From 693158f765d33fd7352f1e450ae7487da4cc0739 Mon Sep 17 00:00:00 2001 From: Bui Quang Minh Date: Sun, 13 Jun 2021 21:34:39 +0700 Subject: [PATCH 01/16] UPSTREAM: bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc commit 7dd5d437c258bbf4cc15b35229e5208b87b8b4e0 upstream. In 32-bit architecture, the result of sizeof() is a 32-bit integer so the expression becomes the multiplication between 2 32-bit integer which can potentially leads to integer overflow. As a result, bpf_map_area_alloc() allocates less memory than needed. Fix this by casting 1 operand to u64. Fixes: 0d2c4f964050 ("bpf: Eliminate rlimit-based memory accounting for sockmap and sockhash maps") Fixes: 99c51064fb06 ("devmap: Use bpf_map_area_alloc() for allocating hash buckets") Fixes: 546ac1ffb70d ("bpf: add devmap, a map for storing net device references") Signed-off-by: Bui Quang Minh Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210613143440.71975-1-minhquangbui99@gmail.com Signed-off-by: Connor O'Brien Signed-off-by: Greg Kroah-Hartman Signed-off-by: Lee Jones Change-Id: I9ce1991224a87eb39acf1da4923534e22380fc42 --- kernel/bpf/devmap.c | 4 ++-- net/core/sock_map.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c index 6684696fa457..4b2819b0a05a 100644 --- a/kernel/bpf/devmap.c +++ b/kernel/bpf/devmap.c @@ -94,7 +94,7 @@ static struct hlist_head *dev_map_create_hash(unsigned int entries, int i; struct hlist_head *hash; - hash = bpf_map_area_alloc(entries * sizeof(*hash), numa_node); + hash = bpf_map_area_alloc((u64) entries * sizeof(*hash), numa_node); if (hash != NULL) for (i = 0; i < entries; i++) INIT_HLIST_HEAD(&hash[i]); @@ -159,7 +159,7 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr) spin_lock_init(&dtab->index_lock); } else { - dtab->netdev_map = bpf_map_area_alloc(dtab->map.max_entries * + dtab->netdev_map = bpf_map_area_alloc((u64) dtab->map.max_entries * sizeof(struct bpf_dtab_netdev *), dtab->map.numa_node); if (!dtab->netdev_map) diff --git a/net/core/sock_map.c b/net/core/sock_map.c index df52061f99f7..2646e8f98f67 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -48,7 +48,7 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr) if (err) goto free_stab; - stab->sks = bpf_map_area_alloc(stab->map.max_entries * + stab->sks = bpf_map_area_alloc((u64) stab->map.max_entries * sizeof(struct sock *), stab->map.numa_node); if (stab->sks) From f1a1171f3c5912e7b5911488d15065f2598fca5b Mon Sep 17 00:00:00 2001 From: Jens Wiklander Date: Thu, 9 Dec 2021 15:59:37 +0100 Subject: [PATCH 02/16] UPSTREAM: tee: handle lookup of shm with reference count 0 commit dfd0743f1d9ea76931510ed150334d571fbab49d upstream. Since the tee subsystem does not keep a strong reference to its idle shared memory buffers, it races with other threads that try to destroy a shared memory through a close of its dma-buf fd or by unmapping the memory. In tee_shm_get_from_id() when a lookup in teedev->idr has been successful, it is possible that the tee_shm is in the dma-buf teardown path, but that path is blocked by the teedev mutex. Since we don't have an API to tell if the tee_shm is in the dma-buf teardown path or not we must find another way of detecting this condition. Fix this by doing the reference counting directly on the tee_shm using a new refcount_t refcount field. dma-buf is replaced by using anon_inode_getfd() instead, this separates the life-cycle of the underlying file from the tee_shm. tee_shm_put() is updated to hold the mutex when decreasing the refcount to 0 and then remove the tee_shm from teedev->idr before releasing the mutex. This means that the tee_shm can never be found unless it has a refcount larger than 0. Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem") Cc: stable@vger.kernel.org Reviewed-by: Greg Kroah-Hartman Reviewed-by: Lars Persson Reviewed-by: Sumit Garg Reported-by: Patrik Lantz [JW: backport to 5.4-stable] Signed-off-by: Jens Wiklander Signed-off-by: Greg Kroah-Hartman Signed-off-by: Lee Jones Change-Id: Ibd2809a225b167563c65faff4a44e56e23c2e97b --- drivers/tee/tee_shm.c | 177 +++++++++++++++------------------------- include/linux/tee_drv.h | 4 +- 2 files changed, 69 insertions(+), 112 deletions(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index d6491e973fa4..0d5ae8053049 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -1,26 +1,18 @@ // SPDX-License-Identifier: GPL-2.0-only /* - * Copyright (c) 2015-2016, Linaro Limited + * Copyright (c) 2015-2017, 2019-2021 Linaro Limited */ +#include #include -#include -#include #include +#include #include #include #include #include "tee_private.h" -static void tee_shm_release(struct tee_shm *shm) +static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm) { - struct tee_device *teedev = shm->teedev; - - mutex_lock(&teedev->mutex); - idr_remove(&teedev->idr, shm->id); - if (shm->ctx) - list_del(&shm->link); - mutex_unlock(&teedev->mutex); - if (shm->flags & TEE_SHM_POOL) { struct tee_shm_pool_mgr *poolm; @@ -52,51 +44,6 @@ static void tee_shm_release(struct tee_shm *shm) tee_device_put(teedev); } -static struct sg_table *tee_shm_op_map_dma_buf(struct dma_buf_attachment - *attach, enum dma_data_direction dir) -{ - return NULL; -} - -static void tee_shm_op_unmap_dma_buf(struct dma_buf_attachment *attach, - struct sg_table *table, - enum dma_data_direction dir) -{ -} - -static void tee_shm_op_release(struct dma_buf *dmabuf) -{ - struct tee_shm *shm = dmabuf->priv; - - tee_shm_release(shm); -} - -static void *tee_shm_op_map(struct dma_buf *dmabuf, unsigned long pgnum) -{ - return NULL; -} - -static int tee_shm_op_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma) -{ - struct tee_shm *shm = dmabuf->priv; - size_t size = vma->vm_end - vma->vm_start; - - /* Refuse sharing shared memory provided by application */ - if (shm->flags & TEE_SHM_REGISTER) - return -EINVAL; - - return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT, - size, vma->vm_page_prot); -} - -static const struct dma_buf_ops tee_shm_dma_buf_ops = { - .map_dma_buf = tee_shm_op_map_dma_buf, - .unmap_dma_buf = tee_shm_op_unmap_dma_buf, - .release = tee_shm_op_release, - .map = tee_shm_op_map, - .mmap = tee_shm_op_mmap, -}; - static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, struct tee_device *teedev, size_t size, u32 flags) @@ -137,6 +84,7 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, goto err_dev_put; } + refcount_set(&shm->refcount, 1); shm->flags = flags | TEE_SHM_POOL; shm->teedev = teedev; shm->ctx = ctx; @@ -159,21 +107,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, goto err_pool_free; } - if (flags & TEE_SHM_DMA_BUF) { - DEFINE_DMA_BUF_EXPORT_INFO(exp_info); - - exp_info.ops = &tee_shm_dma_buf_ops; - exp_info.size = shm->size; - exp_info.flags = O_RDWR; - exp_info.priv = shm; - - shm->dmabuf = dma_buf_export(&exp_info); - if (IS_ERR(shm->dmabuf)) { - ret = ERR_CAST(shm->dmabuf); - goto err_rem; - } - } - if (ctx) { teedev_ctx_get(ctx); mutex_lock(&teedev->mutex); @@ -182,10 +115,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, } return shm; -err_rem: - mutex_lock(&teedev->mutex); - idr_remove(&teedev->idr, shm->id); - mutex_unlock(&teedev->mutex); err_pool_free: poolm->ops->free(poolm, shm); err_kfree: @@ -268,6 +197,7 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, goto err; } + refcount_set(&shm->refcount, 1); shm->flags = flags | TEE_SHM_REGISTER; shm->teedev = teedev; shm->ctx = ctx; @@ -309,22 +239,6 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, goto err; } - if (flags & TEE_SHM_DMA_BUF) { - DEFINE_DMA_BUF_EXPORT_INFO(exp_info); - - exp_info.ops = &tee_shm_dma_buf_ops; - exp_info.size = shm->size; - exp_info.flags = O_RDWR; - exp_info.priv = shm; - - shm->dmabuf = dma_buf_export(&exp_info); - if (IS_ERR(shm->dmabuf)) { - ret = ERR_CAST(shm->dmabuf); - teedev->desc->ops->shm_unregister(ctx, shm); - goto err; - } - } - mutex_lock(&teedev->mutex); list_add_tail(&shm->link, &ctx->list_shm); mutex_unlock(&teedev->mutex); @@ -352,6 +266,35 @@ err: } EXPORT_SYMBOL_GPL(tee_shm_register); +static int tee_shm_fop_release(struct inode *inode, struct file *filp) +{ + tee_shm_put(filp->private_data); + return 0; +} + +static int tee_shm_fop_mmap(struct file *filp, struct vm_area_struct *vma) +{ + struct tee_shm *shm = filp->private_data; + size_t size = vma->vm_end - vma->vm_start; + + /* Refuse sharing shared memory provided by application */ + if (shm->flags & TEE_SHM_USER_MAPPED) + return -EINVAL; + + /* check for overflowing the buffer's size */ + if (vma->vm_pgoff + vma_pages(vma) > shm->size >> PAGE_SHIFT) + return -EINVAL; + + return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT, + size, vma->vm_page_prot); +} + +static const struct file_operations tee_shm_fops = { + .owner = THIS_MODULE, + .release = tee_shm_fop_release, + .mmap = tee_shm_fop_mmap, +}; + /** * tee_shm_get_fd() - Increase reference count and return file descriptor * @shm: Shared memory handle @@ -364,10 +307,11 @@ int tee_shm_get_fd(struct tee_shm *shm) if (!(shm->flags & TEE_SHM_DMA_BUF)) return -EINVAL; - get_dma_buf(shm->dmabuf); - fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC); + /* matched by tee_shm_put() in tee_shm_op_release() */ + refcount_inc(&shm->refcount); + fd = anon_inode_getfd("tee_shm", &tee_shm_fops, shm, O_RDWR); if (fd < 0) - dma_buf_put(shm->dmabuf); + tee_shm_put(shm); return fd; } @@ -377,17 +321,7 @@ int tee_shm_get_fd(struct tee_shm *shm) */ void tee_shm_free(struct tee_shm *shm) { - /* - * dma_buf_put() decreases the dmabuf reference counter and will - * call tee_shm_release() when the last reference is gone. - * - * In the case of driver private memory we call tee_shm_release - * directly instead as it doesn't have a reference counter. - */ - if (shm->flags & TEE_SHM_DMA_BUF) - dma_buf_put(shm->dmabuf); - else - tee_shm_release(shm); + tee_shm_put(shm); } EXPORT_SYMBOL_GPL(tee_shm_free); @@ -494,10 +428,15 @@ struct tee_shm *tee_shm_get_from_id(struct tee_context *ctx, int id) teedev = ctx->teedev; mutex_lock(&teedev->mutex); shm = idr_find(&teedev->idr, id); + /* + * If the tee_shm was found in the IDR it must have a refcount + * larger than 0 due to the guarantee in tee_shm_put() below. So + * it's safe to use refcount_inc(). + */ if (!shm || shm->ctx != ctx) shm = ERR_PTR(-EINVAL); - else if (shm->flags & TEE_SHM_DMA_BUF) - get_dma_buf(shm->dmabuf); + else + refcount_inc(&shm->refcount); mutex_unlock(&teedev->mutex); return shm; } @@ -509,7 +448,25 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); */ void tee_shm_put(struct tee_shm *shm) { - if (shm->flags & TEE_SHM_DMA_BUF) - dma_buf_put(shm->dmabuf); + struct tee_device *teedev = shm->teedev; + bool do_release = false; + + mutex_lock(&teedev->mutex); + if (refcount_dec_and_test(&shm->refcount)) { + /* + * refcount has reached 0, we must now remove it from the + * IDR before releasing the mutex. This will guarantee that + * the refcount_inc() in tee_shm_get_from_id() never starts + * from 0. + */ + idr_remove(&teedev->idr, shm->id); + if (shm->ctx) + list_del(&shm->link); + do_release = true; + } + mutex_unlock(&teedev->mutex); + + if (do_release) + tee_shm_release(teedev, shm); } EXPORT_SYMBOL_GPL(tee_shm_put); diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h index cd15c1b7fae0..e08ace76eba6 100644 --- a/include/linux/tee_drv.h +++ b/include/linux/tee_drv.h @@ -178,7 +178,7 @@ void tee_device_unregister(struct tee_device *teedev); * @offset: offset of buffer in user space * @pages: locked pages from userspace * @num_pages: number of locked pages - * @dmabuf: dmabuf used to for exporting to user space + * @refcount: reference counter * @flags: defined by