OSDN Git Service
Badhri Jagan Sridharan [Tue, 5 Apr 2016 18:18:16 +0000 (11:18 -0700)]
ANDROID: dm: rename dm-linear methods for dm-android-verity
This keeps linear_target as static variable and just exposes
the linear target methods for android-verity
Cherry-picked: https://android-review.googlesource.com/#/c/212858
Change-Id: I4a377e417b00afd9ecccdb3e605fea31a7df112e
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
(cherry picked from commit
a6d1b091f40b25d97849487e29ec097bc5f568dd)
Badhri Jagan Sridharan [Mon, 28 Mar 2016 21:41:21 +0000 (14:41 -0700)]
ANDROID: dm: Minor cleanup
Compacts the linear device arguments removing the
unnecessary variables.
Bug:
27175947
Change-Id: I157170eebe3c0f89a68ae05870a1060f188d0da0
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Badhri Jagan Sridharan [Mon, 21 Mar 2016 17:55:23 +0000 (10:55 -0700)]
ANDROID: dm: Mounting root as linear device when verity disabled
This CL makes android-verity target to be added as linear
dm device if when bootloader is unlocked and verity is disabled.
Bug:
27175947
Change-Id: Ic41ca4b8908fb2777263799cf3a3e25934d70f18
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Badhri Jagan Sridharan [Tue, 9 Feb 2016 00:28:43 +0000 (16:28 -0800)]
ANDROID: dm-android-verity: Rebase on top of 4.1
Following CLs in upstream causes minor changes to dm-android-verity target.
1. keys: change asymmetric keys to use common hash definitions
2. block: Abstract out bvec iterator
Rebase dm-android-verity on top of these changes.
Bug:
27175947
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Change-Id: Icfdc3e7b3ead5de335a059cade1aca70414db415
Badhri Jagan Sridharan [Tue, 15 Dec 2015 04:09:39 +0000 (20:09 -0800)]
ANDROID: dm: Add android verity target
This device-mapper target is virtually a VERITY target. This
target is setup by reading the metadata contents piggybacked
to the actual data blocks in the block device. The signature
of the metadata contents are verified against the key included
in the system keyring. Upon success, the underlying verity
target is setup.
BUG:
27175947
Change-Id: I7e99644a0960ac8279f02c0158ed20999510ea97
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Jeremy Compostella [Mon, 2 May 2016 15:29:28 +0000 (17:29 +0200)]
ANDROID: dm: fix dm_substitute_devices()
When candidate is the last parameter, candidate_end points to the '\0'
character and not the DM_FIELD_SEP character. In such a situation, we
should not move the candidate_end pointer one character backward.
Signed-off-by: Jeremy Compostella <jeremy.compostella@intel.com>
Badhri Jagan Sridharan [Tue, 9 Feb 2016 00:47:41 +0000 (16:47 -0800)]
ANDROID: dm: Rebase on top of 4.1
1. "dm: optimize use SRCU and RCU" removes the use of dm_table_put.
2. "dm: remove request-based logic from make_request_fn wrapper" necessitates
calling dm_setup_md_queue or else the request_queue's make_request_fn
pointer ends being unset.
[ 7.711600] Internal error: Oops - bad mode: 0 [#1] PREEMPT SMP
[ 7.717519] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W
4.1.15-02273-gb057d16-dirty #33
[ 7.726559] Hardware name: HiKey Development Board (DT)
[ 7.731779] task:
ffffffc005f8acc0 ti:
ffffffc005f8c000 task.ti:
ffffffc005f8c000
[ 7.739257] PC is at 0x0
[ 7.741787] LR is at generic_make_request+0x8c/0x108
....
[ 9.082931] Call trace:
[ 9.085372] [< (null)>] (null)
[ 9.090074] [<
ffffffc0003f4ac0>] submit_bio+0x98/0x1e0
[ 9.095212] [<
ffffffc0001e2618>] _submit_bh+0x120/0x1f0
[ 9.096165] cfg80211: Calling CRDA to update world regulatory domain
[ 9.106781] [<
ffffffc0001e5450>] __bread_gfp+0x94/0x114
[ 9.112004] [<
ffffffc00024a748>] ext4_fill_super+0x18c/0x2d64
[ 9.117750] [<
ffffffc0001b275c>] mount_bdev+0x194/0x1c0
[ 9.122973] [<
ffffffc0002450dc>] ext4_mount+0x14/0x1c
[ 9.128021] [<
ffffffc0001b29a0>] mount_fs+0x3c/0x194
[ 9.132985] [<
ffffffc0001d059c>] vfs_kern_mount+0x4c/0x134
[ 9.138467] [<
ffffffc0001d2168>] do_mount+0x204/0xbbc
[ 9.143514] [<
ffffffc0001d2ec4>] SyS_mount+0x94/0xe8
[ 9.148479] [<
ffffffc000c54074>] mount_block_root+0x120/0x24c
[ 9.154222] [<
ffffffc000c543e8>] mount_root+0x110/0x12c
[ 9.159443] [<
ffffffc000c54574>] prepare_namespace+0x170/0x1b8
[ 9.165273] [<
ffffffc000c53d98>] kernel_init_freeable+0x23c/0x260
[ 9.171365] [<
ffffffc0009b1748>] kernel_init+0x10/0x118
[ 9.176589] Code: bad PC value
[ 9.179807] ---[ end trace
75e1bc52ba364d13 ]---
Bug:
27175947
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Change-Id: I952d86fd1475f0825f9be1386e3497b36127abd0
Will Drewry [Wed, 9 Jun 2010 22:47:38 +0000 (17:47 -0500)]
CHROMIUM: dm: boot time specification of dm=
This is a wrap-up of three patches pending upstream approval.
I'm bundling them because they are interdependent, and it'll be
easier to drop it on rebase later.
1. dm: allow a dm-fs-style device to be shared via dm-ioctl
Integrates feedback from Alisdair, Mike, and Kiyoshi.
Two main changes occur here:
- One function is added which allows for a programmatically created
mapped device to be inserted into the dm-ioctl hash table. This binds
the device to a name and, optional, uuid which is needed by udev and
allows for userspace management of the mapped device.
- dm_table_complete() was extended to handle all of the final
functional changes required for the table to be operational once
called.
2. init: boot to device-mapper targets without an initr*
Add a dm= kernel parameter modeled after the md= parameter from
do_mounts_md. It allows for device-mapper targets to be configured at
boot time for use early in the boot process (as the root device or
otherwise). It also replaces /dev/XXX calls with major:minor opportunistically.
The format is dm="name uuid ro,table line 1,table line 2,...". The
parser expects the comma to be safe to use as a newline substitute but,
otherwise, uses the normal separator of space. Some attempt has been
made to make it forgiving of additional spaces (using skip_spaces()).
A mapped device created during boot will be assigned a minor of 0 and
may be access via /dev/dm-0.
An example dm-linear root with no uuid may look like:
root=/dev/dm-0 dm="lroot none ro, 0 4096 linear /dev/ubdb 0, 4096 4096 linear /dv/ubdc 0"
Once udev is started, /dev/dm-0 will become /dev/mapper/lroot.
Older upstream threads:
http://marc.info/?l=dm-devel&m=
127429492521964&w=2
http://marc.info/?l=dm-devel&m=
127429499422096&w=2
http://marc.info/?l=dm-devel&m=
127429493922000&w=2
Latest upstream threads:
https://patchwork.kernel.org/patch/104859/
https://patchwork.kernel.org/patch/104860/
https://patchwork.kernel.org/patch/104861/
Bug:
27175947
Signed-off-by: Will Drewry <wad@chromium.org>
Review URL: http://codereview.chromium.org/
2020011
Change-Id: I92bd53432a11241228d2e5ac89a3b20d19b05a31
Arnaldo Carvalho de Melo [Mon, 14 Mar 2016 12:56:35 +0000 (09:56 -0300)]
UPSTREAM: net: Fix use after free in the recvmmsg exit path
(cherry picked from commit
34b88a68f26a75e4fded796f1a49c40f82234b7d)
The syzkaller fuzzer hit the following use-after-free:
Call Trace:
[<
ffffffff8175ea0e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295
[<
ffffffff851cc31a>] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261
[< inline >] SYSC_recvmmsg net/socket.c:2281
[<
ffffffff851cc57f>] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270
[<
ffffffff86332bb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
And, as Dmitry rightly assessed, that is because we can drop the
reference and then touch it when the underlying recvmsg calls return
some packets and then hit an error, which will make recvmmsg to set
sock->sk->sk_err, oops, fix it.
Reported-and-Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Kostya Serebryany <kcc@google.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Fixes:
a2e2725541fa ("net: Introduce recvmmsg socket syscall")
http://lkml.kernel.org/r/
20160122211644.GC2470@redhat.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Change-Id: I2adb0faf595b7b634d9b739dfdd1a47109e20ecb
Bug:
30515201
James Carr [Sat, 30 Jul 2016 02:02:16 +0000 (19:02 -0700)]
Implement memory_state_time, used by qcom,cpubw
New driver memory_state_time tracks time spent in different DDR
frequency and bandwidth states.
Memory drivers such as qcom,cpubw can post updated state to the driver
after registering a callback. Processed by a workqueue
Bandwidth buckets are read in from device tree in the relevant qualcomm
section, can be defined in any quantity and spacing.
The data is exposed at /sys/kernel/memory_state_time, able to be read by
the Android framework.
Functionality is behind a config option CONFIG_MEMORY_STATE_TIME
Change-Id: I4fee165571cb975fb9eacbc9aada5e6d7dd748f0
Signed-off-by: James Carr <carrja@google.com>
Amit Pundir [Sun, 31 Jul 2016 11:37:46 +0000 (17:07 +0530)]
Revert "panic: Add board ID to panic output"
This reverts commit
4e09c510185cb4db2277ce81cce81b7aa06bea45.
I checked for the usage of this debug helper in AOSP common kernels as
well as vendor kernels (e.g exynos, msm, mediatek, omap, tegra, x86,
x86_64) hosted at https://android.googlesource.com/kernel/ and I found
out that other than few fairly obsolete Omap trees (for tuna & Glass)
and Exynos tree (for Manta), there is no active user of this debug
helper. So we can safely remove this helper code.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Anson Jacob [Mon, 1 Aug 2016 02:30:14 +0000 (22:30 -0400)]
usb: gadget: f_accessory: remove duplicate endpoint alloc
usb_ep_autoconfig is called twice for allocating
bulk out endpoint.
Removed the unwanted call.
Fixes Issue: 67180
Change-Id: I03e87a86fbbbc85831ff7f0496adf038d1de2956
Signed-off-by: Anson Jacob <ansonjacob.aj@gmail.com>
Arend Van Spriel [Fri, 15 Jul 2016 10:39:13 +0000 (12:39 +0200)]
BACKPORT: brcmfmac: defer DPC processing during probe
The sdio dpc starts processing when in SDIOD_STATE_DATA. This state was
entered right after firmware download. This patch moves that transition
just before enabling sdio interrupt handling thus avoiding watchdog
expiry which would put the bus to sleep while probing.
Change-Id: I09c60752374b8145da78000935062be08c5c8a52
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
John Stultz [Fri, 15 Jul 2016 00:22:19 +0000 (17:22 -0700)]
FROMLIST: proc: Add LSM hook checks to /proc/<tid>/timerslack_ns
As requested, this patch checks the existing LSM hooks
task_getscheduler/task_setscheduler when reading or modifying
the task's timerslack value.
Previous versions added new get/settimerslack LSM hooks, but
since they checked the same PROCESS__SET/GETSCHED values as
existing hooks, it was suggested we just use the existing ones.
Cc: Kees Cook <keescook@chromium.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
CC: Arjan van de Ven <arjan@linux.intel.com>
Cc: Oren Laadan <orenl@cellrox.com>
Cc: Ruchi Kandoi <kandoiruchi@google.com>
Cc: Rom Lemarchand <romlem@android.com>
Cc: Todd Kjos <tkjos@google.com>
Cc: Colin Cross <ccross@android.com>
Cc: Nick Kralevich <nnk@google.com>
Cc: Dmitry Shmidt <dimitrysh@google.com>
Cc: Elliott Hughes <enh@google.com>
Cc: James Morris <jmorris@namei.org>
Cc: Android Kernel Team <kernel-team@android.com>
Cc: linux-security-module@vger.kernel.org
Cc: selinux@tycho.nsa.gov
Signed-off-by: John Stultz <john.stultz@linaro.org>
FROMLIST URL: https://lkml.org/lkml/2016/7/21/523
Change-Id: Id157d10e2fe0b85f1be45035a6117358a42af028
(Cherry picked back to common/android-4.4)
Signed-off-by: John Stultz <john.stultz@linaro.org>
John Stultz [Thu, 14 Jul 2016 18:20:55 +0000 (11:20 -0700)]
FROMLIST: proc: Relax /proc/<tid>/timerslack_ns capability requirements
When an interface to allow a task to change another tasks
timerslack was first proposed, it was suggested that something
greater then CAP_SYS_NICE would be needed, as a task could be
delayed further then what normally could be done with nice
adjustments.
So CAP_SYS_PTRACE was adopted instead for what became the
/proc/<tid>/timerslack_ns interface. However, for Android (where
this feature originates), giving the system_server
CAP_SYS_PTRACE would allow it to observe and modify all tasks
memory. This is considered too high a privilege level for only
needing to change the timerslack.
After some discussion, it was realized that a CAP_SYS_NICE
process can set a task as SCHED_FIFO, so they could fork some
spinning processes and set them all SCHED_FIFO 99, in effect
delaying all other tasks for an infinite amount of time.
So as a CAP_SYS_NICE task can already cause trouble for other
tasks, using it as a required capability for accessing and
modifying /proc/<tid>/timerslack_ns seems sufficient.
Thus, this patch loosens the capability requirements to
CAP_SYS_NICE and removes CAP_SYS_PTRACE, simplifying some
of the code flow as well.
This is technically an ABI change, but as the feature just
landed in 4.6, I suspect no one is yet using it.
Cc: Kees Cook <keescook@chromium.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
CC: Arjan van de Ven <arjan@linux.intel.com>
Cc: Oren Laadan <orenl@cellrox.com>
Cc: Ruchi Kandoi <kandoiruchi@google.com>
Cc: Rom Lemarchand <romlem@android.com>
Cc: Todd Kjos <tkjos@google.com>
Cc: Colin Cross <ccross@android.com>
Cc: Nick Kralevich <nnk@google.com>
Cc: Dmitry Shmidt <dimitrysh@google.com>
Cc: Elliott Hughes <enh@google.com>
Cc: Android Kernel Team <kernel-team@android.com>
Reviewed-by: Nick Kralevich <nnk@google.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
FROMLIST URL: https://lkml.org/lkml/2016/7/21/522
Change-Id: Ia75481402e3948165a1b7c1551c539530cb25509
(Cherry picked against common/android-4.4)
Signed-off-by: John Stultz <john.stultz@linaro.org>
Jann Horn [Wed, 1 Jun 2016 09:55:07 +0000 (11:55 +0200)]
UPSTREAM: sched: panic on corrupted stack end
(cherry picked from commit
29d6455178a09e1dc340380c582b13356227e8df)
Until now, hitting this BUG_ON caused a recursive oops (because oops
handling involves do_exit(), which calls into the scheduler, which in
turn raises an oops), which caused stuff below the stack to be
overwritten until a panic happened (e.g. via an oops in interrupt
context, caused by the overwritten CPU index in the thread_info).
Just panic directly.
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: Ia3acb3f747f7a58ec2d071644433b0591925969f
Bug:
29444228
Jann Horn [Wed, 1 Jun 2016 09:55:06 +0000 (11:55 +0200)]
UPSTREAM: ecryptfs: forbid opening files without mmap handler
(cherry picked from commit
2f36db71009304b3f0b95afacd8eba1f9f046b87)
This prevents users from triggering a stack overflow through a recursive
invocation of pagefault handling that involves mapping procfs files into
virtual memory.
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: I0be77c7f8bd3046bc34cd87ef577529792d479bc
Bug:
29444228
Jann Horn [Wed, 1 Jun 2016 09:55:05 +0000 (11:55 +0200)]
UPSTREAM: proc: prevent stacking filesystems on top
(cherry picked from commit
e54ad7f1ee263ffa5a2de9c609d58dfa27b21cd9)
This prevents stacking filesystems (ecryptfs and overlayfs) from using
procfs as lower filesystem. There is too much magic going on inside
procfs, and there is no good reason to stack stuff on top of procfs.
(For example, procfs does access checks in VFS open handlers, and
ecryptfs by design calls open handlers from a kernel thread that doesn't
drop privileges or so.)
Signed-off-by: Jann Horn <jannh@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: Ib050ef9dc10e623589d22e3a9e6aee9ee4f0cd5d
Bug:
29444228
WANG Cong [Wed, 6 Jul 2016 05:12:36 +0000 (22:12 -0700)]
UPSTREAM: ppp: defer netns reference release for ppp channel
(cherry pick from commit
205e1e255c479f3fd77446415706463b282f94e4)
Matt reported that we have a NULL pointer dereference
in ppp_pernet() from ppp_connect_channel(),
i.e. pch->chan_net is NULL.
This is due to that a parallel ppp_unregister_channel()
could happen while we are in ppp_connect_channel(), during
which pch->chan_net set to NULL. Since we need a reference
to net per channel, it makes sense to sync the refcnt
with the life time of the channel, therefore we should
release this reference when we destroy it.
Fixes:
1f461dcdd296 ("ppp: take reference on channels netns")
Reported-by: Matt Bennett <Matt.Bennett@alliedtelesis.co.nz>
Cc: Paul Mackerras <paulus@samba.org>
Cc: linux-ppp@vger.kernel.org
Cc: Guillaume Nault <g.nault@alphalink.fr>
Cc: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Fixes: Change-Id: Iee0015eca5bd181954bb4896a3720f7549c5ed0b ("UPSTREAM:
ppp: take reference on channels netns")
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Change-Id: I24d0bb6f349ab3829f63cfe935ed97b6913a3508
Riley Andrews [Sat, 6 Jun 2015 01:59:29 +0000 (18:59 -0700)]
cpuset: Add allow_attach hook for cpusets on android.
This patch provides a allow_attach hook for cpusets,
which resolves lots of the following logcat noise.
W SchedPolicy: add_tid_to_cgroup failed to write '2816' (Permission denied); fd=29
W ActivityManager: Failed setting process group of 2816 to 0
W System.err: java.lang.IllegalArgumentException
W System.err: at android.os.Process.setProcessGroup(Native Method)
W System.err: at com.android.server.am.ActivityManagerService.applyOomAdjLocked(ActivityManagerService.java:18763)
W System.err: at com.android.server.am.ActivityManagerService.updateOomAdjLocked(ActivityManagerService.java:19028)
W System.err: at com.android.server.am.ActivityManagerService.updateOomAdjLocked(ActivityManagerService.java:19106)
W System.err: at com.android.server.am.ActiveServices.serviceDoneExecutingLocked(ActiveServices.java:2015)
W System.err: at com.android.server.am.ActiveServices.publishServiceLocked(ActiveServices.java:905)
W System.err: at com.android.server.am.ActivityManagerService.publishService(ActivityManagerService.java:16065)
W System.err: at android.app.ActivityManagerNative.onTransact(ActivityManagerNative.java:1007)
W System.err: at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2493)
W System.err: at android.os.Binder.execTransact(Binder.java:453)
Change-Id: Ic1b61b2bbb7ce74c9e9422b5e22ee9078251de21
[Ported to 4.4, added commit message]
Signed-off-by: John Stultz <john.stultz@linaro.org>
Mark Salyzyn [Mon, 18 Jul 2016 22:21:12 +0000 (22:21 +0000)]
Revert "CHROMIUM: android: binder: Fix potential scheduling-while-atomic"
This reverts commit
71b1886054473597c46a8a25c95477b5262971b5.
