From a4420dc21f4051ba0584e02535e2bfc6abe52fa9 Mon Sep 17 00:00:00 2001 From: Weichao Guo Date: Sat, 7 May 2022 00:28:14 +0800 Subject: [PATCH 01/41] BACKPORT: f2fs: skip GC if possible when checkpoint disabling If the number of unusable blocks is not larger than unusable capacity, we can skip GC when checkpoint disabling. Bug: 278486610 Signed-off-by: Weichao Guo Signed-off-by: Chao Yu [Jaegeuk Kim: Fix missing gc_mode assignment] Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim (cherry picked from commit 2880f47b949f1f49e2d861ffbba91d57416be7d9) [ qixiaoyu1: Resolved minor conflict in fs/f2fs/super.c ] Change-Id: Ic37debb3fbb9d863cb1b0f539cc992dd08ad9f77 --- fs/f2fs/super.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 2c77a2df34a6..268bdd61f2d0 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -1995,6 +1995,11 @@ static int f2fs_disable_checkpoint(struct f2fs_sb_info *sbi) } sbi->sb->s_flags |= SB_ACTIVE; + /* check if we need more GC first */ + unusable = f2fs_get_unusable_blocks(sbi); + if (!f2fs_disable_cp_again(sbi, unusable)) + goto skip_gc; + f2fs_update_time(sbi, DISABLE_TIME); while (!f2fs_time_over(sbi, DISABLE_TIME)) { @@ -2020,6 +2025,7 @@ static int f2fs_disable_checkpoint(struct f2fs_sb_info *sbi) goto restore_flag; } +skip_gc: f2fs_down_write(&sbi->gc_lock); cpc.reason = CP_PAUSE; set_sbi_flag(sbi, SBI_CP_DISABLED); From fffb0ae9aac66b147e70d6510b3e59d3addfd161 Mon Sep 17 00:00:00 2001 From: Uttkarsh Aggarwal Date: Tue, 30 May 2023 10:22:46 +0530 Subject: [PATCH 02/41] BACKPORT: usb: dwc3: gadget: Bail out in pullup if soft reset timeout happens If the core soft reset timeout happens, avoid setting up event buffers and starting gadget as the writes to these registers may not reflect when in reset and setting the run stop bit can lead the controller to access wrong event buffer address resulting in a crash. Signed-off-by: Krishna Kurapati Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20230510075252.31023-2-quic_kriskura@quicinc.com Signed-off-by: Greg Kroah-Hartman Bug: 284900975 (cherry picked from commit 813f44d57e19ccaa7330e829bd913515be42719d https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb -next) Change-Id: I01373b098b7e576931d61815fe07373c1185b556 Signed-off-by: Uttkarsh Aggarwal --- drivers/usb/dwc3/gadget.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 905fd2774cb0..35fd2c4fa82f 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2604,13 +2604,16 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) * device-initiated disconnect requires a core soft reset * (DCTL.CSftRst) before enabling the run/stop bit. */ - dwc3_core_soft_reset(dwc); + ret = dwc3_core_soft_reset(dwc); + if (ret) + goto done; dwc3_event_buffers_setup(dwc); __dwc3_gadget_start(dwc); ret = dwc3_gadget_run_stop(dwc, true, false); } +done: pm_runtime_put(dwc->dev); return ret; From 7cc458acf42c60f417156694c4e5a43a99d5cfe1 Mon Sep 17 00:00:00 2001 From: Krishna Kurapati Date: Sun, 21 May 2023 00:03:13 +0530 Subject: [PATCH 03/41] BACKPORT: usb: gadget: udc: Handle gadget_connect failure during bind operation In the event, gadget_connect call (which invokes pullup) fails, propagate the error to udc bind operation which inturn sends the error to configfs. The userspace can then retry enumeartion if it chooses to. Signed-off-by: Krishna Kurapati Acked-by: Alan Stern Link: https://lore.kernel.org/r/20230510075252.31023-3-quic_kriskura@quicinc.com Signed-off-by: Greg Kroah-Hartman (cherry picked from commit d34f9bafa78da2a561c67d9daf55fc4d1d80edf0 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb- next) Bug: 284900975 Change-Id: I43925bafc6ba7b08e8c501502a0fa58ee40e6526 Signed-off-by: Krishna Kurapati (cherry picked from commit 8faa860f5594a68e5ecf97bb632e59097da23d14) --- drivers/usb/gadget/udc/core.c | 31 +++++++++++++++++++++++-------- 1 file changed, 23 insertions(+), 8 deletions(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 7a00af1f9624..237f9cc8bfba 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -1047,12 +1047,16 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state); /* ------------------------------------------------------------------------- */ -static void usb_udc_connect_control(struct usb_udc *udc) +static int usb_udc_connect_control(struct usb_udc *udc) { + int ret; + if (udc->vbus) - usb_gadget_connect(udc->gadget); + ret = usb_gadget_connect(udc->gadget); else - usb_gadget_disconnect(udc->gadget); + ret = usb_gadget_disconnect(udc->gadget); + + return ret; } /** @@ -1507,15 +1511,26 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri if (ret) goto err1; ret = usb_gadget_udc_start(udc); - if (ret) { - driver->unbind(udc->gadget); - goto err1; - } + if (ret) + goto err_start; + usb_gadget_enable_async_callbacks(udc); - usb_udc_connect_control(udc); + ret = usb_udc_connect_control(udc); + if (ret) + goto err_connect_control; kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE); return 0; + +err_connect_control: + usb_gadget_disable_async_callbacks(udc); + if (udc->gadget->irq) + synchronize_irq(udc->gadget->irq); + usb_gadget_udc_stop(udc); + +err_start: + driver->unbind(udc->gadget); + err1: if (ret != -EISNAM) dev_err(&udc->dev, "failed to start %s: %d\n", From 2246168a72ec76f45c4b27016be238ba988ea94a Mon Sep 17 00:00:00 2001 From: Dezhi Huang Date: Mon, 22 May 2023 21:24:45 +0800 Subject: [PATCH 04/41] ANDROID: fix a race between speculative page walk and unmap operations Speculative page fault walks the page tables under RCU protection and assumes that page tables are stable after ptl lock is taken. Current implementation has three issues: 1. While pmd can't be destroyed while in RCU read section, it can be cleared and result in an invalid ptl lock address. Fix that by rechecking pmd value after obtaining ptl lock. 2. In case of CONFIG_ALLOC_SPLIT_PTLOCKS, ptl lock is separate from the pmd and is destroyed by a synchronous call to pgtable_pmd_page_dtor, which can happen while page walker is in RCU section. Prevent this by adding a dependency for CONFIG_SPECULATIVE_PAGE_FAULT to require !CONIG_ALLOC_SPLIT_PTLOCKS. 3. Below sequence when do_mmap happens after the last mmap_seq check would result in use-after-free issue. __pte_map_lock rcu_read_lock() mmap_seq_read_check() ptl = pte_lockptr(vmf->pmd) spin_trylock(ptl) mmap_seq_read_check() mmap_write_lock() do_mmap() unmap_region() unmap_vmas() free_pgtables() ... free_pte_range pmd_clear pte_free_tlb ... call_rcu(tlb_remove_table_rcu) rcu_read_unlock() tlb_remove_table_rcu spin_unlock(ptl) <-- UAF! To prevent that free_pte_range needs to be blocked if ptl is locked and is in use. [tyler wang: This is a backport from https://android-review.googlesource.com/c/kernel/common/+/2330194. We have adapted the corresponding modifications from 5.15 to 5.10, including the changes made to the function __pte_map_lock in 5.15, which have been adapted to the functions pte_spinlock and __pte_map_lock_speculative in 5.10. Additionally, following surenb's suggestion, we have folded https://android-review.googlesource.com/c/kernel/common/+/2368961 in this patch.] Bug: 278602292 Change-Id: I7b353f0995fc59e92bb2069bcdc7d1ac29b521b9 Signed-off-by: Dezhi Huang --- mm/memory.c | 34 +++++++++++++++++++++++----------- 1 file changed, 23 insertions(+), 11 deletions(-) diff --git a/mm/memory.c b/mm/memory.c index 834078ab6e1c..df62ea2ef8f2 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -246,6 +246,16 @@ static void free_pte_range(struct mmu_gather *tlb, pmd_t *pmd, unsigned long addr) { pgtable_t token = pmd_pgtable(*pmd); +#ifdef CONFIG_SPECULATIVE_PAGE_FAULT + /* + * Ensure page table destruction is blocked if __pte_map_lock managed + * to take this lock. Without this barrier tlb_remove_table_rcu can + * destroy ptl after __pte_map_lock locked it and during unlock would + * cause a use-after-free. + */ + spinlock_t *ptl = pmd_lock(tlb->mm, pmd); + spin_unlock(ptl); +#endif pmd_clear(pmd); pte_free_tlb(tlb, token, addr); mm_dec_nr_ptes(tlb->mm); @@ -2627,9 +2637,7 @@ EXPORT_SYMBOL_GPL(apply_to_page_range); static bool pte_spinlock(struct vm_fault *vmf) { bool ret = false; -#ifdef CONFIG_TRANSPARENT_HUGEPAGE pmd_t pmdval; -#endif /* Check if vma is still valid */ if (!(vmf->flags & FAULT_FLAG_SPECULATIVE)) { @@ -2644,24 +2652,28 @@ static bool pte_spinlock(struct vm_fault *vmf) goto out; } -#ifdef CONFIG_TRANSPARENT_HUGEPAGE /* * We check if the pmd value is still the same to ensure that there * is not a huge collapse operation in progress in our back. + * It also ensures that pmd was not cleared by pmd_clear in + * free_pte_range and ptl is still valid. */ pmdval = READ_ONCE(*vmf->pmd); if (!pmd_same(pmdval, vmf->orig_pmd)) { trace_spf_pmd_changed(_RET_IP_, vmf->vma, vmf->address); goto out; } -#endif - vmf->ptl = pte_lockptr(vmf->vma->vm_mm, vmf->pmd); + vmf->ptl = pte_lockptr(vmf->vma->vm_mm, &pmdval); if (unlikely(!spin_trylock(vmf->ptl))) { trace_spf_pte_lock(_RET_IP_, vmf->vma, vmf->address); goto out; } + /* + * The check below will fail if pte_spinlock passed its ptl barrier + * before we took the ptl lock. + */ if (vma_has_changed(vmf)) { spin_unlock(vmf->ptl); trace_spf_vma_changed(_RET_IP_, vmf->vma, vmf->address); @@ -2679,9 +2691,7 @@ static bool __pte_map_lock_speculative(struct vm_fault *vmf, unsigned long addr) bool ret = false; pte_t *pte; spinlock_t *ptl; -#ifdef CONFIG_TRANSPARENT_HUGEPAGE pmd_t pmdval; -#endif /* * The first vma_has_changed() guarantees the page-tables are still @@ -2696,7 +2706,6 @@ static bool __pte_map_lock_speculative(struct vm_fault *vmf, unsigned long addr) goto out; } -#ifdef CONFIG_TRANSPARENT_HUGEPAGE /* * We check if the pmd value is still the same to ensure that there * is not a huge collapse operation in progress in our back. @@ -2706,7 +2715,6 @@ static bool __pte_map_lock_speculative(struct vm_fault *vmf, unsigned long addr) trace_spf_pmd_changed(_RET_IP_, vmf->vma, addr); goto out; } -#endif /* * Same as pte_offset_map_lock() except that we call @@ -2715,14 +2723,18 @@ static bool __pte_map_lock_speculative(struct vm_fault *vmf, unsigned long addr) * to invalidate TLB but this CPU has irq disabled. * Since we are in a speculative patch, accept it could fail */ - ptl = pte_lockptr(vmf->vma->vm_mm, vmf->pmd); - pte = pte_offset_map(vmf->pmd, addr); + ptl = pte_lockptr(vmf->vma->vm_mm, &pmdval); + pte = pte_offset_map(&pmdval, addr); if (unlikely(!spin_trylock(ptl))) { pte_unmap(pte); trace_spf_pte_lock(_RET_IP_, vmf->vma, addr); goto out; } + /* + * The check below will fail if __pte_map_lock_speculative passed its ptl + * barrier before we took the ptl lock. + */ if (vma_has_changed(vmf)) { pte_unmap_unlock(pte, ptl); trace_spf_vma_changed(_RET_IP_, vmf->vma, addr); From 403d5d1318c9b82b70c44a76e3ddbadf42a7838a Mon Sep 17 00:00:00 2001 From: xieliujie Date: Tue, 6 Jun 2023 20:45:12 +0800 Subject: [PATCH 05/41] ANDROID: vendor_hook: Avoid clearing protect-flag before waking waiters With hooks below, we can mark a lock-owned thread with an identifiable flag, which can protect it from being preempted by some other unimportant threads, and then waiter will be wakeup more quickly. https://android-review.googlesource.com/c/kernel/common/+/2183353 but now we find an issue like this one: static inline void __up_write(struct rw_semaphore *sem) { ... // Step 1. we clear flag. trace_android_vh_record_rwsem_lock_starttime(current, 0); // Step 2. owner may be preempted by unimportant threads. rwsem_clear_owner(sem); ... // Step 3. wake up waiter, but it's too later. if (unlikely(tmp & RWSEM_FLAG_WAITERS)) rwsem_wake(sem); } This patch will clear protect-flag after waking up waiters. Bug: 286024926 Change-Id: I71f8b6a7d8a01336fd36b8267c2cb5edab65bd11 Signed-off-by: xieliujie --- include/linux/percpu-rwsem.h | 2 +- kernel/locking/mutex.c | 2 +- kernel/locking/percpu-rwsem.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/include/linux/percpu-rwsem.h b/include/linux/percpu-rwsem.h index 92d172cfce06..55e80d18628d 100644 --- a/include/linux/percpu-rwsem.h +++ b/include/linux/percpu-rwsem.h @@ -107,7 +107,6 @@ static inline bool percpu_down_read_trylock(struct percpu_rw_semaphore *sem) static inline void percpu_up_read(struct percpu_rw_semaphore *sem) { - _trace_android_vh_record_pcpu_rwsem_starttime(current, 0); rwsem_release(&sem->dep_map, _RET_IP_); preempt_disable(); @@ -130,6 +129,7 @@ static inline void percpu_up_read(struct percpu_rw_semaphore *sem) this_cpu_dec(*sem->read_count); rcuwait_wake_up(&sem->writer); } + _trace_android_vh_record_pcpu_rwsem_starttime(current, 0); preempt_enable(); } diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c index b9a10aacb139..be121ed70d7c 100644 --- a/kernel/locking/mutex.c +++ b/kernel/locking/mutex.c @@ -760,12 +760,12 @@ static noinline void __sched __mutex_unlock_slowpath(struct mutex *lock, unsigne */ void __sched mutex_unlock(struct mutex *lock) { - trace_android_vh_record_mutex_lock_starttime(current, 0); #ifndef CONFIG_DEBUG_LOCK_ALLOC if (__mutex_unlock_fast(lock)) return; #endif __mutex_unlock_slowpath(lock, _RET_IP_); + trace_android_vh_record_mutex_lock_starttime(current, 0); } EXPORT_SYMBOL(mutex_unlock); diff --git a/kernel/locking/percpu-rwsem.c b/kernel/locking/percpu-rwsem.c index c8a474aa1b3b..915c045a15f3 100644 --- a/kernel/locking/percpu-rwsem.c +++ b/kernel/locking/percpu-rwsem.c @@ -258,7 +258,6 @@ EXPORT_SYMBOL_GPL(percpu_down_write); void percpu_up_write(struct percpu_rw_semaphore *sem) { - trace_android_vh_record_pcpu_rwsem_starttime(current, 0); rwsem_release(&sem->dep_map, _RET_IP_); /* @@ -284,6 +283,7 @@ void percpu_up_write(struct percpu_rw_semaphore *sem) * exclusive write lock because its counting. */ rcu_sync_exit(&sem->rss); + trace_android_vh_record_pcpu_rwsem_starttime(current, 0); } EXPORT_SYMBOL_GPL(percpu_up_write); From b82903573e481f61ea5d21812d6a2c778cd1119f Mon Sep 17 00:00:00 2001 From: John Stultz Date: Wed, 8 Mar 2023 20:40:43 +0000 Subject: [PATCH 06/41] FROMGIT: pstore: Revert pmsg_lock back to a normal mutex MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 76d62f24db07f22ccf9bc18ca793c27d4ebef721. So while priority inversion on the pmsg_lock is an occasional problem that an rt_mutex would help with, in uses where logging is writing to pmsg heavily from multiple threads, the pmsg_lock can be heavily contended. After this change landed, it was reported that cases where the mutex locking overhead was commonly adding on the order of 10s of usecs delay had suddenly jumped to ~msec delay with rtmutex. It seems the slight differences in the locks under this level of contention causes the normal mutexes to utilize the spinning optimizations, while the rtmutexes end up in the sleeping slowpath (which allows additional threads to pile on trying to take the lock). In this case, it devolves to a worse case senerio where the lock acquisition and scheduling overhead dominates, and each thread is waiting on the order of ~ms to do ~us of work. Obviously, having tons of threads all contending on a single lock for logging is non-optimal, so the proper fix is probably reworking pstore pmsg to have per-cpu buffers so we don't have contention. Additionally, Steven Rostedt has provided some furhter optimizations for rtmutexes that improves the rtmutex spinning path, but at least in my testing, I still see the test tripping into the sleeping path on rtmutexes while utilizing the spinning path with mutexes. But in the short term, lets revert the change to the rt_mutex and go back to normal mutexes to avoid a potentially major performance regression. And we can work on optimizations to both rtmutexes and finer-grained locking for pstore pmsg in the future. Cc: Wei Wang Cc: Midas Chien Cc: "Chunhui Li (李春辉)" Cc: Steven Rostedt Cc: Kees Cook Cc: Anton Vorontsov Cc: "Guilherme G. Piccoli" Cc: Tony Luck Cc: kernel-team@android.com Fixes: 76d62f24db07 ("pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion") Reported-by: "Chunhui Li (李春辉)" Signed-off-by: John Stultz Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20230308204043.2061631-1-jstultz@google.com Bug: 271041816 Bug: 272453930 (cherry picked from commit 5239a89b06d6b199f133bf0ffea421683187f257 https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/pstore ) Change-Id: Iadf30bcbf5ba3895dd4af8c15c3a8aecf4301acb Signed-off-by: John Stultz (cherry picked from commit 64c66caa8f1f2412377a8d6c75a73da1234bee0d) --- fs/pstore/pmsg.