No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Pu Lehui 0b36a04e95
UPSTREAM: bpf, cgroup: Fix kernel BUG in purge_effective_progs
[ Upstream commit 7d6620f107bae6ed687ff07668e8e8f855487aa9 ]

Syzkaller reported a triggered kernel BUG as follows:

  ------------[ cut here ]------------
  kernel BUG at kernel/bpf/cgroup.c:925!
  invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 1 PID: 194 Comm: detach Not tainted 5.19.0-14184-g69dac8e431af #8
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
  rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
  RIP: 0010:__cgroup_bpf_detach+0x1f2/0x2a0
  Code: 00 e8 92 60 30 00 84 c0 75 d8 4c 89 e0 31 f6 85 f6 74 19 42 f6 84
  28 48 05 00 00 02 75 0e 48 8b 80 c0 00 00 00 48 85 c0 75 e5 <0f> 0b 48
  8b 0c5
  RSP: 0018:ffffc9000055bdb0 EFLAGS: 00000246
  RAX: 0000000000000000 RBX: ffff888100ec0800 RCX: ffffc900000f1000
  RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888100ec4578
  RBP: 0000000000000000 R08: ffff888100ec0800 R09: 0000000000000040
  R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100ec4000
  R13: 000000000000000d R14: ffffc90000199000 R15: ffff888100effb00
  FS:  00007f68213d2b80(0000) GS:ffff88813bc80000(0000)
  knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 000055f74a0e5850 CR3: 0000000102836000 CR4: 00000000000006e0
  Call Trace:
   <TASK>
   cgroup_bpf_prog_detach+0xcc/0x100
   __sys_bpf+0x2273/0x2a00
   __x64_sys_bpf+0x17/0x20
   do_syscall_64+0x3b/0x90
   entry_SYSCALL_64_after_hwframe+0x63/0xcd
  RIP: 0033:0x7f68214dbcb9
  Code: 08 44 89 e0 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 48 89 f8 48 89
  f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
  f0 ff8
  RSP: 002b:00007ffeb487db68 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
  RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f68214dbcb9
  RDX: 0000000000000090 RSI: 00007ffeb487db70 RDI: 0000000000000009
  RBP: 0000000000000003 R08: 0000000000000012 R09: 0000000b00000003
  R10: 00007ffeb487db70 R11: 0000000000000246 R12: 00007ffeb487dc20
  R13: 0000000000000004 R14: 0000000000000001 R15: 000055f74a1011b0
   </TASK>
  Modules linked in:
  ---[ end trace 0000000000000000 ]---

Repetition steps:

For the following cgroup tree,

  root
   |
  cg1
   |
  cg2

  1. attach prog2 to cg2, and then attach prog1 to cg1, both bpf progs
     attach type is NONE or OVERRIDE.
  2. write 1 to /proc/thread-self/fail-nth for failslab.
  3. detach prog1 for cg1, and then kernel BUG occur.

Failslab injection will cause kmalloc fail and fall back to
purge_effective_progs. The problem is that cg2 have attached another prog,
so when go through cg2 layer, iteration will add pos to 1, and subsequent
operations will be skipped by the following condition, and cg will meet
NULL in the end.

  `if (pos && !(cg->bpf.flags[atype] & BPF_F_ALLOW_MULTI))`

The NULL cg means no link or prog match, this is as expected, and it's not
a bug. So here just skip the no match situation.

Fixes: 4c46091ee985 ("bpf: Fix KASAN use-after-free Read in compute_effective_progs")
Change-Id: Ica98c69bf3d58c46b1692625827485f7312960be
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20220813134030.1972696-1-pulehui@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2026-01-14 18:13:03 -08:00
android Merge tag 'LA.UM.9.14.r1-26500-LAHAINA.QSSI16.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into android13-5.4-lahaina 2025-11-08 16:13:44 +02:00
arch UPSTREAM: bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog 2026-01-14 18:12:57 -08:00
block Merge tag 'ASB-2025-12-01_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina 2025-12-04 19:21:35 +02:00
certs
crypto BACKPORT: crypto: lib/sha1 - rename "sha" to "sha1" 2025-12-23 13:36:17 -08:00
Documentation BACKPORT: bpf: Restrict bpf_trace_printk()'s %s usage and add %pks, %pus specifier 2026-01-14 18:12:53 -08:00
drivers UPSTREAM: module: Fix up module_notifier return values 2026-01-14 18:12:53 -08:00
fs UPSTREAM: sysctl: Convert to iter interfaces 2026-01-14 18:12:28 -08:00
include UPSTREAM: bpf: Adjust BPF stack helper functions to accommodate skip > 0 2026-01-14 18:13:01 -08:00
init UPSTREAM: bpf: Restrict bpf_probe_read{, str}() only to archs where they work 2026-01-14 18:12:54 -08:00
ipc BACKPORT: sysctl: pass kernel pointers to ->proc_handler 2025-12-23 13:36:15 -08:00
kernel UPSTREAM: bpf, cgroup: Fix kernel BUG in purge_effective_progs 2026-01-14 18:13:03 -08:00
lib BACKPORT: bpf: Restrict bpf_trace_printk()'s %s usage and add %pks, %pus specifier 2026-01-14 18:12:53 -08:00
LICENSES
mm UPSTREAM: maccess: rename strncpy_from_unsafe_strict to strncpy_from_kernel_nofault 2026-01-14 18:12:55 -08:00
net UPSTREAM: bpf: Don't redirect packets with invalid pkt_len 2026-01-14 18:13:02 -08:00
samples UPSTREAM: devmap: Adjust tracepoint for map-less queue flush 2025-12-23 13:35:54 -08:00
scripts UPSTREAM: bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop 2026-01-14 18:12:45 -08:00
security UPSTREAM: bpf: Implement bpf_local_storage for inodes 2026-01-14 18:12:21 -08:00
sound BACKPORT: mm: remove the pgprot argument to __vmalloc 2026-01-14 17:48:09 -08:00
techpack Merge tag 'LA.UM.9.14.r1-26000-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/display-drivers into android13-5.4-lahaina 2025-04-12 09:35:58 +00:00
tools UPSTREAM: bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off. 2026-01-14 18:12:58 -08:00
usr FROMLIST: kbuild: Add environment variables for userprogs flags 2025-09-28 10:00:32 +02:00
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Merge android11-5.4.289(4c8fb32) into msm-5.4 2025-03-26 11:56:22 +05:30
.mailmap
Android.mk
Androidbp
build.config.aarch64
build.config.allmodconfig
build.config.allmodconfig.aarch64
build.config.allmodconfig.arm
build.config.allmodconfig.x86_64
build.config.arm
build.config.common
build.config.db845c
build.config.gki
build.config.gki-debug.aarch64
build.config.gki-debug.x86_64
build.config.gki.aarch64
build.config.gki.x86_64
build.config.gki_kasan
build.config.gki_kasan.aarch64
build.config.gki_kasan.x86_64
build.config.gki_kprobes
build.config.gki_kprobes.aarch64
build.config.gki_kprobes.x86_64
build.config.hikey960
build.config.msm.common
build.config.msm.gki
build.config.msm.lahaina
build.config.x86_64
build.targets
COPYING
CREDITS
gen_headers_arm.bp
gen_headers_arm64.bp
gen_headers_arm64_auto.bp
gen_headers_arm_auto.bp
Kbuild
Kconfig
kernel_headers.py
LICENSE
MAINTAINERS BACKPORT: bpf: Introduce BPF_PROG_TYPE_LSM 2025-12-23 13:36:09 -08:00
Makefile BACKPORT: bpf: Resolve BTF IDs in vmlinux image 2026-01-14 18:12:02 -08:00
modules.list.msm.lahaina
OWNERS
README
README.md

How do I submit patches to Android Common Kernels

  1. BEST: Make all of your changes to upstream Linux. If appropriate, backport to the stable releases. These patches will be merged automatically in the corresponding common kernels. If the patch is already in upstream Linux, post a backport of the patch that conforms to the patch requirements below.

  2. LESS GOOD: Develop your patches out-of-tree (from an upstream Linux point-of-view). Unless these are fixing an Android-specific bug, these are very unlikely to be accepted unless they have been coordinated with kernel-team@android.com. If you want to proceed, post a patch that conforms to the patch requirements below.

Common Kernel patch requirements

  • All patches must conform to the Linux kernel coding standards and pass script/checkpatch.pl
  • Patches shall not break gki_defconfig or allmodconfig builds for arm, arm64, x86, x86_64 architectures (see https://source.android.com/setup/build/building-kernels)
  • If the patch is not merged from an upstream branch, the subject must be tagged with the type of patch: UPSTREAM:, BACKPORT:, FROMGIT:, FROMLIST:, or ANDROID:.
  • All patches must have a Change-Id: tag (see https://gerrit-review.googlesource.com/Documentation/user-changeid.html)
  • If an Android bug has been assigned, there must be a Bug: tag.
  • All patches must have a Signed-off-by: tag by the author and the submitter

Additional requirements are listed below based on patch type

Requirements for backports from mainline Linux: UPSTREAM:, BACKPORT:

  • If the patch is a cherry-pick from Linux mainline with no changes at all
    • tag the patch subject with UPSTREAM:.
    • add upstream commit information with a (cherry-picked from ...) line
    • Example:
      • if the upstream commit message is
        important patch from upstream

        This is the detailed description of the important patch

        Signed-off-by: Fred Jones <fred.jones@foo.org>
    - then Joe Smith would upload the patch for the common kernel as
        UPSTREAM: important patch from upstream

        This is the detailed description of the important patch

        Signed-off-by: Fred Jones <fred.jones@foo.org>

        Bug: 135791357
        Change-Id: I4caaaa566ea080fa148c5e768bb1a0b6f7201c01
        (cherry-picked from c31e73121f4c1ec41143423ac6ce3ce6dafdcec1)
        Signed-off-by: Joe Smith <joe.smith@foo.org>
  • If the patch requires any changes from the upstream version, tag the patch with BACKPORT: instead of UPSTREAM:.
    • use the same tags as UPSTREAM:
    • add comments about the changes under the (cherry-picked from ...) line
    • Example:
        BACKPORT: important patch from upstream

