* Re: [PATCH v13 5/8] blk-mq: use hk cpus only when isolcpus=io_queue is enabled
From: Daniel Wagner @ 2026-05-13 9:42 UTC (permalink / raw)
To: Aaron Tomlin
Cc: axboe, kbusch, hch, sagi, mst, aacraid, James.Bottomley,
martin.petersen, liyihang9, kashyap.desai, sumit.saxena,
shivasharan.srikanteshwara, chandrakanth.patil, sathya.prakash,
sreekanth.reddy, suganath-prabu.subramani, ranjan.kumar,
jinpu.wang, tglx, mingo, peterz, juri.lelli, vincent.guittot,
akpm, maz, ruanjinjie, bigeasy, yphbchou0911, wagi, frederic,
longman, chenridong, hare, kch, ming.lei, tom.leiming, steve,
sean, chjohnst, neelx, mproche, nick.lange, marco.crivellari,
rishil1999, linux-block, linux-kernel
In-Reply-To: <20260513005509.135966-6-atomlin@atomlin.com>
On Tue, May 12, 2026 at 08:55:06PM -0400, Aaron Tomlin wrote:
> +static void blk_mq_map_fallback(struct blk_mq_queue_map *qmap)
> +{
> + unsigned int cpu;
> +
> + /*
> + * Map all CPUs to the first hctx of this specific map to ensure
> + * at least one online CPU is serving it, respecting the map's
> + * boundaries so secondary maps do not route into the default map.
> + */
> + for_each_possible_cpu(cpu)
> + qmap->mq_map[cpu] = qmap->queue_offset;
> +}
I think this should also check if the CPU is online. The fallback should
ensure the system will boot.
^ permalink raw reply
* Re: [PATCH blktests 2/3] common/rc: add _echo() function to trace sysfs attribute writes
From: Shin'ichiro Kawasaki @ 2026-05-16 12:11 UTC (permalink / raw)
To: Bart Van Assche; +Cc: linux-block, Daniel Wagner, John Meneghini
In-Reply-To: <58c5d530-416a-4dce-8aa7-099eb571bddc@acm.org>
On May 14, 2026 / 08:58, Bart Van Assche wrote:
> On 5/14/26 2:45 AM, Shin'ichiro Kawasaki wrote:
> > On May 13, 2026 / 10:17, Bart Van Assche wrote:
> > > Should "echo" or "echo -n" be used in the above shell function?
> >
> > I couldn't catch the comment above. The current patch uses "echo", and it's
> > working.
>
> We will have to switch to "echo -n" if any code is ever added to
> blktests that writes into binary sysfs/debugfs/configfs attributes.
Thanks, then "echo -n" is more appropriate. I have reflected it to the v2
series.
^ permalink raw reply
* [PATCH blktests v2 3/3] common/nvme, nvme/rc: use _set_attr() to trace attribute writes
From: Shin'ichiro Kawasaki @ 2026-05-16 12:07 UTC (permalink / raw)
To: linux-block
Cc: Daniel Wagner, John Meneghini, Bart Van Assche,
Shin'ichiro Kawasaki
In-Reply-To: <20260516120729.113659-1-shinichiro.kawasaki@wdc.com>
The previous commit introduced the helper function _set_attr(). Use it
in common/nvme and tests/nvme/rc to trace sysfs/configfs/debugfs
attribute writes.
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
---
common/nvme | 34 ++++++++++++++---------------
tests/nvme/rc | 60 +++++++++++++++++++++++++--------------------------
2 files changed, 46 insertions(+), 48 deletions(-)
diff --git a/common/nvme b/common/nvme
index 565de59..44f2fe6 100644
--- a/common/nvme
+++ b/common/nvme
@@ -570,18 +570,18 @@ _create_nvmet_port() {
traddr=$(_fc_traddr $port)
adrfam="fc"
fi
- echo "${trtype}" > "${portcfs}/addr_trtype"
- echo "${traddr}" > "${portcfs}/addr_traddr"
- echo "${adrfam}" > "${portcfs}/addr_adrfam"
+ _set_attr "${trtype}" "${portcfs}/addr_trtype"
+ _set_attr "${traddr}" "${portcfs}/addr_traddr"
+ _set_attr "${adrfam}" "${portcfs}/addr_adrfam"
if [[ "${adrfam}" != "fc" ]] && \
[[ "${adrfam}" != "loop" ]] ; then
- echo "${trsvcid}" > "${portcfs}/addr_trsvcid"
+ _set_attr "${trsvcid}" "${portcfs}/addr_trsvcid"
fi
if [[ "${trtype}" == "tcp" ]] && \
[[ "${tls}" != "none" ]]; then
- echo "tls1.3" > "${portcfs}/addr_tsas"
+ _set_attr "tls1.3" "${portcfs}/addr_tsas"
if [[ "${tls}" != "required" ]]; then
- echo "not required" > "${portcfs}/addr_treq"
+ _set_attr "not required" "${portcfs}/addr_treq"
fi
fi
echo "${port}"
@@ -601,7 +601,7 @@ _setup_nvmet_port_ana() {
fi
mkdir "${anaport}"
fi
- echo "${anastate}" > "${anaport}/ana_state"
+ _set_attr "${anastate}" "${anaport}/ana_state"
}
_remove_nvmet_port() {
@@ -722,19 +722,19 @@ _create_nvmet_ns() {
subsys_path="${NVMET_CFS}/subsystems/${subsysnqn}"
ns_path="${subsys_path}/namespaces/${nsid}"
mkdir "${ns_path}"
- printf "%s" "${blkdev}" > "${ns_path}/device_path"
+ _set_attr "$(printf "%s" "${blkdev}")" "${ns_path}/device_path"
if [[ -f "${ns_path}/resv_enable" && "${resv_enable}" = true ]] ; then
- printf 1 > "${ns_path}/resv_enable"
+ _set_attr 1 "${ns_path}/resv_enable"
fi
if [[ -n "${uuid}" ]]; then
- printf "%s" "${uuid}" > "${ns_path}/device_uuid"
+ _set_attr "$(printf "%s" "${uuid}")" "${ns_path}/device_uuid"
else
uuid=$(cat "${ns_path}/device_uuid")
fi
if (( grpid != 1 )); then
- printf "%d" "${grpid}" > "${ns_path}/ana_grpid"
+ _set_attr "$(printf "%d" "${grpid}")" "${ns_path}/ana_grpid"
fi
- printf 1 > "${ns_path}/enable"
+ _set_attr 1 "${ns_path}/enable"
echo "${uuid}"
}
@@ -748,7 +748,7 @@ _setup_nvmet_ns_ana() {
if [[ ! -d "${ns_path}" ]]; then
return
fi
- echo "${anagrpid}" > "${ns_path}/anagrpid"
+ _set_attr "${anagrpid}" "${ns_path}/anagrpid"
}
_create_nvmet_subsystem() {
@@ -786,7 +786,7 @@ _create_nvmet_subsystem() {
cfs_path="${NVMET_CFS}/subsystems/${subsystem}"
mkdir -p "${cfs_path}"
- echo 0 > "${cfs_path}/attr_allow_any_host"
+ _set_attr 0 "${cfs_path}/attr_allow_any_host"
if [[ -z "${blkdev}" ]]; then
return 0
fi
@@ -825,10 +825,10 @@ _create_nvmet_host() {
mkdir "${host_path}"
_add_nvmet_allow_hosts "${nvmet_subsystem}" "${nvmet_hostnqn}"
if [[ "${nvmet_hostkey}" ]] ; then
- echo "${nvmet_hostkey}" > "${host_path}/dhchap_key"
+ _set_attr "${nvmet_hostkey}" "${host_path}/dhchap_key"
fi
if [[ "${nvmet_ctrlkey}" ]] ; then
- echo "${nvmet_ctrlkey}" > "${host_path}/dhchap_ctrl_key"
+ _set_attr "${nvmet_ctrlkey}" "${host_path}/dhchap_ctrl_key"
fi
}
@@ -838,7 +838,7 @@ _remove_nvmet_ns() {
local subsys_path="${NVMET_CFS}/subsystems/${nvmet_subsystem}"
local nvmet_ns_path="${subsys_path}/namespaces/${nsid}"
- echo 0 > "${nvmet_ns_path}/enable"
+ _set_attr 0 "${nvmet_ns_path}/enable"
rmdir "${nvmet_ns_path}"
}
diff --git a/tests/nvme/rc b/tests/nvme/rc
index a8f80d8..d6496b3 100644
--- a/tests/nvme/rc
+++ b/tests/nvme/rc
@@ -223,12 +223,12 @@ _create_nvmet_passthru() {
local passthru_path="${subsys_path}/passthru"
