- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] filescgroup: migrate files resources of every task, not just the first
by Cai Xinchen 28 Oct '26

28 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10137 -------------------------------- files_cgroup_can_attach() used cgroup_taskset_first() and only migrated the files resources of the first task of the taskset. A thread group may contain tasks that own private files_struct instances (created through unshare(CLONE_FILES) or clone() without CLONE_FILES); on a thread-group migration those structs kept pointing at the source cgroup, so FDs opened afterwards were charged to the source cgroup and bypassed the target cgroup's files.limit. Walk the whole taskset with cgroup_taskset_for_each(), de-duplicating tasks that share a files_struct (they already point at the target css after being handled by an earlier task). A partial migration is rolled back inside ->can_attach() from a list of records that stores the source css of every files_struct actually moved; the source cannot be recomputed from task_css() because a shared files_struct may be charged to a css that differs from its task's. ->cancel_attach() is registered as well, but in this tree files is the last subsystem implementing ->can_attach() and the core only cancels subsystems with a lower ssid than the failing one, so the core never invokes it today; it is kept for forward compatibility. Fixes: be6df5f1e6b8 ("cgroups: Resource controller for open files") Assisted-by: opencode:deepseek-v4.1-flash Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/legacy-filescontrol.c | 194 ++++++++++++++++++++++++++++++++++----- 1 file changed, 173 insertions(+), 21 deletions(-) diff --git a/fs/legacy-filescontrol.c b/fs/legacy-filescontrol.c index 8ef732bf9020..c05b5d0211c5 100644 --- a/fs/legacy-filescontrol.c +++ b/fs/legacy-filescontrol.c @@ -96,32 +96,126 @@ static void files_cgroup_css_free(struct cgroup_subsys_state *css) } /* - * If attaching this cgroup would overcommit the resource then deny - * the attach. If not, attach the file resource into new cgroup. + * A files migration performed by ->can_attach(), recording the migrated + * files_struct and the css it is moved from/to so that the move can be + * rolled back later. */ -static int files_cgroup_can_attach(struct cgroup_taskset *tset) -{ - u64 num_files; - bool can_attach; - struct cgroup_subsys_state *to_css; +struct files_migrate_entry { + struct files_struct *files; struct cgroup_subsys_state *from_css; - struct page_counter *from_res; - struct page_counter *to_res; - struct page_counter *fail_res; + struct cgroup_subsys_state *to_css; + struct list_head node; +}; + +static LIST_HEAD(files_migrate_entries); + +/* Undo exactly the files_structs ->can_attach() actually migrated. */ +static void files_migrate_rollback(void) +{ + struct files_migrate_entry *mig_entry, *next_entry; + struct cgroup_subsys_state *from_css, *to_css; + struct page_counter *from_res, *to_res; struct files_struct *files; - struct task_struct *task = cgroup_taskset_first(tset, &to_css); + u64 num_files; + LIST_HEAD(list); - to_res = css_res_open_handles(to_css); + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + from_css = mig_entry->from_css; + to_css = mig_entry->to_css; + files = mig_entry->files; + + list_del(&mig_entry->node); + + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); + + spin_lock(&files->file_lock); + num_files = file_cg_count_fds(files); + page_counter_uncharge(to_res, num_files); + page_counter_charge(from_res, num_files); + css_put(to_css); + files->files_cgroup = css_fcg(from_css); + spin_unlock(&files->file_lock); + + /* + * Drop the references taken when the move was recorded: + * the pin on @files (this may free it, which uncharges + * the just-restored css). + */ + put_files_struct(files); + kfree(mig_entry); + } +} + +/* Migration committed: the moves are final, just drop the records. */ +static void files_migrate_commit(void) +{ + struct files_migrate_entry *mig_entry, *next_entry; + LIST_HEAD(list); + + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + list_del(&mig_entry->node); + /* + * The moves are final: the files_struct keeps its + * reference on @to_css, only the pin and the reference + * transferred from the pre-migration state are dropped. + */ + put_files_struct(mig_entry->files); + css_put(mig_entry->from_css); + kfree(mig_entry); + } +} + +static void files_cgroup_cancel_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_rollback(); +} + +static void files_cgroup_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_commit(); +} + +/* + * files_cgroup_can_attach_one_task - judge one task can attach to files cgroup + * @task: the task is judged whether can attach + * @mig_entry: files_migrate_entry record + * @to_css: the css migrate to + * @skip: if task files is NULL or files->files_cgroup is NULL or files == init_files + * or already on target css, skip attach is true + */ +static int files_cgroup_can_attach_one_task(struct task_struct *task, + struct files_migrate_entry *mig_entry, + struct cgroup_subsys_state *to_css, + bool *skip) +{ + int ret = 0; + u64 num_files; + struct page_counter *from_res, *to_res, *fail_res; + struct files_struct *files; + struct cgroup_subsys_state *from_css; + *skip = false; task_lock(task); files = task->files; if (!files || !files->files_cgroup || files == &init_files) { - task_unlock(task); - return 0; + *skip = true; + goto skip; } from_css = &files_cgroup_from_files(files)->css; + /* Already on the target css, or handled via a shared files_struct. */ + if (from_css == to_css) { + *skip = true; + goto skip; + } + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); spin_lock(&files->file_lock); num_files = file_cg_count_fds(files); @@ -130,16 +224,67 @@ static int files_cgroup_can_attach(struct cgroup_taskset *tset) if (!page_counter_try_charge(to_res, num_files, &fail_res)) { page_counter_charge(from_res, num_files); pr_err("Open files limit overcommited\n"); - can_attach = false; - } else { - css_put(from_css); - css_get(to_css); - task->files->files_cgroup = css_fcg(to_css); - can_attach = true; + ret = -ENOSPC; + goto overcommited; } + + /* + * The files_struct's reference on @from_css is transferred to + * the rollback record; @to_css is referenced by the + * files_struct from now on. + */ + css_get(to_css); + files->files_cgroup = css_fcg(to_css); + + atomic_inc(&files->count); + mig_entry->files = files; + mig_entry->from_css = from_css; + mig_entry->to_css = to_css; + +overcommited: spin_unlock(&files->file_lock); +skip: task_unlock(task); - return can_attach ? 0 : -ENOSPC; + return ret; +} + +/* + * If attaching this cgroup would overcommit the resource then deny + * the attach. If not, attach the file resource into new cgroup. + */ +static int files_cgroup_can_attach(struct cgroup_taskset *tset) +{ + struct task_struct *task; + struct cgroup_subsys_state *to_css; + struct files_migrate_entry *mig_entry; + int ret = 0; + bool skip = false; + + cgroup_taskset_for_each(task, to_css, tset) { + mig_entry = kzalloc(sizeof(*mig_entry), GFP_KERNEL); + if (!mig_entry) { + ret = -ENOMEM; + break; + } + + ret = files_cgroup_can_attach_one_task(task, mig_entry, to_css, &skip); + if (ret) { + kfree(mig_entry); + break; + } + + if (skip) { + kfree(mig_entry); + continue; + } + + list_add_tail(&mig_entry->node, &files_migrate_entries); + } + + if (ret) + files_migrate_rollback(); + + return ret; } int files_cgroup_alloc_fd(struct files_struct *files, u64 n) @@ -294,6 +439,13 @@ struct cgroup_subsys files_cgrp_subsys = { .css_alloc = files_cgroup_css_alloc, .css_free = files_cgroup_css_free, .can_attach = files_cgroup_can_attach, + /* + * Not reachable today because files has the highest ssid among the + * subsystems implementing ->can_attach(); kept for forward + * compatibility. See the comment above struct files_migrate_entry. + */ + .cancel_attach = files_cgroup_cancel_attach, + .attach = files_cgroup_attach, .legacy_cftypes = files, }; -- 2.34.1

