- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 V3 0/7] P2PDMA PATCHSET PART 2
by Zizhi Wo 12 Nov '26

12 Nov '26

Add some p2pdma api and dedup of vmemmap. Alistair Popple (1): mm: allow compound zone device pages Zizhi Wo (6): PCI/P2PDMA: whitelist HiSilicon root ports PCI/P2PDMA: disable CPU access through bvec iterators mm: add P2PDMA vmemmap optimization capability PCI/P2PDMA: add aligned resource registration x86: enable P2PDMA vmemmap optimization arm64: enable P2PDMA vmemmap optimization arch/arm64/Kconfig | 1 + arch/x86/Kconfig | 1 + drivers/pci/p2pdma.c | 119 +++++++++++++++++++++++++++++++------ include/linux/memremap.h | 6 +- include/linux/mm.h | 19 +++++- include/linux/mmzone.h | 13 +++- include/linux/pci-p2pdma.h | 21 ++++++- lib/iov_iter.c | 36 +++++++++-- mm/Kconfig | 7 ++- mm/memremap.c | 2 +- 10 files changed, 192 insertions(+), 33 deletions(-) -- 2.52.0

2 8

[PATCH OLK-6.6 V3 0/7] P2PDMA PATCHSET PART 2
by Zizhi Wo 12 Nov '26

12 Nov '26

Add some p2pdma api and dedup of vmemmap. Alistair Popple (1): mm: allow compound zone device pages Zizhi Wo (6): PCI/P2PDMA: whitelist HiSilicon root ports PCI/P2PDMA: disable CPU access through bvec iterators mm: add P2PDMA vmemmap optimization capability PCI/P2PDMA: add aligned resource registration x86: enable P2PDMA vmemmap optimization arm64: enable P2PDMA vmemmap optimization arch/arm64/Kconfig | 1 + arch/x86/Kconfig | 1 + drivers/pci/p2pdma.c | 119 +++++++++++++++++++++++++++++++------ include/linux/memremap.h | 6 +- include/linux/mm.h | 19 +++++- include/linux/mmzone.h | 13 +++- include/linux/pci-p2pdma.h | 21 ++++++- lib/iov_iter.c | 36 +++++++++-- mm/Kconfig | 7 ++- mm/memremap.c | 2 +- 10 files changed, 192 insertions(+), 33 deletions(-) -- 2.52.0

2 8

[PATCH v3 openEuler-26.09 0/3] cache_ext framework
by Nikita Panov 12 Nov '26

12 Nov '26

From: Nikita Panov <panov.nikita(a)huawei.com> Cache_ext framework project integration. Heavily inspired by "cache_ext: Customizing the Page Cache with eBPF" by Tal Zussman, Ioannis Zarkadas and others. This patchset allows users to load custom bpf policies to adjust page cache reclaim algorithm. Policy might be designed to reclaim specific files (filter by name) or an algorithm differ from LRU/MGLRU might be implemented. Additionaly, a refill mechanism was implemented. If the page was reclaimed through the cache_ext, the system has a lot of free mem, and the disk is not busy with IO at the moment, page might be refilled to the page cache. Nikita Panov (3): mm: Cache_ext framework krefilld: initial design and implementation cache_ext: Add examples to tools/cache_ext .../admin-guide/kernel-parameters.txt | 21 + Documentation/admin-guide/sysctl/vm.rst | 41 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/drop_caches.c | 6 + fs/inode.c | 13 + fs/super.c | 20 +- include/linux/cache_ext.h | 259 ++++ include/linux/fs.h | 4 + include/linux/memcontrol.h | 26 + include/linux/mempolicy.h | 6 + include/linux/mm_types.h | 33 + include/linux/mmzone.h | 7 + include/linux/page_ext.h | 4 + include/linux/pagemap.h | 3 + include/linux/sched.h | 7 + include/linux/swap.h | 20 + include/linux/sysctl.h | 8 +- kernel/bpf/verifier.c | 129 +- kernel/sysctl.c | 38 +- mm/Kconfig | 11 + mm/Makefile | 1 + mm/cache_ext.c | 1335 +++++++++++++++++ mm/cache_ext_ds.c | 1050 +++++++++++++ mm/filemap.c | 12 +- mm/memcontrol.c | 48 + mm/mempolicy.c | 5 + mm/migrate.c | 16 +- mm/page_ext.c | 7 + mm/swap.c | 1 + mm/truncate.c | 12 +- mm/vmscan.c | 267 +++- mm/vmstat.c | 8 +- mm/workingset.c | 110 +- tools/cache_ext/.gitignore | 2 + tools/cache_ext/Makefile | 229 +++ tools/cache_ext/cache_ext_simple_fifo.bpf.c | 109 ++ tools/cache_ext/cache_ext_simple_fifo.c | 52 + .../cache_ext/include/cache_ext_common.bpf.h | 178 +++ 39 files changed, 4074 insertions(+), 26 deletions(-) create mode 100644 include/linux/cache_ext.h create mode 100644 mm/cache_ext.c create mode 100644 mm/cache_ext_ds.c create mode 100644 tools/cache_ext/.gitignore create mode 100644 tools/cache_ext/Makefile create mode 100644 tools/cache_ext/cache_ext_simple_fifo.bpf.c create mode 100644 tools/cache_ext/cache_ext_simple_fifo.c create mode 100644 tools/cache_ext/include/cache_ext_common.bpf.h -- 2.34.1