mkdir -p "${subsys_path}"
- echo 0 > "${subsys_path}/attr_allow_any_host"
+ _set_attr 0 "${subsys_path}/attr_allow_any_host"
_test_dev_nvme_ctrl > "${passthru_path}/device_path"
- echo 1 > "${passthru_path}/enable"
+ _set_attr 1 "${passthru_path}/enable"
if [[ -f "${passthru_path}/clear_ids" ]]; then
- echo 1 > "${passthru_path}/clear_ids"
+ _set_attr 1 "${passthru_path}/clear_ids"
fi
}
@@ -237,7 +237,7 @@ _remove_nvmet_passhtru() {
local subsys_path="${NVMET_CFS}/subsystems/${nvmet_subsystem}"
local passthru_path="${subsys_path}/passthru"
- echo 0 > "${passthru_path}/enable"
+ _set_attr 0 "${passthru_path}/enable"
rm -f "${subsys_path}"/allowed_hosts/*
rmdir "${subsys_path}"
}
@@ -247,8 +247,7 @@ _set_nvmet_hostkey() {
local nvmet_hostkey="$2"
local cfs_path="${NVMET_CFS}/hosts/${nvmet_hostnqn}"
- echo "${nvmet_hostkey}" > \
- "${cfs_path}/dhchap_key"
+ _set_attr "${nvmet_hostkey}" "${cfs_path}/dhchap_key"
}
_set_nvmet_ctrlkey() {
@@ -256,8 +255,7 @@ _set_nvmet_ctrlkey() {
local nvmet_ctrlkey="$2"
local cfs_path="${NVMET_CFS}/hosts/${nvmet_hostnqn}"
- echo "${nvmet_ctrlkey}" > \
- "${cfs_path}/dhchap_ctrl_key"
+ _set_attr "${nvmet_ctrlkey}" "${cfs_path}/dhchap_ctrl_key"
}
_set_nvmet_hash() {
@@ -265,8 +263,7 @@ _set_nvmet_hash() {
local nvmet_hash="$2"
local cfs_path="${NVMET_CFS}/hosts/${nvmet_hostnqn}"
- echo "${nvmet_hash}" > \
- "${cfs_path}/dhchap_hash"
+ _set_attr "${nvmet_hash}" "${cfs_path}/dhchap_hash"
}
_set_nvmet_dhgroup() {
@@ -274,8 +271,7 @@ _set_nvmet_dhgroup() {
local nvmet_dhgroup="$2"
local cfs_path="${NVMET_CFS}/hosts/${nvmet_hostnqn}"
- echo "${nvmet_dhgroup}" > \
- "${cfs_path}/dhchap_dhgroup"
+ _set_attr "${nvmet_dhgroup}" "${cfs_path}/dhchap_dhgroup"
}
_enable_nvmet_ns() {
@@ -285,7 +281,7 @@ _enable_nvmet_ns() {
cfs_path="${NVMET_CFS}/subsystems/${subsysnqn}"
ns_path="${cfs_path}/namespaces/${nsid}"
- echo 1 > "${ns_path}/enable"
+ _set_attr 1 "${ns_path}/enable"
}
_disable_nvmet_ns() {
@@ -295,7 +291,7 @@ _disable_nvmet_ns() {
cfs_path="${NVMET_CFS}/subsystems/${subsysnqn}"
ns_path="${cfs_path}/namespaces/${nsid}"
- echo 0 > "${ns_path}/enable"
+ _set_attr 0 "${ns_path}/enable"
}
_set_nvmet_ns_uuid() {
@@ -473,8 +469,10 @@ _nvme_passthru_logging_setup()
_nvme_passthru_logging_cleanup()
{
- echo "$ctrl_dev_passthru_logging" > /sys/class/nvme/"$2"/passthru_err_log_enabled
- echo "$ns_dev_passthru_logging" > /sys/class/nvme/"$2"/"$1"/passthru_err_log_enabled
+ _set_attr "$ctrl_dev_passthru_logging" \
+ /sys/class/nvme/"$2"/passthru_err_log_enabled
+ _set_attr "$ns_dev_passthru_logging" \
+ /sys/class/nvme/"$2"/"$1"/passthru_err_log_enabled
}
_nvme_err_inject_setup()
@@ -495,55 +493,55 @@ _nvme_err_inject_cleanup()
local a
for a in /sys/kernel/debug/"$1"/fault_inject/*; do
- echo "${NS_DEV_FAULT_INJECT_SAVE[${a}]}" > "${a}"
+ _set_attr "${NS_DEV_FAULT_INJECT_SAVE[${a}]}" "${a}"
done
for a in /sys/kernel/debug/"$2"/fault_inject/*; do
- echo "${CTRL_DEV_FAULT_INJECT_SAVE[${a}]}" > "${a}"
+ _set_attr "${CTRL_DEV_FAULT_INJECT_SAVE[${a}]}" "${a}"
done
}
_nvme_enable_err_inject()
{
- echo "$2" > /sys/kernel/debug/"$1"/fault_inject/verbose
- echo "$3" > /sys/kernel/debug/"$1"/fault_inject/probability
- echo "$4" > /sys/kernel/debug/"$1"/fault_inject/dont_retry
- echo "$5" > /sys/kernel/debug/"$1"/fault_inject/status
- echo "$6" > /sys/kernel/debug/"$1"/fault_inject/times
+ _set_attr "$2" /sys/kernel/debug/"$1"/fault_inject/verbose
+ _set_attr "$3" /sys/kernel/debug/"$1"/fault_inject/probability
+ _set_attr "$4" /sys/kernel/debug/"$1"/fault_inject/dont_retry
+ _set_attr "$5" /sys/kernel/debug/"$1"/fault_inject/status
+ _set_attr "$6" /sys/kernel/debug/"$1"/fault_inject/times
}
_nvme_disable_err_inject()
{
- echo 0 > /sys/kernel/debug/"$1"/fault_inject/probability
- echo 0 > /sys/kernel/debug/"$1"/fault_inject/times
+ _set_attr 0 /sys/kernel/debug/"$1"/fault_inject/probability
+ _set_attr 0 /sys/kernel/debug/"$1"/fault_inject/times
}
_nvme_enable_passthru_admin_error_logging()
{
- echo on > /sys/class/nvme/"$1"/passthru_err_log_enabled
+ _set_attr on /sys/class/nvme/"$1"/passthru_err_log_enabled
}
_nvme_enable_passthru_io_error_logging()
{
- echo on > /sys/class/nvme/"$2"/"$1"/passthru_err_log_enabled
+ _set_attr on /sys/class/nvme/"$2"/"$1"/passthru_err_log_enabled
}
_nvme_disable_passthru_admin_error_logging()
{
- echo off > /sys/class/nvme/"$1"/passthru_err_log_enabled
+ _set_attr off /sys/class/nvme/"$1"/passthru_err_log_enabled
}
_nvme_disable_passthru_io_error_logging()
{
- echo off > /sys/class/nvme/"$2"/"$1"/passthru_err_log_enabled
+ _set_attr off /sys/class/nvme/"$2"/"$1"/passthru_err_log_enabled
}
_nvme_reset_ctrl() {
- echo 1 > /sys/class/nvme/"$1"/reset_controller
+ _set_attr 1 /sys/class/nvme/"$1"/reset_controller
}
_nvme_delete_ctrl() {
- echo 1 > /sys/class/nvme/"$1"/delete_controller
+ _set_attr 1 /sys/class/nvme/"$1"/delete_controller
}
# Check whether the version of the fio is greater than or equal to $1.$2.$3
--
2.54.0
^ permalink raw reply related
* [PATCH blktests v2 2/3] common/rc: add _set_attr() function to trace attribute writes
From: Shin'ichiro Kawasaki @ 2026-05-16 12:07 UTC (permalink / raw)
To: linux-block
Cc: Daniel Wagner, John Meneghini, Bart Van Assche,
Shin'ichiro Kawasaki
In-Reply-To: <20260516120729.113659-1-shinichiro.kawasaki@wdc.com>
Many test cases write to sysfs/configfs/debugfs attributes, and these
writes are important for understanding test behavior. However, bash's
xtrace feature does not record the target attribute file in commands
like `echo X > Y`; it only records `echo X`.
To capture the write target, introduce `_set_attr()`, which writes its
first argument to the file specified by its second argument. This allows
xtrace to record the complete operation (e.g., `_set_attr X Y` instead
of just `echo X`).
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
---
common/rc | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/common/rc b/common/rc
index d2c1d74..7dd5898 100644
--- a/common/rc
+++ b/common/rc
@@ -780,3 +780,10 @@ _min() {
done
echo "$ret"
}
+
+# Write a value to a sysfs/debugfs/configfs attribute. This wrapper is used to
+# trace sysfs/debugfs/configfs attribute writes when the --cmd-trace option is
+# enabled.
