Commit Graph

1150160 Commits

Author SHA1 Message Date
Gao Xiang
cee0694362 BACKPORT: erofs: get rid of erofs_inode_datablocks()
erofs_inode_datablocks() has the only one caller, let's just get
rid of it entirely.  No logic changes.

Bug: 303691233
Change-Id: I15f4e5df8ddd53c570408cc80b255b6934c06fdb

Reviewed-by: Yue Hu <huyue2@coolpad.com>
Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Change-Id: I96195a960204c313649c510766e6a54d49a01784
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20230204093040.97967-1-hsiangkao@linux.alibaba.com
(cherry picked from commit 4efdec36dc9907628e590a68193d6d8e5e74d032)
Signed-off-by: Sandeep Dhavale <dhavale@google.com>
2023-10-06 21:48:22 +00:00
Gao Xiang
f7d9c7d0b4 BACKPORT: erofs: simplify iloc()
Actually we could pass in inodes directly to clean up all callers.
Also rename iloc() as erofs_iloc().

Bug: 303691233

Link: https://lore.kernel.org/r/20230114150823.432069-1-xiang@kernel.org
Reviewed-by: Yue Hu <huyue2@coolpad.com>
Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
(cherry picked from commit b780d3fc6107464dcc43631a6208c43b6421f1e6)
[dhavale: resolved minor conflict in fs/erofs/zmap.c]
Signed-off-by: Sandeep Dhavale <dhavale@google.com>

Change-Id: Iea7a97040cebdc984e2956d421755230263c97ae
2023-10-06 21:48:22 +00:00
Junghoon Jang
7d42260e5c ANDROID: Update the ABI symbol list
Adding the following symbols:
  - reserve_iova

Bug: 303000855
Change-Id: I84b0eeb179b4194d0d8294b789f2cecc388f0963
Signed-off-by: Junghoon Jang <junghoonjang@google.com>
2023-10-06 17:58:24 +00:00
JohnHsu
324c8522f9 ANDROID: Update symbol list for mtk
6 function symbol(s) added
  'int __traceiter_android_vh_compaction_exit(void*, int, int, int)'
  'int __traceiter_android_vh_compaction_try_to_compact_pages_exit(void*, enum compact_result*)'
  'int __traceiter_android_vh_mm_alloc_pages_direct_reclaim_enter(void*, unsigned int)'
  'int __traceiter_android_vh_mm_alloc_pages_direct_reclaim_exit(void*, unsigned long, int)'
  'int __traceiter_android_vh_mm_alloc_pages_may_oom_exit(void*, struct oom_control*, unsigned long)'
  'int __traceiter_android_vh_vmscan_kswapd_done(void*, int, unsigned int, unsigned int, unsigned int)'

6 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_compaction_exit'
  'struct tracepoint __tracepoint_android_vh_compaction_try_to_compact_pages_exit'
  'struct tracepoint __tracepoint_android_vh_mm_alloc_pages_direct_reclaim_enter'
  'struct tracepoint __tracepoint_android_vh_mm_alloc_pages_direct_reclaim_exit'
  'struct tracepoint __tracepoint_android_vh_mm_alloc_pages_may_oom_exit'
  'struct tracepoint __tracepoint_android_vh_vmscan_kswapd_done'

Bug: 301044280

Change-Id: Ie084b70571900e2e63e6f9d0b1aec4f630d9e6d2
Signed-off-by: john.hsu <john.hsu@mediatek.com>
2023-10-05 16:33:46 +08:00
JohnHsu
30d86f760c ANDROID: mm: Add vendor hooks for recording when kswapd finishing the reclaim job
To monitor the reclaiming ability of kswapd, add vendor hook recording when the kswapd finish the reclaiming job and the reclaim progress.

android_vh_vmscan_kswpad_done(int, unsigned int, unsigned int, unsigned int)

Bug: 301044280

Change-Id: Id6e0a97003f0a156cff4d0996bc38bcd89b1dc69
Signed-off-by: John Hsu <john.hsu@mediatek.com>
2023-10-05 10:48:42 +08:00
JohnHsu
0deb7bb73e ANDROID: mm: Add vendor hooks for __alloc_pages_slowpath
To monitor the efficiency of memory relciaming in __alloc_pages_slowpath, add vendor hooks in each stages of __alloc_pages_slowpath including __alloc_pages_may_oom and __alloc_pages_direct_reclaim.

android_vh_mm_alloc_pages_direct_reclaim_enter()
android_vh_mm_alloc_pages_direct_reclaim_exit(unsigned long, int)
android_vh_mm_alloc_pages_may_oom_exit(struct oom_control *, unsigned long)

Bug: 301044280

Change-Id: Ic5b5f1c2ad31b16e7339f539fcf54659e9acaba7
Signed-off-by: John Hsu <john.hsu@mediatek.com>
2023-10-05 10:46:38 +08:00
JohnHsu
5c2855fbce ANDROID: mm: Add vendor hook for compact pages work.
To monitor the efficiency of each action about compaction.
Add the vendor_hook function and call it in kcompactd_do_work() and
try_to_compact_pages()

ANDROID vendor hook
android_vh_compaction_exit(int, int, const int)
android_vh_compaction_try_to_compact_pages_exit(enum *compact result)

Bug: 301044280

Change-Id: I4c3f94e77eb2b16ba154ba88a9f75095536de916
Signed-off-by: John Hsu <john.hsu@mediatek.com>
2023-10-05 10:46:03 +08:00
Rick Yiu
4e10001b7c ANDROID: Update the ABI symbol list
Adding the following symbols:
  - activate_task
  - arch_freq_scale
  - available_idle_cpu
  - balance_push_callback
  - bpf_trace_run12
  - check_preempt_curr
  - __cpu_active_mask
  - cpufreq_add_update_util_hook
  - cpufreq_disable_fast_switch
  - cpufreq_driver_fast_switch
  - cpufreq_driver_resolve_freq
  - __cpufreq_driver_target
  - cpufreq_enable_fast_switch
  - cpufreq_policy_transition_delay_us
  - cpufreq_register_governor
  - cpufreq_remove_update_util_hook
  - cpufreq_this_cpu_can_update
  - cpufreq_update_util_data
  - cpupri_find_fitness
  - deactivate_task
  - find_task_by_vpid
  - get_governor_parent_kobj
  - get_task_cred
  - gov_attr_set_get
  - gov_attr_set_init
  - gov_attr_set_put
  - governor_sysfs_ops
  - have_governor_per_policy
  - irq_work_queue
  - irq_work_sync
  - kernfs_path_from_node
  - ns_capable
  - _printk_deferred
  - proc_douintvec_minmax
  - proc_set_size
  - push_cpu_stop
  - __put_cred
  - raw_spin_rq_lock_nested
  - raw_spin_rq_unlock
  - resched_curr
  - reweight_task
  - root_task_group
  - runqueues
  - sched_feat_keys
  - sched_uclamp_used
  - set_task_cpu
  - static_key_enable
  - stop_one_cpu_nowait
  - sysctl_sched_features
  - sysctl_sched_latency
  - task_rq_lock
  - teo_cpu_get_util_threshold
  - teo_cpu_set_util_threshold
  - thermal_pressure
  - __traceiter_android_rvh_attach_entity_load_avg
  - __traceiter_android_rvh_can_migrate_task
  - __traceiter_android_rvh_check_preempt_wakeup
  - __traceiter_android_rvh_cpu_overutilized
  - __traceiter_android_rvh_dequeue_task
  - __traceiter_android_rvh_dequeue_task_fair
  - __traceiter_android_rvh_detach_entity_load_avg
  - __traceiter_android_rvh_enqueue_task
  - __traceiter_android_rvh_enqueue_task_fair
  - __traceiter_android_rvh_find_lowest_rq
  - __traceiter_android_rvh_irqs_disable
  - __traceiter_android_rvh_irqs_enable
  - __traceiter_android_rvh_post_init_entity_util_avg
  - __traceiter_android_rvh_preempt_disable
  - __traceiter_android_rvh_preempt_enable
  - __traceiter_android_rvh_prepare_prio_fork
  - __traceiter_android_rvh_remove_entity_load_avg
  - __traceiter_android_rvh_rtmutex_prepare_setprio
  - __traceiter_android_rvh_sched_newidle_balance
  - __traceiter_android_rvh_select_task_rq_fair
  - __traceiter_android_rvh_select_task_rq_rt
  - __traceiter_android_rvh_set_cpus_allowed_by_task
  - __traceiter_android_rvh_set_iowait
  - __traceiter_android_rvh_setscheduler
  - __traceiter_android_rvh_set_task_cpu
  - __traceiter_android_rvh_set_user_nice
  - __traceiter_android_rvh_uclamp_eff_get
  - __traceiter_android_rvh_update_blocked_fair
  - __traceiter_android_rvh_update_load_avg
  - __traceiter_android_rvh_update_rt_rq_load_avg
  - __traceiter_android_vh_arch_set_freq_scale
  - __traceiter_android_vh_binder_restore_priority
  - __traceiter_android_vh_binder_set_priority
  - __traceiter_android_vh_dump_throttled_rt_tasks
  - __traceiter_android_vh_dup_task_struct
  - __traceiter_android_vh_setscheduler_uclamp
  - __traceiter_android_vh_uclamp_validate
  - __traceiter_android_vh_use_amu_fie
  - __traceiter_cpu_frequency
  - __traceiter_pelt_cfs_tp
  - __traceiter_pelt_dl_tp
  - __traceiter_pelt_irq_tp
  - __traceiter_pelt_rt_tp
  - __traceiter_pelt_se_tp
  - __traceiter_sched_cpu_capacity_tp
  - __traceiter_sched_overutilized_tp
  - __traceiter_sched_util_est_cfs_tp
  - __traceiter_sched_util_est_se_tp
  - __tracepoint_android_rvh_attach_entity_load_avg
  - __tracepoint_android_rvh_can_migrate_task
  - __tracepoint_android_rvh_check_preempt_wakeup
  - __tracepoint_android_rvh_cpu_overutilized
  - __tracepoint_android_rvh_dequeue_task
  - __tracepoint_android_rvh_dequeue_task_fair
  - __tracepoint_android_rvh_detach_entity_load_avg
  - __tracepoint_android_rvh_enqueue_task
  - __tracepoint_android_rvh_enqueue_task_fair
  - __tracepoint_android_rvh_find_lowest_rq
  - __tracepoint_android_rvh_irqs_disable
  - __tracepoint_android_rvh_irqs_enable
  - __tracepoint_android_rvh_post_init_entity_util_avg
  - __tracepoint_android_rvh_preempt_disable
  - __tracepoint_android_rvh_preempt_enable
  - __tracepoint_android_rvh_prepare_prio_fork
  - __tracepoint_android_rvh_remove_entity_load_avg
  - __tracepoint_android_rvh_rtmutex_prepare_setprio
  - __tracepoint_android_rvh_sched_newidle_balance
  - __tracepoint_android_rvh_select_task_rq_fair
  - __tracepoint_android_rvh_select_task_rq_rt
  - __tracepoint_android_rvh_set_cpus_allowed_by_task
  - __tracepoint_android_rvh_set_iowait
  - __tracepoint_android_rvh_setscheduler
  - __tracepoint_android_rvh_set_task_cpu
  - __tracepoint_android_rvh_set_user_nice
  - __tracepoint_android_rvh_uclamp_eff_get
  - __tracepoint_android_rvh_update_blocked_fair
  - __tracepoint_android_rvh_update_load_avg
  - __tracepoint_android_rvh_update_rt_rq_load_avg
  - __tracepoint_android_vh_arch_set_freq_scale
  - __tracepoint_android_vh_binder_restore_priority
  - __tracepoint_android_vh_binder_set_priority
  - __tracepoint_android_vh_dump_throttled_rt_tasks
  - __tracepoint_android_vh_dup_task_struct
  - __tracepoint_android_vh_setscheduler_uclamp
  - __tracepoint_android_vh_uclamp_validate
  - __tracepoint_android_vh_use_amu_fie
  - __tracepoint_cpu_frequency
  - __tracepoint_pelt_cfs_tp
  - __tracepoint_pelt_dl_tp
  - __tracepoint_pelt_irq_tp
  - __tracepoint_pelt_rt_tp
  - __tracepoint_pelt_se_tp
  - __tracepoint_sched_cpu_capacity_tp
  - __tracepoint_sched_overutilized_tp
  - __tracepoint_sched_util_est_cfs_tp
  - __tracepoint_sched_util_est_se_tp
  - uclamp_eff_value
  - ___update_load_avg
  - ___update_load_sum
  - update_rq_clock

