Merge android-5.4.11 (fde6e0c) into msm-5.4

* refs/heads/tmp-fde6e0c:
  Linux 5.4.11
  usb: missing parentheses in USE_NEW_SCHEME
  USB: serial: option: add Telit ME910G1 0x110a composition
  USB: core: fix check for duplicate endpoints
  usb: dwc3: gadget: Fix request complete check
  net/mlx5: DR, Init lists that are used in rule's member
  net/mlx5e: Fix hairpin RSS table size
  net/mlx5: DR, No need for atomic refcount for internal SW steering resources
  net/mlx5e: Always print health reporter message to dmesg
  net: dsa: mv88e6xxx: force cmode write on 6141/6341
  net/mlx5: Move devlink registration before interfaces load
  macb: Don't unregister clks unconditionally
  vlan: vlan_changelink() should propagate errors
  vlan: fix memory leak in vlan_dev_set_egress_priority
  net: sch_prio: When ungrafting, replace with FIFO
  mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO
  vxlan: fix tos value before xmit
  tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK
  sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY
  sch_cake: avoid possible divide by zero in cake_enqueue()
  pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
  net: usb: lan78xx: fix possible skb leak
  net: stmmac: Fixed link does not need MDIO Bus
  net: stmmac: dwmac-sunxi: Allow all RGMII modes
  net: stmmac: dwmac-sun8i: Allow all RGMII modes
  net: freescale: fec: Fix ethtool -d runtime PM
  net: dsa: mv88e6xxx: Preserve priority when setting CPU port.
  macvlan: do not assume mac_header is set in macvlan_broadcast()
  gtp: fix bad unlock balance in gtp_encap_enable_socket
  tracing: Do not create directories if lockdown is in affect
  selftests: pmtu: fix init mtu value in description
  hv_netvsc: Fix unwanted rx_table reset
  llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c)
  s390/qeth: don't return -ENOTSUPP to userspace
  s390/qeth: fix promiscuous mode after reset
  s390/qeth: handle error due to unsupported transport mode
  sbitmap: only queue kyber's wait callback if not already active
  parisc: Fix compiler warnings in debug_core.c
  block: fix memleak when __blk_rq_map_user_iov() is failed
  s390/dasd: fix memleak in path handling error case
  s390/dasd/cio: Interpret ccw_device_get_mdc return value correctly
  block: Fix a lockdep complaint triggered by request queue flushing
  arm64: cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list
  platform/x86: pcengines-apuv2: fix simswap GPIO assignment
  net/ixgbe: Fix concurrency issues between config flow and XSK
  net/i40e: Fix concurrency issues between config flow and XSK
  net/mlx5e: Fix concurrency issues between config flow and XSK
  xsk: Add rcu_read_lock around the XSK wakeup
  tpm/tpm_ftpm_tee: add shutdown call back
  drm/exynos: gsc: add missed component_del
  s390/purgatory: do not build purgatory with kcov, kasan and friends
  net: stmmac: Always arm TX Timer at end of transmission start
  net: stmmac: RX buffer size must be 16 byte aligned
  net: stmmac: xgmac: Clear previous RX buffer size
  net: stmmac: Do not accept invalid MTU values
  net: stmmac: Determine earlier the size of RX buffer
  net: stmmac: selftests: Needs to check the number of Multicast regs
  clk: Move clk_core_reparent_orphans() under CONFIG_OF
  io_uring: don't wait when under-submitting
  iommu/dma: Relax locking in iommu_dma_prepare_msi()
  perf/smmuv3: Remove the leftover put_cpu() in error path
  fs: call fsnotify_sb_delete after evict_inodes
  fs: avoid softlockups in s_inodes iterators
  block: end bio with BLK_STS_AGAIN in case of non-mq devs and REQ_NOWAIT
  usb: typec: fusb302: Fix an undefined reference to 'extcon_get_state'
  psi: Fix a division error in psi poll()
  sched/psi: Fix sampling error and rare div0 crashes with cgroups and high uptime
  perf/x86/intel: Fix PT PMI handling
  perf/x86: Fix potential out-of-bounds access
  scripts: package: mkdebian: add missing rsync dependency
  kconfig: don't crash on NULL expressions in expr_eq()
  iommu/iova: Init the struct iova to fix the possible memleak
  staging: axis-fifo: add unspecified HAS_IOMEM dependency
  clk: at91: fix possible deadlock
  spi: nxp-fspi: Ensure width is respected in spi-mem operations
  regulator: rn5t618: fix module aliases
  ASoC: wm8962: fix lambda value
  rfkill: Fix incorrect check to avoid NULL pointer dereference
  parisc: add missing __init annotation
  parisc: fix compilation when KEXEC=n and KEXEC_FILE=y
  net: usb: lan78xx: Fix error message format specifier
  cxgb4: Fix kernel panic while accessing sge_info
  bnx2x: Fix logic to get total no. of PFs per engine
  bnx2x: Do not handle requests from VFs after parity
  habanalabs: remove variable 'val' set but not used
  habanalabs: rate limit error msg on waiting for CS
  bpf: Clear skb->tstamp in bpf_redirect when necessary
  ocxl: Fix potential memory leak on context creation
  Btrfs: fix hole extent items with a zero size after range cloning
  btrfs: handle error in btrfs_cache_block_group
  powerpc/spinlocks: Include correct header for static key