        This is the detailed description of the important patch

        Signed-off-by: Fred Jones <fred.jones@foo.org>

        Bug: 135791357
        Change-Id: I4caaaa566ea080fa148c5e768bb1a0b6f7201c01
        (cherry-picked from c31e73121f4c1ec41143423ac6ce3ce6dafdcec1)
        [ Resolved minor conflict in drivers/foo/bar.c ]
        Signed-off-by: Joe Smith <joe.smith@foo.org>

Requirements for other backports: FROMGIT:, FROMLIST:,

  • If the patch has been merged into an upstream maintainer tree, but has not yet been merged into Linux mainline
    • tag the patch subject with FROMGIT:
    • add info on where the patch came from as (cherry picked from commit <sha1> <repo> <branch>). This must be a stable maintainer branch (not rebased, so don't use linux-next for example).
    • if changes were required, use BACKPORT: FROMGIT:
    • Example:
      • if the commit message in the maintainer tree is
        important patch from upstream

        This is the detailed description of the important patch

        Signed-off-by: Fred Jones <fred.jones@foo.org>
    - then Joe Smith would upload the patch for the common kernel as
        FROMGIT: important patch from upstream

        This is the detailed description of the important patch

        Signed-off-by: Fred Jones <fred.jones@foo.org>

        Bug: 135791357
        (cherry picked from commit 878a2fd9de10b03d11d2f622250285c7e63deace
         https://git.kernel.org/pub/scm/linux/kernel/git/foo/bar.git test-branch)
        Change-Id: I4caaaa566ea080fa148c5e768bb1a0b6f7201c01
        Signed-off-by: Joe Smith <joe.smith@foo.org>
  • If the patch has been submitted to LKML, but not accepted into any maintainer tree
    • tag the patch subject with FROMLIST:
    • add a Link: tag with a link to the submittal on lore.kernel.org
    • if changes were required, use BACKPORT: FROMLIST:
    • Example:
        FROMLIST: important patch from upstream

        This is the detailed description of the important patch

        Signed-off-by: Fred Jones <fred.jones@foo.org>

        Bug: 135791357
        Link: https://lore.kernel.org/lkml/20190619171517.GA17557@someone.com/
        Change-Id: I4caaaa566ea080fa148c5e768bb1a0b6f7201c01
        Signed-off-by: Joe Smith <joe.smith@foo.org>

Requirements for Android-specific patches: ANDROID:

  • If the patch is fixing a bug to Android-specific code
    • tag the patch subject with ANDROID:
    • add a Fixes: tag that cites the patch with the bug
    • Example:
        ANDROID: fix android-specific bug in foobar.c

        This is the detailed description of the important fix

        Fixes: 1234abcd2468 ("foobar: add cool feature")
        Change-Id: I4caaaa566ea080fa148c5e768bb1a0b6f7201c01
        Signed-off-by: Joe Smith <joe.smith@foo.org>
  • If the patch is a new feature
    • tag the patch subject with ANDROID:
    • add a Bug: tag with the Android bug (required for android-specific features)

Vibrator driver for HHG device

How to merge the driver into kernel source tree

  1. Copy ${this_project}/drivers/hid/hid-aksys.c into ${your_kernel_root}/drivers/hid/

  2. Compare and merge ${this_project}/drivers/hid/hid-ids.h into ${your_kernel_root}/drivers/hid/hid-ids.h : Add the following code before the last line of this file

    	#define USB_VENDER_ID_QUALCOMM  0x0a12
    	#define USB_VENDER_ID_TEMP_HHG_AKSY 0x1234
    	#define USB_PRODUCT_ID_AKSYS_HHG  0x1000
    
  3. Merge ${this_project}/drivers/hid/Kconfig into ${your_kernel_root}/drivers/hid/Kconfig : Add the following code before the last line of this file

    config HID_AKSYS_QRD
    	tristate "AKSys gamepad USB adapter support"
    	depends on HID
    	---help---
    	Support for AKSys gamepad USB adapter
    
    config AKSYS_QRD_FF
    	bool "AKSys gamepad USB adapter force feedback support"
    	depends on HID_AKSYS_QRD
    	select INPUT_FF_MEMLESS
    	---help---
    	Say Y here if you have a AKSys gamepad USB adapter and want to
    	enable force feedback support for it.
    
  4. Merge ${this_project}/drivers/hid/Makefile into ${your_kernel_root}/drivers/hid/Makefile : Add the following code at the end of this file

    obj-$(CONFIG_HID_AKSYS_QRD)	+= hid-aksys.o
    
  5. Modify your kernel's default build configuration file. Add the following two lines:

    CONFIG_HID_AKSYS_QRD=m
    CONFIG_AKSYS_QRD_FF=y