NothingOSS/android_kernel_msm-6.1_nothing_sm7635
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
android_kernel_msm-6.1_noth.../drivers
History
John Stultz 87647c0c54 ANDROID: uid_sys_stats: Use llist for deferred work 
A use-after-free bug was found in the previous custom lock-free list
implementation for the deferred work, so switch functionality to llist
implementation.

While the previous approach atomically handled the list head, it did not
assure the new node's next pointer was assigned before the head was
pointed to the node, allowing the consumer to traverse to an invalid
next pointer.

Additionally, in switching to llists, this patch pulls the entire list
off the list head once and processes it separately, reducing the number
of atomic operations compared with the custom lists's implementation
which pulled one node at a time atomically from the list head.

BUG: KASAN: use-after-free in process_notifier+0x270/0x2dc
Write of size 8 at addr d4ffff89545c3c58 by task Blocking Thread/3431
Pointer tag: [d4], memory tag: [fe]

call trace:
 dump_backtrace+0xf8/0x118
 show_stack+0x18/0x24
 dump_stack_lvl+0x60/0x78
 print_report+0x178/0x470
 kasan_report+0x8c/0xbc
 kasan_tag_mismatch+0x28/0x3c
 __hwasan_tag_mismatch+0x30/0x60
 process_notifier+0x270/0x2dc
 notifier_call_chain+0xb4/0x108
 blocking_notifier_call_chain+0x54/0x80
 profile_task_exit+0x20/0x2c
 do_exit+0xec/0x1114
 __arm64_sys_exit_group+0x0/0x24
 get_signal+0x93c/0xa78
 do_notify_resume+0x158/0x3fc
 el0_svc+0x54/0x78
 el0t_64_sync_handler+0x44/0xe4
 el0t_64_sync+0x190/0x194

Bug: 294468796
Bug: 295787403
Fixes: 8e86825eec ("ANDROID: uid_sys_stats: Use a single work for deferred updates")
Change-Id: Id377348c239ec720a5237726bc3632544d737e3b
Signed-off-by: John Stultz <jstultz@google.com>
[nkapron: Squashed with other changes and rewrote the commit message]
Signed-off-by: Neill Kapron <nkapron@google.com>
2023-09-05 12:07:09 +00:00
..
accessibility
acpi UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
amba
android ANDROID: vendor_hooks: Add tune swappiness hook in get_scan_count() 2023-08-31 17:38:17 +00:00
ata UPSTREAM: scsi: ata: libata-scsi: Convert to scsi_execute_cmd() 2023-03-15 16:17:14 +00:00
atm atm: idt77252: fix kmemleak when rmmod idt77252 2023-03-30 12:49:09 +02:00
auxdisplay auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() 2023-03-11 13:55:16 +01:00
base UPSTREAM: platform: Provide a remove callback that returns no value 2023-06-14 16:40:59 +00:00
bcma
block ANDROID: zram: allow zram to allocate CMA pages 2023-04-26 17:01:52 +00:00
bluetooth bluetooth: btbcm: Fix logic error in forming the board name. 2023-04-20 12:35:06 +02:00
bus bus: imx-weim: fix branch condition evaluates to a garbage value 2023-03-30 12:49:29 +02:00
cdrom
char UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
clk This is the 6.1.25 stable release 2023-04-26 13:13:19 +00:00
clocksource FROMLIST: clocksource/drivers/timer-mediatek: Make timer-mediatek become loadable module 2023-05-09 09:49:00 +00:00
comedi
connector
counter counter: 104-quad-8: Fix Synapse action reported for Index signals 2023-04-13 16:55:31 +02:00
cpufreq ANDROID: cpufreq: times: record fast switch frequency transitions 2023-06-09 20:10:41 +00:00
cpuidle UPSTREAM: cpuidle: teo: Introduce util-awareness 2023-05-23 18:50:16 +00:00
crypto UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
cxl cxl/pci: Handle excessive CDAT length 2023-04-13 16:55:25 +02:00
dax UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
dca
devfreq
dio
dma UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
dma-buf UPSTREAM: dma-buf: fix an error pointer vs NULL bug 2023-08-15 16:58:34 +00:00
edac
eisa
extcon
firewire
firmware UPSTREAM: firmware: arm_sdei: Fix sleep from invalid context BUG 2023-06-14 16:40:59 +00:00
fpga UPSTREAM: fpga: bridge: properly initialize bridge device before populating children 2023-05-16 17:26:38 +00:00
fsi
gnss
gpio ANDROID: GKI: add kabi padding for structures for the android14 release 2023-06-07 14:24:51 +00:00
gpu UPSTREAM: dma-buf: fix an error pointer vs NULL bug 2023-08-15 16:58:34 +00:00
greybus
hid UPSTREAM: HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651. 2023-07-26 09:56:44 +00:00
hsi UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
hte
hv Merge 6.1.24 into android14-6.1 2023-04-22 08:52:25 +00:00
hwmon This is the 6.1.25 stable release 2023-04-26 13:13:19 +00:00
hwspinlock
hwtracing UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
i2c This is the 6.1.25 stable release 2023-04-26 13:13:19 +00:00
i3c
idle Revert "cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*" 2023-04-06 12:10:58 +02:00
iio UPSTREAM: iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() 2023-05-16 17:26:38 +00:00
infiniband UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
input UPSTREAM: Input: pegasus-notetaker - check pipe type when probing 2023-05-16 17:26:14 +00:00
interconnect interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT 2023-03-30 12:48:59 +02:00
iommu BACKPORT: mm: always expand the stack with the mmap write lock held 2023-07-27 11:47:21 +00:00
ipack
irqchip BACKPORT: FROMGIT: irqchip/gic-v3: Workaround for GIC-700 erratum 2941627 2023-07-27 19:40:08 +00:00
isdn
leds Revert "Revert "pwm: Make .get_state() callback return an error code"" 2023-05-11 05:22:29 +00:00
macintosh macintosh: windfarm: Use unsigned type for 1-bit bitfields 2023-03-17 08:50:31 +01:00
mailbox ANDROID: virt: gunyah: Sync with latest Gunyah patches 2023-06-14 22:02:31 +00:00
mcb
md ANDROID: vendor_hook: add hooks in dm_bufio.c 2023-05-25 05:10:22 +00:00
media UPSTREAM: media: usb: siano: Fix warning due to null work_func_t function pointer 2023-08-23 15:04:00 +01:00
memory memory: tegra30-emc: fix interconnect registration race 2023-03-22 13:33:56 +01:00
memstick UPSTREAM: memstick: r592: Fix UAF bug in r592_remove due to race condition 2023-06-19 14:56:51 +00:00
message FROMGIT: scsi: core: Change the return type of .eh_timed_out() 2023-03-15 16:17:14 +00:00
mfd ANDROID: GKI: regmap: Add regmap vendor hook for of_syscon_register 2023-07-13 02:22:21 +00:00
misc ANDROID: uid_sys_stats: Use llist for deferred work 2023-09-05 12:07:09 +00:00
mmc ANDROID: GKI: add kabi padding for structures for the android14 release 2023-06-07 14:24:51 +00:00
most
mtd mtd: spi-nor: fix memory leak when using debugfs_lookup() 2023-04-26 14:28:37 +02:00
mux
net UPSTREAM: net: tap_open(): set sk_uid from current_fsuid() 2023-09-04 09:44:46 +00:00
nfc nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition 2023-03-22 13:33:46 +01:00
ntb
nubus
nvdimm cxl/pmem: Fix nvdimm registration races 2023-03-10 09:34:20 +01:00
nvme Merge 55fba69fbf ("rust: kernel: Mark rust_fmt_argument as extern "C"") into android14-6.1 2023-05-09 03:32:41 +00:00
nvmem
of ANDROID: of: of_reserved_mem: Increase limit for reserved_mem regions 2023-03-22 14:27:16 +00:00
opp OPP: fix error checking in opp_migrate_dentry() 2023-03-10 09:33:01 +01:00
parisc
parport
pci ANDROID: GKI: pci: add Android ABI padding to some structures 2023-06-07 14:24:51 +00:00
pcmcia
peci
perf
phy phy: rockchip-typec: Fix unsigned comparison with less than zero 2023-03-11 13:55:40 +01:00
pinctrl Revert "pinctrl: amd: Disable and mask interrupts on resume" 2023-04-20 12:35:05 +02:00
platform platform/x86: asus-nb-wmi: Add quirk_asus_tablet_mode to other ROG Flow X13 models 2023-04-26 14:28:37 +02:00
pnp
power This is the 6.1.25 stable release 2023-04-26 13:13:19 +00:00
powercap powercap: fix possible name leak in powercap_register_zone() 2023-03-10 09:32:56 +01:00
pps
ps3
ptp ptp_qoriq: fix memory leak in probe() 2023-04-06 12:10:44 +02:00
pwm Revert "Revert "pwm: meson: Explicitly set .polarity in .get_state()"" 2023-05-11 05:22:29 +00:00
rapidio
ras
regulator regulator: fan53555: Fix wrong TCS_SLEW_MASK 2023-04-26 14:28:32 +02:00
remoteproc BACKPORT: firmware: qcom_scm: Use fixed width src vm bitmap 2023-05-16 20:35:28 +00:00
reset
rpmsg rpmsg: glink: Release driver_override 2023-03-10 09:33:45 +01:00
rtc rtc: allow rtc_read_alarm without read_alarm callback 2023-03-11 13:55:30 +01:00
s390 s390/vfio-ap: fix memory leak in vfio_ap device driver 2023-04-06 12:10:46 +02:00
sbus UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
scsi UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
sh
siox
slimbus
soc BACKPORT: firmware: qcom_scm: Use fixed width src vm bitmap 2023-05-16 20:35:28 +00:00
soundwire soundwire: cadence: Drain the RX FIFO after an IO timeout 2023-03-11 13:55:40 +01:00
spi Merge 55fba69fbf ("rust: kernel: Mark rust_fmt_argument as extern "C"") into android14-6.1 2023-05-09 03:32:41 +00:00
spmi
ssb
staging UPSTREAM: media: rkvdec: fix use after free bug in rkvdec_remove 2023-07-04 09:10:16 +00:00
target UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
tc
tee tee: amdtee: fix race condition in amdtee_open_session 2023-03-30 12:49:29 +02:00
thermal ANDROID: thermal: Add vendor thermal genl check 2023-07-19 15:23:51 -07:00
thunderbolt thunderbolt: Limit USB3 bandwidth of certain Intel USB4 host routers 2023-04-06 12:10:33 +02:00
tty UPSTREAM: tty: n_gsm: fix UAF in gsm_cleanup_mux 2023-08-16 09:18:40 +00:00
ufs UPSTREAM: scsi: ufs: core: Remove dedicated hwq for dev command 2023-07-04 09:08:44 +00:00
uio UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
usb UPSTREAM: usb: typec: ucsi: Fix command cancellation 2023-09-01 09:53:15 +00:00
vdpa UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
vfio UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
vhost UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
video UPSTREAM: fbdev: fix potential OOB read in fast_imageblit() 2023-07-26 09:56:38 +00:00
virt FROMLIST: virt: geniezone: Add dtb config support 2023-08-29 18:02:40 +00:00
virtio
vlynq
w1
watchdog watchdog: sbsa_wdog: Make sure the timeout programming is within the limits 2023-03-11 13:55:24 +01:00
xen UPSTREAM: mm: replace vma->vm_flags direct modifications with modifier calls 2023-06-07 14:24:57 +00:00
zorro
Kconfig
Makefile