+_set_attr() {
+ echo -n "$1" > "$2"
+}
--
2.54.0
^ permalink raw reply related
* [PATCH blktests v2 1/3] check: add --cmd-trace option
From: Shin'ichiro Kawasaki @ 2026-05-16 12:07 UTC (permalink / raw)
To: linux-block
Cc: Daniel Wagner, John Meneghini, Bart Van Assche,
Shin'ichiro Kawasaki
In-Reply-To: <20260516120729.113659-1-shinichiro.kawasaki@wdc.com>
Test cases that use helper functions can be difficult to understand due
to deep nesting. To make test execution easier to follow, add a new
--cmd-trace (or -t) option to record the commands executed during test
runs.
The trace is implemented using bash's xtrace feature. Enable xtrace with
`set -x` before each test case and redirect the trace output to a
`.cmdtrace` file in the result directory.
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
---
check | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/check b/check
index c166fae..a68049b 100755
--- a/check
+++ b/check
@@ -458,7 +458,17 @@ _call_test() {
TIMEFORMAT="%Rs"
pushd . >/dev/null || return
+ if ((CMD_TRACE)); then
+ exec 8>"${seqres}.cmdtrace"
+ export BASH_XTRACEFD=8
+ set -x
+ fi
{ time "$test_func" >"${seqres}.out" 2>&1; } 2>"${seqres}.runtime"
+ if ((CMD_TRACE)); then
+ set +x
+ unset BASH_XTRACEFD
+ exec 8>&-
+ fi
TEST_RUN["exit_status"]=$?
popd >/dev/null || return
TEST_RUN["runtime"]="$(cat "${seqres}.runtime")"
@@ -1157,7 +1167,7 @@ Miscellaneous:
_check_dependencies
-if ! TEMP=$(getopt -o 'do:q::x:c:h' --long 'device-only,quick::,exclude:,output:,config:,help' -n "$0" -- "$@"); then
+if ! TEMP=$(getopt -o 'do:q::x:c:th' --long 'device-only,quick::,exclude:,output:,config:,cmd-trace,help' -n "$0" -- "$@"); then
exit 1
fi
@@ -1165,6 +1175,7 @@ eval set -- "$TEMP"
unset TEMP
LOADED_CONFIG=0
+CMD_TRACE=0
OPTION_EXCLUDE=()
while true; do
case "$1" in
@@ -1192,6 +1203,10 @@ while true; do
LOADED_CONFIG=1
shift 2
;;
+ '-t'|'--cmd-trace')
+ CMD_TRACE=1
+ shift
+ ;;
'-h'|'--help')
usage out
;;
--
2.54.0
^ permalink raw reply related
* [PATCH blktests v2 0/3] introduce command trace feature
From: Shin'ichiro Kawasaki @ 2026-05-16 12:07 UTC (permalink / raw)
To: linux-block
Cc: Daniel Wagner, John Meneghini, Bart Van Assche,
Shin'ichiro Kawasaki
Some blktests test cases have deep nesting, making their behavior
difficult to understand. For example, the nvme test group has many
helper functions that set sysfs attribute values and call nvme-cli
commands. Understanding these behaviors is essential for debugging test
case failures.
This series adds a new 'command trace' feature to blktests. The first
patch introduces a new --cmd-trace (or -t) option to record commands
executed during test runs. The second and third patches add a new helper
function _set_attr(), which traces both the value and file name of sysfs
attribute writes.
With this series, blktests users can use the option to generate a
.cmdtrace file that records all commands executed during a test case
run. By grepping the .cmdtrace file, users can check writes to sysfs
attributes and nvme-cli command invocations. The example below shows how
nvme targets are set up for the nvme/008 test case with rdma transport.
# NVMET_TRTYPES=rdma NVMET_BLKDEV_TYPES=device ./check --cmd-trace nvme/008
nvme/008 (tr=rdma bd=device) (create an NVMeOF host) [passed]
runtime 1.903s ... 1.890s
# grep -e _set_attr -e "nvme " results/nodev_tr_rdma_bd_device/nvme/008.cmdtrace
+ _set_attr 0 /sys/kernel/config/nvmet/subsystems/blktests-subsystem-1/attr_allow_any_host
+ _set_attr /dev/loop0 /sys/kernel/config/nvmet/subsystems/blktests-subsystem-1/namespaces/1/device_path
+ _set_attr 91fdba0d-f87b-4c25-b80f-db7be1418b9e /sys/kernel/config/nvmet/subsystems/blktests-subsystem-1/namespaces/1/device_uuid
+ _set_attr 1 /sys/kernel/config/nvmet/subsystems/blktests-subsystem-1/namespaces/1/enable
++ _set_attr rdma /sys/kernel/config/nvmet/ports/0/addr_trtype
++ _set_attr 10.0.2.15 /sys/kernel/config/nvmet/ports/0/addr_traddr
++ _set_attr ipv4 /sys/kernel/config/nvmet/ports/0/addr_adrfam
++ _set_attr 4420 /sys/kernel/config/nvmet/ports/0/addr_trsvcid
++ nvme connect --traddr 10.0.2.15 --transport rdma --trsvcid 4420 --nqn blktests-subsystem-1 --hostnqn=nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349 --hostid=0f01fb42-9f7f-4856-b0b3-51e60b8de349 --output-format=json
+ nvme disconnect --nqn blktests-subsystem-1
+ _set_attr 0 /sys/kernel/config/nvmet/subsystems/blktests-subsystem-1/namespaces/1/enable
Changes from v1:
- 2nd patch: added -n option to the echo command
- 2nd and 3rd patches: renamed _echo() to _set_attr()
- Link to v1: https://lore.kernel.org/linux-block/20260513112326.584256-1-shinichiro.kawasaki@wdc.com/
Shin'ichiro Kawasaki (3):
check: add --cmd-trace option
common/rc: add _set_attr() function to trace attribute writes
common/nvme, nvme/rc: use _set_attr() to trace attribute writes
check | 17 ++++++++++++++-
common/nvme | 34 ++++++++++++++---------------
common/rc | 7 ++++++
tests/nvme/rc | 60 +++++++++++++++++++++++++--------------------------
4 files changed, 69 insertions(+), 49 deletions(-)
--
2.54.0
^ permalink raw reply
* [PATCH v2] cgroup/rstat: validate cpu before css_rstat_cpu() access
From: Qing Ming @ 2026-05-16 7:08 UTC (permalink / raw)
To: Tejun Heo, Josef Bacik, Jens Axboe, Johannes Weiner,
Michal Koutný, Michal Hocko, Roman Gushchin, Shakeel Butt,
Muchun Song, Andrew Morton, Alexei Starovoitov, Hao Luo,
Yosry Ahmed
Cc: cgroups, linux-block, linux-kernel, linux-mm, bpf, Qing Ming
In-Reply-To: <20260515122952.59209-1-a0yami@mailbox.org>
css_rstat_updated() is exposed as a BPF kfunc and accepts a
caller-provided cpu argument. The function uses cpu for per-cpu rstat
lookups without checking whether it refers to a valid possible CPU.
A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an
invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==
0x7fffffff triggers:
UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9
index 2147483647 is out of range for type 'long unsigned int [64]'
Call Trace:
css_rstat_updated
bpf_iter_run_prog
cgroup_iter_seq_show
bpf_seq_read
Add cpu validation to the BPF-facing css_rstat_updated() kfunc and
move the common implementation to __css_rstat_updated() for in-kernel
callers.
Fixes: a319185be9f5 ("cgroup: bpf: enable bpf programs to integrate with rstat")
Signed-off-by: Qing Ming <a0yami@mailbox.org>
---
v2:
- Split css_rstat_updated() into a BPF-visible wrapper and an internal
__css_rstat_updated() helper.
- Switch internal callers to __css_rstat_updated().
block/blk-cgroup.c | 2 +-
include/linux/cgroup.h | 1 +
kernel/cgroup/rstat.c | 30 ++++++++++++++++++++----------
mm/memcontrol.c | 6 +++---
4 files changed, 25 insertions(+), 14 deletions(-)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 554c87bb4a86..bc63bd220865 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -2241,7 +2241,7 @@ void blk_cgroup_bio_start(struct bio *bio)
}
u64_stats_update_end_irqrestore(&bis->sync, flags);
- css_rstat_updated(&blkcg->css, cpu);
+ __css_rstat_updated(&blkcg->css, cpu);
put_cpu();
}
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index f6d037a30fd8..c5648fcf74e2 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -777,6 +777,7 @@ static inline void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen)
/*
* cgroup scalable recursive statistics.