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/fs/pstore/pmsg.c b/fs/pstore/pmsg.c index 18cf94b597e0..d8542ec2f38c 100644 --- a/fs/pstore/pmsg.c +++ b/fs/pstore/pmsg.c @@ -7,10 +7,9 @@ #include #include #include -#include #include "internal.h" -static DEFINE_RT_MUTEX(pmsg_lock); +static DEFINE_MUTEX(pmsg_lock); static ssize_t write_pmsg(struct file *file, const char __user *buf, size_t count, loff_t *ppos) @@ -29,9 +28,9 @@ static ssize_t write_pmsg(struct file *file, const char __user *buf, if (!access_ok(buf, count)) return -EFAULT; - rt_mutex_lock(&pmsg_lock); + mutex_lock(&pmsg_lock); ret = psinfo->write_user(&record, buf); - rt_mutex_unlock(&pmsg_lock); + mutex_unlock(&pmsg_lock); return ret ? ret : count; } From 708d51e22a10a68c782a5d1a9b3d25b35b9659e6 Mon Sep 17 00:00:00 2001 From: Zheng Wang Date: Mon, 13 Mar 2023 22:43:25 +0800 Subject: [PATCH 07/41] UPSTREAM: 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition [ Upstream commit ea4f1009408efb4989a0f139b70fb338e7f687d0 ] In xen_9pfs_front_probe, it calls xen_9pfs_front_alloc_dataring to init priv->rings and bound &ring->work with p9_xen_response. When it calls xen_9pfs_front_event_handler to handle IRQ requests, it will finally call schedule_work to start the work. When we call xen_9pfs_front_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in xen_9pfs_front_free. Note that, this bug is found by static analysis, which might be false positive. CPU0 CPU1 |p9_xen_response xen_9pfs_front_remove| xen_9pfs_front_free| kfree(priv) | //free priv | |p9_tag_lookup |//use priv->client Bug: 284409180 Fixes: 71ebd71921e4 ("xen/9pfs: connect to the backend") Signed-off-by: Zheng Wang Reviewed-by: Michal Swiatkowski Signed-off-by: Eric Van Hensbergen Signed-off-by: Sasha Levin (cherry picked from commit 9266e939d76279d8710196d86215ba2be6345041) Signed-off-by: Lee Jones Change-Id: I3a50acfe9957e0140e01d17f4d766532ec5670e0 --- net/9p/trans_xen.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index 220e8f4ac0cf..da056170849b 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -300,6 +300,10 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) write_unlock(&xen_9pfs_lock); for (i = 0; i < priv->num_rings; i++) { + struct xen_9pfs_dataring *ring = &priv->rings[i]; + + cancel_work_sync(&ring->work); + if (!priv->rings[i].intf) break; if (priv->rings[i].irq > 0) From 17bbc533f8f3bdadfe82a153b854bed397bcaa19 Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Thu, 20 Apr 2023 08:27:18 +0100 Subject: [PATCH 08/41] UPSTREAM: mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() [ Upstream commit 2d1e952a2b8e5e92d8d55ac88a7cf7ca5ea591ad ] If a user can make copy_from_user() fail, there is a potential for UAF/DF due to a lack of locking around the allocation, use and freeing of the data buffers. This issue is not theoretical. I managed to author a POC for it: BUG: KASAN: double-free in kfree+0x5c/0xac Free of addr ffff29280be5de00 by task poc/356 CPU: 1 PID: 356 Comm: poc Not tainted 6.1.0-00001-g961aa6552c04-dirty #20 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x64/0x80 print_report+0x188/0x48c kasan_report_invalid_free+0xa0/0xc0 ____kasan_slab_free+0x174/0x1b0 __kasan_slab_free+0x18/0x24 __kmem_cache_free+0x130/0x2e0 kfree+0x5c/0xac mbox_test_message_write+0x208/0x29c full_proxy_write+0x90/0xf0 vfs_write+0x154/0x440 ksys_write+0xcc/0x180 __arm64_sys_write+0x44/0x60 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x40/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x18c/0x190 Allocated by task 356: kasan_save_stack+0x3c/0x70 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xc0 kmalloc_trace+0x58/0x70 mbox_test_message_write+0x6c/0x29c full_proxy_write+0x90/0xf0 vfs_write+0x154/0x440 ksys_write+0xcc/0x180 __arm64_sys_write+0x44/0x60 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x40/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x18c/0x190 Freed by task 357: kasan_save_stack+0x3c/0x70 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c ____kasan_slab_free+0x13c/0x1b0 __kasan_slab_free+0x18/0x24 __kmem_cache_free+0x130/0x2e0 kfree+0x5c/0xac mbox_test_message_write+0x208/0x29c full_proxy_write+0x90/0xf0 vfs_write+0x154/0x440 ksys_write+0xcc/0x180 __arm64_sys_write+0x44/0x60 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x40/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xf4/0x120 el0t_64_sync+0x18c/0x190 Bug: 275340532 Signed-off-by: Lee Jones Signed-off-by: Jassi Brar Signed-off-by: Sasha Levin (cherry picked from commit cad1abbe488dfd149499e492344c03b87bb0b08c) Signed-off-by: Lee Jones Change-Id: I79753a9a63d8b04e139eaaeb9435bf1d05d38892 --- drivers/mailbox/mailbox-test.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c index 4555d678fadd..6dd5b9614452 100644 --- a/drivers/mailbox/mailbox-test.c +++ b/drivers/mailbox/mailbox-test.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -38,6 +39,7 @@ struct mbox_test_device { char *signal; char *message; spinlock_t lock; + struct mutex mutex; wait_queue_head_t waitq; struct fasync_struct *async_queue; struct dentry *root_debugfs_dir; @@ -110,6 +112,8 @@ static ssize_t mbox_test_message_write(struct file *filp, return -EINVAL; } + mutex_lock(&tdev->mutex); + tdev->message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL); if (!tdev->message) return -ENOMEM; @@ -144,6 +148,8 @@ out: kfree(tdev->message); tdev->signal = NULL; + mutex_unlock(&tdev->mutex); + return ret < 0 ? ret : count; } @@ -392,6 +398,7 @@ static int mbox_test_probe(struct platform_device *pdev) platform_set_drvdata(pdev, tdev); spin_lock_init(&tdev->lock); + mutex_init(&tdev->mutex); if (tdev->rx_channel) { tdev->rx_buffer = devm_kzalloc(&pdev->dev, From 0a52039fcbba79985a4e8b4b5a38fc134881c2a8 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 5 May 2023 12:22:09 +0300 Subject: [PATCH 09/41] UPSTREAM: mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() [ Upstream commit 8fe72b76db79d694858e872370df49676bc3be8c ] There was a bug where this code forgot to unlock the tdev->mutex if the kzalloc() failed. Fix this issue, by moving the allocation outside the lock. Bug: 275340532 Fixes: 2d1e952a2b8e ("mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()") Signed-off-by: Dan Carpenter Reviewed-by: Lee Jones Signed-off-by: Jassi Brar Signed-off-by: Sasha Levin (cherry picked from commit 7d233f93594f0d9afe44e9409131a8d6ad4f593c) Signed-off-by: Lee Jones Change-Id: I7a4a1bf06abbb2092aceb72610e3f894b2bfbf0f --- drivers/mailbox/mailbox-test.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c index 6dd5b9614452..abcee58e851c 100644 --- a/drivers/mailbox/mailbox-test.c +++ b/drivers/mailbox/mailbox-test.c @@ -97,6 +97,7 @@ static ssize_t mbox_test_message_write(struct file *filp, size_t count, loff_t *ppos) { struct mbox_test_device *tdev = filp->private_data; + char *message; void *data; int ret; @@ -112,12 +113,13 @@ static ssize_t mbox_test_message_write(struct file *filp, return -EINVAL; } - mutex_lock(&tdev->mutex); - - tdev->message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL); - if (!tdev->message) + message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL); + if (!message) return -ENOMEM; + mutex_lock(&tdev->mutex); + + tdev->message = message; ret = copy_from_user(tdev->message, userbuf, count); if (ret) { ret = -EFAULT; From c6ae8be4e6f0aff05ae186a10e2d6a5314bec733 Mon Sep 17 00:00:00 2001 From: Kyongho Cho Date: Mon, 12 Jun 2023 09:45:30 -0700 Subject: [PATCH 10/41] ANDROID: GKI: update symbol list for exynos Leaf changes summary: 3 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 3 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 3 Added functions: [A] 'function void copy_highpage(page*, page*)' [A] 'function void ttm_bo_unmap_virtual(ttm_buffer_object*)' [A] 'function int ttm_bo_wait(ttm_buffer_object*, bool, bool)' Bug: 286912592 Change-Id: I97371458327427fffef390154f817149a3120cbd Signed-off-by: Kyongho Cho --- android/abi_gki_aarch64.xml | 162 ++++++++++++++++++--------------- android/abi_gki_aarch64_exynos | 3 + 2 files changed, 93 insertions(+), 72 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 878779269b2b..ef03b0c13e9b 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -1300,6 +1300,7 @@ + @@ -5581,7 +5582,9 @@ + + @@ -122097,12 +122100,12 @@ - - - - - - + + + + + + @@ -124529,6 +124532,11 @@ + + + + + @@ -130870,10 +130878,10 @@ - - - - + + + + @@ -131506,10 +131514,10 @@ - - - - + + + + @@ -141682,12 +141690,12 @@ - - - - - - + + + + + + @@ -146687,12 +146695,22 @@ + + + + + + + + + + @@ -147456,11 +147474,11 @@ - - - - - + + + + + @@ -147642,13 +147660,13 @@ - - + + - - - + + + @@ -147817,8 +147835,8 @@ - - + + @@ -147981,8 +147999,8 @@ - - + + @@ -147994,9 +148012,9 @@ - - - + + + @@ -148011,8 +148029,8 @@ - - + + @@ -148052,7 +148070,7 @@ - + @@ -148172,10 +148190,10 @@ - - - - + + + + @@ -148386,9 +148404,9 @@ - - - + + + @@ -149842,22 +149860,22 @@ - - - - + + + + - - - - + + + + - - - - + + + + @@ -149928,23 +149946,23 @@ - - - - + + + + - - - - + + + + - - - - - + + + + + diff --git a/android/abi_gki_aarch64_exynos b/android/abi_gki_aarch64_exynos index 5f0526297f1c..c64082bb95b0 100644 --- a/android/abi_gki_aarch64_exynos +++ b/android/abi_gki_aarch64_exynos @@ -172,6 +172,7 @@ __const_udelay consume_skb contig_page_data + copy_highpage __cpu_active_mask cpu_all_bits cpu_bit_bitmap @@ -2114,7 +2115,9 @@ ttm_bo_move_ttm ttm_bo_put ttm_bo_unlock_delayed_workqueue + ttm_bo_unmap_virtual ttm_bo_validate + ttm_bo_wait ttm_dma_page_alloc_debugfs ttm_dma_populate ttm_dma_tt_fini From 552009b284ada00b6787c2bdba8cd60deaba63a7 Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Wed, 17 May 2023 13:38:08 +0000 Subject: [PATCH 11/41] UPSTREAM: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize commit 7e01c7f7046efc2c7c192c3619db43292b98e997 upstream. Currently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than the calculated "min" value, but greater than zero, the logic sets tx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in cdc_ncm_fill_tx_frame() where all the data is handled. For small values of dwNtbOutMaxSize the memory allocated during alloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to how size is aligned at alloc time: size = SKB_DATA_ALIGN(size); size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); Thus we hit the same bug that we tried to squash with commit 2be6d4d16a084 ("net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero") Low values of dwNtbOutMaxSize do not cause an issue presently because at alloc_skb() time more memory (512b) is allocated than required for the SKB headers alone (320b), leaving some space (512b - 320b = 192b) for CDC data (172b). However, if more elements (for example 3 x u64 = [24b]) were added to one of the SKB header structs, say 'struct skb_shared_info', increasing its original size (320b [320b aligned]) to something larger (344b [384b aligned]), then suddenly the CDC data (172b) no longer fits in the spare SKB data area (512b - 384b = 128b). Consequently the SKB bounds checking semantics fails and panics: skbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev: ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:113! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic net/core/skbuff.c:113 [inline] RIP: 0010:skb_over_panic+0x14c/0x150 net/core/skbuff.c:118 [snip] Call Trace: skb_put+0x151/0x210 net/core/skbuff.c:2047 skb_put_zero include/linux/skbuff.h:2422 [inline] cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline] cdc_ncm_fill_tx_frame+0x11ab/0x3da0 drivers/net/usb/cdc_ncm.c:1308 cdc_ncm_tx_fixup+0xa3/0x100 Deal with too low values of dwNtbOutMaxSize, clamp it in the range [USB_CDC_NCM_NTB_MIN_OUT_SIZE, CDC_NCM_NTB_MAX_SIZE_TX]. We ensure enough data space is allocated to handle CDC data by making sure dwNtbOutMaxSize is not smaller than USB_CDC_NCM_NTB_MIN_OUT_SIZE. Fixes: 289507d3364f ("net: cdc_ncm: use sysfs for rx/tx aggregation tuning") Cc: stable@vger.kernel.org Reported-by: syzbot+9f575a1f15fc0c01ed69@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=b982f1059506db48409d Link: https://lore.kernel.org/all/20211202143437.1411410-1-lee.jones@linaro.org/ Signed-off-by: Tudor Ambarus Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230517133808.1873695-2-tudor.ambarus@linaro.org Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Bug: 281604646 Bug: 281606231 Change-Id: Ic1d912e7bf2ba53620eb8293b68ec6046422e047 Signed-off-by: Tudor Ambarus --- drivers/net/usb/cdc_ncm.