Commit Graph

1068544 Commits

Author SHA1 Message Date
Pavankumar Kondeti
734865de30 FROMGIT: mm/madvise: fix madvise_pageout for private file mappings
When MADV_PAGEOUT is called on a private file mapping VMA region,
we bail out early if the process is neither owner nor write capable
of the file. However, this VMA may have both private/shared clean
pages and private dirty pages. The opportunity of paging out the
private dirty pages (Anon pages) is missed. Fix this by caching
the file access check and use it later along with PageAnon() during
page walk.

We observe ~10% improvement in zram usage, thus leaving more available
memory on a 4GB RAM system running Android.

Link: https://lkml.kernel.org/r/1667971116-12900-1-git-send-email-quic_pkondeti@quicinc.com
Signed-off-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
Cc: Charan Teja Kalla <quic_charante@quicinc.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 8fc5be8efc3cf356f25098fbd4bda7c0e949c2ea
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable)

Bug: 259329159
Signed-off-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
Change-Id: I5f2d425aec94e5a75ebeaf90f9f5d7adf1975c59
(cherry picked from commit 979df868f594e76a36a7a9523991cdc5b5f99a14)
2023-10-17 20:20:03 +00:00
Wander Lairson Costa
4e664ccbea UPSTREAM: netfilter: xt_u32: validate user space input
commit 69c5d284f6 upstream.

The xt_u32 module doesn't validate the fields in the xt_u32 structure.
An attacker may take advantage of this to trigger an OOB read by setting
the size fields with a value beyond the arrays boundaries.

Add a checkentry function to validate the structure.

This was originally reported by the ZDI project (ZDI-CAN-18408).

Bug: 304913716
Fixes: 1b50b8a371 ("[NETFILTER]: Add u32 match")
Cc: stable@vger.kernel.org
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 1c164c1e9e)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ic2ff70b303f55f9c3c5db24295bcb223ed7175a7
2023-10-17 17:35:11 +00:00
Wander Lairson Costa
a114e5dca4 UPSTREAM: netfilter: nfnetlink_osf: avoid OOB read
[ Upstream commit f4f8a78031 ]

The opt_num field is controlled by user mode and is not currently
validated inside the kernel. An attacker can take advantage of this to
trigger an OOB read and potentially leak information.

BUG: KASAN: slab-out-of-bounds in nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88
Read of size 2 at addr ffff88804bc64272 by task poc/6431

CPU: 1 PID: 6431 Comm: poc Not tainted 6.0.0-rc4 #1
Call Trace:
 nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88
 nf_osf_find+0x186/0x2f0 net/netfilter/nfnetlink_osf.c:281
 nft_osf_eval+0x37f/0x590 net/netfilter/nft_osf.c:47
 expr_call_ops_eval net/netfilter/nf_tables_core.c:214
 nft_do_chain+0x2b0/0x1490 net/netfilter/nf_tables_core.c:264
 nft_do_chain_ipv4+0x17c/0x1f0 net/netfilter/nft_chain_filter.c:23
 [..]

Also add validation to genre, subtype and version fields.

Bug: 304913642
Fixes: 11eeef41d5 ("netfilter: passive OS fingerprint xtables match")
Reported-by: Lucas Leong <wmliang@infosec.exchange>
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 7bb8d52b42)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If79c79e3f55de8c81b70c19661cb0084b02c3da2
2023-10-17 13:48:18 +01:00
Jamal Hadi Salim
fae3eccae9 UPSTREAM: net/sched: Retire rsvp classifier
commit 265b4da82d upstream.

The rsvp classifier has served us well for about a quarter of a century but has
has not been getting much maintenance attention due to lack of known users.

Bug: 304913975
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 08569c92f7)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I4716954c5e8d5414a580eb34c699908028aa754b
2023-10-17 12:06:26 +00:00
Kyle Zeng
002ad09f12 UPSTREAM: ipv4: fix null-deref in ipv4_link_failure
[ Upstream commit 0113d9c9d1 ]

Currently, we assume the skb is associated with a device before calling
__ip_options_compile, which is not always the case if it is re-routed by
ipvs.
When skb->dev is NULL, dev_net(skb->dev) will become null-dereference.
This patch adds a check for the edge case and switch to use the net_device
from the rtable when skb->dev is NULL.

Bug: 304913674
Fixes: ed0de45a10 ("ipv4: recompile ip options in ipv4_link_failure")
Suggested-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
Cc: Stephen Suryaputra <ssuryaextr@gmail.com>
Cc: Vadim Fedorenko <vfedorenko@novek.ru>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 2712545e53)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ie840ff3351e487f7095c49fac4fdd1e81021a982
2023-10-17 10:29:04 +01:00
Bart Van Assche
bfeb57ae95 FROMGIT: scsi: ufs: Set the CP flag for RT requests
Make the UFS device execute realtime (RT) requests before other requests.
This will be used in Android to reduce the I/O latency of the foreground
app.

Change-Id: Ia8fa42517e6f8e11439bd91b2e23762c00845724
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
(cherry picked from commit 00d2fa28da0aa371ad215e92ebf5297c0e7d4861 git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git for-next)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-10-13 09:55:49 -07:00
Bart Van Assche
67d3336282 FROMGIT: scsi: ufs: Simplify ufshcd_comp_scsi_upiu()
ufshcd_comp_scsi_upiu() has one caller and that caller ensures that
lrbp->cmd != NULL. Hence leave out the lrbp->cmd check from
ufshcd_comp_scsi_upiu().

Change-Id: Ic37b0eda0d59c0b7d759a5d352f139cdcffbf163
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
(cherry picked from commit c788cf8a21cd3b12a1823869878e3fd93132859f git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git for-next)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-10-13 09:55:49 -07:00
Bart Van Assche
0b5cd2a4a4 ANDROID: scsi: Limit unaligned zoned write retries
It may happen that zoned writes get reordered and hence that a zoned
device receives these out of order. If that happens, the SCSI error
handler will resubmit the zoned writes in LBA order. Only resubmit
zoned writes if the number of retries has not been exceeded. Otherwise
fail the zoned write.

Bug: 234829282
Change-Id: Ieb0e596df60b05f67d7c54ebd2e700e6c550d6f5
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-10-13 09:55:49 -07:00
Bart Van Assche
f1b91d8b41 ANDROID: block: Preserve the order of requeued zoned writes
blk_mq_process_requeue_list() inserts requeued requests in front of other
requests. This is fine for all request types except for sequential zoned
writes. Hence this patch.