2 4

[PATCH OLK-5.10] drm/virtio: use the DMA API for resource backing on Xen
by Jiacheng Yu 12 Nov '26

12 Nov '26

From: Benjamin Leggett <benjamin(a)edera.io> mainline inclusion from mainline-v7.3-rc2 commit 6a736d2f9d0c6e6217fe7532bc4c50ceca71db78 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19675 CVE: CVE-2026-98156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtio_ring.c handles this correctly, vring_use_map_api() returns true for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM. virtio-gpu makes the same decision independently, but its copy looks only at the feature bit: bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); QEMU does not set iommu_platform on virtio-vga by default, so VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and virtio_gpu_object_shmem_init() describes the framebuffer's backing pages to the host with sg_phys(). Those are guest-physical addresses. In a PV domain they resolve, on the host side, to pages belonging to some other domain, so the host scans out unrelated memory. Move the decision into virtio_gpu_use_dma_api() and give it the xen_domain() check, like vring_use_map_api() has. This additionally enables the dma_sync_sgtable_for_device() calls in virtgpu_vq.c, which are required for correctness whenever swiotlb is in play. Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0 works fine and doesn't need this fix because it is identity-mapped, only PV dom0s are affected. Fixes: a3b815f09bb8 ("drm/virtio: add iommu support.") Signed-off-by: Ben Leggett <benjamin(a)edera.io> Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Link: https://patch.msgid.link/20260806-virtgpu-xen-dma-v1-1-e499b345bbad@edera.io Conflicts: drivers/gpu/drm/virtio/virtgpu_drv.h drivers/gpu/drm/virtio/virtgpu_object.c drivers/gpu/drm/virtio/virtgpu_vq.c [1. virtgpu_vq.c: the upstream virtio_gpu_panic_cmd_transfer_to_host_2d() hunk is dropped, this tree has no such function; only virtio_gpu_cmd_transfer_to_host_2d() and virtio_gpu_cmd_transfer_to_host_3d() are switched to virtio_gpu_use_dma_api(). 2. Context conflicts: virtgpu_drv.h here has no DEBUG_NAME_MAX_LEN; virtgpu_object.c and virtgpu_vq.c still use shmem->pages rather than bo->base.sgt.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_drv.h | 20 ++++++++++++++++++++ drivers/gpu/drm/virtio/virtgpu_object.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 4 ++-- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h index 7c4f721621f3..950e8b1fc8dc 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.h +++ b/drivers/gpu/drm/virtio/virtgpu_drv.h @@ -41,6 +41,8 @@ #include <drm/drm_probe_helper.h> #include <drm/virtgpu_drm.h> +#include <xen/xen.h> + #define DRIVER_NAME "virtio_gpu" #define DRIVER_DESC "virtio GPU" #define DRIVER_DATE "0" @@ -53,6 +55,24 @@ #define UUID_INITIALIZED 1 #define UUID_INITIALIZATION_FAILED 2 +/* + * Whether the host must be told about resource backing pages by DMA address + * rather than guest-physical address. + * + * This mirrors vring_use_map_api() in drivers/virtio/virtio_ring.c, including + * its xen_domain() case. + */ +static inline bool virtio_gpu_use_dma_api(const struct virtio_device *vdev) +{ + if (!virtio_has_dma_quirk(vdev)) + return true; + + if (xen_domain()) + return true; + + return false; +} + struct virtio_gpu_object_params { uint32_t format; uint32_t width; diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index 49fa59e09187..59046bf43301 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -141,7 +141,7 @@ static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev, struct virtio_gpu_mem_entry **ents, unsigned int *nents) { - bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev); struct virtio_gpu_object_shmem *shmem = to_virtio_gpu_shmem(bo); struct scatterlist *sg; int si, ret; diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index 3f75510bf240..429c00c9062c 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -598,7 +598,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev, struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]); struct virtio_gpu_transfer_to_host_2d *cmd_p; struct virtio_gpu_vbuffer *vbuf; - bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev); struct virtio_gpu_object_shmem *shmem = to_virtio_gpu_shmem(bo); if (virtio_gpu_is_shmem(bo) && use_dma_api) @@ -1018,7 +1018,7 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev, struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]); struct virtio_gpu_transfer_host_3d *cmd_p; struct virtio_gpu_vbuffer *vbuf; - bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev); struct virtio_gpu_object_shmem *shmem = to_virtio_gpu_shmem(bo); if (use_dma_api) -- 2.34.1

