This change adds a new function, anon_inode_getfd_secure, that creates
anonymous-node file with individual non-S_PRIVATE inode to which security
modules can apply policy. Existing callers continue using the original
singleton-inode kind of anonymous-inode file. We can transition anonymous
inode users to the new kind of anonymous inode in individual patches for
the sake of bisection and review.
The new function accepts an optional context_inode parameter that callers
can use to provide additional contextual information to security modules.
For example, in case of userfaultfd, the created inode is a 'logical child'
of the context_inode (userfaultfd inode of the parent process) in the sense
that it provides the security context required during creation of the child
process' userfaultfd inode.
Signed-off-by: Daniel Colascione <dancol@google.com>
[LG: Delete obsolete comments to alloc_anon_inode()]
[LG: Add context_inode description in comments to anon_inode_getfd_secure()]
[LG: Remove definition of anon_inode_getfile_secure() as there are no callers]
[LG: Make __anon_inode_getfile() static]
[LG: Use correct error cast in __anon_inode_getfile()]
[LG: Fix error handling in __anon_inode_getfile()]
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit e7e832ce6fa769f800cd7eaebdb0459ad31e0416)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I88f1821243c58454ce445fd50fd804221e0bfc67
This change adds a new LSM hook, inode_init_security_anon(), that will
be used while creating secure anonymous inodes. The hook allows/denies
its creation and assigns a security context to the inode.
The new hook accepts an optional context_inode parameter that callers
can use to provide additional contextual information to security modules
for granting/denying permission to create an anon-inode of the same type.
This context_inode's security_context can also be used to initialize the
newly created anon-inode's security_context.
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 215b674b84dd052098fe6389e32a5afaff8b4d56)
Conflicts:
include/linux/lsm_hook_defs.h
(1. Added LSM hook in lsm_hook.h and removd lsm_hook_defs.h as per
98e828a0650f348be85728c69875260cf78069e6, which is not merged here)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: I83fe318c891f034b4dd7f3f357cc74964b55ffc8
With this change, when the knob is set to 0, it allows unprivileged users
to call userfaultfd, like when it is set to 1, but with the restriction
that page faults from only user-mode can be handled. In this mode, an
unprivileged user (without SYS_CAP_PTRACE capability) must pass
UFFD_USER_MODE_ONLY to userfaultd or the API will fail with EPERM.
This enables administrators to reduce the likelihood that an attacker with
access to userfaultfd can delay faulting kernel code to widen timing
windows for other exploits.
The default value of this knob is changed to 0. This is required for
correct functioning of pipe mutex. However, this will fail postcopy live
migration, which will be unnoticeable to the VM guests. To avoid this,
set 'vm.userfault = 1' in /sys/sysctl.conf.
The main reason this change is desirable as in the short term is that the
Android userland will behave as with the sysctl set to zero. So without
this commit, any Linux binary using userfaultfd to manage its memory would
behave differently if run within the Android userland. For more details,
refer to Andrea's reply [1].
[1] https://lore.kernel.org/lkml/20200904033438.GI9411@redhat.com/
Link: https://lkml.kernel.org/r/20201120030411.2690816-3-lokeshgidra@google.com
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Peter Xu <peterx@redhat.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: Eric Biggers <ebiggers@kernel.org>
Cc: Daniel Colascione <dancol@dancol.org>
Cc: "Joel Fernandes (Google)" <joel@joelfernandes.org>
Cc: Kalesh Singh <kaleshsingh@google.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Jeff Vander Stoep <jeffv@google.com>
Cc: <calin@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Shaohua Li <shli@fb.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Nitin Gupta <nigupta@nvidia.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Iurii Zaikin <yzaikin@google.com>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Daniel Colascione <dancol@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit d0d4730ac2e404a5b0da9a87ef38c73e51cb1664)
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Bug: 160737021
Bug: 169683130
Change-Id: Ic46c0be47d6394d25bd3443ff524936fa568ab85
Patch series "Control over userfaultfd kernel-fault handling", v6.
