- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] bpf: Make post-verification instruction rewrites killable
by Pu Lehui 28 Oct '26

28 Oct '26

From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> mainline inclusion from mainline-v7.3-rc5 commit 261b61d3735b042ae25634f795c4540be0fc140c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20695 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- After do_check() returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining instruction and auxiliary-data arrays and adjusts all branch offsets, making the overall work quadratic in the program length. A privileged loader can submit 131072 unconditional jumps by zero followed by a valid return. Verification finishes quickly, but bpf_opt_remove_nops() then spends a long time removing each jump separately. Since this post-verification work neither checks for signals nor reschedules, a pending SIGKILL cannot terminate the task until the rewrite finishes. Make bpf_patch_insn_data() and verifier_remove_insns() common cancellation and rescheduling points. These helpers run from BPF_PROG_LOAD process context, and bpf_patch_insn_data() can already sleep while reallocating auxiliary data. Report interrupted constant blinding as -EINTR and propagate it through both JIT paths, including kernels that permit interpreter fallback. Other blinding failures retain the existing fallback behavior. This does not reduce the quadratic cost of the rewrite passes, but it makes the work preemptible and allows a killed loader to be torn down promptly. Fixes: 52875a04f4b2 ("bpf: verifier: remove dead code") Reported-by: Nicholas Carlini <npc(a)anthropic.com> Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://patch.msgid.link/20260917233222.2542500-2-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Conflicts: arch/arm/net/bpf_jit_32.c arch/arm64/net/bpf_jit_comp.c arch/loongarch/net/bpf_jit.c arch/mips/net/bpf_jit_comp.c arch/parisc/net/bpf_jit_core.c arch/powerpc/net/bpf_jit_comp.c arch/riscv/net/bpf_jit_core.c arch/s390/net/bpf_jit_comp.c arch/sparc/net/bpf_jit_comp_64.c arch/sw_64/net/bpf_jit_comp.c arch/x86/net/bpf_jit_comp.c arch/x86/net/bpf_jit_comp32.c kernel/bpf/core.c kernel/bpf/verifier.c kernel/bpf/fixups.c [generic bpf_jit_blind_constants not merged] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/arm/net/bpf_jit_32.c | 14 ++++++++------ arch/arm64/net/bpf_jit_comp.c | 10 +++++++--- arch/loongarch/net/bpf_jit.c | 10 ++++++---- arch/mips/net/bpf_jit_comp.c | 12 +++++++----- arch/parisc/net/bpf_jit_core.c | 9 ++++++++- arch/powerpc/net/bpf_jit_comp.c | 9 ++++++++- arch/riscv/net/bpf_jit_core.c | 9 ++++++++- arch/s390/net/bpf_jit_comp.c | 9 ++++++--- arch/sparc/net/bpf_jit_comp_64.c | 10 +++++++--- arch/sw_64/net/bpf_jit_comp.c | 10 +++++++--- arch/x86/net/bpf_jit_comp.c | 9 ++++++--- arch/x86/net/bpf_jit_comp32.c | 9 ++++++--- kernel/bpf/core.c | 12 +++++++++++- kernel/bpf/verifier.c | 20 ++++++++++++++++++++ 14 files changed, 115 insertions(+), 37 deletions(-) diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c index 8adc45ad1b2a..0ff2a70d8c06 100644 --- a/arch/arm/net/bpf_jit_32.c +++ b/arch/arm/net/bpf_jit_32.c @@ -1894,14 +1894,16 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) if (!prog->jit_requested) return orig_prog; - /* If constant blinding was enabled and we failed during blinding - * then we must fall back to the interpreter. Otherwise, we save - * the new JITed code. - */ tmp = bpf_jit_blind_constants(prog); - - if (IS_ERR(tmp)) + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. + */ + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 971b75b8059f..87ec8dbb43af 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1580,11 +1580,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - /* If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index 123df6a771d7..f44803e66ff4 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -1125,12 +1125,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp = bpf_jit_blind_constants(prog); /* - * If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. Otherwise, we save - * the new JITed code. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; diff --git a/arch/mips/net/bpf_jit_comp.c b/arch/mips/net/bpf_jit_comp.c index e355dfca4400..6e5ede70b306 100644 --- a/arch/mips/net/bpf_jit_comp.c +++ b/arch/mips/net/bpf_jit_comp.c @@ -926,14 +926,16 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) */ if (!prog->jit_requested) return orig_prog; + tmp = bpf_jit_blind_constants(prog); /* - * If constant blinding was enabled and we failed during blinding - * then we must fall back to the interpreter. Otherwise, we save - * the new JITed code. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - tmp = bpf_jit_blind_constants(prog); - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/parisc/net/bpf_jit_core.c b/arch/parisc/net/bpf_jit_core.c index 06cbcd6fe87b..80ec6a6c2d49 100644 --- a/arch/parisc/net/bpf_jit_core.c +++ b/arch/parisc/net/bpf_jit_core.c @@ -54,8 +54,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - if (IS_ERR(tmp)) + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. + */ + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c index 57de9d6b0089..ab316a492075 100644 --- a/arch/powerpc/net/bpf_jit_comp.c +++ b/arch/powerpc/net/bpf_jit_comp.c @@ -75,8 +75,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) return org_fp; tmp_fp = bpf_jit_blind_constants(org_fp); - if (IS_ERR(tmp_fp)) + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. + */ + if (IS_ERR(tmp_fp)) { + if (PTR_ERR(tmp_fp) == -EINTR) + return tmp_fp; return org_fp; + } if (tmp_fp != org_fp) { bpf_blinded = true; diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c index 7b70ccb7fec3..bbfaaa880d4f 100644 --- a/arch/riscv/net/bpf_jit_core.c +++ b/arch/riscv/net/bpf_jit_core.c @@ -54,8 +54,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - if (IS_ERR(tmp)) + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. + */ + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c index 99eae9cf7972..3c171c1c56e7 100644 --- a/arch/s390/net/bpf_jit_comp.c +++ b/arch/s390/net/bpf_jit_comp.c @@ -1952,11 +1952,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) tmp = bpf_jit_blind_constants(fp); /* - * If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_fp; + } if (tmp != fp) { tmp_blinded = true; fp = tmp; diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c index 73bf0aea8baf..0fe2df433082 100644 --- a/arch/sparc/net/bpf_jit_comp_64.c +++ b/arch/sparc/net/bpf_jit_comp_64.c @@ -1493,11 +1493,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - /* If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/sw_64/net/bpf_jit_comp.c b/arch/sw_64/net/bpf_jit_comp.c index 057461689832..e154adc33073 100644 --- a/arch/sw_64/net/bpf_jit_comp.c +++ b/arch/sw_64/net/bpf_jit_comp.c @@ -1969,11 +1969,15 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) return orig_prog; tmp = bpf_jit_blind_constants(prog); - /* If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + /* + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index ad50d9a270fc..46fb1c77b370 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2986,11 +2986,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp = bpf_jit_blind_constants(prog); /* - * If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c index f2fc8c38629b..d45644254cba 100644 --- a/arch/x86/net/bpf_jit_comp32.c +++ b/arch/x86/net/bpf_jit_comp32.c @@ -2535,11 +2535,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp = bpf_jit_blind_constants(prog); /* - * If blinding was requested and we failed during blinding, - * we must fall back to the interpreter. + * Fall back to the interpreter after blinding failures, except when + * the loader was killed. */ - if (IS_ERR(tmp)) + if (IS_ERR(tmp)) { + if (PTR_ERR(tmp) == -EINTR) + return tmp; return orig_prog; + } if (tmp != prog) { tmp_blinded = true; prog = tmp; diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index bf493b8ae8fd..06748b956b5c 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -19,6 +19,7 @@ #include <uapi/linux/btf.h> #include <linux/filter.h> +#include <linux/sched/signal.h> #include <linux/skbuff.h> #include <linux/vmalloc.h> #include <linux/random.h> @@ -1534,6 +1535,8 @@ struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *prog) * fix it up here on error. */ bpf_jit_prog_release_other(prog, clone); + if (fatal_signal_pending(current)) + return ERR_PTR(-EINTR); return tmp; } @@ -2466,6 +2469,8 @@ static void bpf_prog_select_func(struct bpf_prog *fp) */ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err) { + struct bpf_prog *jit_prog; + /* In case of BPF to BPF calls, verifier did all the prep * work with regards to JITing, etc. */ @@ -2491,7 +2496,12 @@ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err) if (*err) return fp; - fp = bpf_int_jit_compile(fp); + jit_prog = bpf_int_jit_compile(fp); + if (IS_ERR(jit_prog)) { + *err = PTR_ERR(jit_prog); + return fp; + } + fp = jit_prog; bpf_prog_jit_attempt_done(fp); if (!fp->jited && jit_needed) { *err = -ENOTSUPP; diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 7f3bb5bf8a57..66cfb1d955c1 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -19,6 +19,7 @@ #include <linux/bsearch.h> #include <linux/sort.h> #include <linux/perf_event.h> +#include <linux/sched/signal.h> #include <linux/ctype.h> #include <linux/error-injection.h> #include <linux/bpf_lsm.h> @@ -18452,12 +18453,28 @@ static void adjust_poke_descs(struct bpf_prog *prog, u32 off, u32 len) } } +/* + * Some post-verification instruction rewriting passes require an + * O(prog->len) operation per instruction. Keep their shared primitives + * killable and preemptible. + */ +static bool bpf_rewrite_must_abort(void) +{ + if (fatal_signal_pending(current)) + return true; + cond_resched(); + return false; +} + static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 off, const struct bpf_insn *patch, u32 len) { struct bpf_prog *new_prog; struct bpf_insn_aux_data *new_data = NULL; + if (bpf_rewrite_must_abort()) + return NULL; + if (len > 1) { new_data = vzalloc(array_size(env->prog->len + len - 1, sizeof(struct bpf_insn_aux_data))); @@ -18606,6 +18623,9 @@ static int verifier_remove_insns(struct bpf_verifier_env *env, u32 off, u32 cnt) unsigned int orig_prog_len = env->prog->len; int err; + if (bpf_rewrite_must_abort()) + return -EINTR; + if (bpf_prog_is_offloaded(env->prog->aux)) bpf_prog_offload_remove_insns(env, off, cnt); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-98044
by Chen Yuxi 28 Oct '26

28 Oct '26

Fix CVE-2026-98044 and the kabi breakage. Chen Yuxi (1): bpf: Fix kabi breakage in struct bpf_subprog_info Kumar Kartikeya Dwivedi (1): bpf: Reject legacy packet loads from callbacks include/linux/bpf_verifier.h | 1 + kernel/bpf/verifier.c | 22 ++++++++++++++++++++++ 2 files changed, 23 insertions(+) -- 2.34.1

2 3

openEuler Kernel SIG双周例会
by openEuler conference 28 Oct '26

28 Oct '26

您好！ Kernel 邀请您参加 2026-10-30 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题可直接申报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/968711190 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-10-30 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题可直接申报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/968711190 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-5.10 v2] md: fix null-ptr-deref in md_check_no_bitmap()
by Zhou Minqiang 28 Oct '26

28 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10134 -------------------------------- md_check_no_bitmap() dereferences mddev->pers->name to print the personality name when an array has a bitmap configured but the personality does not support bitmaps. Commit 36d091f4759d ("md: protect ->pers changes with mddev->lock") moved the assignment mddev->pers = pers to after pers->run(), so mddev->pers is still NULL when md_check_no_bitmap() is called from the ->run method of raid0 and linear: do_md_run md_run pers->run(mddev) <- mddev->pers still NULL raid0_run / linear_run md_check_no_bitmap mddev->pers->head.name <- NULL pointer dereference The early-return check in md_check_no_bitmap() can be bypassed because the bitmap can be configured while pers is NULL: set_bitmap_file() (via SET_BITMAP_FILE ioctl) sets bitmap_info.file directly, and location_store() (via sysfs bitmap/location) sets bitmap_info.offset. Both md_run() and the level_store() takeover path set mddev->clevel via strscpy(mddev->clevel, pers->name, ...) before calling pers->run(), making mddev->clevel a safe substitute for printing the personality name. Fixes: 36d091f4759d ("md: protect ->pers changes with mddev->lock") Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 4ddb56d7408a..2952b178f016 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -1170,7 +1170,7 @@ int md_check_no_bitmap(struct mddev *mddev) if (!mddev->bitmap_info.file && !mddev->bitmap_info.offset) return 0; pr_warn("%s: bitmaps are not supported for %s\n", - mdname(mddev), mddev->pers->name); + mdname(mddev), mddev->clevel); return 1; } EXPORT_SYMBOL(md_check_no_bitmap); -- 2.52.0

2 1

[PATCH OLK-6.6 v2] md: fix null-ptr-deref in md_check_no_bitmap()
by Zhou Minqiang 28 Oct '26

28 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10134 -------------------------------- md_check_no_bitmap() dereferences mddev->pers->name to print the personality name when an array has a bitmap configured but the personality does not support bitmaps. Commit 36d091f4759d ("md: protect ->pers changes with mddev->lock") moved the assignment mddev->pers = pers to after pers->run(), so mddev->pers is still NULL when md_check_no_bitmap() is called from the ->run method of raid0 and linear: do_md_run md_run pers->run(mddev) <- mddev->pers still NULL raid0_run / linear_run md_check_no_bitmap mddev->pers->head.name <- NULL pointer dereference The early-return check in md_check_no_bitmap() can be bypassed because the bitmap can be configured while pers is NULL: set_bitmap_file() (via SET_BITMAP_FILE ioctl) sets bitmap_info.file directly, and location_store() (via sysfs bitmap/location) sets bitmap_info.offset. Both md_run() and the level_store() takeover path set mddev->clevel via strscpy(mddev->clevel, pers->name, ...) before calling pers->run(), making mddev->clevel a safe substitute for printing the personality name. Fixes: 36d091f4759d ("md: protect ->pers changes with mddev->lock") Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 643c8f1117c6..80d2bddb9e46 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -1307,7 +1307,7 @@ int md_check_no_bitmap(struct mddev *mddev) if (!mddev->bitmap_info.file && !mddev->bitmap_info.offset) return 0; pr_warn("%s: bitmaps are not supported for %s\n", - mdname(mddev), mddev->pers->name); + mdname(mddev), mddev->clevel); return 1; } EXPORT_SYMBOL(md_check_no_bitmap); -- 2.52.0

2 1

[PATCH OLK-5.10] nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
by Zhang Yuwei 28 Oct '26

28 Oct '26

From: Yang Xiuwei <yangxiuwei(a)kylinos.cn> mainline inclusion from mainline-v7.3-rc1 commit b53d495c7f0db46b6748b5ade48371a10dd5d3bc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19562 CVE: CVE-2026-90227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass flags and open_for_write through and reject disallowed commands with -EACCES. Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Yang Xiuwei <yangxiuwei(a)kylinos.cn> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/core.c [5.10 has no drivers/nvme/host/ioctl.c and no nvme_cmd_allowed() (both introduced by the 6.x nvme ioctl split), so nvme_submit_io() still lives in core.c without the fine-grained permission framework; add the equivalent capable(CAP_SYS_ADMIN) check used by the other passthrough ioctls in this file.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/nvme/host/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index c127c6a182a3..86b6c29a1bba 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -1596,6 +1596,9 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio) c.rw.apptag = cpu_to_le16(io.apptag); c.rw.appmask = cpu_to_le16(io.appmask); + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + return nvme_submit_user_cmd(ns->queue, &c, nvme_to_user_ptr(io.addr), length, metadata, meta_len, lower_32_bits(io.slba), NULL, 0); -- 2.22.0

2 1

[PATCH OLK-6.6] nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
by Zhang Yuwei 28 Oct '26

28 Oct '26

From: Yang Xiuwei <yangxiuwei(a)kylinos.cn> mainline inclusion from mainline-v7.3-rc1 commit b53d495c7f0db46b6748b5ade48371a10dd5d3bc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19562 CVE: CVE-2026-90227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass flags and open_for_write through and reject disallowed commands with -EACCES. Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Yang Xiuwei <yangxiuwei(a)kylinos.cn> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/core.c [5.10 has no drivers/nvme/host/ioctl.c and no nvme_cmd_allowed() (both introduced by the 6.x nvme ioctl split), so nvme_submit_io() still lives in core.c without the fine-grained permission framework; add the equivalent capable(CAP_SYS_ADMIN) check used by the other passthrough ioctls in this file.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/nvme/host/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index c127c6a182a3..86b6c29a1bba 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -1596,6 +1596,9 @@ static int nvme_submit_io(struct nvme_ns *ns, struct nvme_user_io __user *uio) c.rw.apptag = cpu_to_le16(io.apptag); c.rw.appmask = cpu_to_le16(io.appmask); + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; + return nvme_submit_user_cmd(ns->queue, &c, nvme_to_user_ptr(io.addr), length, metadata, meta_len, lower_32_bits(io.slba), NULL, 0); -- 2.22.0

2 1

[PATCH OLK-6.6] blk-mq: set RQF_USE_SCHED when the operation is known
by Zizhi Wo 27 Oct '26

27 Oct '26

From: Keith Busch <kbusch(a)kernel.org> stable inclusion from stable-v6.18.56 commit 790730e4d95de8356a573d4b4864486bba731863 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20493 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ab6c756f28c741d704a7c3e04814bfc3adf6f818 ] The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF_USE_SCHED cleared, so using those flags for a subsequent read/write bio will insert it into the scheduler without ->prepare_request() and frees it without ->finish_request(). For kyber, this leaks the domain token acquired at dispatch and stalls the queue. Don't set RQF_USE_SCHED based on the first operation the batch happened to be allocated for. Instead, set it after the request is claimed by an operation. Introduce a helper function, blk_mq_rq_late_init() for this, and absorb blk_mq_rq_time_init() since the two run together. Fixes: 4b6a5d9cea91 ("block: enable batched allocation for blk_mq_alloc_request()") Link: https://lore.kernel.org/linux-block/20260916151655.2588-1-15815827059@163.c… Reported-by: Henry Hu <huhai(a)kylinos.cn> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://patch.msgid.link/20260922172711.1573186-1-kbusch@meta.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- block/blk-mq.c | 64 +++++++++++++++++++++++++++++---------------- block/mq-deadline.c | 2 +- 2 files changed, 43 insertions(+), 23 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index ed2ddd17841b..9724e5bce3f0 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -398,20 +398,10 @@ static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data, INIT_LIST_HEAD(&rq->queuelist); /* tag was already set */ WRITE_ONCE(rq->deadline, 0); req_ref_set(rq, 1); - if (rq->rq_flags & RQF_USE_SCHED) { - struct elevator_queue *e = data->q->elevator; - - INIT_HLIST_NODE(&rq->hash); - RB_CLEAR_NODE(&rq->rb_node); - - if (e->type->ops.prepare_request) - e->type->ops.prepare_request(rq); - } - return rq; } static inline struct request * __blk_mq_alloc_requests_batch(struct blk_mq_alloc_data *data) @@ -442,10 +432,44 @@ __blk_mq_alloc_requests_batch(struct blk_mq_alloc_data *data) data->nr_tags -= nr; return rq_list_pop(data->cached_rq); } +static bool blk_op_bypass_sched(blk_opf_t opf) +{ + return (opf & REQ_OP_MASK) == REQ_OP_FLUSH || + blk_op_is_passthrough(opf); +} + +/* + * Finish initializing a request once it has been claimed for an operation. + * Cached requests are allocated before that operation is known. + */ +static void blk_mq_rq_late_init(struct request *rq, u64 alloc_time_ns) +{ + struct elevator_queue *e; + + if (!(rq->rq_flags & RQF_SCHED_TAGS) || (rq->rq_flags & RQF_RESV) || + blk_op_bypass_sched(rq->cmd_flags)) { + blk_mq_rq_time_init(rq, alloc_time_ns); + return; + } + + /* + * Set this before initializing the time stamps because + * blk_mq_rq_time_init() looks at RQF_USE_SCHED. + */ + rq->rq_flags |= RQF_USE_SCHED; + blk_mq_rq_time_init(rq, alloc_time_ns); + INIT_HLIST_NODE(&rq->hash); + RB_CLEAR_NODE(&rq->rb_node); + + e = rq->q->elevator; + if (e->type->ops.prepare_request) + e->type->ops.prepare_request(rq); +} + static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) { struct request_queue *q = data->q; u64 alloc_time_ns = 0; struct request *rq; @@ -471,17 +495,15 @@ static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) /* * Flush/passthrough requests are special and go directly to the * dispatch list. */ - if ((data->cmd_flags & REQ_OP_MASK) != REQ_OP_FLUSH && - !blk_op_is_passthrough(data->cmd_flags)) { + if (!blk_op_bypass_sched(data->cmd_flags)) { struct elevator_mq_ops *ops = &q->elevator->type->ops; WARN_ON_ONCE(data->flags & BLK_MQ_REQ_RESERVED); - data->rq_flags |= RQF_USE_SCHED; if (ops->limit_depth) ops->limit_depth(data->cmd_flags, data); } } else { blk_mq_tag_busy(data->hctx); @@ -494,11 +516,11 @@ static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) * Try batched alloc if we want more than 1 tag. */ if (data->nr_tags > 1) { rq = __blk_mq_alloc_requests_batch(data); if (rq) { - blk_mq_rq_time_init(rq, alloc_time_ns); + blk_mq_rq_late_init(rq, alloc_time_ns); return rq; } data->nr_tags = 1; } @@ -520,11 +542,11 @@ static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) msleep(3); goto retry; } rq = blk_mq_rq_ctx_init(data, blk_mq_tags_from_data(data), tag); - blk_mq_rq_time_init(rq, alloc_time_ns); + blk_mq_rq_late_init(rq, alloc_time_ns); return rq; } static struct request *blk_mq_rq_cache_fill(struct request_queue *q, struct blk_plug *plug, @@ -563,12 +585,10 @@ static struct request *blk_mq_alloc_cached_request(struct request_queue *q, if (rq_list_empty(plug->cached_rq)) { if (plug->nr_ios == 1) return NULL; rq = blk_mq_rq_cache_fill(q, plug, opf, flags); - if (!rq) - return NULL; } else { rq = rq_list_peek(&plug->cached_rq); if (!rq || rq->q != q) return NULL; @@ -576,15 +596,15 @@ static struct request *blk_mq_alloc_cached_request(struct request_queue *q, return NULL; if (op_is_flush(rq->cmd_flags) != op_is_flush(opf)) return NULL; plug->cached_rq = rq_list_next(rq); - blk_mq_rq_time_init(rq, 0); + rq->cmd_flags = opf; + INIT_LIST_HEAD(&rq->queuelist); + blk_mq_rq_late_init(rq, 0); } - rq->cmd_flags = opf; - INIT_LIST_HEAD(&rq->queuelist); return rq; } struct request *blk_mq_alloc_request(struct request_queue *q, blk_opf_t opf, blk_mq_req_flags_t flags) @@ -679,11 +699,11 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, ret = -EWOULDBLOCK; tag = blk_mq_get_tag(&data); if (tag == BLK_MQ_NO_TAG) goto out_queue_exit; rq = blk_mq_rq_ctx_init(&data, blk_mq_tags_from_data(&data), tag); - blk_mq_rq_time_init(rq, alloc_time_ns); + blk_mq_rq_late_init(rq, alloc_time_ns); rq->__data_len = 0; rq->__sector = (sector_t) -1; rq->bio = rq->biotail = NULL; return rq; @@ -3036,13 +3056,13 @@ static bool blk_mq_can_use_cached_rq(struct request *rq, struct blk_plug *plug, * before we throttle. */ plug->cached_rq = rq_list_next(rq); rq_qos_throttle(rq->q, bio); - blk_mq_rq_time_init(rq, 0); rq->cmd_flags = bio->bi_opf; INIT_LIST_HEAD(&rq->queuelist); + blk_mq_rq_late_init(rq, 0); return true; } /** * blk_mq_submit_bio - Create and send a request to block device. diff --git a/block/mq-deadline.c b/block/mq-deadline.c index a9cf8e19f9d1..433b9cecdb6c 100644 --- a/block/mq-deadline.c +++ b/block/mq-deadline.c @@ -906,11 +906,11 @@ static void dd_insert_requests(struct blk_mq_hw_ctx *hctx, rq_list_hierarchy_end_io_acct(&free, STAGE_DEADLINE); blk_mq_free_requests(&free); } -/* Callback from inside blk_mq_rq_ctx_init(). */ +/* Callback from inside blk_mq_rq_late_init(). */ static void dd_prepare_request(struct request *rq) { rq->elv.priv[0] = NULL; } -- 2.52.0

2 1

[PATCH OLK-6.6 v7 00/14] net: dynthread: dynamic threaded NAPI
by Cai Xinchen 27 Oct '26