Bug: 299851672
Change-Id: I5460a1d6622df1ac74cce3a8f9faffcc0e275003
Signed-off-by: Rick Yiu <rickyiu@google.com>
2023-10-04 15:45:08 +00:00
Prashanth K
2434dece1f FROMGIT: usb: gadget: u_serial: Add null pointer check in gserial_suspend
Consider a case where gserial_disconnect has already cleared
gser->ioport. And if gserial_suspend gets called afterwards,
it will lead to accessing of gser->ioport and thus causing
null pointer dereference.

Avoid this by adding a null pointer check. Added a static
spinlock to prevent gser->ioport from becoming null after
the newly added null pointer check.

Fixes: aba3a8d01d ("usb: gadget: u_serial: add suspend resume callbacks")
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Link: https://lore.kernel.org/r/1683278317-11774-1-git-send-email-quic_prashk@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 285495243
(cherry picked from commit 2f6ecb89fe8feb2b60a53325b0eeb9866d88909a
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb-next)

Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Change-Id: I2c5b58eaaa1e3428952ffdbf7f1a39cad519cc5a
(cherry picked from commit f51f079fe30f53aca027aca2c7a517e79c45b67f)
2023-10-04 03:15:46 +00:00
Amit Sunil Dhamne
5f8aa27248 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - device_get_named_child_node
  - tcpm_register_port
  - tcpm_tcpc_reset
  - tcpm_unregister_port

Bug: 302578746
Change-Id: I1af3377667dc4cadacd20977298a9fe99628b5c0
Signed-off-by: Amit Sunil Dhamne <amitsd@google.com>
2023-10-04 01:40:19 +00:00
RD Babiera
f7e7874d9b BACKPORT: usb: typec: bus: verify partner exists in typec_altmode_attention
Some usb hubs will negotiate DisplayPort Alt mode with the device
but will then negotiate a data role swap after entering the alt
mode. The data role swap causes the device to unregister all alt
modes, however the usb hub will still send Attention messages
even after failing to reregister the Alt Mode. type_altmode_attention
currently does not verify whether or not a device's altmode partner
exists, which results in a NULL pointer error when dereferencing
the typec_altmode and typec_altmode_ops belonging to the altmode
partner.

Verify the presence of a device's altmode partner before sending
the Attention message to the Alt Mode driver.

Fixes: 8a37d87d72 ("usb: typec: Bus type for alternate modes")
Cc: stable@vger.kernel.org
Signed-off-by: RD Babiera <rdbabiera@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20230814180559.923475-1-rdbabiera@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 288952921
(cherry picked from commit f23643306430f86e2f413ee2b986e0773e79da31)
[rd: changed return type of typec_altmode_attention to void to not break
 kmi, moved tcpm_log from error return to typec_altmode_attention as
 dev_warn]
Signed-off-by: RD Babiera <rdbabiera@google.com>
(cherry picked from https://android-review.googlesource.com/q/commit:e23c89c0b76305f9f264ba113d647710b956a540)
Merged-In: I054a6ef56b9b2d7c4e8167e8630a8c277910da88
Change-Id: I054a6ef56b9b2d7c4e8167e8630a8c277910da88
2023-10-02 22:51:53 +00:00
Will McVicker
5cb3b26d79 ANDROID: ABI: Update the pixel symbol list and stg
23 function symbol(s) added
  'int __traceiter_android_vh_typec_tcpm_modify_src_caps(void*, unsigned int*, u32(*)[0], bool*)'
  'void* __xa_erase(struct xarray*, unsigned long)'
  'void* __xa_store(struct xarray*, unsigned long, void*, gfp_t)'
  'unsigned int cpumask_local_spread(unsigned int, int)'
  'void devm_memunmap(struct device*, void*)'
  'long dma_buf_set_name(struct dma_buf*, const char*)'
  'void gether_cleanup(struct eth_dev*)'
  'struct net_device* gether_connect(struct gether*)'
  'void gether_disconnect(struct gether*)'
  'int gether_get_dev_addr(struct net_device*, char*, int)'
  'int gether_get_host_addr(struct net_device*, char*, int)'
  'void gether_get_host_addr_u8(struct net_device*, u8*)'
  'int gether_get_ifname(struct net_device*, char*, int)'
  'unsigned int gether_get_qmult(struct net_device*)'
  'int gether_register_netdev(struct net_device*)'
  'int gether_set_dev_addr(struct net_device*, const char*)'
  'void gether_set_gadget(struct net_device*, struct usb_gadget*)'
  'int gether_set_host_addr(struct net_device*, const char*)'
  'int gether_set_ifname(struct net_device*, const char*, int)'
  'void gether_set_qmult(struct net_device*, unsigned int)'
  'struct net_device* gether_setup_name_default(const char*)'
  'void* xas_find(struct xa_state*, unsigned long)'
  'void xas_pause(struct xa_state*)'

1 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_typec_tcpm_modify_src_caps'

Adding the following symbols to the pixel symbol list:
  bpf_trace_run11
  cleancache_register_ops
  cpu_hotplug_disable
  cpu_hotplug_enable
  cpuidle_driver_state_disabled
  cpuidle_get_driver
  cpumask_local_spread
  debugfs_create_file_unsafe
  dev_get_stats
  __devm_irq_alloc_descs
  devm_krealloc
  devm_memremap
  devm_memunmap
  __devm_regmap_init_spmi_ext
  devm_request_any_context_irq
  devm_thermal_of_zone_unregister
  dev_vprintk_emit
  dma_buf_set_name
  drm_add_edid_modes
  drm_atomic_bridge_chain_disable
  drm_atomic_bridge_chain_post_disable
  drm_atomic_get_new_private_obj_state
  drm_atomic_get_old_private_obj_state
  drm_atomic_helper_calc_timestamping_constants
  drm_atomic_helper_connector_destroy_state
  drm_atomic_helper_connector_duplicate_state
  drm_atomic_helper_connector_reset
  drm_atomic_helper_update_legacy_modeset_state
  drm_connector_update_edid_property
  drm_crtc_add_crc_entry
  __drm_crtc_commit_free
  drm_crtc_commit_wait
  drm_crtc_vblank_count
  __drm_debug
  drm_detect_monitor_audio
  __drm_dev_dbg
  drm_dev_printk
  drm_display_mode_from_cea_vic
  drm_do_get_edid
  drm_edid_duplicate
  drm_edid_get_monitor_name
  drm_edid_is_valid
  drm_edid_to_sad
  drm_get_edid
  drm_match_cea_mode
  drm_mode_copy
  drm_mode_destroy
  drm_modeset_lock_single_interruptible
  drm_object_property_set_value
  dw_pcie_find_capability
  dw_pcie_read_dbi
  dw_pcie_write_dbi
  __folio_lock
  fsnotify
  __fsnotify_parent
  gether_cleanup
  gether_connect
  gether_disconnect
  gether_get_dev_addr
  gether_get_host_addr
  gether_get_host_addr_u8
  gether_get_ifname
  gether_get_qmult
  gether_register_netdev
  gether_set_dev_addr
  gether_set_gadget
  gether_set_host_addr
  gether_set_ifname
  gether_set_qmult
  gether_setup_name_default
  __get_task_comm
  i2c_add_adapter
  int_pow
  irq_domain_simple_ops
  irq_force_affinity
  memchr_inv
  mtree_load
  nf_register_net_hooks
  nf_unregister_net_hooks
  of_find_node_with_property
  proc_symlink
  rtnl_trylock
  sched_set_fifo
  sched_set_normal
  snd_pcm_hw_constraint_integer
  snd_soc_set_runtime_hwparams
  spmi_controller_add
  spmi_controller_alloc
  spmi_controller_remove
  __spmi_driver_register
  strnchr
  __tasklet_hi_schedule
  thermal_zone_get_temp
  thermal_zone_get_zone_by_name
  __traceiter_android_rvh_audio_usb_offload_disconnect
  __traceiter_android_rvh_cgroup_force_kthread_migration
  __traceiter_android_vh_audio_usb_offload_connect
  __traceiter_android_vh_typec_tcpm_modify_src_caps
  __tracepoint_android_rvh_audio_usb_offload_disconnect
  __tracepoint_android_rvh_cgroup_force_kthread_migration
  __tracepoint_android_vh_audio_usb_offload_connect
  __tracepoint_android_vh_typec_tcpm_modify_src_caps
  ufshcd_auto_hibern8_update
  usb_assign_descriptors
  usb_ep_alloc_request
  usb_ep_disable
  usb_ep_enable
  usb_ep_free_request
  usb_ep_queue
  usb_free_all_descriptors
  usb_gstrings_attach
  usb_os_desc_prepare_interf_dir
  usb_role_string
  vm_iomap_memory
  __xa_erase
  xas_find
  xas_pause
  __xa_store
  xhci_get_endpoint_index