This patch series is split from [1]. The other series enables SELinux
support for userfaultfd file descriptors so that its creation and movement
can be controlled.
It has been demonstrated on various occasions that suspending kernel code
execution for an arbitrary amount of time at any access to userspace
memory (copy_from_user()/copy_to_user()/...) can be exploited to change
the intended behavior of the kernel. For instance, handling page faults
in kernel-mode using userfaultfd has been exploited in [2, 3]. Likewise,
FUSE, which is similar to userfaultfd in this respect, has been exploited
in [4, 5] for similar outcome.
This small patch series adds a new flag to userfaultfd(2) that allows
callers to give up the ability to handle kernel-mode faults with the
resulting UFFD file object. It then adds a 'user-mode only' option to the
unprivileged_userfaultfd sysctl knob to require unprivileged callers to
use this new flag.
The purpose of this new interface is to decrease the chance of an
unprivileged userfaultfd user taking advantage of userfaultfd to enhance
security vulnerabilities by lengthening the race window in kernel code.
[1] https://lore.kernel.org/lkml/20200211225547.235083-1-dancol@google.com/
[2] https://duasynt.com/blog/linux-kernel-heap-spray
[3] https://duasynt.com/blog/cve-2016-6187-heap-off-by-one-exploit
[4] https://googleprojectzero.blogspot.com/2016/06/exploiting-recursion-in-linux-kernel_20.html
[5] https://bugs.chromium.org/p/project-zero/issues/detail?id=808
This patch (of 2):
userfaultfd handles page faults from both user and kernel code. Add a new
UFFD_USER_MODE_ONLY flag for userfaultfd(2) that makes the resulting
userfaultfd object refuse to handle faults from kernel mode, treating
these faults as if SIGBUS were always raised, causing the kernel code to
fail with EFAULT.
A future patch adds a knob allowing administrators to give some processes
the ability to create userfaultfd file objects only if they pass
UFFD_USER_MODE_ONLY, reducing the likelihood that these processes will
exploit userfaultfd's ability to delay kernel page faults to open timing
windows for future exploits.
Link: https://lkml.kernel.org/r/20201120030411.2690816-1-lokeshgidra@google.com
Link: https://lkml.kernel.org/r/20201120030411.2690816-2-lokeshgidra@google.com
Signed-off-by: Daniel Colascione <dancol@google.com>
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: <calin@google.com>
Cc: Daniel Colascione <dancol@dancol.org>
Cc: Eric Biggers <ebiggers@kernel.org>
Cc: Iurii Zaikin <yzaikin@google.com>
Cc: Jeff Vander Stoep <jeffv@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: "Joel Fernandes (Google)" <joel@joelfernandes.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Kalesh Singh <kaleshsingh@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Nitin Gupta <nigupta@nvidia.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Shaohua Li <shli@fb.com>
Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 37cd0575b8510159992d279c530c05f872990b02)
Conflicts:
include/uapi/linux/userfaultfd.h
(1. Removed uffdio_writeprotect struct part of 63b2d4174c4ad)
Bug: 160737021
Bug: 169683130
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Change-Id: Ic4cecce08956402f91f866ae08f1d4ec21d64289
To be able to update addresses of an IPsec SA, as required by
supporting MOBIKE
Bug: 169169084
Signed-off-by: Yan Yan <evitayan@google.com>
Change-Id: I5aa3f3556d615e4f0695bb78cd3cad9e83851df5
This partially reverts commit 2e77a46f0d.
Reason for revert: ipa3_mdt_load_ipa_fws is not present in this kernel,
this is a bad cherrypick resolution by qcom.