2 1

[PATCH OLK-5.10] filescgroup: migrate files resources of every task, not just the first
by Cai Xinchen 28 Oct '26

28 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10137 -------------------------------- files_cgroup_can_attach() used cgroup_taskset_first() and only migrated the files resources of the first task of the taskset. A thread group may contain tasks that own private files_struct instances (created through unshare(CLONE_FILES) or clone() without CLONE_FILES); on a thread-group migration those structs kept pointing at the source cgroup, so FDs opened afterwards were charged to the source cgroup and bypassed the target cgroup's files.limit. Walk the whole taskset with cgroup_taskset_for_each(), de-duplicating tasks that share a files_struct (they already point at the target css after being handled by an earlier task). A partial migration is rolled back inside ->can_attach() from a list of records that stores the source css of every files_struct actually moved; the source cannot be recomputed from task_css() because a shared files_struct may be charged to a css that differs from its task's. ->cancel_attach() is registered as well, but in this tree files is the last subsystem implementing ->can_attach() and the core only cancels subsystems with a lower ssid than the failing one, so the core never invokes it today; it is kept for forward compatibility. Fixes: be6df5f1e6b8 ("cgroups: Resource controller for open files") Assisted-by: opencode:deepseek-v4.1-flash Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/filescontrol.c | 195 +++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 174 insertions(+), 21 deletions(-) diff --git a/fs/filescontrol.c b/fs/filescontrol.c index fdd557a246be..753e6786db79 100644 --- a/fs/filescontrol.c +++ b/fs/filescontrol.c @@ -103,32 +103,127 @@ u64 files_cgroup_count_fds(struct files_struct *files) } /* - * If attaching this cgroup would overcommit the resource then deny - * the attach. If not, attach the file resource into new cgroup. + * A files migration performed by ->can_attach(), recording the migrated + * files_struct and the css it is moved from/to so that the move can be + * rolled back later. */ -static int files_cgroup_can_attach(struct cgroup_taskset *tset) +struct files_migrate_entry { + struct files_struct *files; + struct cgroup_subsys_state *from_css; + struct cgroup_subsys_state *to_css; + struct list_head node; +}; + +static LIST_HEAD(files_migrate_entries); + +/* Undo exactly the files_structs ->can_attach() actually migrated. */ +static void files_migrate_rollback(void) { + struct files_migrate_entry *mig_entry, *next_entry; + struct cgroup_subsys_state *from_css, *to_css; + struct page_counter *from_res, *to_res; + struct files_struct *files; u64 num_files; - bool can_attach; - struct cgroup_subsys_state *to_css; - struct cgroup_subsys_state *from_css; - struct page_counter *from_res; - struct page_counter *to_res; - struct page_counter *fail_res; + LIST_HEAD(list); + + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + from_css = mig_entry->from_css; + to_css = mig_entry->to_css; + files = mig_entry->files; + + list_del(&mig_entry->node); + + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); + + spin_lock(&files->file_lock); + num_files = files_cgroup_count_fds(files); + page_counter_uncharge(to_res, num_files); + page_counter_charge(from_res, num_files); + css_put(to_css); + files->files_cgroup = css_fcg(from_css); + spin_unlock(&files->file_lock); + + /* + * Drop the references taken when the move was recorded: + * the pin on @files (this may free it, which uncharges + * the just-restored css). + */ + put_files_struct(files); + kfree(mig_entry); + } +} + +/* Migration committed: the moves are final, just drop the records. */ +static void files_migrate_commit(void) +{ + struct files_migrate_entry *mig_entry, *next_entry; + LIST_HEAD(list); + + list_splice_init(&files_migrate_entries, &list); + + list_for_each_entry_safe(mig_entry, next_entry, &list, node) { + list_del(&mig_entry->node); + /* + * The moves are final: the files_struct keeps its + * reference