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c index 913d91381f23..73455643acba 100644 --- a/drivers/net/usb/cdc_ncm.c +++ b/drivers/net/usb/cdc_ncm.c @@ -180,9 +180,12 @@ static u32 cdc_ncm_check_tx_max(struct usbnet *dev, u32 new_tx) else min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth32); - max = min_t(u32, CDC_NCM_NTB_MAX_SIZE_TX, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize)); - if (max == 0) + if (le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) == 0) max = CDC_NCM_NTB_MAX_SIZE_TX; /* dwNtbOutMaxSize not set */ + else + max = clamp_t(u32, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize), + USB_CDC_NCM_NTB_MIN_OUT_SIZE, + CDC_NCM_NTB_MAX_SIZE_TX); /* some devices set dwNtbOutMaxSize too low for the above default */ min = min(min, max); @@ -1230,6 +1233,9 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) * further. */ if (skb_out == NULL) { + /* If even the smallest allocation fails, abort. */ + if (ctx->tx_curr_size == USB_CDC_NCM_NTB_MIN_OUT_SIZE) + goto alloc_failed; ctx->tx_low_mem_max_cnt = min(ctx->tx_low_mem_max_cnt + 1, (unsigned)CDC_NCM_LOW_MEM_MAX_CNT); ctx->tx_low_mem_val = ctx->tx_low_mem_max_cnt; @@ -1248,13 +1254,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) skb_out = alloc_skb(ctx->tx_curr_size, GFP_ATOMIC); /* No allocation possible so we will abort */ - if (skb_out == NULL) { - if (skb != NULL) { - dev_kfree_skb_any(skb); - dev->net->stats.tx_dropped++; - } - goto exit_no_skb; - } + if (!skb_out) + goto alloc_failed; ctx->tx_low_mem_val--; } if (ctx->is_ndp16) { @@ -1447,6 +1448,11 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) return skb_out; +alloc_failed: + if (skb) { + dev_kfree_skb_any(skb); + dev->net->stats.tx_dropped++; + } exit_no_skb: /* Start timer, if there is a remaining non-empty skb */ if (ctx->tx_curr_skb != NULL && n > 0) From ab25d94e88082d3cd6870b8338da55da42e3cf5e Mon Sep 17 00:00:00 2001 From: Uttkarsh Aggarwal Date: Thu, 25 May 2023 14:58:54 +0530 Subject: [PATCH 12/41] UPSTREAM: usb: gadget: f_fs: Add unbind event before functionfs_unbind While exercising the unbind path, with the current implementation the functionfs_unbind would be calling which waits for the ffs->mutex to be available, however within the same time ffs_ep0_read is invoked & if no setup packets are pending, it will invoke function wait_event_interruptible_exclusive_locked_irq which by definition waits for the ev.count to be increased inside the same mutex for which functionfs_unbind is waiting. This creates deadlock situation because the functionfs_unbind won't get the lock until ev.count is increased which can only happen if the caller ffs_func_unbind can proceed further. Following is the illustration: CPU1 CPU2 ffs_func_unbind() ffs_ep0_read() mutex_lock(ffs->mutex) wait_event(ffs->ev.count) functionfs_unbind() mutex_lock(ffs->mutex) mutex_unlock(ffs->mutex) ffs_event_add() Fix this by moving the event unbind before functionfs_unbind to ensure the ev.count is incrased properly. Fixes: 6a19da111057 ("usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait") Cc: stable Signed-off-by: Uttkarsh Aggarwal Link: https://lore.kernel.org/r/20230525092854.7992-1-quic_uaggarwa@quicinc.com Signed-off-by: Greg Kroah-Hartman Bug: 285072336 (cherry picked from commit efb6b535207395a5c7317993602e2503ca8cb4b3) Change-Id: Iae8cbdacc64810b3a63f77d0510b61fb39d10ae8 Signed-off-by: Uttkarsh Aggarwal --- drivers/usb/gadget/function/f_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 53154a6fd9fb..deaba9128949 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -3619,6 +3619,7 @@ static void ffs_func_unbind(struct usb_configuration *c, /* Drain any pending AIO completions */ drain_workqueue(ffs->io_completion_wq); + ffs_event_add(ffs, FUNCTIONFS_UNBIND); if (!--opts->refcnt) functionfs_unbind(ffs); @@ -3643,7 +3644,6 @@ static void ffs_func_unbind(struct usb_configuration *c, func->function.ssp_descriptors = NULL; func->interfaces_nums = NULL; - ffs_event_add(ffs, FUNCTIONFS_UNBIND); } static struct usb_function *ffs_alloc(struct usb_function_instance *fi) From c93516a2d02c0a1f0466b3f512977c40c1bee4f0 Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Tue, 13 Jun 2023 14:45:31 +0100 Subject: [PATCH 13/41] ANDROID: HID; Over-ride default maximum buffer size when using UHID Presently, when a report is processed, its proposed size, provided by the user of the API (as Report Size * Report Count) is compared against the subsystem default HID_MAX_BUFFER_SIZE (16k). However, some low-level HID drivers allocate a reduced amount of memory to their buffers (e.g. UHID only allocates UHID_DATA_MAX (4k) buffers), rending this check inadequate in some cases. In these circumstances, if the received report ends up being smaller than the proposed report size, the remainder of the buffer is zeroed. That is, the space between sizeof(csize) (size of the current report) and the rsize (size proposed i.e. Report Size * Report Count), which can be handled up to HID_MAX_BUFFER_SIZE (16k). Meaning that memset() shoots straight past the end of the buffer boundary and starts zeroing out in-use values, often resulting in calamity. This is an Android specific patch which essentially achieves the same goal as the recently reverted upstream commits b1a37ed00d790 "(HID: core: Provide new max_buffer_size attribute to over-ride the default") and 1c5d4221240a2 ("HID: uhid: Over-ride the default maximum data buffer value with our own") only it does so in an ABI friendly (albeit more hacky) way. Bug: 260007429 Signed-off-by: Lee Jones Change-Id: I1f56673bb67b63ab14b58634bfe74a04b0758e3d (cherry picked from commit 71761b36c37ae15a09fdd4d4adcc98bb939c426c) --- drivers/hid/hid-core.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 5f9ec1d1464a..ad82324e7a4b 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -32,6 +32,7 @@ #include #include #include +#include #include "hid-ids.h" @@ -258,6 +259,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign { struct hid_report *report; struct hid_field *field; + unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE; unsigned int usages; unsigned int offset; unsigned int i; @@ -288,8 +290,11 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign offset = report->size; report->size += parser->global.report_size * parser->global.report_count; + if (parser->device->ll_driver == &uhid_hid_driver) + max_buffer_size = UHID_DATA_MAX; + /* Total size check: Allow for possible report index byte */ - if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { + if (report->size > (max_buffer_size - 1) << 3) { hid_err(parser->device, "report is too long\n"); return -1; } @@ -1752,6 +1757,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, struct hid_report_enum *report_enum = hid->report_enum + type; struct hid_report *report; struct hid_driver *hdrv; + int max_buffer_size = HID_MAX_BUFFER_SIZE; unsigned int a; u32 rsize, csize = size; u8 *cdata = data; @@ -1768,10 +1774,13 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, rsize = hid_compute_report_size(report); - if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE) - rsize = HID_MAX_BUFFER_SIZE - 1; - else if (rsize > HID_MAX_BUFFER_SIZE) - rsize = HID_MAX_BUFFER_SIZE; + if (hid->ll_driver == &uhid_hid_driver) + max_buffer_size = UHID_DATA_MAX; + + if (report_enum->numbered && rsize >= max_buffer_size) + rsize = max_buffer_size - 1; + else if (rsize > max_buffer_size) + rsize = max_buffer_size; if (csize < rsize) { dbg_hid("report %d is too short, (%d < %d)\n", report->id, From 5bffeca4fb12b0ffe297c4754923764a97a829cc Mon Sep 17 00:00:00 2001 From: Ruihan Li Date: Sun, 16 Apr 2023 16:14:04 +0800 Subject: [PATCH 14/41] UPSTREAM: bluetooth: Perform careful capability checks in hci_sock_ioctl() commit 25c150ac103a4ebeed0319994c742a90634ddf18 upstream. Previously, capability was checked using capable(), which verified that the caller of the ioctl system call had the required capability. In addition, the result of the check would be stored in the HCI_SOCK_TRUSTED flag, making it persistent for the socket. However, malicious programs can abuse this approach by deliberately sharing an HCI socket with a privileged task. The HCI socket will be marked as trusted when the privileged task occasionally makes an ioctl call. This problem can be solved by using sk_capable() to check capability, which ensures that not only the current task but also the socket opener has the specified capability, thus reducing the risk of privilege escalation through the previously identified vulnerability. Bug: 286456284 Cc: stable@vger.kernel.org Fixes: f81f5b2db869 ("Bluetooth: Send control open and close messages for HCI raw sockets") Signed-off-by: Ruihan Li Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 47e6893a5b0ad14c0b1c25983a1facb1cf667b6e) Signed-off-by: Lee Jones Change-Id: I9a4b20c7b1e9b4e6bbd6371264aec039770a52ff --- net/bluetooth/hci_sock.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index 7a2a7b6c10ca..5f32209f8c11 100644 --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c @@ -996,7 +996,14 @@ static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, if (hci_sock_gen_cookie(sk)) { struct sk_buff *skb; - if (capable(CAP_NET_ADMIN)) + /* Perform careful checks before setting the HCI_SOCK_TRUSTED + * flag. Make sure that not only the current task but also + * the socket opener has the required capability, since + * privileged programs can be tricked into making ioctl calls + * on HCI sockets, and the socket should not be marked as + * trusted simply because the ioctl caller is privileged. + */ + if (sk_capable(sk, CAP_NET_ADMIN)) hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); /* Send event to monitor */ From 40aea038ea8ce7866d8c1eb75039854a295818d7 Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Mon, 19 Jun 2023 14:41:36 +0100 Subject: [PATCH 15/41] ANDROID: HID: Only utilise UHID provided exports if UHID is enabled Commit "ANDROID: HID; Over-ride default maximum buffer size when using UHID" provided a means for the UHID driver to offer an alternative (smaller) report buffer size when dealing with user-space. The method used was an Android-only solution designed to prevent the KMI ABI from being broken (nb: the upstream solution was cleaner, but broke the ABI). Since this solution involved consuming resources exported by a subordinate driver, that driver would have to be enabled for the export to take place. Since all of our default configs enable UHID, an issue was not detected. However, for more specific kernel configs, where HID is enabled, but UHID is not, this leads to compile-time undefined symbol errors: ld.lld: error: undefined symbol: uhid_hid_driver This patch relies on the compiler to leave out unutilised sections of the code if the associated resources are not available. Bug: 260007429 Reported-by: Paul Lawrence Reported-by: Nathan Chancellor Signed-off-by: Lee Jones Change-Id: I80b1aa7454c89d5c5e21f0268252ffb666efab97 Signed-off-by: Lee Jones --- drivers/hid/hid-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index ad82324e7a4b..b007074a30ec 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -290,7 +290,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign offset = report->size; report->size += parser->global.report_size * parser->global.report_count; - if (parser->device->ll_driver == &uhid_hid_driver) + if (IS_ENABLED(CONFIG_UHID) && parser->device->ll_driver == &uhid_hid_driver) max_buffer_size = UHID_DATA_MAX; /* Total size check: Allow for possible report index byte */ @@ -1774,7 +1774,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, rsize = hid_compute_report_size(report); - if (hid->ll_driver == &uhid_hid_driver) + if (IS_ENABLED(CONFIG_UHID) && hid->ll_driver == &uhid_hid_driver) max_buffer_size = UHID_DATA_MAX; if (report_enum->numbered && rsize >= max_buffer_size) From 5f17bf82b43fdeb7367656707881c9c9fdb91682 Mon Sep 17 00:00:00 2001 From: LongPing Wei Date: Mon, 19 Jun 2023 20:25:03 +0800 Subject: [PATCH 16/41] ANDROID: Export memcg functions to allow module to add new files Export cgroup_add_dfl_cftypes to allow vendor module to expose additional files in the memory cgroup-v2 hierarchy. Bug: 287922632 Change-Id: I103b983fbb46ff7a45cfc57f5657142a1bbd3d68 Signed-off-by: LongPing Wei --- kernel/cgroup/cgroup.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index f08f898ea929..1b7e1da46dfa 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -4219,6 +4219,7 @@ int cgroup_add_dfl_cftypes(struct cgroup_subsys *ss, struct cftype *cfts) cft->flags |= __CFTYPE_ONLY_ON_DFL; return cgroup_add_cftypes(ss, cfts); } +EXPORT_SYMBOL_GPL(cgroup_add_dfl_cftypes); /** * cgroup_add_legacy_cftypes - add an array of cftypes for legacy hierarchies From b3af11bf9080375dd8dd34cbdcff84f5b7f5686a Mon Sep 17 00:00:00 2001 From: LongPing Wei Date: Mon, 19 Jun 2023 21:46:19 +0800 Subject: [PATCH 17/41] ANDROID: ABI: Update oplus symbol list 1 function symbol(s) added 'int cgroup_add_dfl_cftypes(struct cgroup_subsys *, struct cftype *)' Bug: 287922632 Change-Id: I7f6d9d7310c59601079566951303208d2b9dcfc4 Signed-off-by: LongPing Wei --- android/abi_gki_aarch64.xml | 209 +++++++++++++++++++++------------- android/abi_gki_aarch64_oplus | 1 + 2 files changed, 128 insertions(+), 82 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index ef03b0c13e9b..0bab4531f386 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -1182,6 +1182,7 @@ + @@ -44629,7 +44630,23 @@ - + + + + + + + + + + + + + + + + + @@ -48969,6 +48986,7 @@ + @@ -53926,6 +53944,13 @@ + + + + + + + @@ -66586,6 +66611,13 @@ + + + + + + + @@ -91377,6 +91409,7 @@ + @@ -103144,6 +103177,12 @@ + + + + + + @@ -111390,6 +111429,7 @@ + @@ -117232,16 +117272,16 @@ - - - - + + + + - - - - + + + + @@ -123717,41 +123757,41 @@ - - - - - + + + + + - - - + + + - - - - + + + + - - - + + + - - - + + + - - + + - - - + + + @@ -123897,9 +123937,14 @@ - - - + + + + + + + + @@ -125342,14 +125387,14 @@ - - - + + + - - - + + + @@ -133020,71 +133065,71 @@ - - + + - + - - - + + + - - + + - - + + - - - + + + - - + + - - - - - - + + + + + + - - + + - - - - + + + + - - - - - - + + + + + + - - + + - - - - - - + + + + + + diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus index bd21cf7d3005..61477d74b5cb 100644 --- a/android/abi_gki_aarch64_oplus +++ b/android/abi_gki_aarch64_oplus @@ -143,6 +143,7 @@ cdev_device_del cdev_init __cfi_slowpath + cgroup_add_dfl_cftypes cgroup_add_legacy_cftypes cgroup_path_ns cgroup_taskset_first From e6d71f847b98bd0c747251d9680771f9e2a21f86 Mon Sep 17 00:00:00 2001 From: Zixuan Fu Date: Thu, 21 Jul 2022 15:48:29 +0800 Subject: [PATCH 18/41] BACKPORT: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() commit 85f02d6c856b9f3a0acf5219de6e32f58b9778eb upstream. In btrfs_relocate_block_group(), the rc is allocated. Then btrfs_relocate_block_group() calls relocate_block_group() prepare_to_relocate() set_reloc_control() that assigns rc to the variable fs_info->reloc_ctl. When prepare_to_relocate() returns, it calls btrfs_commit_transaction() btrfs_start_dirty_block_groups() btrfs_alloc_path() kmem_cache_zalloc() which may fail for example (or other errors could happen). When the failure occurs, btrfs_relocate_block_group() detects the error and frees rc and doesn't set fs_info->reloc_ctl to NULL. After that, in btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and then used, which may cause a use-after-free bug. This possible bug can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). To fix this possible bug, in prepare_to_relocate(), check if btrfs_commit_transaction() fails. If the failure occurs, unset_reloc_control() is called to set fs_info->reloc_ctl to NULL. The error log in our fault-injection testing is shown as follows: [ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs] ... [ 58.753577] Call Trace: ... [ 58.755800] kasan_report+0x45/0x60 [ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs] [ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs] [ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs] [ 58.758231] start_transaction+0x896/0x2950 [btrfs] [ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs] [ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs] [ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs] ... [ 58.768510] Allocated by task 23683: [ 58.768777] ____kasan_kmalloc+0xb5/0xf0 [ 58.769069] __kmalloc+0x227/0x3d0 [ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs] [ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs] [ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ... [ 58.773337] Freed by task 23683: ... [ 58.774815] kfree+0xda/0x2b0 [ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs] [ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs] [ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ... Bug: 286629572 Reported-by: TOTE Robot CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Sweet Tea Dorminy Reviewed-by: Nikolay Borisov Signed-off-by: Zixuan Fu Signed-off-by: David Sterba Signed-off-by: Stefan Ghinea Signed-off-by: Greg Kroah-Hartman (cherry picked from commit b60e862e133f646f19023ece1d476d630a660de1) [Lee: Fixed minor conflict - returning result vs returning 0] Signed-off-by: Lee Jones Change-Id: I9212b61a85d36e20eed337d59fbadc2782d96a24 --- fs/btrfs/relocation.