Change-Id: I218978168a6c3fe9f6139a6688be1cb4c0f96b94
"LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0"
* tag 'LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
asoc: codec: avoid out of bound write to map array
asoc: codec: avoid out of bound write to map array
asoc: Fixed OOB issue in qcs405
asoc: codec: wcd934x: enable auto recovery when port overflows
Change-Id: I51a30fe905251b6f66e733bae43fdcd3b0a7e787
"LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0"
* tag 'LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0:
qcacld-3.0: Fix the possible OOB write in country IE unpack
qcacld-3.0: Correcting the TSInfo structure size according to the Spec
Release 2.0.8.34Y
qcacld-3.0: Correcting the TSInfo structure size according to the Spec
Release 2.0.8.34X
qcacld-3.0: Remove use-after-free of frame in tx mgmt send
Release 2.0.8.34W
qcacld-3.0: Fix the possible OOB write in country IE unpack
Release 2.0.8.34V
qcacld-3.0: Enhance the RSNXE inter-op logic
Release 2.0.8.34U
qcacld-3.0: Set sar safety req resp event before unsolited work stop
Release 2.0.8.34T
qcacld-3.0: Update connect request crypto parameters
qcacld-3.0: Enable CFG80211_MULTI_AKM_CONNECT_SUPPORT from kernelv6.0
qcacld-3.0: Update wiphy max_num_akms_connect variable
Change-Id: I79d549c4c8c2f38dc18509f91f12befc15bb19c6
"LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0"
* tag 'LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
msm: eva: Validating the SFR buffer size before accessing
msm: eva: Copy back the validated size to avoid security issue
msm: npu: Fix use after free issue
USB: dwc3: gadget: Add stop transfer request for isoc transfers
arm64: defconfig: Enable uvc for QCM6490 IOT target
firmware: qcom_scm: do not clear dump mode from shutdown
msm: virtio_npu: Fix use-after-free issue in unmap_buf
msm: virtio_npu: Fix use-after-free issue in virt_npu_map_buf
i2c: i2c-master-msm-geni: add null pointer check in event call back
firmware: qcom_scm: handle echo b > /proc/sysrq-trigger
scripts: mod: replace with a safe function
msm: ep_pcie: Disable hot reset and ignore linkdown
coresight-tmc: Replace deprecated function
USB: dwc3: gadget: Queue data for 16 micro frames ahead in future
power: reset: Disable support of dynamic download mode (ramdump)
Conflicts:
arch/arm64/boot/dts/vendor/bindings/sound/rt5645.txt
Change-Id: I57c063465c2804c77c5a6f62acb6c7987a38bc7f
https://source.android.com/docs/security/bulletin/2025-02-01
CVE-2024-53104
CVE-2025-0088
* tag 'ASB-2025-02-05_11-5.4' of https://android.googlesource.com/kernel/common: (449 commits)
ANDROID: gki - change networking configuration
ANDROID: kernelci build-break for 64-bit riscv clang builds (5.4 only)
Revert "BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics"
Revert "ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER"
ANDROID: GKI: add Trimble symbol list
UPSTREAM: selinux: ignore unknown extended permissions
ANDROID: ABI: Update allowed list for galaxy
Revert "netfilter: Replace zero-length array with flexible-array member"
Revert "tracing: Constify string literal data member in struct trace_event_call"
Revert "skb_expand_head() adjust skb->truesize incorrectly"
Linux 5.4.289
ftrace: use preempt_enable/disable notrace macros to avoid double fault
mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
drm: adv7511: Drop dsi single lane support
net/sctp: Prevent autoclose integer overflow in sctp_association_init()
sky2: Add device ID 11ab:4373 for Marvell 88E8075
pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
RDMA/uverbs: Prevent integer overflow issue
modpost: fix the missed iteration for the max bit in do_input()
modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
...
Conflicts:
arch/arm64/boot/dts/vendor/bindings/clock/adi,axi-clkgen.yaml
arch/arm64/boot/dts/vendor/bindings/clock/axi-clkgen.txt
drivers/rpmsg/qcom_glink_native.c
drivers/soc/qcom/socinfo.c
Change-Id: I60727e0cdd974fda5ca71f938bc2f984a8bbf19a
When STACKPROTECTOR_PER_TASK is enabled, __stack_chk_guard is not
exported which breaks external modules due to missing symbols.
