- Kernel - mailweb.openeuler.org

[PATCH 00/14] mm: add huge pfnmap support for remap_pfn_range()
by Yin Tirui 10 Nov '25

10 Nov '25

Overview ======== This patch series adds huge page support for remap_pfn_range(), automatically creating huge mappings when prerequisites are satisfied (size, alignment, architecture support, etc.) and falling back to normal page mappings otherwise. This work builds on Peter Xu's previous efforts on huge pfnmap support [0]. TODO ==== - Add PUD-level huge page support. Currently, only PMD-level huge pages are supported. - Consider the logic related to vmap_page_range and extract reusable common code. Tests Done ========== - Cross-build tests. - Performance tests with custom device driver implementing mmap() with remap_pfn_range(): - lat_mem_rd benchmark modified to use mmap(device_fd) instead of malloc() shows around 40% improvement in memory access latency with huge page support compared to normal page mappings. numactl -C 0 lat_mem_rd -t 4096M (stride=64) Memory Size (MB) Without Huge Mapping With Huge Mapping Improvement ---------------- ----------------- -------------- ----------- 64.00 148.858 ns 100.780 ns 32.3% 128.00 164.745 ns 103.537 ns 37.2% 256.00 169.907 ns 103.179 ns 39.3% 512.00 171.285 ns 103.072 ns 39.8% 1024.00 173.054 ns 103.055 ns 40.4% 2048.00 172.820 ns 103.091 ns 40.3% 4096.00 172.877 ns 103.115 ns 40.4% - Custom memory copy operations on mmap(device_fd) show around 18% performance improvement with huge page support compared to normal page mappings. numactl -C 0 memcpy_test (memory copy performance test) Memory Size (MB) Without Huge Mapping With Huge Mapping Improvement ---------------- ----------------- -------------- ----------- 1024.00 95.76 ms 77.91 ms 18.6% 2048.00 190.87 ms 155.64 ms 18.5% 4096.00 380.84 ms 311.45 ms 18.2% [0] https://lore.kernel.org/all/20240826204353.2228736-2-peterx@redhat.com/T/#u David Hildenbrand (1): mm/huge_memory: check pmd_special() only after pmd_present() Peter Xu (11): mm: introduce ARCH_SUPPORTS_HUGE_PFNMAP and special bits to pmd/pud mm: drop is_huge_zero_pud() mm: mark special bits for huge pfn mappings when inject mm: allow THP orders for PFNMAPs mm/gup: detect huge pfnmap entries in gup-fast mm/pagewalk: check pfnmap for folio_walk_start() mm/fork: accept huge pfnmap entries mm: always define pxx_pgprot() mm/x86: support large pfn mappings mm/arm64: support large pfn mappings arm64: mm: Drop dead code for pud special bit handling Yin Tirui (2): pgtable: add pte_clrhuge() implementation for arm64 mm: introduce remap_huge_pfn_range() for PMD-level hugepage mapping arch/arm64/Kconfig | 1 + arch/arm64/include/asm/pgtable.h | 38 ++++++ arch/powerpc/include/asm/book3s/64/pgtable.h | 2 +- arch/powerpc/include/asm/pgtable.h | 1 + arch/s390/include/asm/pgtable.h | 1 + arch/sparc/include/asm/pgtable_64.h | 1 + arch/x86/Kconfig | 1 + arch/x86/include/asm/pgtable.h | 80 +++++++----- fs/dax.c | 2 +- include/linux/huge_mm.h | 16 +-- include/linux/mm.h | 26 ++++ include/linux/pgtable.h | 14 ++- mm/Kconfig | 13 ++ mm/gup.c | 6 + mm/huge_memory.c | 93 ++++++++++---- mm/memory.c | 126 +++++++++++++++---- 16 files changed, 325 insertions(+), 96 deletions(-) -- 2.43.0

2 15

[PATCH OLK-6.6 0/6] blk-ioinf: introduce inflight-based IO QoS controller
by Baokun Li 10 Nov '25