2 1

[PATCH OLK-6.6] drm/virtio: use the DMA API for resource backing on Xen
by Jiacheng Yu 12 Nov '26

12 Nov '26

From: Benjamin Leggett <benjamin(a)edera.io> stable inclusion from stable-v6.6.160 commit 32e999ccf5f6453b3b4df8264ff1b03c6720292f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19675 CVE: CVE-2026-98156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6a736d2f9d0c6e6217fe7532bc4c50ceca71db78 ] On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtio_ring.c handles this correctly, vring_use_map_api() returns true for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM. virtio-gpu makes the same decision independently, but its copy looks only at the feature bit: bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); QEMU does not set iommu_platform on virtio-vga by default, so VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and virtio_gpu_object_shmem_init() describes the framebuffer's backing pages to the host with sg_phys(). Those are guest-physical addresses. In a PV domain they resolve, on the host side, to pages belonging to some other domain, so the host scans out unrelated memory. Move the decision into virtio_gpu_use_dma_api() and give it the xen_domain() check, like vring_use_map_api() has. This additionally enables the dma_sync_sgtable_for_device() calls in virtgpu_vq.c, which are required for correctness whenever swiotlb is in play. Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0 works fine and doesn't need this fix because it is identity-mapped, only PV dom0s are affected. Fixes: a3b815f09bb8 ("drm/virtio: add iommu support.") Signed-off-by: Ben Leggett <benjamin(a)edera.io> Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Link: https://patch.msgid.link/20260806-virtgpu-xen-dma-v1-1-e499b345bbad@edera.io Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_drv.h | 20 ++++++++++++++++++++ drivers/gpu/drm/virtio/virtgpu_object.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 4 ++-- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h index 9f9ded45cd6a..de36af56df86 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.h +++ b/drivers/gpu/drm/virtio/virtgpu_drv.h @@ -43,6 +43,8 @@ #include <drm/drm_probe_helper.h> #include <drm/virtgpu_drm.h> +#include <xen/xen.h> + #define DRIVER_NAME "virtio_gpu" #define DRIVER_DESC "virtio GPU" #define DRIVER_DATE "0" @@ -58,6 +60,24 @@ #define MAX_CAPSET_ID 63 #define MAX_RINGS 64 +/* + * Whether the host must be told about resource backing pages by DMA address + * rather than guest-physical address. + * + * This mirrors vring_use_map_api() in drivers/virtio/virtio_ring.c, including + * its xen_domain() case. + */ +static inline bool virtio_gpu_use_dma_api(const struct virtio_device *vdev) +{ + if (!virtio_has_dma_quirk(vdev)) + return true; + + if (xen_domain()) + return true; + + return false; +} + struct virtio_gpu_object_params { unsigned long size; bool dumb; diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index c7e74cf13022..c4f8cdf85f60 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -137,7 +137,7 @@ static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev, struct virtio_gpu_mem_entry **ents, unsigned int *nents) { - bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev); struct scatterlist *sg; struct sg_table *pages; int si; diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index a4d1a7710325..d2c83f3e74b9 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -601,7 +601,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev, struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]); struct virtio_gpu_transfer_to_host_2d *cmd_p; struct virtio_gpu_vbuffer *vbuf; - bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev); if (virtio_gpu_is_shmem(bo) && use_dma_api) dma_sync_sgtable_for_device(vgdev->vdev->dev.parent, @@ -1020,7 +1020,7 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev, struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]); struct virtio_gpu_transfer_host_3d *cmd_p; struct virtio_gpu_vbuffer *vbuf; - bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); + bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev); if (virtio_gpu_is_shmem(bo) && use_dma_api) dma_sync_sgtable_for_device(vgdev->vdev->dev.parent, -- 2.34.1