Change-Id: I9ded0ff43535c1367c2cf79dfeec20d4b5f0357a
Andrew Bresticker [Fri, 23 Oct 2015 22:13:42 +0000 (15:13 -0700)]
CHROMIUM: android: binder: Fix potential scheduling-while-atomic
(cherry picked from commit
166b45af97359159f9585a836c9849e725e31fd6)
Commit
f1e7f0a724f6 ("android: binder: Disable preemption while holding
the global binder lock.") re-enabled preemption around most of the sites
where calls to potentially sleeping functions were made, but missed
__alloc_fd(), which can sleep if the fdtable needs to be resized.
Re-enable preemption around __alloc_fd() as well as __fd_install() which
can now sleep in upstream kernels as of commit
8a81252b774b ("fs/file.c:
don't acquire files->file_lock in fd_install()").
BUG=chrome-os-partner:44012
TEST=Build and boot on Smaug.
Change-Id: I9819c4b95876f697e75b1b84810b6c520d9c33ec
Signed-off-by: Andrew Bresticker <abrestic@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/308582
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Riley Andrews <riandrews@google.com>
Bug:
30141999
Florian Westphal [Tue, 22 Mar 2016 17:02:50 +0000 (18:02 +0100)]
UPSTREAM: netfilter: x_tables: make sure e->next_offset covers remaining blob size
(cherry pick from commit
6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91)
Otherwise this function may read data beyond the ruleset blob.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Change-Id: I9d19ecf3e00a2d52817b35b9042623927895c005
Bug:
29637687
Florian Westphal [Tue, 22 Mar 2016 17:02:49 +0000 (18:02 +0100)]
UPSTREAM: netfilter: x_tables: validate e->target_offset early
(cherry pick from commit
bdf533de6968e9686df777dc178486f600c6e617)
We should check that e->target_offset is sane before
mark_source_chains gets called since it will fetch the target entry
for loop detection.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Change-Id: Ic2dbc31c9525d698e94d4d8875886acf3524abbd
Bug:
29637687
Dan Carpenter [Thu, 16 Jun 2016 14:48:57 +0000 (15:48 +0100)]
UPSTREAM: KEYS: potential uninitialized variable
(cherry picked from commit
38327424b40bcebe2de92d07312c89360ac9229a)
If __key_link_begin() failed then "edit" would be uninitialized. I've
added a check to fix that.
This allows a random user to crash the kernel, though it's quite
difficult to achieve. There are three ways it can be done as the user
would have to cause an error to occur in __key_link():
(1) Cause the kernel to run out of memory. In practice, this is difficult
to achieve without ENOMEM cropping up elsewhere and aborting the
attempt.
(2) Revoke the destination keyring between the keyring ID being looked up
and it being tested for revocation. In practice, this is difficult to
time correctly because the KEYCTL_REJECT function can only be used
from the request-key upcall process. Further, users can only make use
of what's in /sbin/request-key.conf, though this does including a
rejection debugging test - which means that the destination keyring
has to be the caller's session keyring in practice.
(3) Have just enough key quota available to create a key, a new session
keyring for the upcall and a link in the session keyring, but not then
sufficient quota to create a link in the nominated destination keyring
so that it fails with EDQUOT.
The bug can be triggered using option (3) above using something like the
following:
echo 80 >/proc/sys/kernel/keys/root_maxbytes
keyctl request2 user debug:fred negate @t
The above sets the quota to something much lower (80) to make the bug
easier to trigger, but this is dependent on the system. Note also that
the name of the keyring created contains a random number that may be
between 1 and 10 characters in size, so may throw the test off by
changing the amount of quota used.
Assuming the failure occurs, something like the following will be seen:
kfree_debugcheck: out of range ptr 6b6b6b6b6b6b6b68h
------------[ cut here ]------------
kernel BUG at ../mm/slab.c:2821!
...
RIP: 0010:[<
ffffffff811600f9>] kfree_debugcheck+0x20/0x25
RSP: 0018:
ffff8804014a7de8 EFLAGS:
00010092
RAX:
0000000000000034 RBX:
6b6b6b6b6b6b6b68 RCX:
0000000000000000
RDX:
0000000000040001 RSI:
00000000000000f6 RDI:
0000000000000300
RBP:
ffff8804014a7df0 R08:
0000000000000001 R09:
0000000000000000
R10:
ffff8804014a7e68 R11:
0000000000000054 R12:
0000000000000202
R13:
ffffffff81318a66 R14:
0000000000000000 R15:
0000000000000001
...
Call Trace:
kfree+0xde/0x1bc
assoc_array_cancel_edit+0x1f/0x36
__key_link_end+0x55/0x63
key_reject_and_link+0x124/0x155
keyctl_reject_key+0xb6/0xe0
keyctl_negate_key+0x10/0x12
SyS_keyctl+0x9f/0xe7
do_syscall_64+0x63/0x13a
entry_SYSCALL64_slow_path+0x25/0x25
Fixes:
f70e2e06196a ('KEYS: Do preallocation for __key_link()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: Ia9616cce142a616beea0ef20bde49129939d2d2d
Bug:
29823941
David Howells [Tue, 23 Feb 2016 11:03:12 +0000 (11:03 +0000)]
UPSTREAM: KEYS: Fix ASN.1 indefinite length object parsing
(cherry pick from commit
23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa)
This fixes CVE-2016-0758.
In the ASN.1 decoder, when the length field of an ASN.1 value is extracted,
it isn't validated against the remaining amount of data before being added
to the cursor. With a sufficiently large size indicated, the check:
datalen - dp < 2
may then fail due to integer overflow.
Fix this by checking the length indicated against the amount of remaining
data in both places a definite length is determined.
Whilst we're at it, make the following changes:
(1) Check the maximum size of extended length does not exceed the capacity
of the variable it's being stored in (len) rather than the type that
variable is assumed to be (size_t).
(2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the
integer 0.
(3) To reduce confusion, move the initialisation of len outside of:
for (len = 0; n > 0; n--) {
since it doesn't have anything to do with the loop counter n.
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Acked-by: David Woodhouse <David.Woodhouse@intel.com>
Acked-by: Peter Jones <pjones@redhat.com>
Change-Id: If760bc3b8ab0e59fefc24fa687514324348fb8e8
Bug:
29814470
Guillaume Nault [Wed, 23 Mar 2016 15:38:55 +0000 (16:38 +0100)]
UPSTREAM: ppp: take reference on channels netns
(cherry pick from commit
1f461dcdd296eecedaffffc6bae2bfa90bd7eb89)
Let channels hold a reference on their network namespace.
Some channel types, like ppp_async and ppp_synctty, can have their
userspace controller running in a different namespace. Therefore they
can't rely on them to preclude their netns from being removed from
under them.
==================================================================
BUG: KASAN: use-after-free in ppp_unregister_channel+0x372/0x3a0 at
addr
ffff880064e217e0
Read of size 8 by task syz-executor/11581
=============================================================================
BUG net_namespace (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: Allocated in copy_net_ns+0x6b/0x1a0 age=92569 cpu=3 pid=6906
[< none >] ___slab_alloc+0x4c7/0x500 kernel/mm/slub.c:2440
[< none >] __slab_alloc+0x4c/0x90 kernel/mm/slub.c:2469
[< inline >] slab_alloc_node kernel/mm/slub.c:2532
[< inline >] slab_alloc kernel/mm/slub.c:2574
[< none >] kmem_cache_alloc+0x23a/0x2b0 kernel/mm/slub.c:2579
[< inline >] kmem_cache_zalloc kernel/include/linux/slab.h:597
[< inline >] net_alloc kernel/net/core/net_namespace.c:325
[< none >] copy_net_ns+0x6b/0x1a0 kernel/net/core/net_namespace.c:360
[< none >] create_new_namespaces+0x2f6/0x610 kernel/kernel/nsproxy.c:95
[< none >] copy_namespaces+0x297/0x320 kernel/kernel/nsproxy.c:150
[< none >] copy_process.part.35+0x1bf4/0x5760 kernel/kernel/fork.c:1451
[< inline >] copy_process kernel/kernel/fork.c:1274
[< none >] _do_fork+0x1bc/0xcb0 kernel/kernel/fork.c:1723
[< inline >] SYSC_clone kernel/kernel/fork.c:1832
[< none >] SyS_clone+0x37/0x50 kernel/kernel/fork.c:1826
[< none >] entry_SYSCALL_64_fastpath+0x16/0x7a kernel/arch/x86/entry/entry_64.S:185
INFO: Freed in net_drop_ns+0x67/0x80 age=575 cpu=2 pid=2631
[< none >] __slab_free+0x1fc/0x320 kernel/mm/slub.c:2650
[< inline >] slab_free kernel/mm/slub.c:2805
[< none >] kmem_cache_free+0x2a0/0x330 kernel/mm/slub.c:2814
[< inline >] net_free kernel/net/core/net_namespace.c:341
[< none >] net_drop_ns+0x67/0x80 kernel/net/core/net_namespace.c:348
[< none >] cleanup_net+0x4e5/0x600 kernel/net/core/net_namespace.c:448
[< none >] process_one_work+0x794/0x1440 kernel/kernel/workqueue.c:2036
[< none >] worker_thread+0xdb/0xfc0 kernel/kernel/workqueue.c:2170
[< none >] kthread+0x23f/0x2d0 kernel/drivers/block/aoe/aoecmd.c:1303
[< none >] ret_from_fork+0x3f/0x70 kernel/arch/x86/entry/entry_64.S:468
INFO: Slab 0xffffea0001938800 objects=3 used=0 fp=0xffff880064e20000
flags=0x5fffc0000004080
INFO: Object 0xffff880064e20000 @offset=0 fp=0xffff880064e24200
CPU: 1 PID: 11581 Comm: syz-executor Tainted: G B 4.4.0+
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
00000000ffffffff ffff8800662c7790 ffffffff8292049d ffff88003e36a300
ffff880064e20000 ffff880064e20000 ffff8800662c77c0 ffffffff816f2054
ffff88003e36a300 ffffea0001938800 ffff880064e20000 0000000000000000
Call Trace:
[< inline >] __dump_stack kernel/lib/dump_stack.c:15
[<
ffffffff8292049d>] dump_stack+0x6f/0xa2 kernel/lib/dump_stack.c:50
[<
ffffffff816f2054>] print_trailer+0xf4/0x150 kernel/mm/slub.c:654
[<
ffffffff816f875f>] object_err+0x2f/0x40 kernel/mm/slub.c:661
[< inline >] print_address_description kernel/mm/kasan/report.c:138
[<
ffffffff816fb0c5>] kasan_report_error+0x215/0x530 kernel/mm/kasan/report.c:236
[< inline >] kasan_report kernel/mm/kasan/report.c:259
[<
ffffffff816fb4de>] __asan_report_load8_noabort+0x3e/0x40 kernel/mm/kasan/report.c:280
[< inline >] ? ppp_pernet kernel/include/linux/compiler.h:218
[<
ffffffff83ad71b2>] ? ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392
[< inline >] ppp_pernet kernel/include/linux/compiler.h:218
[<
ffffffff83ad71b2>] ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392
[< inline >] ? ppp_pernet kernel/drivers/net/ppp/ppp_generic.c:293
[<
ffffffff83ad6f26>] ? ppp_unregister_channel+0xe6/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392
[<
ffffffff83ae18f3>] ppp_asynctty_close+0xa3/0x130 kernel/drivers/net/ppp/ppp_async.c:241
[<
ffffffff83ae1850>] ? async_lcp_peek+0x5b0/0x5b0 kernel/drivers/net/ppp/ppp_async.c:1000
[<
ffffffff82c33239>] tty_ldisc_close.isra.1+0x99/0xe0 kernel/drivers/tty/tty_ldisc.c:478
[<
ffffffff82c332c0>] tty_ldisc_kill+0x40/0x170 kernel/drivers/tty/tty_ldisc.c:744
[<
ffffffff82c34943>] tty_ldisc_release+0x1b3/0x260 kernel/drivers/tty/tty_ldisc.c:772
[<
ffffffff82c1ef21>] tty_release+0xac1/0x13e0 kernel/drivers/tty/tty_io.c:1901
[<
ffffffff82c1e460>] ? release_tty+0x320/0x320 kernel/drivers/tty/tty_io.c:1688
[<
ffffffff8174de36>] __fput+0x236/0x780 kernel/fs/file_table.c:208
[<
ffffffff8174e405>] ____fput+0x15/0x20 kernel/fs/file_table.c:244
[<
ffffffff813595ab>] task_work_run+0x16b/0x200 kernel/kernel/task_work.c:115
[< inline >] exit_task_work kernel/include/linux/task_work.h:21
[<
ffffffff81307105>] do_exit+0x8b5/0x2c60 kernel/kernel/exit.c:750
[<
ffffffff813fdd20>] ? debug_check_no_locks_freed+0x290/0x290 kernel/kernel/locking/lockdep.c:4123
[<
ffffffff81306850>] ? mm_update_next_owner+0x6f0/0x6f0 kernel/kernel/exit.c:357
[<
ffffffff813215e6>] ? __dequeue_signal+0x136/0x470 kernel/kernel/signal.c:550
[<
ffffffff8132067b>] ? recalc_sigpending_tsk+0x13b/0x180 kernel/kernel/signal.c:145
[<
ffffffff81309628>] do_group_exit+0x108/0x330 kernel/kernel/exit.c:880
[<
ffffffff8132b9d4>] get_signal+0x5e4/0x14f0 kernel/kernel/signal.c:2307
[< inline >] ? kretprobe_table_lock kernel/kernel/kprobes.c:1113
[<
ffffffff8151d355>] ? kprobe_flush_task+0xb5/0x450 kernel/kernel/kprobes.c:1158
[<
ffffffff8115f7d3>] do_signal+0x83/0x1c90 kernel/arch/x86/kernel/signal.c:712
[<
ffffffff8151d2a0>] ? recycle_rp_inst+0x310/0x310 kernel/include/linux/list.h:655
[<
ffffffff8115f750>] ? setup_sigcontext+0x780/0x780 kernel/arch/x86/kernel/signal.c:165
[<
ffffffff81380864>] ? finish_task_switch+0x424/0x5f0 kernel/kernel/sched/core.c:2692
[< inline >] ? finish_lock_switch kernel/kernel/sched/sched.h:1099
[<
ffffffff81380560>] ? finish_task_switch+0x120/0x5f0 kernel/kernel/sched/core.c:2678
[< inline >] ? context_switch kernel/kernel/sched/core.c:2807
[<
ffffffff85d794e9>] ? __schedule+0x919/0x1bd0 kernel/kernel/sched/core.c:3283
[<
ffffffff81003901>] exit_to_usermode_loop+0xf1/0x1a0 kernel/arch/x86/entry/common.c:247
[< inline >] prepare_exit_to_usermode kernel/arch/x86/entry/common.c:282
[<
ffffffff810062ef>] syscall_return_slowpath+0x19f/0x210 kernel/arch/x86/entry/common.c:344
[<
ffffffff85d88022>] int_ret_from_sys_call+0x25/0x9f kernel/arch/x86/entry/entry_64.S:281
Memory state around the buggy address:
ffff880064e21680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880064e21700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>
ffff880064e21780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff880064e21800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880064e21880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Fixes:
273ec51dd7ce ("net: ppp_generic - introduce net-namespace functionality v2")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Change-Id: Iee0015eca5bd181954bb4896a3720f7549c5ed0b
Bug:
28979703
Florian Westphal [Tue, 22 Mar 2016 17:02:52 +0000 (18:02 +0100)]
UPSTREAM: netfilter: x_tables: fix unconditional helper
(cherry pick from commit
54d83fc74aa9ec72794373cb47432c5f7fb1a309)
Ben Hawkes says:
In the mark_source_chains function (net/ipv4/netfilter/ip_tables.c) it
is possible for a user-supplied ipt_entry structure to have a large
next_offset field. This field is not bounds checked prior to writing a
counter value at the supplied offset.
Problem is that mark_source_chains should not have been called --
the rule doesn't have a next entry, so its supposed to return
an absolute verdict of either ACCEPT or DROP.
However, the function conditional() doesn't work as the name implies.
It only checks that the rule is using wildcard address matching.
However, an unconditional rule must also not be using any matches
(no -m args).
The underflow validator only checked the addresses, therefore
passing the 'unconditional absolute verdict' test, while
mark_source_chains also tested for presence of matches, and thus
proceeeded to the next (not-existent) rule.
Unify this so that all the callers have same idea of 'unconditional rule'.
Reported-by: Ben Hawkes <hawkes@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Change-Id: I47ec0713ac563ac244200c7b2c54f09a91aceabc
Bug:
28940694
Julia Lawall [Wed, 1 Jun 2016 17:28:49 +0000 (10:28 -0700)]
ANDROID: sdcardfs: fix itnull.cocci warnings
List_for_each_entry has the property that the first argument is always
bound to a real list element, never NULL, so testing dentry is not needed.
Generated by: scripts/coccinelle/iterators/itnull.cocci
Cc: Daniel Rosenberg <drosen@google.com>
Signed-off-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Jeff Vander Stoep [Mon, 13 Jun 2016 00:37:52 +0000 (17:37 -0700)]
android-recommended.cfg: enable fstack-protector-strong
If compiler has stack protector support, set
CONFIG_CC_STACKPROTECTOR_STRONG.
Bug:
28967314
Change-Id: I588c2d544250e9e4b5082b43c237b8f85b7313ca
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Daniel Rosenberg [Fri, 8 Jul 2016 21:15:14 +0000 (14:15 -0700)]
sdcardfs: Truncate packages_gid.list on overflow
packages_gid.list was improperly returning the wrong
count. Use scnprintf instead, and inform the user that
the list was truncated if it is.
Bug:
30013843
Change-Id: Ida2b2ef7cd86dd87300bfb4c2cdb6bfe2ee1650d
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Bjørn Mork [Fri, 8 Jul 2016 20:24:09 +0000 (13:24 -0700)]
UPSTREAM: cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind
(cherry pick from commit
4d06dd537f95683aba3651098ae288b7cbff8274)
usbnet_link_change will call schedule_work and should be
avoided if bind is failing. Otherwise we will end up with
scheduled work referring to a netdev which has gone away.
Instead of making the call conditional, we can just defer
it to usbnet_probe, using the driver_info flag made for
this purpose.
Fixes:
8a34b0ae8778 ("usbnet: cdc_ncm: apply usbnet_link_change")
Reported-by: Andrey Konovalov <andreyknvl@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Change-Id: Id9a6d02bdd98bf495d26595cf2cc90e480746186
Bug:
28744625
Jann Horn [Wed, 20 Jan 2016 23:00:04 +0000 (15:00 -0800)]
BACKPORT: ptrace: use fsuid, fsgid, effective creds for fs access checks
This patch backports
969624b (which backports
caaee6234d0 upstream),
from the v4.4-stable branch to the common/android-4.4 branch.
This patch is needed to provide the PTRACE_MODE_ATTACH_FSCREDS definition
which was used by the backported version of proc/<tid>/timerslack_ns
in change-id: Ie5799b9a3402a31f88cd46437dcda4a0e46415a7
commit
caaee6234d05a58c5b4d05e7bf766131b810a657 upstream.
By checking the effective credentials instead of the real UID / permitted
capabilities, ensure that the calling process actually intended to use its
credentials.
To ensure that all ptrace checks use the correct caller credentials (e.g.
in case out-of-tree code or newly added code omits the PTRACE_MODE_*CREDS
flag), use two new flags and require one of them to be set.
The problem was that when a privileged task had temporarily dropped its
privileges, e.g. by calling setreuid(0, user_uid), with the intent to
perform following syscalls with the credentials of a user, it still passed
ptrace access checks that the user would not be able to pass.
While an attacker should not be able to convince the privileged task to
perform a ptrace() syscall, this is a problem because the ptrace access
check is reused for things in procfs.
In particular, the following somewhat interesting procfs entries only rely
on ptrace access checks:
/proc/$pid/stat - uses the check for determining whether pointers
should be visible, useful for bypassing ASLR
/proc/$pid/maps - also useful for bypassing ASLR
/proc/$pid/cwd - useful for gaining access to restricted
directories that contain files with lax permissions, e.g. in
this scenario:
lrwxrwxrwx root root /proc/13020/cwd -> /root/foobar
drwx------ root root /root
drwxr-xr-x root root /root/foobar
-rw-r--r-- root root /root/foobar/secret
Therefore, on a system where a root-owned mode 6755 binary changes its
effective credentials as described and then dumps a user-specified file,
this could be used by an attacker to reveal the memory layout of root's
processes or reveal the contents of files he is not allowed to access
(through /proc/$pid/cwd).
[akpm@linux-foundation.org: fix warning]
Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Morris <james.l.morris@oracle.com>
Cc: "Serge E. Hallyn" <serge.hallyn@ubuntu.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[jstultz: Cherry-picked for common/android-4.4]
Signed-off-by: John Stultz <john.stultz@linaro.org>
John Stultz [Thu, 17 Mar 2016 21:20:54 +0000 (14:20 -0700)]
BACKPORT: proc: add /proc/<pid>/timerslack_ns interface
This backports
5de23d435e88996b1efe0e2cebe242074ce67c9e
This patch provides a proc/PID/timerslack_ns interface which exposes a
task's timerslack value in nanoseconds and allows it to be changed.
This allows power/performance management software to set timer slack for
other threads according to its policy for the thread (such as when the
thread is designated foreground vs. background activity)
If the value written is non-zero, slack is set to that value. Otherwise
sets it to the default for the thread.
This interface checks that the calling task has permissions to to use
PTRACE_MODE_ATTACH_FSCREDS on the target task, so that we can ensure
arbitrary apps do not change the timer slack for other apps.
Signed-off-by: John Stultz <john.stultz@linaro.org>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Oren Laadan <orenl@cellrox.com>
Cc: Ruchi Kandoi <kandoiruchi@google.com>
Cc: Rom Lemarchand <romlem@android.com>
Cc: Android Kernel Team <kernel-team@android.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
John Stultz [Thu, 17 Mar 2016 21:20:51 +0000 (14:20 -0700)]
BACKPORT: timer: convert timer_slack_ns from unsigned long to u64
This backports
da8b44d5a9f8bf26da637b7336508ca534d6b319 from upstream.
This patchset introduces a /proc/<pid>/timerslack_ns interface which
would allow controlling processes to be able to set the timerslack value
on other processes in order to save power by avoiding wakeups (Something
Android currently does via out-of-tree patches).
The first patch tries to fix the internal timer_slack_ns usage which was
defined as a long, which limits the slack range to ~4 seconds on 32bit
systems. It converts it to a u64, which provides the same basically
unlimited slack (500 years) on both 32bit and 64bit machines.
The second patch introduces the /proc/<pid>/timerslack_ns interface
which allows the full 64bit slack range for a task to be read or set on
both 32bit and 64bit machines.
With these two patches, on a 32bit machine, after setting the slack on
bash to 10 seconds:
$ time sleep 1
real 0m10.747s
user 0m0.001s
sys 0m0.005s
The first patch is a little ugly, since I had to chase the slack delta
arguments through a number of functions converting them to u64s. Let me
know if it makes sense to break that up more or not.
Other than that things are fairly straightforward.
This patch (of 2):
The timer_slack_ns value in the task struct is currently a unsigned
long. This means that on 32bit applications, the maximum slack is just
over 4 seconds. However, on 64bit machines, its much much larger (~500
years).
This disparity could make application development a little (as well as
the default_slack) to a u64. This means both 32bit and 64bit systems
have the same effective internal slack range.
Now the existing ABI via PR_GET_TIMERSLACK and PR_SET_TIMERSLACK specify
the interface as a unsigned long, so we preserve that limitation on
32bit systems, where SET_TIMERSLACK can only set the slack to a unsigned
long value, and GET_TIMERSLACK will return ULONG_MAX if the slack is
actually larger then what can be stored by an unsigned long.
This patch also modifies hrtimer functions which specified the slack
delta as a unsigned long.
Signed-off-by: John Stultz <john.stultz@linaro.org>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Oren Laadan <orenl@cellrox.com>
Cc: Ruchi Kandoi <kandoiruchi@google.com>
Cc: Rom Lemarchand <romlem@android.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Android Kernel Team <kernel-team@android.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Liping Zhang [Wed, 22 Jun 2016 08:49:48 +0000 (16:49 +0800)]
netfilter: xt_quota2: make quota2_log work well
In upstream commit
7200135bc1e61f1437dc326ae2ef2f310c50b4eb
(netfilter: kill ulog targets)
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=
7200135bc1e6
ipt_ULOG target was removed, meanwhile, the IP_NF_TARGET_ULOG Kconfig
and ipt_ULOG.h header file were removed too. This causes we cannot enable
QUOTA2_LOG, and netd complains this error: "Unable to open quota socket".
So when we reach the quota2 limit, userspace will not be notified with
this event.
Since IP_NF_TARGET_ULOG was removed, we need not depend on
"IP_NF_TARGET_ULOG=n", and for compatibility, add ulog_packet_msg_t
related definitions copied from "ipt_ULOG.h".
Change-Id: I38132efaabf52bea75dfd736ce734a1b9690e87e
Reported-by: Samboo Shen <samboo.shen@spreadtrum.com>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Badhri Jagan Sridharan [Mon, 27 Jun 2016 20:33:59 +0000 (13:33 -0700)]
Revert "usb: gadget: prevent change of Host MAC address of 'usb0' interface"
This reverts commit
265801537d110eb68d44a2f66015479908f635c0.
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Tomeu Vizoso [Thu, 7 Jan 2016 15:46:14 +0000 (16:46 +0100)]
BACKPORT: PM / sleep: Go direct_complete if driver has no callbacks
Backport notes: This resolves clk warnings in the designware i2c
driver on HiKey seen during suspend/resume.
Cherrypicked from:
aa8e54b559479d0cb7eb632ba443b8cacd20cd4b
If a suitable prepare callback cannot be found for a given device and
its driver has no PM callbacks at all, assume that it can go direct to
complete when the system goes to sleep.
The reason for this is that there's lots of devices in a system that do
no PM at all and there's no reason for them to prevent their ancestors
to do direct_complete if they can support it.
Change-Id: Ia773afb4b266f012336b99fc8cf87453839e078b
Signed-off-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[jstultz: Backported to 4.4]
Signed-off-by: John Stultz <john.stultz@linaro.org>
Amit Pundir [Thu, 23 Jun 2016 10:05:07 +0000 (15:35 +0530)]
ANDROID: base-cfg: enable UID_CPUTIME
Enabled UID_CPUTIME and dependent PROFILING config option.
UID_CPUTIME (/proc/uid_cputime) interfaces provide amount of time a
UID's processes spent executing in user-space and kernel-space. It is
used by batterystats service.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Kangjie Lu [Tue, 3 May 2016 20:32:16 +0000 (16:32 -0400)]
UPSTREAM: USB: usbfs: fix potential infoleak in devio
(cherry pick from commit
681fef8380eb818c0b845fca5d2ab1dcbab114ee)
The stack object “ci” has a total size of 8 bytes. Its last 3 bytes
are padding bytes which are not initialized and leaked to userland
via “copy_to_user”.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug:
28619695
Change-Id: I170754d659d0891c075f85211b5e3970b114f097
Kangjie Lu [Tue, 3 May 2016 20:44:20 +0000 (16:44 -0400)]
UPSTREAM: ALSA: timer: Fix leak in events via snd_timer_user_ccallback
(cherry pick from commit
9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6)
The stack object “r1” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Bug:
28980217
Change-Id: I2e4c27352894b9f1f4c808b8db3ae5f9284faec1
Kangjie Lu [Tue, 3 May 2016 20:44:32 +0000 (16:44 -0400)]
UPSTREAM: ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt
(cherry pick from commit
e4ec8cc8039a7063e24204299b462bd1383184a5)
The stack object “r1” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Bug:
28980217
Change-Id: If2bba3c9ffb4e57190583b0bb2524d3b2514b2a3
Kangjie Lu [Tue, 3 May 2016 20:44:07 +0000 (16:44 -0400)]
UPSTREAM: ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
(cherry pick from commit
cec8f96e49d9be372fdb0c3836dcf31ec71e457e)
The stack object “tread” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Bug:
28980557
Change-Id: Ibda2d126f6d72fedf797a98796c3cde7bb03db76
Kangjie Lu [Tue, 3 May 2016 20:46:24 +0000 (16:46 -0400)]
UPSTREAM: net: fix infoleak in rtnetlink
(cherry pick from commit
5f8e44741f9f216e33736ea4ec65ca9ac03036e6)
The stack object “map” has a total size of 32 bytes. Its last 4
bytes are padding generated by compiler. These padding bytes are
not initialized and sent out via “nla_put”.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Bug:
28620102
Change-Id: Ica015c6a90d47e9188b1cd87a280ac6819dd9d09
Amit Pundir [Thu, 23 Jun 2016 06:21:39 +0000 (11:51 +0530)]
ANDROID: configs: remove unused configs
Remove following configs which no longer exist:
CONFIG_IP6_NF_TARGET_REJECT_SKERR
CONFIG_IP_NF_TARGET_REJECT_SKERR
CONFIG_RESOURCE_COUNTERS
CONFIG_TABLET_USB_WACOM
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Thierry Strudel [Wed, 15 Jun 2016 00:46:44 +0000 (17:46 -0700)]
ANDROID: cpu: send KOBJ_ONLINE event when enabling cpus
In case some sysfs nodes needs to be labeled with a different label than
sysfs then user needs to be notified when a core is brought back online.
Signed-off-by: Thierry Strudel <tstrudel@google.com>
Bug:
29359497
Change-Id: I0395c86e01cd49c348fda8f93087d26f88557c91
Oliver Neukum [Mon, 7 Mar 2016 10:31:10 +0000 (11:31 +0100)]
UPSTREAM: usbnet: cleanup after bind() in probe()
(cherry pick from commit
1666984c8625b3db19a9abc298931d35ab7bc64b)
In case bind() works, but a later error forces bailing
in probe() in error cases work and a timer may be scheduled.
They must be killed. This fixes an error case related to
the double free reported in
http://www.spinics.net/lists/netdev/msg367669.html
and needs to go on top of Linus' fix to cdc-ncm.
Signed-off-by: Oliver Neukum <ONeukum@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Bug:
28744625
Sami Tolvanen [Fri, 17 Jun 2016 18:31:17 +0000 (11:31 -0700)]
ANDROID: dm verity fec: initialize recursion level
Explicitly initialize recursion level to zero at the beginning of each
I/O operation.
Bug:
28943429
Change-Id: I00c612be2b8c22dd5afb65a739551df91cb324fc
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
(cherry picked from commit
32ffb3a22d7fd269b2961323478ece92c06a8334)
Sami Tolvanen [Fri, 17 Jun 2016 18:22:03 +0000 (11:22 -0700)]
ANDROID: dm verity fec: fix RS block calculation
A call to do_div was changed in Linux 4.5 to div64_u64 in
verity_fec_decode, which broke RS block calculation due to
incompatible semantics. This change fixes the computation.
Bug:
21893453
Change-Id: Idb88b901e0209c2cccc9c0796689f780592d58f9
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
(cherry picked from commit
879aac93eebcc2862d71afa9eca3a0c0f51b3b01)
Sami Tolvanen [Fri, 3 Jun 2016 21:22:46 +0000 (14:22 -0700)]
ANDROID: dm verity fec: add missing release from fec_ktype
Add a release function to allow destroying the dm-verity device.
Bug:
27928374
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Change-Id: Ic0f7c17e4889c5580d70b52d9a709a37165a5747
(cherry picked from commit
0039ccf47c8f99888f7b71b2a36a68a027fbe357)
Sami Tolvanen [Fri, 3 Jun 2016 21:06:14 +0000 (14:06 -0700)]
ANDROID: dm verity fec: limit error correction recursion
If verity tree itself is sufficiently corrupted in addition to data
blocks, it's possible for error correction to end up in a deep recursive
error correction loop that eventually causes a kernel panic as follows:
[ 14.728962] [<
ffffffc0008c1a14>] verity_fec_decode+0xa8/0x138
[ 14.734691] [<
ffffffc0008c3ee0>] verity_verify_level+0x11c/0x180
[ 14.740681] [<
ffffffc0008c482c>] verity_hash_for_block+0x88/0xe0
[ 14.746671] [<
ffffffc0008c1508>] fec_decode_rsb+0x318/0x75c
[ 14.752226] [<
ffffffc0008c1a14>] verity_fec_decode+0xa8/0x138
[ 14.757956] [<
ffffffc0008c3ee0>] verity_verify_level+0x11c/0x180
[ 14.763944] [<
ffffffc0008c482c>] verity_hash_for_block+0x88/0xe0
This change limits the recursion to a reasonable level during a single
I/O operation.
Bug:
28943429
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Change-Id: I0a7ebff331d259c59a5e03c81918cc1613c3a766
(cherry picked from commit
f4b9e40597e73942d2286a73463c55f26f61bfa7)
Jeff Vander Stoep [Wed, 1 Jun 2016 20:44:47 +0000 (13:44 -0700)]
ANDROID: restrict access to perf events
Add:
CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
to android-base.cfg
The kernel.perf_event_paranoid sysctl is set to 3 by default.
No unprivileged use of the perf_event_open syscall will be
permitted unless it is changed.
Bug:
29054680
Change-Id: Ie7512259150e146d8e382dc64d40e8faaa438917
Jeff Vander Stoep [Sun, 29 May 2016 21:22:32 +0000 (14:22 -0700)]
FROMLIST: security,perf: Allow further restriction of perf_event_open
When kernel.perf_event_open is set to 3 (or greater), disallow all
access to performance events by users without CAP_SYS_ADMIN.
Add a Kconfig symbol CONFIG_SECURITY_PERF_EVENTS_RESTRICT that
makes this value the default.
This is based on a similar feature in grsecurity
(CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making
the variable read-only. It also allows enabling further restriction
at run-time regardless of whether the default is changed.
https://lkml.org/lkml/2016/1/11/587
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Bug:
29054680
Change-Id: Iff5bff4fc1042e85866df9faa01bce8d04335ab8
Ben Hutchings [Tue, 19 Jan 2016 21:35:15 +0000 (21:35 +0000)]
BACKPORT: perf tools: Document the perf sysctls
perf_event_paranoid was only documented in source code and a perf error
message. Copy the documentation from the error message to
Documentation/sysctl/kernel.txt.
perf_cpu_time_max_percent was already documented but missing from the
list at the top, so add it there.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: linux-doc@vger.kernel.org
Link: http://lkml.kernel.org/r/20160119213515.GG2637@decadent.org.uk
[ Remove reference to external Documentation file, provide info inline, as before ]
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Bug:
29054680
Change-Id: I13e73cfb2ad761c94762d0c8196df7725abdf5c5
Ard Biesheuvel [Tue, 5 Jan 2016 09:18:52 +0000 (10:18 +0100)]
UPSTREAM: arm64: module: avoid undefined shift behavior in reloc_data()
Compilers may engage the improbability drive when encountering shifts
by a distance that is a multiple of the size of the operand type. Since
the required bounds check is very simple here, we can get rid of all the
fuzzy masking, shifting and comparing, and use the documented bounds
directly.
Change-Id: Ibc1b73f4a630bc182deb6edfa7458b5e29ba9577
Reported-by: David Binderman <dcb314@hotmail.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Ard Biesheuvel [Tue, 5 Jan 2016 09:18:51 +0000 (10:18 +0100)]
UPSTREAM: arm64: module: fix relocation of movz instruction with negative immediate
The test whether a movz instruction with a signed immediate should be
turned into a movn instruction (i.e., when the immediate is negative)
is flawed, since the value of imm is always positive. Also, the
subsequent bounds check is incorrect since the limit update never
executes, due to the fact that the imm_type comparison will always be
false for negative signed immediates.
Let's fix this by performing the sign test on sval directly, and
replacing the bounds check with a simple comparison against U16_MAX.
Change-Id: I9ad3d8bfd91e5fdc6434b1be6c3062dfec193176
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
[will: tidied up use of sval, renamed MOVK enum value to MOVKZ]
Signed-off-by: Will Deacon <will.deacon@arm.com>
Amit Pundir [Thu, 26 May 2016 07:28:21 +0000 (12:58 +0530)]
Revert "armv6 dcc tty driver"
This reverts commit
97312429c2bef1bf8055d01b35cf12028f60ef62.
Drop AOSP's "armv6 dcc tty driver" in favor of upstream DCC driver for
ARMv6/v7
16c63f8ea49c (drivers: char: hvc: add arm JTAG DCC console
support) and for ARMv8
4cad4c57e0b3 (ARM64: TTY: hvc_dcc: Add support
for ARM64 dcc).
Change-Id: I0ca651ef2d854fff03cee070524fe1e3971b6d8f
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Thu, 26 May 2016 07:27:56 +0000 (12:57 +0530)]
Revert "arm: dcc_tty: fix armv6 dcc tty build failure"
This reverts commit
dfc1d4be88597141f5ad9d39908c13944d209009.
Drop AOSP's "armv6 dcc tty driver" in favor of upstream DCC driver for
ARMv6/v7
16c63f8ea49c (drivers: char: hvc: add arm JTAG DCC console
support) and for ARMv8
4cad4c57e0b3 (ARM64: TTY: hvc_dcc: Add support
for ARM64 dcc).
Change-Id: I8110a4fd649b8ac1ec9bfac00255c1214135e4b2
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Dmitry Shmidt [Tue, 24 May 2016 21:41:57 +0000 (14:41 -0700)]
ARM64: Ignore Image-dtb from git point of view
Change-Id: I5bbf1db90f28ea956383b4a5d91ad508eea656dc
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Haojian Zhuang [Fri, 22 Apr 2016 09:23:29 +0000 (17:23 +0800)]
arm64: add option to build Image-dtb
Some bootloaders couldn't decompress Image.gz-dtb.
Change-Id: I698cd0c4ee6894e8d0655d88f3ecf4826c28a645
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Winter Wang [Fri, 20 May 2016 03:05:00 +0000 (11:05 +0800)]
ANDROID: usb: gadget: f_midi: set fi->f to NULL when free f_midi function
fi->f is set in f_midi's alloc_func, need to clean this to
NULL in free_func, otherwise on ConfigFS's function switch,
midi->usb_function it self is freed, fi->f will be a wild
pointer and run into below kernel panic:
---------------
[ 58.950628] Unable to handle kernel paging request at virtual address
63697664
[ 58.957869] pgd =
c0004000
[ 58.960583] [
63697664] *pgd=
00000000
[ 58.964185] Internal error: Oops:
80000005 [#1] PREEMPT SMP ARM
[ 58.970111] Modules linked in:
[ 58.973191] CPU: 0 PID: 0 Comm: swapper/0 Not tainted
4.1.15-03504-g34c857c-dirty #89
[ 58.981024] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[ 58.987557] task:
c110bd70 ti:
c1100000 task.ti:
c1100000
[ 58.992962] PC is at 0x63697664
[ 58.996120] LR is at android_setup+0x78/0x138
<..snip..>
[ 60.044980] 1fc0:
ffffffff ffffffff c1000684 00000000 00000000 c108ecd0 c11f7294 c11039c0
[ 60.053181] 1fe0:
c108eccc c110d148 1000406a 412fc09a 00000000 1000807c 00000000 00000000
[ 60.061420] [<
c073b1fc>] (android_setup) from [<
c0730490>] (udc_irq+0x758/0x1034)
[ 60.068951] [<
c0730490>] (udc_irq) from [<
c017c650>] (handle_irq_event_percpu+0x50/0x254)
[ 60.077165] [<
c017c650>] (handle_irq_event_percpu) from [<
c017c890>] (handle_irq_event+0x3c/0x5c)
[ 60.086072] [<
c017c890>] (handle_irq_event) from [<
c017f3ec>] (handle_fasteoi_irq+0xe0/0x198)
[ 60.094630] [<
c017f3ec>] (handle_fasteoi_irq) from [<
c017bcfc>] (generic_handle_irq+0x2c/0x3c)
[ 60.103271] [<
c017bcfc>] (generic_handle_irq) from [<
c017bfb8>] (__handle_domain_irq+0x7c/0xec)
[ 60.112000] [<
c017bfb8>] (__handle_domain_irq) from [<
c0101450>] (gic_handle_irq+0x24/0x5c)
--------------
Signed-off-by: Winter Wang <wente.wang@nxp.com>
Jeff Mahoney [Mon, 4 Apr 2016 18:15:23 +0000 (14:15 -0400)]
UPSTREAM: mac80211: fix "warning: ‘target_metric’ may be used uninitialized"
(This cherry-picks
b4201cc4fc6e1c57d6d306b1f787865043d60129 upstream)
This fixes:
net/mac80211/mesh_hwmp.c:603:26: warning: ‘target_metric’ may be used uninitialized in this function
target_metric is only consumed when reply = true so no bug exists here,
but not all versions of gcc realize it. Initialize to 0 to remove the
warning.