10 Nov '25

Baokun Li (6): blk-ioinf: introduce inflight-based IO QoS controller blk-ioinf: add rqos/inflight/stat debufs interface blk-ioinf: dynamically adjust inflight limit to balance workloads blk-ioinf: support percentile latency QoS for oneline workloads blk-io-hierarchy: support new bio based stage ioinf openeuler_defconfig: Enable CONFIG_BLK_CGROUP_IOINFLIGHT arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 10 + block/Makefile | 1 + block/blk-io-hierarchy/Kconfig | 11 + block/blk-io-hierarchy/debugfs.c | 3 + block/blk-ioinf.c | 1342 ++++++++++++++++++++++++ block/blk-mq-debugfs.c | 2 + block/blk-rq-qos.h | 1 + include/linux/blk-mq.h | 3 + include/linux/blk_types.h | 3 + 11 files changed, 1378 insertions(+) create mode 100644 block/blk-ioinf.c -- 2.46.1

2 7

[openeuler:OLK-6.6 3126/3126] mm/shmem.c:1699:51: error: passing argument 3 of 'swap_cluster_readahead' from incompatible pointer type
by kernel test robot 10 Nov '25

10 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f750bb89c43eea8f7e0424615516674781c72f7b commit: 2896144b31df6748c5d0e6df7991c4a31a54b371 [3126/3126] mempolicy: alloc_pages_mpol() for NUMA policy without vma config: arm64-allnoconfig (https://download.01.org/0day-ci/archive/20251110/202511101911.9c0ewxw1-lkp@…) compiler: aarch64-linux-gcc (GCC) 15.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251110/202511101911.9c0ewxw1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511101911.9c0ewxw1-lkp@intel.com/ All errors (new ones prefixed by >>): mm/shmem.c: In function 'shmem_swapin_cluster': >> mm/shmem.c:1699:51: error: passing argument 3 of 'swap_cluster_readahead' from incompatible pointer type [-Wincompatible-pointer-types] 1699 | folio = swap_cluster_readahead(swap, gfp, mpol, ilx); | ^~~~ | | | struct mempolicy * In file included from mm/shmem.c:43: mm/swap.h:102:66: note: expected 'struct vm_fault *' but argument is of type 'struct mempolicy *' 102 | gfp_t gfp_mask, struct vm_fault *vmf) | ~~~~~~~~~~~~~~~~~^~~ >> mm/shmem.c:1699:17: error: too many arguments to function 'swap_cluster_readahead'; expected 3, have 4 1699 | folio = swap_cluster_readahead(swap, gfp, mpol, ilx); | ^~~~~~~~~~~~~~~~~~~~~~ ~~~ mm/swap.h:101:29: note: declared here 101 | static inline struct folio *swap_cluster_readahead(swp_entry_t entry, | ^~~~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARCH_SUPPORTS_SCHED_SOFT_QUOTA Depends on [n]: CGROUPS [=n] Selected by [y]: - ARM64 [=y] WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE Depends on [n]: CPU_IDLE [=n] && ARCH_CPUIDLE_HALTPOLL [=y] && ARCH_HAS_OPTIMIZED_POLL [=y] Selected by [y]: - ARM64 [=y] vim +/swap_cluster_readahead +1699 mm/shmem.c 1687 1688 static struct mempolicy *shmem_get_pgoff_policy(struct shmem_inode_info *info, 1689 pgoff_t index, unsigned int order, pgoff_t *ilx); 1690 1691 static struct folio *shmem_swapin_cluster(swp_entry_t swap, gfp_t gfp, 1692 struct shmem_inode_info *info, pgoff_t index) 1693 { 1694 struct mempolicy *mpol; 1695 pgoff_t ilx; 1696 struct folio *folio; 1697 1698 mpol = shmem_get_pgoff_policy(info, index, 0, &ilx); > 1699 folio = swap_cluster_readahead(swap, gfp, mpol, ilx); 1700 mpol_cond_put(mpol); 1701 1702 return folio; 1703 } 1704 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3126/3126] mm/shmem.c:1699:50: error: too many arguments to function call, expected 3, have 4
by kernel test robot 10 Nov '25

