aboutsummaryrefslogtreecommitdiff
path: root/fs
Commit message (Collapse)AuthorAgeFilesLines
* Merge tag 'android-7.1.1_r0.52' of ↵Arvin Quilao2017-04-061-0/+7
|\ | | | | | | | | | | https://android.googlesource.com/kernel/msm into cm-14.1 Android 7.1.1 Release 0.52 (N4F26W,seed)
| * sdcardfs: limit stacking depthAndrew Chant2017-02-141-0/+7
| | | | | | | | | | | | | | | | Limit filesystem stacking to prevent stack overflow. Bug: 32761463 Change-Id: I8b1462b9c0d6c7f00cf110724ffb17e7f307c51e Signed-off-by: Andrew Chant <achant@google.com>
* | ANDROID: vfs: Missed updating truncate to truncate2Daniel Rosenberg2017-03-071-1/+1
| | | | | | | | | | | | Bug: 30954918 Change-Id: I8163d3f86dd7aadb2ab3fc11816754f331986f05 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | BACKPORT: smarter propagate_mnt()Al Viro2017-03-073-77/+127
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current mainline has copies propagated to *all* nodes, then tears down the copies we made for nodes that do not contain counterparts of the desired mountpoint. That sets the right propagation graph for the copies (at teardown time we move the slaves of removed node to a surviving peer or directly to master), but we end up paying a fairly steep price in useless allocations. It's fairly easy to create a situation where N calls of mount(2) create exactly N bindings, with O(N^2) vfsmounts allocated and freed in process. Fortunately, it is possible to avoid those allocations/freeings. The trick is to create copies in the right order and find which one would've eventually become a master with the current algorithm. It turns out to be possible in O(nodes getting propagation) time and with no extra allocations at all. One part is that we need to make sure that eventual master will be created before its slaves, so we need to walk the propagation tree in a different order - by peer groups. And iterate through the peers before dealing with the next group. Another thing is finding the (earlier) copy that will be a master of one we are about to create; to do that we are (temporary) marking the masters of mountpoints we are attaching the copies to. Either we are in a peer of the last mountpoint we'd dealt with, or we have the following situation: we are attaching to mountpoint M, the last copy S_0 had been attached to M_0 and there are sequences S_0...S_n, M_0...M_n such that S_{i+1} is a master of S_{i}, S_{i} mounted on M{i} and we need to create a slave of the first S_{k} such that M is getting propagation from M_{k}. It means that the master of M_{k} will be among the sequence of masters of M. On the other hand, the nearest marked node in that sequence will either be the master of M_{k} or the master of M_{k-1} (the latter - in the case if M_{k-1} is a slave of something M gets propagation from, but in a wrong peer group). So we go through the sequence of masters of M until we find a marked one (P). Let N be the one before it. Then we go through the sequence of masters of S_0 until we find one (say, S) mounted on a node D that has P as master and check if D is a peer of N. If it is, S will be the master of new copy, if not - the master of S will be. That's it for the hard part; the rest is fairly simple. Iterator is in next_group(), handling of one prospective mountpoint is propagate_one(). It seems to survive all tests and gives a noticably better performance than the current mainline for setups that are seriously using shared subtrees. Change-Id: I45648e8a405544f768c5956711bdbdf509e2705a Cc: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* | BACKPORT: don't bother with propagate_mnt() unless the target is sharedAl Viro2017-03-071-10/+7
| | | | | | | | | | | | | | | | | | | | If the dest_mnt is not shared, propagate_mnt() does nothing - there's no mounts to propagate to and thus no copies to create. Might as well don't bother calling it in that case. Change-Id: Id94af8ad288bf9bfc6ffb5570562bbc2dc2e0d87 Cc: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* | ANDROID: mnt: remount should propagate to slaves of slavesDaniel Rosenberg2017-03-072-7/+22