Change-Id: I13923fda9d314f48196c29e4354133dfe01f5abd
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[jstultz: Cherry-picked to android-4.4]
Signed-off-by: John Stultz <john.stultz@linaro.org>
Peter Hurley [Mon, 11 Jan 2016 06:40:55 +0000 (22:40 -0800)]
UPSTREAM: tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
(cherry pick from commit
5c17c861a357e9458001f021a7afa7aab9937439)
ioctl(TIOCGETD) retrieves the line discipline id directly from the
ldisc because the line discipline id (c_line) in termios is untrustworthy;
userspace may have set termios via ioctl(TCSETS*) without actually
changing the line discipline via ioctl(TIOCSETD).
However, directly accessing the current ldisc via tty->ldisc is
unsafe; the ldisc ptr dereferenced may be stale if the line discipline
is changing via ioctl(TIOCSETD) or hangup.
Wait for the line discipline reference (just like read() or write())
to retrieve the "current" line discipline id.
Cc: <stable@vger.kernel.org>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug:
28409131
Change-Id: I6774bd883a2e48bbe020486c72c42fb410e3f98a
Amit Pundir [Tue, 17 May 2016 10:36:17 +0000 (16:06 +0530)]
Revert "drivers: power: use 'current' instead of 'get_current()'"
This reverts commit
e1b5d103894d097fb630aebc3c1fdaf257f7c9bb.
This patch fixed the aosp commit
ad86cc8ad632 (drivers: power:
Add watchdog timer to catch drivers which lockup during suspend.),
which we dropped in Change Id Ic72a87432e27844155467817600adc6cf0c2209c,
so we no longer need this fix. A part of this patch is already reverted
in above mentioned Change Id.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Mon, 16 May 2016 07:55:35 +0000 (13:25 +0530)]
cpufreq: interactive: drop cpufreq_{get,put}_global_kobject func calls
Upstream commit
8eec1020f0c0 (cpufreq: create cpu/cpufreq at boot time)
make sure that cpufreq sysfs entry get created at boot time, and there
is no need to create/destroy it on need basis anymore.
So drop deprecated cpufreq_{get,put}_global_kobject function calls which
otherwise result in following compilation errors:
drivers/cpufreq/cpufreq_interactive.c: In function 'cpufreq_governor_interactive':
drivers/cpufreq/cpufreq_interactive.c:1187:4: error: implicit declaration of function 'cpufreq_get_global_kobject' [-Werror=implicit-function-declaration]
WARN_ON(cpufreq_get_global_kobject());
^
drivers/cpufreq/cpufreq_interactive.c:1197:5: error: implicit declaration of function 'cpufreq_put_global_kobject'[-Werror=implicit-function-declaration]
cpufreq_put_global_kobject();
^
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Mon, 16 May 2016 07:47:28 +0000 (13:17 +0530)]
Revert "cpufreq: interactive: build fixes for 4.4"
This reverts commit
bc68f6c4efbd4ddbb15817203f18b7941d9ffd52.
This build fix broke the Interactive Gov at runtime with duplicate sysfs
entry warnings at boot time. We no longer need to this create/destroy
cpufreq sysfs entry at run time on need basis thanks to upstream commit
8eec1020f0c0 (cpufreq: create cpu/cpufreq at boot time) which creates it
at boot time. Hence drop this build fix.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
John Stultz [Thu, 12 May 2016 18:17:52 +0000 (11:17 -0700)]
xt_qtaguid: Fix panic caused by processing non-full socket.
In an issue very similar to
4e461c777e3 (xt_qtaguid: Fix panic
caused by synack processing), we were seeing panics on occasion
in testing.
In this case, it was the same issue, but caused by a different
call path, as the sk being returned from qtaguid_find_sk() was
not a full socket. Resulting in the sk->sk_socket deref to fail.
This patch adds an extra check to ensure the sk being retuned
is a full socket, and if not it returns NULL.
Reported-by: Milosz Wasilewski <milosz.wasilewski@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Dmitry Shmidt [Wed, 11 May 2016 18:01:02 +0000 (11:01 -0700)]
fiq_debugger: Add fiq_debugger.disable option
This change allows to use same kernel image with
different console options for uart and fiq_debugger.
If fiq_debugger.disable will be set to 1/y/Y,
fiq_debugger will not be initialized.
Change-Id: I71fda54f5f863d13b1437b1f909e52dd375d002d
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Janis Danisevskis [Thu, 14 Apr 2016 12:57:03 +0000 (13:57 +0100)]
UPSTREAM: procfs: fixes pthread cross-thread naming if !PR_DUMPABLE
The PR_DUMPABLE flag causes the pid related paths of the
proc file system to be owned by ROOT. The implementation
of pthread_set/getname_np however needs access to
/proc/<pid>/task/<tid>/comm.
If PR_DUMPABLE is false this implementation is locked out.
This patch installs a special permission function for
the file "comm" that grants read and write access to
all threads of the same group regardless of the ownership
of the inode. For all other threads the function falls back
to the generic inode permission check.
Signed-off-by: Janis Danisevskis <jdanis@google.com>
Jimmy Perchet [Mon, 9 May 2016 17:32:04 +0000 (10:32 -0700)]
FROMLIST: wlcore: Disable filtering in AP role
When you configure (set it up) a STA interface, the driver
install a multicast filter. This is normal behavior, when
one application subscribe to multicast address the filter
is updated. When Access Point interface is configured, there
is no filter installation and the "filter update" path is
disabled in the driver.
The problem happens when you switch an interface from STA
type to AP type. The filter is installed but there are no
means to update it.
Change-Id: Ied22323af831575303abd548574918baa9852dd0
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Lianwei Wang [Fri, 6 May 2016 07:17:57 +0000 (00:17 -0700)]
Revert "drivers: power: Add watchdog timer to catch drivers which lockup during suspend."
This reverts commit
ad86cc8ad63229eeeba0628e99f2f59df55a25fd.
Commit
70fea60d888d ("PM / Sleep: Detect device suspend/resume lockup...")
added a suspend/resume watchdog timer to catch the lockup. Let's revert the
duplicate one.
Change-Id: Ic72a87432e27844155467817600adc6cf0c2209c
Signed-off-by: Lianwei Wang <lianwei.wang@gmail.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Dmitry Shmidt [Wed, 4 May 2016 20:51:38 +0000 (13:51 -0700)]
fiq_debugger: Add option to apply uart overlay by FIQ_DEBUGGER_UART_OVERLAY
fiq_debugger is taking over uart, so it is necessary to disable
original uart in DT file. It can be done manually or by overlay.
Change-Id: I9f50ec15b0e22e602d73b9f745fc8666f8925d09
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Amit Pundir [Wed, 4 May 2016 05:44:16 +0000 (11:14 +0530)]
Revert "Recreate asm/mach/mmc.h include file"
This reverts commit
5b42ae3edab6c39c1337d36881d29350bb36dcff.
This recereated arch/arm/include/asm/mach/mmc.h include file has
no active user in android-4.x kernels. Also all the necessary bits
are already moved to include/linux/amba/mmci.h.
6ef297f86b62 (ARM: 5720/1: Move MMCI header to amba include dir)
Change-Id: Ibf258b355d17f54f49b777a8f6e0089e9b59a3a5
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Wed, 4 May 2016 05:35:15 +0000 (11:05 +0530)]
Revert "ARM: Add 'card_present' state to mmc_platfrom_data"
This reverts commit
541632275e983573b8250fcd4402f772d7bd1e6f.
mmc_platform_data (or arch/arm/include/asm/mach/mmc.h in general)
has no active user in android-4.x kernels. Also all the necessary
bits are already moved to include/linux/amba/mmci.h.
6ef297f86b62 (ARM: 5720/1: Move MMCI header to amba include dir)
Change-Id: Iff384eb527327bf88543408e0257241c1fd99a43
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Jack Pham [Wed, 23 Mar 2016 20:18:03 +0000 (13:18 -0700)]
usb: dual-role: make stub functions inline
If CONFIG_DUAL_ROLE_USB_INTF is disabled but the exported functions
are referenced, the build will result in warnings such as:
In file included from include/linux/usb/class-dual-role.h:112:13:
warning: ‘dual_role_instance_changed’ defined but not used
[-Wunused-function]
These stub functions should be static inline.
Change-Id: I5a9ef58dca32306fac5a4c7f28cdaa36fa8ae078
Signed-off-by: Jack Pham <jackp@codeaurora.org>
(cherry picked from commit
2d152dbb0743526b21d6bbefe097f874c027f860)
(cherry picked from commit
8ad66cafaa10e6ba94ff79a8dbc2cc437c6bfe93)
Amit Pundir [Mon, 2 May 2016 10:02:15 +0000 (15:32 +0530)]
Revert "mmc: Add status IRQ and status callback function to mmc platform data"
This reverts commit
91fa97e1e5c001d52f6c993d37be08d1e84f47b7.
This patch is no longer valid. There are no users for this status irq and
callback in android-4.x. The Qcom platform (mach-msm/qsd8x50, HTC Dream..)
and SDCC controller (msm_sdcc) using this status IRQ and callback are
dropped from mainline sometime back.
27842bb18b00 (mmc: Remove msm_sdcc driver)
c0c89fafa289 (ARM: Remove mach-msm and associated ARM architecture code)
Change-Id: Ia38e42a06dc184395f79c1ec1d306bf9775704d5
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Yongqin Liu [Thu, 28 Apr 2016 05:53:36 +0000 (13:53 +0800)]
quick selinux support for tracefs
Here is just the quick fix for tracefs with selinux.
just add tracefs to the list of whitelisted filesystem
types in selinux_is_sblabel_mnt(), but the right fix would be to
generalize this logic as described in the last item on the todo list,
https://bitbucket.org/seandroid/wiki/wiki/ToDo
Change-Id: I2aa803ccffbcd2802a7287514da7648e6b364157
Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>
Amit Pundir [Tue, 26 Apr 2016 09:17:53 +0000 (14:47 +0530)]
Revert "hid-multitouch: Filter collections by application usage."
This reverts commit
0840b80cb9626906b57df54e7229db60f9aea4f2.
This patch is already upstreamed in v4.4, commit
658d4aed59b3 (HID: hid-multitouch: Filter collections by application usage.),
and further fixed/cleaned up afterwards in commits
c2ef8f21ea8f (HID: multitouch: add support for trackpads),
76f5902aebda (HID: hid-multitouch: Simplify setup and frame synchronization) et al.
By having this duplicate patch in AOSP we are doing redundant
checks for Touchscreen and Touchpad devices.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Tue, 26 Apr 2016 09:44:35 +0000 (15:14 +0530)]
Revert "HID: steelseries: validate output report details"
This reverts commit
90037b2720acffa6da2269a10ecf24ec2dace89b.
Remove duplicate code. This patch is already upstreamed in v4.4,
commit
41df7f6d4372 (HID: steelseries: validate output report details).
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
John Stultz [Sat, 23 Apr 2016 00:12:57 +0000 (17:12 -0700)]
xt_qtaguid: Fix panic caused by synack processing
In upstream commit
ca6fb06518836ef9b65dc0aac02ff97704d52a05
(tcp: attach SYNACK messages to request sockets instead of
listener)
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=
ca6fb0651883
The building of synack messages was changed, which made it so
the skb->sk points to a casted request_sock. This is problematic,
as there is no sk_socket in a request_sock. So when the qtaguid_mt
function tries to access the sk->sk_socket, it accesses uninitialized
memory.
After looking at how other netfilter implementations handle this,
I realized there was a skb_to_full_sk() helper added, which the
xt_qtaguid code isn't yet using.
This patch adds its use, and resovles panics seen when accessing
uninitialzed memory when processing synack packets.
Reported-by: YongQin Liu <yongquin.liu@linaro.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Dmitry Shmidt [Mon, 25 Apr 2016 21:28:30 +0000 (14:28 -0700)]
Revert "mm: vmscan: Add a debug file for shrinkers"
Kernel panic when type "cat /sys/kernel/debug/shrinker"
Unable to handle kernel paging request at virtual address
0af37d40
pgd =
d4dec000
[
0af37d40] *pgd=
00000000
Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[<
c0bb8f24>] (_raw_spin_lock) from [<
c020aa08>] (list_lru_count_one+0x14/0x28)
[<
c020aa08>] (list_lru_count_one) from [<
c02309a8>] (super_cache_count+0x40/0xa0)
[<
c02309a8>] (super_cache_count) from [<
c01f6ab0>] (debug_shrinker_show+0x50/0x90)
[<
c01f6ab0>] (debug_shrinker_show) from [<
c024fa5c>] (seq_read+0x1ec/0x48c)
[<
c024fa5c>] (seq_read) from [<
c022e8f8>] (__vfs_read+0x20/0xd0)
[<
c022e8f8>] (__vfs_read) from [<
c022f0d0>] (vfs_read+0x7c/0x104)
[<
c022f0d0>] (vfs_read) from [<
c022f974>] (SyS_read+0x44/0x9c)
[<
c022f974>] (SyS_read) from [<
c0107580>] (ret_fast_syscall+0x0/0x3c)
Code:
e1a04000 e3a00001 ebd66b39 f594f000 (
e1943f9f)
---[ end trace
60c74014a63a9688 ]---
Kernel panic - not syncing: Fatal exception
shrink_control.nid is used but not initialzed, same for
shrink_control.memcg.
This reverts commit
b0e7a582b2264cdf75874dcd8df915b6b4427755.
Change-Id: I108de88fa4baaef99a53c4e4c6a1d8c4b4804157
Reported-by: Xiaowen Liu <xiaowen.liu@freescale.com>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Amit Pundir [Tue, 26 Apr 2016 10:21:20 +0000 (15:51 +0530)]
Revert "SELinux: Enable setting security contexts on rootfs inodes."
This reverts commit
78d36d2111cd4ca722a602846f7db8f54a0b074c.
Drop this duplicate patch. This patch is already upstreamed in v4.4. Commits
5c73fceb8c70 (SELinux: Enable setting security contexts on rootfs inodes.),
12f348b9dcf6 (SELinux: rename SE_SBLABELSUPP to SBLABEL_MNT), and
b43e725d8d38 (SELinux: use a helper function to determine seclabel),
for reference.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Tue, 26 Apr 2016 10:21:06 +0000 (15:51 +0530)]
Revert "SELinux: build fix for 4.1"
This reverts commit
43e1b4f528e1654fadd1097f7cc5c50be6e45b77.
This patch is part of code which is already upstreamed in v4.4. Commits
5c73fceb8c70 (SELinux: Enable setting security contexts on rootfs inodes.),
12f348b9dcf6 (SELinux: rename SE_SBLABELSUPP to SBLABEL_MNT), and
b43e725d8d38 (SELinux: use a helper function to determine seclabel).
for reference.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Daniel Rosenberg [Fri, 22 Apr 2016 07:00:48 +0000 (00:00 -0700)]
fuse: Add support for d_canonical_path
Allows FUSE to report to inotify that it is acting
as a layered filesystem. The userspace component
returns a string representing the location of the
underlying file. If the string cannot be resolved
into a path, the top level path is returned instead.
bug:
23904372
Change-Id: Iabdca0bbedfbff59e9c820c58636a68ef9683d9f
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Daniel Rosenberg [Fri, 22 Apr 2016 07:00:14 +0000 (00:00 -0700)]
vfs: change d_canonical_path to take two paths
bug:
23904372
Change-Id: I4a686d64b6de37decf60019be1718e1d820193e6
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Amit Pundir [Mon, 25 Apr 2016 18:25:44 +0000 (23:55 +0530)]
android: recommended.cfg: remove CONFIG_UID_STAT
Remove UID Stat driver.
Change-Id: Ifc9d2c6fe27900f30e6407398f5b24222518bffc
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Thu, 1 Oct 2015 05:14:36 +0000 (10:44 +0530)]
netfilter: xt_qtaguid: seq_printf fixes
Update seq_printf() usage in xt_qtaguid to align
with changes from mainline commit
6798a8caaf64
"fs/seq_file: convert int seq_vprint/seq_printf/etc...
returns to void".
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Mon, 25 Apr 2016 11:38:15 +0000 (17:08 +0530)]
Revert "misc: uidstat: Adding uid stat driver to collect network statistics."
This reverts commit
6b6d5fbf9ae567aefb58099a30bbb6d25fa8925b.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Mon, 25 Apr 2016 11:31:08 +0000 (17:01 +0530)]
Revert "net: activity_stats: Add statistics for network transmission activity"
This reverts commit
afedd7beba14385fd797166751fde39e0f52cf72.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Mon, 25 Apr 2016 11:30:57 +0000 (17:00 +0530)]
Revert "net: activity_stats: Stop using obsolete create_proc_read_entry api"
This reverts commit
7c121720fa14889d59e933aad0a8b9ce948a39ae.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Mon, 25 Apr 2016 11:30:43 +0000 (17:00 +0530)]
Revert "misc: uidstat: avoid create_stat() race and blockage."
This reverts commit
f7a812174033fe620509e6e8ca7022abd924b1c4.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Mon, 25 Apr 2016 11:30:31 +0000 (17:00 +0530)]
Revert "misc: uidstat: Remove use of obsolete create_proc_read_entry api"
This reverts commit
fccab646d33381af63e4f4c0d4f309a1d2b4b0c3.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Mon, 25 Apr 2016 11:30:08 +0000 (17:00 +0530)]
Revert "misc seq_printf fixes for 4.4"
This reverts commit
5c7566a29bff14166d952f2ea525d5231546f821.
This patch revert some changes in net/netfilter/xt_qtaguid.c as well.
I'll submit another patch to restore those changes.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Amit Pundir [Mon, 25 Apr 2016 11:28:20 +0000 (16:58 +0530)]
Revert "misc: uid_stat: Include linux/atomic.h instead of asm/atomic.h"
This reverts commit
8d3a6c1538fb021448c4f6381f6191061f947ba1.
This series of patches revert AOSP UID_STAT and NET_ACTIVITY_STATS drivers.
I could not find any meaningful usage of these interfaces in AOSP master.
UID_STAT driver expose "/proc/uid_stat/*" interfaces but it is only
used in AOSP master as in what appears be an out of date bandwidth
test in frameworks/base and in somewhat recent battery utils test
in external/chromium-trace project.
NET_ACTIVITY_STATS driver expose "/proc/net/stat/activity" interface
but I can not track its usage anywhere in AOSP at all.
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Dmitry Shmidt [Thu, 21 Apr 2016 22:47:01 +0000 (15:47 -0700)]
Revert "net: socket ioctl to reset connections matching local address"
Use SOCK_DESTROY from now instead of SIOCKILLADDR
This reverts commit
38f0ec724f5306c81130ca9343c856aa37a76d54.
Change-Id: I2dcd833b66c88a48de8978dce9d72ab78f9af549
Dmitry Shmidt [Thu, 21 Apr 2016 22:44:25 +0000 (15:44 -0700)]
Revert "net: fix iterating over hashtable in tcp_nuke_addr()"
This reverts commit
4747299b2c8e8778927b3df0501023d76fe4f2d5.
Dmitry Shmidt [Thu, 21 Apr 2016 22:44:11 +0000 (15:44 -0700)]
Revert "net: fix crash in tcp_nuke_addr()"
This reverts commit
08f7c4280cd5efe9e274240c42177f459431bac2.
Dmitry Shmidt [Thu, 21 Apr 2016 22:43:58 +0000 (15:43 -0700)]
Revert "Don't kill IPv4 sockets when killing IPv6 sockets was requested."
This reverts commit
8bf4413b4f54e24120b90ecbfee426beeddc3ff0.
Dmitry Shmidt [Thu, 21 Apr 2016 22:43:29 +0000 (15:43 -0700)]
Revert "tcp: Fix IPV6 module build errors"
This reverts commit
3823c8136f2170b3ac5e6a5f8b857746a786e845.
Dmitry Shmidt [Tue, 19 Apr 2016 19:44:42 +0000 (12:44 -0700)]
android: base-cfg: remove CONFIG_SWITCH
Change-Id: I3fd1aa7a54fe3a8d3ad5537cbc61386e52f41ea0
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>