From cb4872d6e65dfbe3702119e450989ba04c9a95ee Mon Sep 17 00:00:00 2001 From: Nitin LNU Date: Fri, 14 Oct 2022 11:34:40 +0530 Subject: [PATCH 1/4] qseecom: Release ion buffer in case of keymaster TA For Keymaster TA we are not going to add it in to unload pending list as we should not unload keymaster TA and as soon as unload request come we should release Buffer and return. Change-Id: Icba33195794aacde1c3b3ade5432fabbc27db608 Signed-off-by: Nitin LNU Signed-off-by: Nageswara reddy Karnati --- drivers/misc/qseecom.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c index 5d35f4be132e..0c5dfee9b71a 100644 --- a/drivers/misc/qseecom.c +++ b/drivers/misc/qseecom.c @@ -3153,6 +3153,30 @@ static int qseecom_prepare_unload_app(struct qseecom_dev_handle *data) pr_debug("prepare to unload app(%d)(%s), pending %d\n", data->client.app_id, data->client.app_name, data->client.unload_pending); + + /* For keymaster we are not going to unload so no need to add it in + * unload app pending list as soon as we identify release ion buffer + * and return . + */ + if (!memcmp(data->client.app_name, "keymaste", strlen("keymaste"))) { + if (data->client.dmabuf) { + /* Each client will get same KM TA loaded handle but + * will allocate separate shared buffer during + * loading of TA, as client can't unload KM TA so we + * will only free out shared buffer and return early + * to avoid any ion buffer leak. + */ + qseecom_vaddr_unmap(data->client.sb_virt, + data->client.sgt, data->client.attach, + data->client.dmabuf); + MAKE_NULL(data->client.sgt, + data->client.attach, data->client.dmabuf); + } + __qseecom_free_tzbuf(&data->sglistinfo_shm); + data->released = true; + return 0; + } + if (data->client.unload_pending) return 0; entry = kzalloc(sizeof(*entry), GFP_KERNEL); From 0dfd96ad528092f27f6b49c46562133e1278b01b Mon Sep 17 00:00:00 2001 From: Suren Baghdasaryan Date: Wed, 24 Nov 2021 15:59:05 -0800 Subject: [PATCH 2/4] BACKPORT: FROMLIST: mm: protect free_pgtables with mmap_lock write lock in exit_mmap oom-reaper and process_mrelease system call should protect against races with exit_mmap which can destroy page tables while they walk the VMA tree. oom-reaper protects from that race by setting MMF_OOM_VICTIM and by relying on exit_mmap to set MMF_OOM_SKIP before taking and releasing mmap_write_lock. process_mrelease has to elevate mm->mm_users to prevent such race. Both oom-reaper and process_mrelease hold mmap_read_lock when walking the VMA tree. The locking rules and mechanisms could be simpler if exit_mmap takes mmap_write_lock while executing destructive operations such as free_pgtables. Change exit_mmap to hold the mmap_write_lock when calling free_pgtables. Operations like unmap_vmas() and unlock_range() are not destructive and could run under mmap_read_lock but for simplicity we take one mmap_write_lock during almost the entire operation. Note also that because oom-reaper checks VM_LOCKED flag, unlock_range() should not be allowed to race with it. In most cases this lock should be uncontended. Previously, Kirill reported ~4% regression caused by a similar change [1]. We reran the same test and although the individual results are quite noisy, the percentiles show lower regression with 1.6% being the worst case [2]. The change allows oom-reaper and process_mrelease to execute safely under mmap_read_lock without worries that exit_mmap might destroy page tables from under them. [1] https://lore.kernel.org/all/20170725141723.ivukwhddk2voyhuc@node.shutemov.name/ [2] https://lore.kernel.org/all/CAJuCfpGC9-c9P40x7oy=jy5SphMcd0o0G_6U1-+JAziGKG6dGA@mail.gmail.com/ Signed-off-by: Suren Baghdasaryan Link: https://lore.kernel.org/all/20211124235906.14437-1-surenb@google.com/ Bug: 130172058 Bug: 189803002 Change-Id: Ic87272d09a0b68a1b0e968e8f1a1510fd6fc776a Git-commit: 28358ebf2adb31117893813992fefcfd359a6a16 Git-repo: https://android.googlesource.com/kernel/common/ [quic_gkohli@quicinc.com: Resolved cherry-pick conflict in mm/mmap.c due to mmap lock was implemented differently in older kernel, and Although process_mrelease is not applicable in older kernel, but this patch is required to take exclusive lock in exit_mmap path so that SPF knows an isolated vma was freed from this path] Signed-off-by: Gaurav Kohli Signed-off-by: Srinivasarao Pathipati --- mm/mmap.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index b23744449d8e..94509df0cc09 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -3178,10 +3178,9 @@ void exit_mmap(struct mm_struct *mm) (void)__oom_reap_task_mm(mm); set_bit(MMF_OOM_SKIP, &mm->flags); - down_write(&mm->mmap_sem); - up_write(&mm->mmap_sem); } + down_write(&mm->mmap_sem); if (mm->locked_vm) { vma = mm->mmap; while (vma) { @@ -3194,8 +3193,11 @@ void exit_mmap(struct mm_struct *mm) arch_exit_mmap(mm); vma = mm->mmap; - if (!vma) /* Can happen if dup_mmap() received an OOM */ + if (!vma) { + /* Can happen if dup_mmap() received an OOM */ + up_write(&mm->mmap_sem);; return; + } lru_add_drain(); flush_cache_mm(mm); @@ -3206,16 +3208,14 @@ void exit_mmap(struct mm_struct *mm) free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING); tlb_finish_mmu(&tlb, 0, -1); - /* - * Walk the list again, actually closing and freeing it, - * with preemption enabled, without holding any MM locks. - */ + /* Walk the list again, actually closing