Bug: 234829282
Change-Id: If1f1aece17f425104a936b36db33eab5f9ba5c2d
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-10-13 09:55:49 -07:00
Bart Van Assche
d7f09c11e7 ANDROID: gki_defconfig: Enable CONFIG_BLK_CGROUP_IOPRIO
Prepare for supporting I/O priority in the storage stack.

Bug: 186902601
Change-Id: I387ac4792c89d88d131c5146b116a0393c01b096
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-10-13 09:55:48 -07:00
Qinglin Li
e2dadb5022 ANDROID: GKI: Update symbol list for Amlogic
5 function symbol(s) added
  'int __traceiter_android_vh_free_unref_page_bypass(void*, struct page*, int, int, bool*)'
  'int __traceiter_android_vh_kvmalloc_node_use_vmalloc(void*, size_t, gfp_t*, bool*)'
  'int __traceiter_android_vh_rmqueue_bulk_bypass(void*, unsigned int, struct per_cpu_pages*, int, struct list_head*)'
  'int __traceiter_android_vh_should_alloc_pages_retry(void*, gfp_t, int, int*, int, struct zone*, struct page**, bool*)'
  'int __traceiter_android_vh_unreserve_highatomic_bypass(void*, bool, struct zone*, bool*)'

5 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_free_unref_page_bypass'
  'struct tracepoint __tracepoint_android_vh_kvmalloc_node_use_vmalloc'
  'struct tracepoint __tracepoint_android_vh_rmqueue_bulk_bypass'
  'struct tracepoint __tracepoint_android_vh_should_alloc_pages_retry'
  'struct tracepoint __tracepoint_android_vh_unreserve_highatomic_bypass'

Bug: 304066882
Change-Id: Ic128510f338a1bc2129d749af264144f45d7a173
Signed-off-by: Qinglin Li <qinglin.li@amlogic.corp-partner.google.com>
2023-10-12 17:07:50 +00:00
Oven
5b8c9a002d ANDROID: vendor_hooks: Add hooks to avoid key threads stalled in
memory allocations

We add these hooks to avoid key threads blocked in memory allocation
path.
-android_vh_free_unref_page_bypass  ----We create a memory pool for the
key threads. This hook determines whether a page should be free to the
pool or to buddy freelist. It works with a existing hook
`android_vh_alloc_pages_reclaim_bypass`, which takes pages out of the
pool.

-android_vh_kvmalloc_node_use_vmalloc  ----For key threads, we perfer
not to run into direct reclaim. So we clear __GFP_DIRECT_RECLAIM flag.
For threads which are not that important, we perfer use vmalloc.

-android_vh_should_alloc_pages_retry  ----Before key threads run into
direct reclaim, we want to retry with a lower watermark.

-android_vh_unreserve_highatomic_bypass  ----We want to keep more
highatomic pages when unreserve them to avoid highatomic allocation
failures.

-android_vh_rmqueue_bulk_bypass  ----We found sometimes when key threads
run into rmqueue_bulk,  it took several milliseconds spinning at
zone->lock or filling per-cpu pages. We use this hook to take pages from
the mempool mentioned above,  rather than grab zone->lock and fill a
batch of pages to per-cpu.

Bug: 288216516
Bug: 304066882

Change-Id: I1656032d6819ca627723341987b6094775bc345f
Signed-off-by: Oven <liyangouwen1@oppo.com>
Signed-off-by: Qinglin Li <qinglin.li@amlogic.com>
(cherry picked from commit aa47cc7c206a8e159a735e6f1513ece6dac1e0ba)
2023-10-12 17:07:50 +00:00
Mostafa Saleh
a1ebbe9d5e ANDROID: KVM: arm64: Add missing hyp events for forwarded SMCs
__kvm_hyp_host_forward_smc() forwards SMCs to EL3, which means we
exit and enter the hypervisor without tracing those.
Add missing hyp events.

Bug: 304445720
Change-Id: I0b66c37f1521702764b12c038324c3fec3e499a6
Signed-off-by: Mostafa Saleh <smostafa@google.com>
2023-10-12 10:15:25 +00:00
erinwang
86fb1cdb30 ANDROID: GKI: Update symbol list for lenovo
1 function symbol(s) added
  'void* vmalloc_array(size_t, size_t)'

Bug: 304899645
Change-Id: I0ccff89e100ea4aa132153a67765f94667e47e9c
Signed-off-by: erinwang <erinwang2@lenovo.com>
2023-10-12 08:44:54 +00:00
Fuad Tabba
2c0ad668ff ANDROID: KVM: arm64: Store hyp address in the host fp state array
Store the hyp address in kvm_arm_hyp_host_fp_state[], to avoid having to
calculate it with kern_hyp_va() on every access.

Bug: 303684934
Signed-off-by: Fuad Tabba <tabba@google.com>
Change-Id: I52902c297f9b957a8d035be942e3cbeb32fed0a2
2023-10-12 08:14:09 +00:00
Fuad Tabba
813b98b113 ANDROID: KVM: arm64: Allocate host fp/simd state later in initialization
Allocate and map hyp memory to maintain the host's fp/simd state,
which is also used for SVE and SME, later in the initialization
process. The amount of memory needed to track the host's state
varies depending on the number of cpus in the system, whether
there's SVE support, as well as the SVE vector size. Much of the
state needed to extract this information isn't initialized yet at
kvm_hyp_reserve().

Fixes: 6dc9af85f7 ("ANDROID: KVM: arm64: Allocate host fp state at pkvm init rather than per cpu")
Bug: 303684934
Signed-off-by: Fuad Tabba <tabba@google.com>
Change-Id: I744be685a107ddd92c6975bafb0149aebad7bb55
2023-10-12 08:14:09 +00:00
qinglin.li
f44a014f33 ANDROID: GKI: Update symbol list for Amlogic
1 function symbol(s) added
  'int mmc_gpiod_request_cd(struct mmc_host *host, const char *con_id,
                         unsigned int idx, bool override_active_level,
                         unsigned int debounce)'

Bug: 304416725
Change-Id: I6fe74aa309935c5154425e45145b256df3e6da0b
Signed-off-by: Qinglin Li <qinglin.li@amlogic.com>
2023-10-11 17:34:01 +00:00
Pablo Neira Ayuso
0973d792be UPSTREAM: netfilter: nf_tables: disallow rule removal from chain binding
[ Upstream commit f15f29fd47 ]

Chain binding only requires the rule addition/insertion command within
the same transaction. Removal of rules from chain bindings within the
same transaction makes no sense, userspace does not utilize this
feature. Replace nft_chain_is_bound() check to nft_chain_binding() in
rule deletion commands. Replace command implies a rule deletion, reject
this command too.

Rule flush command can also safely rely on this nft_chain_binding()
check because unbound chains are not allowed since 62e1e94b24
("netfilter: nf_tables: reject unbound chain set before commit phase").

Bug: 302085977
Fixes: d0e2c7de92 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Reported-by: Kevin Rich <kevinrich1337@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 9af8bb2afe)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I8b05dc37062824db4c2901000fdf701b38605d32
2023-10-11 10:14:07 +01:00
Patrick Daly
46a1c28f37 ANDROID: mm: Use intended order-adjusted batch size
Commit 44042b4498 ("mm/page_alloc: allow high-order pages to be stored
on the per-cpu lists") adjusts the pcp batch size __rmqueue_pcplist()
allocates from rmqueue_bulk() in proportion to the page order.

This line was not properly carried forward when porting
commit 37b2d597bb ("ANDROID: mm: add cma pcp list") to android 13-5.15.

Fixes: 37b2d597bb ("ANDROID: mm: add cma pcp list")
Bug: 260129859
Change-Id: I28b7c22c75596176fd951974d1dd682ee1014efb
Signed-off-by: Patrick Daly <quic_pdaly@quicinc.com>
(cherry picked from commit 4931d96eb36e955fe72eee53b1ce834e2894ab5c)
2023-10-09 19:09:13 +00:00
Nikhil V
6e161d9045 ANDROID: mm: cma: proper ret type for tasks interrupted by fatal signal
Currently, cma_alloc() checks if the task has fatal signals pending
and simply bail out without updating return type(defaulting to EBUSY).
Update the return type to EINTR when cma allocation fails due to pending
fatal signals.

Bug: 245880180
Change-Id: Ibcef026a3af3417a5a10e0eae51017f477f6ac0f
Signed-off-by: Nikhil V <quic_nprakash@quicinc.com>
2023-10-09 19:08:50 +00:00
James Tai
cbd1dda137 ANDROID: GKI: Update RTK STB KMI symbol list
5 function symbol(s) added
  'void sdhci_request(struct mmc_host*, struct mmc_request*)'
  'unsigned int cpufreq_generic_get(unsigned int)'
  'unsigned long dev_pm_opp_get_max_transition_latency(struct device*)'
  'int dev_pm_opp_get_sharing_cpus(struct device*, struct cpumask*)'
  'unsigned long dev_pm_opp_get_suspend_opp_freq(struct device*)'

Bug: 303770081
Change-Id: I573865da87487e0bb00b4123d4afb204af43cba6
Signed-off-by: James Tai <james.tai@realtek.com>
2023-10-08 23:25:41 +08:00
Sergey Volk
79ef0ab3a2 ANDROID: Update the ABI symbol list
INFO: 2 function symbol(s) added
  'bool drm_connector_atomic_hdr_metadata_equal(struct drm_connector_state*, struct drm_connector_state*)'
  'int drm_connector_attach_hdr_output_metadata_property(struct drm_connector*)'

Adding the following symbols:
  - debugfs_create_devm_seqfile
  - devm_device_add_group
  - drm_connector_atomic_hdr_metadata_equal
  - drm_connector_attach_hdr_output_metadata_property
  - drm_hdmi_infoframe_set_hdr_metadata
  - hdmi_drm_infoframe_pack_only
  - __traceiter_android_rvh_sched_setaffinity
  - __tracepoint_android_rvh_sched_setaffinity

Bug: 303113760
Change-Id: I476f5fad1eaa340ebec4c8458c8cc1718d0d79f7
Signed-off-by: Sergey Volk <servolk@google.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
2023-10-04 23:29:37 +00:00
James Tai
d15ca4faa6 ANDROID: GKI: Update RTK STB KMI symbol list
2 function symbol(s) added
  'ssize_t drm_scdc_read(struct i2c_adapter*, u8, void*, size_t)'
  'ssize_t drm_scdc_write(struct i2c_adapter*, u8, const void*, size_t)'

Bug: 303339313
Change-Id: I8c4994ad728a19ae4196f956bcb6e7a7e29f01e2
Signed-off-by: James Tai <james.tai@realtek.com>
2023-10-04 15:14:41 +08:00
RD Babiera
63fc189127 BACKPORT: usb: typec: bus: verify partner exists in typec_altmode_attention
Some usb hubs will negotiate DisplayPort Alt mode with the device
but will then negotiate a data role swap after entering the alt
mode. The data role swap causes the device to unregister all alt
modes, however the usb hub will still send Attention messages
even after failing to reregister the Alt Mode. type_altmode_attention
currently does not verify whether or not a device's altmode partner
exists, which results in a NULL pointer error when dereferencing
the typec_altmode and typec_altmode_ops belonging to the altmode
partner.

Verify the presence of a device's altmode partner before sending
the Attention message to the Alt Mode driver.

Fixes: 8a37d87d72 ("usb: typec: Bus type for alternate modes")
Cc: stable@vger.kernel.org
Signed-off-by: RD Babiera <rdbabiera@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20230814180559.923475-1-rdbabiera@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 288952921
(cherry picked from commit f236433064)
[rd: changed return type of typec_altmode_attention to void to not break
 kmi, moved tcpm_log from error return to typec_altmode_attention as
 dev_warn]
Change-Id: I054a6ef56b9b2d7c4e8167e8630a8c277910da88
Signed-off-by: RD Babiera <rdbabiera@google.com>
2023-10-02 22:51:16 +00:00
Patrick Daly
d61f670260 ANDROID: mm/memory_hotplug: Fix error path handling
Correct a resource leak if arch_add_memory() returns failure.

Bug: 243477359
Change-Id: I1dce82a18c2242d7b6fd9fb1fe3a8b2ba67853de
Fixes: 42db6c2e9 ("ANDROID: mm/memory_hotplug: implement {add/remove}_memory_subsection")
Signed-off-by: Patrick Daly <quic_pdaly@quicinc.com>
(cherry picked from commit b337f6e1a90b01e14969c6c37705e548b53e488a)
2023-09-27 17:30:47 +00:00
Johannes Weiner
3207c9ecb1 BACKPORT: mm: page_alloc: fix CMA and HIGHATOMIC landing on the wrong buddy list
Commit 4b23a68f95 ("mm/page_alloc: protect PCP lists with a spinlock")
bypasses the pcplist on lock contention and returns the page directly to
the buddy list of the page's migratetype.

For pages that don't have their own pcplist, such as CMA and HIGHATOMIC,
the migratetype is temporarily updated such that the page can hitch a ride
on the MOVABLE pcplist.  Their true type is later reassessed when flushing
in free_pcppages_bulk().  However, when lock contention is detected after
the type was already overridden, the bypass will then put the page on the
wrong buddy list.

Once on the MOVABLE buddy list, the page becomes eligible for fallbacks
and even stealing.  In the case of HIGHATOMIC, otherwise ineligible
allocations can dip into the highatomic reserves.  In the case of CMA, the
page can be lost from the CMA region permanently.

Use a separate pcpmigratetype variable for the pcplist override.  Use the
original migratetype when going directly to the buddy.  This fixes the bug
and should make the intentions more obvious in the code.

Originally sent here to address the HIGHATOMIC case:
https://lore.kernel.org/lkml/20230821183733.106619-4-hannes@cmpxchg.org/

Changelog updated in response to the CMA-specific bug report.

[mgorman@techsingularity.net: updated changelog]
Link: https://lkml.kernel.org/r/20230911181108.GA104295@cmpxchg.org
Fixes: 4b23a68f95 ("mm/page_alloc: protect PCP lists with a spinlock")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reported-by: Joe Liu <joe.liu@mediatek.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

Bug: 302075941
(cherry picked from commit 7b086755fb)
Change-Id: I5e62c941e0a91db551a56f4b8c1ae14f87fd2bc3
Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com>
2023-09-27 15:46:52 +00:00
Kees Cook
b0572dcd78 UPSTREAM: ARM: ptrace: Restore syscall skipping for tracers
Since commit 4e57a4ddf6 ("ARM: 9107/1: syscall: always store
thread_info->abi_syscall"), the seccomp selftests "syscall_errno"
and "syscall_faked" have been broken. Both seccomp and PTRACE depend
on using the special value of "-1" for skipping syscalls. This value
wasn't working because it was getting masked by __NR_SYSCALL_MASK in
both PTRACE_SET_SYSCALL and get_syscall_nr().

Explicitly test for -1 in PTRACE_SET_SYSCALL and get_syscall_nr(),
leaving it exposed when present, allowing tracers to skip syscalls
again.

Cc: Russell King <linux@armlinux.org.uk>
Cc: Arnd Bergmann <arnd@kernel.org>
Cc: Lecopzer Chen <lecopzer.chen@mediatek.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: linux-arm-kernel@lists.infradead.org
Fixes: 4e57a4ddf6 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall")
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20230810195422.2304827-2-keescook@chromium.org
Change-Id: I5b13c06a9cca85d13beec809a695198a7696df45
Signed-off-by: Kees Cook <keescook@chromium.org>
(cherry picked from commit 4697b5848b)
Bug: 289991100
Signed-off-by: Edward Liaw <edliaw@google.com>
2023-09-26 20:28:45 +00:00
Kees Cook
277d398991 UPSTREAM: ARM: ptrace: Restore syscall restart tracing
Since commit 4e57a4ddf6 ("ARM: 9107/1: syscall: always store
thread_info->abi_syscall"), the seccomp selftests "syscall_restart" has
been broken. This was caused by the restart syscall not being stored to
"abi_syscall" during restart setup before branching to the "local_restart"
label. Tracers would see the wrong syscall, and scno would get overwritten
while returning from the TIF_WORK path. Add the missing store.

Cc: Russell King <linux@armlinux.org.uk>
Cc: Arnd Bergmann <arnd@kernel.org>
Cc: Lecopzer Chen <lecopzer.chen@mediatek.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: linux-arm-kernel@lists.infradead.org
Fixes: 4e57a4ddf6 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall")
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20230810195422.2304827-1-keescook@chromium.org
Change-Id: If78d334ed46335cf8eff33a4bbcb1da5e86de016
Signed-off-by: Kees Cook <keescook@chromium.org>
(cherry picked from commit cf00764747)
Bug: 289991100
Signed-off-by: Edward Liaw <edliaw@google.com>
2023-09-26 20:28:40 +00:00
Jaegeuk Kim
dfac06d29d FROMGIT: f2fs: preload extent_cache for POSIX_FADV_WILLNEED
This patch tries to preload extent_cache given POSIX_FADV_WILLNEED, which is
more useful for generic usecases.

Bug: 301585673
Bug: 296299682
Fixes: f43b021e14 ("FROMGIT: f2fs: preload extent_cache for POSIX_FADV_WILLNEED")
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 3e729e50d01e6a336132d1739866a6463f82faa9
 https://git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev)
Change-Id: I11702b172270b143209407d06aa0338f19f19b43
2023-09-26 10:54:38 -07:00
Xin Liu
a430d09818 UPSTREAM: bpf, sockmap: fix deadlocks in the sockhash and sockmap
[ Upstream commit ed17aa92dc ]

When huang uses sched_switch tracepoint, the tracepoint
does only one thing in the mounted ebpf program, which
deletes the fixed elements in sockhash ([0])

It seems that elements in sockhash are rarely actively
deleted by users or ebpf program. Therefore, we do not
pay much attention to their deletion. Compared with hash
maps, sockhash only provides spin_lock_bh protection.
This causes it to appear to have self-locking behavior
in the interrupt context.

  [0]:https://lore.kernel.org/all/CABcoxUayum5oOqFMMqAeWuS8+EzojquSOSyDA3J_2omY=2EeAg@mail.gmail.com/

Bug: 293551383
Reported-by: Hsin-Wei Hung <hsinweih@uci.edu>
Fixes: 604326b41a ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: Xin Liu <liuxin350@huawei.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/20230406122622.109978-1-liuxin350@huawei.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit f333854dce)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I913aa014f16e294ab9f9fec04d3e63afb8aa803f
2023-09-26 06:25:06 +00:00
Wanwei Jiang
eb21f15a1a ANDROID: GKI: Update symbol list for Amlogic
2 function symbol(s) added
  'int __traceiter_android_vh_printk_caller(void*, char*, size_t, u32, int*)'
  'int __traceiter_android_vh_printk_caller_id(void*, u32*)'

2 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_printk_caller'
  'struct tracepoint __tracepoint_android_vh_printk_caller_id'

