From 59d826468078a51b683e550b9ea9f2a1f2dce870 Mon Sep 17 00:00:00 2001 From: Jaegeuk Kim Date: Wed, 27 Oct 2021 09:07:09 -0700 Subject: [PATCH 1/6] ANDROID: f2fs: fix potential deadlock by android ftrace sb_internal#2 --> &s->s_dquot.dqio_sem --> fs_reclaim Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(&s->s_dquot.dqio_sem); lock(fs_reclaim); lock(sb_internal#2); *** DEADLOCK *** 3 locks held by kswapd0/133: #0: ffffffda597c93a8 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x4/0x50 #1: ffffffda597bc890 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab+0xa0/0x19c #2: ffffff80d5fb90e0 (&type->s_umount_key#50){.+.+}-{3:3}, at: super_cache_scan+0x40/0x1dc stack backtrace: CPU: 7 PID: 133 Comm: kswapd0 Tainted: G W O 5.10.43-android12-9-g4665ec64f3df #1 Hardware name: MT6879(ENG) (DT) Call trace: dump_backtrace.cfi_jt+0x0/0x8 show_stack+0x1c/0x2c dump_stack_lvl+0xd8/0x16c print_circular_bug+0x2d4/0x2d8 check_noncircular+0x190/0x1a4 validate_chain+0xc54/0x2d34 __lock_acquire+0x7e4/0xed4 lock_acquire+0x114/0x394 f2fs_evict_inode+0x1a0/0x8b8 evict+0xd4/0x2f8 iput+0x1c0/0x258 dentry_unlink_inode+0x16c/0x1dc __dentry_kill+0x128/0x280 shrink_dentry_list+0x6c/0x420 prune_dcache_sb+0x5c/0x90 super_cache_scan+0x13c/0x1dc do_shrink_slab+0x1e0/0x388 shrink_slab+0xf4/0x19c shrink_node_memcgs+0x80/0x25c shrink_node+0x324/0x710 balance_pgdat+0x3a8/0x6a8 kswapd+0x484/0x594 kthread+0x15c/0x1ac ret_from_fork+0x10/0x30 Bug: 201025620 Signed-off-by: Jaegeuk Kim Change-Id: Idaa303eb7c681a56ad5d4e1f6dddbda71f7fece4 --- fs/f2fs/data.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index a305081e6370..ea04d67d75aa 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -3350,7 +3350,13 @@ static int f2fs_write_begin(struct file *file, struct address_space *mapping, block_t blkaddr = NULL_ADDR; int err = 0; - if (trace_android_fs_datawrite_start_enabled()) { + /* + * Should avoid quota operations which can make deadlock: + * kswapd -> f2fs_evict_inode -> dquot_drop -> + * f2fs_dquot_commit -> f2fs_write_begin -> + * d_obtain_alias -> __d_alloc -> kmem_cache_alloc(GFP_KERNEL) + */ + if (trace_android_fs_datawrite_start_enabled() && !IS_NOQUOTA(inode)) { char *path, pathbuf[MAX_TRACE_PATHBUF_LEN]; path = android_fstrace_get_pathname(pathbuf, From 55cb12f0f8516120d3bd08ffafdba4a93cde4894 Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Fri, 22 Oct 2021 19:07:29 +0100 Subject: [PATCH 2/6] ANDROID: Incremental fs: Fix dentry get/put imbalance on vfs_mkdir() failure Syz{bot,kaller} reports[0]: BUG: Dentry ffff888119d8a000{i=0,n=.index} still in use (1) [unmount of ramfs ramfs] ------------[ cut here ]------------ WARNING: CPU: 0 PID: 367 at fs/dcache.c:1616 umount_check+0x18d/0x1d0 fs/dcache.c:1607 Modules linked in: CPU: 0 PID: 367 Comm: syz-executor388 Not tainted 5.10.75-syzkaller-01082-g234d53d2bb60 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:umount_check+0x18d/0x1d0 fs/dcache.c:1607 Code: 8b 0b 49 81 c6 f8 03 00 00 48 c7 c7 00 40 2e 85 4c 89 e6 48 8b 55 d0 4c 89 e1 45 89 f8 31 c0 41 56 e8 ae d9 9e ff 48 83 c4 08 <0f> 0b e9 f1 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c c9 fe ff RSP: 0018:ffffc9000096f770 EFLAGS: 00010292 RAX: 0000000000000055 RBX: ffffffff866af200 RCX: 1ad6b89836e5b500 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffc9000096f7a0 R08: ffffffff81545368 R09: 0000000000000003 R10: fffff5200012de41 R11: 0000000000000004 R12: ffff888119d8a000 R13: dffffc0000000000 R14: ffff88811d7373f8 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f01b7bddb68 CR3: 000000010c4f0000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_walk+0x309/0x540 fs/dcache.c:1326 do_one_tree fs/dcache.c:1623 [inline] shrink_dcache_for_umount+0x8e/0x1b0 fs/dcache.c:1639 generic_shutdown_super+0x66/0x2c0 