27 Oct '26

This series makes the NAPI/queue/IRQ relationship visible to the network stack, backports the drivers and locking fixes it needs, and then builds net/dynthread on top of it: a loadable module that adapts the NAPI processing and the RX queue IRQ placement of a set of net devices to the scheduling behaviour of a target application at runtime. Motivation ---------- Interrupt and softirq processing of network RX competes with latency sensitive applications (e.g. mysqld) for CPU time. When such an application runs for a long time on a CPU without blocking, the softirq work of the NIC completion queues can preempt it on the same CPU and inflate its tail latency. The usual remedies are to steer the RX queue IRQs to other CPUs and/or to move NAPI processing into kernel threads bound to spare CPUs, but a static configuration cannot follow the application: once the target goes idle, is scheduled in short bursts, or is displaced, the reserved CPUs are simply wasted. To do this from a module, the queue a NAPI instance serves, the NAPI instance of a queue and the interrupt vector of that NAPI must be discoverable. Mainline added that association in v6.8/v6.9 (queue/NAPI pointer, netif_napi_set_irq(), mlx5e conversion) together with the RTNL fixes it requires. Patches 1-8 of this series backport that infrastructure, adapt it to the OLK KABI layout and fix the mlx5e lock ordering; patches 9-14 add the scheduler. Approach -------- The module periodically samples the scheduling statistics of all threads matching the appname module parameter and classifies them into one of five statuses (DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION, LONG_RUNNING_WITH_INTERRUPTS). Acting on that status it: - restores the RX queue IRQs to their original affinity when the target is gone or barely running; - spreads the IRQs over the NUMA node of their queues when processing in softirq context is acceptable again; - switches the NAPI processing of the configured net devices to kernel threads and binds the NAPI threads (and, optionally, the queue IRQs) to the CPUs of their NUMA node that the target tasks are not allowed to use; - scales the number of CPUs used by those threads with their measured load while the target stays in the long-running status. An unusable sample (counters moved backwards: DATA_LOSS) keeps the previous status, so a single bad sample cannot toggle the mode. Everything is controlled through module parameters, and the original IRQ affinity and NAPI mode are restored when the target disappears, the scheduler is disabled or the module is unloaded. The module is buildable only as a loadable module; the Kconfig entry currently allows ARM64 and it is enabled in the arm64 openeuler defconfig. Patch breakdown --------------- 1/14 net: Add queue and napi association Backport the queue <-> NAPI mapping: add enum netdev_queue_type, a napi pointer to struct netdev_queue and struct netdev_rx_queue, and netif_queue_set_napi() to set or clear it for RX and TX queues. The new netdev_queue field is put into reserve space so the layout of the structure is preserved. 2/14 net: fix KABI breakage for queue napi association Keep the struct layout stable across the backport: use the reserved domain segment of KABI 1 for netdev_queue and KABI 2 for netdev_rx_queue. 3/14 net: Add NAPI IRQ support Add napi->irq and netif_napi_set_irq(), so a driver can publish the interrupt vector that serves a NAPI instance. It is initialized to -1 by netif_napi_add_weight() and stays unknown for drivers that do not call the setter. The ice and netdev-genl/netlink parts of the upstream patch are not needed here and are dropped. 4/14 net: Fix napi irq KABI breakage Store napi->irq in the reserved domain segment of KABI 1 so that the napi_struct layout does not change. 5/14 net/mlx5e: link NAPI instances to queues and IRQs Make mlx5e call netif_napi_set_irq() when a channel is opened and register/clear the queue/NAPI association for its RX and TX queues (including the PTP queues) when they are activated/deactivated. This is also what users of the queue GET netlink API expect. 6/14 net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation netif_queue_set_napi() asserts RTNL for a registered netdev, so take the lock in the mlx5e TX reporter recovery paths that activate or deactivate queues without it. 7/14 net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover The RTNL has to be acquired before priv->state_lock in the PTP SQ recovery. Move the lock acquisition up so the order matches the probe and channel switch paths. 8/14 net/mlx5e: Do not block on RTNL while recovering an SQ The recovery callbacks run synchronously from devlink_health_report() under the devlink lock, from SQ work items, while channel teardown holds the RTNL and waits for those work items with cancel_work_sync(). Replace the blocking rtnl_lock() with rtnl_trylock() and abandon the recovery when the SQ has been disabled by the teardown, following the existing mlx5e_tx_timeout_work() pattern. This avoids a deadlock that also stalled all devlink operations on the device. 9/14 net: dynthread: Add dynamic threaded NAPI scheduler framework Wire the new directory into net/Kconfig and net/Makefile, add the NET_DYNTHREAD Kconfig entry (ARM64, module only) and the module skeleton. On load the module takes a reference on each device given with the '#' separated ifname parameter, walks the IRQ descriptor table through the exported irq_get_irq_data(), snapshots desc->action and the effective affinity under desc->lock, and records the IRQ number and the original affinity CPU of every RX queue. IRQs are matched against the device name, its parent device name and the irqname pattern. Also count the NUMA nodes the recorded queues span, drop the device references on unload, and unwind a partially failed init. 10/14 net: dynthread: Monitor the load of the target tasks Add the sampling loop and the status judgement. Every dyn_threaded_interval ms, every monitored thread whose name matches appname contributes its runtime, voluntary/involuntary context switches and its allowed CPU mask; the masks are unioned to know where the target may run. The sample is compared with the previous one to derive the average runtime per switch, the nvcsw percentage and the CPU load, and to classify it as DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION or LONG_RUNNING_WITH_INTERRUPTS. Add the periodic hrtimer/work worker, the dynthreaded enable/disable parameter, a mutex serializing the worker control, a zeroed baseline on every enable, and the last_status tracking used to carry the transition sample. 11/14 net: dynthread: Steer the RX queue IRQs away from the target tasks Manage the affinity of the recorded RX queue IRQs. When the target tasks sit in a single NUMA node and enough CPUs of that node are free, move all queue IRQs there round-robin; when the target is gone or barely running, restore the affinity recorded at load time; when the target is fragmented, spread the IRQs over a subset of their own NUMA node sized from dyn_threaded_irq_cpucore_per. Track the "bound to one node" state so spreading is suppressed while it is active, and clear it on every recovery. All of this is skipped when dyn_threaded_bindirq is off, and the IRQ affinity is restored when the worker is stopped. 12/14 net: dynthread: Switch NAPI to threads on spare CPUs Enable threaded NAPI (dev_set_threaded) on the monitored devices in LONG_RUNNING_WITH_INTERRUPTS and bind each NAPI thread from the NUMA node of its queue IRQ: use the whole node if the target is not there, the target-free CPUs of the node if any, otherwise the first dyn_threaded_corenum CPUs of the node. Use napi->irq when the driver published it and fall back to the RX queue IRQ recorded by the module (e.g. hns3) otherwise. The NAPI list is built by head insertion, so it is walked in reverse to visit the NAPIs in registration (vector) order, matching the ascending order in which the RX queue IRQs are recorded. Optionally bind the queue IRQ to the same mask. Record the CPUs used by the NAPI threads in napi_cpumask for the load evaluation of the next patch. Switch the devices back to softirq mode in NO_TASK, NOT_RUNNING and FRAGMENTATION, when the scheduler is disabled and on module unload; the NAPI and IRQ operations run under the rtnetlink lock. 13/14 net: dynthread: Scale the number of NAPI thread CPUs Sample the kernel_cpustat of the CPUs used by the NAPI threads and compare consecutive periods. Grow dyn_threaded_corenum when the irq/softirq share or the total load of those CPUs is too high, and shrink it when the user share is high or the total load is low, within the lower/upper limit parameters. Damping and anti-fight rules avoid oscillating right after a change or undoing a change made for the opposite reason; the two total-load driven directions check each other, and the cpustat baseline is taken over the mask that was actually just bound. The default core count is computed at init from the busiest device's RX queue count divided by the online NUMA nodes. The lower/upper limit parameters reject zero and an inverted range, refuse a change that would move the computed default out of range, and clamp the current core count into the new range. Reset the damping state and the baseline when leaving the long-running status or when the scheduler is stopped, and serialize the core-count updates with the module parameter setter. 14/14 net: dynthread: Add debug switch and instrumentation Add the dyn_threaded_debug module parameter and instrument the periodic sampling, the status transitions, the IRQ affinity decisions, the NAPI thread masks and the CPU-count resizes. The messages are recorded with trace_printk() so they can be read from tracefs without flooding the console; without tracing support they fall back to dynamic debug. The switch is off by default. Amritha Nambiar (2): net: Add queue and napi association net: Add NAPI IRQ support Cai Xinchen (7): net/mlx5e: Do not block on RTNL while recovering an SQ net: dynthread: Add dynamic threaded NAPI scheduler framework net: dynthread: Monitor the load of the target tasks net: dynthread: Steer the RX queue IRQs away from the target tasks net: dynthread: Switch NAPI to threads on spare CPUs net: dynthread: Scale the number of NAPI thread CPUs net: dynthread: Add debug switch and instrumentation Carolina Jubran (1): net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation Cosmin Ratiu (1): net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover JiangJieHua (2): net: fix KABI breakage for queue napi association net: Fix napi irq KABI breakage Joe Damato (1): net/mlx5e: link NAPI instances to queues and IRQs arch/arm64/configs/openeuler_defconfig | 1 + .../net/ethernet/mellanox/mlx5/core/en/ptp.c | 5 +- .../mellanox/mlx5/core/en/reporter_tx.c | 23 + .../net/ethernet/mellanox/mlx5/core/en_main.c | 7 + include/linux/netdevice.h | 21 +- include/net/netdev_rx_queue.h | 2 +- net/Kconfig | 1 + net/Makefile | 1 + net/core/dev.c | 38 + net/dynthread/Kconfig | 13 + net/dynthread/Makefile | 2 + net/dynthread/net_dynthread.c | 1587 +++++++++++++++++ 12 files changed, 1697 insertions(+), 4 deletions(-) create mode 100644 net/dynthread/Kconfig create mode 100644 net/dynthread/Makefile create mode 100644 net/dynthread/net_dynthread.c -- 2.18.0.huawei.25

2 15

[PATCH OLK-6.6 v6 00/14] net: dynthread: dynamic threaded NAPI
by Cai Xinchen 27 Oct '26

27 Oct '26

This series makes the NAPI/queue/IRQ relationship visible to the network stack, backports the drivers and locking fixes it needs, and then builds net/dynthread on top of it: a loadable module that adapts the NAPI processing and the RX queue IRQ placement of a set of net devices to the scheduling behaviour of a target application at runtime. Motivation ---------- Interrupt and softirq processing of network RX competes with latency sensitive applications (e.g. mysqld) for CPU time. When such an application runs for a long time on a CPU without blocking, the softirq work of the NIC completion queues can preempt it on the same CPU and inflate its tail latency. The usual remedies are to steer the RX queue IRQs to other CPUs and/or to move NAPI processing into kernel threads bound to spare CPUs, but a static configuration cannot follow the application: once the target goes idle, is scheduled in short bursts, or is displaced, the reserved CPUs are simply wasted. To do this from a module, the queue a NAPI instance serves, the NAPI instance of a queue and the interrupt vector of that NAPI must be discoverable. Mainline added that association in v6.8/v6.9 (queue/NAPI pointer, netif_napi_set_irq(), mlx5e conversion) together with the RTNL fixes it requires. Patches 1-8 of this series backport that infrastructure, adapt it to the OLK KABI layout and fix the mlx5e lock ordering; patches 9-14 add the scheduler. Approach -------- The module periodically samples the scheduling statistics of all threads matching the appname module parameter and classifies them into one of five statuses (DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION, LONG_RUNNING_WITH_INTERRUPTS). Acting on that status it: - restores the RX queue IRQs to their original affinity when the target is gone or barely running; - spreads the IRQs over the NUMA node of their queues when processing in softirq context is acceptable again; - switches the NAPI processing of the configured net devices to kernel threads and binds the NAPI threads (and, optionally, the queue IRQs) to the CPUs of their NUMA node that the target tasks are not allowed to use; - scales the number of CPUs used by those threads with their measured load while the target stays in the long-running status. An unusable sample (counters moved backwards: DATA_LOSS) keeps the previous status, so a single bad sample cannot toggle the mode. Everything is controlled through module parameters, and the original IRQ affinity and NAPI mode are restored when the target disappears, the scheduler is disabled or the module is unloaded. The module is buildable only as a loadable module; the Kconfig entry currently allows ARM64 and it is enabled in the arm64 openeuler defconfig. Patch breakdown --------------- 1/14 net: Add queue and napi association Backport the queue <-> NAPI mapping: add enum netdev_queue_type, a napi pointer to struct netdev_queue and struct netdev_rx_queue, and netif_queue_set_napi() to set or clear it for RX and TX queues. The new netdev_queue field is put into reserve space so the layout of the structure is preserved. 2/14 net: fix KABI breakage for queue napi association Keep the struct layout stable across the backport: use the reserved domain segment of KABI 1 for netdev_queue and KABI 2 for netdev_rx_queue. 3/14 net: Add NAPI IRQ support Add napi->irq and netif_napi_set_irq(), so a driver can publish the interrupt vector that serves a NAPI instance. It is initialized to -1 by netif_napi_add_weight() and stays unknown for drivers that do not call the setter. The ice and netdev-genl/netlink parts of the upstream patch are not needed here and are dropped. 4/14 net: Fix napi irq KABI breakage Store napi->irq in the reserved domain segment of KABI 1 so that the napi_struct layout does not change. 5/14 net/mlx5e: link NAPI instances to queues and IRQs Make mlx5e call netif_napi_set_irq() when a channel is opened and register/clear the queue/NAPI association for its RX and TX queues (including the PTP queues) when they are activated/deactivated. This is also what users of the queue GET netlink API expect. 6/14 net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation netif_queue_set_napi() asserts RTNL for a registered netdev, so take the lock in the mlx5e TX reporter recovery paths that activate or deactivate queues without it. 7/14 net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover The RTNL has to be acquired before priv->state_lock in the PTP SQ recovery. Move the lock acquisition up so the order matches the probe and channel switch paths. 8/14 net/mlx5e: Do not block on RTNL while recovering an SQ The recovery callbacks run synchronously from devlink_health_report() under the devlink lock, from SQ work items, while channel teardown holds the RTNL and waits for those work items with cancel_work_sync(). Replace the blocking rtnl_lock() with rtnl_trylock() and abandon the recovery when the SQ has been disabled by the teardown, following the existing mlx5e_tx_timeout_work() pattern. This avoids a deadlock that also stalled all devlink operations on the device. 9/14 net: dynthread: Add dynamic threaded NAPI scheduler framework Wire the new directory into net/Kconfig and net/Makefile, add the NET_DYNTHREAD Kconfig entry (ARM64, module only) and the module skeleton. On load the module takes a reference on each device given with the '#' separated ifname parameter, walks the IRQ descriptor table through the exported irq_get_irq_data(), snapshots desc->action and the effective affinity under desc->lock, and records the IRQ number and the original affinity CPU of every RX queue. IRQs are matched against the device name, its parent device name and the irqname pattern. Also count the NUMA nodes the recorded queues span, drop the device references on unload, and unwind a partially failed init. 10/14 net: dynthread: Monitor the load of the target tasks Add the sampling loop and the status judgement. Every dyn_threaded_interval ms, every monitored thread whose name matches appname contributes its runtime, voluntary/involuntary context switches and its allowed CPU mask; the masks are unioned to know where the target may run. The sample is compared with the previous one to derive the average runtime per switch, the nvcsw percentage and the CPU load, and to classify it as DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION or LONG_RUNNING_WITH_INTERRUPTS. Add the periodic hrtimer/work worker, the dynthreaded enable/disable parameter, a mutex serializing the worker control, a zeroed baseline on every enable, and the last_status tracking used to carry the transition sample. 11/14 net: dynthread: Steer the RX queue IRQs away from the target tasks Manage the affinity of the recorded RX queue IRQs. When the target tasks sit in a single NUMA node and enough CPUs of that node are free, move all queue IRQs there round-robin; when the target is gone or barely running, restore the affinity recorded at load time; when the target is fragmented, spread the IRQs over a subset of their own NUMA node sized from dyn_threaded_irq_cpucore_per. Track the "bound to one node" state so spreading is suppressed while it is active, and clear it on every recovery. All of this is skipped when dyn_threaded_bindirq is off, and the IRQ affinity is restored when the worker is stopped. 12/14 net: dynthread: Switch NAPI to threads on spare CPUs Enable threaded NAPI (dev_set_threaded) on the monitored devices in LONG_RUNNING_WITH_INTERRUPTS and bind each NAPI thread from the NUMA node of its queue IRQ: use the whole node if the target is not there, the target-free CPUs of the node if any, otherwise the first dyn_threaded_corenum CPUs of the node. Use napi->irq when the driver published it and fall back to the RX queue IRQ recorded by the module (e.g. hns3) otherwise. The NAPI list is built by head insertion, so it is walked in reverse to visit the NAPIs in registration (vector) order, matching the ascending order in which the RX queue IRQs are recorded. Optionally bind the queue IRQ to the same mask. Record the CPUs used by the NAPI threads in napi_cpumask for the load evaluation of the next patch. Switch the devices back to softirq mode in NO_TASK, NOT_RUNNING and FRAGMENTATION, when the scheduler is disabled and on module unload; the NAPI and IRQ operations run under the rtnetlink lock. 13/14 net: dynthread: Scale the number of NAPI thread CPUs Sample the kernel_cpustat of the CPUs used by the NAPI threads and compare consecutive periods. Grow dyn_threaded_corenum when the irq/softirq share or the total load of those CPUs is too high, and shrink it when the user share is high or the total load is low, within the lower/upper limit parameters. Damping and anti-fight rules avoid oscillating right after a change or undoing a change made for the opposite reason; the two total-load driven directions check each other, and the cpustat baseline is taken over the mask that was actually just bound. The default core count is computed at init from the busiest device's RX queue count divided by the online NUMA nodes. The lower/upper limit parameters reject zero and an inverted range, refuse a change that would move the computed default out of range, and clamp the current core count into the new range. Reset the damping state and the baseline when leaving the long-running status or when the scheduler is stopped, and serialize the core-count updates with the module parameter setter. 14/14 net: dynthread: Add debug switch and instrumentation Add the dyn_threaded_debug module parameter and instrument the periodic sampling, the status transitions, the IRQ affinity decisions, the NAPI thread masks and the CPU-count resizes. The messages are recorded with trace_printk() so they can be read from tracefs without flooding the console; without tracing support they fall back to dynamic debug. The switch is off by default. Amritha Nambiar (2): net: Add queue and napi association net: Add NAPI IRQ support Cai Xinchen (7): net/mlx5e: Do not block on RTNL while recovering an SQ net: dynthread: Add dynamic threaded NAPI scheduler framework net: dynthread: Monitor the load of the target tasks net: dynthread: Steer the RX queue IRQs away from the target tasks net: dynthread: Switch NAPI to threads on spare CPUs net: dynthread: Scale the number of NAPI thread CPUs net: dynthread: Add debug switch and instrumentation Carolina Jubran (1): net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation Cosmin Ratiu (1): net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover JiangJieHua (2): net: fix KABI breakage for queue napi association net: Fix napi irq KABI breakage Joe Damato (1): net/mlx5e: link NAPI instances to queues and IRQs arch/arm64/configs/openeuler_defconfig | 1 + .../net/ethernet/mellanox/mlx5/core/en/ptp.c | 5 +- .../mellanox/mlx5/core/en/reporter_tx.c | 23 + .../net/ethernet/mellanox/mlx5/core/en_main.c | 7 + include/linux/netdevice.h | 21 +- include/net/netdev_rx_queue.h | 2 +- net/Kconfig | 1 + net/Makefile | 1 + net/core/dev.c | 38 + net/dynthread/Kconfig | 13 + net/dynthread/Makefile | 2 + net/dynthread/net_dynthread.c | 1587 +++++++++++++++++ 12 files changed, 1697 insertions(+), 4 deletions(-) create mode 100644 net/dynthread/Kconfig create mode 100644 net/dynthread/Makefile create mode 100644 net/dynthread/net_dynthread.c -- 2.18.0.huawei.25

2 15

[PATCH OLK-6.6] blk-mq: set RQF_USE_SCHED when the operation is known
by Zizhi Wo 27 Oct '26

27 Oct '26

From: Keith Busch <kbusch(a)kernel.org> stable inclusion from stable-v6.18.56 commit 790730e4d95de8356a573d4b4864486bba731863 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20493 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ab6c756f28c741d704a7c3e04814bfc3adf6f818 ] The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQF_USE_SCHED cleared, so using those flags for a subsequent read/write bio will insert it into the scheduler without ->prepare_request() and frees it without ->finish_request(). For kyber, this leaks the domain token acquired at dispatch and stalls the queue. Don't set RQF_USE_SCHED based on the first operation the batch happened to be allocated for. Instead, set it after the request is claimed by an operation. Introduce a helper function, blk_mq_rq_late_init() for this, and absorb blk_mq_rq_time_init() since the two run together. Fixes: 4b6a5d9cea91 ("block: enable batched allocation for blk_mq_alloc_request()") Link: https://lore.kernel.org/linux-block/20260916151655.2588-1-15815827059@163.c… Reported-by: Henry Hu <huhai(a)kylinos.cn> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://patch.msgid.link/20260922172711.1573186-1-kbusch@meta.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- block/blk-mq.c | 59 ++++++++++++++++++++++++++++----------------- block/mq-deadline.c | 2 +- 2 files changed, 38 insertions(+), 23 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index ed2ddd17841b..e3de61a1a874 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -398,20 +398,10 @@ static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data, INIT_LIST_HEAD(&rq->queuelist); /* tag was already set */ WRITE_ONCE(rq->deadline, 0); req_ref_set(rq, 1); - if (rq->rq_flags & RQF_USE_SCHED) { - struct elevator_queue *e = data->q->elevator; - - INIT_HLIST_NODE(&rq->hash); - RB_CLEAR_NODE(&rq->rb_node); - - if (e->type->ops.prepare_request) - e->type->ops.prepare_request(rq); - } - return rq; } static inline struct request * __blk_mq_alloc_requests_batch(struct blk_mq_alloc_data *data) @@ -442,10 +432,39 @@ __blk_mq_alloc_requests_batch(struct blk_mq_alloc_data *data) data->nr_tags -= nr; return rq_list_pop(data->cached_rq); } +static bool blk_op_bypass_sched(blk_opf_t opf) +{ + return (opf & REQ_OP_MASK) == REQ_OP_FLUSH || + blk_op_is_passthrough(opf); +} + +/* + * Finish initializing a request once it has been claimed for an operation. + * Cached requests are allocated before that operation is known. + */ +static void blk_mq_rq_late_init(struct request *rq, u64 alloc_time_ns) +{ + struct elevator_queue *e; + + blk_mq_rq_time_init(rq, alloc_time_ns); + + if (!(rq->rq_flags & RQF_SCHED_TAGS) || (rq->rq_flags & RQF_RESV) || + blk_op_bypass_sched(rq->cmd_flags)) + return; + + rq->rq_flags |= RQF_USE_SCHED; + INIT_HLIST_NODE(&rq->hash); + RB_CLEAR_NODE(&rq->rb_node); + + e = rq->q->elevator; + if (e->type->ops.prepare_request) + e->type->ops.prepare_request(rq); +} + static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) { struct request_queue *q = data->q; u64 alloc_time_ns = 0; struct request *rq; @@ -471,17 +490,15 @@ static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) /* * Flush/passthrough requests are special and go directly to the * dispatch list. */ - if ((data->cmd_flags & REQ_OP_MASK) != REQ_OP_FLUSH && - !blk_op_is_passthrough(data->cmd_flags)) { + if (!blk_op_bypass_sched(data->cmd_flags)) { struct elevator_mq_ops *ops = &q->elevator->type->ops; WARN_ON_ONCE(data->flags & BLK_MQ_REQ_RESERVED); - data->rq_flags |= RQF_USE_SCHED; if (ops->limit_depth) ops->limit_depth(data->cmd_flags, data); } } else { blk_mq_tag_busy(data->hctx); @@ -494,11 +511,11 @@ static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) * Try batched alloc if we want more than 1 tag. */ if (data->nr_tags > 1) { rq = __blk_mq_alloc_requests_batch(data); if (rq) { - blk_mq_rq_time_init(rq, alloc_time_ns); + blk_mq_rq_late_init(rq, alloc_time_ns); return rq; } data->nr_tags = 1; } @@ -520,11 +537,11 @@ static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) msleep(3); goto retry; } rq = blk_mq_rq_ctx_init(data, blk_mq_tags_from_data(data), tag); - blk_mq_rq_time_init(rq, alloc_time_ns); + blk_mq_rq_late_init(rq, alloc_time_ns); return rq; } static struct request *blk_mq_rq_cache_fill(struct request_queue *q, struct blk_plug *plug, @@ -563,12 +580,10 @@ static struct request *blk_mq_alloc_cached_request(struct request_queue *q, if (rq_list_empty(plug->cached_rq)) { if (plug->nr_ios == 1) return NULL; rq = blk_mq_rq_cache_fill(q, plug, opf, flags); - if (!rq) - return NULL; } else { rq = rq_list_peek(&plug->cached_rq); if (!rq || rq->q != q) return NULL; @@ -576,15 +591,15 @@ static struct request *blk_mq_alloc_cached_request(struct request_queue *q, return NULL; if (op_is_flush(rq->cmd_flags) != op_is_flush(opf)) return NULL; plug->cached_rq = rq_list_next(rq); - blk_mq_rq_time_init(rq, 0); + rq->cmd_flags = opf; + INIT_LIST_HEAD(&rq->queuelist); + blk_mq_rq_late_init(rq, 0); } - rq->cmd_flags = opf; - INIT_LIST_HEAD(&rq->queuelist); return rq; } struct request *blk_mq_alloc_request(struct request_queue *q, blk_opf_t opf, blk_mq_req_flags_t flags) @@ -679,11 +694,11 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, ret = -EWOULDBLOCK; tag = blk_mq_get_tag(&data); if (tag == BLK_MQ_NO_TAG) goto out_queue_exit; rq = blk_mq_rq_ctx_init(&data, blk_mq_tags_from_data(&data), tag); - blk_mq_rq_time_init(rq, alloc_time_ns); + blk_mq_rq_late_init(rq, alloc_time_ns); rq->__data_len = 0; rq->__sector = (sector_t) -1; rq->bio = rq->biotail = NULL; return rq; @@ -3036,13 +3051,13 @@ static bool blk_mq_can_use_cached_rq(struct request *rq, struct blk_plug *plug, * before we throttle. */ plug->cached_rq = rq_list_next(rq); rq_qos_throttle(rq->q, bio); - blk_mq_rq_time_init(rq, 0); rq->cmd_flags = bio->bi_opf; INIT_LIST_HEAD(&rq->queuelist); + blk_mq_rq_late_init(rq, 0); return true; } /** * blk_mq_submit_bio - Create and send a request to block device. diff --git a/block/mq-deadline.c b/block/mq-deadline.c index a9cf8e19f9d1..433b9cecdb6c 100644 --- a/block/mq-deadline.c +++ b/block/mq-deadline.c @@ -906,11 +906,11 @@ static void dd_insert_requests(struct blk_mq_hw_ctx *hctx, rq_list_hierarchy_end_io_acct(&free, STAGE_DEADLINE); blk_mq_free_requests(&free); } -/* Callback from inside blk_mq_rq_ctx_init(). */ +/* Callback from inside blk_mq_rq_late_init(). */ static void dd_prepare_request(struct request *rq) { rq->elv.priv[0] = NULL; } -- 2.52.0

