Thadeu Lima de Souza Cascardo
40b46d8656
UPSTREAM: netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
...
commit caf3ef7468 upstream.
When evaluating byteorder expressions with size 2, a union with 32-bit and
16-bit members is used. Since the 16-bit members are aligned to 32-bit,
the array accesses will be out-of-bounds.
It may lead to a stack-out-of-bounds access like the one below:
[ 23.095215] ==================================================================
[ 23.095625] BUG: KASAN: stack-out-of-bounds in nft_byteorder_eval+0x13c/0x320
[ 23.096020] Read of size 2 at addr ffffc90000007948 by task ping/115
[ 23.096358]
[ 23.096456] CPU: 0 PID: 115 Comm: ping Not tainted 6.4.0+ #413
[ 23.096770] Call Trace:
[ 23.096910] <IRQ>
[ 23.097030] dump_stack_lvl+0x60/0xc0
[ 23.097218] print_report+0xcf/0x630
[ 23.097388] ? nft_byteorder_eval+0x13c/0x320
[ 23.097577] ? kasan_addr_to_slab+0xd/0xc0
[ 23.097760] ? nft_byteorder_eval+0x13c/0x320
[ 23.097949] kasan_report+0xc9/0x110
[ 23.098106] ? nft_byteorder_eval+0x13c/0x320
[ 23.098298] __asan_load2+0x83/0xd0
[ 23.098453] nft_byteorder_eval+0x13c/0x320
[ 23.098659] nft_do_chain+0x1c8/0xc50
[ 23.098852] ? __pfx_nft_do_chain+0x10/0x10
[ 23.099078] ? __kasan_check_read+0x11/0x20
[ 23.099295] ? __pfx___lock_acquire+0x10/0x10
[ 23.099535] ? __pfx___lock_acquire+0x10/0x10
[ 23.099745] ? __kasan_check_read+0x11/0x20
[ 23.099929] nft_do_chain_ipv4+0xfe/0x140
[ 23.100105] ? __pfx_nft_do_chain_ipv4+0x10/0x10
[ 23.100327] ? lock_release+0x204/0x400
[ 23.100515] ? nf_hook.constprop.0+0x340/0x550
[ 23.100779] nf_hook_slow+0x6c/0x100
[ 23.100977] ? __pfx_nft_do_chain_ipv4+0x10/0x10
[ 23.101223] nf_hook.constprop.0+0x334/0x550
[ 23.101443] ? __pfx_ip_local_deliver_finish+0x10/0x10
[ 23.101677] ? __pfx_nf_hook.constprop.0+0x10/0x10
[ 23.101882] ? __pfx_ip_rcv_finish+0x10/0x10
[ 23.102071] ? __pfx_ip_local_deliver_finish+0x10/0x10
[ 23.102291] ? rcu_read_lock_held+0x4b/0x70
[ 23.102481] ip_local_deliver+0xbb/0x110
[ 23.102665] ? __pfx_ip_rcv+0x10/0x10
[ 23.102839] ip_rcv+0x199/0x2a0
[ 23.102980] ? __pfx_ip_rcv+0x10/0x10
[ 23.103140] __netif_receive_skb_one_core+0x13e/0x150
[ 23.103362] ? __pfx___netif_receive_skb_one_core+0x10/0x10
[ 23.103647] ? mark_held_locks+0x48/0xa0
[ 23.103819] ? process_backlog+0x36c/0x380
[ 23.103999] __netif_receive_skb+0x23/0xc0
[ 23.104179] process_backlog+0x91/0x380
[ 23.104350] __napi_poll.constprop.0+0x66/0x360
[ 23.104589] ? net_rx_action+0x1cb/0x610
[ 23.104811] net_rx_action+0x33e/0x610
[ 23.105024] ? _raw_spin_unlock+0x23/0x50
[ 23.105257] ? __pfx_net_rx_action+0x10/0x10
[ 23.105485] ? mark_held_locks+0x48/0xa0
[ 23.105741] __do_softirq+0xfa/0x5ab
[ 23.105956] ? __dev_queue_xmit+0x765/0x1c00
[ 23.106193] do_softirq.part.0+0x49/0xc0
[ 23.106423] </IRQ>
[ 23.106547] <TASK>
[ 23.106670] __local_bh_enable_ip+0xf5/0x120
[ 23.106903] __dev_queue_xmit+0x789/0x1c00
[ 23.107131] ? __pfx___dev_queue_xmit+0x10/0x10
[ 23.107381] ? find_held_lock+0x8e/0xb0
[ 23.107585] ? lock_release+0x204/0x400
[ 23.107798] ? neigh_resolve_output+0x185/0x350
[ 23.108049] ? mark_held_locks+0x48/0xa0
[ 23.108265] ? neigh_resolve_output+0x185/0x350
[ 23.108514] neigh_resolve_output+0x246/0x350
[ 23.108753] ? neigh_resolve_output+0x246/0x350
[ 23.109003] ip_finish_output2+0x3c3/0x10b0
[ 23.109250] ? __pfx_ip_finish_output2+0x10/0x10
[ 23.109510] ? __pfx_nf_hook+0x10/0x10
[ 23.109732] __ip_finish_output+0x217/0x390
[ 23.109978] ip_finish_output+0x2f/0x130
[ 23.110207] ip_output+0xc9/0x170
[ 23.110404] ip_push_pending_frames+0x1a0/0x240
[ 23.110652] raw_sendmsg+0x102e/0x19e0
[ 23.110871] ? __pfx_raw_sendmsg+0x10/0x10
[ 23.111093] ? lock_release+0x204/0x400
[ 23.111304] ? __mod_lruvec_page_state+0x148/0x330
[ 23.111567] ? find_held_lock+0x8e/0xb0
[ 23.111777] ? find_held_lock+0x8e/0xb0
[ 23.111993] ? __rcu_read_unlock+0x7c/0x2f0
[ 23.112225] ? aa_sk_perm+0x18a/0x550
[ 23.112431] ? filemap_map_pages+0x4f1/0x900
[ 23.112665] ? __pfx_aa_sk_perm+0x10/0x10
[ 23.112880] ? find_held_lock+0x8e/0xb0
[ 23.113098] inet_sendmsg+0xa0/0xb0
[ 23.113297] ? inet_sendmsg+0xa0/0xb0
[ 23.113500] ? __pfx_inet_sendmsg+0x10/0x10
[ 23.113727] sock_sendmsg+0xf4/0x100
[ 23.113924] ? move_addr_to_kernel.part.0+0x4f/0xa0
[ 23.114190] __sys_sendto+0x1d4/0x290
[ 23.114391] ? __pfx___sys_sendto+0x10/0x10
[ 23.114621] ? __pfx_mark_lock.part.0+0x10/0x10
[ 23.114869] ? lock_release+0x204/0x400
[ 23.115076] ? find_held_lock+0x8e/0xb0
[ 23.115287] ? rcu_is_watching+0x23/0x60
[ 23.115503] ? __rseq_handle_notify_resume+0x6e2/0x860
[ 23.115778] ? __kasan_check_write+0x14/0x30
[ 23.116008] ? blkcg_maybe_throttle_current+0x8d/0x770
[ 23.116285] ? mark_held_locks+0x28/0xa0
[ 23.116503] ? do_syscall_64+0x37/0x90
[ 23.116713] __x64_sys_sendto+0x7f/0xb0
[ 23.116924] do_syscall_64+0x59/0x90
[ 23.117123] ? irqentry_exit_to_user_mode+0x25/0x30
[ 23.117387] ? irqentry_exit+0x77/0xb0
[ 23.117593] ? exc_page_fault+0x92/0x140
[ 23.117806] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 23.118081] RIP: 0033:0x7f744aee2bba
[ 23.118282] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
[ 23.119237] RSP: 002b:00007ffd04a7c9f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 23.119644] RAX: ffffffffffffffda RBX: 00007ffd04a7e0a0 RCX: 00007f744aee2bba
[ 23.120023] RDX: 0000000000000040 RSI: 000056488e9e6300 RDI: 0000000000000003
[ 23.120413] RBP: 000056488e9e6300 R08: 00007ffd04a80320 R09: 0000000000000010
[ 23.120809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
[ 23.121219] R13: 00007ffd04a7dc38 R14: 00007ffd04a7ca00 R15: 00007ffd04a7e0a0
[ 23.121617] </TASK>
[ 23.121749]
[ 23.121845] The buggy address belongs to the virtual mapping at
[ 23.121845] [ffffc90000000000, ffffc90000009000) created by:
[ 23.121845] irq_init_percpu_irqstack+0x1cf/0x270
[ 23.122707]
[ 23.122803] The buggy address belongs to the physical page:
[ 23.123104] page:0000000072ac19f0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24a09
[ 23.123609] flags: 0xfffffc0001000(reserved|node=0|zone=1|lastcpupid=0x1fffff)
[ 23.123998] page_type: 0xffffffff()
[ 23.124194] raw: 000fffffc0001000 ffffea0000928248 ffffea0000928248 0000000000000000
[ 23.124610] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 23.125023] page dumped because: kasan: bad access detected
[ 23.125326]
[ 23.125421] Memory state around the buggy address:
[ 23.125682] ffffc90000007800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 23.126072] ffffc90000007880: 00 00 00 00 00 f1 f1 f1 f1 f1 f1 00 00 f2 f2 00
[ 23.126455] >ffffc90000007900: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00
[ 23.126840] ^
[ 23.127138] ffffc90000007980: 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3
[ 23.127522] ffffc90000007a00: f3 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
[ 23.127906] ==================================================================
[ 23.128324] Disabling lock debugging due to kernel taint
Using simple s16 pointers for the 16-bit accesses fixes the problem. For
the 32-bit accesses, src and dst can be used directly.
Bug: 291031528
Fixes: 96518518cc ("netfilter: add nftables")
Cc: stable@vger.kernel.org
Reported-by: Tanguy DUBROCA (@SidewayRE) from @Synacktiv working with ZDI
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com >
Reviewed-by: Florian Westphal <fw@strlen.de >
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
(cherry picked from commit 870dcc31c0 )
Signed-off-by: Lee Jones <joneslee@google.com >
Change-Id: I4a76c2be021867c923684f0034d4564f7797b48b
2023-09-20 14:37:55 +00:00
Randy Dunlap
d8f69aade5
UPSTREAM: iommu/of: mark an unused function as __maybe_unused
...
When CONFIG_OF_ADDRESS is not set, there is a build warning/error
about an unused function.
Annotate the function to quieten the warning/error.
../drivers/iommu/of_iommu.c:176:29: warning: 'iommu_resv_region_get_type' defined but not used [-Wunused-function]
176 | static enum iommu_resv_type iommu_resv_region_get_type(struct device *dev, struct resource *phys,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
Bug: 257546262
Fixes: a5bf3cfce8 ("iommu: Implement of_iommu_get_resv_regions()")
Change-Id: Ice815df046c06efa7351351e3886e925c27ca57f
Signed-off-by: Randy Dunlap <rdunlap@infradead.org >
Cc: Thierry Reding <treding@nvidia.com >
Cc: Joerg Roedel <jroedel@suse.de >
Cc: Will Deacon <will@kernel.org >
Cc: iommu@lists.linux.dev
Reviewed-by: Thierry Reding <treding@nvidia.com >
Link: https://lore.kernel.org/r/20230209010359.23831-1-rdunlap@infradead.org
[joro: Improve code formatting]
Signed-off-by: Joerg Roedel <jroedel@suse.de >
(cherry picked from commit 4762315d1c )
2023-09-19 16:59:57 -07:00
Thierry Reding
a032fbc776
UPSTREAM: iommu: dma: Use of_iommu_get_resv_regions()
...
For device tree nodes, use the standard of_iommu_get_resv_regions()
implementation to obtain the reserved memory regions associated with a
device.
Bug: 257546262
Cc: Rob Herring <robh+dt@kernel.org >
Cc: Frank Rowand <frowand.list@gmail.com >
Cc: devicetree@vger.kernel.org
Acked-by: Robin Murphy <robin.murphy@arm.com >
Change-Id: I142fa2ef8639b604701f8d0bc70429288a5e8491
Signed-off-by: Thierry Reding <treding@nvidia.com >
Link: https://lore.kernel.org/r/20230120174251.4004100-5-thierry.reding@gmail.com
Signed-off-by: Joerg Roedel <jroedel@suse.de >
(cherry picked from commit 5cef282e29 )
2023-09-19 16:59:57 -07:00
Thierry Reding
693c712967
UPSTREAM: iommu: Implement of_iommu_get_resv_regions()
...
This is an implementation that IOMMU drivers can use to obtain reserved
memory regions from a device tree node. It uses the reserved-memory DT
bindings to find the regions associated with a given device. If these
regions are marked accordingly, identity mappings will be created for
them in the IOMMU domain that the devices will be attached to.
Bug: 257546262
Cc: Frank Rowand <frowand.list@gmail.com >
Cc: devicetree@vger.kernel.org
Reviewed-by: Rob Herring <robh@kernel.org >
Acked-by: Robin Murphy <robin.murphy@arm.com >
Change-Id: I68367e556cfd822a5802d7ff579f6dc12f54f6a6
Signed-off-by: Thierry Reding <treding@nvidia.com >
Link: https://lore.kernel.org/r/20230120174251.4004100-4-thierry.reding@gmail.com
Signed-off-by: Joerg Roedel <jroedel@suse.de >
(cherry picked from commit a5bf3cfce8 )
2023-09-19 16:59:57 -07:00
Thierry Reding
e9603e85ac
UPSTREAM: dt-bindings: reserved-memory: Document iommu-addresses
...
This adds the "iommu-addresses" property to reserved-memory nodes, which
allow describing the interaction of memory regions with IOMMUs. Two use-
cases are supported:
1. Static mappings can be described by pairing the "iommu-addresses"
property with a "reg" property. This is mostly useful for adopting
firmware-allocated buffers via identity mappings. One common use-
case where this is required is if early firmware or bootloaders
have set up a bootsplash framebuffer that a display controller is
actively scanning out from during the operating system boot
process.
2. If an "iommu-addresses" property exists without a "reg" property,
the reserved-memory node describes an IOVA reservation. Such memory
regions are excluded from the IOVA space available to operating
system drivers and can be used for regions that must not be used to
map arbitrary buffers.
Each mapping or reservation is tied to a specific device via a phandle
to the device's device tree node. This allows a reserved-memory region
to be reused across multiple devices.
Bug: 257546262
Reviewed-by: Rob Herring <robh@kernel.org >
Reviewed-by: Robin Murphy <robin.murphy@arm.com >
Change-Id: I9cdd29d056896b9cbb9fdbbc0c6cbd824f1be78e
Signed-off-by: Thierry Reding <treding@nvidia.com >
Link: https://lore.kernel.org/r/20230120174251.4004100-3-thierry.reding@gmail.com
Signed-off-by: Joerg Roedel <jroedel@suse.de >
(cherry picked from commit af0d81357c )
2023-09-19 16:59:57 -07:00
Thierry Reding
64ed291347
UPSTREAM: of: Introduce of_translate_dma_region()
...
This function is similar to of_translate_dma_address() but also reads a
length in addition to an address from a device tree property.
Bug: 257546262
Reviewed-by: Rob Herring <robh@kernel.org >
Change-Id: I04eb9ee382b4a6db998b0bf34545f2bddef7a00e
Signed-off-by: Thierry Reding <treding@nvidia.com >
Link: https://lore.kernel.org/r/20230120174251.4004100-2-thierry.reding@gmail.com
Signed-off-by: Joerg Roedel <jroedel@suse.de >
(cherry picked from commit e251c21372 )
2023-09-19 16:59:57 -07:00
Kever Yang
536996aa30
ANDROID: GKI: Add rockchip fragment and build.config
...
Add rockchip fragment and build.config for build symbol list and abi update.
Bug: 300024866
Change-Id: I05f9b2cdba8b558be68a3f93330cd072cd341d71
Signed-off-by: Kever Yang <kever.yang@rock-chips.com >
2023-09-19 17:36:15 +00:00
Kever Yang
6a10b34387
ANDROID: GKI: Add symbols for rockchip v4l2
...
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 11 function symbol(s) added
'int __v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler*)'
'bool v4l2_find_dv_timings_cap(struct v4l2_dv_timings*, const struct v4l2_dv_timings_cap*, unsigned int, v4l2_check_dv_timings_fnc*, void*)'
'int v4l2_pipeline_pm_get(struct media_entity*)'
'void v4l2_pipeline_pm_put(struct media_entity*)'
'void v4l2_print_dv_timings(const char*, const char*, const struct v4l2_dv_timings*, bool)'
'int v4l2_querymenu(struct v4l2_ctrl_handler*, struct v4l2_querymenu*)'
'int v4l2_src_change_event_subdev_subscribe(struct v4l2_subdev*, struct v4l2_fh*, struct v4l2_event_subscription*)'
'void v4l2_subdev_notify_event(struct v4l2_subdev*, const struct v4l2_event*)'
'bool v4l2_valid_dv_timings(const struct v4l2_dv_timings*, const struct v4l2_dv_timings_cap*, v4l2_check_dv_timings_fnc*, void*)'
'int video_device_pipeline_start(struct video_device*, struct media_pipeline*)'
'void video_device_pipeline_stop(struct video_device*)'
1 variable symbol(s) added
'const char* v4l2_type_names[15]'
Bug: 300024866
Change-Id: I1c7e85b6b125c2dfb43fe2ac4c4c9b2867119513
Signed-off-by: Kever Yang <kever.yang@rock-chips.com >
2023-09-19 03:02:27 +00:00
Kever Yang
3e3c6debe4
ANDROID: GKI: Add hid and usb symbols for rockchip
...
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 35 function symbol(s) added
'struct fwnode_handle* fwnode_create_software_node(const struct property_entry*, const struct fwnode_handle*)'
'int hid_driver_reset_resume(struct hid_device*)'
'int hid_driver_suspend(struct hid_device*, pm_message_t)'
'void hid_hw_close(struct hid_device*)'
'int hid_hw_open(struct hid_device*)'
'int hid_hw_output_report(struct hid_device*, __u8*, size_t)'
'void hid_hw_request(struct hid_device*, struct hid_report*, enum hid_class_request)'
'int hid_report_raw_event(struct hid_device*, enum hid_report_type, u8*, u32, int)'
'struct hid_report* hid_validate_values(struct hid_device*, enum hid_report_type, unsigned int, unsigned int, unsigned int)'
'struct tcpm_port* tcpm_register_port(struct device*, struct tcpc_dev*)'
'void tcpm_unregister_port(struct tcpm_port*)'
'int usb_interrupt_msg(struct usb_device*, unsigned int, void*, int, int*, int)'
'int usbnet_change_mtu(struct net_device*, int)'
'void usbnet_defer_kevent(struct usbnet*, int)'
'void usbnet_disconnect(struct usb_interface*)'
'void usbnet_get_drvinfo(struct net_device*, struct ethtool_drvinfo*)'
'u32 usbnet_get_link(struct net_device*)'
'int usbnet_get_link_ksettings_mii(struct net_device*, struct ethtool_link_ksettings*)'
'u32 usbnet_get_msglevel(struct net_device*)'
'int usbnet_nway_reset(struct net_device*)'
'int usbnet_open(struct net_device*)'
'int usbnet_probe(struct usb_interface*, const struct usb_device_id*)'
'int usbnet_read_cmd(struct usbnet*, u8, u8, u16, u16, void*, u16)'
'int usbnet_read_cmd_nopm(struct usbnet*, u8, u8, u16, u16, void*, u16)'
'int usbnet_resume(struct usb_interface*)'
'int usbnet_set_link_ksettings_mii(struct net_device*, const struct ethtool_link_ksettings*)'
'void usbnet_set_msglevel(struct net_device*, u32)'
'void usbnet_skb_return(struct usbnet*, struct sk_buff*)'
'netdev_tx_t usbnet_start_xmit(struct sk_buff*, struct net_device*)'
'int usbnet_stop(struct net_device*)'
'int usbnet_suspend(struct usb_interface*, pm_message_t)'
'void usbnet_tx_timeout(struct net_device*, unsigned int)'
'int usbnet_write_cmd(struct usbnet*, u8, u8, u16, u16, const void*, u16)'
'int usbnet_write_cmd_async(struct usbnet*, u8, u8, u16, u16, const void*, u16)'
'int usbnet_write_cmd_nopm(struct usbnet*, u8, u8, u16, u16, const void*, u16)'
2 variable symbol(s) added
'int hid_debug'
'struct hid_ll_driver usb_hid_driver'
Bug: 300024866
Change-Id: Ie417675e96b58d05e04c44e81abcc00c5d3b0dbe
Signed-off-by: Kever Yang <kever.yang@rock-chips.com >
2023-09-19 03:02:27 +00:00
Kever Yang
53162778e7
ANDROID: GKI: Add cdc symbols for rockchip
...
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 10 function symbol(s) added
'struct net_device* __vlan_find_dev_deep_rcu(struct net_device*, __be16, u16)'
'int cdc_ncm_bind_common(struct usbnet*, struct usb_interface*, u8, int)'
'int cdc_ncm_change_mtu(struct net_device*, int)'
'struct sk_buff* cdc_ncm_fill_tx_frame(struct usbnet*, struct sk_buff*, __le32)'
'int cdc_ncm_rx_verify_ndp16(struct sk_buff*, int)'
'int cdc_ncm_rx_verify_nth16(struct cdc_ncm_ctx*, struct sk_buff*)'
'u8 cdc_ncm_select_altsetting(struct usb_interface*)'
'void cdc_ncm_unbind(struct usbnet*, struct usb_interface*)'
'void cec_queue_pin_hpd_event(struct cec_adapter*, bool, ktime_t)'
'void in6_dev_finish_destroy(struct inet6_dev*)'
Bug: 300024866
Change-Id: I4eaa35395fcb35e058f67ef73ae6561161ccf0bd
Signed-off-by: Kever Yang <kever.yang@rock-chips.com >
2023-09-19 03:02:27 +00:00
Kever Yang
b09b06dcf1
ANDROID: GKI: Add symbols for rockchip sdhci
...
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 8 function symbol(s) added
'void sdhci_adma_write_desc(struct sdhci_host*, void**, dma_addr_t, int, unsigned int)'
'unsigned int sdhci_pltfm_clk_get_max_clock(struct sdhci_host*)'
'int sdhci_pltfm_unregister(struct platform_device*)'
'void sdhci_set_clock(struct sdhci_host*, unsigned int)'
'void sdhci_set_power_and_bus_voltage(struct sdhci_host*, unsigned char, unsigned short)'
'void sdhci_set_uhs_signaling(struct sdhci_host*, unsigned int)'
'u16 sdio_readw(struct sdio_func*, unsigned int, int*)'
'void sdio_writew(struct sdio_func*, u16, unsigned int, int*)'
Bug: 300024866
Change-Id: I7592c26a0e1547719a70994a28d9c5bb525224b5
Signed-off-by: Kever Yang <kever.yang@rock-chips.com >
2023-09-19 03:02:27 +00:00
Kever Yang
62d64a59d9
ANDROID: GKI: Add symbols for rockchip devfreq
...
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 6 function symbol(s) added
'int devfreq_event_disable_edev(struct devfreq_event_dev*)'
'int devfreq_event_enable_edev(struct devfreq_event_dev*)'
'struct devfreq_event_dev* devfreq_event_get_edev_by_phandle(struct device*, const char*, int)'
'int devfreq_event_get_edev_count(struct device*, const char*)'
'int devfreq_event_get_event(struct devfreq_event_dev*, struct devfreq_event_data*)'
'int devm_devfreq_register_opp_notifier(struct device*, struct devfreq*)'
Bug: 300024866
Change-Id: I5db2294c3bc3e7e6dc9932551073310aec7065dc
Signed-off-by: Kever Yang <kever.yang@rock-chips.com >
2023-09-19 03:02:27 +00:00
Kever Yang
9c9ee611cf
ANDROID: GKI: Add crypto symbols for rockchip
...
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 14 function symbol(s) added
'int crypto_ahash_final(struct ahash_request*)'
'int crypto_ahash_finup(struct ahash_request*)'
'void crypto_cipher_encrypt_one(struct crypto_cipher*, u8*, const u8*)'
'int crypto_register_akcipher(struct akcipher_alg*)'
'int crypto_register_alg(struct crypto_alg*)'
'int crypto_register_template(struct crypto_template*)'
'int crypto_sha1_finup(struct shash_desc*, const u8*, unsigned int, u8*)'
'int crypto_sha1_update(struct shash_desc*, const u8*, unsigned int)'
'void crypto_unregister_akcipher(struct akcipher_alg*)'
'void crypto_unregister_alg(struct crypto_alg*)'
'void crypto_unregister_template(struct crypto_template*)'
'int des_expand_key(struct des_ctx*, const u8*, unsigned int)'
'int rsa_parse_priv_key(struct rsa_key*, const void*, unsigned int)'
'int rsa_parse_pub_key(struct rsa_key*, const void*, unsigned int)'
2 variable symbol(s) added
'bool fpsimd_context_busy'
'irq_cpustat_t irq_stat'
Bug: 300024866
Change-Id: I8266e5ca7683d3ffc4924b1926b5b70ba6cd7a81
Signed-off-by: Kever Yang <kever.yang@rock-chips.com >
2023-09-19 03:02:27 +00:00
Kever Yang
7246ecec46
ANDROID: GKI: Add rockchip drm symbols and abi
...
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 23 function symbol(s) added
'int __drm_atomic_helper_disable_plane(struct drm_plane*, struct drm_plane_state*)'
'int component_compare_dev(struct device*, void*)'
'int drm_aperture_remove_conflicting_framebuffers(resource_size_t, resource_size_t, bool, const struct drm_driver*)'
'struct edid* drm_bridge_get_edid(struct drm_bridge*, struct drm_connector*)'
'int drm_bridge_get_modes(struct drm_bridge*, struct drm_connector*)'
'bool drm_connector_has_possible_encoder(struct drm_connector*, struct drm_encoder*)'
'struct drm_crtc* drm_crtc_from_index(struct drm_device*, int)'
'uint64_t drm_format_info_min_pitch(const struct drm_format_info*, int, unsigned int)'
'struct dma_buf* drm_gem_dmabuf_export(struct drm_device*, struct dma_buf_export_info*)'
'int drm_gem_dumb_map_offset(struct drm_file*, struct drm_device*, u32, u64*)'
'int drm_gem_fb_afbc_init(struct drm_device*, const struct drm_mode_fb_cmd2*, struct drm_afbc_framebuffer*)'
'int drm_gem_fb_init_with_funcs(struct drm_device*, struct drm_framebuffer*, struct drm_file*, const struct drm_mode_fb_cmd2*, const struct drm_framebuffer_funcs*)'
'int drm_mm_reserve_node(struct drm_mm*, struct drm_mm_node*)'
'int drm_mode_create_tv_properties(struct drm_device*, unsigned int, const char* const*)'
'bool drm_mode_is_420(const struct drm_display_info*, const struct drm_display_mode*)'
'enum drm_mode_status drm_mode_validate_driver(struct drm_device*, const struct drm_display_mode*)'
'enum drm_mode_status drm_mode_validate_size(const struct drm_display_mode*, int, int)'
'enum drm_mode_status drm_mode_validate_ycbcr420(const struct drm_display_mode*, struct drm_connector*)'
'uint32_t drm_of_crtc_port_mask(struct drm_device*, struct device_node*)'
'struct drm_property* drm_property_create_object(struct drm_device*, u32, const char*, uint32_t)'
'int drm_property_replace_global_blob(struct drm_device*, struct drm_property_blob**, size_t, const void*, struct drm_mode_object*, struct drm_property*)'
'bool mipi_dsi_packet_format_is_short(u8)'
'struct device_node* of_graph_get_remote_port(const struct device_node*)'
Bug: 300024866
Change-Id: I057815380a8c4a3dfb1a81f6fd27148e3e36719c
Signed-off-by: Kever Yang <kever.yang@rock-chips.com >
2023-09-19 03:02:27 +00:00
Kever Yang
2f3d6aa0c9
ANDROID: GKI: Add initial abi for rockchip
...
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 65 function symbol(s) added
'unsigned int _bcd2bin(unsigned char)'
'unsigned char _bin2bcd(unsigned int)'
'int ce_aes_expandkey(struct crypto_aes_ctx*, const u8*, unsigned int)'
'void clk_fractional_divider_general_approximation(struct clk_hw*, unsigned long, unsigned long*, unsigned long*, unsigned long*)'
'int clk_get_phase(struct clk*)'
'void clk_hw_unregister_composite(struct clk_hw*)'
'int clk_set_phase(struct clk*, int)'
'int compat_only_sysfs_link_entry_to_kobj(struct kobject*, struct kobject*, const char*, const char*)'
'bool cpu_have_feature(unsigned int)'
'struct crypto_akcipher* crypto_alloc_akcipher(const char*, u32, u32)'
'int dev_pm_opp_get_supplies(struct dev_pm_opp*, struct dev_pm_opp_supply*)'
'void device_set_node(struct device*, struct fwnode_handle*)'
'struct devfreq_event_dev* devm_devfreq_event_add_edev(struct device*, struct devfreq_event_desc*)'
'char** devm_kasprintf_strarray(struct device*, const char*, size_t)'
'void* devm_pci_remap_cfg_resource(struct device*, struct resource*)'
'bool disable_hardirq(unsigned int)'
'int drm_gem_handle_delete(struct drm_file*, u32)'
'u16 dw_pcie_find_ext_capability(struct dw_pcie*, u8)'
'int dw_pcie_link_up(struct dw_pcie*)'
'int extcon_sync(struct extcon_dev*, unsigned int)'
'void gpiochip_relres_irq(struct gpio_chip*, unsigned int)'
'int gpiochip_reqres_irq(struct gpio_chip*, unsigned int)'
'ssize_t hdmi_avi_infoframe_pack_only(const struct hdmi_avi_infoframe*, void*, size_t)'
'struct iio_channel* iio_channel_get_all(struct device*)'
'void iio_channel_release_all(struct iio_channel*)'
'int iio_update_buffers(struct iio_dev*, struct iio_buffer*, struct iio_buffer*)'
'void input_set_poll_interval(struct input_dev*, unsigned int)'
'int input_setup_polling(struct input_dev*, void(*)(struct input_dev*))'
'void iommu_detach_group(struct iommu_domain*, struct iommu_group*)'
'int irq_gc_set_wake(struct irq_data*, unsigned int)'
'void led_set_brightness_nosleep(struct led_classdev*, unsigned int)'
'int media_entity_setup_link(struct media_link*, u32)'
'int mii_link_ok(struct mii_if_info*)'
'int mmc_sw_reset(struct mmc_card*)'
'struct pinctrl_dev* of_pinctrl_get(struct device_node*)'
'enum usb_dr_mode of_usb_get_dr_mode_by_phy(struct device_node*, int)'
'int phy_mipi_dphy_config_validate(struct phy_configure_opts_mipi_dphy*)'
'struct pinctrl_gpio_range* pinctrl_find_gpio_range_from_pin(struct pinctrl_dev*, unsigned int)'
'int pinmux_generic_add_function(struct pinctrl_dev*, const char*, const char* const*, unsigned int, void*)'
'int pm_clk_add_clk(struct device*, struct clk*)'
'int power_supply_get_property_from_supplier(struct power_supply*, enum power_supply_property, union power_supply_propval*)'
'int pwm_adjust_config(struct pwm_device*)'
'int regulator_suspend_enable(struct regulator_dev*, suspend_state_t)'
'struct iova* reserve_iova(struct iova_domain*, unsigned long, unsigned long)'
'void sha1_init(__u32*)'
'void sha1_transform(__u32*, const char*, __u32*)'
'struct skcipher_instance* skcipher_alloc_instance_simple(struct crypto_template*, struct rtattr**)'
'int skcipher_register_instance(struct crypto_template*, struct skcipher_instance*)'
'int skcipher_walk_aead_decrypt(struct skcipher_walk*, struct aead_request*, bool)'
'int skcipher_walk_aead_encrypt(struct skcipher_walk*, struct aead_request*, bool)'
'int skcipher_walk_done(struct skcipher_walk*, int)'
'int skcipher_walk_virt(struct skcipher_walk*, struct skcipher_request*, bool)'
'int snd_pcm_create_iec958_consumer_hw_params(struct snd_pcm_hw_params*, u8*, size_t)'
'int snd_pcm_stop_xrun(struct snd_pcm_substream*)'
'int snd_soc_jack_add_zones(struct snd_soc_jack*, int, struct snd_soc_jack_zone*)'
'int snd_soc_jack_get_type(struct snd_soc_jack*, int)'
'unsigned int swiotlb_max_segment()'
'void tcpm_tcpc_reset(struct tcpm_port*)'
'int usb_add_phy(struct usb_phy*, enum usb_phy_type)'
'void usb_deregister_dev(struct usb_interface*, struct usb_class_driver*)'
'struct usb_interface* usb_find_interface(struct usb_driver*, int)'
'void usb_poison_anchored_urbs(struct usb_anchor*)'
'int usb_register_dev(struct usb_interface*, struct usb_class_driver*)'
'enum usb_role usb_role_switch_get_role(struct usb_role_switch*)'
'unsigned int usb_wakeup_enabled_descendants(struct usb_device*)'
2 variable symbol(s) added
'unsigned long avenrun[3]'
'struct class* power_supply_class'
Bug: 300024866
Change-Id: I0e1aeb3470bc01a8097319dfca593c6d0c0c7d7f
Signed-off-by: Kever Yang <kever.yang@rock-chips.com >
2023-09-19 03:02:27 +00:00
Kever Yang
1e26ba1901
ANDROID: GKI: Add initial rockchip symbol list
...
Add initial symbol list for rockchip in android/abi_gki_aarch64_rockchip
Bug: 300024866
Change-Id: I4fd44b33141dfbdcd5b8d0d7c5d0fbc5aa2758cc
Signed-off-by: Kever Yang <kever.yang@rock-chips.com >
2023-09-19 03:02:27 +00:00
Elaine Zhang
404360f6d3
FROMLIST: clk: clk-fractional-divider: Export clk_fractional_divider_general_approximation API
...
This is used by the Rockchip clk driver, export it to allow that
driver to be compiled as a module.
Bug: 300024866
Change-Id: Ie457e795b105312aeb220b6070972d50a07797d9
Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com >
Reviewed-by: Kever Yang <kever.yang@rock-chips.com >
Link: https://lore.kernel.org/lkml/20230801081456.2551-1-zhangqing@rock-chips.com/
2023-09-19 00:34:38 +00:00
Budimir Markovic
c3d6c235b2
UPSTREAM: net/sched: sch_hfsc: Ensure inner classes have fsc curve
...
[ Upstream commit b3d26c5702 ]
HFSC assumes that inner classes have an fsc curve, but it is currently
possible for classes without an fsc curve to become parents. This leads
to bugs including a use-after-free.
Don't allow non-root classes without HFSC_FSC to become parents.
Bug: 300027510
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Budimir Markovic <markovicbudimir@gmail.com >
Signed-off-by: Budimir Markovic <markovicbudimir@gmail.com >
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com >
Link: https://lore.kernel.org/r/20230824084905.422-1-markovicbudimir@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org >
Signed-off-by: Sasha Levin <sashal@kernel.org >
(cherry picked from commit a1e820fc78 )
Signed-off-by: Lee Jones <joneslee@google.com >
Change-Id: I7d839127f7e1709cb571ac22a19aec08e6deec18
2023-09-18 17:02:00 +01:00
Schspa Shi
d3212c2dba
UPSTREAM: sched/rt: Fix bad task migration for rt tasks
...
Commit 95158a89dd ("sched,rt: Use the full cpumask for balancing")
allows find_lock_lowest_rq() to pick a task with migration disabled.
The purpose of the commit is to push the current running task on the
CPU that has the migrate_disable() task away.
However, there is a race which allows a migrate_disable() task to be
migrated. Consider:
CPU0 CPU1
push_rt_task
check is_migration_disabled(next_task)
task not running and
migration_disabled == 0
find_lock_lowest_rq(next_task, rq);
_double_lock_balance(this_rq, busiest);
raw_spin_rq_unlock(this_rq);
double_rq_lock(this_rq, busiest);
<<wait for busiest rq>>
<wakeup>
task become running
migrate_disable();
<context out>
deactivate_task(rq, next_task, 0);
set_task_cpu(next_task, lowest_rq->cpu);
WARN_ON_ONCE(is_migration_disabled(p));
Fixes: 95158a89dd ("sched,rt: Use the full cpumask for balancing")
Signed-off-by: Schspa Shi <schspa@gmail.com >
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org >
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org >
Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com >
Reviewed-by: Valentin Schneider <vschneid@redhat.com >
Tested-by: Dwaine Gonyier <dgonyier@redhat.com >
Signed-off-by: Sasha Levin <sashal@kernel.org >
Bug: 300418678
(cherry picked from commit feffe5bb27 )
[quic_dickey@quicinc.com: Port only]
Change-Id: I3e7953aeb3edf3f1a5d03e355297d7b1541ff7c8
Signed-off-by: Stephen Dickey <quic_dickey@quicinc.com>
2023-09-15 18:38:35 +00:00
steve2_yang
215e38e517
ANDROID: GKI: Add ASUS symbol list
...
create the ASUS symbol list of HID symbols for the USB HID Fan driver which requires them
6 function symbol(s) added
'int __hid_register_driver(struct hid_driver*, struct module*, const char*)'
'int hid_hw_raw_request(struct hid_device*, unsigned char, __u8*, size_t, enum hid_report_type, enum hid_class_request)'
'int hid_hw_start(struct hid_device*, unsigned int)'
'void hid_hw_stop(struct hid_device*)'
'int hid_open_report(struct hid_device*)'
'void hid_unregister_driver(struct hid_driver*)'
Bug: 300220786
Change-Id: I422c3b82754921c530e9afc32529a1dbf2f6c38e
Signed-off-by: Steve2 Yang <steve2_yang@asus.com >
2023-09-15 18:37:46 +00:00
Badhri Jagan Sridharan
e52e60e3ed
UPSTREAM: tcpm: Avoid soft reset when partner does not support get_status
...
When partner does not support get_status message, tcpm right now
responds with soft reset message. This causes PD renegotiation to
happen and resets PPS link. Avoid soft resetting the link when
partner does not support get_status message to mitigate PPS resets.
[ 208.926752] Setting voltage/current limit 9500 mV 2450 mA
[ 208.930407] set_auto_vbus_discharge_threshold mode:3 pps_active:y vbus:9500 ret:0
[ 208.930418] state change SNK_TRANSITION_SINK -> SNK_READY [rev3 POWER_NEGOTIATION]
[ 208.930455] AMS POWER_NEGOTIATION finished
// ALERT message from the Source
[ 213.948442] PD RX, header: 0x19a6 [1]
[ 213.948451] state change SNK_READY -> GET_STATUS_SEND [rev3 GETTING_SOURCE_SINK_STATUS]
[ 213.948457] PD TX, header: 0x492
[ 213.950402] PD TX complete, status: 0
[ 213.950427] pending state change GET_STATUS_SEND -> GET_STATUS_SEND_TIMEOUT @ 60 ms [rev3 GETTING_SOURCE_SINK_STATUS]
// NOT_SUPPORTED from the Source
[ 213.959954] PD RX, header: 0xbb0 [1]
// sink sends SOFT_RESET
[ 213.959958] state change GET_STATUS_SEND -> SNK_SOFT_RESET [rev3 GETTING_SOURCE_SINK_STATUS]
[ 213.959962] AMS GETTING_SOURCE_SINK_STATUS finished
[ 213.959964] AMS SOFT_RESET_AMS start
[ 213.959966] state change SNK_SOFT_RESET -> AMS_START [rev3 SOFT_RESET_AMS]
[ 213.959969] state change AMS_START -> SOFT_RESET_SEND [rev3 SOFT_RESET_AMS]
Cc: stable@vger.kernel.org
Fixes: 8dea75e113 ("usb: typec: tcpm: Protocol Error handling")
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com >
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com >
Link: https://lore.kernel.org/r/20230820044449.1005889-1-badhri@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
Bug: 265339154
(cherry picked from commit 78e0ea4277 )
Change-Id: Ic485cf8ae80b26d717b2f22998b267cc07027085
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com >
2023-09-15 16:37:36 +00:00
xiaosong.ma
bbc9d3bc0b
ANDROID: vendor_hooks: mm: Add tune_swappiness vendor hook in get_swappiness()
...
Add hook in get_swappiness() for customized swappiness when lru_gen is enabled.
Bug: 299548382
Test: buid pass
Change-Id: If15cb4f71fda6c0b24359f8dc439a090a5434dc9
Signed-off-by: xiaosong.ma <xiaosong.ma@unisoc.com >
2023-09-15 16:06:46 +00:00
Enlin Mu
7024c9cd28
ANDROID: ABI: Update symbols to unisoc whitelist
...
Update whitelist for the symbols used by the unisoc device and
update the ABI representation accordingly.
1 function symbol(s) added
'int pvclock_gtod_register_notifier(struct notifier_block*)'
Bug: 300019103
Change-Id: Ice320a418069f24a27d14939a143ce01f50c0de8
Signed-off-by: Enlin Mu <enlin.mu@unisoc.com >
2023-09-15 10:51:05 +00:00
Venkata Rao Kakani
de3e9f3111
ANDROID: ABI: Add to QCOM symbols list
...
Symbols updated to QCOM abi symbol list:
bio_split
dm_bufio_client_create
dm_bufio_client_destroy
dm_bufio_mark_buffer_dirty
dm_bufio_new
dm_bufio_read
dm_bufio_release
dm_bufio_write_dirty_buffers
dm_disk
dm_get_device
dm_kobject_release
dm_read_arg_group
dm_register_target
dm_shift_arg
dm_table_get_md
dm_table_get_mode
dm_unregister_target
Bug: 300189063
Change-Id: I0bfe7093e12074218384d645123fbb8854615162
Signed-off-by: Venkata Rao Kakani <quic_vkakani@quicinc.com >
2023-09-15 08:23:57 +00:00
Sangmoon Kim
85902d60cd
ANDROID: ABI: update symbol list for galaxy
...
1 function symbol(s) added
'int __traceiter_error_report_end(void*, enum error_detector, unsigned long)'
1 variable symbol(s) added
'struct tracepoint __tracepoint_error_report_end'
Bug: 300201494
Change-Id: I558abcc6f2d4bcae873687fc58d52228d0d53436
Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com >
2023-09-14 06:24:51 +00:00
Kees Cook
c2ac612610
BACKPORT: printk: ringbuffer: Fix truncating buffer size min_t cast
...
If an output buffer size exceeded U16_MAX, the min_t(u16, ...) cast in
copy_data() was causing writes to truncate. This manifested as output
bytes being skipped, seen as %NUL bytes in pstore dumps when the available
record size was larger than 65536. Fix the cast to no longer truncate
the calculation.
Bug: 300230860
(cherry picked from commit 53e9e33ede )
Change-Id: I1b55761335aba6fa39f00306f7b0255c2afd0849
Cc: Petr Mladek <pmladek@suse.com >
Cc: Sergey Senozhatsky <senozhatsky@chromium.org >
Cc: Steven Rostedt <rostedt@goodmis.org >
Cc: John Ogness <john.ogness@linutronix.de >
Reported-by: Vijay Balakrishna <vijayb@linux.microsoft.com >
Link: https://lore.kernel.org/lkml/d8bb1ec7-a4c5-43a2-9de0-9643a70b899f@linux.microsoft.com/
Fixes: b6cf8b3f33 ("printk: add lockless ringbuffer")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org >
Tested-by: Vijay Balakrishna <vijayb@linux.microsoft.com >
Tested-by: Guilherme G. Piccoli <gpiccoli@igalia.com > # Steam Deck
Reviewed-by: Tyler Hicks (Microsoft) <code@tyhicks.com >
Tested-by: Tyler Hicks (Microsoft) <code@tyhicks.com >
Reviewed-by: John Ogness <john.ogness@linutronix.de >
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org >
Reviewed-by: Petr Mladek <pmladek@suse.com >
Signed-off-by: Petr Mladek <pmladek@suse.com >
Link: https://lore.kernel.org/r/20230811054528.never.165-kees@kernel.org
Signed-off-by: Enlin Mu <enlin.mu@unisoc.com >
2023-09-13 11:43:36 +00:00
zhengtangquan
7579b22626
ANDROID: GKI: Add symbols to symbol list for oplus
...
1 variable symbol(s) added
'struct tracepoint __tracepoint_android_vh_killed_process'
1 variable symbol(s) added
'struct tracepoint __tracepoint_android_vh_killed_process'
Bug: 232062955
Change-Id: I8ae3cdd8f8b7a953d76349d3299b6b9b87ab8707
Signed-off-by: Tangquan Zheng <zhengtangquan@oppo.com >
2023-09-13 00:04:10 +00:00
zhengtangquan
6e5f182128
ANDROID: signal: Add vendor hook for memory reap
...
Add vendor hook to determine if the memory of a process
that received the SIGKILL can be reaped.
Partial cherry-pick of aosp/1724512 & aosp/2093626.
Bug: 232062955
Change-Id: I75072bd264df33caff67d083821ee6f33ca83af9
Signed-off-by: Tangquan Zheng <zhengtangquan@oppo.com >
2023-09-13 00:04:10 +00:00
Charan Teja Kalla
3a51a61927
ANDROID: abi_gki_aarch64_qcom: white list symbols for mglru overshoot
...
Whitelist the below symbols that can be used to decide if overshooting
of kswapd reclaim is allowed.
Symbols added:
__traceiter_android_vh_scan_abort_check_wmarks
__tracepoint_android_vh_scan_abort_check_wmarks
Bug: 224956008
Change-Id: I185a570b345d2db0a1426075faa4d9c6325fb0e8
Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com >
Signed-off-by: Kalesh Singh <kaleshsingh@google.com >
2023-09-12 23:08:17 +00:00
Kalesh Singh
0500235e3f
ANDROID: vendor_hook: Add vendor hook to decide scan abort policy
...
Allow vendor hook to enable checking of the high water marks to
decide if reclaim should continue scanning.
Bug: 224956008
Change-Id: I63fe1fd386e7599451c2df0a04c8440b4fc142fc
Signed-off-by: Kalesh Singh <kaleshsingh@google.com >
2023-09-12 23:08:17 +00:00
Kuniyuki Iwashima
e6ed59127c
UPSTREAM: af_unix: Fix null-ptr-deref in unix_stream_sendpage().
...
Bing-Jhong Billy Jheng reported null-ptr-deref in unix_stream_sendpage()
with detailed analysis and a nice repro.
unix_stream_sendpage() tries to add data to the last skb in the peer's
recv queue without locking the queue.
If the peer's FD is passed to another socket and the socket's FD is
passed to the peer, there is a loop between them. If we close both
sockets without receiving FD, the sockets will be cleaned up by garbage
collection.
The garbage collection iterates such sockets and unlinks skb with
FD from the socket's receive queue under the queue's lock.
So, there is a race where unix_stream_sendpage() could access an skb
locklessly that is being released by garbage collection, resulting in
use-after-free.
To avoid the issue, unix_stream_sendpage() must lock the peer's recv
queue.
Note the issue does not exist in 6.5+ thanks to the recent sendpage()
refactoring.
This patch is originally written by Linus Torvalds.
BUG: unable to handle page fault for address: ffff988004dd6870
PF: supervisor read access in kernel mode
PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
PREEMPT SMP PTI
CPU: 4 PID: 297 Comm: garbage_uaf Not tainted 6.1.46 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
RIP: 0010:kmem_cache_alloc_node+0xa2/0x1e0
Code: c0 0f 84 32 01 00 00 41 83 fd ff 74 10 48 8b 00 48 c1 e8 3a 41 39 c5 0f 85 1c 01 00 00 41 8b 44 24 28 49 8b 3c 24 48 8d 4a 40 <49> 8b 1c 06 4c 89 f0 65 48 0f c7 0f 0f 94 c0 84 c0 74 a1 41 8b 44
RSP: 0018:ffffc9000079fac0 EFLAGS: 00000246
RAX: 0000000000000070 RBX: 0000000000000005 RCX: 000000000001a284
RDX: 000000000001a244 RSI: 0000000000400cc0 RDI: 000000000002eee0
RBP: 0000000000400cc0 R08: 0000000000400cc0 R09: 0000000000000003
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888003970f00
R13: 00000000ffffffff R14: ffff988004dd6800 R15: 00000000000000e8
FS: 00007f174d6f3600(0000) GS:ffff88807db00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff988004dd6870 CR3: 00000000092be000 CR4: 00000000007506e0
PKRU: 55555554
Call Trace:
<TASK>
? __die_body.cold+0x1a/0x1f
? page_fault_oops+0xa9/0x1e0
? fixup_exception+0x1d/0x310
? exc_page_fault+0xa8/0x150
? asm_exc_page_fault+0x22/0x30
? kmem_cache_alloc_node+0xa2/0x1e0
? __alloc_skb+0x16c/0x1e0
__alloc_skb+0x16c/0x1e0
alloc_skb_with_frags+0x48/0x1e0
sock_alloc_send_pskb+0x234/0x270
unix_stream_sendmsg+0x1f5/0x690
sock_sendmsg+0x5d/0x60
____sys_sendmsg+0x210/0x260
___sys_sendmsg+0x83/0xd0
? kmem_cache_alloc+0xc6/0x1c0
? avc_disable+0x20/0x20
? percpu_counter_add_batch+0x53/0xc0
? alloc_empty_file+0x5d/0xb0
? alloc_file+0x91/0x170
? alloc_file_pseudo+0x94/0x100
? __fget_light+0x9f/0x120
__sys_sendmsg+0x54/0xa0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x69/0xd3
RIP: 0033:0x7f174d639a7d
Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 8a c1 f4 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 de c1 f4 ff 48
RSP: 002b:00007ffcb563ea50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f174d639a7d
RDX: 0000000000000000 RSI: 00007ffcb563eab0 RDI: 0000000000000007
RBP: 00007ffcb563eb10 R08: 0000000000000000 R09: 00000000ffffffff
R10: 00000000004040a0 R11: 0000000000000293 R12: 00007ffcb563ec28
R13: 0000000000401398 R14: 0000000000403e00 R15: 00007f174d72c000
</TASK>
Bug: 299922588
Fixes: 869e7c6248 ("net: af_unix: implement stream sendpage support")
Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg >
Reviewed-by: Bing-Jhong Billy Jheng <billy@starlabs.sg >
Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
(cherry picked from commit 790c2f9d15 )
Signed-off-by: Lee Jones <joneslee@google.com >
Change-Id: Ied4a40e6ae0e594ef84f36287bc6194602935585
2023-09-12 15:01:22 +01:00
Peter Wang
2eb5b31ac1
FROMLIST: ufs: core: fix abnormal scale up after last cmd finish
...
When ufshcd_clk_scaling_suspend_work(Thread A) running and new command
coming, ufshcd_clk_scaling_start_busy(Thread B) may get host_lock
after Thread A first time release host_lock. Then Thread A second time
get host_lock will set clk_scaling.window_start_t = 0 which scale up
clock abnormal next polling_ms time.
Also inlines another __ufshcd_suspend_clkscaling calls.
Below is racing step:
1 hba->clk_scaling.suspend_work (Thread A)
ufshcd_clk_scaling_suspend_work
2 spin_lock_irqsave(hba->host->host_lock, irq_flags);
3 hba->clk_scaling.is_suspended = true;
4 spin_unlock_irqrestore(hba->host->host_lock, irq_flags);
__ufshcd_suspend_clkscaling
7 spin_lock_irqsave(hba->host->host_lock, flags);
8 hba->clk_scaling.window_start_t = 0;
9 spin_unlock_irqrestore(hba->host->host_lock, flags);
ufshcd_send_command (Thread B)
ufshcd_clk_scaling_start_busy
5 spin_lock_irqsave(hba->host->host_lock, flags);
....
6 spin_unlock_irqrestore(hba->host->host_lock, flags);
Bug: 298004596
Link: https://lore.kernel.org/all/20230831130826.5592-3-peter.wang@mediatek.com/
Change-Id: Ib208b1265107769005c4ae3f72d46b12c072b5c7
Signed-off-by: Peter Wang <peter.wang@mediatek.com >
2023-09-11 20:28:25 +00:00
Peter Wang
89434cbd2d
FROMLIST: ufs: core: fix abnormal scale up after scale down
...
When no active_reqs, devfreq_monitor(Thread A) will suspend clock scaling.
But it may have racing with clk_scaling.suspend_work(Thread B) and
actually not suspend clock scaling(requue after suspend).
Next time after polling_ms, devfreq_monitor read
clk_scaling.window_start_t = 0 then scale up clock abnormal.
Below is racing step:
devfreq->work (Thread A)
devfreq_monitor
update_devfreq
.....
ufshcd_devfreq_target
queue_work(hba->clk_scaling.workq,
1 &hba->clk_scaling.suspend_work)
.....
5 queue_delayed_work(devfreq_wq, &devfreq->work,
msecs_to_jiffies(devfreq->profile->polling_ms));
2 hba->clk_scaling.suspend_work (Thread B)
ufshcd_clk_scaling_suspend_work
__ufshcd_suspend_clkscaling
devfreq_suspend_device(hba->devfreq);
3 cancel_delayed_work_sync(&devfreq->work);
4 hba->clk_scaling.window_start_t = 0;
.....
Bug: 298004596
Link: https://lore.kernel.org/all/20230831130826.5592-4-peter.wang@mediatek.com/
Change-Id: I3ea77255f1b3845e9dd7bf6b050f3e9ba1f5f3f2
Signed-off-by: Peter Wang <peter.wang@mediatek.com >
2023-09-11 20:28:25 +00:00
Peter Wang
e490b62fed
FROMLIST: ufs: core: only suspend clock scaling if scale down
...
If clock scale up and suspend clock scaling, ufs will keep high
performance/power mode but no read/write requests on going.
It is logic wrong and have power concern.
Bug: 298004596
Link: https://lore.kernel.org/all/20230831130826.5592-2-peter.wang@mediatek.com/
Change-Id: I950ec28a506d7eb83c575d9bd482c41869e73848
Signed-off-by: Peter Wang <peter.wang@mediatek.com >
2023-09-11 20:28:25 +00:00
Suren Baghdasaryan
3ffb038098
ANDROID: GKI: update ABI definition
...
Regenerate ABU definition file to resolve ABI breakage caused by a
private struct zs_pool:
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: type 'struct zs_pool' changed
member 'atomic_t compaction_in_progress' was added
Bug: 296365608
Change-Id: I477b6dbbdaf464b2fdf3e666b9696f1a79095a63
Signed-off-by: Suren Baghdasaryan <surenb@google.com >
2023-09-11 17:21:03 +00:00
Sergey Senozhatsky
e2fa9ebcae
UPSTREAM: zsmalloc: allow only one active pool compaction context
...
zsmalloc pool can be compacted concurrently by many contexts,
e.g.
cc1 handle_mm_fault()
do_anonymous_page()
__alloc_pages_slowpath()
try_to_free_pages()
do_try_to_free_pages(
lru_gen_shrink_node()
shrink_slab()
do_shrink_slab()
zs_shrinker_scan()
zs_compact()
Pool compaction is currently (basically) single-threaded as
it is performed under pool->lock. Having multiple compaction
threads results in unnecessary contention, as each thread
competes for pool->lock. This, in turn, affects all zsmalloc
operations such as zs_malloc(), zs_map_object(), zs_free(), etc.
Introduce the pool->compaction_in_progress atomic variable,
which ensures that only one compaction context can run at a
time. This reduces overall pool->lock contention in (corner)
cases when many contexts attempt to shrink zspool simultaneously.
Link: https://lkml.kernel.org/r/20230418074639.1903197-1-senozhatsky@chromium.org
Fixes: c0547d0b6a ("zsmalloc: consolidate zs_pool's migrate_lock and size_class's locks")
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org >
Reviewed-by: Yosry Ahmed <yosryahmed@google.com >
Cc: Minchan Kim <minchan@kernel.org >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
(cherry picked from commit cb440cecb2 )
Bug: 296365608
Change-Id: Ic7878e08c3484ade8c766d051a8f17cc8179eedf
Signed-off-by: Suren Baghdasaryan <surenb@google.com >
2023-09-11 17:20:54 +00:00
Aaro Mäkinen
478ec4dbea
ANDROID: GKI: Update Tuxera symbol list
...
This list covers Microsoft exFAT by Tuxera and Microsoft NTFS by Tuxera file
system drivers.
INFO: 118 function symbol(s) added
'void __bforget(struct buffer_head*)'
'void __bh_read_batch(int, struct buffer_head**, blk_opf_t, bool)'
'ssize_t __blockdev_direct_IO(struct kiocb*, struct inode*, struct block_device*, struct iov_iter*, get_block_t*, dio_iodone_t*, dio_submit_t*, int)'
'struct buffer_head* __bread_gfp(struct block_device*, sector_t, unsigned int, gfp_t)'
'void __breadahead(struct block_device*, sector_t, unsigned int)'
'void __brelse(struct buffer_head*)'
'void __filemap_set_wb_err(struct address_space*, int)'
'struct folio* __folio_alloc(gfp_t, unsigned int, int, nodemask_t*)'
'void __folio_cancel_dirty(struct folio*)'
'void __insert_inode_hash(struct inode*, unsigned long)'
'void __mark_inode_dirty(struct inode*, int)'
'void __remove_inode_hash(struct inode*)'
'int __set_page_dirty_nobuffers(struct page*)'
'int __sync_dirty_buffer(struct buffer_head*, blk_opf_t)'
'void _trace_android_vh_record_pcpu_rwsem_time_early(unsigned long, struct percpu_rw_semaphore*)'
'struct wait_queue_head* bit_waitqueue(void*, int)'
'int blkdev_issue_discard(struct block_device*, sector_t, sector_t, gfp_t)'
'bool block_dirty_folio(struct address_space*, struct folio*)'
'void block_invalidate_folio(struct folio*, size_t, size_t)'
'bool block_is_partially_uptodate(struct folio*, size_t, size_t)'
'int buffer_migrate_folio(struct address_space*, struct folio*, struct folio*, enum migrate_mode)'
'bool capable_wrt_inode_uidgid(struct user_namespace*, const struct inode*, int)'
'void clean_bdev_aliases(struct block_device*, sector_t, sector_t)'
'void clear_inode(struct inode*)'
'bool clear_page_dirty_for_io(struct page*)'
'size_t copy_page_from_iter_atomic(struct page*, unsigned int, size_t, struct iov_iter*)'
'void create_empty_buffers(struct page*, unsigned long, unsigned long)'
'int current_umask()'
'struct dentry* d_add_ci(struct dentry*, struct inode*, struct qstr*)'
'void d_instantiate(struct dentry*, struct inode*)'
'struct dentry* d_obtain_alias(struct inode*)'
'struct dentry* d_splice_alias(struct inode*, struct dentry*)'
'int down_write_trylock(struct rw_semaphore*)'
'void drop_nlink(struct inode*)'
'void end_buffer_write_sync(struct buffer_head*, int)'
'void end_page_writeback(struct page*)'
'errseq_t errseq_set(errseq_t*, int)'
'size_t fault_in_iov_iter_readable(const struct iov_iter*, size_t)'
'size_t fault_in_safe_writeable(const char*, size_t)'
'int fiemap_fill_next_extent(struct fiemap_extent_info*, u64, u64, u64, u32)'
'int fiemap_prep(struct inode*, struct fiemap_extent_info*, u64, u64*, u32)'
'int file_check_and_advance_wb_err(struct file*)'
'int file_remove_privs(struct file*)'
'int file_update_time(struct file*)'
'bool filemap_dirty_folio(struct address_space*, struct folio*)'
'vm_fault_t filemap_fault(struct vm_fault*)'
'int filemap_fdatawait_range(struct address_space*, loff_t, loff_t)'
'int filemap_fdatawrite(struct address_space*)'
'int filemap_fdatawrite_range(struct address_space*, loff_t, loff_t)'
'int filemap_flush(struct address_space*)'
'int filemap_write_and_wait_range(struct address_space*, loff_t, loff_t)'
'int folio_write_one(struct folio*)'
'int generic_error_remove_page(struct address_space*, struct page*)'
'ssize_t generic_file_direct_write(struct kiocb*, struct iov_iter*)'
'int generic_file_mmap(struct file*, struct vm_area_struct*)'
'int generic_file_open(struct inode*, struct file*)'
'ssize_t generic_file_splice_read(struct file*, loff_t*, struct pipe_inode_info*, size_t, unsigned int)'
'void generic_fillattr(struct user_namespace*, struct inode*, struct kstat*)'
'ssize_t generic_read_dir(struct file*, char*, size_t, loff_t*)'
'struct page* grab_cache_page_write_begin(struct address_space*, unsigned long)'
'struct inode* iget5_locked(struct super_block*, unsigned long, int(*)(struct inode*, void*), int(*)(struct inode*, void*), void*)'
'struct inode* igrab(struct inode*)'
'void ihold(struct inode*)'
'struct inode* ilookup5(struct super_block*, unsigned long, int(*)(struct inode*, void*), void*)'
'int in_group_p(kgid_t)'
'void inc_nlink(struct inode*)'
'void init_special_inode(struct inode*, umode_t, dev_t)'
'void inode_dio_wait(struct inode*)'
'void inode_init_once(struct inode*)'
'void inode_init_owner(struct user_namespace*, struct inode*, const struct inode*, umode_t)'
'bool inode_maybe_inc_iversion(struct inode*, bool)'
'int inode_newsize_ok(const struct inode*, loff_t)'
'void inode_set_flags(struct inode*, unsigned int, unsigned int)'
'void invalidate_bdev(struct block_device*)'
'unsigned long iov_iter_alignment(const struct iov_iter*)'
'ssize_t iov_iter_get_pages2(struct iov_iter*, struct page**, size_t, unsigned int, size_t*)'
'size_t iov_iter_single_seg_count(const struct iov_iter*)'
'bool is_bad_inode(struct inode*)'
'ssize_t iter_file_splice_write(struct pipe_inode_info*, struct file*, loff_t*, size_t, unsigned int)'
'ino_t iunique(struct super_block*, ino_t)'
'void kill_block_super(struct super_block*)'
'void* kmem_cache_alloc_lru(struct kmem_cache*, struct list_lru*, gfp_t)'
'struct nls_table* load_nls(char*)'
'struct nls_table* load_nls_default()'
'void make_bad_inode(struct inode*)'
'void mark_buffer_async_write(struct buffer_head*)'
'void mark_buffer_dirty(struct buffer_head*)'
'void mark_buffer_write_io_error(struct buffer_head*)'
'struct dentry* mount_bdev(struct file_system_type*, int, const char*, void*, int(*)(struct super_block*, void*, int))'
'int mpage_read_folio(struct folio*, get_block_t*)'
'void mpage_readahead(struct readahead_control*, get_block_t*)'
'int notify_change(struct user_namespace*, struct dentry*, struct iattr*, struct inode**)'
'unsigned long page_cache_next_miss(struct address_space*, unsigned long, unsigned long)'
'unsigned long page_cache_prev_miss(struct address_space*, unsigned long, unsigned long)'
'void page_zero_new_buffers(struct page*, unsigned int, unsigned int)'
'struct page* pagecache_get_page(struct address_space*, unsigned long, int, gfp_t)'
'unsigned int pagevec_lookup_range_tag(struct pagevec*, struct address_space*, unsigned long*, unsigned long, xa_mark_t)'
'bool redirty_page_for_writepage(struct writeback_control*, struct page*)'
'int sb_min_blocksize(struct super_block*, int)'
'int sb_set_blocksize(struct super_block*, int)'
'int security_inode_init_security(struct inode*, struct inode*, const struct qstr*, initxattrs, void*)'
'void set_nlink(struct inode*, unsigned int)'
'bool set_page_writeback(struct page*)'
'int setattr_prepare(struct user_namespace*, struct dentry*, struct iattr*)'
'int sync_dirty_buffer(struct buffer_head*)'
'int sync_inode_metadata(struct inode*, int)'
'void tag_pages_for_writeback(struct address_space*, unsigned long, unsigned long)'
'struct timespec64 timestamp_truncate(struct timespec64, struct inode*)'
'void touch_atime(const struct path*)'
'void truncate_inode_pages(struct address_space*, loff_t)'
'void truncate_inode_pages_final(struct address_space*)'
'void truncate_pagecache(struct inode*, loff_t)'
'void truncate_setsize(struct inode*, loff_t)'
'void try_to_writeback_inodes_sb(struct super_block*, enum wb_reason)'
'void unload_nls(struct nls_table*)'
'void unlock_new_inode(struct inode*)'
'int wake_bit_function(struct wait_queue_entry*, unsigned int, int, void*)'
'int write_inode_now(struct inode*, int)'
Bug: 299833811
Change-Id: I51ae5f4b02bab32a913b95b16ab5625ba41458f5
Signed-off-by: Aaro Mäkinen <aaro@tuxera.com >
2023-09-11 16:07:12 +03:00
Prathu Baronia
cd94fe67fd
ANDROID: ABI: Update symbols to qcom whitelist
...
Update whitelist for the symbols used by qcom socs in
abi_gki_aarch64_qcom.
1 function symbol(s) added
'vhost_dev_flush'
Bug: 299585715
Change-Id: I403394331953c9cfee54b4b0c2a0365a3df5f0af
Signed-off-by: Prathu Baronia <quic_pbaronia@quicinc.com >
Signed-off-by: Aleksei Vetrov <vvvvvv@google.com >
2023-09-08 19:29:53 +00:00
RD Babiera
68eefde2d3
UPSTREAM: usb: typec: tcpm: set initial svdm version based on pd revision
...
When sending Discover Identity messages to a Port Partner that uses Power
Delivery v2 and SVDM v1, we currently send PD v2 messages with SVDM v2.0,
expecting the port partner to respond with its highest supported SVDM
version as stated in Section 6.4.4.2.3 in the Power Delivery v3
specification. However, sending SVDM v2 to some Power Delivery v2 port
partners results in a NAK whereas sending SVDM v1 does not.