10 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f750bb89c43eea8f7e0424615516674781c72f7b commit: 2896144b31df6748c5d0e6df7991c4a31a54b371 [3126/3126] mempolicy: alloc_pages_mpol() for NUMA policy without vma config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20251110/202511101918.i2LTDdWk-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251110/202511101918.i2LTDdWk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511101918.i2LTDdWk-lkp@intel.com/ All errors (new ones prefixed by >>): >> mm/shmem.c:1699:50: error: too many arguments to function call, expected 3, have 4 1699 | folio = swap_cluster_readahead(swap, gfp, mpol, ilx); | ~~~~~~~~~~~~~~~~~~~~~~ ^~~ mm/swap.h:101:29: note: 'swap_cluster_readahead' declared here 101 | static inline struct folio *swap_cluster_readahead(swp_entry_t entry, | ^ ~~~~~~~~~~~~~~~~~~ 102 | gfp_t gfp_mask, struct vm_fault *vmf) | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 error generated. vim +1699 mm/shmem.c 1687 1688 static struct mempolicy *shmem_get_pgoff_policy(struct shmem_inode_info *info, 1689 pgoff_t index, unsigned int order, pgoff_t *ilx); 1690 1691 static struct folio *shmem_swapin_cluster(swp_entry_t swap, gfp_t gfp, 1692 struct shmem_inode_info *info, pgoff_t index) 1693 { 1694 struct mempolicy *mpol; 1695 pgoff_t ilx; 1696 struct folio *folio; 1697 1698 mpol = shmem_get_pgoff_policy(info, index, 0, &ilx); > 1699 folio = swap_cluster_readahead(swap, gfp, mpol, ilx); 1700 mpol_cond_put(mpol); 1701 1702 return folio; 1703 } 1704 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v5 0/9] Add xcall 2.0 support
by Jinjie Ruan 10 Nov '25

10 Nov '25

Add xcall 2.0 support, which is compatible with xcall1.0, and can be used to dynamic instruction replacement for hardware xcall. Changes in v5: - Fix build problem. - el0t_64_sync_ventry jump to kernel_ventry to do VMAP_STACK. - Some cleanups. - Merge the three refactor patch. Changes in v4: - Reuse uprobe_write_opcode() instead of use __replace_page() and copy_to_page(). - Handle error for uprobe_write_opcode(). - Support xcall1.0 before 920G. - Change xcall1.0 bitmap to byte array to save check insns. - Use percpu variable to save check insns for xcall1.0. - A little cleanup. Changes in v3: - Add validity checks during xcall registration to prevent out-of-bounds access and null pointer dereferences. - Extract __replace_page() and copy_to_page() from uprobe, to avoid code duplication. - Replace with new compatible refactored code. - Remove unnecessary member, such as old_name. Changes in v2: - Remove duplicates or unnecessary ~300 LOC, such as link_slot, init_task. - Fix kabi. - Some cleanups. Jinjie Ruan (2): xcall2.0: Support xcall1.0 for hardware xcall openeuler_defconfig: Enable CONFIG_DYNAMIC_XCALL by default Liao Chang (6): xcall2.0: Add userspace proc interface xcall2.0: Add xcall module register interface xcall2.0: Add xcall_area xcall2.0: Hajack syscall with dynamic instruciton replace xcall: Refactor the early exception entry for ACTLR.xcall xcall2.0: Add a basic testcase Yuntao Liu (1): xcall2.0: Intruduce xcall2.0 prefetch kernel module arch/arm64/Kconfig.turbo | 13 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/exception.h | 4 +- arch/arm64/include/asm/mmu_context.h | 7 - arch/arm64/include/asm/xcall.h | 142 ++++---- arch/arm64/kernel/cpufeature.c | 71 ++-- arch/arm64/kernel/entry-common.c | 28 +- arch/arm64/kernel/entry.S | 86 +---- arch/arm64/kernel/probes/uprobes.c | 6 + arch/arm64/kernel/process.c | 5 + arch/arm64/kernel/syscall.c | 14 + arch/arm64/kernel/xcall/Makefile | 3 +- arch/arm64/kernel/xcall/core.c | 390 +++++++++++++++++++++ arch/arm64/kernel/xcall/entry.S | 133 +++++-- arch/arm64/kernel/xcall/proc.c | 203 +++++++++++ arch/arm64/kernel/xcall/xcall.c | 56 +-- arch/arm64/kvm/sys_regs.c | 1 + drivers/staging/Kconfig | 2 + drivers/staging/Makefile | 1 + drivers/staging/xcall/Kconfig | 19 + drivers/staging/xcall/Makefile | 1 + drivers/staging/xcall/dynamic_xcall_test.c | 97 +++++ drivers/staging/xcall/prefetch.c | 267 ++++++++++++++ fs/proc/proc_xcall.c | 141 ++------ include/linux/mm_types.h | 4 + include/linux/xcall.h | 52 +++ kernel/events/uprobes.c | 23 ++ kernel/fork.c | 3 + mm/mmap.c | 14 +- 29 files changed, 1416 insertions(+), 371 deletions(-) create mode 100644 arch/arm64/kernel/xcall/core.c create mode 100644 arch/arm64/kernel/xcall/proc.c create mode 100644 drivers/staging/xcall/Kconfig create mode 100644 drivers/staging/xcall/Makefile create mode 100644 drivers/staging/xcall/dynamic_xcall_test.c create mode 100644 drivers/staging/xcall/prefetch.c create mode 100644 include/linux/xcall.h -- 2.34.1