2 1

[PATCH OLK-6.6] iommu/io-pgtable-arm: Add support for contiguous hint
by Zhang Yuwei 27 Oct '26

27 Oct '26

maillist inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8788 ------------------------------------------------------------- Add support for the contiguous hint (CONT) bit in ARM LPAE page tables, following the community v5 mapping and unmapping approach. Keep CONT disabled by default. SMMU drivers opt in with IO_PGTABLE_QUIRK_ARM_CONT_HINT (BIT(12)) before allocating page tables. Mali continues to reject quirks and never advertises CONT sizes. Derive CONT sizes from the architecture-valid base page-size bitmap, guard expansion against overflow, and constrain the result by IAS/OAS. Keep sizes which exactly span the configured address space. Only tag descriptors when the caller selects an advertised CONT size. Do not promote aligned runs of ordinary page mappings internally. Bound the number of groups before converting them to descriptor counts. Check the first and last descriptors of the current unmap batch before clearing PTEs or freeing sub-tables. Reject a partial CONT group with no changes to that batch. Earlier batches in an iommu_unmap() request may already have completed; this is not a whole-request atomicity guarantee. Unlike the community baseline, OLK 6.6 supports splitting leaf blocks on partial unmap. Reject CONT-tagged blocks before entering that path while preserving splitting for ordinary blocks. Suggested-by: Robin Murphy <robin.murphy(a)arm.com> Co-developed-by: Vijayanand Jitta <vijayanand.jitta(a)oss.qualcomm.com> Signed-off-by: Vijayanand Jitta <vijayanand.jitta(a)oss.qualcomm.com> Signed-off-by: Prakash Gupta <prakash.gupta(a)oss.qualcomm.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/io-pgtable-arm.c | 195 ++++++++++++++++++++++++++++++--- include/linux/io-pgtable.h | 4 + 2 files changed, 184 insertions(+), 15 deletions(-) diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index aecd5939e7b2..22c589b0aa54 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -93,6 +93,16 @@ /* Software bit for solving coherency races */ #define ARM_LPAE_PTE_SW_SYNC (((arm_lpae_iopte)1) << 55) +/* PTE Contiguous Bit */ +#define ARM_LPAE_PTE_CONT (((arm_lpae_iopte)1) << 52) + +/* + * Granule CONT page Block CONT block L1 block CONT L1 + * 4K 64K 2M 32M 1G 16G + * 16K 2M 32M 1G + * 64K 2M 512M 16G + */ + /* Stage-1 PTE */ #define ARM_LPAE_PTE_AP_UNPRIV (((arm_lpae_iopte)1) << 6) #define ARM_LPAE_PTE_AP_RDONLY_BIT 7 @@ -408,6 +418,24 @@ static arm_lpae_iopte arm_lpae_install_table(arm_lpae_iopte *table, return old; } +static int arm_lpae_num_cont(size_t size) +{ + switch (size) { + case SZ_4K: + case SZ_2M: + case SZ_1G: + return 16; + case SZ_64K: + case SZ_32M: + case SZ_512M: + return 32; + case SZ_16K: + return 128; + default: + return 1; + } +} + static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, phys_addr_t paddr, size_t size, size_t pgcount, arm_lpae_iopte prot, int lvl, arm_lpae_iopte *ptep, @@ -417,19 +445,40 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, size_t block_size = ARM_LPAE_BLOCK_SIZE(lvl, data); size_t tblsz = ARM_LPAE_GRANULE(data); struct io_pgtable_cfg *cfg = &data->iop.cfg; - int ret = 0, num_entries, max_entries, map_idx_start; + int num_cont = arm_lpae_num_cont(block_size); + size_t cont_size = 0, entries_per_map; + int num_entries, max_entries, map_idx_start; + + if (num_cont > 1 && block_size <= SIZE_MAX / num_cont) + cont_size = num_cont * block_size; /* Find our entry at the current level */ map_idx_start = ARM_LPAE_LVL_IDX(iova, lvl, data); ptep += map_idx_start; /* If we can install a leaf entry at this level, then do so */ - if (size == block_size) { + if (size == block_size || + ((cfg->quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT) && + size == cont_size)) { + bool cont = size == cont_size; + int ret; + + if (cont && (!IS_ALIGNED(iova, size) || !IS_ALIGNED(paddr, size))) + return -EINVAL; + + entries_per_map = size / block_size; max_entries = arm_lpae_max_entries(map_idx_start, data); - num_entries = min_t(int, pgcount, max_entries); - ret = arm_lpae_init_pte(data, iova, paddr, prot, lvl, num_entries, ptep); + num_entries = min_t(size_t, pgcount, + max_entries / entries_per_map) * entries_per_map; + if (!num_entries) + return -EINVAL; + if (cont) + prot |= ARM_LPAE_PTE_CONT; + + ret = arm_lpae_init_pte(data, iova, paddr, prot, lvl, num_entries, + ptep); if (!ret) - *mapped += num_entries * size; + *mapped += num_entries * block_size; return ret; } @@ -683,12 +732,19 @@ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data, { arm_lpae_iopte pte; struct io_pgtable *iop = &data->iop; + size_t block_size, cont_size = 0, entries_per_map; + int num_cont; int i = 0, num_entries, max_entries, unmap_idx_start; /* Something went horribly wrong and we ran out of page table */ if (WARN_ON(lvl == ARM_LPAE_MAX_LEVELS)) return 0; + block_size = ARM_LPAE_BLOCK_SIZE(lvl, data); + num_cont = arm_lpae_num_cont(block_size); + if (num_cont > 1 && block_size <= SIZE_MAX / num_cont) + cont_size = num_cont * block_size; + unmap_idx_start = ARM_LPAE_LVL_IDX(iova, lvl, data); ptep += unmap_idx_start; pte = READ_ONCE(*ptep); @@ -696,9 +752,24 @@ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data, return 0; /* If the size matches this level, we're in the right place */ - if (size == ARM_LPAE_BLOCK_SIZE(lvl, data)) { + if (size == block_size || + ((iop->cfg.quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT) && + size == cont_size)) { + entries_per_map = size / block_size; max_entries = arm_lpae_max_entries(unmap_idx_start, data); - num_entries = min_t(int, pgcount, max_entries); + num_entries = min_t(size_t, pgcount, + max_entries / entries_per_map) * entries_per_map; + if (!num_entries) + return 0; + + /* Check this batch before clearing PTEs or freeing sub-tables. */ + if (((pte & ARM_LPAE_PTE_CONT) && + !IS_ALIGNED(iova, cont_size)) || + ((READ_ONCE(ptep[num_entries - 1]) & ARM_LPAE_PTE_CONT) && + !IS_ALIGNED(iova + num_entries * block_size, cont_size))) { + WARN_ON_ONCE(1); + return 0; + } while (i < num_entries) { pte = READ_ONCE(*ptep); @@ -709,19 +780,33 @@ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data, if (!iopte_leaf(pte, lvl, iop->fmt)) { /* Also flush any partial walks */ - io_pgtable_tlb_flush_walk(iop, iova + i * size, size, - ARM_LPAE_GRANULE(data)); + io_pgtable_tlb_flush_walk(iop, iova + i * block_size, + block_size, ARM_LPAE_GRANULE(data)); __arm_lpae_free_pgtable(data, lvl + 1, iopte_deref(pte, data)); } else if (!iommu_iotlb_gather_queued(gather)) { - io_pgtable_tlb_add_page(iop, gather, iova + i * size, size); + unsigned long end = iova + (i + 1) * block_size; + + if (pte & ARM_LPAE_PTE_CONT) { + /* Add a complete group after its last PTE is cleared. */ + if (IS_ALIGNED(end, cont_size)) + io_pgtable_tlb_add_page(iop, gather, + end - cont_size, cont_size); + } else { + io_pgtable_tlb_add_page(iop, gather, + end - block_size, + block_size); + } } ptep++; i++; } - return i * size; + return i * block_size; } else if (iopte_leaf(pte, lvl, iop->fmt)) { + /* Never split a block that belongs to a CONT group. */ + if (WARN_ON_ONCE(pte & ARM_LPAE_PTE_CONT)) + return 0; /* * Insert a table at the next level to map the old region, * minus the part we want to unmap @@ -856,6 +941,9 @@ static size_t __arm_lpae_split_block(struct arm_lpae_io_pgtable *data, if (size == ARM_LPAE_BLOCK_SIZE(lvl, data)) { if (iopte_leaf(pte, lvl, iop->fmt)) { + /* Splitting one member would invalidate the CONT group. */ + if (WARN_ON_ONCE(pte & ARM_LPAE_PTE_CONT)) + return 0; if (lvl == (ARM_LPAE_MAX_LEVELS - 1) || (pte & ARM_LPAE_PTE_AP_RDONLY)) return size; @@ -919,18 +1007,34 @@ static size_t __arm_lpae_merge_page(struct arm_lpae_io_pgtable *data, arm_lpae_iopte pte, *tablep; struct io_pgtable *iop = &data->iop; struct io_pgtable_cfg *cfg = &data->iop.cfg; + int idx, num_cont, i; if (WARN_ON(lvl == ARM_LPAE_MAX_LEVELS)) return 0; - ptep += ARM_LPAE_LVL_IDX(iova, lvl, data); + idx = ARM_LPAE_LVL_IDX(iova, lvl, data); + ptep += idx; pte = READ_ONCE(*ptep); if (WARN_ON(!pte)) return 0; if (size == ARM_LPAE_BLOCK_SIZE(lvl, data)) { - if (iopte_leaf(pte, lvl, iop->fmt)) + if (iopte_leaf(pte, lvl, iop->fmt)) { + if (WARN_ON_ONCE(pte & ARM_LPAE_PTE_CONT)) + return 0; return size; + } + + /* Do not replace a table inside a partially split CONT group. */ + num_cont = arm_lpae_num_cont(size); + if ((cfg->quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT) && num_cont > 1) { + arm_lpae_iopte *group = ptep - (idx % num_cont); + + for (i = 0; i < num_cont; i++) { + if (WARN_ON_ONCE(READ_ONCE(group[i]) & ARM_LPAE_PTE_CONT)) + return 0; + } + } /* Race does not exist */ if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_BBML1) { @@ -1004,6 +1108,24 @@ static int __arm_lpae_sync_dirty_log(struct arm_lpae_io_pgtable *data, if (WARN_ON(lvl == ARM_LPAE_MAX_LEVELS)) return -EINVAL; + /* A CONT-sized request can cover several leaves at this level. */ + next_size = ARM_LPAE_BLOCK_SIZE(lvl, data); + if (size > next_size) { + if (!IS_ALIGNED(size, next_size) || + size / next_size > + arm_lpae_max_entries(ARM_LPAE_LVL_IDX(iova, lvl, data), data)) + return -EINVAL; + + for (base = 0; base < size; base += next_size) { + ret = __arm_lpae_sync_dirty_log(data, iova + base, + next_size, lvl, ptep, bitmap, + base_iova, bitmap_pgshift); + if (ret) + return ret; + } + return 0; + } + ptep += ARM_LPAE_LVL_IDX(iova, lvl, data); pte = READ_ONCE(*ptep); if (WARN_ON(!pte)) @@ -1089,6 +1211,27 @@ static int __arm_lpae_clear_dirty_log(struct arm_lpae_io_pgtable *data, size_t base, next_size; int nbits, ret, i; + if (WARN_ON(lvl == ARM_LPAE_MAX_LEVELS)) + return -EINVAL; + + /* A CONT-sized request can cover several leaves at this level. */ + next_size = ARM_LPAE_BLOCK_SIZE(lvl, data); + if (size > next_size) { + if (!IS_ALIGNED(size, next_size) || + size / next_size > + arm_lpae_max_entries(ARM_LPAE_LVL_IDX(iova, lvl, data), data)) + return -EINVAL; + + for (base = 0; base < size; base += next_size) { + ret = __arm_lpae_clear_dirty_log(data, iova + base, + next_size, lvl, ptep, bitmap, + base_iova, bitmap_pgshift); + if (ret) + return ret; + } + return 0; + } + ptep += ARM_LPAE_LVL_IDX(iova, lvl, data); pte = READ_ONCE(*ptep); if (WARN_ON(!pte)) @@ -1098,6 +1241,8 @@ static int __arm_lpae_clear_dirty_log(struct arm_lpae_io_pgtable *data, if (iopte_leaf(pte, lvl, iop->fmt)) { if (pte & ARM_LPAE_PTE_AP_RDONLY) return 0; + if (pte & ARM_LPAE_PTE_CONT) + return -EOPNOTSUPP; /* Ensure all corresponding bits are set */ nbits = size >> bitmap_pgshift; @@ -1188,6 +1333,9 @@ static int io_pgtable_visit_dirty(struct arm_lpae_io_pgtable *data, size_t size = ARM_LPAE_BLOCK_SIZE(lvl, data); if (iopte_writeable_dirty(pte)) { + if ((pte & ARM_LPAE_PTE_CONT) && + !(walk_data->flags & IOMMU_DIRTY_NO_CLEAR)) + return -EOPNOTSUPP; iommu_dirty_bitmap_record(walk_data->dirty, walk_data->addr, size); if (!(walk_data->flags & IOMMU_DIRTY_NO_CLEAR)) @@ -1295,8 +1443,23 @@ static void arm_lpae_restrict_pgsizes(struct io_pgtable_cfg *cfg) } cfg->pgsize_bitmap &= page_sizes; + if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT) { + unsigned long sizes = cfg->pgsize_bitmap; + + while (sizes) { + unsigned long size = BIT(__ffs(sizes)); + int num_cont = arm_lpae_num_cont(size); + + if (size <= ULONG_MAX / num_cont) + cfg->pgsize_bitmap |= num_cont * size; + sizes &= ~size; + } + } + cfg->ias = min(cfg->ias, max_addr_bits); cfg->oas = min(cfg->oas, max_addr_bits); + cfg->pgsize_bitmap &= GENMASK_ULL(cfg->ias, 0); + cfg->pgsize_bitmap &= GENMASK_ULL(cfg->oas, 0); } static struct arm_lpae_io_pgtable * @@ -1358,7 +1521,8 @@ arm_64_lpae_alloc_pgtable_s1(struct io_pgtable_cfg *cfg, void *cookie) IO_PGTABLE_QUIRK_ARM_HD | IO_PGTABLE_QUIRK_ARM_BBML1 | IO_PGTABLE_QUIRK_ARM_BBML2 | - IO_PGTABLE_QUIRK_HISI_ERRATA)) + IO_PGTABLE_QUIRK_HISI_ERRATA | + IO_PGTABLE_QUIRK_ARM_CONT_HINT)) return NULL; data = arm_lpae_alloc_pgtable(cfg); @@ -1464,7 +1628,8 @@ arm_64_lpae_alloc_pgtable_s2(struct io_pgtable_cfg *cfg, void *cookie) IO_PGTABLE_QUIRK_ARM_BBML1 | IO_PGTABLE_QUIRK_ARM_BBML2 | IO_PGTABLE_QUIRK_ARM_S2FWB | - IO_PGTABLE_QUIRK_HISI_ERRATA)) + IO_PGTABLE_QUIRK_HISI_ERRATA | + IO_PGTABLE_QUIRK_ARM_CONT_HINT)) return NULL; data = arm_lpae_alloc_pgtable(cfg); diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h index 62a0c5b0f55f..1febcede3791 100644 --- a/include/linux/io-pgtable.h +++ b/include/linux/io-pgtable.h @@ -98,6 +98,9 @@ struct io_pgtable_cfg { * IO_PGTABLE_QUIRK_ARM_BBML2: ARM SMMU supports BBM Level 2 behavior * when changing block size. * IO_PGTABLE_QUIRK_ARM_S2FWB: Use the FWB format for the MemAttrs bits + * IO_PGTABLE_QUIRK_ARM_CONT_HINT: Enable contiguous hints for ARM LPAE. + * Disabled by default; drivers opt in before alloc_io_pgtable_ops(). + * Only mappings using an advertised CONT group size are tagged. */ #define IO_PGTABLE_QUIRK_ARM_NS BIT(0) #define IO_PGTABLE_QUIRK_NO_PERMS BIT(1) @@ -110,6 +113,7 @@ struct io_pgtable_cfg { #define IO_PGTABLE_QUIRK_ARM_BBML2 BIT(9) #define IO_PGTABLE_QUIRK_ARM_S2FWB BIT(10) #define IO_PGTABLE_QUIRK_HISI_ERRATA BIT(11) + #define IO_PGTABLE_QUIRK_ARM_CONT_HINT BIT(12) unsigned long quirks; unsigned long pgsize_bitmap; unsigned int ias; -- 2.22.0

2 1

[PATCH OLK-6.6 v5 00/14] net: dynthread: dynamic threaded NAPI scheduler
by Cai Xinchen 27 Oct '26

27 Oct '26

This series makes the NAPI/queue/IRQ relationship visible to the network stack, backports the drivers and locking fixes it needs, and then builds net/dynthread on top of it: a loadable module that adapts the NAPI processing and the RX queue IRQ placement of a set of net devices to the scheduling behaviour of a target application at runtime. Motivation ---------- Interrupt and softirq processing of network RX competes with latency sensitive applications (e.g. mysqld) for CPU time. When such an application runs for a long time on a CPU without blocking, the softirq work of the NIC completion queues can preempt it on the same CPU and inflate its tail latency. The usual remedies are to steer the RX queue IRQs to other CPUs and/or to move NAPI processing into kernel threads bound to spare CPUs, but a static configuration cannot follow the application: once the target goes idle, is scheduled in short bursts, or is displaced, the reserved CPUs are simply wasted. To do this from a module, the queue a NAPI instance serves, the NAPI instance of a queue and the interrupt vector of that NAPI must be discoverable. Mainline added that association in v6.8/v6.9 (queue/NAPI pointer, netif_napi_set_irq(), mlx5e conversion) together with the RTNL fixes it requires. Patches 1-8 of this series backport that infrastructure, adapt it to the OLK KABI layout and fix the mlx5e lock ordering; patches 9-14 add the scheduler. Approach -------- The module periodically samples the scheduling statistics of all threads matching the appname module parameter and classifies them into one of five statuses (DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION, LONG_RUNNING_WITH_INTERRUPTS). Acting on that status it: - restores the RX queue IRQs to their original affinity when the target is gone or barely running; - spreads the IRQs over the NUMA node of their queues when processing in softirq context is acceptable again; - switches the NAPI processing of the configured net devices to kernel threads and binds the NAPI threads (and, optionally, the queue IRQs) to the CPUs of their NUMA node that the target tasks are not allowed to use; - scales the number of CPUs used by those threads with their measured load while the target stays in the long-running status. An unusable sample (counters moved backwards: DATA_LOSS) keeps the previous status, so a single bad sample cannot toggle the mode. Everything is controlled through module parameters, and the original IRQ affinity and NAPI mode are restored when the target disappears, the scheduler is disabled or the module is unloaded. The module is buildable only as a loadable module; the Kconfig entry currently allows ARM64 and it is enabled in the arm64 openeuler defconfig. Patch breakdown --------------- 1/14 net: Add queue and napi association Backport the queue <-> NAPI mapping: add enum netdev_queue_type, a napi pointer to struct netdev_queue and struct netdev_rx_queue, and netif_queue_set_napi() to set or clear it for RX and TX queues. The new netdev_queue field is put into reserve space so the layout of the structure is preserved. 2/14 net: fix KABI breakage for queue napi association Keep the struct layout stable across the backport: use the reserved domain segment of KABI 1 for netdev_queue and KABI 2 for netdev_rx_queue. 3/14 net: Add NAPI IRQ support Add napi->irq and netif_napi_set_irq(), so a driver can publish the interrupt vector that serves a NAPI instance. It is initialized to -1 by netif_napi_add_weight() and stays unknown for drivers that do not call the setter. The ice and netdev-genl/netlink parts of the upstream patch are not needed here and are dropped. 4/14 net: Fix napi irq KABI breakage Store napi->irq in the reserved domain segment of KABI 1 so that the napi_struct layout does not change. 5/14 net/mlx5e: link NAPI instances to queues and IRQs Make mlx5e call netif_napi_set_irq() when a channel is opened and register/clear the queue/NAPI association for its RX and TX queues (including the PTP queues) when they are activated/deactivated. This is also what users of the queue GET netlink API expect. 6/14 net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation netif_queue_set_napi() asserts RTNL for a registered netdev, so take the lock in the mlx5e TX reporter recovery paths that activate or deactivate queues without it. 7/14 net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover The RTNL has to be acquired before priv->state_lock in the PTP SQ recovery. Move the lock acquisition up so the order matches the probe and channel switch paths. 8/14 net/mlx5e: Do not block on RTNL while recovering an SQ The recovery callbacks run synchronously from devlink_health_report() under the devlink lock, from SQ work items, while channel teardown holds the RTNL and waits for those work items with cancel_work_sync(). Replace the blocking rtnl_lock() with rtnl_trylock() and abandon the recovery when the SQ has been disabled by the teardown, following the existing mlx5e_tx_timeout_work() pattern. This avoids a deadlock that also stalled all devlink operations on the device. 9/14 net: dynthread: Add dynamic threaded NAPI scheduler framework Wire the new directory into net/Kconfig and net/Makefile, add the NET_DYNTHREAD Kconfig entry (ARM64, module only) and the module skeleton. On load the module takes a reference on each device given with the '#' separated ifname parameter, walks the IRQ descriptor table through the exported irq_get_irq_data(), snapshots desc->action and the effective affinity under desc->lock, and records the IRQ number and the original affinity CPU of every RX queue. IRQs are matched against the device name, its parent device name and the irqname pattern. Also count the NUMA nodes the recorded queues span, drop the device references on unload, and unwind a partially failed init. 10/14 net: dynthread: Monitor the load of the target tasks Add the sampling loop and the status judgement. Every dyn_threaded_interval ms, every monitored thread whose name matches appname contributes its runtime, voluntary/involuntary context switches and its allowed CPU mask; the masks are unioned to know where the target may run. The sample is compared with the previous one to derive the average runtime per switch, the nvcsw percentage and the CPU load, and to classify it as DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION or LONG_RUNNING_WITH_INTERRUPTS. Add the periodic hrtimer/work worker, the dynthreaded enable/disable parameter, a mutex serializing the worker control, a zeroed baseline on every enable, and the last_status tracking used to carry the transition sample. 11/14 net: dynthread: Steer the RX queue IRQs away from the target tasks Manage the affinity of the recorded RX queue IRQs. When the target tasks sit in a single NUMA node and enough CPUs of that node are free, move all queue IRQs there round-robin; when the target is gone or barely running, restore the affinity recorded at load time; when the target is fragmented, spread the IRQs over a subset of their own NUMA node sized from dyn_threaded_irq_cpucore_per. Track the "bound to one node" state so spreading is suppressed while it is active, and clear it on every recovery. All of this is skipped when dyn_threaded_bindirq is off, and the IRQ affinity is restored when the worker is stopped. 12/14 net: dynthread: Switch NAPI to threads on spare CPUs Enable threaded NAPI (dev_set_threaded) on the monitored devices in LONG_RUNNING_WITH_INTERRUPTS and bind each NAPI thread from the NUMA node of its queue IRQ: use the whole node if the target is not there, the target-free CPUs of the node if any, otherwise the first dyn_threaded_corenum CPUs of the node. Use napi->irq when the driver published it and fall back to the RX queue IRQ recorded by the module (e.g. hns3) otherwise. The NAPI list is built by head insertion, so it is walked in reverse to visit the NAPIs in registration (vector) order, matching the ascending order in which the RX queue IRQs are recorded. Optionally bind the queue IRQ to the same mask. Record the CPUs used by the NAPI threads in napi_cpumask for the load evaluation of the next patch. Switch the devices back to softirq mode in NO_TASK, NOT_RUNNING and FRAGMENTATION, when the scheduler is disabled and on module unload; the NAPI and IRQ operations run under the rtnetlink lock. 13/14 net: dynthread: Scale the number of NAPI thread CPUs Sample the kernel_cpustat of the CPUs used by the NAPI threads and compare consecutive periods. Grow dyn_threaded_corenum when the irq/softirq share or the total load of those CPUs is too high, and shrink it when the user share is high or the total load is low, within the lower/upper limit parameters. Damping and anti-fight rules avoid oscillating right after a change or undoing a change made for the opposite reason; the two total-load driven directions check each other, and the cpustat baseline is taken over the mask that was actually just bound. The default core count is computed at init from the busiest device's RX queue count divided by the online NUMA nodes. The lower/upper limit parameters reject zero and an inverted range, refuse a change that would move the computed default out of range, and clamp the current core count into the new range. Reset the damping state and the baseline when leaving the long-running status or when the scheduler is stopped, and serialize the core-count updates with the module parameter setter. 14/14 net: dynthread: Add debug switch and instrumentation Add the dyn_threaded_debug module parameter and instrument the periodic sampling, the status transitions, the IRQ affinity decisions, the NAPI thread masks and the CPU-count resizes. The messages are recorded with trace_printk() so they can be read from tracefs without flooding the console; without tracing support they fall back to dynamic debug. The switch is off by default. Amritha Nambiar (2): net: Add queue and napi association net: Add NAPI IRQ support Cai Xinchen (7): net/mlx5e: Do not block on RTNL while recovering an SQ net: dynthread: Add dynamic threaded NAPI scheduler framework net: dynthread: Monitor the load of the target tasks net: dynthread: Steer the RX queue IRQs away from the target tasks net: dynthread: Switch NAPI to threads on spare CPUs net: dynthread: Scale the number of NAPI thread CPUs net: dynthread: Add debug switch and instrumentation Amritha Nambiar (2): net: Add queue and napi association net: Add NAPI IRQ support Cai Xinchen (7): net/mlx5e: Do not block on RTNL while recovering an SQ net: dynthread: Add dynamic threaded NAPI scheduler framework net: dynthread: Monitor the load of the target tasks net: dynthread: Steer the RX queue IRQs away from the target tasks net: dynthread: Switch NAPI to threads on spare CPUs net: dynthread: Scale the number of NAPI thread CPUs net: dynthread: Add debug switch and instrumentation Carolina Jubran (1): net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation Cosmin Ratiu (1): net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover JiangJieHua (2): net: fix KABI breakage for queue napi association net: Fix napi irq KABI breakage Joe Damato (1): net/mlx5e: link NAPI instances to queues and IRQs arch/arm64/configs/openeuler_defconfig | 1 + .../net/ethernet/mellanox/mlx5/core/en/ptp.c | 5 +- .../mellanox/mlx5/core/en/reporter_tx.c | 23 + .../net/ethernet/mellanox/mlx5/core/en_main.c | 7 + include/linux/netdevice.h | 21 +- include/net/netdev_rx_queue.h | 2 +- net/Kconfig | 1 + net/Makefile | 1 + net/core/dev.c | 38 + net/dynthread/Kconfig | 13 + net/dynthread/Makefile | 2 + net/dynthread/net_dynthread.c | 1588 +++++++++++++++++ 12 files changed, 1698 insertions(+), 4 deletions(-) create mode 100644 net/dynthread/Kconfig create mode 100644 net/dynthread/Makefile create mode 100644 net/dynthread/net_dynthread.c -- 2.18.0.huawei.25