Change-Id: I633dcdd3343f63f6af34aab87e98cc81c6c56fe2
- Proper Handling in case of invalid pinctrl index
- Removing dead code and unused variables
- Change to dereference s_ctrl only after proper
NULL Dereference Check.
CRs-Fixed: 3875406
Change-Id: I8e2c717b22efff2a7d6503d38c048e30eff230da
Signed-off-by: Swami Reddy Reddy <quic_swamired@quicinc.com>
Make the following configuration changes:
CONFIG_NET_CLS_MATCHALL=y
CONFIG_NET_ACT_POLICE=y
CONFIG_NET_ACT_BPF=y
CONFIG_USB_RTL8150=y
CONFIG_USB_NET_CDC_EEM=y
CONFIG_USB_NET_CDC_NCM=y
CONFIG_USB_NET_AQC111=y
Note: 4 of these are already enabled in android12-5.4,
and the remaining 3 will be enabled as well in
https://android-review.googlesource.com/c/kernel/common/+/3470489
Test: TreeHugger
Bug: 377436524
Bug: 391669319
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1737c1e18a072cac9dd50e4d21b52b220c2ec40c
No 64-bit riscv builds were working with clang (found via kernelci) for our 5.4 kernels:
ld.lld: error: arch/riscv/built-in.a(kernel/signal.o):(function do_notify_resume: .text+0x30c): relocation R_RISCV_PCREL_HI20 out of range: 33554406 is not in [-524288, 524287]; references '__vdso_rt_sigreturn'
>>> referenced by signal.c
>>> defined in arch/riscv/built-in.a(kernel/vdso/vdso-syms.o)
There are two ANDROID-specific patches that added global variables that
must be reverted to fix the build:
f06e9ec979 ("BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics")
3818981c3332 ("ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER")
Also, CONFIG_INIT_STACK_ALL_PATTERN must be disabled to avoid the
relocation issues.
These issues all seem to be fixed in 5.10 and later kernels.
Bug: 393656515
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I0a5395a9767b94ec2291c9ef7e9a69f1f4665730
This reverts commit 6dea6a501418e1561d48f141d288866d71684372.
Reason for revert: Prevents device from entering deep sleep (possibly
improper port).
NOTE: dwc3_msm_role_allowed was added in a later change, specifically
"usb: dwc3: dwc3-msm-core: Reject incompatible role/mode request", but
it is necessary to modify it here due to that change's dependency
on dr_mode being present where it is no longer available
after this revert (it is available elsewhere).
Issue: https://gitlab.com/LineageOS/issues/android/-/issues/8226
Issue: calyxos#2970
Change-Id: I03e9b7960d62999e019464b538a2642644e7fc6c
To avoid any OOB write or other security issues, it's good to
validate the buffer size before accessing it.
Change-Id: Ibfdef21293c9385119cfb6338ef36e20c0fc1f2f
Signed-off-by: Pulkit Singh Tak <quic_ptak@quicinc.com>
(cherry picked from commit 8ee6cd6bef)
As we are reading the packet from a shared queue, there is a
possibility to corrupt the packet->size data of shared queue by
malicious FW after validating it in the kernel driver.
Change-Id: I9bff8f2daa64054eada37de54fe3fa837d57b22a
Signed-off-by: Aniruddh Sharma <quic_anirshar@quicinc.com>
Signed-off-by: Madhu Ananthula <quic_mananthu@quicinc.com>
(cherry picked from commit bb8a45801d)
Block USB enumeration from the get-go by blocking role switches away from
USB_ROLE_NONE when usb_data_enabled is false.
Change-Id: I0eff78e56e4a3b64262f220a085cfec5910baf30
Signed-off-by: Sultan Alsawaf <sultan@osomprivacy.com>
If USB controller is configured to work in a specific mode, reject
any compatible role/mode request. For example, if device mode is
only allowed, switching to host mode/role is not allowed. The current
code allows this and it results in accessing invalid dwc host structures.
Change-Id: I5e4d905c8240ad228f48b40fe36298029d8770e1
Signed-off-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
To avoid dependencies for the DWC3 core device to be present during
dwc3_msm_probe(), read out the dr_mode property from the DT node directly.
Since this property can not dynamically change, it will be the same per
compile time setting.
Change-Id: I3b56bde13af141ea01f06ea5b81e44bc034bf7b1
Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
commit 900f83cf376bdaf798b6f5dcb2eae0c822e908b6 upstream.
When evaluating extended permissions, ignore unknown permissions instead
of calling BUG(). This commit ensures that future permissions can be
added without interfering with older kernels.
Cc: stable@vger.kernel.org
Fixes: fa1aa143ac ("selinux: extended permissions for ioctls")
Signed-off-by: Thiébaud Weksteen <tweek@google.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thiébaud Weksteen <tweek@google.com>
Change-Id: I1689d8c5084a24c1a34ef3d15d71f8cfa4122447
This reverts commit 9857e028d4 which is
commit 6daf14140129d30207ed6a0a69851fa6a3636bda upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I72ea16907de19ad38a993363ae45bab25f67d57a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 30080cdde6 which is
commit 452f4b31e3f70a52b97890888eeb9eaa9a87139a upstream.
It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: Ib63a284c6a02575a89f533f77da910de420989a7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
https://source.android.com/docs/security/bulletin/2025-01-01
* tag 'ASB-2025-01-05_11-5.4' of https://android.googlesource.com/kernel/common:
UPSTREAM: ALSA: usb-audio: Fix a DMA to stack memory bug
UPSTREAM: ALSA: usb-audio: Fix out of bounds reads when finding clock sources
UPSTREAM: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
Revert "UPSTREAM: unicode: Don't special case ignorable code points"
Reapply "UPSTREAM: unicode: Don't special case ignorable code points"
Revert "UPSTREAM: unicode: Don't special case ignorable code points"
Change-Id: Ibfa7592f50072262205201b39dd2e37a1ee3c289
This reverts commit 43e7958cf7 which is
commit 7f678def99d29c520418607509bb19c7fc96a6db upstream.
It breaks the Android kernel build and can be brought back in the future
in an abi-safe way if it is really needed.
Bug: 161946584
Change-Id: I21417bd6cf13432836618e2c0be84c79a9998b60
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmd/v80ACgkQONu9yGCS
aT6efw//UHOD4GORAmNhbC5i1A7+anJJpafHEDDb3f7yYpPsAeZMo3wS1zXesoIl
1x3aSBAUW6651gpO7FMQx16VMl9gtF2LRYtQomVvyqIi53a2XvZUGdmhnZBaXfNz
F7EX4bn3/wKtYfEC0buDCBzFZUzsLLnkwpiIwzMWymZsHS/lMvu9F+Ap240gy3MG
60ikjLpWbkrmfgJVHHKn+xeTUp8ikqDsx9JW+VYAqBENUr6+ZKZxKgo8SNh+Z+3n
xk39Rq/hzXyMtsQR7s8+3QSCJoh6VYhl7l6yvGYZ+BW8BKpqDl4lcKxiNUPUFjXL
mSk9AISKMUnBiPKQmhK0Yewns8aX0qIdLpZiUoSg+Ul+hlBf1bD//0AvJZ7A8kT0
I7s8OiemcrVMTW0m9HzY6XAgXhF9TutbrHTBn8IjDunQGz6Rz1pBsk7ka6boHf9K
6Cxb/VcsB3OsZGzVc7wULCVki5PWSRbQ4AklmCSlLnbMC8saVTkvH5cd0b6CeCB9
HJzZC4N77nUHUpRLz9ybu+bZFlJAwsXLrz84c50oU8RYSOPwIWOYsJgOmEpy1gbx
THGLBhs6xCdzOUB4deRS9MXcVDzLvVo5qcT7XAnVABz2XULfEPN1aD2ZbBsxQoxU
KIkmryxsohsLkomIxzSZHRTHptHCL+qtAPkDb0OgRkINlBb3Gbw=
=5mLz
-----END PGP SIGNATURE-----
Merge 5.4.289 into android11-5.4-lts
Changes in 5.4.289
net: sched: fix ordering of qlen adjustment
usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled
PCI/AER: Disable AER service on suspend
ALSA: usb: Fix UBSAN warning in parse_audio_unit()
PCI: Add ACS quirk for Broadcom BCM5760X NIC
i2c: pnx: Fix timeout in wait functions
drm/i915: Fix memory leak by correcting cache object name in error handler
erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
erofs: fix incorrect symlink detection in fast symlink
