmd_transfer_to_host_2d() hunk is dropped, this tree has no such function; only virtio_gpu_cmd_transfer_to_host_2d() and virtio_gpu_cmd_transfer_to_host_3d() are switched to virtio_gpu_use_dma_api(). 2. Context conflicts: virtgpu_drv.h here has no DEBUG_NAME_MAX_LEN; virtgpu_object.c and virtgpu_vq.c still use shmem->pages rather than bo->base.sgt.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_drv.h | 20 ++++++++++++++++++++ drivers/gpu/drm/virtio/virtgpu_object.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 4 ++-- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h index 7c4f721621f3..950e8b1fc8dc 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.h +++ b/drivers/gpu/drm/virtio/virtgpu_drv.h @@ -41,6 +41,8 @@ #include <drm/drm_probe_helper.h> #include <drm/virtgpu_drm.h> +#include <xen/xen.h> + #define DRIVER_NAME "virtio_gpu" #define DRIVER_DESC "virtio GPU" #define DRIVER_DATE "0" @@ -53,6 +55,24 @@ #define UUID_INITIALIZED 1 #define UUID_INITIALIZATION_FAILED 2 +/* + * Whether the host must be told about resource backing pages by DMA address + * rather than guest-physical address. + * + * This mirrors vring_use_map_api() in drivers/virtio/virtio_ring.c, including + * its xen_domain() case. + */ +static inline bool virtio_gpu_use_dma_api(const struct virtio_device *vdev) +{ + if (!virtio_has_dma_quirk(vdev)) + return true; + + if (xen_domain()) + return true; + + return false; +} + struct virtio_gpu_object_params { uint32_t format; uint32_t width; diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index 49fa59e09187..59046bf43301 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -141,7 +141,7 @@ static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev, struct virtio_gpu_mem_entry **ents, unsigned int *nents) { - bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev); struct virtio_gpu_object_shmem *shmem = to_virtio_gpu_shmem(bo); struct scatterlist *sg; int si, ret; diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index 3f75510bf240..429c00c9062c 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -598,7 +598,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev, struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]); struct virtio_gpu_transfer_to_host_2d *cmd_p; struct virtio_gpu_vbuffer *vbuf; - bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev); struct virtio_gpu_object_shmem *shmem = to_virtio_gpu_shmem(bo); if (virtio_gpu_is_shmem(bo) && use_dma_api) @@ -1018,7 +1018,7 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev, struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]); struct virtio_gpu_transfer_host_3d *cmd_p; struct virtio_gpu_vbuffer *vbuf; - bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev); struct virtio_gpu_object_shmem *shmem = to_virtio_gpu_shmem(bo); if (use_dma_api) -- 2.34.1

2 1

[PATCH OLK-6.6] drm/virtio: use the DMA API for resource backing on Xen
by Jiacheng Yu 12 Nov '26

12 Nov '26

From: Benjamin Leggett <benjamin(a)edera.io> stable inclusion from stable-v6.6.160 commit 32e999ccf5f6453b3b4df8264ff1b03c6720292f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19675 CVE: CVE-2026-98156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6a736d2f9d0c6e6217fe7532bc4c50ceca71db78 ] On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtio_ring.c handles this correctly, vring_use_map_api() returns true for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM. virtio-gpu makes the same decision independently, but its copy looks only at the feature bit: bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); QEMU does not set iommu_platform on virtio-vga by default, so VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and virtio_gpu_object_shmem_init() describes the framebuffer's backing pages to the host with sg_phys(). Those are guest-physical addresses. In a PV domain they resolve, on the host side, to pages belonging to some other domain, so the host scans out unrelated memory. Move the decision into virtio_gpu_use_dma_api() and give it the xen_domain() check, like vring_use_map_api() has. This additionally enables the dma_sync_sgtable_for_device() calls in virtgpu_vq.c, which are required for correctness whenever swiotlb is in play. Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0 works fine and doesn't need this fix because it is identity-mapped, only PV dom0s are affected. Fixes: a3b815f09bb8 ("drm/virtio: add iommu support.") Signed-off-by: Ben Leggett <benjamin(a)edera.io> Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Link: https://patch.msgid.link/20260806-virtgpu-xen-dma-v1-1-e499b345bbad@edera.io Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_drv.h | 20 ++++++++++++++++++++ drivers/gpu/drm/virtio/virtgpu_object.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 4 ++-- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h index 9f9ded45cd6a..de36af56df86 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.h +++ b/drivers/gpu/drm/virtio/virtgpu_drv.h @@ -43,6 +43,8 @@ #include <drm/drm_probe_helper.h> #include <drm/virtgpu_drm.h> +#include <xen/xen.h> + #define DRIVER_NAME "virtio_gpu" #define DRIVER_DESC "virtio GPU" #define DRIVER_DATE "0" @@ -58,6 +60,24 @@ #define MAX_CAPSET_ID 63 #define MAX_RINGS 64 +/* + * Whether the host must be told about resource backing pages by DMA address + * rather than guest-physical address. + * + * This mirrors vring_use_map_api() in drivers/virtio/virtio_ring.c, including + * its xen_domain() case. + */ +static inline bool virtio_gpu_use_dma_api(const struct virtio_device *vdev) +{ + if (!virtio_has_dma_quirk(vdev)) + return true; + + if (xen_domain()) + return true; + + return false; +} + struct virtio_gpu_object_params { unsigned long size; bool dumb; diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index c7e74cf13022..c4f8cdf85f60 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -137,7 +137,7 @@ static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev, struct virtio_gpu_mem_entry **ents, unsigned int *nents) { - bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev); struct scatterlist *sg; struct sg_table *pages; int si; diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index a4d1a7710325..d2c83f3e74b9 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -601,7 +601,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev, struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]); struct virtio_gpu_transfer_to_host_2d *cmd_p; struct virtio_gpu_vbuffer *vbuf; - bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev); if (virtio_gpu_is_shmem(bo) && use_dma_api) dma_sync_sgtable_for_device(vgdev->vdev->dev.parent, @@ -1020,7 +1020,7 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev, struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]); struct virtio_gpu_transfer_host_3d *cmd_p; struct virtio_gpu_vbuffer *vbuf; - bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev); if (virtio_gpu_is_shmem(bo) && use_dma_api) dma_sync_sgtable_for_device(vgdev->vdev->dev.parent, -- 2.34.1

2 1

[PATCH OLK-5.10 0/5] CVE-2026-97997
by Jiacheng Yu 12 Nov '26

12 Nov '26

CVE-2026-97997 Jiacheng Yu (5): virtio-ring: maintain next in extra state for packed virtqueue virtio_ring: rename vring_desc_extra_packed virtio_ring: secure handling of mapping errors virtio_ring: rename vring_unmap_state_packed() to vring_unmap_extra_packed() virtio_ring: fix stale descriptor flags after a failed packed add drivers/virtio/virtio_ring.c | 60 +++++++++++++++++++++++------------- 1 file changed, 39 insertions(+), 21 deletions(-) -- 2.34.1

2 6