Bug: 269652215
Change-Id: I608904647b4983ab235522ebcebc40dd4c025d77
Signed-off-by: Will McVicker <willmcvicker@google.com>
2023-10-02 22:32:07 +00:00
Hugh Dickins
cf1ba6a102 UPSTREAM: shmem: fix smaps BUG sleeping while atomic
smaps_pte_hole_lookup() is calling shmem_partial_swap_usage() with page
table lock held: but shmem_partial_swap_usage() does cond_resched_rcu() if
need_resched(): "BUG: sleeping function called from invalid context".

Since shmem_partial_swap_usage() is designed to count across a range, but
smaps_pte_hole_lookup() only calls it for a single page slot, just break
out of the loop on the last or only page, before checking need_resched().

Bug: 302977171

Link: https://lkml.kernel.org/r/6fe3b3ec-abdf-332f-5c23-6a3b3a3b11a9@google.com
(cherry picked from commit e5548f85b4527c4c803b7eae7887c10bf8f90c97)
Fixes: 2301003215 ("mm/smaps: simplify shmem handling of pte holes")
Change-Id: I1b59341c954cb7eb31709ba0dcc65ec6e67c58c6
Signed-off-by: Hugh Dickins <hughd@google.com>
Acked-by: Peter Xu <peterx@redhat.com>
Cc: <stable@vger.kernel.org>	[5.16+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2023-10-02 11:24:29 +00:00
Hou Tao
52824b718c UPSTREAM: blk-ioprio: Introduce promote-to-rt policy
Since commit a78418e6a0 ("block: Always initialize bio IO priority on
submit"), bio->bi_ioprio will never be IOPRIO_CLASS_NONE when calling
blkcg_set_ioprio(), so there will be no way to promote the io-priority
of one cgroup to IOPRIO_CLASS_RT, because bi_ioprio will always be
greater than or equals to IOPRIO_CLASS_RT.

It seems possible to call blkcg_set_ioprio() first then try to
initialize bi_ioprio later in bio_set_ioprio(), but this doesn't work
for bio in which bi_ioprio is already initialized (e.g., direct-io), so
introduce a new promote-to-rt policy to promote the iopriority of bio to
IOPRIO_CLASS_RT if the ioprio is not already RT.

For none-to-rt policy, although it doesn't work now, but considering
that its purpose was also to override the io-priority to RT and allowing
for a smoother transition, just keep it and treat it as an alias of
the promote-to-rt policy.

Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Change-Id: I1f511e8dca604fdb3249562ea73adb69b93a8aec
Signed-off-by: Hou Tao <houtao1@huawei.com>
Reviewed-by: Bagas Sanjaya <bagasdotme@gmail.com>
Link: https://lore.kernel.org/r/20230428074404.280532-1-houtao@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit ddf63516d8d37528dc6834c7f19b55084e956068)
Bug: 186902601
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-09-29 09:18:05 +00:00
Zichun Zheng
dce1834895 ANDROID: ABI: Update oplus symbol list
7 function symbol(s) added
  'void __mod_lruvec_state(struct lruvec*, enum node_stat_item, int)'
  'void __mod_zone_page_state(struct zone*, enum zone_stat_item, long)'
  'void folio_add_lru(struct folio*)'
  'struct address_space* folio_mapping(struct folio*)'
  'int folio_referenced(struct folio*, int, struct mem_cgroup*, unsigned long*)'
  'void mem_cgroup_update_lru_size(struct lruvec*, enum lru_list, int, int)'
  'void put_pages_list(struct list_head*)'

1 variable symbol(s) added
  'struct mem_cgroup* root_mem_cgroup'

Bug: 302230539
Change-Id: I34bf400a9f09aa593ccba4dad8a94e87c9b32468
Signed-off-by: Zichun Zheng <zhengzichun@oppo.com>
2023-09-28 22:13:37 +00:00
Zichun Zheng
89815ec103 ANDROID: GKI: export symbols to do reverse mapping within memcg and modify lru stats
Export the symbols below to modify LRU state:
  root_mem_cgroup
  __mod_lruvec_state
  mem_cgroup_update_lru_size
  folio_referenced

Bug: 302230539
Change-Id: I27ac888f0fa09981ef4497bc04e4254318af7077
Signed-off-by: Zichun Zheng <zhengzichun@oppo.com>
2023-09-28 22:13:19 +00:00
Bart Van Assche
45fe413fdf ANDROID: gki_defconfig: Enable CONFIG_BLK_CGROUP_IOPRIO
Prepare for supporting I/O priority in the storage stack.

Bug: 186902601
Change-Id: I387ac4792c89d88d131c5146b116a0393c01b096
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-09-28 11:30:27 -07:00
Prakruthi Deepak Heragu
c240f4ed00 ANDROID: gunyah: Convert mutex_lock_interruptible to mutex_lock
Crosvm thread can get interrupted while making a call to the Resource
Manager. If we wait on mutext_lock_interruptible, the RM call might be
incomplete and as part of the cleanup if there are further RM calls that
need to be made, they will also return without making the RM call
because there is a signal on the thread. Use mutex_lock while making the
RM calls to ensure the RM call completes and only if there is a geniune
error, we can clean up.

Bug: 302322730
Change-Id: I961aa917588a72bb8733e6f80d80f3ceed179076
Signed-off-by: Prakruthi Deepak Heragu <quic_pheragu@quicinc.com>
2023-09-27 23:07:38 +00:00
Xin Liu
6305df8009 UPSTREAM: bpf, sockmap: fix deadlocks in the sockhash and sockmap
[ Upstream commit ed17aa92dc56b6d8883e4b7a8f1c6fbf5ed6cd29 ]

When huang uses sched_switch tracepoint, the tracepoint
does only one thing in the mounted ebpf program, which
deletes the fixed elements in sockhash ([0])

It seems that elements in sockhash are rarely actively
deleted by users or ebpf program. Therefore, we do not
pay much attention to their deletion. Compared with hash
maps, sockhash only provides spin_lock_bh protection.
This causes it to appear to have self-locking behavior
in the interrupt context.

  [0]:https://lore.kernel.org/all/CABcoxUayum5oOqFMMqAeWuS8+EzojquSOSyDA3J_2omY=2EeAg@mail.gmail.com/

Bug: 293551383
Reported-by: Hsin-Wei Hung <hsinweih@uci.edu>
Fixes: 604326b41a ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: Xin Liu <liuxin350@huawei.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/20230406122622.109978-1-liuxin350@huawei.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit f333854dce4a079783f00c201869b9ee8f7ff3c3)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I913aa014f16e294ab9f9fec04d3e63afb8aa803f
2023-09-27 18:28:29 +00:00
valis
7999b48d76 UPSTREAM: net: sched: sch_qfq: Fix UAF in qfq_dequeue()
[ Upstream commit 8fc134fee27f2263988ae38920bc03da416b03d8 ]

When the plug qdisc is used as a class of the qfq qdisc it could trigger a
UAF. This issue can be reproduced with following commands:

  tc qdisc add dev lo root handle 1: qfq
  tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512
  tc qdisc add dev lo parent 1:1 handle 2: plug
  tc filter add dev lo parent 1: basic classid 1:1
  ping -c1 127.0.0.1

and boom:

[  285.353793] BUG: KASAN: slab-use-after-free in qfq_dequeue+0xa7/0x7f0
[  285.354910] Read of size 4 at addr ffff8880bad312a8 by task ping/144
[  285.355903]
[  285.356165] CPU: 1 PID: 144 Comm: ping Not tainted 6.5.0-rc3+ #4
[  285.357112] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
[  285.358376] Call Trace:
[  285.358773]  <IRQ>
[  285.359109]  dump_stack_lvl+0x44/0x60
[  285.359708]  print_address_description.constprop.0+0x2c/0x3c0
[  285.360611]  kasan_report+0x10c/0x120
[  285.361195]  ? qfq_dequeue+0xa7/0x7f0
[  285.361780]  qfq_dequeue+0xa7/0x7f0
[  285.362342]  __qdisc_run+0xf1/0x970
[  285.362903]  net_tx_action+0x28e/0x460
[  285.363502]  __do_softirq+0x11b/0x3de
[  285.364097]  do_softirq.part.0+0x72/0x90
[  285.364721]  </IRQ>
[  285.365072]  <TASK>
[  285.365422]  __local_bh_enable_ip+0x77/0x90
[  285.366079]  __dev_queue_xmit+0x95f/0x1550
[  285.366732]  ? __pfx_csum_and_copy_from_iter+0x10/0x10
[  285.367526]  ? __pfx___dev_queue_xmit+0x10/0x10
[  285.368259]  ? __build_skb_around+0x129/0x190
[  285.368960]  ? ip_generic_getfrag+0x12c/0x170
[  285.369653]  ? __pfx_ip_generic_getfrag+0x10/0x10
[  285.370390]  ? csum_partial+0x8/0x20
[  285.370961]  ? raw_getfrag+0xe5/0x140
[  285.371559]  ip_finish_output2+0x539/0xa40
[  285.372222]  ? __pfx_ip_finish_output2+0x10/0x10
[  285.372954]  ip_output+0x113/0x1e0
[  285.373512]  ? __pfx_ip_output+0x10/0x10
[  285.374130]  ? icmp_out_count+0x49/0x60
[  285.374739]  ? __pfx_ip_finish_output+0x10/0x10
[  285.375457]  ip_push_pending_frames+0xf3/0x100
[  285.376173]  raw_sendmsg+0xef5/0x12d0
[  285.376760]  ? do_syscall_64+0x40/0x90
[  285.377359]  ? __static_call_text_end+0x136578/0x136578
[  285.378173]  ? do_syscall_64+0x40/0x90
[  285.378772]  ? kasan_enable_current+0x11/0x20
[  285.379469]  ? __pfx_raw_sendmsg+0x10/0x10
[  285.380137]  ? __sock_create+0x13e/0x270
[  285.380673]  ? __sys_socket+0xf3/0x180
[  285.381174]  ? __x64_sys_socket+0x3d/0x50
[  285.381725]  ? entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[  285.382425]  ? __rcu_read_unlock+0x48/0x70
[  285.382975]  ? ip4_datagram_release_cb+0xd8/0x380
[  285.383608]  ? __pfx_ip4_datagram_release_cb+0x10/0x10
[  285.384295]  ? preempt_count_sub+0x14/0xc0
[  285.384844]  ? __list_del_entry_valid+0x76/0x140
[  285.385467]  ? _raw_spin_lock_bh+0x87/0xe0
[  285.386014]  ? __pfx__raw_spin_lock_bh+0x10/0x10
[  285.386645]  ? release_sock+0xa0/0xd0
[  285.387148]  ? preempt_count_sub+0x14/0xc0
[  285.387712]  ? freeze_secondary_cpus+0x348/0x3c0
[  285.388341]  ? aa_sk_perm+0x177/0x390
[  285.388856]  ? __pfx_aa_sk_perm+0x10/0x10
[  285.389441]  ? check_stack_object+0x22/0x70
[  285.390032]  ? inet_send_prepare+0x2f/0x120
[  285.390603]  ? __pfx_inet_sendmsg+0x10/0x10
[  285.391172]  sock_sendmsg+0xcc/0xe0
[  285.391667]  __sys_sendto+0x190/0x230
[  285.392168]  ? __pfx___sys_sendto+0x10/0x10
[  285.392727]  ? kvm_clock_get_cycles+0x14/0x30
[  285.393328]  ? set_normalized_timespec64+0x57/0x70
[  285.393980]  ? _raw_spin_unlock_irq+0x1b/0x40
[  285.394578]  ? __x64_sys_clock_gettime+0x11c/0x160
[  285.395225]  ? __pfx___x64_sys_clock_gettime+0x10/0x10
[  285.395908]  ? _copy_to_user+0x3e/0x60
[  285.396432]  ? exit_to_user_mode_prepare+0x1a/0x120
[  285.397086]  ? syscall_exit_to_user_mode+0x22/0x50
[  285.397734]  ? do_syscall_64+0x71/0x90
[  285.398258]  __x64_sys_sendto+0x74/0x90
[  285.398786]  do_syscall_64+0x64/0x90
[  285.399273]  ? exit_to_user_mode_prepare+0x1a/0x120
[  285.399949]  ? syscall_exit_to_user_mode+0x22/0x50
[  285.400605]  ? do_syscall_64+0x71/0x90
[  285.401124]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[  285.401807] RIP: 0033:0x495726
[  285.402233] Code: ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 09
[  285.404683] RSP: 002b:00007ffcc25fb618 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  285.405677] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 0000000000495726
[  285.406628] RDX: 0000000000000040 RSI: 0000000002518750 RDI: 0000000000000000
[  285.407565] RBP: 00000000005205ef R08: 00000000005f8838 R09: 000000000000001c
[  285.408523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000002517634
[  285.409460] R13: 00007ffcc25fb6f0 R14: 0000000000000003 R15: 0000000000000000
[  285.410403]  </TASK>
[  285.410704]
[  285.410929] Allocated by task 144:
[  285.411402]  kasan_save_stack+0x1e/0x40
[  285.411926]  kasan_set_track+0x21/0x30
[  285.412442]  __kasan_slab_alloc+0x55/0x70
[  285.412973]  kmem_cache_alloc_node+0x187/0x3d0
[  285.413567]  __alloc_skb+0x1b4/0x230
[  285.414060]  __ip_append_data+0x17f7/0x1b60
[  285.414633]  ip_append_data+0x97/0xf0
[  285.415144]  raw_sendmsg+0x5a8/0x12d0
[  285.415640]  sock_sendmsg+0xcc/0xe0
[  285.416117]  __sys_sendto+0x190/0x230
[  285.416626]  __x64_sys_sendto+0x74/0x90
[  285.417145]  do_syscall_64+0x64/0x90
[  285.417624]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[  285.418306]
[  285.418531] Freed by task 144:
[  285.418960]  kasan_save_stack+0x1e/0x40
[  285.419469]  kasan_set_track+0x21/0x30
[  285.419988]  kasan_save_free_info+0x27/0x40
[  285.420556]  ____kasan_slab_free+0x109/0x1a0
[  285.421146]  kmem_cache_free+0x1c2/0x450
[  285.421680]  __netif_receive_skb_core+0x2ce/0x1870
[  285.422333]  __netif_receive_skb_one_core+0x97/0x140
[  285.423003]  process_backlog+0x100/0x2f0
[  285.423537]  __napi_poll+0x5c/0x2d0
[  285.424023]  net_rx_action+0x2be/0x560
[  285.424510]  __do_softirq+0x11b/0x3de
[  285.425034]
[  285.425254] The buggy address belongs to the object at ffff8880bad31280
[  285.425254]  which belongs to the cache skbuff_head_cache of size 224
[  285.426993] The buggy address is located 40 bytes inside of
[  285.426993]  freed 224-byte region [ffff8880bad31280, ffff8880bad31360)
[  285.428572]
[  285.428798] The buggy address belongs to the physical page:
[  285.429540] page:00000000f4b77674 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbad31
[  285.430758] flags: 0x100000000000200(slab|node=0|zone=1)
[  285.431447] page_type: 0xffffffff()
[  285.431934] raw: 0100000000000200 ffff88810094a8c0 dead000000000122 0000000000000000
[  285.432757] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
[  285.433562] page dumped because: kasan: bad access detected
[  285.434144]
[  285.434320] Memory state around the buggy address:
[  285.434828]  ffff8880bad31180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  285.435580]  ffff8880bad31200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  285.436264] >ffff8880bad31280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  285.436777]                                   ^
[  285.437106]  ffff8880bad31300: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[  285.437616]  ffff8880bad31380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  285.438126] ==================================================================
[  285.438662] Disabling lock debugging due to kernel taint

Fix this by:
1. Changing sch_plug's .peek handler to qdisc_peek_dequeued(), a
function compatible with non-work-conserving qdiscs
2. Checking the return value of qdisc_dequeue_peeked() in sch_qfq.

Bug: 300131820
Fixes: 462dbc9101 ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Reported-by: valis <sec@valis.email>
Signed-off-by: valis <sec@valis.email>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20230901162237.11525-1-jhs@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit a18349dc8d)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I2be4a7b7eb1448df8281c145ee2ca441bd746c9a
2023-09-27 18:24:36 +00:00
Kees Cook
709dc094e3 UPSTREAM: ARM: ptrace: Restore syscall skipping for tracers
Since commit 4e57a4ddf6 ("ARM: 9107/1: syscall: always store
thread_info->abi_syscall"), the seccomp selftests "syscall_errno"
and "syscall_faked" have been broken. Both seccomp and PTRACE depend
on using the special value of "-1" for skipping syscalls. This value
wasn't working because it was getting masked by __NR_SYSCALL_MASK in
both PTRACE_SET_SYSCALL and get_syscall_nr().

Explicitly test for -1 in PTRACE_SET_SYSCALL and get_syscall_nr(),
leaving it exposed when present, allowing tracers to skip syscalls
again.

Cc: Russell King <linux@armlinux.org.uk>
Cc: Arnd Bergmann <arnd@kernel.org>
Cc: Lecopzer Chen <lecopzer.chen@mediatek.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: linux-arm-kernel@lists.infradead.org
Fixes: 4e57a4ddf6 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall")
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20230810195422.2304827-2-keescook@chromium.org
Change-Id: I5b13c06a9cca85d13beec809a695198a7696df45
Signed-off-by: Kees Cook <keescook@chromium.org>
(cherry picked from commit 4697b5848bd933f68ebd04836362c8de0cacaf71)
Bug: 289991100
Signed-off-by: Edward Liaw <edliaw@google.com>
2023-09-27 15:39:53 +00:00
Kees Cook
ea494b2716 UPSTREAM: ARM: ptrace: Restore syscall restart tracing
Since commit 4e57a4ddf6 ("ARM: 9107/1: syscall: always store
thread_info->abi_syscall"), the seccomp selftests "syscall_restart" has
been broken. This was caused by the restart syscall not being stored to
"abi_syscall" during restart setup before branching to the "local_restart"
label. Tracers would see the wrong syscall, and scno would get overwritten
while returning from the TIF_WORK path. Add the missing store.

Cc: Russell King <linux@armlinux.org.uk>
Cc: Arnd Bergmann <arnd@kernel.org>
Cc: Lecopzer Chen <lecopzer.chen@mediatek.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: linux-arm-kernel@lists.infradead.org
Fixes: 4e57a4ddf6 ("ARM: 9107/1: syscall: always store thread_info->abi_syscall")
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20230810195422.2304827-1-keescook@chromium.org
Change-Id: If78d334ed46335cf8eff33a4bbcb1da5e86de016
Signed-off-by: Kees Cook <keescook@chromium.org>
(cherry picked from commit cf007647475b5090819c5fe8da771073145c7334)
Bug: 289991100
Signed-off-by: Edward Liaw <edliaw@google.com>
2023-09-27 15:39:53 +00:00
Neill Kapron
b374d94195 Revert "BACKPORT: FROMGIT: usb: gadget: udc: Handle gadget_connect failure during bind operation"
This reverts commit 251aa28d16.

Reason for revert: b/301670242

The connect_lock mutex is not being released in error path. This patch was reverted upstream.

Signed-off-by: Neill Kapron <nkapron@google.com>
Change-Id: I802a9a8afc9f23b1bf91fa4df4bfb5d207373b04
2023-09-27 12:21:55 +00:00
Jiyong Park
ae5ea9043d ANDROID: Move microdroid and crashdump defconfigs to common
They don't have device-specific modules. They are just generic configs
that are different from GKI.

Bug: 301852599
Test: run following commands
tools/bazel run //common:kernel_aarch64_microdroid_dist
tools/bazel run //common:kernel_x86_64_microdroid_dist
tools/bazel run //common:kernel_aarch64_microdroid_config -- menuconfig
tools/bazel run //common:kernel_x86_64_microdroid_config -- menuconfig
tools/bazel run //common:kernel_aarch64_crashdump_dist
tools/bazel run //common:kernel_x86_64_crashdump_dist
tools/bazel run //common:kernel_aarch64_crashdump_config -- menuconfig
tools/bazel run //common:kernel_x86_64_crashdump_config -- menuconfig

Change-Id: I8908a7499451ace0740979b694eb5fcc68398c61
Signed-off-by: Jiyong Park <jiyong@google.com>
2023-09-26 16:18:51 +00:00
Paolo Abeni
b548c046c7 UPSTREAM: net: prevent skb corruption on frag list segmentation
[ Upstream commit c329b261afe71197d9da83c1f18eb45a7e97e089 ]

Ian reported several skb corruptions triggered by rx-gro-list,
collecting different oops alike:

[   62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0
[   62.631083] #PF: supervisor read access in kernel mode
[   62.636312] #PF: error_code(0x0000) - not-present page
[   62.641541] PGD 0 P4D 0
[   62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI
[   62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364
[   62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022
[   62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858
./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261
net/ipv4/udp_offload.c:277)
[   62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246
[   62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000
[   62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4
[   62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9
[   62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2
[   62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9
[   62.728654] FS:  0000000000000000(0000) GS:ffffa127efa40000(0000)
knlGS:0000000000000000
[   62.736852] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0
[   62.749948] Call Trace:
[   62.752498]  <TASK>
[   62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398)
[   62.787605] skb_mac_gso_segment (net/core/gro.c:141)
[   62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2))
[   62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862
net/core/dev.c:3659)
[   62.804695] validate_xmit_skb_list (net/core/dev.c:3710)
[   62.809158] sch_direct_xmit (net/sched/sch_generic.c:330)
[   62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210)
net/netfilter/core.c:626)
[   62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55)
[   62.825652] maybe_deliver (net/bridge/br_forward.c:193)
[   62.829420] br_flood (net/bridge/br_forward.c:233)
[   62.832758] br_handle_frame_finish (net/bridge/br_input.c:215)
[   62.837403] br_handle_frame (net/bridge/br_input.c:298
net/bridge/br_input.c:416)
[   62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387)
[   62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570)
[   62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638
net/core/dev.c:5727)
[   62.876795] napi_complete_done (./include/linux/list.h:37
./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067)
[   62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191)
[   62.893534] __napi_poll (net/core/dev.c:6498)
[   62.897133] napi_threaded_poll (./include/linux/netpoll.h:89
net/core/dev.c:6640)
[   62.905276] kthread (kernel/kthread.c:379)
[   62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314)
[   62.917119]  </TASK>

In the critical scenario, rx-gro-list GRO-ed packets are fed, via a
bridge, both to the local input path and to an egress device (tun).

The segmentation of such packets unsafely writes to the cloned skbs
with shared heads.

This change addresses the issue by uncloning as needed the
to-be-segmented skbs.

Reported-by: Ian Kumlien <ian.kumlien@gmail.com>
Tested-by: Ian Kumlien <ian.kumlien@gmail.com>
Fixes: 3a1296a38d ("net: Support GRO/GSO fraglist chaining.")
Change-Id: I6e79a4d19751becd42ec486233f1a8de4a0f3f7e
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-09-26 00:04:05 +00:00
xieliujie
060ebb378d ANDROID: ABI: Update oplus symbol list
INFO: 1 function symbol(s) added
  'int __traceiter_android_vh_percpu_rwsem_wq_add(void*, struct percpu_rw_semaphore*, bool)'

1 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_percpu_rwsem_wq_add'

Bug: 301066838
Change-Id: Ie6be06a6c19959a992555f65cf9b5edef5c86010
Signed-off-by: xieliujie <xieliujie@oppo.com>
2023-09-22 20:08:20 +00:00
xieliujie
f451f4a599 ANDROID: vendor_hooks: Add hooks for oem percpu-rwsem optimaton
Recently we have discovered many lag issues caused by percpu_rwsem
lock-holding tasks not being scheduled for a long time. we need to
identify them and provide appropriate scheduling protection in our
oem scheduler.
To support this, we add one hook below:
	trace_android_vh_percpu_rwsem_wq_add

Bug: 301066838
Change-Id: Id770c1a7978842abfc62d3fa9aeb5ac7a1904972
Signed-off-by: xieliujie <xieliujie@oppo.com>
2023-09-22 17:33:39 +00:00
lfc
a3cb85bffe ANDROID: ABI: Update oplus symbol list
INFO: 5 function symbol(s) added
  'int __traceiter_android_vh_alloc_oem_binder_struct(void*, struct binder_transaction_data*, struct binder_transaction*, struct binder_proc*)'
  'int __traceiter_android_vh_binder_free_buf(void*, struct binder_proc*, struct binder_thread*, struct binder_buffer*)'
  'int __traceiter_android_vh_binder_special_task(void*, struct binder_transaction*, struct binder_proc*, struct binder_thread*, struct binder_work*, struct list_head*, bool, bool*)'
  'int __traceiter_android_vh_binder_transaction_received(void*, struct binder_transaction*, struct binder_proc*, struct binder_thread*, uint32_t)'
  'int __traceiter_android_vh_free_oem_binder_struct(void*, struct binder_transaction*)'

5 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_alloc_oem_binder_struct'
  'struct tracepoint __tracepoint_android_vh_binder_free_buf'
  'struct tracepoint __tracepoint_android_vh_binder_special_task'
  'struct tracepoint __tracepoint_android_vh_binder_transaction_received'
  'struct tracepoint __tracepoint_android_vh_free_oem_binder_struct'

Bug: 299328919

Change-Id: I3abb4eb46404ce7f68d1b86ac40cb972dfe48b33
Signed-off-by: lfc <lfc@oppo.com>
2023-09-21 23:30:37 +00:00
lfc
740a51391b ANDROID: vendor_hooks: Add hooks for binder
Add hooks to support oem's binder feature of improving binder_thread->task sched priority

1) Check if it is a specific task in trace_android_vh_binder_transaction_buffer() and store the flag to t->android_vendor_data1
2) If it is a specific binder task and binder_thread selected, raise the sched priority of binder_thread->task in runqueue.
3) If it is a specific binder task but no binder_thread selected (e.g pending_async or no free threads), insert t->work to the appropriate position in the list.
4) Reset the sched priority when BR_TRANSACTION or BC_FREE_BUFFER.
Some high-priority async binder task reset the sched priority when BC_FREE_BUFFER in trace_android_vh_binder_free_buf().
Some middle-priority async binder task reset the sched priority when driver return server "BR_TRANSACTION" in trace_android_vh_binder_transaction_received().

Bug: 299328919

Change-Id: Iab4939fe4a4881b31961aaa2fef500b51c944743
Signed-off-by: lfc <lfc@oppo.com>
2023-09-21 23:30:37 +00:00
Peifeng Li
c6724bfeda ANDROID: uid_sys_stat: instead update_io_stats_uid_locked to update_io_stats_uid
Update_io_stats_uid_locked would take a long lock-time of uid_lock due to
call do_each_thread to compute uid_entry->io, which would cause to lock
competition sometime.

Using uid_entry_tmp to get the result of update_io_stats_uid, so that we
can unlock_uid during update_io_stats_uid, in order to avoid the
unnecessary lock-time of uid_lock.

Bug: 278138377

Signed-off-by: Peifeng Li <lipeifeng@oppo.com>
(cherry picked from https://android-review.googlesource.com/q/commit:c1fa53f3cf85c0a1c23f0e0a944986b4aa049073)
Merged-In: I5be62105e57e2a896a95d906e3c14e17c7f8077d
Change-Id: I5be62105e57e2a896a95d906e3c14e17c7f8077d
2023-09-21 15:14:31 +00:00
Peifeng Li
97f2f8a065 ANDROID: uid_sys_stat: split the global lock uid_lock to the fine-grained
locks for each hlist in hash_table.

1.Hash_table in uid_sys_stat is protected by a global lock named id_lock,
which causes some lock competition issue. Actually, uid_lock can be split to
several file-grained locks for each hlist in hash_table, which avoid
the unnecessary lock competition when get different-uid process info.

2. Switching rt-mutex to spinlock, in order to operate with read_rcu_lock.

Bug: 278138377
Signed-off-by: Peifeng Li <lipeifeng@oppo.com>
(cherry picked from https://android-review.googlesource.com/q/commit:c949fbdce0bc792dea206c709d909094be579c3a)
Merged-In: Ib252b65e9aebe3a594e6edf075f7aa01f8e6105d
Change-Id: Ib252b65e9aebe3a594e6edf075f7aa01f8e6105d
2023-09-21 15:14:31 +00:00
Saravana Kannan
9290fc3e8d ANDROID: Flush deferred probe list before dropping host priv
Some IOMMU devices might be deferred after the driver being
loaded early, so we need to flush the deferred probe list,
this will work if all dependencies already exist.

Bug: 290582379
Change-Id: I5fb3af9b0f7d1b4dbf57078707112dfdb8a3dc23
Signed-off-by: Saravana Kannan <saravanak@google.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
2023-09-21 13:45:20 +00:00
Will Deacon
6625133137 ANDROID: KVM: arm64: Don't force pte mappings in [n]VHE guest stage-2
Commit d096d35445 ("ANDROID: KVM: arm64: Have different callbacks for
PTE manipulation") accidentally forces the use of pte-level mappings for
the guest stage-2 page-table when not using pKVM.

This confuses user_mem_abort() when the guest takes a permission fault
trying to execute from a huge page. Since the fault is reported at the
pte-level, we end up handling it as a translation fault by calling
kvm_pgtable_stage2_map() which dutifully returns -EAGAIN when it finds
the RW PTE. Consequently, the guest appears to hang randomly during boot.

Fix the issue by inverting stage2_force_pte_cb() so that the host is in
complete control of the mapping granularity of the guest when pKVM is
not being used.

Cc: Fuad Tabba <tabba@google.com>
Cc: Mostafa Saleh <smostafa@google.com>
Fixes: d096d35445 ("ANDROID: KVM: arm64: Have different callbacks for PTE manipulation")
Signed-off-by: Will Deacon <willdeacon@google.com>
Bug: 222044487
Change-Id: Ideab281ae6d1d5c0fd29fba03ad8ed1cae521a1e
2023-09-21 12:29:11 +00:00
Kuen-Han Tsai
2f2c035453 UPSTREAM: usb: gadget: u_serial: Add null pointer check in gs_start_io
If gs_close has cleared port->port.tty and gs_start_io is called
afterwards, then the function tty_wakeup will attempt to access the value
of the pointer port->port.tty which will cause a null pointer
dereference error.

To avoid this, add a null pointer check to gs_start_io before attempting
to access the value of the pointer port->port.tty.

Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Message-ID: <20230602070009.1353946-1-khtsai@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 283247551
(cherry picked from commit ffd603f214237e250271162a5b325c6199a65382)
Change-Id: I782ef328b0d49810d3fb23c002a86439e6728542
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
(cherry picked from commit ca0cd377615866a0253c6e495f99fad57bbaab86)
2023-09-21 07:11:32 +00:00
Peter Zijlstra
ac9005946a UPSTREAM: sched: Consider task_struct::saved_state in wait_task_inactive()
With the introduction of task_struct::saved_state in commit
5f220be214 ("sched/wakeup: Prepare for RT sleeping spin/rwlocks")
matching the task state has gotten more complicated. That same commit
changed try_to_wake_up() to consider both states, but
wait_task_inactive() has been neglected.

Sebastian noted that the wait_task_inactive() usage in
ptrace_check_attach() can misbehave when ptrace_stop() is blocked on
the tasklist_lock after it sets TASK_TRACED.

Therefore extract a common helper from ttwu_state_match() and use that
to teach wait_task_inactive() about the PREEMPT_RT locks.

Originally-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lkml.kernel.org/r/20230601091234.GW83892@hirez.programming.kicks-ass.net

(cherry picked from commit 1c06918788e8ae6e69e4381a2806617312922524)
Bug: 292064955
Change-Id: I2cc02dfdf3c04be146078f80d09c3a87979d79a6
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-09-20 21:39:14 +00:00
Peter Zijlstra
b52b33e912 UPSTREAM: sched: Unconditionally use full-fat wait_task_inactive()
While modifying wait_task_inactive() for PREEMPT_RT; the build robot
noted that UP got broken. This led to audit and consideration of the
UP implementation of wait_task_inactive().

It looks like the UP implementation is also broken for PREEMPT;
consider task_current_syscall() getting preempted between the two
calls to wait_task_inactive().

Therefore move the wait_task_inactive() implementation out of
CONFIG_SMP and unconditionally use it.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20230602103731.GA630648%40hirez.programming.kicks-ass.net

(cherry picked from commit d5e1586617be7093ea3419e3fa9387ed833cdbb1)
Bug: 292064955
Change-Id: Ief91cf48c27533fee47d5bd049c8a9be4010e6f6
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-09-20 21:39:14 +00:00
steve2_yang
8465ef2b4f ANDROID: GKI: Update symbol list for ASUS
3 symbol(s) added
  hid_hw_output_report
  hid_hw_open
  hid_hw_close

Bug: 301210579
Change-Id: Idd91bc728f0a7d4f4333862fc4974187caf921c9
Signed-off-by: Steve2 Yang <steve2_yang@asus.com>
2023-09-20 15:23:46 +00:00
Yi Yang
1e4c6e5048 UPSTREAM: tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
commit 3c4f8333b582487a2d1e02171f1465531cde53e3 upstream.

In commit 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux"), the UAF
problem is not completely fixed. There is a race condition in
gsm_cleanup_mux(), which caused this UAF.

The UAF problem is triggered by the following race:
task[5046]                     task[5054]
-----------------------        -----------------------
gsm_cleanup_mux();
dlci = gsm->dlci[0];
mutex_lock(&gsm->mutex);
                               gsm_cleanup_mux();
			       dlci = gsm->dlci[0]; //Didn't take the lock
gsm_dlci_release(gsm->dlci[i]);
gsm->dlci[i] = NULL;
mutex_unlock(&gsm->mutex);
                               mutex_lock(&gsm->mutex);
			       dlci->dead = true; //UAF

Fix it by assigning values after mutex_lock().

Bug: 291178675
Link: https://syzkaller.appspot.com/text?tag=CrashReport&x=176188b5a80000
Cc: stable <stable@kernel.org>
Fixes: 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux")
Fixes: aa371e96f0 ("tty: n_gsm: fix restart handling via CLD command")
Signed-off-by: Yi Yang <yiyang13@huawei.com>
Co-developed-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
Signed-off-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
Link: https://lore.kernel.org/r/20230811031121.153237-1-yiyang13@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 31311a9a4b)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I460a0f21f4121531d7732e09643a451382dfa2da
2023-09-20 14:41:24 +00:00
Thadeu Lima de Souza Cascardo
40b46d8656 UPSTREAM: netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
commit caf3ef7468f7534771b5c44cd8dbd6f7f87c2cbd upstream.

When evaluating byteorder expressions with size 2, a union with 32-bit and
16-bit members is used. Since the 16-bit members are aligned to 32-bit,
the array accesses will be out-of-bounds.

It may lead to a stack-out-of-bounds access like the one below:

[   23.095215] ==================================================================
[   23.095625] BUG: KASAN: stack-out-of-bounds in nft_byteorder_eval+0x13c/0x320
[   23.096020] Read of size 2 at addr ffffc90000007948 by task ping/115
[   23.096358]
[   23.096456] CPU: 0 PID: 115 Comm: ping Not tainted 6.4.0+ #413
[   23.096770] Call Trace:
[   23.096910]  <IRQ>
[   23.097030]  dump_stack_lvl+0x60/0xc0
[   23.097218]  print_report+0xcf/0x630
[   23.097388]  ? nft_byteorder_eval+0x13c/0x320
[   23.097577]  ? kasan_addr_to_slab+0xd/0xc0
[   23.097760]  ? nft_byteorder_eval+0x13c/0x320
[   23.097949]  kasan_report+0xc9/0x110
[   23.098106]  ? nft_byteorder_eval+0x13c/0x320
[   23.098298]  __asan_load2+0x83/0xd0
[   23.098453]  nft_byteorder_eval+0x13c/0x320
[   23.098659]  nft_do_chain+0x1c8/0xc50
[   23.098852]  ? __pfx_nft_do_chain+0x10/0x10
[   23.099078]  ? __kasan_check_read+0x11/0x20
[   23.099295]  ? __pfx___lock_acquire+0x10/0x10
[   23.099535]  ? __pfx___lock_acquire+0x10/0x10
[   23.099745]  ? __kasan_check_read+0x11/0x20
[   23.099929]  nft_do_chain_ipv4+0xfe/0x140
[   23.100105]  ? __pfx_nft_do_chain_ipv4+0x10/0x10
[   23.100327]  ? lock_release+0x204/0x400
[   23.100515]  ? nf_hook.constprop.0+0x340/0x550
[   23.100779]  nf_hook_slow+0x6c/0x100
[   23.100977]  ? __pfx_nft_do_chain_ipv4+0x10/0x10
[   23.101223]  nf_hook.constprop.0+0x334/0x550
[   23.101443]  ? __pfx_ip_local_deliver_finish+0x10/0x10
[   23.101677]  ? __pfx_nf_hook.constprop.0+0x10/0x10
[   23.101882]  ? __pfx_ip_rcv_finish+0x10/0x10
[   23.102071]  ? __pfx_ip_local_deliver_finish+0x10/0x10
[   23.102291]  ? rcu_read_lock_held+0x4b/0x70
[   23.102481]  ip_local_deliver+0xbb/0x110
[   23.102665]  ? __pfx_ip_rcv+0x10/0x10
[   23.102839]  ip_rcv+0x199/0x2a0
[   23.102980]  ? __pfx_ip_rcv+0x10/0x10
[   23.103140]  __netif_receive_skb_one_core+0x13e/0x150
[   23.103362]  ? __pfx___netif_receive_skb_one_core+0x10/0x10
[   23.103647]  ? mark_held_locks+0x48/0xa0
[   23.103819]  ? process_backlog+0x36c/0x380
[   23.103999]  __netif_receive_skb+0x23/0xc0
[   23.104179]  process_backlog+0x91/0x380
[   23.104350]  __napi_poll.constprop.0+0x66/0x360
[   23.104589]  ? net_rx_action+0x1cb/0x610
[   23.104811]  net_rx_action+0x33e/0x610
[   23.105024]  ? _raw_spin_unlock+0x23/0x50
[   23.105257]  ? __pfx_net_rx_action+0x10/0x10
[   23.105485]  ? mark_held_locks+0x48/0xa0
[   23.105741]  __do_softirq+0xfa/0x5ab
[   23.105956]  ? __dev_queue_xmit+0x765/0x1c00
[   23.106193]  do_softirq.part.0+0x49/0xc0
[   23.106423]  </IRQ>
[   23.106547]  <TASK>
[   23.106670]  __local_bh_enable_ip+0xf5/0x120
[   23.106903]  __dev_queue_xmit+0x789/0x1c00
[   23.107131]  ? __pfx___dev_queue_xmit+0x10/0x10
[   23.107381]  ? find_held_lock+0x8e/0xb0
[   23.107585]  ? lock_release+0x204/0x400
[   23.107798]  ? neigh_resolve_output+0x185/0x350
[   23.108049]  ? mark_held_locks+0x48/0xa0
[   23.108265]  ? neigh_resolve_output+0x185/0x350
[   23.108514]  neigh_resolve_output+0x246/0x350
[   23.108753]  ? neigh_resolve_output+0x246/0x350
[   23.109003]  ip_finish_output2+0x3c3/0x10b0
[   23.109250]  ? __pfx_ip_finish_output2+0x10/0x10
[   23.109510]  ? __pfx_nf_hook+0x10/0x10
[   23.109732]  __ip_finish_output+0x217/0x390
[   23.109978]  ip_finish_output+0x2f/0x130
[   23.110207]  ip_output+0xc9/0x170
[   23.110404]  ip_push_pending_frames+0x1a0/0x240
[   23.110652]  raw_sendmsg+0x102e/0x19e0
[   23.110871]  ? __pfx_raw_sendmsg+0x10/0x10
[   23.111093]  ? lock_release+0x204/0x400
[   23.111304]  ? __mod_lruvec_page_state+0x148/0x330
[   23.111567]  ? find_held_lock+0x8e/0xb0
[   23.111777]  ? find_held_lock+0x8e/0xb0
[   23.111993]  ? __rcu_read_unlock+0x7c/0x2f0
[   23.112225]  ? aa_sk_perm+0x18a/0x550
[   23.112431]  ? filemap_map_pages+0x4f1/0x900
[   23.112665]  ? __pfx_aa_sk_perm+0x10/0x10
[   23.112880]  ? find_held_lock+0x8e/0xb0
[   23.113098]  inet_sendmsg+0xa0/0xb0
[   23.113297]  ? inet_sendmsg+0xa0/0xb0
[   23.113500]  ? __pfx_inet_sendmsg+0x10/0x10
[   23.113727]  sock_sendmsg+0xf4/0x100
[   23.113924]  ? move_addr_to_kernel.part.0+0x4f/0xa0
[   23.114190]  __sys_sendto+0x1d4/0x290
[   23.114391]  ? __pfx___sys_sendto+0x10/0x10
[   23.114621]  ? __pfx_mark_lock.part.0+0x10/0x10
[   23.114869]  ? lock_release+0x204/0x400
[   23.115076]  ? find_held_lock+0x8e/0xb0
[   23.115287]  ? rcu_is_watching+0x23/0x60
[   23.115503]  ? __rseq_handle_notify_resume+0x6e2/0x860
[   23.115778]  ? __kasan_check_write+0x14/0x30
[   23.116008]  ? blkcg_maybe_throttle_current+0x8d/0x770
[   23.116285]  ? mark_held_locks+0x28/0xa0
[   23.116503]  ? do_syscall_64+0x37/0x90
[   23.116713]  __x64_sys_sendto+0x7f/0xb0
[   23.116924]  do_syscall_64+0x59/0x90
[   23.117123]  ? irqentry_exit_to_user_mode+0x25/0x30
[   23.117387]  ? irqentry_exit+0x77/0xb0
[   23.117593]  ? exc_page_fault+0x92/0x140
[   23.117806]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[   23.118081] RIP: 0033:0x7f744aee2bba
[   23.118282] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
[   23.119237] RSP: 002b:00007ffd04a7c9f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[   23.119644] RAX: ffffffffffffffda RBX: 00007ffd04a7e0a0 RCX: 00007f744aee2bba
[   23.120023] RDX: 0000000000000040 RSI: 000056488e9e6300 RDI: 0000000000000003
[   23.120413] RBP: 000056488e9e6300 R08: 00007ffd04a80320 R09: 0000000000000010
[   23.120809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
[   23.121219] R13: 00007ffd04a7dc38 R14: 00007ffd04a7ca00 R15: 00007ffd04a7e0a0
[   23.121617]  </TASK>
[   23.121749]
[   23.121845] The buggy address belongs to the virtual mapping at
[   23.121845]  [ffffc90000000000, ffffc90000009000) created by:
[   23.121845]  irq_init_percpu_irqstack+0x1cf/0x270
[   23.122707]
[   23.122803] The buggy address belongs to the physical page:
[   23.123104] page:0000000072ac19f0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24a09
[   23.123609] flags: 0xfffffc0001000(reserved|node=0|zone=1|lastcpupid=0x1fffff)
[   23.123998] page_type: 0xffffffff()
[   23.124194] raw: 000fffffc0001000 ffffea0000928248 ffffea0000928248 0000000000000000
[   23.124610] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   23.125023] page dumped because: kasan: bad access detected
[   23.125326]
[   23.125421] Memory state around the buggy address:
[   23.125682]  ffffc90000007800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   23.126072]  ffffc90000007880: 00 00 00 00 00 f1 f1 f1 f1 f1 f1 00 00 f2 f2 00
[   23.126455] >ffffc90000007900: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00
[   23.126840]                                               ^
[   23.127138]  ffffc90000007980: 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3
[   23.127522]  ffffc90000007a00: f3 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
[   23.127906] ==================================================================
[   23.128324] Disabling lock debugging due to kernel taint

Using simple s16 pointers for the 16-bit accesses fixes the problem. For
the 32-bit accesses, src and dst can be used directly.

Bug: 291031528
Fixes: 96518518cc ("netfilter: add nftables")
Cc: stable@vger.kernel.org
Reported-by: Tanguy DUBROCA (@SidewayRE) from @Synacktiv working with ZDI
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 870dcc31c0cf47cb15a568ade4168dc644b3ccfb)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I4a76c2be021867c923684f0034d4564f7797b48b
2023-09-20 14:37:55 +00:00
Randy Dunlap
d8f69aade5 UPSTREAM: iommu/of: mark an unused function as __maybe_unused
When CONFIG_OF_ADDRESS is not set, there is a build warning/error
about an unused function.
Annotate the function to quieten the warning/error.

../drivers/iommu/of_iommu.c:176:29: warning: 'iommu_resv_region_get_type' defined but not used [-Wunused-function]
  176 | static enum iommu_resv_type iommu_resv_region_get_type(struct device *dev, struct resource *phys,
      |                             ^~~~~~~~~~~~~~~~~~~~~~~~~~

Bug: 257546262
Fixes: a5bf3cfce8cb ("iommu: Implement of_iommu_get_resv_regions()")
Change-Id: Ice815df046c06efa7351351e3886e925c27ca57f
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Thierry Reding <treding@nvidia.com>
Cc: Joerg Roedel <jroedel@suse.de>
Cc: Will Deacon <will@kernel.org>
Cc: iommu@lists.linux.dev
Reviewed-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20230209010359.23831-1-rdunlap@infradead.org
[joro: Improve code formatting]
Signed-off-by: Joerg Roedel <jroedel@suse.de>
(cherry picked from commit 4762315d1c971312d55848fdc85eee7f0b09c8f2)
2023-09-19 16:59:57 -07:00
Thierry Reding
a032fbc776 UPSTREAM: iommu: dma: Use of_iommu_get_resv_regions()
For device tree nodes, use the standard of_iommu_get_resv_regions()
implementation to obtain the reserved memory regions associated with a
device.

Bug: 257546262
Cc: Rob Herring <robh+dt@kernel.org>
Cc: Frank Rowand <frowand.list@gmail.com>
Cc: devicetree@vger.kernel.org
Acked-by: Robin Murphy <robin.murphy@arm.com>
Change-Id: I142fa2ef8639b604701f8d0bc70429288a5e8491
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20230120174251.4004100-5-thierry.reding@gmail.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
(cherry picked from commit 5cef282e295f7cf623672470d040716d1e3eacf2)
2023-09-19 16:59:57 -07:00
Thierry Reding
693c712967 UPSTREAM: iommu: Implement of_iommu_get_resv_regions()
This is an implementation that IOMMU drivers can use to obtain reserved
memory regions from a device tree node. It uses the reserved-memory DT
bindings to find the regions associated with a given device. If these
regions are marked accordingly, identity mappings will be created for
them in the IOMMU domain that the devices will be attached to.

Bug: 257546262
Cc: Frank Rowand <frowand.list@gmail.com>
Cc: devicetree@vger.kernel.org
Reviewed-by: Rob Herring <robh@kernel.org>
Acked-by: Robin Murphy <robin.murphy@arm.com>
Change-Id: I68367e556cfd822a5802d7ff579f6dc12f54f6a6
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20230120174251.4004100-4-thierry.reding@gmail.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
(cherry picked from commit a5bf3cfce8cb77d9d24613ab52d520896f83dd48)
2023-09-19 16:59:57 -07:00
Thierry Reding
e9603e85ac UPSTREAM: dt-bindings: reserved-memory: Document iommu-addresses
This adds the "iommu-addresses" property to reserved-memory nodes, which
allow describing the interaction of memory regions with IOMMUs. Two use-
cases are supported:

  1. Static mappings can be described by pairing the "iommu-addresses"
     property with a "reg" property. This is mostly useful for adopting
     firmware-allocated buffers via identity mappings. One common use-
     case where this is required is if early firmware or bootloaders
     have set up a bootsplash framebuffer that a display controller is
     actively scanning out from during the operating system boot
     process.

  2. If an "iommu-addresses" property exists without a "reg" property,
     the reserved-memory node describes an IOVA reservation. Such memory
     regions are excluded from the IOVA space available to operating
     system drivers and can be used for regions that must not be used to
     map arbitrary buffers.

Each mapping or reservation is tied to a specific device via a phandle
to the device's device tree node. This allows a reserved-memory region
to be reused across multiple devices.

Bug: 257546262
Reviewed-by: Rob Herring <robh@kernel.org>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Change-Id: I9cdd29d056896b9cbb9fdbbc0c6cbd824f1be78e
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20230120174251.4004100-3-thierry.reding@gmail.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
(cherry picked from commit af0d81357cc558ff40968b4e04131e08ae540127)
2023-09-19 16:59:57 -07:00
Thierry Reding
64ed291347 UPSTREAM: of: Introduce of_translate_dma_region()
This function is similar to of_translate_dma_address() but also reads a
length in addition to an address from a device tree property.

Bug: 257546262
Reviewed-by: Rob Herring <robh@kernel.org>
Change-Id: I04eb9ee382b4a6db998b0bf34545f2bddef7a00e
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20230120174251.4004100-2-thierry.reding@gmail.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
(cherry picked from commit e251c21372c07694f547afe3c9828f7f6ef01267)
2023-09-19 16:59:57 -07:00
Kever Yang
536996aa30 ANDROID: GKI: Add rockchip fragment and build.config
Add rockchip fragment and build.config for build symbol list and abi update.

Bug: 300024866
Change-Id: I05f9b2cdba8b558be68a3f93330cd072cd341d71
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
2023-09-19 17:36:15 +00:00
Kever Yang
6a10b34387 ANDROID: GKI: Add symbols for rockchip v4l2
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 11 function symbol(s) added
  'int __v4l2_ctrl_handler_setup(struct v4l2_ctrl_handler*)'
  'bool v4l2_find_dv_timings_cap(struct v4l2_dv_timings*, const struct v4l2_dv_timings_cap*, unsigned int, v4l2_check_dv_timings_fnc*, void*)'
  'int v4l2_pipeline_pm_get(struct media_entity*)'
  'void v4l2_pipeline_pm_put(struct media_entity*)'
  'void v4l2_print_dv_timings(const char*, const char*, const struct v4l2_dv_timings*, bool)'
  'int v4l2_querymenu(struct v4l2_ctrl_handler*, struct v4l2_querymenu*)'
  'int v4l2_src_change_event_subdev_subscribe(struct v4l2_subdev*, struct v4l2_fh*, struct v4l2_event_subscription*)'
  'void v4l2_subdev_notify_event(struct v4l2_subdev*, const struct v4l2_event*)'
  'bool v4l2_valid_dv_timings(const struct v4l2_dv_timings*, const struct v4l2_dv_timings_cap*, v4l2_check_dv_timings_fnc*, void*)'
  'int video_device_pipeline_start(struct video_device*, struct media_pipeline*)'
  'void video_device_pipeline_stop(struct video_device*)'

1 variable symbol(s) added
  'const char* v4l2_type_names[15]'

Bug: 300024866
Change-Id: I1c7e85b6b125c2dfb43fe2ac4c4c9b2867119513
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
2023-09-19 03:02:27 +00:00
Kever Yang
3e3c6debe4 ANDROID: GKI: Add hid and usb symbols for rockchip
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 35 function symbol(s) added
  'struct fwnode_handle* fwnode_create_software_node(const struct property_entry*, const struct fwnode_handle*)'
  'int hid_driver_reset_resume(struct hid_device*)'
  'int hid_driver_suspend(struct hid_device*, pm_message_t)'
  'void hid_hw_close(struct hid_device*)'
  'int hid_hw_open(struct hid_device*)'
  'int hid_hw_output_report(struct hid_device*, __u8*, size_t)'
  'void hid_hw_request(struct hid_device*, struct hid_report*, enum hid_class_request)'
  'int hid_report_raw_event(struct hid_device*, enum hid_report_type, u8*, u32, int)'
  'struct hid_report* hid_validate_values(struct hid_device*, enum hid_report_type, unsigned int, unsigned int, unsigned int)'
  'struct tcpm_port* tcpm_register_port(struct device*, struct tcpc_dev*)'
  'void tcpm_unregister_port(struct tcpm_port*)'
  'int usb_interrupt_msg(struct usb_device*, unsigned int, void*, int, int*, int)'
  'int usbnet_change_mtu(struct net_device*, int)'
  'void usbnet_defer_kevent(struct usbnet*, int)'
  'void usbnet_disconnect(struct usb_interface*)'
  'void usbnet_get_drvinfo(struct net_device*, struct ethtool_drvinfo*)'
  'u32 usbnet_get_link(struct net_device*)'
  'int usbnet_get_link_ksettings_mii(struct net_device*, struct ethtool_link_ksettings*)'
  'u32 usbnet_get_msglevel(struct net_device*)'
  'int usbnet_nway_reset(struct net_device*)'
  'int usbnet_open(struct net_device*)'
  'int usbnet_probe(struct usb_interface*, const struct usb_device_id*)'
  'int usbnet_read_cmd(struct usbnet*, u8, u8, u16, u16, void*, u16)'
  'int usbnet_read_cmd_nopm(struct usbnet*, u8, u8, u16, u16, void*, u16)'
  'int usbnet_resume(struct usb_interface*)'
  'int usbnet_set_link_ksettings_mii(struct net_device*, const struct ethtool_link_ksettings*)'
  'void usbnet_set_msglevel(struct net_device*, u32)'
  'void usbnet_skb_return(struct usbnet*, struct sk_buff*)'
  'netdev_tx_t usbnet_start_xmit(struct sk_buff*, struct net_device*)'
  'int usbnet_stop(struct net_device*)'
  'int usbnet_suspend(struct usb_interface*, pm_message_t)'
  'void usbnet_tx_timeout(struct net_device*, unsigned int)'
  'int usbnet_write_cmd(struct usbnet*, u8, u8, u16, u16, const void*, u16)'
  'int usbnet_write_cmd_async(struct usbnet*, u8, u8, u16, u16, const void*, u16)'
  'int usbnet_write_cmd_nopm(struct usbnet*, u8, u8, u16, u16, const void*, u16)'

2 variable symbol(s) added
  'int hid_debug'
  'struct hid_ll_driver usb_hid_driver'

Bug: 300024866
Change-Id: Ie417675e96b58d05e04c44e81abcc00c5d3b0dbe
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
2023-09-19 03:02:27 +00:00
Kever Yang
53162778e7 ANDROID: GKI: Add cdc symbols for rockchip
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 10 function symbol(s) added
  'struct net_device* __vlan_find_dev_deep_rcu(struct net_device*, __be16, u16)'
  'int cdc_ncm_bind_common(struct usbnet*, struct usb_interface*, u8, int)'
  'int cdc_ncm_change_mtu(struct net_device*, int)'
  'struct sk_buff* cdc_ncm_fill_tx_frame(struct usbnet*, struct sk_buff*, __le32)'
  'int cdc_ncm_rx_verify_ndp16(struct sk_buff*, int)'
  'int cdc_ncm_rx_verify_nth16(struct cdc_ncm_ctx*, struct sk_buff*)'
  'u8 cdc_ncm_select_altsetting(struct usb_interface*)'
  'void cdc_ncm_unbind(struct usbnet*, struct usb_interface*)'
  'void cec_queue_pin_hpd_event(struct cec_adapter*, bool, ktime_t)'
  'void in6_dev_finish_destroy(struct inet6_dev*)'

Bug: 300024866
Change-Id: I4eaa35395fcb35e058f67ef73ae6561161ccf0bd
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
2023-09-19 03:02:27 +00:00
Kever Yang
b09b06dcf1 ANDROID: GKI: Add symbols for rockchip sdhci
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 8 function symbol(s) added
  'void sdhci_adma_write_desc(struct sdhci_host*, void**, dma_addr_t, int, unsigned int)'
  'unsigned int sdhci_pltfm_clk_get_max_clock(struct sdhci_host*)'
  'int sdhci_pltfm_unregister(struct platform_device*)'
  'void sdhci_set_clock(struct sdhci_host*, unsigned int)'
  'void sdhci_set_power_and_bus_voltage(struct sdhci_host*, unsigned char, unsigned short)'
  'void sdhci_set_uhs_signaling(struct sdhci_host*, unsigned int)'
  'u16 sdio_readw(struct sdio_func*, unsigned int, int*)'
  'void sdio_writew(struct sdio_func*, u16, unsigned int, int*)'

Bug: 300024866
Change-Id: I7592c26a0e1547719a70994a28d9c5bb525224b5
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
2023-09-19 03:02:27 +00:00
Kever Yang
62d64a59d9 ANDROID: GKI: Add symbols for rockchip devfreq
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 6 function symbol(s) added
  'int devfreq_event_disable_edev(struct devfreq_event_dev*)'
  'int devfreq_event_enable_edev(struct devfreq_event_dev*)'
  'struct devfreq_event_dev* devfreq_event_get_edev_by_phandle(struct device*, const char*, int)'
  'int devfreq_event_get_edev_count(struct device*, const char*)'
  'int devfreq_event_get_event(struct devfreq_event_dev*, struct devfreq_event_data*)'
  'int devm_devfreq_register_opp_notifier(struct device*, struct devfreq*)'

Bug: 300024866
Change-Id: I5db2294c3bc3e7e6dc9932551073310aec7065dc
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
2023-09-19 03:02:27 +00:00