  powerpc/vcpu: Assume dedicated processors as non-preempt
  Btrfs: fix cloning range with a hole when using the NO_HOLES feature
  btrfs: Fix error messages in qgroup_rescan_init
  powerpc: Ensure that swiotlb buffer is allocated from low memory
  pinctrl: pinmux: fix a possible null pointer in pinmux_can_be_used_for_gpio
  cfg80211: fix double-free after changing network namespace
  mac80211: fix TID field in monitor mode transmit
  clk: walk orphan list on clock provider registration
  bus: ti-sysc: Fix missing reset delay handling
  pinctrl: aspeed-g6: Fix LPC/eSPI mux configuration
  ARM: imx_v6_v7_defconfig: Explicitly restore CONFIG_DEBUG_FS
  arm64: dts: ls1028a: fix reboot node
  samples: bpf: fix syscall_tp due to unused syscall
  samples: bpf: Replace symbol compare of trace_event
  kselftest: Support old perl versions
  kselftest/runner: Print new line in print of timeout log
  ARM: dts: am437x-gp/epos-evm: fix panel compatible
  spi: spi-ti-qspi: Fix a bug when accessing non default CS
  perf header: Fix false warning when there are no duplicate cache entries
  perf metricgroup: Fix printing event names of metric group with multiple events
  bpftool: Don't crash on missing jited insns or ksyms
  bpf, mips: Limit to 33 tail calls
  bpf, riscv: Limit to 33 tail calls
  arm64: dts: ls1028a: fix typo in TMU calibration data
  ARM: dts: bcm283x: Fix critical trip point
  ARM: omap2plus_defconfig: Add back DEBUG_FS
  ARM: dts: am335x-sancloud-bbe: fix phy mode
  ASoC: SOF: Intel: split cht and byt debug window sizes
  ASoC: SOF: loader: snd_sof_fw_parse_ext_data log warning on unknown header
  ASoC: topology: Check return value for soc_tplg_pcm_create()
  ASoC: topology: Check return value for snd_soc_add_dai_link()
  reset: Do not register resource data for missing resets
  spi: spi-cavium-thunderx: Add missing pci_release_regions()
  ARM: dts: Cygnus: Fix MDIO node address/size cells
  ARM: exynos_defconfig: Restore debugfs support
  selftests: safesetid: Fix Makefile to set correct test program
  selftests: safesetid: Check the return value of setuid/setgid
  selftests: safesetid: Move link library to LDLIBS
  selftests/ftrace: Fix multiple kprobe testcase
  selftests/ftrace: Do not to use absolute debugfs path
  selftests/ftrace: Fix ftrace test cases to check unsupported
  selftests/ftrace: Fix to check the existence of set_ftrace_filter
  ARM: dts: BCM5301X: Fix MDIO node address/size cells
  netfilter: nf_tables_offload: return EOPNOTSUPP if rule specifies no actions
  netfilter: nf_tables: skip module reference count bump on object updates
  netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()
  netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END
  netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets
  netfilter: uapi: Avoid undefined left-shift in xt_sctp.h
  ARM: vexpress: Set-up shared OPP table instead of individual for each CPU
  ARM: dts: imx6ul: imx6ul-14x14-evk.dtsi: Fix SPI NOR probing
  efi/earlycon: Remap entire framebuffer after page initialization
  efi/gop: Fix memory leak in __gop_query32/64()
  efi/gop: Return EFI_SUCCESS if a usable GOP was found
  efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs
  selftests: netfilter: use randomized netns names
  ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89
  x86/efi: Update e820 with reserved EFI boot services data to fix kexec breakage
  regulator: core: fix regulator_register() error paths to properly release rdev
  libtraceevent: Copy pkg-config file to output folder when using O=
  libtraceevent: Fix lib installation with O=
  mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
  netfilter: nf_tables_offload: Check for the NETDEV_UNREGISTER event
  x86/intel: Disable HPET on Intel Ice Lake platforms
  netfilter: ctnetlink: netns exit must wait for callbacks
  locking/spinlock/debug: Fix various data races
  spi: fsl: Handle the single hardwired chipselect case
  gpio: Handle counting of Freescale chipselects
  spi: fsl: Fix GPIO descriptor support
  ASoC: max98090: fix possible race conditions
  regulator: fix use after free issue
  spi: pxa2xx: Add support for Intel Jasper Lake
  ASoC: rt5682: fix i2c arbitration lost issue
  bpf: Fix passing modified ctx to ld/abs/ind instruction
  USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein
  ANDROID: Kconfig.gki: Add QCOM_SCM to QCOM Hidden configs
  ANDROID: iommu/arm-smmu: Allow inherting stream mapping from bootloader
  ANDROID: iommu/arm-smmu: Expose s2cr and smr structs to impl
  ANDROID: iommu/arm-smmu: Don't blindly use first SMR to calculate mask
  ANDROID: clk: qcom: Add sync_state = clk_sync_state for db845c clock providers
  UPSTREAM: net: usbnet: Fix -Wcast-function-type
  UPSTREAM: PM / QoS: Restore DEV_PM_QOS_MIN/MAX_FREQUENCY
  UPSTREAM: PM / QoS: Reorder pm_qos/freq_qos/dev_pm_qos structs
  UPSTREAM: USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein
  ANDROID: update kernel ABI (perf_event changes)
  BACKPORT: perf_event: Add support for LSM and SELinux checks
  ANDROID: Enable HID_STEAM and JOYSTICK_XPAD as y