2 15

[PATCH OLK-6.6 0/2] Fix CVE-2026-98386
by Zizhi Wo 27 Oct '26

27 Oct '26

Fix CVE-2026-98386 Nilesh Javali (2): scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot drivers/scsi/qla2xxx/qla_iocb.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] smb: client: drain and invalidate before server-side copy/clone
by Yifan Qiao 27 Oct '26

27 Oct '26

From: Paulo Alcantara <pc(a)manguebit.org> mainline inclusion from mainline-v7.3-rc6 commit c9b1194e8ec99d95db25db45edd2fbf690f043ab category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20580 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- cifs_file_copychunk_range() and the clone (FICLONE) path of cifs_remap_file_range() do not serialise the destination page cache against the server-side copy the way the other server-side range operations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range() and smb3_insert_range()) do. cifs_file_copychunk_range() invalidates the destination range with filemap_invalidate_inode(), which takes and drops the mapping's invalidate_lock internally, so the lock is no longer held when the copychunk ioctl is issued. It also never drains in-flight netfs I/O on the target. The clone path never takes the invalidate_lock at all (only i_rwsem), uses a bare truncate_inode_pages_range() and likewise does not drain outstanding I/O. As a result an asynchronous destination writeback can complete after the server-side copy/clone has run and reinstate stale data over the region just written by the server, corrupting the file. This is the same class of corruption as commit d7d2adcd022b ("smb/client: flush dirty data before punching a hole") and has been seen randomly in generic/363 against Windows Server. Fix both paths to follow the established ordering: hold the target mapping's invalidate_lock across the flush and invalidation of the destination and the server ioctl, and call netfs_wait_for_outstanding_io() on the target to drain in-flight writes before the ioctl is issued. Only the target inode's invalidate_lock is required, as the source is merely flushed and not invalidated; i_rwsem (already held via lock_two_nondirectories()) is acquired before the invalidate_lock, matching the VFS lock ordering. Since filemap_invalidate_inode() takes that same lock internally, replace it with its own unmap/flush/invalidate steps instead of calling it, and return early on a zero-length copy to avoid a range underflow. Fixes: 8101d6e112e2 ("cifs: Fix copy offload to flush destination region") Fixes: c54fc3a4f375 ("cifs: Fix flushing, invalidation and file size with FICLONE") Reviewed-by: David Howells <dhowells(a)redhat.com> Reviewed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Cc: Christian Brauner <brauner(a)kernel.org> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Ronnie Sahlberg <ronniesahlberg(a)gmail.com> Cc: Shyam Prasad N <sprasad(a)microsoft.com> Cc: Tom Talpey <tom(a)talpey.com> Cc: Bharath SM <bharathsm(a)microsoft.com> Cc: stable(a)vger.kernel.org Conflicts: fs/smb/client/cifsfs.c [This tree has no netfs_wait_for_outstanding_io() and 8101d6e112e2 is not merged yet. So no need to change cifs_file_copychunk_range] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/cifsfs.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c index fb2692789cd6..334efdd8d8d9 100644 --- a/fs/smb/client/cifsfs.c +++ b/fs/smb/client/cifsfs.c @@ -1338,6 +1338,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, * server could even support copy of range where source = target */ lock_two_nondirectories(target_inode, src_inode); + filemap_invalidate_lock(target_inode->i_mapping); if (len == 0) { loff_t src_size = i_size_read(src_inode); @@ -1387,8 +1388,19 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, if (rc) goto unlock; - /* Discard all the folios that overlap the destination region. */ + /* Discard all the folios that overlap the destination region. Start at + * the old EOF when extending so the folio straddling it, which may hold + * data written past EOF through an mmap, is dropped too. + */ cifs_dbg(FYI, "about to discard pages %llx-%llx\n", fstart, fend); + fstart = min_t(unsigned long long, fstart, + i_size_read(target_inode)); + /* Drain any in-flight writeback on the destination before the server + * side clone rewrites the range. + */ + rc = filemap_write_and_wait_range(target_inode->i_mapping, fstart, fend); + if (rc) + goto unlock; truncate_inode_pages_range(&target_inode->i_data, fstart, fend); fscache_invalidate(cifs_inode_cookie(target_inode), NULL, @@ -1424,6 +1436,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, that target is updated on the server */ CIFS_I(target_inode)->time = 0; unlock: + filemap_invalidate_unlock(target_inode->i_mapping); /* although unlocking in the reverse order from locking is not strictly necessary here it is a little cleaner to be consistent */ unlock_two_nondirectories(src_inode, target_inode); -- 2.52.0

2 1

[PATCH OLK-6.6] smb: client: flush and commit data before querying allocated ranges
by Yifan Qiao 27 Oct '26

27 Oct '26

From: Paulo Alcantara <pc(a)manguebit.org> mainline inclusion from mainline-v7.3-rc6 commit aa994489bd835547c191827acc460192e147032d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20578 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior ranges in smb3_simple_fallocate_range() issues FSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server reports as an unallocated hole, to force block allocation without changing file contents. This is unsafe against Windows servers. Per the Win32 documentation, FSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain nonzero data and is explicitly not coherent with recently written data: "a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network file] would not necessarily return a correct list of allocated regions. To ensure coherency [...] flush the data to the file" fsx (generic/363) reproduces the resulting corruption against Windows Server 2022: a range is written, an uncached read returns the data, yet the next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole hole, so the emulation overwrites live data with zeroes. A network trace confirmed the WRITE, the READ returning data and the query returning an empty range list within microseconds. Samba does not exhibit this; its query is coherent with the written data. Write back the dirty pages, drain any outstanding I/O and issue an SMB2 FLUSH to force the server to commit the data before querying the allocated ranges, so the query reflects the data actually present. With this, generic/363 passes against both Windows Server 2022 and Samba over 100000 fsx operations. Fixes: 966a3cb7c7db ("cifs: improve fallocate emulation") Reviewed-by: David Howells <dhowells(a)redhat.com> Reviewed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Cc: Christian Brauner <brauner(a)kernel.org> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Ronnie Sahlberg <ronniesahlberg(a)gmail.com> Cc: Shyam Prasad N <sprasad(a)microsoft.com> Cc: Tom Talpey <tom(a)talpey.com> Cc: Bharath SM <bharathsm(a)microsoft.com> Cc: stable(a)vger.kernel.org Conflicts: fs/smb/client/smb2ops.c [smb3_simple_fallocate_range() in this tree lacks the pre-EOF fast path and buffers are allocated after the ioctl; drop netfs_wait_for_outstanding_io() as this tree has no netfs io_count and cifs uses its own writeback path, and keep filemap_write_and_wait_range() plus SMB2_flush() before FSCTL_QUERY_ALLOCATED_RANGES.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/smb2ops.c | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 781c471927e8..f5f92a9ed422 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -3454,12 +3454,30 @@ static int smb3_simple_fallocate_range(unsigned int xid, loff_t off, loff_t len) { struct file_allocated_range_buffer in_data, *out_data = NULL, *tmp_data; + struct inode *inode = d_inode(cfile->dentry); u32 out_data_len; char *buf = NULL; u64 range_start, range_len, range_end; loff_t l; int rc; + filemap_invalidate_lock(inode->i_mapping); + + /* + * Flush and commit the data to the server, otherwise + * FSCTL_QUERY_ALLOCATED_RANGES might report recently written data as + * unallocated holes on Windows Servers, and the loop below would + * then zero-fill them and corrupt the file. + */ + rc = filemap_write_and_wait_range(inode->i_mapping, off, + off + len - 1); + if (rc) + goto out_unlock; + rc = SMB2_flush(xid, tcon, cfile->fid.persistent_fid, + cfile->fid.volatile_fid); + if (rc) + goto out_unlock; + in_data.file_offset = cpu_to_le64(off); in_data.length = cpu_to_le64(len); rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid, @@ -3469,12 +3487,12 @@ static int smb3_simple_fallocate_range(unsigned int xid, 1024 * sizeof(struct file_allocated_range_buffer), (char **)&out_data, &out_data_len); if (rc) - goto out; + goto out_unlock; buf = kvzalloc(min_t(loff_t, len, SMB2_MAX_BUFFER_SIZE), GFP_KERNEL); if (buf == NULL) { rc = -ENOMEM; - goto out; + goto out_unlock; } tmp_data = out_data; @@ -3485,12 +3503,12 @@ static int smb3_simple_fallocate_range(unsigned int xid, if (out_data_len == 0) { rc = smb3_simple_fallocate_write_range(xid, tcon, cfile, off, len, buf); - goto out; + goto out_unlock; } if (out_data_len < sizeof(struct file_allocated_range_buffer)) { rc = -EINVAL; - goto out; + goto out_unlock; } range_start = le64_to_cpu(tmp_data->file_offset); @@ -3498,7 +3516,7 @@ static int smb3_simple_fallocate_range(unsigned int xid, if (check_add_overflow(range_start, range_len, &range_end) || range_end > S64_MAX) { rc = -EINVAL; - goto out; + goto out_unlock; } if (off < range_start) { @@ -3513,11 +3531,11 @@ static int smb3_simple_fallocate_range(unsigned int xid, rc = smb3_simple_fallocate_write_range(xid, tcon, cfile, off, l, buf); if (rc) - goto out; + goto out_unlock; off = off + l; len = len - l; if (len == 0) - goto out; + goto out_unlock; } /* * We are at a section of allocated data, just skip forward @@ -3536,7 +3554,8 @@ static int smb3_simple_fallocate_range(unsigned int xid, out_data_len -= sizeof(struct file_allocated_range_buffer); } - out: + out_unlock: + filemap_invalidate_unlock(inode->i_mapping); kfree(out_data); kvfree(buf); return rc; -- 2.52.0

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2026-98454
by Zizhi Wo 26 Oct '26

26 Oct '26

Fix CVE-2026-98454 Steve French (1): smb3: make query_on_disk_id open context consistent and move to common code Zihan Xi (1): smb: client: fix create context out-of-bounds reads fs/cifs/smb2ops.c | 28 ++++++++++++++++++++-------- fs/cifs/smb2pdu.c | 44 ++++++++++++++++++++++++++++++++++---------- fs/cifs/smb2pdu.h | 6 +++--- 3 files changed, 57 insertions(+), 21 deletions(-) -- 2.52.0

2 3

[PATCH v2 OLK-6.6 0/4] arm64: Allow CPU0 to be nohz_full
by Xia Fukun 26 Oct '26

26 Oct '26

This series is the OLK-6.6 adaptation of the same feature merged in OLK-5.10 (original author Xiongfeng Wang). Xiongfeng Wang (4): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether there exists a housekeeping CPU online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arm64: defconfig: Enable CONFIG_PM_SLEEP_SMP_NONZERO_CPU and CONFIG_ARCH_SUSPEND_NONZERO_CPU arch/arm64/Kconfig | 3 ++ arch/arm64/configs/openeuler_defconfig | 2 ++ include/linux/cpu.h | 3 +- include/linux/sched/isolation.h | 2 ++ include/linux/tick.h | 2 ++ kernel/sched/isolation.c | 45 ++++++++++++++++++++++---- kernel/smp.c | 4 +++ kernel/time/tick-sched.c | 11 ++++++- 8 files changed, 63 insertions(+), 9 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/3] FIX CVE-2026-98453
by Zizhi Wo 26 Oct '26

26 Oct '26

FIX CVE-2026-98453 ChenXiaoSong (2): smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() smb/client: pass cifs_open_info_data to SMB2_open() Zihan Xi (1): smb: client: close handle after create-context parsing failure fs/smb/client/link.c | 15 +++------------ fs/smb/client/smb2file.c | 19 ++++++++----------- fs/smb/client/smb2pdu.c | 34 +++++++++++++++++++--------------- fs/smb/client/smb2proto.h | 2 +- 4 files changed, 31 insertions(+), 39 deletions(-) -- 2.52.0

2 4

[PATCH OLK-6.6 0/2] FIX CVE-2026-98452
by Zizhi Wo 26 Oct '26

26 Oct '26

Fix CVE-2026-98452 ChenXiaoSong (1): smb: move SMB2 Status code to common header file Zihan Xi (1): smb: client: clean up failed cached directory opens fs/smb/client/cached_dir.c | 32 +- fs/smb/client/smb2file.c | 2 +- fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smb2maperror.c | 2 +- fs/smb/client/smb2misc.c | 2 +- fs/smb/client/smb2ops.c | 2 +- fs/smb/client/smb2pdu.c | 2 +- fs/smb/client/smb2transport.c | 2 +- fs/smb/{client => common}/smb2status.h | 2 + fs/smb/server/oplock.c | 2 +- fs/smb/server/server.c | 2 +- fs/smb/server/smb2misc.c | 2 +- fs/smb/server/smb2pdu.c | 2 +- fs/smb/server/smb_common.c | 2 +- fs/smb/server/smbstatus.h | 1822 ------------------------ fs/smb/server/transport_rdma.c | 2 +- 16 files changed, 37 insertions(+), 1845 deletions(-) rename fs/smb/{client => common}/smb2status.h (99%) delete mode 100644 fs/smb/server/smbstatus.h -- 2.52.0

2 3

[PATCH OLK-6.6] nvmet: fix max_qid race between configfs and controller allocation
by Zhang Yuwei 26 Oct '26

26 Oct '26

From: Maurizio Lombardi <mlombard(a)redhat.com> mainline inclusion from mainline-v7.3-rc1 commit f1a8846e06388113dfdbb89dee005083fa9afdf9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19441 CVE: CVE-2026-90206 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The function nvmet_subsys_attr_qid_max_store() can race against nvmet_alloc_ctrl() when a subsystem's max_qid limit is modified. Suppose max_qid is currently 64. If nvmet_alloc_ctrl() executes: ctrl->sqs = kzalloc_objs(struct nvmet_sq *, subsys->max_qid + 1); and at this exact point, a userspace process changes max_qid to 128, nvmet_subsys_attr_qid_max_store() will set the new max_qid value. It attempts to delete active controllers to force a reconnect, but the new controller won't be deleted because it hasn't been added to the subsys->ctrls list yet. nvmet_alloc_ctrl() then proceeds and adds the new controller to the subsys->ctrls list. Later, when nvmet_install_queue() is called, it will see max_qid set to 128, but the memory allocated for sqs is only sized for 64 entries. This results in a KASAN out-of-bounds warning and potential memory corruptions. Fix this by protecting the queue allocations and list insertion in nvmet_alloc_ctrl() with down_read(&nvmet_config_sem). Because nvmet_subsys_attr_qid_max_store() acquires down_write(&nvmet_config_sem) to modify the attribute, this safely prevents the configfs writer from modifying max_qid during controller creation. Copy the max_qid from the subsystem to the controller's structure during the allocation; ctrl->max_qid never changes as long as the controller remains in LIVE state, so this will prevent similar race conditions. Fixes: 3e980f5995e0 ("nvmet: expose max queues to configfs") Reported-by: syzbot+2626e846cd2585c9aa67(a)syzkaller.appspotmail.com Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/target/core.c [Commit 3e980f5995e0 predates the kzalloc_objs() helper and the ctrl->cqs array, so keep the open-coded kcalloc(ctrl->max_qid + 1) for ctrl->sqs and drop the cqs allocation/cleanup path. The pci-epf.c hunk is skipped because this tree has no PCI endpoint function target driver.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/nvme/target/admin-cmd.c | 8 +++--- drivers/nvme/target/core.c | 41 ++++++++++++++++++------------- drivers/nvme/target/fabrics-cmd.c | 2 +- drivers/nvme/target/nvmet.h | 6 +++++ 4 files changed, 35 insertions(+), 22 deletions(-) diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c index 096bb9f4dd34..cda1d94d17af 100644 --- a/drivers/nvme/target/admin-cmd.c +++ b/drivers/nvme/target/admin-cmd.c @@ -818,7 +818,7 @@ u16 nvmet_set_feat_async_event(struct nvmet_req *req, u32 mask) void nvmet_execute_set_features(struct nvmet_req *req) { - struct nvmet_subsys *subsys = nvmet_req_subsys(req); + struct nvmet_ctrl *ctrl = nvmet_req_ctrl(req); u32 cdw10 = le32_to_cpu(req->cmd->common.cdw10); u32 cdw11 = le32_to_cpu(req->cmd->common.cdw11); u16 status = 0; @@ -837,7 +837,7 @@ void nvmet_execute_set_features(struct nvmet_req *req) break; } nvmet_set_result(req, - (subsys->max_qid - 1) | ((subsys->max_qid - 1) << 16)); + (ctrl->max_qid - 1) | ((ctrl->max_qid - 1) << 16)); break; case NVME_FEAT_KATO: status = nvmet_set_feat_kato(req); @@ -892,7 +892,7 @@ void nvmet_get_feat_async_event(struct nvmet_req *req) void nvmet_execute_get_features(struct nvmet_req *req) { - struct nvmet_subsys *subsys = nvmet_req_subsys(req); + struct nvmet_ctrl *ctrl = nvmet_req_ctrl(req); u32 cdw10 = le32_to_cpu(req->cmd->common.cdw10); u16 status = 0; @@ -929,7 +929,7 @@ void nvmet_execute_get_features(struct nvmet_req *req) break; case NVME_FEAT_NUM_QUEUES: nvmet_set_result(req, - (subsys->max_qid-1) | ((subsys->max_qid-1) << 16)); + (ctrl->max_qid-1) | ((ctrl->max_qid-1) << 16)); break; case NVME_FEAT_KATO: nvmet_get_feat_kato(req); diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c index e76394dc38f6..79cdd25533b3 100644 --- a/drivers/nvme/target/core.c +++ b/drivers/nvme/target/core.c @@ -1434,7 +1434,25 @@ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn, if (!ctrl->changed_ns_list) goto out_free_ctrl; - ctrl->sqs = kcalloc(subsys->max_qid + 1, + /* + * Discovery controllers may use some arbitrary high value + * in order to cleanup stale discovery sessions + */ + if (nvmet_is_disc_subsys(ctrl->subsys) && !kato) + kato = NVMET_DISC_KATO_MS; + + /* keep-alive timeout in seconds */ + ctrl->kato = DIV_ROUND_UP(kato, 1000); + + ctrl->err_counter = 0; + spin_lock_init(&ctrl->error_lock); + + down_read(&nvmet_config_sem); + mutex_lock(&subsys->lock); + + ctrl->max_qid = subsys->max_qid; + + ctrl->sqs = kcalloc(ctrl->max_qid + 1, sizeof(struct nvmet_sq *), GFP_KERNEL); if (!ctrl->sqs) @@ -1452,25 +1470,12 @@ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn, } ctrl->cntlid = ret; - /* - * Discovery controllers may use some arbitrary high value - * in order to cleanup stale discovery sessions - */ - if (nvmet_is_disc_subsys(ctrl->subsys) && !kato) - kato = NVMET_DISC_KATO_MS; - - /* keep-alive timeout in seconds */ - ctrl->kato = DIV_ROUND_UP(kato, 1000); - - ctrl->err_counter = 0; - spin_lock_init(&ctrl->error_lock); - - nvmet_start_keep_alive_timer(ctrl); - - mutex_lock(&subsys->lock); list_add_tail(&ctrl->subsys_entry, &subsys->ctrls); nvmet_setup_p2p_ns_map(ctrl, req); mutex_unlock(&subsys->lock); + up_read(&nvmet_config_sem); + + nvmet_start_keep_alive_timer(ctrl); *ctrlp = ctrl; return 0; @@ -1478,6 +1483,8 @@ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn, out_free_sqs: kfree(ctrl->sqs); out_free_changed_ns_list: + mutex_unlock(&subsys->lock); + up_read(&nvmet_config_sem); kfree(ctrl->changed_ns_list); out_free_ctrl: kfree(ctrl); diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c index 441a6b6170fd..d6e4e9ba10e3 100644 --- a/drivers/nvme/target/fabrics-cmd.c +++ b/drivers/nvme/target/fabrics-cmd.c @@ -318,7 +318,7 @@ static void nvmet_execute_io_connect(struct nvmet_req *req) goto out; } - if (unlikely(qid > ctrl->subsys->max_qid)) { + if (unlikely(qid > ctrl->max_qid)) { pr_warn("invalid queue id (%d)\n", qid); status = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR; req->cqe->result.u32 = IPO_IATTR_CONNECT_SQE(qid); diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h index 87033c8bd7b9..6e6f74118ccc 100644 --- a/drivers/nvme/target/nvmet.h +++ b/drivers/nvme/target/nvmet.h @@ -192,6 +192,7 @@ struct nvmet_ctrl { uuid_t hostid; u16 cntlid; + u16 max_qid; u32 kato; struct nvmet_port *port; @@ -615,6 +616,11 @@ static inline struct nvmet_subsys *nvmet_req_subsys(struct nvmet_req *req) return req->sq->ctrl->subsys; } +static inline struct nvmet_ctrl *nvmet_req_ctrl(struct nvmet_req *req) +{ + return req->sq->ctrl; +} + static inline bool nvmet_is_disc_subsys(struct nvmet_subsys *subsys) { return subsys->type != NVME_NQN_NVME; -- 2.22.0

