Evolution-X-Devices/kernel_nothing_sm7325
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'android11-5.4' into branch 'android11-5.4-lts'

Browse Source 
Sync up with android11-5.4 for the following commits:

4338018da7 Merge tag 'android11-5.4.219_r00' into android11-5.4
a6768f02c5 UPSTREAM: mmc: hsq: Fix data stomping during mmc recovery
c08e708d2b UPSTREAM: pinctrl: sunxi: Fix name for A100 R_PIO
b45868d624 BACKPORT: mmc: core: Fix UHS-I SD 1.8V workaround branch
4f0ce36d86 UPSTREAM: Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
624ab3a0c0 UPSTREAM: wifi: mac80211_hwsim: set virtio device ready in probe()
de960e4e26 BACKPORT: f2fs: don't use casefolded comparison for "." and ".."
c219b2d3f5 UPSTREAM: Revert "mm/cma.c: remove redundant cma_mutex lock"
bcbaf126b8 UPSTREAM: usb: dwc3: Try usb-role-switch first in dwc3_drd_init
2117e7c78a BACKPORT: usb: typec: ucsi: Fix reuse of completion structure
ef283814b2 BACKPORT: tipc: fix incorrect order of state message data sanity check
c5f9da53b8 UPSTREAM: net: fix up skbs delta_truesize in UDP GRO frag_list
f644f48276 UPSTREAM: cgroup-v1: Correct privileges check in release_agent writes
cb59d054a9 UPSTREAM: mm: don't try to NUMA-migrate COW pages that have other uses
e4d47f2da1 UPSTREAM: usb: raw-gadget: fix handling of dual-direction-capable endpoints
2119237920 UPSTREAM: selinux: check return value of sel_make_avc_files
517330573a UPSTREAM: usb: musb: select GENERIC_PHY instead of depending on it
e233e13e47 BACKPORT: driver core: Fix error return code in really_probe()
fb4622ee74 UPSTREAM: fscrypt: fix derivation of SipHash keys on big endian CPUs
c8bc35f2f6 BACKPORT: fscrypt: rename FS_KEY_DERIVATION_NONCE_SIZE
0aad586104 UPSTREAM: socionext: account for napi_gro_receive never returning GRO_DROP
38f38545f7 UPSTREAM: net: socionext: netsec: fix xdp stats accounting
202bfe2b1f BACKPORT: fs: align IOCB_* flags with RWF_* flags
141f8d76b3 UPSTREAM: efi: capsule-loader: Fix use-after-free in efi_capsule_write
d4d1f95c4b BACKPORT: ARM: 9039/1: assembler: generalize byte swapping macro into rev_l
28066cfbc9 BACKPORT: ARM: 9035/1: uncompress: Add be32tocpu macro
cc190ff2f8 UPSTREAM: drm/meson: Fix overflow implicit truncation warnings
0d0c1b2686 UPSTREAM: irqchip/tegra: Fix overflow implicit truncation warnings
026441f593 UPSTREAM: video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write
482efd771f UPSTREAM: mm/mremap: hold the rmap lock in write mode when moving page table entries.
c262d21607 FROMLIST: binder: fix UAF of alloc->vma in race with munmap()
6d1487a4aa UPSTREAM: mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
4a5337dfb3 UPSTREAM: mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
e8453c3dec UPSTREAM: af_key: Do not call xfrm_probe_algs in parallel
40a8e0ed5c UPSTREAM: wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans()
f7fbd478a0 UPSTREAM: wifi: cfg80211/mac80211: reject bad MBSSID elements
569d099d40 UPSTREAM: wifi: cfg80211: ensure length byte is present before access
916a29b486 UPSTREAM: wifi: cfg80211: fix BSS refcounting bugs
a30ebebb22 UPSTREAM: wifi: cfg80211: avoid nontransmitted BSS list corruption
99f0812889 UPSTREAM: wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
df86d024f6 UPSTREAM: wifi: cfg80211: update hidden BSSes to avoid WARN_ON
fa35741b59 UPSTREAM: mac80211: mlme: find auth challenge directly
7633d41a83 UPSTREAM: wifi: mac80211: don't parse mbssid in assoc response
9f3b5ab822 UPSTREAM: wifi: mac80211: fix MBSSID parsing use-after-free
09cd270b42 ANDROID: Drop explicit 'CONFIG_INIT_STACK_ALL_ZERO=y' from gki_defconfig
0d4d3b41a5 UPSTREAM: hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
9267f98065 UPSTREAM: hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO
f086581010 UPSTREAM: hardening: Clarify Kconfig text for auto-var-init
07228609d8 ANDROID: GKI: Update FCNT KMI symbol list
b8dedbc2ab ANDROID: Fix kenelci build-break for !CONFIG_PERF_EVENTS
c1957fce68 BACKPORT: HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
7e0fbb9e25 ANDROID: ABI: Update allowed list for QCOM
da8a8d7722 UPSTREAM: wifi: mac80211_hwsim: use 32-bit skb cookie
85f8095194 UPSTREAM: wifi: mac80211_hwsim: add back erroneously removed cast
8b32ee8a9e UPSTREAM: wifi: mac80211_hwsim: fix race condition in pending packet

