Add support to check available CPUS for each cluster.
Change-Id: Ifc40333cdfe4e846b1cd527afc36a84f89bd8538
Signed-off-by: Shivnandan Kumar <quic_kshivnan@quicinc.com>
Binderfs binder-control devices are cleaned up via binderfs_evict_inode
too() which will use refcount_dec_and_test(). However, we missed to set
the refcount for binderfs binder-control devices and so we underflowed
when the binderfs instance got unmounted. Pretty obvious oversight and
should have been part of the more general UAF fix. The good news is that
having test cases (suprisingly) helps.
Technically, we could detect that we're about to cleanup the
binder-control dentry in binderfs_evict_inode() and then simply clean it
up. But that makes the assumption that the binder driver itself will
never make use of a binderfs binder-control device after the binderfs
instance it belongs to has been unmounted and the superblock for it been
destroyed. While it is unlikely to ever come to this let's be on the
safe side. Performance-wise this also really doesn't matter since the
binder-control device is only every really when creating the binderfs
filesystem or creating additional binder devices. Both operations are
pretty rare.
Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
Link: https://lore.kernel.org/r/CA+G9fYusdfg7PMfC9Xce-xLT7NiyKSbgojpK35GOm=Pf9jXXrA@mail.gmail.com
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20200311105309.1742827-1-christian.brauner@ubuntu.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 211b64e4b5b6bd5fdc19cd525c2cc9a90e6b0ec9)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Idb5e9e8945fa95506f3ff4f15bde3efaf65d7c9f
Git-commit: d2437b10ba
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
emulation_proc_handler() changes table->data for proc_dointvec_minmax
and can generate the following Oops if called concurrently with itself:
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
| Internal error: Oops: 96000006 [#1] SMP
| Call trace:
| update_insn_emulation_mode+0xc0/0x148
| emulation_proc_handler+0x64/0xb8
| proc_sys_call_handler+0x9c/0xf8
| proc_sys_write+0x18/0x20
| __vfs_write+0x20/0x48
| vfs_write+0xe4/0x1d0
| ksys_write+0x70/0xf8
| __arm64_sys_write+0x20/0x28
| el0_svc_common.constprop.0+0x7c/0x1c0
| el0_svc_handler+0x2c/0xa0
| el0_svc+0x8/0x200
To fix this issue, keep the table->data as &insn->current_mode and
use container_of() to retrieve the insn pointer. Another mutex is
used to protect against the current_mode update but not for retrieving
insn_emulation as table->data is no longer changing.
Bug: 237540956
Co-developed-by: hewenliang <hewenliang4@huawei.com>
Signed-off-by: hewenliang <hewenliang4@huawei.com>
Signed-off-by: Haibin Zhang <haibinzhang@tencent.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20220128090324.2727688-1-hewenliang4@huawei.com
Link: https://lore.kernel.org/r/9A004C03-250B-46C5-BF39-782D7551B00E@tencent.com
Signed-off-by: Will Deacon <will@kernel.org>
[Lee: Added Fixes: tag]
(cherry picked from commit af483947d472eccb79e42059276c4deed76f99a6
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-next/core)
Fixes: 587064b610 ("arm64: Add framework for legacy instruction emulation")
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If9b96bb79c79903f9d8292e719b06fdef57ef1c5
Git-commit: 5d2c9fe6e3
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
Frames are corrupted for higher resolution with default URB queue
size and frame size. This patch creates a sysfs node to support
dynamic setting of number of packers per urb and maximum packet
size for higher resolution frames.
$ find . -name urb_config.
$ echo qsize:fsize > urb_config.
Change-Id: I70aaad824049acdc21a8a52242066a6437b96833
Signed-off-by: Arjun Singh <quic_arsingh@quicinc.com>
Increase the total number of camera ID's supported.
Change-Id: Ib1eb78eb1d6686b28c90b06b87fa57bcc1f45c07
Signed-off-by: Waseem Akhtar <quic_wakhtar@quicinc.com>
When the kernel is configured with CONFIG_NR_CPUS smaller than the
number of CPU nodes in the device tree(DT), all the CPU nodes parsing
done to fetch topology information will fail. This is not reasonable
as it is valid to have all the physical CPUs in the system in the DT.