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index c21545c5b34b..206e0bc1b2d6 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -3270,8 +3270,12 @@ int prepare_to_relocate(struct reloc_control *rc) */ return PTR_ERR(trans); } - btrfs_commit_transaction(trans); - return 0; + + ret = btrfs_commit_transaction(trans); + if (ret) + unset_reloc_control(rc); + + return ret; } static noinline_for_stack int relocate_block_group(struct reloc_control *rc) From 1c98645c8e83ede34b20cd0ec4450db9893f1242 Mon Sep 17 00:00:00 2001 From: Zheng Wang Date: Wed, 8 Mar 2023 00:43:38 +0800 Subject: [PATCH 19/41] UPSTREAM: memstick: r592: Fix UAF bug in r592_remove due to race condition [ Upstream commit 63264422785021704c39b38f65a78ab9e4a186d7 ] In r592_probe, dev->detect_timer was bound with r592_detect_timer. In r592_irq function, the timer function will be invoked by mod_timer. If we remove the module which will call hantro_release to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug. Fix it by canceling the work before cleanup in r592_remove. CPU0 CPU1 |r592_detect_timer r592_remove | memstick_free_host| put_device; | kfree(host); | | | queue_work | &host->media_checker //use Bug: 287729043 Signed-off-by: Zheng Wang Link: https://lore.kernel.org/r/20230307164338.1246287-1-zyytlz.wz@163.com Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin (cherry picked from commit 9a342d4eb9fb8e52f7d1afe088a79513f3f9a9a5) Signed-off-by: Lee Jones Change-Id: Idb15f593287ebaeec294b3e276126306fa6743ba --- drivers/memstick/host/r592.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c index eaa2a94d18be..dd06c18495eb 100644 --- a/drivers/memstick/host/r592.c +++ b/drivers/memstick/host/r592.c @@ -828,7 +828,7 @@ static void r592_remove(struct pci_dev *pdev) /* Stop the processing thread. That ensures that we won't take any more requests */ kthread_stop(dev->io_thread); - + del_timer_sync(&dev->detect_timer); r592_enable_device(dev, false); while (!error && dev->req) { From 4991def0fa4cf4af67957e25233383ca05574d32 Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Wed, 12 Apr 2023 15:49:23 +1000 Subject: [PATCH 20/41] UPSTREAM: xfs: verify buffer contents when we skip log replay commit 22ed903eee23a5b174e240f1cdfa9acf393a5210 upstream. syzbot detected a crash during log recovery: XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 XFS (loop0): Torn write (CRC failure) detected at log block 0x180. Truncating head block from 0x200. XFS (loop0): Starting recovery (logdev: internal) ================================================================== BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813 Read of size 8 at addr ffff88807e89f258 by task syz-executor132/5074 CPU: 0 PID: 5074 Comm: syz-executor132 Not tainted 6.2.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:306 print_report+0x107/0x1f0 mm/kasan/report.c:417 kasan_report+0xcd/0x100 mm/kasan/report.c:517 xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813 xfs_btree_lookup+0x346/0x12c0 fs/xfs/libxfs/xfs_btree.c:1913 xfs_btree_simple_query_range+0xde/0x6a0 fs/xfs/libxfs/xfs_btree.c:4713 xfs_btree_query_range+0x2db/0x380 fs/xfs/libxfs/xfs_btree.c:4953 xfs_refcount_recover_cow_leftovers+0x2d1/0xa60 fs/xfs/libxfs/xfs_refcount.c:1946 xfs_reflink_recover_cow+0xab/0x1b0 fs/xfs/xfs_reflink.c:930 xlog_recover_finish+0x824/0x920 fs/xfs/xfs_log_recover.c:3493 xfs_log_mount_finish+0x1ec/0x3d0 fs/xfs/xfs_log.c:829 xfs_mountfs+0x146a/0x1ef0 fs/xfs/xfs_mount.c:933 xfs_fs_fill_super+0xf95/0x11f0 fs/xfs/xfs_super.c:1666 get_tree_bdev+0x400/0x620 fs/super.c:1282 vfs_get_tree+0x88/0x270 fs/super.c:1489 do_new_mount+0x289/0xad0 fs/namespace.c:3145 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f89fa3f4aca Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffd5fb5ef8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00646975756f6e2c RCX: 00007f89fa3f4aca RDX: 0000000020000100 RSI: 0000000020009640 RDI: 00007fffd5fb5f10 RBP: 00007fffd5fb5f10 R08: 00007fffd5fb5f50 R09: 000000000000970d R10: 0000000000200800 R11: 0000000000000206 R12: 0000000000000004 R13: 0000555556c6b2c0 R14: 0000000000200800 R15: 00007fffd5fb5f50 The fuzzed image contains an AGF with an obviously garbage agf_refcount_level value of 32, and a dirty log with a buffer log item for that AGF. The ondisk AGF has a higher LSN than the recovered log item. xlog_recover_buf_commit_pass2 reads the buffer, compares the LSNs, and decides to skip replay because the ondisk buffer appears to be newer. Unfortunately, the ondisk buffer is corrupt, but recovery just read the buffer with no buffer ops specified: error = xfs_buf_read(mp->m_ddev_targp, buf_f->blf_blkno, buf_f->blf_len, buf_flags, &bp, NULL); Skipping the buffer leaves its contents in memory unverified. This sets us up for a kernel crash because xfs_refcount_recover_cow_leftovers reads the buffer (which is still around in XBF_DONE state, so no read verification) and creates a refcountbt cursor of height 32. This is impossible so we run off the end of the cursor object and crash. Fix this by invoking the verifier on all skipped buffers and aborting log recovery if the ondisk buffer is corrupt. It might be smarter to force replay the log item atop the buffer and then see if it'll pass the write verifier (like ext4 does) but for now let's go with the conservative option where we stop immediately. Bug: 284409747 Link: https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner Reported-by: Danila Chernetsov Link: https://lore.kernel.org/linux-xfs/20230601164439.15404-1-listdansp@mail.ru Signed-off-by: Amir Goldstein Acked-by: Darrick J. Wong Signed-off-by: Greg Kroah-Hartman (cherry picked from commit a2961463d74f5c86a8dda3b41c484c28ccc4c289) Signed-off-by: Lee Jones Change-Id: Ie5e156221966323a9cb7cc261b4ed17593cfaabd --- fs/xfs/xfs_buf_item_recover.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/fs/xfs/xfs_buf_item_recover.c b/fs/xfs/xfs_buf_item_recover.c index b374c9cee117..a053b0bf7930 100644 --- a/fs/xfs/xfs_buf_item_recover.c +++ b/fs/xfs/xfs_buf_item_recover.c @@ -924,6 +924,16 @@ xlog_recover_buf_commit_pass2( if (lsn && lsn != -1 && XFS_LSN_CMP(lsn, current_lsn) >= 0) { trace_xfs_log_recover_buf_skip(log, buf_f); xlog_recover_validate_buf_type(mp, bp, buf_f, NULLCOMMITLSN); + + /* + * We're skipping replay of this buffer log item due to the log + * item LSN being behind the ondisk buffer. Verify the buffer + * contents since we aren't going to run the write verifier. + */ + if (bp->b_ops) { + bp->b_ops->verify_read(bp); + error = bp->b_error; + } goto out_release; } From 39c3d16903dc2621de4c135d296636e05cf6e614 Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Thu, 8 Jun 2023 08:29:03 +0100 Subject: [PATCH 21/41] UPSTREAM: net/sched: cls_u32: Fix reference counter leak leading to overflow [ Upstream commit 04c55383fa5689357bcdd2c8036725a55ed632bc ] In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Bug: 273251569 Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet Signed-off-by: Lee Jones Reviewed-by: Eric Dumazet Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller Signed-off-by: Sasha Levin (cherry picked from commit 07f9cc229b44cbcee6385802d390091d915f38c3) Signed-off-by: Lee Jones Change-Id: I95524bfda9a08a40b3d54515e528419dba18dc55 --- net/sched/cls_u32.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index da042bc8b239..1ac8ff445a6d 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -716,12 +716,18 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, struct nlattr *est, bool ovr, struct netlink_ext_ack *extack) { - int err; + int err, ifindex = -1; err = tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, true, extack); if (err < 0) return err; + if (tb[TCA_U32_INDEV]) { + ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); + if (ifindex < 0) + return -EINVAL; + } + if (tb[TCA_U32_LINK]) { u32 handle = nla_get_u32(tb[TCA_U32_LINK]); struct tc_u_hnode *ht_down = NULL, *ht_old; @@ -756,13 +762,9 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, tcf_bind_filter(tp, &n->res, base); } - if (tb[TCA_U32_INDEV]) { - int ret; - ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); - if (ret < 0) - return -EINVAL; - n->ifindex = ret; - } + if (ifindex >= 0) + n->ifindex = ifindex; + return 0; } From 69dc2c1a79b89c0bed7355a1c47020772b6efa6c Mon Sep 17 00:00:00 2001 From: Chao Yu Date: Mon, 10 Apr 2023 10:14:02 +0800 Subject: [PATCH 22/41] UPSTREAM: f2fs: fix to avoid use-after-free for cached IPU bio [ Upstream commit 5cdb422c839134273866208dad5360835ddb9794 ] xfstest generic/019 reports a bug: kernel BUG at mm/filemap.c:1619! RIP: 0010:folio_end_writeback+0x8a/0x90 Call Trace: end_page_writeback+0x1c/0x60 f2fs_write_end_io+0x199/0x420 bio_endio+0x104/0x180 submit_bio_noacct+0xa5/0x510 submit_bio+0x48/0x80 f2fs_submit_write_bio+0x35/0x300 f2fs_submit_merged_ipu_write+0x2a0/0x2b0 f2fs_write_single_data_page+0x838/0x8b0 f2fs_write_cache_pages+0x379/0xa30 f2fs_write_data_pages+0x30c/0x340 do_writepages+0xd8/0x1b0 __writeback_single_inode+0x44/0x370 writeback_sb_inodes+0x233/0x4d0 __writeback_inodes_wb+0x56/0xf0 wb_writeback+0x1dd/0x2d0 wb_workfn+0x367/0x4a0 process_one_work+0x21d/0x430 worker_thread+0x4e/0x3c0 kthread+0x103/0x130 ret_from_fork+0x2c/0x50 The root cause is: after cp_error is set, f2fs_submit_merged_ipu_write() in f2fs_write_single_data_page() tries to flush IPU bio in cache, however f2fs_submit_merged_ipu_write() missed to check validity of @bio parameter, result in submitting random cached bio which belong to other IO context, then it will cause use-after-free issue, fix it by adding additional validity check. Fixes: 0b20fcec8651 ("f2fs: cache global IPU bio") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Sasha Levin Bug: 268109575 Change-Id: Ifbdad0f8e8b51592ed63d025cf13965e623a7956 Signed-off-by: Tudor Ambarus --- fs/f2fs/data.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index d6be65b40302..113be0d3ee5b 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -829,6 +829,8 @@ void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi, bool found = false; struct bio *target = bio ? *bio : NULL; + f2fs_bug_on(sbi, !target && !page); + for (temp = HOT; temp < NR_TEMP_TYPE && !found; temp++) { struct f2fs_bio_info *io = sbi->write_io[DATA] + temp; struct list_head *head = &io->bio_list; @@ -2875,7 +2877,8 @@ out: if (unlikely(f2fs_cp_error(sbi))) { f2fs_submit_merged_write(sbi, DATA); - f2fs_submit_merged_ipu_write(sbi, bio, NULL); + if (bio && *bio) + f2fs_submit_merged_ipu_write(sbi, bio, NULL); submitted = NULL; } From 69a794a283c77a4fd33455697deaa77155d58d08 Mon Sep 17 00:00:00 2001 From: Oven Date: Fri, 16 Jun 2023 20:49:05 +0800 Subject: [PATCH 23/41] ANDROID: vendor_hooks: Add hooks to avoid key threads stalled in memory allocations We add these hooks to avoid key threads blocked in memory allocation path. -android_vh_free_unref_page_bypass ----We create a memory pool for the key threads. This hook determines whether a page should be free to the pool or to buddy freelist. It works with a existing hook `android_vh_alloc_pages_reclaim_bypass`, which takes pages out of the pool. -android_vh_kvmalloc_node_use_vmalloc ----For key threads, we perfer not to run into direct reclaim. So we clear __GFP_DIRECT_RECLAIM flag. For threads which are not that important, we perfer use vmalloc. -android_vh_should_alloc_pages_retry ----Before key threads run into direct reclaim, we want to retry with a lower watermark. -android_vh_unreserve_highatomic_bypass ----We want to keep more highatomic pages when unreserve them to avoid highatomic allocation failures. -android_vh_pageset_update ----We found the default per-cpu pageset is quite few in smartphones with large ram size. This hook is used to increase it to reduce zone->lock contentions. -android_vh_rmqueue_bulk_bypass ----We found sometimes when key threads run into rmqueue_bulk, it took several milliseconds spinning at zone->lock or filling per-cpu pages. We use this hook to take pages from the mempool mentioned above, rather than grab zone->lock and fill a batch of pages to per-cpu. Bug: 288216516 Change-Id: I1656032d6819ca627723341987b6094775bc345f Signed-off-by: Oven --- drivers/android/vendor_hooks.c | 6 ++++++ include/trace/hooks/mm.h | 21 +++++++++++++++++++++ mm/page_alloc.c | 30 ++++++++++++++++++++++++++++++ mm/util.c | 7 +++++++ 4 files changed, 64 insertions(+) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 2ce349294f3d..0aa79f03f578 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -332,6 +332,12 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_page_trylock); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_page_referenced_check_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_drain_all_pages_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cma_drain_all_pages_bypass); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_unref_page_bypass); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_kvmalloc_node_use_vmalloc); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_should_alloc_pages_retry); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_unreserve_highatomic_bypass); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_pageset_update); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_rmqueue_bulk_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_pcplist_add_cma_pages_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_psi_event); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_psi_group); diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index 