*/
+void __css_rstat_updated(struct cgroup_subsys_state *css, int cpu);
void css_rstat_updated(struct cgroup_subsys_state *css, int cpu);
void css_rstat_flush(struct cgroup_subsys_state *css);
diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c
index 150e5871e66f..ed60ba119c68 100644
--- a/kernel/cgroup/rstat.c
+++ b/kernel/cgroup/rstat.c
@@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
#include "cgroup-internal.h"
+#include <linux/cpumask.h>
#include <linux/sched/cputime.h>
#include <linux/bpf.h>
@@ -53,7 +54,7 @@ static inline struct llist_head *ss_lhead_cpu(struct cgroup_subsys *ss, int cpu)
}
/**
- * css_rstat_updated - keep track of updated rstat_cpu
+ * __css_rstat_updated - keep track of updated rstat_cpu
* @css: target cgroup subsystem state
* @cpu: cpu on which rstat_cpu was updated
*
@@ -63,20 +64,17 @@ static inline struct llist_head *ss_lhead_cpu(struct cgroup_subsys *ss, int cpu)
*
* NOTE: if the user needs the guarantee that the updater either add itself in
* the lockless list or the concurrent flusher flushes its updated stats, a
- * memory barrier is needed before the call to css_rstat_updated() i.e. a
+ * memory barrier is needed before the call to __css_rstat_updated() i.e. a
* barrier after updating the per-cpu stats and before calling
- * css_rstat_updated().
+ * __css_rstat_updated().
*/
-__bpf_kfunc void css_rstat_updated(struct cgroup_subsys_state *css, int cpu)
+void __css_rstat_updated(struct cgroup_subsys_state *css, int cpu)
{
struct llist_head *lhead;
struct css_rstat_cpu *rstatc;
struct llist_node *self;
- /*
- * Since bpf programs can call this function, prevent access to
- * uninitialized rstat pointers.
- */
+ /* Prevent access to uninitialized rstat pointers. */
if (!css_uses_rstat(css))
return;
@@ -125,6 +123,18 @@ __bpf_kfunc void css_rstat_updated(struct cgroup_subsys_state *css, int cpu)
llist_add(&rstatc->lnode, lhead);
}
+/*
+ * BPF-facing wrapper for __css_rstat_updated(). Validate the caller-provided
+ * CPU before passing it to the internal rstat updater.
+ */
+__bpf_kfunc void css_rstat_updated(struct cgroup_subsys_state *css, int cpu)
+{
+ if (unlikely(cpu < 0 || cpu >= nr_cpu_ids || !cpu_possible(cpu)))
+ return;
+
+ __css_rstat_updated(css, cpu);
+}
+
static void __css_process_update_tree(struct cgroup_subsys_state *css, int cpu)
{
/* put @css and all ancestors on the corresponding updated lists */
@@ -170,7 +180,7 @@ static void css_process_update_tree(struct cgroup_subsys *ss, int cpu)
* flusher flush the stats updated by the updater who have
* observed that they are already on the list. The
* corresponding barrier pair for this one should be before
- * css_rstat_updated() by the user.
+ * __css_rstat_updated() by the user.
*
* For now, there aren't any such user, so not adding the
* barrier here but if such a use-case arise, please add
@@ -614,7 +624,7 @@ static void cgroup_base_stat_cputime_account_end(struct cgroup *cgrp,
unsigned long flags)
{
u64_stats_update_end_irqrestore(&rstatbc->bsync, flags);
- css_rstat_updated(&cgrp->self, smp_processor_id());
+ __css_rstat_updated(&cgrp->self, smp_processor_id());
put_cpu_ptr(rstatbc);
}
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index c03d4787d466..749c128b4fad 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -679,7 +679,7 @@ static inline void memcg_rstat_updated(struct mem_cgroup *memcg, long val,
if (!val)
return;
- css_rstat_updated(&memcg->css, cpu);
+ __css_rstat_updated(&memcg->css, cpu);
statc_pcpu = memcg->vmstats_percpu;
for (; statc_pcpu; statc_pcpu = statc->parent_pcpu) {
statc = this_cpu_ptr(statc_pcpu);
@@ -2796,7 +2796,7 @@ static inline void account_slab_nmi_safe(struct mem_cgroup *memcg,
struct mem_cgroup_per_node *pn = memcg->nodeinfo[pgdat->node_id];
/* preemption is disabled in_nmi(). */
- css_rstat_updated(&memcg->css, smp_processor_id());
+ __css_rstat_updated(&memcg->css, smp_processor_id());
if (idx == NR_SLAB_RECLAIMABLE_B)
atomic_add(nr, &pn->slab_reclaimable);
else
@@ -3019,7 +3019,7 @@ static inline void account_kmem_nmi_safe(struct mem_cgroup *memcg, int val)
mod_memcg_state(memcg, MEMCG_KMEM, val);
} else {
/* preemption is disabled in_nmi(). */
- css_rstat_updated(&memcg->css, smp_processor_id());
+ __css_rstat_updated(&memcg->css, smp_processor_id());
atomic_add(val, &memcg->kmem_stat);
}
}
--
2.53.0
^ permalink raw reply related
* Re: [REGRESSION] block: virtio-blk + LVM raid1 spurious sector-0 read failures on libaio/threads submit since 5ff3f74e145a ("block: simplify direct io validity check")
From: Thorsten Leemhuis @ 2026-05-16 5:09 UTC (permalink / raw)
To: Vjaceslavs Klimovs, Jens Axboe
Cc: Keith Busch, Hannes Reinecke, Martin K. Petersen,
Christoph Hellwig, linux-block, linux-raid, dm-devel,
linux-kernel, regressions
In-Reply-To: <CAC_j7i1R7oy+nRhxEjCTba=DUgn02w9X+p94DCu0aHv5+5tKnQ@mail.gmail.com>
On 5/15/26 18:52, Vjaceslavs Klimovs wrote:
> Summary
> -------
> On v6.18, starting a libvirt/QEMU guest with virtio-blk backed by an
> LVM "--type raid1" LV (drivers/md/dm-raid.c stacked on
> drivers/md/raid1.c) makes md/raid1 register read failures at LV
> sector 0 within seconds of "virsh start" and mark rimage_0 Faulty
> once max_corrected_read_errors (default 20) is exceeded. Reads
> succeed via the redirect path so guests boot, but every guest disk
> ends up degraded on every VM start. Same workload on legacy
> "--type mirror" (drivers/md/dm-raid1.c) crashes the host: a
> zero-length READ reaches the NVMe controller, is rejected with
> "Invalid Field in Command", and the dm-mirror recovery path oopses.
That sounds somewhat like
https://lore.kernel.org/all/2982107.4sosBPzcNG@electra/
Have you tried latest 7.1-rc? It contains a fix for the problem
mentioned in said thread: f7b24c7b41f23b ("md/raid1,raid10: don't fail
devices for invalid IO errors") [v7.1-rc2]
Ciao, Thorsten
> Symptom on dm-raid raid1 (post --type raid1)
> --------------------------------------------
> Per LV, at virsh start, in host dmesg:
>
> kernel: raid1_end_read_request: 95 callbacks suppressed
> kernel: raid1_read_request: 95 callbacks suppressed
> kernel: md/raid1:mdX: dm-58: rescheduling sector 0
> kernel: md/raid1:mdX: redirecting sector 0 to other mirror: dm-58
> kernel: md/raid1:mdX: dm-58: rescheduling sector 0
> kernel: md/raid1:mdX: redirecting sector 0 to other mirror: dm-58
> [... 10 rescheduling/redirecting pairs ...]
> kernel: md/raid1:mdX: dm-58: Raid device exceeded read_error
> threshold [cur 21:max 20]
> kernel: md/raid1:mdX: dm-58: Failing raid device
> kernel: md/raid1:mdX: Disk failure on dm-58, disabling device.
> kernel: md/raid1:mdX: Operation continuing on 1 devices.
>
> dmeventd: WARNING: Device #0 of raid1 array, vg0-iris_boot, has failed.
> dmeventd: WARNING: Waiting for resynchronization to finish before
> initiating repair on RAID device vg0-iris_boot.
> dmeventd: Use 'lvconvert --repair vg0/iris_boot' to replace failed device.
>
> Subsequent "lvs -a":
>
> WARNING: RaidLV vg0/iris_boot needs to be refreshed!
> See character 'r' at position 9 in the RaidLV's attributes and its SubLV(s).
>
> dmesg | grep nvme is EMPTY on this path. The NVMe driver is not
> involved in producing the error; the failure originates between the
> virtio-blk bio submission and raid1_end_read_request().
>
> Symptom on legacy dm-mirror (pre-conversion --type mirror)
> ----------------------------------------------------------
> Same workload on drivers/md/dm-raid1.c reaches the NVMe controller
> as a zero-length READ and panics the host through dm-mirror's
> recovery path:
>
> kernel: operation not supported error, dev nvme1n1, sector 935446535
> op 0x0:(READ) flags 0x0 phys_seg 0 prio class 2
> kernel: nvme1n1: I/O Cmd(0x2) @ LBA 935446535, 0 blocks, I/O Error
> (sct 0x0 / sc 0x2)
> [... 10+ identical bursts at same timestamp ...]