| | | | | | | | | | | | | | | | | | | | propagate_remount was not accounting for the slave mounts of other slave mounts, leading to some namespaces not recieving the remount information. Signed-off-by: Daniel Rosenberg <drosen@google.com> Bug: 33731928 Change-Id: Idc9e8c2ed126a4143229fc23f10a959c2d0a3854
* | ANDROID: sdcardfs: Don't bother deleting freelistDaniel Rosenberg2017-03-071-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is no point deleting entries from dlist, as that is a temporary list on the stack from which contains only entries that are being deleted. Not all code paths set up dlist, so those that don't were performing invalid accesses in hash_del_rcu. As an additional means to prevent any other issue, we null out the list entries when we allocate from the cache. Signed-off-by: Daniel Rosenberg <drosen@google.com> Bug: 35666680 Change-Id: Ibb1e28c08c3a600c29418d39ba1c0f3db3bf31e5
* | ANDROID: sdcardfs: support direct-IO (DIO) operationsDaniel Rosenberg2017-03-072-17/+5
| | | | | | | | | | | | | | | | | | | | | | This comes from the wrapfs patch 2e346c83b26e Wrapfs: support direct-IO (DIO) operations Signed-off-by: Li Mengyang <li.mengyang@stonybrook.edu> Signed-off-by: Erez Zadok <ezk@cs.sunysb.edu> Signed-off-by: Daniel Rosenberg <drosen@google.com> Bug: 34133558 Change-Id: I3fd779c510ab70d56b1d918f99c20421b524cdc4
* | ANDROID: sdcardfs: implement vm_ops->page_mkwriteDaniel Rosenberg2017-03-071-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | This comes from the wrapfs patch 3dfec0ffe5e2 Wrapfs: implement vm_ops->page_mkwrite Some file systems (e.g., ext4) require it. Reported by Ted Ts'o. Signed-off-by: Erez Zadok <ezk@cs.sunysb.edu> Signed-off-by: Daniel Rosenberg <drosen@google.com> Bug: 34133558 Change-Id: I1a389b2422c654a6d3046bb8ec3e20511aebfa8e
* | ANDROID: sdcardfs: Add missing path_putDaniel Rosenberg2017-03-071-0/+1
| | | | | | | | | | | | | | | | | | | | "ANDROID: sdcardfs: Add GID Derivation to sdcardfs" introduced an unbalanced pat_get, leading to storage space not being freed after deleting a file until rebooting. This adds the missing path_put. Signed-off-by: Daniel Rosenberg <drosen@google.com> Bug: 34691169 Change-Id: Ia7ef97ec2eca2c555cc06b235715635afc87940e
* | ANDROID: sdcardfs: Fix incorrect hashDaniel Rosenberg2017-03-071-2/+6
| | | | | | | | | | | | | | | | | | This adds back the hash calculation removed as part of the previous patch, as it is in fact necessary. Signed-off-by: Daniel Rosenberg <drosen@google.com> Bug: 35307857 Change-Id: Ie607332bcf2c5d2efdf924e4060ef3f576bf25dc
* | ANDROID: sdcardfs: Switch strcasecmp for internal callDaniel Rosenberg2017-03-076-58/+78
| | | | | | | | | | | | | | | | | | This moves our uses of strcasecmp over to an internal call so we can easily change implementations later if we so desire. Additionally, we leverage qstr's where appropriate to save time on comparisons. Change-Id: I32fdc4fd0cd3b7b735dcfd82f60a2516fd8272a5 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | ANDROID: sdcardfs: switch to full_name_hash and qstrDaniel Rosenberg2017-03-071-81/+108
| | | | | | | | | | | | | | | | | | Use the kernel's string hash function instead of rolling our own. Additionally, save a bit of calculation by using the qstr struct in place of strings. Change-Id: I0bbeb5ec2a9233f40135ad632e6f22c30ffa95c1 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | ANDROID: sdcardfs: Add GID Derivation to sdcardfsDaniel Rosenberg2017-03-077-60/+429
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This changes sdcardfs to modify the user and group in the underlying filesystem depending on its usage. Ownership is set by Android user, and package, as well as if the file is under obb or cache. Other files can be labeled by extension. Those values are set via the configfs interace. To add an entry, mkdir -p [configfs root]/sdcardfs/extensions/[gid]/[ext] Bug: 34262585 Change-Id: I4e030ce84f094a678376349b1a96923e5076a0f4 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | ANDROID: sdcardfs: Remove redundant operationDaniel Rosenberg2017-03-071-11/+0
| | | | | | | | | | | | | | | | We call get_derived_permission_new unconditionally, so we don't need to call update_derived_permission_lock, which does the same thing. Change-Id: I0748100828c6af806da807241a33bf42be614935 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | ANDROID: sdcardfs: add support for user permission isolationDaniel Rosenberg2017-03-073-40/+284
| | | | | | | | | | | | | | | | | | | | | | This allows you to hide the existence of a package from a user by adding them to an exclude list. If a user creates that package's folder and is on the exclude list, they will not see that package's id. Bug: 34542611 Change-Id: I9eb82e0bf2457d7eb81ee56153b9c7d2f6646323 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | ANDROID: sdcardfs: Refactor configfs interfaceDaniel Rosenberg2017-03-071-80/+76
| | | | | | | | | | | | | | | | | | | | This refactors the configfs code to be more easily extended. It will allow additional files to be added easily. Bug: 34542611 Bug: 34262585 Change-Id: I73c9b0ae5ca7eb27f4ebef3e6807f088b512d539 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | ANDROID: sdcardfs: Allow non-owners to touchDaniel Rosenberg2017-03-071-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This modifies the permission checks in setattr to allow for non-owners to modify the timestamp of files to things other than the current time. This still requires write access, as enforced by the permission call, but relaxes the requirement that the caller must be the owner, allowing those with group permissions to change it as well. Bug: 11118565 Change-Id: Ied31f0cce2797675c7ef179eeb4e088185adcbad Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | constify ->actorAl Viro2017-03-075-38/+4
| | | | | | | | | | | | | | | | Change-Id: I75fcba66a9839c3be8dc11ced25105c87ac4ee65 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Git-commit: b2497fc3057ae27db9aa29579f16ae5afb6d6d08 Git-repo: https://android.googlesource.com/kernel/common.git Signed-off-by: Kaushal Kumar <kaushalk@codeaurora.org>
* | introduce ->iterate(), ctx->pos, dir_emit()Al Viro2017-03-072-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New method - ->iterate(file, ctx). That's the replacement for ->readdir(); it takes callback from ctx->actor, uses ctx->pos instead of file->f_pos and calls dir_emit(ctx, ...) instead of filldir(data, ...). It does *not* update file->f_pos (or look at it, for that matter); iterate_dir() does the update. Note that dir_emit() takes the offset from ctx->pos (and eventually filldir_t will lose that argument). Change-Id: I24c029f536689d809e804c6f742a5f28070e4a2e Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Git-commit: 83fd542759010949ac7d9638b615fac1bb9744e1 Git-repo: https://android.googlesource.com/kernel/common.git Signed-off-by: Kaushal Kumar <kaushalk@codeaurora.org>
* | introduce iterate_dir() and dir_contextAl Viro2017-03-075-12/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | iterate_dir(): new helper, replacing vfs_readdir(). struct dir_context: contains the readdir callback (and will get more stuff in it), embedded into whatever data that callback wants to deal with; eventually, we'll be passing it to ->readdir() replacement instead of (data,filldir) pair. Change-Id: I2285e5832093a0bbd7dd42b5e4cf26d62703c34e Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Git-commit: c301a0e047e401d41b26db1009d08e088ae2365a Git-repo: https://android.googlesource.com/kernel/common.git Signed-off-by: Kaushal Kumar <kaushalk@codeaurora.org>
* | vfs: Add setattr2 for filesystems with per mount permissionsDaniel Rosenberg2017-03-075-14/+29
| | | | | | | | | | | | | | | | | | | | This allows filesystems to use their mount private data to influence the permssions they use in setattr2. It has been separated into a new call to avoid disrupting current setattr users. Change-Id: I19959038309284448f1b7f232d579674ef546385 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | vfs: Allow filesystems to access their private mount dataDaniel Rosenberg2017-03-074-10/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Now we pass the vfsmount when mounting and remounting. This allows the filesystem to actually set up the mount specific data, although we can't quite do anything with it yet. show_options is expanded to include data that lives with the mount. To avoid changing existing filesystems, these have been added as new vfs functions. Change-Id: If80670bfad9f287abb8ac22457e1b034c9697097 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | mnt: Add filesystem private data to mount pointsDaniel Rosenberg2017-03-073-1/+42
| | | | | | | | | | | | | | | | | | | | | | This starts to add private data associated directly to mount points. The intent is to give filesystems a sense of where they have come from, as a means of letting a filesystem take different actions based on this information. Change-Id: Ie769d7b3bb2f5972afe05c1bf16cf88c91647ab2 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | fuse: Add support for d_canonical_pathDaniel Rosenberg2017-03-073-0/+53
| | | | | | | | | | | | | | | | | | | | | | | | Allows FUSE to report to inotify that it is acting as a layered filesystem. The userspace component returns a string representing the location of the underlying file. If the string cannot be resolved into a path, the top level path is returned instead. bug: 23904372 Change-Id: Iabdca0bbedfbff59e9c820c58636a68ef9683d9f Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | ANDROID: sdcardfs: Fix locking issue with permision fix upDaniel Rosenberg2017-03-071-21/+15
| | | | | | | | | | | | | | | | | | Don't use lookup_one_len so we can grab the spinlock that protects d_subdirs. Bug: 30954918 Change-Id: I0c6a393252db7beb467e0d563739a3a14e1b5115 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | sdcardfs: Use per mount permissionsDaniel Rosenberg2017-03-075-52/+150
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This switches sdcardfs over to using permission2. Instead of mounting several sdcardfs instances onto the same underlaying directory, you bind mount a single mount several times, and remount with the options you want. These are stored in the private mount data, allowing you to maintain the same tree, but have different permissions for different mount points. Warning functions have been added for permission, as it should never be called, and the correct behavior is unclear. Change-Id: I841b1d70ec60cf2b866fa48edeb74a0b0f8334f5 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | sdcardfs: Add gid and mask to private mount dataDaniel Rosenberg2017-03-073-18/+157
| | | | | | | | | | | | | | | | | | | | Adds support for mount2, remount2, and the functions to allocate/clone/copy the private data The next patch will switch over to actually using it. Change-Id: I8a43da26021d33401f655f0b2784ead161c575e3 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | sdcardfs: User new permission2 functionsDaniel Rosenberg2017-03-072-8/+22
| | | | | | | | | | Change-Id: Ic7e0fb8fdcebb31e657b079fe02ac834c4a50db9 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | sdcardfs: Move directory unlock before touchDaniel Rosenberg2017-03-071-3/+9
| | | | | | | | | | | | | | | | | | This removes a deadlock under low memory conditions. filp_open can call lookup_slow, which will attempt to lock the parent. Change-Id: I940643d0793f5051d1e79a56f4da2fa8ca3d8ff7 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | sdcardfs: fix external storage exporting incorrect uidalvin_liang2017-03-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | Symptom: App cannot write into per-app folder Root Cause: sdcardfs exports incorrect uid Solution: fix uid Project: All Note: Test done by RD: passed Change-Id: Iff64f6f40ba4c679f07f4426d3db6e6d0db7e3ca
* | sdcardfs: Added top to sdcardfs_inode_infoDaniel Rosenberg2017-03-076-56/+179
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adding packages to the package list and moving files takes a large amount of locks, and is currently a heavy operation. This adds a 'top' field to the inode_info, which points to the inode for the top most directory whose owner you would like to match. On permission checks and get_attr, we look up the owner based on the information at top. When we change a package mapping, we need only modify the information in the corresponding top inode_info's. When renaming, we must ensure top is set correctly in all children. This happens when an app specific folder gets moved outside of the folder for that app. Change-Id: Ib749c60b568e9a45a46f8ceed985c1338246ec6c Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | sdcardfs: Switch package list to RCUDaniel Rosenberg2017-03-073-112/+93
| | | | | | | | | | | | | | Switched the package id hashmap to use RCU. Change-Id: I9fdcab279009005bf28536247d11e13babab0b93 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | sdcardfs: Fix locking for permission fix upDaniel Rosenberg2017-03-073-9/+3
| | | | | | | | | | | | | | | | Iterating over d_subdirs requires taking d_lock. Removed several unneeded locks. Change-Id: I5b1588e54c7e6ee19b756d6705171c7f829e2650 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | sdcardfs: Check for other cases on path lookupDaniel Rosenberg2017-03-071-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | This fixes a bug where the first lookup of a file or folder created under a different view would not be case insensitive. It will now search through for a case insensitive match if the initial lookup fails. Bug:28024488 Change-Id: I4ff9ce297b9f2f9864b47540e740fd491c545229 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | sdcardfs: override umask on mkdir and createDaniel Rosenberg2017-03-072-35/+36
| | | | | | | | | | | | | | | | | | | | | | | | The mode on files created on the lower fs should not be affected by the umask of the calling task's fs_struct. Instead, we create a copy and modify it as needed. This also lets us avoid the string shenanigans around .nomedia files. Bug: 27992761 Change-Id: Ia3a6e56c24c6e19b3b01c1827e46403bb71c2f4c Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | ANDROID: sdcardfs: fix itnull.cocci warningsJulia Lawall2017-03-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | List_for_each_entry has the property that the first argument is always bound to a real list element, never NULL, so testing dentry is not needed. Generated by: scripts/coccinelle/iterators/itnull.cocci Change-Id: I51033a2649eb39451862b35b6358fe5cfe25c5f5 Cc: Daniel Rosenberg <drosen@google.com> Signed-off-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Guenter Roeck <groeck@chromium.org>
* | vfs: Add permission2 for filesystems with per mount permissionsDaniel Rosenberg2017-03-076-67/+149
| | | | | | | | | | | | | | | | | | | | This allows filesystems to use their mount private data to influence the permssions they return in permission2. It has been separated into a new call to avoid disrupting current permission users. Change-Id: I9d416e3b8b6eca84ef3e336bd2af89ddd51df6ca Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | vfs: change d_canonical_path to take two pathsDaniel Rosenberg2017-03-072-2/+6
| | | | | | | | | | | | bug: 23904372 Change-Id: I4a686d64b6de37decf60019be1718e1d820193e6 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | inotify: Fix erroneous update of bit countDaniel Rosenberg2017-03-071-1/+1
| | | | | | | | | | | | | | Patch "vfs: add d_canonical_path for stacked filesystem support" erroneously updated the ALL_INOTIFY_BITS count. This changes it back Change-Id: Idb04edc736da276159d30f04c40cff9d6b1e070f
* | vfs: add d_canonical_path for stacked filesystem supportDaniel Rosenberg2017-03-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Inotify does not currently know when a filesystem is acting as a wrapper around another fs. This means that inotify watchers will miss any modifications to the base file, as well as any made in a separate stacked fs that points to the same file. d_canonical_path solves this problem by allowing the fs to map a dentry to a path in the lower fs. Inotify can use it to find the appropriate place to watch to be informed of all changes to a file. Change-Id: I09563baffad1711a045e45c1bd0bd8713c2cc0b6 Signed-off-by: Daniel Rosenberg <drosen@google.com>
* | Revert "sdcardfs: Flag files as non-mappable"Arvin Quilao2017-03-071-8/+0
| | | | | | | | | | | | This reverts commit c58e6f11aa1253ebf301721acb21228b846b8975. Change-Id: I02101b0061e2e6f1c9c5fd5c46cb04f539a63c29
* | Merge tag 'android-7.1.1_r0.31' of ↵Arvin Quilao2017-02-113-6/+29
|\| | | | | | | | | | | | | | | https://android.googlesource.com/kernel/msm into HEAD Android 7.1.1 Release 0.31 (N4F26P,seed) Change-Id: I8d0feb72827ef1a65a50d486e151c19a2e6f4927
| * ext4: fix ext4_discard_allocated_blocks() if we can't allocate the paAriel Yin2016-12-061-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | struct If there is a failure while allocating the preallocation structure, a number of blocks can end up getting marked in the in-memory buddy bitmap, and then not getting released. This can result in the following corruption getting reported by the kernel: EXT4-fs error (device sda3): ext4_mb_generate_buddy:758: group 1126, 12793 clusters in bitmap, 12729 in gd In that case, we need to release the blocks using mb_free_blocks(). Tested: fs smoke test; also demonstrated that with injected errors, the file system is no longer getting corrupted Bug: 32645639 Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> Change-Id: I251a902541a566c1e4898fe02be1a345aefcd89d
| * fs/proc/array.c: make safe access to group_leaderAdrian Salido2016-12-051-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As mentioned in commit 52ee2dfdd4f51cf422ea6a96a0846dc94244aa37 ("pids: refactor vnr/nr_ns helpers to make them safe"). *_nr_ns helpers used to be buggy. The commit addresses most of the helpers but is missing task_tgid_xxx() Without this protection there is a possible use after free reported by kasan instrumented kernel: ================================================================== BUG: KASAN: use-after-free in task_tgid_nr_ns+0x2c/0x44 at addr *** Read of size 8 by task cat/2472 CPU: 1 PID: 2472 Comm: cat Tainted: **** Hardware name: Google Tegra210 Smaug Rev 1,3+ (DT) Call trace: [<ffffffc00020ad2c>] dump_backtrace+0x0/0x17c [<ffffffc00020aec0>] show_stack+0x18/0x24 [<ffffffc0011573d0>] dump_stack+0x94/0x100 [<ffffffc0003c7dc0>] kasan_report+0x308/0x554 [<ffffffc0003c7518>] __asan_load8+0x20/0x7c [<ffffffc00025a54c>] task_tgid_nr_ns+0x28/0x44 [<ffffffc00046951c>] proc_pid_status+0x444/0x1080 [<ffffffc000460f60>] proc_single_show+0x8c/0xdc [<ffffffc0004081b0>] seq_read+0x2e8/0x6f0 [<ffffffc0003d1420>] vfs_read+0xd8/0x1e0 [<ffffffc0003d1b98>] SyS_read+0x68/0xd4 Accessing group_leader while holding rcu_lock and using the now safe helpers introduced in the commit mentioned, this race condition is addressed. Signed-off-by: Adrian Salido <salidoa@google.com> Change-Id: I4315217922dda375a30a3581c0c1740dda7b531b Bug: 31495866
| * BACKPORT: aio: mark AIO pseudo-fs noexecAriel Yin2016-12-051-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This ensures that do_mmap() won't implicitly make AIO memory mappings executable if the READ_IMPLIES_EXEC personality flag is set. Such behavior is problematic because the security_mmap_file LSM hook doesn't catch this case, potentially permitting an attacker to bypass a W^X policy enforced by SELinux. I have tested the patch on my machine. To test the behavior, compile and run this: #define _GNU_SOURCE #include <unistd.h> #include <sys/personality.h> #include <linux/aio_abi.h> #include <err.h> #include <stdlib.h> #include <stdio.h> #include <sys/syscall.h> int main(void) { personality(READ_IMPLIES_EXEC); aio_context_t ctx = 0; if (syscall(__NR_io_setup, 1, &ctx)) err(1, "io_setup"); char cmd[1000]; sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'", (int)getpid()); system(cmd); return 0; } In the output, "rw-s" is good, "rwxs" is bad. Signed-off-by: Jann Horn <jann@thejh.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 22f6b4d34fcf039c63a94e7670e0da24f8575a5a) Bug: 31711619 Change-Id: I9f2872703bef240d6b82320c744529459bb076dc
| * UPSTREAM: block: fix use-after-free in sys_ioprio_get()Omar Sandoval2016-09-161-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (cherry picked from commit 8ba8682107ee2ca3347354e018865d8e1967c5f4) get_task_ioprio() accesses the task->io_context without holding the task lock and thus can race with exit_io_context(), leading to a use-after-free. The reproducer below hits this within a few seconds on my 4-core QEMU VM: int main(int argc, char **argv) { pid_t pid, child; long nproc, i; /* ioprio_set(IOPRIO_WHO_PROCESS, 0, IOPRIO_PRIO_VALUE(IOPRIO_CLASS_IDLE, 0)); */ syscall(SYS_ioprio_set, 1, 0, 0x6000); nproc = sysconf(_SC_NPROCESSORS_ONLN); for (i = 0; i < nproc; i++) { pid = fork(); assert(pid != -1); if (pid == 0) { for (;;) { pid = fork(); assert(pid != -1); if (pid == 0) { _exit(0); } else { child = wait(NULL); assert(child == pid); } } } pid = fork(); assert(pid != -1); if (pid == 0) { for (;;) { /* ioprio_get(IOPRIO_WHO_PGRP, 0); */ syscall(SYS_ioprio_get, 2, 0); } } } for (;;) { /* ioprio_get(IOPRIO_WHO_PGRP, 0); */ syscall(SYS_ioprio_get, 2, 0); } return 0; } This gets us KASAN dumps like this: [ 35.526914] ================================================================== [ 35.530009] BUG: KASAN: out-of-bounds in get_task_ioprio+0x7b/0x90 at addr ffff880066f34e6c [ 35.530009] Read of size 2 by task ioprio-gpf/363 [ 35.530009] ============================================================================= [ 35.530009] BUG blkdev_ioc (Not tainted): kasan: bad access detected [ 35.530009] ----------------------------------------------------------------------------- [ 35.530009] Disabling lock debugging due to kernel taint [ 35.530009] INFO: Allocated in create_task_io_context+0x2b/0x370 age=0 cpu=0 pid=360 [ 35.530009] ___slab_alloc+0x55d/0x5a0 [ 35.530009] __slab_alloc.isra.20+0x2b/0x40 [ 35.530009] kmem_cache_alloc_node+0x84/0x200 [ 35.530009] create_task_io_context+0x2b/0x370 [ 35.530009] get_task_io_context+0x92/0xb0 [ 35.530009] copy_process.part.8+0x5029/0x5660 [ 35.530009] _do_fork+0x155/0x7e0 [ 35.530009] SyS_clone+0x19/0x20 [ 35.530009] do_syscall_64+0x195/0x3a0 [ 35.530009] return_from_SYSCALL_64+0x0/0x6a [ 35.530009] INFO: Freed in put_io_context+0xe7/0x120 age=0 cpu=0 pid=1060 [ 35.530009] __slab_free+0x27b/0x3d0 [ 35.530009] kmem_cache_free+0x1fb/0x220 [ 35.530009] put_io_context+0xe7/0x120 [ 35.530009] put_io_context_active+0x238/0x380 [ 35.530009] exit_io_context+0x66/0x80 [ 35.530009] do_exit+0x158e/0x2b90 [ 35.530009] do_group_exit+0xe5/0x2b0 [ 35.530009] SyS_exit_group+0x1d/0x20 [ 35.530009] entry_SYSCALL_64_fastpath+0x1a/0xa4 [ 35.530009] INFO: Slab 0xffffea00019bcd00 objects=20 used=4 fp=0xffff880066f34ff0 flags=0x1fffe0000004080 [ 35.530009] INFO: Object 0xffff880066f34e58 @offset=3672 fp=0x0000000000000001 [ 35.530009] ================================================================== Fix it by grabbing the task lock while we poke at the io_context. Cc: stable@vger.kernel.org Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Omar Sandoval <osandov@fb.com> Signed-off-by: Jens Axboe <axboe@fb.com> Change-Id: I3f5858cc9a1b9d4124ae7a6578660dec219d2c57 Bug: 30946378
| * UPSTREAM: proc: prevent accessing /proc/<PID>/environ until it's readyMathias Krause2016-09-161-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (cherry picked from commit 8148a73c9901a8794a50f950083c00ccf97d43b3) If /proc/<PID>/environ gets read before the envp[] array is fully set up in create_{aout,elf,elf_fdpic,flat}_tables(), we might end up trying to read more bytes than are actually written, as env_start will already be set but env_end will still be zero, making the range calculation underflow, allowing to read beyond the end of what has been written. Fix this as it is done for /proc/<PID>/cmdline by testing env_end for zero. It is, apparently, intentionally set last in create_*_tables(). This bug was found by the PaX size_overflow plugin that detected the arithmetic underflow of 'this_len = env_end - (env_start + src)' when env_end is still zero. The expected consequence is that userland trying to access /proc/<PID>/environ of a not yet fully set up process may get inconsistent data as we're in the middle of copying in the environment variables. Fixes: https://forums.grsecurity.net/viewtopic.php?f=3&t=4363 Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=116461 Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Emese Revfy <re.emese@gmail.com> Cc: Pax Team <pageexec@freemail.hu> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Mateusz Guzik <mguzik@redhat.com> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Cyrill Gorcunov <gorcunov@openvz.org> Cc: Jarod Wilson <jarod@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Change-Id: Ia2f58d48c15478ed4b6e237b63e704c70ff21e96 Bug: 30951939
* | sdcardfs: Flag files as non-mappablefluxi2016-12-201-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement Samsung's FMODE_NONMAPPABLE flag from sdcardfs version 2.1.4 as we hit a BUG on ext4: [ 49.655037]@0 Kernel BUG at ffffffc0001deeec [verbose debug info unavailable] [ 49.655045]@0 Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 49.655052]@0 Modules linked in: [ 49.655061]@0 CPU: 0 PID: 283 Comm: kworker/u8:7 Tainted: G W 3.18.20-perf-g3be2054-00086-ga8307fb #1 [ 49.655070]@0 Hardware name: Qualcomm Technologies, Inc. MSM 8996 v3 + PMI8996 MTP (DT) [ 49.655077]@0 Workqueue: writeback bdi_writeback_workfn (flush-8:0) [ 49.655096]@0 task: ffffffc174ba8b00 ti: ffffffc174bb4000 task.ti: ffffffc174bb4000 [ 49.655108]@0 PC is at mpage_prepare_extent_to_map+0x198/0x218 [ 49.655116]@0 LR is at mpage_prepare_extent_to_map+0x110/0x218 [ 49.655121]@0 pc : [<ffffffc0001deeec>] lr : [<ffffffc0001dee64>] pstate: 60000145 [ 49.655126]@0 sp : ffffffc174bb7800 [ 49.655130]@0 x29: ffffffc174bb7800 x28: ffffffc174bb7880 [ 49.655140]@0 x27: 000000000000000d x26: ffffffc1245505e8 [ 49.655149]@0 x25: 0000000000000000 x24: 0000000000003400 [ 49.655160]@0 x23: ffffffffffffffff x22: 0000000000000000 [ 49.655172]@0 x21: ffffffc174bb7888 x20: ffffffc174bb79e0 [ 49.655182]@0 x19: ffffffbdc4ee7b80 x18: 0000007f92872000 [ 49.655191]@0 x17: 0000007f959b6424 x16: ffffffc00016d1ac [ 49.655201]@0 x15: 0000007f9285d158 x14: ffffffc1734796e8 [ 49.655210]@0 x13: ffffffbdc1ffa4c0 x12: ffffffbdc4ee7b80 [ 49.655220]@0 x11: 0000000000000100 x10: 0000000000000000 [ 49.655229]@0 x9 : 0000000000000000 x8 : ffffffc0b444e210 [ 49.655237]@0 x7 : 0000000000000000 x6 : ffffffc0b444e1e0 [ 49.655246]@0 x5 : 0000000000000000 x4 : 0000000000000001 [ 49.655254]@0 x3 : 0000000000000000 x2 : 400000000002003d [ 49.655263]@0 x1 : ffffffbdc4ee7b80 x0 : 400000000002003d [ 49.655271]@0 [ 49.656502]@0 Process kworker/u8:7 (pid: 283, stack limit = 0xffffffc174bb4058) [ 49.656509]@0 Call trace: [ 49.656514]@0 [<ffffffc0001deeec>] mpage_prepare_extent_to_map+0x198/0x218 [ 49.656526]@0 [<ffffffc0001e28d0>] ext4_writepages+0x270/0xa58 [ 49.656533]@0 [<ffffffc00012982c>] do_writepages+0x24/0x40 [ 49.656541]@0 [<ffffffc000180160>] __writeback_single_inode+0x40/0x114 [ 49.656549]@0 [<ffffffc000180e50>] writeback_sb_inodes+0x1dc/0x34c [ 49.656555]@0 [<ffffffc00018103c>] __writeback_inodes_wb+0x7c/0xc4 [ 49.656560]@0 [<ffffffc000181224>] wb_writeback+0x110/0x1a8 [ 49.656565]@0 [<ffffffc000181344>] wb_check_old_data_flush+0x88/0x98 [ 49.656571]@0 [<ffffffc00018156c>] bdi_writeback_workfn+0xf4/0x1fc [ 49.656576]@0 [<ffffffc0000b14f8>] process_one_work+0x1e0/0x300 [ 49.656585]@0 [<ffffffc0000b1e14>] worker_thread+0x318/0x438 [ 49.656590]@0 [<ffffffc0000b5da0>] kthread+0xe0/0xec [ 49.656598]@0 Code: f9400260 f9400a63 1ad92063 37580040 (e7f001f2) [ 49.656604]@0 ---[ end trace cbed09f772fd630d ]--- Conflicts: include/linux/fs.h mm/mmap.c Change-Id: I931da7cb3841db1f130dba298a7d256b6f02d1bc
* | sdcardfs: Truncate packages_gid.list on overflowDaniel Rosenberg2016-12-201-4/+11
| | | | | | | | | | | | | | | | | | | | packages_gid.list was improperly returning the wrong count. Use scnprintf instead, and inform the user that the list was truncated if it is. Bug: 30013843 Change-Id: Ida2b2ef7cd86dd87300bfb4c2cdb6bfe2ee1650d Signed-off-by: Daniel Rosenberg <drosen@google.com>
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-20 17:10:03 +0000