2 1

[PATCH OLK-5.10] smb: client: use finish_no_open() for non-regular inodes
by Zizhi Wo 26 Oct '26

26 Oct '26

From: Namjae Jeon <linkinjeon(a)kernel.org> maillist inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20390 Reference: https://lore.kernel.org/all/20260930184156.247870-1-sashal@kernel.org/ -------------------------------- [ Upstream commit e66cf1625ec4a3fe68346119f371def713fd0a4d ] An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also prevents the VFS from following the symlink. Track whether cifs_do_create() returned an open server handle. For non-regular inodes, close the handle if present, remove the pending open, and call finish_no_open() so the VFS can continue the lookup. Do not set FMODE_CREATED unless a regular file was opened. For O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's -EFTYPE check. Defer closing a legacy POSIX handle on a non-regular inode until after inode lookup. This avoids closing it again if lookup fails. Fixes: d2c127197dfc ("cifs: implement i_op->atomic_open()") Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Cc: stable(a)vger.kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/dir.c | 37 +++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-) diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c index 0d7238cb45b5..6241dba19bd8 100644 --- a/fs/cifs/dir.c +++ b/fs/cifs/dir.c @@ -223,11 +223,11 @@ check_name(struct dentry *direntry, struct cifs_tcon *tcon) /* Inode operations in similar order to how they appear in Linux file fs.h */ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid, struct tcon_link *tlink, unsigned oflags, umode_t mode, - __u32 *oplock, struct cifs_fid *fid) + __u32 *oplock, struct cifs_fid *fid, bool *opened) { int rc = -ENOENT; int create_options = CREATE_NOT_DIR; int desired_access; struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); @@ -237,10 +237,11 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid, struct inode *newinode = NULL; int disposition; struct TCP_Server_Info *server = tcon->ses->server; struct cifs_open_parms oparms; + *opened = false; *oplock = 0; if (tcon->ses->server->oplocks) *oplock = REQ_OPLOCK; full_path = build_path_from_dentry(direntry); @@ -252,10 +253,11 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid, le64_to_cpu(tcon->fsUnixInfo.Capability))) { rc = cifs_posix_open(full_path, &newinode, inode->i_sb, mode, oflags, oplock, &fid->netfid, xid); switch (rc) { case 0: + *opened = true; if (newinode == NULL) { /* query inode info */ goto cifs_create_get_file_info; } @@ -268,15 +270,13 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid, if (!S_ISREG(newinode->i_mode)) { /* * The server may allow us to open things like * FIFOs, but the client isn't set up to deal - * with that. If it's not a regular file, just - * close it and proceed as if it were a normal - * lookup. + * with that. Keep the handle until the caller + * can finish the lookup. */ - CIFSSMBClose(xid, tcon, fid->netfid); goto cifs_create_get_file_info; } /* success, no need to query */ goto cifs_create_set_dentry; @@ -367,10 +367,11 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid, rc = server->ops->open(xid, &oparms, oplock, buf); if (rc) { cifs_dbg(FYI, "cifs_create returned 0x%x\n", rc); goto out; } + *opened = true; /* * If Open reported that we actually created a file then we now have to * set the mode if possible. */ @@ -449,11 +450,11 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid, kfree(buf); kfree(full_path); return rc; out_err: - if (server->ops->close) + if (*opened && server->ops->close) server->ops->close(xid, tcon, fid); if (newinode) iput(newinode); goto out; } @@ -469,10 +470,12 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, struct TCP_Server_Info *server; struct cifs_fid fid; struct cifs_pending_open open; __u32 oplock; struct cifsFileInfo *file_info; + bool is_regular; + bool opened; /* * Posix open is only called (at lookup time) for file create now. For * opens (rather than creates), because we do not know if it is a file * or directory yet, and current Samba no longer allows us to do posix @@ -523,20 +526,33 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, server->ops->new_lease_key(&fid); cifs_add_pending_open(&fid, tlink, &open); rc = cifs_do_create(inode, direntry, xid, tlink, oflags, mode, - &oplock, &fid); + &oplock, &fid, &opened); if (rc) { cifs_del_pending_open(&open); goto out; } - if ((oflags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL)) + is_regular = d_is_reg(direntry); + if (!is_regular || !opened) { + if (opened && server->ops->close) + server->ops->close(xid, tcon, &fid); + cifs_del_pending_open(&open); + } + + if (is_regular && opened && + (oflags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL)) file->f_mode |= FMODE_CREATED; + if (!is_regular || !opened) { + rc = finish_no_open(file, NULL); + goto out; + } + rc = finish_open(file, direntry, generic_file_open); if (rc) { if (server->ops->close) server->ops->close(xid, tcon, &fid); cifs_del_pending_open(&open); @@ -582,10 +598,11 @@ int cifs_create(struct inode *inode, struct dentry *direntry, umode_t mode, struct tcon_link *tlink; struct cifs_tcon *tcon; struct TCP_Server_Info *server; struct cifs_fid fid; __u32 oplock; + bool opened; cifs_dbg(FYI, "cifs_create parent inode = 0x%p name is: %pd and dentry = 0x%p\n", inode, direntry, direntry); tlink = cifs_sb_tlink(CIFS_SB(inode->i_sb)); @@ -598,12 +615,12 @@ int cifs_create(struct inode *inode, struct dentry *direntry, umode_t mode, if (server->ops->new_lease_key) server->ops->new_lease_key(&fid); rc = cifs_do_create(inode, direntry, xid, tlink, oflags, mode, - &oplock, &fid); - if (!rc && server->ops->close) + &oplock, &fid, &opened); + if (!rc && opened && server->ops->close) server->ops->close(xid, tcon, &fid); cifs_put_tlink(tlink); out_free_xid: free_xid(xid); -- 2.52.0

2 1

[PATCH OLK-6.6 0/3] CVE-2026-90129
by Jiacheng Yu 26 Oct '26

26 Oct '26

CVE-2026-90129 Denis V. Lunev (3): virtio: add virtio_device_shutdown() helper virtio_balloon: factor out virtballoon_quiesce() virtio_balloon: quiesce balloon work before device shutdown drivers/virtio/virtio.c | 41 ++++++++++++++++++++++----------- drivers/virtio/virtio_balloon.c | 34 +++++++++++++++++++++------ include/linux/virtio.h | 1 + 3 files changed, 55 insertions(+), 21 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] smb: client: use finish_no_open() for non-regular inodes
by Zizhi Wo 26 Oct '26

26 Oct '26

From: Namjae Jeon <linkinjeon(a)kernel.org> stable inclusion from stable-v6.6.160 commit 045532f920d86dd76600b635f9756e5fd671ddfc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20390 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit e66cf1625ec4a3fe68346119f371def713fd0a4d ] An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also prevents the VFS from following the symlink. Track whether cifs_do_create() returned an open server handle. For non-regular inodes, close the handle if present, remove the pending open, and call finish_no_open() so the VFS can continue the lookup. Do not set FMODE_CREATED unless a regular file was opened. For O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's -EFTYPE check. Defer closing a legacy POSIX handle on a non-regular inode until after inode lookup. This avoids closing it again if lookup fails. Fixes: d2c127197dfc ("cifs: implement i_op->atomic_open()") Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Cc: stable(a)vger.kernel.org [ replaced S_ISREG(inode->i_mode) with d_is_reg(direntry) because the older cifs_do_create() already attaches the inode. ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/smb/client/dir.c | 39 +++++++++++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 10 deletions(-) diff --git a/fs/smb/client/dir.c b/fs/smb/client/dir.c index 1822493dd084..02e146ce1385 100644 --- a/fs/smb/client/dir.c +++ b/fs/smb/client/dir.c @@ -174,11 +174,12 @@ check_name(struct dentry *direntry, struct cifs_tcon *tcon) /* Inode operations in similar order to how they appear in Linux file fs.h */ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid, struct tcon_link *tlink, unsigned int oflags, umode_t mode, __u32 *oplock, - struct cifs_fid *fid, struct cifs_open_info_data *buf) + struct cifs_fid *fid, struct cifs_open_info_data *buf, + bool *opened) { int rc = -ENOENT; int create_options = CREATE_NOT_DIR; int desired_access; struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb); @@ -189,10 +190,11 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int disposition; struct TCP_Server_Info *server = tcon->ses->server; struct cifs_open_parms oparms; int rdwr_for_fscache = 0; + *opened = false; *oplock = 0; if (tcon->ses->server->oplocks) *oplock = REQ_OPLOCK; full_path = build_path_from_dentry(direntry, page); @@ -211,10 +213,11 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned le64_to_cpu(tcon->fsUnixInfo.Capability))) { rc = cifs_posix_open(full_path, &newinode, inode->i_sb, mode, oflags, oplock, &fid->netfid, xid); switch (rc) { case 0: + *opened = true; if (newinode == NULL) { /* query inode info */ goto cifs_create_get_file_info; } @@ -227,15 +230,13 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned if (!S_ISREG(newinode->i_mode)) { /* * The server may allow us to open things like * FIFOs, but the client isn't set up to deal - * with that. If it's not a regular file, just - * close it and proceed as if it were a normal - * lookup. + * with that. Keep the handle until the caller + * can finish the lookup. */ - CIFSSMBClose(xid, tcon, fid->netfid); goto cifs_create_get_file_info; } /* success, no need to query */ goto cifs_create_set_dentry; @@ -330,10 +331,11 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned rdwr_for_fscache = 2; goto retry_open; } goto out; } + *opened = true; if (rdwr_for_fscache == 2) cifs_invalidate_cache(inode, FSCACHE_INVAL_DIO_WRITE); #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY /* @@ -420,11 +422,11 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned out: free_dentry_path(page); return rc; out_err: - if (server->ops->close) + if (*opened && server->ops->close) server->ops->close(xid, tcon, fid); if (newinode) iput(newinode); goto out; } @@ -439,10 +441,12 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, struct cifs_tcon *tcon; struct TCP_Server_Info *server; struct cifs_fid fid = {}; struct cifs_pending_open open; __u32 oplock; + bool is_regular; + bool opened; struct cifsFileInfo *file_info; struct cifs_open_info_data buf = {}; if (unlikely(cifs_forced_shutdown(CIFS_SB(inode->i_sb)))) return -EIO; @@ -498,19 +502,32 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, server->ops->new_lease_key(&fid); cifs_add_pending_open(&fid, tlink, &open); rc = cifs_do_create(inode, direntry, xid, tlink, oflags, mode, - &oplock, &fid, &buf); + &oplock, &fid, &buf, &opened); if (rc) { cifs_del_pending_open(&open); goto out; } - if ((oflags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL)) + is_regular = d_is_reg(direntry); + if (!is_regular || !opened) { + if (opened && server->ops->close) + server->ops->close(xid, tcon, &fid); + cifs_del_pending_open(&open); + } + + if (is_regular && opened && + (oflags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL)) file->f_mode |= FMODE_CREATED; + if (!is_regular || !opened) { + rc = finish_no_open(file, NULL); + goto out; + } + rc = finish_open(file, direntry, generic_file_open); if (rc) { if (server->ops->close) server->ops->close(xid, tcon, &fid); cifs_del_pending_open(&open); @@ -561,10 +578,11 @@ int cifs_create(struct mnt_idmap *idmap, struct inode *inode, struct tcon_link *tlink; struct cifs_tcon *tcon; struct TCP_Server_Info *server; struct cifs_fid fid; __u32 oplock; + bool opened; struct cifs_open_info_data buf = {}; cifs_dbg(FYI, "cifs_create parent inode = 0x%p name is: %pd and dentry = 0x%p\n", inode, direntry, direntry); @@ -582,12 +600,13 @@ int cifs_create(struct mnt_idmap *idmap, struct inode *inode, server = tcon->ses->server; if (server->ops->new_lease_key) server->ops->new_lease_key(&fid); - rc = cifs_do_create(inode, direntry, xid, tlink, oflags, mode, &oplock, &fid, &buf); - if (!rc && server->ops->close) + rc = cifs_do_create(inode, direntry, xid, tlink, oflags, mode, + &oplock, &fid, &buf, &opened); + if (!rc && opened && server->ops->close) server->ops->close(xid, tcon, &fid); cifs_free_open_info(&buf); cifs_put_tlink(tlink); out_free_xid: -- 2.52.0

2 1

[PATCH OLK-6.6] smb: client: close completed creates on compound wait errors
by Zizhi Wo 26 Oct '26

26 Oct '26

From: Zihan Xi <zihanx(a)nebusec.ai> stable inclusion from stable-v6.6.160 commit 8afc80156b1d9e2cfd02d42c255305fad95b59fc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20391 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 6c5c547f037bc18f0b8d0b5db5a648f8f630ce85 ] compound_send_recv() waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already have opened a remote handle. The earlier mid is then released without invoking handle_cancelled_mid(), leaving the remote handle open because no FID was copied to the caller. Mark completed earlier mids as cancelled when a compound wait or MID synchronization aborts. Keep their response buffers attached while the MIDs are synchronized, and transfer them only after synchronization of the processed responses, so the release path can inspect successful CREATE responses and queue SMB2_close() after a later failure. Account for a remote open only after the close work is allocated and before it is queued, since the caller has not yet updated num_remote_opens. Mark the create+close compound used by smb2_unlink() so it is not closed again. Non-CREATE responses and compounds that already include a close keep their existing behavior. Fixes: e0bba0b85481 ("cifs: add compound_send_recv()") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Assisted-by: LLM Co-developed-by: Luxing Yin <root(a)tr0jan.top> Signed-off-by: Luxing Yin <root(a)tr0jan.top> Signed-off-by: Zihan Xi <zihanx(a)nebusec.ai> Tested-by: Frank Sorenson <sorenson(a)redhat.com> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> [ replaced the upstream cancellation helper with inline loops using midQ and MID_WAIT_CANCELLED under server->mid_lock. ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/smb/client/transport.c [Simple context conflicts.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/smb/client/smb2misc.c | 9 +++-- fs/smb/client/transport.c | 69 ++++++++++++++++++++++++++++++--------- 2 files changed, 59 insertions(+), 19 deletions(-) diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c index 6fa23cf7a529..e37fe2d3b409 100644 --- a/fs/smb/client/smb2misc.c +++ b/fs/smb/client/smb2misc.c @@ -816,11 +816,12 @@ smb2_cancelled_close_fid(struct work_struct *work) * SMB2_CREATE to the server but before we processed the reply, and second * if a close was interrupted before we sent the SMB2_CLOSE to the server. */ static int __smb2_handle_cancelled_cmd(struct cifs_tcon *tcon, __u16 cmd, __u64 mid, - __u64 persistent_fid, __u64 volatile_fid) + __u64 persistent_fid, __u64 volatile_fid, + bool account_remote_open) { struct close_cancelled_open *cancelled; cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL); if (!cancelled) @@ -830,10 +831,12 @@ __smb2_handle_cancelled_cmd(struct cifs_tcon *tcon, __u16 cmd, __u64 mid, cancelled->fid.volatile_fid = volatile_fid; cancelled->tcon = tcon; cancelled->cmd = cmd; cancelled->mid = mid; INIT_WORK(&cancelled->work, smb2_cancelled_close_fid); + if (account_remote_open) + atomic_inc(&tcon->num_remote_opens); WARN_ON(queue_work(cifsiod_wq, &cancelled->work) == false); return 0; } @@ -866,11 +869,11 @@ smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, netfs_trace_tcon_ref_get_cancelled_close); spin_unlock(&tcon->tc_lock); rc = __smb2_handle_cancelled_cmd(tcon, SMB2_CLOSE_HE, 0, - persistent_fid, volatile_fid); + persistent_fid, volatile_fid, false); if (rc) cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_cancelled_close); return rc; } @@ -894,11 +897,11 @@ smb2_handle_cancelled_mid(struct mid_q_entry *mid, struct TCP_Server_Info *serve rc = __smb2_handle_cancelled_cmd(tcon, le16_to_cpu(hdr->Command), le64_to_cpu(hdr->MessageId), rsp->PersistentFileId, - rsp->VolatileFileId); + rsp->VolatileFileId, true); if (rc) cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_cancelled_mid); return rc; } diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c index 9d1f2af27de5..4d7322e895b4 100644 --- a/fs/smb/client/transport.c +++ b/fs/smb/client/transport.c @@ -1079,10 +1079,11 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, struct TCP_Server_Info *server, const int flags, const int num_rqst, struct smb_rqst *rqst, int *resp_buf_type, struct kvec *resp_iov) { int i, j, optype, rc = 0; + int num_processed = 0; struct mid_q_entry *midQ[MAX_COMPOUND]; bool cancelled_mid[MAX_COMPOUND] = {false}; struct cifs_credits credits[MAX_COMPOUND] = { { .value = 0, .instance = 0 } }; @@ -1221,10 +1222,21 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, rc = wait_for_response(server, midQ[i]); if (rc != 0) break; } if (rc != 0) { + /* + * A completed CREATE earlier in the compound chain may have + * opened a remote handle even though a later wait was + * interrupted. Mark it cancelled so __release_mid() invokes + * the existing unmatched-open cleanup. + */ + spin_lock(&server->mid_lock); + for (j = 0; j < i; j++) + midQ[j]->mid_flags |= MID_WAIT_CANCELLED; + spin_unlock(&server->mid_lock); + for (; i < num_rqst; i++) { cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n", midQ[i]->mid, le16_to_cpu(midQ[i]->command)); send_cancel(server, &rqst[i], midQ[i]); spin_lock(&midQ[i]->mid_lock); @@ -1242,59 +1254,84 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, if (rc < 0) goto out; rc = cifs_sync_mid_result(midQ[i], server); if (rc != 0) { + /* + * A previous CREATE may have completed before this + * response failed. Mark it cancelled so its remote + * handle is closed when the mid is released. + */ + spin_lock(&server->mid_lock); + for (j = 0; j < i; j++) + midQ[j]->mid_flags |= MID_WAIT_CANCELLED; + spin_unlock(&server->mid_lock); + /* Keep their response buffers for cancelled-mid cleanup. */ + num_processed = 0; /* mark this mid as cancelled to not free it below */ cancelled_mid[i] = true; goto out; } if (!midQ[i]->resp_buf || midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); + spin_lock(&server->mid_lock); + for (j = 0; j < i; j++) + midQ[j]->mid_flags |= MID_WAIT_CANCELLED; + spin_unlock(&server->mid_lock); + num_processed = 0; goto out; } + rc = server->ops->check_receive(midQ[i], server, + flags & CIFS_LOG_ERROR); + num_processed = i + 1; + } + +out: + /* + * Delay moving response buffers out of their mids until response + * synchronization completes. This lets cancelled-mid cleanup inspect + * an earlier CREATE response if a later MID fails. + */ + for (i = 0; i < num_processed; i++) { buf = (char *)midQ[i]->resp_buf; resp_iov[i].iov_base = buf; resp_iov[i].iov_len = midQ[i]->resp_buf_size + HEADER_PREAMBLE_SIZE(server); if (midQ[i]->large_buf) resp_buf_type[i] = CIFS_LARGE_BUFFER; else resp_buf_type[i] = CIFS_SMALL_BUFFER; - rc = server->ops->check_receive(midQ[i], server, - flags & CIFS_LOG_ERROR); - /* mark it so buf will not be freed by delete_mid */ if ((flags & CIFS_NO_RSP_BUF) == 0) midQ[i]->resp_buf = NULL; - } /* * Compounding is never used during session establish. */ - spin_lock(&ses->ses_lock); - if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) { - struct kvec iov = { - .iov_base = resp_iov[0].iov_base, - .iov_len = resp_iov[0].iov_len - }; - spin_unlock(&ses->ses_lock); - cifs_server_lock(server); - smb311_update_preauth_hash(ses, server, &iov, 1); - cifs_server_unlock(server); + if (num_processed == num_rqst) { spin_lock(&ses->ses_lock); + if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) { + struct kvec iov = { + .iov_base = resp_iov[0].iov_base, + .iov_len = resp_iov[0].iov_len + }; + spin_unlock(&ses->ses_lock); + cifs_server_lock(server); + smb311_update_preauth_hash(ses, server, &iov, 1); + cifs_server_unlock(server); + spin_lock(&ses->ses_lock); + } + spin_unlock(&ses->ses_lock); } - spin_unlock(&ses->ses_lock); -out: /* * This will dequeue all mids. After this it is important that the * demultiplex_thread will not process any of these mids any futher. * This is prevented above by using a noop callback that will not * wake this thread except for the very last PDU. -- 2.52.0

2 1

[PATCH OLK-6.6] [Backport] smb: client: close completed creates on compound wait errors
by Zizhi Wo 26 Oct '26

26 Oct '26

From: Zihan Xi <zihanx(a)nebusec.ai> stable inclusion from stable-v6.6.160 commit 8afc80156b1d9e2cfd02d42c255305fad95b59fc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20391 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 6c5c547f037bc18f0b8d0b5db5a648f8f630ce85 ] compound_send_recv() waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already have opened a remote handle. The earlier mid is then released without invoking handle_cancelled_mid(), leaving the remote handle open because no FID was copied to the caller. Mark completed earlier mids as cancelled when a compound wait or MID synchronization aborts. Keep their response buffers attached while the MIDs are synchronized, and transfer them only after synchronization of the processed responses, so the release path can inspect successful CREATE responses and queue SMB2_close() after a later failure. Account for a remote open only after the close work is allocated and before it is queued, since the caller has not yet updated num_remote_opens. Mark the create+close compound used by smb2_unlink() so it is not closed again. Non-CREATE responses and compounds that already include a close keep their existing behavior. Fixes: e0bba0b85481 ("cifs: add compound_send_recv()") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Assisted-by: LLM Co-developed-by: Luxing Yin <root(a)tr0jan.top> Signed-off-by: Luxing Yin <root(a)tr0jan.top> Signed-off-by: Zihan Xi <zihanx(a)nebusec.ai> Tested-by: Frank Sorenson <sorenson(a)redhat.com> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> [ replaced the upstream cancellation helper with inline loops using midQ and MID_WAIT_CANCELLED under server->mid_lock. ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/smb/client/transport.c [Simple context conflicts.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/smb/client/smb2misc.c | 9 +++-- fs/smb/client/transport.c | 69 ++++++++++++++++++++++++++++++--------- 2 files changed, 59 insertions(+), 19 deletions(-) diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c index 6fa23cf7a529..e37fe2d3b409 100644 --- a/fs/smb/client/smb2misc.c +++ b/fs/smb/client/smb2misc.c @@ -816,11 +816,12 @@ smb2_cancelled_close_fid(struct work_struct *work) * SMB2_CREATE to the server but before we processed the reply, and second * if a close was interrupted before we sent the SMB2_CLOSE to the server. */ static int __smb2_handle_cancelled_cmd(struct cifs_tcon *tcon, __u16 cmd, __u64 mid, - __u64 persistent_fid, __u64 volatile_fid) + __u64 persistent_fid, __u64 volatile_fid, + bool account_remote_open) { struct close_cancelled_open *cancelled; cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL); if (!cancelled) @@ -830,10 +831,12 @@ __smb2_handle_cancelled_cmd(struct cifs_tcon *tcon, __u16 cmd, __u64 mid, cancelled->fid.volatile_fid = volatile_fid; cancelled->tcon = tcon; cancelled->cmd = cmd; cancelled->mid = mid; INIT_WORK(&cancelled->work, smb2_cancelled_close_fid); + if (account_remote_open) + atomic_inc(&tcon->num_remote_opens); WARN_ON(queue_work(cifsiod_wq, &cancelled->work) == false); return 0; } @@ -866,11 +869,11 @@ smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, netfs_trace_tcon_ref_get_cancelled_close); spin_unlock(&tcon->tc_lock); rc = __smb2_handle_cancelled_cmd(tcon, SMB2_CLOSE_HE, 0, - persistent_fid, volatile_fid); + persistent_fid, volatile_fid, false); if (rc) cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_cancelled_close); return rc; } @@ -894,11 +897,11 @@ smb2_handle_cancelled_mid(struct mid_q_entry *mid, struct TCP_Server_Info *serve rc = __smb2_handle_cancelled_cmd(tcon, le16_to_cpu(hdr->Command), le64_to_cpu(hdr->MessageId), rsp->PersistentFileId, - rsp->VolatileFileId); + rsp->VolatileFileId, true); if (rc) cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_cancelled_mid); return rc; } diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c index 9d1f2af27de5..4d7322e895b4 100644 --- a/fs/smb/client/transport.c +++ b/fs/smb/client/transport.c @@ -1079,10 +1079,11 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, struct TCP_Server_Info *server, const int flags, const int num_rqst, struct smb_rqst *rqst, int *resp_buf_type, struct kvec *resp_iov) { int i, j, optype, rc = 0; + int num_processed = 0; struct mid_q_entry *midQ[MAX_COMPOUND]; bool cancelled_mid[MAX_COMPOUND] = {false}; struct cifs_credits credits[MAX_COMPOUND] = { { .value = 0, .instance = 0 } }; @@ -1221,10 +1222,21 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, rc = wait_for_response(server, midQ[i]); if (rc != 0) break; } if (rc != 0) { + /* + * A completed CREATE earlier in the compound chain may have + * opened a remote handle even though a later wait was + * interrupted. Mark it cancelled so __release_mid() invokes + * the existing unmatched-open cleanup. + */ + spin_lock(&server->mid_lock); + for (j = 0; j < i; j++) + midQ[j]->mid_flags |= MID_WAIT_CANCELLED; + spin_unlock(&server->mid_lock); + for (; i < num_rqst; i++) { cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n", midQ[i]->mid, le16_to_cpu(midQ[i]->command)); send_cancel(server, &rqst[i], midQ[i]); spin_lock(&midQ[i]->mid_lock); @@ -1242,59 +1254,84 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, if (rc < 0) goto out; rc = cifs_sync_mid_result(midQ[i], server); if (rc != 0) { + /* + * A previous CREATE may have completed before this + * response failed. Mark it cancelled so its remote + * handle is closed when the mid is released. + */ + spin_lock(&server->mid_lock); + for (j = 0; j < i; j++) + midQ[j]->mid_flags |= MID_WAIT_CANCELLED; + spin_unlock(&server->mid_lock); + /* Keep their response buffers for cancelled-mid cleanup. */ + num_processed = 0; /* mark this mid as cancelled to not free it below */ cancelled_mid[i] = true; goto out; } if (!midQ[i]->resp_buf || midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); + spin_lock(&server->mid_lock); + for (j = 0; j < i; j++) + midQ[j]->mid_flags |= MID_WAIT_CANCELLED; + spin_unlock(&server->mid_lock); + num_processed = 0; goto out; } + rc = server->ops->check_receive(midQ[i], server, + flags & CIFS_LOG_ERROR); + num_processed = i + 1; + } + +out: + /* + * Delay moving response buffers out of their mids until response + * synchronization completes. This lets cancelled-mid cleanup inspect + * an earlier CREATE response if a later MID fails. + */ + for (i = 0; i < num_processed; i++) { buf = (char *)midQ[i]->resp_buf; resp_iov[i].iov_base = buf; resp_iov[i].iov_len = midQ[i]->resp_buf_size + HEADER_PREAMBLE_SIZE(server); if (midQ[i]->large_buf) resp_buf_type[i] = CIFS_LARGE_BUFFER; else resp_buf_type[i] = CIFS_SMALL_BUFFER; - rc = server->ops->check_receive(midQ[i], server, - flags & CIFS_LOG_ERROR); - /* mark it so buf will not be freed by delete_mid */ if ((flags & CIFS_NO_RSP_BUF) == 0) midQ[i]->resp_buf = NULL; - } /* * Compounding is never used during session establish. */ - spin_lock(&ses->ses_lock); - if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) { - struct kvec iov = { - .iov_base = resp_iov[0].iov_base, - .iov_len = resp_iov[0].iov_len - }; - spin_unlock(&ses->ses_lock); - cifs_server_lock(server); - smb311_update_preauth_hash(ses, server, &iov, 1); - cifs_server_unlock(server); + if (num_processed == num_rqst) { spin_lock(&ses->ses_lock); + if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) { + struct kvec iov = { + .iov_base = resp_iov[0].iov_base, + .iov_len = resp_iov[0].iov_len + }; + spin_unlock(&ses->ses_lock); + cifs_server_lock(server); + smb311_update_preauth_hash(ses, server, &iov, 1); + cifs_server_unlock(server); + spin_lock(&ses->ses_lock); + } + spin_unlock(&ses->ses_lock); } - spin_unlock(&ses->ses_lock); -out: /* * This will dequeue all mids. After this it is important that the * demultiplex_thread will not process any of these mids any futher. * This is prevented above by using a noop callback that will not * wake this thread except for the very last PDU. -- 2.52.0