8fecbc8b3d5b..d041bd44edaf 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -192,6 +192,27 @@ DECLARE_HOOK(android_vh_mark_page_accessed, DECLARE_HOOK(android_vh_cma_drain_all_pages_bypass, TP_PROTO(unsigned int migratetype, bool *bypass), TP_ARGS(migratetype, bypass)); +DECLARE_HOOK(android_vh_free_unref_page_bypass, + TP_PROTO(struct page *page, int order, int migratetype, bool *bypass), + TP_ARGS(page, order, migratetype, bypass)); +DECLARE_HOOK(android_vh_kvmalloc_node_use_vmalloc, + TP_PROTO(size_t size, gfp_t *kmalloc_flags, bool *use_vmalloc), + TP_ARGS(size, kmalloc_flags, use_vmalloc)); +DECLARE_HOOK(android_vh_should_alloc_pages_retry, + TP_PROTO(gfp_t gfp_mask, int order, int *alloc_flags, + int migratetype, struct zone *preferred_zone, struct page **page, bool *should_alloc_retry), + TP_ARGS(gfp_mask, order, alloc_flags, + migratetype, preferred_zone, page, should_alloc_retry)); +DECLARE_HOOK(android_vh_unreserve_highatomic_bypass, + TP_PROTO(bool force, struct zone *zone, bool *skip_unreserve_highatomic), + TP_ARGS(force, zone, skip_unreserve_highatomic)); +DECLARE_HOOK(android_vh_pageset_update, + TP_PROTO(unsigned long *high, unsigned long *batch), + TP_ARGS(high, batch)); +DECLARE_HOOK(android_vh_rmqueue_bulk_bypass, + TP_PROTO(unsigned int order, struct per_cpu_pages *pcp, int migratetype, + struct list_head *list), + TP_ARGS(order, pcp, migratetype, list)); DECLARE_HOOK(android_vh_pcplist_add_cma_pages_bypass, TP_PROTO(int migratetype, bool *bypass), TP_ARGS(migratetype, bypass)); diff --git a/mm/page_alloc.c b/mm/page_alloc.c index cd1c43bbf037..19eb65be0ea6 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -1608,11 +1608,16 @@ static void __free_pages_ok(struct page *page, unsigned int order, unsigned long flags; int migratetype; unsigned long pfn = page_to_pfn(page); + bool skip_free_unref_page = false; if (!free_pages_prepare(page, order, true, fpi_flags)) return; migratetype = get_pfnblock_migratetype(page, pfn); + trace_android_vh_free_unref_page_bypass(page, order, migratetype, &skip_free_unref_page); + if (skip_free_unref_page) + return; + local_irq_save(flags); __count_vm_events(PGFREE, 1 << order); free_one_page(page_zone(page), page, pfn, order, migratetype, @@ -2791,6 +2796,7 @@ static bool unreserve_highatomic_pageblock(const struct alloc_context *ac, struct page *page; int order; bool ret; + bool skip_unreserve_highatomic = false; for_each_zone_zonelist_nodemask(zone, z, zonelist, ac->highest_zoneidx, ac->nodemask) { @@ -2802,6 +2808,11 @@ static bool unreserve_highatomic_pageblock(const struct alloc_context *ac, pageblock_nr_pages) continue; + trace_android_vh_unreserve_highatomic_bypass(force, zone, + &skip_unreserve_highatomic); + if (skip_unreserve_highatomic) + continue; + spin_lock_irqsave(&zone->lock, flags); for (order = 0; order < MAX_ORDER; order++) { struct free_area *area = &(zone->free_area[order]); @@ -3047,6 +3058,10 @@ static struct list_head *get_populated_pcp_list(struct zone *zone, struct list_head *list = &pcp->lists[migratetype]; if (list_empty(list)) { + trace_android_vh_rmqueue_bulk_bypass(order, pcp, migratetype, list); + if (!list_empty(list)) + return list; + pcp->count += rmqueue_bulk(zone, order, pcp->batch, list, migratetype, alloc_flags); @@ -3343,10 +3358,17 @@ void free_unref_page(struct page *page) { unsigned long flags; unsigned long pfn = page_to_pfn(page); + int migratetype; + bool skip_free_unref_page = false; if (!free_unref_page_prepare(page, pfn)) return; + migratetype = get_pfnblock_migratetype(page, pfn); + trace_android_vh_free_unref_page_bypass(page, 0, migratetype, &skip_free_unref_page); + if (skip_free_unref_page) + return; + local_irq_save(flags); free_unref_page_commit(page, pfn); local_irq_restore(flags); @@ -4822,6 +4844,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, unsigned int zonelist_iter_cookie; int reserve_flags; unsigned long vh_record; + bool should_alloc_retry = false; trace_android_vh_alloc_pages_slowpath_begin(gfp_mask, order, &vh_record); /* @@ -4962,6 +4985,12 @@ retry: if (page) goto got_pg; + trace_android_vh_should_alloc_pages_retry(gfp_mask, order, + &alloc_flags, ac->migratetype, ac->preferred_zoneref->zone, + &page, &should_alloc_retry); + if (should_alloc_retry) + goto retry; + /* Try direct reclaim and then allocating */ page = __alloc_pages_direct_reclaim(gfp_mask, order, alloc_flags, ac, &did_some_progress); @@ -6604,6 +6633,7 @@ static int zone_batchsize(struct zone *zone) static void pageset_update(struct per_cpu_pages *pcp, unsigned long high, unsigned long batch) { + trace_android_vh_pageset_update(&high, &batch); /* start with a fail safe value for batch */ pcp->batch = 1; smp_wmb(); diff --git a/mm/util.c b/mm/util.c index 9e2b223ebde3..6ed9861cb98c 100644 --- a/mm/util.c +++ b/mm/util.c @@ -29,6 +29,7 @@ #include "internal.h" #ifndef __GENKSYMS__ #include +#include #endif /** @@ -587,6 +588,7 @@ void *kvmalloc_node(size_t size, gfp_t flags, int node) { gfp_t kmalloc_flags = flags; void *ret; + bool use_vmalloc = false; /* * vmalloc uses GFP_KERNEL for some internal allocations (e.g page tables) @@ -595,6 +597,10 @@ void *kvmalloc_node(size_t size, gfp_t flags, int node) if ((flags & GFP_KERNEL) != GFP_KERNEL) return kmalloc_node(size, flags, node); + trace_android_vh_kvmalloc_node_use_vmalloc(size, &kmalloc_flags, &use_vmalloc); + if (use_vmalloc) + goto use_vmalloc_node; + /* * We want to attempt a large physically contiguous block first because * it is less likely to fragment multiple larger blocks and therefore @@ -624,6 +630,7 @@ void *kvmalloc_node(size_t size, gfp_t flags, int node) return NULL; } +use_vmalloc_node: return __vmalloc_node(size, 1, flags, node, __builtin_return_address(0)); } From 4782c8cb168f9119ff9fbdba2f01e9c10397f8c0 Mon Sep 17 00:00:00 2001 From: Oven Date: Fri, 16 Jun 2023 20:51:14 +0800 Subject: [PATCH 24/41] ANDROID: vendor_hook: Add hook to tune readaround size In some situations, we want to decrease readaround size for better performance. So we add this hook. Bug: 288216516 Change-Id: If2f5f75976c99ff1f82ce29d370f9216926055ab Signed-off-by: Oven --- drivers/android/vendor_hooks.c | 1 + include/trace/hooks/mm.h | 4 ++++ mm/filemap.c | 2 ++ 3 files changed, 7 insertions(+) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 0aa79f03f578..ae35b2a9ec8b 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -447,6 +447,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_read_done); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_handle_tlb_conf); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_shrink_node_memcgs); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ra_tuning_max_page); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_tune_mmap_readaround); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_handle_pte_fault_end); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_handle_pte_fault_end); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cow_user_page); diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index d041bd44edaf..7a1d74f646cb 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -222,6 +222,10 @@ DECLARE_HOOK(android_vh_subpage_dma_contig_alloc, DECLARE_HOOK(android_vh_ra_tuning_max_page, TP_PROTO(struct readahead_control *ractl, unsigned long *max_page), TP_ARGS(ractl, max_page)); +DECLARE_HOOK(android_vh_tune_mmap_readaround, + TP_PROTO(unsigned int ra_pages, pgoff_t pgoff, + pgoff_t *start, unsigned int *size, unsigned int *async_size), + TP_ARGS(ra_pages, pgoff, start, size, async_size)); DECLARE_RESTRICTED_HOOK(android_rvh_handle_pte_fault_end, TP_PROTO(struct vm_fault *vmf, unsigned long highest_memmap_pfn), TP_ARGS(vmf, highest_memmap_pfn), 1); diff --git a/mm/filemap.c b/mm/filemap.c index dd1db5745741..0450b4ef4b1a 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -2661,6 +2661,8 @@ static struct file *do_sync_mmap_readahead(struct vm_fault *vmf) ra->start = max_t(long, 0, vmf->pgoff - ra->ra_pages / 2); ra->size = ra->ra_pages; ra->async_size = ra->ra_pages / 4; + trace_android_vh_tune_mmap_readaround(ra->ra_pages, vmf->pgoff, + &ra->start, &ra->size, &ra->async_size); ractl._index = ra->start; do_page_cache_ra(&ractl, ra->size, ra->async_size); return fpin; From 540586cf5b23c020ae90952c1b9b8ceab26545e1 Mon Sep 17 00:00:00 2001 From: Oven Date: Fri, 30 Jun 2023 00:33:10 +0800 Subject: [PATCH 25/41] ANDROID: GKI: Update symbols to symbol list Leaf changes summary: 14 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 7 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 7 Added variables 7 Added functions: [A] 'function int __traceiter_android_vh_free_unref_page_bypass(void*, page*, int, int, bool*)' [A] 'function int __traceiter_android_vh_kvmalloc_node_use_vmalloc(void*, size_t, gfp_t*, bool*)' [A] 'function int __traceiter_android_vh_pageset_update(void*, unsigned long int*, unsigned long int*)' [A] 'function int __traceiter_android_vh_rmqueue_bulk_bypass(void*, unsigned int, per_cpu_pages*, int, list_head*)' [A] 'function int __traceiter_android_vh_should_alloc_pages_retry(void*, gfp_t, int, int*, int, zone*, page**, bool*)' [A] 'function int __traceiter_android_vh_tune_mmap_readaround(void*, unsigned int, unsigned long int, unsigned long int*, unsigned int*, unsigned int*)' [A] 'function int __traceiter_android_vh_unreserve_highatomic_bypass(void*, bool, zone*, bool*)' 7 Added variables: [A] 'tracepoint __tracepoint_android_vh_free_unref_page_bypass' [A] 'tracepoint __tracepoint_android_vh_kvmalloc_node_use_vmalloc' [A] 'tracepoint __tracepoint_android_vh_pageset_update' [A] 'tracepoint __tracepoint_android_vh_rmqueue_bulk_bypass' [A] 'tracepoint __tracepoint_android_vh_should_alloc_pages_retry' [A] 'tracepoint __tracepoint_android_vh_tune_mmap_readaround' [A] 'tracepoint __tracepoint_android_vh_unreserve_highatomic_bypass' Bug: 288216516 Change-Id: Id93d9871ea9fc292916e2b75b95b017ccb6e2011 Signed-off-by: Oven --- android/abi_gki_aarch64.xml | 847 ++++++++++++++++++---------------- android/abi_gki_aarch64_oplus | 18 + 2 files changed, 461 insertions(+), 404 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 0bab4531f386..7656ab64512c 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -509,6 +509,7 @@ + @@ -547,6 +548,7 @@ + @@ -587,6 +589,7 @@ + @@ -602,6 +605,7 @@ + @@ -648,6 +652,7 @@ + @@ -674,6 +679,7 @@ + @@ -691,6 +697,7 @@ + @@ -6569,6 +6576,7 @@ + @@ -6607,6 +6615,7 @@ + @@ -6647,6 +6656,7 @@ + @@ -6662,6 +6672,7 @@ + @@ -6708,6 +6719,7 @@ + @@ -6734,6 +6746,7 @@ + @@ -6751,6 +6764,7 @@ + @@ -12159,6 +12173,7 @@ + @@ -44630,23 +44645,7 @@ - - - - - - - - - - - - - - - - - + @@ -48986,7 +48985,6 @@ - @@ -53944,13 +53942,6 @@ - - - - - - - @@ -66611,13 +66602,6 @@ - - - - - - - @@ -91409,7 +91393,6 @@ - @@ -103177,12 +103160,6 @@ - - - - - - @@ -111429,7 +111406,6 @@ - @@ -116503,9 +116479,9 @@ - + - + @@ -116534,11 +116510,11 @@ - - - - - + + + + + @@ -117174,9 +117150,9 @@ - - - + + + @@ -117219,9 +117195,9 @@ - - - + + + @@ -117229,9 +117205,9 @@ - - - + + + @@ -117747,13 +117723,13 @@ - - - + + + - - + + @@ -118262,17 +118238,17 @@ - - - - + + + + - - - - - + + + + + @@ -118453,12 +118429,12 @@ - - - - - - + + + + + + @@ -118539,19 +118515,19 @@ - - - - - + + + + + - - - - - - + + + + + + @@ -118563,10 +118539,10 @@ - - - - + + + + @@ -118979,10 +118955,10 @@ - - - - + + + + @@ -119023,22 +118999,22 @@ - - - - - - - + + + + + + + - - - - - - - + + + + + + + @@ -119055,17 +119031,17 @@ - - - - + + + + - - - - - + + + + + @@ -119365,27 +119341,27 @@ - - - + + + - - - + + + - - - - - + + + + + - - - - + + + + @@ -119507,12 +119483,12 @@ - - - - - - + + + + + + @@ -119593,17 +119569,17 @@ - - - - + + + + - - - - - + + + + + @@ -119611,6 +119587,14 @@ + + + + + + + + @@ -119711,12 +119695,12 @@ - - - - - - + + + + + + @@ -119735,10 +119719,10 @@ - - - - + + + + @@ -119763,10 +119747,10 @@ - - - - + + + + @@ -119853,6 +119837,13 @@ + + + + + + + @@ -119865,24 +119856,24 @@ - - - - - - + + + + + + - - - - + + + + - - - - + + + + @@ -119939,10 +119930,10 @@ - - - - + + + + @@ -120049,10 +120040,10 @@ - - - - + + + + @@ -120063,11 +120054,11 @@ - - - - - + + + + + @@ -120101,10 +120092,16 @@ - - - - + + + + + + + + + + @@ -120140,10 +120137,10 @@ - - - - + + + + @@ -120170,9 +120167,9 @@ - - - + + + @@ -120191,6 +120188,14 @@ + + + + + + + + @@ -120420,9 +120425,9 @@ - - - + + + @@ -120451,6 +120456,17 @@ + + + + + + + + + + + @@ -120500,10 +120516,10 @@ - - - - + + + + @@ -120529,22 +120545,22 @@ - - - - - + + + + + - - - + + + - - - - + + + + @@ -120559,9 +120575,9 @@ - - - + + + @@ -120608,6 +120624,15 @@ + + + + + + + + + @@ -120721,10 +120746,17 @@ - - - - + + + + + + + + + + + @@ -120784,9 +120816,9 @@ - - - + + + @@ -121226,8 +121258,8 @@ - - + + @@ -121254,7 +121286,7 @@ - + @@ -121267,10 +121299,10 @@ - - + + - + @@ -121336,18 +121368,18 @@ - + - - + + - - + + @@ -121392,10 +121424,10 @@ - - - - + + + + @@ -121414,7 +121446,7 @@ - + @@ -121427,9 +121459,10 @@ - - + + + @@ -121446,15 +121479,15 @@ - + - + - + @@ -121468,11 +121501,12 @@ + - - - + + + @@ -121482,7 +121516,7 @@ - + @@ -121500,29 +121534,31 @@ - + - + - + + - + - + + @@ -121564,11 +121600,12 @@ - + + @@ -121577,17 +121614,17 @@ - + - - - + + + - + @@ -121595,6 +121632,7 @@ + @@ -121612,7 +121650,8 @@ - + + @@ -121621,7 +121660,7 @@ - + @@ -122234,9 +122273,9 @@ - - - + + + @@ -122360,9 +122399,9 @@ - - - + + + @@ -122444,7 +122483,7 @@ - + @@ -131366,15 +131405,15 @@ - + - - + + @@ -131391,10 +131430,10 @@ - - - - + + + + @@ -131619,14 +131658,14 @@ - - - + + + - - - + + + @@ -132199,9 +132238,9 @@ - - - + + + @@ -132218,9 +132257,9 @@ - - - + + + @@ -132262,10 +132301,10 @@ - - - - + + + + @@ -132574,8 +132613,8 @@ - - + + @@ -132855,10 +132894,10 @@ - - - - + + + + @@ -135196,8 +135235,8 @@ - - + + @@ -135296,16 +135335,16 @@ - - - - + + + + - - - - + + + + @@ -135431,14 +135470,14 @@ - - - + + + - - - + + + @@ -135446,10 +135485,10 @@ - - - - + + + + @@ -135733,8 +135772,8 @@ - - + + @@ -135742,10 +135781,10 @@ - - - - + + + + @@ -136247,14 +136286,14 @@ - - - + + + - - - + + + @@ -138446,14 +138485,14 @@ - - - - + + + + - - + + @@ -138462,12 +138501,12 @@ - - + + - - + + @@ -138532,24 +138571,24 @@ - - - - - - - - + + + + + + + + - - - - - - - - + + + + + + + + @@ -141089,17 +141128,17 @@ - - - - - + + + + + - - - - + + + + @@ -143618,11 +143657,11 @@ - + - - + + @@ -145414,9 +145453,9 @@ - - - + + + @@ -145699,9 +145738,9 @@ - - - + + + @@ -146589,9 +146628,9 @@ - - - + + + @@ -149929,16 +149968,16 @@ - + - - - - - - - + + + + + + + @@ -149986,9 +150025,9 @@ - - - + + + @@ -150635,19 +150674,19 @@ - - - - - - + + + + + + - - - - - + + + + + diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus index 61477d74b5cb..20d15056b373 100644 --- a/android/abi_gki_aarch64_oplus +++ b/android/abi_gki_aarch64_oplus @@ -2794,6 +2794,15 @@ __traceiter_android_vh_clear_mask_adjust __traceiter_android_vh_clear_reserved_fmt_fields __traceiter_android_vh_cma_drain_all_pages_bypass + __traceiter_android_vh_alloc_pages_reclaim_bypass + __traceiter_android_vh_free_unref_page_bypass + __traceiter_android_vh_kvmalloc_node_use_vmalloc + __traceiter_android_vh_should_alloc_pages_retry + __traceiter_android_vh_unreserve_highatomic_bypass + __traceiter_android_vh_pageset_update + __traceiter_android_vh_rmqueue_bulk_bypass + __traceiter_android_vh_tune_mmap_readaround + __traceiter_android_vh_ra_tuning_max_page __traceiter_android_vh_cleanup_old_buffers_bypass __traceiter_android_vh_commit_creds __traceiter_android_vh_cpufreq_acct_update_power @@ -3050,6 +3059,15 @@ __tracepoint_android_vh_clear_mask_adjust __tracepoint_android_vh_clear_reserved_fmt_fields __tracepoint_android_vh_cma_drain_all_pages_bypass + __tracepoint_android_vh_alloc_pages_reclaim_bypass + __tracepoint_android_vh_free_unref_page_bypass + __tracepoint_android_vh_kvmalloc_node_use_vmalloc + __tracepoint_android_vh_should_alloc_pages_retry + __tracepoint_android_vh_unreserve_highatomic_bypass + __tracepoint_android_vh_pageset_update + __tracepoint_android_vh_rmqueue_bulk_bypass + __tracepoint_android_vh_tune_mmap_readaround + __tracepoint_android_vh_ra_tuning_max_page __tracepoint_android_vh_cleanup_old_buffers_bypass __tracepoint_android_vh_commit_creds __tracepoint_android_vh_cpufreq_acct_update_power From c811ac11f792c50d5a636ca5fd9b60155befd555 Mon Sep 17 00:00:00 2001 From: "t.feng" Date: Wed, 10 May 2023 11:50:44 +0800 Subject: [PATCH 26/41] UPSTREAM: ipvlan:Fix out-of-bounds caused by unclear skb->cb [ Upstream commit 90cbed5247439a966b645b34eb0a2e037836ea8e ] If skb enqueue the qdisc, fq_skb_cb(skb)->time_to_send is changed which is actually skb->cb, and IPCB(skb_in)->opt will be used in __ip_options_echo. It is possible that memcpy is out of bounds and lead to stack overflow. We should clear skb->cb before ip_local_out or ip6_local_out. v2: 1. clean the stack info 2. use IPCB/IP6CB instead of skb->cb crash on stable-5.10(reproduce in kasan kernel). Stack info: [ 2203.651571] BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0x589/0x800 [ 2203.653327] Write of size 4 at addr ffff88811a388f27 by task swapper/3/0 [ 2203.655460] CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Not tainted 5.10.0-60.18.0.50.h856.kasan.eulerosv2r11.x86_64 #1 [ 2203.655466] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-20181220_000000-szxrtosci10000 04/01/2014 [ 2203.655475] Call Trace: [ 2203.655481] [ 2203.655501] dump_stack+0x9c/0xd3 [ 2203.655514] print_address_description.constprop.0+0x19/0x170 [ 2203.655530] __kasan_report.cold+0x6c/0x84 [ 2203.655586] kasan_report+0x3a/0x50 [ 2203.655594] check_memory_region+0xfd/0x1f0 [ 2203.655601] memcpy+0x39/0x60 [ 2203.655608] __ip_options_echo+0x589/0x800 [ 2203.655654] __icmp_send+0x59a/0x960 [ 2203.655755] nf_send_unreach+0x129/0x3d0 [nf_reject_ipv4] [ 2203.655763] reject_tg+0x77/0x1bf [ipt_REJECT] [ 2203.655772] ipt_do_table+0x691/0xa40 [ip_tables] [ 2203.655821] nf_hook_slow+0x69/0x100 [ 2203.655828] __ip_local_out+0x21e/0x2b0 [ 2203.655857] ip_local_out+0x28/0x90 [ 2203.655868] ipvlan_process_v4_outbound+0x21e/0x260 [ipvlan] [ 2203.655931] ipvlan_xmit_mode_l3+0x3bd/0x400 [ipvlan] [ 2203.655967] ipvlan_queue_xmit+0xb3/0x190 [ipvlan] [ 2203.655977] ipvlan_start_xmit+0x2e/0xb0 [ipvlan] [ 2203.655984] xmit_one.constprop.0+0xe1/0x280 [ 2203.655992] dev_hard_start_xmit+0x62/0x100 [ 2203.656000] sch_direct_xmit+0x215/0x640 [ 2203.656028] __qdisc_run+0x153/0x1f0 [ 2203.656069] __dev_queue_xmit+0x77f/0x1030 [ 2203.656173] ip_finish_output2+0x59b/0xc20 [ 2203.656244] __ip_finish_output.part.0+0x318/0x3d0 [ 2203.656312] ip_finish_output+0x168/0x190 [ 2203.656320] ip_output+0x12d/0x220 [ 2203.656357] __ip_queue_xmit+0x392/0x880 [ 2203.656380] __tcp_transmit_skb+0x1088/0x11c0 [ 2203.656436] __tcp_retransmit_skb+0x475/0xa30 [ 2203.656505] tcp_retransmit_skb+0x2d/0x190 [ 2203.656512] tcp_retransmit_timer+0x3af/0x9a0 [ 2203.656519] tcp_write_timer_handler+0x3ba/0x510 [ 2203.656529] tcp_write_timer+0x55/0x180 [ 2203.656542] call_timer_fn+0x3f/0x1d0 [ 2203.656555] expire_timers+0x160/0x200 [ 2203.656562] run_timer_softirq+0x1f4/0x480 [ 2203.656606] __do_softirq+0xfd/0x402 [ 2203.656613] asm_call_irq_on_stack+0x12/0x20 [ 2203.656617] [ 2203.656623] do_softirq_own_stack+0x37/0x50 [ 2203.656631] irq_exit_rcu+0x134/0x1a0 [ 2203.656639] sysvec_apic_timer_interrupt+0x36/0x80 [ 2203.656646] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 2203.656654] RIP: 0010:default_idle+0x13/0x20 [ 2203.656663] Code: 89 f0 5d 41 5c 41 5d 41 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 0f 1f 44 00 00 0f 1f 44 00 00 0f 00 2d 9f 32 57 00 fb f4 cc cc cc cc 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 54 be 08 [ 2203.656668] RSP: 0018:ffff88810036fe78 EFLAGS: 00000256 [ 2203.656676] RAX: ffffffffaf2a87f0 RBX: ffff888100360000 RCX: ffffffffaf290191 [ 2203.656681] RDX: 0000000000098b5e RSI: 0000000000000004 RDI: ffff88811a3c4f60 [ 2203.656686] RBP: 0000000000000000 R08: 0000000000000001 R09: ffff88811a3c4f63 [ 2203.656690] R10: ffffed10234789ec R11: 0000000000000001 R12: 0000000000000003 [ 2203.656695] R13: ffff888100360000 R14: 0000000000000000 R15: 0000000000000000 [ 2203.656729] default_idle_call+0x5a/0x150 [ 2203.656735] cpuidle_idle_call+0x1c6/0x220 [ 2203.656780] do_idle+0xab/0x100 [ 2203.656786] cpu_startup_entry+0x19/0x20 [ 2203.656793] secondary_startup_64_no_verify+0xc2/0xcb [ 2203.657409] The buggy address belongs to the page: [ 2203.658648] page:0000000027a9842f refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a388 [ 2203.658665] flags: 0x17ffffc0001000(reserved|node=0|zone=2|lastcpupid=0x1fffff) [ 2203.658675] raw: 0017ffffc0001000 ffffea000468e208 ffffea000468e208 0000000000000000 [ 2203.658682] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 2203.658686] page dumped because: kasan: bad access detected To reproduce(ipvlan with IPVLAN_MODE_L3): Env setting: ======================================================= modprobe ipvlan ipvlan_default_mode=1 sysctl net.ipv4.conf.eth0.forwarding=1 iptables -t nat -A POSTROUTING -s 20.0.0.0/255.255.255.0 -o eth0 -j MASQUERADE ip link add gw link eth0 type ipvlan ip -4 addr add 20.0.0.254/24 dev gw ip netns add net1 ip link add ipv1 link eth0 type ipvlan ip link set ipv1 netns net1 ip netns exec net1 ip link set ipv1 up ip netns exec net1 ip -4 addr add 20.0.0.4/24 dev ipv1 ip netns exec net1 route add default gw 20.0.0.254 ip netns exec net1 tc qdisc add dev ipv1 root netem loss 10% ifconfig gw up iptables -t filter -A OUTPUT -p tcp --dport 8888 -j REJECT --reject-with icmp-port-unreachable ======================================================= And then excute the shell(curl any address of eth0 can reach): for((i=1;i<=100000;i++)) do ip netns exec net1 curl x.x.x.x:8888 done ======================================================= Bug: 289225588 Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Signed-off-by: "t.feng" Suggested-by: Florian Westphal Reviewed-by: Paolo Abeni Signed-off-by: David S. Miller Signed-off-by: Sasha Levin (cherry picked from commit 610a433810b277b3b77389733c07d22e8af68de2) Signed-off-by: Lee Jones Change-Id: I08a12f6e3b1614210867cd23e9071918dc380faf --- drivers/net/ipvlan/ipvlan_core.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c index a33149ee0ddc..0a5b5ff597c6 100644 --- a/drivers/net/ipvlan/ipvlan_core.c +++ b/drivers/net/ipvlan/ipvlan_core.c @@ -437,6 +437,9 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb) goto err; } skb_dst_set(skb, &rt->dst); + + memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + err = ip_local_out(net, skb->sk, skb); if (unlikely(net_xmit_eval(err))) dev->stats.tx_errors++; @@ -475,6 +478,9 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb) goto err; } skb_dst_set(skb, dst); + + memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); + err = ip6_local_out(net, skb->sk, skb); if (unlikely(net_xmit_eval(err))) dev->stats.tx_errors++; From 6a975c2771cc214e71ae25e3ba392a5836bd3a9f Mon Sep 17 00:00:00 2001 From: Hangyu Hua Date: Wed, 31 May 2023 18:28:04 +0800 Subject: [PATCH 27/41] UPSTREAM: net/sched: flower: fix possible OOB write in fl_set_geneve_opt() [ Upstream commit 4d56304e5827c8cc8cc18c75343d283af7c4825c ] If we send two TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets and their total size is 252 bytes(key->enc_opts.len = 252) then key->enc_opts.len = opt->length = data_len / 4 = 0 when the third TCA_FLOWER_KEY_ENC_OPTS_GENEVE packet enters fl_set_geneve_opt. This bypasses the next bounds check and results in an out-of-bounds. Bug: 288660424 Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options") Signed-off-by: Hangyu Hua Reviewed-by: Simon Horman Reviewed-by: Pieter Jansen van Vuuren Link: https://lore.kernel.org/r/20230531102805.27090-1-hbh25y@gmail.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin (cherry picked from commit 45f47d2cf1142fbfe5d6fc39ad78f4aac058907c) Signed-off-by: Lee Jones Change-Id: I53c534b7d43f4c7da5a9f63556c79d35797aa598 --- net/sched/cls_flower.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c index 35ee6d8226e6..caf1a05bfbde 100644 --- a/net/sched/cls_flower.c +++ b/net/sched/cls_flower.c @@ -1086,6 +1086,9 @@ static int fl_set_geneve_opt(const struct nlattr *nla, struct fl_flow_key *key, if (option_len > sizeof(struct geneve_opt)) data_len = option_len - sizeof(struct geneve_opt); + if (key->enc_opts.len > FLOW_DIS_TUN_OPTS_MAX - 4) + return -ERANGE; + opt = (struct geneve_opt *)&key->enc_opts.data[key->enc_opts.len]; memset(opt, 0xff, option_len); opt->length = data_len / 4; From be9bc79296726ed38eee93f314419fe1bf1c0411 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Fri, 16 Jun 2023 21:12:06 -0600 Subject: [PATCH 28/41] UPSTREAM: io_uring: hold uring mutex around poll removal Snipped from commit 9ca9fb24d5febccea354089c41f96a8ad0d853f8 upstream. While reworking the poll hashing in the v6.0 kernel, we ended up grabbing the ctx->uring_lock in poll update/removal. This also fixed a bug with linked timeouts racing with timeout expiry and poll removal. Bring back just the locking fix for that. Bug: 289229683 Reported-and-tested-by: Querijn Voet Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 0e388fce7aec40992eadee654193cad345d62663) Signed-off-by: Lee Jones Change-Id: Ife3683f26b19af1887ae1c59d3bd8b4e1700c79a --- io_uring/io_uring.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 5325e915a5d7..419a64990906 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -5976,6 +5976,8 @@ static int io_poll_update(struct io_kiocb *req, unsigned int issue_flags) struct io_kiocb *preq; int ret2, ret = 0; + io_ring_submit_lock(ctx, !(issue_flags & IO_URING_F_NONBLOCK)); + spin_lock(&ctx->completion_lock); preq = io_poll_find(ctx, req->poll_update.old_user_data, true); if (!preq || !io_poll_disarm(preq)) { @@ -6007,6 +6009,7 @@ out: req_set_fail(req); /* complete update request, we're done with it */ io_req_complete(req, ret); + io_ring_submit_unlock(ctx, !(issue_flags & IO_URING_F_NONBLOCK)); return 0; } From 5db82d830f2bc40da8fe3e0948a0d1e4b62a637c Mon Sep 17 00:00:00 2001 From: Zhang Zhengming Date: Wed, 19 Apr 2023 12:02:03 +0800 Subject: [PATCH 29/41] UPSTREAM: relayfs: fix out-of-bounds access in relay_file_read commit 43ec16f1450f4936025a9bdf1a273affdb9732c1 upstream. There is a crash in relay_file_read, as the var from point to the end of last subbuf. The oops looks something like: pc : __arch_copy_to_user+0x180/0x310 lr : relay_file_read+0x20c/0x2c8 Call trace: __arch_copy_to_user+0x180/0x310 full_proxy_read+0x68/0x98 vfs_read+0xb0/0x1d0 ksys_read+0x6c/0xf0 __arm64_sys_read+0x20/0x28 el0_svc_common.constprop.3+0x84/0x108 do_el0_svc+0x74/0x90 el0_svc+0x1c/0x28 el0_sync_handler+0x88/0xb0 el0_sync+0x148/0x180 We get the condition by analyzing the vmcore: 1). The last produced byte and last consumed byte both at the end of the last subbuf 2). A softirq calls function(e.g __blk_add_trace) to write relay buffer occurs when an program is calling relay_file_read_avail(). relay_file_read relay_file_read_avail relay_file_read_consume(buf, 0, 0); //interrupted by softirq who will write subbuf .... return 1; //read_start point to the end of the last subbuf read_start = relay_file_read_start_pos //avail is equal to subsize avail = relay_file_read_subbuf_avail //from points to an invalid memory address from = buf->start + read_start //system is crashed copy_to_user(buffer, from, avail) Bug: 288957094 Link: https://lkml.kernel.org/r/20230419040203.37676-1-zhang.zhengming@h3c.com Fixes: 8d62fdebdaf9 ("relay file read: start-pos fix") Signed-off-by: Zhang Zhengming Reviewed-by: Zhao Lei Reviewed-by: Zhou Kete Reviewed-by: Pengcheng Yang Cc: Jens Axboe Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman (cherry picked from commit f6ee841ff2169d7a7d045340ee72b2b9de9f06c5) Signed-off-by: Lee Jones Change-Id: Ibbdf65d8bf2268c3e8c09520f595167a2ed41e8b --- kernel/relay.