fs/super.c:447 kill_anon_super fs/super.c:1108 [inline] kill_litter_super+0x75/0xa0 fs/super.c:1117 ramfs_kill_sb+0x44/0x50 fs/ramfs/inode.c:270 deactivate_locked_super+0xb0/0x100 fs/super.c:335 deactivate_super+0xa5/0xd0 fs/super.c:366 cleanup_mnt+0x45f/0x510 fs/namespace.c:1118 __cleanup_mnt+0x19/0x20 fs/namespace.c:1125 task_work_run+0x147/0x1b0 kernel/task_work.c:154 exit_task_work include/linux/task_work.h:30 [inline] do_exit+0x70e/0x23a0 kernel/exit.c:813 do_group_exit+0x16a/0x2d0 kernel/exit.c:910 get_signal+0x133e/0x1f80 kernel/signal.c:2790 arch_do_signal+0x8d/0x620 arch/x86/kernel/signal.c:805 exit_to_user_mode_loop kernel/entry/common.c:161 [inline] exit_to_user_mode_prepare+0xaa/0xe0 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x24/0x40 kernel/entry/common.c:266 do_syscall_64+0x3d/0x70 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f01b7b884f9 Code: Unable to access opcode bytes at RIP 0x7f01b7b884cf. RSP: 002b:00007f01b7b19308 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f01b7c103f8 RCX: 00007f Which was due to a missing dput() before returning from a vfs_mkdir() failure. Bug: 203827798 Link: [0] https://syzkaller.appspot.com/bug?extid=81b5ca9b2848f4dad8fa Reported-by: syzbot+81b5ca9b2848f4dad8fa@syzkaller.appspotmail.com Signed-off-by: Lee Jones Change-Id: Iaef9aa0aecc964645aaca5fe8d79388ae28527bd --- fs/incfs/vfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/incfs/vfs.c b/fs/incfs/vfs.c index d7a750290953..b972716f0c25 100644 --- a/fs/incfs/vfs.c +++ b/fs/incfs/vfs.c @@ -777,8 +777,10 @@ static struct dentry *open_or_create_index_dir(struct dentry *backing_dir) err = vfs_mkdir(backing_inode, index_dentry, 0777); inode_unlock(backing_inode); - if (err) + if (err) { + dput(index_dentry); return ERR_PTR(err); + } if (!d_really_is_positive(index_dentry)) { dput(index_dentry); From 051373292befa1ae003649404789adb3951270b9 Mon Sep 17 00:00:00 2001 From: evitayan Date: Mon, 20 Jul 2020 10:40:39 -0700 Subject: [PATCH 3/6] ANDROID: GKI: Enable CHACHA20POLY1305 and XCBC To be able to use ChaCha20Poly1305 and AES-XCBC in IPsec Bug: 161717358 Bug: 204402327 Change-Id: Ifeeb3d1f3458d46491ba6cd363656bf4737b5cd3 Signed-off-by: Yan Yan Signed-off-by: evitayan Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 2d7ae7b614213b28b6cd6230104e1f5f723e81df) --- arch/arm64/configs/gki_defconfig | 2 ++ arch/x86/configs/gki_defconfig | 2 ++ 2 files changed, 4 insertions(+) diff --git a/arch/arm64/configs/gki_defconfig b/arch/arm64/configs/gki_defconfig index cd9c8da3b259..1ed0c750f483 100644 --- a/arch/arm64/configs/gki_defconfig +++ b/arch/arm64/configs/gki_defconfig @@ -558,7 +558,9 @@ CONFIG_STATIC_USERMODEHELPER_PATH="" CONFIG_SECURITY_SELINUX=y CONFIG_INIT_STACK_ALL_ZERO=y CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y +CONFIG_CRYPTO_CHACHA20POLY1305=y CONFIG_CRYPTO_ADIANTUM=y +CONFIG_CRYPTO_XCBC=y CONFIG_CRYPTO_BLAKE2B=y CONFIG_CRYPTO_LZ4=y CONFIG_CRYPTO_ZSTD=y diff --git a/arch/x86/configs/gki_defconfig b/arch/x86/configs/gki_defconfig index 67a8c6119273..ab3db4763b6e 100644 --- a/arch/x86/configs/gki_defconfig +++ b/arch/x86/configs/gki_defconfig @@ -486,7 +486,9 @@ CONFIG_STATIC_USERMODEHELPER_PATH="" CONFIG_SECURITY_SELINUX=y CONFIG_INIT_STACK_ALL_ZERO=y CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y +CONFIG_CRYPTO_CHACHA20POLY1305=y CONFIG_CRYPTO_ADIANTUM=y +CONFIG_CRYPTO_XCBC=y CONFIG_CRYPTO_BLAKE2B=y CONFIG_CRYPTO_SHA256_SSSE3=y CONFIG_CRYPTO_AES_NI_INTEL=y From 937e6e41cc5d4cebc0203594aff9a007ed06950b Mon Sep 17 00:00:00 2001 From: Connor O'Brien Date: Fri, 7 Feb 2020 10:01:49 -0800 Subject: [PATCH 4/6] UPSTREAM: security: selinux: allow per-file labeling for bpffs Add support for genfscon per-file labeling of bpffs files. This allows for separate permissions for different pinned bpf objects, which may be completely unrelated to each other. Signed-off-by: Connor O'Brien Signed-off-by: Steven Moreland Acked-by: Stephen Smalley Signed-off-by: Paul Moore (cherry picked from commit 4ca54d3d3022ce27170b50e4bdecc3a42f05dbdc) [which is v5.6-rc1-10-g4ca54d3d3022 and thus already included in 5.10] Bug: 200440527 Change-Id: I8234b9047f29981b8140bd81bb2ff070b3b0b843 (cherry picked from commit d52ac987ad2ae16ff313d7fb6185bc412cb221a4) --- security/selinux/hooks.