2 1

[PATCH OLK-6.6] md: fix null-ptr-deref in md_check_no_bitmap()
by Zhou Minqiang 26 Oct '26

26 Oct '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10134 -------------------------------- md_check_no_bitmap() dereferences mddev->pers->name to print the personality name when an array has a bitmap configured but the personality does not support bitmaps. Commit 36d091f4759d ("md: protect ->pers changes with mddev->lock") moved the assignment mddev->pers = pers to after pers->run(), so mddev->pers is still NULL when md_check_no_bitmap() is called from the ->run method of raid0 and linear: do_md_run md_run pers->run(mddev) <- mddev->pers still NULL raid0_run / linear_run md_check_no_bitmap mddev->pers->head.name <- NULL pointer dereference The early-return check in md_check_no_bitmap() can be bypassed because the bitmap can be configured while pers is NULL: set_bitmap_file() (via SET_BITMAP_FILE ioctl) sets bitmap_info.file directly, and location_store() (via sysfs bitmap/location) sets bitmap_info.offset. Both md_run() and the level_store() takeover path set mddev->clevel via strscpy(mddev->clevel, pers->name, ...) before calling pers->run(), making mddev->clevel a safe substitute for printing the personality name. Fixes: 36d091f4759d ("md: protect ->pers changes with mddev->lock") Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 643c8f1117c6..80d2bddb9e46 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -1307,7 +1307,7 @@ int md_check_no_bitmap(struct mddev *mddev) if (!mddev->bitmap_info.file && !mddev->bitmap_info.offset) return 0; pr_warn("%s: bitmaps are not supported for %s\n", - mdname(mddev), mddev->pers->name); + mdname(mddev), mddev->clevel); return 1; } EXPORT_SYMBOL(md_check_no_bitmap); -- 2.52.0

2 1

[PATCH OLK-5.10] md: fix null-ptr-deref in md_check_no_bitmap()
by Zhou Minqiang 26 Oct '26

26 Oct '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10134 -------------------------------- md_check_no_bitmap() dereferences mddev->pers->name to print the personality name when an array has a bitmap configured but the personality does not support bitmaps. Commit 36d091f4759d ("md: protect ->pers changes with mddev->lock") moved the assignment mddev->pers = pers to after pers->run(), so mddev->pers is still NULL when md_check_no_bitmap() is called from the ->run method of raid0 and linear: do_md_run md_run pers->run(mddev) <- mddev->pers still NULL raid0_run / linear_run md_check_no_bitmap mddev->pers->head.name <- NULL pointer dereference The early-return check in md_check_no_bitmap() can be bypassed because the bitmap can be configured while pers is NULL: set_bitmap_file() (via SET_BITMAP_FILE ioctl) sets bitmap_info.file directly, and location_store() (via sysfs bitmap/location) sets bitmap_info.offset. Both md_run() and the level_store() takeover path set mddev->clevel via strscpy(mddev->clevel, pers->name, ...) before calling pers->run(), making mddev->clevel a safe substitute for printing the personality name. Fixes: 36d091f4759d ("md: protect ->pers changes with mddev->lock") Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 4ddb56d7408a..2952b178f016 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -1170,7 +1170,7 @@ int md_check_no_bitmap(struct mddev *mddev) if (!mddev->bitmap_info.file && !mddev->bitmap_info.offset) return 0; pr_warn("%s: bitmaps are not supported for %s\n", - mdname(mddev), mddev->pers->name); + mdname(mddev), mddev->clevel); return 1; } EXPORT_SYMBOL(md_check_no_bitmap); -- 2.52.0

2 1

[PATCH OLK-6.6 0/3] CVE-2026-90129
by Jiacheng Yu 26 Oct '26

26 Oct '26

CVE-2026-90129 Denis V. Lunev (3): virtio: add virtio_device_shutdown() helper virtio_balloon: factor out virtballoon_quiesce() virtio_balloon: quiesce balloon work before device shutdown drivers/virtio/virtio.c | 41 ++++++++++++++++++++++----------- drivers/virtio/virtio_balloon.c | 34 +++++++++++++++++++++------ include/linux/virtio.h | 1 + 3 files changed, 55 insertions(+), 21 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/3] some fixes to xSched
by Tang Hui 26 Oct '26

26 Oct '26

Zicheng Qu (3): xsched: fix use-after-free in vstream lookup by user stream id xsched: add debug log for picked entity xsched: make vstream_hbm_free tolerate a missing context kernel/xsched/core.c | 2 ++ kernel/xsched/vstream.c | 31 +++++++++++++++++++------------ 2 files changed, 21 insertions(+), 12 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] iommu/io-pgtable-arm: Add support for contiguous hint
by Zhang Yuwei 26 Oct '26

26 Oct '26

maillist inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8788 ------------------------------------------------------------- Add support for the contiguous hint (CONT) bit in ARM LPAE page tables, following the community v5 mapping and unmapping approach. Keep CONT disabled by default. SMMU drivers opt in with IO_PGTABLE_QUIRK_ARM_CONT_HINT (BIT(12)) before allocating page tables. Mali continues to reject quirks and never advertises CONT sizes. Derive CONT sizes from the architecture-valid base page-size bitmap, guard expansion against overflow, and constrain the result by IAS/OAS. Keep sizes which exactly span the configured address space. Only tag descriptors when the caller selects an advertised CONT size. Do not promote aligned runs of ordinary page mappings internally. Bound the number of groups before converting them to descriptor counts. Check the first and last descriptors of the current unmap batch before clearing PTEs or freeing sub-tables. Reject a partial CONT group with no changes to that batch. Earlier batches in an iommu_unmap() request may already have completed; this is not a whole-request atomicity guarantee. Unlike the community baseline, OLK 6.6 supports splitting leaf blocks on partial unmap. Reject CONT-tagged blocks before entering that path while preserving splitting for ordinary blocks. Suggested-by: Robin Murphy <robin.murphy(a)arm.com> Co-developed-by: Vijayanand Jitta <vijayanand.jitta(a)oss.qualcomm.com> Signed-off-by: Vijayanand Jitta <vijayanand.jitta(a)oss.qualcomm.com> Signed-off-by: Prakash Gupta <prakash.gupta(a)oss.qualcomm.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/io-pgtable-arm.c | 141 +++++++++++++++++++++++++++++---- include/linux/io-pgtable.h | 4 + 2 files changed, 130 insertions(+), 15 deletions(-) diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index aecd5939e7b2..c88b205b49ea 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -93,6 +93,16 @@ /* Software bit for solving coherency races */ #define ARM_LPAE_PTE_SW_SYNC (((arm_lpae_iopte)1) << 55) +/* PTE Contiguous Bit */ +#define ARM_LPAE_PTE_CONT (((arm_lpae_iopte)1) << 52) + +/* + * Granule CONT page Block CONT block L1 block CONT L1 + * 4K 64K 2M 32M 1G 16G + * 16K 2M 32M 1G + * 64K 2M 512M 16G + */ + /* Stage-1 PTE */ #define ARM_LPAE_PTE_AP_UNPRIV (((arm_lpae_iopte)1) << 6) #define ARM_LPAE_PTE_AP_RDONLY_BIT 7 @@ -408,6 +418,24 @@ static arm_lpae_iopte arm_lpae_install_table(arm_lpae_iopte *table, return old; } +static int arm_lpae_num_cont(size_t size) +{ + switch (size) { + case SZ_4K: + case SZ_2M: + case SZ_1G: + return 16; + case SZ_64K: + case SZ_32M: + case SZ_512M: + return 32; + case SZ_16K: + return 128; + default: + return 1; + } +} + static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, phys_addr_t paddr, size_t size, size_t pgcount, arm_lpae_iopte prot, int lvl, arm_lpae_iopte *ptep, @@ -417,19 +445,40 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, size_t block_size = ARM_LPAE_BLOCK_SIZE(lvl, data); size_t tblsz = ARM_LPAE_GRANULE(data); struct io_pgtable_cfg *cfg = &data->iop.cfg; - int ret = 0, num_entries, max_entries, map_idx_start; + int num_cont = arm_lpae_num_cont(block_size); + size_t cont_size = 0, entries_per_map; + int num_entries, max_entries, map_idx_start; + + if (num_cont > 1 && block_size <= SIZE_MAX / num_cont) + cont_size = num_cont * block_size; /* Find our entry at the current level */ map_idx_start = ARM_LPAE_LVL_IDX(iova, lvl, data); ptep += map_idx_start; /* If we can install a leaf entry at this level, then do so */ - if (size == block_size) { + if (size == block_size || + ((cfg->quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT) && + size == cont_size)) { + bool cont = size == cont_size; + int ret; + + if (cont && (!IS_ALIGNED(iova, size) || !IS_ALIGNED(paddr, size))) + return -EINVAL; + + entries_per_map = size / block_size; max_entries = arm_lpae_max_entries(map_idx_start, data); - num_entries = min_t(int, pgcount, max_entries); - ret = arm_lpae_init_pte(data, iova, paddr, prot, lvl, num_entries, ptep); + num_entries = min_t(size_t, pgcount, + max_entries / entries_per_map) * entries_per_map; + if (!num_entries) + return -EINVAL; + if (cont) + prot |= ARM_LPAE_PTE_CONT; + + ret = arm_lpae_init_pte(data, iova, paddr, prot, lvl, + num_entries, ptep); if (!ret) - *mapped += num_entries * size; + *mapped += num_entries * block_size; return ret; } @@ -683,12 +732,19 @@ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data, { arm_lpae_iopte pte; struct io_pgtable *iop = &data->iop; + size_t block_size, cont_size = 0, entries_per_map; + int num_cont; int i = 0, num_entries, max_entries, unmap_idx_start; /* Something went horribly wrong and we ran out of page table */ if (WARN_ON(lvl == ARM_LPAE_MAX_LEVELS)) return 0; + block_size = ARM_LPAE_BLOCK_SIZE(lvl, data); + num_cont = arm_lpae_num_cont(block_size); + if (num_cont > 1 && block_size <= SIZE_MAX / num_cont) + cont_size = num_cont * block_size; + unmap_idx_start = ARM_LPAE_LVL_IDX(iova, lvl, data); ptep += unmap_idx_start; pte = READ_ONCE(*ptep); @@ -696,9 +752,24 @@ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data, return 0; /* If the size matches this level, we're in the right place */ - if (size == ARM_LPAE_BLOCK_SIZE(lvl, data)) { + if (size == block_size || + ((iop->cfg.quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT) && + size == cont_size)) { + entries_per_map = size / block_size; max_entries = arm_lpae_max_entries(unmap_idx_start, data); - num_entries = min_t(int, pgcount, max_entries); + num_entries = min_t(size_t, pgcount, + max_entries / entries_per_map) * entries_per_map; + if (!num_entries) + return 0; + + /* Check this batch before clearing PTEs or freeing sub-tables. */ + if (((pte & ARM_LPAE_PTE_CONT) && + !IS_ALIGNED(iova, cont_size)) || + ((READ_ONCE(ptep[num_entries - 1]) & ARM_LPAE_PTE_CONT) && + !IS_ALIGNED(iova + num_entries * block_size, cont_size))) { + WARN_ON_ONCE(1); + return 0; + } while (i < num_entries) { pte = READ_ONCE(*ptep); @@ -709,19 +780,24 @@ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data, if (!iopte_leaf(pte, lvl, iop->fmt)) { /* Also flush any partial walks */ - io_pgtable_tlb_flush_walk(iop, iova + i * size, size, - ARM_LPAE_GRANULE(data)); + io_pgtable_tlb_flush_walk(iop, + iova + i * block_size, block_size, + ARM_LPAE_GRANULE(data)); __arm_lpae_free_pgtable(data, lvl + 1, iopte_deref(pte, data)); } else if (!iommu_iotlb_gather_queued(gather)) { - io_pgtable_tlb_add_page(iop, gather, iova + i * size, size); + io_pgtable_tlb_add_page(iop, gather, + iova + i * block_size, block_size); } ptep++; i++; } - return i * size; + return i * block_size; } else if (iopte_leaf(pte, lvl, iop->fmt)) { + /* Never split a block that belongs to a CONT group. */ + if (WARN_ON_ONCE(pte & ARM_LPAE_PTE_CONT)) + return 0; /* * Insert a table at the next level to map the old region, * minus the part we want to unmap @@ -856,6 +932,9 @@ static size_t __arm_lpae_split_block(struct arm_lpae_io_pgtable *data, if (size == ARM_LPAE_BLOCK_SIZE(lvl, data)) { if (iopte_leaf(pte, lvl, iop->fmt)) { + /* Splitting one member would invalidate the CONT group. */ + if (WARN_ON_ONCE(pte & ARM_LPAE_PTE_CONT)) + return 0; if (lvl == (ARM_LPAE_MAX_LEVELS - 1) || (pte & ARM_LPAE_PTE_AP_RDONLY)) return size; @@ -919,18 +998,33 @@ static size_t __arm_lpae_merge_page(struct arm_lpae_io_pgtable *data, arm_lpae_iopte pte, *tablep; struct io_pgtable *iop = &data->iop; struct io_pgtable_cfg *cfg = &data->iop.cfg; + int idx, num_cont, i; if (WARN_ON(lvl == ARM_LPAE_MAX_LEVELS)) return 0; - ptep += ARM_LPAE_LVL_IDX(iova, lvl, data); + idx = ARM_LPAE_LVL_IDX(iova, lvl, data); + ptep += idx; pte = READ_ONCE(*ptep); if (WARN_ON(!pte)) return 0; if (size == ARM_LPAE_BLOCK_SIZE(lvl, data)) { - if (iopte_leaf(pte, lvl, iop->fmt)) + if (iopte_leaf(pte, lvl, iop->fmt)) { + if (WARN_ON_ONCE(pte & ARM_LPAE_PTE_CONT)) + return 0; return size; + } + /* Do not replace a table inside a partially split CONT group. */ + num_cont = arm_lpae_num_cont(size); + if ((cfg->quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT) && num_cont > 1) { + arm_lpae_iopte *group = ptep - (idx % num_cont); + + for (i = 0; i < num_cont; i++) { + if (WARN_ON_ONCE(READ_ONCE(group[i]) & ARM_LPAE_PTE_CONT)) + return 0; + } + } /* Race does not exist */ if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_BBML1) { @@ -1295,8 +1389,23 @@ static void arm_lpae_restrict_pgsizes(struct io_pgtable_cfg *cfg) } cfg->pgsize_bitmap &= page_sizes; + if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_CONT_HINT) { + unsigned long sizes = cfg->pgsize_bitmap; + + while (sizes) { + unsigned long size = BIT(__ffs(sizes)); + int num_cont = arm_lpae_num_cont(size); + + if (size <= ULONG_MAX / num_cont) + cfg->pgsize_bitmap |= num_cont * size; + sizes &= ~size; + } + } + cfg->ias = min(cfg->ias, max_addr_bits); cfg->oas = min(cfg->oas, max_addr_bits); + cfg->pgsize_bitmap &= GENMASK_ULL(cfg->ias, 0); + cfg->pgsize_bitmap &= GENMASK_ULL(cfg->oas, 0); } static struct arm_lpae_io_pgtable * @@ -1358,7 +1467,8 @@ arm_64_lpae_alloc_pgtable_s1(struct io_pgtable_cfg *cfg, void *cookie) IO_PGTABLE_QUIRK_ARM_HD | IO_PGTABLE_QUIRK_ARM_BBML1 | IO_PGTABLE_QUIRK_ARM_BBML2 | - IO_PGTABLE_QUIRK_HISI_ERRATA)) + IO_PGTABLE_QUIRK_HISI_ERRATA | + IO_PGTABLE_QUIRK_ARM_CONT_HINT)) return NULL; data = arm_lpae_alloc_pgtable(cfg); @@ -1464,7 +1574,8 @@ arm_64_lpae_alloc_pgtable_s2(struct io_pgtable_cfg *cfg, void *cookie) IO_PGTABLE_QUIRK_ARM_BBML1 | IO_PGTABLE_QUIRK_ARM_BBML2 | IO_PGTABLE_QUIRK_ARM_S2FWB | - IO_PGTABLE_QUIRK_HISI_ERRATA)) + IO_PGTABLE_QUIRK_HISI_ERRATA | + IO_PGTABLE_QUIRK_ARM_CONT_HINT)) return NULL; data = arm_lpae_alloc_pgtable(cfg); diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h index 62a0c5b0f55f..1febcede3791 100644 --- a/include/linux/io-pgtable.h +++ b/include/linux/io-pgtable.h @@ -98,6 +98,9 @@ struct io_pgtable_cfg { * IO_PGTABLE_QUIRK_ARM_BBML2: ARM SMMU supports BBM Level 2 behavior * when changing block size. * IO_PGTABLE_QUIRK_ARM_S2FWB: Use the FWB format for the MemAttrs bits + * IO_PGTABLE_QUIRK_ARM_CONT_HINT: Enable contiguous hints for ARM LPAE. + * Disabled by default; drivers opt in before alloc_io_pgtable_ops(). + * Only mappings using an advertised CONT group size are tagged. */ #define IO_PGTABLE_QUIRK_ARM_NS BIT(0) #define IO_PGTABLE_QUIRK_NO_PERMS BIT(1) @@ -110,6 +113,7 @@ struct io_pgtable_cfg { #define IO_PGTABLE_QUIRK_ARM_BBML2 BIT(9) #define IO_PGTABLE_QUIRK_ARM_S2FWB BIT(10) #define IO_PGTABLE_QUIRK_HISI_ERRATA BIT(11) + #define IO_PGTABLE_QUIRK_ARM_CONT_HINT BIT(12) unsigned long quirks; unsigned long pgsize_bitmap; unsigned int ias; -- 2.22.0

2 1

[PATCH OLK-6.6 0/4] arm64: Allow CPU0 to be nohz_full
by Xia Fukun 26 Oct '26

26 Oct '26

The upstream commits 2f1a6fbbef77, 9ca12ac04bb7, 9219565aa890 and 08ae95f4fd3b provide the generic framework to allow the boot CPU to be nohz_full. x86 and PowerPC already benefit from it. However, on arm64, CPU0 still cannot be put into the nohz_full/isolcpus range due to two obstacles: 1. The cpu_present_mask of arm64 is populated rather late (in smp_prepare_cpus()), because only CPUs with GICC entries marked as ACPI_MADT_ENABLED can be marked present. When 'isolcpus=' or 'nohz_full=' is parsed during early boot, only CPU0 is present, so the present check in housekeeping_setup() forcibly pulls CPU0 back into the housekeeping mask, which breaks the isolation. 2. The framework requires the arch to declare ARCH_SUSPEND_NONZERO_CPU so that a non-zero CPU can act as the primary CPU for suspend/hibernate/kexec. arm64 did not define it. This series removes the two obstacles: Patch 1/4 skips the unreliable early present check (present does not guarantee the CPU will be brought up online) when the new boot param 'support_cpu0_nohz_full' is given, keeping only the "housekeeping mask must not be empty" fallback. Patch 2/4 adds check_housekeeping_cpu_online() at the end of smp_init() as the safety net: after all CPUs are onlined, it verifies that every configured housekeeping type has at least one CPU online, and BUG()s with a clear message otherwise ("early release, late check"). Patch 3/4 declares ARCH_SUSPEND_NONZERO_CPU for arm64 (PSCI does not restrict which CPU enters suspend), and gates the behavior change with the 'support_cpu0_nohz_full' boot param, so the default behavior is unchanged. Patch 4/4 enables the two configs in openeuler_defconfig explicitly. With "support_cpu0_nohz_full isolcpus=0-N nohz_full=0-N" on the kernel command line, all CPUs including CPU0 can be isolated for latency critical workloads, while the timekeeping, RCU and workqueue duties converge on the remaining housekeeping CPUs. This series is the OLK-6.6 adaptation of the same feature merged in OLK-5.10 (original author Xiongfeng Wang). Xiongfeng Wang (4): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether there exists a housekeeping CPU online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arm64: defconfig: Enable CONFIG_PM_SLEEP_SMP_NONZERO_CPU and CONFIG_ARCH_SUSPEND_NONZERO_CPU arch/arm64/Kconfig | 3 ++ arch/arm64/configs/openeuler_defconfig | 2 ++ include/linux/cpu.h | 5 ++- include/linux/sched/isolation.h | 2 ++ include/linux/tick.h | 2 ++ kernel/sched/isolation.c | 45 ++++++++++++++++++++++---- kernel/smp.c | 4 +++ kernel/time/tick-sched.c | 11 ++++++- 8 files changed, 65 insertions(+), 9 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] ice: fix metadata_dst refcount handling on representor teardown
by Pu Lehui 26 Oct '26