NAK messages can be handled by the initiator (PD v3 section 6.4.4.2.5.1),
and one solution could be to resend Discover Identity on a lower SVDM
version if possible. But, Section 6.4.4.3 of PD v2 states that "A NAK
response Should be taken as an indication not to retry that particular
Command."
Instead, we can set the SVDM version to the maximum one supported by the
negotiated PD revision. When operating in PD v2, this obeys Section
6.4.4.2.3, which states the SVDM field "Shall be set to zero to indicate
Version 1.0." In PD v3, the SVDM field "Shall be set to 01b to indicate
Version 2.0."
Fixes: c34e85fa69 ("usb: typec: tcpm: Send DISCOVER_IDENTITY from dedicated work")
Cc: stable@vger.kernel.org
Signed-off-by: RD Babiera <rdbabiera@google.com >
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com >
Link: https://lore.kernel.org/r/20230731165926.1815338-1-rdbabiera@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
Bug: 289437937
(cherry picked from commit c97cd0b4b5 )
Signed-off-by: RD Babiera <rdbabiera@google.com >
(cherry picked from https://android-review.googlesource.com/q/commit:d02aef1ae51a03b9ab20c8e01ed32593a7ffc6fc )
Merged-In: Ie919c29bab68cb08cb659471ff6106bae502c8dd
Change-Id: Ie919c29bab68cb08cb659471ff6106bae502c8dd
2023-09-08 19:24:11 +00:00
Mostafa Saleh
a68bd01493
ANDROID: KVM: arm64: Don't update IOMMUs for share/unshare
...
Share/unshare initiated by host doesn't change memory permission, and
as currently pKVM doesn't support device assignment, there is no need
to update the IOMMU unnecessarily as it waste cycles.
Once device assignment is enabled, this assumption will not be valid
as guests have access to DMA.
Bug: 291843613
Change-Id: I28c69ec8f721711d5b59fa2784386fa61654fe5a
Signed-off-by: Mostafa Saleh <smostafa@google.com >
2023-09-08 11:45:45 +00:00
Qais Yousef
20ecb229c5
ANDROID: cpuidle: teo: Export a function that allows modifying util_threshold
...
There are some corner cases where we do worse in power because the
threshold is too low. Until these cases are better understood and
addressed upstream, provide a function for vendors to override this
value with something more suitable in their modules.
Bug: 289293494
Signed-off-by: Qais Yousef <qyousef@google.com >
Change-Id: I95dd36718a317f3fcb2a9f4bc87dd3390a4f7d7d
2023-09-08 03:14:00 +00:00
Rick Yiu
2490ab50e7
ANDROID: sched: Add vendor hook for rt util update
...
Vendor may have need to track rt util.
Bug: 201261299
Signed-off-by: Rick Yiu <rickyiu@google.com >
Change-Id: I2f4e5142c6bc8574ee3558042e1fb0dae13b702d
2023-09-08 03:14:00 +00:00
Rick Yiu
6d97f75abc
ANDROID: sched: Add vendor hook for util-update related functions
...
Vendor may have the need to implement their own util tracking.
Bug: 297343949
Signed-off-by: Rick Yiu <rickyiu@google.com >
Change-Id: I973902e6ff82a85ecd029ac5a78692d629df1ebe
2023-09-08 03:14:00 +00:00
Wei Wang
e08c5de06e
ANDROID: sched: Add vendor hooks for override sugov behavior
...
Upstream moved the sugov to DEADLINE class which has higher prio than RT
so it can potentially block many RT use case in Android.
Also currently iowait doesn't distinguish background/foreground tasks
and we have seen cases where device run to high frequency unnecessarily
when running some background I/O.
Bug: 297343949
Signed-off-by: Wei Wang <wvw@google.com >
Change-Id: I21e9bfe9ef75a4178279574389e417c3f38e65ac
2023-09-08 03:14:00 +00:00
Qais Yousef
5762974151
ANDROID: Add new hook to enable overriding uclamp_validate()
...
We want to add more special values, specifically for uclamp_max so that
it can be set automatically to the most efficient value based on the
core it's running on.
Bug: 297343949
Signed-off-by: Qais Yousef <qyousef@google.com >
Change-Id: I57343c4544f6cac621c855cbb94de0b8d80c51fa
2023-09-08 03:14:00 +00:00
Qais Yousef
b57e3c1d99
ANDROID: sched/uclamp: Don't enable uclamp_is_used static key by in-kernel requests
...
We do have now in-kernel users of uclamp to implement inheritance. The
static_branch_enable() path unconditionally holds the cpus_read_lock()
which might_sleep(). The path in binder that implements inheritance
happens from in_atomic() context which leads to a splat like this one:
[ 147.529960] BUG: sleeping function called from invalid context at include/linux/percpu-rwsem.h:56
[ 147.530196] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2586, name: RenderThread
[ 147.530410] INFO: lockdep is turned off.
[ 147.530518] Preemption disabled at:
[ 147.530521] [<ffffffc008ca2cec>] binder_proc_transaction+0x78/0x41c
[ 147.530793] CPU: 8 PID: 2586 Comm: RenderThread Tainted: G S W O 5.15.76-android14-5-00086-gc01afe5d262f #1
[ 147.531214] Call trace:
[ 147.531288] dump_backtrace+0xe8/0x134
[ 147.531444] show_stack+0x1c/0x4c
[ 147.531598] dump_stack_lvl+0x74/0x94
[ 147.531766] dump_stack+0x14/0x3c
[ 147.531920] ___might_sleep+0x210/0x230
[ 147.532094] __might_sleep+0x54/0x84
[ 147.532259] cpus_read_lock+0x2c/0x160
[ 147.532429] static_key_enable+0x1c/0x34
[ 147.532608] __sched_setscheduler+0x2a8/0x99c
[ 147.532802] sched_setattr_nocheck+0x1c/0x24
[ 147.532994] binder_do_set_priority+0x31c/0x4a4
[ 147.533195] binder_transaction_priority+0x200/0x3f4
[ 147.533413] binder_proc_transaction+0x220/0x41c
[ 147.533618] binder_transaction+0x1df0/0x234c
[ 147.533812] binder_thread_write+0xd84/0x2398
[ 147.534007] binder_ioctl_write_read+0x19c/0xb28
[ 147.534212] binder_ioctl+0x344/0x1a3c
[ 147.534382] __arm64_sys_ioctl+0x94/0xc8
[ 147.534561] invoke_syscall+0x44/0xf8
[ 147.534729] el0_svc_common+0xc8/0x10c
[ 147.534900] do_el0_svc+0x20/0x28
[ 147.535053] el0_svc+0x58/0xe0
[ 147.535198] el0t_64_sync_handler+0x7c/0xe4
[ 147.535386] el0t_64_sync+0x188/0x18c
Prevent enabling the lock for !user initiated sched_setattr()
operations. Generally we don't expect in-kernel uclamp users.
Bug: 259145692
Signed-off-by: Qais Yousef <qyousef@google.com >
Change-Id: Iac5be139b5ffd39f5e1c0431ce253133d81b98cf
2023-09-08 03:14:00 +00:00
Rick Yiu
2b25d535d0
ANDROID: topology: Add vendor hook for use_amu_fie
...
Vendors could decide to use amu fie feature or not, such as if they
have some feature that needs amu fie to be disabled.
Bug: 297343949
Change-Id: I6b44ee899c58e7d5a8b2db03a30e3ab14b08f101
Signed-off-by: Rick Yiu <rickyiu@google.com >
2023-09-08 03:14:00 +00:00
Rick Yiu
eb9686932b
ANDROID: sched: Export symbols needed for vendor hooks
...
Bug: 297343949
Change-Id: I0cb65e85b36687bfaae6a185ca373d7fb8de0a77
Signed-off-by: Rick Yiu <rickyiu@google.com >
2023-09-08 03:14:00 +00:00
Bumyong Lee
84131c988b
ANDROID: Update symbol list for Exynos Auto SoCs
...
Update symbol list for Exynos Auto SoCs
Bug: 299219798
Signed-off-by: Bumyong Lee <bumyong.lee@samsung.com >
Change-Id: I2a6a58cdfceb28186ee6a5778ce78e872d06c04f
2023-09-06 19:23:23 +00:00
Florian Westphal
3367abadff
UPSTREAM: netfilter: nf_tables: deactivate catchall elements in next generation
...
[ Upstream commit 90e5b3462e ]
When flushing, individual set elements are disabled in the next
generation via the ->flush callback.
Catchall elements are not disabled. This is incorrect and may lead to
double-deactivations of catchall elements which then results in memory
leaks:
WARNING: CPU: 1 PID: 3300 at include/net/netfilter/nf_tables.h:1172 nft_map_deactivate+0x549/0x730
CPU: 1 PID: 3300 Comm: nft Not tainted 6.5.0-rc5+ #60
RIP: 0010:nft_map_deactivate+0x549/0x730
[..]
? nft_map_deactivate+0x549/0x730
nf_tables_delset+0xb66/0xeb0
(the warn is due to nft_use_dec() detecting underflow).
Bug: 298710879
Fixes: aaa31047a6 ("netfilter: nftables: add catch-all set element support")
Reported-by: lonial con <kongln9170@gmail.com >
Signed-off-by: Florian Westphal <fw@strlen.de >
Signed-off-by: Sasha Levin <sashal@kernel.org >
(cherry picked from commit 00ea7eb1c6 )
Signed-off-by: Lee Jones <joneslee@google.com >
Change-Id: I870613042789da3ab44f5f34a240f5dc8c4b25a2
2023-09-06 17:06:09 +00:00