2 1

[PATCH OLK-5.10 0/5] CVE-2026-97997
by Jiacheng Yu 12 Nov '26

12 Nov '26

CVE-2026-97997 Jiacheng Yu (5): virtio-ring: maintain next in extra state for packed virtqueue virtio_ring: rename vring_desc_extra_packed virtio_ring: secure handling of mapping errors virtio_ring: rename vring_unmap_state_packed() to vring_unmap_extra_packed() virtio_ring: fix stale descriptor flags after a failed packed add drivers/virtio/virtio_ring.c | 60 +++++++++++++++++++++++------------- 1 file changed, 39 insertions(+), 21 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6] virtio_ring: fix stale descriptor flags after a failed packed add
by Jiacheng Yu 12 Nov '26

12 Nov '26

From: Alexander Graf <graf(a)amazon.com> stable inclusion from stable-v6.6.160 commit 5ad081761a1f0b0d95ab08b61a6008309fba95f9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19808 CVE: CVE-2026-97997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 75d276e5bb68778b2916f98a2bc30f142ebadc64 ] In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every round of the ring, tracked by a wrap counter, so invalidating or validating a descriptor means inverting both bits. Commit 1ce9e6055fa0 ("virtio_ring: introduce packed ring support") has virtqueue_add_packed() make every descriptor of a chain available as it maps the chain, and write the head last. The device consumes the ring in order and stops at a head that is not available yet, so it never reaches the rest. When vring_map_one_sg() fails partway, unmap_release unmaps the segments and restores avail_used_flags, but the descriptors it wrote to in the ring stay marked with AVAIL and USED bits. The head is now the only entry that keeps the device from consuming these stale entries. For example, the ring would look like this now. Z - pre-previous command A - previous command B - aborted command C - current command [A1 DONE] [A2 DONE] <C1 EMPTY> [B2] [B3] [Z1 DONE] When the driver now attempts to issue the C command, the next add starts at the same head as B. If C spans less descriptors than B, there is no end marker because AVAIL and USED bits were still in place. And that means the device will start interpreting these stale entries (B2/B3) as another command entry, which then blocks the queue. This effect typically happens in swiotlb configurations under memory pressure, because vring_map_one_sg() can then fail with larger I/O requests which then leads to command abortions. There are broadly 2 ways to avoid leaving those flags behind: 1) Defer those flags too until the chain is complete. 2) Rewrite those flags for the previous wrap counter. Implement the second option in both packed add paths. The first option traverses the chain a second time on every successful add. The second option invalidates all added descriptors when any add fails. With this patch applied, a packed virtqueue keeps completing requests after a failed add. Fixes: 1ce9e6055fa0 ("virtio_ring: introduce packed ring support") Fixes: f6a15d854986 ("virtio_ring: add in order support") Assisted-by: Kiro:claude-opus-5 checkpatch sparse Signed-off-by: Alexander Graf <graf(a)amazon.