26 Oct '26

From: Tristan Madani <tristan(a)talencesecurity.com> stable inclusion from stable-v6.6.160 commit 1f263235651775f93c15d90c9f25c3f4a4ef6512 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20929 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 58858b8f14803a7eeac297b3ce20f3b21bf2ff66 ] ice_eswitch_release_repr() uses metadata_dst_free() to release the representor's metadata_dst. metadata_dst_free() directly frees the underlying memory without checking the dst_entry refcount. When ice_eswitch_port_start_xmit() processes a packet, it takes a reference via dst_hold() and attaches the metadata_dst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadata_dst is freed while references are still held. Use dst_release() instead, which correctly decrements the refcount and only frees the object when all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set. Other drivers sharing this pattern (nfp, airoha, bnxt) already use dst_release() for their metadata_dst lifecycle. Fixes: f5396b8a663f7 ("ice: switchdev slow path") Cc: stable(a)vger.kernel.org Signed-off-by: Tristan Madani <tristan(a)talencesecurity.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Link: https://patch.msgid.link/20260928230429.495442-5-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> [ sashal: Adapted repr->dst access to vf->repr->dst in ice_eswitch_release_reprs(). ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_eswitch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ice/ice_eswitch.c b/drivers/net/ethernet/intel/ice/ice_eswitch.c index e7f1e53314d7..528ca4be2b64 100644 --- a/drivers/net/ethernet/intel/ice/ice_eswitch.c +++ b/drivers/net/ethernet/intel/ice/ice_eswitch.c @@ -207,7 +207,7 @@ ice_eswitch_release_reprs(struct ice_pf *pf, struct ice_vsi *ctrl_vsi) continue; ice_vsi_update_security(vsi, ice_vsi_ctx_set_antispoof); - metadata_dst_free(vf->repr->dst); + dst_release(&vf->repr->dst->dst); vf->repr->dst = NULL; ice_eswitch_del_vf_sp_rule(vf); ice_fltr_add_mac_and_broadcast(vsi, vf->hw_lan_addr, -- 2.34.1

2 1

[PATCH OLK-6.6 v4 00/14] net: dynthread: dynamic threaded NAPI scheduler
by Cai Xinchen 26 Oct '26

26 Oct '26

This series makes the NAPI/queue/IRQ relationship visible to the network stack, backports the drivers and locking fixes it needs, and then builds net/dynthread on top of it: a loadable module that adapts the NAPI processing and the RX queue IRQ placement of a set of net devices to the scheduling behaviour of a target application at runtime. Motivation ---------- Interrupt and softirq processing of network RX competes with latency sensitive applications (e.g. mysqld) for CPU time. When such an application runs for a long time on a CPU without blocking, the softirq work of the NIC completion queues can preempt it on the same CPU and inflate its tail latency. The usual remedies are to steer the RX queue IRQs to other CPUs and/or to move NAPI processing into kernel threads bound to spare CPUs, but a static configuration cannot follow the application: once the target goes idle, is scheduled in short bursts, or is displaced, the reserved CPUs are simply wasted. To do this from a module, the queue a NAPI instance serves, the NAPI instance of a queue and the interrupt vector of that NAPI must be discoverable. Mainline added that association in v6.8/v6.9 (queue/NAPI pointer, netif_napi_set_irq(), mlx5e conversion) together with the RTNL fixes it requires. Patches 1-8 of this series backport that infrastructure, adapt it to the OLK KABI layout and fix the mlx5e lock ordering; patches 9-14 add the scheduler. Approach -------- The module periodically samples the scheduling statistics of all threads matching the appname module parameter and classifies them into one of five statuses (DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION, LONG_RUNNING_WITH_INTERRUPTS). Acting on that status it: - restores the RX queue IRQs to their original affinity when the target is gone or barely running; - spreads the IRQs over the NUMA node of their queues when processing in softirq context is acceptable again; - switches the NAPI processing of the configured net devices to kernel threads and binds the NAPI threads (and, optionally, the queue IRQs) to the CPUs of their NUMA node that the target tasks are not allowed to use; - scales the number of CPUs used by those threads with their measured load while the target stays in the long-running status. An unusable sample (counters moved backwards: DATA_LOSS) keeps the previous status, so a single bad sample cannot toggle the mode. Everything is controlled through module parameters, and the original IRQ affinity and NAPI mode are restored when the target disappears, the scheduler is disabled or the module is unloaded. The module is buildable only as a loadable module; the Kconfig entry currently allows ARM64 and it is enabled in the arm64 openeuler defconfig. Patch breakdown --------------- 1/14 net: Add queue and napi association Backport the queue <-> NAPI mapping: add enum netdev_queue_type, a napi pointer to struct netdev_queue and struct netdev_rx_queue, and netif_queue_set_napi() to set or clear it for RX and TX queues. The new netdev_queue field is put into reserve space so the layout of the structure is preserved. 2/14 net: fix KABI breakage for queue napi association Keep the struct layout stable across the backport: use the reserved domain segment of KABI 1 for netdev_queue and KABI 2 for netdev_rx_queue. 3/14 net: Add NAPI IRQ support Add napi->irq and netif_napi_set_irq(), so a driver can publish the interrupt vector that serves a NAPI instance. It is initialized to -1 by netif_napi_add_weight() and stays unknown for drivers that do not call the setter. The ice and netdev-genl/netlink parts of the upstream patch are not needed here and are dropped. 4/14 net: Fix napi irq KABI breakage Store napi->irq in the reserved domain segment of KABI 1 so that the napi_struct layout does not change. 5/14 net/mlx5e: link NAPI instances to queues and IRQs Make mlx5e call netif_napi_set_irq() when a channel is opened and register/clear the queue/NAPI association for its RX and TX queues (including the PTP queues) when they are activated/deactivated. This is also what users of the queue GET netlink API expect. 6/14 net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation netif_queue_set_napi() asserts RTNL for a registered netdev, so take the lock in the mlx5e TX reporter recovery paths that activate or deactivate queues without it. 7/14 net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover The RTNL has to be acquired before priv->state_lock in the PTP SQ recovery. Move the lock acquisition up so the order matches the probe and channel switch paths. 8/14 net/mlx5e: Do not block on RTNL while recovering an SQ The recovery callbacks run synchronously from devlink_health_report() under the devlink lock, from SQ work items, while channel teardown holds the RTNL and waits for those work items with cancel_work_sync(). Replace the blocking rtnl_lock() with rtnl_trylock() and abandon the recovery when the SQ has been disabled by the teardown, following the existing mlx5e_tx_timeout_work() pattern. This avoids a deadlock that also stalled all devlink operations on the device. 9/14 net: dynthread: Add dynamic threaded NAPI scheduler framework Wire the new directory into net/Kconfig and net/Makefile, add the NET_DYNTHREAD Kconfig entry (ARM64, module only) and the module skeleton. On load the module takes a reference on each device given with the '#' separated ifname parameter, walks the IRQ descriptor table through the exported irq_get_irq_data(), snapshots desc->action and the effective affinity under desc->lock, and records the IRQ number and the original affinity CPU of every RX queue. IRQs are matched against the device name, its parent device name and the irqname pattern. Also count the NUMA nodes the recorded queues span, drop the device references on unload, and unwind a partially failed init. 10/14 net: dynthread: Monitor the load of the target tasks Add the sampling loop and the status judgement. Every dyn_threaded_interval ms, every monitored thread whose name matches appname contributes its runtime, voluntary/involuntary context switches and its allowed CPU mask; the masks are unioned to know where the target may run. The sample is compared with the previous one to derive the average runtime per switch, the nvcsw percentage and the CPU load, and to classify it as DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION or LONG_RUNNING_WITH_INTERRUPTS. Add the periodic hrtimer/work worker, the dynthreaded enable/disable parameter, a mutex serializing the worker control, a zeroed baseline on every enable, and the last_status tracking used to carry the transition sample. 11/14 net: dynthread: Steer the RX queue IRQs away from the target tasks Manage the affinity of the recorded RX queue IRQs. When the target tasks sit in a single NUMA node and enough CPUs of that node are free, move all queue IRQs there round-robin; when the target is gone or barely running, restore the affinity recorded at load time; when the target is fragmented, spread the IRQs over a subset of their own NUMA node sized from dyn_threaded_irq_cpucore_per. Track the "bound to one node" state so spreading is suppressed while it is active, and clear it on every recovery. All of this is skipped when dyn_threaded_bindirq is off, and the IRQ affinity is restored when the worker is stopped. 12/14 net: dynthread: Switch NAPI to threads on spare CPUs Enable threaded NAPI (dev_set_threaded) on the monitored devices in LONG_RUNNING_WITH_INTERRUPTS and bind each NAPI thread from the NUMA node of its queue IRQ: use the whole node if the target is not there, the target-free CPUs of the node if any, otherwise the first dyn_threaded_corenum CPUs of the node. Use napi->irq when the driver published it and fall back to the RX queue IRQ recorded by the module (e.g. hns3) otherwise. The NAPI list is built by head insertion, so it is walked in reverse to visit the NAPIs in registration (vector) order, matching the ascending order in which the RX queue IRQs are recorded. Optionally bind the queue IRQ to the same mask. Record the CPUs used by the NAPI threads in napi_cpumask for the load evaluation of the next patch. Switch the devices back to softirq mode in NO_TASK, NOT_RUNNING and FRAGMENTATION, when the scheduler is disabled and on module unload; the NAPI and IRQ operations run under the rtnetlink lock. 13/14 net: dynthread: Scale the number of NAPI thread CPUs Sample the kernel_cpustat of the CPUs used by the NAPI threads and compare consecutive periods. Grow dyn_threaded_corenum when the irq/softirq share or the total load of those CPUs is too high, and shrink it when the user share is high or the total load is low, within the lower/upper limit parameters. Damping and anti-fight rules avoid oscillating right after a change or undoing a change made for the opposite reason; the two total-load driven directions check each other, and the cpustat baseline is taken over the mask that was actually just bound. The default core count is computed at init from the busiest device's RX queue count divided by the online NUMA nodes. The lower/upper limit parameters reject zero and an inverted range, refuse a change that would move the computed default out of range, and clamp the current core count into the new range. Reset the damping state and the baseline when leaving the long-running status or when the scheduler is stopped, and serialize the core-count updates with the module parameter setter. 14/14 net: dynthread: Add debug switch and instrumentation Add the dyn_threaded_debug module parameter and instrument the periodic sampling, the status transitions, the IRQ affinity decisions, the NAPI thread masks and the CPU-count resizes. The messages are recorded with trace_printk() so they can be read from tracefs without flooding the console; without tracing support they fall back to dynamic debug. The switch is off by default. Amritha Nambiar (2): net: Add queue and napi association net: Add NAPI IRQ support Cai Xinchen (7): net/mlx5e: Do not block on RTNL while recovering an SQ net: dynthread: Add dynamic threaded NAPI scheduler framework net: dynthread: Monitor the load of the target tasks net: dynthread: Steer the RX queue IRQs away from the target tasks net: dynthread: Switch NAPI to threads on spare CPUs net: dynthread: Scale the number of NAPI thread CPUs net: dynthread: Add debug switch and instrumentation Carolina Jubran (1): net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation Cosmin Ratiu (1): net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover JiangJieHua (2): net: fix KABI breakage for queue napi association net: Fix napi irq KABI breakage Joe Damato (1): net/mlx5e: link NAPI instances to queues and IRQs arch/arm64/configs/openeuler_defconfig | 1 + .../net/ethernet/mellanox/mlx5/core/en/ptp.c | 5 +- .../mellanox/mlx5/core/en/reporter_tx.c | 23 + .../net/ethernet/mellanox/mlx5/core/en_main.c | 7 + include/linux/netdevice.h | 21 +- include/net/netdev_rx_queue.h | 2 +- net/Kconfig | 1 + net/Makefile | 1 + net/core/dev.c | 38 + net/dynthread/Kconfig | 13 + net/dynthread/Makefile | 2 + net/dynthread/net_dynthread.c | 1493 +++++++++++++++++ 12 files changed, 1603 insertions(+), 4 deletions(-) create mode 100644 net/dynthread/Kconfig create mode 100644 net/dynthread/Makefile create mode 100644 net/dynthread/net_dynthread.c -- 2.18.0.huawei.25

2 15

[PATCH OLK-6.6 v4 00/14] net: dynthread: dynamic threaded NAPI scheduler
by Cai Xinchen 26 Oct '26

26 Oct '26

s series makes the NAPI/queue/IRQ relationship visible to the network stack, backports the drivers and locking fixes it needs, and then builds net/dynthread on top of it: a loadable module that adapts the NAPI processing and the RX queue IRQ placement of a set of net devices to the scheduling behaviour of a target application at runtime. Motivation ---------- Interrupt and softirq processing of network RX competes with latency sensitive applications (e.g. mysqld) for CPU time. When such an application runs for a long time on a CPU without blocking, the softirq work of the NIC completion queues can preempt it on the same CPU and inflate its tail latency. The usual remedies are to steer the RX queue IRQs to other CPUs and/or to move NAPI processing into kernel threads bound to spare CPUs, but a static configuration cannot follow the application: once the target goes idle, is scheduled in short bursts, or is displaced, the reserved CPUs are simply wasted. To do this from a module, the queue a NAPI instance serves, the NAPI instance of a queue and the interrupt vector of that NAPI must be discoverable. Mainline added that association in v6.8/v6.9 (queue/NAPI pointer, netif_napi_set_irq(), mlx5e conversion) together with the RTNL fixes it requires. Patches 1-8 of this series backport that infrastructure, adapt it to the OLK KABI layout and fix the mlx5e lock ordering; patches 9-14 add the scheduler. Approach -------- The module periodically samples the scheduling statistics of all threads matching the appname module parameter and classifies them into one of five statuses (DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION, LONG_RUNNING_WITH_INTERRUPTS). Acting on that status it: - restores the RX queue IRQs to their original affinity when the target is gone or barely running; - spreads the IRQs over the NUMA node of their queues when processing in softirq context is acceptable again; - switches the NAPI processing of the configured net devices to kernel threads and binds the NAPI threads (and, optionally, the queue IRQs) to the CPUs of their NUMA node that the target tasks are not allowed to use; - scales the number of CPUs used by those threads with their measured load while the target stays in the long-running status. An unusable sample (counters moved backwards: DATA_LOSS) keeps the previous status, so a single bad sample cannot toggle the mode. Everything is controlled through module parameters, and the original IRQ affinity and NAPI mode are restored when the target disappears, the scheduler is disabled or the module is unloaded. The module is buildable only as a loadable module; the Kconfig entry currently allows ARM64 and it is enabled in the arm64 openeuler defconfig. Patch breakdown --------------- 1/14 net: Add queue and napi association Backport the queue <-> NAPI mapping: add enum netdev_queue_type, a napi pointer to struct netdev_queue and struct netdev_rx_queue, and netif_queue_set_napi() to set or clear it for RX and TX queues. The new netdev_queue field is put into reserve space so the layout of the structure is preserved. 2/14 net: fix KABI breakage for queue napi association Keep the struct layout stable across the backport: use the reserved domain segment of KABI 1 for netdev_queue and KABI 2 for netdev_rx_queue. 3/14 net: Add NAPI IRQ support Add napi->irq and netif_napi_set_irq(), so a driver can publish the interrupt vector that serves a NAPI instance. It is initialized to -1 by netif_napi_add_weight() and stays unknown for drivers that do not call the setter. The ice and netdev-genl/netlink parts of the upstream patch are not needed here and are dropped. 4/14 net: Fix napi irq KABI breakage Store napi->irq in the reserved domain segment of KABI 1 so that the napi_struct layout does not change. 5/14 net/mlx5e: link NAPI instances to queues and IRQs Make mlx5e call netif_napi_set_irq() when a channel is opened and register/clear the queue/NAPI association for its RX and TX queues (including the PTP queues) when they are activated/deactivated. This is also what users of the queue GET netlink API expect. 6/14 net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation netif_queue_set_napi() asserts RTNL for a registered netdev, so take the lock in the mlx5e TX reporter recovery paths that activate or deactivate queues without it. 7/14 net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover The RTNL has to be acquired before priv->state_lock in the PTP SQ recovery. Move the lock acquisition up so the order matches the probe and channel switch paths. 8/14 net/mlx5e: Do not block on RTNL while recovering an SQ The recovery callbacks run synchronously from devlink_health_report() under the devlink lock, from SQ work items, while channel teardown holds the RTNL and waits for those work items with cancel_work_sync(). Replace the blocking rtnl_lock() with rtnl_trylock() and abandon the recovery when the SQ has been disabled by the teardown, following the existing mlx5e_tx_timeout_work() pattern. This avoids a deadlock that also stalled all devlink operations on the device. 9/14 net: dynthread: Add dynamic threaded NAPI scheduler framework Wire the new directory into net/Kconfig and net/Makefile, add the NET_DYNTHREAD Kconfig entry (ARM64, module only) and the module skeleton. On load the module takes a reference on each device given with the '#' separated ifname parameter, walks the IRQ descriptor table through the exported irq_get_irq_data(), snapshots desc->action and the effective affinity under desc->lock, and records the IRQ number and the original affinity CPU of every RX queue. IRQs are matched against the device name, its parent device name and the irqname pattern. Also count the NUMA nodes the recorded queues span, drop the device references on unload, and unwind a partially failed init. 10/14 net: dynthread: Monitor the load of the target tasks Add the sampling loop and the status judgement. Every dyn_threaded_interval ms, every monitored thread whose name matches appname contributes its runtime, voluntary/involuntary context switches and its allowed CPU mask; the masks are unioned to know where the target may run. The sample is compared with the previous one to derive the average runtime per switch, the nvcsw percentage and the CPU load, and to classify it as DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION or LONG_RUNNING_WITH_INTERRUPTS. Add the periodic hrtimer/work worker, the dynthreaded enable/disable parameter, a mutex serializing the worker control, a zeroed baseline on every enable, and the last_status tracking used to carry the transition sample. 11/14 net: dynthread: Steer the RX queue IRQs away from the target tasks Manage the affinity of the recorded RX queue IRQs. When the target tasks sit in a single NUMA node and enough CPUs of that node are free, move all queue IRQs there round-robin; when the target is gone or barely running, restore the affinity recorded at load time; when the target is fragmented, spread the IRQs over a subset of their own NUMA node sized from dyn_threaded_irq_cpucore_per. Track the "bound to one node" state so spreading is suppressed while it is active, and clear it on every recovery. All of this is skipped when dyn_threaded_bindirq is off, and the IRQ affinity is restored when the worker is stopped. 12/14 net: dynthread: Switch NAPI to threads on spare CPUs Enable threaded NAPI (dev_set_threaded) on the monitored devices in LONG_RUNNING_WITH_INTERRUPTS and bind each NAPI thread from the NUMA node of its queue IRQ: use the whole node if the target is not there, the target-free CPUs of the node if any, otherwise the first dyn_threaded_corenum CPUs of the node. Use napi->irq when the driver published it and fall back to the RX queue IRQ recorded by the module (e.g. hns3) otherwise. The NAPI list is built by head insertion, so it is walked in reverse to visit the NAPIs in registration (vector) order, matching the ascending order in which the RX queue IRQs are recorded. Optionally bind the queue IRQ to the same mask. Record the CPUs used by the NAPI threads in napi_cpumask for the load evaluation of the next patch. Switch the devices back to softirq mode in NO_TASK, NOT_RUNNING and FRAGMENTATION, when the scheduler is disabled and on module unload; the NAPI and IRQ operations run under the rtnetlink lock. 13/14 net: dynthread: Scale the number of NAPI thread CPUs Sample the kernel_cpustat of the CPUs used by the NAPI threads and compare consecutive periods. Grow dyn_threaded_corenum when the irq/softirq share or the total load of those CPUs is too high, and shrink it when the user share is high or the total load is low, within the lower/upper limit parameters. Damping and anti-fight rules avoid oscillating right after a change or undoing a change made for the opposite reason; the two total-load driven directions check each other, and the cpustat baseline is taken over the mask that was actually just bound. The default core count is computed at init from the busiest device's RX queue count divided by the online NUMA nodes. The lower/upper limit parameters reject zero and an inverted range, refuse a change that would move the computed default out of range, and clamp the current core count into the new range. Reset the damping state and the baseline when leaving the long-running status or when the scheduler is stopped, and serialize the core-count updates with the module parameter setter. 14/14 net: dynthread: Add debug switch and instrumentation Add the dyn_threaded_debug module parameter and instrument the periodic sampling, the status transitions, the IRQ affinity decisions, the NAPI thread masks and the CPU-count resizes. The messages are recorded with trace_printk() so they can be read from tracefs without flooding the console; without tracing support they fall back to dynamic debug. The switch is off by default. Amritha Nambiar (2): net: Add queue and napi association net: Add NAPI IRQ support Cai Xinchen (7): net/mlx5e: Do not block on RTNL while recovering an SQ net: dynthread: Add dynamic threaded NAPI scheduler framework net: dynthread: Monitor the load of the target tasks net: dynthread: Steer the RX queue IRQs away from the target tasks net: dynthread: Switch NAPI to threads on spare CPUs net: dynthread: Scale the number of NAPI thread CPUs net: dynthread: Add debug switch and instrumentation Carolina Jubran (1): net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation Cosmin Ratiu (1): net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover JiangJieHua (2): net: fix KABI breakage for queue napi association net: Fix napi irq KABI breakage Joe Damato (1): net/mlx5e: link NAPI instances to queues and IRQs arch/arm64/configs/openeuler_defconfig | 1 + .../net/ethernet/mellanox/mlx5/core/en/ptp.c | 5 +- .../mellanox/mlx5/core/en/reporter_tx.c | 23 + .../net/ethernet/mellanox/mlx5/core/en_main.c | 7 + include/linux/netdevice.h | 21 +- include/net/netdev_rx_queue.h | 2 +- net/Kconfig | 1 + net/Makefile | 1 + net/core/dev.c | 38 + net/dynthread/Kconfig | 13 + net/dynthread/Makefile | 2 + net/dynthread/net_dynthread.c | 1494 +++++++++++++++++ 12 files changed, 1604 insertions(+), 4 deletions(-) create mode 100644 net/dynthread/Kconfig create mode 100644 net/dynthread/Makefile create mode 100644 net/dynthread/net_dynthread.c -- 2.18.0.huawei.25

2 15

[PATCH OLK-6.6 0/2] CVE-2026-98800
by Pu Lehui 26 Oct '26

26 Oct '26

Florent Revest (Anthropic) (1): bpf: Wait for an RCU tasks grace period before freeing trampoline progs Pu Lehui (1): bpf: Fix kabi breakage in struct bpf_prog_aux include/linux/bpf.h | 1 + kernel/bpf/syscall.c | 19 ++++++++++++++++++- kernel/bpf/trampoline.c | 1 + 3 files changed, 20 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2026-97563 and CVE-2026-97565
by Yifan Qiao 26 Oct '26

26 Oct '26

Diego Oliva (2): smb: client: reject short READ responses in CIFSSMBRead() smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() fs/cifs/cifssmb.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 0/9] add ksm_only_merge_zero_pages mode and some fixes
by Jinjiang Tu 26 Oct '26

26 Oct '26

Andrew Morton (1): mm/hugetlb.c: undo errant change Chengming Zhou (2): mm/ksm: refactor out try_to_merge_with_zero_page() mm/ksm: don't waste time searching stable tree for fast changing page Jinjiang Tu (4): mm/ksm: fix ksm exec support for prctl mm/memcontrol: add ksm state for memcg mm/memcontrol: enable KSM for tasks moving to new memcg mm/ksm: add ksm_only_merge_zero_pages mode to merge zero pages only Johannes Weiner (1): mm: page_alloc: avoid kswapd thrashing due to NUMA restrictions Stefan Roesch (1): mm/ksm: support fork/exec for prctl fs/exec.c | 11 ++ include/linux/ksm.h | 14 +++ include/linux/memcontrol.h | 4 + include/linux/sched/coredump.h | 8 +- mm/ksm.c | 190 +++++++++++++++++++++++++-------- mm/memcontrol.c | 67 +++++++++++- mm/page_alloc.c | 24 +++++ 7 files changed, 270 insertions(+), 48 deletions(-) -- 2.43.0

2 10

[PATCH OLK-6.6] scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
by Zizhi Wo 23 Oct '26