> dmeventd: Primary mirror device 252:58 read failed.
> dmeventd: vg0-iris_boot is now in-sync.
> [kernel oops in dm_mirror recovery path, full trace lost to console flash]
>
> The "phys_seg 0", "0 blocks", "sct 0x0/sc 0x2" trio (NVMe Generic,
> Invalid Field in Command, NVMe spec 4.1.1.2) is unambiguous: a bio
> with bi_iter.bi_size == 0 and bi_vcnt == 0 left the block layer and
> hit the controller. dm-raid raid1 hides this by retrying on the
> surviving leg, but the upstream-of-md trigger is identical.
>
> Bisect
> ------
> git bisect, v6.12..v6.18, 16 deterministic GOOD/BAD steps, no skips,
> ~104 minutes:
>
> 5ff3f74e145adc79b49668adb8de276446acf6be is the first bad commit
> block: simplify direct io validity check
>
> --- a/block/fops.c
> +++ b/block/fops.c
> @@ -38,8 +38,8 @@ static blk_opf_t dio_bio_write_op(struct kiocb *iocb)
> static bool blkdev_dio_invalid(struct block_device *bdev, struct kiocb *iocb,
> struct iov_iter *iter)
> {
> - return iocb->ki_pos & (bdev_logical_block_size(bdev) - 1) ||
> - !bdev_iter_is_aligned(bdev, iter);
> + return (iocb->ki_pos | iov_iter_count(iter)) &
> + (bdev_logical_block_size(bdev) - 1);
> }
>
> The dropped bdev_iter_is_aligned() used to walk the iov_iter and
> reject per-segment misaligned/degenerate vectors at the blkdev fops
> entry point. The replacement only validates ki_pos and total length
> against the logical block size. Cases that now pass that no longer
> get rejected:
>
> - iter with iov_iter_count(iter) == 0 (degenerate; total length is
> "sector-aligned" since 0 % 512 == 0)
> - iter where total length is sector-aligned but a segment isn't
>
> The commit message justifies the removal with "The block layer
> checks all the segments for validity later". This is true for the
> io_uring submit path (which enters __blkdev_direct_IO directly and
> does its own validation) but not for the libaio aio_read/write_iter
> or the worker-pool sync read/write_iter paths that enter via
> blkdev_{read,write}_iter() -> blkdev_dio_invalid(). For those paths,
> the segment check has no replacement.
>
> Reproducing
> ----------------------------------------------------------
>
> The trigger requires QEMU virtio-blk's specific submission shape AND
> a non-io_uring submit. Userspace libaio alone, userspace
> preadv-in-a-thread alone, and QEMU's raw-driver open probes (which
> qemu-img info exercises identically) are all insufficient. The
> combination that hits the bug is "guest-driven I/O through
> virtio-blk-pci with cache.direct=on and aio in {native, threads}".
>
> #regzbot introduced: 5ff3f74e145adc79b49668adb8de276446acf6be
>
> Thanks,
> Vjaceslavs Klimovs
>
^ permalink raw reply
* [PATCH] blk-cgroup-rwstat: add missing DISCARD counter in blkg_rwstat_total()
From: Tao Cui @ 2026-05-16 4:47 UTC (permalink / raw)
To: axboe, tj, linux-block; +Cc: Tao Cui
Since commit 636620b66d5d ("blkcg: Track DISCARD statistics and output
them in cgroup io.stat"), blkg_rwstat_add() routes discard IOs into
BLKG_RWSTAT_DISCARD, but blkg_rwstat_total() still only sums READ and
WRITE. This makes the total inconsistent with the per-type counters
whenever discard IOs are present.
On mixed read/write/discard workloads, the total undercounts the
actual IO activity. If only discard requests are queued, the total
returns 0 outright. In BFQ this causes avg_queue_size to be
underestimated and the group to be incorrectly marked empty.
The affected BFQ code paths are all gated by CONFIG_BFQ_CGROUP_DEBUG
and used only for statistics display (bfq.sectors, bfq.avg_queue_size,
bfq.empty_time). No scheduling decisions depend on these values.
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
block/blk-cgroup-rwstat.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/block/blk-cgroup-rwstat.h b/block/blk-cgroup-rwstat.h
index 703a16fe1404..b7908d877e2b 100644
--- a/block/blk-cgroup-rwstat.h
+++ b/block/blk-cgroup-rwstat.h
@@ -110,7 +110,8 @@ static inline uint64_t blkg_rwstat_total(struct blkg_rwstat *rwstat)
struct blkg_rwstat_sample tmp = { };
blkg_rwstat_read(rwstat, &tmp);
- return tmp.cnt[BLKG_RWSTAT_READ] + tmp.cnt[BLKG_RWSTAT_WRITE];
+ return tmp.cnt[BLKG_RWSTAT_READ] + tmp.cnt[BLKG_RWSTAT_WRITE] +
+ tmp.cnt[BLKG_RWSTAT_DISCARD];
}
/**
--
2.43.0
^ permalink raw reply related
* Re: [PATCH 01/12] swap: remove the maxpages variable in sys_swapon
From: Chris Li @ 2026-05-15 22:37 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Andrew Morton, Kairui Song, Christian Brauner, Darrick J . Wong,
Jens Axboe, David Sterba, Theodore Ts'o, Jaegeuk Kim, Chao Yu,
Trond Myklebust, Anna Schumaker, Namjae Jeon, Hyunchul Lee,
Steve French, Paulo Alcantara, Carlos Maiolino, Damien Le Moal,
Naohiro Aota, linux-xfs, linux-fsdevel, linux-doc, linux-mm,
linux-block, linux-btrfs, linux-ext4, linux-f2fs-devel, linux-nfs,
linux-cifs
In-Reply-To: <20260512053625.2950900-2-hch@lst.de>
On Mon, May 11, 2026 at 10:36 PM Christoph Hellwig <hch@lst.de> wrote:
>
> Always use si->max which is updated setup_swap_extents instead of copying
> into and out of maxpages.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Chris Li <chrisl@kernel.org>
> ---
> mm/swapfile.c | 27 +++++++++++----------------
> 1 file changed, 11 insertions(+), 16 deletions(-)
>
> diff --git a/mm/swapfile.c b/mm/swapfile.c
> index 9174f1eeffb0..f7ebd97e28a3 100644
> --- a/mm/swapfile.c
> +++ b/mm/swapfile.c
> @@ -3350,10 +3350,9 @@ static unsigned long read_swap_header(struct swap_info_struct *si,
> }
>
> static int setup_swap_clusters_info(struct swap_info_struct *si,
> - union swap_header *swap_header,
> - unsigned long maxpages)
> + union swap_header *swap_header)
> {
> - unsigned long nr_clusters = DIV_ROUND_UP(maxpages, SWAPFILE_CLUSTER);
> + unsigned long nr_clusters = DIV_ROUND_UP(si->max, SWAPFILE_CLUSTER);
> struct swap_cluster_info *cluster_info;
> int err = -ENOMEM;
> unsigned long i;
> @@ -3395,7 +3394,7 @@ static int setup_swap_clusters_info(struct swap_info_struct *si,
> if (err)
> goto err;
> }
> - for (i = maxpages; i < round_up(maxpages, SWAPFILE_CLUSTER); i++) {
> + for (i = si->max; i < round_up(si->max, SWAPFILE_CLUSTER); i++) {
> err = swap_cluster_setup_bad_slot(si, cluster_info, i, true);
Nitpick: I couldn't hlep but notice the si->max does not change
between setup bad slots, so in theory you can cache the si->max value
to a local variable for the loop. In real life, it will make no
difference, so feel free to keep it as is.
Chris
^ permalink raw reply
* Re: [PATCH 02/12] swap: move boilerplate code into the core swap code
From: Chris Li @ 2026-05-15 22:29 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Andrew Morton, Kairui Song, Christian Brauner, Darrick J . Wong,
Jens Axboe, David Sterba, Theodore Ts'o, Jaegeuk Kim, Chao Yu,
Trond Myklebust, Anna Schumaker, Namjae Jeon, Hyunchul Lee,
Steve French, Paulo Alcantara, Carlos Maiolino, Damien Le Moal,
Naohiro Aota, linux-xfs, linux-fsdevel, linux-doc, linux-mm,
linux-block, linux-btrfs, linux-ext4, linux-f2fs-devel, linux-nfs,
linux-cifs
In-Reply-To: <20260512053625.2950900-3-hch@lst.de>
On Mon, May 11, 2026 at 10:36 PM Christoph Hellwig <hch@lst.de> wrote:
>
> Make the core swap code calculate sis->pages, nr_extents and the span,
> re-set sis->max based on it and don't require passing the current offset
> into the swap file to swap_add_extent as all that can trivially be
> calculated internally. Also truncate the spans based on the available
> information.
>
> All this removes a lot of boilerplate code in the callers.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
Very nice cleanup.