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/relay.c b/kernel/relay.c index 067769b80d4a..f6826dec2103 100644 --- a/kernel/relay.c +++ b/kernel/relay.c @@ -1077,7 +1077,8 @@ static size_t relay_file_read_start_pos(struct rchan_buf *buf) size_t subbuf_size = buf->chan->subbuf_size; size_t n_subbufs = buf->chan->n_subbufs; size_t consumed = buf->subbufs_consumed % n_subbufs; - size_t read_pos = consumed * subbuf_size + buf->bytes_consumed; + size_t read_pos = (consumed * subbuf_size + buf->bytes_consumed) + % (n_subbufs * subbuf_size); read_subbuf = read_pos / subbuf_size; padding = buf->padding[read_subbuf]; From 739f5722f44709628f2a8d9627a135779d679e77 Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Wed, 14 Jun 2023 17:38:54 +0100 Subject: [PATCH 30/41] UPSTREAM: x86/mm: Avoid using set_pgd() outside of real PGD pages commit d082d48737c75d2b3cc1f972b8c8674c25131534 upstream. KPTI keeps around two PGDs: one for userspace and another for the kernel. Among other things, set_pgd() contains infrastructure to ensure that updates to the kernel PGD are reflected in the user PGD as well. One side-effect of this is that set_pgd() expects to be passed whole pages. Unfortunately, init_trampoline_kaslr() passes in a single entry: 'trampoline_pgd_entry'. When KPTI is on, set_pgd() will update 'trampoline_pgd_entry' (an 8-Byte globally stored [.bss] variable) and will then proceed to replicate that value into the non-existent neighboring user page (located +4k away), leading to the corruption of other global [.bss] stored variables. Fix it by directly assigning 'trampoline_pgd_entry' and avoiding set_pgd(). [ dhansen: tweak subject and changelog ] Bug: 274115504 Fixes: 0925dda5962e ("x86/mm/KASLR: Use only one PUD entry for real mode trampoline") Suggested-by: Dave Hansen Signed-off-by: Lee Jones Signed-off-by: Dave Hansen Cc: Link: https://lore.kernel.org/all/20230614163859.924309-1-lee@kernel.org/g Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 364fdcbb035bb910e58a2814708de72481256466) Signed-off-by: Lee Jones Change-Id: Idc1fc494d7ccb4a8a3765e1f46482583b528a584 --- arch/x86/mm/kaslr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c index 6e6b39710e5f..a8cdbbe67bb5 100644 --- a/arch/x86/mm/kaslr.c +++ b/arch/x86/mm/kaslr.c @@ -172,10 +172,10 @@ void __meminit init_trampoline_kaslr(void) set_p4d(p4d_tramp, __p4d(_KERNPG_TABLE | __pa(pud_page_tramp))); - set_pgd(&trampoline_pgd_entry, - __pgd(_KERNPG_TABLE | __pa(p4d_page_tramp))); + trampoline_pgd_entry = + __pgd(_KERNPG_TABLE | __pa(p4d_page_tramp)); } else { - set_pgd(&trampoline_pgd_entry, - __pgd(_KERNPG_TABLE | __pa(pud_page_tramp))); + trampoline_pgd_entry = + __pgd(_KERNPG_TABLE | __pa(pud_page_tramp)); } } From 158d8bfffcd3c398e76eee11f5a68de8eaffcee7 Mon Sep 17 00:00:00 2001 From: Zheng Wang Date: Mon, 13 Mar 2023 16:42:20 +0000 Subject: [PATCH 31/41] UPSTREAM: media: rkvdec: fix use after free bug in rkvdec_remove [ Upstream commit 3228cec23b8b29215e18090c6ba635840190993d ] In rkvdec_probe, rkvdec->watchdog_work is bound with rkvdec_watchdog_func. Then rkvdec_vp9_run may be called to start the work. If we remove the module which will call rkvdec_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug. Fix it by canceling the work before cleanup in rkvdec_remove. CPU0 CPU1 |rkvdec_watchdog_func rkvdec_remove | rkvdec_v4l2_cleanup| v4l2_m2m_release | kfree(m2m_dev); | | | v4l2_m2m_get_curr_priv | m2m_dev->curr_ctx //use Bug: 289003637 Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver") Signed-off-by: Zheng Wang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin (cherry picked from commit 6a17add9c61030683b9c1fc86878f00a2d318a95) Signed-off-by: Lee Jones Change-Id: Ibdf4667315d98ac1cd42545f61e271c291893edd --- drivers/staging/media/rkvdec/rkvdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c index e384ea8d7280..f6a29a707862 100644 --- a/drivers/staging/media/rkvdec/rkvdec.c +++ b/drivers/staging/media/rkvdec/rkvdec.c @@ -1077,6 +1077,8 @@ static int rkvdec_remove(struct platform_device *pdev) { struct rkvdec_dev *rkvdec = platform_get_drvdata(pdev); + cancel_delayed_work_sync(&rkvdec->watchdog_work); + rkvdec_v4l2_cleanup(rkvdec); pm_runtime_disable(&pdev->dev); pm_runtime_dont_use_autosuspend(&pdev->dev); From 505b4a192915e388bb2f1659672bca58af6086e3 Mon Sep 17 00:00:00 2001 From: Zheng Wang Date: Mon, 20 Mar 2023 14:29:31 +0800 Subject: [PATCH 32/41] UPSTREAM: usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition [ Upstream commit 2b947f8769be8b8181dc795fd292d3e7120f5204 ] In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work. renesas_usb3_start will be called to start the work. If we remove the driver which will call usbhs_remove, there may be an unfinished work. The possible sequence is as follows: CPU0 CPU1 renesas_usb3_role_work renesas_usb3_remove usb_role_switch_unregister device_unregister kfree(sw) //free usb3->role_sw usb_role_switch_set_role //use usb3->role_sw The usb3->role_sw could be freed under such circumstance and then used in usb_role_switch_set_role. This bug was found by static analysis. And note that removing a driver is a root-only operation, and should never happen in normal case. But the root user may directly remove the device which will also trigger the remove function. Fix it by canceling the work before cleanup in the renesas_usb3_remove. Bug: 289003615 Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") Signed-off-by: Zheng Wang Reviewed-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin (cherry picked from commit df2380520926bdbc264cffab0f45da9a21f304c8) Signed-off-by: Lee Jones Change-Id: I79a1dbeba9a90ee5daf94648ef6a32207b283561 --- drivers/usb/gadget/udc/renesas_usb3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c index 601829a6b4ba..a10f41c4a3f2 100644 --- a/drivers/usb/gadget/udc/renesas_usb3.c +++ b/drivers/usb/gadget/udc/renesas_usb3.c @@ -2568,6 +2568,7 @@ static int renesas_usb3_remove(struct platform_device *pdev) debugfs_remove_recursive(usb3->dentry); device_remove_file(&pdev->dev, &dev_attr_role); + cancel_work_sync(&usb3->role_work); usb_role_switch_unregister(usb3->role_sw); usb_del_gadget_udc(&usb3->gadget); From b52f2d4395e57b469ffcf6dd4ccea2ebe134a469 Mon Sep 17 00:00:00 2001 From: Krishna Kurapati Date: Sun, 18 Jun 2023 17:39:49 +0530 Subject: [PATCH 33/41] UPSTREAM: usb: dwc3: gadget: Propagate core init errors to UDC during pullup In scenarios where pullup relies on resume (get sync) to initialize the controller and set the run stop bit, then core_init is followed by gadget_resume which will eventually set run stop bit. But in cases where the core_init fails, the return value is not sent back to udc appropriately. So according to UDC the controller has started but in reality we never set the run stop bit. On systems like Android, there are uevents sent to HAL depending on whether the configfs_bind / configfs_disconnect were invoked. In the above mentioned scnenario, if the core init fails, the run stop won't be set and the cable plug-out won't result in generation of any disconnect event and userspace would never get any uevent regarding cable plug out and we never call pullup(0) again. Furthermore none of the next Plug-In/Plug-Out's would be known to configfs. Return back the appropriate result to UDC to let the userspace/ configfs know that the pullup failed so they can take appropriate action. Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded") Cc: stable Change-Id: Ieb281722cdc4fa2ff15545d9edaabdc8c2d70223 Signed-off-by: Krishna Kurapati Acked-by: Thinh Nguyen Message-ID: <20230618120949.14868-1-quic_kriskura@quicinc.com> Signed-off-by: Greg Kroah-Hartman (cherry picked from commit c0aabed9cabe057309779a9e26fe86a113d24dad https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master) Bug: 289984280 Change-Id: I633b2c325dd954a3e4cdd636052158a90fd976a3 Signed-off-by: Krishna Kurapati --- drivers/usb/dwc3/gadget.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 35fd2c4fa82f..73e869ac1066 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2585,7 +2585,9 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) ret = pm_runtime_get_sync(dwc->dev); if (!ret || ret < 0) { pm_runtime_put(dwc->dev); - return 0; + if (ret < 0) + pm_runtime_set_suspended(dwc->dev); + return ret; } if (dwc->pullups_connected == is_on) { From de4dc1c15c722079f3854dab4a6d467170f94225 Mon Sep 17 00:00:00 2001 From: Dylan Chang Date: Tue, 11 Jul 2023 11:56:27 +0800 Subject: [PATCH 34/41] ANDROID: GKI: Add symbol list for Nothing Add symbol list for Nothing at the first time 2 function symbol(s) added 'struct file_system_type* get_fs_type(const char*)' 'void iterate_supers_type(struct file_system_type*, void(*)(struct super_block*, void*), void*)' Bug: 290756100 Change-Id: I3cdf16cf21bf04df2c0ab10358e7e7dd4e82c2d1 Signed-off-by: Dylan Chang Signed-off-by: Giuliano Procida --- android/abi_gki_aarch64.xml | 119 ++++++++++++++++++++++++++++++-- android/abi_gki_aarch64_nothing | 4 ++ build.config.gki.aarch64 | 1 + 3 files changed, 119 insertions(+), 5 deletions(-) create mode 100644 android/abi_gki_aarch64_nothing diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 7656ab64512c..de2a2412ca6d 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -2798,6 +2798,7 @@ + @@ -3300,6 +3301,7 @@ + @@ -15444,6 +15446,89 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -33955,6 +34040,7 @@ + @@ -58997,6 +59083,11 @@ + + + + + @@ -68594,7 +68685,14 @@ - + + + + + + + + @@ -93905,6 +94003,7 @@ + @@ -130962,10 +131061,10 @@ - - - - + + + + @@ -132456,6 +132555,10 @@ + + + + @@ -135021,6 +135124,12 @@ + + + + + + diff --git a/android/abi_gki_aarch64_nothing b/android/abi_gki_aarch64_nothing new file mode 100644 index 000000000000..5960f2b3c287 --- /dev/null +++ b/android/abi_gki_aarch64_nothing @@ -0,0 +1,4 @@ +[abi_symbol_list] +# required by mount_state.ko + iterate_supers_type + get_fs_type \ No newline at end of file diff --git a/build.config.gki.aarch64 b/build.config.gki.aarch64 index 738ddee4af33..b0971e2a0c4f 100644 --- a/build.config.gki.aarch64 +++ b/build.config.gki.aarch64 @@ -23,6 +23,7 @@ android/abi_gki_aarch64_honor android/abi_gki_aarch64_imx android/abi_gki_aarch64_lenovo android/abi_gki_aarch64_mtk +android/abi_gki_aarch64_nothing android/abi_gki_aarch64_oplus android/abi_gki_aarch64_qcom android/abi_gki_aarch64_rockchip From bff06d6020dea5a813cfe740c98706aa8ea244af Mon Sep 17 00:00:00 2001 From: Liujie Xie Date: Wed, 12 Jul 2023 15:40:52 +0800 Subject: [PATCH 35/41] ANDROID: vendor_hooks: Supplement the missing hook call point. As a supplement to commit eed2741ae61d ("ANDROID: vendor_hook: add hooks to protect locking-tsk in cpu scheduler"). In rwsem read, we missed a lock-holding scenario, add it now. Bug: 290868674 Change-Id: I718dd942b24b330a79283fc241dcbf47cc34c0c5 Signed-off-by: Liujie Xie --- kernel/locking/rwsem.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c index 057c9e99251a..acd1fc78d059 100644 --- a/kernel/locking/rwsem.c +++ b/kernel/locking/rwsem.c @@ -1066,6 +1066,8 @@ queue: raw_spin_unlock_irq(&sem->wait_lock); rwsem_set_reader_owned(sem); lockevent_inc(rwsem_rlock_fast); + trace_android_vh_record_rwsem_lock_starttime( + current, jiffies); return sem; } adjustment += RWSEM_FLAG_WAITERS; From 4def2dd1807f802810d8c16e13d81a8c5e5c4e55 Mon Sep 17 00:00:00 2001 From: Kyongho Cho Date: Thu, 13 Jul 2023 12:39:53 -0700 Subject: [PATCH 36/41] ANDROID: ABI: update symbol list for Xclipse GPU Leaf changes summary: 1 artifact changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 1 Added function: [A] 'function void ttm_tt_unpopulate(ttm_bo_device*, ttm_tt*)' Xclipse GPU driver depends on TTM for graphics buffer allocation and management. It is required by customers to add graphics memory swap to improve overall memory efficiency. However TTM's swap feature can't be used since it selects victim buffer by LRU and we can't choose a specific buffer to swap. Xclipse GPU driver implements its own swap feature by means of APIs of TTM. But the problem is TTM's buffer allocations statistics in ttm_tt.c which are local to that file. Whenever a graphic buffer is swapped out, the size of total page allocation should be decreased but it is not possible from the outside of ttm_tt.c. If the statistics is not maintained well, TTM ends up swapping out TTM buffers globally which is unexpected. Bug: 291100620 Change-Id: I0edc4b5e8ae6d9e41e99750eb5f0e62fa78ec1fb Signed-off-by: Kyongho Cho --- android/abi_gki_aarch64.xml | 164 ++++++++++----------------------- android/abi_gki_aarch64_exynos | 1 + drivers/gpu/drm/ttm/ttm_tt.c | 1 + 3 files changed, 52 insertions(+), 114 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index de2a2412ca6d..a35c3777c1d0 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -5613,6 +5613,7 @@ + @@ -7303,6 +7304,14 @@ + + + + + + + + @@ -9500,9 +9509,9 @@ - - - + + + @@ -15446,89 +15455,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -24624,6 +24550,9 @@ + + + @@ -40110,8 +40039,8 @@ - - + + @@ -68685,14 +68614,7 @@ - - - - - - - - + @@ -71699,7 +71621,17 @@ - + + + + + + + + + + + @@ -94003,7 +93935,6 @@ - @@ -128282,16 +128213,16 @@ - - + + - - + + - - + + @@ -128303,16 +128234,16 @@ - - + + - - + + - - + + @@ -147002,6 +146933,11 @@ + + + + + @@ -147826,12 +147762,12 @@ - - + + - - + + diff --git a/android/abi_gki_aarch64_exynos b/android/abi_gki_aarch64_exynos index c64082bb95b0..ef69e40b6754 100644 --- a/android/abi_gki_aarch64_exynos +++ b/android/abi_gki_aarch64_exynos @@ -2136,6 +2136,7 @@ ttm_tt_destroy_common ttm_tt_populate ttm_tt_set_placement_caching + ttm_tt_unpopulate ttm_unmap_and_unpopulate_pages tty_flip_buffer_push tty_insert_flip_string_fixed_flag diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c index f43fa69a1e65..3f1a029248ce 100644 --- a/drivers/gpu/drm/ttm/ttm_tt.c +++ b/drivers/gpu/drm/ttm/ttm_tt.c @@ -466,3 +466,4 @@ void ttm_tt_unpopulate(struct ttm_bo_device *bdev, else ttm_pool_unpopulate(ttm); } +EXPORT_SYMBOL(ttm_tt_unpopulate); From f48a4c3b296eb7cf187021f0bb6b9150c5aa74c7 Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Tue, 11 Jul 2023 17:20:13 +0000 Subject: [PATCH 37/41] ANDROID: Incremental fs: Allocate data buffer based on input request size Presently the data buffer used to return the per-UID timeout description is created based on information provided by the user. It is expected that the user populates a variable called 'timeouts_array_size' which is heavily scrutinised to ensure the value provided is appropriate i.e. smaller than the largest possible value but large enough to contain all of the data we wish to pass back. The issue is that the aforementioned scrutiny is imposed on a different variable to the one expected. Contrary to expectation, the data buffer is actually being allocated to the size specified in a variable named 'timeouts_array_size_out'. A variable originally designed to only contain the output information i.e. the size of the data actually copied to the user for consumption. This value is also user provided and is not given the same level of scrutiny as the former. The fix in this case is simple. Ignore 'timeouts_array_size_out' until it is time to populate (over-write) it ourselves and use 'timeouts_array_size' to shape the buffer as intended. Bug: 281547360 Change-Id: I95e12879a33a2355f9e4bc0ce2bfc3f229141aa8 Signed-off-by: Lee Jones (cherry picked from commit 5a4d20a3eb4e651f88ed2f1f08cee066639ca801) --- fs/incfs/pseudo_files.