2 10

[PATCH OLK-5.10] ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
by Xiaomeng Zhang 10 Nov '25

10 Nov '25

From: Yajun Deng <yajun.deng(a)linux.dev> stable inclusion from stable-v5.10.236 commit de203da734fae00e75be50220ba5391e7beecdf9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QP4 CVE: CVE-2023-53034 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit de203da734fae00e75be50220ba5391e7beecdf9 ] There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative Ensuring xlate_pos is a positive or zero before BIT. Fixes: 1e2fd202f859 ("ntb_hw_switchtec: Check for alignment of the buffer in mw_set_trans()") Signed-off-by: Yajun Deng <yajun.deng(a)linux.dev> Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Signed-off-by: Jon Mason <jdmason(a)kudzu.us> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c index ad09946100b5..c5c1963c699d 100644 --- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c @@ -288,7 +288,7 @@ static int switchtec_ntb_mw_set_trans(struct ntb_dev *ntb, int pidx, int widx, if (size != 0 && xlate_pos < 12) return -EINVAL; - if (!IS_ALIGNED(addr, BIT_ULL(xlate_pos))) { + if (xlate_pos >= 0 && !IS_ALIGNED(addr, BIT_ULL(xlate_pos))) { /* * In certain circumstances we can get a buffer that is * not aligned to its size. (Most of the time -- 2.34.1

2 1

[PATCH OLK-5.10] slimbus: messaging: Free transaction ID in delayed interrupt scenario
by Xiaomeng Zhang 10 Nov '25

10 Nov '25

From: Visweswara Tanuku <quic_vtanuku(a)quicinc.com> stable inclusion from stable-v5.10.235 commit a32e5198a9134772eb03f7b72a7849094c55bda9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY44F CVE: CVE-2025-21914 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a upstream. In case of interrupt delay for any reason, slim_do_transfer() returns timeout error but the transaction ID (TID) is not freed. This results into invalid memory access inside qcom_slim_ngd_rx_msgq_cb() due to invalid TID. Fix the issue by freeing the TID in slim_do_transfer() before returning timeout error to avoid invalid memory access. Call trace: __memcpy_fromio+0x20/0x190 qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl] vchan_complete+0x2a0/0x4a0 tasklet_action_common+0x274/0x700 tasklet_action+0x28/0x3c _stext+0x188/0x620 run_ksoftirqd+0x34/0x74 smpboot_thread_fn+0x1d8/0x464 kthread+0x178/0x238 ret_from_fork+0x10/0x20 Code: aa0003e8 91000429 f100044a 3940002b (3800150b) ---[ end trace 0fe00bec2b975c99 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt. Fixes: afbdcc7c384b ("slimbus: Add messaging APIs to slimbus framework") Cc: stable <stable(a)kernel.org> Signed-off-by: Visweswara Tanuku <quic_vtanuku(a)quicinc.com> Link: https://lore.kernel.org/r/20250124125740.16897-1-quic_vtanuku@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/slimbus/messaging.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c index ddf0371ad52b..c1171ec5efeb 100644 --- a/drivers/slimbus/messaging.c +++ b/drivers/slimbus/messaging.c @@ -147,8 +147,9 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn) } ret = ctrl->xfer_msg(ctrl, txn); - - if (!ret && need_tid && !txn->msg->comp) { + if (ret == -ETIMEDOUT) { + slim_free_txn_tid(ctrl, txn); + } else if (!ret && need_tid && !txn->msg->comp) { unsigned long ms = txn->rl + HZ; timeout = wait_for_completion_timeout(txn->comp, -- 2.34.1