TEE_SHM_* in tee_drv.h * @id: unique id of a shared memory object on this device * @@ -195,7 +195,7 @@ struct tee_shm { unsigned int offset; struct page **pages; size_t num_pages; - struct dma_buf *dmabuf; + refcount_t refcount; u32 flags; int id; }; From 7aedba616cb4be30908dfc62187fa6688c79fdff Mon Sep 17 00:00:00 2001 From: Todd Kjos Date: Mon, 20 Dec 2021 11:01:50 -0800 Subject: [PATCH 03/16] UPSTREAM: binder: fix async_free_space accounting for empty parcels commit cfd0d84ba28c18b531648c9d4a35ecca89ad9901 upstream. In 4.13, commit 74310e06be4d ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are the same except for this corner case of asynchronous transactions with payloads < 8 bytes. Fixes: 74310e06be4d ("android: binder: Move buffer out of area shared with user space") Signed-off-by: Todd Kjos Cc: stable@vger.kernel.org # 4.14+ Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman Change-Id: Ie01082a056bff56f51035c0f6be34e136bd56faf --- drivers/android/binder_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index 2739ebbc684b..add45eb9ea97 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -662,7 +662,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size); if (buffer->async_transaction) { - alloc->free_async_space += size + sizeof(struct binder_buffer); + alloc->free_async_space += buffer_size + sizeof(struct binder_buffer); binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, "%d: binder_free_buf size %zd async free %zd\n", From fe0c18d0f08da58acf328686a0c78682b54de6b8 Mon Sep 17 00:00:00 2001 From: Tadeusz Struk Date: Wed, 26 Jan 2022 13:09:39 -0800 Subject: [PATCH 04/16] ANDROID: incremental-fs: remove index and incomplete dir on umount Cleanup incremental-fs left overs on umount, otherwise incr-fs will complain as below: BUG: Dentry {i=47a,n=.incomplete} still in use [unmount of incremental-fs] This requires vfs_rmdir() of the special index dir. Since set_anon_super() was used in incfs_mount_fs() the incfs_kill_sb() should use kill_anon_super() instead of generic_shutdown_super() otherwise it will leak the pseudo dev_t that set_anon_super() allocates. Bug: 211066171 Signed-off-by: Tadeusz Struk Change-Id: I7ea54db63513fc130e1997cbf79121015ee12405 --- fs/incfs/vfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/incfs/vfs.c b/fs/incfs/vfs.c index 8d4c4e39fa46..ceb0c2e41402 100644 --- a/fs/incfs/vfs.c +++ b/fs/incfs/vfs.c @@ -2269,7 +2269,7 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags, goto err; } - path_put(&backing_dir_path); + mi->mi_backing_dir_path = backing_dir_path; sb->s_flags |= SB_ACTIVE; pr_debug("incfs: mount\n"); @@ -2309,8 +2309,9 @@ void incfs_kill_sb(struct super_block *sb) struct mount_info *mi = sb->s_fs_info; pr_debug("incfs: unmount\n"); + vfs_rmdir(d_inode(mi->mi_backing_dir_path.dentry), mi->mi_index_dir); + kill_anon_super(sb); incfs_free_mount_info(mi); - generic_shutdown_super(sb); sb->s_fs_info = NULL; } From 4ec7ffac469baf161683aa47a256c6350899855b Mon Sep 17 00:00:00 2001 From: "Eric W. Biederman" Date: Thu, 20 Jan 2022 11:04:01 -0600 Subject: [PATCH 05/16] UPSTREAM: cgroup-v1: Require capabilities to set release_agent The cgroup release_agent is called with call_usermodehelper. The function call_usermodehelper starts the release_agent with a full set fo capabilities. Therefore require capabilities when setting the release_agaent. Reported-by: Tabitha Sable Tested-by: Tabitha Sable Fixes: 81a6a5cdd2c5 ("Task Control Groups: automatic userspace notification of idle cgroups") Cc: stable@vger.kernel.org # v2.6.24+ Signed-off-by: "Eric W. Biederman" Signed-off-by: Tejun Heo (cherry picked from commit 24f6008564183aa120d07c03d9289519c2fe02af) Signed-off-by: Greg Kroah-Hartman Change-Id: If663568d24f781c58c882d69a5b81a9327c0e6fe --- kernel/cgroup/cgroup-v1.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c index b513f70b0cc0..17bf2db821c6 100644 --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -552,6 +552,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of, BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX); + /* + * Release agent gets called with all capabilities, + * require capabilities to set release agent. + */ + if ((of->file->f_cred->user_ns != &init_user_ns) || + !capable(CAP_SYS_ADMIN)) + return -EPERM; + cgrp = cgroup_kn_lock_live(of->kn, false); if (!cgrp) return -ENODEV; @@ -964,6 +972,12 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param) /* Specifying two release agents is forbidden */ if (ctx->release_agent) return cg_invalf(fc, "cgroup1: release_agent respecified"); + /* + * Release agent gets called with all capabilities, + * require capabilities to set release agent. + */ + if ((fc->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN)) + return cg_invalf(fc, "cgroup1: Setting release_agent not allowed"); ctx->release_agent = param->string; param->string = NULL; break; From 15dd5a8bc02bd6d83d87899c7b6952e058302e88 Mon Sep 17 00:00:00 2001 From: Alistair Delva Date: Mon, 7 Feb 2022 10:30:55 -0800 Subject: [PATCH 06/16] ANDROID: Increase x86 cmdline size to 4k Recently we have started adding more things to kernel command line with the new bootloader able to pass through crosvm built-in cmdline, and on 4.19 this causes problems because all bootconfig keys are also passed as cmdline, exceeding the 2048 byte limit. This causes cmdline truncation which dumps the device in recovery mode. Bump it up until we can turn this testing down. Bug: 217879977 Signed-off-by: Alistair Delva Change-Id: If341f72394de879d43da5206675d21683495d1d0 --- arch/x86/include/asm/setup.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h index ed8ec011a9fd..42f3e42a10ee 100644 --- a/arch/x86/include/asm/setup.h +++ b/arch/x86/include/asm/setup.h @@ -4,7 +4,7 @@ #include -#define COMMAND_LINE_SIZE 2048 +#define COMMAND_LINE_SIZE 4096 #include #include From 813b12454e6ef77c5179b5f51cc5f9fed97cce40 Mon Sep 17 00:00:00 2001 From: Amit Pundir Date: Mon, 7 Feb 2022 15:45:29 +0530 Subject: [PATCH 07/16] ANDROID: GKI: db845c: Update symbols list and ABI android11-5.4 is broken on Dragonboard 845c because of recently added symbols. So updating the symbols list by running: BUILD_CONFIG=common/build.config.db845c build/build_abi.sh -s And updated the abi_gki_aarch64 ABI by running: "BUILD_CONFIG=common/build.config.gki.aarch64 \ ABI_DEFINITION=abi_gki_aarch64.xml build/build_abi.sh \ --update --print-report" ======================================================== Leaf changes summary: 1 artifact changed (4 filtered out) Changed leaf types summary: 0 (4 filtered out) leaf types changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 1 Added function: [A] 'function void kill_anon_super(super_block*)' ======================================================== Bug: 146449535 Signed-off-by: Amit Pundir Change-Id: Ibebf64f3484ed20662487dae0d7db0ef5fac708a --- android/abi_gki_aarch64.xml | 3714 ++++++++++++++++---------------- android/abi_gki_aarch64_db845c | 5 +- 2 files changed, 1877 insertions(+), 1842 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index d9c149005f72..ebc1d68e38dc 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -2365,6 +2365,7 @@ + @@ -6213,12 +6214,12 @@ - + - + - + @@ -6884,12 +6885,12 @@ - + - + - + @@ -19586,109 +19587,109 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -22162,9 +22163,9 @@ - + - + @@ -23718,6 +23719,17 @@ + + + + + + + + + + + @@ -25155,165 +25167,165 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -25932,6 +25944,11 @@ + + + + + @@ -26343,7 +26360,7 @@ - + @@ -26397,7 +26414,7 @@ - + @@ -28617,18 +28634,18 @@ - + - + - + - + - + @@ -31261,7 +31278,7 @@ - + @@ -31269,7 +31286,7 @@ - + @@ -32557,7 +32574,7 @@ - + @@ -32819,7 +32836,7 @@ - + @@ -35859,109 +35876,109 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -37083,6 +37100,14 @@ + + + + + + + + @@ -37877,14 +37902,6 @@ - - - - - - - - @@ -46666,13 +46683,6 @@ - - - - - - - @@ -46773,102 +46783,102 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -46877,7 +46887,7 @@ - + @@ -46901,347 +46911,347 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -47268,63 +47278,63 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -47412,12 +47422,12 @@ - + - + - + @@ -47484,24 +47494,24 @@ - + - + - + - + - + - + - + @@ -48200,22 +48210,22 @@ - - + + - - + + - - + + - - - - + + + + @@ -48224,18 +48234,18 @@ - - + + - - - - + + + + - - + + @@ -48370,7 +48380,7 @@ - + @@ -48789,18 +48799,18 @@ - - + + - - - + + + - - - + + + @@ -48845,42 +48855,42 @@ - - - + + + - - - + + + - - + + - - - + + + - - + + - - - - - + + + + + - - + + @@ -48895,13 +48905,13 @@ - - - + + + - - + + @@ -55450,6 +55460,12 @@ + + + + + + @@ -55831,97 +55847,97 @@ - - + + - - + + - - - - - + + + + + - - - - + + + + - - - - - + + + + + - - - - + + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - - + + + + - - - - - + + + + + - - - + + + - - - + + + - - - + + + - - - + + + @@ -67103,55 +67119,55 @@ - - - + + + - - - - - + + + + + - - - + + + - - - - - + + + + + - - - + + + - - - - + + + + - - - - + + + + - - - + + + - - - + + + @@ -73937,16 +73953,6 @@ - - - - - - - - - - @@ -73960,12 +73966,6 @@ - - - - - - @@ -78188,6 +78188,12 @@ + + + + + + @@ -81841,6 +81847,16 @@ + + + + + + + + + + @@ -85969,11 +85985,11 @@ - + - + @@ -85981,14 +85997,14 @@ - + - + - + @@ -91169,12 +91185,12 @@ - + - + @@ -91183,7 +91199,7 @@ - + @@ -92138,422 +92154,422 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -92573,63 +92589,63 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -92655,59 +92671,59 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -92733,7 +92749,7 @@ - + @@ -92799,13 +92815,13 @@ - + - + @@ -105551,10 +105567,10 @@ - - - - + + + + @@ -107366,8 +107382,8 @@ - - + + @@ -107393,74 +107409,74 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - + + - - + + - - + + - - - + + + - - + + - - - + + + - - - - - + + + + + - - + + - - + + - - + + - - - + + + @@ -107795,25 +107811,25 @@ - - + + - - + + - - - - + + + + - - - - - + + + + + @@ -108222,8 +108238,8 @@ - - + + @@ -108243,52 +108259,52 @@ - - - - + + + + - + - + - - - - - - + + - - + + - - + + - - + + + + + + - - - + + + @@ -108297,18 +108313,18 @@ - - + + - - - + + + - - - + + + @@ -108318,28 +108334,28 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - + + @@ -108478,7 +108494,7 @@ - + @@ -108541,54 +108557,54 @@ - - + + - - + + - - + + - - - + + + - - - + + + - - + + - - - - - + + + + + - - - - + + + + - - - - + + + + - - - + + + @@ -109234,7 +109250,7 @@ - + @@ -109256,7 +109272,7 @@ - + @@ -109266,7 +109282,7 @@ - + @@ -109274,12 +109290,12 @@ - + - + @@ -109302,7 +109318,7 @@ - + @@ -109318,15 +109334,15 @@ - + - + - + @@ -109337,7 +109353,7 @@ - + @@ -109351,7 +109367,7 @@ - + @@ -109906,7 +109922,7 @@ - + @@ -109983,12 +109999,12 @@ - + - + @@ -110002,11 +110018,6 @@ - - - - - @@ -112435,53 +112446,53 @@ - - + + - - - + + + - - - - - - - - + + + + + + + + - - - - - - - - + + + + + + + + - - - - - - - - + + + + + + + + - - - - - - - - + + + + + + + + @@ -112914,165 +112925,165 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -113186,18 +113197,18 @@ - + - + - + - + - + @@ -114635,7 +114646,23 @@ - + + + + + + + + + + + + + + + + + @@ -114823,7 +114850,7 @@ - + @@ -114902,7 +114929,7 @@ - + @@ -114951,7 +114978,7 @@ - + @@ -115242,7 +115269,7 @@ - + @@ -115253,7 +115280,7 @@ - + @@ -115261,7 +115288,7 @@ - + @@ -115711,7 +115738,7 @@ - + @@ -117045,12 +117072,6 @@ - - - - - - @@ -117058,6 +117079,12 @@ + + + + + + @@ -117124,16 +117151,16 @@ - - - - + + + + - - - - + + + + @@ -117489,21 +117516,21 @@ - - + + - - + + - - + + - - - + + + @@ -119181,7 +119208,7 @@ - + @@ -119194,31 +119221,31 @@ - + - + - + - + - - + + - - - - - + + + + + - - + + @@ -119289,24 +119316,24 @@ - + - + - + - + - + - - + + @@ -119325,8 +119352,8 @@ - - + + @@ -119361,85 +119388,85 @@ - - + + - - + + - - - - + + + + - - + + - - - + + + - - - - + + + + - - - - + + + + - - + + - - - + + + - - + + - - - + + + - - + + - - + + - - + + - - - + + + - + - + @@ -119480,7 +119507,7 @@ - + @@ -119495,72 +119522,72 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -119611,44 +119638,44 @@ - - - + + + - + - + - + - + - + - + - - + + - - + + @@ -119657,22 +119684,22 @@ - - + + - - + + - + - + - + @@ -119730,7 +119757,7 @@ - + @@ -120021,17 +120048,17 @@ - - - - + + + + - - - - - + + + + + @@ -124742,9 +124769,9 @@ - - - + + + @@ -126123,12 +126150,12 @@ - - + + - - + + @@ -128948,15 +128975,15 @@ - + - + - + @@ -129104,57 +129131,57 @@ - - + + - - - + + + - - + + - - - - - - + + + + + + - - - - - - - + + + + + + + - - - - - - - - + + + + + + + + - - + + - - + + - - - + + + @@ -130964,38 +130991,38 @@ - - - - - - - + + + + + + + - - - - + + + + - - - - - + + + + + - - - - - - + + + + + + - - + + @@ -136308,8 +136335,8 @@ - - + + @@ -139148,9 +139175,9 @@ - - - + + + @@ -139743,9 +139770,9 @@ - - - + + + @@ -140217,15 +140244,15 @@ - + - + - + - + @@ -140264,7 +140291,7 @@ - + @@ -140274,7 +140301,7 @@ - + @@ -140285,17 +140312,17 @@ - + - + - + @@ -140305,13 +140332,13 @@ - + - + @@ -140322,22 +140349,22 @@ - + - + - + - + @@ -142479,9 +142506,9 @@ - - - + + + @@ -142494,20 +142521,20 @@ - - + + - - + + - - + + - - + + @@ -142518,8 +142545,8 @@ - - + + @@ -144275,28 +144302,28 @@ - - + + - - + + - - + + - - + + - - + + - - + + @@ -144628,9 +144655,9 @@ - - - + + + @@ -147369,6 +147396,10 @@ + + + + @@ -147719,24 +147750,24 @@ - + - + - + - + - + - + - + @@ -147984,18 +148015,18 @@ - + - + - + - + - + @@ -148505,7 +148536,7 @@ - + @@ -148606,6 +148637,12 @@ + + + + + + @@ -148980,6 +149017,13 @@ + + + + + + + @@ -149670,20 +149714,20 @@ - - + + - - + + - - + + - - + + @@ -150813,7 +150857,7 @@ - + @@ -150824,35 +150868,35 @@ - + - + - - + + - - + + - - + + - - - + + + - - - - - - + + + + + + @@ -152753,12 +152797,12 @@ - + - + - + @@ -153706,9 +153750,9 @@ - + - + @@ -162851,22 +162895,22 @@ - - - + + + - - - - + + + + - - - - - + + + + + @@ -162933,19 +162977,19 @@ - - - - + + + + - - - + + + @@ -164174,18 +164218,18 @@ - + - + - + - + - + @@ -164416,7 +164460,7 @@ - + @@ -164640,12 +164684,12 @@ - + - + - + @@ -164700,7 +164744,7 @@ - + @@ -164838,12 +164882,12 @@ - + - + @@ -165101,10 +165145,10 @@ - - - - + + + + @@ -165623,12 +165667,6 @@ - - - - - - @@ -166568,15 +166606,15 @@ - - - - + + + + - - - + + + @@ -166670,12 +166708,6 @@ - - - - - - @@ -166898,209 +166930,9 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -167236,39 +167068,28 @@ - - - - - - - - - - - - - + + - - - + + + - - - + + + - + @@ -167343,106 +167164,99 @@ - - - - + + + + - - - - + + + + - - + + - - - - + + + + - - + + - - - - + + + + - - + + - - - + + + - - + + - - + + - - - - + + + + - - - - - - + + + + + + - - - + + + - - + + - - - + + + - - + + - - - - + + + + - - - + + + - - - - - - - @@ -167450,10 +167264,6 @@ - - - - @@ -167561,7 +167371,7 @@ - + @@ -167574,8 +167384,8 @@ - - + + @@ -167606,8 +167416,8 @@ - - + + @@ -167787,12 +167597,12 @@ - - + + - - + + @@ -167803,100 +167613,100 @@ - - - - - + + + + + - - - - + + + + - - - - - + + + + + - - - + + + - - - - - + + + + + - - - - + + + + - - - - - - - - - - - - - - - - - + - - - - + + - - - - - - + + + - - - - + + + - - - - - + + + + + + - - - - + + + + + + - - - - - + + + + + + + + + + + + + + + + + + + + + + + + @@ -168973,7 +168783,7 @@ - + @@ -171415,7 +171225,7 @@ - + @@ -171455,7 +171265,7 @@ - + @@ -171537,7 +171347,7 @@ - + @@ -171977,7 +171787,7 @@ - + @@ -173722,7 +173532,7 @@ - + @@ -173742,7 +173552,7 @@ - + @@ -173750,12 +173560,12 @@ - + - + @@ -173886,7 +173696,7 @@ - + @@ -175278,9 +175088,9 @@ - - - + + + @@ -175552,75 +175362,75 @@ - - - + + + - - - + + + - - - - + + + + - - - + + + - - - + + + - - + + - - + + - - - - + + + + - - - - - + + + + + - - - + + + - - - + + + - - - - + + + + - - - - - - + + + + + + @@ -177043,7 +176853,7 @@ - + @@ -177179,7 +176989,7 @@ - + @@ -177722,27 +177532,27 @@ - - - - - + + + + + - - - - - - - + + + + + + + - - - - - + + + + + @@ -178205,13 +178015,224 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -178293,7 +178314,7 @@ - + @@ -178306,6 +178327,17 @@ + + + + + + + + + + + @@ -184196,72 +184228,72 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - - - - + + + + + - - - - - - - - + + + + + + + + - - - - - - - - - - - + + + + + + + + + + + - - - - - - + + + + + + - - - + + + - - - + + + @@ -190945,16 +190977,16 @@ - - - - + + + + - - - - + + + + @@ -190963,69 +190995,69 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + diff --git a/android/abi_gki_aarch64_db845c b/android/abi_gki_aarch64_db845c index d9bc40995f5b..898684f65cfe 100644 --- a/android/abi_gki_aarch64_db845c +++ b/android/abi_gki_aarch64_db845c @@ -583,6 +583,7 @@ __kfifo_alloc __kfifo_free kmalloc_order_trace + ktime_get_with_offset __local_bh_enable_ip memmove param_ops_ulong @@ -590,6 +591,7 @@ __rcu_read_lock __rcu_read_unlock regulatory_hint + rfc1042_header skb_copy skb_realloc_headroom strlcat @@ -660,6 +662,7 @@ phy_pm_runtime_get_sync phy_pm_runtime_put_sync platform_get_irq_byname_optional + pm_runtime_barrier system_freezable_wq usb_add_gadget_udc usb_decode_ctrl @@ -733,7 +736,6 @@ generic_file_read_iter generic_file_splice_read generic_read_dir - generic_shutdown_super __get_free_pages get_zeroed_page iget5_locked @@ -745,6 +747,7 @@ kernel_read kernel_write kern_path + kill_anon_super kobject_create_and_add kobject_put lockref_get From 617c7432b539440179d095cba985f1ed70679fb1 Mon Sep 17 00:00:00 2001 From: Alistair Delva Date: Thu, 10 Feb 2022 11:20:10 -0800 Subject: [PATCH 08/16] ANDROID: GKI: Enable CONFIG_SERIAL_8250_RUNTIME_UARTS=0 8250_core registers 4 ISA uart ports by default, which can cause problems on some devices which don't have them. This change doesn't break earlycon=uart8250, but it will cause the 8250_of and 8250_pci sub drivers to be unable to register ports. Boards that really need the full 8250 driver to take over from earlycon can use the "8250.nr_uarts=X" kernel command line option to restore the ports allocation. Bug: 216312411 Signed-off-by: Alistair Delva Change-Id: I04715394b32bd98544657101de4537df34554ea9 [Lee: Fixed merge conflict] Signed-off-by: Lee Jones --- arch/arm64/configs/gki_defconfig | 1 + arch/x86/configs/gki_defconfig | 1 + 2 files changed, 2 insertions(+) diff --git a/arch/arm64/configs/gki_defconfig b/arch/arm64/configs/gki_defconfig index e0a67b0c52f4..67418fc50830 100644 --- a/arch/arm64/configs/gki_defconfig +++ b/arch/arm64/configs/gki_defconfig @@ -317,6 +317,7 @@ CONFIG_SERIAL_8250=y # CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set CONFIG_SERIAL_8250_CONSOLE=y # CONFIG_SERIAL_8250_EXAR is not set +CONFIG_SERIAL_8250_RUNTIME_UARTS=0 CONFIG_SERIAL_OF_PLATFORM=y CONFIG_SERIAL_AMBA_PL011=y CONFIG_SERIAL_AMBA_PL011_CONSOLE=y diff --git a/arch/x86/configs/gki_defconfig b/arch/x86/configs/gki_defconfig index 1da7f7fb4291..f3d46d70e639 100644 --- a/arch/x86/configs/gki_defconfig +++ b/arch/x86/configs/gki_defconfig @@ -289,6 +289,7 @@ CONFIG_INPUT_UINPUT=y CONFIG_SERIAL_8250=y # CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set CONFIG_SERIAL_8250_CONSOLE=y +CONFIG_SERIAL_8250_RUNTIME_UARTS=0 CONFIG_SERIAL_OF_PLATFORM=y CONFIG_SERIAL_DEV_BUS=y CONFIG_HW_RANDOM=y From 717add4ec81bf80af1a091d247d21f3453b9a1ab Mon Sep 17 00:00:00 2001 From: Jon Maloy Date: Sat, 5 Feb 2022 14:11:18 -0500 Subject: [PATCH 09/16] UPSTREAM: tipc: improve size validations for received domain records commit 9aa422ad326634b76309e8ff342c246800621216 upstream. The function tipc_mon_rcv() allows a node to receive and process domain_record structs from peer nodes to track their views of the network topology. This patch verifies that the number of members in a received domain record does not exceed the limit defined by MAX_MON_DOMAIN, something that may otherwise lead to a stack overflow. tipc_mon_rcv() is called from the function tipc_link_proto_rcv(), where we are reading a 32 bit message data length field into a uint16. To avert any risk of bit overflow, we add an extra sanity check for this in that function. We cannot see that happen with the current code, but future designers being unaware of this risk, may introduce it by allowing delivery of very large (> 64k) sk buffers from the bearer layer. This potential problem was identified by Eric Dumazet. This fixes CVE-2022-0435 Reported-by: Samuel Page Reported-by: Eric Dumazet Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework") Signed-off-by: Jon Maloy Reviewed-by: Xin Long Reviewed-by: Samuel Page Reviewed-by: Eric Dumazet Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman (cherry picked from commit d692e3406e052dbf9f6d9da0cba36cb763272529) Signed-off-by: Greg Kroah-Hartman Change-Id: I5da5bc6880456ec91e6d3f3a283d2c24b6cc269c --- net/tipc/link.c | 10 +++++++--- net/tipc/monitor.c | 2 ++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/net/tipc/link.c b/net/tipc/link.c index f25010261a9e..8f2ee71c63c6 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c @@ -1953,15 +1953,18 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, u16 peers_tol = msg_link_tolerance(hdr); u16 peers_prio = msg_linkprio(hdr); u16 rcv_nxt = l->rcv_nxt; - u16 dlen = msg_data_sz(hdr); + u32 dlen = msg_data_sz(hdr), glen = 0; int mtyp = msg_type(hdr); bool reply = msg_probe(hdr); - u16 glen = 0; void *data; char *if_name; int rc = 0; trace_tipc_proto_rcv(skb, false, l->name); + + if (dlen > U16_MAX) + goto exit; + if (tipc_link_is_blocked(l) || !xmitq) goto exit; @@ -2063,7 +2066,8 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt)) ga = NULL; } - + if(glen > dlen) + break; tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr, &l->mon_state, l->bearer_id); diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c index 58708b4c7719..e7155a774300 100644 --- a/net/tipc/monitor.c +++ b/net/tipc/monitor.c @@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr, state->probing = false; /* Sanity check received domain record */ + if (new_member_cnt > MAX_MON_DOMAIN) + return; if (dlen < dom_rec_len(arrv_dom, 0)) return; if (dlen != dom_rec_len(arrv_dom, new_member_cnt)) From f5fe46103f5d4c3d465910f933f64a9f0fd4eabd Mon Sep 17 00:00:00 2001 From: Kalesh Singh Date: Fri, 11 Feb 2022 09:36:26 -0800 Subject: [PATCH 10/16] Revert "tracefs: Have tracefs directories not set OTH permission bits by default" This reverts commit e2c27194fcd9f9703d927aeea104ec304bcf0ae3. This change breaks Android userspace tools (tracepoint bpf programs, simpleperf, atrace, perfetto, ...) that assume access to tracefs. On Android T and S (QPR2) this is fixed by adding a gid mount option in userspace, for devices with older kernels the permission change needs to be reverted. Bug: 217150407 Bug: 216676030 Signed-off-by: Kalesh Singh Change-Id: I53a63c42b4cf1133a6a2fc1674380ffd8f331392 --- fs/tracefs/inode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c index efe078fe5d4a..0caa151cae4e 100644 --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -427,8 +427,7 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent, if (unlikely(!inode)) return failed_creating(dentry); - /* Do not set bits for OTH */ - inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP; + inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO; inode->i_op = ops; inode->i_fop = &simple_dir_operations; From 0d1f1d4375c98f5fa33277cd3f1be90949445c12 Mon Sep 17 00:00:00 2001 From: Szymon Heidrich Date: Mon, 24 Jan 2022 12:14:00 +0100 Subject: [PATCH 11/16] UPSTREAM: USB: gadget: validate interface OS descriptor requests Stall the control endpoint in case provided index exceeds array size of MAX_CONFIG_INTERFACES or when the retrieved function pointer is null. Bug: 213172319 Signed-off-by: Szymon Heidrich Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 75e5b4849b81e19e9efe1654b30d7f3151c33c2c) Signed-off-by: Greg Kroah-Hartman Change-Id: I78f46b6f2140394a6bc6cff9f829c0742d7ad2fc --- drivers/usb/gadget/composite.