on @to_css, only the pin and the reference + * transferred from the pre-migration state are dropped. + */ + put_files_struct(mig_entry->files); + css_put(mig_entry->from_css); + kfree(mig_entry); + } +} + +static void files_cgroup_cancel_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_rollback(); +} + +static void files_cgroup_attach(struct cgroup_taskset *tset __always_unused) +{ + files_migrate_commit(); +} + +/* + * files_cgroup_can_attach_one_task - try to migrate one task's files_struct + * @task: task to migrate + * @mig_entry: migration record filled in on success + * @to_css: target css + * @skip: set to true if @task has no chargeable files_struct or its + * files_struct already points at @to_css + */ +static int files_cgroup_can_attach_one_task(struct task_struct *task, + struct files_migrate_entry *mig_entry, + struct cgroup_subsys_state *to_css, + bool *skip) +{ + int ret = 0; + u64 num_files; + struct page_counter *from_res, *to_res, *fail_res; struct files_struct *files; - struct task_struct *task = cgroup_taskset_first(tset, &to_css); + struct cgroup_subsys_state *from_css; - to_res = css_res_open_handles(to_css); + *skip = false; task_lock(task); files = task->files; - if (!files || files == &init_files) { - task_unlock(task); - return 0; + if (!files || !files->files_cgroup || files == &init_files) { + *skip = true; + goto skip; } from_css = &files_cgroup_from_files(files)->css; + /* Already on the target css, or handled via a shared files_struct. */ + if (from_css == to_css) { + *skip = true; + goto skip; + } + from_res = css_res_open_handles(from_css); + to_res = css_res_open_handles(to_css); spin_lock(&files->file_lock); num_files = files_cgroup_count_fds(files); @@ -137,16 +232,67 @@ static int files_cgroup_can_attach(struct cgroup_taskset *tset) if (!page_counter_try_charge(to_res, num_files, &fail_res)) { page_counter_charge(from_res, num_files); pr_err("Open files limit overcommited\n"); - can_attach = false; - } else { - css_put(from_css); - css_get(to_css); - task->files->files_cgroup = css_fcg(to_css); - can_attach = true; + ret = -ENOSPC; + goto unlock; } + + /* + * The files_struct's reference on @from_css is transferred to + * the rollback record; @to_css is referenced by the + * files_struct from now on. + */ + css_get(to_css); + files->files_cgroup = css_fcg(to_css); + + atomic_inc(&files->count); + mig_entry->files = files; + mig_entry->from_css = from_css; + mig_entry->to_css = to_css; + +unlock: spin_unlock(&files->file_lock); +skip: task_unlock(task); - return can_attach ? 0 : -ENOSPC; + return ret; +} + +/* + * If attaching this cgroup would overcommit the resource then deny + * the attach. If not, attach the file resource into new cgroup. + */ +static int files_cgroup_can_attach(struct cgroup_taskset *tset) +{ + struct task_struct *task; + struct cgroup_subsys_state *to_css; + struct files_migrate_entry *mig_entry; + int ret = 0; + bool skip = false; + + cgroup_taskset_for_each(task, to_css, tset) { + mig_entry = kzalloc(sizeof(*mig_entry), GFP_KERNEL); + if (!mig_entry) { + ret = -ENOMEM; + break; + } + + ret = files_cgroup_can_attach_one_task(task, mig_entry, to_css, &skip); + if (ret) { + kfree(mig_entry); + break; + } + + if (skip) { + kfree(mig_entry); + continue; + } + + list_add_tail(&mig_entry->node, &files_migrate_entries); + } + + if (ret) + files_migrate_rollback(); + + return ret; } int files_cgroup_alloc_fd(struct files_struct *files, u64 n) @@ -276,6 +422,13 @@ struct cgroup_subsys files_cgrp_subsys = { .css_alloc = files_cgroup_css_alloc, .css_free = files_cgroup_css_free, .can_attach = files_cgroup_can_attach, + /* + * Not reachable today because files has the highest ssid among the + * subsystems implementing ->can_attach(); kept for forward + * compatibility. See the comment above struct files_migrate_entry. + */ + .cancel_attach = files_cgroup_cancel_attach, + .attach = files_cgroup_attach, .legacy_cftypes = files, .dfl_cftypes = files, }; -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Make post-verification instruction rewrites killable
by Pu Lehui 28 Oct '26