Acked-by: Chris Li <chrisl@kernel.org>
Chris
^ permalink raw reply
* Re: [PATCH 03/12] swap,fs: move swapfile operations to struct file_operations
From: Chris Li @ 2026-05-15 22:24 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Andrew Morton, Kairui Song, Christian Brauner, Darrick J . Wong,
Jens Axboe, David Sterba, Theodore Ts'o, Jaegeuk Kim, Chao Yu,
Trond Myklebust, Anna Schumaker, Namjae Jeon, Hyunchul Lee,
Steve French, Paulo Alcantara, Carlos Maiolino, Damien Le Moal,
Naohiro Aota, linux-xfs, linux-fsdevel, linux-doc, linux-mm,
linux-block, linux-btrfs, linux-ext4, linux-f2fs-devel, linux-nfs,
linux-cifs
In-Reply-To: <20260512053625.2950900-4-hch@lst.de>
On Mon, May 11, 2026 at 10:37 PM Christoph Hellwig <hch@lst.de> wrote:
>
> The swap operations have nothing to do with the address_space, which is
> used for pagecache operations. Move them to struct file_operations
> instead. This will allow moving the block device special cases into
> block/fops.c subsequently.
>
> Pass struct file first to ->swap_activate as file operations typically
> get the file or iocb as first argument and use swap_activate instead of
> swapfile_activate in all names to be consistent.
>
> Note that while the trivial iomap wrappers are moved to a new file when
> applicable to keep them local to the file operation instances, complex
> implementation are kept in their existing place. It might be worth to
> move them in follow-on patches if the maintainers desire so.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
That makes sense to me. I ack for the core swap part of the code.
Acked-by: Chris Li <chrisl@kernel.org>
Chris
^ permalink raw reply
* Re: [PATCH 04/12] swap: restrict to regular files or block devices
From: Chris Li @ 2026-05-15 22:19 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Andrew Morton, Kairui Song, Christian Brauner, Darrick J . Wong,
Jens Axboe, David Sterba, Theodore Ts'o, Jaegeuk Kim, Chao Yu,
Trond Myklebust, Anna Schumaker, Namjae Jeon, Hyunchul Lee,
Steve French, Paulo Alcantara, Carlos Maiolino, Damien Le Moal,
Naohiro Aota, linux-xfs, linux-fsdevel, linux-doc, linux-mm,
linux-block, linux-btrfs, linux-ext4, linux-f2fs-devel, linux-nfs,
linux-cifs
In-Reply-To: <20260512053625.2950900-5-hch@lst.de>
On Mon, May 11, 2026 at 10:37 PM Christoph Hellwig <hch@lst.de> wrote:
>
> Various swap code assumes it runs either on a block device or on a
> regular file. Make this restriction explicit using checks right
> after opening the file.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Chris Li <chrisl@kernel.org>
Chris
^ permalink raw reply
* Re: [PATCH 05/12] swap: cleanup setup_swap_extents
From: Chris Li @ 2026-05-15 22:18 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Andrew Morton, Kairui Song, Christian Brauner, Darrick J . Wong,
Jens Axboe, David Sterba, Theodore Ts'o, Jaegeuk Kim, Chao Yu,
Trond Myklebust, Anna Schumaker, Namjae Jeon, Hyunchul Lee,
Steve French, Paulo Alcantara, Carlos Maiolino, Damien Le Moal,
Naohiro Aota, linux-xfs, linux-fsdevel, linux-doc, linux-mm,
linux-block, linux-btrfs, linux-ext4, linux-f2fs-devel, linux-nfs,
linux-cifs
In-Reply-To: <20260512053625.2950900-6-hch@lst.de>
On Mon, May 11, 2026 at 10:37 PM Christoph Hellwig <hch@lst.de> wrote:
>
> Reflow setup_swap_extents so that the flag checking is not conditional on
> a swap_activate method. This is currently a no-op because the swapoff
> code still checks the presence of a swap_deactivate method, but it
> simplifies adding a new check, and also makes the SWP_ACTIVATED flag
> more consistent.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Chris Li <chrisl@kernel.org>
Chris
^ permalink raw reply
* Re: [PATCH 06/12] swap,block: move the block device swapon code into block/fops.c
From: Chris Li @ 2026-05-15 22:14 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Andrew Morton, Kairui Song, Christian Brauner, Darrick J . Wong,
Jens Axboe, David Sterba, Theodore Ts'o, Jaegeuk Kim, Chao Yu,
Trond Myklebust, Anna Schumaker, Namjae Jeon, Hyunchul Lee,
Steve French, Paulo Alcantara, Carlos Maiolino, Damien Le Moal,
Naohiro Aota, linux-xfs, linux-fsdevel, linux-doc, linux-mm,
linux-block, linux-btrfs, linux-ext4, linux-f2fs-devel, linux-nfs,
linux-cifs
In-Reply-To: <20260512053625.2950900-7-hch@lst.de>
On Mon, May 11, 2026 at 10:37 PM Christoph Hellwig <hch@lst.de> wrote:
>
> Make use of the abstractions we have. This is a preparation for
> moving more special casing down into block/.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Chris Li <chrisl@kernel.org>
Chris
^ permalink raw reply
* Re: [PATCH 09/12] swap: push down setting sis->bdev into ->swap_activate
From: Chris Li @ 2026-05-15 22:12 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Andrew Morton, Kairui Song, Christian Brauner, Darrick J . Wong,
Jens Axboe, David Sterba, Theodore Ts'o, Jaegeuk Kim, Chao Yu,
Trond Myklebust, Anna Schumaker, Namjae Jeon, Hyunchul Lee,
Steve French, Paulo Alcantara, Carlos Maiolino, Damien Le Moal,
Naohiro Aota, linux-xfs, linux-fsdevel, linux-doc, linux-mm,
linux-block, linux-btrfs, linux-ext4, linux-f2fs-devel, linux-nfs,
linux-cifs
In-Reply-To: <20260512053625.2950900-10-hch@lst.de>
On Mon, May 11, 2026 at 10:37 PM Christoph Hellwig <hch@lst.de> wrote:
>
> Only the file operation method knows what block device we'll swap
> to. So move down setting sis->bdev and the special blockdev flag
> into ->swap_activate.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
The core swap part of the code looks fine to me, I did not look much
deeper into the fs side.
Ack-by: Chris Li <chrisl@kernel.org>
Chris
^ permalink raw reply
* Re: [PATCH 10/12] swap: add a swap_activate_fs_ops helper
From: Chris Li @ 2026-05-15 22:00 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Andrew Morton, Kairui Song, Christian Brauner, Darrick J . Wong,
Jens Axboe, David Sterba, Theodore Ts'o, Jaegeuk Kim, Chao Yu,
Trond Myklebust, Anna Schumaker, Namjae Jeon, Hyunchul Lee,
Steve French, Paulo Alcantara, Carlos Maiolino, Damien Le Moal,
Naohiro Aota, linux-xfs, linux-fsdevel, linux-doc, linux-mm,
linux-block, linux-btrfs, linux-ext4, linux-f2fs-devel, linux-nfs,
linux-cifs
In-Reply-To: <20260512053625.2950900-11-hch@lst.de>
On Mon, May 11, 2026 at 10:37 PM Christoph Hellwig <hch@lst.de> wrote:
>
> Add a helper abstracting away the low-level details of enabling
> fs_ops-based swapping. This prepares for taking swap_info_struct
> private.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Chris Li <chrisl@kernel.org>
Chris
^ permalink raw reply
* Re: [PATCH 11/12] swap: move struct swap_extent to swapfile.c
From: Chris Li @ 2026-05-15 21:58 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Andrew Morton, Kairui Song, Christian Brauner, Darrick J . Wong,
Jens Axboe, David Sterba, Theodore Ts'o, Jaegeuk Kim, Chao Yu,
Trond Myklebust, Anna Schumaker, Namjae Jeon, Hyunchul Lee,
Steve French, Paulo Alcantara, Carlos Maiolino, Damien Le Moal,
Naohiro Aota, linux-xfs, linux-fsdevel, linux-doc, linux-mm,
linux-block, linux-btrfs, linux-ext4, linux-f2fs-devel, linux-nfs,
linux-cifs
In-Reply-To: <20260512053625.2950900-12-hch@lst.de>
On Mon, May 11, 2026 at 10:38 PM Christoph Hellwig <hch@lst.de> wrote:
>
> struct swap_extent is only used inside of mm/swapfile.c, so move it
> there.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Chris Li <chrisl@kernel.org>
Chris
^ permalink raw reply
* Re: [PATCH 12/12] swap: move swap_info_struct to mm/swap.h
From: Chris Li @ 2026-05-15 21:58 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Andrew Morton, Kairui Song, Christian Brauner, Darrick J . Wong,
Jens Axboe, David Sterba, Theodore Ts'o, Jaegeuk Kim, Chao Yu,
Trond Myklebust, Anna Schumaker, Namjae Jeon, Hyunchul Lee,
Steve French, Paulo Alcantara, Carlos Maiolino, Damien Le Moal,
Naohiro Aota, linux-xfs, linux-fsdevel, linux-doc, linux-mm,
linux-block, linux-btrfs, linux-ext4, linux-f2fs-devel, linux-nfs,
linux-cifs
In-Reply-To: <20260512053625.2950900-13-hch@lst.de>
On Mon, May 11, 2026 at 10:38 PM Christoph Hellwig <hch@lst.de> wrote:
>
> swap_info_struct is now internal to the MM subsystem, so remove it from
> the public header.