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index c5acf5c39fb1..a3106b179562 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1944,6 +1944,9 @@ unknown: if (w_index != 0x5 || (w_value >> 8)) break; interface = w_value & 0xFF; + if (interface >= MAX_CONFIG_INTERFACES || + !os_desc_cfg->interface[interface]) + break; buf[6] = w_index; count = count_ext_prop(os_desc_cfg, interface); From 9a4b39bd766255179c8fce534c7e1e4036900969 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 9 Feb 2022 16:37:53 +0100 Subject: [PATCH 12/16] UPSTREAM: usb: gadget: rndis: check size of RNDIS_MSG_SET command Check the size of the RNDIS_MSG_SET command given to us before attempting to respond to an invalid message size. Bug: 162326603 Reported-by: Szymon Heidrich Cc: stable@kernel.org Tested-by: Szymon Heidrich Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 38ea1eac7d88072bbffb630e2b3db83ca649b826) Signed-off-by: Greg Kroah-Hartman Change-Id: I61168b48de4ca79a3a28dd4d3b81779bc25554c1 --- drivers/usb/gadget/function/rndis.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c index 04c142c13075..ab827c1badc5 100644 --- a/drivers/usb/gadget/function/rndis.c +++ b/drivers/usb/gadget/function/rndis.c @@ -637,14 +637,17 @@ static int rndis_set_response(struct rndis_params *params, rndis_set_cmplt_type *resp; rndis_resp_t *r; + BufLength = le32_to_cpu(buf->InformationBufferLength); + BufOffset = le32_to_cpu(buf->InformationBufferOffset); + if ((BufLength > RNDIS_MAX_TOTAL_SIZE) || + (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE)) + return -EINVAL; + r = rndis_add_response(params, sizeof(rndis_set_cmplt_type)); if (!r) return -ENOMEM; resp = (rndis_set_cmplt_type *)r->buf; - BufLength = le32_to_cpu(buf->InformationBufferLength); - BufOffset = le32_to_cpu(buf->InformationBufferOffset); - #ifdef VERBOSE_DEBUG pr_debug("%s: Length: %d\n", __func__, BufLength); pr_debug("%s: Offset: %d\n", __func__, BufOffset); From 46778c889eb692508868e85da1f4e26eae444be4 Mon Sep 17 00:00:00 2001 From: Jaegeuk Kim Date: Thu, 9 Dec 2021 10:25:43 -0800 Subject: [PATCH 13/16] FROMGIT: f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file Android OTA failed due to SBI_NEED_FSCK flag when pinning the file. Let's avoid it since we can do in-place-updates. Bug: 210593661 Signed-off-by: Jaegeuk Kim (cherry picked from commit 70da2736a4138b86a12873d33fefbb495e22e6f8 git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev) Signed-off-by: Huang Jianan Change-Id: I3fd33c984417c10b38e23de6cec017b03d588945 Signed-off-by: David Anderson --- fs/f2fs/data.c | 5 +++++ fs/f2fs/file.c | 10 +++++----- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index 70cf1a7560e1..73beaaf397bf 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -2577,6 +2577,11 @@ bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio) { struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + /* The below cases were checked when setting it. */ + if (f2fs_is_pinned_file(inode)) + return false; + if (fio && is_sbi_flag_set(sbi, SBI_NEED_FSCK)) + return true; if (f2fs_lfs_mode(sbi)) return true; if (S_ISDIR(inode->i_mode)) diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index a6fc4445ccdd..b42b1fa737bd 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -3235,17 +3235,17 @@ static int f2fs_ioc_set_pin_file(struct file *filp, unsigned long arg) inode_lock(inode); - if (f2fs_should_update_outplace(inode, NULL)) { - ret = -EINVAL; - goto out; - } - if (!pin) { clear_inode_flag(inode, FI_PIN_FILE); f2fs_i_gc_failures_write(inode, 0); goto done; } + if (f2fs_should_update_outplace(inode, NULL)) { + ret = -EINVAL; + goto out; + } + if (f2fs_pin_file_control(inode, false)) { ret = -EAGAIN; goto out; From 2b144ea90c6cb062689b4c05be9a4c53e2f49167 Mon Sep 17 00:00:00 2001 From: Howard Chen Date: Wed, 23 Feb 2022 15:00:13 +0800 Subject: [PATCH 14/16] Revert "ANDROID: incremental-fs: fix mount_fs issue" This reverts commit 013b7ed7546e04b50abdb26dee92114e43c3064f. Test: Can now install the same apk twice, and repeated installs are stable Bug: 217661925 Bug: 219731048 Signed-off-by: Paul Lawrence Change-Id: I86871c364c17a0d1107b3891a574b72edcf04ea2 (cherry picked from commit d107cd06f26b4d45b1079c7eb857815905198076) Signed-off-by: Howard Chen --- fs/incfs/vfs.c | 58 ++++++++++++++------------------------------------ 1 file changed, 16 insertions(+), 42 deletions(-) diff --git a/fs/incfs/vfs.c b/fs/incfs/vfs.c index ceb0c2e41402..62425969c75b 100644 --- a/fs/incfs/vfs.c +++ b/fs/incfs/vfs.c @@ -319,6 +319,7 @@ static struct mount_info *get_mount_info(struct super_block *sb) { struct mount_info *result = sb->s_fs_info; + WARN_ON(!result); return result; } @@ -677,7 +678,7 @@ static int iterate_incfs_dir(struct file *file, struct dir_context *ctx) struct mount_info *mi = get_mount_info(file_superblock(file)); bool root; - if (!dir || !mi) { + if (!dir) { error = -EBADF; goto out; } @@ -1841,9 +1842,6 @@ static int dir_rename(struct inode *old_dir, struct dentry *old_dentry, struct dentry *trap; int error = 0; - if (!mi) - return -EBADF; - error = mutex_lock_interruptible(&mi->mi_dir_struct_mutex); if (error) return error; @@ -2091,9 +2089,6 @@ static ssize_t incfs_getxattr(struct dentry *d, const char *name, char *stored_value; size_t stored_size; - if (!mi) - return -EBADF; - if (di && di->backing_path.dentry) return vfs_getxattr(di->backing_path.dentry, name, value, size); @@ -2130,9 +2125,6 @@ static ssize_t incfs_setxattr(struct dentry *d, const char *name, void **stored_value; size_t *stored_size; - if (!mi) - return -EBADF; - if (di && di->backing_path.dentry) return vfs_setxattr(di->backing_path.dentry, name, value, size, flags); @@ -2173,11 +2165,6 @@ static ssize_t incfs_listxattr(struct dentry *d, char *list, size_t size) return vfs_listxattr(di->backing_path.dentry, list, size); } -static int incfs_test_super(struct super_block *s, void *p) -{ - return s->s_fs_info != NULL; -} - struct dentry *incfs_mount_fs(struct file_system_type *type, int flags, const char *dev_name, void *data) { @@ -2187,8 +2174,7 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags, struct dentry *index_dir; struct super_block *src_fs_sb = NULL; struct inode *root_inode = NULL; - struct super_block *sb = sget(type, incfs_test_super, set_anon_super, - flags, NULL); + struct super_block *sb = sget(type, NULL, set_anon_super, flags, NULL); int error = 0; if (IS_ERR(sb)) @@ -2229,18 +2215,13 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags, src_fs_sb = backing_dir_path.dentry->d_sb; sb->s_maxbytes = src_fs_sb->s_maxbytes; - if (!sb->s_fs_info) { - mi = incfs_alloc_mount_info(sb, &options, &backing_dir_path); + mi = incfs_alloc_mount_info(sb, &options, &backing_dir_path); - if (IS_ERR_OR_NULL(mi)) { - error = PTR_ERR(mi); - pr_err("incfs: Error allocating mount info. %d\n", error); - mi = NULL; - goto err; - } - sb->s_fs_info = mi; - } else { - mi = sb->s_fs_info; + if (IS_ERR_OR_NULL(mi)) { + error = PTR_ERR(mi); + pr_err("incfs: Error allocating mount info. %d\n", error); + mi = NULL; + goto err; } index_dir = open_or_create_index_dir(backing_dir_path.dentry); @@ -2252,22 +2233,21 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags, } mi->mi_index_dir = index_dir; + sb->s_fs_info = mi; root_inode = fetch_regular_inode(sb, backing_dir_path.dentry); if (IS_ERR(root_inode)) { error = PTR_ERR(root_inode); goto err; } + sb->s_root = d_make_root(root_inode); if (!sb->s_root) { - sb->s_root = d_make_root(root_inode); - if (!sb->s_root) { - error = -ENOMEM; - goto err; - } - error = incfs_init_dentry(sb->s_root, &backing_dir_path); - if (error) - goto err; + error = -ENOMEM; + goto err; } + error = incfs_init_dentry(sb->s_root, &backing_dir_path); + if (error) + goto err; mi->mi_backing_dir_path = backing_dir_path; sb->s_flags |= SB_ACTIVE; @@ -2288,9 +2268,6 @@ static int incfs_remount_fs(struct super_block *sb, int *flags, char *data) struct mount_info *mi = get_mount_info(sb); int err = 0; - if (!mi) - return err; - sync_filesystem(sb); err = parse_options(&options, (char *)data); if (err) @@ -2319,9 +2296,6 @@ static int show_options(struct seq_file *m, struct dentry *root) { struct mount_info *mi = get_mount_info(root->d_sb); - if (!mi) - return -EBADF; - seq_printf(m, ",read_timeout_ms=%u", mi->mi_options.read_timeout_ms); seq_printf(m, ",readahead=%u", mi->mi_options.readahead_pages); if (mi->mi_options.read_log_pages != 0) { From 88e13027695dd46ebe49db8a1c70504a8cafa084 Mon Sep 17 00:00:00 2001 From: Tadeusz Struk Date: Wed, 23 Feb 2022 09:47:03 -0800 Subject: [PATCH 15/16] Revert "ANDROID: incremental-fs: remove index and incomplete dir on umount" This reverts commit fe0c18d0f08da58acf328686a0c78682b54de6b8. This is follow up cleanup after revert of: "Revert "ANDROID: incremental-fs: fix mount_fs issue" Bug: 220805927 Signed-off-by: Tadeusz Struk Change-Id: I7749401484d87b9d519bd7b9600cd02f91a18090 --- fs/incfs/vfs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fs/incfs/vfs.c b/fs/incfs/vfs.c index 62425969c75b..b849568ae9b8 100644 --- a/fs/incfs/vfs.c +++ b/fs/incfs/vfs.c @@ -2249,7 +2249,7 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags, if (error) goto err; - mi->mi_backing_dir_path = backing_dir_path; + path_put(&backing_dir_path); sb->s_flags |= SB_ACTIVE; pr_debug("incfs: mount\n"); @@ -2286,9 +2286,8 @@ void incfs_kill_sb(struct super_block *sb) struct mount_info *mi = sb->s_fs_info; pr_debug("incfs: unmount\n"); - vfs_rmdir(d_inode(mi->mi_backing_dir_path.dentry), mi->mi_index_dir); - kill_anon_super(sb); incfs_free_mount_info(mi); + generic_shutdown_super(sb); sb->s_fs_info = NULL; } From 5d7a491ae4a76ffe84bc76c16383ffedc69b5826 Mon Sep 17 00:00:00 2001 From: Max Kellermann Date: Mon, 21 Feb 2022 11:03:13 +0100 Subject: [PATCH 16/16] UPSTREAM: lib/iov_iter: initialize "flags" in new pipe_buffer commit 9d2231c5d74e13b2a0546fee6737ee4446017903 upstream. The functions copy_page_to_iter_pipe() and push_pipe() can both allocate a new pipe_buffer, but the "flags" member initializer is missing. Fixes: 241699cd72a8 ("new iov_iter flavour: pipe-backed") To: Alexander Viro To: linux-fsdevel@vger.kernel.org To: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Max Kellermann Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 87c575d2a238febe8a04241008f18252fe5d093d) Bug: 220741611 Signed-off-by: Greg Kroah-Hartman Change-Id: I91076a0b6327ee8dd87e75fc875062b6adf2de4c --- lib/iov_iter.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 957e3e58df65..9d3bda3d49fe 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -398,6 +398,7 @@ static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t by return 0; pipe->nrbufs++; buf->ops = &page_cache_pipe_buf_ops; + buf->flags = 0; get_page(buf->page = page); buf->offset = offset; buf->len = bytes; @@ -524,6 +525,7 @@ static size_t push_pipe(struct iov_iter *i, size_t size, break; pipe->nrbufs++; pipe->bufs[idx].ops = &default_pipe_buf_ops; + pipe->bufs[idx].flags = 0; pipe->bufs[idx].page = page; pipe->bufs[idx].offset = 0; if (left <= PAGE_SIZE) {