mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-05 19:31:57 -04:00
988,773 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Michael Bestas
|
c8bc4b74db |
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-23.2
* sm8350/lineage-20: tipc: fix double-free in tipc_buf_append() FROMGIT: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure UPSTREAM: nfc: llcp: add missing return after LLCP_CLOSED checks Change-Id: Ibf3e62f1100281728cb118786d1d2c4dcaec595a |
||
Lee Jones
|
db44a74f9f |
tipc: fix double-free in tipc_buf_append()
[ Upstream commit d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a ]
tipc_msg_validate() can potentially reallocate the skb it is validating,
freeing the old one. In tipc_buf_append(), it was being called with a
pointer to a local variable which was a copy of the caller's skb
pointer.
If the skb was reallocated and validation subsequently failed, the error
handling path would free the original skb pointer, which had already
been freed, leading to double-free.
Fix this by checking if head now points to a newly allocated reassembled
skb. If it does, reassign *headbuf for later freeing operations.
Bug: 500022799
Fixes:
|
||
|
Lee Jones
|
1f9e522f94 |
FROMGIT: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
Presently, if the force feedback initialisation fails when probing the Logitech G920 Driving Force Racing Wheel for Xbox One, an error number will be returned and propagated before the userspace infrastructure (sysfs and /dev/input) has been torn down. If userspace ignores the errors and continues to use its references to these dangling entities, a UAF will promptly follow. We have 2 options; continue to return the error, but ensure that all of the infrastructure is torn down accordingly or continue to treat this condition as a warning by emitting the message but returning success. It is thought that the original author's intention was to emit the warning but keep the device functional, less the force feedback feature, so let's go with that. Bug: 482992246 Signed-off-by: Lee Jones <lee@kernel.org> Reviewed-by: Günther Noack <gnoack@google.com> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> (cherry picked from commit f7a4c78bfeb320299c1b641500fe7761eadbd101) # HID Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I2d2148fc1fd977b47e07523ee977070dbfa149b5 |
||
Junxi Qian
|
d3d47118ab |
UPSTREAM: nfc: llcp: add missing return after LLCP_CLOSED checks
In nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket
state is LLCP_CLOSED, the code correctly calls release_sock() and
nfc_llcp_sock_put() but fails to return. Execution falls through to
the remainder of the function, which calls release_sock() and
nfc_llcp_sock_put() again. This results in a double release_sock()
and a refcount underflow via double nfc_llcp_sock_put(), leading to
a use-after-free.
Add the missing return statements after the LLCP_CLOSED branches
in both functions to prevent the fall-through.
Bug: 499350302
Fixes:
|
||
LuK1337
|
aba9e36d0f |
input: fingerprint: etxxx: Fix CFI failure on module init
[ 2.458802] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 [ 2.459516] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 2.459788] Modules linked in: ec617_drv(+) wcd9xxx_dlkm(+) bolero_cdc_dlkm(+) mbhc_dlkm stub_dlkm q6_dlkm adsp_loader_dlkm leds_aw2016 wcd937x_slave_dlkm rdbg focaltech_fts sec_ts_drv(+) p73 btpower apr_dlkm wcd938x_slave_dlkm wsa881x_analog_dlkm bu520x1nvx q6_notifier_dlkm rmnet_shs wcd_core_dlkm rmnet_offload q6_pdr_dlkm haptic snd_event_dlkm rmnet_core swr_dlkm rmnet_ctl snx0 [ 2.460075] CPU: 2 PID: 546 Comm: modprobe Tainted: G S 5.4.302-qgki-g3972ebf038eb #3 [ 2.460221] Hardware name: Sony Mobile Communications. PDX225(BLAIR v4) (DT) [ 2.460285] pstate: 80400005 (Nzcv daif +PAN -UAO) [ 2.460398] pc : __cfi_check_fail+0x4/0x50 [ec617_drv] [ 2.460457] lr : __cfi_check+0x1ac/0x1e0 [ec617_drv] [ 2.460912] x21: 02b3a43e29242445 x20: 0000000000000010 [ 2.462187] Call trace: [ 2.462240] __cfi_check_fail+0x4/0x50 [ec617_drv] [ 2.462332] __cfi_slowpath+0x10c/0x168 [ 2.462383] do_one_initcall+0x1dc/0x384 [ 2.462435] do_init_module+0x4c/0x204 [ 2.462522] load_module+0x1734/0x18c0 [ 2.462569] __arm64_sys_finit_module+0xb4/0xf0 [ 2.462617] el0_svc_common+0xc0/0x1a8 [ 2.462698] el0_svc_handler+0x24/0x70 [ 2.462745] el0_svc+0x8/0x100 [ 2.462877] ---[ end trace 711a96c503b0de92 ]--- [ 2.481911] Kernel panic - not syncing: Fatal exception module_init()/module_exit() define init_module/cleanup_module as aliases of the given functions. With clang r584948 and cross-DSO CFI, such an alias only gets its own jump table entry when the aliasee has internal linkage. Since egisfp_init()/egisfp_exit() were declared non-static, modpost ended up pointing __this_module.init at the raw .init.text address instead of init_module.cfi_jt: R_AARCH64_ABS64 init_module + 0 R_AARCH64_ABS64 cleanup_module + 0 __cfi_check() then compared the initcall pointer (type id 02b3a43e29242445) against egisfp_init.cfi_jt, failed, and jumped to __cfi_check_fail(), which faulted while dereferencing its bogus diag argument. Make both functions static, as they should have been in the first place. The relocations now resolve to the jump table: R_AARCH64_ABS64 init_module.cfi_jt + 0 R_AARCH64_ABS64 cleanup_module.cfi_jt + 0 Assisted-by: ClaudeCode:claude-opus-5 Change-Id: I3bf5a698bc5103e1fe0ae13e4c9c52cad9b41c7e |
||
|
Michael Bestas
|
b44ad6704a |
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-23.2
* sm8350/lineage-20: techpack: audio: wcd_cpe: Fix -Wimplicit-enum-enum-cast qcacld-3.0: Fix implicit enum-enum-cast warnings Change-Id: Ibce416295c81d6a22dd555343e60a405048c5c8d |
||
|
Michael Bestas
|
925d92bed5 |
techpack: audio: wcd_cpe: Fix -Wimplicit-enum-enum-cast
Change-Id: Ie415813c248c86c162673ea932927ffd1d35755d |
||
angelomds42
|
b9f3e9838b |
qcacld-3.0: Fix implicit enum-enum-cast warnings
This fixes the following warning when building with newer clang:
error: implicit conversion from enumeration type
'A_STATUS' to different enumeration type 'QDF_STATUS' [-Werror,-Wimplicit-enum-enum-cast]
Change-Id: I84f9f9b0406fad6df74749cbcb2cb176d42525aa
Signed-off-by: angelomds42 <angelomds42@gmail.com>
|
||
|
Michael Bestas
|
d9d80047e5 |
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-23.2
* sm8350/lineage-20: drivers: staging: fw-api: Correct mis-merge techpack: datarmnet-ext: shs: fix CFI failure on module init with newer Clang versions ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() net: skbuff: fix missing zerocopy reference in pskb_carve helpers net: fix fanout UAF in packet_release() via NETDEV_UP race ip6_tunnel: clear skb2->cb[] in ip4ip6_err() net: skbuff: propagate shared-frag marker through frag-transfer helpers net: skbuff: preserve shared-frag marker during coalescing BACKPORT: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued BACKPORT: rtmutex: Use waiter::task instead of current in remove_waiter() tcp: fix an incorrect __user annotation on tcp_use_userconfig_sysctl_handler tcp: fix an incorrect __user annotation on tcp_proc_delayed_ack_control msm: camera: common: Fix OOB access in bandwidth path handling fw-api: CL 32870364 - update fw common interface files fw-api: CL 32860533 - update fw common interface files fw-api: CL 32860532 - update fw common interface files fw-api: CL 32835676 - update fw common interface files qcacld-3.0: Avoid phymode and puncture mismatch qcacld-3.0: Update phymode along with ch_width update to FW fw-api: CL 32817922 - update fw common interface files fw-api: CL 32798720 - update fw common interface files fw-api: CL 32796759 - update fw common interface files fw-api: CL 32796472 - update fw common interface files msm:adsprpc: Fix UAF of ctx->perf in async invoke perf counter fw-api: CL 32762973 - update fw common interface files fw-api: CL 32742658 - update fw common interface files fw-api: CL 32731178 - update fw common interface files fw-api: CL 32697676 - update fw common interface files fw-api: CL 32697669 - update fw common interface files fw-api: CL 32692322 - update fw common interface files fw-api: CL 32688516 - update fw common interface files fw-api: CL 32668717 - update fw common interface files fw-api: CL 32640276 - update fw common interface files fw-api: CL 32636152 - update fw common interface files fw-api: CL 32626000 - update fw common interface files fw-api: CL 32623461 - update fw common interface files fw-api: CL 32623458 - update fw common interface files fw-api: CL 32578922 - update fw common interface files qcacld-3.0: Add print log for new roam scan type fw-api: CL 32560454 - update fw common interface files fw-api: CL 32559793 - update fw common interface files fw-api: CL 32559532 - update fw common interface files fw-api: CL 32554999 - update fw common interface files fw-api: CL 32544807 - update fw common interface files fw-api: CL 32516836 - update fw common interface files qcacld-3.0: Disable SAP bringup in DFS when DFSmastercap is disabled qcacld-3.0: Set “WIPHY_FLAG_DFS_OFFLOAD” always in wiphy flag fw-api: CL 32489576 - update fw common interface files fw-api: CL 32479166 - update fw common interface files fw-api: CL 32477405 - update fw common interface files qcacld-3.0: Add A_INT64 typedef fw-api: CL 