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 461221c3d505..027c7b99434e 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -754,6 +754,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, if (!strcmp(sb->s_type->name, "debugfs") || !strcmp(sb->s_type->name, "tracefs") || !strcmp(sb->s_type->name, "binder") || + !strcmp(sb->s_type->name, "bpf") || !strcmp(sb->s_type->name, "pstore")) sbsec->flags |= SE_SBGENFS; From bfb2ce3eb1b8819c6724eeb0d1fb28f6fbca1b55 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 28 Sep 2021 14:38:19 +0200 Subject: [PATCH 5/6] ANDROID: GKI: rework the ANDROID_KABI_USE() macro to not use __UNIQUE() The __UNIQUE_ID() macro causes problems as it turns out to not be deterministic across different compiler runs as it relies on the __COUNTER__ macro which could have been used on other .h files previous to this .h file being included. This shows up specifically when building with "LTO=thin" vs. "LTO=full" as different build paths seem to be triggered. As the structure name isn't really needed at all here, we were just including it for older compilers that could not handle anonymous structures in a union, just drop the whole thing which resolves the abi naming issue. Bug: 210255585 Reported-by: Giuliano Procida Signed-off-by: Greg Kroah-Hartman Change-Id: I6b9449fa9d26ffc5d66b2f0f3b41e2d5f3003f68 --- include/linux/android_kabi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/android_kabi.h b/include/linux/android_kabi.h index efa52953fe35..9c7b6c035ad3 100644 --- a/include/linux/android_kabi.h +++ b/include/linux/android_kabi.h @@ -63,7 +63,7 @@ _new; \ struct { \ _orig; \ - } __UNIQUE_ID(android_kabi_hide); \ + }; \ __ANDROID_KABI_CHECK_SIZE_ALIGN(_orig, _new); \ } From e785a25f52622e9a3355fa492263391952b96edd Mon Sep 17 00:00:00 2001 From: Alistair Delva Date: Mon, 15 Nov 2021 22:18:18 +0000 Subject: [PATCH 6/6] Revert "ANDROID: GKI: Enable CHACHA20POLY1305 and XCBC" This reverts commit 051373292befa1ae003649404789adb3951270b9. Reason for revert: tests will be dropped from gsi Change-Id: I435df6e02114a3e66591f2f6d2d2136d7893842a Signed-off-by: Alistair Delva --- arch/arm64/configs/gki_defconfig | 2 -- arch/x86/configs/gki_defconfig | 2 -- 2 files changed, 4 deletions(-) diff --git a/arch/arm64/configs/gki_defconfig b/arch/arm64/configs/gki_defconfig index 1ed0c750f483..cd9c8da3b259 100644 --- a/arch/arm64/configs/gki_defconfig +++ b/arch/arm64/configs/gki_defconfig @@ -558,9 +558,7 @@ CONFIG_STATIC_USERMODEHELPER_PATH="" CONFIG_SECURITY_SELINUX=y CONFIG_INIT_STACK_ALL_ZERO=y CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y -CONFIG_CRYPTO_CHACHA20POLY1305=y CONFIG_CRYPTO_ADIANTUM=y -CONFIG_CRYPTO_XCBC=y CONFIG_CRYPTO_BLAKE2B=y CONFIG_CRYPTO_LZ4=y CONFIG_CRYPTO_ZSTD=y diff --git a/arch/x86/configs/gki_defconfig b/arch/x86/configs/gki_defconfig index ab3db4763b6e..67a8c6119273 100644 --- a/arch/x86/configs/gki_defconfig +++ b/arch/x86/configs/gki_defconfig @@ -486,9 +486,7 @@ CONFIG_STATIC_USERMODEHELPER_PATH="" CONFIG_SECURITY_SELINUX=y CONFIG_INIT_STACK_ALL_ZERO=y CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y -CONFIG_CRYPTO_CHACHA20POLY1305=y CONFIG_CRYPTO_ADIANTUM=y -CONFIG_CRYPTO_XCBC=y CONFIG_CRYPTO_BLAKE2B=y CONFIG_CRYPTO_SHA256_SSSE3=y CONFIG_CRYPTO_AES_NI_INTEL=y