Mohammed EL Kadiri medelkadiri

Mohammed EL Kadiri

Systems Software Engineer · Linux Kernel Contributor · Security & Reliability Engineering

Systems software engineer focused on Linux kernel development, operating-system internals, security hardening, and low-level reliability engineering.
I work on correctness, memory safety, synchronization, and failure handling across kernel subsystems, firmware-facing drivers, key management, filesystem encryption, and performance-sensitive systems components in C/C++17.

What This GitHub Contains

This is my systems-engineering workspace: software that operates close to operating-system infrastructure, hardware interfaces, and runtime-critical services.

The projects and kernel work here focus on software that must remain correct under stress and failure: memory ownership, file-descriptor lifetime, concurrent execution, process control, IPC, binary-parser correctness, kernel locking, and security boundaries. My approach emphasizes explicit invariants, defensive design, measurable performance, and maintainable low-level code.

What I Build

systems-engineering

Production-oriented C++17 systems components designed around explicit ownership, secure resource management, concurrency safety, benchmarking, and cross-platform portability.

RAII fd wrapper · lock-free stack · memory pool · thread pool · ring buffer

jakashell

Linux shell and process-management project exploring zero-copy IPC, memory-mapped communication, CPU-affinity-aware execution, and eBPF-based runtime telemetry.

mmap IPC · CPU affinity · eBPF tracing · process management

Linux Kernel Contributions

Upstream Linux kernel work across driver correctness, memory-safety hardening, key-management reliability, allocator isolation, and filesystem-encryption debugging.

Linux Kernel Contributions

Upstream Linux kernel patches and credited reports — tracked through lore.kernel.org, subsystem maintainer trees, and stable-kernel notifications

Status guide:
Submitted — posted to the relevant upstream mailing list for review.
Reviewed — formally reviewed by a subsystem maintainer or domain expert.
Queued — accepted into a maintainer's integration tree for a future kernel release.
Committed — committed to a subsystem maintainer tree.
Accepted — accepted by the responsible maintainer for upstream inclusion.
Credited fix — the issue report was attributed in an upstream fix; the implementation was authored by another kernel developer.