32465518 - update fw common interface files fw-api: CL 32464183 - update fw common interface files fw-api: CL 32437017 - update fw common interface files fw-api: CL 32415720 - update fw common interface files fw-api: CL 32412612 - update fw common interface files fw-api: CL 32402817 - update fw common interface files fw-api: CL 32402810 - update fw common interface files fw-api: CL 32397731 - update fw common interface files fw-api: CL 32397726 - update fw common interface files tty: msm: Update timer handling for interrupt-safe context fw-api: CL 32387418 - update fw common interface files fw-api: CL 32362944 - update fw common interface files fw-api: CL 32356331 - update fw common interface files fw-api: CL 32335202 - update fw common interface files fw-api: CL 32323534 - update fw common interface files fw-api: CL 32322205 - update fw common interface files fw-api: CL 32320410 - update fw common interface files disp: msm: dsi: Nullify display modes after kfree fw-api: CL 32306378 - update fw common interface files fw-api: CL 32296279 - update fw common interface files fw-api: CL 32294648 - update fw common interface files fw-api: CL 32293073 - update fw common interface files fw-api: CL 32292001 - update fw common interface files fw-api: CL 32290054 - update fw common interface files fw-api: CL 32280322 - update fw common interface files fw-api: CL 32280311 - update fw common interface files fw-api: CL 32267210 - update fw common interface files fw-api: CL 32239632 - update fw common interface files fw-api: CL 32229597 - update fw common interface files fw-api: CL 32227711 - update fw common interface files fw-api: CL 32227291 - update fw common interface files fw-api: CL 32227070 - update fw common interface files fw-api: CL 32226903 - update fw common interface files fw-api: CL 32168619 - update fw common interface files qcacld-3.0: Use orig_key_mgmt vdev param for AKM negotiation fw-api: CL 32115955 - update fw common interface files fw-api: CL 32091641 - update fw common interface files fw-api: CL 32088692 - update fw common interface files fw-api: CL 32083726 - update fw common interface files fw-api: CL 32059381 - update fw common interface files fw-api: CL 32054464 - update fw common interface files fw-api: CL 32045293 - update fw common interface files fw-api: hw_headers: Add v1 e3r50 hw headers for wcn8750 fw-api: CL 32033412 - update fw common interface files fw-api: CL 32023116 - update fw common interface files fw-api: CL 32000241 - update fw common interface files fw-api: CL 31990638 - update fw common interface files qcacld-3.0: Reset SPMK cache before every connection fw-api: CL 31978468 - update fw common interface files fw-api: CL 31959202 - update fw common interface files fw-api: CL 31945200 - update fw common interface files fw-api: CL 31944819 - update fw common interface files fw-api: CL 31933928 - update fw common interface files fw-api: CL 31932286 - update fw common interface files fw-api: CL 31924680 - update fw common interface files fw-api: CL 31897484 - update fw common interface files fw-api: CL 31882288 - update fw common interface files fw-api: CL 31863503 - update fw common interface files fw-api: CL 31845524 - update fw common interface files fw-api: CL 31837430 - update fw common interface files fw-api: CL 31823693 - update fw common interface files fw-api: CL 31823686 - update fw common interface files fw-api: CL 31740103 - update fw common interface files fw-api: CL 31732805 - update fw common interface files fw-api: CL 31732804 - update fw common interface files disp: msm: dp: handle panel_init for eDP case fw-api: CL 31721572 - update fw common interface files fw-api: CL 31721565 - update fw common interface files fw-api: CL 31710587 - update fw common interface files qcacld-3.0: Self rsn cap intersect with AP rsn cap fw-api: CL 31670251 - update fw common interface files fw-api: CL 31670248 - update fw common interface files fw-api: CL 31660856 - update fw common interface files fw-api: CL 31636084 - update fw common interface files fw-api: CL 31634761 - update fw common interface files fw-api: CL 31633543 - update fw common interface files fw-api: CL 31632679 - update fw common interface files fw-api: CL 31620095 - update fw common interface files msm: camera: isp: Fix potential illegal access in Acquire HW. Fix for above msm: camera: isp: Fix potential illegal access in Acquire HW msm: camera: ois: Copy packet header in kernel msm: camera: common: Add missing put_cpu_buf calls msm: camera: sensor: handling condition for random read msm: camera: icp: io buf config num validation msm: camera: ope: check cpu buffer offset and cmd buf idx fw-api: CL 31606165 - update fw common interface files fw-api: CL 31594124 - update fw common interface files fw-api: CL 31593473 - update fw common interface files fw-api: CL 31593469 - update fw common interface files fw-api: CL 31580442 - update fw common interface files fw-api: CL 31580439 - update fw common interface files fw-api: CL 31579265 - update fw common interface files fw-api: Add PMM spare registers address related header files fw-api: CL 31562446 - update fw common interface files fw-api: CL 31562430 - update fw common interface files fw-api: hw_headers: Add v2 3181 hw headers for fig fw-api: CL 31548376 - update fw common interface files fw-api: CL 31548353 - update fw common interface files fw-api: CL 31532680 - update fw common interface files fw-api: CL 31531034 - update fw common interface files fw-api: CL 31530723 - update fw common interface files fw-api: CL 31528807 - update fw common interface files fw-api: CL 31516598 - update fw common interface files fw-api: CL 31516597 - update fw common interface files fw-api: CL 31516593 - update fw common interface files qcacld-3.0: Prevent ping loss due to runtime suspend qcacld-3.0: Add runtime pm lock during roaming fw-api: CL 31493387 - update fw common interface files fw-api: CL 31480148 - update fw common interface files fw-api: CL 31472949 - update fw common interface files fw-api: CL 31472689 - update fw common interface files fw-api: CL 31460336 - update fw common interface files fw-api: CL 31459767 - update fw common interface files fw-api: CL 31440102 - update fw common interface files fw-api: CL 31436976 - update fw common interface files fw-api: CL 31424696 - update fw common interface files fw-api: CL 31413468 - update fw common interface files fw-api: CL 31412194 - update fw common interface files fw-api: CL 31404904 - update fw common interface files fw-api: CL 31399985 - update fw common interface files fw-api: CL 31397472 - update fw common interface files fw-api: CL 31390056 - update fw common interface files fw-api: CL 31386508 - update fw common interface files fw-api: CL 31376775 - update fw common interface files qcacld-3.0: Add buffer overflow check in wma_fill_rx_stats function fw-api: CL 31362795 - update fw common interface files fw-api: CL 31360546 - update fw common interface files fw-api: CL 31351405 - update fw common interface files fw-api: CL 31348242 - update fw common interface files fw-api: CL 31341426 - update fw common interface files fw-api: CL 31338231 - update fw common interface files fw-api: CL 31328053 - update fw common interface files fw-api: CL 31316506 - update fw common interface files fw-api: CL 31305348 - update fw common interface files fw-api: CL 31295115 - update fw common interface files fw-api: CL 31282590 - update fw common interface files fw-api: CL 31281768 - update fw common interface files fw-api: CL 31274787 - update fw common interface files fw-api: CL 31274786 - update fw common interface files fw-api: CL 31250105 - update fw common interface files fw-api: CL 31244431 - update fw common interface files fw-api: CL 31233937 - update fw common interface files fw-api: CL 31233932 - update fw common interface files fw-api: CL 31221789 - update fw common interface files qcacmn: Remove 6G domain check on Maschan list qcacmn: Replace ap reg rules with client reg rules qcacmn: Add reo_mismatch stats for FISA path fw-api: CL 31209257 - update fw common interface files fw-api: CL 31209256 - update fw common interface files fw-api: CL 31184750 - update fw common interface files fw-api: CL 31184747 - update fw common interface files qcacld-3.0: Validate fse metadata before aggregation of FISA flow fw-api: CL 31181068 - update fw common interface files fw-api: hw_headers: Add v2 3175 hw headers for fig fw-api: CL 31152020 - update fw common interface files fw-api: CL 31139090 - update fw common interface files fw-api: CL 31139082 - update fw common interface files fw-api: CL 31129784 - update fw common interface files fw-api: CL 31127648 - update fw common interface files fw-api: CL 31108122 - update fw common interface files fw-api: CL 31100347 - update fw common interface files fw-api: CL 31060090 - update fw common interface files fw-api: CL 31059684 - update fw common interface files fw-api: CL 31023126 - update fw common interface files fw-api: CL 31021605 - update fw common interface files fw-api: CL 31012511 - update fw common interface files fw-api: CL 30998406 - update fw common interface files qcacld-3.0: Consider intersected AKM for association fw-api: fig: v1 remove unused reo hw data structure files fw-api: CL 30960339 - update fw common interface files fw-api: CL 30949206 - update fw common interface files fw-api: CL 30939043 - update fw common interface files fw-api: CL 30933603 - update fw common interface files fw-api: CL 30924456 - update fw common interface files fw-api: CL 30906519 - update fw common interface files fw-api: CL 30905405 - update fw common interface files fw-api: CL 30894242 - update fw common interface files fw-api: CL 30855107 - update fw common interface files fw-api: CL 30855102 - update fw common interface files fw-api: CL 30839654 - update fw common interface files fw-api: CL 30839650 - update fw common interface files fw-api: CL 30825844 - update fw common interface files fw-api: CL 30811728 - update fw common interface files fw-api: CL 30797342 - update fw common interface files fw-api: fig: Update config macros for REO_R0_RBM_DESTINATION_RING_CTRL fw-api: CL 30786115 - update fw common interface files fw-api: CL 30768408 - update fw common interface files fw-api: CL 30768407 - update fw common interface files fw-api: CL 30757804 - update fw common interface files fw-api: E3.0 WCSS_VERSION 3150 fig headers fw-api: CL 30735748 - update fw common interface files fw-api: CL 30720606 - update fw common interface files fw-api: CL 30714212 - update fw common interface files fw-api: CL 30697325 - update fw common interface files fw-api: CL 30678803 - update fw common interface files fw-api: CL 30669089 - update fw common interface files fw-api: CL 30669084 - update fw common interface files fw-api: CL 30584319 - update fw common interface files fw-api: CL 30583992 - update fw common interface files fw-api: CL 30580039 - update fw common interface files fw-api: CL 30544126 - update fw common interface files fw-api: CL 30541340 - update fw common interface files fw-api: CL 30538540 - update fw common interface files fw-api: CL 30538539 - update fw common interface files fw-api: CL 30538536 - update fw common interface files fw-api: CL 30519258 - update fw common interface files fw-api: CL 30519235 - update fw common interface files fw-api: CL 30501923 - update fw common interface files fw-api: CL 30443155 - update fw common interface files fw-api: CL 30391907 - update fw common interface files fw-api: CL 30387120 - update fw common interface files fw-api: CL 30358561 - update fw common interface files fw-api: CL 30297480 - update fw common interface files fw-api: CL 30281577 - update fw common interface files fw-api: CL 30273614 - update fw common interface files fw-api: CL 30273613 - update fw common interface files fw-api: CL 30269010 - update fw common interface files fw-api: CL 30243121 - update fw common interface files fw-api: CL 30231044 - update fw common interface files fw-api: CL 30227097 - update fw common interface files fw-api: CL 30201837 - update fw common interface files fw-api: CL 30201834 - update fw common interface files fw-api: CL 30198227 - update fw common interface files fw-api: CL 30152986 - update fw common interface files fw-api: CL 30143205 - update fw common interface files fw-api: CL 30056543 - update fw common interface files fw-api: CL 30026411 - update fw common interface files fw-api: CL 30026410 - update fw common interface files fw-api: CL 29948685 - update fw common interface files fw-api: CL 29930068 - update fw common interface files fw-api: CL 29930067 - update fw common interface files fw-api: CL 29873461 - update fw common interface files fw-api: CL 29858563 - update fw common interface files fw-api: CL 29858560 - update fw common interface files fw-api: CL 29845167 - update fw common interface files fw-api: CL 29832217 - update fw common interface files fw-api: CL 29804280 - update fw common interface files fw-api: CL 29789406 - update fw common interface files msm: camera: sensor: TOCTOU error handling Change-Id: I93a709ae7fd15531830ebd257a9aaa98cac1dde8 |
||
Nolen Johnson
|
629d9d7ba8 |
drivers: staging: fw-api: Correct mis-merge
* Matches correct merge of LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0. Change-Id: I36ed254e33a2030fa120b0900422ff0ddc8e9f7e |
||
|
Nolen Johnson
|
18cc56963e |
Merge tag 'LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/display-drivers into HEAD
"LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0" * tag 'LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/display-drivers: disp: msm: dsi: Nullify display modes after kfree disp: msm: dp: handle panel_init for eDP case Change-Id: I5e3fe03b3bbfe41bbb3898bce78299dce8769b3a |
||
|
Nolen Johnson
|
c491e7d22d |
Merge tag 'LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/camera-kernel into HEAD
"LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0" * tag 'LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/camera-kernel: msm: camera: common: Fix OOB access in bandwidth path handling msm: camera: isp: Fix potential illegal access in Acquire HW. Fix for above msm: camera: isp: Fix potential illegal access in Acquire HW msm: camera: ois: Copy packet header in kernel msm: camera: common: Add missing put_cpu_buf calls msm: camera: sensor: handling condition for random read msm: camera: icp: io buf config num validation msm: camera: ope: check cpu buffer offset and cmd buf idx msm: camera: sensor: TOCTOU error handling Change-Id: Ia765f67129e72a2114bd23040a216535acdb3931 |
||
|
Nolen Johnson
|
9c41ddc9c7 |
Merge tag 'LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0 into HEAD
"LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0" * tag 'LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0: qcacld-3.0: Avoid phymode and puncture mismatch qcacld-3.0: Update phymode along with ch_width update to FW qcacld-3.0: Add print log for new roam scan type qcacld-3.0: Disable SAP bringup in DFS when DFSmastercap is disabled qcacld-3.0: Set “WIPHY_FLAG_DFS_OFFLOAD” always in wiphy flag qcacld-3.0: Add A_INT64 typedef qcacld-3.0: Use orig_key_mgmt vdev param for AKM negotiation qcacld-3.0: Reset SPMK cache before every connection qcacld-3.0: Self rsn cap intersect with AP rsn cap qcacld-3.0: Prevent ping loss due to runtime suspend qcacld-3.0: Add runtime pm lock during roaming qcacld-3.0: Add buffer overflow check in wma_fill_rx_stats function qcacld-3.0: Validate fse metadata before aggregation of FISA flow qcacld-3.0: Consider intersected AKM for association Change-Id: I6c0a23448639cffd3ea1ef6e5d3c30621d0902de |
||
|
Nolen Johnson
|
820e1598cc |
Merge tag 'LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn into HEAD
"LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0" * tag 'LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn: qcacmn: Remove 6G domain check on Maschan list qcacmn: Replace ap reg rules with client reg rules qcacmn: Add reo_mismatch stats for FISA path Change-Id: I42342b65b32052d48cf52cee9fb59e987b060fe8 |
||
|
Nolen Johnson
|
18a188fb0e |
Merge tag 'LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/fw-api into HEAD
"LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0" * tag 'LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/fw-api: fw-api: CL 32870364 - update fw common interface files fw-api: CL 32860533 - update fw common interface files fw-api: CL 32860532 - update fw common interface files fw-api: CL 32835676 - update fw common interface files fw-api: CL 32817922 - update fw common interface files fw-api: CL 32798720 - update fw common interface files fw-api: CL 32796759 - update fw common interface files fw-api: CL 32796472 - update fw common interface files fw-api: CL 32762973 - update fw common interface files fw-api: CL 32742658 - update fw common interface files fw-api: CL 32731178 - update fw common interface files fw-api: CL 32697676 - update fw common interface files fw-api: CL 32697669 - update fw common interface files fw-api: CL 32692322 - update fw common interface files fw-api: CL 32688516 - update fw common interface files fw-api: CL 32668717 - update fw common interface files fw-api: CL 32640276 - update fw common interface files fw-api: CL 32636152 - update fw common interface files fw-api: CL 32626000 - update fw common interface files fw-api: CL 32623461 - update fw common interface files fw-api: CL 32623458 - update fw common interface files fw-api: CL 32578922 - update fw common interface files fw-api: CL 32560454 - update fw common interface files fw-api: CL 32559793 - update fw common interface files fw-api: CL 32559532 - update fw common interface files fw-api: CL 32554999 - update fw common interface files fw-api: CL 32544807 - update fw common interface files fw-api: CL 32516836 - update fw common interface files fw-api: CL 32489576 - update fw common interface files fw-api: CL 32479166 - update fw common interface files fw-api: CL 32477405 - update fw common interface files fw-api: CL 32465518 - update fw common interface files fw-api: CL 32464183 - update fw common interface files fw-api: CL 32437017 - update fw common interface files fw-api: CL 32415720 - update fw common interface files fw-api: CL 32412612 - update fw common interface files fw-api: CL 32402817 - update fw common interface files fw-api: CL 32402810 - update fw common interface files fw-api: CL 32397731 - update fw common interface files fw-api: CL 32397726 - update fw common interface files fw-api: CL 32387418 - update fw common interface files fw-api: CL 32362944 - update fw common interface files fw-api: CL 32356331 - update fw common interface files fw-api: CL 32335202 - update fw common interface files fw-api: CL 32323534 - update fw common interface files fw-api: CL 32322205 - update fw common interface files fw-api: CL 32320410 - update fw common interface files fw-api: CL 32306378 - update fw common interface files fw-api: CL 32296279 - update fw common interface files fw-api: CL 32294648 - update fw common interface files fw-api: CL 32293073 - update fw common interface files fw-api: CL 32292001 - update fw common interface files fw-api: CL 32290054 - update fw common interface files fw-api: CL 32280322 - update fw common interface files fw-api: CL 32280311 - update fw common interface files fw-api: CL 32267210 - update fw common interface files fw-api: CL 32239632 - update fw common interface files fw-api: CL 32229597 - update fw common interface files fw-api: CL 32227711 - update fw common interface files fw-api: CL 32227291 - update fw common interface files fw-api: CL 32227070 - update fw common interface files fw-api: CL 32226903 - update fw common interface files fw-api: CL 32168619 - update fw common interface files fw-api: CL 32115955 - update fw common interface files fw-api: CL 32091641 - update fw common interface files fw-api: CL 32088692 - update fw common interface files fw-api: CL 32083726 - update fw common interface files fw-api: CL 32059381 - update fw common interface files fw-api: CL 32054464 - update fw common interface files fw-api: CL 32045293 - update fw common interface files fw-api: hw_headers: Add v1 e3r50 hw headers for wcn8750 fw-api: CL 32033412 - update fw common interface files fw-api: CL 32023116 - update fw common interface files fw-api: CL 32000241 - update fw common interface files fw-api: CL 31990638 - update fw common interface files fw-api: CL 31978468 - update fw common interface files fw-api: CL 31959202 - update fw common interface files fw-api: CL 31945200 - update fw common interface files fw-api: CL 31944819 - update fw common interface files fw-api: CL 31933928 - update fw common interface files fw-api: CL 31932286 - update fw common interface files fw-api: CL 31924680 - update fw common interface files fw-api: CL 31897484 - update fw common interface files fw-api: CL 31882288 - update fw common interface files fw-api: CL 31863503 - update fw common interface files fw-api: CL 31845524 - update fw common interface files fw-api: CL 31837430 - update fw common interface files fw-api: CL 31823693 - update fw common interface files fw-api: CL 31823686 - update fw common interface files fw-api: CL 31740103 - update fw common interface files fw-api: CL 31732805 - update fw common interface files fw-api: CL 31732804 - update fw common interface files fw-api: CL 31721572 - update fw common interface files fw-api: CL 31721565 - update fw common interface files fw-api: CL 31710587 - update fw common interface files fw-api: CL 31670251 - update fw common interface files fw-api: CL 31670248 - update fw common interface files fw-api: CL 31660856 - update fw common interface files fw-api: CL 31636084 - update fw common interface files fw-api: CL 31634761 - update fw common interface files fw-api: CL 31633543 - update fw common interface files fw-api: CL 31632679 - update fw common interface files fw-api: CL 31620095 - update fw common interface files fw-api: CL 31606165 - update fw common interface files fw-api: CL 31594124 - update fw common interface files fw-api: CL 31593473 - update fw common interface files fw-api: CL 31593469 - update fw common interface files fw-api: CL 31580442 - update fw common interface files fw-api: CL 31580439 - update fw common interface files fw-api: CL 31579265 - update fw common interface files fw-api: Add PMM spare registers address related header files fw-api: CL 31562446 - update fw common interface files fw-api: CL 31562430 - update fw common interface files fw-api: hw_headers: Add v2 3181 hw headers for fig fw-api: CL 31548376 - update fw common interface files fw-api: CL 31548353 - update fw common interface files fw-api: CL 31532680 - update fw common interface files fw-api: CL 31531034 - update fw common interface files fw-api: CL 31530723 - update fw common interface files fw-api: CL 31528807 - update fw common interface files fw-api: CL 31516598 - update fw common interface files fw-api: CL 31516597 - update fw common interface files fw-api: CL 31516593 - update fw common interface files fw-api: CL 31493387 - update fw common interface files fw-api: CL 31480148 - update fw common interface files fw-api: CL 31472949 - update fw common interface files fw-api: CL 31472689 - update fw common interface files fw-api: CL 31460336 - update fw common interface files fw-api: CL 31459767 - update fw common interface files fw-api: CL 31440102 - update fw common interface files fw-api: CL 31436976 - update fw common interface files fw-api: CL 31424696 - update fw common interface files fw-api: CL 31413468 - update fw common interface files fw-api: CL 31412194 - update fw common interface files fw-api: CL 31404904 - update fw common interface files fw-api: CL 31399985 - update fw common interface files fw-api: CL 31397472 - update fw common interface files fw-api: CL 31390056 - update fw common interface files fw-api: CL 31386508 - update fw common interface files fw-api: CL 31376775 - update fw common interface files fw-api: CL 31362795 - update fw common interface files fw-api: CL 31360546 - update fw common interface files fw-api: CL 31351405 - update fw common interface files fw-api: CL 31348242 - update fw common interface files fw-api: CL 31341426 - update fw common interface files fw-api: CL 31338231 - update fw common interface files fw-api: CL 31328053 - update fw common interface files fw-api: CL 31316506 - update fw common interface files fw-api: CL 31305348 - update fw common interface files fw-api: CL 31295115 - update fw common interface files fw-api: CL 31282590 - update fw common interface files fw-api: CL 31281768 - update fw common interface files fw-api: CL 31274787 - update fw common interface files fw-api: CL 31274786 - update fw common interface files fw-api: CL 31250105 - update fw common interface files fw-api: CL 31244431 - update fw common interface files fw-api: CL 31233937 - update fw common interface files fw-api: CL 31233932 - update fw common interface files fw-api: CL 31221789 - update fw common interface files fw-api: CL 31209257 - update fw common interface files fw-api: CL 31209256 - update fw common interface files fw-api: CL 31184750 - update fw common interface files fw-api: CL 31184747 - update fw common interface files fw-api: CL 31181068 - update fw common interface files fw-api: hw_headers: Add v2 3175 hw headers for fig fw-api: CL 31152020 - update fw common interface files fw-api: CL 31139090 - update fw common interface files fw-api: CL 31139082 - update fw common interface files fw-api: CL 31129784 - update fw common interface files fw-api: CL 31127648 - update fw common interface files fw-api: CL 31108122 - update fw common interface files fw-api: CL 31100347 - update fw common interface files fw-api: CL 31060090 - update fw common interface files fw-api: CL 31059684 - update fw common interface files fw-api: CL 31023126 - update fw common interface files fw-api: CL 31021605 - update fw common interface files fw-api: CL 31012511 - update fw common interface files fw-api: CL 30998406 - update fw common interface files fw-api: fig: v1 remove unused reo hw data structure files fw-api: CL 30960339 - update fw common interface files fw-api: CL 30949206 - update fw common interface files fw-api: CL 30939043 - update fw common interface files fw-api: CL 30933603 - update fw common interface files fw-api: CL 30924456 - update fw common interface files fw-api: CL 30906519 - update fw common interface files fw-api: CL 30905405 - update fw common interface files fw-api: CL 30894242 - update fw common interface files fw-api: CL 30855107 - update fw common interface files fw-api: CL 30855102 - update fw common interface files fw-api: CL 30839654 - update fw common interface files fw-api: CL 30839650 - update fw common interface files fw-api: CL 30825844 - update fw common interface files fw-api: CL 30811728 - update fw common interface files fw-api: CL 30797342 - update fw common interface files fw-api: fig: Update config macros for REO_R0_RBM_DESTINATION_RING_CTRL fw-api: CL 30786115 - update fw common interface files fw-api: CL 30768408 - update fw common interface files fw-api: CL 30768407 - update fw common interface files fw-api: CL 30757804 - update fw common interface files fw-api: E3.0 WCSS_VERSION 3150 fig headers fw-api: CL 30735748 - update fw common interface files fw-api: CL 30720606 - update fw common interface files fw-api: CL 30714212 - update fw common interface files fw-api: CL 30697325 - update fw common interface files fw-api: CL 30678803 - update fw common interface files fw-api: CL 30669089 - update fw common interface files fw-api: CL 30669084 - update fw common interface files fw-api: CL 30584319 - update fw common interface files fw-api: CL 30583992 - update fw common interface files fw-api: CL 30580039 - update fw common interface files fw-api: CL 30544126 - update fw common interface files fw-api: CL 30541340 - update fw common interface files fw-api: CL 30538540 - update fw common interface files fw-api: CL 30538539 - update fw common interface files fw-api: CL 30538536 - update fw common interface files fw-api: CL 30519258 - update fw common interface files fw-api: CL 30519235 - update fw common interface files fw-api: CL 30501923 - update fw common interface files fw-api: CL 30443155 - update fw common interface files fw-api: CL 30391907 - update fw common interface files fw-api: CL 30387120 - update fw common interface files fw-api: CL 30358561 - update fw common interface files fw-api: CL 30297480 - update fw common interface files fw-api: CL 30281577 - update fw common interface files fw-api: CL 30273614 - update fw common interface files fw-api: CL 30273613 - update fw common interface files fw-api: CL 30269010 - update fw common interface files fw-api: CL 30243121 - update fw common interface files fw-api: CL 30231044 - update fw common interface files fw-api: CL 30227097 - update fw common interface files fw-api: CL 30201837 - update fw common interface files fw-api: CL 30201834 - update fw common interface files fw-api: CL 30198227 - update fw common interface files fw-api: CL 30152986 - update fw common interface files fw-api: CL 30143205 - update fw common interface files fw-api: CL 30056543 - update fw common interface files fw-api: CL 30026411 - update fw common interface files fw-api: CL 30026410 - update fw common interface files fw-api: CL 29948685 - update fw common interface files fw-api: CL 29930068 - update fw common interface files fw-api: CL 29930067 - update fw common interface files fw-api: CL 29873461 - update fw common interface files fw-api: CL 29858563 - update fw common interface files fw-api: CL 29858560 - update fw common interface files fw-api: CL 29845167 - update fw common interface files fw-api: CL 29832217 - update fw common interface files fw-api: CL 29804280 - update fw common interface files fw-api: CL 29789406 - update fw common interface files Change-Id: Ic1aa7aae3b182e0e5d212665371a25eaa540aaec |
||
|
Nolen Johnson
|
7692046155 |
Merge tag 'LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into HEAD
"LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0" * tag 'LA.UM.9.14.1.r1-21700-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4: msm:adsprpc: Fix UAF of ctx->perf in async invoke perf counter tty: msm: Update timer handling for interrupt-safe context Change-Id: I41d7a1f4826c1ea9578cb8e04fff517e72422a2d |
||
Salvo Giangreco
|
e70533ab68 |
techpack: datarmnet-ext: shs: fix CFI failure on module init with newer Clang versions
<4>[ 1.660990] [6: init: 1] ------------[ cut here ]------------ <4>[ 1.661004] [6: init: 1] CFI failure (target: DATARMNET163e93649e+0x0/0xfb8 [rmnet_shs]): <4>[ 1.661018] [6: init: 1] WARNING: CPU: 6 PID: 1 at kernel/cfi.c:30 __ubsan_handle_cfi_check_fail+0x4c/0x54 <4>[ 1.661020] [6: init: 1] Modules linked in: rmnet_shs(+) rmnet_offload rmnet_core rmnet_ctl camera hdmi_dlkm stub_dlkm swr_dmic_dlkm rx_macro_dlkm tx_macro_dlkm va_macro_dlkm wcd938x_slave_dlkm adsp_loader_dlkm native_dlkm platform_dlkm machine_dlkm tas256x_dlkm wcd938x_dlkm mbhc_dlkm wcd9xxx_dlkm wcd_core_dlkm bolero_cdc_dlkm swr_ctrl_dlkm swr_dlkm pinctrl_lpi_dlkm q6_dlkm apr_dlkm q6_notifier_dlkm q6_pdr_dlkm snd_event_dlkm pinctrl_wcd_dlkm sec_audio_sysfs slimbus_ngd stm_ts sec_cmd sec_tsp_dumpkey sec_common_fn sec_secure_touch sec_tclm_v2 sec_tsp_log kperfmon wlan(C) hid_aksys bt_fm_slim slimbus btpower tda18250 m88rs6000t qm1d1b0004 qm1d1c0042 mxl301rf r820t it913x fc0013 fc0012 fc0011 si2157 tua9001 fc2580 e4000 tda18212 tda18218 max2165 mc44s803 mxl5007t mxl5005s mt2131 qt1010 mt2266 mt2063 mt2060 msi001 xc4000 xc5000 tda9887 tea5761 tea5767 mt20xx tuner_simple tuner_types tuner_xc2028 aqc111 cdc_ncm cdc_eem rtl8150 nfc_sec rdbg llcc_perfmon ssg_iosched blk_sec_stats <4>[ 1.661052] [6: init: 1] CPU: 6 PID: 1 Comm: init Tainted: G S WC 5.4.302-qgki-52214-g542c168ade6d-dirty #1 <4>[ 1.661055] [6: init: 1] Hardware name: Samsung A52SXQ PROJECT (board-id,02) (DT) <4>[ 1.661058] [6: init: 1] pstate: 60400005 (nZCv daif +PAN -UAO) <4>[ 1.661061] [6: init: 1] pc : __ubsan_handle_cfi_check_fail+0x4c/0x54 <4>[ 1.661063] [6: init: 1] lr : __ubsan_handle_cfi_check_fail+0x4c/0x54 <4>[ 1.661065] [6: init: 1] sp : ffffffc010063a40 <4>[ 1.661067] [6: init: 1] x29: ffffffc010063a40 x28: 0000000000000379 <4>[ 1.661070] [6: init: 1] x27: 00000000000037e7 x26: ffffff8045f72f40 <4>[ 1.661073] [6: init: 1] x25: 0000000000000000 x24: ffffffc00b66e000 <4>[ 1.661075] [6: init: 1] x23: ffffff8045f72f40 x22: 0000000000000001 <4>[ 1.661077] [6: init: 1] x21: 02b3a43e29242445 x20: ffffffc012b4a000 <4>[ 1.661079] [6: init: 1] x19: ffffffc00b691048 x18: ffffffc010059048 <4>[ 1.661081] [6: init: 1] x17: ffffffc012eb9000 x16: 0000000000000010 <4>[ 1.661084] [6: init: 1] x15: ffffffc01188446c x14: 3a295d7368735f74 <4>[ 1.661086] [6: init: 1] x13: 0000000000000330 x12: 0000000000000018 <4>[ 1.661088] [6: init: 1] x11: 000000000000000a x10: 00000000ffffffff <4>[ 1.661091] [6: init: 1] x9 : 102999c091cf4200 x8 : 102999c091cf4200 <4>[ 1.661093] [6: init: 1] x7 : 6c69616620494643 x6 : ffffffc012eb8aab <4>[ 1.661095] [6: init: 1] x5 : 0000000000000001 x4 : 0000000000000000 <4>[ 1.661097] [6: init: 1] x3 : 0000000000002020 x2 : 0000000000000001 <4>[ 1.661099] [6: init: 1] x1 : 0000000000000000 x0 : 0000000000000040 <4>[ 1.661102] [6: init: 1] Call trace: <4>[ 1.661105] [6: init: 1] __ubsan_handle_cfi_check_fail+0x4c/0x54 <4>[ 1.661113] [6: init: 1] __cfi_check_fail+0x3c/0x8c [rmnet_shs] <4>[ 1.661120] [6: init: 1] __cfi_check+0x3a8/0x3b0 [rmnet_shs] <4>[ 1.661123] [6: init: 1] __cfi_slowpath_diag+0x10c/0x164 <4>[ 1.661127] [6: init: 1] do_one_initcall+0x2c0/0x478 <4>[ 1.661130] [6: init: 1] do_init_module+0x4c/0x204 <4>[ 1.661133] [6: init: 1] load_module+0x16f8/0x18d4 <4>[ 1.661136] [6: init: 1] __arm64_sys_finit_module+0xb4/0xf0 <4>[ 1.661139] [6: init: 1] el0_svc_common+0xc0/0x1b0 <4>[ 1.661142] [6: init: 1] el0_svc_handler+0x24/0x84 <4>[ 1.661145] [6: init: 1] el0_svc+0x8/0x140 <4>[ 1.661147] [6: init: 1] ---[ end trace 91166a70db25a0a4 ]--- Change-Id: Ie89f1489dfb834836df13a30a0a03cb7eb0bf500 |
||
Eric Dumazet
|
7b94a33952 |
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
[ Upstream commit 86ab3e55673a7a49a841838776f1ab18d23a67b5 ]
Sashiko AI-review observed:
In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet
where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2
and passed to icmp6_send(), it uses IP6CB(skb2).
IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso
offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm
at offset 18.
If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao
would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called
and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO).
This would scan the inner, attacker-controlled IPv6 packet starting at that
offset, potentially returning a fake TLV without checking if the remaining
packet length can hold the full 18-byte struct ipv6_destopt_hao.
Could mip6_addr_swap() then perform a 16-byte swap that extends past the end
of the packet data into skb_shared_info?
Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and
ip6ip6_err() to prevent this?
This patch implements the first suggestion.
I am not sure if ip6ip6_err() needs to be changed.
A separate patch would be better anyway.
Fixes:
|
||
Minh Nguyen
|
90694eff39 |
net: skbuff: fix missing zerocopy reference in pskb_carve helpers
[ Upstream commit 98d0912e9f841e5529a5b89a972805f34cb1c69d ]
pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy
the old skb_shared_info header into a new buffer via memcpy(), which
includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs.
Neither function calls net_zcopy_get() for the new shinfo, creating an
unaccounted holder: every skb_shared_info with destructor_arg set will
call skb_zcopy_clear() once when freed, but the corresponding
net_zcopy_get() was never called for the new copy. Repeated calls
drive uarg->refcnt to zero prematurely, freeing ubuf_info_msgzc while
TX skbs still hold live destructor_arg pointers.
KASAN reports use-after-free on a freed ubuf_info_msgzc:
BUG: KASAN: slab-use-after-free in skb_release_data+0x77b/0x810
Read of size 8 at addr ffff88801574d3e8 by task poc/220
Call Trace:
skb_release_data+0x77b/0x810
kfree_skb_list_reason+0x13e/0x610
skb_release_data+0x4cd/0x810
sk_skb_reason_drop+0xf3/0x340
skb_queue_purge_reason+0x282/0x440
rds_tcp_inc_free+0x1e/0x30
rds_recvmsg+0x354/0x1780
__sys_recvmsg+0xdf/0x180
Allocated by task 219:
msg_zerocopy_realloc+0x157/0x7b0
tcp_sendmsg_locked+0x2892/0x3ba0
Freed by task 219:
ip_recv_error+0x74a/0xb10
tcp_recvmsg+0x475/0x530
The skb consuming the late access still referenced the same uarg via
shinfo->destructor_arg copied by pskb_carve_inside_nonlinear() without
a refcount bump. This has been verified to be reliably exploitable: a
working proof-of-concept achieves full root privilege escalation from
an unprivileged local user on a default kernel configuration.
