Skip to content

Stable features and fixes#176

Merged
heatd merged 64 commits into
masterfrom
for-next
Apr 13, 2026
Merged

Stable features and fixes#176
heatd merged 64 commits into
masterfrom
for-next

Conversation

@heatd
Copy link
Copy Markdown
Owner

@heatd heatd commented Apr 12, 2026

Notable:

  • netlink implementation
  • evdev implementation
  • many stability fixes

heatd added 30 commits April 12, 2026 22:26
Add an initial netlink implementation. This first version allows simple
communication with the kernel side, in rtnetlink. This initial version
does not allow for several stuff. Errors are not communicated proprly.

Needs to be finished, but it's cromulent enough for now.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Add initial (DUMP!) implementations of these two rtnetlink requests.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Good enough for Xorg, good enough for me.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Record and report tx queue lengths to userspace through netlink.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
This allows a change from anon.cpp to anon.c

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
It is not possible to run get_phys_pages() on these VMAs and get a
coherent result, or even expect reads without side-effects.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
It is not possible to get a coherent, valid result with PFNMAP VMAs.
Deny them.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
It is no longer required, and actually breaks e.g O_NONBLOCK.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Protocol code is not supposed to zero msg_controllen where there are no
cmsg's to pass to userspace. This is because msg_controllen takes an
opposite role for protocols, and that is actually passed to userspace is
the original len - msg_controllen.

So for protocols that have nothing to say, not touching msg_controllen
will make it so usersapce will say "original - msg_controllen", which is
0.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
page_vecs can be more than a page long now.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
The way fill_pbuf() works, it always calls unix_pbf_init().
This is entirely wrong, because unix_pbf_init() always
reinitializes the attached unix_pbf_info, and this can happen:

1) Send message with CMSG attached
1a) pbf is allocated
1b) fill_pbuf() is called
1c) unix_pbf_init() initializes the members
2) Send message without CMSG (so, mergeable)
2a) Attempt to append to tail by fill_pbuf()
2b) unix_pbf_init() is called and NULLs out the members

With this, sending a message with a FD attached, followed by one without
will in the vast majority of cases mysteriously drop the FD, confusing
userspace and everyone involved.

Fix it by doing the zeroing outside unix_pbf_init(), only when first
allocating the pbf.

Fixes: c84fe75 ("unix: Add SCM_RIGHTS support")
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
There's a difference between the msg_controllen in kmsg vs userspace
msghdr. kernel_msghdr's msg_controllen counts the number of bytes
*remaining* in the cmsg buffer. Not the number of bytes that were
actually placed there by the kernel.

As such, copy msg.msg_controllen bytes instead.

This fixes mysterious problems passing cmsg data to userspace, where it
may not see the data correctly if kmsg.msg_controllen <
msg.msg_controllen.

Fixes: 566cec0 ("net: Pass iovec_iter around the stack")
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
This can happen if the folio is on a bunch of folio batches.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
This is a blatant race, where reclaim can willy-nilly remove a page in a
racing way.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
This can trivially happen if a page is truncated out but in the middle
of getting freed.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
If a page has a mapcount of 0 while mapped, then it definitely does not
need to be unmapped.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
A page can be in the middle of getting freed. In that case, it may be in
the LRU while having a refcount of 0. Don't bother isolating it.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
As a debug check.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
A waiter can already be queued, in case there was an EINTR.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
This is a significant allocation spot for writeback, etc.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
5 is too low, 16 is what Linux uses.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
put_pid() finds it strange that a pid still technically has a process
attached. pid_remove_proc() does functionally the same thing.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
It's only possible to racelessly set ACTIVE when !LRU if on the current
LRU add batch. Anything else is racey.

Caught by doing a simple fsx invocation with the new pagestat logic.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
The current code is blatantly incorrect and racey. Between
get_per_cpu_ptr(lru_batches) and local_lock(), it's possible to get
migrated. This is obviously very problematic.

Fixes: 0fb2b42 ("page_lru: Add per-cpu LRU batching")
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
heatd added 28 commits April 12, 2026 22:29
Namely, a socket leak when we grab a ref succesfully but then the
connection request is stale, and a missing rcu_read_unlock().

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
It's not a valid flag if the object may be freed.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
A rare race can easily be seen with ld.lld: a zap while the current
process is spawning a new one creates a hung zap, where one thread
doesn't participate in it.

Kill it manually instead.

There are other problems here: execve() zap and group stops. This will
need to be dealt with later.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Add a mechanism so reclaim and truncate can know if a page is being used
elsewhere (e.g block_bufs).

This change includes various bits in the page cache, filesystems and
reclaim.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Instead of having fully percpu counters with no central count, make them
a traditional counter that periodically transfers its count to a central
one. This makes it faster for readers, and permits the detection of
underflows, etc.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Instead of doing PAGE_ALLOC_MAX_RECLAIM_ATTEMPT loops, loop while there
is progress. If progress doesn't happen for MAX_RECLAIM_ATTEMPT loops,
then fail.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
nfds can be FD_SETSIZE.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Make the code and logic simpler by simply not needing to execute any of
the hairy logic. Also makes it faster.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
This was possible before we simply stopped entering these codepaths at
all.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
It's not possible to migrate a thread if it's on-cpu. This case is
possible if, for instance, a thread was just switched out but is
technically still running mid-switch (the stack may still be the old
one, etc).

Don't do it, man.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Sometimes useful.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
With the old mmap refactoring it somehow lost the capability to do this.
This results in terribly corrupt maple trees. Not good.

Fix it (trivially).

Fixes: 35f25fc ("vm: Refactor sys_mmap")
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
The kernel has had WARN_ON for a while, and a couple were commented out.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
It's not the device file's inode it should pass, but f_mapping's owner.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
For a given page, it should only read as many blocks as are actually in
the device. Anything else should be left alone.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
This fixes mysterious pid 1 crashes when too much concurrency happens
early-on. Easily reproduceable by running init on tmpfs.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
They're not doing anything right now, which Isn't Good(tm), particularly
due to security concerns. But since the swapping isn't particularly well
supported right now, this is ok.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
GNU tar longnames are represented by tar entries of type L or K. When
one is seen, the next entry will have as name (and/or linkg) the
contents of the entry.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Fix races against writepage_endio by excluding on the pagestate_lock.
This makes it so uptodate is set by the caller of write_begin.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
This may mess with the readpage endio functions. Just don't bother.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
Add basic PS/2 mouse support. And with it, some slight reworking and
fixes around the driver. Yay.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
None are yet implemented. But dnf seems to cope with it.

Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
@heatd heatd enabled auto-merge (rebase) April 12, 2026 21:35
@heatd heatd merged commit 23bdd2d into master Apr 13, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant