Skip to content
Snippets Groups Projects
Select Git revision
  • aosp-new/mirror-aosp-android-mainline
  • aosp-new/android-gs-bluejay-5.10-android15-qpr1
  • aosp-new/android-gs-felix-5.10-android15-qpr1
  • aosp-new/android-gs-lynx-5.10-android15-qpr1
  • aosp-new/android-gs-pantah-5.10-android15-qpr1
  • aosp-new/android-gs-raviole-5.10-android15-qpr1
  • aosp-new/android-gs-tangorpro-5.10-android15-qpr1
  • aosp-new/android-gs-bluejay-5.10-android15
  • aosp-new/android-gs-felix-5.10-android15
  • aosp-new/android-gs-lynx-5.10-android15
  • aosp-new/android-gs-pantah-5.10-android15
  • aosp-new/android-gs-raviole-5.10-android15
  • aosp-new/android-gs-tangorpro-5.10-android15
  • aosp-new/android-gs-bluejay-android15-qpr1-beta3
  • aosp-new/android-gs-felix-5.10-android15-qpr1-beta3
  • aosp-new/android-gs-lynx-5.10-android15-qpr1-beta3
  • aosp-new/android-gs-pantah-5.10-android15-qpr1-beta3
  • aosp-new/android-gs-raviole-5.10-android15-qpr1-beta3
  • aosp-new/android-gs-tangorpro-5.10-android15-qpr1-beta3
  • aosp-new/android-gs-bluejay-5.10-android14-qpr3
  • android-15.0.0_r0.55
  • android-15.0.0_r0.54
  • android-15.0.0_r0.53
  • android-15.0.0_r0.52
  • android-15.0.0_r0.51
  • android-15.0.0_r0.50
  • android-15.0.0_r0.42
  • android-15.0.0_r0.35
  • android-15.0.0_r0.34
  • android-15.0.0_r0.33
  • android-15.0.0_r0.32
  • android-15.0.0_r0.31
  • android-15.0.0_r0.30
  • android-15.0.0_r0.25
  • android-15.0.0_r0.24
  • android-15.0.0_r0.23
  • android-15.0.0_r0.22
  • android-15.0.0_r0.21
  • android-15.0.0_r0.20
  • android-15-qpr1-beta-3_r0.10
40 results
Search by author
  • Any Author
  • 72162444 72162444 72162444 72162444 gaochangning
  • Aakash Dave Aakash Dave aakash.dave
  • Aaron Kim Aaron Kim akim
  • Aaron Kloc Aaron Kloc akloc
  • Aaron Lan Aaron Lan aaron.lan
  • Aaron Nabil Aaron Nabil aaronna
  • Aaron Pohle Aaron Pohle aaron.pohle
  • Abbott Chung Abbott Chung chung.abbott
  • Abdallah Omar Abdallah Omar abdallah_omar
  • Abdessamii Chalbi Abdessamii Chalbi abdessamii.chalbi
  • Abdul Hussain Sirajudeen Abdul Hussain Sirajudeen abdul.hussain
  • Abdullah Alghamdi Abdullah Alghamdi a.alghamdi
  • Abdullah Elmarghany Abdullah Elmarghany abdullah_elmarghany
  • Abel Fang Abel Fang abel_fang
  • Abel Vesa Abel Vesa abel.vesa
  • Abhijeet Badurkar Abhijeet Badurkar abhijeet.badurkar
  • Abhijit Adsule Abhijit Adsule adsule
  • Abhijit Murthy Abhijit Murthy abhijit
  • Abhi Khanal Abhi Khanal akhanal
  • Abhilash Sahoo Abhilash Sahoo abhilashsahoo
20 authors
  1. Sep 11, 2024
  3. Sep 02, 2024
    • Hangyu Hua's avatar
      UPSTREAM: net: sched: sch_multiq: fix possible OOB write in multiq_tune() · 17e85e80
      Hangyu Hua authored 
      
[ Upstream commit affc18fd ]

q->bands will be assigned to qopt->bands to execute subsequent code logic
after kmalloc. So the old q->bands should not be used in kmalloc.
Otherwise, an out-of-bounds write will occur.

Bug: 349777785
Fixes: c2999f7f ("net: sched: multiq: don't call qdisc_put() while holding tree lock")
Signed-off-by: default avatarHangyu Hua <hbh25y@gmail.com>
Acked-by: default avatarCong Wang <cong.wang@bytedance.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
(cherry picked from commit 0f208fad)
Signed-off-by: default avatarLee Jones <joneslee@google.com>
Change-Id: Iec8413c39878596795420ae58bbe6974890cf2de
      17e85e80
    • Carlos Llamas's avatar
      FROMLIST: binder: fix UAF caused by offsets overwrite · 148d7d15
      Carlos Llamas authored 
      
Binder objects are processed and copied individually into the target
buffer during transactions. Any raw data in-between these objects is
copied as well. However, this raw data copy lacks an out-of-bounds
check. If the raw data exceeds the data section size then the copy
overwrites the offsets section. This eventually triggers an error that
attempts to unwind the processed objects. However, at this point the
offsets used to index these objects are now corrupted.

Unwinding with corrupted offsets can result in decrements of arbitrary
nodes and lead to their premature release. Other users of such nodes are
left with a dangling pointer triggering a use-after-free. This issue is
made evident by the following KASAN report (trimmed):

  ==================================================================
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
  Write of size 4 at addr ffff47fc91598f04 by task binder-util/743

  CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   _raw_spin_lock+0xe4/0x19c
   binder_free_buf+0x128/0x434
   binder_thread_write+0x8a4/0x3260
   binder_ioctl+0x18f0/0x258c
  [...]

  Allocated by task 743:
   __kmalloc_cache_noprof+0x110/0x270
   binder_new_node+0x50/0x700
   binder_transaction+0x413c/0x6da8
   binder_thread_write+0x978/0x3260
   binder_ioctl+0x18f0/0x258c
  [...]

  Freed by task 745:
   kfree+0xbc/0x208
   binder_thread_read+0x1c5c/0x37d4
   binder_ioctl+0x16d8/0x258c
  [...]
  ==================================================================

To avoid this issue, let's check that the raw data copy is within the
boundaries of the data section.

Fixes: 6d98eb95 ("binder: avoid potential data leakage when copying txn")
Cc: Todd Kjos <tkjos@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarCarlos Llamas <cmllamas@google.com>

Bug: 352520660
Link: https://lore.kernel.org/all/20240822182353.2129600-1-cmllamas@google.com/


Change-Id: I1b2dd8403b63e5eeb58904558b7b542141c83fc2
Signed-off-by: default avatarCarlos Llamas <cmllamas@google.com>
(cherry picked from commit b42ed94769088450987f2b52f41a3fb274244827)
Signed-off-by: default avatarLee Jones <joneslee@google.com>
      148d7d15
  5. Jul 18, 2024
  7. Jul 16, 2024
  9. Jul 11, 2024
  11. Jul 04, 2024
    • Mostafa Saleh's avatar
      arm64/dts: gs201: Add Alive S2MPU · 7b40bac4
      Mostafa Saleh authored 
      
Alive S2MPU is fully trusted and is not managed by the kernel.
However, we need to make sure the kernel can’t map it to use
it in emulation mode of the S2MPU.

So we define it as:
- “deny-all”: So it never gets power managed or updated
- “off-at-boot”: Never configured at boot.

Which mainly means it remains unconfigured but it's MMIO is not
accessible to the kernel.

Bug: 342511931
Change-Id: I844cdd4e2485fbae416c618b0b8a83e30b847065
Signed-off-by: default avatarMostafa Saleh <smostafa@google.com>
      7b40bac4
    • Mostafa Saleh's avatar
      arm64/dts: gs201: Add AoC S2MPU · d913e04f
      Mostafa Saleh authored 
      
AoC is only controlled by TZ.

However, SysMMU has an emulation feature that can be misused to read
from arbitrary memory locations, and with SysMMU under the control of
the kernel, we need to configure S2MPU to block such potentially
malicious transactions.

Add the AoC S2MPU with the new flag “deny-all” which would mainly
unmap the S2MPU interface and configure it to deny all traffic.

Bug: 342511931
Change-Id: I38a1a2af556eaca83be3bd93db1b5dd400034255
Signed-off-by: default avatarMostafa Saleh <smostafa@google.com>
      d913e04f
    • Mostafa Saleh's avatar
      arm64/s2mpu: Add deny-all support · 0f1c59c0
      Mostafa Saleh authored 
      
Add "deny-all" propery for S2MPUs, this has the same purpose as other
branches but implemented in a slightly different way.

Mainly, we want to ensure that this device is not accessible from
host and in deny-all state, at probe the device is set to deny state
and then all PM calls are blocked so the hypervisor would never touch
any of its MMIO
But they are registered with the hypervisor so they are not accessible
from host.

Bug: 342511931
Change-Id: Id8a38b38310ec950841074b288797041355a3ec7
Signed-off-by: default avatarMostafa Saleh <smostafa@google.com>
      0f1c59c0
  13. Jun 28, 2024
    • Michal Luczaj's avatar
      UPSTREAM: af_unix: Fix garbage collector racing against connect() · 53f60c53
      Michal Luczaj authored 
      
[ Upstream commit 47d8ac01 ]

Garbage collector does not take into account the risk of embryo getting
enqueued during the garbage collection. If such embryo has a peer that
carries SCM_RIGHTS, two consecutive passes of scan_children() may see a
different set of children. Leading to an incorrectly elevated inflight
count, and then a dangling pointer within the gc_inflight_list.

sockets are AF_UNIX/SOCK_STREAM
S is an unconnected socket
L is a listening in-flight socket bound to addr, not in fdtable
V's fd will be passed via sendmsg(), gets inflight count bumped

connect(S, addr)	sendmsg(S, [V]); close(V)	__unix_gc()
----------------	-------------------------	-----------

NS = unix_create1()
skb1 = sock_wmalloc(NS)
L = unix_find_other(addr)
unix_state_lock(L)
unix_peer(S) = NS
			// V count=1 inflight=0

 			NS = unix_peer(S)
 			skb2 = sock_alloc()
			skb_queue_tail(NS, skb2[V])

			// V became in-flight
			// V count=2 inflight=1

			close(V)

			// V count=1 inflight=1
			// GC candidate condition met

						for u in gc_inflight_list:
						  if (total_refs == inflight_refs)
						    add u to gc_candidates

						// gc_candidates={L, V}

						for u in gc_candidates:
						  scan_children(u, dec_inflight)

						// embryo (skb1) was not
						// reachable from L yet, so V's
						// inflight remains unchanged
__skb_queue_tail(L, skb1)
unix_state_unlock(L)
						for u in gc_candidates:
						  if (u.inflight)
						    scan_children(u, inc_inflight_move_tail)

						// V count=1 inflight=2 (!)

If there is a GC-candidate listening socket, lock/unlock its state. This
makes GC wait until the end of any ongoing connect() to that socket. After
flipping the lock, a possibly SCM-laden embryo is already enqueued. And if
there is another embryo coming, it can not possibly carry SCM_RIGHTS. At
this point, unix_inflight() can not happen because unix_gc_lock is already
taken. Inflight graph remains unaffected.

Bug: 349143236
Bug: 336226035
Fixes: 1fd05ba5 ("[AF_UNIX]: Rewrite garbage collector, fixes race.")
Signed-off-by: default avatarMichal Luczaj <mhal@rbox.co>
Reviewed-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20240409201047.1032217-1-mhal@rbox.co


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
(cherry picked from commit 507cc232ffe53a352847893f8177d276c3b532a9)
Signed-off-by: default avatarLee Jones <joneslee@google.com>
Change-Id: If321f78b8b3220f5a1caea4b5e9450f1235b0770
(cherry picked from commit 897b4b44ae08bc3a74e204536f49ab86a0b8002c)
      53f60c53
  15. Jun 25, 2024
    • Woody Lin's avatar
      watchdog: s3c2410_wdt: Assign s3c_wdt[] until probe complete · d69b4928
      Woody Lin authored 
      
Assigns device data to `s3c_wdt[cluster_index]` only when probe function
completes. Several functions of s3c2410_wdt use the existence of
`s3c_wdt[*]` to decide whether the device data is ready to be accessed.
This causes an invalid access issue as long as the probe function puts
device data to `s3c_wdt[cluster_index]` before completely preparing the
content. Fixes the issue by rearranging the assignment order.

Bug: 342585125
Change-Id: Idb4c3b71fb2e0518725c697db01e708aa0c7c86b
Signed-off-by: default avatarWoody Lin <woodylin@google.com>
(cherry picked from commit d7bd15571d51e658a081d98dfbcc17e3aa104585)
      d69b4928
  17. Jun 21, 2024
  19. Jun 14, 2024
    • Kalesh Singh's avatar
      ANDROID: 16K: Only check basename of linker context · 28a6e1ad
      Kalesh Singh authored 
      
Depending on the platform binary being executed, the linker
(interpreter) requested can be one of:

    1) /system/bin/bootstrap/linker64
    2) /system/bin/linker64
    3) /apex/com.android.runtime/bin/linker64

Relax the check to the basename (linker64), instead of the path.

Bug: 330767927
Bug: 335584973
Bug: 347106837
Change-Id: I4a1f95b7cecd126f85ad8cefd9ff10d272947f9e
Signed-off-by: default avatarKalesh Singh <kaleshsingh@google.com>
(cherry picked from commit 38965378)
      28a6e1ad
  21. Jun 11, 2024
  23. Jun 06, 2024
  25. Jun 05, 2024
  27. Jun 04, 2024
  29. Jun 03, 2024
  31. May 29, 2024
  33. May 25, 2024
  35. May 24, 2024
  37. May 23, 2024
  39. May 21, 2024
  41. May 15, 2024
  43. May 14, 2024
  45. May 10, 2024