net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
ionic: use ee->offset when returning sprom data
net: hinic: Fix cleanup in create_rxqs/txqs()
net: ethernet: bgmac-platform: fix an OF node reference leak
netfilter: ipset: Fix for recursive locking warning
mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk
chelsio/chtls: prevent potential integer overflow on 32bit
i2c: riic: Always round-up when calculating bus period
efivarfs: Fix error on non-existent file
USB: serial: option: add TCL IK512 MBIM & ECM
USB: serial: option: add MeiG Smart SLM770A
USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
USB: serial: option: add MediaTek T7XX compositions
USB: serial: option: add Telit FE910C04 rmnet compositions
sh: clk: Fix clk_enable() to return 0 on NULL clk
zram: refuse to use zero sized block device as backing device
btrfs: tree-checker: reject inline extent items with 0 ref count
NFS/pnfs: Fix a live lock between recalled layouts and layoutget
of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one()
nilfs2: prevent use of deleted inode
udmabuf: also check for F_SEAL_FUTURE_WRITE
of: Fix error path in of_parse_phandle_with_args_map()
of: Fix refcount leakage for OF node returned by __of_get_dma_parent()
media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
bpf: Check negative offsets in __bpf_skb_min_len()
nfsd: restore callback functionality for NFSv4.0
mtd: diskonchip: Cast an operand to prevent potential overflow
phy: core: Fix an OF node refcount leakage in _of_phy_get()
phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup()
phy: core: Fix that API devm_phy_put() fails to release the phy
phy: core: Fix that API devm_phy_destroy() fails to destroy the phy
dmaengine: mv_xor: fix child node refcount handling in early exit
dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
mtd: rawnand: fix double free in atmel_pmecc_create_user()
tracing/kprobe: Make trace_kprobe's module callback called after jump_label update
scsi: qla1280: Fix hw revision numbering for ISP1020/1040
scsi: megaraid_sas: Fix for a potential deadlock
regmap: Use correct format specifier for logging range errors
platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load time
virtio-blk: don't keep queue frozen during system suspend
epoll: Add synchronous wakeup support for ep_poll_callback
MIPS: Probe toolchain support of -msym32
skbuff: introduce skb_expand_head()
ipv6: use skb_expand_head in ip6_finish_output2
ipv6: use skb_expand_head in ip6_xmit
ipv6: fix possible UAF in ip6_finish_output2()
bpf: fix recursive lock when verdict program return SK_PASS
tracing: Constify string literal data member in struct trace_event_call
btrfs: avoid monopolizing a core when activating a swap file
skb_expand_head() adjust skb->truesize incorrectly
ipv6: prevent possible UAF in ip6_xmit()
selinux: ignore unknown extended permissions
Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
IB/mlx5: Introduce and use mlx5_core_is_vf()
net/mlx5: Make API mlx5_core_is_ecpf accept const pointer
RDMA/mlx5: Enforce same type port association for multiport RoCE
RDMA/bnxt_re: Add check for path mtu in modify_qp
RDMA/bnxt_re: Fix reporting hw_ver in query_device
RDMA/bnxt_re: Fix max_qp_wrs reported
drm: bridge: adv7511: Enable SPDIF DAI
drm/bridge: adv7511_audio: Update Audio InfoFrame properly
netrom: check buffer length before accessing it
netfilter: Replace zero-length array with flexible-array member
netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
net: llc: reset skb->transport_header
ALSA: usb-audio: US16x08: Initialize array before use
af_packet: fix vlan_get_tci() vs MSG_PEEK
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
ila: serialize calls to nf_register_net_hooks()
wifi: mac80211: wake the queues in case of failure in resume
sound: usb: format: don't warn that raw DSD is unsupported
bpf: fix potential error return
net: usb: qmi_wwan: add Telit FE910C04 compositions
irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base
ARC: build: Try to guess GCC variant of cross compiler
modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
modpost: fix the missed iteration for the max bit in do_input()
RDMA/uverbs: Prevent integer overflow issue
pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
sky2: Add device ID 11ab:4373 for Marvell 88E8075
net/sctp: Prevent autoclose integer overflow in sctp_association_init()
drm: adv7511: Drop dsi single lane support
mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
ftrace: use preempt_enable/disable notrace macros to avoid double fault
Linux 5.4.289
Change-Id: I2fe8ada5386224ce16b22d4e1eff016656be40f3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Since the backport commit eea46baf14 ("ftrace: Fix possible
use-after-free issue in ftrace_location()") on linux-5.4.y branch, the
old ftrace_int3_handler()->ftrace_location() path has included
rcu_read_lock(), which has mcount location inside and leads to potential
double fault.
Replace rcu_read_lock/unlock with preempt_enable/disable notrace macros
so that the mcount location does not appear on the int3 handler path.
This fix is specific to linux-5.4.y branch, the only branch still using
ftrace_int3_handler with commit e60b613df8b6 ("ftrace: Fix possible
use-after-free issue in ftrace_location()") backported. It also avoids
the need to backport the code conversion to text_poke() on this branch.
Reported-by: Koichiro Den <koichiro.den@canonical.com>
Closes: https://lore.kernel.org/all/74gjhwxupvozwop7ndhrh7t5qeckomt7yqvkkbm5j2tlx6dkfk@rgv7sijvry2k
Fixes: eea46baf14 ("ftrace: Fix possible use-after-free issue in ftrace_location()") # linux-5.4.y
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6aaced5abd32e2a57cd94fd64f824514d0361da8 upstream.
The task sometimes continues looping in throttle_direct_reclaim() because
allow_direct_reclaim(pgdat) keeps returning false.
#0 [ffff80002cb6f8d0] __switch_to at ffff8000080095ac
#1 [ffff80002cb6f900] __schedule at ffff800008abbd1c
#2 [ffff80002cb6f990] schedule at ffff800008abc50c
#3 [ffff80002cb6f9b0] throttle_direct_reclaim at ffff800008273550
#4 [ffff80002cb6fa20] try_to_free_pages at ffff800008277b68
#5 [ffff80002cb6fae0] __alloc_pages_nodemask at ffff8000082c4660
#6 [ffff80002cb6fc50] alloc_pages_vma at ffff8000082e4a98
#7 [ffff80002cb6fca0] do_anonymous_page at ffff80000829f5a8
#8 [ffff80002cb6fce0] __handle_mm_fault at ffff8000082a5974
#9 [ffff80002cb6fd90] handle_mm_fault at ffff8000082a5bd4
At this point, the pgdat contains the following two zones:
NODE: 4 ZONE: 0 ADDR: ffff00817fffe540 NAME: "DMA32"
SIZE: 20480 MIN/LOW/HIGH: 11/28/45
VM_STAT:
NR_FREE_PAGES: 359
NR_ZONE_INACTIVE_ANON: 18813
NR_ZONE_ACTIVE_ANON: 0
NR_ZONE_INACTIVE_FILE: 50
NR_ZONE_ACTIVE_FILE: 0
NR_ZONE_UNEVICTABLE: 0
NR_ZONE_WRITE_PENDING: 0
NR_MLOCK: 0
NR_BOUNCE: 0
NR_ZSPAGES: 0
NR_FREE_CMA_PAGES: 0
NODE: 4 ZONE: 1 ADDR: ffff00817fffec00 NAME: "Normal"
SIZE: 8454144 PRESENT: 98304 MIN/LOW/HIGH: 68/166/264
VM_STAT:
NR_FREE_PAGES: 146
NR_ZONE_INACTIVE_ANON: 94668
NR_ZONE_ACTIVE_ANON: 3
NR_ZONE_INACTIVE_FILE: 735
NR_ZONE_ACTIVE_FILE: 78
NR_ZONE_UNEVICTABLE: 0
NR_ZONE_WRITE_PENDING: 0
NR_MLOCK: 0
NR_BOUNCE: 0
NR_ZSPAGES: 0
NR_FREE_CMA_PAGES: 0
In allow_direct_reclaim(), while processing ZONE_DMA32, the sum of
inactive/active file-backed pages calculated in zone_reclaimable_pages()
based on the result of zone_page_state_snapshot() is zero.