The fix follows the pattern of pskb_expand_head() which has the same
memcpy/cloned structure. For pskb_carve_inside_header(), net_zcopy_get()
is placed after skb_orphan_frags() succeeds, so the orphan error path
needs no cleanup. For pskb_carve_inside_nonlinear(), net_zcopy_get() is
placed after all failure points and just before skb_release_data(), so
no error path needs cleanup at all -- matching pskb_expand_head() more
closely and avoiding the need for a balancing net_zcopy_put().
Fixes:
|
||
Yochai Eisenrich
|
214ddb05df |
net: fix fanout UAF in packet_release() via NETDEV_UP race
[ Upstream commit 42156f93d123436f2a27c468f18c966b7e5db796 ]
`packet_release()` has a race window where `NETDEV_UP` can re-register a
socket into a fanout group's `arr[]` array. The re-registration is not
cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout
array.
`packet_release()` does NOT zero `po->num` in its `bind_lock` section.
After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex`
still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`
that already found the socket in `sklist` can re-register the hook.
For fanout sockets, this re-registration calls `__fanout_link(sk, po)`
which adds the socket back into `f->arr[]` and increments `f->num_members`,
but does NOT increment `f->sk_ref`.
The fix sets `po->num` to zero in `packet_release` while `bind_lock` is
held to prevent NETDEV_UP from linking, preventing the race window.
This bug was found following an additional audit with Claude Code based
on CVE-2025-38617.
Fixes:
|
||
|
Eric Dumazet
|
aaee6ec86f |
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
[ Upstream commit 2edfa31769a4add828a7e604b21cb82aaaa05925 ]
Oskar Kjos reported the following problem.
ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written
by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes
IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region
as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff
at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr
value. __ip_options_echo() then reads optlen from attacker-controlled
packet data at sptr[rr+1] and copies that many bytes into dopt->__data,
a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).
To fix this we clear skb2->cb[], as suggested by Oskar Kjos.
Also add minimal IPv4 header validation (version == 4, ihl >= 5).
Fixes:
|
||
Hyunwoo Kim
|
06dad31134 |
net: skbuff: propagate shared-frag marker through frag-transfer helpers
Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail
to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when
moving frags from source to destination. __pskb_copy_fclone() defers
the rest of the shinfo metadata to skb_copy_header() after copying
frag descriptors, but that helper only carries over gso_{size,segs,
type} and never touches skb_shinfo()->flags; skb_shift() moves frag
descriptors directly and leaves flags untouched. As a result, the
destination skb keeps a reference to the same externally-owned or
page-cache-backed pages while reporting skb_has_shared_frag() as
false.
The mismatch is harmful in any in-place writer that uses
skb_has_shared_frag() to decide whether shared pages must be detoured
through skb_cow_data(). ESP input is one such writer (esp4.c,
esp6.c), and a single nft 'dup to <local>' rule -- or any other
nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d
skb in esp_input() with the marker stripped, letting an unprivileged
user write into the page cache of a root-owned read-only file via
authencesn-ESN stray writes.
Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors
were actually moved from the source. skb_copy() and skb_copy_expand()
share skb_copy_header() too but linearize all paged data into freshly
allocated head storage and emerge with nr_frags == 0, so
skb_has_shared_frag() returns false on its own; they need no change.
The same omission exists in skb_gro_receive() and skb_gro_receive_list().
The former moves the incoming skb's frag descriptors into the
accumulator's last sub-skb via two paths (a direct frag-move loop and
the head_frag + memcpy path); the latter chains the incoming skb whole
onto p's frag_list. Downstream skb_segment() reads only
skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's
shinfo as the nskb -- both p and lp must carry the marker.
The same omission also exists in tcp_clone_payload(), which builds an
MTU probe skb by moving frag descriptors from skbs on sk_write_queue
into a freshly allocated nskb. The helper falls into the same family
and warrants the same fix for consistency; no TCP TX-side in-place
writer is currently known to reach a user page through this gap, but
a future consumer depending on the marker would regress silently.
The same omission exists in skb_segment(): the per-iteration flag
merge takes only head_skb's flag, and the inner switch that rebinds
frag_skb to list_skb on head_skb-frags exhaustion does not fold the
new frag_skb's flag into nskb. Fold frag_skb's flag at both sites
so segments drawing frags from frag_list members carry the marker.
Fixes:
|
||
William Bowling
|
16656dc06d |
net: skbuff: preserve shared-frag marker during coalescing
skb_try_coalesce() can attach paged frags from @from to @to. If @from
has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same
externally-owned or page-cache-backed frags, but the shared-frag marker
is currently lost.
That breaks the invariant relied on by later in-place writers. In
particular, ESP input checks skb_has_shared_frag() before deciding
whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP
receive coalescing has moved shared frags into an unmarked skb, ESP can
see skb_has_shared_frag() as false and decrypt in place over page-cache
backed frags.
Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged
frags. The tailroom copy path does not need the marker because it copies
bytes into @to's linear data rather than transferring frag descriptors.
Fixes:
|
||
Davidlohr Bueso
|
2ec0afec5c |
BACKPORT: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
syzbot triggered the following splat in remove_waiter() via
FUTEX_CMP_REQUEUE_PI:
KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f]
class_raw_spinlock_constructor
remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561
rt_mutex_start_proxy_lock+0x103/0x120
futex_requeue+0x10e4/0x20d0
__x64_sys_futex+0x34f/0x4d0
task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection,
leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead
of current in remove_waiter()") made this fatal.
Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter()
upon a successfully grabbing the rtmutex.
|
||
Keenan Dong
|
6efbfed641 |
BACKPORT: rtmutex: Use waiter::task instead of current in remove_waiter()
remove_waiter() is used by the slowlock paths, but it is also used for
proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from
futex_requeue().
In the latter case waiter::task is not current, but remove_waiter()
operates on current for the dequeue operation. That results in several
problems:
1) the rbtree dequeue happens without waiter::task::pi_lock being held
2) the waiter task's pi_blocked_on state is not cleared, which leaves a
dangling pointer primed for UAF around.
3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter
task
Use waiter::task instead of current in all related operations in
remove_waiter() to cure those problems.
[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the
changelog ]
Fixes:
|
||
Tashfin Shakeer Rhythm
|
69c7394469 |
tcp: fix an incorrect __user annotation on tcp_use_userconfig_sysctl_handler
No user pointers for sysctls anymore.
Fixes: c3f877ec98a12 ("BACKPORT: sysctl: pass kernel pointers to ->proc_handler")
Change-Id: Ia9c27a7308aad6fb9b6476f1000d2588d0367014
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
|
||
|
Tashfin Shakeer Rhythm
|
a1535b0667 |
tcp: fix an incorrect __user annotation on tcp_proc_delayed_ack_control
No user pointers for sysctls anymore.