Conflicts:
	drivers/iommu/arm-smmu.c
	drivers/iommu/dma-iommu.c
	include/linux/pm_qos.h
	init/Kconfig.gki
	kernel/sched/psi.c

Restored change a7f7e61270 ("usb: dwc3: gadget: Fix logical condition")
since it is safe due to import of 158cbd970b ("usb: dwc3: gadget:
Fix request complete check").

Change-Id: Id8931bdd4b8a6bde233d654abc87019fc6f2ec22
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
This commit is contained in:
Blagovest Kolenichev 2020-03-07 10:01:57 -08:00
commit 6ec8cd9d1e
221 changed files with 51862 additions and 50108 deletions

View file

@ -6039,6 +6039,7 @@ static bool may_access_skb(enum bpf_prog_type type)
static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
{
struct bpf_reg_state *regs = cur_regs(env);
static const int ctx_reg = BPF_REG_6;
u8 mode = BPF_MODE(insn->code);
int i, err;
@ -6072,7 +6073,7 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
}
/* check whether implicit source operand (register R6) is readable */
err = check_reg_arg(env, BPF_REG_6, SRC_OP);
err = check_reg_arg(env, ctx_reg, SRC_OP);
if (err)
return err;
@ -6091,7 +6092,7 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
return -EINVAL;
}
if (regs[BPF_REG_6].type != PTR_TO_CTX) {
if (regs[ctx_reg].type != PTR_TO_CTX) {
verbose(env,
"at the time of BPF_LD_ABS|IND R6 != pointer to skb\n");
return -EINVAL;
@ -6104,6 +6105,10 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
return err;
}
err = check_ctx_reg(env, &regs[ctx_reg], ctx_reg);
if (err < 0)
return err;
/* reset caller saved regs to unreadable */
for (i = 0; i < CALLER_SAVED_REGS; i++) {
mark_reg_not_init(env, regs, caller_saved[i]);