Additionally, since this system lacks swap, the calculation of inactive/
active anonymous pages is skipped.
crash> p nr_swap_pages
nr_swap_pages = $1937 = {
counter = 0
}
As a result, ZONE_DMA32 is deemed unreclaimable and skipped, moving on to
the processing of the next zone, ZONE_NORMAL, despite ZONE_DMA32 having
free pages significantly exceeding the high watermark.
The problem is that the pgdat->kswapd_failures hasn't been incremented.
crash> px ((struct pglist_data *) 0xffff00817fffe540)->kswapd_failures
$1935 = 0x0
This is because the node deemed balanced. The node balancing logic in
balance_pgdat() evaluates all zones collectively. If one or more zones
(e.g., ZONE_DMA32) have enough free pages to meet their watermarks, the
entire node is deemed balanced. This causes balance_pgdat() to exit early
before incrementing the kswapd_failures, as it considers the overall
memory state acceptable, even though some zones (like ZONE_NORMAL) remain
under significant pressure.
The patch ensures that zone_reclaimable_pages() includes free pages
(NR_FREE_PAGES) in its calculation when no other reclaimable pages are
available (e.g., file-backed or anonymous pages). This change prevents
zones like ZONE_DMA32, which have sufficient free pages, from being
mistakenly deemed unreclaimable. By doing so, the patch ensures proper
node balancing, avoids masking pressure on other zones like ZONE_NORMAL,
and prevents infinite loops in throttle_direct_reclaim() caused by
allow_direct_reclaim(pgdat) repeatedly returning false.
The kernel hangs due to a task stuck in throttle_direct_reclaim(), caused
by a node being incorrectly deemed balanced despite pressure in certain
zones, such as ZONE_NORMAL. This issue arises from
zone_reclaimable_pages() returning 0 for zones without reclaimable file-
backed or anonymous pages, causing zones like ZONE_DMA32 with sufficient
free pages to be skipped.
The lack of swap or reclaimable pages results in ZONE_DMA32 being ignored
during reclaim, masking pressure in other zones. Consequently,
pgdat->kswapd_failures remains 0 in balance_pgdat(), preventing fallback
mechanisms in allow_direct_reclaim() from being triggered, leading to an
infinite loop in throttle_direct_reclaim().
This patch modifies zone_reclaimable_pages() to account for free pages
(NR_FREE_PAGES) when no other reclaimable pages exist. This ensures zones
with sufficient free pages are not skipped, enabling proper balancing and
reclaim behavior.
[akpm@linux-foundation.org: coding-style cleanups]
Link: https://lkml.kernel.org/r/20241130164346.436469-1-snishika@redhat.com
Link: https://lkml.kernel.org/r/20241130161236.433747-2-snishika@redhat.com
Fixes: 5a1c84b404 ("mm: remove reclaim and compaction retry approximations")
Signed-off-by: Seiji Nishikawa <snishika@redhat.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