Change-Id: Ie1d54da353bd48b4f3a31123c9b91198d223ba73
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman
2022-11-29 11:39:30 +00:00
parent 0bd6dcc07a 4338018da7
commit d3df1dbcb2
35 changed files with 230 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Documentation/filesystems/fscrypt.rst
View File

@@ -1158,7 +1158,7 @@ setxattr() because of the special semantics of the encryption xattr.
were to be added to or removed from anything other than an empty
directory.) These structs are defined as follows::
#define FS_KEY_DERIVATION_NONCE_SIZE 16
#define FSCRYPT_FILE_NONCE_SIZE 16
#define FSCRYPT_KEY_DESCRIPTOR_SIZE 8
struct fscrypt_context_v1 {
@@ -1167,7 +1167,7 @@ directory.) These structs are defined as follows::
u8 filenames_encryption_mode;
u8 flags;
u8 master_key_descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE];
u8 nonce[FS_KEY_DERIVATION_NONCE_SIZE];
u8 nonce[FSCRYPT_FILE_NONCE_SIZE];
};
#define FSCRYPT_KEY_IDENTIFIER_SIZE 16
@@ -1178,7 +1178,7 @@ directory.) These structs are defined as follows::
u8 flags;
u8 __reserved[4];
u8 master_key_identifier[FSCRYPT_KEY_IDENTIFIER_SIZE];
u8 nonce[FS_KEY_DERIVATION_NONCE_SIZE];
u8 nonce[FSCRYPT_FILE_NONCE_SIZE];
};
The context structs contain the same information as the corresponding

6
Makefile
View File

@@ -810,12 +810,12 @@ endif
# Initialize all stack variables with a zero value.
ifdef CONFIG_INIT_STACK_ALL_ZERO
# Future support for zero initialization is still being debated, see
# https://bugs.llvm.org/show_bug.cgi?id=45497. These flags are subject to being
# renamed or dropped.
KBUILD_CFLAGS += -ftrivial-auto-var-init=zero
ifdef CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER
# https://github.com/llvm/llvm-project/issues/44842
KBUILD_CFLAGS += -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang
endif
endif
DEBUG_CFLAGS := $(call cc-option, -fno-var-tracking-assignments)

16
android/abi_gki_aarch64_fcnt Executable file → Normal file
View File

@@ -78,3 +78,19 @@
# required by sdhci-msm.ko
mmc_gpio_set_cd_wake
# required by max77729.ko
i2c_new_dummy_device
__irq_alloc_descs
i2c_smbus_write_word_data
i2c_smbus_write_i2c_block_data
i2c_smbus_read_i2c_block_data
i2c_smbus_read_word_data
power_supply_register
power_supply_unregister
mfd_add_devices
mfd_remove_devices
# required by sec.ko
strncat
input_mt_destroy_slots

1
android/abi_gki_aarch64_qcom
View File

@@ -1942,6 +1942,7 @@
refcount_dec_not_one
refcount_inc_checked
refcount_inc_not_zero_checked
refcount_warn_saturate
__refrigerator
regcache_cache_bypass
regcache_cache_only

23
arch/arm/boot/compressed/head.S
View File

@@ -140,6 +140,13 @@
#endif
.endm
.macro be32tocpu, val, tmp
#ifndef __ARMEB__
/* convert to little endian */
rev_l \val, \tmp
#endif
.endm
.section ".start", "ax"
/*
* sort out different calling conventions
@@ -344,13 +351,7 @@ restart: adr r0, LC0
/* Get the initial DTB size */
ldr r5, [r6, #4]
#ifndef __ARMEB__
/* convert to little endian */
eor r1, r5, r5, ror #16
bic r1, r1, #0x00ff0000
mov r5, r5, ror #8
eor r5, r5, r1, lsr #8
#endif
be32tocpu r5, r1
/* 50% DTB growth should be good enough */
add r5, r5, r5, lsr #1
/* preserve 64-bit alignment */
@@ -403,13 +404,7 @@ restart: adr r0, LC0
/* Get the current DTB size */
ldr r5, [r6, #4]
#ifndef __ARMEB__
/* convert r5 (dtb size) to little endian */
eor r1, r5, r5, ror #16
bic r1, r1, #0x00ff0000
mov r5, r5, ror #8
eor r5, r5, r1, lsr #8
#endif
be32tocpu r5, r1
/* preserve 64-bit alignment */
add r5, r5, #7