View file

@ -4234,8 +4234,9 @@ find_get_context(struct pmu *pmu, struct task_struct *task,
if (!task) {
/* Must be root to operate on a CPU event: */
if (perf_paranoid_cpu() && !capable(CAP_SYS_ADMIN))
return ERR_PTR(-EACCES);
err = perf_allow_cpu(&event->attr);
if (err)
return ERR_PTR(err);
cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
ctx = &cpuctx->ctx;
@ -4544,6 +4545,8 @@ static void _free_event(struct perf_event *event)
unaccount_event(event);
security_perf_event_free(event);
if (event->rb) {
/*
* Can happen when we close an event with re-directed output.
@ -4997,6 +5000,10 @@ perf_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
struct perf_event_context *ctx;
int ret;
ret = security_perf_event_read(event);
if (ret)
return ret;
ctx = perf_event_ctx_lock(event);
ret = __perf_read(event, buf, count);
perf_event_ctx_unlock(event, ctx);
@ -5261,6 +5268,11 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
struct perf_event_context *ctx;
long ret;
/* Treat ioctl like writes as it is likely a mutating operation. */
ret = security_perf_event_write(event);
if (ret)
return ret;
ctx = perf_event_ctx_lock(event);
ret = _perf_ioctl(event, cmd, arg);
perf_event_ctx_unlock(event, ctx);
@ -5724,6 +5736,10 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
if (!(vma->vm_flags & VM_SHARED))
return -EINVAL;
ret = security_perf_event_read(event);
if (ret)
return ret;
vma_size = vma->vm_end - vma->vm_start;
if (vma->vm_pgoff == 0) {
@ -5849,7 +5865,7 @@ accounting:
lock_limit >>= PAGE_SHIFT;
locked = atomic64_read(&vma->vm_mm->pinned_vm) + extra;
if ((locked > lock_limit) && perf_paranoid_tracepoint_raw() &&
if ((locked > lock_limit) && perf_is_paranoid() &&
!capable(CAP_IPC_LOCK)) {
ret = -EPERM;
goto unlock;
@ -10592,11 +10608,20 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
}
}
err = security_perf_event_alloc(event);
if (err)
goto err_callchain_buffer;
/* symmetric to unaccount_event() in _free_event() */
account_event(event);
return event;
err_callchain_buffer:
if (!event->parent) {
if (event->attr.sample_type & PERF_SAMPLE_CALLCHAIN)
put_callchain_buffers();
}
err_addr_filters:
kfree(event->addr_filter_ranges);
@ -10685,9 +10710,11 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr,
attr->branch_sample_type = mask;
}
/* privileged levels capture (kernel, hv): check permissions */
if ((mask & PERF_SAMPLE_BRANCH_PERM_PLM)
&& perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
return -EACCES;
if (mask & PERF_SAMPLE_BRANCH_PERM_PLM) {
ret = perf_allow_kernel(attr);
if (ret)
return ret;
}
}
if (attr->sample_type & PERF_SAMPLE_REGS_USER) {
@ -10903,13 +10930,19 @@ SYSCALL_DEFINE5(perf_event_open,
if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN))
return -EACCES;
/* Do we allow access to perf_event_open(2) ? */
err = security_perf_event_open(&attr, PERF_SECURITY_OPEN);
if (err)
return err;
err = perf_copy_attr(attr_uptr, &attr);
if (err)
return err;
if (!attr.exclude_kernel) {
if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
return -EACCES;
err = perf_allow_kernel(&attr);
if (err)
return err;
}
if (attr.namespaces) {
@ -10926,9 +10959,11 @@ SYSCALL_DEFINE5(perf_event_open,
}
/* Only privileged users can get physical addresses */
if ((attr.sample_type & PERF_SAMPLE_PHYS_ADDR) &&
perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
return -EACCES;
if ((attr.sample_type & PERF_SAMPLE_PHYS_ADDR)) {
err = perf_allow_kernel(&attr);
if (err)
return err;
}
err = security_locked_down(LOCKDOWN_PERF);
if (err && (attr.sample_type & PERF_SAMPLE_REGS_INTR))