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/incfs/pseudo_files.c b/fs/incfs/pseudo_files.c index 1b9bf000f598..d43ccb2ce3b0 100644 --- a/fs/incfs/pseudo_files.c +++ b/fs/incfs/pseudo_files.c @@ -916,10 +916,10 @@ static long ioctl_get_read_timeouts(struct mount_info *mi, void __user *arg) if (copy_from_user(&args, args_usr_ptr, sizeof(args))) return -EINVAL; - if (args.timeouts_array_size_out > INCFS_DATA_FILE_BLOCK_SIZE) + if (args.timeouts_array_size > INCFS_DATA_FILE_BLOCK_SIZE) return -EINVAL; - buffer = kzalloc(args.timeouts_array_size_out, GFP_NOFS); + buffer = kzalloc(args.timeouts_array_size, GFP_NOFS); if (!buffer) return -ENOMEM; From adad2dab31999467601f753a90a4290f344fee79 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 25 Apr 2023 09:46:18 +0200 Subject: [PATCH 38/41] UPSTREAM: Revert "Fix XFRM-I support for nested ESP tunnels" [ Upstream commit 5fc46f94219d1d103ffb5f0832be9da674d85a73 ] This reverts commit b0355dbbf13c0052931dd14c38c789efed64d3de. The reverted commit clears the secpath on packets received via xfrm interfaces to support nested IPsec tunnels. This breaks Netfilter policy matching using xt_policy in the FORWARD chain, as the secpath is missing during forwarding. Additionally, Benedict Wong reports that it breaks Transport-in-Tunnel mode. Fix this regression by reverting the commit until we have a better approach for nested IPsec tunnels. Fixes: b0355dbbf13c ("Fix XFRM-I support for nested ESP tunnels") Link: https://lore.kernel.org/netdev/20230412085615.124791-1-martin@strongswan.org/ Signed-off-by: Martin Willi Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Bug: 288489934 (cherry picked from commit c5449195f86ec02433a9ef8abe01be11d228fca1) Change-Id: Iefaed6d21a641fefb02e0fd0067086a9ae3a802a Signed-off-by: Carlos Llamas --- net/xfrm/xfrm_interface.c | 54 +++------------------------------------ net/xfrm/xfrm_policy.c | 3 --- 2 files changed, 4 insertions(+), 53 deletions(-) diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c index e4f21a692415..da518b4ca84c 100644 --- a/net/xfrm/xfrm_interface.c +++ b/net/xfrm/xfrm_interface.c @@ -207,52 +207,6 @@ static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet) skb->mark = 0; } -static int xfrmi_input(struct sk_buff *skb, int nexthdr, __be32 spi, - int encap_type, unsigned short family) -{ - struct sec_path *sp; - - sp = skb_sec_path(skb); - if (sp && (sp->len || sp->olen) && - !xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family)) - goto discard; - - XFRM_SPI_SKB_CB(skb)->family = family; - if (family == AF_INET) { - XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); - XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; - } else { - XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr); - XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL; - } - - return xfrm_input(skb, nexthdr, spi, encap_type); -discard: - kfree_skb(skb); - return 0; -} - -static int xfrmi4_rcv(struct sk_buff *skb) -{ - return xfrmi_input(skb, ip_hdr(skb)->protocol, 0, 0, AF_INET); -} - -static int xfrmi6_rcv(struct sk_buff *skb) -{ - return xfrmi_input(skb, skb_network_header(skb)[IP6CB(skb)->nhoff], - 0, 0, AF_INET6); -} - -static int xfrmi4_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) -{ - return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET); -} - -static int xfrmi6_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) -{ - return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET6); -} - static int xfrmi_rcv_cb(struct sk_buff *skb, int err) { const struct xfrm_mode *inner_mode; @@ -826,8 +780,8 @@ static struct pernet_operations xfrmi_net_ops = { }; static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = { - .handler = xfrmi6_rcv, - .input_handler = xfrmi6_input, + .handler = xfrm6_rcv, + .input_handler = xfrm_input, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi6_err, .priority = 10, @@ -877,8 +831,8 @@ static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = { #endif static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = { - .handler = xfrmi4_rcv, - .input_handler = xfrmi4_input, + .handler = xfrm4_rcv, + .input_handler = xfrm_input, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi4_err, .priority = 10, diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index c1aaf71d7ccb..7b9d21d85d48 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -3698,9 +3698,6 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, goto reject; } - if (if_id) - secpath_reset(skb); - xfrm_pols_put(pols, npols); return 1; } From 28f1c8e015511c60a5b4ae888773a8b1ed946a87 Mon Sep 17 00:00:00 2001 From: shenjiangjiang Date: Wed, 5 Jul 2023 17:50:26 +0800 Subject: [PATCH 39/41] ANDROID: vendor_hook: Add hook to abort reclaim and compaction We need to abort the reclaim/compaction by sending signal(such as SIGUSR2) to the reclaim thread, or just abort when cpu-usage is too-high or free-mem is enough. Bug: 289987875 Change-Id: I4b637cbd2b37235eec27a985a9b5b95598247c59 Signed-off-by: shenjiangjiang (cherry picked from commit 024628cc9203cbd4f8471d98435b3a3d6f85764d) --- drivers/android/vendor_hooks.c | 2 ++ include/trace/hooks/mm.h | 6 ++++++ mm/compaction.c | 9 ++++++++- mm/madvise.c | 4 +++- 4 files changed, 19 insertions(+), 2 deletions(-) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index ae35b2a9ec8b..81334ada8a61 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -488,6 +488,8 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_look_around_migrate_page); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_test_clear_look_around_ref); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_dma_buf_stats_teardown); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_madvise_cold_or_pageout_abort); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_compact_finished); /* * For type visibility */ diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index 7a1d74f646cb..480880a49d32 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -338,6 +338,12 @@ DECLARE_HOOK(android_vh_look_around, TP_PROTO(struct page_vma_mapped_walk *pvmw, struct page *page, struct vm_area_struct *vma, int *referenced), TP_ARGS(pvmw, page, vma, referenced)); +DECLARE_HOOK(android_vh_compact_finished, + TP_PROTO(bool *abort_compact), + TP_ARGS(abort_compact)); +DECLARE_HOOK(android_vh_madvise_cold_or_pageout_abort, + TP_PROTO(struct vm_area_struct *vma, bool *abort_madvise), + TP_ARGS(vma, abort_madvise)); /* macro versions of hooks are no longer required */ #endif /* _TRACE_HOOK_MM_H */ diff --git a/mm/compaction.c b/mm/compaction.c index eca4d0ea74c1..dc96fadb04da 100644 --- a/mm/compaction.c +++ b/mm/compaction.c @@ -45,6 +45,11 @@ static inline void count_compact_events(enum vm_event_item item, long delta) #define CREATE_TRACE_POINTS #include +#undef CREATE_TRACE_POINTS +#ifndef __GENKSYMS__ +#include +#endif + #define block_start_pfn(pfn, order) round_down(pfn, 1UL << (order)) #define block_end_pfn(pfn, order) ALIGN((pfn) + 1, 1UL << (order)) #define pageblock_start_pfn(pfn) block_start_pfn(pfn, pageblock_order) @@ -1984,6 +1989,7 @@ static enum compact_result __compact_finished(struct compact_control *cc) unsigned int order; const int migratetype = cc->migratetype; int ret; + bool abort_compact = false; /* Compaction run completes if the migrate and free scanner meet */ if (compact_scanners_met(cc)) { @@ -2083,7 +2089,8 @@ static enum compact_result __compact_finished(struct compact_control *cc) } out: - if (cc->contended || fatal_signal_pending(current)) + trace_android_vh_compact_finished(&abort_compact); + if (cc->contended || fatal_signal_pending(current) || abort_compact) ret = COMPACT_CONTENDED; return ret; diff --git a/mm/madvise.c b/mm/madvise.c index b3761ca637bb..d16fa1d8f60f 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -322,8 +322,10 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd, struct page *page = NULL; LIST_HEAD(page_list); bool allow_shared = false; + bool abort_madvise = false; - if (fatal_signal_pending(current)) + trace_android_vh_madvise_cold_or_pageout_abort(vma, &abort_madvise); + if (fatal_signal_pending(current) || abort_madvise) return -EINTR; trace_android_vh_madvise_cold_or_pageout(vma, &allow_shared); From 1dc57723228ef10764dd13b6da8651e6f1f67d3b Mon Sep 17 00:00:00 2001 From: shenjiangjiang Date: Mon, 17 Jul 2023 11:46:56 +0800 Subject: [PATCH 40/41] ANDROID: GKI: Update symbols to symbol list Leaf changes summary: 4 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 2 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 2 Added variables 2 Added functions: [A] 'function int __traceiter_android_vh_compact_finished(void*, bool*)' [A] 'function int __traceiter_android_vh_madvise_cold_or_pageout_abort(void*, vm_area_struct*, bool*)' 2 Added variables: [A] 'tracepoint __tracepoint_android_vh_compact_finished' [A] 'tracepoint __tracepoint_android_vh_madvise_cold_or_pageout_abort' Bug: 288216516 Change-Id: I182b925aec69655ad6c17e5452d387c158e563ef Signed-off-by: shenjiangjiang --- android/abi_gki_aarch64.xml | 138 +++++++++++++++++----------------- android/abi_gki_aarch64_oplus | 4 + 2 files changed, 73 insertions(+), 69 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index a35c3777c1d0..af1caade63e1 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -471,6 +471,7 @@ + @@ -554,6 +555,7 @@ + @@ -6541,6 +6543,7 @@ + @@ -6624,6 +6627,7 @@ + @@ -8754,14 +8758,6 @@ - - - - - - - - @@ -44660,7 +44656,23 @@ - + + + + + + + + + + + + + + + + + @@ -49000,6 +49012,7 @@ + @@ -53957,6 +53970,13 @@ + + + + + + + @@ -65106,26 +65126,7 @@ - - - - - - - - - - - - - - - - - - - - + @@ -66622,6 +66623,13 @@ + + + + + + + @@ -91423,6 +91431,7 @@ + @@ -103190,6 +103199,12 @@ + + + + + + @@ -106596,29 +106611,7 @@ - - - - - - - - - - - - - - - - - - - - - - - + @@ -109544,13 +109537,6 @@ - - - - - - - @@ -111436,6 +111422,7 @@ + @@ -116509,20 +116496,20 @@ - + - + - - + + - - - + + + @@ -119371,6 +119358,11 @@ + + + + + @@ -119906,6 +119898,12 @@ + + + + + + @@ -121454,6 +121452,7 @@ + @@ -121537,6 +121536,7 @@ + @@ -135031,9 +135031,9 @@ - - - + + + diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus index 20d15056b373..51738dc7cd4d 100644 --- a/android/abi_gki_aarch64_oplus +++ b/android/abi_gki_aarch64_oplus @@ -2794,6 +2794,7 @@ __traceiter_android_vh_clear_mask_adjust __traceiter_android_vh_clear_reserved_fmt_fields __traceiter_android_vh_cma_drain_all_pages_bypass + __traceiter_android_vh_compact_finished __traceiter_android_vh_alloc_pages_reclaim_bypass __traceiter_android_vh_free_unref_page_bypass __traceiter_android_vh_kvmalloc_node_use_vmalloc @@ -2851,6 +2852,7 @@ __traceiter_android_vh_logbuf __traceiter_android_vh_look_around __traceiter_android_vh_look_around_migrate_page + __traceiter_android_vh_madvise_cold_or_pageout_abort __traceiter_android_vh_mark_page_accessed __traceiter_android_vh_mem_cgroup_alloc __traceiter_android_vh_mem_cgroup_css_offline @@ -3059,6 +3061,7 @@ __tracepoint_android_vh_clear_mask_adjust __tracepoint_android_vh_clear_reserved_fmt_fields __tracepoint_android_vh_cma_drain_all_pages_bypass + __tracepoint_android_vh_compact_finished __tracepoint_android_vh_alloc_pages_reclaim_bypass __tracepoint_android_vh_free_unref_page_bypass __tracepoint_android_vh_kvmalloc_node_use_vmalloc @@ -3116,6 +3119,7 @@ __tracepoint_android_vh_logbuf __tracepoint_android_vh_look_around __tracepoint_android_vh_look_around_migrate_page + __tracepoint_android_vh_madvise_cold_or_pageout_abort __tracepoint_android_vh_mark_page_accessed __tracepoint_android_vh_mem_cgroup_alloc __tracepoint_android_vh_mem_cgroup_css_offline From b4b7d228301ff12eeef059f28d20b19ebd7c29b4 Mon Sep 17 00:00:00 2001 From: Vatsal Parasrampuria Date: Wed, 19 Jul 2023 20:04:28 +0000 Subject: [PATCH 41/41] ANDROID: wakeupbypass: Add vendor hook for batteryswap Implemented a hook to check if battery swap is enabled in alarm timer suspend routine. During a battery swap, it is crucial to ensure that the device remains in a suspended state, relying on a limited backup power source. It is essential to prevent any unintended awakenings in this state, as they could potentially lead to sudden surges in the power consumption, ultimately resulting in a device shutdown. Hence, we disable alarmtimer IRQs when in batteryswap mode. Bug: 290881352 Change-Id: I31dc30d9a3168bb1356cccba49f0a70fd6b73782 Signed-off-by: Vatsal Parasrampuria --- drivers/android/vendor_hooks.c | 2 ++ drivers/input/keyboard/gpio_keys.c | 18 ++++++++++++++---- include/trace/hooks/wakeupbypass.h | 17 +++++++++++++++++ kernel/time/alarmtimer.c | 7 +++++++ 4 files changed, 40 insertions(+), 4 deletions(-) create mode 100644 include/trace/hooks/wakeupbypass.h diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 81334ada8a61..815c5efb5c22 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -76,6 +76,7 @@ #include #include #include +#include /* * Export tracepoints that act as a bare tracehook (ie: have no trace event @@ -490,6 +491,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_test_clear_look_around_ref); EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_dma_buf_stats_teardown); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_madvise_cold_or_pageout_abort); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_compact_finished); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_wakeup_bypass); /* * For type visibility */ diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c index f2d4e4daa818..725a196662af 100644 --- a/drivers/input/keyboard/gpio_keys.c +++ b/drivers/input/keyboard/gpio_keys.c @@ -28,6 +28,7 @@ #include #include #include +#include struct gpio_button_data { const struct gpio_keys_button *button; @@ -958,11 +959,16 @@ static int __maybe_unused gpio_keys_suspend(struct device *dev) struct gpio_keys_drvdata *ddata = dev_get_drvdata(dev); struct input_dev *input = ddata->input; int error; + int wakeup_bypass_enabled = 0; + + trace_android_vh_wakeup_bypass(&wakeup_bypass_enabled); if (device_may_wakeup(dev)) { - error = gpio_keys_enable_wakeup(ddata); - if (error) - return error; + if (!wakeup_bypass_enabled) { + error = gpio_keys_enable_wakeup(ddata); + if (error) + return error; + } } else { mutex_lock(&input->mutex); if (input->users) @@ -978,9 +984,13 @@ static int __maybe_unused gpio_keys_resume(struct device *dev) struct gpio_keys_drvdata *ddata = dev_get_drvdata(dev); struct input_dev *input = ddata->input; int error = 0; + int wakeup_bypass_enabled = 0; + + trace_android_vh_wakeup_bypass(&wakeup_bypass_enabled); if (device_may_wakeup(dev)) { - gpio_keys_disable_wakeup(ddata); + if (!wakeup_bypass_enabled) + gpio_keys_disable_wakeup(ddata); } else { mutex_lock(&input->mutex); if (input->users) diff --git a/include/trace/hooks/wakeupbypass.h b/include/trace/hooks/wakeupbypass.h new file mode 100644 index 000000000000..a96c8874481e --- /dev/null +++ b/include/trace/hooks/wakeupbypass.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#undef TRACE_SYSTEM +#define TRACE_SYSTEM wakeupbypass + +#define TRACE_INCLUDE_PATH trace/hooks + +#if !defined(_TRACE_HOOK_WAKEUPBYPASS_H) || defined(TRACE_HEADER_MULTI_READ) +#define _TRACE_HOOK_WAKEUPBYPASS_H +#include + +DECLARE_HOOK(android_vh_wakeup_bypass, + TP_PROTO(int *is_wakeup_bypassed), + TP_ARGS(is_wakeup_bypassed)); + +#endif /* _TRACE_HOOK_WAKEUPBYPASS_H */ +/* This part must be outside protection */ +#include diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c index 1de426d3f694..3a20a9f9f7b5 100644 --- a/kernel/time/alarmtimer.c +++ b/kernel/time/alarmtimer.c @@ -33,6 +33,8 @@ #define CREATE_TRACE_POINTS #include +#undef CREATE_TRACE_POINTS +#include /** * struct alarm_base - Alarm timer bases * @lock: Lock for syncrhonized access to the base @@ -246,6 +248,7 @@ static int alarmtimer_suspend(struct device *dev) struct rtc_device *rtc; unsigned long flags; struct rtc_time tm; + int wakeup_bypass_enabled = 0; spin_lock_irqsave(&freezer_delta_lock, flags); min = freezer_delta; @@ -254,6 +257,10 @@ static int alarmtimer_suspend(struct device *dev) freezer_delta = 0; spin_unlock_irqrestore(&freezer_delta_lock, flags); + trace_android_vh_wakeup_bypass(&wakeup_bypass_enabled); + if (wakeup_bypass_enabled) + return 0; + rtc = alarmtimer_get_rtcdev(); /* If we have no rtcdev, just return */ if (!rtc)