23 Oct '26

From: Nilesh Javali <njavali(a)marvell.com> stable inclusion from stable-v6.6.160 commit 2e6f60adf609c77e828f64e0cd371920bef91c12 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20146 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 34a40e0dff940ac5eba494a69b553ea571e24873 ] qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing bugs exposed on the error path of qla25xx_create_{req,rsp}_que(): 1. When dma_alloc_coherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dma_free_coherent() with a NULL cpu_addr is undefined behavior and can panic. 2. The free functions clear req_qid_map / rsp_qid_map under vport_lock, but the create functions protect the same bitmaps with mq_lock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mq_lock before calling the free function, creating a window where another thread can allocate the same que_id and have its ha->req_q_map entry clobbered by the subsequent lockless NULL assignment in the free function. Fix by: - Guarding dma_free_coherent() with a NULL check on the ring pointer. - Using mq_lock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit. - Removing the now-redundant clear_bit blocks from the create error paths since the free functions handle it atomically. Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Reviewed-by: Hannes Reinecke <hare(a)kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-41-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp(a)kernel.org> Backport adaptation for the stable tree: the 29xx IOCB size-selection helpers are absent, and queue creation still allocates fixed-size entries. Initialize the local req_entry_size and rsp_entry_size values with sizeof(request_t) and sizeof(response_t), respectively, so DMA freeing continues to match allocation without adding helper functions or 29xx support. Retain all NULL-ring guards, mq_lock protection, and removal of the premature bitmap clears. Keep the response-ring cleanup layout used by upstream so target commit 19788a55cab61d78e33e0914a5a31d27843e8a4a applies unchanged. Stable-dep-of: 19788a55cab6 ("scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/qla2xxx/qla_mid.c [Simple context conflicts.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/scsi/qla2xxx/qla_mid.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c index 4029b7942e21..86c0217d1763 100644 --- a/drivers/scsi/qla2xxx/qla_mid.c +++ b/drivers/scsi/qla2xxx/qla_mid.c @@ -572,30 +572,34 @@ qla24xx_create_vhost(struct fc_vport *fc_vport) static void qla25xx_free_req_que(struct scsi_qla_host *vha, struct req_que *req) { struct qla_hw_data *ha = vha->hw; uint16_t que_id = req->id; + size_t req_entry_size = sizeof(request_t); - dma_free_coherent(&ha->pdev->dev, (req->length + 1) * - sizeof(request_t), req->ring, req->dma); + if (req->ring) + dma_free_coherent(&ha->pdev->dev, + (req->length + 1) * req_entry_size, + req->ring, req->dma); req->ring = NULL; req->dma = 0; if (que_id) { + mutex_lock(&ha->mq_lock); ha->req_q_map[que_id] = NULL; - mutex_lock(&ha->vport_lock); clear_bit(que_id, ha->req_qid_map); - mutex_unlock(&ha->vport_lock); + mutex_unlock(&ha->mq_lock); } kfree(req->outstanding_cmds); kfree(req); } static void qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) { struct qla_hw_data *ha = vha->hw; uint16_t que_id = rsp->id; + size_t rsp_entry_size = sizeof(response_t); if (rsp->msix && rsp->msix->have_irq) { free_irq(rsp->msix->vector, rsp->msix->handle); rsp->msix->have_irq = 0; rsp->msix->in_use = 0; @@ -604,19 +608,21 @@ qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) /* Flush any queued response work before freeing the queue/qpair. */ if (rsp->qpair && ha->wq) cancel_work_sync(&rsp->qpair->q_work); - dma_free_coherent(&ha->pdev->dev, (rsp->length + 1) * - sizeof(response_t), rsp->ring, rsp->dma); + if (rsp->ring) + dma_free_coherent(&ha->pdev->dev, + (rsp->length + 1) * rsp_entry_size, + rsp->ring, rsp->dma); rsp->ring = NULL; rsp->dma = 0; if (que_id) { + mutex_lock(&ha->mq_lock); ha->rsp_q_map[que_id] = NULL; - mutex_lock(&ha->vport_lock); clear_bit(que_id, ha->rsp_qid_map); - mutex_unlock(&ha->vport_lock); + mutex_unlock(&ha->mq_lock); } kfree(rsp); } int @@ -797,13 +803,10 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options, if (startqp) { ret = qla25xx_init_req_que(base_vha, req); if (ret != QLA_SUCCESS) { ql_log(ql_log_fatal, base_vha, 0x00df, "%s failed.\n", __func__); - mutex_lock(&ha->mq_lock); - clear_bit(que_id, ha->req_qid_map); - mutex_unlock(&ha->mq_lock); goto que_failed; } vha->flags.qpairs_req_created = 1; } @@ -911,13 +914,10 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, if (startqp) { ret = qla25xx_init_rsp_que(base_vha, rsp); if (ret != QLA_SUCCESS) { ql_log(ql_log_fatal, base_vha, 0x00e7, "%s failed.\n", __func__); - mutex_lock(&ha->mq_lock); - clear_bit(que_id, ha->rsp_qid_map); - mutex_unlock(&ha->mq_lock); goto que_failed; } vha->flags.qpairs_rsp_created = 1; } rsp->req = NULL; -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] resolve hungtask
by Chen Jinghuang 23 Oct '26

23 Oct '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix struct sched_entity kabi broken Ingo Molnar (1): sched/fair: Separate se->vlag from se->vprot include/linux/sched.h | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
by Zizhi Wo 23 Oct '26

23 Oct '26

From: Nilesh Javali <njavali(a)marvell.com> stable inclusion from stable-v6.6.160 commit 2e6f60adf609c77e828f64e0cd371920bef91c12 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20146 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 34a40e0dff940ac5eba494a69b553ea571e24873 ] qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing bugs exposed on the error path of qla25xx_create_{req,rsp}_que(): 1. When dma_alloc_coherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dma_free_coherent() with a NULL cpu_addr is undefined behavior and can panic. 2. The free functions clear req_qid_map / rsp_qid_map under vport_lock, but the create functions protect the same bitmaps with mq_lock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mq_lock before calling the free function, creating a window where another thread can allocate the same que_id and have its ha->req_q_map entry clobbered by the subsequent lockless NULL assignment in the free function. Fix by: - Guarding dma_free_coherent() with a NULL check on the ring pointer. - Using mq_lock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit. - Removing the now-redundant clear_bit blocks from the create error paths since the free functions handle it atomically. Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Reviewed-by: Hannes Reinecke <hare(a)kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-41-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp(a)kernel.org> Backport adaptation for the stable tree: the 29xx IOCB size-selection helpers are absent, and queue creation still allocates fixed-size entries. Initialize the local req_entry_size and rsp_entry_size values with sizeof(request_t) and sizeof(response_t), respectively, so DMA freeing continues to match allocation without adding helper functions or 29xx support. Retain all NULL-ring guards, mq_lock protection, and removal of the premature bitmap clears. Keep the response-ring cleanup layout used by upstream so target commit 19788a55cab61d78e33e0914a5a31d27843e8a4a applies unchanged. Stable-dep-of: 19788a55cab6 ("scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/qla2xxx/qla_mid.c [Simple context conflicts.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/scsi/qla2xxx/qla_mid.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c index 4029b7942e21..53a523adcd06 100644 --- a/drivers/scsi/qla2xxx/qla_mid.c +++ b/drivers/scsi/qla2xxx/qla_mid.c @@ -572,30 +572,34 @@ qla24xx_create_vhost(struct fc_vport *fc_vport) static void qla25xx_free_req_que(struct scsi_qla_host *vha, struct req_que *req) { struct qla_hw_data *ha = vha->hw; uint16_t que_id = req->id; + size_t req_entry_size = sizeof(request_t); - dma_free_coherent(&ha->pdev->dev, (req->length + 1) * - sizeof(request_t), req->ring, req->dma); + if (req->ring) + dma_free_coherent(&ha->pdev->dev, + (req->length + 1) * req_entry_size, + req->ring, req->dma); req->ring = NULL; req->dma = 0; if (que_id) { + mutex_lock(&ha->mq_lock); ha->req_q_map[que_id] = NULL; - mutex_lock(&ha->vport_lock); clear_bit(que_id, ha->req_qid_map); - mutex_unlock(&ha->vport_lock); + mutex_unlock(&ha->mq_lock); } kfree(req->outstanding_cmds); kfree(req); } static void qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) { struct qla_hw_data *ha = vha->hw; uint16_t que_id = rsp->id; + size_t rsp_entry_size = sizeof(response_t); if (rsp->msix && rsp->msix->have_irq) { free_irq(rsp->msix->vector, rsp->msix->handle); rsp->msix->have_irq = 0; rsp->msix->in_use = 0; @@ -604,19 +608,21 @@ qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) /* Flush any queued response work before freeing the queue/qpair. */ if (rsp->qpair && ha->wq) cancel_work_sync(&rsp->qpair->q_work); - dma_free_coherent(&ha->pdev->dev, (rsp->length + 1) * - sizeof(response_t), rsp->ring, rsp->dma); + if (req->ring) + dma_free_coherent(&ha->pdev->dev, + (req->length + 1) * req_entry_size, + req->ring, req->dma); rsp->ring = NULL; rsp->dma = 0; if (que_id) { + mutex_lock(&ha->mq_lock); ha->rsp_q_map[que_id] = NULL; - mutex_lock(&ha->vport_lock); clear_bit(que_id, ha->rsp_qid_map); - mutex_unlock(&ha->vport_lock); + mutex_unlock(&ha->mq_lock); } kfree(rsp); } int @@ -797,13 +803,10 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options, if (startqp) { ret = qla25xx_init_req_que(base_vha, req); if (ret != QLA_SUCCESS) { ql_log(ql_log_fatal, base_vha, 0x00df, "%s failed.\n", __func__); - mutex_lock(&ha->mq_lock); - clear_bit(que_id, ha->req_qid_map); - mutex_unlock(&ha->mq_lock); goto que_failed; } vha->flags.qpairs_req_created = 1; } @@ -911,13 +914,10 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, if (startqp) { ret = qla25xx_init_rsp_que(base_vha, rsp); if (ret != QLA_SUCCESS) { ql_log(ql_log_fatal, base_vha, 0x00e7, "%s failed.\n", __func__); - mutex_lock(&ha->mq_lock); - clear_bit(que_id, ha->rsp_qid_map); - mutex_unlock(&ha->mq_lock); goto que_failed; } vha->flags.qpairs_rsp_created = 1; } rsp->req = NULL; -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] resolve hungtask
by Chen Jinghuang 23 Oct '26

23 Oct '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix struct sched_entity kabi broken Ingo Molnar (1): sched/fair: Separate se->vlag from se->vprot include/linux/sched.h | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 1/2] sched/fair: Separate se->vlag from se->vprot
by Chen Jinghuang 23 Oct '26

23 Oct '26

From: Ingo Molnar <mingo(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 80390ead2080071cbd6f427ff8deb94d10a4a50f category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10165 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's no real space concerns here and keeping these fields in a union makes reading (and tracing) the scheduler code harder. Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://patch.msgid.link/20251201064647.1851919-4-mingo@kernel.org Conflicts: include/linux/sched.h [a trival context conflict about kabi] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- include/linux/sched.h | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index c7229faef4c7..639851dbd85e 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -595,18 +595,10 @@ struct sched_entity { u64 sum_exec_runtime; u64 prev_sum_exec_runtime; u64 vruntime; - KABI_BROKEN_REPLACE( - s64 vlag, - union { - /* - * When !@on_rq this field is vlag. - * When cfs_rq->curr == se (which implies @on_rq) - * this field is vprot. See protect_slice(). - */ - s64 vlag; - u64 vprot; - } - ) + /* Approximated virtual lag: */ + s64 vlag; + /* 'Protected' deadline, to give out minimum quantums: */ + u64 vprot; u64 slice; u64 nr_migrations; -- 2.34.1

2 2

[PATCH OLK-6.6] drm/amdkfd: fix SMI event cross-process information leak
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Yongqiang Sun <Yongqiang.Sun(a)amd.com> mainline inclusion from mainline-v7.2-rc1 commit 92a8dba246d371fe268280e5fd74b0955688e6df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19653 CVE: CVE-2026-97422 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers. Signed-off-by: Yongqiang Sun <Yongqiang.Sun(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c [Commit b8f67b9ddf4f changed vm->task_info to flat fields (task_info->pid/tgid/task_name), so pass task_info->tgid as the SMI client pid filter instead of task_info->task.tgid. The kfd_smi_event_process()/PROCESS_START|END path does not exist in this tree, so only the VMFAULT caller is adapted.] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c index 06ac835190f9..4e374c0e5a52 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c @@ -244,8 +244,9 @@ void kfd_smi_event_update_vmfault(struct kfd_node *dev, uint16_t pasid) if (task_info) { /* Report VM faults from user applications, not retry from kernel */ if (task_info->pid) - kfd_smi_event_add(0, dev, KFD_SMI_EVENT_VMFAULT, "%x:%s\n", - task_info->pid, task_info->task_name); + kfd_smi_event_add(task_info->tgid, dev, + KFD_SMI_EVENT_VMFAULT, "%x:%s\n", + task_info->pid, task_info->task_name); amdgpu_vm_put_task_info(task_info); } } -- 2.22.0

2 1

[PATCH OLK-6.6] drm/amdkfd: fix SMI event cross-process information leak
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Yongqiang Sun <Yongqiang.Sun(a)amd.com> mainline inclusion from mainline-v7.2-rc1 commit 92a8dba246d371fe268280e5fd74b0955688e6df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19653 CVE: CVE-2026-97422 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers. Signed-off-by: Yongqiang Sun <Yongqiang.Sun(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c [Commit b8f67b9ddf4f changed vm->task_info to flat fields (task_info->pid/tgid/task_name), so pass task_info->tgid as the SMI client pid filter instead of task_info->task.tgid. The kfd_smi_event_process()/PROCESS_START|END path does not exist in this tree, so only the VMFAULT caller is adapted.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c index 06ac835190f9..4e374c0e5a52 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c @@ -244,8 +244,9 @@ void kfd_smi_event_update_vmfault(struct kfd_node *dev, uint16_t pasid) if (task_info) { /* Report VM faults from user applications, not retry from kernel */ if (task_info->pid) - kfd_smi_event_add(0, dev, KFD_SMI_EVENT_VMFAULT, "%x:%s\n", - task_info->pid, task_info->task_name); + kfd_smi_event_add(task_info->tgid, dev, + KFD_SMI_EVENT_VMFAULT, "%x:%s\n", + task_info->pid, task_info->task_name); amdgpu_vm_put_task_info(task_info); } } -- 2.22.0

2 1

[PATCH OLK-5.10 0/2] CVE-2026-97563 and CVE-2026-97565
by Yifan Qiao 22 Oct '26

22 Oct '26

Diego Oliva (2): smb: client: reject short READ responses in CIFSSMBRead() smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() fs/cifs/cifssmb.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()
by Yifan Qiao 22 Oct '26

22 Oct '26

From: Diego Oliva <diego(a)bynar.io> mainline inclusion from mainline-v7.3-rc3 commit 5be5bdda5863eacc964b609ba927764f253431b3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20155 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The SMB1 synchronous read helper CIFSSMBRead() validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy source is formed as &pSMBr->hdr.Protocol + le16_to_cpu(pSMBr->DataOffset) and memcpy()'d for DataLength bytes with no check that the [DataOffset, DataOffset + DataLength) range lies within the response actually received from the server. A malicious or compromised SMB1 server can return a response carrying an in-range DataLength and a large DataOffset, driving the source pointer past the end of the response buffer. The memcpy() then copies adjacent kernel heap into the caller's read buffer (information disclosure), or reads unmapped memory and oopses (denial of service). SMB1 is not negotiated by default; reaching this code requires an explicit vers=1.0 mount. Both DataOffset and the received response length recorded in rsp_iov.iov_len are relative to the start of the SMB header, so reject the response unless DataOffset + DataLength fits within that length, using overflow-safe arithmetic, before forming the source pointer. The response length has been validated by the previous patch, so the DataOffset and DataLength fields can be read safely here. While here, make data_length unsigned. It holds a length derived from unsigned on-the-wire fields and is only ever compared against unsigned quantities; print it with %u accordingly, and add __func__ to the cifs_dbg() calls in this function. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org # 6.19.x Assisted-by: Bynario AI Signed-off-by: Diego Oliva <diego(a)bynar.io> Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Conflicts: fs/smb/client/cifssmb.c fs/smb/client/trace.h [Context differences.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/cifssmb.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c index 60f333f6fa02..4c0a2d410f9a 100644 --- a/fs/smb/client/cifssmb.c +++ b/fs/smb/client/cifssmb.c @@ -1456,7 +1456,8 @@ CIFSSMBRead(const unsigned int xid, struct cifs_io_parms *io_parms, rc = -EIO; *nbytes = 0; } else { - int data_length = le16_to_cpu(pSMBr->DataLengthHigh); + unsigned int data_length = le16_to_cpu(pSMBr->DataLengthHigh); + __u16 data_offset = le16_to_cpu(pSMBr->DataOffset); data_length = data_length << 16; data_length += le16_to_cpu(pSMBr->DataLength); *nbytes = data_length; @@ -1464,13 +1465,19 @@ CIFSSMBRead(const unsigned int xid, struct cifs_io_parms *io_parms, /*check that DataLength would not go beyond end of SMB */ if ((data_length > CIFSMaxBufSize) || (data_length > count)) { - cifs_dbg(FYI, "bad length %d for count %d\n", - data_length, count); + cifs_dbg(FYI, "%s: bad length %u for count %u\n", + __func__, data_length, count); + rc = -EIO; + *nbytes = 0; + } else if (4 + data_offset < sizeof(*pSMBr) || + 4 + (size_t)data_offset + data_length > rsp_iov.iov_len) { + /* check that the data lies within the received response */ + cifs_dbg(FYI, "%s: bad data offset %u length %u for response of %zu\n", + __func__, data_offset, data_length, rsp_iov.iov_len); rc = -EIO; *nbytes = 0; } else { - pReadData = (char *) (&pSMBr->hdr.Protocol) + - le16_to_cpu(pSMBr->DataOffset); + pReadData = (char *) (&pSMBr->hdr.Protocol) + data_offset; /* if (rc = copy_to_user(buf, pReadData, data_length)) { cifs_dbg(VFS, "Faulting on read rc = %d\n",rc); rc = -EFAULT; -- 2.52.0

2 1

[PATCH OLK-6.6] io_uring/rw: end write accounting from ->ki_complete
by Yifan Qiao 22 Oct '26

22 Oct '26

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v7.3-rc3 commit 796aa0547557e63338657ed1c487906f9fac4c73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20166 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the io_req_rw_complete() task_work. However, only the fsnotify part actually needed to move as it may sleep. Ending the write accounting is just a percpu_up_read() on the superblock writers sem. Deferring it is a problem, because it makes dropping SB_FREEZE_WRITE protection depend on the ring owner getting to running task_work. But the task may be blocked in freeze_super(), causing it to never get to that: task io-wq worker -------------------------------------------------------------- io_write() io_kiocb_start_write() (takes sb_writers, hidden from lockdep by __sb_writers_release) write_iter() -> -EIOCBQUEUED ioctl(FS_IOC_SHUTDOWN) bdev_freeze() freeze_super() percpu_down_write() <- waits for the reader above io_write() kiocb_start_write() percpu_down_read() <- queued behind the writer <bio completes> io_complete_rw() queues io_req_rw_complete() <- never runs, task is in D state End the write from io_complete_rw() instead, and leave only the fsnotify calls in task_work. Reported-by: syzbot+2eb3d983669d3e49d4fa(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Fixes: b000145e9907 ("io_uring/rw: defer fsnotify calls to task context") Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/rw.c [This tree still has io_req_io_end() (which ends write accounting) on the reissue branch of __io_complete_rw_common(), so the hoisted io_req_end_write() is placed after that branch instead of at the top of io_complete_rw(), avoiding a double sb_end_write() while still ending writes from ->ki_complete.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/rw.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/io_uring/rw.c b/io_uring/rw.c index e550f0618fd2..15dfb9c24613 100644 --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -244,20 +244,25 @@ static void io_req_end_write(struct io_kiocb *req) } } -/* - * Trigger the notifications after having done some IO, and finish the write - * accounting, if any. - */ -static void io_req_io_end(struct io_kiocb *req) +/* Trigger the notifications after having done some IO. */ +static void io_req_io_notify(struct io_kiocb *req) { struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw); - if (rw->kiocb.ki_flags & IOCB_WRITE) { - io_req_end_write(req); + if (rw->kiocb.ki_flags & IOCB_WRITE) fsnotify_modify(req->file); - } else { + else fsnotify_access(req->file); - } +} + +/* Finish write accounting and notify, for inline completions only. */ +static void io_req_io_end(struct io_kiocb *req) +{ + struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw); + + if (rw->kiocb.ki_flags & IOCB_WRITE) + io_req_end_write(req); + io_req_io_notify(req); } static bool __io_complete_rw_common(struct io_kiocb *req, long res) @@ -304,7 +309,7 @@ void io_req_rw_complete(struct io_kiocb *req, struct io_tw_state *ts) io_req_set_res(req, io_fixup_rw_res(req, res), 0); } - io_req_io_end(req); + io_req_io_notify(req); if (req->flags & (REQ_F_BUFFER_SELECTED|REQ_F_BUFFER_RING)) req->cqe.flags |= io_put_kbuf(req, 0); @@ -322,6 +327,12 @@ static void io_complete_rw(struct kiocb *kiocb, long res) return; io_req_set_res(req, io_fixup_rw_res(req, res), 0); } + /* + * End write accounting here rather than in task_work, as the ring + * owner may block in freeze_super() before that runs. + */ + if (kiocb->ki_flags & IOCB_WRITE) + io_req_end_write(req); req->io_task_work.func = io_req_rw_complete; __io_req_task_work_add(req, IOU_F_TWQ_LAZY_WAKE); } -- 2.52.0

2 1

[PATCH OLK-6.6] iommu/amd: Do not reallocate GA log buffers on resume
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Karl Mehltretter <kmehltretter(a)gmail.com> mainline inclusion from mainline-v7.3-rc3 commit 00a7dd64888d6dd72110b40e2824a088cf7b7386 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19847 CVE: CVE-2026-98003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Commit c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement") moved the GA log allocation from iommu_init_pci() to enable_iommus_vapic(), which is called on every resume. iommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail unconditionally. Each resume therefore replaces the boot-time pointers and leaks both old allocations. The function also uses GFP_KERNEL from a syscore resume callback, where interrupts are disabled and the non-boot CPUs are offline. Return early if both buffers are already allocated. Clear the pointers in free_ga_log() so a partial allocation failure cannot leave ga_log dangling. Fixes: c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement") Assisted-by: Claude:claude-opus-5 Signed-off-by: Karl Mehltretter <kmehltretter(a)gmail.com> Reviewed-by: Vasant Hegde <vasant.hegde(a)amd.com> Reviewed-by: Ankit Soni <Ankit.Soni(a)amd.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/amd/init.c [Upstream now uses iommu_alloc_pages_node_sz()/iommu_free_pages() (commit 1e0c8d6b69521 and follow-ups) and WARN_ON_ONCE() for the VAPIC check; this tree predates them, so keep the local __get_free_pages()/free_pages() helpers and the legacy silent !AMD_IOMMU_GUEST_IR_VAPIC() check. Only the early-return guard and the pointer NULLing after free are applied.] Co-authored-by: BackportAgent(a)GLM-5.3 Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/amd/init.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index f57e2a784da4..ff36f3c456fa 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -890,7 +890,9 @@ static void free_ga_log(struct amd_iommu *iommu) { #ifdef CONFIG_IRQ_REMAP iommu_free_pages(iommu->ga_log, get_order(GA_LOG_SIZE)); + iommu->ga_log = NULL; iommu_free_pages(iommu->ga_log_tail, get_order(8)); + iommu->ga_log_tail = NULL; #endif } @@ -935,6 +937,9 @@ static int iommu_init_ga_log(struct amd_iommu *iommu) if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir)) return 0; + if (iommu->ga_log && iommu->ga_log_tail) + return 0; + iommu->ga_log = iommu_alloc_pages(GFP_KERNEL, get_order(GA_LOG_SIZE)); if (!iommu->ga_log) goto err_out; -- 2.22.0

2 1

[PATCH OLK-6.6 00/17] hisilicon: HBM dev/cache fixes and sysfs cleanup
by Ziming Du 22 Oct '26

22 Oct '26

This series fixes several issues in the HiSilicon HBM device/cache drivers and cleans up the hisi_hbmdev sysfs interface. Highlights: - Serialize the ACPI device online/offline path to avoid races. - Protect the PCC operation region with locks in hbmdev/hbmcache. - Prevent hung task via mutex_trylock in hbmcache. - Don't poweroff when memory blocks failed to offline; fix NULL pointer dereference on the offline path. - Add missing locality information for hot-added ACPI/HMAT devices. - Revert the extra memory-topology and ACLS repair/query features and drop the now-unused memdev kobj / state-show sysfs. Bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20607 Dengdui Huang (1): arm64: openeuler_defconfig: add Kunpeng HCCS config Zhang Zekun (13): soc:hisilicon: Use _ON and _OFF in hbmcache hisilicon/hisi_hbmcache: Add a lock to protect pcc operation region hisilicon/hisi_hbmdev: Add lock to protect pcc operation region ACPI/HMAT: Add missing locality information for hot-added device hisilicon/hisi_hbmcache: Use mutex_trylock to prevent hung task soc: hisilicon: Don't poweroff if memblocks don't offlined soc: hisilicon: hisi_hbmdev: Notify the device in the ACPI soc: hisilicon: Setting the demand_offline in sysfs interface hisilicon/hisi_hbmdev: prevent NULL pointer dereference when corrently arm64: config: Open the hbmdev related config soc: hisilicon: hbmdev: Only support built-in soc/hisilicon: Clean the hbmcache state show sysfs soc/hisilicon: Remove the memdev kobj Ziming Du (3): soc: hisilicon: Serialize the online and onfline the acpi devices Revert "soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods" Revert "soc: hisilicon: hisi_hbmdev: Provide extra memory topology information" arch/arm64/configs/openeuler_defconfig | 8 + drivers/acpi/acpi_memhotplug.c | 13 + drivers/acpi/device_sysfs.c | 8 + drivers/acpi/internal.h | 1 + drivers/acpi/numa/hmat.c | 17 ++ drivers/acpi/osl.c | 6 +- drivers/soc/hisilicon/Kconfig | 21 +- drivers/soc/hisilicon/hisi_hbmcache.c | 42 ++- drivers/soc/hisilicon/hisi_hbmdev.c | 346 ++++++------------------- include/linux/acpi.h | 2 + 10 files changed, 160 insertions(+), 304 deletions(-) -- 2.43.0

2 18