28 Oct '26

From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> mainline inclusion from mainline-v7.3-rc5 commit 261b61d3735b042ae25634f795c4540be0fc140c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20695 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- After do_check() returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining instruction and auxiliary-data arrays and adjusts all branch offsets, making the overall work quadratic in the program length. A privileged loader can submit 131072 unconditional jumps by zero followed by a valid return. Verification finishes quickly, but bpf_opt_remove_nops() then spends a long time removing each jump separately. Since this post-verification work neither checks for signals nor reschedules, a pending SIGKILL cannot terminate the task until the rewrite finishes. Make bpf_patch_insn_data() and verifier_remove_insns() common cancellation and rescheduling points. These helpers run from BPF_PROG_LOAD process context, and bpf_patch_insn_data() can already sleep while reallocating auxiliary data. Report interrupted constant blinding as -EINTR and propagate it through both JIT paths, including kernels that permit interpreter fallback. Other blinding failures retain the existing fallback behavior. This does not reduce the quadratic cost of the rewrite passes, but it makes the work preemptible and allows a killed loader to be torn down promptly. Fixes: 52875a04f4b2 ("bpf: verifier: remove dead code") Reported-by: Nicholas Carlini <npc(a)anthropic.com> Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://patch.msgid.link/20260917233222.2542500-2-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Conflicts: arch/arm/net/bpf_jit_32.c arch/arm64/net/bpf_jit_comp.c arch/loongarch/net/bpf_jit.c arch/mips/net/bpf_jit_comp.c arch/parisc/net/bpf_jit_core.c arch/powerpc/net/bpf_jit_comp.c arch/riscv/net/bpf_jit_core.c arch/s390/net/bpf_jit_comp.c arch/sparc/net/bpf_jit_comp_64.c arch/sw_64/net/bpf_jit_comp.c arch/x86/net/bpf_jit_comp.c arch/x86/net/bpf_jit_comp32.c kernel/bpf/core.c kernel/bpf/verifier.c kernel/bpf/fixups.c [generic bpf_jit_blind_constants not merged] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/arm/net/bpf_jit_32.c | 14 ++++++++------ arch/arm64/net/bpf_jit_comp.c | 10 +++++++--- arch/loongarch/net/bpf_jit.c | 10 ++++++---- arch/mips/net/bpf_jit_comp.c | 12 +++++++----- arch/parisc/net/bpf_jit_core.c | 9 ++++++++- arch/powerpc/net/bpf_jit_comp.c | 9 ++++++++- arch/riscv/net/bpf_jit_core.c | 9 ++++++++- arch/s390/net/bpf_jit_comp.c | 9 ++++++--- arch/sparc/net/bpf_jit_comp_64.c | 10 +++++++--- arch/sw_64/net/bpf_jit_comp.c | 10 +++++++--- arch/x86/net/bpf_jit_comp.c | 9 ++++++--- arch/x86/net/bpf_jit_comp32.c | 9 ++++++--- kernel/bpf/core.c | 12 +++++++++++- kernel/bpf/verifier.c | 20 ++++++++++++++++++++ 14 files changed, 115 insertions(+), 37 deletions(-) diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c index 8adc45ad1b2a..0ff2a70d8c06 100644 --- a/arch/arm/net/bpf_jit_32.c +++ b/arch/arm/net/bpf_jit_32.c @@ -1894,14 +1894,16 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) if (!prog->jit_requested) return orig_prog; - /* If constant blinding was enabled and we failed during blinding - * then we must fall back to the interpreter. Otherwise, we save - * the new JITed code. - */ tmp = bpf_jit_blind_constants(prog); - - if (IS_ERR(tmp)) + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. + */ + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 971b75b8059f..87ec8dbb43af 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1580,11 +1580,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - /* If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index 123df6a771d7..f44803e66ff4 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -1125,12 +1125,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp = bpf_jit_blind_constants(prog); /* - * If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. Otherwise, we save - * the new JITed code. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; diff --git a/arch/mips/net/bpf_jit_comp.c b/arch/mips/net/bpf_jit_comp.c index e355dfca4400..6e5ede70b306 100644 --- a/arch/mips/net/bpf_jit_comp.c +++ b/arch/mips/net/bpf_jit_comp.c @@ -926,14 +926,16 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) */ if (!prog->jit_requested) return orig_prog; + tmp = bpf_jit_blind_constants(prog); /* - * If constant blinding was enabled and we failed during blinding - * then we must fall back to the interpreter. Otherwise, we save - * the new JITed code. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - tmp = bpf_jit_blind_constants(prog); - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/parisc/net/bpf_jit_core.c b/arch/parisc/net/bpf_jit_core.c index 06cbcd6fe87b..80ec6a6c2d49 100644 --- a/arch/parisc/net/bpf_jit_core.c +++ b/arch/parisc/net/bpf_jit_core.c @@ -54,8 +54,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - if (IS_ERR(tmp)) + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. + */ + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c index 57de9d6b0089..ab316a492075 100644 --- a/arch/powerpc/net/bpf_jit_comp.c +++ b/arch/powerpc/net/bpf_jit_comp.c @@ -75,8 +75,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) return org_fp; tmp_fp = bpf_jit_blind_constants(org_fp); - if (IS_ERR(tmp_fp)) + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. + */ + if (IS_ERR(tmp_fp)) { + if (PTR_ERR(tmp_fp) == -EINTR) + return tmp_fp; return org_fp; + } if (tmp_fp != org_fp) { bpf_blinded = true; diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c index 7b70ccb7fec3..bbfaaa880d4f 100644 --- a/arch/riscv/net/bpf_jit_core.c +++ b/arch/riscv/net/bpf_jit_core.c @@ -54,8 +54,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - if (IS_ERR(tmp)) + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. + */ + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c index 99eae9cf7972..3c171c1c56e7 100644 --- a/arch/s390/net/bpf_jit_comp.c +++ b/arch/s390/net/bpf_jit_comp.c @@ -1952,11 +1952,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) tmp = bpf_jit_blind_constants(fp); /* - * If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_fp; + } if (tmp != fp) { tmp_blinded = true; fp = tmp; diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c index 73bf0aea8baf..0fe2df433082 100644 --- a/arch/sparc/net/bpf_jit_comp_64.c +++ b/arch/sparc/net/bpf_jit_comp_64.c @@ -1493,11 +1493,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - /* If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/sw_64/net/bpf_jit_comp.c b/arch/sw_64/net/bpf_jit_comp.c index 057461689832..e154adc33073 100644 --- a/arch/sw_64/net/bpf_jit_comp.c +++ b/arch/sw_64/net/bpf_jit_comp.c @@ -1969,11 +1969,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - /* If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index ad50d9a270fc..46fb1c77b370 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2986,11 +2986,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp = bpf_jit_blind_constants(prog); /* - * If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c index f2fc8c38629b..d45644254cba 100644 --- a/arch/x86/net/bpf_jit_comp32.c +++ b/arch/x86/net/bpf_jit_comp32.c @@ -2535,11 +2535,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp = bpf_jit_blind_constants(prog); /* - * If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index bf493b8ae8fd..06748b956b5c 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -19,6 +19,7 @@ #include <uapi/linux/btf.h> #include <linux/filter.h> +#include <linux/sched/signal.h> #include <linux/skbuff.h> #include <linux/vmalloc.h> #include <linux/random.h> @@ -1534,6 +1535,8 @@ struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *prog) * fix it up here on error. */ bpf_jit_prog_release_other(prog, clone); + if (fatal_signal_pending(current)) + return ERR_PTR(-EINTR); return tmp; } @@ -2466,6 +2469,8 @@ static void bpf_prog_select_func(struct bpf_prog *fp) */ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err) { + struct bpf_prog *jit_prog; + /* In case of BPF to BPF calls, verifier did all the prep * work with regards to JITing, etc. */ @@ -2491,7 +2496,12 @@ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err) if (*err) return fp; - fp = bpf_int_jit_compile(fp); + jit_prog = bpf_int_jit_compile(fp); + if (IS_ERR(jit_prog)) { + *err = PTR_ERR(jit_prog); + return fp; + } + fp = jit_prog; bpf_prog_jit_attempt_done(fp); if (!fp->jited && jit_needed) { *err = -ENOTSUPP; diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 7f3bb5bf8a57..66cfb1d955c1 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -19,6 +19,7 @@ #include <linux/bsearch.h> #include <linux/sort.h> #include <linux/perf_event.h> +#include <linux/sched/signal.h> #include <linux/ctype.h> #include <linux/error-injection.h> #include <linux/bpf_lsm.h> @@ -18452,12 +18453,28 @@ static void adjust_poke_descs(struct bpf_prog *prog, u32 off, u32 len) } } +/* + * Some post-verification instruction rewriting passes require an + * O(prog->len) operation per instruction. Keep their shared primitives + * killable and preemptible. + */ +static bool bpf_rewrite_must_abort(void) +{ + if (fatal_signal_pending(current)) + return true; + cond_resched(); + return false; +} + static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 off, const struct bpf_insn *patch, u32 len) { struct bpf_prog *new_prog; struct bpf_insn_aux_data *new_data = NULL; + if (bpf_rewrite_must_abort()) + return NULL; + if (len > 1) { new_data = vzalloc(array_size(env->prog->len + len - 1, sizeof(struct bpf_insn_aux_data))); @@ -18606,6 +18623,9 @@ static int verifier_remove_insns(struct bpf_verifier_env *env, u32 off, u32 cnt) unsigned int orig_prog_len = env->prog->len; int err; + if (bpf_rewrite_must_abort()) + return -EINTR; + if (bpf_prog_is_offloaded(env->prog->aux)) bpf_prog_offload_remove_insns(env, off, cnt); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-98044
by Chen Yuxi 28 Oct '26

28 Oct '26

Fix CVE-2026-98044 and the kabi breakage. Chen Yuxi (1): bpf: Fix kabi breakage in struct bpf_subprog_info Kumar Kartikeya Dwivedi (1): bpf: Reject legacy packet loads from callbacks include/linux/bpf_verifier.h | 1 + kernel/bpf/verifier.c | 22 ++++++++++++++++++++++ 2 files changed, 23 insertions(+) -- 2.34.1

2 3

openEuler Kernel SIG双周例会
by openEuler conference 28 Oct '26

28 Oct '26

您好！ Kernel 邀请您参加 2026-10-30 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题可直接申报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/968711190 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-10-30 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题可直接申报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/968711190 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-5.10 v2] md: fix null-ptr-deref in md_check_no_bitmap()
by Zhou Minqiang 28 Oct '26

28 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10134 -------------------------------- md_check_no_bitmap() dereferences mddev->pers->name to print the personality name when an array has a bitmap configured but the personality does not support bitmaps. Commit 36d091f4759d ("md: protect ->pers changes with mddev->lock") moved the assignment mddev->pers = pers to after pers->run(), so mddev->pers is still NULL when md_check_no_bitmap() is called from the ->run method of raid0 and linear: do_md_run md_run pers->run(mddev) <- mddev->pers still NULL raid0_run / linear_run md_check_no_bitmap mddev->pers->head.name <- NULL pointer dereference The early-return check in md_check_no_bitmap() can be bypassed because the bitmap can be configured while pers is NULL: set_bitmap_file() (via SET_BITMAP_FILE ioctl) sets bitmap_info.file directly, and location_store() (via sysfs bitmap/location) sets bitmap_info.offset. Both md_run() and the level_store() takeover path set mddev->clevel via strscpy(mddev->clevel, pers->name, ...) before calling pers->run(), making mddev->clevel a safe substitute for printing the personality name. Fixes: 36d091f4759d ("md: protect ->pers changes with mddev->lock") Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 4ddb56d7408a..2952b178f016 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -1170,7 +1170,7 @@ int md_check_no_bitmap(struct mddev *mddev) if (!mddev->bitmap_info.file && !mddev->bitmap_info.offset) return 0; pr_warn("%s: bitmaps are not supported for %s\n", - mdname(mddev), mddev->pers->name); + mdname(mddev), mddev->clevel); return 1; } EXPORT_SYMBOL(md_check_no_bitmap); -- 2.52.0

2 1

[PATCH OLK-6.6 v2] md: fix null-ptr-deref in md_check_no_bitmap()
by Zhou Minqiang 28 Oct '26

28 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10134 -------------------------------- md_check_no_bitmap() dereferences mddev->pers->name to print the personality name when an array has a bitmap configured but the personality does not support bitmaps. Commit 36d091f4759d ("md: protect ->pers changes with mddev->lock") moved the assignment mddev->pers = pers to after pers->run(), so mddev->pers is still NULL when md_check_no_bitmap() is called from the ->run method of raid0 and linear: do_md_run md_run pers->run(mddev) <- mddev->pers still NULL raid0_run / linear_run md_check_no_bitmap mddev->pers->head.name <- NULL pointer dereference The early-return check in md_check_no_bitmap() can be bypassed because the bitmap can be configured while pers is NULL: set_bitmap_file() (via SET_BITMAP_FILE ioctl) sets bitmap_info.file directly, and location_store() (via sysfs bitmap/location) sets bitmap_info.offset. Both md_run() and the level_store() takeover path set mddev->clevel via strscpy(mddev->clevel, pers->name, ...) before calling pers->run(), making mddev->clevel a safe substitute for printing the personality name. Fixes: 36d091f4759d ("md: protect ->pers changes with mddev->lock") Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 643c8f1117c6..80d2bddb9e46 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -1307,7 +1307,7 @@ int md_check_no_bitmap(struct mddev *mddev) if (!mddev->bitmap_info.file && !mddev->bitmap_info.offset) return 0; pr_warn("%s: bitmaps are not supported for %s\n", - mdname(mddev), mddev->pers->name); + mdname(mddev), mddev->clevel); return 1; } EXPORT_SYMBOL(md_check_no_bitmap); -- 2.52.0

2 1

[PATCH OLK-5.10] nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
by Zhang Yuwei 28 Oct '26