17
arch/arm/include/asm/assembler.h
View File

@@ -504,4 +504,21 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
#define _ASM_NOKPROBE(entry)
#endif
/*
* rev_l - byte-swap a 32-bit value
*
* @val: source/destination register
* @tmp: scratch register
*/
.macro rev_l, val:req, tmp:req
.if __LINUX_ARM_ARCH__ < 6
eor \tmp, \val, \val, ror #16
bic \tmp, \tmp, #0x00ff0000
mov \val, \val, ror #8
eor \val, \val, \tmp, lsr #8
.else
rev \val, \val
.endif
.endm
#endif /* __ASM_ASSEMBLER_H__ */

1
arch/arm64/configs/gki_defconfig
View File

@@ -556,7 +556,6 @@ CONFIG_HARDENED_USERCOPY=y
CONFIG_STATIC_USERMODEHELPER=y
CONFIG_STATIC_USERMODEHELPER_PATH=""
CONFIG_SECURITY_SELINUX=y
CONFIG_INIT_STACK_ALL_ZERO=y
CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
CONFIG_CRYPTO_ADIANTUM=y
CONFIG_CRYPTO_BLAKE2B=y

1
arch/x86/configs/gki_defconfig
View File

@@ -484,7 +484,6 @@ CONFIG_HARDENED_USERCOPY=y
CONFIG_STATIC_USERMODEHELPER=y
CONFIG_STATIC_USERMODEHELPER_PATH=""
CONFIG_SECURITY_SELINUX=y
CONFIG_INIT_STACK_ALL_ZERO=y
CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
CONFIG_CRYPTO_ADIANTUM=y
CONFIG_CRYPTO_BLAKE2B=y

16
drivers/base/dd.c
View File

@@ -550,7 +550,8 @@ re_probe:
goto probe_failed;
}
if (driver_sysfs_add(dev)) {
ret = driver_sysfs_add(dev);
if (ret) {
printk(KERN_ERR "%s: driver_sysfs_add(%s) failed\n",
__func__, dev_name(dev));
goto probe_failed;
@@ -572,15 +573,18 @@ re_probe:
goto probe_failed;
}
if (device_add_groups(dev, drv->dev_groups)) {
ret = device_add_groups(dev, drv->dev_groups);
if (ret) {
dev_err(dev, "device_add_groups() failed\n");
goto dev_groups_failed;
}
if (dev_has_sync_state(dev) &&
device_create_file(dev, &dev_attr_state_synced)) {
dev_err(dev, "state_synced sysfs add failed\n");
goto dev_sysfs_state_synced_failed;
if (dev_has_sync_state(dev)) {
ret = device_create_file(dev, &dev_attr_state_synced);
if (ret) {
dev_err(dev, "state_synced sysfs add failed\n");
goto dev_sysfs_state_synced_failed;
}
}
if (test_remove) {

5
drivers/mmc/core/sd.c
View File

@@ -1054,7 +1054,7 @@ retry:
mmc_remove_card(card);
goto retry;
}
goto done;
goto cont;
}
}
@@ -1091,6 +1091,7 @@ retry:
}
}
cont:
if (host->cqe_ops && !host->cqe_enabled) {
err = host->cqe_ops->cqe_enable(host, card);
if (!err) {
@@ -1108,7 +1109,7 @@ retry:
err = -EINVAL;
goto free_card;
}
done:
host->card = card;
return 0;

2
drivers/mmc/host/mmc_hsq.c
View File

@@ -34,7 +34,7 @@ static void mmc_hsq_pump_requests(struct mmc_hsq *hsq)
spin_lock_irqsave(&hsq->lock, flags);
/* Make sure we are not already running a request now */
if (hsq->mrq) {
if (hsq->mrq || hsq->recovery_halt) {
spin_unlock_irqrestore(&hsq->lock, flags);
return;
}

8
drivers/net/ethernet/socionext/netsec.c
View File

@@ -252,7 +252,6 @@
#define NETSEC_XDP_CONSUMED BIT(0)
#define NETSEC_XDP_TX BIT(1)
#define NETSEC_XDP_REDIR BIT(2)
#define NETSEC_XDP_RX_OK (NETSEC_XDP_PASS | NETSEC_XDP_TX | NETSEC_XDP_REDIR)
enum ring_id {
NETSEC_RING_TX = 0,
@@ -661,6 +660,7 @@ static bool netsec_clean_tx_dring(struct netsec_priv *priv)
bytes += desc->skb->len;
dev_kfree_skb(desc->skb);
} else {
bytes += desc->xdpf->len;
xdp_return_frame(desc->xdpf);
}
next:
@@ -858,6 +858,7 @@ static u32 netsec_xdp_queue_one(struct netsec_priv *priv,
tx_desc.addr = xdpf->data;
tx_desc.len = xdpf->len;
netdev_sent_queue(priv->ndev, xdpf->len);
netsec_set_tx_de(priv, tx_ring, &tx_ctrl, &tx_desc, xdpf);
return NETSEC_XDP_TX;
@@ -1029,8 +1030,9 @@ static int netsec_process_rx(struct netsec_priv *priv, int budget)
skb->ip_summed = CHECKSUM_UNNECESSARY;
next:
if ((skb && napi_gro_receive(&priv->napi, skb) != GRO_DROP) ||
xdp_result & NETSEC_XDP_RX_OK) {
if (skb)
napi_gro_receive(&priv->napi, skb);
if (skb || xdp_result) {
ndev->stats.rx_packets++;
ndev->stats.rx_bytes += xdp.data_end - xdp.data;
}