View file

@ -51,19 +51,19 @@ EXPORT_SYMBOL(__rwlock_init);
static void spin_dump(raw_spinlock_t *lock, const char *msg)
{
struct task_struct *owner = NULL;
struct task_struct *owner = READ_ONCE(lock->owner);
if (lock->owner && lock->owner != SPINLOCK_OWNER_INIT)
owner = lock->owner;
if (owner == SPINLOCK_OWNER_INIT)
owner = NULL;
printk(KERN_EMERG "BUG: spinlock %s on CPU#%d, %s/%d\n",
msg, raw_smp_processor_id(),
current->comm, task_pid_nr(current));
printk(KERN_EMERG " lock: %pS, .magic: %08x, .owner: %s/%d, "
".owner_cpu: %d\n",
lock, lock->magic,
lock, READ_ONCE(lock->magic),
owner ? owner->comm : "<none>",
owner ? task_pid_nr(owner) : -1,
lock->owner_cpu);
READ_ONCE(lock->owner_cpu));
dump_stack();
}
@ -80,16 +80,16 @@ static void spin_bug(raw_spinlock_t *lock, const char *msg)
static inline void
debug_spin_lock_before(raw_spinlock_t *lock)
{
SPIN_BUG_ON(lock->magic != SPINLOCK_MAGIC, lock, "bad magic");
SPIN_BUG_ON(lock->owner == current, lock, "recursion");
SPIN_BUG_ON(lock->owner_cpu == raw_smp_processor_id(),
SPIN_BUG_ON(READ_ONCE(lock->magic) != SPINLOCK_MAGIC, lock, "bad magic");
SPIN_BUG_ON(READ_ONCE(lock->owner) == current, lock, "recursion");
SPIN_BUG_ON(READ_ONCE(lock->owner_cpu) == raw_smp_processor_id(),
lock, "cpu recursion");
}
static inline void debug_spin_lock_after(raw_spinlock_t *lock)
{
lock->owner_cpu = raw_smp_processor_id();
lock->owner = current;
WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id());
WRITE_ONCE(lock->owner, current);
}
static inline void debug_spin_unlock(raw_spinlock_t *lock)
@ -99,8 +99,8 @@ static inline void debug_spin_unlock(raw_spinlock_t *lock)
SPIN_BUG_ON(lock->owner != current, lock, "wrong owner");
SPIN_BUG_ON(lock->owner_cpu != raw_smp_processor_id(),
lock, "wrong CPU");
lock->owner = SPINLOCK_OWNER_INIT;
lock->owner_cpu = -1;
WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT);
WRITE_ONCE(lock->owner_cpu, -1);
}
/*
@ -187,8 +187,8 @@ static inline void debug_write_lock_before(rwlock_t *lock)
static inline void debug_write_lock_after(rwlock_t *lock)
{
lock->owner_cpu = raw_smp_processor_id();
lock->owner = current;
WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id());
WRITE_ONCE(lock->owner, current);
}
static inline void debug_write_unlock(rwlock_t *lock)
@ -197,8 +197,8 @@ static inline void debug_write_unlock(rwlock_t *lock)
RWLOCK_BUG_ON(lock->owner != current, lock, "wrong owner");
RWLOCK_BUG_ON(lock->owner_cpu != raw_smp_processor_id(),
lock, "wrong CPU");
lock->owner = SPINLOCK_OWNER_INIT;
lock->owner_cpu = -1;
WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT);
WRITE_ONCE(lock->owner_cpu, -1);
}
void do_raw_write_lock(rwlock_t *lock)

View file

@ -714,8 +714,10 @@ s32 freq_qos_read_value(struct freq_constraints *qos,
* @req: Constraint request to apply.
* @action: Action to perform (add/update/remove).
* @value: Value to assign to the QoS request.
*
* This is only meant to be called from inside pm_qos, not drivers.
*/
static int freq_qos_apply(struct freq_qos_request *req,
int freq_qos_apply(struct freq_qos_request *req,
enum pm_qos_req_action action, s32 value)
{
int ret;