2 1

[PATCH OLK-6.6 v5 RESEND 0/9] Add xcall 2.0 support
by Jinjie Ruan 10 Nov '25

10 Nov '25

Add xcall 2.0 support, which is compatible with xcall1.0, and can be used to dynamic instruction replacement for hardware xcall. Changes in v5: - Fix build problem. - el0t_64_sync_ventry jump to kernel_ventry to do VMAP_STACK. - Some cleanups. - Merge the three refactor patch. Changes in v4: - Reuse uprobe_write_opcode() instead of use __replace_page() and copy_to_page(). - Handle error for uprobe_write_opcode(). - Support xcall1.0 before 920G. - Change xcall1.0 bitmap to byte array to save check insns. - Use percpu variable to save check insns for xcall1.0. - A little cleanup. Changes in v3: - Add validity checks during xcall registration to prevent out-of-bounds access and null pointer dereferences. - Extract __replace_page() and copy_to_page() from uprobe, to avoid code duplication. - Replace with new compatible refactored code. - Remove unnecessary member, such as old_name. Changes in v2: - Remove duplicates or unnecessary ~300 LOC, such as link_slot, init_task. - Fix kabi. - Some cleanups. Jinjie Ruan (2): xcall2.0: Support xcall1.0 for hardware xcall openeuler_defconfig: Enable CONFIG_DYNAMIC_XCALL by default Liao Chang (6): xcall2.0: Add userspace proc interface xcall2.0: Add xcall module register interface xcall2.0: Add xcall_area xcall2.0: Hajack syscall with dynamic instruciton replace xcall: Refactor the early exception entry for ACTLR.xcall xcall2.0: Add a basic testcase Yuntao Liu (1): xcall2.0: Intruduce xcall2.0 prefetch kernel module arch/arm64/Kconfig.turbo | 13 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/exception.h | 4 +- arch/arm64/include/asm/mmu_context.h | 7 - arch/arm64/include/asm/xcall.h | 142 ++++---- arch/arm64/kernel/cpufeature.c | 71 ++-- arch/arm64/kernel/entry-common.c | 28 +- arch/arm64/kernel/entry.S | 86 +---- arch/arm64/kernel/probes/uprobes.c | 6 + arch/arm64/kernel/process.c | 5 + arch/arm64/kernel/syscall.c | 14 + arch/arm64/kernel/xcall/Makefile | 3 +- arch/arm64/kernel/xcall/core.c | 390 +++++++++++++++++++++ arch/arm64/kernel/xcall/entry.S | 133 +++++-- arch/arm64/kernel/xcall/proc.c | 203 +++++++++++ arch/arm64/kernel/xcall/xcall.c | 56 +-- arch/arm64/kvm/sys_regs.c | 1 + drivers/staging/Kconfig | 2 + drivers/staging/Makefile | 1 + drivers/staging/xcall/Kconfig | 19 + drivers/staging/xcall/Makefile | 1 + drivers/staging/xcall/dynamic_xcall_test.c | 97 +++++ drivers/staging/xcall/prefetch.c | 267 ++++++++++++++ fs/proc/proc_xcall.c | 141 ++------ include/linux/mm_types.h | 4 + include/linux/xcall.h | 52 +++ kernel/events/uprobes.c | 23 ++ kernel/fork.c | 3 + mm/mmap.c | 14 +- 29 files changed, 1416 insertions(+), 371 deletions(-) create mode 100644 arch/arm64/kernel/xcall/core.c create mode 100644 arch/arm64/kernel/xcall/proc.c create mode 100644 drivers/staging/xcall/Kconfig create mode 100644 drivers/staging/xcall/Makefile create mode 100644 drivers/staging/xcall/dynamic_xcall_test.c create mode 100644 drivers/staging/xcall/prefetch.c create mode 100644 include/linux/xcall.h -- 2.34.1