Bug: 301935205
Change-Id: I0bb0d60776b2451f92a3f5916741cac737ed82f5
Signed-off-by: Wanwei Jiang <wanwei.jiang@amlogic.com>
2023-09-25 23:48:42 +08:00
valis
130bf74489 UPSTREAM: net: sched: sch_qfq: Fix UAF in qfq_dequeue()
[ Upstream commit 8fc134fee2 ]

When the plug qdisc is used as a class of the qfq qdisc it could trigger a
UAF. This issue can be reproduced with following commands:

  tc qdisc add dev lo root handle 1: qfq
  tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512
  tc qdisc add dev lo parent 1:1 handle 2: plug
  tc filter add dev lo parent 1: basic classid 1:1
  ping -c1 127.0.0.1

and boom:

[  285.353793] BUG: KASAN: slab-use-after-free in qfq_dequeue+0xa7/0x7f0
[  285.354910] Read of size 4 at addr ffff8880bad312a8 by task ping/144
[  285.355903]
[  285.356165] CPU: 1 PID: 144 Comm: ping Not tainted 6.5.0-rc3+ #4
[  285.357112] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
[  285.358376] Call Trace:
[  285.358773]  <IRQ>
[  285.359109]  dump_stack_lvl+0x44/0x60
[  285.359708]  print_address_description.constprop.0+0x2c/0x3c0
[  285.360611]  kasan_report+0x10c/0x120
[  285.361195]  ? qfq_dequeue+0xa7/0x7f0
[  285.361780]  qfq_dequeue+0xa7/0x7f0
[  285.362342]  __qdisc_run+0xf1/0x970
[  285.362903]  net_tx_action+0x28e/0x460
[  285.363502]  __do_softirq+0x11b/0x3de
[  285.364097]  do_softirq.part.0+0x72/0x90
[  285.364721]  </IRQ>
[  285.365072]  <TASK>
[  285.365422]  __local_bh_enable_ip+0x77/0x90
[  285.366079]  __dev_queue_xmit+0x95f/0x1550
[  285.366732]  ? __pfx_csum_and_copy_from_iter+0x10/0x10
[  285.367526]  ? __pfx___dev_queue_xmit+0x10/0x10
[  285.368259]  ? __build_skb_around+0x129/0x190
[  285.368960]  ? ip_generic_getfrag+0x12c/0x170
[  285.369653]  ? __pfx_ip_generic_getfrag+0x10/0x10
[  285.370390]  ? csum_partial+0x8/0x20
[  285.370961]  ? raw_getfrag+0xe5/0x140
[  285.371559]  ip_finish_output2+0x539/0xa40
[  285.372222]  ? __pfx_ip_finish_output2+0x10/0x10
[  285.372954]  ip_output+0x113/0x1e0
[  285.373512]  ? __pfx_ip_output+0x10/0x10
[  285.374130]  ? icmp_out_count+0x49/0x60
[  285.374739]  ? __pfx_ip_finish_output+0x10/0x10
[  285.375457]  ip_push_pending_frames+0xf3/0x100
[  285.376173]  raw_sendmsg+0xef5/0x12d0
[  285.376760]  ? do_syscall_64+0x40/0x90
[  285.377359]  ? __static_call_text_end+0x136578/0x136578
[  285.378173]  ? do_syscall_64+0x40/0x90
[  285.378772]  ? kasan_enable_current+0x11/0x20
[  285.379469]  ? __pfx_raw_sendmsg+0x10/0x10
[  285.380137]  ? __sock_create+0x13e/0x270
[  285.380673]  ? __sys_socket+0xf3/0x180
[  285.381174]  ? __x64_sys_socket+0x3d/0x50
[  285.381725]  ? entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[  285.382425]  ? __rcu_read_unlock+0x48/0x70
[  285.382975]  ? ip4_datagram_release_cb+0xd8/0x380
[  285.383608]  ? __pfx_ip4_datagram_release_cb+0x10/0x10
[  285.384295]  ? preempt_count_sub+0x14/0xc0
[  285.384844]  ? __list_del_entry_valid+0x76/0x140
[  285.385467]  ? _raw_spin_lock_bh+0x87/0xe0
[  285.386014]  ? __pfx__raw_spin_lock_bh+0x10/0x10
[  285.386645]  ? release_sock+0xa0/0xd0
[  285.387148]  ? preempt_count_sub+0x14/0xc0
[  285.387712]  ? freeze_secondary_cpus+0x348/0x3c0
[  285.388341]  ? aa_sk_perm+0x177/0x390
[  285.388856]  ? __pfx_aa_sk_perm+0x10/0x10
[  285.389441]  ? check_stack_object+0x22/0x70
[  285.390032]  ? inet_send_prepare+0x2f/0x120
[  285.390603]  ? __pfx_inet_sendmsg+0x10/0x10
[  285.391172]  sock_sendmsg+0xcc/0xe0
[  285.391667]  __sys_sendto+0x190/0x230
[  285.392168]  ? __pfx___sys_sendto+0x10/0x10
[  285.392727]  ? kvm_clock_get_cycles+0x14/0x30
[  285.393328]  ? set_normalized_timespec64+0x57/0x70
[  285.393980]  ? _raw_spin_unlock_irq+0x1b/0x40
[  285.394578]  ? __x64_sys_clock_gettime+0x11c/0x160
[  285.395225]  ? __pfx___x64_sys_clock_gettime+0x10/0x10
[  285.395908]  ? _copy_to_user+0x3e/0x60
[  285.396432]  ? exit_to_user_mode_prepare+0x1a/0x120
[  285.397086]  ? syscall_exit_to_user_mode+0x22/0x50
[  285.397734]  ? do_syscall_64+0x71/0x90
[  285.398258]  __x64_sys_sendto+0x74/0x90
[  285.398786]  do_syscall_64+0x64/0x90
[  285.399273]  ? exit_to_user_mode_prepare+0x1a/0x120
[  285.399949]  ? syscall_exit_to_user_mode+0x22/0x50
[  285.400605]  ? do_syscall_64+0x71/0x90
[  285.401124]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[  285.401807] RIP: 0033:0x495726
[  285.402233] Code: ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 09
[  285.404683] RSP: 002b:00007ffcc25fb618 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  285.405677] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 0000000000495726
[  285.406628] RDX: 0000000000000040 RSI: 0000000002518750 RDI: 0000000000000000
[  285.407565] RBP: 00000000005205ef R08: 00000000005f8838 R09: 000000000000001c
[  285.408523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000002517634
[  285.409460] R13: 00007ffcc25fb6f0 R14: 0000000000000003 R15: 0000000000000000
[  285.410403]  </TASK>
[  285.410704]
[  285.410929] Allocated by task 144:
[  285.411402]  kasan_save_stack+0x1e/0x40
[  285.411926]  kasan_set_track+0x21/0x30
[  285.412442]  __kasan_slab_alloc+0x55/0x70
[  285.412973]  kmem_cache_alloc_node+0x187/0x3d0
[  285.413567]  __alloc_skb+0x1b4/0x230
[  285.414060]  __ip_append_data+0x17f7/0x1b60
[  285.414633]  ip_append_data+0x97/0xf0
[  285.415144]  raw_sendmsg+0x5a8/0x12d0
[  285.415640]  sock_sendmsg+0xcc/0xe0
[  285.416117]  __sys_sendto+0x190/0x230
[  285.416626]  __x64_sys_sendto+0x74/0x90
[  285.417145]  do_syscall_64+0x64/0x90
[  285.417624]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[  285.418306]
[  285.418531] Freed by task 144:
[  285.418960]  kasan_save_stack+0x1e/0x40
[  285.419469]  kasan_set_track+0x21/0x30
[  285.419988]  kasan_save_free_info+0x27/0x40
[  285.420556]  ____kasan_slab_free+0x109/0x1a0
[  285.421146]  kmem_cache_free+0x1c2/0x450
[  285.421680]  __netif_receive_skb_core+0x2ce/0x1870
[  285.422333]  __netif_receive_skb_one_core+0x97/0x140
[  285.423003]  process_backlog+0x100/0x2f0
[  285.423537]  __napi_poll+0x5c/0x2d0
[  285.424023]  net_rx_action+0x2be/0x560
[  285.424510]  __do_softirq+0x11b/0x3de
[  285.425034]
[  285.425254] The buggy address belongs to the object at ffff8880bad31280
[  285.425254]  which belongs to the cache skbuff_head_cache of size 224
[  285.426993] The buggy address is located 40 bytes inside of
[  285.426993]  freed 224-byte region [ffff8880bad31280, ffff8880bad31360)
[  285.428572]
[  285.428798] The buggy address belongs to the physical page:
[  285.429540] page:00000000f4b77674 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbad31
[  285.430758] flags: 0x100000000000200(slab|node=0|zone=1)
[  285.431447] page_type: 0xffffffff()
[  285.431934] raw: 0100000000000200 ffff88810094a8c0 dead000000000122 0000000000000000
[  285.432757] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
[  285.433562] page dumped because: kasan: bad access detected
[  285.434144]
[  285.434320] Memory state around the buggy address:
[  285.434828]  ffff8880bad31180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  285.435580]  ffff8880bad31200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  285.436264] >ffff8880bad31280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  285.436777]                                   ^
[  285.437106]  ffff8880bad31300: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[  285.437616]  ffff8880bad31380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  285.438126] ==================================================================
[  285.438662] Disabling lock debugging due to kernel taint

Fix this by:
1. Changing sch_plug's .peek handler to qdisc_peek_dequeued(), a
function compatible with non-work-conserving qdiscs
2. Checking the return value of qdisc_dequeue_peeked() in sch_qfq.

Bug: 300131820
Fixes: 462dbc9101 ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Reported-by: valis <sec@valis.email>
Signed-off-by: valis <sec@valis.email>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20230901162237.11525-1-jhs@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit a18349dc8d)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I2be4a7b7eb1448df8281c145ee2ca441bd746c9a
2023-09-25 12:08:25 +00:00
Budimir Markovic
ba5f5fb147 UPSTREAM: net/sched: sch_hfsc: Ensure inner classes have fsc curve
[ Upstream commit b3d26c5702 ]

HFSC assumes that inner classes have an fsc curve, but it is currently
possible for classes without an fsc curve to become parents. This leads
to bugs including a use-after-free.

Don't allow non-root classes without HFSC_FSC to become parents.

Bug: 299921101
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
Signed-off-by: Budimir Markovic <markovicbudimir@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20230824084905.422-1-markovicbudimir@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 4cf994d3f4)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I5b44ae6bb340b978372ed9657ba2e23f75b850e5
2023-09-25 11:16:59 +01:00
Wanwei Jiang
360c724a76 ANDROID: GKI: Update symbol list for Amlogic
1 function symbol(s) added
  'int __traceiter_android_vh_xhci_urb_suitable_bypass(void*, struct urb*, int*)'

1 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_xhci_urb_suitable_bypass'

Bug: 301055890
Change-Id: I7358088b761e539eb2e2fce50d8db4b7277520ff
Signed-off-by: Wanwei Jiang <wanwei.jiang@amlogic.com>
2023-09-22 17:32:31 +00:00
qinglin.li
d3c35bf422 ANDROID: vendor_hooks: add vendor hook in xhci_urb_suitable_for_idt()
By this vh, so that we can reimplement the function xhci_urb_suitable_for_idt()

Bug: 301055890
Change-Id: I5e4eabf1155eceb650eee6a42b0e00e8d55281dc
Signed-off-by: Wanwei Jiang <wanwei.jiang@amlogic.com>
2023-09-22 17:32:31 +00:00
Peifeng Li
a29acad961 ANDROID: uid_sys_stat: instead update_io_stats_uid_locked to update_io_stats_uid
Update_io_stats_uid_locked would take a long lock-time of uid_lock due to
call do_each_thread to compute uid_entry->io, which would cause to lock
competition sometime.

Using uid_entry_tmp to get the result of update_io_stats_uid, so that we
can unlock_uid during update_io_stats_uid, in order to avoid the
unnecessary lock-time of uid_lock.

Bug: 278138377

Signed-off-by: Peifeng Li <lipeifeng@oppo.com>
(cherry picked from https://android-review.googlesource.com/q/commit:c1fa53f3cf85c0a1c23f0e0a944986b4aa049073)
Merged-In: I5be62105e57e2a896a95d906e3c14e17c7f8077d
Change-Id: I5be62105e57e2a896a95d906e3c14e17c7f8077d
2023-09-21 15:15:00 +00:00
Peifeng Li
a1931ea630 ANDROID: uid_sys_stat: split the global lock uid_lock to the fine-grained
locks for each hlist in hash_table.

1.Hash_table in uid_sys_stat is protected by a global lock named id_lock,
which causes some lock competition issue. Actually, uid_lock can be split to
several file-grained locks for each hlist in hash_table, which avoid
the unnecessary lock competition when get different-uid process info.

2. Switching rt-mutex to spinlock, in order to operate with read_rcu_lock.

Bug: 278138377
Signed-off-by: Peifeng Li <lipeifeng@oppo.com>
(cherry picked from https://android-review.googlesource.com/q/commit:c949fbdce0bc792dea206c709d909094be579c3a)
Merged-In: Ib252b65e9aebe3a594e6edf075f7aa01f8e6105d
Change-Id: Ib252b65e9aebe3a594e6edf075f7aa01f8e6105d
2023-09-21 15:15:00 +00:00
Saravana Kannan
19b5b13d8f ANDROID: Flush deferred probe list before dropping host priv
Some IOMMU devices might be deferred after the driver being
loaded early, so we need to flush the deferred probe list,
this will work if all dependencies already exist.

Bug: 290582379
Change-Id: I5fb3af9b0f7d1b4dbf57078707112dfdb8a3dc23
Signed-off-by: Saravana Kannan <saravanak@google.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
2023-09-21 13:45:08 +00:00
Will Deacon
93ef439161 ANDROID: KVM: arm64: Don't force pte mappings in [n]VHE guest stage-2
Commit d096d35445 ("ANDROID: KVM: arm64: Have different callbacks for
PTE manipulation") accidentally forces the use of pte-level mappings for
the guest stage-2 page-table when not using pKVM.

This confuses user_mem_abort() when the guest takes a permission fault
trying to execute from a huge page. Since the fault is reported at the
pte-level, we end up handling it as a translation fault by calling
kvm_pgtable_stage2_map() which dutifully returns -EAGAIN when it finds
the RW PTE. Consequently, the guest appears to hang randomly during boot.

Fix the issue by inverting stage2_force_pte_cb() so that the host is in
complete control of the mapping granularity of the guest when pKVM is
not being used.

Cc: Fuad Tabba <tabba@google.com>
Cc: Mostafa Saleh <smostafa@google.com>
Fixes: d096d35445 ("ANDROID: KVM: arm64: Have different callbacks for PTE manipulation")
Signed-off-by: Will Deacon <willdeacon@google.com>
Bug: 222044487
Change-Id: Ideab281ae6d1d5c0fd29fba03ad8ed1cae521a1e
2023-09-21 12:29:02 +00:00
Jaegeuk Kim
f43b021e14 FROMGIT: f2fs: preload extent_cache for POSIX_FADV_WILLNEED
This patch tries to preload extent_cache given POSIX_FADV_WILLNEED, which is
more useful for generic usecases.

Bug: 296299682
Suggested-by: Eric Biggers <ebiggers@kernel.org>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit a3edf9f0bbb798f6c39b2bd467ee2d7fe425a0f8
 https://git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev)
Change-Id: Ie4abc8b670658373dc0d4b8cae29990b6fb8bf9e
2023-09-20 20:49:27 +00:00
Nathan Chancellor
a0622550a9 ANDROID: tools/resolve_btfids: Pass CFLAGS to libsubcmd build via EXTRA_CFLAGS
When building using kleaf on an host distribution with glibc 2.38 or later,
there is a linkage failure when building resolve_btfids:

  ld.lld: error: undefined symbol: __isoc23_strtol
  >>> referenced by stdlib.h:483 (/usr/include/stdlib.h:483)
  >>>               libsubcmd-in.o:(pretty_print_string_list) in archive .../libsubcmd.a
  >>> referenced by stdlib.h:483 (/usr/include/stdlib.h:483)
  >>>               libsubcmd-in.o:(pretty_print_string_list) in archive .../libsubcmd.a
  >>> referenced by stdlib.h:483 (/usr/include/stdlib.h:483)
  >>>               libsubcmd-in.o:(pager_get_columns) in archive .../libsubcmd.a
  >>> referenced 2 more times

  ld.lld: error: undefined symbol: __isoc23_strtoul
  >>> referenced by parse-options.c:314 (.../tools/lib/subcmd/parse-options.c:314)
  >>>               libsubcmd-in.o:(get_value) in archive .../libsubcmd.a

  ld.lld: error: undefined symbol: __isoc23_strtoull
  >>> referenced by parse-options.c:332 (.../tools/lib/subcmd/parse-options.c:332)
  >>>               libsubcmd-in.o:(get_value) in archive .../libsubcmd.a
  clang-17: error: linker command failed with exit code 1 (use -v to see invocation)

These errors imply that the files were build against glibc 2.38 headers
but attempted to be linked with an older glibc version.

Building with '--debug_make_verbosity=D' reveals that the libsubcmd
object files are not built with the additional HOSTCFLAGS the Android
build system provides for a hermetic build (namely '-I' for .c files),
so they build against the system's headers but link against Android's
glibc 2.17, resulting in the error above.

This is not an issue upstream after
commit 13e07691a1 ("tools/resolve_btfids: Alter how HOSTCC is
forced"), as HOST_OVERRIDES (which contains HOSTCFLAGS via EXTRA_CFLAGS)
is passed along to libsubcmd. That change is quite invasive as a
backport for 5.15 and earlier. As a miminal fix, pass CFLAGS (which
contains HOSTCFLAGS via KBUILD_HOSTCFLAGS) to the libsubcmd build via
EXTRA_CFLAGS, which really should have been done upstream in
commit 0e3a1c902f ("tools/resolve_btfids: Build with host flags"),
which is present in this branch as commit 9e332a14f3 ("FROMGIT:
tools/resolve_btfids: Build with host flags").

Bug: 301145081
Change-Id: I91c1c9a8fb8f83118a6b8ec4da6cc33a773f2124
Fixes: 368cd63174 ("FROMGIT: tools/resolve_btfids: Build with host flags")
Link: https://github.com/ClangBuiltLinux/linux/issues/1929
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2023-09-20 18:31:56 +00:00
Nathan Chancellor
4aee33cbf4 ANDROID: libsubcmd: Hoist iterator variable declarations in parse_options_subcommand()
When applying HOSTCFLAGS to the libsubcmd build to resolve a separate
issue, which contain '-std=gnu89' prior to commit 1e24078113 ("Kbuild:
use -std=gnu11 for KBUILD_USERCFLAGS"), the following warning/error
occurs:

  parse-options.c:643:8: error: GCC does not allow variable declarations in for loop initializers before C99 [-Werror,-Wgcc-compat]
                  for (int i = 0; subcommands[i]; i++) {
                       ^
  parse-options.c:669:9: error: GCC does not allow variable declarations in for loop initializers before C99 [-Werror,-Wgcc-compat]
                          for (int i = 0; subcommands[i]; i++)
                               ^

This issue was never visible upstream, as commit 1e24078113 ("Kbuild:
use -std=gnu11 for KBUILD_USERCFLAGS") was applied before
commit 13e07691a1 ("tools/resolve_btfids: Alter how HOSTCC is
forced"). Prior to the latter change, there was no '-std=' flag passed
to the libsubcmd build, so the default standard value was used, which
may be newer than C99.