28 Oct '26

From: Yang Xiuwei <yangxiuwei(a)kylinos.cn> mainline inclusion from mainline-v7.3-rc1 commit b53d495c7f0db46b6748b5ade48371a10dd5d3bc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19562 CVE: CVE-2026-90227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass flags and open_for_write through and reject disallowed commands with -EACCES. Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Yang Xiuwei <yangxiuwei(a)kylinos.cn> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/core.c [5.10 has no drivers/nvme/host/ioctl.c and no nvme_cmd_allowed() (both introduced by the 6.x nvme ioctl split), so nvme_submit_io() still lives in core.c without the fine-grained permission framework; add the equivalent capable(CAP_SYS_ADMIN) check used by the other passthrough ioctls in this file.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/nvme/host/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index c127c6a182a3..86b6c29a1bba 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -1596,6 +1596,9 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio) c.rw.apptag = cpu_to_le16(io.apptag); c.rw.appmask = cpu_to_le16(io.appmask); + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + return nvme_submit_user_cmd(ns->queue, &c, nvme_to_user_ptr(io.addr), length, metadata, meta_len, lower_32_bits(io.slba), NULL, 0); -- 2.22.0

2 1

[PATCH OLK-6.6] nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
by Zhang Yuwei 28 Oct '26

28 Oct '26

From: Yang Xiuwei <yangxiuwei(a)kylinos.cn> mainline inclusion from mainline-v7.3-rc1 commit b53d495c7f0db46b6748b5ade48371a10dd5d3bc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19562 CVE: CVE-2026-90227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass flags and open_for_write through and reject disallowed commands with -EACCES. Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Yang Xiuwei <yangxiuwei(a)kylinos.cn> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/core.c [5.10 has no drivers/nvme/host/ioctl.c and no nvme_cmd_allowed() (both introduced by the 6.x nvme ioctl split), so nvme_submit_io() still lives in core.c without the fine-grained permission framework; add the equivalent capable(CAP_SYS_ADMIN) check used by the other passthrough ioctls in this file.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/nvme/host/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index c127c6a182a3..86b6c29a1bba 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -1596,6 +1596,9 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio) c.rw.apptag = cpu_to_le16(io.apptag); c.rw.appmask = cpu_to_le16(io.appmask); + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + return nvme_submit_user_cmd(ns->queue, &c, nvme_to_user_ptr(io.addr), length, metadata, meta_len, lower_32_bits(io.slba), NULL, 0); -- 2.22.0

2 1

[PATCH OLK-6.6] blk-mq: set RQF_USE_SCHED when the operation is known
by Zizhi Wo 27 Oct '26