Let us just skip such CPU DT nodes that are not used in the kernel
rather than returning an error.
Change-Id: Ic7c50afd52741eb2a472fe33d532835f767e8d1c
Signed-off-by: Shivnandan Kumar <quic_kshivnan@quicinc.com>
In writeback cache mode mtime/ctime updates are cached, and flushed to the
server using the ->write_inode() callback.
Closing the file will result in a dirty inode being immediately written,
but in other cases the inode can remain dirty after all references are
dropped. This result in the inode being written back from reclaim, which
can deadlock on a regular allocation while the request is being served.
The usual mechanisms (GFP_NOFS/PF_MEMALLOC*) don't work for FUSE, because
serving a request involves unrelated userspace process(es).
Instead do the same as for dirty pages: make sure the inode is written
before the last reference is gone.
- fallocate(2)/copy_file_range(2): these call file_update_time() or
file_modified(), so flush the inode before returning from the call
- unlink(2), link(2) and rename(2): these call fuse_update_ctime(), so
flush the ctime directly from this helper
fuse_flush_time_update(inode) was skipped to call in __fuse_copy_file_range()
because of huge dependent changes.
Change-Id: I102dab1992c9ed2b5e89606265b3d3aa9c1cdb8a
Reported-by: chenguanyou <chenguanyou@xiaomi.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Git-commit: 5c791fe1e2a4f401f819065ea4fc0450849f1818
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Pradeep P V K <quic_pragalla@quicinc.com>
A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the
reference for a node. In this case, the target proc normally releases
the failed reference upon close as expected. However, if the target is
dying in parallel the call will race with binder_deferred_release(), so
the target could have released all of its references by now leaving the
cleanup of the new failed reference unhandled.
The transaction then ends and the target proc gets released making the
ref->proc now a dangling pointer. Later on, ref->node is closed and we
attempt to take spin_lock(&ref->proc->inner_lock), which leads to the
use-after-free bug reported below. Let's fix this by cleaning up the
failed reference on the spot instead of relying on the target to do so.
==================================================================
BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150
Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590
CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10
Hardware name: linux,dummy-virt (DT)
Workqueue: events binder_deferred_func
Call trace:
dump_backtrace.part.0+0x1d0/0x1e0
show_stack+0x18/0x70
dump_stack_lvl+0x68/0x84
print_report+0x2e4/0x61c
kasan_report+0xa4/0x110
kasan_check_range+0xfc/0x1a4
__kasan_check_write+0x3c/0x50
_raw_spin_lock+0xa8/0x150
binder_deferred_func+0x5e0/0x9b0
process_one_work+0x38c/0x5f0
worker_thread+0x9c/0x694
kthread+0x188/0x190
ret_from_fork+0x10/0x20
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Bug: 239630375
Link: https://lore.kernel.org/all/20220801182511.3371447-1-cmllamas@google.com/
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: I5085dd0dc805a780a64c057e5819f82dd8f02868
(cherry picked from commit ae3fa5d16a02ba7c7b170e0e1ab56d6f0ba33964)
Git-commit: 70f060f93c
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
Add SOC ID to support socinfo for Khaje IOT platform.
Change-Id: Ibcc958d1f7326afeccb53c5cf6582f7f2269b46b
Signed-off-by: Naina Mehta <quic_nainmeht@quicinc.com>
Add SOC ID to support socinfo for KhajeG platform.
Change-Id: Ie77ac540879e392754e51a3857c2c1317c2acb7c
Signed-off-by: Komal Bajaj <quic_kbajaj@quicinc.com>
Set the ipa3_ctx->logbuf NULL after destroy,or
IPAERR will use the ipa3_ctx->logbuf after free it,
that can make crash.
Change-Id: I470c4a043d426d7620c01fadac1f1cd12ad54b08
Signed-off-by: Veerendra Kumar Kamsali <quic_veekum@quicinc.com>
There is possiblity of setting wrong IIN value, if user vote
for greater then IIN_MAX (5000mA <), so fix this by updating
the IIN_MAX as IIN value.
Change-Id: I50df73d71514967d0d383d612f1c9ddba58437ce
Signed-off-by: Rakesh Kota <quic_kotarake@quicinc.com>
Cleaned debug log output when nordic
controllers notify data to HMD.
Change-Id: Ibd767d3db181ff7b2f99976e910a4fd2f6c85727
Signed-off-by: Wei Tan <quic_weitan@quicinc.com>
A check is introduced to restrict the double call of
hyp_assign_phys for the same address.
Change-Id: I0ac984af9fe456d317c7c2d99d6d1290f86830e8
Acked-by: Sandheep Balasubramanian <sandheep@qti.qualcomm.com>
Signed-off-by: Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
kcalloc returns out of memory in low memory conditions even if memory
is available in non-contiguous manner. This results in failure to
submit commands to ringbuffer. Use kvcalloc in place of kcalloc so
that when kcalloc fails in low memory conditions, commands can be
submitted if kvcalloc can provide enough memory.
Change-Id: If6a20e35983982b5c0888e5f7dabecfa8c026bcb
Signed-off-by: Pranav Patel <quic_pranavp@quicinc.com>
Add a check for valid cpu and create cpu isolation cooling
device only for those cpu's which passes this check.
Change-Id: Ic931a1aa51857ed109555e055879cb39da11f3cf
Signed-off-by: Priyansh Jain <quic_priyjain@quicinc.com>
Avoid dumping primary and secondary register dump
when crash happens in mission mode as these register might not
have correct info.
Change-Id: Ie6004924ecaf1c7177888c49303dbb221925dfc7
Signed-off-by: Nirav Shah <quic_nnshah@quicinc.com>
Ensure that thermal limits set by devfreq cooling framework,
limits framework and sysfs nodes (like gpu_max_clock) don't
overwrite each other, instead a consolidated (lowest of all)
limit is used as a final thermal limit. If this fails, fall back
to setting thermal_pwrlevel directly.
Change-Id: Ia6ec60e4881176da064c3cd5cf4ffd8e0a8e1046
Signed-off-by: Pranav Patel <quic_pranavp@quicinc.com>
Enable the flag required to support ICE Driver for
Full Disk Encryption feature.
Change-Id: Icd107924f7d1deb1bbb797f155bca8e6aebac72c
Signed-off-by: Abhinav Gupta <quic_abgupt@quicinc.com>
Due to mmc optimizations mmc host controllers are turned off during
mmc suspend. These clocks have to be turned ON during ICE program/evict
key. In PFK based FBE there would be numerous calls to program/evict
ICE key.
The change ensure required clocks are turned on before programming
crypto key to avoid any unclocked access.
Validations done:-
1) Flash P SDM660 build and let device bootup successfully to UI.
2) adb shell getprop ro.crypto.state: encrypted
adb shell getprop ro.crypto.type: file
3) Create files under /data and /data/misc/vold/user_key
4) Flash T build except userdata i.e. OTA to T.
5) Device able to boot successfully to UI.
6) Files created earlier got retained after flashing T build.
Change-Id: Ia1629a6b373895af42b1c724aebbe7ae6fc7de93
Signed-off-by: Pruthvi Kurada <quic_pkurada@quicinc.com>
Add support for 4-byte SDAM cookie, instead of 1-byte(default),
to make the SDAM corruption check more accurate.
Change-Id: I084c44eef08d4555896a7efb38a098420ebfec69
Signed-off-by: Kamal Wadhwa <quic_kamalw@quicinc.com>
Cleaned up and updated the driver for the
end-to-end scenario of XR reference device
connecting with the Remote VR controllers.
Change-Id: I1cb725c331b808addc7c5b8af0422ce616fa7f03
Signed-off-by: Wei Tan <quic_weitan@quicinc.com>
qctecmdr