>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Chris Li <chrisl@kernel.org>
Chris
^ permalink raw reply
* Re: improve the swap_activate interface
From: Chris Li @ 2026-05-15 21:40 UTC (permalink / raw)
To: Christoph Hellwig
Cc: Andrew Morton, Kairui Song, Christian Brauner, Darrick J . Wong,
Jens Axboe, David Sterba, Theodore Ts'o, Jaegeuk Kim, Chao Yu,
Trond Myklebust, Anna Schumaker, Namjae Jeon, Hyunchul Lee,
Steve French, Paulo Alcantara, Carlos Maiolino, Damien Le Moal,
Naohiro Aota, linux-xfs, linux-fsdevel, linux-doc, linux-mm,
linux-block, linux-btrfs, linux-ext4, linux-f2fs-devel, linux-nfs,
linux-cifs
In-Reply-To: <20260512053625.2950900-1-hch@lst.de>
On Mon, May 11, 2026 at 10:36 PM Christoph Hellwig <hch@lst.de> wrote:
>
> Hi all,
>
> Darrick recently posted iomap support for fuse-iomap, which was trivial
> but a bit ugly, which triggered me into looking how this could be done
> in a cleaner way. The result of that is this fairly big series that
> reworks how the MM code calls into the file system to activate swap
> files to make it much cleaner and easier to use.
My first impression it looks very promising. I will need more time to
take a closer look.
BTW, I just tried it, this series conflicts with Kairui's swap table
phase IV series. Might need to coordinate the merge order with Kairui.
Chris
^ permalink raw reply
* Re: [GIT PULL] Block fixes for 7.1-rc4
From: pr-tracker-bot @ 2026-05-15 20:10 UTC (permalink / raw)
To: Jens Axboe; +Cc: Linus Torvalds, linux-block@vger.kernel.org
In-Reply-To: <093dc3c7-5030-4400-9b38-727c41c5f511@kernel.dk>
The pull request you sent on Fri, 15 May 2026 08:20:27 -0600:
> https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git tags/block-7.1-20260515
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/d458a240344c4369bf6f3da203f2779515177738
Thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html
^ permalink raw reply
* [REGRESSION] block: virtio-blk + LVM raid1 spurious sector-0 read failures on libaio/threads submit since 5ff3f74e145a ("block: simplify direct io validity check")
From: Vjaceslavs Klimovs @ 2026-05-15 16:52 UTC (permalink / raw)
To: Jens Axboe
Cc: Keith Busch, Hannes Reinecke, Martin K. Petersen,
Christoph Hellwig, linux-block, linux-raid, dm-devel,
linux-kernel, regressions
Summary
-------
On v6.18, starting a libvirt/QEMU guest with virtio-blk backed by an
LVM "--type raid1" LV (drivers/md/dm-raid.c stacked on
drivers/md/raid1.c) makes md/raid1 register read failures at LV
sector 0 within seconds of "virsh start" and mark rimage_0 Faulty
once max_corrected_read_errors (default 20) is exceeded. Reads
succeed via the redirect path so guests boot, but every guest disk
ends up degraded on every VM start. Same workload on legacy
"--type mirror" (drivers/md/dm-raid1.c) crashes the host: a
zero-length READ reaches the NVMe controller, is rejected with
"Invalid Field in Command", and the dm-mirror recovery path oopses.
Symptom on dm-raid raid1 (post --type raid1)
--------------------------------------------
Per LV, at virsh start, in host dmesg:
kernel: raid1_end_read_request: 95 callbacks suppressed
kernel: raid1_read_request: 95 callbacks suppressed
kernel: md/raid1:mdX: dm-58: rescheduling sector 0
kernel: md/raid1:mdX: redirecting sector 0 to other mirror: dm-58
kernel: md/raid1:mdX: dm-58: rescheduling sector 0
kernel: md/raid1:mdX: redirecting sector 0 to other mirror: dm-58
[... 10 rescheduling/redirecting pairs ...]
kernel: md/raid1:mdX: dm-58: Raid device exceeded read_error
threshold [cur 21:max 20]
kernel: md/raid1:mdX: dm-58: Failing raid device
kernel: md/raid1:mdX: Disk failure on dm-58, disabling device.
kernel: md/raid1:mdX: Operation continuing on 1 devices.
dmeventd: WARNING: Device #0 of raid1 array, vg0-iris_boot, has failed.
dmeventd: WARNING: Waiting for resynchronization to finish before
initiating repair on RAID device vg0-iris_boot.
dmeventd: Use 'lvconvert --repair vg0/iris_boot' to replace failed device.
Subsequent "lvs -a":
WARNING: RaidLV vg0/iris_boot needs to be refreshed!
See character 'r' at position 9 in the RaidLV's attributes and its SubLV(s).
dmesg | grep nvme is EMPTY on this path. The NVMe driver is not
involved in producing the error; the failure originates between the
virtio-blk bio submission and raid1_end_read_request().
Symptom on legacy dm-mirror (pre-conversion --type mirror)
----------------------------------------------------------
Same workload on drivers/md/dm-raid1.c reaches the NVMe controller
as a zero-length READ and panics the host through dm-mirror's
recovery path:
kernel: operation not supported error, dev nvme1n1, sector 935446535
op 0x0:(READ) flags 0x0 phys_seg 0 prio class 2
kernel: nvme1n1: I/O Cmd(0x2) @ LBA 935446535, 0 blocks, I/O Error
(sct 0x0 / sc 0x2)
[... 10+ identical bursts at same timestamp ...]
dmeventd: Primary mirror device 252:58 read failed.
dmeventd: vg0-iris_boot is now in-sync.
[kernel oops in dm_mirror recovery path, full trace lost to console flash]
The "phys_seg 0", "0 blocks", "sct 0x0/sc 0x2" trio (NVMe Generic,
Invalid Field in Command, NVMe spec 4.1.1.2) is unambiguous: a bio
with bi_iter.bi_size == 0 and bi_vcnt == 0 left the block layer and
hit the controller. dm-raid raid1 hides this by retrying on the
surviving leg, but the upstream-of-md trigger is identical.
Bisect
------
git bisect, v6.12..v6.18, 16 deterministic GOOD/BAD steps, no skips,
~104 minutes:
5ff3f74e145adc79b49668adb8de276446acf6be is the first bad commit
block: simplify direct io validity check
--- a/block/fops.c
+++ b/block/fops.c
@@ -38,8 +38,8 @@ static blk_opf_t dio_bio_write_op(struct kiocb *iocb)
static bool blkdev_dio_invalid(struct block_device *bdev, struct kiocb *iocb,
struct iov_iter *iter)
{
- return iocb->ki_pos & (bdev_logical_block_size(bdev) - 1) ||
- !bdev_iter_is_aligned(bdev, iter);
+ return (iocb->ki_pos | iov_iter_count(iter)) &
+ (bdev_logical_block_size(bdev) - 1);
}
The dropped bdev_iter_is_aligned() used to walk the iov_iter and
reject per-segment misaligned/degenerate vectors at the blkdev fops
entry point. The replacement only validates ki_pos and total length
against the logical block size. Cases that now pass that no longer
get rejected:
- iter with iov_iter_count(iter) == 0 (degenerate; total length is
"sector-aligned" since 0 % 512 == 0)
- iter where total length is sector-aligned but a segment isn't
The commit message justifies the removal with "The block layer
checks all the segments for validity later". This is true for the
io_uring submit path (which enters __blkdev_direct_IO directly and
does its own validation) but not for the libaio aio_read/write_iter
or the worker-pool sync read/write_iter paths that enter via
blkdev_{read,write}_iter() -> blkdev_dio_invalid(). For those paths,
the segment check has no replacement.
Reproducing
----------------------------------------------------------
The trigger requires QEMU virtio-blk's specific submission shape AND
a non-io_uring submit. Userspace libaio alone, userspace
preadv-in-a-thread alone, and QEMU's raw-driver open probes (which
qemu-img info exercises identically) are all insufficient. The
combination that hits the bug is "guest-driven I/O through
virtio-blk-pci with cache.direct=on and aio in {native, threads}".