27 Oct '26

From: Keith Busch <kbusch(a)kernel.org> stable inclusion from stable-v6.18.56 commit 790730e4d95de8356a573d4b4864486bba731863 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20493 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ab6c756f28c741d704a7c3e04814bfc3adf6f818 ] The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF_USE_SCHED cleared, so using those flags for a subsequent read/write bio will insert it into the scheduler without ->prepare_request() and frees it without ->finish_request(). For kyber, this leaks the domain token acquired at dispatch and stalls the queue. Don't set RQF_USE_SCHED based on the first operation the batch happened to be allocated for. Instead, set it after the request is claimed by an operation. Introduce a helper function, blk_mq_rq_late_init() for this, and absorb blk_mq_rq_time_init() since the two run together. Fixes: 4b6a5d9cea91 ("block: enable batched allocation for blk_mq_alloc_request()") Link: https://lore.kernel.org/linux-block/20260916151655.2588-1-15815827059@163.c… Reported-by: Henry Hu <huhai(a)kylinos.cn> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://patch.msgid.link/20260922172711.1573186-1-kbusch@meta.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- block/blk-mq.c | 64 +++++++++++++++++++++++++++++---------------- block/mq-deadline.c | 2 +- 2 files changed, 43 insertions(+), 23 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index ed2ddd17841b..9724e5bce3f0 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -398,20 +398,10 @@ static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data, INIT_LIST_HEAD(&rq->queuelist); /* tag was already set */ WRITE_ONCE(rq->deadline, 0); req_ref_set(rq, 1); - if (rq->rq_flags & RQF_USE_SCHED) { - struct elevator_queue *e = data->q->elevator; - - INIT_HLIST_NODE(&rq->hash); - RB_CLEAR_NODE(&rq->rb_node); - - if (e->type->ops.prepare_request) - e->type->ops.prepare_request(rq); - } - return rq; } static inline struct request * __blk_mq_alloc_requests_batch(struct blk_mq_alloc_data *data) @@ -442,10 +432,44 @@ __blk_mq_alloc_requests_batch(struct blk_mq_alloc_data *data) data->nr_tags -= nr; return rq_list_pop(data->cached_rq); } +static bool blk_op_bypass_sched(blk_opf_t opf) +{ + return (opf & REQ_OP_MASK) == REQ_OP_FLUSH || + blk_op_is_passthrough(opf); +} + +/* + * Finish initializing a request once it has been claimed for an operation. + * Cached requests are allocated before that operation is known. + */ +static void blk_mq_rq_late_init(struct request *rq, u64 alloc_time_ns) +{ + struct elevator_queue *e; + + if (!(rq->rq_flags & RQF_SCHED_TAGS) || (rq->rq_flags & RQF_RESV) || + blk_op_bypass_sched(rq->cmd_flags)) { + blk_mq_rq_time_init(rq, alloc_time_ns); + return; + } + + /* + * Set this before initializing the time stamps because + * blk_mq_rq_time_init() looks at RQF_USE_SCHED. + */ + rq->rq_flags |= RQF_USE_SCHED; + blk_mq_rq_time_init(rq, alloc_time_ns); + INIT_HLIST_NODE(&rq->hash); + RB_CLEAR_NODE(&rq->rb_node); + + e = rq->q->elevator; + if (e->type->ops.prepare_request) + e->type->ops.prepare_request(rq); +} + static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) { struct request_queue *q = data->q; u64 alloc_time_ns = 0; struct request *rq; @@ -471,17 +495,15 @@ static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) /* * Flush/passthrough requests are special and go directly to the * dispatch list. */ - if ((data->cmd_flags & REQ_OP_MASK) != REQ_OP_FLUSH && - !blk_op_is_passthrough(data->cmd_flags)) { + if (!blk_op_bypass_sched(data->cmd_flags)) { struct elevator_mq_ops *ops = &q->elevator->type->ops; WARN_ON_ONCE(data->flags & BLK_MQ_REQ_RESERVED); - data->rq_flags |= RQF_USE_SCHED; if (ops->limit_depth) ops->limit_depth(data->cmd_flags, data); } } else { blk_mq_tag_busy(data->hctx); @@ -494,11 +516,11 @@ static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) * Try batched alloc if we want more than 1 tag. */ if (data->nr_tags > 1) { rq = __blk_mq_alloc_requests_batch(data); if (rq) { - blk_mq_rq_time_init(rq, alloc_time_ns); + blk_mq_rq_late_init(rq, alloc_time_ns); return rq; } data->nr_tags = 1; } @@ -520,11 +542,11 @@ static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) msleep(3); goto retry; } rq = blk_mq_rq_ctx_init(data, blk_mq_tags_from_data(data), tag); - blk_mq_rq_time_init(rq, alloc_time_ns); + blk_mq_rq_late_init(rq, alloc_time_ns); return rq; } static struct request *blk_mq_rq_cache_fill(struct request_queue *q, struct blk_plug *plug, @@ -563,12 +585,10 @@ static struct request *blk_mq_alloc_cached_request(struct request_queue *q, if (rq_list_empty(plug->cached_rq)) { if (plug->nr_ios == 1) return NULL; rq = blk_mq_rq_cache_fill(q, plug, opf, flags); - if (!rq) - return NULL; } else { rq = rq_list_peek(&plug->cached_rq); if (!rq || rq->q != q) return NULL; @@ -576,15 +596,15 @@ static struct request *blk_mq_alloc_cached_request(struct request_queue *q, return NULL; if (op_is_flush(rq->cmd_flags) != op_is_flush(opf)) return NULL; plug->cached_rq = rq_list_next(rq); - blk_mq_rq_time_init(rq, 0); + rq->cmd_flags = opf; + INIT_LIST_HEAD(&rq->queuelist); + blk_mq_rq_late_init(rq, 0); } - rq->cmd_flags = opf; - INIT_LIST_HEAD(&rq->queuelist); return rq; } struct request *blk_mq_alloc_request(struct request_queue *q, blk_opf_t opf, blk_mq_req_flags_t flags) @@ -679,11 +699,11 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, ret = -EWOULDBLOCK; tag = blk_mq_get_tag(&data); if (tag == BLK_MQ_NO_TAG) goto out_queue_exit; rq = blk_mq_rq_ctx_init(&data, blk_mq_tags_from_data(&data), tag); - blk_mq_rq_time_init(rq, alloc_time_ns); + blk_mq_rq_late_init(rq, alloc_time_ns); rq->__data_len = 0; rq->__sector = (sector_t) -1; rq->bio = rq->biotail = NULL; return rq; @@ -3036,13 +3056,13 @@ static bool blk_mq_can_use_cached_rq(struct request *rq, struct blk_plug *plug, * before we throttle. */ plug->cached_rq = rq_list_next(rq); rq_qos_throttle(rq->q, bio); - blk_mq_rq_time_init(rq, 0); rq->cmd_flags = bio->bi_opf; INIT_LIST_HEAD(&rq->queuelist); + blk_mq_rq_late_init(rq, 0); return true; } /** * blk_mq_submit_bio - Create and send a request to block device. diff --git a/block/mq-deadline.c b/block/mq-deadline.c index a9cf8e19f9d1..433b9cecdb6c 100644 --- a/block/mq-deadline.c +++ b/block/mq-deadline.c @@ -906,11 +906,11 @@ static void dd_insert_requests(struct blk_mq_hw_ctx *hctx, rq_list_hierarchy_end_io_acct(&free, STAGE_DEADLINE); blk_mq_free_requests(&free); } -/* Callback from inside blk_mq_rq_ctx_init(). */ +/* Callback from inside blk_mq_rq_late_init(). */ static void dd_prepare_request(struct request *rq) { rq->elv.priv[0] = NULL; } -- 2.52.0

2 1