To resolve this issue to unblock applying HOSTCFLAGS to libsubcmd, just
hoist the declarations out of the for loops.

Bug: 301145081
Change-Id: I41f17964f3d0822b026f6ae8f06a4d49bc7f15a9
Link: https://github.com/ClangBuiltLinux/linux/issues/1929
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2023-09-20 18:31:56 +00:00
Bart Van Assche
cc1046e3c7 ANDROID: block: Revert "Send requeued requests to the I/O scheduler"
Revert commit 9102217567 ("ANDROID: block: Send requeued requests to
the I/O scheduler") because these changes are not needed for any use
case.

Bug: 298142254
Change-Id: I0a0e51a46d56c2c433ae5900d69e69ee2abad7a0
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-09-19 13:15:49 -07:00
Bart Van Assche
c7b7058fbf ANDROID: block: Revert "Preserve the order of requeued requests"
Revert commit 5d90f7cbaf ("ANDROID: block: Preserve the order of
requeued requests") because it is no longer needed. A mechanism has
been added in the SCSI core for sorting zoned writes by LBA. This
patch includes changes to compensate for the move of the requeue_work
member from struct request_queue into struct internal_request_queue.

Bug: 298142254
Change-Id: I35161cfff058d518c3ac5835c6bfcedb8fb567c7
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-09-19 13:14:54 -07:00
Bart Van Assche
1988ebab8f ANDROID: block: Restore request_queue.requeue_work
Restore the struct request_queue requeue_work member without modifying
the KMI. The approach of this patch works because blk_dev_init() is the
only function that needs to know the size of a request queue structure.

This patch prepares for reverting "Preserve the order of requeued
requests".

See also commit 619ba336c3 ("ANDROID: block: Remove
request_queue.requeue_work").

Bug: 298142254
Change-Id: I108ceb9f58cec521f81fd8cf82f38185376a7a6b
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-09-19 13:12:26 -07:00
Bart Van Assche
cfe32cb3c3 BACKPORT: FROMGIT: scsi: ufs: Include the SCSI ID in UFS command tracing output
The logical unit information is missing from the UFS command tracing
output. Although the device name is logged, e.g. 13200000.ufs, this
name does not include logical unit information. Hence this patch that
replaces the device name with the SCSI ID in the tracing output. An
example of tracing output with this patch applied:

    kworker/8:0H-80      [008] .....    89.106063: ufshcd_command: send_req: 0:0:0:4: tag: 10, DB: 0x7ffffbff, size: 524288, IS: 0, LBA: 1085538, opcode: 0x8a (WRITE_16), group_id: 0x0
              dd-4225    [000] d.h..    89.106219: ufshcd_command: complete_rsp: 0:0:0:4: tag: 11, DB: 0x7ffff7ff, size: 524288, IS: 0, LBA: 1081728, opcode: 0x8a (WRITE_16), group_id: 0x0

Bug: 299493745
Change-Id: I140a5b0bfea25d17d0c0e46038cb016d8f6ca589
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
(cherry picked from commit ccc3e1363069c5955045824bb0e63c51d8873e25 git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git for-next)
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-09-19 17:57:09 +00:00
Amit Daniel Kachhap
33d2a21b81 UPSTREAM: ARM: 9269/1: vfp: Add hwcap for FEAT_DotProd
Advanced Dot product is a feature present in AArch32 state for Armv8 and
is represented by ISAR6 identification register.

This feature denotes the presence of UDOT and SDOT instructions and hence adding a hwcap will enable the userspace to check it before trying to use those instructions.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Amit Daniel Kachhap <amit.kachhap@arm.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>

Bug: 282663915
(cherry picked from commit 62ea0d873a)
Change-Id: I27cd1e060ec48ec3302c23b566ef9f50f7dc384e
Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
2023-09-18 19:40:55 +00:00
Amit Daniel Kachhap
49c6c1e40f UPSTREAM: ARM: 9268/1: vfp: Add hwcap FPHP and ASIMDHP for FEAT_FP16
Floating point half-precision (FPHP) and Advanced SIMD half-precision
(ASIMDHP) are VFP features (FEAT_FP16) represented by MVFR1 identification register. These capabilities can optionally exist with VFPv3 and mandatory with VFPv4. Both these new features exist for Armv8 architecture in AArch32 state.

These hwcaps may be useful for the userspace to add conditional check
before trying to use FEAT_FP16 feature specific instructions.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Amit Daniel Kachhap <amit.kachhap@arm.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>

Bug: 282663915
(cherry picked from commit c00a19c8b1)
Change-Id: I46af49d39168b0d35db05cdd1499f9b7df030f09
Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
2023-09-18 19:40:55 +00:00
Amit Daniel Kachhap
52e28a12a9 UPSTREAM: ARM: 9267/1: Define Armv8 registers in AArch32 state
AArch32 Instruction Set Attribute Register 6 (ID_ISAR6_EL1) and AArch32
Processor Feature Register 2 (ID_PFR2_EL1) identifies some new features
for the Armv8 architecture. This registers will be utilized to add
hwcaps for those cpu features.

These registers are marked as reserved for Armv7 and should be a RAZ.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Amit Daniel Kachhap <amit.kachhap@arm.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>

Bug: 282663915
(cherry picked from commit 74c344e6f1)
Change-Id: I5545dbb3d22424ef130c0f95e92ee31a9e7de9be
Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
2023-09-18 19:40:55 +00:00
Suren Baghdasaryan
a6f12f29b8 ANDROID: mm: fix freeing of MIGRATE_ISOLATE page
While porting [1] from 5.10 kernel there was a bug introduced which
results in CMA pages ending up in MIGRATE_MOVABLE pcp list. Remove
the extra line.

[1] https://android-review.googlesource.com/c/kernel/common/+/2059993

Fixes: 98f3cc7ecd ("ANDROID: mm: freeing MIGRATE_ISOLATE page instantly")
Bug: 299241869
Change-Id: Ia63bca17e455460eb9f22a1190c991159c44acaa
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2023-09-15 19:09:09 +00:00