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Message-ID: <20260817223229.28954-1-graf(a)amazon.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/virtio/virtio_ring.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c index 9c3cdc490e87..7d6948d3a874 100644 --- a/drivers/virtio/virtio_ring.c +++ b/drivers/virtio/virtio_ring.c @@ -1430,7 +1430,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, struct scatterlist *sg; unsigned int i, n, c, descs_used, err_idx; __le16 head_flags, flags; - u16 head, id, prev, curr, avail_used_flags; + u16 head, id, prev, curr, avail_used_flags, unpub_flags; int err; START_USE(vq); @@ -1553,15 +1553,30 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, curr = vq->free_head; vq->packed.avail_used_flags = avail_used_flags; + unpub_flags = avail_used_flags ^ (1 << VRING_PACKED_DESC_F_AVAIL | + 1 << VRING_PACKED_DESC_F_USED); for (n = 0; n < total_sg; n++) { if (i == err_idx) break; + /* + * The mapping loop made every descriptor but the head + * available. Stamp the previous wrap counter's AVAIL and USED + * bits on those, so that a later and shorter chain at this head + * does not leave one of them available beyond its own last + * descriptor. Marking them used instead would hand + * is_used_desc_packed() a completion we never made. + */ + if (i != head) + desc[i].flags = cpu_to_le16(unpub_flags); vring_unmap_extra_packed(vq, &vq->packed.desc_extra[curr]); curr = vq->packed.desc_extra[curr].next; i++; - if (i >= vq->packed.vring.num) + if (i >= vq->packed.vring.num) { i = 0; + unpub_flags ^= 1 << VRING_PACKED_DESC_F_AVAIL | + 1 << VRING_PACKED_DESC_F_USED; + } } END_USE(vq); -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] CVE-2026-97994
by Jiacheng Yu 12 Nov '26

12 Nov '26

CVE-2026-97994 Jia Jia (1): vhost/vdpa: reject VRING_NUM larger than device max Si-Wei Liu (2): vdpa: introduce .compat_reset operation callback vhost-vdpa: clean iotlb map during reset for older userspace drivers/vhost/vdpa.c | 62 ++++++++++++++++++++++++++++++------ drivers/virtio/virtio_vdpa.c | 2 +- include/linux/vdpa.h | 20 ++++++++++-- 3 files changed, 71 insertions(+), 13 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/3] CVE-2026-90129
by Jiacheng Yu 12 Nov '26

12 Nov '26

CVE-2026-90129 Denis V. Lunev (3): virtio: add virtio_device_shutdown() helper virtio_balloon: factor out virtballoon_quiesce() virtio_balloon: quiesce balloon work before device shutdown drivers/virtio/virtio.c | 41 ++++++++++++++++++++++----------- drivers/virtio/virtio_balloon.c | 34 +++++++++++++++++++++------ include/linux/virtio.h | 1 + 3 files changed, 55 insertions(+), 21 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/3] CVE-2026-90129
by Jiacheng Yu 12 Nov '26

12 Nov '26

CVE-2026-90129 Denis V. Lunev (3): virtio: add virtio_device_shutdown() helper virtio_balloon: factor out virtballoon_quiesce() virtio_balloon: quiesce balloon work before device shutdown drivers/virtio/virtio.c | 41 ++++++++++++++++++++++----------- drivers/virtio/virtio_balloon.c | 34 +++++++++++++++++++++------ include/linux/virtio.h | 1 + 3 files changed, 55 insertions(+), 21 deletions(-) -- 2.34.1

2 4