Commit Graph

1156173 Commits

Author SHA1 Message Date
Android Build Coastguard Worker
97abf17308 Snap for 11249489 from 26b11a5c3a to android14-6.1-keystone-qcom-release
Change-Id: I1aee969e2cf11e226fc3979c1c056651e22bdf77
Signed-off-by: Coastguard Worker <android-build-coastguard-worker@google.com>
2023-12-22 09:01:18 +00:00
keystone-kernel-automerger
26b11a5c3a Merge android14-6.1-2023-11_r3 into HEAD
* commit 'a2fa77d36d26b574cffec6766df50a711f305450':
  ANDROID: GKI: Update symbol list for mtk
  FROMGIT: freezer,sched: clean saved_state when restoring it during thaw
  FROMGIT: freezer,sched: do not restore saved_state of a thawed task

Change-Id: I6bd2084838d02f0a1b9d03cc644bc81a1992608d
Signed-off-by: keystone-kernel-automerger <keystone-kernel-automerger@google.com>
2023-12-21 07:30:31 +00:00
Android Build Coastguard Worker
41f211a206 Snap for 11227771 from 027d47e0e0 to android14-6.1-keystone-qcom-release
Change-Id: I66a20ca893c842a8ccec5ea48bd1c2b9644ed42e
2023-12-17 09:20:47 +00:00
Omkar Sai Sandeep Katadi
027d47e0e0 Merge remote-tracking branch into HEAD
* keystone/mirror-android14-6.1-2023-12: (2159 commits)
  ANDROID: Update the ABI symbol list
  ANDROID: GKI: Update symbol list for mtk
  ANDROID: mm: lru_cache_disable skips lru cache drainnig
  ANDROID: mm: cma: introduce __cma_alloc API
  ANDROID: Update the ABI representation
  BACKPORT: fscrypt: support crypto data unit size less than filesystem block size
  UPSTREAM: netfilter: nf_tables: remove catchall element in GC sync path
  ANDROID: GKI: Update oplus symbol list
  ANDROID: vendor_hooks: export tracepoint symbol trace_mm_vmscan_kswapd_wake
  BACKPORT: HID: input: map battery system charging
  ANDROID: fuse-bpf: Ignore readaheads unless they go to the daemon
  FROMGIT: f2fs: skip adding a discard command if exists
  UPSTREAM: f2fs: clean up zones when not successfully unmounted
  UPSTREAM: f2fs: use finish zone command when closing a zone
  UPSTREAM: f2fs: check zone write pointer points to the end of zone
  UPSTREAM: f2fs: close unused open zones while mounting
  UPSTREAM: f2fs: maintain six open zones for zoned devices
  ANDROID: update symbol for unisoc whitelist
  ANDROID: vendor_hooks: mm: add hook to count the number pages allocated for each slab
  ANDROID: Update the ABI symbol list
  ...

Change-Id: I9c0a3423376524b5392f0670c27fb0515fec3407
Signed-off-by: Omkar Sai Sandeep Katadi <okatadi@google.com>
2023-12-15 20:22:18 +00:00
Todd Kjos
9695e7a856 ANDROID: Initialize android14-6.1-2023-12
Bug: 313544059
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: Idacd3dded4e7322c79f96579f5db679b93e82665
2023-12-08 16:17:44 +00:00
Seiya Wang
a2fa77d36d ANDROID: GKI: Update symbol list for mtk
ABI impact

8 function symbol(s) added
  'struct mii_bus* devm_mdiobus_alloc_size(struct device*, int)'
  'struct phy_device* of_phy_get_and_connect(struct net_device*, struct device_node*, void(*)(struct net_device*))'
  'int pci_enable_device_mem(struct pci_dev*)'
  'int pci_prepare_to_sleep(struct pci_dev*)'
  'int pci_select_bars(struct pci_dev*, unsigned long)'
  'void phy_support_asym_pause(struct phy_device*)'
  'int ptp_find_pin(struct ptp_clock*, enum ptp_pin_function, unsigned int)'
  'int ptp_schedule_worker(struct ptp_clock*, unsigned long)'

1 variable symbol(s) added
  'struct efi efi'

Add following symbols

devm_alloc_etherdev_mqs
devm_mdiobus_alloc_size
efi
eth_prepare_mac_addr_change
of_get_mac_address
of_phy_get_and_connect
pci_disable_msi
pci_disable_msix
pci_enable_device_mem
pci_enable_msi
pci_enable_msix_range
pci_prepare_to_sleep
pci_release_selected_regions
pci_request_selected_regions
pci_select_bars
pci_set_power_state
phy_connect_direct
phy_ethtool_get_eee
phy_ethtool_get_wol
phy_ethtool_set_eee
phy_ethtool_set_wol
phy_find_first
phy_init_eee
phy_mii_ioctl
phy_remove_link_mode
phy_start_aneg
phy_support_asym_pause
ptp_clock_event
ptp_clock_index
ptp_clock_register
ptp_clock_unregister
ptp_find_pin
ptp_schedule_worker

Bug: 315023870
Bug: 315397227
Signed-off-by: Seiya Wang <seiya.wang@mediatek.com>
Change-Id: I046b656fe9049a701ca6a440111eb4bfa420cf52
(cherry picked from commit 3c9cb9c06f)
2023-12-08 05:08:10 +00:00
Taylor Nelms
c9b5c232e7 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - devm_drm_of_get_bridge
  - drm_kms_helper_connector_hotplug_event
  - of_find_mipi_dsi_host_by_node
  - of_get_parent
  - of_graph_get_remote_node

1 function symbol(s) added
  'void drm_kms_helper_connector_hotplug_event(struct drm_connector*)'

Bug: 303500701
Change-Id: Ief76bed701a62cb89cad78cc3d141ee6c6a84dad
Signed-off-by: Taylor Nelms <tknelms@google.com>
2023-12-07 19:24:02 +00:00
Seiya Wang
3c9cb9c06f ANDROID: GKI: Update symbol list for mtk
ABI impact

8 function symbol(s) added
  'struct mii_bus* devm_mdiobus_alloc_size(struct device*, int)'
  'struct phy_device* of_phy_get_and_connect(struct net_device*, struct device_node*, void(*)(struct net_device*))'
  'int pci_enable_device_mem(struct pci_dev*)'
  'int pci_prepare_to_sleep(struct pci_dev*)'
  'int pci_select_bars(struct pci_dev*, unsigned long)'
  'void phy_support_asym_pause(struct phy_device*)'
  'int ptp_find_pin(struct ptp_clock*, enum ptp_pin_function, unsigned int)'
  'int ptp_schedule_worker(struct ptp_clock*, unsigned long)'

1 variable symbol(s) added
  'struct efi efi'

Add following symbols

devm_alloc_etherdev_mqs
devm_mdiobus_alloc_size
efi
eth_prepare_mac_addr_change
of_get_mac_address
of_phy_get_and_connect
pci_disable_msi
pci_disable_msix
pci_enable_device_mem
pci_enable_msi
pci_enable_msix_range
pci_prepare_to_sleep
pci_release_selected_regions
pci_request_selected_regions
pci_select_bars
pci_set_power_state
phy_connect_direct
phy_ethtool_get_eee
phy_ethtool_get_wol
phy_ethtool_set_eee
phy_ethtool_set_wol
phy_find_first
phy_init_eee
phy_mii_ioctl
phy_remove_link_mode
phy_start_aneg
phy_support_asym_pause
ptp_clock_event
ptp_clock_index
ptp_clock_register
ptp_clock_unregister
ptp_find_pin
ptp_schedule_worker

Bug: 315023870
Signed-off-by: Seiya Wang <seiya.wang@mediatek.com>
Change-Id: I046b656fe9049a701ca6a440111eb4bfa420cf52
2023-12-06 19:32:59 +00:00
Richard Chang
5723833390 ANDROID: mm: lru_cache_disable skips lru cache drainnig
lru_cache_disable is not trivial cost since it should run work
from every cores in the system. Thus, repeated call of the
function whenever alloc_contig_range in the cma's allocation loop
is called is expensive.

This patch makes the lru_cache_disable smarter in that it will
not run __lru_add_drain_all since it knows the cache was already
disabled by someone else.
With that, user of alloc_contig_range can disable the lru cache
in advance in their context so that subsequent alloc_contig_range
for user's operation will avoid the costly function call.

Bug: 313795505
Change-Id: Icbb0e6dbf74644d45f562fd1d845888ca1f1f347
Signed-off-by: Richard Chang <richardycc@google.com>
(cherry picked from commit 816567b17866ca3f9a11e670bd52c82335cbb448)
2023-12-06 18:54:20 +00:00
Richard Chang
0de2f42977 ANDROID: mm: cma: introduce __cma_alloc API
This patch enhances the CMA API with support for failfast mode,
utilizing the __GFP_NORETRY flag. This mode is specifically designed
for high-order bulk allocation scenarios, enabling the CMA API to
avoid prolonged stalls resulting from blocking pages such as those
undergoing page writeback or page locking. Instead of stalling, the
API will continue searching for readily migratable pages across
different pageblocks.

The original patch link:
Link: https://lore.kernel.org/linux-mm/YAnM5PbNJZlk%2F%2FiX@google.com/T/#m36b144ff81fe0a8f0ecaf6813de4819ecc41f8fe

Bug: 308881290
Change-Id: I1c623f17fb49c26005aaffc17330cf820ce6585c
Signed-off-by: Richard Chang <richardycc@google.com>
(cherry picked from commit 3390547fec36527ed15dd213ee55d397f83ffa46)
2023-12-06 18:54:20 +00:00
Eric Biggers
db9d7ba706 ANDROID: Update the ABI representation
INFO: type 'struct fscrypt_info' changed
  member 'u8 ci_data_unit_bits' was added
  member 'u8 ci_data_units_per_block_bits' was added

type 'struct fscrypt_policy_v2' changed
  member '__u8 log2_data_unit_size' was added
  member changed from '__u8 __reserved[4]' to '__u8 __reserved[3]'
    offset changed from 32 to 40
    type changed from '__u8[4]' to '__u8[3]'
      number of elements changed from 4 to 3

Bug: 299136786
Bug: 302588300
Change-Id: Idbbc2123961a41d395323c72cef67d94bdd17ab0
Signed-off-by: Eric Biggers <ebiggers@google.com>
2023-12-06 17:54:14 +00:00
Eric Biggers
6b972d6047 BACKPORT: fscrypt: support crypto data unit size less than filesystem block size
Until now, fscrypt has always used the filesystem block size as the
granularity of file contents encryption.  Two scenarios have come up
where a sub-block granularity of contents encryption would be useful:

1. Inline crypto hardware that only supports a crypto data unit size
   that is less than the filesystem block size.

2. Support for direct I/O at a granularity less than the filesystem
   block size, for example at the block device's logical block size in
   order to match the traditional direct I/O alignment requirement.

(1) first came up with older eMMC inline crypto hardware that only
supports a crypto data unit size of 512 bytes.  That specific case
ultimately went away because all systems with that hardware continued
using out of tree code and never actually upgraded to the upstream
inline crypto framework.  But, now it's coming back in a new way: some
current UFS controllers only support a data unit size of 4096 bytes, and
there is a proposal to increase the filesystem block size to 16K.

(2) was discussed as a "nice to have" feature, though not essential,
when support for direct I/O on encrypted files was being upstreamed.

Still, the fact that this feature has come up several times does suggest
it would be wise to have available.  Therefore, this patch implements it
by using one of the reserved bytes in fscrypt_policy_v2 to allow users
to select a sub-block data unit size.  Supported data unit sizes are
powers of 2 between 512 and the filesystem block size, inclusively.
Support is implemented for both the FS-layer and inline crypto cases.

This patch focuses on the basic support for sub-block data units.  Some
things are out of scope for this patch but may be addressed later:

- Supporting sub-block data units in combination with
  FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64, in most cases.  Unfortunately this
  combination usually causes data unit indices to exceed 32 bits, and
  thus fscrypt_supported_policy() correctly disallows it.  The users who
  potentially need this combination are using f2fs.  To support it, f2fs
  would need to provide an option to slightly reduce its max file size.

- Supporting sub-block data units in combination with
  FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32.  This has the same problem
  described above, but also it will need special code to make DUN
  wraparound still happen on a FS block boundary.

- Supporting use case (2) mentioned above.  The encrypted direct I/O
  code will need to stop requiring and assuming FS block alignment.
  This won't be hard, but it belongs in a separate patch.

- Supporting this feature on filesystems other than ext4 and f2fs.
  (Filesystems declare support for it via their fscrypt_operations.)
  On UBIFS, sub-block data units don't make sense because UBIFS encrypts
  variable-length blocks as a result of compression.  CephFS could
  support it, but a bit more work would be needed to make the
  fscrypt_*_block_inplace functions play nicely with sub-block data
  units.  I don't think there's a use case for this on CephFS anyway.

Link: https://lore.kernel.org/r/20230925055451.59499-6-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>

Bug: 299136786
Bug: 302588300
(cherry picked from commit 5b11888471806edf699316d4dcb9b426caebbef2)
(Reworked this commit to not change struct fscrypt_operations and not
 depend on other commits that changed struct fscrypt_operations.  Also
 resolved conflicts with the HW-wrapped key support.)
Change-Id: Ic3dc56ef3f42d123f812e9037e2cc6f0b24bacc1
Signed-off-by: Eric Biggers <ebiggers@google.com>
2023-12-06 17:54:14 +00:00
Pablo Neira Ayuso
72bdb74622 UPSTREAM: netfilter: nf_tables: remove catchall element in GC sync path
[ Upstream commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630 ]

The expired catchall element is not deactivated and removed from GC sync
path. This path holds mutex so just call nft_setelem_data_deactivate()
and nft_setelem_catchall_remove() before queueing the GC work.

Bug: 310691882
Fixes: 4a9e12ea7e70 ("netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC")
Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 13e2d49647)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ic5d1d98fe5a749e759869f0789cbb77c4ab5e6c2
2023-12-06 14:44:26 +00:00
Android Build Coastguard Worker
95421a1dc3 Snap for 11181586 from 59e9b82864 to android14-6.1-keystone-qcom-release
Change-Id: I6cffa3470e8a4c757361e45b2b3845d24d34c0f9
2023-12-06 09:50:21 +00:00
liwei
924116f1b8 ANDROID: GKI: Update oplus symbol list
1 function symbol(s) added
  'int __traceiter_mm_vmscan_kswapd_wake(void*, int, int, int)'

1 variable symbol(s) added
  'struct tracepoint __tracepoint_mm_vmscan_kswapd_wake'

Bug: 309352303
Change-Id: Id46347110c482eca8d0fb12bd1dd69a14ad8a337
Signed-off-by: liwei <liwei1234@oppo.com>
2023-12-05 20:22:28 +00:00
liwei
0ad2a3cd4d ANDROID: vendor_hooks: export tracepoint symbol trace_mm_vmscan_kswapd_wake
export tracepoint symbol trace_mm_vmscan_kswapd_wake so we can hook it in our ko
to capture some kswapd running info.

Bug: 309352303
Change-Id: Ieb37f544502f33e708dacda6cbb552792dfbbc6b
Signed-off-by: liwei <liwei1234@oppo.com>
2023-12-05 20:22:28 +00:00
keystone-kernel-automerger
59e9b82864 Merge android14-6.1-2023-11_r2 into HEAD
* commit '4e7b7a37fb50e6432377fe37721fb613c86188e5':
  ANDROID: GKI: Update symbol list for mtk

Change-Id: I89f485901b8fb4809d6f75a11f33912cce721b47
Signed-off-by: keystone-kernel-automerger <keystone-kernel-automerger@google.com>
2023-12-05 07:27:52 +00:00
luguohong
6465e29536 BACKPORT: HID: input: map battery system charging
HID descriptors with Battery System (0x85) Charging (0x44) usage are
ignored and POWER_SUPPLY_STATUS_DISCHARGING is always reported to user
space, even when the device is charging.

Map this usage and when it is reported set the right charging status.

In addition, add KUnit tests to make sure that the charging status is
correctly set and reported. They can be run with the usual command:

    $ ./tools/testing/kunit/kunit.py run --kunitconfig=drivers/hid

Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Bug: 305125317
Change-Id: Iad6a8177ad6954ad8ac2b714cc35acffcf2f226f
(cherry picked from commit a608dc1c06397dc50ab773498433432fb5938f92)
Signed-off-by: luguohong <luguohong@xiaomi.corp-partner.google.com>
2023-12-01 19:04:48 +00:00
Paul Lawrence
cfdfc17a46 ANDROID: fuse-bpf: Ignore readaheads unless they go to the daemon
readpages will be triggered on the fuse fs in passthrough mode though
system calls like fadvise. If the daemon isn't aware of the file, this
will likely cause a hang.

For the moment, simply ignore fadvise in this situation

Bug: 301201239
Test: fuse_test, atest ScopedStorageDeviceTest both pass
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: I524a84aeeb1b1593e51264fcc37f7cfa66757168
2023-12-01 18:11:28 +00:00
Elliot Berman
57bd37b1a6 FROMGIT: freezer,sched: clean saved_state when restoring it during thaw
Clean saved_state after using it during thaw. Cleaning the saved_state
allows us to avoid some unnecessary branches in ttwu_state_match.

Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20231120-freezer-state-multiple-thaws-v1-2-f2e1dd7ce5a2@quicinc.com

Bug: 292064955
Bug: 312992017
(cherry picked from commit 418146e39891ef1fb2284dee4cabbfe616cd21cf
 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git sched/core)
Change-Id: I245593122edecb1dc9c354c36b59da057d4f4e00
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
(cherry picked from commit 9e64014b1a011de2da224743bb25cb7711d8669a)
2023-11-30 15:13:04 -08:00
Elliot Berman
eb72e49034 FROMGIT: freezer,sched: do not restore saved_state of a thawed task
It is possible for a task to be thawed multiple times when mixing the
*legacy* cgroup freezer and system-wide freezer. To do this, freeze the
cgroup, do system-wide freeze/thaw, then thaw the cgroup. When this
happens, then a stale saved_state can be written to the task's state
and cause task to hang indefinitely. Fix this by only trying to thaw
tasks that are actually frozen.

This change also has the marginal benefit avoiding unnecessary
wake_up_state(p, TASK_FROZEN) if we know the task is already thawed.
There is not possibility of time-of-compare/time-of-use race when we skip
the wake_up_state because entering/exiting TASK_FROZEN is guarded by
freezer_lock.

Fixes: 8f0eed4a78a8 ("freezer,sched: Use saved_state to reduce some spurious wakeups")
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Abhijeet Dharmapurikar <quic_adharmap@quicinc.com>
Link: https://lore.kernel.org/r/20231120-freezer-state-multiple-thaws-v1-1-f2e1dd7ce5a2@quicinc.com

Bug: 292064955
Bug: 312992017
(cherry picked from commit 23ab79e8e469e2605beec2e3ccb40d19c68dd2e0
 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git sched/urgent)
Change-Id: I09cb09a3ef3641c71e3b3156bc3a9a3e69d4966e
Signed-off-by: Qi Feng <fengqi@xiaomi.corp-partner.google.com>
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
(cherry picked from commit a99b5a407c561c0157cdc29ef102b10be091b13e)
2023-11-30 15:13:04 -08:00
Jaegeuk Kim
354b1b716c FROMGIT: f2fs: skip adding a discard command if exists
When recovering zoned UFS, sometimes we add the same zone to discard multiple
times. Simple workaround is to bypass adding it.

Reviewed-by: Chao Yu <chao@kernel.org>
Change-Id: Ic1501caa02aea8bdc9d7f00a8bd0d35be2ef4ba1
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit bbd3efed3383e332191c665786c61653826d2ac3
 https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev)
2023-11-30 12:27:28 -08:00
Daeho Jeong
ccbea4f458 UPSTREAM: f2fs: clean up zones when not successfully unmounted
We can't trust write pointers when the previous mount was not
successfully unmounted.

Change-Id: If67696db9ab820a805711b43cabb50c796c9f75f
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 9f792ab8e33de727993bbd84ece892e72de18c85)
2023-11-30 12:25:22 -08:00
Daeho Jeong
88cccede6d UPSTREAM: f2fs: use finish zone command when closing a zone
Use the finish zone command first when a zone should be closed.

Change-Id: Ie38800c2787392980f7914ad10b5f92f6d59e99b
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 3b7166121402a5062d18dcf4e3bce083fb9e4201)
2023-11-30 12:24:46 -08:00
Daeho Jeong
b2d3a555d3 UPSTREAM: f2fs: check zone write pointer points to the end of zone
We don't need to report an issue, when the zone write pointer already
points to the end of the zone, since the zone mismatch is already taken
care.

Change-Id: Ifc967abe44521cd239ebac509353c25e36cc7a18
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit c9667b19e2cf13735fe2620f9d97b788897cd4af)
2023-11-30 12:24:00 -08:00
Daeho Jeong
c9e29a0073 UPSTREAM: f2fs: close unused open zones while mounting
Zoned UFS allows only 6 open zones at the same time, so we need to take
care of the count of open zones while mounting.

Change-Id: Ie197b9e9e47b3397446ce2cf97168c9f68fea431
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 04abeb699ddce800837c4039ea1cc7d4d139bb36)
2023-11-30 12:23:09 -08:00
Daeho Jeong
e92b866e22 UPSTREAM: f2fs: maintain six open zones for zoned devices
To keep six open zone constraints, make them not to be open over six
open zones.

Change-Id: If5d02581073f90db4cadd8f928cef9abc5bac8a7
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit e067dc3c6b9c419bac43c6a0be2d85f44681f863)
2023-11-30 12:20:46 -08:00
Fangzheng Zhang
088f228370 ANDROID: update symbol for unisoc whitelist
Add kmalloc_large_order_alloced

1 function symbol(s) added
  'int __traceiter_android_vh_kmalloc_large_alloced(void*, struct page*, unsigned int, gfp_t)'

1 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_kmalloc_large_alloced'

Bug: 312897430
Change-Id: I586956fb3cef3d9c5dde63f08de9ed46715163c6
Signed-off-by: Fangzheng Zhang <fangzheng.zhang@unisoc.com>
2023-11-30 18:19:39 +00:00
Fangzheng Zhang
aa71a02cf3 ANDROID: vendor_hooks: mm: add hook to count the number pages
allocated for each slab

Add the tracing interface on the kmalloc_large allocation path,
which can detect the number of pages allocated by the slab,
and if exceeds a threshold, trigger a panic or other actions.

Bug: 312897430
Change-Id: I5575d0e4f91dab1c6e074f3e907fee8ea9327fd7
Signed-off-by: Fangzheng Zhang <fangzheng.zhang@unisoc.com>
2023-11-30 18:19:39 +00:00
Rick Yiu
4326c78f84 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - __traceiter_android_rvh_set_user_nice_locked
  - __tracepoint_android_rvh_set_user_nice_locked

Bug: 300872872
Change-Id: I370d51175efc5ac1bf997bc2425cff8ab00b9b19
Signed-off-by: Rick Yiu <rickyiu@google.com>
2023-11-30 18:18:44 +00:00
Rick Yiu
eb67f58322 ANDROID: sched: Add trace_android_rvh_set_user_nice_locked
We will need vendor hook of set_user_nice with lock to avoid race
condition.

Bug: 300872872
Change-Id: I24fc1e13cc6578dcc418d956a5146ad29ff76a56
Signed-off-by: Rick Yiu <rickyiu@google.com>
2023-11-30 18:18:44 +00:00
yixuanjiang
855511173d UPSTREAM: ASoC: soc-compress: Fix deadlock in soc_compr_open_fe
[ Upstream commit 2222214749a9969e09454b9ba7febfdfb09c1c8d ]

Modify the error handling flow by release lock.
The require mutex will keep holding if open fail.

Fixes: aa9ff6a4955f ("ASoC: soc-compress: Reposition and add pcm_mutex")
Signed-off-by: yixuanjiang <yixuanjiang@google.com>
Link: https://lore.kernel.org/r/20230619033127.2522477-1-yixuanjiang@google.com
Signed-off-by: Mark Brown <broonie@kernel.org>

Bug: 303236405
Change-Id: I64172b9d40b061239c7e4087f34759c3b23cfa6a
Signed-off-by: Yixuan Jiang <yixuanjiang@google.com>
2023-11-30 18:09:27 +00:00
Kuninori Morimoto
6cb2109589 BACKPORT: ASoC: add snd_soc_card_mutex_lock/unlock()
ASoC need to use card->mutex with _INIT or _RUNTIME,
but there is no helper function for it.

This patch adds its helper function and use it.

Because people might misunderstand that _init() is mutex initialization,
this patch renames _INIT to _ROOT and adds new
snd_soc_card_mutex_lock_root() for it.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87a5zlx3tw.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>

Bug: 303236405
(cherry picked from commit 0f3b818486796ec8895fa4ccdf15edb759bff40a)
[ Yixuan Jiang: Fix minor conflict ]
Change-Id: Ie8cd7aeeea759576423760d25b5fb5b2c9ae0d12
Signed-off-by: Yixuan Jiang <yixuanjiang@google.com>
2023-11-30 18:09:27 +00:00
Kuninori Morimoto
edfef8fdc9 BACKPORT: ASoC: expand snd_soc_dpcm_mutex_lock/unlock()
soc-pcm.c has snd_soc_dpcm_mutex_lock/unlock(),
but other files can't use it because it is static function.

It requests snd_soc_pcm_runtime as parameter (A), but sometimes we
want to use it by snd_soc_card (B).

(A)	static inline void snd_soc_dpcm_mutex_lock(struct snd_soc_pcm_runtime *rtd)
	{
		mutex_lock_nested(&rtd->card->pcm_mutex, rtd->card->pcm_subclass);
	}			   ^^^^^^^^^

(B)	mutex_lock_nested(&card->pcm_mutex, card->pcm_subclass);
			   ^^^^

We want to use it with both "rtd" and "card" for dapm lock/unlock.
To enable it, this patch uses _Generic macro.

This patch makes snd_soc_dpcm_mutex_{un}lock() global function, and use it on
each files.

Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87bkk1x3ud.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>

Bug: 303236405
(cherry picked from commit 38e42f6d6c6702bbfc633fce9b579fb80cec2d59)
[ Yixuan Jiang: Fix minor conflict ]
Change-Id: Id942841c7ca1642b44b1229a7bf4ab1bc5373707
Signed-off-by: Yixuan Jiang <yixuanjiang@google.com>
2023-11-30 18:09:27 +00:00
Kuninori Morimoto
52771d9792 BACKPORT: ASoC: expand snd_soc_dapm_mutex_lock/unlock()
soc.h has snd_soc_dapm_mutex_lock/unlock() definition and
many drivers are using it, but soc-dapm.c is not.

1st reason is snd_soc_dapm_mutex_lock/unlock() requests
snd_soc_dapm_context pointer as parameter (A), but sometimes soc-dapm.c
needs to use snd_soc_card (B).

(A)	static inline void snd_soc_dapm_mutex_lock(struct snd_soc_dapm_context *dapm)
	{
		mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
	}			   ^^^^^^^^^^

(B)	mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
			   ^^^^

2nd reason is it want to use SND_SOC_DAPM_CLASS_INIT for mutex_lock_nested(),
but helper is using _RUNTIME (A).

The conclusion is we want to use "dapm vs card" and "_RUNTIME vs _INIT"
for dapm lock/unlock. To enable this selfish request, this patch uses
_Generic macro. We can use snd_soc_dapm_mutex_lock/unlock() for both
dapm and card case.

	snd_soc_dapm_mutex_lock(dapm);	snd_soc_dapm_mutex_unlock(dapm);
	snd_soc_dapm_mutex_lock(card);	snd_soc_dapm_mutex_unlock(card);

Current soc-dapm.c is using both mutex_lock() and mutex_lock_nested().
This patch handles mutex_lock() as mutex_lock_nested(..., 0),
in other words, handles below as same.

	mutex_lock(&card->dapm_mutex);
	mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_INIT);

Because people might misunderstand that _init() is mutex initialization,
this patch renames _INIT to _ROOT and adds new
snd_soc_dapm_mutex_lock_root() for it.

This patch also moves snd_soc_dapm_subclass definition from soc-dapm.h
to soc.h to keep related code together.

Because very complex soc.h vs soc-dapm.h relationship,
it is difficult/impossible to define these helper into soc-dapm.h.

Change-Id: I064718bbad9d053a0c84549be0a5e942f29a5dee
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87cz4hx3v0.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>

Bug: 303236405
(cherry picked from commit 4a778bdc7afbc422bd513c4f1cd7a9faf4bebaab)
[ Yixuan Jiang: Fix minor conflict ]
Change-Id: I0fa12ec9272847c320ccdb0d69eceb2a03853d4e
Signed-off-by: Yixuan Jiang <yixuanjiang@google.com>
2023-11-30 18:09:27 +00:00
Seiya Wang
4e7b7a37fb ANDROID: GKI: Update symbol list for mtk
Add following symbols

bitmap_alloc
cpufreq_cpu_get_raw
cpufreq_get_driver_data
cpufreq_update_policy
cpufreq_update_util_data
devm_clk_get_optional_enabled
devm_gpiod_get_array
devm_pwmchip_add
dev_pm_opp_adjust_voltage
dev_pm_opp_disable
dev_pm_opp_enable
dev_set_threaded
dma_vmap_noncontiguous
drm_connector_set_panel_orientation
drm_panel_of_backlight
_find_first_and_bit
gpiod_set_array_value_cansleep
hid_debug
hid_driver_reset_resume
hid_driver_suspend
i2c_smbus_read_byte
irq_find_matching_fwspec
memdup_user_nul
mipi_dsi_dcs_enter_sleep_mode
mipi_dsi_dcs_set_display_off
mmc_pwrseq_register
mmc_pwrseq_unregister
of_drm_get_panel_orientation
pm_suspend_target_state
return_address
serial8250_do_pm
snd_vendor_set_ops
_trace_android_vh_record_pcpu_rwsem_time_early
__traceiter_android_rvh_cpufreq_transition
__traceiter_android_rvh_post_init_entity_util_avg
__traceiter_android_vh_binder_trans
__traceiter_android_vh_check_uninterrupt_tasks
__traceiter_android_vh_dump_throttled_rt_tasks
__traceiter_android_vh_setscheduler_uclamp
__tracepoint_android_rvh_cpufreq_transition
__tracepoint_android_rvh_post_init_entity_util_avg
__tracepoint_android_vh_binder_trans
__tracepoint_android_vh_check_uninterrupt_tasks
__tracepoint_android_vh_dump_throttled_rt_tasks
__tracepoint_android_vh_setscheduler_uclamp
ufshcd_mcq_poll_cqe_lock
ufshcd_mcq_write_cqis
unpin_user_pages_dirty_lock

Bug: 311514694
Bug: 314029349
Signed-off-by: Seiya Wang <seiya.wang@mediatek.com>
Change-Id: Ibda780725c05cbd5fccf2716f107ba6fa308a1cb
(cherry picked from commit da694b565e24b326f80c8fd5a7cc8b7c83c41fc2)
2023-11-30 10:58:43 +00:00
Greg Kroah-Hartman
dc61d0ccd6 Merge "Merge tag 'android14-6.1.57_r00' into branch 'android14-6.1'" into android14-6.1 2023-11-30 10:20:44 +00:00
Android Build Coastguard Worker
ff4725c203 Snap for 11159036 from 7e4c17c522 to android14-6.1-keystone-qcom-release
Change-Id: I51b1a7cefc13d8d0a9764c3d81ea31fb8d46cd21
2023-11-30 09:40:50 +00:00
Omkar Sai Sandeep Katadi
7e4c17c522 Merge remote-tracking branch into HEAD
* keystone/mirror-android14-6.1-2023-11: (3456 commits)
  ANDROID: fs/passthrough: Fix compatibility with R/O file system
  FROMLIST: usb: typec: tcpm: Fix sink caps op current check
  UPSTREAM: scsi: ufs: core: Add advanced RPMB support where UFSHCI 4.0 does not support EHS length in UTRD
  ANDROID: ABI: Update symbol list for MediatTek
  ANDROID: vendor_hooks: Add hook for mmc queue
  Revert "proc: allow pid_revalidate() during LOOKUP_RCU"
  UPSTREAM: scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5
  ANDROID: GKI: Update symbols to symbol list
  ANDROID: vendor_hook: Add hook to tune readaround size
  ANDROID: add for tuning readahead size
  ANDROID: vendor_hooks: Add hooks to avoid key threads stalled in memory allocations
  ANDROID: GKI: Update oplus symbol list
  ANDROID: vendor_hooks: add hooks for adjust kvmalloc_node alloc_flags
  UPSTREAM: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
  ANDROID: ABI: Update symbol list for imx
  ANDROID: abi_gki_aarch64_qcom: Add __netif_rx
  ANDROID: ABI: Update sony symbol list and stg
  ANDROID: mmc: Add vendor hooks for sdcard failure diagnostics
  ANDROID: Update symbol list for mtk
  UPSTREAM: scsi: ufs: mcq: Fix the search/wrap around logic
  ...

Change-Id: I3fa91d80248446d69628f2b575ad18975106871c
Signed-off-by: Omkar Sai Sandeep Katadi <okatadi@google.com>
2023-11-29 21:42:29 +00:00
Chungkai Mei
ceb6ff1a69 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - __traceiter_android_rvh_update_load_sum
  - __tracepoint_android_rvh_update_load_sum

Bug: 181105055
Change-Id: Ie70d640f252f40af86aff48bcf2d5cfd80485393
Signed-off-by: Chungkai Mei <chungkai@google.com>
2023-11-29 21:33:45 +00:00
Chungkai Mei
0d97bca80a ANDROID: sched: Add vendor hook for update_load_sum
vendor may have the need to modify update_load_sum function

Bug: 181105055
Change-Id: I35964977a4b8917c62773d48a37340f880774e38
Signed-off-by: Chungkai Mei <chungkai@google.com>
(cherry picked from commit 984523c368423410bf53ca4c68402897d160c5dd)
2023-11-29 21:33:45 +00:00
Elliot Berman
eba89bbb6f FROMGIT: freezer,sched: clean saved_state when restoring it during thaw
Clean saved_state after using it during thaw. Cleaning the saved_state
allows us to avoid some unnecessary branches in ttwu_state_match.

Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20231120-freezer-state-multiple-thaws-v1-2-f2e1dd7ce5a2@quicinc.com

Bug: 292064955
Bug: 312992017
(cherry picked from commit 418146e39891ef1fb2284dee4cabbfe616cd21cf
 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git sched/core)
Change-Id: I245593122edecb1dc9c354c36b59da057d4f4e00
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-11-29 20:08:28 +00:00
Elliot Berman
2a5c5d7c47 FROMGIT: freezer,sched: do not restore saved_state of a thawed task
It is possible for a task to be thawed multiple times when mixing the
*legacy* cgroup freezer and system-wide freezer. To do this, freeze the
cgroup, do system-wide freeze/thaw, then thaw the cgroup. When this
happens, then a stale saved_state can be written to the task's state
and cause task to hang indefinitely. Fix this by only trying to thaw
tasks that are actually frozen.

This change also has the marginal benefit avoiding unnecessary
wake_up_state(p, TASK_FROZEN) if we know the task is already thawed.
There is not possibility of time-of-compare/time-of-use race when we skip
the wake_up_state because entering/exiting TASK_FROZEN is guarded by
freezer_lock.

Fixes: 8f0eed4a78a8 ("freezer,sched: Use saved_state to reduce some spurious wakeups")
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Abhijeet Dharmapurikar <quic_adharmap@quicinc.com>
Link: https://lore.kernel.org/r/20231120-freezer-state-multiple-thaws-v1-1-f2e1dd7ce5a2@quicinc.com

Bug: 292064955
Bug: 312992017
(cherry picked from commit 23ab79e8e469e2605beec2e3ccb40d19c68dd2e0
 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git sched/urgent)
Change-Id: I09cb09a3ef3641c71e3b3156bc3a9a3e69d4966e
Signed-off-by: Qi Feng <fengqi@xiaomi.corp-partner.google.com>
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-11-29 20:08:28 +00:00
Junho Cha
6e3127c7ba ANDROID: GKI: add allowed list for Exynosauto SoC
This patch adds GKI symbol list for Exynosauto SoC.
We need to add below 3 function symbols and it required
by DP MST of DRM(Direct Rendering Manager) driver.

3 function symbol(s) added
  'int drm_connector_set_path_property(struct drm_connector*, const char*)'
  'int drm_helper_probe_detect(struct drm_connector*, struct drm_modeset_acquire_ctx*, bool)'
  'int of_graph_get_endpoint_count(const struct device_node*)'

Bug: 313751443
Change-Id: I3a7e212f598d50f21ee2272ccb18ceaa5af72f42
Signed-off-by: Junho Cha <junhomax.cha@samsung.com>
2023-11-29 19:33:55 +00:00
Vincent Donnefort
af85ead8ce ANDROID: KVM: arm64: pkvm_module_ops documentation
This structure is at the heart of the module support for pKVM. Add a
description to help anyone trying to create a module.

Bug: 312200309
Change-Id: Ie1d9043a6a94d15dd8ef25c6f0f8d442da26bc1f
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
2023-11-29 15:43:49 +00:00
Jia-Shiuan Chen
c331f5b7af ANDROID: Update the ABI symbol list
Adding the following symbols:
  - dma_fence_array_create

Bug: 313783640
Change-Id: I8183d866dec9d9043509578f6267dc7198477767
Signed-off-by: Jia-Shiuan Chen <chenjs@google.com>
2023-11-29 10:44:27 +00:00
Jimmy Hu
bcb7dfe013 UPSTREAM: usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
It is possible that typec_register_partner() returns ERR_PTR on failure.
When port->partner is an error, a NULL pointer dereference may occur as
shown below.

[91222.095236][  T319] typec port0: failed to register partner (-17)
...
[91225.061491][  T319] Unable to handle kernel NULL pointer dereference
at virtual address 000000000000039f
[91225.274642][  T319] pc : tcpm_pd_data_request+0x310/0x13fc
[91225.274646][  T319] lr : tcpm_pd_data_request+0x298/0x13fc
[91225.308067][  T319] Call trace:
[91225.308070][  T319]  tcpm_pd_data_request+0x310/0x13fc
[91225.308073][  T319]  tcpm_pd_rx_handler+0x100/0x9e8
[91225.355900][  T319]  kthread_worker_fn+0x178/0x58c
[91225.355902][  T319]  kthread+0x150/0x200
[91225.355905][  T319]  ret_from_fork+0x10/0x30

Add a check for port->partner to avoid dereferencing a NULL pointer.

Fixes: 5e1d4c49fb ("usb: typec: tcpm: Determine common SVDM Version")
Cc: stable@vger.kernel.org
Signed-off-by: Jimmy Hu <hhhuuu@google.com>
Link: https://lore.kernel.org/r/20231020012132.100960-1-hhhuuu@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 280207787
(cherry picked from commit 4987daf86c152ff882d51572d154ad12e4ff3a4b)
Change-Id: I609640ff70258b8fd0e7f9eaad9eb60db35ccfad
Signed-off-by: Kyle Tso <kyletso@google.com>
2023-11-29 06:58:14 +00:00
liwei
61ca1246d9 ANDROID: GKI: Update oplus symbol list
add four symbol to oplus symbol list, which already EXPORTED
1. static_key_enable
2. static_key_disable
3. __traceiter_android_vh_alloc_pages_slowpath
4. __tracepoint_android_vh_alloc_pages_slowpath

Bug: 312913816
Change-Id: I2c5776c4b58b8b50e7e4c245492614412042cf9d
Signed-off-by: liwei <liwei1234@oppo.com>
2023-11-28 18:28:02 +00:00
Wander Lairson Costa
d3787b952a UPSTREAM: drm/qxl: fix UAF on handle creation
commit c611589b4259ed63b9b77be6872b1ce07ec0ac16 upstream.

qxl_mode_dumb_create() dereferences the qobj returned by
qxl_gem_object_create_with_handle(), but the handle is the only one
holding a reference to it.

A potential attacker could guess the returned handle value and closes it
between the return of qxl_gem_object_create_with_handle() and the qobj
usage, triggering a use-after-free scenario.