and freeing it. */ while (vma) { if (vma->vm_flags & VM_ACCOUNT) nr_accounted += vma_pages(vma); vma = remove_vma(vma); cond_resched(); } + up_write(&mm->mmap_sem); vm_unacct_memory(nr_accounted); } From d34c7430e4c0cc710d0b7260b5b7384ba977785a Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Mon, 31 Jan 2022 16:09:47 -0800 Subject: [PATCH 3/4] exec: Force single empty string when argv is empty commit dcd46d897adb70d63e025f175a00a89797d31a43 upstream. Quoting[1] Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve(2) be the name of a program, thus prohibiting a scenario where argc < 1. POSIX 2017 also recommends this behaviour, but it is not an explicit requirement[2]: The argument arg0 should point to a filename string that is associated with the process being started by one of the exec functions. ... Interestingly, Michael Kerrisk opened an issue about this in 2008[3], but there was no consensus to support fixing this issue then. Hopefully now that CVE-2021-4034 shows practical exploitative use[4] of this bug in a shellcode, we can reconsider. This issue is being tracked in the KSPP issue tracker[5]." While the initial code searches[6][7] turned up what appeared to be mostly corner case tests, trying to that just reject argv == NULL (or an immediately terminated pointer list) quickly started tripping[8] existing userspace programs. The next best approach is forcing a single empty string into argv and adjusting argc to match. The number of programs depending on argc == 0 seems a smaller set than those calling execve with a NULL argv. Account for the additional stack space in bprm_stack_limits(). Inject an empty string when argc == 0 (and set argc = 1). Warn about the case so userspace has some notice about the change: process './argc0' launched './argc0' with NULL argv: empty string added Additionally WARN() and reject NULL argv usage for kernel threads. [1] https://lore.kernel.org/lkml/20220127000724.15106-1-ariadne@dereferenced.org/ [2] https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html [3] https://bugzilla.kernel.org/show_bug.cgi?id=8408 [4] https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt [5] https://github.com/KSPP/linux/issues/176 [6] https://codesearch.debian.net/search?q=execve%5C+*%5C%28%5B%5E%2C%5D%2B%2C+*NULL&literal=0 [7] https://codesearch.debian.net/search?q=execlp%3F%5Cs*%5C%28%5B%5E%2C%5D%2B%2C%5Cs*NULL&literal=0 [8] https://lore.kernel.org/lkml/20220131144352.GE16385@xsang-OptiPlex-9020/ Change-Id: Ie940481088d6b5de45f450501144585dba003a5e Reported-by: Ariadne Conill Reported-by: Michael Kerrisk Cc: Matthew Wilcox Cc: Christian Brauner Cc: Rich Felker Cc: Eric Biederman Cc: Alexander Viro Cc: linux-fsdevel@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Acked-by: Christian Brauner Acked-by: Ariadne Conill Acked-by: Andy Lutomirski Link: https://lore.kernel.org/r/20220201000947.2453721-1-keescook@chromium.org [vegard: fixed conflicts due to missing 886d7de631da71e30909980fdbf318f7caade262^- and 3950e975431bc914f7e81b8f2a2dbdf2064acb0f^- and 655c16a8ce9c15842547f40ce23fd148aeccc074] Signed-off-by: Vegard Nossum Signed-off-by: Greg Kroah-Hartman Git-commit: b50fb8dbc8b81aaa126387de428f4c42a7c72a73 Git-repo: https://android.googlesource.com/kernel/common/ Signed-off-by: Srinivasarao Pathipati --- fs/exec.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/fs/exec.c b/fs/exec.c index 17d7f8a66167..82d552981719 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1805,6 +1805,9 @@ static int __do_execve_file(int fd, struct filename *filename, goto out_unmark; bprm->argc = count(argv, MAX_ARG_STRINGS); + if (bprm->argc == 0) + pr_warn_once("process '%s' launched '%s' with NULL argv: empty string added\n", + current->comm, bprm->filename); if ((retval = bprm->argc) < 0) goto out; @@ -1829,6 +1832,20 @@ static int __do_execve_file(int fd, struct filename *filename, if (retval < 0) goto out; + /* + * When argv is empty, add an empty string ("") as argv[0] to + * ensure confused userspace programs that start processing + * from argv[1] won't end up walking envp. See also + * bprm_stack_limits(). + */ + if (bprm->argc == 0) { + const char *argv[] = { "", NULL }; + retval = copy_strings_kernel(1, argv, bprm); + if (retval < 0) + goto out; + bprm->argc = 1; + } + retval = exec_binprm(bprm); if (retval < 0) goto out; From e71eeae71237b09c10e2d3c4ff23c483aafb2def Mon Sep 17 00:00:00 2001 From: Fakruddin Vohra Date: Fri, 18 Aug 2023 11:32:56 +0530 Subject: [PATCH 4/4] mdm: dataipa: increase the size of prefetch buffer prefetch buffer is updated from 128 to 256 byte for route and filter rule read. Change-Id: Ibddddfda355e8032d6ec40da73394037534d1d78 Signed-off-by: Fakruddin Vohra --- drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_fltrt_i.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_fltrt_i.h b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_fltrt_i.h index 283786236a07..0200541c2764 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_fltrt_i.h +++ b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_fltrt_i.h @@ -44,7 +44,7 @@ enum ipa_fltrt_equations { #define IPA3_0_HW_TBL_ADDR_MASK (127) #define IPA3_0_HW_RULE_BUF_SIZE (256) #define IPA3_0_HW_RULE_START_ALIGNMENT (7) -#define IPA3_0_HW_RULE_PREFETCH_BUF_SIZE (128) +#define IPA3_0_HW_RULE_PREFETCH_BUF_SIZE (256) /*