View file

@ -188,7 +188,8 @@ static void group_init(struct psi_group *group)
for_each_possible_cpu(cpu)
seqcount_init(&per_cpu_ptr(group->pcpu, cpu)->seq);
group->avg_next_update = sched_clock() + psi_period;
group->avg_last_update = sched_clock();
group->avg_next_update = group->avg_last_update + psi_period;
INIT_DEFERRABLE_WORK(&group->avgs_work, psi_avgs_work);
mutex_init(&group->avgs_lock);
/* Init trigger-related members */
@ -519,7 +520,7 @@ static u64 window_update(struct psi_window *win, u64 now, u64 value)
u32 remaining;
remaining = win->size - elapsed;
growth += div_u64(win->prev_growth * remaining, win->size);
growth += div64_u64(win->prev_growth * remaining, win->size);
}
return growth;

View file

@ -11,6 +11,7 @@
#include <linux/trace_seq.h>
#include <linux/spinlock.h>
#include <linux/irq_work.h>
#include <linux/security.h>
#include <linux/uaccess.h>
#include <linux/hardirq.h>
#include <linux/kthread.h> /* for self test */
@ -5068,6 +5069,11 @@ static __init int test_ringbuffer(void)
int cpu;
int ret = 0;
if (security_locked_down(LOCKDOWN_TRACEFS)) {
pr_warning("Lockdown is enabled, skipping ring buffer tests\n");
return 0;
}
pr_info("Running ring buffer tests...\n");
buffer = ring_buffer_alloc(RB_TEST_BUFFER_SIZE, RB_FL_OVERWRITE);

View file

@ -1805,6 +1805,12 @@ int __init register_tracer(struct tracer *type)
return -1;
}
if (security_locked_down(LOCKDOWN_TRACEFS)) {
pr_warning("Can not register tracer %s due to lockdown\n",
type->name);
return -EPERM;
}
mutex_lock(&trace_types_lock);
tracing_selftest_running = true;
@ -8663,6 +8669,11 @@ struct dentry *tracing_init_dentry(void)
{
struct trace_array *tr = &global_trace;
if (security_locked_down(LOCKDOWN_TRACEFS)) {
pr_warning("Tracing disabled due to lockdown\n");
return ERR_PTR(-EPERM);
}
/* The top level trace array uses NULL as parent */
if (tr->dir)
return NULL;
@ -9105,6 +9116,12 @@ __init static int tracer_alloc_buffers(void)
int ring_buf_size;
int ret = -ENOMEM;
if (security_locked_down(LOCKDOWN_TRACEFS)) {
pr_warning("Tracing disabled due to lockdown\n");
return -EPERM;
}
/*
* Make sure we don't accidently add more trace options
* than we have bits for.

View file

@ -8,6 +8,7 @@
#include <linux/module.h>
#include <linux/kprobes.h>
#include <linux/security.h>
#include "trace.h"
#include "trace_probe.h"
@ -26,8 +27,10 @@ static int total_ref_count;
static int perf_trace_event_perm(struct trace_event_call *tp_event,
struct perf_event *p_event)
{
int ret;
if (tp_event->perf_perm) {
int ret = tp_event->perf_perm(tp_event, p_event);
ret = tp_event->perf_perm(tp_event, p_event);
if (ret)
return ret;
}
@ -46,8 +49,9 @@ static int perf_trace_event_perm(struct trace_event_call *tp_event,
/* The ftrace function trace is allowed only for root. */
if (ftrace_event_is_function(tp_event)) {
if (perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN))
return -EPERM;
ret = perf_allow_tracepoint(&p_event->attr);
if (ret)
return ret;
if (!is_sampling_event(p_event))
return 0;
@ -82,8 +86,9 @@ static int perf_trace_event_perm(struct trace_event_call *tp_event,
* ...otherwise raw tracepoint data can be a severe data leak,
* only allow root to have these.
*/
if (perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN))
return -EPERM;
ret = perf_allow_tracepoint(&p_event->attr);
if (ret)
return ret;
return 0;
}