#regzbot introduced: 5ff3f74e145adc79b49668adb8de276446acf6be
Thanks,
Vjaceslavs Klimovs
^ permalink raw reply
* [GIT PULL] Block fixes for 7.1-rc4
From: Jens Axboe @ 2026-05-15 14:20 UTC (permalink / raw)
To: Linus Torvalds; +Cc: linux-block@vger.kernel.org
Hi Linus,
Set of fixes for the block area, which should go into the 7.1 kernel
release. This pull request contains:
- NVMe merge request via Keith
- Fix memory leak on a passthrough integrity mapping failure
(Keith)
- Hide secrets behind debug option (Hannes)
- Fix pci use-after-free for host memory buffer (Chia-Lin Kao)
- Fix tcp taregt use-after-free for data digest (Sagi)
- Revert a mistaken quirk (Alan Cui)
- Fix uevent and controller state race condition (Maurizio)
- Fix apple submission queue re-initialization (Nick Chan)
- Three fixes for blk-integrity, fixing an issue with the user data
mapping and two problems with recomputing number of segments.
- Two fixes for the iov_iter bounce buffering.
- Fix for the handling of dead zoned write plugs.
- ublk max_sectors validation fix, with associated selftest addition.
Please pull!
The following changes since commit f7700a4415afb3ac1767a556094e4ef8bd440e41:
ublk: fix use-after-free in ublk_cancel_cmd() (2026-05-08 06:44:42 -0600)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git tags/block-7.1-20260515
for you to fetch changes up to 4141f46daa4cf1f8caa14129f8b6db86f17452f5:
Merge tag 'nvme-7.1-2026-05-14' of git://git.infradead.org/nvme into block-7.1 (2026-05-14 19:14:33 -0600)
----------------------------------------------------------------
block-7.1-20260515
----------------------------------------------------------------
AlanCui4080 (1):
Revert "nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808"
Casey Chen (1):
block: recompute nr_integrity_segments in blk_insert_cloned_request
Chia-Lin Kao (AceLan) (1):
nvme-pci: fix use-after-free in nvme_free_host_mem()
Christoph Hellwig (2):
block: pass a minsize argument to bio_iov_iter_bounce
block: align down bounces bios
Damien Le Moal (1):
block: fix handling of dead zone write plugs
David Carlier (1):
block: don't overwrite bip_vcnt in bio_integrity_copy_user()
Hannes Reinecke (1):
nvmet-auth: Do not print DH-HMAC-CHAP secrets
Jens Axboe (1):
Merge tag 'nvme-7.1-2026-05-14' of git://git.infradead.org/nvme into block-7.1
Keith Busch (2):
nvme: make prp passthrough usage less scary
nvme: fix bio leak on mapping failure
Maurizio Lombardi (1):
nvme: fix race condition between connected uevent and STARTED_ONCE flag
Ming Lei (2):
ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation
selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
Nick Chan (1):
nvme-apple: Reset q->sq_tail during queue init
Sagi Grimberg (1):
nvmet-tcp: Fix potential UAF when ddgst mismatch
Sungwoo Kim (1):
block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
block/bio-integrity.c | 19 ++++++++++++++++++-
block/bio.c | 27 +++++++++++++++------------
block/blk-mq.c | 19 +++++++++++++++++++
block/blk-zoned.c | 32 +++++++++++++++++++++++++++-----
drivers/block/ublk_drv.c | 3 +++
drivers/nvme/host/apple.c | 1 +
drivers/nvme/host/core.c | 6 +++++-
drivers/nvme/host/ioctl.c | 18 ++++--------------
drivers/nvme/host/pci.c | 8 ++++----
drivers/nvme/target/Kconfig | 9 +++++++++
drivers/nvme/target/auth.c | 13 ++++++++-----
drivers/nvme/target/tcp.c | 4 +++-
fs/iomap/direct-io.c | 2 +-
include/linux/bio.h | 3 ++-
tools/testing/selftests/ublk/kublk.c | 11 +++++++++++
15 files changed, 130 insertions(+), 45 deletions(-)
--
Jens Axboe
^ permalink raw reply
* Re: [PATCH] block: bio-integrity: fix memory leak in bio_integrity_map_user()
From: Christoph Hellwig @ 2026-05-15 13:13 UTC (permalink / raw)
To: Dmitry Antipov
Cc: Jens Axboe, Weidong Zhu, Chao Shi, Sungwoo Kim, Dave Tian,
Keith Busch, Caleb Sander Mateos, Christoph Hellwig, linux-block,
lvc-project, Kanchan Joshi, Anuj Gupta
In-Reply-To: <20260513070515.528861-1-dmantipov@yandex.ru>
On Wed, May 13, 2026 at 10:05:15AM +0300, Dmitry Antipov wrote:
> Since 'iov_iter_extract_pages()' may allocate new array of pages
> even when it returns non-zero error value, matching cleanup with
> 'vfree()' should be performed on all return paths afterwards. So
> adjust 'bio_integrity_map_user()' to ensure that both 'pages' and
> 'bvec' arrays are always freed on return.
>
> Fixes: 8582792cf23b ("block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()")
> Fixes: 492c5d455969 ("block: bio-integrity: directly map user buffers")
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
The change looks fine:
Reviewed-by: Christoph Hellwig <hch@lst.de>
We'd still be much better off converting it to iov_iter_extract_bvecs
to share common code, and make it more efficient by no needing the
separate pages allocation.
> ---
> block/bio-integrity.c | 21 ++++++---------------
> 1 file changed, 6 insertions(+), 15 deletions(-)
>
> diff --git a/block/bio-integrity.c b/block/bio-integrity.c
> index e796de1a749e..53fb04adb09b 100644
> --- a/block/bio-integrity.c
> +++ b/block/bio-integrity.c
> @@ -400,7 +400,7 @@ int bio_integrity_map_user(struct bio *bio, struct iov_iter *iter)
> ret = iov_iter_extract_pages(iter, &pages, bytes, nr_vecs,
> extraction_flags, &offset);
> if (unlikely(ret < 0))
> - goto free_bvec;
> + goto out_free;
>
> /*
> * Handle partial pinning. This can happen when pin_user_pages_fast()
> @@ -414,16 +414,12 @@ int bio_integrity_map_user(struct bio *bio, struct iov_iter *iter)
> for (i = 0; i < npinned; i++)
> unpin_user_page(pages[i]);
> }
> - if (pages != stack_pages)
> - kvfree(pages);
> ret = -EFAULT;
> - goto free_bvec;
> + goto out_free;
> }
>
> nr_bvecs = bvec_from_pages(bvec, pages, nr_vecs, bytes, offset,
> &is_p2p);
> - if (pages != stack_pages)
> - kvfree(pages);
> if (nr_bvecs > queue_max_integrity_segments(q))
> copy = true;
> if (is_p2p)
> @@ -434,15 +430,10 @@ int bio_integrity_map_user(struct bio *bio, struct iov_iter *iter)
> else
> ret = bio_integrity_init_user(bio, bvec, nr_bvecs, bytes);
> if (ret)
> - goto release_pages;
> - if (bvec != stack_vec)
> - kfree(bvec);
> -
> - return 0;
> -
> -release_pages:
> - bio_integrity_unpin_bvec(bvec, nr_bvecs);
> -free_bvec:
> + bio_integrity_unpin_bvec(bvec, nr_bvecs);
> +out_free:
> + if (pages != stack_pages)
> + kvfree(pages);
> if (bvec != stack_vec)
> kfree(bvec);
> return ret;
> --
> 2.54.0
---end quoted text---
^ permalink raw reply
* Re: [PATCH 0/1] drbd: fix false positive resync throttling (in-tree 8.4)
From: Ionut Nechita (Wind River) @ 2026-05-15 12:30 UTC (permalink / raw)
To: drbd-dev, linux-block
Cc: Philipp Reisner, Christoph Boehmwalder, Lars Ellenberg,
Jens Axboe, linux-kernel, Ionut Nechita
In-Reply-To: <20260513163905.562722-1-ionut.nechita@windriver.com>
From: Ionut Nechita <ionut.nechita@windriver.com>
Hi Philipp, Christoph,
Friendly ping on this patch. We are planning to integrate it into our
next release and our engineering team asked whether you could provide
a brief risk assessment or a Reviewed-by tag for the in-tree 8.4
backport.
To summarize the risk profile from our side:
- The change is confined to drbd_rs_c_min_rate_throttle() — only the
throttle decision, no data path or replication protocol changes.
- Worst-case failure mode (ap_bio_cnt not reflecting reality) is
equivalent to c-min-rate=0, which is already a supported config.
- The approach is identical to what drbd 9.x already uses.
Could you confirm the patch is correct as-is, or provide a Reviewed-by
/ Acked-by if you're comfortable with it? If there are any concerns
or suggested changes, happy to spin a v3.
Thanks,
Ionut
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox