From be34ad9457d9061031c61342003b679d11e34880 Mon Sep 17 00:00:00 2001 From: Wander Lairson Costa Date: Mon, 28 Aug 2023 19:12:55 -0300 Subject: [PATCH 01/31] UPSTREAM: netfilter: xt_sctp: validate the flag_info count commit e99476497687ef9e850748fe6d232264f30bc8f9 upstream. sctp_mt_check doesn't validate the flag_count field. An attacker can take advantage of that to trigger a OOB read and leak memory information. Add the field validation in the checkentry function. Bug: 304913898 Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables") Cc: stable@vger.kernel.org Reported-by: Lucas Leong Signed-off-by: Wander Lairson Costa Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 4921f9349b66da7c5a2b6418fe45e9ae0ae72924) Signed-off-by: Lee Jones Change-Id: Ife4e69f6218fdaca2a8647b5ed00d875a5ed0d34 --- net/netfilter/xt_sctp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c index 680015ba7cb6..d4bf089c9e3f 100644 --- a/net/netfilter/xt_sctp.c +++ b/net/netfilter/xt_sctp.c @@ -150,6 +150,8 @@ static int sctp_mt_check(const struct xt_mtchk_param *par) { const struct xt_sctp_info *info = par->matchinfo; + if (info->flag_count > ARRAY_SIZE(info->flag_info)) + return -EINVAL; if (info->flags & ~XT_SCTP_VALID_FLAGS) return -EINVAL; if (info->invflags & ~XT_SCTP_VALID_FLAGS) From dc8e07a5946ff6022f1f0c21cdf2ebda51591764 Mon Sep 17 00:00:00 2001 From: "qinglin.li" Date: Tue, 17 Oct 2023 14:31:23 +0800 Subject: [PATCH 02/31] ANDROID: vendor_hooks: add vendor hook in __alloc_pages() By this vh, so that we can record page information and add custom optimisations such as cma. Bug: 305868227 Change-Id: I6d20dc96f864202ea0ca236c82337f385a9054f6 Signed-off-by: Qinglin Li --- drivers/android/vendor_hooks.c | 1 + include/trace/hooks/mm.h | 4 ++++ mm/page_alloc.c | 1 + 3 files changed, 6 insertions(+) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index b33c3e365443..7e8788469d2a 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -460,6 +460,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_clear_page_migrating); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cma_alloc_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_enable_thermal_genl_check); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_xhci_urb_suitable_bypass); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_pages_entry); /* * For type visibility */ diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index f38b6c3d2a80..e4f166f05131 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -254,6 +254,10 @@ DECLARE_HOOK(android_vh_cma_alloc_bypass, TP_PROTO(struct cma *cma, unsigned long count, unsigned int align, bool no_warn, struct page **page, bool *bypass), TP_ARGS(cma, count, align, no_warn, page, bypass)); +DECLARE_HOOK(android_vh_alloc_pages_entry, + TP_PROTO(gfp_t *gfp, unsigned int order, int preferred_nid, + nodemask_t *nodemask), + TP_ARGS(gfp, order, preferred_nid, nodemask)); #endif /* _TRACE_HOOK_MM_H */ /* This part must be outside protection */ diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 862869a1804f..bd3d87513216 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -5740,6 +5740,7 @@ struct page *__alloc_pages(gfp_t gfp, unsigned int order, int preferred_nid, gfp_t alloc_gfp; /* The gfp_t that was actually used for allocation */ struct alloc_context ac = { }; + trace_android_vh_alloc_pages_entry(&gfp, order, preferred_nid, nodemask); /* * There are several places where we assume that the order value is sane * so bail out early if the request is out of bound. From d4c2ea3e903788f86988769aa3ef724d96dc9cdd Mon Sep 17 00:00:00 2001 From: "qinglin.li" Date: Tue, 17 Oct 2023 16:51:57 +0800 Subject: [PATCH 03/31] ANDROID: GKI: Update symbol list for Amlogic 1 function symbol(s) added 'int __traceiter_android_vh_alloc_pages_entry(void*, gfp_t*, unsigned int, int, nodemask_t*)' 1 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_alloc_pages_entry' Bug: 305868227 Change-Id: I6b5ac5f413c63650a7a39f454934ebe906dbaefa Signed-off-by: Qinglin Li --- android/abi_gki_aarch64.xml | 2096 ++++++++++++++++--------------- android/abi_gki_aarch64_amlogic | 2 + 2 files changed, 1056 insertions(+), 1042 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index e870c1cfc08b..40b42a225632 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -497,6 +497,7 @@ + @@ -7171,6 +7172,7 @@ + @@ -13593,48 +13595,48 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -27337,15 +27339,15 @@ - + - + - + - + @@ -41607,9 +41609,9 @@ - + - + @@ -44948,24 +44950,24 @@ - + - + - + - + - + - + - + @@ -50870,7 +50872,7 @@ - + @@ -59277,15 +59279,15 @@ - + - + - + - + @@ -62407,27 +62409,27 @@ - + - + - + - + - + - + - + - + @@ -66245,21 +66247,21 @@ - + - + - + - + - + - + @@ -79860,12 +79862,12 @@ - + - + - + @@ -84315,9 +84317,9 @@ - + - + @@ -90179,73 +90181,73 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -120472,21 +120474,21 @@ - + - + - + - + - + - + @@ -123478,15 +123480,15 @@ - + - + - + - + @@ -125874,33 +125876,33 @@ - + - + - + - + - + - + - + - + - + - + @@ -127527,7 +127529,7 @@ - + @@ -128310,8 +128312,8 @@ - - + + @@ -128445,9 +128447,9 @@ - - - + + + @@ -128507,9 +128509,9 @@ - - - + + + @@ -129047,11 +129049,11 @@ - - - - - + + + + + @@ -129073,13 +129075,13 @@ - - - - - - - + + + + + + + @@ -129108,9 +129110,9 @@ - - - + + + @@ -129500,8 +129502,8 @@ - - + + @@ -130556,6 +130558,14 @@ + + + + + + + + @@ -132518,15 +132528,15 @@ - - - - + + + + - - - + + + @@ -132947,6 +132957,7 @@ + @@ -133259,8 +133270,8 @@ - - + + @@ -133795,12 +133806,12 @@ - - - - - - + + + + + + @@ -133880,27 +133891,27 @@ - - - - - - - - - - - - + + + + + + + + + + + + - - - + + + @@ -134006,11 +134017,11 @@ - - - - - + + + + + @@ -134047,27 +134058,27 @@ - - - + + + - - - - - - + + + + + + - - - - + + + + @@ -135139,15 +135150,15 @@ - - - + + + - - - - + + + + @@ -135301,8 +135312,8 @@ - - + + @@ -135563,16 +135574,16 @@ - - + + - - + + - - + + @@ -137283,14 +137294,14 @@ - - + + - + @@ -137631,8 +137642,8 @@ - - + + @@ -137655,8 +137666,8 @@ - - + + @@ -137809,28 +137820,28 @@ - - - - + + + + - - - - - - + + + + + + - - - + + + - - - + + + @@ -137875,8 +137886,8 @@ - - + + @@ -137937,42 +137948,42 @@ - - + + - - + + - - + + - - + + - - + + - - + + - - - + + + - - + + - - - + + + @@ -137980,9 +137991,9 @@ - - - + + + @@ -137990,10 +138001,10 @@ - - - - + + + + @@ -138001,10 +138012,10 @@ - - - - + + + + @@ -139146,14 +139157,14 @@ - - - - + + + + - - + + @@ -139278,21 +139289,21 @@ - - - + + + - - - - + + + + - - - - + + + + @@ -140417,16 +140428,16 @@ - - - - + + + + - - - - + + + + @@ -140434,9 +140445,9 @@ - - - + + + @@ -140447,11 +140458,11 @@ - - - - - + + + + + @@ -140463,39 +140474,39 @@ - - - - - + + + + + - - - - - + + + + + - - - + + + - - - - + + + + - - - - + + + + @@ -140508,8 +140519,8 @@ - - + + @@ -140568,14 +140579,14 @@ - - - + + + - - - + + + @@ -140593,48 +140604,48 @@ - - + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + @@ -140646,13 +140657,13 @@ - - - - - - - + + + + + + + @@ -140683,52 +140694,52 @@ - - - + + + - - - - + + + + - - + + - - - + + + - - + + - - - + + + - - - + + + - - - - + + + + - - + + - - + + @@ -140772,31 +140783,31 @@ - - - + + + - - - + + + - - - + + + - - + + - - - - - - + + + + + + @@ -140812,81 +140823,81 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - + + - - + + - - - + + + - - - + + + - - - - - - - - - - - - - + + + + + + + + + + + + + - - + + - - - - + + + + - - - + + + - - - + + + - - + + @@ -140894,20 +140905,20 @@ - - - + + + - - + + - - - - - + + + + + @@ -140940,16 +140951,16 @@ - - + + - - + + - - + + @@ -141053,18 +141064,18 @@ - - + + - - + + - - - - + + + + @@ -142910,9 +142921,9 @@ - - - + + + @@ -143444,85 +143455,85 @@ - - + + - - + + - - - + + + - - + + - - + + - - - - - + + + + + - - - - + + + + - - - + + + - - - - + + + + - - - - - + + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - + + + - - - - + + + + @@ -143576,8 +143587,8 @@ - - + + @@ -143591,12 +143602,12 @@ - - + + - - + + @@ -143676,11 +143687,11 @@ - - - - - + + + + + @@ -143769,26 +143780,26 @@ - - + + - - + + - - + + - - - - + + + + @@ -143826,9 +143837,9 @@ - - - + + + @@ -143844,14 +143855,14 @@ - - - + + + - - - + + + @@ -144187,8 +144198,8 @@ - - + + @@ -145076,8 +145087,8 @@ - - + + @@ -146218,13 +146229,13 @@ - - - - - - - + + + + + + + @@ -146335,26 +146346,26 @@ - - - - - - + + + + + + - - - + + + - - + + @@ -146564,16 +146575,16 @@ - - - + + + - - - - - + + + + + @@ -146709,10 +146720,10 @@ - - - - + + + + @@ -146735,8 +146746,8 @@ - - + + @@ -146747,15 +146758,15 @@ - - - - - + + + + + - - + + @@ -146763,13 +146774,13 @@ - - + + - - - + + + @@ -146777,10 +146788,10 @@ - - - - + + + + @@ -146934,8 +146945,8 @@ - - + + @@ -147419,8 +147430,8 @@ - - + + @@ -147438,19 +147449,19 @@ - - - - - + + + + + - - - - - - + + + + + + @@ -147923,9 +147934,9 @@ - - - + + + @@ -148091,10 +148102,10 @@ - - - - + + + + @@ -148972,9 +148983,9 @@ - - - + + + @@ -150056,11 +150067,11 @@ - - - - - + + + + + @@ -150255,13 +150266,13 @@ - - - - - - - + + + + + + + @@ -150500,11 +150511,11 @@ - - - - - + + + + + @@ -150515,8 +150526,8 @@ - - + + @@ -150524,8 +150535,8 @@ - - + + @@ -150535,8 +150546,8 @@ - - + + @@ -150708,7 +150719,7 @@ - + @@ -150837,48 +150848,48 @@ - - - - + + + + - - - - + + + + - - + + - - - + + + - - - + + + - - + + - - + + - - - + + + - - - + + + @@ -150886,9 +150897,9 @@ - - - + + + @@ -150896,14 +150907,14 @@ - - - + + + - - - + + + @@ -151732,21 +151743,21 @@ - - - - - + + + + + - - + + - - - - + + + + @@ -151802,10 +151813,10 @@ - - - - + + + + @@ -152087,9 +152098,9 @@ - - - + + + @@ -152594,8 +152605,8 @@ - - + + @@ -154292,13 +154303,13 @@ - - - + + + - - + + @@ -154512,17 +154523,17 @@ - - - - - + + + + + - - - - + + + + @@ -154813,20 +154824,20 @@ - - + + - - + + - - + + - - + + @@ -155089,8 +155100,8 @@ - - + + @@ -155099,18 +155110,18 @@ - - - - - + + + + + - - - - - + + + + + @@ -155128,30 +155139,30 @@ - - - + + + - - - - - - - + + + + + + + - - + + - - + + @@ -155171,63 +155182,63 @@ - - - - + + + + - - - - + + + + - - - - - + + + + + - - - - - + + + + + - - - - - + + + + + - - - - - + + + + + - - - - - + + + + + - - - - + + + + - - - - + + + + @@ -155235,14 +155246,14 @@ - - - - - - - - + + + + + + + + @@ -155251,34 +155262,34 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - - - + + + + - - + + @@ -155286,85 +155297,85 @@ - - + + - - + + - - + + - - - + + + - - + + - - + + - - + + - - + + - - - + + + - - + + - - + + - - + + - - - - + + + + - - - + + + @@ -155406,24 +155417,24 @@ - - - - + + + + - - + + - - - + + + - - - + + + @@ -155431,10 +155442,10 @@ - - - - + + + + @@ -155443,14 +155454,14 @@ - - - + + + - - - + + + @@ -155458,10 +155469,10 @@ - - - - + + + + @@ -155469,29 +155480,29 @@ - - - - + + + + - - - - + + + + - - + + - - + + - - - + + + @@ -155540,8 +155551,8 @@ - - + + @@ -155627,11 +155638,11 @@ - - - - - + + + + + @@ -157370,11 +157381,11 @@ - + - - + + @@ -157543,8 +157554,8 @@ - - + + @@ -157554,9 +157565,9 @@ - - - + + + @@ -157597,10 +157608,10 @@ - - - - + + + + @@ -157617,9 +157628,9 @@ - - - + + + @@ -157627,16 +157638,16 @@ - - - - + + + + - - - - + + + + @@ -157685,9 +157696,9 @@ - - - + + + @@ -157708,18 +157719,18 @@ - - - - - + + + + + - - - - - + + + + + @@ -157727,9 +157738,9 @@ - - - + + + @@ -157737,8 +157748,8 @@ - - + + @@ -159113,20 +159124,20 @@ - - - - - - - + + + + + + + - - - - - + + + + + @@ -159150,88 +159161,88 @@ - - - - - + + + + + - - - + + + - - - - - + + + + + - - - - + + + + - - - - - + + + + + - - - - + + + + - - - + + + - - - - + + + + - - - - - + + + + + - - - - + + + + - - - - - - + + + + + + - - - + + + - - - + + + @@ -159269,11 +159280,11 @@ - - - - - + + + + + @@ -160421,9 +160432,9 @@ - - - + + + @@ -160437,8 +160448,8 @@ - - + + @@ -160462,12 +160473,12 @@ - - + + - - + + @@ -161503,26 +161514,26 @@ - - - + + + - - - + + + - - + + - - + + - - + + @@ -161532,13 +161543,13 @@ - - - + + + - - + + @@ -161830,11 +161841,11 @@ - - - - - + + + + + @@ -164812,20 +164823,20 @@ - - + + - - - - + + + + - - - - + + + + @@ -165444,6 +165455,7 @@ + diff --git a/android/abi_gki_aarch64_amlogic b/android/abi_gki_aarch64_amlogic index db8e72292dab..453289c9ca96 100644 --- a/android/abi_gki_aarch64_amlogic +++ b/android/abi_gki_aarch64_amlogic @@ -1963,6 +1963,7 @@ __traceiter_android_rvh_schedule __traceiter_android_rvh_select_task_rq_rt __traceiter_android_rvh_tick_entry + __traceiter_android_vh_alloc_pages_entry __traceiter_android_vh_cma_alloc_bypass __traceiter_android_vh_cma_drain_all_pages_bypass __traceiter_android_vh_cpu_idle_enter @@ -2002,6 +2003,7 @@ __tracepoint_android_rvh_schedule __tracepoint_android_rvh_select_task_rq_rt __tracepoint_android_rvh_tick_entry + __tracepoint_android_vh_alloc_pages_entry __tracepoint_android_vh_cma_alloc_bypass __tracepoint_android_vh_cma_drain_all_pages_bypass __tracepoint_android_vh_cpu_idle_enter From 488dcc05293fa902a842079e7ccebb8a1e8b0cca Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 14 Aug 2022 15:16:18 -0400 Subject: [PATCH 04/31] BACKPORT: take care to handle NULL ->proc_lseek() Easily done now, just by clearing FMODE_LSEEK in ->f_mode during proc_reg_open() for such entries. Fixes: 868941b14441 "fs: remove no_llseek" Change-Id: I39ea07e044417a66e874515c4a20ee21636a64b6 Signed-off-by: Al Viro (cherry picked from commit 3f61631d47f115b83c935d0039f95cb68b0c8ab7) Signed-off-by: David Anderson --- fs/proc/inode.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 599eb724ff2d..e5b710674215 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -489,6 +489,9 @@ static int proc_reg_open(struct inode *inode, struct file *file) typeof_member(struct proc_ops, proc_release) release; struct pde_opener *pdeo; + if (!pde->proc_ops->proc_lseek) + file->f_mode &= ~FMODE_LSEEK; + if (pde_is_permanent(pde)) { open = pde->proc_ops->proc_open; if (open) From ac178987584017ed6d85752157b8af6ab3e429fa Mon Sep 17 00:00:00 2001 From: "qinglin.li" Date: Thu, 19 Oct 2023 13:30:35 +0800 Subject: [PATCH 05/31] ANDROID: GKI: Update symbol list for Amlogic 1 function symbol(s) added 'int __traceiter_rwmmio_post_write(void*, unsigned long, u64, u8, volatile void*)' 1 variable symbol(s) added 'struct tracepoint __tracepoint_rwmmio_post_write' Bug: 306277287 Change-Id: I33f35203d418000a82da12a3874d9d6ed82f4f84 Signed-off-by: Qinglin Li --- android/abi_gki_aarch64.xml | 741 ++++++++++++++++---------------- android/abi_gki_aarch64_amlogic | 8 + 2 files changed, 384 insertions(+), 365 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 40b42a225632..c6916d4ae671 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -833,6 +833,7 @@ + @@ -7508,6 +7509,7 @@ + @@ -8880,7 +8882,7 @@ - + @@ -12304,7 +12306,7 @@ - + @@ -14454,7 +14456,7 @@ - + @@ -16509,7 +16511,7 @@ - + @@ -19624,7 +19626,7 @@ - + @@ -27682,7 +27684,7 @@ - + @@ -30249,7 +30251,7 @@ - + @@ -36358,7 +36360,7 @@ - + @@ -38244,10 +38246,10 @@ - + - + @@ -41434,7 +41436,7 @@ - + @@ -44412,7 +44414,7 @@ - + @@ -52378,10 +52380,10 @@ - + - + @@ -56794,19 +56796,19 @@ - + - + - + - + @@ -61284,7 +61286,7 @@ - + @@ -68036,61 +68038,61 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -68272,16 +68274,16 @@ - + - + - + - + @@ -71956,7 +71958,7 @@ - + @@ -72049,7 +72051,7 @@ - + @@ -75157,7 +75159,7 @@ - + @@ -76162,7 +76164,7 @@ - + @@ -76387,7 +76389,7 @@ - + @@ -77134,7 +77136,7 @@ - + @@ -78256,25 +78258,25 @@ - + - + - + - + - + - + - + @@ -78795,7 +78797,7 @@ - + @@ -78849,10 +78851,10 @@ - + - + @@ -81682,7 +81684,7 @@ - + @@ -81709,7 +81711,7 @@ - + @@ -81723,7 +81725,7 @@ - + @@ -81752,7 +81754,7 @@ - + @@ -82606,15 +82608,15 @@ - + - + - + @@ -82727,7 +82729,7 @@ - + @@ -82741,7 +82743,7 @@ - + @@ -82757,13 +82759,13 @@ - + - + - + @@ -82851,12 +82853,12 @@ - + - + @@ -82899,10 +82901,10 @@ - + - + @@ -82953,7 +82955,7 @@ - + @@ -82966,7 +82968,7 @@ - + @@ -82996,7 +82998,7 @@ - + @@ -83039,7 +83041,7 @@ - + @@ -83066,7 +83068,7 @@ - + @@ -83074,7 +83076,7 @@ - + @@ -83082,7 +83084,7 @@ - + @@ -83100,25 +83102,25 @@ - + - + - + - + - + - + - + @@ -83151,7 +83153,7 @@ - + @@ -83162,7 +83164,7 @@ - + @@ -83175,7 +83177,7 @@ - + @@ -83183,7 +83185,7 @@ - + @@ -83229,7 +83231,7 @@ - + @@ -83257,7 +83259,7 @@ - + @@ -83265,10 +83267,10 @@ - + - + @@ -83276,7 +83278,7 @@ - + @@ -83354,7 +83356,7 @@ - + @@ -83362,21 +83364,21 @@ - + - + - + - + - + @@ -83416,13 +83418,13 @@ - + - + - + @@ -83438,7 +83440,7 @@ - + @@ -83465,10 +83467,10 @@ - + - + @@ -83541,7 +83543,7 @@ - + @@ -83562,24 +83564,24 @@ - + - + - + - + - + - + @@ -83640,7 +83642,7 @@ - + @@ -83651,13 +83653,13 @@ - + - + @@ -83665,7 +83667,7 @@ - + @@ -83681,7 +83683,7 @@ - + @@ -83793,10 +83795,10 @@ - + - + @@ -83993,10 +83995,10 @@ - + - + @@ -84012,27 +84014,27 @@ - + - + - + - + - + - + - + @@ -84062,7 +84064,7 @@ - + @@ -84078,27 +84080,27 @@ - + - + - + - + - + - + - + @@ -84109,7 +84111,7 @@ - + @@ -84120,10 +84122,10 @@ - + - + @@ -84141,34 +84143,34 @@ - + - + - + - + - + - + - + - + - + - + @@ -84357,7 +84359,7 @@ - + @@ -89561,7 +89563,7 @@ - + @@ -91319,7 +91321,7 @@ - + @@ -99586,7 +99588,7 @@ - + @@ -101636,7 +101638,7 @@ - + @@ -101732,22 +101734,22 @@ - + - + - + - + - + - + @@ -108386,7 +108388,7 @@ - + @@ -109614,7 +109616,7 @@ - + @@ -113209,7 +113211,7 @@ - + @@ -114497,7 +114499,7 @@ - + @@ -114511,7 +114513,7 @@ - + @@ -114531,7 +114533,7 @@ - + @@ -114539,7 +114541,7 @@ - + @@ -114556,7 +114558,7 @@ - + @@ -114570,7 +114572,7 @@ - + @@ -114584,7 +114586,7 @@ - + @@ -114613,7 +114615,7 @@ - + @@ -114630,7 +114632,7 @@ - + @@ -114644,7 +114646,7 @@ - + @@ -114658,7 +114660,7 @@ - + @@ -114672,7 +114674,7 @@ - + @@ -114683,7 +114685,7 @@ - + @@ -114700,7 +114702,7 @@ - + @@ -114726,12 +114728,12 @@ - + - + @@ -114742,7 +114744,7 @@ - + @@ -114753,7 +114755,7 @@ - + @@ -114770,7 +114772,7 @@ - + @@ -114778,7 +114780,7 @@ - + @@ -114786,7 +114788,7 @@ - + @@ -114794,7 +114796,7 @@ - + @@ -114808,7 +114810,7 @@ - + @@ -114819,7 +114821,7 @@ - + @@ -114833,12 +114835,12 @@ - + - + @@ -114846,7 +114848,7 @@ - + @@ -114854,7 +114856,7 @@ - + @@ -114865,7 +114867,7 @@ - + @@ -114873,7 +114875,7 @@ - + @@ -114890,7 +114892,7 @@ - + @@ -114898,7 +114900,7 @@ - + @@ -114906,7 +114908,7 @@ - + @@ -114920,7 +114922,7 @@ - + @@ -114934,7 +114936,7 @@ - + @@ -114951,7 +114953,7 @@ - + @@ -114965,7 +114967,7 @@ - + @@ -114982,7 +114984,7 @@ - + @@ -114993,7 +114995,7 @@ - + @@ -115010,7 +115012,7 @@ - + @@ -115018,7 +115020,7 @@ - + @@ -115029,7 +115031,7 @@ - + @@ -115040,7 +115042,7 @@ - + @@ -115054,7 +115056,7 @@ - + @@ -115062,7 +115064,7 @@ - + @@ -115235,13 +115237,13 @@ - + - + @@ -115252,7 +115254,7 @@ - + @@ -115263,7 +115265,7 @@ - + @@ -115271,7 +115273,7 @@ - + @@ -115279,7 +115281,7 @@ - + @@ -115293,7 +115295,7 @@ - + @@ -115307,7 +115309,7 @@ - + @@ -115315,7 +115317,7 @@ - + @@ -115323,7 +115325,7 @@ - + @@ -115331,7 +115333,7 @@ - + @@ -115339,7 +115341,7 @@ - + @@ -115350,7 +115352,7 @@ - + @@ -115358,7 +115360,7 @@ - + @@ -115372,7 +115374,7 @@ - + @@ -115386,7 +115388,7 @@ - + @@ -115406,7 +115408,7 @@ - + @@ -115417,7 +115419,7 @@ - + @@ -115425,7 +115427,7 @@ - + @@ -115433,7 +115435,7 @@ - + @@ -115441,7 +115443,7 @@ - + @@ -115461,7 +115463,7 @@ - + @@ -115475,7 +115477,7 @@ - + @@ -115492,7 +115494,7 @@ - + @@ -115506,7 +115508,7 @@ - + @@ -115520,7 +115522,7 @@ - + @@ -115528,7 +115530,7 @@ - + @@ -115542,7 +115544,7 @@ - + @@ -115553,7 +115555,7 @@ - + @@ -115570,7 +115572,7 @@ - + @@ -115578,7 +115580,7 @@ - + @@ -115586,7 +115588,7 @@ - + @@ -115597,7 +115599,7 @@ - + @@ -115608,7 +115610,7 @@ - + @@ -115616,7 +115618,7 @@ - + @@ -115624,7 +115626,7 @@ - + @@ -115641,7 +115643,7 @@ - + @@ -115664,7 +115666,7 @@ - + @@ -115672,7 +115674,7 @@ - + @@ -115683,7 +115685,7 @@ - + @@ -115691,7 +115693,7 @@ - + @@ -115702,7 +115704,7 @@ - + @@ -115710,7 +115712,7 @@ - + @@ -115721,7 +115723,7 @@ - + @@ -115732,7 +115734,7 @@ - + @@ -115740,7 +115742,7 @@ - + @@ -115751,12 +115753,12 @@ - + - + @@ -115764,7 +115766,7 @@ - + @@ -115772,7 +115774,7 @@ - + @@ -115780,7 +115782,7 @@ - + @@ -115788,12 +115790,12 @@ - + - + @@ -115801,7 +115803,7 @@ - + @@ -115809,7 +115811,7 @@ - + @@ -115817,7 +115819,7 @@ - + @@ -115825,7 +115827,7 @@ - + @@ -115833,7 +115835,7 @@ - + @@ -115841,7 +115843,7 @@ - + @@ -115882,7 +115884,7 @@ - + @@ -115896,7 +115898,7 @@ - + @@ -115922,7 +115924,7 @@ - + @@ -115990,7 +115992,7 @@ - + @@ -116001,7 +116003,7 @@ - + @@ -116018,7 +116020,7 @@ - + @@ -116062,7 +116064,7 @@ - + @@ -116073,7 +116075,7 @@ - + @@ -116084,7 +116086,7 @@ - + @@ -116104,7 +116106,7 @@ - + @@ -116112,7 +116114,7 @@ - + @@ -116129,7 +116131,7 @@ - + @@ -116158,7 +116160,7 @@ - + @@ -116175,7 +116177,7 @@ - + @@ -116189,17 +116191,17 @@ - + - + - + @@ -116207,7 +116209,7 @@ - + @@ -116218,7 +116220,7 @@ - + @@ -116226,12 +116228,12 @@ - + - + @@ -116272,7 +116274,7 @@ - + @@ -116280,7 +116282,7 @@ - + @@ -116288,7 +116290,7 @@ - + @@ -116299,7 +116301,7 @@ - + @@ -116313,7 +116315,7 @@ - + @@ -116333,7 +116335,7 @@ - + @@ -116341,7 +116343,7 @@ - + @@ -116349,7 +116351,7 @@ - + @@ -116357,7 +116359,7 @@ - + @@ -116368,7 +116370,7 @@ - + @@ -116376,7 +116378,7 @@ - + @@ -116387,7 +116389,7 @@ - + @@ -116395,17 +116397,17 @@ - + - + - + @@ -116413,8 +116415,8 @@ - - + + @@ -116428,12 +116430,12 @@ - + - + @@ -116441,12 +116443,12 @@ - + - + @@ -116454,12 +116456,12 @@ - + - + @@ -116470,7 +116472,7 @@ - + @@ -116478,7 +116480,7 @@ - + @@ -116489,7 +116491,7 @@ - + @@ -116503,7 +116505,7 @@ - + @@ -116514,7 +116516,7 @@ - + @@ -116528,7 +116530,7 @@ - + @@ -116548,7 +116550,7 @@ - + @@ -116559,7 +116561,7 @@ - + @@ -116573,7 +116575,7 @@ - + @@ -116590,12 +116592,12 @@ - + - + @@ -116609,7 +116611,7 @@ - + @@ -116632,7 +116634,7 @@ - + @@ -122519,7 +122521,7 @@ - + @@ -124056,7 +124058,7 @@ - + @@ -127082,7 +127084,7 @@ - + @@ -132666,6 +132668,14 @@ + + + + + + + + @@ -133293,6 +133303,7 @@ + @@ -147399,10 +147410,10 @@ - - - - + + + + @@ -165099,10 +165110,10 @@ - - - - + + + + @@ -165118,15 +165129,15 @@ - - - + + + - - - - + + + + @@ -165139,13 +165150,13 @@ - - - + + + - - + + @@ -165154,9 +165165,9 @@ - - - + + + @@ -165167,14 +165178,14 @@ - - - + + + - - - + + + @@ -165195,13 +165206,13 @@ - - + + - - - + + + diff --git a/android/abi_gki_aarch64_amlogic b/android/abi_gki_aarch64_amlogic index 453289c9ca96..df8691c9dd27 100644 --- a/android/abi_gki_aarch64_amlogic +++ b/android/abi_gki_aarch64_amlogic @@ -1986,6 +1986,10 @@ __traceiter_mmap_lock_acquire_returned __traceiter_mmap_lock_released __traceiter_mmap_lock_start_locking + __traceiter_rwmmio_post_read + __traceiter_rwmmio_post_write + __traceiter_rwmmio_read + __traceiter_rwmmio_write __traceiter_sched_switch __traceiter_xdp_exception trace_output_call @@ -2028,6 +2032,10 @@ __tracepoint_mmap_lock_start_locking tracepoint_probe_register tracepoint_probe_unregister + __tracepoint_rwmmio_post_read + __tracepoint_rwmmio_post_write + __tracepoint_rwmmio_read + __tracepoint_rwmmio_write __tracepoint_sched_switch __tracepoint_xdp_exception trace_print_array_seq From 4d065e6a9b190b1e40a72e94a4a10e8dfbfbf7dd Mon Sep 17 00:00:00 2001 From: Prashanth K Date: Mon, 23 Oct 2023 16:41:36 +0530 Subject: [PATCH 06/31] ANDROID: abi_gki_aarch64_qcom: Add wait_for_device_probe symbol Update the qcom symbol list by adding wait_for_device_probe(). Symbols added: wait_for_device_probe Bug: 307237748 Change-Id: I9b58b60905cac794eae45b87bdc693fd390f163b Signed-off-by: Prashanth K --- android/abi_gki_aarch64_qcom | 1 + 1 file changed, 1 insertion(+) diff --git a/android/abi_gki_aarch64_qcom b/android/abi_gki_aarch64_qcom index 9b103108c140..69fa29593a39 100644 --- a/android/abi_gki_aarch64_qcom +++ b/android/abi_gki_aarch64_qcom @@ -2676,6 +2676,7 @@ wait_for_completion_interruptible_timeout wait_for_completion_io_timeout wait_for_completion_timeout + wait_for_device_probe __wait_rcu_gp __wake_up wake_up_if_idle From 72d0bfc6310de00a7429ea4c387e0635cc638516 Mon Sep 17 00:00:00 2001 From: Radoslaw Tyl Date: Thu, 24 Aug 2023 13:46:19 -0700 Subject: [PATCH 07/31] UPSTREAM: igb: set max size RX buffer when store bad packet is enabled commit bb5ed01cd2428cd25b1c88a3a9cba87055eb289f upstream. Increase the RX buffer size to 3K when the SBP bit is on. The size of the RX buffer determines the number of pages allocated which may not be sufficient for receive frames larger than the set MTU size. Bug: 306483516 Cc: stable@vger.kernel.org Fixes: 89eaefb61dc9 ("igb: Support RX-ALL feature flag.") Reported-by: Manfred Rudigier Signed-off-by: Radoslaw Tyl Tested-by: Arpana Arland (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman (cherry picked from commit be7353af5b35c8f4a11573a38b997f74f8c2ae4b) Signed-off-by: Lee Jones Change-Id: I3f05b369cd9ac24643af3e37e2ce1d099c63bc02 --- drivers/net/ethernet/intel/igb/igb_main.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index bff9649d8abd..83daf86c1674 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -4737,6 +4737,10 @@ void igb_configure_rx_ring(struct igb_adapter *adapter, static void igb_set_rx_buffer_len(struct igb_adapter *adapter, struct igb_ring *rx_ring) { +#if (PAGE_SIZE < 8192) + struct e1000_hw *hw = &adapter->hw; +#endif + /* set build_skb and buffer size flags */ clear_ring_build_skb_enabled(rx_ring); clear_ring_uses_large_buffer(rx_ring); @@ -4747,10 +4751,9 @@ static void igb_set_rx_buffer_len(struct igb_adapter *adapter, set_ring_build_skb_enabled(rx_ring); #if (PAGE_SIZE < 8192) - if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB) - return; - - set_ring_uses_large_buffer(rx_ring); + if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB || + rd32(E1000_RCTL) & E1000_RCTL_SBP) + set_ring_uses_large_buffer(rx_ring); #endif } From f637dd4cd6f403cb09904ce4312972ba7cafffaf Mon Sep 17 00:00:00 2001 From: Lin Ma Date: Tue, 27 Jun 2023 11:31:38 +0800 Subject: [PATCH 08/31] UPSTREAM: net: xfrm: Fix xfrm_address_filter OOB read [ Upstream commit dfa73c17d55b921e1d4e154976de35317e43a93a ] We found below OOB crash: [ 44.211730] ================================================================== [ 44.212045] BUG: KASAN: slab-out-of-bounds in memcmp+0x8b/0xb0 [ 44.212045] Read of size 8 at addr ffff88800870f320 by task poc.xfrm/97 [ 44.212045] [ 44.212045] CPU: 0 PID: 97 Comm: poc.xfrm Not tainted 6.4.0-rc7-00072-gdad9774deaf1-dirty #4 [ 44.212045] Call Trace: [ 44.212045] [ 44.212045] dump_stack_lvl+0x37/0x50 [ 44.212045] print_report+0xcc/0x620 [ 44.212045] ? __virt_addr_valid+0xf3/0x170 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_report+0xb2/0xe0 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_check_range+0x39/0x1c0 [ 44.212045] memcmp+0x8b/0xb0 [ 44.212045] xfrm_state_walk+0x21c/0x420 [ 44.212045] ? __pfx_dump_one_state+0x10/0x10 [ 44.212045] xfrm_dump_sa+0x1e2/0x290 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __kernel_text_address+0xd/0x40 [ 44.212045] ? kasan_unpoison+0x27/0x60 [ 44.212045] ? mutex_lock+0x60/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] ? __pfx_netlink_dump+0x10/0x10 [ 44.212045] ? mutex_unlock+0x7f/0xd0 [ 44.212045] ? __pfx_mutex_unlock+0x10/0x10 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa_done+0x10/0x10 [ 44.212045] ? __stack_depot_save+0x382/0x4e0 [ 44.212045] ? filter_irq_stacks+0x1c/0x70 [ 44.212045] ? kasan_save_stack+0x32/0x50 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? __kasan_slab_alloc+0x59/0x70 [ 44.212045] ? kmem_cache_alloc_node+0xf7/0x260 [ 44.212045] ? kmalloc_reserve+0xab/0x120 [ 44.212045] ? __alloc_skb+0xcf/0x210 [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? kasan_save_free_info+0x2e/0x50 [ 44.212045] ? __kasan_slab_free+0x10a/0x190 [ 44.212045] ? kmem_cache_free+0x9c/0x340 [ 44.212045] ? netlink_recvmsg+0x23c/0x660 [ 44.212045] ? sock_recvmsg+0xeb/0xf0 [ 44.212045] ? __sys_recvfrom+0x13c/0x1f0 [ 44.212045] ? __x64_sys_recvfrom+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? copyout+0x3e/0x50 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 44.212045] ? __pfx_sock_has_perm+0x10/0x10 [ 44.212045] ? mutex_lock+0x8d/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] ? __pfx_netlink_unicast+0x10/0x10 [ 44.212045] ? netlink_recvmsg+0x500/0x660 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] ? __pfx___sys_sendto+0x10/0x10 [ 44.212045] ? rcu_core+0x44a/0xe10 [ 44.212045] ? __rseq_handle_notify_resume+0x45b/0x740 [ 44.212045] ? _raw_spin_lock_irq+0x81/0xe0 [ 44.212045] ? __pfx___rseq_handle_notify_resume+0x10/0x10 [ 44.212045] ? __pfx_restore_fpregs_from_fpstate+0x10/0x10 [ 44.212045] ? __pfx_blkcg_maybe_throttle_current+0x10/0x10 [ 44.212045] ? __pfx_task_work_run+0x10/0x10 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] RIP: 0033:0x44b7da [ 44.212045] RSP: 002b:00007ffdc8838548 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 44.212045] RAX: ffffffffffffffda RBX: 00007ffdc8839978 RCX: 000000000044b7da [ 44.212045] RDX: 0000000000000038 RSI: 00007ffdc8838770 RDI: 0000000000000003 [ 44.212045] RBP: 00007ffdc88385b0 R08: 00007ffdc883858c R09: 000000000000000c [ 44.212045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 44.212045] R13: 00007ffdc8839968 R14: 00000000004c37d0 R15: 0000000000000001 [ 44.212045] [ 44.212045] [ 44.212045] Allocated by task 97: [ 44.212045] kasan_save_stack+0x22/0x50 [ 44.212045] kasan_set_track+0x25/0x30 [ 44.212045] __kasan_kmalloc+0x7f/0x90 [ 44.212045] __kmalloc_node_track_caller+0x5b/0x140 [ 44.212045] kmemdup+0x21/0x50 [ 44.212045] xfrm_dump_sa+0x17d/0x290 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] [ 44.212045] The buggy address belongs to the object at ffff88800870f300 [ 44.212045] which belongs to the cache kmalloc-64 of size 64 [ 44.212045] The buggy address is located 32 bytes inside of [ 44.212045] allocated 36-byte region [ffff88800870f300, ffff88800870f324) [ 44.212045] [ 44.212045] The buggy address belongs to the physical page: [ 44.212045] page:00000000e4de16ee refcount:1 mapcount:0 mapping:000000000 ... [ 44.212045] flags: 0x100000000000200(slab|node=0|zone=1) [ 44.212045] page_type: 0xffffffff() [ 44.212045] raw: 0100000000000200 ffff888004c41640 dead000000000122 0000000000000000 [ 44.212045] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 44.212045] page dumped because: kasan: bad access detected [ 44.212045] [ 44.212045] Memory state around the buggy address: [ 44.212045] ffff88800870f200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f280: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] >ffff88800870f300: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ^ [ 44.212045] ffff88800870f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ================================================================== By investigating the code, we find the root cause of this OOB is the lack of checks in xfrm_dump_sa(). The buggy code allows a malicious user to pass arbitrary value of filter->splen/dplen. Hence, with crafted xfrm states, the attacker can achieve 8 bytes heap OOB read, which causes info leak. if (attrs[XFRMA_ADDRESS_FILTER]) { filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]), sizeof(*filter), GFP_KERNEL); if (filter == NULL) return -ENOMEM; // NO MORE CHECKS HERE !!! } This patch fixes the OOB by adding necessary boundary checks, just like the code in pfkey_dump() function. Bug: 304913834 Fixes: d3623099d350 ("ipsec: add support of limited SA dump") Signed-off-by: Lin Ma Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin (cherry picked from commit 1960f468078b3471d1ee9aafa0cf06c8c34a505f) Signed-off-by: Lee Jones Change-Id: Iee18d8ee7e2b99ce5cf4e1ff7137f5b31531b890 --- net/xfrm/xfrm_user.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 951ca8e4ee08..65ee282cb551 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1159,6 +1159,15 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb) sizeof(*filter), GFP_KERNEL); if (filter == NULL) return -ENOMEM; + + /* see addr_match(), (prefix length >> 5) << 2 + * will be used to compare xfrm_address_t + */ + if (filter->splen > (sizeof(xfrm_address_t) << 3) || + filter->dplen > (sizeof(xfrm_address_t) << 3)) { + kfree(filter); + return -EINVAL; + } } if (attrs[XFRMA_PROTO]) From e89b1266f784b2271af2e72a5d04e3e39d0afcdc Mon Sep 17 00:00:00 2001 From: liujinbao1 Date: Thu, 12 Oct 2023 12:28:06 +0800 Subject: [PATCH 09/31] ANDROID: fuse-bpf: Add NULL pointer check in fuse_entry_revalidate If userspace tried to add a backing file in a fuse_dentry_revalidate where there wasn't one originally, this would trigger a crash. Disallow this operation for now. Bug: 296013218 Fixes: 57f3ff964899 ("ANDROID: fuse-bpf v1.1") Test: fuse_test passes, following script no longer crashes: adb shell su root setenforce 0 adb shell su root chmod ug+w /data/media adb shell su root rm /data/media/Android -rf adb shell su root mkdir -p /storage/emulated/Android/data/test adb shell su root ls -l /storage/emulated/Android/data/test Change-Id: Id8a67c43d1edfa010403d5f17e31109b796998cf Signed-off-by: liujinbao1 --- fs/fuse/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index b0164fa947f8..f3ed2ff426cd 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -186,7 +186,7 @@ static bool backing_data_changed(struct fuse_inode *fi, struct dentry *entry, int err; bool ret = true; - if (!entry) { + if (!entry || !fi->backing_inode) { ret = false; goto put_backing_file; } From 50b7feda1560607de5eff3ddeca8450923a5af4e Mon Sep 17 00:00:00 2001 From: Jozsef Kadlecsik Date: Tue, 19 Sep 2023 20:04:45 +0200 Subject: [PATCH 10/31] UPSTREAM: netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP [ Upstream commit 7433b6d2afd512d04398c73aa984d1e285be125b ] Kyle Zeng reported that there is a race between IPSET_CMD_ADD and IPSET_CMD_SWAP in netfilter/ip_set, which can lead to the invocation of `__ip_set_put` on a wrong `set`, triggering the `BUG_ON(set->ref == 0);` check in it. The race is caused by using the wrong reference counter, i.e. the ref counter instead of ref_netlink. Bug: 303172721 Fixes: 24e227896bbf ("netfilter: ipset: Add schedule point in call_ad().") Reported-by: Kyle Zeng Closes: https://lore.kernel.org/netfilter-devel/ZPZqetxOmH+w%2Fmyc@westworld/#r Tested-by: Kyle Zeng Signed-off-by: Jozsef Kadlecsik Signed-off-by: Florian Westphal Signed-off-by: Sasha Levin (cherry picked from commit ea5a61d58886ae875f1b4a371999f2a8b58cf26d) Signed-off-by: Lee Jones Change-Id: I33a6a6234830c600a4ebd62ed1fee3a48876b98d --- net/netfilter/ipset/ip_set_core.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c index c911fc09f363..33869db42bb6 100644 --- a/net/netfilter/ipset/ip_set_core.c +++ b/net/netfilter/ipset/ip_set_core.c @@ -682,6 +682,14 @@ __ip_set_put(struct ip_set *set) /* set->ref can be swapped out by ip_set_swap, netlink events (like dump) need * a separate reference counter */ +static void +__ip_set_get_netlink(struct ip_set *set) +{ + write_lock_bh(&ip_set_ref_lock); + set->ref_netlink++; + write_unlock_bh(&ip_set_ref_lock); +} + static void __ip_set_put_netlink(struct ip_set *set) { @@ -1695,11 +1703,11 @@ call_ad(struct net *net, struct sock *ctnl, struct sk_buff *skb, do { if (retried) { - __ip_set_get(set); + __ip_set_get_netlink(set); nfnl_unlock(NFNL_SUBSYS_IPSET); cond_resched(); nfnl_lock(NFNL_SUBSYS_IPSET); - __ip_set_put(set); + __ip_set_put_netlink(set); } ip_set_lock(set); From d7644c8942d622a15c17cb70a733f7db13d2bf33 Mon Sep 17 00:00:00 2001 From: "qinglin.li" Date: Tue, 24 Oct 2023 17:22:22 +0800 Subject: [PATCH 11/31] ANDROID: mm: allow hooks into __alloc_pages() Allow drivers to register mm_page_alloc hooks when alloc pages. This helps to get page info when alloc pages exit. Bug: 307485594 Change-Id: I6bdec48bf04a19718e49a51e52ac8d4ae64a7f86 Signed-off-by: Qinglin Li --- mm/page_alloc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index bd3d87513216..c94aa620ff27 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -83,6 +83,8 @@ #include "shuffle.h" #include "page_reporting.h" +EXPORT_TRACEPOINT_SYMBOL_GPL(mm_page_alloc); + /* Free Page Internal flags: for internal, non-pcp variants of free_pages(). */ typedef int __bitwise fpi_t; From d0a5b5f66ccaf4ef62226df42022ee565d1013e4 Mon Sep 17 00:00:00 2001 From: "qinglin.li" Date: Tue, 24 Oct 2023 19:09:26 +0800 Subject: [PATCH 12/31] ANDROID: GKI: Update symbol list for Amlogic 1 function symbol(s) added 'int __traceiter_mm_page_alloc(void*, struct page*, unsigned int, gfp_t, int)' 1 variable symbol(s) added 'struct tracepoint __tracepoint_mm_page_alloc' Bug: 307485594 Change-Id: I1393146b905a27875e52ff925da1a94e2d6d2e45 Signed-off-by: Qinglin Li --- android/abi_gki_aarch64.xml | 787 ++++++++++++++++---------------- android/abi_gki_aarch64_amlogic | 8 + 2 files changed, 407 insertions(+), 388 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index c6916d4ae671..8d45467966db 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -819,6 +819,7 @@ + @@ -7495,6 +7496,7 @@ + @@ -8882,7 +8884,7 @@ - + @@ -12306,7 +12308,7 @@ - + @@ -14456,7 +14458,7 @@ - + @@ -16511,7 +16513,7 @@ - + @@ -19626,7 +19628,7 @@ - + @@ -27684,7 +27686,7 @@ - + @@ -30251,7 +30253,7 @@ - + @@ -36360,7 +36362,7 @@ - + @@ -38246,10 +38248,10 @@ - + - + @@ -41436,7 +41438,7 @@ - + @@ -44414,7 +44416,7 @@ - + @@ -56796,19 +56798,19 @@ - + - + - + - + @@ -61286,7 +61288,7 @@ - + @@ -68038,61 +68040,61 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -68274,16 +68276,16 @@ - + - + - + - + @@ -71958,7 +71960,7 @@ - + @@ -72051,7 +72053,7 @@ - + @@ -75159,7 +75161,7 @@ - + @@ -76164,7 +76166,7 @@ - + @@ -76389,7 +76391,7 @@ - + @@ -77136,7 +77138,7 @@ - + @@ -78258,25 +78260,25 @@ - + - + - + - + - + - + - + @@ -78797,7 +78799,7 @@ - + @@ -78851,10 +78853,10 @@ - + - + @@ -81684,7 +81686,7 @@ - + @@ -81711,7 +81713,7 @@ - + @@ -81725,7 +81727,7 @@ - + @@ -81754,7 +81756,7 @@ - + @@ -82608,15 +82610,15 @@ - + - + - + @@ -82729,7 +82731,7 @@ - + @@ -82743,7 +82745,7 @@ - + @@ -82759,13 +82761,13 @@ - + - + - + @@ -82853,12 +82855,12 @@ - + - + @@ -82901,10 +82903,10 @@ - + - + @@ -82955,7 +82957,7 @@ - + @@ -82968,7 +82970,7 @@ - + @@ -82998,7 +83000,7 @@ - + @@ -83041,7 +83043,7 @@ - + @@ -83068,7 +83070,7 @@ - + @@ -83076,7 +83078,7 @@ - + @@ -83084,7 +83086,7 @@ - + @@ -83102,25 +83104,25 @@ - + - + - + - + - + - + - + @@ -83153,7 +83155,7 @@ - + @@ -83164,7 +83166,7 @@ - + @@ -83177,7 +83179,7 @@ - + @@ -83185,7 +83187,7 @@ - + @@ -83231,7 +83233,7 @@ - + @@ -83259,7 +83261,7 @@ - + @@ -83267,10 +83269,10 @@ - + - + @@ -83278,7 +83280,7 @@ - + @@ -83356,7 +83358,7 @@ - + @@ -83364,21 +83366,21 @@ - + - + - + - + - + @@ -83418,13 +83420,13 @@ - + - + - + @@ -83440,7 +83442,7 @@ - + @@ -83467,10 +83469,10 @@ - + - + @@ -83543,7 +83545,7 @@ - + @@ -83564,24 +83566,24 @@ - + - + - + - + - + - + @@ -83642,7 +83644,7 @@ - + @@ -83653,13 +83655,13 @@ - + - + @@ -83667,7 +83669,7 @@ - + @@ -83683,7 +83685,7 @@ - + @@ -83795,10 +83797,10 @@ - + - + @@ -83995,10 +83997,10 @@ - + - + @@ -84014,27 +84016,27 @@ - + - + - + - + - + - + - + @@ -84064,7 +84066,7 @@ - + @@ -84080,27 +84082,27 @@ - + - + - + - + - + - + - + @@ -84111,7 +84113,7 @@ - + @@ -84122,10 +84124,10 @@ - + - + @@ -84143,34 +84145,34 @@ - + - + - + - + - + - + - + - + - + - + @@ -84359,7 +84361,7 @@ - + @@ -89563,7 +89565,7 @@ - + @@ -91321,7 +91323,7 @@ - + @@ -99588,7 +99590,7 @@ - + @@ -101638,7 +101640,7 @@ - + @@ -101734,22 +101736,22 @@ - + - + - + - + - + - + @@ -108388,7 +108390,7 @@ - + @@ -109616,7 +109618,7 @@ - + @@ -113211,7 +113213,7 @@ - + @@ -114499,7 +114501,7 @@ - + @@ -114513,7 +114515,7 @@ - + @@ -114533,7 +114535,7 @@ - + @@ -114541,7 +114543,7 @@ - + @@ -114558,7 +114560,7 @@ - + @@ -114572,7 +114574,7 @@ - + @@ -114586,7 +114588,7 @@ - + @@ -114615,7 +114617,7 @@ - + @@ -114632,7 +114634,7 @@ - + @@ -114646,7 +114648,7 @@ - + @@ -114660,7 +114662,7 @@ - + @@ -114674,7 +114676,7 @@ - + @@ -114685,7 +114687,7 @@ - + @@ -114702,7 +114704,7 @@ - + @@ -114728,12 +114730,12 @@ - + - + @@ -114744,7 +114746,7 @@ - + @@ -114755,7 +114757,7 @@ - + @@ -114772,7 +114774,7 @@ - + @@ -114780,7 +114782,7 @@ - + @@ -114788,7 +114790,7 @@ - + @@ -114796,7 +114798,7 @@ - + @@ -114810,7 +114812,7 @@ - + @@ -114821,7 +114823,7 @@ - + @@ -114835,12 +114837,12 @@ - + - + @@ -114848,7 +114850,7 @@ - + @@ -114856,7 +114858,7 @@ - + @@ -114867,7 +114869,7 @@ - + @@ -114875,7 +114877,7 @@ - + @@ -114892,7 +114894,7 @@ - + @@ -114900,7 +114902,7 @@ - + @@ -114908,7 +114910,7 @@ - + @@ -114922,7 +114924,7 @@ - + @@ -114936,7 +114938,7 @@ - + @@ -114953,7 +114955,7 @@ - + @@ -114967,7 +114969,7 @@ - + @@ -114984,7 +114986,7 @@ - + @@ -114995,7 +114997,7 @@ - + @@ -115012,7 +115014,7 @@ - + @@ -115020,7 +115022,7 @@ - + @@ -115031,7 +115033,7 @@ - + @@ -115042,7 +115044,7 @@ - + @@ -115056,7 +115058,7 @@ - + @@ -115064,7 +115066,7 @@ - + @@ -115237,13 +115239,13 @@ - + - + @@ -115254,7 +115256,7 @@ - + @@ -115265,7 +115267,7 @@ - + @@ -115273,7 +115275,7 @@ - + @@ -115281,7 +115283,7 @@ - + @@ -115295,7 +115297,7 @@ - + @@ -115309,7 +115311,7 @@ - + @@ -115317,7 +115319,7 @@ - + @@ -115325,7 +115327,7 @@ - + @@ -115333,7 +115335,7 @@ - + @@ -115341,7 +115343,7 @@ - + @@ -115352,7 +115354,7 @@ - + @@ -115360,7 +115362,7 @@ - + @@ -115374,7 +115376,7 @@ - + @@ -115388,7 +115390,7 @@ - + @@ -115408,7 +115410,7 @@ - + @@ -115419,7 +115421,7 @@ - + @@ -115427,7 +115429,7 @@ - + @@ -115435,7 +115437,7 @@ - + @@ -115443,7 +115445,7 @@ - + @@ -115463,7 +115465,7 @@ - + @@ -115477,7 +115479,7 @@ - + @@ -115494,7 +115496,7 @@ - + @@ -115508,7 +115510,7 @@ - + @@ -115522,7 +115524,7 @@ - + @@ -115530,7 +115532,7 @@ - + @@ -115544,7 +115546,7 @@ - + @@ -115555,7 +115557,7 @@ - + @@ -115572,7 +115574,7 @@ - + @@ -115580,7 +115582,7 @@ - + @@ -115588,7 +115590,7 @@ - + @@ -115599,7 +115601,7 @@ - + @@ -115610,7 +115612,7 @@ - + @@ -115618,7 +115620,7 @@ - + @@ -115626,7 +115628,7 @@ - + @@ -115643,7 +115645,7 @@ - + @@ -115666,7 +115668,7 @@ - + @@ -115674,7 +115676,7 @@ - + @@ -115685,7 +115687,7 @@ - + @@ -115693,7 +115695,7 @@ - + @@ -115704,7 +115706,7 @@ - + @@ -115712,7 +115714,7 @@ - + @@ -115723,7 +115725,7 @@ - + @@ -115734,7 +115736,7 @@ - + @@ -115742,7 +115744,7 @@ - + @@ -115753,12 +115755,12 @@ - + - + @@ -115766,7 +115768,7 @@ - + @@ -115774,7 +115776,7 @@ - + @@ -115782,7 +115784,7 @@ - + @@ -115790,12 +115792,12 @@ - + - + @@ -115803,7 +115805,7 @@ - + @@ -115811,7 +115813,7 @@ - + @@ -115819,7 +115821,7 @@ - + @@ -115827,7 +115829,7 @@ - + @@ -115835,7 +115837,7 @@ - + @@ -115843,7 +115845,7 @@ - + @@ -115884,7 +115886,7 @@ - + @@ -115898,7 +115900,7 @@ - + @@ -115924,7 +115926,7 @@ - + @@ -115992,7 +115994,7 @@ - + @@ -116003,7 +116005,7 @@ - + @@ -116020,7 +116022,7 @@ - + @@ -116064,7 +116066,7 @@ - + @@ -116075,7 +116077,7 @@ - + @@ -116086,7 +116088,7 @@ - + @@ -116106,7 +116108,7 @@ - + @@ -116114,7 +116116,7 @@ - + @@ -116131,7 +116133,7 @@ - + @@ -116160,7 +116162,7 @@ - + @@ -116177,7 +116179,7 @@ - + @@ -116191,17 +116193,17 @@ - + - + - + @@ -116209,7 +116211,7 @@ - + @@ -116220,7 +116222,7 @@ - + @@ -116228,12 +116230,12 @@ - + - + @@ -116274,7 +116276,7 @@ - + @@ -116282,7 +116284,7 @@ - + @@ -116290,7 +116292,7 @@ - + @@ -116301,7 +116303,7 @@ - + @@ -116315,7 +116317,7 @@ - + @@ -116335,7 +116337,7 @@ - + @@ -116343,7 +116345,7 @@ - + @@ -116351,7 +116353,7 @@ - + @@ -116359,7 +116361,7 @@ - + @@ -116370,7 +116372,7 @@ - + @@ -116378,7 +116380,7 @@ - + @@ -116389,7 +116391,7 @@ - + @@ -116397,17 +116399,17 @@ - + - + - + @@ -116415,8 +116417,8 @@ - - + + @@ -116430,12 +116432,12 @@ - + - + @@ -116443,12 +116445,12 @@ - + - + @@ -116456,12 +116458,12 @@ - + - + @@ -116472,7 +116474,7 @@ - + @@ -116480,7 +116482,7 @@ - + @@ -116491,7 +116493,7 @@ - + @@ -116505,7 +116507,7 @@ - + @@ -116516,7 +116518,7 @@ - + @@ -116530,7 +116532,7 @@ - + @@ -116550,7 +116552,7 @@ - + @@ -116561,7 +116563,7 @@ - + @@ -116575,7 +116577,7 @@ - + @@ -116592,12 +116594,12 @@ - + - + @@ -116611,7 +116613,7 @@ - + @@ -116634,7 +116636,7 @@ - + @@ -122521,7 +122523,7 @@ - + @@ -124058,7 +124060,7 @@ - + @@ -127084,7 +127086,7 @@ - + @@ -127658,11 +127660,11 @@ - - - - - + + + + + @@ -128449,9 +128451,9 @@ - - - + + + @@ -128511,9 +128513,9 @@ - - - + + + @@ -129112,9 +129114,9 @@ - - - + + + @@ -132584,6 +132586,14 @@ + + + + + + + + @@ -133289,6 +133299,7 @@ + @@ -133806,7 +133817,7 @@ - + @@ -133920,9 +133931,9 @@ - - - + + + @@ -134028,11 +134039,11 @@ - - - - - + + + + + @@ -134069,9 +134080,9 @@ - - - + + + @@ -143848,9 +143859,9 @@ - - - + + + @@ -143866,14 +143877,14 @@ - - - + + + - - - + + + @@ -144969,10 +144980,10 @@ - - - - + + + + @@ -145098,8 +145109,8 @@ - - + + @@ -146724,7 +146735,7 @@ - + @@ -147915,8 +147926,8 @@ - - + + @@ -150704,7 +150715,7 @@ - + @@ -150730,7 +150741,7 @@ - + @@ -151754,15 +151765,15 @@ - - - - - + + + + + - - + + @@ -157392,11 +157403,11 @@ - + - - + + @@ -159459,9 +159470,9 @@ - - - + + + diff --git a/android/abi_gki_aarch64_amlogic b/android/abi_gki_aarch64_amlogic index df8691c9dd27..bcc9b65184ae 100644 --- a/android/abi_gki_aarch64_amlogic +++ b/android/abi_gki_aarch64_amlogic @@ -536,6 +536,7 @@ drm_atomic_helper_resume drm_atomic_helper_set_config drm_atomic_helper_setup_commit + drm_atomic_helper_shutdown drm_atomic_helper_suspend drm_atomic_helper_swap_state drm_atomic_helper_update_plane @@ -647,6 +648,8 @@ drm_poll drm_prime_gem_destroy drm_printf + __drm_printfn_coredump + __drm_printfn_seq_file drm_property_add_enum drm_property_blob_get drm_property_blob_put @@ -657,9 +660,12 @@ drm_property_destroy drm_property_lookup_blob drm_property_replace_blob + __drm_puts_coredump + __drm_puts_seq_file drm_read drm_release drm_self_refresh_helper_update_avg_times + drm_state_dump drm_universal_plane_init drm_vblank_init drm_writeback_connector_init @@ -1986,6 +1992,7 @@ __traceiter_mmap_lock_acquire_returned __traceiter_mmap_lock_released __traceiter_mmap_lock_start_locking + __traceiter_mm_page_alloc __traceiter_rwmmio_post_read __traceiter_rwmmio_post_write __traceiter_rwmmio_read @@ -2030,6 +2037,7 @@ __tracepoint_mmap_lock_acquire_returned __tracepoint_mmap_lock_released __tracepoint_mmap_lock_start_locking + __tracepoint_mm_page_alloc tracepoint_probe_register tracepoint_probe_unregister __tracepoint_rwmmio_post_read From 10277013993b09d0358a2fb275807b787440a8c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aaro=20M=C3=A4kinen?= Date: Wed, 25 Oct 2023 21:47:54 +0300 Subject: [PATCH 13/31] ANDROID: GKI: Update symbol list for Tuxera MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 4 function symbol(s) added 'int block_read_full_page(struct page *, get_block_t *)' 'void inode_add_bytes(struct inode *, loff_t)' 'int try_to_free_buffers(struct page *)' 'int utf32_to_utf8(unicode_t, u8 *, int)' 1 variable symbol(s) added 'unsigned int dirty_writeback_interval' Bug: 307761441 Change-Id: I32c48bc74937b3d82abd0534f3afd731fe36db34 Signed-off-by: Aaro Mäkinen --- android/abi_gki_aarch64.xml | 27 ++++++++++++++++++++++++++- android/abi_gki_aarch64_tuxera | 5 +++++ 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 8d45467966db..c0a8ab98eecc 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -1192,6 +1192,7 @@ + @@ -3401,6 +3402,7 @@ + @@ -6103,6 +6105,7 @@ + @@ -6587,6 +6590,7 @@ + @@ -7586,6 +7590,7 @@ + @@ -135124,6 +135129,11 @@ + + + + + @@ -139607,6 +139617,7 @@ + @@ -146768,6 +146779,11 @@ + + + + + @@ -160706,6 +160722,10 @@ + + + + @@ -163116,6 +163136,12 @@ + + + + + + @@ -165477,7 +165503,6 @@ - diff --git a/android/abi_gki_aarch64_tuxera b/android/abi_gki_aarch64_tuxera index 5b5f71f66653..80093f21a417 100644 --- a/android/abi_gki_aarch64_tuxera +++ b/android/abi_gki_aarch64_tuxera @@ -23,6 +23,7 @@ blk_start_plug __blockdev_direct_IO block_invalidatepage block_is_partially_uptodate +block_read_full_page __breadahead __bread_gfp __brelse @@ -49,6 +50,7 @@ delete_from_page_cache d_instantiate d_make_root d_obtain_alias +dirty_writeback_interval down_read down_write down_write_trylock @@ -104,6 +106,7 @@ __init_rwsem init_special_inode init_wait_entry __init_waitqueue_head +inode_add_bytes inode_dio_wait inode_init_once inode_init_owner @@ -255,6 +258,7 @@ truncate_inode_pages truncate_inode_pages_final truncate_pagecache truncate_setsize +try_to_free_buffers try_to_release_page try_to_writeback_inodes_sb __ubsan_handle_cfi_check_fail_abort @@ -266,6 +270,7 @@ unmap_mapping_range unregister_filesystem up_read up_write +utf32_to_utf8 vfree vfs_fsync_range __vmalloc From a82ccd72a629e7c8d26be14551b907e931b962ef Mon Sep 17 00:00:00 2001 From: Yoshihiro Shimoda Date: Thu, 5 Oct 2023 10:12:00 +0900 Subject: [PATCH 14/31] UPSTREAM: ravb: Fix up dma_free_coherent() call in ravb_remove() [ Upstream commit e6864af61493113558c502b5cd0d754c19b93277 ] In ravb_remove(), dma_free_coherent() should be call after unregister_netdev(). Otherwise, this controller is possible to use the freed buffer. Bug: 289003868 Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Signed-off-by: Yoshihiro Shimoda Reviewed-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20231005011201.14368-2-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin (cherry picked from commit 3f9295ad7f9478e65debcef496da4e4eb83db5ea) Signed-off-by: Lee Jones Change-Id: I8e7da5816f715307c7d8bcd881a2a5ecb52439bb --- drivers/net/ethernet/renesas/ravb_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c index 4ee72d33e9cb..a866a38ebea5 100644 --- a/drivers/net/ethernet/renesas/ravb_main.c +++ b/drivers/net/ethernet/renesas/ravb_main.c @@ -2382,14 +2382,14 @@ static int ravb_remove(struct platform_device *pdev) clk_disable_unprepare(priv->refclk); - dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, - priv->desc_bat_dma); /* Set reset mode */ ravb_write(ndev, CCC_OPC_RESET, CCC); unregister_netdev(ndev); netif_napi_del(&priv->napi[RAVB_NC]); netif_napi_del(&priv->napi[RAVB_BE]); ravb_mdio_release(priv); + dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, + priv->desc_bat_dma); pm_runtime_put_sync(&pdev->dev); pm_runtime_disable(&pdev->dev); reset_control_assert(priv->rstc); From ff6428453d8e843eea131c1d5cdbb730ca6cf4d9 Mon Sep 17 00:00:00 2001 From: Yoshihiro Shimoda Date: Thu, 5 Oct 2023 10:12:01 +0900 Subject: [PATCH 15/31] UPSTREAM: ravb: Fix use-after-free issue in ravb_tx_timeout_work() [ Upstream commit 3971442870713de527684398416970cf025b4f89 ] The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like below: CPU0 CPU1 ravb_tx_timeout() ravb_remove() unregister_netdev() free_netdev(ndev) // free priv ravb_tx_timeout_work() // use priv unregister_netdev() will call .ndo_stop() so that ravb_stop() is called. And, after phy_stop() is called, netif_carrier_off() is also called. So that .ndo_tx_timeout() will not be called after phy_stop(). Bug: 289003868 Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Reported-by: Zheng Wang Closes: https://lore.kernel.org/netdev/20230725030026.1664873-1-zyytlz.wz@163.com/ Signed-off-by: Yoshihiro Shimoda Reviewed-by: Sergey Shtylyov Link: https://lore.kernel.org/r/20231005011201.14368-3-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin (cherry picked from commit 6f6fa8061f756aedb93af12a8a5d3cf659127965) Signed-off-by: Lee Jones Change-Id: I36fcd769d93817adaa04162cae0b54b1addbb9bf --- drivers/net/ethernet/renesas/ravb_main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c index a866a38ebea5..19733c9a7c25 100644 --- a/drivers/net/ethernet/renesas/ravb_main.c +++ b/drivers/net/ethernet/renesas/ravb_main.c @@ -1774,6 +1774,8 @@ static int ravb_close(struct net_device *ndev) of_phy_deregister_fixed_link(np); } + cancel_work_sync(&priv->work); + if (info->multi_irqs) { free_irq(priv->tx_irqs[RAVB_NC], ndev); free_irq(priv->rx_irqs[RAVB_NC], ndev); From 0f24a9edd057e74e2ddc1bc071e073591665b68b Mon Sep 17 00:00:00 2001 From: Avichal Rakesh Date: Fri, 2 Jun 2023 15:04:55 -0700 Subject: [PATCH 16/31] UPSTREAM: usb: gadget: uvc: clean up comments and styling in video_pump This patch elaborates on some of the edge cases handled by video_pump around setting no_interrupt flag, and brings the code style in line with rest of the file. Link: https://lore.kernel.org/20230602151916.GH26944@pendragon.ideasonboard.com/ Signed-off-by: Avichal Rakesh Reviewed-by: Laurent Pinchart Message-ID: <20230602220455.313801-1-arakesh@google.com> Signed-off-by: Greg Kroah-Hartman Bug: 301887900 Change-Id: Ie5f28e8d8f55158e32e0ff03b79f0f18cce7d6af (cherry picked from commit 5ae8a35459e77fd9ddb1844baa8c736fc0223847 https://kernel.googlesource.com/pub/scm/linux/kernel/git/gregkh/usb usb-next) Signed-off-by: Avichal Rakesh --- drivers/usb/gadget/function/uvc_video.c | 38 ++++++++++++++++--------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c index e81865978299..91af3b1ef0d4 100644 --- a/drivers/usb/gadget/function/uvc_video.c +++ b/drivers/usb/gadget/function/uvc_video.c @@ -382,13 +382,13 @@ static void uvcg_video_pump(struct work_struct *work) { struct uvc_video *video = container_of(work, struct uvc_video, pump); struct uvc_video_queue *queue = &video->queue; + /* video->max_payload_size is only set when using bulk transfer */ + bool is_bulk = video->max_payload_size; struct usb_request *req = NULL; struct uvc_buffer *buf; unsigned long flags; + bool buf_done; int ret; - bool buf_int; - /* video->max_payload_size is only set when using bulk transfer */ - bool is_bulk = video->max_payload_size; while (video->ep->enabled) { /* @@ -414,20 +414,19 @@ static void uvcg_video_pump(struct work_struct *work) if (buf != NULL) { video->encode(req, video, buf); - /* Always interrupt for the last request of a video buffer */ - buf_int = buf->state == UVC_BUF_STATE_DONE; + buf_done = buf->state == UVC_BUF_STATE_DONE; } else if (!(queue->flags & UVC_QUEUE_DISCONNECTED) && !is_bulk) { /* * No video buffer available; the queue is still connected and - * we're traferring over ISOC. Queue a 0 length request to + * we're transferring over ISOC. Queue a 0 length request to * prevent missed ISOC transfers. */ req->length = 0; - buf_int = false; + buf_done = false; } else { /* - * Either queue has been disconnected or no video buffer - * available to bulk transfer. Either way, stop processing + * Either the queue has been disconnected or no video buffer + * available for bulk transfer. Either way, stop processing * further. */ spin_unlock_irqrestore(&queue->irqlock, flags); @@ -435,11 +434,24 @@ static void uvcg_video_pump(struct work_struct *work) } /* - * With usb3 we have more requests. This will decrease the - * interrupt load to a quarter but also catches the corner - * cases, which needs to be handled. + * With USB3 handling more requests at a higher speed, we can't + * afford to generate an interrupt for every request. Decide to + * interrupt: + * + * - When no more requests are available in the free queue, as + * this may be our last chance to refill the endpoint's + * request queue. + * + * - When this is request is the last request for the video + * buffer, as we want to start sending the next video buffer + * ASAP in case it doesn't get started already in the next + * iteration of this loop. + * + * - Four times over the length of the requests queue (as + * indicated by video->uvc_num_requests), as a trade-off + * between latency and interrupt load. */ - if (list_empty(&video->req_free) || buf_int || + if (list_empty(&video->req_free) || buf_done || !(video->req_int_count % DIV_ROUND_UP(video->uvc_num_requests, 4))) { video->req_int_count = 0; From b153f0c5b29b2d087b8543749f55a3e1bae0613b Mon Sep 17 00:00:00 2001 From: Yue Haibing Date: Fri, 18 Aug 2023 20:40:25 +0800 Subject: [PATCH 17/31] UPSTREAM: usb: gadget: function: Remove unused declarations These declarations are not implemented anymore, remove them. Signed-off-by: Yue Haibing Link: https://lore.kernel.org/r/20230818124025.51576-1-yuehaibing@huawei.com Signed-off-by: Greg Kroah-Hartman Bug: 301887900 Change-Id: Ib1ac4d7ecada70d467cd9b2d688f13ba3797a05c (cherry picked from commit ae257611573cde279d31be3961a59e255f567fb0 https://kernel.googlesource.com/pub/scm/linux/kernel/git/gregkh/usb usb-next) Signed-off-by: Avichal Rakesh --- drivers/usb/gadget/function/u_phonet.h | 1 - drivers/usb/gadget/function/u_serial.h | 4 ---- drivers/usb/gadget/function/uvc.h | 2 -- 3 files changed, 7 deletions(-) diff --git a/drivers/usb/gadget/function/u_phonet.h b/drivers/usb/gadget/function/u_phonet.h index c53233b37192..ff62ca22c40d 100644 --- a/drivers/usb/gadget/function/u_phonet.h +++ b/drivers/usb/gadget/function/u_phonet.h @@ -20,7 +20,6 @@ struct f_phonet_opts { struct net_device *gphonet_setup_default(void); void gphonet_set_gadget(struct net_device *net, struct usb_gadget *g); int gphonet_register_netdev(struct net_device *net); -int phonet_bind_config(struct usb_configuration *c, struct net_device *dev); void gphonet_cleanup(struct net_device *dev); #endif /* __U_PHONET_H */ diff --git a/drivers/usb/gadget/function/u_serial.h b/drivers/usb/gadget/function/u_serial.h index 102a7323a1fd..901d99310bc4 100644 --- a/drivers/usb/gadget/function/u_serial.h +++ b/drivers/usb/gadget/function/u_serial.h @@ -71,8 +71,4 @@ void gserial_disconnect(struct gserial *); void gserial_suspend(struct gserial *p); void gserial_resume(struct gserial *p); -/* functions are bound to configurations by a config or gadget driver */ -int gser_bind_config(struct usb_configuration *c, u8 port_num); -int obex_bind_config(struct usb_configuration *c, u8 port_num); - #endif /* __U_SERIAL_H */ diff --git a/drivers/usb/gadget/function/uvc.h b/drivers/usb/gadget/function/uvc.h index 40226b1f7e14..289c5611e138 100644 --- a/drivers/usb/gadget/function/uvc.h +++ b/drivers/usb/gadget/function/uvc.h @@ -176,8 +176,6 @@ struct uvc_file_handle { */ extern void uvc_function_setup_continue(struct uvc_device *uvc); -extern void uvc_endpoint_stream(struct uvc_device *dev); - extern void uvc_function_connect(struct uvc_device *uvc); extern void uvc_function_disconnect(struct uvc_device *uvc); From 85156cffb2200dc3da0b855320ed2861b47fc190 Mon Sep 17 00:00:00 2001 From: Linyu Yuan Date: Thu, 3 Aug 2023 17:10:49 +0800 Subject: [PATCH 18/31] UPSTREAM: usb: gadget: f_uvc: change endpoint allocation in uvc_function_bind() when call uvc_function_bind(), gadget still have no connection speed, just follow other gadget function, use fs endpoint descriptor to allocate a video endpoint, remove gadget_is_{super|dual}speed() API call. Signed-off-by: Linyu Yuan Link: https://lore.kernel.org/r/20230803091053.9714-4-quic_linyyuan@quicinc.com Signed-off-by: Greg Kroah-Hartman Bug: 301887900 Change-Id: I076e51716e4bab7a70a43ad3e080b4c4e110c9db (cherry picked from commit 3c5b006f3ee800b4bd9ed37b3a8f271b8560126e https://kernel.googlesource.com/pub/scm/linux/kernel/git/gregkh/usb usb-next) Signed-off-by: Avichal Rakesh --- drivers/usb/gadget/function/f_uvc.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c index 32f2c1645467..429ec4e86f45 100644 --- a/drivers/usb/gadget/function/f_uvc.c +++ b/drivers/usb/gadget/function/f_uvc.c @@ -673,21 +673,13 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f) } uvc->control_ep = ep; - if (gadget_is_superspeed(c->cdev->gadget)) - ep = usb_ep_autoconfig_ss(cdev->gadget, &uvc_ss_streaming_ep, - &uvc_ss_streaming_comp); - else if (gadget_is_dualspeed(cdev->gadget)) - ep = usb_ep_autoconfig(cdev->gadget, &uvc_hs_streaming_ep); - else - ep = usb_ep_autoconfig(cdev->gadget, &uvc_fs_streaming_ep); - + ep = usb_ep_autoconfig(cdev->gadget, &uvc_fs_streaming_ep); if (!ep) { uvcg_info(f, "Unable to allocate streaming EP\n"); goto error; } uvc->video.ep = ep; - uvc_fs_streaming_ep.bEndpointAddress = uvc->video.ep->address; uvc_hs_streaming_ep.bEndpointAddress = uvc->video.ep->address; uvc_ss_streaming_ep.bEndpointAddress = uvc->video.ep->address; From df15bb1463b6b3f244ced71ddf66b54db64c0376 Mon Sep 17 00:00:00 2001 From: Linyu Yuan Date: Thu, 3 Aug 2023 17:10:50 +0800 Subject: [PATCH 19/31] BACKPORT: usb: gadget: unconditionally allocate hs/ss descriptor in bind operation Take f_midi_bind() for example, when composite layer call it, it will allocate hs descriptor by calling gadget_is_dualspeed() API to check gadget max support speed capability, but most other gadget function didn't do like this. To follow other function drivers, it is safe to remove the check which mean support all possible link speed by default in function driver. Similar change apply to midi2 and uvc. Also in midi and midi2, as there is no descriptor difference between super speed and super speed plus, follow other gadget function drivers, do not allocate descriptor for super speed plus, composite layer will handle it properly. Signed-off-by: Linyu Yuan Link: https://lore.kernel.org/r/20230803091053.9714-5-quic_linyyuan@quicinc.com Signed-off-by: Greg Kroah-Hartman Bug: 301887900 Change-Id: I8b287266b3973c66e559bd3eea9adbe95e051be7 (cherry picked from commit 46decc82ffd54212cc2c600031daec6e835a6503 https://kernel.googlesource.com/pub/scm/linux/kernel/git/gregkh/usb usb-next) [arakesh: f_midi2.c doesn't exist, so dropped those changes] Signed-off-by: Avichal Rakesh --- drivers/usb/gadget/function/f_midi.c | 56 ++++++++++++---------------- drivers/usb/gadget/function/f_uvc.c | 26 ++++++------- 2 files changed, 35 insertions(+), 47 deletions(-) diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c index 0e78da6fc091..7eddfdad8183 100644 --- a/drivers/usb/gadget/function/f_midi.c +++ b/drivers/usb/gadget/function/f_midi.c @@ -1023,40 +1023,30 @@ static int f_midi_bind(struct usb_configuration *c, struct usb_function *f) if (!f->fs_descriptors) goto fail_f_midi; - if (gadget_is_dualspeed(c->cdev->gadget)) { - bulk_in_desc.wMaxPacketSize = cpu_to_le16(512); - bulk_out_desc.wMaxPacketSize = cpu_to_le16(512); - f->hs_descriptors = usb_copy_descriptors(midi_function); - if (!f->hs_descriptors) - goto fail_f_midi; - } + bulk_in_desc.wMaxPacketSize = cpu_to_le16(512); + bulk_out_desc.wMaxPacketSize = cpu_to_le16(512); + f->hs_descriptors = usb_copy_descriptors(midi_function); + if (!f->hs_descriptors) + goto fail_f_midi; - if (gadget_is_superspeed(c->cdev->gadget)) { - bulk_in_desc.wMaxPacketSize = cpu_to_le16(1024); - bulk_out_desc.wMaxPacketSize = cpu_to_le16(1024); - i = endpoint_descriptor_index; - midi_function[i++] = (struct usb_descriptor_header *) - &bulk_out_desc; - midi_function[i++] = (struct usb_descriptor_header *) - &bulk_out_ss_comp_desc; - midi_function[i++] = (struct usb_descriptor_header *) - &ms_out_desc; - midi_function[i++] = (struct usb_descriptor_header *) - &bulk_in_desc; - midi_function[i++] = (struct usb_descriptor_header *) - &bulk_in_ss_comp_desc; - midi_function[i++] = (struct usb_descriptor_header *) - &ms_in_desc; - f->ss_descriptors = usb_copy_descriptors(midi_function); - if (!f->ss_descriptors) - goto fail_f_midi; - - if (gadget_is_superspeed_plus(c->cdev->gadget)) { - f->ssp_descriptors = usb_copy_descriptors(midi_function); - if (!f->ssp_descriptors) - goto fail_f_midi; - } - } + bulk_in_desc.wMaxPacketSize = cpu_to_le16(1024); + bulk_out_desc.wMaxPacketSize = cpu_to_le16(1024); + i = endpoint_descriptor_index; + midi_function[i++] = (struct usb_descriptor_header *) + &bulk_out_desc; + midi_function[i++] = (struct usb_descriptor_header *) + &bulk_out_ss_comp_desc; + midi_function[i++] = (struct usb_descriptor_header *) + &ms_out_desc; + midi_function[i++] = (struct usb_descriptor_header *) + &bulk_in_desc; + midi_function[i++] = (struct usb_descriptor_header *) + &bulk_in_ss_comp_desc; + midi_function[i++] = (struct usb_descriptor_header *) + &ms_in_desc; + f->ss_descriptors = usb_copy_descriptors(midi_function); + if (!f->ss_descriptors) + goto fail_f_midi; kfree(midi_function); diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c index 429ec4e86f45..7a55900083a4 100644 --- a/drivers/usb/gadget/function/f_uvc.c +++ b/drivers/usb/gadget/function/f_uvc.c @@ -718,21 +718,19 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f) f->fs_descriptors = NULL; goto error; } - if (gadget_is_dualspeed(cdev->gadget)) { - f->hs_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_HIGH); - if (IS_ERR(f->hs_descriptors)) { - ret = PTR_ERR(f->hs_descriptors); - f->hs_descriptors = NULL; - goto error; - } + + f->hs_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_HIGH); + if (IS_ERR(f->hs_descriptors)) { + ret = PTR_ERR(f->hs_descriptors); + f->hs_descriptors = NULL; + goto error; } - if (gadget_is_superspeed(c->cdev->gadget)) { - f->ss_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_SUPER); - if (IS_ERR(f->ss_descriptors)) { - ret = PTR_ERR(f->ss_descriptors); - f->ss_descriptors = NULL; - goto error; - } + + f->ss_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_SUPER); + if (IS_ERR(f->ss_descriptors)) { + ret = PTR_ERR(f->ss_descriptors); + f->ss_descriptors = NULL; + goto error; } /* Preallocate control endpoint request. */ From 373d8674e6435eb3855e26e8cade57a950bebb3e Mon Sep 17 00:00:00 2001 From: Shuzhen Wang Date: Fri, 27 Oct 2023 11:34:40 -0700 Subject: [PATCH 20/31] BACKPORT: usb: gadget: uvc: Add missing initialization of ssp config descriptor In case the uvc gadget is super speed plus, the corresponding config descriptor wasn't initialized. As a result, the host will not recognize the devices when using super speed plus connection. This patch initializes them to super speed descriptors. Reviewed-by: Laurent Pinchart Signed-off-by: Shuzhen Wang Link: https://lore.kernel.org/r/20231027183440.1994315-1-shuzhenwang@google.com Signed-off-by: Greg Kroah-Hartman Bug: 301887900 Change-Id: I79c699bafaf959990da3a8101c8bfe0f8dabf72f (cherry picked from commit c70793fb7632a153862ee9060e6d48131469a29c https://kernel.googlesource.com/pub/scm/linux/kernel/git/gregkh/usb usb-next) [arakesh: Resolved minor merge conflicts in f_uvc.c] Signed-off-by: Avichal Rakesh --- drivers/usb/gadget/function/f_uvc.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c index 7a55900083a4..8eca4aff215c 100644 --- a/drivers/usb/gadget/function/f_uvc.c +++ b/drivers/usb/gadget/function/f_uvc.c @@ -492,6 +492,7 @@ uvc_copy_descriptors(struct uvc_device *uvc, enum usb_device_speed speed) void *mem; switch (speed) { + case USB_SPEED_SUPER_PLUS: case USB_SPEED_SUPER: uvc_control_desc = uvc->desc.ss_control; uvc_streaming_cls = uvc->desc.ss_streaming; @@ -536,7 +537,8 @@ uvc_copy_descriptors(struct uvc_device *uvc, enum usb_device_speed speed) + uvc_control_ep.bLength + uvc_control_cs_ep.bLength + uvc_streaming_intf_alt0.bLength; - if (speed == USB_SPEED_SUPER) { + if (speed == USB_SPEED_SUPER || + speed == USB_SPEED_SUPER_PLUS) { bytes += uvc_ss_control_comp.bLength; n_desc = 6; } else { @@ -580,7 +582,8 @@ uvc_copy_descriptors(struct uvc_device *uvc, enum usb_device_speed speed) uvc_control_header->baInterfaceNr[0] = uvc->streaming_intf; UVC_COPY_DESCRIPTOR(mem, dst, &uvc_control_ep); - if (speed == USB_SPEED_SUPER) + if (speed == USB_SPEED_SUPER + || speed == USB_SPEED_SUPER_PLUS) UVC_COPY_DESCRIPTOR(mem, dst, &uvc_ss_control_comp); UVC_COPY_DESCRIPTOR(mem, dst, &uvc_control_cs_ep); @@ -733,6 +736,13 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f) goto error; } + f->ssp_descriptors = uvc_copy_descriptors(uvc, USB_SPEED_SUPER_PLUS); + if (IS_ERR(f->ssp_descriptors)) { + ret = PTR_ERR(f->ssp_descriptors); + f->ssp_descriptors = NULL; + goto error; + } + /* Preallocate control endpoint request. */ uvc->control_req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL); uvc->control_buf = kmalloc(UVC_MAX_REQUEST_SIZE, GFP_KERNEL); From c85178cecaaf9206cb7e7742fa3a655f3bdb119f Mon Sep 17 00:00:00 2001 From: Kyle Zeng Date: Tue, 5 Sep 2023 15:04:09 -0700 Subject: [PATCH 21/31] UPSTREAM: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878 upstream. The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to slab out-of-bound access. This patch adds back the IP_SET_HASH_WITH_NET0 macro to ip_set_hash_netportnet to address the issue. Bug: 302199939 Fixes: 886503f34d63 ("netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net") Suggested-by: Jozsef Kadlecsik Signed-off-by: Kyle Zeng Acked-by: Jozsef Kadlecsik Signed-off-by: Florian Westphal Signed-off-by: Greg Kroah-Hartman (cherry picked from commit a9e6142e5f8f6ac7d1bca45c1b2b13b084ea9e14) Signed-off-by: Lee Jones Change-Id: I11cc1650e7df9d54041164b6bdb01f3a0de46de4 --- net/netfilter/ipset/ip_set_hash_netportnet.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c index 005a7ce87217..bf4f91b78e1d 100644 --- a/net/netfilter/ipset/ip_set_hash_netportnet.c +++ b/net/netfilter/ipset/ip_set_hash_netportnet.c @@ -36,6 +36,7 @@ MODULE_ALIAS("ip_set_hash:net,port,net"); #define IP_SET_HASH_WITH_PROTO #define IP_SET_HASH_WITH_NETS #define IPSET_NET_COUNT 2 +#define IP_SET_HASH_WITH_NET0 /* IPv4 variant */ From 85ccc4a25c6007d2ac4284565b1864f9abd44808 Mon Sep 17 00:00:00 2001 From: "cathy.cai" Date: Thu, 2 Nov 2023 10:19:23 +0800 Subject: [PATCH 22/31] ANDROID: ABI: Update symbols to unisoc whitelist Update whitelist for the symbols used by the unisoc in abi_gki_aarch64_unisoc. Also changes happened to the abi_gki_aarch64.xml file. 1 symbol(s) added 'u16 vlan_dev_vlan_id(const struct net_device *dev)' 2 symbol(s) added 'struct net_device *vlan_dev_real_dev(const struct net_device *dev)' Bug: 308822565 Change-Id: Ia27c300c5716608a3732333e0a5dce64dfd93461 Signed-off-by: cathy.cai --- android/abi_gki_aarch64.xml | 483 +-------------------------------- android/abi_gki_aarch64_unisoc | 2 + 2 files changed, 14 insertions(+), 471 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index c0a8ab98eecc..a6cab6f5267f 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -6838,6 +6838,8 @@ + + @@ -9274,7 +9276,6 @@ - @@ -9859,7 +9860,6 @@ - @@ -12912,17 +12912,6 @@ - - - - - - - - - - - @@ -14175,14 +14164,6 @@ - - - - - - - - @@ -19812,12 +19793,6 @@ - - - - - - @@ -20806,7 +20781,6 @@ - @@ -20879,7 +20853,6 @@ - @@ -21405,7 +21378,6 @@ - @@ -23050,206 +23022,7 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + @@ -25542,7 +25315,6 @@ - @@ -27940,7 +27712,6 @@ - @@ -29182,7 +28953,6 @@ - @@ -29759,7 +29529,6 @@ - @@ -31044,7 +30813,6 @@ - @@ -39668,14 +39436,6 @@ - - - - - - - - @@ -40375,13 +40135,6 @@ - - - - - - - @@ -43502,7 +43255,6 @@ - @@ -44825,7 +44577,6 @@ - @@ -47688,12 +47439,6 @@ - - - - - - @@ -48831,14 +48576,6 @@ - - - - - - - - @@ -50676,7 +50413,6 @@ - @@ -50885,12 +50621,6 @@ - - - - - - @@ -53897,7 +53627,6 @@ - @@ -57033,14 +56762,6 @@ - - - - - - - - @@ -57781,10 +57502,6 @@ - - - - @@ -59017,20 +58734,6 @@ - - - - - - - - - - - - - - @@ -59941,12 +59644,6 @@ - - - - - - @@ -61762,7 +61459,6 @@ - @@ -62205,7 +61901,6 @@ - @@ -62888,7 +62583,6 @@ - @@ -63543,14 +63237,6 @@ - - - - - - - - @@ -63695,15 +63381,6 @@ - - - - - - - - - @@ -63981,11 +63658,6 @@ - - - - - @@ -64487,20 +64159,6 @@ - - - - - - - - - - - - - - @@ -65735,7 +65393,6 @@ - @@ -69819,10 +69476,6 @@ - - - - @@ -69939,32 +69592,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -70410,7 +70037,6 @@ - @@ -76720,17 +76346,6 @@ - - - - - - - - - - - @@ -76875,7 +76490,6 @@ - @@ -79760,7 +79374,6 @@ - @@ -80657,7 +80270,6 @@ - @@ -84899,7 +84511,6 @@ - @@ -87545,11 +87156,6 @@ - - - - - @@ -89178,7 +88784,6 @@ - @@ -93105,7 +92710,6 @@ - @@ -93556,7 +93160,6 @@ - @@ -94244,7 +93847,6 @@ - @@ -96263,7 +95865,6 @@ - @@ -96337,7 +95938,6 @@ - @@ -97554,12 +97154,6 @@ - - - - - - @@ -104088,17 +103682,6 @@ - - - - - - - - - - - @@ -105702,7 +105285,6 @@ - @@ -106218,14 +105800,6 @@ - - - - - - - - @@ -107759,17 +107333,6 @@ - - - - - - - - - - - @@ -107964,17 +107527,6 @@ - - - - - - - - - - - @@ -110853,11 +110405,6 @@ - - - - - @@ -119019,7 +118566,6 @@ - @@ -122068,20 +121614,6 @@ - - - - - - - - - - - - - - @@ -164471,6 +164003,14 @@ + + + + + + + + @@ -165503,6 +165043,7 @@ + diff --git a/android/abi_gki_aarch64_unisoc b/android/abi_gki_aarch64_unisoc index b7fc09497d26..01d9e74bd802 100644 --- a/android/abi_gki_aarch64_unisoc +++ b/android/abi_gki_aarch64_unisoc @@ -2354,6 +2354,8 @@ skb_copy_bits skb_vlan_untag unregister_netdevice_notifier + vlan_dev_real_dev + vlan_dev_vlan_id # required by sha1-ce.ko crypto_sha1_finup From f0033a7e61fa3995499e4c36781fab1b2b61f5ec Mon Sep 17 00:00:00 2001 From: Zhezhe Song Date: Mon, 6 Nov 2023 12:42:53 +0800 Subject: [PATCH 23/31] ANDROID: abi_gki_aarch64_qcom: Update QCOM symbol list Only update QCOM abi-list with usb-net related APIs They are already in abi_gki_aarch64.xml. 27 function symbol(s) added dev_get_tstats64 eth_platform_mac_address generic_mii_ioctl mii_check_media mii_ethtool_gset usb_autopm_get_interface_async usb_autopm_put_interface_async usbnet_disconnect usbnet_get_endpoints usbnet_get_msglevel usbnet_link_change usbnet_nway_reset usbnet_open usbnet_probe usbnet_read_cmd usbnet_read_cmd_nopm usbnet_resume usbnet_set_msglevel usbnet_skb_return usbnet_start_xmit usbnet_stop usbnet_suspend usbnet_tx_timeout usbnet_update_max_qlen usbnet_write_cmd usbnet_write_cmd_async usbnet_write_cmd_nopm Bug: 309359608 Change-Id: I062391bafa884cec6b7be5794077c3398e598c05 Signed-off-by: Zhezhe Song --- android/abi_gki_aarch64_qcom | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/android/abi_gki_aarch64_qcom b/android/abi_gki_aarch64_qcom index 69fa29593a39..80c9e4ec27e9 100644 --- a/android/abi_gki_aarch64_qcom +++ b/android/abi_gki_aarch64_qcom @@ -375,6 +375,7 @@ dev_get_by_name dev_get_by_name_rcu dev_get_regmap + dev_get_tstats64 device_add device_add_disk device_add_groups @@ -698,6 +699,7 @@ ethnl_cable_test_pulse ethnl_cable_test_result ethnl_cable_test_step + eth_platform_get_mac_address ethtool_convert_legacy_u32_to_link_mode ethtool_convert_link_mode_to_legacy_u32 eventfd_ctx_fdget @@ -765,6 +767,7 @@ generic_handle_domain_irq generic_handle_irq generic_iommu_put_resv_regions + generic_mii_ioctl geni_icc_disable geni_icc_enable geni_icc_get @@ -1296,6 +1299,8 @@ migrate_pages migrate_swap __migrate_task + mii_check_media + mii_ethtool_gset mipi_dsi_dcs_set_tear_off misc_deregister misc_register @@ -2573,6 +2578,8 @@ usb_alloc_coherent usb_alloc_dev usb_assign_descriptors + usb_autopm_get_interface_async + usb_autopm_put_interface_async usb_bus_idr usb_bus_idr_lock usb_composite_setup_continue @@ -2601,6 +2608,26 @@ usb_interface_id usb_mon_deregister usb_mon_register + usbnet_disconnect + usbnet_get_endpoints + usbnet_get_msglevel + usbnet_link_change + usbnet_nway_reset + usbnet_open + usbnet_probe + usbnet_read_cmd + usbnet_read_cmd_nopm + usbnet_resume + usbnet_set_msglevel + usbnet_skb_return + usbnet_start_xmit + usbnet_stop + usbnet_suspend + usbnet_tx_timeout + usbnet_update_max_qlen + usbnet_write_cmd + usbnet_write_cmd_async + usbnet_write_cmd_nopm usb_phy_set_charger_current usb_pipe_type_check usb_put_function_instance From e4cb5eaa4286d13b1966eb9e8c002338f558fc22 Mon Sep 17 00:00:00 2001 From: Peter Wang Date: Wed, 27 Sep 2023 11:35:57 +0800 Subject: [PATCH 24/31] FROMGIT: ufs: core: wlun send SSU timeout recovery When runtime pm send SSU times out, the SCSI core invokes eh_host_reset_handler, which hooks function ufshcd_eh_host_reset_handler schedule eh_work and stuck at wait flush_work(&hba->eh_work). However, ufshcd_err_handler hangs in wait rpm resume. Do link recovery only in this case. Below is IO hang stack dump in kernel-6.1 kworker/4:0 D __switch_to+0x180/0x344 __schedule+0x5ec/0xa14 schedule+0x78/0xe0 schedule_timeout+0xb0/0x15c io_schedule_timeout+0x48/0x70 do_wait_for_common+0x108/0x19c wait_for_completion_io_timeout+0x50/0x78 blk_execute_rq+0x1b8/0x218 scsi_execute_cmd+0x148/0x238 ufshcd_set_dev_pwr_mode+0xe8/0x244 __ufshcd_wl_resume+0x1e0/0x45c ufshcd_wl_runtime_resume+0x3c/0x174 scsi_runtime_resume+0x7c/0xc8 __rpm_callback+0xa0/0x410 rpm_resume+0x43c/0x67c __rpm_callback+0x1f0/0x410 rpm_resume+0x460/0x67c pm_runtime_work+0xa4/0xac process_one_work+0x208/0x598 worker_thread+0x228/0x438 kthread+0x104/0x1d4 ret_from_fork+0x10/0x20 scsi_eh_0 D __switch_to+0x180/0x344 __schedule+0x5ec/0xa14 schedule+0x78/0xe0 schedule_timeout+0x44/0x15c do_wait_for_common+0x108/0x19c wait_for_completion+0x48/0x64 __flush_work+0x260/0x2d0 flush_work+0x10/0x20 ufshcd_eh_host_reset_handler+0x88/0xcc scsi_try_host_reset+0x48/0xe0 scsi_eh_ready_devs+0x934/0xa40 scsi_error_handler+0x168/0x374 kthread+0x104/0x1d4 ret_from_fork+0x10/0x20 kworker/u16:5 D __switch_to+0x180/0x344 __schedule+0x5ec/0xa14 schedule+0x78/0xe0 rpm_resume+0x114/0x67c __pm_runtime_resume+0x70/0xb4 ufshcd_err_handler+0x1a0/0xe68 process_one_work+0x208/0x598 worker_thread+0x228/0x438 kthread+0x104/0x1d4 ret_from_fork+0x10/0x20 (cherry picked from commit 971237b900c38f50e7865289a2aecb77dc7f09f3 https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git for-next) Link: https://lore.kernel.org/all/20230927033557.13801-1-peter.wang@mediatek.com/ Change-Id: I51d4ddec2be7ef71fd333ca7658539f38eeb8c31 Signed-off-by: Peter Wang Reviewed-by: Bart Van Assche Reviewed-by: Stanley Chu Signed-off-by: Peng Zhou --- drivers/scsi/ufs/ufshcd.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index 264cde1003a1..d4199f3a7dea 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -7318,6 +7318,20 @@ static int ufshcd_eh_host_reset_handler(struct scsi_cmnd *cmd) hba = shost_priv(cmd->device->host); + /* + * If runtime pm send SSU and got timeout, scsi_error_handler + * stuck at this function to wait for flush_work(&hba->eh_work). + * And ufshcd_err_handler(eh_work) stuck at wait for runtime pm active. + * Do ufshcd_link_recovery instead schedule eh_work can prevent + * dead lock to happen. + */ + if (hba->pm_op_in_progress) { + if (ufshcd_link_recovery(hba)) + err = FAILED; + + return err; + } + spin_lock_irqsave(hba->host->host_lock, flags); hba->force_reset = true; ufshcd_schedule_eh_work(hba); From 46b8053e2a3aafda4abe72004d9cf09b8fca0368 Mon Sep 17 00:00:00 2001 From: Stefano Garzarella Date: Mon, 25 Sep 2023 12:30:57 +0200 Subject: [PATCH 25/31] UPSTREAM: vringh: don't use vringh_kiov_advance() in vringh_iov_xfer() commit 7aed44babc7f97e82b38e9a68515e699692cc100 upstream. In the while loop of vringh_iov_xfer(), `partlen` could be 0 if one of the `iov` has 0 lenght. In this case, we should skip the iov and go to the next one. But calling vringh_kiov_advance() with 0 lenght does not cause the advancement, since it returns immediately if asked to advance by 0 bytes. Let's restore the code that was there before commit b8c06ad4d67d ("vringh: implement vringh_kiov_advance()"), avoiding using vringh_kiov_advance(). Bug: 302200656 Fixes: b8c06ad4d67d ("vringh: implement vringh_kiov_advance()") Cc: stable@vger.kernel.org Reported-by: Jason Wang Signed-off-by: Stefano Garzarella Acked-by: Jason Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 3a72decd6b49ff11a894aabd4d9b3025f046fe61) Signed-off-by: Lee Jones Change-Id: I5ed14650aca07e0f8d52023cf148bd63e87d04c9 --- drivers/vhost/vringh.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c index 786876af0a73..13b75213ebaa 100644 --- a/drivers/vhost/vringh.c +++ b/drivers/vhost/vringh.c @@ -123,8 +123,18 @@ static inline ssize_t vringh_iov_xfer(struct vringh *vrh, done += partlen; len -= partlen; ptr += partlen; + iov->consumed += partlen; + iov->iov[iov->i].iov_len -= partlen; + iov->iov[iov->i].iov_base += partlen; - vringh_kiov_advance(iov, partlen); + if (!iov->iov[iov->i].iov_len) { + /* Fix up old iov element then increment. */ + iov->iov[iov->i].iov_len = iov->consumed; + iov->iov[iov->i].iov_base -= iov->consumed; + + iov->consumed = 0; + iov->i++; + } } return done; } From 29ee4272dc34e3f2c5936c5e148c04c15f3d8f0b Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Thu, 26 Oct 2023 19:57:38 +0530 Subject: [PATCH 26/31] UPSTREAM: firmware_loader: Refactor kill_pending_fw_fallback_reqs() Rename 'only_kill_custom' and refactor logic related to it to be more meaningful. Bug: 309378049 Change-Id: I119d2f8c29b9b624e6c1d8546c1533d76a2cc51d Signed-off-by: Mukesh Ojha Acked-by: Luis Chamberlain Link: https://lore.kernel.org/r/1698330459-31776-1-git-send-email-quic_mojha@quicinc.com Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 87ffa98eeee8d62a56afdad80ea697e7a6e5c354) Signed-off-by: Srinivasarao Pathipati --- drivers/base/firmware_loader/fallback.c | 4 ++-- drivers/base/firmware_loader/fallback.h | 4 ++-- drivers/base/firmware_loader/main.c | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c index d7d63c1aa993..ad11ba7cdc01 100644 --- a/drivers/base/firmware_loader/fallback.c +++ b/drivers/base/firmware_loader/fallback.c @@ -106,7 +106,7 @@ static void fw_load_abort(struct fw_sysfs *fw_sysfs) static LIST_HEAD(pending_fw_head); -void kill_pending_fw_fallback_reqs(bool only_kill_custom) +void kill_pending_fw_fallback_reqs(bool kill_all) { struct fw_priv *fw_priv; struct fw_priv *next; @@ -114,7 +114,7 @@ void kill_pending_fw_fallback_reqs(bool only_kill_custom) mutex_lock(&fw_lock); list_for_each_entry_safe(fw_priv, next, &pending_fw_head, pending_list) { - if (!fw_priv->need_uevent || !only_kill_custom) + if (kill_all || !fw_priv->need_uevent) __fw_load_abort(fw_priv); } mutex_unlock(&fw_lock); diff --git a/drivers/base/firmware_loader/fallback.h b/drivers/base/firmware_loader/fallback.h index 3af7205b302f..1d9476d16a01 100644 --- a/drivers/base/firmware_loader/fallback.h +++ b/drivers/base/firmware_loader/fallback.h @@ -35,7 +35,7 @@ int firmware_fallback_sysfs(struct firmware *fw, const char *name, struct device *device, u32 opt_flags, int ret); -void kill_pending_fw_fallback_reqs(bool only_kill_custom); +void kill_pending_fw_fallback_reqs(bool kill_all); void fw_fallback_set_cache_timeout(void); void fw_fallback_set_default_timeout(void); @@ -52,7 +52,7 @@ static inline int firmware_fallback_sysfs(struct firmware *fw, const char *name, return ret; } -static inline void kill_pending_fw_fallback_reqs(bool only_kill_custom) { } +static inline void kill_pending_fw_fallback_reqs(bool kill_all) { } static inline void fw_fallback_set_cache_timeout(void) { } static inline void fw_fallback_set_default_timeout(void) { } diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c index e74e5d0644b5..2eb85499a350 100644 --- a/drivers/base/firmware_loader/main.c +++ b/drivers/base/firmware_loader/main.c @@ -1525,10 +1525,10 @@ static int fw_pm_notify(struct notifier_block *notify_block, case PM_SUSPEND_PREPARE: case PM_RESTORE_PREPARE: /* - * kill pending fallback requests with a custom fallback - * to avoid stalling suspend. + * Here, kill pending fallback requests will only kill + * non-uevent firmware request to avoid stalling suspend. */ - kill_pending_fw_fallback_reqs(true); + kill_pending_fw_fallback_reqs(false); device_cache_fw_images(); break; @@ -1613,7 +1613,7 @@ static int fw_shutdown_notify(struct notifier_block *unused1, * Kill all pending fallback requests to avoid both stalling shutdown, * and avoid a deadlock with the usermode_lock. */ - kill_pending_fw_fallback_reqs(false); + kill_pending_fw_fallback_reqs(true); return NOTIFY_DONE; } From e3eb2bbc882ee63b12b0c30640dd86c2493c28d5 Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Thu, 26 Oct 2023 19:57:39 +0530 Subject: [PATCH 27/31] BACKPORT: firmware_loader: Abort all upcoming firmware load request once reboot triggered There could be following scenario where there is a ongoing reboot is going from processA which tries to call all the reboot notifier callback and one of them is firmware reboot call which tries to abort all the ongoing firmware userspace request under fw_lock but there could be another processB which tries to do request firmware, which came just after abort done from ProcessA and ask for userspace to load the firmware and this can stop the ongoing reboot ProcessA to stall for next 60s(default timeout) which may not be expected behaviour everyone like to see, instead we should abort any firmware load request which came once firmware knows about the reboot through notification. ProcessA ProcessB kernel_restart_prepare blocking_notifier_call_chain fw_shutdown_notify kill_pending_fw_fallback_reqs __fw_load_abort fw_state_aborted request_firmware __fw_state_set firmware_fallback_sysfs ... fw_load_from_user_helper .. ... . .. usermodehelper_read_trylock fw_load_sysfs_fallback fw_sysfs_wait_timeout usermodehelper_disable __usermodehelper_disable down_write() Bug: 309378049 Change-Id: I61eb91f21a01460f340f890b25c60de7597a87ff Signed-off-by: Mukesh Ojha Acked-by: Luis Chamberlain Link: https://lore.kernel.org/r/1698330459-31776-2-git-send-email-quic_mojha@quicinc.com Signed-off-by: Greg Kroah-Hartman (cherry picked from commit effd7c70eaa0440688b60b9d419243695ede3c45) Signed-off-by: Srinivasarao Pathipati --- drivers/base/firmware_loader/fallback.c | 6 +++++- drivers/base/firmware_loader/firmware.h | 1 + drivers/base/firmware_loader/main.c | 1 + 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c index ad11ba7cdc01..00f0c234e5c5 100644 --- a/drivers/base/firmware_loader/fallback.c +++ b/drivers/base/firmware_loader/fallback.c @@ -117,6 +117,10 @@ void kill_pending_fw_fallback_reqs(bool kill_all) if (kill_all || !fw_priv->need_uevent) __fw_load_abort(fw_priv); } + + if (kill_all) + fw_load_abort_all = true; + mutex_unlock(&fw_lock); } @@ -511,7 +515,7 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, long timeout) } mutex_lock(&fw_lock); - if (fw_state_is_aborted(fw_priv)) { + if (fw_load_abort_all || fw_state_is_aborted(fw_priv)) { mutex_unlock(&fw_lock); retval = -EINTR; goto out; diff --git a/drivers/base/firmware_loader/firmware.h b/drivers/base/firmware_loader/firmware.h index a3014e9e2c85..53e08de04b86 100644 --- a/drivers/base/firmware_loader/firmware.h +++ b/drivers/base/firmware_loader/firmware.h @@ -87,6 +87,7 @@ struct fw_priv { }; extern struct mutex fw_lock; +extern bool fw_load_abort_all; static inline bool __fw_state_check(struct fw_priv *fw_priv, enum fw_status status) diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c index 2eb85499a350..cada3c3018e0 100644 --- a/drivers/base/firmware_loader/main.c +++ b/drivers/base/firmware_loader/main.c @@ -92,6 +92,7 @@ static inline struct fw_priv *to_fw_priv(struct kref *ref) DEFINE_MUTEX(fw_lock); static struct firmware_cache fw_cache; +bool fw_load_abort_all; /* Builtin firmware support */ From 6dcfedcb7cf5ac7ddd3c71ee1500d0e33384a489 Mon Sep 17 00:00:00 2001 From: Yafang Shao Date: Wed, 19 Jan 2022 18:08:43 -0800 Subject: [PATCH 28/31] UPSTREAM: kthread: dynamically allocate memory to store kthread's full name When I was implementing a new per-cpu kthread cfs_migration, I found the comm of it "cfs_migration/%u" is truncated due to the limitation of TASK_COMM_LEN. For example, the comm of the percpu thread on CPU10~19 all have the same name "cfs_migration/1", which will confuse the user. This issue is not critical, because we can get the corresponding CPU from the task's Cpus_allowed. But for kthreads corresponding to other hardware devices, it is not easy to get the detailed device info from task comm, for example, jbd2/nvme0n1p2- xfs-reclaim/sdf Currently there are so many truncated kthreads: rcu_tasks_kthre rcu_tasks_rude_ rcu_tasks_trace poll_mpt3sas0_s ext4-rsv-conver xfs-reclaim/sd{a, b, c, ...} xfs-blockgc/sd{a, b, c, ...} xfs-inodegc/sd{a, b, c, ...} audit_send_repl ecryptfs-kthrea vfio-irqfd-clea jbd2/nvme0n1p2- ... We can shorten these names to work around this problem, but it may be not applied to all of the truncated kthreads. Take 'jbd2/nvme0n1p2-' for example, it is a nice name, and it is not a good idea to shorten it. One possible way to fix this issue is extending the task comm size, but as task->comm is used in lots of places, that may cause some potential buffer overflows. Another more conservative approach is introducing a new pointer to store kthread's full name if it is truncated, which won't introduce too much overhead as it is in the non-critical path. Finally we make a dicision to use the second approach. See also the discussions in this thread: https://lore.kernel.org/lkml/20211101060419.4682-1-laoar.shao@gmail.com/ After this change, the full name of these truncated kthreads will be displayed via /proc/[pid]/comm: rcu_tasks_kthread rcu_tasks_rude_kthread rcu_tasks_trace_kthread poll_mpt3sas0_statu ext4-rsv-conversion xfs-reclaim/sdf1 xfs-blockgc/sdf1 xfs-inodegc/sdf1 audit_send_reply ecryptfs-kthread vfio-irqfd-cleanup jbd2/nvme0n1p2-8 Bug: 309706715 Change-Id: Ib3f176d2738ad547dbd8beb83c89ebdb5a9e476d (cherry picked from commit d6986ce24fc00b0638bd29efe8fb7ba7619ed2aa) Link: https://lkml.kernel.org/r/20211120112850.46047-1-laoar.shao@gmail.com Signed-off-by: Yafang Shao Reviewed-by: David Hildenbrand Reviewed-by: Petr Mladek Suggested-by: Petr Mladek Suggested-by: Steven Rostedt Cc: Mathieu Desnoyers Cc: Arnaldo Carvalho de Melo Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Michal Miroslaw Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Matthew Wilcox Cc: Al Viro Cc: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Zhiguo Niu --- fs/proc/array.c | 3 +++ include/linux/kthread.h | 1 + kernel/kthread.c | 32 ++++++++++++++++++++++++++++++-- 3 files changed, 34 insertions(+), 2 deletions(-) diff --git a/fs/proc/array.c b/fs/proc/array.c index 49be8c8ef555..860e4deafa65 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -92,6 +92,7 @@ #include #include #include +#include #include #include "internal.h" @@ -102,6 +103,8 @@ void proc_task_name(struct seq_file *m, struct task_struct *p, bool escape) if (p->flags & PF_WQ_WORKER) wq_worker_comm(tcomm, sizeof(tcomm), p); + else if (p->flags & PF_KTHREAD) + get_kthread_comm(tcomm, sizeof(tcomm), p); else __get_task_comm(tcomm, sizeof(tcomm), p); diff --git a/include/linux/kthread.h b/include/linux/kthread.h index db47aae7c481..a1810374eaa9 100644 --- a/include/linux/kthread.h +++ b/include/linux/kthread.h @@ -33,6 +33,7 @@ struct task_struct *kthread_create_on_cpu(int (*threadfn)(void *data), unsigned int cpu, const char *namefmt); +void get_kthread_comm(char *buf, size_t buf_size, struct task_struct *tsk); void set_kthread_struct(struct task_struct *p); void kthread_set_per_cpu(struct task_struct *k, int cpu); diff --git a/kernel/kthread.c b/kernel/kthread.c index 296b3327768e..f4dfd7d43d44 100644 --- a/kernel/kthread.c +++ b/kernel/kthread.c @@ -60,6 +60,8 @@ struct kthread { #ifdef CONFIG_BLK_CGROUP struct cgroup_subsys_state *blkcg_css; #endif + /* To store the full name if task comm is truncated. */ + char *full_name; }; enum KTHREAD_BITS { @@ -93,6 +95,18 @@ static inline struct kthread *__to_kthread(struct task_struct *p) return kthread; } +void get_kthread_comm(char *buf, size_t buf_size, struct task_struct *tsk) +{ + struct kthread *kthread = to_kthread(tsk); + + if (!kthread || !kthread->full_name) { + __get_task_comm(buf, buf_size, tsk); + return; + } + + strscpy_pad(buf, kthread->full_name, buf_size); +} + void set_kthread_struct(struct task_struct *p) { struct kthread *kthread; @@ -118,9 +132,13 @@ void free_kthread_struct(struct task_struct *k) * or if kmalloc() in kthread() failed. */ kthread = to_kthread(k); + if (!kthread) + return; + #ifdef CONFIG_BLK_CGROUP - WARN_ON_ONCE(kthread && kthread->blkcg_css); + WARN_ON_ONCE(kthread->blkcg_css); #endif + kfree(kthread->full_name); kfree(kthread); } @@ -399,12 +417,22 @@ struct task_struct *__kthread_create_on_node(int (*threadfn)(void *data), if (!IS_ERR(task)) { static const struct sched_param param = { .sched_priority = 0 }; char name[TASK_COMM_LEN]; + va_list aq; + int len; /* * task is already visible to other tasks, so updating * COMM must be protected. */ - vsnprintf(name, sizeof(name), namefmt, args); + va_copy(aq, args); + len = vsnprintf(name, sizeof(name), namefmt, aq); + va_end(aq); + if (len >= TASK_COMM_LEN) { + struct kthread *kthread = to_kthread(task); + + /* leave it truncated when out of memory. */ + kthread->full_name = kvasprintf(GFP_KERNEL, namefmt, args); + } set_task_comm(task, name); /* * root may have changed our (kthreadd's) priority or CPU mask. From cd7989c58bc7ae4317caa49e97e867249703e4ec Mon Sep 17 00:00:00 2001 From: "qinglin.li" Date: Mon, 6 Nov 2023 15:02:04 +0800 Subject: [PATCH 29/31] ANDROID: mm: add vendor hook in isolate_freepages() By this vh, so that we can skip if this page needs to be treated specially, like as cma. In the Android kernel, the use of cma is restricted, and filecache cannot use cma.But during the memory compaction process, filecache may be migrated to cma pool, so a judgment needs to be added here to restrict filecache from entering cma. Bug: 309371168 Change-Id: I3ec29bdf5f7b6ac4c7af0a317aa41ad77b71444d Signed-off-by: Qinglin Li --- drivers/android/vendor_hooks.c | 1 + include/trace/hooks/mm.h | 4 ++++ mm/compaction.c | 5 +++++ 3 files changed, 10 insertions(+) diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c index 7e8788469d2a..5d67ca6962d6 100644 --- a/drivers/android/vendor_hooks.c +++ b/drivers/android/vendor_hooks.c @@ -461,6 +461,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_cma_alloc_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_enable_thermal_genl_check); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_xhci_urb_suitable_bypass); EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_alloc_pages_entry); +EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_isolate_freepages); /* * For type visibility */ diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h index e4f166f05131..16062481bcb8 100644 --- a/include/trace/hooks/mm.h +++ b/include/trace/hooks/mm.h @@ -32,6 +32,7 @@ struct track; struct address_space; struct page_vma_mapped_walk; struct cma; +struct compact_control; DECLARE_RESTRICTED_HOOK(android_rvh_set_skip_swapcache_flags, TP_PROTO(gfp_t *flags), @@ -258,6 +259,9 @@ DECLARE_HOOK(android_vh_alloc_pages_entry, TP_PROTO(gfp_t *gfp, unsigned int order, int preferred_nid, nodemask_t *nodemask), TP_ARGS(gfp, order, preferred_nid, nodemask)); +DECLARE_HOOK(android_vh_isolate_freepages, + TP_PROTO(struct compact_control *cc, struct page *page, bool *bypass), + TP_ARGS(cc, page, bypass)); #endif /* _TRACE_HOOK_MM_H */ /* This part must be outside protection */ diff --git a/mm/compaction.c b/mm/compaction.c index 2c024dc73c7d..98630c07d591 100644 --- a/mm/compaction.c +++ b/mm/compaction.c @@ -1601,6 +1601,7 @@ static void isolate_freepages(struct compact_control *cc) unsigned long low_pfn; /* lowest pfn scanner is able to scan */ struct list_head *freelist = &cc->freepages; unsigned int stride; + bool bypass = false; /* Try a small search of the free lists for a candidate */ isolate_start_pfn = fast_isolate_freepages(cc); @@ -1656,6 +1657,10 @@ static void isolate_freepages(struct compact_control *cc) if (!isolation_suitable(cc, page)) continue; + trace_android_vh_isolate_freepages(cc, page, &bypass); + if (bypass) + continue; + /* Found a block suitable for isolating free pages from. */ nr_isolated = isolate_freepages_block(cc, &isolate_start_pfn, block_end_pfn, freelist, stride, false); From 690e148c4df8986ec5460f1d27876ec768cbdf12 Mon Sep 17 00:00:00 2001 From: "qinglin.li" Date: Mon, 6 Nov 2023 16:11:51 +0800 Subject: [PATCH 30/31] ANDROID: GKI: Update symbol list for Amlogic 1 function symbol(s) added 'int __traceiter_android_vh_isolate_freepages(void*, struct compact_control*, struct page*, bool*)' 1 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_isolate_freepages' Bug: 309371168 Change-Id: I441742a55ab6e5192b2ce512ae41dd9099112cfa Signed-off-by: Qinglin Li --- android/abi_gki_aarch64.xml | 1242 +++++++++++++++++++++---------- android/abi_gki_aarch64_amlogic | 2 + 2 files changed, 863 insertions(+), 381 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index a6cab6f5267f..96d7496ca38d 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -617,6 +617,7 @@ + @@ -7300,6 +7301,7 @@ + @@ -9276,6 +9278,7 @@ + @@ -9860,6 +9863,7 @@ + @@ -12912,6 +12916,17 @@ + + + + + + + + + + + @@ -14164,6 +14179,14 @@ + + + + + + + + @@ -19793,6 +19816,12 @@ + + + + + + @@ -20781,6 +20810,7 @@ + @@ -20853,6 +20883,7 @@ + @@ -21378,6 +21409,7 @@ + @@ -23022,7 +23054,206 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -25315,6 +25546,7 @@ + @@ -27712,6 +27944,7 @@ + @@ -28953,6 +29186,7 @@ + @@ -29529,6 +29763,7 @@ + @@ -30813,6 +31048,7 @@ + @@ -39436,6 +39672,14 @@ + + + + + + + + @@ -40135,6 +40379,13 @@ + + + + + + + @@ -43255,6 +43506,7 @@ + @@ -44577,6 +44829,7 @@ + @@ -47439,6 +47692,12 @@ + + + + + + @@ -48576,6 +48835,14 @@ + + + + + + + + @@ -50413,6 +50680,7 @@ + @@ -50621,6 +50889,12 @@ + + + + + + @@ -53627,6 +53901,7 @@ + @@ -56762,6 +57037,14 @@ + + + + + + + + @@ -57502,6 +57785,10 @@ + + + + @@ -58734,6 +59021,20 @@ + + + + + + + + + + + + + + @@ -59644,6 +59945,12 @@ + + + + + + @@ -61459,6 +61766,7 @@ + @@ -61901,6 +62209,7 @@ + @@ -62583,6 +62892,7 @@ + @@ -63237,6 +63547,14 @@ + + + + + + + + @@ -63381,6 +63699,15 @@ + + + + + + + + + @@ -63658,6 +63985,11 @@ + + + + + @@ -64159,6 +64491,20 @@ + + + + + + + + + + + + + + @@ -65393,6 +65739,7 @@ + @@ -69476,6 +69823,10 @@ + + + + @@ -69592,6 +69943,32 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -70037,6 +70414,7 @@ + @@ -76346,6 +76724,17 @@ + + + + + + + + + + + @@ -76490,6 +76879,7 @@ + @@ -79374,6 +79764,7 @@ + @@ -80270,6 +80661,7 @@ + @@ -84511,6 +84903,7 @@ + @@ -87156,6 +87549,11 @@ + + + + + @@ -88784,6 +89182,7 @@ + @@ -92710,6 +93109,7 @@ + @@ -93160,6 +93560,7 @@ + @@ -93847,6 +94248,7 @@ + @@ -95865,6 +96267,7 @@ + @@ -95938,6 +96341,7 @@ + @@ -97154,6 +97558,12 @@ + + + + + + @@ -103682,6 +104092,17 @@ + + + + + + + + + + + @@ -105285,6 +105706,7 @@ + @@ -105800,6 +106222,14 @@ + + + + + + + + @@ -107333,6 +107763,17 @@ + + + + + + + + + + + @@ -107527,6 +107968,17 @@ + + + + + + + + + + + @@ -110405,6 +110857,11 @@ + + + + + @@ -118566,6 +119023,7 @@ + @@ -121614,6 +122072,20 @@ + + + + + + + + + + + + + + @@ -127070,7 +127542,7 @@ - + @@ -129355,9 +129827,9 @@ - - - + + + @@ -129713,9 +130185,9 @@ - - - + + + @@ -129893,9 +130365,9 @@ - - - + + + @@ -129905,14 +130377,14 @@ - - - + + + - - - + + + @@ -130006,10 +130478,10 @@ - - - - + + + + @@ -130051,11 +130523,11 @@ - - - - - + + + + + @@ -130088,48 +130560,48 @@ - - - - + + + + - - - + + + - - - - - - + + + + + + - - - - - - - + + + + + + + - - - - - - - + + + + + + + - - - - - + + + + + @@ -130154,9 +130626,9 @@ - - - + + + @@ -130387,11 +130859,11 @@ - - - - - + + + + + @@ -130450,43 +130922,43 @@ - - - - - + + + + + - - - + + + - - - - - - - - + + + + + + + + - - - - + + + + - - - - + + + + - - - + + + @@ -130547,11 +131019,11 @@ - - - - - + + + + + @@ -130566,10 +131038,10 @@ - - - - + + + + @@ -130599,12 +131071,12 @@ - - - - - - + + + + + + @@ -130614,9 +131086,9 @@ - - - + + + @@ -130625,14 +131097,14 @@ - - - - - - - - + + + + + + + + @@ -130680,9 +131152,9 @@ - - - + + + @@ -130696,14 +131168,14 @@ - - - - - - - - + + + + + + + + @@ -130711,12 +131183,12 @@ - - - - - - + + + + + + @@ -130892,6 +131364,13 @@ + + + + + + + @@ -130904,18 +131383,18 @@ - - - - - + + + + + - - - - - + + + + + @@ -130925,11 +131404,11 @@ - - - - - + + + + + @@ -130944,18 +131423,18 @@ - - - - - - + + + + + + - - - - + + + + @@ -130964,16 +131443,16 @@ - - - - + + + + - - - - + + + + @@ -130994,47 +131473,47 @@ - - - + + + - - - + + + - - - - + + + + - - - - + + + + - - - + + + - - - + + + - - - + + + - - - - + + + + @@ -131170,17 +131649,17 @@ - - - - + + + + - - - - - + + + + + @@ -131191,10 +131670,10 @@ - - - - + + + + @@ -131213,10 +131692,10 @@ - - - - + + + + @@ -131230,9 +131709,9 @@ - - - + + + @@ -131272,10 +131751,10 @@ - - - - + + + + @@ -131308,37 +131787,37 @@ - - - - - - - - + + + + + + + + - - - - - - + + + + + + - - - - - + + + + + - - - - - - + + + + + + @@ -131438,10 +131917,10 @@ - - - - + + + + @@ -131507,9 +131986,9 @@ - - - + + + @@ -131533,26 +132012,26 @@ - - - - - - - - - + + + + + + + + + - - - + + + - - - - + + + + @@ -131580,11 +132059,11 @@ - - - - - + + + + + @@ -131613,9 +132092,9 @@ - - - + + + @@ -131639,11 +132118,11 @@ - - - - - + + + + + @@ -131663,12 +132142,12 @@ - - - - - - + + + + + + @@ -131677,13 +132156,13 @@ - - - - - - - + + + + + + + @@ -131857,20 +132336,20 @@ - - - - - + + + + + - - - - - - - + + + + + + + @@ -131884,15 +132363,15 @@ - - - + + + - - - - + + + + @@ -132398,7 +132877,7 @@ - + @@ -132453,7 +132932,7 @@ - + @@ -132481,10 +132960,10 @@ - + - - + + @@ -132500,28 +132979,28 @@ - + - + - - - - - - + + + + + + - + @@ -132555,7 +133034,7 @@ - + @@ -132565,12 +133044,12 @@ - - - - - - + + + + + + @@ -132580,19 +133059,19 @@ - + - + - + - + - + @@ -132600,12 +133079,12 @@ - + - + - + @@ -132634,29 +133113,30 @@ + - - + + - + - - + + - - + + - - - - - - - - + + + + + + + + @@ -132680,33 +133160,33 @@ - - + + - + - + - + - + - - - - + + + + @@ -132725,7 +133205,7 @@ - + @@ -132737,34 +133217,34 @@ - + - - - + + + - + - + - + - + - + @@ -132792,12 +133272,12 @@ - - + + - - + + diff --git a/android/abi_gki_aarch64_amlogic b/android/abi_gki_aarch64_amlogic index bcc9b65184ae..e7e892e84c71 100644 --- a/android/abi_gki_aarch64_amlogic +++ b/android/abi_gki_aarch64_amlogic @@ -1979,6 +1979,7 @@ __traceiter_android_vh_ftrace_format_check __traceiter_android_vh_iommu_iovad_free_iova __traceiter_android_vh_ipi_stop + __traceiter_android_vh_isolate_freepages __traceiter_android_vh_mem_cgroup_alloc __traceiter_android_vh_mmc_sd_update_cmdline_timing __traceiter_android_vh_mmc_sd_update_dataline_timing @@ -2024,6 +2025,7 @@ __tracepoint_android_vh_ftrace_format_check __tracepoint_android_vh_iommu_iovad_free_iova __tracepoint_android_vh_ipi_stop + __tracepoint_android_vh_isolate_freepages __tracepoint_android_vh_mem_cgroup_alloc __tracepoint_android_vh_mmc_sd_update_cmdline_timing __tracepoint_android_vh_mmc_sd_update_dataline_timing From d8156345d8c56a2b082c1877eaee48a22c33014f Mon Sep 17 00:00:00 2001 From: Dongyun Liu Date: Thu, 9 Nov 2023 15:33:02 +0800 Subject: [PATCH 31/31] ANDROID: GKI: Add symbol list for Transsion Add symbol list for Transsion 1 variable symbol(s) added 'unsigned long avenrun[3]' Bug: 309886726 Change-Id: Ic15627b2d6f2cf379b00bac36ec148ba56eeac63 Signed-off-by: Dongyun Liu --- BUILD.bazel | 1 + android/abi_gki_aarch64.xml | 3 ++- android/abi_gki_aarch64_transsion | 2 ++ build.config.gki.aarch64 | 1 + 4 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 android/abi_gki_aarch64_transsion diff --git a/BUILD.bazel b/BUILD.bazel index 4b253225eb23..3a63587af890 100644 --- a/BUILD.bazel +++ b/BUILD.bazel @@ -35,6 +35,7 @@ _aarch64_additional_kmi_symbol_lists = [ "android/abi_gki_aarch64_rtktv", "android/abi_gki_aarch64_sony", "android/abi_gki_aarch64_sunxi", + "android/abi_gki_aarch64_transsion", "android/abi_gki_aarch64_tuxera", "android/abi_gki_aarch64_type_visibility", "android/abi_gki_aarch64_unisoc", diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 96d7496ca38d..7b95edda57b5 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -7554,6 +7554,7 @@ + @@ -134266,6 +134267,7 @@ + @@ -165523,7 +165525,6 @@ - diff --git a/android/abi_gki_aarch64_transsion b/android/abi_gki_aarch64_transsion new file mode 100644 index 000000000000..4f0126a8151c --- /dev/null +++ b/android/abi_gki_aarch64_transsion @@ -0,0 +1,2 @@ +[abi_symbol_list] + avenrun diff --git a/build.config.gki.aarch64 b/build.config.gki.aarch64 index 49abc212ebb6..0a04fe765c97 100644 --- a/build.config.gki.aarch64 +++ b/build.config.gki.aarch64 @@ -42,6 +42,7 @@ android/abi_gki_aarch64_sunxi android/abi_gki_aarch64_pasa android/abi_gki_aarch64_zeku android/abi_gki_aarch64_lenovo +android/abi_gki_aarch64_transsion " FILES="${FILES}