2
drivers/net/wireless/mac80211_hwsim.c
View File

@@ -4152,6 +4152,8 @@ static int hwsim_virtio_probe(struct virtio_device *vdev)
if (err)
return err;
virtio_device_ready(vdev);
err = fill_vq(hwsim_vqs[HWSIM_VQ_RX]);
if (err)
goto out_remove;

2
drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c
View File

@@ -98,7 +98,7 @@ MODULE_DEVICE_TABLE(of, a100_r_pinctrl_match);
static struct platform_driver a100_r_pinctrl_driver = {
.probe = a100_r_pinctrl_probe,
.driver = {
.name = "sun50iw10p1-r-pinctrl",
.name = "sun50i-a100-r-pinctrl",
.of_match_table = a100_r_pinctrl_match,
},
};

11
drivers/usb/dwc3/drd.c
View File

@@ -566,16 +566,15 @@ int dwc3_drd_init(struct dwc3 *dwc)
{
int ret, irq;
if (ROLE_SWITCH &&
device_property_read_bool(dwc->dev, "usb-role-switch"))
return dwc3_setup_role_switch(dwc);
dwc->edev = dwc3_get_extcon(dwc);
if (IS_ERR(dwc->edev))
return PTR_ERR(dwc->edev);
if (ROLE_SWITCH &&
device_property_read_bool(dwc->dev, "usb-role-switch")) {
ret = dwc3_setup_role_switch(dwc);
if (ret < 0)
return ret;
} else if (dwc->edev) {
if (dwc->edev) {
dwc->edev_nb.notifier_call = dwc3_drd_notifier;
ret = extcon_register_notifier(dwc->edev, EXTCON_USB_HOST,
&dwc->edev_nb);

2
drivers/usb/gadget/legacy/raw_gadget.c
View File

@@ -1000,7 +1000,7 @@ static int raw_process_ep_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
ret = -EBUSY;
goto out_unlock;
}
if ((in && !ep->ep->caps.dir_in) || (!in && ep->ep->caps.dir_in)) {
if (in != usb_endpoint_dir_in(ep->ep->desc)) {
dev_dbg(&dev->gadget->dev, "fail, wrong direction\n");
ret = -EINVAL;
goto out_unlock;

2
drivers/usb/musb/Kconfig
View File

@@ -120,7 +120,7 @@ config USB_MUSB_MEDIATEK
tristate "MediaTek platforms"
depends on ARCH_MEDIATEK || COMPILE_TEST
depends on NOP_USB_XCEIV
depends on GENERIC_PHY
select GENERIC_PHY
select USB_ROLE_SWITCH
config USB_MUSB_AM335X_CHILD

4
drivers/usb/typec/ucsi/ucsi.c
View File

@@ -739,6 +739,8 @@ static int ucsi_dr_swap(struct typec_port *port, enum typec_data_role role)
role == TYPEC_HOST))
goto out_unlock;
reinit_completion(&con->complete);
UCSI_CMD_SET_UOR(ctrl, con, role);
ret = ucsi_role_cmd(con, &ctrl);
if (ret < 0)
@@ -774,6 +776,8 @@ static int ucsi_pr_swap(struct typec_port *port, enum typec_role role)
if (con->status.pwr_dir == role)
goto out_unlock;
reinit_completion(&con->complete);
UCSI_CMD_SET_PDR(ctrl, con, role);
ret = ucsi_role_cmd(con, &ctrl);
if (ret < 0)

2
fs/crypto/crypto.c
View File

@@ -92,7 +92,7 @@ void fscrypt_generate_iv(union fscrypt_iv *iv, u64 lblk_num,
WARN_ON_ONCE(lblk_num > U32_MAX);
lblk_num = (u32)(ci->ci_hashed_ino + lblk_num);
} else if (flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) {
memcpy(iv->nonce, ci->ci_nonce, FS_KEY_DERIVATION_NONCE_SIZE);
memcpy(iv->nonce, ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE);
}
iv->lblk_num = cpu_to_le64(lblk_num);
}

12
fs/crypto/fscrypt_private.h
View File

@@ -19,9 +19,9 @@
#define CONST_STRLEN(str) (sizeof(str) - 1)
#define FS_KEY_DERIVATION_NONCE_SIZE 16
#define FSCRYPT_FILE_NONCE_SIZE 16
#define FSCRYPT_MIN_KEY_SIZE 16
#define FSCRYPT_MIN_KEY_SIZE 16
#define FSCRYPT_MAX_HW_WRAPPED_KEY_SIZE 128
#define FSCRYPT_CONTEXT_V1 1
@@ -36,7 +36,7 @@ struct fscrypt_context_v1 {
u8 filenames_encryption_mode;
u8 flags;
u8 master_key_descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE];
u8 nonce[FS_KEY_DERIVATION_NONCE_SIZE];
u8 nonce[FSCRYPT_FILE_NONCE_SIZE];
};
struct fscrypt_context_v2 {
@@ -46,7 +46,7 @@ struct fscrypt_context_v2 {
u8 flags;
u8 __reserved[4];
u8 master_key_identifier[FSCRYPT_KEY_IDENTIFIER_SIZE];
u8 nonce[FS_KEY_DERIVATION_NONCE_SIZE];
u8 nonce[FSCRYPT_FILE_NONCE_SIZE];
};
/*
@@ -249,7 +249,7 @@ struct fscrypt_info {
union fscrypt_policy ci_policy;
/* This inode's nonce, copied from the fscrypt_context */
u8 ci_nonce[FS_KEY_DERIVATION_NONCE_SIZE];
u8 ci_nonce[FSCRYPT_FILE_NONCE_SIZE];
/* Hashed inode number. Only set for IV_INO_LBLK_32 */
u32 ci_hashed_ino;
@@ -285,7 +285,7 @@ union fscrypt_iv {
__le64 lblk_num;
/* per-file nonce; only set in DIRECT_KEY mode */
u8 nonce[FS_KEY_DERIVATION_NONCE_SIZE];
u8 nonce[FSCRYPT_FILE_NONCE_SIZE];
};
u8 raw[FSCRYPT_MAX_IV_SIZE];
__le64 dun[FSCRYPT_MAX_IV_SIZE / sizeof(__le64)];

45
fs/crypto/keysetup.c
View File

@@ -240,15 +240,40 @@ out_unlock:
return err;
}
/*
* Derive a SipHash key from the given fscrypt master key and the given
* application-specific information string.
*
* Note that the KDF produces a byte array, but the SipHash APIs expect the key
* as a pair of 64-bit words. Therefore, on big endian CPUs we have to do an
* endianness swap in order to get the same results as on little endian CPUs.
*/
static int fscrypt_derive_siphash_key(const struct fscrypt_master_key *mk,
u8 context, const u8 *info,
unsigned int infolen, siphash_key_t *key)
{
int err;
err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, context, info, infolen,
(u8 *)key, sizeof(*key));
if (err)
return err;
BUILD_BUG_ON(sizeof(*key) != 16);
BUILD_BUG_ON(ARRAY_SIZE(key->key) != 2);
le64_to_cpus(&key->key[0]);
le64_to_cpus(&key->key[1]);
return 0;
}
int fscrypt_derive_dirhash_key(struct fscrypt_info *ci,
const struct fscrypt_master_key *mk)
{
int err;
err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, HKDF_CONTEXT_DIRHASH_KEY,
ci->ci_nonce, FS_KEY_DERIVATION_NONCE_SIZE,
(u8 *)&ci->ci_dirhash_key,
sizeof(ci->ci_dirhash_key));
err = fscrypt_derive_siphash_key(mk, HKDF_CONTEXT_DIRHASH_KEY,
ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE,
&ci->ci_dirhash_key);
if (err)
return err;
ci->ci_dirhash_key_initialized = true;
@@ -273,10 +298,9 @@ static int fscrypt_setup_iv_ino_lblk_32_key(struct fscrypt_info *ci,
if (mk->mk_ino_hash_key_initialized)
goto unlock;
err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf,
HKDF_CONTEXT_INODE_HASH_KEY, NULL, 0,
(u8 *)&mk->mk_ino_hash_key,
sizeof(mk->mk_ino_hash_key));
err = fscrypt_derive_siphash_key(mk,
HKDF_CONTEXT_INODE_HASH_KEY,
NULL, 0, &mk->mk_ino_hash_key);
if (err)
goto unlock;
/* pairs with smp_load_acquire() above */
@@ -335,8 +359,7 @@ static int fscrypt_setup_v2_file_key(struct fscrypt_info *ci,
err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf,
HKDF_CONTEXT_PER_FILE_ENC_KEY,
ci->ci_nonce,
FS_KEY_DERIVATION_NONCE_SIZE,
ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE,
derived_key, ci->ci_mode->keysize);
if (err)
return err;
@@ -545,7 +568,7 @@ int fscrypt_get_encryption_info(struct inode *inode)
}
memcpy(crypt_info->ci_nonce, fscrypt_context_nonce(&ctx),
FS_KEY_DERIVATION_NONCE_SIZE);
FSCRYPT_FILE_NONCE_SIZE);
if (!fscrypt_supported_policy(&crypt_info->ci_policy, inode)) {
res = -EINVAL;

4
fs/crypto/keysetup_v1.c
View File

@@ -45,7 +45,7 @@ static DEFINE_SPINLOCK(fscrypt_direct_keys_lock);
* key is longer, then only the first 'derived_keysize' bytes are used.
*/
static int derive_key_aes(const u8 *master_key,
const u8 nonce[FS_KEY_DERIVATION_NONCE_SIZE],
const u8 nonce[FSCRYPT_FILE_NONCE_SIZE],
u8 *derived_key, unsigned int derived_keysize)
{
int res = 0;
@@ -68,7 +68,7 @@ static int derive_key_aes(const u8 *master_key,
skcipher_request_set_callback(req,
CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
crypto_req_done, &wait);
res = crypto_skcipher_setkey(tfm, nonce, FS_KEY_DERIVATION_NONCE_SIZE);
res = crypto_skcipher_setkey(tfm, nonce, FSCRYPT_FILE_NONCE_SIZE);
if (res < 0)
goto out;

2
fs/crypto/policy.c
View File

@@ -551,7 +551,7 @@ int fscrypt_ioctl_get_nonce(struct file *filp, void __user *arg)
if (!fscrypt_context_is_valid(&ctx, ret))
return -EINVAL;
if (copy_to_user(arg, fscrypt_context_nonce(&ctx),
FS_KEY_DERIVATION_NONCE_SIZE))
FSCRYPT_FILE_NONCE_SIZE))
return -EFAULT;
return 0;
}

3
fs/f2fs/dir.c
View File

@@ -78,7 +78,8 @@ int f2fs_init_casefolded_name(const struct inode *dir,
#ifdef CONFIG_UNICODE
struct f2fs_sb_info *sbi = F2FS_SB(dir->i_sb);
if (IS_CASEFOLDED(dir)) {
if (IS_CASEFOLDED(dir) &&
!is_dot_dotdot(fname->usr_fname->name, fname->usr_fname->len)) {
fname->cf_name.name = f2fs_kmalloc(sbi, F2FS_NAME_LEN,
GFP_NOFS);
if (!fname->cf_name.name)

10
fs/f2fs/f2fs.h
View File

@@ -548,11 +548,11 @@ struct f2fs_filename {
#ifdef CONFIG_UNICODE
/*
* For casefolded directories: the casefolded name, but it's left NULL
* if the original name is not valid Unicode, if the directory is both
* casefolded and encrypted and its encryption key is unavailable, or if
* the filesystem is doing an internal operation where usr_fname is also
* NULL. In all these cases we fall back to treating the name as an
* opaque byte sequence.
* if the original name is not valid Unicode, if the original name is
* "." or "..", if the directory is both casefolded and encrypted and
* its encryption key is unavailable, or if the filesystem is doing an
* internal operation where usr_fname is also NULL. In all these cases
* we fall back to treating the name as an opaque byte sequence.
*/
struct fscrypt_str cf_name;
#endif

11
fs/f2fs/hash.c
View File

@@ -92,7 +92,7 @@ static u32 TEA_hash_name(const u8 *p, size_t len)
/*
* Compute @fname->hash. For all directories, @fname->disk_name must be set.
* For casefolded directories, @fname->usr_fname must be set, and also
* @fname->cf_name if the filename is valid Unicode.
* @fname->cf_name if the filename is valid Unicode and is not "." or "..".
*/
void f2fs_hash_filename(const struct inode *dir, struct f2fs_filename *fname)
{
@@ -111,10 +111,11 @@ void f2fs_hash_filename(const struct inode *dir, struct f2fs_filename *fname)
/*
* If the casefolded name is provided, hash it instead of the
* on-disk name. If the casefolded name is *not* provided, that
* should only be because the name wasn't valid Unicode, so fall
* back to treating the name as an opaque byte sequence. Note
* that to handle encrypted directories, the fallback must use
* usr_fname (plaintext) rather than disk_name (ciphertext).
* should only be because the name wasn't valid Unicode or was
* "." or "..", so fall back to treating the name as an opaque
* byte sequence. Note that to handle encrypted directories,
* the fallback must use usr_fname (plaintext) rather than
* disk_name (ciphertext).
*/
WARN_ON_ONCE(!fname->usr_fname->name);
if (fname->cf_name.name) {

42
include/linux/fs.h
View File

@@ -308,14 +308,20 @@ enum rw_hint {
WRITE_LIFE_EXTREME = RWH_WRITE_LIFE_EXTREME,
};
#define IOCB_EVENTFD (1 << 0)
#define IOCB_APPEND (1 << 1)
#define IOCB_DIRECT (1 << 2)
#define IOCB_HIPRI (1 << 3)
#define IOCB_DSYNC (1 << 4)
#define IOCB_SYNC (1 << 5)
#define IOCB_WRITE (1 << 6)
#define IOCB_NOWAIT (1 << 7)
/* Match RWF_* bits to IOCB bits */
#define IOCB_HIPRI (__force int) RWF_HIPRI
#define IOCB_DSYNC (__force int) RWF_DSYNC
#define IOCB_SYNC (__force int) RWF_SYNC
#define IOCB_NOWAIT (__force int) RWF_NOWAIT
#define IOCB_APPEND (__force int) RWF_APPEND
/* non-RWF related bits - start at 16 */
#define IOCB_EVENTFD (1 << 16)
#define IOCB_DIRECT (1 << 17)
#define IOCB_WRITE (1 << 18)
/* iocb->ki_waitq is valid */
#define IOCB_WAITQ (1 << 19)
#define IOCB_NOIO (1 << 20)
struct kiocb {
struct file *ki_filp;
@@ -3493,22 +3499,26 @@ static inline int iocb_flags(struct file *file)
static inline int kiocb_set_rw_flags(struct kiocb *ki, rwf_t flags)
{
int kiocb_flags = 0;
/* make sure there's no overlap between RWF and private IOCB flags */
BUILD_BUG_ON((__force int)RWF_SUPPORTED & IOCB_EVENTFD);
if (!flags)
return 0;
if (unlikely(flags & ~RWF_SUPPORTED))
return -EOPNOTSUPP;
if (flags & RWF_NOWAIT) {
if (!(ki->ki_filp->f_mode & FMODE_NOWAIT))
return -EOPNOTSUPP;
ki->ki_flags |= IOCB_NOWAIT;
kiocb_flags |= IOCB_NOIO;
}
if (flags & RWF_HIPRI)
ki->ki_flags |= IOCB_HIPRI;
if (flags & RWF_DSYNC)
ki->ki_flags |= IOCB_DSYNC;
kiocb_flags |= (__force int)(flags & RWF_SUPPORTED);
if (flags & RWF_SYNC)
ki->ki_flags |= (IOCB_DSYNC | IOCB_SYNC);
if (flags & RWF_APPEND)
ki->ki_flags |= IOCB_APPEND;
kiocb_flags |= IOCB_DSYNC;
ki->ki_flags |= kiocb_flags;
return 0;
}

6
kernel/cgroup/cgroup-v1.c
View File

@@ -556,6 +556,7 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
char *buf, size_t nbytes, loff_t off)
{
struct cgroup *cgrp;
struct cgroup_file_ctx *ctx;
BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
@@ -563,8 +564,9 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
* Release agent gets called with all capabilities,
* require capabilities to set release agent.
*/
if ((of->file->f_cred->user_ns != &init_user_ns) ||
!capable(CAP_SYS_ADMIN))
ctx = of->priv;
if ((ctx->ns->user_ns != &init_user_ns) ||
!file_ns_capable(of->file, &init_user_ns, CAP_SYS_ADMIN))
return -EPERM;
cgrp = cgroup_kn_lock_live(of->kn, false);

2
kernel/cpu.c
View File

@@ -1449,7 +1449,9 @@ int __boot_cpu_id;
/* Horrific hacks because we can't add more to cpuhp_hp_states. */
static int random_and_perf_prepare_fusion(unsigned int cpu)
{
#ifdef CONFIG_PERF_EVENTS
perf_event_init_cpu(cpu);
#endif
random_prepare_cpu(cpu);
return 0;
}

4
mm/cma.c
View File

@@ -39,6 +39,7 @@
struct cma cma_areas[MAX_CMA_AREAS];
unsigned cma_area_count;
static DEFINE_MUTEX(cma_mutex);
phys_addr_t cma_get_base(const struct cma *cma)
{
@@ -454,9 +455,10 @@ struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align,
mutex_unlock(&cma->lock);
pfn = cma->base_pfn + (bitmap_no << cma->order_per_bit);
mutex_lock(&cma_mutex);
ret = alloc_contig_range(pfn, pfn + count, MIGRATE_CMA,
GFP_KERNEL | (no_warn ? __GFP_NOWARN : 0));
mutex_unlock(&cma_mutex);
if (ret == 0) {
page = pfn_to_page(pfn);
break;

2
mm/mprotect.c
View File

@@ -86,7 +86,7 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
/* Also skip shared copy-on-write pages */
if (is_cow_mapping(vma->vm_flags) &&
page_mapcount(page) != 1)
page_count(page) != 1)
continue;
/*

2
net/core/skbuff.c
View File

@@ -3699,6 +3699,7 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
list_skb = list_skb->next;
err = 0;
delta_truesize += nskb->truesize;
if (skb_shared(nskb)) {
tmp = skb_clone(nskb, GFP_ATOMIC);
if (tmp) {
@@ -3723,7 +3724,6 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
tail = nskb;
delta_len += nskb->len;
delta_truesize += nskb->truesize;
skb_push(nskb, -skb_network_offset(nskb) + offset);