Reproducer:

int dri_fd =-1;
struct drm_mode_create_dumb arg = {0};

void gem_close(int handle);

void* trigger(void* ptr)
{
	int ret;
	arg.width = arg.height = 0x20;
	arg.bpp = 32;
	ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &arg);
	if(ret)
	{
		perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed");
		exit(-1);
	}
	gem_close(arg.handle);
	while(1) {
		struct drm_mode_create_dumb args = {0};
		args.width = args.height = 0x20;
		args.bpp = 32;
		ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &args);
		if (ret) {
			perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed");
			exit(-1);
		}

		printf("[*] DRM_IOCTL_MODE_CREATE_DUMB created, %d\n", args.handle);
		gem_close(args.handle);
	}
	return NULL;
}

void gem_close(int handle)
{
	struct drm_gem_close args;
	args.handle = handle;
	int ret = ioctl(dri_fd, DRM_IOCTL_GEM_CLOSE, &args); // gem close handle
	if (!ret)
		printf("gem close handle %d\n", args.handle);
}

int main(void)
{
	dri_fd= open("/dev/dri/card0", O_RDWR);
	printf("fd:%d\n", dri_fd);

	if(dri_fd == -1)
		return -1;

	pthread_t tid1;

	if(pthread_create(&tid1,NULL,trigger,NULL)){
		perror("[*] thread_create tid1\n");
		return -1;
	}
	while (1)
	{
		gem_close(arg.handle);
	}
	return 0;
}

This is a KASAN report:

==================================================================
BUG: KASAN: slab-use-after-free in qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69
Write of size 1 at addr ffff88801136c240 by task poc/515

CPU: 1 PID: 515 Comm: poc Not tainted 6.3.0 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
Call Trace:
<TASK>
__dump_stack linux/lib/dump_stack.c:88
dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106
print_address_description linux/mm/kasan/report.c:319
print_report+0xd2/0x660 linux/mm/kasan/report.c:430
kasan_report+0xd2/0x110 linux/mm/kasan/report.c:536
__asan_report_store1_noabort+0x17/0x30 linux/mm/kasan/report_generic.c:383
qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120
RIP: 0033:0x7ff5004ff5f7
Code: 00 00 00 48 8b 05 99 c8 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 69 c8 0d 00 f7 d8 64 89 01 48

RSP: 002b:00007ff500408ea8 EFLAGS: 00000286 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff5004ff5f7
RDX: 00007ff500408ec0 RSI: 00000000c02064b2 RDI: 0000000000000003
RBP: 00007ff500408ef0 R08: 0000000000000000 R09: 000000000000002a
R10: 0000000000000000 R11: 0000000000000286 R12: 00007fff1c6cdafe
R13: 00007fff1c6cdaff R14: 00007ff500408fc0 R15: 0000000000802000
</TASK>

Allocated by task 515:
kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45
kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52
kasan_save_alloc_info+0x1e/0x40 linux/mm/kasan/generic.c:510
____kasan_kmalloc linux/mm/kasan/common.c:374
__kasan_kmalloc+0xc3/0xd0 linux/mm/kasan/common.c:383
kasan_kmalloc linux/./include/linux/kasan.h:196
kmalloc_trace+0x48/0xc0 linux/mm/slab_common.c:1066
kmalloc linux/./include/linux/slab.h:580
kzalloc linux/./include/linux/slab.h:720
qxl_bo_create+0x11a/0x610 linux/drivers/gpu/drm/qxl/qxl_object.c:124
qxl_gem_object_create+0xd9/0x360 linux/drivers/gpu/drm/qxl/qxl_gem.c:58
qxl_gem_object_create_with_handle+0xa1/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:89
qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120

Freed by task 515:
kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45
kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x60 linux/mm/kasan/generic.c:521
____kasan_slab_free linux/mm/kasan/common.c:236
____kasan_slab_free+0x180/0x1f0 linux/mm/kasan/common.c:200
__kasan_slab_free+0x12/0x30 linux/mm/kasan/common.c:244
kasan_slab_free linux/./include/linux/kasan.h:162
slab_free_hook linux/mm/slub.c:1781
slab_free_freelist_hook+0xd2/0x1a0 linux/mm/slub.c:1807
slab_free linux/mm/slub.c:3787
__kmem_cache_free+0x196/0x2d0 linux/mm/slub.c:3800
kfree+0x78/0x120 linux/mm/slab_common.c:1019
qxl_ttm_bo_destroy+0x140/0x1a0 linux/drivers/gpu/drm/qxl/qxl_object.c:49
ttm_bo_release+0x678/0xa30 linux/drivers/gpu/drm/ttm/ttm_bo.c:381
kref_put linux/./include/linux/kref.h:65
ttm_bo_put+0x50/0x80 linux/drivers/gpu/drm/ttm/ttm_bo.c:393
qxl_gem_object_free+0x3e/0x60 linux/drivers/gpu/drm/qxl/qxl_gem.c:42
drm_gem_object_free+0x5c/0x90 linux/drivers/gpu/drm/drm_gem.c:974
kref_put linux/./include/linux/kref.h:65
__drm_gem_object_put linux/./include/drm/drm_gem.h:431
drm_gem_object_put linux/./include/drm/drm_gem.h:444
qxl_gem_object_create_with_handle+0x151/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:100
qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63
drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96
drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102
drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788
drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891
vfs_ioctl linux/fs/ioctl.c:51
__do_sys_ioctl linux/fs/ioctl.c:870
__se_sys_ioctl linux/fs/ioctl.c:856
__x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856
do_syscall_x64 linux/arch/x86/entry/common.c:50
do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120

The buggy address belongs to the object at ffff88801136c000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 576 bytes inside of
freed 1024-byte region [ffff88801136c000, ffff88801136c400)

The buggy address belongs to the physical page:
page:0000000089fc329b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11368
head:0000000089fc329b order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0010200 ffff888007841dc0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff88801136c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801136c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801136c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801136c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801136c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Disabling lock debugging due to kernel taint

Instead of returning a weak reference to the qxl_bo object, return the
created drm_gem_object and let the caller decrement the reference count
when it no longer needs it. As a convenience, if the caller is not
interested in the gobj object, it can pass NULL to the parameter and the
reference counting is descremented internally.

The bug and the reproducer were originally found by the Zero Day Initiative project (ZDI-CAN-20940).

Bug: 311571057
Link: https://www.zerodayinitiative.com/
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230814165119.90847-1-wander@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit d578c919deb786b4d6ba8c7639255cb658731671)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If0e6ae00dd7e90f938beff9c6992ea37ba7bc4fa
2023-11-28 14:34:24 +00:00
Android Build Coastguard Worker
06be4eb868 Snap for 11148269 from 8578f794ea to android14-6.1-keystone-qcom-release
Change-Id: Ic1e860f77e5e4bd20401f195d1dc4ca75d19208d
2023-11-28 09:15:23 +00:00