Commit Graph

1155864 Commits

Author SHA1 Message Date
Keir Fraser
f082d22541 ANDROID: KVM: arm64: Optimise module_change_host_page_prot
Merge the relaxation and restriction paths to both only need to adjust
permissions. This avoids un-map + re-map on the restriction path; and
avoids installing an annotated entry on the relaxation path (which
will cause a translation fault on first access by the host).

Bug: 308373293
Change-Id: I9c7a6ac149aad64b19a5ce7808334188475b27cc
Signed-off-by: Keir Fraser <keirf@google.com>
2023-12-15 08:45:53 +00:00
Will Deacon
01dd8c280b ANDROID: KVM: arm64: Prefault entries when splitting a block mapping
When splitting a block mapping, we install a table entry pointing to an
empty page and recreate the new entries lazily as we fault them in. For
page-tables with the KVM_PGTABLE_S2_IDMAP flag, this can result in
unnecessary translation faults.

When splitting a block for a page-table with KVM_PGTABLE_S2_IDMAP set,
pre-populate the newly allocate page-table page with contiguous ptes
based on the attributes of the block.

Bug: 308373293
Change-Id: I0c53d048de913e193830caef93d75755270db709
Signed-off-by: Will Deacon <willdeacon@google.com>
Signed-off-by: Keir Fraser <keirf@google.com>
2023-12-15 08:45:53 +00:00
Elliot Berman
cc653d701f ANDROID: virt: gunyah: Zero state_data after vcpu_run
Do not re-use stale state_data on subsequent vcpu runs as the stale data
could be interpreted by Gunyah and rejected.

Bug: 268234781
Change-Id: I3d4bf7a922da1e0e85006ffa58b64a74e320d3c9
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-12-14 15:39:09 -08:00
Benjamin Schwartz
cc294d9503 ANDROID: Update the ABI symbol list
Adding the following symbols:
     - __traceiter_android_vh_ep_create_wakeup_source
     - __traceiter_android_vh_timerfd_create
     - __tracepoint_android_vh_ep_create_wakeup_source
     - __tracepoint_android_vh_timerfd_create

Bug: 155142106

Change-Id: Ie895faefacd62674ac58783ba6a3cd5c3bc46637
Signed-off-by: Benjamin Schwartz <bsschwar@google.com>
2023-12-14 17:32:26 +00:00
Manish Varma
956a0d3998 ANDROID: fs: Add vendor hooks for ep_create_wakeup_source & timerfd_create
timerfd doesn't create any wakelocks, but eventpoll can.  When it does,
it names them after the underlying file descriptor, and since all
timerfd file descriptors are named "[timerfd]" (which saves memory on
systems like desktops with potentially many timerfd instances), all
wakesources created as a result of using the eventpoll-on-timerfd idiom
are called... "[timerfd]".

However, it becomes impossible to tell which "[timerfd]" wakesource is
affliated with which process and hence troubleshooting is difficult.

Adding vendor hooks to allow vendor to assign appropriate names to
timerfd descriptors and eventoll wakesource.

Bug: 155142106

Signed-off-by: Manish Varma <varmam@google.com>
Change-Id: I330a42ab48bed4b26d5eb2f636925c66061165ec
(cherry picked from commit 0ff110fbb3)
2023-12-13 15:54:47 -08:00
DooHyun Hwang
d8d2b95fd0 ANDROID: ABI: update symbol list for galaxy
2 function symbol(s) added
  'int scsi_device_quiesce(struct scsi_device*)'
  'void scsi_device_resume(struct scsi_device*)'

Bug: 316076675
Change-Id: I301b9445f41736ae485c3779b7164962c17117b2
Signed-off-by: DooHyun Hwang <dh0421.hwang@samsung.com>
2023-12-13 17:58:33 +00:00
Lee Jones
bcc758eed7 Reapply "binder: fix UAF caused by faulty buffer cleanup"
This reverts commit 9f67f4f500.

Vanir complained that this fix was missing, but only from this branch.

Let's bring it back and see how the ABI checker behaves.

Bug: 275041864
Bug: 308350116
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I1fc248582347a295d9168bbd8e55dbd6880e34ed
2023-12-13 09:41:09 +00:00
Joerg Roedel
b2b3a1e6d1 UPSTREAM: x86/sev: Check for user-space IOIO pointing to kernel space
Upstream commit: 63e44bc520

Check the memory operand of INS/OUTS before emulating the instruction.
The #VC exception can get raised from user-space, but the memory operand
can be manipulated to access kernel memory before the emulation actually
begins and after the exception handler has run.

  [ bp: Massage commit message. ]

Bug: 309733863
Fixes: 597cfe4821 ("x86/boot/compressed/64: Setup a GHCB-based VC Exception handler")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 57d0639f60)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Iac1c2f15cc922ab215d57654b004d020a0b65e53
2023-12-12 18:32:31 +00:00
Joerg Roedel
62b97630d4 UPSTREAM: x86/sev: Check IOBM for IOIO exceptions from user-space
Upstream commit: b9cb9c4558

Check the IO permission bitmap (if present) before emulating IOIO #VC
exceptions for user-space. These permissions are checked by hardware
already before the #VC is raised, but due to the VC-handler decoding
race it needs to be checked again in software.

Bug: 309733863
Fixes: 25189d08e5 ("x86/sev-es: Add support for handling IOIO exceptions")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Tested-by: Tom Dohrmann <erbse.13@gmx.de>
Cc: <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit def94eb9a8)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ia520acc67da21353148fd07a3a8e48ee8a97d364
2023-12-12 18:32:28 +00:00
Guan-Yu Lin
071c14698c FROMGIT: usb: typec: tcpm: skip checking port->send_discover in PD3.0
The original Collison Avoidance mechanism, port->send_discover, avoids
the conflict when port partners start AMS almost the same time. However,
this mechanism is replaced by SINK_TX_OK and SINK_TX_NG. Skip the check
in PD3.0 to avoid the deadlock when source is requesting DR_SWAP where
sink is requesting DISCOVER_IDENTITY.

Signed-off-by: Guan-Yu Lin <guanyulin@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20231116083221.1201892-1-guanyulin@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 292178486
(cherry picked from commit e0cc05d52ad310cced029449bcda0f9fc847097c
 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb-next)
Change-Id: I4691628d8085dfa7be9189b2bd598896664c38b5
Signed-off-by: Guan-Yu Lin <guanyulin@google.com>
2023-12-12 17:25:38 +00:00
Will Deacon
a9567a35d0 ANDROID: arm64: Disable workaround for CPU errata 2441007 and 2441009
CPU errata 2441007 (Cortex-A55) and 2441009 (Cortex-A510) are categorised
as "rare" by Arm and consequently the workaround is not intended to be
deployed in practice as the issue is not expected to occur in real-world
environments.

Given that the cost of the workaround, which issues additional broadcast
TLB invalidation requests, has been shown to impact kswapd significantly
on Pixel devices, disable the workaround following Arm's recommendation.

Bug: 306231846
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: I39b6d9736cfa79827321151b45774f62c8d1a747
(cherry picked from commit 4ba6c3197c)
2023-12-12 08:17:04 +00:00
Richard Chang
2d8a5ddebb ANDROID: Update the ABI symbol list
Adding the following symbol:
  - __cma_alloc

Bug: 308881290
Change-Id: I5b3ffb0c804dc636355c1462aaa6e96b1189446b
Signed-off-by: Richard Chang <richardycc@google.com>
2023-12-11 02:12:31 +00:00
Jong eon Park
ddf142e5a8 ANDROID: netlink: add netlink poll and hooks
In huge uevents generating system, especially for user apps who have
small size of rcvbuf socket, it has been reported that netlink overrun
happens quite frequently.

Moreover, if there's no POLLERR (caused by this netlink overrun) handler
in user apps, the system can almost be stucked by calling 'poll' repeatedly.

Regarding this issue, I have sent a kernel netlink patch to linux
maintainers and got replied that this is absolutely user app's problem,
must not addressing kernel.

Until Android team look into this issue and some modification comes out,
we need kernel patch for temporary. To minimize the effect by this patch
to the others who have never met this issue, I would like to just add
netlink's dedicated poll and its hooks.

Please refer to below v1/v2 patch links for history.

v1: https://lore.kernel.org/netdev/20231110110002.7279f895@kernel.org/T/#t
v2: https://lore.kernel.org/netdev/d599922fd89b3e61c7cf531a03ea8b81cbcb003e.camel@redhat.com/T/#t

Bug: 300009377
Link: https://lore.kernel.org/netdev/d599922fd89b3e61c7cf531a03ea8b81cbcb003e.camel@redhat.com/T/#t

Change-Id: I4f11399d61c10332ba05bac64cfa1e92bb111565
Signed-off-by: Jong eon Park <jongeon.park@samsung.com>
2023-12-08 20:50:05 +00:00
Taylor Nelms
c9b5c232e7 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - devm_drm_of_get_bridge
  - drm_kms_helper_connector_hotplug_event
  - of_find_mipi_dsi_host_by_node
  - of_get_parent
  - of_graph_get_remote_node

1 function symbol(s) added
  'void drm_kms_helper_connector_hotplug_event(struct drm_connector*)'

Bug: 303500701
Change-Id: Ief76bed701a62cb89cad78cc3d141ee6c6a84dad
Signed-off-by: Taylor Nelms <tknelms@google.com>
2023-12-07 19:24:02 +00:00
Seiya Wang
3c9cb9c06f ANDROID: GKI: Update symbol list for mtk
ABI impact

8 function symbol(s) added
  'struct mii_bus* devm_mdiobus_alloc_size(struct device*, int)'
  'struct phy_device* of_phy_get_and_connect(struct net_device*, struct device_node*, void(*)(struct net_device*))'
  'int pci_enable_device_mem(struct pci_dev*)'
  'int pci_prepare_to_sleep(struct pci_dev*)'
  'int pci_select_bars(struct pci_dev*, unsigned long)'
  'void phy_support_asym_pause(struct phy_device*)'
  'int ptp_find_pin(struct ptp_clock*, enum ptp_pin_function, unsigned int)'
  'int ptp_schedule_worker(struct ptp_clock*, unsigned long)'

1 variable symbol(s) added
  'struct efi efi'

Add following symbols

devm_alloc_etherdev_mqs
devm_mdiobus_alloc_size
efi
eth_prepare_mac_addr_change
of_get_mac_address
of_phy_get_and_connect
pci_disable_msi
pci_disable_msix
pci_enable_device_mem
pci_enable_msi
pci_enable_msix_range
pci_prepare_to_sleep
pci_release_selected_regions
pci_request_selected_regions
pci_select_bars
pci_set_power_state
phy_connect_direct
phy_ethtool_get_eee
phy_ethtool_get_wol
phy_ethtool_set_eee
phy_ethtool_set_wol
phy_find_first
phy_init_eee
phy_mii_ioctl
phy_remove_link_mode
phy_start_aneg
phy_support_asym_pause
ptp_clock_event
ptp_clock_index
ptp_clock_register
ptp_clock_unregister
ptp_find_pin
ptp_schedule_worker

Bug: 315023870
Signed-off-by: Seiya Wang <seiya.wang@mediatek.com>
Change-Id: I046b656fe9049a701ca6a440111eb4bfa420cf52
2023-12-06 19:32:59 +00:00
Richard Chang
5723833390 ANDROID: mm: lru_cache_disable skips lru cache drainnig
lru_cache_disable is not trivial cost since it should run work
from every cores in the system. Thus, repeated call of the
function whenever alloc_contig_range in the cma's allocation loop
is called is expensive.

This patch makes the lru_cache_disable smarter in that it will
not run __lru_add_drain_all since it knows the cache was already
disabled by someone else.
With that, user of alloc_contig_range can disable the lru cache
in advance in their context so that subsequent alloc_contig_range
for user's operation will avoid the costly function call.

Bug: 313795505
Change-Id: Icbb0e6dbf74644d45f562fd1d845888ca1f1f347
Signed-off-by: Richard Chang <richardycc@google.com>
(cherry picked from commit 816567b17866ca3f9a11e670bd52c82335cbb448)
2023-12-06 18:54:20 +00:00
Richard Chang
0de2f42977 ANDROID: mm: cma: introduce __cma_alloc API
This patch enhances the CMA API with support for failfast mode,
utilizing the __GFP_NORETRY flag. This mode is specifically designed
for high-order bulk allocation scenarios, enabling the CMA API to
avoid prolonged stalls resulting from blocking pages such as those
undergoing page writeback or page locking. Instead of stalling, the
API will continue searching for readily migratable pages across
different pageblocks.

The original patch link:
Link: https://lore.kernel.org/linux-mm/YAnM5PbNJZlk%2F%2FiX@google.com/T/#m36b144ff81fe0a8f0ecaf6813de4819ecc41f8fe

Bug: 308881290
Change-Id: I1c623f17fb49c26005aaffc17330cf820ce6585c
Signed-off-by: Richard Chang <richardycc@google.com>
(cherry picked from commit 3390547fec36527ed15dd213ee55d397f83ffa46)
2023-12-06 18:54:20 +00:00
Eric Biggers
db9d7ba706 ANDROID: Update the ABI representation
INFO: type 'struct fscrypt_info' changed
  member 'u8 ci_data_unit_bits' was added
  member 'u8 ci_data_units_per_block_bits' was added

type 'struct fscrypt_policy_v2' changed
  member '__u8 log2_data_unit_size' was added
  member changed from '__u8 __reserved[4]' to '__u8 __reserved[3]'
    offset changed from 32 to 40
    type changed from '__u8[4]' to '__u8[3]'
      number of elements changed from 4 to 3

Bug: 299136786
Bug: 302588300
Change-Id: Idbbc2123961a41d395323c72cef67d94bdd17ab0
Signed-off-by: Eric Biggers <ebiggers@google.com>
2023-12-06 17:54:14 +00:00
Eric Biggers
6b972d6047 BACKPORT: fscrypt: support crypto data unit size less than filesystem block size
Until now, fscrypt has always used the filesystem block size as the
granularity of file contents encryption.  Two scenarios have come up
where a sub-block granularity of contents encryption would be useful:

1. Inline crypto hardware that only supports a crypto data unit size
   that is less than the filesystem block size.

2. Support for direct I/O at a granularity less than the filesystem
   block size, for example at the block device's logical block size in
   order to match the traditional direct I/O alignment requirement.

(1) first came up with older eMMC inline crypto hardware that only
supports a crypto data unit size of 512 bytes.  That specific case
ultimately went away because all systems with that hardware continued
using out of tree code and never actually upgraded to the upstream
inline crypto framework.  But, now it's coming back in a new way: some
current UFS controllers only support a data unit size of 4096 bytes, and
there is a proposal to increase the filesystem block size to 16K.

(2) was discussed as a "nice to have" feature, though not essential,
when support for direct I/O on encrypted files was being upstreamed.

Still, the fact that this feature has come up several times does suggest
it would be wise to have available.  Therefore, this patch implements it
by using one of the reserved bytes in fscrypt_policy_v2 to allow users
to select a sub-block data unit size.  Supported data unit sizes are
powers of 2 between 512 and the filesystem block size, inclusively.
Support is implemented for both the FS-layer and inline crypto cases.

This patch focuses on the basic support for sub-block data units.  Some
things are out of scope for this patch but may be addressed later:

- Supporting sub-block data units in combination with
  FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64, in most cases.  Unfortunately this
  combination usually causes data unit indices to exceed 32 bits, and
  thus fscrypt_supported_policy() correctly disallows it.  The users who
  potentially need this combination are using f2fs.  To support it, f2fs
  would need to provide an option to slightly reduce its max file size.

- Supporting sub-block data units in combination with
  FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32.  This has the same problem
  described above, but also it will need special code to make DUN
  wraparound still happen on a FS block boundary.

- Supporting use case (2) mentioned above.  The encrypted direct I/O
  code will need to stop requiring and assuming FS block alignment.
  This won't be hard, but it belongs in a separate patch.

- Supporting this feature on filesystems other than ext4 and f2fs.
  (Filesystems declare support for it via their fscrypt_operations.)
  On UBIFS, sub-block data units don't make sense because UBIFS encrypts
  variable-length blocks as a result of compression.  CephFS could
  support it, but a bit more work would be needed to make the
  fscrypt_*_block_inplace functions play nicely with sub-block data
  units.  I don't think there's a use case for this on CephFS anyway.