1 9

[PATCH OLK-6.6 00/21] Add MFS support
by Huang Xiaojia 10 Nov '25

10 Nov '25

MFS is a stackable file system that utilizes a lower and a cache layer. It provides users with programmable caching capabilities. MFS only supports read-only operations for regular files, directories and symbolic links. When MFS is stacked on top of the lower and cache layers (which are themselves mounted on other file systems, such as ext4 or xfs), the underlying file systems must be also kept read-only to prevent the data inconsistency. MFS supports three running mode: none, local and remote. These modes are explained in running mode section. In short, MFS requires the `mtree` and `cachedir` mount options. The `mtree` option specifies the metadata source for MFS, while the `cachedir` option specifies the data source. In local or remote mode, `cachedir` points to a local cache (in memory or on disk) for backend file systems. Hongbo Li (19): mfs: Initialize mfs module mfs: implement the mount procedure mfs: Add basic metadata operation for MFS mfs: Add basic data operation for MFS mfs: Add basic cache framework: check method and control structure mfs: Add basic events framework mfs: Add communication devie and event acquisition operations mfs: Add user command for handling events mfs: Add tracepoint for MFS mfs: Add MFS documentation MAINTAINERS: Add maintainer for mfs mfs: enable MFS mfs: Fix the UAF problems on syncer object mfs: Make mfs_filemap_map_pages static mfs: Make mfs_dops, mfs_sops and _acquire_set_path static mfs: Make mfs_lookup, mfs_dir_iops, mfs_symlink_iops and mfs_symlink_iops static mfs: Make sure all delayed rcu inodes are safe to be destroyed mfs: Pending when umount with the device opening mfs: allow resched when too many events need to be destroyed Huang Xiaojia (1): mfs: tool: Add mfs user space tool demo HuangXiaojia (1): mfs: Fix null pointer access in mfs_open or mfs_lookup Documentation/filesystems/index.rst | 1 + Documentation/filesystems/mfs.rst | 223 +++++++++++ MAINTAINERS | 10 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/Kconfig | 1 + fs/Makefile | 1 + fs/mfs/Kconfig | 12 + fs/mfs/Makefile | 4 + fs/mfs/cache.c | 507 ++++++++++++++++++++++++ fs/mfs/data.c | 523 +++++++++++++++++++++++++ fs/mfs/dev.c | 242 ++++++++++++ fs/mfs/inode.c | 303 ++++++++++++++ fs/mfs/internal.h | 232 +++++++++++ fs/mfs/super.c | 499 +++++++++++++++++++++++ include/trace/events/mfs.h | 105 +++++ include/uapi/linux/magic.h | 1 + include/uapi/linux/mfs.h | 62 +++ tools/mfs/.gitignore | 2 + tools/mfs/Makefile | 13 + tools/mfs/mfsd.c | 186 +++++++++ 21 files changed, 2929 insertions(+) create mode 100644 Documentation/filesystems/mfs.rst create mode 100644 fs/mfs/Kconfig create mode 100644 fs/mfs/Makefile create mode 100644 fs/mfs/cache.c create mode 100644 fs/mfs/data.c create mode 100644 fs/mfs/dev.c create mode 100644 fs/mfs/inode.c create mode 100644 fs/mfs/internal.h create mode 100644 fs/mfs/super.c create mode 100644 include/trace/events/mfs.h create mode 100644 include/uapi/linux/mfs.h create mode 100644 tools/mfs/.gitignore create mode 100644 tools/mfs/Makefile create mode 100644 tools/mfs/mfsd.c -- 2.25.1

2 22

[PATCH openEuler-1.0-LTS] Revert "fbdev: Fix out-of-bounds issue in sys_fillrect()"
by Gu Bowen 10 Nov '25

10 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID5JM1 CVE: NA ------------------ This reverts commit 7389066b79d5dc829e15de2509e43a66bf24e296. This patch caused an issue which a virtual machine could not start, revert it. Fixes: 7389066b79d5 ("fbdev: Fix out-of-bounds issue in sys_fillrect()") Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 2 +- drivers/video/fbdev/core/sysfillrect.c | 6 ------ 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index e893835c1c25..83a4949e2497 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2649,9 +2649,9 @@ static void fbcon_modechanged(struct fb_info *info) return; p = &fb_display[vc->vc_num]; + set_blitting_type(vc, info); if (con_is_visible(vc)) { - set_blitting_type(vc, info); var_to_display(p, &info->var, info); cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); diff --git a/drivers/video/fbdev/core/sysfillrect.c b/drivers/video/fbdev/core/sysfillrect.c index 7b4103c3288e..33ee3d34f9d2 100644 --- a/drivers/video/fbdev/core/sysfillrect.c +++ b/drivers/video/fbdev/core/sysfillrect.c @@ -248,7 +248,6 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect) u32 bpp = p->var.bits_per_pixel; unsigned long *dst; int dst_idx, left; - long dst_offset; if (p->state != FBINFO_STATE_RUNNING) return; @@ -288,11 +287,6 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect) } while (height--) { dst += dst_idx >> (ffs(bits) - 1); - dst_offset = (long)dst - (long)p->screen_base; - if (dst_offset < 0 || dst_offset >= p->fix.smem_len) { - pr_err("dst offset out of bound: dst_offset(%ld)", dst_offset); - return; - } dst_idx &= (bits - 1); fill_op32(p, dst, dst_idx, pat, width*bpp, bits); dst_idx += p->fix.line_length*8; -- 2.43.0

2 1