From 202bc8432cdd1ed8c5dbfd2670fad51370fb1995 Mon Sep 17 00:00:00 2001 From: Jamie Hill-Daniel Date: Tue, 18 Jan 2022 08:06:04 +0100 Subject: [PATCH 01/14] UPSTREAM: vfs: fs_context: fix up param length parsing in legacy_parse_param The "PAGE_SIZE - 2 - size" calculation in legacy_parse_param() is an unsigned type so a large value of "size" results in a high positive value instead of a negative value as expected. Fix this by getting rid of the subtraction. Signed-off-by: Jamie Hill-Daniel Signed-off-by: William Liu Tested-by: Salvatore Bonaccorso Tested-by: Thadeu Lima de Souza Cascardo Acked-by: Dan Carpenter Acked-by: Al Viro Signed-off-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds (cherry picked from commit 722d94847de29310e8aa03fcbdb41fc92c521756) Bug: 213421437 Signed-off-by: Greg Kroah-Hartman Change-Id: Ica4c894715daae0d4393a377ac3e81260a651df9 --- fs/fs_context.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/fs_context.c b/fs/fs_context.c index 138b5b4d621d..a2367c7aef5b 100644 --- a/fs/fs_context.c +++ b/fs/fs_context.c @@ -585,7 +585,7 @@ static int legacy_parse_param(struct fs_context *fc, struct fs_parameter *param) param->key); } - if (len > PAGE_SIZE - 2 - size) + if (size + len + 2 > PAGE_SIZE) return invalf(fc, "VFS: Legacy: Cumulative options too large"); if (strchr(param->key, ',') || (param->type == fs_value_is_string && From 013b7ed7546e04b50abdb26dee92114e43c3064f Mon Sep 17 00:00:00 2001 From: Tadeusz Struk Date: Wed, 12 Jan 2022 13:52:50 -0800 Subject: [PATCH 02/14] ANDROID: incremental-fs: fix mount_fs issue Syzbot recently found a number of issues related to incremental-fs (see bug numbers below). All have to do with the fact that incr-fs allows mounts of the same source and target multiple times. The correct behavior for a file system is to allow only one such mount, and then every subsequent attempt should fail with a -EBUSY error code. In case of the issues listed below the common pattern is that the reproducer calls: mount("./file0", "./file0", "incremental-fs", 0, NULL) many times and then invokes a file operation like chmod, setxattr, or open on the ./file0. This causes a recursive call for all the mounted instances, which eventually causes a stack overflow and a kernel crash: BUG: stack guard page was hit at ffffc90000c0fff8 kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN The reason why many mounts with the same source and target are possible is because the incfs_mount_fs() as it is allocates a new super_block for every call, regardless of whether a given mount already exists or not. This happens every time the sget() function is called with a test param equal to NULL. The correct behavior for an FS mount implementation is to call appropriate mount vfs call for it's type, i.e. mount_bdev() for a block device backed FS, mount_single() for a pseudo file system, like sysfs that is mounted in a single, well know location, or mount_nodev() for other special purpose FS like overlayfs. In case of incremental-fs the open coded mount logic doesn't check for abusive mount attempts such as overlays. To fix this issue the logic needs to be changed to pass a proper test function to sget() call, which then checks if a super_block for a mount instance has already been allocated and also allows the VFS to properly verify invalid mount attempts. Bug: 211066171 Bug: 213140206 Bug: 213215835 Bug: 211914587 Bug: 211213635 Bug: 213137376 Bug: 211161296 Signed-off-by: Tadeusz Struk Change-Id: I66cfc3f1b5aaffb32b0845b2dad3ff26fe952e27 --- fs/incfs/vfs.c | 59 ++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 43 insertions(+), 16 deletions(-) diff --git a/fs/incfs/vfs.c b/fs/incfs/vfs.c index b972716f0c25..8d4c4e39fa46 100644 --- a/fs/incfs/vfs.c +++ b/fs/incfs/vfs.c @@ -319,7 +319,6 @@ static struct mount_info *get_mount_info(struct super_block *sb) { struct mount_info *result = sb->s_fs_info; - WARN_ON(!result); return result; } @@ -678,7 +677,7 @@ static int iterate_incfs_dir(struct file *file, struct dir_context *ctx) struct mount_info *mi = get_mount_info(file_superblock(file)); bool root; - if (!dir) { + if (!dir || !mi) { error = -EBADF; goto out; } @@ -1842,6 +1841,9 @@ static int dir_rename(struct inode *old_dir, struct dentry *old_dentry, struct dentry *trap; int error = 0; + if (!mi) + return -EBADF; + error = mutex_lock_interruptible(&mi->mi_dir_struct_mutex); if (error) return error; @@ -2089,6 +2091,9 @@ static ssize_t incfs_getxattr(struct dentry *d, const char *name, char *stored_value; size_t stored_size; + if (!mi) + return -EBADF; + if (di && di->backing_path.dentry) return vfs_getxattr(di->backing_path.dentry, name, value, size); @@ -2125,6 +2130,9 @@ static ssize_t incfs_setxattr(struct dentry *d, const char *name, void **stored_value; size_t *stored_size; + if (!mi) + return -EBADF; + if (di && di->backing_path.dentry) return vfs_setxattr(di->backing_path.dentry, name, value, size, flags); @@ -2165,6 +2173,11 @@ static ssize_t incfs_listxattr(struct dentry *d, char *list, size_t size) return vfs_listxattr(di->backing_path.dentry, list, size); } +static int incfs_test_super(struct super_block *s, void *p) +{ + return s->s_fs_info != NULL; +} + struct dentry *incfs_mount_fs(struct file_system_type *type, int flags, const char *dev_name, void *data) { @@ -2174,7 +2187,8 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags, struct dentry *index_dir; struct super_block *src_fs_sb = NULL; struct inode *root_inode = NULL; - struct super_block *sb = sget(type, NULL, set_anon_super, flags, NULL); + struct super_block *sb = sget(type, incfs_test_super, set_anon_super, + flags, NULL); int error = 0; if (IS_ERR(sb)) @@ -2215,13 +2229,18 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags, src_fs_sb = backing_dir_path.dentry->d_sb; sb->s_maxbytes = src_fs_sb->s_maxbytes; - mi = incfs_alloc_mount_info(sb, &options, &backing_dir_path); + if (!sb->s_fs_info) { + mi = incfs_alloc_mount_info(sb, &options, &backing_dir_path); - if (IS_ERR_OR_NULL(mi)) { - error = PTR_ERR(mi); - pr_err("incfs: Error allocating mount info. %d\n", error); - mi = NULL; - goto err; + if (IS_ERR_OR_NULL(mi)) { + error = PTR_ERR(mi); + pr_err("incfs: Error allocating mount info. %d\n", error); + mi = NULL; + goto err; + } + sb->s_fs_info = mi; + } else { + mi = sb->s_fs_info; } index_dir = open_or_create_index_dir(backing_dir_path.dentry); @@ -2233,21 +2252,22 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags, } mi->mi_index_dir = index_dir; - sb->s_fs_info = mi; root_inode = fetch_regular_inode(sb, backing_dir_path.dentry); if (IS_ERR(root_inode)) { error = PTR_ERR(root_inode); goto err; } - sb->s_root = d_make_root(root_inode); if (!sb->s_root) { - error = -ENOMEM; - goto err; + sb->s_root = d_make_root(root_inode); + if (!sb->s_root) { + error = -ENOMEM; + goto err; + } + error = incfs_init_dentry(sb->s_root, &backing_dir_path); + if (error) + goto err; } - error = incfs_init_dentry(sb->s_root, &backing_dir_path); - if (error) - goto err; path_put(&backing_dir_path); sb->s_flags |= SB_ACTIVE; @@ -2268,6 +2288,9 @@ static int incfs_remount_fs(struct super_block *sb, int *flags, char *data) struct mount_info *mi = get_mount_info(sb); int err = 0; + if (!mi) + return err; + sync_filesystem(sb); err = parse_options(&options, (char *)data); if (err) @@ -2288,12 +2311,16 @@ void incfs_kill_sb(struct super_block *sb) pr_debug("incfs: unmount\n"); incfs_free_mount_info(mi); generic_shutdown_super(sb); + sb->s_fs_info = NULL; } static int show_options(struct seq_file *m, struct dentry *root) { struct mount_info *mi = get_mount_info(root->d_sb); + if (!mi) + return -EBADF; + seq_printf(m, ",read_timeout_ms=%u", mi->mi_options.read_timeout_ms); seq_printf(m, ",readahead=%u", mi->mi_options.readahead_pages); if (mi->mi_options.read_log_pages != 0) { From a4e84758f02959df24c67e0aabcefd42079c2d01 Mon Sep 17 00:00:00 2001 From: Hang Lu Date: Fri, 9 Apr 2021 17:40:45 +0800 Subject: [PATCH 03/14] UPSTREAM: binder: fix the missing BR_FROZEN_REPLY in binder_return_strings Add BR_FROZEN_REPLY in binder_return_strings to support stat function. Fixes: ae28c1be1e54 ("binder: BINDER_GET_FROZEN_INFO ioctl") Acked-by: Todd Kjos Signed-off-by: Hang Lu Link: https://lore.kernel.org/r/1617961246-4502-2-git-send-email-hangl@codeaurora.org Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 005169157448ca41eff8716d79dc1b8f158229d2) Bug: 187129171 Signed-off-by: Connor O'Brien Change-Id: I3b0f67ee9f3a747d9052b7a900f2239b0e4097f5 --- drivers/android/binder.c | 3 ++- drivers/android/binder_internal.h | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 2b461f141bfe..3b64f35a1969 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -5743,7 +5743,8 @@ static const char * const binder_return_strings[] = { "BR_FINISHED", "BR_DEAD_BINDER", "BR_CLEAR_DEATH_NOTIFICATION_DONE", - "BR_FAILED_REPLY" + "BR_FAILED_REPLY", + "BR_FROZEN_REPLY", }; static const char * const binder_command_strings[] = { diff --git a/drivers/android/binder_internal.h b/drivers/android/binder_internal.h index 7c5993bcfc10..e32807fbb732 100644 --- a/drivers/android/binder_internal.h +++ b/drivers/android/binder_internal.h @@ -155,7 +155,7 @@ enum binder_stat_types { }; struct binder_stats { - atomic_t br[_IOC_NR(BR_FAILED_REPLY) + 1]; + atomic_t br[_IOC_NR(BR_FROZEN_REPLY) + 1]; atomic_t bc[_IOC_NR(BC_REPLY_SG) + 1]; atomic_t obj_created[BINDER_STAT_COUNT]; atomic_t obj_deleted[BINDER_STAT_COUNT]; From 54e1868c8b1e4c229f506bfdd74a71868489fea1 Mon Sep 17 00:00:00 2001 From: Pavel Skripkin Date: Fri, 25 Jun 2021 13:23:54 +0300 Subject: [PATCH 04/14] UPSTREAM: net: xfrm: fix memory leak in xfrm_user_rcv_msg Syzbot reported memory leak in xfrm_user_rcv_msg(). The problem was is non-freed skb's frag_list. In skb_release_all() skb_release_data() will be called only in case of skb->head != NULL, but netlink_skb_destructor() sets head to NULL. So, allocated frag_list skb should be freed manualy, since consume_skb() won't take care of it Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator") Reported-and-tested-by: syzbot+fb347cf82c73a90efcca@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin Signed-off-by: Steffen Klassert (cherry picked from commit 7c1a80e80cde008f271bae630d28cf684351e807) Bug: 187129171 Signed-off-by: Connor O'Brien Change-Id: I4270f5f9f748d6ecd52dd62118b32a70d0921d4b --- net/xfrm/xfrm_user.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index bb0d33ac28bd..40ea3d553a33 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -2754,6 +2754,16 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, err = link->doit(skb, nlh, attrs); + /* We need to free skb allocated in xfrm_alloc_compat() before + * returning from this function, because consume_skb() won't take + * care of frag_list since netlink destructor sets + * sbk->head to NULL. (see netlink_skb_destructor()) + */ + if (skb_has_frag_list(skb)) { + kfree_skb(skb_shinfo(skb)->frag_list); + skb_shinfo(skb)->frag_list = NULL; + } + err: kvfree(nlh64); return err; From 3aeff147960e7b288d8f152831801ee88476ec59 Mon Sep 17 00:00:00 2001 From: Ming Lei Date: Wed, 11 Aug 2021 22:26:24 +0800 Subject: [PATCH 05/14] UPSTREAM: blk-mq: fix kernel panic during iterating over flush request For fixing use-after-free during iterating over requests, we grabbed request's refcount before calling ->fn in commit 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter"). Turns out this way may cause kernel panic when iterating over one flush request: 1) old flush request's tag is just released, and this tag is reused by one new request, but ->rqs[] isn't updated yet 2) the flush request can be re-used for submitting one new flush command, so blk_rq_init() is called at the same time 3) meantime blk_mq_queue_tag_busy_iter() is called, and old flush request is retrieved from ->rqs[tag]; when blk_mq_put_rq_ref() is called, flush_rq->end_io may not be updated yet, so NULL pointer dereference is triggered in blk_mq_put_rq_ref(). Fix the issue by calling refcount_set(&flush_rq->ref, 1) after flush_rq->end_io is set. So far the only other caller of blk_rq_init() is scsi_ioctl_reset() in which the request doesn't enter block IO stack and the request reference count isn't used, so the change is safe. Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter") Reported-by: "Blank-Burian, Markus, Dr." Tested-by: "Blank-Burian, Markus, Dr." Signed-off-by: Ming Lei Reviewed-by: Christoph Hellwig Reviewed-by: John Garry Link: https://lore.kernel.org/r/20210811142624.618598-1-ming.lei@redhat.com Signed-off-by: Jens Axboe (cherry picked from commit c2da19ed50554ce52ecbad3655c98371fe58599f) Bug: 187129171 Signed-off-by: Connor O'Brien Change-Id: Id7fb5f38b0fe35331df98ec2f96e4914f15d981c --- block/blk-core.c | 1 - block/blk-flush.c | 8 ++++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/block/blk-core.c b/block/blk-core.c index 08966d8574e6..eeb6b0245e18 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -120,7 +120,6 @@ void blk_rq_init(struct request_queue *q, struct request *rq) rq->internal_tag = -1; rq->start_time_ns = ktime_get_ns(); rq->part = NULL; - refcount_set(&rq->ref, 1); } EXPORT_SYMBOL(blk_rq_init); diff --git a/block/blk-flush.c b/block/blk-flush.c index e5735a213db7..04bcb6feb1d1 100644 --- a/block/blk-flush.c +++ b/block/blk-flush.c @@ -325,6 +325,14 @@ static void blk_kick_flush(struct request_queue *q, struct blk_flush_queue *fq, flush_rq->rq_flags |= RQF_FLUSH_SEQ; flush_rq->rq_disk = first_rq->rq_disk; flush_rq->end_io = flush_end_io; + /* + * Order WRITE ->end_io and WRITE rq->ref, and its pair is the one + * implied in refcount_inc_not_zero() called from + * blk_mq_find_and_get_req(), which orders WRITE/READ flush_rq->ref + * and READ flush_rq->end_io + */ + smp_wmb(); + refcount_set(&flush_rq->ref, 1); blk_flush_queue_rq(flush_rq, false); } From b9d179c605d3bbaf1ca38f1a1039416b5e57680c Mon Sep 17 00:00:00 2001 From: Yang Yingliang Date: Thu, 30 Sep 2021 16:57:14 +0800 Subject: [PATCH 06/14] UPSTREAM: driver core: Fix possible memory leak in device_link_add() I got memory leak as follows: unreferenced object 0xffff88801f0b2200 (size 64): comm "i2c-lis2hh12-21", pid 5455, jiffies 4294944606 (age 15.224s) hex dump (first 32 bytes): 72 65 67 75 6c 61 74 6f 72 3a 72 65 67 75 6c 61 regulator:regula 74 6f 72 2e 30 2d 2d 69 32 63 3a 31 2d 30 30 31 tor.0--i2c:1-001 backtrace: [<00000000bf5b0c3b>] __kmalloc_track_caller+0x19f/0x3a0 [<0000000050da42d9>] kvasprintf+0xb5/0x150 [<000000004bbbed13>] kvasprintf_const+0x60/0x190 [<00000000cdac7480>] kobject_set_name_vargs+0x56/0x150 [<00000000bf83f8e8>] dev_set_name+0xc0/0x100 [<00000000cc1cf7e3>] device_link_add+0x6b4/0x17c0 [<000000009db9faed>] _regulator_get+0x297/0x680 [<00000000845e7f2b>] _devm_regulator_get+0x5b/0xe0 [<000000003958ee25>] st_sensors_power_enable+0x71/0x1b0 [st_sensors] [<000000005f450f52>] st_accel_i2c_probe+0xd9/0x150 [st_accel_i2c] [<00000000b5f2ab33>] i2c_device_probe+0x4d8/0xbe0 [<0000000070fb977b>] really_probe+0x299/0xc30 [<0000000088e226ce>] __driver_probe_device+0x357/0x500 [<00000000c21dda32>] driver_probe_device+0x4e/0x140 [<000000004e650441>] __device_attach_driver+0x257/0x340 [<00000000cf1891b8>] bus_for_each_drv+0x166/0x1e0 When device_register() returns an error, the name allocated in dev_set_name() will be leaked, the put_device() should be used instead of kfree() to give up the device reference, then the name will be freed in kobject_cleanup() and the references of consumer and supplier will be decreased in device_link_release_fn(). Fixes: 287905e68dd2 ("driver core: Expose device link details in sysfs") Reported-by: Hulk Robot Reviewed-by: Saravana Kannan Reviewed-by: Rafael J. Wysocki Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20210930085714.2057460-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman (cherry picked from commit df0a18149474c7e6b21f6367fbc6bc8d0f192444) Bug: 187129171 Signed-off-by: Connor O'Brien Change-Id: Iba22f7d2f05da2cd24abe157d36fcb4c05b8ee82 --- drivers/base/core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/base/core.c b/drivers/base/core.c index 50bece594b36..f0a71c35dea3 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -642,9 +642,7 @@ struct device_link *device_link_add(struct device *consumer, dev_set_name(&link->link_dev, "%s--%s", dev_name(supplier), dev_name(consumer)); if (device_register(&link->link_dev)) { - put_device(consumer); - put_device(supplier); - kfree(link); + put_device(&link->link_dev); link = NULL; goto out; } From 693158f765d33fd7352f1e450ae7487da4cc0739 Mon Sep 17 00:00:00 2001 From: Bui Quang Minh Date: Sun, 13 Jun 2021 21:34:39 +0700 Subject: [PATCH 07/14] UPSTREAM: bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc commit 7dd5d437c258bbf4cc15b35229e5208b87b8b4e0 upstream. In 32-bit architecture, the result of sizeof() is a 32-bit integer so the expression becomes the multiplication between 2 32-bit integer which can potentially leads to integer overflow. As a result, bpf_map_area_alloc() allocates less memory than needed. Fix this by casting 1 operand to u64. Fixes: 0d2c4f964050 ("bpf: Eliminate rlimit-based memory accounting for sockmap and sockhash maps") Fixes: 99c51064fb06 ("devmap: Use bpf_map_area_alloc() for allocating hash buckets") Fixes: 546ac1ffb70d ("bpf: add devmap, a map for storing net device references") Signed-off-by: Bui Quang Minh Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210613143440.71975-1-minhquangbui99@gmail.com Signed-off-by: Connor O'Brien Signed-off-by: Greg Kroah-Hartman Signed-off-by: Lee Jones Change-Id: I9ce1991224a87eb39acf1da4923534e22380fc42 --- kernel/bpf/devmap.c | 4 ++-- net/core/sock_map.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c index 6684696fa457..4b2819b0a05a 100644 --- a/kernel/bpf/devmap.c +++ b/kernel/bpf/devmap.c @@ -94,7 +94,7 @@ static struct hlist_head *dev_map_create_hash(unsigned int entries, int i; struct hlist_head *hash; - hash = bpf_map_area_alloc(entries * sizeof(*hash), numa_node); + hash = bpf_map_area_alloc((u64) entries * sizeof(*hash), numa_node); if (hash != NULL) for (i = 0; i < entries; i++) INIT_HLIST_HEAD(&hash[i]); @@ -159,7 +159,7 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr) spin_lock_init(&dtab->index_lock); } else { - dtab->netdev_map = bpf_map_area_alloc(dtab->map.max_entries * + dtab->netdev_map = bpf_map_area_alloc((u64) dtab->map.max_entries * sizeof(struct bpf_dtab_netdev *), dtab->map.numa_node); if (!dtab->netdev_map) diff --git a/net/core/sock_map.c b/net/core/sock_map.c index df52061f99f7..2646e8f98f67 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -48,7 +48,7 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr) if (err) goto free_stab; - stab->sks = bpf_map_area_alloc(stab->map.max_entries * + stab->sks = bpf_map_area_alloc((u64) stab->map.max_entries * sizeof(struct sock *), stab->map.numa_node); if (stab->sks) From f1a1171f3c5912e7b5911488d15065f2598fca5b Mon Sep 17 00:00:00 2001 From: Jens Wiklander Date: Thu, 9 Dec 2021 15:59:37 +0100 Subject: [PATCH 08/14] UPSTREAM: tee: handle lookup of shm with reference count 0 commit dfd0743f1d9ea76931510ed150334d571fbab49d upstream. Since the tee subsystem does not keep a strong reference to its idle shared memory buffers, it races with other threads that try to destroy a shared memory through a close of its dma-buf fd or by unmapping the memory. In tee_shm_get_from_id() when a lookup in teedev->idr has been successful, it is possible that the tee_shm is in the dma-buf teardown path, but that path is blocked by the teedev mutex. Since we don't have an API to tell if the tee_shm is in the dma-buf teardown path or not we must find another way of detecting this condition. Fix this by doing the reference counting directly on the tee_shm using a new refcount_t refcount field. dma-buf is replaced by using anon_inode_getfd() instead, this separates the life-cycle of the underlying file from the tee_shm. tee_shm_put() is updated to hold the mutex when decreasing the refcount to 0 and then remove the tee_shm from teedev->idr before releasing the mutex. This means that the tee_shm can never be found unless it has a refcount larger than 0. Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem") Cc: stable@vger.kernel.org Reviewed-by: Greg Kroah-Hartman Reviewed-by: Lars Persson Reviewed-by: Sumit Garg Reported-by: Patrik Lantz [JW: backport to 5.4-stable] Signed-off-by: Jens Wiklander Signed-off-by: Greg Kroah-Hartman Signed-off-by: Lee Jones Change-Id: Ibd2809a225b167563c65faff4a44e56e23c2e97b --- drivers/tee/tee_shm.c | 177 +++++++++++++++------------------------- include/linux/tee_drv.h | 4 +- 2 files changed, 69 insertions(+), 112 deletions(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index d6491e973fa4..0d5ae8053049 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -1,26 +1,18 @@ // SPDX-License-Identifier: GPL-2.0-only /* - * Copyright (c) 2015-2016, Linaro Limited + * Copyright (c) 2015-2017, 2019-2021 Linaro Limited */ +#include #include -#include -#include #include +#include #include #include #include #include "tee_private.h" -static void tee_shm_release(struct tee_shm *shm) +static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm) { - struct tee_device *teedev = shm->teedev; - - mutex_lock(&teedev->mutex); - idr_remove(&teedev->idr, shm->id); - if (shm->ctx) - list_del(&shm->link); - mutex_unlock(&teedev->mutex); - if (shm->flags & TEE_SHM_POOL) { struct tee_shm_pool_mgr *poolm; @@ -52,51 +44,6 @@ static void tee_shm_release(struct tee_shm *shm) tee_device_put(teedev); } -static struct sg_table *tee_shm_op_map_dma_buf(struct dma_buf_attachment - *attach, enum dma_data_direction dir) -{ - return NULL; -} - -static void tee_shm_op_unmap_dma_buf(struct dma_buf_attachment *attach, - struct sg_table *table, - enum dma_data_direction dir) -{ -} - -static void tee_shm_op_release(struct dma_buf *dmabuf) -{ - struct tee_shm *shm = dmabuf->priv; - - tee_shm_release(shm); -} - -static void *tee_shm_op_map(struct dma_buf *dmabuf, unsigned long pgnum) -{ - return NULL; -} - -static int tee_shm_op_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma) -{ - struct tee_shm *shm = dmabuf->priv; - size_t size = vma->vm_end - vma->vm_start; - - /* Refuse sharing shared memory provided by application */ - if (shm->flags & TEE_SHM_REGISTER) - return -EINVAL; - - return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT, - size, vma->vm_page_prot); -} - -static const struct dma_buf_ops tee_shm_dma_buf_ops = { - .map_dma_buf = tee_shm_op_map_dma_buf, - .unmap_dma_buf = tee_shm_op_unmap_dma_buf, - .release = tee_shm_op_release, - .map = tee_shm_op_map, - .mmap = tee_shm_op_mmap, -}; - static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, struct tee_device *teedev, size_t size, u32 flags) @@ -137,6 +84,7 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, goto err_dev_put; } + refcount_set(&shm->refcount, 1); shm->flags = flags | TEE_SHM_POOL; shm->teedev = teedev; shm->ctx = ctx; @@ -159,21 +107,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, goto err_pool_free; } - if (flags & TEE_SHM_DMA_BUF) { - DEFINE_DMA_BUF_EXPORT_INFO(exp_info); - - exp_info.ops = &tee_shm_dma_buf_ops; - exp_info.size = shm->size; - exp_info.flags = O_RDWR; - exp_info.priv = shm; - - shm->dmabuf = dma_buf_export(&exp_info); - if (IS_ERR(shm->dmabuf)) { - ret = ERR_CAST(shm->dmabuf); - goto err_rem; - } - } - if (ctx) { teedev_ctx_get(ctx); mutex_lock(&teedev->mutex); @@ -182,10 +115,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, } return shm; -err_rem: - mutex_lock(&teedev->mutex); - idr_remove(&teedev->idr, shm->id); - mutex_unlock(&teedev->mutex); err_pool_free: poolm->ops->free(poolm, shm); err_kfree: @@ -268,6 +197,7 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, goto err; } + refcount_set(&shm->refcount, 1); shm->flags = flags | TEE_SHM_REGISTER; shm->teedev = teedev; shm->ctx = ctx; @@ -309,22 +239,6 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, goto err; } - if (flags & TEE_SHM_DMA_BUF) { - DEFINE_DMA_BUF_EXPORT_INFO(exp_info); - - exp_info.ops = &tee_shm_dma_buf_ops; - exp_info.size = shm->size; - exp_info.flags = O_RDWR; - exp_info.priv = shm; - - shm->dmabuf = dma_buf_export(&exp_info); - if (IS_ERR(shm->dmabuf)) { - ret = ERR_CAST(shm->dmabuf); - teedev->desc->ops->shm_unregister(ctx, shm); - goto err; - } - } - mutex_lock(&teedev->mutex); list_add_tail(&shm->link, &ctx->list_shm); mutex_unlock(&teedev->mutex); @@ -352,6 +266,35 @@ err: } EXPORT_SYMBOL_GPL(tee_shm_register); +static int tee_shm_fop_release(struct inode *inode, struct file *filp) +{ + tee_shm_put(filp->private_data); + return 0; +} + +static int tee_shm_fop_mmap(struct file *filp, struct vm_area_struct *vma) +{ + struct tee_shm *shm = filp->private_data; + size_t size = vma->vm_end - vma->vm_start; + + /* Refuse sharing shared memory provided by application */ + if (shm->flags & TEE_SHM_USER_MAPPED) + return -EINVAL; + + /* check for overflowing the buffer's size */ + if (vma->vm_pgoff + vma_pages(vma) > shm->size >> PAGE_SHIFT) + return -EINVAL; + + return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT, + size, vma->vm_page_prot); +} + +static const struct file_operations tee_shm_fops = { + .owner = THIS_MODULE, + .release = tee_shm_fop_release, + .mmap = tee_shm_fop_mmap, +}; + /** * tee_shm_get_fd() - Increase reference count and return file descriptor * @shm: Shared memory handle @@ -364,10 +307,11 @@ int tee_shm_get_fd(struct tee_shm *shm) if (!(shm->flags & TEE_SHM_DMA_BUF)) return -EINVAL; - get_dma_buf(shm->dmabuf); - fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC); + /* matched by tee_shm_put() in tee_shm_op_release() */ + refcount_inc(&shm->refcount); + fd = anon_inode_getfd("tee_shm", &tee_shm_fops, shm, O_RDWR); if (fd < 0) - dma_buf_put(shm->dmabuf); + tee_shm_put(shm); return fd; } @@ -377,17 +321,7 @@ int tee_shm_get_fd(struct tee_shm *shm) */ void tee_shm_free(struct tee_shm *shm) { - /* - * dma_buf_put() decreases the dmabuf reference counter and will - * call tee_shm_release() when the last reference is gone. - * - * In the case of driver private memory we call tee_shm_release - * directly instead as it doesn't have a reference counter. - */ - if (shm->flags & TEE_SHM_DMA_BUF) - dma_buf_put(shm->dmabuf); - else - tee_shm_release(shm); + tee_shm_put(shm); } EXPORT_SYMBOL_GPL(tee_shm_free); @@ -494,10 +428,15 @@ struct tee_shm *tee_shm_get_from_id(struct tee_context *ctx, int id) teedev = ctx->teedev; mutex_lock(&teedev->mutex); shm = idr_find(&teedev->idr, id); + /* + * If the tee_shm was found in the IDR it must have a refcount + * larger than 0 due to the guarantee in tee_shm_put() below. So + * it's safe to use refcount_inc(). + */ if (!shm || shm->ctx != ctx) shm = ERR_PTR(-EINVAL); - else if (shm->flags & TEE_SHM_DMA_BUF) - get_dma_buf(shm->dmabuf); + else + refcount_inc(&shm->refcount); mutex_unlock(&teedev->mutex); return shm; } @@ -509,7 +448,25 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); */ void tee_shm_put(struct tee_shm *shm) { - if (shm->flags & TEE_SHM_DMA_BUF) - dma_buf_put(shm->dmabuf); + struct tee_device *teedev = shm->teedev; + bool do_release = false; + + mutex_lock(&teedev->mutex); + if (refcount_dec_and_test(&shm->refcount)) { + /* + * refcount has reached 0, we must now remove it from the + * IDR before releasing the mutex. This will guarantee that + * the refcount_inc() in tee_shm_get_from_id() never starts + * from 0. + */ + idr_remove(&teedev->idr, shm->id); + if (shm->ctx) + list_del(&shm->link); + do_release = true; + } + mutex_unlock(&teedev->mutex); + + if (do_release) + tee_shm_release(teedev, shm); } EXPORT_SYMBOL_GPL(tee_shm_put); diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h index cd15c1b7fae0..e08ace76eba6 100644 --- a/include/linux/tee_drv.h +++ b/include/linux/tee_drv.h @@ -178,7 +178,7 @@ void tee_device_unregister(struct tee_device *teedev); * @offset: offset of buffer in user space * @pages: locked pages from userspace * @num_pages: number of locked pages - * @dmabuf: dmabuf used to for exporting to user space + * @refcount: reference counter * @flags: defined by TEE_SHM_* in tee_drv.h * @id: unique id of a shared memory object on this device * @@ -195,7 +195,7 @@ struct tee_shm { unsigned int offset; struct page **pages; size_t num_pages; - struct dma_buf *dmabuf; + refcount_t refcount; u32 flags; int id; }; From 7aedba616cb4be30908dfc62187fa6688c79fdff Mon Sep 17 00:00:00 2001 From: Todd Kjos Date: Mon, 20 Dec 2021 11:01:50 -0800 Subject: [PATCH 09/14] UPSTREAM: binder: fix async_free_space accounting for empty parcels commit cfd0d84ba28c18b531648c9d4a35ecca89ad9901 upstream. In 4.13, commit 74310e06be4d ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are the same except for this corner case of asynchronous transactions with payloads < 8 bytes. Fixes: 74310e06be4d ("android: binder: Move buffer out of area shared with user space") Signed-off-by: Todd Kjos Cc: stable@vger.kernel.org # 4.14+ Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman Change-Id: Ie01082a056bff56f51035c0f6be34e136bd56faf --- drivers/android/binder_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index 2739ebbc684b..add45eb9ea97 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -662,7 +662,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size); if (buffer->async_transaction) { - alloc->free_async_space += size + sizeof(struct binder_buffer); + alloc->free_async_space += buffer_size + sizeof(struct binder_buffer); binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, "%d: binder_free_buf size %zd async free %zd\n", From fe0c18d0f08da58acf328686a0c78682b54de6b8 Mon Sep 17 00:00:00 2001 From: Tadeusz Struk Date: Wed, 26 Jan 2022 13:09:39 -0800 Subject: [PATCH 10/14] ANDROID: incremental-fs: remove index and incomplete dir on umount Cleanup incremental-fs left overs on umount, otherwise incr-fs will complain as below: BUG: Dentry {i=47a,n=.incomplete} still in use [unmount of incremental-fs] This requires vfs_rmdir() of the special index dir. Since set_anon_super() was used in incfs_mount_fs() the incfs_kill_sb() should use kill_anon_super() instead of generic_shutdown_super() otherwise it will leak the pseudo dev_t that set_anon_super() allocates. Bug: 211066171 Signed-off-by: Tadeusz Struk Change-Id: I7ea54db63513fc130e1997cbf79121015ee12405 --- fs/incfs/vfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/incfs/vfs.c b/fs/incfs/vfs.c index 8d4c4e39fa46..ceb0c2e41402 100644 --- a/fs/incfs/vfs.c +++ b/fs/incfs/vfs.c @@ -2269,7 +2269,7 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags, goto err; } - path_put(&backing_dir_path); + mi->mi_backing_dir_path = backing_dir_path; sb->s_flags |= SB_ACTIVE; pr_debug("incfs: mount\n"); @@ -2309,8 +2309,9 @@ void incfs_kill_sb(struct super_block *sb) struct mount_info *mi = sb->s_fs_info; pr_debug("incfs: unmount\n"); + vfs_rmdir(d_inode(mi->mi_backing_dir_path.dentry), mi->mi_index_dir); + kill_anon_super(sb); incfs_free_mount_info(mi); - generic_shutdown_super(sb); sb->s_fs_info = NULL; } From 4ec7ffac469baf161683aa47a256c6350899855b Mon Sep 17 00:00:00 2001 From: "Eric W. Biederman" Date: Thu, 20 Jan 2022 11:04:01 -0600 Subject: [PATCH 11/14] UPSTREAM: cgroup-v1: Require capabilities to set release_agent The cgroup release_agent is called with call_usermodehelper. The function call_usermodehelper starts the release_agent with a full set fo capabilities. Therefore require capabilities when setting the release_agaent. Reported-by: Tabitha Sable Tested-by: Tabitha Sable Fixes: 81a6a5cdd2c5 ("Task Control Groups: automatic userspace notification of idle cgroups") Cc: stable@vger.kernel.org # v2.6.24+ Signed-off-by: "Eric W. Biederman" Signed-off-by: Tejun Heo (cherry picked from commit 24f6008564183aa120d07c03d9289519c2fe02af) Signed-off-by: Greg Kroah-Hartman Change-Id: If663568d24f781c58c882d69a5b81a9327c0e6fe --- kernel/cgroup/cgroup-v1.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c index b513f70b0cc0..17bf2db821c6 100644 --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -552,6 +552,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of, BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX); + /* + * Release agent gets called with all capabilities, + * require capabilities to set release agent. + */ + if ((of->file->f_cred->user_ns != &init_user_ns) || + !capable(CAP_SYS_ADMIN)) + return -EPERM; + cgrp = cgroup_kn_lock_live(of->kn, false); if (!cgrp) return -ENODEV; @@ -964,6 +972,12 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param) /* Specifying two release agents is forbidden */ if (ctx->release_agent) return cg_invalf(fc, "cgroup1: release_agent respecified"); + /* + * Release agent gets called with all capabilities, + * require capabilities to set release agent. + */ + if ((fc->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN)) + return cg_invalf(fc, "cgroup1: Setting release_agent not allowed"); ctx->release_agent = param->string; param->string = NULL; break; From 15dd5a8bc02bd6d83d87899c7b6952e058302e88 Mon Sep 17 00:00:00 2001 From: Alistair Delva Date: Mon, 7 Feb 2022 10:30:55 -0800 Subject: [PATCH 12/14] ANDROID: Increase x86 cmdline size to 4k Recently we have started adding more things to kernel command line with the new bootloader able to pass through crosvm built-in cmdline, and on 4.19 this causes problems because all bootconfig keys are also passed as cmdline, exceeding the 2048 byte limit. This causes cmdline truncation which dumps the device in recovery mode. Bump it up until we can turn this testing down. Bug: 217879977 Signed-off-by: Alistair Delva Change-Id: If341f72394de879d43da5206675d21683495d1d0 --- arch/x86/include/asm/setup.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h index ed8ec011a9fd..42f3e42a10ee 100644 --- a/arch/x86/include/asm/setup.h +++ b/arch/x86/include/asm/setup.h @@ -4,7 +4,7 @@ #include -#define COMMAND_LINE_SIZE 2048 +#define COMMAND_LINE_SIZE 4096 #include #include From 813b12454e6ef77c5179b5f51cc5f9fed97cce40 Mon Sep 17 00:00:00 2001 From: Amit Pundir Date: Mon, 7 Feb 2022 15:45:29 +0530 Subject: [PATCH 13/14] ANDROID: GKI: db845c: Update symbols list and ABI android11-5.4 is broken on Dragonboard 845c because of recently added symbols. So updating the symbols list by running: BUILD_CONFIG=common/build.config.db845c build/build_abi.sh -s And updated the abi_gki_aarch64 ABI by running: "BUILD_CONFIG=common/build.config.gki.aarch64 \ ABI_DEFINITION=abi_gki_aarch64.xml build/build_abi.sh \ --update --print-report" ======================================================== Leaf changes summary: 1 artifact changed (4 filtered out) Changed leaf types summary: 0 (4 filtered out) leaf types changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 1 Added function: [A] 'function void kill_anon_super(super_block*)' ======================================================== Bug: 146449535 Signed-off-by: Amit Pundir Change-Id: Ibebf64f3484ed20662487dae0d7db0ef5fac708a --- android/abi_gki_aarch64.xml | 3714 ++++++++++++++++---------------- android/abi_gki_aarch64_db845c | 5 +- 2 files changed, 1877 insertions(+), 1842 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index d9c149005f72..ebc1d68e38dc 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -2365,6 +2365,7 @@ + @@ -6213,12 +6214,12 @@ - + - + - + @@ -6884,12 +6885,12 @@ - + - + - + @@ -19586,109 +19587,109 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -22162,9 +22163,9 @@ - + - + @@ -23718,6 +23719,17 @@ + + + + + + + + + + + @@ -25155,165 +25167,165 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -25932,6 +25944,11 @@ + + + + + @@ -26343,7 +26360,7 @@ - + @@ -26397,7 +26414,7 @@ - + @@ -28617,18 +28634,18 @@ - + - + - + - + - + @@ -31261,7 +31278,7 @@ - + @@ -31269,7 +31286,7 @@ - + @@ -32557,7 +32574,7 @@ - + @@ -32819,7 +32836,7 @@ - + @@ -35859,109 +35876,109 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -37083,6 +37100,14 @@ + + + + + + + + @@ -37877,14 +37902,6 @@ - - - - - - - - @@ -46666,13 +46683,6 @@ - - - - - - - @@ -46773,102 +46783,102 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -46877,7 +46887,7 @@ - + @@ -46901,347 +46911,347 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -47268,63 +47278,63 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -47412,12 +47422,12 @@ - + - + - + @@ -47484,24 +47494,24 @@ - + - + - + - + - + - + - + @@ -48200,22 +48210,22 @@ - - + + - - + + - - + + - - - - + + + + @@ -48224,18 +48234,18 @@ - - + + - - - - + + + + - - + + @@ -48370,7 +48380,7 @@ - + @@ -48789,18 +48799,18 @@ - - + + - - - + + + - - - + + + @@ -48845,42 +48855,42 @@ - - - + + + - - - + + + - - + + - - - + + + - - + + - - - - - + + + + + - - + + @@ -48895,13 +48905,13 @@ - - - + + + - - + + @@ -55450,6 +55460,12 @@ + + + + + + @@ -55831,97 +55847,97 @@ - - + + - - + + - - - - - + + + + + - - - - + + + + - - - - - + + + + + - - - - + + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - - + + + + - - - - - + + + + + - - - + + + - - - + + + - - - + + + - - - + + + @@ -67103,55 +67119,55 @@ - - - + + + - - - - - + + + + + - - - + + + - - - - - + + + + + - - - + + + - - - - + + + + - - - - + + + + - - - + + + - - - + + + @@ -73937,16 +73953,6 @@ - - - - - - - - - - @@ -73960,12 +73966,6 @@ - - - - - - @@ -78188,6 +78188,12 @@ + + + + + + @@ -81841,6 +81847,16 @@ + + + + + + + + + + @@ -85969,11 +85985,11 @@ - + - + @@ -85981,14 +85997,14 @@ - + - + - + @@ -91169,12 +91185,12 @@ - + - + @@ -91183,7 +91199,7 @@ - + @@ -92138,422 +92154,422 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -92573,63 +92589,63 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -92655,59 +92671,59 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -92733,7 +92749,7 @@ - + @@ -92799,13 +92815,13 @@ - + - + @@ -105551,10 +105567,10 @@ - - - - + + + + @@ -107366,8 +107382,8 @@ - - + + @@ -107393,74 +107409,74 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - + + - - + + - - + + - - - + + + - - + + - - - + + + - - - - - + + + + + - - + + - - + + - - + + - - - + + + @@ -107795,25 +107811,25 @@ - - + + - - + + - - - - + + + + - - - - - + + + + + @@ -108222,8 +108238,8 @@ - - + + @@ -108243,52 +108259,52 @@ - - - - + + + + - + - + - - - - - - + + - - + + - - + + - - + + + + + + - - - + + + @@ -108297,18 +108313,18 @@ - - + + - - - + + + - - - + + + @@ -108318,28 +108334,28 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - + + @@ -108478,7 +108494,7 @@ - + @@ -108541,54 +108557,54 @@ - - + + - - + + - - + + - - - + + + - - - + + + - - + + - - - - - + + + + + - - - - + + + + - - - - + + + + - - - + + + @@ -109234,7 +109250,7 @@ - + @@ -109256,7 +109272,7 @@ - + @@ -109266,7 +109282,7 @@ - + @@ -109274,12 +109290,12 @@ - + - + @@ -109302,7 +109318,7 @@ - + @@ -109318,15 +109334,15 @@ - + - + - + @@ -109337,7 +109353,7 @@ - + @@ -109351,7 +109367,7 @@ - + @@ -109906,7 +109922,7 @@ - + @@ -109983,12 +109999,12 @@ - + - + @@ -110002,11 +110018,6 @@ - - - - - @@ -112435,53 +112446,53 @@ - - + + - - - + + + - - - - - - - - + + + + + + + + - - - - - - - - + + + + + + + + - - - - - - - - + + + + + + + + - - - - - - - - + + + + + + + + @@ -112914,165 +112925,165 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -113186,18 +113197,18 @@ - + - + - + - + - + @@ -114635,7 +114646,23 @@ - + + + + + + + + + + + + + + + + + @@ -114823,7 +114850,7 @@ - + @@ -114902,7 +114929,7 @@ - + @@ -114951,7 +114978,7 @@ - + @@ -115242,7 +115269,7 @@ - + @@ -115253,7 +115280,7 @@ - + @@ -115261,7 +115288,7 @@ - + @@ -115711,7 +115738,7 @@ - + @@ -117045,12 +117072,6 @@ - - - - - - @@ -117058,6 +117079,12 @@ + + + + + + @@ -117124,16 +117151,16 @@ - - - - + + + + - - - - + + + + @@ -117489,21 +117516,21 @@ - - + + - - + + - - + + - - - + + + @@ -119181,7 +119208,7 @@ - + @@ -119194,31 +119221,31 @@ - + - + - + - + - - + + - - - - - + + + + + - - + + @@ -119289,24 +119316,24 @@ - + - + - + - + - + - - + + @@ -119325,8 +119352,8 @@ - - + + @@ -119361,85 +119388,85 @@ - - + + - - + + - - - - + + + + - - + + - - - + + + - - - - + + + + - - - - + + + + - - + + - - - + + + - - + + - - - + + + - - + + - - + + - - + + - - - + + + - + - + @@ -119480,7 +119507,7 @@ - + @@ -119495,72 +119522,72 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -119611,44 +119638,44 @@ - - - + + + - + - + - + - + - + - + - - + + - - + + @@ -119657,22 +119684,22 @@ - - + + - - + + - + - + - + @@ -119730,7 +119757,7 @@ - + @@ -120021,17 +120048,17 @@ - - - - + + + + - - - - - + + + + + @@ -124742,9 +124769,9 @@ - - - + + + @@ -126123,12 +126150,12 @@ - - + + - - + + @@ -128948,15 +128975,15 @@ - + - + - + @@ -129104,57 +129131,57 @@ - - + + - - - + + + - - + + - - - - - - + + + + + + - - - - - - - + + + + + + + - - - - - - - - + + + + + + + + - - + + - - + + - - - + + + @@ -130964,38 +130991,38 @@ - - - - - - - + + + + + + + - - - - + + + + - - - - - + + + + + - - - - - - + + + + + + - - + + @@ -136308,8 +136335,8 @@ - - + + @@ -139148,9 +139175,9 @@ - - - + + + @@ -139743,9 +139770,9 @@ - - - + + + @@ -140217,15 +140244,15 @@ - + - + - + - + @@ -140264,7 +140291,7 @@ - + @@ -140274,7 +140301,7 @@ - + @@ -140285,17 +140312,17 @@ - + - + - + @@ -140305,13 +140332,13 @@ - + - + @@ -140322,22 +140349,22 @@ - + - + - + - + @@ -142479,9 +142506,9 @@ - - - + + + @@ -142494,20 +142521,20 @@ - - + + - - + + - - + + - - + + @@ -142518,8 +142545,8 @@ - - + + @@ -144275,28 +144302,28 @@ - - + + - - + + - - + + - - + + - - + + - - + + @@ -144628,9 +144655,9 @@ - - - + + + @@ -147369,6 +147396,10 @@ + + + + @@ -147719,24 +147750,24 @@ - + - + - + - + - + - + - + @@ -147984,18 +148015,18 @@ - + - + - + - + - + @@ -148505,7 +148536,7 @@ - + @@ -148606,6 +148637,12 @@ + + + + + + @@ -148980,6 +149017,13 @@ + + + + + + + @@ -149670,20 +149714,20 @@ - - + + - - + + - - + + - - + + @@ -150813,7 +150857,7 @@ - + @@ -150824,35 +150868,35 @@ - + - + - - + + - - + + - - + + - - - + + + - - - - - - + + + + + + @@ -152753,12 +152797,12 @@ - + - + - + @@ -153706,9 +153750,9 @@ - + - + @@ -162851,22 +162895,22 @@ - - - + + + - - - - + + + + - - - - - + + + + + @@ -162933,19 +162977,19 @@ - - - - + + + + - - - + + + @@ -164174,18 +164218,18 @@ - + - + - + - + - + @@ -164416,7 +164460,7 @@ - + @@ -164640,12 +164684,12 @@ - + - + - + @@ -164700,7 +164744,7 @@ - + @@ -164838,12 +164882,12 @@ - + - + @@ -165101,10 +165145,10 @@ - - - - + + + + @@ -165623,12 +165667,6 @@ - - - - - - @@ -166568,15 +166606,15 @@ - - - - + + + + - - - + + + @@ -166670,12 +166708,6 @@ - - - - - - @@ -166898,209 +166930,9 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -167236,39 +167068,28 @@ - - - - - - - - - - - - - + + - - - + + + - - - + + + - + @@ -167343,106 +167164,99 @@ - - - - + + + + - - - - + + + + - - + + - - - - + + + + - - + + - - - - + + + + - - + + - - - + + + - - + + - - + + - - - - + + + + - - - - - - + + + + + + - - - + + + - - + + - - - + + + - - + + - - - - + + + + - - - + + + - - - - - - - @@ -167450,10 +167264,6 @@ - - - - @@ -167561,7 +167371,7 @@ - + @@ -167574,8 +167384,8 @@ - - + + @@ -167606,8 +167416,8 @@ - - + + @@ -167787,12 +167597,12 @@ - - + + - - + + @@ -167803,100 +167613,100 @@ - - - - - + + + + + - - - - + + + + - - - - - + + + + + - - - + + + - - - - - + + + + + - - - - + + + + - - - - - - - - - - - - - - - - - + - - - - + + - - - - - - + + + - - - - + + + - - - - - + + + + + + - - - - + + + + + + - - - - - + + + + + + + + + + + + + + + + + + + + + + + + @@ -168973,7 +168783,7 @@ - + @@ -171415,7 +171225,7 @@ - + @@ -171455,7 +171265,7 @@ - + @@ -171537,7 +171347,7 @@ - + @@ -171977,7 +171787,7 @@ - + @@ -173722,7 +173532,7 @@ - + @@ -173742,7 +173552,7 @@ - + @@ -173750,12 +173560,12 @@ - + - + @@ -173886,7 +173696,7 @@ - + @@ -175278,9 +175088,9 @@ - - - + + + @@ -175552,75 +175362,75 @@ - - - + + + - - - + + + - - - - + + + + - - - + + + - - - + + + - - + + - - + + - - - - + + + + - - - - - + + + + + - - - + + + - - - + + + - - - - + + + + - - - - - - + + + + + + @@ -177043,7 +176853,7 @@ - + @@ -177179,7 +176989,7 @@ - + @@ -177722,27 +177532,27 @@ - - - - - + + + + + - - - - - - - + + + + + + + - - - - - + + + + + @@ -178205,13 +178015,224 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -178293,7 +178314,7 @@ - + @@ -178306,6 +178327,17 @@ + + + + + + + + + + + @@ -184196,72 +184228,72 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - - - - + + + + + - - - - - - - - + + + + + + + + - - - - - - - - - - - + + + + + + + + + + + - - - - - - + + + + + + - - - + + + - - - + + + @@ -190945,16 +190977,16 @@ - - - - + + + + - - - - + + + + @@ -190963,69 +190995,69 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + diff --git a/android/abi_gki_aarch64_db845c b/android/abi_gki_aarch64_db845c index d9bc40995f5b..898684f65cfe 100644 --- a/android/abi_gki_aarch64_db845c +++ b/android/abi_gki_aarch64_db845c @@ -583,6 +583,7 @@ __kfifo_alloc __kfifo_free kmalloc_order_trace + ktime_get_with_offset __local_bh_enable_ip memmove param_ops_ulong @@ -590,6 +591,7 @@ __rcu_read_lock __rcu_read_unlock regulatory_hint + rfc1042_header skb_copy skb_realloc_headroom strlcat @@ -660,6 +662,7 @@ phy_pm_runtime_get_sync phy_pm_runtime_put_sync platform_get_irq_byname_optional + pm_runtime_barrier system_freezable_wq usb_add_gadget_udc usb_decode_ctrl @@ -733,7 +736,6 @@ generic_file_read_iter generic_file_splice_read generic_read_dir - generic_shutdown_super __get_free_pages get_zeroed_page iget5_locked @@ -745,6 +747,7 @@ kernel_read kernel_write kern_path + kill_anon_super kobject_create_and_add kobject_put lockref_get From 617c7432b539440179d095cba985f1ed70679fb1 Mon Sep 17 00:00:00 2001 From: Alistair Delva Date: Thu, 10 Feb 2022 11:20:10 -0800 Subject: [PATCH 14/14] ANDROID: GKI: Enable CONFIG_SERIAL_8250_RUNTIME_UARTS=0 8250_core registers 4 ISA uart ports by default, which can cause problems on some devices which don't have them. This change doesn't break earlycon=uart8250, but it will cause the 8250_of and 8250_pci sub drivers to be unable to register ports. Boards that really need the full 8250 driver to take over from earlycon can use the "8250.nr_uarts=X" kernel command line option to restore the ports allocation. Bug: 216312411 Signed-off-by: Alistair Delva Change-Id: I04715394b32bd98544657101de4537df34554ea9 [Lee: Fixed merge conflict] Signed-off-by: Lee Jones --- arch/arm64/configs/gki_defconfig | 1 + arch/x86/configs/gki_defconfig | 1 + 2 files changed, 2 insertions(+) diff --git a/arch/arm64/configs/gki_defconfig b/arch/arm64/configs/gki_defconfig index e0a67b0c52f4..67418fc50830 100644 --- a/arch/arm64/configs/gki_defconfig +++ b/arch/arm64/configs/gki_defconfig @@ -317,6 +317,7 @@ CONFIG_SERIAL_8250=y # CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set CONFIG_SERIAL_8250_CONSOLE=y # CONFIG_SERIAL_8250_EXAR is not set +CONFIG_SERIAL_8250_RUNTIME_UARTS=0 CONFIG_SERIAL_OF_PLATFORM=y CONFIG_SERIAL_AMBA_PL011=y CONFIG_SERIAL_AMBA_PL011_CONSOLE=y diff --git a/arch/x86/configs/gki_defconfig b/arch/x86/configs/gki_defconfig index 1da7f7fb4291..f3d46d70e639 100644 --- a/arch/x86/configs/gki_defconfig +++ b/arch/x86/configs/gki_defconfig @@ -289,6 +289,7 @@ CONFIG_INPUT_UINPUT=y CONFIG_SERIAL_8250=y # CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set CONFIG_SERIAL_8250_CONSOLE=y +CONFIG_SERIAL_8250_RUNTIME_UARTS=0 CONFIG_SERIAL_OF_PLATFORM=y CONFIG_SERIAL_DEV_BUS=y CONFIG_HW_RANDOM=y