21
net/tipc/link.c
View File

@@ -2033,6 +2033,17 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
break;
case STATE_MSG:
/* Receive Gap ACK blocks from peer if any */
if (l->peer_caps & TIPC_GAP_ACK_BLOCK) {
ga = (struct tipc_gap_ack_blks *)data;
glen = ntohs(ga->len);
/* sanity check: if failed, ignore Gap ACK blocks */
if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt))
ga = NULL;
}
if(glen > dlen)
break;
l->rcv_nxt_state = msg_seqno(hdr) + 1;
/* Update own tolerance if peer indicates a non-zero value */
@@ -2058,16 +2069,6 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
break;
}
/* Receive Gap ACK blocks from peer if any */
if (l->peer_caps & TIPC_GAP_ACK_BLOCK) {
ga = (struct tipc_gap_ack_blks *)data;
glen = ntohs(ga->len);
/* sanity check: if failed, ignore Gap ACK blocks */
if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt))
ga = NULL;
}
if(glen > dlen)
break;
tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr,
&l->mon_state, l->bearer_id);

61
security/Kconfig.hardening
View File

@@ -22,13 +22,23 @@ menu "Memory initialization"
config CC_HAS_AUTO_VAR_INIT_PATTERN
def_bool $(cc-option,-ftrivial-auto-var-init=pattern)
config CC_HAS_AUTO_VAR_INIT_ZERO
config CC_HAS_AUTO_VAR_INIT_ZERO_BARE
def_bool $(cc-option,-ftrivial-auto-var-init=zero)
config CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER
# Clang 16 and later warn about using the -enable flag, but it
# is required before then.
def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
depends on !CC_HAS_AUTO_VAR_INIT_ZERO_BARE
config CC_HAS_AUTO_VAR_INIT_ZERO
def_bool CC_HAS_AUTO_VAR_INIT_ZERO_BARE || CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER
choice
prompt "Initialize kernel stack variables at function entry"
default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
default INIT_STACK_NONE
help
This option enables initialization of stack variables at
@@ -39,11 +49,11 @@ choice
syscalls.
This chooses the level of coverage over classes of potentially
uninitialized variables. The selected class will be
uninitialized variables. The selected class of variable will be
initialized before use in a function.
config INIT_STACK_NONE
bool "no automatic initialization (weakest)"
bool "no automatic stack variable initialization (weakest)"
help
Disable automatic stack variable initialization.
This leaves the kernel vulnerable to the standard
@@ -80,7 +90,7 @@ choice
and is disallowed.
config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
bool "zero-init anything passed by reference (very strong)"
bool "zero-init everything passed by reference (very strong)"
depends on GCC_PLUGINS
depends on !(KASAN && KASAN_STACK=1)
select GCC_PLUGIN_STRUCTLEAK
@@ -91,33 +101,44 @@ choice
of uninitialized stack variable exploits and information
exposures.
As a side-effect, this keeps a lot of variables on the
stack that can otherwise be optimized out, so combining
this with CONFIG_KASAN_STACK can lead to a stack overflow
and is disallowed.
config INIT_STACK_ALL_PATTERN
bool "0xAA-init everything on the stack (strongest)"
bool "pattern-init everything (strongest)"
depends on CC_HAS_AUTO_VAR_INIT_PATTERN
help
Initializes everything on the stack with a 0xAA
pattern. This is intended to eliminate all classes
of uninitialized stack variable exploits and information
exposures, even variables that were warned to have been
left uninitialized.
Initializes everything on the stack (including padding)
with a specific debug value. This is intended to eliminate
all classes of uninitialized stack variable exploits and
information exposures, even variables that were warned about
having been left uninitialized.
Pattern initialization is known to provoke many existing bugs
related to uninitialized locals, e.g. pointers receive
non-NULL values, buffer sizes and indices are very big.
non-NULL values, buffer sizes and indices are very big. The
pattern is situation-specific; Clang on 64-bit uses 0xAA
repeating for all types and padding except float and double
which use 0xFF repeating (-NaN). Clang on 32-bit uses 0xFF
repeating for all types and padding.
config INIT_STACK_ALL_ZERO
bool "zero-init everything on the stack (strongest and safest)"
bool "zero-init everything (strongest and safest)"
depends on CC_HAS_AUTO_VAR_INIT_ZERO
help
Initializes everything on the stack with a zero
value. This is intended to eliminate all classes
of uninitialized stack variable exploits and information
exposures, even variables that were warned to have been
left uninitialized.
Initializes everything on the stack (including padding)
with a zero value. This is intended to eliminate all
classes of uninitialized stack variable exploits and
information exposures, even variables that were warned
about having been left uninitialized.
Zero initialization provides safe defaults for strings,
pointers, indices and sizes, and is therefore
more suitable as a security mitigation measure.
Zero initialization provides safe defaults for strings
(immediately NUL-terminated), pointers (NULL), indices
(index 0), and sizes (0 length), so it is therefore more
suitable as a production security mitigation than pattern
initialization.
endchoice

2
security/selinux/selinuxfs.c
View File

@@ -2025,6 +2025,8 @@ static int sel_fill_super(struct super_block *sb, struct fs_context *fc)
}
ret = sel_make_avc_files(dentry);
if (ret)
goto err;
dentry = sel_make_dir(sb->s_root, "ss", &fsi->last_ino);
if (IS_ERR(dentry)) {