Link: https://lore.kernel.org/r/20230925055451.59499-6-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>

Bug: 299136786
Bug: 302588300
(cherry picked from commit 5b11888471806edf699316d4dcb9b426caebbef2)
(Reworked this commit to not change struct fscrypt_operations and not
 depend on other commits that changed struct fscrypt_operations.  Also
 resolved conflicts with the HW-wrapped key support.)
Change-Id: Ic3dc56ef3f42d123f812e9037e2cc6f0b24bacc1
Signed-off-by: Eric Biggers <ebiggers@google.com>
2023-12-06 17:54:14 +00:00
Pablo Neira Ayuso
72bdb74622 UPSTREAM: netfilter: nf_tables: remove catchall element in GC sync path
[ Upstream commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630 ]

The expired catchall element is not deactivated and removed from GC sync
path. This path holds mutex so just call nft_setelem_data_deactivate()
and nft_setelem_catchall_remove() before queueing the GC work.

Bug: 310691882
Fixes: 4a9e12ea7e ("netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC")
Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 13e2d49647)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ic5d1d98fe5a749e759869f0789cbb77c4ab5e6c2
2023-12-06 14:44:26 +00:00
liwei
924116f1b8 ANDROID: GKI: Update oplus symbol list
1 function symbol(s) added
  'int __traceiter_mm_vmscan_kswapd_wake(void*, int, int, int)'

1 variable symbol(s) added
  'struct tracepoint __tracepoint_mm_vmscan_kswapd_wake'

Bug: 309352303
Change-Id: Id46347110c482eca8d0fb12bd1dd69a14ad8a337
Signed-off-by: liwei <liwei1234@oppo.com>
2023-12-05 20:22:28 +00:00
liwei
0ad2a3cd4d ANDROID: vendor_hooks: export tracepoint symbol trace_mm_vmscan_kswapd_wake
export tracepoint symbol trace_mm_vmscan_kswapd_wake so we can hook it in our ko
to capture some kswapd running info.

Bug: 309352303
Change-Id: Ieb37f544502f33e708dacda6cbb552792dfbbc6b
Signed-off-by: liwei <liwei1234@oppo.com>
2023-12-05 20:22:28 +00:00
luguohong
6465e29536 BACKPORT: HID: input: map battery system charging
HID descriptors with Battery System (0x85) Charging (0x44) usage are
ignored and POWER_SUPPLY_STATUS_DISCHARGING is always reported to user
space, even when the device is charging.

Map this usage and when it is reported set the right charging status.

In addition, add KUnit tests to make sure that the charging status is
correctly set and reported. They can be run with the usual command:

    $ ./tools/testing/kunit/kunit.py run --kunitconfig=drivers/hid

Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Bug: 305125317
Change-Id: Iad6a8177ad6954ad8ac2b714cc35acffcf2f226f
(cherry picked from commit a608dc1c06)
Signed-off-by: luguohong <luguohong@xiaomi.corp-partner.google.com>
2023-12-01 19:04:48 +00:00
Paul Lawrence
cfdfc17a46 ANDROID: fuse-bpf: Ignore readaheads unless they go to the daemon
readpages will be triggered on the fuse fs in passthrough mode though
system calls like fadvise. If the daemon isn't aware of the file, this
will likely cause a hang.

For the moment, simply ignore fadvise in this situation

Bug: 301201239
Test: fuse_test, atest ScopedStorageDeviceTest both pass
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: I524a84aeeb1b1593e51264fcc37f7cfa66757168
2023-12-01 18:11:28 +00:00
Jaegeuk Kim
354b1b716c FROMGIT: f2fs: skip adding a discard command if exists
When recovering zoned UFS, sometimes we add the same zone to discard multiple
times. Simple workaround is to bypass adding it.

Reviewed-by: Chao Yu <chao@kernel.org>
Change-Id: Ic1501caa02aea8bdc9d7f00a8bd0d35be2ef4ba1
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit bbd3efed3383e332191c665786c61653826d2ac3
 https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev)
2023-11-30 12:27:28 -08:00
Daeho Jeong
ccbea4f458 UPSTREAM: f2fs: clean up zones when not successfully unmounted
We can't trust write pointers when the previous mount was not
successfully unmounted.

Change-Id: If67696db9ab820a805711b43cabb50c796c9f75f
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 9f792ab8e33de727993bbd84ece892e72de18c85)
2023-11-30 12:25:22 -08:00
Daeho Jeong
88cccede6d UPSTREAM: f2fs: use finish zone command when closing a zone
Use the finish zone command first when a zone should be closed.

Change-Id: Ie38800c2787392980f7914ad10b5f92f6d59e99b
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 3b71661214)
2023-11-30 12:24:46 -08:00
Daeho Jeong
b2d3a555d3 UPSTREAM: f2fs: check zone write pointer points to the end of zone
We don't need to report an issue, when the zone write pointer already
points to the end of the zone, since the zone mismatch is already taken
care.

Change-Id: Ifc967abe44521cd239ebac509353c25e36cc7a18
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit c9667b19e2)
2023-11-30 12:24:00 -08:00
Daeho Jeong
c9e29a0073 UPSTREAM: f2fs: close unused open zones while mounting
Zoned UFS allows only 6 open zones at the same time, so we need to take
care of the count of open zones while mounting.

Change-Id: Ie197b9e9e47b3397446ce2cf97168c9f68fea431
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 04abeb699d)
2023-11-30 12:23:09 -08:00
Daeho Jeong
e92b866e22 UPSTREAM: f2fs: maintain six open zones for zoned devices
To keep six open zone constraints, make them not to be open over six
open zones.

Change-Id: If5d02581073f90db4cadd8f928cef9abc5bac8a7
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit e067dc3c6b)
2023-11-30 12:20:46 -08:00
Fangzheng Zhang
088f228370 ANDROID: update symbol for unisoc whitelist
Add kmalloc_large_order_alloced

1 function symbol(s) added
  'int __traceiter_android_vh_kmalloc_large_alloced(void*, struct page*, unsigned int, gfp_t)'

1 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_kmalloc_large_alloced'

Bug: 312897430
Change-Id: I586956fb3cef3d9c5dde63f08de9ed46715163c6
Signed-off-by: Fangzheng Zhang <fangzheng.zhang@unisoc.com>
2023-11-30 18:19:39 +00:00
Fangzheng Zhang
aa71a02cf3 ANDROID: vendor_hooks: mm: add hook to count the number pages
allocated for each slab

Add the tracing interface on the kmalloc_large allocation path,
which can detect the number of pages allocated by the slab,
and if exceeds a threshold, trigger a panic or other actions.

Bug: 312897430
Change-Id: I5575d0e4f91dab1c6e074f3e907fee8ea9327fd7
Signed-off-by: Fangzheng Zhang <fangzheng.zhang@unisoc.com>
2023-11-30 18:19:39 +00:00
Rick Yiu
4326c78f84 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - __traceiter_android_rvh_set_user_nice_locked
  - __tracepoint_android_rvh_set_user_nice_locked

Bug: 300872872
Change-Id: I370d51175efc5ac1bf997bc2425cff8ab00b9b19
Signed-off-by: Rick Yiu <rickyiu@google.com>
2023-11-30 18:18:44 +00:00
Rick Yiu
eb67f58322 ANDROID: sched: Add trace_android_rvh_set_user_nice_locked
We will need vendor hook of set_user_nice with lock to avoid race
condition.

Bug: 300872872
Change-Id: I24fc1e13cc6578dcc418d956a5146ad29ff76a56
Signed-off-by: Rick Yiu <rickyiu@google.com>
2023-11-30 18:18:44 +00:00
yixuanjiang
855511173d UPSTREAM: ASoC: soc-compress: Fix deadlock in soc_compr_open_fe
[ Upstream commit 2222214749 ]

Modify the error handling flow by release lock.
The require mutex will keep holding if open fail.

Fixes: aa9ff6a495 ("ASoC: soc-compress: Reposition and add pcm_mutex")
Signed-off-by: yixuanjiang <yixuanjiang@google.com>
Link: https://lore.kernel.org/r/20230619033127.2522477-1-yixuanjiang@google.com
Signed-off-by: Mark Brown <broonie@kernel.org>

Bug: 303236405
Change-Id: I64172b9d40b061239c7e4087f34759c3b23cfa6a
Signed-off-by: Yixuan Jiang <yixuanjiang@google.com>
2023-11-30 18:09:27 +00:00
Kuninori Morimoto
6cb2109589 BACKPORT: ASoC: add snd_soc_card_mutex_lock/unlock()
ASoC need to use card->mutex with _INIT or _RUNTIME,
but there is no helper function for it.

This patch adds its helper function and use it.

Because people might misunderstand that _init() is mutex initialization,
this patch renames _INIT to _ROOT and adds new
snd_soc_card_mutex_lock_root() for it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87a5zlx3tw.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>

Bug: 303236405
(cherry picked from commit 0f3b818486)
[ Yixuan Jiang: Fix minor conflict ]
Change-Id: Ie8cd7aeeea759576423760d25b5fb5b2c9ae0d12
Signed-off-by: Yixuan Jiang <yixuanjiang@google.com>
2023-11-30 18:09:27 +00:00
Kuninori Morimoto
edfef8fdc9 BACKPORT: ASoC: expand snd_soc_dpcm_mutex_lock/unlock()
soc-pcm.c has snd_soc_dpcm_mutex_lock/unlock(),
but other files can't use it because it is static function.

It requests snd_soc_pcm_runtime as parameter (A), but sometimes we
want to use it by snd_soc_card (B).

(A)	static inline void snd_soc_dpcm_mutex_lock(struct snd_soc_pcm_runtime *rtd)
	{
		mutex_lock_nested(&rtd->card->pcm_mutex, rtd->card->pcm_subclass);
	}			   ^^^^^^^^^

(B)	mutex_lock_nested(&card->pcm_mutex, card->pcm_subclass);
			   ^^^^

We want to use it with both "rtd" and "card" for dapm lock/unlock.
To enable it, this patch uses _Generic macro.

This patch makes snd_soc_dpcm_mutex_{un}lock() global function, and use it on
each files.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87bkk1x3ud.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>

Bug: 303236405
(cherry picked from commit 38e42f6d6c)
[ Yixuan Jiang: Fix minor conflict ]
Change-Id: Id942841c7ca1642b44b1229a7bf4ab1bc5373707
Signed-off-by: Yixuan Jiang <yixuanjiang@google.com>
2023-11-30 18:09:27 +00:00
Kuninori Morimoto
52771d9792 BACKPORT: ASoC: expand snd_soc_dapm_mutex_lock/unlock()
soc.h has snd_soc_dapm_mutex_lock/unlock() definition and
many drivers are using it, but soc-dapm.c is not.

1st reason is snd_soc_dapm_mutex_lock/unlock() requests
snd_soc_dapm_context pointer as parameter (A), but sometimes soc-dapm.c
needs to use snd_soc_card (B).

(A)	static inline void snd_soc_dapm_mutex_lock(struct snd_soc_dapm_context *dapm)
	{
		mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
	}			   ^^^^^^^^^^

(B)	mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
			   ^^^^

2nd reason is it want to use SND_SOC_DAPM_CLASS_INIT for mutex_lock_nested(),
but helper is using _RUNTIME (A).

The conclusion is we want to use "dapm vs card" and "_RUNTIME vs _INIT"
for dapm lock/unlock. To enable this selfish request, this patch uses
_Generic macro. We can use snd_soc_dapm_mutex_lock/unlock() for both
dapm and card case.

	snd_soc_dapm_mutex_lock(dapm);	snd_soc_dapm_mutex_unlock(dapm);
	snd_soc_dapm_mutex_lock(card);	snd_soc_dapm_mutex_unlock(card);

Current soc-dapm.c is using both mutex_lock() and mutex_lock_nested().
This patch handles mutex_lock() as mutex_lock_nested(..., 0),
in other words, handles below as same.

	mutex_lock(&card->dapm_mutex);
	mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_INIT);

Because people might misunderstand that _init() is mutex initialization,
this patch renames _INIT to _ROOT and adds new
snd_soc_dapm_mutex_lock_root() for it.

This patch also moves snd_soc_dapm_subclass definition from soc-dapm.h
to soc.h to keep related code together.

Because very complex soc.h vs soc-dapm.h relationship,
it is difficult/impossible to define these helper into soc-dapm.h.

Change-Id: I064718bbad9d053a0c84549be0a5e942f29a5dee
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87cz4hx3v0.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>

Bug: 303236405
(cherry picked from commit 4a778bdc7a)
[ Yixuan Jiang: Fix minor conflict ]
Change-Id: I0fa12ec9272847c320ccdb0d69eceb2a03853d4e
Signed-off-by: Yixuan Jiang <yixuanjiang@google.com>
2023-11-30 18:09:27 +00:00
Greg Kroah-Hartman
dc61d0ccd6 Merge "Merge tag 'android14-6.1.57_r00' into branch 'android14-6.1'" into android14-6.1 2023-11-30 10:20:44 +00:00
Chungkai Mei
ceb6ff1a69 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - __traceiter_android_rvh_update_load_sum
  - __tracepoint_android_rvh_update_load_sum

Bug: 181105055
Change-Id: Ie70d640f252f40af86aff48bcf2d5cfd80485393
Signed-off-by: Chungkai Mei <chungkai@google.com>
2023-11-29 21:33:45 +00:00
Chungkai Mei
0d97bca80a ANDROID: sched: Add vendor hook for update_load_sum
vendor may have the need to modify update_load_sum function

Bug: 181105055
Change-Id: I35964977a4b8917c62773d48a37340f880774e38
Signed-off-by: Chungkai Mei <chungkai@google.com>
(cherry picked from commit 984523c368)
2023-11-29 21:33:45 +00:00
Elliot Berman
eba89bbb6f FROMGIT: freezer,sched: clean saved_state when restoring it during thaw
Clean saved_state after using it during thaw. Cleaning the saved_state
allows us to avoid some unnecessary branches in ttwu_state_match.

Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20231120-freezer-state-multiple-thaws-v1-2-f2e1dd7ce5a2@quicinc.com

Bug: 292064955
Bug: 312992017
(cherry picked from commit 418146e39891ef1fb2284dee4cabbfe616cd21cf
 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git sched/core)
Change-Id: I245593122edecb1dc9c354c36b59da057d4f4e00
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-11-29 20:08:28 +00:00
Elliot Berman
2a5c5d7c47 FROMGIT: freezer,sched: do not restore saved_state of a thawed task
It is possible for a task to be thawed multiple times when mixing the
*legacy* cgroup freezer and system-wide freezer. To do this, freeze the
cgroup, do system-wide freeze/thaw, then thaw the cgroup. When this
happens, then a stale saved_state can be written to the task's state
and cause task to hang indefinitely. Fix this by only trying to thaw
tasks that are actually frozen.

This change also has the marginal benefit avoiding unnecessary
wake_up_state(p, TASK_FROZEN) if we know the task is already thawed.
There is not possibility of time-of-compare/time-of-use race when we skip
the wake_up_state because entering/exiting TASK_FROZEN is guarded by
freezer_lock.

Fixes: 8f0eed4a78a8 ("freezer,sched: Use saved_state to reduce some spurious wakeups")
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Abhijeet Dharmapurikar <quic_adharmap@quicinc.com>
Link: https://lore.kernel.org/r/20231120-freezer-state-multiple-thaws-v1-1-f2e1dd7ce5a2@quicinc.com

Bug: 292064955
Bug: 312992017
(cherry picked from commit 23ab79e8e469e2605beec2e3ccb40d19c68dd2e0
 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git sched/urgent)
Change-Id: I09cb09a3ef3641c71e3b3156bc3a9a3e69d4966e
Signed-off-by: Qi Feng <fengqi@xiaomi.corp-partner.google.com>
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-11-29 20:08:28 +00:00
Junho Cha
6e3127c7ba ANDROID: GKI: add allowed list for Exynosauto SoC
This patch adds GKI symbol list for Exynosauto SoC.
We need to add below 3 function symbols and it required
by DP MST of DRM(Direct Rendering Manager) driver.

3 function symbol(s) added
  'int drm_connector_set_path_property(struct drm_connector*, const char*)'
  'int drm_helper_probe_detect(struct drm_connector*, struct drm_modeset_acquire_ctx*, bool)'
  'int of_graph_get_endpoint_count(const struct device_node*)'

Bug: 313751443
Change-Id: I3a7e212f598d50f21ee2272ccb18ceaa5af72f42
Signed-off-by: Junho Cha <junhomax.cha@samsung.com>
2023-11-29 19:33:55 +00:00
Vincent Donnefort
af85ead8ce ANDROID: KVM: arm64: pkvm_module_ops documentation
This structure is at the heart of the module support for pKVM. Add a
description to help anyone trying to create a module.

Bug: 312200309
Change-Id: Ie1d9043a6a94d15dd8ef25c6f0f8d442da26bc1f
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-11-29 15:43:49 +00:00
Jia-Shiuan Chen
c331f5b7af ANDROID: Update the ABI symbol list
Adding the following symbols:
  - dma_fence_array_create

Bug: 313783640
Change-Id: I8183d866dec9d9043509578f6267dc7198477767
Signed-off-by: Jia-Shiuan Chen <chenjs@google.com>
2023-11-29 10:44:27 +00:00
Jimmy Hu
bcb7dfe013 UPSTREAM: usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
It is possible that typec_register_partner() returns ERR_PTR on failure.
When port->partner is an error, a NULL pointer dereference may occur as
shown below.

[91222.095236][  T319] typec port0: failed to register partner (-17)
...
[91225.061491][  T319] Unable to handle kernel NULL pointer dereference
at virtual address 000000000000039f
[91225.274642][  T319] pc : tcpm_pd_data_request+0x310/0x13fc
[91225.274646][  T319] lr : tcpm_pd_data_request+0x298/0x13fc
[91225.308067][  T319] Call trace:
[91225.308070][  T319]  tcpm_pd_data_request+0x310/0x13fc
[91225.308073][  T319]  tcpm_pd_rx_handler+0x100/0x9e8
[91225.355900][  T319]  kthread_worker_fn+0x178/0x58c
[91225.355902][  T319]  kthread+0x150/0x200
[91225.355905][  T319]  ret_from_fork+0x10/0x30

Add a check for port->partner to avoid dereferencing a NULL pointer.

Fixes: 5e1d4c49fb ("usb: typec: tcpm: Determine common SVDM Version")
Cc: stable@vger.kernel.org
Signed-off-by: Jimmy Hu <hhhuuu@google.com>
Link: https://lore.kernel.org/r/20231020012132.100960-1-hhhuuu@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 280207787
(cherry picked from commit 4987daf86c152ff882d51572d154ad12e4ff3a4b)
Change-Id: I609640ff70258b8fd0e7f9eaad9eb60db35ccfad
Signed-off-by: Kyle Tso <kyletso@google.com>
2023-11-29 06:58:14 +00:00
liwei
61ca1246d9 ANDROID: GKI: Update oplus symbol list
add four symbol to oplus symbol list, which already EXPORTED
1. static_key_enable
2. static_key_disable
3. __traceiter_android_vh_alloc_pages_slowpath
4. __tracepoint_android_vh_alloc_pages_slowpath

Bug: 312913816
Change-Id: I2c5776c4b58b8b50e7e4c245492614412042cf9d
Signed-off-by: liwei <liwei1234@oppo.com>
2023-11-28 18:28:02 +00:00
Wander Lairson Costa
d3787b952a UPSTREAM: drm/qxl: fix UAF on handle creation
commit c611589b42 upstream.

qxl_mode_dumb_create() dereferences the qobj returned by
qxl_gem_object_create_with_handle(), but the handle is the only one
holding a reference to it.

A potential attacker could guess the returned handle value and closes it
between the return of qxl_gem_object_create_with_handle() and the qobj
usage, triggering a use-after-free scenario.

Reproducer:

int dri_fd =-1;
struct drm_mode_create_dumb arg = {0};

void gem_close(int handle);

void* trigger(void* ptr)
{
	int ret;
	arg.width = arg.height = 0x20;
	arg.bpp = 32;
	ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &arg);
	if(ret)
	{
		perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed");
		exit(-1);
	}
	gem_close(arg.handle);
	while(1) {
		struct drm_mode_create_dumb args = {0};
		args.width = args.height = 0x20;
		args.bpp = 32;
		ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &args);
		if (ret) {
			perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed");
			exit(-1);
		}

		printf("[*] DRM_IOCTL_MODE_CREATE_DUMB created, %d\n", args.handle);
		gem_close(args.handle);
	}
	return NULL;
}

void gem_close(int handle)
{
	struct drm_gem_close args;
	args.handle = handle;
	int ret = ioctl(dri_fd, DRM_IOCTL_GEM_CLOSE, &args); // gem close handle
	if (!ret)
		printf("gem close handle %d\n", args.handle);
}

int main(void)
{
	dri_fd= open("/dev/dri/card0", O_RDWR);
	printf("fd:%d\n", dri_fd);

	if(dri_fd == -1)
		return -1;

	pthread_t tid1;

	if(pthread_create(&tid1,NULL,trigger,NULL)){
		perror("[*] thread_create tid1\n");
		return -1;
	}
	while (1)
	{
		gem_close(arg.handle);
	}
	return 0;
}

This is a KASAN report:

==================================================================
BUG: KASAN: slab-use-after-free in qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69
Write of size 1 at addr ffff88801136c240 by task poc/515

CPU: 1 PID: 515 Comm: poc Not tainted 6.3.0 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
Call Trace:
<TASK>
__dump_stack linux/lib/dump_stack.c:88
dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106
print_address_description linux/mm/kasan/report.c:319
print_report+0xd2/0x660 linux/mm/kasan/report.c:430
kasan_report+0xd2/0x110 linux/mm/kasan/report.c:536
__asan_report_store1_noabort+0x17/0x30 linux/mm/kasan/report_generic.c:383
qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120
RIP: 0033:0x7ff5004ff5f7
Code: 00 00 00 48 8b 05 99 c8 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 69 c8 0d 00 f7 d8 64 89 01 48

RSP: 002b:00007ff500408ea8 EFLAGS: 00000286 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff5004ff5f7
RDX: 00007ff500408ec0 RSI: 00000000c02064b2 RDI: 0000000000000003
RBP: 00007ff500408ef0 R08: 0000000000000000 R09: 000000000000002a
R10: 0000000000000000 R11: 0000000000000286 R12: 00007fff1c6cdafe
R13: 00007fff1c6cdaff R14: 00007ff500408fc0 R15: 0000000000802000
</TASK>

Allocated by task 515:
kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45
kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52
kasan_save_alloc_info+0x1e/0x40 linux/mm/kasan/generic.c:510
____kasan_kmalloc linux/mm/kasan/common.c:374
__kasan_kmalloc+0xc3/0xd0 linux/mm/kasan/common.c:383
kasan_kmalloc linux/./include/linux/kasan.h:196
kmalloc_trace+0x48/0xc0 linux/mm/slab_common.c:1066
kmalloc linux/./include/linux/slab.h:580
kzalloc linux/./include/linux/slab.h:720
qxl_bo_create+0x11a/0x610 linux/drivers/gpu/drm/qxl/qxl_object.c:124
qxl_gem_object_create+0xd9/0x360 linux/drivers/gpu/drm/qxl/qxl_gem.c:58
qxl_gem_object_create_with_handle+0xa1/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:89
qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120

Freed by task 515:
kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45
kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x60 linux/mm/kasan/generic.c:521
____kasan_slab_free linux/mm/kasan/common.c:236
____kasan_slab_free+0x180/0x1f0 linux/mm/kasan/common.c:200
__kasan_slab_free+0x12/0x30 linux/mm/kasan/common.c:244
kasan_slab_free linux/./include/linux/kasan.h:162
slab_free_hook linux/mm/slub.c:1781
slab_free_freelist_hook+0xd2/0x1a0 linux/mm/slub.c:1807
slab_free linux/mm/slub.c:3787
__kmem_cache_free+0x196/0x2d0 linux/mm/slub.c:3800
kfree+0x78/0x120 linux/mm/slab_common.c:1019
qxl_ttm_bo_destroy+0x140/0x1a0 linux/drivers/gpu/drm/qxl/qxl_object.c:49
ttm_bo_release+0x678/0xa30 linux/drivers/gpu/drm/ttm/ttm_bo.c:381
kref_put linux/./include/linux/kref.h:65
ttm_bo_put+0x50/0x80 linux/drivers/gpu/drm/ttm/ttm_bo.c:393
qxl_gem_object_free+0x3e/0x60 linux/drivers/gpu/drm/qxl/qxl_gem.c:42
drm_gem_object_free+0x5c/0x90 linux/drivers/gpu/drm/drm_gem.c:974
kref_put linux/./include/linux/kref.h:65
__drm_gem_object_put linux/./include/drm/drm_gem.h:431
drm_gem_object_put linux/./include/drm/drm_gem.h:444
qxl_gem_object_create_with_handle+0x151/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:100
qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120

The buggy address belongs to the object at ffff88801136c000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 576 bytes inside of
freed 1024-byte region [ffff88801136c000, ffff88801136c400)

The buggy address belongs to the physical page:
page:0000000089fc329b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11368
head:0000000089fc329b order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0010200 ffff888007841dc0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff88801136c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801136c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801136c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801136c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801136c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Disabling lock debugging due to kernel taint

Instead of returning a weak reference to the qxl_bo object, return the
created drm_gem_object and let the caller decrement the reference count
when it no longer needs it. As a convenience, if the caller is not
interested in the gobj object, it can pass NULL to the parameter and the
reference counting is descremented internally.

The bug and the reproducer were originally found by the Zero Day Initiative project (ZDI-CAN-20940).

Bug: 311571057
Link: https://www.zerodayinitiative.com/
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230814165119.90847-1-wander@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit d578c919de)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If0e6ae00dd7e90f938beff9c6992ea37ba7bc4fa
2023-11-28 14:34:24 +00:00
Jayant Chowdhary
a2377cc135 FROMGIT: usb:gadget:uvc Do not use worker thread to pump isoc usb requests
When we use an async work queue to perform the function of pumping
usb requests to the usb controller, it is possible that amongst other
factors, thread scheduling affects at what cadence we're able to pump
requests. This could mean isoc usb requests miss their uframes - resulting
in video stream flickers on the host device.

To avoid this, we make the async_wq thread only produce isoc usb_requests
with uvc buffers encoded into them. The process of queueing to the
endpoint is done by the uvc_video_complete() handler. In case no
usb_requests are ready with encoded information, we just queue a zero
length request to the endpoint from the complete handler.

For bulk endpoints the async_wq thread still queues usb requests to the
endpoint.

Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: Jayant Chowdhary <jchowdhary@google.com>
Suggested-by: Avichal Rakesh <arakesh@google.com>
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20231120062026.3759463-1-jchowdhary@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 301915972
(cherry picked from commit 6acba0345b68772830582ca1ca369a2f45631275
 https://kernel.googlesource.com/pub/scm/linux/kernel/git/gregkh/usb usb-next)
Change-Id: I5597cc29e9caec69e4f3575938d7d640857aaa28
Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-11-28 02:26:06 +00:00