#	Contribution	Subsystem	Status	Date
`10`	fscrypt keyring / filesystem-reclaim lockdep issue _{Investigated and reported a locking issue in fscrypt master-key user tracking. The issue involved an interaction between keyring locking and filesystem memory reclaim that could produce a lockdep warning under automated kernel fuzzing. The upstream resolution simplified fscrypt's user-claim tracking by replacing an internal keyring with an explicit linked-list representation while retaining per-user quota accounting.} _{Reported-by credit in upstream commit 696c030e1e34 · Fix authored by Eric Biggers · Added to the 6.12-stable and 7.1-stable trees.}	`fs/crypto` `security/keys`	`Credited fix`	_14/06/2026
`9`	KEYS: avoid filesystem reclaim while holding keyring->sem _{Proposed a targeted mitigation for a lock-ordering cycle between the kernel keyring semaphore and filesystem memory reclaim. The patch uses memalloc_nofs_save() and memalloc_nofs_restore() to prevent filesystem reclaim while updating a keyring associative array, avoiding an allocation path that can re-enter the same locking domain.} _{The investigation contributed to the subsequent upstream fscrypt redesign credited above.}	`security/keys`	`Submitted`	_14/06/2026
`8`	keys: keyctl_pkey: replace BUG with return -EOPNOTSUPP _{Replaced fatal BUG() assertions in asymmetric-key operation dispatch with the standard -EOPNOTSUPP error. Unsupported operation types are now returned safely to userspace instead of causing a system-wide kernel crash.} _{This aligns the code path with normal kernel error-handling conventions and preserves system availability for unsupported requests.} _{Reviewed-by: Jarkko Sakkinen · Queued in for-next-keys}	`security/keys`	`Queued`	_13/06/2026
`7`	keys: request_key: replace BUG with return -EINVAL _{Replaced a BUG() path in request-key destination handling with -EINVAL. Invalid or unimplemented keyring destination states now follow the kernel's standard error-return model rather than triggering a fatal assertion.} _{This hardens a userspace-facing path in the key-management subsystem by treating invalid state as a recoverable error.} _{Reviewed-by: Jarkko Sakkinen · Queued in for-next-keys}	`security/keys`	`Queued`	_13/06/2026
`6`	media: venus: fix payload size calculation in parse_raw_formats() _{Fixed binary parsing of firmware responses in Qualcomm's Venus video-codec driver. The previous implementation calculated the total payload size using the plane count from only the final format record. If records contained different plane counts, the parser could advance through the firmware buffer incorrectly. The fix accumulates each record's actual size while parsing.} _{This preserves the protocol invariant that parser state advances by the exact number of bytes consumed.} _{Reviewed-by: Dmitry Baryshkov, Qualcomm · Committed to media.git/next}	`media/venus`	`Committed`	_10/06/2026
`5`	media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() _{Corrected consumed-byte accounting in two variable-length firmware-message parsers in the Qualcomm Venus driver. The functions returned only fixed-header sizes and omitted the flexible-array payload. Since the higher-level parser uses those values to locate the next message in a firmware response buffer, underreporting could desynchronize parsing when messages are packed together.} _{The fix returns the full consumed size for each message: fixed header plus variable-length entries.} _{Fixes: 9edaaa8e3e15 · Cc: stable@vger.kernel.org · Reviewed-by: Dmitry Baryshkov, Qualcomm · Committed to media.git/next}	`media/venus`	`Committed`	_10/06/2026
`4`	cred: prevent slab cache merging for cred_jar _{Added SLAB_NO_MERGE to the allocator cache used for Linux credential objects (struct cred). Credential objects contain process identity and authorization state, including user and group IDs, capabilities, and security-relevant execution context. The change keeps these objects in a dedicated slab cache instead of allowing allocation-cache sharing with unrelated object types.} _{This improves isolation for one of the kernel's most security-sensitive object types.} _{Reviewed-by: Kees Cook}	`kernel/cred`	`Reviewed`	_11/06/2026
`3`	keys: prevent slab cache merging for key_jar _{Added SLAB_NO_MERGE to the slab cache used for struct key, a core object in Linux key management. The change prevents key objects from sharing a compatible allocator cache with unrelated kernel object types.} _{Dedicated allocation domains strengthen isolation in a subsystem responsible for credentials, secrets, certificates, and cryptographic key material.} _{Acked-by: Vlastimil Babka, SUSE · Queued in for-next-keys}	`security/keys`	`Queued`	_04/06/2026
`2`	media: venus: Annotate flex arrays with __counted_by() _{Annotated flexible-array members in Qualcomm Venus HFI protocol structures with __counted_by(). The annotations associate each variable-length array with its element-count field, allowing compilers and kernel sanitizers to determine the valid bounds of allocated objects more accurately.} _{This improves run-time bounds checking through CONFIG_UBSAN_BOUNDS and strengthens compiler object-size analysis for firmware-facing data structures.} _{Reviewed-by: Dmitry Baryshkov, Qualcomm · Reviewed-by: Konrad Dybcio, Qualcomm · Committed to media.git/next}	`media/venus`	`Committed`	_07/06/2026
`1`	sfc: fix spelling mistake _{Submitted a documentation and source-comment correction for the Solarflare network-driver firmware interface. The change followed the upstream Linux kernel workflow: patch submission, subsystem maintainer review, and forwarding for inclusion during a future generated firmware-header update.} _{Forwarded upstream by maintainer Edward Cree.}	`net/sfc`	`Accepted`	_22/03/2026

Upstream Submissions
9
_{Patch series and individual patches posted to kernel lists} Integration Progress
7
_{Accepted, queued in maintainer trees, or committed} Maintainer Review
7
_{Contributions carrying Reviewed-by or Acked-by tags} Stable Tree Credit
1
_{Reported issue referenced by a stable-kernel fix}

_{Statuses represent different stages of the upstream process; a patch can be reviewed before being queued or committed.}
_{Last updated: 03/08/2026}

Technical Focus

Area	Details
Kernel / OS Internals	Linux kernel internals, syscall interfaces, VFS, keyrings, credentials, filesystem encryption, memory management, driver parsing
Security Hardening	Slab-cache isolation, cross-cache attack mitigation, bounds checking, flexible-array safety, secure error handling
Reliability Engineering	Root-cause analysis, parser invariants, memory lifetime, fault handling, lockdep analysis, syzbot-driven debugging
Concurrency	Lock-free structures, atomics, memory ordering, spinlocks, RCU, lock hierarchy and deadlock analysis
Performance	perf, flamegraphs, strace, eBPF, Google Benchmark, CPU-affinity-aware execution
Cross-platform	Linux, macOS, FreeBSD, POSIX interfaces, compile-time platform abstraction

Tools

C · C++17 · POSIX · x86_64/ARM64 · CMake · Make/Kbuild · GDB/LLDB · perf · strace · eBPF · Git · Linux · macOS/XNU

Activity

Kernel contributions tracked on lore.kernel.org · Projects on GitHub

Navigation Menu

Mohammed EL Kadiri medelkadiri

Achievements