Fixes: c3f877ec98a12 ("BACKPORT: sysctl: pass kernel pointers to ->proc_handler")
Change-Id: Ie7d47a3bb5ed4238cea83a493937f38a3fee2571
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
|
||
|
Michael Bestas
|
5048089773 |
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-23.2
* sm8350/lineage-20: UPSTREAM: tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE UPSTREAM: selftests: add clone3() CAP_CHECKPOINT_RESTORE test UPSTREAM: prctl: exe link permission error changed from -EINVAL to -EPERM UPSTREAM: prctl: Allow local CAP_CHECKPOINT_RESTORE to change /proc/self/exe UPSTREAM: proc: allow access in init userns for map_files with CAP_CHECKPOINT_RESTORE UPSTREAM: pid_namespace: use checkpoint_restore_ns_capable() for ns_last_pid UPSTREAM: pid: use checkpoint_restore_ns_capable() for set_tid UPSTREAM: capabilities: Introduce CAP_CHECKPOINT_RESTORE UPSTREAM: selftests: add tests for clone3() with *set_tid UPSTREAM: fork: extend clone3() to support setting a PID UPSTREAM: selftests: add tests for clone3() UPSTREAM: tests: test CLONE_CLEAR_SIGHAND UPSTREAM: clone3: add CLONE_CLEAR_SIGHAND Change-Id: I7890fb550e85b9fd4c0c3a27144d5bfd8963d496 |
||
Adrian Reber
|
ad10207c9d |
UPSTREAM: tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
[ Upstream commit e0f25b8992345aa5f113da2815f5add98738c611 ] The capability CAP_CHECKPOINT_RESTORE was introduced to allow non-root users to checkpoint and restore processes as non-root with CRIU. This change extends CAP_CHECKPOINT_RESTORE to enable the CRIU option '--shell-job' as non-root. CRIU's man-page describes the '--shell-job' option like this: Allow one to dump shell jobs. This implies the restored task will inherit session and process group ID from the criu itself. This option also allows to migrate a single external tty connection, to migrate applications like top. TIOCSLCKTRMIOS can only be done if the process has CAP_SYS_ADMIN and this change extends it to CAP_SYS_ADMIN or CAP_CHECKPOINT_RESTORE. With this change it is possible to checkpoint and restore processes which have a tty connection as non-root if CAP_CHECKPOINT_RESTORE is set. Acked-by: Christian Brauner <brauner@kernel.org> Change-Id: I079e010f7ab7c1dc2e829bfa4023405efd5aada8 Signed-off-by: Adrian Reber <areber@redhat.com> Acked-by: Andrei Vagin <avagin@gmail.com> Link: https://lore.kernel.org/r/20231208143656.1019-1-areber@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: ralph950412 <ralph950412@gmail.com> |
||
|
Adrian Reber
|
e5abb5d796 |
UPSTREAM: selftests: add clone3() CAP_CHECKPOINT_RESTORE test
This adds a test that changes its UID, uses capabilities to get CAP_CHECKPOINT_RESTORE and uses clone3() with set_tid to create a process with a given PID as non-root. Change-Id: Iac62e21213ad1bd04f5a2762255fc924c3830ea6 Signed-off-by: Adrian Reber <areber@redhat.com> Link: https://lore.kernel.org/r/20200719100418.2112740-8-areber@redhat.com [christian.brauner@ubuntu.com: use TH_LOG() instead of ksft_print_msg()] Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: ralph950412 <ralph950412@gmail.com> |
||
Nicolas Viennot
|
6b4aab010e |
UPSTREAM: prctl: exe link permission error changed from -EINVAL to -EPERM
This brings consistency with the rest of the prctl() syscall where -EPERM is returned when failing a capability check. Change-Id: I1b27a485d4ca9dd99376c6628572509835aabaf3 Signed-off-by: Nicolas Viennot <Nicolas.Viennot@twosigma.com> Signed-off-by: Adrian Reber <areber@redhat.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> Link: https://lore.kernel.org/r/20200719100418.2112740-7-areber@redhat.com Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: ralph950412 <ralph950412@gmail.com> |
||
|
Nicolas Viennot
|
c90ed82a1d |
UPSTREAM: prctl: Allow local CAP_CHECKPOINT_RESTORE to change /proc/self/exe
Originally, only a local CAP_SYS_ADMIN could change the exe link, making it difficult for doing checkpoint/restore without CAP_SYS_ADMIN. This commit adds CAP_CHECKPOINT_RESTORE in addition to CAP_SYS_ADMIN for permitting changing the exe link. The following describes the history of the /proc/self/exe permission checks as it may be difficult to understand what decisions lead to this point. * [1] May 2012: This commit introduces the ability of changing /proc/self/exe if the user is CAP_SYS_RESOURCE capable. In the related discussion [2], no clear thread model is presented for what could happen if the /proc/self/exe changes multiple times, or why would the admin be at the mercy of userspace. * [3] Oct 2014: This commit introduces a new API to change /proc/self/exe. The permission no longer checks for CAP_SYS_RESOURCE, but instead checks if the current user is root (uid=0) in its local namespace. In the related discussion [4] it is said that "Controlling exe_fd without privileges may turn out to be dangerous. At least things like tomoyo examine it for making policy decisions (see tomoyo_manager())." * [5] Dec 2016: This commit removes the restriction to change /proc/self/exe at most once. The related discussion [6] informs that the audit subsystem relies on the exe symlink, presumably audit_log_d_path_exe() in kernel/audit.c. * [7] May 2017: This commit changed the check from uid==0 to local CAP_SYS_ADMIN. No discussion. * [8] July 2020: A PoC to spoof any program's /proc/self/exe via ptrace is demonstrated Overall, the concrete points that were made to retain capability checks around changing the exe symlink is that tomoyo_manager() and audit_log_d_path_exe() uses the exe_file path. Christian Brauner said that relying on /proc/<pid>/exe being immutable (or guarded by caps) in a sake of security is a bit misleading. It can only be used as a hint without any guarantees of what code is being executed once execve() returns to userspace. Christian suggested that in the future, we could call audit_log() or similar to inform the admin of all exe link changes, instead of attempting to provide security guarantees via permission checks. However, this proposed change requires the understanding of the security implications in the tomoyo/audit subsystems. [1] |
||
|
Adrian Reber
|
ef13cc913c |
UPSTREAM: proc: allow access in init userns for map_files with CAP_CHECKPOINT_RESTORE
Opening files in /proc/pid/map_files when the current user is CAP_CHECKPOINT_RESTORE capable in the root namespace is useful for checkpointing and restoring to recover files that are unreachable via the file system such as deleted files, or memfd files. Change-Id: I6ec3846f81a5208b66ef41e00229b7535e1e6668 Signed-off-by: Adrian Reber <areber@redhat.com> Signed-off-by: Nicolas Viennot <Nicolas.Viennot@twosigma.com> Reviewed-by: Cyrill Gorcunov <gorcunov@gmail.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> Link: https://lore.kernel.org/r/20200719100418.2112740-5-areber@redhat.com Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: ralph950412 <ralph950412@gmail.com> |
||
|
Adrian Reber
|
63b4832326 |
UPSTREAM: pid_namespace: use checkpoint_restore_ns_capable() for ns_last_pid
Use the newly introduced capability CAP_CHECKPOINT_RESTORE to allow writing to ns_last_pid. Change-Id: I95727c385f136818553260db0e9edfa654f7907e Signed-off-by: Adrian Reber <areber@redhat.com> Signed-off-by: Nicolas Viennot <Nicolas.Viennot@twosigma.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20200719100418.2112740-4-areber@redhat.com Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: ralph950412 <ralph950412@gmail.com> |
||
|
Adrian Reber
|
5c348f563d |
UPSTREAM: pid: use checkpoint_restore_ns_capable() for set_tid
Use the newly introduced capability CAP_CHECKPOINT_RESTORE to allow using clone3() with set_tid set. Change-Id: Ifc86c455e500e59a62f9960ba094c4f9973891ff Signed-off-by: Adrian Reber <areber@redhat.com> Signed-off-by: Nicolas Viennot <Nicolas.Viennot@twosigma.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20200719100418.2112740-3-areber@redhat.com Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: ralph950412 <ralph950412@gmail.com> |
||
|
Adrian Reber
|
ef8a66d0ee |
UPSTREAM: capabilities: Introduce CAP_CHECKPOINT_RESTORE
This patch introduces CAP_CHECKPOINT_RESTORE, a new capability facilitating checkpoint/restore for non-root users. Over the last years, The CRIU (Checkpoint/Restore In Userspace) team has been asked numerous times if it is possible to checkpoint/restore a process as non-root. The answer usually was: 'almost'. The main blocker to restore a process as non-root was to control the PID of the restored process. This feature available via the clone3 system call, or via /proc/sys/kernel/ns_last_pid is unfortunately guarded by CAP_SYS_ADMIN. In the past two years, requests for non-root checkpoint/restore have increased due to the following use cases: * Checkpoint/Restore in an HPC environment in combination with a resource manager distributing jobs where users are always running as non-root. There is a desire to provide a way to checkpoint and restore long running jobs. * Container migration as non-root * We have been in contact with JVM developers who are integrating CRIU into a Java VM to decrease the startup time. These checkpoint/restore applications are not meant to be running with CAP_SYS_ADMIN. We have seen the following workarounds: * Use a setuid wrapper around CRIU: See https://github.com/FredHutch/slurm-examples/blob/master/checkpointer/lib/checkpointer/checkpointer-suid.c * Use a setuid helper that writes to ns_last_pid. Unfortunately, this helper delegation technique is impossible to use with clone3, and is thus prone to races. See https://github.com/twosigma/set_ns_last_pid * Cycle through PIDs with fork() until the desired PID is reached: This has been demonstrated to work with cycling rates of 100,000 PIDs/s See https://github.com/twosigma/set_ns_last_pid * Patch out the CAP_SYS_ADMIN check from the kernel * Run the desired application in a new user and PID namespace to provide a local CAP_SYS_ADMIN for controlling PIDs. This technique has limited use in typical container environments (e.g., Kubernetes) as /proc is typically protected with read-only layers (e.g., /proc/sys) for hardening purposes. Read-only layers prevent additional /proc mounts (due to proc's SB_I_USERNS_VISIBLE property), making the use of new PID namespaces limited as certain applications need access to /proc matching their PID namespace. The introduced capability allows to: * Control PIDs when the current user is CAP_CHECKPOINT_RESTORE capable for the corresponding PID namespace via ns_last_pid/clone3. * Open files in /proc/pid/map_files when the current user is CAP_CHECKPOINT_RESTORE capable in the root namespace, useful for recovering files that are unreachable via the file system such as deleted files, or memfd files. See corresponding selftest for an example with clone3(). Change-Id: Ia9ae3fc9a698e37774be945bac5a7d2a0d640cbc Signed-off-by: Adrian Reber <areber@redhat.com> Signed-off-by: Nicolas Viennot <Nicolas.Viennot@twosigma.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20200719100418.2112740-2-areber@redhat.com Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: ralph950412 <ralph950412@gmail.com> |
||
|
Adrian Reber
|
2c395af267 |
UPSTREAM: selftests: add tests for clone3() with *set_tid
This tests clone3() with *set_tid to see if all desired PIDs are working as expected. The tests are trying multiple invalid input parameters as well as creating processes while specifying a certain PID in multiple PID namespaces at the same time. Additionally this moves common clone3() test code into clone3_selftests.h. Change-Id: Ic30e083c2b8c3e5c1fe9adff28387e84431f4c71 Signed-off-by: Adrian Reber <areber@redhat.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20191115123621.142252-2-areber@redhat.com Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: ralph950412 <ralph950412@gmail.com> |
||
|
Adrian Reber
|
62ec29d7ad |
UPSTREAM: fork: extend clone3() to support setting a PID
The main motivation to add set_tid to clone3() is CRIU.
To restore a process with the same PID/TID CRIU currently uses
/proc/sys/kernel/ns_last_pid. It writes the desired (PID - 1) to
ns_last_pid and then (quickly) does a clone(). This works most of the
time, but it is racy. It is also slow as it requires multiple syscalls.
Extending clone3() to support *set_tid makes it possible restore a
process using CRIU without accessing /proc/sys/kernel/ns_last_pid and
race free (as long as the desired PID/TID is available).
This clone3() extension places the same restrictions (CAP_SYS_ADMIN)
on clone3() with *set_tid as they are currently in place for ns_last_pid.
The original version of this change was using a single value for
set_tid. At the 2019 LPC, after presenting set_tid, it was, however,
decided to change set_tid to an array to enable setting the PID of a
process in multiple PID namespaces at the same time. If a process is
created in a PID namespace it is possible to influence the PID inside
and outside of the PID namespace. Details also in the corresponding
selftest.
To create a process with the following PIDs:
PID NS level Requested PID
0 (host) 31496
1 42
2 1
For that example the two newly introduced parameters to struct
clone_args (set_tid and set_tid_size) would need to be:
set_tid[0] = 1;
set_tid[1] = 42;
set_tid[2] = 31496;
set_tid_size = 3;
If only the PIDs of the two innermost nested PID namespaces should be
defined it would look like this:
set_tid[0] = 1;
set_tid[1] = 42;
set_tid_size = 2;
The PID of the newly created process would then be the next available
free PID in the PID namespace level 0 (host) and 42 in the PID namespace
at level 1 and the PID of the process in the innermost PID namespace
would be 1.
The set_tid array is used to specify the PID of a process starting
from the innermost nested PID namespaces up to set_tid_size PID namespaces.
set_tid_size cannot be larger then the current PID namespace level.
Change-Id: I21a8a13c5a794b2a788f3e647fd639b5ae313ebf
Signed-off-by: Adrian Reber <areber@redhat.com>
Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com>
Acked-by: Andrei Vagin <avagin@gmail.com>
Link: https://lore.kernel.org/r/20191115123621.142252-1-areber@redhat.com
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: ralph950412 <ralph950412@gmail.com>
|
||
|
Adrian Reber
|
0092575594 |
UPSTREAM: selftests: add tests for clone3()
This adds tests for clone3() with different values and sizes of struct clone_args. This selftest was initially part of of the clone3() with PID selftest. After that patch was almost merged Eugene sent out a couple of patches to fix problems with these test. This commit now only contains the clone3() selftest after the LPC decision to rework clone3() with PID to allow setting the PID in multiple PID namespaces including all of Eugene's patches. Change-Id: I32fecd920f7a820c0ca7869a70a8c5b34af583dd Signed-off-by: Eugene Syromiatnikov <esyr@redhat.com> Signed-off-by: Adrian Reber <areber@redhat.com> Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20191112095851.811884-1-areber@redhat.com Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: ralph950412 <ralph950412@gmail.com> |
||
Christian Brauner
|
399202290e |
UPSTREAM: tests: test CLONE_CLEAR_SIGHAND
Test that CLONE_CLEAR_SIGHAND resets signal handlers to SIG_DFL for the child process and that CLONE_CLEAR_SIGHAND and CLONE_SIGHAND are mutually exclusive. Cc: Florian Weimer <fweimer@redhat.com> Cc: libc-alpha@sourceware.org Cc: linux-api@vger.kernel.org Change-Id: I07ebb8cb2e741cf1a6a43ff4dbe6ee489636f506 Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20191014104538.3096-2-christian.brauner@ubuntu.com Signed-off-by: ralph950412 <ralph950412@gmail.com> |
||
|
Christian Brauner
|
67da5e102b |
UPSTREAM: clone3: add CLONE_CLEAR_SIGHAND
Reset all signal handlers of the child not set to SIG_IGN to SIG_DFL. Mutually exclusive with CLONE_SIGHAND to not disturb other thread's signal handler. In the spirit of closer cooperation between glibc developers and kernel developers (cf. [2]) this patchset came out of a discussion on the glibc mailing list for improving posix_spawn() (cf. [1], [3], [4]). Kernel support for this feature has been explicitly requested by glibc and I see no reason not to help them with this. The child helper process on Linux posix_spawn must ensure that no signal handlers are enabled, so the signal disposition must be either SIG_DFL or SIG_IGN. However, it requires a sigprocmask to obtain the current signal mask and at least _NSIG sigaction calls to reset the signal handlers for each posix_spawn call or complex state tracking that might lead to data corruption in glibc. Adding this flags lets glibc avoid these problems. [1]: https://www.sourceware.org/ml/libc-alpha/2019-10/msg00149.html [3]: https://www.sourceware.org/ml/libc-alpha/2019-10/msg00158.html [4]: https://www.sourceware.org/ml/libc-alpha/2019-10/msg00160.html [2]: https://lwn.net/Articles/799331/ '[...] by asking for better cooperation with the C-library projects in general. They should be copied on patches containing ABI changes, for example. I noted that there are often times where C-library developers wish the kernel community had done things differently; how could those be avoided in the future? Members of the audience suggested that more glibc developers should perhaps join the linux-api list. The other suggestion was to "copy Florian on everything".' Cc: Florian Weimer <fweimer@redhat.com> Cc: libc-alpha@sourceware.org Cc: linux-api@vger.kernel.org Change-Id: Iced02ef93ed4dcda5ca5d3bd475cbfcae928fb19 Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Reviewed-by: Oleg Nesterov <oleg@redhat.com> Link: https://lore.kernel.org/r/20191014104538.3096-1-christian.brauner@ubuntu.com Signed-off-by: ralph950412 <ralph950412@gmail.com> |
||
Parag Singhal
|
542be35e0e |
msm: camera: common: Fix OOB access in bandwidth path handling
Invalid input from user can lead to an index going below the valid range after offset calculation. Existing validation only checked the upper bound, allowing negative values to pass and cause out-of-bounds memory access. Add complete bounds validation to ensure safe access. CRs-Fixed: 4544133 Change-Id: Ib37b25ab84e9004eaeb216302857d65df18a2516 Signed-off-by: Parag Singhal <parsin@qti.qualcomm.com> (cherry picked from commit d6cee3f552be8126f0c8b29ea833228bf3357fa8) |
||
lnxbuild
|
bb7df1153e |
Merge 38f771a775 on remote branch
Change-Id: I6ce24d05c3a850db562648fee0fd65f294e9cd33 |
||
|
lnxbuild
|
9e8629ad6f |
Merge c2adf7dc3f on remote branch
Change-Id: I725b37236522e560ba315a2c90380d1dffd52951 |
||
|
lnxbuild
|
7f2f278fab |
Merge e0313af26b on remote branch
Change-Id: Ibe983dc00d528592d9c0d84784994a533aad9ce2 |
||
|
lnxbuild
|
6a5f009819 |
Merge 3296157051 on remote branch
Change-Id: I5f9dff78d3c1be9d07827282ff111aac89b5c2f4 |
||
|
Michael Bestas
|
c229ae0da6 |
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-23.2
* sm8350/lineage-20: drivers: staging: qca-wifi-host-cmn: Fix implicit-enum-enum-cast errors techpack: display: msm: sde: Fix uninitialized errors drivers: hwtracing: coresight: Fix sometimes-uninitialized errors kbuild: Remove support for Clang's ThinLTO caching kbuild: lto: force rebuilds when switching CONFIG_LTO Makefile: use -z pack-relative-relocs Revert "kbuild: disable clang's default use of -fmerge-all-constants" BACKPORT: dma-buf: return success for cmo of dummy clients Revert "msm: kgsl: Call dma_buf_unmap_attachment() early" Change-Id: I879af747cfc89b2e70d80b06c53ed67cc3195266 |
||
|
Nolen Johnson
|
8d80a9da0f |
drivers: staging: qca-wifi-host-cmn: Fix implicit-enum-enum-cast errors
Change-Id: I2e72f2fe56aed7c42db7b5ad52937080acb20343 |
||
|
Nolen Johnson
|
33304e5fe0 |
techpack: display: msm: sde: Fix uninitialized errors
Change-Id: I481190f2a03bc49976241e4c0b60304ca634f89a |
||
|
Nolen Johnson
|
ce01923678 |
drivers: hwtracing: coresight: Fix sometimes-uninitialized errors
Change-Id: Ia0a6242bec8ceaa27ef623a668e032a08e5fab0d |